20 #include <linux/module.h>
22 #include <linux/audit.h>
23 #include <asm/uaccess.h>
25 #include <linux/slab.h>
27 #include <linux/kernel.h>
40 static unsigned int xfrm_state_hashmax
__read_mostly = 1 * 1024 * 1024;
45 static inline unsigned int xfrm_dst_hash(
struct net *
net,
51 return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
54 static inline unsigned int xfrm_src_hash(
struct net *
net,
59 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
62 static inline unsigned int
66 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
73 unsigned int nhashmask)
81 h = __xfrm_dst_hash(&x->
id.daddr, &x->
props.saddr,
84 hlist_add_head(&x->
bydst, ndsttable+h);
86 h = __xfrm_src_hash(&x->
id.daddr, &x->
props.saddr,
89 hlist_add_head(&x->
bysrc, nsrctable+h);
92 h = __xfrm_spi_hash(&x->
id.daddr, x->
id.spi,
95 hlist_add_head(&x->
byspi, nspitable+h);
100 static unsigned long xfrm_hash_new_size(
unsigned int state_hmask)
102 return ((state_hmask + 1) << 1) *
sizeof(
struct hlist_head);
110 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
111 unsigned long nsize, osize;
112 unsigned int nhashmask, ohashmask;
117 nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
133 spin_lock_bh(&xfrm_state_lock);
135 nhashmask = (nsize /
sizeof(
struct hlist_head)) - 1
U;
136 for (i = net->xfrm.state_hmask; i >= 0; i--)
137 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
140 odst = net->xfrm.state_bydst;
141 osrc = net->xfrm.state_bysrc;
142 ospi = net->xfrm.state_byspi;
143 ohashmask = net->xfrm.state_hmask;
145 net->xfrm.state_bydst = ndst;
146 net->xfrm.state_bysrc = nsrc;
147 net->xfrm.state_byspi = nspi;
148 net->xfrm.state_hmask = nhashmask;
150 spin_unlock_bh(&xfrm_state_lock);
152 osize = (ohashmask + 1) *
sizeof(
struct hlist_head);
171 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(
unsigned int family)
173 struct xfrm_state_afinfo *afinfo;
177 afinfo = xfrm_state_afinfo[
family];
183 static void xfrm_state_unlock_afinfo(
struct xfrm_state_afinfo *afinfo)
191 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
203 xfrm_state_unlock_afinfo(afinfo);
210 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
222 xfrm_state_unlock_afinfo(afinfo);
227 static const struct xfrm_type *xfrm_get_type(
u8 proto,
unsigned short family)
229 struct xfrm_state_afinfo *afinfo;
232 int modload_attempted = 0;
235 afinfo = xfrm_state_get_afinfo(family);
240 type = typemap[
proto];
243 if (!type && !modload_attempted) {
244 xfrm_state_put_afinfo(afinfo);
245 request_module(
"xfrm-type-%d-%d", family, proto);
246 modload_attempted = 1;
250 xfrm_state_put_afinfo(afinfo);
254 static void xfrm_put_type(
const struct xfrm_type *type)
256 module_put(type->
owner);
261 struct xfrm_state_afinfo *afinfo;
268 afinfo = xfrm_state_lock_afinfo(family);
274 if (modemap[mode->
encap])
278 if (!try_module_get(afinfo->
owner))
286 xfrm_state_unlock_afinfo(afinfo);
293 struct xfrm_state_afinfo *afinfo;
300 afinfo = xfrm_state_lock_afinfo(family);
308 module_put(mode->
afinfo->owner);
312 xfrm_state_unlock_afinfo(afinfo);
317 static struct xfrm_mode *xfrm_get_mode(
unsigned int encap,
int family)
319 struct xfrm_state_afinfo *afinfo;
321 int modload_attempted = 0;
327 afinfo = xfrm_state_get_afinfo(family);
334 if (!mode && !modload_attempted) {
335 xfrm_state_put_afinfo(afinfo);
336 request_module(
"xfrm-mode-%d-%d", family, encap);
337 modload_attempted = 1;
341 xfrm_state_put_afinfo(afinfo);
