blob: 9895a8c56d8c2675393e1aad3a1a438e16d4d47c [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm_state.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
Trent Jaegerdf718372005-12-13 23:12:27 -080013 *
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 */
15
16#include <linux/workqueue.h>
17#include <net/xfrm.h>
18#include <linux/pfkeyv2.h>
19#include <linux/ipsec.h>
20#include <linux/module.h>
David S. Millerf034b5d2006-08-24 03:08:07 -070021#include <linux/cache.h>
Paul Moore68277ac2007-12-20 20:49:33 -080022#include <linux/audit.h>
Jesper Juhlb5890d82007-08-10 15:20:21 -070023#include <asm/uaccess.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080024#include <linux/ktime.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090025#include <linux/slab.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080026#include <linux/interrupt.h>
27#include <linux/kernel.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028
David S. Miller44e36b42006-08-24 04:50:50 -070029#include "xfrm_hash.h"
30
Linus Torvalds1da177e2005-04-16 15:20:36 -070031/* Each xfrm_state may be linked to two tables:
32
33 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
David S. Millera624c102006-08-24 03:24:33 -070034 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
Linus Torvalds1da177e2005-04-16 15:20:36 -070035 destination/tunnel endpoint. (output)
36 */
37
David S. Millerf034b5d2006-08-24 03:08:07 -070038static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
Linus Torvalds1da177e2005-04-16 15:20:36 -070039
Alexey Dobriyan64d0cd02008-11-25 17:29:21 -080040static inline unsigned int xfrm_dst_hash(struct net *net,
David S. Miller2ab38502011-02-24 01:47:16 -050041 const xfrm_address_t *daddr,
42 const xfrm_address_t *saddr,
David S. Millerc1969f22006-08-24 04:00:03 -070043 u32 reqid,
David S. Millera624c102006-08-24 03:24:33 -070044 unsigned short family)
45{
Alexey Dobriyan64d0cd02008-11-25 17:29:21 -080046 return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
David S. Millera624c102006-08-24 03:24:33 -070047}
48
Alexey Dobriyan64d0cd02008-11-25 17:29:21 -080049static inline unsigned int xfrm_src_hash(struct net *net,
David S. Miller2ab38502011-02-24 01:47:16 -050050 const xfrm_address_t *daddr,
51 const xfrm_address_t *saddr,
David S. Miller44e36b42006-08-24 04:50:50 -070052 unsigned short family)
David S. Millerf034b5d2006-08-24 03:08:07 -070053{
Alexey Dobriyan64d0cd02008-11-25 17:29:21 -080054 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
David S. Millerf034b5d2006-08-24 03:08:07 -070055}
56
David S. Miller2575b652006-08-24 03:26:44 -070057static inline unsigned int
David S. Miller2ab38502011-02-24 01:47:16 -050058xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr,
59 __be32 spi, u8 proto, unsigned short family)
David S. Millerf034b5d2006-08-24 03:08:07 -070060{
Alexey Dobriyan64d0cd02008-11-25 17:29:21 -080061 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
David S. Millerf034b5d2006-08-24 03:08:07 -070062}
63
David S. Millerf034b5d2006-08-24 03:08:07 -070064static void xfrm_hash_transfer(struct hlist_head *list,
65 struct hlist_head *ndsttable,
66 struct hlist_head *nsrctable,
67 struct hlist_head *nspitable,
68 unsigned int nhashmask)
69{
Sasha Levinb67bfe02013-02-27 17:06:00 -080070 struct hlist_node *tmp;
David S. Millerf034b5d2006-08-24 03:08:07 -070071 struct xfrm_state *x;
72
Sasha Levinb67bfe02013-02-27 17:06:00 -080073 hlist_for_each_entry_safe(x, tmp, list, bydst) {
David S. Millerf034b5d2006-08-24 03:08:07 -070074 unsigned int h;
75
David S. Millerc1969f22006-08-24 04:00:03 -070076 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
77 x->props.reqid, x->props.family,
78 nhashmask);
David S. Millerf034b5d2006-08-24 03:08:07 -070079 hlist_add_head(&x->bydst, ndsttable+h);
80
Masahide NAKAMURA667bbcb2006-10-03 15:56:09 -070081 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
82 x->props.family,
David S. Millerf034b5d2006-08-24 03:08:07 -070083 nhashmask);
84 hlist_add_head(&x->bysrc, nsrctable+h);
85
Masahide NAKAMURA7b4dc3602006-09-27 22:21:52 -070086 if (x->id.spi) {
87 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
88 x->id.proto, x->props.family,
89 nhashmask);
90 hlist_add_head(&x->byspi, nspitable+h);
91 }
David S. Millerf034b5d2006-08-24 03:08:07 -070092 }
93}
94
Alexey Dobriyan63082732008-11-25 17:19:07 -080095static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
David S. Millerf034b5d2006-08-24 03:08:07 -070096{
Alexey Dobriyan63082732008-11-25 17:19:07 -080097 return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
David S. Millerf034b5d2006-08-24 03:08:07 -070098}
99
Alexey Dobriyan63082732008-11-25 17:19:07 -0800100static void xfrm_hash_resize(struct work_struct *work)
David S. Millerf034b5d2006-08-24 03:08:07 -0700101{
Alexey Dobriyan63082732008-11-25 17:19:07 -0800102 struct net *net = container_of(work, struct net, xfrm.state_hash_work);
David S. Millerf034b5d2006-08-24 03:08:07 -0700103 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
104 unsigned long nsize, osize;
105 unsigned int nhashmask, ohashmask;
106 int i;
107
Alexey Dobriyan63082732008-11-25 17:19:07 -0800108 nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
David S. Miller44e36b42006-08-24 04:50:50 -0700109 ndst = xfrm_hash_alloc(nsize);
David S. Millerf034b5d2006-08-24 03:08:07 -0700110 if (!ndst)
Ying Xue02447902014-08-29 17:09:07 +0800111 return;
David S. Miller44e36b42006-08-24 04:50:50 -0700112 nsrc = xfrm_hash_alloc(nsize);
David S. Millerf034b5d2006-08-24 03:08:07 -0700113 if (!nsrc) {
David S. Miller44e36b42006-08-24 04:50:50 -0700114 xfrm_hash_free(ndst, nsize);
Ying Xue02447902014-08-29 17:09:07 +0800115 return;
David S. Millerf034b5d2006-08-24 03:08:07 -0700116 }
David S. Miller44e36b42006-08-24 04:50:50 -0700117 nspi = xfrm_hash_alloc(nsize);
David S. Millerf034b5d2006-08-24 03:08:07 -0700118 if (!nspi) {
David S. Miller44e36b42006-08-24 04:50:50 -0700119 xfrm_hash_free(ndst, nsize);
120 xfrm_hash_free(nsrc, nsize);
Ying Xue02447902014-08-29 17:09:07 +0800121 return;
David S. Millerf034b5d2006-08-24 03:08:07 -0700122 }
123
Fan Du283bc9f2013-11-07 17:47:50 +0800124 spin_lock_bh(&net->xfrm.xfrm_state_lock);
David S. Millerf034b5d2006-08-24 03:08:07 -0700125
126 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
Alexey Dobriyan63082732008-11-25 17:19:07 -0800127 for (i = net->xfrm.state_hmask; i >= 0; i--)
128 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
David S. Millerf034b5d2006-08-24 03:08:07 -0700129 nhashmask);
130
Alexey Dobriyan63082732008-11-25 17:19:07 -0800131 odst = net->xfrm.state_bydst;
132 osrc = net->xfrm.state_bysrc;
133 ospi = net->xfrm.state_byspi;
134 ohashmask = net->xfrm.state_hmask;
David S. Millerf034b5d2006-08-24 03:08:07 -0700135
Alexey Dobriyan63082732008-11-25 17:19:07 -0800136 net->xfrm.state_bydst = ndst;
137 net->xfrm.state_bysrc = nsrc;
138 net->xfrm.state_byspi = nspi;
139 net->xfrm.state_hmask = nhashmask;
David S. Millerf034b5d2006-08-24 03:08:07 -0700140
Fan Du283bc9f2013-11-07 17:47:50 +0800141 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
David S. Millerf034b5d2006-08-24 03:08:07 -0700142
143 osize = (ohashmask + 1) * sizeof(struct hlist_head);
David S. Miller44e36b42006-08-24 04:50:50 -0700144 xfrm_hash_free(odst, osize);
145 xfrm_hash_free(osrc, osize);
146 xfrm_hash_free(ospi, osize);
David S. Millerf034b5d2006-08-24 03:08:07 -0700147}
148
Cong Wang44abdc32013-01-16 16:05:05 +0800149static DEFINE_SPINLOCK(xfrm_state_afinfo_lock);
150static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700151
Linus Torvalds1da177e2005-04-16 15:20:36 -0700152static DEFINE_SPINLOCK(xfrm_state_gc_lock);
153
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800154int __xfrm_state_delete(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700155
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800156int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Horia Geanta0f245582014-02-12 16:20:06 +0200157bool km_is_alive(const struct km_event *c);
Eric W. Biederman15e47302012-09-07 20:12:54 +0000158void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700159
Cong Wang7a9885b2013-01-17 16:34:11 +0800160static DEFINE_SPINLOCK(xfrm_type_lock);
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800161int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700162{
Cong Wang7a9885b2013-01-17 16:34:11 +0800163 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800164 const struct xfrm_type **typemap;
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700165 int err = 0;
166
167 if (unlikely(afinfo == NULL))
168 return -EAFNOSUPPORT;
169 typemap = afinfo->type_map;
Cong Wang7a9885b2013-01-17 16:34:11 +0800170 spin_lock_bh(&xfrm_type_lock);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700171
172 if (likely(typemap[type->proto] == NULL))
173 typemap[type->proto] = type;
174 else
175 err = -EEXIST;
Cong Wang7a9885b2013-01-17 16:34:11 +0800176 spin_unlock_bh(&xfrm_type_lock);
177 xfrm_state_put_afinfo(afinfo);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700178 return err;
179}
180EXPORT_SYMBOL(xfrm_register_type);
181
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800182int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700183{
Cong Wang7a9885b2013-01-17 16:34:11 +0800184 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800185 const struct xfrm_type **typemap;
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700186 int err = 0;
187
188 if (unlikely(afinfo == NULL))
189 return -EAFNOSUPPORT;
190 typemap = afinfo->type_map;
Cong Wang7a9885b2013-01-17 16:34:11 +0800191 spin_lock_bh(&xfrm_type_lock);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700192
193 if (unlikely(typemap[type->proto] != type))
194 err = -ENOENT;
195 else
196 typemap[type->proto] = NULL;
Cong Wang7a9885b2013-01-17 16:34:11 +0800197 spin_unlock_bh(&xfrm_type_lock);
198 xfrm_state_put_afinfo(afinfo);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700199 return err;
200}
201EXPORT_SYMBOL(xfrm_unregister_type);
202
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800203static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700204{
205 struct xfrm_state_afinfo *afinfo;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800206 const struct xfrm_type **typemap;
207 const struct xfrm_type *type;
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700208 int modload_attempted = 0;
209
210retry:
211 afinfo = xfrm_state_get_afinfo(family);
212 if (unlikely(afinfo == NULL))
213 return NULL;
214 typemap = afinfo->type_map;
215
216 type = typemap[proto];
217 if (unlikely(type && !try_module_get(type->owner)))
218 type = NULL;
219 if (!type && !modload_attempted) {
220 xfrm_state_put_afinfo(afinfo);
221 request_module("xfrm-type-%d-%d", family, proto);
222 modload_attempted = 1;
223 goto retry;
224 }
225
226 xfrm_state_put_afinfo(afinfo);
227 return type;
228}
229
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800230static void xfrm_put_type(const struct xfrm_type *type)
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700231{
232 module_put(type->owner);
233}
234
Cong Wang7a9885b2013-01-17 16:34:11 +0800235static DEFINE_SPINLOCK(xfrm_mode_lock);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700236int xfrm_register_mode(struct xfrm_mode *mode, int family)
237{
238 struct xfrm_state_afinfo *afinfo;
239 struct xfrm_mode **modemap;
240 int err;
241
242 if (unlikely(mode->encap >= XFRM_MODE_MAX))
243 return -EINVAL;
244
Cong Wang7a9885b2013-01-17 16:34:11 +0800245 afinfo = xfrm_state_get_afinfo(family);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700246 if (unlikely(afinfo == NULL))
247 return -EAFNOSUPPORT;
248
249 err = -EEXIST;
250 modemap = afinfo->mode_map;
Cong Wang7a9885b2013-01-17 16:34:11 +0800251 spin_lock_bh(&xfrm_mode_lock);
Herbert Xu17c2a422007-10-17 21:33:12 -0700252 if (modemap[mode->encap])
253 goto out;
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700254
Herbert Xu17c2a422007-10-17 21:33:12 -0700255 err = -ENOENT;
256 if (!try_module_get(afinfo->owner))
257 goto out;
258
259 mode->afinfo = afinfo;
260 modemap[mode->encap] = mode;
261 err = 0;
262
263out:
Cong Wang7a9885b2013-01-17 16:34:11 +0800264 spin_unlock_bh(&xfrm_mode_lock);
265 xfrm_state_put_afinfo(afinfo);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700266 return err;
267}
268EXPORT_SYMBOL(xfrm_register_mode);
269
270int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
271{
272 struct xfrm_state_afinfo *afinfo;
273 struct xfrm_mode **modemap;
274 int err;
275
276 if (unlikely(mode->encap >= XFRM_MODE_MAX))
277 return -EINVAL;
278
Cong Wang7a9885b2013-01-17 16:34:11 +0800279 afinfo = xfrm_state_get_afinfo(family);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700280 if (unlikely(afinfo == NULL))
281 return -EAFNOSUPPORT;
282
283 err = -ENOENT;
284 modemap = afinfo->mode_map;
Cong Wang7a9885b2013-01-17 16:34:11 +0800285 spin_lock_bh(&xfrm_mode_lock);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700286 if (likely(modemap[mode->encap] == mode)) {
287 modemap[mode->encap] = NULL;
Herbert Xu17c2a422007-10-17 21:33:12 -0700288 module_put(mode->afinfo->owner);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700289 err = 0;
290 }
291
Cong Wang7a9885b2013-01-17 16:34:11 +0800292 spin_unlock_bh(&xfrm_mode_lock);
293 xfrm_state_put_afinfo(afinfo);
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700294 return err;
295}
296EXPORT_SYMBOL(xfrm_unregister_mode);
297
298static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
299{
300 struct xfrm_state_afinfo *afinfo;
301 struct xfrm_mode *mode;
302 int modload_attempted = 0;
303
304 if (unlikely(encap >= XFRM_MODE_MAX))
305 return NULL;
306
307retry:
308 afinfo = xfrm_state_get_afinfo(family);
309 if (unlikely(afinfo == NULL))
310 return NULL;
311
312 mode = afinfo->mode_map[encap];
313 if (unlikely(mode && !try_module_get(mode->owner)))
314 mode = NULL;
315 if (!mode && !modload_attempted) {
316 xfrm_state_put_afinfo(afinfo);
317 request_module("xfrm-mode-%d-%d", family, encap);
318 modload_attempted = 1;
319 goto retry;
320 }
321
322 xfrm_state_put_afinfo(afinfo);
323 return mode;
324}
325
326static void xfrm_put_mode(struct xfrm_mode *mode)
327{
328 module_put(mode->owner);
329}
330
Linus Torvalds1da177e2005-04-16 15:20:36 -0700331static void xfrm_state_gc_destroy(struct xfrm_state *x)
332{
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800333 tasklet_hrtimer_cancel(&x->mtimer);
David S. Millera47f0ce2006-08-24 03:54:22 -0700334 del_timer_sync(&x->rtimer);
Jesper Juhla51482b2005-11-08 09:41:34 -0800335 kfree(x->aalg);
336 kfree(x->ealg);
337 kfree(x->calg);
338 kfree(x->encap);
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700339 kfree(x->coaddr);
Steffen Klassertd8647b72011-03-08 00:10:27 +0000340 kfree(x->replay_esn);
341 kfree(x->preplay_esn);
Herbert Xu13996372007-10-17 21:35:51 -0700342 if (x->inner_mode)
343 xfrm_put_mode(x->inner_mode);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700344 if (x->inner_mode_iaf)
345 xfrm_put_mode(x->inner_mode_iaf);
Herbert Xu13996372007-10-17 21:35:51 -0700346 if (x->outer_mode)
347 xfrm_put_mode(x->outer_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700348 if (x->type) {
349 x->type->destructor(x);
350 xfrm_put_type(x->type);
351 }
Trent Jaegerdf718372005-12-13 23:12:27 -0800352 security_xfrm_state_free(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353 kfree(x);
354}
355
Alexey Dobriyanc7837142008-11-25 17:20:36 -0800356static void xfrm_state_gc_task(struct work_struct *work)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700357{
Alexey Dobriyanc7837142008-11-25 17:20:36 -0800358 struct net *net = container_of(work, struct net, xfrm.state_gc_work);
Herbert Xu12a169e2008-10-01 07:03:24 -0700359 struct xfrm_state *x;
Sasha Levinb67bfe02013-02-27 17:06:00 -0800360 struct hlist_node *tmp;
Herbert Xu12a169e2008-10-01 07:03:24 -0700361 struct hlist_head gc_list;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362
Linus Torvalds1da177e2005-04-16 15:20:36 -0700363 spin_lock_bh(&xfrm_state_gc_lock);
Alexey Dobriyanc7837142008-11-25 17:20:36 -0800364 hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700365 spin_unlock_bh(&xfrm_state_gc_lock);
366
Sasha Levinb67bfe02013-02-27 17:06:00 -0800367 hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700368 xfrm_state_gc_destroy(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369}
370
371static inline unsigned long make_jiffies(long secs)
372{
373 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
374 return MAX_SCHEDULE_TIMEOUT-1;
375 else
YOSHIFUJI Hideakia716c112007-02-09 23:25:29 +0900376 return secs*HZ;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700377}
378
Weilong Chen3e94c2d2013-12-24 09:43:47 +0800379static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700380{
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800381 struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer);
382 struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer);
James Morris9d729f72007-03-04 16:12:44 -0800383 unsigned long now = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384 long next = LONG_MAX;
385 int warn = 0;
Joy Latten161a09e2006-11-27 13:11:54 -0600386 int err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700387
388 spin_lock(&x->lock);
389 if (x->km.state == XFRM_STATE_DEAD)
390 goto out;
391 if (x->km.state == XFRM_STATE_EXPIRED)
392 goto expired;
393 if (x->lft.hard_add_expires_seconds) {
394 long tmo = x->lft.hard_add_expires_seconds +
395 x->curlft.add_time - now;
Fan Due3c0d042012-07-30 21:43:54 +0000396 if (tmo <= 0) {
397 if (x->xflags & XFRM_SOFT_EXPIRE) {
398 /* enter hard expire without soft expire first?!
399 * setting a new date could trigger this.
400 * workarbound: fix x->curflt.add_time by below:
401 */
402 x->curlft.add_time = now - x->saved_tmo - 1;
403 tmo = x->lft.hard_add_expires_seconds - x->saved_tmo;
404 } else
405 goto expired;
406 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407 if (tmo < next)
408 next = tmo;
409 }
410 if (x->lft.hard_use_expires_seconds) {
411 long tmo = x->lft.hard_use_expires_seconds +
412 (x->curlft.use_time ? : now) - now;
413 if (tmo <= 0)
414 goto expired;
415 if (tmo < next)
416 next = tmo;
417 }
418 if (x->km.dying)
419 goto resched;
420 if (x->lft.soft_add_expires_seconds) {
421 long tmo = x->lft.soft_add_expires_seconds +
422 x->curlft.add_time - now;
Fan Due3c0d042012-07-30 21:43:54 +0000423 if (tmo <= 0) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 warn = 1;
Fan Due3c0d042012-07-30 21:43:54 +0000425 x->xflags &= ~XFRM_SOFT_EXPIRE;
426 } else if (tmo < next) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700427 next = tmo;
Fan Due3c0d042012-07-30 21:43:54 +0000428 x->xflags |= XFRM_SOFT_EXPIRE;
429 x->saved_tmo = tmo;
430 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700431 }
432 if (x->lft.soft_use_expires_seconds) {
433 long tmo = x->lft.soft_use_expires_seconds +
434 (x->curlft.use_time ? : now) - now;
435 if (tmo <= 0)
436 warn = 1;
437 else if (tmo < next)
438 next = tmo;
439 }
440
Herbert Xu4666faa2005-06-18 22:43:22 -0700441 x->km.dying = warn;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700442 if (warn)
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800443 km_state_expired(x, 0, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700444resched:
Weilong Chen9b7a7872013-12-24 09:43:46 +0800445 if (next != LONG_MAX) {
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800446 tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL);
447 }
David S. Millera47f0ce2006-08-24 03:54:22 -0700448
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449 goto out;
450
451expired:
Steffen Klassert5b8ef342013-08-27 13:43:30 +0200452 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700453 x->km.state = XFRM_STATE_EXPIRED;
Joy Latten161a09e2006-11-27 13:11:54 -0600454
455 err = __xfrm_state_delete(x);
Nicolas Dichtel0806ae42013-08-23 15:46:08 +0200456 if (!err)
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800457 km_state_expired(x, 1, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458
Tetsuo Handa2e710292014-04-22 21:48:30 +0900459 xfrm_audit_state_delete(x, err ? 0 : 1, true);
Joy Latten161a09e2006-11-27 13:11:54 -0600460
Linus Torvalds1da177e2005-04-16 15:20:36 -0700461out:
462 spin_unlock(&x->lock);
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800463 return HRTIMER_NORESTART;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700464}
465
David S. Miller0ac84752006-03-20 19:18:23 -0800466static void xfrm_replay_timer_handler(unsigned long data);
467
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800468struct xfrm_state *xfrm_state_alloc(struct net *net)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700469{
470 struct xfrm_state *x;
471
Panagiotis Issaris0da974f2006-07-21 14:51:30 -0700472 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700473
474 if (x) {
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800475 write_pnet(&x->xs_net, net);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700476 atomic_set(&x->refcnt, 1);
477 atomic_set(&x->tunnel_users, 0);
Herbert Xu12a169e2008-10-01 07:03:24 -0700478 INIT_LIST_HEAD(&x->km.all);
David S. Miller8f126e32006-08-24 02:45:07 -0700479 INIT_HLIST_NODE(&x->bydst);
480 INIT_HLIST_NODE(&x->bysrc);
481 INIT_HLIST_NODE(&x->byspi);
Fan Du99565a6c2013-08-15 15:49:06 +0800482 tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler,
483 CLOCK_BOOTTIME, HRTIMER_MODE_ABS);
Pavel Emelyanovb24b8a22008-01-23 21:20:07 -0800484 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
485 (unsigned long)x);
James Morris9d729f72007-03-04 16:12:44 -0800486 x->curlft.add_time = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700487 x->lft.soft_byte_limit = XFRM_INF;
488 x->lft.soft_packet_limit = XFRM_INF;
489 x->lft.hard_byte_limit = XFRM_INF;
490 x->lft.hard_packet_limit = XFRM_INF;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800491 x->replay_maxage = 0;
492 x->replay_maxdiff = 0;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700493 x->inner_mode = NULL;
494 x->inner_mode_iaf = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700495 spin_lock_init(&x->lock);
496 }
497 return x;
498}
499EXPORT_SYMBOL(xfrm_state_alloc);
500
501void __xfrm_state_destroy(struct xfrm_state *x)
502{
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800503 struct net *net = xs_net(x);
504
Ilpo Järvinen547b7922008-07-25 21:43:18 -0700505 WARN_ON(x->km.state != XFRM_STATE_DEAD);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700506
507 spin_lock_bh(&xfrm_state_gc_lock);
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800508 hlist_add_head(&x->gclist, &net->xfrm.state_gc_list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700509 spin_unlock_bh(&xfrm_state_gc_lock);
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800510 schedule_work(&net->xfrm.state_gc_work);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700511}
512EXPORT_SYMBOL(__xfrm_state_destroy);
513
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800514int __xfrm_state_delete(struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700515{
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800516 struct net *net = xs_net(x);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700517 int err = -ESRCH;
518
Linus Torvalds1da177e2005-04-16 15:20:36 -0700519 if (x->km.state != XFRM_STATE_DEAD) {
520 x->km.state = XFRM_STATE_DEAD;
Fan Du283bc9f2013-11-07 17:47:50 +0800521 spin_lock(&net->xfrm.xfrm_state_lock);
Herbert Xu12a169e2008-10-01 07:03:24 -0700522 list_del(&x->km.all);
David S. Miller8f126e32006-08-24 02:45:07 -0700523 hlist_del(&x->bydst);
David S. Miller8f126e32006-08-24 02:45:07 -0700524 hlist_del(&x->bysrc);
David S. Millera47f0ce2006-08-24 03:54:22 -0700525 if (x->id.spi)
David S. Miller8f126e32006-08-24 02:45:07 -0700526 hlist_del(&x->byspi);
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800527 net->xfrm.state_num--;
Fan Du283bc9f2013-11-07 17:47:50 +0800528 spin_unlock(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700529
Linus Torvalds1da177e2005-04-16 15:20:36 -0700530 /* All xfrm_state objects are created by xfrm_state_alloc.
531 * The xfrm_state_alloc call gives a reference, and that
532 * is what we are dropping here.
