]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - net/xfrm/xfrm_state.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[NEIGH]: Fix race between pneigh deletion and ipv6's ndisc_recv_ns (v3).
[mirror_ubuntu-artful-kernel.git] / net / xfrm / xfrm_state.c
CommitLineData
1da177e4
LT		 1/*
2 * xfrm_state.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
df71837d 13 *
1da177e4
LT		 14 */
15
16#include <linux/workqueue.h>
17#include <net/xfrm.h>
18#include <linux/pfkeyv2.h>
19#include <linux/ipsec.h>
20#include <linux/module.h>
f034b5d4 21#include <linux/cache.h>
68277acc 22#include <linux/audit.h>
b5890d8b 23#include <asm/uaccess.h>
1da177e4 24
44e36b42
DM		 25#include "xfrm_hash.h"
26
ee857a7d
DM		 27struct sock *xfrm_nl;
28EXPORT_SYMBOL(xfrm_nl);
29
01e67d08 30u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
a70fcb0b
DM		 31EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
32
01e67d08 33u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
a70fcb0b
DM		 34EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
35
01e67d08
DM		 36u32 sysctl_xfrm_acq_expires __read_mostly = 30;
37
1da177e4
LT		 38/* Each xfrm_state may be linked to two tables:
39
40 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
a624c108 41 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
1da177e4
LT		 42 destination/tunnel endpoint. (output)
43 */
44
45static DEFINE_SPINLOCK(xfrm_state_lock);
46
47/* Hash table to find appropriate SA towards given target (endpoint
48 * of tunnel or destination of transport mode) allowed by selector.
49 *
50 * Main use is finding SA after policy selected tunnel or transport mode.
51 * Also, it can be used by ah/esp icmp error handler to find offending SA.
52 */
f034b5d4
DM		 53static struct hlist_head *xfrm_state_bydst __read_mostly;
54static struct hlist_head *xfrm_state_bysrc __read_mostly;
55static struct hlist_head *xfrm_state_byspi __read_mostly;
56static unsigned int xfrm_state_hmask __read_mostly;
57static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
58static unsigned int xfrm_state_num;
9d4a706d 59static unsigned int xfrm_state_genid;
f034b5d4 60
17c2a42a
HX		 61static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
62static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
63
afeb14b4
PM		 64#ifdef CONFIG_AUDITSYSCALL
65static void xfrm_audit_state_replay(struct xfrm_state *x,
66 struct sk_buff *skb, __be32 net_seq);
67#else
68#define xfrm_audit_state_replay(x, s, sq) do { ; } while (0)
69#endif /* CONFIG_AUDITSYSCALL */
70
c1969f29
DM		 71static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
72 xfrm_address_t *saddr,
73 u32 reqid,
a624c108 74 unsigned short family)
f034b5d4 75{
c1969f29 76 return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
f034b5d4
DM		 77}
78
667bbcb6
MN		 79static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
80 xfrm_address_t *saddr,
44e36b42 81 unsigned short family)
f034b5d4 82{
667bbcb6 83 return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
f034b5d4
DM		 84}
85
f034b5d4 86static inline unsigned int
8122adf0 87xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
f034b5d4 88{
c1969f29 89 return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
f034b5d4
DM		 90}
91
f034b5d4
DM		 92static void xfrm_hash_transfer(struct hlist_head *list,
93 struct hlist_head *ndsttable,
94 struct hlist_head *nsrctable,
95 struct hlist_head *nspitable,
96 unsigned int nhashmask)
97{
98 struct hlist_node *entry, *tmp;
99 struct xfrm_state *x;
100
101 hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
102 unsigned int h;
103
c1969f29
DM		 104 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
105 x->props.reqid, x->props.family,
106 nhashmask);
f034b5d4
DM		 107 hlist_add_head(&x->bydst, ndsttable+h);
108
667bbcb6
MN		 109 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
110 x->props.family,
f034b5d4
DM		 111 nhashmask);
112 hlist_add_head(&x->bysrc, nsrctable+h);
113
7b4dc360
MN		 114 if (x->id.spi) {
115 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
116 x->id.proto, x->props.family,
117 nhashmask);
118 hlist_add_head(&x->byspi, nspitable+h);
119 }
f034b5d4
DM		 120 }
121}
122
123static unsigned long xfrm_hash_new_size(void)
124{
125 return ((xfrm_state_hmask + 1) << 1) *
126 sizeof(struct hlist_head);
127}
128
129static DEFINE_MUTEX(hash_resize_mutex);
130
c4028958 131static void xfrm_hash_resize(struct work_struct *__unused)
f034b5d4
DM		 132{
133 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
134 unsigned long nsize, osize;
135 unsigned int nhashmask, ohashmask;
136 int i;
137
138 mutex_lock(&hash_resize_mutex);
139
140 nsize = xfrm_hash_new_size();
44e36b42 141 ndst = xfrm_hash_alloc(nsize);
f034b5d4
DM		 142 if (!ndst)
143 goto out_unlock;
44e36b42 144 nsrc = xfrm_hash_alloc(nsize);
f034b5d4 145 if (!nsrc) {
44e36b42 146 xfrm_hash_free(ndst, nsize);
f034b5d4
DM		 147 goto out_unlock;
148 }
44e36b42 149 nspi = xfrm_hash_alloc(nsize);
f034b5d4 150 if (!nspi) {
44e36b42
DM		 151 xfrm_hash_free(ndst, nsize);
152 xfrm_hash_free(nsrc, nsize);
f034b5d4
DM		 153 goto out_unlock;
154 }
155
156 spin_lock_bh(&xfrm_state_lock);
157
158 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
159 for (i = xfrm_state_hmask; i >= 0; i--)
160 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
161 nhashmask);
162
163 odst = xfrm_state_bydst;
164 osrc = xfrm_state_bysrc;
165 ospi = xfrm_state_byspi;
166 ohashmask = xfrm_state_hmask;
167
168 xfrm_state_bydst = ndst;
169 xfrm_state_bysrc = nsrc;
170 xfrm_state_byspi = nspi;
171 xfrm_state_hmask = nhashmask;
172
173 spin_unlock_bh(&xfrm_state_lock);
174
175 osize = (ohashmask + 1) * sizeof(struct hlist_head);
44e36b42
DM		 176 xfrm_hash_free(odst, osize);
177 xfrm_hash_free(osrc, osize);
178 xfrm_hash_free(ospi, osize);
f034b5d4
DM		 179
180out_unlock:
181 mutex_unlock(&hash_resize_mutex);
182}
183
c4028958 184static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
f034b5d4 185
1da177e4
LT		 186DECLARE_WAIT_QUEUE_HEAD(km_waitq);
187EXPORT_SYMBOL(km_waitq);
188
189static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
190static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
191
192static struct work_struct xfrm_state_gc_work;
8f126e37 193static HLIST_HEAD(xfrm_state_gc_list);
1da177e4
LT		 194static DEFINE_SPINLOCK(xfrm_state_gc_lock);
195
53bc6b4d 196int __xfrm_state_delete(struct xfrm_state *x);
1da177e4 197
980ebd25 198int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
53bc6b4d 199void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
1da177e4 200
aa5d62cc
HX		 201static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
202{
203 struct xfrm_state_afinfo *afinfo;
204 if (unlikely(family >= NPROTO))
205 return NULL;
206 write_lock_bh(&xfrm_state_afinfo_lock);
207 afinfo = xfrm_state_afinfo[family];
208 if (unlikely(!afinfo))
209 write_unlock_bh(&xfrm_state_afinfo_lock);
210 return afinfo;
211}
212
213static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
9a429c49 214 __releases(xfrm_state_afinfo_lock)
aa5d62cc
HX		 215{
216 write_unlock_bh(&xfrm_state_afinfo_lock);
217}
218
533cb5b0 219int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
aa5d62cc
HX		 220{
221 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
533cb5b0 222 const struct xfrm_type **typemap;
aa5d62cc
HX		 223 int err = 0;
224
225 if (unlikely(afinfo == NULL))
226 return -EAFNOSUPPORT;
227 typemap = afinfo->type_map;
228
229 if (likely(typemap[type->proto] == NULL))
230 typemap[type->proto] = type;
231 else
232 err = -EEXIST;
233 xfrm_state_unlock_afinfo(afinfo);
234 return err;
235}
236EXPORT_SYMBOL(xfrm_register_type);
237
533cb5b0 238int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
aa5d62cc
HX		 239{
240 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
533cb5b0 241 const struct xfrm_type **typemap;
aa5d62cc
HX		 242 int err = 0;
243
244 if (unlikely(afinfo == NULL))
245 return -EAFNOSUPPORT;
246 typemap = afinfo->type_map;
247
248 if (unlikely(typemap[type->proto] != type))
249 err = -ENOENT;
250 else
251 typemap[type->proto] = NULL;
252 xfrm_state_unlock_afinfo(afinfo);
253 return err;
254}
255EXPORT_SYMBOL(xfrm_unregister_type);
256
533cb5b0 257static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
aa5d62cc
HX		 258{
