SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <linux/cache.h>
  22 #include <linux/audit.h>
  23 #include <asm/uaccess.h>
  24
  25 #include "xfrm_hash.h"
  26
  27 struct sock *xfrm_nl;
  28 EXPORT_SYMBOL(xfrm_nl);
  29
  30 u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
  31 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
  32
  33 u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
  34 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
  35
  36 u32 sysctl_xfrm_acq_expires __read_mostly = 30;
  37
  38 /* Each xfrm_state may be linked to two tables:
  39
  40    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  41    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
  42       destination/tunnel endpoint. (output)
  43  */
  44
  45 static DEFINE_SPINLOCK(xfrm_state_lock);
  46
  47 /* Hash table to find appropriate SA towards given target (endpoint
  48  * of tunnel or destination of transport mode) allowed by selector.
  49  *
  50  * Main use is finding SA after policy selected tunnel or transport mode.
  51  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  52  */
  53 static LIST_HEAD(xfrm_state_all);
  54 static struct hlist_head *xfrm_state_bydst __read_mostly;
  55 static struct hlist_head *xfrm_state_bysrc __read_mostly;
  56 static struct hlist_head *xfrm_state_byspi __read_mostly;
  57 static unsigned int xfrm_state_hmask __read_mostly;
  58 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
  59 static unsigned int xfrm_state_num;
  60 static unsigned int xfrm_state_genid;
  61
  62 /* Counter indicating ongoing walk, protected by xfrm_state_lock. */
  63 static unsigned long xfrm_state_walk_ongoing;
  64 /* Counter indicating walk completion, protected by xfrm_cfg_mutex. */
  65 static unsigned long xfrm_state_walk_completed;
  66
  67 /* List of outstanding state walks used to set the completed counter.  */
  68 static LIST_HEAD(xfrm_state_walks);
  69
  70 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
  71 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  72
  73 #ifdef CONFIG_AUDITSYSCALL
  74 static void xfrm_audit_state_replay(struct xfrm_state *x,
  75                                     struct sk_buff *skb, __be32 net_seq);
  76 #else
  77 #define xfrm_audit_state_replay(x, s, sq)       do { ; } while (0)
  78 #endif /* CONFIG_AUDITSYSCALL */
  79
  80 static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
  81                                          xfrm_address_t *saddr,
  82                                          u32 reqid,
  83                                          unsigned short family)
  84 {
  85         return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
  86 }
  87
  88 static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
  89                                          xfrm_address_t *saddr,
  90                                          unsigned short family)
  91 {
  92         return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
  93 }
  94
  95 static inline unsigned int
  96 xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
  97 {
  98         return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
  99 }
 100
 101 static void xfrm_hash_transfer(struct hlist_head *list,
 102                                struct hlist_head *ndsttable,
 103                                struct hlist_head *nsrctable,
 104                                struct hlist_head *nspitable,
 105                                unsigned int nhashmask)
 106 {
 107         struct hlist_node *entry, *tmp;
 108         struct xfrm_state *x;
 109
 110         hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
 111                 unsigned int h;
 112
 113                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 114                                     x->props.reqid, x->props.family,
 115                                     nhashmask);
 116                 hlist_add_head(&x->bydst, ndsttable+h);
 117
 118                 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
 119                                     x->props.family,
 120                                     nhashmask);
 121                 hlist_add_head(&x->bysrc, nsrctable+h);
 122
 123                 if (x->id.spi) {
 124                         h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
 125                                             x->id.proto, x->props.family,
 126                                             nhashmask);
 127                         hlist_add_head(&x->byspi, nspitable+h);
 128                 }
 129         }
 130 }
 131
 132 static unsigned long xfrm_hash_new_size(void)
 133 {
 134         return ((xfrm_state_hmask + 1) << 1) *
 135                 sizeof(struct hlist_head);
 136 }
 137
 138 static DEFINE_MUTEX(hash_resize_mutex);
 139
 140 static void xfrm_hash_resize(struct work_struct *__unused)
 141 {
 142         struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
 143         unsigned long nsize, osize;
 144         unsigned int nhashmask, ohashmask;
 145         int i;
 146
 147         mutex_lock(&hash_resize_mutex);
 148
 149         nsize = xfrm_hash_new_size();
 150         ndst = xfrm_hash_alloc(nsize);
 151         if (!ndst)
 152                 goto out_unlock;
 153         nsrc = xfrm_hash_alloc(nsize);
 154         if (!nsrc) {
 155                 xfrm_hash_free(ndst, nsize);
 156                 goto out_unlock;
 157         }
 158         nspi = xfrm_hash_alloc(nsize);
 159         if (!nspi) {
 160                 xfrm_hash_free(ndst, nsize);
 161                 xfrm_hash_free(nsrc, nsize);
 162                 goto out_unlock;
 163         }
 164
 165         spin_lock_bh(&xfrm_state_lock);
 166
 167         nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
 168         for (i = xfrm_state_hmask; i >= 0; i--)
 169                 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
 170                                    nhashmask);
 171
 172         odst = xfrm_state_bydst;
 173         osrc = xfrm_state_bysrc;
 174         ospi = xfrm_state_byspi;
 175         ohashmask = xfrm_state_hmask;
 176
 177         xfrm_state_bydst = ndst;
 178         xfrm_state_bysrc = nsrc;
 179         xfrm_state_byspi = nspi;
 180         xfrm_state_hmask = nhashmask;
 181
 182         spin_unlock_bh(&xfrm_state_lock);
 183
 184         osize = (ohashmask + 1) * sizeof(struct hlist_head);
 185         xfrm_hash_free(odst, osize);
 186         xfrm_hash_free(osrc, osize);
 187         xfrm_hash_free(ospi, osize);
 188
 189 out_unlock:
 190         mutex_unlock(&hash_resize_mutex);
 191 }
 192
 193 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
 194
 195 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
 196 EXPORT_SYMBOL(km_waitq);
 197
 198 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 199 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 200
 201 static struct work_struct xfrm_state_gc_work;
 202 static LIST_HEAD(xfrm_state_gc_leftovers);
 203 static LIST_HEAD(xfrm_state_gc_list);
 204 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 205
 206 int __xfrm_state_delete(struct xfrm_state *x);
 207
 208 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 209 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 210
 211 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
 212 {
 213         struct xfrm_state_afinfo *afinfo;
 214         if (unlikely(family >= NPROTO))
 215                 return NULL;
 216         write_lock_bh(&xfrm_state_afinfo_lock);
 217         afinfo = xfrm_state_afinfo[family];
 218         if (unlikely(!afinfo))
 219                 write_unlock_bh(&xfrm_state_afinfo_lock);
 220         return afinfo;
 221 }
 222
 223 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
 224         __releases(xfrm_state_afinfo_lock)
 225 {
 226         write_unlock_bh(&xfrm_state_afinfo_lock);
 227 }
 228
 229 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
 230 {
 231         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 232         const struct xfrm_type **typemap;
 233         int err = 0;
 234
 235         if (unlikely(afinfo == NULL))
 236                 return -EAFNOSUPPORT;
 237         typemap = afinfo->type_map;
 238
 239         if (likely(typemap[type->proto] == NULL))
 240                 typemap[type->proto] = type;
 241         else
 242                 err = -EEXIST;
 243         xfrm_state_unlock_afinfo(afinfo);
 244         return err;
 245 }
 246 EXPORT_SYMBOL(xfrm_register_type);
 247
 248 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
 249 {
 250         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 251         const struct xfrm_type **typemap;
 252         int err = 0;
 253
 254         if (unlikely(afinfo == NULL))
 255                 return -EAFNOSUPPORT;
 256         typemap = afinfo->type_map;
 257
 258         if (unlikely(typemap[type->proto] != type))
 259                 err = -ENOENT;
 260         else
 261                 typemap[type->proto] = NULL;
 262         xfrm_state_unlock_afinfo(afinfo);
 263         return err;
 264 }
 265 EXPORT_SYMBOL(xfrm_unregister_type);
 266
 267 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
 268 {
 269         struct xfrm_state_afinfo *afinfo;
 270         const struct xfrm_type **typemap;
 271         const struct xfrm_type *type;
 272         int modload_attempted = 0;
 273
 274 retry:
 275         afinfo = xfrm_state_get_afinfo(family);
 276         if (unlikely(afinfo == NULL))
 277                 return NULL;
 278         typemap = afinfo->type_map;
 279
 280         type = typemap[proto];
 281         if (unlikely(type && !try_module_get(type->owner)))
 282                 type = NULL;
 283         if (!type && !modload_attempted) {
 284                 xfrm_state_put_afinfo(afinfo);
 285                 request_module("xfrm-type-%d-%d", family, proto);
 286                 modload_attempted = 1;
 287                 goto retry;
 288         }
 289
 290         xfrm_state_put_afinfo(afinfo);
