]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - net/xfrm/xfrm_state.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'lvs-next-2.6' of git://git.kernel.org/pub/scm/linux/kernel/git/horms...
[mirror_ubuntu-artful-kernel.git] / net / xfrm / xfrm_state.c
CommitLineData
1da177e4
LT		 1/*
2 * xfrm_state.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
df71837d 13 *
1da177e4
LT		 14 */
15
16#include <linux/workqueue.h>
17#include <net/xfrm.h>
18#include <linux/pfkeyv2.h>
19#include <linux/ipsec.h>
20#include <linux/module.h>
f034b5d4 21#include <linux/cache.h>
68277acc 22#include <linux/audit.h>
b5890d8b 23#include <asm/uaccess.h>
1da177e4 24
44e36b42
DM		 25#include "xfrm_hash.h"
26
ee857a7d
DM		 27struct sock *xfrm_nl;
28EXPORT_SYMBOL(xfrm_nl);
29
01e67d08 30u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
a70fcb0b
DM		 31EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
32
01e67d08 33u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
a70fcb0b
DM		 34EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
35
01e67d08
DM		 36u32 sysctl_xfrm_acq_expires __read_mostly = 30;
37
1da177e4
LT		 38/* Each xfrm_state may be linked to two tables:
39
40 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
a624c108 41 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
1da177e4
LT		 42 destination/tunnel endpoint. (output)
43 */
44
45static DEFINE_SPINLOCK(xfrm_state_lock);
46
47/* Hash table to find appropriate SA towards given target (endpoint
48 * of tunnel or destination of transport mode) allowed by selector.
49 *
50 * Main use is finding SA after policy selected tunnel or transport mode.
51 * Also, it can be used by ah/esp icmp error handler to find offending SA.
52 */
4c563f76 53static LIST_HEAD(xfrm_state_all);
f034b5d4
DM		 54static struct hlist_head *xfrm_state_bydst __read_mostly;
55static struct hlist_head *xfrm_state_bysrc __read_mostly;
56static struct hlist_head *xfrm_state_byspi __read_mostly;
57static unsigned int xfrm_state_hmask __read_mostly;
58static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
59static unsigned int xfrm_state_num;
9d4a706d 60static unsigned int xfrm_state_genid;
f034b5d4 61
17c2a42a
HX		 62static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
63static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
64
afeb14b4
PM		 65#ifdef CONFIG_AUDITSYSCALL
66static void xfrm_audit_state_replay(struct xfrm_state *x,
67 struct sk_buff *skb, __be32 net_seq);
68#else
69#define xfrm_audit_state_replay(x, s, sq) do { ; } while (0)
70#endif /* CONFIG_AUDITSYSCALL */
71
c1969f29
DM		 72static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
73 xfrm_address_t *saddr,
74 u32 reqid,
a624c108 75 unsigned short family)
f034b5d4 76{
c1969f29 77 return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
f034b5d4
DM		 78}
79
667bbcb6
MN		 80static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
81 xfrm_address_t *saddr,
44e36b42 82 unsigned short family)
f034b5d4 83{
667bbcb6 84 return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
f034b5d4
DM		 85}
86
f034b5d4 87static inline unsigned int
8122adf0 88xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
f034b5d4 89{
c1969f29 90 return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
f034b5d4
DM		 91}
92
f034b5d4
DM		 93static void xfrm_hash_transfer(struct hlist_head *list,
94 struct hlist_head *ndsttable,
95 struct hlist_head *nsrctable,
96 struct hlist_head *nspitable,
97 unsigned int nhashmask)
98{
99 struct hlist_node *entry, *tmp;
100 struct xfrm_state *x;
101
102 hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
103 unsigned int h;
104
c1969f29
DM		 105 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
106 x->props.reqid, x->props.family,
107 nhashmask);
f034b5d4
DM		 108 hlist_add_head(&x->bydst, ndsttable+h);
109
667bbcb6
MN		 110 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
111 x->props.family,
f034b5d4
DM		 112 nhashmask);
113 hlist_add_head(&x->bysrc, nsrctable+h);
114
7b4dc360
MN		 115 if (x->id.spi) {
116 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
117 x->id.proto, x->props.family,
118 nhashmask);
119 hlist_add_head(&x->byspi, nspitable+h);
120 }
f034b5d4
DM		 121 }
122}
123
124static unsigned long xfrm_hash_new_size(void)
125{
126 return ((xfrm_state_hmask + 1) << 1) *
127 sizeof(struct hlist_head);
128}
129
130static DEFINE_MUTEX(hash_resize_mutex);
131
c4028958 132static void xfrm_hash_resize(struct work_struct *__unused)
f034b5d4
DM		 133{
134 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
135 unsigned long nsize, osize;
136 unsigned int nhashmask, ohashmask;
137 int i;
138
139 mutex_lock(&hash_resize_mutex);
140
141 nsize = xfrm_hash_new_size();
44e36b42 142 ndst = xfrm_hash_alloc(nsize);
f034b5d4
DM		 143 if (!ndst)
144 goto out_unlock;
44e36b42 145 nsrc = xfrm_hash_alloc(nsize);
f034b5d4 146 if (!nsrc) {
44e36b42 147 xfrm_hash_free(ndst, nsize);
f034b5d4
DM		 148 goto out_unlock;
149 }
44e36b42 150 nspi = xfrm_hash_alloc(nsize);
f034b5d4 151 if (!nspi) {
44e36b42
DM		 152 xfrm_hash_free(ndst, nsize);
153 xfrm_hash_free(nsrc, nsize);
f034b5d4
DM		 154 goto out_unlock;
155 }
156
157 spin_lock_bh(&xfrm_state_lock);
158
159 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
160 for (i = xfrm_state_hmask; i >= 0; i--)
161 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
162 nhashmask);
163
164 odst = xfrm_state_bydst;
165 osrc = xfrm_state_bysrc;
166 ospi = xfrm_state_byspi;
167 ohashmask = xfrm_state_hmask;
168
169 xfrm_state_bydst = ndst;
170 xfrm_state_bysrc = nsrc;
171 xfrm_state_byspi = nspi;
172 xfrm_state_hmask = nhashmask;
173
174 spin_unlock_bh(&xfrm_state_lock);
175
176 osize = (ohashmask + 1) * sizeof(struct hlist_head);
44e36b42
DM		 177 xfrm_hash_free(odst, osize);
178 xfrm_hash_free(osrc, osize);
179 xfrm_hash_free(ospi, osize);
f034b5d4
DM		 180
181out_unlock:
182 mutex_unlock(&hash_resize_mutex);
183}
184
c4028958 185static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
f034b5d4 186
1da177e4
LT		 187DECLARE_WAIT_QUEUE_HEAD(km_waitq);
188EXPORT_SYMBOL(km_waitq);
189
190static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
191static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
192
193static struct work_struct xfrm_state_gc_work;
8f126e37 194static HLIST_HEAD(xfrm_state_gc_list);
1da177e4
LT		 195static DEFINE_SPINLOCK(xfrm_state_gc_lock);
196
53bc6b4d 197int __xfrm_state_delete(struct xfrm_state *x);
1da177e4 198
980ebd25 199int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
53bc6b4d 200void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
1da177e4 201
aa5d62cc
HX		 202static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
203{
204 struct xfrm_state_afinfo *afinfo;
205 if (unlikely(family >= NPROTO))
206 return NULL;
207 write_lock_bh(&xfrm_state_afinfo_lock);
208 afinfo = xfrm_state_afinfo[family];
209 if (unlikely(!afinfo))
210 write_unlock_bh(&xfrm_state_afinfo_lock);
211 return afinfo;
212}
213
214static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
9a429c49 215 __releases(xfrm_state_afinfo_lock)
aa5d62cc
HX		 216{
217 write_unlock_bh(&xfrm_state_afinfo_lock);
218}
219
533cb5b0 220int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
aa5d62cc
HX		 221{
222 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
533cb5b0 223 const struct xfrm_type **typemap;
aa5d62cc
HX		 224 int err = 0;
225
226 if (unlikely(afinfo == NULL))
227 return -EAFNOSUPPORT;
228 typemap = afinfo->type_map;
229
230 if (likely(typemap[type->proto] == NULL))
231 typemap[type->proto] = type;
232 else
233 err = -EEXIST;
234 xfrm_state_unlock_afinfo(afinfo);
235 return err;
236}
237EXPORT_SYMBOL(xfrm_register_type);
238
533cb5b0 239int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
aa5d62cc
HX		 240{
241 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
533cb5b0 242 const struct xfrm_type **typemap;
aa5d62cc
HX		 243 int err = 0;
244
245 if (unlikely(afinfo == NULL))
246 return -EAFNOSUPPORT;
247 typemap = afinfo->type_map;
248
249 if (unlikely(typemap[type->proto] != type))
250 err = -ENOENT;
251 else
252 typemap[type->proto] = NULL;
253 xfrm_state_unlock_afinfo(afinfo);
254 return err;
255}
256EXPORT_SYMBOL(xfrm_unregister_type);
257
533cb5b0 258static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
aa5d62cc
HX		 259{
260 struct xfrm_state_afinfo *afinfo;
533cb5b0
ED		 261 const struct xfrm_type **typemap;
262 const struct xfrm_type *type;
aa5d62cc
HX		 263 int modload_attempted = 0;
