+	u32			index;+	struct xfrm_selector	selector;+	struct xfrm_lifetime_cfg lft;+	struct xfrm_lifetime_cur curlft;+	struct dst_entry       *bundles;+	__u16			family;+	__u8			action;+	__u8			flags;+	__u8			dead;+	__u8			xfrm_nr;+	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];+};++#define XFRM_KM_TIMEOUT		30++struct xfrm_mgr+{+	struct list_head	list;+	char			*id;+	int			(*notify)(struct xfrm_state *x, struct km_event *c);+	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);+	struct xfrm_policy	*(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);+	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);+	int			(*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);+};++extern int xfrm_register_km(struct xfrm_mgr *km);+extern int xfrm_unregister_km(struct xfrm_mgr *km);+++extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];++static inline void xfrm_pol_hold(struct xfrm_policy *policy)+{+	if (likely(policy != NULL))+		atomic_inc(&policy->refcnt);+}++extern void __xfrm_policy_destroy(struct xfrm_policy *policy);++static inline void xfrm_pol_put(struct xfrm_policy *policy)+{+	if (atomic_dec_and_test(&policy->refcnt))+		__xfrm_policy_destroy(policy);+}++#define XFRM_DST_HSIZE		1024++static __inline__+unsigned __xfrm4_dst_hash(xfrm_address_t *addr)+{+	unsigned h;+	h = ntohl(addr->a4);+	h = (h ^ (h>>16)) % XFRM_DST_HSIZE;+	return h;+}++static __inline__+unsigned __xfrm6_dst_hash(xfrm_address_t *addr)+{+	unsigned h;+	h = ntohl(addr->a6[2]^addr->a6[3]);+	h = (h ^ (h>>16)) % XFRM_DST_HSIZE;+	return h;+}++static __inline__+unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)+{+	switch (family) {+	case AF_INET:+		return __xfrm4_dst_hash(addr);+	case AF_INET6:+		return __xfrm6_dst_hash(addr);+	}+	return 0;+}++static __inline__+unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)+{+	unsigned h;+	h = ntohl(addr->a4^spi^proto);+	h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;+	return h;+}++static __inline__+unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)+{+	unsigned h;+	h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);+	h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;+	return h;+}++static __inline__+unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)+{+	switch (family) {+	case AF_INET:+		return __xfrm4_spi_hash(addr, spi, proto);+	case AF_INET6:+		return __xfrm6_spi_hash(addr, spi, proto);+	}+	return 0;	/*XXX*/+}++extern void __xfrm_state_destroy(struct xfrm_state *);++static inline void xfrm_state_put(struct xfrm_state *x)+{+	if (atomic_dec_and_test(&x->refcnt))+		__xfrm_state_destroy(x);+}++static inline void xfrm_state_hold(struct xfrm_state *x)+{+	atomic_inc(&x->refcnt);+}++static __inline__ int addr_match(void *token1, void *token2, int prefixlen)+{+	__u32 *a1 = token1;+	__u32 *a2 = token2;+	int pdw;+	int pbi;++	pdw = prefixlen >> 5;	  /* num of whole __u32 in prefix */+	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */++	if (pdw)+		if (memcmp(a1, a2, pdw << 2))+			return 0;++	if (pbi) {+		__u32 mask;++		mask = htonl((0xffffffff) << (32 - pbi));++		if ((a1[pdw] ^ a2[pdw]) & mask)+			return 0;+	}++	return 1;+}++static __inline__+u16 xfrm_flowi_sport(struct flowi *fl)+{+	u16 port;+	switch(fl->proto) {+	case IPPROTO_TCP:+	case IPPROTO_UDP:+	case IPPROTO_SCTP:+		port = fl->fl_ip_sport;+		break;+	case IPPROTO_ICMP:+	case IPPROTO_ICMPV6:+		port = htons(fl->fl_icmp_type);+		break;+	default:+		port = 0;	/*XXX*/+	}+	return port;+}++static __inline__+u16 xfrm_flowi_dport(struct flowi *fl)+{+	u16 port;+	switch(fl->proto) {+	case IPPROTO_TCP:+	case IPPROTO_UDP:+	case IPPROTO_SCTP:+		port = fl->fl_ip_dport;+		break;+	case IPPROTO_ICMP:+	case IPPROTO_ICMPV6:+		port = htons(fl->fl_icmp_code);+		break;+	default:+		port = 0;	/*XXX*/+	}+	return port;+}++static inline int+__xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)+{+	return  addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&+		addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&+		!((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&+		!((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&+		(fl->proto == sel->proto || !sel->proto) &&+		(fl->oif == sel->ifindex || !sel->ifindex);+}++static inline int+__xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)+{+	return  addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&+		addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&+		!((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&+		!((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&+		(fl->proto == sel->proto || !sel->proto) &&+		(fl->oif == sel->ifindex || !sel->ifindex);+}++static inline int+xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,+		    unsigned short family)+{+	switch (family) {+	case AF_INET:+		return __xfrm4_selector_match(sel, fl);+	case AF_INET6:+		return __xfrm6_selector_match(sel, fl);+	}+	return 0;+}++/* A struct encoding bundle of transformations to apply to some set of flow.+ *+ * dst->child points to the next element of bundle.+ * dst->xfrm  points to an instanse of transformer.+ *+ * Due to unfortunate limitations of current routing cache, which we+ * have no time to fix, it mirrors struct rtable and bound to the same+ * routing key, including saddr,daddr. However, we can have many of+ * bundles differing by session id. All the bundles grow from a parent+ * policy rule.