6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
16 #include <linux/workqueue.h>
18 #include <linux/pfkeyv2.h>
19 #include <linux/ipsec.h>
20 #include <linux/module.h>
21 #include <linux/cache.h>
22 #include <linux/audit.h>
23 #include <asm/uaccess.h>
25 #include "xfrm_hash.h"
28 EXPORT_SYMBOL(xfrm_nl
);
30 u32 sysctl_xfrm_aevent_etime __read_mostly
= XFRM_AE_ETIME
;
31 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime
);
33 u32 sysctl_xfrm_aevent_rseqth __read_mostly
= XFRM_AE_SEQT_SIZE
;
34 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth
);
36 u32 sysctl_xfrm_acq_expires __read_mostly
= 30;
38 /* Each xfrm_state may be linked to two tables:
40 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
41 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
42 destination/tunnel endpoint. (output)
45 static DEFINE_SPINLOCK(xfrm_state_lock
);
47 static unsigned int xfrm_state_hmask __read_mostly
;
48 static unsigned int xfrm_state_hashmax __read_mostly
= 1 * 1024 * 1024;
49 static unsigned int xfrm_state_num
;
50 static unsigned int xfrm_state_genid
;
52 static struct xfrm_state_afinfo
*xfrm_state_get_afinfo(unsigned int family
);
53 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo
*afinfo
);
55 #ifdef CONFIG_AUDITSYSCALL
56 static void xfrm_audit_state_replay(struct xfrm_state
*x
,
57 struct sk_buff
*skb
, __be32 net_seq
);
59 #define xfrm_audit_state_replay(x, s, sq) do { ; } while (0)
60 #endif /* CONFIG_AUDITSYSCALL */
62 static inline unsigned int xfrm_dst_hash(xfrm_address_t
*daddr
,
63 xfrm_address_t
*saddr
,
65 unsigned short family
)
67 return __xfrm_dst_hash(daddr
, saddr
, reqid
, family
, xfrm_state_hmask
);
70 static inline unsigned int xfrm_src_hash(xfrm_address_t
*daddr
,
71 xfrm_address_t
*saddr
,
72 unsigned short family
)
74 return __xfrm_src_hash(daddr
, saddr
, family
, xfrm_state_hmask
);
77 static inline unsigned int
78 xfrm_spi_hash(xfrm_address_t
*daddr
, __be32 spi
, u8 proto
, unsigned short family
)
80 return __xfrm_spi_hash(daddr
, spi
, proto
, family
, xfrm_state_hmask
);
83 static void xfrm_hash_transfer(struct hlist_head
*list
,
84 struct hlist_head
*ndsttable
,
85 struct hlist_head
*nsrctable
,
86 struct hlist_head
*nspitable
,
87 unsigned int nhashmask
)
89 struct hlist_node
*entry
, *tmp
;
92 hlist_for_each_entry_safe(x
, entry
, tmp
, list
, bydst
) {
95 h
= __xfrm_dst_hash(&x
->id
.daddr
, &x
->props
.saddr
,
96 x
->props
.reqid
, x
->props
.family
,
98 hlist_add_head(&x
->bydst
, ndsttable
+h
);
100 h
= __xfrm_src_hash(&x
->id
.daddr
, &x
->props
.saddr
,
103 hlist_add_head(&x
->bysrc
, nsrctable
+h
);
106 h
= __xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
,
107 x
->id
.proto
, x
->props
.family
,
109 hlist_add_head(&x
->byspi
, nspitable
+h
);
114 static unsigned long xfrm_hash_new_size(void)
116 return ((xfrm_state_hmask
+ 1) << 1) *
117 sizeof(struct hlist_head
);
120 static DEFINE_MUTEX(hash_resize_mutex
);
122 static void xfrm_hash_resize(struct work_struct
*__unused
)
124 struct hlist_head
*ndst
, *nsrc
, *nspi
, *odst
, *osrc
, *ospi
;
125 unsigned long nsize
, osize
;
126 unsigned int nhashmask
, ohashmask
;
129 mutex_lock(&hash_resize_mutex
);
131 nsize
= xfrm_hash_new_size();
132 ndst
= xfrm_hash_alloc(nsize
);
135 nsrc
= xfrm_hash_alloc(nsize
);
137 xfrm_hash_free(ndst
, nsize
);
140 nspi
= xfrm_hash_alloc(nsize
);
142 xfrm_hash_free(ndst
, nsize
);
143 xfrm_hash_free(nsrc
, nsize
);
147 spin_lock_bh(&xfrm_state_lock
);
149 nhashmask
= (nsize
/ sizeof(struct hlist_head
)) - 1U;
150 for (i
= xfrm_state_hmask
; i
>= 0; i
--)
151 xfrm_hash_transfer(init_net
.xfrm
.state_bydst
+i
, ndst
, nsrc
, nspi
,
154 odst
= init_net
.xfrm
.state_bydst
;
155 osrc
= init_net
.xfrm
.state_bysrc
;
156 ospi
= init_net
.xfrm
.state_byspi
;
157 ohashmask
= xfrm_state_hmask
;
159 init_net
.xfrm
.state_bydst
= ndst
;
160 init_net
.xfrm
.state_bysrc
= nsrc
;
161 init_net
.xfrm
.state_byspi
= nspi
;
162 xfrm_state_hmask
= nhashmask
;
164 spin_unlock_bh(&xfrm_state_lock
);
166 osize
= (ohashmask
+ 1) * sizeof(struct hlist_head
);
167 xfrm_hash_free(odst
, osize
);
168 xfrm_hash_free(osrc
, osize
);
169 xfrm_hash_free(ospi
, osize
);
172 mutex_unlock(&hash_resize_mutex
);
175 static DECLARE_WORK(xfrm_hash_work
, xfrm_hash_resize
);
177 DECLARE_WAIT_QUEUE_HEAD(km_waitq
);
178 EXPORT_SYMBOL(km_waitq
);
180 static DEFINE_RWLOCK(xfrm_state_afinfo_lock
);
181 static struct xfrm_state_afinfo
*xfrm_state_afinfo
[NPROTO
];
183 static struct work_struct xfrm_state_gc_work
;
184 static HLIST_HEAD(xfrm_state_gc_list
);
185 static DEFINE_SPINLOCK(xfrm_state_gc_lock
);
187 int __xfrm_state_delete(struct xfrm_state
*x
);
189 int km_query(struct xfrm_state
*x
, struct xfrm_tmpl
*t
, struct xfrm_policy
*pol
);
190 void km_state_expired(struct xfrm_state
*x
, int hard
, u32 pid
);
192 static struct xfrm_state_afinfo
*xfrm_state_lock_afinfo(unsigned int family
)
194 struct xfrm_state_afinfo
*afinfo
;
195 if (unlikely(family
>= NPROTO
))
197 write_lock_bh(&xfrm_state_afinfo_lock
);
198 afinfo
= xfrm_state_afinfo
[family
];
199 if (unlikely(!afinfo
))
200 write_unlock_bh(&xfrm_state_afinfo_lock
);
204 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo
*afinfo
)
205 __releases(xfrm_state_afinfo_lock
)
207 write_unlock_bh(&xfrm_state_afinfo_lock
);
210 int xfrm_register_type(const struct xfrm_type
*type
, unsigned short family
)
212 struct xfrm_state_afinfo
*afinfo
= xfrm_state_lock_afinfo(family
);
213 const struct xfrm_type
**typemap
;
216 if (unlikely(afinfo
== NULL
))
217 return -EAFNOSUPPORT
;
218 typemap
= afinfo
->type_map
;
220 if (likely(typemap
[type
->proto
] == NULL
))
221 typemap
[type
->proto
] = type
;
224 xfrm_state_unlock_afinfo(afinfo
);
227 EXPORT_SYMBOL(xfrm_register_type
);
229 int xfrm_unregister_type(const struct xfrm_type
*type
, unsigned short family
)
231 struct xfrm_state_afinfo
*afinfo
= xfrm_state_lock_afinfo(family
);
232 const struct xfrm_type
**typemap
;
235 if (unlikely(afinfo
== NULL
))
236 return -EAFNOSUPPORT
;
237 typemap
= afinfo
->type_map
;
239 if (unlikely(typemap
[type
->proto
] != type
))
242 typemap
[type
->proto
] = NULL
;
243 xfrm_state_unlock_afinfo(afinfo
);
246 EXPORT_SYMBOL(xfrm_unregister_type
);
248 static const struct xfrm_type
*xfrm_get_type(u8 proto
, unsigned short family
)
250 struct xfrm_state_afinfo
