net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <linux/cache.h>
  22 #include <linux/audit.h>
  23 #include <asm/uaccess.h>
  24
  25 #include "xfrm_hash.h"
  26
  27 struct sock *xfrm_nl;
  28 EXPORT_SYMBOL(xfrm_nl);
  29
  30 u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
  31 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
  32
  33 u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
  34 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
  35
  36 u32 sysctl_xfrm_acq_expires __read_mostly = 30;
  37
  38 /* Each xfrm_state may be linked to two tables:
  39
  40    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  41    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
  42       destination/tunnel endpoint. (output)
  43  */
  44
  45 static DEFINE_SPINLOCK(xfrm_state_lock);
  46
  47 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
  48 static unsigned int xfrm_state_genid;
  49
  50 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
  51 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  52
  53 #ifdef CONFIG_AUDITSYSCALL
  54 static void xfrm_audit_state_replay(struct xfrm_state *x,
  55                                     struct sk_buff *skb, __be32 net_seq);
  56 #else
  57 #define xfrm_audit_state_replay(x, s, sq)       do { ; } while (0)
  58 #endif /* CONFIG_AUDITSYSCALL */
  59
  60 static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
  61                                          xfrm_address_t *saddr,
  62                                          u32 reqid,
  63                                          unsigned short family)
  64 {
  65         return __xfrm_dst_hash(daddr, saddr, reqid, family, init_net.xfrm.state_hmask);
  66 }
  67
  68 static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
  69                                          xfrm_address_t *saddr,
  70                                          unsigned short family)
  71 {
  72         return __xfrm_src_hash(daddr, saddr, family, init_net.xfrm.state_hmask);
  73 }
  74
  75 static inline unsigned int
  76 xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
  77 {
  78         return __xfrm_spi_hash(daddr, spi, proto, family, init_net.xfrm.state_hmask);
  79 }
  80
  81 static void xfrm_hash_transfer(struct hlist_head *list,
  82                                struct hlist_head *ndsttable,
  83                                struct hlist_head *nsrctable,
  84                                struct hlist_head *nspitable,
  85                                unsigned int nhashmask)
  86 {
  87         struct hlist_node *entry, *tmp;
  88         struct xfrm_state *x;
  89
  90         hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
  91                 unsigned int h;
  92
  93                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
  94                                     x->props.reqid, x->props.family,
  95                                     nhashmask);
  96                 hlist_add_head(&x->bydst, ndsttable+h);
  97
  98                 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
  99                                     x->props.family,
 100                                     nhashmask);
 101                 hlist_add_head(&x->bysrc, nsrctable+h);
 102
 103                 if (x->id.spi) {
 104                         h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
 105                                             x->id.proto, x->props.family,
 106                                             nhashmask);
 107                         hlist_add_head(&x->byspi, nspitable+h);
 108                 }
 109         }
 110 }
 111
 112 static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
 113 {
 114         return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
 115 }
 116
 117 static DEFINE_MUTEX(hash_resize_mutex);
 118
 119 static void xfrm_hash_resize(struct work_struct *work)
 120 {
 121         struct net *net = container_of(work, struct net, xfrm.state_hash_work);
 122         struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
 123         unsigned long nsize, osize;
 124         unsigned int nhashmask, ohashmask;
 125         int i;
 126
 127         mutex_lock(&hash_resize_mutex);
 128
 129         nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
 130         ndst = xfrm_hash_alloc(nsize);
 131         if (!ndst)
 132                 goto out_unlock;
 133         nsrc = xfrm_hash_alloc(nsize);
 134         if (!nsrc) {
 135                 xfrm_hash_free(ndst, nsize);
 136                 goto out_unlock;
 137         }
 138         nspi = xfrm_hash_alloc(nsize);
 139         if (!nspi) {
 140                 xfrm_hash_free(ndst, nsize);
 141                 xfrm_hash_free(nsrc, nsize);
 142                 goto out_unlock;
 143         }
 144
 145         spin_lock_bh(&xfrm_state_lock);
 146
 147         nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
 148         for (i = net->xfrm.state_hmask; i >= 0; i--)
 149                 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
 150                                    nhashmask);
 151
 152         odst = net->xfrm.state_bydst;
 153         osrc = net->xfrm.state_bysrc;
 154         ospi = net->xfrm.state_byspi;
 155         ohashmask = net->xfrm.state_hmask;
 156
 157         net->xfrm.state_bydst = ndst;
 158         net->xfrm.state_bysrc = nsrc;
 159         net->xfrm.state_byspi = nspi;
 160         net->xfrm.state_hmask = nhashmask;
 161
 162         spin_unlock_bh(&xfrm_state_lock);
 163
 164         osize = (ohashmask + 1) * sizeof(struct hlist_head);
 165         xfrm_hash_free(odst, osize);
 166         xfrm_hash_free(osrc, osize);
 167         xfrm_hash_free(ospi, osize);
 168
 169 out_unlock:
 170         mutex_unlock(&hash_resize_mutex);
 171 }
 172
 173 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
 174 EXPORT_SYMBOL(km_waitq);
 175
 176 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 177 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 178
 179 static struct work_struct xfrm_state_gc_work;
 180 static HLIST_HEAD(xfrm_state_gc_list);
 181 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 182
 183 int __xfrm_state_delete(struct xfrm_state *x);
 184
 185 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 186 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 187
 188 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
 189 {
 190         struct xfrm_state_afinfo *afinfo;
 191         if (unlikely(family >= NPROTO))
 192                 return NULL;
 193         write_lock_bh(&xfrm_state_afinfo_lock);
 194         afinfo = xfrm_state_afinfo[family];
 195         if (unlikely(!afinfo))
 196                 write_unlock_bh(&xfrm_state_afinfo_lock);
 197         return afinfo;
 198 }
 199
 200 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
 201         __releases(xfrm_state_afinfo_lock)
 202 {
 203         write_unlock_bh(&xfrm_state_afinfo_lock);
 204 }
 205
 206 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
 207 {
 208         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 209         const struct xfrm_type **typemap;
 210         int err = 0;
 211
 212         if (unlikely(afinfo == NULL))
 213                 return -EAFNOSUPPORT;
 214         typemap = afinfo->type_map;
 215
 216         if (likely(typemap[type->proto] == NULL))
 217                 typemap[type->proto] = type;
 218         else
 219                 err = -EEXIST;
 220         xfrm_state_unlock_afinfo(afinfo);
 221         return err;
 222 }
 223 EXPORT_SYMBOL(xfrm_register_type);
 224
 225 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
 226 {
 227         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 228         const struct xfrm_type **typemap;
 229         int err = 0;
 230
 231         if (unlikely(afinfo == NULL))
 232                 return -EAFNOSUPPORT;
 233         typemap = afinfo->type_map;
 234
 235         if (unlikely(typemap[type->proto] != type))
 236                 err = -ENOENT;
 237         else
 238                 typemap[type->proto] = NULL;
 239         xfrm_state_unlock_afinfo(afinfo);
 240         return err;
 241 }
 242 EXPORT_SYMBOL(xfrm_unregister_type);
 243
 244 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
 245 {
 246         struct xfrm_state_afinfo *afinfo;
 247         const struct xfrm_type **typemap;
 248         const struct xfrm_type *type;
 249         int modload_attempted = 0;
 250
 251 retry:
 252         afinfo = xfrm_state_get_afinfo(family);
 253         if (unlikely(afinfo == NULL))
 254                 return NULL;
 255         typemap = afinfo->type_map;
 256
 257         type = typemap[proto];
 258         if (unlikely(type && !try_module_get(type->owner)))
 259                 type = NULL;
 260         if (!type && !modload_attempted) {
 261                 xfrm_state_put_afinfo(afinfo);
 262                 request_module("xfrm-type-%d-%d", family, proto);
 263                 modload_attempted = 1;
 264                 goto retry;
 265         }
 266
 267         xfrm_state_put_afinfo(afinfo);
 268         return type;
 269 }
 270
 271 static void xfrm_put_type(const struct xfrm_type *type)
 272 {
 273         module_put(type->owner);
 274 }
 275
 276 int xfrm_register_mode(struct xfrm_mode *mode, int family)
 277 {
 278         struct xfrm_state_afinfo *afinfo;
 279         struct xfrm_mode **modemap;
 280         int err;
