xref: /openbmc/linux/net/xfrm/xfrm_state.c (revision 5447c5e401c49aba0c36bb1066f2d25b152553b7)
1 /*
2  * xfrm_state.c
3  *
4  * Changes:
5  *	Mitsuru KANDA @USAGI
6  * 	Kazunori MIYAZAWA @USAGI
7  * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8  * 		IPv6 support
9  * 	YOSHIFUJI Hideaki @USAGI
10  * 		Split up af-specific functions
11  *	Derek Atkins <derek@ihtfp.com>
12  *		Add UDP Encapsulation
13  *
14  */
15 
16 #include <linux/workqueue.h>
17 #include <net/xfrm.h>
18 #include <linux/pfkeyv2.h>
19 #include <linux/ipsec.h>
20 #include <linux/module.h>
21 #include <linux/cache.h>
22 #include <linux/audit.h>
23 #include <asm/uaccess.h>
24 
25 #include "xfrm_hash.h"
26 
27 struct sock *xfrm_nl;
28 EXPORT_SYMBOL(xfrm_nl);
29 
30 u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
31 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
32 
33 u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
34 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
35 
36 u32 sysctl_xfrm_acq_expires __read_mostly = 30;
37 
38 /* Each xfrm_state may be linked to two tables:
39 
40    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
41    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
42       destination/tunnel endpoint. (output)
43  */
44 
45 static DEFINE_SPINLOCK(xfrm_state_lock);
46 
47 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
48 static unsigned int xfrm_state_genid;
49 
50 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
51 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
52 
53 #ifdef CONFIG_AUDITSYSCALL
54 static void xfrm_audit_state_replay(struct xfrm_state *x,
55 				    struct sk_buff *skb, __be32 net_seq);
56 #else
57 #define xfrm_audit_state_replay(x, s, sq)	do { ; } while (0)
58 #endif /* CONFIG_AUDITSYSCALL */
59 
60 static inline unsigned int xfrm_dst_hash(struct net *net,
61 					 xfrm_address_t *daddr,
62 					 xfrm_address_t *saddr,
63 					 u32 reqid,
64 					 unsigned short family)
65 {
66 	return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
67 }
68 
69 static inline unsigned int xfrm_src_hash(struct net *net,
70 					 xfrm_address_t *daddr,
71 					 xfrm_address_t *saddr,
72 					 unsigned short family)
73 {
74 	return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
75 }
76 
77 static inline unsigned int
78 xfrm_spi_hash(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
79 {
80 	return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
81 }
82 
83 static void xfrm_hash_transfer(struct hlist_head *list,
84 			       struct hlist_head *ndsttable,
85 			       struct hlist_head *nsrctable,
86 			       struct hlist_head *nspitable,
87 			       unsigned int nhashmask)
88 {
89 	struct hlist_node *entry, *tmp;
90 	struct xfrm_state *x;
91 
92 	hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
93 		unsigned int h;
94 
95 		h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
96 				    x->props.reqid, x->props.family,
97 				    nhashmask);
98 		hlist_add_head(&x->bydst, ndsttable+h);
99 
100 		h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
101 				    x->props.family,
102 				    nhashmask);
103 		hlist_add_head(&x->bysrc, nsrctable+h);
104 
105 		if (x->id.spi) {
106 			h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
107 					    x->id.proto, x->props.family,
108 					    nhashmask);
109 			hlist_add_head(&x->byspi, nspitable+h);
110 		}
111 	}
112 }
113 
114 static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
115 {
116 	return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
117 }
118 
119 static DEFINE_MUTEX(hash_resize_mutex);
120 
121 static void xfrm_hash_resize(struct work_struct *work)
122 {
123 	struct net *net = container_of(work, struct net, xfrm.state_hash_work);
124 	struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
125 	unsigned long nsize, osize;
126 	unsigned int nhashmask, ohashmask;
127 	int i;
128 
129 	mutex_lock(&hash_resize_mutex);
130 
131 	nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
132 	ndst = xfrm_hash_alloc(nsize);
133 	if (!ndst)
134 		goto out_unlock;
135 	nsrc = xfrm_hash_alloc(nsize);
136 	if (!nsrc) {
137 		xfrm_hash_free(ndst, nsize);
138 		goto out_unlock;
139 	}
140 	nspi = xfrm_hash_alloc(nsize);
141 	if (!nspi) {
142 		xfrm_hash_free(ndst, nsize);
143 		xfrm_hash_free(nsrc, nsize);
144 		goto out_unlock;
145 	}
146 
147 	spin_lock_bh(&xfrm_state_lock);
148 
149 	nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
150 	for (i = net->xfrm.state_hmask; i >= 0; i--)
151 		xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi,
152 				   nhashmask);
153 
154 	odst = net->xfrm.state_bydst;
155 	osrc = net->xfrm.state_bysrc;
156 	ospi = net->xfrm.state_byspi;
157 	ohashmask = net->xfrm.state_hmask;
158 
159 	net->xfrm.state_bydst = ndst;
160 	net->xfrm.state_bysrc = nsrc;
161 	net->xfrm.state_byspi = nspi;
162 	net->xfrm.state_hmask = nhashmask;
163 
164 	spin_unlock_bh(&xfrm_state_lock);
165 
166 	osize = (ohashmask + 1) * sizeof(struct hlist_head);
167 	xfrm_hash_free(odst, osize);
168 	xfrm_hash_free(osrc, osize);
169 	xfrm_hash_free(ospi, osize);
170 
171 out_unlock:
172 	mutex_unlock(&hash_resize_mutex);
173 }
174 
175 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
176 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
177 
178 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
179 
180 int __xfrm_state_delete(struct xfrm_state *x);
181 
182 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
183 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
184 
185 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
186 {
187 	struct xfrm_state_afinfo *afinfo;
188 	if (unlikely(family >= NPROTO))
189 		return NULL;
190 	write_lock_bh(&xfrm_state_afinfo_lock);
191 	afinfo = xfrm_state_afinfo[family];
192 	if (unlikely(!afinfo))
193 		write_unlock_bh(&xfrm_state_afinfo_lock);
194 	return afinfo;
195 }
196 
197 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
198 	__releases(xfrm_state_afinfo_lock)
199 {
200 	write_unlock_bh(&xfrm_state_afinfo_lock);
201 }
202 
203 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
204 {
205 	struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
206 	const struct xfrm_type **typemap;
207 	int err = 0;
208 
209 	if (unlikely(afinfo == NULL))
210 		return -EAFNOSUPPORT;
211 	typemap = afinfo->type_map;
212 
213 	if (likely(typemap[type->proto] == NULL))
214 		typemap[type->proto] = type;
215 	else
216 		err = -EEXIST;
217 	xfrm_state_unlock_afinfo(afinfo);
218 	return err;
219 }
220 EXPORT_SYMBOL(xfrm_register_type);
221 
222 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
223 {
224 	struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
225 	const struct xfrm_type **typemap;
226 	int err = 0;
227 
228 	if (unlikely(afinfo == NULL))
229 		return -EAFNOSUPPORT;
230 	typemap = afinfo->type_map;
231 
232 	if (unlikely(typemap[type->proto] != type))
233 		err = -ENOENT;
234 	else
235 		typemap[type->proto] = NULL;
236 	xfrm_state_unlock_afinfo(afinfo);
237 	return err;
238 }
239 EXPORT_SYMBOL(xfrm_unregister_type);
240 
241 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
242 {
243 	struct xfrm_state_afinfo *afinfo;
244 	const struct xfrm_type **typemap;
245 	const struct xfrm_type *type;
246 	int modload_attempted = 0;
247 
248 retry:
249 	afinfo = xfrm_state_get_afinfo(family);
250 	if (unlikely(afinfo == NULL))
251 		return NULL;
252 	typemap = afinfo->type_map;
253 
254 	type = typemap[proto];
255 	if (unlikely(type && !try_module_get(type->owner)))
256 		type = NULL;
257 	if (!type && !modload_attempted) {
258 		xfrm_state_put_afinfo(afinfo);
259 		request_module("xfrm-type-%d-%d", family, proto);
260 		modload_attempted = 1;
261 		goto retry;
262 	}
263 
264 	xfrm_state_put_afinfo(afinfo);
