SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <linux/cache.h>
  22 #include <linux/audit.h>
  23 #include <asm/uaccess.h>
  24 #include <linux/ktime.h>
  25 #include <linux/interrupt.h>
  26 #include <linux/kernel.h>
  27
  28 #include "xfrm_hash.h"
  29
  30 /* Each xfrm_state may be linked to two tables:
  31
  32    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  33    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
  34       destination/tunnel endpoint. (output)
  35  */
  36
  37 static DEFINE_SPINLOCK(xfrm_state_lock);
  38
  39 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
  40 static unsigned int xfrm_state_genid;
  41
  42 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
  43 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  44
  45 #ifdef CONFIG_AUDITSYSCALL
  46 static void xfrm_audit_state_replay(struct xfrm_state *x,
  47                                     struct sk_buff *skb, __be32 net_seq);
  48 #else
  49 #define xfrm_audit_state_replay(x, s, sq)       do { ; } while (0)
  50 #endif /* CONFIG_AUDITSYSCALL */
  51
  52 static inline unsigned int xfrm_dst_hash(struct net *net,
  53                                          xfrm_address_t *daddr,
  54                                          xfrm_address_t *saddr,
  55                                          u32 reqid,
  56                                          unsigned short family)
  57 {
  58         return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
  59 }
  60
  61 static inline unsigned int xfrm_src_hash(struct net *net,
  62                                          xfrm_address_t *daddr,
  63                                          xfrm_address_t *saddr,
  64                                          unsigned short family)
  65 {
  66         return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
  67 }
  68
  69 static inline unsigned int
  70 xfrm_spi_hash(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
  71 {
  72         return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
  73 }
  74
  75 static void xfrm_hash_transfer(struct hlist_head *list,
  76                                struct hlist_head *ndsttable,
  77                                struct hlist_head *nsrctable,
  78                                struct hlist_head *nspitable,
  79                                unsigned int nhashmask)
  80 {
  81         struct hlist_node *entry, *tmp;
  82         struct xfrm_state *x;
  83
  84         hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
  85                 unsigned int h;
  86
  87                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
  88                                     x->props.reqid, x->props.family,
  89                                     nhashmask);
  90                 hlist_add_head(&x->bydst, ndsttable+h);
  91
  92                 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
  93                                     x->props.family,
  94                                     nhashmask);
  95                 hlist_add_head(&x->bysrc, nsrctable+h);
  96
  97                 if (x->id.spi) {
  98                         h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
  99                                             x->id.proto, x->props.family,
 100                                             nhashmask);
 101                         hlist_add_head(&x->byspi, nspitable+h);
 102                 }
 103         }
 104 }
 105
 106 static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
 107 {
 108         return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
 109 }
 110
 111 static DEFINE_MUTEX(hash_resize_mutex);
 112
 113 static void xfrm_hash_resize(struct work_struct *work)
 114 {
 115         struct net *net = container_of(work, struct net, xfrm.state_hash_work);
 116         struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
 117         unsigned long nsize, osize;
 118         unsigned int nhashmask, ohashmask;
 119         int i;
 120
 121         mutex_lock(&hash_resize_mutex);
 122
 123         nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
 124         ndst = xfrm_hash_alloc(nsize);
 125         if (!ndst)
 126                 goto out_unlock;
 127         nsrc = xfrm_hash_alloc(nsize);
 128         if (!nsrc) {
 129                 xfrm_hash_free(ndst, nsize);
 130                 goto out_unlock;
 131         }
 132         nspi = xfrm_hash_alloc(nsize);
 133         if (!nspi) {
 134                 xfrm_hash_free(ndst, nsize);
 135                 xfrm_hash_free(nsrc, nsize);
 136                 goto out_unlock;
 137         }
 138
 139         spin_lock_bh(&xfrm_state_lock);
 140
 141         nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
 142         for (i = net->xfrm.state_hmask; i >= 0; i--)
 143                 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
 144                                    nhashmask);
 145
 146         odst = net->xfrm.state_bydst;
 147         osrc = net->xfrm.state_bysrc;
 148         ospi = net->xfrm.state_byspi;
 149         ohashmask = net->xfrm.state_hmask;
 150
 151         net->xfrm.state_bydst = ndst;
 152         net->xfrm.state_bysrc = nsrc;
 153         net->xfrm.state_byspi = nspi;
 154         net->xfrm.state_hmask = nhashmask;
 155
 156         spin_unlock_bh(&xfrm_state_lock);
 157
 158         osize = (ohashmask + 1) * sizeof(struct hlist_head);
 159         xfrm_hash_free(odst, osize);
 160         xfrm_hash_free(osrc, osize);
 161         xfrm_hash_free(ospi, osize);
 162
 163 out_unlock:
 164         mutex_unlock(&hash_resize_mutex);
 165 }
 166
 167 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 168 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 169
 170 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 171
 172 int __xfrm_state_delete(struct xfrm_state *x);
 173
 174 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 175 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 176
 177 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
 178 {
 179         struct xfrm_state_afinfo *afinfo;
 180         if (unlikely(family >= NPROTO))
 181                 return NULL;
 182         write_lock_bh(&xfrm_state_afinfo_lock);
 183         afinfo = xfrm_state_afinfo[family];
 184         if (unlikely(!afinfo))
 185                 write_unlock_bh(&xfrm_state_afinfo_lock);
 186         return afinfo;
 187 }
 188
 189 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
 190         __releases(xfrm_state_afinfo_lock)
 191 {
 192         write_unlock_bh(&xfrm_state_afinfo_lock);
 193 }
 194
 195 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
 196 {
 197         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 198         const struct xfrm_type **typemap;
 199         int err = 0;
 200
 201         if (unlikely(afinfo == NULL))
 202                 return -EAFNOSUPPORT;
 203         typemap = afinfo->type_map;
 204
 205         if (likely(typemap[type->proto] == NULL))
 206                 typemap[type->proto] = type;
 207         else
 208                 err = -EEXIST;
 209         xfrm_state_unlock_afinfo(afinfo);
 210         return err;
 211 }
 212 EXPORT_SYMBOL(xfrm_register_type);
 213
 214 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
 215 {
 216         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 217         const struct xfrm_type **typemap;
 218         int err = 0;
 219
 220         if (unlikely(afinfo == NULL))
 221                 return -EAFNOSUPPORT;
 222         typemap = afinfo->type_map;
 223
 224         if (unlikely(typemap[type->proto] != type))
 225                 err = -ENOENT;
 226         else
 227                 typemap[type->proto] = NULL;
 228         xfrm_state_unlock_afinfo(afinfo);
 229         return err;
 230 }
 231 EXPORT_SYMBOL(xfrm_unregister_type);
 232
 233 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
 234 {
 235         struct xfrm_state_afinfo *afinfo;
 236         const struct xfrm_type **typemap;
 237         const struct xfrm_type *type;
 238         int modload_attempted = 0;
 239
 240 retry:
 241         afinfo = xfrm_state_get_afinfo(family);
 242         if (unlikely(afinfo == NULL))
 243                 return NULL;
 244         typemap = afinfo->type_map;
 245
 246         type = typemap[proto];
 247         if (unlikely(type && !try_module_get(type->owner)))
 248                 type = NULL;
 249         if (!type && !modload_attempted) {
 250                 xfrm_state_put_afinfo(afinfo);
 251                 request_module("xfrm-type-%d-%d", family, proto);
 252                 modload_attempted = 1;
 253                 goto retry;
 254         }
 255
 256         xfrm_state_put_afinfo(afinfo);
 257         return type;
 258 }
 259
 260 static void xfrm_put_type(const struct xfrm_type *type)
 261 {
 262         module_put(type->owner);
 263 }
 264
 265 int xfrm_register_mode(struct xfrm_mode *mode, int family)
 266 {
 267         struct xfrm_state_afinfo *afinfo;
 268         struct xfrm_mode **modemap;
 269         int err;
 270
 271         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 272                 return -EINVAL;
 273
 274         afinfo = xfrm_state_lock_afinfo(family);
 275         if (unlikely(afinfo == NULL))
 276                 return -EAFNOSUPPORT;
 277
 278         err = -EEXIST;
 279         modemap = afinfo->mode_map;
 280         if (modemap[mode->encap])
 281                 goto out;
 282
 283         err = -ENOENT;
 284         if (!try_module_get(afinfo->owner))
