1 /* 2 * xfrm_policy.c 3 * 4 * Changes: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * Kazunori MIYAZAWA @USAGI 10 * YOSHIFUJI Hideaki 11 * Split up af-specific portion 12 * Derek Atkins <derek@ihtfp.com> Add the post_input processor 13 * 14 */ 15 16 #include <linux/slab.h> 17 #include <linux/kmod.h> 18 #include <linux/list.h> 19 #include <linux/spinlock.h> 20 #include <linux/workqueue.h> 21 #include <linux/notifier.h> 22 #include <linux/netdevice.h> 23 #include <linux/netfilter.h> 24 #include <linux/module.h> 25 #include <linux/cache.h> 26 #include <net/xfrm.h> 27 #include <net/ip.h> 28 29 #include "xfrm_hash.h" 30 31 int sysctl_xfrm_larval_drop __read_mostly; 32 33 DEFINE_MUTEX(xfrm_cfg_mutex); 34 EXPORT_SYMBOL(xfrm_cfg_mutex); 35 36 static DEFINE_RWLOCK(xfrm_policy_lock); 37 38 unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2]; 39 EXPORT_SYMBOL(xfrm_policy_count); 40 41 static DEFINE_RWLOCK(xfrm_policy_afinfo_lock); 42 static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO]; 43 44 static struct kmem_cache *xfrm_dst_cache __read_mostly; 45 46 static struct work_struct xfrm_policy_gc_work; 47 static HLIST_HEAD(xfrm_policy_gc_list); 48 static DEFINE_SPINLOCK(xfrm_policy_gc_lock); 49 50 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family); 51 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo); 52 static struct xfrm_policy_afinfo *xfrm_policy_lock_afinfo(unsigned int family); 53 static void xfrm_policy_unlock_afinfo(struct xfrm_policy_afinfo *afinfo); 54 55 static inline int 56 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl) 57 { 58 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) && 59 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) && 60 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 61 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 62 (fl->proto == sel->proto || !sel->proto) && 63 (fl->oif == sel->ifindex || !sel->ifindex); 64 } 65 66 static inline int 67 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl) 68 { 69 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) && 70 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) && 71 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 72 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 73 (fl->proto == sel->proto || !sel->proto) && 74 (fl->oif == sel->ifindex || !sel->ifindex); 75 } 76 77 int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl, 78 unsigned short family) 79 { 80 switch (family) { 81 case AF_INET: 82 return __xfrm4_selector_match(sel, fl); 83 case AF_INET6: 84 return __xfrm6_selector_match(sel, fl); 85 } 86 return 0; 87 } 88 89 int xfrm_register_type(struct xfrm_type *type, unsigned short family) 90 { 91 struct xfrm_policy_afinfo *afinfo = xfrm_policy_lock_afinfo(family); 92 struct xfrm_type **typemap; 93 int err = 0; 94 95 if (unlikely(afinfo == NULL)) 96 return -EAFNOSUPPORT; 97 typemap = afinfo->type_map; 98 99 if (likely(typemap[type->proto] == NULL)) 100 typemap[type->proto] = type; 101 else 102 err = -EEXIST; 103 xfrm_policy_unlock_afinfo(afinfo); 104 return err; 105 } 106 EXPORT_SYMBOL(xfrm_register_type); 107 108 int xfrm_unregister_type(struct xfrm_type *type, unsigned short family) 109 { 110 struct xfrm_policy_afinfo *afinfo = xfrm_policy_lock_afinfo(family); 111 struct xfrm_type **typemap; 112 int err = 0; 113 114 if (unlikely(afinfo == NULL)) 115 return -EAFNOSUPPORT; 116 typemap = afinfo->type_map; 117 118 if (unlikely(typemap[type->proto] != type)) 119 err = -ENOENT; 120 else 121 typemap[type->proto] = NULL; 122 xfrm_policy_unlock_afinfo(afinfo); 123 return err; 124 } 125 EXPORT_SYMBOL(xfrm_unregister_type); 126 127 struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family) 128 { 129 struct xfrm_policy_afinfo *afinfo; 130 struct xfrm_type **typemap; 131 struct xfrm_type *type; 132 int modload_attempted = 0; 133 134 retry: 135 afinfo = xfrm_policy_get_afinfo(family); 136 if (unlikely(afinfo == NULL)) 137 return NULL; 138 typemap = afinfo->type_map; 139 140 type = typemap[proto]; 141 if (unlikely(type && !try_module_get(type->owner))) 142 type = NULL; 143 if (!type && !modload_attempted) { 144 xfrm_policy_put_afinfo(afinfo); 145 request_module("xfrm-type-%d-%d", 146 (int) family, (int) proto); 147 modload_attempted = 1; 148 goto retry; 149 } 150 151 xfrm_policy_put_afinfo(afinfo); 152 return type; 153 } 154 155 int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, 156 unsigned short family) 157 { 158 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 159 int err = 0; 160 161 if (unlikely(afinfo == NULL)) 162 return -EAFNOSUPPORT; 163 164 if (likely(afinfo->dst_lookup != NULL)) 165 err = afinfo->dst_lookup(dst, fl); 166 else 167 err = -EINVAL; 168 xfrm_policy_put_afinfo(afinfo); 169 return err; 170 } 171 EXPORT_SYMBOL(xfrm_dst_lookup); 172 173 void xfrm_put_type(struct xfrm_type *type) 174 { 175 module_put(type->owner); 176 } 177 178 int xfrm_register_mode(struct xfrm_mode *mode, int family) 179 { 180 struct xfrm_policy_afinfo *afinfo; 181 struct xfrm_mode **modemap; 182 int err; 183 184 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 185 return -EINVAL; 186 187 afinfo = xfrm_policy_lock_afinfo(family); 188 if (unlikely(afinfo == NULL)) 189 return -EAFNOSUPPORT; 190 191 err = -EEXIST; 192 modemap = afinfo->mode_map; 193 if (likely(modemap[mode->encap] == NULL)) { 194 modemap[mode->encap] = mode; 195 err = 0; 196 } 197 198 xfrm_policy_unlock_afinfo(afinfo); 199 return err; 200 } 201 EXPORT_SYMBOL(xfrm_register_mode); 202 203 int xfrm_unregister_mode(struct xfrm_mode *mode, int family) 204 { 205 struct xfrm_policy_afinfo *afinfo; 206 struct xfrm_mode **modemap; 207 int err; 208 209 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 210 return -EINVAL; 211 212 afinfo = xfrm_policy_lock_afinfo(family); 213 if (unlikely(afinfo == NULL)) 214 return -EAFNOSUPPORT; 215 216 err = -ENOENT; 217 modemap = afinfo->mode_map; 218 if (likely(modemap[mode->encap] == mode)) { 219 modemap[mode->encap] = NULL; 220 err = 0; 221 } 222 223 xfrm_policy_unlock_afinfo(afinfo); 224 return err; 225 } 226 EXPORT_SYMBOL(xfrm_unregister_mode); 227 228 struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family) 229 { 230 struct xfrm_policy_afinfo *afinfo; 231 struct xfrm_mode *mode; 232 int modload_attempted = 0; 233 234 if (unlikely(encap >= XFRM_MODE_MAX)) 235 return NULL; 236 237 retry: 238 afinfo = xfrm_policy_get_afinfo(family); 239 if (unlikely(afinfo == NULL)) 240 return NULL; 241 242 mode = afinfo->mode_map[encap]; 243 if (unlikely(mode && !try_module_get(mode->owner))) 244 mode = NULL; 245 if (!mode && !modload_attempted) { 246 xfrm_policy_put_afinfo(afinfo); 247 request_module("xfrm-mode-%d-%d", family, encap); 248 modload_attempted = 1; 249 goto retry; 250 } 251 252 xfrm_policy_put_afinfo(afinfo); 253 return mode; 254 } 255 256 void xfrm_put_mode(struct xfrm_mode *mode) 257 { 258 module_put(mode->owner); 259 } 260 261 static inline unsigned long make_jiffies(long secs) 262 { 263 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ) 264 return MAX_SCHEDULE_TIMEOUT-1; 265 else 266 return secs*HZ; 267 } 268 269 static void xfrm_policy_timer(unsigned long data) 270 { 271 struct xfrm_policy *xp = (struct xfrm_policy*)data; 272 unsigned long now = get_seconds(); 273 long next = LONG_MAX; 274 int warn = 0; 275 int dir; 276 277 read_lock(&xp->lock); 278 279 if (xp->dead) 280 goto out; 281 282 dir = xfrm_policy_id2dir(xp->index); 283 284 if (xp->lft.hard_add_expires_seconds) { 285 long tmo = xp->lft.hard_add_expires_seconds + 286 xp->curlft.add_time - now; 287 if (tmo <= 0) 288 goto expired; 289 if (tmo < next) 290 next = tmo; 291 } 292 if (xp->lft.hard_use_expires_seconds) { 293 long tmo = xp->lft.hard_use_expires_seconds + 294 (xp->curlft.use_time ? : xp->curlft.add_time) - now; 295 if (tmo <= 0) 296 goto expired; 297 if (tmo < next) 298 next = tmo; 299 } 300 if (xp->lft.soft_add_expires_seconds) { 301 long tmo = xp->lft.soft_add_expires_seconds + 302 xp->curlft.add_time - now; 303 if (tmo <= 0) { 304 warn = 1; 305 tmo = XFRM_KM_TIMEOUT; 306 } 307 if (tmo < next) 308 next = tmo; 309 } 310 if (xp->lft.soft_use_expires_seconds) { 311 long tmo = xp->lft.soft_use_expires_seconds + 312 (xp->curlft.use_time ? : xp->curlft.add_time) - now; 313 if (tmo <= 0) { 314 warn = 1; 315 tmo = XFRM_KM_TIMEOUT; 316 } 317 if (tmo < next) 318 next = tmo; 319 } 320 321 if (warn) 322 km_policy_expired(xp, dir, 0, 0); 323 if (next != LONG_MAX && 324 !mod_timer(&xp->timer, jiffies + make_jiffies(next))) 325 xfrm_pol_hold(xp); 326 327 out: 328 read_unlock(&xp->lock); 329 xfrm_pol_put(xp); 330 return; 331 332 expired: 333 read_unlock(&xp->lock); 334 if (!xfrm_policy_delete(xp, dir)) 335 km_policy_expired(xp, dir, 1, 0); 336 xfrm_pol_put(xp); 337 } 338 339 340 /* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2 341 * SPD calls. 