1/* 2 * xfrm_state.c 3 * 4 * Changes: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * YOSHIFUJI Hideaki @USAGI 10 * Split up af-specific functions 11 * Derek Atkins <derek@ihtfp.com> 12 * Add UDP Encapsulation 13 * 14 */ 15 16#include <linux/workqueue.h> 17#include <net/xfrm.h> 18#include <linux/pfkeyv2.h> 19#include <linux/ipsec.h> 20#include <linux/module.h> 21#include <linux/cache.h> 22#include <linux/audit.h> 23#include <asm/uaccess.h> 24#include <linux/ktime.h> 25#include <linux/slab.h> 26#include <linux/interrupt.h> 27#include <linux/kernel.h> 28 29#include "xfrm_hash.h" 30 31/* Each xfrm_state may be linked to two tables: 32 33 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl) 34 2. Hash table by (daddr,family,reqid) to find what SAs exist for given 35 destination/tunnel endpoint. (output) 36 */ 37 38static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024; 39 40static inline unsigned int xfrm_dst_hash(struct net *net, 41 const xfrm_address_t *daddr, 42 const xfrm_address_t *saddr, 43 u32 reqid, 44 unsigned short family) 45{ 46 return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask); 47} 48 49static inline unsigned int xfrm_src_hash(struct net *net, 50 const xfrm_address_t *daddr, 51 const xfrm_address_t *saddr, 52 unsigned short family) 53{ 54 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask); 55} 56 57static inline unsigned int 58xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr, 59 __be32 spi, u8 proto, unsigned short family) 60{ 61 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask); 62} 63 64static void xfrm_hash_transfer(struct hlist_head *list, 65 struct hlist_head *ndsttable, 66 struct hlist_head *nsrctable, 67 struct hlist_head *nspitable, 68 unsigned int nhashmask) 69{ 70 struct hlist_node *tmp; 71 struct xfrm_state *x; 72 73 hlist_for_each_entry_safe(x, tmp, list, bydst) { 74 unsigned int h; 75 76 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr, 77 x->props.reqid, x->props.family, 78 nhashmask); 79 hlist_add_head(&x->bydst, ndsttable+h); 80 81 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr, 82 x->props.family, 83 nhashmask); 84 hlist_add_head(&x->bysrc, nsrctable+h); 85 86 if (x->id.spi) { 87 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi, 88 x->id.proto, x->props.family, 89 nhashmask); 90 hlist_add_head(&x->byspi, nspitable+h); 91 } 92 } 93} 94 95static unsigned long xfrm_hash_new_size(unsigned int state_hmask) 96{ 97 return ((state_hmask + 1) << 1) * sizeof(struct hlist_head); 98} 99 100static void xfrm_hash_resize(struct work_struct *work) 101{ 102 struct net *net = container_of(work, struct net, xfrm.state_hash_work); 103 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi; 104 unsigned long nsize, osize; 105 unsigned int nhashmask, ohashmask; 106 int i; 107 108 nsize = xfrm_hash_new_size(net->xfrm.state_hmask); 109 ndst = xfrm_hash_alloc(nsize); 110 if (!ndst) 111 return; 112 nsrc = xfrm_hash_alloc(nsize); 113 if (!nsrc) { 114 xfrm_hash_free(ndst, nsize); 115 return; 116 } 117 nspi = xfrm_hash_alloc(nsize); 118 if (!nspi) { 119 xfrm_hash_free(ndst, nsize); 120 xfrm_hash_free(nsrc, nsize); 121 return; 122 } 123 124 spin_lock_bh(&net->xfrm.xfrm_state_lock); 125 126 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U; 127 for (i = net->xfrm.state_hmask; i >= 0; i--) 128 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi, 129 nhashmask); 130 131 odst = net->xfrm.state_bydst; 132 osrc = net->xfrm.state_bysrc; 133 ospi = net->xfrm.state_byspi; 134 ohashmask = net->xfrm.state_hmask; 135 136 net->xfrm.state_bydst = ndst; 137 net->xfrm.state_bysrc = nsrc; 138 net->xfrm.state_byspi = nspi; 139 net->xfrm.state_hmask = nhashmask; 140 141 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 142 143 osize = (ohashmask + 1) * sizeof(struct hlist_head); 144 xfrm_hash_free(odst, osize); 145 xfrm_hash_free(osrc, osize); 146 xfrm_hash_free(ospi, osize); 147} 148 149static DEFINE_SPINLOCK(xfrm_state_afinfo_lock); 150static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO]; 151 152static DEFINE_SPINLOCK(xfrm_state_gc_lock); 153 154int __xfrm_state_delete(struct xfrm_state *x); 155 156int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); 157bool km_is_alive(const struct km_event *c); 158void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 159 160static DEFINE_SPINLOCK(xfrm_type_lock); 161int xfrm_register_type(const struct xfrm_type *type, unsigned short family) 162{ 163 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 164 const struct xfrm_type **typemap; 165 int err = 0; 166 167 if (unlikely(afinfo == NULL)) 168 return -EAFNOSUPPORT; 169 typemap = afinfo->type_map; 170 spin_lock_bh(&xfrm_type_lock); 171 172 if (likely(typemap[type->proto] == NULL)) 173 typemap[type->proto] = type; 174 else 175 err = -EEXIST; 176 spin_unlock_bh(&xfrm_type_lock); 177 xfrm_state_put_afinfo(afinfo); 178 return err; 179} 180EXPORT_SYMBOL(xfrm_register_type); 181 182int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family) 183{ 184 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 185 const struct xfrm_type **typemap; 186 int err = 0; 187 188 if (unlikely(afinfo == NULL)) 189 return -EAFNOSUPPORT; 190 typemap = afinfo->type_map; 191 spin_lock_bh(&xfrm_type_lock); 192 193 if (unlikely(typemap[type->proto] != type)) 194 err = -ENOENT; 195 else 196 typemap[type->proto] = NULL; 197 spin_unlock_bh(&xfrm_type_lock); 198 xfrm_state_put_afinfo(afinfo); 199 return err; 200} 201EXPORT_SYMBOL(xfrm_unregister_type); 202 203static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family) 204{ 205 struct xfrm_state_afinfo *afinfo; 206 const struct xfrm_type **typemap; 207 const struct xfrm_type *type; 208 int modload_attempted = 0; 209 210retry: 211 afinfo = xfrm_state_get_afinfo(family); 212 if (unlikely(afinfo == NULL)) 213 return NULL; 214 typemap = afinfo->type_map; 215 216 type = typemap[proto]; 217 if (unlikely(type && !try_module_get(type->owner))) 218 type = NULL; 219 if (!type && !modload_attempted) { 220 xfrm_state_put_afinfo(afinfo); 221 request_module("xfrm-type-%d-%d", family, proto); 222 modload_attempted = 1; 223 goto retry; 224 } 225 226 xfrm_state_put_afinfo(afinfo); 227 return type; 228} 229 230static void xfrm_put_type(const struct xfrm_type *type) 231{ 232 module_put(type->owner); 233} 234 235static DEFINE_SPINLOCK(xfrm_mode_lock); 236int xfrm_register_mode(struct xfrm_mode *mode, int family) 237{ 238 struct xfrm_state_afinfo *afinfo; 239 struct xfrm_mode **modemap; 240 int err; 241 242 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 243 return -EINVAL; 244 245 afinfo = xfrm_state_get_afinfo(family); 246 if (unlikely(afinfo == NULL)) 247 return -EAFNOSUPPORT; 248 249 err = -EEXIST; 250 modemap = afinfo->mode_map; 251 spin_lock_bh(&xfrm_mode_lock); 252 if (modemap[mode->encap]) 253 goto out; 254 255 err = -ENOENT; 256 if (!try_module_get(afinfo->owner)) 257 goto out; 258 259 mode->afinfo = afinfo; 260 modemap[mode->encap] = mode; 261 err = 0; 262 263out: 264 spin_unlock_bh(&xfrm_mode_lock); 265 xfrm_state_put_afinfo(afinfo); 266 return err; 267} 268EXPORT_SYMBOL(xfrm_register_mode); 269 270int xfrm_unregister_mode(struct xfrm_mode *mode, int family) 271{ 272 struct xfrm_state_afinfo *afinfo; 273 struct xfrm_mode **modemap; 274 int err; 275 276 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 277 return -EINVAL; 278 279 afinfo = xfrm_state_get_afinfo(family); 280 if (unlikely(afinfo == NULL)) 281 return -EAFNOSUPPORT; 282 283 err = -ENOENT; 284 modemap = afinfo->mode_map; 285 spin_lock_bh(&xfrm_mode_lock); 286 if (likely(modemap[mode->encap] == mode)) { 287 modemap[mode->encap] = NULL; 288 module_put(mode->afinfo->owner); 289 err = 0; 290 } 291 292 spin_unlock_bh(&xfrm_mode_lock); 