265 	return type;
266 }
267 
268 static void xfrm_put_type(const struct xfrm_type *type)
269 {
270 	module_put(type->owner);
271 }
272 
273 int xfrm_register_mode(struct xfrm_mode *mode, int family)
274 {
275 	struct xfrm_state_afinfo *afinfo;
276 	struct xfrm_mode **modemap;
277 	int err;
278 
279 	if (unlikely(mode->encap >= XFRM_MODE_MAX))
280 		return -EINVAL;
281 
282 	afinfo = xfrm_state_lock_afinfo(family);
283 	if (unlikely(afinfo == NULL))
284 		return -EAFNOSUPPORT;
285 
286 	err = -EEXIST;
287 	modemap = afinfo->mode_map;
288 	if (modemap[mode->encap])
289 		goto out;
290 
291 	err = -ENOENT;
292 	if (!try_module_get(afinfo->owner))
293 		goto out;
294 
295 	mode->afinfo = afinfo;
296 	modemap[mode->encap] = mode;
297 	err = 0;
298 
299 out:
300 	xfrm_state_unlock_afinfo(afinfo);
301 	return err;
302 }
303 EXPORT_SYMBOL(xfrm_register_mode);
304 
305 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
306 {
307 	struct xfrm_state_afinfo *afinfo;
308 	struct xfrm_mode **modemap;
309 	int err;
310 
311 	if (unlikely(mode->encap >= XFRM_MODE_MAX))
312 		return -EINVAL;
313 
314 	afinfo = xfrm_state_lock_afinfo(family);
315 	if (unlikely(afinfo == NULL))
316 		return -EAFNOSUPPORT;
317 
318 	err = -ENOENT;
319 	modemap = afinfo->mode_map;
320 	if (likely(modemap[mode->encap] == mode)) {
321 		modemap[mode->encap] = NULL;
322 		module_put(mode->afinfo->owner);
323 		err = 0;
324 	}
325 
326 	xfrm_state_unlock_afinfo(afinfo);
327 	return err;
328 }
329 EXPORT_SYMBOL(xfrm_unregister_mode);
330 
331 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
332 {
333 	struct xfrm_state_afinfo *afinfo;
334 	struct xfrm_mode *mode;
335 	int modload_attempted = 0;
336 
337 	if (unlikely(encap >= XFRM_MODE_MAX))
338 		return NULL;
339 
340 retry:
341 	afinfo = xfrm_state_get_afinfo(family);
342 	if (unlikely(afinfo == NULL))
343 		return NULL;
344 
345 	mode = afinfo->mode_map[encap];
346 	if (unlikely(mode && !try_module_get(mode->owner)))
347 		mode = NULL;
348 	if (!mode && !modload_attempted) {
349 		xfrm_state_put_afinfo(afinfo);
350 		request_module("xfrm-mode-%d-%d", family, encap);
351 		modload_attempted = 1;
352 		goto retry;
353 	}
354 
355 	xfrm_state_put_afinfo(afinfo);
356 	return mode;
357 }
358 
359 static void xfrm_put_mode(struct xfrm_mode *mode)
360 {
361 	module_put(mode->owner);
362 }
363 
364 static void xfrm_state_gc_destroy(struct xfrm_state *x)
365 {
366 	del_timer_sync(&x->timer);
367 	del_timer_sync(&x->rtimer);
368 	kfree(x->aalg);
369 	kfree(x->ealg);
370 	kfree(x->calg);
371 	kfree(x->encap);
372 	kfree(x->coaddr);
373 	if (x->inner_mode)
374 		xfrm_put_mode(x->inner_mode);
375 	if (x->inner_mode_iaf)
376 		xfrm_put_mode(x->inner_mode_iaf);
377 	if (x->outer_mode)
378 		xfrm_put_mode(x->outer_mode);
379 	if (x->type) {
380 		x->type->destructor(x);
381 		xfrm_put_type(x->type);
382 	}
383 	security_xfrm_state_free(x);
384 	kfree(x);
385 }
386 
387 static void xfrm_state_gc_task(struct work_struct *work)
388 {
389 	struct net *net = container_of(work, struct net, xfrm.state_gc_work);
390 	struct xfrm_state *x;
391 	struct hlist_node *entry, *tmp;
392 	struct hlist_head gc_list;
393 
394 	spin_lock_bh(&xfrm_state_gc_lock);
395 	hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
396 	spin_unlock_bh(&xfrm_state_gc_lock);
397 
398 	hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
399 		xfrm_state_gc_destroy(x);
400 
401 	wake_up(&net->xfrm.km_waitq);
402 }
403 
404 static inline unsigned long make_jiffies(long secs)
405 {
406 	if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
407 		return MAX_SCHEDULE_TIMEOUT-1;
408 	else
409 		return secs*HZ;
410 }
411 
412 static void xfrm_timer_handler(unsigned long data)
413 {
414 	struct xfrm_state *x = (struct xfrm_state*)data;
415 	struct net *net = xs_net(x);
416 	unsigned long now = get_seconds();
417 	long next = LONG_MAX;
418 	int warn = 0;
419 	int err = 0;
420 
421 	spin_lock(&x->lock);
422 	if (x->km.state == XFRM_STATE_DEAD)
423 		goto out;
424 	if (x->km.state == XFRM_STATE_EXPIRED)
425 		goto expired;
426 	if (x->lft.hard_add_expires_seconds) {
427 		long tmo = x->lft.hard_add_expires_seconds +
428 			x->curlft.add_time - now;
429 		if (tmo <= 0)
430 			goto expired;
431 		if (tmo < next)
432 			next = tmo;
433 	}
434 	if (x->lft.hard_use_expires_seconds) {
435 		long tmo = x->lft.hard_use_expires_seconds +
436 			(x->curlft.use_time ? : now) - now;
437 		if (tmo <= 0)
438 			goto expired;
439 		if (tmo < next)
440 			next = tmo;
441 	}
442 	if (x->km.dying)
443 		goto resched;
444 	if (x->lft.soft_add_expires_seconds) {
445 		long tmo = x->lft.soft_add_expires_seconds +
446 			x->curlft.add_time - now;
447 		if (tmo <= 0)
448 			warn = 1;
449 		else if (tmo < next)
450 			next = tmo;
451 	}
452 	if (x->lft.soft_use_expires_seconds) {
453 		long tmo = x->lft.soft_use_expires_seconds +
454 			(x->curlft.use_time ? : now) - now;
455 		if (tmo <= 0)
456 			warn = 1;
457 		else if (tmo < next)
458 			next = tmo;
459 	}
460 
461 	x->km.dying = warn;
462 	if (warn)
463 		km_state_expired(x, 0, 0);
464 resched:
465 	if (next != LONG_MAX)
466 		mod_timer(&x->timer, jiffies + make_jiffies(next));
467 
468 	goto out;
469 
470 expired:
471 	if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
472 		x->km.state = XFRM_STATE_EXPIRED;
473 		wake_up(&net->xfrm.km_waitq);
474 		next = 2;
475 		goto resched;
476 	}
477 
478 	err = __xfrm_state_delete(x);
479 	if (!err && x->id.spi)
480 		km_state_expired(x, 1, 0);
481 
482 	xfrm_audit_state_delete(x, err ? 0 : 1,
483 				audit_get_loginuid(current),
484 				audit_get_sessionid(current), 0);
485 
486 out:
487 	spin_unlock(&x->lock);
488 }
489 
490 static void xfrm_replay_timer_handler(unsigned long data);
491 
492 struct xfrm_state *xfrm_state_alloc(struct net *net)
493 {
494 	struct xfrm_state *x;
495 
496 	x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
497 
498 	if (x) {
499 		write_pnet(&x->xs_net, net);
500 		atomic_set(&x->refcnt, 1);
501 		atomic_set(&x->tunnel_users, 0);
502 		INIT_LIST_HEAD(&x->km.all);
503 		INIT_HLIST_NODE(&x->bydst);
504 		INIT_HLIST_NODE(&x->bysrc);
505 		INIT_HLIST_NODE(&x->byspi);
506 		setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
507 		setup_timer(&x->rtimer, xfrm_replay_timer_handler,
508 				(unsigned long)x);
509 		x->curlft.add_time = get_seconds();
510 		x->lft.soft_byte_limit = XFRM_INF;
511 		x->lft.soft_packet_limit = XFRM_INF;
512 		x->lft.hard_byte_limit = XFRM_INF;
513 		x->lft.hard_packet_limit = XFRM_INF;
514 		x->replay_maxage = 0;
515 		x->replay_maxdiff = 0;
516 		x->inner_mode = NULL;
517 		x->inner_mode_iaf = NULL;
518 		spin_lock_init(&x->lock);
519 	}
520 	return x;
521 }
522 EXPORT_SYMBOL(xfrm_state_alloc);
523 
524 void __xfrm_state_destroy(struct xfrm_state *x)
525 {
526 	struct net *net = xs_net(x);
527 
528 	WARN_ON(x->km.state != XFRM_STATE_DEAD);
529 
530 	spin_lock_bh(&xfrm_state_gc_lock);
531 	hlist_add_head(&x->gclist, &net->xfrm.state_gc_list);
532 	spin_unlock_bh(&xfrm_state_gc_lock);
533 	schedule_work(&net->xfrm.state_gc_work);
534 }
535 EXPORT_SYMBOL(__xfrm_state_destroy);
536 
537 int __xfrm_state_delete(struct xfrm_state *x)
538 {
539 	struct net *net = xs_net(x);
540 	int err = -ESRCH;
541 
542 	if (x->km.state != XFRM_STATE_DEAD) {
543 		x->km.state = XFRM_STATE_DEAD;
544 		spin_lock(&xfrm_state_lock);
545 		list_del(&x->km.all);
546 		hlist_del(&x->bydst);
547 		hlist_del(&x->bysrc);
548 		if (x->id.spi)
549 			hlist_del(&x->byspi);
550 		net->xfrm.state_num--;
551 		spin_unlock(&xfrm_state_lock);
552 
553 		/* All xfrm_state objects are created by xfrm_state_alloc.
554 		 * The xfrm_state_alloc call gives a reference, and that
555 		 * is what we are dropping here.
