]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - net/xfrm/xfrm_state.c
projects / mirror_ubuntu-artful-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
[XFRM]: xfrm audit calls
[mirror_ubuntu-artful-kernel.git] / net / xfrm / xfrm_state.c
1 /*
2 * xfrm_state.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
13 *
14 */
15
16 #include <linux/workqueue.h>
17 #include <net/xfrm.h>
18 #include <linux/pfkeyv2.h>
19 #include <linux/ipsec.h>
20 #include <linux/module.h>
21 #include <linux/cache.h>
22 #include <asm/uaccess.h>
23
24 #include "xfrm_hash.h"
25
26 struct sock *xfrm_nl;
27 EXPORT_SYMBOL(xfrm_nl);
28
29 u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
30 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
31
32 u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
33 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
34
35 u32 sysctl_xfrm_acq_expires __read_mostly = 30;
36
37 /* Each xfrm_state may be linked to two tables:
38
39 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
40 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
41 destination/tunnel endpoint. (output)
42 */
43
44 static DEFINE_SPINLOCK(xfrm_state_lock);
45
46 /* Hash table to find appropriate SA towards given target (endpoint
47 * of tunnel or destination of transport mode) allowed by selector.
48 *
49 * Main use is finding SA after policy selected tunnel or transport mode.
50 * Also, it can be used by ah/esp icmp error handler to find offending SA.
51 */
52 static struct hlist_head *xfrm_state_bydst __read_mostly;
53 static struct hlist_head *xfrm_state_bysrc __read_mostly;
54 static struct hlist_head *xfrm_state_byspi __read_mostly;
55 static unsigned int xfrm_state_hmask __read_mostly;
56 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
57 static unsigned int xfrm_state_num;
58 static unsigned int xfrm_state_genid;
59
60 static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
61 xfrm_address_t *saddr,
62 u32 reqid,
63 unsigned short family)
64 {
65 return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
66 }
67
68 static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
69 xfrm_address_t *saddr,
70 unsigned short family)
71 {
72 return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
73 }
74
75 static inline unsigned int
76 xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
77 {
78 return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
79 }
80
81 static void xfrm_hash_transfer(struct hlist_head *list,
82 struct hlist_head *ndsttable,
83 struct hlist_head *nsrctable,
84 struct hlist_head *nspitable,
85 unsigned int nhashmask)
86 {
87 struct hlist_node *entry, *tmp;
88 struct xfrm_state *x;
89
90 hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
91 unsigned int h;
92
93 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
94 x->props.reqid, x->props.family,
95 nhashmask);
96 hlist_add_head(&x->bydst, ndsttable+h);
97
98 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
99 x->props.family,
100 nhashmask);
101 hlist_add_head(&x->bysrc, nsrctable+h);
102
103 if (x->id.spi) {
104 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
105 x->id.proto, x->props.family,
106 nhashmask);
107 hlist_add_head(&x->byspi, nspitable+h);
108 }
109 }
110 }
111
112 static unsigned long xfrm_hash_new_size(void)
113 {
114 return ((xfrm_state_hmask + 1) << 1) *
115 sizeof(struct hlist_head);
116 }
117
118 static DEFINE_MUTEX(hash_resize_mutex);
119
120 static void xfrm_hash_resize(struct work_struct *__unused)
121 {
122 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
123 unsigned long nsize, osize;
124 unsigned int nhashmask, ohashmask;
125 int i;
126
127 mutex_lock(&hash_resize_mutex);
128
129 nsize = xfrm_hash_new_size();
130 ndst = xfrm_hash_alloc(nsize);
131 if (!ndst)
132 goto out_unlock;
133 nsrc = xfrm_hash_alloc(nsize);
134 if (!nsrc) {
135 xfrm_hash_free(ndst, nsize);
136 goto out_unlock;
137 }
138 nspi = xfrm_hash_alloc(nsize);
139 if (!nspi) {
140 xfrm_hash_free(ndst, nsize);
141 xfrm_hash_free(nsrc, nsize);
142 goto out_unlock;
143 }
144
145 spin_lock_bh(&xfrm_state_lock);
146
147 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
148 for (i = xfrm_state_hmask; i >= 0; i--)
149 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
150 nhashmask);
151
152 odst = xfrm_state_bydst;
153 osrc = xfrm_state_bysrc;
154 ospi = xfrm_state_byspi;
155 ohashmask = xfrm_state_hmask;
156
157 xfrm_state_bydst = ndst;
158 xfrm_state_bysrc = nsrc;
159 xfrm_state_byspi = nspi;
160 xfrm_state_hmask = nhashmask;
161
162 spin_unlock_bh(&xfrm_state_lock);
163
164 osize = (ohashmask + 1) * sizeof(struct hlist_head);
165 xfrm_hash_free(odst, osize);
166 xfrm_hash_free(osrc, osize);
167 xfrm_hash_free(ospi, osize);
168
169 out_unlock:
170 mutex_unlock(&hash_resize_mutex);
171 }
172
173 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
174
175 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
176 EXPORT_SYMBOL(km_waitq);
177
178 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
179 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
180
181 static struct work_struct xfrm_state_gc_work;
182 static HLIST_HEAD(xfrm_state_gc_list);
183 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
184
185 int __xfrm_state_delete(struct xfrm_state *x);
186
187 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
188 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
189
190 static void xfrm_state_gc_destroy(struct xfrm_state *x)
191 {
192 del_timer_sync(&x->timer);
193 del_timer_sync(&x->rtimer);
194 kfree(x->aalg);
195 kfree(x->ealg);
196 kfree(x->calg);
197 kfree(x->encap);
198 kfree(x->coaddr);
199 if (x->mode)
200 xfrm_put_mode(x->mode);
201 if (x->type) {
202 x->type->destructor(x);
203 xfrm_put_type(x->type);
204 }
205 security_xfrm_state_free(x);
206 kfree(x);
207 }
208
209 static void xfrm_state_gc_task(struct work_struct *data)
210 {
211 struct xfrm_state *x;
212 struct hlist_node *entry, *tmp;
213 struct hlist_head gc_list;
214
215 spin_lock_bh(&xfrm_state_gc_lock);
