SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <asm/uaccess.h>
  22
  23 struct sock *xfrm_nl;
  24 EXPORT_SYMBOL(xfrm_nl);
  25
  26 u32 sysctl_xfrm_aevent_etime = XFRM_AE_ETIME;
  27 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
  28
  29 u32 sysctl_xfrm_aevent_rseqth = XFRM_AE_SEQT_SIZE;
  30 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
  31
  32 /* Each xfrm_state may be linked to two tables:
  33
  34    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  35    2. Hash table by daddr to find what SAs exist for given
  36       destination/tunnel endpoint. (output)
  37  */
  38
  39 static DEFINE_SPINLOCK(xfrm_state_lock);
  40
  41 /* Hash table to find appropriate SA towards given target (endpoint
  42  * of tunnel or destination of transport mode) allowed by selector.
  43  *
  44  * Main use is finding SA after policy selected tunnel or transport mode.
  45  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  46  */
  47 static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE];
  48 static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE];
  49
  50 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
  51 EXPORT_SYMBOL(km_waitq);
  52
  53 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
  54 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
  55
  56 static struct work_struct xfrm_state_gc_work;
  57 static struct list_head xfrm_state_gc_list = LIST_HEAD_INIT(xfrm_state_gc_list);
  58 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
  59
  60 static int xfrm_state_gc_flush_bundles;
  61
  62 int __xfrm_state_delete(struct xfrm_state *x);
  63
  64 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family);
  65 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  66
  67 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
  68 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
  69
  70 static void xfrm_state_gc_destroy(struct xfrm_state *x)
  71 {
  72         if (del_timer(&x->timer))
  73                 BUG();
  74         if (del_timer(&x->rtimer))
  75                 BUG();
  76         kfree(x->aalg);
  77         kfree(x->ealg);
  78         kfree(x->calg);
  79         kfree(x->encap);
  80         if (x->mode)
  81                 xfrm_put_mode(x->mode);
  82         if (x->type) {
  83                 x->type->destructor(x);
  84                 xfrm_put_type(x->type);
  85         }
  86         security_xfrm_state_free(x);
  87         kfree(x);
  88 }
  89
  90 static void xfrm_state_gc_task(void *data)
  91 {
  92         struct xfrm_state *x;
  93         struct list_head *entry, *tmp;
  94         struct list_head gc_list = LIST_HEAD_INIT(gc_list);
  95
  96         if (xfrm_state_gc_flush_bundles) {
  97                 xfrm_state_gc_flush_bundles = 0;
  98                 xfrm_flush_bundles();
  99         }
 100
 101         spin_lock_bh(&xfrm_state_gc_lock);
 102         list_splice_init(&xfrm_state_gc_list, &gc_list);
 103         spin_unlock_bh(&xfrm_state_gc_lock);
 104
 105         list_for_each_safe(entry, tmp, &gc_list) {
 106                 x = list_entry(entry, struct xfrm_state, bydst);
 107                 xfrm_state_gc_destroy(x);
 108         }
 109         wake_up(&km_waitq);
 110 }
 111
 112 static inline unsigned long make_jiffies(long secs)
 113 {
 114         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 115                 return MAX_SCHEDULE_TIMEOUT-1;
 116         else
 117                 return secs*HZ;
 118 }
 119
 120 static void xfrm_timer_handler(unsigned long data)
 121 {
 122         struct xfrm_state *x = (struct xfrm_state*)data;
 123         unsigned long now = (unsigned long)xtime.tv_sec;
 124         long next = LONG_MAX;
 125         int warn = 0;
 126
 127         spin_lock(&x->lock);
 128         if (x->km.state == XFRM_STATE_DEAD)
 129                 goto out;
 130         if (x->km.state == XFRM_STATE_EXPIRED)
 131                 goto expired;
 132         if (x->lft.hard_add_expires_seconds) {
 133                 long tmo = x->lft.hard_add_expires_seconds +
 134                         x->curlft.add_time - now;
 135                 if (tmo <= 0)
 136                         goto expired;
 137                 if (tmo < next)
 138                         next = tmo;
 139         }
 140         if (x->lft.hard_use_expires_seconds) {
 141                 long tmo = x->lft.hard_use_expires_seconds +
 142                         (x->curlft.use_time ? : now) - now;
 143                 if (tmo <= 0)
 144                         goto expired;
 145                 if (tmo < next)
 146                         next = tmo;
 147         }
 148         if (x->km.dying)