259 struct xfrm_state_afinfo *afinfo;
533cb5b0
ED		 260 const struct xfrm_type **typemap;
261 const struct xfrm_type *type;
aa5d62cc
HX		 262 int modload_attempted = 0;
263
264retry:
265 afinfo = xfrm_state_get_afinfo(family);
266 if (unlikely(afinfo == NULL))
267 return NULL;
268 typemap = afinfo->type_map;
269
270 type = typemap[proto];
271 if (unlikely(type && !try_module_get(type->owner)))
272 type = NULL;
273 if (!type && !modload_attempted) {
274 xfrm_state_put_afinfo(afinfo);
275 request_module("xfrm-type-%d-%d", family, proto);
276 modload_attempted = 1;
277 goto retry;
278 }
279
280 xfrm_state_put_afinfo(afinfo);
281 return type;
282}
283
533cb5b0 284static void xfrm_put_type(const struct xfrm_type *type)
aa5d62cc
HX		 285{
286 module_put(type->owner);
287}
288
289int xfrm_register_mode(struct xfrm_mode *mode, int family)
290{
291 struct xfrm_state_afinfo *afinfo;
292 struct xfrm_mode **modemap;
293 int err;
294
295 if (unlikely(mode->encap >= XFRM_MODE_MAX))
296 return -EINVAL;
297
298 afinfo = xfrm_state_lock_afinfo(family);
299 if (unlikely(afinfo == NULL))
300 return -EAFNOSUPPORT;
301
302 err = -EEXIST;
303 modemap = afinfo->mode_map;
17c2a42a
HX		 304 if (modemap[mode->encap])
305 goto out;
aa5d62cc 306
17c2a42a
HX		 307 err = -ENOENT;
308 if (!try_module_get(afinfo->owner))
309 goto out;
310
311 mode->afinfo = afinfo;
312 modemap[mode->encap] = mode;
313 err = 0;
314
315out:
aa5d62cc
HX		 316 xfrm_state_unlock_afinfo(afinfo);
317 return err;
318}
319EXPORT_SYMBOL(xfrm_register_mode);
320
321int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
322{
323 struct xfrm_state_afinfo *afinfo;
324 struct xfrm_mode **modemap;
325 int err;
326
327 if (unlikely(mode->encap >= XFRM_MODE_MAX))
328 return -EINVAL;
329
330 afinfo = xfrm_state_lock_afinfo(family);
331 if (unlikely(afinfo == NULL))
332 return -EAFNOSUPPORT;
333
334 err = -ENOENT;
335 modemap = afinfo->mode_map;
336 if (likely(modemap[mode->encap] == mode)) {
337 modemap[mode->encap] = NULL;
17c2a42a 338 module_put(mode->afinfo->owner);
aa5d62cc
HX		 339 err = 0;
340 }
341
342 xfrm_state_unlock_afinfo(afinfo);
343 return err;
344}
345EXPORT_SYMBOL(xfrm_unregister_mode);
346
347static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
348{
349 struct xfrm_state_afinfo *afinfo;
350 struct xfrm_mode *mode;
351 int modload_attempted = 0;
352
353 if (unlikely(encap >= XFRM_MODE_MAX))
354 return NULL;
355
356retry:
357 afinfo = xfrm_state_get_afinfo(family);
358 if (unlikely(afinfo == NULL))
359 return NULL;
360
361 mode = afinfo->mode_map[encap];
362 if (unlikely(mode && !try_module_get(mode->owner)))
363 mode = NULL;
364 if (!mode && !modload_attempted) {
365 xfrm_state_put_afinfo(afinfo);
366 request_module("xfrm-mode-%d-%d", family, encap);
367 modload_attempted = 1;
368 goto retry;
369 }
370
371 xfrm_state_put_afinfo(afinfo);
372 return mode;
373}
374
375static void xfrm_put_mode(struct xfrm_mode *mode)
376{
377 module_put(mode->owner);
378}
379
1da177e4
LT		 380static void xfrm_state_gc_destroy(struct xfrm_state *x)
381{
a47f0ce0
DM		 382 del_timer_sync(&x->timer);
383 del_timer_sync(&x->rtimer);
a51482bd
JJ		 384 kfree(x->aalg);
385 kfree(x->ealg);
386 kfree(x->calg);
387 kfree(x->encap);
060f02a3 388 kfree(x->coaddr);
13996378
HX		 389 if (x->inner_mode)
390 xfrm_put_mode(x->inner_mode);
391 if (x->outer_mode)
392 xfrm_put_mode(x->outer_mode);
1da177e4
LT		 393 if (x->type) {
394 x->type->destructor(x);
395 xfrm_put_type(x->type);
396 }
df71837d 397 security_xfrm_state_free(x);
1da177e4
LT		 398 kfree(x);
399}
400
c4028958 401static void xfrm_state_gc_task(struct work_struct *data)
1da177e4
LT		 402{
403 struct xfrm_state *x;
8f126e37
DM		 404 struct hlist_node *entry, *tmp;
405 struct hlist_head gc_list;
1da177e4 406
1da177e4 407 spin_lock_bh(&xfrm_state_gc_lock);
8f126e37
DM		 408 gc_list.first = xfrm_state_gc_list.first;
409 INIT_HLIST_HEAD(&xfrm_state_gc_list);
1da177e4
LT		 410 spin_unlock_bh(&xfrm_state_gc_lock);
411
8f126e37 412 hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
1da177e4 413 xfrm_state_gc_destroy(x);
8f126e37 414
1da177e4
LT		 415 wake_up(&km_waitq);
416}
417
418static inline unsigned long make_jiffies(long secs)
419{
420 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
421 return MAX_SCHEDULE_TIMEOUT-1;
422 else
a716c119 423 return secs*HZ;
1da177e4
LT		 424}
425
426static void xfrm_timer_handler(unsigned long data)
427{
428 struct xfrm_state *x = (struct xfrm_state*)data;
9d729f72 429 unsigned long now = get_seconds();
1da177e4
LT		 430 long next = LONG_MAX;
431 int warn = 0;
161a09e7 432 int err = 0;
1da177e4
LT		 433
434 spin_lock(&x->lock);
435 if (x->km.state == XFRM_STATE_DEAD)
436 goto out;
437 if (x->km.state == XFRM_STATE_EXPIRED)
438 goto expired;
439 if (x->lft.hard_add_expires_seconds) {
440 long tmo = x->lft.hard_add_expires_seconds +
441 x->curlft.add_time - now;
442 if (tmo <= 0)
443 goto expired;
444 if (tmo < next)
445 next = tmo;
446 }
447 if (x->lft.hard_use_expires_seconds) {
448 long tmo = x->lft.hard_use_expires_seconds +
449 (x->curlft.use_time ? : now) - now;
450 if (tmo <= 0)
451 goto expired;
452 if (tmo < next)
453 next = tmo;
454 }
455 if (x->km.dying)
456 goto resched;
457 if (x->lft.soft_add_expires_seconds) {
458 long tmo = x->lft.soft_add_expires_seconds +
459 x->curlft.add_time - now;
460 if (tmo <= 0)
461 warn = 1;
462 else if (tmo < next)
463 next = tmo;
464 }
465 if (x->lft.soft_use_expires_seconds) {
466 long tmo = x->lft.soft_use_expires_seconds +
467 (x->curlft.use_time ? : now) - now;
468 if (tmo <= 0)
469 warn = 1;
470 else if (tmo < next)
471 next = tmo;
472 }
473
4666faab 474 x->km.dying = warn;
1da177e4 475 if (warn)
53bc6b4d 476 km_state_expired(x, 0, 0);
1da177e4 477resched:
a47f0ce0
DM		 478 if (next != LONG_MAX)
479 mod_timer(&x->timer, jiffies + make_jiffies(next));
480
1da177e4
LT		 481 goto out;
482
483expired:
484 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
485 x->km.state = XFRM_STATE_EXPIRED;
486 wake_up(&km_waitq);
487 next = 2;
488 goto resched;
489 }
161a09e7
JL		 490
491 err = __xfrm_state_delete(x);
492 if (!err && x->id.spi)
53bc6b4d 493 km_state_expired(x, 1, 0);
1da177e4 494
ab5f5e8b 495 xfrm_audit_state_delete(x, err ? 0 : 1,
0c11b942 496 audit_get_loginuid(current), 0);
161a09e7 497
1da177e4
LT		 498out:
499 spin_unlock(&x->lock);
1da177e4
LT		 500}
501
0ac84752
DM		 502static void xfrm_replay_timer_handler(unsigned long data);
503
1da177e4
LT		 504struct xfrm_state *xfrm_state_alloc(void)
505{
506 struct xfrm_state *x;
507
0da974f4 508 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
1da177e4
LT		 509
510 if (x) {
1da177e4
LT		 511 atomic_set(&x->refcnt, 1);
512 atomic_set(&x->tunnel_users, 0);
8f126e37
DM		 513 INIT_HLIST_NODE(&x->bydst);
514 INIT_HLIST_NODE(&x->bysrc);
515 INIT_HLIST_NODE(&x->byspi);
b24b8a24
PE		 516 setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
517 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
518 (unsigned long)x);
9d729f72 519 x->curlft.add_time = get_seconds();
1da177e4
LT		 520 x->lft.soft_byte_limit = XFRM_INF;
521 x->lft.soft_packet_limit = XFRM_INF;
522 x->lft.hard_byte_limit = XFRM_INF;
523 x->lft.hard_packet_limit = XFRM_INF;
f8cd5488
JHS		 524 x->replay_maxage = 0;
525 x->replay_maxdiff = 0;
1da177e4
LT		 526 spin_lock_init(&x->lock);
527 }
528 return x;
529}
530EXPORT_SYMBOL(xfrm_state_alloc);
531
532void __xfrm_state_destroy(struct xfrm_state *x)
533{
534 BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
535
536 spin_lock_bh(&xfrm_state_gc_lock);
8f126e37 537 hlist_add_head(&x->bydst, &xfrm_state_gc_list);
1da177e4
LT		 538 spin_unlock_bh(&xfrm_state_gc_lock);
539 schedule_work(&xfrm_state_gc_work);
540}
541EXPORT_SYMBOL(__xfrm_state_destroy);
542
53bc6b4d 543int __xfrm_state_delete(struct xfrm_state *x)
1da177e4 544{
26b15dad
JHS		 545 int err = -ESRCH;
546
1da177e4
LT		 547 if (x->km.state != XFRM_STATE_DEAD) {
548 x->km.state = XFRM_STATE_DEAD;
549 spin_lock(&xfrm_state_lock);
8f126e37 550 hlist_del(&x->bydst);
8f126e37 551 hlist_del(&x->bysrc);
a47f0ce0 552 if (x->id.spi)
8f126e37 553 hlist_del(&x->byspi);
f034b5d4 554 xfrm_state_num--;
1da177e4 555 spin_unlock(&xfrm_state_lock);
1da177e4 556
1da177e4
LT		 557 /* All xfrm_state objects are created by xfrm_state_alloc.