 285                 goto out;
 286
 287         mode->afinfo = afinfo;
 288         modemap[mode->encap] = mode;
 289         err = 0;
 290
 291 out:
 292         xfrm_state_unlock_afinfo(afinfo);
 293         return err;
 294 }
 295 EXPORT_SYMBOL(xfrm_register_mode);
 296
 297 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
 298 {
 299         struct xfrm_state_afinfo *afinfo;
 300         struct xfrm_mode **modemap;
 301         int err;
 302
 303         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 304                 return -EINVAL;
 305
 306         afinfo = xfrm_state_lock_afinfo(family);
 307         if (unlikely(afinfo == NULL))
 308                 return -EAFNOSUPPORT;
 309
 310         err = -ENOENT;
 311         modemap = afinfo->mode_map;
 312         if (likely(modemap[mode->encap] == mode)) {
 313                 modemap[mode->encap] = NULL;
 314                 module_put(mode->afinfo->owner);
 315                 err = 0;
 316         }
 317
 318         xfrm_state_unlock_afinfo(afinfo);
 319         return err;
 320 }
 321 EXPORT_SYMBOL(xfrm_unregister_mode);
 322
 323 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
 324 {
 325         struct xfrm_state_afinfo *afinfo;
 326         struct xfrm_mode *mode;
 327         int modload_attempted = 0;
 328
 329         if (unlikely(encap >= XFRM_MODE_MAX))
 330                 return NULL;
 331
 332 retry:
 333         afinfo = xfrm_state_get_afinfo(family);
 334         if (unlikely(afinfo == NULL))
 335                 return NULL;
 336
 337         mode = afinfo->mode_map[encap];
 338         if (unlikely(mode && !try_module_get(mode->owner)))
 339                 mode = NULL;
 340         if (!mode && !modload_attempted) {
 341                 xfrm_state_put_afinfo(afinfo);
 342                 request_module("xfrm-mode-%d-%d", family, encap);
 343                 modload_attempted = 1;
 344                 goto retry;
 345         }
 346
 347         xfrm_state_put_afinfo(afinfo);
 348         return mode;
 349 }
 350
 351 static void xfrm_put_mode(struct xfrm_mode *mode)
 352 {
 353         module_put(mode->owner);
 354 }
 355
 356 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 357 {
 358         tasklet_hrtimer_cancel(&x->mtimer);
 359         del_timer_sync(&x->rtimer);
 360         kfree(x->aalg);
 361         kfree(x->ealg);
 362         kfree(x->calg);
 363         kfree(x->encap);
 364         kfree(x->coaddr);
 365         if (x->inner_mode)
 366                 xfrm_put_mode(x->inner_mode);
 367         if (x->inner_mode_iaf)
 368                 xfrm_put_mode(x->inner_mode_iaf);
 369         if (x->outer_mode)
 370                 xfrm_put_mode(x->outer_mode);
 371         if (x->type) {
 372                 x->type->destructor(x);
 373                 xfrm_put_type(x->type);
 374         }
 375         security_xfrm_state_free(x);
 376         kfree(x);
 377 }
 378
 379 static void xfrm_state_gc_task(struct work_struct *work)
 380 {
 381         struct net *net = container_of(work, struct net, xfrm.state_gc_work);
 382         struct xfrm_state *x;
 383         struct hlist_node *entry, *tmp;
 384         struct hlist_head gc_list;
 385
 386         spin_lock_bh(&xfrm_state_gc_lock);
 387         hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
 388         spin_unlock_bh(&xfrm_state_gc_lock);
 389
 390         hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
 391                 xfrm_state_gc_destroy(x);
 392
 393         wake_up(&net->xfrm.km_waitq);
 394 }
 395
 396 static inline unsigned long make_jiffies(long secs)
 397 {
 398         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 399                 return MAX_SCHEDULE_TIMEOUT-1;
 400         else
 401                 return secs*HZ;
 402 }
 403
 404 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
 405 {
 406         struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer);
 407         struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer);
 408         struct net *net = xs_net(x);
 409         unsigned long now = get_seconds();
 410         long next = LONG_MAX;
 411         int warn = 0;
 412         int err = 0;
 413
 414         spin_lock(&x->lock);
 415         if (x->km.state == XFRM_STATE_DEAD)
 416                 goto out;
 417         if (x->km.state == XFRM_STATE_EXPIRED)
 418                 goto expired;
 419         if (x->lft.hard_add_expires_seconds) {
 420                 long tmo = x->lft.hard_add_expires_seconds +
 421                         x->curlft.add_time - now;
 422                 if (tmo <= 0)
 423                         goto expired;
 424                 if (tmo < next)
 425                         next = tmo;
 426         }
 427         if (x->lft.hard_use_expires_seconds) {
 428                 long tmo = x->lft.hard_use_expires_seconds +
 429                         (x->curlft.use_time ? : now) - now;
 430                 if (tmo <= 0)
 431                         goto expired;
 432                 if (tmo < next)
 433                         next = tmo;
 434         }
 435         if (x->km.dying)
 436                 goto resched;
 437         if (x->lft.soft_add_expires_seconds) {
 438                 long tmo = x->lft.soft_add_expires_seconds +
 439                         x->curlft.add_time - now;
 440                 if (tmo <= 0)
 441                         warn = 1;
 442                 else if (tmo < next)
 443                         next = tmo;
 444         }
 445         if (x->lft.soft_use_expires_seconds) {
 446                 long tmo = x->lft.soft_use_expires_seconds +
 447                         (x->curlft.use_time ? : now) - now;
 448                 if (tmo <= 0)
 449                         warn = 1;
 450                 else if (tmo < next)
 451                         next = tmo;
 452         }
 453
 454         x->km.dying = warn;
 455         if (warn)
 456                 km_state_expired(x, 0, 0);
 457 resched:
 458         if (next != LONG_MAX){
 459                 tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL);
 460         }
 461
 462         goto out;
 463
 464 expired:
 465         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 466                 x->km.state = XFRM_STATE_EXPIRED;
 467                 wake_up(&net->xfrm.km_waitq);
 468                 next = 2;
 469                 goto resched;
 470         }
 471
 472         err = __xfrm_state_delete(x);
 473         if (!err && x->id.spi)
 474                 km_state_expired(x, 1, 0);
 475
 476         xfrm_audit_state_delete(x, err ? 0 : 1,
 477                                 audit_get_loginuid(current),
 478                                 audit_get_sessionid(current), 0);
 479
 480 out:
 481         spin_unlock(&x->lock);
 482         return HRTIMER_NORESTART;
 483 }
 484
 485 static void xfrm_replay_timer_handler(unsigned long data);
 486
 487 struct xfrm_state *xfrm_state_alloc(struct net *net)
 488 {
 489         struct xfrm_state *x;
 490
 491         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 492
 493         if (x) {
 494                 write_pnet(&x->xs_net, net);
 495                 atomic_set(&x->refcnt, 1);
 496                 atomic_set(&x->tunnel_users, 0);
 497                 INIT_LIST_HEAD(&x->km.all);
 498                 INIT_HLIST_NODE(&x->bydst);
 499                 INIT_HLIST_NODE(&x->bysrc);
 500                 INIT_HLIST_NODE(&x->byspi);
 501                 tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, CLOCK_REALTIME, HRTIMER_MODE_ABS);
 502                 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
 503                                 (unsigned long)x);
 504                 x->curlft.add_time = get_seconds();
 505                 x->lft.soft_byte_limit = XFRM_INF;
 506                 x->lft.soft_packet_limit = XFRM_INF;
 507                 x->lft.hard_byte_limit = XFRM_INF;
 508                 x->lft.hard_packet_limit = XFRM_INF;
 509                 x->replay_maxage = 0;
 510                 x->replay_maxdiff = 0;
 511                 x->inner_mode = NULL;
 512                 x->inner_mode_iaf = NULL;
 513                 spin_lock_init(&x->lock);
 514         }
 515         return x;
 516 }
 517 EXPORT_SYMBOL(xfrm_state_alloc);
 518
 519 void __xfrm_state_destroy(struct xfrm_state *x)
 520 {
 521         struct net *net = xs_net(x);
 522
 523         WARN_ON(x->km.state != XFRM_STATE_DEAD);
 524
 525         spin_lock_bh(&xfrm_state_gc_lock);
 526         hlist_add_head(&x->gclist, &net->xfrm.state_gc_list);
 527         spin_unlock_bh(&xfrm_state_gc_lock);
 528         schedule_work(&net->xfrm.state_gc_work);
 529 }
 530 EXPORT_SYMBOL(__xfrm_state_destroy);
 531
 532 int __xfrm_state_delete(struct xfrm_state *x)
 533 {
 534         struct net *net = xs_net(x);
 535         int err = -ESRCH;
 536
 537         if (x->km.state != XFRM_STATE_DEAD) {
 538                 x->km.state = XFRM_STATE_DEAD;
 539                 spin_lock(&xfrm_state_lock);
 540                 list_del(&x->km.all);
 541                 hlist_del(&x->bydst);
 542                 hlist_del(&x->bysrc);
 543                 if (x->id.spi)
 544                         hlist_del(&x->byspi);
 545                 net->xfrm.state_num--;
 546                 spin_unlock(&xfrm_state_lock);
 547
 548                 /* All xfrm_state objects are created by xfrm_state_alloc.
 549                  * The xfrm_state_alloc call gives a reference, and that
 550                  * is what we are dropping here.