 149                 goto resched;
 150         if (x->lft.soft_add_expires_seconds) {
 151                 long tmo = x->lft.soft_add_expires_seconds +
 152                         x->curlft.add_time - now;
 153                 if (tmo <= 0)
 154                         warn = 1;
 155                 else if (tmo < next)
 156                         next = tmo;
 157         }
 158         if (x->lft.soft_use_expires_seconds) {
 159                 long tmo = x->lft.soft_use_expires_seconds +
 160                         (x->curlft.use_time ? : now) - now;
 161                 if (tmo <= 0)
 162                         warn = 1;
 163                 else if (tmo < next)
 164                         next = tmo;
 165         }
 166
 167         x->km.dying = warn;
 168         if (warn)
 169                 km_state_expired(x, 0, 0);
 170 resched:
 171         if (next != LONG_MAX &&
 172             !mod_timer(&x->timer, jiffies + make_jiffies(next)))
 173                 xfrm_state_hold(x);
 174         goto out;
 175
 176 expired:
 177         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 178                 x->km.state = XFRM_STATE_EXPIRED;
 179                 wake_up(&km_waitq);
 180                 next = 2;
 181                 goto resched;
 182         }
 183         if (!__xfrm_state_delete(x) && x->id.spi)
 184                 km_state_expired(x, 1, 0);
 185
 186 out:
 187         spin_unlock(&x->lock);
 188         xfrm_state_put(x);
 189 }
 190
 191 static void xfrm_replay_timer_handler(unsigned long data);
 192
 193 struct xfrm_state *xfrm_state_alloc(void)
 194 {
 195         struct xfrm_state *x;
 196
 197         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 198
 199         if (x) {
 200                 atomic_set(&x->refcnt, 1);
 201                 atomic_set(&x->tunnel_users, 0);
 202                 INIT_LIST_HEAD(&x->bydst);
 203                 INIT_LIST_HEAD(&x->byspi);
 204                 init_timer(&x->timer);
 205                 x->timer.function = xfrm_timer_handler;
 206                 x->timer.data     = (unsigned long)x;
 207                 init_timer(&x->rtimer);
 208                 x->rtimer.function = xfrm_replay_timer_handler;
 209                 x->rtimer.data     = (unsigned long)x;
 210                 x->curlft.add_time = (unsigned long)xtime.tv_sec;
 211                 x->lft.soft_byte_limit = XFRM_INF;
 212                 x->lft.soft_packet_limit = XFRM_INF;
 213                 x->lft.hard_byte_limit = XFRM_INF;
 214                 x->lft.hard_packet_limit = XFRM_INF;
 215                 x->replay_maxage = 0;
 216                 x->replay_maxdiff = 0;
 217                 spin_lock_init(&x->lock);
 218         }
 219         return x;
 220 }
 221 EXPORT_SYMBOL(xfrm_state_alloc);
 222
 223 void __xfrm_state_destroy(struct xfrm_state *x)
 224 {
 225         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 226
 227         spin_lock_bh(&xfrm_state_gc_lock);
 228         list_add(&x->bydst, &xfrm_state_gc_list);
 229         spin_unlock_bh(&xfrm_state_gc_lock);
 230         schedule_work(&xfrm_state_gc_work);
 231 }
 232 EXPORT_SYMBOL(__xfrm_state_destroy);
 233
 234 int __xfrm_state_delete(struct xfrm_state *x)
 235 {
 236         int err = -ESRCH;
 237
 238         if (x->km.state != XFRM_STATE_DEAD) {
 239                 x->km.state = XFRM_STATE_DEAD;
 240                 spin_lock(&xfrm_state_lock);
 241                 list_del(&x->bydst);
 242                 __xfrm_state_put(x);
 243                 if (x->id.spi) {
 244                         list_del(&x->byspi);
 245                         __xfrm_state_put(x);
 246                 }
 247                 spin_unlock(&xfrm_state_lock);
 248                 if (del_timer(&x->timer))
 249                         __xfrm_state_put(x);
 250                 if (del_timer(&x->rtimer))
 251                         __xfrm_state_put(x);
 252
 253                 /* The number two in this test is the reference
 254                  * mentioned in the comment below plus the reference
 255                  * our caller holds.  A larger value means that
 256                  * there are DSTs attached to this xfrm_state.
 257                  */
 258                 if (atomic_read(&x->refcnt) > 2) {
 259                         xfrm_state_gc_flush_bundles = 1;
 260                         schedule_work(&xfrm_state_gc_work);
 261                 }
 262
 263                 /* All xfrm_state objects are created by xfrm_state_alloc.
 264                  * The xfrm_state_alloc call gives a reference, and that
 265                  * is what we are dropping here.