 291         return type;
 292 }
 293
 294 static void xfrm_put_type(const struct xfrm_type *type)
 295 {
 296         module_put(type->owner);
 297 }
 298
 299 int xfrm_register_mode(struct xfrm_mode *mode, int family)
 300 {
 301         struct xfrm_state_afinfo *afinfo;
 302         struct xfrm_mode **modemap;
 303         int err;
 304
 305         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 306                 return -EINVAL;
 307
 308         afinfo = xfrm_state_lock_afinfo(family);
 309         if (unlikely(afinfo == NULL))
 310                 return -EAFNOSUPPORT;
 311
 312         err = -EEXIST;
 313         modemap = afinfo->mode_map;
 314         if (modemap[mode->encap])
 315                 goto out;
 316
 317         err = -ENOENT;
 318         if (!try_module_get(afinfo->owner))
 319                 goto out;
 320
 321         mode->afinfo = afinfo;
 322         modemap[mode->encap] = mode;
 323         err = 0;
 324
 325 out:
 326         xfrm_state_unlock_afinfo(afinfo);
 327         return err;
 328 }
 329 EXPORT_SYMBOL(xfrm_register_mode);
 330
 331 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
 332 {
 333         struct xfrm_state_afinfo *afinfo;
 334         struct xfrm_mode **modemap;
 335         int err;
 336
 337         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 338                 return -EINVAL;
 339
 340         afinfo = xfrm_state_lock_afinfo(family);
 341         if (unlikely(afinfo == NULL))
 342                 return -EAFNOSUPPORT;
 343
 344         err = -ENOENT;
 345         modemap = afinfo->mode_map;
 346         if (likely(modemap[mode->encap] == mode)) {
 347                 modemap[mode->encap] = NULL;
 348                 module_put(mode->afinfo->owner);
 349                 err = 0;
 350         }
 351
 352         xfrm_state_unlock_afinfo(afinfo);
 353         return err;
 354 }
 355 EXPORT_SYMBOL(xfrm_unregister_mode);
 356
 357 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
 358 {
 359         struct xfrm_state_afinfo *afinfo;
 360         struct xfrm_mode *mode;
 361         int modload_attempted = 0;
 362
 363         if (unlikely(encap >= XFRM_MODE_MAX))
 364                 return NULL;
 365
 366 retry:
 367         afinfo = xfrm_state_get_afinfo(family);
 368         if (unlikely(afinfo == NULL))
 369                 return NULL;
 370
 371         mode = afinfo->mode_map[encap];
 372         if (unlikely(mode && !try_module_get(mode->owner)))
 373                 mode = NULL;
 374         if (!mode && !modload_attempted) {
 375                 xfrm_state_put_afinfo(afinfo);
 376                 request_module("xfrm-mode-%d-%d", family, encap);
 377                 modload_attempted = 1;
 378                 goto retry;
 379         }
 380
 381         xfrm_state_put_afinfo(afinfo);
 382         return mode;
 383 }
 384
 385 static void xfrm_put_mode(struct xfrm_mode *mode)
 386 {
 387         module_put(mode->owner);
 388 }
 389
 390 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 391 {
 392         del_timer_sync(&x->timer);
 393         del_timer_sync(&x->rtimer);
 394         kfree(x->aalg);
 395         kfree(x->ealg);
 396         kfree(x->calg);
 397         kfree(x->encap);
 398         kfree(x->coaddr);
 399         if (x->inner_mode)
 400                 xfrm_put_mode(x->inner_mode);
 401         if (x->inner_mode_iaf)
 402                 xfrm_put_mode(x->inner_mode_iaf);
 403         if (x->outer_mode)
 404                 xfrm_put_mode(x->outer_mode);
 405         if (x->type) {
 406                 x->type->destructor(x);
 407                 xfrm_put_type(x->type);
 408         }
 409         security_xfrm_state_free(x);
 410         kfree(x);
 411 }
 412
 413 static void xfrm_state_gc_task(struct work_struct *data)
 414 {
 415         struct xfrm_state *x, *tmp;
 416         unsigned long completed;
 417
 418         mutex_lock(&xfrm_cfg_mutex);
 419         spin_lock_bh(&xfrm_state_gc_lock);
 420         list_splice_tail_init(&xfrm_state_gc_list, &xfrm_state_gc_leftovers);
 421         spin_unlock_bh(&xfrm_state_gc_lock);
 422
 423         completed = xfrm_state_walk_completed;
 424         mutex_unlock(&xfrm_cfg_mutex);
 425
 426         list_for_each_entry_safe(x, tmp, &xfrm_state_gc_leftovers, gclist) {
 427                 if ((long)(x->lastused - completed) > 0)
 428                         break;
 429                 list_del(&x->gclist);
 430                 xfrm_state_gc_destroy(x);
 431         }
 432
 433         wake_up(&km_waitq);
 434 }
 435
 436 static inline unsigned long make_jiffies(long secs)
 437 {
 438         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 439                 return MAX_SCHEDULE_TIMEOUT-1;
 440         else
 441                 return secs*HZ;
 442 }
 443
 444 static void xfrm_timer_handler(unsigned long data)
 445 {
 446         struct xfrm_state *x = (struct xfrm_state*)data;
 447         unsigned long now = get_seconds();
 448         long next = LONG_MAX;
 449         int warn = 0;
 450         int err = 0;
 451
 452         spin_lock(&x->lock);
 453         if (x->km.state == XFRM_STATE_DEAD)
 454                 goto out;
 455         if (x->km.state == XFRM_STATE_EXPIRED)
 456                 goto expired;
 457         if (x->lft.hard_add_expires_seconds) {
 458                 long tmo = x->lft.hard_add_expires_seconds +
 459                         x->curlft.add_time - now;
 460                 if (tmo <= 0)
 461                         goto expired;
 462                 if (tmo < next)
 463                         next = tmo;
 464         }
 465         if (x->lft.hard_use_expires_seconds) {
 466                 long tmo = x->lft.hard_use_expires_seconds +
 467                         (x->curlft.use_time ? : now) - now;
 468                 if (tmo <= 0)
 469                         goto expired;
 470                 if (tmo < next)
 471                         next = tmo;
 472         }
 473         if (x->km.dying)
 474                 goto resched;
 475         if (x->lft.soft_add_expires_seconds) {
 476                 long tmo = x->lft.soft_add_expires_seconds +
 477                         x->curlft.add_time - now;
 478                 if (tmo <= 0)
 479                         warn = 1;
 480                 else if (tmo < next)
 481                         next = tmo;
 482         }
 483         if (x->lft.soft_use_expires_seconds) {
 484                 long tmo = x->lft.soft_use_expires_seconds +
 485                         (x->curlft.use_time ? : now) - now;
 486                 if (tmo <= 0)
 487                         warn = 1;
 488                 else if (tmo < next)
 489                         next = tmo;
 490         }
 491
 492         x->km.dying = warn;
 493         if (warn)
 494                 km_state_expired(x, 0, 0);
 495 resched:
 496         if (next != LONG_MAX)
 497                 mod_timer(&x->timer, jiffies + make_jiffies(next));
 498
 499         goto out;
 500
 501 expired:
 502         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 503                 x->km.state = XFRM_STATE_EXPIRED;
 504                 wake_up(&km_waitq);
 505                 next = 2;
 506                 goto resched;
 507         }
 508
 509         err = __xfrm_state_delete(x);
 510         if (!err && x->id.spi)
 511                 km_state_expired(x, 1, 0);
 512
 513         xfrm_audit_state_delete(x, err ? 0 : 1,
 514                                 audit_get_loginuid(current),
 515                                 audit_get_sessionid(current), 0);
 516
 517 out:
 518         spin_unlock(&x->lock);
 519 }
 520
 521 static void xfrm_replay_timer_handler(unsigned long data);
 522
 523 struct xfrm_state *xfrm_state_alloc(void)
 524 {
 525         struct xfrm_state *x;
 526
 527         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 528
 529         if (x) {
 530                 atomic_set(&x->refcnt, 1);
 531                 atomic_set(&x->tunnel_users, 0);
 532                 INIT_LIST_HEAD(&x->all);
 533                 INIT_HLIST_NODE(&x->bydst);
 534                 INIT_HLIST_NODE(&x->bysrc);
 535                 INIT_HLIST_NODE(&x->byspi);
 536                 setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
 537                 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
 538                                 (unsigned long)x);
 539                 x->curlft.add_time = get_seconds();
 540                 x->lft.soft_byte_limit = XFRM_INF;
 541                 x->lft.soft_packet_limit = XFRM_INF;
 542                 x->lft.hard_byte_limit = XFRM_INF;
 543                 x->lft.hard_packet_limit = XFRM_INF;
 544                 x->replay_maxage = 0;
 545                 x->replay_maxdiff = 0;
 546                 x->inner_mode = NULL;
 547                 x->inner_mode_iaf = NULL;
 548                 spin_lock_init(&x->lock);
 549         }
 550         return x;
 551 }
 552 EXPORT_SYMBOL(xfrm_state_alloc);
 553
 554 void __xfrm_state_destroy(struct xfrm_state *x)
 555 {
 556         WARN_ON(x->km.state != XFRM_STATE_DEAD);
 557
 558         spin_lock_bh(&xfrm_state_gc_lock);
 559         list_add_tail(&x->gclist, &xfrm_state_gc_list);
 560         spin_unlock_bh(&xfrm_state_gc_lock);
 561         schedule_work(&xfrm_state_gc_work);
 562 }
 563 EXPORT_SYMBOL(__xfrm_state_destroy);
 564
 565 int __xfrm_state_delete(struct xfrm_state *x)
 566 {
 567         int err = -ESRCH;
 568
 569         if (x->km.state != XFRM_STATE_DEAD) {
 570                 x->km.state = XFRM_STATE_DEAD;
 571                 spin_lock(&xfrm_state_lock);
 572                 x->lastused = xfrm_state_walk_ongoing;
 573                 list_del_rcu(&x->all);
 574                 hlist_del(&x->bydst);
 575                 hlist_del(&x->bysrc);
 576                 if (x->id.spi)
 577                         hlist_del(&x->byspi);
 578                 xfrm_state_num--;
 579                 spin_unlock(&xfrm_state_lock);
 580
 581                 /* All xfrm_state objects are created by xfrm_state_alloc.