 281
 282         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 283                 return -EINVAL;
 284
 285         afinfo = xfrm_state_lock_afinfo(family);
 286         if (unlikely(afinfo == NULL))
 287                 return -EAFNOSUPPORT;
 288
 289         err = -EEXIST;
 290         modemap = afinfo->mode_map;
 291         if (modemap[mode->encap])
 292                 goto out;
 293
 294         err = -ENOENT;
 295         if (!try_module_get(afinfo->owner))
 296                 goto out;
 297
 298         mode->afinfo = afinfo;
 299         modemap[mode->encap] = mode;
 300         err = 0;
 301
 302 out:
 303         xfrm_state_unlock_afinfo(afinfo);
 304         return err;
 305 }
 306 EXPORT_SYMBOL(xfrm_register_mode);
 307
 308 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
 309 {
 310         struct xfrm_state_afinfo *afinfo;
 311         struct xfrm_mode **modemap;
 312         int err;
 313
 314         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 315                 return -EINVAL;
 316
 317         afinfo = xfrm_state_lock_afinfo(family);
 318         if (unlikely(afinfo == NULL))
 319                 return -EAFNOSUPPORT;
 320
 321         err = -ENOENT;
 322         modemap = afinfo->mode_map;
 323         if (likely(modemap[mode->encap] == mode)) {
 324                 modemap[mode->encap] = NULL;
 325                 module_put(mode->afinfo->owner);
 326                 err = 0;
 327         }
 328
 329         xfrm_state_unlock_afinfo(afinfo);
 330         return err;
 331 }
 332 EXPORT_SYMBOL(xfrm_unregister_mode);
 333
 334 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
 335 {
 336         struct xfrm_state_afinfo *afinfo;
 337         struct xfrm_mode *mode;
 338         int modload_attempted = 0;
 339
 340         if (unlikely(encap >= XFRM_MODE_MAX))
 341                 return NULL;
 342
 343 retry:
 344         afinfo = xfrm_state_get_afinfo(family);
 345         if (unlikely(afinfo == NULL))
 346                 return NULL;
 347
 348         mode = afinfo->mode_map[encap];
 349         if (unlikely(mode && !try_module_get(mode->owner)))
 350                 mode = NULL;
 351         if (!mode && !modload_attempted) {
 352                 xfrm_state_put_afinfo(afinfo);
 353                 request_module("xfrm-mode-%d-%d", family, encap);
 354                 modload_attempted = 1;
 355                 goto retry;
 356         }
 357
 358         xfrm_state_put_afinfo(afinfo);
 359         return mode;
 360 }
 361
 362 static void xfrm_put_mode(struct xfrm_mode *mode)
 363 {
 364         module_put(mode->owner);
 365 }
 366
 367 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 368 {
 369         del_timer_sync(&x->timer);
 370         del_timer_sync(&x->rtimer);
 371         kfree(x->aalg);
 372         kfree(x->ealg);
 373         kfree(x->calg);
 374         kfree(x->encap);
 375         kfree(x->coaddr);
 376         if (x->inner_mode)
 377                 xfrm_put_mode(x->inner_mode);
 378         if (x->inner_mode_iaf)
 379                 xfrm_put_mode(x->inner_mode_iaf);
 380         if (x->outer_mode)
 381                 xfrm_put_mode(x->outer_mode);
 382         if (x->type) {
 383                 x->type->destructor(x);
 384                 xfrm_put_type(x->type);
 385         }
 386         security_xfrm_state_free(x);
 387         kfree(x);
 388 }
 389
 390 static void xfrm_state_gc_task(struct work_struct *data)
 391 {
 392         struct xfrm_state *x;
 393         struct hlist_node *entry, *tmp;
 394         struct hlist_head gc_list;
 395
 396         spin_lock_bh(&xfrm_state_gc_lock);
 397         hlist_move_list(&xfrm_state_gc_list, &gc_list);
 398         spin_unlock_bh(&xfrm_state_gc_lock);
 399
 400         hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
 401                 xfrm_state_gc_destroy(x);
 402
 403         wake_up(&km_waitq);
 404 }
 405
 406 static inline unsigned long make_jiffies(long secs)
 407 {
 408         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 409                 return MAX_SCHEDULE_TIMEOUT-1;
 410         else
 411                 return secs*HZ;
 412 }
 413
 414 static void xfrm_timer_handler(unsigned long data)
 415 {
 416         struct xfrm_state *x = (struct xfrm_state*)data;
 417         unsigned long now = get_seconds();
 418         long next = LONG_MAX;
 419         int warn = 0;
 420         int err = 0;
 421
 422         spin_lock(&x->lock);
 423         if (x->km.state == XFRM_STATE_DEAD)
 424                 goto out;
 425         if (x->km.state == XFRM_STATE_EXPIRED)
 426                 goto expired;
 427         if (x->lft.hard_add_expires_seconds) {
 428                 long tmo = x->lft.hard_add_expires_seconds +
 429                         x->curlft.add_time - now;
 430                 if (tmo <= 0)
 431                         goto expired;
 432                 if (tmo < next)
 433                         next = tmo;
 434         }
 435         if (x->lft.hard_use_expires_seconds) {
 436                 long tmo = x->lft.hard_use_expires_seconds +
 437                         (x->curlft.use_time ? : now) - now;
 438                 if (tmo <= 0)
 439                         goto expired;
 440                 if (tmo < next)
 441                         next = tmo;
 442         }
 443         if (x->km.dying)
 444                 goto resched;
 445         if (x->lft.soft_add_expires_seconds) {
 446                 long tmo = x->lft.soft_add_expires_seconds +
 447                         x->curlft.add_time - now;
 448                 if (tmo <= 0)
 449                         warn = 1;
 450                 else if (tmo < next)
 451                         next = tmo;
 452         }
 453         if (x->lft.soft_use_expires_seconds) {
 454                 long tmo = x->lft.soft_use_expires_seconds +
 455                         (x->curlft.use_time ? : now) - now;
 456                 if (tmo <= 0)
 457                         warn = 1;
 458                 else if (tmo < next)
 459                         next = tmo;
 460         }
 461
 462         x->km.dying = warn;
 463         if (warn)
 464                 km_state_expired(x, 0, 0);
 465 resched:
 466         if (next != LONG_MAX)
 467                 mod_timer(&x->timer, jiffies + make_jiffies(next));
 468
 469         goto out;
 470
 471 expired:
 472         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 473                 x->km.state = XFRM_STATE_EXPIRED;
 474                 wake_up(&km_waitq);
 475                 next = 2;
 476                 goto resched;
 477         }
 478
 479         err = __xfrm_state_delete(x);
 480         if (!err && x->id.spi)
 481                 km_state_expired(x, 1, 0);
 482
 483         xfrm_audit_state_delete(x, err ? 0 : 1,
 484                                 audit_get_loginuid(current),
 485                                 audit_get_sessionid(current), 0);
 486
 487 out:
 488         spin_unlock(&x->lock);
 489 }
 490
 491 static void xfrm_replay_timer_handler(unsigned long data);
 492
 493 struct xfrm_state *xfrm_state_alloc(struct net *net)
 494 {
 495         struct xfrm_state *x;
 496
 497         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 498
 499         if (x) {
 500                 write_pnet(&x->xs_net, net);
 501                 atomic_set(&x->refcnt, 1);
 502                 atomic_set(&x->tunnel_users, 0);
 503                 INIT_LIST_HEAD(&x->km.all);
 504                 INIT_HLIST_NODE(&x->bydst);
 505                 INIT_HLIST_NODE(&x->bysrc);
 506                 INIT_HLIST_NODE(&x->byspi);
 507                 setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
 508                 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
 509                                 (unsigned long)x);
 510                 x->curlft.add_time = get_seconds();
 511                 x->lft.soft_byte_limit = XFRM_INF;
 512                 x->lft.soft_packet_limit = XFRM_INF;
 513                 x->lft.hard_byte_limit = XFRM_INF;
 514                 x->lft.hard_packet_limit = XFRM_INF;
 515                 x->replay_maxage = 0;
 516                 x->replay_maxdiff = 0;
 517                 x->inner_mode = NULL;
 518                 x->inner_mode_iaf = NULL;
 519                 spin_lock_init(&x->lock);
 520         }
 521         return x;
 522 }
 523 EXPORT_SYMBOL(xfrm_state_alloc);
 524
 525 void __xfrm_state_destroy(struct xfrm_state *x)
 526 {
 527         WARN_ON(x->km.state != XFRM_STATE_DEAD);
 528
 529         spin_lock_bh(&xfrm_state_gc_lock);
 530         hlist_add_head(&x->gclist, &xfrm_state_gc_list);
 531         spin_unlock_bh(&xfrm_state_gc_lock);
 532         schedule_work(&xfrm_state_gc_work);
 533 }
 534 EXPORT_SYMBOL(__xfrm_state_destroy);
 535
 536 int __xfrm_state_delete(struct xfrm_state *x)
 537 {
 538         int err = -ESRCH;
 539
 540         if (x->km.state != XFRM_STATE_DEAD) {
 541                 x->km.state = XFRM_STATE_DEAD;
 542                 spin_lock(&xfrm_state_lock);
 543                 list_del(&x->km.all);
 544                 hlist_del(&x->bydst);
 545                 hlist_del(&x->bysrc);
 546                 if (x->id.spi)
 547                         hlist_del(&x->byspi);
 548                 init_net.xfrm.state_num--;
 549                 spin_unlock(&xfrm_state_lock);
 550
 551                 /* All xfrm_state objects are created by xfrm_state_alloc.