556 		 */
557 		xfrm_state_put(x);
558 		err = 0;
559 	}
560 
561 	return err;
562 }
563 EXPORT_SYMBOL(__xfrm_state_delete);
564 
565 int xfrm_state_delete(struct xfrm_state *x)
566 {
567 	int err;
568 
569 	spin_lock_bh(&x->lock);
570 	err = __xfrm_state_delete(x);
571 	spin_unlock_bh(&x->lock);
572 
573 	return err;
574 }
575 EXPORT_SYMBOL(xfrm_state_delete);
576 
577 #ifdef CONFIG_SECURITY_NETWORK_XFRM
578 static inline int
579 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
580 {
581 	int i, err = 0;
582 
583 	for (i = 0; i <= net->xfrm.state_hmask; i++) {
584 		struct hlist_node *entry;
585 		struct xfrm_state *x;
586 
587 		hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
588 			if (xfrm_id_proto_match(x->id.proto, proto) &&
589 			   (err = security_xfrm_state_delete(x)) != 0) {
590 				xfrm_audit_state_delete(x, 0,
591 							audit_info->loginuid,
592 							audit_info->sessionid,
593 							audit_info->secid);
594 				return err;
595 			}
596 		}
597 	}
598 
599 	return err;
600 }
601 #else
602 static inline int
603 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
604 {
605 	return 0;
606 }
607 #endif
608 
609 int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
610 {
611 	int i, err = 0;
612 
613 	spin_lock_bh(&xfrm_state_lock);
614 	err = xfrm_state_flush_secctx_check(net, proto, audit_info);
615 	if (err)
616 		goto out;
617 
618 	for (i = 0; i <= net->xfrm.state_hmask; i++) {
619 		struct hlist_node *entry;
620 		struct xfrm_state *x;
621 restart:
622 		hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
623 			if (!xfrm_state_kern(x) &&
624 			    xfrm_id_proto_match(x->id.proto, proto)) {
625 				xfrm_state_hold(x);
626 				spin_unlock_bh(&xfrm_state_lock);
627 
628 				err = xfrm_state_delete(x);
629 				xfrm_audit_state_delete(x, err ? 0 : 1,
630 							audit_info->loginuid,
631 							audit_info->sessionid,
632 							audit_info->secid);
633 				xfrm_state_put(x);
634 
635 				spin_lock_bh(&xfrm_state_lock);
636 				goto restart;
637 			}
638 		}
639 	}
640 	err = 0;
641 
642 out:
643 	spin_unlock_bh(&xfrm_state_lock);
644 	wake_up(&net->xfrm.km_waitq);
645 	return err;
646 }
647 EXPORT_SYMBOL(xfrm_state_flush);
648 
649 void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
650 {
651 	spin_lock_bh(&xfrm_state_lock);
652 	si->sadcnt = init_net.xfrm.state_num;
653 	si->sadhcnt = init_net.xfrm.state_hmask;
654 	si->sadhmcnt = xfrm_state_hashmax;
655 	spin_unlock_bh(&xfrm_state_lock);
656 }
657 EXPORT_SYMBOL(xfrm_sad_getinfo);
658 
659 static int
660 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
661 		  struct xfrm_tmpl *tmpl,
662 		  xfrm_address_t *daddr, xfrm_address_t *saddr,
663 		  unsigned short family)
664 {
665 	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
666 	if (!afinfo)
667 		return -1;
668 	afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
669 	xfrm_state_put_afinfo(afinfo);
670 	return 0;
671 }
672 
673 static struct xfrm_state *__xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
674 {
675 	unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
676 	struct xfrm_state *x;
677 	struct hlist_node *entry;
678 
679 	hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
680 		if (x->props.family != family ||
681 		    x->id.spi       != spi ||
682 		    x->id.proto     != proto)
683 			continue;
684 
685 		switch (family) {
686 		case AF_INET:
687 			if (x->id.daddr.a4 != daddr->a4)
688 				continue;
689 			break;
690 		case AF_INET6:
691 			if (!ipv6_addr_equal((struct in6_addr *)daddr,
692 					     (struct in6_addr *)
693 					     x->id.daddr.a6))
694 				continue;
695 			break;
696 		}
697 
698 		xfrm_state_hold(x);
699 		return x;
700 	}
701 
702 	return NULL;
703 }
704 
705 static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
706 {
707 	unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
708 	struct xfrm_state *x;
709 	struct hlist_node *entry;
710 
711 	hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
712 		if (x->props.family != family ||
713 		    x->id.proto     != proto)
714 			continue;
715 
716 		switch (family) {
717 		case AF_INET:
718 			if (x->id.daddr.a4 != daddr->a4 ||
719 			    x->props.saddr.a4 != saddr->a4)
720 				continue;
721 			break;
722 		case AF_INET6:
723 			if (!ipv6_addr_equal((struct in6_addr *)daddr,
724 					     (struct in6_addr *)
725 					     x->id.daddr.a6) ||
726 			    !ipv6_addr_equal((struct in6_addr *)saddr,
727 					     (struct in6_addr *)
728 					     x->props.saddr.a6))
729 				continue;
730 			break;
731 		}
732 
733 		xfrm_state_hold(x);
734 		return x;
735 	}
736 
737 	return NULL;
738 }
739 
740 static inline struct xfrm_state *
741 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
742 {
743 	struct net *net = xs_net(x);
744 
745 	if (use_spi)
746 		return __xfrm_state_lookup(net, &x->id.daddr, x->id.spi,
747 					   x->id.proto, family);
748 	else
749 		return __xfrm_state_lookup_byaddr(net, &x->id.daddr,
750 						  &x->props.saddr,
751 						  x->id.proto, family);
752 }
753 
754 static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
755 {
756 	if (have_hash_collision &&
757 	    (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
758 	    net->xfrm.state_num > net->xfrm.state_hmask)
759 		schedule_work(&net->xfrm.state_hash_work);
760 }
761 
762 struct xfrm_state *
763 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
764 		struct flowi *fl, struct xfrm_tmpl *tmpl,
765 		struct xfrm_policy *pol, int *err,
766 		unsigned short family)
767 {
768 	struct net *net = xp_net(pol);
769 	unsigned int h;
770 	struct hlist_node *entry;
771 	struct xfrm_state *x, *x0, *to_put;
772 	int acquire_in_progress = 0;
773 	int error = 0;
774 	struct xfrm_state *best = NULL;
775 
776 	to_put = NULL;
777 
778 	spin_lock_bh(&xfrm_state_lock);
779 	h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, family);
780 	hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
781 		if (x->props.family == family &&
782 		    x->props.reqid == tmpl->reqid &&
783 		    !(x->props.flags & XFRM_STATE_WILDRECV) &&
784 		    xfrm_state_addr_check(x, daddr, saddr, family) &&
785 		    tmpl->mode == x->props.mode &&
786 		    tmpl->id.proto == x->id.proto &&
787 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
788 			/* Resolution logic:
789 			   1. There is a valid state with matching selector.
790 			      Done.
791 			   2. Valid state with inappropriate selector. Skip.
792 
793 			   Entering area of "sysdeps".
794 
795 			   3. If state is not valid, selector is temporary,
796 			      it selects only session which triggered
797 			      previous resolution. Key manager will do
798 			      something to install a state with proper
799 			      selector.