 551                  */
 552                 xfrm_state_put(x);
 553                 err = 0;
 554         }
 555
 556         return err;
 557 }
 558 EXPORT_SYMBOL(__xfrm_state_delete);
 559
 560 int xfrm_state_delete(struct xfrm_state *x)
 561 {
 562         int err;
 563
 564         spin_lock_bh(&x->lock);
 565         err = __xfrm_state_delete(x);
 566         spin_unlock_bh(&x->lock);
 567
 568         return err;
 569 }
 570 EXPORT_SYMBOL(xfrm_state_delete);
 571
 572 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 573 static inline int
 574 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 575 {
 576         int i, err = 0;
 577
 578         for (i = 0; i <= net->xfrm.state_hmask; i++) {
 579                 struct hlist_node *entry;
 580                 struct xfrm_state *x;
 581
 582                 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
 583                         if (xfrm_id_proto_match(x->id.proto, proto) &&
 584                            (err = security_xfrm_state_delete(x)) != 0) {
 585                                 xfrm_audit_state_delete(x, 0,
 586                                                         audit_info->loginuid,
 587                                                         audit_info->sessionid,
 588                                                         audit_info->secid);
 589                                 return err;
 590                         }
 591                 }
 592         }
 593
 594         return err;
 595 }
 596 #else
 597 static inline int
 598 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 599 {
 600         return 0;
 601 }
 602 #endif
 603
 604 int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 605 {
 606         int i, err = 0, cnt = 0;
 607
 608         spin_lock_bh(&xfrm_state_lock);
 609         err = xfrm_state_flush_secctx_check(net, proto, audit_info);
 610         if (err)
 611                 goto out;
 612
 613         err = -ESRCH;
 614         for (i = 0; i <= net->xfrm.state_hmask; i++) {
 615                 struct hlist_node *entry;
 616                 struct xfrm_state *x;
 617 restart:
 618                 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
 619                         if (!xfrm_state_kern(x) &&
 620                             xfrm_id_proto_match(x->id.proto, proto)) {
 621                                 xfrm_state_hold(x);
 622                                 spin_unlock_bh(&xfrm_state_lock);
 623
 624                                 err = xfrm_state_delete(x);
 625                                 xfrm_audit_state_delete(x, err ? 0 : 1,
 626                                                         audit_info->loginuid,
 627                                                         audit_info->sessionid,
 628                                                         audit_info->secid);
 629                                 xfrm_state_put(x);
 630                                 if (!err)
 631                                         cnt++;
 632
 633                                 spin_lock_bh(&xfrm_state_lock);
 634                                 goto restart;
 635                         }
 636                 }
 637         }
 638         if (cnt)
 639                 err = 0;
 640
 641 out:
 642         spin_unlock_bh(&xfrm_state_lock);
 643         wake_up(&net->xfrm.km_waitq);
 644         return err;
 645 }
 646 EXPORT_SYMBOL(xfrm_state_flush);
 647
 648 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
 649 {
 650         spin_lock_bh(&xfrm_state_lock);
 651         si->sadcnt = net->xfrm.state_num;
 652         si->sadhcnt = net->xfrm.state_hmask;
 653         si->sadhmcnt = xfrm_state_hashmax;
 654         spin_unlock_bh(&xfrm_state_lock);
 655 }
 656 EXPORT_SYMBOL(xfrm_sad_getinfo);
 657
 658 static int
 659 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 660                   struct xfrm_tmpl *tmpl,
 661                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 662                   unsigned short family)
 663 {
 664         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 665         if (!afinfo)
 666                 return -1;
 667         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 668         xfrm_state_put_afinfo(afinfo);
 669         return 0;
 670 }
 671
 672 static struct xfrm_state *__xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 673 {
 674         unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
 675         struct xfrm_state *x;
 676         struct hlist_node *entry;
 677
 678         hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
 679                 if (x->props.family != family ||
 680                     x->id.spi       != spi ||
 681                     x->id.proto     != proto ||
 682                     xfrm_addr_cmp(&x->id.daddr, daddr, family))
 683                         continue;
 684
 685                 xfrm_state_hold(x);
 686                 return x;
 687         }
 688
 689         return NULL;
 690 }
 691
 692 static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 693 {
 694         unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
 695         struct xfrm_state *x;
 696         struct hlist_node *entry;
 697
 698         hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
 699                 if (x->props.family != family ||
 700                     x->id.proto     != proto ||
 701                     xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
 702                     xfrm_addr_cmp(&x->props.saddr, saddr, family))
 703                         continue;
 704
 705                 xfrm_state_hold(x);
 706                 return x;
 707         }
 708
 709         return NULL;
 710 }
 711
 712 static inline struct xfrm_state *
 713 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
 714 {
 715         struct net *net = xs_net(x);
 716
 717         if (use_spi)
 718                 return __xfrm_state_lookup(net, &x->id.daddr, x->id.spi,
 719                                            x->id.proto, family);
 720         else
 721                 return __xfrm_state_lookup_byaddr(net, &x->id.daddr,
 722                                                   &x->props.saddr,
 723                                                   x->id.proto, family);
 724 }
 725
 726 static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
 727 {
 728         if (have_hash_collision &&
 729             (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
 730             net->xfrm.state_num > net->xfrm.state_hmask)
 731                 schedule_work(&net->xfrm.state_hash_work);
 732 }
 733
 734 static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
 735                                struct flowi *fl, unsigned short family,
 736                                xfrm_address_t *daddr, xfrm_address_t *saddr,
 737                                struct xfrm_state **best, int *acq_in_progress,
 738                                int *error)
 739 {
 740         /* Resolution logic:
 741          * 1. There is a valid state with matching selector. Done.
 742          * 2. Valid state with inappropriate selector. Skip.
 743          *
 744          * Entering area of "sysdeps".
 745          *
 746          * 3. If state is not valid, selector is temporary, it selects
 747          *    only session which triggered previous resolution. Key
 748          *    manager will do something to install a state with proper
 749          *    selector.
 750          */
 751         if (x->km.state == XFRM_STATE_VALID) {
 752                 if ((x->sel.family &&
 753                      !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
 754                     !security_xfrm_state_pol_flow_match(x, pol, fl))
 755                         return;
 756
 757                 if (!*best ||
 758                     (*best)->km.dying > x->km.dying ||
 759                     ((*best)->km.dying == x->km.dying &&
 760                      (*best)->curlft.add_time < x->curlft.add_time))
 761                         *best = x;
 762         } else if (x->km.state == XFRM_STATE_ACQ) {
 763                 *acq_in_progress = 1;
 764         } else if (x->km.state == XFRM_STATE_ERROR ||
 765                    x->km.state == XFRM_STATE_EXPIRED) {
 766                 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
 767                     security_xfrm_state_pol_flow_match(x, pol, fl))
 768                         *error = -ESRCH;
 769         }
 770 }
 771
 772 struct xfrm_state *
 773 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 774                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 775                 struct xfrm_policy *pol, int *err,
 776                 unsigned short family)
 777 {
 778         static xfrm_address_t saddr_wildcard = { };
 779         struct net *net = xp_net(pol);
 780         unsigned int h, h_wildcard;
 781         struct hlist_node *entry;
 782         struct xfrm_state *x, *x0, *to_put;
 783         int acquire_in_progress = 0;
 784         int error = 0;
 785         struct xfrm_state *best = NULL;
 786
 787         to_put = NULL;
 788
 789         spin_lock_bh(&xfrm_state_lock);
 790         h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, family);
 791         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
 792                 if (x->props.family == family &&
 793                     x->props.reqid == tmpl->reqid &&
 794                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 795                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 796                     tmpl->mode == x->props.mode &&
 797                     tmpl->id.proto == x->id.proto &&
 798                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
 799                         xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
 800                                            &best, &acquire_in_progress, &error);
 801         }
 802         if (best)
 803                 goto found;
 804
 805         h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
 806         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
 807                 if (x->props.family == family &&
 808                     x->props.reqid == tmpl->reqid &&
 809                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 810                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 811                     tmpl->mode == x->props.mode &&
 812                     tmpl->id.proto == x->id.proto &&