216 gc_list.first = xfrm_state_gc_list.first;
217 INIT_HLIST_HEAD(&xfrm_state_gc_list);
218 spin_unlock_bh(&xfrm_state_gc_lock);
219
220 hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
221 xfrm_state_gc_destroy(x);
222
223 wake_up(&km_waitq);
224 }
225
226 static inline unsigned long make_jiffies(long secs)
227 {
228 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
229 return MAX_SCHEDULE_TIMEOUT-1;
230 else
231 return secs*HZ;
232 }
233
234 static void xfrm_timer_handler(unsigned long data)
235 {
236 struct xfrm_state *x = (struct xfrm_state*)data;
237 unsigned long now = get_seconds();
238 long next = LONG_MAX;
239 int warn = 0;
240 int err = 0;
241
242 spin_lock(&x->lock);
243 if (x->km.state == XFRM_STATE_DEAD)
244 goto out;
245 if (x->km.state == XFRM_STATE_EXPIRED)
246 goto expired;
247 if (x->lft.hard_add_expires_seconds) {
248 long tmo = x->lft.hard_add_expires_seconds +
249 x->curlft.add_time - now;
250 if (tmo <= 0)
251 goto expired;
252 if (tmo < next)
253 next = tmo;
254 }
255 if (x->lft.hard_use_expires_seconds) {
256 long tmo = x->lft.hard_use_expires_seconds +
257 (x->curlft.use_time ? : now) - now;
258 if (tmo <= 0)
259 goto expired;
260 if (tmo < next)
261 next = tmo;
262 }
263 if (x->km.dying)
264 goto resched;
265 if (x->lft.soft_add_expires_seconds) {
266 long tmo = x->lft.soft_add_expires_seconds +
267 x->curlft.add_time - now;
268 if (tmo <= 0)
269 warn = 1;
270 else if (tmo < next)
271 next = tmo;
272 }
273 if (x->lft.soft_use_expires_seconds) {
274 long tmo = x->lft.soft_use_expires_seconds +
275 (x->curlft.use_time ? : now) - now;
276 if (tmo <= 0)
277 warn = 1;
278 else if (tmo < next)
279 next = tmo;
280 }
281
282 x->km.dying = warn;
283 if (warn)
284 km_state_expired(x, 0, 0);
285 resched:
286 if (next != LONG_MAX)
287 mod_timer(&x->timer, jiffies + make_jiffies(next));
288
289 goto out;
290
291 expired:
292 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
293 x->km.state = XFRM_STATE_EXPIRED;
294 wake_up(&km_waitq);
295 next = 2;
296 goto resched;
297 }
298
299 err = __xfrm_state_delete(x);
300 if (!err && x->id.spi)
301 km_state_expired(x, 1, 0);
302
303 xfrm_audit_state_delete(x, err ? 0 : 1,
304 audit_get_loginuid(current->audit_context), 0);
305
306 out:
307 spin_unlock(&x->lock);
308 }
309
310 static void xfrm_replay_timer_handler(unsigned long data);
311
312 struct xfrm_state *xfrm_state_alloc(void)
313 {
314 struct xfrm_state *x;
315
316 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
317
318 if (x) {
319 atomic_set(&x->refcnt, 1);
320 atomic_set(&x->tunnel_users, 0);
321 INIT_HLIST_NODE(&x->bydst);
322 INIT_HLIST_NODE(&x->bysrc);
323 INIT_HLIST_NODE(&x->byspi);
324 init_timer(&x->timer);
325 x->timer.function = xfrm_timer_handler;
326 x->timer.data = (unsigned long)x;
327 init_timer(&x->rtimer);
328 x->rtimer.function = xfrm_replay_timer_handler;
329 x->rtimer.data = (unsigned long)x;
330 x->curlft.add_time = get_seconds();
331 x->lft.soft_byte_limit = XFRM_INF;
332 x->lft.soft_packet_limit = XFRM_INF;
333 x->lft.hard_byte_limit = XFRM_INF;
334 x->lft.hard_packet_limit = XFRM_INF;
335 x->replay_maxage = 0;
336 x->replay_maxdiff = 0;
337 spin_lock_init(&x->lock);
338 }
339 return x;
340 }
341 EXPORT_SYMBOL(xfrm_state_alloc);
342
343 void __xfrm_state_destroy(struct xfrm_state *x)
344 {
345 BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
346
347 spin_lock_bh(&xfrm_state_gc_lock);
348 hlist_add_head(&x->bydst, &xfrm_state_gc_list);
349 spin_unlock_bh(&xfrm_state_gc_lock);
350 schedule_work(&xfrm_state_gc_work);
351 }
352 EXPORT_SYMBOL(__xfrm_state_destroy);
353
354 int __xfrm_state_delete(struct xfrm_state *x)
355 {
356 int err = -ESRCH;
357
358 if (x->km.state != XFRM_STATE_DEAD) {
359 x->km.state = XFRM_STATE_DEAD;
360 spin_lock(&xfrm_state_lock);
361 hlist_del(&x->bydst);
362 hlist_del(&x->bysrc);
363 if (x->id.spi)
364 hlist_del(&x->byspi);
365 xfrm_state_num--;
366 spin_unlock(&xfrm_state_lock);
367
368 /* All xfrm_state objects are created by xfrm_state_alloc.
369 * The xfrm_state_alloc call gives a reference, and that
370 * is what we are dropping here.
371 */
372 __xfrm_state_put(x);
373 err = 0;
374 }
375
376 return err;
377 }
378 EXPORT_SYMBOL(__xfrm_state_delete);
379
380 int xfrm_state_delete(struct xfrm_state *x)
381 {
382 int err;
383
384 spin_lock_bh(&x->lock);
385 err = __xfrm_state_delete(x);
386 spin_unlock_bh(&x->lock);
387
388 return err;
389 }
390 EXPORT_SYMBOL(xfrm_state_delete);
391
392 #ifdef CONFIG_SECURITY_NETWORK_XFRM
393 static inline int
394 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
395 {
396 int i, err = 0;
397
398 for (i = 0; i <= xfrm_state_hmask; i++) {
399 struct hlist_node *entry;
400 struct xfrm_state *x;
401
402 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
403 if (xfrm_id_proto_match(x->id.proto, proto) &&
404 (err = security_xfrm_state_delete(x)) != 0) {
405 xfrm_audit_state_delete(x, 0,
406 audit_info->loginuid,
407 audit_info->secid);
408 return err;
409 }
410 }
411 }
412
413 return err;
414 }
415 #else
416 static inline int
417 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
418 {
419 return 0;
420 }
421 #endif
422
423 int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
424 {
425 int i, err = 0;
426
427 spin_lock_bh(&xfrm_state_lock);
428 err = xfrm_state_flush_secctx_check(proto, audit_info);
429 if (err)
430 goto out;
431
432 for (i = 0; i <= xfrm_state_hmask; i++) {
433 struct hlist_node *entry;
434 struct xfrm_state *x;
435 restart:
436 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
437 if (!xfrm_state_kern(x) &&
438 xfrm_id_proto_match(x->id.proto, proto)) {
439 xfrm_state_hold(x);
440 spin_unlock_bh(&xfrm_state_lock);
441
442 err = xfrm_state_delete(x);
443 xfrm_audit_state_delete(x, err ? 0 : 1,
444 audit_info->loginuid,
445 audit_info->secid);
446 xfrm_state_put(x);
447
448 spin_lock_bh(&xfrm_state_lock);
449 goto restart;
450 }
451 }
452 }
453 err = 0;
454
455 out:
456 spin_unlock_bh(&xfrm_state_lock);
457 wake_up(&km_waitq);
458 return err;