558 * The xfrm_state_alloc call gives a reference, and that
559 * is what we are dropping here.
560 */
5dba4797 561 xfrm_state_put(x);
26b15dad 562 err = 0;
1da177e4 563 }
26b15dad
JHS		 564
565 return err;
1da177e4 566}
53bc6b4d 567EXPORT_SYMBOL(__xfrm_state_delete);
1da177e4 568
26b15dad 569int xfrm_state_delete(struct xfrm_state *x)
1da177e4 570{
26b15dad
JHS		 571 int err;
572
1da177e4 573 spin_lock_bh(&x->lock);
26b15dad 574 err = __xfrm_state_delete(x);
1da177e4 575 spin_unlock_bh(&x->lock);
26b15dad
JHS		 576
577 return err;
1da177e4
LT		 578}
579EXPORT_SYMBOL(xfrm_state_delete);
580
4aa2e62c
JL		 581#ifdef CONFIG_SECURITY_NETWORK_XFRM
582static inline int
583xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
1da177e4 584{
4aa2e62c
JL		 585 int i, err = 0;
586
587 for (i = 0; i <= xfrm_state_hmask; i++) {
588 struct hlist_node *entry;
589 struct xfrm_state *x;
590
591 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
592 if (xfrm_id_proto_match(x->id.proto, proto) &&
593 (err = security_xfrm_state_delete(x)) != 0) {
ab5f5e8b
JL		 594 xfrm_audit_state_delete(x, 0,
595 audit_info->loginuid,
596 audit_info->secid);
4aa2e62c
JL		 597 return err;
598 }
599 }
600 }
601
602 return err;
603}
604#else
605static inline int
606xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
607{
608 return 0;
609}
610#endif
611
612int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
613{
614 int i, err = 0;
1da177e4
LT		 615
616 spin_lock_bh(&xfrm_state_lock);
4aa2e62c
JL		 617 err = xfrm_state_flush_secctx_check(proto, audit_info);
618 if (err)
619 goto out;
620
a9917c06 621 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37
DM		 622 struct hlist_node *entry;
623 struct xfrm_state *x;
1da177e4 624restart:
8f126e37 625 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1da177e4 626 if (!xfrm_state_kern(x) &&
5794708f 627 xfrm_id_proto_match(x->id.proto, proto)) {
1da177e4
LT		 628 xfrm_state_hold(x);
629 spin_unlock_bh(&xfrm_state_lock);
630
161a09e7 631 err = xfrm_state_delete(x);
ab5f5e8b
JL		 632 xfrm_audit_state_delete(x, err ? 0 : 1,
633 audit_info->loginuid,
634 audit_info->secid);
1da177e4
LT		 635 xfrm_state_put(x);
636
637 spin_lock_bh(&xfrm_state_lock);
638 goto restart;
639 }
640 }
641 }
4aa2e62c
JL		 642 err = 0;
643
644out:
1da177e4
LT		 645 spin_unlock_bh(&xfrm_state_lock);
646 wake_up(&km_waitq);
4aa2e62c 647 return err;
1da177e4
LT		 648}
649EXPORT_SYMBOL(xfrm_state_flush);
650
af11e316 651void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
28d8909b
JHS		 652{
653 spin_lock_bh(&xfrm_state_lock);
654 si->sadcnt = xfrm_state_num;
655 si->sadhcnt = xfrm_state_hmask;
656 si->sadhmcnt = xfrm_state_hashmax;
657 spin_unlock_bh(&xfrm_state_lock);
658}
659EXPORT_SYMBOL(xfrm_sad_getinfo);
660
1da177e4
LT		 661static int
662xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
663 struct xfrm_tmpl *tmpl,
664 xfrm_address_t *daddr, xfrm_address_t *saddr,
665 unsigned short family)
666{
667 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
668 if (!afinfo)
669 return -1;
670 afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
671 xfrm_state_put_afinfo(afinfo);
672 return 0;
673}
674
a94cfd19 675static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
edcd5821
DM		 676{
677 unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
678 struct xfrm_state *x;
8f126e37 679 struct hlist_node *entry;
edcd5821 680
8f126e37 681 hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
edcd5821
DM		 682 if (x->props.family != family ||
683 x->id.spi != spi ||
684 x->id.proto != proto)
685 continue;
686
687 switch (family) {
688 case AF_INET:
689 if (x->id.daddr.a4 != daddr->a4)
690 continue;
691 break;
692 case AF_INET6:
693 if (!ipv6_addr_equal((struct in6_addr *)daddr,
694 (struct in6_addr *)
695 x->id.daddr.a6))
696 continue;
697 break;
3ff50b79 698 }
edcd5821
DM		 699
700 xfrm_state_hold(x);
701 return x;
702 }
703
704 return NULL;
705}
706
707static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
708{
667bbcb6 709 unsigned int h = xfrm_src_hash(daddr, saddr, family);
edcd5821 710 struct xfrm_state *x;
8f126e37 711 struct hlist_node *entry;
edcd5821 712
8f126e37 713 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
edcd5821
DM		 714 if (x->props.family != family ||
715 x->id.proto != proto)
716 continue;
717
718 switch (family) {
719 case AF_INET:
720 if (x->id.daddr.a4 != daddr->a4 ||
721 x->props.saddr.a4 != saddr->a4)
722 continue;
723 break;
724 case AF_INET6:
725 if (!ipv6_addr_equal((struct in6_addr *)daddr,
726 (struct in6_addr *)
727 x->id.daddr.a6) ||
728 !ipv6_addr_equal((struct in6_addr *)saddr,
729 (struct in6_addr *)
730 x->props.saddr.a6))
731 continue;
732 break;
3ff50b79 733 }
edcd5821
DM		 734
735 xfrm_state_hold(x);
736 return x;
737 }
738
739 return NULL;
740}
741
742static inline struct xfrm_state *
743__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
744{
745 if (use_spi)
746 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
747 x->id.proto, family);
748 else
749 return __xfrm_state_lookup_byaddr(&x->id.daddr,
750 &x->props.saddr,
751 x->id.proto, family);
752}
753
2fab22f2
PM		 754static void xfrm_hash_grow_check(int have_hash_collision)
755{
756 if (have_hash_collision &&
757 (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
758 xfrm_state_num > xfrm_state_hmask)
759 schedule_work(&xfrm_hash_work);
760}
761
1da177e4 762struct xfrm_state *
a716c119 763xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1da177e4
LT		 764 struct flowi *fl, struct xfrm_tmpl *tmpl,
765 struct xfrm_policy *pol, int *err,
766 unsigned short family)
767{
4bda4f25 768 unsigned int h;
8f126e37 769 struct hlist_node *entry;
1da177e4
LT		 770 struct xfrm_state *x, *x0;
771 int acquire_in_progress = 0;
772 int error = 0;
773 struct xfrm_state *best = NULL;
a716c119 774
1da177e4 775 spin_lock_bh(&xfrm_state_lock);
4bda4f25 776 h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
8f126e37 777 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1da177e4
LT		 778 if (x->props.family == family &&
779 x->props.reqid == tmpl->reqid &&
fbd9a5b4 780 !(x->props.flags & XFRM_STATE_WILDRECV) &&
1da177e4
LT		 781 xfrm_state_addr_check(x, daddr, saddr, family) &&
782 tmpl->mode == x->props.mode &&
783 tmpl->id.proto == x->id.proto &&
784 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
785 /* Resolution logic:
786 1. There is a valid state with matching selector.
787 Done.
788 2. Valid state with inappropriate selector. Skip.
789
790 Entering area of "sysdeps".
791
792 3. If state is not valid, selector is temporary,
793 it selects only session which triggered
794 previous resolution. Key manager will do
795 something to install a state with proper
796 selector.
