Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
xfrm_state.c
Go to the documentation of this file.
1 /*
2  * xfrm_state.c
3  *
4  * Changes:
5  * Mitsuru KANDA @USAGI
6  * Kazunori MIYAZAWA @USAGI
7  * Kunihiro Ishiguro <[email protected]>
8  * IPv6 support
9  * YOSHIFUJI Hideaki @USAGI
10  * Split up af-specific functions
11  * Derek Atkins <[email protected]>
12  * Add UDP Encapsulation
13  *
14  */
15 
16 #include <linux/workqueue.h>
17 #include <net/xfrm.h>
18 #include <linux/pfkeyv2.h>
19 #include <linux/ipsec.h>
20 #include <linux/module.h>
21 #include <linux/cache.h>
22 #include <linux/audit.h>
23 #include <asm/uaccess.h>
24 #include <linux/ktime.h>
25 #include <linux/slab.h>
26 #include <linux/interrupt.h>
27 #include <linux/kernel.h>
28 
29 #include "xfrm_hash.h"
30 
31 /* Each xfrm_state may be linked to two tables:
32 
33  1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
34  2. Hash table by (daddr,family,reqid) to find what SAs exist for given
35  destination/tunnel endpoint. (output)
36  */
37 
38 static DEFINE_SPINLOCK(xfrm_state_lock);
39 
40 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
41 
42 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
43 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
44 
45 static inline unsigned int xfrm_dst_hash(struct net *net,
46  const xfrm_address_t *daddr,
47  const xfrm_address_t *saddr,
48  u32 reqid,
49  unsigned short family)
50 {
51  return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
52 }
53 
54 static inline unsigned int xfrm_src_hash(struct net *net,
55  const xfrm_address_t *daddr,
56  const xfrm_address_t *saddr,
57  unsigned short family)
58 {
59  return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
60 }
61 
62 static inline unsigned int
63 xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr,
64  __be32 spi, u8 proto, unsigned short family)
65 {
66  return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
67 }
68 
69 static void xfrm_hash_transfer(struct hlist_head *list,
70  struct hlist_head *ndsttable,
71  struct hlist_head *nsrctable,
72  struct hlist_head *nspitable,
73  unsigned int nhashmask)
74 {
75  struct hlist_node *entry, *tmp;
76  struct xfrm_state *x;
77 
78  hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
79  unsigned int h;
80 
81  h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
82  x->props.reqid, x->props.family,
83  nhashmask);
84  hlist_add_head(&x->bydst, ndsttable+h);
85 
86  h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
87  x->props.family,
88  nhashmask);
89  hlist_add_head(&x->bysrc, nsrctable+h);
90 
91  if (x->id.spi) {
92  h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
93  x->id.proto, x->props.family,
94  nhashmask);
95  hlist_add_head(&x->byspi, nspitable+h);
96  }
97  }
98 }
99 
100 static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
101 {
102  return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
103 }
104 
105 static DEFINE_MUTEX(hash_resize_mutex);
106 
107 static void xfrm_hash_resize(struct work_struct *work)
108 {
109  struct net *net = container_of(work, struct net, xfrm.state_hash_work);
110  struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
111  unsigned long nsize, osize;
112  unsigned int nhashmask, ohashmask;
113  int i;
114 
115  mutex_lock(&hash_resize_mutex);
116 
117  nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
118  ndst = xfrm_hash_alloc(nsize);
119  if (!ndst)
120  goto out_unlock;
121  nsrc = xfrm_hash_alloc(nsize);
122  if (!nsrc) {
123  xfrm_hash_free(ndst, nsize);
124  goto out_unlock;
125  }
126  nspi = xfrm_hash_alloc(nsize);
127  if (!nspi) {
128  xfrm_hash_free(ndst, nsize);
129  xfrm_hash_free(nsrc, nsize);
130  goto out_unlock;
131  }
132 
133  spin_lock_bh(&xfrm_state_lock);
134 
135  nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
136  for (i = net->xfrm.state_hmask; i >= 0; i--)
137  xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
138  nhashmask);
139 
140  odst = net->xfrm.state_bydst;
141  osrc = net->xfrm.state_bysrc;
142  ospi = net->xfrm.state_byspi;
143  ohashmask = net->xfrm.state_hmask;
144 
145  net->xfrm.state_bydst = ndst;
146  net->xfrm.state_bysrc = nsrc;
147  net->xfrm.state_byspi = nspi;
148  net->xfrm.state_hmask = nhashmask;
149 
150  spin_unlock_bh(&xfrm_state_lock);
151 
152  osize = (ohashmask + 1) * sizeof(struct hlist_head);
153  xfrm_hash_free(odst, osize);
154  xfrm_hash_free(osrc, osize);
155  xfrm_hash_free(ospi, osize);
156 
157 out_unlock:
158  mutex_unlock(&hash_resize_mutex);
159 }
160 
161 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
163 
164 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
165 
166 int __xfrm_state_delete(struct xfrm_state *x);
167 
168 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
169 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
170 
171 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
172 {
173  struct xfrm_state_afinfo *afinfo;
174  if (unlikely(family >= NPROTO))
175  return NULL;
176  write_lock_bh(&xfrm_state_afinfo_lock);
177  afinfo = xfrm_state_afinfo[family];
178  if (unlikely(!afinfo))
179  write_unlock_bh(&xfrm_state_afinfo_lock);
180  return afinfo;
181 }
182 
183 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
184  __releases(xfrm_state_afinfo_lock)
185 {
186  write_unlock_bh(&xfrm_state_afinfo_lock);
187 }
188 
189 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
190 {
191  struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
192  const struct xfrm_type **typemap;
193  int err = 0;
194 
195  if (unlikely(afinfo == NULL))
196  return -EAFNOSUPPORT;
197  typemap = afinfo->type_map;
198 
199  if (likely(typemap[type->proto] == NULL))
200  typemap[type->proto] = type;
201  else
202  err = -EEXIST;
203  xfrm_state_unlock_afinfo(afinfo);
204  return err;
205 }
207 
208 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
209 {
210  struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
211  const struct xfrm_type **typemap;
212  int err = 0;
213 
214  if (unlikely(afinfo == NULL))
215  return -EAFNOSUPPORT;
216  typemap = afinfo->type_map;
217 
218  if (unlikely(typemap[type->proto] != type))
219  err = -ENOENT;
220  else
221  typemap[type->proto] = NULL;
222  xfrm_state_unlock_afinfo(afinfo);
223  return err;
224 }
226 
227 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
228 {
229  struct xfrm_state_afinfo *afinfo;
230  const struct xfrm_type **typemap;
231  const struct xfrm_type *type;
232  int modload_attempted = 0;
233 
234 retry:
235  afinfo = xfrm_state_get_afinfo(family);
236  if (unlikely(afinfo == NULL))
237  return NULL;
238  typemap = afinfo->type_map;
239 
240  type = typemap[proto];
241  if (unlikely(type && !try_module_get(type->owner)))
242  type = NULL;
243  if (!type && !modload_attempted) {
244  xfrm_state_put_afinfo(afinfo);
245  request_module("xfrm-type-%d-%d", family, proto);
246  modload_attempted = 1;
247  goto retry;
248  }
249 
250  xfrm_state_put_afinfo(afinfo);
251  return type;
252 }
253 
254 static void xfrm_put_type(const struct xfrm_type *type)
255 {
256  module_put(type->owner);
257 }
258 
259 int xfrm_register_mode(struct xfrm_mode *mode, int family)
260 {
261  struct xfrm_state_afinfo *afinfo;
262  struct xfrm_mode **modemap;
263  int err;
264 
265  if (unlikely(mode->encap >= XFRM_MODE_MAX))
266  return -EINVAL;
267 
268  afinfo = xfrm_state_lock_afinfo(family);
269  if (unlikely(afinfo == NULL))
270  return -EAFNOSUPPORT;
