xfrm_state.c revision 0e6024519b4da2d9413b97be1de8122d5709ccc1
1/* 2 * xfrm_state.c 3 * 4 * Changes: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * YOSHIFUJI Hideaki @USAGI 10 * Split up af-specific functions 11 * Derek Atkins <derek@ihtfp.com> 12 * Add UDP Encapsulation 13 * 14 */ 15 16#include <linux/workqueue.h> 17#include <net/xfrm.h> 18#include <linux/pfkeyv2.h> 19#include <linux/ipsec.h> 20#include <linux/module.h> 21#include <linux/cache.h> 22#include <linux/audit.h> 23#include <asm/uaccess.h> 24 25#include "xfrm_hash.h" 26 27struct sock *xfrm_nl; 28EXPORT_SYMBOL(xfrm_nl); 29 30u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME; 31EXPORT_SYMBOL(sysctl_xfrm_aevent_etime); 32 33u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE; 34EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth); 35 36u32 sysctl_xfrm_acq_expires __read_mostly = 30; 37 38/* Each xfrm_state may be linked to two tables: 39 40 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl) 41 2. Hash table by (daddr,family,reqid) to find what SAs exist for given 42 destination/tunnel endpoint. (output) 43 */ 44 45static DEFINE_SPINLOCK(xfrm_state_lock); 46 47static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024; 48static unsigned int xfrm_state_genid; 49 50static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 51static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo); 52 53#ifdef CONFIG_AUDITSYSCALL 54static void xfrm_audit_state_replay(struct xfrm_state *x, 55 struct sk_buff *skb, __be32 net_seq); 56#else 57#define xfrm_audit_state_replay(x, s, sq) do { ; } while (0) 58#endif /* CONFIG_AUDITSYSCALL */ 59 60static inline unsigned int xfrm_dst_hash(struct net *net, 61 xfrm_address_t *daddr, 62 xfrm_address_t *saddr, 63 u32 reqid, 64 unsigned short family) 65{ 66 return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask); 67} 68 69static inline unsigned int xfrm_src_hash(struct net *net, 70 xfrm_address_t *daddr, 71 xfrm_address_t *saddr, 72 unsigned short family) 73{ 74 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask); 75} 76 77static inline unsigned int 78xfrm_spi_hash(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family) 79{ 80 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask); 81} 82 83static void xfrm_hash_transfer(struct hlist_head *list, 84 struct hlist_head *ndsttable, 85 struct hlist_head *nsrctable, 86 struct hlist_head *nspitable, 87 unsigned int nhashmask) 88{ 89 struct hlist_node *entry, *tmp; 90 struct xfrm_state *x; 91 92 hlist_for_each_entry_safe(x, entry, tmp, list, bydst) { 93 unsigned int h; 94 95 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr, 96 x->props.reqid, x->props.family, 97 nhashmask); 98 hlist_add_head(&x->bydst, ndsttable+h); 99 100 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr, 101 x->props.family, 102 nhashmask); 103 hlist_add_head(&x->bysrc, nsrctable+h); 104 105 if (x->id.spi) { 106 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi, 107 x->id.proto, x->props.family, 108 nhashmask); 109 hlist_add_head(&x->byspi, nspitable+h); 110 } 111 } 112} 113 114static unsigned long xfrm_hash_new_size(unsigned int state_hmask) 115{ 116 return ((state_hmask + 1) << 1) * sizeof(struct hlist_head); 117} 118 119static DEFINE_MUTEX(hash_resize_mutex); 120 121static void xfrm_hash_resize(struct work_struct *work) 122{ 123 struct net *net = container_of(work, struct net, xfrm.state_hash_work); 124 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi; 125 unsigned long nsize, osize; 126 unsigned int nhashmask, ohashmask; 127 int i; 128 129 mutex_lock(&hash_resize_mutex); 130 131 nsize = xfrm_hash_new_size(net->xfrm.state_hmask); 132 ndst = xfrm_hash_alloc(nsize); 133 if (!ndst) 134 goto out_unlock; 135 nsrc = xfrm_hash_alloc(nsize); 136 if (!nsrc) { 137 xfrm_hash_free(ndst, nsize); 138 goto out_unlock; 139 } 140 nspi = xfrm_hash_alloc(nsize); 141 if (!nspi) { 142 xfrm_hash_free(ndst, nsize); 143 xfrm_hash_free(nsrc, nsize); 144 goto out_unlock; 145 } 146 147 spin_lock_bh(&xfrm_state_lock); 148 149 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U; 150 for (i = net->xfrm.state_hmask; i >= 0; i--) 151 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi, 152 nhashmask); 153 154 odst = net->xfrm.state_bydst; 155 osrc = net->xfrm.state_bysrc; 156 ospi = net->xfrm.state_byspi; 157 ohashmask = net->xfrm.state_hmask; 158 159 net->xfrm.state_bydst = ndst; 160 net->xfrm.state_bysrc = nsrc; 161 net->xfrm.state_byspi = nspi; 162 net->xfrm.state_hmask = nhashmask; 163 164 spin_unlock_bh(&xfrm_state_lock); 165 166 osize = (ohashmask + 1) * sizeof(struct hlist_head); 167 xfrm_hash_free(odst, osize); 168 xfrm_hash_free(osrc, osize); 169 xfrm_hash_free(ospi, osize); 170 171out_unlock: 172 mutex_unlock(&hash_resize_mutex); 173} 174 175static DEFINE_RWLOCK(xfrm_state_afinfo_lock); 176static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO]; 177 178static DEFINE_SPINLOCK(xfrm_state_gc_lock); 179 180int __xfrm_state_delete(struct xfrm_state *x); 181 182int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); 183void km_state_expired(struct xfrm_state *x, int hard, u32 pid); 184 185static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family) 186{ 187 struct xfrm_state_afinfo *afinfo; 188 if (unlikely(family >= NPROTO)) 189 return NULL; 190 write_lock_bh(&xfrm_state_afinfo_lock); 191 afinfo = xfrm_state_afinfo[family]; 192 if (unlikely(!afinfo)) 193 write_unlock_bh(&xfrm_state_afinfo_lock); 194 return afinfo; 195} 196 197static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo) 198 __releases(xfrm_state_afinfo_lock) 199{ 200 write_unlock_bh(&xfrm_state_afinfo_lock); 201} 202 203int xfrm_register_type(const struct xfrm_type *type, unsigned short family) 204{ 205 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family); 206 const struct xfrm_type **typemap; 207 int err = 0; 208 209 if (unlikely(afinfo == NULL)) 210 return -EAFNOSUPPORT; 211 typemap = afinfo->type_map; 212 213 if (likely(typemap[type->proto] == NULL)) 214 typemap[type->proto] = type; 215 else 216 err = -EEXIST; 217 xfrm_state_unlock_afinfo(afinfo); 218 return err; 219} 220EXPORT_SYMBOL(xfrm_register_type); 221 222int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family) 223{ 224 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family); 225 const struct xfrm_type **typemap; 226 int err = 0; 227 228 if (unlikely(afinfo == NULL)) 229 return -EAFNOSUPPORT; 230 typemap = afinfo->type_map; 231 232 if (unlikely(typemap[type->proto] != type)) 233 err = -ENOENT; 234 else 235 typemap[type->proto] = NULL; 236 xfrm_state_unlock_afinfo(afinfo); 237 return err; 238} 239EXPORT_SYMBOL(xfrm_unregister_type); 240 241static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family) 242{ 243 struct xfrm_state_afinfo *afinfo; 244 const struct xfrm_type **typemap; 245 const struct xfrm_type *type; 246 int modload_attempted = 0; 247 248retry: 249 afinfo = xfrm_state_get_afinfo(family); 250 if (unlikely(afinfo == NULL)) 251 return NULL; 252 typemap = afinfo->type_map; 253 254 type = typemap[proto]; 255 if (unlikely(type && !try_module_get(type->owner))) 256 type = NULL; 257 if (!type && !modload_attempted) { 258 xfrm_state_put_afinfo(afinfo); 259 request_module("xfrm-type-%d-%d", family, proto); 260 modload_attempted = 1; 261 goto retry; 262 } 263 264 xfrm_state_put_afinfo(afinfo); 265 return type; 266} 267 268static void xfrm_put_type(const struct xfrm_type *type) 269{ 270 module_put(type->owner); 271} 272 273int xfrm_register_mode(struct xfrm_mode *mode, int