1 /* 2 * xfrm_state.c 3 * 4 * Changes: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * YOSHIFUJI Hideaki @USAGI 10 * Split up af-specific functions 11 * Derek Atkins <derek@ihtfp.com> 12 * Add UDP Encapsulation 13 * 14 */ 15 16 #include <linux/workqueue.h> 17 #include <net/xfrm.h> 18 #include <linux/pfkeyv2.h> 19 #include <linux/ipsec.h> 20 #include <linux/module.h> 21 #include <linux/cache.h> 22 #include <linux/audit.h> 23 #include <asm/uaccess.h> 24 #include <linux/ktime.h> 25 #include <linux/slab.h> 26 #include <linux/interrupt.h> 27 #include <linux/kernel.h> 28 29 #include "xfrm_hash.h" 30 31 #define xfrm_state_deref_prot(table, net) \ 32 rcu_dereference_protected((table), lockdep_is_held(&(net)->xfrm.xfrm_state_lock)) 33 34 static void xfrm_state_gc_task(struct work_struct *work); 35 36 /* Each xfrm_state may be linked to two tables: 37 38 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl) 39 2. Hash table by (daddr,family,reqid) to find what SAs exist for given 40 destination/tunnel endpoint. (output) 41 */ 42 43 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024; 44 static __read_mostly seqcount_t xfrm_state_hash_generation = SEQCNT_ZERO(xfrm_state_hash_generation); 45 46 static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task); 47 static HLIST_HEAD(xfrm_state_gc_list); 48 49 static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x) 50 { 51 return atomic_inc_not_zero(&x->refcnt); 52 } 53 54 static inline unsigned int xfrm_dst_hash(struct net *net, 55 const xfrm_address_t *daddr, 56 const xfrm_address_t *saddr, 57 u32 reqid, 58 unsigned short family) 59 { 60 return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask); 61 } 62 63 static inline unsigned int xfrm_src_hash(struct net *net, 64 const xfrm_address_t *daddr, 65 const xfrm_address_t *saddr, 66 unsigned short family) 67 { 68 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask); 69 } 70 71 static inline unsigned int 72 xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr, 73 __be32 spi, u8 proto, unsigned short family) 74 { 75 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask); 76 } 77 78 static void xfrm_hash_transfer(struct hlist_head *list, 79 struct hlist_head *ndsttable, 80 struct hlist_head *nsrctable, 81 struct hlist_head *nspitable, 82 unsigned int nhashmask) 83 { 84 struct hlist_node *tmp; 85 struct xfrm_state *x; 86 87 hlist_for_each_entry_safe(x, tmp, list, bydst) { 88 unsigned int h; 89 90 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr, 91 x->props.reqid, x->props.family, 92 nhashmask); 93 hlist_add_head_rcu(&x->bydst, ndsttable + h); 94 95 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr, 96 x->props.family, 97 nhashmask); 98 hlist_add_head_rcu(&x->bysrc, nsrctable + h); 99 100 if (x->id.spi) { 101 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi, 102 x->id.proto, x->props.family, 103 nhashmask); 104 hlist_add_head_rcu(&x->byspi, nspitable + h); 105 } 106 } 107 } 108 109 static unsigned long xfrm_hash_new_size(unsigned int state_hmask) 110 { 111 return ((state_hmask + 1) << 1) * sizeof(struct hlist_head); 112 } 113 114 static void xfrm_hash_resize(struct work_struct *work) 115 { 116 struct net *net = container_of(work, struct net, xfrm.state_hash_work); 117 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi; 118 unsigned long nsize, osize; 119 unsigned int nhashmask, ohashmask; 120 int i; 121 122 nsize = xfrm_hash_new_size(net->xfrm.state_hmask); 123 ndst = xfrm_hash_alloc(nsize); 124 if (!ndst) 125 return; 126 nsrc = xfrm_hash_alloc(nsize); 127 if (!nsrc) { 128 xfrm_hash_free(ndst, nsize); 129 return; 130 } 131 nspi = xfrm_hash_alloc(nsize); 132 if (!nspi) { 133 xfrm_hash_free(ndst, nsize); 134 xfrm_hash_free(nsrc, nsize); 135 return; 136 } 137 138 spin_lock_bh(&net->xfrm.xfrm_state_lock); 139 write_seqcount_begin(&xfrm_state_hash_generation); 140 141 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U; 142 odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net); 143 for (i = net->xfrm.state_hmask; i >= 0; i--) 144 xfrm_hash_transfer(odst + i, ndst, nsrc, nspi, nhashmask); 145 146 osrc = xfrm_state_deref_prot(net->xfrm.state_bysrc, net); 147 ospi = xfrm_state_deref_prot(net->xfrm.state_byspi, net); 148 ohashmask = net->xfrm.state_hmask; 149 150 rcu_assign_pointer(net->xfrm.state_bydst, ndst); 151 rcu_assign_pointer(net->xfrm.state_bysrc, nsrc); 152 rcu_assign_pointer(net->xfrm.state_byspi, nspi); 153 net->xfrm.state_hmask = nhashmask; 154 155 write_seqcount_end(&xfrm_state_hash_generation); 156 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 157 158 osize = (ohashmask + 1) * sizeof(struct hlist_head); 159 160 synchronize_rcu(); 161 162 xfrm_hash_free(odst, osize); 163 xfrm_hash_free(osrc, osize); 164 xfrm_hash_free(ospi, osize); 165 } 166 167 static DEFINE_SPINLOCK(xfrm_state_afinfo_lock); 168 static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO]; 169 170 static DEFINE_SPINLOCK(xfrm_state_gc_lock); 171 172 int __xfrm_state_delete(struct xfrm_state *x); 173 174 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); 175 bool km_is_alive(const struct km_event *c); 176 void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 177 178 static DEFINE_SPINLOCK(xfrm_type_lock); 179 int xfrm_register_type(const struct xfrm_type *type, unsigned short family) 180 { 181 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 182 const struct xfrm_type **typemap; 183 int err = 0; 184 185 if (unlikely(afinfo == NULL)) 186 return -EAFNOSUPPORT; 187 typemap = afinfo->type_map; 188 spin_lock_bh(&xfrm_type_lock); 189 190 if (likely(typemap[type->proto] == NULL)) 191 typemap[type->proto] = type; 192 else 193 err = -EEXIST; 194 spin_unlock_bh(&xfrm_type_lock); 195 xfrm_state_put_afinfo(afinfo); 196 return err; 197 } 198 EXPORT_SYMBOL(xfrm_register_type); 199 200 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family) 201 { 202 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 203 const struct xfrm_type **typemap; 204 int err = 0; 205 206 if (unlikely(afinfo == NULL)) 207 return -EAFNOSUPPORT; 208 typemap = afinfo->type_map; 209 spin_lock_bh(&xfrm_type_lock); 210 211 if (unlikely(typemap[type->proto] != type)) 212 err = -ENOENT; 213 else 214 typemap[type->proto] = NULL; 215 spin_unlock_bh(&xfrm_type_lock); 216 xfrm_state_put_afinfo(afinfo); 217 return err; 218 } 219 EXPORT_SYMBOL(xfrm_unregister_type); 220 221 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family) 222 { 223 struct xfrm_state_afinfo *afinfo; 224 const struct xfrm_type **typemap; 225 const struct xfrm_type *type; 226 int modload_attempted = 0; 227 228 retry: 229 afinfo = xfrm_state_get_afinfo(family); 230 if (unlikely(afinfo == NULL)) 231 return NULL; 232 typemap = afinfo->type_map; 233 234 type = typemap[proto]; 235 if (unlikely(type && !try_module_get(type->owner))) 236 type = NULL; 237 if (!type && !modload_attempted) { 238 xfrm_state_put_afinfo(afinfo); 239 request_module("xfrm-type-%d-%d", family, proto); 240 modload_attempted = 1; 241 goto retry; 242 } 243 244 xfrm_state_put_afinfo(afinfo); 245 return type; 246 } 247 248 static void xfrm_put_type(const struct xfrm_type *type) 249 { 250 module_put(type->owner); 251 } 252 253 static DEFINE_SPINLOCK(xfrm_mode_lock); 254 int xfrm_register_mode(struct xfrm_mode *mode, int family) 255 { 256 struct xfrm_state_afinfo *afinfo; 257 struct xfrm_mode **modemap; 258 int err; 259 260 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 261 return -EINVAL; 262 263 afinfo = xfrm_state_get_afinfo(family); 264 if (unlikely(afinfo == NULL)) 265 return -EAFNOSUPPORT; 