SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <linux/cache.h>
  22 #include <linux/audit.h>
  23 #include <asm/uaccess.h>
  24
  25 #include "xfrm_hash.h"
  26
  27 struct sock *xfrm_nl;
  28 EXPORT_SYMBOL(xfrm_nl);
  29
  30 u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
  31 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
  32
  33 u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
  34 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
  35
  36 u32 sysctl_xfrm_acq_expires __read_mostly = 30;
  37
  38 /* Each xfrm_state may be linked to two tables:
  39
  40    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  41    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
  42       destination/tunnel endpoint. (output)
  43  */
  44
  45 static DEFINE_SPINLOCK(xfrm_state_lock);
  46
  47 /* Hash table to find appropriate SA towards given target (endpoint
  48  * of tunnel or destination of transport mode) allowed by selector.
  49  *
  50  * Main use is finding SA after policy selected tunnel or transport mode.
  51  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  52  */
  53 static LIST_HEAD(xfrm_state_all);
  54 static struct hlist_head *xfrm_state_bydst __read_mostly;
  55 static struct hlist_head *xfrm_state_bysrc __read_mostly;
  56 static struct hlist_head *xfrm_state_byspi __read_mostly;
  57 static unsigned int xfrm_state_hmask __read_mostly;
  58 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
  59 static unsigned int xfrm_state_num;
  60 static unsigned int xfrm_state_genid;
  61
  62 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
  63 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  64
  65 #ifdef CONFIG_AUDITSYSCALL
  66 static void xfrm_audit_state_replay(struct xfrm_state *x,
  67                                     struct sk_buff *skb, __be32 net_seq);
  68 #else
  69 #define xfrm_audit_state_replay(x, s, sq)       do { ; } while (0)
  70 #endif /* CONFIG_AUDITSYSCALL */
  71
  72 static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
  73                                          xfrm_address_t *saddr,
  74                                          u32 reqid,
  75                                          unsigned short family)
  76 {
  77         return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
  78 }
  79
  80 static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
  81                                          xfrm_address_t *saddr,
  82                                          unsigned short family)
  83 {
  84         return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
  85 }
  86
  87 static inline unsigned int
  88 xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
  89 {
  90         return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
  91 }
  92
  93 static void xfrm_hash_transfer(struct hlist_head *list,
  94                                struct hlist_head *ndsttable,
  95                                struct hlist_head *nsrctable,
  96                                struct hlist_head *nspitable,
  97                                unsigned int nhashmask)
  98 {
  99         struct hlist_node *entry, *tmp;
 100         struct xfrm_state *x;
 101
 102         hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
 103                 unsigned int h;
 104
 105                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 106                                     x->props.reqid, x->props.family,
 107                                     nhashmask);
 108                 hlist_add_head(&x->bydst, ndsttable+h);
 109
 110                 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
 111                                     x->props.family,
 112                                     nhashmask);
 113                 hlist_add_head(&x->bysrc, nsrctable+h);
 114
 115                 if (x->id.spi) {
 116                         h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
 117                                             x->id.proto, x->props.family,
 118                                             nhashmask);
 119                         hlist_add_head(&x->byspi, nspitable+h);
 120                 }
 121         }
 122 }
 123
 124 static unsigned long xfrm_hash_new_size(void)
 125 {
 126         return ((xfrm_state_hmask + 1) << 1) *
 127                 sizeof(struct hlist_head);
 128 }
 129
 130 static DEFINE_MUTEX(hash_resize_mutex);
 131
 132 static void xfrm_hash_resize(struct work_struct *__unused)
 133 {
 134         struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
 135         unsigned long nsize, osize;
 136         unsigned int nhashmask, ohashmask;
 137         int i;
 138
 139         mutex_lock(&hash_resize_mutex);
 140
 141         nsize = xfrm_hash_new_size();
 142         ndst = xfrm_hash_alloc(nsize);
 143         if (!ndst)
 144                 goto out_unlock;
 145         nsrc = xfrm_hash_alloc(nsize);
 146         if (!nsrc) {
 147                 xfrm_hash_free(ndst, nsize);
 148                 goto out_unlock;
 149         }
 150         nspi = xfrm_hash_alloc(nsize);
 151         if (!nspi) {
 152                 xfrm_hash_free(ndst, nsize);
 153                 xfrm_hash_free(nsrc, nsize);
 154                 goto out_unlock;
 155         }
 156
 157         spin_lock_bh(&xfrm_state_lock);
 158
 159         nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
 160         for (i = xfrm_state_hmask; i >= 0; i--)
 161                 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
 162                                    nhashmask);
 163
 164         odst = xfrm_state_bydst;
 165         osrc = xfrm_state_bysrc;
 166         ospi = xfrm_state_byspi;
 167         ohashmask = xfrm_state_hmask;
 168
 169         xfrm_state_bydst = ndst;
 170         xfrm_state_bysrc = nsrc;
 171         xfrm_state_byspi = nspi;
 172         xfrm_state_hmask = nhashmask;
 173
 174         spin_unlock_bh(&xfrm_state_lock);
 175
 176         osize = (ohashmask + 1) * sizeof(struct hlist_head);
 177         xfrm_hash_free(odst, osize);
 178         xfrm_hash_free(osrc, osize);
 179         xfrm_hash_free(ospi, osize);
 180
 181 out_unlock:
 182         mutex_unlock(&hash_resize_mutex);
 183 }
 184
 185 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
 186
 187 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
 188 EXPORT_SYMBOL(km_waitq);
 189
 190 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 191 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 192
 193 static struct work_struct xfrm_state_gc_work;
 194 static HLIST_HEAD(xfrm_state_gc_list);
 195 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 196
 197 int __xfrm_state_delete(struct xfrm_state *x);
 198
 199 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 200 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 201
 202 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
 203 {
 204         struct xfrm_state_afinfo *afinfo;
 205         if (unlikely(family >= NPROTO))
 206                 return NULL;
 207         write_lock_bh(&xfrm_state_afinfo_lock);
 208         afinfo = xfrm_state_afinfo[family];
 209         if (unlikely(!afinfo))
 210                 write_unlock_bh(&xfrm_state_afinfo_lock);
 211         return afinfo;
 212 }
 213
 214 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
 215         __releases(xfrm_state_afinfo_lock)
 216 {
 217         write_unlock_bh(&xfrm_state_afinfo_lock);
 218 }
 219
 220 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
 221 {
 222         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 223         const struct xfrm_type **typemap;
 224         int err = 0;
 225
 226         if (unlikely(afinfo == NULL))
 227                 return -EAFNOSUPPORT;
 228         typemap = afinfo->type_map;
 229
 230         if (likely(typemap[type->proto] == NULL))
 231                 typemap[type->proto] = type;
 232         else
 233                 err = -EEXIST;
 234         xfrm_state_unlock_afinfo(afinfo);
 235         return err;
 236 }
 237 EXPORT_SYMBOL(xfrm_register_type);
 238
 239 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
 240 {
 241         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 242         const struct xfrm_type **typemap;
 243         int err = 0;
 244
 245         if (unlikely(afinfo == NULL))
 246                 return -EAFNOSUPPORT;
 247         typemap = afinfo->type_map;
 248
 249         if (unlikely(typemap[type->proto] != type))
 250                 err = -ENOENT;
 251         else
 252                 typemap[type->proto] = NULL;
 253         xfrm_state_unlock_afinfo(afinfo);
 254         return err;
 255 }
 256 EXPORT_SYMBOL(xfrm_unregister_type);
 257
 258 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
 259 {
 260         struct xfrm_state_afinfo *afinfo;
 261         const struct xfrm_type **typemap;
 262         const struct xfrm_type *type;
 263         int modload_attempted = 0;
 264
 265 retry:
 266         afinfo = xfrm_state_get_afinfo(family);
 267         if (unlikely(afinfo == NULL))
 268                 return NULL;
 269         typemap = afinfo->type_map;
 270
 271         type = typemap[proto];
 272         if (unlikely(type && !try_module_get(type->owner)))
 273                 type = NULL;
 274         if (!type && !modload_attempted) {
 275                 xfrm_state_put_afinfo(afinfo);
 276                 request_module("xfrm-type-%d-%d", family, proto);
 277                 modload_attempted = 1;
 278                 goto retry;
 279         }
 280
 281         xfrm_state_put_afinfo(afinfo);
 282         return type;
 283 }
 284