 582                  * The xfrm_state_alloc call gives a reference, and that
 583                  * is what we are dropping here.
 584                  */
 585                 xfrm_state_put(x);
 586                 err = 0;
 587         }
 588
 589         return err;
 590 }
 591 EXPORT_SYMBOL(__xfrm_state_delete);
 592
 593 int xfrm_state_delete(struct xfrm_state *x)
 594 {
 595         int err;
 596
 597         spin_lock_bh(&x->lock);
 598         err = __xfrm_state_delete(x);
 599         spin_unlock_bh(&x->lock);
 600
 601         return err;
 602 }
 603 EXPORT_SYMBOL(xfrm_state_delete);
 604
 605 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 606 static inline int
 607 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 608 {
 609         int i, err = 0;
 610
 611         for (i = 0; i <= xfrm_state_hmask; i++) {
 612                 struct hlist_node *entry;
 613                 struct xfrm_state *x;
 614
 615                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 616                         if (xfrm_id_proto_match(x->id.proto, proto) &&
 617                            (err = security_xfrm_state_delete(x)) != 0) {
 618                                 xfrm_audit_state_delete(x, 0,
 619                                                         audit_info->loginuid,
 620                                                         audit_info->sessionid,
 621                                                         audit_info->secid);
 622                                 return err;
 623                         }
 624                 }
 625         }
 626
 627         return err;
 628 }
 629 #else
 630 static inline int
 631 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 632 {
 633         return 0;
 634 }
 635 #endif
 636
 637 int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
 638 {
 639         int i, err = 0;
 640
 641         spin_lock_bh(&xfrm_state_lock);
 642         err = xfrm_state_flush_secctx_check(proto, audit_info);
 643         if (err)
 644                 goto out;
 645
 646         for (i = 0; i <= xfrm_state_hmask; i++) {
 647                 struct hlist_node *entry;
 648                 struct xfrm_state *x;
 649 restart:
 650                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 651                         if (!xfrm_state_kern(x) &&
 652                             xfrm_id_proto_match(x->id.proto, proto)) {
 653                                 xfrm_state_hold(x);
 654                                 spin_unlock_bh(&xfrm_state_lock);
 655
 656                                 err = xfrm_state_delete(x);
 657                                 xfrm_audit_state_delete(x, err ? 0 : 1,
 658                                                         audit_info->loginuid,
 659                                                         audit_info->sessionid,
 660                                                         audit_info->secid);
 661                                 xfrm_state_put(x);
 662
 663                                 spin_lock_bh(&xfrm_state_lock);
 664                                 goto restart;
 665                         }
 666                 }
 667         }
 668         err = 0;
 669
 670 out:
 671         spin_unlock_bh(&xfrm_state_lock);
 672         wake_up(&km_waitq);
 673         return err;
 674 }
 675 EXPORT_SYMBOL(xfrm_state_flush);
 676
 677 void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
 678 {
 679         spin_lock_bh(&xfrm_state_lock);
 680         si->sadcnt = xfrm_state_num;
 681         si->sadhcnt = xfrm_state_hmask;
 682         si->sadhmcnt = xfrm_state_hashmax;
 683         spin_unlock_bh(&xfrm_state_lock);
 684 }
 685 EXPORT_SYMBOL(xfrm_sad_getinfo);
 686
 687 static int
 688 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 689                   struct xfrm_tmpl *tmpl,
 690                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 691                   unsigned short family)
 692 {
 693         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 694         if (!afinfo)
 695                 return -1;
 696         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 697         xfrm_state_put_afinfo(afinfo);
 698         return 0;
 699 }
 700
 701 static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 702 {
 703         unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
 704         struct xfrm_state *x;
 705         struct hlist_node *entry;
 706
 707         hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
 708                 if (x->props.family != family ||
 709                     x->id.spi       != spi ||
 710                     x->id.proto     != proto)
 711                         continue;
 712
 713                 switch (family) {
 714                 case AF_INET:
 715                         if (x->id.daddr.a4 != daddr->a4)
 716                                 continue;
 717                         break;
 718                 case AF_INET6:
 719                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 720                                              (struct in6_addr *)
 721                                              x->id.daddr.a6))
 722                                 continue;
 723                         break;
 724                 }
 725
 726                 xfrm_state_hold(x);
 727                 return x;
 728         }
 729
 730         return NULL;
 731 }
 732
 733 static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 734 {
 735         unsigned int h = xfrm_src_hash(daddr, saddr, family);
 736         struct xfrm_state *x;
 737         struct hlist_node *entry;
 738
 739         hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
 740                 if (x->props.family != family ||
 741                     x->id.proto     != proto)
 742                         continue;
 743
 744                 switch (family) {
 745                 case AF_INET:
 746                         if (x->id.daddr.a4 != daddr->a4 ||
 747                             x->props.saddr.a4 != saddr->a4)
 748                                 continue;
 749                         break;
 750                 case AF_INET6:
 751                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 752                                              (struct in6_addr *)
 753                                              x->id.daddr.a6) ||
 754                             !ipv6_addr_equal((struct in6_addr *)saddr,
 755                                              (struct in6_addr *)
 756                                              x->props.saddr.a6))
 757                                 continue;
 758                         break;
 759                 }
 760
 761                 xfrm_state_hold(x);
 762                 return x;
 763         }
 764
 765         return NULL;
 766 }
 767
 768 static inline struct xfrm_state *
 769 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
 770 {
 771         if (use_spi)
 772                 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
 773                                            x->id.proto, family);
 774         else
 775                 return __xfrm_state_lookup_byaddr(&x->id.daddr,
 776                                                   &x->props.saddr,
 777                                                   x->id.proto, family);
 778 }
 779
 780 static void xfrm_hash_grow_check(int have_hash_collision)
 781 {
 782         if (have_hash_collision &&
 783             (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
 784             xfrm_state_num > xfrm_state_hmask)
 785                 schedule_work(&xfrm_hash_work);
 786 }
 787
 788 struct xfrm_state *
 789 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 790                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 791                 struct xfrm_policy *pol, int *err,
 792                 unsigned short family)
 793 {
 794         unsigned int h;
 795         struct hlist_node *entry;
 796         struct xfrm_state *x, *x0, *to_put;
 797         int acquire_in_progress = 0;
 798         int error = 0;
 799         struct xfrm_state *best = NULL;
 800
 801         to_put = NULL;
 802
 803         spin_lock_bh(&xfrm_state_lock);
 804         h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
 805         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 806                 if (x->props.family == family &&
 807                     x->props.reqid == tmpl->reqid &&
 808                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 809                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 810                     tmpl->mode == x->props.mode &&
 811                     tmpl->id.proto == x->id.proto &&
 812                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 813                         /* Resolution logic:
 814                            1. There is a valid state with matching selector.
 815                               Done.
 816                            2. Valid state with inappropriate selector. Skip.
 817
 818                            Entering area of "sysdeps".
 819
 820                            3. If state is not valid, selector is temporary,
 821                               it selects only session which triggered
 822                               previous resolution. Key manager will do
 823                               something to install a state with proper
 824                               selector.