 266                  */
 267                 __xfrm_state_put(x);
 268                 err = 0;
 269         }
 270
 271         return err;
 272 }
 273 EXPORT_SYMBOL(__xfrm_state_delete);
 274
 275 int xfrm_state_delete(struct xfrm_state *x)
 276 {
 277         int err;
 278
 279         spin_lock_bh(&x->lock);
 280         err = __xfrm_state_delete(x);
 281         spin_unlock_bh(&x->lock);
 282
 283         return err;
 284 }
 285 EXPORT_SYMBOL(xfrm_state_delete);
 286
 287 void xfrm_state_flush(u8 proto)
 288 {
 289         int i;
 290         struct xfrm_state *x;
 291
 292         spin_lock_bh(&xfrm_state_lock);
 293         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 294 restart:
 295                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 296                         if (!xfrm_state_kern(x) &&
 297                             (proto == IPSEC_PROTO_ANY || x->id.proto == proto)) {
 298                                 xfrm_state_hold(x);
 299                                 spin_unlock_bh(&xfrm_state_lock);
 300
 301                                 xfrm_state_delete(x);
 302                                 xfrm_state_put(x);
 303
 304                                 spin_lock_bh(&xfrm_state_lock);
 305                                 goto restart;
 306                         }
 307                 }
 308         }
 309         spin_unlock_bh(&xfrm_state_lock);
 310         wake_up(&km_waitq);
 311 }
 312 EXPORT_SYMBOL(xfrm_state_flush);
 313
 314 static int
 315 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 316                   struct xfrm_tmpl *tmpl,
 317                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 318                   unsigned short family)
 319 {
 320         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 321         if (!afinfo)
 322                 return -1;
 323         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 324         xfrm_state_put_afinfo(afinfo);
 325         return 0;
 326 }
 327
 328 struct xfrm_state *
 329 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 330                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 331                 struct xfrm_policy *pol, int *err,
 332                 unsigned short family)
 333 {
 334         unsigned h = xfrm_dst_hash(daddr, family);
 335         struct xfrm_state *x, *x0;
 336         int acquire_in_progress = 0;
 337         int error = 0;
 338         struct xfrm_state *best = NULL;
 339         struct xfrm_state_afinfo *afinfo;
 340
 341         afinfo = xfrm_state_get_afinfo(family);
 342         if (afinfo == NULL) {
 343                 *err = -EAFNOSUPPORT;
 344                 return NULL;
 345         }
 346
 347         spin_lock_bh(&xfrm_state_lock);
 348         list_for_each_entry(x, xfrm_state_bydst+h, bydst) {
 349                 if (x->props.family == family &&
 350                     x->props.reqid == tmpl->reqid &&
 351                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 352                     tmpl->mode == x->props.mode &&
 353                     tmpl->id.proto == x->id.proto &&
 354                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 355                         /* Resolution logic:
 356                            1. There is a valid state with matching selector.
 357                               Done.
 358                            2. Valid state with inappropriate selector. Skip.
 359
 360                            Entering area of "sysdeps".
 361
 362                            3. If state is not valid, selector is temporary,
 363                               it selects only session which triggered
 364                               previous resolution. Key manager will do
 365                               something to install a state with proper
 366                               selector.
 367                          */
 368                         if (x->km.state == XFRM_STATE_VALID) {
 369                                 if (!xfrm_selector_match(&x->sel, fl, family) ||
 370                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
 371                                         continue;
 372                                 if (!best ||
 373                                     best->km.dying > x->km.dying ||
 374                                     (best->km.dying == x->km.dying &&
 375                                      best->curlft.add_time < x->curlft.add_time))
 376                                         best = x;
 377                         } else if (x->km.state == XFRM_STATE_ACQ) {
 378                                 acquire_in_progress = 1;
 379                         } else if (x->km.state == XFRM_STATE_ERROR ||
 380                                    x->km.state == XFRM_STATE_EXPIRED) {
 381                                 if (xfrm_selector_match(&x->sel, fl, family) &&
 382                                     security_xfrm_state_pol_flow_match(x, pol, fl))
 383                                         error = -ESRCH;
 384                         }
 385                 }
 386         }
 387
 388         x = best;
 389         if (!x && !error && !acquire_in_progress) {
 390                 if (tmpl->id.spi &&
 391                     (x0 = afinfo->state_lookup(daddr, tmpl->id.spi,
 392                                                tmpl->id.proto)) != NULL) {
 393                         xfrm_state_put(x0);
 394                         error = -EEXIST;