 552                  * The xfrm_state_alloc call gives a reference, and that
 553                  * is what we are dropping here.
 554                  */
 555                 xfrm_state_put(x);
 556                 err = 0;
 557         }
 558
 559         return err;
 560 }
 561 EXPORT_SYMBOL(__xfrm_state_delete);
 562
 563 int xfrm_state_delete(struct xfrm_state *x)
 564 {
 565         int err;
 566
 567         spin_lock_bh(&x->lock);
 568         err = __xfrm_state_delete(x);
 569         spin_unlock_bh(&x->lock);
 570
 571         return err;
 572 }
 573 EXPORT_SYMBOL(xfrm_state_delete);
 574
 575 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 576 static inline int
 577 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 578 {
 579         int i, err = 0;
 580
 581         for (i = 0; i <= init_net.xfrm.state_hmask; i++) {
 582                 struct hlist_node *entry;
 583                 struct xfrm_state *x;
 584
 585                 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+i, bydst) {
 586                         if (xfrm_id_proto_match(x->id.proto, proto) &&
 587                            (err = security_xfrm_state_delete(x)) != 0) {
 588                                 xfrm_audit_state_delete(x, 0,
 589                                                         audit_info->loginuid,
 590                                                         audit_info->sessionid,
 591                                                         audit_info->secid);
 592                                 return err;
 593                         }
 594                 }
 595         }
 596
 597         return err;
 598 }
 599 #else
 600 static inline int
 601 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 602 {
 603         return 0;
 604 }
 605 #endif
 606
 607 int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
 608 {
 609         int i, err = 0;
 610
 611         spin_lock_bh(&xfrm_state_lock);
 612         err = xfrm_state_flush_secctx_check(proto, audit_info);
 613         if (err)
 614                 goto out;
 615
 616         for (i = 0; i <= init_net.xfrm.state_hmask; i++) {
 617                 struct hlist_node *entry;
 618                 struct xfrm_state *x;
 619 restart:
 620                 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+i, bydst) {
 621                         if (!xfrm_state_kern(x) &&
 622                             xfrm_id_proto_match(x->id.proto, proto)) {
 623                                 xfrm_state_hold(x);
 624                                 spin_unlock_bh(&xfrm_state_lock);
 625
 626                                 err = xfrm_state_delete(x);
 627                                 xfrm_audit_state_delete(x, err ? 0 : 1,
 628                                                         audit_info->loginuid,
 629                                                         audit_info->sessionid,
 630                                                         audit_info->secid);
 631                                 xfrm_state_put(x);
 632
 633                                 spin_lock_bh(&xfrm_state_lock);
 634                                 goto restart;
 635                         }
 636                 }
 637         }
 638         err = 0;
 639
 640 out:
 641         spin_unlock_bh(&xfrm_state_lock);
 642         wake_up(&km_waitq);
 643         return err;
 644 }
 645 EXPORT_SYMBOL(xfrm_state_flush);
 646
 647 void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
 648 {
 649         spin_lock_bh(&xfrm_state_lock);
 650         si->sadcnt = init_net.xfrm.state_num;
 651         si->sadhcnt = init_net.xfrm.state_hmask;
 652         si->sadhmcnt = xfrm_state_hashmax;
 653         spin_unlock_bh(&xfrm_state_lock);
 654 }
 655 EXPORT_SYMBOL(xfrm_sad_getinfo);
 656
 657 static int
 658 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 659                   struct xfrm_tmpl *tmpl,
 660                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 661                   unsigned short family)
 662 {
 663         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 664         if (!afinfo)
 665                 return -1;
 666         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 667         xfrm_state_put_afinfo(afinfo);
 668         return 0;
 669 }
 670
 671 static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 672 {
 673         unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
 674         struct xfrm_state *x;
 675         struct hlist_node *entry;
 676
 677         hlist_for_each_entry(x, entry, init_net.xfrm.state_byspi+h, byspi) {
 678                 if (x->props.family != family ||
 679                     x->id.spi       != spi ||
 680                     x->id.proto     != proto)
 681                         continue;
 682
 683                 switch (family) {
 684                 case AF_INET:
 685                         if (x->id.daddr.a4 != daddr->a4)
 686                                 continue;
 687                         break;
 688                 case AF_INET6:
 689                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 690                                              (struct in6_addr *)
 691                                              x->id.daddr.a6))
 692                                 continue;
 693                         break;
 694                 }
 695
 696                 xfrm_state_hold(x);
 697                 return x;
 698         }
 699
 700         return NULL;
 701 }
 702
 703 static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 704 {
 705         unsigned int h = xfrm_src_hash(daddr, saddr, family);
 706         struct xfrm_state *x;
 707         struct hlist_node *entry;
 708
 709         hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
 710                 if (x->props.family != family ||
 711                     x->id.proto     != proto)
 712                         continue;
 713
 714                 switch (family) {
 715                 case AF_INET:
 716                         if (x->id.daddr.a4 != daddr->a4 ||
 717                             x->props.saddr.a4 != saddr->a4)
 718                                 continue;
 719                         break;
 720                 case AF_INET6:
 721                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 722                                              (struct in6_addr *)
 723                                              x->id.daddr.a6) ||
 724                             !ipv6_addr_equal((struct in6_addr *)saddr,
 725                                              (struct in6_addr *)
 726                                              x->props.saddr.a6))
 727                                 continue;
 728                         break;
 729                 }
 730
 731                 xfrm_state_hold(x);
 732                 return x;
 733         }
 734
 735         return NULL;
 736 }
 737
 738 static inline struct xfrm_state *
 739 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
 740 {
 741         if (use_spi)
 742                 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
 743                                            x->id.proto, family);
 744         else
 745                 return __xfrm_state_lookup_byaddr(&x->id.daddr,
 746                                                   &x->props.saddr,
 747                                                   x->id.proto, family);
 748 }
 749
 750 static void xfrm_hash_grow_check(int have_hash_collision)
 751 {
 752         if (have_hash_collision &&
 753             (init_net.xfrm.state_hmask + 1) < xfrm_state_hashmax &&
 754             init_net.xfrm.state_num > init_net.xfrm.state_hmask)
 755                 schedule_work(&init_net.xfrm.state_hash_work);
 756 }
 757
 758 struct xfrm_state *
 759 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 760                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 761                 struct xfrm_policy *pol, int *err,
 762                 unsigned short family)
 763 {
 764         unsigned int h;
 765         struct hlist_node *entry;
 766         struct xfrm_state *x, *x0, *to_put;
 767         int acquire_in_progress = 0;
 768         int error = 0;
 769         struct xfrm_state *best = NULL;
 770
 771         to_put = NULL;
 772
 773         spin_lock_bh(&xfrm_state_lock);
 774         h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
 775         hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
 776                 if (x->props.family == family &&
 777                     x->props.reqid == tmpl->reqid &&
 778                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 779                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 780                     tmpl->mode == x->props.mode &&
 781                     tmpl->id.proto == x->id.proto &&
 782                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 783                         /* Resolution logic:
 784                            1. There is a valid state with matching selector.
 785                               Done.
 786                            2. Valid state with inappropriate selector. Skip.
 787
 788                            Entering area of "sysdeps".
 789
 790                            3. If state is not valid, selector is temporary,
 791                               it selects only session which triggered
 792                               previous resolution. Key manager will do
 793                               something to install a state with proper
 794                               selector.