*afinfo
;
251 const struct xfrm_type
**typemap
;
252 const struct xfrm_type
*type
;
253 int modload_attempted
= 0;
256 afinfo
= xfrm_state_get_afinfo(family
);
257 if (unlikely(afinfo
== NULL
))
259 typemap
= afinfo
->type_map
;
261 type
= typemap
[proto
];
262 if (unlikely(type
&& !try_module_get(type
->owner
)))
264 if (!type
&& !modload_attempted
) {
265 xfrm_state_put_afinfo(afinfo
);
266 request_module("xfrm-type-%d-%d", family
, proto
);
267 modload_attempted
= 1;
271 xfrm_state_put_afinfo(afinfo
);
275 static void xfrm_put_type(const struct xfrm_type
*type
)
277 module_put(type
->owner
);
280 int xfrm_register_mode(struct xfrm_mode
*mode
, int family
)
282 struct xfrm_state_afinfo
*afinfo
;
283 struct xfrm_mode
**modemap
;
286 if (unlikely(mode
->encap
>= XFRM_MODE_MAX
))
289 afinfo
= xfrm_state_lock_afinfo(family
);
290 if (unlikely(afinfo
== NULL
))
291 return -EAFNOSUPPORT
;
294 modemap
= afinfo
->mode_map
;
295 if (modemap
[mode
->encap
])
299 if (!try_module_get(afinfo
->owner
))
302 mode
->afinfo
= afinfo
;
303 modemap
[mode
->encap
] = mode
;
307 xfrm_state_unlock_afinfo(afinfo
);
310 EXPORT_SYMBOL(xfrm_register_mode
);
312 int xfrm_unregister_mode(struct xfrm_mode
*mode
, int family
)
314 struct xfrm_state_afinfo
*afinfo
;
315 struct xfrm_mode
**modemap
;
318 if (unlikely(mode
->encap
>= XFRM_MODE_MAX
))
321 afinfo
= xfrm_state_lock_afinfo(family
);
322 if (unlikely(afinfo
== NULL
))
323 return -EAFNOSUPPORT
;
326 modemap
= afinfo
->mode_map
;
327 if (likely(modemap
[mode
->encap
] == mode
)) {
328 modemap
[mode
->encap
] = NULL
;
329 module_put(mode
->afinfo
->owner
);
333 xfrm_state_unlock_afinfo(afinfo
);
336 EXPORT_SYMBOL(xfrm_unregister_mode
);
338 static struct xfrm_mode
*xfrm_get_mode(unsigned int encap
, int family
)
340 struct xfrm_state_afinfo
*afinfo
;
341 struct xfrm_mode
*mode
;
342 int modload_attempted
= 0;
344 if (unlikely(encap
>= XFRM_MODE_MAX
))
348 afinfo
= xfrm_state_get_afinfo(family
);
349 if (unlikely(afinfo
== NULL
))
352 mode
= afinfo
->mode_map
[encap
];
353 if (unlikely(mode
&& !try_module_get(mode
->owner
)))
355 if (!mode
&& !modload_attempted
) {
356 xfrm_state_put_afinfo(afinfo
);
357 request_module("xfrm-mode-%d-%d", family
, encap
);
358 modload_attempted
= 1;
362 xfrm_state_put_afinfo(afinfo
);
366 static void xfrm_put_mode(struct xfrm_mode
*mode
)
368 module_put(mode
->owner
);
371 static void xfrm_state_gc_destroy(struct xfrm_state
*x
)
373 del_timer_sync(&x
->timer
);
374 del_timer_sync(&x
->rtimer
);
381 xfrm_put_mode(x
->inner_mode
);
382 if (x
->inner_mode_iaf
)
383 xfrm_put_mode(x
->inner_mode_iaf
);
385 xfrm_put_mode(x
->outer_mode
);
387 x
->type
->destructor(x
);
388 xfrm_put_type(x
->type
);
390 security_xfrm_state_free(x
);
394 static void xfrm_state_gc_task(struct work_struct
*data
)
396 struct xfrm_state
*x
;
397 struct hlist_node
*entry
, *tmp
;
398 struct hlist_head gc_list
;
400 spin_lock_bh(&xfrm_state_gc_lock
);
401 hlist_move_list(&xfrm_state_gc_list
, &gc_list
);
402 spin_unlock_bh(&xfrm_state_gc_lock
);
404 hlist_for_each_entry_safe(x
, entry
, tmp
, &gc_list
, gclist
)
405 xfrm_state_gc_destroy(x
);
410 static inline unsigned long make_jiffies(long secs
)
412 if (secs
>= (MAX_SCHEDULE_TIMEOUT
-1)/HZ
)
413 return MAX_SCHEDULE_TIMEOUT
-1;
418 static void xfrm_timer_handler(unsigned long data
)
420 struct xfrm_state
*x
= (struct xfrm_state
*)data
;
421 unsigned long now
= get_seconds();
422 long next
= LONG_MAX
;
427 if (x
->km
.state
== XFRM_STATE_DEAD
)
429 if (x
->km
.state
== XFRM_STATE_EXPIRED
)
431 if (x
->lft
.hard_add_expires_seconds
) {
432 long tmo
= x
->lft
.hard_add_expires_seconds
+
433 x
->curlft
.add_time
- now
;
439 if (x
->lft
.hard_use_expires_seconds
) {
440 long tmo
= x
->lft
.hard_use_expires_seconds
+
441 (x
->curlft
.use_time
? : now
) - now
;
449 if (x
->lft
.soft_add_expires_seconds
) {
450 long tmo
= x
->lft
.soft_add_expires_seconds
+
451 x
->curlft
.add_time
- now
;
457 if (x
->lft
.soft_use_expires_seconds
) {
458 long tmo
= x
->lft
.soft_use_expires_seconds
+
459 (x
->curlft
.use_time
? : now
) - now
;
468 km_state_expired(x
, 0, 0);
470 if (next
!= LONG_MAX
)
471 mod_timer(&x
->timer
, jiffies
+ make_jiffies(next
));
476 if (x
->km
.state
== XFRM_STATE_ACQ
&& x
->id
.spi
== 0) {
477 x
->km
.state
= XFRM_STATE_EXPIRED
;
483 err
= __xfrm_state_delete(x
);
484 if (!err
&& x
->id
.spi
)
485 km_state_expired(x
, 1, 0);
487 xfrm_audit_state_delete(x
, err
? 0 : 1,
488 audit_get_loginuid(current
),
489 audit_get_sessionid(current
), 0);
492 spin_unlock(&x
->lock
);
495 static void xfrm_replay_timer_handler(unsigned long data
);
497 struct xfrm_state
*xfrm_state_alloc(struct net
*net
)
499 struct xfrm_state
*x
;
501 x
= kzalloc(sizeof(struct xfrm_state
), GFP_ATOMIC
);
504 write_pnet(&x
->xs_net
, net
);
505 atomic_set(&x
->refcnt
, 1);
506 atomic_set(&x
->tunnel_users
, 0);
507 INIT_LIST_HEAD(&x
->km
.all
);
508 INIT_HLIST_NODE(&x
->bydst
);
509 INIT_HLIST_NODE(&x
->bysrc
);
510 INIT_HLIST_NODE(&x
->byspi
);
511 setup_timer(&x
->timer
, xfrm_timer_handler
, (unsigned long)x
);
512 setup_timer(&x
->rtimer
, xfrm_replay_timer_handler
,
514 x
->curlft
.add_time
= get_seconds();
515 x
->lft
.soft_byte_limit
= XFRM_INF
;
516 x
->lft
.soft_packet_limit
= XFRM_INF
;
517 x
->lft
.hard_byte_limit
= XFRM_INF
;
518 x
->lft
.hard_packet_limit
= XFRM_INF
;
519 x
->replay_maxage
= 0;
520 x
->replay_maxdiff
= 0;
521 x
->inner_mode
= NULL
;
522 x
->inner_mode_iaf
= NULL
;
523 spin_lock_init(&x
->lock
);
527 EXPORT_SYMBOL(xfrm_state_alloc
);
529 void __xfrm_state_destroy(struct xfrm_state
*x
)
531 WARN_ON(x
->km
.state
!= XFRM_STATE_DEAD
);
533 spin_lock_bh(&xfrm_state_gc_lock
);
534 hlist_add_head(&x
->gclist
, &xfrm_state_gc_list
);
535 spin_unlock_bh(&xfrm_state_gc_lock
);
536 schedule_work(&xfrm_state_gc_work
);
538 EXPORT_SYMBOL(__xfrm_state_destroy
);
540 int __xfrm_state_delete(struct xfrm_state
*x
)
544 if (x
->km
.state
!= XFRM_STATE_DEAD
) {
545 x
->km
.state
= XFRM_STATE_DEAD
;
546 spin_lock(&xfrm_state_lock
);
547 list_del(&x
->km
.all
);
548 hlist_del(&x
->bydst
);
549 hlist_del(&x
->bysrc
);
551 hlist_del(&x
->byspi
);
553 spin_unlock(&xfrm_state_lock
);
555 /* All xfrm_state objects are created by xfrm_state_alloc.
556 * The xfrm_state_alloc call gives a reference, and that
557 * is what we are dropping here.