345 static void xfrm_put_mode(
struct xfrm_mode *mode)
347 module_put(mode->
owner);
350 static void xfrm_state_gc_destroy(
struct xfrm_state *x)
352 tasklet_hrtimer_cancel(&x->
mtimer);
368 x->
type->destructor(x);
369 xfrm_put_type(x->
type);
371 security_xfrm_state_free(x);
375 static void xfrm_state_gc_task(
struct work_struct *work)
377 struct net *net =
container_of(work,
struct net, xfrm.state_gc_work);
382 spin_lock_bh(&xfrm_state_gc_lock);
383 hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
384 spin_unlock_bh(&xfrm_state_gc_lock);
387 xfrm_state_gc_destroy(x);
392 static
inline unsigned long make_jiffies(
long secs)
404 struct net *net = xs_net(x);
415 if (x->
lft.hard_add_expires_seconds) {
416 long tmo = x->
lft.hard_add_expires_seconds +
432 if (x->
lft.hard_use_expires_seconds) {
433 long tmo = x->
lft.hard_use_expires_seconds +
434 (x->
curlft.use_time ? : now) - now;
442 if (x->
lft.soft_add_expires_seconds) {
443 long tmo = x->
lft.soft_add_expires_seconds +
448 }
else if (tmo < next) {
454 if (x->
lft.soft_use_expires_seconds) {
455 long tmo = x->
lft.soft_use_expires_seconds +
456 (x->
curlft.use_time ? : now) - now;
482 if (!err && x->
id.spi)
485 xfrm_audit_state_delete(x, err ? 0 : 1,
487 audit_get_sessionid(
current), 0);
490 spin_unlock(&x->
lock);
494 static void xfrm_replay_timer_handler(
unsigned long data);
506 INIT_LIST_HEAD(&x->
km.all);
507 INIT_HLIST_NODE(&x->
bydst);
508 INIT_HLIST_NODE(&x->
bysrc);
509 INIT_HLIST_NODE(&x->
byspi);
515 x->lft.soft_packet_limit =
XFRM_INF;
517 x->lft.hard_packet_limit =
XFRM_INF;
518 x->replay_maxage = 0;
519 x->replay_maxdiff = 0;
520 x->inner_mode =
NULL;
521 x->inner_mode_iaf =
NULL;
530 struct net *net = xs_net(x);
534 spin_lock_bh(&xfrm_state_gc_lock);
535 hlist_add_head(&x->
gclist, &net->xfrm.state_gc_list);
536 spin_unlock_bh(&xfrm_state_gc_lock);
543 struct net *net = xs_net(x);
548 spin_lock(&xfrm_state_lock);
550 hlist_del(&x->
bydst);
551 hlist_del(&x->
bysrc);
553 hlist_del(&x->
byspi);
554 net->xfrm.state_num--;
555 spin_unlock(&xfrm_state_lock);
573 spin_lock_bh(&x->
lock);
575 spin_unlock_bh(&x->
lock);
581 #ifdef CONFIG_SECURITY_NETWORK_XFRM
583 xfrm_state_flush_secctx_check(
struct net *net,
u8 proto,
struct xfrm_audit *audit_info)
587 for (i = 0; i <= net->xfrm.state_hmask; i++) {
592 if (xfrm_id_proto_match(x->
id.proto, proto) &&
593 (err = security_xfrm_state_delete(x)) != 0) {
594 xfrm_audit_state_delete(x, 0,
607 xfrm_state_flush_secctx_check(
struct net *net,
u8 proto,
struct xfrm_audit *audit_info)
615 int i, err = 0,
cnt = 0;
617 spin_lock_bh(&xfrm_state_lock);
618 err = xfrm_state_flush_secctx_check(net, proto, audit_info);
623 for (i = 0; i <= net->xfrm.state_hmask; i++) {
628 if (!xfrm_state_kern(x) &&
629 xfrm_id_proto_match(x->
id.proto, proto)) {
631 spin_unlock_bh(&xfrm_state_lock);
634 xfrm_audit_state_delete(x, err ? 0 : 1,
642 spin_lock_bh(&xfrm_state_lock);
651 spin_unlock_bh(&xfrm_state_lock);
659 spin_lock_bh(&xfrm_state_lock);
660 si->
sadcnt = net->xfrm.state_num;
661 si->
sadhcnt = net->xfrm.state_hmask;
663 spin_unlock_bh(&xfrm_state_lock);
671 unsigned short family)
673 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
679 xfrm_state_put_afinfo(afinfo);
685 xfrm_state_put_afinfo(afinfo);
692 unsigned short family)
694 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
699 if (x->
props.family != family ||
701 x->
id.proto != proto ||