266 267 err = -EEXIST; 268 modemap = afinfo->mode_map; 269 spin_lock_bh(&xfrm_mode_lock); 270 if (modemap[mode->encap]) 271 goto out; 272 273 err = -ENOENT; 274 if (!try_module_get(afinfo->owner)) 275 goto out; 276 277 mode->afinfo = afinfo; 278 modemap[mode->encap] = mode; 279 err = 0; 280 281 out: 282 spin_unlock_bh(&xfrm_mode_lock); 283 xfrm_state_put_afinfo(afinfo); 284 return err; 285 } 286 EXPORT_SYMBOL(xfrm_register_mode); 287 288 int xfrm_unregister_mode(struct xfrm_mode *mode, int family) 289 { 290 struct xfrm_state_afinfo *afinfo; 291 struct xfrm_mode **modemap; 292 int err; 293 294 if (unlikely(mode->encap >= XFRM_MODE_MAX)) 295 return -EINVAL; 296 297 afinfo = xfrm_state_get_afinfo(family); 298 if (unlikely(afinfo == NULL)) 299 return -EAFNOSUPPORT; 300 301 err = -ENOENT; 302 modemap = afinfo->mode_map; 303 spin_lock_bh(&xfrm_mode_lock); 304 if (likely(modemap[mode->encap] == mode)) { 305 modemap[mode->encap] = NULL; 306 module_put(mode->afinfo->owner); 307 err = 0; 308 } 309 310 spin_unlock_bh(&xfrm_mode_lock); 311 xfrm_state_put_afinfo(afinfo); 312 return err; 313 } 314 EXPORT_SYMBOL(xfrm_unregister_mode); 315 316 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family) 317 { 318 struct xfrm_state_afinfo *afinfo; 319 struct xfrm_mode *mode; 320 int modload_attempted = 0; 321 322 if (unlikely(encap >= XFRM_MODE_MAX)) 323 return NULL; 324 325 retry: 326 afinfo = xfrm_state_get_afinfo(family); 327 if (unlikely(afinfo == NULL)) 328 return NULL; 329 330 mode = afinfo->mode_map[encap]; 331 if (unlikely(mode && !try_module_get(mode->owner))) 332 mode = NULL; 333 if (!mode && !modload_attempted) { 334 xfrm_state_put_afinfo(afinfo); 335 request_module("xfrm-mode-%d-%d", family, encap); 336 modload_attempted = 1; 337 goto retry; 338 } 339 340 xfrm_state_put_afinfo(afinfo); 341 return mode; 342 } 343 344 static void xfrm_put_mode(struct xfrm_mode *mode) 345 { 346 module_put(mode->owner); 347 } 348 349 static void xfrm_state_gc_destroy(struct xfrm_state *x) 350 { 351 tasklet_hrtimer_cancel(&x->mtimer); 352 del_timer_sync(&x->rtimer); 353 kfree(x->aalg); 354 kfree(x->ealg); 355 kfree(x->calg); 356 kfree(x->encap); 357 kfree(x->coaddr); 358 kfree(x->replay_esn); 359 kfree(x->preplay_esn); 360 if (x->inner_mode) 361 xfrm_put_mode(x->inner_mode); 362 if (x->inner_mode_iaf) 363 xfrm_put_mode(x->inner_mode_iaf); 364 if (x->outer_mode) 365 xfrm_put_mode(x->outer_mode); 366 if (x->type) { 367 x->type->destructor(x); 368 xfrm_put_type(x->type); 369 } 370 security_xfrm_state_free(x); 371 kfree(x); 372 } 373 374 static void xfrm_state_gc_task(struct work_struct *work) 375 { 376 struct xfrm_state *x; 377 struct hlist_node *tmp; 378 struct hlist_head gc_list; 379 380 spin_lock_bh(&xfrm_state_gc_lock); 381 hlist_move_list(&xfrm_state_gc_list, &gc_list); 382 spin_unlock_bh(&xfrm_state_gc_lock); 383 384 synchronize_rcu(); 385 386 hlist_for_each_entry_safe(x, tmp, &gc_list, gclist) 387 xfrm_state_gc_destroy(x); 388 } 389 390 static inline unsigned long make_jiffies(long secs) 391 { 392 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ) 393 return MAX_SCHEDULE_TIMEOUT-1; 394 else 395 return secs*HZ; 396 } 397 398 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me) 399 { 400 struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer); 401 struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer); 402 unsigned long now = get_seconds(); 403 long next = LONG_MAX; 404 int warn = 0; 405 int err = 0; 406 407 spin_lock(&x->lock); 408 if (x->km.state == XFRM_STATE_DEAD) 409 goto out; 410 if (x->km.state == XFRM_STATE_EXPIRED) 411 goto expired; 412 if (x->lft.hard_add_expires_seconds) { 413 long tmo = x->lft.hard_add_expires_seconds + 414 x->curlft.add_time - now; 415 if (tmo <= 0) { 416 if (x->xflags & XFRM_SOFT_EXPIRE) { 417 /* enter hard expire without soft expire first?! 418 * setting a new date could trigger this. 419 * workarbound: fix x->curflt.add_time by below: 420 */ 421 x->curlft.add_time = now - x->saved_tmo - 1; 422 tmo = x->lft.hard_add_expires_seconds - x->saved_tmo; 423 } else 424 goto expired; 425 } 426 if (tmo < next) 427 next = tmo; 428 } 429 if (x->lft.hard_use_expires_seconds) { 430 long tmo = x->lft.hard_use_expires_seconds + 431 (x->curlft.use_time ? : now) - now; 432 if (tmo <= 0) 433 goto expired; 434 if (tmo < next) 435 next = tmo; 436 } 437 if (x->km.dying) 438 goto resched; 439 if (x->lft.soft_add_expires_seconds) { 440 long tmo = x->lft.soft_add_expires_seconds + 441 x->curlft.add_time - now; 442 if (tmo <= 0) { 443 warn = 1; 444 x->xflags &= ~XFRM_SOFT_EXPIRE; 445 } else if (tmo < next) { 446 next = tmo; 447 x->xflags |= XFRM_SOFT_EXPIRE; 448 x->saved_tmo = tmo; 449 } 450 } 451 if (x->lft.soft_use_expires_seconds) { 452 long tmo = x->lft.soft_use_expires_seconds + 453 (x->curlft.use_time ? : now) - now; 454 if (tmo <= 0) 455 warn = 1; 456 else if (tmo < next) 457 next = tmo; 458 } 459 460 x->km.dying = warn; 461 if (warn) 462 km_state_expired(x, 0, 0); 463 resched: 464 if (next != LONG_MAX) { 465 tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL); 466 } 467 468 goto out; 469 470 expired: 471 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) 472 x->km.state = XFRM_STATE_EXPIRED; 473 474 err = __xfrm_state_delete(x); 475 if (!err) 476 km_state_expired(x, 1, 0); 477 478 xfrm_audit_state_delete(x, err ? 0 : 1, true); 479 480 out: 481 spin_unlock(&x->lock); 482 return HRTIMER_NORESTART; 483 } 484 485 static void xfrm_replay_timer_handler(unsigned long data); 486 487 struct xfrm_state *xfrm_state_alloc(struct net *net) 488 { 489 struct xfrm_state *x; 490 491 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC); 492 493 if (x) { 494 write_pnet(&x->xs_net, net); 495 atomic_set(&x->refcnt, 1); 496 atomic_set(&x->tunnel_users, 0); 497 INIT_LIST_HEAD(&x->km.all); 498 INIT_HLIST_NODE(&x->bydst); 499 INIT_HLIST_NODE(&x->bysrc); 500 INIT_HLIST_NODE(&x->byspi); 501 tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, 502 CLOCK_BOOTTIME, HRTIMER_MODE_ABS); 503 setup_timer(&x->rtimer, xfrm_replay_timer_handler, 504 (unsigned long)x); 505 x->curlft.add_time = get_seconds(); 506 x->lft.soft_byte_limit = XFRM_INF; 507 x->lft.soft_packet_limit = XFRM_INF; 508 x->lft.hard_byte_limit = XFRM_INF; 509 x->lft.hard_packet_limit = XFRM_INF; 510 x->replay_maxage = 0; 511 x->replay_maxdiff = 0; 512 x->inner_mode = NULL; 513 x->inner_mode_iaf = NULL; 514 spin_lock_init(&x->lock); 515 } 516 return x; 517 } 518 EXPORT_SYMBOL(xfrm_state_alloc); 519 520 void __xfrm_state_destroy(struct xfrm_state *x) 521 { 522 WARN_ON(x->km.state != XFRM_STATE_DEAD); 523 524 spin_lock_bh(&xfrm_state_gc_lock); 525 hlist_add_head(&x->gclist, &xfrm_state_gc_list); 526 spin_unlock_bh(&xfrm_state_gc_lock); 527 schedule_work(&xfrm_state_gc_work); 528 } 529 EXPORT_SYMBOL(__xfrm_state_destroy); 530 531 int __xfrm_state_delete(struct xfrm_state *x) 532 { 533 struct net *net = xs_net(x); 534 int err = -ESRCH; 535 536 if (x->km.state != XFRM_STATE_DEAD) { 537 x->km.state = XFRM_STATE_DEAD; 538 spin_lock(&net->xfrm.xfrm_state_lock); 539 list_del(&x->km.all); 540 hlist_del_rcu(&x->bydst); 541 hlist_del_rcu(&x->bysrc); 542 if (x->id.spi) 543 hlist_del_rcu(&x->byspi); 544 net->xfrm.state_num--; 545 spin_unlock(&net->xfrm.xfrm_state_lock); 546 547 /* All xfrm_state objects are created by xfrm_state_alloc. 