459 }
460 EXPORT_SYMBOL(xfrm_state_flush);
461
462 void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
463 {
464 spin_lock_bh(&xfrm_state_lock);
465 si->sadcnt = xfrm_state_num;
466 si->sadhcnt = xfrm_state_hmask;
467 si->sadhmcnt = xfrm_state_hashmax;
468 spin_unlock_bh(&xfrm_state_lock);
469 }
470 EXPORT_SYMBOL(xfrm_sad_getinfo);
471
472 static int
473 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
474 struct xfrm_tmpl *tmpl,
475 xfrm_address_t *daddr, xfrm_address_t *saddr,
476 unsigned short family)
477 {
478 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
479 if (!afinfo)
480 return -1;
481 afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
482 xfrm_state_put_afinfo(afinfo);
483 return 0;
484 }
485
486 static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
487 {
488 unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
489 struct xfrm_state *x;
490 struct hlist_node *entry;
491
492 hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
493 if (x->props.family != family ||
494 x->id.spi != spi ||
495 x->id.proto != proto)
496 continue;
497
498 switch (family) {
499 case AF_INET:
500 if (x->id.daddr.a4 != daddr->a4)
501 continue;
502 break;
503 case AF_INET6:
504 if (!ipv6_addr_equal((struct in6_addr *)daddr,
505 (struct in6_addr *)
506 x->id.daddr.a6))
507 continue;
508 break;
509 }
510
511 xfrm_state_hold(x);
512 return x;
513 }
514
515 return NULL;
516 }
517
518 static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
519 {
520 unsigned int h = xfrm_src_hash(daddr, saddr, family);
521 struct xfrm_state *x;
522 struct hlist_node *entry;
523
524 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
525 if (x->props.family != family ||
526 x->id.proto != proto)
527 continue;
528
529 switch (family) {
530 case AF_INET:
531 if (x->id.daddr.a4 != daddr->a4 ||
532 x->props.saddr.a4 != saddr->a4)
533 continue;
534 break;
535 case AF_INET6:
536 if (!ipv6_addr_equal((struct in6_addr *)daddr,
537 (struct in6_addr *)
538 x->id.daddr.a6) ||
539 !ipv6_addr_equal((struct in6_addr *)saddr,
540 (struct in6_addr *)
541 x->props.saddr.a6))
542 continue;
543 break;
544 }
545
546 xfrm_state_hold(x);
547 return x;
548 }
549
550 return NULL;
551 }
552
553 static inline struct xfrm_state *
554 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
555 {
556 if (use_spi)
557 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
558 x->id.proto, family);
559 else
560 return __xfrm_state_lookup_byaddr(&x->id.daddr,
561 &x->props.saddr,
562 x->id.proto, family);
563 }
564
565 static void xfrm_hash_grow_check(int have_hash_collision)
566 {
567 if (have_hash_collision &&
568 (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
569 xfrm_state_num > xfrm_state_hmask)
570 schedule_work(&xfrm_hash_work);
571 }
572
573 struct xfrm_state *
574 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
575 struct flowi *fl, struct xfrm_tmpl *tmpl,
576 struct xfrm_policy *pol, int *err,
577 unsigned short family)
578 {
579 unsigned int h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
580 struct hlist_node *entry;
581 struct xfrm_state *x, *x0;
582 int acquire_in_progress = 0;
583 int error = 0;
584 struct xfrm_state *best = NULL;
585
586 spin_lock_bh(&xfrm_state_lock);
587 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
588 if (x->props.family == family &&
589 x->props.reqid == tmpl->reqid &&
590 !(x->props.flags & XFRM_STATE_WILDRECV) &&
591 xfrm_state_addr_check(x, daddr, saddr, family) &&
592 tmpl->mode == x->props.mode &&
593 tmpl->id.proto == x->id.proto &&
594 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
595 /* Resolution logic:
596 1. There is a valid state with matching selector.
597 Done.
598 2. Valid state with inappropriate selector. Skip.
599
600 Entering area of "sysdeps".
601
602 3. If state is not valid, selector is temporary,
603 it selects only session which triggered
604 previous resolution. Key manager will do
605 something to install a state with proper
606 selector.
607 */
608 if (x->km.state == XFRM_STATE_VALID) {
609 if (!xfrm_selector_match(&x->sel, fl, x->sel.family) ||
610 !security_xfrm_state_pol_flow_match(x, pol, fl))
611 continue;
612 if (!best ||
613 best->km.dying > x->km.dying ||
614 (best->km.dying == x->km.dying &&
615 best->curlft.add_time < x->curlft.add_time))
616 best = x;
617 } else if (x->km.state == XFRM_STATE_ACQ) {
618 acquire_in_progress = 1;
619 } else if (x->km.state == XFRM_STATE_ERROR ||
620 x->km.state == XFRM_STATE_EXPIRED) {
621 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
622 security_xfrm_state_pol_flow_match(x, pol, fl))
623 error = -ESRCH;
624 }
625 }
626 }
627
628 x = best;
629 if (!x && !error && !acquire_in_progress) {
630 if (tmpl->id.spi &&
631 (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
632 tmpl->id.proto, family)) != NULL) {
633 xfrm_state_put(x0);
634 error = -EEXIST;
635 goto out;
636 }
637 x = xfrm_state_alloc();
638 if (x == NULL) {
639 error = -ENOMEM;
640 goto out;
641 }
642 /* Initialize temporary selector matching only
643 * to current session. */
644 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
645
646 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
647 if (error) {
648 x->km.state = XFRM_STATE_DEAD;
649 xfrm_state_put(x);
650 x = NULL;
651 goto out;
652 }
653
654 if (km_query(x, tmpl, pol) == 0) {
655 x->km.state = XFRM_STATE_ACQ;
656 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
657 h = xfrm_src_hash(daddr, saddr, family);
658 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
659 if (x->id.spi) {
660 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
661 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
662 }
663 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
664 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
665 add_timer(&x->timer);
666 xfrm_state_num++;
667 xfrm_hash_grow_check(x->bydst.next != NULL);
668 } else {
669 x->km.state = XFRM_STATE_DEAD;
670 xfrm_state_put(x);
671 x = NULL;
672 error = -ESRCH;
673 }
674 }
675 out:
676 if (x)
677 xfrm_state_hold(x);
678 else
679 *err = acquire_in_progress ? -EAGAIN : error;
680 spin_unlock_bh(&xfrm_state_lock);
681 return x;
682 }
683
684 struct xfrm_state *
685 xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
686 unsigned short family, u8 mode, u8 proto, u32 reqid)
687 {
688 unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
689 struct xfrm_state *rx = NULL, *x = NULL;
690 struct hlist_node *entry;
691
692 spin_lock(&xfrm_state_lock);
693 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
694 if (x->props.family == family &&
695 x->props.reqid == reqid &&
696 !(x->props.flags & XFRM_STATE_WILDRECV) &&
697 xfrm_state_addr_check(x, daddr, saddr, family) &&
698 mode == x->props.mode &&
699 proto == x->id.proto &&
700 x->km.state == XFRM_STATE_VALID) {
701 rx = x;
702 break;
703 }
704 }
705
706 if (rx)
707 xfrm_state_hold(rx);
708 spin_unlock(&xfrm_state_lock);
709
710
711 return rx;
712 }
713 EXPORT_SYMBOL(xfrm_stateonly_find);
714
715 static void __xfrm_state_insert(struct xfrm_state *x)
716 {
717 unsigned int h;
718
719 x->genid = ++xfrm_state_genid;
720
721 h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
722 x->props.reqid, x->props.family);
723 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
724
725 h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
726 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
727
728 if (x->id.spi) {
729 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
730 x->props.family);
731
732 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
733 }
734
735 mod_timer(&x->timer, jiffies + HZ);
736 if (x->replay_maxage)
737 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
738
739 wake_up(&km_waitq);
740
741 xfrm_state_num++;
742
743 xfrm_hash_grow_check(x->bydst.next != NULL);
744 }
745
746 /* xfrm_state_lock is held */
747 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
748 {
749 unsigned short family = xnew->props.family;
750 u32 reqid = xnew->props.reqid;
751 struct xfrm_state *x;
752 struct hlist_node *entry;
753 unsigned int h;
754
755 h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
756 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
757 if (x->props.family == family &&
758 x->props.reqid == reqid &&
759 !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
760 !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
761 x->genid = xfrm_state_genid;
762 }
763 }
764
765 void xfrm_state_insert(struct xfrm_state *x)
766 {
767 spin_lock_bh(&xfrm_state_lock);
768 __xfrm_state_bump_genids(x);
769 __xfrm_state_insert(x);
770 spin_unlock_bh(&xfrm_state_lock);
771 }
772 EXPORT_SYMBOL(xfrm_state_insert);
773
774 /* xfrm_state_lock is held */
775 static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
776 {
777 unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
778 struct hlist_node *entry;
779 struct xfrm_state *x;
780
781 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
782 if (x->props.reqid != reqid ||
783 x->props.mode != mode ||
784 x->props.family != family ||
785 x->km.state != XFRM_STATE_ACQ ||
786 x->id.spi != 0 ||
787 x->id.proto != proto)
788 continue;
789
790 switch (family) {
791 case AF_INET:
792 if (x->id.daddr.a4 != daddr->a4 ||
793 x->props.saddr.a4 != saddr->a4)
794 continue;
795 break;
796 case AF_INET6:
797 if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
798 (struct in6_addr *)daddr) ||
799 !ipv6_addr_equal((struct in6_addr *)
800 x->props.saddr.a6,
801 (struct in6_addr *)saddr))
802 continue;
803 break;
804 }
805
806 xfrm_state_hold(x);
807 return x;
808 }
809
810 if (!create)
811 return NULL;
812
813 x = xfrm_state_alloc();
814 if (likely(x)) {
815 switch (family) {
816 case AF_INET:
817 x->sel.daddr.a4 = daddr->a4;
818 x->sel.saddr.a4 = saddr->a4;
819 x->sel.prefixlen_d = 32;
820 x->sel.prefixlen_s = 32;
821 x->props.saddr.a4 = saddr->a4;
822 x->id.daddr.a4 = daddr->a4;
823 break;
824
825 case AF_INET6:
826 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
827 (struct in6_addr *)daddr);
828 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
829 (struct in6_addr *)saddr);
830 x->sel.prefixlen_d = 128;
831 x->sel.prefixlen_s = 128;
832 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
833 (struct in6_addr *)saddr);
834 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
835 (struct in6_addr *)daddr);
836 break;
837 }
838
839 x->km.state = XFRM_STATE_ACQ;
840 x->id.proto = proto;
841 x->props.family = family;
842 x->props.mode = mode;
843 x->props.reqid = reqid;
844 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
845 xfrm_state_hold(x);
846 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
847 add_timer(&x->timer);
848 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
849 h = xfrm_src_hash(daddr, saddr, family);
850 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
851 wake_up(&km_waitq);
852
853 xfrm_state_num++;
854
855 xfrm_hash_grow_check(x->bydst.next != NULL);
856 }
857
858 return x;
859 }
860
861 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
862
863 int xfrm_state_add(struct xfrm_state *x)
864 {
865 struct xfrm_state *x1;
866 int family;
867 int err;
868 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
869
870 family = x->props.family;
871
872 spin_lock_bh(&xfrm_state_lock);
873
874 x1 = __xfrm_state_locate(x, use_spi, family);
875 if (x1) {
876 xfrm_state_put(x1);
877 x1 = NULL;
878 err = -EEXIST;
879 goto out;
880 }
881
882 if (use_spi && x->km.seq) {
883 x1 = __xfrm_find_acq_byseq(x->km.seq);
884 if (x1 && ((x1->id.proto != x->id.proto) ||
885 xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
886 xfrm_state_put(x1);
887 x1 = NULL;
888 }
889 }
890
891 if (use_spi && !x1)
892 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
893 x->id.proto,
894 &x->id.daddr, &x->props.saddr, 0);
895
896 __xfrm_state_bump_genids(x);
897 __xfrm_state_insert(x);
898 err = 0;
899
900 out:
901 spin_unlock_bh(&xfrm_state_lock);
902
903 if (x1) {
904 xfrm_state_delete(x1);
905 xfrm_state_put(x1);
906 }
907