 825                          */
 826                         if (x->km.state == XFRM_STATE_VALID) {
 827                                 if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
 828                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
 829                                         continue;
 830                                 if (!best ||
 831                                     best->km.dying > x->km.dying ||
 832                                     (best->km.dying == x->km.dying &&
 833                                      best->curlft.add_time < x->curlft.add_time))
 834                                         best = x;
 835                         } else if (x->km.state == XFRM_STATE_ACQ) {
 836                                 acquire_in_progress = 1;
 837                         } else if (x->km.state == XFRM_STATE_ERROR ||
 838                                    x->km.state == XFRM_STATE_EXPIRED) {
 839                                 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
 840                                     security_xfrm_state_pol_flow_match(x, pol, fl))
 841                                         error = -ESRCH;
 842                         }
 843                 }
 844         }
 845
 846         x = best;
 847         if (!x && !error && !acquire_in_progress) {
 848                 if (tmpl->id.spi &&
 849                     (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
 850                                               tmpl->id.proto, family)) != NULL) {
 851                         to_put = x0;
 852                         error = -EEXIST;
 853                         goto out;
 854                 }
 855                 x = xfrm_state_alloc();
 856                 if (x == NULL) {
 857                         error = -ENOMEM;
 858                         goto out;
 859                 }
 860                 /* Initialize temporary selector matching only
 861                  * to current session. */
 862                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 863
 864                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
 865                 if (error) {
 866                         x->km.state = XFRM_STATE_DEAD;
 867                         to_put = x;
 868                         x = NULL;
 869                         goto out;
 870                 }
 871
 872                 if (km_query(x, tmpl, pol) == 0) {
 873                         x->km.state = XFRM_STATE_ACQ;
 874                         list_add_tail(&x->all, &xfrm_state_all);
 875                         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 876                         h = xfrm_src_hash(daddr, saddr, family);
 877                         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 878                         if (x->id.spi) {
 879                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 880                                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 881                         }
 882                         x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
 883                         x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
 884                         add_timer(&x->timer);
 885                         xfrm_state_num++;
 886                         xfrm_hash_grow_check(x->bydst.next != NULL);
 887                 } else {
 888                         x->km.state = XFRM_STATE_DEAD;
 889                         to_put = x;
 890                         x = NULL;
 891                         error = -ESRCH;
 892                 }
 893         }
 894 out:
 895         if (x)
 896                 xfrm_state_hold(x);
 897         else
 898                 *err = acquire_in_progress ? -EAGAIN : error;
 899         spin_unlock_bh(&xfrm_state_lock);
 900         if (to_put)
 901                 xfrm_state_put(to_put);
 902         return x;
 903 }
 904
 905 struct xfrm_state *
 906 xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 907                     unsigned short family, u8 mode, u8 proto, u32 reqid)
 908 {
 909         unsigned int h;
 910         struct xfrm_state *rx = NULL, *x = NULL;
 911         struct hlist_node *entry;
 912
 913         spin_lock(&xfrm_state_lock);
 914         h = xfrm_dst_hash(daddr, saddr, reqid, family);
 915         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 916                 if (x->props.family == family &&
 917                     x->props.reqid == reqid &&
 918                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 919                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 920                     mode == x->props.mode &&
 921                     proto == x->id.proto &&
 922                     x->km.state == XFRM_STATE_VALID) {
 923                         rx = x;
 924                         break;
 925                 }
 926         }
 927
 928         if (rx)
 929                 xfrm_state_hold(rx);
 930         spin_unlock(&xfrm_state_lock);
 931
 932
 933         return rx;
 934 }
 935 EXPORT_SYMBOL(xfrm_stateonly_find);
 936
 937 static void __xfrm_state_insert(struct xfrm_state *x)
 938 {
 939         unsigned int h;
 940
 941         x->genid = ++xfrm_state_genid;
 942
 943         list_add_tail(&x->all, &xfrm_state_all);
 944
 945         h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 946                           x->props.reqid, x->props.family);
 947         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 948
 949         h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
 950         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 951
 952         if (x->id.spi) {
 953                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
 954                                   x->props.family);
 955
 956                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 957         }
 958
 959         mod_timer(&x->timer, jiffies + HZ);
 960         if (x->replay_maxage)
 961                 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
 962
 963         wake_up(&km_waitq);
 964
 965         xfrm_state_num++;
 966
 967         xfrm_hash_grow_check(x->bydst.next != NULL);
 968 }
 969
 970 /* xfrm_state_lock is held */
 971 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 972 {
 973         unsigned short family = xnew->props.family;
 974         u32 reqid = xnew->props.reqid;
 975         struct xfrm_state *x;
 976         struct hlist_node *entry;
 977         unsigned int h;
 978
 979         h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
 980         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 981                 if (x->props.family     == family &&
 982                     x->props.reqid      == reqid &&
 983                     !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
 984                     !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
 985                         x->genid = xfrm_state_genid;
 986         }
 987 }
 988
 989 void xfrm_state_insert(struct xfrm_state *x)
 990 {
 991         spin_lock_bh(&xfrm_state_lock);
 992         __xfrm_state_bump_genids(x);
 993         __xfrm_state_insert(x);
 994         spin_unlock_bh(&xfrm_state_lock);
 995 }
 996 EXPORT_SYMBOL(xfrm_state_insert);
 997
 998 /* xfrm_state_lock is held */
 999 static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
1000 {
1001         unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
1002         struct hlist_node *entry;
1003         struct xfrm_state *x;
1004
1005         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1006                 if (x->props.reqid  != reqid ||
1007                     x->props.mode   != mode ||
1008                     x->props.family != family ||
1009                     x->km.state     != XFRM_STATE_ACQ ||
1010                     x->id.spi       != 0 ||
1011                     x->id.proto     != proto)
1012                         continue;
1013
1014                 switch (family) {
1015                 case AF_INET:
1016                         if (x->id.daddr.a4    != daddr->a4 ||
1017                             x->props.saddr.a4 != saddr->a4)
1018                                 continue;
1019                         break;
1020                 case AF_INET6:
1021                         if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
1022                                              (struct in6_addr *)daddr) ||
1023                             !ipv6_addr_equal((struct in6_addr *)
1024                                              x->props.saddr.a6,
1025                                              (struct in6_addr *)saddr))
1026                                 continue;
1027                         break;
1028                 }
1029
1030                 xfrm_state_hold(x);
1031                 return x;
1032         }
1033
1034         if (!create)
1035                 return NULL;
1036
1037         x = xfrm_state_alloc();
1038         if (likely(x)) {
1039                 switch (family) {
1040                 case AF_INET:
1041                         x->sel.daddr.a4 = daddr->a4;
1042                         x->sel.saddr.a4 = saddr->a4;
1043                         x->sel.prefixlen_d = 32;
1044                         x->sel.prefixlen_s = 32;
1045                         x->props.saddr.a4 = saddr->a4;
1046                         x->id.daddr.a4 = daddr->a4;
1047                         break;
1048
1049                 case AF_INET6:
1050                         ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1051                                        (struct in6_addr *)daddr);
1052                         ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1053                                        (struct in6_addr *)saddr);
1054                         x->sel.prefixlen_d = 128;
1055                         x->sel.prefixlen_s = 128;
1056                         ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1057                                        (struct in6_addr *)saddr);
1058                         ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1059                                        (struct in6_addr *)daddr);