342 */ 343 344 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp) 345 { 346 struct xfrm_policy *policy; 347 348 policy = kzalloc(sizeof(struct xfrm_policy), gfp); 349 350 if (policy) { 351 INIT_HLIST_NODE(&policy->bydst); 352 INIT_HLIST_NODE(&policy->byidx); 353 rwlock_init(&policy->lock); 354 atomic_set(&policy->refcnt, 1); 355 init_timer(&policy->timer); 356 policy->timer.data = (unsigned long)policy; 357 policy->timer.function = xfrm_policy_timer; 358 } 359 return policy; 360 } 361 EXPORT_SYMBOL(xfrm_policy_alloc); 362 363 /* Destroy xfrm_policy: descendant resources must be released to this moment. */ 364 365 void __xfrm_policy_destroy(struct xfrm_policy *policy) 366 { 367 BUG_ON(!policy->dead); 368 369 BUG_ON(policy->bundles); 370 371 if (del_timer(&policy->timer)) 372 BUG(); 373 374 security_xfrm_policy_free(policy); 375 kfree(policy); 376 } 377 EXPORT_SYMBOL(__xfrm_policy_destroy); 378 379 static void xfrm_policy_gc_kill(struct xfrm_policy *policy) 380 { 381 struct dst_entry *dst; 382 383 while ((dst = policy->bundles) != NULL) { 384 policy->bundles = dst->next; 385 dst_free(dst); 386 } 387 388 if (del_timer(&policy->timer)) 389 atomic_dec(&policy->refcnt); 390 391 if (atomic_read(&policy->refcnt) > 1) 392 flow_cache_flush(); 393 394 xfrm_pol_put(policy); 395 } 396 397 static void xfrm_policy_gc_task(struct work_struct *work) 398 { 399 struct xfrm_policy *policy; 400 struct hlist_node *entry, *tmp; 401 struct hlist_head gc_list; 402 403 spin_lock_bh(&xfrm_policy_gc_lock); 404 gc_list.first = xfrm_policy_gc_list.first; 405 INIT_HLIST_HEAD(&xfrm_policy_gc_list); 406 spin_unlock_bh(&xfrm_policy_gc_lock); 407 408 hlist_for_each_entry_safe(policy, entry, tmp, &gc_list, bydst) 409 xfrm_policy_gc_kill(policy); 410 } 411 412 /* Rule must be locked. Release descentant resources, announce 413 * entry dead. The rule must be unlinked from lists to the moment. 414 */ 415 416 static void xfrm_policy_kill(struct xfrm_policy *policy) 417 { 418 int dead; 419 420 write_lock_bh(&policy->lock); 421 dead = policy->dead; 422 policy->dead = 1; 423 write_unlock_bh(&policy->lock); 424 425 if (unlikely(dead)) { 426 WARN_ON(1); 427 return; 428 } 429 430 spin_lock(&xfrm_policy_gc_lock); 431 hlist_add_head(&policy->bydst, &xfrm_policy_gc_list); 432 spin_unlock(&xfrm_policy_gc_lock); 433 434 schedule_work(&xfrm_policy_gc_work); 435 } 436 437 struct xfrm_policy_hash { 438 struct hlist_head *table; 439 unsigned int hmask; 440 }; 441 442 static struct hlist_head xfrm_policy_inexact[XFRM_POLICY_MAX*2]; 443 static struct xfrm_policy_hash xfrm_policy_bydst[XFRM_POLICY_MAX*2] __read_mostly; 444 static struct hlist_head *xfrm_policy_byidx __read_mostly; 445 static unsigned int xfrm_idx_hmask __read_mostly; 446 static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024; 447 448 static inline unsigned int idx_hash(u32 index) 449 { 450 return __idx_hash(index, xfrm_idx_hmask); 451 } 452 453 static struct hlist_head *policy_hash_bysel(struct xfrm_selector *sel, unsigned short family, int dir) 454 { 455 unsigned int hmask = xfrm_policy_bydst[dir].hmask; 456 unsigned int hash = __sel_hash(sel, family, hmask); 457 458 return (hash == hmask + 1 ? 459 &xfrm_policy_inexact[dir] : 460 xfrm_policy_bydst[dir].table + hash); 461 } 462 463 static struct hlist_head *policy_hash_direct(xfrm_address_t *daddr, xfrm_address_t *saddr, unsigned short family, int dir) 464 { 465 unsigned int hmask = xfrm_policy_bydst[dir].hmask; 466 unsigned int hash = __addr_hash(daddr, saddr, family, hmask); 467 468 return xfrm_policy_bydst[dir].table + hash; 469 } 470 471 static void xfrm_dst_hash_transfer(struct hlist_head *list, 472 struct hlist_head *ndsttable, 473 unsigned int nhashmask) 474 { 475 struct hlist_node *entry, *tmp; 476 struct xfrm_policy *pol; 477 478 hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) { 479 unsigned int h; 480 481 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr, 482 pol->family, nhashmask); 483 hlist_add_head(&pol->bydst, ndsttable+h); 484 } 485 } 486 487 static void xfrm_idx_hash_transfer(struct hlist_head *list, 488 struct hlist_head *nidxtable, 489 unsigned int nhashmask) 490 { 491 struct hlist_node *entry, *tmp; 492 struct xfrm_policy *pol; 493 494 hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) { 495 unsigned int h; 496 497 h = __idx_hash(pol->index, nhashmask); 498 hlist_add_head(&pol->byidx, nidxtable+h); 499 } 500 } 501 502 static unsigned long xfrm_new_hash_mask(unsigned int old_hmask) 503 { 504 return ((old_hmask + 1) << 1) - 1; 505 } 506 507 static void xfrm_bydst_resize(int dir) 508 { 509 unsigned int hmask = xfrm_policy_bydst[dir].hmask; 510 unsigned int nhashmask = xfrm_new_hash_mask(hmask); 511 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head); 512 struct hlist_head *odst = xfrm_policy_bydst[dir].table; 513 struct hlist_head *ndst = xfrm_hash_alloc(nsize); 514 int i; 515 516 if (!ndst) 517 return; 518 519 write_lock_bh(&xfrm_policy_lock); 520 521 for (i = hmask; i >= 0; i--) 522 xfrm_dst_hash_transfer(odst + i, ndst, nhashmask); 523 524 xfrm_policy_bydst[dir].table = ndst; 525 xfrm_policy_bydst[dir].hmask = nhashmask; 526 527 write_unlock_bh(&xfrm_policy_lock); 528 529 xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head)); 530 } 531 532 static void xfrm_byidx_resize(int total) 533 { 534 unsigned int hmask = xfrm_idx_hmask; 535 unsigned int nhashmask = xfrm_new_hash_mask(hmask); 536 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head); 537 struct hlist_head *oidx = xfrm_policy_byidx; 538 struct hlist_head *nidx = xfrm_hash_alloc(nsize); 539 int i; 540 541 if (!nidx) 542 return; 543 544 write_lock_bh(&xfrm_policy_lock); 545 546 for (i = hmask; i >= 0; i--) 547 xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask); 548 549 xfrm_policy_byidx = nidx; 550 xfrm_idx_hmask = nhashmask; 551 552 write_unlock_bh(&xfrm_policy_lock); 553 554 xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head)); 555 } 556 557 static inline int xfrm_bydst_should_resize(int dir, int *total) 558 { 559 unsigned int cnt = xfrm_policy_count[dir]; 560 unsigned int hmask = xfrm_policy_bydst[dir].hmask; 561 562 if (total) 563 *total += cnt; 564 565 if ((hmask + 1) < xfrm_policy_hashmax && 566 cnt > hmask) 567 return 1; 568 569 return 0; 570 } 571 572 static inline int xfrm_byidx_should_resize(int total) 573 { 574 unsigned int hmask = xfrm_idx_hmask; 575 576 if ((hmask + 1) < xfrm_policy_hashmax && 577 total > hmask) 578 return 1; 579 580 return 0; 581 } 582 583 void xfrm_spd_getinfo(struct xfrmk_spdinfo *si) 584 { 585 read_lock_bh(&xfrm_policy_lock); 586 si->incnt = xfrm_policy_count[XFRM_POLICY_IN]; 587 si->outcnt = xfrm_policy_count[XFRM_POLICY_OUT]; 588 si->fwdcnt = xfrm_policy_count[XFRM_POLICY_FWD]; 589 si->inscnt = xfrm_policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX]; 590 si->outscnt = xfrm_policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX]; 591 si->fwdscnt = xfrm_policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX]; 592 si->spdhcnt = xfrm_idx_hmask; 593 si->spdhmcnt = xfrm_policy_hashmax; 594 read_unlock_bh(&xfrm_policy_lock); 595 } 596 EXPORT_SYMBOL(xfrm_spd_getinfo); 597 598 static DEFINE_MUTEX(hash_resize_mutex); 599 static void xfrm_hash_resize(struct work_struct *__unused) 600 { 601 int dir, total; 602 603 mutex_lock(&hash_resize_mutex); 604 605 total = 0; 606 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 607 if (xfrm_bydst_should_resize(dir, &total)) 608 xfrm_bydst_resize(dir); 609 } 610 if (xfrm_byidx_should_resize(total)) 611 xfrm_byidx_resize(total); 612 613 mutex_unlock(&hash_resize_mutex); 614 } 615 616 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize); 617 618 /* Generate new index... KAME seems to generate them ordered by cost 619 * of an absolute inpredictability of ordering of rules. This will not pass. */ 620 static u32 xfrm_gen_index(u8 type, int dir) 621 { 622 static u32 idx_generator; 623 624 for (;;) { 625 struct hlist_node *entry; 626 struct hlist_head *list; 627 struct xfrm_policy *p; 628 u32 idx; 629 int found; 630 631 idx = (idx_generator | dir); 632 idx_generator += 8; 633 if (idx == 0) 634 idx = 8; 635 list = xfrm_policy_byidx + idx_hash(idx); 636 found = 0; 637 hlist_for_each_entry(p, entry, list, byidx) { 638 if (p->index == idx) { 639 found = 1; 640 break; 641 } 642 } 643 if (!found) 644 return idx; 645 } 646 } 647 648 static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s2) 649 { 650 u32 *p1 = (u32 *) s1; 651 u32 *p2 = (u32 *) s2; 652 int len = sizeof(struct xfrm_selector) / sizeof(u32); 653 int i; 654 655 for (i = 0; i < len; i++) { 656 if (p1[i] != p2[i]) 657 return 1; 658 } 659 660 return 0; 661 } 662 663 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) 664 { 665 struct xfrm_policy *pol; 666 struct xfrm_policy *delpol; 667 struct hlist_head *chain; 668 struct hlist_node *entry, *newpos; 669 struct dst_entry *gc_list; 670 671 write_lock_bh(&xfrm_policy_lock); 672 chain = policy_hash_bysel(&policy->selector, policy->family, dir); 673 delpol = NULL; 674 newpos = NULL; 675 hlist_for_each_entry(pol, entry, chain, bydst) { 676 if (pol->type == policy->type && 677 !selector_cmp(&pol->selector, &policy->selector) && 678 xfrm_sec_ctx_match(pol->security, policy->security) && 679 !WARN_ON(delpol)) { 680 if (excl) { 681 write_unlock_bh(&xfrm_policy_lock); 682 return -EEXIST; 683 } 684 delpol = pol; 685 if (policy->priority > pol->priority) 686 continue; 687 } else if (policy->priority >= pol->priority) { 688 newpos = &pol->bydst; 689 continue; 690 } 691 if (delpol) 692 break; 693 } 694 if (newpos) 695 hlist_add_after(newpos, &policy->bydst); 696 else 697 hlist_add_head(&policy->bydst, chain); 698 xfrm_pol_hold(policy); 699 xfrm_policy_count[dir]++; 700 atomic_inc(&flow_cache_genid); 701 if (delpol) { 702 hlist_del(&delpol->bydst); 703 hlist_del(&delpol->byidx); 704 xfrm_policy_count[dir]--; 705 } 706 policy->index = delpol ? delpol->index : xfrm_gen_index(policy->type, dir); 707 hlist_add_head(&policy->byidx, xfrm_policy_byidx+idx_hash(policy->index)); 708 policy->curlft.add_time = get_seconds(); 709 policy->curlft.use_time = 0; 710 if (!mod_timer(&policy->timer, jiffies + HZ)) 711 xfrm_pol_hold(policy); 712 write_unlock_bh(&xfrm_policy_lock); 713 714 if (delpol) 715 xfrm_policy_kill(delpol); 716 else if (xfrm_bydst_should_resize(dir, NULL)) 717 schedule_work(&xfrm_hash_work); 718 719 read_lock_bh(&xfrm_policy_lock); 720 gc_list = NULL; 721 entry = &policy->bydst; 722 hlist_for_each_entry_continue(policy, entry, bydst) { 723 struct dst_entry *dst; 724 725 write_lock(&policy->lock); 726 dst = policy->bundles; 727 if (dst) { 728 struct dst_entry *tail = dst; 729 while (tail->next) 730 tail = tail->next; 731 tail->next = gc_list; 732 gc_list = dst; 733 734 policy->bundles = NULL; 735 } 736 write_unlock(&policy->lock); 737 } 738 read_unlock_bh(&xfrm_policy_lock); 739 740 while (gc_list) { 741 struct dst_entry *dst = gc_list; 742 743 gc_list = dst->next; 744 dst_free(dst); 745 } 746 747 return 0; 748 } 749 EXPORT_SYMBOL(xfrm_policy_insert); 750 751 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir, 752 struct xfrm_selector *sel, 753 struct xfrm_sec_ctx *ctx, int delete, 754 int *err) 755 { 756 struct xfrm_policy *pol, *ret; 757 struct hlist_head *chain; 758 struct hlist_node *entry; 759 760 *err = 0; 761 write_lock_bh(&xfrm_policy_lock); 762 chain = policy_hash_bysel(sel, sel->family, dir); 763 ret = NULL; 764 hlist_for_each_entry(pol, entry, chain, bydst) { 765 if (pol->type == type && 766 !selector_cmp(sel, &pol->selector) && 767 xfrm_sec_ctx_match(ctx, pol->security)) { 768 xfrm_pol_hold(pol); 769 if (delete) { 770 *err = security_xfrm_policy_delete(pol); 771 if (*err) { 772 write_unlock_bh(&xfrm_policy_lock); 773 return pol; 774 } 775 hlist_del(&pol->bydst); 776 hlist_del(&pol->byidx); 777 xfrm_policy_count[dir]--; 778 } 779 ret = pol; 780 break; 781 } 782 } 783 write_unlock_bh(&xfrm_policy_lock); 784 785 if (ret && delete) { 786 atomic_inc(&flow_cache_genid); 787 xfrm_policy_kill(ret); 788 } 789 return ret; 790 } 791 EXPORT_SYMBOL(xfrm_policy_bysel_ctx); 792 793 struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete, 794 int *err) 795 { 796 struct xfrm_policy *pol, *ret; 797 struct hlist_head *chain; 798 struct hlist_node *entry; 799 800 *err = -ENOENT; 801 if (xfrm_policy_id2dir(id) != dir) 802 return NULL; 803 804 *err = 0; 805 write_lock_bh(&xfrm_policy_lock); 806 chain = xfrm_policy_byidx + idx_hash(id); 807 ret = NULL; 808 hlist_for_each_entry(pol, entry, chain, byidx) { 809 if (pol->type == type && pol->index == id) { 810 xfrm_pol_hold(pol); 811 if (delete) { 812 *err = security_xfrm_policy_delete(pol); 813 if (*err) { 814 write_unlock_bh(&xfrm_policy_lock); 815 return pol; 816 } 817 hlist_del(&pol->bydst); 818 hlist_del(&pol->byidx); 819 xfrm_policy_count[dir]--; 820 } 821 ret = pol; 822 break; 823 } 824 } 825 write_unlock_bh(&xfrm_policy_lock); 826 827 if (ret && delete) { 828 atomic_inc(&flow_cache_genid); 829 xfrm_policy_kill(ret); 830 } 831 return ret; 832 } 833 EXPORT_SYMBOL(xfrm_policy_byid); 834 835 #ifdef CONFIG_SECURITY_NETWORK_XFRM 836 static inline int 837 xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info) 838 { 839 int dir, err = 0; 840 841 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { 842 struct xfrm_policy *pol; 843 struct hlist_node *entry; 844 int i; 845 846 hlist_for_each_entry(pol, entry, 847 &xfrm_policy_inexact[dir], bydst) { 848 if (pol->type != type) 849 continue; 850 err = security_xfrm_policy_delete(pol); 851 if (err) { 852 xfrm_audit_policy_delete(pol, 0, 853 audit_info->loginuid, 854 audit_info->secid); 855 return err; 856 } 857 } 858 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) { 859 hlist_for_each_entry(pol, entry, 860 xfrm_policy_bydst[dir].table + i, 861 bydst) { 862 if (pol->type != type) 863 continue; 864 err = security_xfrm_policy_delete(pol); 865 if (err) { 866 xfrm_audit_policy_delete(pol, 0, 867 audit_info->loginuid, 868 audit_info->secid); 869 return err; 870 } 871 } 872 } 873 } 874 return err; 875 } 876 #else 877 static inline int 878 xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info) 879 { 880 return 0; 881 } 882 #endif 883 884 int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info) 885 { 886 int dir, err = 0; 887 888 write_lock_bh(&xfrm_policy_lock); 889 890 err = xfrm_policy_flush_secctx_check(type, audit_info); 891 if (err) 892 goto out; 893 894 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { 895 struct xfrm_policy *pol; 896 struct hlist_node *entry; 897 int i, killed; 898 899 killed = 0; 900 again1: 901 hlist_for_each_entry(pol, entry, 902 &xfrm_policy_inexact[dir], bydst) { 903 if (pol->type != type) 904 continue; 905 hlist_del(&pol->bydst); 906 hlist_del(&pol->byidx); 907 write_unlock_bh(&xfrm_policy_lock); 908 909 xfrm_audit_policy_delete(pol, 1, audit_info->loginuid, 910 audit_info->secid); 911 912 xfrm_policy_kill(pol); 913 killed++; 914 915 write_lock_bh(&xfrm_policy_lock); 916 goto again1; 917 } 918 919 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) { 920 again2: 921 hlist_for_each_entry(pol, entry, 922 xfrm_policy_bydst[dir].table + i, 923 bydst) { 924 if (pol->type != type) 925 continue; 926 hlist_del(&pol->bydst); 927 hlist_del(&pol->byidx); 928 write_unlock_bh(&xfrm_policy_lock); 929 930 xfrm_audit_policy_delete(pol, 1, 931 audit_info->loginuid, 932 audit_info->secid); 933 xfrm_policy_kill(pol); 934 killed++; 935 936 write_lock_bh(&xfrm_policy_lock); 937 goto again2; 938 } 939 } 940 941 xfrm_policy_count[dir] -= killed; 942 } 943 atomic_inc(&flow_cache_genid); 944 out: 945 write_unlock_bh(&xfrm_policy_lock); 946 return err; 947 } 948 EXPORT_SYMBOL(xfrm_policy_flush); 949 950 int xfrm_policy_walk(u8 type, int (*func)(struct xfrm_policy *, int, int, void*), 951 void *data) 952 { 953 struct xfrm_policy *pol, *last = NULL; 954 struct hlist_node *entry; 955 int dir, last_dir = 0, count, error; 956 957 read_lock_bh(&xfrm_policy_lock); 958 count = 0; 959 960 for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) { 961 struct hlist_head *table = xfrm_policy_bydst[dir].table; 962 int i; 963 964 hlist_for_each_entry(pol, entry, 965 &xfrm_policy_inexact[dir], bydst) { 966 if (pol->type != type) 967 continue; 968 if (last) { 969 error = func(last, last_dir % XFRM_POLICY_MAX, 970 count, data); 971 if (error) 972 goto out; 973 } 974 last = pol; 975 last_dir = dir; 976 count++; 977 } 978 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) { 979 hlist_for_each_entry(pol, entry, table + i, bydst) { 980 if (pol->type != type) 981 continue; 982 if (last) { 983 error = func(last, last_dir % XFRM_POLICY_MAX, 984 count, data); 985 if (error) 986 goto out; 987 } 988 last = pol; 989 last_dir = dir; 990 count++; 991 } 992 } 993 } 994 if (count == 0) { 995 error = -ENOENT; 996 goto out; 997 } 998 error = func(last, last_dir % XFRM_POLICY_MAX, 0, data); 999 out: 1000 read_unlock_bh(&xfrm_policy_lock); 1001 return error; 1002 } 1003 EXPORT_SYMBOL(xfrm_policy_walk); 1004 1005 /* 1006 * Find policy to apply to this flow. 1007 * 1008 * Returns 0 if policy found, else an -errno. 