271 
272  err = -EEXIST;
273  modemap = afinfo->mode_map;
274  if (modemap[mode->encap])
275  goto out;
276 
277  err = -ENOENT;
278  if (!try_module_get(afinfo->owner))
279  goto out;
280 
281  mode->afinfo = afinfo;
282  modemap[mode->encap] = mode;
283  err = 0;
284 
285 out:
286  xfrm_state_unlock_afinfo(afinfo);
287  return err;
288 }
290 
291 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
292 {
293  struct xfrm_state_afinfo *afinfo;
294  struct xfrm_mode **modemap;
295  int err;
296 
297  if (unlikely(mode->encap >= XFRM_MODE_MAX))
298  return -EINVAL;
299 
300  afinfo = xfrm_state_lock_afinfo(family);
301  if (unlikely(afinfo == NULL))
302  return -EAFNOSUPPORT;
303 
304  err = -ENOENT;
305  modemap = afinfo->mode_map;
306  if (likely(modemap[mode->encap] == mode)) {
307  modemap[mode->encap] = NULL;
308  module_put(mode->afinfo->owner);
309  err = 0;
310  }
311 
312  xfrm_state_unlock_afinfo(afinfo);
313  return err;
314 }
316 
317 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
318 {
319  struct xfrm_state_afinfo *afinfo;
320  struct xfrm_mode *mode;
321  int modload_attempted = 0;
322 
323  if (unlikely(encap >= XFRM_MODE_MAX))
324  return NULL;
325 
326 retry:
327  afinfo = xfrm_state_get_afinfo(family);
328  if (unlikely(afinfo == NULL))
329  return NULL;
330 
331  mode = afinfo->mode_map[encap];
332  if (unlikely(mode && !try_module_get(mode->owner)))
333  mode = NULL;
334  if (!mode && !modload_attempted) {
335  xfrm_state_put_afinfo(afinfo);
336  request_module("xfrm-mode-%d-%d", family, encap);
337  modload_attempted = 1;
338  goto retry;
339  }
340 
341  xfrm_state_put_afinfo(afinfo);
342  return mode;
343 }
344 
345 static void xfrm_put_mode(struct xfrm_mode *mode)
346 {
347  module_put(mode->owner);
348 }
349 
350 static void xfrm_state_gc_destroy(struct xfrm_state *x)
351 {
352  tasklet_hrtimer_cancel(&x->mtimer);
353  del_timer_sync(&x->rtimer);
354  kfree(x->aalg);
355  kfree(x->ealg);
356  kfree(x->calg);
357  kfree(x->encap);
358  kfree(x->coaddr);
359  kfree(x->replay_esn);
360  kfree(x->preplay_esn);
361  if (x->inner_mode)
362  xfrm_put_mode(x->inner_mode);
363  if (x->inner_mode_iaf)
364  xfrm_put_mode(x->inner_mode_iaf);
365  if (x->outer_mode)
366  xfrm_put_mode(x->outer_mode);
367  if (x->type) {
368  x->type->destructor(x);
369  xfrm_put_type(x->type);
370  }
371  security_xfrm_state_free(x);
372  kfree(x);
373 }
374 
375 static void xfrm_state_gc_task(struct work_struct *work)
376 {
377  struct net *net = container_of(work, struct net, xfrm.state_gc_work);
378  struct xfrm_state *x;
379  struct hlist_node *entry, *tmp;
380  struct hlist_head gc_list;
381 
382  spin_lock_bh(&xfrm_state_gc_lock);
383  hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
384  spin_unlock_bh(&xfrm_state_gc_lock);
385 
386  hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
387  xfrm_state_gc_destroy(x);
388 
389  wake_up(&net->xfrm.km_waitq);
390 }
391 
392 static inline unsigned long make_jiffies(long secs)
393 {
394  if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
395  return MAX_SCHEDULE_TIMEOUT-1;
396  else
397  return secs*HZ;
398 }
399 
400 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
401 {
402  struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer);
403  struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer);
404  struct net *net = xs_net(x);
405  unsigned long now = get_seconds();
406  long next = LONG_MAX;
407  int warn = 0;
408  int err = 0;
409 
410  spin_lock(&x->lock);
411  if (x->km.state == XFRM_STATE_DEAD)
412  goto out;
413  if (x->km.state == XFRM_STATE_EXPIRED)
414  goto expired;
415  if (x->lft.hard_add_expires_seconds) {
416  long tmo = x->lft.hard_add_expires_seconds +
417  x->curlft.add_time - now;
418  if (tmo <= 0) {
419  if (x->xflags & XFRM_SOFT_EXPIRE) {
420  /* enter hard expire without soft expire first?!
421  * setting a new date could trigger this.
422  * workarbound: fix x->curflt.add_time by below:
423  */
424  x->curlft.add_time = now - x->saved_tmo - 1;
425  tmo = x->lft.hard_add_expires_seconds - x->saved_tmo;
426  } else
427  goto expired;
428  }
429  if (tmo < next)
430  next = tmo;
431  }
432  if (x->lft.hard_use_expires_seconds) {
433  long tmo = x->lft.hard_use_expires_seconds +
434  (x->curlft.use_time ? : now) - now;
435  if (tmo <= 0)
436  goto expired;
437  if (tmo < next)
438  next = tmo;
439  }
440  if (x->km.dying)
441  goto resched;
442  if (x->lft.soft_add_expires_seconds) {
443  long tmo = x->lft.soft_add_expires_seconds +
444  x->curlft.add_time - now;
445  if (tmo <= 0) {
446  warn = 1;
447  x->xflags &= ~XFRM_SOFT_EXPIRE;
448  } else if (tmo < next) {
449  next = tmo;
450  x->xflags |= XFRM_SOFT_EXPIRE;
451  x->saved_tmo = tmo;
452  }
453  }
454  if (x->lft.soft_use_expires_seconds) {
455  long tmo = x->lft.soft_use_expires_seconds +
456  (x->curlft.use_time ? : now) - now;
457  if (tmo <= 0)
458  warn = 1;
459  else if (tmo < next)
460  next = tmo;
461  }
462 
463  x->km.dying = warn;
464  if (warn)
465  km_state_expired(x, 0, 0);
466 resched:
467  if (next != LONG_MAX){
468  tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL);
469  }
470 
471  goto out;
472 
473 expired:
474  if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
475  x->km.state = XFRM_STATE_EXPIRED;
476  wake_up(&net->xfrm.km_waitq);
477  next = 2;
478  goto resched;
479  }
480 
481  err = __xfrm_state_delete(x);
482  if (!err && x->id.spi)
483  km_state_expired(x, 1, 0);
484 
485  xfrm_audit_state_delete(x, err ? 0 : 1,
486  audit_get_loginuid(current),
487  audit_get_sessionid(current), 0);
488 
489 out:
490  spin_unlock(&x->lock);
491  return HRTIMER_NORESTART;
492 }
493 
494 static void xfrm_replay_timer_handler(unsigned long data);
495 
496 struct xfrm_state *xfrm_state_alloc(struct net *net)
497 {
498  struct xfrm_state *x;
499 
500  x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
501 
502  if (x) {
503  write_pnet(&x->xs_net, net);
504  atomic_set(&x->refcnt, 1);
505  atomic_set(&x->tunnel_users, 0);
506  INIT_LIST_HEAD(&x->km.all);
507  INIT_HLIST_NODE(&x->bydst);
508  INIT_HLIST_NODE(&x->bysrc);
509  INIT_HLIST_NODE(&x->byspi);
510  tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, CLOCK_REALTIME, HRTIMER_MODE_ABS);
511  setup_timer(&x->rtimer, xfrm_replay_timer_handler,
512  (unsigned long)x);
513  x->curlft.add_time = get_seconds();
514  x->lft.soft_byte_limit = XFRM_INF;
515  x->lft.soft_packet_limit = XFRM_INF;
516  x->lft.hard_byte_limit = XFRM_INF;
517  x->lft.hard_packet_limit = XFRM_INF;
518  x->replay_maxage = 0;
519  x->replay_maxdiff = 0;
520  x->inner_mode = NULL;
521  x->inner_mode_iaf = NULL;
522  spin_lock_init(&x->lock);
523  }
524  return x;
525 }
527 
529 {
530  struct net *net = xs_net(x);
531 
532  WARN_ON(x->km.state != XFRM_STATE_DEAD);
533 
534  spin_lock_bh(&xfrm_state_gc_lock);
535  hlist_add_head(&x->gclist, &net->xfrm.state_gc_list);
536  spin_unlock_bh(&xfrm_state_gc_lock);
537  schedule_work(&net->xfrm.state_gc_work);
538 }
540 
542 {
543  struct net *net = xs_net(x);
544  int err = -ESRCH;
545 
546  if (x->km.state != XFRM_STATE_DEAD) {
547  x->km.state = XFRM_STATE_DEAD;
548  spin_lock(&xfrm_state_lock);
549  list_del(&x->km.all);
550  hlist_del(&x->bydst);
551  hlist_del(&x->bysrc);
552  if (x->id.spi)
553  hlist_del(&x->byspi);
554  net->xfrm.state_num--;
555  spin_unlock(&xfrm_state_lock);
556 
557  /* All xfrm_state objects are created by xfrm_state_alloc.
