xfrm_state.c 52.3 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8 9 10 11 12
/*
 * xfrm_state.c
 *
 * Changes:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
 * 	YOSHIFUJI Hideaki @USAGI
 * 		Split up af-specific functions
 *	Derek Atkins <derek@ihtfp.com>
 *		Add UDP Encapsulation
13
 *
Linus Torvalds's avatar
Linus Torvalds committed
14 15 16 17 18 19 20
 */

#include <linux/workqueue.h>
#include <net/xfrm.h>
#include <linux/pfkeyv2.h>
#include <linux/ipsec.h>
#include <linux/module.h>
21
#include <linux/cache.h>
Paul Moore's avatar
Paul Moore committed
22
#include <linux/audit.h>
23
#include <asm/uaccess.h>
Linus Torvalds's avatar
Linus Torvalds committed
24

25 26
#include "xfrm_hash.h"

27 28 29
struct sock *xfrm_nl;
EXPORT_SYMBOL(xfrm_nl);

30
u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
31 32
EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);

33
u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
34 35
EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);

36 37
u32 sysctl_xfrm_acq_expires __read_mostly = 30;

Linus Torvalds's avatar
Linus Torvalds committed
38 39 40
/* Each xfrm_state may be linked to two tables:

   1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
41
   2. Hash table by (daddr,family,reqid) to find what SAs exist for given
Linus Torvalds's avatar
Linus Torvalds committed
42 43 44 45 46 47 48 49 50 51 52
      destination/tunnel endpoint. (output)
 */

static DEFINE_SPINLOCK(xfrm_state_lock);

/* Hash table to find appropriate SA towards given target (endpoint
 * of tunnel or destination of transport mode) allowed by selector.
 *
 * Main use is finding SA after policy selected tunnel or transport mode.
 * Also, it can be used by ah/esp icmp error handler to find offending SA.
 */
53
static LIST_HEAD(xfrm_state_all);
54 55 56 57 58 59
static struct hlist_head *xfrm_state_bydst __read_mostly;
static struct hlist_head *xfrm_state_bysrc __read_mostly;
static struct hlist_head *xfrm_state_byspi __read_mostly;
static unsigned int xfrm_state_hmask __read_mostly;
static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
static unsigned int xfrm_state_num;
60
static unsigned int xfrm_state_genid;
61

62 63 64
static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);

65 66 67 68 69 70 71
#ifdef CONFIG_AUDITSYSCALL
static void xfrm_audit_state_replay(struct xfrm_state *x,
				    struct sk_buff *skb, __be32 net_seq);
#else
#define xfrm_audit_state_replay(x, s, sq)	do { ; } while (0)
#endif /* CONFIG_AUDITSYSCALL */

72 73 74
static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
					 xfrm_address_t *saddr,
					 u32 reqid,
75
					 unsigned short family)
76
{
77
	return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
78 79
}

80 81
static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
					 xfrm_address_t *saddr,
82
					 unsigned short family)
83
{
84
	return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
85 86 87
}

static inline unsigned int
88
xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
89
{
90
	return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
91 92 93 94 95 96 97 98 99 100 101 102 103 104
}

static void xfrm_hash_transfer(struct hlist_head *list,
			       struct hlist_head *ndsttable,
			       struct hlist_head *nsrctable,
			       struct hlist_head *nspitable,
			       unsigned int nhashmask)
{
	struct hlist_node *entry, *tmp;
	struct xfrm_state *x;

	hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
		unsigned int h;

105 106 107
		h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
				    x->props.reqid, x->props.family,
				    nhashmask);
108 109
		hlist_add_head(&x->bydst, ndsttable+h);

110 111
		h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
				    x->props.family,
112 113 114
				    nhashmask);
		hlist_add_head(&x->bysrc, nsrctable+h);

115 116 117 118 119 120
		if (x->id.spi) {
			h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
					    x->id.proto, x->props.family,
					    nhashmask);
			hlist_add_head(&x->byspi, nspitable+h);
		}
121 122 123 124 125 126 127 128 129 130 131
	}
}

static unsigned long xfrm_hash_new_size(void)
{
	return ((xfrm_state_hmask + 1) << 1) *
		sizeof(struct hlist_head);
}

static DEFINE_MUTEX(hash_resize_mutex);

132
static void xfrm_hash_resize(struct work_struct *__unused)
133 134 135 136 137 138 139 140 141
{
	struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
	unsigned long nsize, osize;
	unsigned int nhashmask, ohashmask;
	int i;

	mutex_lock(&hash_resize_mutex);

	nsize = xfrm_hash_new_size();
142
	ndst = xfrm_hash_alloc(nsize);
143 144
	if (!ndst)
		goto out_unlock;
145
	nsrc = xfrm_hash_alloc(nsize);
146
	if (!nsrc) {
147
		xfrm_hash_free(ndst, nsize);
148 149
		goto out_unlock;
	}
150
	nspi = xfrm_hash_alloc(nsize);
151
	if (!nspi) {
152 153
		xfrm_hash_free(ndst, nsize);
		xfrm_hash_free(nsrc, nsize);
154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176
		goto out_unlock;
	}

	spin_lock_bh(&xfrm_state_lock);

	nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
	for (i = xfrm_state_hmask; i >= 0; i--)
		xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
				   nhashmask);

	odst = xfrm_state_bydst;
	osrc = xfrm_state_bysrc;
	ospi = xfrm_state_byspi;
	ohashmask = xfrm_state_hmask;

	xfrm_state_bydst = ndst;
	xfrm_state_bysrc = nsrc;
	xfrm_state_byspi = nspi;
	xfrm_state_hmask = nhashmask;

	spin_unlock_bh(&xfrm_state_lock);

	osize = (ohashmask + 1) * sizeof(struct hlist_head);
177 178 179
	xfrm_hash_free(odst, osize);
	xfrm_hash_free(osrc, osize);
	xfrm_hash_free(ospi, osize);
180 181 182 183 184

out_unlock:
	mutex_unlock(&hash_resize_mutex);
}

185
static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
186

Linus Torvalds's avatar
Linus Torvalds committed
187 188 189 190 191 192 193
DECLARE_WAIT_QUEUE_HEAD(km_waitq);
EXPORT_SYMBOL(km_waitq);

static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];

static struct work_struct xfrm_state_gc_work;
194
static HLIST_HEAD(xfrm_state_gc_list);
Linus Torvalds's avatar
Linus Torvalds committed
195 196
static DEFINE_SPINLOCK(xfrm_state_gc_lock);

197
int __xfrm_state_delete(struct xfrm_state *x);
Linus Torvalds's avatar
Linus Torvalds committed
198

199
int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
200
void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
Linus Torvalds's avatar
Linus Torvalds committed
201

202 203 204 205 206 207 208 209 210 211 212 213 214
static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
{
	struct xfrm_state_afinfo *afinfo;
	if (unlikely(family >= NPROTO))
		return NULL;
	write_lock_bh(&xfrm_state_afinfo_lock);
	afinfo = xfrm_state_afinfo[family];
	if (unlikely(!afinfo))
		write_unlock_bh(&xfrm_state_afinfo_lock);
	return afinfo;
}

static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
215
	__releases(xfrm_state_afinfo_lock)
216 217 218 219
{
	write_unlock_bh(&xfrm_state_afinfo_lock);
}

220
int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
221 222
{
	struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
223
	const struct xfrm_type **typemap;
224 225 226 227 228 229 230 231 232 233 234 235 236 237 238
	int err = 0;

	if (unlikely(afinfo == NULL))
		return -EAFNOSUPPORT;
	typemap = afinfo->type_map;

	if (likely(typemap[type->proto] == NULL))
		typemap[type->proto] = type;
	else
		err = -EEXIST;
	xfrm_state_unlock_afinfo(afinfo);
	return err;
}
EXPORT_SYMBOL(xfrm_register_type);

239
int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
240 241
{
	struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
242
	const struct xfrm_type **typemap;
243 244 245 246 247 248 249 250 251 252 253 254 255 256 257
	int err = 0;

	if (unlikely(afinfo == NULL))
		return -EAFNOSUPPORT;
	typemap = afinfo->type_map;

	if (unlikely(typemap[type->proto] != type))
		err = -ENOENT;
	else
		typemap[type->proto] = NULL;
	xfrm_state_unlock_afinfo(afinfo);
	return err;
}
EXPORT_SYMBOL(xfrm_unregister_type);

258
static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
259 260
{
	struct xfrm_state_afinfo *afinfo;
261 262
	const struct xfrm_type **typemap;
	const struct xfrm_type *type;
263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284
	int modload_attempted = 0;

retry:
	afinfo = xfrm_state_get_afinfo(family);
	if (unlikely(afinfo == NULL))
		return NULL;
	typemap = afinfo->type_map;

	type = typemap[proto];
	if (unlikely(type && !try_module_get(type->owner)))
		type = NULL;
	if (!type && !modload_attempted) {
		xfrm_state_put_afinfo(afinfo);
		request_module("xfrm-type-%d-%d", family, proto);
		modload_attempted = 1;
		goto retry;
	}

	xfrm_state_put_afinfo(afinfo);
	return type;
}

285
static void xfrm_put_type(const struct xfrm_type *type)
286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304
{
	module_put(type->owner);
}

int xfrm_register_mode(struct xfrm_mode *mode, int family)
{
	struct xfrm_state_afinfo *afinfo;
	struct xfrm_mode **modemap;
	int err;

	if (unlikely(mode->encap >= XFRM_MODE_MAX))
		return -EINVAL;

	afinfo = xfrm_state_lock_afinfo(family);
	if (unlikely(afinfo == NULL))
		return -EAFNOSUPPORT;

	err = -EEXIST;
	modemap = afinfo->mode_map;
305 306
	if (modemap[mode->encap])
		goto out;
307