565 EXPORT_SYMBOL(__xfrm_state_delete
);
567 int xfrm_state_delete(struct xfrm_state
*x
)
571 spin_lock_bh(&x
->lock
);
572 err
= __xfrm_state_delete(x
);
573 spin_unlock_bh(&x
->lock
);
577 EXPORT_SYMBOL(xfrm_state_delete
);
579 #ifdef CONFIG_SECURITY_NETWORK_XFRM
581 xfrm_state_flush_secctx_check(u8 proto
, struct xfrm_audit
*audit_info
)
585 for (i
= 0; i
<= xfrm_state_hmask
; i
++) {
586 struct hlist_node
*entry
;
587 struct xfrm_state
*x
;
589 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+i
, bydst
) {
590 if (xfrm_id_proto_match(x
->id
.proto
, proto
) &&
591 (err
= security_xfrm_state_delete(x
)) != 0) {
592 xfrm_audit_state_delete(x
, 0,
593 audit_info
->loginuid
,
594 audit_info
->sessionid
,
605 xfrm_state_flush_secctx_check(u8 proto
, struct xfrm_audit
*audit_info
)
611 int xfrm_state_flush(u8 proto
, struct xfrm_audit
*audit_info
)
615 spin_lock_bh(&xfrm_state_lock
);
616 err
= xfrm_state_flush_secctx_check(proto
, audit_info
);
620 for (i
= 0; i
<= xfrm_state_hmask
; i
++) {
621 struct hlist_node
*entry
;
622 struct xfrm_state
*x
;
624 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+i
, bydst
) {
625 if (!xfrm_state_kern(x
) &&
626 xfrm_id_proto_match(x
->id
.proto
, proto
)) {
628 spin_unlock_bh(&xfrm_state_lock
);
630 err
= xfrm_state_delete(x
);
631 xfrm_audit_state_delete(x
, err
? 0 : 1,
632 audit_info
->loginuid
,
633 audit_info
->sessionid
,
637 spin_lock_bh(&xfrm_state_lock
);
645 spin_unlock_bh(&xfrm_state_lock
);
649 EXPORT_SYMBOL(xfrm_state_flush
);
651 void xfrm_sad_getinfo(struct xfrmk_sadinfo
*si
)
653 spin_lock_bh(&xfrm_state_lock
);
654 si
->sadcnt
= xfrm_state_num
;
655 si
->sadhcnt
= xfrm_state_hmask
;
656 si
->sadhmcnt
= xfrm_state_hashmax
;
657 spin_unlock_bh(&xfrm_state_lock
);
659 EXPORT_SYMBOL(xfrm_sad_getinfo
);
662 xfrm_init_tempsel(struct xfrm_state
*x
, struct flowi
*fl
,
663 struct xfrm_tmpl
*tmpl
,
664 xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
665 unsigned short family
)
667 struct xfrm_state_afinfo
*afinfo
= xfrm_state_get_afinfo(family
);
670 afinfo
->init_tempsel(x
, fl
, tmpl
, daddr
, saddr
);
671 xfrm_state_put_afinfo(afinfo
);
675 static struct xfrm_state
*__xfrm_state_lookup(xfrm_address_t
*daddr
, __be32 spi
, u8 proto
, unsigned short family
)
677 unsigned int h
= xfrm_spi_hash(daddr
, spi
, proto
, family
);
678 struct xfrm_state
*x
;
679 struct hlist_node
*entry
;
681 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_byspi
+h
, byspi
) {
682 if (x
->props
.family
!= family
||
684 x
->id
.proto
!= proto
)
689 if (x
->id
.daddr
.a4
!= daddr
->a4
)
693 if (!ipv6_addr_equal((struct in6_addr
*)daddr
,
707 static struct xfrm_state
*__xfrm_state_lookup_byaddr(xfrm_address_t
*daddr
, xfrm_address_t
*saddr
, u8 proto
, unsigned short family
)
709 unsigned int h
= xfrm_src_hash(daddr
, saddr
, family
);
710 struct xfrm_state
*x
;
711 struct hlist_node
*entry
;
713 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bysrc
+h
, bysrc
) {
714 if (x
->props
.family
!= family
||
715 x
->id
.proto
!= proto
)
720 if (x
->id
.daddr
.a4
!= daddr
->a4
||
721 x
->props
.saddr
.a4
!= saddr
->a4
)
725 if (!ipv6_addr_equal((struct in6_addr
*)daddr
,
728 !ipv6_addr_equal((struct in6_addr
*)saddr
,
742 static inline struct xfrm_state
*
743 __xfrm_state_locate(struct xfrm_state
*x
, int use_spi
, int family
)
746 return __xfrm_state_lookup(&x
->id
.daddr
, x
->id
.spi
,
747 x
->id
.proto
, family
);
749 return __xfrm_state_lookup_byaddr(&x
->id
.daddr
,
751 x
->id
.proto
, family
);
754 static void xfrm_hash_grow_check(int have_hash_collision
)
756 if (have_hash_collision
&&
757 (xfrm_state_hmask
+ 1) < xfrm_state_hashmax
&&
758 xfrm_state_num
> xfrm_state_hmask
)
759 schedule_work(&xfrm_hash_work
);
763 xfrm_state_find(xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
764 struct flowi
*fl
, struct xfrm_tmpl
*tmpl
,
765 struct xfrm_policy
*pol
, int *err
,
766 unsigned short family
)
769 struct hlist_node
*entry
;
770 struct xfrm_state
*x
, *x0
, *to_put
;
771 int acquire_in_progress
= 0;
773 struct xfrm_state
*best
= NULL
;
777 spin_lock_bh(&xfrm_state_lock
);
778 h
= xfrm_dst_hash(daddr
, saddr
, tmpl
->reqid
, family
);
779 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+h
, bydst
) {
780 if (x
->props
.family
== family
&&
781 x
->props
.reqid
== tmpl
->reqid
&&
782 !(x
->props
.flags
& XFRM_STATE_WILDRECV
) &&
783 xfrm_state_addr_check(x
, daddr
, saddr
, family
) &&
784 tmpl
->mode
== x
->props
.mode
&&
785 tmpl
->id
.proto
== x
->id
.proto
&&
786 (tmpl
->id
.spi
== x
->id
.spi
|| !tmpl
->id
.spi
)) {
788 1. There is a valid state with matching selector.
790 2. Valid state with inappropriate selector. Skip.