 795                          */
 796                         if (x->km.state == XFRM_STATE_VALID) {
 797                                 if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
 798                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
 799                                         continue;
 800                                 if (!best ||
 801                                     best->km.dying > x->km.dying ||
 802                                     (best->km.dying == x->km.dying &&
 803                                      best->curlft.add_time < x->curlft.add_time))
 804                                         best = x;
 805                         } else if (x->km.state == XFRM_STATE_ACQ) {
 806                                 acquire_in_progress = 1;
 807                         } else if (x->km.state == XFRM_STATE_ERROR ||
 808                                    x->km.state == XFRM_STATE_EXPIRED) {
 809                                 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
 810                                     security_xfrm_state_pol_flow_match(x, pol, fl))
 811                                         error = -ESRCH;
 812                         }
 813                 }
 814         }
 815
 816         x = best;
 817         if (!x && !error && !acquire_in_progress) {
 818                 if (tmpl->id.spi &&
 819                     (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
 820                                               tmpl->id.proto, family)) != NULL) {
 821                         to_put = x0;
 822                         error = -EEXIST;
 823                         goto out;
 824                 }
 825                 x = xfrm_state_alloc(&init_net);
 826                 if (x == NULL) {
 827                         error = -ENOMEM;
 828                         goto out;
 829                 }
 830                 /* Initialize temporary selector matching only
 831                  * to current session. */
 832                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 833
 834                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
 835                 if (error) {
 836                         x->km.state = XFRM_STATE_DEAD;
 837                         to_put = x;
 838                         x = NULL;
 839                         goto out;
 840                 }
 841
 842                 if (km_query(x, tmpl, pol) == 0) {
 843                         x->km.state = XFRM_STATE_ACQ;
 844                         list_add(&x->km.all, &init_net.xfrm.state_all);
 845                         hlist_add_head(&x->bydst, init_net.xfrm.state_bydst+h);
 846                         h = xfrm_src_hash(daddr, saddr, family);
 847                         hlist_add_head(&x->bysrc, init_net.xfrm.state_bysrc+h);
 848                         if (x->id.spi) {
 849                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 850                                 hlist_add_head(&x->byspi, init_net.xfrm.state_byspi+h);
 851                         }
 852                         x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
 853                         x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
 854                         add_timer(&x->timer);
 855                         init_net.xfrm.state_num++;
 856                         xfrm_hash_grow_check(x->bydst.next != NULL);
 857                 } else {
 858                         x->km.state = XFRM_STATE_DEAD;
 859                         to_put = x;
 860                         x = NULL;
 861                         error = -ESRCH;
 862                 }
 863         }
 864 out:
 865         if (x)
 866                 xfrm_state_hold(x);
 867         else
 868                 *err = acquire_in_progress ? -EAGAIN : error;
 869         spin_unlock_bh(&xfrm_state_lock);
 870         if (to_put)
 871                 xfrm_state_put(to_put);
 872         return x;
 873 }
 874
 875 struct xfrm_state *
 876 xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 877                     unsigned short family, u8 mode, u8 proto, u32 reqid)
 878 {
 879         unsigned int h;
 880         struct xfrm_state *rx = NULL, *x = NULL;
 881         struct hlist_node *entry;
 882
 883         spin_lock(&xfrm_state_lock);
 884         h = xfrm_dst_hash(daddr, saddr, reqid, family);
 885         hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
 886                 if (x->props.family == family &&
 887                     x->props.reqid == reqid &&
 888                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 889                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 890                     mode == x->props.mode &&
 891                     proto == x->id.proto &&
 892                     x->km.state == XFRM_STATE_VALID) {
 893                         rx = x;
 894                         break;
 895                 }
 896         }
 897
 898         if (rx)
 899                 xfrm_state_hold(rx);
 900         spin_unlock(&xfrm_state_lock);
 901
 902
 903         return rx;
 904 }
 905 EXPORT_SYMBOL(xfrm_stateonly_find);
 906
 907 static void __xfrm_state_insert(struct xfrm_state *x)
 908 {
 909         unsigned int h;
 910
 911         x->genid = ++xfrm_state_genid;
 912
 913         list_add(&x->km.all, &init_net.xfrm.state_all);
 914
 915         h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 916                           x->props.reqid, x->props.family);
 917         hlist_add_head(&x->bydst, init_net.xfrm.state_bydst+h);
 918
 919         h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
 920         hlist_add_head(&x->bysrc, init_net.xfrm.state_bysrc+h);
 921
 922         if (x->id.spi) {
 923                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
 924                                   x->props.family);
 925
 926                 hlist_add_head(&x->byspi, init_net.xfrm.state_byspi+h);
 927         }
 928
 929         mod_timer(&x->timer, jiffies + HZ);
 930         if (x->replay_maxage)
 931                 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
 932
 933         wake_up(&km_waitq);
 934
 935         init_net.xfrm.state_num++;
 936
 937         xfrm_hash_grow_check(x->bydst.next != NULL);
 938 }
 939
 940 /* xfrm_state_lock is held */
 941 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 942 {
 943         unsigned short family = xnew->props.family;
 944         u32 reqid = xnew->props.reqid;
 945         struct xfrm_state *x;
 946         struct hlist_node *entry;
 947         unsigned int h;
 948
 949         h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
 950         hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
 951                 if (x->props.family     == family &&
 952                     x->props.reqid      == reqid &&
 953                     !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
 954                     !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
 955                         x->genid = xfrm_state_genid;
 956         }
 957 }
 958
 959 void xfrm_state_insert(struct xfrm_state *x)
 960 {
 961         spin_lock_bh(&xfrm_state_lock);
 962         __xfrm_state_bump_genids(x);
 963         __xfrm_state_insert(x);
 964         spin_unlock_bh(&xfrm_state_lock);
 965 }
 966 EXPORT_SYMBOL(xfrm_state_insert);
 967
 968 /* xfrm_state_lock is held */
 969 static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
 970 {
 971         unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
 972         struct hlist_node *entry;
 973         struct xfrm_state *x;
 974
 975         hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
 976                 if (x->props.reqid  != reqid ||
 977                     x->props.mode   != mode ||
 978                     x->props.family != family ||
 979                     x->km.state     != XFRM_STATE_ACQ ||
 980                     x->id.spi       != 0 ||
 981                     x->id.proto     != proto)
 982                         continue;
 983
 984                 switch (family) {
 985                 case AF_INET:
 986                         if (x->id.daddr.a4    != daddr->a4 ||
 987                             x->props.saddr.a4 != saddr->a4)
 988                                 continue;
 989                         break;
 990                 case AF_INET6:
 991                         if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
 992                                              (struct in6_addr *)daddr) ||
 993                             !ipv6_addr_equal((struct in6_addr *)
 994                                              x->props.saddr.a6,
 995                                              (struct in6_addr *)saddr))
 996                                 continue;
 997                         break;
 998                 }
 999
1000                 xfrm_state_hold(x);
1001                 return x;
1002         }
1003
1004         if (!create)
1005                 return NULL;
1006
1007         x = xfrm_state_alloc(&init_net);
1008         if (likely(x)) {
1009                 switch (family) {
1010                 case AF_INET:
1011                         x->sel.daddr.a4 = daddr->a4;
1012                         x->sel.saddr.a4 = saddr->a4;
1013                         x->sel.prefixlen_d = 32;
1014                         x->sel.prefixlen_s = 32;
1015                         x->props.saddr.a4 = saddr->a4;
1016                         x->id.daddr.a4 = daddr->a4;
1017                         break;
1018
1019                 case AF_INET6:
1020                         ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1021                                        (struct in6_addr *)daddr);
1022                         ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1023                                        (struct in6_addr *)saddr);
1024                         x->sel.prefixlen_d = 128;
1025                         x->sel.prefixlen_s = 128;
1026                         ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1027                                        (struct in6_addr *)saddr);
1028                         ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1029                                        (struct in6_addr *)daddr);
1030                         break;
1031                 }
1032
1033                 x->km.state = XFRM_STATE_ACQ;
1034                 x->id.proto = proto;
1035                 x->props.family = family;
1036                 x->props.mode = mode;
1037                 x->props.reqid = reqid;
1038                 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