797 */
798 if (x->km.state == XFRM_STATE_VALID) {
48b8d783 799 if (!xfrm_selector_match(&x->sel, fl, x->sel.family) ||
e0d1caa7 800 !security_xfrm_state_pol_flow_match(x, pol, fl))
1da177e4
LT		 801 continue;
802 if (!best ||
803 best->km.dying > x->km.dying ||
804 (best->km.dying == x->km.dying &&
805 best->curlft.add_time < x->curlft.add_time))
806 best = x;
807 } else if (x->km.state == XFRM_STATE_ACQ) {
808 acquire_in_progress = 1;
809 } else if (x->km.state == XFRM_STATE_ERROR ||
810 x->km.state == XFRM_STATE_EXPIRED) {
48b8d783 811 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
e0d1caa7 812 security_xfrm_state_pol_flow_match(x, pol, fl))
1da177e4
LT		 813 error = -ESRCH;
814 }
815 }
816 }
817
818 x = best;
819 if (!x && !error && !acquire_in_progress) {
5c5d281a 820 if (tmpl->id.spi &&
edcd5821
DM		 821 (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
822 tmpl->id.proto, family)) != NULL) {
1da177e4
LT		 823 xfrm_state_put(x0);
824 error = -EEXIST;
825 goto out;
826 }
827 x = xfrm_state_alloc();
828 if (x == NULL) {
829 error = -ENOMEM;
830 goto out;
831 }
832 /* Initialize temporary selector matching only
833 * to current session. */
834 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
835
e0d1caa7
VY		 836 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
837 if (error) {
838 x->km.state = XFRM_STATE_DEAD;
839 xfrm_state_put(x);
840 x = NULL;
841 goto out;
842 }
843
1da177e4
LT		 844 if (km_query(x, tmpl, pol) == 0) {
845 x->km.state = XFRM_STATE_ACQ;
8f126e37 846 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
667bbcb6 847 h = xfrm_src_hash(daddr, saddr, family);
8f126e37 848 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1da177e4
LT		 849 if (x->id.spi) {
850 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
8f126e37 851 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1da177e4 852 }
01e67d08
DM		 853 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
854 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1da177e4 855 add_timer(&x->timer);
2fab22f2
PM		 856 xfrm_state_num++;
857 xfrm_hash_grow_check(x->bydst.next != NULL);
1da177e4
LT		 858 } else {
859 x->km.state = XFRM_STATE_DEAD;
860 xfrm_state_put(x);
861 x = NULL;
862 error = -ESRCH;
863 }
864 }
865out:
866 if (x)
867 xfrm_state_hold(x);
868 else
869 *err = acquire_in_progress ? -EAGAIN : error;
870 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 871 return x;
872}
873
628529b6
JHS		 874struct xfrm_state *
875xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
876 unsigned short family, u8 mode, u8 proto, u32 reqid)
877{
4bda4f25 878 unsigned int h;
628529b6
JHS		 879 struct xfrm_state *rx = NULL, *x = NULL;
880 struct hlist_node *entry;
881
882 spin_lock(&xfrm_state_lock);
4bda4f25 883 h = xfrm_dst_hash(daddr, saddr, reqid, family);
628529b6
JHS		 884 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
885 if (x->props.family == family &&
886 x->props.reqid == reqid &&
887 !(x->props.flags & XFRM_STATE_WILDRECV) &&
888 xfrm_state_addr_check(x, daddr, saddr, family) &&
889 mode == x->props.mode &&
890 proto == x->id.proto &&
891 x->km.state == XFRM_STATE_VALID) {
892 rx = x;
893 break;
894 }
895 }
896
897 if (rx)
898 xfrm_state_hold(rx);
899 spin_unlock(&xfrm_state_lock);
900
901
902 return rx;
903}
904EXPORT_SYMBOL(xfrm_stateonly_find);
905
1da177e4
LT		 906static void __xfrm_state_insert(struct xfrm_state *x)
907{
a624c108 908 unsigned int h;
1da177e4 909
9d4a706d
DM		 910 x->genid = ++xfrm_state_genid;
911
c1969f29
DM		 912 h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
913 x->props.reqid, x->props.family);
8f126e37 914 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1da177e4 915
667bbcb6 916 h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
8f126e37 917 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1da177e4 918
7b4dc360 919 if (x->id.spi) {
6c44e6b7
MN		 920 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
921 x->props.family);
922
8f126e37 923 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
6c44e6b7
MN		 924 }
925
a47f0ce0
DM		 926 mod_timer(&x->timer, jiffies + HZ);
927 if (x->replay_maxage)
928 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
f8cd5488 929
1da177e4 930 wake_up(&km_waitq);
f034b5d4
DM		 931
932 xfrm_state_num++;
933
918049f0 934 xfrm_hash_grow_check(x->bydst.next != NULL);
1da177e4
LT		 935}
936
c7f5ea3a
DM		 937/* xfrm_state_lock is held */
938static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
939{
940 unsigned short family = xnew->props.family;
941 u32 reqid = xnew->props.reqid;
942 struct xfrm_state *x;
943 struct hlist_node *entry;
944 unsigned int h;
945
c1969f29 946 h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
c7f5ea3a
DM		 947 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
948 if (x->props.family == family &&
949 x->props.reqid == reqid &&
c1969f29
DM		 950 !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
951 !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
c7f5ea3a
DM		 952 x->genid = xfrm_state_genid;
953 }
954}
955
1da177e4
LT		 956void xfrm_state_insert(struct xfrm_state *x)
957{
958 spin_lock_bh(&xfrm_state_lock);
c7f5ea3a 959 __xfrm_state_bump_genids(x);
1da177e4
LT		 960 __xfrm_state_insert(x);
961 spin_unlock_bh(&xfrm_state_lock);
962}
963EXPORT_SYMBOL(xfrm_state_insert);
964
2770834c
DM		 965/* xfrm_state_lock is held */
966static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
967{
c1969f29 968 unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
8f126e37 969 struct hlist_node *entry;
2770834c
DM		 970 struct xfrm_state *x;
971
8f126e37 972 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
2770834c
DM		 973 if (x->props.reqid != reqid ||
974 x->props.mode != mode ||
975 x->props.family != family ||
976 x->km.state != XFRM_STATE_ACQ ||
75e252d9
JL		 977 x->id.spi != 0 ||
978 x->id.proto != proto)
2770834c
DM		 979 continue;
980
981 switch (family) {
982 case AF_INET:
983 if (x->id.daddr.a4 != daddr->a4 ||
984 x->props.saddr.a4 != saddr->a4)
985 continue;
986 break;
987 case AF_INET6:
988 if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
989 (struct in6_addr *)daddr) ||
990 !ipv6_addr_equal((struct in6_addr *)
991 x->props.saddr.a6,
992 (struct in6_addr *)saddr))
993 continue;
994 break;
3ff50b79 995 }
2770834c
DM		 996
997 xfrm_state_hold(x);
998 return x;
999 }
1000
1001 if (!create)
1002 return NULL;
1003
1004 x = xfrm_state_alloc();
1005 if (likely(x)) {
1006 switch (family) {
1007 case AF_INET:
1008 x->sel.daddr.a4 = daddr->a4;
1009 x->sel.saddr.a4 = saddr->a4;
1010 x->sel.prefixlen_d = 32;
1011 x->sel.prefixlen_s = 32;
1012 x->props.saddr.a4 = saddr->a4;
1013 x->id.daddr.a4 = daddr->a4;
1014 break;
1015
1016 case AF_INET6:
1017 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1018 (struct in6_addr *)daddr);
1019 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1020 (struct in6_addr *)saddr);
1021 x->sel.prefixlen_d = 128;
1022 x->sel.prefixlen_s = 128;
1023 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1024 (struct in6_addr *)saddr);
1025 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1026 (struct in6_addr *)daddr);
1027 break;
3ff50b79 1028 }
2770834c
DM		 1029
1030 x->km.state = XFRM_STATE_ACQ;
1031 x->id.proto = proto;
1032 x->props.family = family;
1033 x->props.mode = mode;
1034 x->props.reqid = reqid;
01e67d08 1035 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
2770834c 1036 xfrm_state_hold(x);
01e67d08 1037 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
2770834c 1038 add_timer(&x->timer);
8f126e37 1039 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
667bbcb6 1040 h = xfrm_src_hash(daddr, saddr, family);
8f126e37 1041 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
918049f0
DM		 1042
1043 xfrm_state_num++;
1044
1045 xfrm_hash_grow_check(x->bydst.next != NULL);
2770834c
DM		 1046 }
1047
1048 return x;
1049}
1050
1da177e4
LT		 1051static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
1052