792 Entering area of "sysdeps".
794 3. If state is not valid, selector is temporary,
795 it selects only session which triggered
796 previous resolution. Key manager will do
797 something to install a state with proper
800 if (x
->km
.state
== XFRM_STATE_VALID
) {
801 if ((x
->sel
.family
&& !xfrm_selector_match(&x
->sel
, fl
, x
->sel
.family
)) ||
802 !security_xfrm_state_pol_flow_match(x
, pol
, fl
))
805 best
->km
.dying
> x
->km
.dying
||
806 (best
->km
.dying
== x
->km
.dying
&&
807 best
->curlft
.add_time
< x
->curlft
.add_time
))
809 } else if (x
->km
.state
== XFRM_STATE_ACQ
) {
810 acquire_in_progress
= 1;
811 } else if (x
->km
.state
== XFRM_STATE_ERROR
||
812 x
->km
.state
== XFRM_STATE_EXPIRED
) {
813 if (xfrm_selector_match(&x
->sel
, fl
, x
->sel
.family
) &&
814 security_xfrm_state_pol_flow_match(x
, pol
, fl
))
821 if (!x
&& !error
&& !acquire_in_progress
) {
823 (x0
= __xfrm_state_lookup(daddr
, tmpl
->id
.spi
,
824 tmpl
->id
.proto
, family
)) != NULL
) {
829 x
= xfrm_state_alloc(&init_net
);
834 /* Initialize temporary selector matching only
835 * to current session. */
836 xfrm_init_tempsel(x
, fl
, tmpl
, daddr
, saddr
, family
);
838 error
= security_xfrm_state_alloc_acquire(x
, pol
->security
, fl
->secid
);
840 x
->km
.state
= XFRM_STATE_DEAD
;
846 if (km_query(x
, tmpl
, pol
) == 0) {
847 x
->km
.state
= XFRM_STATE_ACQ
;
848 list_add(&x
->km
.all
, &init_net
.xfrm
.state_all
);
849 hlist_add_head(&x
->bydst
, init_net
.xfrm
.state_bydst
+h
);
850 h
= xfrm_src_hash(daddr
, saddr
, family
);
851 hlist_add_head(&x
->bysrc
, init_net
.xfrm
.state_bysrc
+h
);
853 h
= xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
, x
->id
.proto
, family
);
854 hlist_add_head(&x
->byspi
, init_net
.xfrm
.state_byspi
+h
);
856 x
->lft
.hard_add_expires_seconds
= sysctl_xfrm_acq_expires
;
857 x
->timer
.expires
= jiffies
+ sysctl_xfrm_acq_expires
*HZ
;
858 add_timer(&x
->timer
);
860 xfrm_hash_grow_check(x
->bydst
.next
!= NULL
);
862 x
->km
.state
= XFRM_STATE_DEAD
;
872 *err
= acquire_in_progress
? -EAGAIN
: error
;
873 spin_unlock_bh(&xfrm_state_lock
);
875 xfrm_state_put(to_put
);
880 xfrm_stateonly_find(xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
881 unsigned short family
, u8 mode
, u8 proto
, u32 reqid
)
884 struct xfrm_state
*rx
= NULL
, *x
= NULL
;
885 struct hlist_node
*entry
;
887 spin_lock(&xfrm_state_lock
);
888 h
= xfrm_dst_hash(daddr
, saddr
, reqid
, family
);
889 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+h
, bydst
) {
890 if (x
->props
.family
== family
&&
891 x
->props
.reqid
== reqid
&&
892 !(x
->props
.flags
& XFRM_STATE_WILDRECV
) &&
893 xfrm_state_addr_check(x
, daddr
, saddr
, family
) &&
894 mode
== x
->props
.mode
&&
895 proto
== x
->id
.proto
&&
896 x
->km
.state
== XFRM_STATE_VALID
) {
904 spin_unlock(&xfrm_state_lock
);
909 EXPORT_SYMBOL(xfrm_stateonly_find
);
911 static void __xfrm_state_insert(struct xfrm_state
*x
)
915 x
->genid
= ++xfrm_state_genid
;
917 list_add(&x
->km
.all
, &init_net
.xfrm
.state_all
);
919 h
= xfrm_dst_hash(&x
->id
.daddr
, &x
->props
.saddr
,
920 x
->props
.reqid
, x
->props
.family
);
921 hlist_add_head(&x
->bydst
, init_net
.xfrm
.state_bydst
+h
);
923 h
= xfrm_src_hash(&x
->id
.daddr
, &x
->props
.saddr
, x
->props
.family
);
924 hlist_add_head(&x
->bysrc
, init_net
.xfrm
.state_bysrc
+h
);
927 h
= xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
, x
->id
.proto
,
930 hlist_add_head(&x
->byspi
, init_net
.xfrm
.state_byspi
+h
);
933 mod_timer(&x
->timer
, jiffies
+ HZ
);
934 if (x
->replay_maxage
)
935 mod_timer(&x
->rtimer
, jiffies
+ x
->replay_maxage
);
941 xfrm_hash_grow_check(x
->bydst
.next
!= NULL
);
944 /* xfrm_state_lock is held */
945 static void __xfrm_state_bump_genids(struct xfrm_state
*xnew
)
947 unsigned short family
= xnew
->props
.family
;
948 u32 reqid
= xnew
->props
.reqid
;
949 struct xfrm_state
*x
;
950 struct hlist_node
*entry
;
953 h
= xfrm_dst_hash(&xnew
->id
.daddr
, &xnew
->props
.saddr
, reqid
, family
);
954 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+h
, bydst
) {
955 if (x
->props
.family
== family
&&
956 x
->props
.reqid
== reqid
&&
957 !xfrm_addr_cmp(&x
->id
.daddr
, &xnew
->id
.daddr
, family
) &&
958 !xfrm_addr_cmp(&x
->props
.saddr
, &xnew
->props
.saddr
, family
))
959 x
->genid
= xfrm_state_genid
;
963 void xfrm_state_insert(struct xfrm_state
*x
)
965 spin_lock_bh(&xfrm_state_lock
);
966 __xfrm_state_bump_genids(x
);
967 __xfrm_state_insert(x
);
968 spin_unlock_bh(&xfrm_state_lock
);
970 EXPORT_SYMBOL(xfrm_state_insert
);
972 /* xfrm_state_lock is held */
973 static struct xfrm_state
*__find_acq_core(unsigned short family
, u8 mode
, u32 reqid
, u8 proto
, xfrm_address_t
*daddr
, xfrm_address_t
*saddr
, int create
)
975 unsigned int h
= xfrm_dst_hash(daddr
, saddr
, reqid
, family
);
976 struct hlist_node
*entry
;
977 struct xfrm_state
*x
;
979 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+h
, bydst
) {
980 if (x
->props
.reqid
!= reqid
||
981 x
->props
.mode
!= mode
||
982 x
->props
.family
!= family
||
983 x
->km
.state
!= XFRM_STATE_ACQ
||
985 x
->id
.proto
!= proto
)
990 if (x
->id
.daddr
.a4
!= daddr
->a4
||
991 x
->props
.saddr
.a4
!= saddr
->a4
)
995 if (!ipv6_addr_equal((struct in6_addr
*)x
->id
.daddr
.a6
,
996 (struct in6_addr
*)daddr
) ||
997 !ipv6_addr_equal((struct in6_addr
*)
999 (struct in6_addr
*)saddr
))
1011 x
= xfrm_state_alloc(&init_net
);
1015 x
->sel
.daddr
.a4
= daddr
->a4
;
1016 x
->sel
.saddr
.a4
= saddr
->a4
;
1017 x
->sel
.prefixlen_d
= 32;
1018 x
->sel
.prefixlen_s
= 32;
1019 x
->props
.saddr
.a4
= saddr
->a4
;
1020 x
->id
.daddr
.a4
= daddr
->a4
;
1024 ipv6_addr_copy((struct in6_addr
*)x
->sel
.daddr
.a6
,
1025 (struct in6_addr
*)daddr
);
1026 ipv6_addr_copy((struct in6_addr
*)x
->sel
.saddr
.a6
,
1027 (struct in6_addr
*)saddr
);
1028 x
->sel
.prefixlen_d
= 128;
1029 x
->sel
.prefixlen_s
= 128;
1030 ipv6_addr_copy((struct in6_addr
*)x
->props
.saddr
.a6
,
1031 (struct in6_addr
*)saddr
);
1032 ipv6_addr_copy((struct in6_addr
*)x
->id
.daddr
.a6
,
1033 (struct in6_addr
*)daddr
);
1037 x
->km
.state
= XFRM_STATE_ACQ
;
1038 x
->id
.proto
= proto
;
1039 x
->props
.family
= family
;
1040 x
->props
.mode
= mode
;
1041 x
->props
.reqid
= reqid
;
1042 x
->lft
.hard_add_expires_seconds
= sysctl_xfrm_acq_expires
;
1044 x
->timer
.expires
= jiffies
+ sysctl_xfrm_acq_expires
*HZ
;
1045 add_timer(&x
->timer
);
1046 list_add(&x
->km
.all
, &init_net
.xfrm
.state_all
);
1047 hlist_add_head(&x
->bydst
, init_net
.xfrm