293 xfrm_state_put_afinfo(afinfo); 294 return err; 295} 296EXPORT_SYMBOL(xfrm_unregister_mode); 297 298static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family) 299{ 300 struct xfrm_state_afinfo *afinfo; 301 struct xfrm_mode *mode; 302 int modload_attempted = 0; 303 304 if (unlikely(encap >= XFRM_MODE_MAX)) 305 return NULL; 306 307retry: 308 afinfo = xfrm_state_get_afinfo(family); 309 if (unlikely(afinfo == NULL)) 310 return NULL; 311 312 mode = afinfo->mode_map[encap]; 313 if (unlikely(mode && !try_module_get(mode->owner))) 314 mode = NULL; 315 if (!mode && !modload_attempted) { 316 xfrm_state_put_afinfo(afinfo); 317 request_module("xfrm-mode-%d-%d", family, encap); 318 modload_attempted = 1; 319 goto retry; 320 } 321 322 xfrm_state_put_afinfo(afinfo); 323 return mode; 324} 325 326static void xfrm_put_mode(struct xfrm_mode *mode) 327{ 328 module_put(mode->owner); 329} 330 331static void xfrm_state_gc_destroy(struct xfrm_state *x) 332{ 333 tasklet_hrtimer_cancel(&x->mtimer); 334 del_timer_sync(&x->rtimer); 335 kfree(x->aalg); 336 kfree(x->ealg); 337 kfree(x->calg); 338 kfree(x->encap); 339 kfree(x->coaddr); 340 kfree(x->replay_esn); 341 kfree(x->preplay_esn); 342 if (x->inner_mode) 343 xfrm_put_mode(x->inner_mode); 344 if (x->inner_mode_iaf) 345 xfrm_put_mode(x->inner_mode_iaf); 346 if (x->outer_mode) 347 xfrm_put_mode(x->outer_mode); 348 if (x->type) { 349 x->type->destructor(x); 350 xfrm_put_type(x->type); 351 } 352 security_xfrm_state_free(x); 353 kfree(x); 354} 355 356static void xfrm_state_gc_task(struct work_struct *work) 357{ 358 struct net *net = container_of(work, struct net, xfrm.state_gc_work); 359 struct xfrm_state *x; 360 struct hlist_node *tmp; 361 struct hlist_head gc_list; 362 363 spin_lock_bh(&xfrm_state_gc_lock); 364 hlist_move_list(&net->xfrm.state_gc_list, &gc_list); 365 spin_unlock_bh(&xfrm_state_gc_lock); 366 367 hlist_for_each_entry_safe(x, tmp, &gc_list, gclist) 368 xfrm_state_gc_destroy(x); 369} 370 371static inline unsigned long make_jiffies(long secs) 372{ 373 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ) 374 return MAX_SCHEDULE_TIMEOUT-1; 375 else 376 return secs*HZ; 377} 378 379static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me) 380{ 381 struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer); 382 struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer); 383 unsigned long now = get_seconds(); 384 long next = LONG_MAX; 385 int warn = 0; 386 int err = 0; 387 388 spin_lock(&x->lock); 389 if (x->km.state == XFRM_STATE_DEAD) 390 goto out; 391 if (x->km.state == XFRM_STATE_EXPIRED) 392 goto expired; 393 if (x->lft.hard_add_expires_seconds) { 394 long tmo = x->lft.hard_add_expires_seconds + 395 x->curlft.add_time - now; 396 if (tmo <= 0) { 397 if (x->xflags & XFRM_SOFT_EXPIRE) { 398 /* enter hard expire without soft expire first?! 399 * setting a new date could trigger this. 400 * workarbound: fix x->curflt.add_time by below: 401 */ 402 x->curlft.add_time = now - x->saved_tmo - 1; 403 tmo = x->lft.hard_add_expires_seconds - x->saved_tmo; 404 } else 405 goto expired; 406 } 407 if (tmo < next) 408 next = tmo; 409 } 410 if (x->lft.hard_use_expires_seconds) { 411 long tmo = x->lft.hard_use_expires_seconds + 412 (x->curlft.use_time ? : now) - now; 413 if (tmo <= 0) 414 goto expired; 415 if (tmo < next) 416 next = tmo; 417 } 418 if (x->km.dying) 419 goto resched; 420 if (x->lft.soft_add_expires_seconds) { 421 long tmo = x->lft.soft_add_expires_seconds + 422 x->curlft.add_time - now; 423 if (tmo <= 0) { 424 warn = 1; 425 x->xflags &= ~XFRM_SOFT_EXPIRE; 426 } else if (tmo < next) { 427 next = tmo; 428 x->xflags |= XFRM_SOFT_EXPIRE; 429 x->saved_tmo = tmo; 430 } 431 } 432 if (x->lft.soft_use_expires_seconds) { 433 long tmo = x->lft.soft_use_expires_seconds + 434 (x->curlft.use_time ? : now) - now; 435 if (tmo <= 0) 436 warn = 1; 437 else if (tmo < next) 438 next = tmo; 439 } 440 441 x->km.dying = warn; 442 if (warn) 443 km_state_expired(x, 0, 0); 444resched: 445 if (next != LONG_MAX) { 446 tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL); 447 } 448 449 goto out; 450 451expired: 452 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) 453 x->km.state = XFRM_STATE_EXPIRED; 454 455 err = __xfrm_state_delete(x); 456 if (!err) 457 km_state_expired(x, 1, 0); 458 459 xfrm_audit_state_delete(x, err ? 0 : 1, true); 460 461out: 462 spin_unlock(&x->lock); 463 return HRTIMER_NORESTART; 464} 465 466static void xfrm_replay_timer_handler(unsigned long data); 467 468struct xfrm_state *xfrm_state_alloc(struct net *net) 469{ 470 struct xfrm_state *x; 471 472 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC); 473 474 if (x) { 475 write_pnet(&x->xs_net, net); 476 atomic_set(&x->refcnt, 1); 477 atomic_set(&x->tunnel_users, 0); 478 INIT_LIST_HEAD(&x->km.all); 479 INIT_HLIST_NODE(&x->bydst); 480 INIT_HLIST_NODE(&x->bysrc); 481 INIT_HLIST_NODE(&x->byspi); 482 tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, 483 CLOCK_BOOTTIME, HRTIMER_MODE_ABS); 484 setup_timer(&x->rtimer, xfrm_replay_timer_handler, 485 (unsigned long)x); 486 x->curlft.add_time = get_seconds(); 487 x->lft.soft_byte_limit = XFRM_INF; 488 x->lft.soft_packet_limit = XFRM_INF; 489 x->lft.hard_byte_limit = XFRM_INF; 490 x->lft.hard_packet_limit = XFRM_INF; 491 x->replay_maxage = 0; 492 x->replay_maxdiff = 0; 493 x->inner_mode = NULL; 494 x->inner_mode_iaf = NULL; 495 spin_lock_init(&x->lock); 496 } 497 return x; 498} 499EXPORT_SYMBOL(xfrm_state_alloc); 500 501void __xfrm_state_destroy(struct xfrm_state *x) 502{ 503 struct net *net = xs_net(x); 504 505 WARN_ON(x->km.state != XFRM_STATE_DEAD); 506 507 spin_lock_bh(&xfrm_state_gc_lock); 508 hlist_add_head(&x->gclist, &net->xfrm.state_gc_list); 509 spin_unlock_bh(&xfrm_state_gc_lock); 510 schedule_work(&net->xfrm.state_gc_work); 511} 512EXPORT_SYMBOL(__xfrm_state_destroy); 513 514int __xfrm_state_delete(struct xfrm_state *x) 515{ 516 struct net *net = xs_net(x); 517 int err = -ESRCH; 518 519 if (x->km.state != XFRM_STATE_DEAD) { 520 x->km.state = XFRM_STATE_DEAD; 521 spin_lock(&net->xfrm.xfrm_state_lock); 522 list_del(&x->km.all); 523 hlist_del(&x->bydst); 524 hlist_del(&x->bysrc); 525 if (x->id.spi) 526 hlist_del(&x->byspi); 527 net->xfrm.state_num--; 528 spin_unlock(&net->xfrm.xfrm_state_lock); 529 530 /* All xfrm_state objects are created by xfrm_state_alloc. 531 * The xfrm_state_alloc call gives a reference, and that 532 * is what we are dropping here. 533 */ 534 xfrm_state_put(x); 535 err = 0; 536 } 537 538 return err; 539} 540EXPORT_SYMBOL(__xfrm_state_delete); 541 542int xfrm_state_delete(struct xfrm_state *x) 543{ 544 int err; 545 546 spin_lock_bh(&x->lock); 547 err = __xfrm_state_delete(x); 548 spin_unlock_bh(&x->lock); 549 550 return err; 551} 552EXPORT_SYMBOL(xfrm_state_delete); 553 554#ifdef CONFIG_SECURITY_NETWORK_XFRM 555static inline int 556xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid) 557{ 558 int i, err = 0; 559 560 for (i = 0; i <= net->xfrm.state_hmask; i++) { 561 struct xfrm_state *x; 562 563 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { 564 if (xfrm_id_proto_match(x->id.proto, proto) && 565 (err = security_xfrm_state_delete(x)) != 0) { 566 xfrm_audit_state_delete(x, 0, task_valid); 567 return err; 568 } 569 } 570 } 571 572 return err; 573} 574#else 575static inline int 576xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid) 577{ 578 return 0; 579} 580#endif 581 582int xfrm_state_flush(struct net *net, u8 proto, bool task_valid) 583{ 584 int i, err = 0, cnt = 0; 585 586 spin_lock_bh(&net->xfrm.xfrm_state_lock); 587 err = xfrm_state_flush_secctx_check(net, proto, task_valid); 588 if (err) 589 goto out; 590 591 err = -ESRCH; 592 for (i = 0; i <= net->xfrm.state_hmask; i++) { 593 struct xfrm_state *x; 594restart: 595 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { 596 if (!xfrm_state_kern(x) && 597 xfrm_id_proto_match(x->id.proto, proto)) { 598 xfrm_state_hold(x); 599 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 600 601 err = xfrm_state_delete(x); 602 xfrm_audit_state_delete(x, err ? 