family) 274{ 275 struct xfrm_state_afinfo *afinfo; 276 struct xfrm_mode **modemap; 277 int err; 278 279 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 280 return -EINVAL; 281 282 afinfo = xfrm_state_lock_afinfo(family); 283 if (unlikely(afinfo == NULL)) 284 return -EAFNOSUPPORT; 285 286 err = -EEXIST; 287 modemap = afinfo->mode_map; 288 if (modemap[mode->encap]) 289 goto out; 290 291 err = -ENOENT; 292 if (!try_module_get(afinfo->owner)) 293 goto out; 294 295 mode->afinfo = afinfo; 296 modemap[mode->encap] = mode; 297 err = 0; 298 299out: 300 xfrm_state_unlock_afinfo(afinfo); 301 return err; 302} 303EXPORT_SYMBOL(xfrm_register_mode); 304 305int xfrm_unregister_mode(struct xfrm_mode *mode, int family) 306{ 307 struct xfrm_state_afinfo *afinfo; 308 struct xfrm_mode **modemap; 309 int err; 310 311 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 312 return -EINVAL; 313 314 afinfo = xfrm_state_lock_afinfo(family); 315 if (unlikely(afinfo == NULL)) 316 return -EAFNOSUPPORT; 317 318 err = -ENOENT; 319 modemap = afinfo->mode_map; 320 if (likely(modemap[mode->encap] == mode)) { 321 modemap[mode->encap] = NULL; 322 module_put(mode->afinfo->owner); 323 err = 0; 324 } 325 326 xfrm_state_unlock_afinfo(afinfo); 327 return err; 328} 329EXPORT_SYMBOL(xfrm_unregister_mode); 330 331static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family) 332{ 333 struct xfrm_state_afinfo *afinfo; 334 struct xfrm_mode *mode; 335 int modload_attempted = 0; 336 337 if (unlikely(encap >= XFRM_MODE_MAX)) 338 return NULL; 339 340retry: 341 afinfo = xfrm_state_get_afinfo(family); 342 if (unlikely(afinfo == NULL)) 343 return NULL; 344 345 mode = afinfo->mode_map[encap]; 346 if (unlikely(mode && !try_module_get(mode->owner))) 347 mode = NULL; 348 if (!mode && !modload_attempted) { 349 xfrm_state_put_afinfo(afinfo); 350 request_module("xfrm-mode-%d-%d", family, encap); 351 modload_attempted = 1; 352 goto retry; 353 } 354 355 xfrm_state_put_afinfo(afinfo); 356 return mode; 357} 358 359static void xfrm_put_mode(struct xfrm_mode *mode) 360{ 361 module_put(mode->owner); 362} 363 364static void xfrm_state_gc_destroy(struct xfrm_state *x) 365{ 366 del_timer_sync(&x->timer); 367 del_timer_sync(&x->rtimer); 368 kfree(x->aalg); 369 kfree(x->ealg); 370 kfree(x->calg); 371 kfree(x->encap); 372 kfree(x->coaddr); 373 if (x->inner_mode) 374 xfrm_put_mode(x->inner_mode); 375 if (x->inner_mode_iaf) 376 xfrm_put_mode(x->inner_mode_iaf); 377 if (x->outer_mode) 378 xfrm_put_mode(x->outer_mode); 379 if (x->type) { 380 x->type->destructor(x); 381 xfrm_put_type(x->type); 382 } 383 security_xfrm_state_free(x); 384 kfree(x); 385} 386 387static void xfrm_state_gc_task(struct work_struct *work) 388{ 389 struct net *net = container_of(work, struct net, xfrm.state_gc_work); 390 struct xfrm_state *x; 391 struct hlist_node *entry, *tmp; 392 struct hlist_head gc_list; 393 394 spin_lock_bh(&xfrm_state_gc_lock); 395 hlist_move_list(&net->xfrm.state_gc_list, &gc_list); 396 spin_unlock_bh(&xfrm_state_gc_lock); 397 398 hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist) 399 xfrm_state_gc_destroy(x); 400 401 wake_up(&net->xfrm.km_waitq); 402} 403 404static inline unsigned long make_jiffies(long secs) 405{ 406 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ) 407 return MAX_SCHEDULE_TIMEOUT-1; 408 else 409 return secs*HZ; 410} 411 412static void xfrm_timer_handler(unsigned long data) 413{ 414 struct xfrm_state *x = (struct xfrm_state*)data; 415 struct net *net = xs_net(x); 416 unsigned long now = get_seconds(); 417 long next = LONG_MAX; 418 int warn = 0; 419 int err = 0; 420 421 spin_lock(&x->lock); 422 if (x->km.state == XFRM_STATE_DEAD) 423 goto out; 424 if (x->km.state == XFRM_STATE_EXPIRED) 425 goto expired; 426 if (x->lft.hard_add_expires_seconds) { 427 long tmo = x->lft.hard_add_expires_seconds + 428 x->curlft.add_time - now; 429 if (tmo <= 0) 430 goto expired; 431 if (tmo < next) 432 next = tmo; 433 } 434 if (x->lft.hard_use_expires_seconds) { 435 long tmo = x->lft.hard_use_expires_seconds + 436 (x->curlft.use_time ? : now) - now; 437 if (tmo <= 0) 438 goto expired; 439 if (tmo < next) 440 next = tmo; 441 } 442 if (x->km.dying) 443 goto resched; 444 if (x->lft.soft_add_expires_seconds) { 445 long tmo = x->lft.soft_add_expires_seconds + 446 x->curlft.add_time - now; 447 if (tmo <= 0) 448 warn = 1; 449 else if (tmo < next) 450 next = tmo; 451 } 452 if (x->lft.soft_use_expires_seconds) { 453 long tmo = x->lft.soft_use_expires_seconds + 454 (x->curlft.use_time ? : now) - now; 455 if (tmo <= 0) 456 warn = 1; 457 else if (tmo < next) 458 next = tmo; 459 } 460 461 x->km.dying = warn; 462 if (warn) 463 km_state_expired(x, 0, 0); 464resched: 465 if (next != LONG_MAX) 466 mod_timer(&x->timer, jiffies + make_jiffies(next)); 467 468 goto out; 469 470expired: 471 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) { 472 x->km.state = XFRM_STATE_EXPIRED; 473 wake_up(&net->xfrm.km_waitq); 474 next = 2; 475 goto resched; 476 } 477 478 err = __xfrm_state_delete(x); 479 if (!err && x->id.spi) 480 km_state_expired(x, 1, 0); 481 482 xfrm_audit_state_delete(x, err ? 0 : 1, 483 audit_get_loginuid(current), 484 audit_get_sessionid(current), 0); 485 486out: 487 spin_unlock(&x->lock); 488} 489 490static void xfrm_replay_timer_handler(unsigned long data); 491 492struct xfrm_state *xfrm_state_alloc(struct net *net) 493{ 494 struct xfrm_state *x; 495 496 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC); 497 498 if (x) { 499 write_pnet(&x->xs_net, net); 500 atomic_set(&x->refcnt, 1); 501 atomic_set(&x->tunnel_users, 0); 502 INIT_LIST_HEAD(&x->km.all); 503 INIT_HLIST_NODE(&x->bydst); 504 INIT_HLIST_NODE(&x->bysrc); 505 INIT_HLIST_NODE(&x->byspi); 506 setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x); 507 setup_timer(&x->rtimer, xfrm_replay_timer_handler, 508 (unsigned long)x); 509 x->curlft.add_time = get_seconds(); 510 x->lft.soft_byte_limit = XFRM_INF; 511 x->lft.soft_packet_limit = XFRM_INF; 512 x->lft.hard_byte_limit = XFRM_INF; 513 x->lft.hard_packet_limit = XFRM_INF; 514 x->replay_maxage = 0; 515 x->replay_maxdiff = 0; 516 x->inner_mode = NULL; 517 x->inner_mode_iaf = NULL; 518 spin_lock_init(&x->lock); 519 } 520 return x; 521} 522EXPORT_SYMBOL(xfrm_state_alloc); 523 524void __xfrm_state_destroy(struct xfrm_state *x) 525{ 526 struct net *net = xs_net(x); 527 528 WARN_ON(x->km.state != XFRM_STATE_DEAD); 529 530 spin_lock_bh(&xfrm_state_gc_lock); 531 hlist_add_head(&x->gclist, &net->xfrm.state_gc_list); 532 spin_unlock_bh(&xfrm_state_gc_lock); 533 schedule_work(&net->xfrm.state_gc_work); 534} 535EXPORT_SYMBOL(__xfrm_state_destroy); 536 537int __xfrm_state_delete(struct xfrm_state *x) 538{ 539 struct net *net = xs_net(x); 540 int err = -ESRCH; 541 542 if (x->km.state != XFRM_STATE_DEAD) { 543 x->km.state = XFRM_STATE_DEAD; 544 spin_lock(&xfrm_state_lock); 545 list_del(&x->km.all); 546 hlist_del(&x->bydst); 547 hlist_del(&x->bysrc); 548 if (x->id.spi) 549 hlist_del(&x->byspi); 550 net->xfrm.state_num--; 551 spin_unlock(&xfrm_state_lock); 552 553 /* All xfrm_state objects are created by xfrm_state_alloc. 