1 /* 2 * xfrm_state.c 3 * 4 * Changes: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * YOSHIFUJI Hideaki @USAGI 10 * Split up af-specific functions 11 * Derek Atkins <derek@ihtfp.com> 12 * Add UDP Encapsulation 13 * 14 */ 15 16 #include <linux/workqueue.h> 17 #include <net/xfrm.h> 18 #include <linux/pfkeyv2.h> 19 #include <linux/ipsec.h> 20 #include <linux/module.h> 21 #include <linux/cache.h> 22 #include <linux/audit.h> 23 #include <asm/uaccess.h> 24 #include <linux/ktime.h> 25 #include <linux/slab.h> 26 #include <linux/interrupt.h> 27 #include <linux/kernel.h> 28 29 #include "xfrm_hash.h" 30 31 /* Each xfrm_state may be linked to two tables: 32 33 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl) 34 2. Hash table by (daddr,family,reqid) to find what SAs exist for given 35 destination/tunnel endpoint. (output) 36 */ 37 38 static DEFINE_SPINLOCK(xfrm_state_lock); 39 40 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024; 41 42 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 43 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo); 44 45 #ifdef CONFIG_AUDITSYSCALL 46 static void xfrm_audit_state_replay(struct xfrm_state *x, 47 struct sk_buff *skb, __be32 net_seq); 48 #else 49 #define xfrm_audit_state_replay(x, s, sq) do { ; } while (0) 50 #endif /* CONFIG_AUDITSYSCALL */ 51 52 static inline unsigned int xfrm_dst_hash(struct net *net, 53 xfrm_address_t *daddr, 54 xfrm_address_t *saddr, 55 u32 reqid, 56 unsigned short family) 57 { 58 return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask); 59 } 60 61 static inline unsigned int xfrm_src_hash(struct net *net, 62 xfrm_address_t *daddr, 63 xfrm_address_t *saddr, 64 unsigned short family) 65 { 66 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask); 67 } 68 69 static inline unsigned int 70 xfrm_spi_hash(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family) 71 { 72 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask); 73 } 74 75 static void xfrm_hash_transfer(struct hlist_head *list, 76 struct hlist_head *ndsttable, 77 struct hlist_head *nsrctable, 78 struct hlist_head *nspitable, 79 unsigned int nhashmask) 80 { 81 struct hlist_node *entry, *tmp; 82 struct xfrm_state *x; 83 84 hlist_for_each_entry_safe(x, entry, tmp, list, bydst) { 85 unsigned int h; 86 87 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr, 88 x->props.reqid, x->props.family, 89 nhashmask); 90 hlist_add_head(&x->bydst, ndsttable+h); 91 92 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr, 93 x->props.family, 94 nhashmask); 95 hlist_add_head(&x->bysrc, nsrctable+h); 96 97 if (x->id.spi) { 98 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi, 99 x->id.proto, x->props.family, 100 nhashmask); 101 hlist_add_head(&x->byspi, nspitable+h); 102 } 103 } 104 } 105 106 static unsigned long xfrm_hash_new_size(unsigned int state_hmask) 107 { 108 return ((state_hmask + 1) << 1) * sizeof(struct hlist_head); 109 } 110 111 static DEFINE_MUTEX(hash_resize_mutex); 112 113 static void xfrm_hash_resize(struct work_struct *work) 114 { 115 struct net *net = container_of(work, struct net, xfrm.state_hash_work); 116 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi; 117 unsigned long nsize, osize; 118 unsigned int nhashmask, ohashmask; 119 int i; 120 121 mutex_lock(&hash_resize_mutex); 122 123 nsize = xfrm_hash_new_size(net->xfrm.state_hmask); 124 ndst = xfrm_hash_alloc(nsize); 125 if (!ndst) 126 goto out_unlock; 127 nsrc = xfrm_hash_alloc(nsize); 128 if (!nsrc) { 129 xfrm_hash_free(ndst, nsize); 130 goto out_unlock; 131 } 132 nspi = xfrm_hash_alloc(nsize); 133 if (!nspi) { 134 xfrm_hash_free(ndst, nsize); 135 xfrm_hash_free(nsrc, nsize); 136 goto out_unlock; 137 } 138 139 spin_lock_bh(&xfrm_state_lock); 140 141 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U; 142 for (i = net->xfrm.state_hmask; i >= 0; i--) 143 xfrm_hash_transfer(net->xfrm.state_bydst+i, ndst, nsrc, nspi, 144 nhashmask); 145 146 odst = net->xfrm.state_bydst; 147 osrc = net->xfrm.state_bysrc; 148 ospi = net->xfrm.state_byspi; 149 ohashmask = net->xfrm.state_hmask; 150 151 net->xfrm.state_bydst = ndst; 152 net->xfrm.state_bysrc = nsrc; 153 net->xfrm.state_byspi = nspi; 154 net->xfrm.state_hmask = nhashmask; 155 156 spin_unlock_bh(&xfrm_state_lock); 157 158 osize = (ohashmask + 1) * sizeof(struct hlist_head); 159 xfrm_hash_free(odst, osize); 160 xfrm_hash_free(osrc, osize); 161 xfrm_hash_free(ospi, osize); 162 163 out_unlock: 164 mutex_unlock(&hash_resize_mutex); 165 } 166 167 static DEFINE_RWLOCK(xfrm_state_afinfo_lock); 168 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO]; 169 170 static DEFINE_SPINLOCK(xfrm_state_gc_lock); 171 172 int __xfrm_state_delete(struct xfrm_state *x); 173 174 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); 175 void km_state_expired(struct xfrm_state *x, int hard, u32 pid); 176 177 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family) 178 { 179 struct xfrm_state_afinfo *afinfo; 180 if (unlikely(family >= NPROTO)) 181 return NULL; 182 write_lock_bh(&xfrm_state_afinfo_lock); 183 afinfo = xfrm_state_afinfo[family]; 184 if (unlikely(!afinfo)) 185 write_unlock_bh(&xfrm_state_afinfo_lock); 186 return afinfo; 187 } 188 189 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo) 190 __releases(xfrm_state_afinfo_lock) 191 { 192 write_unlock_bh(&xfrm_state_afinfo_lock); 193 } 194 195 int xfrm_register_type(const struct xfrm_type *type, unsigned short family) 196 { 197 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family); 198 const struct xfrm_type **typemap; 199 int err = 0; 200 201 if (unlikely(afinfo == NULL)) 202 return -EAFNOSUPPORT; 203 typemap = afinfo->type_map; 204 205 if (likely(typemap[type->proto] == NULL)) 206 typemap[type->proto] = type; 207 else 208 err = -EEXIST; 209 xfrm_state_unlock_afinfo(afinfo); 210 return err; 211 } 212 EXPORT_SYMBOL(xfrm_register_type); 213 214 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family) 215 { 216 struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family); 217 const struct xfrm_type **typemap; 218 int err = 0; 219 220 if (unlikely(afinfo == NULL)) 221 return -EAFNOSUPPORT; 222 typemap = afinfo->type_map; 223 224 if (unlikely(typemap[type->proto] != type)) 225 err = -ENOENT; 226 else 227 typemap[type->proto] = NULL; 228 xfrm_state_unlock_afinfo(afinfo); 229 return err; 230 } 231 EXPORT_SYMBOL(xfrm_unregister_type); 232 233 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family) 234 { 235 struct xfrm_state_afinfo *afinfo; 236 const struct xfrm_type **typemap; 237 const struct xfrm_type *type; 238 int modload_attempted = 0; 239 240 retry: 241 afinfo = xfrm_state_get_afinfo(family); 242 if (unlikely(afinfo == NULL)) 243 return NULL; 244 typemap = afinfo->type_map; 245 246 type = typemap[proto]; 247 if (unlikely(type && !try_module_get(type->owner))) 248 type = NULL; 249 if (!type && !modload_attempted) { 250 xfrm_state_put_afinfo(afinfo); 251 request_module("xfrm-type-%d-%d", family, proto); 252 modload_attempted = 1; 253 goto retry; 254 } 255 256 xfrm_state_put_afinfo(afinfo); 257 return type; 258 } 259 260 static void xfrm_put_type(const struct xfrm_type *type) 261 { 262 module_put(type->owner); 263 } 264 265 int xfrm_register_mode(struct xfrm_mode *mode, int family) 266 { 267 struct xfrm_state_afinfo *afinfo; 268 struct xfrm_mode **modemap; 269 int err; 270 271 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 272 return -EINVAL; 273 274 afinfo = xfrm_state_lock_afinfo(family); 275 if (unlikely(afinfo == NULL)) 276 return -EAFNOSUPPORT; 277 278 err = -EEXIST; 279 modemap = afinfo->mode_map; 280 if (modemap[mode->encap]) 281 goto out; 282 283 err = -ENOENT; 284 if (!try_module_get(afinfo->owner)) 285 goto out; 286 287 mode->afinfo = afinfo; 288 modemap[mode->encap] = mode; 289 err = 0; 290 291 out: 292 xfrm_state_unlock_afinfo(afinfo); 293 return err; 294 } 295 EXPORT_SYMBOL(xfrm_register_mode); 296 297 int xfrm_unregister_mode(struct xfrm_mode *mode, int family) 298 { 299 struct xfrm_state_afinfo *afinfo; 300 struct xfrm_mode **modemap; 301 int err; 302 303 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 304 return -EINVAL; 305 306 afinfo = xfrm_state_lock_afinfo(family); 307 if (unlikely(afinfo == NULL)) 308 return -EAFNOSUPPORT; 309 310 err = -ENOENT; 311 modemap = afinfo->mode_map; 312 if (likely(modemap[mode->encap] == mode)) { 313 modemap[mode->encap] = NULL; 314 module_put(mode->afinfo->owner); 315 err = 0; 316 } 317 318 xfrm_state_unlock_afinfo(afinfo); 319 return err; 320 } 321 EXPORT_SYMBOL(xfrm_unregister_mode); 322 323 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family) 324 { 325 struct xfrm_state_afinfo *afinfo; 326 struct xfrm_mode *mode; 327 int modload_attempted = 0; 328 329 if (unlikely(encap >= XFRM_MODE_MAX)) 330 return NULL; 331 332 retry: 333 afinfo = xfrm_state_get_afinfo(family); 334 if (unlikely(afinfo == NULL)) 335 return NULL; 336 337 mode = afinfo->mode_map[encap]; 338 if (unlikely(mode && !try_module_get(mode->owner))) 339 mode = NULL; 340 if (!mode && !modload_attempted) { 341 xfrm_state_put_afinfo(afinfo); 342 request_module("xfrm-mode-%d-%d", family, encap); 343 modload_attempted = 1; 344 goto retry; 345 } 346 347 xfrm_state_put_afinfo(afinfo); 348 return mode; 349 } 350 351 static void xfrm_put_mode(struct xfrm_mode *mode) 352 { 353 module_put(mode->owner); 354 } 355 356 static void xfrm_state_gc_destroy(struct xfrm_state *x) 357 { 358 tasklet_hrtimer_cancel(&x->mtimer); 359 del_timer_sync(&x->rtimer); 360 kfree(x->aalg); 361 kfree(x->ealg); 362 kfree(x->calg); 363 kfree(x->encap); 364 kfree(x->coaddr); 365 if (x->inner_mode) 366 xfrm_put_mode(x->inner_mode); 367 if (x->inner_mode_iaf) 368 xfrm_put_mode(x->inner_mode_iaf); 369 if (x->outer_mode) 370 xfrm_put_mode(x->outer_mode); 371 if (x->type) { 372 x->type->destructor(x); 373 xfrm_put_type(x->type); 374 } 375 security_xfrm_state_free(x); 376 kfree(x); 377 } 378 379 static void xfrm_state_gc_task(struct work_struct *work) 380 { 381 struct net *net = container_of(work, struct net, xfrm.state_gc_work); 382 struct xfrm_state *x; 383 struct hlist_node *entry, *tmp; 384 struct hlist_head gc_list; 385 386 spin_lock_bh(&xfrm_state_gc_lock); 387 hlist_move_list(&net->xfrm.state_gc_list, &gc_list); 388 spin_unlock_bh(&xfrm_state_gc_lock); 389 390 hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist) 391 xfrm_state_gc_destroy(x); 392 393 wake_up(&net->xfrm.km_waitq); 394 } 395 396 static inline unsigned long make_jiffies(long secs) 397 { 398 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ) 399 return MAX_SCHEDULE_TIMEOUT-1; 400 else 401 return secs*HZ; 402 } 403 404 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me) 405 { 406 struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer); 407 struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer); 408 struct net *net = xs_net(x); 409 unsigned long now = get_seconds(); 410 long next = LONG_MAX; 411 int warn = 0; 412 int err = 0; 413 414 spin_lock(&x->lock); 415 if (x->km.state == XFRM_STATE_DEAD) 416 goto out; 417 if (x->km.state == XFRM_STATE_EXPIRED) 418 goto expired; 419 if (x->lft.hard_add_expires_seconds) { 420 long tmo = x->lft.hard_add_expires_seconds + 421 x->curlft.add_time - now; 422 if (tmo <= 0) 423 goto expired; 424 if (tmo < next) 425 next = tmo; 426 } 427 if (x->lft.hard_use_expires_seconds) { 428 long tmo = x->lft.hard_use_expires_seconds + 429 (x->curlft.use_time ? : now) - now; 430 if (tmo <= 0) 431 goto expired; 432 if (tmo < next) 433 next = tmo; 434 } 435 if (x->km.dying) 436 goto resched; 437 if (x->lft.soft_add_expires_seconds) { 438 long tmo = x->lft.soft_add_expires_seconds + 439 x->curlft.add_time - now; 440 if (tmo <= 0) 441 warn = 1; 442 else if (tmo < next) 443 next = tmo; 444 } 445 if (x->lft.soft_use_expires_seconds) { 446 long tmo = x->lft.soft_use_expires_seconds + 447 (x->curlft.use_time ? : now) - now; 448 if (tmo <= 0) 449 warn = 1; 450 else if (tmo < next) 451 next = tmo; 452 } 453 454 x->km.dying = warn; 455 if (warn) 456 km_state_expired(x, 0, 0); 457 resched: 458 if (next != LONG_MAX){ 459 tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL); 460 } 461 462 goto out; 463 464 expired: 465 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) { 466 x->km.state = XFRM_STATE_EXPIRED; 467 wake_up(&net->xfrm.km_waitq); 468 next = 2; 469 goto resched; 470 } 471 472 err = __xfrm_state_delete(x); 473 if (!err && x->id.spi) 474 km_state_expired(x, 1, 0); 475 476 xfrm_audit_state_delete(x, err ? 0 : 1, 477 audit_get_loginuid(current), 478 audit_get_sessionid(current), 0); 479 480 out: 481 spin_unlock(&x->lock); 482 return HRTIMER_NORESTART; 483 } 484 485 static void xfrm_replay_timer_handler(unsigned long data); 486 487 struct xfrm_state *xfrm_state_alloc(struct net *net) 488 { 489 struct xfrm_state *x; 490 491 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC); 492 493 if (x) { 494 write_pnet(&x->xs_net, net); 495 atomic_set(&x->refcnt, 1); 496 atomic_set(&x->tunnel_users, 0); 497 INIT_LIST_HEAD(&x->km.all); 498 INIT_HLIST_NODE(&x->bydst); 499 INIT_HLIST_NODE(&x->bysrc); 500 INIT_HLIST_NODE(&x->byspi); 501 tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, CLOCK_REALTIME, HRTIMER_MODE_ABS); 502 setup_timer(&x->rtimer, xfrm_replay_timer_handler, 503 (unsigned long)x); 504 x->curlft.add_time = get_seconds(); 505 x->lft.soft_byte_limit = XFRM_INF; 506 x->lft.soft_packet_limit = XFRM_INF; 507 x->lft.hard_byte_limit = XFRM_INF; 508 x->lft.hard_packet_limit = XFRM_INF; 509 x->replay_maxage = 0; 510 x->replay_maxdiff = 0; 511 x->inner_mode = NULL; 512 x->inner_mode_iaf = NULL; 513 spin_lock_init(&x->lock); 514 } 515 return x; 516 } 517 EXPORT_SYMBOL(xfrm_state_alloc); 518 519 void __xfrm_state_destroy(struct xfrm_state *x) 520 { 521 struct net *net = xs_net(x); 522 523 WARN_ON(x->km.state != XFRM_STATE_DEAD); 524 525 spin_lock_bh(&xfrm_state_gc_lock); 526 hlist_add_head(&x->gclist, &net->xfrm.state_gc_list); 527 spin_unlock_bh(&xfrm_state_gc_lock); 528 schedule_work(&net->xfrm.state_gc_work); 529 } 530 EXPORT_SYMBOL(__xfrm_state_destroy); 531 532 int __xfrm_state_delete(struct xfrm_state *x) 533 { 534 struct net *net = xs_net(x); 535 int err = -ESRCH; 536 537 if (x->km.state != XFRM_STATE_DEAD) { 538 x->km.state = XFRM_STATE_DEAD; 539 spin_lock(&xfrm_state_lock); 540 list_del(&x->km.all); 541 hlist_del(&x->bydst); 542 hlist_del(&x->bysrc); 543 if (x->id.spi) 544 hlist_del(&x->byspi); 545 net->xfrm.state_num--; 546 spin_unlock(&xfrm_state_lock); 547 548 /* All xfrm_state objects are created by xfrm_state_alloc. 