533 */
Patrick McHardy5dba4792007-11-27 11:10:07 +0800534 xfrm_state_put(x);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700535 err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536 }
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700537
538 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700539}
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800540EXPORT_SYMBOL(__xfrm_state_delete);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700542int xfrm_state_delete(struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700543{
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700544 int err;
545
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 spin_lock_bh(&x->lock);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700547 err = __xfrm_state_delete(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548 spin_unlock_bh(&x->lock);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700549
550 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700551}
552EXPORT_SYMBOL(xfrm_state_delete);
553
Joy Latten4aa2e622007-06-04 19:05:57 -0400554#ifdef CONFIG_SECURITY_NETWORK_XFRM
555static inline int
Tetsuo Handa2e710292014-04-22 21:48:30 +0900556xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700557{
Joy Latten4aa2e622007-06-04 19:05:57 -0400558 int i, err = 0;
559
Alexey Dobriyan0e602452008-11-25 17:30:18 -0800560 for (i = 0; i <= net->xfrm.state_hmask; i++) {
Joy Latten4aa2e622007-06-04 19:05:57 -0400561 struct xfrm_state *x;
562
Sasha Levinb67bfe02013-02-27 17:06:00 -0800563 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
Joy Latten4aa2e622007-06-04 19:05:57 -0400564 if (xfrm_id_proto_match(x->id.proto, proto) &&
565 (err = security_xfrm_state_delete(x)) != 0) {
Tetsuo Handa2e710292014-04-22 21:48:30 +0900566 xfrm_audit_state_delete(x, 0, task_valid);
Joy Latten4aa2e622007-06-04 19:05:57 -0400567 return err;
568 }
569 }
570 }
571
572 return err;
573}
574#else
575static inline int
Tetsuo Handa2e710292014-04-22 21:48:30 +0900576xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
Joy Latten4aa2e622007-06-04 19:05:57 -0400577{
578 return 0;
579}
580#endif
581
Tetsuo Handa2e710292014-04-22 21:48:30 +0900582int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
Joy Latten4aa2e622007-06-04 19:05:57 -0400583{
Jamal Hadi Salim9e64cc92010-02-19 02:00:41 +0000584 int i, err = 0, cnt = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585
Fan Du283bc9f2013-11-07 17:47:50 +0800586 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Tetsuo Handa2e710292014-04-22 21:48:30 +0900587 err = xfrm_state_flush_secctx_check(net, proto, task_valid);
Joy Latten4aa2e622007-06-04 19:05:57 -0400588 if (err)
589 goto out;
590
Jamal Hadi Salim9e64cc92010-02-19 02:00:41 +0000591 err = -ESRCH;
Alexey Dobriyan0e602452008-11-25 17:30:18 -0800592 for (i = 0; i <= net->xfrm.state_hmask; i++) {
David S. Miller8f126e32006-08-24 02:45:07 -0700593 struct xfrm_state *x;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700594restart:
Sasha Levinb67bfe02013-02-27 17:06:00 -0800595 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700596 if (!xfrm_state_kern(x) &&
Masahide NAKAMURA57947082006-09-22 15:06:24 -0700597 xfrm_id_proto_match(x->id.proto, proto)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700598 xfrm_state_hold(x);
Fan Du283bc9f2013-11-07 17:47:50 +0800599 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700600
Joy Latten161a09e2006-11-27 13:11:54 -0600601 err = xfrm_state_delete(x);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700602 xfrm_audit_state_delete(x, err ? 0 : 1,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900603 task_valid);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700604 xfrm_state_put(x);
Jamal Hadi Salim9e64cc92010-02-19 02:00:41 +0000605 if (!err)
606 cnt++;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700607
Fan Du283bc9f2013-11-07 17:47:50 +0800608 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700609 goto restart;
610 }
611 }
612 }
Jamal Hadi Salim9e64cc92010-02-19 02:00:41 +0000613 if (cnt)
614 err = 0;
Joy Latten4aa2e622007-06-04 19:05:57 -0400615
616out:
Fan Du283bc9f2013-11-07 17:47:50 +0800617 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Joy Latten4aa2e622007-06-04 19:05:57 -0400618 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700619}
620EXPORT_SYMBOL(xfrm_state_flush);
621
Alexey Dobriyane0710412010-01-23 13:37:10 +0000622void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
Jamal Hadi Salim28d89092007-04-26 00:10:29 -0700623{
Fan Du283bc9f2013-11-07 17:47:50 +0800624 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Alexey Dobriyane0710412010-01-23 13:37:10 +0000625 si->sadcnt = net->xfrm.state_num;
626 si->sadhcnt = net->xfrm.state_hmask;
Jamal Hadi Salim28d89092007-04-26 00:10:29 -0700627 si->sadhmcnt = xfrm_state_hashmax;
Fan Du283bc9f2013-11-07 17:47:50 +0800628 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Jamal Hadi Salim28d89092007-04-26 00:10:29 -0700629}
630EXPORT_SYMBOL(xfrm_sad_getinfo);
631
Linus Torvalds1da177e2005-04-16 15:20:36 -0700632static int
David S. Miller1a898592011-02-22 18:22:34 -0800633xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl,
David S. Miller04686012011-02-24 01:50:12 -0500634 const struct xfrm_tmpl *tmpl,
David S. Miller33765d02011-02-24 01:55:45 -0500635 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
Thomas Egerer8444cf72010-09-20 11:11:38 -0700636 unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700637{
638 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
639 if (!afinfo)
640 return -1;
Thomas Egerer8444cf72010-09-20 11:11:38 -0700641 afinfo->init_tempsel(&x->sel, fl);
642
643 if (family != tmpl->encap_family) {
644 xfrm_state_put_afinfo(afinfo);
645 afinfo = xfrm_state_get_afinfo(tmpl->encap_family);
646 if (!afinfo)
647 return -1;
648 }
649 afinfo->init_temprop(x, tmpl, daddr, saddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700650 xfrm_state_put_afinfo(afinfo);
651 return 0;
652}
653
David S. Miller9aa60082011-02-24 01:51:36 -0500654static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
655 const xfrm_address_t *daddr,
656 __be32 spi, u8 proto,
657 unsigned short family)
David S. Milleredcd5822006-08-24 00:42:45 -0700658{
Alexey Dobriyan221df1e2008-11-25 17:30:50 -0800659 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
David S. Milleredcd5822006-08-24 00:42:45 -0700660 struct xfrm_state *x;
661
Sasha Levinb67bfe02013-02-27 17:06:00 -0800662 hlist_for_each_entry(x, net->xfrm.state_byspi+h, byspi) {
David S. Milleredcd5822006-08-24 00:42:45 -0700663 if (x->props.family != family ||
664 x->id.spi != spi ||
Wei Yongjun18025712009-06-28 18:42:53 +0000665 x->id.proto != proto ||
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +0000666 !xfrm_addr_equal(&x->id.daddr, daddr, family))
David S. Milleredcd5822006-08-24 00:42:45 -0700667 continue;
668
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +0000669 if ((mark & x->mark.m) != x->mark.v)
670 continue;
David S. Milleredcd5822006-08-24 00:42:45 -0700671 xfrm_state_hold(x);
672 return x;
673 }
674
675 return NULL;
676}
677
David S. Miller9aa60082011-02-24 01:51:36 -0500678static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
679 const xfrm_address_t *daddr,
680 const xfrm_address_t *saddr,
681 u8 proto, unsigned short family)
David S. Milleredcd5822006-08-24 00:42:45 -0700682{
Alexey Dobriyan221df1e2008-11-25 17:30:50 -0800683 unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
David S. Milleredcd5822006-08-24 00:42:45 -0700684 struct xfrm_state *x;
685
Sasha Levinb67bfe02013-02-27 17:06:00 -0800686 hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
David S. Milleredcd5822006-08-24 00:42:45 -0700687 if (x->props.family != family ||
Wei Yongjun18025712009-06-28 18:42:53 +0000688 x->id.proto != proto ||
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +0000689 !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
690 !xfrm_addr_equal(&x->props.saddr, saddr, family))
David S. Milleredcd5822006-08-24 00:42:45 -0700691 continue;
692
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +0000693 if ((mark & x->mark.m) != x->mark.v)
694 continue;
David S. Milleredcd5822006-08-24 00:42:45 -0700695 xfrm_state_hold(x);
696 return x;
697 }
698
699 return NULL;
700}
701
702static inline struct xfrm_state *
703__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
704{
Alexey Dobriyan221df1e2008-11-25 17:30:50 -0800705 struct net *net = xs_net(x);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -0800706 u32 mark = x->mark.v & x->mark.m;
Alexey Dobriyan221df1e2008-11-25 17:30:50 -0800707
David S. Milleredcd5822006-08-24 00:42:45 -0700708 if (use_spi)
Jamal Hadi Salimbd557752010-02-22 16:20:22 -0800709 return __xfrm_state_lookup(net, mark, &x->id.daddr,
710 x->id.spi, x->id.proto, family);
David S. Milleredcd5822006-08-24 00:42:45 -0700711 else
Jamal Hadi Salimbd557752010-02-22 16:20:22 -0800712 return __xfrm_state_lookup_byaddr(net, mark,
713 &x->id.daddr,
David S. Milleredcd5822006-08-24 00:42:45 -0700714 &x->props.saddr,
715 x->id.proto, family);
716}
717
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800718static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
Patrick McHardy2fab22f2006-10-24 15:34:00 -0700719{
720 if (have_hash_collision &&
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800721 (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
722 net->xfrm.state_num > net->xfrm.state_hmask)
723 schedule_work(&net->xfrm.state_hash_work);
Patrick McHardy2fab22f2006-10-24 15:34:00 -0700724}
725
David S. Miller08ec9af2009-03-13 14:22:40 -0700726static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
David S. Miller4a08ab02011-02-22 18:21:31 -0800727 const struct flowi *fl, unsigned short family,
David S. Miller08ec9af2009-03-13 14:22:40 -0700728 struct xfrm_state **best, int *acq_in_progress,
729 int *error)
730{
731 /* Resolution logic:
732 * 1. There is a valid state with matching selector. Done.
733 * 2. Valid state with inappropriate selector. Skip.
734 *
735 * Entering area of "sysdeps".
736 *
737 * 3. If state is not valid, selector is temporary, it selects
738 * only session which triggered previous resolution. Key
739 * manager will do something to install a state with proper
740 * selector.
741 */
742 if (x->km.state == XFRM_STATE_VALID) {
743 if ((x->sel.family &&
744 !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
745 !security_xfrm_state_pol_flow_match(x, pol, fl))
746 return;
747
748 if (!*best ||
749 (*best)->km.dying > x->km.dying ||
750 ((*best)->km.dying == x->km.dying &&
751 (*best)->curlft.add_time < x->curlft.add_time))
752 *best = x;
753 } else if (x->km.state == XFRM_STATE_ACQ) {
754 *acq_in_progress = 1;
755 } else if (x->km.state == XFRM_STATE_ERROR ||
756 x->km.state == XFRM_STATE_EXPIRED) {
757 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
758 security_xfrm_state_pol_flow_match(x, pol, fl))
759 *error = -ESRCH;
760 }
761}
762
Linus Torvalds1da177e2005-04-16 15:20:36 -0700763struct xfrm_state *
David S. Miller33765d02011-02-24 01:55:45 -0500764xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
David S. Millerb520e9f2011-02-22 18:24:19 -0800765 const struct flowi *fl, struct xfrm_tmpl *tmpl,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700766 struct xfrm_policy *pol, int *err,
767 unsigned short family)
768{
David S. Miller08ec9af2009-03-13 14:22:40 -0700769 static xfrm_address_t saddr_wildcard = { };
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800770 struct net *net = xp_net(pol);
Nicolas Dichtel6a783c92009-04-27 02:58:59 -0700771 unsigned int h, h_wildcard;
David S. Miller37b08e32008-09-02 20:14:15 -0700772 struct xfrm_state *x, *x0, *to_put;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700773 int acquire_in_progress = 0;
774 int error = 0;
775 struct xfrm_state *best = NULL;
Jamal Hadi Salimbd557752010-02-22 16:20:22 -0800776 u32 mark = pol->mark.v & pol->mark.m;
Thomas Egerer8444cf72010-09-20 11:11:38 -0700777 unsigned short encap_family = tmpl->encap_family;
Horia Geanta0f245582014-02-12 16:20:06 +0200778 struct km_event c;
YOSHIFUJI Hideakia716c112007-02-09 23:25:29 +0900779
David S. Miller37b08e32008-09-02 20:14:15 -0700780 to_put = NULL;
781
Fan Du283bc9f2013-11-07 17:47:50 +0800782 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Thomas Egerer8444cf72010-09-20 11:11:38 -0700783 h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800784 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
Thomas Egerer8444cf72010-09-20 11:11:38 -0700785 if (x->props.family == encap_family &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700786 x->props.reqid == tmpl->reqid &&
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +0000787 (mark & x->mark.m) == x->mark.v &&
Masahide NAKAMURAfbd9a5b2006-08-23 18:08:21 -0700788 !(x->props.flags & XFRM_STATE_WILDRECV) &&
Thomas Egerer8444cf72010-09-20 11:11:38 -0700789 xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700790 tmpl->mode == x->props.mode &&
791 tmpl->id.proto == x->id.proto &&
David S. Miller08ec9af2009-03-13 14:22:40 -0700792 (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
David S. Miller1f673c52011-02-24 01:53:13 -0500793 xfrm_state_look_at(pol, x, fl, encap_family,
David S. Miller08ec9af2009-03-13 14:22:40 -0700794 &best, &acquire_in_progress, &error);
795 }
Fan Du6f115632013-09-23 17:18:25 +0800796 if (best || acquire_in_progress)
David S. Miller08ec9af2009-03-13 14:22:40 -0700797 goto found;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700798
Thomas Egerer8444cf72010-09-20 11:11:38 -0700799 h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800800 hlist_for_each_entry(x, net->xfrm.state_bydst+h_wildcard, bydst) {
Thomas Egerer8444cf72010-09-20 11:11:38 -0700801 if (x->props.family == encap_family &&
David S. Miller08ec9af2009-03-13 14:22:40 -0700802 x->props.reqid == tmpl->reqid &&
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +0000803 (mark & x->mark.m) == x->mark.v &&
David S. Miller08ec9af2009-03-13 14:22:40 -0700804 !(x->props.flags & XFRM_STATE_WILDRECV) &&
Fan Duf59bbdf2013-09-27 16:32:50 +0800805 xfrm_addr_equal(&x->id.daddr, daddr, encap_family) &&
David S. Miller08ec9af2009-03-13 14:22:40 -0700806 tmpl->mode == x->props.mode &&
807 tmpl->id.proto == x->id.proto &&
808 (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
David S. Miller1f673c52011-02-24 01:53:13 -0500809 xfrm_state_look_at(pol, x, fl, encap_family,
David S. Miller08ec9af2009-03-13 14:22:40 -0700810 &best, &acquire_in_progress, &error);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700811 }
812
David S. Miller08ec9af2009-03-13 14:22:40 -0700813found:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700814 x = best;
815 if (!x && !error && !acquire_in_progress) {
Patrick McHardy5c5d2812005-04-21 20:12:32 -0700816 if (tmpl->id.spi &&
Jamal Hadi Salimbd557752010-02-22 16:20:22 -0800817 (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
Thomas Egerer8444cf72010-09-20 11:11:38 -0700818 tmpl->id.proto, encap_family)) != NULL) {
David S. Miller37b08e32008-09-02 20:14:15 -0700819 to_put = x0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700820 error = -EEXIST;
821 goto out;
822 }
Horia Geanta0f245582014-02-12 16:20:06 +0200823
824 c.net = net;
825 /* If the KMs have no listeners (yet...), avoid allocating an SA
826 * for each and every packet - garbage collection might not
827 * handle the flood.