554 * The xfrm_state_alloc call gives a reference, and that 555 * is what we are dropping here. 556 */ 557 xfrm_state_put(x); 558 err = 0; 559 } 560 561 return err; 562} 563EXPORT_SYMBOL(__xfrm_state_delete); 564 565int xfrm_state_delete(struct xfrm_state *x) 566{ 567 int err; 568 569 spin_lock_bh(&x->lock); 570 err = __xfrm_state_delete(x); 571 spin_unlock_bh(&x->lock); 572 573 return err; 574} 575EXPORT_SYMBOL(xfrm_state_delete); 576 577#ifdef CONFIG_SECURITY_NETWORK_XFRM 578static inline int 579xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info) 580{ 581 int i, err = 0; 582 583 for (i = 0; i <= net->xfrm.state_hmask; i++) { 584 struct hlist_node *entry; 585 struct xfrm_state *x; 586 587 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) { 588 if (xfrm_id_proto_match(x->id.proto, proto) && 589 (err = security_xfrm_state_delete(x)) != 0) { 590 xfrm_audit_state_delete(x, 0, 591 audit_info->loginuid, 592 audit_info->sessionid, 593 audit_info->secid); 594 return err; 595 } 596 } 597 } 598 599 return err; 600} 601#else 602static inline int 603xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info) 604{ 605 return 0; 606} 607#endif 608 609int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info) 610{ 611 int i, err = 0; 612 613 spin_lock_bh(&xfrm_state_lock); 614 err = xfrm_state_flush_secctx_check(net, proto, audit_info); 615 if (err) 616 goto out; 617 618 for (i = 0; i <= net->xfrm.state_hmask; i++) { 619 struct hlist_node *entry; 620 struct xfrm_state *x; 621restart: 622 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) { 623 if (!xfrm_state_kern(x) && 624 xfrm_id_proto_match(x->id.proto, proto)) { 625 xfrm_state_hold(x); 626 spin_unlock_bh(&xfrm_state_lock); 627 628 err = xfrm_state_delete(x); 629 xfrm_audit_state_delete(x, err ? 0 : 1, 630 audit_info->loginuid, 631 audit_info->sessionid, 632 audit_info->secid); 633 xfrm_state_put(x); 634 635 spin_lock_bh(&xfrm_state_lock); 636 goto restart; 637 } 638 } 639 } 640 err = 0; 641 642out: 643 spin_unlock_bh(&xfrm_state_lock); 644 wake_up(&net->xfrm.km_waitq); 645 return err; 646} 647EXPORT_SYMBOL(xfrm_state_flush); 648 649void xfrm_sad_getinfo(struct xfrmk_sadinfo *si) 650{ 651 spin_lock_bh(&xfrm_state_lock); 652 si->sadcnt = init_net.xfrm.state_num; 653 si->sadhcnt = init_net.xfrm.state_hmask; 654 si->sadhmcnt = xfrm_state_hashmax; 655 spin_unlock_bh(&xfrm_state_lock); 656} 657EXPORT_SYMBOL(xfrm_sad_getinfo); 658 659static int 660xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl, 661 struct xfrm_tmpl *tmpl, 662 xfrm_address_t *daddr, xfrm_address_t *saddr, 663 unsigned short family) 664{ 665 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 666 if (!afinfo) 667 return -1; 668 afinfo->init_tempsel(x, fl, tmpl, daddr, saddr); 669 xfrm_state_put_afinfo(afinfo); 670 return 0; 671} 672 673static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family) 674{ 675 unsigned int h = xfrm_spi_hash(&init_net, daddr, spi, proto, family); 676 struct xfrm_state *x; 677 struct hlist_node *entry; 678 679 hlist_for_each_entry(x, entry, init_net.xfrm.state_byspi+h, byspi) { 680 if (x->props.family != family || 681 x->id.spi != spi || 682 x->id.proto != proto) 683 continue; 684 685 switch (family) { 686 case AF_INET: 687 if (x->id.daddr.a4 != daddr->a4) 688 continue; 689 break; 690 case AF_INET6: 691 if (!ipv6_addr_equal((struct in6_addr *)daddr, 692 (struct in6_addr *) 693 x->id.daddr.a6)) 694 continue; 695 break; 696 } 697 698 xfrm_state_hold(x); 699 return x; 700 } 701 702 return NULL; 703} 704 705static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family) 706{ 707 unsigned int h = xfrm_src_hash(&init_net, daddr, saddr, family); 708 struct xfrm_state *x; 709 struct hlist_node *entry; 710 711 hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) { 712 if (x->props.family != family || 713 x->id.proto != proto) 714 continue; 715 716 switch (family) { 717 case AF_INET: 718 if (x->id.daddr.a4 != daddr->a4 || 719 x->props.saddr.a4 != saddr->a4) 720 continue; 721 break; 722 case AF_INET6: 723 if (!ipv6_addr_equal((struct in6_addr *)daddr, 724 (struct in6_addr *) 725 x->id.daddr.a6) || 726 !ipv6_addr_equal((struct in6_addr *)saddr, 727 (struct in6_addr *) 728 x->props.saddr.a6)) 729 continue; 730 break; 731 } 732 733 xfrm_state_hold(x); 734 return x; 735 } 736 737 return NULL; 738} 739 740static inline struct xfrm_state * 741__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) 742{ 743 if (use_spi) 744 return __xfrm_state_lookup(&x->id.daddr, x->id.spi, 745 x->id.proto, family); 746 else 747 return __xfrm_state_lookup_byaddr(&x->id.daddr, 748 &x->props.saddr, 749 x->id.proto, family); 750} 751 752static void xfrm_hash_grow_check(struct net *net, int have_hash_collision) 753{ 754 if (have_hash_collision && 755 (net->xfrm.state_hmask + 1) < xfrm_state_hashmax && 756 net->xfrm.state_num > net->xfrm.state_hmask) 757 schedule_work(&net->xfrm.state_hash_work); 758} 759 760struct xfrm_state * 761xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 762 struct flowi *fl, struct xfrm_tmpl *tmpl, 763 struct xfrm_policy *pol, int *err, 764 unsigned short family) 765{ 766 unsigned int h; 767 struct hlist_node *entry; 768 struct xfrm_state *x, *x0, *to_put; 769 int acquire_in_progress = 0; 770 int error = 0; 771 struct xfrm_state *best = NULL; 772 773 to_put = NULL; 774 775 spin_lock_bh(&xfrm_state_lock); 776 h = xfrm_dst_hash(&init_net, daddr, saddr, tmpl->reqid, family); 777 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) { 778 if (x->props.family == family && 779 x->props.reqid == tmpl->reqid && 780 !(x->props.flags & XFRM_STATE_WILDRECV) && 781 xfrm_state_addr_check(x, daddr, saddr, family) && 782 tmpl->mode == x->props.mode && 783 tmpl->id.proto == x->id.proto && 784 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) { 785 /* Resolution logic: 786 1. There is a valid state with matching selector. 787 Done. 788 2. Valid state with inappropriate selector. Skip. 789 790 Entering area of "sysdeps". 791 792 3. If state is not valid, selector is temporary, 793 it selects only session which triggered 794 previous resolution. Key manager will do 795 something to install a state with proper 796 selector. 797 */ 798 if (x->km.state == XFRM_STATE_VALID) { 799 if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) || 800 !security_xfrm_state_pol_flow_match(x, pol, fl)) 801 continue; 802 if (!best || 803 best->km.dying > x->km.dying || 804 (best->km.dying == x->km.dying && 805 best->curlft.add_time < x->curlft.add_time)) 806 best = x; 807 } else if (x->km.state == XFRM_STATE_ACQ) { 808 acquire_in_progress = 1; 809 } else if (x->km.state == XFRM_STATE_ERROR || 810 x->km.state == XFRM_STATE_EXPIRED) { 811 if (xfrm_selector_match(&x->sel, fl, x->sel.family) && 812 security_xfrm_state_pol_flow_match(x, pol, fl)) 813 error = -ESRCH; 814 } 815 } 816 } 817 818 x = best; 819 if (!x && !error && !acquire_in_progress) { 820 if (tmpl->id.spi && 821 (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi, 822 tmpl->id.proto, family)) != NULL) { 823 to_put = x0; 824 error = -EEXIST; 825 goto out; 826 } 827 x = xfrm_state_alloc(&init_net); 828 if (x == NULL) { 829 error = -ENOMEM; 830 goto out; 831 } 832 /* Initialize temporary selector matching only 833 * to current session. */ 834 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family); 835 836 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid); 837 if (error) { 838 x->km.state = XFRM_STATE_DEAD; 839 to_put = x; 840 x = NULL; 841 goto out; 842 } 843 844 if (km_query(x, tmpl, pol) == 0) { 845 x->km.state = XFRM_STATE_ACQ; 846 list_add(&x->km.all, &init_net.xfrm.state_all); 847 hlist_add_head(&x->bydst, init_net.xfrm.state_bydst+h); 848 h = xfrm_src_hash(&init_net, daddr, saddr, family); 849 hlist_add_head(&x->bysrc, init_net.xfrm.state_bysrc+h); 850 if (x->id.spi) { 851 h = xfrm_spi_hash(&init_net, &x->id.daddr, x->id.spi, x->id.proto, family); 852 hlist_add_head(&x->byspi, init_net.xfrm.state_byspi+h); 853 } 854 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires; 855 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ; 856 add_timer(&x->timer); 857 init_net.xfrm.state_num++; 858 xfrm_hash_grow_check(&init_net, x->bydst.next != NULL); 859 } else { 860 x->km.state = XFRM_STATE_DEAD; 861 to_put = x; 862 x = NULL; 863 error = -ESRCH; 864 } 865 } 866out: 867 if (x) 868 xfrm_state_hold(x); 869 else 870 *err = acquire_in_progress ? -EAGAIN : error; 871 spin_unlock_bh(&xfrm_state_lock); 872 if (to_put) 873 xfrm_state_put(to_put); 874 return x; 875} 876 877struct xfrm_state * 878xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 879 unsigned short family, u8 mode, u8 proto, u32 reqid) 880{ 881 unsigned int h; 882 struct xfrm_state *rx = NULL, *x = NULL; 883 struct hlist_node *entry; 884 885 spin_lock(&xfrm_state_lock); 886 h = xfrm_dst_hash(&init_net, daddr, saddr, reqid, family); 887 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) { 888 if (x->props.family == family && 889 x->props.reqid == reqid && 890 !