702 xfrm_addr_cmp(&x->
id.daddr, daddr, family))
705 if ((mark & x->
mark.m) != x->
mark.v)
714 static struct xfrm_state *__xfrm_state_lookup_byaddr(
struct net *net,
u32 mark,
717 u8 proto,
unsigned short family)
719 unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
724 if (x->
props.family != family ||
725 x->
id.proto != proto ||
726 xfrm_addr_cmp(&x->
id.daddr, daddr, family) ||
727 xfrm_addr_cmp(&x->
props.saddr, saddr, family))
730 if ((mark & x->
mark.m) != x->
mark.v)
740 __xfrm_state_locate(
struct xfrm_state *x,
int use_spi,
int family)
742 struct net *net = xs_net(x);
746 return __xfrm_state_lookup(net, mark, &x->
id.daddr,
747 x->
id.spi, x->
id.proto, family);
749 return __xfrm_state_lookup_byaddr(net, mark,
752 x->
id.proto, family);
755 static void xfrm_hash_grow_check(
struct net *net,
int have_hash_collision)
757 if (have_hash_collision &&
758 (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
759 net->xfrm.state_num > net->xfrm.state_hmask)
764 const struct flowi *fl,
unsigned short family,
765 struct xfrm_state **best,
int *acq_in_progress,
780 if ((x->
sel.family &&
782 !security_xfrm_state_pol_flow_match(x, pol, fl))
786 (*best)->
km.dying > x->
km.dying ||
787 ((*best)->km.dying == x->
km.dying &&
788 (*best)->curlft.add_time < x->
curlft.add_time))
791 *acq_in_progress = 1;
795 security_xfrm_state_pol_flow_match(x, pol, fl))
804 unsigned short family)
807 struct net *net = xp_net(pol);
808 unsigned int h, h_wildcard;
811 int acquire_in_progress = 0;
819 spin_lock_bh(&xfrm_state_lock);
820 h = xfrm_dst_hash(net, daddr, saddr, tmpl->
reqid, encap_family);
822 if (x->
props.family == encap_family &&
826 xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
828 tmpl->
id.proto == x->
id.proto &&
829 (tmpl->
id.spi == x->
id.spi || !tmpl->
id.spi))
830 xfrm_state_look_at(pol, x, fl, encap_family,
831 &best, &acquire_in_progress, &error);
836 h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->
reqid, encap_family);
838 if (x->
props.family == encap_family &&
842 xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
844 tmpl->
id.proto == x->
id.proto &&
845 (tmpl->
id.spi == x->
id.spi || !tmpl->
id.spi))
846 xfrm_state_look_at(pol, x, fl, encap_family,
847 &best, &acquire_in_progress, &error);
852 if (!x && !error && !acquire_in_progress) {
854 (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->
id.spi,
855 tmpl->
id.proto, encap_family)) !=
NULL) {
867 xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
870 error = security_xfrm_state_alloc_acquire(x, pol->
security, fl->flowi_secid);
880 list_add(&x->
km.all, &net->xfrm.state_all);
881 hlist_add_head(&x->
bydst, net->xfrm.state_bydst+h);
882 h = xfrm_src_hash(net, daddr, saddr, encap_family);
883 hlist_add_head(&x->
bysrc, net->xfrm.state_bysrc+h);
885 h = xfrm_spi_hash(net, &x->
id.daddr, x->
id.spi, x->
id.proto, encap_family);
886 hlist_add_head(&x->
byspi, net->xfrm.state_byspi+h);
888 x->
lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
890 net->xfrm.state_num++;
891 xfrm_hash_grow_check(net, x->
bydst.next !=
NULL);
904 spin_unlock_bh(&xfrm_state_lock);
906 xfrm_state_put(to_put);
919 spin_lock(&xfrm_state_lock);
920 h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
922 if (x->props.family == family &&
923 x->props.reqid == reqid &&
924 (mark & x->mark.m) == x->mark.v &&
926 xfrm_state_addr_check(x, daddr, saddr, family) &&
927 mode == x->props.mode &&
928 proto == x->id.proto &&