.state_bydst
+h
);
1048 h
= xfrm_src_hash(daddr
, saddr
, family
);
1049 hlist_add_head(&x
->bysrc
, init_net
.xfrm
.state_bysrc
+h
);
1053 xfrm_hash_grow_check(x
->bydst
.next
!= NULL
);
1059 static struct xfrm_state
*__xfrm_find_acq_byseq(u32 seq
);
1061 int xfrm_state_add(struct xfrm_state
*x
)
1063 struct xfrm_state
*x1
, *to_put
;
1066 int use_spi
= xfrm_id_proto_match(x
->id
.proto
, IPSEC_PROTO_ANY
);
1068 family
= x
->props
.family
;
1072 spin_lock_bh(&xfrm_state_lock
);
1074 x1
= __xfrm_state_locate(x
, use_spi
, family
);
1082 if (use_spi
&& x
->km
.seq
) {
1083 x1
= __xfrm_find_acq_byseq(x
->km
.seq
);
1084 if (x1
&& ((x1
->id
.proto
!= x
->id
.proto
) ||
1085 xfrm_addr_cmp(&x1
->id
.daddr
, &x
->id
.daddr
, family
))) {
1092 x1
= __find_acq_core(family
, x
->props
.mode
, x
->props
.reqid
,
1094 &x
->id
.daddr
, &x
->props
.saddr
, 0);
1096 __xfrm_state_bump_genids(x
);
1097 __xfrm_state_insert(x
);
1101 spin_unlock_bh(&xfrm_state_lock
);
1104 xfrm_state_delete(x1
);
1109 xfrm_state_put(to_put
);
1113 EXPORT_SYMBOL(xfrm_state_add
);
1115 #ifdef CONFIG_XFRM_MIGRATE
1116 static struct xfrm_state
*xfrm_state_clone(struct xfrm_state
*orig
, int *errp
)
1119 struct xfrm_state
*x
= xfrm_state_alloc(&init_net
);
1123 memcpy(&x
->id
, &orig
->id
, sizeof(x
->id
));
1124 memcpy(&x
->sel
, &orig
->sel
, sizeof(x
->sel
));
1125 memcpy(&x
->lft
, &orig
->lft
, sizeof(x
->lft
));
1126 x
->props
.mode
= orig
->props
.mode
;
1127 x
->props
.replay_window
= orig
->props
.replay_window
;
1128 x
->props
.reqid
= orig
->props
.reqid
;
1129 x
->props
.family
= orig
->props
.family
;
1130 x
->props
.saddr
= orig
->props
.saddr
;
1133 x
->aalg
= xfrm_algo_clone(orig
->aalg
);
1137 x
->props
.aalgo
= orig
->props
.aalgo
;
1140 x
->ealg
= xfrm_algo_clone(orig
->ealg
);
1144 x
->props
.ealgo
= orig
->props
.ealgo
;
1147 x
->calg
= xfrm_algo_clone(orig
->calg
);
1151 x
->props
.calgo
= orig
->props
.calgo
;
1154 x
->encap
= kmemdup(orig
->encap
, sizeof(*x
->encap
), GFP_KERNEL
);
1160 x
->coaddr
= kmemdup(orig
->coaddr
, sizeof(*x
->coaddr
),
1166 err
= xfrm_init_state(x
);
1170 x
->props
.flags
= orig
->props
.flags
;
1172 x
->curlft
.add_time
= orig
->curlft
.add_time
;
1173 x
->km
.state
= orig
->km
.state
;
1174 x
->km
.seq
= orig
->km
.seq
;
1192 /* xfrm_state_lock is held */
1193 struct xfrm_state
* xfrm_migrate_state_find(struct xfrm_migrate
*m
)
1196 struct xfrm_state
*x
;
1197 struct hlist_node
*entry
;
1200 h
= xfrm_dst_hash(&m
->old_daddr
, &m
->old_saddr
,
1201 m
->reqid
, m
->old_family
);
1202 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+h
, bydst
) {
1203 if (x
->props
.mode
!= m
->mode
||
1204 x
->id
.proto
!= m
->proto
)
1206 if (m
->reqid
&& x
->props
.reqid
!= m
->reqid
)
1208 if (xfrm_addr_cmp(&x
->id
.daddr
, &m
->old_daddr
,
1210 xfrm_addr_cmp(&x
->props
.saddr
, &m
->old_saddr
,
1217 h
= xfrm_src_hash(&m
->old_daddr
, &m
->old_saddr
,
1219 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bysrc
+h
, bysrc
) {
1220 if (x
->props
.mode
!= m
->mode
||
1221 x
->id
.proto
!= m
->proto
)
1223 if (xfrm_addr_cmp(&x
->id
.daddr
, &m
->old_daddr
,
1225 xfrm_addr_cmp(&x
->props
.saddr
, &m
->old_saddr
,
1235 EXPORT_SYMBOL(xfrm_migrate_state_find
);
1237 struct xfrm_state
* xfrm_state_migrate(struct xfrm_state
*x
,
1238 struct xfrm_migrate
*m
)
1240 struct xfrm_state
*xc
;
1243 xc
= xfrm_state_clone(x
, &err
);
1247 memcpy(&xc
->id
.daddr
, &m
->new_daddr
, sizeof(xc
->id
.daddr
));
1248 memcpy(&xc
->props
.saddr
, &m
->new_saddr
, sizeof(xc
->props
.saddr
));
1251 if (!xfrm_addr_cmp(&x
->id
.daddr
, &m
->new_daddr
, m
->new_family
)) {
1252 /* a care is needed when the destination address of the
1253 state is to be updated as it is a part of triplet */
1254 xfrm_state_insert(xc
);
1256 if ((err
= xfrm_state_add(xc
)) < 0)
1265 EXPORT_SYMBOL(xfrm_state_migrate
);
1268 int xfrm_state_update(struct xfrm_state
*x
)
1270 struct xfrm_state
*x1
, *to_put
;
1272 int use_spi
= xfrm_id_proto_match(x
->id
.proto
, IPSEC_PROTO_ANY
);
1276 spin_lock_bh(&xfrm_state_lock
);
1277 x1
= __xfrm_state_locate(x
, use_spi
, x
->props
.family
);
1283 if (xfrm_state_kern(x1
)) {
1289 if (x1
->km
.state
== XFRM_STATE_ACQ
) {
1290 __xfrm_state_insert(x
);
1296 spin_unlock_bh(&xfrm_state_lock
);
1299 xfrm_state_put(to_put
);
1305 xfrm_state_delete(x1
);
1311 spin_lock_bh(&x1
->lock
);
1312 if (likely(x1
->km
.state
== XFRM_STATE_VALID
)) {
1313 if (x
->encap
&& x1
->encap
)
1314 memcpy(x1
->encap
, x
->encap
, sizeof(*x1
->encap
));
1315 if (x
->coaddr
&& x1
->coaddr
) {
1316 memcpy(x1
->coaddr
, x
->coaddr
, sizeof(*x1
->coaddr
));
1318 if (!use_spi
&& memcmp(&x1
->sel
, &x
->sel
, sizeof(x1
->sel
)))
1319 memcpy(&x1
->sel
, &x
->sel
, sizeof(x1
->sel
));
1320 memcpy(&x1
->lft
, &x
->lft
, sizeof(x1
->lft
));
1323 mod_timer(&x1
->timer
, jiffies
+ HZ
);
1324 if (x1
->curlft
.use_time
)
1325 xfrm_state_check_expire(x1
);
1329 spin_unlock_bh(&x1
->lock
);
1335 EXPORT_SYMBOL(xfrm_state_update
);
1337 int xfrm_state_check_expire(struct xfrm_state
*x
)
1339 if (!x
->curlft
.use_time
)
1340 x
->curlft
.use_time
= get_seconds();
1342 if (x
->km
.state
!= XFRM_STATE_VALID
)
1345 if (x
->curlft
.bytes
>= x
->lft
.hard_byte_limit
||
1346 x
->curlft
.packets
>= x
->lft
.hard_packet_limit
) {
1347 x
->km
.state
= XFRM_STATE_EXPIRED
;
1348 mod_timer(&x
->timer
, jiffies
);
1353 (x
->curlft
.bytes
>= x
->lft
.soft_byte_limit
||
1354 x
->curlft
.packets
>= x
->lft
.soft_packet_limit
)) {
1356 km_state_expired(x
, 0, 0);
1360 EXPORT_SYMBOL(xfrm_state_check_expire
);
1363 xfrm_state_lookup(xfrm_address_t
*daddr
, __be32 spi
, u8 proto
,
1364 unsigned short family
)
1366 struct xfrm_state
*x
;
1368 spin_lock_bh(&xfrm_state_lock
);
1369 x
= __xfrm_state_lookup(daddr
, spi
, proto
, family
);
1370 spin_unlock_bh(&xfrm_state_lock
);
1373 EXPORT_SYMBOL(xfrm_state_lookup
);
1376 xfrm_state_lookup_byaddr(xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
1377 u8 proto
, unsigned short family
)
1379 struct xfrm_state
*x
;
1381 spin_lock_bh(&xfrm_state_lock
);
1382 x
= __xfrm_state_lookup_byaddr(daddr
, saddr
, proto
, family
);
1383 spin_unlock_bh(&xfrm_state_lock
);
1386 EXPORT_SYMBOL(xfrm_state_lookup_byaddr
);
1389 xfrm_find_acq(u8 mode
, u32 reqid
, u8 proto
,
1390 xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
1391 int create
, unsigned short family
)
1393 struct xfrm_state
*x
;
1395 spin_lock_bh(&xfrm_state_lock
);
1396 x
= __find_acq_core(family
, mode
, reqid
, proto
, daddr
, saddr
, create
);