(x->props.flags & XFRM_STATE_WILDRECV) && 891 xfrm_state_addr_check(x, daddr, saddr, family) && 892 mode == x->props.mode && 893 proto == x->id.proto && 894 x->km.state == XFRM_STATE_VALID) { 895 rx = x; 896 break; 897 } 898 } 899 900 if (rx) 901 xfrm_state_hold(rx); 902 spin_unlock(&xfrm_state_lock); 903 904 905 return rx; 906} 907EXPORT_SYMBOL(xfrm_stateonly_find); 908 909static void __xfrm_state_insert(struct xfrm_state *x) 910{ 911 struct net *net = xs_net(x); 912 unsigned int h; 913 914 x->genid = ++xfrm_state_genid; 915 916 list_add(&x->km.all, &net->xfrm.state_all); 917 918 h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr, 919 x->props.reqid, x->props.family); 920 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h); 921 922 h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family); 923 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h); 924 925 if (x->id.spi) { 926 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, 927 x->props.family); 928 929 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); 930 } 931 932 mod_timer(&x->timer, jiffies + HZ); 933 if (x->replay_maxage) 934 mod_timer(&x->rtimer, jiffies + x->replay_maxage); 935 936 wake_up(&net->xfrm.km_waitq); 937 938 net->xfrm.state_num++; 939 940 xfrm_hash_grow_check(net, x->bydst.next != NULL); 941} 942 943/* xfrm_state_lock is held */ 944static void __xfrm_state_bump_genids(struct xfrm_state *xnew) 945{ 946 struct net *net = xs_net(xnew); 947 unsigned short family = xnew->props.family; 948 u32 reqid = xnew->props.reqid; 949 struct xfrm_state *x; 950 struct hlist_node *entry; 951 unsigned int h; 952 953 h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family); 954 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) { 955 if (x->props.family == family && 956 x->props.reqid == reqid && 957 !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) && 958 !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family)) 959 x->genid = xfrm_state_genid; 960 } 961} 962 963void xfrm_state_insert(struct xfrm_state *x) 964{ 965 spin_lock_bh(&xfrm_state_lock); 966 __xfrm_state_bump_genids(x); 967 __xfrm_state_insert(x); 968 spin_unlock_bh(&xfrm_state_lock); 969} 970EXPORT_SYMBOL(xfrm_state_insert); 971 972/* xfrm_state_lock is held */ 973static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create) 974{ 975 unsigned int h = xfrm_dst_hash(&init_net, daddr, saddr, reqid, family); 976 struct hlist_node *entry; 977 struct xfrm_state *x; 978 979 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) { 980 if (x->props.reqid != reqid || 981 x->props.mode != mode || 982 x->props.family != family || 983 x->km.state != XFRM_STATE_ACQ || 984 x->id.spi != 0 || 985 x->id.proto != proto) 986 continue; 987 988 switch (family) { 989 case AF_INET: 990 if (x->id.daddr.a4 != daddr->a4 || 991 x->props.saddr.a4 != saddr->a4) 992 continue; 993 break; 994 case AF_INET6: 995 if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6, 996 (struct in6_addr *)daddr) || 997 !ipv6_addr_equal((struct in6_addr *) 998 x->props.saddr.a6, 999 (struct in6_addr *)saddr)) 1000 continue; 1001 break; 1002 } 1003 1004 xfrm_state_hold(x); 1005 return x; 1006 } 1007 1008 if (!create) 1009 return NULL; 1010 1011 x = xfrm_state_alloc(&init_net); 1012 if (likely(x)) { 1013 switch (family) { 1014 case AF_INET: 1015 x->sel.daddr.a4 = daddr->a4; 1016 x->sel.saddr.a4 = saddr->a4; 1017 x->sel.prefixlen_d = 32; 1018 x->sel.prefixlen_s = 32; 1019 x->props.saddr.a4 = saddr->a4; 1020 x->id.daddr.a4 = daddr->a4; 1021 break; 1022 1023 case AF_INET6: 1024 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6, 1025 (struct in6_addr *)daddr); 1026 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6, 1027 (struct in6_addr *)saddr); 1028 x->sel.prefixlen_d = 128; 1029 x->sel.prefixlen_s = 128; 1030 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6, 1031 (struct in6_addr *)saddr); 1032 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6, 1033 (struct in6_addr *)daddr); 1034 break; 1035 } 1036 1037 x->km.state = XFRM_STATE_ACQ; 1038 x->id.proto = proto; 1039 x->props.family = family; 1040 x->props.mode = mode; 1041 x->props.reqid = reqid; 1042 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires; 1043 xfrm_state_hold(x); 1044 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ; 1045 add_timer(&x->timer); 1046 list_add(&x->km.all, &init_net.xfrm.state_all); 1047 hlist_add_head(&x->bydst, init_net.xfrm.state_bydst+h); 1048 h = xfrm_src_hash(&init_net, daddr, saddr, family); 1049 hlist_add_head(&x->bysrc, init_net.xfrm.state_bysrc+h); 1050 1051 init_net.xfrm.state_num++; 1052 1053 xfrm_hash_grow_check(&init_net, x->bydst.next != NULL); 1054 } 1055 1056 return x; 1057} 1058 1059static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq); 1060 1061int xfrm_state_add(struct xfrm_state *x) 1062{ 1063 struct xfrm_state *x1, *to_put; 1064 int family; 1065 int err; 1066 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1067 1068 family = x->props.family; 1069 1070 to_put = NULL; 1071 1072 spin_lock_bh(&xfrm_state_lock); 1073 1074 x1 = __xfrm_state_locate(x, use_spi, family); 1075 if (x1) { 1076 to_put = x1; 1077 x1 = NULL; 1078 err = -EEXIST; 1079 goto out; 1080 } 1081 1082 if (use_spi && x->km.seq) { 1083 x1 = __xfrm_find_acq_byseq(x->km.seq); 1084 if (x1 && ((x1->id.proto != x->id.proto) || 1085 xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) { 1086 to_put = x1; 1087 x1 = NULL; 1088 } 1089 } 1090 1091 if (use_spi && !x1) 1092 x1 = __find_acq_core(family, x->props.mode, x->props.reqid, 1093 x->id.proto, 1094 &x->id.daddr, &x->props.saddr, 0); 1095 1096 __xfrm_state_bump_genids(x); 1097 __xfrm_state_insert(x); 1098 err = 0; 1099 1100out: 1101 spin_unlock_bh(&xfrm_state_lock); 1102 1103 if (x1) { 1104 xfrm_state_delete(x1); 1105 xfrm_state_put(x1); 1106 } 1107 1108 if (to_put) 1109 xfrm_state_put(to_put); 1110 1111 return err; 1112} 1113EXPORT_SYMBOL(xfrm_state_add); 1114 1115#ifdef CONFIG_XFRM_MIGRATE 1116static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp) 1117{ 1118 struct net *net = xs_net(orig); 1119 int err = -ENOMEM; 1120 struct xfrm_state *x = xfrm_state_alloc(net); 1121 if (!x) 1122 goto error; 1123 1124 memcpy(&x->id, &orig->id, sizeof(x->id)); 1125 memcpy(&x->sel, &orig->sel, sizeof(x->sel)); 1126 memcpy(&x->lft, &orig->lft, sizeof(x->lft)); 1127 x->props.mode = orig->props.mode; 1128 x->props.replay_window = orig->props.replay_window; 1129 x->props.reqid = orig->props.reqid; 1130 x->props.family = orig->props.family; 