549 * The xfrm_state_alloc call gives a reference, and that 550 * is what we are dropping here. 551 */ 552 xfrm_state_put(x); 553 err = 0; 554 } 555 556 return err; 557 } 558 EXPORT_SYMBOL(__xfrm_state_delete); 559 560 int xfrm_state_delete(struct xfrm_state *x) 561 { 562 int err; 563 564 spin_lock_bh(&x->lock); 565 err = __xfrm_state_delete(x); 566 spin_unlock_bh(&x->lock); 567 568 return err; 569 } 570 EXPORT_SYMBOL(xfrm_state_delete); 571 572 #ifdef CONFIG_SECURITY_NETWORK_XFRM 573 static inline int 574 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info) 575 { 576 int i, err = 0; 577 578 for (i = 0; i <= net->xfrm.state_hmask; i++) { 579 struct hlist_node *entry; 580 struct xfrm_state *x; 581 582 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) { 583 if (xfrm_id_proto_match(x->id.proto, proto) && 584 (err = security_xfrm_state_delete(x)) != 0) { 585 xfrm_audit_state_delete(x, 0, 586 audit_info->loginuid, 587 audit_info->sessionid, 588 audit_info->secid); 589 return err; 590 } 591 } 592 } 593 594 return err; 595 } 596 #else 597 static inline int 598 xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info) 599 { 600 return 0; 601 } 602 #endif 603 604 int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info) 605 { 606 int i, err = 0, cnt = 0; 607 608 spin_lock_bh(&xfrm_state_lock); 609 err = xfrm_state_flush_secctx_check(net, proto, audit_info); 610 if (err) 611 goto out; 612 613 err = -ESRCH; 614 for (i = 0; i <= net->xfrm.state_hmask; i++) { 615 struct hlist_node *entry; 616 struct xfrm_state *x; 617 restart: 618 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) { 619 if (!xfrm_state_kern(x) && 620 xfrm_id_proto_match(x->id.proto, proto)) { 621 xfrm_state_hold(x); 622 spin_unlock_bh(&xfrm_state_lock); 623 624 err = xfrm_state_delete(x); 625 xfrm_audit_state_delete(x, err ? 0 : 1, 626 audit_info->loginuid, 627 audit_info->sessionid, 628 audit_info->secid); 629 xfrm_state_put(x); 630 if (!err) 631 cnt++; 632 633 spin_lock_bh(&xfrm_state_lock); 634 goto restart; 635 } 636 } 637 } 638 if (cnt) 639 err = 0; 640 641 out: 642 spin_unlock_bh(&xfrm_state_lock); 643 wake_up(&net->xfrm.km_waitq); 644 return err; 645 } 646 EXPORT_SYMBOL(xfrm_state_flush); 647 648 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si) 649 { 650 spin_lock_bh(&xfrm_state_lock); 651 si->sadcnt = net->xfrm.state_num; 652 si->sadhcnt = net->xfrm.state_hmask; 653 si->sadhmcnt = xfrm_state_hashmax; 654 spin_unlock_bh(&xfrm_state_lock); 655 } 656 EXPORT_SYMBOL(xfrm_sad_getinfo); 657 658 static int 659 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl, 660 struct xfrm_tmpl *tmpl, 661 xfrm_address_t *daddr, xfrm_address_t *saddr, 662 unsigned short family) 663 { 664 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 665 if (!afinfo) 666 return -1; 667 afinfo->init_tempsel(x, fl, tmpl, daddr, saddr); 668 xfrm_state_put_afinfo(afinfo); 669 return 0; 670 } 671 672 static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family) 673 { 674 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); 675 struct xfrm_state *x; 676 struct hlist_node *entry; 677 678 hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) { 679 if (x->props.family != family || 680 x->id.spi != spi || 681 x->id.proto != proto || 682 xfrm_addr_cmp(&x->id.daddr, daddr, family)) 683 continue; 684 685 if ((mark & x->mark.m) != x->mark.v) 686 continue; 687 xfrm_state_hold(x); 688 return x; 689 } 690 691 return NULL; 692 } 693 694 static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family) 695 { 696 unsigned int h = xfrm_src_hash(net, daddr, saddr, family); 697 struct xfrm_state *x; 698 struct hlist_node *entry; 699 700 hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) { 701 if (x->props.family != family || 702 x->id.proto != proto || 703 xfrm_addr_cmp(&x->id.daddr, daddr, family) || 704 xfrm_addr_cmp(&x->props.saddr, saddr, family)) 705 continue; 706 707 if ((mark & x->mark.m) != x->mark.v) 708 continue; 709 xfrm_state_hold(x); 710 return x; 711 } 712 713 return NULL; 714 } 715 716 static inline struct xfrm_state * 717 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) 718 { 719 struct net *net = xs_net(x); 720 u32 mark = x->mark.v & x->mark.m; 721 722 if (use_spi) 723 return __xfrm_state_lookup(net, mark, &x->id.daddr, 724 x->id.spi, x->id.proto, family); 725 else 726 return __xfrm_state_lookup_byaddr(net, mark, 727 &x->id.daddr, 728 &x->props.saddr, 729 x->id.proto, family); 730 } 731 732 static void xfrm_hash_grow_check(struct net *net, int have_hash_collision) 733 { 734 if (have_hash_collision && 735 (net->xfrm.state_hmask + 1) < xfrm_state_hashmax && 736 net->xfrm.state_num > net->xfrm.state_hmask) 737 schedule_work(&net->xfrm.state_hash_work); 738 } 739 740 static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, 741 struct flowi *fl, unsigned short family, 742 xfrm_address_t *daddr, xfrm_address_t *saddr, 743 struct xfrm_state **best, int *acq_in_progress, 744 int *error) 745 { 746 /* Resolution logic: 747 * 1. There is a valid state with matching selector. Done. 748 * 2. Valid state with inappropriate selector. Skip. 749 * 750 * Entering area of "sysdeps". 751 * 752 * 3. If state is not valid, selector is temporary, it selects 753 * only session which triggered previous resolution. Key 754 * manager will do something to install a state with proper 755 * selector. 756 */ 757 if (x->km.state == XFRM_STATE_VALID) { 758 if ((x->sel.family && 759 !xfrm_selector_match(&x->sel, fl, x->sel.family)) || 760 !security_xfrm_state_pol_flow_match(x, pol, fl)) 761 return; 762 763 if (!*best || 764 (*best)->km.dying > x->km.dying || 765 ((*best)->km.dying == x->km.dying && 766 (*best)->curlft.add_time < x->curlft.add_time)) 767 *best = x; 768 } else if (x->km.state == XFRM_STATE_ACQ) { 769 *acq_in_progress = 1; 770 } else if (x->km.state == XFRM_STATE_ERROR || 771 x->km.state == XFRM_STATE_EXPIRED) { 772 if (xfrm_selector_match(&x->sel, fl, x->sel.family) && 773 security_xfrm_state_pol_flow_match(x, pol, fl)) 774 *error = -ESRCH; 775 } 776 } 777 778 struct xfrm_state * 779 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 780 struct flowi *fl, struct xfrm_tmpl *tmpl, 781 struct xfrm_policy *pol, int *err, 782 unsigned short family) 783 { 784 static xfrm_address_t saddr_wildcard = { }; 785 struct net *net = xp_net(pol); 786 unsigned int h, h_wildcard; 787 struct hlist_node *entry; 788 struct xfrm_state *x, *x0, *to_put; 789 int acquire_in_progress = 0; 790 int error = 0; 791 struct xfrm_state *best = NULL; 792 u32 mark = pol->mark.v & pol->mark.m; 793 794 to_put = NULL; 795 796 spin_lock_bh(&xfrm_state_lock); 797 h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, family); 798 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) { 799 if (x->props.family == family && 800 x->props.reqid == tmpl->reqid && 801 (mark & x->mark.m) == x->mark.v && 802 !(x->props.flags & XFRM_STATE_WILDRECV) && 803 xfrm_state_addr_check(x, daddr, saddr, family) && 804 tmpl->mode == x->props.mode && 805 tmpl->id.proto == x->id.proto && 806 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 807 xfrm_state_look_at(pol, x, fl, family, daddr, saddr, 808 &best, &acquire_in_progress, &error); 809 } 810 if (best) 811 goto found; 812 813 h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family); 814 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) { 815 if (x->props.family == family && 816 x->props.reqid == tmpl->reqid && 817 (mark & x->mark.m) == x->mark.v && 818 !