548 * The xfrm_state_alloc call gives a reference, and that 549 * is what we are dropping here. 550 */ 551 xfrm_state_put(x); 552 err = 0; 553 } 554 555 return err; 556 } 557 EXPORT_SYMBOL(__xfrm_state_delete); 558 559 int xfrm_state_delete(struct xfrm_state *x) 560 { 561 int err; 562 563 spin_lock_bh(&x->lock); 564 err = __xfrm_state_delete(x); 565 spin_unlock_bh(&x->lock); 566 567 return err; 568 } 569 EXPORT_SYMBOL(xfrm_state_delete); 570 571 #ifdef CONFIG_SECURITY_NETWORK_XFRM 572 static inline int 573 xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid) 574 { 575 int i, err = 0; 576 577 for (i = 0; i <= net->xfrm.state_hmask; i++) { 578 struct xfrm_state *x; 579 580 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { 581 if (xfrm_id_proto_match(x->id.proto, proto) && 582 (err = security_xfrm_state_delete(x)) != 0) { 583 xfrm_audit_state_delete(x, 0, task_valid); 584 return err; 585 } 586 } 587 } 588 589 return err; 590 } 591 #else 592 static inline int 593 xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid) 594 { 595 return 0; 596 } 597 #endif 598 599 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid) 600 { 601 int i, err = 0, cnt = 0; 602 603 spin_lock_bh(&net->xfrm.xfrm_state_lock); 604 err = xfrm_state_flush_secctx_check(net, proto, task_valid); 605 if (err) 606 goto out; 607 608 err = -ESRCH; 609 for (i = 0; i <= net->xfrm.state_hmask; i++) { 610 struct xfrm_state *x; 611 restart: 612 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { 613 if (!xfrm_state_kern(x) && 614 xfrm_id_proto_match(x->id.proto, proto)) { 615 xfrm_state_hold(x); 616 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 617 618 err = xfrm_state_delete(x); 619 xfrm_audit_state_delete(x, err ? 0 : 1, 620 task_valid); 621 xfrm_state_put(x); 622 if (!err) 623 cnt++; 624 625 spin_lock_bh(&net->xfrm.xfrm_state_lock); 626 goto restart; 627 } 628 } 629 } 630 if (cnt) 631 err = 0; 632 633 out: 634 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 635 return err; 636 } 637 EXPORT_SYMBOL(xfrm_state_flush); 638 639 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si) 640 { 641 spin_lock_bh(&net->xfrm.xfrm_state_lock); 642 si->sadcnt = net->xfrm.state_num; 643 si->sadhcnt = net->xfrm.state_hmask; 644 si->sadhmcnt = xfrm_state_hashmax; 645 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 646 } 647 EXPORT_SYMBOL(xfrm_sad_getinfo); 648 649 static int 650 xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl, 651 const struct xfrm_tmpl *tmpl, 652 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 653 unsigned short family) 654 { 655 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 656 if (!afinfo) 657 return -1; 658 afinfo->init_tempsel(&x->sel, fl); 659 660 if (family != tmpl->encap_family) { 661 xfrm_state_put_afinfo(afinfo); 662 afinfo = xfrm_state_get_afinfo(tmpl->encap_family); 663 if (!afinfo) 664 return -1; 665 } 666 afinfo->init_temprop(x, tmpl, daddr, saddr); 667 xfrm_state_put_afinfo(afinfo); 668 return 0; 669 } 670 671 static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, 672 const xfrm_address_t *daddr, 673 __be32 spi, u8 proto, 674 unsigned short family) 675 { 676 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); 677 struct xfrm_state *x; 678 679 hlist_for_each_entry_rcu(x, net->xfrm.state_byspi + h, byspi) { 680 if (x->props.family != family || 681 x->id.spi != spi || 682 x->id.proto != proto || 683 !xfrm_addr_equal(&x->id.daddr, daddr, family)) 684 continue; 685 686 if ((mark & x->mark.m) != x->mark.v) 687 continue; 688 if (!xfrm_state_hold_rcu(x)) 689 continue; 690 return x; 691 } 692 693 return NULL; 694 } 695 696 static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, 697 const xfrm_address_t *daddr, 698 const xfrm_address_t *saddr, 699 u8 proto, unsigned short family) 700 { 701 unsigned int h = xfrm_src_hash(net, daddr, saddr, family); 702 struct xfrm_state *x; 703 704 hlist_for_each_entry_rcu(x, net->xfrm.state_bysrc + h, bysrc) { 705 if (x->props.family != family || 706 x->id.proto != proto || 707 !xfrm_addr_equal(&x->id.daddr, daddr, family) || 708 !xfrm_addr_equal(&x->props.saddr, saddr, family)) 709 continue; 710 711 if ((mark & x->mark.m) != x->mark.v) 712 continue; 713 if (!xfrm_state_hold_rcu(x)) 714 continue; 715 return x; 716 } 717 718 return NULL; 719 } 720 721 static inline struct xfrm_state * 722 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) 723 { 724 struct net *net = xs_net(x); 725 u32 mark = x->mark.v & x->mark.m; 726 727 if (use_spi) 728 return __xfrm_state_lookup(net, mark, &x->id.daddr, 729 x->id.spi, x->id.proto, family); 730 else 731 return __xfrm_state_lookup_byaddr(net, mark, 732 &x->id.daddr, 733 &x->props.saddr, 734 x->id.proto, family); 735 } 736 737 static void xfrm_hash_grow_check(struct net *net, int have_hash_collision) 738 { 739 if (have_hash_collision && 740 (net->xfrm.state_hmask + 1) < xfrm_state_hashmax && 741 net->xfrm.state_num > net->xfrm.state_hmask) 742 schedule_work(&net->xfrm.state_hash_work); 743 } 744 745 static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, 746 const struct flowi *fl, unsigned short family, 747 struct xfrm_state **best, int *acq_in_progress, 748 int *error) 749 { 750 /* Resolution logic: 751 * 1. There is a valid state with matching selector. Done. 752 * 2. Valid state with inappropriate selector. Skip. 753 * 754 * Entering area of "sysdeps". 755 * 756 * 3. If state is not valid, selector is temporary, it selects 757 * only session which triggered previous resolution. Key 758 * manager will do something to install a state with proper 759 * selector. 760 */ 761 if (x->km.state == XFRM_STATE_VALID) { 762 if ((x->sel.family && 763 !xfrm_selector_match(&x->sel, fl, x->sel.family)) || 764 !security_xfrm_state_pol_flow_match(x, pol, fl)) 765 return; 766 767 if (!*best || 768 (*best)->km.dying > x->km.dying || 769 ((*best)->km.dying == x->km.dying && 770 (*best)->curlft.add_time < x->curlft.add_time)) 771 *best = x; 772 } else if (x->km.state == XFRM_STATE_ACQ) { 773 *acq_in_progress = 1; 774 } else if (x->km.state == XFRM_STATE_ERROR || 775 x->km.state == XFRM_STATE_EXPIRED) { 776 if (xfrm_selector_match(&x->sel, fl, x->sel.family) && 777 security_xfrm_state_pol_flow_match(x, pol, fl)) 778 *error = -ESRCH; 779 } 780 } 781 782 struct xfrm_state * 783 xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, 784 const struct flowi *fl, struct xfrm_tmpl *tmpl, 785 struct xfrm_policy *pol, int *err, 786 unsigned short family) 787 { 788 static xfrm_address_t saddr_wildcard = { }; 789 struct net *net = xp_net(pol); 790 unsigned int h, h_wildcard; 791 struct xfrm_state *x, *x0, *to_put; 792 int acquire_in_progress = 0; 793 int error = 0; 794 struct xfrm_state *best = NULL; 795 u32 mark = pol->mark.v & pol->mark.m; 796 unsigned short encap_family = tmpl->encap_family; 797 unsigned int sequence; 798 struct km_event c; 799 800 to_put = NULL; 801 802 sequence = read_seqcount_begin(&xfrm_state_hash_generation); 803 804 rcu_read_lock(); 805 h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); 806 hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { 807 if (x->props.family == encap_family && 808 x->props.reqid == tmpl->reqid && 809 (mark & x->mark.m) == x->mark.v && 810 !(x->props.flags & XFRM_STATE_WILDRECV) && 811 xfrm_state_addr_check(x, daddr, saddr, encap_family) && 812 tmpl->mode == x->props.mode && 813 tmpl->id.proto == x->id.proto && 814 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 815 xfrm_state_look_at(pol, x, fl, encap_family, 816 &best, &acquire_in_progress, &error); 817 } 818 if (best || acquire_in_progress) 819 goto found; 820 821 h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family); 822 hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h_wildcard, bydst) { 823 if (x->props.family == encap_family && 824 x->props.reqid == tmpl->reqid && 825 (mark & x->mark.m) == x->mark.v && 826 !