558  * The xfrm_state_alloc call gives a reference, and that
559  * is what we are dropping here.
560  */
561  xfrm_state_put(x);
562  err = 0;
563  }
564 
565  return err;
566 }
568 
570 {
571  int err;
572 
573  spin_lock_bh(&x->lock);
574  err = __xfrm_state_delete(x);
575  spin_unlock_bh(&x->lock);
576 
577  return err;
578 }
580 
581 #ifdef CONFIG_SECURITY_NETWORK_XFRM
582 static inline int
583 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
584 {
585  int i, err = 0;
586 
587  for (i = 0; i <= net->xfrm.state_hmask; i++) {
588  struct hlist_node *entry;
589  struct xfrm_state *x;
590 
591  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
592  if (xfrm_id_proto_match(x->id.proto, proto) &&
593  (err = security_xfrm_state_delete(x)) != 0) {
594  xfrm_audit_state_delete(x, 0,
595  audit_info->loginuid,
596  audit_info->sessionid,
597  audit_info->secid);
598  return err;
599  }
600  }
601  }
602 
603  return err;
604 }
605 #else
606 static inline int
607 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
608 {
609  return 0;
610 }
611 #endif
612 
613 int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
614 {
615  int i, err = 0, cnt = 0;
616 
617  spin_lock_bh(&xfrm_state_lock);
618  err = xfrm_state_flush_secctx_check(net, proto, audit_info);
619  if (err)
620  goto out;
621 
622  err = -ESRCH;
623  for (i = 0; i <= net->xfrm.state_hmask; i++) {
624  struct hlist_node *entry;
625  struct xfrm_state *x;
626 restart:
627  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
628  if (!xfrm_state_kern(x) &&
629  xfrm_id_proto_match(x->id.proto, proto)) {
630  xfrm_state_hold(x);
631  spin_unlock_bh(&xfrm_state_lock);
632 
633  err = xfrm_state_delete(x);
634  xfrm_audit_state_delete(x, err ? 0 : 1,
635  audit_info->loginuid,
636  audit_info->sessionid,
637  audit_info->secid);
638  xfrm_state_put(x);
639  if (!err)
640  cnt++;
641 
642  spin_lock_bh(&xfrm_state_lock);
643  goto restart;
644  }
645  }
646  }
647  if (cnt)
648  err = 0;
649 
650 out:
651  spin_unlock_bh(&xfrm_state_lock);
652  wake_up(&net->xfrm.km_waitq);
653  return err;
654 }
656 
657 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
658 {
659  spin_lock_bh(&xfrm_state_lock);
660  si->sadcnt = net->xfrm.state_num;
661  si->sadhcnt = net->xfrm.state_hmask;
662  si->sadhmcnt = xfrm_state_hashmax;
663  spin_unlock_bh(&xfrm_state_lock);
664 }
666 
667 static int
668 xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl,
669  const struct xfrm_tmpl *tmpl,
670  const xfrm_address_t *daddr, const xfrm_address_t *saddr,
671  unsigned short family)
672 {
673  struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
674  if (!afinfo)
675  return -1;
676  afinfo->init_tempsel(&x->sel, fl);
677 
678  if (family != tmpl->encap_family) {
679  xfrm_state_put_afinfo(afinfo);
680  afinfo = xfrm_state_get_afinfo(tmpl->encap_family);
681  if (!afinfo)
682  return -1;
683  }
684  afinfo->init_temprop(x, tmpl, daddr, saddr);
685  xfrm_state_put_afinfo(afinfo);
686  return 0;
687 }
688 
689 static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
690  const xfrm_address_t *daddr,
691  __be32 spi, u8 proto,
692  unsigned short family)
693 {
694  unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
695  struct xfrm_state *x;
696  struct hlist_node *entry;
697 
698  hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
699  if (x->props.family != family ||
700  x->id.spi != spi ||
701  x->id.proto != proto ||
702  xfrm_addr_cmp(&x->id.daddr, daddr, family))
703  continue;
704 
705  if ((mark & x->mark.m) != x->mark.v)
706  continue;
707  xfrm_state_hold(x);
708  return x;
709  }
710 
711  return NULL;
712 }
713 
714 static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
715  const xfrm_address_t *daddr,
716  const xfrm_address_t *saddr,
717  u8 proto, unsigned short family)
718 {
719  unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
720  struct xfrm_state *x;
721  struct hlist_node *entry;
722 
723  hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
724  if (x->props.family != family ||
725  x->id.proto != proto ||
726  xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
727  xfrm_addr_cmp(&x->props.saddr, saddr, family))
728  continue;
729 
730  if ((mark & x->mark.m) != x->mark.v)
731  continue;
732  xfrm_state_hold(x);
733  return x;
734  }
735 
736  return NULL;
737 }
738 
739 static inline struct xfrm_state *
740 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
741 {
742  struct net *net = xs_net(x);
743  u32 mark = x->mark.v & x->mark.m;
744 
745  if (use_spi)
746  return __xfrm_state_lookup(net, mark, &x->id.daddr,
747  x->id.spi, x->id.proto, family);
748  else
749  return __xfrm_state_lookup_byaddr(net, mark,
750  &x->id.daddr,
751  &x->props.saddr,
752  x->id.proto, family);
753 }
754 
755 static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
756 {
757  if (have_hash_collision &&
758  (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
759  net->xfrm.state_num > net->xfrm.state_hmask)
760  schedule_work(&net->xfrm.state_hash_work);
761 }
762 
763 static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
764  const struct flowi *fl, unsigned short family,
765  struct xfrm_state **best, int *acq_in_progress,
766  int *error)
767 {
768  /* Resolution logic:
769  * 1. There is a valid state with matching selector. Done.
770  * 2. Valid state with inappropriate selector. Skip.
771  *
772  * Entering area of "sysdeps".
773  *
774  * 3. If state is not valid, selector is temporary, it selects
775  * only session which triggered previous resolution. Key
776  * manager will do something to install a state with proper
777  * selector.