 285 static void xfrm_put_type(const struct xfrm_type *type)
 286 {
 287         module_put(type->owner);
 288 }
 289
 290 int xfrm_register_mode(struct xfrm_mode *mode, int family)
 291 {
 292         struct xfrm_state_afinfo *afinfo;
 293         struct xfrm_mode **modemap;
 294         int err;
 295
 296         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 297                 return -EINVAL;
 298
 299         afinfo = xfrm_state_lock_afinfo(family);
 300         if (unlikely(afinfo == NULL))
 301                 return -EAFNOSUPPORT;
 302
 303         err = -EEXIST;
 304         modemap = afinfo->mode_map;
 305         if (modemap[mode->encap])
 306                 goto out;
 307
 308         err = -ENOENT;
 309         if (!try_module_get(afinfo->owner))
 310                 goto out;
 311
 312         mode->afinfo = afinfo;
 313         modemap[mode->encap] = mode;
 314         err = 0;
 315
 316 out:
 317         xfrm_state_unlock_afinfo(afinfo);
 318         return err;
 319 }
 320 EXPORT_SYMBOL(xfrm_register_mode);
 321
 322 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
 323 {
 324         struct xfrm_state_afinfo *afinfo;
 325         struct xfrm_mode **modemap;
 326         int err;
 327
 328         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 329                 return -EINVAL;
 330
 331         afinfo = xfrm_state_lock_afinfo(family);
 332         if (unlikely(afinfo == NULL))
 333                 return -EAFNOSUPPORT;
 334
 335         err = -ENOENT;
 336         modemap = afinfo->mode_map;
 337         if (likely(modemap[mode->encap] == mode)) {
 338                 modemap[mode->encap] = NULL;
 339                 module_put(mode->afinfo->owner);
 340                 err = 0;
 341         }
 342
 343         xfrm_state_unlock_afinfo(afinfo);
 344         return err;
 345 }
 346 EXPORT_SYMBOL(xfrm_unregister_mode);
 347
 348 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
 349 {
 350         struct xfrm_state_afinfo *afinfo;
 351         struct xfrm_mode *mode;
 352         int modload_attempted = 0;
 353
 354         if (unlikely(encap >= XFRM_MODE_MAX))
 355                 return NULL;
 356
 357 retry:
 358         afinfo = xfrm_state_get_afinfo(family);
 359         if (unlikely(afinfo == NULL))
 360                 return NULL;
 361
 362         mode = afinfo->mode_map[encap];
 363         if (unlikely(mode && !try_module_get(mode->owner)))
 364                 mode = NULL;
 365         if (!mode && !modload_attempted) {
 366                 xfrm_state_put_afinfo(afinfo);
 367                 request_module("xfrm-mode-%d-%d", family, encap);
 368                 modload_attempted = 1;
 369                 goto retry;
 370         }
 371
 372         xfrm_state_put_afinfo(afinfo);
 373         return mode;
 374 }
 375
 376 static void xfrm_put_mode(struct xfrm_mode *mode)
 377 {
 378         module_put(mode->owner);
 379 }
 380
 381 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 382 {
 383         del_timer_sync(&x->timer);
 384         del_timer_sync(&x->rtimer);
 385         kfree(x->aalg);
 386         kfree(x->ealg);
 387         kfree(x->calg);
 388         kfree(x->encap);
 389         kfree(x->coaddr);
 390         if (x->inner_mode)
 391                 xfrm_put_mode(x->inner_mode);
 392         if (x->inner_mode_iaf)
 393                 xfrm_put_mode(x->inner_mode_iaf);
 394         if (x->outer_mode)
 395                 xfrm_put_mode(x->outer_mode);
 396         if (x->type) {
 397                 x->type->destructor(x);
 398                 xfrm_put_type(x->type);
 399         }
 400         security_xfrm_state_free(x);
 401         kfree(x);
 402 }
 403
 404 static void xfrm_state_gc_task(struct work_struct *data)
 405 {
 406         struct xfrm_state *x;
 407         struct hlist_node *entry, *tmp;
 408         struct hlist_head gc_list;
 409
 410         spin_lock_bh(&xfrm_state_gc_lock);
 411         hlist_move_list(&xfrm_state_gc_list, &gc_list);
 412         spin_unlock_bh(&xfrm_state_gc_lock);
 413
 414         hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
 415                 xfrm_state_gc_destroy(x);
 416
 417         wake_up(&km_waitq);
 418 }
 419
 420 static inline unsigned long make_jiffies(long secs)
 421 {
 422         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 423                 return MAX_SCHEDULE_TIMEOUT-1;
 424         else
 425                 return secs*HZ;
 426 }
 427
 428 static void xfrm_timer_handler(unsigned long data)
 429 {
 430         struct xfrm_state *x = (struct xfrm_state*)data;
 431         unsigned long now = get_seconds();
 432         long next = LONG_MAX;
 433         int warn = 0;
 434         int err = 0;
 435
 436         spin_lock(&x->lock);
 437         if (x->km.state == XFRM_STATE_DEAD)
 438                 goto out;
 439         if (x->km.state == XFRM_STATE_EXPIRED)
 440                 goto expired;
 441         if (x->lft.hard_add_expires_seconds) {
 442                 long tmo = x->lft.hard_add_expires_seconds +
 443                         x->curlft.add_time - now;
 444                 if (tmo <= 0)
 445                         goto expired;
 446                 if (tmo < next)
 447                         next = tmo;
 448         }
 449         if (x->lft.hard_use_expires_seconds) {
 450                 long tmo = x->lft.hard_use_expires_seconds +
 451                         (x->curlft.use_time ? : now) - now;
 452                 if (tmo <= 0)
 453                         goto expired;
 454                 if (tmo < next)
 455                         next = tmo;
 456         }
 457         if (x->km.dying)
 458                 goto resched;
 459         if (x->lft.soft_add_expires_seconds) {
 460                 long tmo = x->lft.soft_add_expires_seconds +
 461                         x->curlft.add_time - now;
 462                 if (tmo <= 0)
 463                         warn = 1;
 464                 else if (tmo < next)
 465                         next = tmo;
 466         }
 467         if (x->lft.soft_use_expires_seconds) {
 468                 long tmo = x->lft.soft_use_expires_seconds +
 469                         (x->curlft.use_time ? : now) - now;
 470                 if (tmo <= 0)
 471                         warn = 1;
 472                 else if (tmo < next)
 473                         next = tmo;
 474         }
 475
 476         x->km.dying = warn;
 477         if (warn)
 478                 km_state_expired(x, 0, 0);
 479 resched:
 480         if (next != LONG_MAX)
 481                 mod_timer(&x->timer, jiffies + make_jiffies(next));
 482
 483         goto out;
 484
 485 expired:
 486         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 487                 x->km.state = XFRM_STATE_EXPIRED;
 488                 wake_up(&km_waitq);
 489                 next = 2;
 490                 goto resched;
 491         }
 492
 493         err = __xfrm_state_delete(x);
 494         if (!err && x->id.spi)
 495                 km_state_expired(x, 1, 0);
 496
 497         xfrm_audit_state_delete(x, err ? 0 : 1,
 498                                 audit_get_loginuid(current),
 499                                 audit_get_sessionid(current), 0);
 500
 501 out:
 502         spin_unlock(&x->lock);
 503 }
 504
 505 static void xfrm_replay_timer_handler(unsigned long data);
 506
 507 struct xfrm_state *xfrm_state_alloc(void)
 508 {
 509         struct xfrm_state *x;
 510
 511         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 512
 513         if (x) {
 514                 atomic_set(&x->refcnt, 1);
 515                 atomic_set(&x->tunnel_users, 0);
 516                 INIT_LIST_HEAD(&x->km.all);
 517                 INIT_HLIST_NODE(&x->bydst);
 518                 INIT_HLIST_NODE(&x->bysrc);
 519                 INIT_HLIST_NODE(&x->byspi);
 520                 setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
 521                 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
 522                                 (unsigned long)x);
 523                 x->curlft.add_time = get_seconds();
 524                 x->lft.soft_byte_limit = XFRM_INF;
 525                 x->lft.soft_packet_limit = XFRM_INF;
 526                 x->lft.hard_byte_limit = XFRM_INF;
 527                 x->lft.hard_packet_limit = XFRM_INF;
 528                 x->replay_maxage = 0;
 529                 x->replay_maxdiff = 0;
 530                 x->inner_mode = NULL;
 531                 x->inner_mode_iaf = NULL;
 532                 spin_lock_init(&x->lock);
 533         }
 534         return x;
 535 }
 536 EXPORT_SYMBOL(xfrm_state_alloc);
 537
 538 void __xfrm_state_destroy(struct xfrm_state *x)
 539 {
 540         WARN_ON(x->km.state != XFRM_STATE_DEAD);
 541
 542         spin_lock_bh(&xfrm_state_gc_lock);
 543         hlist_add_head(&x->gclist, &xfrm_state_gc_list);
 544         spin_unlock_bh(&xfrm_state_gc_lock);
 545         schedule_work(&xfrm_state_gc_work);
 546 }
 547 EXPORT_SYMBOL(__xfrm_state_destroy);
 548
 549 int __xfrm_state_delete(struct xfrm_state *x)
 550 {
 551         int err = -ESRCH;
 552
 553         if (x->km.state != XFRM_STATE_DEAD) {
 554                 x->km.state = XFRM_STATE_DEAD;
 555                 spin_lock(&xfrm_state_lock);
 556                 list_del(&x->km.all);
 557                 hlist_del(&x->bydst);
 558                 hlist_del(&x->bysrc);
 559                 if (x->id.spi)
 560                         hlist_del(&x->byspi);
 561                 xfrm_state_num--;
 562                 spin_unlock(&xfrm_state_lock);
 563
 564                 /* All xfrm_state objects are created by xfrm_state_alloc.