(x->props.flags & XFRM_STATE_WILDRECV) && 827 xfrm_addr_equal(&x->id.daddr, daddr, encap_family) && 828 tmpl->mode == x->props.mode && 829 tmpl->id.proto == x->id.proto && 830 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 831 xfrm_state_look_at(pol, x, fl, encap_family, 832 &best, &acquire_in_progress, &error); 833 } 834 835 found: 836 x = best; 837 if (!x && !error && !acquire_in_progress) { 838 if (tmpl->id.spi && 839 (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi, 840 tmpl->id.proto, encap_family)) != NULL) { 841 to_put = x0; 842 error = -EEXIST; 843 goto out; 844 } 845 846 c.net = net; 847 /* If the KMs have no listeners (yet...), avoid allocating an SA 848 * for each and every packet - garbage collection might not 849 * handle the flood. 850 */ 851 if (!km_is_alive(&c)) { 852 error = -ESRCH; 853 goto out; 854 } 855 856 x = xfrm_state_alloc(net); 857 if (x == NULL) { 858 error = -ENOMEM; 859 goto out; 860 } 861 /* Initialize temporary state matching only 862 * to current session. */ 863 xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family); 864 memcpy(&x->mark, &pol->mark, sizeof(x->mark)); 865 866 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid); 867 if (error) { 868 x->km.state = XFRM_STATE_DEAD; 869 to_put = x; 870 x = NULL; 871 goto out; 872 } 873 874 if (km_query(x, tmpl, pol) == 0) { 875 spin_lock_bh(&net->xfrm.xfrm_state_lock); 876 x->km.state = XFRM_STATE_ACQ; 877 list_add(&x->km.all, &net->xfrm.state_all); 878 hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h); 879 h = xfrm_src_hash(net, daddr, saddr, encap_family); 880 hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h); 881 if (x->id.spi) { 882 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family); 883 hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h); 884 } 885 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; 886 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL); 887 net->xfrm.state_num++; 888 xfrm_hash_grow_check(net, x->bydst.next != NULL); 889 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 890 } else { 891 x->km.state = XFRM_STATE_DEAD; 892 to_put = x; 893 x = NULL; 894 error = -ESRCH; 895 } 896 } 897 out: 898 if (x) { 899 if (!xfrm_state_hold_rcu(x)) { 900 *err = -EAGAIN; 901 x = NULL; 902 } 903 } else { 904 *err = acquire_in_progress ? -EAGAIN : error; 905 } 906 rcu_read_unlock(); 907 if (to_put) 908 xfrm_state_put(to_put); 909 910 if (read_seqcount_retry(&xfrm_state_hash_generation, sequence)) { 911 *err = -EAGAIN; 912 if (x) { 913 xfrm_state_put(x); 914 x = NULL; 915 } 916 } 917 918 return x; 919 } 920 921 struct xfrm_state * 922 xfrm_stateonly_find(struct net *net, u32 mark, 923 xfrm_address_t *daddr, xfrm_address_t *saddr, 924 unsigned short family, u8 mode, u8 proto, u32 reqid) 925 { 926 unsigned int h; 927 struct xfrm_state *rx = NULL, *x = NULL; 928 929 spin_lock_bh(&net->xfrm.xfrm_state_lock); 930 h = xfrm_dst_hash(net, daddr, saddr, reqid, family); 931 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 932 if (x->props.family == family && 933 x->props.reqid == reqid && 934 (mark & x->mark.m) == x->mark.v && 935 !(x->props.flags & XFRM_STATE_WILDRECV) && 936 xfrm_state_addr_check(x, daddr, saddr, family) && 937 mode == x->props.mode && 938 proto == x->id.proto && 939 x->km.state == XFRM_STATE_VALID) { 940 rx = x; 941 break; 942 } 943 } 944 945 if (rx) 946 xfrm_state_hold(rx); 947 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 948 949 950 return rx; 951 } 952 EXPORT_SYMBOL(xfrm_stateonly_find); 953 954 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 955 unsigned short family) 956 { 957 struct xfrm_state *x; 958 struct xfrm_state_walk *w; 959 960 spin_lock_bh(&net->xfrm.xfrm_state_lock); 961 list_for_each_entry(w, &net->xfrm.state_all, all) { 962 x = container_of(w, struct xfrm_state, km); 963 if (x->props.family != family || 964 x->id.spi != spi) 965 continue; 966 967 xfrm_state_hold(x); 968 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 969 return x; 970 } 971 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 972 return NULL; 973 } 974 EXPORT_SYMBOL(xfrm_state_lookup_byspi); 975 976 static void __xfrm_state_insert(struct xfrm_state *x) 977 { 978 struct net *net = xs_net(x); 979 unsigned int h; 980 981 list_add(&x->km.all, &net->xfrm.state_all); 982 983 h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr, 984 x->props.reqid, x->props.family); 985 hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h); 986 987 h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family); 988 hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h); 989 990 if (x->id.spi) { 991 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, 992 x->props.family); 993 994 hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h); 995 } 996 997 tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL); 998 if (x->replay_maxage) 999 mod_timer(&x->rtimer, jiffies + x->replay_maxage); 1000 1001 net->xfrm.state_num++; 1002 1003 xfrm_hash_grow_check(net, x->bydst.next != NULL); 1004 } 1005 1006 /* net->xfrm.xfrm_state_lock is held */ 1007 static void __xfrm_state_bump_genids(struct xfrm_state *xnew) 1008 { 1009 struct net *net = xs_net(xnew); 1010 unsigned short family = xnew->props.family; 1011 u32 reqid = xnew->props.reqid; 1012 struct xfrm_state *x; 1013 unsigned int h; 1014 u32 mark = xnew->mark.v & xnew->mark.m; 1015 1016 h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family); 1017 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 1018 if (x->props.family == family && 1019 x->props.reqid == reqid && 1020 (mark & x->mark.m) == x->mark.v && 1021 xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) && 1022 xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family)) 1023 x->genid++; 1024 } 1025 } 1026 1027 void xfrm_state_insert(struct xfrm_state *x) 1028 { 1029 struct net *net = xs_net(x); 1030 1031 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1032 __xfrm_state_bump_genids(x); 1033 __xfrm_state_insert(x); 1034 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1035 } 1036 EXPORT_SYMBOL(xfrm_state_insert); 1037 1038 /* net->xfrm.xfrm_state_lock is held */ 1039 static struct xfrm_state *__find_acq_core(struct net *net, 1040 const struct xfrm_mark *m, 1041 unsigned short family, u8 mode, 1042 u32 reqid, u8 proto, 1043 const xfrm_address_t *daddr, 1044 const xfrm_address_t *saddr, 1045 int create) 1046 { 1047 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family); 1048 struct xfrm_state *x; 1049 u32 mark = m->v & m->m; 1050 1051 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 1052 if (x->props.reqid != reqid || 1053 x->props.mode != mode || 1054 x->props.family != family || 1055 x->km.state != XFRM_STATE_ACQ || 1056 x->id.spi != 0 || 1057 x->id.proto != proto || 1058 (mark & x->mark.m) != x->mark.v || 1059 !xfrm_addr_equal(&x->id.daddr, daddr, family) || 1060 !xfrm_addr_equal(&x->props.saddr, saddr, family)) 1061 continue; 1062 1063 xfrm_state_hold(x); 1064 return x; 1065 } 1066 1067 if (!create) 1068 return NULL; 1069 1070 x = xfrm_state_alloc(net); 1071 if (likely(x)) { 1072 switch (family) { 1073 case AF_INET: 1074 x->sel.daddr.a4 = daddr->a4; 1075 x->sel.saddr.a4 = saddr->a4; 1076 x->sel.prefixlen_d = 32; 1077 x->sel.prefixlen_s = 32; 1078 x->props.saddr.a4 = saddr->a4; 1079 x->id.daddr.a4 = daddr->a4; 1080 break; 1081 1082 case AF_INET6: 1083 x->sel.daddr.in6 = daddr->in6; 1084 x->sel.saddr.in6 = saddr->in6; 1085 x->sel.prefixlen_d = 128; 1086 x->sel.prefixlen_s = 128; 