0 : 1, 603 task_valid); 604 xfrm_state_put(x); 605 if (!err) 606 cnt++; 607 608 spin_lock_bh(&net->xfrm.xfrm_state_lock); 609 goto restart; 610 } 611 } 612 } 613 if (cnt) 614 err = 0; 615 616out: 617 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 618 return err; 619} 620EXPORT_SYMBOL(xfrm_state_flush); 621 622void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si) 623{ 624 spin_lock_bh(&net->xfrm.xfrm_state_lock); 625 si->sadcnt = net->xfrm.state_num; 626 si->sadhcnt = net->xfrm.state_hmask; 627 si->sadhmcnt = xfrm_state_hashmax; 628 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 629} 630EXPORT_SYMBOL(xfrm_sad_getinfo); 631 632static int 633xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl, 634 const struct xfrm_tmpl *tmpl, 635 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 636 unsigned short family) 637{ 638 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 639 if (!afinfo) 640 return -1; 641 afinfo->init_tempsel(&x->sel, fl); 642 643 if (family != tmpl->encap_family) { 644 xfrm_state_put_afinfo(afinfo); 645 afinfo = xfrm_state_get_afinfo(tmpl->encap_family); 646 if (!afinfo) 647 return -1; 648 } 649 afinfo->init_temprop(x, tmpl, daddr, saddr); 650 xfrm_state_put_afinfo(afinfo); 651 return 0; 652} 653 654static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, 655 const xfrm_address_t *daddr, 656 __be32 spi, u8 proto, 657 unsigned short family) 658{ 659 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); 660 struct xfrm_state *x; 661 662 hlist_for_each_entry(x, net->xfrm.state_byspi+h, byspi) { 663 if (x->props.family != family || 664 x->id.spi != spi || 665 x->id.proto != proto || 666 !xfrm_addr_equal(&x->id.daddr, daddr, family)) 667 continue; 668 669 if ((mark & x->mark.m) != x->mark.v) 670 continue; 671 xfrm_state_hold(x); 672 return x; 673 } 674 675 return NULL; 676} 677 678static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, 679 const xfrm_address_t *daddr, 680 const xfrm_address_t *saddr, 681 u8 proto, unsigned short family) 682{ 683 unsigned int h = xfrm_src_hash(net, daddr, saddr, family); 684 struct xfrm_state *x; 685 686 hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) { 687 if (x->props.family != family || 688 x->id.proto != proto || 689 !xfrm_addr_equal(&x->id.daddr, daddr, family) || 690 !xfrm_addr_equal(&x->props.saddr, saddr, family)) 691 continue; 692 693 if ((mark & x->mark.m) != x->mark.v) 694 continue; 695 xfrm_state_hold(x); 696 return x; 697 } 698 699 return NULL; 700} 701 702static inline struct xfrm_state * 703__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) 704{ 705 struct net *net = xs_net(x); 706 u32 mark = x->mark.v & x->mark.m; 707 708 if (use_spi) 709 return __xfrm_state_lookup(net, mark, &x->id.daddr, 710 x->id.spi, x->id.proto, family); 711 else 712 return __xfrm_state_lookup_byaddr(net, mark, 713 &x->id.daddr, 714 &x->props.saddr, 715 x->id.proto, family); 716} 717 718static void xfrm_hash_grow_check(struct net *net, int have_hash_collision) 719{ 720 if (have_hash_collision && 721 (net->xfrm.state_hmask + 1) < xfrm_state_hashmax && 722 net->xfrm.state_num > net->xfrm.state_hmask) 723 schedule_work(&net->xfrm.state_hash_work); 724} 725 726static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, 727 const struct flowi *fl, unsigned short family, 728 struct xfrm_state **best, int *acq_in_progress, 729 int *error) 730{ 731 /* Resolution logic: 732 * 1. There is a valid state with matching selector. Done. 733 * 2. Valid state with inappropriate selector. Skip. 734 * 735 * Entering area of "sysdeps". 736 * 737 * 3. If state is not valid, selector is temporary, it selects 738 * only session which triggered previous resolution. Key 739 * manager will do something to install a state with proper 740 * selector. 741 */ 742 if (x->km.state == XFRM_STATE_VALID) { 743 if ((x->sel.family && 744 !xfrm_selector_match(&x->sel, fl, x->sel.family)) || 745 !security_xfrm_state_pol_flow_match(x, pol, fl)) 746 return; 747 748 if (!*best || 749 (*best)->km.dying > x->km.dying || 750 ((*best)->km.dying == x->km.dying && 751 (*best)->curlft.add_time < x->curlft.add_time)) 752 *best = x; 753 } else if (x->km.state == XFRM_STATE_ACQ) { 754 *acq_in_progress = 1; 755 } else if (x->km.state == XFRM_STATE_ERROR || 756 x->km.state == XFRM_STATE_EXPIRED) { 757 if (xfrm_selector_match(&x->sel, fl, x->sel.family) && 758 security_xfrm_state_pol_flow_match(x, pol, fl)) 759 *error = -ESRCH; 760 } 761} 762 763struct xfrm_state * 764xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, 765 const struct flowi *fl, struct xfrm_tmpl *tmpl, 766 struct xfrm_policy *pol, int *err, 767 unsigned short family) 768{ 769 static xfrm_address_t saddr_wildcard = { }; 770 struct net *net = xp_net(pol); 771 unsigned int h, h_wildcard; 772 struct xfrm_state *x, *x0, *to_put; 773 int acquire_in_progress = 0; 774 int error = 0; 775 struct xfrm_state *best = NULL; 776 u32 mark = pol->mark.v & pol->mark.m; 777 unsigned short encap_family = tmpl->encap_family; 778 struct km_event c; 779 780 to_put = NULL; 781 782 spin_lock_bh(&net->xfrm.xfrm_state_lock); 783 h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); 784 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 785 if (x->props.family == encap_family && 786 x->props.reqid == tmpl->reqid && 787 (mark & x->mark.m) == x->mark.v && 788 !(x->props.flags & XFRM_STATE_WILDRECV) && 789 xfrm_state_addr_check(x, daddr, saddr, encap_family) && 790 tmpl->mode == x->props.mode && 791 tmpl->id.proto == x->id.proto && 792 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 793 xfrm_state_look_at(pol, x, fl, encap_family, 794 &best, &acquire_in_progress, &error); 795 } 796 if (best || acquire_in_progress) 797 goto found; 798 799 h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family); 800 hlist_for_each_entry(x, net->xfrm.state_bydst+h_wildcard, bydst) { 801 if (x->props.family == encap_family && 802 x->props.reqid == tmpl->reqid && 803 (mark & x->mark.m) == x->mark.v && 804 !(x->props.flags & XFRM_STATE_WILDRECV) && 805 xfrm_addr_equal(&x->id.daddr, daddr, encap_family) && 806 tmpl->mode == x->props.mode && 807 tmpl->id.proto == x->id.proto && 808 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 809 xfrm_state_look_at(pol, x, fl, encap_family, 810 &best, &acquire_in_progress, &error); 811 } 812 813found: 814 x = best; 815 if (!x && !error && !acquire_in_progress) { 816 if (tmpl->id.spi && 817 (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi, 818 tmpl->id.proto, encap_family)) != NULL) { 819 to_put = x0; 820 error = -EEXIST; 821 goto out; 822 } 823 824 c.net = net; 825 /* If the KMs have no listeners (yet...), avoid allocating an SA 826 * for each and every packet - garbage collection might not 827 * handle the flood. 