1060                         break;
1061                 }
1062
1063                 x->km.state = XFRM_STATE_ACQ;
1064                 x->id.proto = proto;
1065                 x->props.family = family;
1066                 x->props.mode = mode;
1067                 x->props.reqid = reqid;
1068                 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
1069                 xfrm_state_hold(x);
1070                 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1071                 add_timer(&x->timer);
1072                 list_add_tail(&x->all, &xfrm_state_all);
1073                 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1074                 h = xfrm_src_hash(daddr, saddr, family);
1075                 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1076
1077                 xfrm_state_num++;
1078
1079                 xfrm_hash_grow_check(x->bydst.next != NULL);
1080         }
1081
1082         return x;
1083 }
1084
1085 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
1086
1087 int xfrm_state_add(struct xfrm_state *x)
1088 {
1089         struct xfrm_state *x1, *to_put;
1090         int family;
1091         int err;
1092         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1093
1094         family = x->props.family;
1095
1096         to_put = NULL;
1097
1098         spin_lock_bh(&xfrm_state_lock);
1099
1100         x1 = __xfrm_state_locate(x, use_spi, family);
1101         if (x1) {
1102                 to_put = x1;
1103                 x1 = NULL;
1104                 err = -EEXIST;
1105                 goto out;
1106         }
1107
1108         if (use_spi && x->km.seq) {
1109                 x1 = __xfrm_find_acq_byseq(x->km.seq);
1110                 if (x1 && ((x1->id.proto != x->id.proto) ||
1111                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1112                         to_put = x1;
1113                         x1 = NULL;
1114                 }
1115         }
1116
1117         if (use_spi && !x1)
1118                 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
1119                                      x->id.proto,
1120                                      &x->id.daddr, &x->props.saddr, 0);
1121
1122         __xfrm_state_bump_genids(x);
1123         __xfrm_state_insert(x);
1124         err = 0;
1125
1126 out:
1127         spin_unlock_bh(&xfrm_state_lock);
1128
1129         if (x1) {
1130                 xfrm_state_delete(x1);
1131                 xfrm_state_put(x1);
1132         }
1133
1134         if (to_put)
1135                 xfrm_state_put(to_put);
1136
1137         return err;
1138 }
1139 EXPORT_SYMBOL(xfrm_state_add);
1140
1141 #ifdef CONFIG_XFRM_MIGRATE
1142 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1143 {
1144         int err = -ENOMEM;
1145         struct xfrm_state *x = xfrm_state_alloc();
1146         if (!x)
1147                 goto error;
1148
1149         memcpy(&x->id, &orig->id, sizeof(x->id));
1150         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1151         memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1152         x->props.mode = orig->props.mode;
1153         x->props.replay_window = orig->props.replay_window;
1154         x->props.reqid = orig->props.reqid;
1155         x->props.family = orig->props.family;
1156         x->props.saddr = orig->props.saddr;
1157
1158         if (orig->aalg) {
1159                 x->aalg = xfrm_algo_clone(orig->aalg);
1160                 if (!x->aalg)
1161                         goto error;
1162         }
1163         x->props.aalgo = orig->props.aalgo;
1164
1165         if (orig->ealg) {
1166                 x->ealg = xfrm_algo_clone(orig->ealg);
1167                 if (!x->ealg)
1168                         goto error;
1169         }
1170         x->props.ealgo = orig->props.ealgo;
1171
1172         if (orig->calg) {
1173                 x->calg = xfrm_algo_clone(orig->calg);
1174                 if (!x->calg)
1175                         goto error;
1176         }
1177         x->props.calgo = orig->props.calgo;
1178
1179         if (orig->encap) {
1180                 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1181                 if (!x->encap)
1182                         goto error;
1183         }
1184
1185         if (orig->coaddr) {
1186                 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1187                                     GFP_KERNEL);
1188                 if (!x->coaddr)
1189                         goto error;
1190         }
1191
1192         err = xfrm_init_state(x);
1193         if (err)
1194                 goto error;
1195
1196         x->props.flags = orig->props.flags;
1197
1198         x->curlft.add_time = orig->curlft.add_time;
1199         x->km.state = orig->km.state;
1200         x->km.seq = orig->km.seq;
1201
1202         return x;
1203
1204  error:
1205         if (errp)
1206                 *errp = err;
1207         if (x) {
1208                 kfree(x->aalg);
1209                 kfree(x->ealg);
1210                 kfree(x->calg);
1211                 kfree(x->encap);
1212                 kfree(x->coaddr);
1213         }
1214         kfree(x);
1215         return NULL;
1216 }
1217
1218 /* xfrm_state_lock is held */
1219 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1220 {
1221         unsigned int h;
1222         struct xfrm_state *x;
1223         struct hlist_node *entry;
1224
1225         if (m->reqid) {
1226                 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1227                                   m->reqid, m->old_family);
1228                 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1229                         if (x->props.mode != m->mode ||
1230                             x->id.proto != m->proto)
1231                                 continue;
1232                         if (m->reqid && x->props.reqid != m->reqid)
1233                                 continue;
1234                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1235                                           m->old_family) ||
1236                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1237                                           m->old_family))
1238                                 continue;
1239                         xfrm_state_hold(x);
1240                         return x;
1241                 }
1242         } else {
1243                 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1244                                   m->old_family);
1245                 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1246                         if (x->props.mode != m->mode ||
1247                             x->id.proto != m->proto)
1248                                 continue;
1249                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1250                                           m->old_family) ||
1251                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1252                                           m->old_family))
1253                                 continue;
1254                         xfrm_state_hold(x);
1255                         return x;
1256                 }
1257         }
1258
1259         return NULL;
1260 }
1261 EXPORT_SYMBOL(xfrm_migrate_state_find);
1262
1263 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1264                                        struct xfrm_migrate *m)
1265 {
1266         struct xfrm_state *xc;
1267         int err;
1268
1269         xc = xfrm_state_clone(x, &err);
1270         if (!xc)
1271                 return NULL;
1272
1273         memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1274         memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1275
1276         /* add state */
1277         if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1278                 /* a care is needed when the destination address of the
1279                    state is to be updated as it is a part of triplet */
1280                 xfrm_state_insert(xc);
1281         } else {
1282                 if ((err = xfrm_state_add(xc)) < 0)
1283                         goto error;
1284         }
1285
1286         return xc;
1287 error:
1288         kfree(xc);
1289         return NULL;
1290 }
1291 EXPORT_SYMBOL(xfrm_state_migrate);
1292 #endif
1293
1294 int xfrm_state_update(struct xfrm_state *x)
1295 {
1296         struct xfrm_state *x1, *to_put;
1297         int err;
1298         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1299
1300         to_put = NULL;
1301
1302         spin_lock_bh(&xfrm_state_lock);
1303         x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1304
1305         err = -ESRCH;
1306         if (!x1)
1307                 goto out;
1308
1309         if (xfrm_state_kern(x1)) {
1310                 to_put = x1;
1311                 err = -EEXIST;
1312                 goto out;
1313         }
1314
1315         if (x1->km.state == XFRM_STATE_ACQ) {
1316                 __xfrm_state_insert(x);
1317                 x = NULL;
1318         }
1319         err = 0;
1320
1321 out:
1322         spin_unlock_bh(&xfrm_state_lock);
1323
1324         if (to_put)
1325                 xfrm_state_put(to_put);
1326
1327         if (err)
1328                 return err;
1329
1330         if (!x) {
1331                 xfrm_state_delete(x1);
1332                 xfrm_state_put(x1);
1333                 return 0;
1334         }
1335
1336         err = -EINVAL;
1337         spin_lock_bh(&x1->lock);
1338         if (likely(x1->km.state == XFRM_STATE_VALID)) {
1339                 if (x->encap && x1->encap)
1340                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1341                 if (x->coaddr && x1->coaddr) {
1342                         memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1343                 }
1344                 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1345                         memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1346                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1347                 x1->km.dying = 0;
1348
1349                 mod_timer(&x1->timer, jiffies + HZ);
1350                 if (x1->curlft.use_time)