308 309 310 311 312 313 314 315 316
	err = -ENOENT;
	if (!try_module_get(afinfo->owner))
		goto out;

	mode->afinfo = afinfo;
	modemap[mode->encap] = mode;
	err = 0;

out:
317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338
	xfrm_state_unlock_afinfo(afinfo);
	return err;
}
EXPORT_SYMBOL(xfrm_register_mode);

int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
{
	struct xfrm_state_afinfo *afinfo;
	struct xfrm_mode **modemap;
	int err;

	if (unlikely(mode->encap >= XFRM_MODE_MAX))
		return -EINVAL;

	afinfo = xfrm_state_lock_afinfo(family);
	if (unlikely(afinfo == NULL))
		return -EAFNOSUPPORT;

	err = -ENOENT;
	modemap = afinfo->mode_map;
	if (likely(modemap[mode->encap] == mode)) {
		modemap[mode->encap] = NULL;
339
		module_put(mode->afinfo->owner);
340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380
		err = 0;
	}

	xfrm_state_unlock_afinfo(afinfo);
	return err;
}
EXPORT_SYMBOL(xfrm_unregister_mode);

static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
{
	struct xfrm_state_afinfo *afinfo;
	struct xfrm_mode *mode;
	int modload_attempted = 0;

	if (unlikely(encap >= XFRM_MODE_MAX))
		return NULL;

retry:
	afinfo = xfrm_state_get_afinfo(family);
	if (unlikely(afinfo == NULL))
		return NULL;

	mode = afinfo->mode_map[encap];
	if (unlikely(mode && !try_module_get(mode->owner)))
		mode = NULL;
	if (!mode && !modload_attempted) {
		xfrm_state_put_afinfo(afinfo);
		request_module("xfrm-mode-%d-%d", family, encap);
		modload_attempted = 1;
		goto retry;
	}

	xfrm_state_put_afinfo(afinfo);
	return mode;
}

static void xfrm_put_mode(struct xfrm_mode *mode)
{
	module_put(mode->owner);
}

Linus Torvalds's avatar
Linus Torvalds committed
381 382
static void xfrm_state_gc_destroy(struct xfrm_state *x)
{
383 384
	del_timer_sync(&x->timer);
	del_timer_sync(&x->rtimer);
Jesper Juhl's avatar
Jesper Juhl committed
385 386 387 388
	kfree(x->aalg);
	kfree(x->ealg);
	kfree(x->calg);
	kfree(x->encap);
389
	kfree(x->coaddr);
390 391
	if (x->inner_mode)
		xfrm_put_mode(x->inner_mode);
392 393
	if (x->inner_mode_iaf)
		xfrm_put_mode(x->inner_mode_iaf);
394 395
	if (x->outer_mode)
		xfrm_put_mode(x->outer_mode);
Linus Torvalds's avatar
Linus Torvalds committed
396 397 398 399
	if (x->type) {
		x->type->destructor(x);
		xfrm_put_type(x->type);
	}
400
	security_xfrm_state_free(x);
Linus Torvalds's avatar
Linus Torvalds committed
401 402 403
	kfree(x);
}

404
static void xfrm_state_gc_task(struct work_struct *data)
Linus Torvalds's avatar
Linus Torvalds committed
405
{
406 407 408
	struct xfrm_state *x;
	struct hlist_node *entry, *tmp;
	struct hlist_head gc_list;
Linus Torvalds's avatar
Linus Torvalds committed
409 410

	spin_lock_bh(&xfrm_state_gc_lock);
411
	hlist_move_list(&xfrm_state_gc_list, &gc_list);
Linus Torvalds's avatar
Linus Torvalds committed
412 413
	spin_unlock_bh(&xfrm_state_gc_lock);

414
	hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
Linus Torvalds's avatar
Linus Torvalds committed
415
		xfrm_state_gc_destroy(x);
416

Linus Torvalds's avatar
Linus Torvalds committed
417 418 419 420 421 422 423 424
	wake_up(&km_waitq);
}

static inline unsigned long make_jiffies(long secs)
{
	if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
		return MAX_SCHEDULE_TIMEOUT-1;
	else
425
		return secs*HZ;
Linus Torvalds's avatar
Linus Torvalds committed
426 427 428 429 430
}

static void xfrm_timer_handler(unsigned long data)
{
	struct xfrm_state *x = (struct xfrm_state*)data;
431
	unsigned long now = get_seconds();
Linus Torvalds's avatar
Linus Torvalds committed
432 433
	long next = LONG_MAX;
	int warn = 0;
Joy Latten's avatar
Joy Latten committed
434
	int err = 0;
Linus Torvalds's avatar
Linus Torvalds committed
435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475

	spin_lock(&x->lock);
	if (x->km.state == XFRM_STATE_DEAD)
		goto out;
	if (x->km.state == XFRM_STATE_EXPIRED)
		goto expired;
	if (x->lft.hard_add_expires_seconds) {
		long tmo = x->lft.hard_add_expires_seconds +
			x->curlft.add_time - now;
		if (tmo <= 0)
			goto expired;
		if (tmo < next)
			next = tmo;
	}
	if (x->lft.hard_use_expires_seconds) {
		long tmo = x->lft.hard_use_expires_seconds +
			(x->curlft.use_time ? : now) - now;
		if (tmo <= 0)
			goto expired;
		if (tmo < next)
			next = tmo;
	}
	if (x->km.dying)
		goto resched;
	if (x->lft.soft_add_expires_seconds) {
		long tmo = x->lft.soft_add_expires_seconds +
			x->curlft.add_time - now;
		if (tmo <= 0)
			warn = 1;
		else if (tmo < next)
			next = tmo;
	}
	if (x->lft.soft_use_expires_seconds) {
		long tmo = x->lft.soft_use_expires_seconds +
			(x->curlft.use_time ? : now) - now;
		if (tmo <= 0)
			warn = 1;
		else if (tmo < next)
			next = tmo;
	}

476
	x->km.dying = warn;
Linus Torvalds's avatar
Linus Torvalds committed
477
	if (warn)
478
		km_state_expired(x, 0, 0);
Linus Torvalds's avatar
Linus Torvalds committed
479
resched:
480 481 482
	if (next != LONG_MAX)
		mod_timer(&x->timer, jiffies + make_jiffies(next));

Linus Torvalds's avatar
Linus Torvalds committed
483 484 485 486 487 488 489 490 491
	goto out;

expired:
	if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
		x->km.state = XFRM_STATE_EXPIRED;
		wake_up(&km_waitq);
		next = 2;
		goto resched;
	}
Joy Latten's avatar
Joy Latten committed
492 493 494

	err = __xfrm_state_delete(x);
	if (!err && x->id.spi)
495
		km_state_expired(x, 1, 0);
Linus Torvalds's avatar
Linus Torvalds committed
496

Joy Latten's avatar
Joy Latten committed
497
	xfrm_audit_state_delete(x, err ? 0 : 1,
498 499
				audit_get_loginuid(current),
				audit_get_sessionid(current), 0);
Joy Latten's avatar
Joy Latten committed
500

Linus Torvalds's avatar
Linus Torvalds committed
501 502 503 504
out:
	spin_unlock(&x->lock);
}

505 506
static void xfrm_replay_timer_handler(unsigned long data);

Linus Torvalds's avatar
Linus Torvalds committed
507 508 509 510
struct xfrm_state *xfrm_state_alloc(void)
{
	struct xfrm_state *x;

511
	x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
512 513 514 515

	if (x) {
		atomic_set(&x->refcnt, 1);
		atomic_set(&x->tunnel_users, 0);
516
		INIT_LIST_HEAD(&x->km.all);
517 518 519
		INIT_HLIST_NODE(&x->bydst);
		INIT_HLIST_NODE(&x->bysrc);
		INIT_HLIST_NODE(&x->byspi);
520 521 522
		setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
		setup_timer(&x->rtimer, xfrm_replay_timer_handler,
				(unsigned long)x);
523
		x->curlft.add_time = get_seconds();
Linus Torvalds's avatar
Linus Torvalds committed
524 525 526 527
		x->lft.soft_byte_limit = XFRM_INF;
		x->lft.soft_packet_limit = XFRM_INF;
		x->lft.hard_byte_limit = XFRM_INF;
		x->lft.hard_packet_limit = XFRM_INF;
528 529
		x->replay_maxage = 0;
		x->replay_maxdiff = 0;
530 531
		x->inner_mode = NULL;
		x->inner_mode_iaf = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
532 533 534 535 536 537 538 539
		spin_lock_init(&x->lock);
	}
	return x;
}
EXPORT_SYMBOL(xfrm_state_alloc);

void __xfrm_state_destroy(struct xfrm_state *x)
{
540
	WARN_ON(x->km.state != XFRM_STATE_DEAD);
Linus Torvalds's avatar
Linus Torvalds committed
541 542

	spin_lock_bh(&xfrm_state_gc_lock);
543
	hlist_add_head(&x->gclist, &xfrm_state_gc_list);
Linus Torvalds's avatar
Linus Torvalds committed
544 545 546 547 548
	spin_unlock_bh(&xfrm_state_gc_lock);
	schedule_work(&xfrm_state_gc_work);
}
EXPORT_SYMBOL(__xfrm_state_destroy);

549
int __xfrm_state_delete(struct xfrm_state *x)
Linus Torvalds's avatar
Linus Torvalds committed
550
{
551 552
	int err = -ESRCH;

Linus Torvalds's avatar
Linus Torvalds committed
553 554 555
	if (x->km.state != XFRM_STATE_DEAD) {
		x->km.state = XFRM_STATE_DEAD;
		spin_lock(&xfrm_state_lock);
556
		list_del(&x->km.all);
557 558
		hlist_del(&x->bydst);
		hlist_del(&x->bysrc);
559
		if (x->id.spi)
560
			hlist_del(&x->byspi);
561
		xfrm_state_num--;
Linus Torvalds's avatar
Linus Torvalds committed
562 563 564 565 566 567
		spin_unlock(&xfrm_state_lock);