828 */ 829 if (!km_is_alive(&c)) { 830 error = -ESRCH; 831 goto out; 832 } 833 834 x = xfrm_state_alloc(net); 835 if (x == NULL) { 836 error = -ENOMEM; 837 goto out; 838 } 839 /* Initialize temporary state matching only 840 * to current session. */ 841 xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family); 842 memcpy(&x->mark, &pol->mark, sizeof(x->mark)); 843 844 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid); 845 if (error) { 846 x->km.state = XFRM_STATE_DEAD; 847 to_put = x; 848 x = NULL; 849 goto out; 850 } 851 852 if (km_query(x, tmpl, pol) == 0) { 853 x->km.state = XFRM_STATE_ACQ; 854 list_add(&x->km.all, &net->xfrm.state_all); 855 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h); 856 h = xfrm_src_hash(net, daddr, saddr, encap_family); 857 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h); 858 if (x->id.spi) { 859 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family); 860 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); 861 } 862 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; 863 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL); 864 net->xfrm.state_num++; 865 xfrm_hash_grow_check(net, x->bydst.next != NULL); 866 } else { 867 x->km.state = XFRM_STATE_DEAD; 868 to_put = x; 869 x = NULL; 870 error = -ESRCH; 871 } 872 } 873out: 874 if (x) 875 xfrm_state_hold(x); 876 else 877 *err = acquire_in_progress ? -EAGAIN : error; 878 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 879 if (to_put) 880 xfrm_state_put(to_put); 881 return x; 882} 883 884struct xfrm_state * 885xfrm_stateonly_find(struct net *net, u32 mark, 886 xfrm_address_t *daddr, xfrm_address_t *saddr, 887 unsigned short family, u8 mode, u8 proto, u32 reqid) 888{ 889 unsigned int h; 890 struct xfrm_state *rx = NULL, *x = NULL; 891 892 spin_lock_bh(&net->xfrm.xfrm_state_lock); 893 h = xfrm_dst_hash(net, daddr, saddr, reqid, family); 894 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 895 if (x->props.family == family && 896 x->props.reqid == reqid && 897 (mark & x->mark.m) == x->mark.v && 898 !(x->props.flags & XFRM_STATE_WILDRECV) && 899 xfrm_state_addr_check(x, daddr, saddr, family) && 900 mode == x->props.mode && 901 proto == x->id.proto && 902 x->km.state == XFRM_STATE_VALID) { 903 rx = x; 904 break; 905 } 906 } 907 908 if (rx) 909 xfrm_state_hold(rx); 910 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 911 912 913 return rx; 914} 915EXPORT_SYMBOL(xfrm_stateonly_find); 916 917struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 918 unsigned short family) 919{ 920 struct xfrm_state *x; 921 struct xfrm_state_walk *w; 922 923 spin_lock_bh(&net->xfrm.xfrm_state_lock); 924 list_for_each_entry(w, &net->xfrm.state_all, all) { 925 x = container_of(w, struct xfrm_state, km); 926 if (x->props.family != family || 927 x->id.spi != spi) 928 continue; 929 930 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 931 xfrm_state_hold(x); 932 return x; 933 } 934 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 935 return NULL; 936} 937EXPORT_SYMBOL(xfrm_state_lookup_byspi); 938 939static void __xfrm_state_insert(struct xfrm_state *x) 940{ 941 struct net *net = xs_net(x); 942 unsigned int h; 943 944 list_add(&x->km.all, &net->xfrm.state_all); 945 946 h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr, 947 x->props.reqid, x->props.family); 948 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h); 949 950 h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family); 951 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h); 952 953 if (x->id.spi) { 954 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, 955 x->props.family); 956 957 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); 958 } 959 960 tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL); 961 if (x->replay_maxage) 962 mod_timer(&x->rtimer, jiffies + x->replay_maxage); 963 964 net->xfrm.state_num++; 965 966 xfrm_hash_grow_check(net, x->bydst.next != NULL); 967} 968 969/* net->xfrm.xfrm_state_lock is held */ 970static void __xfrm_state_bump_genids(struct xfrm_state *xnew) 971{ 972 struct net *net = xs_net(xnew); 973 unsigned short family = xnew->props.family; 974 u32 reqid = xnew->props.reqid; 975 struct xfrm_state *x; 976 unsigned int h; 977 u32 mark = xnew->mark.v & xnew->mark.m; 978 979 h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family); 980 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 981 if (x->props.family == family && 982 x->props.reqid == reqid && 983 (mark & x->mark.m) == x->mark.v && 984 xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) && 985 xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family)) 986 x->genid++; 987 } 988} 989 990void xfrm_state_insert(struct xfrm_state *x) 991{ 992 struct net *net = xs_net(x); 993 994 spin_lock_bh(&net->xfrm.xfrm_state_lock); 995 __xfrm_state_bump_genids(x); 996 __xfrm_state_insert(x); 997 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 998} 999EXPORT_SYMBOL(xfrm_state_insert); 1000 1001/* net->xfrm.xfrm_state_lock is held */ 1002static struct xfrm_state *__find_acq_core(struct net *net, 1003 const struct xfrm_mark *m, 1004 unsigned short family, u8 mode, 1005 u32 reqid, u8 proto, 1006 const xfrm_address_t *daddr, 1007 const xfrm_address_t *saddr, 1008 int create) 1009{ 1010 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family); 1011 struct xfrm_state *x; 1012 u32 mark = m->v & m->m; 1013 1014 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 1015 if (x->props.reqid != reqid || 1016 x->props.mode != mode || 1017 x->props.family != family || 1018 x->km.state != XFRM_STATE_ACQ || 1019 x->id.spi != 0 || 1020 x->id.proto != proto || 1021 (mark & x->mark.m) != x->mark.v || 1022 !xfrm_addr_equal(&x->id.daddr, daddr, family) || 1023 !xfrm_addr_equal(&x->props.saddr, saddr, family)) 1024 continue; 1025 1026 xfrm_state_hold(x); 1027 return x; 1028 } 1029 1030 if (!create) 1031 return NULL; 1032 1033 x = xfrm_state_alloc(net); 1034 if (likely(x)) { 1035 switch (family) { 1036 case AF_INET: 1037 x->sel.daddr.a4 = daddr->a4; 1038 x->sel.saddr.a4 = saddr->a4; 1039 x->sel.prefixlen_d = 32; 1040 x->sel.prefixlen_s = 32; 1041 x->props.saddr.a4 = saddr->a4; 1042 x->id.daddr.a4 = daddr->a4; 1043 break; 1044 1045 case AF_INET6: 1046 *(struct in6_addr *)x->sel.daddr.a6 = *(struct in6_addr *)daddr; 1047 *(struct in6_addr *)x->sel.saddr.a6 = *(struct in6_addr *)saddr; 1048 x->sel.prefixlen_d = 128; 1049 x->sel.prefixlen_s = 128; 1050 *(struct in6_addr *)x->props.saddr.a6 = *(struct in6_addr *)saddr; 1051 *(struct in6_addr *)x->id.daddr.a6 = *(struct in6_addr *)daddr; 1052 break; 1053 } 1054 1055 x->km.state = XFRM_STATE_ACQ; 1056 x->id.proto = proto; 1057 x->props.family = family; 1058 x->props.mode = mode; 1059 x->props.reqid = reqid; 1060 x->mark.v = m->v; 1061 x->mark.m = m->m; 1062 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; 1063 xfrm_state_hold(x); 1064 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL); 1065 list_add(&x->km.all, &net->xfrm.state_all); 1066 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h); 1067 h = xfrm_src_hash(net, daddr, saddr, family); 1068 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h); 1069 1070 net->xfrm.state_num++; 1071 1072 xfrm_hash_grow_check(net, x->bydst.next != NULL); 1073 } 1074 1075 return x; 1076} 1077 1078static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1079 1080int xfrm_state_add(struct xfrm_state *x) 1081{ 1082 struct net *net = xs_net(x); 1083 struct xfrm_state *x1, *to_put; 1084 int family; 1085 int err; 1086 u32 mark = x->mark.v & x->mark.m; 1087 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1088 1089 family = x->props.family; 1090 1091 to_put = NULL; 1092 1093 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1094 1095 x1 = __xfrm_state_locate(x, use_spi, family); 1096 if (x1) { 1097 to_put = x1; 1098 x1 = NULL; 1099 err = -EEXIST; 1100 goto out; 1101 } 1102 1103 if (use_spi && x->km.seq) { 1104 x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq); 1105 if (x1 && ((x1->id.proto != x->id.proto) || 1106 !