1053int xfrm_state_add(struct xfrm_state *x)
1054{
1da177e4
LT		 1055 struct xfrm_state *x1;
1056 int family;
1057 int err;
eb2971b6 1058 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1da177e4
LT		 1059
1060 family = x->props.family;
1da177e4
LT		 1061
1062 spin_lock_bh(&xfrm_state_lock);
1063
edcd5821 1064 x1 = __xfrm_state_locate(x, use_spi, family);
1da177e4
LT		 1065 if (x1) {
1066 xfrm_state_put(x1);
1067 x1 = NULL;
1068 err = -EEXIST;
1069 goto out;
1070 }
1071
eb2971b6 1072 if (use_spi && x->km.seq) {
1da177e4 1073 x1 = __xfrm_find_acq_byseq(x->km.seq);
75e252d9
JL		 1074 if (x1 && ((x1->id.proto != x->id.proto) ||
1075 xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1da177e4
LT		 1076 xfrm_state_put(x1);
1077 x1 = NULL;
1078 }
1079 }
1080
eb2971b6 1081 if (use_spi && !x1)
2770834c
DM		 1082 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
1083 x->id.proto,
1084 &x->id.daddr, &x->props.saddr, 0);
1da177e4 1085
c7f5ea3a 1086 __xfrm_state_bump_genids(x);
1da177e4
LT		 1087 __xfrm_state_insert(x);
1088 err = 0;
1089
1090out:
1091 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 1092
1093 if (x1) {
1094 xfrm_state_delete(x1);
1095 xfrm_state_put(x1);
1096 }
1097
1098 return err;
1099}
1100EXPORT_SYMBOL(xfrm_state_add);
1101
80c9abaa 1102#ifdef CONFIG_XFRM_MIGRATE
6666351d 1103static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
80c9abaa
SS		 1104{
1105 int err = -ENOMEM;
1106 struct xfrm_state *x = xfrm_state_alloc();
1107 if (!x)
1108 goto error;
1109
1110 memcpy(&x->id, &orig->id, sizeof(x->id));
1111 memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1112 memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1113 x->props.mode = orig->props.mode;
1114 x->props.replay_window = orig->props.replay_window;
1115 x->props.reqid = orig->props.reqid;
1116 x->props.family = orig->props.family;
1117 x->props.saddr = orig->props.saddr;
1118
1119 if (orig->aalg) {
1120 x->aalg = xfrm_algo_clone(orig->aalg);
1121 if (!x->aalg)
1122 goto error;
1123 }
1124 x->props.aalgo = orig->props.aalgo;
1125
1126 if (orig->ealg) {
1127 x->ealg = xfrm_algo_clone(orig->ealg);
1128 if (!x->ealg)
1129 goto error;
1130 }
1131 x->props.ealgo = orig->props.ealgo;
1132
1133 if (orig->calg) {
1134 x->calg = xfrm_algo_clone(orig->calg);
1135 if (!x->calg)
1136 goto error;
1137 }
1138 x->props.calgo = orig->props.calgo;
1139
a716c119 1140 if (orig->encap) {
80c9abaa
SS		 1141 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1142 if (!x->encap)
1143 goto error;
1144 }
1145
1146 if (orig->coaddr) {
1147 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1148 GFP_KERNEL);
1149 if (!x->coaddr)
1150 goto error;
1151 }
1152
1153 err = xfrm_init_state(x);
1154 if (err)
1155 goto error;
1156
1157 x->props.flags = orig->props.flags;
1158
1159 x->curlft.add_time = orig->curlft.add_time;
1160 x->km.state = orig->km.state;
1161 x->km.seq = orig->km.seq;
1162
1163 return x;
1164
1165 error:
1166 if (errp)
1167 *errp = err;
1168 if (x) {
1169 kfree(x->aalg);
1170 kfree(x->ealg);
1171 kfree(x->calg);
1172 kfree(x->encap);
1173 kfree(x->coaddr);
1174 }
1175 kfree(x);
1176 return NULL;
1177}
80c9abaa
SS		 1178
1179/* xfrm_state_lock is held */
1180struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1181{
1182 unsigned int h;
1183 struct xfrm_state *x;
1184 struct hlist_node *entry;
1185
1186 if (m->reqid) {
1187 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1188 m->reqid, m->old_family);
1189 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1190 if (x->props.mode != m->mode ||
1191 x->id.proto != m->proto)
1192 continue;
1193 if (m->reqid && x->props.reqid != m->reqid)
1194 continue;
1195 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1196 m->old_family) ||
1197 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1198 m->old_family))
1199 continue;
1200 xfrm_state_hold(x);
1201 return x;
1202 }
1203 } else {
1204 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1205 m->old_family);
1206 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1207 if (x->props.mode != m->mode ||
1208 x->id.proto != m->proto)
1209 continue;
1210 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1211 m->old_family) ||
1212 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1213 m->old_family))
1214 continue;
1215 xfrm_state_hold(x);
1216 return x;
1217 }
1218 }
1219
a716c119 1220 return NULL;
80c9abaa
SS		 1221}
1222EXPORT_SYMBOL(xfrm_migrate_state_find);
1223
1224struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1225 struct xfrm_migrate *m)
1226{
1227 struct xfrm_state *xc;
1228 int err;
1229
1230 xc = xfrm_state_clone(x, &err);
1231 if (!xc)
1232 return NULL;
1233
1234 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1235 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1236
1237 /* add state */
1238 if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1239 /* a care is needed when the destination address of the
1240 state is to be updated as it is a part of triplet */
1241 xfrm_state_insert(xc);
1242 } else {
1243 if ((err = xfrm_state_add(xc)) < 0)
1244 goto error;
1245 }
1246
1247 return xc;
1248error:
1249 kfree(xc);
1250 return NULL;
1251}
1252EXPORT_SYMBOL(xfrm_state_migrate);
1253#endif
1254
1da177e4
LT		 1255int xfrm_state_update(struct xfrm_state *x)
1256{
1da177e4
LT		 1257 struct xfrm_state *x1;
1258 int err;
eb2971b6 1259 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1da177e4 1260
1da177e4 1261 spin_lock_bh(&xfrm_state_lock);
edcd5821 1262 x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1da177e4
LT		 1263
1264 err = -ESRCH;
1265 if (!x1)
1266 goto out;
1267
1268 if (xfrm_state_kern(x1)) {
1269 xfrm_state_put(x1);
1270 err = -EEXIST;
1271 goto out;
1272 }
1273
1274 if (x1->km.state == XFRM_STATE_ACQ) {
1275 __xfrm_state_insert(x);
1276 x = NULL;
1277 }
1278 err = 0;
1279
1280out:
1281 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 1282
1283 if (err)
1284 return err;
1285
1286 if (!x) {
1287 xfrm_state_delete(x1);
1288 xfrm_state_put(x1);
1289 return 0;
1290 }
1291
1292 err = -EINVAL;
1293 spin_lock_bh(&x1->lock);
1294 if (likely(x1->km.state == XFRM_STATE_VALID)) {
1295 if (x->encap && x1->encap)
1296 memcpy(x1->encap, x->encap, sizeof(*x1->encap));
060f02a3
NT		 1297 if (x->coaddr && x1->coaddr) {
1298 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1299 }
1300 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1301 memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1da177e4
LT		 1302 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1303 x1->km.dying = 0;
1304
a47f0ce0 1305 mod_timer(&x1->timer, jiffies + HZ);
1da177e4
LT		 1306 if (x1->curlft.use_time)
1307 xfrm_state_check_expire(x1);
1308
1309 err = 0;
1310 }
1311 spin_unlock_bh(&x1->lock);
1312
1313 xfrm_state_put(x1);
1314
1315 return err;
1316}
1317EXPORT_SYMBOL(xfrm_state_update);
1318
1319int xfrm_state_check_expire(struct xfrm_state *x)
1320{
1321 if (!x->curlft.use_time)
9d729f72 1322 x->curlft.use_time = get_seconds();
1da177e4
LT		 1323
1324 if (x->km.state != XFRM_STATE_VALID)
1325 return -EINVAL;
1326
1327 if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1328 x->curlft.packets >= x->lft.hard_packet_limit) {
4666faab 1329 x->km.state = XFRM_STATE_EXPIRED;
a47f0ce0 1330 mod_timer(&x->timer, jiffies);
1da177e4
LT		 1331 return -EINVAL;
1332 }
1333
1334 if (!x->km.dying &&
1335 (x->curlft.bytes >= x->lft.soft_byte_limit ||
4666faab
HX		 1336 x->curlft.packets >= x->lft.soft_packet_limit)) {
1337 x->km.dying = 1;
53bc6b4d 1338 km_state_expired(x, 0, 0);
4666faab 1339 }
1da177e4
LT		 1340 return 0;
1341}
1342EXPORT_SYMBOL(xfrm_state_check_expire);
1343
1da177e4 1344struct xfrm_state *
a94cfd19 1345xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1da177e4
LT		 1346 unsigned short family)
1347{
1348 struct xfrm_state *x;
1da177e4
LT		 1349
1350 spin_lock_bh(&xfrm_state_lock);
edcd5821 1351 x = __xfrm_state_lookup(daddr, spi, proto, family);