(x->props.flags & XFRM_STATE_WILDRECV) && 819 xfrm_state_addr_check(x, daddr, saddr, family) && 820 tmpl->mode == x->props.mode && 821 tmpl->id.proto == x->id.proto && 822 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 823 xfrm_state_look_at(pol, x, fl, family, daddr, saddr, 824 &best, &acquire_in_progress, &error); 825 } 826 827 found: 828 x = best; 829 if (!x && !error && !acquire_in_progress) { 830 if (tmpl->id.spi && 831 (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi, 832 tmpl->id.proto, family)) != NULL) { 833 to_put = x0; 834 error = -EEXIST; 835 goto out; 836 } 837 x = xfrm_state_alloc(net); 838 if (x == NULL) { 839 error = -ENOMEM; 840 goto out; 841 } 842 /* Initialize temporary selector matching only 843 * to current session. */ 844 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family); 845 memcpy(&x->mark, &pol->mark, sizeof(x->mark)); 846 847 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid); 848 if (error) { 849 x->km.state = XFRM_STATE_DEAD; 850 to_put = x; 851 x = NULL; 852 goto out; 853 } 854 855 if (km_query(x, tmpl, pol) == 0) { 856 x->km.state = XFRM_STATE_ACQ; 857 list_add(&x->km.all, &net->xfrm.state_all); 858 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h); 859 h = xfrm_src_hash(net, daddr, saddr, family); 860 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h); 861 if (x->id.spi) { 862 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, family); 863 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); 864 } 865 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; 866 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL); 867 net->xfrm.state_num++; 868 xfrm_hash_grow_check(net, x->bydst.next != NULL); 869 } else { 870 x->km.state = XFRM_STATE_DEAD; 871 to_put = x; 872 x = NULL; 873 error = -ESRCH; 874 } 875 } 876 out: 877 if (x) 878 xfrm_state_hold(x); 879 else 880 *err = acquire_in_progress ? -EAGAIN : error; 881 spin_unlock_bh(&xfrm_state_lock); 882 if (to_put) 883 xfrm_state_put(to_put); 884 return x; 885 } 886 887 struct xfrm_state * 888 xfrm_stateonly_find(struct net *net, u32 mark, 889 xfrm_address_t *daddr, xfrm_address_t *saddr, 890 unsigned short family, u8 mode, u8 proto, u32 reqid) 891 { 892 unsigned int h; 893 struct xfrm_state *rx = NULL, *x = NULL; 894 struct hlist_node *entry; 895 896 spin_lock(&xfrm_state_lock); 897 h = xfrm_dst_hash(net, daddr, saddr, reqid, family); 898 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) { 899 if (x->props.family == family && 900 x->props.reqid == reqid && 901 (mark & x->mark.m) == x->mark.v && 902 !(x->props.flags & XFRM_STATE_WILDRECV) && 903 xfrm_state_addr_check(x, daddr, saddr, family) && 904 mode == x->props.mode && 905 proto == x->id.proto && 906 x->km.state == XFRM_STATE_VALID) { 907 rx = x; 908 break; 909 } 910 } 911 912 if (rx) 913 xfrm_state_hold(rx); 914 spin_unlock(&xfrm_state_lock); 915 916 917 return rx; 918 } 919 EXPORT_SYMBOL(xfrm_stateonly_find); 920 921 static void __xfrm_state_insert(struct xfrm_state *x) 922 { 923 struct net *net = xs_net(x); 924 unsigned int h; 925 926 list_add(&x->km.all, &net->xfrm.state_all); 927 928 h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr, 929 x->props.reqid, x->props.family); 930 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h); 931 932 h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family); 933 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h); 934 935 if (x->id.spi) { 936 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, 937 x->props.family); 938 939 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); 940 } 941 942 tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL); 943 if (x->replay_maxage) 944 mod_timer(&x->rtimer, jiffies + x->replay_maxage); 945 946 wake_up(&net->xfrm.km_waitq); 947 948 net->xfrm.state_num++; 949 950 xfrm_hash_grow_check(net, x->bydst.next != NULL); 951 } 952 953 /* xfrm_state_lock is held */ 954 static void __xfrm_state_bump_genids(struct xfrm_state *xnew) 955 { 956 struct net *net = xs_net(xnew); 957 unsigned short family = xnew->props.family; 958 u32 reqid = xnew->props.reqid; 959 struct xfrm_state *x; 960 struct hlist_node *entry; 961 unsigned int h; 962 u32 mark = xnew->mark.v & xnew->mark.m; 963 964 h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family); 965 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) { 966 if (x->props.family == family && 967 x->props.reqid == reqid && 968 (mark & x->mark.m) == x->mark.v && 969 !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) && 970 !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family)) 971 x->genid++; 972 } 973 } 974 975 void xfrm_state_insert(struct xfrm_state *x) 976 { 977 spin_lock_bh(&xfrm_state_lock); 978 __xfrm_state_bump_genids(x); 979 __xfrm_state_insert(x); 980 spin_unlock_bh(&xfrm_state_lock); 981 } 982 EXPORT_SYMBOL(xfrm_state_insert); 983 984 /* xfrm_state_lock is held */ 985 static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m, unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create) 986 { 987 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family); 988 struct hlist_node *entry; 989 struct xfrm_state *x; 990 u32 mark = m->v & m->m; 991 992 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) { 993 if (x->props.reqid != reqid || 994 x->props.mode != mode || 995 x->props.family != family || 996 x->km.state != XFRM_STATE_ACQ || 997 x->id.spi != 0 || 998 x->id.proto != proto || 999 (mark & x->mark.m) != x->mark.v || 1000 xfrm_addr_cmp(&x->id.daddr, daddr, family) || 1001 xfrm_addr_cmp(&x->props.saddr, saddr, family)) 1002 continue; 1003 1004 xfrm_state_hold(x); 1005 return x; 1006 } 1007 1008 if (!create) 1009 return NULL; 1010 1011 x = xfrm_state_alloc(net); 1012 if (likely(x)) { 1013 switch (family) { 1014 case AF_INET: 1015 x->sel.daddr.a4 = daddr->a4; 1016 x->sel.saddr.a4 = saddr->a4; 1017 x->sel.prefixlen_d = 32; 1018 x->sel.prefixlen_s = 32; 1019 x->props.saddr.a4 = saddr->a4; 1020 x->id.daddr.a4 = daddr->a4; 1021 break; 1022 1023 case AF_INET6: 1024 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6, 1025 (struct in6_addr *)daddr); 1026 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6, 1027 (struct in6_addr *)saddr); 1028 x->sel.prefixlen_d = 128; 1029 x->sel.prefixlen_s = 128; 1030 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6, 1031 (struct in6_addr *)saddr); 1032 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6, 1033 (struct in6_addr *)daddr); 1034 break; 1035 } 1036 1037 x->km.state = XFRM_STATE_ACQ; 1038 x->id.proto = proto; 1039 x->props.family = family; 1040 x->props.mode = mode; 1041 x->props.reqid = reqid; 1042 x->mark.v = m->v; 1043 x->mark.m = m->m; 1044 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; 1045 xfrm_state_hold(x); 1046 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL); 1047 list_add(&x->km.all, &net->xfrm.state_all); 1048 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h); 1049 h = xfrm_src_hash(net, daddr, saddr, family); 1050 hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h); 1051 1052 net->xfrm.state_num++; 1053 1054 xfrm_hash_grow_check(net, x->bydst.next != NULL); 1055 } 1056 1057 return x; 1058 } 1059 1060 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1061 1062 int xfrm_state_add(struct xfrm_state *x) 1063 { 1064 struct net *net = xs_net(x); 1065 struct xfrm_state *x1, *to_put; 1066 int family; 1067 int err; 1068 u32 mark = x->mark.v & x->mark.m; 1069 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1070 1071 family = x->props.family; 1072 1073 to_put = NULL; 1074 1075 spin_lock_bh(&xfrm_state_lock); 1076 1077 x1 = __xfrm_state_locate(x, use_spi, family); 1078 if (x1) { 1079 to_put = x1; 1080 x1 = NULL; 1081 err = -EEXIST; 1082 goto out; 1083 } 1084 1085 if (use_spi && x->km.seq) { 1086 x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq); 1087 if (x1 && ((x1->id.proto != x->id.proto) || 1088 xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) { 1089 to_put = x1; 1090 x1 = NULL; 1091 } 1092 } 1093 1094 if (use_spi && !x1) 1095 x1 = __find_acq_core(net, &x->mark, family, x->props.mode, 1096 x->props.reqid, x->id.proto, 1097 &x->id.daddr, &x->props.saddr, 0); 1098 1099 __xfrm_state_bump_genids(x); 1100 __xfrm_state_insert(x); 1101 err = 0; 1102 1103 out: 1104 spin_unlock_bh(&xfrm_state_lock); 1105 1106 if (x1) { 1107 xfrm_state_delete(x1); 1108 xfrm_state_put(x1); 1109 } 1110 1111 if (to_put) 1112 xfrm_state_put(to_put); 1113 1114 return err; 1115 } 1116 EXPORT_SYMBOL(xfrm_state_add); 1117 1118 #ifdef CONFIG_XFRM_MIGRATE 1119 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp) 1120 { 1121 struct net *net = xs_net(orig); 1122 int err = -ENOMEM; 1123 struct xfrm_state *x = xfrm_state_alloc(net); 1124 if (!x) 1125 goto out; 1126 1127 memcpy(&x->id, &orig->id, sizeof(x->id)); 1128 memcpy(&x->sel, &orig->sel, sizeof(x->sel)); 1129 