828 */
829 if (!km_is_alive(&c)) {
830 error = -ESRCH;
831 goto out;
832 }
833
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800834 x = xfrm_state_alloc(net);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700835 if (x == NULL) {
836 error = -ENOMEM;
837 goto out;
838 }
Thomas Egerer8444cf72010-09-20 11:11:38 -0700839 /* Initialize temporary state matching only
Linus Torvalds1da177e2005-04-16 15:20:36 -0700840 * to current session. */
Thomas Egerer8444cf72010-09-20 11:11:38 -0700841 xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -0800842 memcpy(&x->mark, &pol->mark, sizeof(x->mark));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700843
David S. Miller1d28f422011-03-12 00:29:39 -0500844 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid);
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -0700845 if (error) {
846 x->km.state = XFRM_STATE_DEAD;
David S. Miller37b08e32008-09-02 20:14:15 -0700847 to_put = x;
Venkat Yekkiralae0d1caa2006-07-24 23:29:07 -0700848 x = NULL;
849 goto out;
850 }
851
Linus Torvalds1da177e2005-04-16 15:20:36 -0700852 if (km_query(x, tmpl, pol) == 0) {
853 x->km.state = XFRM_STATE_ACQ;
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800854 list_add(&x->km.all, &net->xfrm.state_all);
855 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
Thomas Egerer8444cf72010-09-20 11:11:38 -0700856 h = xfrm_src_hash(net, daddr, saddr, encap_family);
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800857 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700858 if (x->id.spi) {
Thomas Egerer8444cf72010-09-20 11:11:38 -0700859 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800860 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700861 }
Alexey Dobriyanb27aead2008-11-25 18:00:48 -0800862 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800863 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800864 net->xfrm.state_num++;
865 xfrm_hash_grow_check(net, x->bydst.next != NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700866 } else {
867 x->km.state = XFRM_STATE_DEAD;
David S. Miller37b08e32008-09-02 20:14:15 -0700868 to_put = x;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700869 x = NULL;
870 error = -ESRCH;
871 }
872 }
873out:
874 if (x)
875 xfrm_state_hold(x);
876 else
877 *err = acquire_in_progress ? -EAGAIN : error;
Fan Du283bc9f2013-11-07 17:47:50 +0800878 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
David S. Miller37b08e32008-09-02 20:14:15 -0700879 if (to_put)
880 xfrm_state_put(to_put);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700881 return x;
882}
883
Jamal Hadi Salim628529b2007-07-02 22:41:14 -0700884struct xfrm_state *
Jamal Hadi Salimbd557752010-02-22 16:20:22 -0800885xfrm_stateonly_find(struct net *net, u32 mark,
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800886 xfrm_address_t *daddr, xfrm_address_t *saddr,
Jamal Hadi Salim628529b2007-07-02 22:41:14 -0700887 unsigned short family, u8 mode, u8 proto, u32 reqid)
888{
Pavel Emelyanov4bda4f22007-12-14 11:38:04 -0800889 unsigned int h;
Jamal Hadi Salim628529b2007-07-02 22:41:14 -0700890 struct xfrm_state *rx = NULL, *x = NULL;
Jamal Hadi Salim628529b2007-07-02 22:41:14 -0700891
Fan Du4ae770b2014-01-03 11:18:29 +0800892 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -0800893 h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800894 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
Jamal Hadi Salim628529b2007-07-02 22:41:14 -0700895 if (x->props.family == family &&
896 x->props.reqid == reqid &&
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +0000897 (mark & x->mark.m) == x->mark.v &&
Jamal Hadi Salim628529b2007-07-02 22:41:14 -0700898 !(x->props.flags & XFRM_STATE_WILDRECV) &&
899 xfrm_state_addr_check(x, daddr, saddr, family) &&
900 mode == x->props.mode &&
901 proto == x->id.proto &&
902 x->km.state == XFRM_STATE_VALID) {
903 rx = x;
904 break;
905 }
906 }
907
908 if (rx)
909 xfrm_state_hold(rx);
Fan Du4ae770b2014-01-03 11:18:29 +0800910 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Jamal Hadi Salim628529b2007-07-02 22:41:14 -0700911
912
913 return rx;
914}
915EXPORT_SYMBOL(xfrm_stateonly_find);
916
Fan Duc4549972014-01-03 11:18:32 +0800917struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
918 unsigned short family)
919{
920 struct xfrm_state *x;
921 struct xfrm_state_walk *w;
922
923 spin_lock_bh(&net->xfrm.xfrm_state_lock);
924 list_for_each_entry(w, &net->xfrm.state_all, all) {
925 x = container_of(w, struct xfrm_state, km);
926 if (x->props.family != family ||
927 x->id.spi != spi)
928 continue;
929
Fan Duc4549972014-01-03 11:18:32 +0800930 xfrm_state_hold(x);
Li RongQingbdddbf62015-04-29 08:42:44 +0800931 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Fan Duc4549972014-01-03 11:18:32 +0800932 return x;
933 }
934 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
935 return NULL;
936}
937EXPORT_SYMBOL(xfrm_state_lookup_byspi);
938
Linus Torvalds1da177e2005-04-16 15:20:36 -0700939static void __xfrm_state_insert(struct xfrm_state *x)
940{
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800941 struct net *net = xs_net(x);
David S. Millera624c102006-08-24 03:24:33 -0700942 unsigned int h;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700943
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800944 list_add(&x->km.all, &net->xfrm.state_all);
Timo Teras4c563f72008-02-28 21:31:08 -0800945
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800946 h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
David S. Millerc1969f22006-08-24 04:00:03 -0700947 x->props.reqid, x->props.family);
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800948 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700949
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800950 h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
951 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700952
Masahide NAKAMURA7b4dc3602006-09-27 22:21:52 -0700953 if (x->id.spi) {
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800954 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
Masahide NAKAMURA6c44e6b2006-08-23 17:53:57 -0700955 x->props.family);
956
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800957 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
Masahide NAKAMURA6c44e6b2006-08-23 17:53:57 -0700958 }
959
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800960 tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
David S. Millera47f0ce2006-08-24 03:54:22 -0700961 if (x->replay_maxage)
962 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800963
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800964 net->xfrm.state_num++;
David S. Millerf034b5d2006-08-24 03:08:07 -0700965
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800966 xfrm_hash_grow_check(net, x->bydst.next != NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700967}
968
Fan Du283bc9f2013-11-07 17:47:50 +0800969/* net->xfrm.xfrm_state_lock is held */
David S. Millerc7f5ea32006-08-24 03:29:04 -0700970static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
971{
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800972 struct net *net = xs_net(xnew);
David S. Millerc7f5ea32006-08-24 03:29:04 -0700973 unsigned short family = xnew->props.family;
974 u32 reqid = xnew->props.reqid;
975 struct xfrm_state *x;
David S. Millerc7f5ea32006-08-24 03:29:04 -0700976 unsigned int h;
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +0000977 u32 mark = xnew->mark.v & xnew->mark.m;
David S. Millerc7f5ea32006-08-24 03:29:04 -0700978
Alexey Dobriyan98806f72008-11-25 17:29:47 -0800979 h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800980 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
David S. Millerc7f5ea32006-08-24 03:29:04 -0700981 if (x->props.family == family &&
982 x->props.reqid == reqid &&
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +0000983 (mark & x->mark.m) == x->mark.v &&
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +0000984 xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) &&
985 xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family))
Herbert Xu34996cb2010-03-31 01:19:49 +0000986 x->genid++;
David S. Millerc7f5ea32006-08-24 03:29:04 -0700987 }
988}
989
Linus Torvalds1da177e2005-04-16 15:20:36 -0700990void xfrm_state_insert(struct xfrm_state *x)
991{
Fan Du283bc9f2013-11-07 17:47:50 +0800992 struct net *net = xs_net(x);
993
994 spin_lock_bh(&net->xfrm.xfrm_state_lock);
David S. Millerc7f5ea32006-08-24 03:29:04 -0700995 __xfrm_state_bump_genids(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700996 __xfrm_state_insert(x);
Fan Du283bc9f2013-11-07 17:47:50 +0800997 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700998}
999EXPORT_SYMBOL(xfrm_state_insert);
1000
Fan Du283bc9f2013-11-07 17:47:50 +08001001/* net->xfrm.xfrm_state_lock is held */
Mathias Krausee473fcb2013-06-26 23:56:58 +02001002static struct xfrm_state *__find_acq_core(struct net *net,
1003 const struct xfrm_mark *m,
David S. Millera70486f2011-02-27 23:17:24 -08001004 unsigned short family, u8 mode,
1005 u32 reqid, u8 proto,
1006 const xfrm_address_t *daddr,
Mathias Krausee473fcb2013-06-26 23:56:58 +02001007 const xfrm_address_t *saddr,
1008 int create)
David S. Miller27708342006-08-24 00:13:10 -07001009{
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001010 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
David S. Miller27708342006-08-24 00:13:10 -07001011 struct xfrm_state *x;
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +00001012 u32 mark = m->v & m->m;
David S. Miller27708342006-08-24 00:13:10 -07001013
Sasha Levinb67bfe02013-02-27 17:06:00 -08001014 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
David S. Miller27708342006-08-24 00:13:10 -07001015 if (x->props.reqid != reqid ||
1016 x->props.mode != mode ||
1017 x->props.family != family ||
1018 x->km.state != XFRM_STATE_ACQ ||
Joy Latten75e252d2007-03-12 17:14:07 -07001019 x->id.spi != 0 ||
Wei Yongjun18025712009-06-28 18:42:53 +00001020 x->id.proto != proto ||
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +00001021 (mark & x->mark.m) != x->mark.v ||
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001022 !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
1023 !xfrm_addr_equal(&x->props.saddr, saddr, family))
David S. Miller27708342006-08-24 00:13:10 -07001024 continue;
1025
David S. Miller27708342006-08-24 00:13:10 -07001026 xfrm_state_hold(x);
1027 return x;
1028 }
1029
1030 if (!create)
1031 return NULL;
1032
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001033 x = xfrm_state_alloc(net);
David S. Miller27708342006-08-24 00:13:10 -07001034 if (likely(x)) {
1035 switch (family) {
1036 case AF_INET:
1037 x->sel.daddr.a4 = daddr->a4;
1038 x->sel.saddr.a4 = saddr->a4;
1039 x->sel.prefixlen_d = 32;
1040 x->sel.prefixlen_s = 32;
1041 x->props.saddr.a4 = saddr->a4;
1042 x->id.daddr.a4 = daddr->a4;
1043 break;
1044
1045 case AF_INET6:
Jiri Benc15e318b2015-03-29 16:59:24 +02001046 x->sel.daddr.in6 = daddr->in6;
1047 x->sel.saddr.in6 = saddr->in6;
David S. Miller27708342006-08-24 00:13:10 -07001048 x->sel.prefixlen_d = 128;
1049 x->sel.prefixlen_s = 128;
Jiri Benc15e318b2015-03-29 16:59:24 +02001050 x->props.saddr.in6 = saddr->in6;
1051 x->id.daddr.in6 = daddr->in6;
David S. Miller27708342006-08-24 00:13:10 -07001052 break;
Stephen Hemminger3ff50b72007-04-20 17:09:22 -07001053 }
David S. Miller27708342006-08-24 00:13:10 -07001054
1055 x->km.state = XFRM_STATE_ACQ;
1056 x->id.proto = proto;
1057 x->props.family = family;
1058 x->props.mode = mode;
1059 x->props.reqid = reqid;
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001060 x->mark.v = m->v;
1061 x->mark.m = m->m;
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001062 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
David S. Miller27708342006-08-24 00:13:10 -07001063 xfrm_state_hold(x);
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -08001064 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001065 list_add(&x->km.all, &net->xfrm.state_all);
1066 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
1067 h = xfrm_src_hash(net, daddr, saddr, family);
1068 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
David S. Miller918049f2006-10-12 22:03:24 -07001069
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001070 net->xfrm.state_num++;
David S. Miller918049f2006-10-12 22:03:24 -07001071
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001072 xfrm_hash_grow_check(net, x->bydst.next != NULL);
David S. Miller27708342006-08-24 00:13:10 -07001073 }
1074
1075 return x;
1076}
1077
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001078static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001079
1080int xfrm_state_add(struct xfrm_state *x)
1081{
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001082 struct net *net = xs_net(x);
David S. Miller37b08e32008-09-02 20:14:15 -07001083 struct xfrm_state *x1, *to_put;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001084 int family;
1085 int err;
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001086 u32 mark = x->mark.v & x->mark.m;