1009 */ 1010 static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl, 1011 u8 type, u16 family, int dir) 1012 { 1013 struct xfrm_selector *sel = &pol->selector; 1014 int match, ret = -ESRCH; 1015 1016 if (pol->family != family || 1017 pol->type != type) 1018 return ret; 1019 1020 match = xfrm_selector_match(sel, fl, family); 1021 if (match) 1022 ret = security_xfrm_policy_lookup(pol, fl->secid, dir); 1023 1024 return ret; 1025 } 1026 1027 static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl, 1028 u16 family, u8 dir) 1029 { 1030 int err; 1031 struct xfrm_policy *pol, *ret; 1032 xfrm_address_t *daddr, *saddr; 1033 struct hlist_node *entry; 1034 struct hlist_head *chain; 1035 u32 priority = ~0U; 1036 1037 daddr = xfrm_flowi_daddr(fl, family); 1038 saddr = xfrm_flowi_saddr(fl, family); 1039 if (unlikely(!daddr || !saddr)) 1040 return NULL; 1041 1042 read_lock_bh(&xfrm_policy_lock); 1043 chain = policy_hash_direct(daddr, saddr, family, dir); 1044 ret = NULL; 1045 hlist_for_each_entry(pol, entry, chain, bydst) { 1046 err = xfrm_policy_match(pol, fl, type, family, dir); 1047 if (err) { 1048 if (err == -ESRCH) 1049 continue; 1050 else { 1051 ret = ERR_PTR(err); 1052 goto fail; 1053 } 1054 } else { 1055 ret = pol; 1056 priority = ret->priority; 1057 break; 1058 } 1059 } 1060 chain = &xfrm_policy_inexact[dir]; 1061 hlist_for_each_entry(pol, entry, chain, bydst) { 1062 err = xfrm_policy_match(pol, fl, type, family, dir); 1063 if (err) { 1064 if (err == -ESRCH) 1065 continue; 1066 else { 1067 ret = ERR_PTR(err); 1068 goto fail; 1069 } 1070 } else if (pol->priority < priority) { 1071 ret = pol; 1072 break; 1073 } 1074 } 1075 if (ret) 1076 xfrm_pol_hold(ret); 1077 fail: 1078 read_unlock_bh(&xfrm_policy_lock); 1079 1080 return ret; 1081 } 1082 1083 static int xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir, 1084 void **objp, atomic_t **obj_refp) 1085 { 1086 struct xfrm_policy *pol; 1087 int err = 0; 1088 1089 #ifdef CONFIG_XFRM_SUB_POLICY 1090 pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_SUB, fl, family, dir); 1091 if (IS_ERR(pol)) { 1092 err = PTR_ERR(pol); 1093 pol = NULL; 1094 } 1095 if (pol || err) 1096 goto end; 1097 #endif 1098 pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, fl, family, dir); 1099 if (IS_ERR(pol)) { 1100 err = PTR_ERR(pol); 1101 pol = NULL; 1102 } 1103 #ifdef CONFIG_XFRM_SUB_POLICY 1104 end: 1105 #endif 1106 if ((*objp = (void *) pol) != NULL) 1107 *obj_refp = &pol->refcnt; 1108 return err; 1109 } 1110 1111 static inline int policy_to_flow_dir(int dir) 1112 { 1113 if (XFRM_POLICY_IN == FLOW_DIR_IN && 1114 XFRM_POLICY_OUT == FLOW_DIR_OUT && 1115 XFRM_POLICY_FWD == FLOW_DIR_FWD) 1116 return dir; 1117 switch (dir) { 1118 default: 1119 case XFRM_POLICY_IN: 1120 return FLOW_DIR_IN; 1121 case XFRM_POLICY_OUT: 1122 return FLOW_DIR_OUT; 1123 case XFRM_POLICY_FWD: 1124 return FLOW_DIR_FWD; 1125 } 1126 } 1127 1128 static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl) 1129 { 1130 struct xfrm_policy *pol; 1131 1132 read_lock_bh(&xfrm_policy_lock); 1133 if ((pol = sk->sk_policy[dir]) != NULL) { 1134 int match = xfrm_selector_match(&pol->selector, fl, 1135 sk->sk_family); 1136 int err = 0; 1137 1138 if (match) { 1139 err = security_xfrm_policy_lookup(pol, fl->secid, 1140 policy_to_flow_dir(dir)); 1141 if (!err) 1142 xfrm_pol_hold(pol); 1143 else if (err == -ESRCH) 1144 pol = NULL; 1145 else 1146 pol = ERR_PTR(err); 1147 } else 1148 pol = NULL; 1149 } 1150 read_unlock_bh(&xfrm_policy_lock); 1151 return pol; 1152 } 1153 1154 static void __xfrm_policy_link(struct xfrm_policy *pol, int dir) 1155 { 1156 struct hlist_head *chain = policy_hash_bysel(&pol->selector, 1157 pol->family, dir); 1158 1159 hlist_add_head(&pol->bydst, chain); 1160 hlist_add_head(&pol->byidx, xfrm_policy_byidx+idx_hash(pol->index)); 1161 xfrm_policy_count[dir]++; 1162 xfrm_pol_hold(pol); 1163 1164 if (xfrm_bydst_should_resize(dir, NULL)) 1165 schedule_work(&xfrm_hash_work); 1166 } 1167 1168 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, 1169 int dir) 1170 { 1171 if (hlist_unhashed(&pol->bydst)) 1172 return NULL; 1173 1174 hlist_del(&pol->bydst); 1175 hlist_del(&pol->byidx); 1176 xfrm_policy_count[dir]--; 1177 1178 return pol; 1179 } 1180 1181 int xfrm_policy_delete(struct xfrm_policy *pol, int dir) 1182 { 1183 write_lock_bh(&xfrm_policy_lock); 1184 pol = __xfrm_policy_unlink(pol, dir); 1185 write_unlock_bh(&xfrm_policy_lock); 1186 if (pol) { 1187 if (dir < XFRM_POLICY_MAX) 1188 atomic_inc(&flow_cache_genid); 1189 xfrm_policy_kill(pol); 1190 return 0; 1191 } 1192 return -ENOENT; 1193 } 1194 EXPORT_SYMBOL(xfrm_policy_delete); 1195 1196 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) 1197 { 1198 struct xfrm_policy *old_pol; 1199 1200 #ifdef CONFIG_XFRM_SUB_POLICY 1201 if (pol && pol->type != XFRM_POLICY_TYPE_MAIN) 1202 return -EINVAL; 1203 #endif 1204 1205 write_lock_bh(&xfrm_policy_lock); 1206 old_pol = sk->sk_policy[dir]; 1207 sk->sk_policy[dir] = pol; 1208 if (pol) { 1209 pol->curlft.add_time = get_seconds(); 1210 pol->index = xfrm_gen_index(pol->type, XFRM_POLICY_MAX+dir); 1211 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir); 1212 } 1213 if (old_pol) 1214 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir); 1215 write_unlock_bh(&xfrm_policy_lock); 1216 1217 if (old_pol) { 1218 xfrm_policy_kill(old_pol); 1219 } 1220 return 0; 1221 } 1222 1223 static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir) 1224 { 1225 struct xfrm_policy *newp = xfrm_policy_alloc(GFP_ATOMIC); 1226 1227 if (newp) { 1228 newp->selector = old->selector; 1229 if (security_xfrm_policy_clone(old, newp)) { 1230 kfree(newp); 1231 return NULL; /* ENOMEM */ 1232 } 1233 newp->lft = old->lft; 1234 newp->curlft = old->curlft; 1235 newp->action = old->action; 1236 newp->flags = old->flags; 1237 newp->xfrm_nr = old->xfrm_nr; 1238 newp->index = old->index; 1239 newp->type = old->type; 1240 memcpy(newp->xfrm_vec, old->xfrm_vec, 1241 newp->xfrm_nr*sizeof(struct xfrm_tmpl)); 1242 write_lock_bh(&xfrm_policy_lock); 1243 __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir); 1244 write_unlock_bh(&xfrm_policy_lock); 1245 xfrm_pol_put(newp); 1246 } 1247 return newp; 1248 } 1249 1250 int __xfrm_sk_clone_policy(struct sock *sk) 1251 { 1252 struct xfrm_policy *p0 = sk->sk_policy[0], 1253 *p1 = sk->sk_policy[1]; 1254 1255 sk->sk_policy[0] = sk->sk_policy[1] = NULL; 1256 if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL) 1257 return -ENOMEM; 1258 if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL) 1259 return -ENOMEM; 1260 return 0; 1261 } 1262 1263 static int 1264 xfrm_get_saddr(xfrm_address_t *local, xfrm_address_t *remote, 1265 unsigned short family) 1266 { 1267 int err; 1268 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1269 1270 if (unlikely(afinfo == NULL)) 1271 return -EINVAL; 1272 err = afinfo->get_saddr(local, remote); 1273 xfrm_policy_put_afinfo(afinfo); 1274 return err; 1275 } 1276 1277 /* Resolve list of templates for the flow, given policy. */ 1278 1279 static int 1280 xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl, 1281 struct xfrm_state **xfrm, 1282 unsigned short family) 1283 { 1284 int nx; 1285 int i, error; 1286 xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family); 1287 xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family); 1288 xfrm_address_t tmp; 1289 1290 for (nx=0, i = 0; i < policy->xfrm_nr; i++) { 1291 struct xfrm_state *x; 1292 xfrm_address_t *remote = daddr; 1293 xfrm_address_t *local = saddr; 1294 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i]; 1295 1296 if (tmpl->mode == XFRM_MODE_TUNNEL || 1297 tmpl->mode == XFRM_MODE_BEET) { 1298 remote = &tmpl->id.daddr; 1299 local = &tmpl->saddr; 1300 family = tmpl->encap_family; 1301 if (xfrm_addr_any(local, family)) { 1302 error = xfrm_get_saddr(&tmp, remote, family); 1303 if (error) 1304 goto fail; 1305 local = &tmp; 1306 } 1307 } 1308 1309 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family); 1310 1311 if (x && x->km.state == XFRM_STATE_VALID) { 1312 xfrm[nx++] = x; 1313 daddr = remote; 1314 saddr = local; 1315 continue; 1316 } 1317 if (x) { 1318 error = (x->km.state == XFRM_STATE_ERROR ? 