1da177e4 1352 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 1353 return x;
1354}
1355EXPORT_SYMBOL(xfrm_state_lookup);
1356
1357struct xfrm_state *
eb2971b6
MN		 1358xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1359 u8 proto, unsigned short family)
1360{
1361 struct xfrm_state *x;
eb2971b6
MN		 1362
1363 spin_lock_bh(&xfrm_state_lock);
edcd5821 1364 x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
eb2971b6 1365 spin_unlock_bh(&xfrm_state_lock);
eb2971b6
MN		 1366 return x;
1367}
1368EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1369
1370struct xfrm_state *
a716c119
YH		 1371xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1372 xfrm_address_t *daddr, xfrm_address_t *saddr,
1da177e4
LT		 1373 int create, unsigned short family)
1374{
1375 struct xfrm_state *x;
1da177e4
LT		 1376
1377 spin_lock_bh(&xfrm_state_lock);
2770834c 1378 x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1da177e4 1379 spin_unlock_bh(&xfrm_state_lock);
2770834c 1380
1da177e4
LT		 1381 return x;
1382}
1383EXPORT_SYMBOL(xfrm_find_acq);
1384
41a49cc3
MN		 1385#ifdef CONFIG_XFRM_SUB_POLICY
1386int
1387xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1388 unsigned short family)
1389{
1390 int err = 0;
1391 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1392 if (!afinfo)
1393 return -EAFNOSUPPORT;
1394
1395 spin_lock_bh(&xfrm_state_lock);
1396 if (afinfo->tmpl_sort)
1397 err = afinfo->tmpl_sort(dst, src, n);
1398 spin_unlock_bh(&xfrm_state_lock);
1399 xfrm_state_put_afinfo(afinfo);
1400 return err;
1401}
1402EXPORT_SYMBOL(xfrm_tmpl_sort);
1403
1404int
1405xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1406 unsigned short family)
1407{
1408 int err = 0;
1409 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1410 if (!afinfo)
1411 return -EAFNOSUPPORT;
1412
1413 spin_lock_bh(&xfrm_state_lock);
1414 if (afinfo->state_sort)
1415 err = afinfo->state_sort(dst, src, n);
1416 spin_unlock_bh(&xfrm_state_lock);
1417 xfrm_state_put_afinfo(afinfo);
1418 return err;
1419}
1420EXPORT_SYMBOL(xfrm_state_sort);
1421#endif
1422
1da177e4
LT		 1423/* Silly enough, but I'm lazy to build resolution list */
1424
1425static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1426{
1427 int i;
1da177e4 1428
f034b5d4 1429 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37
DM		 1430 struct hlist_node *entry;
1431 struct xfrm_state *x;
1432
1433 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1434 if (x->km.seq == seq &&
1435 x->km.state == XFRM_STATE_ACQ) {
1da177e4
LT		 1436 xfrm_state_hold(x);
1437 return x;
1438 }
1439 }
1440 }
1441 return NULL;
1442}
1443
1444struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1445{
1446 struct xfrm_state *x;
1447
1448 spin_lock_bh(&xfrm_state_lock);
1449 x = __xfrm_find_acq_byseq(seq);
1450 spin_unlock_bh(&xfrm_state_lock);
1451 return x;
1452}
1453EXPORT_SYMBOL(xfrm_find_acq_byseq);
1454
1455u32 xfrm_get_acqseq(void)
1456{
1457 u32 res;
1458 static u32 acqseq;
1459 static DEFINE_SPINLOCK(acqseq_lock);
1460
1461 spin_lock_bh(&acqseq_lock);
1462 res = (++acqseq ? : ++acqseq);
1463 spin_unlock_bh(&acqseq_lock);
1464 return res;
1465}
1466EXPORT_SYMBOL(xfrm_get_acqseq);
1467
658b219e 1468int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1da177e4 1469{
f034b5d4 1470 unsigned int h;
1da177e4 1471 struct xfrm_state *x0;
658b219e
HX		 1472 int err = -ENOENT;
1473 __be32 minspi = htonl(low);
1474 __be32 maxspi = htonl(high);
1da177e4 1475
658b219e
HX		 1476 spin_lock_bh(&x->lock);
1477 if (x->km.state == XFRM_STATE_DEAD)
1478 goto unlock;
1479
1480 err = 0;
1da177e4 1481 if (x->id.spi)
658b219e
HX		 1482 goto unlock;
1483
1484 err = -ENOENT;
1da177e4
LT		 1485
1486 if (minspi == maxspi) {
1487 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1488 if (x0) {
1489 xfrm_state_put(x0);
658b219e 1490 goto unlock;
1da177e4
LT		 1491 }
1492 x->id.spi = minspi;
1493 } else {
1494 u32 spi = 0;
26977b4e
AV		 1495 for (h=0; h<high-low+1; h++) {
1496 spi = low + net_random()%(high-low+1);
1da177e4
LT		 1497 x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1498 if (x0 == NULL) {
1499 x->id.spi = htonl(spi);
1500 break;
1501 }
1502 xfrm_state_put(x0);
1503 }
1504 }
1505 if (x->id.spi) {
1506 spin_lock_bh(&xfrm_state_lock);
1507 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
8f126e37 1508 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1da177e4 1509 spin_unlock_bh(&xfrm_state_lock);
658b219e
HX		 1510
1511 err = 0;
1da177e4 1512 }
658b219e
HX		 1513
1514unlock:
1515 spin_unlock_bh(&x->lock);
1516
1517 return err;
1da177e4
LT		 1518}
1519EXPORT_SYMBOL(xfrm_alloc_spi);
1520
1521int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
1522 void *data)
1523{
1524 int i;
94b9bb54 1525 struct xfrm_state *x, *last = NULL;
8f126e37 1526 struct hlist_node *entry;
1da177e4
LT		 1527 int count = 0;
1528 int err = 0;
1529
1530 spin_lock_bh(&xfrm_state_lock);
f034b5d4 1531 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37 1532 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
94b9bb54
JHS		 1533 if (!xfrm_id_proto_match(x->id.proto, proto))
1534 continue;
1535 if (last) {
1536 err = func(last, count, data);
1537 if (err)
1538 goto out;
1539 }
1540 last = x;
1541 count++;
1da177e4
LT		 1542 }
1543 }
1544 if (count == 0) {
1545 err = -ENOENT;
1546 goto out;
1547 }
94b9bb54 1548 err = func(last, 0, data);
1da177e4
LT		 1549out:
1550 spin_unlock_bh(&xfrm_state_lock);
1551 return err;
1552}
1553EXPORT_SYMBOL(xfrm_state_walk);
1554
f8cd5488
JHS		 1555
1556void xfrm_replay_notify(struct xfrm_state *x, int event)
1557{
1558 struct km_event c;
1559 /* we send notify messages in case
1560 * 1. we updated on of the sequence numbers, and the seqno difference
1561 * is at least x->replay_maxdiff, in this case we also update the
1562 * timeout of our timer function
1563 * 2. if x->replay_maxage has elapsed since last update,
1564 * and there were changes
1565 *
1566 * The state structure must be locked!
1567 */
1568
1569 switch (event) {
1570 case XFRM_REPLAY_UPDATE:
1571 if (x->replay_maxdiff &&
1572 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
2717096a
JHS		 1573 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1574 if (x->xflags & XFRM_TIME_DEFER)
1575 event = XFRM_REPLAY_TIMEOUT;
1576 else
1577 return;
1578 }
f8cd5488
JHS		 1579
1580 break;
1581
1582 case XFRM_REPLAY_TIMEOUT:
1583 if ((x->replay.seq == x->preplay.seq) &&
1584 (x->replay.bitmap == x->preplay.bitmap) &&
2717096a
JHS		 1585 (x->replay.oseq == x->preplay.oseq)) {
1586 x->xflags |= XFRM_TIME_DEFER;
f8cd5488 1587 return;
2717096a 1588 }
f8cd5488
JHS		 1589
1590 break;
1591 }
1592
1593 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1594 c.event = XFRM_MSG_NEWAE;
1595 c.data.aevent = event;
1596 km_state_notify(x, &c);
1597
f8cd5488 1598 if (x->replay_maxage &&
a47f0ce0 1599 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
2717096a 1600 x->xflags &= ~XFRM_TIME_DEFER;
f8cd5488
JHS		 1601}
1602
1603static void xfrm_replay_timer_handler(unsigned long data)
1604{
1605 struct xfrm_state *x = (struct xfrm_state*)data;
1606
1607 spin_lock(&x->lock);
1608
2717096a
JHS		 1609 if (x->km.state == XFRM_STATE_VALID) {
1610 if (xfrm_aevent_is_on())
1611 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1612 else
1613 x->xflags |= XFRM_TIME_DEFER;
1614 }
f8cd5488
JHS		 1615
1616 spin_unlock(&x->lock);
1617}
1618
afeb14b4
PM		 1619int xfrm_replay_check(struct xfrm_state *x,
1620 struct sk_buff *skb, __be32 net_seq)
1da177e4
LT		 1621{
1622 u32 diff;
a252cc23 1623 u32 seq = ntohl(net_seq);
1da177e4
LT		 1624
1625 if (unlikely(seq == 0))
afeb14b4 1626 goto err;
1da177e4
LT		 1627
1628 if (likely(seq > x->replay.seq))
1629 return 0;
1630
1631 diff = x->replay.seq - seq;
4c4d51a7
HX		 1632 if (diff >= min_t(unsigned int, x->props.replay_window,
1633 sizeof(x->replay.bitmap) * 8)) {
1da177e4 1634 x->stats.replay_window++;
afeb14b4 1635 goto err;
1da177e4
LT		 1636 }
1637
1638 if (x->replay.bitmap & (1U << diff)) {
1639 x->stats.replay++;