memcpy(&x->lft, &orig->lft, sizeof(x->lft)); 1130 x->props.mode = orig->props.mode; 1131 x->props.replay_window = orig->props.replay_window; 1132 x->props.reqid = orig->props.reqid; 1133 x->props.family = orig->props.family; 1134 x->props.saddr = orig->props.saddr; 1135 1136 if (orig->aalg) { 1137 x->aalg = xfrm_algo_auth_clone(orig->aalg); 1138 if (!x->aalg) 1139 goto error; 1140 } 1141 x->props.aalgo = orig->props.aalgo; 1142 1143 if (orig->ealg) { 1144 x->ealg = xfrm_algo_clone(orig->ealg); 1145 if (!x->ealg) 1146 goto error; 1147 } 1148 x->props.ealgo = orig->props.ealgo; 1149 1150 if (orig->calg) { 1151 x->calg = xfrm_algo_clone(orig->calg); 1152 if (!x->calg) 1153 goto error; 1154 } 1155 x->props.calgo = orig->props.calgo; 1156 1157 if (orig->encap) { 1158 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL); 1159 if (!x->encap) 1160 goto error; 1161 } 1162 1163 if (orig->coaddr) { 1164 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr), 1165 GFP_KERNEL); 1166 if (!x->coaddr) 1167 goto error; 1168 } 1169 1170 memcpy(&x->mark, &orig->mark, sizeof(x->mark)); 1171 1172 err = xfrm_init_state(x); 1173 if (err) 1174 goto error; 1175 1176 x->props.flags = orig->props.flags; 1177 1178 x->curlft.add_time = orig->curlft.add_time; 1179 x->km.state = orig->km.state; 1180 x->km.seq = orig->km.seq; 1181 1182 return x; 1183 1184 error: 1185 xfrm_state_put(x); 1186 out: 1187 if (errp) 1188 *errp = err; 1189 return NULL; 1190 } 1191 1192 /* xfrm_state_lock is held */ 1193 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m) 1194 { 1195 unsigned int h; 1196 struct xfrm_state *x; 1197 struct hlist_node *entry; 1198 1199 if (m->reqid) { 1200 h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr, 1201 m->reqid, m->old_family); 1202 hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) { 1203 if (x->props.mode != m->mode || 1204 x->id.proto != m->proto) 1205 continue; 1206 if (m->reqid && x->props.reqid != m->reqid) 1207 continue; 1208 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr, 1209 m->old_family) || 1210 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr, 1211 m->old_family)) 1212 continue; 1213 xfrm_state_hold(x); 1214 return x; 1215 } 1216 } else { 1217 h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr, 1218 m->old_family); 1219 hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) { 1220 if (x->props.mode != m->mode || 1221 x->id.proto != m->proto) 1222 continue; 1223 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr, 1224 m->old_family) || 1225 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr, 1226 m->old_family)) 1227 continue; 1228 xfrm_state_hold(x); 1229 return x; 1230 } 1231 } 1232 1233 return NULL; 1234 } 1235 EXPORT_SYMBOL(xfrm_migrate_state_find); 1236 1237 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x, 1238 struct xfrm_migrate *m) 1239 { 1240 struct xfrm_state *xc; 1241 int err; 1242 1243 xc = xfrm_state_clone(x, &err); 1244 if (!xc) 1245 return NULL; 1246 1247 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); 1248 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); 1249 1250 /* add state */ 1251 if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) { 1252 /* a care is needed when the destination address of the 1253 state is to be updated as it is a part of triplet */ 1254 xfrm_state_insert(xc); 1255 } else { 1256 if ((err = xfrm_state_add(xc)) < 0) 1257 goto error; 1258 } 1259 1260 return xc; 1261 error: 1262 kfree(xc); 1263 return NULL; 1264 } 1265 EXPORT_SYMBOL(xfrm_state_migrate); 1266 #endif 1267 1268 int xfrm_state_update(struct xfrm_state *x) 1269 { 1270 struct xfrm_state *x1, *to_put; 1271 int err; 1272 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1273 1274 to_put = NULL; 1275 1276 spin_lock_bh(&xfrm_state_lock); 1277 x1 = __xfrm_state_locate(x, use_spi, x->props.family); 1278 1279 err = -ESRCH; 1280 if (!x1) 1281 goto out; 1282 1283 if (xfrm_state_kern(x1)) { 1284 to_put = x1; 1285 err = -EEXIST; 1286 goto out; 1287 } 1288 1289 if (x1->km.state == XFRM_STATE_ACQ) { 1290 __xfrm_state_insert(x); 1291 x = NULL; 1292 } 1293 err = 0; 1294 1295 out: 1296 spin_unlock_bh(&xfrm_state_lock); 1297 1298 if (to_put) 1299 xfrm_state_put(to_put); 1300 1301 if (err) 1302 return err; 1303 1304 if (!x) { 1305 xfrm_state_delete(x1); 1306 xfrm_state_put(x1); 1307 return 0; 1308 } 1309 1310 err = -EINVAL; 1311 spin_lock_bh(&x1->lock); 1312 if (likely(x1->km.state == XFRM_STATE_VALID)) { 1313 if (x->encap && x1->encap) 1314 memcpy(x1->encap, x->encap, sizeof(*x1->encap)); 1315 if (x->coaddr && x1->coaddr) { 1316 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr)); 1317 } 1318 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel))) 1319 memcpy(&x1->sel, &x->sel, sizeof(x1->sel)); 1320 memcpy(&x1->lft, &x->lft, sizeof(x1->lft)); 1321 x1->km.dying = 0; 1322 1323 tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL); 1324 if (x1->curlft.use_time) 1325 xfrm_state_check_expire(x1); 1326 1327 err = 0; 1328 } 1329 spin_unlock_bh(&x1->lock); 1330 1331 xfrm_state_put(x1); 1332 1333 return err; 1334 } 1335 EXPORT_SYMBOL(xfrm_state_update); 1336 1337 int xfrm_state_check_expire(struct xfrm_state *x) 1338 { 1339 if (!x->curlft.use_time) 1340 x->curlft.use_time = get_seconds(); 1341 1342 if (x->km.state != XFRM_STATE_VALID) 1343 return -EINVAL; 1344 1345 if (x->curlft.bytes >= x->lft.hard_byte_limit || 1346 x->curlft.packets >= x->lft.hard_packet_limit) { 1347 x->km.state = XFRM_STATE_EXPIRED; 1348 tasklet_hrtimer_start(&x->mtimer, ktime_set(0,0), HRTIMER_MODE_REL); 1349 return -EINVAL; 1350 } 1351 1352 if (!x->km.dying && 1353 (x->curlft.bytes >= x->lft.soft_byte_limit || 1354 x->curlft.packets >= x->lft.soft_packet_limit)) { 1355 x->km.dying = 1; 1356 km_state_expired(x, 0, 0); 1357 } 1358 return 0; 1359 } 1360 EXPORT_SYMBOL(xfrm_state_check_expire); 1361 1362 struct xfrm_state * 1363 xfrm_state_lookup(struct net *net, u32 mark, xfrm_address_t *daddr, __be32 spi, 1364 u8 proto, unsigned short family) 1365 { 1366 struct xfrm_state *x; 1367 1368 spin_lock_bh(&xfrm_state_lock); 1369 x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family); 1370 spin_unlock_bh(&xfrm_state_lock); 1371 return x; 1372 } 1373 EXPORT_SYMBOL(xfrm_state_lookup); 1374 1375 struct xfrm_state * 1376 xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1377 xfrm_address_t *daddr, xfrm_address_t *saddr, 1378 u8 proto, unsigned short family) 1379 { 1380 struct xfrm_state *x; 1381 1382 spin_lock_bh(&xfrm_state_lock); 1383 x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family); 1384 spin_unlock_bh(&xfrm_state_lock); 1385 return x; 1386 } 1387 EXPORT_SYMBOL(xfrm_state_lookup_byaddr); 1388 1389 struct xfrm_state * 1390 xfrm_find_acq(struct net *net, struct xfrm_mark *mark, u8 mode, u32 reqid, u8 proto, 1391 xfrm_address_t *daddr, xfrm_address_t *saddr, 1392 int create, unsigned short family) 1393 { 1394 struct xfrm_state *x; 1395 1396 spin_lock_bh(&xfrm_state_lock); 1397 x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create); 1398 spin_unlock_bh(&xfrm_state_lock); 1399 1400 return x; 1401 } 1402 EXPORT_SYMBOL(xfrm_find_acq); 1403 1404 #ifdef CONFIG_XFRM_SUB_POLICY 1405 int 1406 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1407 unsigned short family) 1408 { 1409 int err = 0; 1410 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1411 if (!afinfo) 1412 return -EAFNOSUPPORT; 1413 1414 spin_lock_bh(&xfrm_state_lock); 1415 if (afinfo->tmpl_sort) 1416 err = afinfo->tmpl_sort(dst, src, n); 1417 spin_unlock_bh(&xfrm_state_lock); 1418 xfrm_state_put_afinfo(afinfo); 1419 return err; 1420 } 1421 EXPORT_SYMBOL(xfrm_tmpl_sort); 1422 1423 int 1424 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1425 unsigned short family) 1426 { 