778  */
779  if (x->km.state == XFRM_STATE_VALID) {
780  if ((x->sel.family &&
781  !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
782  !security_xfrm_state_pol_flow_match(x, pol, fl))
783  return;
784 
785  if (!*best ||
786  (*best)->km.dying > x->km.dying ||
787  ((*best)->km.dying == x->km.dying &&
788  (*best)->curlft.add_time < x->curlft.add_time))
789  *best = x;
790  } else if (x->km.state == XFRM_STATE_ACQ) {
791  *acq_in_progress = 1;
792  } else if (x->km.state == XFRM_STATE_ERROR ||
793  x->km.state == XFRM_STATE_EXPIRED) {
794  if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
795  security_xfrm_state_pol_flow_match(x, pol, fl))
796  *error = -ESRCH;
797  }
798 }
799 
800 struct xfrm_state *
801 xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
802  const struct flowi *fl, struct xfrm_tmpl *tmpl,
803  struct xfrm_policy *pol, int *err,
804  unsigned short family)
805 {
806  static xfrm_address_t saddr_wildcard = { };
807  struct net *net = xp_net(pol);
808  unsigned int h, h_wildcard;
809  struct hlist_node *entry;
810  struct xfrm_state *x, *x0, *to_put;
811  int acquire_in_progress = 0;
812  int error = 0;
813  struct xfrm_state *best = NULL;
814  u32 mark = pol->mark.v & pol->mark.m;
815  unsigned short encap_family = tmpl->encap_family;
816 
817  to_put = NULL;
818 
819  spin_lock_bh(&xfrm_state_lock);
820  h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
821  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
822  if (x->props.family == encap_family &&
823  x->props.reqid == tmpl->reqid &&
824  (mark & x->mark.m) == x->mark.v &&
825  !(x->props.flags & XFRM_STATE_WILDRECV) &&
826  xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
827  tmpl->mode == x->props.mode &&
828  tmpl->id.proto == x->id.proto &&
829  (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
830  xfrm_state_look_at(pol, x, fl, encap_family,
831  &best, &acquire_in_progress, &error);
832  }
833  if (best)
834  goto found;
835 
836  h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
837  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
838  if (x->props.family == encap_family &&
839  x->props.reqid == tmpl->reqid &&
840  (mark & x->mark.m) == x->mark.v &&
841  !(x->props.flags & XFRM_STATE_WILDRECV) &&
842  xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
843  tmpl->mode == x->props.mode &&
844  tmpl->id.proto == x->id.proto &&
845  (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
846  xfrm_state_look_at(pol, x, fl, encap_family,
847  &best, &acquire_in_progress, &error);
848  }
849 
850 found:
851  x = best;
852  if (!x && !error && !acquire_in_progress) {
853  if (tmpl->id.spi &&
854  (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
855  tmpl->id.proto, encap_family)) != NULL) {
856  to_put = x0;
857  error = -EEXIST;
858  goto out;
859  }
860  x = xfrm_state_alloc(net);
861  if (x == NULL) {
862  error = -ENOMEM;
863  goto out;
864  }
865  /* Initialize temporary state matching only
866  * to current session. */
867  xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
868  memcpy(&x->mark, &pol->mark, sizeof(x->mark));
869 
870  error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid);
871  if (error) {
872  x->km.state = XFRM_STATE_DEAD;
873  to_put = x;
874  x = NULL;
875  goto out;
876  }
877 
878  if (km_query(x, tmpl, pol) == 0) {
879  x->km.state = XFRM_STATE_ACQ;
880  list_add(&x->km.all, &net->xfrm.state_all);
881  hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
882  h = xfrm_src_hash(net, daddr, saddr, encap_family);
883  hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
884  if (x->id.spi) {
885  h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
886  hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
887  }
888  x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
889  tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
890  net->xfrm.state_num++;
891  xfrm_hash_grow_check(net, x->bydst.next != NULL);
892  } else {
893  x->km.state = XFRM_STATE_DEAD;
894  to_put = x;
895  x = NULL;
896  error = -ESRCH;
897  }
898  }
899 out:
900  if (x)
901  xfrm_state_hold(x);
902  else
903  *err = acquire_in_progress ? -EAGAIN : error;
904  spin_unlock_bh(&xfrm_state_lock);
905  if (to_put)
906  xfrm_state_put(to_put);
907  return x;
908 }
909 
910 struct xfrm_state *
911 xfrm_stateonly_find(struct net *net, u32 mark,
912  xfrm_address_t *daddr, xfrm_address_t *saddr,
913  unsigned short family, u8 mode, u8 proto, u32 reqid)
914 {
915  unsigned int h;
916  struct xfrm_state *rx = NULL, *x = NULL;
917  struct hlist_node *entry;
918 
919  spin_lock(&xfrm_state_lock);
920  h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
921  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
922  if (x->props.family == family &&
923  x->props.reqid == reqid &&
924  (mark & x->mark.m) == x->mark.v &&
925  !(x->props.flags & XFRM_STATE_WILDRECV) &&
926  xfrm_state_addr_check(x, daddr, saddr, family) &&
927  mode == x->props.mode &&
928  proto == x->id.proto &&
929  x->km.state == XFRM_STATE_VALID) {
930  rx = x;
931  break;
932  }
933  }
934 
935  if (rx)
936  xfrm_state_hold(rx);
937  spin_unlock(&xfrm_state_lock);
938 
939 
940  return rx;
941 }
943 
944 static void __xfrm_state_insert(struct xfrm_state *x)
945 {
946  struct net *net = xs_net(x);
947  unsigned int h;
948 
949  list_add(&x->km.all, &net->xfrm.state_all);
950 
951  h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
952  x->props.reqid, x->props.family);
953  hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
954 
955  h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
956  hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
957 
958  if (x->id.spi) {
959  h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
960  x->props.family);
961 
962  hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
963  }
964 
965  tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
966  if (x->replay_maxage)
967  mod_timer(&x->rtimer, jiffies + x->replay_maxage);
968 
969  wake_up(&net->xfrm.km_waitq);
970 
971  net->xfrm.state_num++;
972 
973  xfrm_hash_grow_check(net, x->bydst.next != NULL);
974 }
975 
976 /* xfrm_state_lock is held */
977 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
978 {
979  struct net *net = xs_net(xnew);
980  unsigned short family = xnew->props.family;
981  u32 reqid = xnew->props.reqid;
982  struct xfrm_state *x;
983  struct hlist_node *entry;
984  unsigned int h;
985  u32 mark = xnew->mark.v & xnew->mark.m;
986 
987  h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
988  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
989  if (x->props.family == family &&
990  x->props.reqid == reqid &&
991  (mark & x->mark.m) == x->mark.v &&
992  !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
993  !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
994  x->genid++;
995  }
996 }
997 
999 {
1000  spin_lock_bh(&xfrm_state_lock);
1001  __xfrm_state_bump_genids(x);
1002  __xfrm_state_insert(x);
1003  spin_unlock_bh(&xfrm_state_lock);
1004 }
1006 
1007 /* xfrm_state_lock is held */
1008 static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
1009  unsigned short family, u8 mode,
1010  u32 reqid, u8 proto,
1011  const xfrm_address_t *daddr,
1012  const xfrm_address_t *saddr, int create)
1013 {
1014  unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
1015  struct hlist_node *entry;
1016  struct xfrm_state *x;
1017  u32 mark = m->v & m->m;
1018 
1019  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
1020  if (x->props.reqid != reqid ||
1021  x->props.mode != mode ||
1022  x->props.family != family ||
1023  x->km.state != XFRM_STATE_ACQ ||
1024  x->id.spi != 0 ||
1025  x->id.proto != proto ||
1026  (mark & x->mark.m) != x->mark.v ||
1027  xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