264
265retry:
266 afinfo = xfrm_state_get_afinfo(family);
267 if (unlikely(afinfo == NULL))
268 return NULL;
269 typemap = afinfo->type_map;
270
271 type = typemap[proto];
272 if (unlikely(type && !try_module_get(type->owner)))
273 type = NULL;
274 if (!type && !modload_attempted) {
275 xfrm_state_put_afinfo(afinfo);
276 request_module("xfrm-type-%d-%d", family, proto);
277 modload_attempted = 1;
278 goto retry;
279 }
280
281 xfrm_state_put_afinfo(afinfo);
282 return type;
283}
284
533cb5b0 285static void xfrm_put_type(const struct xfrm_type *type)
aa5d62cc
HX		 286{
287 module_put(type->owner);
288}
289
290int xfrm_register_mode(struct xfrm_mode *mode, int family)
291{
292 struct xfrm_state_afinfo *afinfo;
293 struct xfrm_mode **modemap;
294 int err;
295
296 if (unlikely(mode->encap >= XFRM_MODE_MAX))
297 return -EINVAL;
298
299 afinfo = xfrm_state_lock_afinfo(family);
300 if (unlikely(afinfo == NULL))
301 return -EAFNOSUPPORT;
302
303 err = -EEXIST;
304 modemap = afinfo->mode_map;
17c2a42a
HX		 305 if (modemap[mode->encap])
306 goto out;
aa5d62cc 307
17c2a42a
HX		 308 err = -ENOENT;
309 if (!try_module_get(afinfo->owner))
310 goto out;
311
312 mode->afinfo = afinfo;
313 modemap[mode->encap] = mode;
314 err = 0;
315
316out:
aa5d62cc
HX		 317 xfrm_state_unlock_afinfo(afinfo);
318 return err;
319}
320EXPORT_SYMBOL(xfrm_register_mode);
321
322int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
323{
324 struct xfrm_state_afinfo *afinfo;
325 struct xfrm_mode **modemap;
326 int err;
327
328 if (unlikely(mode->encap >= XFRM_MODE_MAX))
329 return -EINVAL;
330
331 afinfo = xfrm_state_lock_afinfo(family);
332 if (unlikely(afinfo == NULL))
333 return -EAFNOSUPPORT;
334
335 err = -ENOENT;
336 modemap = afinfo->mode_map;
337 if (likely(modemap[mode->encap] == mode)) {
338 modemap[mode->encap] = NULL;
17c2a42a 339 module_put(mode->afinfo->owner);
aa5d62cc
HX		 340 err = 0;
341 }
342
343 xfrm_state_unlock_afinfo(afinfo);
344 return err;
345}
346EXPORT_SYMBOL(xfrm_unregister_mode);
347
348static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
349{
350 struct xfrm_state_afinfo *afinfo;
351 struct xfrm_mode *mode;
352 int modload_attempted = 0;
353
354 if (unlikely(encap >= XFRM_MODE_MAX))
355 return NULL;
356
357retry:
358 afinfo = xfrm_state_get_afinfo(family);
359 if (unlikely(afinfo == NULL))
360 return NULL;
361
362 mode = afinfo->mode_map[encap];
363 if (unlikely(mode && !try_module_get(mode->owner)))
364 mode = NULL;
365 if (!mode && !modload_attempted) {
366 xfrm_state_put_afinfo(afinfo);
367 request_module("xfrm-mode-%d-%d", family, encap);
368 modload_attempted = 1;
369 goto retry;
370 }
371
372 xfrm_state_put_afinfo(afinfo);
373 return mode;
374}
375
376static void xfrm_put_mode(struct xfrm_mode *mode)
377{
378 module_put(mode->owner);
379}
380
1da177e4
LT		 381static void xfrm_state_gc_destroy(struct xfrm_state *x)
382{
a47f0ce0
DM		 383 del_timer_sync(&x->timer);
384 del_timer_sync(&x->rtimer);
a51482bd
JJ		 385 kfree(x->aalg);
386 kfree(x->ealg);
387 kfree(x->calg);
388 kfree(x->encap);
060f02a3 389 kfree(x->coaddr);
13996378
HX		 390 if (x->inner_mode)
391 xfrm_put_mode(x->inner_mode);
df9dcb45
KM		 392 if (x->inner_mode_iaf)
393 xfrm_put_mode(x->inner_mode_iaf);
13996378
HX		 394 if (x->outer_mode)
395 xfrm_put_mode(x->outer_mode);
1da177e4
LT		 396 if (x->type) {
397 x->type->destructor(x);
398 xfrm_put_type(x->type);
399 }
df71837d 400 security_xfrm_state_free(x);
1da177e4
LT		 401 kfree(x);
402}
403
c4028958 404static void xfrm_state_gc_task(struct work_struct *data)
1da177e4
LT		 405{
406 struct xfrm_state *x;
8f126e37
DM		 407 struct hlist_node *entry, *tmp;
408 struct hlist_head gc_list;
1da177e4 409
1da177e4 410 spin_lock_bh(&xfrm_state_gc_lock);
8f126e37
DM		 411 gc_list.first = xfrm_state_gc_list.first;
412 INIT_HLIST_HEAD(&xfrm_state_gc_list);
1da177e4
LT		 413 spin_unlock_bh(&xfrm_state_gc_lock);
414
8f126e37 415 hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
1da177e4 416 xfrm_state_gc_destroy(x);
8f126e37 417
1da177e4
LT		 418 wake_up(&km_waitq);
419}
420
421static inline unsigned long make_jiffies(long secs)
422{
423 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
424 return MAX_SCHEDULE_TIMEOUT-1;
425 else
a716c119 426 return secs*HZ;
1da177e4
LT		 427}
428
429static void xfrm_timer_handler(unsigned long data)
430{
431 struct xfrm_state *x = (struct xfrm_state*)data;
9d729f72 432 unsigned long now = get_seconds();
1da177e4
LT		 433 long next = LONG_MAX;
434 int warn = 0;
161a09e7 435 int err = 0;
1da177e4
LT		 436
437 spin_lock(&x->lock);
438 if (x->km.state == XFRM_STATE_DEAD)
439 goto out;
440 if (x->km.state == XFRM_STATE_EXPIRED)
441 goto expired;
442 if (x->lft.hard_add_expires_seconds) {
443 long tmo = x->lft.hard_add_expires_seconds +
444 x->curlft.add_time - now;
445 if (tmo <= 0)
446 goto expired;
447 if (tmo < next)
448 next = tmo;
449 }
450 if (x->lft.hard_use_expires_seconds) {
451 long tmo = x->lft.hard_use_expires_seconds +
452 (x->curlft.use_time ? : now) - now;
453 if (tmo <= 0)
454 goto expired;
455 if (tmo < next)
456 next = tmo;
457 }
458 if (x->km.dying)
459 goto resched;
460 if (x->lft.soft_add_expires_seconds) {
461 long tmo = x->lft.soft_add_expires_seconds +
462 x->curlft.add_time - now;
463 if (tmo <= 0)
464 warn = 1;
465 else if (tmo < next)
466 next = tmo;
467 }
468 if (x->lft.soft_use_expires_seconds) {
469 long tmo = x->lft.soft_use_expires_seconds +
470 (x->curlft.use_time ? : now) - now;
471 if (tmo <= 0)
472 warn = 1;
473 else if (tmo < next)
474 next = tmo;
475 }
476
4666faab 477 x->km.dying = warn;
1da177e4 478 if (warn)
53bc6b4d 479 km_state_expired(x, 0, 0);
1da177e4 480resched:
a47f0ce0
DM		 481 if (next != LONG_MAX)
482 mod_timer(&x->timer, jiffies + make_jiffies(next));
483
1da177e4
LT		 484 goto out;
485
486expired:
487 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
488 x->km.state = XFRM_STATE_EXPIRED;
489 wake_up(&km_waitq);
490 next = 2;
491 goto resched;
492 }
161a09e7
JL		 493
494 err = __xfrm_state_delete(x);
495 if (!err && x->id.spi)
53bc6b4d 496 km_state_expired(x, 1, 0);
1da177e4 497
ab5f5e8b 498 xfrm_audit_state_delete(x, err ? 0 : 1,
2532386f
EP		 499 audit_get_loginuid(current),
500 audit_get_sessionid(current), 0);
161a09e7 501
1da177e4
LT		 502out:
503 spin_unlock(&x->lock);
1da177e4
LT		 504}
505
0ac84752
DM		 506static void xfrm_replay_timer_handler(unsigned long data);
507
1da177e4
LT		 508struct xfrm_state *xfrm_state_alloc(void)
509{
510 struct xfrm_state *x;
511
0da974f4 512 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
1da177e4
LT		 513
514 if (x) {
1da177e4
LT		 515 atomic_set(&x->refcnt, 1);
516 atomic_set(&x->tunnel_users, 0);
4c563f76 517 INIT_LIST_HEAD(&x->all);
8f126e37
DM		 518 INIT_HLIST_NODE(&x->bydst);
519 INIT_HLIST_NODE(&x->bysrc);
520 INIT_HLIST_NODE(&x->byspi);
b24b8a24
PE		 521 setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
522 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
523 (unsigned long)x);
9d729f72 524 x->curlft.add_time = get_seconds();
1da177e4
LT		 525 x->lft.soft_byte_limit = XFRM_INF;
526 x->lft.soft_packet_limit = XFRM_INF;
527 x->lft.hard_byte_limit = XFRM_INF;
528 x->lft.hard_packet_limit = XFRM_INF;
f8cd5488
JHS		 529 x->replay_maxage = 0;
530 x->replay_maxdiff = 0;
df9dcb45
KM		 531 x->inner_mode = NULL;
532 x->inner_mode_iaf = NULL;
1da177e4
LT		 533 spin_lock_init(&x->lock);
534 }
535 return x;
536}
537EXPORT_SYMBOL(xfrm_state_alloc);
538
539void __xfrm_state_destroy(struct xfrm_state *x)
540{
547b792c 541 WARN_ON(x->km.state != XFRM_STATE_DEAD);
1da177e4 542
4c563f76
TT		 543 spin_lock_bh(&xfrm_state_lock);
544 list_del(&x->all);
545 spin_unlock_bh(&xfrm_state_lock);
546
1da177e4 547 spin_lock_bh(&xfrm_state_gc_lock);
8f126e37 548 hlist_add_head(&x->bydst, &xfrm_state_gc_list);
1da177e4
LT		 549 spin_unlock_bh(&xfrm_state_gc_lock);
550 schedule_work(&xfrm_state_gc_work);
551}
552EXPORT_SYMBOL(__xfrm_state_destroy);
553
53bc6b4d 554int __xfrm_state_delete(struct xfrm_state *x)
1da177e4 555{
26b15dad
JHS		 556 int err = -ESRCH;
557
1da177e4
LT		 558 if (x->km.state != XFRM_STATE_DEAD) {
559 x->km.state = XFRM_STATE_DEAD;
560 spin_lock(&xfrm_state_lock);
8f126e37 561 hlist_del(&x->bydst);
8f126e37 562 hlist_del(&x->bysrc);
a47f0ce0 563 if (x->id.spi)
8f126e37 564 hlist_del(&x->byspi);
f034b5d4 565 xfrm_state_num--;
1da177e4 566 spin_unlock(&xfrm_state_lock);
1da177e4 567
1da177e4
LT		 568 /* All xfrm_state objects are created by xfrm_state_alloc.