+ */+struct xfrm_dst+{+	union {+		struct xfrm_dst		*next;+		struct dst_entry	dst;+		struct rtable		rt;+		struct rt6_info		rt6;+	} u;+	struct dst_entry *route;+	u32 route_mtu_cached;+	u32 child_mtu_cached;+	u32 route_cookie;+	u32 path_cookie;+};++static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)+{+	dst_release(xdst->route);+	if (likely(xdst->u.dst.xfrm))+		xfrm_state_put(xdst->u.dst.xfrm);+}++extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);++/* Decapsulation state, used by the input to store data during+ * decapsulation procedure, to be used later (during the policy+ * check+ */+struct xfrm_decap_state {+	char	decap_data[20];+	__u16	decap_type;+};   ++struct sec_decap_state {+	struct xfrm_state	*xvec;+	struct xfrm_decap_state decap;+};++struct sec_path+{+	atomic_t		refcnt;+	int			len;+	struct sec_decap_state	x[XFRM_MAX_DEPTH];+};++static inline struct sec_path *+secpath_get(struct sec_path *sp)+{+	if (sp)+		atomic_inc(&sp->refcnt);+	return sp;+}++extern void __secpath_destroy(struct sec_path *sp);++static inline void+secpath_put(struct sec_path *sp)+{+	if (sp && atomic_dec_and_test(&sp->refcnt))+		__secpath_destroy(sp);+}++extern struct sec_path *secpath_dup(struct sec_path *src);++static inline void+secpath_reset(struct sk_buff *skb)+{+#ifdef CONFIG_XFRM+	secpath_put(skb->sp);+	skb->sp = NULL;+#endif+}++static inline int+__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)+{+	return	(tmpl->saddr.a4 &&+		 tmpl->saddr.a4 != x->props.saddr.a4);+}++static inline int+__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)+{+	return	(!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&+		 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));+}++static inline int+xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)+{+	switch (family) {+	case AF_INET:+		return __xfrm4_state_addr_cmp(tmpl, x);+	case AF_INET6:+		return __xfrm6_state_addr_cmp(tmpl, x);+	}+	return !0;+}++#ifdef CONFIG_XFRM++extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);++static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)+{+	if (sk && sk->sk_policy[XFRM_POLICY_IN])+		return __xfrm_policy_check(sk, dir, skb, family);+		+	return	(!xfrm_policy_list[dir] && !skb->sp) ||+		(skb->dst->flags & DST_NOPOLICY) ||+		__xfrm_policy_check(sk, dir, skb, family);+}++static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)+{+	return xfrm_policy_check(sk, dir, skb, AF_INET);+}++static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)+{+	return xfrm_policy_check(sk, dir, skb, AF_INET6);+}+++extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);++static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)+{+	return	!xfrm_policy_list[XFRM_POLICY_OUT] ||+		(skb->dst->flags & DST_NOXFRM) ||+		__xfrm_route_forward(skb, family);+}++static inline int xfrm4_route_forward(struct sk_buff *skb)+{+	return xfrm_route_forward(skb, AF_INET);+}++static inline int xfrm6_route_forward(struct sk_buff *skb)+{+	return xfrm_route_forward(skb, AF_INET6);+}++extern int __xfrm_sk_clone_policy(struct sock *sk);++static inline int xfrm_sk_clone_policy(struct sock *sk)+{+	if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))+		return __xfrm_sk_clone_policy(sk);+	return 0;+}++extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);++static inline void xfrm_sk_free_policy(struct sock *sk)+{+	if (unlikely(sk->sk_policy[0] != NULL)) {+		xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);+		sk->sk_policy[0] = NULL;+	}+	if (unlikely(sk->sk_policy[1] != NULL)) {+		xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);+		sk->sk_policy[1] = NULL;+	}+}++#else++static inline void xfrm_sk_free_policy(struct sock *sk) {}+static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }+static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }  +static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } +static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)+{ +	return 1; +} +static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)+{+	return 1;+}+static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)+{+	return 1;+}+#endif++static __inline__+xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)+{+	switch (family){+	case AF_INET:+		return (xfrm_address_t *)&fl->fl4_dst;+	case AF_INET6:+		return (xfrm_address_t *)&fl->fl6_dst;+	}+	return NULL;+}++static __inline__+xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)+{+	switch (family){+	case AF_INET:+		return (xfrm_address_t *)&fl->fl4_src;+	case AF_INET6:+		return (xfrm_address_t *)&fl->fl6_src;+	}+	return NULL;+}++static __inline__ int+__xfrm4_state_addr_check(struct xfrm_state *x,+			 xfrm_address_t *daddr, xfrm_address_t *saddr)+{+	if (daddr->a4 == x->id.daddr.a4 &&+	    (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))+		return 1;+	return 0;+}++static __inline__ int+__xfrm6_state_addr_check(struct xfrm_state *x,+			 xfrm_address_t *daddr, xfrm_address_t *saddr)+{+	if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&+	    (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)|| +	     ipv6_addr_any((struct in6_addr *)saddr) || +	     ipv6_addr_any((struct in6_addr *)&x->props.saddr)))+		return 1;+	return 0;+}++static __inline__ int+xfrm_state_addr_check(struct xfrm_state *x,+		      xfrm_address_t *daddr, xfrm_address_t *saddr,+		      unsigned short family)+{+	switch (family) {+	case AF_INET:+		return __xfrm4_state_addr_check(x, daddr, saddr);+	case AF_INET6:+		return __xfrm6_state_addr_check(x, daddr, saddr);+	}+	return 0;