1087 x->props.saddr.in6 = saddr->in6; 1088 x->id.daddr.in6 = daddr->in6; 1089 break; 1090 } 1091 1092 x->km.state = XFRM_STATE_ACQ; 1093 x->id.proto = proto; 1094 x->props.family = family; 1095 x->props.mode = mode; 1096 x->props.reqid = reqid; 1097 x->mark.v = m->v; 1098 x->mark.m = m->m; 1099 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; 1100 xfrm_state_hold(x); 1101 tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL); 1102 list_add(&x->km.all, &net->xfrm.state_all); 1103 hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h); 1104 h = xfrm_src_hash(net, daddr, saddr, family); 1105 hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h); 1106 1107 net->xfrm.state_num++; 1108 1109 xfrm_hash_grow_check(net, x->bydst.next != NULL); 1110 } 1111 1112 return x; 1113 } 1114 1115 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1116 1117 int xfrm_state_add(struct xfrm_state *x) 1118 { 1119 struct net *net = xs_net(x); 1120 struct xfrm_state *x1, *to_put; 1121 int family; 1122 int err; 1123 u32 mark = x->mark.v & x->mark.m; 1124 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1125 1126 family = x->props.family; 1127 1128 to_put = NULL; 1129 1130 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1131 1132 x1 = __xfrm_state_locate(x, use_spi, family); 1133 if (x1) { 1134 to_put = x1; 1135 x1 = NULL; 1136 err = -EEXIST; 1137 goto out; 1138 } 1139 1140 if (use_spi && x->km.seq) { 1141 x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq); 1142 if (x1 && ((x1->id.proto != x->id.proto) || 1143 !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) { 1144 to_put = x1; 1145 x1 = NULL; 1146 } 1147 } 1148 1149 if (use_spi && !x1) 1150 x1 = __find_acq_core(net, &x->mark, family, x->props.mode, 1151 x->props.reqid, x->id.proto, 1152 &x->id.daddr, &x->props.saddr, 0); 1153 1154 __xfrm_state_bump_genids(x); 1155 __xfrm_state_insert(x); 1156 err = 0; 1157 1158 out: 1159 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1160 1161 if (x1) { 1162 xfrm_state_delete(x1); 1163 xfrm_state_put(x1); 1164 } 1165 1166 if (to_put) 1167 xfrm_state_put(to_put); 1168 1169 return err; 1170 } 1171 EXPORT_SYMBOL(xfrm_state_add); 1172 1173 #ifdef CONFIG_XFRM_MIGRATE 1174 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig) 1175 { 1176 struct net *net = xs_net(orig); 1177 struct xfrm_state *x = xfrm_state_alloc(net); 1178 if (!x) 1179 goto out; 1180 1181 memcpy(&x->id, &orig->id, sizeof(x->id)); 1182 memcpy(&x->sel, &orig->sel, sizeof(x->sel)); 1183 memcpy(&x->lft, &orig->lft, sizeof(x->lft)); 1184 x->props.mode = orig->props.mode; 1185 x->props.replay_window = orig->props.replay_window; 1186 x->props.reqid = orig->props.reqid; 1187 x->props.family = orig->props.family; 1188 x->props.saddr = orig->props.saddr; 1189 1190 if (orig->aalg) { 1191 x->aalg = xfrm_algo_auth_clone(orig->aalg); 1192 if (!x->aalg) 1193 goto error; 1194 } 1195 x->props.aalgo = orig->props.aalgo; 1196 1197 if (orig->aead) { 1198 x->aead = xfrm_algo_aead_clone(orig->aead); 1199 if (!x->aead) 1200 goto error; 1201 } 1202 if (orig->ealg) { 1203 x->ealg = xfrm_algo_clone(orig->ealg); 1204 if (!x->ealg) 1205 goto error; 1206 } 1207 x->props.ealgo = orig->props.ealgo; 1208 1209 if (orig->calg) { 1210 x->calg = xfrm_algo_clone(orig->calg); 1211 if (!x->calg) 1212 goto error; 1213 } 1214 x->props.calgo = orig->props.calgo; 1215 1216 if (orig->encap) { 1217 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL); 1218 if (!x->encap) 1219 goto error; 1220 } 1221 1222 if (orig->coaddr) { 1223 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr), 1224 GFP_KERNEL); 1225 if (!x->coaddr) 1226 goto error; 1227 } 1228 1229 if (orig->replay_esn) { 1230 if (xfrm_replay_clone(x, orig)) 1231 goto error; 1232 } 1233 1234 memcpy(&x->mark, &orig->mark, sizeof(x->mark)); 1235 1236 if (xfrm_init_state(x) < 0) 1237 goto error; 1238 1239 x->props.flags = orig->props.flags; 1240 x->props.extra_flags = orig->props.extra_flags; 1241 1242 x->tfcpad = orig->tfcpad; 1243 x->replay_maxdiff = orig->replay_maxdiff; 1244 x->replay_maxage = orig->replay_maxage; 1245 x->curlft.add_time = orig->curlft.add_time; 1246 x->km.state = orig->km.state; 1247 x->km.seq = orig->km.seq; 1248 1249 return x; 1250 1251 error: 1252 xfrm_state_put(x); 1253 out: 1254 return NULL; 1255 } 1256 1257 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net) 1258 { 1259 unsigned int h; 1260 struct xfrm_state *x = NULL; 1261 1262 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1263 1264 if (m->reqid) { 1265 h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr, 1266 m->reqid, m->old_family); 1267 hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { 1268 if (x->props.mode != m->mode || 1269 x->id.proto != m->proto) 1270 continue; 1271 if (m->reqid && x->props.reqid != m->reqid) 1272 continue; 1273 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, 1274 m->old_family) || 1275 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, 1276 m->old_family)) 1277 continue; 1278 xfrm_state_hold(x); 1279 break; 1280 } 1281 } else { 1282 h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr, 1283 m->old_family); 1284 hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) { 1285 if (x->props.mode != m->mode || 1286 x->id.proto != m->proto) 1287 continue; 1288 if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, 1289 m->old_family) || 1290 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, 1291 m->old_family)) 1292 continue; 1293 xfrm_state_hold(x); 1294 break; 1295 } 1296 } 1297 1298 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1299 1300 return x; 1301 } 1302 EXPORT_SYMBOL(xfrm_migrate_state_find); 1303 1304 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 1305 struct xfrm_migrate *m) 1306 { 1307 struct xfrm_state *xc; 1308 1309 xc = xfrm_state_clone(x); 1310 if (!xc) 1311 return NULL; 1312 1313 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); 1314 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); 1315 1316 /* add state */ 1317 if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) { 1318 /* a care is needed when the destination address of the 1319 state is to be updated as it is a part of triplet */ 1320 xfrm_state_insert(xc); 1321 } else { 1322 if (xfrm_state_add(xc) < 0) 1323 goto error; 1324 } 1325 1326 return xc; 1327 error: 1328 xfrm_state_put(xc); 1329 return NULL; 1330 } 1331 EXPORT_SYMBOL(xfrm_state_migrate); 1332 #endif 1333 1334 int xfrm_state_update(struct xfrm_state *x) 1335 { 1336 struct xfrm_state *x1, *to_put; 1337 int err; 1338 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); 1339 struct net *net = xs_net(x); 1340 1341 to_put = NULL; 1342 1343 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1344 x1 = __xfrm_state_locate(x, use_spi, x->props.family); 1345 1346 err = -ESRCH; 1347 if (!x1) 1348 goto out; 1349 1350 if (xfrm_state_kern(x1)) { 1351 to_put = x1; 1352 err = -EEXIST; 1353 goto out; 1354 } 1355 1356 if (x1->km.state == XFRM_STATE_ACQ) { 1357 __xfrm_state_insert(x); 1358 x = NULL; 1359 } 1360 err = 0; 1361 1362 out: 1363 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1364 1365 if (to_put) 1366 xfrm_state_put(to_put); 1367 1368 if (err) 1369 return err; 1370 1371 if (!x) { 1372 xfrm_state_delete(x1); 1373 xfrm_state_put(x1); 1374 return 0; 1375 } 1376 1377 err = -EINVAL; 1378 spin_lock_bh(&x1->lock); 1379 if (likely(x1->km.state == XFRM_STATE_VALID)) { 1380 if (x->encap && x1->encap) 1381 memcpy(x1->encap, x->encap, sizeof(*x1->encap)); 1382 if (x->coaddr && x1->coaddr) { 1383 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr)); 