		/* All xfrm_state objects are created by xfrm_state_alloc.
		 * The xfrm_state_alloc call gives a reference, and that
		 * is what we are dropping here.
		 */
568
		xfrm_state_put(x);
569
		err = 0;
Linus Torvalds's avatar
Linus Torvalds committed
570
	}
571 572

	return err;
Linus Torvalds's avatar
Linus Torvalds committed
573
}
574
EXPORT_SYMBOL(__xfrm_state_delete);
Linus Torvalds's avatar
Linus Torvalds committed
575

576
int xfrm_state_delete(struct xfrm_state *x)
Linus Torvalds's avatar
Linus Torvalds committed
577
{
578 579
	int err;

Linus Torvalds's avatar
Linus Torvalds committed
580
	spin_lock_bh(&x->lock);
581
	err = __xfrm_state_delete(x);
Linus Torvalds's avatar
Linus Torvalds committed
582
	spin_unlock_bh(&x->lock);
583 584

	return err;
Linus Torvalds's avatar
Linus Torvalds committed
585 586 587
}
EXPORT_SYMBOL(xfrm_state_delete);

588 589 590
#ifdef CONFIG_SECURITY_NETWORK_XFRM
static inline int
xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
Linus Torvalds's avatar
Linus Torvalds committed
591
{
592 593 594 595 596 597 598 599 600
	int i, err = 0;

	for (i = 0; i <= xfrm_state_hmask; i++) {
		struct hlist_node *entry;
		struct xfrm_state *x;

		hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
			if (xfrm_id_proto_match(x->id.proto, proto) &&
			   (err = security_xfrm_state_delete(x)) != 0) {
Joy Latten's avatar
Joy Latten committed
601 602
				xfrm_audit_state_delete(x, 0,
							audit_info->loginuid,
603
							audit_info->sessionid,
Joy Latten's avatar
Joy Latten committed
604
							audit_info->secid);
605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622
				return err;
			}
		}
	}

	return err;
}
#else
static inline int
xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
{
	return 0;
}
#endif

int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
{
	int i, err = 0;
Linus Torvalds's avatar
Linus Torvalds committed
623 624

	spin_lock_bh(&xfrm_state_lock);
625 626 627 628
	err = xfrm_state_flush_secctx_check(proto, audit_info);
	if (err)
		goto out;

629
	for (i = 0; i <= xfrm_state_hmask; i++) {
630 631
		struct hlist_node *entry;
		struct xfrm_state *x;
Linus Torvalds's avatar
Linus Torvalds committed
632
restart:
633
		hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
Linus Torvalds's avatar
Linus Torvalds committed
634
			if (!xfrm_state_kern(x) &&
635
			    xfrm_id_proto_match(x->id.proto, proto)) {
Linus Torvalds's avatar
Linus Torvalds committed
636 637 638
				xfrm_state_hold(x);
				spin_unlock_bh(&xfrm_state_lock);

Joy Latten's avatar
Joy Latten committed
639
				err = xfrm_state_delete(x);
Joy Latten's avatar
Joy Latten committed
640 641
				xfrm_audit_state_delete(x, err ? 0 : 1,
							audit_info->loginuid,
642
							audit_info->sessionid,
Joy Latten's avatar
Joy Latten committed
643
							audit_info->secid);
Linus Torvalds's avatar
Linus Torvalds committed
644 645 646 647 648 649 650
				xfrm_state_put(x);

				spin_lock_bh(&xfrm_state_lock);
				goto restart;
			}
		}
	}
651 652 653
	err = 0;

out:
Linus Torvalds's avatar
Linus Torvalds committed
654 655
	spin_unlock_bh(&xfrm_state_lock);
	wake_up(&km_waitq);
656
	return err;
Linus Torvalds's avatar
Linus Torvalds committed
657 658 659
}
EXPORT_SYMBOL(xfrm_state_flush);

660
void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
661 662 663 664 665 666 667 668 669
{
	spin_lock_bh(&xfrm_state_lock);
	si->sadcnt = xfrm_state_num;
	si->sadhcnt = xfrm_state_hmask;
	si->sadhmcnt = xfrm_state_hashmax;
	spin_unlock_bh(&xfrm_state_lock);
}
EXPORT_SYMBOL(xfrm_sad_getinfo);

Linus Torvalds's avatar
Linus Torvalds committed
670 671 672 673 674 675 676 677 678 679 680 681 682 683
static int
xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
		  struct xfrm_tmpl *tmpl,
		  xfrm_address_t *daddr, xfrm_address_t *saddr,
		  unsigned short family)
{
	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
	if (!afinfo)
		return -1;
	afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
	xfrm_state_put_afinfo(afinfo);
	return 0;
}

684
static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
685 686 687
{
	unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
	struct xfrm_state *x;
688
	struct hlist_node *entry;
689

690
	hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706
		if (x->props.family != family ||
		    x->id.spi       != spi ||
		    x->id.proto     != proto)
			continue;

		switch (family) {
		case AF_INET:
			if (x->id.daddr.a4 != daddr->a4)
				continue;
			break;
		case AF_INET6:
			if (!ipv6_addr_equal((struct in6_addr *)daddr,
					     (struct in6_addr *)
					     x->id.daddr.a6))
				continue;
			break;
707
		}
708 709 710 711 712 713 714 715 716 717

		xfrm_state_hold(x);
		return x;
	}

	return NULL;
}

static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
{
718
	unsigned int h = xfrm_src_hash(daddr, saddr, family);
719
	struct xfrm_state *x;
720
	struct hlist_node *entry;
721

722
	hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741
		if (x->props.family != family ||
		    x->id.proto     != proto)
			continue;

		switch (family) {
		case AF_INET:
			if (x->id.daddr.a4 != daddr->a4 ||
			    x->props.saddr.a4 != saddr->a4)
				continue;
			break;
		case AF_INET6:
			if (!ipv6_addr_equal((struct in6_addr *)daddr,
					     (struct in6_addr *)
					     x->id.daddr.a6) ||
			    !ipv6_addr_equal((struct in6_addr *)saddr,
					     (struct in6_addr *)
					     x->props.saddr.a6))
				continue;
			break;
742
		}
743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762

		xfrm_state_hold(x);
		return x;
	}

	return NULL;
}

static inline struct xfrm_state *
__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
{
	if (use_spi)
		return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
					   x->id.proto, family);
	else
		return __xfrm_state_lookup_byaddr(&x->id.daddr,
						  &x->props.saddr,
						  x->id.proto, family);
}

763 764 765 766 767 768 769 770
static void xfrm_hash_grow_check(int have_hash_collision)
{
	if (have_hash_collision &&
	    (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
	    xfrm_state_num > xfrm_state_hmask)
		schedule_work(&xfrm_hash_work);
}

Linus Torvalds's avatar
Linus Torvalds committed
771
struct xfrm_state *
772
xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
Linus Torvalds's avatar
Linus Torvalds committed
773 774 775 776
		struct flowi *fl, struct xfrm_tmpl *tmpl,
		struct xfrm_policy *pol, int *err,
		unsigned short family)
{
777
	unsigned int h;
778
	struct hlist_node *entry;
779
	struct xfrm_state *x, *x0, *to_put;
Linus Torvalds's avatar
Linus Torvalds committed
780 781 782
	int acquire_in_progress = 0;
	int error = 0;
	struct xfrm_state *best = NULL;
783

784 785
	to_put = NULL;

Linus Torvalds's avatar
Linus Torvalds committed
786
	spin_lock_bh(&xfrm_state_lock);
787
	h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
788
	hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
Linus Torvalds's avatar
Linus Torvalds committed
789 790
		if (x->props.family == family &&
		    x->props.reqid == tmpl->reqid &&
791
		    !(x->props.flags & XFRM_STATE_WILDRECV) &&
Linus Torvalds's avatar
Linus Torvalds committed
792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809
		    xfrm_state_addr_check(x, daddr, saddr, family) &&
		    tmpl->mode == x->props.mode &&
		    tmpl->id.proto == x->id.proto &&
		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
			/* Resolution logic:
			   1. There is a valid state with matching selector.
			      Done.
			   2. Valid state with inappropriate selector. Skip.

			   Entering area of "sysdeps".