569 * The xfrm_state_alloc call gives a reference, and that
570 * is what we are dropping here.
571 */
5dba4797 572 xfrm_state_put(x);
26b15dad 573 err = 0;
1da177e4 574 }
26b15dad
JHS		 575
576 return err;
1da177e4 577}
53bc6b4d 578EXPORT_SYMBOL(__xfrm_state_delete);
1da177e4 579
26b15dad 580int xfrm_state_delete(struct xfrm_state *x)
1da177e4 581{
26b15dad
JHS		 582 int err;
583
1da177e4 584 spin_lock_bh(&x->lock);
26b15dad 585 err = __xfrm_state_delete(x);
1da177e4 586 spin_unlock_bh(&x->lock);
26b15dad
JHS		 587
588 return err;
1da177e4
LT		 589}
590EXPORT_SYMBOL(xfrm_state_delete);
591
4aa2e62c
JL		 592#ifdef CONFIG_SECURITY_NETWORK_XFRM
593static inline int
594xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
1da177e4 595{
4aa2e62c
JL		 596 int i, err = 0;
597
598 for (i = 0; i <= xfrm_state_hmask; i++) {
599 struct hlist_node *entry;
600 struct xfrm_state *x;
601
602 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
603 if (xfrm_id_proto_match(x->id.proto, proto) &&
604 (err = security_xfrm_state_delete(x)) != 0) {
ab5f5e8b
JL		 605 xfrm_audit_state_delete(x, 0,
606 audit_info->loginuid,
2532386f 607 audit_info->sessionid,
ab5f5e8b 608 audit_info->secid);
4aa2e62c
JL		 609 return err;
610 }
611 }
612 }
613
614 return err;
615}
616#else
617static inline int
618xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
619{
620 return 0;
621}
622#endif
623
624int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
625{
626 int i, err = 0;
1da177e4
LT		 627
628 spin_lock_bh(&xfrm_state_lock);
4aa2e62c
JL		 629 err = xfrm_state_flush_secctx_check(proto, audit_info);
630 if (err)
631 goto out;
632
a9917c06 633 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37
DM		 634 struct hlist_node *entry;
635 struct xfrm_state *x;
1da177e4 636restart:
8f126e37 637 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1da177e4 638 if (!xfrm_state_kern(x) &&
5794708f 639 xfrm_id_proto_match(x->id.proto, proto)) {
1da177e4
LT		 640 xfrm_state_hold(x);
641 spin_unlock_bh(&xfrm_state_lock);
642
161a09e7 643 err = xfrm_state_delete(x);
ab5f5e8b
JL		 644 xfrm_audit_state_delete(x, err ? 0 : 1,
645 audit_info->loginuid,
2532386f 646 audit_info->sessionid,
ab5f5e8b 647 audit_info->secid);
1da177e4
LT		 648 xfrm_state_put(x);
649
650 spin_lock_bh(&xfrm_state_lock);
651 goto restart;
652 }
653 }
654 }
4aa2e62c
JL		 655 err = 0;
656
657out:
1da177e4
LT		 658 spin_unlock_bh(&xfrm_state_lock);
659 wake_up(&km_waitq);
4aa2e62c 660 return err;
1da177e4
LT		 661}
662EXPORT_SYMBOL(xfrm_state_flush);
663
af11e316 664void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
28d8909b
JHS		 665{
666 spin_lock_bh(&xfrm_state_lock);
667 si->sadcnt = xfrm_state_num;
668 si->sadhcnt = xfrm_state_hmask;
669 si->sadhmcnt = xfrm_state_hashmax;
670 spin_unlock_bh(&xfrm_state_lock);
671}
672EXPORT_SYMBOL(xfrm_sad_getinfo);
673
1da177e4
LT		 674static int
675xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
676 struct xfrm_tmpl *tmpl,
677 xfrm_address_t *daddr, xfrm_address_t *saddr,
678 unsigned short family)
679{
680 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
681 if (!afinfo)
682 return -1;
683 afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
684 xfrm_state_put_afinfo(afinfo);
685 return 0;
686}
687
a94cfd19 688static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
edcd5821
DM		 689{
690 unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
691 struct xfrm_state *x;
8f126e37 692 struct hlist_node *entry;
edcd5821 693
8f126e37 694 hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
edcd5821
DM		 695 if (x->props.family != family ||
696 x->id.spi != spi ||
697 x->id.proto != proto)
698 continue;
699
700 switch (family) {
701 case AF_INET:
702 if (x->id.daddr.a4 != daddr->a4)
703 continue;
704 break;
705 case AF_INET6:
706 if (!ipv6_addr_equal((struct in6_addr *)daddr,
707 (struct in6_addr *)
708 x->id.daddr.a6))
709 continue;
710 break;
3ff50b79 711 }
edcd5821
DM		 712
713 xfrm_state_hold(x);
714 return x;
715 }
716
717 return NULL;
718}
719
720static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
721{
667bbcb6 722 unsigned int h = xfrm_src_hash(daddr, saddr, family);
edcd5821 723 struct xfrm_state *x;
8f126e37 724 struct hlist_node *entry;
edcd5821 725
8f126e37 726 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
edcd5821
DM		 727 if (x->props.family != family ||
728 x->id.proto != proto)
729 continue;
730
731 switch (family) {
732 case AF_INET:
733 if (x->id.daddr.a4 != daddr->a4 ||
734 x->props.saddr.a4 != saddr->a4)
735 continue;
736 break;
737 case AF_INET6:
738 if (!ipv6_addr_equal((struct in6_addr *)daddr,
739 (struct in6_addr *)
740 x->id.daddr.a6) ||
741 !ipv6_addr_equal((struct in6_addr *)saddr,
742 (struct in6_addr *)
743 x->props.saddr.a6))
744 continue;
745 break;
3ff50b79 746 }
edcd5821
DM		 747
748 xfrm_state_hold(x);
749 return x;
750 }
751
752 return NULL;
753}
754
755static inline struct xfrm_state *
756__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
757{
758 if (use_spi)
759 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
760 x->id.proto, family);
761 else
762 return __xfrm_state_lookup_byaddr(&x->id.daddr,
763 &x->props.saddr,
764 x->id.proto, family);
765}
766
2fab22f2
PM		 767static void xfrm_hash_grow_check(int have_hash_collision)
768{
769 if (have_hash_collision &&
770 (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
771 xfrm_state_num > xfrm_state_hmask)
772 schedule_work(&xfrm_hash_work);
773}
774
1da177e4 775struct xfrm_state *
a716c119 776xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1da177e4
LT		 777 struct flowi *fl, struct xfrm_tmpl *tmpl,
778 struct xfrm_policy *pol, int *err,
779 unsigned short family)
780{
4bda4f25 781 unsigned int h;
8f126e37 782 struct hlist_node *entry;
37b08e34 783 struct xfrm_state *x, *x0, *to_put;
1da177e4
LT		 784 int acquire_in_progress = 0;
785 int error = 0;
786 struct xfrm_state *best = NULL;
a716c119 787
37b08e34
DM		 788 to_put = NULL;
789
1da177e4 790 spin_lock_bh(&xfrm_state_lock);
4bda4f25 791 h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
8f126e37 792 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1da177e4
LT		 793 if (x->props.family == family &&
794 x->props.reqid == tmpl->reqid &&
fbd9a5b4 795 !(x->props.flags & XFRM_STATE_WILDRECV) &&
1da177e4
LT		 796 xfrm_state_addr_check(x, daddr, saddr, family) &&
797 tmpl->mode == x->props.mode &&
798 tmpl->id.proto == x->id.proto &&
799 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
800 /* Resolution logic:
801 1. There is a valid state with matching selector.
802 Done.
803 2. Valid state with inappropriate selector. Skip.
804
805 Entering area of "sysdeps".
806
807 3. If state is not valid, selector is temporary,
808 it selects only session which triggered
809 previous resolution. Key manager will do
810 something to install a state with proper
811 selector.