 395                         goto out;
 396                 }
 397                 x = xfrm_state_alloc();
 398                 if (x == NULL) {
 399                         error = -ENOMEM;
 400                         goto out;
 401                 }
 402                 /* Initialize temporary selector matching only
 403                  * to current session. */
 404                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 405
 406                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
 407                 if (error) {
 408                         x->km.state = XFRM_STATE_DEAD;
 409                         xfrm_state_put(x);
 410                         x = NULL;
 411                         goto out;
 412                 }
 413
 414                 if (km_query(x, tmpl, pol) == 0) {
 415                         x->km.state = XFRM_STATE_ACQ;
 416                         list_add_tail(&x->bydst, xfrm_state_bydst+h);
 417                         xfrm_state_hold(x);
 418                         if (x->id.spi) {
 419                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 420                                 list_add(&x->byspi, xfrm_state_byspi+h);
 421                                 xfrm_state_hold(x);
 422                         }
 423                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
 424                         xfrm_state_hold(x);
 425                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
 426                         add_timer(&x->timer);
 427                 } else {
 428                         x->km.state = XFRM_STATE_DEAD;
 429                         xfrm_state_put(x);
 430                         x = NULL;
 431                         error = -ESRCH;
 432                 }
 433         }
 434 out:
 435         if (x)
 436                 xfrm_state_hold(x);
 437         else
 438                 *err = acquire_in_progress ? -EAGAIN : error;
 439         spin_unlock_bh(&xfrm_state_lock);
 440         xfrm_state_put_afinfo(afinfo);
 441         return x;
 442 }
 443
 444 static void __xfrm_state_insert(struct xfrm_state *x)
 445 {
 446         unsigned h = xfrm_dst_hash(&x->id.daddr, x->props.family);
 447
 448         list_add(&x->bydst, xfrm_state_bydst+h);
 449         xfrm_state_hold(x);
 450
 451         h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 452
 453         list_add(&x->byspi, xfrm_state_byspi+h);
 454         xfrm_state_hold(x);
 455
 456         if (!mod_timer(&x->timer, jiffies + HZ))
 457                 xfrm_state_hold(x);
 458
 459         if (x->replay_maxage &&
 460             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
 461                 xfrm_state_hold(x);
 462
 463         wake_up(&km_waitq);
 464 }
 465
 466 void xfrm_state_insert(struct xfrm_state *x)
 467 {
 468         spin_lock_bh(&xfrm_state_lock);
 469         __xfrm_state_insert(x);
 470         spin_unlock_bh(&xfrm_state_lock);
 471
 472         xfrm_flush_all_bundles();
 473 }
 474 EXPORT_SYMBOL(xfrm_state_insert);
 475
 476 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
 477
 478 int xfrm_state_add(struct xfrm_state *x)
 479 {
 480         struct xfrm_state_afinfo *afinfo;
 481         struct xfrm_state *x1;
 482         int family;
 483         int err;
 484
 485         family = x->props.family;
 486         afinfo = xfrm_state_get_afinfo(family);
 487         if (unlikely(afinfo == NULL))
 488                 return -EAFNOSUPPORT;
 489
 490         spin_lock_bh(&xfrm_state_lock);
 491
 492         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 493         if (x1) {
 494                 xfrm_state_put(x1);
 495                 x1 = NULL;
 496                 err = -EEXIST;
 497                 goto out;
 498         }
 499
 500         if (x->km.seq) {
 501                 x1 = __xfrm_find_acq_byseq(x->km.seq);
 502                 if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
 503                         xfrm_state_put(x1);
 504                         x1 = NULL;
 505                 }
 506         }
 507
 508         if (!x1)
 509                 x1 = afinfo->find_acq(
 510                         x->props.mode, x->props.reqid, x->id.proto,
 511                         &x->id.daddr, &x->props.saddr, 0);
 512
 513         __xfrm_state_insert(x);
 514         err = 0;
 515
 516 out:
 517         spin_unlock_bh(&xfrm_state_lock);
 518         xfrm_state_put_afinfo(afinfo);
 519
 520         if (!err)
 521                 xfrm_flush_all_bundles();
 522
 523         if (x1) {
 524                 xfrm_state_delete(x1);
 525                 xfrm_state_put(x1);
 526         }
 527
 528         return err;
 529 }
 530 EXPORT_SYMBOL(xfrm_state_add);
 531
 532 int xfrm_state_update(struct xfrm_state *x)
 533 {
 534         struct xfrm_state_afinfo *afinfo;
 535         struct xfrm_state *x1;
 536         int err;
 537
 538         afinfo = xfrm_state_get_afinfo(x->props.family);
 539         if (unlikely(afinfo == NULL))
 540                 return -EAFNOSUPPORT;
 541
 542         spin_lock_bh(&xfrm_state_lock);
 543         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 544
 545         err = -ESRCH;
 546         if (!x1)
 547                 goto out;
 548
 549         if (xfrm_state_kern(x1)) {
 550                 xfrm_state_put(x1);
 551                 err = -EEXIST;
 552                 goto out;
 553         }
 554
 555         if (x1->km.state == XFRM_STATE_ACQ) {