1397 spin_unlock_bh(&xfrm_state_lock
);
1401 EXPORT_SYMBOL(xfrm_find_acq
);
1403 #ifdef CONFIG_XFRM_SUB_POLICY
1405 xfrm_tmpl_sort(struct xfrm_tmpl
**dst
, struct xfrm_tmpl
**src
, int n
,
1406 unsigned short family
)
1409 struct xfrm_state_afinfo
*afinfo
= xfrm_state_get_afinfo(family
);
1411 return -EAFNOSUPPORT
;
1413 spin_lock_bh(&xfrm_state_lock
);
1414 if (afinfo
->tmpl_sort
)
1415 err
= afinfo
->tmpl_sort(dst
, src
, n
);
1416 spin_unlock_bh(&xfrm_state_lock
);
1417 xfrm_state_put_afinfo(afinfo
);
1420 EXPORT_SYMBOL(xfrm_tmpl_sort
);
1423 xfrm_state_sort(struct xfrm_state
**dst
, struct xfrm_state
**src
, int n
,
1424 unsigned short family
)
1427 struct xfrm_state_afinfo
*afinfo
= xfrm_state_get_afinfo(family
);
1429 return -EAFNOSUPPORT
;
1431 spin_lock_bh(&xfrm_state_lock
);
1432 if (afinfo
->state_sort
)
1433 err
= afinfo
->state_sort(dst
, src
, n
);
1434 spin_unlock_bh(&xfrm_state_lock
);
1435 xfrm_state_put_afinfo(afinfo
);
1438 EXPORT_SYMBOL(xfrm_state_sort
);
1441 /* Silly enough, but I'm lazy to build resolution list */
1443 static struct xfrm_state
*__xfrm_find_acq_byseq(u32 seq
)
1447 for (i
= 0; i
<= xfrm_state_hmask
; i
++) {
1448 struct hlist_node
*entry
;
1449 struct xfrm_state
*x
;
1451 hlist_for_each_entry(x
, entry
, init_net
.xfrm
.state_bydst
+i
, bydst
) {
1452 if (x
->km
.seq
== seq
&&
1453 x
->km
.state
== XFRM_STATE_ACQ
) {
1462 struct xfrm_state
*xfrm_find_acq_byseq(u32 seq
)
1464 struct xfrm_state
*x
;
1466 spin_lock_bh(&xfrm_state_lock
);
1467 x
= __xfrm_find_acq_byseq(seq
);
1468 spin_unlock_bh(&xfrm_state_lock
);
1471 EXPORT_SYMBOL(xfrm_find_acq_byseq
);
1473 u32
xfrm_get_acqseq(void)
1477 static DEFINE_SPINLOCK(acqseq_lock
);
1479 spin_lock_bh(&acqseq_lock
);
1480 res
= (++acqseq
? : ++acqseq
);
1481 spin_unlock_bh(&acqseq_lock
);
1484 EXPORT_SYMBOL(xfrm_get_acqseq
);
1486 int xfrm_alloc_spi(struct xfrm_state
*x
, u32 low
, u32 high
)
1489 struct xfrm_state
*x0
;
1491 __be32 minspi
= htonl(low
);
1492 __be32 maxspi
= htonl(high
);
1494 spin_lock_bh(&x
->lock
);
1495 if (x
->km
.state
== XFRM_STATE_DEAD
)
1504 if (minspi
== maxspi
) {
1505 x0
= xfrm_state_lookup(&x
->id
.daddr
, minspi
, x
->id
.proto
, x
->props
.family
);
1513 for (h
=0; h
<high
-low
+1; h
++) {
1514 spi
= low
+ net_random()%(high
-low
+1);
1515 x0
= xfrm_state_lookup(&x
->id
.daddr
, htonl(spi
), x
->id
.proto
, x
->props
.family
);
1517 x
->id
.spi
= htonl(spi
);
1524 spin_lock_bh(&xfrm_state_lock
);
1525 h
= xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
, x
->id
.proto
, x
->props
.family
);
1526 hlist_add_head(&x
->byspi
, init_net
.xfrm
.state_byspi
+h
);
1527 spin_unlock_bh(&xfrm_state_lock
);
1533 spin_unlock_bh(&x
->lock
);
1537 EXPORT_SYMBOL(xfrm_alloc_spi
);
1539 int xfrm_state_walk(struct xfrm_state_walk
*walk
,
1540 int (*func
)(struct xfrm_state
*, int, void*),
1543 struct xfrm_state
*state
;
1544 struct xfrm_state_walk
*x
;
1547 if (walk
->seq
!= 0 && list_empty(&walk
->all
))
1550 spin_lock_bh(&xfrm_state_lock
);
1551 if (list_empty(&walk
->all
))
1552 x
= list_first_entry(&init_net
.xfrm
.state_all
, struct xfrm_state_walk
, all
);
1554 x
= list_entry(&walk
->all
, struct xfrm_state_walk
, all
);
1555 list_for_each_entry_from(x
, &init_net
.xfrm
.state_all
, all
) {
1556 if (x
->state
== XFRM_STATE_DEAD
)
1558 state
= container_of(x
, struct xfrm_state
, km
);
1559 if (!xfrm_id_proto_match(state
->id
.proto
, walk
->proto
))
1561 err
= func(state
, walk
->seq
, data
);
1563 list_move_tail(&walk
->all
, &x
->all
);
1568 if (walk
->seq
== 0) {
1572 list_del_init(&walk
->all
);
1574 spin_unlock_bh(&xfrm_state_lock
);
1577 EXPORT_SYMBOL(xfrm_state_walk
);
1579 void xfrm_state_walk_init(struct xfrm_state_walk
*walk
, u8 proto
)
1581 INIT_LIST_HEAD(&walk
->all
);
1582 walk
->proto
= proto
;
1583 walk
->state
= XFRM_STATE_DEAD
;
1586 EXPORT_SYMBOL(xfrm_state_walk_init
);
1588 void xfrm_state_walk_done(struct xfrm_state_walk
*walk
)
1590 if (list_empty(&walk
->all
))
1593 spin_lock_bh(&xfrm_state_lock
);
1594 list_del(&walk
->all
);
1595 spin_lock_bh(&xfrm_state_lock
);
1597 EXPORT_SYMBOL(xfrm_state_walk_done
);
1600 void xfrm_replay_notify(struct xfrm_state
*x
, int event
)
1603 /* we send notify messages in case
1604 * 1. we updated on of the sequence numbers, and the seqno difference
1605 * is at least x->replay_maxdiff, in this case we also update the
1606 * timeout of our timer function
1607 * 2. if x->replay_maxage has elapsed since last update,
1608 * and there were changes
1610 * The state structure must be locked!
1614 case XFRM_REPLAY_UPDATE
:
1615 if (x
->replay_maxdiff
&&
1616 (x
->replay
.seq
- x
->preplay
.seq
< x
->replay_maxdiff
) &&
1617 (x
->replay
.oseq
- x
->preplay
.oseq
< x
->replay_maxdiff
)) {
1618 if (x
->xflags
& XFRM_TIME_DEFER
)
1619 event
= XFRM_REPLAY_TIMEOUT
;
1626 case XFRM_REPLAY_TIMEOUT
:
1627 if ((x
->replay
.seq
== x
->preplay
.seq
) &&
1628 (x
->replay
.bitmap
== x
->preplay
.bitmap
) &&
1629 (x
->replay
.oseq
== x
->preplay
.oseq
)) {
1630 x
->xflags
|= XFRM_TIME_DEFER
;
1637 memcpy(&x
->preplay
, &x
->replay
, sizeof(struct xfrm_replay_state
));
1638 c
.event
= XFRM_MSG_NEWAE
;
1639 c
.data
.aevent
= event
;
1640 km_state_notify(x
, &c
);
1642 if (x
->replay_maxage
&&
1643 !mod_timer(&x
->rtimer
, jiffies
+ x
->replay_maxage
))
1644 x
->xflags
&= ~XFRM_TIME_DEFER
;
1647 static void xfrm_replay_timer_handler(unsigned long data
)
1649 struct xfrm_state
*x
= (struct xfrm_state
*)data
;
1651 spin_lock(&x
->lock
);
1653 if (x
->km
.state
== XFRM_STATE_VALID
) {
1654 if (xfrm_aevent_is_on())
1655 xfrm_replay_notify(x
, XFRM_REPLAY_TIMEOUT
);
1657 x
->xflags
|= XFRM_TIME_DEFER
;
1660 spin_unlock(&x
->lock
);
1663 int xfrm_replay_check(struct xfrm_state
*x
,
1664 struct sk_buff
*skb
, __be32 net_seq
)
1667 u32 seq
= ntohl(net_seq
);
1669 if (unlikely(seq
== 0))
1672 if (likely(seq
> x
->replay
.seq
))
1675 diff
= x
->replay
.seq
- seq
;
1676 if (diff
>= min_t(unsigned int, x
->props
.replay_window
,
1677 sizeof(x
->replay
.bitmap
) * 8)) {
1678 x
->stats
.replay_window
++;
1682 if (x
->replay
.bitmap
& (1U << diff
)) {
1689 xfrm_audit_state_replay(x
, skb
, net_seq
);
1693 void xfrm_replay_advance(struct xfrm_state
*x
, __be32 net_seq
)
1696 u32 seq
= ntohl(net_seq
);
1698 if (seq
> x
->replay
.seq
) {
1699 diff
= seq
- x
->replay
.seq
;
1700 if (diff
< x
->props
.replay_window
)
1701 x
->replay
.bitmap
= ((x
->replay
.bitmap
) << diff
) | 1;
1703 x
->replay
.bitmap
= 1;
1704 x
->replay
.seq
= seq
;
1706 diff
= x
->replay
.seq