800 			 */
801 			if (x->km.state == XFRM_STATE_VALID) {
802 				if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
803 				    !security_xfrm_state_pol_flow_match(x, pol, fl))
804 					continue;
805 				if (!best ||
806 				    best->km.dying > x->km.dying ||
807 				    (best->km.dying == x->km.dying &&
808 				     best->curlft.add_time < x->curlft.add_time))
809 					best = x;
810 			} else if (x->km.state == XFRM_STATE_ACQ) {
811 				acquire_in_progress = 1;
812 			} else if (x->km.state == XFRM_STATE_ERROR ||
813 				   x->km.state == XFRM_STATE_EXPIRED) {
814 				if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
815 				    security_xfrm_state_pol_flow_match(x, pol, fl))
816 					error = -ESRCH;
817 			}
818 		}
819 	}
820 
821 	x = best;
822 	if (!x && !error && !acquire_in_progress) {
823 		if (tmpl->id.spi &&
824 		    (x0 = __xfrm_state_lookup(net, daddr, tmpl->id.spi,
825 					      tmpl->id.proto, family)) != NULL) {
826 			to_put = x0;
827 			error = -EEXIST;
828 			goto out;
829 		}
830 		x = xfrm_state_alloc(net);
831 		if (x == NULL) {
832 			error = -ENOMEM;
833 			goto out;
834 		}
835 		/* Initialize temporary selector matching only
836 		 * to current session. */
837 		xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
838 
839 		error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
840 		if (error) {
841 			x->km.state = XFRM_STATE_DEAD;
842 			to_put = x;
843 			x = NULL;
844 			goto out;
845 		}
846 
847 		if (km_query(x, tmpl, pol) == 0) {
848 			x->km.state = XFRM_STATE_ACQ;
849 			list_add(&x->km.all, &net->xfrm.state_all);
850 			hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
851 			h = xfrm_src_hash(net, daddr, saddr, family);
852 			hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
853 			if (x->id.spi) {
854 				h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, family);
855 				hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
856 			}
857 			x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
858 			x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
859 			add_timer(&x->timer);
860 			net->xfrm.state_num++;
861 			xfrm_hash_grow_check(net, x->bydst.next != NULL);
862 		} else {
863 			x->km.state = XFRM_STATE_DEAD;
864 			to_put = x;
865 			x = NULL;
866 			error = -ESRCH;
867 		}
868 	}
869 out:
870 	if (x)
871 		xfrm_state_hold(x);
872 	else
873 		*err = acquire_in_progress ? -EAGAIN : error;
874 	spin_unlock_bh(&xfrm_state_lock);
875 	if (to_put)
876 		xfrm_state_put(to_put);
877 	return x;
878 }
879 
880 struct xfrm_state *
881 xfrm_stateonly_find(struct net *net,
882 		    xfrm_address_t *daddr, xfrm_address_t *saddr,
883 		    unsigned short family, u8 mode, u8 proto, u32 reqid)
884 {
885 	unsigned int h;
886 	struct xfrm_state *rx = NULL, *x = NULL;
887 	struct hlist_node *entry;
888 
889 	spin_lock(&xfrm_state_lock);
890 	h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
891 	hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
892 		if (x->props.family == family &&
893 		    x->props.reqid == reqid &&
894 		    !(x->props.flags & XFRM_STATE_WILDRECV) &&
895 		    xfrm_state_addr_check(x, daddr, saddr, family) &&
896 		    mode == x->props.mode &&
897 		    proto == x->id.proto &&
898 		    x->km.state == XFRM_STATE_VALID) {
899 			rx = x;
900 			break;
901 		}
902 	}
903 
904 	if (rx)
905 		xfrm_state_hold(rx);
906 	spin_unlock(&xfrm_state_lock);
907 
908 
909 	return rx;
910 }
911 EXPORT_SYMBOL(xfrm_stateonly_find);
912 
913 static void __xfrm_state_insert(struct xfrm_state *x)
914 {
915 	struct net *net = xs_net(x);
916 	unsigned int h;
917 
918 	x->genid = ++xfrm_state_genid;
919 
920 	list_add(&x->km.all, &net->xfrm.state_all);
921 
922 	h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
923 			  x->props.reqid, x->props.family);
924 	hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
925 
926 	h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
927 	hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
928 
929 	if (x->id.spi) {
930 		h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
931 				  x->props.family);
932 
933 		hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
934 	}
935 
936 	mod_timer(&x->timer, jiffies + HZ);
937 	if (x->replay_maxage)
938 		mod_timer(&x->rtimer, jiffies + x->replay_maxage);
939 
940 	wake_up(&net->xfrm.km_waitq);
941 
942 	net->xfrm.state_num++;
943 
944 	xfrm_hash_grow_check(net, x->bydst.next != NULL);
945 }
946 
947 /* xfrm_state_lock is held */
948 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
949 {
950 	struct net *net = xs_net(xnew);
951 	unsigned short family = xnew->props.family;
952 	u32 reqid = xnew->props.reqid;
953 	struct xfrm_state *x;
954 	struct hlist_node *entry;
955 	unsigned int h;
956 
957 	h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
958 	hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
959 		if (x->props.family	== family &&
960 		    x->props.reqid	== reqid &&
961 		    !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
962 		    !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
963 			x->genid = xfrm_state_genid;
964 	}
965 }
966 
967 void xfrm_state_insert(struct xfrm_state *x)
968 {
969 	spin_lock_bh(&xfrm_state_lock);
970 	__xfrm_state_bump_genids(x);
971 	__xfrm_state_insert(x);
972 	spin_unlock_bh(&xfrm_state_lock);
973 }
974 EXPORT_SYMBOL(xfrm_state_insert);
975 
976 /* xfrm_state_lock is held */
977 static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
978 {
979 	unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
980 	struct hlist_node *entry;
981 	struct xfrm_state *x;
982 
983 	hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
984 		if (x->props.reqid  != reqid ||
985 		    x->props.mode   != mode ||
986 		    x->props.family != family ||
987 		    x->km.state     != XFRM_STATE_ACQ ||
988 		    x->id.spi       != 0 ||
989 		    x->id.proto	    != proto)
990 			continue;
991 
992 		switch (family) {
993 		case AF_INET:
994 			if (x->id.daddr.a4    != daddr->a4 ||
995 			    x->props.saddr.a4 != saddr->a4)
996 				continue;
997 			break;
998 		case AF_INET6:
999 			if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
1000 					     (struct in6_addr *)daddr) ||
1001 			    !ipv6_addr_equal((struct in6_addr *)
1002 					     x->props.saddr.a6,
1003 					     (struct in6_addr *)saddr))
1004 				continue;
1005 			break;
1006 		}
1007 
1008 		xfrm_state_hold(x);
1009 		return x;
1010 	}
1011 
1012 	if (!create)
1013 		return NULL;
1014 
1015 	x = xfrm_state_alloc(net);
1016 	if (likely(x)) {
1017 		switch (family) {
1018 		case AF_INET:
1019 			x->sel.daddr.a4 = daddr->a4;
1020 			x->sel.saddr.a4 = saddr->a4;
1021 			x->sel.prefixlen_d = 32;
1022 			x->sel.prefixlen_s = 32;
1023 			x->props.saddr.a4 = saddr->a4;
1024 			x->id.daddr.a4 = daddr->a4;
1025 			break;
1026 
1027 		case AF_INET6:
1028 			ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1029 				       (struct in6_addr *)daddr);
1030 			ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1031 				       (struct in6_addr *)saddr);
1032 			x->sel.prefixlen_d = 128;
1033 			x->sel.prefixlen_s = 128;
1034 			ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1035 				       (struct in6_addr *)saddr);
1036 			ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1037 				       (struct in6_addr *)daddr);
1038 			break;
1039 		}
1040 
1041 		x->km.state = XFRM_STATE_ACQ;
1042 		x->id.proto = proto;
1043 		x->props.family = family;
1044 		x->props.mode = mode;
1045 		x->props.reqid = reqid;
1046 		x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
1047 		xfrm_state_hold(x);
1048 		x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1049 		add_timer(&x->timer);
1050 		list_add(&x->km.all, &net->xfrm.state_all);
1051 		hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
1052 		h = xfrm_src_hash(net, daddr, saddr, family);
1053 		hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
1054 
1055 		net->xfrm.state_num++;
1056 
1057 		xfrm_hash_grow_check(net, x->bydst.next != NULL);
1058 	}
1059 
1060 	return x;
1061 }
1062 
1063 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq);
1064 
1065 int xfrm_state_add(struct xfrm_state *x)
1066 {
1067 	struct net *net = xs_net(x);
1068 	struct xfrm_state *x1, *to_put;
1069 	int family;
1070 	int err;
1071 	int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1072 
1073 	family = x->props.family;