1351                         xfrm_state_check_expire(x1);
1352
1353                 err = 0;
1354         }
1355         spin_unlock_bh(&x1->lock);
1356
1357         xfrm_state_put(x1);
1358
1359         return err;
1360 }
1361 EXPORT_SYMBOL(xfrm_state_update);
1362
1363 int xfrm_state_check_expire(struct xfrm_state *x)
1364 {
1365         if (!x->curlft.use_time)
1366                 x->curlft.use_time = get_seconds();
1367
1368         if (x->km.state != XFRM_STATE_VALID)
1369                 return -EINVAL;
1370
1371         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1372             x->curlft.packets >= x->lft.hard_packet_limit) {
1373                 x->km.state = XFRM_STATE_EXPIRED;
1374                 mod_timer(&x->timer, jiffies);
1375                 return -EINVAL;
1376         }
1377
1378         if (!x->km.dying &&
1379             (x->curlft.bytes >= x->lft.soft_byte_limit ||
1380              x->curlft.packets >= x->lft.soft_packet_limit)) {
1381                 x->km.dying = 1;
1382                 km_state_expired(x, 0, 0);
1383         }
1384         return 0;
1385 }
1386 EXPORT_SYMBOL(xfrm_state_check_expire);
1387
1388 struct xfrm_state *
1389 xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1390                   unsigned short family)
1391 {
1392         struct xfrm_state *x;
1393
1394         spin_lock_bh(&xfrm_state_lock);
1395         x = __xfrm_state_lookup(daddr, spi, proto, family);
1396         spin_unlock_bh(&xfrm_state_lock);
1397         return x;
1398 }
1399 EXPORT_SYMBOL(xfrm_state_lookup);
1400
1401 struct xfrm_state *
1402 xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1403                          u8 proto, unsigned short family)
1404 {
1405         struct xfrm_state *x;
1406
1407         spin_lock_bh(&xfrm_state_lock);
1408         x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
1409         spin_unlock_bh(&xfrm_state_lock);
1410         return x;
1411 }
1412 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1413
1414 struct xfrm_state *
1415 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1416               xfrm_address_t *daddr, xfrm_address_t *saddr,
1417               int create, unsigned short family)
1418 {
1419         struct xfrm_state *x;
1420
1421         spin_lock_bh(&xfrm_state_lock);
1422         x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1423         spin_unlock_bh(&xfrm_state_lock);
1424
1425         return x;
1426 }
1427 EXPORT_SYMBOL(xfrm_find_acq);
1428
1429 #ifdef CONFIG_XFRM_SUB_POLICY
1430 int
1431 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1432                unsigned short family)
1433 {
1434         int err = 0;
1435         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1436         if (!afinfo)
1437                 return -EAFNOSUPPORT;
1438
1439         spin_lock_bh(&xfrm_state_lock);
1440         if (afinfo->tmpl_sort)
1441                 err = afinfo->tmpl_sort(dst, src, n);
1442         spin_unlock_bh(&xfrm_state_lock);
1443         xfrm_state_put_afinfo(afinfo);
1444         return err;
1445 }
1446 EXPORT_SYMBOL(xfrm_tmpl_sort);
1447
1448 int
1449 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1450                 unsigned short family)
1451 {
1452         int err = 0;
1453         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1454         if (!afinfo)
1455                 return -EAFNOSUPPORT;
1456
1457         spin_lock_bh(&xfrm_state_lock);
1458         if (afinfo->state_sort)
1459                 err = afinfo->state_sort(dst, src, n);
1460         spin_unlock_bh(&xfrm_state_lock);
1461         xfrm_state_put_afinfo(afinfo);
1462         return err;
1463 }
1464 EXPORT_SYMBOL(xfrm_state_sort);
1465 #endif
1466
1467 /* Silly enough, but I'm lazy to build resolution list */
1468
1469 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1470 {
1471         int i;
1472
1473         for (i = 0; i <= xfrm_state_hmask; i++) {
1474                 struct hlist_node *entry;
1475                 struct xfrm_state *x;
1476
1477                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1478                         if (x->km.seq == seq &&
1479                             x->km.state == XFRM_STATE_ACQ) {
1480                                 xfrm_state_hold(x);
1481                                 return x;
1482                         }
1483                 }
1484         }
1485         return NULL;
1486 }
1487
1488 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1489 {
1490         struct xfrm_state *x;
1491
1492         spin_lock_bh(&xfrm_state_lock);
1493         x = __xfrm_find_acq_byseq(seq);
1494         spin_unlock_bh(&xfrm_state_lock);
1495         return x;
1496 }
1497 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1498
1499 u32 xfrm_get_acqseq(void)
1500 {
1501         u32 res;
1502         static u32 acqseq;
1503         static DEFINE_SPINLOCK(acqseq_lock);
1504
1505         spin_lock_bh(&acqseq_lock);
1506         res = (++acqseq ? : ++acqseq);
1507         spin_unlock_bh(&acqseq_lock);
1508         return res;
1509 }
1510 EXPORT_SYMBOL(xfrm_get_acqseq);
1511
1512 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1513 {
1514         unsigned int h;
1515         struct xfrm_state *x0;
1516         int err = -ENOENT;
1517         __be32 minspi = htonl(low);
1518         __be32 maxspi = htonl(high);
1519
1520         spin_lock_bh(&x->lock);
1521         if (x->km.state == XFRM_STATE_DEAD)
1522                 goto unlock;
1523
1524         err = 0;
1525         if (x->id.spi)
1526                 goto unlock;
1527
1528         err = -ENOENT;
1529
1530         if (minspi == maxspi) {
1531                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1532                 if (x0) {
1533                         xfrm_state_put(x0);
1534                         goto unlock;
1535                 }
1536                 x->id.spi = minspi;
1537         } else {
1538                 u32 spi = 0;
1539                 for (h=0; h<high-low+1; h++) {
1540                         spi = low + net_random()%(high-low+1);
1541                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1542                         if (x0 == NULL) {
1543                                 x->id.spi = htonl(spi);
1544                                 break;
1545                         }
1546                         xfrm_state_put(x0);
1547                 }
1548         }
1549         if (x->id.spi) {
1550                 spin_lock_bh(&xfrm_state_lock);
1551                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1552                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1553                 spin_unlock_bh(&xfrm_state_lock);
1554
1555                 err = 0;
1556         }
1557
1558 unlock:
1559         spin_unlock_bh(&x->lock);
1560
1561         return err;
1562 }
1563 EXPORT_SYMBOL(xfrm_alloc_spi);
1564
1565 int xfrm_state_walk(struct xfrm_state_walk *walk,
1566                     int (*func)(struct xfrm_state *, int, void*),
1567                     void *data)
1568 {
1569         struct xfrm_state *old, *x, *last = NULL;
1570         int err = 0;
1571
1572         if (walk->state == NULL && walk->count != 0)
1573                 return 0;
1574
1575         old = x = walk->state;
1576         walk->state = NULL;
1577         spin_lock_bh(&xfrm_state_lock);
1578         if (x == NULL)
1579                 x = list_first_entry(&xfrm_state_all, struct xfrm_state, all);
1580         list_for_each_entry_from(x, &xfrm_state_all, all) {
1581                 if (x->km.state == XFRM_STATE_DEAD)
1582                         continue;
1583                 if (!xfrm_id_proto_match(x->id.proto, walk->proto))
1584                         continue;
1585                 if (last) {
1586                         err = func(last, walk->count, data);
1587                         if (err) {
1588                                 xfrm_state_hold(last);
1589                                 walk->state = last;
1590                                 goto out;
1591                         }
1592                 }
1593                 last = x;
1594                 walk->count++;
1595         }
1596         if (walk->count == 0) {
1597                 err = -ENOENT;
1598                 goto out;
1599         }
1600         if (last)
1601                 err = func(last, 0, data);
1602 out:
1603         spin_unlock_bh(&xfrm_state_lock);
1604         if (old != NULL)
1605                 xfrm_state_put(old);
1606         return err;
1607 }
1608 EXPORT_SYMBOL(xfrm_state_walk);
1609
1610 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
1611 {
1612         walk->proto = proto;
1613         walk->state = NULL;
1614         walk->count = 0;
1615         list_add_tail(&walk->list, &xfrm_state_walks);
1616         walk->genid = ++xfrm_state_walk_ongoing;
1617 }
1618 EXPORT_SYMBOL(xfrm_state_walk_init);
1619
1620 void xfrm_state_walk_done(struct xfrm_state_walk *walk)
1621 {
1622         struct list_head *prev;
1623
1624         if (walk->state != NULL) {
1625                 xfrm_state_put(walk->state);
1626                 walk->state = NULL;
1627         }
1628
1629         prev = walk->list.prev;
1630         list_del(&walk->list);
1631
1632         if (prev != &xfrm_state_walks) {
1633                 list_entry(prev, struct xfrm_state_walk, list)->genid =
1634                         walk->genid;
1635                 return;
1636         }
1637
1638         xfrm_state_walk_completed = walk->genid;
1639
1640         if (!list_empty(&xfrm_state_gc_leftovers))
1641                 schedule_work(&xfrm_state_gc_work);
1642 }
1643 EXPORT_SYMBOL(xfrm_state_walk_done);
1644
1645
1646 void xfrm_replay_notify(struct xfrm_state *x, int event)
1647 {
1648         struct km_event c;
1649         /* we send notify messages in case
1650          *  1. we updated on of the sequence numbers, and the seqno difference
1651          *     is at least x->replay_maxdiff, in this case we also update the
1652          *     timeout of our timer function
1653          *  2. if x->replay_maxage has elapsed since last update,
1654          *     and there were changes
1655          *
1656          *  The state structure must be locked!