 813                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
 814                         xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
 815                                            &best, &acquire_in_progress, &error);
 816         }
 817
 818 found:
 819         x = best;
 820         if (!x && !error && !acquire_in_progress) {
 821                 if (tmpl->id.spi &&
 822                     (x0 = __xfrm_state_lookup(net, daddr, tmpl->id.spi,
 823                                               tmpl->id.proto, family)) != NULL) {
 824                         to_put = x0;
 825                         error = -EEXIST;
 826                         goto out;
 827                 }
 828                 x = xfrm_state_alloc(net);
 829                 if (x == NULL) {
 830                         error = -ENOMEM;
 831                         goto out;
 832                 }
 833                 /* Initialize temporary selector matching only
 834                  * to current session. */
 835                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 836
 837                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
 838                 if (error) {
 839                         x->km.state = XFRM_STATE_DEAD;
 840                         to_put = x;
 841                         x = NULL;
 842                         goto out;
 843                 }
 844
 845                 if (km_query(x, tmpl, pol) == 0) {
 846                         x->km.state = XFRM_STATE_ACQ;
 847                         list_add(&x->km.all, &net->xfrm.state_all);
 848                         hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
 849                         h = xfrm_src_hash(net, daddr, saddr, family);
 850                         hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
 851                         if (x->id.spi) {
 852                                 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, family);
 853                                 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
 854                         }
 855                         x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
 856                         tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
 857                         net->xfrm.state_num++;
 858                         xfrm_hash_grow_check(net, x->bydst.next != NULL);
 859                 } else {
 860                         x->km.state = XFRM_STATE_DEAD;
 861                         to_put = x;
 862                         x = NULL;
 863                         error = -ESRCH;
 864                 }
 865         }
 866 out:
 867         if (x)
 868                 xfrm_state_hold(x);
 869         else
 870                 *err = acquire_in_progress ? -EAGAIN : error;
 871         spin_unlock_bh(&xfrm_state_lock);
 872         if (to_put)
 873                 xfrm_state_put(to_put);
 874         return x;
 875 }
 876
 877 struct xfrm_state *
 878 xfrm_stateonly_find(struct net *net,
 879                     xfrm_address_t *daddr, xfrm_address_t *saddr,
 880                     unsigned short family, u8 mode, u8 proto, u32 reqid)
 881 {
 882         unsigned int h;
 883         struct xfrm_state *rx = NULL, *x = NULL;
 884         struct hlist_node *entry;
 885
 886         spin_lock(&xfrm_state_lock);
 887         h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
 888         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
 889                 if (x->props.family == family &&
 890                     x->props.reqid == reqid &&
 891                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 892                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 893                     mode == x->props.mode &&
 894                     proto == x->id.proto &&
 895                     x->km.state == XFRM_STATE_VALID) {
 896                         rx = x;
 897                         break;
 898                 }
 899         }
 900
 901         if (rx)
 902                 xfrm_state_hold(rx);
 903         spin_unlock(&xfrm_state_lock);
 904
 905
 906         return rx;
 907 }
 908 EXPORT_SYMBOL(xfrm_stateonly_find);
 909
 910 static void __xfrm_state_insert(struct xfrm_state *x)
 911 {
 912         struct net *net = xs_net(x);
 913         unsigned int h;
 914
 915         x->genid = ++xfrm_state_genid;
 916
 917         list_add(&x->km.all, &net->xfrm.state_all);
 918
 919         h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
 920                           x->props.reqid, x->props.family);
 921         hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
 922
 923         h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
 924         hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
 925
 926         if (x->id.spi) {
 927                 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
 928                                   x->props.family);
 929
 930                 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
 931         }
 932
 933         tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
 934         if (x->replay_maxage)
 935                 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
 936
 937         wake_up(&net->xfrm.km_waitq);
 938
 939         net->xfrm.state_num++;
 940
 941         xfrm_hash_grow_check(net, x->bydst.next != NULL);
 942 }
 943
 944 /* xfrm_state_lock is held */
 945 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 946 {
 947         struct net *net = xs_net(xnew);
 948         unsigned short family = xnew->props.family;
 949         u32 reqid = xnew->props.reqid;
 950         struct xfrm_state *x;
 951         struct hlist_node *entry;
 952         unsigned int h;
 953
 954         h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
 955         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
 956                 if (x->props.family     == family &&
 957                     x->props.reqid      == reqid &&
 958                     !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
 959                     !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
 960                         x->genid = xfrm_state_genid;
 961         }
 962 }
 963
 964 void xfrm_state_insert(struct xfrm_state *x)
 965 {
 966         spin_lock_bh(&xfrm_state_lock);
 967         __xfrm_state_bump_genids(x);
 968         __xfrm_state_insert(x);
 969         spin_unlock_bh(&xfrm_state_lock);
 970 }
 971 EXPORT_SYMBOL(xfrm_state_insert);
 972
 973 /* xfrm_state_lock is held */
 974 static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
 975 {
 976         unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
 977         struct hlist_node *entry;
 978         struct xfrm_state *x;
 979
 980         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
 981                 if (x->props.reqid  != reqid ||
 982                     x->props.mode   != mode ||
 983                     x->props.family != family ||
 984                     x->km.state     != XFRM_STATE_ACQ ||
 985                     x->id.spi       != 0 ||
 986                     x->id.proto     != proto ||
 987                     xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
 988                     xfrm_addr_cmp(&x->props.saddr, saddr, family))
 989                         continue;
 990
 991                 xfrm_state_hold(x);
 992                 return x;
 993         }
 994
 995         if (!create)
 996                 return NULL;
 997
 998         x = xfrm_state_alloc(net);
 999         if (likely(x)) {
1000                 switch (family) {
1001                 case AF_INET:
1002                         x->sel.daddr.a4 = daddr->a4;
1003                         x->sel.saddr.a4 = saddr->a4;
1004                         x->sel.prefixlen_d = 32;
1005                         x->sel.prefixlen_s = 32;
1006                         x->props.saddr.a4 = saddr->a4;
1007                         x->id.daddr.a4 = daddr->a4;
1008                         break;
1009
1010                 case AF_INET6:
1011                         ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1012                                        (struct in6_addr *)daddr);
1013                         ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1014                                        (struct in6_addr *)saddr);
1015                         x->sel.prefixlen_d = 128;
1016                         x->sel.prefixlen_s = 128;
1017                         ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1018                                        (struct in6_addr *)saddr);
1019                         ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1020                                        (struct in6_addr *)daddr);
1021                         break;
1022                 }
1023
1024                 x->km.state = XFRM_STATE_ACQ;
1025                 x->id.proto = proto;
1026                 x->props.family = family;
1027                 x->props.mode = mode;
1028                 x->props.reqid = reqid;
1029                 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
1030                 xfrm_state_hold(x);
1031                 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
1032                 list_add(&x->km.all, &net->xfrm.state_all);
1033                 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
1034                 h = xfrm_src_hash(net, daddr, saddr, family);
1035                 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
1036
1037                 net->xfrm.state_num++;
1038
1039                 xfrm_hash_grow_check(net, x->bydst.next != NULL);
1040         }
1041
1042         return x;
1043 }
1044
1045 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq);
1046
1047 int xfrm_state_add(struct xfrm_state *x)
1048 {
1049         struct net *net = xs_net(x);
1050         struct xfrm_state *x1, *to_put;
1051         int family;
1052         int err;
1053         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1054
1055         family = x->props.family;
1056
1057         to_put = NULL;
1058
1059         spin_lock_bh(&xfrm_state_lock);
1060
1061         x1 = __xfrm_state_locate(x, use_spi, family);
1062         if (x1) {
1063                 to_put = x1;
1064                 x1 = NULL;
1065                 err = -EEXIST;
1066                 goto out;
1067         }
1068
1069         if (use_spi && x->km.seq) {
1070                 x1 = __xfrm_find_acq_byseq(net, x->km.seq);