 556                 __xfrm_state_insert(x);
 557                 x = NULL;
 558         }
 559         err = 0;
 560
 561 out:
 562         spin_unlock_bh(&xfrm_state_lock);
 563         xfrm_state_put_afinfo(afinfo);
 564
 565         if (err)
 566                 return err;
 567
 568         if (!x) {
 569                 xfrm_state_delete(x1);
 570                 xfrm_state_put(x1);
 571                 return 0;
 572         }
 573
 574         err = -EINVAL;
 575         spin_lock_bh(&x1->lock);
 576         if (likely(x1->km.state == XFRM_STATE_VALID)) {
 577                 if (x->encap && x1->encap)
 578                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
 579                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
 580                 x1->km.dying = 0;
 581
 582                 if (!mod_timer(&x1->timer, jiffies + HZ))
 583                         xfrm_state_hold(x1);
 584                 if (x1->curlft.use_time)
 585                         xfrm_state_check_expire(x1);
 586
 587                 err = 0;
 588         }
 589         spin_unlock_bh(&x1->lock);
 590
 591         xfrm_state_put(x1);
 592
 593         return err;
 594 }
 595 EXPORT_SYMBOL(xfrm_state_update);
 596
 597 int xfrm_state_check_expire(struct xfrm_state *x)
 598 {
 599         if (!x->curlft.use_time)
 600                 x->curlft.use_time = (unsigned long)xtime.tv_sec;
 601
 602         if (x->km.state != XFRM_STATE_VALID)
 603                 return -EINVAL;
 604
 605         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
 606             x->curlft.packets >= x->lft.hard_packet_limit) {
 607                 x->km.state = XFRM_STATE_EXPIRED;
 608                 if (!mod_timer(&x->timer, jiffies))
 609                         xfrm_state_hold(x);
 610                 return -EINVAL;
 611         }
 612
 613         if (!x->km.dying &&
 614             (x->curlft.bytes >= x->lft.soft_byte_limit ||
 615              x->curlft.packets >= x->lft.soft_packet_limit)) {
 616                 x->km.dying = 1;
 617                 km_state_expired(x, 0, 0);
 618         }
 619         return 0;
 620 }
 621 EXPORT_SYMBOL(xfrm_state_check_expire);
 622
 623 static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
 624 {
 625         int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
 626                 - skb_headroom(skb);
 627
 628         if (nhead > 0)
 629                 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
 630
 631         /* Check tail too... */
 632         return 0;
 633 }
 634
 635 int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
 636 {
 637         int err = xfrm_state_check_expire(x);
 638         if (err < 0)
 639                 goto err;
 640         err = xfrm_state_check_space(x, skb);
 641 err:
 642         return err;
 643 }
 644 EXPORT_SYMBOL(xfrm_state_check);
 645
 646 struct xfrm_state *
 647 xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
 648                   unsigned short family)
 649 {
 650         struct xfrm_state *x;
 651         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 652         if (!afinfo)
 653                 return NULL;
 654
 655         spin_lock_bh(&xfrm_state_lock);
 656         x = afinfo->state_lookup(daddr, spi, proto);
 657         spin_unlock_bh(&xfrm_state_lock);
 658         xfrm_state_put_afinfo(afinfo);
 659         return x;
 660 }
 661 EXPORT_SYMBOL(xfrm_state_lookup);
 662
 663 struct xfrm_state *
 664 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 665               xfrm_address_t *daddr, xfrm_address_t *saddr,
 666               int create, unsigned short family)
 667 {
 668         struct xfrm_state *x;
 669         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 670         if (!afinfo)
 671                 return NULL;
 672
 673         spin_lock_bh(&xfrm_state_lock);
 674         x = afinfo->find_acq(mode, reqid, proto, daddr, saddr, create);
 675         spin_unlock_bh(&xfrm_state_lock);
 676         xfrm_state_put_afinfo(afinfo);
 677         return x;
 678 }
 679 EXPORT_SYMBOL(xfrm_find_acq);
 680
 681 /* Silly enough, but I'm lazy to build resolution list */
 682
 683 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
 684 {
 685         int i;
 686         struct xfrm_state *x;
 687
 688         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 689                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 690                         if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
 691                                 xfrm_state_hold(x);
 692                                 return x;
 693                         }
 694                 }
 695         }
 696         return NULL;
 697 }
 698
 699 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
 700 {
 701         struct xfrm_state *x;
 702
 703         spin_lock_bh(&xfrm_state_lock);
 704         x = __xfrm_find_acq_byseq(seq);
 705         spin_unlock_bh(&xfrm_state_lock);
 706         return x;
 707 }
 708 EXPORT_SYMBOL(xfrm_find_acq_byseq);
 709
 710 u32 xfrm_get_acqseq(void)
 711 {
 712         u32 res;
 713         static u32 acqseq;
 714         static DEFINE_SPINLOCK(acqseq_lock);
 715
 716         spin_lock_bh(&acqseq_lock);
 717         res = (++acqseq ? : ++acqseq);
 718         spin_unlock_bh(&acqseq_lock);
 719         return res;
 720 }
 721 EXPORT_SYMBOL(xfrm_get_acqseq);
 722
 723 void
 724 xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
 725 {
 726         u32 h;