1384 } 1385 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel))) 1386 memcpy(&x1->sel, &x->sel, sizeof(x1->sel)); 1387 memcpy(&x1->lft, &x->lft, sizeof(x1->lft)); 1388 x1->km.dying = 0; 1389 1390 tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL); 1391 if (x1->curlft.use_time) 1392 xfrm_state_check_expire(x1); 1393 1394 err = 0; 1395 x->km.state = XFRM_STATE_DEAD; 1396 __xfrm_state_put(x); 1397 } 1398 spin_unlock_bh(&x1->lock); 1399 1400 xfrm_state_put(x1); 1401 1402 return err; 1403 } 1404 EXPORT_SYMBOL(xfrm_state_update); 1405 1406 int xfrm_state_check_expire(struct xfrm_state *x) 1407 { 1408 if (!x->curlft.use_time) 1409 x->curlft.use_time = get_seconds(); 1410 1411 if (x->curlft.bytes >= x->lft.hard_byte_limit || 1412 x->curlft.packets >= x->lft.hard_packet_limit) { 1413 x->km.state = XFRM_STATE_EXPIRED; 1414 tasklet_hrtimer_start(&x->mtimer, ktime_set(0, 0), HRTIMER_MODE_REL); 1415 return -EINVAL; 1416 } 1417 1418 if (!x->km.dying && 1419 (x->curlft.bytes >= x->lft.soft_byte_limit || 1420 x->curlft.packets >= x->lft.soft_packet_limit)) { 1421 x->km.dying = 1; 1422 km_state_expired(x, 0, 0); 1423 } 1424 return 0; 1425 } 1426 EXPORT_SYMBOL(xfrm_state_check_expire); 1427 1428 struct xfrm_state * 1429 xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi, 1430 u8 proto, unsigned short family) 1431 { 1432 struct xfrm_state *x; 1433 1434 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1435 x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family); 1436 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1437 return x; 1438 } 1439 EXPORT_SYMBOL(xfrm_state_lookup); 1440 1441 struct xfrm_state * 1442 xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1443 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 1444 u8 proto, unsigned short family) 1445 { 1446 struct xfrm_state *x; 1447 1448 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1449 x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family); 1450 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1451 return x; 1452 } 1453 EXPORT_SYMBOL(xfrm_state_lookup_byaddr); 1454 1455 struct xfrm_state * 1456 xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid, 1457 u8 proto, const xfrm_address_t *daddr, 1458 const xfrm_address_t *saddr, int create, unsigned short family) 1459 { 1460 struct xfrm_state *x; 1461 1462 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1463 x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create); 1464 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1465 1466 return x; 1467 } 1468 EXPORT_SYMBOL(xfrm_find_acq); 1469 1470 #ifdef CONFIG_XFRM_SUB_POLICY 1471 int 1472 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1473 unsigned short family, struct net *net) 1474 { 1475 int err = 0; 1476 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1477 if (!afinfo) 1478 return -EAFNOSUPPORT; 1479 1480 spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/ 1481 if (afinfo->tmpl_sort) 1482 err = afinfo->tmpl_sort(dst, src, n); 1483 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1484 xfrm_state_put_afinfo(afinfo); 1485 return err; 1486 } 1487 EXPORT_SYMBOL(xfrm_tmpl_sort); 1488 1489 int 1490 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1491 unsigned short family) 1492 { 1493 int err = 0; 1494 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1495 struct net *net = xs_net(*src); 1496 1497 if (!afinfo) 1498 return -EAFNOSUPPORT; 1499 1500 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1501 if (afinfo->state_sort) 1502 err = afinfo->state_sort(dst, src, n); 1503 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1504 xfrm_state_put_afinfo(afinfo); 1505 return err; 1506 } 1507 EXPORT_SYMBOL(xfrm_state_sort); 1508 #endif 1509 1510 /* Silly enough, but I'm lazy to build resolution list */ 1511 1512 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) 1513 { 1514 int i; 1515 1516 for (i = 0; i <= net->xfrm.state_hmask; i++) { 1517 struct xfrm_state *x; 1518 1519 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { 1520 if (x->km.seq == seq && 1521 (mark & x->mark.m) == x->mark.v && 1522 x->km.state == XFRM_STATE_ACQ) { 1523 xfrm_state_hold(x); 1524 return x; 1525 } 1526 } 1527 } 1528 return NULL; 1529 } 1530 1531 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) 1532 { 1533 struct xfrm_state *x; 1534 1535 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1536 x = __xfrm_find_acq_byseq(net, mark, seq); 1537 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1538 return x; 1539 } 1540 EXPORT_SYMBOL(xfrm_find_acq_byseq); 1541 1542 u32 xfrm_get_acqseq(void) 1543 { 1544 u32 res; 1545 static atomic_t acqseq; 1546 1547 do { 1548 res = atomic_inc_return(&acqseq); 1549 } while (!res); 1550 1551 return res; 1552 } 1553 EXPORT_SYMBOL(xfrm_get_acqseq); 1554 1555 int verify_spi_info(u8 proto, u32 min, u32 max) 1556 { 1557 switch (proto) { 1558 case IPPROTO_AH: 1559 case IPPROTO_ESP: 1560 break; 1561 1562 case IPPROTO_COMP: 1563 /* IPCOMP spi is 16-bits. */ 1564 if (max >= 0x10000) 1565 return -EINVAL; 1566 break; 1567 1568 default: 1569 return -EINVAL; 1570 } 1571 1572 if (min > max) 1573 return -EINVAL; 1574 1575 return 0; 1576 } 1577 EXPORT_SYMBOL(verify_spi_info); 1578 1579 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high) 1580 { 1581 struct net *net = xs_net(x); 1582 unsigned int h; 1583 struct xfrm_state *x0; 1584 int err = -ENOENT; 1585 __be32 minspi = htonl(low); 1586 __be32 maxspi = htonl(high); 1587 u32 mark = x->mark.v & x->mark.m; 1588 1589 spin_lock_bh(&x->lock); 1590 if (x->km.state == XFRM_STATE_DEAD) 1591 goto unlock; 1592 1593 err = 0; 1594 if (x->id.spi) 1595 goto unlock; 1596 1597 err = -ENOENT; 1598 1599 if (minspi == maxspi) { 1600 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family); 1601 if (x0) { 1602 xfrm_state_put(x0); 1603 goto unlock; 1604 } 1605 x->id.spi = minspi; 1606 } else { 1607 u32 spi = 0; 1608 for (h = 0; h < high-low+1; h++) { 1609 spi = low + prandom_u32()%(high-low+1); 1610 x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family); 1611 if (x0 == NULL) { 1612 x->id.spi = htonl(spi); 1613 break; 1614 } 1615 xfrm_state_put(x0); 1616 } 1617 } 1618 if (x->id.spi) { 1619 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1620 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family); 1621 hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h); 1622 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1623 1624 err = 0; 1625 } 1626 1627 unlock: 1628 spin_unlock_bh(&x->lock); 1629 1630 return err; 1631 } 1632 EXPORT_SYMBOL(xfrm_alloc_spi); 1633 1634 static bool __xfrm_state_filter_match(struct xfrm_state *x, 1635 struct xfrm_address_filter *filter) 1636 { 1637 if (filter) { 1638 if ((filter->family == AF_INET || 1639 filter->family == AF_INET6) && 1640 x->props.family != filter->family) 1641 return false; 1642 1643 return addr_match(&x->props.saddr, &filter->saddr, 1644 filter->splen) && 1645 addr_match(&x->id.daddr, &filter->daddr, 1646 filter->dplen); 1647 } 1648 return true; 1649 } 1650 1651 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 1652 int (*func)(struct xfrm_state *, int, void*), 1653 void *data) 1654 { 1655 struct xfrm_state *state; 1656 struct xfrm_state_walk *x; 1657 int err = 0; 1658 1659 if (walk->seq != 0 && list_empty(&walk->all)) 1660 return 0; 1661 1662 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1663 if (list_empty(&walk->all)) 1664 x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all); 1665 else 1666 x = list_first_entry(&walk->all, struct xfrm_state_walk, all); 1667 list_for_each_entry_from(x, &net->xfrm.state_all, all) { 1668 if (x->state == XFRM_STATE_DEAD) 1669 continue; 1670 state = container_of(x, struct xfrm_state, km); 1671 if (!xfrm_id_proto_match(state->id.proto, walk->proto)) 1672 continue; 1673 if (!