 565                  * The xfrm_state_alloc call gives a reference, and that
 566                  * is what we are dropping here.
 567                  */
 568                 xfrm_state_put(x);
 569                 err = 0;
 570         }
 571
 572         return err;
 573 }
 574 EXPORT_SYMBOL(__xfrm_state_delete);
 575
 576 int xfrm_state_delete(struct xfrm_state *x)
 577 {
 578         int err;
 579
 580         spin_lock_bh(&x->lock);
 581         err = __xfrm_state_delete(x);
 582         spin_unlock_bh(&x->lock);
 583
 584         return err;
 585 }
 586 EXPORT_SYMBOL(xfrm_state_delete);
 587
 588 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 589 static inline int
 590 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 591 {
 592         int i, err = 0;
 593
 594         for (i = 0; i <= xfrm_state_hmask; i++) {
 595                 struct hlist_node *entry;
 596                 struct xfrm_state *x;
 597
 598                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 599                         if (xfrm_id_proto_match(x->id.proto, proto) &&
 600                            (err = security_xfrm_state_delete(x)) != 0) {
 601                                 xfrm_audit_state_delete(x, 0,
 602                                                         audit_info->loginuid,
 603                                                         audit_info->sessionid,
 604                                                         audit_info->secid);
 605                                 return err;
 606                         }
 607                 }
 608         }
 609
 610         return err;
 611 }
 612 #else
 613 static inline int
 614 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 615 {
 616         return 0;
 617 }
 618 #endif
 619
 620 int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
 621 {
 622         int i, err = 0;
 623
 624         spin_lock_bh(&xfrm_state_lock);
 625         err = xfrm_state_flush_secctx_check(proto, audit_info);
 626         if (err)
 627                 goto out;
 628
 629         for (i = 0; i <= xfrm_state_hmask; i++) {
 630                 struct hlist_node *entry;
 631                 struct xfrm_state *x;
 632 restart:
 633                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 634                         if (!xfrm_state_kern(x) &&
 635                             xfrm_id_proto_match(x->id.proto, proto)) {
 636                                 xfrm_state_hold(x);
 637                                 spin_unlock_bh(&xfrm_state_lock);
 638
 639                                 err = xfrm_state_delete(x);
 640                                 xfrm_audit_state_delete(x, err ? 0 : 1,
 641                                                         audit_info->loginuid,
 642                                                         audit_info->sessionid,
 643                                                         audit_info->secid);
 644                                 xfrm_state_put(x);
 645
 646                                 spin_lock_bh(&xfrm_state_lock);
 647                                 goto restart;
 648                         }
 649                 }
 650         }
 651         err = 0;
 652
 653 out:
 654         spin_unlock_bh(&xfrm_state_lock);
 655         wake_up(&km_waitq);
 656         return err;
 657 }
 658 EXPORT_SYMBOL(xfrm_state_flush);
 659
 660 void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
 661 {
 662         spin_lock_bh(&xfrm_state_lock);
 663         si->sadcnt = xfrm_state_num;
 664         si->sadhcnt = xfrm_state_hmask;
 665         si->sadhmcnt = xfrm_state_hashmax;
 666         spin_unlock_bh(&xfrm_state_lock);
 667 }
 668 EXPORT_SYMBOL(xfrm_sad_getinfo);
 669
 670 static int
 671 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 672                   struct xfrm_tmpl *tmpl,
 673                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 674                   unsigned short family)
 675 {
 676         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 677         if (!afinfo)
 678                 return -1;
 679         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 680         xfrm_state_put_afinfo(afinfo);
 681         return 0;
 682 }
 683
 684 static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 685 {
 686         unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
 687         struct xfrm_state *x;
 688         struct hlist_node *entry;
 689
 690         hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
 691                 if (x->props.family != family ||
 692                     x->id.spi       != spi ||
 693                     x->id.proto     != proto)
 694                         continue;
 695
 696                 switch (family) {
 697                 case AF_INET:
 698                         if (x->id.daddr.a4 != daddr->a4)
 699                                 continue;
 700                         break;
 701                 case AF_INET6:
 702                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 703                                              (struct in6_addr *)
 704                                              x->id.daddr.a6))
 705                                 continue;
 706                         break;
 707                 }
 708
 709                 xfrm_state_hold(x);
 710                 return x;
 711         }
 712
 713         return NULL;
 714 }
 715
 716 static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 717 {
 718         unsigned int h = xfrm_src_hash(daddr, saddr, family);
 719         struct xfrm_state *x;
 720         struct hlist_node *entry;
 721
 722         hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
 723                 if (x->props.family != family ||
 724                     x->id.proto     != proto)
 725                         continue;
 726
 727                 switch (family) {
 728                 case AF_INET:
 729                         if (x->id.daddr.a4 != daddr->a4 ||
 730                             x->props.saddr.a4 != saddr->a4)
 731                                 continue;
 732                         break;
 733                 case AF_INET6:
 734                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 735                                              (struct in6_addr *)
 736                                              x->id.daddr.a6) ||
 737                             !ipv6_addr_equal((struct in6_addr *)saddr,
 738                                              (struct in6_addr *)
 739                                              x->props.saddr.a6))
 740                                 continue;
 741                         break;
 742                 }
 743
 744                 xfrm_state_hold(x);
 745                 return x;
 746         }
 747
 748         return NULL;
 749 }
 750
 751 static inline struct xfrm_state *
 752 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
 753 {
 754         if (use_spi)
 755                 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
 756                                            x->id.proto, family);
 757         else
 758                 return __xfrm_state_lookup_byaddr(&x->id.daddr,
 759                                                   &x->props.saddr,
 760                                                   x->id.proto, family);
 761 }
 762
 763 static void xfrm_hash_grow_check(int have_hash_collision)
 764 {
 765         if (have_hash_collision &&
 766             (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
 767             xfrm_state_num > xfrm_state_hmask)
 768                 schedule_work(&xfrm_hash_work);
 769 }
 770
 771 struct xfrm_state *
 772 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 773                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 774                 struct xfrm_policy *pol, int *err,
 775                 unsigned short family)
 776 {
 777         unsigned int h;
 778         struct hlist_node *entry;
 779         struct xfrm_state *x, *x0, *to_put;
 780         int acquire_in_progress = 0;
 781         int error = 0;
 782         struct xfrm_state *best = NULL;
 783
 784         to_put = NULL;
 785
 786         spin_lock_bh(&xfrm_state_lock);
 787         h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
 788         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 789                 if (x->props.family == family &&
 790                     x->props.reqid == tmpl->reqid &&
 791                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 792                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 793                     tmpl->mode == x->props.mode &&
 794                     tmpl->id.proto == x->id.proto &&
 795                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 796                         /* Resolution logic:
 797                            1. There is a valid state with matching selector.
 798                               Done.
 799                            2. Valid state with inappropriate selector. Skip.
 800
 801                            Entering area of "sysdeps".
 802
 803                            3. If state is not valid, selector is temporary,
 804                               it selects only session which triggered
 805                               previous resolution. Key manager will do
 806                               something to install a state with proper
 807                               selector.
