1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16#include <linux/workqueue.h>
17#include <net/xfrm.h>
18#include <linux/pfkeyv2.h>
19#include <linux/ipsec.h>
20#include <linux/module.h>
21#include <linux/cache.h>
22#include <linux/audit.h>
23#include <asm/uaccess.h>
24#include <linux/ktime.h>
25#include <linux/slab.h>
26#include <linux/interrupt.h>
27#include <linux/kernel.h>
28
29#include "xfrm_hash.h"
30
31
32
33
34
35
36
37
38static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
39
40static inline unsigned int xfrm_dst_hash(struct net *net,
41 const xfrm_address_t *daddr,
42 const xfrm_address_t *saddr,
43 u32 reqid,
44 unsigned short family)
45{
46 return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
47}
48
49static inline unsigned int xfrm_src_hash(struct net *net,
50 const xfrm_address_t *daddr,
51 const xfrm_address_t *saddr,
52 unsigned short family)
53{
54 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
55}
56
57static inline unsigned int
58xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr,
59 __be32 spi, u8 proto, unsigned short family)
60{
61 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
62}
63
64static void xfrm_hash_transfer(struct hlist_head *list,
65 struct hlist_head *ndsttable,
66 struct hlist_head *nsrctable,
67 struct hlist_head *nspitable,
68 unsigned int nhashmask)
69{
70 struct hlist_node *tmp;
71 struct xfrm_state *x;
72
73 hlist_for_each_entry_safe(x, tmp, list, bydst) {
74 unsigned int h;
75
76 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
77 x->props.reqid, x->props.family,
78 nhashmask);
79 hlist_add_head(&x->bydst, ndsttable+h);
80
81 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
82 x->props.family,
83 nhashmask);
84 hlist_add_head(&x->bysrc, nsrctable+h);
85
86 if (x->id.spi) {
87 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
88 x->id.proto, x->props.family,
89 nhashmask);
90 hlist_add_head(&x->byspi, nspitable+h);
91 }
92 }
93}
94
95static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
96{
97 return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
98}
99
100static void xfrm_hash_resize(struct work_struct *work)
101{
102 struct net *net = container_of(work, struct net, xfrm.state_hash_work);
103 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
104 unsigned long nsize, osize;
105 unsigned int nhashmask, ohashmask;
106 int i;
107
108 nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
109 ndst = xfrm_hash_alloc(nsize);
110 if (!ndst)
111 return;
112 nsrc = xfrm_hash_alloc(nsize);
113 if (!nsrc) {
114 xfrm_hash_free(ndst, nsize);
115 return;
116 }
117 nspi = xfrm_hash_alloc(nsize);
118 if (!nspi) {
119 xfrm_hash_free(ndst, nsize);
120 xfrm_hash_free(nsrc, nsize);
121 return;
122 }
123
124 spin_lock_bh(&net->xfrm.xfrm_state_lock);
125
126 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
127 for (i = net->xfrm.state_hmask; i >= 0; i--)
128 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
129 nhashmask);
130
131 odst = net->xfrm.state_bydst;
132 osrc = net->xfrm.state_bysrc;
133 ospi = net->xfrm.state_byspi;
134 ohashmask = net->xfrm.state_hmask;
135
136 net->xfrm.state_bydst = ndst;
137 net->xfrm.state_bysrc = nsrc;
138 net->xfrm.state_byspi = nspi;
139 net->xfrm.state_hmask = nhashmask;
140
141 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
142
143 osize = (ohashmask + 1) * sizeof(struct hlist_head);
144 xfrm_hash_free(odst, osize);
145 xfrm_hash_free(osrc, osize);
146 xfrm_hash_free(ospi, osize);
147}
148
149static DEFINE_SPINLOCK(xfrm_state_afinfo_lock);
150static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO];
151
152static DEFINE_SPINLOCK(xfrm_state_gc_lock);
153
154int __xfrm_state_delete(struct xfrm_state *x);
155
156int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
157bool km_is_alive(const struct km_event *c);
158void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
159
160static DEFINE_SPINLOCK(xfrm_type_lock);
161int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
162{
163 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
164 const struct xfrm_type **typemap;
165 int err = 0;
166
167 if (unlikely(afinfo == NULL))
168 return -EAFNOSUPPORT;
169 typemap = afinfo->type_map;
170 spin_lock_bh(&xfrm_type_lock);
171
172 if (likely(typemap[type->proto] == NULL))
173 typemap[type->proto] = type;
174 else
175 err = -EEXIST;
176 spin_unlock_bh(&xfrm_type_lock);
177 xfrm_state_put_afinfo(afinfo);
178 return err;
179}
180EXPORT_SYMBOL(xfrm_register_type);
181
182int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
183{
184 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
185 const struct xfrm_type **typemap;
186 int err = 0;
187
188 if (unlikely(afinfo == NULL))
189 return -EAFNOSUPPORT;
190 typemap = afinfo->type_map;
191 spin_lock_bh(&xfrm_type_lock);
192
193 if (unlikely(typemap[type->proto] != type))
194 err = -ENOENT;
195 else
196 typemap[type->proto] = NULL;
197 spin_unlock_bh(&xfrm_type_lock);
198 xfrm_state_put_afinfo(afinfo);
199 return err;
200}
201EXPORT_SYMBOL(xfrm_unregister_type);
202
203static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
204{
205 struct xfrm_state_afinfo *afinfo;
206 const struct xfrm_type **typemap;
207 const struct xfrm_type *type;
208 int modload_attempted = 0;
209
210retry:
211 afinfo = xfrm_state_get_afinfo(family);
212 if (unlikely(afinfo == NULL))
213 return NULL;
214 typemap = afinfo->type_map;
215
216 type = typemap[proto];
217 if (unlikely(type && !try_module_get(type->owner)))
218 type = NULL;
219 if (!type && !modload_attempted) {
220 xfrm_state_put_afinfo(afinfo);
221 request_module("xfrm-type-%d-%d", family, proto);
222 modload_attempted = 1;
223 goto retry;
224 }
225
226 xfrm_state_put_afinfo(afinfo);
227 return type;
228}
229
230static void xfrm_put_type(const struct xfrm_type *type)
231{
232 module_put(type->owner);
233}
234
235static DEFINE_SPINLOCK(xfrm_mode_lock);
236int xfrm_register_mode(struct xfrm_mode *mode, int family)
237{
238 struct xfrm_state_afinfo *afinfo;
239 struct xfrm_mode **modemap;
240 int err;
241
242 if (unlikely(mode->encap >= XFRM_MODE_MAX))
243 return -EINVAL;
244
245 afinfo = xfrm_state_get_afinfo(family);
246 if (unlikely(afinfo == NULL))
247 return -EAFNOSUPPORT;
248
249 err = -EEXIST;
250 modemap = afinfo->mode_map;
251 spin_lock_bh(&xfrm_mode_lock);
252 if (modemap[mode->encap])
253 goto out;
254
255 err = -ENOENT;
256 if (!try_module_get(afinfo->owner))
257 goto out;
258
259 mode->afinfo = afinfo;
260 modemap[mode->encap] = mode;
261 err = 0;
262
263out:
264 spin_unlock_bh(&xfrm_mode_lock);
265 xfrm_state_put_afinfo(afinfo);
266 return err;
267}
268EXPORT_SYMBOL(xfrm_register_mode);
269
270int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
271{
272 struct xfrm_state_afinfo *afinfo;
273 struct xfrm_mode **modemap;
274 int err;
275
276 if (unlikely(mode->encap >= XFRM_MODE_MAX))
277 return -EINVAL;
278
279 afinfo = xfrm_state_get_afinfo(family);
280 if (unlikely(afinfo == NULL))
281 return -EAFNOSUPPORT;
282
283 err = -ENOENT;
284 modemap = afinfo->mode_map;
285 spin_lock_bh(&xfrm_mode_lock);
286 if (likely(modemap[mode->encap] == mode)) {
287 modemap[mode->encap] = NULL;
288 module_put(mode->afinfo->owner);
289 err = 0;
290 }
291
292 spin_unlock_bh(&xfrm_mode_lock);
293 xfrm_state_put_afinfo(afinfo);
294 return err;
295}
296EXPORT_SYMBOL(xfrm_unregister_mode);
297
298static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
299{
300 struct xfrm_state_afinfo *afinfo;
301 struct xfrm_mode *mode;
302 int modload_attempted = 0;
303
304 if (unlikely(encap >= XFRM_MODE_MAX))
305 return NULL;
306
307retry:
308 afinfo = xfrm_state_get_afinfo(family);
309 if (unlikely(afinfo == NULL))
310 return NULL;
311
312 mode = afinfo->mode_map[encap];
313 if (unlikely(mode && !try_module_get(mode->owner)))
314 mode = NULL;
315 if (!mode && !modload_attempted) {
316 xfrm_state_put_afinfo(afinfo);
317 request_module("xfrm-mode-%d-%d", family, encap);
318 modload_attempted = 1;
319 goto retry;
320 }
321
322 xfrm_state_put_afinfo(afinfo);
323 return mode;
324}
325
326static void xfrm_put_mode(struct xfrm_mode *mode)
327{
328 module_put(mode->owner);
329}
330
331static void xfrm_state_gc_destroy(struct xfrm_state *x)
332{
333 tasklet_hrtimer_cancel(&x->mtimer);
334 del_timer_sync(&x->rtimer);
335 kfree(x->aalg);
336 kfree(x->ealg);
337 kfree(x->calg);
338 kfree(x->encap);
339 kfree(x->coaddr);
340 kfree(x->replay_esn);
341 kfree(x->preplay_esn);
342 if (x->inner_mode)
343 xfrm_put_mode(x->inner_mode);
344 if (x->inner_mode_iaf)
345 xfrm_put_mode(x->inner_mode_iaf);
346 if (x->outer_mode)
347 xfrm_put_mode(x->outer_mode);
348 if (x->type) {
349 x->type->destructor(x);
350 xfrm_put_type(x->type);
351 }
352 security_xfrm_state_free(x);
353 kfree(x);
354}
355
356static void xfrm_state_gc_task(struct work_struct *work)
357{
358 struct net *net = container_of(work, struct net, xfrm.state_gc_work);
359 struct xfrm_state *x;
360 struct hlist_node *tmp;
361 struct hlist_head gc_list;
362
363 spin_lock_bh(&xfrm_state_gc_lock);
364 hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
365 spin_unlock_bh(&xfrm_state_gc_lock);
366
367 hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
368 xfrm_state_gc_destroy(x);
369}
370
371static inline unsigned long make_jiffies(long secs)
372{
373 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
374 return MAX_SCHEDULE_TIMEOUT-1;
375 else
376 return secs*HZ;
377}
378
379static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
380{
381 struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer);
382 struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer);
383 unsigned long now = get_seconds();
384 long next = LONG_MAX;
385 int warn = 0;
386 int err = 0;
387
388 spin_lock(&x->lock);
389 if (x->km.state == XFRM_STATE_DEAD)
390 goto out;
391 if (x->km.state == XFRM_STATE_EXPIRED)
392 goto expired;
393 if (x->lft.hard_add_expires_seconds) {
394 long tmo = x->lft.hard_add_expires_seconds +
395 x->curlft.add_time - now;
396 if (tmo <= 0) {
397 if (x->xflags & XFRM_SOFT_EXPIRE) {
398
399
400
401
402 x->curlft.add_time = now - x->saved_tmo - 1;
403 tmo = x->lft.hard_add_expires_seconds - x->saved_tmo;
404 } else
405 goto expired;
406 }
407 if (tmo < next)
408 next = tmo;
409 }
410 if (x->lft.hard_use_expires_seconds) {
411 long tmo = x->lft.hard_use_expires_seconds +
412 (x->curlft.use_time ? : now) - now;
413 if (tmo <= 0)
414 goto expired;
415 if (tmo < next)
416 next = tmo;
417 }
418 if (x->km.dying)
419 goto resched;
420 if (x->lft.soft_add_expires_seconds) {
421 long tmo = x->lft.soft_add_expires_seconds +
422 x->curlft.add_time - now;
423 if (tmo <= 0) {
424 warn = 1;
425 x->xflags &= ~XFRM_SOFT_EXPIRE;
426 } else if (tmo < next) {
427 next = tmo;
428 x->xflags |= XFRM_SOFT_EXPIRE;
429 x->saved_tmo = tmo;
430 }
431 }
432 if (x->lft.soft_use_expires_seconds) {
433 long tmo = x->lft.soft_use_expires_seconds +
434 (x->curlft.use_time ? : now) - now;
435 if (tmo <= 0)
436 warn = 1;
437 else if (tmo < next)
438 next = tmo;
439 }
440
441 x->km.dying = warn;
442 if (warn)
443 km_state_expired(x, 0, 0);
444resched:
445 if (next != LONG_MAX) {
446 tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL);
447 }
448
449 goto out;
450
451expired:
452 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0)
453 x->km.state = XFRM_STATE_EXPIRED;
454
455 err = __xfrm_state_delete(x);
456 if (!err)
457 km_state_expired(x, 1, 0);
458
459 xfrm_audit_state_delete(x, err ? 0 : 1, true);
460
461out:
462 spin_unlock(&x->lock);
463 return HRTIMER_NORESTART;
464}
465
466static void xfrm_replay_timer_handler(unsigned long data);
467
468struct xfrm_state *xfrm_state_alloc(struct net *net)
469{
470 struct xfrm_state *x;
471
472 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
473
474 if (x) {
475 write_pnet(&x->xs_net, net);
476 atomic_set(&x->refcnt, 1);
477 atomic_set(&x->tunnel_users, 0);
478 INIT_LIST_HEAD(&x->km.all);
479 INIT_HLIST_NODE(&x->bydst);
480 INIT_HLIST_NODE(&x->bysrc);
481 INIT_HLIST_NODE(&x->byspi);
482 tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler,
483 CLOCK_BOOTTIME, HRTIMER_MODE_ABS);
484 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
485 (unsigned long)x);
486 x->curlft.add_time = get_seconds();
487 x->lft.soft_byte_limit = XFRM_INF;
488 x->lft.soft_packet_limit = XFRM_INF;
489 x->lft.hard_byte_limit = XFRM_INF;
490 x->lft.hard_packet_limit = XFRM_INF;
491 x->replay_maxage = 0;
492 x->replay_maxdiff = 0;
493 x->inner_mode = NULL;
494 x->inner_mode_iaf = NULL;
495 spin_lock_init(&x->lock);
496 }
497 return x;
498}
499EXPORT_SYMBOL(xfrm_state_alloc);
500
501void __xfrm_state_destroy(struct xfrm_state *x)
502{
503 struct net *net = xs_net(x);
504
505 WARN_ON(x->km.state != XFRM_STATE_DEAD);
506
507 spin_lock_bh(&xfrm_state_gc_lock);
508 hlist_add_head(&x->gclist, &net->xfrm.state_gc_list);
509 spin_unlock_bh(&xfrm_state_gc_lock);
510 schedule_work(&net->xfrm.state_gc_work);
511}
512EXPORT_SYMBOL(__xfrm_state_destroy);
513
514int __xfrm_state_delete(struct xfrm_state *x)
515{
516 struct net *net = xs_net(x);
517 int err = -ESRCH;
518
519 if (x->km.state != XFRM_STATE_DEAD) {
520 x->km.state = XFRM_STATE_DEAD;
521 spin_lock(&net->xfrm.xfrm_state_lock);
522 list_del(&x->km.all);
523 hlist_del(&x->bydst);
524 hlist_del(&x->bysrc);
525 if (x->id.spi)
526 hlist_del(&x->byspi);
527 net->xfrm.state_num--;
528 spin_unlock(&net->xfrm.xfrm_state_lock);
529
530
531
532
533
534 xfrm_state_put(x);
535 err = 0;
536 }
537
538 return err;
539}
540EXPORT_SYMBOL(__xfrm_state_delete);
541
542int xfrm_state_delete(struct xfrm_state *x)
543{
544 int err;
545
546 spin_lock_bh(&x->lock);
547 err = __xfrm_state_delete(x);
548 spin_unlock_bh(&x->lock);
549
550 return err;
551}
552EXPORT_SYMBOL(xfrm_state_delete);
553
554#ifdef CONFIG_SECURITY_NETWORK_XFRM
555static inline int
556xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
557{
558 int i, err = 0;
559
560 for (i = 0; i <= net->xfrm.state_hmask; i++) {
561 struct xfrm_state *x;
562
563 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
564 if (xfrm_id_proto_match(x->id.proto, proto) &&
565 (err = security_xfrm_state_delete(x)) != 0) {
566 xfrm_audit_state_delete(x, 0, task_valid);
567 return err;
568 }
569 }
570 }
571
572 return err;
573}
574#else
575static inline int
576xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
577{
578 return 0;
579}
580#endif
581
582int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
583{
584 int i, err = 0, cnt = 0;
585
586 spin_lock_bh(&net->xfrm.xfrm_state_lock);
587 err = xfrm_state_flush_secctx_check(net, proto, task_valid);
588 if (err)
589 goto out;
590
591 err = -ESRCH;
592 for (i = 0; i <= net->xfrm.state_hmask; i++) {
593 struct xfrm_state *x;
594restart:
595 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
596 if (!xfrm_state_kern(x) &&
597 xfrm_id_proto_match(x->id.proto, proto)) {
598 xfrm_state_hold(x);
599 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
600
601 err = xfrm_state_delete(x);
602 xfrm_audit_state_delete(x, err ? 0 : 1,
603 task_valid);
604 xfrm_state_put(x);
605 if (!err)
606 cnt++;
607
608 spin_lock_bh(&net->xfrm.xfrm_state_lock);
609 goto restart;
610 }
611 }
612 }
613 if (cnt)
614 err = 0;
615
616out:
617 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
618 return err;
619}
620EXPORT_SYMBOL(xfrm_state_flush);
621
622void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
623{
624 spin_lock_bh(&net->xfrm.xfrm_state_lock);
625 si->sadcnt = net->xfrm.state_num;
626 si->sadhcnt = net->xfrm.state_hmask;
627 si->sadhmcnt = xfrm_state_hashmax;
628 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
629}
630EXPORT_SYMBOL(xfrm_sad_getinfo);
631
632static int
633xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl,
634 const struct xfrm_tmpl *tmpl,
635 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
636 unsigned short family)
637{
638 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
639 if (!afinfo)
640 return -1;
641 afinfo->init_tempsel(&x->sel, fl);
642
643 if (family != tmpl->encap_family) {
644 xfrm_state_put_afinfo(afinfo);
645 afinfo = xfrm_state_get_afinfo(tmpl->encap_family);
646 if (!afinfo)
647 return -1;
648 }
649 afinfo->init_temprop(x, tmpl, daddr, saddr);
650 xfrm_state_put_afinfo(afinfo);
651 return 0;
652}
653
654static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
655 const xfrm_address_t *daddr,
656 __be32 spi, u8 proto,
657 unsigned short family)
658{
659 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
660 struct xfrm_state *x;
661
662 hlist_for_each_entry(x, net->xfrm.state_byspi+h, byspi) {
663 if (x->props.family != family ||
664 x->id.spi != spi ||
665 x->id.proto != proto ||
666 !xfrm_addr_equal(&x->id.daddr, daddr, family))
667 continue;
668
669 if ((mark & x->mark.m) != x->mark.v)
670 continue;
671 xfrm_state_hold(x);
672 return x;
673 }
674
675 return NULL;
676}
677
678static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
679 const xfrm_address_t *daddr,
680 const xfrm_address_t *saddr,
681 u8 proto, unsigned short family)
682{
683 unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
684 struct xfrm_state *x;
685
686 hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
687 if (x->props.family != family ||
688 x->id.proto != proto ||
689 !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
690 !xfrm_addr_equal(&x->props.saddr, saddr, family))
691 continue;
692
693 if ((mark & x->mark.m) != x->mark.v)
694 continue;
695 xfrm_state_hold(x);
696 return x;
697 }
698
699 return NULL;
700}
701
702static inline struct xfrm_state *
703__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
704{
705 struct net *net = xs_net(x);
706 u32 mark = x->mark.v & x->mark.m;
707
708 if (use_spi)
709 return __xfrm_state_lookup(net, mark, &x->id.daddr,
710 x->id.spi, x->id.proto, family);
711 else
712 return __xfrm_state_lookup_byaddr(net, mark,
713 &x->id.daddr,
714 &x->props.saddr,
715 x->id.proto, family);
716}
717
718static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
719{
720 if (have_hash_collision &&
721 (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
722 net->xfrm.state_num > net->xfrm.state_hmask)
723 schedule_work(&net->xfrm.state_hash_work);
724}
725
726static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
727 const struct flowi *fl, unsigned short family,
728 struct xfrm_state **best, int *acq_in_progress,
729 int *error)
730{
731
732
733
734
735
736
737
738
739
740
741
742 if (x->km.state == XFRM_STATE_VALID) {
743 if ((x->sel.family &&
744 !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
745 !security_xfrm_state_pol_flow_match(x, pol, fl))
746 return;
747
748 if (!*best ||
749 (*best)->km.dying > x->km.dying ||
750 ((*best)->km.dying == x->km.dying &&
751 (*best)->curlft.add_time < x->curlft.add_time))
752 *best = x;
753 } else if (x->km.state == XFRM_STATE_ACQ) {
754 *acq_in_progress = 1;
755 } else if (x->km.state == XFRM_STATE_ERROR ||
756 x->km.state == XFRM_STATE_EXPIRED) {
757 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
758 security_xfrm_state_pol_flow_match(x, pol, fl))
759 *error = -ESRCH;
760 }
761}
762
763struct xfrm_state *
764xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
765 const struct flowi *fl, struct xfrm_tmpl *tmpl,
766 struct xfrm_policy *pol, int *err,
767 unsigned short family)
768{
769 static xfrm_address_t saddr_wildcard = { };
770 struct net *net = xp_net(pol);
771 unsigned int h, h_wildcard;
772 struct xfrm_state *x, *x0, *to_put;
773 int acquire_in_progress = 0;
774 int error = 0;
775 struct xfrm_state *best = NULL;
776 u32 mark = pol->mark.v & pol->mark.m;
777 unsigned short encap_family = tmpl->encap_family;
778 struct km_event c;
779
780 to_put = NULL;
781
782 spin_lock_bh(&net->xfrm.xfrm_state_lock);
783 h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
784 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
785 if (x->props.family == encap_family &&
786 x->props.reqid == tmpl->reqid &&
787 (mark & x->mark.m) == x->mark.v &&
788 !(x->props.flags & XFRM_STATE_WILDRECV) &&
789 xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
790 tmpl->mode == x->props.mode &&
791 tmpl->id.proto == x->id.proto &&
792 (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
793 xfrm_state_look_at(pol, x, fl, encap_family,
794 &best, &acquire_in_progress, &error);
795 }
796 if (best || acquire_in_progress)
797 goto found;
798
799 h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
800 hlist_for_each_entry(x, net->xfrm.state_bydst+h_wildcard, bydst) {
801 if (x->props.family == encap_family &&
802 x->props.reqid == tmpl->reqid &&
803 (mark & x->mark.m) == x->mark.v &&
804 !(x->props.flags & XFRM_STATE_WILDRECV) &&
805 xfrm_addr_equal(&x->id.daddr, daddr, encap_family) &&
806 tmpl->mode == x->props.mode &&
807 tmpl->id.proto == x->id.proto &&
808 (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
809 xfrm_state_look_at(pol, x, fl, encap_family,
810 &best, &acquire_in_progress, &error);
811 }
812
813found:
814 x = best;
815 if (!x && !error && !acquire_in_progress) {
816 if (tmpl->id.spi &&
817 (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
818 tmpl->id.proto, encap_family)) != NULL) {
819 to_put = x0;
820 error = -EEXIST;
821 goto out;
822 }
823
824 c.net = net;
825
826
827
828
829 if (!km_is_alive(&c)) {
830 error = -ESRCH;
831 goto out;
832 }
833
834 x = xfrm_state_alloc(net);
835 if (x == NULL) {
836 error = -ENOMEM;
837 goto out;
838 }
839
840
841 xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
842 memcpy(&x->mark, &pol->mark, sizeof(x->mark));
843
844 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid);
845 if (error) {
846 x->km.state = XFRM_STATE_DEAD;
847 to_put = x;
848 x = NULL;
849 goto out;
850 }
851
852 if (km_query(x, tmpl, pol) == 0) {
853 x->km.state = XFRM_STATE_ACQ;
854 list_add(&x->km.all, &net->xfrm.state_all);
855 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
856 h = xfrm_src_hash(net, daddr, saddr, encap_family);
857 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
858 if (x->id.spi) {
859 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
860 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
861 }
862 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
863 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
864 net->xfrm.state_num++;
865 xfrm_hash_grow_check(net, x->bydst.next != NULL);
866 } else {
867 x->km.state = XFRM_STATE_DEAD;
868 to_put = x;
869 x = NULL;
870 error = -ESRCH;
871 }
872 }
873out:
874 if (x)
875 xfrm_state_hold(x);
876 else
877 *err = acquire_in_progress ? -EAGAIN : error;
878 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
879 if (to_put)
880 xfrm_state_put(to_put);
881 return x;
882}
883
884struct xfrm_state *
885xfrm_stateonly_find(struct net *net, u32 mark,
886 xfrm_address_t *daddr, xfrm_address_t *saddr,
887 unsigned short family, u8 mode, u8 proto, u32 reqid)
888{
889 unsigned int h;
890 struct xfrm_state *rx = NULL, *x = NULL;
891
892 spin_lock_bh(&net->xfrm.xfrm_state_lock);
893 h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
894 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
895 if (x->props.family == family &&
896 x->props.reqid == reqid &&
897 (mark & x->mark.m) == x->mark.v &&
898 !(x->props.flags & XFRM_STATE_WILDRECV) &&
899 xfrm_state_addr_check(x, daddr, saddr, family) &&
900 mode == x->props.mode &&
901 proto == x->id.proto &&
902 x->km.state == XFRM_STATE_VALID) {
903 rx = x;
904 break;
905 }
906 }
907
908 if (rx)
909 xfrm_state_hold(rx);
910 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
911
912
913 return rx;
914}
915EXPORT_SYMBOL(xfrm_stateonly_find);
916
917struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
918 unsigned short family)
919{
920 struct xfrm_state *x;
921 struct xfrm_state_walk *w;
922
923 spin_lock_bh(&net->xfrm.xfrm_state_lock);
924 list_for_each_entry(w, &net->xfrm.state_all, all) {
925 x = container_of(w, struct xfrm_state, km);
926 if (x->props.family != family ||
927 x->id.spi != spi)
928 continue;
929
930 xfrm_state_hold(x);
931 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
932 return x;
933 }
934 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
935 return NULL;
936}
937EXPORT_SYMBOL(xfrm_state_lookup_byspi);
938
939static void __xfrm_state_insert(struct xfrm_state *x)
940{
941 struct net *net = xs_net(x);
942 unsigned int h;
943
944 list_add(&x->km.all, &net->xfrm.state_all);
945
946 h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
947 x->props.reqid, x->props.family);
948 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
949
950 h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
951 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
952
953 if (x->id.spi) {
954 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
955 x->props.family);
956
957 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
958 }
959
960 tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
961 if (x->replay_maxage)
962 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
963
964 net->xfrm.state_num++;
965
966 xfrm_hash_grow_check(net, x->bydst.next != NULL);
967}
968
969
970static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
971{
972 struct net *net = xs_net(xnew);
973 unsigned short family = xnew->props.family;
974 u32 reqid = xnew->props.reqid;
975 struct xfrm_state *x;
976 unsigned int h;
977 u32 mark = xnew->mark.v & xnew->mark.m;
978
979 h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
980 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
981 if (x->props.family == family &&
982 x->props.reqid == reqid &&
983 (mark & x->mark.m) == x->mark.v &&
984 xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) &&
985 xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family))
986 x->genid++;
987 }
988}
989
990void xfrm_state_insert(struct xfrm_state *x)
991{
992 struct net *net = xs_net(x);
993
994 spin_lock_bh(&net->xfrm.xfrm_state_lock);
995 __xfrm_state_bump_genids(x);
996 __xfrm_state_insert(x);
997 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
998}
999EXPORT_SYMBOL(xfrm_state_insert);
1000
1001
1002static struct xfrm_state *__find_acq_core(struct net *net,
1003 const struct xfrm_mark *m,
1004 unsigned short family, u8 mode,
1005 u32 reqid, u8 proto,
1006 const xfrm_address_t *daddr,
1007 const xfrm_address_t *saddr,
1008 int create)
1009{
1010 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
1011 struct xfrm_state *x;
1012 u32 mark = m->v & m->m;
1013
1014 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
1015 if (x->props.reqid != reqid ||
1016 x->props.mode != mode ||
1017 x->props.family != family ||
1018 x->km.state != XFRM_STATE_ACQ ||
1019 x->id.spi != 0 ||
1020 x->id.proto != proto ||
1021 (mark & x->mark.m) != x->mark.v ||
1022 !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
1023 !xfrm_addr_equal(&x->props.saddr, saddr, family))
1024 continue;
1025
1026 xfrm_state_hold(x);
1027 return x;
1028 }
1029
1030 if (!create)
1031 return NULL;
1032
1033 x = xfrm_state_alloc(net);
1034 if (likely(x)) {
1035 switch (family) {
1036 case AF_INET:
1037 x->sel.daddr.a4 = daddr->a4;
1038 x->sel.saddr.a4 = saddr->a4;
1039 x->sel.prefixlen_d = 32;
1040 x->sel.prefixlen_s = 32;
1041 x->props.saddr.a4 = saddr->a4;
1042 x->id.daddr.a4 = daddr->a4;
1043 break;
1044
1045 case AF_INET6:
1046 x->sel.daddr.in6 = daddr->in6;
1047 x->sel.saddr.in6 = saddr->in6;
1048 x->sel.prefixlen_d = 128;
1049 x->sel.prefixlen_s = 128;
1050 x->props.saddr.in6 = saddr->in6;
1051 x->id.daddr.in6 = daddr->in6;
1052 break;
1053 }
1054
1055 x->km.state = XFRM_STATE_ACQ;
1056 x->id.proto = proto;
1057 x->props.family = family;
1058 x->props.mode = mode;
1059 x->props.reqid = reqid;
1060 x->mark.v = m->v;
1061 x->mark.m = m->m;
1062 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
1063 xfrm_state_hold(x);
1064 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
1065 list_add(&x->km.all, &net->xfrm.state_all);
1066 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
1067 h = xfrm_src_hash(net, daddr, saddr, family);
1068 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
1069
1070 net->xfrm.state_num++;
1071
1072 xfrm_hash_grow_check(net, x->bydst.next != NULL);
1073 }
1074
1075 return x;
1076}
1077
1078static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1079
1080int xfrm_state_add(struct xfrm_state *x)
1081{
1082 struct net *net = xs_net(x);
1083 struct xfrm_state *x1, *to_put;
1084 int family;
1085 int err;
1086 u32 mark = x->mark.v & x->mark.m;
1087 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1088
1089 family = x->props.family;
1090
1091 to_put = NULL;
1092
1093 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1094
1095 x1 = __xfrm_state_locate(x, use_spi, family);
1096 if (x1) {
1097 to_put = x1;
1098 x1 = NULL;
1099 err = -EEXIST;
1100 goto out;
1101 }
1102
1103 if (use_spi && x->km.seq) {
1104 x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq);
1105 if (x1 && ((x1->id.proto != x->id.proto) ||
1106 !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) {
1107 to_put = x1;
1108 x1 = NULL;
1109 }
1110 }
1111
1112 if (use_spi && !x1)
1113 x1 = __find_acq_core(net, &x->mark, family, x->props.mode,
1114 x->props.reqid, x->id.proto,
1115 &x->id.daddr, &x->props.saddr, 0);
1116
1117 __xfrm_state_bump_genids(x);
1118 __xfrm_state_insert(x);
1119 err = 0;
1120
1121out:
1122 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1123
1124 if (x1) {
1125 xfrm_state_delete(x1);
1126 xfrm_state_put(x1);
1127 }
1128
1129 if (to_put)
1130 xfrm_state_put(to_put);
1131
1132 return err;
1133}
1134EXPORT_SYMBOL(xfrm_state_add);
1135
1136#ifdef CONFIG_XFRM_MIGRATE
1137static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
1138{
1139 struct net *net = xs_net(orig);
1140 struct xfrm_state *x = xfrm_state_alloc(net);
1141 if (!x)
1142 goto out;
1143
1144 memcpy(&x->id, &orig->id, sizeof(x->id));
1145 memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1146 memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1147 x->props.mode = orig->props.mode;
1148 x->props.replay_window = orig->props.replay_window;
1149 x->props.reqid = orig->props.reqid;
1150 x->props.family = orig->props.family;
1151 x->props.saddr = orig->props.saddr;
1152
1153 if (orig->aalg) {
1154 x->aalg = xfrm_algo_auth_clone(orig->aalg);
1155 if (!x->aalg)
1156 goto error;
1157 }
1158 x->props.aalgo = orig->props.aalgo;
1159
1160 if (orig->aead) {
1161 x->aead = xfrm_algo_aead_clone(orig->aead);
1162 if (!x->aead)
1163 goto error;
1164 }
1165 if (orig->ealg) {
1166 x->ealg = xfrm_algo_clone(orig->ealg);
1167 if (!x->ealg)
1168 goto error;
1169 }
1170 x->props.ealgo = orig->props.ealgo;
1171
1172 if (orig->calg) {
1173 x->calg = xfrm_algo_clone(orig->calg);
1174 if (!x->calg)
1175 goto error;
1176 }
1177 x->props.calgo = orig->props.calgo;
1178
1179 if (orig->encap) {
1180 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1181 if (!x->encap)
1182 goto error;
1183 }
1184
1185 if (orig->coaddr) {
1186 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1187 GFP_KERNEL);
1188 if (!x->coaddr)
1189 goto error;
1190 }
1191
1192 if (orig->replay_esn) {
1193 if (xfrm_replay_clone(x, orig))
1194 goto error;
1195 }
1196
1197 memcpy(&x->mark, &orig->mark, sizeof(x->mark));
1198
1199 if (xfrm_init_state(x) < 0)
1200 goto error;
1201
1202 x->props.flags = orig->props.flags;
1203 x->props.extra_flags = orig->props.extra_flags;
1204
1205 x->tfcpad = orig->tfcpad;
1206 x->replay_maxdiff = orig->replay_maxdiff;
1207 x->replay_maxage = orig->replay_maxage;
1208 x->curlft.add_time = orig->curlft.add_time;
1209 x->km.state = orig->km.state;
1210 x->km.seq = orig->km.seq;
1211
1212 return x;
1213
1214 error:
1215 xfrm_state_put(x);
1216out:
1217 return NULL;
1218}
1219
1220struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net)
1221{
1222 unsigned int h;
1223 struct xfrm_state *x = NULL;
1224
1225 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1226
1227 if (m->reqid) {
1228 h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
1229 m->reqid, m->old_family);
1230 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
1231 if (x->props.mode != m->mode ||
1232 x->id.proto != m->proto)
1233 continue;
1234 if (m->reqid && x->props.reqid != m->reqid)
1235 continue;
1236 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
1237 m->old_family) ||
1238 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
1239 m->old_family))
1240 continue;
1241 xfrm_state_hold(x);
1242 break;
1243 }
1244 } else {
1245 h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
1246 m->old_family);
1247 hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
1248 if (x->props.mode != m->mode ||
1249 x->id.proto != m->proto)
1250 continue;
1251 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
1252 m->old_family) ||
1253 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
1254 m->old_family))
1255 continue;
1256 xfrm_state_hold(x);
1257 break;
1258 }
1259 }
1260
1261 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1262
1263 return x;
1264}
1265EXPORT_SYMBOL(xfrm_migrate_state_find);
1266
1267struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1268 struct xfrm_migrate *m)
1269{
1270 struct xfrm_state *xc;
1271
1272 xc = xfrm_state_clone(x);
1273 if (!xc)
1274 return NULL;
1275
1276 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1277 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1278
1279
1280 if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) {
1281
1282
1283 xfrm_state_insert(xc);
1284 } else {
1285 if (xfrm_state_add(xc) < 0)
1286 goto error;
1287 }
1288
1289 return xc;
1290error:
1291 xfrm_state_put(xc);
1292 return NULL;
1293}
1294EXPORT_SYMBOL(xfrm_state_migrate);
1295#endif
1296
1297int xfrm_state_update(struct xfrm_state *x)
1298{
1299 struct xfrm_state *x1, *to_put;
1300 int err;
1301 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1302 struct net *net = xs_net(x);
1303
1304 to_put = NULL;
1305
1306 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1307 x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1308
1309 err = -ESRCH;
1310 if (!x1)
1311 goto out;
1312
1313 if (xfrm_state_kern(x1)) {
1314 to_put = x1;
1315 err = -EEXIST;
1316 goto out;
1317 }
1318
1319 if (x1->km.state == XFRM_STATE_ACQ) {
1320 __xfrm_state_insert(x);
1321 x = NULL;
1322 }
1323 err = 0;
1324
1325out:
1326 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1327
1328 if (to_put)
1329 xfrm_state_put(to_put);
1330
1331 if (err)
1332 return err;
1333
1334 if (!x) {
1335 xfrm_state_delete(x1);
1336 xfrm_state_put(x1);
1337 return 0;
1338 }
1339
1340 err = -EINVAL;
1341 spin_lock_bh(&x1->lock);
1342 if (likely(x1->km.state == XFRM_STATE_VALID)) {
1343 if (x->encap && x1->encap)
1344 memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1345 if (x->coaddr && x1->coaddr) {
1346 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1347 }
1348 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1349 memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1350 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1351 x1->km.dying = 0;
1352
1353 tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
1354 if (x1->curlft.use_time)
1355 xfrm_state_check_expire(x1);
1356
1357 err = 0;
1358 x->km.state = XFRM_STATE_DEAD;
1359 __xfrm_state_put(x);
1360 }
1361 spin_unlock_bh(&x1->lock);
1362
1363 xfrm_state_put(x1);
1364
1365 return err;
1366}
1367EXPORT_SYMBOL(xfrm_state_update);
1368
1369int xfrm_state_check_expire(struct xfrm_state *x)
1370{
1371 if (!x->curlft.use_time)
1372 x->curlft.use_time = get_seconds();
1373
1374 if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1375 x->curlft.packets >= x->lft.hard_packet_limit) {
1376 x->km.state = XFRM_STATE_EXPIRED;
1377 tasklet_hrtimer_start(&x->mtimer, ktime_set(0, 0), HRTIMER_MODE_REL);
1378 return -EINVAL;
1379 }
1380
1381 if (!x->km.dying &&
1382 (x->curlft.bytes >= x->lft.soft_byte_limit ||
1383 x->curlft.packets >= x->lft.soft_packet_limit)) {
1384 x->km.dying = 1;
1385 km_state_expired(x, 0, 0);
1386 }
1387 return 0;
1388}
1389EXPORT_SYMBOL(xfrm_state_check_expire);
1390
1391struct xfrm_state *
1392xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi,
1393 u8 proto, unsigned short family)
1394{
1395 struct xfrm_state *x;
1396
1397 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1398 x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
1399 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1400 return x;
1401}
1402EXPORT_SYMBOL(xfrm_state_lookup);
1403
1404struct xfrm_state *
1405xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1406 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1407 u8 proto, unsigned short family)
1408{
1409 struct xfrm_state *x;
1410
1411 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1412 x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
1413 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1414 return x;
1415}
1416EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1417
1418struct xfrm_state *
1419xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid,
1420 u8 proto, const xfrm_address_t *daddr,
1421 const xfrm_address_t *saddr, int create, unsigned short family)
1422{
1423 struct xfrm_state *x;
1424
1425 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1426 x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create);
1427 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1428
1429 return x;
1430}
1431EXPORT_SYMBOL(xfrm_find_acq);
1432
1433#ifdef CONFIG_XFRM_SUB_POLICY
1434int
1435xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1436 unsigned short family, struct net *net)
1437{
1438 int err = 0;
1439 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1440 if (!afinfo)
1441 return -EAFNOSUPPORT;
1442
1443 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1444 if (afinfo->tmpl_sort)
1445 err = afinfo->tmpl_sort(dst, src, n);
1446 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1447 xfrm_state_put_afinfo(afinfo);
1448 return err;
1449}
1450EXPORT_SYMBOL(xfrm_tmpl_sort);
1451
1452int
1453xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1454 unsigned short family)
1455{
1456 int err = 0;
1457 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1458 struct net *net = xs_net(*src);
1459
1460 if (!afinfo)
1461 return -EAFNOSUPPORT;
1462
1463 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1464 if (afinfo->state_sort)
1465 err = afinfo->state_sort(dst, src, n);
1466 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1467 xfrm_state_put_afinfo(afinfo);
1468 return err;
1469}
1470EXPORT_SYMBOL(xfrm_state_sort);
1471#endif
1472
1473
1474
1475static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
1476{
1477 int i;
1478
1479 for (i = 0; i <= net->xfrm.state_hmask; i++) {
1480 struct xfrm_state *x;
1481
1482 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
1483 if (x->km.seq == seq &&
1484 (mark & x->mark.m) == x->mark.v &&
1485 x->km.state == XFRM_STATE_ACQ) {
1486 xfrm_state_hold(x);
1487 return x;
1488 }
1489 }
1490 }
1491 return NULL;
1492}
1493
1494struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
1495{
1496 struct xfrm_state *x;
1497
1498 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1499 x = __xfrm_find_acq_byseq(net, mark, seq);
1500 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1501 return x;
1502}
1503EXPORT_SYMBOL(xfrm_find_acq_byseq);
1504
1505u32 xfrm_get_acqseq(void)
1506{
1507 u32 res;
1508 static atomic_t acqseq;
1509
1510 do {
1511 res = atomic_inc_return(&acqseq);
1512 } while (!res);
1513
1514 return res;
1515}
1516EXPORT_SYMBOL(xfrm_get_acqseq);
1517
1518int verify_spi_info(u8 proto, u32 min, u32 max)
1519{
1520 switch (proto) {
1521 case IPPROTO_AH:
1522 case IPPROTO_ESP:
1523 break;
1524
1525 case IPPROTO_COMP:
1526
1527 if (max >= 0x10000)
1528 return -EINVAL;
1529 break;
1530
1531 default:
1532 return -EINVAL;
1533 }
1534
1535 if (min > max)
1536 return -EINVAL;
1537
1538 return 0;
1539}
1540EXPORT_SYMBOL(verify_spi_info);
1541
1542int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1543{
1544 struct net *net = xs_net(x);
1545 unsigned int h;
1546 struct xfrm_state *x0;
1547 int err = -ENOENT;
1548 __be32 minspi = htonl(low);
1549 __be32 maxspi = htonl(high);
1550 u32 mark = x->mark.v & x->mark.m;
1551
1552 spin_lock_bh(&x->lock);
1553 if (x->km.state == XFRM_STATE_DEAD)
1554 goto unlock;
1555
1556 err = 0;
1557 if (x->id.spi)
1558 goto unlock;
1559
1560 err = -ENOENT;
1561
1562 if (minspi == maxspi) {
1563 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
1564 if (x0) {
1565 xfrm_state_put(x0);
1566 goto unlock;
1567 }
1568 x->id.spi = minspi;
1569 } else {
1570 u32 spi = 0;
1571 for (h = 0; h < high-low+1; h++) {
1572 spi = low + prandom_u32()%(high-low+1);
1573 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1574 if (x0 == NULL) {
1575 x->id.spi = htonl(spi);
1576 break;
1577 }
1578 xfrm_state_put(x0);
1579 }
1580 }
1581 if (x->id.spi) {
1582 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1583 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1584 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
1585 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1586
1587 err = 0;
1588 }
1589
1590unlock:
1591 spin_unlock_bh(&x->lock);
1592
1593 return err;
1594}
1595EXPORT_SYMBOL(xfrm_alloc_spi);
1596
1597static bool __xfrm_state_filter_match(struct xfrm_state *x,
1598 struct xfrm_address_filter *filter)
1599{
1600 if (filter) {
1601 if ((filter->family == AF_INET ||
1602 filter->family == AF_INET6) &&
1603 x->props.family != filter->family)
1604 return false;
1605
1606 return addr_match(&x->props.saddr, &filter->saddr,
1607 filter->splen) &&
1608 addr_match(&x->id.daddr, &filter->daddr,
1609 filter->dplen);
1610 }
1611 return true;
1612}
1613
1614int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1615 int (*func)(struct xfrm_state *, int, void*),
1616 void *data)
1617{
1618 struct xfrm_state *state;
1619 struct xfrm_state_walk *x;
1620 int err = 0;
1621
1622 if (walk->seq != 0 && list_empty(&walk->all))
1623 return 0;
1624
1625 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1626 if (list_empty(&walk->all))
1627 x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
1628 else
1629 x = list_first_entry(&walk->all, struct xfrm_state_walk, all);
1630 list_for_each_entry_from(x, &net->xfrm.state_all, all) {
1631 if (x->state == XFRM_STATE_DEAD)
1632 continue;
1633 state = container_of(x, struct xfrm_state, km);
1634 if (!xfrm_id_proto_match(state->id.proto, walk->proto))
1635 continue;
1636 if (!__xfrm_state_filter_match(state, walk->filter))
1637 continue;
1638 err = func(state, walk->seq, data);
1639 if (err) {
1640 list_move_tail(&walk->all, &x->all);
1641 goto out;
1642 }
1643 walk->seq++;
1644 }
1645 if (walk->seq == 0) {
1646 err = -ENOENT;
1647 goto out;
1648 }
1649 list_del_init(&walk->all);
1650out:
1651 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1652 return err;
1653}
1654EXPORT_SYMBOL(xfrm_state_walk);
1655
1656void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1657 struct xfrm_address_filter *filter)
1658{
1659 INIT_LIST_HEAD(&walk->all);
1660 walk->proto = proto;
1661 walk->state = XFRM_STATE_DEAD;
1662 walk->seq = 0;
1663 walk->filter = filter;
1664}
1665EXPORT_SYMBOL(xfrm_state_walk_init);
1666
1667void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net)
1668{
1669 kfree(walk->filter);
1670
1671 if (list_empty(&walk->all))
1672 return;
1673
1674 spin_lock_bh(&net->xfrm.xfrm_state_lock);
1675 list_del(&walk->all);
1676 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1677}
1678EXPORT_SYMBOL(xfrm_state_walk_done);
1679
1680static void xfrm_replay_timer_handler(unsigned long data)
1681{
1682 struct xfrm_state *x = (struct xfrm_state *)data;
1683
1684 spin_lock(&x->lock);
1685
1686 if (x->km.state == XFRM_STATE_VALID) {
1687 if (xfrm_aevent_is_on(xs_net(x)))
1688 x->repl->notify(x, XFRM_REPLAY_TIMEOUT);
1689 else
1690 x->xflags |= XFRM_TIME_DEFER;
1691 }
1692
1693 spin_unlock(&x->lock);
1694}
1695
1696static LIST_HEAD(xfrm_km_list);
1697
1698void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
1699{
1700 struct xfrm_mgr *km;
1701
1702 rcu_read_lock();
1703 list_for_each_entry_rcu(km, &xfrm_km_list, list)
1704 if (km->notify_policy)
1705 km->notify_policy(xp, dir, c);
1706 rcu_read_unlock();
1707}
1708
1709void km_state_notify(struct xfrm_state *x, const struct km_event *c)
1710{
1711 struct xfrm_mgr *km;
1712 rcu_read_lock();
1713 list_for_each_entry_rcu(km, &xfrm_km_list, list)
1714 if (km->notify)
1715 km->notify(x, c);
1716 rcu_read_unlock();
1717}
1718
1719EXPORT_SYMBOL(km_policy_notify);
1720EXPORT_SYMBOL(km_state_notify);
1721
1722void km_state_expired(struct xfrm_state *x, int hard, u32 portid)
1723{
1724 struct km_event c;
1725
1726 c.data.hard = hard;
1727 c.portid = portid;
1728 c.event = XFRM_MSG_EXPIRE;
1729 km_state_notify(x, &c);
1730}
1731
1732EXPORT_SYMBOL(km_state_expired);
1733
1734
1735
1736
1737int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1738{
1739 int err = -EINVAL, acqret;
1740 struct xfrm_mgr *km;
1741
1742 rcu_read_lock();
1743 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
1744 acqret = km->acquire(x, t, pol);
1745 if (!acqret)
1746 err = acqret;
1747 }
1748 rcu_read_unlock();
1749 return err;
1750}
1751EXPORT_SYMBOL(km_query);
1752
1753int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1754{
1755 int err = -EINVAL;
1756 struct xfrm_mgr *km;
1757
1758 rcu_read_lock();
1759 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
1760 if (km->new_mapping)
1761 err = km->new_mapping(x, ipaddr, sport);
1762 if (!err)
1763 break;
1764 }
1765 rcu_read_unlock();
1766 return err;
1767}
1768EXPORT_SYMBOL(km_new_mapping);
1769
1770void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
1771{
1772 struct km_event c;
1773
1774 c.data.hard = hard;
1775 c.portid = portid;
1776 c.event = XFRM_MSG_POLEXPIRE;
1777 km_policy_notify(pol, dir, &c);
1778}
1779EXPORT_SYMBOL(km_policy_expired);
1780
1781#ifdef CONFIG_XFRM_MIGRATE
1782int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1783 const struct xfrm_migrate *m, int num_migrate,
1784 const struct xfrm_kmaddress *k)
1785{
1786 int err = -EINVAL;
1787 int ret;
1788 struct xfrm_mgr *km;
1789
1790 rcu_read_lock();
1791 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
1792 if (km->migrate) {
1793 ret = km->migrate(sel, dir, type, m, num_migrate, k);
1794 if (!ret)
1795 err = ret;
1796 }
1797 }
1798 rcu_read_unlock();
1799 return err;
1800}
1801EXPORT_SYMBOL(km_migrate);
1802#endif
1803
1804int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1805{
1806 int err = -EINVAL;
1807 int ret;
1808 struct xfrm_mgr *km;
1809
1810 rcu_read_lock();
1811 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
1812 if (km->report) {
1813 ret = km->report(net, proto, sel, addr);
1814 if (!ret)
1815 err = ret;
1816 }
1817 }
1818 rcu_read_unlock();
1819 return err;
1820}
1821EXPORT_SYMBOL(km_report);
1822
1823bool km_is_alive(const struct km_event *c)
1824{
1825 struct xfrm_mgr *km;
1826 bool is_alive = false;
1827
1828 rcu_read_lock();
1829 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
1830 if (km->is_alive && km->is_alive(c)) {
1831 is_alive = true;
1832 break;
1833 }
1834 }
1835 rcu_read_unlock();
1836
1837 return is_alive;
1838}
1839EXPORT_SYMBOL(km_is_alive);
1840
1841int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1842{
1843 int err;
1844 u8 *data;
1845 struct xfrm_mgr *km;
1846 struct xfrm_policy *pol = NULL;
1847
1848 if (optlen <= 0 || optlen > PAGE_SIZE)
1849 return -EMSGSIZE;
1850
1851 data = kmalloc(optlen, GFP_KERNEL);
1852 if (!data)
1853 return -ENOMEM;
1854
1855 err = -EFAULT;
1856 if (copy_from_user(data, optval, optlen))
1857 goto out;
1858
1859 err = -EINVAL;
1860 rcu_read_lock();
1861 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
1862 pol = km->compile_policy(sk, optname, data,
1863 optlen, &err);
1864 if (err >= 0)
1865 break;
1866 }
1867 rcu_read_unlock();
1868
1869 if (err >= 0) {
1870 xfrm_sk_policy_insert(sk, err, pol);
1871 xfrm_pol_put(pol);
1872 err = 0;
1873 }
1874
1875out:
1876 kfree(data);
1877 return err;
1878}
1879EXPORT_SYMBOL(xfrm_user_policy);
1880
1881static DEFINE_SPINLOCK(xfrm_km_lock);
1882
1883int xfrm_register_km(struct xfrm_mgr *km)
1884{
1885 spin_lock_bh(&xfrm_km_lock);
1886 list_add_tail_rcu(&km->list, &xfrm_km_list);
1887 spin_unlock_bh(&xfrm_km_lock);
1888 return 0;
1889}
1890EXPORT_SYMBOL(xfrm_register_km);
1891
1892int xfrm_unregister_km(struct xfrm_mgr *km)
1893{
1894 spin_lock_bh(&xfrm_km_lock);
1895 list_del_rcu(&km->list);
1896 spin_unlock_bh(&xfrm_km_lock);
1897 synchronize_rcu();
1898 return 0;
1899}
1900EXPORT_SYMBOL(xfrm_unregister_km);
1901
1902int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1903{
1904 int err = 0;
1905 if (unlikely(afinfo == NULL))
1906 return -EINVAL;
1907 if (unlikely(afinfo->family >= NPROTO))
1908 return -EAFNOSUPPORT;
1909 spin_lock_bh(&xfrm_state_afinfo_lock);
1910 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1911 err = -EEXIST;
1912 else
1913 rcu_assign_pointer(xfrm_state_afinfo[afinfo->family], afinfo);
1914 spin_unlock_bh(&xfrm_state_afinfo_lock);
1915 return err;
1916}
1917EXPORT_SYMBOL(xfrm_state_register_afinfo);
1918
1919int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1920{
1921 int err = 0;
1922 if (unlikely(afinfo == NULL))
1923 return -EINVAL;
1924 if (unlikely(afinfo->family >= NPROTO))
1925 return -EAFNOSUPPORT;
1926 spin_lock_bh(&xfrm_state_afinfo_lock);
1927 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1928 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1929 err = -EINVAL;
1930 else
1931 RCU_INIT_POINTER(xfrm_state_afinfo[afinfo->family], NULL);
1932 }
1933 spin_unlock_bh(&xfrm_state_afinfo_lock);
1934 synchronize_rcu();
1935 return err;
1936}
1937EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1938
1939struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1940{
1941 struct xfrm_state_afinfo *afinfo;
1942 if (unlikely(family >= NPROTO))
1943 return NULL;
1944 rcu_read_lock();
1945 afinfo = rcu_dereference(xfrm_state_afinfo[family]);
1946 if (unlikely(!afinfo))
1947 rcu_read_unlock();
1948 return afinfo;
1949}
1950
1951void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1952{
1953 rcu_read_unlock();
1954}
1955
1956
1957void xfrm_state_delete_tunnel(struct xfrm_state *x)
1958{
1959 if (x->tunnel) {
1960 struct xfrm_state *t = x->tunnel;
1961
1962 if (atomic_read(&t->tunnel_users) == 2)
1963 xfrm_state_delete(t);
1964 atomic_dec(&t->tunnel_users);
1965 xfrm_state_put(t);
1966 x->tunnel = NULL;
1967 }
1968}
1969EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1970
1971int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1972{
1973 int res;
1974
1975 spin_lock_bh(&x->lock);
1976 if (x->km.state == XFRM_STATE_VALID &&
1977 x->type && x->type->get_mtu)
1978 res = x->type->get_mtu(x, mtu);
1979 else
1980 res = mtu - x->props.header_len;
1981 spin_unlock_bh(&x->lock);
1982 return res;
1983}
1984
1985int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
1986{
1987 struct xfrm_state_afinfo *afinfo;
1988 struct xfrm_mode *inner_mode;
1989 int family = x->props.family;
1990 int err;
1991
1992 err = -EAFNOSUPPORT;
1993 afinfo = xfrm_state_get_afinfo(family);
1994 if (!afinfo)
1995 goto error;
1996
1997 err = 0;
1998 if (afinfo->init_flags)
1999 err = afinfo->init_flags(x);
2000
2001 xfrm_state_put_afinfo(afinfo);
2002
2003 if (err)
2004 goto error;
2005
2006 err = -EPROTONOSUPPORT;
2007
2008 if (x->sel.family != AF_UNSPEC) {
2009 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2010 if (inner_mode == NULL)
2011 goto error;
2012
2013 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2014 family != x->sel.family) {
2015 xfrm_put_mode(inner_mode);
2016 goto error;
2017 }
2018
2019 x->inner_mode = inner_mode;
2020 } else {
2021 struct xfrm_mode *inner_mode_iaf;
2022 int iafamily = AF_INET;
2023
2024 inner_mode = xfrm_get_mode(x->props.mode, x->props.family);
2025 if (inner_mode == NULL)
2026 goto error;
2027
2028 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2029 xfrm_put_mode(inner_mode);
2030 goto error;
2031 }
2032 x->inner_mode = inner_mode;
2033
2034 if (x->props.family == AF_INET)
2035 iafamily = AF_INET6;
2036
2037 inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily);
2038 if (inner_mode_iaf) {
2039 if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)
2040 x->inner_mode_iaf = inner_mode_iaf;
2041 else
2042 xfrm_put_mode(inner_mode_iaf);
2043 }
2044 }
2045
2046 x->type = xfrm_get_type(x->id.proto, family);
2047 if (x->type == NULL)
2048 goto error;
2049
2050 err = x->type->init_state(x);
2051 if (err)
2052 goto error;
2053
2054 x->outer_mode = xfrm_get_mode(x->props.mode, family);
2055 if (x->outer_mode == NULL) {
2056 err = -EPROTONOSUPPORT;
2057 goto error;
2058 }
2059
2060 if (init_replay) {
2061 err = xfrm_init_replay(x);
2062 if (err)
2063 goto error;
2064 }
2065
2066 x->km.state = XFRM_STATE_VALID;
2067
2068error:
2069 return err;
2070}
2071
2072EXPORT_SYMBOL(__xfrm_init_state);
2073
2074int xfrm_init_state(struct xfrm_state *x)
2075{
2076 return __xfrm_init_state(x, true);
2077}
2078
2079EXPORT_SYMBOL(xfrm_init_state);
2080
2081int __net_init xfrm_state_init(struct net *net)
2082{
2083 unsigned int sz;
2084
2085 INIT_LIST_HEAD(&net->xfrm.state_all);
2086
2087 sz = sizeof(struct hlist_head) * 8;
2088
2089 net->xfrm.state_bydst = xfrm_hash_alloc(sz);
2090 if (!net->xfrm.state_bydst)
2091 goto out_bydst;
2092 net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
2093 if (!net->xfrm.state_bysrc)
2094 goto out_bysrc;
2095 net->xfrm.state_byspi = xfrm_hash_alloc(sz);
2096 if (!net->xfrm.state_byspi)
2097 goto out_byspi;
2098 net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2099
2100 net->xfrm.state_num = 0;
2101 INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
2102 INIT_HLIST_HEAD(&net->xfrm.state_gc_list);
2103 INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
2104 spin_lock_init(&net->xfrm.xfrm_state_lock);
2105 return 0;
2106
2107out_byspi:
2108 xfrm_hash_free(net->xfrm.state_bysrc, sz);
2109out_bysrc:
2110 xfrm_hash_free(net->xfrm.state_bydst, sz);
2111out_bydst:
2112 return -ENOMEM;
2113}
2114
2115void xfrm_state_fini(struct net *net)
2116{
2117 unsigned int sz;
2118
2119 flush_work(&net->xfrm.state_hash_work);
2120 xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
2121 flush_work(&net->xfrm.state_gc_work);
2122
2123 WARN_ON(!list_empty(&net->xfrm.state_all));
2124
2125 sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
2126 WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2127 xfrm_hash_free(net->xfrm.state_byspi, sz);
2128 WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2129 xfrm_hash_free(net->xfrm.state_bysrc, sz);
2130 WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2131 xfrm_hash_free(net->xfrm.state_bydst, sz);
2132}
2133
2134#ifdef CONFIG_AUDITSYSCALL
2135static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2136 struct audit_buffer *audit_buf)
2137{
2138 struct xfrm_sec_ctx *ctx = x->security;
2139 u32 spi = ntohl(x->id.spi);
2140
2141 if (ctx)
2142 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2143 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2144
2145 switch (x->props.family) {
2146 case AF_INET:
2147 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2148 &x->props.saddr.a4, &x->id.daddr.a4);
2149 break;
2150 case AF_INET6:
2151 audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
2152 x->props.saddr.a6, x->id.daddr.a6);
2153 break;
2154 }
2155
2156 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2157}
2158
2159static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2160 struct audit_buffer *audit_buf)
2161{
2162 const struct iphdr *iph4;
2163 const struct ipv6hdr *iph6;
2164
2165 switch (family) {
2166 case AF_INET:
2167 iph4 = ip_hdr(skb);
2168 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2169 &iph4->saddr, &iph4->daddr);
2170 break;
2171 case AF_INET6:
2172 iph6 = ipv6_hdr(skb);
2173 audit_log_format(audit_buf,
2174 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2175 &iph6->saddr, &iph6->daddr,
2176 iph6->flow_lbl[0] & 0x0f,
2177 iph6->flow_lbl[1],
2178 iph6->flow_lbl[2]);
2179 break;
2180 }
2181}
2182
2183void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid)
2184{
2185 struct audit_buffer *audit_buf;
2186
2187 audit_buf = xfrm_audit_start("SAD-add");
2188 if (audit_buf == NULL)
2189 return;
2190 xfrm_audit_helper_usrinfo(task_valid, audit_buf);
2191 xfrm_audit_helper_sainfo(x, audit_buf);
2192 audit_log_format(audit_buf, " res=%u", result);
2193 audit_log_end(audit_buf);
2194}
2195EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2196
2197void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid)
2198{
2199 struct audit_buffer *audit_buf;
2200
2201 audit_buf = xfrm_audit_start("SAD-delete");
2202 if (audit_buf == NULL)
2203 return;
2204 xfrm_audit_helper_usrinfo(task_valid, audit_buf);
2205 xfrm_audit_helper_sainfo(x, audit_buf);
2206 audit_log_format(audit_buf, " res=%u", result);
2207 audit_log_end(audit_buf);
2208}
2209EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2210
2211void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2212 struct sk_buff *skb)
2213{
2214 struct audit_buffer *audit_buf;
2215 u32 spi;
2216
2217 audit_buf = xfrm_audit_start("SA-replay-overflow");
2218 if (audit_buf == NULL)
2219 return;
2220 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2221
2222
2223 spi = ntohl(x->id.spi);
2224 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2225 audit_log_end(audit_buf);
2226}
2227EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2228
2229void xfrm_audit_state_replay(struct xfrm_state *x,
2230 struct sk_buff *skb, __be32 net_seq)
2231{
2232 struct audit_buffer *audit_buf;
2233 u32 spi;
2234
2235 audit_buf = xfrm_audit_start("SA-replayed-pkt");
2236 if (audit_buf == NULL)
2237 return;
2238 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2239 spi = ntohl(x->id.spi);
2240 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2241 spi, spi, ntohl(net_seq));
2242 audit_log_end(audit_buf);
2243}
2244EXPORT_SYMBOL_GPL(xfrm_audit_state_replay);
2245
2246void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2247{
2248 struct audit_buffer *audit_buf;
2249
2250 audit_buf = xfrm_audit_start("SA-notfound");
2251 if (audit_buf == NULL)
2252 return;
2253 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2254 audit_log_end(audit_buf);
2255}
2256EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2257
2258void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2259 __be32 net_spi, __be32 net_seq)
2260{
2261 struct audit_buffer *audit_buf;
2262 u32 spi;
2263
2264 audit_buf = xfrm_audit_start("SA-notfound");
2265 if (audit_buf == NULL)
2266 return;
2267 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2268 spi = ntohl(net_spi);
2269 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2270 spi, spi, ntohl(net_seq));
2271 audit_log_end(audit_buf);
2272}
2273EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2274
2275void xfrm_audit_state_icvfail(struct xfrm_state *x,
2276 struct sk_buff *skb, u8 proto)
2277{
2278 struct audit_buffer *audit_buf;
2279 __be32 net_spi;
2280 __be32 net_seq;
2281
2282 audit_buf = xfrm_audit_start("SA-icv-failure");
2283 if (audit_buf == NULL)
2284 return;
2285 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2286 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2287 u32 spi = ntohl(net_spi);
2288 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2289 spi, spi, ntohl(net_seq));
2290 }
2291 audit_log_end(audit_buf);
2292}
2293EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2294#endif
2295