afeb14b4 1640 goto err;
1da177e4
LT		 1641 }
1642 return 0;
afeb14b4
PM		 1643
1644err:
1645 xfrm_audit_state_replay(x, skb, net_seq);
1646 return -EINVAL;
1da177e4 1647}
1da177e4 1648
61f4627b 1649void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1da177e4
LT		 1650{
1651 u32 diff;
61f4627b 1652 u32 seq = ntohl(net_seq);
1da177e4
LT		 1653
1654 if (seq > x->replay.seq) {
1655 diff = seq - x->replay.seq;
1656 if (diff < x->props.replay_window)
1657 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1658 else
1659 x->replay.bitmap = 1;
1660 x->replay.seq = seq;
1661 } else {
1662 diff = x->replay.seq - seq;
1663 x->replay.bitmap |= (1U << diff);
1664 }
f8cd5488
JHS		 1665
1666 if (xfrm_aevent_is_on())
1667 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1da177e4 1668}
1da177e4 1669
df01812e 1670static LIST_HEAD(xfrm_km_list);
1da177e4
LT		 1671static DEFINE_RWLOCK(xfrm_km_lock);
1672
26b15dad 1673void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1da177e4
LT		 1674{
1675 struct xfrm_mgr *km;
1676
26b15dad
JHS		 1677 read_lock(&xfrm_km_lock);
1678 list_for_each_entry(km, &xfrm_km_list, list)
1679 if (km->notify_policy)
1680 km->notify_policy(xp, dir, c);
1681 read_unlock(&xfrm_km_lock);
1682}
1da177e4 1683
26b15dad
JHS		 1684void km_state_notify(struct xfrm_state *x, struct km_event *c)
1685{
1686 struct xfrm_mgr *km;
1da177e4
LT		 1687 read_lock(&xfrm_km_lock);
1688 list_for_each_entry(km, &xfrm_km_list, list)
26b15dad
JHS		 1689 if (km->notify)
1690 km->notify(x, c);
1da177e4 1691 read_unlock(&xfrm_km_lock);
26b15dad
JHS		 1692}
1693
1694EXPORT_SYMBOL(km_policy_notify);
1695EXPORT_SYMBOL(km_state_notify);
1696
53bc6b4d 1697void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
26b15dad
JHS		 1698{
1699 struct km_event c;
1700
bf08867f 1701 c.data.hard = hard;
53bc6b4d 1702 c.pid = pid;
f60f6b8f 1703 c.event = XFRM_MSG_EXPIRE;
26b15dad 1704 km_state_notify(x, &c);
1da177e4
LT		 1705
1706 if (hard)
1707 wake_up(&km_waitq);
1708}
1709
53bc6b4d 1710EXPORT_SYMBOL(km_state_expired);
26b15dad
JHS		 1711/*
1712 * We send to all registered managers regardless of failure
1713 * We are happy with one success
1714*/
980ebd25 1715int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1da177e4 1716{
26b15dad 1717 int err = -EINVAL, acqret;
1da177e4
LT		 1718 struct xfrm_mgr *km;
1719
1720 read_lock(&xfrm_km_lock);
1721 list_for_each_entry(km, &xfrm_km_list, list) {
26b15dad
JHS		 1722 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1723 if (!acqret)
1724 err = acqret;
1da177e4
LT		 1725 }
1726 read_unlock(&xfrm_km_lock);
1727 return err;
1728}
980ebd25 1729EXPORT_SYMBOL(km_query);
1da177e4 1730
5d36b180 1731int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1da177e4
LT		 1732{
1733 int err = -EINVAL;
1734 struct xfrm_mgr *km;
1735
1736 read_lock(&xfrm_km_lock);
1737 list_for_each_entry(km, &xfrm_km_list, list) {
1738 if (km->new_mapping)
1739 err = km->new_mapping(x, ipaddr, sport);
1740 if (!err)
1741 break;
1742 }
1743 read_unlock(&xfrm_km_lock);
1744 return err;
1745}
1746EXPORT_SYMBOL(km_new_mapping);
1747
6c5c8ca7 1748void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1da177e4 1749{
26b15dad 1750 struct km_event c;
1da177e4 1751
bf08867f 1752 c.data.hard = hard;
6c5c8ca7 1753 c.pid = pid;
f60f6b8f 1754 c.event = XFRM_MSG_POLEXPIRE;
26b15dad 1755 km_policy_notify(pol, dir, &c);
1da177e4
LT		 1756
1757 if (hard)
1758 wake_up(&km_waitq);
1759}
a70fcb0b 1760EXPORT_SYMBOL(km_policy_expired);
1da177e4 1761
2d60abc2 1762#ifdef CONFIG_XFRM_MIGRATE
80c9abaa
SS		 1763int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1764 struct xfrm_migrate *m, int num_migrate)
1765{
1766 int err = -EINVAL;
1767 int ret;
1768 struct xfrm_mgr *km;
1769
1770 read_lock(&xfrm_km_lock);
1771 list_for_each_entry(km, &xfrm_km_list, list) {
1772 if (km->migrate) {
1773 ret = km->migrate(sel, dir, type, m, num_migrate);
1774 if (!ret)
1775 err = ret;
1776 }
1777 }
1778 read_unlock(&xfrm_km_lock);
1779 return err;
1780}
1781EXPORT_SYMBOL(km_migrate);
2d60abc2 1782#endif
80c9abaa 1783
97a64b45
MN		 1784int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1785{
1786 int err = -EINVAL;
1787 int ret;
1788 struct xfrm_mgr *km;
1789
1790 read_lock(&xfrm_km_lock);
1791 list_for_each_entry(km, &xfrm_km_list, list) {
1792 if (km->report) {
1793 ret = km->report(proto, sel, addr);
1794 if (!ret)
1795 err = ret;
1796 }
1797 }
1798 read_unlock(&xfrm_km_lock);
1799 return err;
1800}
1801EXPORT_SYMBOL(km_report);
1802
1da177e4
LT		 1803int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1804{
1805 int err;
1806 u8 *data;
1807 struct xfrm_mgr *km;
1808 struct xfrm_policy *pol = NULL;
1809
1810 if (optlen <= 0 || optlen > PAGE_SIZE)
1811 return -EMSGSIZE;
1812
1813 data = kmalloc(optlen, GFP_KERNEL);
1814 if (!data)
1815 return -ENOMEM;
1816
1817 err = -EFAULT;
1818 if (copy_from_user(data, optval, optlen))
1819 goto out;
1820
1821 err = -EINVAL;
1822 read_lock(&xfrm_km_lock);
1823 list_for_each_entry(km, &xfrm_km_list, list) {
cb969f07 1824 pol = km->compile_policy(sk, optname, data,
1da177e4
LT		 1825 optlen, &err);
1826 if (err >= 0)
1827 break;
1828 }
1829 read_unlock(&xfrm_km_lock);
1830
1831 if (err >= 0) {
1832 xfrm_sk_policy_insert(sk, err, pol);
1833 xfrm_pol_put(pol);
1834 err = 0;
1835 }
1836
1837out:
1838 kfree(data);
1839 return err;
1840}
1841EXPORT_SYMBOL(xfrm_user_policy);
1842
1843int xfrm_register_km(struct xfrm_mgr *km)
1844{
1845 write_lock_bh(&xfrm_km_lock);
1846 list_add_tail(&km->list, &xfrm_km_list);
1847 write_unlock_bh(&xfrm_km_lock);
1848 return 0;
1849}
1850EXPORT_SYMBOL(xfrm_register_km);
1851
1852int xfrm_unregister_km(struct xfrm_mgr *km)
1853{
1854 write_lock_bh(&xfrm_km_lock);
1855 list_del(&km->list);
1856 write_unlock_bh(&xfrm_km_lock);
1857 return 0;
1858}
1859EXPORT_SYMBOL(xfrm_unregister_km);
1860
1861int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1862{
1863 int err = 0;
1864 if (unlikely(afinfo == NULL))
1865 return -EINVAL;
1866 if (unlikely(afinfo->family >= NPROTO))
1867 return -EAFNOSUPPORT;
f3111502 1868 write_lock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1869 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1870 err = -ENOBUFS;
edcd5821 1871 else
1da177e4 1872 xfrm_state_afinfo[afinfo->family] = afinfo;
f3111502 1873 write_unlock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1874 return err;
1875}
1876EXPORT_SYMBOL(xfrm_state_register_afinfo);
1877
1878int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1879{
1880 int err = 0;
1881 if (unlikely(afinfo == NULL))
1882 return -EINVAL;
1883 if (unlikely(afinfo->family >= NPROTO))
1884 return -EAFNOSUPPORT;
f3111502 1885 write_lock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1886 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1887 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1888 err = -EINVAL;
edcd5821 1889 else
1da177e4 1890 xfrm_state_afinfo[afinfo->family] = NULL;
1da177e4 1891 }
f3111502 1892 write_unlock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1893 return err;
1894}
1895EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1896
17c2a42a 1897static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1da177e4
LT		 1898{
1899 struct xfrm_state_afinfo *afinfo;
1900 if (unlikely(family >= NPROTO))
1901 return NULL;
1902 read_lock(&xfrm_state_afinfo_lock);
1903 afinfo = xfrm_state_afinfo[family];
546be240
HX		 1904 if (unlikely(!afinfo))
1905 read_unlock(&xfrm_state_afinfo_lock);
1da177e4
LT		 1906 return afinfo;
1907}
1908
17c2a42a 1909static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
9a429c49 1910 __releases(xfrm_state_afinfo_lock)
1da177e4 1911{
546be240 1912 read_unlock(&xfrm_state_afinfo_lock);
1da177e4
LT		 1913}
1914
1915/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1916void xfrm_state_delete_tunnel(struct xfrm_state *x)
1917{
1918 if (x->tunnel) {
1919 struct xfrm_state *t = x->tunnel;
1920
1921 if (atomic_read(&t->tunnel_users) == 2)