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) { 1107 to_put = x1; 1108 x1 = NULL; 1109 } 1110 } 1111 1112 if (use_spi && !x1) 1113 x1 = __find_acq_core(net, &x->mark, family, x->props.mode, 1114 x->props.reqid, x->id.proto, 1115 &x->id.daddr, &x->props.saddr, 0); 1116 1117 __xfrm_state_bump_genids(x); 1118 __xfrm_state_insert(x); 1119 err = 0; 1120 1121out: 1122 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1123 1124 if (x1) { 1125 xfrm_state_delete(x1); 1126 xfrm_state_put(x1); 1127 } 1128 1129 if (to_put) 1130 xfrm_state_put(to_put); 1131 1132 return err; 1133} 1134EXPORT_SYMBOL(xfrm_state_add); 1135 1136#ifdef CONFIG_XFRM_MIGRATE 1137static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig) 1138{ 1139 struct net *net = xs_net(orig); 1140 struct xfrm_state *x = xfrm_state_alloc(net); 1141 if (!x) 1142 goto out; 1143 1144 memcpy(&x->id, &orig->id, sizeof(x->id)); 1145 memcpy(&x->sel, &orig->sel, sizeof(x->sel)); 1146 memcpy(&x->lft, &orig->lft, sizeof(x->lft)); 1147 x->props.mode = orig->props.mode; 1148 x->props.replay_window = orig->props.replay_window; 1149 x->props.reqid = orig->props.reqid; 1150 x->props.family = orig->props.family; 1151 x->props.saddr = orig->props.saddr; 1152 1153 if (orig->aalg) { 1154 x->aalg = xfrm_algo_auth_clone(orig->aalg); 1155 if (!x->aalg) 1156 goto error; 1157 } 1158 x->props.aalgo = orig->props.aalgo; 1159 1160 if (orig->aead) { 1161 x->aead = xfrm_algo_aead_clone(orig->aead); 1162 if (!x->aead) 1163 goto error; 1164 } 1165 if (orig->ealg) { 1166 x->ealg = xfrm_algo_clone(orig->ealg); 1167 if (!x->ealg) 1168 goto error; 1169 } 1170 x->props.ealgo = orig->props.ealgo; 1171 1172 if (orig->calg) { 1173 x->calg = xfrm_algo_clone(orig->calg); 1174 if (!x->calg) 1175 goto error; 1176 } 1177 x->props.calgo = orig->props.calgo; 1178 1179 if (orig->encap) { 1180 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL); 1181 if (!x->encap) 1182 goto error; 1183 } 1184 1185 if (orig->coaddr) { 1186 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr), 1187 GFP_KERNEL); 1188 if (!x->coaddr) 1189 goto error; 1190 } 1191 1192 if (orig->replay_esn) { 1193 if (xfrm_replay_clone(x, orig)) 1194 goto error; 1195 } 1196 1197 memcpy(&x->mark, &orig->mark, sizeof(x->mark)); 1198 1199 if (xfrm_init_state(x) < 0) 1200 goto error; 1201 1202 x->props.flags = orig->props.flags; 1203 x->props.extra_flags = orig->props.extra_flags; 1204 1205 x->tfcpad = orig->tfcpad; 1206 x->replay_maxdiff = orig->replay_maxdiff; 1207 x->replay_maxage = orig->replay_maxage; 1208 x->curlft.add_time = orig->curlft.add_time; 1209 x->km.state = orig->km.state; 1210 x->km.seq = orig->km.seq; 1211 1212 return x; 1213 1214 error: 1215 xfrm_state_put(x); 1216out: 1217 return NULL; 1218} 1219 1220struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net) 1221{ 1222 unsigned int h; 1223 struct xfrm_state *x = NULL; 1224 1225 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1226 1227 if (m->reqid) { 1228 h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr, 1229 m->reqid, m->old_family); 1230 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 1231 if (x->props.mode != m->mode || 1232 x->id.proto != m->proto) 1233 continue; 1234 if (m->reqid && x->props.reqid != m->reqid) 1235 continue; 1236 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, 1237 m->old_family) || 1238 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, 1239 m->old_family)) 1240 continue; 1241 xfrm_state_hold(x); 1242 break; 1243 } 1244 } else { 1245 h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr, 1246 m->old_family); 1247 hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) { 1248 if (x->props.mode != m->mode || 1249 x->id.proto != m->proto) 1250 continue; 1251 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, 1252 m->old_family) || 1253 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, 1254 m->old_family)) 1255 continue; 1256 xfrm_state_hold(x); 1257 break; 1258 } 1259 } 1260 1261 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1262 1263 return x; 1264} 1265EXPORT_SYMBOL(xfrm_migrate_state_find); 1266 1267struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 1268 struct xfrm_migrate *m) 1269{ 1270 struct xfrm_state *xc; 1271 1272 xc = xfrm_state_clone(x); 1273 if (!xc) 1274 return NULL; 1275 1276 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); 1277 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); 1278 1279 /* add state */ 1280 if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) { 1281 /* a care is needed when the destination address of the 1282 state is to be updated as it is a part of triplet */ 1283 xfrm_state_insert(xc); 1284 } else { 1285 if (xfrm_state_add(xc) < 0) 1286 goto error; 1287 } 1288 1289 return xc; 1290error: 1291 xfrm_state_put(xc); 1292 return NULL; 1293} 1294EXPORT_SYMBOL(xfrm_state_migrate); 1295#endif 1296 1297int xfrm_state_update(struct xfrm_state *x) 1298{ 1299 struct xfrm_state *x1, *to_put; 1300 int err; 1301 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1302 struct net *net = xs_net(x); 1303 1304 to_put = NULL; 1305 1306 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1307 x1 = __xfrm_state_locate(x, use_spi, x->props.family); 1308 1309 err = -ESRCH; 1310 if (!x1) 1311 goto out; 1312 1313 if (xfrm_state_kern(x1)) { 1314 to_put = x1; 1315 err = -EEXIST; 1316 goto out; 1317 } 1318 1319 if (x1->km.state == XFRM_STATE_ACQ) { 1320 __xfrm_state_insert(x); 1321 x = NULL; 1322 } 1323 err = 0; 1324 1325out: 1326 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1327 1328 if (to_put) 1329 xfrm_state_put(to_put); 1330 1331 if (err) 1332 return err; 1333 1334 if (!x) { 1335 xfrm_state_delete(x1); 1336 xfrm_state_put(x1); 1337 return 0; 1338 } 1339 1340 err = -EINVAL; 1341 spin_lock_bh(&x1->lock); 1342 if (likely(x1->km.state == XFRM_STATE_VALID)) { 1343 if (x->encap && x1->encap) 1344 memcpy(x1->encap, x->encap, sizeof(*x1->encap)); 1345 if (x->coaddr && x1->coaddr) { 1346 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr)); 1347 } 1348 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel))) 1349 memcpy(&x1->sel, &x->sel, sizeof(x1->sel)); 1350 memcpy(&x1->lft, &x->lft, sizeof(x1->lft)); 1351 x1->km.dying = 0; 1352 1353 tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL); 1354 if (x1->curlft.use_time) 1355 xfrm_state_check_expire(x1); 1356 1357 err = 0; 1358 x->km.state = XFRM_STATE_DEAD; 1359 __xfrm_state_put(x); 1360 } 1361 spin_unlock_bh(&x1->lock); 1362 1363 xfrm_state_put(x1); 1364 1365 return err; 1366} 1367EXPORT_SYMBOL(xfrm_state_update); 1368 1369int xfrm_state_check_expire(struct xfrm_state *x) 1370{ 1371 if (!x->curlft.use_time) 1372 x->curlft.use_time = get_seconds(); 1373 1374 if (x->curlft.bytes >= x->lft.hard_byte_limit || 1375 x->curlft.packets >= x->lft.hard_packet_limit) { 1376 x->km.state = XFRM_STATE_EXPIRED; 1377 tasklet_hrtimer_start(&x->mtimer, ktime_set(0, 0), HRTIMER_MODE_REL); 1378 return -EINVAL; 1379 } 1380 1381 if (!x->km.dying && 1382 (x->curlft.bytes >= x->lft.soft_byte_limit || 1383 x->curlft.packets >= x->lft.soft_packet_limit)) { 1384 x->km.dying = 1; 1385 km_state_expired(x, 0, 0); 1386 } 1387 return 0; 1388} 1389EXPORT_SYMBOL(xfrm_state_check_expire); 1390 1391struct xfrm_state * 1392xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi, 1393 u8 proto, unsigned short family) 1394{ 1395 struct xfrm_state *x; 1396 1397 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1398 x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family); 1399 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1400 return x; 1401} 1402EXPORT_SYMBOL(xfrm_state_lookup); 1403 1404struct xfrm_state * 1405xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1406 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 1407 u8 proto, unsigned short family) 1408{ 1409 struct xfrm_state *x; 1410 1411 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1412 x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family); 1413 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1414 return x; 1415} 