1028  xfrm_addr_cmp(&x->props.saddr, saddr, family))
1029  continue;
1030 
1031  xfrm_state_hold(x);
1032  return x;
1033  }
1034 
1035  if (!create)
1036  return NULL;
1037 
1038  x = xfrm_state_alloc(net);
1039  if (likely(x)) {
1040  switch (family) {
1041  case AF_INET:
1042  x->sel.daddr.a4 = daddr->a4;
1043  x->sel.saddr.a4 = saddr->a4;
1044  x->sel.prefixlen_d = 32;
1045  x->sel.prefixlen_s = 32;
1046  x->props.saddr.a4 = saddr->a4;
1047  x->id.daddr.a4 = daddr->a4;
1048  break;
1049 
1050  case AF_INET6:
1051  *(struct in6_addr *)x->sel.daddr.a6 = *(struct in6_addr *)daddr;
1052  *(struct in6_addr *)x->sel.saddr.a6 = *(struct in6_addr *)saddr;
1053  x->sel.prefixlen_d = 128;
1054  x->sel.prefixlen_s = 128;
1055  *(struct in6_addr *)x->props.saddr.a6 = *(struct in6_addr *)saddr;
1056  *(struct in6_addr *)x->id.daddr.a6 = *(struct in6_addr *)daddr;
1057  break;
1058  }
1059 
1060  x->km.state = XFRM_STATE_ACQ;
1061  x->id.proto = proto;
1062  x->props.family = family;
1063  x->props.mode = mode;
1064  x->props.reqid = reqid;
1065  x->mark.v = m->v;
1066  x->mark.m = m->m;
1067  x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
1068  xfrm_state_hold(x);
1069  tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
1070  list_add(&x->km.all, &net->xfrm.state_all);
1071  hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
1072  h = xfrm_src_hash(net, daddr, saddr, family);
1073  hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
1074 
1075  net->xfrm.state_num++;
1076 
1077  xfrm_hash_grow_check(net, x->bydst.next != NULL);
1078  }
1079 
1080  return x;
1081 }
1082 
1083 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1084 
1086 {
1087  struct net *net = xs_net(x);
1088  struct xfrm_state *x1, *to_put;
1089  int family;
1090  int err;
1091  u32 mark = x->mark.v & x->mark.m;
1092  int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1093 
1094  family = x->props.family;
1095 
1096  to_put = NULL;
1097 
1098  spin_lock_bh(&xfrm_state_lock);
1099 
1100  x1 = __xfrm_state_locate(x, use_spi, family);
1101  if (x1) {
1102  to_put = x1;
1103  x1 = NULL;
1104  err = -EEXIST;
1105  goto out;
1106  }
1107 
1108  if (use_spi && x->km.seq) {
1109  x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq);
1110  if (x1 && ((x1->id.proto != x->id.proto) ||
1111  xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1112  to_put = x1;
1113  x1 = NULL;
1114  }
1115  }
1116 
1117  if (use_spi && !x1)
1118  x1 = __find_acq_core(net, &x->mark, family, x->props.mode,
1119  x->props.reqid, x->id.proto,
1120  &x->id.daddr, &x->props.saddr, 0);
1121 
1122  __xfrm_state_bump_genids(x);
1123  __xfrm_state_insert(x);
1124  err = 0;
1125 
1126 out:
1127  spin_unlock_bh(&xfrm_state_lock);
1128 
1129  if (x1) {
1130  xfrm_state_delete(x1);
1131  xfrm_state_put(x1);
1132  }
1133 
1134  if (to_put)
1135  xfrm_state_put(to_put);
1136 
1137  return err;
1138 }
1140 
1141 #ifdef CONFIG_XFRM_MIGRATE
1142 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1143 {
1144  struct net *net = xs_net(orig);
1145  int err = -ENOMEM;
1146  struct xfrm_state *x = xfrm_state_alloc(net);
1147  if (!x)
1148  goto out;
1149 
1150  memcpy(&x->id, &orig->id, sizeof(x->id));
1151  memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1152  memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1153  x->props.mode = orig->props.mode;
1154  x->props.replay_window = orig->props.replay_window;
1155  x->props.reqid = orig->props.reqid;
1156  x->props.family = orig->props.family;
1157  x->props.saddr = orig->props.saddr;
1158 
1159  if (orig->aalg) {
1160  x->aalg = xfrm_algo_auth_clone(orig->aalg);
1161  if (!x->aalg)
1162  goto error;
1163  }
1164  x->props.aalgo = orig->props.aalgo;
1165 
1166  if (orig->ealg) {
1167  x->ealg = xfrm_algo_clone(orig->ealg);
1168  if (!x->ealg)
1169  goto error;
1170  }
1171  x->props.ealgo = orig->props.ealgo;
1172 
1173  if (orig->calg) {
1174  x->calg = xfrm_algo_clone(orig->calg);
1175  if (!x->calg)
1176  goto error;
1177  }
1178  x->props.calgo = orig->props.calgo;
1179 
1180  if (orig->encap) {
1181  x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1182  if (!x->encap)
1183  goto error;
1184  }
1185 
1186  if (orig->coaddr) {
1187  x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1188  GFP_KERNEL);
1189  if (!x->coaddr)
1190  goto error;
1191  }
1192 
1193  if (orig->replay_esn) {
1194  err = xfrm_replay_clone(x, orig);
1195  if (err)
1196  goto error;
1197  }
1198 
1199  memcpy(&x->mark, &orig->mark, sizeof(x->mark));
1200 
1201  err = xfrm_init_state(x);
1202  if (err)
1203  goto error;
1204 
1205  x->props.flags = orig->props.flags;
1206 
1207  x->curlft.add_time = orig->curlft.add_time;
1208  x->km.state = orig->km.state;
1209  x->km.seq = orig->km.seq;
1210 
1211  return x;
1212 
1213  error:
1214  xfrm_state_put(x);
1215 out:
1216  if (errp)
1217  *errp = err;
1218  return NULL;
1219 }
1220 
1221 /* xfrm_state_lock is held */
1222 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1223 {
1224  unsigned int h;
1225  struct xfrm_state *x;
1226  struct hlist_node *entry;
1227 
1228  if (m->reqid) {
1229  h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr,
1230  m->reqid, m->old_family);
1231  hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
1232  if (x->props.mode != m->mode ||
1233  x->id.proto != m->proto)
1234  continue;
1235  if (m->reqid && x->props.reqid != m->reqid)
1236  continue;
1237  if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1238  m->old_family) ||
1239  xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1240  m->old_family))
1241  continue;
1242  xfrm_state_hold(x);
1243  return x;
1244  }
1245  } else {
1246  h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr,
1247  m->old_family);
1248  hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
1249  if (x->props.mode != m->mode ||
1250  x->id.proto != m->proto)
1251  continue;
1252  if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1253  m->old_family) ||
1254  xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1255  m->old_family))
1256  continue;
1257  xfrm_state_hold(x);
1258  return x;
1259  }
1260  }
1261 
1262  return NULL;
1263 }
1264 EXPORT_SYMBOL(xfrm_migrate_state_find);
1265 
1266 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1267  struct xfrm_migrate *m)
1268 {
1269  struct xfrm_state *xc;
1270  int err;
1271 
1272  xc = xfrm_state_clone(x, &err);
1273  if (!xc)
1274  return NULL;
1275 
1276  memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1277  memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1278 
1279  /* add state */
1280  if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1281  /* a care is needed when the destination address of the
1282  state is to be updated as it is a part of triplet */
1283  xfrm_state_insert(xc);
1284  } else {
1285  if ((err = xfrm_state_add(xc)) < 0)
1286  goto error;
1287  }
1288 
1289  return xc;
1290 error:
1291  xfrm_state_put(xc);
1292  return NULL;
1293 }
1294 EXPORT_SYMBOL(xfrm_state_migrate);
1295 #endif
1296 
1298 {
1299  struct xfrm_state *x1, *to_put;
1300  int err;
1301  int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1302 
1303  to_put = NULL;
1304 
1305  spin_lock_bh(&xfrm_state_lock);
1306  x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1307 
1308  err = -ESRCH;
1309  if (!x1)
1310  goto out;
1311 
1312  if (xfrm_state_kern(x1)) {
1313  to_put = x1;
1314  err = -EEXIST;
1315  goto out;
1316  }
1317 
1318  if (x1->km.state == XFRM_STATE_ACQ) {
1319  __xfrm_state_insert(x);
1320  x = NULL;
1321  }
1322  err = 0;
1323 
1324 out:
1325  spin_unlock_bh(&xfrm_state_lock);
1326 
1327  if (to_put)
1328  xfrm_state_put(to_put);
1329 
1330  if (err)
1331  return err;
1332 
1333  if (!x) {
1334  xfrm_state_delete(x1);
1335  xfrm_state_put(x1);
1336  return 0;
1337  }
1338 