1922 xfrm_state_delete(t);
1923 atomic_dec(&t->tunnel_users);
1924 xfrm_state_put(t);
1925 x->tunnel = NULL;
1926 }
1927}
1928EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1929
1930int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1931{
c5c25238 1932 int res;
1da177e4 1933
c5c25238
PM		 1934 spin_lock_bh(&x->lock);
1935 if (x->km.state == XFRM_STATE_VALID &&
1936 x->type && x->type->get_mtu)
1937 res = x->type->get_mtu(x, mtu);
1938 else
28121617 1939 res = mtu - x->props.header_len;
c5c25238 1940 spin_unlock_bh(&x->lock);
1da177e4
LT		 1941 return res;
1942}
1943
72cb6962
HX		 1944int xfrm_init_state(struct xfrm_state *x)
1945{
d094cd83
HX		 1946 struct xfrm_state_afinfo *afinfo;
1947 int family = x->props.family;
72cb6962
HX		 1948 int err;
1949
d094cd83
HX		 1950 err = -EAFNOSUPPORT;
1951 afinfo = xfrm_state_get_afinfo(family);
1952 if (!afinfo)
1953 goto error;
1954
1955 err = 0;
1956 if (afinfo->init_flags)
1957 err = afinfo->init_flags(x);
1958
1959 xfrm_state_put_afinfo(afinfo);
1960
1961 if (err)
1962 goto error;
1963
1964 err = -EPROTONOSUPPORT;
13996378
HX		 1965 x->inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
1966 if (x->inner_mode == NULL)
1967 goto error;
1968
1969 if (!(x->inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
1970 family != x->sel.family)
1971 goto error;
1972
d094cd83 1973 x->type = xfrm_get_type(x->id.proto, family);
72cb6962
HX		 1974 if (x->type == NULL)
1975 goto error;
1976
1977 err = x->type->init_state(x);
1978 if (err)
1979 goto error;
1980
13996378
HX		 1981 x->outer_mode = xfrm_get_mode(x->props.mode, family);
1982 if (x->outer_mode == NULL)
b59f45d0
HX		 1983 goto error;
1984
72cb6962
HX		 1985 x->km.state = XFRM_STATE_VALID;
1986
1987error:
1988 return err;
1989}
1990
1991EXPORT_SYMBOL(xfrm_init_state);
a716c119 1992
1da177e4
LT		 1993void __init xfrm_state_init(void)
1994{
f034b5d4
DM		 1995 unsigned int sz;
1996
1997 sz = sizeof(struct hlist_head) * 8;
1998
44e36b42
DM		 1999 xfrm_state_bydst = xfrm_hash_alloc(sz);
2000 xfrm_state_bysrc = xfrm_hash_alloc(sz);
2001 xfrm_state_byspi = xfrm_hash_alloc(sz);
f034b5d4
DM		 2002 if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
2003 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
2004 xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
1da177e4 2005
c4028958 2006 INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
1da177e4
LT		 2007}
2008
ab5f5e8b 2009#ifdef CONFIG_AUDITSYSCALL
cf35f43e
IJ		 2010static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2011 struct audit_buffer *audit_buf)
ab5f5e8b 2012{
68277acc
PM		 2013 struct xfrm_sec_ctx *ctx = x->security;
2014 u32 spi = ntohl(x->id.spi);
2015
2016 if (ctx)
ab5f5e8b 2017 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
68277acc 2018 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
ab5f5e8b
JL		 2019
2020 switch(x->props.family) {
2021 case AF_INET:
68277acc
PM		 2022 audit_log_format(audit_buf,
2023 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
ab5f5e8b
JL		 2024 NIPQUAD(x->props.saddr.a4),
2025 NIPQUAD(x->id.daddr.a4));
2026 break;
2027 case AF_INET6:
68277acc
PM		 2028 audit_log_format(audit_buf,
2029 " src=" NIP6_FMT " dst=" NIP6_FMT,
2030 NIP6(*(struct in6_addr *)x->props.saddr.a6),
2031 NIP6(*(struct in6_addr *)x->id.daddr.a6));
ab5f5e8b
JL		 2032 break;
2033 }
68277acc
PM		 2034
2035 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
ab5f5e8b
JL		 2036}
2037
cf35f43e
IJ		 2038static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2039 struct audit_buffer *audit_buf)
afeb14b4
PM		 2040{
2041 struct iphdr *iph4;
2042 struct ipv6hdr *iph6;
2043
2044 switch (family) {
2045 case AF_INET:
2046 iph4 = ip_hdr(skb);
2047 audit_log_format(audit_buf,
2048 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2049 NIPQUAD(iph4->saddr),
2050 NIPQUAD(iph4->daddr));
2051 break;
2052 case AF_INET6:
2053 iph6 = ipv6_hdr(skb);
2054 audit_log_format(audit_buf,
2055 " src=" NIP6_FMT " dst=" NIP6_FMT
2056 " flowlbl=0x%x%x%x",
2057 NIP6(iph6->saddr),
2058 NIP6(iph6->daddr),
2059 iph6->flow_lbl[0] & 0x0f,
2060 iph6->flow_lbl[1],
2061 iph6->flow_lbl[2]);
2062 break;
2063 }
2064}
2065
68277acc
PM		 2066void xfrm_audit_state_add(struct xfrm_state *x, int result,
2067 u32 auid, u32 secid)
ab5f5e8b
JL		 2068{
2069 struct audit_buffer *audit_buf;
ab5f5e8b 2070
afeb14b4 2071 audit_buf = xfrm_audit_start("SAD-add");
ab5f5e8b
JL		 2072 if (audit_buf == NULL)
2073 return;
afeb14b4
PM		 2074 xfrm_audit_helper_usrinfo(auid, secid, audit_buf);
2075 xfrm_audit_helper_sainfo(x, audit_buf);
2076 audit_log_format(audit_buf, " res=%u", result);
ab5f5e8b
JL		 2077 audit_log_end(audit_buf);
2078}
2079EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2080
68277acc
PM		 2081void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2082 u32 auid, u32 secid)
ab5f5e8b
JL		 2083{
2084 struct audit_buffer *audit_buf;
ab5f5e8b 2085
afeb14b4 2086 audit_buf = xfrm_audit_start("SAD-delete");
ab5f5e8b
JL		 2087 if (audit_buf == NULL)
2088 return;
afeb14b4
PM		 2089 xfrm_audit_helper_usrinfo(auid, secid, audit_buf);
2090 xfrm_audit_helper_sainfo(x, audit_buf);
2091 audit_log_format(audit_buf, " res=%u", result);
ab5f5e8b
JL		 2092 audit_log_end(audit_buf);
2093}
2094EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
afeb14b4
PM		 2095
2096void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2097 struct sk_buff *skb)
2098{
2099 struct audit_buffer *audit_buf;
2100 u32 spi;
2101
2102 audit_buf = xfrm_audit_start("SA-replay-overflow");
2103 if (audit_buf == NULL)
2104 return;
2105 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2106 /* don't record the sequence number because it's inherent in this kind
2107 * of audit message */
2108 spi = ntohl(x->id.spi);
2109 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2110 audit_log_end(audit_buf);
2111}
2112EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2113
2114static void xfrm_audit_state_replay(struct xfrm_state *x,
2115 struct sk_buff *skb, __be32 net_seq)
2116{
2117 struct audit_buffer *audit_buf;
2118 u32 spi;
2119
2120 audit_buf = xfrm_audit_start("SA-replayed-pkt");
2121 if (audit_buf == NULL)
2122 return;
2123 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2124 spi = ntohl(x->id.spi);
2125 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2126 spi, spi, ntohl(net_seq));
2127 audit_log_end(audit_buf);
2128}
2129
2130void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2131{
2132 struct audit_buffer *audit_buf;
2133
2134 audit_buf = xfrm_audit_start("SA-notfound");
2135 if (audit_buf == NULL)
2136 return;
2137 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2138 audit_log_end(audit_buf);
2139}
2140EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2141
2142void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2143 __be32 net_spi, __be32 net_seq)
2144{
2145 struct audit_buffer *audit_buf;
2146 u32 spi;
2147
2148 audit_buf = xfrm_audit_start("SA-notfound");
2149 if (audit_buf == NULL)
2150 return;
2151 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2152 spi = ntohl(net_spi);
2153 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2154 spi, spi, ntohl(net_seq));
2155 audit_log_end(audit_buf);
2156}
2157EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2158
2159void xfrm_audit_state_icvfail(struct xfrm_state *x,
2160 struct sk_buff *skb, u8 proto)
2161{
2162 struct audit_buffer *audit_buf;
2163 __be32 net_spi;
2164 __be32 net_seq;
2165
2166 audit_buf = xfrm_audit_start("SA-icv-failure");
2167 if (audit_buf == NULL)
2168 return;
2169 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2170 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2171 u32 spi = ntohl(net_spi);
2172 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2173 spi, spi, ntohl(net_seq));
2174 }
2175 audit_log_end(audit_buf);
2176}
2177EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
ab5f5e8b 2178#endif /* CONFIG_AUDITSYSCALL */
Ubuntu Artful kernel mirror