1074 
1075 	to_put = NULL;
1076 
1077 	spin_lock_bh(&xfrm_state_lock);
1078 
1079 	x1 = __xfrm_state_locate(x, use_spi, family);
1080 	if (x1) {
1081 		to_put = x1;
1082 		x1 = NULL;
1083 		err = -EEXIST;
1084 		goto out;
1085 	}
1086 
1087 	if (use_spi && x->km.seq) {
1088 		x1 = __xfrm_find_acq_byseq(net, x->km.seq);
1089 		if (x1 && ((x1->id.proto != x->id.proto) ||
1090 		    xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1091 			to_put = x1;
1092 			x1 = NULL;
1093 		}
1094 	}
1095 
1096 	if (use_spi && !x1)
1097 		x1 = __find_acq_core(net, family, x->props.mode, x->props.reqid,
1098 				     x->id.proto,
1099 				     &x->id.daddr, &x->props.saddr, 0);
1100 
1101 	__xfrm_state_bump_genids(x);
1102 	__xfrm_state_insert(x);
1103 	err = 0;
1104 
1105 out:
1106 	spin_unlock_bh(&xfrm_state_lock);
1107 
1108 	if (x1) {
1109 		xfrm_state_delete(x1);
1110 		xfrm_state_put(x1);
1111 	}
1112 
1113 	if (to_put)
1114 		xfrm_state_put(to_put);
1115 
1116 	return err;
1117 }
1118 EXPORT_SYMBOL(xfrm_state_add);
1119 
1120 #ifdef CONFIG_XFRM_MIGRATE
1121 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1122 {
1123 	struct net *net = xs_net(orig);
1124 	int err = -ENOMEM;
1125 	struct xfrm_state *x = xfrm_state_alloc(net);
1126 	if (!x)
1127 		goto error;
1128 
1129 	memcpy(&x->id, &orig->id, sizeof(x->id));
1130 	memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1131 	memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1132 	x->props.mode = orig->props.mode;
1133 	x->props.replay_window = orig->props.replay_window;
1134 	x->props.reqid = orig->props.reqid;
1135 	x->props.family = orig->props.family;
1136 	x->props.saddr = orig->props.saddr;
1137 
1138 	if (orig->aalg) {
1139 		x->aalg = xfrm_algo_clone(orig->aalg);
1140 		if (!x->aalg)
1141 			goto error;
1142 	}
1143 	x->props.aalgo = orig->props.aalgo;
1144 
1145 	if (orig->ealg) {
1146 		x->ealg = xfrm_algo_clone(orig->ealg);
1147 		if (!x->ealg)
1148 			goto error;
1149 	}
1150 	x->props.ealgo = orig->props.ealgo;
1151 
1152 	if (orig->calg) {
1153 		x->calg = xfrm_algo_clone(orig->calg);
1154 		if (!x->calg)
1155 			goto error;
1156 	}
1157 	x->props.calgo = orig->props.calgo;
1158 
1159 	if (orig->encap) {
1160 		x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1161 		if (!x->encap)
1162 			goto error;
1163 	}
1164 
1165 	if (orig->coaddr) {
1166 		x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1167 				    GFP_KERNEL);
1168 		if (!x->coaddr)
1169 			goto error;
1170 	}
1171 
1172 	err = xfrm_init_state(x);
1173 	if (err)
1174 		goto error;
1175 
1176 	x->props.flags = orig->props.flags;
1177 
1178 	x->curlft.add_time = orig->curlft.add_time;
1179 	x->km.state = orig->km.state;
1180 	x->km.seq = orig->km.seq;
1181 
1182 	return x;
1183 
1184  error:
1185 	if (errp)
1186 		*errp = err;
1187 	if (x) {
1188 		kfree(x->aalg);
1189 		kfree(x->ealg);
1190 		kfree(x->calg);
1191 		kfree(x->encap);
1192 		kfree(x->coaddr);
1193 	}
1194 	kfree(x);
1195 	return NULL;
1196 }
1197 
1198 /* xfrm_state_lock is held */
1199 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1200 {
1201 	unsigned int h;
1202 	struct xfrm_state *x;
1203 	struct hlist_node *entry;
1204 
1205 	if (m->reqid) {
1206 		h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr,
1207 				  m->reqid, m->old_family);
1208 		hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
1209 			if (x->props.mode != m->mode ||
1210 			    x->id.proto != m->proto)
1211 				continue;
1212 			if (m->reqid && x->props.reqid != m->reqid)
1213 				continue;
1214 			if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1215 					  m->old_family) ||
1216 			    xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1217 					  m->old_family))
1218 				continue;
1219 			xfrm_state_hold(x);
1220 			return x;
1221 		}
1222 	} else {
1223 		h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr,
1224 				  m->old_family);
1225 		hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
1226 			if (x->props.mode != m->mode ||
1227 			    x->id.proto != m->proto)
1228 				continue;
1229 			if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1230 					  m->old_family) ||
1231 			    xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1232 					  m->old_family))
1233 				continue;
1234 			xfrm_state_hold(x);
1235 			return x;
1236 		}
1237 	}
1238 
1239 	return NULL;
1240 }
1241 EXPORT_SYMBOL(xfrm_migrate_state_find);
1242 
1243 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1244 				       struct xfrm_migrate *m)
1245 {
1246 	struct xfrm_state *xc;
1247 	int err;
1248 
1249 	xc = xfrm_state_clone(x, &err);
1250 	if (!xc)
1251 		return NULL;
1252 
1253 	memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1254 	memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1255 
1256 	/* add state */
1257 	if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1258 		/* a care is needed when the destination address of the
1259 		   state is to be updated as it is a part of triplet */
1260 		xfrm_state_insert(xc);
1261 	} else {
1262 		if ((err = xfrm_state_add(xc)) < 0)
1263 			goto error;
1264 	}
1265 
1266 	return xc;
1267 error:
1268 	kfree(xc);
1269 	return NULL;
1270 }
1271 EXPORT_SYMBOL(xfrm_state_migrate);
1272 #endif
1273 
1274 int xfrm_state_update(struct xfrm_state *x)
1275 {
1276 	struct xfrm_state *x1, *to_put;
1277 	int err;
1278 	int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1279 
1280 	to_put = NULL;
1281 
1282 	spin_lock_bh(&xfrm_state_lock);
1283 	x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1284 
1285 	err = -ESRCH;
1286 	if (!x1)
1287 		goto out;
1288 
1289 	if (xfrm_state_kern(x1)) {
1290 		to_put = x1;
1291 		err = -EEXIST;
1292 		goto out;
1293 	}
1294 
1295 	if (x1->km.state == XFRM_STATE_ACQ) {
1296 		__xfrm_state_insert(x);
1297 		x = NULL;
1298 	}
1299 	err = 0;
1300 
1301 out:
1302 	spin_unlock_bh(&xfrm_state_lock);
1303 
1304 	if (to_put)
1305 		xfrm_state_put(to_put);
1306 
1307 	if (err)
1308 		return err;
1309 
1310 	if (!x) {
1311 		xfrm_state_delete(x1);
1312 		xfrm_state_put(x1);
1313 		return 0;
1314 	}
1315 
1316 	err = -EINVAL;
1317 	spin_lock_bh(&x1->lock);
1318 	if (likely(x1->km.state == XFRM_STATE_VALID)) {
1319 		if (x->encap && x1->encap)
1320 			memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1321 		if (x->coaddr && x1->coaddr) {
1322 			memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1323 		}
1324 		if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1325 			memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1326 		memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1327 		x1->km.dying = 0;
1328 
1329 		mod_timer(&x1->timer, jiffies + HZ);
1330 		if (x1->curlft.use_time)
1331 			xfrm_state_check_expire(x1);
1332 
1333 		err = 0;
1334 	}
1335 	spin_unlock_bh(&x1->lock);
1336 
1337 	xfrm_state_put(x1);
1338 
1339 	return err;
1340 }
1341 EXPORT_SYMBOL(xfrm_state_update);
1342 
1343 int xfrm_state_check_expire(struct xfrm_state *x)
1344 {
1345 	if (!x->curlft.use_time)
1346 		x->curlft.use_time = get_seconds();
1347 
1348 	if (x->km.state != XFRM_STATE_VALID)
1349 		return -EINVAL;
1350 
1351 	if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1352 	    x->curlft.packets >= x->lft.hard_packet_limit) {
1353 		x->km.state = XFRM_STATE_EXPIRED;
1354 		mod_timer(&x->timer, jiffies);
1355 		return -EINVAL;
1356 	}
1357 
1358 	if (!x->km.dying &&
1359 	    (x->curlft.bytes >= x->lft.soft_byte_limit ||
1360 	     x->curlft.packets >= x->lft.soft_packet_limit)) {
1361 		x->km.dying = 1;
1362 		km_state_expired(x, 0, 0);
1363 	}
1364 	return 0;
1365 }
1366 EXPORT_SYMBOL(xfrm_state_check_expire);
1367 
1368 struct xfrm_state *
1369 xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto,
1370 		  unsigned short family)
1371 {
1372 	struct xfrm_state *x;
1373 
1374 	spin_lock_bh(&xfrm_state_lock);
1375 	x = __xfrm_state_lookup(net, daddr, spi, proto, family);
1376 	spin_unlock_bh(&xfrm_state_lock);
1377 	return x;
1378 }
1379 EXPORT_SYMBOL(xfrm_state_lookup);
1380 
1381 struct xfrm_state *
1382 xfrm_state_lookup_byaddr(struct net *net,
1383 			 xfrm_address_t *daddr, xfrm_address_t *saddr,
1384 			 u8 proto, unsigned short family)
1385 {
1386 	struct xfrm_state *x;
1387 
1388 	spin_lock_bh(&xfrm_state_lock);
1389 	x = __xfrm_state_lookup_byaddr(net, daddr, saddr, proto, family);
1390 	spin_unlock_bh(&xfrm_state_lock);
1391 	return x;