937 spin_unlock(&xfrm_state_lock);
944 static void __xfrm_state_insert(
struct xfrm_state *x)
946 struct net *net = xs_net(x);
949 list_add(&x->
km.all, &net->xfrm.state_all);
951 h = xfrm_dst_hash(net, &x->
id.daddr, &x->
props.saddr,
953 hlist_add_head(&x->
bydst, net->xfrm.state_bydst+h);
955 h = xfrm_src_hash(net, &x->
id.daddr, &x->
props.saddr, x->
props.family);
956 hlist_add_head(&x->
bysrc, net->xfrm.state_bysrc+h);
959 h = xfrm_spi_hash(net, &x->
id.daddr, x->
id.spi, x->
id.proto,
962 hlist_add_head(&x->
byspi, net->xfrm.state_byspi+h);
971 net->xfrm.state_num++;
973 xfrm_hash_grow_check(net, x->
bydst.next !=
NULL);
977 static void __xfrm_state_bump_genids(
struct xfrm_state *xnew)
979 struct net *net = xs_net(xnew);
980 unsigned short family = xnew->
props.family;
987 h = xfrm_dst_hash(net, &xnew->
id.daddr, &xnew->
props.saddr, reqid, family);
989 if (x->
props.family == family &&
990 x->
props.reqid == reqid &&
992 !xfrm_addr_cmp(&x->
id.daddr, &xnew->
id.daddr, family) &&
993 !xfrm_addr_cmp(&x->
props.saddr, &xnew->
props.saddr, family))
1000 spin_lock_bh(&xfrm_state_lock);
1001 __xfrm_state_bump_genids(x);
1002 __xfrm_state_insert(x);
1003 spin_unlock_bh(&xfrm_state_lock);
1009 unsigned short family,
u8 mode,
1010 u32 reqid,
u8 proto,
1014 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
1017 u32 mark = m->
v & m->
m;
1020 if (x->
props.reqid != reqid ||
1021 x->
props.mode != mode ||
1022 x->
props.family != family ||
1025 x->
id.proto != proto ||
1027 xfrm_addr_cmp(&x->
id.daddr, daddr, family) ||
1028 xfrm_addr_cmp(&x->
props.saddr, saddr, family))
1042 x->
sel.daddr.a4 = daddr->
a4;
1043 x->
sel.saddr.a4 = saddr->
a4;
1044 x->
sel.prefixlen_d = 32;
1045 x->
sel.prefixlen_s = 32;
1046 x->
props.saddr.a4 = saddr->
a4;
1047 x->
id.daddr.a4 = daddr->
a4;
1053 x->
sel.prefixlen_d = 128;
1054 x->
sel.prefixlen_s = 128;
1064 x->
props.reqid = reqid;
1067 x->
lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
1070 list_add(&x->
km.all, &net->xfrm.state_all);
1071 hlist_add_head(&x->
bydst, net->xfrm.state_bydst+h);
1072 h = xfrm_src_hash(net, daddr, saddr, family);
1073 hlist_add_head(&x->
bysrc, net->xfrm.state_bysrc+h);
1075 net->xfrm.state_num++;
1077 xfrm_hash_grow_check(net, x->
bydst.next !=
NULL);
1083 static struct xfrm_state *__xfrm_find_acq_byseq(
struct net *net,
u32 mark,
u32 seq);
1087 struct net *net = xs_net(x);
1094 family = x->
props.family;
1098 spin_lock_bh(&xfrm_state_lock);
1100 x1 = __xfrm_state_locate(x, use_spi, family);
1108 if (use_spi && x->
km.seq) {
1109 x1 = __xfrm_find_acq_byseq(net, mark, x->
km.seq);
1110 if (x1 && ((x1->
id.proto != x->
id.proto) ||
1111 xfrm_addr_cmp(&x1->
id.daddr, &x->
id.daddr, family))) {
1118 x1 = __find_acq_core(net, &x->
mark, family, x->
props.mode,
1120 &x->
id.daddr, &x->
props.saddr, 0);
1122 __xfrm_state_bump_genids(x);
1123 __xfrm_state_insert(x);
1127 spin_unlock_bh(&xfrm_state_lock);
1135 xfrm_state_put(to_put);
1141 #ifdef CONFIG_XFRM_MIGRATE
1144 struct net *net = xs_net(orig);
1154 x->
props.replay_window = orig->
props.replay_window;
1160 x->
aalg = xfrm_algo_auth_clone(orig->
aalg);
1167 x->
ealg = xfrm_algo_clone(orig->
ealg);
1174 x->
calg = xfrm_algo_clone(orig->
calg);
1194 err = xfrm_replay_clone(x, orig);
1208 x->
km.state = orig->
km.state;
1209 x->
km.seq = orig->
km.seq;
1272 xc = xfrm_state_clone(x, &err);
1305 spin_lock_bh(&xfrm_state_lock);