908 return err;
909 }
910 EXPORT_SYMBOL(xfrm_state_add);
911
912 #ifdef CONFIG_XFRM_MIGRATE
913 struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
914 {
915 int err = -ENOMEM;
916 struct xfrm_state *x = xfrm_state_alloc();
917 if (!x)
918 goto error;
919
920 memcpy(&x->id, &orig->id, sizeof(x->id));
921 memcpy(&x->sel, &orig->sel, sizeof(x->sel));
922 memcpy(&x->lft, &orig->lft, sizeof(x->lft));
923 x->props.mode = orig->props.mode;
924 x->props.replay_window = orig->props.replay_window;
925 x->props.reqid = orig->props.reqid;
926 x->props.family = orig->props.family;
927 x->props.saddr = orig->props.saddr;
928
929 if (orig->aalg) {
930 x->aalg = xfrm_algo_clone(orig->aalg);
931 if (!x->aalg)
932 goto error;
933 }
934 x->props.aalgo = orig->props.aalgo;
935
936 if (orig->ealg) {
937 x->ealg = xfrm_algo_clone(orig->ealg);
938 if (!x->ealg)
939 goto error;
940 }
941 x->props.ealgo = orig->props.ealgo;
942
943 if (orig->calg) {
944 x->calg = xfrm_algo_clone(orig->calg);
945 if (!x->calg)
946 goto error;
947 }
948 x->props.calgo = orig->props.calgo;
949
950 if (orig->encap) {
951 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
952 if (!x->encap)
953 goto error;
954 }
955
956 if (orig->coaddr) {
957 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
958 GFP_KERNEL);
959 if (!x->coaddr)
960 goto error;
961 }
962
963 err = xfrm_init_state(x);
964 if (err)
965 goto error;
966
967 x->props.flags = orig->props.flags;
968
969 x->curlft.add_time = orig->curlft.add_time;
970 x->km.state = orig->km.state;
971 x->km.seq = orig->km.seq;
972
973 return x;
974
975 error:
976 if (errp)
977 *errp = err;
978 if (x) {
979 kfree(x->aalg);
980 kfree(x->ealg);
981 kfree(x->calg);
982 kfree(x->encap);
983 kfree(x->coaddr);
984 }
985 kfree(x);
986 return NULL;
987 }
988 EXPORT_SYMBOL(xfrm_state_clone);
989
990 /* xfrm_state_lock is held */
991 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
992 {
993 unsigned int h;
994 struct xfrm_state *x;
995 struct hlist_node *entry;
996
997 if (m->reqid) {
998 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
999 m->reqid, m->old_family);
1000 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1001 if (x->props.mode != m->mode ||
1002 x->id.proto != m->proto)
1003 continue;
1004 if (m->reqid && x->props.reqid != m->reqid)
1005 continue;
1006 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1007 m->old_family) ||
1008 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1009 m->old_family))
1010 continue;
1011 xfrm_state_hold(x);
1012 return x;
1013 }
1014 } else {
1015 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1016 m->old_family);
1017 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1018 if (x->props.mode != m->mode ||
1019 x->id.proto != m->proto)
1020 continue;
1021 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1022 m->old_family) ||
1023 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1024 m->old_family))
1025 continue;
1026 xfrm_state_hold(x);
1027 return x;
1028 }
1029 }
1030
1031 return NULL;
1032 }
1033 EXPORT_SYMBOL(xfrm_migrate_state_find);
1034
1035 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1036 struct xfrm_migrate *m)
1037 {
1038 struct xfrm_state *xc;
1039 int err;
1040
1041 xc = xfrm_state_clone(x, &err);
1042 if (!xc)
1043 return NULL;
1044
1045 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1046 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1047
1048 /* add state */
1049 if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1050 /* a care is needed when the destination address of the
1051 state is to be updated as it is a part of triplet */
1052 xfrm_state_insert(xc);
1053 } else {
1054 if ((err = xfrm_state_add(xc)) < 0)
1055 goto error;
1056 }
1057
1058 return xc;
1059 error:
1060 kfree(xc);
1061 return NULL;
1062 }
1063 EXPORT_SYMBOL(xfrm_state_migrate);
1064 #endif
1065
1066 int xfrm_state_update(struct xfrm_state *x)
1067 {
1068 struct xfrm_state *x1;
1069 int err;
1070 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1071
1072 spin_lock_bh(&xfrm_state_lock);
1073 x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1074
1075 err = -ESRCH;
1076 if (!x1)
1077 goto out;
1078
1079 if (xfrm_state_kern(x1)) {
1080 xfrm_state_put(x1);
1081 err = -EEXIST;
1082 goto out;
1083 }
1084
1085 if (x1->km.state == XFRM_STATE_ACQ) {
1086 __xfrm_state_insert(x);
1087 x = NULL;
1088 }
1089 err = 0;
1090
1091 out:
1092 spin_unlock_bh(&xfrm_state_lock);
1093
1094 if (err)
1095 return err;
1096
1097 if (!x) {
1098 xfrm_state_delete(x1);
1099 xfrm_state_put(x1);
1100 return 0;
1101 }
1102
1103 err = -EINVAL;
1104 spin_lock_bh(&x1->lock);
1105 if (likely(x1->km.state == XFRM_STATE_VALID)) {
1106 if (x->encap && x1->encap)
1107 memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1108 if (x->coaddr && x1->coaddr) {
1109 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1110 }
1111 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1112 memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1113 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1114 x1->km.dying = 0;
1115
1116 mod_timer(&x1->timer, jiffies + HZ);
1117 if (x1->curlft.use_time)
1118 xfrm_state_check_expire(x1);
1119
1120 err = 0;
1121 }
1122 spin_unlock_bh(&x1->lock);
1123
1124 xfrm_state_put(x1);
1125
1126 return err;
1127 }
1128 EXPORT_SYMBOL(xfrm_state_update);
1129
1130 int xfrm_state_check_expire(struct xfrm_state *x)
1131 {
1132 if (!x->curlft.use_time)
1133 x->curlft.use_time = get_seconds();
1134
1135 if (x->km.state != XFRM_STATE_VALID)
1136 return -EINVAL;
1137
1138 if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1139 x->curlft.packets >= x->lft.hard_packet_limit) {
1140 x->km.state = XFRM_STATE_EXPIRED;
1141 mod_timer(&x->timer, jiffies);
1142 return -EINVAL;
1143 }
1144
1145 if (!x->km.dying &&
1146 (x->curlft.bytes >= x->lft.soft_byte_limit ||
1147 x->curlft.packets >= x->lft.soft_packet_limit)) {
1148 x->km.dying = 1;
1149 km_state_expired(x, 0, 0);
1150 }
1151 return 0;
1152 }
1153 EXPORT_SYMBOL(xfrm_state_check_expire);