 808                          */
 809                         if (x->km.state == XFRM_STATE_VALID) {
 810                                 if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
 811                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
 812                                         continue;
 813                                 if (!best ||
 814                                     best->km.dying > x->km.dying ||
 815                                     (best->km.dying == x->km.dying &&
 816                                      best->curlft.add_time < x->curlft.add_time))
 817                                         best = x;
 818                         } else if (x->km.state == XFRM_STATE_ACQ) {
 819                                 acquire_in_progress = 1;
 820                         } else if (x->km.state == XFRM_STATE_ERROR ||
 821                                    x->km.state == XFRM_STATE_EXPIRED) {
 822                                 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
 823                                     security_xfrm_state_pol_flow_match(x, pol, fl))
 824                                         error = -ESRCH;
 825                         }
 826                 }
 827         }
 828
 829         x = best;
 830         if (!x && !error && !acquire_in_progress) {
 831                 if (tmpl->id.spi &&
 832                     (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
 833                                               tmpl->id.proto, family)) != NULL) {
 834                         to_put = x0;
 835                         error = -EEXIST;
 836                         goto out;
 837                 }
 838                 x = xfrm_state_alloc();
 839                 if (x == NULL) {
 840                         error = -ENOMEM;
 841                         goto out;
 842                 }
 843                 /* Initialize temporary selector matching only
 844                  * to current session. */
 845                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 846
 847                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
 848                 if (error) {
 849                         x->km.state = XFRM_STATE_DEAD;
 850                         to_put = x;
 851                         x = NULL;
 852                         goto out;
 853                 }
 854
 855                 if (km_query(x, tmpl, pol) == 0) {
 856                         x->km.state = XFRM_STATE_ACQ;
 857                         list_add(&x->km.all, &xfrm_state_all);
 858                         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 859                         h = xfrm_src_hash(daddr, saddr, family);
 860                         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 861                         if (x->id.spi) {
 862                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 863                                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 864                         }
 865                         x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
 866                         x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
 867                         add_timer(&x->timer);
 868                         xfrm_state_num++;
 869                         xfrm_hash_grow_check(x->bydst.next != NULL);
 870                 } else {
 871                         x->km.state = XFRM_STATE_DEAD;
 872                         to_put = x;
 873                         x = NULL;
 874                         error = -ESRCH;
 875                 }
 876         }
 877 out:
 878         if (x)
 879                 xfrm_state_hold(x);
 880         else
 881                 *err = acquire_in_progress ? -EAGAIN : error;
 882         spin_unlock_bh(&xfrm_state_lock);
 883         if (to_put)
 884                 xfrm_state_put(to_put);
 885         return x;
 886 }
 887
 888 struct xfrm_state *
 889 xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 890                     unsigned short family, u8 mode, u8 proto, u32 reqid)
 891 {
 892         unsigned int h;
 893         struct xfrm_state *rx = NULL, *x = NULL;
 894         struct hlist_node *entry;
 895
 896         spin_lock(&xfrm_state_lock);
 897         h = xfrm_dst_hash(daddr, saddr, reqid, family);
 898         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 899                 if (x->props.family == family &&
 900                     x->props.reqid == reqid &&
 901                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 902                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 903                     mode == x->props.mode &&
 904                     proto == x->id.proto &&
 905                     x->km.state == XFRM_STATE_VALID) {
 906                         rx = x;
 907                         break;
 908                 }
 909         }
 910
 911         if (rx)
 912                 xfrm_state_hold(rx);
 913         spin_unlock(&xfrm_state_lock);
 914
 915
 916         return rx;
 917 }
 918 EXPORT_SYMBOL(xfrm_stateonly_find);
 919
 920 static void __xfrm_state_insert(struct xfrm_state *x)
 921 {
 922         unsigned int h;
 923
 924         x->genid = ++xfrm_state_genid;
 925
 926         list_add(&x->km.all, &xfrm_state_all);
 927
 928         h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 929                           x->props.reqid, x->props.family);
 930         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 931
 932         h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
 933         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 934
 935         if (x->id.spi) {
 936                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
 937                                   x->props.family);
 938
 939                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 940         }
 941
 942         mod_timer(&x->timer, jiffies + HZ);
 943         if (x->replay_maxage)
 944                 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
 945
 946         wake_up(&km_waitq);
 947
 948         xfrm_state_num++;
 949
 950         xfrm_hash_grow_check(x->bydst.next != NULL);
 951 }
 952
 953 /* xfrm_state_lock is held */
 954 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 955 {
 956         unsigned short family = xnew->props.family;
 957         u32 reqid = xnew->props.reqid;
 958         struct xfrm_state *x;
 959         struct hlist_node *entry;
 960         unsigned int h;
 961
 962         h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
 963         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 964                 if (x->props.family     == family &&
 965                     x->props.reqid      == reqid &&
 966                     !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
 967                     !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
 968                         x->genid = xfrm_state_genid;
 969         }
 970 }
 971
 972 void xfrm_state_insert(struct xfrm_state *x)
 973 {
 974         spin_lock_bh(&xfrm_state_lock);
 975         __xfrm_state_bump_genids(x);
 976         __xfrm_state_insert(x);
 977         spin_unlock_bh(&xfrm_state_lock);
 978 }
 979 EXPORT_SYMBOL(xfrm_state_insert);
 980
 981 /* xfrm_state_lock is held */
 982 static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
 983 {
 984         unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
 985         struct hlist_node *entry;
 986         struct xfrm_state *x;
 987
 988         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 989                 if (x->props.reqid  != reqid ||
 990                     x->props.mode   != mode ||
 991                     x->props.family != family ||
 992                     x->km.state     != XFRM_STATE_ACQ ||
 993                     x->id.spi       != 0 ||
 994                     x->id.proto     != proto)
 995                         continue;
 996
 997                 switch (family) {
 998                 case AF_INET:
 999                         if (x->id.daddr.a4    != daddr->a4 ||
1000                             x->props.saddr.a4 != saddr->a4)
1001                                 continue;
1002                         break;
1003                 case AF_INET6:
1004                         if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
1005                                              (struct in6_addr *)daddr) ||
1006                             !ipv6_addr_equal((struct in6_addr *)
1007                                              x->props.saddr.a6,
1008                                              (struct in6_addr *)saddr))
1009                                 continue;
1010                         break;
1011                 }
1012
1013                 xfrm_state_hold(x);
1014                 return x;
1015         }
1016
1017         if (!create)
1018                 return NULL;
1019
1020         x = xfrm_state_alloc();
1021         if (likely(x)) {
1022                 switch (family) {
1023                 case AF_INET:
1024                         x->sel.daddr.a4 = daddr->a4;
1025                         x->sel.saddr.a4 = saddr->a4;
1026                         x->sel.prefixlen_d = 32;
1027                         x->sel.prefixlen_s = 32;
1028                         x->props.saddr.a4 = saddr->a4;
1029                         x->id.daddr.a4 = daddr->a4;
1030                         break;
1031
1032                 case AF_INET6:
1033                         ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1034                                        (struct in6_addr *)daddr);
1035                         ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1036                                        (struct in6_addr *)saddr);
1037                         x->sel.prefixlen_d = 128;
1038                         x->sel.prefixlen_s = 128;