1306 x1 = __xfrm_state_locate(x, use_spi, x->
props.family);
1312 if (xfrm_state_kern(x1)) {
1319 __xfrm_state_insert(x);
1325 spin_unlock_bh(&xfrm_state_lock);
1328 xfrm_state_put(to_put);
1340 spin_lock_bh(&x1->
lock);
1358 __xfrm_state_put(x);
1360 spin_unlock_bh(&x1->
lock);
1376 if (x->
curlft.bytes >= x->
lft.hard_byte_limit ||
1377 x->
curlft.packets >= x->
lft.hard_packet_limit) {
1384 (x->
curlft.bytes >= x->
lft.soft_byte_limit ||
1385 x->
curlft.packets >= x->
lft.soft_packet_limit)) {
1395 u8 proto,
unsigned short family)
1399 spin_lock_bh(&xfrm_state_lock);
1400 x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
1401 spin_unlock_bh(&xfrm_state_lock);
1409 u8 proto,
unsigned short family)
1413 spin_lock_bh(&xfrm_state_lock);
1414 x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
1415 spin_unlock_bh(&xfrm_state_lock);
1423 int create,
unsigned short family)
1427 spin_lock_bh(&xfrm_state_lock);
1428 x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create);
1429 spin_unlock_bh(&xfrm_state_lock);
1435 #ifdef CONFIG_XFRM_SUB_POLICY
1438 unsigned short family)
1441 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1445 spin_lock_bh(&xfrm_state_lock);
1448 spin_unlock_bh(&xfrm_state_lock);
1449 xfrm_state_put_afinfo(afinfo);
1456 unsigned short family)
1459 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1463 spin_lock_bh(&xfrm_state_lock);
1466 spin_unlock_bh(&xfrm_state_lock);
1467 xfrm_state_put_afinfo(afinfo);
1475 static struct xfrm_state *__xfrm_find_acq_byseq(
struct net *net,
u32 mark,
u32 seq)
1479 for (i = 0; i <= net->xfrm.state_hmask; i++) {
1484 if (x->
km.seq == seq &&
1499 spin_lock_bh(&xfrm_state_lock);
1500 x = __xfrm_find_acq_byseq(net, mark, seq);
1501 spin_unlock_bh(&xfrm_state_lock);
1521 struct net *net = xs_net(x);
1529 spin_lock_bh(&x->
lock);
1539 if (minspi == maxspi) {
1548 for (h=0; h<high-low+1; h++) {
1559 spin_lock_bh(&xfrm_state_lock);
1560 h = xfrm_spi_hash(net, &x->
id.daddr, x->
id.spi, x->
id.proto, x->
props.family);
1561 hlist_add_head(&x->
byspi, net->xfrm.state_byspi+h);
1562 spin_unlock_bh(&xfrm_state_lock);
1568 spin_unlock_bh(&x->
lock);
1582 if (walk->
seq != 0 && list_empty(&walk->
all))
1585 spin_lock_bh(&xfrm_state_lock);
1586 if (list_empty(&walk->
all))
1594 if (!xfrm_id_proto_match(state->
id.proto, walk->
proto))
1596 err =
func(state, walk->
seq, data);
1598 list_move_tail(&walk->
all, &x->
all);
1603 if (walk->
seq == 0) {
1607 list_del_init(&walk->
all);
1609 spin_unlock_bh(&xfrm_state_lock);
1616 INIT_LIST_HEAD(&walk->
all);
1625 if (list_empty(&walk->
all))
1628 spin_lock_bh(&xfrm_state_lock);
1630 spin_unlock_bh(&xfrm_state_lock);
1634 static void xfrm_replay_timer_handler(
unsigned long data)
1638 spin_lock(&x->
lock);
1641 if (xfrm_aevent_is_on(xs_net(x)))
1647 spin_unlock(&x->
lock);
1679 struct net *net = xs_net(x);
1698 int err = -
EINVAL, acqret;
1703 acqret = km->
acquire(x, t, pol);
1731 struct net *net = xp_net(pol);
1744 #ifdef CONFIG_XFRM_MIGRATE
1756 ret = km->
migrate(sel, dir, type, m, num_migrate, k);
1776 ret = km->
report(net, proto, sel, addr);
1855 xfrm_state_afinfo[afinfo->
family] = afinfo;
1880 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(
unsigned int family)
1882 struct xfrm_state_afinfo *afinfo;
1886 afinfo = xfrm_state_afinfo[
family];
1892 static void xfrm_state_put_afinfo(
struct xfrm_state_afinfo *afinfo)
1917 spin_lock_bh(&x->
lock);
1920 res = x->
type->get_mtu(x, mtu);