 727         struct xfrm_state *x0;
 728
 729         if (x->id.spi)
 730                 return;
 731
 732         if (minspi == maxspi) {
 733                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
 734                 if (x0) {
 735                         xfrm_state_put(x0);
 736                         return;
 737                 }
 738                 x->id.spi = minspi;
 739         } else {
 740                 u32 spi = 0;
 741                 minspi = ntohl(minspi);
 742                 maxspi = ntohl(maxspi);
 743                 for (h=0; h<maxspi-minspi+1; h++) {
 744                         spi = minspi + net_random()%(maxspi-minspi+1);
 745                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
 746                         if (x0 == NULL) {
 747                                 x->id.spi = htonl(spi);
 748                                 break;
 749                         }
 750                         xfrm_state_put(x0);
 751                 }
 752         }
 753         if (x->id.spi) {
 754                 spin_lock_bh(&xfrm_state_lock);
 755                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 756                 list_add(&x->byspi, xfrm_state_byspi+h);
 757                 xfrm_state_hold(x);
 758                 spin_unlock_bh(&xfrm_state_lock);
 759                 wake_up(&km_waitq);
 760         }
 761 }
 762 EXPORT_SYMBOL(xfrm_alloc_spi);
 763
 764 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
 765                     void *data)
 766 {
 767         int i;
 768         struct xfrm_state *x;
 769         int count = 0;
 770         int err = 0;
 771
 772         spin_lock_bh(&xfrm_state_lock);
 773         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 774                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 775                         if (proto == IPSEC_PROTO_ANY || x->id.proto == proto)
 776                                 count++;
 777                 }
 778         }
 779         if (count == 0) {
 780                 err = -ENOENT;
 781                 goto out;
 782         }
 783
 784         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 785                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 786                         if (proto != IPSEC_PROTO_ANY && x->id.proto != proto)
 787                                 continue;
 788                         err = func(x, --count, data);
 789                         if (err)
 790                                 goto out;
 791                 }
 792         }
 793 out:
 794         spin_unlock_bh(&xfrm_state_lock);
 795         return err;
 796 }
 797 EXPORT_SYMBOL(xfrm_state_walk);
 798
 799
 800 void xfrm_replay_notify(struct xfrm_state *x, int event)
 801 {
 802         struct km_event c;
 803         /* we send notify messages in case
 804          *  1. we updated on of the sequence numbers, and the seqno difference
 805          *     is at least x->replay_maxdiff, in this case we also update the
 806          *     timeout of our timer function
 807          *  2. if x->replay_maxage has elapsed since last update,
 808          *     and there were changes
 809          *
 810          *  The state structure must be locked!
 811          */
 812
 813         switch (event) {
 814         case XFRM_REPLAY_UPDATE:
 815                 if (x->replay_maxdiff &&
 816                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
 817                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
 818                         if (x->xflags & XFRM_TIME_DEFER)
 819                                 event = XFRM_REPLAY_TIMEOUT;
 820                         else
 821                                 return;
 822                 }
 823
 824                 break;
 825
 826         case XFRM_REPLAY_TIMEOUT:
 827                 if ((x->replay.seq == x->preplay.seq) &&
 828                     (x->replay.bitmap == x->preplay.bitmap) &&
 829                     (x->replay.oseq == x->preplay.oseq)) {
 830                         x->xflags |= XFRM_TIME_DEFER;
 831                         return;
 832                 }
 833
 834                 break;
 835         }
 836
 837         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
 838         c.event = XFRM_MSG_NEWAE;
 839         c.data.aevent = event;
 840         km_state_notify(x, &c);
 841
 842         if (x->replay_maxage &&
 843             !mod_timer(&x->rtimer, jiffies + x->replay_maxage)) {
 844                 xfrm_state_hold(x);
 845                 x->xflags &= ~XFRM_TIME_DEFER;
 846         }
 847 }
 848 EXPORT_SYMBOL(xfrm_replay_notify);
 849
 850 static void xfrm_replay_timer_handler(unsigned long data)
 851 {
 852         struct xfrm_state *x = (struct xfrm_state*)data;
 853
 854         spin_lock(&x->lock);
 855
 856         if (x->km.state == XFRM_STATE_VALID) {
 857                 if (xfrm_aevent_is_on())
 858                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
 859                 else
 860                         x->xflags |= XFRM_TIME_DEFER;
 861         }
 862
 863         spin_unlock(&x->lock);
 864         xfrm_state_put(x);
 865 }
 866
 867 int xfrm_replay_check(struct xfrm_state *x, u32 seq)
 868 {
 869         u32 diff;
 870
 871         seq = ntohl(seq);
 872
 873         if (unlikely(seq == 0))
 874                 return -EINVAL;
 875
 876         if (likely(seq > x->replay.seq))
 877                 return 0;
 878
 879         diff = x->replay.seq - seq;