1427 int err = 0; 1428 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1429 if (!afinfo) 1430 return -EAFNOSUPPORT; 1431 1432 spin_lock_bh(&xfrm_state_lock); 1433 if (afinfo->state_sort) 1434 err = afinfo->state_sort(dst, src, n); 1435 spin_unlock_bh(&xfrm_state_lock); 1436 xfrm_state_put_afinfo(afinfo); 1437 return err; 1438 } 1439 EXPORT_SYMBOL(xfrm_state_sort); 1440 #endif 1441 1442 /* Silly enough, but I'm lazy to build resolution list */ 1443 1444 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) 1445 { 1446 int i; 1447 1448 for (i = 0; i <= net->xfrm.state_hmask; i++) { 1449 struct hlist_node *entry; 1450 struct xfrm_state *x; 1451 1452 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) { 1453 if (x->km.seq == seq && 1454 (mark & x->mark.m) == x->mark.v && 1455 x->km.state == XFRM_STATE_ACQ) { 1456 xfrm_state_hold(x); 1457 return x; 1458 } 1459 } 1460 } 1461 return NULL; 1462 } 1463 1464 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) 1465 { 1466 struct xfrm_state *x; 1467 1468 spin_lock_bh(&xfrm_state_lock); 1469 x = __xfrm_find_acq_byseq(net, mark, seq); 1470 spin_unlock_bh(&xfrm_state_lock); 1471 return x; 1472 } 1473 EXPORT_SYMBOL(xfrm_find_acq_byseq); 1474 1475 u32 xfrm_get_acqseq(void) 1476 { 1477 u32 res; 1478 static atomic_t acqseq; 1479 1480 do { 1481 res = atomic_inc_return(&acqseq); 1482 } while (!res); 1483 1484 return res; 1485 } 1486 EXPORT_SYMBOL(xfrm_get_acqseq); 1487 1488 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high) 1489 { 1490 struct net *net = xs_net(x); 1491 unsigned int h; 1492 struct xfrm_state *x0; 1493 int err = -ENOENT; 1494 __be32 minspi = htonl(low); 1495 __be32 maxspi = htonl(high); 1496 u32 mark = x->mark.v & x->mark.m; 1497 1498 spin_lock_bh(&x->lock); 1499 if (x->km.state == XFRM_STATE_DEAD) 1500 goto unlock; 1501 1502 err = 0; 1503 if (x->id.spi) 1504 goto unlock; 1505 1506 err = -ENOENT; 1507 1508 if (minspi == maxspi) { 1509 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family); 1510 if (x0) { 1511 xfrm_state_put(x0); 1512 goto unlock; 1513 } 1514 x->id.spi = minspi; 1515 } else { 1516 u32 spi = 0; 1517 for (h=0; h<high-low+1; h++) { 1518 spi = low + net_random()%(high-low+1); 1519 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family); 1520 if (x0 == NULL) { 1521 x->id.spi = htonl(spi); 1522 break; 1523 } 1524 xfrm_state_put(x0); 1525 } 1526 } 1527 if (x->id.spi) { 1528 spin_lock_bh(&xfrm_state_lock); 1529 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family); 1530 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); 1531 spin_unlock_bh(&xfrm_state_lock); 1532 1533 err = 0; 1534 } 1535 1536 unlock: 1537 spin_unlock_bh(&x->lock); 1538 1539 return err; 1540 } 1541 EXPORT_SYMBOL(xfrm_alloc_spi); 1542 1543 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 1544 int (*func)(struct xfrm_state *, int, void*), 1545 void *data) 1546 { 1547 struct xfrm_state *state; 1548 struct xfrm_state_walk *x; 1549 int err = 0; 1550 1551 if (walk->seq != 0 && list_empty(&walk->all)) 1552 return 0; 1553 1554 spin_lock_bh(&xfrm_state_lock); 1555 if (list_empty(&walk->all)) 1556 x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all); 1557 else 1558 x = list_entry(&walk->all, struct xfrm_state_walk, all); 1559 list_for_each_entry_from(x, &net->xfrm.state_all, all) { 1560 if (x->state == XFRM_STATE_DEAD) 1561 continue; 1562 state = container_of(x, struct xfrm_state, km); 1563 if (!xfrm_id_proto_match(state->id.proto, walk->proto)) 1564 continue; 1565 err = func(state, walk->seq, data); 1566 if (err) { 1567 list_move_tail(&walk->all, &x->all); 1568 goto out; 1569 } 1570 walk->seq++; 1571 } 1572 if (walk->seq == 0) { 1573 err = -ENOENT; 1574 goto out; 1575 } 1576 list_del_init(&walk->all); 1577 out: 1578 spin_unlock_bh(&xfrm_state_lock); 1579 return err; 1580 } 1581 EXPORT_SYMBOL(xfrm_state_walk); 1582 1583 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto) 1584 { 1585 INIT_LIST_HEAD(&walk->all); 1586 walk->proto = proto; 1587 walk->state = XFRM_STATE_DEAD; 1588 walk->seq = 0; 1589 } 1590 EXPORT_SYMBOL(xfrm_state_walk_init); 1591 1592 void xfrm_state_walk_done(struct xfrm_state_walk *walk) 1593 { 1594 if (list_empty(&walk->all)) 1595 return; 1596 1597 spin_lock_bh(&xfrm_state_lock); 1598 list_del(&walk->all); 1599 spin_unlock_bh(&xfrm_state_lock); 1600 } 1601 EXPORT_SYMBOL(xfrm_state_walk_done); 1602 1603 1604 void xfrm_replay_notify(struct xfrm_state *x, int event) 1605 { 1606 struct km_event c; 1607 /* we send notify messages in case 1608 * 1. we updated on of the sequence numbers, and the seqno difference 1609 * is at least x->replay_maxdiff, in this case we also update the 1610 * timeout of our timer function 1611 * 2. if x->replay_maxage has elapsed since last update, 1612 * and there were changes 1613 * 1614 * The state structure must be locked! 1615 */ 1616 1617 switch (event) { 1618 case XFRM_REPLAY_UPDATE: 1619 if (x->replay_maxdiff && 1620 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) && 1621 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) { 1622 if (x->xflags & XFRM_TIME_DEFER) 1623 event = XFRM_REPLAY_TIMEOUT; 1624 else 1625 return; 1626 } 1627 1628 break; 1629 1630 case XFRM_REPLAY_TIMEOUT: 1631 if ((x->replay.seq == x->preplay.seq) && 1632 (x->replay.bitmap == x->preplay.bitmap) && 1633 (x->replay.oseq == x->preplay.oseq)) { 1634 x->xflags |= XFRM_TIME_DEFER; 1635 return; 1636 } 1637 1638 break; 1639 } 1640 1641 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state)); 1642 c.event = XFRM_MSG_NEWAE; 1643 c.data.aevent = event; 1644 km_state_notify(x, &c); 1645 1646 if (x->replay_maxage && 1647 !mod_timer(&x->rtimer, jiffies + x->replay_maxage)) 1648 x->xflags &= ~XFRM_TIME_DEFER; 1649 } 1650 1651 static void xfrm_replay_timer_handler(unsigned long data) 1652 { 1653 struct xfrm_state *x = (struct xfrm_state*)data; 1654 1655 spin_lock(&x->lock); 1656 1657 if (x->km.state == XFRM_STATE_VALID) { 1658 if (xfrm_aevent_is_on(xs_net(x))) 1659 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT); 1660 else 1661 x->xflags |= XFRM_TIME_DEFER; 1662 } 1663 1664 spin_unlock(&x->lock); 1665 } 1666 1667 int xfrm_replay_check(struct xfrm_state *x, 1668 struct sk_buff *skb, __be32 net_seq) 1669 { 1670 u32 diff; 1671 u32 seq = ntohl(net_seq); 1672 1673 if (unlikely(seq == 0)) 1674 goto err; 1675 1676 if (likely(seq > x->replay.seq)) 1677 return 0; 1678 1679 diff = x->replay.seq - seq; 1680 if (diff >= min_t(unsigned int, x->props.replay_window, 1681 sizeof(x->replay.bitmap) * 8)) { 1682 x->stats.replay_window++; 1683 goto err; 1684 } 1685 1686 if (x->replay.bitmap & (1U << diff)) { 1687 x->stats.replay++; 1688 goto err; 1689 } 1690 return 0; 1691 1692 err: 1693 xfrm_audit_state_replay(x, skb, net_seq); 1694 return -EINVAL; 1695 } 1696 1697 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq) 1698 { 1699 u32 diff; 1700 u32 seq = ntohl(net_seq); 1701 1702 if (seq > x->replay.seq) { 1703 diff = seq - x->replay.seq; 1704 if (diff < x->props.replay_window) 1705 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1; 1706 else 1707 x->replay.bitmap = 1; 1708 x->replay.seq = seq; 1709 } else { 1710 diff = x->replay.seq - seq; 1711 x->replay.bitmap |= (1U << diff); 1712 } 1713 1714 if (xfrm_aevent_is_on(xs_net(x))) 1715 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); 1716 } 1717 1718 static LIST_HEAD(xfrm_km_list); 1719 static DEFINE_RWLOCK(xfrm_km_lock); 1720 1721 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 1722 { 1723 struct xfrm_mgr *km; 1724 1725 read_lock(&xfrm_km_lock); 1726 list_for_each_entry(km, &xfrm_km_list, list) 1727 if (km->notify_policy) 1728 km->notify_policy(xp, dir, c); 1729 read_unlock(&xfrm_km_lock); 1730 } 1731 1732 void km_state_notify(struct