812 */
813 if (x->km.state == XFRM_STATE_VALID) {
df9dcb45 814 if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
e0d1caa7 815 !security_xfrm_state_pol_flow_match(x, pol, fl))
1da177e4
LT		 816 continue;
817 if (!best ||
818 best->km.dying > x->km.dying ||
819 (best->km.dying == x->km.dying &&
820 best->curlft.add_time < x->curlft.add_time))
821 best = x;
822 } else if (x->km.state == XFRM_STATE_ACQ) {
823 acquire_in_progress = 1;
824 } else if (x->km.state == XFRM_STATE_ERROR ||
825 x->km.state == XFRM_STATE_EXPIRED) {
48b8d783 826 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
e0d1caa7 827 security_xfrm_state_pol_flow_match(x, pol, fl))
1da177e4
LT		 828 error = -ESRCH;
829 }
830 }
831 }
832
833 x = best;
834 if (!x && !error && !acquire_in_progress) {
5c5d281a 835 if (tmpl->id.spi &&
edcd5821
DM		 836 (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
837 tmpl->id.proto, family)) != NULL) {
37b08e34 838 to_put = x0;
1da177e4
LT		 839 error = -EEXIST;
840 goto out;
841 }
842 x = xfrm_state_alloc();
843 if (x == NULL) {
844 error = -ENOMEM;
845 goto out;
846 }
847 /* Initialize temporary selector matching only
848 * to current session. */
849 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
850
e0d1caa7
VY		 851 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
852 if (error) {
853 x->km.state = XFRM_STATE_DEAD;
37b08e34 854 to_put = x;
e0d1caa7
VY		 855 x = NULL;
856 goto out;
857 }
858
1da177e4
LT		 859 if (km_query(x, tmpl, pol) == 0) {
860 x->km.state = XFRM_STATE_ACQ;
225f4005 861 list_add_tail(&x->all, &xfrm_state_all);
8f126e37 862 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
667bbcb6 863 h = xfrm_src_hash(daddr, saddr, family);
8f126e37 864 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1da177e4
LT		 865 if (x->id.spi) {
866 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
8f126e37 867 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1da177e4 868 }
01e67d08
DM		 869 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
870 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1da177e4 871 add_timer(&x->timer);
2fab22f2
PM		 872 xfrm_state_num++;
873 xfrm_hash_grow_check(x->bydst.next != NULL);
1da177e4
LT		 874 } else {
875 x->km.state = XFRM_STATE_DEAD;
37b08e34 876 to_put = x;
1da177e4
LT		 877 x = NULL;
878 error = -ESRCH;
879 }
880 }
881out:
882 if (x)
883 xfrm_state_hold(x);
884 else
885 *err = acquire_in_progress ? -EAGAIN : error;
886 spin_unlock_bh(&xfrm_state_lock);
37b08e34
DM		 887 if (to_put)
888 xfrm_state_put(to_put);
1da177e4
LT		 889 return x;
890}
891
628529b6
JHS		 892struct xfrm_state *
893xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
894 unsigned short family, u8 mode, u8 proto, u32 reqid)
895{
4bda4f25 896 unsigned int h;
628529b6
JHS		 897 struct xfrm_state *rx = NULL, *x = NULL;
898 struct hlist_node *entry;
899
900 spin_lock(&xfrm_state_lock);
4bda4f25 901 h = xfrm_dst_hash(daddr, saddr, reqid, family);
628529b6
JHS		 902 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
903 if (x->props.family == family &&
904 x->props.reqid == reqid &&
905 !(x->props.flags & XFRM_STATE_WILDRECV) &&
906 xfrm_state_addr_check(x, daddr, saddr, family) &&
907 mode == x->props.mode &&
908 proto == x->id.proto &&
909 x->km.state == XFRM_STATE_VALID) {
910 rx = x;
911 break;
912 }
913 }
914
915 if (rx)
916 xfrm_state_hold(rx);
917 spin_unlock(&xfrm_state_lock);
918
919
920 return rx;
921}
922EXPORT_SYMBOL(xfrm_stateonly_find);
923
1da177e4
LT		 924static void __xfrm_state_insert(struct xfrm_state *x)
925{
a624c108 926 unsigned int h;
1da177e4 927
9d4a706d
DM		 928 x->genid = ++xfrm_state_genid;
929
4c563f76
TT		 930 list_add_tail(&x->all, &xfrm_state_all);
931
c1969f29
DM		 932 h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
933 x->props.reqid, x->props.family);
8f126e37 934 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1da177e4 935
667bbcb6 936 h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
8f126e37 937 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1da177e4 938
7b4dc360 939 if (x->id.spi) {
6c44e6b7
MN		 940 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
941 x->props.family);
942
8f126e37 943 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
6c44e6b7
MN		 944 }
945
a47f0ce0
DM		 946 mod_timer(&x->timer, jiffies + HZ);
947 if (x->replay_maxage)
948 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
f8cd5488 949
1da177e4 950 wake_up(&km_waitq);
f034b5d4
DM		 951
952 xfrm_state_num++;
953
918049f0 954 xfrm_hash_grow_check(x->bydst.next != NULL);
1da177e4
LT		 955}
956
c7f5ea3a
DM		 957/* xfrm_state_lock is held */
958static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
959{
960 unsigned short family = xnew->props.family;
961 u32 reqid = xnew->props.reqid;
962 struct xfrm_state *x;
963 struct hlist_node *entry;
964 unsigned int h;
965
c1969f29 966 h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
c7f5ea3a
DM		 967 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
968 if (x->props.family == family &&
969 x->props.reqid == reqid &&
c1969f29
DM		 970 !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
971 !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
c7f5ea3a
DM		 972 x->genid = xfrm_state_genid;
973 }
974}
975
1da177e4
LT		 976void xfrm_state_insert(struct xfrm_state *x)
977{
978 spin_lock_bh(&xfrm_state_lock);
c7f5ea3a 979 __xfrm_state_bump_genids(x);
1da177e4
LT		 980 __xfrm_state_insert(x);
981 spin_unlock_bh(&xfrm_state_lock);
982}
983EXPORT_SYMBOL(xfrm_state_insert);
984
2770834c
DM		 985/* xfrm_state_lock is held */
986static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
987{
c1969f29 988 unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
8f126e37 989 struct hlist_node *entry;
2770834c
DM		 990 struct xfrm_state *x;
991
8f126e37 992 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
2770834c
DM		 993 if (x->props.reqid != reqid ||
994 x->props.mode != mode ||
995 x->props.family != family ||
996 x->km.state != XFRM_STATE_ACQ ||
75e252d9
JL		 997 x->id.spi != 0 ||
998 x->id.proto != proto)
2770834c
DM		 999 continue;
1000
1001 switch (family) {
1002 case AF_INET:
1003 if (x->id.daddr.a4 != daddr->a4 ||
1004 x->props.saddr.a4 != saddr->a4)
1005 continue;
1006 break;
1007 case AF_INET6:
1008 if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
1009 (struct in6_addr *)daddr) ||
1010 !ipv6_addr_equal((struct in6_addr *)
1011 x->props.saddr.a6,
1012 (struct in6_addr *)saddr))
1013 continue;
1014 break;
3ff50b79 1015 }
2770834c
DM		 1016
1017 xfrm_state_hold(x);
1018 return x;
1019 }
1020
1021 if (!create)
1022 return NULL;
1023
1024 x = xfrm_state_alloc();
1025 if (likely(x)) {
1026 switch (family) {
1027 case AF_INET:
1028 x->sel.daddr.a4 = daddr->a4;
1029 x->sel.saddr.a4 = saddr->a4;
1030 x->sel.prefixlen_d = 32;
1031 x->sel.prefixlen_s = 32;
1032 x->props.saddr.a4 = saddr->a4;
1033 x->id.daddr.a4 = daddr->a4;
1034 break;
1035
1036 case AF_INET6:
1037 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1038 (struct in6_addr *)daddr);
1039 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1040 (struct in6_addr *)saddr);
1041 x->sel.prefixlen_d = 128;
1042 x->sel.prefixlen_s = 128;
1043 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1044 (struct in6_addr *)saddr);
1045 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1046 (struct in6_addr *)daddr);
1047 break;
3ff50b79 1048 }
2770834c
DM		 1049
1050 x->km.state = XFRM_STATE_ACQ;
1051 x->id.proto = proto;
1052 x->props.family = family;
1053 x->props.mode = mode;
1054 x->props.reqid = reqid;
01e67d08 1055 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
2770834c 1056 xfrm_state_hold(x);
01e67d08 1057 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
2770834c 1058 add_timer(&x->timer);
225f4005 1059 list_add_tail(&x->all, &xfrm_state_all);
8f126e37 1060 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
667bbcb6 1061 h = xfrm_src_hash(daddr, saddr, family);
8f126e37 1062 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
918049f0
DM		 1063
1064 xfrm_state_num++;
1065
1066 xfrm_hash_grow_check(x->bydst.next != NULL);
2770834c
DM		 1067 }
1068
1069 return x;
1070}
1071
1da177e4
LT		 1072static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
1073
1074int xfrm_state_add(struct xfrm_state *x)
1075{
37b08e34 1076 struct xfrm_state *x1, *to_put;
1da177e4
LT		 1077 int family;