1392 }
1393 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1394 
1395 struct xfrm_state *
1396 xfrm_find_acq(struct net *net, u8 mode, u32 reqid, u8 proto,
1397 	      xfrm_address_t *daddr, xfrm_address_t *saddr,
1398 	      int create, unsigned short family)
1399 {
1400 	struct xfrm_state *x;
1401 
1402 	spin_lock_bh(&xfrm_state_lock);
1403 	x = __find_acq_core(net, family, mode, reqid, proto, daddr, saddr, create);
1404 	spin_unlock_bh(&xfrm_state_lock);
1405 
1406 	return x;
1407 }
1408 EXPORT_SYMBOL(xfrm_find_acq);
1409 
1410 #ifdef CONFIG_XFRM_SUB_POLICY
1411 int
1412 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1413 	       unsigned short family)
1414 {
1415 	int err = 0;
1416 	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1417 	if (!afinfo)
1418 		return -EAFNOSUPPORT;
1419 
1420 	spin_lock_bh(&xfrm_state_lock);
1421 	if (afinfo->tmpl_sort)
1422 		err = afinfo->tmpl_sort(dst, src, n);
1423 	spin_unlock_bh(&xfrm_state_lock);
1424 	xfrm_state_put_afinfo(afinfo);
1425 	return err;
1426 }
1427 EXPORT_SYMBOL(xfrm_tmpl_sort);
1428 
1429 int
1430 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1431 		unsigned short family)
1432 {
1433 	int err = 0;
1434 	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1435 	if (!afinfo)
1436 		return -EAFNOSUPPORT;
1437 
1438 	spin_lock_bh(&xfrm_state_lock);
1439 	if (afinfo->state_sort)
1440 		err = afinfo->state_sort(dst, src, n);
1441 	spin_unlock_bh(&xfrm_state_lock);
1442 	xfrm_state_put_afinfo(afinfo);
1443 	return err;
1444 }
1445 EXPORT_SYMBOL(xfrm_state_sort);
1446 #endif
1447 
1448 /* Silly enough, but I'm lazy to build resolution list */
1449 
1450 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq)
1451 {
1452 	int i;
1453 
1454 	for (i = 0; i <= net->xfrm.state_hmask; i++) {
1455 		struct hlist_node *entry;
1456 		struct xfrm_state *x;
1457 
1458 		hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
1459 			if (x->km.seq == seq &&
1460 			    x->km.state == XFRM_STATE_ACQ) {
1461 				xfrm_state_hold(x);
1462 				return x;
1463 			}
1464 		}
1465 	}
1466 	return NULL;
1467 }
1468 
1469 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 seq)
1470 {
1471 	struct xfrm_state *x;
1472 
1473 	spin_lock_bh(&xfrm_state_lock);
1474 	x = __xfrm_find_acq_byseq(net, seq);
1475 	spin_unlock_bh(&xfrm_state_lock);
1476 	return x;
1477 }
1478 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1479 
1480 u32 xfrm_get_acqseq(void)
1481 {
1482 	u32 res;
1483 	static u32 acqseq;
1484 	static DEFINE_SPINLOCK(acqseq_lock);
1485 
1486 	spin_lock_bh(&acqseq_lock);
1487 	res = (++acqseq ? : ++acqseq);
1488 	spin_unlock_bh(&acqseq_lock);
1489 	return res;
1490 }
1491 EXPORT_SYMBOL(xfrm_get_acqseq);
1492 
1493 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1494 {
1495 	struct net *net = xs_net(x);
1496 	unsigned int h;
1497 	struct xfrm_state *x0;
1498 	int err = -ENOENT;
1499 	__be32 minspi = htonl(low);
1500 	__be32 maxspi = htonl(high);
1501 
1502 	spin_lock_bh(&x->lock);
1503 	if (x->km.state == XFRM_STATE_DEAD)
1504 		goto unlock;
1505 
1506 	err = 0;
1507 	if (x->id.spi)
1508 		goto unlock;
1509 
1510 	err = -ENOENT;
1511 
1512 	if (minspi == maxspi) {
1513 		x0 = xfrm_state_lookup(net, &x->id.daddr, minspi, x->id.proto, x->props.family);
1514 		if (x0) {
1515 			xfrm_state_put(x0);
1516 			goto unlock;
1517 		}
1518 		x->id.spi = minspi;
1519 	} else {
1520 		u32 spi = 0;
1521 		for (h=0; h<high-low+1; h++) {
1522 			spi = low + net_random()%(high-low+1);
1523 			x0 = xfrm_state_lookup(net, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1524 			if (x0 == NULL) {
1525 				x->id.spi = htonl(spi);
1526 				break;
1527 			}
1528 			xfrm_state_put(x0);
1529 		}
1530 	}
1531 	if (x->id.spi) {
1532 		spin_lock_bh(&xfrm_state_lock);
1533 		h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1534 		hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
1535 		spin_unlock_bh(&xfrm_state_lock);
1536 
1537 		err = 0;
1538 	}
1539 
1540 unlock:
1541 	spin_unlock_bh(&x->lock);
1542 
1543 	return err;
1544 }
1545 EXPORT_SYMBOL(xfrm_alloc_spi);
1546 
1547 int xfrm_state_walk(struct xfrm_state_walk *walk,
1548 		    int (*func)(struct xfrm_state *, int, void*),
1549 		    void *data)
1550 {
1551 	struct xfrm_state *state;
1552 	struct xfrm_state_walk *x;
1553 	int err = 0;
1554 
1555 	if (walk->seq != 0 && list_empty(&walk->all))
1556 		return 0;
1557 
1558 	spin_lock_bh(&xfrm_state_lock);
1559 	if (list_empty(&walk->all))
1560 		x = list_first_entry(&init_net.xfrm.state_all, struct xfrm_state_walk, all);
1561 	else
1562 		x = list_entry(&walk->all, struct xfrm_state_walk, all);
1563 	list_for_each_entry_from(x, &init_net.xfrm.state_all, all) {
1564 		if (x->state == XFRM_STATE_DEAD)
1565 			continue;
1566 		state = container_of(x, struct xfrm_state, km);
1567 		if (!xfrm_id_proto_match(state->id.proto, walk->proto))
1568 			continue;
1569 		err = func(state, walk->seq, data);
1570 		if (err) {
1571 			list_move_tail(&walk->all, &x->all);
1572 			goto out;
1573 		}
1574 		walk->seq++;
1575 	}
1576 	if (walk->seq == 0) {
1577 		err = -ENOENT;
1578 		goto out;
1579 	}
1580 	list_del_init(&walk->all);
1581 out:
1582 	spin_unlock_bh(&xfrm_state_lock);
1583 	return err;
1584 }
1585 EXPORT_SYMBOL(xfrm_state_walk);
1586 
1587 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
1588 {
1589 	INIT_LIST_HEAD(&walk->all);
1590 	walk->proto = proto;
1591 	walk->state = XFRM_STATE_DEAD;
1592 	walk->seq = 0;
1593 }
1594 EXPORT_SYMBOL(xfrm_state_walk_init);
1595 
1596 void xfrm_state_walk_done(struct xfrm_state_walk *walk)
1597 {
1598 	if (list_empty(&walk->all))
1599 		return;
1600 
1601 	spin_lock_bh(&xfrm_state_lock);
1602 	list_del(&walk->all);
1603 	spin_lock_bh(&xfrm_state_lock);
1604 }
1605 EXPORT_SYMBOL(xfrm_state_walk_done);
1606 
1607 
1608 void xfrm_replay_notify(struct xfrm_state *x, int event)
1609 {
1610 	struct km_event c;
1611 	/* we send notify messages in case
1612 	 *  1. we updated on of the sequence numbers, and the seqno difference
1613 	 *     is at least x->replay_maxdiff, in this case we also update the
1614 	 *     timeout of our timer function
1615 	 *  2. if x->replay_maxage has elapsed since last update,
1616 	 *     and there were changes
1617 	 *
1618 	 *  The state structure must be locked!
1619 	 */
1620 
1621 	switch (event) {
1622 	case XFRM_REPLAY_UPDATE:
1623 		if (x->replay_maxdiff &&
1624 		    (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1625 		    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1626 			if (x->xflags & XFRM_TIME_DEFER)
1627 				event = XFRM_REPLAY_TIMEOUT;
1628 			else
1629 				return;
1630 		}
1631 
1632 		break;
1633 
1634 	case XFRM_REPLAY_TIMEOUT:
1635 		if ((x->replay.seq == x->preplay.seq) &&
1636 		    (x->replay.bitmap == x->preplay.bitmap) &&
1637 		    (x->replay.oseq == x->preplay.oseq)) {
1638 			x->xflags |= XFRM_TIME_DEFER;
1639 			return;
1640 		}
1641 
1642 		break;
1643 	}
1644 
1645 	memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1646 	c.event = XFRM_MSG_NEWAE;
1647 	c.data.aevent = event;
1648 	km_state_notify(x, &c);
1649 
1650 	if (x->replay_maxage &&
1651 	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1652 		x->xflags &= ~XFRM_TIME_DEFER;
1653 }
1654 
1655 static void xfrm_replay_timer_handler(unsigned long data)
1656 {
1657 	struct xfrm_state *x = (struct xfrm_state*)data;
1658 
1659 	spin_lock(&x->lock);
1660 
1661 	if (x->km.state == XFRM_STATE_VALID) {
1662 		if (xfrm_aevent_is_on())
1663 			xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1664 		else
1665 			x->xflags |= XFRM_TIME_DEFER;
1666 	}
1667 
1668 	spin_unlock(&x->lock);
1669 }
1670 
1671 int xfrm_replay_check(struct xfrm_state *x,
1672 		      struct sk_buff *skb, __be32 net_seq)
1673 {
1674 	u32 diff;
1675 	u32 seq = ntohl(net_seq);
1676 
1677 	if (unlikely(seq == 0))
1678 		goto err;
1679 
1680 	if (likely(seq > x->replay.seq))
1681 		return 0;
1682 
1683 	diff = x->replay.seq - seq;
1684 	if (diff >= min_t(unsigned int, x->props.replay_window,
1685 			  sizeof(x->replay.bitmap) * 8)) {
1686 		x->stats.replay_window++;
1687 		goto err;
1688 	}
1689 
1690 	if (x->replay.bitmap & (1U << diff)) {
1691 		x->stats.replay++;
1692 		goto err;
1693 	}
1694 	return 0;
1695 
1696 err:
1697 	xfrm_audit_state_replay(x, skb, net_seq);
1698 	return -EINVAL;
1699 }
1700 
1701 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1702 {