1319 -EINVAL : -EAGAIN); 1320 xfrm_state_put(x); 1321 } 1322 1323 if (!tmpl->optional) 1324 goto fail; 1325 } 1326 return nx; 1327 1328 fail: 1329 for (nx--; nx>=0; nx--) 1330 xfrm_state_put(xfrm[nx]); 1331 return error; 1332 } 1333 1334 static int 1335 xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, struct flowi *fl, 1336 struct xfrm_state **xfrm, 1337 unsigned short family) 1338 { 1339 struct xfrm_state *tp[XFRM_MAX_DEPTH]; 1340 struct xfrm_state **tpp = (npols > 1) ? tp : xfrm; 1341 int cnx = 0; 1342 int error; 1343 int ret; 1344 int i; 1345 1346 for (i = 0; i < npols; i++) { 1347 if (cnx + pols[i]->xfrm_nr >= XFRM_MAX_DEPTH) { 1348 error = -ENOBUFS; 1349 goto fail; 1350 } 1351 1352 ret = xfrm_tmpl_resolve_one(pols[i], fl, &tpp[cnx], family); 1353 if (ret < 0) { 1354 error = ret; 1355 goto fail; 1356 } else 1357 cnx += ret; 1358 } 1359 1360 /* found states are sorted for outbound processing */ 1361 if (npols > 1) 1362 xfrm_state_sort(xfrm, tpp, cnx, family); 1363 1364 return cnx; 1365 1366 fail: 1367 for (cnx--; cnx>=0; cnx--) 1368 xfrm_state_put(tpp[cnx]); 1369 return error; 1370 1371 } 1372 1373 /* Check that the bundle accepts the flow and its components are 1374 * still valid. 1375 */ 1376 1377 static struct dst_entry * 1378 xfrm_find_bundle(struct flowi *fl, struct xfrm_policy *policy, unsigned short family) 1379 { 1380 struct dst_entry *x; 1381 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1382 if (unlikely(afinfo == NULL)) 1383 return ERR_PTR(-EINVAL); 1384 x = afinfo->find_bundle(fl, policy); 1385 xfrm_policy_put_afinfo(afinfo); 1386 return x; 1387 } 1388 1389 /* Allocate chain of dst_entry's, attach known xfrm's, calculate 1390 * all the metrics... Shortly, bundle a bundle. 1391 */ 1392 1393 static int 1394 xfrm_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx, 1395 struct flowi *fl, struct dst_entry **dst_p, 1396 unsigned short family) 1397 { 1398 int err; 1399 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1400 if (unlikely(afinfo == NULL)) 1401 return -EINVAL; 1402 err = afinfo->bundle_create(policy, xfrm, nx, fl, dst_p); 1403 xfrm_policy_put_afinfo(afinfo); 1404 return err; 1405 } 1406 1407 static int inline 1408 xfrm_dst_alloc_copy(void **target, void *src, int size) 1409 { 1410 if (!*target) { 1411 *target = kmalloc(size, GFP_ATOMIC); 1412 if (!*target) 1413 return -ENOMEM; 1414 } 1415 memcpy(*target, src, size); 1416 return 0; 1417 } 1418 1419 static int inline 1420 xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel) 1421 { 1422 #ifdef CONFIG_XFRM_SUB_POLICY 1423 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1424 return xfrm_dst_alloc_copy((void **)&(xdst->partner), 1425 sel, sizeof(*sel)); 1426 #else 1427 return 0; 1428 #endif 1429 } 1430 1431 static int inline 1432 xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl) 1433 { 1434 #ifdef CONFIG_XFRM_SUB_POLICY 1435 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1436 return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl)); 1437 #else 1438 return 0; 1439 #endif 1440 } 1441 1442 static int stale_bundle(struct dst_entry *dst); 1443 1444 /* Main function: finds/creates a bundle for given flow. 1445 * 1446 * At the moment we eat a raw IP route. Mostly to speed up lookups 1447 * on interfaces with disabled IPsec. 1448 */ 1449 int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl, 1450 struct sock *sk, int flags) 1451 { 1452 struct xfrm_policy *policy; 1453 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1454 int npols; 1455 int pol_dead; 1456 int xfrm_nr; 1457 int pi; 1458 struct xfrm_state *xfrm[XFRM_MAX_DEPTH]; 1459 struct dst_entry *dst, *dst_orig = *dst_p; 1460 int nx = 0; 1461 int err; 1462 u32 genid; 1463 u16 family; 1464 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT); 1465 1466 restart: 1467 genid = atomic_read(&flow_cache_genid); 1468 policy = NULL; 1469 for (pi = 0; pi < ARRAY_SIZE(pols); pi++) 1470 pols[pi] = NULL; 1471 npols = 0; 1472 pol_dead = 0; 1473 xfrm_nr = 0; 1474 1475 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { 1476 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); 1477 if (IS_ERR(policy)) 1478 return PTR_ERR(policy); 1479 } 1480 1481 if (!policy) { 1482 /* To accelerate a bit... */ 1483 if ((dst_orig->flags & DST_NOXFRM) || 1484 !xfrm_policy_count[XFRM_POLICY_OUT]) 1485 return 0; 1486 1487 policy = flow_cache_lookup(fl, dst_orig->ops->family, 1488 dir, xfrm_policy_lookup); 1489 if (IS_ERR(policy)) 1490 return PTR_ERR(policy); 1491 } 1492 1493 if (!policy) 1494 return 0; 1495 1496 family = dst_orig->ops->family; 1497 policy->curlft.use_time = get_seconds(); 1498 pols[0] = policy; 1499 npols ++; 1500 xfrm_nr += pols[0]->xfrm_nr; 1501 1502 switch (policy->action) { 1503 case XFRM_POLICY_BLOCK: 1504 /* Prohibit the flow */ 1505 err = -EPERM; 1506 goto error; 1507 1508 case XFRM_POLICY_ALLOW: 1509 #ifndef CONFIG_XFRM_SUB_POLICY 1510 if (policy->xfrm_nr == 0) { 1511 /* Flow passes not transformed. */ 1512 xfrm_pol_put(policy); 1513 return 0; 1514 } 1515 #endif 1516 1517 /* Try to find matching bundle. 1518 * 1519 * LATER: help from flow cache. It is optional, this 1520 * is required only for output policy. 1521 */ 1522 dst = xfrm_find_bundle(fl, policy, family); 1523 if (IS_ERR(dst)) { 1524 err = PTR_ERR(dst); 1525 goto error; 1526 } 1527 1528 if (dst) 1529 break; 1530 1531 #ifdef CONFIG_XFRM_SUB_POLICY 1532 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) { 1533 pols[1] = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, 1534 fl, family, 1535 XFRM_POLICY_OUT); 1536 if (pols[1]) { 1537 if (IS_ERR(pols[1])) { 1538 err = PTR_ERR(pols[1]); 1539 goto error; 1540 } 1541 if (pols[1]->action == XFRM_POLICY_BLOCK) { 1542 err = -EPERM; 1543 goto error; 1544 } 1545 npols ++; 1546 xfrm_nr += pols[1]->xfrm_nr; 1547 } 1548 } 1549 1550 /* 1551 * Because neither flowi nor bundle information knows about 1552 * transformation template size. On more than one policy usage 1553 * we can realize whether all of them is bypass or not after 1554 * they are searched. See above not-transformed bypass 1555 * is surrounded by non-sub policy configuration, too. 1556 */ 1557 if (xfrm_nr == 0) { 1558 /* Flow passes not transformed. */ 1559 xfrm_pols_put(pols, npols); 1560 return 0; 1561 } 1562 1563 #endif 1564 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family); 1565 1566 if (unlikely(nx<0)) { 1567 err = nx; 1568 if (err == -EAGAIN && sysctl_xfrm_larval_drop) { 1569 /* EREMOTE tells the caller to generate 1570 * a one-shot blackhole route. 1571 */ 1572 xfrm_pol_put(policy); 1573 return -EREMOTE; 1574 } 1575 if (err == -EAGAIN && flags) { 1576 DECLARE_WAITQUEUE(wait, current); 1577 1578 add_wait_queue(&km_waitq, &wait); 1579 set_current_state(TASK_INTERRUPTIBLE); 1580 schedule(); 1581 set_current_state(TASK_RUNNING); 1582 remove_wait_queue(&km_waitq, &wait); 1583 1584 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family); 1585 1586 if (nx == -EAGAIN && signal_pending(current)) { 1587 err = -ERESTART; 1588 goto error; 1589 } 1590 if (nx == -EAGAIN || 1591 genid != atomic_read(&flow_cache_genid)) { 1592 xfrm_pols_put(pols, npols); 1593 goto restart; 1594 } 1595 err = nx; 1596 } 1597 if (err < 0) 1598 goto error; 1599 } 1600 if (nx == 0) { 1601 /* Flow passes not transformed. */ 1602 xfrm_pols_put(pols, npols); 1603 return 0; 1604 } 1605 1606 dst = dst_orig; 1607 err = xfrm_bundle_create(policy, xfrm, nx, fl, &dst, family); 1608 1609 if (unlikely(err)) { 1610 int i; 1611 for (i=0; i<nx; i++) 1612 xfrm_state_put(xfrm[i]); 1613 goto error; 1614 } 1615 1616 for (pi = 0; pi < npols; pi++) { 1617 read_lock_bh(&pols[pi]->lock); 1618 pol_dead |= pols[pi]->dead; 1619 read_unlock_bh(&pols[pi]->lock); 1620 } 1621 1622 write_lock_bh(&policy->lock); 1623 if (unlikely(pol_dead || stale_bundle(dst))) { 1624 /* Wow! While we worked on resolving, this 1625 * policy has gone. Retry. It is not paranoia, 1626 * we just cannot enlist new bundle to dead object. 1627 * We can't enlist stable bundles either. 