1039                 xfrm_state_hold(x);
1040                 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1041                 add_timer(&x->timer);
1042                 list_add(&x->km.all, &init_net.xfrm.state_all);
1043                 hlist_add_head(&x->bydst, init_net.xfrm.state_bydst+h);
1044                 h = xfrm_src_hash(daddr, saddr, family);
1045                 hlist_add_head(&x->bysrc, init_net.xfrm.state_bysrc+h);
1046
1047                 init_net.xfrm.state_num++;
1048
1049                 xfrm_hash_grow_check(x->bydst.next != NULL);
1050         }
1051
1052         return x;
1053 }
1054
1055 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
1056
1057 int xfrm_state_add(struct xfrm_state *x)
1058 {
1059         struct xfrm_state *x1, *to_put;
1060         int family;
1061         int err;
1062         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1063
1064         family = x->props.family;
1065
1066         to_put = NULL;
1067
1068         spin_lock_bh(&xfrm_state_lock);
1069
1070         x1 = __xfrm_state_locate(x, use_spi, family);
1071         if (x1) {
1072                 to_put = x1;
1073                 x1 = NULL;
1074                 err = -EEXIST;
1075                 goto out;
1076         }
1077
1078         if (use_spi && x->km.seq) {
1079                 x1 = __xfrm_find_acq_byseq(x->km.seq);
1080                 if (x1 && ((x1->id.proto != x->id.proto) ||
1081                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1082                         to_put = x1;
1083                         x1 = NULL;
1084                 }
1085         }
1086
1087         if (use_spi && !x1)
1088                 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
1089                                      x->id.proto,
1090                                      &x->id.daddr, &x->props.saddr, 0);
1091
1092         __xfrm_state_bump_genids(x);
1093         __xfrm_state_insert(x);
1094         err = 0;
1095
1096 out:
1097         spin_unlock_bh(&xfrm_state_lock);
1098
1099         if (x1) {
1100                 xfrm_state_delete(x1);
1101                 xfrm_state_put(x1);
1102         }
1103
1104         if (to_put)
1105                 xfrm_state_put(to_put);
1106
1107         return err;
1108 }
1109 EXPORT_SYMBOL(xfrm_state_add);
1110
1111 #ifdef CONFIG_XFRM_MIGRATE
1112 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1113 {
1114         int err = -ENOMEM;
1115         struct xfrm_state *x = xfrm_state_alloc(&init_net);
1116         if (!x)
1117                 goto error;
1118
1119         memcpy(&x->id, &orig->id, sizeof(x->id));
1120         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1121         memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1122         x->props.mode = orig->props.mode;
1123         x->props.replay_window = orig->props.replay_window;
1124         x->props.reqid = orig->props.reqid;
1125         x->props.family = orig->props.family;
1126         x->props.saddr = orig->props.saddr;
1127
1128         if (orig->aalg) {
1129                 x->aalg = xfrm_algo_clone(orig->aalg);
1130                 if (!x->aalg)
1131                         goto error;
1132         }
1133         x->props.aalgo = orig->props.aalgo;
1134
1135         if (orig->ealg) {
1136                 x->ealg = xfrm_algo_clone(orig->ealg);
1137                 if (!x->ealg)
1138                         goto error;
1139         }
1140         x->props.ealgo = orig->props.ealgo;
1141
1142         if (orig->calg) {
1143                 x->calg = xfrm_algo_clone(orig->calg);
1144                 if (!x->calg)
1145                         goto error;
1146         }
1147         x->props.calgo = orig->props.calgo;
1148
1149         if (orig->encap) {
1150                 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1151                 if (!x->encap)
1152                         goto error;
1153         }
1154
1155         if (orig->coaddr) {
1156                 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1157                                     GFP_KERNEL);
1158                 if (!x->coaddr)
1159                         goto error;
1160         }
1161
1162         err = xfrm_init_state(x);
1163         if (err)
1164                 goto error;
1165
1166         x->props.flags = orig->props.flags;
1167
1168         x->curlft.add_time = orig->curlft.add_time;
1169         x->km.state = orig->km.state;
1170         x->km.seq = orig->km.seq;
1171
1172         return x;
1173
1174  error:
1175         if (errp)
1176                 *errp = err;
1177         if (x) {
1178                 kfree(x->aalg);
1179                 kfree(x->ealg);
1180                 kfree(x->calg);
1181                 kfree(x->encap);
1182                 kfree(x->coaddr);
1183         }
1184         kfree(x);
1185         return NULL;
1186 }
1187
1188 /* xfrm_state_lock is held */
1189 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1190 {
1191         unsigned int h;
1192         struct xfrm_state *x;
1193         struct hlist_node *entry;
1194
1195         if (m->reqid) {
1196                 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1197                                   m->reqid, m->old_family);
1198                 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
1199                         if (x->props.mode != m->mode ||
1200                             x->id.proto != m->proto)
1201                                 continue;
1202                         if (m->reqid && x->props.reqid != m->reqid)
1203                                 continue;
1204                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1205                                           m->old_family) ||
1206                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1207                                           m->old_family))
1208                                 continue;
1209                         xfrm_state_hold(x);
1210                         return x;
1211                 }
1212         } else {
1213                 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1214                                   m->old_family);
1215                 hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
1216                         if (x->props.mode != m->mode ||
1217                             x->id.proto != m->proto)
1218                                 continue;
1219                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1220                                           m->old_family) ||
1221                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1222                                           m->old_family))
1223                                 continue;
1224                         xfrm_state_hold(x);
1225                         return x;
1226                 }
1227         }
1228
1229         return NULL;
1230 }
1231 EXPORT_SYMBOL(xfrm_migrate_state_find);
1232
1233 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1234                                        struct xfrm_migrate *m)
1235 {
1236         struct xfrm_state *xc;
1237         int err;
1238
1239         xc = xfrm_state_clone(x, &err);
1240         if (!xc)
1241                 return NULL;
1242
1243         memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1244         memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1245
1246         /* add state */
1247         if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1248                 /* a care is needed when the destination address of the
1249                    state is to be updated as it is a part of triplet */
1250                 xfrm_state_insert(xc);
1251         } else {
1252                 if ((err = xfrm_state_add(xc)) < 0)
1253                         goto error;
1254         }
1255
1256         return xc;
1257 error:
1258         kfree(xc);
1259         return NULL;
1260 }
1261 EXPORT_SYMBOL(xfrm_state_migrate);
1262 #endif
1263
1264 int xfrm_state_update(struct xfrm_state *x)
1265 {
1266         struct xfrm_state *x1, *to_put;
1267         int err;
1268         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1269
1270         to_put = NULL;
1271
1272         spin_lock_bh(&xfrm_state_lock);
1273         x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1274
1275         err = -ESRCH;
1276         if (!x1)
1277                 goto out;
1278
1279         if (xfrm_state_kern(x1)) {
1280                 to_put = x1;
1281                 err = -EEXIST;
1282                 goto out;
1283         }
1284
1285         if (x1->km.state == XFRM_STATE_ACQ) {
1286                 __xfrm_state_insert(x);
1287                 x = NULL;
1288         }
1289         err = 0;
1290
1291 out:
1292         spin_unlock_bh(&xfrm_state_lock);
1293
1294         if (to_put)
1295                 xfrm_state_put(to_put);
1296
1297         if (err)
1298                 return err;
1299
1300         if (!x) {
1301                 xfrm_state_delete(x1);
1302                 xfrm_state_put(x1);
1303                 return 0;
1304         }
1305
1306         err = -EINVAL;
1307         spin_lock_bh(&x1->lock);
1308         if (likely(x1->km.state == XFRM_STATE_VALID)) {
1309                 if (x->encap && x1->encap)
1310                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1311                 if (x->coaddr && x1->coaddr) {
1312                         memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1313                 }
1314                 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1315                         memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1316                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1317                 x1->km.dying = 0;
1318
1319                 mod_timer(&x1->timer, jiffies + HZ);
1320                 if (x1->curlft.use_time)
1321                         xfrm_state_check_expire(x1);
1322
1323                 err = 0;
1324         }
1325         spin_unlock_bh(&x1->lock);
1326
1327         xfrm_state_put(x1);
1328
1329         return err;
1330 }
1331 EXPORT_SYMBOL(xfrm_state_update);
1332
1333 int xfrm_state_check_expire(struct xfrm_state *x)
1334 {
1335         if (!x->curlft.use_time)
1336                 x->curlft.use_time = get_seconds();
1337
1338         if (x->km.state != XFRM_STATE_VALID)
1339                 return -EINVAL;
1340
1341         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1342             x->curlft.packets >= x->lft.hard_packet_limit) {
1343                 x->km.state = XFRM_STATE_EXPIRED;
1344                 mod_timer(&x->timer, jiffies);
1345                 return -EINVAL;