Masahide NAKAMURAeb2971b2006-08-23 17:56:04 -07001087 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001088
1089 family = x->props.family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001090
David S. Miller37b08e32008-09-02 20:14:15 -07001091 to_put = NULL;
1092
Fan Du283bc9f2013-11-07 17:47:50 +08001093 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001094
David S. Milleredcd5822006-08-24 00:42:45 -07001095 x1 = __xfrm_state_locate(x, use_spi, family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001096 if (x1) {
David S. Miller37b08e32008-09-02 20:14:15 -07001097 to_put = x1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001098 x1 = NULL;
1099 err = -EEXIST;
1100 goto out;
1101 }
1102
Masahide NAKAMURAeb2971b2006-08-23 17:56:04 -07001103 if (use_spi && x->km.seq) {
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001104 x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq);
Joy Latten75e252d2007-03-12 17:14:07 -07001105 if (x1 && ((x1->id.proto != x->id.proto) ||
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001106 !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) {
David S. Miller37b08e32008-09-02 20:14:15 -07001107 to_put = x1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001108 x1 = NULL;
1109 }
1110 }
1111
Masahide NAKAMURAeb2971b2006-08-23 17:56:04 -07001112 if (use_spi && !x1)
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001113 x1 = __find_acq_core(net, &x->mark, family, x->props.mode,
1114 x->props.reqid, x->id.proto,
David S. Miller27708342006-08-24 00:13:10 -07001115 &x->id.daddr, &x->props.saddr, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001116
David S. Millerc7f5ea32006-08-24 03:29:04 -07001117 __xfrm_state_bump_genids(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001118 __xfrm_state_insert(x);
1119 err = 0;
1120
1121out:
Fan Du283bc9f2013-11-07 17:47:50 +08001122 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001123
1124 if (x1) {
1125 xfrm_state_delete(x1);
1126 xfrm_state_put(x1);
1127 }
1128
David S. Miller37b08e32008-09-02 20:14:15 -07001129 if (to_put)
1130 xfrm_state_put(to_put);
1131
Linus Torvalds1da177e2005-04-16 15:20:36 -07001132 return err;
1133}
1134EXPORT_SYMBOL(xfrm_state_add);
1135
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001136#ifdef CONFIG_XFRM_MIGRATE
Steffen Klassertcc9ab602014-02-19 13:33:24 +01001137static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001138{
Alexey Dobriyan98806f72008-11-25 17:29:47 -08001139 struct net *net = xs_net(orig);
Alexey Dobriyan98806f72008-11-25 17:29:47 -08001140 struct xfrm_state *x = xfrm_state_alloc(net);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001141 if (!x)
Herbert Xu553f9112010-02-15 20:00:51 +00001142 goto out;
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001143
1144 memcpy(&x->id, &orig->id, sizeof(x->id));
1145 memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1146 memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1147 x->props.mode = orig->props.mode;
1148 x->props.replay_window = orig->props.replay_window;
1149 x->props.reqid = orig->props.reqid;
1150 x->props.family = orig->props.family;
1151 x->props.saddr = orig->props.saddr;
1152
1153 if (orig->aalg) {
Martin Willi4447bb32009-11-25 00:29:52 +00001154 x->aalg = xfrm_algo_auth_clone(orig->aalg);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001155 if (!x->aalg)
1156 goto error;
1157 }
1158 x->props.aalgo = orig->props.aalgo;
1159
Steffen Klassertee5c2312014-02-19 13:33:24 +01001160 if (orig->aead) {
1161 x->aead = xfrm_algo_aead_clone(orig->aead);
1162 if (!x->aead)
1163 goto error;
1164 }
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001165 if (orig->ealg) {
1166 x->ealg = xfrm_algo_clone(orig->ealg);
1167 if (!x->ealg)
1168 goto error;
1169 }
1170 x->props.ealgo = orig->props.ealgo;
1171
1172 if (orig->calg) {
1173 x->calg = xfrm_algo_clone(orig->calg);
1174 if (!x->calg)
1175 goto error;
1176 }
1177 x->props.calgo = orig->props.calgo;
1178
YOSHIFUJI Hideakia716c112007-02-09 23:25:29 +09001179 if (orig->encap) {
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001180 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1181 if (!x->encap)
1182 goto error;
1183 }
1184
1185 if (orig->coaddr) {
1186 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1187 GFP_KERNEL);
1188 if (!x->coaddr)
1189 goto error;
1190 }
1191
Steffen Klassertaf2f4642011-03-28 19:46:39 +00001192 if (orig->replay_esn) {
Steffen Klassertcc9ab602014-02-19 13:33:24 +01001193 if (xfrm_replay_clone(x, orig))
Steffen Klassertaf2f4642011-03-28 19:46:39 +00001194 goto error;
1195 }
1196
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001197 memcpy(&x->mark, &orig->mark, sizeof(x->mark));
1198
Steffen Klassertcc9ab602014-02-19 13:33:24 +01001199 if (xfrm_init_state(x) < 0)
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001200 goto error;
1201
1202 x->props.flags = orig->props.flags;
Nicolas Dichtela947b0a2013-02-22 10:54:54 +01001203 x->props.extra_flags = orig->props.extra_flags;
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001204
Steffen Klassertee5c2312014-02-19 13:33:24 +01001205 x->tfcpad = orig->tfcpad;
1206 x->replay_maxdiff = orig->replay_maxdiff;
1207 x->replay_maxage = orig->replay_maxage;
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001208 x->curlft.add_time = orig->curlft.add_time;
1209 x->km.state = orig->km.state;
1210 x->km.seq = orig->km.seq;
1211
1212 return x;
1213
1214 error:
Herbert Xu553f9112010-02-15 20:00:51 +00001215 xfrm_state_put(x);
1216out:
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001217 return NULL;
1218}
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001219
Fan Du283bc9f2013-11-07 17:47:50 +08001220struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net)
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001221{
1222 unsigned int h;
Steffen Klassert8c0cba22014-02-19 13:33:24 +01001223 struct xfrm_state *x = NULL;
1224
1225 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001226
1227 if (m->reqid) {
Fan Du283bc9f2013-11-07 17:47:50 +08001228 h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001229 m->reqid, m->old_family);
Fan Du283bc9f2013-11-07 17:47:50 +08001230 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001231 if (x->props.mode != m->mode ||
1232 x->id.proto != m->proto)
1233 continue;
1234 if (m->reqid && x->props.reqid != m->reqid)
1235 continue;
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001236 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
1237 m->old_family) ||
1238 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
1239 m->old_family))
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001240 continue;
1241 xfrm_state_hold(x);
Steffen Klassert8c0cba22014-02-19 13:33:24 +01001242 break;
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001243 }
1244 } else {
Fan Du283bc9f2013-11-07 17:47:50 +08001245 h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001246 m->old_family);
Fan Du283bc9f2013-11-07 17:47:50 +08001247 hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001248 if (x->props.mode != m->mode ||
1249 x->id.proto != m->proto)
1250 continue;
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001251 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
1252 m->old_family) ||
1253 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
1254 m->old_family))
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001255 continue;
1256 xfrm_state_hold(x);
Steffen Klassert8c0cba22014-02-19 13:33:24 +01001257 break;
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001258 }
1259 }
1260
Steffen Klassert8c0cba22014-02-19 13:33:24 +01001261 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1262
1263 return x;
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001264}
1265EXPORT_SYMBOL(xfrm_migrate_state_find);
1266
Weilong Chen3e94c2d2013-12-24 09:43:47 +08001267struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1268 struct xfrm_migrate *m)
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001269{
1270 struct xfrm_state *xc;
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001271
Steffen Klassertcc9ab602014-02-19 13:33:24 +01001272 xc = xfrm_state_clone(x);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001273 if (!xc)
1274 return NULL;
1275
1276 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1277 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1278
1279 /* add state */
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001280 if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) {
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001281 /* a care is needed when the destination address of the
1282 state is to be updated as it is a part of triplet */
1283 xfrm_state_insert(xc);
1284 } else {
Steffen Klassertcc9ab602014-02-19 13:33:24 +01001285 if (xfrm_state_add(xc) < 0)
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001286 goto error;
1287 }
1288
1289 return xc;
1290error:
Thomas Egerer78347c82010-12-06 23:28:56 +00001291 xfrm_state_put(xc);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001292 return NULL;
1293}
1294EXPORT_SYMBOL(xfrm_state_migrate);
1295#endif
1296
Linus Torvalds1da177e2005-04-16 15:20:36 -07001297int xfrm_state_update(struct xfrm_state *x)
1298{
David S. Miller37b08e32008-09-02 20:14:15 -07001299 struct xfrm_state *x1, *to_put;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001300 int err;
Masahide NAKAMURAeb2971b2006-08-23 17:56:04 -07001301 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
Fan Du283bc9f2013-11-07 17:47:50 +08001302 struct net *net = xs_net(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001303
David S. Miller37b08e32008-09-02 20:14:15 -07001304 to_put = NULL;
1305
Fan Du283bc9f2013-11-07 17:47:50 +08001306 spin_lock_bh(&net->xfrm.xfrm_state_lock);
David S. Milleredcd5822006-08-24 00:42:45 -07001307 x1 = __xfrm_state_locate(x, use_spi, x->props.family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001308
1309 err = -ESRCH;
1310 if (!x1)
1311 goto out;
1312
1313 if (xfrm_state_kern(x1)) {
David S. Miller37b08e32008-09-02 20:14:15 -07001314 to_put = x1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001315 err = -EEXIST;
1316 goto out;
1317 }
1318
1319 if (x1->km.state == XFRM_STATE_ACQ) {
1320 __xfrm_state_insert(x);
1321 x = NULL;
1322 }
1323 err = 0;
1324
1325out:
Fan Du283bc9f2013-11-07 17:47:50 +08001326 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001327
David S. Miller37b08e32008-09-02 20:14:15 -07001328 if (to_put)
1329 xfrm_state_put(to_put);
1330
Linus Torvalds1da177e2005-04-16 15:20:36 -07001331 if (err)
1332 return err;
1333
1334 if (!x) {
1335 xfrm_state_delete(x1);
1336 xfrm_state_put(x1);
1337 return 0;
1338 }
1339
1340 err = -EINVAL;
1341 spin_lock_bh(&x1->lock);
1342 if (likely(x1->km.state == XFRM_STATE_VALID)) {
1343 if (x->encap && x1->encap)
1344 memcpy(x1->encap, x->encap, sizeof(*x1->encap));
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -07001345 if (x->coaddr && x1->coaddr) {
1346 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1347 }
1348 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1349 memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001350 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1351 x1->km.dying = 0;
1352
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -08001353 tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001354 if (x1->curlft.use_time)
1355 xfrm_state_check_expire(x1);
1356
1357 err = 0;
Tushar Gohad8fcbc632011-07-07 15:38:52 +00001358 x->km.state = XFRM_STATE_DEAD;
1359 __xfrm_state_put(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001360 }
1361 spin_unlock_bh(&x1->lock);
1362
1363 xfrm_state_put(x1);
1364
1365 return err;
1366}
1367EXPORT_SYMBOL(xfrm_state_update);
1368
1369int xfrm_state_check_expire(struct xfrm_state *x)
1370{
1371 if (!x->curlft.use_time)
James Morris9d729f72007-03-04 16:12:44 -08001372 x->curlft.use_time = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001373
Linus Torvalds1da177e2005-04-16 15:20:36 -07001374 if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1375 x->curlft.packets >= x->lft.hard_packet_limit) {
Herbert Xu4666faa2005-06-18 22:43:22 -07001376 x->km.state = XFRM_STATE_EXPIRED;
Weilong Chen9b7a7872013-12-24 09:43:46 +08001377 tasklet_hrtimer_start(&x->mtimer, ktime_set(0, 0), HRTIMER_MODE_REL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001378 return -EINVAL;
1379 }
1380
1381 if (!x->km.dying &&
1382 (x->curlft.bytes >= x->lft.soft_byte_limit ||
Herbert Xu4666faa2005-06-18 22:43:22 -07001383 x->curlft.packets >= x->lft.soft_packet_limit)) {
1384 x->km.dying = 1;
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -08001385 km_state_expired(x, 0, 0);
Herbert Xu4666faa2005-06-18 22:43:22 -07001386 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001387 return 0;
1388}
1389EXPORT_SYMBOL(xfrm_state_check_expire);
1390
Linus Torvalds1da177e2005-04-16 15:20:36 -07001391struct xfrm_state *
David S. Millera70486f2011-02-27 23:17:24 -08001392xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001393 u8 proto, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001394{