xfrm_state *x, struct km_event *c) 1733 { 1734 struct xfrm_mgr *km; 1735 read_lock(&xfrm_km_lock); 1736 list_for_each_entry(km, &xfrm_km_list, list) 1737 if (km->notify) 1738 km->notify(x, c); 1739 read_unlock(&xfrm_km_lock); 1740 } 1741 1742 EXPORT_SYMBOL(km_policy_notify); 1743 EXPORT_SYMBOL(km_state_notify); 1744 1745 void km_state_expired(struct xfrm_state *x, int hard, u32 pid) 1746 { 1747 struct net *net = xs_net(x); 1748 struct km_event c; 1749 1750 c.data.hard = hard; 1751 c.pid = pid; 1752 c.event = XFRM_MSG_EXPIRE; 1753 km_state_notify(x, &c); 1754 1755 if (hard) 1756 wake_up(&net->xfrm.km_waitq); 1757 } 1758 1759 EXPORT_SYMBOL(km_state_expired); 1760 /* 1761 * We send to all registered managers regardless of failure 1762 * We are happy with one success 1763 */ 1764 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol) 1765 { 1766 int err = -EINVAL, acqret; 1767 struct xfrm_mgr *km; 1768 1769 read_lock(&xfrm_km_lock); 1770 list_for_each_entry(km, &xfrm_km_list, list) { 1771 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT); 1772 if (!acqret) 1773 err = acqret; 1774 } 1775 read_unlock(&xfrm_km_lock); 1776 return err; 1777 } 1778 EXPORT_SYMBOL(km_query); 1779 1780 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 1781 { 1782 int err = -EINVAL; 1783 struct xfrm_mgr *km; 1784 1785 read_lock(&xfrm_km_lock); 1786 list_for_each_entry(km, &xfrm_km_list, list) { 1787 if (km->new_mapping) 1788 err = km->new_mapping(x, ipaddr, sport); 1789 if (!err) 1790 break; 1791 } 1792 read_unlock(&xfrm_km_lock); 1793 return err; 1794 } 1795 EXPORT_SYMBOL(km_new_mapping); 1796 1797 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid) 1798 { 1799 struct net *net = xp_net(pol); 1800 struct km_event c; 1801 1802 c.data.hard = hard; 1803 c.pid = pid; 1804 c.event = XFRM_MSG_POLEXPIRE; 1805 km_policy_notify(pol, dir, &c); 1806 1807 if (hard) 1808 wake_up(&net->xfrm.km_waitq); 1809 } 1810 EXPORT_SYMBOL(km_policy_expired); 1811 1812 #ifdef CONFIG_XFRM_MIGRATE 1813 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 1814 struct xfrm_migrate *m, int num_migrate, 1815 struct xfrm_kmaddress *k) 1816 { 1817 int err = -EINVAL; 1818 int ret; 1819 struct xfrm_mgr *km; 1820 1821 read_lock(&xfrm_km_lock); 1822 list_for_each_entry(km, &xfrm_km_list, list) { 1823 if (km->migrate) { 1824 ret = km->migrate(sel, dir, type, m, num_migrate, k); 1825 if (!ret) 1826 err = ret; 1827 } 1828 } 1829 read_unlock(&xfrm_km_lock); 1830 return err; 1831 } 1832 EXPORT_SYMBOL(km_migrate); 1833 #endif 1834 1835 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr) 1836 { 1837 int err = -EINVAL; 1838 int ret; 1839 struct xfrm_mgr *km; 1840 1841 read_lock(&xfrm_km_lock); 1842 list_for_each_entry(km, &xfrm_km_list, list) { 1843 if (km->report) { 1844 ret = km->report(net, proto, sel, addr); 1845 if (!ret) 1846 err = ret; 1847 } 1848 } 1849 read_unlock(&xfrm_km_lock); 1850 return err; 1851 } 1852 EXPORT_SYMBOL(km_report); 1853 1854 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 1855 { 1856 int err; 1857 u8 *data; 1858 struct xfrm_mgr *km; 1859 struct xfrm_policy *pol = NULL; 1860 1861 if (optlen <= 0 || optlen > PAGE_SIZE) 1862 return -EMSGSIZE; 1863 1864 data = kmalloc(optlen, GFP_KERNEL); 1865 if (!data) 1866 return -ENOMEM; 1867 1868 err = -EFAULT; 1869 if (copy_from_user(data, optval, optlen)) 1870 goto out; 1871 1872 err = -EINVAL; 1873 read_lock(&xfrm_km_lock); 1874 list_for_each_entry(km, &xfrm_km_list, list) { 1875 pol = km->compile_policy(sk, optname, data, 1876 optlen, &err); 1877 if (err >= 0) 1878 break; 1879 } 1880 read_unlock(&xfrm_km_lock); 1881 1882 if (err >= 0) { 1883 xfrm_sk_policy_insert(sk, err, pol); 1884 xfrm_pol_put(pol); 1885 err = 0; 1886 } 1887 1888 out: 1889 kfree(data); 1890 return err; 1891 } 1892 EXPORT_SYMBOL(xfrm_user_policy); 1893 1894 int xfrm_register_km(struct xfrm_mgr *km) 1895 { 1896 write_lock_bh(&xfrm_km_lock); 1897 list_add_tail(&km->list, &xfrm_km_list); 1898 write_unlock_bh(&xfrm_km_lock); 1899 return 0; 1900 } 1901 EXPORT_SYMBOL(xfrm_register_km); 1902 1903 int xfrm_unregister_km(struct xfrm_mgr *km) 1904 { 1905 write_lock_bh(&xfrm_km_lock); 1906 list_del(&km->list); 1907 write_unlock_bh(&xfrm_km_lock); 1908 return 0; 1909 } 1910 EXPORT_SYMBOL(xfrm_unregister_km); 1911 1912 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo) 1913 { 1914 int err = 0; 1915 if (unlikely(afinfo == NULL)) 1916 return -EINVAL; 1917 if (unlikely(afinfo->family >= NPROTO)) 1918 return -EAFNOSUPPORT; 1919 write_lock_bh(&xfrm_state_afinfo_lock); 1920 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL)) 1921 err = -ENOBUFS; 1922 else 1923 xfrm_state_afinfo[afinfo->family] = afinfo; 1924 write_unlock_bh(&xfrm_state_afinfo_lock); 1925 return err; 1926 } 1927 EXPORT_SYMBOL(xfrm_state_register_afinfo); 1928 1929 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo) 1930 { 1931 int err = 0; 1932 if (unlikely(afinfo == NULL)) 1933 return -EINVAL; 1934 if (unlikely(afinfo->family >= NPROTO)) 1935 return -EAFNOSUPPORT; 1936 write_lock_bh(&xfrm_state_afinfo_lock); 1937 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) { 1938 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo)) 1939 err = -EINVAL; 1940 else 1941 xfrm_state_afinfo[afinfo->family] = NULL; 1942 } 1943 write_unlock_bh(&xfrm_state_afinfo_lock); 1944 return err; 1945 } 1946 EXPORT_SYMBOL(xfrm_state_unregister_afinfo); 1947 1948 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family) 1949 { 1950 struct xfrm_state_afinfo *afinfo; 1951 if (unlikely(family >= NPROTO)) 1952 return NULL; 1953 read_lock(&xfrm_state_afinfo_lock); 1954 afinfo = xfrm_state_afinfo[family]; 1955 if (unlikely(!afinfo)) 1956 read_unlock(&xfrm_state_afinfo_lock); 1957 return afinfo; 1958 } 1959 1960 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo) 1961 __releases(xfrm_state_afinfo_lock) 1962 { 1963 read_unlock(&xfrm_state_afinfo_lock); 1964 } 1965 1966 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ 1967 void xfrm_state_delete_tunnel(struct xfrm_state *x) 1968 { 1969 if (x->tunnel) { 1970 struct xfrm_state *t = x->tunnel; 1971 1972 if (atomic_read(&t->tunnel_users) == 2) 1973 xfrm_state_delete(t); 1974 atomic_dec(&t->tunnel_users); 1975 xfrm_state_put(t); 1976 x->tunnel = NULL; 1977 } 1978 } 1979 EXPORT_SYMBOL(xfrm_state_delete_tunnel); 1980 1981 int xfrm_state_mtu(struct xfrm_state *x, int mtu) 1982 { 1983 int res; 1984 1985 spin_lock_bh(&x->lock); 1986 if (x->km.state == XFRM_STATE_VALID && 1987 x->type && x->type->get_mtu) 1988 res = x->type->get_mtu(x, mtu); 1989 else 1990 res = mtu - x->props.header_len; 1991 spin_unlock_bh(&x->lock); 1992 return res; 1993 } 1994 1995 int xfrm_init_state(struct xfrm_state *x) 1996 { 1997 struct xfrm_state_afinfo *afinfo; 1998 struct xfrm_mode *inner_mode; 1999 int family = x->props.family; 2000 int err; 2001 2002 err = -EAFNOSUPPORT; 2003 afinfo = xfrm_state_get_afinfo(family); 2004 if (!afinfo) 2005 goto error; 2006 2007 err = 0; 2008 if (afinfo->init_flags) 2009 err = afinfo->init_flags(x); 2010 2011 xfrm_state_put_afinfo(afinfo); 2012 2013 if (err) 2014 goto error; 2015 2016 err = -EPROTONOSUPPORT; 2017 2018 if (x->sel.family != AF_UNSPEC) { 2019 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family); 2020 if (inner_mode == NULL) 2021 goto error; 2022 2023 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) && 2024 family != x->sel.family) { 2025 xfrm_put_mode(inner_mode); 2026 goto error; 2027 } 2028 2029 x->inner_mode = inner_mode; 2030 } else { 2031 struct xfrm_mode *inner_mode_iaf; 2032 int iafamily = AF_INET; 2033 2034 inner_mode = xfrm_get_mode(x->props.mode, x->props.family); 2035 if (inner_mode == NULL) 2036 goto error; 2037 2038 