1078 int err;
eb2971b6 1079 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1da177e4
LT		 1080
1081 family = x->props.family;
1da177e4 1082
37b08e34
DM		 1083 to_put = NULL;
1084
1da177e4
LT		 1085 spin_lock_bh(&xfrm_state_lock);
1086
edcd5821 1087 x1 = __xfrm_state_locate(x, use_spi, family);
1da177e4 1088 if (x1) {
37b08e34 1089 to_put = x1;
1da177e4
LT		 1090 x1 = NULL;
1091 err = -EEXIST;
1092 goto out;
1093 }
1094
eb2971b6 1095 if (use_spi && x->km.seq) {
1da177e4 1096 x1 = __xfrm_find_acq_byseq(x->km.seq);
75e252d9
JL		 1097 if (x1 && ((x1->id.proto != x->id.proto) ||
1098 xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
37b08e34 1099 to_put = x1;
1da177e4
LT		 1100 x1 = NULL;
1101 }
1102 }
1103
eb2971b6 1104 if (use_spi && !x1)
2770834c
DM		 1105 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
1106 x->id.proto,
1107 &x->id.daddr, &x->props.saddr, 0);
1da177e4 1108
c7f5ea3a 1109 __xfrm_state_bump_genids(x);
1da177e4
LT		 1110 __xfrm_state_insert(x);
1111 err = 0;
1112
1113out:
1114 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 1115
1116 if (x1) {
1117 xfrm_state_delete(x1);
1118 xfrm_state_put(x1);
1119 }
1120
37b08e34
DM		 1121 if (to_put)
1122 xfrm_state_put(to_put);
1123
1da177e4
LT		 1124 return err;
1125}
1126EXPORT_SYMBOL(xfrm_state_add);
1127
80c9abaa 1128#ifdef CONFIG_XFRM_MIGRATE
6666351d 1129static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
80c9abaa
SS		 1130{
1131 int err = -ENOMEM;
1132 struct xfrm_state *x = xfrm_state_alloc();
1133 if (!x)
1134 goto error;
1135
1136 memcpy(&x->id, &orig->id, sizeof(x->id));
1137 memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1138 memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1139 x->props.mode = orig->props.mode;
1140 x->props.replay_window = orig->props.replay_window;
1141 x->props.reqid = orig->props.reqid;
1142 x->props.family = orig->props.family;
1143 x->props.saddr = orig->props.saddr;
1144
1145 if (orig->aalg) {
1146 x->aalg = xfrm_algo_clone(orig->aalg);
1147 if (!x->aalg)
1148 goto error;
1149 }
1150 x->props.aalgo = orig->props.aalgo;
1151
1152 if (orig->ealg) {
1153 x->ealg = xfrm_algo_clone(orig->ealg);
1154 if (!x->ealg)
1155 goto error;
1156 }
1157 x->props.ealgo = orig->props.ealgo;
1158
1159 if (orig->calg) {
1160 x->calg = xfrm_algo_clone(orig->calg);
1161 if (!x->calg)
1162 goto error;
1163 }
1164 x->props.calgo = orig->props.calgo;
1165
a716c119 1166 if (orig->encap) {
80c9abaa
SS		 1167 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1168 if (!x->encap)
1169 goto error;
1170 }
1171
1172 if (orig->coaddr) {
1173 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1174 GFP_KERNEL);
1175 if (!x->coaddr)
1176 goto error;
1177 }
1178
1179 err = xfrm_init_state(x);
1180 if (err)
1181 goto error;
1182
1183 x->props.flags = orig->props.flags;
1184
1185 x->curlft.add_time = orig->curlft.add_time;
1186 x->km.state = orig->km.state;
1187 x->km.seq = orig->km.seq;
1188
1189 return x;
1190
1191 error:
1192 if (errp)
1193 *errp = err;
1194 if (x) {
1195 kfree(x->aalg);
1196 kfree(x->ealg);
1197 kfree(x->calg);
1198 kfree(x->encap);
1199 kfree(x->coaddr);
1200 }
1201 kfree(x);
1202 return NULL;
1203}
80c9abaa
SS		 1204
1205/* xfrm_state_lock is held */
1206struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1207{
1208 unsigned int h;
1209 struct xfrm_state *x;
1210 struct hlist_node *entry;
1211
1212 if (m->reqid) {
1213 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1214 m->reqid, m->old_family);
1215 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1216 if (x->props.mode != m->mode ||
1217 x->id.proto != m->proto)
1218 continue;
1219 if (m->reqid && x->props.reqid != m->reqid)
1220 continue;
1221 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1222 m->old_family) ||
1223 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1224 m->old_family))
1225 continue;
1226 xfrm_state_hold(x);
1227 return x;
1228 }
1229 } else {
1230 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1231 m->old_family);
1232 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1233 if (x->props.mode != m->mode ||
1234 x->id.proto != m->proto)
1235 continue;
1236 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1237 m->old_family) ||
1238 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1239 m->old_family))
1240 continue;
1241 xfrm_state_hold(x);
1242 return x;
1243 }
1244 }
1245
a716c119 1246 return NULL;
80c9abaa
SS		 1247}
1248EXPORT_SYMBOL(xfrm_migrate_state_find);
1249
1250struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1251 struct xfrm_migrate *m)
1252{
1253 struct xfrm_state *xc;
1254 int err;
1255
1256 xc = xfrm_state_clone(x, &err);
1257 if (!xc)
1258 return NULL;
1259
1260 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1261 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1262
1263 /* add state */
1264 if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1265 /* a care is needed when the destination address of the
1266 state is to be updated as it is a part of triplet */
1267 xfrm_state_insert(xc);
1268 } else {
1269 if ((err = xfrm_state_add(xc)) < 0)
1270 goto error;
1271 }
1272
1273 return xc;
1274error:
1275 kfree(xc);
1276 return NULL;
1277}
1278EXPORT_SYMBOL(xfrm_state_migrate);
1279#endif
1280
1da177e4
LT		 1281int xfrm_state_update(struct xfrm_state *x)
1282{
37b08e34 1283 struct xfrm_state *x1, *to_put;
1da177e4 1284 int err;
eb2971b6 1285 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1da177e4 1286
37b08e34
DM		 1287 to_put = NULL;
1288
1da177e4 1289 spin_lock_bh(&xfrm_state_lock);
edcd5821 1290 x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1da177e4
LT		 1291
1292 err = -ESRCH;
1293 if (!x1)
1294 goto out;
1295
1296 if (xfrm_state_kern(x1)) {
37b08e34 1297 to_put = x1;
1da177e4
LT		 1298 err = -EEXIST;
1299 goto out;
1300 }
1301
1302 if (x1->km.state == XFRM_STATE_ACQ) {
1303 __xfrm_state_insert(x);
1304 x = NULL;
1305 }
1306 err = 0;
1307
1308out:
1309 spin_unlock_bh(&xfrm_state_lock);
1da177e4 1310
37b08e34
DM		 1311 if (to_put)
1312 xfrm_state_put(to_put);
1313
1da177e4
LT		 1314 if (err)
1315 return err;
1316
1317 if (!x) {
1318 xfrm_state_delete(x1);
1319 xfrm_state_put(x1);
1320 return 0;
1321 }
1322
1323 err = -EINVAL;
1324 spin_lock_bh(&x1->lock);
1325 if (likely(x1->km.state == XFRM_STATE_VALID)) {
1326 if (x->encap && x1->encap)
1327 memcpy(x1->encap, x->encap, sizeof(*x1->encap));
060f02a3
NT		 1328 if (x->coaddr && x1->coaddr) {
1329 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1330 }
1331 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1332 memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1da177e4
LT		 1333 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1334 x1->km.dying = 0;
1335
a47f0ce0 1336 mod_timer(&x1->timer, jiffies + HZ);
1da177e4
LT		 1337 if (x1->curlft.use_time)
1338 xfrm_state_check_expire(x1);
1339
1340 err = 0;
1341 }
1342 spin_unlock_bh(&x1->lock);
1343
1344 xfrm_state_put(x1);
1345
1346 return err;
1347}
1348EXPORT_SYMBOL(xfrm_state_update);
1349
1350int xfrm_state_check_expire(struct xfrm_state *x)
1351{
1352 if (!x->curlft.use_time)
9d729f72 1353 x->curlft.use_time = get_seconds();
1da177e4
LT		 1354
1355 if (x->km.state != XFRM_STATE_VALID)
1356 return -EINVAL;
1357
1358 if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1359 x->curlft.packets >= x->lft.hard_packet_limit) {
4666faab 1360 x->km.state = XFRM_STATE_EXPIRED;
a47f0ce0 1361 mod_timer(&x->timer, jiffies);
1da177e4
LT		 1362 return -EINVAL;
1363 }
1364
1365 if (!x->km.dying &&
1366 (x->curlft.bytes >= x->lft.soft_byte_limit ||
4666faab
HX		 1367 x->curlft.packets >= x->lft.soft_packet_limit)) {
1368 x->km.dying = 1;
53bc6b4d 1369 km_state_expired(x, 0, 0);
4666faab 1370 }
1da177e4
LT		 1371 return 0;
1372}
1373EXPORT_SYMBOL(xfrm_state_check_expire);
1374
1da177e4 1375struct xfrm_state *
a94cfd19 1376xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1da177e4
LT		 1377 unsigned short family)
1378{
1379 struct xfrm_state *x;
1da177e4
LT		 1380
1381 spin_lock_bh(&xfrm_state_lock);
edcd5821 1382 x = __xfrm_state_lookup(daddr, spi, proto, family);
1da177e4 1383 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 1384 return x;
1385}
1386EXPORT_SYMBOL(xfrm_state_lookup);
1387
1388struct xfrm_state *
eb2971b6
MN		 1389xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1390 u8 proto, unsigned short family)
1391{