1628 */ 1629 write_unlock_bh(&policy->lock); 1630 if (dst) 1631 dst_free(dst); 1632 1633 err = -EHOSTUNREACH; 1634 goto error; 1635 } 1636 1637 if (npols > 1) 1638 err = xfrm_dst_update_parent(dst, &pols[1]->selector); 1639 else 1640 err = xfrm_dst_update_origin(dst, fl); 1641 if (unlikely(err)) { 1642 write_unlock_bh(&policy->lock); 1643 if (dst) 1644 dst_free(dst); 1645 goto error; 1646 } 1647 1648 dst->next = policy->bundles; 1649 policy->bundles = dst; 1650 dst_hold(dst); 1651 write_unlock_bh(&policy->lock); 1652 } 1653 *dst_p = dst; 1654 dst_release(dst_orig); 1655 xfrm_pols_put(pols, npols); 1656 return 0; 1657 1658 error: 1659 dst_release(dst_orig); 1660 xfrm_pols_put(pols, npols); 1661 *dst_p = NULL; 1662 return err; 1663 } 1664 EXPORT_SYMBOL(__xfrm_lookup); 1665 1666 int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl, 1667 struct sock *sk, int flags) 1668 { 1669 int err = __xfrm_lookup(dst_p, fl, sk, flags); 1670 1671 if (err == -EREMOTE) { 1672 dst_release(*dst_p); 1673 *dst_p = NULL; 1674 err = -EAGAIN; 1675 } 1676 1677 return err; 1678 } 1679 EXPORT_SYMBOL(xfrm_lookup); 1680 1681 static inline int 1682 xfrm_secpath_reject(int idx, struct sk_buff *skb, struct flowi *fl) 1683 { 1684 struct xfrm_state *x; 1685 int err; 1686 1687 if (!skb->sp || idx < 0 || idx >= skb->sp->len) 1688 return 0; 1689 x = skb->sp->xvec[idx]; 1690 if (!x->type->reject) 1691 return 0; 1692 xfrm_state_hold(x); 1693 err = x->type->reject(x, skb, fl); 1694 xfrm_state_put(x); 1695 return err; 1696 } 1697 1698 /* When skb is transformed back to its "native" form, we have to 1699 * check policy restrictions. At the moment we make this in maximally 1700 * stupid way. Shame on me. :-) Of course, connected sockets must 1701 * have policy cached at them. 1702 */ 1703 1704 static inline int 1705 xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x, 1706 unsigned short family) 1707 { 1708 if (xfrm_state_kern(x)) 1709 return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family); 1710 return x->id.proto == tmpl->id.proto && 1711 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) && 1712 (x->props.reqid == tmpl->reqid || !tmpl->reqid) && 1713 x->props.mode == tmpl->mode && 1714 ((tmpl->aalgos & (1<<x->props.aalgo)) || 1715 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) && 1716 !(x->props.mode != XFRM_MODE_TRANSPORT && 1717 xfrm_state_addr_cmp(tmpl, x, family)); 1718 } 1719 1720 /* 1721 * 0 or more than 0 is returned when validation is succeeded (either bypass 1722 * because of optional transport mode, or next index of the mathced secpath 1723 * state with the template. 1724 * -1 is returned when no matching template is found. 1725 * Otherwise "-2 - errored_index" is returned. 1726 */ 1727 static inline int 1728 xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start, 1729 unsigned short family) 1730 { 1731 int idx = start; 1732 1733 if (tmpl->optional) { 1734 if (tmpl->mode == XFRM_MODE_TRANSPORT) 1735 return start; 1736 } else 1737 start = -1; 1738 for (; idx < sp->len; idx++) { 1739 if (xfrm_state_ok(tmpl, sp->xvec[idx], family)) 1740 return ++idx; 1741 if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) { 1742 if (start == -1) 1743 start = -2-idx; 1744 break; 1745 } 1746 } 1747 return start; 1748 } 1749 1750 int 1751 xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family) 1752 { 1753 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1754 int err; 1755 1756 if (unlikely(afinfo == NULL)) 1757 return -EAFNOSUPPORT; 1758 1759 afinfo->decode_session(skb, fl); 1760 err = security_xfrm_decode_session(skb, &fl->secid); 1761 xfrm_policy_put_afinfo(afinfo); 1762 return err; 1763 } 1764 EXPORT_SYMBOL(xfrm_decode_session); 1765 1766 static inline int secpath_has_nontransport(struct sec_path *sp, int k, int *idxp) 1767 { 1768 for (; k < sp->len; k++) { 1769 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) { 1770 *idxp = k; 1771 return 1; 1772 } 1773 } 1774 1775 return 0; 1776 } 1777 1778 int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, 1779 unsigned short family) 1780 { 1781 struct xfrm_policy *pol; 1782 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1783 int npols = 0; 1784 int xfrm_nr; 1785 int pi; 1786 struct flowi fl; 1787 u8 fl_dir = policy_to_flow_dir(dir); 1788 int xerr_idx = -1; 1789 1790 if (xfrm_decode_session(skb, &fl, family) < 0) 1791 return 0; 1792 nf_nat_decode_session(skb, &fl, family); 1793 1794 /* First, check used SA against their selectors. */ 1795 if (skb->sp) { 1796 int i; 1797 1798 for (i=skb->sp->len-1; i>=0; i--) { 1799 struct xfrm_state *x = skb->sp->xvec[i]; 1800 if (!xfrm_selector_match(&x->sel, &fl, family)) 1801 return 0; 1802 } 1803 } 1804 1805 pol = NULL; 1806 if (sk && sk->sk_policy[dir]) { 1807 pol = xfrm_sk_policy_lookup(sk, dir, &fl); 1808 if (IS_ERR(pol)) 1809 return 0; 1810 } 1811 1812 if (!pol) 1813 pol = flow_cache_lookup(&fl, family, fl_dir, 1814 xfrm_policy_lookup); 1815 1816 if (IS_ERR(pol)) 1817 return 0; 1818 1819 if (!pol) { 1820 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) { 1821 xfrm_secpath_reject(xerr_idx, skb, &fl); 1822 return 0; 1823 } 1824 return 1; 1825 } 1826 1827 pol->curlft.use_time = get_seconds(); 1828 1829 pols[0] = pol; 1830 npols ++; 1831 #ifdef CONFIG_XFRM_SUB_POLICY 1832 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) { 1833 pols[1] = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, 1834 &fl, family, 1835 XFRM_POLICY_IN); 1836 if (pols[1]) { 1837 if (IS_ERR(pols[1])) 1838 return 0; 1839 pols[1]->curlft.use_time = get_seconds(); 1840 npols ++; 1841 } 1842 } 1843 #endif 1844 1845 if (pol->action == XFRM_POLICY_ALLOW) { 1846 struct sec_path *sp; 1847 static struct sec_path dummy; 1848 struct xfrm_tmpl *tp[XFRM_MAX_DEPTH]; 1849 struct xfrm_tmpl *stp[XFRM_MAX_DEPTH]; 1850 struct xfrm_tmpl **tpp = tp; 1851 int ti = 0; 1852 int i, k; 1853 1854 if ((sp = skb->sp) == NULL) 1855 sp = &dummy; 1856 1857 for (pi = 0; pi < npols; pi++) { 1858 if (pols[pi] != pol && 1859 pols[pi]->action != XFRM_POLICY_ALLOW) 1860 goto reject; 1861 if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) 1862 goto reject_error; 1863 for (i = 0; i < pols[pi]->xfrm_nr; i++) 1864 tpp[ti++] = &pols[pi]->xfrm_vec[i]; 1865 } 1866 xfrm_nr = ti; 1867 if (npols > 1) { 1868 xfrm_tmpl_sort(stp, tpp, xfrm_nr, family); 1869 tpp = stp; 1870 } 1871 1872 /* For each tunnel xfrm, find the first matching tmpl. 1873 * For each tmpl before that, find corresponding xfrm. 1874 * Order is _important_. Later we will implement 1875 * some barriers, but at the moment barriers 1876 * are implied between each two transformations. 1877 */ 1878 for (i = xfrm_nr-1, k = 0; i >= 0; i--) { 1879 k = xfrm_policy_ok(tpp[i], sp, k, family); 1880 if (k < 0) { 1881 if (k < -1) 1882 /* "-2 - errored_index" returned */ 1883 xerr_idx = -(2+k); 1884 goto reject; 1885 } 1886 } 1887 1888 if (secpath_has_nontransport(sp, k, &xerr_idx)) 1889 goto reject; 1890 1891 xfrm_pols_put(pols, npols); 1892 return 1; 1893 } 1894 1895 reject: 1896 xfrm_secpath_reject(xerr_idx, skb, &fl); 1897 reject_error: 1898 xfrm_pols_put(pols, npols); 1899 return 0; 1900 } 1901 EXPORT_SYMBOL(__xfrm_policy_check); 1902 1903 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) 1904 { 1905 struct flowi fl; 1906 1907 if (xfrm_decode_session(skb, &fl, family) < 0) 1908 return 0; 1909 1910 return xfrm_lookup(&skb->dst, &fl, NULL, 0) == 0; 1911 } 1912 EXPORT_SYMBOL(__xfrm_route_forward); 1913 1914 /* Optimize later using cookies and generation ids. */ 1915 1916 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie) 1917 { 1918 /* Code (such as __xfrm4_bundle_create()) sets dst->obsolete 1919 * to "-1" to force all XFRM destinations to get validated by 1920 * dst_ops->check on every use. We do this because when a 1921 * normal route referenced by an XFRM dst is obsoleted we do 1922 * not go looking around for all parent referencing XFRM dsts 1923 * so that we can invalidate them. It is just too much work. 1924 * Instead we make the checks here on every use. For example: 1925 * 1926 * XFRM dst A --> IPv4 dst X 1927 * 1928 * X is the "xdst->route" of A (X is also the "dst->path" of A 1929 * in this example). If X is marked obsolete, "A" will not 1930 * notice. That's what we are validating here via the 1931 * stale_bundle() check. 1932 * 1933 * When a policy's bundle is pruned, we dst_free() the XFRM 1934 * dst which causes it's ->obsolete field to be set to a 1935 * positive non-zero integer. If an XFRM dst has been pruned 1936 * like this, we want to force a new route lookup. 