1416EXPORT_SYMBOL(xfrm_state_lookup_byaddr); 1417 1418struct xfrm_state * 1419xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid, 1420 u8 proto, const xfrm_address_t *daddr, 1421 const xfrm_address_t *saddr, int create, unsigned short family) 1422{ 1423 struct xfrm_state *x; 1424 1425 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1426 x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create); 1427 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1428 1429 return x; 1430} 1431EXPORT_SYMBOL(xfrm_find_acq); 1432 1433#ifdef CONFIG_XFRM_SUB_POLICY 1434int 1435xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1436 unsigned short family, struct net *net) 1437{ 1438 int err = 0; 1439 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1440 if (!afinfo) 1441 return -EAFNOSUPPORT; 1442 1443 spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/ 1444 if (afinfo->tmpl_sort) 1445 err = afinfo->tmpl_sort(dst, src, n); 1446 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1447 xfrm_state_put_afinfo(afinfo); 1448 return err; 1449} 1450EXPORT_SYMBOL(xfrm_tmpl_sort); 1451 1452int 1453xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1454 unsigned short family) 1455{ 1456 int err = 0; 1457 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1458 struct net *net = xs_net(*src); 1459 1460 if (!afinfo) 1461 return -EAFNOSUPPORT; 1462 1463 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1464 if (afinfo->state_sort) 1465 err = afinfo->state_sort(dst, src, n); 1466 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1467 xfrm_state_put_afinfo(afinfo); 1468 return err; 1469} 1470EXPORT_SYMBOL(xfrm_state_sort); 1471#endif 1472 1473/* Silly enough, but I'm lazy to build resolution list */ 1474 1475static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) 1476{ 1477 int i; 1478 1479 for (i = 0; i <= net->xfrm.state_hmask; i++) { 1480 struct xfrm_state *x; 1481 1482 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { 1483 if (x->km.seq == seq && 1484 (mark & x->mark.m) == x->mark.v && 1485 x->km.state == XFRM_STATE_ACQ) { 1486 xfrm_state_hold(x); 1487 return x; 1488 } 1489 } 1490 } 1491 return NULL; 1492} 1493 1494struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) 1495{ 1496 struct xfrm_state *x; 1497 1498 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1499 x = __xfrm_find_acq_byseq(net, mark, seq); 1500 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1501 return x; 1502} 1503EXPORT_SYMBOL(xfrm_find_acq_byseq); 1504 1505u32 xfrm_get_acqseq(void) 1506{ 1507 u32 res; 1508 static atomic_t acqseq; 1509 1510 do { 1511 res = atomic_inc_return(&acqseq); 1512 } while (!res); 1513 1514 return res; 1515} 1516EXPORT_SYMBOL(xfrm_get_acqseq); 1517 1518int verify_spi_info(u8 proto, u32 min, u32 max) 1519{ 1520 switch (proto) { 1521 case IPPROTO_AH: 1522 case IPPROTO_ESP: 1523 break; 1524 1525 case IPPROTO_COMP: 1526 /* IPCOMP spi is 16-bits. */ 1527 if (max >= 0x10000) 1528 return -EINVAL; 1529 break; 1530 1531 default: 1532 return -EINVAL; 1533 } 1534 1535 if (min > max) 1536 return -EINVAL; 1537 1538 return 0; 1539} 1540EXPORT_SYMBOL(verify_spi_info); 1541 1542int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high) 1543{ 1544 struct net *net = xs_net(x); 1545 unsigned int h; 1546 struct xfrm_state *x0; 1547 int err = -ENOENT; 1548 __be32 minspi = htonl(low); 1549 __be32 maxspi = htonl(high); 1550 u32 mark = x->mark.v & x->mark.m; 1551 1552 spin_lock_bh(&x->lock); 1553 if (x->km.state == XFRM_STATE_DEAD) 1554 goto unlock; 1555 1556 err = 0; 1557 if (x->id.spi) 1558 goto unlock; 1559 1560 err = -ENOENT; 1561 1562 if (minspi == maxspi) { 1563 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family); 1564 if (x0) { 1565 xfrm_state_put(x0); 1566 goto unlock; 1567 } 1568 x->id.spi = minspi; 1569 } else { 1570 u32 spi = 0; 1571 for (h = 0; h < high-low+1; h++) { 1572 spi = low + prandom_u32()%(high-low+1); 1573 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family); 1574 if (x0 == NULL) { 1575 x->id.spi = htonl(spi); 1576 break; 1577 } 1578 xfrm_state_put(x0); 1579 } 1580 } 1581 if (x->id.spi) { 1582 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1583 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family); 1584 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); 1585 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1586 1587 err = 0; 1588 } 1589 1590unlock: 1591 spin_unlock_bh(&x->lock); 1592 1593 return err; 1594} 1595EXPORT_SYMBOL(xfrm_alloc_spi); 1596 1597static bool __xfrm_state_filter_match(struct xfrm_state *x, 1598 struct xfrm_address_filter *filter) 1599{ 1600 if (filter) { 1601 if ((filter->family == AF_INET || 1602 filter->family == AF_INET6) && 1603 x->props.family != filter->family) 1604 return false; 1605 1606 return addr_match(&x->props.saddr, &filter->saddr, 1607 filter->splen) && 1608 addr_match(&x->id.daddr, &filter->daddr, 1609 filter->dplen); 1610 } 1611 return true; 1612} 1613 1614int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 1615 int (*func)(struct xfrm_state *, int, void*), 1616 void *data) 1617{ 1618 struct xfrm_state *state; 1619 struct xfrm_state_walk *x; 1620 int err = 0; 1621 1622 if (walk->seq != 0 && list_empty(&walk->all)) 1623 return 0; 1624 1625 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1626 if (list_empty(&walk->all)) 1627 x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all); 1628 else 1629 x = list_entry(&walk->all, struct xfrm_state_walk, all); 1630 list_for_each_entry_from(x, &net->xfrm.state_all, all) { 1631 if (x->state == XFRM_STATE_DEAD) 1632 continue; 1633 state = container_of(x, struct xfrm_state, km); 1634 if (!xfrm_id_proto_match(state->id.proto, walk->proto)) 1635 continue; 1636 if (!__xfrm_state_filter_match(state, walk->filter)) 1637 continue; 1638 err = func(state, walk->seq, data); 1639 if (err) { 1640 list_move_tail(&walk->all, &x->all); 1641 goto out; 1642 } 1643 walk->seq++; 1644 } 1645 if (walk->seq == 0) { 1646 err = -ENOENT; 1647 goto out; 1648 } 1649 list_del_init(&walk->all); 1650out: 1651 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1652 return err; 1653} 1654EXPORT_SYMBOL(xfrm_state_walk); 1655 1656void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1657 struct xfrm_address_filter *filter) 1658{ 1659 INIT_LIST_HEAD(&walk->all); 1660 walk->proto = proto; 1661 walk->state = XFRM_STATE_DEAD; 1662 walk->seq = 0; 1663 walk->filter = filter; 1664} 1665EXPORT_SYMBOL(xfrm_state_walk_init); 1666 1667void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net) 1668{ 1669 kfree(walk->filter); 1670 1671 if (list_empty(&walk->all)) 1672 return; 1673 1674 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1675 list_del(&walk->all); 1676 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1677} 1678EXPORT_SYMBOL(xfrm_state_walk_done); 1679 1680static void xfrm_replay_timer_handler(unsigned long data) 1681{ 1682 struct xfrm_state *x = (struct xfrm_state *)data; 1683 1684 spin_lock(&x->lock); 1685 1686 if (x->km.state == XFRM_STATE_VALID) { 1687 if (xfrm_aevent_is_on(xs_net(x))) 1688 x->repl->notify(x, XFRM_REPLAY_TIMEOUT); 1689 else 1690 x->xflags |= XFRM_TIME_DEFER; 1691 } 1692 1693 spin_unlock(&x->lock); 1694} 1695 1696static LIST_HEAD(xfrm_km_list); 1697 1698void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 1699{ 1700 struct xfrm_mgr *km; 1701 1702 rcu_read_lock(); 1703 list_for_each_entry_rcu(km, &xfrm_km_list, list) 1704 if (km->notify_policy) 1705 km->notify_policy(xp, dir, c); 1706 rcu_read_unlock(); 1707} 1708 1709void km_state_notify(struct xfrm_state *x, const struct km_event *c) 1710{ 1711 struct xfrm_mgr *km; 1712 rcu_read_lock(); 1713 list_for_each_entry_rcu(km, &xfrm_km_list, list) 1714 if (km->notify) 1715 km->notify(x, c); 1716 