xfrm_state.c 53 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228
  1. /*
  2. * xfrm_state.c
  3. *
  4. * Changes:
  5. * Mitsuru KANDA @USAGI
  6. * Kazunori MIYAZAWA @USAGI
  7. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  8. * IPv6 support
  9. * YOSHIFUJI Hideaki @USAGI
  10. * Split up af-specific functions
  11. * Derek Atkins <derek@ihtfp.com>
  12. * Add UDP Encapsulation
  13. *
  14. */
  15. #include <linux/workqueue.h>
  16. #include <net/xfrm.h>
  17. #include <linux/pfkeyv2.h>
  18. #include <linux/ipsec.h>
  19. #include <linux/module.h>
  20. #include <linux/cache.h>
  21. #include <linux/audit.h>
  22. #include <asm/uaccess.h>
  23. #include <linux/ktime.h>
  24. #include <linux/slab.h>
  25. #include <linux/interrupt.h>
  26. #include <linux/kernel.h>
  27. #include "xfrm_hash.h"
  28. /* Each xfrm_state may be linked to two tables:
  29. 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  30. 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
  31. destination/tunnel endpoint. (output)
  32. */
  33. static DEFINE_SPINLOCK(xfrm_state_lock);
  34. static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
  35. static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
  36. static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  37. static inline unsigned int xfrm_dst_hash(struct net *net,
  38. const xfrm_address_t *daddr,
  39. const xfrm_address_t *saddr,
  40. u32 reqid,
  41. unsigned short family)
  42. {
  43. return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
  44. }
  45. static inline unsigned int xfrm_src_hash(struct net *net,
  46. const xfrm_address_t *daddr,
  47. const xfrm_address_t *saddr,
  48. unsigned short family)
  49. {
  50. return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
  51. }
  52. static inline unsigned int
  53. xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr,
  54. __be32 spi, u8 proto, unsigned short family)
  55. {
  56. return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
  57. }
  58. static void xfrm_hash_transfer(struct hlist_head *list,
  59. struct hlist_head *ndsttable,
  60. struct hlist_head *nsrctable,
  61. struct hlist_head *nspitable,
  62. unsigned int nhashmask)
  63. {
  64. struct hlist_node *entry, *tmp;
  65. struct xfrm_state *x;
  66. hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
  67. unsigned int h;
  68. h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
  69. x->props.reqid, x->props.family,
  70. nhashmask);
  71. hlist_add_head(&x->bydst, ndsttable+h);
  72. h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
  73. x->props.family,
  74. nhashmask);
  75. hlist_add_head(&x->bysrc, nsrctable+h);
  76. if (x->id.spi) {
  77. h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
  78. x->id.proto, x->props.family,
  79. nhashmask);
  80. hlist_add_head(&x->byspi, nspitable+h);
  81. }
  82. }
  83. }
  84. static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
  85. {
  86. return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
  87. }
  88. static DEFINE_MUTEX(hash_resize_mutex);
  89. static void xfrm_hash_resize(struct work_struct *work)
  90. {
  91. struct net *net = container_of(work, struct net, xfrm.state_hash_work);
  92. struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
  93. unsigned long nsize, osize;
  94. unsigned int nhashmask, ohashmask;
  95. int i;
  96. mutex_lock(&hash_resize_mutex);
  97. nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
  98. ndst = xfrm_hash_alloc(nsize);
  99. if (!ndst)
  100. goto out_unlock;
  101. nsrc = xfrm_hash_alloc(nsize);
  102. if (!nsrc) {
  103. xfrm_hash_free(ndst, nsize);
  104. goto out_unlock;
  105. }
  106. nspi = xfrm_hash_alloc(nsize);
  107. if (!nspi) {
  108. xfrm_hash_free(ndst, nsize);
  109. xfrm_hash_free(nsrc, nsize);
  110. goto out_unlock;
  111. }
  112. spin_lock_bh(&xfrm_state_lock);
  113. nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
  114. for (i = net->xfrm.state_hmask; i >= 0; i--)
  115. xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
  116. nhashmask);
  117. odst = net->xfrm.state_bydst;
  118. osrc = net->xfrm.state_bysrc;
  119. ospi = net->xfrm.state_byspi;
  120. ohashmask = net->xfrm.state_hmask;
  121. net->xfrm.state_bydst = ndst;
  122. net->xfrm.state_bysrc = nsrc;
  123. net->xfrm.state_byspi = nspi;
  124. net->xfrm.state_hmask = nhashmask;
  125. spin_unlock_bh(&xfrm_state_lock);
  126. osize = (ohashmask + 1) * sizeof(struct hlist_head);
  127. xfrm_hash_free(odst, osize);
  128. xfrm_hash_free(osrc, osize);
  129. xfrm_hash_free(ospi, osize);
  130. out_unlock:
  131. mutex_unlock(&hash_resize_mutex);
  132. }
  133. static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
  134. static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
  135. static DEFINE_SPINLOCK(xfrm_state_gc_lock);
  136. int __xfrm_state_delete(struct xfrm_state *x);
  137. int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
  138. void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
  139. static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
  140. {
  141. struct xfrm_state_afinfo *afinfo;
  142. if (unlikely(family >= NPROTO))
  143. return NULL;
  144. write_lock_bh(&xfrm_state_afinfo_lock);
  145. afinfo = xfrm_state_afinfo[family];
  146. if (unlikely(!afinfo))
  147. write_unlock_bh(&xfrm_state_afinfo_lock);
  148. return afinfo;
  149. }
  150. static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
  151. __releases(xfrm_state_afinfo_lock)
  152. {
  153. write_unlock_bh(&xfrm_state_afinfo_lock);
  154. }
  155. int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
  156. {
  157. struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
  158. const struct xfrm_type **typemap;
  159. int err = 0;
  160. if (unlikely(afinfo == NULL))
  161. return -EAFNOSUPPORT;
  162. typemap = afinfo->type_map;
  163. if (likely(typemap[type->proto] == NULL))
  164. typemap[type->proto] = type;
  165. else
  166. err = -EEXIST;
  167. xfrm_state_unlock_afinfo(afinfo);
  168. return err;
  169. }
  170. EXPORT_SYMBOL(xfrm_register_type);
  171. int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
  172. {
  173. struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
  174. const struct xfrm_type **typemap;
  175. int err = 0;
  176. if (unlikely(afinfo == NULL))
  177. return -EAFNOSUPPORT;
  178. typemap = afinfo->type_map;
  179. if (unlikely(typemap[type->proto] != type))
  180. err = -ENOENT;
  181. else
  182. typemap[type->proto] = NULL;
  183. xfrm_state_unlock_afinfo(afinfo);
  184. return err;
  185. }
  186. EXPORT_SYMBOL(xfrm_unregister_type);
  187. static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
  188. {
  189. struct xfrm_state_afinfo *afinfo;
  190. const struct xfrm_type **typemap;
  191. const struct xfrm_type *type;
  192. int modload_attempted = 0;
  193. retry:
  194. afinfo = xfrm_state_get_afinfo(family);
  195. if (unlikely(afinfo == NULL))
  196. return NULL;
  197. typemap = afinfo->type_map;
  198. type = typemap[proto];
  199. if (unlikely(type && !try_module_get(type->owner)))
  200. type = NULL;
  201. if (!type && !modload_attempted) {
  202. xfrm_state_put_afinfo(afinfo);
  203. request_module("xfrm-type-%d-%d", family, proto);
  204. modload_attempted = 1;
  205. goto retry;
  206. }
  207. xfrm_state_put_afinfo(afinfo);
  208. return type;
  209. }
  210. static void xfrm_put_type(const struct xfrm_type *type)
  211. {
  212. module_put(type->owner);
  213. }
  214. int xfrm_register_mode(struct xfrm_mode *mode, int family)
  215. {
  216. struct xfrm_state_afinfo *afinfo;
  217. struct xfrm_mode **modemap;
  218. int err;
  219. if (unlikely(mode->encap >= XFRM_MODE_MAX))
  220. return -EINVAL;
  221. afinfo = xfrm_state_lock_afinfo(family);
  222. if (unlikely(afinfo == NULL))
  223. return -EAFNOSUPPORT;
  224. err = -EEXIST;
  225. modemap = afinfo->mode_map;
  226. if (modemap[mode->encap])
  227. goto out;
  228. err = -ENOENT;
  229. if (!try_module_get(afinfo->owner))
  230. goto out;
  231. mode->afinfo = afinfo;
  232. modemap[mode->encap] = mode;
  233. err = 0;
  234. out:
  235. xfrm_state_unlock_afinfo(afinfo);
  236. return err;
  237. }
  238. EXPORT_SYMBOL(xfrm_register_mode);
  239. int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
  240. {
  241. struct xfrm_state_afinfo *afinfo;
  242. struct xfrm_mode **modemap;
  243. int err;
  244. if (unlikely(mode->encap >= XFRM_MODE_MAX))
  245. return -EINVAL;
  246. afinfo = xfrm_state_lock_afinfo(family);
  247. if (unlikely(afinfo == NULL))
  248. return -EAFNOSUPPORT;
  249. err = -ENOENT;
  250. modemap = afinfo->mode_map;
  251. if (likely(modemap[mode->encap] == mode)) {
  252. modemap[mode->encap] = NULL;
  253. module_put(mode->afinfo->owner);
  254. err = 0;
  255. }
  256. xfrm_state_unlock_afinfo(afinfo);
  257. return err;
  258. }
  259. EXPORT_SYMBOL(xfrm_unregister_mode);
  260. static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
  261. {
  262. struct xfrm_state_afinfo *afinfo;
  263. struct xfrm_mode *mode;
  264. int modload_attempted = 0;
  265. if (unlikely(encap >= XFRM_MODE_MAX))
  266. return NULL;
  267. retry:
  268. afinfo = xfrm_state_get_afinfo(family);
  269. if (unlikely(afinfo == NULL))
  270. return NULL;
  271. mode = afinfo->mode_map[encap];
  272. if (unlikely(mode && !try_module_get(mode->owner)))
  273. mode = NULL;
  274. if (!mode && !modload_attempted) {
  275. xfrm_state_put_afinfo(afinfo);
  276. request_module("xfrm-mode-%d-%d", family, encap);
  277. modload_attempted = 1;
  278. goto retry;
  279. }
  280. xfrm_state_put_afinfo(afinfo);
  281. return mode;
  282. }
  283. static void xfrm_put_mode(struct xfrm_mode *mode)
  284. {
  285. module_put(mode->owner);
  286. }
  287. static void xfrm_state_gc_destroy(struct xfrm_state *x)
  288. {
  289. tasklet_hrtimer_cancel(&x->mtimer);
  290. del_timer_sync(&x->rtimer);
  291. kfree(x->aalg);
  292. kfree(x->ealg);
  293. kfree(x->calg);
  294. kfree(x->encap);
  295. kfree(x->coaddr);
  296. kfree(x->replay_esn);
  297. kfree(x->preplay_esn);
  298. if (x->inner_mode)
  299. xfrm_put_mode(x->inner_mode);
  300. if (x->inner_mode_iaf)
  301. xfrm_put_mode(x->inner_mode_iaf);
  302. if (x->outer_mode)
  303. xfrm_put_mode(x->outer_mode);
  304. if (x->type) {
  305. x->type->destructor(x);
  306. xfrm_put_type(x->type);
  307. }
  308. security_xfrm_state_free(x);
  309. kfree(x);
  310. }
  311. static void xfrm_state_gc_task(struct work_struct *work)
  312. {
  313. struct net *net = container_of(work, struct net, xfrm.state_gc_work);
  314. struct xfrm_state *x;
  315. struct hlist_node *entry, *tmp;
  316. struct hlist_head gc_list;
  317. spin_lock_bh(&xfrm_state_gc_lock);
  318. hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
  319. spin_unlock_bh(&xfrm_state_gc_lock);
  320. hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
  321. xfrm_state_gc_destroy(x);
  322. wake_up(&net->xfrm.km_waitq);
  323. }
  324. static inline unsigned long make_jiffies(long secs)
  325. {
  326. if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
  327. return MAX_SCHEDULE_TIMEOUT-1;
  328. else
  329. return secs*HZ;
  330. }
  331. static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
  332. {
  333. struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer);
  334. struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer);
  335. struct net *net = xs_net(x);
  336. unsigned long now = get_seconds();
  337. long next = LONG_MAX;
  338. int warn = 0;
  339. int err = 0;
  340. spin_lock(&x->lock);
  341. if (x->km.state == XFRM_STATE_DEAD)
  342. goto out;
  343. if (x->km.state == XFRM_STATE_EXPIRED)
  344. goto expired;
  345. if (x->lft.hard_add_expires_seconds) {
  346. long tmo = x->lft.hard_add_expires_seconds +
  347. x->curlft.add_time - now;
  348. if (tmo <= 0)
  349. goto expired;
  350. if (tmo < next)
  351. next = tmo;
  352. }
  353. if (x->lft.hard_use_expires_seconds) {
  354. long tmo = x->lft.hard_use_expires_seconds +
  355. (x->curlft.use_time ? : now) - now;
  356. if (tmo <= 0)
  357. goto expired;
  358. if (tmo < next)
  359. next = tmo;
  360. }
  361. if (x->km.dying)
  362. goto resched;
  363. if (x->lft.soft_add_expires_seconds) {
  364. long tmo = x->lft.soft_add_expires_seconds +
  365. x->curlft.add_time - now;
  366. if (tmo <= 0)
  367. warn = 1;
  368. else if (tmo < next)
  369. next = tmo;
  370. }
  371. if (x->lft.soft_use_expires_seconds) {
  372. long tmo = x->lft.soft_use_expires_seconds +
  373. (x->curlft.use_time ? : now) - now;
  374. if (tmo <= 0)
  375. warn = 1;
  376. else if (tmo < next)
  377. next = tmo;
  378. }
  379. x->km.dying = warn;
  380. if (warn)
  381. km_state_expired(x, 0, 0);
  382. resched:
  383. if (next != LONG_MAX){
  384. tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL);
  385. }
  386. goto out;
  387. expired:
  388. if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
  389. x->km.state = XFRM_STATE_EXPIRED;
  390. wake_up(&net->xfrm.km_waitq);
  391. next = 2;
  392. goto resched;
  393. }
  394. err = __xfrm_state_delete(x);
  395. if (!err && x->id.spi)
  396. km_state_expired(x, 1, 0);
  397. xfrm_audit_state_delete(x, err ? 0 : 1,
  398. audit_get_loginuid(current),
  399. audit_get_sessionid(current), 0);
  400. out:
  401. spin_unlock(&x->lock);
  402. return HRTIMER_NORESTART;
  403. }
  404. static void xfrm_replay_timer_handler(unsigned long data);
  405. struct xfrm_state *xfrm_state_alloc(struct net *net)
  406. {
  407. struct xfrm_state *x;
  408. x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
  409. if (x) {
  410. write_pnet(&x->xs_net, net);
  411. atomic_set(&x->refcnt, 1);
  412. atomic_set(&x->tunnel_users, 0);
  413. INIT_LIST_HEAD(&x->km.all);
  414. INIT_HLIST_NODE(&x->bydst);
  415. INIT_HLIST_NODE(&x->bysrc);
  416. INIT_HLIST_NODE(&x->byspi);
  417. tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, CLOCK_REALTIME, HRTIMER_MODE_ABS);
  418. setup_timer(&x->rtimer, xfrm_replay_timer_handler,
  419. (unsigned long)x);
  420. x->curlft.add_time = get_seconds();
  421. x->lft.soft_byte_limit = XFRM_INF;
  422. x->lft.soft_packet_limit = XFRM_INF;
  423. x->lft.hard_byte_limit = XFRM_INF;
  424. x->lft.hard_packet_limit = XFRM_INF;
  425. x->replay_maxage = 0;
  426. x->replay_maxdiff = 0;
  427. x->inner_mode = NULL;
  428. x->inner_mode_iaf = NULL;
  429. spin_lock_init(&x->lock);
  430. }
  431. return x;
  432. }
  433. EXPORT_SYMBOL(xfrm_state_alloc);
  434. void __xfrm_state_destroy(struct xfrm_state *x)
  435. {
  436. struct net *net = xs_net(x);
  437. WARN_ON(x->km.state != XFRM_STATE_DEAD);
  438. spin_lock_bh(&xfrm_state_gc_lock);
  439. hlist_add_head(&x->gclist, &net->xfrm.state_gc_list);
  440. spin_unlock_bh(&xfrm_state_gc_lock);
  441. schedule_work(&net->xfrm.state_gc_work);
  442. }
  443. EXPORT_SYMBOL(__xfrm_state_destroy);
  444. int __xfrm_state_delete(struct xfrm_state *x)
  445. {
  446. struct net *net = xs_net(x);
  447. int err = -ESRCH;
  448. if (x->km.state != XFRM_STATE_DEAD) {
  449. x->km.state = XFRM_STATE_DEAD;
  450. spin_lock(&xfrm_state_lock);
  451. list_del(&x->km.all);
  452. hlist_del(&x->bydst);
  453. hlist_del(&x->bysrc);
  454. if (x->id.spi)
  455. hlist_del(&x->byspi);
  456. net->xfrm.state_num--;
  457. spin_unlock(&xfrm_state_lock);
  458. /* All xfrm_state objects are created by xfrm_state_alloc.
  459. * The xfrm_state_alloc call gives a reference, and that
  460. * is what we are dropping here.
  461. */
  462. xfrm_state_put(x);
  463. err = 0;
  464. }
  465. return err;
  466. }
  467. EXPORT_SYMBOL(__xfrm_state_delete);
  468. int xfrm_state_delete(struct xfrm_state *x)
  469. {
  470. int err;
  471. spin_lock_bh(&x->lock);
  472. err = __xfrm_state_delete(x);
  473. spin_unlock_bh(&x->lock);
  474. return err;
  475. }
  476. EXPORT_SYMBOL(xfrm_state_delete);
  477. #ifdef CONFIG_SECURITY_NETWORK_XFRM
  478. static inline int
  479. xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
  480. {
  481. int i, err = 0;
  482. for (i = 0; i <= net->xfrm.state_hmask; i++) {
  483. struct hlist_node *entry;
  484. struct xfrm_state *x;
  485. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
  486. if (xfrm_id_proto_match(x->id.proto, proto) &&
  487. (err = security_xfrm_state_delete(x)) != 0) {
  488. xfrm_audit_state_delete(x, 0,
  489. audit_info->loginuid,
  490. audit_info->sessionid,
  491. audit_info->secid);
  492. return err;
  493. }
  494. }
  495. }
  496. return err;
  497. }
  498. #else
  499. static inline int
  500. xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
  501. {
  502. return 0;
  503. }
  504. #endif
  505. int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
  506. {
  507. int i, err = 0, cnt = 0;
  508. spin_lock_bh(&xfrm_state_lock);
  509. err = xfrm_state_flush_secctx_check(net, proto, audit_info);
  510. if (err)
  511. goto out;
  512. err = -ESRCH;
  513. for (i = 0; i <= net->xfrm.state_hmask; i++) {
  514. struct hlist_node *entry;
  515. struct xfrm_state *x;
  516. restart:
  517. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
  518. if (!xfrm_state_kern(x) &&
  519. xfrm_id_proto_match(x->id.proto, proto)) {
  520. xfrm_state_hold(x);
  521. spin_unlock_bh(&xfrm_state_lock);
  522. err = xfrm_state_delete(x);
  523. xfrm_audit_state_delete(x, err ? 0 : 1,
  524. audit_info->loginuid,
  525. audit_info->sessionid,
  526. audit_info->secid);
  527. xfrm_state_put(x);
  528. if (!err)
  529. cnt++;
  530. spin_lock_bh(&xfrm_state_lock);
  531. goto restart;
  532. }
  533. }
  534. }
  535. if (cnt)
  536. err = 0;
  537. out:
  538. spin_unlock_bh(&xfrm_state_lock);
  539. wake_up(&net->xfrm.km_waitq);
  540. return err;
  541. }
  542. EXPORT_SYMBOL(xfrm_state_flush);
  543. void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
  544. {
  545. spin_lock_bh(&xfrm_state_lock);
  546. si->sadcnt = net->xfrm.state_num;
  547. si->sadhcnt = net->xfrm.state_hmask;
  548. si->sadhmcnt = xfrm_state_hashmax;
  549. spin_unlock_bh(&xfrm_state_lock);
  550. }
  551. EXPORT_SYMBOL(xfrm_sad_getinfo);
  552. static int
  553. xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl,
  554. const struct xfrm_tmpl *tmpl,
  555. const xfrm_address_t *daddr, const xfrm_address_t *saddr,
  556. unsigned short family)
  557. {
  558. struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
  559. if (!afinfo)
  560. return -1;
  561. afinfo->init_tempsel(&x->sel, fl);
  562. if (family != tmpl->encap_family) {
  563. xfrm_state_put_afinfo(afinfo);
  564. afinfo = xfrm_state_get_afinfo(tmpl->encap_family);
  565. if (!afinfo)
  566. return -1;
  567. }
  568. afinfo->init_temprop(x, tmpl, daddr, saddr);
  569. xfrm_state_put_afinfo(afinfo);
  570. return 0;
  571. }
  572. static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
  573. const xfrm_address_t *daddr,
  574. __be32 spi, u8 proto,
  575. unsigned short family)
  576. {
  577. unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
  578. struct xfrm_state *x;
  579. struct hlist_node *entry;
  580. hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
  581. if (x->props.family != family ||
  582. x->id.spi != spi ||
  583. x->id.proto != proto ||
  584. xfrm_addr_cmp(&x->id.daddr, daddr, family))
  585. continue;
  586. if ((mark & x->mark.m) != x->mark.v)
  587. continue;
  588. xfrm_state_hold(x);
  589. return x;
  590. }
  591. return NULL;
  592. }
  593. static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
  594. const xfrm_address_t *daddr,
  595. const xfrm_address_t *saddr,
  596. u8 proto, unsigned short family)
  597. {
  598. unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
  599. struct xfrm_state *x;
  600. struct hlist_node *entry;
  601. hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
  602. if (x->props.family != family ||
  603. x->id.proto != proto ||
  604. xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
  605. xfrm_addr_cmp(&x->props.saddr, saddr, family))
  606. continue;
  607. if ((mark & x->mark.m) != x->mark.v)
  608. continue;
  609. xfrm_state_hold(x);
  610. return x;
  611. }
  612. return NULL;
  613. }
  614. static inline struct xfrm_state *
  615. __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
  616. {
  617. struct net *net = xs_net(x);
  618. u32 mark = x->mark.v & x->mark.m;
  619. if (use_spi)
  620. return __xfrm_state_lookup(net, mark, &x->id.daddr,
  621. x->id.spi, x->id.proto, family);
  622. else
  623. return __xfrm_state_lookup_byaddr(net, mark,
  624. &x->id.daddr,
  625. &x->props.saddr,
  626. x->id.proto, family);
  627. }
  628. static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
  629. {
  630. if (have_hash_collision &&
  631. (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
  632. net->xfrm.state_num > net->xfrm.state_hmask)
  633. schedule_work(&net->xfrm.state_hash_work);
  634. }
  635. static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
  636. const struct flowi *fl, unsigned short family,
  637. struct xfrm_state **best, int *acq_in_progress,
  638. int *error)
  639. {
  640. /* Resolution logic:
  641. * 1. There is a valid state with matching selector. Done.
  642. * 2. Valid state with inappropriate selector. Skip.
  643. *
  644. * Entering area of "sysdeps".
  645. *
  646. * 3. If state is not valid, selector is temporary, it selects
  647. * only session which triggered previous resolution. Key
  648. * manager will do something to install a state with proper
  649. * selector.
  650. */
  651. if (x->km.state == XFRM_STATE_VALID) {
  652. if ((x->sel.family &&
  653. !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
  654. !security_xfrm_state_pol_flow_match(x, pol, fl))
  655. return;
  656. if (!*best ||
  657. (*best)->km.dying > x->km.dying ||
  658. ((*best)->km.dying == x->km.dying &&
  659. (*best)->curlft.add_time < x->curlft.add_time))
  660. *best = x;
  661. } else if (x->km.state == XFRM_STATE_ACQ) {
  662. *acq_in_progress = 1;
  663. } else if (x->km.state == XFRM_STATE_ERROR ||
  664. x->km.state == XFRM_STATE_EXPIRED) {
  665. if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
  666. security_xfrm_state_pol_flow_match(x, pol, fl))
  667. *error = -ESRCH;
  668. }
  669. }
  670. struct xfrm_state *
  671. xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
  672. const struct flowi *fl, struct xfrm_tmpl *tmpl,
  673. struct xfrm_policy *pol, int *err,
  674. unsigned short family)
  675. {
  676. static xfrm_address_t saddr_wildcard = { };
  677. struct net *net = xp_net(pol);
  678. unsigned int h, h_wildcard;
  679. struct hlist_node *entry;
  680. struct xfrm_state *x, *x0, *to_put;
  681. int acquire_in_progress = 0;
  682. int error = 0;
  683. struct xfrm_state *best = NULL;
  684. u32 mark = pol->mark.v & pol->mark.m;
  685. unsigned short encap_family = tmpl->encap_family;
  686. to_put = NULL;
  687. spin_lock_bh(&xfrm_state_lock);
  688. h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
  689. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
  690. if (x->props.family == encap_family &&
  691. x->props.reqid == tmpl->reqid &&
  692. (mark & x->mark.m) == x->mark.v &&
  693. !(x->props.flags & XFRM_STATE_WILDRECV) &&
  694. xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
  695. tmpl->mode == x->props.mode &&
  696. tmpl->id.proto == x->id.proto &&
  697. (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
  698. xfrm_state_look_at(pol, x, fl, encap_family,
  699. &best, &acquire_in_progress, &error);
  700. }
  701. if (best)
  702. goto found;
  703. h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
  704. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
  705. if (x->props.family == encap_family &&
  706. x->props.reqid == tmpl->reqid &&
  707. (mark & x->mark.m) == x->mark.v &&
  708. !(x->props.flags & XFRM_STATE_WILDRECV) &&
  709. xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
  710. tmpl->mode == x->props.mode &&
  711. tmpl->id.proto == x->id.proto &&
  712. (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
  713. xfrm_state_look_at(pol, x, fl, encap_family,
  714. &best, &acquire_in_progress, &error);
  715. }
  716. found:
  717. x = best;
  718. if (!x && !error && !acquire_in_progress) {
  719. if (tmpl->id.spi &&
  720. (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
  721. tmpl->id.proto, encap_family)) != NULL) {
  722. to_put = x0;
  723. error = -EEXIST;
  724. goto out;
  725. }
  726. x = xfrm_state_alloc(net);
  727. if (x == NULL) {
  728. error = -ENOMEM;
  729. goto out;
  730. }
  731. /* Initialize temporary state matching only
  732. * to current session. */
  733. xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
  734. memcpy(&x->mark, &pol->mark, sizeof(x->mark));
  735. error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid);
  736. if (error) {
  737. x->km.state = XFRM_STATE_DEAD;
  738. to_put = x;
  739. x = NULL;
  740. goto out;
  741. }
  742. if (km_query(x, tmpl, pol) == 0) {
  743. x->km.state = XFRM_STATE_ACQ;
  744. list_add(&x->km.all, &net->xfrm.state_all);
  745. hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
  746. h = xfrm_src_hash(net, daddr, saddr, encap_family);
  747. hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
  748. if (x->id.spi) {
  749. h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
  750. hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
  751. }
  752. x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
  753. tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
  754. net->xfrm.state_num++;
  755. xfrm_hash_grow_check(net, x->bydst.next != NULL);
  756. } else {
  757. x->km.state = XFRM_STATE_DEAD;
  758. to_put = x;
  759. x = NULL;
  760. error = -ESRCH;
  761. }
  762. }
  763. out:
  764. if (x)
  765. xfrm_state_hold(x);
  766. else
  767. *err = acquire_in_progress ? -EAGAIN : error;
  768. spin_unlock_bh(&xfrm_state_lock);
  769. if (to_put)
  770. xfrm_state_put(to_put);
  771. return x;
  772. }
  773. struct xfrm_state *
  774. xfrm_stateonly_find(struct net *net, u32 mark,
  775. xfrm_address_t *daddr, xfrm_address_t *saddr,
  776. unsigned short family, u8 mode, u8 proto, u32 reqid)
  777. {
  778. unsigned int h;
  779. struct xfrm_state *rx = NULL, *x = NULL;
  780. struct hlist_node *entry;
  781. spin_lock(&xfrm_state_lock);
  782. h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
  783. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
  784. if (x->props.family == family &&
  785. x->props.reqid == reqid &&
  786. (mark & x->mark.m) == x->mark.v &&
  787. !(x->props.flags & XFRM_STATE_WILDRECV) &&
  788. xfrm_state_addr_check(x, daddr, saddr, family) &&
  789. mode == x->props.mode &&
  790. proto == x->id.proto &&
  791. x->km.state == XFRM_STATE_VALID) {
  792. rx = x;
  793. break;
  794. }
  795. }
  796. if (rx)
  797. xfrm_state_hold(rx);
  798. spin_unlock(&xfrm_state_lock);
  799. return rx;
  800. }
  801. EXPORT_SYMBOL(xfrm_stateonly_find);
  802. static void __xfrm_state_insert(struct xfrm_state *x)
  803. {
  804. struct net *net = xs_net(x);
  805. unsigned int h;
  806. list_add(&x->km.all, &net->xfrm.state_all);
  807. h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
  808. x->props.reqid, x->props.family);
  809. hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
  810. h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
  811. hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
  812. if (x->id.spi) {
  813. h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
  814. x->props.family);
  815. hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
  816. }
  817. tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
  818. if (x->replay_maxage)
  819. mod_timer(&x->rtimer, jiffies + x->replay_maxage);
  820. wake_up(&net->xfrm.km_waitq);
  821. net->xfrm.state_num++;
  822. xfrm_hash_grow_check(net, x->bydst.next != NULL);
  823. }
  824. /* xfrm_state_lock is held */
  825. static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
  826. {
  827. struct net *net = xs_net(xnew);
  828. unsigned short family = xnew->props.family;
  829. u32 reqid = xnew->props.reqid;
  830. struct xfrm_state *x;
  831. struct hlist_node *entry;
  832. unsigned int h;
  833. u32 mark = xnew->mark.v & xnew->mark.m;
  834. h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
  835. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
  836. if (x->props.family == family &&
  837. x->props.reqid == reqid &&
  838. (mark & x->mark.m) == x->mark.v &&
  839. !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
  840. !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
  841. x->genid++;
  842. }
  843. }
  844. void xfrm_state_insert(struct xfrm_state *x)
  845. {
  846. spin_lock_bh(&xfrm_state_lock);
  847. __xfrm_state_bump_genids(x);
  848. __xfrm_state_insert(x);
  849. spin_unlock_bh(&xfrm_state_lock);
  850. }
  851. EXPORT_SYMBOL(xfrm_state_insert);
  852. /* xfrm_state_lock is held */
  853. static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
  854. unsigned short family, u8 mode,
  855. u32 reqid, u8 proto,
  856. const xfrm_address_t *daddr,
  857. const xfrm_address_t *saddr, int create)
  858. {
  859. unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
  860. struct hlist_node *entry;
  861. struct xfrm_state *x;
  862. u32 mark = m->v & m->m;
  863. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
  864. if (x->props.reqid != reqid ||
  865. x->props.mode != mode ||
  866. x->props.family != family ||
  867. x->km.state != XFRM_STATE_ACQ ||
  868. x->id.spi != 0 ||
  869. x->id.proto != proto ||
  870. (mark & x->mark.m) != x->mark.v ||
  871. xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
  872. xfrm_addr_cmp(&x->props.saddr, saddr, family))
  873. continue;
  874. xfrm_state_hold(x);
  875. return x;
  876. }
  877. if (!create)
  878. return NULL;
  879. x = xfrm_state_alloc(net);
  880. if (likely(x)) {
  881. switch (family) {
  882. case AF_INET:
  883. x->sel.daddr.a4 = daddr->a4;
  884. x->sel.saddr.a4 = saddr->a4;
  885. x->sel.prefixlen_d = 32;
  886. x->sel.prefixlen_s = 32;
  887. x->props.saddr.a4 = saddr->a4;
  888. x->id.daddr.a4 = daddr->a4;
  889. break;
  890. case AF_INET6:
  891. *(struct in6_addr *)x->sel.daddr.a6 = *(struct in6_addr *)daddr;
  892. *(struct in6_addr *)x->sel.saddr.a6 = *(struct in6_addr *)saddr;
  893. x->sel.prefixlen_d = 128;
  894. x->sel.prefixlen_s = 128;
  895. *(struct in6_addr *)x->props.saddr.a6 = *(struct in6_addr *)saddr;
  896. *(struct in6_addr *)x->id.daddr.a6 = *(struct in6_addr *)daddr;
  897. break;
  898. }
  899. x->km.state = XFRM_STATE_ACQ;
  900. x->id.proto = proto;
  901. x->props.family = family;
  902. x->props.mode = mode;
  903. x->props.reqid = reqid;
  904. x->mark.v = m->v;
  905. x->mark.m = m->m;
  906. x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
  907. xfrm_state_hold(x);
  908. tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
  909. list_add(&x->km.all, &net->xfrm.state_all);
  910. hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
  911. h = xfrm_src_hash(net, daddr, saddr, family);
  912. hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
  913. net->xfrm.state_num++;
  914. xfrm_hash_grow_check(net, x->bydst.next != NULL);
  915. }
  916. return x;
  917. }
  918. static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
  919. int xfrm_state_add(struct xfrm_state *x)
  920. {
  921. struct net *net = xs_net(x);
  922. struct xfrm_state *x1, *to_put;
  923. int family;
  924. int err;
  925. u32 mark = x->mark.v & x->mark.m;
  926. int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
  927. family = x->props.family;
  928. to_put = NULL;
  929. spin_lock_bh(&xfrm_state_lock);
  930. x1 = __xfrm_state_locate(x, use_spi, family);
  931. if (x1) {
  932. to_put = x1;
  933. x1 = NULL;
  934. err = -EEXIST;
  935. goto out;
  936. }
  937. if (use_spi && x->km.seq) {
  938. x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq);
  939. if (x1 && ((x1->id.proto != x->id.proto) ||
  940. xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
  941. to_put = x1;
  942. x1 = NULL;
  943. }
  944. }
  945. if (use_spi && !x1)
  946. x1 = __find_acq_core(net, &x->mark, family, x->props.mode,
  947. x->props.reqid, x->id.proto,
  948. &x->id.daddr, &x->props.saddr, 0);
  949. __xfrm_state_bump_genids(x);
  950. __xfrm_state_insert(x);
  951. err = 0;
  952. out:
  953. spin_unlock_bh(&xfrm_state_lock);
  954. if (x1) {
  955. xfrm_state_delete(x1);
  956. xfrm_state_put(x1);
  957. }
  958. if (to_put)
  959. xfrm_state_put(to_put);
  960. return err;
  961. }
  962. EXPORT_SYMBOL(xfrm_state_add);
  963. #ifdef CONFIG_XFRM_MIGRATE
  964. static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
  965. {
  966. struct net *net = xs_net(orig);
  967. int err = -ENOMEM;
  968. struct xfrm_state *x = xfrm_state_alloc(net);
  969. if (!x)
  970. goto out;
  971. memcpy(&x->id, &orig->id, sizeof(x->id));
  972. memcpy(&x->sel, &orig->sel, sizeof(x->sel));
  973. memcpy(&x->lft, &orig->lft, sizeof(x->lft));
  974. x->props.mode = orig->props.mode;
  975. x->props.replay_window = orig->props.replay_window;
  976. x->props.reqid = orig->props.reqid;
  977. x->props.family = orig->props.family;
  978. x->props.saddr = orig->props.saddr;
  979. if (orig->aalg) {
  980. x->aalg = xfrm_algo_auth_clone(orig->aalg);
  981. if (!x->aalg)
  982. goto error;
  983. }
  984. x->props.aalgo = orig->props.aalgo;
  985. if (orig->ealg) {
  986. x->ealg = xfrm_algo_clone(orig->ealg);
  987. if (!x->ealg)
  988. goto error;
  989. }
  990. x->props.ealgo = orig->props.ealgo;
  991. if (orig->calg) {
  992. x->calg = xfrm_algo_clone(orig->calg);
  993. if (!x->calg)
  994. goto error;
  995. }
  996. x->props.calgo = orig->props.calgo;
  997. if (orig->encap) {
  998. x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
  999. if (!x->encap)
  1000. goto error;
  1001. }
  1002. if (orig->coaddr) {
  1003. x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
  1004. GFP_KERNEL);
  1005. if (!x->coaddr)
  1006. goto error;
  1007. }
  1008. if (orig->replay_esn) {
  1009. err = xfrm_replay_clone(x, orig);
  1010. if (err)
  1011. goto error;
  1012. }
  1013. memcpy(&x->mark, &orig->mark, sizeof(x->mark));
  1014. err = xfrm_init_state(x);
  1015. if (err)
  1016. goto error;
  1017. x->props.flags = orig->props.flags;
  1018. x->curlft.add_time = orig->curlft.add_time;
  1019. x->km.state = orig->km.state;
  1020. x->km.seq = orig->km.seq;
  1021. return x;
  1022. error:
  1023. xfrm_state_put(x);
  1024. out:
  1025. if (errp)
  1026. *errp = err;
  1027. return NULL;
  1028. }
  1029. /* xfrm_state_lock is held */
  1030. struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
  1031. {
  1032. unsigned int h;
  1033. struct xfrm_state *x;
  1034. struct hlist_node *entry;
  1035. if (m->reqid) {
  1036. h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr,
  1037. m->reqid, m->old_family);
  1038. hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
  1039. if (x->props.mode != m->mode ||
  1040. x->id.proto != m->proto)
  1041. continue;
  1042. if (m->reqid && x->props.reqid != m->reqid)
  1043. continue;
  1044. if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
  1045. m->old_family) ||
  1046. xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
  1047. m->old_family))
  1048. continue;
  1049. xfrm_state_hold(x);
  1050. return x;
  1051. }
  1052. } else {
  1053. h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr,
  1054. m->old_family);
  1055. hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
  1056. if (x->props.mode != m->mode ||
  1057. x->id.proto != m->proto)
  1058. continue;
  1059. if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
  1060. m->old_family) ||
  1061. xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
  1062. m->old_family))
  1063. continue;
  1064. xfrm_state_hold(x);
  1065. return x;
  1066. }
  1067. }
  1068. return NULL;
  1069. }
  1070. EXPORT_SYMBOL(xfrm_migrate_state_find);
  1071. struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
  1072. struct xfrm_migrate *m)
  1073. {
  1074. struct xfrm_state *xc;
  1075. int err;
  1076. xc = xfrm_state_clone(x, &err);
  1077. if (!xc)
  1078. return NULL;
  1079. memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
  1080. memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
  1081. /* add state */
  1082. if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
  1083. /* a care is needed when the destination address of the
  1084. state is to be updated as it is a part of triplet */
  1085. xfrm_state_insert(xc);
  1086. } else {
  1087. if ((err = xfrm_state_add(xc)) < 0)
  1088. goto error;
  1089. }
  1090. return xc;
  1091. error:
  1092. xfrm_state_put(xc);
  1093. return NULL;
  1094. }
  1095. EXPORT_SYMBOL(xfrm_state_migrate);
  1096. #endif
  1097. int xfrm_state_update(struct xfrm_state *x)
  1098. {
  1099. struct xfrm_state *x1, *to_put;
  1100. int err;
  1101. int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
  1102. to_put = NULL;
  1103. spin_lock_bh(&xfrm_state_lock);
  1104. x1 = __xfrm_state_locate(x, use_spi, x->props.family);
  1105. err = -ESRCH;
  1106. if (!x1)
  1107. goto out;
  1108. if (xfrm_state_kern(x1)) {
  1109. to_put = x1;
  1110. err = -EEXIST;
  1111. goto out;
  1112. }
  1113. if (x1->km.state == XFRM_STATE_ACQ) {
  1114. __xfrm_state_insert(x);
  1115. x = NULL;
  1116. }
  1117. err = 0;
  1118. out:
  1119. spin_unlock_bh(&xfrm_state_lock);
  1120. if (to_put)
  1121. xfrm_state_put(to_put);
  1122. if (err)
  1123. return err;
  1124. if (!x) {
  1125. xfrm_state_delete(x1);
  1126. xfrm_state_put(x1);
  1127. return 0;
  1128. }
  1129. err = -EINVAL;
  1130. spin_lock_bh(&x1->lock);
  1131. if (likely(x1->km.state == XFRM_STATE_VALID)) {
  1132. if (x->encap && x1->encap)
  1133. memcpy(x1->encap, x->encap, sizeof(*x1->encap));
  1134. if (x->coaddr && x1->coaddr) {
  1135. memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
  1136. }
  1137. if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
  1138. memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
  1139. memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
  1140. x1->km.dying = 0;
  1141. tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
  1142. if (x1->curlft.use_time)
  1143. xfrm_state_check_expire(x1);
  1144. err = 0;
  1145. x->km.state = XFRM_STATE_DEAD;
  1146. __xfrm_state_put(x);
  1147. }
  1148. spin_unlock_bh(&x1->lock);
  1149. xfrm_state_put(x1);
  1150. return err;
  1151. }
  1152. EXPORT_SYMBOL(xfrm_state_update);
  1153. int xfrm_state_check_expire(struct xfrm_state *x)
  1154. {
  1155. if (!x->curlft.use_time)
  1156. x->curlft.use_time = get_seconds();
  1157. if (x->km.state != XFRM_STATE_VALID)
  1158. return -EINVAL;
  1159. if (x->curlft.bytes >= x->lft.hard_byte_limit ||
  1160. x->curlft.packets >= x->lft.hard_packet_limit) {
  1161. x->km.state = XFRM_STATE_EXPIRED;
  1162. tasklet_hrtimer_start(&x->mtimer, ktime_set(0,0), HRTIMER_MODE_REL);
  1163. return -EINVAL;
  1164. }
  1165. if (!x->km.dying &&
  1166. (x->curlft.bytes >= x->lft.soft_byte_limit ||
  1167. x->curlft.packets >= x->lft.soft_packet_limit)) {
  1168. x->km.dying = 1;
  1169. km_state_expired(x, 0, 0);
  1170. }
  1171. return 0;
  1172. }
  1173. EXPORT_SYMBOL(xfrm_state_check_expire);
  1174. struct xfrm_state *
  1175. xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi,
  1176. u8 proto, unsigned short family)
  1177. {
  1178. struct xfrm_state *x;
  1179. spin_lock_bh(&xfrm_state_lock);
  1180. x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
  1181. spin_unlock_bh(&xfrm_state_lock);
  1182. return x;
  1183. }
  1184. EXPORT_SYMBOL(xfrm_state_lookup);
  1185. struct xfrm_state *
  1186. xfrm_state_lookup_byaddr(struct net *net, u32 mark,
  1187. const xfrm_address_t *daddr, const xfrm_address_t *saddr,
  1188. u8 proto, unsigned short family)
  1189. {
  1190. struct xfrm_state *x;
  1191. spin_lock_bh(&xfrm_state_lock);
  1192. x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
  1193. spin_unlock_bh(&xfrm_state_lock);
  1194. return x;
  1195. }
  1196. EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
  1197. struct xfrm_state *
  1198. xfrm_find_acq(struct net *net, struct xfrm_mark *mark, u8 mode, u32 reqid, u8 proto,
  1199. const xfrm_address_t *daddr, const xfrm_address_t *saddr,
  1200. int create, unsigned short family)
  1201. {
  1202. struct xfrm_state *x;
  1203. spin_lock_bh(&xfrm_state_lock);
  1204. x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create);
  1205. spin_unlock_bh(&xfrm_state_lock);
  1206. return x;
  1207. }
  1208. EXPORT_SYMBOL(xfrm_find_acq);
  1209. #ifdef CONFIG_XFRM_SUB_POLICY
  1210. int
  1211. xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
  1212. unsigned short family)
  1213. {
  1214. int err = 0;
  1215. struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
  1216. if (!afinfo)
  1217. return -EAFNOSUPPORT;
  1218. spin_lock_bh(&xfrm_state_lock);
  1219. if (afinfo->tmpl_sort)
  1220. err = afinfo->tmpl_sort(dst, src, n);
  1221. spin_unlock_bh(&xfrm_state_lock);
  1222. xfrm_state_put_afinfo(afinfo);
  1223. return err;
  1224. }
  1225. EXPORT_SYMBOL(xfrm_tmpl_sort);
  1226. int
  1227. xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
  1228. unsigned short family)
  1229. {
  1230. int err = 0;
  1231. struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
  1232. if (!afinfo)
  1233. return -EAFNOSUPPORT;
  1234. spin_lock_bh(&xfrm_state_lock);
  1235. if (afinfo->state_sort)
  1236. err = afinfo->state_sort(dst, src, n);
  1237. spin_unlock_bh(&xfrm_state_lock);
  1238. xfrm_state_put_afinfo(afinfo);
  1239. return err;
  1240. }
  1241. EXPORT_SYMBOL(xfrm_state_sort);
  1242. #endif
  1243. /* Silly enough, but I'm lazy to build resolution list */
  1244. static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
  1245. {
  1246. int i;
  1247. for (i = 0; i <= net->xfrm.state_hmask; i++) {
  1248. struct hlist_node *entry;
  1249. struct xfrm_state *x;
  1250. hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
  1251. if (x->km.seq == seq &&
  1252. (mark & x->mark.m) == x->mark.v &&
  1253. x->km.state == XFRM_STATE_ACQ) {
  1254. xfrm_state_hold(x);
  1255. return x;
  1256. }
  1257. }
  1258. }
  1259. return NULL;
  1260. }
  1261. struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
  1262. {
  1263. struct xfrm_state *x;
  1264. spin_lock_bh(&xfrm_state_lock);
  1265. x = __xfrm_find_acq_byseq(net, mark, seq);
  1266. spin_unlock_bh(&xfrm_state_lock);
  1267. return x;
  1268. }
  1269. EXPORT_SYMBOL(xfrm_find_acq_byseq);
  1270. u32 xfrm_get_acqseq(void)
  1271. {
  1272. u32 res;
  1273. static atomic_t acqseq;
  1274. do {
  1275. res = atomic_inc_return(&acqseq);
  1276. } while (!res);
  1277. return res;
  1278. }
  1279. EXPORT_SYMBOL(xfrm_get_acqseq);
  1280. int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
  1281. {
  1282. struct net *net = xs_net(x);
  1283. unsigned int h;
  1284. struct xfrm_state *x0;
  1285. int err = -ENOENT;
  1286. __be32 minspi = htonl(low);
  1287. __be32 maxspi = htonl(high);
  1288. u32 mark = x->mark.v & x->mark.m;
  1289. spin_lock_bh(&x->lock);
  1290. if (x->km.state == XFRM_STATE_DEAD)
  1291. goto unlock;
  1292. err = 0;
  1293. if (x->id.spi)
  1294. goto unlock;
  1295. err = -ENOENT;
  1296. if (minspi == maxspi) {
  1297. x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
  1298. if (x0) {
  1299. xfrm_state_put(x0);
  1300. goto unlock;
  1301. }
  1302. x->id.spi = minspi;
  1303. } else {
  1304. u32 spi = 0;
  1305. for (h=0; h<high-low+1; h++) {
  1306. spi = low + net_random()%(high-low+1);
  1307. x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
  1308. if (x0 == NULL) {
  1309. x->id.spi = htonl(spi);
  1310. break;
  1311. }
  1312. xfrm_state_put(x0);
  1313. }
  1314. }
  1315. if (x->id.spi) {
  1316. spin_lock_bh(&xfrm_state_lock);
  1317. h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
  1318. hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
  1319. spin_unlock_bh(&xfrm_state_lock);
  1320. err = 0;
  1321. }
  1322. unlock:
  1323. spin_unlock_bh(&x->lock);
  1324. return err;
  1325. }
  1326. EXPORT_SYMBOL(xfrm_alloc_spi);
  1327. int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
  1328. int (*func)(struct xfrm_state *, int, void*),
  1329. void *data)
  1330. {
  1331. struct xfrm_state *state;
  1332. struct xfrm_state_walk *x;
  1333. int err = 0;
  1334. if (walk->seq != 0 && list_empty(&walk->all))
  1335. return 0;
  1336. spin_lock_bh(&xfrm_state_lock);
  1337. if (list_empty(&walk->all))
  1338. x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
  1339. else
  1340. x = list_entry(&walk->all, struct xfrm_state_walk, all);
  1341. list_for_each_entry_from(x, &net->xfrm.state_all, all) {
  1342. if (x->state == XFRM_STATE_DEAD)
  1343. continue;
  1344. state = container_of(x, struct xfrm_state, km);
  1345. if (!xfrm_id_proto_match(state->id.proto, walk->proto))
  1346. continue;
  1347. err = func(state, walk->seq, data);
  1348. if (err) {
  1349. list_move_tail(&walk->all, &x->all);
  1350. goto out;
  1351. }
  1352. walk->seq++;
  1353. }
  1354. if (walk->seq == 0) {
  1355. err = -ENOENT;
  1356. goto out;
  1357. }
  1358. list_del_init(&walk->all);
  1359. out:
  1360. spin_unlock_bh(&xfrm_state_lock);
  1361. return err;
  1362. }
  1363. EXPORT_SYMBOL(xfrm_state_walk);
  1364. void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
  1365. {
  1366. INIT_LIST_HEAD(&walk->all);
  1367. walk->proto = proto;
  1368. walk->state = XFRM_STATE_DEAD;
  1369. walk->seq = 0;
  1370. }
  1371. EXPORT_SYMBOL(xfrm_state_walk_init);
  1372. void xfrm_state_walk_done(struct xfrm_state_walk *walk)
  1373. {
  1374. if (list_empty(&walk->all))
  1375. return;
  1376. spin_lock_bh(&xfrm_state_lock);
  1377. list_del(&walk->all);
  1378. spin_unlock_bh(&xfrm_state_lock);
  1379. }
  1380. EXPORT_SYMBOL(xfrm_state_walk_done);
  1381. static void xfrm_replay_timer_handler(unsigned long data)
  1382. {
  1383. struct xfrm_state *x = (struct xfrm_state*)data;
  1384. spin_lock(&x->lock);
  1385. if (x->km.state == XFRM_STATE_VALID) {
  1386. if (xfrm_aevent_is_on(xs_net(x)))
  1387. x->repl->notify(x, XFRM_REPLAY_TIMEOUT);
  1388. else
  1389. x->xflags |= XFRM_TIME_DEFER;
  1390. }
  1391. spin_unlock(&x->lock);
  1392. }
  1393. static LIST_HEAD(xfrm_km_list);
  1394. static DEFINE_RWLOCK(xfrm_km_lock);
  1395. void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
  1396. {
  1397. struct xfrm_mgr *km;
  1398. read_lock(&xfrm_km_lock);
  1399. list_for_each_entry(km, &xfrm_km_list, list)
  1400. if (km->notify_policy)
  1401. km->notify_policy(xp, dir, c);
  1402. read_unlock(&xfrm_km_lock);
  1403. }
  1404. void km_state_notify(struct xfrm_state *x, const struct km_event *c)
  1405. {
  1406. struct xfrm_mgr *km;
  1407. read_lock(&xfrm_km_lock);
  1408. list_for_each_entry(km, &xfrm_km_list, list)
  1409. if (km->notify)
  1410. km->notify(x, c);
  1411. read_unlock(&xfrm_km_lock);
  1412. }
  1413. EXPORT_SYMBOL(km_policy_notify);
  1414. EXPORT_SYMBOL(km_state_notify);
  1415. void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
  1416. {
  1417. struct net *net = xs_net(x);
  1418. struct km_event c;
  1419. c.data.hard = hard;
  1420. c.pid = pid;
  1421. c.event = XFRM_MSG_EXPIRE;
  1422. km_state_notify(x, &c);
  1423. if (hard)
  1424. wake_up(&net->xfrm.km_waitq);
  1425. }
  1426. EXPORT_SYMBOL(km_state_expired);
  1427. /*
  1428. * We send to all registered managers regardless of failure
  1429. * We are happy with one success
  1430. */
  1431. int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
  1432. {
  1433. int err = -EINVAL, acqret;
  1434. struct xfrm_mgr *km;
  1435. read_lock(&xfrm_km_lock);
  1436. list_for_each_entry(km, &xfrm_km_list, list) {
  1437. acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
  1438. if (!acqret)
  1439. err = acqret;
  1440. }
  1441. read_unlock(&xfrm_km_lock);
  1442. return err;
  1443. }
  1444. EXPORT_SYMBOL(km_query);
  1445. int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
  1446. {
  1447. int err = -EINVAL;
  1448. struct xfrm_mgr *km;
  1449. read_lock(&xfrm_km_lock);
  1450. list_for_each_entry(km, &xfrm_km_list, list) {
  1451. if (km->new_mapping)
  1452. err = km->new_mapping(x, ipaddr, sport);
  1453. if (!err)
  1454. break;
  1455. }
  1456. read_unlock(&xfrm_km_lock);
  1457. return err;
  1458. }
  1459. EXPORT_SYMBOL(km_new_mapping);
  1460. void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
  1461. {
  1462. struct net *net = xp_net(pol);
  1463. struct km_event c;
  1464. c.data.hard = hard;
  1465. c.pid = pid;
  1466. c.event = XFRM_MSG_POLEXPIRE;
  1467. km_policy_notify(pol, dir, &c);
  1468. if (hard)
  1469. wake_up(&net->xfrm.km_waitq);
  1470. }
  1471. EXPORT_SYMBOL(km_policy_expired);
  1472. #ifdef CONFIG_XFRM_MIGRATE
  1473. int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
  1474. const struct xfrm_migrate *m, int num_migrate,
  1475. const struct xfrm_kmaddress *k)
  1476. {
  1477. int err = -EINVAL;
  1478. int ret;
  1479. struct xfrm_mgr *km;
  1480. read_lock(&xfrm_km_lock);
  1481. list_for_each_entry(km, &xfrm_km_list, list) {
  1482. if (km->migrate) {
  1483. ret = km->migrate(sel, dir, type, m, num_migrate, k);
  1484. if (!ret)
  1485. err = ret;
  1486. }
  1487. }
  1488. read_unlock(&xfrm_km_lock);
  1489. return err;
  1490. }
  1491. EXPORT_SYMBOL(km_migrate);
  1492. #endif
  1493. int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
  1494. {
  1495. int err = -EINVAL;
  1496. int ret;
  1497. struct xfrm_mgr *km;
  1498. read_lock(&xfrm_km_lock);
  1499. list_for_each_entry(km, &xfrm_km_list, list) {
  1500. if (km->report) {
  1501. ret = km->report(net, proto, sel, addr);
  1502. if (!ret)
  1503. err = ret;
  1504. }
  1505. }
  1506. read_unlock(&xfrm_km_lock);
  1507. return err;
  1508. }
  1509. EXPORT_SYMBOL(km_report);
  1510. int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
  1511. {
  1512. int err;
  1513. u8 *data;
  1514. struct xfrm_mgr *km;
  1515. struct xfrm_policy *pol = NULL;
  1516. if (optlen <= 0 || optlen > PAGE_SIZE)
  1517. return -EMSGSIZE;
  1518. data = kmalloc(optlen, GFP_KERNEL);
  1519. if (!data)
  1520. return -ENOMEM;
  1521. err = -EFAULT;
  1522. if (copy_from_user(data, optval, optlen))
  1523. goto out;
  1524. err = -EINVAL;
  1525. read_lock(&xfrm_km_lock);
  1526. list_for_each_entry(km, &xfrm_km_list, list) {
  1527. pol = km->compile_policy(sk, optname, data,
  1528. optlen, &err);
  1529. if (err >= 0)
  1530. break;
  1531. }
  1532. read_unlock(&xfrm_km_lock);
  1533. if (err >= 0) {
  1534. xfrm_sk_policy_insert(sk, err, pol);
  1535. xfrm_pol_put(pol);
  1536. err = 0;
  1537. }
  1538. out:
  1539. kfree(data);
  1540. return err;
  1541. }
  1542. EXPORT_SYMBOL(xfrm_user_policy);
  1543. int xfrm_register_km(struct xfrm_mgr *km)
  1544. {
  1545. write_lock_bh(&xfrm_km_lock);
  1546. list_add_tail(&km->list, &xfrm_km_list);
  1547. write_unlock_bh(&xfrm_km_lock);
  1548. return 0;
  1549. }
  1550. EXPORT_SYMBOL(xfrm_register_km);
  1551. int xfrm_unregister_km(struct xfrm_mgr *km)
  1552. {
  1553. write_lock_bh(&xfrm_km_lock);
  1554. list_del(&km->list);
  1555. write_unlock_bh(&xfrm_km_lock);
  1556. return 0;
  1557. }
  1558. EXPORT_SYMBOL(xfrm_unregister_km);
  1559. int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
  1560. {
  1561. int err = 0;
  1562. if (unlikely(afinfo == NULL))
  1563. return -EINVAL;
  1564. if (unlikely(afinfo->family >= NPROTO))
  1565. return -EAFNOSUPPORT;
  1566. write_lock_bh(&xfrm_state_afinfo_lock);
  1567. if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
  1568. err = -ENOBUFS;
  1569. else
  1570. xfrm_state_afinfo[afinfo->family] = afinfo;
  1571. write_unlock_bh(&xfrm_state_afinfo_lock);
  1572. return err;
  1573. }
  1574. EXPORT_SYMBOL(xfrm_state_register_afinfo);
  1575. int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
  1576. {
  1577. int err = 0;
  1578. if (unlikely(afinfo == NULL))
  1579. return -EINVAL;
  1580. if (unlikely(afinfo->family >= NPROTO))
  1581. return -EAFNOSUPPORT;
  1582. write_lock_bh(&xfrm_state_afinfo_lock);
  1583. if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
  1584. if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
  1585. err = -EINVAL;
  1586. else
  1587. xfrm_state_afinfo[afinfo->family] = NULL;
  1588. }
  1589. write_unlock_bh(&xfrm_state_afinfo_lock);
  1590. return err;
  1591. }
  1592. EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
  1593. static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
  1594. {
  1595. struct xfrm_state_afinfo *afinfo;
  1596. if (unlikely(family >= NPROTO))
  1597. return NULL;
  1598. read_lock(&xfrm_state_afinfo_lock);
  1599. afinfo = xfrm_state_afinfo[family];
  1600. if (unlikely(!afinfo))
  1601. read_unlock(&xfrm_state_afinfo_lock);
  1602. return afinfo;
  1603. }
  1604. static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
  1605. __releases(xfrm_state_afinfo_lock)
  1606. {
  1607. read_unlock(&xfrm_state_afinfo_lock);
  1608. }
  1609. /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
  1610. void xfrm_state_delete_tunnel(struct xfrm_state *x)
  1611. {
  1612. if (x->tunnel) {
  1613. struct xfrm_state *t = x->tunnel;
  1614. if (atomic_read(&t->tunnel_users) == 2)
  1615. xfrm_state_delete(t);
  1616. atomic_dec(&t->tunnel_users);
  1617. xfrm_state_put(t);
  1618. x->tunnel = NULL;
  1619. }
  1620. }
  1621. EXPORT_SYMBOL(xfrm_state_delete_tunnel);
  1622. int xfrm_state_mtu(struct xfrm_state *x, int mtu)
  1623. {
  1624. int res;
  1625. spin_lock_bh(&x->lock);
  1626. if (x->km.state == XFRM_STATE_VALID &&
  1627. x->type && x->type->get_mtu)
  1628. res = x->type->get_mtu(x, mtu);
  1629. else
  1630. res = mtu - x->props.header_len;
  1631. spin_unlock_bh(&x->lock);
  1632. return res;
  1633. }
  1634. int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
  1635. {
  1636. struct xfrm_state_afinfo *afinfo;
  1637. struct xfrm_mode *inner_mode;
  1638. int family = x->props.family;
  1639. int err;
  1640. err = -EAFNOSUPPORT;
  1641. afinfo = xfrm_state_get_afinfo(family);
  1642. if (!afinfo)
  1643. goto error;
  1644. err = 0;
  1645. if (afinfo->init_flags)
  1646. err = afinfo->init_flags(x);
  1647. xfrm_state_put_afinfo(afinfo);
  1648. if (err)
  1649. goto error;
  1650. err = -EPROTONOSUPPORT;
  1651. if (x->sel.family != AF_UNSPEC) {
  1652. inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
  1653. if (inner_mode == NULL)
  1654. goto error;
  1655. if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
  1656. family != x->sel.family) {
  1657. xfrm_put_mode(inner_mode);
  1658. goto error;
  1659. }
  1660. x->inner_mode = inner_mode;
  1661. } else {
  1662. struct xfrm_mode *inner_mode_iaf;
  1663. int iafamily = AF_INET;
  1664. inner_mode = xfrm_get_mode(x->props.mode, x->props.family);
  1665. if (inner_mode == NULL)
  1666. goto error;
  1667. if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
  1668. xfrm_put_mode(inner_mode);
  1669. goto error;
  1670. }
  1671. x->inner_mode = inner_mode;
  1672. if (x->props.family == AF_INET)
  1673. iafamily = AF_INET6;
  1674. inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily);
  1675. if (inner_mode_iaf) {
  1676. if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)
  1677. x->inner_mode_iaf = inner_mode_iaf;
  1678. else
  1679. xfrm_put_mode(inner_mode_iaf);
  1680. }
  1681. }
  1682. x->type = xfrm_get_type(x->id.proto, family);
  1683. if (x->type == NULL)
  1684. goto error;
  1685. err = x->type->init_state(x);
  1686. if (err)
  1687. goto error;
  1688. x->outer_mode = xfrm_get_mode(x->props.mode, family);
  1689. if (x->outer_mode == NULL)
  1690. goto error;
  1691. if (init_replay) {
  1692. err = xfrm_init_replay(x);
  1693. if (err)
  1694. goto error;
  1695. }
  1696. x->km.state = XFRM_STATE_VALID;
  1697. error:
  1698. return err;
  1699. }
  1700. EXPORT_SYMBOL(__xfrm_init_state);
  1701. int xfrm_init_state(struct xfrm_state *x)
  1702. {
  1703. return __xfrm_init_state(x, true);
  1704. }
  1705. EXPORT_SYMBOL(xfrm_init_state);
  1706. int __net_init xfrm_state_init(struct net *net)
  1707. {
  1708. unsigned int sz;
  1709. INIT_LIST_HEAD(&net->xfrm.state_all);
  1710. sz = sizeof(struct hlist_head) * 8;
  1711. net->xfrm.state_bydst = xfrm_hash_alloc(sz);
  1712. if (!net->xfrm.state_bydst)
  1713. goto out_bydst;
  1714. net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
  1715. if (!net->xfrm.state_bysrc)
  1716. goto out_bysrc;
  1717. net->xfrm.state_byspi = xfrm_hash_alloc(sz);
  1718. if (!net->xfrm.state_byspi)
  1719. goto out_byspi;
  1720. net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
  1721. net->xfrm.state_num = 0;
  1722. INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
  1723. INIT_HLIST_HEAD(&net->xfrm.state_gc_list);
  1724. INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
  1725. init_waitqueue_head(&net->xfrm.km_waitq);
  1726. return 0;
  1727. out_byspi:
  1728. xfrm_hash_free(net->xfrm.state_bysrc, sz);
  1729. out_bysrc:
  1730. xfrm_hash_free(net->xfrm.state_bydst, sz);
  1731. out_bydst:
  1732. return -ENOMEM;
  1733. }
  1734. void xfrm_state_fini(struct net *net)
  1735. {
  1736. struct xfrm_audit audit_info;
  1737. unsigned int sz;
  1738. flush_work(&net->xfrm.state_hash_work);
  1739. audit_info.loginuid = -1;
  1740. audit_info.sessionid = -1;
  1741. audit_info.secid = 0;
  1742. xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info);
  1743. flush_work(&net->xfrm.state_gc_work);
  1744. WARN_ON(!list_empty(&net->xfrm.state_all));
  1745. sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
  1746. WARN_ON(!hlist_empty(net->xfrm.state_byspi));
  1747. xfrm_hash_free(net->xfrm.state_byspi, sz);
  1748. WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
  1749. xfrm_hash_free(net->xfrm.state_bysrc, sz);
  1750. WARN_ON(!hlist_empty(net->xfrm.state_bydst));
  1751. xfrm_hash_free(net->xfrm.state_bydst, sz);
  1752. }
  1753. #ifdef CONFIG_AUDITSYSCALL
  1754. static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
  1755. struct audit_buffer *audit_buf)
  1756. {
  1757. struct xfrm_sec_ctx *ctx = x->security;
  1758. u32 spi = ntohl(x->id.spi);
  1759. if (ctx)
  1760. audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
  1761. ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
  1762. switch(x->props.family) {
  1763. case AF_INET:
  1764. audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
  1765. &x->props.saddr.a4, &x->id.daddr.a4);
  1766. break;
  1767. case AF_INET6:
  1768. audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
  1769. x->props.saddr.a6, x->id.daddr.a6);
  1770. break;
  1771. }
  1772. audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
  1773. }
  1774. static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
  1775. struct audit_buffer *audit_buf)
  1776. {
  1777. const struct iphdr *iph4;
  1778. const struct ipv6hdr *iph6;
  1779. switch (family) {
  1780. case AF_INET:
  1781. iph4 = ip_hdr(skb);
  1782. audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
  1783. &iph4->saddr, &iph4->daddr);
  1784. break;
  1785. case AF_INET6:
  1786. iph6 = ipv6_hdr(skb);
  1787. audit_log_format(audit_buf,
  1788. " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
  1789. &iph6->saddr,&iph6->daddr,
  1790. iph6->flow_lbl[0] & 0x0f,
  1791. iph6->flow_lbl[1],
  1792. iph6->flow_lbl[2]);
  1793. break;
  1794. }
  1795. }
  1796. void xfrm_audit_state_add(struct xfrm_state *x, int result,
  1797. uid_t auid, u32 sessionid, u32 secid)
  1798. {
  1799. struct audit_buffer *audit_buf;
  1800. audit_buf = xfrm_audit_start("SAD-add");
  1801. if (audit_buf == NULL)
  1802. return;
  1803. xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
  1804. xfrm_audit_helper_sainfo(x, audit_buf);
  1805. audit_log_format(audit_buf, " res=%u", result);
  1806. audit_log_end(audit_buf);
  1807. }
  1808. EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
  1809. void xfrm_audit_state_delete(struct xfrm_state *x, int result,
  1810. uid_t auid, u32 sessionid, u32 secid)
  1811. {
  1812. struct audit_buffer *audit_buf;
  1813. audit_buf = xfrm_audit_start("SAD-delete");
  1814. if (audit_buf == NULL)
  1815. return;
  1816. xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
  1817. xfrm_audit_helper_sainfo(x, audit_buf);
  1818. audit_log_format(audit_buf, " res=%u", result);
  1819. audit_log_end(audit_buf);
  1820. }
  1821. EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
  1822. void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
  1823. struct sk_buff *skb)
  1824. {
  1825. struct audit_buffer *audit_buf;
  1826. u32 spi;
  1827. audit_buf = xfrm_audit_start("SA-replay-overflow");
  1828. if (audit_buf == NULL)
  1829. return;
  1830. xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
  1831. /* don't record the sequence number because it's inherent in this kind
  1832. * of audit message */
  1833. spi = ntohl(x->id.spi);
  1834. audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
  1835. audit_log_end(audit_buf);
  1836. }
  1837. EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
  1838. void xfrm_audit_state_replay(struct xfrm_state *x,
  1839. struct sk_buff *skb, __be32 net_seq)
  1840. {
  1841. struct audit_buffer *audit_buf;
  1842. u32 spi;
  1843. audit_buf = xfrm_audit_start("SA-replayed-pkt");
  1844. if (audit_buf == NULL)
  1845. return;
  1846. xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
  1847. spi = ntohl(x->id.spi);
  1848. audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
  1849. spi, spi, ntohl(net_seq));
  1850. audit_log_end(audit_buf);
  1851. }
  1852. EXPORT_SYMBOL_GPL(xfrm_audit_state_replay);
  1853. void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
  1854. {
  1855. struct audit_buffer *audit_buf;
  1856. audit_buf = xfrm_audit_start("SA-notfound");
  1857. if (audit_buf == NULL)
  1858. return;
  1859. xfrm_audit_helper_pktinfo(skb, family, audit_buf);
  1860. audit_log_end(audit_buf);
  1861. }
  1862. EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
  1863. void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
  1864. __be32 net_spi, __be32 net_seq)
  1865. {
  1866. struct audit_buffer *audit_buf;
  1867. u32 spi;
  1868. audit_buf = xfrm_audit_start("SA-notfound");
  1869. if (audit_buf == NULL)
  1870. return;
  1871. xfrm_audit_helper_pktinfo(skb, family, audit_buf);
  1872. spi = ntohl(net_spi);
  1873. audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
  1874. spi, spi, ntohl(net_seq));
  1875. audit_log_end(audit_buf);
  1876. }
  1877. EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
  1878. void xfrm_audit_state_icvfail(struct xfrm_state *x,
  1879. struct sk_buff *skb, u8 proto)
  1880. {
  1881. struct audit_buffer *audit_buf;
  1882. __be32 net_spi;
  1883. __be32 net_seq;
  1884. audit_buf = xfrm_audit_start("SA-icv-failure");
  1885. if (audit_buf == NULL)
  1886. return;
  1887. xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
  1888. if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
  1889. u32 spi = ntohl(net_spi);
  1890. audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
  1891. spi, spi, ntohl(net_seq));
  1892. }
  1893. audit_log_end(audit_buf);
  1894. }
  1895. EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
  1896. #endif /* CONFIG_AUDITSYSCALL */