1154
1155 static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
1156 {
1157 int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
1158 - skb_headroom(skb);
1159
1160 if (nhead > 0)
1161 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
1162
1163 /* Check tail too... */
1164 return 0;
1165 }
1166
1167 int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
1168 {
1169 int err = xfrm_state_check_expire(x);
1170 if (err < 0)
1171 goto err;
1172 err = xfrm_state_check_space(x, skb);
1173 err:
1174 return err;
1175 }
1176 EXPORT_SYMBOL(xfrm_state_check);
1177
1178 struct xfrm_state *
1179 xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1180 unsigned short family)
1181 {
1182 struct xfrm_state *x;
1183
1184 spin_lock_bh(&xfrm_state_lock);
1185 x = __xfrm_state_lookup(daddr, spi, proto, family);
1186 spin_unlock_bh(&xfrm_state_lock);
1187 return x;
1188 }
1189 EXPORT_SYMBOL(xfrm_state_lookup);
1190
1191 struct xfrm_state *
1192 xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1193 u8 proto, unsigned short family)
1194 {
1195 struct xfrm_state *x;
1196
1197 spin_lock_bh(&xfrm_state_lock);
1198 x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
1199 spin_unlock_bh(&xfrm_state_lock);
1200 return x;
1201 }
1202 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1203
1204 struct xfrm_state *
1205 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1206 xfrm_address_t *daddr, xfrm_address_t *saddr,
1207 int create, unsigned short family)
1208 {
1209 struct xfrm_state *x;
1210
1211 spin_lock_bh(&xfrm_state_lock);
1212 x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1213 spin_unlock_bh(&xfrm_state_lock);
1214
1215 return x;
1216 }
1217 EXPORT_SYMBOL(xfrm_find_acq);
1218
1219 #ifdef CONFIG_XFRM_SUB_POLICY
1220 int
1221 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1222 unsigned short family)
1223 {
1224 int err = 0;
1225 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1226 if (!afinfo)
1227 return -EAFNOSUPPORT;
1228
1229 spin_lock_bh(&xfrm_state_lock);
1230 if (afinfo->tmpl_sort)
1231 err = afinfo->tmpl_sort(dst, src, n);
1232 spin_unlock_bh(&xfrm_state_lock);
1233 xfrm_state_put_afinfo(afinfo);
1234 return err;
1235 }
1236 EXPORT_SYMBOL(xfrm_tmpl_sort);
1237
1238 int
1239 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1240 unsigned short family)
1241 {
1242 int err = 0;
1243 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1244 if (!afinfo)
1245 return -EAFNOSUPPORT;
1246
1247 spin_lock_bh(&xfrm_state_lock);
1248 if (afinfo->state_sort)
1249 err = afinfo->state_sort(dst, src, n);
1250 spin_unlock_bh(&xfrm_state_lock);
1251 xfrm_state_put_afinfo(afinfo);
1252 return err;
1253 }
1254 EXPORT_SYMBOL(xfrm_state_sort);
1255 #endif
1256
1257 /* Silly enough, but I'm lazy to build resolution list */
1258
1259 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1260 {
1261 int i;
1262
1263 for (i = 0; i <= xfrm_state_hmask; i++) {
1264 struct hlist_node *entry;
1265 struct xfrm_state *x;
1266
1267 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1268 if (x->km.seq == seq &&
1269 x->km.state == XFRM_STATE_ACQ) {
1270 xfrm_state_hold(x);
1271 return x;
1272 }
1273 }
1274 }
1275 return NULL;
1276 }
1277
1278 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1279 {
1280 struct xfrm_state *x;
1281
1282 spin_lock_bh(&xfrm_state_lock);
1283 x = __xfrm_find_acq_byseq(seq);
1284 spin_unlock_bh(&xfrm_state_lock);
1285 return x;
1286 }
1287 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1288
1289 u32 xfrm_get_acqseq(void)
1290 {
1291 u32 res;
1292 static u32 acqseq;
1293 static DEFINE_SPINLOCK(acqseq_lock);
1294
1295 spin_lock_bh(&acqseq_lock);
1296 res = (++acqseq ? : ++acqseq);
1297 spin_unlock_bh(&acqseq_lock);
1298 return res;
1299 }
1300 EXPORT_SYMBOL(xfrm_get_acqseq);
1301
1302 void
1303 xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi)
1304 {
1305 unsigned int h;
1306 struct xfrm_state *x0;
1307
1308 if (x->id.spi)
1309 return;
1310
1311 if (minspi == maxspi) {
1312 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1313 if (x0) {
1314 xfrm_state_put(x0);
1315 return;
1316 }
1317 x->id.spi = minspi;
1318 } else {
1319 u32 spi = 0;
1320 u32 low = ntohl(minspi);
1321 u32 high = ntohl(maxspi);
1322 for (h=0; h<high-low+1; h++) {
1323 spi = low + net_random()%(high-low+1);
1324 x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1325 if (x0 == NULL) {
1326 x->id.spi = htonl(spi);
1327 break;
1328 }
1329 xfrm_state_put(x0);
1330 }
1331 }
1332 if (x->id.spi) {
1333 spin_lock_bh(&xfrm_state_lock);
1334 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1335 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1336 spin_unlock_bh(&xfrm_state_lock);
1337 wake_up(&km_waitq);
1338 }
1339 }
1340 EXPORT_SYMBOL(xfrm_alloc_spi);
1341
1342 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
1343 void *data)
1344 {
1345 int i;
1346 struct xfrm_state *x, *last = NULL;
1347 struct hlist_node *entry;
1348 int count = 0;
1349 int err = 0;
1350
1351 spin_lock_bh(&xfrm_state_lock);
1352 for (i = 0; i <= xfrm_state_hmask; i++) {
1353 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1354 if (!xfrm_id_proto_match(x->id.proto, proto))
1355 continue;
1356 if (last) {
1357 err = func(last, count, data);
1358 if (err)
1359 goto out;
1360 }
1361 last = x;
1362 count++;
1363 }
1364 }
1365 if (count == 0) {
1366 err = -ENOENT;
1367 goto out;
1368 }
1369 err = func(last, 0, data);
1370 out:
1371 spin_unlock_bh(&xfrm_state_lock);
1372 return err;
1373 }
1374 EXPORT_SYMBOL(xfrm_state_walk);
1375
1376
1377 void xfrm_replay_notify(struct xfrm_state *x, int event)
1378 {
1379 struct km_event c;
1380 /* we send notify messages in case
1381 * 1. we updated on of the sequence numbers, and the seqno difference
1382 * is at least x->replay_maxdiff, in this case we also update the
1383 * timeout of our timer function
1384 * 2. if x->replay_maxage has elapsed since last update,
1385 * and there were changes
1386 *
1387 * The state structure must be locked!