__xfrm_state_filter_match(state, walk->filter)) 1674 continue; 1675 err = func(state, walk->seq, data); 1676 if (err) { 1677 list_move_tail(&walk->all, &x->all); 1678 goto out; 1679 } 1680 walk->seq++; 1681 } 1682 if (walk->seq == 0) { 1683 err = -ENOENT; 1684 goto out; 1685 } 1686 list_del_init(&walk->all); 1687 out: 1688 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1689 return err; 1690 } 1691 EXPORT_SYMBOL(xfrm_state_walk); 1692 1693 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1694 struct xfrm_address_filter *filter) 1695 { 1696 INIT_LIST_HEAD(&walk->all); 1697 walk->proto = proto; 1698 walk->state = XFRM_STATE_DEAD; 1699 walk->seq = 0; 1700 walk->filter = filter; 1701 } 1702 EXPORT_SYMBOL(xfrm_state_walk_init); 1703 1704 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net) 1705 { 1706 kfree(walk->filter); 1707 1708 if (list_empty(&walk->all)) 1709 return; 1710 1711 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1712 list_del(&walk->all); 1713 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1714 } 1715 EXPORT_SYMBOL(xfrm_state_walk_done); 1716 1717 static void xfrm_replay_timer_handler(unsigned long data) 1718 { 1719 struct xfrm_state *x = (struct xfrm_state *)data; 1720 1721 spin_lock(&x->lock); 1722 1723 if (x->km.state == XFRM_STATE_VALID) { 1724 if (xfrm_aevent_is_on(xs_net(x))) 1725 x->repl->notify(x, XFRM_REPLAY_TIMEOUT); 1726 else 1727 x->xflags |= XFRM_TIME_DEFER; 1728 } 1729 1730 spin_unlock(&x->lock); 1731 } 1732 1733 static LIST_HEAD(xfrm_km_list); 1734 1735 void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 1736 { 1737 struct xfrm_mgr *km; 1738 1739 rcu_read_lock(); 1740 list_for_each_entry_rcu(km, &xfrm_km_list, list) 1741 if (km->notify_policy) 1742 km->notify_policy(xp, dir, c); 1743 rcu_read_unlock(); 1744 } 1745 1746 void km_state_notify(struct xfrm_state *x, const struct km_event *c) 1747 { 1748 struct xfrm_mgr *km; 1749 rcu_read_lock(); 1750 list_for_each_entry_rcu(km, &xfrm_km_list, list) 1751 if (km->notify) 1752 km->notify(x, c); 1753 rcu_read_unlock(); 1754 } 1755 1756 EXPORT_SYMBOL(km_policy_notify); 1757 EXPORT_SYMBOL(km_state_notify); 1758 1759 void km_state_expired(struct xfrm_state *x, int hard, u32 portid) 1760 { 1761 struct km_event c; 1762 1763 c.data.hard = hard; 1764 c.portid = portid; 1765 c.event = XFRM_MSG_EXPIRE; 1766 km_state_notify(x, &c); 1767 } 1768 1769 EXPORT_SYMBOL(km_state_expired); 1770 /* 1771 * We send to all registered managers regardless of failure 1772 * We are happy with one success 1773 */ 1774 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol) 1775 { 1776 int err = -EINVAL, acqret; 1777 struct xfrm_mgr *km; 1778 1779 rcu_read_lock(); 1780 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1781 acqret = km->acquire(x, t, pol); 1782 if (!acqret) 1783 err = acqret; 1784 } 1785 rcu_read_unlock(); 1786 return err; 1787 } 1788 EXPORT_SYMBOL(km_query); 1789 1790 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 1791 { 1792 int err = -EINVAL; 1793 struct xfrm_mgr *km; 1794 1795 rcu_read_lock(); 1796 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1797 if (km->new_mapping) 1798 err = km->new_mapping(x, ipaddr, sport); 1799 if (!err) 1800 break; 1801 } 1802 rcu_read_unlock(); 1803 return err; 1804 } 1805 EXPORT_SYMBOL(km_new_mapping); 1806 1807 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid) 1808 { 1809 struct km_event c; 1810 1811 c.data.hard = hard; 1812 c.portid = portid; 1813 c.event = XFRM_MSG_POLEXPIRE; 1814 km_policy_notify(pol, dir, &c); 1815 } 1816 EXPORT_SYMBOL(km_policy_expired); 1817 1818 #ifdef CONFIG_XFRM_MIGRATE 1819 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1820 const struct xfrm_migrate *m, int num_migrate, 1821 const struct xfrm_kmaddress *k) 1822 { 1823 int err = -EINVAL; 1824 int ret; 1825 struct xfrm_mgr *km; 1826 1827 rcu_read_lock(); 1828 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1829 if (km->migrate) { 1830 ret = km->migrate(sel, dir, type, m, num_migrate, k); 1831 if (!ret) 1832 err = ret; 1833 } 1834 } 1835 rcu_read_unlock(); 1836 return err; 1837 } 1838 EXPORT_SYMBOL(km_migrate); 1839 #endif 1840 1841 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr) 1842 { 1843 int err = -EINVAL; 1844 int ret; 1845 struct xfrm_mgr *km; 1846 1847 rcu_read_lock(); 1848 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1849 if (km->report) { 1850 ret = km->report(net, proto, sel, addr); 1851 if (!ret) 1852 err = ret; 1853 } 1854 } 1855 rcu_read_unlock(); 1856 return err; 1857 } 1858 EXPORT_SYMBOL(km_report); 1859 1860 bool km_is_alive(const struct km_event *c) 1861 { 1862 struct xfrm_mgr *km; 1863 bool is_alive = false; 1864 1865 rcu_read_lock(); 1866 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1867 if (km->is_alive && km->is_alive(c)) { 1868 is_alive = true; 1869 break; 1870 } 1871 } 1872 rcu_read_unlock(); 1873 1874 return is_alive; 1875 } 1876 EXPORT_SYMBOL(km_is_alive); 1877 1878 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 1879 { 1880 int err; 1881 u8 *data; 1882 struct xfrm_mgr *km; 1883 struct xfrm_policy *pol = NULL; 1884 1885 if (optlen <= 0 || optlen > PAGE_SIZE) 1886 return -EMSGSIZE; 1887 1888 data = kmalloc(optlen, GFP_KERNEL); 1889 if (!data) 1890 return -ENOMEM; 1891 1892 err = -EFAULT; 1893 if (copy_from_user(data, optval, optlen)) 1894 goto out; 1895 1896 err = -EINVAL; 1897 rcu_read_lock(); 1898 list_for_each_entry_rcu(km, &xfrm_km_list, list) { 1899 pol = km->compile_policy(sk, optname, data, 1900 optlen, &err); 1901 if (err >= 0) 1902 break; 1903 } 1904 rcu_read_unlock(); 1905 1906 if (err >= 0) { 1907 xfrm_sk_policy_insert(sk, err, pol); 1908 xfrm_pol_put(pol); 1909 err = 0; 1910 } 1911 1912 out: 1913 kfree(data); 1914 return err; 1915 } 1916 EXPORT_SYMBOL(xfrm_user_policy); 1917 1918 static DEFINE_SPINLOCK(xfrm_km_lock); 1919 1920 int xfrm_register_km(struct xfrm_mgr *km) 1921 { 1922 spin_lock_bh(&xfrm_km_lock); 1923 list_add_tail_rcu(&km->list, &xfrm_km_list); 1924 spin_unlock_bh(&xfrm_km_lock); 1925 return 0; 1926 } 1927 EXPORT_SYMBOL(xfrm_register_km); 1928 1929 int xfrm_unregister_km(struct xfrm_mgr *km) 1930 { 1931 spin_lock_bh(&xfrm_km_lock); 1932 list_del_rcu(&km->list); 1933 spin_unlock_bh(&xfrm_km_lock); 1934 synchronize_rcu(); 1935 return 0; 1936 } 1937 EXPORT_SYMBOL(xfrm_unregister_km); 1938 1939 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo) 1940 { 1941 int err = 0; 1942 if (unlikely(afinfo == NULL)) 1943 return -EINVAL; 1944 if (unlikely(afinfo->family >= NPROTO)) 1945 return -EAFNOSUPPORT; 1946 spin_lock_bh(&xfrm_state_afinfo_lock); 1947 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL)) 1948 err = -EEXIST; 1949 else 1950 rcu_assign_pointer(xfrm_state_afinfo[afinfo->family], afinfo); 1951 spin_unlock_bh(&xfrm_state_afinfo_lock); 1952 return err; 1953 } 1954 EXPORT_SYMBOL(xfrm_state_register_afinfo); 1955 1956 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo) 1957 { 1958 int err = 0; 1959 if (unlikely(afinfo == NULL)) 1960 return -EINVAL; 1961 if (unlikely(afinfo->family >= NPROTO)) 1962 return -EAFNOSUPPORT; 1963 spin_lock_bh(&xfrm_state_afinfo_lock); 1964 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) { 1965 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo)) 1966 err = -EINVAL; 1967 else 1968 RCU_INIT_POINTER(xfrm_state_afinfo[afinfo->family], NULL); 1969 } 