			   3. If state is not valid, selector is temporary,
			      it selects only session which triggered
			      previous resolution. Key manager will do
			      something to install a state with proper
			      selector.
			 */
			if (x->km.state == XFRM_STATE_VALID) {
810
				if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
811
				    !security_xfrm_state_pol_flow_match(x, pol, fl))
Linus Torvalds's avatar
Linus Torvalds committed
812 813 814 815 816 817 818 819 820 821
					continue;
				if (!best ||
				    best->km.dying > x->km.dying ||
				    (best->km.dying == x->km.dying &&
				     best->curlft.add_time < x->curlft.add_time))
					best = x;
			} else if (x->km.state == XFRM_STATE_ACQ) {
				acquire_in_progress = 1;
			} else if (x->km.state == XFRM_STATE_ERROR ||
				   x->km.state == XFRM_STATE_EXPIRED) {
822
				if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
823
				    security_xfrm_state_pol_flow_match(x, pol, fl))
Linus Torvalds's avatar
Linus Torvalds committed
824 825 826 827 828 829 830
					error = -ESRCH;
			}
		}
	}

	x = best;
	if (!x && !error && !acquire_in_progress) {
831
		if (tmpl->id.spi &&
832 833
		    (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
					      tmpl->id.proto, family)) != NULL) {
834
			to_put = x0;
Linus Torvalds's avatar
Linus Torvalds committed
835 836 837 838 839 840 841 842 843 844 845 846
			error = -EEXIST;
			goto out;
		}
		x = xfrm_state_alloc();
		if (x == NULL) {
			error = -ENOMEM;
			goto out;
		}
		/* Initialize temporary selector matching only
		 * to current session. */
		xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);

847 848 849
		error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
		if (error) {
			x->km.state = XFRM_STATE_DEAD;
850
			to_put = x;
851 852 853 854
			x = NULL;
			goto out;
		}

Linus Torvalds's avatar
Linus Torvalds committed
855 856
		if (km_query(x, tmpl, pol) == 0) {
			x->km.state = XFRM_STATE_ACQ;
857
			list_add(&x->km.all, &xfrm_state_all);
858
			hlist_add_head(&x->bydst, xfrm_state_bydst+h);
859
			h = xfrm_src_hash(daddr, saddr, family);
860
			hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
Linus Torvalds's avatar
Linus Torvalds committed
861 862
			if (x->id.spi) {
				h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
863
				hlist_add_head(&x->byspi, xfrm_state_byspi+h);
Linus Torvalds's avatar
Linus Torvalds committed
864
			}
865 866
			x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
			x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
Linus Torvalds's avatar
Linus Torvalds committed
867
			add_timer(&x->timer);
868 869
			xfrm_state_num++;
			xfrm_hash_grow_check(x->bydst.next != NULL);
Linus Torvalds's avatar
Linus Torvalds committed
870 871
		} else {
			x->km.state = XFRM_STATE_DEAD;
872
			to_put = x;
Linus Torvalds's avatar
Linus Torvalds committed
873 874 875 876 877 878 879 880 881 882
			x = NULL;
			error = -ESRCH;
		}
	}
out:
	if (x)
		xfrm_state_hold(x);
	else
		*err = acquire_in_progress ? -EAGAIN : error;
	spin_unlock_bh(&xfrm_state_lock);
883 884
	if (to_put)
		xfrm_state_put(to_put);
Linus Torvalds's avatar
Linus Torvalds committed
885 886 887
	return x;
}

888 889 890 891
struct xfrm_state *
xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
		    unsigned short family, u8 mode, u8 proto, u32 reqid)
{
892
	unsigned int h;
893 894 895 896
	struct xfrm_state *rx = NULL, *x = NULL;
	struct hlist_node *entry;

	spin_lock(&xfrm_state_lock);
897
	h = xfrm_dst_hash(daddr, saddr, reqid, family);
898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919
	hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
		if (x->props.family == family &&
		    x->props.reqid == reqid &&
		    !(x->props.flags & XFRM_STATE_WILDRECV) &&
		    xfrm_state_addr_check(x, daddr, saddr, family) &&
		    mode == x->props.mode &&
		    proto == x->id.proto &&
		    x->km.state == XFRM_STATE_VALID) {
			rx = x;
			break;
		}
	}

	if (rx)
		xfrm_state_hold(rx);
	spin_unlock(&xfrm_state_lock);


	return rx;
}
EXPORT_SYMBOL(xfrm_stateonly_find);

Linus Torvalds's avatar
Linus Torvalds committed
920 921
static void __xfrm_state_insert(struct xfrm_state *x)
{
922
	unsigned int h;
Linus Torvalds's avatar
Linus Torvalds committed
923

924 925
	x->genid = ++xfrm_state_genid;

926
	list_add(&x->km.all, &xfrm_state_all);
927

928 929
	h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
			  x->props.reqid, x->props.family);
930
	hlist_add_head(&x->bydst, xfrm_state_bydst+h);
Linus Torvalds's avatar
Linus Torvalds committed
931

932
	h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
933
	hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
Linus Torvalds's avatar
Linus Torvalds committed
934

935
	if (x->id.spi) {
936 937 938
		h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
				  x->props.family);

939
		hlist_add_head(&x->byspi, xfrm_state_byspi+h);
940 941
	}

942 943 944
	mod_timer(&x->timer, jiffies + HZ);
	if (x->replay_maxage)
		mod_timer(&x->rtimer, jiffies + x->replay_maxage);
945

Linus Torvalds's avatar
Linus Torvalds committed
946
	wake_up(&km_waitq);
947 948 949

	xfrm_state_num++;

950
	xfrm_hash_grow_check(x->bydst.next != NULL);
Linus Torvalds's avatar
Linus Torvalds committed
951 952
}

953 954 955 956 957 958 959 960 961
/* xfrm_state_lock is held */
static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
{
	unsigned short family = xnew->props.family;
	u32 reqid = xnew->props.reqid;
	struct xfrm_state *x;
	struct hlist_node *entry;
	unsigned int h;

962
	h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
963 964 965
	hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
		if (x->props.family	== family &&
		    x->props.reqid	== reqid &&
966 967
		    !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
		    !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
968 969 970 971
			x->genid = xfrm_state_genid;
	}
}

Linus Torvalds's avatar
Linus Torvalds committed
972 973 974
void xfrm_state_insert(struct xfrm_state *x)
{
	spin_lock_bh(&xfrm_state_lock);
975
	__xfrm_state_bump_genids(x);
Linus Torvalds's avatar
Linus Torvalds committed
976 977 978 979 980
	__xfrm_state_insert(x);
	spin_unlock_bh(&xfrm_state_lock);
}
EXPORT_SYMBOL(xfrm_state_insert);

981 982 983
/* xfrm_state_lock is held */
static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
{
984
	unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
985
	struct hlist_node *entry;
986 987
	struct xfrm_state *x;

988
	hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
989 990 991 992
		if (x->props.reqid  != reqid ||
		    x->props.mode   != mode ||
		    x->props.family != family ||
		    x->km.state     != XFRM_STATE_ACQ ||
993 994
		    x->id.spi       != 0 ||
		    x->id.proto	    != proto)
995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010
			continue;

		switch (family) {
		case AF_INET:
			if (x->id.daddr.a4    != daddr->a4 ||
			    x->props.saddr.a4 != saddr->a4)
				continue;
			break;
		case AF_INET6:
			if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
					     (struct in6_addr *)daddr) ||
			    !ipv6_addr_equal((struct in6_addr *)
					     x->props.saddr.a6,
					     (struct in6_addr *)saddr))
				continue;
			break;
1011
		}
1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043

		xfrm_state_hold(x);
		return x;
	}

	if (!create)
		return NULL;

	x = xfrm_state_alloc();
	if (likely(x)) {
		switch (family) {
		case AF_INET:
			x->sel.daddr.a4 = daddr->a4;
			x->sel.saddr.a4 = saddr->a4;
			x->sel.prefixlen_d = 32;
			x->sel.prefixlen_s = 32;
			x->props.saddr.a4 = saddr->a4;
			x->id.daddr.a4 = daddr->a4;
			break;

		case AF_INET6:
			ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
				       (struct in6_addr *)daddr);
			ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
				       (struct in6_addr *)saddr);
			x->sel.prefixlen_d = 128;
			x->sel.prefixlen_s = 128;
			ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
				       (struct in6_addr *)saddr);
			ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
				       (struct in6_addr *)daddr);
			break;
1044
		}
1045 1046 1047 1048 1049 1050

		x->km.state = XFRM_STATE_ACQ;
		x->id.proto = proto;
		x->props.family = family;
		x->props.mode = mode;
		x->props.reqid = reqid;
1051
		x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
1052
		xfrm_state_hold(x);
1053
		x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1054
		add_timer(&x->timer);
1055
		list_add(&x->km.all, &xfrm_state_all);
1056
		hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1057
		h = xfrm_src_hash(daddr, saddr, family);
1058
		hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1059 1060 1061 1062

		xfrm_state_num++;

		xfrm_hash_grow_check(x->bydst.next != NULL);
1063 1064 1065 1066 1067
	}

	return x;
}

Linus Torvalds's avatar
Linus Torvalds committed
1068 1069 1070 1071
static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);

int xfrm_state_add(struct xfrm_state *x)
{
1072
	struct xfrm_state *x1, *to_put;
Linus Torvalds's avatar
Linus Torvalds committed
1073 1074
	int family;
	int err;
1075
	int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
Linus Torvalds's avatar
Linus Torvalds committed
1076 1077 1078

	family = x->props.family;

1079 1080
	to_put = NULL;

Linus Torvalds's avatar
Linus Torvalds committed
1081 1082
	spin_lock_bh(&xfrm_state_lock);

1083
	x1 = __xfrm_state_locate(x, use_spi, family);
Linus Torvalds's avatar
Linus Torvalds committed
1084
	if (x1) {
1085
		to_put = x1;
Linus Torvalds's avatar
Linus Torvalds committed
1086 1087 1088 1089 1090
		x1 = NULL;
		err = -EEXIST;
		goto out;
	}

1091
	if (use_spi && x->km.seq) {
Linus Torvalds's avatar
Linus Torvalds committed
1092
		x1 = __xfrm_find_acq_byseq(x->km.seq);
1093 1094
		if (x1 && ((x1->id.proto != x->id.proto) ||
		    xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1095
			to_put = x1;
Linus Torvalds's avatar
Linus Torvalds committed
1096 1097 1098 1099
			x1 = NULL;
		}
	}

1100
	if (use_spi && !x1)
1101 1102 1103
		x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
				     x->id.proto,
				     &x->id.daddr, &x->props.saddr, 0);
Linus Torvalds's avatar
Linus Torvalds committed
1104

1105
	__xfrm_state_bump_genids(x);
Linus Torvalds's avatar
Linus Torvalds committed
1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116
	__xfrm_state_insert(x);
	err = 0;

out:
	spin_unlock_bh(&xfrm_state_lock);

	if (x1) {
		xfrm_state_delete(x1);
		xfrm_state_put(x1);
	}

1117 1118 1119
	if (to_put)
		xfrm_state_put(to_put);