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) { 2039 xfrm_put_mode(inner_mode); 2040 goto error; 2041 } 2042 x->inner_mode = inner_mode; 2043 2044 if (x->props.family == AF_INET) 2045 iafamily = AF_INET6; 2046 2047 inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily); 2048 if (inner_mode_iaf) { 2049 if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL) 2050 x->inner_mode_iaf = inner_mode_iaf; 2051 else 2052 xfrm_put_mode(inner_mode_iaf); 2053 } 2054 } 2055 2056 x->type = xfrm_get_type(x->id.proto, family); 2057 if (x->type == NULL) 2058 goto error; 2059 2060 err = x->type->init_state(x); 2061 if (err) 2062 goto error; 2063 2064 x->outer_mode = xfrm_get_mode(x->props.mode, family); 2065 if (x->outer_mode == NULL) 2066 goto error; 2067 2068 x->km.state = XFRM_STATE_VALID; 2069 2070 error: 2071 return err; 2072 } 2073 2074 EXPORT_SYMBOL(xfrm_init_state); 2075 2076 int __net_init xfrm_state_init(struct net *net) 2077 { 2078 unsigned int sz; 2079 2080 INIT_LIST_HEAD(&net->xfrm.state_all); 2081 2082 sz = sizeof(struct hlist_head) * 8; 2083 2084 net->xfrm.state_bydst = xfrm_hash_alloc(sz); 2085 if (!net->xfrm.state_bydst) 2086 goto out_bydst; 2087 net->xfrm.state_bysrc = xfrm_hash_alloc(sz); 2088 if (!net->xfrm.state_bysrc) 2089 goto out_bysrc; 2090 net->xfrm.state_byspi = xfrm_hash_alloc(sz); 2091 if (!net->xfrm.state_byspi) 2092 goto out_byspi; 2093 net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1); 2094 2095 net->xfrm.state_num = 0; 2096 INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize); 2097 INIT_HLIST_HEAD(&net->xfrm.state_gc_list); 2098 INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task); 2099 init_waitqueue_head(&net->xfrm.km_waitq); 2100 return 0; 2101 2102 out_byspi: 2103 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2104 out_bysrc: 2105 xfrm_hash_free(net->xfrm.state_bydst, sz); 2106 out_bydst: 2107 return -ENOMEM; 2108 } 2109 2110 void xfrm_state_fini(struct net *net) 2111 { 2112 struct xfrm_audit audit_info; 2113 unsigned int sz; 2114 2115 flush_work(&net->xfrm.state_hash_work); 2116 audit_info.loginuid = -1; 2117 audit_info.sessionid = -1; 2118 audit_info.secid = 0; 2119 xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info); 2120 flush_work(&net->xfrm.state_gc_work); 2121 2122 WARN_ON(!list_empty(&net->xfrm.state_all)); 2123 2124 sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head); 2125 WARN_ON(!hlist_empty(net->xfrm.state_byspi)); 2126 xfrm_hash_free(net->xfrm.state_byspi, sz); 2127 WARN_ON(!hlist_empty(net->xfrm.state_bysrc)); 2128 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2129 WARN_ON(!hlist_empty(net->xfrm.state_bydst)); 2130 xfrm_hash_free(net->xfrm.state_bydst, sz); 2131 } 2132 2133 #ifdef CONFIG_AUDITSYSCALL 2134 static void xfrm_audit_helper_sainfo(struct xfrm_state *x, 2135 struct audit_buffer *audit_buf) 2136 { 2137 struct xfrm_sec_ctx *ctx = x->security; 2138 u32 spi = ntohl(x->id.spi); 2139 2140 if (ctx) 2141 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", 2142 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str); 2143 2144 switch(x->props.family) { 2145 case AF_INET: 2146 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2147 &x->props.saddr.a4, &x->id.daddr.a4); 2148 break; 2149 case AF_INET6: 2150 audit_log_format(audit_buf, " src=%pI6 dst=%pI6", 2151 x->props.saddr.a6, x->id.daddr.a6); 2152 break; 2153 } 2154 2155 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2156 } 2157 2158 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, 2159 struct audit_buffer *audit_buf) 2160 { 2161 struct iphdr *iph4; 2162 struct ipv6hdr *iph6; 2163 2164 switch (family) { 2165 case AF_INET: 2166 iph4 = ip_hdr(skb); 2167 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2168 &iph4->saddr, &iph4->daddr); 2169 break; 2170 case AF_INET6: 2171 iph6 = ipv6_hdr(skb); 2172 audit_log_format(audit_buf, 2173 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x", 2174 &iph6->saddr,&iph6->daddr, 2175 iph6->flow_lbl[0] & 0x0f, 2176 iph6->flow_lbl[1], 2177 iph6->flow_lbl[2]); 2178 break; 2179 } 2180 } 2181 2182 void xfrm_audit_state_add(struct xfrm_state *x, int result, 2183 uid_t auid, u32 sessionid, u32 secid) 2184 { 2185 struct audit_buffer *audit_buf; 2186 2187 audit_buf = xfrm_audit_start("SAD-add"); 2188 if (audit_buf == NULL) 2189 return; 2190 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2191 xfrm_audit_helper_sainfo(x, audit_buf); 2192 audit_log_format(audit_buf, " res=%u", result); 2193 audit_log_end(audit_buf); 2194 } 2195 EXPORT_SYMBOL_GPL(xfrm_audit_state_add); 2196 2197 void xfrm_audit_state_delete(struct xfrm_state *x, int result, 2198 uid_t auid, u32 sessionid, u32 secid) 2199 { 2200 struct audit_buffer *audit_buf; 2201 2202 audit_buf = xfrm_audit_start("SAD-delete"); 2203 if (audit_buf == NULL) 2204 return; 2205 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2206 xfrm_audit_helper_sainfo(x, audit_buf); 2207 audit_log_format(audit_buf, " res=%u", result); 2208 audit_log_end(audit_buf); 2209 } 2210 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete); 2211 2212 void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 2213 struct sk_buff *skb) 2214 { 2215 struct audit_buffer *audit_buf; 2216 u32 spi; 2217 2218 audit_buf = xfrm_audit_start("SA-replay-overflow"); 2219 if (audit_buf == NULL) 2220 return; 2221 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2222 /* don't record the sequence number because it's inherent in this kind 2223 * of audit message */ 2224 spi = ntohl(x->id.spi); 2225 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2226 audit_log_end(audit_buf); 2227 } 2228 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow); 2229 2230 static void xfrm_audit_state_replay(struct xfrm_state *x, 2231 struct sk_buff *skb, __be32 net_seq) 2232 { 2233 struct audit_buffer *audit_buf; 2234 u32 spi; 2235 2236 audit_buf = xfrm_audit_start("SA-replayed-pkt"); 2237 if (audit_buf == NULL) 2238 return; 2239 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2240 spi = ntohl(x->id.spi); 2241 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2242 spi, spi, ntohl(net_seq)); 2243 audit_log_end(audit_buf); 2244 } 2245 2246 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family) 2247 { 2248 struct audit_buffer *audit_buf; 2249 2250 audit_buf = xfrm_audit_start("SA-notfound"); 2251 if (audit_buf == NULL) 2252 return; 2253 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2254 audit_log_end(audit_buf); 2255 } 2256 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple); 2257 2258 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 2259 __be32 net_spi, __be32 net_seq) 2260 { 2261 struct audit_buffer *audit_buf; 2262 u32 spi; 2263 2264 audit_buf = xfrm_audit_start("SA-notfound"); 2265 if (audit_buf == NULL) 2266 return; 2267 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2268 spi = ntohl(net_spi); 2269 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2270 spi, spi, ntohl(net_seq)); 2271 audit_log_end(audit_buf); 2272 } 2273 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound); 2274 2275 void xfrm_audit_state_icvfail(struct xfrm_state *x, 2276 struct sk_buff *skb, u8 proto) 2277 { 2278 struct audit_buffer *audit_buf; 2279 __be32 net_spi; 2280 __be32 net_seq; 2281 2282 audit_buf = xfrm_audit_start("SA-icv-failure"); 2283 if (audit_buf == NULL) 2284 return; 2285 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2286 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) { 2287 u32 spi = ntohl(net_spi); 2288 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2289 spi, spi, ntohl(net_seq)); 2290 } 2291 audit_log_end(audit_buf); 2292 } 2293 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail); 2294 #endif /* CONFIG_AUDITSYSCALL */ 2295