- seq
;
1707 x
->replay
.bitmap
|= (1U << diff
);
1710 if (xfrm_aevent_is_on())
1711 xfrm_replay_notify(x
, XFRM_REPLAY_UPDATE
);
1714 static LIST_HEAD(xfrm_km_list
);
1715 static DEFINE_RWLOCK(xfrm_km_lock
);
1717 void km_policy_notify(struct xfrm_policy
*xp
, int dir
, struct km_event
*c
)
1719 struct xfrm_mgr
*km
;
1721 read_lock(&xfrm_km_lock
);
1722 list_for_each_entry(km
, &xfrm_km_list
, list
)
1723 if (km
->notify_policy
)
1724 km
->notify_policy(xp
, dir
, c
);
1725 read_unlock(&xfrm_km_lock
);
1728 void km_state_notify(struct xfrm_state
*x
, struct km_event
*c
)
1730 struct xfrm_mgr
*km
;
1731 read_lock(&xfrm_km_lock
);
1732 list_for_each_entry(km
, &xfrm_km_list
, list
)
1735 read_unlock(&xfrm_km_lock
);
1738 EXPORT_SYMBOL(km_policy_notify
);
1739 EXPORT_SYMBOL(km_state_notify
);
1741 void km_state_expired(struct xfrm_state
*x
, int hard
, u32 pid
)
1747 c
.event
= XFRM_MSG_EXPIRE
;
1748 km_state_notify(x
, &c
);
1754 EXPORT_SYMBOL(km_state_expired
);
1756 * We send to all registered managers regardless of failure
1757 * We are happy with one success
1759 int km_query(struct xfrm_state
*x
, struct xfrm_tmpl
*t
, struct xfrm_policy
*pol
)
1761 int err
= -EINVAL
, acqret
;
1762 struct xfrm_mgr
*km
;
1764 read_lock(&xfrm_km_lock
);
1765 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1766 acqret
= km
->acquire(x
, t
, pol
, XFRM_POLICY_OUT
);
1770 read_unlock(&xfrm_km_lock
);
1773 EXPORT_SYMBOL(km_query
);
1775 int km_new_mapping(struct xfrm_state
*x
, xfrm_address_t
*ipaddr
, __be16 sport
)
1778 struct xfrm_mgr
*km
;
1780 read_lock(&xfrm_km_lock
);
1781 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1782 if (km
->new_mapping
)
1783 err
= km
->new_mapping(x
, ipaddr
, sport
);
1787 read_unlock(&xfrm_km_lock
);
1790 EXPORT_SYMBOL(km_new_mapping
);
1792 void km_policy_expired(struct xfrm_policy
*pol
, int dir
, int hard
, u32 pid
)
1798 c
.event
= XFRM_MSG_POLEXPIRE
;
1799 km_policy_notify(pol
, dir
, &c
);
1804 EXPORT_SYMBOL(km_policy_expired
);
1806 #ifdef CONFIG_XFRM_MIGRATE
1807 int km_migrate(struct xfrm_selector
*sel
, u8 dir
, u8 type
,
1808 struct xfrm_migrate
*m
, int num_migrate
,
1809 struct xfrm_kmaddress
*k
)
1813 struct xfrm_mgr
*km
;
1815 read_lock(&xfrm_km_lock
);
1816 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1818 ret
= km
->migrate(sel
, dir
, type
, m
, num_migrate
, k
);
1823 read_unlock(&xfrm_km_lock
);
1826 EXPORT_SYMBOL(km_migrate
);
1829 int km_report(u8 proto
, struct xfrm_selector
*sel
, xfrm_address_t
*addr
)
1833 struct xfrm_mgr
*km
;
1835 read_lock(&xfrm_km_lock
);
1836 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1838 ret
= km
->report(proto
, sel
, addr
);
1843 read_unlock(&xfrm_km_lock
);
1846 EXPORT_SYMBOL(km_report
);
1848 int xfrm_user_policy(struct sock
*sk
, int optname
, u8 __user
*optval
, int optlen
)
1852 struct xfrm_mgr
*km
;
1853 struct xfrm_policy
*pol
= NULL
;
1855 if (optlen
<= 0 || optlen
> PAGE_SIZE
)
1858 data
= kmalloc(optlen
, GFP_KERNEL
);
1863 if (copy_from_user(data
, optval
, optlen
))
1867 read_lock(&xfrm_km_lock
);
1868 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1869 pol
= km
->compile_policy(sk
, optname
, data
,
1874 read_unlock(&xfrm_km_lock
);
1877 xfrm_sk_policy_insert(sk
, err
, pol
);
1886 EXPORT_SYMBOL(xfrm_user_policy
);
1888 int xfrm_register_km(struct xfrm_mgr
*km
)
1890 write_lock_bh(&xfrm_km_lock
);
1891 list_add_tail(&km
->list
, &xfrm_km_list
);
1892 write_unlock_bh(&xfrm_km_lock
);
1895 EXPORT_SYMBOL(xfrm_register_km
);
1897 int xfrm_unregister_km(struct xfrm_mgr
*km
)
1899 write_lock_bh(&xfrm_km_lock
);
1900 list_del(&km
->list
);
1901 write_unlock_bh(&xfrm_km_lock
);
1904 EXPORT_SYMBOL(xfrm_unregister_km
);
1906 int xfrm_state_register_afinfo(struct xfrm_state_afinfo
*afinfo
)
1909 if (unlikely(afinfo
== NULL
))
1911 if (unlikely(afinfo
->family
>= NPROTO
))
1912 return -EAFNOSUPPORT
;
1913 write_lock_bh(&xfrm_state_afinfo_lock
);
1914 if (unlikely(xfrm_state_afinfo
[afinfo
->family
] != NULL
))
1917 xfrm_state_afinfo
[afinfo
->family
] = afinfo
;
1918 write_unlock_bh(&xfrm_state_afinfo_lock
);
1921 EXPORT_SYMBOL(xfrm_state_register_afinfo
);
1923 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo
*afinfo
)
1926 if (unlikely(afinfo
== NULL
))
1928 if (unlikely(afinfo
->family
>= NPROTO
))
1929 return -EAFNOSUPPORT
;
1930 write_lock_bh(&xfrm_state_afinfo_lock
);
1931 if (likely(xfrm_state_afinfo
[afinfo
->family
] != NULL
)) {
1932 if (unlikely(xfrm_state_afinfo
[afinfo
->family
] != afinfo
))
1935 xfrm_state_afinfo
[afinfo
->family
] = NULL
;
1937 write_unlock_bh(&xfrm_state_afinfo_lock
);
1940 EXPORT_SYMBOL(xfrm_state_unregister_afinfo
);
1942 static struct xfrm_state_afinfo
*xfrm_state_get_afinfo(unsigned int family
)
1944 struct xfrm_state_afinfo
*afinfo
;
1945 if (unlikely(family
>= NPROTO
))
1947 read_lock(&xfrm_state_afinfo_lock
);
1948 afinfo
= xfrm_state_afinfo
[family
];
1949 if (unlikely(!afinfo
))
1950 read_unlock(&xfrm_state_afinfo_lock
);
1954 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo
*afinfo
)
1955 __releases(xfrm_state_afinfo_lock
)
1957 read_unlock(&xfrm_state_afinfo_lock
);
1960 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1961 void xfrm_state_delete_tunnel(struct xfrm_state
*x
)
1964 struct xfrm_state
*t
= x
->tunnel
;
1966 if (atomic_read(&t
->tunnel_users
) == 2)
1967 xfrm_state_delete(t
);
1968 atomic_dec(&t
->tunnel_users
);
1973 EXPORT_SYMBOL(xfrm_state_delete_tunnel
);
1975 int xfrm_state_mtu(struct xfrm_state
*x
, int mtu
)
1979 spin_lock_bh(&x
->lock
);
1980 if (x
->km
.state
== XFRM_STATE_VALID
&&
1981 x
->type
&& x
->type
->get_mtu
)
1982 res
= x
->type
->get_mtu(x
, mtu
);
1984 res
= mtu
- x
->props
.header_len
;
1985 spin_unlock_bh(&x
->lock
);
1989 int xfrm_init_state(struct xfrm_state
*x
)
1991 struct xfrm_state_afinfo
*afinfo
;
1992 struct xfrm_mode
*inner_mode
;
1993 int family
= x
->props
.family
;
1996 err
= -EAFNOSUPPORT
;
1997 afinfo
= xfrm_state_get_afinfo(family
);
2002 if (afinfo
->init_flags
)
2003 err
= afinfo
->init_flags(x
);
2005 xfrm_state_put_afinfo(afinfo
);
2010 err
= -EPROTONOSUPPORT
;
2012 if (x
->sel
.family
!= AF_UNSPEC
) {
2013 inner_mode
= xfrm_get_mode(x
->props
.mode
, x
->sel
.family
);
2014 if (inner_mode
== NULL
)
2017 if (!(inner_mode
->flags
& XFRM_MODE_FLAG_TUNNEL
) &&
2018 family
!= x
->sel
.family
) {
2019 xfrm_put_mode(inner_mode
);
2023 x
->inner_mode
= inner_mode
;
2025 struct xfrm_mode
*inner_mode_iaf
;
2027 inner_mode
= xfrm_get_mode(x
->props
.mode
, AF_INET
);