Linus Torvalds's avatar
Linus Torvalds committed
1120 1121 1122 1123
	return err;
}
EXPORT_SYMBOL(xfrm_state_add);

1124
#ifdef CONFIG_XFRM_MIGRATE
1125
static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161
{
	int err = -ENOMEM;
	struct xfrm_state *x = xfrm_state_alloc();
	if (!x)
		goto error;

	memcpy(&x->id, &orig->id, sizeof(x->id));
	memcpy(&x->sel, &orig->sel, sizeof(x->sel));
	memcpy(&x->lft, &orig->lft, sizeof(x->lft));
	x->props.mode = orig->props.mode;
	x->props.replay_window = orig->props.replay_window;
	x->props.reqid = orig->props.reqid;
	x->props.family = orig->props.family;
	x->props.saddr = orig->props.saddr;

	if (orig->aalg) {
		x->aalg = xfrm_algo_clone(orig->aalg);
		if (!x->aalg)
			goto error;
	}
	x->props.aalgo = orig->props.aalgo;

	if (orig->ealg) {
		x->ealg = xfrm_algo_clone(orig->ealg);
		if (!x->ealg)
			goto error;
	}
	x->props.ealgo = orig->props.ealgo;

	if (orig->calg) {
		x->calg = xfrm_algo_clone(orig->calg);
		if (!x->calg)
			goto error;
	}
	x->props.calgo = orig->props.calgo;

1162
	if (orig->encap) {
1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241
		x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
		if (!x->encap)
			goto error;
	}

	if (orig->coaddr) {
		x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
				    GFP_KERNEL);
		if (!x->coaddr)
			goto error;
	}

	err = xfrm_init_state(x);
	if (err)
		goto error;

	x->props.flags = orig->props.flags;

	x->curlft.add_time = orig->curlft.add_time;
	x->km.state = orig->km.state;
	x->km.seq = orig->km.seq;

	return x;

 error:
	if (errp)
		*errp = err;
	if (x) {
		kfree(x->aalg);
		kfree(x->ealg);
		kfree(x->calg);
		kfree(x->encap);
		kfree(x->coaddr);
	}
	kfree(x);
	return NULL;
}

/* xfrm_state_lock is held */
struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
{
	unsigned int h;
	struct xfrm_state *x;
	struct hlist_node *entry;

	if (m->reqid) {
		h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
				  m->reqid, m->old_family);
		hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
			if (x->props.mode != m->mode ||
			    x->id.proto != m->proto)
				continue;
			if (m->reqid && x->props.reqid != m->reqid)
				continue;
			if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
					  m->old_family) ||
			    xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
					  m->old_family))
				continue;
			xfrm_state_hold(x);
			return x;
		}
	} else {
		h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
				  m->old_family);
		hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
			if (x->props.mode != m->mode ||
			    x->id.proto != m->proto)
				continue;
			if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
					  m->old_family) ||
			    xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
					  m->old_family))
				continue;
			xfrm_state_hold(x);
			return x;
		}
	}

1242
	return NULL;
1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276
}
EXPORT_SYMBOL(xfrm_migrate_state_find);

struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
				       struct xfrm_migrate *m)
{
	struct xfrm_state *xc;
	int err;

	xc = xfrm_state_clone(x, &err);
	if (!xc)
		return NULL;

	memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
	memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));

	/* add state */
	if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
		/* a care is needed when the destination address of the
		   state is to be updated as it is a part of triplet */
		xfrm_state_insert(xc);
	} else {
		if ((err = xfrm_state_add(xc)) < 0)
			goto error;
	}

	return xc;
error:
	kfree(xc);
	return NULL;
}
EXPORT_SYMBOL(xfrm_state_migrate);
#endif

Linus Torvalds's avatar
Linus Torvalds committed
1277 1278
int xfrm_state_update(struct xfrm_state *x)
{
1279
	struct xfrm_state *x1, *to_put;
Linus Torvalds's avatar
Linus Torvalds committed
1280
	int err;
1281
	int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
Linus Torvalds's avatar
Linus Torvalds committed
1282

1283 1284
	to_put = NULL;

Linus Torvalds's avatar
Linus Torvalds committed
1285
	spin_lock_bh(&xfrm_state_lock);
1286
	x1 = __xfrm_state_locate(x, use_spi, x->props.family);
Linus Torvalds's avatar
Linus Torvalds committed
1287 1288 1289 1290 1291 1292

	err = -ESRCH;
	if (!x1)
		goto out;

	if (xfrm_state_kern(x1)) {
1293
		to_put = x1;
Linus Torvalds's avatar
Linus Torvalds committed
1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306
		err = -EEXIST;
		goto out;
	}

	if (x1->km.state == XFRM_STATE_ACQ) {
		__xfrm_state_insert(x);
		x = NULL;
	}
	err = 0;

out:
	spin_unlock_bh(&xfrm_state_lock);

1307 1308 1309
	if (to_put)
		xfrm_state_put(to_put);

Linus Torvalds's avatar
Linus Torvalds committed
1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323
	if (err)
		return err;

	if (!x) {
		xfrm_state_delete(x1);
		xfrm_state_put(x1);
		return 0;
	}

	err = -EINVAL;
	spin_lock_bh(&x1->lock);
	if (likely(x1->km.state == XFRM_STATE_VALID)) {
		if (x->encap && x1->encap)
			memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1324 1325 1326 1327 1328
		if (x->coaddr && x1->coaddr) {
			memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
		}
		if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
			memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
Linus Torvalds's avatar
Linus Torvalds committed
1329 1330 1331
		memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
		x1->km.dying = 0;

1332
		mod_timer(&x1->timer, jiffies + HZ);
Linus Torvalds's avatar
Linus Torvalds committed
1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348
		if (x1->curlft.use_time)
			xfrm_state_check_expire(x1);

		err = 0;
	}
	spin_unlock_bh(&x1->lock);

	xfrm_state_put(x1);

	return err;
}
EXPORT_SYMBOL(xfrm_state_update);

int xfrm_state_check_expire(struct xfrm_state *x)
{
	if (!x->curlft.use_time)
1349
		x->curlft.use_time = get_seconds();
Linus Torvalds's avatar
Linus Torvalds committed
1350 1351 1352 1353 1354 1355

	if (x->km.state != XFRM_STATE_VALID)
		return -EINVAL;

	if (x->curlft.bytes >= x->lft.hard_byte_limit ||
	    x->curlft.packets >= x->lft.hard_packet_limit) {
1356
		x->km.state = XFRM_STATE_EXPIRED;
1357
		mod_timer(&x->timer, jiffies);
Linus Torvalds's avatar
Linus Torvalds committed
1358 1359 1360 1361 1362
		return -EINVAL;
	}

	if (!x->km.dying &&
	    (x->curlft.bytes >= x->lft.soft_byte_limit ||
1363 1364
	     x->curlft.packets >= x->lft.soft_packet_limit)) {
		x->km.dying = 1;
1365
		km_state_expired(x, 0, 0);
1366
	}
Linus Torvalds's avatar
Linus Torvalds committed
1367 1368 1369 1370 1371
	return 0;
}
EXPORT_SYMBOL(xfrm_state_check_expire);

struct xfrm_state *
1372
xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
Linus Torvalds's avatar
Linus Torvalds committed
1373 1374 1375 1376 1377
		  unsigned short family)
{
	struct xfrm_state *x;

	spin_lock_bh(&xfrm_state_lock);
1378
	x = __xfrm_state_lookup(daddr, spi, proto, family);
Linus Torvalds's avatar
Linus Torvalds committed
1379 1380 1381 1382 1383 1384
	spin_unlock_bh(&xfrm_state_lock);
	return x;
}
EXPORT_SYMBOL(xfrm_state_lookup);

struct xfrm_state *
1385 1386 1387 1388 1389 1390
xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
			 u8 proto, unsigned short family)
{
	struct xfrm_state *x;

	spin_lock_bh(&xfrm_state_lock);
1391
	x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
1392 1393 1394 1395 1396 1397
	spin_unlock_bh(&xfrm_state_lock);
	return x;
}
EXPORT_SYMBOL(xfrm_state_lookup_byaddr);

struct xfrm_state *
1398 1399
xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
	      xfrm_address_t *daddr, xfrm_address_t *saddr,
Linus Torvalds's avatar
Linus Torvalds committed
1400 1401 1402 1403 1404
	      int create, unsigned short family)
{
	struct xfrm_state *x;

	spin_lock_bh(&xfrm_state_lock);
1405
	x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
Linus Torvalds's avatar
Linus Torvalds committed
1406
	spin_unlock_bh(&xfrm_state_lock);
1407

Linus Torvalds's avatar
Linus Torvalds committed
1408 1409 1410 1411
	return x;
}
EXPORT_SYMBOL(xfrm_find_acq);

1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449
#ifdef CONFIG_XFRM_SUB_POLICY
int
xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
	       unsigned short family)
{
	int err = 0;
	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
	if (!afinfo)
		return -EAFNOSUPPORT;

	spin_lock_bh(&xfrm_state_lock);
	if (afinfo->tmpl_sort)
		err = afinfo->tmpl_sort(dst, src, n);
	spin_unlock_bh(&xfrm_state_lock);
	xfrm_state_put_afinfo(afinfo);
	return err;
}
EXPORT_SYMBOL(xfrm_tmpl_sort);

int
xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
		unsigned short family)
{
	int err = 0;
	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
	if (!afinfo)
		return -EAFNOSUPPORT;

	spin_lock_bh(&xfrm_state_lock);
	if (afinfo->state_sort)
		err = afinfo->state_sort(dst, src, n);
	spin_unlock_bh(&xfrm_state_lock);
	xfrm_state_put_afinfo(afinfo);
	return err;
}
EXPORT_SYMBOL(xfrm_state_sort);
#endif