1346         }
1347
1348         if (!x->km.dying &&
1349             (x->curlft.bytes >= x->lft.soft_byte_limit ||
1350              x->curlft.packets >= x->lft.soft_packet_limit)) {
1351                 x->km.dying = 1;
1352                 km_state_expired(x, 0, 0);
1353         }
1354         return 0;
1355 }
1356 EXPORT_SYMBOL(xfrm_state_check_expire);
1357
1358 struct xfrm_state *
1359 xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1360                   unsigned short family)
1361 {
1362         struct xfrm_state *x;
1363
1364         spin_lock_bh(&xfrm_state_lock);
1365         x = __xfrm_state_lookup(daddr, spi, proto, family);
1366         spin_unlock_bh(&xfrm_state_lock);
1367         return x;
1368 }
1369 EXPORT_SYMBOL(xfrm_state_lookup);
1370
1371 struct xfrm_state *
1372 xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1373                          u8 proto, unsigned short family)
1374 {
1375         struct xfrm_state *x;
1376
1377         spin_lock_bh(&xfrm_state_lock);
1378         x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
1379         spin_unlock_bh(&xfrm_state_lock);
1380         return x;
1381 }
1382 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1383
1384 struct xfrm_state *
1385 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1386               xfrm_address_t *daddr, xfrm_address_t *saddr,
1387               int create, unsigned short family)
1388 {
1389         struct xfrm_state *x;
1390
1391         spin_lock_bh(&xfrm_state_lock);
1392         x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1393         spin_unlock_bh(&xfrm_state_lock);
1394
1395         return x;
1396 }
1397 EXPORT_SYMBOL(xfrm_find_acq);
1398
1399 #ifdef CONFIG_XFRM_SUB_POLICY
1400 int
1401 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1402                unsigned short family)
1403 {
1404         int err = 0;
1405         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1406         if (!afinfo)
1407                 return -EAFNOSUPPORT;
1408
1409         spin_lock_bh(&xfrm_state_lock);
1410         if (afinfo->tmpl_sort)
1411                 err = afinfo->tmpl_sort(dst, src, n);
1412         spin_unlock_bh(&xfrm_state_lock);
1413         xfrm_state_put_afinfo(afinfo);
1414         return err;
1415 }
1416 EXPORT_SYMBOL(xfrm_tmpl_sort);
1417
1418 int
1419 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1420                 unsigned short family)
1421 {
1422         int err = 0;
1423         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1424         if (!afinfo)
1425                 return -EAFNOSUPPORT;
1426
1427         spin_lock_bh(&xfrm_state_lock);
1428         if (afinfo->state_sort)
1429                 err = afinfo->state_sort(dst, src, n);
1430         spin_unlock_bh(&xfrm_state_lock);
1431         xfrm_state_put_afinfo(afinfo);
1432         return err;
1433 }
1434 EXPORT_SYMBOL(xfrm_state_sort);
1435 #endif
1436
1437 /* Silly enough, but I'm lazy to build resolution list */
1438
1439 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1440 {
1441         int i;
1442
1443         for (i = 0; i <= init_net.xfrm.state_hmask; i++) {
1444                 struct hlist_node *entry;
1445                 struct xfrm_state *x;
1446
1447                 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+i, bydst) {
1448                         if (x->km.seq == seq &&
1449                             x->km.state == XFRM_STATE_ACQ) {
1450                                 xfrm_state_hold(x);
1451                                 return x;
1452                         }
1453                 }
1454         }
1455         return NULL;
1456 }
1457
1458 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1459 {
1460         struct xfrm_state *x;
1461
1462         spin_lock_bh(&xfrm_state_lock);
1463         x = __xfrm_find_acq_byseq(seq);
1464         spin_unlock_bh(&xfrm_state_lock);
1465         return x;
1466 }
1467 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1468
1469 u32 xfrm_get_acqseq(void)
1470 {
1471         u32 res;
1472         static u32 acqseq;
1473         static DEFINE_SPINLOCK(acqseq_lock);
1474
1475         spin_lock_bh(&acqseq_lock);
1476         res = (++acqseq ? : ++acqseq);
1477         spin_unlock_bh(&acqseq_lock);
1478         return res;
1479 }
1480 EXPORT_SYMBOL(xfrm_get_acqseq);
1481
1482 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1483 {
1484         unsigned int h;
1485         struct xfrm_state *x0;
1486         int err = -ENOENT;
1487         __be32 minspi = htonl(low);
1488         __be32 maxspi = htonl(high);
1489
1490         spin_lock_bh(&x->lock);
1491         if (x->km.state == XFRM_STATE_DEAD)
1492                 goto unlock;
1493
1494         err = 0;
1495         if (x->id.spi)
1496                 goto unlock;
1497
1498         err = -ENOENT;
1499
1500         if (minspi == maxspi) {
1501                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1502                 if (x0) {
1503                         xfrm_state_put(x0);
1504                         goto unlock;
1505                 }
1506                 x->id.spi = minspi;
1507         } else {
1508                 u32 spi = 0;
1509                 for (h=0; h<high-low+1; h++) {
1510                         spi = low + net_random()%(high-low+1);
1511                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1512                         if (x0 == NULL) {
1513                                 x->id.spi = htonl(spi);
1514                                 break;
1515                         }
1516                         xfrm_state_put(x0);
1517                 }
1518         }
1519         if (x->id.spi) {
1520                 spin_lock_bh(&xfrm_state_lock);
1521                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1522                 hlist_add_head(&x->byspi, init_net.xfrm.state_byspi+h);
1523                 spin_unlock_bh(&xfrm_state_lock);
1524
1525                 err = 0;
1526         }
1527
1528 unlock:
1529         spin_unlock_bh(&x->lock);
1530
1531         return err;
1532 }
1533 EXPORT_SYMBOL(xfrm_alloc_spi);
1534
1535 int xfrm_state_walk(struct xfrm_state_walk *walk,
1536                     int (*func)(struct xfrm_state *, int, void*),
1537                     void *data)
1538 {
1539         struct xfrm_state *state;
1540         struct xfrm_state_walk *x;
1541         int err = 0;
1542
1543         if (walk->seq != 0 && list_empty(&walk->all))
1544                 return 0;
1545
1546         spin_lock_bh(&xfrm_state_lock);
1547         if (list_empty(&walk->all))
1548                 x = list_first_entry(&init_net.xfrm.state_all, struct xfrm_state_walk, all);
1549         else
1550                 x = list_entry(&walk->all, struct xfrm_state_walk, all);
1551         list_for_each_entry_from(x, &init_net.xfrm.state_all, all) {
1552                 if (x->state == XFRM_STATE_DEAD)
1553                         continue;
1554                 state = container_of(x, struct xfrm_state, km);
1555                 if (!xfrm_id_proto_match(state->id.proto, walk->proto))
1556                         continue;
1557                 err = func(state, walk->seq, data);
1558                 if (err) {
1559                         list_move_tail(&walk->all, &x->all);
1560                         goto out;
1561                 }
1562                 walk->seq++;
1563         }
1564         if (walk->seq == 0) {
1565                 err = -ENOENT;
1566                 goto out;
1567         }
1568         list_del_init(&walk->all);
1569 out:
1570         spin_unlock_bh(&xfrm_state_lock);
1571         return err;
1572 }
1573 EXPORT_SYMBOL(xfrm_state_walk);
1574
1575 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
1576 {
1577         INIT_LIST_HEAD(&walk->all);
1578         walk->proto = proto;
1579         walk->state = XFRM_STATE_DEAD;
1580         walk->seq = 0;
1581 }
1582 EXPORT_SYMBOL(xfrm_state_walk_init);
1583
1584 void xfrm_state_walk_done(struct xfrm_state_walk *walk)
1585 {
1586         if (list_empty(&walk->all))
1587                 return;
1588
1589         spin_lock_bh(&xfrm_state_lock);
1590         list_del(&walk->all);
1591         spin_lock_bh(&xfrm_state_lock);
1592 }
1593 EXPORT_SYMBOL(xfrm_state_walk_done);
1594
1595
1596 void xfrm_replay_notify(struct xfrm_state *x, int event)
1597 {
1598         struct km_event c;
1599         /* we send notify messages in case
1600          *  1. we updated on of the sequence numbers, and the seqno difference
1601          *     is at least x->replay_maxdiff, in this case we also update the
1602          *     timeout of our timer function
1603          *  2. if x->replay_maxage has elapsed since last update,
1604          *     and there were changes
1605          *
1606          *  The state structure must be locked!
1607          */
1608
1609         switch (event) {
1610         case XFRM_REPLAY_UPDATE:
1611                 if (x->replay_maxdiff &&
1612                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1613                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1614                         if (x->xflags & XFRM_TIME_DEFER)
1615                                 event = XFRM_REPLAY_TIMEOUT;
1616                         else
1617                                 return;
1618                 }
1619
1620                 break;
1621
1622         case XFRM_REPLAY_TIMEOUT:
1623                 if ((x->replay.seq == x->preplay.seq) &&
1624                     (x->replay.bitmap == x->preplay.bitmap) &&
1625                     (x->replay.oseq == x->preplay.oseq)) {
1626                         x->xflags |= XFRM_TIME_DEFER;
1627                         return;
1628                 }
1629
1630                 break;
1631         }
1632
1633         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1634         c.event = XFRM_MSG_NEWAE;
1635         c.data.aevent = event;
1636         km_state_notify(x, &c);
1637
1638         if (x->replay_maxage &&
1639             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1640                 x->xflags &= ~XFRM_TIME_DEFER;
1641 }
1642
1643 static void xfrm_replay_timer_handler(unsigned long data)
1644 {
1645         struct xfrm_state *x = (struct xfrm_state*)data;
1646
1647         spin_lock(&x->lock);
1648
1649         if (x->km.state == XFRM_STATE_VALID) {
1650                 if (xfrm_aevent_is_on())
1651                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1652                 else
1653                         x->xflags |= XFRM_TIME_DEFER;
1654         }
1655
1656         spin_unlock(&x->lock);
1657 }
1658
1659 int xfrm_replay_check(struct xfrm_state *x,