rcu_read_unlock(); 1717} 1718 1719EXPORT_SYMBOL(km_policy_notify); 1720EXPORT_SYMBOL(km_state_notify); 1721 1722void km_state_expired(struct xfrm_state *x, int hard, u32 portid) 1723{ 1724 struct km_event c; 1725 1726 c.data.hard = hard; 1727 c.portid = portid; 1728 c.event = XFRM_MSG_EXPIRE; 1729 km_state_notify(x, &c); 1730} 1731 1732EXPORT_SYMBOL(km_state_expired); 1733/* 1734 * We send to all registered managers regardless of failure 1735 * We are happy with one success 1736*/ 1737int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol) 1738{ 1739 int err = -EINVAL, acqret; 1740 struct xfrm_mgr *km; 1741 1742 rcu_read_lock(); 1743 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1744 acqret = km->acquire(x, t, pol); 1745 if (!acqret) 1746 err = acqret; 1747 } 1748 rcu_read_unlock(); 1749 return err; 1750} 1751EXPORT_SYMBOL(km_query); 1752 1753int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 1754{ 1755 int err = -EINVAL; 1756 struct xfrm_mgr *km; 1757 1758 rcu_read_lock(); 1759 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1760 if (km->new_mapping) 1761 err = km->new_mapping(x, ipaddr, sport); 1762 if (!err) 1763 break; 1764 } 1765 rcu_read_unlock(); 1766 return err; 1767} 1768EXPORT_SYMBOL(km_new_mapping); 1769 1770void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid) 1771{ 1772 struct km_event c; 1773 1774 c.data.hard = hard; 1775 c.portid = portid; 1776 c.event = XFRM_MSG_POLEXPIRE; 1777 km_policy_notify(pol, dir, &c); 1778} 1779EXPORT_SYMBOL(km_policy_expired); 1780 1781#ifdef CONFIG_XFRM_MIGRATE 1782int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1783 const struct xfrm_migrate *m, int num_migrate, 1784 const struct xfrm_kmaddress *k) 1785{ 1786 int err = -EINVAL; 1787 int ret; 1788 struct xfrm_mgr *km; 1789 1790 rcu_read_lock(); 1791 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1792 if (km->migrate) { 1793 ret = km->migrate(sel, dir, type, m, num_migrate, k); 1794 if (!ret) 1795 err = ret; 1796 } 1797 } 1798 rcu_read_unlock(); 1799 return err; 1800} 1801EXPORT_SYMBOL(km_migrate); 1802#endif 1803 1804int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr) 1805{ 1806 int err = -EINVAL; 1807 int ret; 1808 struct xfrm_mgr *km; 1809 1810 rcu_read_lock(); 1811 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1812 if (km->report) { 1813 ret = km->report(net, proto, sel, addr); 1814 if (!ret) 1815 err = ret; 1816 } 1817 } 1818 rcu_read_unlock(); 1819 return err; 1820} 1821EXPORT_SYMBOL(km_report); 1822 1823bool km_is_alive(const struct km_event *c) 1824{ 1825 struct xfrm_mgr *km; 1826 bool is_alive = false; 1827 1828 rcu_read_lock(); 1829 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1830 if (km->is_alive && km->is_alive(c)) { 1831 is_alive = true; 1832 break; 1833 } 1834 } 1835 rcu_read_unlock(); 1836 1837 return is_alive; 1838} 1839EXPORT_SYMBOL(km_is_alive); 1840 1841int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 1842{ 1843 int err; 1844 u8 *data; 1845 struct xfrm_mgr *km; 1846 struct xfrm_policy *pol = NULL; 1847 1848 if (optlen <= 0 || optlen > PAGE_SIZE) 1849 return -EMSGSIZE; 1850 1851 data = kmalloc(optlen, GFP_KERNEL); 1852 if (!data) 1853 return -ENOMEM; 1854 1855 err = -EFAULT; 1856 if (copy_from_user(data, optval, optlen)) 1857 goto out; 1858 1859 err = -EINVAL; 1860 rcu_read_lock(); 1861 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1862 pol = km->compile_policy(sk, optname, data, 1863 optlen, &err); 1864 if (err >= 0) 1865 break; 1866 } 1867 rcu_read_unlock(); 1868 1869 if (err >= 0) { 1870 xfrm_sk_policy_insert(sk, err, pol); 1871 xfrm_pol_put(pol); 1872 err = 0; 1873 } 1874 1875out: 1876 kfree(data); 1877 return err; 1878} 1879EXPORT_SYMBOL(xfrm_user_policy); 1880 1881static DEFINE_SPINLOCK(xfrm_km_lock); 1882 1883int xfrm_register_km(struct xfrm_mgr *km) 1884{ 1885 spin_lock_bh(&xfrm_km_lock); 1886 list_add_tail_rcu(&km->list, &xfrm_km_list); 1887 spin_unlock_bh(&xfrm_km_lock); 1888 return 0; 1889} 1890EXPORT_SYMBOL(xfrm_register_km); 1891 1892int xfrm_unregister_km(struct xfrm_mgr *km) 1893{ 1894 spin_lock_bh(&xfrm_km_lock); 1895 list_del_rcu(&km->list); 1896 spin_unlock_bh(&xfrm_km_lock); 1897 synchronize_rcu(); 1898 return 0; 1899} 1900EXPORT_SYMBOL(xfrm_unregister_km); 1901 1902int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo) 1903{ 1904 int err = 0; 1905 if (unlikely(afinfo == NULL)) 1906 return -EINVAL; 1907 if (unlikely(afinfo->family >= NPROTO)) 1908 return -EAFNOSUPPORT; 1909 spin_lock_bh(&xfrm_state_afinfo_lock); 1910 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL)) 1911 err = -ENOBUFS; 1912 else 1913 rcu_assign_pointer(xfrm_state_afinfo[afinfo->family], afinfo); 1914 spin_unlock_bh(&xfrm_state_afinfo_lock); 1915 return err; 1916} 1917EXPORT_SYMBOL(xfrm_state_register_afinfo); 1918 1919int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo) 1920{ 1921 int err = 0; 1922 if (unlikely(afinfo == NULL)) 1923 return -EINVAL; 1924 if (unlikely(afinfo->family >= NPROTO)) 1925 return -EAFNOSUPPORT; 1926 spin_lock_bh(&xfrm_state_afinfo_lock); 1927 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) { 1928 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo)) 1929 err = -EINVAL; 1930 else 1931 RCU_INIT_POINTER(xfrm_state_afinfo[afinfo->family], NULL); 1932 } 1933 spin_unlock_bh(&xfrm_state_afinfo_lock); 1934 synchronize_rcu(); 1935 return err; 1936} 1937EXPORT_SYMBOL(xfrm_state_unregister_afinfo); 1938 1939struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family) 1940{ 1941 struct xfrm_state_afinfo *afinfo; 1942 if (unlikely(family >= NPROTO)) 1943 return NULL; 1944 rcu_read_lock(); 1945 afinfo = rcu_dereference(xfrm_state_afinfo[family]); 1946 if (unlikely(!afinfo)) 1947 rcu_read_unlock(); 1948 return afinfo; 1949} 1950 1951void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo) 1952{ 1953 rcu_read_unlock(); 1954} 1955 1956/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ 1957void xfrm_state_delete_tunnel(struct xfrm_state *x) 1958{ 1959 if (x->tunnel) { 1960 struct xfrm_state *t = x->tunnel; 1961 1962 if (atomic_read(&t->tunnel_users) == 2) 1963 xfrm_state_delete(t); 1964 atomic_dec(&t->tunnel_users); 1965 xfrm_state_put(t); 1966 x->tunnel = NULL; 1967 } 1968} 1969EXPORT_SYMBOL(xfrm_state_delete_tunnel); 1970 1971int xfrm_state_mtu(struct xfrm_state *x, int mtu) 1972{ 1973 int res; 1974 1975 spin_lock_bh(&x->lock); 1976 if (x->km.state == XFRM_STATE_VALID && 1977 x->type && x->type->get_mtu) 1978 res = x->type->get_mtu(x, mtu); 1979 else 1980 res = mtu - x->props.header_len; 1981 spin_unlock_bh(&x->lock); 1982 return res; 1983} 1984 1985int __xfrm_init_state(struct xfrm_state *x, bool init_replay) 1986{ 1987 struct xfrm_state_afinfo *afinfo; 1988 struct xfrm_mode *inner_mode; 1989 int family = x->props.family; 1990 int err; 1991 1992 err = -EAFNOSUPPORT; 1993 afinfo = xfrm_state_get_afinfo(family); 1994 if (!afinfo) 1995 goto error; 1996 1997 err = 0; 1998 if (afinfo->init_flags) 1999 err = afinfo->init_flags(x); 2000 2001 xfrm_state_put_afinfo(afinfo); 2002 2003 if (err) 2004 goto error; 2005 2006 err = -EPROTONOSUPPORT; 2007 2008 if (x->sel.family != AF_UNSPEC) { 2009 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family); 2010 if (inner_mode == NULL) 2011 goto error; 2012 2013 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) && 2014 family != x->sel.family) { 2015 xfrm_put_mode(inner_mode); 2016 goto error; 2017 } 2018 2019 x->inner_mode = inner_mode; 2020 } else { 2021 struct xfrm_mode *inner_mode_iaf; 2022 int iafamily = AF_INET; 2023 2024 inner_mode = xfrm_get_mode(x->props.mode, x->props.family); 2025 if (inner_mode == NULL) 2026 goto error; 2027 2028 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) { 2029 