1039                         ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1040                                        (struct in6_addr *)saddr);
1041                         ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1042                                        (struct in6_addr *)daddr);
1043                         break;
1044                 }
1045
1046                 x->km.state = XFRM_STATE_ACQ;
1047                 x->id.proto = proto;
1048                 x->props.family = family;
1049                 x->props.mode = mode;
1050                 x->props.reqid = reqid;
1051                 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
1052                 xfrm_state_hold(x);
1053                 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1054                 add_timer(&x->timer);
1055                 list_add(&x->km.all, &xfrm_state_all);
1056                 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1057                 h = xfrm_src_hash(daddr, saddr, family);
1058                 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1059
1060                 xfrm_state_num++;
1061
1062                 xfrm_hash_grow_check(x->bydst.next != NULL);
1063         }
1064
1065         return x;
1066 }
1067
1068 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
1069
1070 int xfrm_state_add(struct xfrm_state *x)
1071 {
1072         struct xfrm_state *x1, *to_put;
1073         int family;
1074         int err;
1075         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1076
1077         family = x->props.family;
1078
1079         to_put = NULL;
1080
1081         spin_lock_bh(&xfrm_state_lock);
1082
1083         x1 = __xfrm_state_locate(x, use_spi, family);
1084         if (x1) {
1085                 to_put = x1;
1086                 x1 = NULL;
1087                 err = -EEXIST;
1088                 goto out;
1089         }
1090
1091         if (use_spi && x->km.seq) {
1092                 x1 = __xfrm_find_acq_byseq(x->km.seq);
1093                 if (x1 && ((x1->id.proto != x->id.proto) ||
1094                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1095                         to_put = x1;
1096                         x1 = NULL;
1097                 }
1098         }
1099
1100         if (use_spi && !x1)
1101                 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
1102                                      x->id.proto,
1103                                      &x->id.daddr, &x->props.saddr, 0);
1104
1105         __xfrm_state_bump_genids(x);
1106         __xfrm_state_insert(x);
1107         err = 0;
1108
1109 out:
1110         spin_unlock_bh(&xfrm_state_lock);
1111
1112         if (x1) {
1113                 xfrm_state_delete(x1);
1114                 xfrm_state_put(x1);
1115         }
1116
1117         if (to_put)
1118                 xfrm_state_put(to_put);
1119
1120         return err;
1121 }
1122 EXPORT_SYMBOL(xfrm_state_add);
1123
1124 #ifdef CONFIG_XFRM_MIGRATE
1125 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1126 {
1127         int err = -ENOMEM;
1128         struct xfrm_state *x = xfrm_state_alloc();
1129         if (!x)
1130                 goto error;
1131
1132         memcpy(&x->id, &orig->id, sizeof(x->id));
1133         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1134         memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1135         x->props.mode = orig->props.mode;
1136         x->props.replay_window = orig->props.replay_window;
1137         x->props.reqid = orig->props.reqid;
1138         x->props.family = orig->props.family;
1139         x->props.saddr = orig->props.saddr;
1140
1141         if (orig->aalg) {
1142                 x->aalg = xfrm_algo_clone(orig->aalg);
1143                 if (!x->aalg)
1144                         goto error;
1145         }
1146         x->props.aalgo = orig->props.aalgo;
1147
1148         if (orig->ealg) {
1149                 x->ealg = xfrm_algo_clone(orig->ealg);
1150                 if (!x->ealg)
1151                         goto error;
1152         }
1153         x->props.ealgo = orig->props.ealgo;
1154
1155         if (orig->calg) {
1156                 x->calg = xfrm_algo_clone(orig->calg);
1157                 if (!x->calg)
1158                         goto error;
1159         }
1160         x->props.calgo = orig->props.calgo;
1161
1162         if (orig->encap) {
1163                 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1164                 if (!x->encap)
1165                         goto error;
1166         }
1167
1168         if (orig->coaddr) {
1169                 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1170                                     GFP_KERNEL);
1171                 if (!x->coaddr)
1172                         goto error;
1173         }
1174
1175         err = xfrm_init_state(x);
1176         if (err)
1177                 goto error;
1178
1179         x->props.flags = orig->props.flags;
1180
1181         x->curlft.add_time = orig->curlft.add_time;
1182         x->km.state = orig->km.state;
1183         x->km.seq = orig->km.seq;
1184
1185         return x;
1186
1187  error:
1188         if (errp)
1189                 *errp = err;
1190         if (x) {
1191                 kfree(x->aalg);
1192                 kfree(x->ealg);
1193                 kfree(x->calg);
1194                 kfree(x->encap);
1195                 kfree(x->coaddr);
1196         }
1197         kfree(x);
1198         return NULL;
1199 }
1200
1201 /* xfrm_state_lock is held */
1202 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1203 {
1204         unsigned int h;
1205         struct xfrm_state *x;
1206         struct hlist_node *entry;
1207
1208         if (m->reqid) {
1209                 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1210                                   m->reqid, m->old_family);
1211                 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1212                         if (x->props.mode != m->mode ||
1213                             x->id.proto != m->proto)
1214                                 continue;
1215                         if (m->reqid && x->props.reqid != m->reqid)
1216                                 continue;
1217                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1218                                           m->old_family) ||
1219                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1220                                           m->old_family))
1221                                 continue;
1222                         xfrm_state_hold(x);
1223                         return x;
1224                 }
1225         } else {
1226                 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1227                                   m->old_family);
1228                 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1229                         if (x->props.mode != m->mode ||
1230                             x->id.proto != m->proto)
1231                                 continue;
1232                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1233                                           m->old_family) ||
1234                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1235                                           m->old_family))
1236                                 continue;
1237                         xfrm_state_hold(x);
1238                         return x;
1239                 }
1240         }
1241
1242         return NULL;
1243 }
1244 EXPORT_SYMBOL(xfrm_migrate_state_find);
1245
1246 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1247                                        struct xfrm_migrate *m)
1248 {
1249         struct xfrm_state *xc;
1250         int err;
1251
1252         xc = xfrm_state_clone(x, &err);
1253         if (!xc)
1254                 return NULL;
1255
1256         memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1257         memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1258
1259         /* add state */
1260         if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1261                 /* a care is needed when the destination address of the
1262                    state is to be updated as it is a part of triplet */
1263                 xfrm_state_insert(xc);
1264         } else {
1265                 if ((err = xfrm_state_add(xc)) < 0)
1266                         goto error;
1267         }
1268
1269         return xc;
1270 error:
1271         kfree(xc);
1272         return NULL;
1273 }
1274 EXPORT_SYMBOL(xfrm_state_migrate);
1275 #endif
1276
1277 int xfrm_state_update(struct xfrm_state *x)
1278 {
1279         struct xfrm_state *x1, *to_put;
1280         int err;
1281         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1282
1283         to_put = NULL;
1284
1285         spin_lock_bh(&xfrm_state_lock);
1286         x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1287
1288         err = -ESRCH;
1289         if (!x1)
1290                 goto out;
1291
1292         if (xfrm_state_kern(x1)) {
1293                 to_put = x1;
1294                 err = -EEXIST;
1295                 goto out;
1296         }
1297
1298         if (x1->km.state == XFRM_STATE_ACQ) {
1299                 __xfrm_state_insert(x);
1300                 x = NULL;
1301         }
1302         err = 0;
1303
1304 out:
1305         spin_unlock_bh(&xfrm_state_lock);
1306
1307         if (to_put)
1308                 xfrm_state_put(to_put);
1309
1310         if (err)
1311                 return err;
1312
1313         if (!x) {
1314                 xfrm_state_delete(x1);
1315                 xfrm_state_put(x1);
1316                 return 0;
1317         }
1318
1319         err = -EINVAL;
1320         spin_lock_bh(&x1->lock);
1321         if (likely(x1->km.state == XFRM_STATE_VALID)) {
1322                 if (x->encap && x1->encap)
1323                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1324                 if (x->coaddr && x1->coaddr) {