Linus Torvalds's avatar
Linus Torvalds committed
1450 1451 1452 1453 1454 1455
/* Silly enough, but I'm lazy to build resolution list */

static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
{
	int i;

1456
	for (i = 0; i <= xfrm_state_hmask; i++) {
1457 1458 1459 1460 1461 1462
		struct hlist_node *entry;
		struct xfrm_state *x;

		hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
			if (x->km.seq == seq &&
			    x->km.state == XFRM_STATE_ACQ) {
Linus Torvalds's avatar
Linus Torvalds committed
1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494
				xfrm_state_hold(x);
				return x;
			}
		}
	}
	return NULL;
}

struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
{
	struct xfrm_state *x;

	spin_lock_bh(&xfrm_state_lock);
	x = __xfrm_find_acq_byseq(seq);
	spin_unlock_bh(&xfrm_state_lock);
	return x;
}
EXPORT_SYMBOL(xfrm_find_acq_byseq);

u32 xfrm_get_acqseq(void)
{
	u32 res;
	static u32 acqseq;
	static DEFINE_SPINLOCK(acqseq_lock);

	spin_lock_bh(&acqseq_lock);
	res = (++acqseq ? : ++acqseq);
	spin_unlock_bh(&acqseq_lock);
	return res;
}
EXPORT_SYMBOL(xfrm_get_acqseq);

1495
int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
Linus Torvalds's avatar
Linus Torvalds committed
1496
{
1497
	unsigned int h;
Linus Torvalds's avatar
Linus Torvalds committed
1498
	struct xfrm_state *x0;
1499 1500 1501
	int err = -ENOENT;
	__be32 minspi = htonl(low);
	__be32 maxspi = htonl(high);
Linus Torvalds's avatar
Linus Torvalds committed
1502

1503 1504 1505 1506 1507
	spin_lock_bh(&x->lock);
	if (x->km.state == XFRM_STATE_DEAD)
		goto unlock;

	err = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1508
	if (x->id.spi)
1509 1510 1511
		goto unlock;

	err = -ENOENT;
Linus Torvalds's avatar
Linus Torvalds committed
1512 1513 1514 1515 1516

	if (minspi == maxspi) {
		x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
		if (x0) {
			xfrm_state_put(x0);
1517
			goto unlock;
Linus Torvalds's avatar
Linus Torvalds committed
1518 1519 1520 1521
		}
		x->id.spi = minspi;
	} else {
		u32 spi = 0;
Al Viro's avatar
Al Viro committed
1522 1523
		for (h=0; h<high-low+1; h++) {
			spi = low + net_random()%(high-low+1);
Linus Torvalds's avatar
Linus Torvalds committed
1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534
			x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
			if (x0 == NULL) {
				x->id.spi = htonl(spi);
				break;
			}
			xfrm_state_put(x0);
		}
	}
	if (x->id.spi) {
		spin_lock_bh(&xfrm_state_lock);
		h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1535
		hlist_add_head(&x->byspi, xfrm_state_byspi+h);
Linus Torvalds's avatar
Linus Torvalds committed
1536
		spin_unlock_bh(&xfrm_state_lock);
1537 1538

		err = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1539
	}
1540 1541 1542 1543 1544

unlock:
	spin_unlock_bh(&x->lock);

	return err;
Linus Torvalds's avatar
Linus Torvalds committed
1545 1546 1547
}
EXPORT_SYMBOL(xfrm_alloc_spi);

1548 1549
int xfrm_state_walk(struct xfrm_state_walk *walk,
		    int (*func)(struct xfrm_state *, int, void*),
Linus Torvalds's avatar
Linus Torvalds committed
1550 1551
		    void *data)
{
1552 1553
	struct xfrm_state *state;
	struct xfrm_state_walk *x;
Linus Torvalds's avatar
Linus Torvalds committed
1554 1555
	int err = 0;

1556
	if (walk->seq != 0 && list_empty(&walk->all))
1557 1558
		return 0;

Linus Torvalds's avatar
Linus Torvalds committed
1559
	spin_lock_bh(&xfrm_state_lock);
1560 1561 1562 1563
	if (list_empty(&walk->all))
		x = list_first_entry(&xfrm_state_all, struct xfrm_state_walk, all);
	else
		x = list_entry(&walk->all, struct xfrm_state_walk, all);
1564
	list_for_each_entry_from(x, &xfrm_state_all, all) {
1565
		if (x->state == XFRM_STATE_DEAD)
1566
			continue;
1567 1568
		state = container_of(x, struct xfrm_state, km);
		if (!xfrm_id_proto_match(state->id.proto, walk->proto))
1569
			continue;
1570 1571 1572 1573
		err = func(state, walk->seq, data);
		if (err) {
			list_move_tail(&walk->all, &x->all);
			goto out;
Linus Torvalds's avatar
Linus Torvalds committed
1574
		}
1575
		walk->seq++;
Linus Torvalds's avatar
Linus Torvalds committed
1576
	}
1577
	if (walk->seq == 0) {
Linus Torvalds's avatar
Linus Torvalds committed
1578 1579 1580
		err = -ENOENT;
		goto out;
	}
1581
	list_del_init(&walk->all);
Linus Torvalds's avatar
Linus Torvalds committed
1582 1583 1584 1585 1586 1587
out:
	spin_unlock_bh(&xfrm_state_lock);
	return err;
}
EXPORT_SYMBOL(xfrm_state_walk);

Herbert Xu's avatar
Herbert Xu committed
1588 1589
void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
{
1590
	INIT_LIST_HEAD(&walk->all);
Herbert Xu's avatar
Herbert Xu committed
1591
	walk->proto = proto;
1592 1593
	walk->state = XFRM_STATE_DEAD;
	walk->seq = 0;
Herbert Xu's avatar
Herbert Xu committed
1594 1595 1596
}
EXPORT_SYMBOL(xfrm_state_walk_init);

1597 1598
void xfrm_state_walk_done(struct xfrm_state_walk *walk)
{
1599
	if (list_empty(&walk->all))
Herbert Xu's avatar
Herbert Xu committed
1600 1601
		return;

1602 1603 1604
	spin_lock_bh(&xfrm_state_lock);
	list_del(&walk->all);
	spin_lock_bh(&xfrm_state_lock);
1605 1606 1607
}
EXPORT_SYMBOL(xfrm_state_walk_done);

1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625

void xfrm_replay_notify(struct xfrm_state *x, int event)
{
	struct km_event c;
	/* we send notify messages in case
	 *  1. we updated on of the sequence numbers, and the seqno difference
	 *     is at least x->replay_maxdiff, in this case we also update the
	 *     timeout of our timer function
	 *  2. if x->replay_maxage has elapsed since last update,
	 *     and there were changes
	 *
	 *  The state structure must be locked!
	 */

	switch (event) {
	case XFRM_REPLAY_UPDATE:
		if (x->replay_maxdiff &&
		    (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
1626 1627 1628 1629 1630 1631
		    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
			if (x->xflags & XFRM_TIME_DEFER)
				event = XFRM_REPLAY_TIMEOUT;
			else
				return;
		}
1632 1633 1634 1635 1636 1637

		break;

	case XFRM_REPLAY_TIMEOUT:
		if ((x->replay.seq == x->preplay.seq) &&
		    (x->replay.bitmap == x->preplay.bitmap) &&
Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
1638 1639
		    (x->replay.oseq == x->preplay.oseq)) {
			x->xflags |= XFRM_TIME_DEFER;
1640
			return;
Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
1641
		}
1642 1643 1644 1645 1646 1647 1648 1649 1650 1651

		break;
	}

	memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
	c.event = XFRM_MSG_NEWAE;
	c.data.aevent = event;
	km_state_notify(x, &c);

	if (x->replay_maxage &&
1652
	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
1653
		x->xflags &= ~XFRM_TIME_DEFER;
1654 1655 1656 1657 1658 1659 1660 1661
}

static void xfrm_replay_timer_handler(unsigned long data)
{
	struct xfrm_state *x = (struct xfrm_state*)data;

	spin_lock(&x->lock);

Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
1662 1663 1664 1665 1666 1667
	if (x->km.state == XFRM_STATE_VALID) {
		if (xfrm_aevent_is_on())
			xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
		else
			x->xflags |= XFRM_TIME_DEFER;
	}
1668 1669 1670 1671

	spin_unlock(&x->lock);
}

1672 1673
int xfrm_replay_check(struct xfrm_state *x,
		      struct sk_buff *skb, __be32 net_seq)
Linus Torvalds's avatar
Linus Torvalds committed
1674 1675
{
	u32 diff;
1676
	u32 seq = ntohl(net_seq);
Linus Torvalds's avatar
Linus Torvalds committed
1677 1678

	if (unlikely(seq == 0))
1679
		goto err;
Linus Torvalds's avatar
Linus Torvalds committed
1680 1681 1682 1683 1684

	if (likely(seq > x->replay.seq))
		return 0;

	diff = x->replay.seq - seq;
1685 1686
	if (diff >= min_t(unsigned int, x->props.replay_window,
			  sizeof(x->replay.bitmap) * 8)) {
Linus Torvalds's avatar
Linus Torvalds committed
1687
		x->stats.replay_window++;
1688
		goto err;
Linus Torvalds's avatar
Linus Torvalds committed
1689 1690 1691 1692
	}

	if (x->replay.bitmap & (1U << diff)) {
		x->stats.replay++;
1693
		goto err;
Linus Torvalds's avatar
Linus Torvalds committed
1694 1695
	}
	return 0;
1696 1697 1698 1699

err:
	xfrm_audit_state_replay(x, skb, net_seq);
	return -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
1700 1701
}