1657          */
1658
1659         switch (event) {
1660         case XFRM_REPLAY_UPDATE:
1661                 if (x->replay_maxdiff &&
1662                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1663                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1664                         if (x->xflags & XFRM_TIME_DEFER)
1665                                 event = XFRM_REPLAY_TIMEOUT;
1666                         else
1667                                 return;
1668                 }
1669
1670                 break;
1671
1672         case XFRM_REPLAY_TIMEOUT:
1673                 if ((x->replay.seq == x->preplay.seq) &&
1674                     (x->replay.bitmap == x->preplay.bitmap) &&
1675                     (x->replay.oseq == x->preplay.oseq)) {
1676                         x->xflags |= XFRM_TIME_DEFER;
1677                         return;
1678                 }
1679
1680                 break;
1681         }
1682
1683         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1684         c.event = XFRM_MSG_NEWAE;
1685         c.data.aevent = event;
1686         km_state_notify(x, &c);
1687
1688         if (x->replay_maxage &&
1689             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1690                 x->xflags &= ~XFRM_TIME_DEFER;
1691 }
1692
1693 static void xfrm_replay_timer_handler(unsigned long data)
1694 {
1695         struct xfrm_state *x = (struct xfrm_state*)data;
1696
1697         spin_lock(&x->lock);
1698
1699         if (x->km.state == XFRM_STATE_VALID) {
1700                 if (xfrm_aevent_is_on())
1701                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1702                 else
1703                         x->xflags |= XFRM_TIME_DEFER;
1704         }
1705
1706         spin_unlock(&x->lock);
1707 }
1708
1709 int xfrm_replay_check(struct xfrm_state *x,
1710                       struct sk_buff *skb, __be32 net_seq)
1711 {
1712         u32 diff;
1713         u32 seq = ntohl(net_seq);
1714
1715         if (unlikely(seq == 0))
1716                 goto err;
1717
1718         if (likely(seq > x->replay.seq))
1719                 return 0;
1720
1721         diff = x->replay.seq - seq;
1722         if (diff >= min_t(unsigned int, x->props.replay_window,
1723                           sizeof(x->replay.bitmap) * 8)) {
1724                 x->stats.replay_window++;
1725                 goto err;
1726         }
1727
1728         if (x->replay.bitmap & (1U << diff)) {
1729                 x->stats.replay++;
1730                 goto err;
1731         }
1732         return 0;
1733
1734 err:
1735         xfrm_audit_state_replay(x, skb, net_seq);
1736         return -EINVAL;
1737 }
1738
1739 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1740 {
1741         u32 diff;
1742         u32 seq = ntohl(net_seq);
1743
1744         if (seq > x->replay.seq) {
1745                 diff = seq - x->replay.seq;
1746                 if (diff < x->props.replay_window)
1747                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1748                 else
1749                         x->replay.bitmap = 1;
1750                 x->replay.seq = seq;
1751         } else {
1752                 diff = x->replay.seq - seq;
1753                 x->replay.bitmap |= (1U << diff);
1754         }
1755
1756         if (xfrm_aevent_is_on())
1757                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1758 }
1759
1760 static LIST_HEAD(xfrm_km_list);
1761 static DEFINE_RWLOCK(xfrm_km_lock);
1762
1763 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1764 {
1765         struct xfrm_mgr *km;
1766
1767         read_lock(&xfrm_km_lock);
1768         list_for_each_entry(km, &xfrm_km_list, list)
1769                 if (km->notify_policy)
1770                         km->notify_policy(xp, dir, c);
1771         read_unlock(&xfrm_km_lock);
1772 }
1773
1774 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1775 {
1776         struct xfrm_mgr *km;
1777         read_lock(&xfrm_km_lock);
1778         list_for_each_entry(km, &xfrm_km_list, list)
1779                 if (km->notify)
1780                         km->notify(x, c);
1781         read_unlock(&xfrm_km_lock);
1782 }
1783
1784 EXPORT_SYMBOL(km_policy_notify);
1785 EXPORT_SYMBOL(km_state_notify);
1786
1787 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1788 {
1789         struct km_event c;
1790
1791         c.data.hard = hard;
1792         c.pid = pid;
1793         c.event = XFRM_MSG_EXPIRE;
1794         km_state_notify(x, &c);
1795
1796         if (hard)
1797                 wake_up(&km_waitq);
1798 }
1799
1800 EXPORT_SYMBOL(km_state_expired);
1801 /*
1802  * We send to all registered managers regardless of failure
1803  * We are happy with one success
1804 */
1805 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1806 {
1807         int err = -EINVAL, acqret;
1808         struct xfrm_mgr *km;
1809
1810         read_lock(&xfrm_km_lock);
1811         list_for_each_entry(km, &xfrm_km_list, list) {
1812                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1813                 if (!acqret)
1814                         err = acqret;
1815         }
1816         read_unlock(&xfrm_km_lock);
1817         return err;
1818 }
1819 EXPORT_SYMBOL(km_query);
1820
1821 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1822 {
1823         int err = -EINVAL;
1824         struct xfrm_mgr *km;
1825
1826         read_lock(&xfrm_km_lock);
1827         list_for_each_entry(km, &xfrm_km_list, list) {
1828                 if (km->new_mapping)
1829                         err = km->new_mapping(x, ipaddr, sport);
1830                 if (!err)
1831                         break;
1832         }
1833         read_unlock(&xfrm_km_lock);
1834         return err;
1835 }
1836 EXPORT_SYMBOL(km_new_mapping);
1837
1838 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1839 {
1840         struct km_event c;
1841
1842         c.data.hard = hard;
1843         c.pid = pid;
1844         c.event = XFRM_MSG_POLEXPIRE;
1845         km_policy_notify(pol, dir, &c);
1846
1847         if (hard)
1848                 wake_up(&km_waitq);
1849 }
1850 EXPORT_SYMBOL(km_policy_expired);
1851
1852 #ifdef CONFIG_XFRM_MIGRATE
1853 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1854                struct xfrm_migrate *m, int num_migrate)
1855 {
1856         int err = -EINVAL;
1857         int ret;
1858         struct xfrm_mgr *km;
1859
1860         read_lock(&xfrm_km_lock);
1861         list_for_each_entry(km, &xfrm_km_list, list) {
1862                 if (km->migrate) {
1863                         ret = km->migrate(sel, dir, type, m, num_migrate);
1864                         if (!ret)
1865                                 err = ret;
1866                 }
1867         }
1868         read_unlock(&xfrm_km_lock);
1869         return err;
1870 }
1871 EXPORT_SYMBOL(km_migrate);
1872 #endif
1873
1874 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1875 {
1876         int err = -EINVAL;
1877         int ret;
1878         struct xfrm_mgr *km;
1879
1880         read_lock(&xfrm_km_lock);
1881         list_for_each_entry(km, &xfrm_km_list, list) {
1882                 if (km->report) {
1883                         ret = km->report(proto, sel, addr);
1884                         if (!ret)
1885                                 err = ret;
1886                 }
1887         }
1888         read_unlock(&xfrm_km_lock);
1889         return err;
1890 }
1891 EXPORT_SYMBOL(km_report);
1892
1893 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1894 {
1895         int err;
1896         u8 *data;
1897         struct xfrm_mgr *km;
1898         struct xfrm_policy *pol = NULL;
1899
1900         if (optlen <= 0 || optlen > PAGE_SIZE)
1901                 return -EMSGSIZE;
1902
1903         data = kmalloc(optlen, GFP_KERNEL);
1904         if (!data)
1905                 return -ENOMEM;
1906
1907         err = -EFAULT;
1908         if (copy_from_user(data, optval, optlen))
1909                 goto out;
1910
1911         err = -EINVAL;
1912         read_lock(&xfrm_km_lock);
1913         list_for_each_entry(km, &xfrm_km_list, list) {
1914                 pol = km->compile_policy(sk, optname, data,
1915                                          optlen, &err);
1916                 if (err >= 0)
1917                         break;
1918         }
1919         read_unlock(&xfrm_km_lock);
1920
1921         if (err >= 0) {
1922                 xfrm_sk_policy_insert(sk, err, pol);
1923                 xfrm_pol_put(pol);
1924                 err = 0;
1925         }
1926
1927 out:
1928         kfree(data);
1929         return err;
1930 }
1931 EXPORT_SYMBOL(xfrm_user_policy);
1932
1933 int xfrm_register_km(struct xfrm_mgr *km)
1934 {
1935         write_lock_bh(&xfrm_km_lock);
1936         list_add_tail(&km->list, &xfrm_km_list);
1937         write_unlock_bh(&xfrm_km_lock);
1938         return 0;
1939 }
1940 EXPORT_SYMBOL(xfrm_register_km);
1941
1942 int xfrm_unregister_km(struct xfrm_mgr *km)
1943 {
1944         write_lock_bh(&xfrm_km_lock);
1945         list_del(&km->list);
1946         write_unlock_bh(&xfrm_km_lock);
1947         return 0;
1948 }
1949 EXPORT_SYMBOL(xfrm_unregister_km);
1950
1951 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1952 {
1953         int err = 0;
1954         if (unlikely(afinfo == NULL))
1955                 return -EINVAL;
1956         if (unlikely(afinfo->family >= NPROTO))
1957                 return -EAFNOSUPPORT;
1958         write_lock_bh(&xfrm_state_afinfo_lock);
1959         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1960                 err = -ENOBUFS;
1961         else
1962                 xfrm_state_afinfo[afinfo->family] = afinfo;
1963         write_unlock_bh(&xfrm_state_afinfo_lock);
1964         return err;
1965 }
1966 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1967
1968 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1969 {
1970         int err = 0;
1971         if (unlikely(afinfo == NULL))
1972                 return -EINVAL;
1973         if (unlikely(afinfo->family >= NPROTO))
1974                 return -EAFNOSUPPORT;
1975         write_lock_bh(&xfrm_state_afinfo_lock);
1976         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1977                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1978                         err = -EINVAL;
1979                 else
1980                         xfrm_state_afinfo[afinfo->family] = NULL;
1981         }
1982         write_unlock_bh(&xfrm_state_afinfo_lock);
1983         return err;
1984 }
1985 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1986
1987 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1988 {
1989         struct xfrm_state_afinfo *afinfo;
1990         if (unlikely(family >= NPROTO))
1991                 return NULL;
1992         read_lock(&xfrm_state_afinfo_lock);
1993         afinfo = xfrm_state_afinfo[family];
1994         if (unlikely(!afinfo))
1995                 read_unlock(&xfrm_state_afinfo_lock);
1996         return afinfo;
1997 }
1998
1999 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
2000         __releases(xfrm_state_afinfo_lock)
2001 {
2002         read_unlock(&xfrm_state_afinfo_lock);
2003 }
2004
2005 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