1325                         memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1326                 }
1327                 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1328                         memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1329                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1330                 x1->km.dying = 0;
1331
1332                 mod_timer(&x1->timer, jiffies + HZ);
1333                 if (x1->curlft.use_time)
1334                         xfrm_state_check_expire(x1);
1335
1336                 err = 0;
1337         }
1338         spin_unlock_bh(&x1->lock);
1339
1340         xfrm_state_put(x1);
1341
1342         return err;
1343 }
1344 EXPORT_SYMBOL(xfrm_state_update);
1345
1346 int xfrm_state_check_expire(struct xfrm_state *x)
1347 {
1348         if (!x->curlft.use_time)
1349                 x->curlft.use_time = get_seconds();
1350
1351         if (x->km.state != XFRM_STATE_VALID)
1352                 return -EINVAL;
1353
1354         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1355             x->curlft.packets >= x->lft.hard_packet_limit) {
1356                 x->km.state = XFRM_STATE_EXPIRED;
1357                 mod_timer(&x->timer, jiffies);
1358                 return -EINVAL;
1359         }
1360
1361         if (!x->km.dying &&
1362             (x->curlft.bytes >= x->lft.soft_byte_limit ||
1363              x->curlft.packets >= x->lft.soft_packet_limit)) {
1364                 x->km.dying = 1;
1365                 km_state_expired(x, 0, 0);
1366         }
1367         return 0;
1368 }
1369 EXPORT_SYMBOL(xfrm_state_check_expire);
1370
1371 struct xfrm_state *
1372 xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1373                   unsigned short family)
1374 {
1375         struct xfrm_state *x;
1376
1377         spin_lock_bh(&xfrm_state_lock);
1378         x = __xfrm_state_lookup(daddr, spi, proto, family);
1379         spin_unlock_bh(&xfrm_state_lock);
1380         return x;
1381 }
1382 EXPORT_SYMBOL(xfrm_state_lookup);
1383
1384 struct xfrm_state *
1385 xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1386                          u8 proto, unsigned short family)
1387 {
1388         struct xfrm_state *x;
1389
1390         spin_lock_bh(&xfrm_state_lock);
1391         x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
1392         spin_unlock_bh(&xfrm_state_lock);
1393         return x;
1394 }
1395 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1396
1397 struct xfrm_state *
1398 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1399               xfrm_address_t *daddr, xfrm_address_t *saddr,
1400               int create, unsigned short family)
1401 {
1402         struct xfrm_state *x;
1403
1404         spin_lock_bh(&xfrm_state_lock);
1405         x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1406         spin_unlock_bh(&xfrm_state_lock);
1407
1408         return x;
1409 }
1410 EXPORT_SYMBOL(xfrm_find_acq);
1411
1412 #ifdef CONFIG_XFRM_SUB_POLICY
1413 int
1414 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1415                unsigned short family)
1416 {
1417         int err = 0;
1418         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1419         if (!afinfo)
1420                 return -EAFNOSUPPORT;
1421
1422         spin_lock_bh(&xfrm_state_lock);
1423         if (afinfo->tmpl_sort)
1424                 err = afinfo->tmpl_sort(dst, src, n);
1425         spin_unlock_bh(&xfrm_state_lock);
1426         xfrm_state_put_afinfo(afinfo);
1427         return err;
1428 }
1429 EXPORT_SYMBOL(xfrm_tmpl_sort);
1430
1431 int
1432 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1433                 unsigned short family)
1434 {
1435         int err = 0;
1436         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1437         if (!afinfo)
1438                 return -EAFNOSUPPORT;
1439
1440         spin_lock_bh(&xfrm_state_lock);
1441         if (afinfo->state_sort)
1442                 err = afinfo->state_sort(dst, src, n);
1443         spin_unlock_bh(&xfrm_state_lock);
1444         xfrm_state_put_afinfo(afinfo);
1445         return err;
1446 }
1447 EXPORT_SYMBOL(xfrm_state_sort);
1448 #endif
1449
1450 /* Silly enough, but I'm lazy to build resolution list */
1451
1452 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1453 {
1454         int i;
1455
1456         for (i = 0; i <= xfrm_state_hmask; i++) {
1457                 struct hlist_node *entry;
1458                 struct xfrm_state *x;
1459
1460                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1461                         if (x->km.seq == seq &&
1462                             x->km.state == XFRM_STATE_ACQ) {
1463                                 xfrm_state_hold(x);
1464                                 return x;
1465                         }
1466                 }
1467         }
1468         return NULL;
1469 }
1470
1471 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1472 {
1473         struct xfrm_state *x;
1474
1475         spin_lock_bh(&xfrm_state_lock);
1476         x = __xfrm_find_acq_byseq(seq);
1477         spin_unlock_bh(&xfrm_state_lock);
1478         return x;
1479 }
1480 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1481
1482 u32 xfrm_get_acqseq(void)
1483 {
1484         u32 res;
1485         static u32 acqseq;
1486         static DEFINE_SPINLOCK(acqseq_lock);
1487
1488         spin_lock_bh(&acqseq_lock);
1489         res = (++acqseq ? : ++acqseq);
1490         spin_unlock_bh(&acqseq_lock);
1491         return res;
1492 }
1493 EXPORT_SYMBOL(xfrm_get_acqseq);
1494
1495 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1496 {
1497         unsigned int h;
1498         struct xfrm_state *x0;
1499         int err = -ENOENT;
1500         __be32 minspi = htonl(low);
1501         __be32 maxspi = htonl(high);
1502
1503         spin_lock_bh(&x->lock);
1504         if (x->km.state == XFRM_STATE_DEAD)
1505                 goto unlock;
1506
1507         err = 0;
1508         if (x->id.spi)
1509                 goto unlock;
1510
1511         err = -ENOENT;
1512
1513         if (minspi == maxspi) {
1514                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1515                 if (x0) {
1516                         xfrm_state_put(x0);
1517                         goto unlock;
1518                 }
1519                 x->id.spi = minspi;
1520         } else {
1521                 u32 spi = 0;
1522                 for (h=0; h<high-low+1; h++) {
1523                         spi = low + net_random()%(high-low+1);
1524                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1525                         if (x0 == NULL) {
1526                                 x->id.spi = htonl(spi);
1527                                 break;
1528                         }
1529                         xfrm_state_put(x0);
1530                 }
1531         }
1532         if (x->id.spi) {
1533                 spin_lock_bh(&xfrm_state_lock);
1534                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1535                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1536                 spin_unlock_bh(&xfrm_state_lock);
1537
1538                 err = 0;
1539         }
1540
1541 unlock:
1542         spin_unlock_bh(&x->lock);
1543
1544         return err;
1545 }
1546 EXPORT_SYMBOL(xfrm_alloc_spi);
1547
1548 int xfrm_state_walk(struct xfrm_state_walk *walk,
1549                     int (*func)(struct xfrm_state *, int, void*),
1550                     void *data)
1551 {
1552         struct xfrm_state *state;
1553         struct xfrm_state_walk *x;
1554         int err = 0;
1555
1556         if (walk->seq != 0 && list_empty(&walk->all))
1557                 return 0;
1558
1559         spin_lock_bh(&xfrm_state_lock);
1560         if (list_empty(&walk->all))
1561                 x = list_first_entry(&xfrm_state_all, struct xfrm_state_walk, all);
1562         else
1563                 x = list_entry(&walk->all, struct xfrm_state_walk, all);
1564         list_for_each_entry_from(x, &xfrm_state_all, all) {
1565                 if (x->state == XFRM_STATE_DEAD)
1566                         continue;
1567                 state = container_of(x, struct xfrm_state, km);
1568                 if (!xfrm_id_proto_match(state->id.proto, walk->proto))
1569                         continue;
1570                 err = func(state, walk->seq, data);
1571                 if (err) {
1572                         list_move_tail(&walk->all, &x->all);
1573                         goto out;
1574                 }
1575                 walk->seq++;
1576         }
1577         if (walk->seq == 0) {
1578                 err = -ENOENT;
1579                 goto out;
1580         }
1581         list_del_init(&walk->all);
1582 out:
1583         spin_unlock_bh(&xfrm_state_lock);
1584         return err;
1585 }
1586 EXPORT_SYMBOL(xfrm_state_walk);
1587
1588 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
1589 {
1590         INIT_LIST_HEAD(&walk->all);
1591         walk->proto = proto;
1592         walk->state = XFRM_STATE_DEAD;
1593         walk->seq = 0;
1594 }
1595 EXPORT_SYMBOL(xfrm_state_walk_init);
1596
1597 void xfrm_state_walk_done(struct xfrm_state_walk *walk)
1598 {
1599         if (list_empty(&walk->all))
1600                 return;
1601
1602         spin_lock_bh(&xfrm_state_lock);
1603         list_del(&walk->all);
1604         spin_lock_bh(&xfrm_state_lock);
1605 }
1606 EXPORT_SYMBOL(xfrm_state_walk_done);
1607
1608
1609 void xfrm_replay_notify(struct xfrm_state *x, int event)
1610 {
1611         struct km_event c;
1612         /* we send notify messages in case
1613          *  1. we updated on of the sequence numbers, and the seqno difference
1614          *     is at least x->replay_maxdiff, in this case we also update the
1615          *     timeout of our timer function
1616          *  2. if x->replay_maxage has elapsed since last update,
1617          *     and there were changes
1618          *
1619          *  The state structure must be locked!