1660                       struct sk_buff *skb, __be32 net_seq)
1661 {
1662         u32 diff;
1663         u32 seq = ntohl(net_seq);
1664
1665         if (unlikely(seq == 0))
1666                 goto err;
1667
1668         if (likely(seq > x->replay.seq))
1669                 return 0;
1670
1671         diff = x->replay.seq - seq;
1672         if (diff >= min_t(unsigned int, x->props.replay_window,
1673                           sizeof(x->replay.bitmap) * 8)) {
1674                 x->stats.replay_window++;
1675                 goto err;
1676         }
1677
1678         if (x->replay.bitmap & (1U << diff)) {
1679                 x->stats.replay++;
1680                 goto err;
1681         }
1682         return 0;
1683
1684 err:
1685         xfrm_audit_state_replay(x, skb, net_seq);
1686         return -EINVAL;
1687 }
1688
1689 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1690 {
1691         u32 diff;
1692         u32 seq = ntohl(net_seq);
1693
1694         if (seq > x->replay.seq) {
1695                 diff = seq - x->replay.seq;
1696                 if (diff < x->props.replay_window)
1697                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1698                 else
1699                         x->replay.bitmap = 1;
1700                 x->replay.seq = seq;
1701         } else {
1702                 diff = x->replay.seq - seq;
1703                 x->replay.bitmap |= (1U << diff);
1704         }
1705
1706         if (xfrm_aevent_is_on())
1707                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1708 }
1709
1710 static LIST_HEAD(xfrm_km_list);
1711 static DEFINE_RWLOCK(xfrm_km_lock);
1712
1713 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1714 {
1715         struct xfrm_mgr *km;
1716
1717         read_lock(&xfrm_km_lock);
1718         list_for_each_entry(km, &xfrm_km_list, list)
1719                 if (km->notify_policy)
1720                         km->notify_policy(xp, dir, c);
1721         read_unlock(&xfrm_km_lock);
1722 }
1723
1724 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1725 {
1726         struct xfrm_mgr *km;
1727         read_lock(&xfrm_km_lock);
1728         list_for_each_entry(km, &xfrm_km_list, list)
1729                 if (km->notify)
1730                         km->notify(x, c);
1731         read_unlock(&xfrm_km_lock);
1732 }
1733
1734 EXPORT_SYMBOL(km_policy_notify);
1735 EXPORT_SYMBOL(km_state_notify);
1736
1737 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1738 {
1739         struct km_event c;
1740
1741         c.data.hard = hard;
1742         c.pid = pid;
1743         c.event = XFRM_MSG_EXPIRE;
1744         km_state_notify(x, &c);
1745
1746         if (hard)
1747                 wake_up(&km_waitq);
1748 }
1749
1750 EXPORT_SYMBOL(km_state_expired);
1751 /*
1752  * We send to all registered managers regardless of failure
1753  * We are happy with one success
1754 */
1755 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1756 {
1757         int err = -EINVAL, acqret;
1758         struct xfrm_mgr *km;
1759
1760         read_lock(&xfrm_km_lock);
1761         list_for_each_entry(km, &xfrm_km_list, list) {
1762                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1763                 if (!acqret)
1764                         err = acqret;
1765         }
1766         read_unlock(&xfrm_km_lock);
1767         return err;
1768 }
1769 EXPORT_SYMBOL(km_query);
1770
1771 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1772 {
1773         int err = -EINVAL;
1774         struct xfrm_mgr *km;
1775
1776         read_lock(&xfrm_km_lock);
1777         list_for_each_entry(km, &xfrm_km_list, list) {
1778                 if (km->new_mapping)
1779                         err = km->new_mapping(x, ipaddr, sport);
1780                 if (!err)
1781                         break;
1782         }
1783         read_unlock(&xfrm_km_lock);
1784         return err;
1785 }
1786 EXPORT_SYMBOL(km_new_mapping);
1787
1788 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1789 {
1790         struct km_event c;
1791
1792         c.data.hard = hard;
1793         c.pid = pid;
1794         c.event = XFRM_MSG_POLEXPIRE;
1795         km_policy_notify(pol, dir, &c);
1796
1797         if (hard)
1798                 wake_up(&km_waitq);
1799 }
1800 EXPORT_SYMBOL(km_policy_expired);
1801
1802 #ifdef CONFIG_XFRM_MIGRATE
1803 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1804                struct xfrm_migrate *m, int num_migrate,
1805                struct xfrm_kmaddress *k)
1806 {
1807         int err = -EINVAL;
1808         int ret;
1809         struct xfrm_mgr *km;
1810
1811         read_lock(&xfrm_km_lock);
1812         list_for_each_entry(km, &xfrm_km_list, list) {
1813                 if (km->migrate) {
1814                         ret = km->migrate(sel, dir, type, m, num_migrate, k);
1815                         if (!ret)
1816                                 err = ret;
1817                 }
1818         }
1819         read_unlock(&xfrm_km_lock);
1820         return err;
1821 }
1822 EXPORT_SYMBOL(km_migrate);
1823 #endif
1824
1825 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1826 {
1827         int err = -EINVAL;
1828         int ret;
1829         struct xfrm_mgr *km;
1830
1831         read_lock(&xfrm_km_lock);
1832         list_for_each_entry(km, &xfrm_km_list, list) {
1833                 if (km->report) {
1834                         ret = km->report(proto, sel, addr);
1835                         if (!ret)
1836                                 err = ret;
1837                 }
1838         }
1839         read_unlock(&xfrm_km_lock);
1840         return err;
1841 }
1842 EXPORT_SYMBOL(km_report);
1843
1844 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1845 {
1846         int err;
1847         u8 *data;
1848         struct xfrm_mgr *km;
1849         struct xfrm_policy *pol = NULL;
1850
1851         if (optlen <= 0 || optlen > PAGE_SIZE)
1852                 return -EMSGSIZE;
1853
1854         data = kmalloc(optlen, GFP_KERNEL);
1855         if (!data)
1856                 return -ENOMEM;
1857
1858         err = -EFAULT;
1859         if (copy_from_user(data, optval, optlen))
1860                 goto out;
1861
1862         err = -EINVAL;
1863         read_lock(&xfrm_km_lock);
1864         list_for_each_entry(km, &xfrm_km_list, list) {
1865                 pol = km->compile_policy(sk, optname, data,
1866                                          optlen, &err);
1867                 if (err >= 0)
1868                         break;
1869         }
1870         read_unlock(&xfrm_km_lock);
1871
1872         if (err >= 0) {
1873                 xfrm_sk_policy_insert(sk, err, pol);
1874                 xfrm_pol_put(pol);
1875                 err = 0;
1876         }
1877
1878 out:
1879         kfree(data);
1880         return err;
1881 }
1882 EXPORT_SYMBOL(xfrm_user_policy);
1883
1884 int xfrm_register_km(struct xfrm_mgr *km)
1885 {
1886         write_lock_bh(&xfrm_km_lock);
1887         list_add_tail(&km->list, &xfrm_km_list);
1888         write_unlock_bh(&xfrm_km_lock);
1889         return 0;
1890 }
1891 EXPORT_SYMBOL(xfrm_register_km);
1892
1893 int xfrm_unregister_km(struct xfrm_mgr *km)
1894 {
1895         write_lock_bh(&xfrm_km_lock);
1896         list_del(&km->list);
1897         write_unlock_bh(&xfrm_km_lock);
1898         return 0;
1899 }
1900 EXPORT_SYMBOL(xfrm_unregister_km);
1901
1902 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1903 {
1904         int err = 0;
1905         if (unlikely(afinfo == NULL))
1906                 return -EINVAL;
1907         if (unlikely(afinfo->family >= NPROTO))
1908                 return -EAFNOSUPPORT;
1909         write_lock_bh(&xfrm_state_afinfo_lock);
1910         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1911                 err = -ENOBUFS;
1912         else
1913                 xfrm_state_afinfo[afinfo->family] = afinfo;
1914         write_unlock_bh(&xfrm_state_afinfo_lock);
1915         return err;
1916 }
1917 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1918
1919 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1920 {
1921         int err = 0;
1922         if (unlikely(afinfo == NULL))
1923                 return -EINVAL;
1924         if (unlikely(afinfo->family >= NPROTO))
1925                 return -EAFNOSUPPORT;
1926         write_lock_bh(&xfrm_state_afinfo_lock);
1927         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1928                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1929                         err = -EINVAL;
1930                 else
1931                         xfrm_state_afinfo[afinfo->family] = NULL;
1932         }
1933         write_unlock_bh(&xfrm_state_afinfo_lock);
1934         return err;
1935 }
1936 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1937
1938 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1939 {
1940         struct xfrm_state_afinfo *afinfo;
1941         if (unlikely(family >= NPROTO))
1942                 return NULL;
1943         read_lock(&xfrm_state_afinfo_lock);
1944         afinfo = xfrm_state_afinfo[family];
1945         if (unlikely(!afinfo))
1946                 read_unlock(&xfrm_state_afinfo_lock);
1947         return afinfo;
1948 }
1949
1950 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1951         __releases(xfrm_state_afinfo_lock)
1952 {
1953         read_unlock(&xfrm_state_afinfo_lock);
1954 }
1955
1956 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1957 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1958 {
1959         if (x->tunnel) {
1960                 struct xfrm_state *t = x->tunnel;
1961
1962                 if (atomic_read(&t->tunnel_users) == 2)
1963                         xfrm_state_delete(t);
1964                 atomic_dec(&t->tunnel_users);
1965                 xfrm_state_put(t);
1966                 x->tunnel = NULL;
1967         }
1968 }
1969 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1970
1971 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1972 {
1973         int res;
1974
1975         spin_lock_bh(&x->lock);
1976         if (x->km.state == XFRM_STATE_VALID &&
1977             x->type && x->type->get_mtu)
1978                 res = x->type->get_mtu(x, mtu);
1979         else
1980                 res = mtu - x->props.header_len;
1981         spin_unlock_bh(&x->lock);
1982         return res;
1983 }
1984
1985 int xfrm_init_state(struct xfrm_state *x)
1986 {
1987         struct xfrm_state_afinfo *afinfo;
1988         struct xfrm_mode *inner_mode;
1989         int family = x->props.family;
1990         int err;
1991
1992         err = -EAFNOSUPPORT;
1993         afinfo = xfrm_state_get_afinfo(family);