1395 struct xfrm_state *x;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001396
Fan Du283bc9f2013-11-07 17:47:50 +08001397 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001398 x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
Fan Du283bc9f2013-11-07 17:47:50 +08001399 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001400 return x;
1401}
1402EXPORT_SYMBOL(xfrm_state_lookup);
1403
1404struct xfrm_state *
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001405xfrm_state_lookup_byaddr(struct net *net, u32 mark,
David S. Millera70486f2011-02-27 23:17:24 -08001406 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
Masahide NAKAMURAeb2971b2006-08-23 17:56:04 -07001407 u8 proto, unsigned short family)
1408{
1409 struct xfrm_state *x;
Masahide NAKAMURAeb2971b2006-08-23 17:56:04 -07001410
Fan Du283bc9f2013-11-07 17:47:50 +08001411 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001412 x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
Fan Du283bc9f2013-11-07 17:47:50 +08001413 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Masahide NAKAMURAeb2971b2006-08-23 17:56:04 -07001414 return x;
1415}
1416EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1417
1418struct xfrm_state *
Mathias Krausee473fcb2013-06-26 23:56:58 +02001419xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid,
1420 u8 proto, const xfrm_address_t *daddr,
1421 const xfrm_address_t *saddr, int create, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001422{
1423 struct xfrm_state *x;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001424
Fan Du283bc9f2013-11-07 17:47:50 +08001425 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001426 x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create);
Fan Du283bc9f2013-11-07 17:47:50 +08001427 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
David S. Miller27708342006-08-24 00:13:10 -07001428
Linus Torvalds1da177e2005-04-16 15:20:36 -07001429 return x;
1430}
1431EXPORT_SYMBOL(xfrm_find_acq);
1432
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001433#ifdef CONFIG_XFRM_SUB_POLICY
1434int
1435xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
Fan Du283bc9f2013-11-07 17:47:50 +08001436 unsigned short family, struct net *net)
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001437{
1438 int err = 0;
1439 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1440 if (!afinfo)
1441 return -EAFNOSUPPORT;
1442
Fan Du283bc9f2013-11-07 17:47:50 +08001443 spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001444 if (afinfo->tmpl_sort)
1445 err = afinfo->tmpl_sort(dst, src, n);
Fan Du283bc9f2013-11-07 17:47:50 +08001446 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001447 xfrm_state_put_afinfo(afinfo);
1448 return err;
1449}
1450EXPORT_SYMBOL(xfrm_tmpl_sort);
1451
1452int
1453xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1454 unsigned short family)
1455{
1456 int err = 0;
1457 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
Steffen Klassert35ea790d2014-02-19 13:33:23 +01001458 struct net *net = xs_net(*src);
Fan Du283bc9f2013-11-07 17:47:50 +08001459
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001460 if (!afinfo)
1461 return -EAFNOSUPPORT;
1462
Fan Du283bc9f2013-11-07 17:47:50 +08001463 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001464 if (afinfo->state_sort)
1465 err = afinfo->state_sort(dst, src, n);
Fan Du283bc9f2013-11-07 17:47:50 +08001466 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001467 xfrm_state_put_afinfo(afinfo);
1468 return err;
1469}
1470EXPORT_SYMBOL(xfrm_state_sort);
1471#endif
1472
Linus Torvalds1da177e2005-04-16 15:20:36 -07001473/* Silly enough, but I'm lazy to build resolution list */
1474
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001475static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001476{
1477 int i;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001478
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001479 for (i = 0; i <= net->xfrm.state_hmask; i++) {
David S. Miller8f126e32006-08-24 02:45:07 -07001480 struct xfrm_state *x;
1481
Sasha Levinb67bfe02013-02-27 17:06:00 -08001482 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
David S. Miller8f126e32006-08-24 02:45:07 -07001483 if (x->km.seq == seq &&
Jamal Hadi Salim3d6acfa2010-02-22 11:32:56 +00001484 (mark & x->mark.m) == x->mark.v &&
David S. Miller8f126e32006-08-24 02:45:07 -07001485 x->km.state == XFRM_STATE_ACQ) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001486 xfrm_state_hold(x);
1487 return x;
1488 }
1489 }
1490 }
1491 return NULL;
1492}
1493
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001494struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001495{
1496 struct xfrm_state *x;
1497
Fan Du283bc9f2013-11-07 17:47:50 +08001498 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001499 x = __xfrm_find_acq_byseq(net, mark, seq);
Fan Du283bc9f2013-11-07 17:47:50 +08001500 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001501 return x;
1502}
1503EXPORT_SYMBOL(xfrm_find_acq_byseq);
1504
1505u32 xfrm_get_acqseq(void)
1506{
1507 u32 res;
jamal6836b9b2010-02-16 02:01:22 +00001508 static atomic_t acqseq;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001509
jamal6836b9b2010-02-16 02:01:22 +00001510 do {
1511 res = atomic_inc_return(&acqseq);
1512 } while (!res);
1513
Linus Torvalds1da177e2005-04-16 15:20:36 -07001514 return res;
1515}
1516EXPORT_SYMBOL(xfrm_get_acqseq);
1517
Fan Du776e9dd2013-12-16 18:47:49 +08001518int verify_spi_info(u8 proto, u32 min, u32 max)
1519{
1520 switch (proto) {
1521 case IPPROTO_AH:
1522 case IPPROTO_ESP:
1523 break;
1524
1525 case IPPROTO_COMP:
1526 /* IPCOMP spi is 16-bits. */
1527 if (max >= 0x10000)
1528 return -EINVAL;
1529 break;
1530
1531 default:
1532 return -EINVAL;
1533 }
1534
1535 if (min > max)
1536 return -EINVAL;
1537
1538 return 0;
1539}
1540EXPORT_SYMBOL(verify_spi_info);
1541
Herbert Xu658b2192007-10-09 13:29:52 -07001542int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001543{
Alexey Dobriyan221df1e2008-11-25 17:30:50 -08001544 struct net *net = xs_net(x);
David S. Millerf034b5d2006-08-24 03:08:07 -07001545 unsigned int h;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001546 struct xfrm_state *x0;
Herbert Xu658b2192007-10-09 13:29:52 -07001547 int err = -ENOENT;
1548 __be32 minspi = htonl(low);
1549 __be32 maxspi = htonl(high);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001550 u32 mark = x->mark.v & x->mark.m;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001551
Herbert Xu658b2192007-10-09 13:29:52 -07001552 spin_lock_bh(&x->lock);
1553 if (x->km.state == XFRM_STATE_DEAD)
1554 goto unlock;
1555
1556 err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001557 if (x->id.spi)
Herbert Xu658b2192007-10-09 13:29:52 -07001558 goto unlock;
1559
1560 err = -ENOENT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001561
1562 if (minspi == maxspi) {
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001563 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001564 if (x0) {
1565 xfrm_state_put(x0);
Herbert Xu658b2192007-10-09 13:29:52 -07001566 goto unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001567 }
1568 x->id.spi = minspi;
1569 } else {
1570 u32 spi = 0;
Weilong Chen9b7a7872013-12-24 09:43:46 +08001571 for (h = 0; h < high-low+1; h++) {
Aruna-Hewapathirane63862b52014-01-11 07:15:59 -05001572 spi = low + prandom_u32()%(high-low+1);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001573 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001574 if (x0 == NULL) {
1575 x->id.spi = htonl(spi);
1576 break;
1577 }
1578 xfrm_state_put(x0);
1579 }
1580 }
1581 if (x->id.spi) {
Fan Du283bc9f2013-11-07 17:47:50 +08001582 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Alexey Dobriyan12604d82008-11-25 17:31:18 -08001583 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1584 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
Fan Du283bc9f2013-11-07 17:47:50 +08001585 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Herbert Xu658b2192007-10-09 13:29:52 -07001586
1587 err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001588 }
Herbert Xu658b2192007-10-09 13:29:52 -07001589
1590unlock:
1591 spin_unlock_bh(&x->lock);
1592
1593 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001594}
1595EXPORT_SYMBOL(xfrm_alloc_spi);
1596
Nicolas Dichteld3623092014-02-14 15:30:36 +01001597static bool __xfrm_state_filter_match(struct xfrm_state *x,
Nicolas Dichtel870a2df2014-03-06 18:24:29 +01001598 struct xfrm_address_filter *filter)
Nicolas Dichteld3623092014-02-14 15:30:36 +01001599{
1600 if (filter) {
1601 if ((filter->family == AF_INET ||
1602 filter->family == AF_INET6) &&
1603 x->props.family != filter->family)
1604 return false;
1605
1606 return addr_match(&x->props.saddr, &filter->saddr,
1607 filter->splen) &&
1608 addr_match(&x->id.daddr, &filter->daddr,
1609 filter->dplen);
1610 }
1611 return true;
1612}
1613
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001614int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001615 int (*func)(struct xfrm_state *, int, void*),
Linus Torvalds1da177e2005-04-16 15:20:36 -07001616 void *data)
1617{
Herbert Xu12a169e2008-10-01 07:03:24 -07001618 struct xfrm_state *state;
1619 struct xfrm_state_walk *x;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001620 int err = 0;
1621
Herbert Xu12a169e2008-10-01 07:03:24 -07001622 if (walk->seq != 0 && list_empty(&walk->all))
Timo Teras4c563f72008-02-28 21:31:08 -08001623 return 0;
1624
Fan Du283bc9f2013-11-07 17:47:50 +08001625 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Herbert Xu12a169e2008-10-01 07:03:24 -07001626 if (list_empty(&walk->all))
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001627 x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
Herbert Xu12a169e2008-10-01 07:03:24 -07001628 else
Li RongQing80077702015-04-22 17:09:54 +08001629 x = list_first_entry(&walk->all, struct xfrm_state_walk, all);
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001630 list_for_each_entry_from(x, &net->xfrm.state_all, all) {
Herbert Xu12a169e2008-10-01 07:03:24 -07001631 if (x->state == XFRM_STATE_DEAD)
Timo Teras4c563f72008-02-28 21:31:08 -08001632 continue;
Herbert Xu12a169e2008-10-01 07:03:24 -07001633 state = container_of(x, struct xfrm_state, km);
1634 if (!xfrm_id_proto_match(state->id.proto, walk->proto))
Timo Teras4c563f72008-02-28 21:31:08 -08001635 continue;
Nicolas Dichteld3623092014-02-14 15:30:36 +01001636 if (!__xfrm_state_filter_match(state, walk->filter))
1637 continue;
Herbert Xu12a169e2008-10-01 07:03:24 -07001638 err = func(state, walk->seq, data);
1639 if (err) {
1640 list_move_tail(&walk->all, &x->all);
1641 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001642 }
Herbert Xu12a169e2008-10-01 07:03:24 -07001643 walk->seq++;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001644 }
Herbert Xu12a169e2008-10-01 07:03:24 -07001645 if (walk->seq == 0) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001646 err = -ENOENT;
1647 goto out;
1648 }
Herbert Xu12a169e2008-10-01 07:03:24 -07001649 list_del_init(&walk->all);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650out:
Fan Du283bc9f2013-11-07 17:47:50 +08001651 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001652 return err;
1653}
1654EXPORT_SYMBOL(xfrm_state_walk);
1655
Nicolas Dichteld3623092014-02-14 15:30:36 +01001656void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
Nicolas Dichtel870a2df2014-03-06 18:24:29 +01001657 struct xfrm_address_filter *filter)
Herbert Xu5c182452008-09-22 19:48:19 -07001658{
Herbert Xu12a169e2008-10-01 07:03:24 -07001659 INIT_LIST_HEAD(&walk->all);
Herbert Xu5c182452008-09-22 19:48:19 -07001660 walk->proto = proto;
Herbert Xu12a169e2008-10-01 07:03:24 -07001661 walk->state = XFRM_STATE_DEAD;
1662 walk->seq = 0;
Nicolas Dichteld3623092014-02-14 15:30:36 +01001663 walk->filter = filter;
Herbert Xu5c182452008-09-22 19:48:19 -07001664}
1665EXPORT_SYMBOL(xfrm_state_walk_init);
1666
Fan Du283bc9f2013-11-07 17:47:50 +08001667void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net)
Herbert Xuabb81c42008-09-09 19:58:29 -07001668{
Nicolas Dichteld3623092014-02-14 15:30:36 +01001669 kfree(walk->filter);
1670
Herbert Xu12a169e2008-10-01 07:03:24 -07001671 if (list_empty(&walk->all))
Herbert Xu5c182452008-09-22 19:48:19 -07001672 return;
Herbert Xu5c182452008-09-22 19:48:19 -07001673
Fan Du283bc9f2013-11-07 17:47:50 +08001674 spin_lock_bh(&net->xfrm.xfrm_state_lock);
Herbert Xu12a169e2008-10-01 07:03:24 -07001675 list_del(&walk->all);
Fan Du283bc9f2013-11-07 17:47:50 +08001676 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
Herbert Xuabb81c42008-09-09 19:58:29 -07001677}
1678EXPORT_SYMBOL(xfrm_state_walk_done);
1679
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001680static void xfrm_replay_timer_handler(unsigned long data)
1681{
Weilong Chen3e94c2d2013-12-24 09:43:47 +08001682 struct xfrm_state *x = (struct xfrm_state *)data;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001683
1684 spin_lock(&x->lock);
1685
Jamal Hadi Salim27170962006-04-14 15:03:05 -07001686 if (x->km.state == XFRM_STATE_VALID) {
