STRUCT XFRM_MODE_CBS(9)

💅 struct xfrm_mode_cbs(9) — ok bestie, let's talk XFRM mode callbacks

So this is a page straight out of the Kernel API Manual (struct xfrm_mode_cbs(9)), and it's literally the cheat sheet for how an XFRM mode plugs itself into the rest of the kernel. Yes it's a struct full of function pointers. Yes it's giving "here's my whole personality in C". Let's go 🎀

---

✨ NAME ✨

struct xfrm_mode_cbs — XFRM mode callbacks. That's it, that's the whole name section. Short and iconic.

---

🌸 SYNOPSIS 🌸

struct xfrm_mode_cbs {
    struct module   *owner;
    int (*init_state)(struct xfrm_state *x);
    int (*clone_state)(struct xfrm_state *x, struct xfrm_state *orig);
    void (*destroy_state)(struct xfrm_state *x);
    int (*user_init)(struct net *net, struct xfrm_state *x, struct nlattr **attrs, struct netlink_ext_ack *extack);
    int (*copy_to_user)(struct xfrm_state *x, struct sk_buff *skb);
    unsigned int (*sa_len)(const struct xfrm_state *x);
    u32 (*get_inner_mtu)(struct xfrm_state *x, int outer_mtu);
    int (*input)(struct xfrm_state *x, struct sk_buff *skb);
    int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
    int (*prepare_output)(struct xfrm_state *x, struct sk_buff *skb);
};

Nine-ish callbacks plus an owner pointer. It's a whole vibe check for a mode, ngl 💀

---

🦋 Members 🦋

• owner — the module owner, or NULL. Like, whose module is this even. 🫶
• init_state — Add/init mode specific state in xfrm_state *x. Setup era ✨
• clone_state — Copy mode specific values from orig to new state x. It's giving "copy my whole look".
• destroy_state — Cleanup mode specific state from xfrm_state *x. Sad but necessary 😭
• user_init — Process mode specific netlink attributes from user. This is where the userspace gossip gets parsed.
• copy_to_user — Add netlink attributes to attrs based on state in x. Sending the info back out, periodt.
• sa_len — Return space required to store mode specific netlink attributes. How many bytes of attitude are we shipping.
• get_inner_mtu — Return avail payload space after removing encap overhead. Math, but make it fashion 🔥
• input — Process received packet from SA using mode. Incoming 🦋
• output — Output given packet using mode. Outgoing 💅
• prepare_output — Add mode specific encapsulation to packet in skb. On return, transport_header should point at ESP header, network_header should point at outer IP header and mac_header should opint at the protocol/nexthdr field of the outer IP.

no cap: that last one really does say opint in the original. It's a typo, but it's their typo and I'm not about to edit the kernel docs behind their back 🙈

---

🌈 Description 🌈

One should examine and understand the specific uses of these callbacks in xfrm for further detail on how and when these functions are called. RTSL.

That's it. That's the description. No elaboration, no further lore, just "go read the source, lmao". Honestly? Respect. 👑

---

⭐ SEE ALSO ⭐

• Kernel file ./include/net/xfrm.h
• struct xfrm_policy(9)

---

and that's the whole page bestie, you ate that 💖 This lil beauty lives at ./include/net in the kernel tree, and the page itself is dated October 2026 — yes, future vibes only. Go forth and encapsulate responsibly 🧚‍♀️💜