2028 if (inner_mode
== NULL
)
2031 if (!(inner_mode
->flags
& XFRM_MODE_FLAG_TUNNEL
)) {
2032 xfrm_put_mode(inner_mode
);
2036 inner_mode_iaf
= xfrm_get_mode(x
->props
.mode
, AF_INET6
);
2037 if (inner_mode_iaf
== NULL
)
2040 if (!(inner_mode_iaf
->flags
& XFRM_MODE_FLAG_TUNNEL
)) {
2041 xfrm_put_mode(inner_mode_iaf
);
2045 if (x
->props
.family
== AF_INET
) {
2046 x
->inner_mode
= inner_mode
;
2047 x
->inner_mode_iaf
= inner_mode_iaf
;
2049 x
->inner_mode
= inner_mode_iaf
;
2050 x
->inner_mode_iaf
= inner_mode
;
2054 x
->type
= xfrm_get_type(x
->id
.proto
, family
);
2055 if (x
->type
== NULL
)
2058 err
= x
->type
->init_state(x
);
2062 x
->outer_mode
= xfrm_get_mode(x
->props
.mode
, family
);
2063 if (x
->outer_mode
== NULL
)
2066 x
->km
.state
= XFRM_STATE_VALID
;
2072 EXPORT_SYMBOL(xfrm_init_state
);
2074 int __net_init
xfrm_state_init(struct net
*net
)
2078 INIT_LIST_HEAD(&net
->xfrm
.state_all
);
2080 sz
= sizeof(struct hlist_head
) * 8;
2082 net
->xfrm
.state_bydst
= xfrm_hash_alloc(sz
);
2083 if (!net
->xfrm
.state_bydst
)
2085 net
->xfrm
.state_bysrc
= xfrm_hash_alloc(sz
);
2086 if (!net
->xfrm
.state_bysrc
)
2088 net
->xfrm
.state_byspi
= xfrm_hash_alloc(sz
);
2089 if (!net
->xfrm
.state_byspi
)
2091 xfrm_state_hmask
= ((sz
/ sizeof(struct hlist_head
)) - 1);
2093 INIT_WORK(&xfrm_state_gc_work
, xfrm_state_gc_task
);
2097 xfrm_hash_free(net
->xfrm
.state_bysrc
, sz
);
2099 xfrm_hash_free(net
->xfrm
.state_bydst
, sz
);
2104 void xfrm_state_fini(struct net
*net
)
2108 WARN_ON(!list_empty(&net
->xfrm
.state_all
));
2110 sz
= (xfrm_state_hmask
+ 1) * sizeof(struct hlist_head
);
2111 WARN_ON(!hlist_empty(net
->xfrm
.state_byspi
));
2112 xfrm_hash_free(net
->xfrm
.state_byspi
, sz
);
2113 WARN_ON(!hlist_empty(net
->xfrm
.state_bysrc
));
2114 xfrm_hash_free(net
->xfrm
.state_bysrc
, sz
);
2115 WARN_ON(!hlist_empty(net
->xfrm
.state_bydst
));
2116 xfrm_hash_free(net
->xfrm
.state_bydst
, sz
);
2119 #ifdef CONFIG_AUDITSYSCALL
2120 static void xfrm_audit_helper_sainfo(struct xfrm_state
*x
,
2121 struct audit_buffer
*audit_buf
)
2123 struct xfrm_sec_ctx
*ctx
= x
->security
;
2124 u32 spi
= ntohl(x
->id
.spi
);
2127 audit_log_format(audit_buf
, " sec_alg=%u sec_doi=%u sec_obj=%s",
2128 ctx
->ctx_alg
, ctx
->ctx_doi
, ctx
->ctx_str
);
2130 switch(x
->props
.family
) {
2132 audit_log_format(audit_buf
, " src=%pI4 dst=%pI4",
2133 &x
->props
.saddr
.a4
, &x
->id
.daddr
.a4
);
2136 audit_log_format(audit_buf
, " src=%pI6 dst=%pI6",
2137 x
->props
.saddr
.a6
, x
->id
.daddr
.a6
);
2141 audit_log_format(audit_buf
, " spi=%u(0x%x)", spi
, spi
);
2144 static void xfrm_audit_helper_pktinfo(struct sk_buff
*skb
, u16 family
,
2145 struct audit_buffer
*audit_buf
)
2148 struct ipv6hdr
*iph6
;
2153 audit_log_format(audit_buf
, " src=%pI4 dst=%pI4",
2154 &iph4
->saddr
, &iph4
->daddr
);
2157 iph6
= ipv6_hdr(skb
);
2158 audit_log_format(audit_buf
,
2159 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2160 &iph6
->saddr
,&iph6
->daddr
,
2161 iph6
->flow_lbl
[0] & 0x0f,
2168 void xfrm_audit_state_add(struct xfrm_state
*x
, int result
,
2169 uid_t auid
, u32 sessionid
, u32 secid
)
2171 struct audit_buffer
*audit_buf
;
2173 audit_buf
= xfrm_audit_start("SAD-add");
2174 if (audit_buf
== NULL
)
2176 xfrm_audit_helper_usrinfo(auid
, sessionid
, secid
, audit_buf
);
2177 xfrm_audit_helper_sainfo(x
, audit_buf
);
2178 audit_log_format(audit_buf
, " res=%u", result
);
2179 audit_log_end(audit_buf
);
2181 EXPORT_SYMBOL_GPL(xfrm_audit_state_add
);
2183 void xfrm_audit_state_delete(struct xfrm_state
*x
, int result
,
2184 uid_t auid
, u32 sessionid
, u32 secid
)
2186 struct audit_buffer
*audit_buf
;
2188 audit_buf
= xfrm_audit_start("SAD-delete");
2189 if (audit_buf
== NULL
)
2191 xfrm_audit_helper_usrinfo(auid
, sessionid
, secid
, audit_buf
);
2192 xfrm_audit_helper_sainfo(x
, audit_buf
);
2193 audit_log_format(audit_buf
, " res=%u", result
);
2194 audit_log_end(audit_buf
);
2196 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete
);
2198 void xfrm_audit_state_replay_overflow(struct xfrm_state
*x
,
2199 struct sk_buff
*skb
)
2201 struct audit_buffer
*audit_buf
;
2204 audit_buf
= xfrm_audit_start("SA-replay-overflow");
2205 if (audit_buf
== NULL
)
2207 xfrm_audit_helper_pktinfo(skb
, x
->props
.family
, audit_buf
);
2208 /* don't record the sequence number because it's inherent in this kind
2209 * of audit message */
2210 spi
= ntohl(x
->id
.spi
);
2211 audit_log_format(audit_buf
, " spi=%u(0x%x)", spi
, spi
);
2212 audit_log_end(audit_buf
);
2214 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow
);
2216 static void xfrm_audit_state_replay(struct xfrm_state
*x
,
2217 struct sk_buff
*skb
, __be32 net_seq
)
2219 struct audit_buffer
*audit_buf
;
2222 audit_buf
= xfrm_audit_start("SA-replayed-pkt");
2223 if (audit_buf
== NULL
)
2225 xfrm_audit_helper_pktinfo(skb
, x
->props
.family
, audit_buf
);
2226 spi
= ntohl(x
->id
.spi
);
2227 audit_log_format(audit_buf
, " spi=%u(0x%x) seqno=%u",
2228 spi
, spi
, ntohl(net_seq
));
2229 audit_log_end(audit_buf
);
2232 void xfrm_audit_state_notfound_simple(struct sk_buff
*skb
, u16 family
)
2234 struct audit_buffer
*audit_buf
;
2236 audit_buf
= xfrm_audit_start("SA-notfound");
2237 if (audit_buf
== NULL
)
2239 xfrm_audit_helper_pktinfo(skb
, family
, audit_buf
);
2240 audit_log_end(audit_buf
);
2242 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple
);
2244 void xfrm_audit_state_notfound(struct sk_buff
*skb
, u16 family
,
2245 __be32 net_spi
, __be32 net_seq
)
2247 struct audit_buffer
*audit_buf
;
2250 audit_buf
= xfrm_audit_start("SA-notfound");
2251 if (audit_buf
== NULL
)
2253 xfrm_audit_helper_pktinfo(skb
, family
, audit_buf
);
2254 spi
= ntohl(net_spi
);
2255 audit_log_format(audit_buf
, " spi=%u(0x%x) seqno=%u",
2256 spi
, spi
, ntohl(net_seq
));
2257 audit_log_end(audit_buf
);
2259 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound
);
2261 void xfrm_audit_state_icvfail(struct xfrm_state
*x
,
2262 struct sk_buff
*skb
, u8 proto
)
2264 struct audit_buffer
*audit_buf
;
2268 audit_buf
= xfrm_audit_start("SA-icv-failure");
2269 if (audit_buf
== NULL
)
2271 xfrm_audit_helper_pktinfo(skb
, x
->props
.family
, audit_buf
);
2272 if (xfrm_parse_spi(skb
, proto
, &net_spi
, &net_seq
) == 0) {
2273 u32 spi
= ntohl(net_spi
);
2274 audit_log_format(audit_buf
, " spi=%u(0x%x) seqno=%u",
2275 spi
, spi
, ntohl(net_seq
));
2277 audit_log_end(audit_buf
);
2279 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail
);
2280 #endif /* CONFIG_AUDITSYSCALL */