1339  err = -EINVAL;
1340  spin_lock_bh(&x1->lock);
1341  if (likely(x1->km.state == XFRM_STATE_VALID)) {
1342  if (x->encap && x1->encap)
1343  memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1344  if (x->coaddr && x1->coaddr) {
1345  memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1346  }
1347  if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1348  memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1349  memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1350  x1->km.dying = 0;
1351 
1352  tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
1353  if (x1->curlft.use_time)
1355 
1356  err = 0;
1357  x->km.state = XFRM_STATE_DEAD;
1358  __xfrm_state_put(x);
1359  }
1360  spin_unlock_bh(&x1->lock);
1361 
1362  xfrm_state_put(x1);
1363 
1364  return err;
1365 }
1367 
1369 {
1370  if (!x->curlft.use_time)
1371  x->curlft.use_time = get_seconds();
1372 
1373  if (x->km.state != XFRM_STATE_VALID)
1374  return -EINVAL;
1375 
1376  if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1377  x->curlft.packets >= x->lft.hard_packet_limit) {
1378  x->km.state = XFRM_STATE_EXPIRED;
1379  tasklet_hrtimer_start(&x->mtimer, ktime_set(0,0), HRTIMER_MODE_REL);
1380  return -EINVAL;
1381  }
1382 
1383  if (!x->km.dying &&
1384  (x->curlft.bytes >= x->lft.soft_byte_limit ||
1385  x->curlft.packets >= x->lft.soft_packet_limit)) {
1386  x->km.dying = 1;
1387  km_state_expired(x, 0, 0);
1388  }
1389  return 0;
1390 }
1392 
1393 struct xfrm_state *
1394 xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi,
1395  u8 proto, unsigned short family)
1396 {
1397  struct xfrm_state *x;
1398 
1399  spin_lock_bh(&xfrm_state_lock);
1400  x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
1401  spin_unlock_bh(&xfrm_state_lock);
1402  return x;
1403 }
1405 
1406 struct xfrm_state *
1407 xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1408  const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1409  u8 proto, unsigned short family)
1410 {
1411  struct xfrm_state *x;
1412 
1413  spin_lock_bh(&xfrm_state_lock);
1414  x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
1415  spin_unlock_bh(&xfrm_state_lock);
1416  return x;
1417 }
1419 
1420 struct xfrm_state *
1421 xfrm_find_acq(struct net *net, struct xfrm_mark *mark, u8 mode, u32 reqid, u8 proto,
1422  const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1423  int create, unsigned short family)
1424 {
1425  struct xfrm_state *x;
1426 
1427  spin_lock_bh(&xfrm_state_lock);
1428  x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create);
1429  spin_unlock_bh(&xfrm_state_lock);
1430 
1431  return x;
1432 }
1434 
1435 #ifdef CONFIG_XFRM_SUB_POLICY
1436 int
1437 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1438  unsigned short family)
1439 {
1440  int err = 0;
1441  struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1442  if (!afinfo)
1443  return -EAFNOSUPPORT;
1444 
1445  spin_lock_bh(&xfrm_state_lock);
1446  if (afinfo->tmpl_sort)
1447  err = afinfo->tmpl_sort(dst, src, n);
1448  spin_unlock_bh(&xfrm_state_lock);
1449  xfrm_state_put_afinfo(afinfo);
1450  return err;
1451 }
1452 EXPORT_SYMBOL(xfrm_tmpl_sort);
1453 
1454 int
1455 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1456  unsigned short family)
1457 {
1458  int err = 0;
1459  struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1460  if (!afinfo)
1461  return -EAFNOSUPPORT;
1462 
1463  spin_lock_bh(&xfrm_state_lock);
1464  if (afinfo->state_sort)
1465  err = afinfo->state_sort(dst, src, n);
1466  spin_unlock_bh(&xfrm_state_lock);
1467  xfrm_state_put_afinfo(afinfo);
1468  return err;
1469 }
1470 EXPORT_SYMBOL(xfrm_state_sort);
1471 #endif
1472 
1473 /* Silly enough, but I'm lazy to build resolution list */
1474 
1475 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
1476 {
1477  int i;
1478 
1479  for (i = 0; i <= net->xfrm.state_hmask; i++) {
1480  struct hlist_node *entry;
1481  struct xfrm_state *x;
1482 
1483  hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
1484  if (x->km.seq == seq &&
1485  (mark & x->mark.m) == x->mark.v &&
1486  x->km.state == XFRM_STATE_ACQ) {
1487  xfrm_state_hold(x);
1488  return x;
1489  }
1490  }
1491  }
1492  return NULL;
1493 }
1494 
1495 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
1496 {
1497  struct xfrm_state *x;
1498 
1499  spin_lock_bh(&xfrm_state_lock);
1500  x = __xfrm_find_acq_byseq(net, mark, seq);
1501  spin_unlock_bh(&xfrm_state_lock);
1502  return x;
1503 }
1505 
1507 {
1508  u32 res;
1509  static atomic_t acqseq;
1510 
1511  do {
1512  res = atomic_inc_return(&acqseq);
1513  } while (!res);
1514 
1515  return res;
1516 }
1518 
1520 {
1521  struct net *net = xs_net(x);
1522  unsigned int h;
1523  struct xfrm_state *x0;
1524  int err = -ENOENT;
1525  __be32 minspi = htonl(low);
1526  __be32 maxspi = htonl(high);
1527  u32 mark = x->mark.v & x->mark.m;
1528 
1529  spin_lock_bh(&x->lock);
1530  if (x->km.state == XFRM_STATE_DEAD)
1531  goto unlock;
1532 
1533  err = 0;
1534  if (x->id.spi)
1535  goto unlock;
1536 
1537  err = -ENOENT;
1538 
1539  if (minspi == maxspi) {
1540  x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
1541  if (x0) {
1542  xfrm_state_put(x0);
1543  goto unlock;
1544  }
1545  x->id.spi = minspi;
1546  } else {
1547  u32 spi = 0;
1548  for (h=0; h<high-low+1; h++) {
1549  spi = low + net_random()%(high-low+1);
1550  x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1551  if (x0 == NULL) {
1552  x->id.spi = htonl(spi);
1553  break;
1554  }
1555  xfrm_state_put(x0);
1556  }
1557  }
1558  if (x->id.spi) {
1559  spin_lock_bh(&xfrm_state_lock);
1560  h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1561  hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
1562  spin_unlock_bh(&xfrm_state_lock);
1563 
1564  err = 0;
1565  }
1566 
1567 unlock:
1568  spin_unlock_bh(&x->lock);
1569 
1570  return err;
1571 }
1573 
1574 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1575  int (*func)(struct xfrm_state *, int, void*),
1576  void *data)
1577 {
1578  struct xfrm_state *state;
1579  struct xfrm_state_walk *x;
1580  int err = 0;
1581 
1582  if (walk->seq != 0 && list_empty(&walk->all))
1583  return 0;
1584 
1585  spin_lock_bh(&xfrm_state_lock);
1586  if (list_empty(&walk->all))
1587  x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
1588  else
1589  x = list_entry(&walk->all, struct xfrm_state_walk, all);
1590  list_for_each_entry_from(x, &net->xfrm.state_all, all) {
1591  if (x->state == XFRM_STATE_DEAD)
1592  continue;
1593  state = container_of(x, struct xfrm_state, km);
1594  if (!xfrm_id_proto_match(state->id.proto, walk->proto))
1595  continue;
1596  err = func(state, walk->seq, data);
1597  if (err) {
1598  list_move_tail(&walk->all, &x->all);
1599  goto out;
1600  }
1601  walk->seq++;
1602  }
1603  if (walk->seq == 0) {
1604  err = -ENOENT;
1605  goto out;
1606  }
1607  list_del_init(&walk->all);
1608 out:
1609  spin_unlock_bh(&xfrm_state_lock);
1610  return err;
1611 }
1613 
1614 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
1615 {
1616  INIT_LIST_HEAD(&walk->all);
1617  walk->proto = proto;
1618  walk->state = XFRM_STATE_DEAD;
1619  walk->seq = 0;
1620 }
1622 
1624 {
1625  if (list_empty(&walk->all))
1626  return;
1627 
1628  spin_lock_bh(&xfrm_state_lock);
1629  list_del(&walk->all);
1630  spin_unlock_bh(&xfrm_state_lock);
1631 }
1633 
1634 static void xfrm_replay_timer_handler(unsigned long data)
1635 {
1636  struct xfrm_state *x = (struct xfrm_state*)data;
1637 
1638  spin_lock(&x->lock);
1639 
1640  if (x->km.state == XFRM_STATE_VALID) {
1641  if (xfrm_aevent_is_on(xs_net(x)))
1642  x->repl->notify(x, XFRM_REPLAY_TIMEOUT);
1643  else
1644  x->xflags |= XFRM_TIME_DEFER;
1645  }
1646 
1647  spin_unlock(&x->lock);
1648 }
1649 
1650 static LIST_HEAD(xfrm_km_list);
1651 static DEFINE_RWLOCK(xfrm_km_lock);