 880         if (diff >= x->props.replay_window) {
 881                 x->stats.replay_window++;
 882                 return -EINVAL;
 883         }
 884
 885         if (x->replay.bitmap & (1U << diff)) {
 886                 x->stats.replay++;
 887                 return -EINVAL;
 888         }
 889         return 0;
 890 }
 891 EXPORT_SYMBOL(xfrm_replay_check);
 892
 893 void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
 894 {
 895         u32 diff;
 896
 897         seq = ntohl(seq);
 898
 899         if (seq > x->replay.seq) {
 900                 diff = seq - x->replay.seq;
 901                 if (diff < x->props.replay_window)
 902                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
 903                 else
 904                         x->replay.bitmap = 1;
 905                 x->replay.seq = seq;
 906         } else {
 907                 diff = x->replay.seq - seq;
 908                 x->replay.bitmap |= (1U << diff);
 909         }
 910
 911         if (xfrm_aevent_is_on())
 912                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
 913 }
 914 EXPORT_SYMBOL(xfrm_replay_advance);
 915
 916 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
 917 static DEFINE_RWLOCK(xfrm_km_lock);
 918
 919 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
 920 {
 921         struct xfrm_mgr *km;
 922
 923         read_lock(&xfrm_km_lock);
 924         list_for_each_entry(km, &xfrm_km_list, list)
 925                 if (km->notify_policy)
 926                         km->notify_policy(xp, dir, c);
 927         read_unlock(&xfrm_km_lock);
 928 }
 929
 930 void km_state_notify(struct xfrm_state *x, struct km_event *c)
 931 {
 932         struct xfrm_mgr *km;
 933         read_lock(&xfrm_km_lock);
 934         list_for_each_entry(km, &xfrm_km_list, list)
 935                 if (km->notify)
 936                         km->notify(x, c);
 937         read_unlock(&xfrm_km_lock);
 938 }
 939
 940 EXPORT_SYMBOL(km_policy_notify);
 941 EXPORT_SYMBOL(km_state_notify);
 942
 943 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
 944 {
 945         struct km_event c;
 946
 947         c.data.hard = hard;
 948         c.pid = pid;
 949         c.event = XFRM_MSG_EXPIRE;
 950         km_state_notify(x, &c);
 951
 952         if (hard)
 953                 wake_up(&km_waitq);
 954 }
 955
 956 EXPORT_SYMBOL(km_state_expired);
 957 /*
 958  * We send to all registered managers regardless of failure
 959  * We are happy with one success
 960 */
 961 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 962 {
 963         int err = -EINVAL, acqret;
 964         struct xfrm_mgr *km;
 965
 966         read_lock(&xfrm_km_lock);
 967         list_for_each_entry(km, &xfrm_km_list, list) {
 968                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
 969                 if (!acqret)
 970                         err = acqret;
 971         }
 972         read_unlock(&xfrm_km_lock);
 973         return err;
 974 }
 975 EXPORT_SYMBOL(km_query);
 976
 977 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport)
 978 {
 979         int err = -EINVAL;
 980         struct xfrm_mgr *km;
 981
 982         read_lock(&xfrm_km_lock);
 983         list_for_each_entry(km, &xfrm_km_list, list) {
 984                 if (km->new_mapping)
 985                         err = km->new_mapping(x, ipaddr, sport);
 986                 if (!err)
 987                         break;
 988         }
 989         read_unlock(&xfrm_km_lock);
 990         return err;
 991 }
 992 EXPORT_SYMBOL(km_new_mapping);
 993
 994 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
 995 {
 996         struct km_event c;
 997
 998         c.data.hard = hard;
 999         c.pid = pid;
1000         c.event = XFRM_MSG_POLEXPIRE;
1001         km_policy_notify(pol, dir, &c);
1002
1003         if (hard)
1004                 wake_up(&km_waitq);
1005 }
1006 EXPORT_SYMBOL(km_policy_expired);
1007
1008 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1009 {
1010         int err;
1011         u8 *data;
1012         struct xfrm_mgr *km;
1013         struct xfrm_policy *pol = NULL;
1014
1015         if (optlen <= 0 || optlen > PAGE_SIZE)
1016                 return -EMSGSIZE;
1017
1018         data = kmalloc(optlen, GFP_KERNEL);
1019         if (!data)
1020                 return -ENOMEM;
1021
1022         err = -EFAULT;
1023         if (copy_from_user(data, optval, optlen))
1024                 goto out;
1025
1026         err = -EINVAL;
1027         read_lock(&xfrm_km_lock);
1028         list_for_each_entry(km, &xfrm_km_list, list) {
1029                 pol = km->compile_policy(sk->sk_family, optname, data,
1030                                          optlen, &err);
1031                 if (err >= 0)
1032                         break;
1033         }
1034         read_unlock(&xfrm_km_lock);
1035
1036         if (err >= 0) {
1037                 xfrm_sk_policy_insert(sk, err, pol);
1038                 xfrm_pol_put(pol);
1039                 err = 0;
1040         }
1041
1042 out:
1043         kfree(data);
1044         return err;
1045 }
1046 EXPORT_SYMBOL(xfrm_user_policy);
1047
1048 int xfrm_register_km(struct xfrm_mgr *km)
1049 {
1050         write_lock_bh(&xfrm_km_lock);
1051         list_add_tail(&km->list, &xfrm_km_list);
1052         write_unlock_bh(&xfrm_km_lock);
1053         return 0;
1054 }
1055 EXPORT_SYMBOL(xfrm_register_km);
1056
1057 int xfrm_unregister_km(struct xfrm_mgr *km)
1058 {