1131 x->props.saddr = orig->props.saddr; 1132 1133 if (orig->aalg) { 1134 x->aalg = xfrm_algo_clone(orig->aalg); 1135 if (!x->aalg) 1136 goto error; 1137 } 1138 x->props.aalgo = orig->props.aalgo; 1139 1140 if (orig->ealg) { 1141 x->ealg = xfrm_algo_clone(orig->ealg); 1142 if (!x->ealg) 1143 goto error; 1144 } 1145 x->props.ealgo = orig->props.ealgo; 1146 1147 if (orig->calg) { 1148 x->calg = xfrm_algo_clone(orig->calg); 1149 if (!x->calg) 1150 goto error; 1151 } 1152 x->props.calgo = orig->props.calgo; 1153 1154 if (orig->encap) { 1155 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL); 1156 if (!x->encap) 1157 goto error; 1158 } 1159 1160 if (orig->coaddr) { 1161 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr), 1162 GFP_KERNEL); 1163 if (!x->coaddr) 1164 goto error; 1165 } 1166 1167 err = xfrm_init_state(x); 1168 if (err) 1169 goto error; 1170 1171 x->props.flags = orig->props.flags; 1172 1173 x->curlft.add_time = orig->curlft.add_time; 1174 x->km.state = orig->km.state; 1175 x->km.seq = orig->km.seq; 1176 1177 return x; 1178 1179 error: 1180 if (errp) 1181 *errp = err; 1182 if (x) { 1183 kfree(x->aalg); 1184 kfree(x->ealg); 1185 kfree(x->calg); 1186 kfree(x->encap); 1187 kfree(x->coaddr); 1188 } 1189 kfree(x); 1190 return NULL; 1191} 1192 1193/* xfrm_state_lock is held */ 1194struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m) 1195{ 1196 unsigned int h; 1197 struct xfrm_state *x; 1198 struct hlist_node *entry; 1199 1200 if (m->reqid) { 1201 h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr, 1202 m->reqid, m->old_family); 1203 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) { 1204 if (x->props.mode != m->mode || 1205 x->id.proto != m->proto) 1206 continue; 1207 if (m->reqid && x->props.reqid != m->reqid) 1208 continue; 1209 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr, 1210 m->old_family) || 1211 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr, 1212 m->old_family)) 1213 continue; 1214 xfrm_state_hold(x); 1215 return x; 1216 } 1217 } else { 1218 h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr, 1219 m->old_family); 1220 hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) { 1221 if (x->props.mode != m->mode || 1222 x->id.proto != m->proto) 1223 continue; 1224 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr, 1225 m->old_family) || 1226 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr, 1227 m->old_family)) 1228 continue; 1229 xfrm_state_hold(x); 1230 return x; 1231 } 1232 } 1233 1234 return NULL; 1235} 1236EXPORT_SYMBOL(xfrm_migrate_state_find); 1237 1238struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x, 1239 struct xfrm_migrate *m) 1240{ 1241 struct xfrm_state *xc; 1242 int err; 1243 1244 xc = xfrm_state_clone(x, &err); 1245 if (!xc) 1246 return NULL; 1247 1248 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); 1249 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); 1250 1251 /* add state */ 1252 if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) { 1253 /* a care is needed when the destination address of the 1254 state is to be updated as it is a part of triplet */ 1255 xfrm_state_insert(xc); 1256 } else { 1257 if ((err = xfrm_state_add(xc)) < 0) 1258 goto error; 1259 } 1260 1261 return xc; 1262error: 1263 kfree(xc); 1264 return NULL; 1265} 1266EXPORT_SYMBOL(xfrm_state_migrate); 1267#endif 1268 1269int xfrm_state_update(struct xfrm_state *x) 1270{ 1271 struct xfrm_state *x1, *to_put; 1272 int err; 1273 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1274 1275 to_put = NULL; 1276 1277 spin_lock_bh(&xfrm_state_lock); 1278 x1 = __xfrm_state_locate(x, use_spi, x->props.family); 1279 1280 err = -ESRCH; 1281 if (!x1) 1282 goto out; 1283 1284 if (xfrm_state_kern(x1)) { 1285 to_put = x1; 1286 err = -EEXIST; 1287 goto out; 1288 } 1289 1290 if (x1->km.state == XFRM_STATE_ACQ) { 1291 __xfrm_state_insert(x); 1292 x = NULL; 1293 } 1294 err = 0; 1295 1296out: 1297 spin_unlock_bh(&xfrm_state_lock); 1298 1299 if (to_put) 1300 xfrm_state_put(to_put); 1301 1302 if (err) 1303 return err; 1304 1305 if (!x) { 1306 xfrm_state_delete(x1); 1307 xfrm_state_put(x1); 1308 return 0; 1309 } 1310 1311 err = -EINVAL; 1312 spin_lock_bh(&x1->lock); 1313 if (likely(x1->km.state == XFRM_STATE_VALID)) { 1314 if (x->encap && x1->encap) 1315 memcpy(x1->encap, x->encap, sizeof(*x1->encap)); 1316 if (x->coaddr && x1->coaddr) { 1317 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr)); 1318 } 1319 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel))) 1320 memcpy(&x1->sel, &x->sel, sizeof(x1->sel)); 1321 memcpy(&x1->lft, &x->lft, sizeof(x1->lft)); 1322 x1->km.dying = 0; 1323 1324 mod_timer(&x1->timer, jiffies + HZ); 1325 if (x1->curlft.use_time) 1326 xfrm_state_check_expire(x1); 1327 1328 err = 0; 1329 } 1330 spin_unlock_bh(&x1->lock); 1331 1332 xfrm_state_put(x1); 1333 1334 return err; 1335} 1336EXPORT_SYMBOL(xfrm_state_update); 1337 1338int xfrm_state_check_expire(struct xfrm_state *x) 1339{ 1340 if (!x->curlft.use_time) 1341 x->curlft.use_time = get_seconds(); 1342 1343 if (x->km.state != XFRM_STATE_VALID) 1344 return -EINVAL; 1345 1346 if (x->curlft.bytes >= x->lft.hard_byte_limit || 1347 x->curlft.packets >= x->lft.hard_packet_limit) { 1348 x->km.state = XFRM_STATE_EXPIRED; 1349 mod_timer(&x->timer, jiffies); 1350 return -EINVAL; 1351 } 1352 1353 if (!x->km.dying && 1354 (x->curlft.bytes >= x->lft.soft_byte_limit || 1355 x->curlft.packets >= x->lft.soft_packet_limit)) { 1356 x->km.dying = 1; 1357 km_state_expired(x, 0, 0); 1358 } 1359 return 0; 1360} 1361EXPORT_SYMBOL(xfrm_state_check_expire); 1362 1363struct xfrm_state * 1364xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, 1365 unsigned short family) 1366{ 1367 struct xfrm_state *x; 1368 1369 spin_lock_bh(&xfrm_state_lock); 1370 x = __xfrm_state_lookup(daddr, spi, proto, family); 1371 spin_unlock_bh(&xfrm_state_lock); 1372 return x; 1373} 1374EXPORT_SYMBOL(xfrm_state_lookup); 1375 1376struct xfrm_state * 1377xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, 1378 u8 proto, unsigned short family) 1379{ 1380 struct xfrm_state *x; 1381 1382 spin_lock_bh(&xfrm_state_lock); 1383 x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family); 1384 spin_unlock_bh(&xfrm_state_lock); 1385 return x; 1386} 1387EXPORT_SYMBOL(xfrm_state_lookup_byaddr); 1388 1389struct xfrm_state * 1390xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 1391 xfrm_address_t *daddr, xfrm_address_t *saddr, 1392 int create, unsigned short family) 1393{ 1394 struct xfrm_state *x; 1395 1396 spin_lock_bh(&xfrm_state_lock); 1397 x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create); 1398 spin_unlock_bh(&xfrm_state_lock); 1399 1400 return x; 1401} 1402EXPORT_SYMBOL(xfrm_find_acq); 1403 1404#ifdef CONFIG_XFRM_SUB_POLICY 1405int 1406xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1407 unsigned short family) 1408{ 1409 int err = 0; 1410 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1411 if (!afinfo) 1412 return -EAFNOSUPPORT; 1413 1414 spin_lock_bh(&xfrm_state_lock); 1415 if (afinfo->tmpl_sort) 1416 err = afinfo->tmpl_sort(dst, src, n); 1417 spin_unlock_bh(&xfrm_state_lock); 1418 xfrm_state_put_afinfo(afinfo); 1419 return err; 1420} 1421EXPORT_SYMBOL(xfrm_tmpl_sort); 1422 1423int 1424xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1425 unsigned short family) 1426{ 1427 int err = 0; 1428 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1429 if (!afinfo) 1430 return -EAFNOSUPPORT; 1431 1432 spin_lock_bh(&xfrm_state_lock); 1433 if (afinfo->state_sort) 1434 err = afinfo->state_sort(dst, src, n); 1435 spin_unlock_bh(&xfrm_state_lock); 1436 xfrm_state_put_afinfo(afinfo); 1437 return err; 1438} 1439EXPORT_SYMBOL(xfrm_state_sort); 1440#endif 1441 1442/* Silly enough, but I'm lazy to build resolution list */ 1443 1444static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq) 1445{ 1446 int i; 1447 1448 for (i = 0; i <= init_net.xfrm.state_hmask; i++) { 1449 struct hlist_node *entry; 1450 struct xfrm_state *x; 1451 1452 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+i, bydst) { 1453 if (x->km.seq == seq && 1454 x->km.state == XFRM_STATE_ACQ) { 1455 xfrm_state_hold(x); 1456 return x; 1457 } 1458 } 1459 } 1460 return NULL; 1461} 1462 1463struct xfrm_state *xfrm_find_acq_byseq(u32 seq) 1464{ 1465 struct xfrm_state *x; 1466 1467 spin_lock_bh(&xfrm_state_lock); 1468 x = __xfrm_find_acq_byseq(seq); 1469 spin_unlock_bh(&xfrm_state_lock); 1470 return x; 1471} 1472EXPORT_SYMBOL(xfrm_find_acq_byseq); 1473 1474u32 xfrm_get_acqseq(void) 1475{ 1476 u32 res; 1477 static u32 acqseq; 1478 static DEFINE_SPINLOCK(acqseq_lock); 1479 1480 spin_lock_bh(&acqseq_lock); 1481 res = (++acqseq ? : ++acqseq); 1482 spin_unlock_bh(&acqseq_lock); 1483 return res; 1484} 1485EXPORT_SYMBOL(xfrm_get_acqseq); 1486 1487int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high) 1488{ 1489 unsigned int h; 1490 struct xfrm_state *x0; 1491 int err = -ENOENT; 1492 __be32 minspi = htonl(low); 1493 __be32 maxspi = htonl(high); 1494 1495 spin_lock_bh(&x->lock); 1496 if (x->km.state == XFRM_STATE_DEAD) 1497 goto unlock; 1498 1499 err = 0; 1500 if (x->id.spi) 1501 goto unlock; 1502 1503 err = -ENOENT; 1504 1505 if (minspi == maxspi) { 1506 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family); 1507 if (x0) { 1508 xfrm_state_put(x0); 1509 goto unlock; 1510 } 1511 x->id.spi = minspi; 1512 } else { 1513 u32 spi = 0; 1514 for (h=0; h<high-low+1; h++) { 1515 spi = low + net_random()%(high-low+1); 1516 x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family); 1517 if (x0 == NULL) { 1518 x->id.spi = htonl(spi); 1519 break; 1520 } 1521 xfrm_state_put(x0); 1522 } 1523 } 1524 if (x->id.spi) { 1525 spin_lock_bh(&xfrm_state_lock); 1526 h = xfrm_spi_hash(&init_net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family); 1527 hlist_add_head(&x->byspi, init_net.xfrm.state_byspi+h); 1528 spin_unlock_bh(&xfrm_state_lock); 1529 1530 err = 0; 1531 } 1532 1533unlock: 1534 spin_unlock_bh(&x->lock); 1535 1536 return err; 1537} 1538EXPORT_SYMBOL(xfrm_alloc_spi); 1539 1540int xfrm_state_walk(struct xfrm_state_walk *walk, 1541 int (*func)(struct xfrm_state *, int, void*), 1542 void *data) 1543{ 1544 struct xfrm_state *state; 1545 struct xfrm_state_walk *x; 1546 int err = 0; 1547 1548 if (walk->seq != 0 && list_empty(&walk->all)) 1549 return 0; 1550 1551 spin_lock_bh(&xfrm_state_lock); 1552 if (list_empty(&walk->all)) 1553 x = list_first_entry(&init_net.xfrm.state_all, struct xfrm_state_walk, all); 1554 else 1555 x = list_entry(&walk->all, struct xfrm_state_walk, all); 1556 list_for_each_entry_from(x, &init_net.xfrm.state_all, all) { 1557 if (x->state == XFRM_STATE_DEAD) 1558 continue; 1559 state = container_of(x, struct xfrm_state, km); 1560 if (!xfrm_id_proto_match(state->id.proto, walk->proto)) 1561 continue; 1562 err = func(state, walk->seq, data); 1563 if (err) { 1564 list_move_tail(&walk->all, &x->all); 1565 goto out; 1566 } 1567 walk->seq++; 1568 } 1569 if (walk->seq == 0) { 1570 err = -ENOENT; 1571 goto out; 1572 } 1573 list_del_init(&walk->all); 1574out: 1575 spin_unlock_bh(&xfrm_state_lock); 1576 return err; 1577} 1578EXPORT_SYMBOL(xfrm_state_walk); 1579 1580void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto) 1581{ 1582 INIT_LIST_HEAD(&walk->all); 1583 walk->proto = proto; 1584 walk->state = XFRM_STATE_DEAD; 1585 walk->seq = 0; 1586} 1587EXPORT_SYMBOL(xfrm_state_walk_init); 1588 1589void xfrm_state_walk_done(struct xfrm_state_walk *walk) 1590{ 1591 if (list_empty(&walk->all)) 1592 return; 1593 1594 spin_lock_bh(&xfrm_state_lock); 1595 list_del(&walk->all); 1596 spin_lock_bh(&xfrm_state_lock); 1597} 1598EXPORT_SYMBOL(xfrm_state_walk_done); 1599 1600 1601void xfrm_replay_notify(struct xfrm_state *x, int event) 1602{ 1603 struct km_event c; 1604 /* we send notify messages in case 1605 * 1. we updated on of the sequence numbers, and the seqno difference 1606 * is at least x->replay_maxdiff, in this case we also update the 1607 * timeout of our timer function 1608 * 2. if x->replay_maxage has elapsed since last update, 1609 * and there were changes 1610 * 1611 * The state structure must be locked! 1612 */ 1613 1614 switch (event) { 1615 case XFRM_REPLAY_UPDATE: 1616 if (x->replay_maxdiff && 1617 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) && 1618 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) { 1619 if (x->xflags & XFRM_TIME_DEFER) 1620 event = XFRM_REPLAY_TIMEOUT; 1621 else 1622 return; 1623 } 1624 1625 break; 1626 1627 case XFRM_REPLAY_TIMEOUT: 1628 if ((x->replay.seq == x->preplay.seq) && 1629 (x->replay.bitmap == x->preplay.bitmap) && 1630 (x->replay.oseq == x->preplay.oseq)) { 1631 x->xflags |= XFRM_TIME_DEFER; 1632 return; 1633 } 1634 1635 break; 1636 } 1637 1638 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state)); 1639 c.event = XFRM_MSG_NEWAE; 1640 c.data.aevent = event; 1641 km_state_notify(x, &c); 1642 1643 if (x->replay_maxage && 1644 !mod_timer(&x->rtimer, jiffies + x->replay_maxage)) 1645 x->xflags &= ~XFRM_TIME_DEFER; 1646} 1647 1648static void xfrm_replay_timer_handler(unsigned long data) 1649{ 1650 struct xfrm_state *x = (struct xfrm_state*)data; 1651 1652 spin_lock(&x->lock); 1653 1654 if (x->km.state == XFRM_STATE_VALID) { 1655 if (xfrm_aevent_is_on()) 1656 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT); 1657 else 1658 x->xflags |= XFRM_TIME_DEFER; 1659 } 1660 1661 spin_unlock(&x->lock); 1662} 1663 1664int xfrm_replay_check(struct xfrm_state *x, 1665 struct sk_buff *skb, __be32 net_seq) 1666{ 1667 u32 diff; 1668 u32 seq = ntohl(net_seq); 1669 1670 if (unlikely(seq == 0)) 1671 goto err; 1672 1673 if (likely(seq > x->replay.seq)) 1674 return 0; 1675 1676 diff = x->replay.seq - seq; 1677 if (diff >= min_t(unsigned int, x->props.replay_window, 1678 sizeof(x->replay.bitmap) * 8)) { 1679 x->stats.replay_window++; 1680 goto err; 1681 } 1682 1683 if (x->replay.bitmap & (1U << diff)) { 1684 x->stats.replay++; 1685 goto err; 1686 } 1687 return 0; 1688 1689err: 1690 xfrm_audit_state_replay(x, skb, net_seq); 1691 return -EINVAL; 1692} 1693 1694void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq) 1695{ 1696 u32 diff; 1697 u32 seq = ntohl(net_seq); 1698 1699 if (seq > x->replay.seq) { 1700 diff = seq - x->replay.seq; 1701 if (diff < x->props.replay_window) 1702 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1; 1703 else 1704 x->replay.bitmap = 1; 1705 x->replay.seq = seq; 1706 } else { 1707 diff = x->replay.seq - seq; 1708 x->replay.bitmap |= (1U << diff); 1709 } 1710 1711 if (xfrm_aevent_is_on()) 1712 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); 1713} 1714 1715static LIST_HEAD(xfrm_km_list); 1716static DEFINE_RWLOCK(xfrm_km_lock); 1717 1718void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 1719{ 1720 struct xfrm_mgr *km; 1721 1722 read_lock(&xfrm_km_lock); 1723 list_for_each_entry(km, &xfrm_km_list, list) 1724 if (km->notify_policy) 1725 km->notify_policy(xp, dir, c); 1726 read_unlock(&xfrm_km_lock); 1727} 1728 1729void km_state_notify(struct xfrm_state *x, struct km_event *c) 1730{ 1731 struct xfrm_mgr *km; 1732 read_lock(&xfrm_km_lock); 1733 list_for_each_entry(km, &xfrm_km_list, list) 1734 if (km->notify) 1735 km->notify(x, c); 1736 read_unlock(&xfrm_km_lock); 1737} 1738 1739EXPORT_SYMBOL(km_policy_notify); 1740EXPORT_SYMBOL(km_state_notify); 1741 1742void km_state_expired(struct xfrm_state *x, int hard, u32 pid) 1743{ 1744 struct net *net = xs_net(x); 1745 struct km_event c; 1746 1747 c.data.hard = hard; 1748 c.pid = pid; 1749 c.event = XFRM_MSG_EXPIRE; 1750 km_state_notify(x, &c); 1751 1752 if (hard) 1753 wake_up(&net->xfrm.km_waitq); 1754} 1755 1756EXPORT_SYMBOL(km_state_expired); 1757/* 1758 * We send to all registered managers regardless of failure 1759 * We are happy with one success 1760*/ 1761int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol) 1762{ 1763 int err = -EINVAL, acqret; 1764 struct xfrm_mgr *km; 1765 1766 read_lock(&xfrm_km_lock); 1767 list_for_each_entry(km, &xfrm_km_list, list) { 1768 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT); 1769 if (!acqret) 1770 err = acqret; 1771 } 1772 read_unlock(&xfrm_km_lock); 1773 return err; 1774} 1775EXPORT_SYMBOL(km_query); 1776 1777int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 1778{ 1779 int err = -EINVAL; 1780 struct xfrm_mgr *km; 1781 1782 read_lock(&xfrm_km_lock); 1783 list_for_each_entry(km, &xfrm_km_list, list) { 1784 if (km->new_mapping) 1785 err = km->new_mapping(x, ipaddr, sport); 1786 if (!err) 1787 break; 1788 } 1789 read_unlock(&xfrm_km_lock); 1790 return err; 1791} 1792EXPORT_SYMBOL(km_new_mapping); 1793 1794void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid) 1795{ 1796 struct net *net = xp_net(pol); 1797 struct km_event c; 1798 1799 c.data.hard = hard; 1800 c.pid = pid; 1801 c.event = XFRM_MSG_POLEXPIRE; 1802 km_policy_notify(pol, dir, &c); 1803 1804 if (hard) 1805 wake_up(&net->xfrm.km_waitq); 1806} 1807EXPORT_SYMBOL(km_policy_expired); 1808 1809#ifdef CONFIG_XFRM_MIGRATE 1810int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 1811 struct xfrm_migrate *m, int num_migrate, 1812 struct xfrm_kmaddress *k) 1813{ 1814 int err = -EINVAL; 1815 int ret; 1816 struct xfrm_mgr *km; 1817 1818 read_lock(&xfrm_km_lock); 1819 list_for_each_entry(km, &xfrm_km_list, list) { 1820 if (km->migrate) { 1821 ret = km->migrate(sel, dir, type, m, num_migrate, k); 1822 if (!ret) 1823 err = ret; 1824 } 1825 } 1826 read_unlock(&xfrm_km_lock); 1827 return err; 1828} 1829EXPORT_SYMBOL(km_migrate); 1830#endif 1831 1832int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr) 1833{ 1834 int err = -EINVAL; 1835 int ret; 1836 struct xfrm_mgr *km; 1837 1838 read_lock(&xfrm_km_lock); 1839 list_for_each_entry(km, &xfrm_km_list, list) { 1840 if (km->report) { 1841 ret = km->report(proto, sel, addr); 1842 if (!ret) 1843 err = ret; 1844 } 1845 } 1846 read_unlock(&xfrm_km_lock); 1847 return err; 1848} 1849EXPORT_SYMBOL(km_report); 1850 1851int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 1852{ 1853 int err; 1854 u8 *data; 1855 struct xfrm_mgr *km; 1856 struct xfrm_policy *pol = NULL; 1857 1858 if (optlen <= 0 || optlen > PAGE_SIZE) 1859 return -EMSGSIZE; 1860 1861 data = kmalloc(optlen, GFP_KERNEL); 1862 if (!data) 1863 return -ENOMEM; 1864 1865 err = -EFAULT; 1866 if (copy_from_user(data, optval, optlen)) 1867 goto out; 1868 1869 err = -EINVAL; 1870 read_lock(&xfrm_km_lock); 1871 list_for_each_entry(km, &xfrm_km_list, list) { 1872 pol = km->compile_policy(sk, optname, data, 1873 optlen, &err); 1874 if (err >= 0) 1875 break; 1876 } 1877 read_unlock(&xfrm_km_lock); 1878 1879 if (err >= 0) { 1880 xfrm_sk_policy_insert(sk, err, pol); 1881 xfrm_pol_put(pol); 1882 err = 0; 1883 } 1884 1885out: 1886 kfree(data); 1887 return err; 1888} 1889EXPORT_SYMBOL(xfrm_user_policy); 1890 1891int xfrm_register_km(struct xfrm_mgr *km) 1892{ 1893 write_lock_bh(&xfrm_km_lock); 1894 list_add_tail(&km->list, &xfrm_km_list); 1895 write_unlock_bh(&xfrm_km_lock); 1896 return 0; 1897} 1898EXPORT_SYMBOL(xfrm_register_km); 1899 1900int xfrm_unregister_km(struct xfrm_mgr *km) 1901{ 1902 write_lock_bh(&xfrm_km_lock); 1903 list_del(&km->list); 1904 write_unlock_bh(&xfrm_km_lock); 1905 return 0; 1906} 1907EXPORT_SYMBOL(xfrm_unregister_km); 1908 1909int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo) 1910{ 1911 int err = 0; 1912 if (unlikely(afinfo == NULL)) 1913 return -EINVAL; 1914 if (unlikely(afinfo->family >= NPROTO)) 1915 return -EAFNOSUPPORT; 1916 write_lock_bh(&xfrm_state_afinfo_lock); 1917 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL)) 1918 err = -ENOBUFS; 1919 else 1920 xfrm_state_afinfo[afinfo->family] = afinfo; 1921 write_unlock_bh(&xfrm_state_afinfo_lock); 1922 return err; 1923} 1924EXPORT_SYMBOL(xfrm_state_register_afinfo); 1925 1926int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo) 1927{ 1928 int err = 0; 1929 if (unlikely(afinfo == NULL)) 1930 return -EINVAL; 1931 if (unlikely(afinfo->family >= NPROTO)) 1932 return -EAFNOSUPPORT; 1933 write_lock_bh(&xfrm_state_afinfo_lock); 1934 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) { 1935 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo)) 1936 err = -EINVAL; 1937 else 1938 xfrm_state_afinfo[afinfo->family] = NULL; 1939 } 1940 write_unlock_bh(&xfrm_state_afinfo_lock); 1941 return err; 1942} 1943EXPORT_SYMBOL(xfrm_state_unregister_afinfo); 1944 1945static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family) 1946{ 1947 struct xfrm_state_afinfo *afinfo; 1948 if (unlikely(family >= NPROTO)) 1949 return NULL; 1950 read_lock(&xfrm_state_afinfo_lock); 1951 afinfo = xfrm_state_afinfo[family]; 1952 if (unlikely(!afinfo)) 1953 read_unlock(&xfrm_state_afinfo_lock); 1954 return afinfo; 1955} 1956 1957static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo) 1958 __releases(xfrm_state_afinfo_lock) 1959{ 1960 read_unlock(&xfrm_state_afinfo_lock); 1961} 1962 1963/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ 1964void xfrm_state_delete_tunnel(struct xfrm_state *x) 1965{ 1966 if (x->tunnel) { 1967 struct xfrm_state *t = x->tunnel; 1968 1969 if (atomic_read(&t->tunnel_users) == 2) 1970 xfrm_state_delete(t); 1971 atomic_dec(&t->tunnel_users); 1972 xfrm_state_put(t); 1973 x->tunnel = NULL; 1974 } 1975} 1976EXPORT_SYMBOL(xfrm_state_delete_tunnel); 1977 1978int xfrm_state_mtu(struct xfrm_state *x, int mtu) 1979{ 1980 int res; 1981 1982 spin_lock_bh(&x->lock); 1983 if (x->km.state == XFRM_STATE_VALID && 1984 x->type && x->type->get_mtu) 1985 res = x->type->get_mtu(x, mtu); 1986 else 1987 res = mtu - x->props.header_len; 1988 spin_unlock_bh(&x->lock); 1989 return res; 1990} 1991 1992int xfrm_init_state(struct xfrm_state *x) 1993{ 1994 struct xfrm_state_afinfo *afinfo; 1995 struct xfrm_mode *inner_mode; 1996 int family = x->props.family; 1997 int err; 1998 1999 err = -EAFNOSUPPORT; 2000 afinfo = xfrm_state_get_afinfo(family); 2001 if (!afinfo) 2002 goto error; 2003 2004 err = 0; 2005 if (afinfo->init_flags) 2006 err = afinfo->init_flags(x); 2007 2008 xfrm_state_put_afinfo(afinfo); 2009 2010 if (err) 2011 goto error; 2012 2013 err = -EPROTONOSUPPORT; 2014 2015 if (x->sel.family != AF_UNSPEC) { 2016 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family); 2017 if (inner_mode == NULL) 2018 goto error; 2019 2020 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) && 2021 family != x->sel.family) { 2022 xfrm_put_mode(inner_mode); 2023 goto error; 2024 } 2025 2026 x->inner_mode = inner_mode; 2027 } else { 2028 struct xfrm_mode *inner_mode_iaf; 2029 2030 inner_mode = xfrm_get_mode(x->props.mode, AF_INET); 2031 if (inner_mode == NULL) 2032 goto error; 2033 2034 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) { 2035 xfrm_put_mode(inner_mode); 2036 goto error; 2037 } 2038 2039 inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6); 2040 if (inner_mode_iaf == NULL) 2041 goto error; 2042 2043 if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) { 2044 xfrm_put_mode(inner_mode_iaf); 2045 goto error; 2046 } 2047 2048 if (x->props.family == AF_INET) { 2049 x->inner_mode = inner_mode; 2050 x->inner_mode_iaf = inner_mode_iaf; 2051 } else { 2052 x->inner_mode = inner_mode_iaf; 2053 x->inner_mode_iaf = inner_mode; 2054 } 2055 } 2056 2057 x->type = xfrm_get_type(x->id.proto, family); 2058 if (x->type == NULL) 2059 goto error; 2060 2061 err = x->type->init_state(x); 2062 if (err) 2063 goto error; 2064 2065 x->outer_mode = xfrm_get_mode(x->props.mode, family); 2066 if (x->outer_mode == NULL) 2067 goto error; 2068 2069 x->km.state = XFRM_STATE_VALID; 2070 2071error: 2072 return err; 2073} 2074 2075EXPORT_SYMBOL(xfrm_init_state); 2076 2077int __net_init xfrm_state_init(struct net *net) 2078{ 2079 unsigned int sz; 2080 2081 INIT_LIST_HEAD(&net->xfrm.state_all); 2082 2083 sz = sizeof(struct hlist_head) * 8; 2084 2085 net->xfrm.state_bydst = xfrm_hash_alloc(sz); 2086 if (!net->xfrm.state_bydst) 2087 goto out_bydst; 2088 net->xfrm.state_bysrc = xfrm_hash_alloc(sz); 2089 if (!net->xfrm.state_bysrc) 2090 goto out_bysrc; 2091 net->xfrm.state_byspi = xfrm_hash_alloc(sz); 2092 if (!net->xfrm.state_byspi) 2093 goto out_byspi; 2094 net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1); 2095 2096 net->xfrm.state_num = 0; 2097 INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize); 2098 INIT_HLIST_HEAD(&net->xfrm.state_gc_list); 2099 INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task); 2100 init_waitqueue_head(&net->xfrm.km_waitq); 2101 return 0; 2102 2103out_byspi: 2104 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2105out_bysrc: 2106 xfrm_hash_free(net->xfrm.state_bydst, sz); 2107out_bydst: 2108 return -ENOMEM; 2109} 2110 2111void xfrm_state_fini(struct net *net) 2112{ 2113 unsigned int sz; 2114 2115 WARN_ON(!list_empty(&net->xfrm.state_all)); 2116 2117 sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head); 2118 WARN_ON(!hlist_empty(net->xfrm.state_byspi)); 2119 xfrm_hash_free(net->xfrm.state_byspi, sz); 2120 WARN_ON(!hlist_empty(net->xfrm.state_bysrc)); 2121 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2122 WARN_ON(!hlist_empty(net->xfrm.state_bydst)); 2123 xfrm_hash_free(net->xfrm.state_bydst, sz); 2124} 2125 2126#ifdef CONFIG_AUDITSYSCALL 2127static void xfrm_audit_helper_sainfo(struct xfrm_state *x, 2128 struct audit_buffer *audit_buf) 2129{ 2130 struct xfrm_sec_ctx *ctx = x->security; 2131 u32 spi = ntohl(x->id.spi); 2132 2133 if (ctx) 2134 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", 2135 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str); 2136 2137 switch(x->props.family) { 2138 case AF_INET: 2139 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2140 &x->props.saddr.a4, &x->id.daddr.a4); 2141 break; 2142 case AF_INET6: 2143 audit_log_format(audit_buf, " src=%pI6 dst=%pI6", 2144 x->props.saddr.a6, x->id.daddr.a6); 2145 break; 2146 } 2147 2148 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2149} 2150 2151static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, 2152 struct audit_buffer *audit_buf) 2153{ 2154 struct iphdr *iph4; 2155 struct ipv6hdr *iph6; 2156 2157 switch (family) { 2158 case AF_INET: 2159 iph4 = ip_hdr(skb); 2160 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2161 &iph4->saddr, &iph4->daddr); 2162 break; 2163 case AF_INET6: 2164 iph6 = ipv6_hdr(skb); 2165 audit_log_format(audit_buf, 2166 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x", 2167 &iph6->saddr,&iph6->daddr, 2168 iph6->flow_lbl[0] & 0x0f, 2169 iph6->flow_lbl[1], 2170 iph6->flow_lbl[2]); 2171 break; 2172 } 2173} 2174 2175void xfrm_audit_state_add(struct xfrm_state *x, int result, 2176 uid_t auid, u32 sessionid, u32 secid) 2177{ 2178 struct audit_buffer *audit_buf; 2179 2180 audit_buf = xfrm_audit_start("SAD-add"); 2181 if (audit_buf == NULL) 2182 return; 2183 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2184 xfrm_audit_helper_sainfo(x, audit_buf); 2185 audit_log_format(audit_buf, " res=%u", result); 2186 audit_log_end(audit_buf); 2187} 2188EXPORT_SYMBOL_GPL(xfrm_audit_state_add); 2189 2190void xfrm_audit_state_delete(struct xfrm_state *x, int result, 2191 uid_t auid, u32 sessionid, u32 secid) 2192{ 2193 struct audit_buffer *audit_buf; 2194 2195 audit_buf = xfrm_audit_start("SAD-delete"); 2196 if (audit_buf == NULL) 2197 return; 2198 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2199 xfrm_audit_helper_sainfo(x, audit_buf); 2200 audit_log_format(audit_buf, " res=%u", result); 2201 audit_log_end(audit_buf); 2202} 2203EXPORT_SYMBOL_GPL(xfrm_audit_state_delete); 2204 2205void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 2206 struct sk_buff *skb) 2207{ 2208 struct audit_buffer *audit_buf; 2209 u32 spi; 2210 2211 audit_buf = xfrm_audit_start("SA-replay-overflow"); 2212 if (audit_buf == NULL) 2213 return; 2214 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2215 /* don't record the sequence number because it's inherent in this kind 2216 * of audit message */ 2217 spi = ntohl(x->id.spi); 2218 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2219 audit_log_end(audit_buf); 2220} 2221EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow); 2222 2223static void xfrm_audit_state_replay(struct xfrm_state *x, 2224 struct sk_buff *skb, __be32 net_seq) 2225{ 2226 struct audit_buffer *audit_buf; 2227 u32 spi; 2228 2229 audit_buf = xfrm_audit_start("SA-replayed-pkt"); 2230 if (audit_buf == NULL) 2231 return; 2232 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2233 spi = ntohl(x->id.spi); 2234 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2235 spi, spi, ntohl(net_seq)); 2236 audit_log_end(audit_buf); 2237} 2238 2239void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family) 2240{ 2241 struct audit_buffer *audit_buf; 2242 2243 audit_buf = xfrm_audit_start("SA-notfound"); 2244 if (audit_buf == NULL) 2245 return; 2246 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2247 audit_log_end(audit_buf); 2248} 2249EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple); 2250 2251void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 2252 __be32 net_spi, __be32 net_seq) 2253{ 2254 struct audit_buffer *audit_buf; 2255 u32 spi; 2256 2257 audit_buf = xfrm_audit_start("SA-notfound"); 2258 if (audit_buf == NULL) 2259 return; 2260 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2261 spi = ntohl(net_spi); 2262 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2263 spi, spi, ntohl(net_seq)); 2264 audit_log_end(audit_buf); 2265} 2266EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound); 2267 2268void xfrm_audit_state_icvfail(struct xfrm_state *x, 2269 struct sk_buff *skb, u8 proto) 2270{ 2271 struct audit_buffer *audit_buf; 2272 __be32 net_spi; 2273 __be32 net_seq; 2274 2275 audit_buf = xfrm_audit_start("SA-icv-failure"); 2276 if (audit_buf == NULL) 2277 return; 2278 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2279 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) { 2280 u32 spi = ntohl(net_spi); 2281 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2282 spi, spi, ntohl(net_seq)); 2283 } 2284 audit_log_end(audit_buf); 2285} 2286EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail); 2287#endif /* CONFIG_AUDITSYSCALL */ 2288