1071                 if (x1 && ((x1->id.proto != x->id.proto) ||
1072                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1073                         to_put = x1;
1074                         x1 = NULL;
1075                 }
1076         }
1077
1078         if (use_spi && !x1)
1079                 x1 = __find_acq_core(net, family, x->props.mode, x->props.reqid,
1080                                      x->id.proto,
1081                                      &x->id.daddr, &x->props.saddr, 0);
1082
1083         __xfrm_state_bump_genids(x);
1084         __xfrm_state_insert(x);
1085         err = 0;
1086
1087 out:
1088         spin_unlock_bh(&xfrm_state_lock);
1089
1090         if (x1) {
1091                 xfrm_state_delete(x1);
1092                 xfrm_state_put(x1);
1093         }
1094
1095         if (to_put)
1096                 xfrm_state_put(to_put);
1097
1098         return err;
1099 }
1100 EXPORT_SYMBOL(xfrm_state_add);
1101
1102 #ifdef CONFIG_XFRM_MIGRATE
1103 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1104 {
1105         struct net *net = xs_net(orig);
1106         int err = -ENOMEM;
1107         struct xfrm_state *x = xfrm_state_alloc(net);
1108         if (!x)
1109                 goto error;
1110
1111         memcpy(&x->id, &orig->id, sizeof(x->id));
1112         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1113         memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1114         x->props.mode = orig->props.mode;
1115         x->props.replay_window = orig->props.replay_window;
1116         x->props.reqid = orig->props.reqid;
1117         x->props.family = orig->props.family;
1118         x->props.saddr = orig->props.saddr;
1119
1120         if (orig->aalg) {
1121                 x->aalg = xfrm_algo_auth_clone(orig->aalg);
1122                 if (!x->aalg)
1123                         goto error;
1124         }
1125         x->props.aalgo = orig->props.aalgo;
1126
1127         if (orig->ealg) {
1128                 x->ealg = xfrm_algo_clone(orig->ealg);
1129                 if (!x->ealg)
1130                         goto error;
1131         }
1132         x->props.ealgo = orig->props.ealgo;
1133
1134         if (orig->calg) {
1135                 x->calg = xfrm_algo_clone(orig->calg);
1136                 if (!x->calg)
1137                         goto error;
1138         }
1139         x->props.calgo = orig->props.calgo;
1140
1141         if (orig->encap) {
1142                 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1143                 if (!x->encap)
1144                         goto error;
1145         }
1146
1147         if (orig->coaddr) {
1148                 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1149                                     GFP_KERNEL);
1150                 if (!x->coaddr)
1151                         goto error;
1152         }
1153
1154         err = xfrm_init_state(x);
1155         if (err)
1156                 goto error;
1157
1158         x->props.flags = orig->props.flags;
1159
1160         x->curlft.add_time = orig->curlft.add_time;
1161         x->km.state = orig->km.state;
1162         x->km.seq = orig->km.seq;
1163
1164         return x;
1165
1166  error:
1167         if (errp)
1168                 *errp = err;
1169         if (x) {
1170                 kfree(x->aalg);
1171                 kfree(x->ealg);
1172                 kfree(x->calg);
1173                 kfree(x->encap);
1174                 kfree(x->coaddr);
1175         }
1176         kfree(x);
1177         return NULL;
1178 }
1179
1180 /* xfrm_state_lock is held */
1181 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1182 {
1183         unsigned int h;
1184         struct xfrm_state *x;
1185         struct hlist_node *entry;
1186
1187         if (m->reqid) {
1188                 h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr,
1189                                   m->reqid, m->old_family);
1190                 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
1191                         if (x->props.mode != m->mode ||
1192                             x->id.proto != m->proto)
1193                                 continue;
1194                         if (m->reqid && x->props.reqid != m->reqid)
1195                                 continue;
1196                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1197                                           m->old_family) ||
1198                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1199                                           m->old_family))
1200                                 continue;
1201                         xfrm_state_hold(x);
1202                         return x;
1203                 }
1204         } else {
1205                 h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr,
1206                                   m->old_family);
1207                 hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
1208                         if (x->props.mode != m->mode ||
1209                             x->id.proto != m->proto)
1210                                 continue;
1211                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1212                                           m->old_family) ||
1213                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1214                                           m->old_family))
1215                                 continue;
1216                         xfrm_state_hold(x);
1217                         return x;
1218                 }
1219         }
1220
1221         return NULL;
1222 }
1223 EXPORT_SYMBOL(xfrm_migrate_state_find);
1224
1225 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1226                                        struct xfrm_migrate *m)
1227 {
1228         struct xfrm_state *xc;
1229         int err;
1230
1231         xc = xfrm_state_clone(x, &err);
1232         if (!xc)
1233                 return NULL;
1234
1235         memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1236         memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1237
1238         /* add state */
1239         if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1240                 /* a care is needed when the destination address of the
1241                    state is to be updated as it is a part of triplet */
1242                 xfrm_state_insert(xc);
1243         } else {
1244                 if ((err = xfrm_state_add(xc)) < 0)
1245                         goto error;
1246         }
1247
1248         return xc;
1249 error:
1250         kfree(xc);
1251         return NULL;
1252 }
1253 EXPORT_SYMBOL(xfrm_state_migrate);
1254 #endif
1255
1256 int xfrm_state_update(struct xfrm_state *x)
1257 {
1258         struct xfrm_state *x1, *to_put;
1259         int err;
1260         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1261
1262         to_put = NULL;
1263
1264         spin_lock_bh(&xfrm_state_lock);
1265         x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1266
1267         err = -ESRCH;
1268         if (!x1)
1269                 goto out;
1270
1271         if (xfrm_state_kern(x1)) {
1272                 to_put = x1;
1273                 err = -EEXIST;
1274                 goto out;
1275         }
1276
1277         if (x1->km.state == XFRM_STATE_ACQ) {
1278                 __xfrm_state_insert(x);
1279                 x = NULL;
1280         }
1281         err = 0;
1282
1283 out:
1284         spin_unlock_bh(&xfrm_state_lock);
1285
1286         if (to_put)
1287                 xfrm_state_put(to_put);
1288
1289         if (err)
1290                 return err;
1291
1292         if (!x) {
1293                 xfrm_state_delete(x1);
1294                 xfrm_state_put(x1);
1295                 return 0;
1296         }
1297
1298         err = -EINVAL;
1299         spin_lock_bh(&x1->lock);
1300         if (likely(x1->km.state == XFRM_STATE_VALID)) {
1301                 if (x->encap && x1->encap)
1302                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1303                 if (x->coaddr && x1->coaddr) {
1304                         memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1305                 }
1306                 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1307                         memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1308                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1309                 x1->km.dying = 0;
1310
1311                 tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
1312                 if (x1->curlft.use_time)
1313                         xfrm_state_check_expire(x1);
1314
1315                 err = 0;
1316         }
1317         spin_unlock_bh(&x1->lock);
1318
1319         xfrm_state_put(x1);
1320
1321         return err;
1322 }
1323 EXPORT_SYMBOL(xfrm_state_update);
1324
1325 int xfrm_state_check_expire(struct xfrm_state *x)
1326 {
1327         if (!x->curlft.use_time)
1328                 x->curlft.use_time = get_seconds();
1329
1330         if (x->km.state != XFRM_STATE_VALID)
1331                 return -EINVAL;
1332
1333         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1334             x->curlft.packets >= x->lft.hard_packet_limit) {
1335                 x->km.state = XFRM_STATE_EXPIRED;
1336                 tasklet_hrtimer_start(&x->mtimer, ktime_set(0,0), HRTIMER_MODE_REL);
1337                 return -EINVAL;
1338         }
1339
1340         if (!x->km.dying &&
1341             (x->curlft.bytes >= x->lft.soft_byte_limit ||
1342              x->curlft.packets >= x->lft.soft_packet_limit)) {
1343                 x->km.dying = 1;
1344                 km_state_expired(x, 0, 0);
1345         }
1346         return 0;
1347 }
1348 EXPORT_SYMBOL(xfrm_state_check_expire);
1349
1350 struct xfrm_state *
1351 xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto,
1352                   unsigned short family)
1353 {
1354         struct xfrm_state *x;
1355
1356         spin_lock_bh(&xfrm_state_lock);
1357         x = __xfrm_state_lookup(net, daddr, spi, proto, family);
1358         spin_unlock_bh(&xfrm_state_lock);
1359         return x;
1360 }
1361 EXPORT_SYMBOL(xfrm_state_lookup);
1362
1363 struct xfrm_state *
1364 xfrm_state_lookup_byaddr(struct net *net,
1365                          xfrm_address_t *daddr, xfrm_address_t *saddr,
1366                          u8 proto, unsigned short family)
1367 {
1368         struct xfrm_state *x;
1369
1370         spin_lock_bh(&xfrm_state_lock);