1652 
1653 void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
1654 {
1655  struct xfrm_mgr *km;
1656 
1657  read_lock(&xfrm_km_lock);
1658  list_for_each_entry(km, &xfrm_km_list, list)
1659  if (km->notify_policy)
1660  km->notify_policy(xp, dir, c);
1661  read_unlock(&xfrm_km_lock);
1662 }
1663 
1664 void km_state_notify(struct xfrm_state *x, const struct km_event *c)
1665 {
1666  struct xfrm_mgr *km;
1667  read_lock(&xfrm_km_lock);
1668  list_for_each_entry(km, &xfrm_km_list, list)
1669  if (km->notify)
1670  km->notify(x, c);
1671  read_unlock(&xfrm_km_lock);
1672 }
1673 
1676 
1677 void km_state_expired(struct xfrm_state *x, int hard, u32 portid)
1678 {
1679  struct net *net = xs_net(x);
1680  struct km_event c;
1681 
1682  c.data.hard = hard;
1683  c.portid = portid;
1684  c.event = XFRM_MSG_EXPIRE;
1685  km_state_notify(x, &c);
1686 
1687  if (hard)
1688  wake_up(&net->xfrm.km_waitq);
1689 }
1690 
1692 /*
1693  * We send to all registered managers regardless of failure
1694  * We are happy with one success
1695 */
1696 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1697 {
1698  int err = -EINVAL, acqret;
1699  struct xfrm_mgr *km;
1700 
1701  read_lock(&xfrm_km_lock);
1702  list_for_each_entry(km, &xfrm_km_list, list) {
1703  acqret = km->acquire(x, t, pol);
1704  if (!acqret)
1705  err = acqret;
1706  }
1707  read_unlock(&xfrm_km_lock);
1708  return err;
1709 }
1711 
1713 {
1714  int err = -EINVAL;
1715  struct xfrm_mgr *km;
1716 
1717  read_lock(&xfrm_km_lock);
1718  list_for_each_entry(km, &xfrm_km_list, list) {
1719  if (km->new_mapping)
1720  err = km->new_mapping(x, ipaddr, sport);
1721  if (!err)
1722  break;
1723  }
1724  read_unlock(&xfrm_km_lock);
1725  return err;
1726 }
1728 
1729 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
1730 {
1731  struct net *net = xp_net(pol);
1732  struct km_event c;
1733 
1734  c.data.hard = hard;
1735  c.portid = portid;
1737  km_policy_notify(pol, dir, &c);
1738 
1739  if (hard)
1740  wake_up(&net->xfrm.km_waitq);
1741 }
1743 
1744 #ifdef CONFIG_XFRM_MIGRATE
1745 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1746  const struct xfrm_migrate *m, int num_migrate,
1747  const struct xfrm_kmaddress *k)
1748 {
1749  int err = -EINVAL;
1750  int ret;
1751  struct xfrm_mgr *km;
1752 
1753  read_lock(&xfrm_km_lock);
1754  list_for_each_entry(km, &xfrm_km_list, list) {
1755  if (km->migrate) {
1756  ret = km->migrate(sel, dir, type, m, num_migrate, k);
1757  if (!ret)
1758  err = ret;
1759  }
1760  }
1761  read_unlock(&xfrm_km_lock);
1762  return err;
1763 }
1764 EXPORT_SYMBOL(km_migrate);
1765 #endif
1766 
1767 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1768 {
1769  int err = -EINVAL;
1770  int ret;
1771  struct xfrm_mgr *km;
1772 
1773  read_lock(&xfrm_km_lock);
1774  list_for_each_entry(km, &xfrm_km_list, list) {
1775  if (km->report) {
1776  ret = km->report(net, proto, sel, addr);
1777  if (!ret)
1778  err = ret;
1779  }
1780  }
1781  read_unlock(&xfrm_km_lock);
1782  return err;
1783 }
1785 
1786 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1787 {
1788  int err;
1789  u8 *data;
1790  struct xfrm_mgr *km;
1791  struct xfrm_policy *pol = NULL;
1792 
1793  if (optlen <= 0 || optlen > PAGE_SIZE)
1794  return -EMSGSIZE;
1795 
1796  data = kmalloc(optlen, GFP_KERNEL);
1797  if (!data)
1798  return -ENOMEM;
1799 
1800  err = -EFAULT;
1801  if (copy_from_user(data, optval, optlen))
1802  goto out;
1803 
1804  err = -EINVAL;
1805  read_lock(&xfrm_km_lock);
1806  list_for_each_entry(km, &xfrm_km_list, list) {
1807  pol = km->compile_policy(sk, optname, data,
1808  optlen, &err);
1809  if (err >= 0)
1810  break;
1811  }
1812  read_unlock(&xfrm_km_lock);
1813 
1814  if (err >= 0) {
1815  xfrm_sk_policy_insert(sk, err, pol);
1816  xfrm_pol_put(pol);
1817  err = 0;
1818  }
1819 
1820 out:
1821  kfree(data);
1822  return err;
1823 }
1825 
1827 {
1828  write_lock_bh(&xfrm_km_lock);
1829  list_add_tail(&km->list, &xfrm_km_list);
1830  write_unlock_bh(&xfrm_km_lock);
1831  return 0;
1832 }
1834 
1836 {
1837  write_lock_bh(&xfrm_km_lock);
1838  list_del(&km->list);
1839  write_unlock_bh(&xfrm_km_lock);
1840  return 0;
1841 }
1843 
1844 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1845 {
1846  int err = 0;
1847  if (unlikely(afinfo == NULL))
1848  return -EINVAL;
1849  if (unlikely(afinfo->family >= NPROTO))
1850  return -EAFNOSUPPORT;
1851  write_lock_bh(&xfrm_state_afinfo_lock);
1852  if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1853  err = -ENOBUFS;
1854  else
1855  xfrm_state_afinfo[afinfo->family] = afinfo;
1856  write_unlock_bh(&xfrm_state_afinfo_lock);
1857  return err;
1858 }
1860 
1861 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1862 {
1863  int err = 0;
1864  if (unlikely(afinfo == NULL))
1865  return -EINVAL;
1866  if (unlikely(afinfo->family >= NPROTO))
1867  return -EAFNOSUPPORT;
1868  write_lock_bh(&xfrm_state_afinfo_lock);
1869  if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1870  if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1871  err = -EINVAL;
1872  else
1873  xfrm_state_afinfo[afinfo->family] = NULL;
1874  }
1875  write_unlock_bh(&xfrm_state_afinfo_lock);
1876  return err;
1877 }
1879 
1880 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1881 {
1882  struct xfrm_state_afinfo *afinfo;
1883  if (unlikely(family >= NPROTO))
1884  return NULL;
1885  read_lock(&xfrm_state_afinfo_lock);
1886  afinfo = xfrm_state_afinfo[family];
1887  if (unlikely(!afinfo))
1888  read_unlock(&xfrm_state_afinfo_lock);
1889  return afinfo;
1890 }
1891 
1892 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1893  __releases(xfrm_state_afinfo_lock)
1894 {
1895  read_unlock(&xfrm_state_afinfo_lock);
1896 }
1897 
1898 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1900 {
1901  if (x->tunnel) {
1902  struct xfrm_state *t = x->tunnel;
1903 
1904  if (atomic_read(&t->tunnel_users) == 2)
1905  xfrm_state_delete(t);
1906  atomic_dec(&t->tunnel_users);
1907  xfrm_state_put(t);
1908  x->tunnel = NULL;
1909  }
1910 }
1912 
1913 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1914 {
1915  int res;
1916 
1917  spin_lock_bh(&x->lock);
1918  if (x->km.state == XFRM_STATE_VALID &&
1919  x->type && x->type->get_mtu)
1920  res = x->type->get_mtu(x, mtu);
1921  else
1922  res = mtu - x->props.header_len;
1923  spin_unlock_bh(&x->lock);
1924  return res;
1925 }
1926 
1927 int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
1928 {
1929  struct xfrm_state_afinfo *afinfo;
1930  struct xfrm_mode *inner_mode;
1931  int family = x->props.family;
1932  int err;
1933 
1934  err = -EAFNOSUPPORT;
1935  afinfo = xfrm_state_get_afinfo(family);
1936  if (!afinfo)
1937  goto error;
1938 
1939  err = 0;
1940  if (afinfo->init_flags)
1941  err = afinfo->init_flags(x);
1942 
1943  xfrm_state_put_afinfo(afinfo);
1944 
1945  if (err)
1946  goto error;
1947 
1948  err = -EPROTONOSUPPORT;
1949 
1950  if (x->sel.family != AF_UNSPEC) {
1951  inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
1952  if (inner_mode == NULL)
1953  goto error;
1954 
1955  if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
1956  family != x->sel.family) {
1957  xfrm_put_mode(inner_mode);
1958  goto error;
1959  }
1960 
1961  x->inner_mode = inner_mode;
1962  } else {
1963  struct xfrm_mode *inner_mode_iaf;
1964  int iafamily = AF_INET;
1965 
1966  inner_mode = xfrm_get_mode(x->props.mode, x->props.family);
1967  if (inner_mode == NULL)
1968  goto error;
1969 
1970  if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
1971  xfrm_put_mode(inner_mode);
1972  goto error;
1973  }
1974  x->inner_mode = inner_mode;
1975 
1976  if (x->props.family == AF_INET)
1977  iafamily = AF_INET6;
1978 
1979  inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily);
1980  if (inner_mode_iaf) {