2006 void xfrm_state_delete_tunnel(struct xfrm_state *x)
2007 {
2008         if (x->tunnel) {
2009                 struct xfrm_state *t = x->tunnel;
2010
2011                 if (atomic_read(&t->tunnel_users) == 2)
2012                         xfrm_state_delete(t);
2013                 atomic_dec(&t->tunnel_users);
2014                 xfrm_state_put(t);
2015                 x->tunnel = NULL;
2016         }
2017 }
2018 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
2019
2020 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
2021 {
2022         int res;
2023
2024         spin_lock_bh(&x->lock);
2025         if (x->km.state == XFRM_STATE_VALID &&
2026             x->type && x->type->get_mtu)
2027                 res = x->type->get_mtu(x, mtu);
2028         else
2029                 res = mtu - x->props.header_len;
2030         spin_unlock_bh(&x->lock);
2031         return res;
2032 }
2033
2034 int xfrm_init_state(struct xfrm_state *x)
2035 {
2036         struct xfrm_state_afinfo *afinfo;
2037         struct xfrm_mode *inner_mode;
2038         int family = x->props.family;
2039         int err;
2040
2041         err = -EAFNOSUPPORT;
2042         afinfo = xfrm_state_get_afinfo(family);
2043         if (!afinfo)
2044                 goto error;
2045
2046         err = 0;
2047         if (afinfo->init_flags)
2048                 err = afinfo->init_flags(x);
2049
2050         xfrm_state_put_afinfo(afinfo);
2051
2052         if (err)
2053                 goto error;
2054
2055         err = -EPROTONOSUPPORT;
2056
2057         if (x->sel.family != AF_UNSPEC) {
2058                 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2059                 if (inner_mode == NULL)
2060                         goto error;
2061
2062                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2063                     family != x->sel.family) {
2064                         xfrm_put_mode(inner_mode);
2065                         goto error;
2066                 }
2067
2068                 x->inner_mode = inner_mode;
2069         } else {
2070                 struct xfrm_mode *inner_mode_iaf;
2071
2072                 inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
2073                 if (inner_mode == NULL)
2074                         goto error;
2075
2076                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2077                         xfrm_put_mode(inner_mode);
2078                         goto error;
2079                 }
2080
2081                 inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
2082                 if (inner_mode_iaf == NULL)
2083                         goto error;
2084
2085                 if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
2086                         xfrm_put_mode(inner_mode_iaf);
2087                         goto error;
2088                 }
2089
2090                 if (x->props.family == AF_INET) {
2091                         x->inner_mode = inner_mode;
2092                         x->inner_mode_iaf = inner_mode_iaf;
2093                 } else {
2094                         x->inner_mode = inner_mode_iaf;
2095                         x->inner_mode_iaf = inner_mode;
2096                 }
2097         }
2098
2099         x->type = xfrm_get_type(x->id.proto, family);
2100         if (x->type == NULL)
2101                 goto error;
2102
2103         err = x->type->init_state(x);
2104         if (err)
2105                 goto error;
2106
2107         x->outer_mode = xfrm_get_mode(x->props.mode, family);
2108         if (x->outer_mode == NULL)
2109                 goto error;
2110
2111         x->km.state = XFRM_STATE_VALID;
2112
2113 error:
2114         return err;
2115 }
2116
2117 EXPORT_SYMBOL(xfrm_init_state);
2118
2119 void __init xfrm_state_init(void)
2120 {
2121         unsigned int sz;
2122
2123         sz = sizeof(struct hlist_head) * 8;
2124
2125         xfrm_state_bydst = xfrm_hash_alloc(sz);
2126         xfrm_state_bysrc = xfrm_hash_alloc(sz);
2127         xfrm_state_byspi = xfrm_hash_alloc(sz);
2128         if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
2129                 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
2130         xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2131
2132         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
2133 }
2134
2135 #ifdef CONFIG_AUDITSYSCALL
2136 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2137                                      struct audit_buffer *audit_buf)
2138 {
2139         struct xfrm_sec_ctx *ctx = x->security;
2140         u32 spi = ntohl(x->id.spi);
2141
2142         if (ctx)
2143                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2144                                  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2145
2146         switch(x->props.family) {
2147         case AF_INET:
2148                 audit_log_format(audit_buf,
2149                                  " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2150                                  NIPQUAD(x->props.saddr.a4),
2151                                  NIPQUAD(x->id.daddr.a4));
2152                 break;
2153         case AF_INET6:
2154                 audit_log_format(audit_buf,
2155                                  " src=" NIP6_FMT " dst=" NIP6_FMT,
2156                                  NIP6(*(struct in6_addr *)x->props.saddr.a6),
2157                                  NIP6(*(struct in6_addr *)x->id.daddr.a6));
2158                 break;
2159         }
2160
2161         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2162 }
2163
2164 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2165                                       struct audit_buffer *audit_buf)
2166 {
2167         struct iphdr *iph4;
2168         struct ipv6hdr *iph6;
2169
2170         switch (family) {
2171         case AF_INET:
2172                 iph4 = ip_hdr(skb);
2173                 audit_log_format(audit_buf,
2174                                  " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2175                                  NIPQUAD(iph4->saddr),
2176                                  NIPQUAD(iph4->daddr));
2177                 break;
2178         case AF_INET6:
2179                 iph6 = ipv6_hdr(skb);
2180                 audit_log_format(audit_buf,
2181                                  " src=" NIP6_FMT " dst=" NIP6_FMT
2182                                  " flowlbl=0x%x%02x%02x",
2183                                  NIP6(iph6->saddr),
2184                                  NIP6(iph6->daddr),
2185                                  iph6->flow_lbl[0] & 0x0f,
2186                                  iph6->flow_lbl[1],
2187                                  iph6->flow_lbl[2]);
2188                 break;
2189         }
2190 }
2191
2192 void xfrm_audit_state_add(struct xfrm_state *x, int result,
2193                           uid_t auid, u32 sessionid, u32 secid)
2194 {
2195         struct audit_buffer *audit_buf;
2196
2197         audit_buf = xfrm_audit_start("SAD-add");
2198         if (audit_buf == NULL)
2199                 return;
2200         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2201         xfrm_audit_helper_sainfo(x, audit_buf);
2202         audit_log_format(audit_buf, " res=%u", result);
2203         audit_log_end(audit_buf);
2204 }
2205 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2206
2207 void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2208                              uid_t auid, u32 sessionid, u32 secid)
2209 {
2210         struct audit_buffer *audit_buf;
2211
2212         audit_buf = xfrm_audit_start("SAD-delete");
2213         if (audit_buf == NULL)
2214                 return;
2215         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2216         xfrm_audit_helper_sainfo(x, audit_buf);
2217         audit_log_format(audit_buf, " res=%u", result);
2218         audit_log_end(audit_buf);
2219 }
2220 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2221
2222 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2223                                       struct sk_buff *skb)
2224 {
2225         struct audit_buffer *audit_buf;
2226         u32 spi;
2227
2228         audit_buf = xfrm_audit_start("SA-replay-overflow");
2229         if (audit_buf == NULL)
2230                 return;
2231         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2232         /* don't record the sequence number because it's inherent in this kind
2233          * of audit message */
2234         spi = ntohl(x->id.spi);
2235         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2236         audit_log_end(audit_buf);
2237 }
2238 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2239
2240 static void xfrm_audit_state_replay(struct xfrm_state *x,
2241                              struct sk_buff *skb, __be32 net_seq)
2242 {
2243         struct audit_buffer *audit_buf;
2244         u32 spi;
2245
2246         audit_buf = xfrm_audit_start("SA-replayed-pkt");
2247         if (audit_buf == NULL)
2248                 return;
2249         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2250         spi = ntohl(x->id.spi);
2251         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2252                          spi, spi, ntohl(net_seq));
2253         audit_log_end(audit_buf);
2254 }
2255
2256 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2257 {
2258         struct audit_buffer *audit_buf;
2259
2260         audit_buf = xfrm_audit_start("SA-notfound");
2261         if (audit_buf == NULL)
2262                 return;
2263         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2264         audit_log_end(audit_buf);
2265 }
2266 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2267
2268 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2269                                __be32 net_spi, __be32 net_seq)
2270 {
2271         struct audit_buffer *audit_buf;
2272         u32 spi;
2273
2274         audit_buf = xfrm_audit_start("SA-notfound");
2275         if (audit_buf == NULL)
2276                 return;
2277         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2278         spi = ntohl(net_spi);
2279         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2280                          spi, spi, ntohl(net_seq));
2281         audit_log_end(audit_buf);
2282 }
2283 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2284
2285 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2286                               struct sk_buff *skb, u8 proto)
2287 {
2288         struct audit_buffer *audit_buf;
2289         __be32 net_spi;
2290         __be32 net_seq;
2291
2292         audit_buf = xfrm_audit_start("SA-icv-failure");
2293         if (audit_buf == NULL)
2294                 return;
2295         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2296         if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2297                 u32 spi = ntohl(net_spi);
2298                 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2299                                  spi, spi, ntohl(net_seq));
2300         }
2301         audit_log_end(audit_buf);
2302 }
2303 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2304 #endif /* CONFIG_AUDITSYSCALL */