1702
void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
Linus Torvalds's avatar
Linus Torvalds committed
1703 1704
{
	u32 diff;
1705
	u32 seq = ntohl(net_seq);
Linus Torvalds's avatar
Linus Torvalds committed
1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717

	if (seq > x->replay.seq) {
		diff = seq - x->replay.seq;
		if (diff < x->props.replay_window)
			x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
		else
			x->replay.bitmap = 1;
		x->replay.seq = seq;
	} else {
		diff = x->replay.seq - seq;
		x->replay.bitmap |= (1U << diff);
	}
1718 1719 1720

	if (xfrm_aevent_is_on())
		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
Linus Torvalds's avatar
Linus Torvalds committed
1721 1722
}

1723
static LIST_HEAD(xfrm_km_list);
Linus Torvalds's avatar
Linus Torvalds committed
1724 1725
static DEFINE_RWLOCK(xfrm_km_lock);

1726
void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
Linus Torvalds's avatar
Linus Torvalds committed
1727 1728 1729
{
	struct xfrm_mgr *km;

1730 1731 1732 1733 1734 1735
	read_lock(&xfrm_km_lock);
	list_for_each_entry(km, &xfrm_km_list, list)
		if (km->notify_policy)
			km->notify_policy(xp, dir, c);
	read_unlock(&xfrm_km_lock);
}
Linus Torvalds's avatar
Linus Torvalds committed
1736

1737 1738 1739
void km_state_notify(struct xfrm_state *x, struct km_event *c)
{
	struct xfrm_mgr *km;
Linus Torvalds's avatar
Linus Torvalds committed
1740 1741
	read_lock(&xfrm_km_lock);
	list_for_each_entry(km, &xfrm_km_list, list)
1742 1743
		if (km->notify)
			km->notify(x, c);
Linus Torvalds's avatar
Linus Torvalds committed
1744
	read_unlock(&xfrm_km_lock);
1745 1746 1747 1748 1749
}

EXPORT_SYMBOL(km_policy_notify);
EXPORT_SYMBOL(km_state_notify);

1750
void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1751 1752 1753
{
	struct km_event c;

1754
	c.data.hard = hard;
1755
	c.pid = pid;
1756
	c.event = XFRM_MSG_EXPIRE;
1757
	km_state_notify(x, &c);
Linus Torvalds's avatar
Linus Torvalds committed
1758 1759 1760 1761 1762

	if (hard)
		wake_up(&km_waitq);
}

1763
EXPORT_SYMBOL(km_state_expired);
1764 1765 1766 1767
/*
 * We send to all registered managers regardless of failure
 * We are happy with one success
*/
1768
int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
Linus Torvalds's avatar
Linus Torvalds committed
1769
{
1770
	int err = -EINVAL, acqret;
Linus Torvalds's avatar
Linus Torvalds committed
1771 1772 1773 1774
	struct xfrm_mgr *km;

	read_lock(&xfrm_km_lock);
	list_for_each_entry(km, &xfrm_km_list, list) {
1775 1776 1777
		acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
		if (!acqret)
			err = acqret;
Linus Torvalds's avatar
Linus Torvalds committed
1778 1779 1780 1781
	}
	read_unlock(&xfrm_km_lock);
	return err;
}
1782
EXPORT_SYMBOL(km_query);
Linus Torvalds's avatar
Linus Torvalds committed
1783

Al Viro's avatar
Al Viro committed
1784
int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
Linus Torvalds's avatar
Linus Torvalds committed
1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800
{
	int err = -EINVAL;
	struct xfrm_mgr *km;

	read_lock(&xfrm_km_lock);
	list_for_each_entry(km, &xfrm_km_list, list) {
		if (km->new_mapping)
			err = km->new_mapping(x, ipaddr, sport);
		if (!err)
			break;
	}
	read_unlock(&xfrm_km_lock);
	return err;
}
EXPORT_SYMBOL(km_new_mapping);

1801
void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
Linus Torvalds's avatar
Linus Torvalds committed
1802
{
1803
	struct km_event c;
Linus Torvalds's avatar
Linus Torvalds committed
1804

1805
	c.data.hard = hard;
1806
	c.pid = pid;
1807
	c.event = XFRM_MSG_POLEXPIRE;
1808
	km_policy_notify(pol, dir, &c);
Linus Torvalds's avatar
Linus Torvalds committed
1809 1810 1811 1812

	if (hard)
		wake_up(&km_waitq);
}
1813
EXPORT_SYMBOL(km_policy_expired);
Linus Torvalds's avatar
Linus Torvalds committed
1814

1815
#ifdef CONFIG_XFRM_MIGRATE
1816
int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1817 1818
	       struct xfrm_migrate *m, int num_migrate,
	       struct xfrm_kmaddress *k)
1819 1820 1821 1822 1823 1824 1825 1826
{
	int err = -EINVAL;
	int ret;
	struct xfrm_mgr *km;

	read_lock(&xfrm_km_lock);
	list_for_each_entry(km, &xfrm_km_list, list) {
		if (km->migrate) {
1827
			ret = km->migrate(sel, dir, type, m, num_migrate, k);
1828 1829 1830 1831 1832 1833 1834 1835
			if (!ret)
				err = ret;
		}
	}
	read_unlock(&xfrm_km_lock);
	return err;
}
EXPORT_SYMBOL(km_migrate);
1836
#endif
1837

1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856
int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
{
	int err = -EINVAL;
	int ret;
	struct xfrm_mgr *km;

	read_lock(&xfrm_km_lock);
	list_for_each_entry(km, &xfrm_km_list, list) {
		if (km->report) {
			ret = km->report(proto, sel, addr);
			if (!ret)
				err = ret;
		}
	}
	read_unlock(&xfrm_km_lock);
	return err;
}
EXPORT_SYMBOL(km_report);

Linus Torvalds's avatar
Linus Torvalds committed
1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877
int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
{
	int err;
	u8 *data;
	struct xfrm_mgr *km;
	struct xfrm_policy *pol = NULL;

	if (optlen <= 0 || optlen > PAGE_SIZE)
		return -EMSGSIZE;

	data = kmalloc(optlen, GFP_KERNEL);
	if (!data)
		return -ENOMEM;

	err = -EFAULT;
	if (copy_from_user(data, optval, optlen))
		goto out;

	err = -EINVAL;
	read_lock(&xfrm_km_lock);
	list_for_each_entry(km, &xfrm_km_list, list) {
1878
		pol = km->compile_policy(sk, optname, data,
Linus Torvalds's avatar
Linus Torvalds committed
1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921
					 optlen, &err);
		if (err >= 0)
			break;
	}
	read_unlock(&xfrm_km_lock);

	if (err >= 0) {
		xfrm_sk_policy_insert(sk, err, pol);
		xfrm_pol_put(pol);
		err = 0;
	}

out:
	kfree(data);
	return err;
}
EXPORT_SYMBOL(xfrm_user_policy);

int xfrm_register_km(struct xfrm_mgr *km)
{
	write_lock_bh(&xfrm_km_lock);
	list_add_tail(&km->list, &xfrm_km_list);
	write_unlock_bh(&xfrm_km_lock);
	return 0;
}
EXPORT_SYMBOL(xfrm_register_km);

int xfrm_unregister_km(struct xfrm_mgr *km)
{
	write_lock_bh(&xfrm_km_lock);
	list_del(&km->list);
	write_unlock_bh(&xfrm_km_lock);
	return 0;
}
EXPORT_SYMBOL(xfrm_unregister_km);

int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
{
	int err = 0;
	if (unlikely(afinfo == NULL))
		return -EINVAL;
	if (unlikely(afinfo->family >= NPROTO))
		return -EAFNOSUPPORT;
1922
	write_lock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds's avatar
Linus Torvalds committed
1923 1924
	if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
		err = -ENOBUFS;
1925
	else
Linus Torvalds's avatar
Linus Torvalds committed
1926
		xfrm_state_afinfo[afinfo->family] = afinfo;
1927
	write_unlock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds's avatar
Linus Torvalds committed
1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938
	return err;
}
EXPORT_SYMBOL(xfrm_state_register_afinfo);

int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
{
	int err = 0;
	if (unlikely(afinfo == NULL))
		return -EINVAL;
	if (unlikely(afinfo->family >= NPROTO))
		return -EAFNOSUPPORT;
1939
	write_lock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds's avatar
Linus Torvalds committed
1940 1941 1942
	if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
		if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
			err = -EINVAL;
1943
		else
Linus Torvalds's avatar
Linus Torvalds committed
1944 1945
			xfrm_state_afinfo[afinfo->family] = NULL;
	}
1946
	write_unlock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds's avatar
Linus Torvalds committed
1947 1948 1949 1950
	return err;
}
EXPORT_SYMBOL(xfrm_state_unregister_afinfo);

1951
static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
Linus Torvalds's avatar
Linus Torvalds committed
1952 1953 1954 1955 1956 1957
{
	struct xfrm_state_afinfo *afinfo;
	if (unlikely(family >= NPROTO))
		return NULL;
	read_lock(&xfrm_state_afinfo_lock);
	afinfo = xfrm_state_afinfo[family];
1958 1959
	if (unlikely(!afinfo))
		read_unlock(&xfrm_state_afinfo_lock);
Linus Torvalds's avatar
Linus Torvalds committed
1960 1961 1962
	return afinfo;
}

1963
static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1964
	__releases(xfrm_state_afinfo_lock)
Linus Torvalds's avatar
Linus Torvalds committed
1965
{
1966
	read_unlock(&xfrm_state_afinfo_lock);
Linus Torvalds's avatar
Linus Torvalds committed
1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985
}

/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
void xfrm_state_delete_tunnel(struct xfrm_state *x)
{
	if (x->tunnel) {
		struct xfrm_state *t = x->tunnel;

		if (atomic_read(&t->tunnel_users) == 2)
			xfrm_state_delete(t);
		atomic_dec(&t->tunnel_users);
		xfrm_state_put(t);
		x->tunnel = NULL;
	}
}
EXPORT_SYMBOL(xfrm_state_delete_tunnel);

int xfrm_state_mtu(struct xfrm_state *x, int mtu)
{
1986
	int res;
Linus Torvalds's avatar
Linus Torvalds committed
1987

1988 1989 1990 1991 1992
	spin_lock_bh(&x->lock);
	if (x->km.state == XFRM_STATE_VALID &&
	    x->type && x->type->get_mtu)
		res = x->type->get_mtu(x, mtu);
	else
1993
		res = mtu - x->props.header_len;
1994
	spin_unlock_bh(&x->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1995 1996 1997
	return res;
}

Herbert Xu's avatar
Herbert Xu committed
1998 1999
int xfrm_init_state(struct xfrm_state *x)
{
2000
	struct xfrm_state_afinfo *afinfo;
2001
	struct xfrm_mode *inner_mode;
2002
	int family = x->props.family;
Herbert Xu's avatar
Herbert Xu committed
2003 2004
	int err;

2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019
	err = -EAFNOSUPPORT;
	afinfo = xfrm_state_get_afinfo(family);
	if (!afinfo)
		goto error;

	err = 0;
	if (afinfo->init_flags)
		err = afinfo->init_flags(x);

	xfrm_state_put_afinfo(afinfo);

	if (err)
		goto error;

	err = -EPROTONOSUPPORT;
2020

2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061
	if (x->sel.family != AF_UNSPEC) {
		inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
		if (inner_mode == NULL)
			goto error;

		if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
		    family != x->sel.family) {
			xfrm_put_mode(inner_mode);
			goto error;
		}

		x->inner_mode = inner_mode;
	} else {
		struct xfrm_mode *inner_mode_iaf;

		inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
		if (inner_mode == NULL)
			goto error;

		if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
			xfrm_put_mode(inner_mode);
			goto error;
		}

		inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
		if (inner_mode_iaf == NULL)
			goto error;

		if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
			xfrm_put_mode(inner_mode_iaf);
			goto error;
		}

		if (x->props.family == AF_INET) {
			x->inner_mode = inner_mode;
			x->inner_mode_iaf = inner_mode_iaf;
		} else {
			x->inner_mode = inner_mode_iaf;
			x->inner_mode_iaf = inner_mode;
		}
	}
2062

2063
	x->type = xfrm_get_type(x->id.proto, family);
Herbert Xu's avatar
Herbert Xu committed
2064 2065 2066 2067 2068 2069 2070
	if (x->type == NULL)
		goto error;

	err = x->type->init_state(x);
	if (err)
		goto error;

2071 2072
	x->outer_mode = xfrm_get_mode(x->props.mode, family);
	if (x->outer_mode == NULL)
2073 2074
		goto error;

Herbert Xu's avatar
Herbert Xu committed
2075 2076 2077 2078 2079 2080 2081
	x->km.state = XFRM_STATE_VALID;

error:
	return err;
}

EXPORT_SYMBOL(xfrm_init_state);
2082

2083
int __net_init xfrm_state_init(struct net *net)
Linus Torvalds's avatar
Linus Torvalds committed
2084
{
2085 2086 2087 2088
	unsigned int sz;

	sz = sizeof(struct hlist_head) * 8;

2089 2090 2091
	xfrm_state_bydst = xfrm_hash_alloc(sz);
	xfrm_state_bysrc = xfrm_hash_alloc(sz);
	xfrm_state_byspi = xfrm_hash_alloc(sz);
2092 2093 2094
	if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
		panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
	xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
Linus Torvalds's avatar
Linus Torvalds committed
2095

2096
	INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
2097 2098 2099 2100 2101
	return 0;
}

void xfrm_state_fini(struct net *net)
{
Linus Torvalds's avatar
Linus Torvalds committed
2102 2103
}

Joy Latten's avatar
Joy Latten committed
2104
#ifdef CONFIG_AUDITSYSCALL
Ilpo Järvinen's avatar
Ilpo Järvinen committed
2105 2106
static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
				     struct audit_buffer *audit_buf)
Joy Latten's avatar
Joy Latten committed
2107
{
Paul Moore's avatar
Paul Moore committed
2108 2109 2110 2111
	struct xfrm_sec_ctx *ctx = x->security;
	u32 spi = ntohl(x->id.spi);

	if (ctx)
Joy Latten's avatar
Joy Latten committed
2112
		audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
Paul Moore's avatar
Paul Moore committed
2113
				 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
Joy Latten's avatar
Joy Latten committed
2114 2115 2116

	switch(x->props.family) {
	case AF_INET:
2117 2118
		audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
				 &x->props.saddr.a4, &x->id.daddr.a4);
Joy Latten's avatar
Joy Latten committed
2119 2120
		break;
	case AF_INET6:
Harvey Harrison's avatar
Harvey Harrison committed
2121
		audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
2122
				 x->props.saddr.a6, x->id.daddr.a6);
Joy Latten's avatar
Joy Latten committed
2123 2124
		break;
	}
Paul Moore's avatar
Paul Moore committed
2125 2126

	audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
Joy Latten's avatar
Joy Latten committed
2127 2128
}

Ilpo Järvinen's avatar
Ilpo Järvinen committed
2129 2130
static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
				      struct audit_buffer *audit_buf)
2131 2132 2133 2134 2135 2136 2137
{
	struct iphdr *iph4;
	struct ipv6hdr *iph6;

	switch (family) {
	case AF_INET:
		iph4 = ip_hdr(skb);
2138 2139
		audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
				 &iph4->saddr, &iph4->daddr);
2140 2141 2142 2143
		break;
	case AF_INET6:
		iph6 = ipv6_hdr(skb);
		audit_log_format(audit_buf,
Harvey Harrison's avatar
Harvey Harrison committed
2144
				 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2145
				 &iph6->saddr,&iph6->daddr,
2146 2147 2148 2149 2150 2151 2152
				 iph6->flow_lbl[0] & 0x0f,
				 iph6->flow_lbl[1],
				 iph6->flow_lbl[2]);
		break;
	}
}

Paul Moore's avatar
Paul Moore committed
2153
void xfrm_audit_state_add(struct xfrm_state *x, int result,
2154
			  uid_t auid, u32 sessionid, u32 secid)
Joy Latten's avatar
Joy Latten committed
2155 2156 2157
{
	struct audit_buffer *audit_buf;

2158
	audit_buf = xfrm_audit_start("SAD-add");
Joy Latten's avatar
Joy Latten committed
2159 2160
	if (audit_buf == NULL)
		return;
2161
	xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2162 2163
	xfrm_audit_helper_sainfo(x, audit_buf);
	audit_log_format(audit_buf, " res=%u", result);
Joy Latten's avatar
Joy Latten committed
2164 2165 2166 2167
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_state_add);

Paul Moore's avatar
Paul Moore committed
2168
void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2169
			     uid_t auid, u32 sessionid, u32 secid)
Joy Latten's avatar
Joy Latten committed
2170 2171 2172
{
	struct audit_buffer *audit_buf;

2173
	audit_buf = xfrm_audit_start("SAD-delete");
Joy Latten's avatar
Joy Latten committed
2174 2175
	if (audit_buf == NULL)
		return;
2176
	xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2177 2178
	xfrm_audit_helper_sainfo(x, audit_buf);
	audit_log_format(audit_buf, " res=%u", result);
Joy Latten's avatar
Joy Latten committed
2179 2180 2181
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264

void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
				      struct sk_buff *skb)
{
	struct audit_buffer *audit_buf;
	u32 spi;

	audit_buf = xfrm_audit_start("SA-replay-overflow");
	if (audit_buf == NULL)
		return;
	xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
	/* don't record the sequence number because it's inherent in this kind
	 * of audit message */
	spi = ntohl(x->id.spi);
	audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);

static void xfrm_audit_state_replay(struct xfrm_state *x,
			     struct sk_buff *skb, __be32 net_seq)
{
	struct audit_buffer *audit_buf;
	u32 spi;

	audit_buf = xfrm_audit_start("SA-replayed-pkt");
	if (audit_buf == NULL)
		return;
	xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
	spi = ntohl(x->id.spi);
	audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
			 spi, spi, ntohl(net_seq));
	audit_log_end(audit_buf);
}

void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
{
	struct audit_buffer *audit_buf;

	audit_buf = xfrm_audit_start("SA-notfound");
	if (audit_buf == NULL)
		return;
	xfrm_audit_helper_pktinfo(skb, family, audit_buf);
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);

void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
			       __be32 net_spi, __be32 net_seq)
{
	struct audit_buffer *audit_buf;
	u32 spi;

	audit_buf = xfrm_audit_start("SA-notfound");
	if (audit_buf == NULL)
		return;
	xfrm_audit_helper_pktinfo(skb, family, audit_buf);
	spi = ntohl(net_spi);
	audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
			 spi, spi, ntohl(net_seq));
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);

void xfrm_audit_state_icvfail(struct xfrm_state *x,
			      struct sk_buff *skb, u8 proto)
{
	struct audit_buffer *audit_buf;
	__be32 net_spi;
	__be32 net_seq;

	audit_buf = xfrm_audit_start("SA-icv-failure");
	if (audit_buf == NULL)
		return;
	xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
	if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
		u32 spi = ntohl(net_spi);
		audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
				 spi, spi, ntohl(net_seq));
	}
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
Joy Latten's avatar
Joy Latten committed
2265
#endif /* CONFIG_AUDITSYSCALL */