1059         write_lock_bh(&xfrm_km_lock);
1060         list_del(&km->list);
1061         write_unlock_bh(&xfrm_km_lock);
1062         return 0;
1063 }
1064 EXPORT_SYMBOL(xfrm_unregister_km);
1065
1066 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1067 {
1068         int err = 0;
1069         if (unlikely(afinfo == NULL))
1070                 return -EINVAL;
1071         if (unlikely(afinfo->family >= NPROTO))
1072                 return -EAFNOSUPPORT;
1073         write_lock_bh(&xfrm_state_afinfo_lock);
1074         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1075                 err = -ENOBUFS;
1076         else {
1077                 afinfo->state_bydst = xfrm_state_bydst;
1078                 afinfo->state_byspi = xfrm_state_byspi;
1079                 xfrm_state_afinfo[afinfo->family] = afinfo;
1080         }
1081         write_unlock_bh(&xfrm_state_afinfo_lock);
1082         return err;
1083 }
1084 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1085
1086 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1087 {
1088         int err = 0;
1089         if (unlikely(afinfo == NULL))
1090                 return -EINVAL;
1091         if (unlikely(afinfo->family >= NPROTO))
1092                 return -EAFNOSUPPORT;
1093         write_lock_bh(&xfrm_state_afinfo_lock);
1094         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1095                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1096                         err = -EINVAL;
1097                 else {
1098                         xfrm_state_afinfo[afinfo->family] = NULL;
1099                         afinfo->state_byspi = NULL;
1100                         afinfo->state_bydst = NULL;
1101                 }
1102         }
1103         write_unlock_bh(&xfrm_state_afinfo_lock);
1104         return err;
1105 }
1106 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1107
1108 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
1109 {
1110         struct xfrm_state_afinfo *afinfo;
1111         if (unlikely(family >= NPROTO))
1112                 return NULL;
1113         read_lock(&xfrm_state_afinfo_lock);
1114         afinfo = xfrm_state_afinfo[family];
1115         if (unlikely(!afinfo))
1116                 read_unlock(&xfrm_state_afinfo_lock);
1117         return afinfo;
1118 }
1119
1120 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1121 {
1122         read_unlock(&xfrm_state_afinfo_lock);
1123 }
1124
1125 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1126 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1127 {
1128         if (x->tunnel) {
1129                 struct xfrm_state *t = x->tunnel;
1130
1131                 if (atomic_read(&t->tunnel_users) == 2)
1132                         xfrm_state_delete(t);
1133                 atomic_dec(&t->tunnel_users);
1134                 xfrm_state_put(t);
1135                 x->tunnel = NULL;
1136         }
1137 }
1138 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1139
1140 /*
1141  * This function is NOT optimal.  For example, with ESP it will give an
1142  * MTU that's usually two bytes short of being optimal.  However, it will
1143  * usually give an answer that's a multiple of 4 provided the input is
1144  * also a multiple of 4.
1145  */
1146 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1147 {
1148         int res = mtu;
1149
1150         res -= x->props.header_len;
1151
1152         for (;;) {
1153                 int m = res;
1154
1155                 if (m < 68)
1156                         return 68;
1157
1158                 spin_lock_bh(&x->lock);
1159                 if (x->km.state == XFRM_STATE_VALID &&
1160                     x->type && x->type->get_max_size)
1161                         m = x->type->get_max_size(x, m);
1162                 else
1163                         m += x->props.header_len;
1164                 spin_unlock_bh(&x->lock);
1165
1166                 if (m <= mtu)
1167                         break;
1168                 res -= (m - mtu);
1169         }
1170
1171         return res;
1172 }
1173
1174 int xfrm_init_state(struct xfrm_state *x)
1175 {
1176         struct xfrm_state_afinfo *afinfo;
1177         int family = x->props.family;
1178         int err;
1179
1180         err = -EAFNOSUPPORT;
1181         afinfo = xfrm_state_get_afinfo(family);
1182         if (!afinfo)
1183                 goto error;
1184
1185         err = 0;
1186         if (afinfo->init_flags)
1187                 err = afinfo->init_flags(x);
1188
1189         xfrm_state_put_afinfo(afinfo);
1190
1191         if (err)
1192                 goto error;
1193
1194         err = -EPROTONOSUPPORT;
1195         x->type = xfrm_get_type(x->id.proto, family);
1196         if (x->type == NULL)
1197                 goto error;
1198
1199         err = x->type->init_state(x);
1200         if (err)
1201                 goto error;
1202
1203         x->mode = xfrm_get_mode(x->props.mode, family);
1204         if (x->mode == NULL)
1205                 goto error;
1206
1207         x->km.state = XFRM_STATE_VALID;
1208
1209 error:
1210         return err;
1211 }
1212
1213 EXPORT_SYMBOL(xfrm_init_state);
1214
1215 void __init xfrm_state_init(void)
1216 {
1217         int i;
1218
1219         for (i=0; i<XFRM_DST_HSIZE; i++) {
1220                 INIT_LIST_HEAD(&xfrm_state_bydst[i]);
1221                 INIT_LIST_HEAD(&xfrm_state_byspi[i]);
1222         }
1223         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task, NULL);
1224 }
1225