1937 */ 1938 if (dst->obsolete < 0 && !stale_bundle(dst)) 1939 return dst; 1940 1941 return NULL; 1942 } 1943 1944 static int stale_bundle(struct dst_entry *dst) 1945 { 1946 return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0); 1947 } 1948 1949 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev) 1950 { 1951 while ((dst = dst->child) && dst->xfrm && dst->dev == dev) { 1952 dst->dev = &loopback_dev; 1953 dev_hold(&loopback_dev); 1954 dev_put(dev); 1955 } 1956 } 1957 EXPORT_SYMBOL(xfrm_dst_ifdown); 1958 1959 static void xfrm_link_failure(struct sk_buff *skb) 1960 { 1961 /* Impossible. Such dst must be popped before reaches point of failure. */ 1962 return; 1963 } 1964 1965 static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst) 1966 { 1967 if (dst) { 1968 if (dst->obsolete) { 1969 dst_release(dst); 1970 dst = NULL; 1971 } 1972 } 1973 return dst; 1974 } 1975 1976 static void prune_one_bundle(struct xfrm_policy *pol, int (*func)(struct dst_entry *), struct dst_entry **gc_list_p) 1977 { 1978 struct dst_entry *dst, **dstp; 1979 1980 write_lock(&pol->lock); 1981 dstp = &pol->bundles; 1982 while ((dst=*dstp) != NULL) { 1983 if (func(dst)) { 1984 *dstp = dst->next; 1985 dst->next = *gc_list_p; 1986 *gc_list_p = dst; 1987 } else { 1988 dstp = &dst->next; 1989 } 1990 } 1991 write_unlock(&pol->lock); 1992 } 1993 1994 static void xfrm_prune_bundles(int (*func)(struct dst_entry *)) 1995 { 1996 struct dst_entry *gc_list = NULL; 1997 int dir; 1998 1999 read_lock_bh(&xfrm_policy_lock); 2000 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 2001 struct xfrm_policy *pol; 2002 struct hlist_node *entry; 2003 struct hlist_head *table; 2004 int i; 2005 2006 hlist_for_each_entry(pol, entry, 2007 &xfrm_policy_inexact[dir], bydst) 2008 prune_one_bundle(pol, func, &gc_list); 2009 2010 table = xfrm_policy_bydst[dir].table; 2011 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) { 2012 hlist_for_each_entry(pol, entry, table + i, bydst) 2013 prune_one_bundle(pol, func, &gc_list); 2014 } 2015 } 2016 read_unlock_bh(&xfrm_policy_lock); 2017 2018 while (gc_list) { 2019 struct dst_entry *dst = gc_list; 2020 gc_list = dst->next; 2021 dst_free(dst); 2022 } 2023 } 2024 2025 static int unused_bundle(struct dst_entry *dst) 2026 { 2027 return !atomic_read(&dst->__refcnt); 2028 } 2029 2030 static void __xfrm_garbage_collect(void) 2031 { 2032 xfrm_prune_bundles(unused_bundle); 2033 } 2034 2035 static int xfrm_flush_bundles(void) 2036 { 2037 xfrm_prune_bundles(stale_bundle); 2038 return 0; 2039 } 2040 2041 void xfrm_init_pmtu(struct dst_entry *dst) 2042 { 2043 do { 2044 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 2045 u32 pmtu, route_mtu_cached; 2046 2047 pmtu = dst_mtu(dst->child); 2048 xdst->child_mtu_cached = pmtu; 2049 2050 pmtu = xfrm_state_mtu(dst->xfrm, pmtu); 2051 2052 route_mtu_cached = dst_mtu(xdst->route); 2053 xdst->route_mtu_cached = route_mtu_cached; 2054 2055 if (pmtu > route_mtu_cached) 2056 pmtu = route_mtu_cached; 2057 2058 dst->metrics[RTAX_MTU-1] = pmtu; 2059 } while ((dst = dst->next)); 2060 } 2061 2062 EXPORT_SYMBOL(xfrm_init_pmtu); 2063 2064 /* Check that the bundle accepts the flow and its components are 2065 * still valid. 2066 */ 2067 2068 int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first, 2069 struct flowi *fl, int family, int strict) 2070 { 2071 struct dst_entry *dst = &first->u.dst; 2072 struct xfrm_dst *last; 2073 u32 mtu; 2074 2075 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) || 2076 (dst->dev && !netif_running(dst->dev))) 2077 return 0; 2078 #ifdef CONFIG_XFRM_SUB_POLICY 2079 if (fl) { 2080 if (first->origin && !flow_cache_uli_match(first->origin, fl)) 2081 return 0; 2082 if (first->partner && 2083 !xfrm_selector_match(first->partner, fl, family)) 2084 return 0; 2085 } 2086 #endif 2087 2088 last = NULL; 2089 2090 do { 2091 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 2092 2093 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family)) 2094 return 0; 2095 if (fl && pol && 2096 !security_xfrm_state_pol_flow_match(dst->xfrm, pol, fl)) 2097 return 0; 2098 if (dst->xfrm->km.state != XFRM_STATE_VALID) 2099 return 0; 2100 if (xdst->genid != dst->xfrm->genid) 2101 return 0; 2102 2103 if (strict && fl && dst->xfrm->props.mode != XFRM_MODE_TUNNEL && 2104 !xfrm_state_addr_flow_check(dst->xfrm, fl, family)) 2105 return 0; 2106 2107 mtu = dst_mtu(dst->child); 2108 if (xdst->child_mtu_cached != mtu) { 2109 last = xdst; 2110 xdst->child_mtu_cached = mtu; 2111 } 2112 2113 if (!dst_check(xdst->route, xdst->route_cookie)) 2114 return 0; 2115 mtu = dst_mtu(xdst->route); 2116 if (xdst->route_mtu_cached != mtu) { 2117 last = xdst; 2118 xdst->route_mtu_cached = mtu; 2119 } 2120 2121 dst = dst->child; 2122 } while (dst->xfrm); 2123 2124 if (likely(!last)) 2125 return 1; 2126 2127 mtu = last->child_mtu_cached; 2128 for (;;) { 2129 dst = &last->u.dst; 2130 2131 mtu = xfrm_state_mtu(dst->xfrm, mtu); 2132 if (mtu > last->route_mtu_cached) 2133 mtu = last->route_mtu_cached; 2134 dst->metrics[RTAX_MTU-1] = mtu; 2135 2136 if (last == first) 2137 break; 2138 2139 last = (struct xfrm_dst *)last->u.dst.next; 2140 last->child_mtu_cached = mtu; 2141 } 2142 2143 return 1; 2144 } 2145 2146 EXPORT_SYMBOL(xfrm_bundle_ok); 2147 2148 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo) 2149 { 2150 int err = 0; 2151 if (unlikely(afinfo == NULL)) 2152 return -EINVAL; 2153 if (unlikely(afinfo->family >= NPROTO)) 2154 return -EAFNOSUPPORT; 2155 write_lock_bh(&xfrm_policy_afinfo_lock); 2156 if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL)) 2157 err = -ENOBUFS; 2158 else { 2159 struct dst_ops *dst_ops = afinfo->dst_ops; 2160 if (likely(dst_ops->kmem_cachep == NULL)) 2161 dst_ops->kmem_cachep = xfrm_dst_cache; 2162 if (likely(dst_ops->check == NULL)) 2163 dst_ops->check = xfrm_dst_check; 2164 if (likely(dst_ops->negative_advice == NULL)) 2165 dst_ops->negative_advice = xfrm_negative_advice; 2166 if (likely(dst_ops->link_failure == NULL)) 2167 dst_ops->link_failure = xfrm_link_failure; 2168 if (likely(afinfo->garbage_collect == NULL)) 2169 afinfo->garbage_collect = __xfrm_garbage_collect; 2170 xfrm_policy_afinfo[afinfo->family] = afinfo; 2171 } 2172 write_unlock_bh(&xfrm_policy_afinfo_lock); 2173 return err; 2174 } 2175 EXPORT_SYMBOL(xfrm_policy_register_afinfo); 2176 2177 int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo) 2178 { 2179 int err = 0; 2180 if (unlikely(afinfo == NULL)) 2181 return -EINVAL; 2182 if (unlikely(afinfo->family >= NPROTO)) 2183 return -EAFNOSUPPORT; 2184 write_lock_bh(&xfrm_policy_afinfo_lock); 2185 if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) { 2186 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo)) 2187 err = -EINVAL; 2188 else { 2189 struct dst_ops *dst_ops = afinfo->dst_ops; 2190 xfrm_policy_afinfo[afinfo->family] = NULL; 2191 dst_ops->kmem_cachep = NULL; 2192 dst_ops->check = NULL; 2193 dst_ops->negative_advice = NULL; 2194 dst_ops->link_failure = NULL; 2195 afinfo->garbage_collect = NULL; 2196 } 2197 } 2198 write_unlock_bh(&xfrm_policy_afinfo_lock); 2199 return err; 2200 } 2201 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo); 2202 2203 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family) 2204 { 2205 struct xfrm_policy_afinfo *afinfo; 2206 if (unlikely(family >= NPROTO)) 2207 return NULL; 2208 read_lock(&xfrm_policy_afinfo_lock); 2209 afinfo = xfrm_policy_afinfo[family]; 2210 if (unlikely(!afinfo)) 2211 read_unlock(&xfrm_policy_afinfo_lock); 2212 return afinfo; 2213 } 2214 2215 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo) 2216 { 2217 read_unlock(&xfrm_policy_afinfo_lock); 2218 } 2219 2220 static struct xfrm_policy_afinfo *xfrm_policy_lock_afinfo(unsigned int family) 2221 { 2222 struct xfrm_policy_afinfo *afinfo; 2223 if (unlikely(family >= NPROTO)) 2224 return NULL; 2225 write_lock_bh(&xfrm_policy_afinfo_lock); 2226 afinfo = xfrm_policy_afinfo[family]; 2227 if (unlikely(!afinfo)) 2228 write_unlock_bh(&xfrm_policy_afinfo_lock); 2229 return afinfo; 2230 } 2231 2232 static void xfrm_policy_unlock_afinfo(struct xfrm_policy_afinfo *afinfo) 2233 { 2234 write_unlock_bh(&xfrm_policy_afinfo_lock); 2235 } 2236 2237 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr) 2238 { 2239 switch (event) { 2240 case NETDEV_DOWN: 2241 xfrm_flush_bundles(); 2242 } 2243 return NOTIFY_DONE; 2244 } 2245 2246 static struct notifier_block xfrm_dev_notifier = { 2247 xfrm_dev_event, 2248 NULL, 2249 0 2250 }; 2251 2252 static void __init xfrm_policy_init(void) 2253 { 2254 unsigned int hmask, sz; 2255 int dir; 2256 2257 xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache", 2258 sizeof(struct xfrm_dst), 2259 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, 2260 NULL); 2261 2262 hmask = 8 - 1; 2263 sz = (hmask+1) * sizeof(struct hlist_head); 2264 2265 xfrm_policy_byidx = xfrm_hash_alloc(sz); 2266 xfrm_idx_hmask = hmask; 2267 if (!xfrm_policy_byidx) 2268 panic("XFRM: failed to allocate byidx hash\n"); 2269 2270 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 2271 struct xfrm_policy_hash *htab; 2272 2273 INIT_HLIST_HEAD(&xfrm_policy_inexact[dir]); 2274 2275 htab = &xfrm_policy_bydst[dir]; 2276 htab->table = xfrm_hash_alloc(sz); 2277 htab->hmask = hmask; 2278 if (!htab->table) 2279 panic("XFRM: failed to allocate bydst hash\n"); 2280 } 2281 2282 INIT_WORK(&xfrm_policy_gc_work, xfrm_policy_gc_task); 2283 register_netdevice_notifier(&xfrm_dev_notifier); 2284 } 2285 2286 void __init xfrm_init(void) 2287 { 2288 xfrm_state_init(); 2289 xfrm_policy_init(); 2290 xfrm_input_init(); 2291 } 2292 2293 #ifdef CONFIG_AUDITSYSCALL 2294 static inline void xfrm_audit_common_policyinfo(struct xfrm_policy *xp, 2295 struct audit_buffer *audit_buf) 2296 { 2297 if (xp->security) 2298 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", 2299 xp->security->ctx_alg, xp->security->ctx_doi, 2300 xp->security->ctx_str); 2301 2302 switch(xp->selector.family) { 2303 case AF_INET: 2304 audit_log_format(audit_buf, " src=%u.