1 files changed, 69 insertions, 14 deletions

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index ae959e950174..77be396ca633 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -2,7 +2,6 @@
 #define _NET_XFRM_H
 
 #include <linux/compiler.h>
-#include <linux/in.h>
 #include <linux/xfrm.h>
 #include <linux/spinlock.h>
 #include <linux/list.h>
@@ -12,9 +11,11 @@
 #include <linux/ipsec.h>
 #include <linux/in6.h>
 #include <linux/mutex.h>
+#include <linux/audit.h>
 
 #include <net/sock.h>
 #include <net/dst.h>
+#include <net/ip.h>
 #include <net/route.h>
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
@@ -278,6 +279,7 @@ struct xfrm_type
         __u8                    proto;
         __u8                    flags;
 #define XFRM_TYPE_NON_FRAGMENT  1
+#define XFRM_TYPE_REPLAY_PROT   2
 
         int                     (*init_state)(struct xfrm_state *x);
         void                    (*destructor)(struct xfrm_state *);
@@ -298,6 +300,18 @@ extern void xfrm_put_type(struct xfrm_type *type);
 
 struct xfrm_mode {
         int (*input)(struct xfrm_state *x, struct sk_buff *skb);
+
+        /*
+         * Add encapsulation header.
+         *
+         * On exit, the transport header will be set to the start of the
+         * encapsulation header to be filled in by x->type->output and
+         * the mac header will be set to the nextheader (protocol for
+         * IPv4) field of the extension header directly preceding the
+         * encapsulation header, or in its absence, that of the top IP
+         * header.  The value of the network header will always point
+         * to the top IP header while skb->data will point to the payload.
+         */
         int (*output)(struct xfrm_state *x,struct sk_buff *skb);
 
         struct module *owner;
@@ -418,18 +432,66 @@ extern int xfrm_unregister_km(struct xfrm_mgr *km);
 
 extern unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];
 
+/*
+ * This structure is used for the duration where packets are being
+ * transformed by IPsec.  As soon as the packet leaves IPsec the
+ * area beyond the generic IP part may be overwritten.
+ */
+struct xfrm_skb_cb {
+        union {
+                struct inet_skb_parm h4;
+                struct inet6_skb_parm h6;
+        } header;
+
+        /* Sequence number for replay protection. */
+        u64 seq;
+};
+
+#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
+
 /* Audit Information */
 struct xfrm_audit
 {
-        uid_t   loginuid;
+        u32     loginuid;
         u32     secid;
 };
 
 #ifdef CONFIG_AUDITSYSCALL
-extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
-                    struct xfrm_policy *xp, struct xfrm_state *x);
+static inline struct audit_buffer *xfrm_audit_start(u32 auid, u32 sid)
+{
+        struct audit_buffer *audit_buf = NULL;
+        char *secctx;
+        u32 secctx_len;
+
+        audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
+                              AUDIT_MAC_IPSEC_EVENT);
+        if (audit_buf == NULL)
+                return NULL;
+
+        audit_log_format(audit_buf, "auid=%u", auid);
+
+        if (sid != 0 &&
+            security_secid_to_secctx(sid, &secctx, &secctx_len) == 0) {
+                audit_log_format(audit_buf, " subj=%s", secctx);
+                security_release_secctx(secctx, secctx_len);
+        } else
+                audit_log_task_context(audit_buf);
+        return audit_buf;
+}
+
+extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
+                                  u32 auid, u32 sid);
+extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
+                                  u32 auid, u32 sid);
+extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
+                                 u32 auid, u32 sid);
+extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
+                                    u32 auid, u32 sid);
 #else
-#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0)
+#define xfrm_audit_policy_add(x, r, a, s)       do { ; } while (0)
+#define xfrm_audit_policy_delete(x, r, a, s)    do { ; } while (0)
+#define xfrm_audit_state_add(x, r, a, s)        do { ; } while (0)
+#define xfrm_audit_state_delete(x, r, a, s)     do { ; } while (0)
 #endif /* CONFIG_AUDITSYSCALL */
 
 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
@@ -585,7 +647,6 @@ static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ct
 struct xfrm_dst
 {
         union {
-                struct xfrm_dst         *next;
                 struct dst_entry        dst;
                 struct rtable           rt;
                 struct rt6_info         rt6;
@@ -982,9 +1043,9 @@ extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si);
 extern int xfrm_replay_check(struct xfrm_state *x, __be32 seq);
 extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
 extern void xfrm_replay_notify(struct xfrm_state *x, int event);
-extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
 extern int xfrm_init_state(struct xfrm_state *x);
+extern int xfrm_output(struct sk_buff *skb);
 extern int xfrm4_rcv(struct sk_buff *skb);
 extern int xfrm4_output(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
@@ -1035,7 +1096,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
 struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err);
 int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
 u32 xfrm_get_acqseq(void);
-void xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi);
+extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
 struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
                                   xfrm_address_t *daddr, xfrm_address_t *saddr,
                                   int create, unsigned short family);
@@ -1114,12 +1175,6 @@ static inline int xfrm_aevent_is_on(void)
         return ret;
 }
 
-static inline void xfrm_aevent_doreplay(struct xfrm_state *x)
-{
-        if (xfrm_aevent_is_on())
-                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
-}
-
 #ifdef CONFIG_XFRM_MIGRATE
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {