xfrm_policy.c revision cf91166223772ef4a2ed98b9874958bf6a2470df
1/* 2 * xfrm_policy.c 3 * 4 * Changes: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * Kazunori MIYAZAWA @USAGI 10 * YOSHIFUJI Hideaki 11 * Split up af-specific portion 12 * Derek Atkins <derek@ihtfp.com> Add the post_input processor 13 * 14 */ 15 16#include <linux/err.h> 17#include <linux/slab.h> 18#include <linux/kmod.h> 19#include <linux/list.h> 20#include <linux/spinlock.h> 21#include <linux/workqueue.h> 22#include <linux/notifier.h> 23#include <linux/netdevice.h> 24#include <linux/netfilter.h> 25#include <linux/module.h> 26#include <linux/cache.h> 27#include <linux/audit.h> 28#include <net/dst.h> 29#include <net/xfrm.h> 30#include <net/ip.h> 31#ifdef CONFIG_XFRM_STATISTICS 32#include <net/snmp.h> 33#endif 34 35#include "xfrm_hash.h" 36 37DEFINE_MUTEX(xfrm_cfg_mutex); 38EXPORT_SYMBOL(xfrm_cfg_mutex); 39 40static DEFINE_SPINLOCK(xfrm_policy_sk_bundle_lock); 41static struct dst_entry *xfrm_policy_sk_bundles; 42static DEFINE_RWLOCK(xfrm_policy_lock); 43 44static DEFINE_RWLOCK(xfrm_policy_afinfo_lock); 45static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO]; 46 47static struct kmem_cache *xfrm_dst_cache __read_mostly; 48 49static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family); 50static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo); 51static void xfrm_init_pmtu(struct dst_entry *dst); 52static int stale_bundle(struct dst_entry *dst); 53static int xfrm_bundle_ok(struct xfrm_dst *xdst, int family); 54 55 56static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, 57 int dir); 58 59static inline int 60__xfrm4_selector_match(const struct xfrm_selector *sel, const struct flowi *fl) 61{ 62 const struct flowi4 *fl4 = &fl->u.ip4; 63 64 return addr_match(&fl4->daddr, &sel->daddr, sel->prefixlen_d) && 65 addr_match(&fl4->saddr, &sel->saddr, sel->prefixlen_s) && 66 !((xfrm_flowi_dport(fl, &fl4->uli) ^ sel->dport) & sel->dport_mask) && 67 !((xfrm_flowi_sport(fl, &fl4->uli) ^ sel->sport) & sel->sport_mask) && 68 (fl4->flowi4_proto == sel->proto || !sel->proto) && 69 (fl4->flowi4_oif == sel->ifindex || !sel->ifindex); 70} 71 72static inline int 73__xfrm6_selector_match(const struct xfrm_selector *sel, const struct flowi *fl) 74{ 75 const struct flowi6 *fl6 = &fl->u.ip6; 76 77 return addr_match(&fl6->daddr, &sel->daddr, sel->prefixlen_d) && 78 addr_match(&fl6->saddr, &sel->saddr, sel->prefixlen_s) && 79 !((xfrm_flowi_dport(fl, &fl6->uli) ^ sel->dport) & sel->dport_mask) && 80 !((xfrm_flowi_sport(fl, &fl6->uli) ^ sel->sport) & sel->sport_mask) && 81 (fl6->flowi6_proto == sel->proto || !sel->proto) && 82 (fl6->flowi6_oif == sel->ifindex || !sel->ifindex); 83} 84 85int xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl, 86 unsigned short family) 87{ 88 switch (family) { 89 case AF_INET: 90 return __xfrm4_selector_match(sel, fl); 91 case AF_INET6: 92 return __xfrm6_selector_match(sel, fl); 93 } 94 return 0; 95} 96 97static inline struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, 98 const xfrm_address_t *saddr, 99 const xfrm_address_t *daddr, 100 int family) 101{ 102 struct xfrm_policy_afinfo *afinfo; 103 struct dst_entry *dst; 104 105 afinfo = xfrm_policy_get_afinfo(family); 106 if (unlikely(afinfo == NULL)) 107 return ERR_PTR(-EAFNOSUPPORT); 108 109 dst = afinfo->dst_lookup(net, tos, saddr, daddr); 110 111 xfrm_policy_put_afinfo(afinfo); 112 113 return dst; 114} 115 116static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, int tos, 117 xfrm_address_t *prev_saddr, 118 xfrm_address_t *prev_daddr, 119 int family) 120{ 121 struct net *net = xs_net(x); 122 xfrm_address_t *saddr = &x->props.saddr; 123 xfrm_address_t *daddr = &x->id.daddr; 124 struct dst_entry *dst; 125 126 if (x->type->flags & XFRM_TYPE_LOCAL_COADDR) { 127 saddr = x->coaddr; 128 daddr = prev_daddr; 129 } 130 if (x->type->flags & XFRM_TYPE_REMOTE_COADDR) { 131 saddr = prev_saddr; 132 daddr = x->coaddr; 133 } 134 135 dst = __xfrm_dst_lookup(net, tos, saddr, daddr, family); 136 137 if (!IS_ERR(dst)) { 138 if (prev_saddr != saddr) 139 memcpy(prev_saddr, saddr, sizeof(*prev_saddr)); 140 if (prev_daddr != daddr) 141 memcpy(prev_daddr, daddr, sizeof(*prev_daddr)); 142 } 143 144 return dst; 145} 146 147static inline unsigned long make_jiffies(long secs) 148{ 149 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ) 150 return MAX_SCHEDULE_TIMEOUT-1; 151 else 152 return secs*HZ; 153} 154 155static void xfrm_policy_timer(unsigned long data) 156{ 157 struct xfrm_policy *xp = (struct xfrm_policy*)data; 158 unsigned long now = get_seconds(); 159 long next = LONG_MAX; 160 int warn = 0; 161 int dir; 162 163 read_lock(&xp->lock); 164 165 if (unlikely(xp->walk.dead)) 166 goto out; 167 168 dir = xfrm_policy_id2dir(xp->index); 169 170 if (xp->lft.hard_add_expires_seconds) { 171 long tmo = xp->lft.hard_add_expires_seconds + 172 xp->curlft.add_time - now; 173 if (tmo <= 0) 174 goto expired; 175 if (tmo < next) 176 next = tmo; 177 } 178 if (xp->lft.hard_use_expires_seconds) { 179 long tmo = xp->lft.hard_use_expires_seconds + 180 (xp->curlft.use_time ? : xp->curlft.add_time) - now; 181 if (tmo <= 0) 182 goto expired; 183 if (tmo < next) 184 next = tmo; 185 } 186 if (xp->lft.soft_add_expires_seconds) { 187 long tmo = xp->lft.soft_add_expires_seconds + 188 xp->curlft.add_time - now; 189 if (tmo <= 0) { 190 warn = 1; 191 tmo = XFRM_KM_TIMEOUT; 192 } 193 if (tmo < next) 194 next = tmo; 195 } 196 if (xp->lft.soft_use_expires_seconds) { 197 long tmo = xp->lft.soft_use_expires_seconds + 198 (xp->curlft.use_time ? : xp->curlft.add_time) - now; 199 if (tmo <= 0) { 200 warn = 1; 201 tmo = XFRM_KM_TIMEOUT; 202 } 203 if (tmo < next) 204 next = tmo; 205 } 206 207 if (warn) 208 km_policy_expired(xp, dir, 0, 0); 209 if (next != LONG_MAX && 210 !mod_timer(&xp->timer, jiffies + make_jiffies(next))) 211 xfrm_pol_hold(xp); 212 213out: 214 read_unlock(&xp->lock); 215 xfrm_pol_put(xp); 216 return; 217 218expired: 219 read_unlock(&xp->lock); 220 if (!xfrm_policy_delete(xp, dir)) 221 km_policy_expired(xp, dir, 1, 0); 222 xfrm_pol_put(xp); 223} 224 225static struct flow_cache_object *xfrm_policy_flo_get(struct flow_cache_object *flo) 226{ 227 struct xfrm_policy *pol = container_of(flo, struct xfrm_policy, flo); 228 229 if (unlikely(pol->walk.dead)) 230 flo = NULL; 231 else 232 xfrm_pol_hold(pol); 233 234 return flo; 235} 236 237static int xfrm_policy_flo_check(struct flow_cache_object *flo) 238{ 239 struct xfrm_policy *pol = container_of(flo, struct xfrm_policy, flo); 240 241 return !pol->walk.dead; 242} 243 244static void xfrm_policy_flo_delete(struct flow_cache_object *flo) 245{ 246 xfrm_pol_put(container_of(flo, struct xfrm_policy, flo)); 247} 248 249static const struct flow_cache_ops xfrm_policy_fc_ops = { 250 .get = xfrm_policy_flo_get, 251 .check = xfrm_policy_flo_check, 252 .delete = xfrm_policy_flo_delete, 253}; 254 255/* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2 256 * SPD calls. 257 */ 258 259struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp) 260{ 261 struct xfrm_policy *policy; 262 263 policy = kzalloc(sizeof(struct xfrm_policy), gfp); 264 265 if (policy) { 266 write_pnet(&policy->xp_net, net); 267 INIT_LIST_HEAD(&policy->walk.all); 268 INIT_HLIST_NODE(&policy->bydst); 269 INIT_HLIST_NODE(&policy->byidx); 270 rwlock_init(&policy->lock); 271 atomic_set(&policy->refcnt, 1); 272 setup_timer(&policy->timer, xfrm_policy_timer, 273 (unsigned long)policy); 274 policy->flo.ops = &xfrm_policy_fc_ops; 275 } 276 return policy; 277} 278EXPORT_SYMBOL(xfrm_policy_alloc); 279 280/* Destroy xfrm_policy: descendant resources must be released to this moment. */ 281 282void xfrm_policy_destroy(struct xfrm_policy *policy) 283{ 284 BUG_ON(!policy->walk.dead); 285 286 if (del_timer(&policy->timer)) 287 BUG(); 288 289 security_xfrm_policy_free(policy->security); 290 kfree(policy); 291} 292EXPORT_SYMBOL(xfrm_policy_destroy); 293 294/* Rule must be locked. Release descentant resources, announce 295 * entry dead. The rule must be unlinked from lists to the moment. 296 */ 297 298static void xfrm_policy_kill(struct xfrm_policy *policy) 299{ 300 policy->walk.dead = 1; 301 302 atomic_inc(&policy->genid); 303 304 if (del_timer(&policy->timer)) 305 xfrm_pol_put(policy); 306 307 xfrm_pol_put(policy); 308} 309 310static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024; 311 312static inline unsigned int idx_hash(struct net *net, u32 index) 313{ 314 return __idx_hash(index, net->xfrm.policy_idx_hmask); 315} 316 317static struct hlist_head *policy_hash_bysel(struct net *net, 318 const struct xfrm_selector *sel, 319 unsigned short family, int dir) 320{ 321 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 322 unsigned int hash = __sel_hash(sel, family, hmask); 323 324 return (hash == hmask + 1 ? 325 &net->xfrm.policy_inexact[dir] : 326 net->xfrm.policy_bydst[dir].table + hash); 327} 328 329static struct hlist_head *policy_hash_direct(struct net *net, 330 const xfrm_address_t *daddr, 331 const xfrm_address_t *saddr, 332 unsigned short family, int dir) 333{ 334 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 335 unsigned int hash = __addr_hash(daddr, saddr, family, hmask); 336 337 return net->xfrm.policy_bydst[dir].table + hash; 338} 339 340static void xfrm_dst_hash_transfer(struct hlist_head *list, 341 struct hlist_head *ndsttable, 342 unsigned int nhashmask) 343{ 344 struct hlist_node *entry, *tmp, *entry0 = NULL; 345 struct xfrm_policy *pol; 346 unsigned int h0 = 0; 347 348redo: 349 hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) { 350 unsigned int h; 351 352 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr, 353 pol->family, nhashmask); 354 if (!entry0) { 355 hlist_del(entry); 356 hlist_add_head(&pol->bydst, ndsttable+h); 357 h0 = h; 358 } else { 359 if (h != h0) 360 continue; 361 hlist_del(entry); 362 hlist_add_after(entry0, &pol->bydst); 363 } 364 entry0 = entry; 365 } 366 if (!hlist_empty(list)) { 367 entry0 = NULL; 368 goto redo; 369 } 370} 371 372static void xfrm_idx_hash_transfer(struct hlist_head *list, 373 struct hlist_head *nidxtable, 374 unsigned int nhashmask) 375{ 376 struct hlist_node *entry, *tmp; 377 struct xfrm_policy *pol; 378 379 hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) { 380 unsigned int h; 381 382 h = __idx_hash(pol->index, nhashmask); 383 hlist_add_head(&pol->byidx, nidxtable+h); 384 } 385} 386 387static unsigned long xfrm_new_hash_mask(unsigned int old_hmask) 388{ 389 return ((old_hmask + 1) << 1) - 1; 390} 391 392static void xfrm_bydst_resize(struct net *net, int dir) 393{ 394 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 395 unsigned int nhashmask = xfrm_new_hash_mask(hmask); 396 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head); 397 struct hlist_head *odst = net->xfrm.policy_bydst[dir].table; 398 struct hlist_head *ndst = xfrm_hash_alloc(nsize); 399 int i; 400 401 if (!ndst) 402 return; 403 404 write_lock_bh(&xfrm_policy_lock); 405 406 for (i = hmask; i >= 0; i--) 407 xfrm_dst_hash_transfer(odst + i, ndst, nhashmask); 408 409 net->xfrm.policy_bydst[dir].table = ndst; 410 net->xfrm.policy_bydst[dir].hmask = nhashmask; 411 412 write_unlock_bh(&xfrm_policy_lock); 413 414 xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head)); 415} 416 417static void xfrm_byidx_resize(struct net *net, int total) 418{ 419 unsigned int hmask = net->xfrm.policy_idx_hmask; 420 unsigned int nhashmask = xfrm_new_hash_mask(hmask); 421 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head); 422 struct hlist_head *oidx = net->xfrm.policy_byidx; 423 struct hlist_head *nidx = xfrm_hash_alloc(nsize); 424 int i; 425 426 if (!nidx) 427 return; 428 429 write_lock_bh(&xfrm_policy_lock); 430 431 for (i = hmask; i >= 0; i--) 432 xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask); 433 434 net->xfrm.policy_byidx = nidx; 435 net->xfrm.policy_idx_hmask = nhashmask; 436 437 write_unlock_bh(&xfrm_policy_lock); 438 439 xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head)); 440} 441 442static inline int xfrm_bydst_should_resize(struct net *net, int dir, int *total) 443{ 444 unsigned int cnt = net->xfrm.policy_count[dir]; 445 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 446 447 if (total) 448 *total += cnt; 449 450 if ((hmask + 1) < xfrm_policy_hashmax && 451 cnt > hmask) 452 return 1; 453 454 return 0; 455} 456 457static inline int xfrm_byidx_should_resize(struct net *net, int total) 458{ 459 unsigned int hmask = net->xfrm.policy_idx_hmask; 460 461 if ((hmask + 1) < xfrm_policy_hashmax && 462 total > hmask) 463 return 1; 464 465 return 0; 466} 467 468void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si) 469{ 470 read_lock_bh(&xfrm_policy_lock); 471 si->incnt = net->xfrm.policy_count[XFRM_POLICY_IN]; 472 si->outcnt = net->xfrm.policy_count[XFRM_POLICY_OUT]; 473 si->fwdcnt = net->xfrm.policy_count[XFRM_POLICY_FWD]; 474 si->inscnt = net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX]; 475 si->outscnt = net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX]; 476 si->fwdscnt = net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX]; 477 si->spdhcnt = net->xfrm.policy_idx_hmask; 478 si->spdhmcnt = xfrm_policy_hashmax; 479 read_unlock_bh(&xfrm_policy_lock); 480} 481EXPORT_SYMBOL(xfrm_spd_getinfo); 482 483static DEFINE_MUTEX(hash_resize_mutex); 484static void xfrm_hash_resize(struct work_struct *work) 485{ 486 struct net *net = container_of(work, struct net, xfrm.policy_hash_work); 487 int dir, total; 488 489 mutex_lock(&hash_resize_mutex); 490 491 total = 0; 492 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 493 if (xfrm_bydst_should_resize(net, dir, &total)) 494 xfrm_bydst_resize(net, dir); 495 } 496 if (xfrm_byidx_should_resize(net, total)) 497 xfrm_byidx_resize(net, total); 498 499 mutex_unlock(&hash_resize_mutex); 500} 501 502/* Generate new index... KAME seems to generate them ordered by cost 503 * of an absolute inpredictability of ordering of rules. This will not pass. */ 504static u32 xfrm_gen_index(struct net *net, int dir) 505{ 506 static u32 idx_generator; 507 508 for (;;) { 509 struct hlist_node *entry; 510 struct hlist_head *list; 511 struct xfrm_policy *p; 512 u32 idx; 513 int found; 514 515 idx = (idx_generator | dir); 516 idx_generator += 8; 517 if (idx == 0) 518 idx = 8; 519 list = net->xfrm.policy_byidx + idx_hash(net, idx); 520 found = 0; 521 hlist_for_each_entry(p, entry, list, byidx) { 522 if (p->index == idx) { 523 found = 1; 524 break; 525 } 526 } 527 if (!found) 528 return idx; 529 } 530} 531 532static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s2) 533{ 534 u32 *p1 = (u32 *) s1; 535 u32 *p2 = (u32 *) s2; 536 int len = sizeof(struct xfrm_selector) / sizeof(u32); 537 int i; 538 539 for (i = 0; i < len; i++) { 540 if (p1[i] != p2[i]) 541 return 1; 542 } 543 544 return 0; 545} 546 547int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) 548{ 549 struct net *net = xp_net(policy); 550 struct xfrm_policy *pol; 551 struct xfrm_policy *delpol; 552 struct hlist_head *chain; 553 struct hlist_node *entry, *newpos; 554 u32 mark = policy->mark.v & policy->mark.m; 555 556 write_lock_bh(&xfrm_policy_lock); 557 chain = policy_hash_bysel(net, &policy->selector, policy->family, dir); 558 delpol = NULL; 559 newpos = NULL; 560 hlist_for_each_entry(pol, entry, chain, bydst) { 561 if (pol->type == policy->type && 562 !selector_cmp(&pol->selector, &policy->selector) && 563 (mark & pol->mark.m) == pol->mark.v && 564 xfrm_sec_ctx_match(pol->security, policy->security) && 565 !WARN_ON(delpol)) { 566 if (excl) { 567 write_unlock_bh(&xfrm_policy_lock); 568 return -EEXIST; 569 } 570 delpol = pol; 571 if (policy->priority > pol->priority) 572 continue; 573 } else if (policy->priority >= pol->priority) { 574 newpos = &pol->bydst; 575 continue; 576 } 577 if (delpol) 578 break; 579 } 580 if (newpos) 581 hlist_add_after(newpos, &policy->bydst); 582 else 583 hlist_add_head(&policy->bydst, chain); 584 xfrm_pol_hold(policy); 585 net->xfrm.policy_count[dir]++; 586 atomic_inc(&flow_cache_genid); 587 if (delpol) 588 __xfrm_policy_unlink(delpol, dir); 589 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir); 590 hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index)); 591 policy->curlft.add_time = get_seconds(); 592 policy->curlft.use_time = 0; 593 if (!mod_timer(&policy->timer, jiffies + HZ)) 594 xfrm_pol_hold(policy); 595 list_add(&policy->walk.all, &net->xfrm.policy_all); 596 write_unlock_bh(&xfrm_policy_lock); 597 598 if (delpol) 599 xfrm_policy_kill(delpol); 600 else if (xfrm_bydst_should_resize(net, dir, NULL)) 601 schedule_work(&net->xfrm.policy_hash_work); 602 603 return 0; 604} 605EXPORT_SYMBOL(xfrm_policy_insert); 606 607struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type, 608 int dir, struct xfrm_selector *sel, 609 struct xfrm_sec_ctx *ctx, int delete, 610 int *err) 611{ 612 struct xfrm_policy *pol, *ret; 613 struct hlist_head *chain; 614 struct hlist_node *entry; 615 616 *err = 0; 617 write_lock_bh(&xfrm_policy_lock); 618 chain = policy_hash_bysel(net, sel, sel->family, dir); 619 ret = NULL; 620 hlist_for_each_entry(pol, entry, chain, bydst) { 621 if (pol->type == type && 622 (mark & pol->mark.m) == pol->mark.v && 623 !selector_cmp(sel, &pol->selector) && 624 xfrm_sec_ctx_match(ctx, pol->security)) { 625 xfrm_pol_hold(pol); 626 if (delete) { 627 *err = security_xfrm_policy_delete( 628 pol->security); 629 if (*err) { 630 write_unlock_bh(&xfrm_policy_lock); 631 return pol; 632 } 633 __xfrm_policy_unlink(pol, dir); 634 } 635 ret = pol; 636 break; 637 } 638 } 639 write_unlock_bh(&xfrm_policy_lock); 640 641 if (ret && delete) 642 xfrm_policy_kill(ret); 643 return ret; 644} 645EXPORT_SYMBOL(xfrm_policy_bysel_ctx); 646 647struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type, 648 int dir, u32 id, int delete, int *err) 649{ 650 struct xfrm_policy *pol, *ret; 651 struct hlist_head *chain; 652 struct hlist_node *entry; 653 654 *err = -ENOENT; 655 if (xfrm_policy_id2dir(id) != dir) 656 return NULL; 657 658 *err = 0; 659 write_lock_bh(&xfrm_policy_lock); 660 chain = net->xfrm.policy_byidx + idx_hash(net, id); 661 ret = NULL; 662 hlist_for_each_entry(pol, entry, chain, byidx) { 663 if (pol->type == type && pol->index == id && 664 (mark & pol->mark.m) == pol->mark.v) { 665 xfrm_pol_hold(pol); 666 if (delete) { 667 *err = security_xfrm_policy_delete( 668 pol->security); 669 if (*err) { 670 write_unlock_bh(&xfrm_policy_lock); 671 return pol; 672 } 673 __xfrm_policy_unlink(pol, dir); 674 } 675 ret = pol; 676 break; 677 } 678 } 679 write_unlock_bh(&xfrm_policy_lock); 680 681 if (ret && delete) 682 xfrm_policy_kill(ret); 683 return ret; 684} 685EXPORT_SYMBOL(xfrm_policy_byid); 686 687#ifdef CONFIG_SECURITY_NETWORK_XFRM 688static inline int 689xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info) 690{ 691 int dir, err = 0; 692 693 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { 694 struct xfrm_policy *pol; 695 struct hlist_node *entry; 696 int i; 697 698 hlist_for_each_entry(pol, entry, 699 &net->xfrm.policy_inexact[dir], bydst) { 700 if (pol->type != type) 701 continue; 702 err = security_xfrm_policy_delete(pol->security); 703 if (err) { 704 xfrm_audit_policy_delete(pol, 0, 705 audit_info->loginuid, 706 audit_info->sessionid, 707 audit_info->secid); 708 return err; 709 } 710 } 711 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) { 712 hlist_for_each_entry(pol, entry, 713 net->xfrm.policy_bydst[dir].table + i, 714 bydst) { 715 if (pol->type != type) 716 continue; 717 err = security_xfrm_policy_delete( 718 pol->security); 719 if (err) { 720 xfrm_audit_policy_delete(pol, 0, 721 audit_info->loginuid, 722 audit_info->sessionid, 723 audit_info->secid); 724 return err; 725 } 726 } 727 } 728 } 729 return err; 730} 731#else 732static inline int 733xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info) 734{ 735 return 0; 736} 737#endif 738 739int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info) 740{ 741 int dir, err = 0, cnt = 0; 742 743 write_lock_bh(&xfrm_policy_lock); 744 745 err = xfrm_policy_flush_secctx_check(net, type, audit_info); 746 if (err) 747 goto out; 748 749 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { 750 struct xfrm_policy *pol; 751 struct hlist_node *entry; 752 int i; 753 754 again1: 755 hlist_for_each_entry(pol, entry, 756 &net->xfrm.policy_inexact[dir], bydst) { 757 if (pol->type != type) 758 continue; 759 __xfrm_policy_unlink(pol, dir); 760 write_unlock_bh(&xfrm_policy_lock); 761 cnt++; 762 763 xfrm_audit_policy_delete(pol, 1, audit_info->loginuid, 764 audit_info->sessionid, 765 audit_info->secid); 766 767 xfrm_policy_kill(pol); 768 769 write_lock_bh(&xfrm_policy_lock); 770 goto again1; 771 } 772 773 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) { 774 again2: 775 hlist_for_each_entry(pol, entry, 776 net->xfrm.policy_bydst[dir].table + i, 777 bydst) { 778 if (pol->type != type) 779 continue; 780 __xfrm_policy_unlink(pol, dir); 781 write_unlock_bh(&xfrm_policy_lock); 782 cnt++; 783 784 xfrm_audit_policy_delete(pol, 1, 785 audit_info->loginuid, 786 audit_info->sessionid, 787 audit_info->secid); 788 xfrm_policy_kill(pol); 789 790 write_lock_bh(&xfrm_policy_lock); 791 goto again2; 792 } 793 } 794 795 } 796 if (!cnt) 797 err = -ESRCH; 798out: 799 write_unlock_bh(&xfrm_policy_lock); 800 return err; 801} 802EXPORT_SYMBOL(xfrm_policy_flush); 803 804int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 805 int (*func)(struct xfrm_policy *, int, int, void*), 806 void *data) 807{ 808 struct xfrm_policy *pol; 809 struct xfrm_policy_walk_entry *x; 810 int error = 0; 811 812 if (walk->type >= XFRM_POLICY_TYPE_MAX && 813 walk->type != XFRM_POLICY_TYPE_ANY) 814 return -EINVAL; 815 816 if (list_empty(&walk->walk.all) && walk->seq != 0) 817 return 0; 818 819 write_lock_bh(&xfrm_policy_lock); 820 if (list_empty(&walk->walk.all)) 821 x = list_first_entry(&net->xfrm.policy_all, struct xfrm_policy_walk_entry, all); 822 else 823 x = list_entry(&walk->walk.all, struct xfrm_policy_walk_entry, all); 824 list_for_each_entry_from(x, &net->xfrm.policy_all, all) { 825 if (x->dead) 826 continue; 827 pol = container_of(x, struct xfrm_policy, walk); 828 if (walk->type != XFRM_POLICY_TYPE_ANY && 829 walk->type != pol->type) 830 continue; 831 error = func(pol, xfrm_policy_id2dir(pol->index), 832 walk->seq, data); 833 if (error) { 834 list_move_tail(&walk->walk.all, &x->all); 835 goto out; 836 } 837 walk->seq++; 838 } 839 if (walk->seq == 0) { 840 error = -ENOENT; 841 goto out; 842 } 843 list_del_init(&walk->walk.all); 844out: 845 write_unlock_bh(&xfrm_policy_lock); 846 return error; 847} 848EXPORT_SYMBOL(xfrm_policy_walk); 849 850void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type) 851{ 852 INIT_LIST_HEAD(&walk->walk.all); 853 walk->walk.dead = 1; 854 walk->type = type; 855 walk->seq = 0; 856} 857EXPORT_SYMBOL(xfrm_policy_walk_init); 858 859void xfrm_policy_walk_done(struct xfrm_policy_walk *walk) 860{ 861 if (list_empty(&walk->walk.all)) 862 return; 863 864 write_lock_bh(&xfrm_policy_lock); 865 list_del(&walk->walk.all); 866 write_unlock_bh(&xfrm_policy_lock); 867} 868EXPORT_SYMBOL(xfrm_policy_walk_done); 869 870/* 871 * Find policy to apply to this flow. 872 * 873 * Returns 0 if policy found, else an -errno. 874 */ 875static int xfrm_policy_match(const struct xfrm_policy *pol, 876 const struct flowi *fl, 877 u8 type, u16 family, int dir) 878{ 879 const struct xfrm_selector *sel = &pol->selector; 880 int match, ret = -ESRCH; 881 882 if (pol->family != family || 883 (fl->flowi_mark & pol->mark.m) != pol->mark.v || 884 pol->type != type) 885 return ret; 886 887 match = xfrm_selector_match(sel, fl, family); 888 if (match) 889 ret = security_xfrm_policy_lookup(pol->security, fl->flowi_secid, 890 dir); 891 892 return ret; 893} 894 895static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type, 896 const struct flowi *fl, 897 u16 family, u8 dir) 898{ 899 int err; 900 struct xfrm_policy *pol, *ret; 901 const xfrm_address_t *daddr, *saddr; 902 struct hlist_node *entry; 903 struct hlist_head *chain; 904 u32 priority = ~0U; 905 906 daddr = xfrm_flowi_daddr(fl, family); 907 saddr = xfrm_flowi_saddr(fl, family); 908 if (unlikely(!daddr || !saddr)) 909 return NULL; 910 911 read_lock_bh(&xfrm_policy_lock); 912 chain = policy_hash_direct(net, daddr, saddr, family, dir); 913 ret = NULL; 914 hlist_for_each_entry(pol, entry, chain, bydst) { 915 err = xfrm_policy_match(pol, fl, type, family, dir); 916 if (err) { 917 if (err == -ESRCH) 918 continue; 919 else { 920 ret = ERR_PTR(err); 921 goto fail; 922 } 923 } else { 924 ret = pol; 925 priority = ret->priority; 926 break; 927 } 928 } 929 chain = &net->xfrm.policy_inexact[dir]; 930 hlist_for_each_entry(pol, entry, chain, bydst) { 931 err = xfrm_policy_match(pol, fl, type, family, dir); 932 if (err) { 933 if (err == -ESRCH) 934 continue; 935 else { 936 ret = ERR_PTR(err); 937 goto fail; 938 } 939 } else if (pol->priority < priority) { 940 ret = pol; 941 break; 942 } 943 } 944 if (ret) 945 xfrm_pol_hold(ret); 946fail: 947 read_unlock_bh(&xfrm_policy_lock); 948 949 return ret; 950} 951 952static struct xfrm_policy * 953__xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir) 954{ 955#ifdef CONFIG_XFRM_SUB_POLICY 956 struct xfrm_policy *pol; 957 958 pol = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_SUB, fl, family, dir); 959 if (pol != NULL) 960 return pol; 961#endif 962 return xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family, dir); 963} 964 965static struct flow_cache_object * 966xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family, 967 u8 dir, struct flow_cache_object *old_obj, void *ctx) 968{ 969 struct xfrm_policy *pol; 970 971 if (old_obj) 972 xfrm_pol_put(container_of(old_obj, struct xfrm_policy, flo)); 973 974 pol = __xfrm_policy_lookup(net, fl, family, dir); 975 if (IS_ERR_OR_NULL(pol)) 976 return ERR_CAST(pol); 977 978 /* Resolver returns two references: 979 * one for cache and one for caller of flow_cache_lookup() */ 980 xfrm_pol_hold(pol); 981 982 return &pol->flo; 983} 984 985static inline int policy_to_flow_dir(int dir) 986{ 987 if (XFRM_POLICY_IN == FLOW_DIR_IN && 988 XFRM_POLICY_OUT == FLOW_DIR_OUT && 989 XFRM_POLICY_FWD == FLOW_DIR_FWD) 990 return dir; 991 switch (dir) { 992 default: 993 case XFRM_POLICY_IN: 994 return FLOW_DIR_IN; 995 case XFRM_POLICY_OUT: 996 return FLOW_DIR_OUT; 997 case XFRM_POLICY_FWD: 998 return FLOW_DIR_FWD; 999 } 1000} 1001 1002static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, 1003 const struct flowi *fl) 1004{ 1005 struct xfrm_policy *pol; 1006 1007 read_lock_bh(&xfrm_policy_lock); 1008 if ((pol = sk->sk_policy[dir]) != NULL) { 1009 int match = xfrm_selector_match(&pol->selector, fl, 1010 sk->sk_family); 1011 int err = 0; 1012 1013 if (match) { 1014 if ((sk->sk_mark & pol->mark.m) != pol->mark.v) { 1015 pol = NULL; 1016 goto out; 1017 } 1018 err = security_xfrm_policy_lookup(pol->security, 1019 fl->flowi_secid, 1020 policy_to_flow_dir(dir)); 1021 if (!err) 1022 xfrm_pol_hold(pol); 1023 else if (err == -ESRCH) 1024 pol = NULL; 1025 else 1026 pol = ERR_PTR(err); 1027 } else 1028 pol = NULL; 1029 } 1030out: 1031 read_unlock_bh(&xfrm_policy_lock); 1032 return pol; 1033} 1034 1035static void __xfrm_policy_link(struct xfrm_policy *pol, int dir) 1036{ 1037 struct net *net = xp_net(pol); 1038 struct hlist_head *chain = policy_hash_bysel(net, &pol->selector, 1039 pol->family, dir); 1040 1041 list_add(&pol->walk.all, &net->xfrm.policy_all); 1042 hlist_add_head(&pol->bydst, chain); 1043 hlist_add_head(&pol->byidx, net->xfrm.policy_byidx+idx_hash(net, pol->index)); 1044 net->xfrm.policy_count[dir]++; 1045 xfrm_pol_hold(pol); 1046 1047 if (xfrm_bydst_should_resize(net, dir, NULL)) 1048 schedule_work(&net->xfrm.policy_hash_work); 1049} 1050 1051static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, 1052 int dir) 1053{ 1054 struct net *net = xp_net(pol); 1055 1056 if (hlist_unhashed(&pol->bydst)) 1057 return NULL; 1058 1059 hlist_del(&pol->bydst); 1060 hlist_del(&pol->byidx); 1061 list_del(&pol->walk.all); 1062 net->xfrm.policy_count[dir]--; 1063 1064 return pol; 1065} 1066 1067int xfrm_policy_delete(struct xfrm_policy *pol, int dir) 1068{ 1069 write_lock_bh(&xfrm_policy_lock); 1070 pol = __xfrm_policy_unlink(pol, dir); 1071 write_unlock_bh(&xfrm_policy_lock); 1072 if (pol) { 1073 xfrm_policy_kill(pol); 1074 return 0; 1075 } 1076 return -ENOENT; 1077} 1078EXPORT_SYMBOL(xfrm_policy_delete); 1079 1080int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) 1081{ 1082 struct net *net = xp_net(pol); 1083 struct xfrm_policy *old_pol; 1084 1085#ifdef CONFIG_XFRM_SUB_POLICY 1086 if (pol && pol->type != XFRM_POLICY_TYPE_MAIN) 1087 return -EINVAL; 1088#endif 1089 1090 write_lock_bh(&xfrm_policy_lock); 1091 old_pol = sk->sk_policy[dir]; 1092 sk->sk_policy[dir] = pol; 1093 if (pol) { 1094 pol->curlft.add_time = get_seconds(); 1095 pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir); 1096 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir); 1097 } 1098 if (old_pol) 1099 /* Unlinking succeeds always. This is the only function 1100 * allowed to delete or replace socket policy. 1101 */ 1102 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir); 1103 write_unlock_bh(&xfrm_policy_lock); 1104 1105 if (old_pol) { 1106 xfrm_policy_kill(old_pol); 1107 } 1108 return 0; 1109} 1110 1111static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir) 1112{ 1113 struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC); 1114 1115 if (newp) { 1116 newp->selector = old->selector; 1117 if (security_xfrm_policy_clone(old->security, 1118 &newp->security)) { 1119 kfree(newp); 1120 return NULL; /* ENOMEM */ 1121 } 1122 newp->lft = old->lft; 1123 newp->curlft = old->curlft; 1124 newp->mark = old->mark; 1125 newp->action = old->action; 1126 newp->flags = old->flags; 1127 newp->xfrm_nr = old->xfrm_nr; 1128 newp->index = old->index; 1129 newp->type = old->type; 1130 memcpy(newp->xfrm_vec, old->xfrm_vec, 1131 newp->xfrm_nr*sizeof(struct xfrm_tmpl)); 1132 write_lock_bh(&xfrm_policy_lock); 1133 __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir); 1134 write_unlock_bh(&xfrm_policy_lock); 1135 xfrm_pol_put(newp); 1136 } 1137 return newp; 1138} 1139 1140int __xfrm_sk_clone_policy(struct sock *sk) 1141{ 1142 struct xfrm_policy *p0 = sk->sk_policy[0], 1143 *p1 = sk->sk_policy[1]; 1144 1145 sk->sk_policy[0] = sk->sk_policy[1] = NULL; 1146 if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL) 1147 return -ENOMEM; 1148 if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL) 1149 return -ENOMEM; 1150 return 0; 1151} 1152 1153static int 1154xfrm_get_saddr(struct net *net, xfrm_address_t *local, xfrm_address_t *remote, 1155 unsigned short family) 1156{ 1157 int err; 1158 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1159 1160 if (unlikely(afinfo == NULL)) 1161 return -EINVAL; 1162 err = afinfo->get_saddr(net, local, remote); 1163 xfrm_policy_put_afinfo(afinfo); 1164 return err; 1165} 1166 1167/* Resolve list of templates for the flow, given policy. */ 1168 1169static int 1170xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl, 1171 struct xfrm_state **xfrm, unsigned short family) 1172{ 1173 struct net *net = xp_net(policy); 1174 int nx; 1175 int i, error; 1176 xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family); 1177 xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family); 1178 xfrm_address_t tmp; 1179 1180 for (nx=0, i = 0; i < policy->xfrm_nr; i++) { 1181 struct xfrm_state *x; 1182 xfrm_address_t *remote = daddr; 1183 xfrm_address_t *local = saddr; 1184 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i]; 1185 1186 if (tmpl->mode == XFRM_MODE_TUNNEL || 1187 tmpl->mode == XFRM_MODE_BEET) { 1188 remote = &tmpl->id.daddr; 1189 local = &tmpl->saddr; 1190 if (xfrm_addr_any(local, tmpl->encap_family)) { 1191 error = xfrm_get_saddr(net, &tmp, remote, tmpl->encap_family); 1192 if (error) 1193 goto fail; 1194 local = &tmp; 1195 } 1196 } 1197 1198 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family); 1199 1200 if (x && x->km.state == XFRM_STATE_VALID) { 1201 xfrm[nx++] = x; 1202 daddr = remote; 1203 saddr = local; 1204 continue; 1205 } 1206 if (x) { 1207 error = (x->km.state == XFRM_STATE_ERROR ? 1208 -EINVAL : -EAGAIN); 1209 xfrm_state_put(x); 1210 } 1211 else if (error == -ESRCH) 1212 error = -EAGAIN; 1213 1214 if (!tmpl->optional) 1215 goto fail; 1216 } 1217 return nx; 1218 1219fail: 1220 for (nx--; nx>=0; nx--) 1221 xfrm_state_put(xfrm[nx]); 1222 return error; 1223} 1224 1225static int 1226xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, const struct flowi *fl, 1227 struct xfrm_state **xfrm, unsigned short family) 1228{ 1229 struct xfrm_state *tp[XFRM_MAX_DEPTH]; 1230 struct xfrm_state **tpp = (npols > 1) ? tp : xfrm; 1231 int cnx = 0; 1232 int error; 1233 int ret; 1234 int i; 1235 1236 for (i = 0; i < npols; i++) { 1237 if (cnx + pols[i]->xfrm_nr >= XFRM_MAX_DEPTH) { 1238 error = -ENOBUFS; 1239 goto fail; 1240 } 1241 1242 ret = xfrm_tmpl_resolve_one(pols[i], fl, &tpp[cnx], family); 1243 if (ret < 0) { 1244 error = ret; 1245 goto fail; 1246 } else 1247 cnx += ret; 1248 } 1249 1250 /* found states are sorted for outbound processing */ 1251 if (npols > 1) 1252 xfrm_state_sort(xfrm, tpp, cnx, family); 1253 1254 return cnx; 1255 1256 fail: 1257 for (cnx--; cnx>=0; cnx--) 1258 xfrm_state_put(tpp[cnx]); 1259 return error; 1260 1261} 1262 1263/* Check that the bundle accepts the flow and its components are 1264 * still valid. 1265 */ 1266 1267static inline int xfrm_get_tos(const struct flowi *fl, int family) 1268{ 1269 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1270 int tos; 1271 1272 if (!afinfo) 1273 return -EINVAL; 1274 1275 tos = afinfo->get_tos(fl); 1276 1277 xfrm_policy_put_afinfo(afinfo); 1278 1279 return tos; 1280} 1281 1282static struct flow_cache_object *xfrm_bundle_flo_get(struct flow_cache_object *flo) 1283{ 1284 struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo); 1285 struct dst_entry *dst = &xdst->u.dst; 1286 1287 if (xdst->route == NULL) { 1288 /* Dummy bundle - if it has xfrms we were not 1289 * able to build bundle as template resolution failed. 1290 * It means we need to try again resolving. */ 1291 if (xdst->num_xfrms > 0) 1292 return NULL; 1293 } else { 1294 /* Real bundle */ 1295 if (stale_bundle(dst)) 1296 return NULL; 1297 } 1298 1299 dst_hold(dst); 1300 return flo; 1301} 1302 1303static int xfrm_bundle_flo_check(struct flow_cache_object *flo) 1304{ 1305 struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo); 1306 struct dst_entry *dst = &xdst->u.dst; 1307 1308 if (!xdst->route) 1309 return 0; 1310 if (stale_bundle(dst)) 1311 return 0; 1312 1313 return 1; 1314} 1315 1316static void xfrm_bundle_flo_delete(struct flow_cache_object *flo) 1317{ 1318 struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo); 1319 struct dst_entry *dst = &xdst->u.dst; 1320 1321 dst_free(dst); 1322} 1323 1324static const struct flow_cache_ops xfrm_bundle_fc_ops = { 1325 .get = xfrm_bundle_flo_get, 1326 .check = xfrm_bundle_flo_check, 1327 .delete = xfrm_bundle_flo_delete, 1328}; 1329 1330static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family) 1331{ 1332 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1333 struct dst_ops *dst_ops; 1334 struct xfrm_dst *xdst; 1335 1336 if (!afinfo) 1337 return ERR_PTR(-EINVAL); 1338 1339 switch (family) { 1340 case AF_INET: 1341 dst_ops = &net->xfrm.xfrm4_dst_ops; 1342 break; 1343#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1344 case AF_INET6: 1345 dst_ops = &net->xfrm.xfrm6_dst_ops; 1346 break; 1347#endif 1348 default: 1349 BUG(); 1350 } 1351 xdst = dst_alloc(dst_ops, NULL, 0, 0, 0); 1352 memset(&xdst->u.rt6.rt6i_table, 0, sizeof(*xdst) - sizeof(struct dst_entry)); 1353 xfrm_policy_put_afinfo(afinfo); 1354 1355 if (likely(xdst)) 1356 xdst->flo.ops = &xfrm_bundle_fc_ops; 1357 else 1358 xdst = ERR_PTR(-ENOBUFS); 1359 1360 return xdst; 1361} 1362 1363static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst, 1364 int nfheader_len) 1365{ 1366 struct xfrm_policy_afinfo *afinfo = 1367 xfrm_policy_get_afinfo(dst->ops->family); 1368 int err; 1369 1370 if (!afinfo) 1371 return -EINVAL; 1372 1373 err = afinfo->init_path(path, dst, nfheader_len); 1374 1375 xfrm_policy_put_afinfo(afinfo); 1376 1377 return err; 1378} 1379 1380static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, 1381 const struct flowi *fl) 1382{ 1383 struct xfrm_policy_afinfo *afinfo = 1384 xfrm_policy_get_afinfo(xdst->u.dst.ops->family); 1385 int err; 1386 1387 if (!afinfo) 1388 return -EINVAL; 1389 1390 err = afinfo->fill_dst(xdst, dev, fl); 1391 1392 xfrm_policy_put_afinfo(afinfo); 1393 1394 return err; 1395} 1396 1397 1398/* Allocate chain of dst_entry's, attach known xfrm's, calculate 1399 * all the metrics... Shortly, bundle a bundle. 1400 */ 1401 1402static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, 1403 struct xfrm_state **xfrm, int nx, 1404 const struct flowi *fl, 1405 struct dst_entry *dst) 1406{ 1407 struct net *net = xp_net(policy); 1408 unsigned long now = jiffies; 1409 struct net_device *dev; 1410 struct dst_entry *dst_prev = NULL; 1411 struct dst_entry *dst0 = NULL; 1412 int i = 0; 1413 int err; 1414 int header_len = 0; 1415 int nfheader_len = 0; 1416 int trailer_len = 0; 1417 int tos; 1418 int family = policy->selector.family; 1419 xfrm_address_t saddr, daddr; 1420 1421 xfrm_flowi_addr_get(fl, &saddr, &daddr, family); 1422 1423 tos = xfrm_get_tos(fl, family); 1424 err = tos; 1425 if (tos < 0) 1426 goto put_states; 1427 1428 dst_hold(dst); 1429 1430 for (; i < nx; i++) { 1431 struct xfrm_dst *xdst = xfrm_alloc_dst(net, family); 1432 struct dst_entry *dst1 = &xdst->u.dst; 1433 1434 err = PTR_ERR(xdst); 1435 if (IS_ERR(xdst)) { 1436 dst_release(dst); 1437 goto put_states; 1438 } 1439 1440 if (!dst_prev) 1441 dst0 = dst1; 1442 else { 1443 dst_prev->child = dst_clone(dst1); 1444 dst1->flags |= DST_NOHASH; 1445 } 1446 1447 xdst->route = dst; 1448 dst_copy_metrics(dst1, dst); 1449 1450 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) { 1451 family = xfrm[i]->props.family; 1452 dst = xfrm_dst_lookup(xfrm[i], tos, &saddr, &daddr, 1453 family); 1454 err = PTR_ERR(dst); 1455 if (IS_ERR(dst)) 1456 goto put_states; 1457 } else 1458 dst_hold(dst); 1459 1460 dst1->xfrm = xfrm[i]; 1461 xdst->xfrm_genid = xfrm[i]->genid; 1462 1463 dst1->obsolete = -1; 1464 dst1->flags |= DST_HOST; 1465 dst1->lastuse = now; 1466 1467 dst1->input = dst_discard; 1468 dst1->output = xfrm[i]->outer_mode->afinfo->output; 1469 1470 dst1->next = dst_prev; 1471 dst_prev = dst1; 1472 1473 header_len += xfrm[i]->props.header_len; 1474 if (xfrm[i]->type->flags & XFRM_TYPE_NON_FRAGMENT) 1475 nfheader_len += xfrm[i]->props.header_len; 1476 trailer_len += xfrm[i]->props.trailer_len; 1477 } 1478 1479 dst_prev->child = dst; 1480 dst0->path = dst; 1481 1482 err = -ENODEV; 1483 dev = dst->dev; 1484 if (!dev) 1485 goto free_dst; 1486 1487 /* Copy neighbour for reachability confirmation */ 1488 dst0->neighbour = neigh_clone(dst->neighbour); 1489 1490 xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len); 1491 xfrm_init_pmtu(dst_prev); 1492 1493 for (dst_prev = dst0; dst_prev != dst; dst_prev = dst_prev->child) { 1494 struct xfrm_dst *xdst = (struct xfrm_dst *)dst_prev; 1495 1496 err = xfrm_fill_dst(xdst, dev, fl); 1497 if (err) 1498 goto free_dst; 1499 1500 dst_prev->header_len = header_len; 1501 dst_prev->trailer_len = trailer_len; 1502 header_len -= xdst->u.dst.xfrm->props.header_len; 1503 trailer_len -= xdst->u.dst.xfrm->props.trailer_len; 1504 } 1505 1506out: 1507 return dst0; 1508 1509put_states: 1510 for (; i < nx; i++) 1511 xfrm_state_put(xfrm[i]); 1512free_dst: 1513 if (dst0) 1514 dst_free(dst0); 1515 dst0 = ERR_PTR(err); 1516 goto out; 1517} 1518 1519static int inline 1520xfrm_dst_alloc_copy(void **target, const void *src, int size) 1521{ 1522 if (!*target) { 1523 *target = kmalloc(size, GFP_ATOMIC); 1524 if (!*target) 1525 return -ENOMEM; 1526 } 1527 memcpy(*target, src, size); 1528 return 0; 1529} 1530 1531static int inline 1532xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel) 1533{ 1534#ifdef CONFIG_XFRM_SUB_POLICY 1535 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1536 return xfrm_dst_alloc_copy((void **)&(xdst->partner), 1537 sel, sizeof(*sel)); 1538#else 1539 return 0; 1540#endif 1541} 1542 1543static int inline 1544xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl) 1545{ 1546#ifdef CONFIG_XFRM_SUB_POLICY 1547 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1548 return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl)); 1549#else 1550 return 0; 1551#endif 1552} 1553 1554static int xfrm_expand_policies(const struct flowi *fl, u16 family, 1555 struct xfrm_policy **pols, 1556 int *num_pols, int *num_xfrms) 1557{ 1558 int i; 1559 1560 if (*num_pols == 0 || !pols[0]) { 1561 *num_pols = 0; 1562 *num_xfrms = 0; 1563 return 0; 1564 } 1565 if (IS_ERR(pols[0])) 1566 return PTR_ERR(pols[0]); 1567 1568 *num_xfrms = pols[0]->xfrm_nr; 1569 1570#ifdef CONFIG_XFRM_SUB_POLICY 1571 if (pols[0] && pols[0]->action == XFRM_POLICY_ALLOW && 1572 pols[0]->type != XFRM_POLICY_TYPE_MAIN) { 1573 pols[1] = xfrm_policy_lookup_bytype(xp_net(pols[0]), 1574 XFRM_POLICY_TYPE_MAIN, 1575 fl, family, 1576 XFRM_POLICY_OUT); 1577 if (pols[1]) { 1578 if (IS_ERR(pols[1])) { 1579 xfrm_pols_put(pols, *num_pols); 1580 return PTR_ERR(pols[1]); 1581 } 1582 (*num_pols) ++; 1583 (*num_xfrms) += pols[1]->xfrm_nr; 1584 } 1585 } 1586#endif 1587 for (i = 0; i < *num_pols; i++) { 1588 if (pols[i]->action != XFRM_POLICY_ALLOW) { 1589 *num_xfrms = -1; 1590 break; 1591 } 1592 } 1593 1594 return 0; 1595 1596} 1597 1598static struct xfrm_dst * 1599xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, 1600 const struct flowi *fl, u16 family, 1601 struct dst_entry *dst_orig) 1602{ 1603 struct net *net = xp_net(pols[0]); 1604 struct xfrm_state *xfrm[XFRM_MAX_DEPTH]; 1605 struct dst_entry *dst; 1606 struct xfrm_dst *xdst; 1607 int err; 1608 1609 /* Try to instantiate a bundle */ 1610 err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); 1611 if (err <= 0) { 1612 if (err != 0 && err != -EAGAIN) 1613 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); 1614 return ERR_PTR(err); 1615 } 1616 1617 dst = xfrm_bundle_create(pols[0], xfrm, err, fl, dst_orig); 1618 if (IS_ERR(dst)) { 1619 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLEGENERROR); 1620 return ERR_CAST(dst); 1621 } 1622 1623 xdst = (struct xfrm_dst *)dst; 1624 xdst->num_xfrms = err; 1625 if (num_pols > 1) 1626 err = xfrm_dst_update_parent(dst, &pols[1]->selector); 1627 else 1628 err = xfrm_dst_update_origin(dst, fl); 1629 if (unlikely(err)) { 1630 dst_free(dst); 1631 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1632 return ERR_PTR(err); 1633 } 1634 1635 xdst->num_pols = num_pols; 1636 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols); 1637 xdst->policy_genid = atomic_read(&pols[0]->genid); 1638 1639 return xdst; 1640} 1641 1642static struct flow_cache_object * 1643xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir, 1644 struct flow_cache_object *oldflo, void *ctx) 1645{ 1646 struct dst_entry *dst_orig = (struct dst_entry *)ctx; 1647 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1648 struct xfrm_dst *xdst, *new_xdst; 1649 int num_pols = 0, num_xfrms = 0, i, err, pol_dead; 1650 1651 /* Check if the policies from old bundle are usable */ 1652 xdst = NULL; 1653 if (oldflo) { 1654 xdst = container_of(oldflo, struct xfrm_dst, flo); 1655 num_pols = xdst->num_pols; 1656 num_xfrms = xdst->num_xfrms; 1657 pol_dead = 0; 1658 for (i = 0; i < num_pols; i++) { 1659 pols[i] = xdst->pols[i]; 1660 pol_dead |= pols[i]->walk.dead; 1661 } 1662 if (pol_dead) { 1663 dst_free(&xdst->u.dst); 1664 xdst = NULL; 1665 num_pols = 0; 1666 num_xfrms = 0; 1667 oldflo = NULL; 1668 } 1669 } 1670 1671 /* Resolve policies to use if we couldn't get them from 1672 * previous cache entry */ 1673 if (xdst == NULL) { 1674 num_pols = 1; 1675 pols[0] = __xfrm_policy_lookup(net, fl, family, dir); 1676 err = xfrm_expand_policies(fl, family, pols, 1677 &num_pols, &num_xfrms); 1678 if (err < 0) 1679 goto inc_error; 1680 if (num_pols == 0) 1681 return NULL; 1682 if (num_xfrms <= 0) 1683 goto make_dummy_bundle; 1684 } 1685 1686 new_xdst = xfrm_resolve_and_create_bundle(pols, num_pols, fl, family, dst_orig); 1687 if (IS_ERR(new_xdst)) { 1688 err = PTR_ERR(new_xdst); 1689 if (err != -EAGAIN) 1690 goto error; 1691 if (oldflo == NULL) 1692 goto make_dummy_bundle; 1693 dst_hold(&xdst->u.dst); 1694 return oldflo; 1695 } else if (new_xdst == NULL) { 1696 num_xfrms = 0; 1697 if (oldflo == NULL) 1698 goto make_dummy_bundle; 1699 xdst->num_xfrms = 0; 1700 dst_hold(&xdst->u.dst); 1701 return oldflo; 1702 } 1703 1704 /* Kill the previous bundle */ 1705 if (xdst) { 1706 /* The policies were stolen for newly generated bundle */ 1707 xdst->num_pols = 0; 1708 dst_free(&xdst->u.dst); 1709 } 1710 1711 /* Flow cache does not have reference, it dst_free()'s, 1712 * but we do need to return one reference for original caller */ 1713 dst_hold(&new_xdst->u.dst); 1714 return &new_xdst->flo; 1715 1716make_dummy_bundle: 1717 /* We found policies, but there's no bundles to instantiate: 1718 * either because the policy blocks, has no transformations or 1719 * we could not build template (no xfrm_states).*/ 1720 xdst = xfrm_alloc_dst(net, family); 1721 if (IS_ERR(xdst)) { 1722 xfrm_pols_put(pols, num_pols); 1723 return ERR_CAST(xdst); 1724 } 1725 xdst->num_pols = num_pols; 1726 xdst->num_xfrms = num_xfrms; 1727 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols); 1728 1729 dst_hold(&xdst->u.dst); 1730 return &xdst->flo; 1731 1732inc_error: 1733 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); 1734error: 1735 if (xdst != NULL) 1736 dst_free(&xdst->u.dst); 1737 else 1738 xfrm_pols_put(pols, num_pols); 1739 return ERR_PTR(err); 1740} 1741 1742static struct dst_entry *make_blackhole(struct net *net, u16 family, 1743 struct dst_entry *dst_orig) 1744{ 1745 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1746 struct dst_entry *ret; 1747 1748 if (!afinfo) { 1749 dst_release(dst_orig); 1750 ret = ERR_PTR(-EINVAL); 1751 } else { 1752 ret = afinfo->blackhole_route(net, dst_orig); 1753 } 1754 xfrm_policy_put_afinfo(afinfo); 1755 1756 return ret; 1757} 1758 1759/* Main function: finds/creates a bundle for given flow. 1760 * 1761 * At the moment we eat a raw IP route. Mostly to speed up lookups 1762 * on interfaces with disabled IPsec. 1763 */ 1764struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig, 1765 const struct flowi *fl, 1766 struct sock *sk, int flags) 1767{ 1768 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1769 struct flow_cache_object *flo; 1770 struct xfrm_dst *xdst; 1771 struct dst_entry *dst, *route; 1772 u16 family = dst_orig->ops->family; 1773 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT); 1774 int i, err, num_pols, num_xfrms = 0, drop_pols = 0; 1775 1776restart: 1777 dst = NULL; 1778 xdst = NULL; 1779 route = NULL; 1780 1781 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { 1782 num_pols = 1; 1783 pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); 1784 err = xfrm_expand_policies(fl, family, pols, 1785 &num_pols, &num_xfrms); 1786 if (err < 0) 1787 goto dropdst; 1788 1789 if (num_pols) { 1790 if (num_xfrms <= 0) { 1791 drop_pols = num_pols; 1792 goto no_transform; 1793 } 1794 1795 xdst = xfrm_resolve_and_create_bundle( 1796 pols, num_pols, fl, 1797 family, dst_orig); 1798 if (IS_ERR(xdst)) { 1799 xfrm_pols_put(pols, num_pols); 1800 err = PTR_ERR(xdst); 1801 goto dropdst; 1802 } else if (xdst == NULL) { 1803 num_xfrms = 0; 1804 drop_pols = num_pols; 1805 goto no_transform; 1806 } 1807 1808 dst_hold(&xdst->u.dst); 1809 1810 spin_lock_bh(&xfrm_policy_sk_bundle_lock); 1811 xdst->u.dst.next = xfrm_policy_sk_bundles; 1812 xfrm_policy_sk_bundles = &xdst->u.dst; 1813 spin_unlock_bh(&xfrm_policy_sk_bundle_lock); 1814 1815 route = xdst->route; 1816 } 1817 } 1818 1819 if (xdst == NULL) { 1820 /* To accelerate a bit... */ 1821 if ((dst_orig->flags & DST_NOXFRM) || 1822 !net->xfrm.policy_count[XFRM_POLICY_OUT]) 1823 goto nopol; 1824 1825 flo = flow_cache_lookup(net, fl, family, dir, 1826 xfrm_bundle_lookup, dst_orig); 1827 if (flo == NULL) 1828 goto nopol; 1829 if (IS_ERR(flo)) { 1830 err = PTR_ERR(flo); 1831 goto dropdst; 1832 } 1833 xdst = container_of(flo, struct xfrm_dst, flo); 1834 1835 num_pols = xdst->num_pols; 1836 num_xfrms = xdst->num_xfrms; 1837 memcpy(pols, xdst->pols, sizeof(struct xfrm_policy*) * num_pols); 1838 route = xdst->route; 1839 } 1840 1841 dst = &xdst->u.dst; 1842 if (route == NULL && num_xfrms > 0) { 1843 /* The only case when xfrm_bundle_lookup() returns a 1844 * bundle with null route, is when the template could 1845 * not be resolved. It means policies are there, but 1846 * bundle could not be created, since we don't yet 1847 * have the xfrm_state's. We need to wait for KM to 1848 * negotiate new SA's or bail out with error.*/ 1849 if (net->xfrm.sysctl_larval_drop) { 1850 /* EREMOTE tells the caller to generate 1851 * a one-shot blackhole route. */ 1852 dst_release(dst); 1853 xfrm_pols_put(pols, drop_pols); 1854 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1855 1856 return make_blackhole(net, family, dst_orig); 1857 } 1858 if (fl->flowi_flags & FLOWI_FLAG_CAN_SLEEP) { 1859 DECLARE_WAITQUEUE(wait, current); 1860 1861 add_wait_queue(&net->xfrm.km_waitq, &wait); 1862 set_current_state(TASK_INTERRUPTIBLE); 1863 schedule(); 1864 set_current_state(TASK_RUNNING); 1865 remove_wait_queue(&net->xfrm.km_waitq, &wait); 1866 1867 if (!signal_pending(current)) { 1868 dst_release(dst); 1869 goto restart; 1870 } 1871 1872 err = -ERESTART; 1873 } else 1874 err = -EAGAIN; 1875 1876 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1877 goto error; 1878 } 1879 1880no_transform: 1881 if (num_pols == 0) 1882 goto nopol; 1883 1884 if ((flags & XFRM_LOOKUP_ICMP) && 1885 !(pols[0]->flags & XFRM_POLICY_ICMP)) { 1886 err = -ENOENT; 1887 goto error; 1888 } 1889 1890 for (i = 0; i < num_pols; i++) 1891 pols[i]->curlft.use_time = get_seconds(); 1892 1893 if (num_xfrms < 0) { 1894 /* Prohibit the flow */ 1895 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLBLOCK); 1896 err = -EPERM; 1897 goto error; 1898 } else if (num_xfrms > 0) { 1899 /* Flow transformed */ 1900 dst_release(dst_orig); 1901 } else { 1902 /* Flow passes untransformed */ 1903 dst_release(dst); 1904 dst = dst_orig; 1905 } 1906ok: 1907 xfrm_pols_put(pols, drop_pols); 1908 return dst; 1909 1910nopol: 1911 if (!(flags & XFRM_LOOKUP_ICMP)) { 1912 dst = dst_orig; 1913 goto ok; 1914 } 1915 err = -ENOENT; 1916error: 1917 dst_release(dst); 1918dropdst: 1919 dst_release(dst_orig); 1920 xfrm_pols_put(pols, drop_pols); 1921 return ERR_PTR(err); 1922} 1923EXPORT_SYMBOL(xfrm_lookup); 1924 1925static inline int 1926xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl) 1927{ 1928 struct xfrm_state *x; 1929 1930 if (!skb->sp || idx < 0 || idx >= skb->sp->len) 1931 return 0; 1932 x = skb->sp->xvec[idx]; 1933 if (!x->type->reject) 1934 return 0; 1935 return x->type->reject(x, skb, fl); 1936} 1937 1938/* When skb is transformed back to its "native" form, we have to 1939 * check policy restrictions. At the moment we make this in maximally 1940 * stupid way. Shame on me. :-) Of course, connected sockets must 1941 * have policy cached at them. 1942 */ 1943 1944static inline int 1945xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, 1946 unsigned short family) 1947{ 1948 if (xfrm_state_kern(x)) 1949 return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family); 1950 return x->id.proto == tmpl->id.proto && 1951 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) && 1952 (x->props.reqid == tmpl->reqid || !tmpl->reqid) && 1953 x->props.mode == tmpl->mode && 1954 (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) || 1955 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) && 1956 !(x->props.mode != XFRM_MODE_TRANSPORT && 1957 xfrm_state_addr_cmp(tmpl, x, family)); 1958} 1959 1960/* 1961 * 0 or more than 0 is returned when validation is succeeded (either bypass 1962 * because of optional transport mode, or next index of the mathced secpath 1963 * state with the template. 1964 * -1 is returned when no matching template is found. 1965 * Otherwise "-2 - errored_index" is returned. 1966 */ 1967static inline int 1968xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start, 1969 unsigned short family) 1970{ 1971 int idx = start; 1972 1973 if (tmpl->optional) { 1974 if (tmpl->mode == XFRM_MODE_TRANSPORT) 1975 return start; 1976 } else 1977 start = -1; 1978 for (; idx < sp->len; idx++) { 1979 if (xfrm_state_ok(tmpl, sp->xvec[idx], family)) 1980 return ++idx; 1981 if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) { 1982 if (start == -1) 1983 start = -2-idx; 1984 break; 1985 } 1986 } 1987 return start; 1988} 1989 1990int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1991 unsigned int family, int reverse) 1992{ 1993 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1994 int err; 1995 1996 if (unlikely(afinfo == NULL)) 1997 return -EAFNOSUPPORT; 1998 1999 afinfo->decode_session(skb, fl, reverse); 2000 err = security_xfrm_decode_session(skb, &fl->flowi_secid); 2001 xfrm_policy_put_afinfo(afinfo); 2002 return err; 2003} 2004EXPORT_SYMBOL(__xfrm_decode_session); 2005 2006static inline int secpath_has_nontransport(const struct sec_path *sp, int k, int *idxp) 2007{ 2008 for (; k < sp->len; k++) { 2009 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) { 2010 *idxp = k; 2011 return 1; 2012 } 2013 } 2014 2015 return 0; 2016} 2017 2018int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, 2019 unsigned short family) 2020{ 2021 struct net *net = dev_net(skb->dev); 2022 struct xfrm_policy *pol; 2023 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 2024 int npols = 0; 2025 int xfrm_nr; 2026 int pi; 2027 int reverse; 2028 struct flowi fl; 2029 u8 fl_dir; 2030 int xerr_idx = -1; 2031 2032 reverse = dir & ~XFRM_POLICY_MASK; 2033 dir &= XFRM_POLICY_MASK; 2034 fl_dir = policy_to_flow_dir(dir); 2035 2036 if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) { 2037 XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR); 2038 return 0; 2039 } 2040 2041 nf_nat_decode_session(skb, &fl, family); 2042 2043 /* First, check used SA against their selectors. */ 2044 if (skb->sp) { 2045 int i; 2046 2047 for (i=skb->sp->len-1; i>=0; i--) { 2048 struct xfrm_state *x = skb->sp->xvec[i]; 2049 if (!xfrm_selector_match(&x->sel, &fl, family)) { 2050 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH); 2051 return 0; 2052 } 2053 } 2054 } 2055 2056 pol = NULL; 2057 if (sk && sk->sk_policy[dir]) { 2058 pol = xfrm_sk_policy_lookup(sk, dir, &fl); 2059 if (IS_ERR(pol)) { 2060 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 2061 return 0; 2062 } 2063 } 2064 2065 if (!pol) { 2066 struct flow_cache_object *flo; 2067 2068 flo = flow_cache_lookup(net, &fl, family, fl_dir, 2069 xfrm_policy_lookup, NULL); 2070 if (IS_ERR_OR_NULL(flo)) 2071 pol = ERR_CAST(flo); 2072 else 2073 pol = container_of(flo, struct xfrm_policy, flo); 2074 } 2075 2076 if (IS_ERR(pol)) { 2077 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 2078 return 0; 2079 } 2080 2081 if (!pol) { 2082 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) { 2083 xfrm_secpath_reject(xerr_idx, skb, &fl); 2084 XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS); 2085 return 0; 2086 } 2087 return 1; 2088 } 2089 2090 pol->curlft.use_time = get_seconds(); 2091 2092 pols[0] = pol; 2093 npols ++; 2094#ifdef CONFIG_XFRM_SUB_POLICY 2095 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) { 2096 pols[1] = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, 2097 &fl, family, 2098 XFRM_POLICY_IN); 2099 if (pols[1]) { 2100 if (IS_ERR(pols[1])) { 2101 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 2102 return 0; 2103 } 2104 pols[1]->curlft.use_time = get_seconds(); 2105 npols ++; 2106 } 2107 } 2108#endif 2109 2110 if (pol->action == XFRM_POLICY_ALLOW) { 2111 struct sec_path *sp; 2112 static struct sec_path dummy; 2113 struct xfrm_tmpl *tp[XFRM_MAX_DEPTH]; 2114 struct xfrm_tmpl *stp[XFRM_MAX_DEPTH]; 2115 struct xfrm_tmpl **tpp = tp; 2116 int ti = 0; 2117 int i, k; 2118 2119 if ((sp = skb->sp) == NULL) 2120 sp = &dummy; 2121 2122 for (pi = 0; pi < npols; pi++) { 2123 if (pols[pi] != pol && 2124 pols[pi]->action != XFRM_POLICY_ALLOW) { 2125 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK); 2126 goto reject; 2127 } 2128 if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) { 2129 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 2130 goto reject_error; 2131 } 2132 for (i = 0; i < pols[pi]->xfrm_nr; i++) 2133 tpp[ti++] = &pols[pi]->xfrm_vec[i]; 2134 } 2135 xfrm_nr = ti; 2136 if (npols > 1) { 2137 xfrm_tmpl_sort(stp, tpp, xfrm_nr, family); 2138 tpp = stp; 2139 } 2140 2141 /* For each tunnel xfrm, find the first matching tmpl. 2142 * For each tmpl before that, find corresponding xfrm. 2143 * Order is _important_. Later we will implement 2144 * some barriers, but at the moment barriers 2145 * are implied between each two transformations. 2146 */ 2147 for (i = xfrm_nr-1, k = 0; i >= 0; i--) { 2148 k = xfrm_policy_ok(tpp[i], sp, k, family); 2149 if (k < 0) { 2150 if (k < -1) 2151 /* "-2 - errored_index" returned */ 2152 xerr_idx = -(2+k); 2153 XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH); 2154 goto reject; 2155 } 2156 } 2157 2158 if (secpath_has_nontransport(sp, k, &xerr_idx)) { 2159 XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH); 2160 goto reject; 2161 } 2162 2163 xfrm_pols_put(pols, npols); 2164 return 1; 2165 } 2166 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK); 2167 2168reject: 2169 xfrm_secpath_reject(xerr_idx, skb, &fl); 2170reject_error: 2171 xfrm_pols_put(pols, npols); 2172 return 0; 2173} 2174EXPORT_SYMBOL(__xfrm_policy_check); 2175 2176int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) 2177{ 2178 struct net *net = dev_net(skb->dev); 2179 struct flowi fl; 2180 struct dst_entry *dst; 2181 int res = 1; 2182 2183 if (xfrm_decode_session(skb, &fl, family) < 0) { 2184 XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR); 2185 return 0; 2186 } 2187 2188 skb_dst_force(skb); 2189 2190 dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, 0); 2191 if (IS_ERR(dst)) { 2192 res = 0; 2193 dst = NULL; 2194 } 2195 skb_dst_set(skb, dst); 2196 return res; 2197} 2198EXPORT_SYMBOL(__xfrm_route_forward); 2199 2200/* Optimize later using cookies and generation ids. */ 2201 2202static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie) 2203{ 2204 /* Code (such as __xfrm4_bundle_create()) sets dst->obsolete 2205 * to "-1" to force all XFRM destinations to get validated by 2206 * dst_ops->check on every use. We do this because when a 2207 * normal route referenced by an XFRM dst is obsoleted we do 2208 * not go looking around for all parent referencing XFRM dsts 2209 * so that we can invalidate them. It is just too much work. 2210 * Instead we make the checks here on every use. For example: 2211 * 2212 * XFRM dst A --> IPv4 dst X 2213 * 2214 * X is the "xdst->route" of A (X is also the "dst->path" of A 2215 * in this example). If X is marked obsolete, "A" will not 2216 * notice. That's what we are validating here via the 2217 * stale_bundle() check. 2218 * 2219 * When a policy's bundle is pruned, we dst_free() the XFRM 2220 * dst which causes it's ->obsolete field to be set to a 2221 * positive non-zero integer. If an XFRM dst has been pruned 2222 * like this, we want to force a new route lookup. 2223 */ 2224 if (dst->obsolete < 0 && !stale_bundle(dst)) 2225 return dst; 2226 2227 return NULL; 2228} 2229 2230static int stale_bundle(struct dst_entry *dst) 2231{ 2232 return !xfrm_bundle_ok((struct xfrm_dst *)dst, AF_UNSPEC); 2233} 2234 2235void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev) 2236{ 2237 while ((dst = dst->child) && dst->xfrm && dst->dev == dev) { 2238 dst->dev = dev_net(dev)->loopback_dev; 2239 dev_hold(dst->dev); 2240 dev_put(dev); 2241 } 2242} 2243EXPORT_SYMBOL(xfrm_dst_ifdown); 2244 2245static void xfrm_link_failure(struct sk_buff *skb) 2246{ 2247 /* Impossible. Such dst must be popped before reaches point of failure. */ 2248} 2249 2250static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst) 2251{ 2252 if (dst) { 2253 if (dst->obsolete) { 2254 dst_release(dst); 2255 dst = NULL; 2256 } 2257 } 2258 return dst; 2259} 2260 2261static void __xfrm_garbage_collect(struct net *net) 2262{ 2263 struct dst_entry *head, *next; 2264 2265 flow_cache_flush(); 2266 2267 spin_lock_bh(&xfrm_policy_sk_bundle_lock); 2268 head = xfrm_policy_sk_bundles; 2269 xfrm_policy_sk_bundles = NULL; 2270 spin_unlock_bh(&xfrm_policy_sk_bundle_lock); 2271 2272 while (head) { 2273 next = head->next; 2274 dst_free(head); 2275 head = next; 2276 } 2277} 2278 2279static void xfrm_init_pmtu(struct dst_entry *dst) 2280{ 2281 do { 2282 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 2283 u32 pmtu, route_mtu_cached; 2284 2285 pmtu = dst_mtu(dst->child); 2286 xdst->child_mtu_cached = pmtu; 2287 2288 pmtu = xfrm_state_mtu(dst->xfrm, pmtu); 2289 2290 route_mtu_cached = dst_mtu(xdst->route); 2291 xdst->route_mtu_cached = route_mtu_cached; 2292 2293 if (pmtu > route_mtu_cached) 2294 pmtu = route_mtu_cached; 2295 2296 dst_metric_set(dst, RTAX_MTU, pmtu); 2297 } while ((dst = dst->next)); 2298} 2299 2300/* Check that the bundle accepts the flow and its components are 2301 * still valid. 2302 */ 2303 2304static int xfrm_bundle_ok(struct xfrm_dst *first, int family) 2305{ 2306 struct dst_entry *dst = &first->u.dst; 2307 struct xfrm_dst *last; 2308 u32 mtu; 2309 2310 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) || 2311 (dst->dev && !netif_running(dst->dev))) 2312 return 0; 2313 2314 last = NULL; 2315 2316 do { 2317 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 2318 2319 if (dst->xfrm->km.state != XFRM_STATE_VALID) 2320 return 0; 2321 if (xdst->xfrm_genid != dst->xfrm->genid) 2322 return 0; 2323 if (xdst->num_pols > 0 && 2324 xdst->policy_genid != atomic_read(&xdst->pols[0]->genid)) 2325 return 0; 2326 2327 mtu = dst_mtu(dst->child); 2328 if (xdst->child_mtu_cached != mtu) { 2329 last = xdst; 2330 xdst->child_mtu_cached = mtu; 2331 } 2332 2333 if (!dst_check(xdst->route, xdst->route_cookie)) 2334 return 0; 2335 mtu = dst_mtu(xdst->route); 2336 if (xdst->route_mtu_cached != mtu) { 2337 last = xdst; 2338 xdst->route_mtu_cached = mtu; 2339 } 2340 2341 dst = dst->child; 2342 } while (dst->xfrm); 2343 2344 if (likely(!last)) 2345 return 1; 2346 2347 mtu = last->child_mtu_cached; 2348 for (;;) { 2349 dst = &last->u.dst; 2350 2351 mtu = xfrm_state_mtu(dst->xfrm, mtu); 2352 if (mtu > last->route_mtu_cached) 2353 mtu = last->route_mtu_cached; 2354 dst_metric_set(dst, RTAX_MTU, mtu); 2355 2356 if (last == first) 2357 break; 2358 2359 last = (struct xfrm_dst *)last->u.dst.next; 2360 last->child_mtu_cached = mtu; 2361 } 2362 2363 return 1; 2364} 2365 2366static unsigned int xfrm_default_advmss(const struct dst_entry *dst) 2367{ 2368 return dst_metric_advmss(dst->path); 2369} 2370 2371static unsigned int xfrm_default_mtu(const struct dst_entry *dst) 2372{ 2373 return dst_mtu(dst->path); 2374} 2375 2376int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo) 2377{ 2378 struct net *net; 2379 int err = 0; 2380 if (unlikely(afinfo == NULL)) 2381 return -EINVAL; 2382 if (unlikely(afinfo->family >= NPROTO)) 2383 return -EAFNOSUPPORT; 2384 write_lock_bh(&xfrm_policy_afinfo_lock); 2385 if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL)) 2386 err = -ENOBUFS; 2387 else { 2388 struct dst_ops *dst_ops = afinfo->dst_ops; 2389 if (likely(dst_ops->kmem_cachep == NULL)) 2390 dst_ops->kmem_cachep = xfrm_dst_cache; 2391 if (likely(dst_ops->check == NULL)) 2392 dst_ops->check = xfrm_dst_check; 2393 if (likely(dst_ops->default_advmss == NULL)) 2394 dst_ops->default_advmss = xfrm_default_advmss; 2395 if (likely(dst_ops->default_mtu == NULL)) 2396 dst_ops->default_mtu = xfrm_default_mtu; 2397 if (likely(dst_ops->negative_advice == NULL)) 2398 dst_ops->negative_advice = xfrm_negative_advice; 2399 if (likely(dst_ops->link_failure == NULL)) 2400 dst_ops->link_failure = xfrm_link_failure; 2401 if (likely(afinfo->garbage_collect == NULL)) 2402 afinfo->garbage_collect = __xfrm_garbage_collect; 2403 xfrm_policy_afinfo[afinfo->family] = afinfo; 2404 } 2405 write_unlock_bh(&xfrm_policy_afinfo_lock); 2406 2407 rtnl_lock(); 2408 for_each_net(net) { 2409 struct dst_ops *xfrm_dst_ops; 2410 2411 switch (afinfo->family) { 2412 case AF_INET: 2413 xfrm_dst_ops = &net->xfrm.xfrm4_dst_ops; 2414 break; 2415#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2416 case AF_INET6: 2417 xfrm_dst_ops = &net->xfrm.xfrm6_dst_ops; 2418 break; 2419#endif 2420 default: 2421 BUG(); 2422 } 2423 *xfrm_dst_ops = *afinfo->dst_ops; 2424 } 2425 rtnl_unlock(); 2426 2427 return err; 2428} 2429EXPORT_SYMBOL(xfrm_policy_register_afinfo); 2430 2431int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo) 2432{ 2433 int err = 0; 2434 if (unlikely(afinfo == NULL)) 2435 return -EINVAL; 2436 if (unlikely(afinfo->family >= NPROTO)) 2437 return -EAFNOSUPPORT; 2438 write_lock_bh(&xfrm_policy_afinfo_lock); 2439 if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) { 2440 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo)) 2441 err = -EINVAL; 2442 else { 2443 struct dst_ops *dst_ops = afinfo->dst_ops; 2444 xfrm_policy_afinfo[afinfo->family] = NULL; 2445 dst_ops->kmem_cachep = NULL; 2446 dst_ops->check = NULL; 2447 dst_ops->negative_advice = NULL; 2448 dst_ops->link_failure = NULL; 2449 afinfo->garbage_collect = NULL; 2450 } 2451 } 2452 write_unlock_bh(&xfrm_policy_afinfo_lock); 2453 return err; 2454} 2455EXPORT_SYMBOL(xfrm_policy_unregister_afinfo); 2456 2457static void __net_init xfrm_dst_ops_init(struct net *net) 2458{ 2459 struct xfrm_policy_afinfo *afinfo; 2460 2461 read_lock_bh(&xfrm_policy_afinfo_lock); 2462 afinfo = xfrm_policy_afinfo[AF_INET]; 2463 if (afinfo) 2464 net->xfrm.xfrm4_dst_ops = *afinfo->dst_ops; 2465#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2466 afinfo = xfrm_policy_afinfo[AF_INET6]; 2467 if (afinfo) 2468 net->xfrm.xfrm6_dst_ops = *afinfo->dst_ops; 2469#endif 2470 read_unlock_bh(&xfrm_policy_afinfo_lock); 2471} 2472 2473static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family) 2474{ 2475 struct xfrm_policy_afinfo *afinfo; 2476 if (unlikely(family >= NPROTO)) 2477 return NULL; 2478 read_lock(&xfrm_policy_afinfo_lock); 2479 afinfo = xfrm_policy_afinfo[family]; 2480 if (unlikely(!afinfo)) 2481 read_unlock(&xfrm_policy_afinfo_lock); 2482 return afinfo; 2483} 2484 2485static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo) 2486{ 2487 read_unlock(&xfrm_policy_afinfo_lock); 2488} 2489 2490static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr) 2491{ 2492 struct net_device *dev = ptr; 2493 2494 switch (event) { 2495 case NETDEV_DOWN: 2496 __xfrm_garbage_collect(dev_net(dev)); 2497 } 2498 return NOTIFY_DONE; 2499} 2500 2501static struct notifier_block xfrm_dev_notifier = { 2502 .notifier_call = xfrm_dev_event, 2503}; 2504 2505#ifdef CONFIG_XFRM_STATISTICS 2506static int __net_init xfrm_statistics_init(struct net *net) 2507{ 2508 int rv; 2509 2510 if (snmp_mib_init((void __percpu **)net->mib.xfrm_statistics, 2511 sizeof(struct linux_xfrm_mib), 2512 __alignof__(struct linux_xfrm_mib)) < 0) 2513 return -ENOMEM; 2514 rv = xfrm_proc_init(net); 2515 if (rv < 0) 2516 snmp_mib_free((void __percpu **)net->mib.xfrm_statistics); 2517 return rv; 2518} 2519 2520static void xfrm_statistics_fini(struct net *net) 2521{ 2522 xfrm_proc_fini(net); 2523 snmp_mib_free((void __percpu **)net->mib.xfrm_statistics); 2524} 2525#else 2526static int __net_init xfrm_statistics_init(struct net *net) 2527{ 2528 return 0; 2529} 2530 2531static void xfrm_statistics_fini(struct net *net) 2532{ 2533} 2534#endif 2535 2536static int __net_init xfrm_policy_init(struct net *net) 2537{ 2538 unsigned int hmask, sz; 2539 int dir; 2540 2541 if (net_eq(net, &init_net)) 2542 xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache", 2543 sizeof(struct xfrm_dst), 2544 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, 2545 NULL); 2546 2547 hmask = 8 - 1; 2548 sz = (hmask+1) * sizeof(struct hlist_head); 2549 2550 net->xfrm.policy_byidx = xfrm_hash_alloc(sz); 2551 if (!net->xfrm.policy_byidx) 2552 goto out_byidx; 2553 net->xfrm.policy_idx_hmask = hmask; 2554 2555 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 2556 struct xfrm_policy_hash *htab; 2557 2558 net->xfrm.policy_count[dir] = 0; 2559 INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]); 2560 2561 htab = &net->xfrm.policy_bydst[dir]; 2562 htab->table = xfrm_hash_alloc(sz); 2563 if (!htab->table) 2564 goto out_bydst; 2565 htab->hmask = hmask; 2566 } 2567 2568 INIT_LIST_HEAD(&net->xfrm.policy_all); 2569 INIT_WORK(&net->xfrm.policy_hash_work, xfrm_hash_resize); 2570 if (net_eq(net, &init_net)) 2571 register_netdevice_notifier(&xfrm_dev_notifier); 2572 return 0; 2573 2574out_bydst: 2575 for (dir--; dir >= 0; dir--) { 2576 struct xfrm_policy_hash *htab; 2577 2578 htab = &net->xfrm.policy_bydst[dir]; 2579 xfrm_hash_free(htab->table, sz); 2580 } 2581 xfrm_hash_free(net->xfrm.policy_byidx, sz); 2582out_byidx: 2583 return -ENOMEM; 2584} 2585 2586static void xfrm_policy_fini(struct net *net) 2587{ 2588 struct xfrm_audit audit_info; 2589 unsigned int sz; 2590 int dir; 2591 2592 flush_work(&net->xfrm.policy_hash_work); 2593#ifdef CONFIG_XFRM_SUB_POLICY 2594 audit_info.loginuid = -1; 2595 audit_info.sessionid = -1; 2596 audit_info.secid = 0; 2597 xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info); 2598#endif 2599 audit_info.loginuid = -1; 2600 audit_info.sessionid = -1; 2601 audit_info.secid = 0; 2602 xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info); 2603 2604 WARN_ON(!list_empty(&net->xfrm.policy_all)); 2605 2606 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 2607 struct xfrm_policy_hash *htab; 2608 2609 WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir])); 2610 2611 htab = &net->xfrm.policy_bydst[dir]; 2612 sz = (htab->hmask + 1); 2613 WARN_ON(!hlist_empty(htab->table)); 2614 xfrm_hash_free(htab->table, sz); 2615 } 2616 2617 sz = (net->xfrm.policy_idx_hmask + 1) * sizeof(struct hlist_head); 2618 WARN_ON(!hlist_empty(net->xfrm.policy_byidx)); 2619 xfrm_hash_free(net->xfrm.policy_byidx, sz); 2620} 2621 2622static int __net_init xfrm_net_init(struct net *net) 2623{ 2624 int rv; 2625 2626 rv = xfrm_statistics_init(net); 2627 if (rv < 0) 2628 goto out_statistics; 2629 rv = xfrm_state_init(net); 2630 if (rv < 0) 2631 goto out_state; 2632 rv = xfrm_policy_init(net); 2633 if (rv < 0) 2634 goto out_policy; 2635 xfrm_dst_ops_init(net); 2636 rv = xfrm_sysctl_init(net); 2637 if (rv < 0) 2638 goto out_sysctl; 2639 return 0; 2640 2641out_sysctl: 2642 xfrm_policy_fini(net); 2643out_policy: 2644 xfrm_state_fini(net); 2645out_state: 2646 xfrm_statistics_fini(net); 2647out_statistics: 2648 return rv; 2649} 2650 2651static void __net_exit xfrm_net_exit(struct net *net) 2652{ 2653 xfrm_sysctl_fini(net); 2654 xfrm_policy_fini(net); 2655 xfrm_state_fini(net); 2656 xfrm_statistics_fini(net); 2657} 2658 2659static struct pernet_operations __net_initdata xfrm_net_ops = { 2660 .init = xfrm_net_init, 2661 .exit = xfrm_net_exit, 2662}; 2663 2664void __init xfrm_init(void) 2665{ 2666 register_pernet_subsys(&xfrm_net_ops); 2667 xfrm_input_init(); 2668} 2669 2670#ifdef CONFIG_AUDITSYSCALL 2671static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp, 2672 struct audit_buffer *audit_buf) 2673{ 2674 struct xfrm_sec_ctx *ctx = xp->security; 2675 struct xfrm_selector *sel = &xp->selector; 2676 2677 if (ctx) 2678 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", 2679 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str); 2680 2681 switch(sel->family) { 2682 case AF_INET: 2683 audit_log_format(audit_buf, " src=%pI4", &sel->saddr.a4); 2684 if (sel->prefixlen_s != 32) 2685 audit_log_format(audit_buf, " src_prefixlen=%d", 2686 sel->prefixlen_s); 2687 audit_log_format(audit_buf, " dst=%pI4", &sel->daddr.a4); 2688 if (sel->prefixlen_d != 32) 2689 audit_log_format(audit_buf, " dst_prefixlen=%d", 2690 sel->prefixlen_d); 2691 break; 2692 case AF_INET6: 2693 audit_log_format(audit_buf, " src=%pI6", sel->saddr.a6); 2694 if (sel->prefixlen_s != 128) 2695 audit_log_format(audit_buf, " src_prefixlen=%d", 2696 sel->prefixlen_s); 2697 audit_log_format(audit_buf, " dst=%pI6", sel->daddr.a6); 2698 if (sel->prefixlen_d != 128) 2699 audit_log_format(audit_buf, " dst_prefixlen=%d", 2700 sel->prefixlen_d); 2701 break; 2702 } 2703} 2704 2705void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 2706 uid_t auid, u32 sessionid, u32 secid) 2707{ 2708 struct audit_buffer *audit_buf; 2709 2710 audit_buf = xfrm_audit_start("SPD-add"); 2711 if (audit_buf == NULL) 2712 return; 2713 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2714 audit_log_format(audit_buf, " res=%u", result); 2715 xfrm_audit_common_policyinfo(xp, audit_buf); 2716 audit_log_end(audit_buf); 2717} 2718EXPORT_SYMBOL_GPL(xfrm_audit_policy_add); 2719 2720void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 2721 uid_t auid, u32 sessionid, u32 secid) 2722{ 2723 struct audit_buffer *audit_buf; 2724 2725 audit_buf = xfrm_audit_start("SPD-delete"); 2726 if (audit_buf == NULL) 2727 return; 2728 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2729 audit_log_format(audit_buf, " res=%u", result); 2730 xfrm_audit_common_policyinfo(xp, audit_buf); 2731 audit_log_end(audit_buf); 2732} 2733EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete); 2734#endif 2735 2736#ifdef CONFIG_XFRM_MIGRATE 2737static int xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp, 2738 const struct xfrm_selector *sel_tgt) 2739{ 2740 if (sel_cmp->proto == IPSEC_ULPROTO_ANY) { 2741 if (sel_tgt->family == sel_cmp->family && 2742 xfrm_addr_cmp(&sel_tgt->daddr, &sel_cmp->daddr, 2743 sel_cmp->family) == 0 && 2744 xfrm_addr_cmp(&sel_tgt->saddr, &sel_cmp->saddr, 2745 sel_cmp->family) == 0 && 2746 sel_tgt->prefixlen_d == sel_cmp->prefixlen_d && 2747 sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) { 2748 return 1; 2749 } 2750 } else { 2751 if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) { 2752 return 1; 2753 } 2754 } 2755 return 0; 2756} 2757 2758static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector *sel, 2759 u8 dir, u8 type) 2760{ 2761 struct xfrm_policy *pol, *ret = NULL; 2762 struct hlist_node *entry; 2763 struct hlist_head *chain; 2764 u32 priority = ~0U; 2765 2766 read_lock_bh(&xfrm_policy_lock); 2767 chain = policy_hash_direct(&init_net, &sel->daddr, &sel->saddr, sel->family, dir); 2768 hlist_for_each_entry(pol, entry, chain, bydst) { 2769 if (xfrm_migrate_selector_match(sel, &pol->selector) && 2770 pol->type == type) { 2771 ret = pol; 2772 priority = ret->priority; 2773 break; 2774 } 2775 } 2776 chain = &init_net.xfrm.policy_inexact[dir]; 2777 hlist_for_each_entry(pol, entry, chain, bydst) { 2778 if (xfrm_migrate_selector_match(sel, &pol->selector) && 2779 pol->type == type && 2780 pol->priority < priority) { 2781 ret = pol; 2782 break; 2783 } 2784 } 2785 2786 if (ret) 2787 xfrm_pol_hold(ret); 2788 2789 read_unlock_bh(&xfrm_policy_lock); 2790 2791 return ret; 2792} 2793 2794static int migrate_tmpl_match(const struct xfrm_migrate *m, const struct xfrm_tmpl *t) 2795{ 2796 int match = 0; 2797 2798 if (t->mode == m->mode && t->id.proto == m->proto && 2799 (m->reqid == 0 || t->reqid == m->reqid)) { 2800 switch (t->mode) { 2801 case XFRM_MODE_TUNNEL: 2802 case XFRM_MODE_BEET: 2803 if (xfrm_addr_cmp(&t->id.daddr, &m->old_daddr, 2804 m->old_family) == 0 && 2805 xfrm_addr_cmp(&t->saddr, &m->old_saddr, 2806 m->old_family) == 0) { 2807 match = 1; 2808 } 2809 break; 2810 case XFRM_MODE_TRANSPORT: 2811 /* in case of transport mode, template does not store 2812 any IP addresses, hence we just compare mode and 2813 protocol */ 2814 match = 1; 2815 break; 2816 default: 2817 break; 2818 } 2819 } 2820 return match; 2821} 2822 2823/* update endpoint address(es) of template(s) */ 2824static int xfrm_policy_migrate(struct xfrm_policy *pol, 2825 struct xfrm_migrate *m, int num_migrate) 2826{ 2827 struct xfrm_migrate *mp; 2828 int i, j, n = 0; 2829 2830 write_lock_bh(&pol->lock); 2831 if (unlikely(pol->walk.dead)) { 2832 /* target policy has been deleted */ 2833 write_unlock_bh(&pol->lock); 2834 return -ENOENT; 2835 } 2836 2837 for (i = 0; i < pol->xfrm_nr; i++) { 2838 for (j = 0, mp = m; j < num_migrate; j++, mp++) { 2839 if (!migrate_tmpl_match(mp, &pol->xfrm_vec[i])) 2840 continue; 2841 n++; 2842 if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL && 2843 pol->xfrm_vec[i].mode != XFRM_MODE_BEET) 2844 continue; 2845 /* update endpoints */ 2846 memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr, 2847 sizeof(pol->xfrm_vec[i].id.daddr)); 2848 memcpy(&pol->xfrm_vec[i].saddr, &mp->new_saddr, 2849 sizeof(pol->xfrm_vec[i].saddr)); 2850 pol->xfrm_vec[i].encap_family = mp->new_family; 2851 /* flush bundles */ 2852 atomic_inc(&pol->genid); 2853 } 2854 } 2855 2856 write_unlock_bh(&pol->lock); 2857 2858 if (!n) 2859 return -ENODATA; 2860 2861 return 0; 2862} 2863 2864static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate) 2865{ 2866 int i, j; 2867 2868 if (num_migrate < 1 || num_migrate > XFRM_MAX_DEPTH) 2869 return -EINVAL; 2870 2871 for (i = 0; i < num_migrate; i++) { 2872 if ((xfrm_addr_cmp(&m[i].old_daddr, &m[i].new_daddr, 2873 m[i].old_family) == 0) && 2874 (xfrm_addr_cmp(&m[i].old_saddr, &m[i].new_saddr, 2875 m[i].old_family) == 0)) 2876 return -EINVAL; 2877 if (xfrm_addr_any(&m[i].new_daddr, m[i].new_family) || 2878 xfrm_addr_any(&m[i].new_saddr, m[i].new_family)) 2879 return -EINVAL; 2880 2881 /* check if there is any duplicated entry */ 2882 for (j = i + 1; j < num_migrate; j++) { 2883 if (!memcmp(&m[i].old_daddr, &m[j].old_daddr, 2884 sizeof(m[i].old_daddr)) && 2885 !memcmp(&m[i].old_saddr, &m[j].old_saddr, 2886 sizeof(m[i].old_saddr)) && 2887 m[i].proto == m[j].proto && 2888 m[i].mode == m[j].mode && 2889 m[i].reqid == m[j].reqid && 2890 m[i].old_family == m[j].old_family) 2891 return -EINVAL; 2892 } 2893 } 2894 2895 return 0; 2896} 2897 2898int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 2899 struct xfrm_migrate *m, int num_migrate, 2900 struct xfrm_kmaddress *k) 2901{ 2902 int i, err, nx_cur = 0, nx_new = 0; 2903 struct xfrm_policy *pol = NULL; 2904 struct xfrm_state *x, *xc; 2905 struct xfrm_state *x_cur[XFRM_MAX_DEPTH]; 2906 struct xfrm_state *x_new[XFRM_MAX_DEPTH]; 2907 struct xfrm_migrate *mp; 2908 2909 if ((err = xfrm_migrate_check(m, num_migrate)) < 0) 2910 goto out; 2911 2912 /* Stage 1 - find policy */ 2913 if ((pol = xfrm_migrate_policy_find(sel, dir, type)) == NULL) { 2914 err = -ENOENT; 2915 goto out; 2916 } 2917 2918 /* Stage 2 - find and update state(s) */ 2919 for (i = 0, mp = m; i < num_migrate; i++, mp++) { 2920 if ((x = xfrm_migrate_state_find(mp))) { 2921 x_cur[nx_cur] = x; 2922 nx_cur++; 2923 if ((xc = xfrm_state_migrate(x, mp))) { 2924 x_new[nx_new] = xc; 2925 nx_new++; 2926 } else { 2927 err = -ENODATA; 2928 goto restore_state; 2929 } 2930 } 2931 } 2932 2933 /* Stage 3 - update policy */ 2934 if ((err = xfrm_policy_migrate(pol, m, num_migrate)) < 0) 2935 goto restore_state; 2936 2937 /* Stage 4 - delete old state(s) */ 2938 if (nx_cur) { 2939 xfrm_states_put(x_cur, nx_cur); 2940 xfrm_states_delete(x_cur, nx_cur); 2941 } 2942 2943 /* Stage 5 - announce */ 2944 km_migrate(sel, dir, type, m, num_migrate, k); 2945 2946 xfrm_pol_put(pol); 2947 2948 return 0; 2949out: 2950 return err; 2951 2952restore_state: 2953 if (pol) 2954 xfrm_pol_put(pol); 2955 if (nx_cur) 2956 xfrm_states_put(x_cur, nx_cur); 2957 if (nx_new) 2958 xfrm_states_delete(x_new, nx_new); 2959 2960 return err; 2961} 2962EXPORT_SYMBOL(xfrm_migrate); 2963#endif 2964