1922 res = mtu - x->
props.header_len;
1923 spin_unlock_bh(&x->
lock);
1929 struct xfrm_state_afinfo *afinfo;
1931 int family = x->
props.family;
1935 afinfo = xfrm_state_get_afinfo(family);
1943 xfrm_state_put_afinfo(afinfo);
1951 inner_mode = xfrm_get_mode(x->
props.mode, x->
sel.family);
1952 if (inner_mode ==
NULL)
1956 family != x->
sel.family) {
1957 xfrm_put_mode(inner_mode);
1966 inner_mode = xfrm_get_mode(x->
props.mode, x->
props.family);
1967 if (inner_mode ==
NULL)
1971 xfrm_put_mode(inner_mode);
1979 inner_mode_iaf = xfrm_get_mode(x->
props.mode, iafamily);
1980 if (inner_mode_iaf) {
1984 xfrm_put_mode(inner_mode_iaf);
1988 x->
type = xfrm_get_type(x->
id.proto, family);
1992 err = x->
type->init_state(x);
2027 INIT_LIST_HEAD(&net->xfrm.state_all);
2032 if (!net->xfrm.state_bydst)
2035 if (!net->xfrm.state_bysrc)
2038 if (!net->xfrm.state_byspi)
2040 net->xfrm.state_hmask = ((sz /
sizeof(
struct hlist_head)) - 1);
2042 net->xfrm.state_num = 0;
2043 INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
2045 INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
2065 audit_info.
secid = 0;
2069 WARN_ON(!list_empty(&net->xfrm.state_all));
2071 sz = (net->xfrm.state_hmask + 1) *
sizeof(
struct hlist_head);
2072 WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2074 WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2076 WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2080 #ifdef CONFIG_AUDITSYSCALL
2081 static void xfrm_audit_helper_sainfo(
struct xfrm_state *x,
2091 switch(x->
props.family) {
2094 &x->
props.saddr.a4, &x->
id.daddr.a4);
2098 x->
props.saddr.a6, x->
id.daddr.a6);
2105 static void xfrm_audit_helper_pktinfo(
struct sk_buff *
skb,
u16 family,
2108 const struct iphdr *iph4;
2118 iph6 = ipv6_hdr(skb);
2120 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2134 audit_buf = xfrm_audit_start(
"SAD-add");
2135 if (audit_buf ==
NULL)
2137 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2138 xfrm_audit_helper_sainfo(x, audit_buf);
2144 void xfrm_audit_state_delete(
struct xfrm_state *x,
int result,
2149 audit_buf = xfrm_audit_start(
"SAD-delete");
2150 if (audit_buf ==
NULL)
2152 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2153 xfrm_audit_helper_sainfo(x, audit_buf);
2159 void xfrm_audit_state_replay_overflow(
struct xfrm_state *x,
2165 audit_buf = xfrm_audit_start(
"SA-replay-overflow");
2166 if (audit_buf ==
NULL)
2168 xfrm_audit_helper_pktinfo(skb, x->
props.family, audit_buf);
2177 void xfrm_audit_state_replay(
struct xfrm_state *x,
2183 audit_buf = xfrm_audit_start(
"SA-replayed-pkt");
2184 if (audit_buf ==
NULL)
2186 xfrm_audit_helper_pktinfo(skb, x->
props.family, audit_buf);
2189 spi, spi,
ntohl(net_seq));
2194 void xfrm_audit_state_notfound_simple(
struct sk_buff *skb,
u16 family)
2198 audit_buf = xfrm_audit_start(
"SA-notfound");
2199 if (audit_buf ==
NULL)
2201 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2206 void xfrm_audit_state_notfound(
struct sk_buff *skb,
u16 family,
2212 audit_buf = xfrm_audit_start(
"SA-notfound");
2213 if (audit_buf ==
NULL)
2215 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2216 spi =
ntohl(net_spi);
2218 spi, spi,
ntohl(net_seq));
2223 void xfrm_audit_state_icvfail(
struct xfrm_state *x,
2230 audit_buf = xfrm_audit_start(
"SA-icv-failure");
2231 if (audit_buf ==
NULL)
2233 xfrm_audit_helper_pktinfo(skb, x->
props.family, audit_buf);
2237 spi, spi,
ntohl(net_seq));