1371         x = __xfrm_state_lookup_byaddr(net, daddr, saddr, proto, family);
1372         spin_unlock_bh(&xfrm_state_lock);
1373         return x;
1374 }
1375 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1376
1377 struct xfrm_state *
1378 xfrm_find_acq(struct net *net, u8 mode, u32 reqid, u8 proto,
1379               xfrm_address_t *daddr, xfrm_address_t *saddr,
1380               int create, unsigned short family)
1381 {
1382         struct xfrm_state *x;
1383
1384         spin_lock_bh(&xfrm_state_lock);
1385         x = __find_acq_core(net, family, mode, reqid, proto, daddr, saddr, create);
1386         spin_unlock_bh(&xfrm_state_lock);
1387
1388         return x;
1389 }
1390 EXPORT_SYMBOL(xfrm_find_acq);
1391
1392 #ifdef CONFIG_XFRM_SUB_POLICY
1393 int
1394 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1395                unsigned short family)
1396 {
1397         int err = 0;
1398         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1399         if (!afinfo)
1400                 return -EAFNOSUPPORT;
1401
1402         spin_lock_bh(&xfrm_state_lock);
1403         if (afinfo->tmpl_sort)
1404                 err = afinfo->tmpl_sort(dst, src, n);
1405         spin_unlock_bh(&xfrm_state_lock);
1406         xfrm_state_put_afinfo(afinfo);
1407         return err;
1408 }
1409 EXPORT_SYMBOL(xfrm_tmpl_sort);
1410
1411 int
1412 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1413                 unsigned short family)
1414 {
1415         int err = 0;
1416         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1417         if (!afinfo)
1418                 return -EAFNOSUPPORT;
1419
1420         spin_lock_bh(&xfrm_state_lock);
1421         if (afinfo->state_sort)
1422                 err = afinfo->state_sort(dst, src, n);
1423         spin_unlock_bh(&xfrm_state_lock);
1424         xfrm_state_put_afinfo(afinfo);
1425         return err;
1426 }
1427 EXPORT_SYMBOL(xfrm_state_sort);
1428 #endif
1429
1430 /* Silly enough, but I'm lazy to build resolution list */
1431
1432 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq)
1433 {
1434         int i;
1435
1436         for (i = 0; i <= net->xfrm.state_hmask; i++) {
1437                 struct hlist_node *entry;
1438                 struct xfrm_state *x;
1439
1440                 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
1441                         if (x->km.seq == seq &&
1442                             x->km.state == XFRM_STATE_ACQ) {
1443                                 xfrm_state_hold(x);
1444                                 return x;
1445                         }
1446                 }
1447         }
1448         return NULL;
1449 }
1450
1451 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 seq)
1452 {
1453         struct xfrm_state *x;
1454
1455         spin_lock_bh(&xfrm_state_lock);
1456         x = __xfrm_find_acq_byseq(net, seq);
1457         spin_unlock_bh(&xfrm_state_lock);
1458         return x;
1459 }
1460 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1461
1462 u32 xfrm_get_acqseq(void)
1463 {
1464         u32 res;
1465         static u32 acqseq;
1466         static DEFINE_SPINLOCK(acqseq_lock);
1467
1468         spin_lock_bh(&acqseq_lock);
1469         res = (++acqseq ? : ++acqseq);
1470         spin_unlock_bh(&acqseq_lock);
1471         return res;
1472 }
1473 EXPORT_SYMBOL(xfrm_get_acqseq);
1474
1475 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1476 {
1477         struct net *net = xs_net(x);
1478         unsigned int h;
1479         struct xfrm_state *x0;
1480         int err = -ENOENT;
1481         __be32 minspi = htonl(low);
1482         __be32 maxspi = htonl(high);
1483
1484         spin_lock_bh(&x->lock);
1485         if (x->km.state == XFRM_STATE_DEAD)
1486                 goto unlock;
1487
1488         err = 0;
1489         if (x->id.spi)
1490                 goto unlock;
1491
1492         err = -ENOENT;
1493
1494         if (minspi == maxspi) {
1495                 x0 = xfrm_state_lookup(net, &x->id.daddr, minspi, x->id.proto, x->props.family);
1496                 if (x0) {
1497                         xfrm_state_put(x0);
1498                         goto unlock;
1499                 }
1500                 x->id.spi = minspi;
1501         } else {
1502                 u32 spi = 0;
1503                 for (h=0; h<high-low+1; h++) {
1504                         spi = low + net_random()%(high-low+1);
1505                         x0 = xfrm_state_lookup(net, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1506                         if (x0 == NULL) {
1507                                 x->id.spi = htonl(spi);
1508                                 break;
1509                         }
1510                         xfrm_state_put(x0);
1511                 }
1512         }
1513         if (x->id.spi) {
1514                 spin_lock_bh(&xfrm_state_lock);
1515                 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1516                 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
1517                 spin_unlock_bh(&xfrm_state_lock);
1518
1519                 err = 0;
1520         }
1521
1522 unlock:
1523         spin_unlock_bh(&x->lock);
1524
1525         return err;
1526 }
1527 EXPORT_SYMBOL(xfrm_alloc_spi);
1528
1529 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1530                     int (*func)(struct xfrm_state *, int, void*),
1531                     void *data)
1532 {
1533         struct xfrm_state *state;
1534         struct xfrm_state_walk *x;
1535         int err = 0;
1536
1537         if (walk->seq != 0 && list_empty(&walk->all))
1538                 return 0;
1539
1540         spin_lock_bh(&xfrm_state_lock);
1541         if (list_empty(&walk->all))
1542                 x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
1543         else
1544                 x = list_entry(&walk->all, struct xfrm_state_walk, all);
1545         list_for_each_entry_from(x, &net->xfrm.state_all, all) {
1546                 if (x->state == XFRM_STATE_DEAD)
1547                         continue;
1548                 state = container_of(x, struct xfrm_state, km);
1549                 if (!xfrm_id_proto_match(state->id.proto, walk->proto))
1550                         continue;
1551                 err = func(state, walk->seq, data);
1552                 if (err) {
1553                         list_move_tail(&walk->all, &x->all);
1554                         goto out;
1555                 }
1556                 walk->seq++;
1557         }
1558         if (walk->seq == 0) {
1559                 err = -ENOENT;
1560                 goto out;
1561         }
1562         list_del_init(&walk->all);
1563 out:
1564         spin_unlock_bh(&xfrm_state_lock);
1565         return err;
1566 }
1567 EXPORT_SYMBOL(xfrm_state_walk);
1568
1569 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
1570 {
1571         INIT_LIST_HEAD(&walk->all);
1572         walk->proto = proto;
1573         walk->state = XFRM_STATE_DEAD;
1574         walk->seq = 0;
1575 }
1576 EXPORT_SYMBOL(xfrm_state_walk_init);
1577
1578 void xfrm_state_walk_done(struct xfrm_state_walk *walk)
1579 {
1580         if (list_empty(&walk->all))
1581                 return;
1582
1583         spin_lock_bh(&xfrm_state_lock);
1584         list_del(&walk->all);
1585         spin_unlock_bh(&xfrm_state_lock);
1586 }
1587 EXPORT_SYMBOL(xfrm_state_walk_done);
1588
1589
1590 void xfrm_replay_notify(struct xfrm_state *x, int event)
1591 {
1592         struct km_event c;
1593         /* we send notify messages in case
1594          *  1. we updated on of the sequence numbers, and the seqno difference
1595          *     is at least x->replay_maxdiff, in this case we also update the
1596          *     timeout of our timer function
1597          *  2. if x->replay_maxage has elapsed since last update,
1598          *     and there were changes
1599          *
1600          *  The state structure must be locked!
1601          */
1602
1603         switch (event) {
1604         case XFRM_REPLAY_UPDATE:
1605                 if (x->replay_maxdiff &&
1606                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1607                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1608                         if (x->xflags & XFRM_TIME_DEFER)
1609                                 event = XFRM_REPLAY_TIMEOUT;
1610                         else
1611                                 return;
1612                 }
1613
1614                 break;
1615
1616         case XFRM_REPLAY_TIMEOUT:
1617                 if ((x->replay.seq == x->preplay.seq) &&
1618                     (x->replay.bitmap == x->preplay.bitmap) &&
1619                     (x->replay.oseq == x->preplay.oseq)) {
1620                         x->xflags |= XFRM_TIME_DEFER;
1621                         return;
1622                 }
1623
1624                 break;
1625         }
1626
1627         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1628         c.event = XFRM_MSG_NEWAE;
1629         c.data.aevent = event;
1630         km_state_notify(x, &c);
1631
1632         if (x->replay_maxage &&
1633             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1634                 x->xflags &= ~XFRM_TIME_DEFER;
1635 }
1636
1637 static void xfrm_replay_timer_handler(unsigned long data)
1638 {
1639         struct xfrm_state *x = (struct xfrm_state*)data;
1640
1641         spin_lock(&x->lock);
1642
1643         if (x->km.state == XFRM_STATE_VALID) {
1644                 if (xfrm_aevent_is_on(xs_net(x)))
1645                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1646                 else
1647                         x->xflags |= XFRM_TIME_DEFER;
1648         }
1649
1650         spin_unlock(&x->lock);
1651 }
1652
1653 int xfrm_replay_check(struct xfrm_state *x,
1654                       struct sk_buff *skb, __be32 net_seq)
1655 {
1656         u32 diff;
1657         u32 seq = ntohl(net_seq);
1658
1659         if (unlikely(seq == 0))
1660                 goto err;
1661
1662         if (likely(seq > x->replay.seq))
1663                 return 0;
1664
1665         diff = x->replay.seq - seq;
1666         if (diff >= min_t(unsigned int, x->props.replay_window,
1667                           sizeof(x->replay.bitmap) * 8)) {
1668                 x->stats.replay_window++;
1669                 goto err;
1670         }
1671
1672         if (x->replay.bitmap & (1U << diff)) {
1673                 x->stats.replay++;
1674                 goto err;
1675         }
1676         return 0;
1677
1678 err:
1679         xfrm_audit_state_replay(x, skb, net_seq);
1680         return -EINVAL;
1681 }
1682
1683 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1684 {
1685         u32 diff;
1686         u32 seq = ntohl(net_seq);
1687
1688         if (seq > x->replay.seq) {
1689                 diff = seq - x->replay.seq;
1690                 if (diff < x->props.replay_window)
1691                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1692                 else
1693                         x->replay.bitmap = 1;
1694                 x->replay.seq = seq;
1695         } else {
1696                 diff = x->replay.seq - seq;
1697                 x->replay.bitmap |= (1U << diff);
1698         }
1699
1700         if (xfrm_aevent_is_on(xs_net(x)))
1701                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1702 }
1703
1704 static LIST_HEAD(xfrm_km_list);
1705 static DEFINE_RWLOCK(xfrm_km_lock);
1706
1707 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1708 {
1709         struct xfrm_mgr *km;
1710
1711         read_lock(&xfrm_km_lock);
1712         list_for_each_entry(km, &xfrm_km_list, list)
1713                 if (km->notify_policy)
1714                         km->notify_policy(xp, dir, c);
1715         read_unlock(&xfrm_km_lock);
1716 }
1717
1718 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1719 {
1720         struct xfrm_mgr *km;
1721         read_lock(&xfrm_km_lock);
1722         list_for_each_entry(km, &xfrm_km_list, list)
1723                 if (km->notify)
1724                         km->notify(x, c);
1725         read_unlock(&xfrm_km_lock);
1726 }
1727
1728 EXPORT_SYMBOL(km_policy_notify);
1729 EXPORT_SYMBOL(km_state_notify);
1730
1731 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1732 {
1733         struct net *net = xs_net(x);
1734         struct km_event c;
1735
1736         c.data.hard = hard;
1737         c.pid = pid;
1738         c.event = XFRM_MSG_EXPIRE;
1739         km_state_notify(x, &c);
1740
1741         if (hard)
1742                 wake_up(&net->xfrm.km_waitq);
1743 }
1744
1745 EXPORT_SYMBOL(km_state_expired);
1746 /*
1747  * We send to all registered managers regardless of failure
1748  * We are happy with one success
1749 */
1750 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1751 {
1752         int err = -EINVAL, acqret;
1753         struct xfrm_mgr *km;
1754
1755         read_lock(&xfrm_km_lock);
1756         list_for_each_entry(km, &xfrm_km_list, list) {
1757                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1758                 if (!acqret)
1759                         err = acqret;
1760         }
1761         read_unlock(&xfrm_km_lock);
1762         return err;
1763 }
1764 EXPORT_SYMBOL(km_query);
1765
1766 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1767 {
1768         int err = -EINVAL;
1769         struct xfrm_mgr *km;
1770
1771         read_lock(&xfrm_km_lock);
1772         list_for_each_entry(km, &xfrm_km_list, list) {
1773                 if (km->new_mapping)
1774                         err = km->new_mapping(x, ipaddr, sport);
1775                 if (!err)
1776                         break;
1777         }
1778         read_unlock(&xfrm_km_lock);
1779         return err;
1780 }
1781 EXPORT_SYMBOL(km_new_mapping);
1782
1783 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1784 {
1785         struct net *net = xp_net(pol);
1786         struct km_event c;
1787
1788         c.data.hard = hard;
1789         c.pid = pid;
1790         c.event = XFRM_MSG_POLEXPIRE;
1791         km_policy_notify(pol, dir, &c);
1792
1793         if (hard)
1794                 wake_up(&net->xfrm.km_waitq);
1795 }
1796 EXPORT_SYMBOL(km_policy_expired);
1797
1798 #ifdef CONFIG_XFRM_MIGRATE
1799 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1800                struct xfrm_migrate *m, int num_migrate,
1801                struct xfrm_kmaddress *k)
1802 {
1803         int err = -EINVAL;
1804         int ret;
1805         struct xfrm_mgr *km;
1806
1807         read_lock(&xfrm_km_lock);
1808         list_for_each_entry(km, &xfrm_km_list, list) {
1809                 if (km->migrate) {
1810                         ret = km->migrate(sel, dir, type, m, num_migrate, k);
1811                         if (!ret)
1812                                 err = ret;
1813                 }
1814         }
1815         read_unlock(&xfrm_km_lock);
1816         return err;
1817 }
1818 EXPORT_SYMBOL(km_migrate);
1819 #endif
1820
1821 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1822 {
1823         int err = -EINVAL;
1824         int ret;
1825         struct xfrm_mgr *km;
1826
1827         read_lock(&xfrm_km_lock);
1828         list_for_each_entry(km, &xfrm_km_list, list) {
1829                 if (km->report) {
1830                         ret = km->report(net, proto, sel, addr);
1831                         if (!ret)
1832                                 err = ret;
1833                 }
1834         }
1835         read_unlock(&xfrm_km_lock);
1836         return err;
1837 }
1838 EXPORT_SYMBOL(km_report);
1839
1840 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1841 {
1842         int err;
1843         u8 *data;
1844         struct xfrm_mgr *km;
1845         struct xfrm_policy *pol = NULL;
1846
1847         if (optlen <= 0 || optlen > PAGE_SIZE)
1848                 return -EMSGSIZE;
1849
1850         data = kmalloc(optlen, GFP_KERNEL);
1851         if (!data)
1852                 return -ENOMEM;
1853
1854         err = -EFAULT;
1855         if (copy_from_user(data, optval, optlen))
1856                 goto out;
1857
1858         err = -EINVAL;
1859         read_lock(&xfrm_km_lock);
1860         list_for_each_entry(km, &xfrm_km_list, list) {
1861                 pol = km->compile_policy(sk, optname, data,
1862                                          optlen, &err);
1863                 if (err >= 0)
1864                         break;
1865         }
1866         read_unlock(&xfrm_km_lock);
1867
1868         if (err >= 0) {
1869                 xfrm_sk_policy_insert(sk, err, pol);
1870                 xfrm_pol_put(pol);
1871                 err = 0;
1872         }
1873
1874 out:
1875         kfree(data);
1876         return err;
1877 }
1878 EXPORT_SYMBOL(xfrm_user_policy);
1879
1880 int xfrm_register_km(struct xfrm_mgr *km)
1881 {
1882         write_lock_bh(&xfrm_km_lock);
1883         list_add_tail(&km->list, &xfrm_km_list);
1884         write_unlock_bh(&xfrm_km_lock);
1885         return 0;
1886 }
1887 EXPORT_SYMBOL(xfrm_register_km);
1888
1889 int xfrm_unregister_km(struct xfrm_mgr *km)
1890 {
1891         write_lock_bh(&xfrm_km_lock);
1892         list_del(&km->list);
1893         write_unlock_bh(&xfrm_km_lock);
1894         return 0;
1895 }
1896 EXPORT_SYMBOL(xfrm_unregister_km);
1897
1898 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1899 {
1900         int err = 0;
1901         if (unlikely(afinfo == NULL))
1902                 return -EINVAL;
1903         if (unlikely(afinfo->family >= NPROTO))
1904                 return -EAFNOSUPPORT;
1905         write_lock_bh(&xfrm_state_afinfo_lock);
1906         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1907                 err = -ENOBUFS;
1908         else
1909                 xfrm_state_afinfo[afinfo->family] = afinfo;
1910         write_unlock_bh(&xfrm_state_afinfo_lock);
1911         return err;
1912 }
1913 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1914
1915 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1916 {
1917         int err = 0;
1918         if (unlikely(afinfo == NULL))
1919                 return -EINVAL;
1920         if (unlikely(afinfo->family >= NPROTO))
1921                 return -EAFNOSUPPORT;
1922         write_lock_bh(&xfrm_state_afinfo_lock);
1923         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1924                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1925                         err = -EINVAL;
1926                 else
1927                         xfrm_state_afinfo[afinfo->family] = NULL;
1928         }
1929         write_unlock_bh(&xfrm_state_afinfo_lock);
1930         return err;
1931 }
1932 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1933
1934 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1935 {
1936         struct xfrm_state_afinfo *afinfo;
1937         if (unlikely(family >= NPROTO))
1938                 return NULL;
1939         read_lock(&xfrm_state_afinfo_lock);
1940         afinfo = xfrm_state_afinfo[family];
1941         if (unlikely(!afinfo))
1942                 read_unlock(&xfrm_state_afinfo_lock);
1943         return afinfo;
1944 }
1945
1946 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1947         __releases(xfrm_state_afinfo_lock)
1948 {
1949         read_unlock(&xfrm_state_afinfo_lock);
1950 }
1951
1952 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1953 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1954 {
1955         if (x->tunnel) {
1956                 struct xfrm_state *t = x->tunnel;
1957
1958                 if (atomic_read(&t->tunnel_users) == 2)
1959                         xfrm_state_delete(t);
1960                 atomic_dec(&t->tunnel_users);
1961                 xfrm_state_put(t);
1962                 x->tunnel = NULL;
1963         }
1964 }
1965 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1966
1967 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1968 {
1969         int res;
1970
1971         spin_lock_bh(&x->lock);
1972         if (x->km.state == XFRM_STATE_VALID &&
1973             x->type && x->type->get_mtu)
1974                 res = x->type->get_mtu(x, mtu);
1975         else
1976                 res = mtu - x->props.header_len;
1977         spin_unlock_bh(&x->lock);
1978         return res;
1979 }
1980
1981 int xfrm_init_state(struct xfrm_state *x)
1982 {
1983         struct xfrm_state_afinfo *afinfo;
1984         struct xfrm_mode *inner_mode;
1985         int family = x->props.family;
1986         int err;
1987
1988         err = -EAFNOSUPPORT;
1989         afinfo = xfrm_state_get_afinfo(family);
1990         if (!afinfo)
1991                 goto error;
1992
1993         err = 0;
1994         if (afinfo->init_flags)
1995                 err = afinfo->init_flags(x);
1996
1997         xfrm_state_put_afinfo(afinfo);
1998
1999         if (err)
2000                 goto error;
2001
2002         err = -EPROTONOSUPPORT;
2003
2004         if (x->sel.family != AF_UNSPEC) {
2005                 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2006                 if (inner_mode == NULL)