1620          */
1621
1622         switch (event) {
1623         case XFRM_REPLAY_UPDATE:
1624                 if (x->replay_maxdiff &&
1625                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1626                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1627                         if (x->xflags & XFRM_TIME_DEFER)
1628                                 event = XFRM_REPLAY_TIMEOUT;
1629                         else
1630                                 return;
1631                 }
1632
1633                 break;
1634
1635         case XFRM_REPLAY_TIMEOUT:
1636                 if ((x->replay.seq == x->preplay.seq) &&
1637                     (x->replay.bitmap == x->preplay.bitmap) &&
1638                     (x->replay.oseq == x->preplay.oseq)) {
1639                         x->xflags |= XFRM_TIME_DEFER;
1640                         return;
1641                 }
1642
1643                 break;
1644         }
1645
1646         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1647         c.event = XFRM_MSG_NEWAE;
1648         c.data.aevent = event;
1649         km_state_notify(x, &c);
1650
1651         if (x->replay_maxage &&
1652             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1653                 x->xflags &= ~XFRM_TIME_DEFER;
1654 }
1655
1656 static void xfrm_replay_timer_handler(unsigned long data)
1657 {
1658         struct xfrm_state *x = (struct xfrm_state*)data;
1659
1660         spin_lock(&x->lock);
1661
1662         if (x->km.state == XFRM_STATE_VALID) {
1663                 if (xfrm_aevent_is_on())
1664                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1665                 else
1666                         x->xflags |= XFRM_TIME_DEFER;
1667         }
1668
1669         spin_unlock(&x->lock);
1670 }
1671
1672 int xfrm_replay_check(struct xfrm_state *x,
1673                       struct sk_buff *skb, __be32 net_seq)
1674 {
1675         u32 diff;
1676         u32 seq = ntohl(net_seq);
1677
1678         if (unlikely(seq == 0))
1679                 goto err;
1680
1681         if (likely(seq > x->replay.seq))
1682                 return 0;
1683
1684         diff = x->replay.seq - seq;
1685         if (diff >= min_t(unsigned int, x->props.replay_window,
1686                           sizeof(x->replay.bitmap) * 8)) {
1687                 x->stats.replay_window++;
1688                 goto err;
1689         }
1690
1691         if (x->replay.bitmap & (1U << diff)) {
1692                 x->stats.replay++;
1693                 goto err;
1694         }
1695         return 0;
1696
1697 err:
1698         xfrm_audit_state_replay(x, skb, net_seq);
1699         return -EINVAL;
1700 }
1701
1702 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1703 {
1704         u32 diff;
1705         u32 seq = ntohl(net_seq);
1706
1707         if (seq > x->replay.seq) {
1708                 diff = seq - x->replay.seq;
1709                 if (diff < x->props.replay_window)
1710                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1711                 else
1712                         x->replay.bitmap = 1;
1713                 x->replay.seq = seq;
1714         } else {
1715                 diff = x->replay.seq - seq;
1716                 x->replay.bitmap |= (1U << diff);
1717         }
1718
1719         if (xfrm_aevent_is_on())
1720                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1721 }
1722
1723 static LIST_HEAD(xfrm_km_list);
1724 static DEFINE_RWLOCK(xfrm_km_lock);
1725
1726 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1727 {
1728         struct xfrm_mgr *km;
1729
1730         read_lock(&xfrm_km_lock);
1731         list_for_each_entry(km, &xfrm_km_list, list)
1732                 if (km->notify_policy)
1733                         km->notify_policy(xp, dir, c);
1734         read_unlock(&xfrm_km_lock);
1735 }
1736
1737 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1738 {
1739         struct xfrm_mgr *km;
1740         read_lock(&xfrm_km_lock);
1741         list_for_each_entry(km, &xfrm_km_list, list)
1742                 if (km->notify)
1743                         km->notify(x, c);
1744         read_unlock(&xfrm_km_lock);
1745 }
1746
1747 EXPORT_SYMBOL(km_policy_notify);
1748 EXPORT_SYMBOL(km_state_notify);
1749
1750 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1751 {
1752         struct km_event c;
1753
1754         c.data.hard = hard;
1755         c.pid = pid;
1756         c.event = XFRM_MSG_EXPIRE;
1757         km_state_notify(x, &c);
1758
1759         if (hard)
1760                 wake_up(&km_waitq);
1761 }
1762
1763 EXPORT_SYMBOL(km_state_expired);
1764 /*
1765  * We send to all registered managers regardless of failure
1766  * We are happy with one success
1767 */
1768 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1769 {
1770         int err = -EINVAL, acqret;
1771         struct xfrm_mgr *km;
1772
1773         read_lock(&xfrm_km_lock);
1774         list_for_each_entry(km, &xfrm_km_list, list) {
1775                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1776                 if (!acqret)
1777                         err = acqret;
1778         }
1779         read_unlock(&xfrm_km_lock);
1780         return err;
1781 }
1782 EXPORT_SYMBOL(km_query);
1783
1784 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1785 {
1786         int err = -EINVAL;
1787         struct xfrm_mgr *km;
1788
1789         read_lock(&xfrm_km_lock);
1790         list_for_each_entry(km, &xfrm_km_list, list) {
1791                 if (km->new_mapping)
1792                         err = km->new_mapping(x, ipaddr, sport);
1793                 if (!err)
1794                         break;
1795         }
1796         read_unlock(&xfrm_km_lock);
1797         return err;
1798 }
1799 EXPORT_SYMBOL(km_new_mapping);
1800
1801 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1802 {
1803         struct km_event c;
1804
1805         c.data.hard = hard;
1806         c.pid = pid;
1807         c.event = XFRM_MSG_POLEXPIRE;
1808         km_policy_notify(pol, dir, &c);
1809
1810         if (hard)
1811                 wake_up(&km_waitq);
1812 }
1813 EXPORT_SYMBOL(km_policy_expired);
1814
1815 #ifdef CONFIG_XFRM_MIGRATE
1816 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1817                struct xfrm_migrate *m, int num_migrate,
1818                struct xfrm_kmaddress *k)
1819 {
1820         int err = -EINVAL;
1821         int ret;
1822         struct xfrm_mgr *km;
1823
1824         read_lock(&xfrm_km_lock);
1825         list_for_each_entry(km, &xfrm_km_list, list) {
1826                 if (km->migrate) {
1827                         ret = km->migrate(sel, dir, type, m, num_migrate, k);
1828                         if (!ret)
1829                                 err = ret;
1830                 }
1831         }
1832         read_unlock(&xfrm_km_lock);
1833         return err;
1834 }
1835 EXPORT_SYMBOL(km_migrate);
1836 #endif
1837
1838 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1839 {
1840         int err = -EINVAL;
1841         int ret;
1842         struct xfrm_mgr *km;
1843
1844         read_lock(&xfrm_km_lock);
1845         list_for_each_entry(km, &xfrm_km_list, list) {
1846                 if (km->report) {
1847                         ret = km->report(proto, sel, addr);
1848                         if (!ret)
1849                                 err = ret;
1850                 }
1851         }
1852         read_unlock(&xfrm_km_lock);
1853         return err;
1854 }
1855 EXPORT_SYMBOL(km_report);
1856
1857 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1858 {
1859         int err;
1860         u8 *data;
1861         struct xfrm_mgr *km;
1862         struct xfrm_policy *pol = NULL;
1863
1864         if (optlen <= 0 || optlen > PAGE_SIZE)
1865                 return -EMSGSIZE;
1866
1867         data = kmalloc(optlen, GFP_KERNEL);
1868         if (!data)
1869                 return -ENOMEM;
1870
1871         err = -EFAULT;
1872         if (copy_from_user(data, optval, optlen))
1873                 goto out;
1874
1875         err = -EINVAL;
1876         read_lock(&xfrm_km_lock);
1877         list_for_each_entry(km, &xfrm_km_list, list) {
1878                 pol = km->compile_policy(sk, optname, data,
1879                                          optlen, &err);
1880                 if (err >= 0)
1881                         break;
1882         }
1883         read_unlock(&xfrm_km_lock);
1884
1885         if (err >= 0) {
1886                 xfrm_sk_policy_insert(sk, err, pol);
1887                 xfrm_pol_put(pol);
1888                 err = 0;
1889         }
1890
1891 out:
1892         kfree(data);
1893         return err;
1894 }
1895 EXPORT_SYMBOL(xfrm_user_policy);
1896
1897 int xfrm_register_km(struct xfrm_mgr *km)
1898 {
1899         write_lock_bh(&xfrm_km_lock);
1900         list_add_tail(&km->list, &xfrm_km_list);
1901         write_unlock_bh(&xfrm_km_lock);
1902         return 0;
1903 }
1904 EXPORT_SYMBOL(xfrm_register_km);
1905
1906 int xfrm_unregister_km(struct xfrm_mgr *km)
1907 {
1908         write_lock_bh(&xfrm_km_lock);
1909         list_del(&km->list);
1910         write_unlock_bh(&xfrm_km_lock);
1911         return 0;
1912 }
1913 EXPORT_SYMBOL(xfrm_unregister_km);
1914
1915 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1916 {
1917         int err = 0;
1918         if (unlikely(afinfo == NULL))
1919                 return -EINVAL;
1920         if (unlikely(afinfo->family >= NPROTO))
1921                 return -EAFNOSUPPORT;
1922         write_lock_bh(&xfrm_state_afinfo_lock);
1923         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1924                 err = -ENOBUFS;
1925         else
1926                 xfrm_state_afinfo[afinfo->family] = afinfo;
1927         write_unlock_bh(&xfrm_state_afinfo_lock);
1928         return err;
1929 }
1930 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1931
1932 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1933 {
1934         int err = 0;
1935         if (unlikely(afinfo == NULL))
1936                 return -EINVAL;
1937         if (unlikely(afinfo->family >= NPROTO))
1938                 return -EAFNOSUPPORT;
1939         write_lock_bh(&xfrm_state_afinfo_lock);
1940         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1941                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1942                         err = -EINVAL;
1943                 else
1944                         xfrm_state_afinfo[afinfo->family] = NULL;
1945         }
1946         write_unlock_bh(&xfrm_state_afinfo_lock);
1947         return err;
1948 }
1949 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1950
1951 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1952 {
1953         struct xfrm_state_afinfo *afinfo;
1954         if (unlikely(family >= NPROTO))
1955                 return NULL;
1956         read_lock(&xfrm_state_afinfo_lock);
1957         afinfo = xfrm_state_afinfo[family];
1958         if (unlikely(!afinfo))
1959                 read_unlock(&xfrm_state_afinfo_lock);
1960         return afinfo;
1961 }
1962
1963 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1964         __releases(xfrm_state_afinfo_lock)