1392 struct xfrm_state *x;
eb2971b6
MN		 1393
1394 spin_lock_bh(&xfrm_state_lock);
edcd5821 1395 x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
eb2971b6 1396 spin_unlock_bh(&xfrm_state_lock);
eb2971b6
MN		 1397 return x;
1398}
1399EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1400
1401struct xfrm_state *
a716c119
YH		 1402xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1403 xfrm_address_t *daddr, xfrm_address_t *saddr,
1da177e4
LT		 1404 int create, unsigned short family)
1405{
1406 struct xfrm_state *x;
1da177e4
LT		 1407
1408 spin_lock_bh(&xfrm_state_lock);
2770834c 1409 x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1da177e4 1410 spin_unlock_bh(&xfrm_state_lock);
2770834c 1411
1da177e4
LT		 1412 return x;
1413}
1414EXPORT_SYMBOL(xfrm_find_acq);
1415
41a49cc3
MN		 1416#ifdef CONFIG_XFRM_SUB_POLICY
1417int
1418xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1419 unsigned short family)
1420{
1421 int err = 0;
1422 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1423 if (!afinfo)
1424 return -EAFNOSUPPORT;
1425
1426 spin_lock_bh(&xfrm_state_lock);
1427 if (afinfo->tmpl_sort)
1428 err = afinfo->tmpl_sort(dst, src, n);
1429 spin_unlock_bh(&xfrm_state_lock);
1430 xfrm_state_put_afinfo(afinfo);
1431 return err;
1432}
1433EXPORT_SYMBOL(xfrm_tmpl_sort);
1434
1435int
1436xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1437 unsigned short family)
1438{
1439 int err = 0;
1440 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1441 if (!afinfo)
1442 return -EAFNOSUPPORT;
1443
1444 spin_lock_bh(&xfrm_state_lock);
1445 if (afinfo->state_sort)
1446 err = afinfo->state_sort(dst, src, n);
1447 spin_unlock_bh(&xfrm_state_lock);
1448 xfrm_state_put_afinfo(afinfo);
1449 return err;
1450}
1451EXPORT_SYMBOL(xfrm_state_sort);
1452#endif
1453
1da177e4
LT		 1454/* Silly enough, but I'm lazy to build resolution list */
1455
1456static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1457{
1458 int i;
1da177e4 1459
f034b5d4 1460 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37
DM		 1461 struct hlist_node *entry;
1462 struct xfrm_state *x;
1463
1464 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1465 if (x->km.seq == seq &&
1466 x->km.state == XFRM_STATE_ACQ) {
1da177e4
LT		 1467 xfrm_state_hold(x);
1468 return x;
1469 }
1470 }
1471 }
1472 return NULL;
1473}
1474
1475struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1476{
1477 struct xfrm_state *x;
1478
1479 spin_lock_bh(&xfrm_state_lock);
1480 x = __xfrm_find_acq_byseq(seq);
1481 spin_unlock_bh(&xfrm_state_lock);
1482 return x;
1483}
1484EXPORT_SYMBOL(xfrm_find_acq_byseq);
1485
1486u32 xfrm_get_acqseq(void)
1487{
1488 u32 res;
1489 static u32 acqseq;
1490 static DEFINE_SPINLOCK(acqseq_lock);
1491
1492 spin_lock_bh(&acqseq_lock);
1493 res = (++acqseq ? : ++acqseq);
1494 spin_unlock_bh(&acqseq_lock);
1495 return res;
1496}
1497EXPORT_SYMBOL(xfrm_get_acqseq);
1498
658b219e 1499int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1da177e4 1500{
f034b5d4 1501 unsigned int h;
1da177e4 1502 struct xfrm_state *x0;
658b219e
HX		 1503 int err = -ENOENT;
1504 __be32 minspi = htonl(low);
1505 __be32 maxspi = htonl(high);
1da177e4 1506
658b219e
HX		 1507 spin_lock_bh(&x->lock);
1508 if (x->km.state == XFRM_STATE_DEAD)
1509 goto unlock;
1510
1511 err = 0;
1da177e4 1512 if (x->id.spi)
658b219e
HX		 1513 goto unlock;
1514
1515 err = -ENOENT;
1da177e4
LT		 1516
1517 if (minspi == maxspi) {
1518 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1519 if (x0) {
1520 xfrm_state_put(x0);
658b219e 1521 goto unlock;
1da177e4
LT		 1522 }
1523 x->id.spi = minspi;
1524 } else {
1525 u32 spi = 0;
26977b4e
AV		 1526 for (h=0; h<high-low+1; h++) {
1527 spi = low + net_random()%(high-low+1);
1da177e4
LT		 1528 x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1529 if (x0 == NULL) {
1530 x->id.spi = htonl(spi);
1531 break;
1532 }
1533 xfrm_state_put(x0);
1534 }
1535 }
1536 if (x->id.spi) {
1537 spin_lock_bh(&xfrm_state_lock);
1538 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
8f126e37 1539 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1da177e4 1540 spin_unlock_bh(&xfrm_state_lock);
658b219e
HX		 1541
1542 err = 0;
1da177e4 1543 }
658b219e
HX		 1544
1545unlock:
1546 spin_unlock_bh(&x->lock);
1547
1548 return err;
1da177e4
LT		 1549}
1550EXPORT_SYMBOL(xfrm_alloc_spi);
1551
4c563f76
TT		 1552int xfrm_state_walk(struct xfrm_state_walk *walk,
1553 int (*func)(struct xfrm_state *, int, void*),
1da177e4
LT		 1554 void *data)
1555{
4c563f76 1556 struct xfrm_state *old, *x, *last = NULL;
1da177e4
LT		 1557 int err = 0;
1558
4c563f76
TT		 1559 if (walk->state == NULL && walk->count != 0)
1560 return 0;
1561
1562 old = x = walk->state;
1563 walk->state = NULL;
1da177e4 1564 spin_lock_bh(&xfrm_state_lock);
4c563f76
TT		 1565 if (x == NULL)
1566 x = list_first_entry(&xfrm_state_all, struct xfrm_state, all);
1567 list_for_each_entry_from(x, &xfrm_state_all, all) {
1568 if (x->km.state == XFRM_STATE_DEAD)
1569 continue;
1570 if (!xfrm_id_proto_match(x->id.proto, walk->proto))
1571 continue;
1572 if (last) {
1573 err = func(last, walk->count, data);
1574 if (err) {
1575 xfrm_state_hold(last);
1576 walk->state = last;
1577 goto out;
94b9bb54 1578 }
1da177e4 1579 }
4c563f76
TT		 1580 last = x;
1581 walk->count++;
1da177e4 1582 }
4c563f76 1583 if (walk->count == 0) {
1da177e4
LT		 1584 err = -ENOENT;
1585 goto out;
1586 }
4c563f76
TT		 1587 if (last)
1588 err = func(last, 0, data);
1da177e4
LT		 1589out:
1590 spin_unlock_bh(&xfrm_state_lock);
4c563f76
TT		 1591 if (old != NULL)
1592 xfrm_state_put(old);
1da177e4
LT		 1593 return err;
1594}
1595EXPORT_SYMBOL(xfrm_state_walk);
1596
f8cd5488
JHS		 1597
1598void xfrm_replay_notify(struct xfrm_state *x, int event)
1599{
1600 struct km_event c;
1601 /* we send notify messages in case
1602 * 1. we updated on of the sequence numbers, and the seqno difference
1603 * is at least x->replay_maxdiff, in this case we also update the
1604 * timeout of our timer function
1605 * 2. if x->replay_maxage has elapsed since last update,
1606 * and there were changes
1607 *
1608 * The state structure must be locked!
1609 */
1610
1611 switch (event) {
1612 case XFRM_REPLAY_UPDATE:
1613 if (x->replay_maxdiff &&
1614 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
2717096a
JHS		 1615 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1616 if (x->xflags & XFRM_TIME_DEFER)
1617 event = XFRM_REPLAY_TIMEOUT;
1618 else
1619 return;
1620 }
f8cd5488
JHS		 1621
1622 break;
1623
1624 case XFRM_REPLAY_TIMEOUT:
1625 if ((x->replay.seq == x->preplay.seq) &&
1626 (x->replay.bitmap == x->preplay.bitmap) &&
2717096a
JHS		 1627 (x->replay.oseq == x->preplay.oseq)) {
1628 x->xflags |= XFRM_TIME_DEFER;
f8cd5488 1629 return;
2717096a 1630 }
f8cd5488
JHS		 1631
1632 break;
1633 }
1634
1635 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1636 c.event = XFRM_MSG_NEWAE;
1637 c.data.aevent = event;
1638 km_state_notify(x, &c);
1639
f8cd5488 1640 if (x->replay_maxage &&
a47f0ce0 1641 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
2717096a 1642 x->xflags &= ~XFRM_TIME_DEFER;
f8cd5488
JHS		 1643}
1644
1645static void xfrm_replay_timer_handler(unsigned long data)
1646{
1647 struct xfrm_state *x = (struct xfrm_state*)data;
1648
1649 spin_lock(&x->lock);
1650
2717096a
JHS		 1651 if (x->km.state == XFRM_STATE_VALID) {
1652 if (xfrm_aevent_is_on())
1653 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1654 else
1655 x->xflags |= XFRM_TIME_DEFER;
1656 }
f8cd5488
JHS		 1657
1658 spin_unlock(&x->lock);
1659}
1660
afeb14b4
PM		 1661int xfrm_replay_check(struct xfrm_state *x,
1662 struct sk_buff *skb, __be32 net_seq)
1da177e4
LT		 1663{
1664 u32 diff;
a252cc23 1665 u32 seq = ntohl(net_seq);
1da177e4
LT		 1666
1667 if (unlikely(seq == 0))
afeb14b4 1668 goto err;
1da177e4
LT		 1669
1670 if (likely(seq > x->replay.seq))
1671 return 0;
1672
1673 diff = x->replay.seq - seq;
4c4d51a7
HX		 1674 if (diff >= min_t(unsigned int, x->props.replay_window,
1675 sizeof(x->replay.bitmap) * 8)) {
1da177e4 1676 x->stats.replay_window++;
afeb14b4 1677 goto err;
1da177e4
LT		 1678 }
1679
1680 if (x->replay.bitmap & (1U << diff)) {
1681 x->stats.replay++;
afeb14b4 1682 goto err;
1da177e4
LT		 1683 }
1684 return 0;
afeb14b4
PM		 1685
1686err:
1687 xfrm_audit_state_replay(x, skb, net_seq);
1688 return -EINVAL;
1da177e4 1689}
1da177e4 1690