2007                         goto error;
2008
2009                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2010                     family != x->sel.family) {
2011                         xfrm_put_mode(inner_mode);
2012                         goto error;
2013                 }
2014
2015                 x->inner_mode = inner_mode;
2016         } else {
2017                 struct xfrm_mode *inner_mode_iaf;
2018                 int iafamily = AF_INET;
2019
2020                 inner_mode = xfrm_get_mode(x->props.mode, x->props.family);
2021                 if (inner_mode == NULL)
2022                         goto error;
2023
2024                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2025                         xfrm_put_mode(inner_mode);
2026                         goto error;
2027                 }
2028                 x->inner_mode = inner_mode;
2029
2030                 if (x->props.family == AF_INET)
2031                         iafamily = AF_INET6;
2032
2033                 inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily);
2034                 if (inner_mode_iaf) {
2035                         if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)
2036                                 x->inner_mode_iaf = inner_mode_iaf;
2037                         else
2038                                 xfrm_put_mode(inner_mode_iaf);
2039                 }
2040         }
2041
2042         x->type = xfrm_get_type(x->id.proto, family);
2043         if (x->type == NULL)
2044                 goto error;
2045
2046         err = x->type->init_state(x);
2047         if (err)
2048                 goto error;
2049
2050         x->outer_mode = xfrm_get_mode(x->props.mode, family);
2051         if (x->outer_mode == NULL)
2052                 goto error;
2053
2054         x->km.state = XFRM_STATE_VALID;
2055
2056 error:
2057         return err;
2058 }
2059
2060 EXPORT_SYMBOL(xfrm_init_state);
2061
2062 int __net_init xfrm_state_init(struct net *net)
2063 {
2064         unsigned int sz;
2065
2066         INIT_LIST_HEAD(&net->xfrm.state_all);
2067
2068         sz = sizeof(struct hlist_head) * 8;
2069
2070         net->xfrm.state_bydst = xfrm_hash_alloc(sz);
2071         if (!net->xfrm.state_bydst)
2072                 goto out_bydst;
2073         net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
2074         if (!net->xfrm.state_bysrc)
2075                 goto out_bysrc;
2076         net->xfrm.state_byspi = xfrm_hash_alloc(sz);
2077         if (!net->xfrm.state_byspi)
2078                 goto out_byspi;
2079         net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2080
2081         net->xfrm.state_num = 0;
2082         INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
2083         INIT_HLIST_HEAD(&net->xfrm.state_gc_list);
2084         INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
2085         init_waitqueue_head(&net->xfrm.km_waitq);
2086         return 0;
2087
2088 out_byspi:
2089         xfrm_hash_free(net->xfrm.state_bysrc, sz);
2090 out_bysrc:
2091         xfrm_hash_free(net->xfrm.state_bydst, sz);
2092 out_bydst:
2093         return -ENOMEM;
2094 }
2095
2096 void xfrm_state_fini(struct net *net)
2097 {
2098         struct xfrm_audit audit_info;
2099         unsigned int sz;
2100
2101         flush_work(&net->xfrm.state_hash_work);
2102         audit_info.loginuid = -1;
2103         audit_info.sessionid = -1;
2104         audit_info.secid = 0;
2105         xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info);
2106         flush_work(&net->xfrm.state_gc_work);
2107
2108         WARN_ON(!list_empty(&net->xfrm.state_all));
2109
2110         sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
2111         WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2112         xfrm_hash_free(net->xfrm.state_byspi, sz);
2113         WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2114         xfrm_hash_free(net->xfrm.state_bysrc, sz);
2115         WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2116         xfrm_hash_free(net->xfrm.state_bydst, sz);
2117 }
2118
2119 #ifdef CONFIG_AUDITSYSCALL
2120 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2121                                      struct audit_buffer *audit_buf)
2122 {
2123         struct xfrm_sec_ctx *ctx = x->security;
2124         u32 spi = ntohl(x->id.spi);
2125
2126         if (ctx)
2127                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2128                                  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2129
2130         switch(x->props.family) {
2131         case AF_INET:
2132                 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2133                                  &x->props.saddr.a4, &x->id.daddr.a4);
2134                 break;
2135         case AF_INET6:
2136                 audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
2137                                  x->props.saddr.a6, x->id.daddr.a6);
2138                 break;
2139         }
2140
2141         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2142 }
2143
2144 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2145                                       struct audit_buffer *audit_buf)
2146 {
2147         struct iphdr *iph4;
2148         struct ipv6hdr *iph6;
2149
2150         switch (family) {
2151         case AF_INET:
2152                 iph4 = ip_hdr(skb);
2153                 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2154                                  &iph4->saddr, &iph4->daddr);
2155                 break;
2156         case AF_INET6:
2157                 iph6 = ipv6_hdr(skb);
2158                 audit_log_format(audit_buf,
2159                                  " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2160                                  &iph6->saddr,&iph6->daddr,
2161                                  iph6->flow_lbl[0] & 0x0f,
2162                                  iph6->flow_lbl[1],
2163                                  iph6->flow_lbl[2]);
2164                 break;
2165         }
2166 }
2167
2168 void xfrm_audit_state_add(struct xfrm_state *x, int result,
2169                           uid_t auid, u32 sessionid, u32 secid)
2170 {
2171         struct audit_buffer *audit_buf;
2172
2173         audit_buf = xfrm_audit_start("SAD-add");
2174         if (audit_buf == NULL)
2175                 return;
2176         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2177         xfrm_audit_helper_sainfo(x, audit_buf);
2178         audit_log_format(audit_buf, " res=%u", result);
2179         audit_log_end(audit_buf);
2180 }
2181 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2182
2183 void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2184                              uid_t auid, u32 sessionid, u32 secid)
2185 {
2186         struct audit_buffer *audit_buf;
2187
2188         audit_buf = xfrm_audit_start("SAD-delete");
2189         if (audit_buf == NULL)
2190                 return;
2191         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2192         xfrm_audit_helper_sainfo(x, audit_buf);
2193         audit_log_format(audit_buf, " res=%u", result);
2194         audit_log_end(audit_buf);
2195 }
2196 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2197
2198 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2199                                       struct sk_buff *skb)
2200 {
2201         struct audit_buffer *audit_buf;
2202         u32 spi;
2203
2204         audit_buf = xfrm_audit_start("SA-replay-overflow");
2205         if (audit_buf == NULL)
2206                 return;
2207         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2208         /* don't record the sequence number because it's inherent in this kind
2209          * of audit message */
2210         spi = ntohl(x->id.spi);
2211         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2212         audit_log_end(audit_buf);
2213 }
2214 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2215
2216 static void xfrm_audit_state_replay(struct xfrm_state *x,
2217                              struct sk_buff *skb, __be32 net_seq)
2218 {
2219         struct audit_buffer *audit_buf;
2220         u32 spi;
2221
2222         audit_buf = xfrm_audit_start("SA-replayed-pkt");
2223         if (audit_buf == NULL)
2224                 return;
2225         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2226         spi = ntohl(x->id.spi);
2227         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2228                          spi, spi, ntohl(net_seq));
2229         audit_log_end(audit_buf);
2230 }
2231
2232 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2233 {
2234         struct audit_buffer *audit_buf;
2235
2236         audit_buf = xfrm_audit_start("SA-notfound");
2237         if (audit_buf == NULL)
2238                 return;
2239         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2240         audit_log_end(audit_buf);
2241 }
2242 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2243
2244 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2245                                __be32 net_spi, __be32 net_seq)
2246 {
2247         struct audit_buffer *audit_buf;
2248         u32 spi;
2249
2250         audit_buf = xfrm_audit_start("SA-notfound");
2251         if (audit_buf == NULL)
2252                 return;
2253         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2254         spi = ntohl(net_spi);
2255         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2256                          spi, spi, ntohl(net_seq));
2257         audit_log_end(audit_buf);
2258 }
2259 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2260
2261 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2262                               struct sk_buff *skb, u8 proto)
2263 {
2264         struct audit_buffer *audit_buf;
2265         __be32 net_spi;
2266         __be32 net_seq;
2267
2268         audit_buf = xfrm_audit_start("SA-icv-failure");
2269         if (audit_buf == NULL)
2270                 return;
2271         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2272         if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2273                 u32 spi = ntohl(net_spi);
2274                 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2275                                  spi, spi, ntohl(net_seq));
2276         }
2277         audit_log_end(audit_buf);
2278 }
2279 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2280 #endif /* CONFIG_AUDITSYSCALL */