Alexey Dobriyana6483b792008-11-25 17:38:20 -08001687 if (xfrm_aevent_is_on(xs_net(x)))
Steffen Klassert9fdc4882011-03-08 00:08:32 +00001688 x->repl->notify(x, XFRM_REPLAY_TIMEOUT);
Jamal Hadi Salim27170962006-04-14 15:03:05 -07001689 else
1690 x->xflags |= XFRM_TIME_DEFER;
1691 }
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001692
1693 spin_unlock(&x->lock);
1694}
1695
Denis Chengdf018122007-12-07 00:51:11 -08001696static LIST_HEAD(xfrm_km_list);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001697
David S. Miller214e0052011-02-24 00:02:38 -05001698void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001699{
1700 struct xfrm_mgr *km;
1701
Cong Wang85168c02013-01-16 16:05:06 +08001702 rcu_read_lock();
1703 list_for_each_entry_rcu(km, &xfrm_km_list, list)
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001704 if (km->notify_policy)
1705 km->notify_policy(xp, dir, c);
Cong Wang85168c02013-01-16 16:05:06 +08001706 rcu_read_unlock();
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001707}
1708
David S. Miller214e0052011-02-24 00:02:38 -05001709void km_state_notify(struct xfrm_state *x, const struct km_event *c)
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001710{
1711 struct xfrm_mgr *km;
Cong Wang85168c02013-01-16 16:05:06 +08001712 rcu_read_lock();
1713 list_for_each_entry_rcu(km, &xfrm_km_list, list)
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001714 if (km->notify)
1715 km->notify(x, c);
Cong Wang85168c02013-01-16 16:05:06 +08001716 rcu_read_unlock();
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001717}
1718
1719EXPORT_SYMBOL(km_policy_notify);
1720EXPORT_SYMBOL(km_state_notify);
1721
Eric W. Biederman15e47302012-09-07 20:12:54 +00001722void km_state_expired(struct xfrm_state *x, int hard, u32 portid)
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001723{
1724 struct km_event c;
1725
Herbert Xubf088672005-06-18 22:44:00 -07001726 c.data.hard = hard;
Eric W. Biederman15e47302012-09-07 20:12:54 +00001727 c.portid = portid;
Herbert Xuf60f6b82005-06-18 22:44:37 -07001728 c.event = XFRM_MSG_EXPIRE;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001729 km_state_notify(x, &c);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001730}
1731
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -08001732EXPORT_SYMBOL(km_state_expired);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001733/*
1734 * We send to all registered managers regardless of failure
1735 * We are happy with one success
1736*/
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -08001737int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001738{
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001739 int err = -EINVAL, acqret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001740 struct xfrm_mgr *km;
1741
Cong Wang85168c02013-01-16 16:05:06 +08001742 rcu_read_lock();
1743 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
Fan Du65e07362012-08-15 10:13:47 +08001744 acqret = km->acquire(x, t, pol);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001745 if (!acqret)
1746 err = acqret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001747 }
Cong Wang85168c02013-01-16 16:05:06 +08001748 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001749 return err;
1750}
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -08001751EXPORT_SYMBOL(km_query);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001752
Al Viro5d36b182006-11-08 00:24:06 -08001753int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001754{
1755 int err = -EINVAL;
1756 struct xfrm_mgr *km;
1757
Cong Wang85168c02013-01-16 16:05:06 +08001758 rcu_read_lock();
1759 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001760 if (km->new_mapping)
1761 err = km->new_mapping(x, ipaddr, sport);
1762 if (!err)
1763 break;
1764 }
Cong Wang85168c02013-01-16 16:05:06 +08001765 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001766 return err;
1767}
1768EXPORT_SYMBOL(km_new_mapping);
1769
Eric W. Biederman15e47302012-09-07 20:12:54 +00001770void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001771{
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001772 struct km_event c;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001773
Herbert Xubf088672005-06-18 22:44:00 -07001774 c.data.hard = hard;
Eric W. Biederman15e47302012-09-07 20:12:54 +00001775 c.portid = portid;
Herbert Xuf60f6b82005-06-18 22:44:37 -07001776 c.event = XFRM_MSG_POLEXPIRE;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001777 km_policy_notify(pol, dir, &c);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001778}
David S. Millera70fcb02006-03-20 19:18:52 -08001779EXPORT_SYMBOL(km_policy_expired);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001780
Eric Dumazet2d60abc2008-01-03 20:43:21 -08001781#ifdef CONFIG_XFRM_MIGRATE
David S. Miller183cad12011-02-24 00:28:01 -05001782int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1783 const struct xfrm_migrate *m, int num_migrate,
1784 const struct xfrm_kmaddress *k)
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001785{
1786 int err = -EINVAL;
1787 int ret;
1788 struct xfrm_mgr *km;
1789
Cong Wang85168c02013-01-16 16:05:06 +08001790 rcu_read_lock();
1791 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001792 if (km->migrate) {
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001793 ret = km->migrate(sel, dir, type, m, num_migrate, k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001794 if (!ret)
1795 err = ret;
1796 }
1797 }
Cong Wang85168c02013-01-16 16:05:06 +08001798 rcu_read_unlock();
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001799 return err;
1800}
1801EXPORT_SYMBOL(km_migrate);
Eric Dumazet2d60abc2008-01-03 20:43:21 -08001802#endif
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001803
Alexey Dobriyandb983c12008-11-25 17:51:01 -08001804int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
Masahide NAKAMURA97a64b42006-08-23 20:44:06 -07001805{
1806 int err = -EINVAL;
1807 int ret;
1808 struct xfrm_mgr *km;
1809
Cong Wang85168c02013-01-16 16:05:06 +08001810 rcu_read_lock();
1811 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
Masahide NAKAMURA97a64b42006-08-23 20:44:06 -07001812 if (km->report) {
Alexey Dobriyandb983c12008-11-25 17:51:01 -08001813 ret = km->report(net, proto, sel, addr);
Masahide NAKAMURA97a64b42006-08-23 20:44:06 -07001814 if (!ret)
1815 err = ret;
1816 }
1817 }
Cong Wang85168c02013-01-16 16:05:06 +08001818 rcu_read_unlock();
Masahide NAKAMURA97a64b42006-08-23 20:44:06 -07001819 return err;
1820}
1821EXPORT_SYMBOL(km_report);
1822
Horia Geanta0f245582014-02-12 16:20:06 +02001823bool km_is_alive(const struct km_event *c)
1824{
1825 struct xfrm_mgr *km;
1826 bool is_alive = false;
1827
1828 rcu_read_lock();
1829 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
1830 if (km->is_alive && km->is_alive(c)) {
1831 is_alive = true;
1832 break;
1833 }
1834 }
1835 rcu_read_unlock();
1836
1837 return is_alive;
1838}
1839EXPORT_SYMBOL(km_is_alive);
1840
Linus Torvalds1da177e2005-04-16 15:20:36 -07001841int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1842{
1843 int err;
1844 u8 *data;
1845 struct xfrm_mgr *km;
1846 struct xfrm_policy *pol = NULL;
1847
1848 if (optlen <= 0 || optlen > PAGE_SIZE)
1849 return -EMSGSIZE;
1850
1851 data = kmalloc(optlen, GFP_KERNEL);
1852 if (!data)
1853 return -ENOMEM;
1854
1855 err = -EFAULT;
1856 if (copy_from_user(data, optval, optlen))
1857 goto out;
1858
1859 err = -EINVAL;
Cong Wang85168c02013-01-16 16:05:06 +08001860 rcu_read_lock();
1861 list_for_each_entry_rcu(km, &xfrm_km_list, list) {
Venkat Yekkiralacb969f02006-07-24 23:32:20 -07001862 pol = km->compile_policy(sk, optname, data,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001863 optlen, &err);
1864 if (err >= 0)
1865 break;
1866 }
Cong Wang85168c02013-01-16 16:05:06 +08001867 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001868
1869 if (err >= 0) {
1870 xfrm_sk_policy_insert(sk, err, pol);
1871 xfrm_pol_put(pol);
1872 err = 0;
1873 }
1874
1875out:
1876 kfree(data);
1877 return err;
1878}
1879EXPORT_SYMBOL(xfrm_user_policy);
1880
Cong Wang85168c02013-01-16 16:05:06 +08001881static DEFINE_SPINLOCK(xfrm_km_lock);
1882
Linus Torvalds1da177e2005-04-16 15:20:36 -07001883int xfrm_register_km(struct xfrm_mgr *km)
1884{
Cong Wang85168c02013-01-16 16:05:06 +08001885 spin_lock_bh(&xfrm_km_lock);
1886 list_add_tail_rcu(&km->list, &xfrm_km_list);
1887 spin_unlock_bh(&xfrm_km_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001888 return 0;
1889}
1890EXPORT_SYMBOL(xfrm_register_km);
1891
1892int xfrm_unregister_km(struct xfrm_mgr *km)
1893{
Cong Wang85168c02013-01-16 16:05:06 +08001894 spin_lock_bh(&xfrm_km_lock);
1895 list_del_rcu(&km->list);
1896 spin_unlock_bh(&xfrm_km_lock);
1897 synchronize_rcu();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001898 return 0;
1899}
1900EXPORT_SYMBOL(xfrm_unregister_km);
1901
1902int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1903{
1904 int err = 0;
1905 if (unlikely(afinfo == NULL))
1906 return -EINVAL;
1907 if (unlikely(afinfo->family >= NPROTO))
1908 return -EAFNOSUPPORT;
Cong Wang44abdc32013-01-16 16:05:05 +08001909 spin_lock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001910 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
Li RongQingf31e8d4f2015-04-23 11:06:53 +08001911 err = -EEXIST;
David S. Milleredcd5822006-08-24 00:42:45 -07001912 else
Cong Wang44abdc32013-01-16 16:05:05 +08001913 rcu_assign_pointer(xfrm_state_afinfo[afinfo->family], afinfo);
1914 spin_unlock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001915 return err;
1916}
1917EXPORT_SYMBOL(xfrm_state_register_afinfo);
1918
1919int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1920{
1921 int err = 0;
1922 if (unlikely(afinfo == NULL))
1923 return -EINVAL;
1924 if (unlikely(afinfo->family >= NPROTO))
1925 return -EAFNOSUPPORT;
Cong Wang44abdc32013-01-16 16:05:05 +08001926 spin_lock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001927 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1928 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1929 err = -EINVAL;
David S. Milleredcd5822006-08-24 00:42:45 -07001930 else
Cong Wang44abdc32013-01-16 16:05:05 +08001931 RCU_INIT_POINTER(xfrm_state_afinfo[afinfo->family], NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001932 }
Cong Wang44abdc32013-01-16 16:05:05 +08001933 spin_unlock_bh(&xfrm_state_afinfo_lock);
1934 synchronize_rcu();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001935 return err;
1936}
1937EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1938
Hannes Frederic Sowa628e3412013-08-14 13:05:23 +02001939struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001940{
1941 struct xfrm_state_afinfo *afinfo;
1942 if (unlikely(family >= NPROTO))
1943 return NULL;
Cong Wang44abdc32013-01-16 16:05:05 +08001944 rcu_read_lock();
1945 afinfo = rcu_dereference(xfrm_state_afinfo[family]);
Herbert Xu546be242006-05-27 23:03:58 -07001946 if (unlikely(!afinfo))
Cong Wang44abdc32013-01-16 16:05:05 +08001947 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001948 return afinfo;
1949}
1950
Hannes Frederic Sowa628e3412013-08-14 13:05:23 +02001951void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001952{
Cong Wang44abdc32013-01-16 16:05:05 +08001953 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001954}
1955
1956/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1957void xfrm_state_delete_tunnel(struct xfrm_state *x)
1958{
1959 if (x->tunnel) {
1960 struct xfrm_state *t = x->tunnel;
1961
1962 if (atomic_read(&t->tunnel_users) == 2)
1963 xfrm_state_delete(t);
1964 atomic_dec(&t->tunnel_users);
1965 xfrm_state_put(t);
1966 x->tunnel = NULL;
1967 }
1968}
1969EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1970
1971int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1972{
Patrick McHardyc5c25232007-04-09 11:47:18 -07001973 int res;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001974
Patrick McHardyc5c25232007-04-09 11:47:18 -07001975 spin_lock_bh(&x->lock);
1976 if (x->km.state == XFRM_STATE_VALID &&
1977 x->type && x->type->get_mtu)
1978 res = x->type->get_mtu(x, mtu);
1979 else
Patrick McHardy28121612007-06-18 22:30:15 -07001980 res = mtu - x->props.header_len;
Patrick McHardyc5c25232007-04-09 11:47:18 -07001981 spin_unlock_bh(&x->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001982 return res;
1983}
1984
Wei Yongjuna454f0c2011-03-21 18:08:28 -07001985int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
Herbert Xu72cb6962005-06-20 13:18:08 -07001986{
Herbert Xud094cd82005-06-20 13:19:41 -07001987 struct xfrm_state_afinfo *afinfo;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07001988 struct xfrm_mode *inner_mode;
Herbert Xud094cd82005-06-20 13:19:41 -07001989 int family = x->props.family;
Herbert Xu72cb6962005-06-20 13:18:08 -07001990 int err;
1991
Herbert Xud094cd82005-06-20 13:19:41 -07001992 err = -EAFNOSUPPORT;
1993 afinfo = xfrm_state_get_afinfo(family);
1994 if (!afinfo)
1995 goto error;
1996
1997 err = 0;
1998 if (afinfo->init_flags)
1999 err = afinfo->init_flags(x);
2000
2001 xfrm_state_put_afinfo(afinfo);
2002
2003 if (err)
2004 goto error;