1965 {
1966         read_unlock(&xfrm_state_afinfo_lock);
1967 }
1968
1969 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1970 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1971 {
1972         if (x->tunnel) {
1973                 struct xfrm_state *t = x->tunnel;
1974
1975                 if (atomic_read(&t->tunnel_users) == 2)
1976                         xfrm_state_delete(t);
1977                 atomic_dec(&t->tunnel_users);
1978                 xfrm_state_put(t);
1979                 x->tunnel = NULL;
1980         }
1981 }
1982 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1983
1984 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1985 {
1986         int res;
1987
1988         spin_lock_bh(&x->lock);
1989         if (x->km.state == XFRM_STATE_VALID &&
1990             x->type && x->type->get_mtu)
1991                 res = x->type->get_mtu(x, mtu);
1992         else
1993                 res = mtu - x->props.header_len;
1994         spin_unlock_bh(&x->lock);
1995         return res;
1996 }
1997
1998 int xfrm_init_state(struct xfrm_state *x)
1999 {
2000         struct xfrm_state_afinfo *afinfo;
2001         struct xfrm_mode *inner_mode;
2002         int family = x->props.family;
2003         int err;
2004
2005         err = -EAFNOSUPPORT;
2006         afinfo = xfrm_state_get_afinfo(family);
2007         if (!afinfo)
2008                 goto error;
2009
2010         err = 0;
2011         if (afinfo->init_flags)
2012                 err = afinfo->init_flags(x);
2013
2014         xfrm_state_put_afinfo(afinfo);
2015
2016         if (err)
2017                 goto error;
2018
2019         err = -EPROTONOSUPPORT;
2020
2021         if (x->sel.family != AF_UNSPEC) {
2022                 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2023                 if (inner_mode == NULL)
2024                         goto error;
2025
2026                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2027                     family != x->sel.family) {
2028                         xfrm_put_mode(inner_mode);
2029                         goto error;
2030                 }
2031
2032                 x->inner_mode = inner_mode;
2033         } else {
2034                 struct xfrm_mode *inner_mode_iaf;
2035
2036                 inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
2037                 if (inner_mode == NULL)
2038                         goto error;
2039
2040                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2041                         xfrm_put_mode(inner_mode);
2042                         goto error;
2043                 }
2044
2045                 inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
2046                 if (inner_mode_iaf == NULL)
2047                         goto error;
2048
2049                 if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
2050                         xfrm_put_mode(inner_mode_iaf);
2051                         goto error;
2052                 }
2053
2054                 if (x->props.family == AF_INET) {
2055                         x->inner_mode = inner_mode;
2056                         x->inner_mode_iaf = inner_mode_iaf;
2057                 } else {
2058                         x->inner_mode = inner_mode_iaf;
2059                         x->inner_mode_iaf = inner_mode;
2060                 }
2061         }
2062
2063         x->type = xfrm_get_type(x->id.proto, family);
2064         if (x->type == NULL)
2065                 goto error;
2066
2067         err = x->type->init_state(x);
2068         if (err)
2069                 goto error;
2070
2071         x->outer_mode = xfrm_get_mode(x->props.mode, family);
2072         if (x->outer_mode == NULL)
2073                 goto error;
2074
2075         x->km.state = XFRM_STATE_VALID;
2076
2077 error:
2078         return err;
2079 }
2080
2081 EXPORT_SYMBOL(xfrm_init_state);
2082
2083 void __init xfrm_state_init(void)
2084 {
2085         unsigned int sz;
2086
2087         sz = sizeof(struct hlist_head) * 8;
2088
2089         xfrm_state_bydst = xfrm_hash_alloc(sz);
2090         xfrm_state_bysrc = xfrm_hash_alloc(sz);
2091         xfrm_state_byspi = xfrm_hash_alloc(sz);
2092         if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
2093                 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
2094         xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2095
2096         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
2097 }
2098
2099 #ifdef CONFIG_AUDITSYSCALL
2100 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2101                                      struct audit_buffer *audit_buf)
2102 {
2103         struct xfrm_sec_ctx *ctx = x->security;
2104         u32 spi = ntohl(x->id.spi);
2105
2106         if (ctx)
2107                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2108                                  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2109
2110         switch(x->props.family) {
2111         case AF_INET:
2112                 audit_log_format(audit_buf,
2113                                  " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2114                                  NIPQUAD(x->props.saddr.a4),
2115                                  NIPQUAD(x->id.daddr.a4));
2116                 break;
2117         case AF_INET6:
2118                 audit_log_format(audit_buf, " src=%p6 dst=%p6",
2119                                  x->props.saddr.a6, x->id.daddr.a6);
2120                 break;
2121         }
2122
2123         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2124 }
2125
2126 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2127                                       struct audit_buffer *audit_buf)
2128 {
2129         struct iphdr *iph4;
2130         struct ipv6hdr *iph6;
2131
2132         switch (family) {
2133         case AF_INET:
2134                 iph4 = ip_hdr(skb);
2135                 audit_log_format(audit_buf,
2136                                  " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2137                                  NIPQUAD(iph4->saddr),
2138                                  NIPQUAD(iph4->daddr));
2139                 break;
2140         case AF_INET6:
2141                 iph6 = ipv6_hdr(skb);
2142                 audit_log_format(audit_buf,
2143                                  " src=%p6 dst=%p6 flowlbl=0x%x%02x%02x",
2144                                  &iph6->saddr,&iph6->daddr,
2145                                  iph6->flow_lbl[0] & 0x0f,
2146                                  iph6->flow_lbl[1],
2147                                  iph6->flow_lbl[2]);
2148                 break;
2149         }
2150 }
2151
2152 void xfrm_audit_state_add(struct xfrm_state *x, int result,
2153                           uid_t auid, u32 sessionid, u32 secid)
2154 {
2155         struct audit_buffer *audit_buf;
2156
2157         audit_buf = xfrm_audit_start("SAD-add");
2158         if (audit_buf == NULL)
2159                 return;
2160         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2161         xfrm_audit_helper_sainfo(x, audit_buf);
2162         audit_log_format(audit_buf, " res=%u", result);
2163         audit_log_end(audit_buf);
2164 }
2165 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2166
2167 void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2168                              uid_t auid, u32 sessionid, u32 secid)
2169 {
2170         struct audit_buffer *audit_buf;
2171
2172         audit_buf = xfrm_audit_start("SAD-delete");
2173         if (audit_buf == NULL)
2174                 return;
2175         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2176         xfrm_audit_helper_sainfo(x, audit_buf);
2177         audit_log_format(audit_buf, " res=%u", result);
2178         audit_log_end(audit_buf);
2179 }
2180 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2181
2182 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2183                                       struct sk_buff *skb)
2184 {
2185         struct audit_buffer *audit_buf;
2186         u32 spi;
2187
2188         audit_buf = xfrm_audit_start("SA-replay-overflow");
2189         if (audit_buf == NULL)
2190                 return;
2191         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2192         /* don't record the sequence number because it's inherent in this kind
2193          * of audit message */
2194         spi = ntohl(x->id.spi);
2195         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2196         audit_log_end(audit_buf);
2197 }
2198 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2199
2200 static void xfrm_audit_state_replay(struct xfrm_state *x,
2201                              struct sk_buff *skb, __be32 net_seq)
2202 {
2203         struct audit_buffer *audit_buf;
2204         u32 spi;
2205
2206         audit_buf = xfrm_audit_start("SA-replayed-pkt");
2207         if (audit_buf == NULL)
2208                 return;
2209         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2210         spi = ntohl(x->id.spi);
2211         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2212                          spi, spi, ntohl(net_seq));
2213         audit_log_end(audit_buf);
2214 }
2215
2216 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2217 {
2218         struct audit_buffer *audit_buf;
2219
2220         audit_buf = xfrm_audit_start("SA-notfound");
2221         if (audit_buf == NULL)
2222                 return;
2223         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2224         audit_log_end(audit_buf);
2225 }
2226 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2227
2228 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2229                                __be32 net_spi, __be32 net_seq)
2230 {
2231         struct audit_buffer *audit_buf;
2232         u32 spi;
2233
2234         audit_buf = xfrm_audit_start("SA-notfound");
2235         if (audit_buf == NULL)
2236                 return;
2237         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2238         spi = ntohl(net_spi);
2239         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2240                          spi, spi, ntohl(net_seq));
2241         audit_log_end(audit_buf);
2242 }
2243 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2244
2245 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2246                               struct sk_buff *skb, u8 proto)
2247 {
2248         struct audit_buffer *audit_buf;
2249         __be32 net_spi;
2250         __be32 net_seq;
2251
2252         audit_buf = xfrm_audit_start("SA-icv-failure");
2253         if (audit_buf == NULL)
2254                 return;
2255         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2256         if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2257                 u32 spi = ntohl(net_spi);
2258                 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2259                                  spi, spi, ntohl(net_seq));
2260         }
2261         audit_log_end(audit_buf);
2262 }
2263 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2264 #endif /* CONFIG_AUDITSYSCALL */