1388 */
1389
1390 switch (event) {
1391 case XFRM_REPLAY_UPDATE:
1392 if (x->replay_maxdiff &&
1393 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1394 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1395 if (x->xflags & XFRM_TIME_DEFER)
1396 event = XFRM_REPLAY_TIMEOUT;
1397 else
1398 return;
1399 }
1400
1401 break;
1402
1403 case XFRM_REPLAY_TIMEOUT:
1404 if ((x->replay.seq == x->preplay.seq) &&
1405 (x->replay.bitmap == x->preplay.bitmap) &&
1406 (x->replay.oseq == x->preplay.oseq)) {
1407 x->xflags |= XFRM_TIME_DEFER;
1408 return;
1409 }
1410
1411 break;
1412 }
1413
1414 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1415 c.event = XFRM_MSG_NEWAE;
1416 c.data.aevent = event;
1417 km_state_notify(x, &c);
1418
1419 if (x->replay_maxage &&
1420 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1421 x->xflags &= ~XFRM_TIME_DEFER;
1422 }
1423 EXPORT_SYMBOL(xfrm_replay_notify);
1424
1425 static void xfrm_replay_timer_handler(unsigned long data)
1426 {
1427 struct xfrm_state *x = (struct xfrm_state*)data;
1428
1429 spin_lock(&x->lock);
1430
1431 if (x->km.state == XFRM_STATE_VALID) {
1432 if (xfrm_aevent_is_on())
1433 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1434 else
1435 x->xflags |= XFRM_TIME_DEFER;
1436 }
1437
1438 spin_unlock(&x->lock);
1439 }
1440
1441 int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
1442 {
1443 u32 diff;
1444 u32 seq = ntohl(net_seq);
1445
1446 if (unlikely(seq == 0))
1447 return -EINVAL;
1448
1449 if (likely(seq > x->replay.seq))
1450 return 0;
1451
1452 diff = x->replay.seq - seq;
1453 if (diff >= min_t(unsigned int, x->props.replay_window,
1454 sizeof(x->replay.bitmap) * 8)) {
1455 x->stats.replay_window++;
1456 return -EINVAL;
1457 }
1458
1459 if (x->replay.bitmap & (1U << diff)) {
1460 x->stats.replay++;
1461 return -EINVAL;
1462 }
1463 return 0;
1464 }
1465 EXPORT_SYMBOL(xfrm_replay_check);
1466
1467 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1468 {
1469 u32 diff;
1470 u32 seq = ntohl(net_seq);
1471
1472 if (seq > x->replay.seq) {
1473 diff = seq - x->replay.seq;
1474 if (diff < x->props.replay_window)
1475 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1476 else
1477 x->replay.bitmap = 1;
1478 x->replay.seq = seq;
1479 } else {
1480 diff = x->replay.seq - seq;
1481 x->replay.bitmap |= (1U << diff);
1482 }
1483
1484 if (xfrm_aevent_is_on())
1485 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1486 }
1487 EXPORT_SYMBOL(xfrm_replay_advance);
1488
1489 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
1490 static DEFINE_RWLOCK(xfrm_km_lock);
1491
1492 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1493 {
1494 struct xfrm_mgr *km;
1495
1496 read_lock(&xfrm_km_lock);
1497 list_for_each_entry(km, &xfrm_km_list, list)
1498 if (km->notify_policy)
1499 km->notify_policy(xp, dir, c);
1500 read_unlock(&xfrm_km_lock);
1501 }
1502
1503 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1504 {
1505 struct xfrm_mgr *km;
1506 read_lock(&xfrm_km_lock);
1507 list_for_each_entry(km, &xfrm_km_list, list)
1508 if (km->notify)
1509 km->notify(x, c);
1510 read_unlock(&xfrm_km_lock);
1511 }
1512
1513 EXPORT_SYMBOL(km_policy_notify);
1514 EXPORT_SYMBOL(km_state_notify);
1515
1516 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1517 {
1518 struct km_event c;
1519
1520 c.data.hard = hard;
1521 c.pid = pid;
1522 c.event = XFRM_MSG_EXPIRE;
1523 km_state_notify(x, &c);
1524
1525 if (hard)
1526 wake_up(&km_waitq);
1527 }
1528
1529 EXPORT_SYMBOL(km_state_expired);
1530 /*
1531 * We send to all registered managers regardless of failure
1532 * We are happy with one success
1533 */
1534 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1535 {
1536 int err = -EINVAL, acqret;
1537 struct xfrm_mgr *km;
1538
1539 read_lock(&xfrm_km_lock);
1540 list_for_each_entry(km, &xfrm_km_list, list) {
1541 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1542 if (!acqret)
1543 err = acqret;
1544 }
1545 read_unlock(&xfrm_km_lock);
1546 return err;
1547 }
1548 EXPORT_SYMBOL(km_query);
1549
1550 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1551 {
1552 int err = -EINVAL;
1553 struct xfrm_mgr *km;
1554
1555 read_lock(&xfrm_km_lock);
1556 list_for_each_entry(km, &xfrm_km_list, list) {
1557 if (km->new_mapping)
1558 err = km->new_mapping(x, ipaddr, sport);
1559 if (!err)
1560 break;
1561 }
1562 read_unlock(&xfrm_km_lock);
1563 return err;
1564 }
1565 EXPORT_SYMBOL(km_new_mapping);
1566
1567 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1568 {
1569 struct km_event c;
1570
1571 c.data.hard = hard;
1572 c.pid = pid;
1573 c.event = XFRM_MSG_POLEXPIRE;
1574 km_policy_notify(pol, dir, &c);
1575
1576 if (hard)
1577 wake_up(&km_waitq);
1578 }
1579 EXPORT_SYMBOL(km_policy_expired);
1580
1581 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1582 struct xfrm_migrate *m, int num_migrate)
1583 {
1584 int err = -EINVAL;
1585 int ret;
1586 struct xfrm_mgr *km;
1587
1588 read_lock(&xfrm_km_lock);
1589 list_for_each_entry(km, &xfrm_km_list, list) {
1590 if (km->migrate) {
1591 ret = km->migrate(sel, dir, type, m, num_migrate);
1592 if (!ret)
1593 err = ret;
1594 }
1595 }
1596 read_unlock(&xfrm_km_lock);
1597 return err;
1598 }
1599 EXPORT_SYMBOL(km_migrate);
1600
1601 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1602 {
1603 int err = -EINVAL;
1604 int ret;
1605 struct xfrm_mgr *km;
1606
1607 read_lock(&xfrm_km_lock);
1608 list_for_each_entry(km, &xfrm_km_list, list) {
1609 if (km->report) {
1610 ret = km->report(proto, sel, addr);
1611 if (!ret)
1612 err = ret;
1613 }
1614 }
1615 read_unlock(&xfrm_km_lock);
1616 return err;
1617 }
1618 EXPORT_SYMBOL(km_report);
1619
1620 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1621 {
1622 int err;
1623 u8 *data;
1624 struct xfrm_mgr *km;
1625 struct xfrm_policy *pol = NULL;
1626
1627 if (optlen <= 0 || optlen > PAGE_SIZE)
1628 return -EMSGSIZE;
1629
1630 data = kmalloc(optlen, GFP_KERNEL);
1631 if (!data)
1632 return -ENOMEM;
1633
1634 err = -EFAULT;
1635 if (copy_from_user(data, optval, optlen))
1636 goto out;
1637
1638 err = -EINVAL;
1639 read_lock(&xfrm_km_lock);
1640 list_for_each_entry(km, &xfrm_km_list, list) {
1641 pol = km->compile_policy(sk, optname, data,
1642 optlen, &err);
1643 if (err >= 0)
1644 break;
1645 }
1646 read_unlock(&xfrm_km_lock);
1647
1648 if (err >= 0) {
1649 xfrm_sk_policy_insert(sk, err, pol);
1650 xfrm_pol_put(pol);
1651 err = 0;
1652 }
1653
1654 out:
1655 kfree(data);
1656 return err;
1657 }