xfrm_put_mode(inner_mode); 2030 goto error; 2031 } 2032 x->inner_mode = inner_mode; 2033 2034 if (x->props.family == AF_INET) 2035 iafamily = AF_INET6; 2036 2037 inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily); 2038 if (inner_mode_iaf) { 2039 if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL) 2040 x->inner_mode_iaf = inner_mode_iaf; 2041 else 2042 xfrm_put_mode(inner_mode_iaf); 2043 } 2044 } 2045 2046 x->type = xfrm_get_type(x->id.proto, family); 2047 if (x->type == NULL) 2048 goto error; 2049 2050 err = x->type->init_state(x); 2051 if (err) 2052 goto error; 2053 2054 x->outer_mode = xfrm_get_mode(x->props.mode, family); 2055 if (x->outer_mode == NULL) { 2056 err = -EPROTONOSUPPORT; 2057 goto error; 2058 } 2059 2060 if (init_replay) { 2061 err = xfrm_init_replay(x); 2062 if (err) 2063 goto error; 2064 } 2065 2066 x->km.state = XFRM_STATE_VALID; 2067 2068error: 2069 return err; 2070} 2071 2072EXPORT_SYMBOL(__xfrm_init_state); 2073 2074int xfrm_init_state(struct xfrm_state *x) 2075{ 2076 return __xfrm_init_state(x, true); 2077} 2078 2079EXPORT_SYMBOL(xfrm_init_state); 2080 2081int __net_init xfrm_state_init(struct net *net) 2082{ 2083 unsigned int sz; 2084 2085 INIT_LIST_HEAD(&net->xfrm.state_all); 2086 2087 sz = sizeof(struct hlist_head) * 8; 2088 2089 net->xfrm.state_bydst = xfrm_hash_alloc(sz); 2090 if (!net->xfrm.state_bydst) 2091 goto out_bydst; 2092 net->xfrm.state_bysrc = xfrm_hash_alloc(sz); 2093 if (!net->xfrm.state_bysrc) 2094 goto out_bysrc; 2095 net->xfrm.state_byspi = xfrm_hash_alloc(sz); 2096 if (!net->xfrm.state_byspi) 2097 goto out_byspi; 2098 net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1); 2099 2100 net->xfrm.state_num = 0; 2101 INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize); 2102 INIT_HLIST_HEAD(&net->xfrm.state_gc_list); 2103 INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task); 2104 spin_lock_init(&net->xfrm.xfrm_state_lock); 2105 return 0; 2106 2107out_byspi: 2108 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2109out_bysrc: 2110 xfrm_hash_free(net->xfrm.state_bydst, sz); 2111out_bydst: 2112 return -ENOMEM; 2113} 2114 2115void xfrm_state_fini(struct net *net) 2116{ 2117 unsigned int sz; 2118 2119 flush_work(&net->xfrm.state_hash_work); 2120 xfrm_state_flush(net, IPSEC_PROTO_ANY, false); 2121 flush_work(&net->xfrm.state_gc_work); 2122 2123 WARN_ON(!list_empty(&net->xfrm.state_all)); 2124 2125 sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head); 2126 WARN_ON(!hlist_empty(net->xfrm.state_byspi)); 2127 xfrm_hash_free(net->xfrm.state_byspi, sz); 2128 WARN_ON(!hlist_empty(net->xfrm.state_bysrc)); 2129 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2130 WARN_ON(!hlist_empty(net->xfrm.state_bydst)); 2131 xfrm_hash_free(net->xfrm.state_bydst, sz); 2132} 2133 2134#ifdef CONFIG_AUDITSYSCALL 2135static void xfrm_audit_helper_sainfo(struct xfrm_state *x, 2136 struct audit_buffer *audit_buf) 2137{ 2138 struct xfrm_sec_ctx *ctx = x->security; 2139 u32 spi = ntohl(x->id.spi); 2140 2141 if (ctx) 2142 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", 2143 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str); 2144 2145 switch (x->props.family) { 2146 case AF_INET: 2147 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2148 &x->props.saddr.a4, &x->id.daddr.a4); 2149 break; 2150 case AF_INET6: 2151 audit_log_format(audit_buf, " src=%pI6 dst=%pI6", 2152 x->props.saddr.a6, x->id.daddr.a6); 2153 break; 2154 } 2155 2156 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2157} 2158 2159static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, 2160 struct audit_buffer *audit_buf) 2161{ 2162 const struct iphdr *iph4; 2163 const struct ipv6hdr *iph6; 2164 2165 switch (family) { 2166 case AF_INET: 2167 iph4 = ip_hdr(skb); 2168 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2169 &iph4->saddr, &iph4->daddr); 2170 break; 2171 case AF_INET6: 2172 iph6 = ipv6_hdr(skb); 2173 audit_log_format(audit_buf, 2174 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x", 2175 &iph6->saddr, &iph6->daddr, 2176 iph6->flow_lbl[0] & 0x0f, 2177 iph6->flow_lbl[1], 2178 iph6->flow_lbl[2]); 2179 break; 2180 } 2181} 2182 2183void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid) 2184{ 2185 struct audit_buffer *audit_buf; 2186 2187 audit_buf = xfrm_audit_start("SAD-add"); 2188 if (audit_buf == NULL) 2189 return; 2190 xfrm_audit_helper_usrinfo(task_valid, audit_buf); 2191 xfrm_audit_helper_sainfo(x, audit_buf); 2192 audit_log_format(audit_buf, " res=%u", result); 2193 audit_log_end(audit_buf); 2194} 2195EXPORT_SYMBOL_GPL(xfrm_audit_state_add); 2196 2197void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid) 2198{ 2199 struct audit_buffer *audit_buf; 2200 2201 audit_buf = xfrm_audit_start("SAD-delete"); 2202 if (audit_buf == NULL) 2203 return; 2204 xfrm_audit_helper_usrinfo(task_valid, audit_buf); 2205 xfrm_audit_helper_sainfo(x, audit_buf); 2206 audit_log_format(audit_buf, " res=%u", result); 2207 audit_log_end(audit_buf); 2208} 2209EXPORT_SYMBOL_GPL(xfrm_audit_state_delete); 2210 2211void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 2212 struct sk_buff *skb) 2213{ 2214 struct audit_buffer *audit_buf; 2215 u32 spi; 2216 2217 audit_buf = xfrm_audit_start("SA-replay-overflow"); 2218 if (audit_buf == NULL) 2219 return; 2220 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2221 /* don't record the sequence number because it's inherent in this kind 2222 * of audit message */ 2223 spi = ntohl(x->id.spi); 2224 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2225 audit_log_end(audit_buf); 2226} 2227EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow); 2228 2229void xfrm_audit_state_replay(struct xfrm_state *x, 2230 struct sk_buff *skb, __be32 net_seq) 2231{ 2232 struct audit_buffer *audit_buf; 2233 u32 spi; 2234 2235 audit_buf = xfrm_audit_start("SA-replayed-pkt"); 2236 if (audit_buf == NULL) 2237 return; 2238 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2239 spi = ntohl(x->id.spi); 2240 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2241 spi, spi, ntohl(net_seq)); 2242 audit_log_end(audit_buf); 2243} 2244EXPORT_SYMBOL_GPL(xfrm_audit_state_replay); 2245 2246void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family) 2247{ 2248 struct audit_buffer *audit_buf; 2249 2250 audit_buf = xfrm_audit_start("SA-notfound"); 2251 if (audit_buf == NULL) 2252 return; 2253 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2254 audit_log_end(audit_buf); 2255} 2256EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple); 2257 2258void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 2259 __be32 net_spi, __be32 net_seq) 2260{ 2261 struct audit_buffer *audit_buf; 2262 u32 spi; 2263 2264 audit_buf = xfrm_audit_start("SA-notfound"); 2265 if (audit_buf == NULL) 2266 return; 2267 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2268 spi = ntohl(net_spi); 2269 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2270 spi, spi, ntohl(net_seq)); 2271 audit_log_end(audit_buf); 2272} 2273EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound); 2274 2275void xfrm_audit_state_icvfail(struct xfrm_state *x, 2276 struct sk_buff *skb, u8 proto) 2277{ 2278 struct audit_buffer *audit_buf; 2279 __be32 net_spi; 2280 __be32 net_seq; 2281 2282 audit_buf = xfrm_audit_start("SA-icv-failure"); 2283 if (audit_buf == NULL) 2284 return; 2285 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2286 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) { 2287 u32 spi = ntohl(net_spi); 2288 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2289 spi, spi, ntohl(net_seq)); 2290 } 2291 audit_log_end(audit_buf); 2292} 2293EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail); 2294#endif /* CONFIG_AUDITSYSCALL */ 2295