61f4627b 1691void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1da177e4
LT		 1692{
1693 u32 diff;
61f4627b 1694 u32 seq = ntohl(net_seq);
1da177e4
LT		 1695
1696 if (seq > x->replay.seq) {
1697 diff = seq - x->replay.seq;
1698 if (diff < x->props.replay_window)
1699 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1700 else
1701 x->replay.bitmap = 1;
1702 x->replay.seq = seq;
1703 } else {
1704 diff = x->replay.seq - seq;
1705 x->replay.bitmap |= (1U << diff);
1706 }
f8cd5488
JHS		 1707
1708 if (xfrm_aevent_is_on())
1709 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1da177e4 1710}
1da177e4 1711
df01812e 1712static LIST_HEAD(xfrm_km_list);
1da177e4
LT		 1713static DEFINE_RWLOCK(xfrm_km_lock);
1714
26b15dad 1715void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1da177e4
LT		 1716{
1717 struct xfrm_mgr *km;
1718
26b15dad
JHS		 1719 read_lock(&xfrm_km_lock);
1720 list_for_each_entry(km, &xfrm_km_list, list)
1721 if (km->notify_policy)
1722 km->notify_policy(xp, dir, c);
1723 read_unlock(&xfrm_km_lock);
1724}
1da177e4 1725
26b15dad
JHS		 1726void km_state_notify(struct xfrm_state *x, struct km_event *c)
1727{
1728 struct xfrm_mgr *km;
1da177e4
LT		 1729 read_lock(&xfrm_km_lock);
1730 list_for_each_entry(km, &xfrm_km_list, list)
26b15dad
JHS		 1731 if (km->notify)
1732 km->notify(x, c);
1da177e4 1733 read_unlock(&xfrm_km_lock);
26b15dad
JHS		 1734}
1735
1736EXPORT_SYMBOL(km_policy_notify);
1737EXPORT_SYMBOL(km_state_notify);
1738
53bc6b4d 1739void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
26b15dad
JHS		 1740{
1741 struct km_event c;
1742
bf08867f 1743 c.data.hard = hard;
53bc6b4d 1744 c.pid = pid;
f60f6b8f 1745 c.event = XFRM_MSG_EXPIRE;
26b15dad 1746 km_state_notify(x, &c);
1da177e4
LT		 1747
1748 if (hard)
1749 wake_up(&km_waitq);
1750}
1751
53bc6b4d 1752EXPORT_SYMBOL(km_state_expired);
26b15dad
JHS		 1753/*
1754 * We send to all registered managers regardless of failure
1755 * We are happy with one success
1756*/
980ebd25 1757int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1da177e4 1758{
26b15dad 1759 int err = -EINVAL, acqret;
1da177e4
LT		 1760 struct xfrm_mgr *km;
1761
1762 read_lock(&xfrm_km_lock);
1763 list_for_each_entry(km, &xfrm_km_list, list) {
26b15dad
JHS		 1764 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1765 if (!acqret)
1766 err = acqret;
1da177e4
LT		 1767 }
1768 read_unlock(&xfrm_km_lock);
1769 return err;
1770}
980ebd25 1771EXPORT_SYMBOL(km_query);
1da177e4 1772
5d36b180 1773int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1da177e4
LT		 1774{
1775 int err = -EINVAL;
1776 struct xfrm_mgr *km;
1777
1778 read_lock(&xfrm_km_lock);
1779 list_for_each_entry(km, &xfrm_km_list, list) {
1780 if (km->new_mapping)
1781 err = km->new_mapping(x, ipaddr, sport);
1782 if (!err)
1783 break;
1784 }
1785 read_unlock(&xfrm_km_lock);
1786 return err;
1787}
1788EXPORT_SYMBOL(km_new_mapping);
1789
6c5c8ca7 1790void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1da177e4 1791{
26b15dad 1792 struct km_event c;
1da177e4 1793
bf08867f 1794 c.data.hard = hard;
6c5c8ca7 1795 c.pid = pid;
f60f6b8f 1796 c.event = XFRM_MSG_POLEXPIRE;
26b15dad 1797 km_policy_notify(pol, dir, &c);
1da177e4
LT		 1798
1799 if (hard)
1800 wake_up(&km_waitq);
1801}
a70fcb0b 1802EXPORT_SYMBOL(km_policy_expired);
1da177e4 1803
2d60abc2 1804#ifdef CONFIG_XFRM_MIGRATE
80c9abaa
SS		 1805int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1806 struct xfrm_migrate *m, int num_migrate)
1807{
1808 int err = -EINVAL;
1809 int ret;
1810 struct xfrm_mgr *km;
1811
1812 read_lock(&xfrm_km_lock);
1813 list_for_each_entry(km, &xfrm_km_list, list) {
1814 if (km->migrate) {
1815 ret = km->migrate(sel, dir, type, m, num_migrate);
1816 if (!ret)
1817 err = ret;
1818 }
1819 }
1820 read_unlock(&xfrm_km_lock);
1821 return err;
1822}
1823EXPORT_SYMBOL(km_migrate);
2d60abc2 1824#endif
80c9abaa 1825
97a64b45
MN		 1826int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1827{
1828 int err = -EINVAL;
1829 int ret;
1830 struct xfrm_mgr *km;
1831
1832 read_lock(&xfrm_km_lock);
1833 list_for_each_entry(km, &xfrm_km_list, list) {
1834 if (km->report) {
1835 ret = km->report(proto, sel, addr);
1836 if (!ret)
1837 err = ret;
1838 }
1839 }
1840 read_unlock(&xfrm_km_lock);
1841 return err;
1842}
1843EXPORT_SYMBOL(km_report);
1844
1da177e4
LT		 1845int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1846{
1847 int err;
1848 u8 *data;
1849 struct xfrm_mgr *km;
1850 struct xfrm_policy *pol = NULL;
1851
1852 if (optlen <= 0 || optlen > PAGE_SIZE)
1853 return -EMSGSIZE;
1854
1855 data = kmalloc(optlen, GFP_KERNEL);
1856 if (!data)
1857 return -ENOMEM;
1858
1859 err = -EFAULT;
1860 if (copy_from_user(data, optval, optlen))
1861 goto out;
1862
1863 err = -EINVAL;
1864 read_lock(&xfrm_km_lock);
1865 list_for_each_entry(km, &xfrm_km_list, list) {
cb969f07 1866 pol = km->compile_policy(sk, optname, data,
1da177e4
LT		 1867 optlen, &err);
1868 if (err >= 0)
1869 break;
1870 }
1871 read_unlock(&xfrm_km_lock);
1872
1873 if (err >= 0) {
1874 xfrm_sk_policy_insert(sk, err, pol);
1875 xfrm_pol_put(pol);
1876 err = 0;
1877 }
1878
1879out:
1880 kfree(data);
1881 return err;
1882}
1883EXPORT_SYMBOL(xfrm_user_policy);
1884
1885int xfrm_register_km(struct xfrm_mgr *km)
1886{
1887 write_lock_bh(&xfrm_km_lock);
1888 list_add_tail(&km->list, &xfrm_km_list);
1889 write_unlock_bh(&xfrm_km_lock);
1890 return 0;
1891}
1892EXPORT_SYMBOL(xfrm_register_km);
1893
1894int xfrm_unregister_km(struct xfrm_mgr *km)
1895{
1896 write_lock_bh(&xfrm_km_lock);
1897 list_del(&km->list);
1898 write_unlock_bh(&xfrm_km_lock);
1899 return 0;
1900}
1901EXPORT_SYMBOL(xfrm_unregister_km);
1902
1903int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1904{
1905 int err = 0;
1906 if (unlikely(afinfo == NULL))
1907 return -EINVAL;
1908 if (unlikely(afinfo->family >= NPROTO))
1909 return -EAFNOSUPPORT;
f3111502 1910 write_lock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1911 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1912 err = -ENOBUFS;
edcd5821 1913 else
1da177e4 1914 xfrm_state_afinfo[afinfo->family] = afinfo;
f3111502 1915 write_unlock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1916 return err;
1917}
1918EXPORT_SYMBOL(xfrm_state_register_afinfo);
1919
1920int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1921{
1922 int err = 0;
1923 if (unlikely(afinfo == NULL))
1924 return -EINVAL;
1925 if (unlikely(afinfo->family >= NPROTO))
1926 return -EAFNOSUPPORT;
f3111502 1927 write_lock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1928 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1929 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1930 err = -EINVAL;
edcd5821 1931 else
1da177e4 1932 xfrm_state_afinfo[afinfo->family] = NULL;
1da177e4 1933 }
f3111502 1934 write_unlock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1935 return err;
1936}
1937EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1938
17c2a42a 1939static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1da177e4
LT		 1940{
1941 struct xfrm_state_afinfo *afinfo;
1942 if (unlikely(family >= NPROTO))
1943 return NULL;
1944 read_lock(&xfrm_state_afinfo_lock);
1945 afinfo = xfrm_state_afinfo[family];
546be240
HX		 1946 if (unlikely(!afinfo))
1947 read_unlock(&xfrm_state_afinfo_lock);
1da177e4
LT		 1948 return afinfo;
1949}
1950
17c2a42a 1951static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
9a429c49 1952 __releases(xfrm_state_afinfo_lock)
1da177e4 1953{
546be240 1954 read_unlock(&xfrm_state_afinfo_lock);
1da177e4
LT		 1955}
1956
1957/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1958void xfrm_state_delete_tunnel(struct xfrm_state *x)
1959{
1960 if (x->tunnel) {
1961 struct xfrm_state *t = x->tunnel;
1962
1963 if (atomic_read(&t->tunnel_users) == 2)
1964 xfrm_state_delete(t);
1965 atomic_dec(&t->tunnel_users);
1966 xfrm_state_put(t);
1967 x->tunnel = NULL;
1968 }
1969}
1970EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1971
1972int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1973{
c5c25238 1974 int res;
1da177e4 1975
c5c25238
PM		 1976 spin_lock_bh(&x->lock);
1977 if (x->km.state == XFRM_STATE_VALID &&
1978 x->type && x->type->get_mtu)
1979 res = x->type->get_mtu(x, mtu);
1980 else
28121617 1981 res = mtu - x->props.header_len;
c5c25238 1982 spin_unlock_bh(&x->lock);
1da177e4
LT		 1983 return res;
1984}
1985
72cb6962