1703 	u32 diff;
1704 	u32 seq = ntohl(net_seq);
1705 
1706 	if (seq > x->replay.seq) {
1707 		diff = seq - x->replay.seq;
1708 		if (diff < x->props.replay_window)
1709 			x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1710 		else
1711 			x->replay.bitmap = 1;
1712 		x->replay.seq = seq;
1713 	} else {
1714 		diff = x->replay.seq - seq;
1715 		x->replay.bitmap |= (1U << diff);
1716 	}
1717 
1718 	if (xfrm_aevent_is_on())
1719 		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1720 }
1721 
1722 static LIST_HEAD(xfrm_km_list);
1723 static DEFINE_RWLOCK(xfrm_km_lock);
1724 
1725 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1726 {
1727 	struct xfrm_mgr *km;
1728 
1729 	read_lock(&xfrm_km_lock);
1730 	list_for_each_entry(km, &xfrm_km_list, list)
1731 		if (km->notify_policy)
1732 			km->notify_policy(xp, dir, c);
1733 	read_unlock(&xfrm_km_lock);
1734 }
1735 
1736 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1737 {
1738 	struct xfrm_mgr *km;
1739 	read_lock(&xfrm_km_lock);
1740 	list_for_each_entry(km, &xfrm_km_list, list)
1741 		if (km->notify)
1742 			km->notify(x, c);
1743 	read_unlock(&xfrm_km_lock);
1744 }
1745 
1746 EXPORT_SYMBOL(km_policy_notify);
1747 EXPORT_SYMBOL(km_state_notify);
1748 
1749 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1750 {
1751 	struct net *net = xs_net(x);
1752 	struct km_event c;
1753 
1754 	c.data.hard = hard;
1755 	c.pid = pid;
1756 	c.event = XFRM_MSG_EXPIRE;
1757 	km_state_notify(x, &c);
1758 
1759 	if (hard)
1760 		wake_up(&net->xfrm.km_waitq);
1761 }
1762 
1763 EXPORT_SYMBOL(km_state_expired);
1764 /*
1765  * We send to all registered managers regardless of failure
1766  * We are happy with one success
1767 */
1768 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1769 {
1770 	int err = -EINVAL, acqret;
1771 	struct xfrm_mgr *km;
1772 
1773 	read_lock(&xfrm_km_lock);
1774 	list_for_each_entry(km, &xfrm_km_list, list) {
1775 		acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1776 		if (!acqret)
1777 			err = acqret;
1778 	}
1779 	read_unlock(&xfrm_km_lock);
1780 	return err;
1781 }
1782 EXPORT_SYMBOL(km_query);
1783 
1784 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1785 {
1786 	int err = -EINVAL;
1787 	struct xfrm_mgr *km;
1788 
1789 	read_lock(&xfrm_km_lock);
1790 	list_for_each_entry(km, &xfrm_km_list, list) {
1791 		if (km->new_mapping)
1792 			err = km->new_mapping(x, ipaddr, sport);
1793 		if (!err)
1794 			break;
1795 	}
1796 	read_unlock(&xfrm_km_lock);
1797 	return err;
1798 }
1799 EXPORT_SYMBOL(km_new_mapping);
1800 
1801 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1802 {
1803 	struct net *net = xp_net(pol);
1804 	struct km_event c;
1805 
1806 	c.data.hard = hard;
1807 	c.pid = pid;
1808 	c.event = XFRM_MSG_POLEXPIRE;
1809 	km_policy_notify(pol, dir, &c);
1810 
1811 	if (hard)
1812 		wake_up(&net->xfrm.km_waitq);
1813 }
1814 EXPORT_SYMBOL(km_policy_expired);
1815 
1816 #ifdef CONFIG_XFRM_MIGRATE
1817 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1818 	       struct xfrm_migrate *m, int num_migrate,
1819 	       struct xfrm_kmaddress *k)
1820 {
1821 	int err = -EINVAL;
1822 	int ret;
1823 	struct xfrm_mgr *km;
1824 
1825 	read_lock(&xfrm_km_lock);
1826 	list_for_each_entry(km, &xfrm_km_list, list) {
1827 		if (km->migrate) {
1828 			ret = km->migrate(sel, dir, type, m, num_migrate, k);
1829 			if (!ret)
1830 				err = ret;
1831 		}
1832 	}
1833 	read_unlock(&xfrm_km_lock);
1834 	return err;
1835 }
1836 EXPORT_SYMBOL(km_migrate);
1837 #endif
1838 
1839 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1840 {
1841 	int err = -EINVAL;
1842 	int ret;
1843 	struct xfrm_mgr *km;
1844 
1845 	read_lock(&xfrm_km_lock);
1846 	list_for_each_entry(km, &xfrm_km_list, list) {
1847 		if (km->report) {
1848 			ret = km->report(proto, sel, addr);
1849 			if (!ret)
1850 				err = ret;
1851 		}
1852 	}
1853 	read_unlock(&xfrm_km_lock);
1854 	return err;
1855 }
1856 EXPORT_SYMBOL(km_report);
1857 
1858 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1859 {
1860 	int err;
1861 	u8 *data;
1862 	struct xfrm_mgr *km;
1863 	struct xfrm_policy *pol = NULL;
1864 
1865 	if (optlen <= 0 || optlen > PAGE_SIZE)
1866 		return -EMSGSIZE;
1867 
1868 	data = kmalloc(optlen, GFP_KERNEL);
1869 	if (!data)
1870 		return -ENOMEM;
1871 
1872 	err = -EFAULT;
1873 	if (copy_from_user(data, optval, optlen))
1874 		goto out;
1875 
1876 	err = -EINVAL;
1877 	read_lock(&xfrm_km_lock);
1878 	list_for_each_entry(km, &xfrm_km_list, list) {
1879 		pol = km->compile_policy(sk, optname, data,
1880 					 optlen, &err);
1881 		if (err >= 0)
1882 			break;
1883 	}
1884 	read_unlock(&xfrm_km_lock);
1885 
1886 	if (err >= 0) {
1887 		xfrm_sk_policy_insert(sk, err, pol);
1888 		xfrm_pol_put(pol);
1889 		err = 0;
1890 	}
1891 
1892 out:
1893 	kfree(data);
1894 	return err;
1895 }
1896 EXPORT_SYMBOL(xfrm_user_policy);
1897 
1898 int xfrm_register_km(struct xfrm_mgr *km)
1899 {
1900 	write_lock_bh(&xfrm_km_lock);
1901 	list_add_tail(&km->list, &xfrm_km_list);
1902 	write_unlock_bh(&xfrm_km_lock);
1903 	return 0;
1904 }
1905 EXPORT_SYMBOL(xfrm_register_km);
1906 
1907 int xfrm_unregister_km(struct xfrm_mgr *km)
1908 {
1909 	write_lock_bh(&xfrm_km_lock);
1910 	list_del(&km->list);
1911 	write_unlock_bh(&xfrm_km_lock);
1912 	return 0;
1913 }
1914 EXPORT_SYMBOL(xfrm_unregister_km);
1915 
1916 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1917 {
1918 	int err = 0;
1919 	if (unlikely(afinfo == NULL))
1920 		return -EINVAL;
1921 	if (unlikely(afinfo->family >= NPROTO))
1922 		return -EAFNOSUPPORT;
1923 	write_lock_bh(&xfrm_state_afinfo_lock);
1924 	if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1925 		err = -ENOBUFS;
1926 	else
1927 		xfrm_state_afinfo[afinfo->family] = afinfo;
1928 	write_unlock_bh(&xfrm_state_afinfo_lock);
1929 	return err;
1930 }
1931 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1932 
1933 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1934 {
1935 	int err = 0;
1936 	if (unlikely(afinfo == NULL))
1937 		return -EINVAL;
1938 	if (unlikely(afinfo->family >= NPROTO))
1939 		return -EAFNOSUPPORT;
1940 	write_lock_bh(&xfrm_state_afinfo_lock);
1941 	if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1942 		if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1943 			err = -EINVAL;
1944 		else
1945 			xfrm_state_afinfo[afinfo->family] = NULL;
1946 	}
1947 	write_unlock_bh(&xfrm_state_afinfo_lock);
1948 	return err;
1949 }
1950 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1951 
1952 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1953 {
1954 	struct xfrm_state_afinfo *afinfo;
1955 	if (unlikely(family >= NPROTO))
1956 		return NULL;
1957 	read_lock(&xfrm_state_afinfo_lock);
1958 	afinfo = xfrm_state_afinfo[family];
1959 	if (unlikely(!afinfo))
1960 		read_unlock(&xfrm_state_afinfo_lock);
1961 	return afinfo;
1962 }
1963 
1964 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1965 	__releases(xfrm_state_afinfo_lock)
1966 {
1967 	read_unlock(&xfrm_state_afinfo_lock);
1968 }
1969 
1970 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1971 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1972 {
1973 	if (x->tunnel) {
1974 		struct xfrm_state *t = x->tunnel;
1975 
1976 		if (atomic_read(&t->tunnel_users) == 2)
1977 			xfrm_state_delete(t);
1978 		atomic_dec(&t->tunnel_users);
1979 		xfrm_state_put(t);
1980 		x->tunnel = NULL;
1981 	}
1982 }
1983 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1984 
1985 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1986 {
1987 	int res;
1988 
1989 	spin_lock_bh(&x->lock);
1990 	if (x->km.state == XFRM_STATE_VALID &&
1991 	    x->type && x->type->get_mtu)
1992 		res = x->type->get_mtu(x, mtu);
1993 	else
1994 		res = mtu - x->props.header_len;
1995 	spin_unlock_bh(&x->lock);
1996 	return res;
1997 }
1998 
1999 int xfrm_init_state(struct xfrm_state *x)
2000 {
2001 	struct xfrm_state_afinfo *afinfo;
2002 	struct xfrm_mode *inner_mode;
2003 	int family = x->props.family;
2004 	int err;
2005 
2006 	err = -EAFNOSUPPORT;
2007 	afinfo = xfrm_state_get_afinfo(family);
2008 	if (!afinfo)
2009 		goto error;
2010 
2011 	err = 0;
2012 	if (afinfo->init_flags)
2013 		err = afinfo->init_flags(x);
2014 
2015 	xfrm_state_put_afinfo(afinfo);
2016 
2017 	if (err)
2018 		goto error;
2019 
2020 	err = -EPROTONOSUPPORT;
2021 
2022 	if (x->sel.family != AF_UNSPEC) {