1981  if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)
1982  x->inner_mode_iaf = inner_mode_iaf;
1983  else
1984  xfrm_put_mode(inner_mode_iaf);
1985  }
1986  }
1987 
1988  x->type = xfrm_get_type(x->id.proto, family);
1989  if (x->type == NULL)
1990  goto error;
1991 
1992  err = x->type->init_state(x);
1993  if (err)
1994  goto error;
1995 
1996  x->outer_mode = xfrm_get_mode(x->props.mode, family);
1997  if (x->outer_mode == NULL) {
1998  err = -EPROTONOSUPPORT;
1999  goto error;
2000  }
2001 
2002  if (init_replay) {
2003  err = xfrm_init_replay(x);
2004  if (err)
2005  goto error;
2006  }
2007 
2008  x->km.state = XFRM_STATE_VALID;
2009 
2010 error:
2011  return err;
2012 }
2013 
2015 
2017 {
2018  return __xfrm_init_state(x, true);
2019 }
2020 
2022 
2023 int __net_init xfrm_state_init(struct net *net)
2024 {
2025  unsigned int sz;
2026 
2027  INIT_LIST_HEAD(&net->xfrm.state_all);
2028 
2029  sz = sizeof(struct hlist_head) * 8;
2030 
2031  net->xfrm.state_bydst = xfrm_hash_alloc(sz);
2032  if (!net->xfrm.state_bydst)
2033  goto out_bydst;
2034  net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
2035  if (!net->xfrm.state_bysrc)
2036  goto out_bysrc;
2037  net->xfrm.state_byspi = xfrm_hash_alloc(sz);
2038  if (!net->xfrm.state_byspi)
2039  goto out_byspi;
2040  net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2041 
2042  net->xfrm.state_num = 0;
2043  INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
2044  INIT_HLIST_HEAD(&net->xfrm.state_gc_list);
2045  INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
2046  init_waitqueue_head(&net->xfrm.km_waitq);
2047  return 0;
2048 
2049 out_byspi:
2050  xfrm_hash_free(net->xfrm.state_bysrc, sz);
2051 out_bysrc:
2052  xfrm_hash_free(net->xfrm.state_bydst, sz);
2053 out_bydst:
2054  return -ENOMEM;
2055 }
2056 
2057 void xfrm_state_fini(struct net *net)
2058 {
2059  struct xfrm_audit audit_info;
2060  unsigned int sz;
2061 
2062  flush_work(&net->xfrm.state_hash_work);
2063  audit_info.loginuid = INVALID_UID;
2064  audit_info.sessionid = -1;
2065  audit_info.secid = 0;
2066  xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info);
2067  flush_work(&net->xfrm.state_gc_work);
2068 
2069  WARN_ON(!list_empty(&net->xfrm.state_all));
2070 
2071  sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
2072  WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2073  xfrm_hash_free(net->xfrm.state_byspi, sz);
2074  WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2075  xfrm_hash_free(net->xfrm.state_bysrc, sz);
2076  WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2077  xfrm_hash_free(net->xfrm.state_bydst, sz);
2078 }
2079 
2080 #ifdef CONFIG_AUDITSYSCALL
2081 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2082  struct audit_buffer *audit_buf)
2083 {
2084  struct xfrm_sec_ctx *ctx = x->security;
2085  u32 spi = ntohl(x->id.spi);
2086 
2087  if (ctx)
2088  audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2089  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2090 
2091  switch(x->props.family) {
2092  case AF_INET:
2093  audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2094  &x->props.saddr.a4, &x->id.daddr.a4);
2095  break;
2096  case AF_INET6:
2097  audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
2098  x->props.saddr.a6, x->id.daddr.a6);
2099  break;
2100  }
2101 
2102  audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2103 }
2104 
2105 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2106  struct audit_buffer *audit_buf)
2107 {
2108  const struct iphdr *iph4;
2109  const struct ipv6hdr *iph6;
2110 
2111  switch (family) {
2112  case AF_INET:
2113  iph4 = ip_hdr(skb);
2114  audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2115  &iph4->saddr, &iph4->daddr);
2116  break;
2117  case AF_INET6:
2118  iph6 = ipv6_hdr(skb);
2119  audit_log_format(audit_buf,
2120  " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2121  &iph6->saddr,&iph6->daddr,
2122  iph6->flow_lbl[0] & 0x0f,
2123  iph6->flow_lbl[1],
2124  iph6->flow_lbl[2]);
2125  break;
2126  }
2127 }
2128 
2129 void xfrm_audit_state_add(struct xfrm_state *x, int result,
2130  kuid_t auid, u32 sessionid, u32 secid)
2131 {
2132  struct audit_buffer *audit_buf;
2133 
2134  audit_buf = xfrm_audit_start("SAD-add");
2135  if (audit_buf == NULL)
2136  return;
2137  xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2138  xfrm_audit_helper_sainfo(x, audit_buf);
2139  audit_log_format(audit_buf, " res=%u", result);
2140  audit_log_end(audit_buf);
2141 }
2142 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2143 
2144 void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2145  kuid_t auid, u32 sessionid, u32 secid)
2146 {
2147  struct audit_buffer *audit_buf;
2148 
2149  audit_buf = xfrm_audit_start("SAD-delete");
2150  if (audit_buf == NULL)
2151  return;
2152  xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2153  xfrm_audit_helper_sainfo(x, audit_buf);
2154  audit_log_format(audit_buf, " res=%u", result);
2155  audit_log_end(audit_buf);
2156 }
2157 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2158 
2159 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2160  struct sk_buff *skb)
2161 {
2162  struct audit_buffer *audit_buf;
2163  u32 spi;
2164 
2165  audit_buf = xfrm_audit_start("SA-replay-overflow");
2166  if (audit_buf == NULL)
2167  return;
2168  xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2169  /* don't record the sequence number because it's inherent in this kind
2170  * of audit message */
2171  spi = ntohl(x->id.spi);
2172  audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2173  audit_log_end(audit_buf);
2174 }
2175 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2176 
2177 void xfrm_audit_state_replay(struct xfrm_state *x,
2178  struct sk_buff *skb, __be32 net_seq)
2179 {
2180  struct audit_buffer *audit_buf;
2181  u32 spi;
2182 
2183  audit_buf = xfrm_audit_start("SA-replayed-pkt");
2184  if (audit_buf == NULL)
2185  return;
2186  xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2187  spi = ntohl(x->id.spi);
2188  audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2189  spi, spi, ntohl(net_seq));
2190  audit_log_end(audit_buf);
2191 }
2192 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay);
2193 
2194 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2195 {
2196  struct audit_buffer *audit_buf;
2197 
2198  audit_buf = xfrm_audit_start("SA-notfound");
2199  if (audit_buf == NULL)
2200  return;
2201  xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2202  audit_log_end(audit_buf);
2203 }
2204 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2205 
2206 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2207  __be32 net_spi, __be32 net_seq)
2208 {
2209  struct audit_buffer *audit_buf;
2210  u32 spi;
2211 
2212  audit_buf = xfrm_audit_start("SA-notfound");
2213  if (audit_buf == NULL)
2214  return;
2215  xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2216  spi = ntohl(net_spi);
2217  audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2218  spi, spi, ntohl(net_seq));
2219  audit_log_end(audit_buf);
2220 }
2221 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2222 
2223 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2224  struct sk_buff *skb, u8 proto)
2225 {
2226  struct audit_buffer *audit_buf;
2227  __be32 net_spi;
2228  __be32 net_seq;
2229 
2230  audit_buf = xfrm_audit_start("SA-icv-failure");
2231  if (audit_buf == NULL)
2232  return;
2233  xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2234  if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2235  u32 spi = ntohl(net_spi);
2236  audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2237  spi, spi, ntohl(net_seq));
2238  }
2239  audit_log_end(audit_buf);
2240 }
2241 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2242 #endif /* CONFIG_AUDITSYSCALL */