1658 EXPORT_SYMBOL(xfrm_user_policy);
1659
1660 int xfrm_register_km(struct xfrm_mgr *km)
1661 {
1662 write_lock_bh(&xfrm_km_lock);
1663 list_add_tail(&km->list, &xfrm_km_list);
1664 write_unlock_bh(&xfrm_km_lock);
1665 return 0;
1666 }
1667 EXPORT_SYMBOL(xfrm_register_km);
1668
1669 int xfrm_unregister_km(struct xfrm_mgr *km)
1670 {
1671 write_lock_bh(&xfrm_km_lock);
1672 list_del(&km->list);
1673 write_unlock_bh(&xfrm_km_lock);
1674 return 0;
1675 }
1676 EXPORT_SYMBOL(xfrm_unregister_km);
1677
1678 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1679 {
1680 int err = 0;
1681 if (unlikely(afinfo == NULL))
1682 return -EINVAL;
1683 if (unlikely(afinfo->family >= NPROTO))
1684 return -EAFNOSUPPORT;
1685 write_lock_bh(&xfrm_state_afinfo_lock);
1686 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1687 err = -ENOBUFS;
1688 else
1689 xfrm_state_afinfo[afinfo->family] = afinfo;
1690 write_unlock_bh(&xfrm_state_afinfo_lock);
1691 return err;
1692 }
1693 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1694
1695 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1696 {
1697 int err = 0;
1698 if (unlikely(afinfo == NULL))
1699 return -EINVAL;
1700 if (unlikely(afinfo->family >= NPROTO))
1701 return -EAFNOSUPPORT;
1702 write_lock_bh(&xfrm_state_afinfo_lock);
1703 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1704 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1705 err = -EINVAL;
1706 else
1707 xfrm_state_afinfo[afinfo->family] = NULL;
1708 }
1709 write_unlock_bh(&xfrm_state_afinfo_lock);
1710 return err;
1711 }
1712 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1713
1714 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
1715 {
1716 struct xfrm_state_afinfo *afinfo;
1717 if (unlikely(family >= NPROTO))
1718 return NULL;
1719 read_lock(&xfrm_state_afinfo_lock);
1720 afinfo = xfrm_state_afinfo[family];
1721 if (unlikely(!afinfo))
1722 read_unlock(&xfrm_state_afinfo_lock);
1723 return afinfo;
1724 }
1725
1726 void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1727 {
1728 read_unlock(&xfrm_state_afinfo_lock);
1729 }
1730
1731 EXPORT_SYMBOL(xfrm_state_get_afinfo);
1732 EXPORT_SYMBOL(xfrm_state_put_afinfo);
1733
1734 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1735 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1736 {
1737 if (x->tunnel) {
1738 struct xfrm_state *t = x->tunnel;
1739
1740 if (atomic_read(&t->tunnel_users) == 2)
1741 xfrm_state_delete(t);
1742 atomic_dec(&t->tunnel_users);
1743 xfrm_state_put(t);
1744 x->tunnel = NULL;
1745 }
1746 }
1747 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1748
1749 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1750 {
1751 int res;
1752
1753 spin_lock_bh(&x->lock);
1754 if (x->km.state == XFRM_STATE_VALID &&
1755 x->type && x->type->get_mtu)
1756 res = x->type->get_mtu(x, mtu);
1757 else
1758 res = mtu - x->props.header_len;
1759 spin_unlock_bh(&x->lock);
1760 return res;
1761 }
1762
1763 int xfrm_init_state(struct xfrm_state *x)
1764 {
1765 struct xfrm_state_afinfo *afinfo;
1766 int family = x->props.family;
1767 int err;
1768
1769 err = -EAFNOSUPPORT;
1770 afinfo = xfrm_state_get_afinfo(family);
1771 if (!afinfo)
1772 goto error;
1773
1774 err = 0;
1775 if (afinfo->init_flags)
1776 err = afinfo->init_flags(x);
1777
1778 xfrm_state_put_afinfo(afinfo);
1779
1780 if (err)
1781 goto error;
1782
1783 err = -EPROTONOSUPPORT;
1784 x->type = xfrm_get_type(x->id.proto, family);
1785 if (x->type == NULL)
1786 goto error;
1787
1788 err = x->type->init_state(x);
1789 if (err)
1790 goto error;
1791
1792 x->mode = xfrm_get_mode(x->props.mode, family);
1793 if (x->mode == NULL)
1794 goto error;
1795
1796 x->km.state = XFRM_STATE_VALID;
1797
1798 error:
1799 return err;
1800 }
1801
1802 EXPORT_SYMBOL(xfrm_init_state);
1803
1804 void __init xfrm_state_init(void)
1805 {
1806 unsigned int sz;
1807
1808 sz = sizeof(struct hlist_head) * 8;
1809
1810 xfrm_state_bydst = xfrm_hash_alloc(sz);
1811 xfrm_state_bysrc = xfrm_hash_alloc(sz);
1812 xfrm_state_byspi = xfrm_hash_alloc(sz);
1813 if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
1814 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
1815 xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
1816
1817 INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
1818 }
1819
1820 #ifdef CONFIG_AUDITSYSCALL
1821 static inline void xfrm_audit_common_stateinfo(struct xfrm_state *x,
1822 struct audit_buffer *audit_buf)
1823 {
1824 if (x->security)
1825 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
1826 x->security->ctx_alg, x->security->ctx_doi,
1827 x->security->ctx_str);
1828
1829 switch(x->props.family) {
1830 case AF_INET:
1831 audit_log_format(audit_buf, " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
1832 NIPQUAD(x->props.saddr.a4),
1833 NIPQUAD(x->id.daddr.a4));
1834 break;
1835 case AF_INET6:
1836 {
1837 struct in6_addr saddr6, daddr6;
1838
1839 memcpy(&saddr6, x->props.saddr.a6,
1840 sizeof(struct in6_addr));
1841 memcpy(&daddr6, x->id.daddr.a6,
1842 sizeof(struct in6_addr));
1843 audit_log_format(audit_buf,
1844 " src=" NIP6_FMT " dst=" NIP6_FMT,
1845 NIP6(saddr6), NIP6(daddr6));
1846 }
1847 break;
1848 }
1849 }
1850
1851 void
1852 xfrm_audit_state_add(struct xfrm_state *x, int result, u32 auid, u32 sid)
1853 {
1854 struct audit_buffer *audit_buf;
1855 extern int audit_enabled;
1856
1857 if (audit_enabled == 0)
1858 return;
1859 audit_buf = xfrm_audit_start(sid, auid);
1860 if (audit_buf == NULL)
1861 return;
1862 audit_log_format(audit_buf, " op=SAD-add res=%u",result);
1863 xfrm_audit_common_stateinfo(x, audit_buf);
1864 audit_log_format(audit_buf, " spi=%lu(0x%lx)",
1865 (unsigned long)x->id.spi, (unsigned long)x->id.spi);
1866 audit_log_end(audit_buf);
1867 }
1868 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
1869
1870 void
1871 xfrm_audit_state_delete(struct xfrm_state *x, int result, u32 auid, u32 sid)
1872 {
1873 struct audit_buffer *audit_buf;
1874 extern int audit_enabled;
1875
1876 if (audit_enabled == 0)
1877 return;
1878 audit_buf = xfrm_audit_start(sid, auid);
1879 if (audit_buf == NULL)
1880 return;
1881 audit_log_format(audit_buf, " op=SAD-delete res=%u",result);
1882 xfrm_audit_common_stateinfo(x, audit_buf);
1883 audit_log_format(audit_buf, " spi=%lu(0x%lx)",
1884 (unsigned long)x->id.spi, (unsigned long)x->id.spi);
1885 audit_log_end(audit_buf);
1886 }
1887 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
1888 #endif /* CONFIG_AUDITSYSCALL */
Ubuntu Artful kernel mirror