%u.%u.%u dst=%u.%u.%u.%u", 2305 NIPQUAD(xp->selector.saddr.a4), 2306 NIPQUAD(xp->selector.daddr.a4)); 2307 break; 2308 case AF_INET6: 2309 { 2310 struct in6_addr saddr6, daddr6; 2311 2312 memcpy(&saddr6, xp->selector.saddr.a6, 2313 sizeof(struct in6_addr)); 2314 memcpy(&daddr6, xp->selector.daddr.a6, 2315 sizeof(struct in6_addr)); 2316 audit_log_format(audit_buf, 2317 " src=" NIP6_FMT " dst=" NIP6_FMT, 2318 NIP6(saddr6), NIP6(daddr6)); 2319 } 2320 break; 2321 } 2322 } 2323 2324 void 2325 xfrm_audit_policy_add(struct xfrm_policy *xp, int result, u32 auid, u32 sid) 2326 { 2327 struct audit_buffer *audit_buf; 2328 extern int audit_enabled; 2329 2330 if (audit_enabled == 0) 2331 return; 2332 audit_buf = xfrm_audit_start(sid, auid); 2333 if (audit_buf == NULL) 2334 return; 2335 audit_log_format(audit_buf, " op=SPD-add res=%u", result); 2336 xfrm_audit_common_policyinfo(xp, audit_buf); 2337 audit_log_end(audit_buf); 2338 } 2339 EXPORT_SYMBOL_GPL(xfrm_audit_policy_add); 2340 2341 void 2342 xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, u32 auid, u32 sid) 2343 { 2344 struct audit_buffer *audit_buf; 2345 extern int audit_enabled; 2346 2347 if (audit_enabled == 0) 2348 return; 2349 audit_buf = xfrm_audit_start(sid, auid); 2350 if (audit_buf == NULL) 2351 return; 2352 audit_log_format(audit_buf, " op=SPD-delete res=%u", result); 2353 xfrm_audit_common_policyinfo(xp, audit_buf); 2354 audit_log_end(audit_buf); 2355 } 2356 EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete); 2357 #endif 2358 2359 #ifdef CONFIG_XFRM_MIGRATE 2360 static int xfrm_migrate_selector_match(struct xfrm_selector *sel_cmp, 2361 struct xfrm_selector *sel_tgt) 2362 { 2363 if (sel_cmp->proto == IPSEC_ULPROTO_ANY) { 2364 if (sel_tgt->family == sel_cmp->family && 2365 xfrm_addr_cmp(&sel_tgt->daddr, &sel_cmp->daddr, 2366 sel_cmp->family) == 0 && 2367 xfrm_addr_cmp(&sel_tgt->saddr, &sel_cmp->saddr, 2368 sel_cmp->family) == 0 && 2369 sel_tgt->prefixlen_d == sel_cmp->prefixlen_d && 2370 sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) { 2371 return 1; 2372 } 2373 } else { 2374 if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) { 2375 return 1; 2376 } 2377 } 2378 return 0; 2379 } 2380 2381 static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel, 2382 u8 dir, u8 type) 2383 { 2384 struct xfrm_policy *pol, *ret = NULL; 2385 struct hlist_node *entry; 2386 struct hlist_head *chain; 2387 u32 priority = ~0U; 2388 2389 read_lock_bh(&xfrm_policy_lock); 2390 chain = policy_hash_direct(&sel->daddr, &sel->saddr, sel->family, dir); 2391 hlist_for_each_entry(pol, entry, chain, bydst) { 2392 if (xfrm_migrate_selector_match(sel, &pol->selector) && 2393 pol->type == type) { 2394 ret = pol; 2395 priority = ret->priority; 2396 break; 2397 } 2398 } 2399 chain = &xfrm_policy_inexact[dir]; 2400 hlist_for_each_entry(pol, entry, chain, bydst) { 2401 if (xfrm_migrate_selector_match(sel, &pol->selector) && 2402 pol->type == type && 2403 pol->priority < priority) { 2404 ret = pol; 2405 break; 2406 } 2407 } 2408 2409 if (ret) 2410 xfrm_pol_hold(ret); 2411 2412 read_unlock_bh(&xfrm_policy_lock); 2413 2414 return ret; 2415 } 2416 2417 static int migrate_tmpl_match(struct xfrm_migrate *m, struct xfrm_tmpl *t) 2418 { 2419 int match = 0; 2420 2421 if (t->mode == m->mode && t->id.proto == m->proto && 2422 (m->reqid == 0 || t->reqid == m->reqid)) { 2423 switch (t->mode) { 2424 case XFRM_MODE_TUNNEL: 2425 case XFRM_MODE_BEET: 2426 if (xfrm_addr_cmp(&t->id.daddr, &m->old_daddr, 2427 m->old_family) == 0 && 2428 xfrm_addr_cmp(&t->saddr, &m->old_saddr, 2429 m->old_family) == 0) { 2430 match = 1; 2431 } 2432 break; 2433 case XFRM_MODE_TRANSPORT: 2434 /* in case of transport mode, template does not store 2435 any IP addresses, hence we just compare mode and 2436 protocol */ 2437 match = 1; 2438 break; 2439 default: 2440 break; 2441 } 2442 } 2443 return match; 2444 } 2445 2446 /* update endpoint address(es) of template(s) */ 2447 static int xfrm_policy_migrate(struct xfrm_policy *pol, 2448 struct xfrm_migrate *m, int num_migrate) 2449 { 2450 struct xfrm_migrate *mp; 2451 struct dst_entry *dst; 2452 int i, j, n = 0; 2453 2454 write_lock_bh(&pol->lock); 2455 if (unlikely(pol->dead)) { 2456 /* target policy has been deleted */ 2457 write_unlock_bh(&pol->lock); 2458 return -ENOENT; 2459 } 2460 2461 for (i = 0; i < pol->xfrm_nr; i++) { 2462 for (j = 0, mp = m; j < num_migrate; j++, mp++) { 2463 if (!migrate_tmpl_match(mp, &pol->xfrm_vec[i])) 2464 continue; 2465 n++; 2466 if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL) 2467 continue; 2468 /* update endpoints */ 2469 memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr, 2470 sizeof(pol->xfrm_vec[i].id.daddr)); 2471 memcpy(&pol->xfrm_vec[i].saddr, &mp->new_saddr, 2472 sizeof(pol->xfrm_vec[i].saddr)); 2473 pol->xfrm_vec[i].encap_family = mp->new_family; 2474 /* flush bundles */ 2475 while ((dst = pol->bundles) != NULL) { 2476 pol->bundles = dst->next; 2477 dst_free(dst); 2478 } 2479 } 2480 } 2481 2482 write_unlock_bh(&pol->lock); 2483 2484 if (!n) 2485 return -ENODATA; 2486 2487 return 0; 2488 } 2489 2490 static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate) 2491 { 2492 int i, j; 2493 2494 if (num_migrate < 1 || num_migrate > XFRM_MAX_DEPTH) 2495 return -EINVAL; 2496 2497 for (i = 0; i < num_migrate; i++) { 2498 if ((xfrm_addr_cmp(&m[i].old_daddr, &m[i].new_daddr, 2499 m[i].old_family) == 0) && 2500 (xfrm_addr_cmp(&m[i].old_saddr, &m[i].new_saddr, 2501 m[i].old_family) == 0)) 2502 return -EINVAL; 2503 if (xfrm_addr_any(&m[i].new_daddr, m[i].new_family) || 2504 xfrm_addr_any(&m[i].new_saddr, m[i].new_family)) 2505 return -EINVAL; 2506 2507 /* check if there is any duplicated entry */ 2508 for (j = i + 1; j < num_migrate; j++) { 2509 if (!memcmp(&m[i].old_daddr, &m[j].old_daddr, 2510 sizeof(m[i].old_daddr)) && 2511 !memcmp(&m[i].old_saddr, &m[j].old_saddr, 2512 sizeof(m[i].old_saddr)) && 2513 m[i].proto == m[j].proto && 2514 m[i].mode == m[j].mode && 2515 m[i].reqid == m[j].reqid && 2516 m[i].old_family == m[j].old_family) 2517 return -EINVAL; 2518 } 2519 } 2520 2521 return 0; 2522 } 2523 2524 int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 2525 struct xfrm_migrate *m, int num_migrate) 2526 { 2527 int i, err, nx_cur = 0, nx_new = 0; 2528 struct xfrm_policy *pol = NULL; 2529 struct xfrm_state *x, *xc; 2530 struct xfrm_state *x_cur[XFRM_MAX_DEPTH]; 2531 struct xfrm_state *x_new[XFRM_MAX_DEPTH]; 2532 struct xfrm_migrate *mp; 2533 2534 if ((err = xfrm_migrate_check(m, num_migrate)) < 0) 2535 goto out; 2536 2537 /* Stage 1 - find policy */ 2538 if ((pol = xfrm_migrate_policy_find(sel, dir, type)) == NULL) { 2539 err = -ENOENT; 2540 goto out; 2541 } 2542 2543 /* Stage 2 - find and update state(s) */ 2544 for (i = 0, mp = m; i < num_migrate; i++, mp++) { 2545 if ((x = xfrm_migrate_state_find(mp))) { 2546 x_cur[nx_cur] = x; 2547 nx_cur++; 2548 if ((xc = xfrm_state_migrate(x, mp))) { 2549 x_new[nx_new] = xc; 2550 nx_new++; 2551 } else { 2552 err = -ENODATA; 2553 goto restore_state; 2554 } 2555 } 2556 } 2557 2558 /* Stage 3 - update policy */ 2559 if ((err = xfrm_policy_migrate(pol, m, num_migrate)) < 0) 2560 goto restore_state; 2561 2562 /* Stage 4 - delete old state(s) */ 2563 if (nx_cur) { 2564 xfrm_states_put(x_cur, nx_cur); 2565 xfrm_states_delete(x_cur, nx_cur); 2566 } 2567 2568 /* Stage 5 - announce */ 2569 km_migrate(sel, dir, type, m, num_migrate); 2570 2571 xfrm_pol_put(pol); 2572 2573 return 0; 2574 out: 2575 return err; 2576 2577 restore_state: 2578 if (pol) 2579 xfrm_pol_put(pol); 2580 if (nx_cur) 2581 xfrm_states_put(x_cur, nx_cur); 2582 if (nx_new) 2583 xfrm_states_delete(x_new, nx_new); 2584 2585 return err; 2586 } 2587 EXPORT_SYMBOL(xfrm_migrate); 2588 #endif 2589