2023 		inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2024 		if (inner_mode == NULL)
2025 			goto error;
2026 
2027 		if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2028 		    family != x->sel.family) {
2029 			xfrm_put_mode(inner_mode);
2030 			goto error;
2031 		}
2032 
2033 		x->inner_mode = inner_mode;
2034 	} else {
2035 		struct xfrm_mode *inner_mode_iaf;
2036 
2037 		inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
2038 		if (inner_mode == NULL)
2039 			goto error;
2040 
2041 		if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2042 			xfrm_put_mode(inner_mode);
2043 			goto error;
2044 		}
2045 
2046 		inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
2047 		if (inner_mode_iaf == NULL)
2048 			goto error;
2049 
2050 		if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
2051 			xfrm_put_mode(inner_mode_iaf);
2052 			goto error;
2053 		}
2054 
2055 		if (x->props.family == AF_INET) {
2056 			x->inner_mode = inner_mode;
2057 			x->inner_mode_iaf = inner_mode_iaf;
2058 		} else {
2059 			x->inner_mode = inner_mode_iaf;
2060 			x->inner_mode_iaf = inner_mode;
2061 		}
2062 	}
2063 
2064 	x->type = xfrm_get_type(x->id.proto, family);
2065 	if (x->type == NULL)
2066 		goto error;
2067 
2068 	err = x->type->init_state(x);
2069 	if (err)
2070 		goto error;
2071 
2072 	x->outer_mode = xfrm_get_mode(x->props.mode, family);
2073 	if (x->outer_mode == NULL)
2074 		goto error;
2075 
2076 	x->km.state = XFRM_STATE_VALID;
2077 
2078 error:
2079 	return err;
2080 }
2081 
2082 EXPORT_SYMBOL(xfrm_init_state);
2083 
2084 int __net_init xfrm_state_init(struct net *net)
2085 {
2086 	unsigned int sz;
2087 
2088 	INIT_LIST_HEAD(&net->xfrm.state_all);
2089 
2090 	sz = sizeof(struct hlist_head) * 8;
2091 
2092 	net->xfrm.state_bydst = xfrm_hash_alloc(sz);
2093 	if (!net->xfrm.state_bydst)
2094 		goto out_bydst;
2095 	net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
2096 	if (!net->xfrm.state_bysrc)
2097 		goto out_bysrc;
2098 	net->xfrm.state_byspi = xfrm_hash_alloc(sz);
2099 	if (!net->xfrm.state_byspi)
2100 		goto out_byspi;
2101 	net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2102 
2103 	net->xfrm.state_num = 0;
2104 	INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
2105 	INIT_HLIST_HEAD(&net->xfrm.state_gc_list);
2106 	INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
2107 	init_waitqueue_head(&net->xfrm.km_waitq);
2108 	return 0;
2109 
2110 out_byspi:
2111 	xfrm_hash_free(net->xfrm.state_bysrc, sz);
2112 out_bysrc:
2113 	xfrm_hash_free(net->xfrm.state_bydst, sz);
2114 out_bydst:
2115 	return -ENOMEM;
2116 }
2117 
2118 void xfrm_state_fini(struct net *net)
2119 {
2120 	unsigned int sz;
2121 
2122 	WARN_ON(!list_empty(&net->xfrm.state_all));
2123 
2124 	sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
2125 	WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2126 	xfrm_hash_free(net->xfrm.state_byspi, sz);
2127 	WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2128 	xfrm_hash_free(net->xfrm.state_bysrc, sz);
2129 	WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2130 	xfrm_hash_free(net->xfrm.state_bydst, sz);
2131 }
2132 
2133 #ifdef CONFIG_AUDITSYSCALL
2134 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2135 				     struct audit_buffer *audit_buf)
2136 {
2137 	struct xfrm_sec_ctx *ctx = x->security;
2138 	u32 spi = ntohl(x->id.spi);
2139 
2140 	if (ctx)
2141 		audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2142 				 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2143 
2144 	switch(x->props.family) {
2145 	case AF_INET:
2146 		audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2147 				 &x->props.saddr.a4, &x->id.daddr.a4);
2148 		break;
2149 	case AF_INET6:
2150 		audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
2151 				 x->props.saddr.a6, x->id.daddr.a6);
2152 		break;
2153 	}
2154 
2155 	audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2156 }
2157 
2158 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2159 				      struct audit_buffer *audit_buf)
2160 {
2161 	struct iphdr *iph4;
2162 	struct ipv6hdr *iph6;
2163 
2164 	switch (family) {
2165 	case AF_INET:
2166 		iph4 = ip_hdr(skb);
2167 		audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2168 				 &iph4->saddr, &iph4->daddr);
2169 		break;
2170 	case AF_INET6:
2171 		iph6 = ipv6_hdr(skb);
2172 		audit_log_format(audit_buf,
2173 				 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2174 				 &iph6->saddr,&iph6->daddr,
2175 				 iph6->flow_lbl[0] & 0x0f,
2176 				 iph6->flow_lbl[1],
2177 				 iph6->flow_lbl[2]);
2178 		break;
2179 	}
2180 }
2181 
2182 void xfrm_audit_state_add(struct xfrm_state *x, int result,
2183 			  uid_t auid, u32 sessionid, u32 secid)
2184 {
2185 	struct audit_buffer *audit_buf;
2186 
2187 	audit_buf = xfrm_audit_start("SAD-add");
2188 	if (audit_buf == NULL)
2189 		return;
2190 	xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2191 	xfrm_audit_helper_sainfo(x, audit_buf);
2192 	audit_log_format(audit_buf, " res=%u", result);
2193 	audit_log_end(audit_buf);
2194 }
2195 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2196 
2197 void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2198 			     uid_t auid, u32 sessionid, u32 secid)
2199 {
2200 	struct audit_buffer *audit_buf;
2201 
2202 	audit_buf = xfrm_audit_start("SAD-delete");
2203 	if (audit_buf == NULL)
2204 		return;
2205 	xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2206 	xfrm_audit_helper_sainfo(x, audit_buf);
2207 	audit_log_format(audit_buf, " res=%u", result);
2208 	audit_log_end(audit_buf);
2209 }
2210 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2211 
2212 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2213 				      struct sk_buff *skb)
2214 {
2215 	struct audit_buffer *audit_buf;
2216 	u32 spi;
2217 
2218 	audit_buf = xfrm_audit_start("SA-replay-overflow");
2219 	if (audit_buf == NULL)
2220 		return;
2221 	xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2222 	/* don't record the sequence number because it's inherent in this kind
2223 	 * of audit message */
2224 	spi = ntohl(x->id.spi);
2225 	audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2226 	audit_log_end(audit_buf);
2227 }
2228 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2229 
2230 static void xfrm_audit_state_replay(struct xfrm_state *x,
2231 			     struct sk_buff *skb, __be32 net_seq)
2232 {
2233 	struct audit_buffer *audit_buf;
2234 	u32 spi;
2235 
2236 	audit_buf = xfrm_audit_start("SA-replayed-pkt");
2237 	if (audit_buf == NULL)
2238 		return;
2239 	xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2240 	spi = ntohl(x->id.spi);
2241 	audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2242 			 spi, spi, ntohl(net_seq));
2243 	audit_log_end(audit_buf);
2244 }
2245 
2246 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2247 {
2248 	struct audit_buffer *audit_buf;
2249 
2250 	audit_buf = xfrm_audit_start("SA-notfound");
2251 	if (audit_buf == NULL)
2252 		return;
2253 	xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2254 	audit_log_end(audit_buf);
2255 }
2256 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2257 
2258 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2259 			       __be32 net_spi, __be32 net_seq)
2260 {
2261 	struct audit_buffer *audit_buf;
2262 	u32 spi;
2263 
2264 	audit_buf = xfrm_audit_start("SA-notfound");
2265 	if (audit_buf == NULL)
2266 		return;
2267 	xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2268 	spi = ntohl(net_spi);
2269 	audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2270 			 spi, spi, ntohl(net_seq));
2271 	audit_log_end(audit_buf);
2272 }
2273 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2274 
2275 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2276 			      struct sk_buff *skb, u8 proto)
2277 {
2278 	struct audit_buffer *audit_buf;
2279 	__be32 net_spi;
2280 	__be32 net_seq;
2281 
2282 	audit_buf = xfrm_audit_start("SA-icv-failure");
2283 	if (audit_buf == NULL)
2284 		return;
2285 	xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2286 	if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2287 		u32 spi = ntohl(net_spi);
2288 		audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2289 				 spi, spi, ntohl(net_seq));
2290 	}
2291 	audit_log_end(audit_buf);
2292 }
2293 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2294 #endif /* CONFIG_AUDITSYSCALL */
2295