HX		 1986int xfrm_init_state(struct xfrm_state *x)
1987{
d094cd83 1988 struct xfrm_state_afinfo *afinfo;
df9dcb45 1989 struct xfrm_mode *inner_mode;
d094cd83 1990 int family = x->props.family;
72cb6962
HX		 1991 int err;
1992
d094cd83
HX		 1993 err = -EAFNOSUPPORT;
1994 afinfo = xfrm_state_get_afinfo(family);
1995 if (!afinfo)
1996 goto error;
1997
1998 err = 0;
1999 if (afinfo->init_flags)
2000 err = afinfo->init_flags(x);
2001
2002 xfrm_state_put_afinfo(afinfo);
2003
2004 if (err)
2005 goto error;
2006
2007 err = -EPROTONOSUPPORT;
13996378 2008
df9dcb45
KM		 2009 if (x->sel.family != AF_UNSPEC) {
2010 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2011 if (inner_mode == NULL)
2012 goto error;
2013
2014 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2015 family != x->sel.family) {
2016 xfrm_put_mode(inner_mode);
2017 goto error;
2018 }
2019
2020 x->inner_mode = inner_mode;
2021 } else {
2022 struct xfrm_mode *inner_mode_iaf;
2023
2024 inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
2025 if (inner_mode == NULL)
2026 goto error;
2027
2028 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2029 xfrm_put_mode(inner_mode);
2030 goto error;
2031 }
2032
2033 inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
2034 if (inner_mode_iaf == NULL)
2035 goto error;
2036
2037 if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
2038 xfrm_put_mode(inner_mode_iaf);
2039 goto error;
2040 }
2041
2042 if (x->props.family == AF_INET) {
2043 x->inner_mode = inner_mode;
2044 x->inner_mode_iaf = inner_mode_iaf;
2045 } else {
2046 x->inner_mode = inner_mode_iaf;
2047 x->inner_mode_iaf = inner_mode;
2048 }
2049 }
13996378 2050
d094cd83 2051 x->type = xfrm_get_type(x->id.proto, family);
72cb6962
HX		 2052 if (x->type == NULL)
2053 goto error;
2054
2055 err = x->type->init_state(x);
2056 if (err)
2057 goto error;
2058
13996378
HX		 2059 x->outer_mode = xfrm_get_mode(x->props.mode, family);
2060 if (x->outer_mode == NULL)
b59f45d0
HX		 2061 goto error;
2062
72cb6962
HX		 2063 x->km.state = XFRM_STATE_VALID;
2064
2065error:
2066 return err;
2067}
2068
2069EXPORT_SYMBOL(xfrm_init_state);
a716c119 2070
1da177e4
LT		 2071void __init xfrm_state_init(void)
2072{
f034b5d4
DM		 2073 unsigned int sz;
2074
2075 sz = sizeof(struct hlist_head) * 8;
2076
44e36b42
DM		 2077 xfrm_state_bydst = xfrm_hash_alloc(sz);
2078 xfrm_state_bysrc = xfrm_hash_alloc(sz);
2079 xfrm_state_byspi = xfrm_hash_alloc(sz);
f034b5d4
DM		 2080 if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
2081 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
2082 xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
1da177e4 2083
c4028958 2084 INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
1da177e4
LT		 2085}
2086
ab5f5e8b 2087#ifdef CONFIG_AUDITSYSCALL
cf35f43e
IJ		 2088static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2089 struct audit_buffer *audit_buf)
ab5f5e8b 2090{
68277acc
PM		 2091 struct xfrm_sec_ctx *ctx = x->security;
2092 u32 spi = ntohl(x->id.spi);
2093
2094 if (ctx)
ab5f5e8b 2095 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
68277acc 2096 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
ab5f5e8b
JL		 2097
2098 switch(x->props.family) {
2099 case AF_INET:
68277acc
PM		 2100 audit_log_format(audit_buf,
2101 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
ab5f5e8b
JL		 2102 NIPQUAD(x->props.saddr.a4),
2103 NIPQUAD(x->id.daddr.a4));
2104 break;
2105 case AF_INET6:
68277acc
PM		 2106 audit_log_format(audit_buf,
2107 " src=" NIP6_FMT " dst=" NIP6_FMT,
2108 NIP6(*(struct in6_addr *)x->props.saddr.a6),
2109 NIP6(*(struct in6_addr *)x->id.daddr.a6));
ab5f5e8b
JL		 2110 break;
2111 }
68277acc
PM		 2112
2113 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
ab5f5e8b
JL		 2114}
2115
cf35f43e
IJ		 2116static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2117 struct audit_buffer *audit_buf)
afeb14b4
PM		 2118{
2119 struct iphdr *iph4;
2120 struct ipv6hdr *iph6;
2121
2122 switch (family) {
2123 case AF_INET:
2124 iph4 = ip_hdr(skb);
2125 audit_log_format(audit_buf,
2126 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2127 NIPQUAD(iph4->saddr),
2128 NIPQUAD(iph4->daddr));
2129 break;
2130 case AF_INET6:
2131 iph6 = ipv6_hdr(skb);
2132 audit_log_format(audit_buf,
2133 " src=" NIP6_FMT " dst=" NIP6_FMT
5e2c433d 2134 " flowlbl=0x%x%02x%02x",
afeb14b4
PM		 2135 NIP6(iph6->saddr),
2136 NIP6(iph6->daddr),
2137 iph6->flow_lbl[0] & 0x0f,
2138 iph6->flow_lbl[1],
2139 iph6->flow_lbl[2]);
2140 break;
2141 }
2142}
2143
68277acc 2144void xfrm_audit_state_add(struct xfrm_state *x, int result,
2532386f 2145 uid_t auid, u32 sessionid, u32 secid)
ab5f5e8b
JL		 2146{
2147 struct audit_buffer *audit_buf;
ab5f5e8b 2148
afeb14b4 2149 audit_buf = xfrm_audit_start("SAD-add");
ab5f5e8b
JL		 2150 if (audit_buf == NULL)
2151 return;
2532386f 2152 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
afeb14b4
PM		 2153 xfrm_audit_helper_sainfo(x, audit_buf);
2154 audit_log_format(audit_buf, " res=%u", result);
ab5f5e8b
JL		 2155 audit_log_end(audit_buf);
2156}
2157EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2158
68277acc 2159void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2532386f 2160 uid_t auid, u32 sessionid, u32 secid)
ab5f5e8b
JL		 2161{
2162 struct audit_buffer *audit_buf;
ab5f5e8b 2163
afeb14b4 2164 audit_buf = xfrm_audit_start("SAD-delete");
ab5f5e8b
JL		 2165 if (audit_buf == NULL)
2166 return;
2532386f 2167 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
afeb14b4
PM		 2168 xfrm_audit_helper_sainfo(x, audit_buf);
2169 audit_log_format(audit_buf, " res=%u", result);
ab5f5e8b
JL		 2170 audit_log_end(audit_buf);
2171}
2172EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
afeb14b4
PM		 2173
2174void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2175 struct sk_buff *skb)
2176{
2177 struct audit_buffer *audit_buf;
2178 u32 spi;
2179
2180 audit_buf = xfrm_audit_start("SA-replay-overflow");
2181 if (audit_buf == NULL)
2182 return;
2183 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2184 /* don't record the sequence number because it's inherent in this kind
2185 * of audit message */
2186 spi = ntohl(x->id.spi);
2187 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2188 audit_log_end(audit_buf);
2189}
2190EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2191
2192static void xfrm_audit_state_replay(struct xfrm_state *x,
2193 struct sk_buff *skb, __be32 net_seq)
2194{
2195 struct audit_buffer *audit_buf;
2196 u32 spi;
2197
2198 audit_buf = xfrm_audit_start("SA-replayed-pkt");
2199 if (audit_buf == NULL)
2200 return;
2201 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2202 spi = ntohl(x->id.spi);
2203 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2204 spi, spi, ntohl(net_seq));
2205 audit_log_end(audit_buf);
2206}
2207
2208void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2209{
2210 struct audit_buffer *audit_buf;
2211
2212 audit_buf = xfrm_audit_start("SA-notfound");
2213 if (audit_buf == NULL)
2214 return;
2215 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2216 audit_log_end(audit_buf);
2217}
2218EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2219
2220void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2221 __be32 net_spi, __be32 net_seq)
2222{
2223 struct audit_buffer *audit_buf;
2224 u32 spi;
2225
2226 audit_buf = xfrm_audit_start("SA-notfound");
2227 if (audit_buf == NULL)
2228 return;
2229 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2230 spi = ntohl(net_spi);
2231 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2232 spi, spi, ntohl(net_seq));
2233 audit_log_end(audit_buf);
2234}
2235EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2236
2237void xfrm_audit_state_icvfail(struct xfrm_state *x,
2238 struct sk_buff *skb, u8 proto)
2239{
2240 struct audit_buffer *audit_buf;
2241 __be32 net_spi;
2242 __be32 net_seq;
2243
2244 audit_buf = xfrm_audit_start("SA-icv-failure");
2245 if (audit_buf == NULL)
2246 return;
2247 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2248 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2249 u32 spi = ntohl(net_spi);
2250 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2251 spi, spi, ntohl(net_seq));
2252 }
2253 audit_log_end(audit_buf);
2254}
2255EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
ab5f5e8b 2256#endif /* CONFIG_AUDITSYSCALL */
Ubuntu Artful kernel mirror