2005
2006 err = -EPROTONOSUPPORT;
Herbert Xu13996372007-10-17 21:35:51 -07002007
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07002008 if (x->sel.family != AF_UNSPEC) {
2009 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2010 if (inner_mode == NULL)
2011 goto error;
2012
2013 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2014 family != x->sel.family) {
2015 xfrm_put_mode(inner_mode);
2016 goto error;
2017 }
2018
2019 x->inner_mode = inner_mode;
2020 } else {
2021 struct xfrm_mode *inner_mode_iaf;
Martin Willid81d2282008-12-03 15:38:07 -08002022 int iafamily = AF_INET;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07002023
Martin Willid81d2282008-12-03 15:38:07 -08002024 inner_mode = xfrm_get_mode(x->props.mode, x->props.family);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07002025 if (inner_mode == NULL)
2026 goto error;
2027
2028 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2029 xfrm_put_mode(inner_mode);
2030 goto error;
2031 }
Martin Willid81d2282008-12-03 15:38:07 -08002032 x->inner_mode = inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07002033
Martin Willid81d2282008-12-03 15:38:07 -08002034 if (x->props.family == AF_INET)
2035 iafamily = AF_INET6;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07002036
Martin Willid81d2282008-12-03 15:38:07 -08002037 inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily);
2038 if (inner_mode_iaf) {
2039 if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)
2040 x->inner_mode_iaf = inner_mode_iaf;
2041 else
2042 xfrm_put_mode(inner_mode_iaf);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07002043 }
2044 }
Herbert Xu13996372007-10-17 21:35:51 -07002045
Herbert Xud094cd82005-06-20 13:19:41 -07002046 x->type = xfrm_get_type(x->id.proto, family);
Herbert Xu72cb6962005-06-20 13:18:08 -07002047 if (x->type == NULL)
2048 goto error;
2049
2050 err = x->type->init_state(x);
2051 if (err)
2052 goto error;
2053
Herbert Xu13996372007-10-17 21:35:51 -07002054 x->outer_mode = xfrm_get_mode(x->props.mode, family);
Julia Lawall599901c2012-08-29 06:49:15 +00002055 if (x->outer_mode == NULL) {
2056 err = -EPROTONOSUPPORT;
Herbert Xub59f45d2006-05-27 23:05:54 -07002057 goto error;
Julia Lawall599901c2012-08-29 06:49:15 +00002058 }
Herbert Xub59f45d2006-05-27 23:05:54 -07002059
Wei Yongjuna454f0c2011-03-21 18:08:28 -07002060 if (init_replay) {
2061 err = xfrm_init_replay(x);
2062 if (err)
2063 goto error;
2064 }
2065
Herbert Xu72cb6962005-06-20 13:18:08 -07002066 x->km.state = XFRM_STATE_VALID;
2067
2068error:
2069 return err;
2070}
2071
Wei Yongjuna454f0c2011-03-21 18:08:28 -07002072EXPORT_SYMBOL(__xfrm_init_state);
2073
2074int xfrm_init_state(struct xfrm_state *x)
2075{
2076 return __xfrm_init_state(x, true);
2077}
2078
Herbert Xu72cb6962005-06-20 13:18:08 -07002079EXPORT_SYMBOL(xfrm_init_state);
YOSHIFUJI Hideakia716c112007-02-09 23:25:29 +09002080
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08002081int __net_init xfrm_state_init(struct net *net)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002082{
David S. Millerf034b5d2006-08-24 03:08:07 -07002083 unsigned int sz;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002084
Alexey Dobriyan9d4139c2008-11-25 17:16:11 -08002085 INIT_LIST_HEAD(&net->xfrm.state_all);
2086
David S. Millerf034b5d2006-08-24 03:08:07 -07002087 sz = sizeof(struct hlist_head) * 8;
2088
Alexey Dobriyan73d189d2008-11-25 17:16:58 -08002089 net->xfrm.state_bydst = xfrm_hash_alloc(sz);
2090 if (!net->xfrm.state_bydst)
2091 goto out_bydst;
Alexey Dobriyand320bbb2008-11-25 17:17:24 -08002092 net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
2093 if (!net->xfrm.state_bysrc)
2094 goto out_bysrc;
Alexey Dobriyanb754a4f2008-11-25 17:17:47 -08002095 net->xfrm.state_byspi = xfrm_hash_alloc(sz);
2096 if (!net->xfrm.state_byspi)
2097 goto out_byspi;
Alexey Dobriyan529983e2008-11-25 17:18:12 -08002098 net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
David S. Millerf034b5d2006-08-24 03:08:07 -07002099
Alexey Dobriyan0bf7c5b2008-11-25 17:18:39 -08002100 net->xfrm.state_num = 0;
Alexey Dobriyan63082732008-11-25 17:19:07 -08002101 INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
Alexey Dobriyanb8a0ae22008-11-25 17:20:11 -08002102 INIT_HLIST_HEAD(&net->xfrm.state_gc_list);
Alexey Dobriyanc7837142008-11-25 17:20:36 -08002103 INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
Fan Du283bc9f2013-11-07 17:47:50 +08002104 spin_lock_init(&net->xfrm.xfrm_state_lock);
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08002105 return 0;
Alexey Dobriyan73d189d2008-11-25 17:16:58 -08002106
Alexey Dobriyanb754a4f2008-11-25 17:17:47 -08002107out_byspi:
2108 xfrm_hash_free(net->xfrm.state_bysrc, sz);
Alexey Dobriyand320bbb2008-11-25 17:17:24 -08002109out_bysrc:
2110 xfrm_hash_free(net->xfrm.state_bydst, sz);
Alexey Dobriyan73d189d2008-11-25 17:16:58 -08002111out_bydst:
2112 return -ENOMEM;
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08002113}
2114
2115void xfrm_state_fini(struct net *net)
2116{
Alexey Dobriyan73d189d2008-11-25 17:16:58 -08002117 unsigned int sz;
2118
Alexey Dobriyan7c2776e2008-11-25 17:57:44 -08002119 flush_work(&net->xfrm.state_hash_work);
Tetsuo Handa2e710292014-04-22 21:48:30 +09002120 xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
Alexey Dobriyan7c2776e2008-11-25 17:57:44 -08002121 flush_work(&net->xfrm.state_gc_work);
2122
Alexey Dobriyan9d4139c2008-11-25 17:16:11 -08002123 WARN_ON(!list_empty(&net->xfrm.state_all));
Alexey Dobriyan73d189d2008-11-25 17:16:58 -08002124
Alexey Dobriyan529983e2008-11-25 17:18:12 -08002125 sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
Alexey Dobriyanb754a4f2008-11-25 17:17:47 -08002126 WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2127 xfrm_hash_free(net->xfrm.state_byspi, sz);
Alexey Dobriyand320bbb2008-11-25 17:17:24 -08002128 WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2129 xfrm_hash_free(net->xfrm.state_bysrc, sz);
Alexey Dobriyan73d189d2008-11-25 17:16:58 -08002130 WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2131 xfrm_hash_free(net->xfrm.state_bydst, sz);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002132}
2133
Joy Lattenab5f5e82007-09-17 11:51:22 -07002134#ifdef CONFIG_AUDITSYSCALL
Ilpo Järvinencf35f432008-01-05 23:13:20 -08002135static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2136 struct audit_buffer *audit_buf)
Joy Lattenab5f5e82007-09-17 11:51:22 -07002137{
Paul Moore68277ac2007-12-20 20:49:33 -08002138 struct xfrm_sec_ctx *ctx = x->security;
2139 u32 spi = ntohl(x->id.spi);
2140
2141 if (ctx)
Joy Lattenab5f5e82007-09-17 11:51:22 -07002142 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
Paul Moore68277ac2007-12-20 20:49:33 -08002143 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
Joy Lattenab5f5e82007-09-17 11:51:22 -07002144
Weilong Chen9b7a7872013-12-24 09:43:46 +08002145 switch (x->props.family) {
Joy Lattenab5f5e82007-09-17 11:51:22 -07002146 case AF_INET:
Harvey Harrison21454aa2008-10-31 00:54:56 -07002147 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2148 &x->props.saddr.a4, &x->id.daddr.a4);
Joy Lattenab5f5e82007-09-17 11:51:22 -07002149 break;
2150 case AF_INET6:
Harvey Harrison5b095d9892008-10-29 12:52:50 -07002151 audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
Harvey Harrisonfdb46ee2008-10-28 16:10:17 -07002152 x->props.saddr.a6, x->id.daddr.a6);
Joy Lattenab5f5e82007-09-17 11:51:22 -07002153 break;
2154 }
Paul Moore68277ac2007-12-20 20:49:33 -08002155
2156 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
Joy Lattenab5f5e82007-09-17 11:51:22 -07002157}
2158
Ilpo Järvinencf35f432008-01-05 23:13:20 -08002159static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2160 struct audit_buffer *audit_buf)
Paul Mooreafeb14b2007-12-21 14:58:11 -08002161{
Eric Dumazetb71d1d42011-04-22 04:53:02 +00002162 const struct iphdr *iph4;
2163 const struct ipv6hdr *iph6;
Paul Mooreafeb14b2007-12-21 14:58:11 -08002164
2165 switch (family) {
2166 case AF_INET:
2167 iph4 = ip_hdr(skb);
Harvey Harrison21454aa2008-10-31 00:54:56 -07002168 audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2169 &iph4->saddr, &iph4->daddr);
Paul Mooreafeb14b2007-12-21 14:58:11 -08002170 break;
2171 case AF_INET6:
2172 iph6 = ipv6_hdr(skb);
2173 audit_log_format(audit_buf,
Harvey Harrison5b095d9892008-10-29 12:52:50 -07002174 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
Weilong Chen9b7a7872013-12-24 09:43:46 +08002175 &iph6->saddr, &iph6->daddr,
Paul Mooreafeb14b2007-12-21 14:58:11 -08002176 iph6->flow_lbl[0] & 0x0f,
2177 iph6->flow_lbl[1],
2178 iph6->flow_lbl[2]);
2179 break;
2180 }
2181}
2182
Tetsuo Handa2e710292014-04-22 21:48:30 +09002183void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid)
Joy Lattenab5f5e82007-09-17 11:51:22 -07002184{
2185 struct audit_buffer *audit_buf;
Joy Lattenab5f5e82007-09-17 11:51:22 -07002186
Paul Mooreafeb14b2007-12-21 14:58:11 -08002187 audit_buf = xfrm_audit_start("SAD-add");
Joy Lattenab5f5e82007-09-17 11:51:22 -07002188 if (audit_buf == NULL)
2189 return;
Tetsuo Handa2e710292014-04-22 21:48:30 +09002190 xfrm_audit_helper_usrinfo(task_valid, audit_buf);
Paul Mooreafeb14b2007-12-21 14:58:11 -08002191 xfrm_audit_helper_sainfo(x, audit_buf);
2192 audit_log_format(audit_buf, " res=%u", result);
Joy Lattenab5f5e82007-09-17 11:51:22 -07002193 audit_log_end(audit_buf);
2194}
2195EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2196
Tetsuo Handa2e710292014-04-22 21:48:30 +09002197void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid)
Joy Lattenab5f5e82007-09-17 11:51:22 -07002198{
2199 struct audit_buffer *audit_buf;
Joy Lattenab5f5e82007-09-17 11:51:22 -07002200
Paul Mooreafeb14b2007-12-21 14:58:11 -08002201 audit_buf = xfrm_audit_start("SAD-delete");
Joy Lattenab5f5e82007-09-17 11:51:22 -07002202 if (audit_buf == NULL)
2203 return;
Tetsuo Handa2e710292014-04-22 21:48:30 +09002204 xfrm_audit_helper_usrinfo(task_valid, audit_buf);
Paul Mooreafeb14b2007-12-21 14:58:11 -08002205 xfrm_audit_helper_sainfo(x, audit_buf);
2206 audit_log_format(audit_buf, " res=%u", result);
Joy Lattenab5f5e82007-09-17 11:51:22 -07002207 audit_log_end(audit_buf);
2208}
2209EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
Paul Mooreafeb14b2007-12-21 14:58:11 -08002210
2211void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2212 struct sk_buff *skb)
2213{
2214 struct audit_buffer *audit_buf;
2215 u32 spi;
2216
2217 audit_buf = xfrm_audit_start("SA-replay-overflow");
2218 if (audit_buf == NULL)
2219 return;
2220 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2221 /* don't record the sequence number because it's inherent in this kind
2222 * of audit message */
2223 spi = ntohl(x->id.spi);
2224 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2225 audit_log_end(audit_buf);
2226}
2227EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2228
Steffen Klassert9fdc4882011-03-08 00:08:32 +00002229void xfrm_audit_state_replay(struct xfrm_state *x,
Paul Mooreafeb14b2007-12-21 14:58:11 -08002230 struct sk_buff *skb, __be32 net_seq)
2231{
2232 struct audit_buffer *audit_buf;
2233 u32 spi;
2234
2235 audit_buf = xfrm_audit_start("SA-replayed-pkt");
2236 if (audit_buf == NULL)
2237 return;
2238 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2239 spi = ntohl(x->id.spi);
2240 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2241 spi, spi, ntohl(net_seq));
2242 audit_log_end(audit_buf);
2243}
Steffen Klassert9fdc4882011-03-08 00:08:32 +00002244EXPORT_SYMBOL_GPL(xfrm_audit_state_replay);
Paul Mooreafeb14b2007-12-21 14:58:11 -08002245
2246void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2247{
2248 struct audit_buffer *audit_buf;
2249
2250 audit_buf = xfrm_audit_start("SA-notfound");
2251 if (audit_buf == NULL)
2252 return;
2253 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2254 audit_log_end(audit_buf);
2255}
2256EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2257
2258void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2259 __be32 net_spi, __be32 net_seq)
2260{
2261 struct audit_buffer *audit_buf;
2262 u32 spi;
2263
2264 audit_buf = xfrm_audit_start("SA-notfound");
2265 if (audit_buf == NULL)
2266 return;
2267 xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2268 spi = ntohl(net_spi);
2269 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2270 spi, spi, ntohl(net_seq));
2271 audit_log_end(audit_buf);
2272}
2273EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2274
2275void xfrm_audit_state_icvfail(struct xfrm_state *x,
2276 struct sk_buff *skb, u8 proto)
2277{
2278 struct audit_buffer *audit_buf;
2279 __be32 net_spi;
2280 __be32 net_seq;
2281
2282 audit_buf = xfrm_audit_start("SA-icv-failure");
2283 if (audit_buf == NULL)
2284 return;
2285 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2286 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2287 u32 spi = ntohl(net_spi);
2288 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2289 spi, spi, ntohl(net_seq));
2290 }
2291 audit_log_end(audit_buf);
2292}
2293EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
Joy Lattenab5f5e82007-09-17 11:51:22 -07002294#endif /* CONFIG_AUDITSYSCALL */