1994         if (!afinfo)
1995                 goto error;
1996
1997         err = 0;
1998         if (afinfo->init_flags)
1999                 err = afinfo->init_flags(x);
2000
2001         xfrm_state_put_afinfo(afinfo);
2002
2003         if (err)
2004                 goto error;
2005
2006         err = -EPROTONOSUPPORT;
2007
2008         if (x->sel.family != AF_UNSPEC) {
2009                 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2010                 if (inner_mode == NULL)
2011                         goto error;
2012
2013                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2014                     family != x->sel.family) {
2015                         xfrm_put_mode(inner_mode);
2016                         goto error;
2017                 }
2018
2019                 x->inner_mode = inner_mode;
2020         } else {
2021                 struct xfrm_mode *inner_mode_iaf;
2022
2023                 inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
2024                 if (inner_mode == NULL)
2025                         goto error;
2026
2027                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2028                         xfrm_put_mode(inner_mode);
2029                         goto error;
2030                 }
2031
2032                 inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
2033                 if (inner_mode_iaf == NULL)
2034                         goto error;
2035
2036                 if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
2037                         xfrm_put_mode(inner_mode_iaf);
2038                         goto error;
2039                 }
2040
2041                 if (x->props.family == AF_INET) {
2042                         x->inner_mode = inner_mode;
2043                         x->inner_mode_iaf = inner_mode_iaf;
2044                 } else {
2045                         x->inner_mode = inner_mode_iaf;
2046                         x->inner_mode_iaf = inner_mode;
2047                 }
2048         }
2049
2050         x->type = xfrm_get_type(x->id.proto, family);
2051         if (x->type == NULL)
2052                 goto error;
2053
2054         err = x->type->init_state(x);
2055         if (err)
2056                 goto error;
2057
2058         x->outer_mode = xfrm_get_mode(x->props.mode, family);
2059         if (x->outer_mode == NULL)
2060                 goto error;
2061
2062         x->km.state = XFRM_STATE_VALID;
2063
2064 error:
2065         return err;
2066 }
2067
2068 EXPORT_SYMBOL(xfrm_init_state);
2069
2070 int __net_init xfrm_state_init(struct net *net)
2071 {
2072         unsigned int sz;
2073
2074         INIT_LIST_HEAD(&net->xfrm.state_all);
2075
2076         sz = sizeof(struct hlist_head) * 8;
2077
2078         net->xfrm.state_bydst = xfrm_hash_alloc(sz);
2079         if (!net->xfrm.state_bydst)
2080                 goto out_bydst;
2081         net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
2082         if (!net->xfrm.state_bysrc)
2083                 goto out_bysrc;
2084         net->xfrm.state_byspi = xfrm_hash_alloc(sz);
2085         if (!net->xfrm.state_byspi)
2086                 goto out_byspi;
2087         net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2088
2089         net->xfrm.state_num = 0;
2090         INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
2091         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
2092         return 0;
2093
2094 out_byspi:
2095         xfrm_hash_free(net->xfrm.state_bysrc, sz);
2096 out_bysrc:
2097         xfrm_hash_free(net->xfrm.state_bydst, sz);
2098 out_bydst:
2099         return -ENOMEM;
2100 }
2101
2102 void xfrm_state_fini(struct net *net)
2103 {
2104         unsigned int sz;
2105
2106         WARN_ON(!list_empty(&net->xfrm.state_all));
2107
2108         sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
2109         WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2110         xfrm_hash_free(net->xfrm.state_byspi, sz);
2111         WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2112         xfrm_hash_free(net->xfrm.state_bysrc, sz);
2113         WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2114         xfrm_hash_free(net->xfrm.state_bydst, sz);
2115 }
2116
2117 #ifdef CONFIG_AUDITSYSCALL
2118 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2119                                      struct audit_buffer *audit_buf)
2120 {
2121         struct xfrm_sec_ctx *ctx = x->security;
2122         u32 spi = ntohl(x->id.spi);
2123
2124         if (ctx)
2125                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2126                                  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2127
2128         switch(x->props.family) {
2129         case AF_INET:
2130                 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2131                                  &x->props.saddr.a4, &x->id.daddr.a4);
2132                 break;
2133         case AF_INET6:
2134                 audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
2135                                  x->props.saddr.a6, x->id.daddr.a6);
2136                 break;
2137         }
2138
2139         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2140 }
2141
2142 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2143                                       struct audit_buffer *audit_buf)
2144 {
2145         struct iphdr *iph4;
2146         struct ipv6hdr *iph6;
2147
2148         switch (family) {
2149         case AF_INET:
2150                 iph4 = ip_hdr(skb);
2151                 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2152                                  &iph4->saddr, &iph4->daddr);
2153                 break;
2154         case AF_INET6:
2155                 iph6 = ipv6_hdr(skb);
2156                 audit_log_format(audit_buf,
2157                                  " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2158                                  &iph6->saddr,&iph6->daddr,
2159                                  iph6->flow_lbl[0] & 0x0f,
2160                                  iph6->flow_lbl[1],
2161                                  iph6->flow_lbl[2]);
2162                 break;
2163         }
2164 }
2165
2166 void xfrm_audit_state_add(struct xfrm_state *x, int result,
2167                           uid_t auid, u32 sessionid, u32 secid)
2168 {
2169         struct audit_buffer *audit_buf;
2170
2171         audit_buf = xfrm_audit_start("SAD-add");
2172         if (audit_buf == NULL)
2173                 return;
2174         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2175         xfrm_audit_helper_sainfo(x, audit_buf);
2176         audit_log_format(audit_buf, " res=%u", result);
2177         audit_log_end(audit_buf);
2178 }
2179 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2180
2181 void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2182                              uid_t auid, u32 sessionid, u32 secid)
2183 {
2184         struct audit_buffer *audit_buf;
2185
2186         audit_buf = xfrm_audit_start("SAD-delete");
2187         if (audit_buf == NULL)
2188                 return;
2189         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2190         xfrm_audit_helper_sainfo(x, audit_buf);
2191         audit_log_format(audit_buf, " res=%u", result);
2192         audit_log_end(audit_buf);
2193 }
2194 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2195
2196 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2197                                       struct sk_buff *skb)
2198 {
2199         struct audit_buffer *audit_buf;
2200         u32 spi;
2201
2202         audit_buf = xfrm_audit_start("SA-replay-overflow");
2203         if (audit_buf == NULL)
2204                 return;
2205         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2206         /* don't record the sequence number because it's inherent in this kind
2207          * of audit message */
2208         spi = ntohl(x->id.spi);
2209         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2210         audit_log_end(audit_buf);
2211 }
2212 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2213
2214 static void xfrm_audit_state_replay(struct xfrm_state *x,
2215                              struct sk_buff *skb, __be32 net_seq)
2216 {
2217         struct audit_buffer *audit_buf;
2218         u32 spi;
2219
2220         audit_buf = xfrm_audit_start("SA-replayed-pkt");
2221         if (audit_buf == NULL)
2222                 return;
2223         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2224         spi = ntohl(x->id.spi);
2225         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2226                          spi, spi, ntohl(net_seq));
2227         audit_log_end(audit_buf);
2228 }
2229
2230 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2231 {
2232         struct audit_buffer *audit_buf;
2233
2234         audit_buf = xfrm_audit_start("SA-notfound");
2235         if (audit_buf == NULL)
2236                 return;
2237         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2238         audit_log_end(audit_buf);
2239 }
2240 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2241
2242 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2243                                __be32 net_spi, __be32 net_seq)
2244 {
2245         struct audit_buffer *audit_buf;
2246         u32 spi;
2247
2248         audit_buf = xfrm_audit_start("SA-notfound");
2249         if (audit_buf == NULL)
2250                 return;
2251         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2252         spi = ntohl(net_spi);
2253         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2254                          spi, spi, ntohl(net_seq));
2255         audit_log_end(audit_buf);
2256 }
2257 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2258
2259 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2260                               struct sk_buff *skb, u8 proto)
2261 {
2262         struct audit_buffer *audit_buf;
2263         __be32 net_spi;
2264         __be32 net_seq;
2265
2266         audit_buf = xfrm_audit_start("SA-icv-failure");
2267         if (audit_buf == NULL)
2268                 return;
2269         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2270         if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2271                 u32 spi = ntohl(net_spi);
2272                 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2273                                  spi, spi, ntohl(net_seq));
2274         }
2275         audit_log_end(audit_buf);
2276 }
2277 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2278 #endif /* CONFIG_AUDITSYSCALL */