1970 spin_unlock_bh(&xfrm_state_afinfo_lock); 1971 synchronize_rcu(); 1972 return err; 1973 } 1974 EXPORT_SYMBOL(xfrm_state_unregister_afinfo); 1975 1976 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family) 1977 { 1978 struct xfrm_state_afinfo *afinfo; 1979 if (unlikely(family >= NPROTO)) 1980 return NULL; 1981 rcu_read_lock(); 1982 afinfo = rcu_dereference(xfrm_state_afinfo[family]); 1983 if (unlikely(!afinfo)) 1984 rcu_read_unlock(); 1985 return afinfo; 1986 } 1987 1988 void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo) 1989 { 1990 rcu_read_unlock(); 1991 } 1992 1993 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ 1994 void xfrm_state_delete_tunnel(struct xfrm_state *x) 1995 { 1996 if (x->tunnel) { 1997 struct xfrm_state *t = x->tunnel; 1998 1999 if (atomic_read(&t->tunnel_users) == 2) 2000 xfrm_state_delete(t); 2001 atomic_dec(&t->tunnel_users); 2002 xfrm_state_put(t); 2003 x->tunnel = NULL; 2004 } 2005 } 2006 EXPORT_SYMBOL(xfrm_state_delete_tunnel); 2007 2008 int xfrm_state_mtu(struct xfrm_state *x, int mtu) 2009 { 2010 int res; 2011 2012 spin_lock_bh(&x->lock); 2013 if (x->km.state == XFRM_STATE_VALID && 2014 x->type && x->type->get_mtu) 2015 res = x->type->get_mtu(x, mtu); 2016 else 2017 res = mtu - x->props.header_len; 2018 spin_unlock_bh(&x->lock); 2019 return res; 2020 } 2021 2022 int __xfrm_init_state(struct xfrm_state *x, bool init_replay) 2023 { 2024 struct xfrm_state_afinfo *afinfo; 2025 struct xfrm_mode *inner_mode; 2026 int family = x->props.family; 2027 int err; 2028 2029 err = -EAFNOSUPPORT; 2030 afinfo = xfrm_state_get_afinfo(family); 2031 if (!afinfo) 2032 goto error; 2033 2034 err = 0; 2035 if (afinfo->init_flags) 2036 err = afinfo->init_flags(x); 2037 2038 xfrm_state_put_afinfo(afinfo); 2039 2040 if (err) 2041 goto error; 2042 2043 err = -EPROTONOSUPPORT; 2044 2045 if (x->sel.family != AF_UNSPEC) { 2046 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family); 2047 if (inner_mode == NULL) 2048 goto error; 2049 2050 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) && 2051 family != x->sel.family) { 2052 xfrm_put_mode(inner_mode); 2053 goto error; 2054 } 2055 2056 x->inner_mode = inner_mode; 2057 } else { 2058 struct xfrm_mode *inner_mode_iaf; 2059 int iafamily = AF_INET; 2060 2061 inner_mode = xfrm_get_mode(x->props.mode, x->props.family); 2062 if (inner_mode == NULL) 2063 goto error; 2064 2065 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) { 2066 xfrm_put_mode(inner_mode); 2067 goto error; 2068 } 2069 x->inner_mode = inner_mode; 2070 2071 if (x->props.family == AF_INET) 2072 iafamily = AF_INET6; 2073 2074 inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily); 2075 if (inner_mode_iaf) { 2076 if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL) 2077 x->inner_mode_iaf = inner_mode_iaf; 2078 else 2079 xfrm_put_mode(inner_mode_iaf); 2080 } 2081 } 2082 2083 x->type = xfrm_get_type(x->id.proto, family); 2084 if (x->type == NULL) 2085 goto error; 2086 2087 err = x->type->init_state(x); 2088 if (err) 2089 goto error; 2090 2091 x->outer_mode = xfrm_get_mode(x->props.mode, family); 2092 if (x->outer_mode == NULL) { 2093 err = -EPROTONOSUPPORT; 2094 goto error; 2095 } 2096 2097 if (init_replay) { 2098 err = xfrm_init_replay(x); 2099 if (err) 2100 goto error; 2101 } 2102 2103 x->km.state = XFRM_STATE_VALID; 2104 2105 error: 2106 return err; 2107 } 2108 2109 EXPORT_SYMBOL(__xfrm_init_state); 2110 2111 int xfrm_init_state(struct xfrm_state *x) 2112 { 2113 return __xfrm_init_state(x, true); 2114 } 2115 2116 EXPORT_SYMBOL(xfrm_init_state); 2117 2118 int __net_init xfrm_state_init(struct net *net) 2119 { 2120 unsigned int sz; 2121 2122 INIT_LIST_HEAD(&net->xfrm.state_all); 2123 2124 sz = sizeof(struct hlist_head) * 8; 2125 2126 net->xfrm.state_bydst = xfrm_hash_alloc(sz); 2127 if (!net->xfrm.state_bydst) 2128 goto out_bydst; 2129 net->xfrm.state_bysrc = xfrm_hash_alloc(sz); 2130 if (!net->xfrm.state_bysrc) 2131 goto out_bysrc; 2132 net->xfrm.state_byspi = xfrm_hash_alloc(sz); 2133 if (!net->xfrm.state_byspi) 2134 goto out_byspi; 2135 net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1); 2136 2137 net->xfrm.state_num = 0; 2138 INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize); 2139 spin_lock_init(&net->xfrm.xfrm_state_lock); 2140 return 0; 2141 2142 out_byspi: 2143 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2144 out_bysrc: 2145 xfrm_hash_free(net->xfrm.state_bydst, sz); 2146 out_bydst: 2147 return -ENOMEM; 2148 } 2149 2150 void xfrm_state_fini(struct net *net) 2151 { 2152 unsigned int sz; 2153 2154 flush_work(&net->xfrm.state_hash_work); 2155 xfrm_state_flush(net, IPSEC_PROTO_ANY, false); 2156 flush_work(&xfrm_state_gc_work); 2157 2158 WARN_ON(!list_empty(&net->xfrm.state_all)); 2159 2160 sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head); 2161 WARN_ON(!hlist_empty(net->xfrm.state_byspi)); 2162 xfrm_hash_free(net->xfrm.state_byspi, sz); 2163 WARN_ON(!hlist_empty(net->xfrm.state_bysrc)); 2164 xfrm_hash_free(net->xfrm.state_bysrc, sz); 2165 WARN_ON(!hlist_empty(net->xfrm.state_bydst)); 2166 xfrm_hash_free(net->xfrm.state_bydst, sz); 2167 } 2168 2169 #ifdef CONFIG_AUDITSYSCALL 2170 static void xfrm_audit_helper_sainfo(struct xfrm_state *x, 2171 struct audit_buffer *audit_buf) 2172 { 2173 struct xfrm_sec_ctx *ctx = x->security; 2174 u32 spi = ntohl(x->id.spi); 2175 2176 if (ctx) 2177 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", 2178 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str); 2179 2180 switch (x->props.family) { 2181 case AF_INET: 2182 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2183 &x->props.saddr.a4, &x->id.daddr.a4); 2184 break; 2185 case AF_INET6: 2186 audit_log_format(audit_buf, " src=%pI6 dst=%pI6", 2187 x->props.saddr.a6, x->id.daddr.a6); 2188 break; 2189 } 2190 2191 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2192 } 2193 2194 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, 2195 struct audit_buffer *audit_buf) 2196 { 2197 const struct iphdr *iph4; 2198 const struct ipv6hdr *iph6; 2199 2200 switch (family) { 2201 case AF_INET: 2202 iph4 = ip_hdr(skb); 2203 audit_log_format(audit_buf, " src=%pI4 dst=%pI4", 2204 &iph4->saddr, &iph4->daddr); 2205 break; 2206 case AF_INET6: 2207 iph6 = ipv6_hdr(skb); 2208 audit_log_format(audit_buf, 2209 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x", 2210 &iph6->saddr, &iph6->daddr, 2211 iph6->flow_lbl[0] & 0x0f, 2212 iph6->flow_lbl[1], 2213 iph6->flow_lbl[2]); 2214 break; 2215 } 2216 } 2217 2218 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid) 2219 { 2220 struct audit_buffer *audit_buf; 2221 2222 audit_buf = xfrm_audit_start("SAD-add"); 2223 if (audit_buf == NULL) 2224 return; 2225 xfrm_audit_helper_usrinfo(task_valid, audit_buf); 2226 xfrm_audit_helper_sainfo(x, audit_buf); 2227 audit_log_format(audit_buf, " res=%u", result); 2228 audit_log_end(audit_buf); 2229 } 2230 EXPORT_SYMBOL_GPL(xfrm_audit_state_add); 2231 2232 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid) 2233 { 2234 struct audit_buffer *audit_buf; 2235 2236 audit_buf = xfrm_audit_start("SAD-delete"); 2237 if (audit_buf == NULL) 2238 return; 2239 xfrm_audit_helper_usrinfo(task_valid, audit_buf); 2240 xfrm_audit_helper_sainfo(x, audit_buf); 2241 audit_log_format(audit_buf, " res=%u", result); 2242 audit_log_end(audit_buf); 2243 } 2244 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete); 2245 2246 void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 2247 struct sk_buff *skb) 2248 { 2249 struct audit_buffer *audit_buf; 2250 u32 spi; 2251 2252 audit_buf = xfrm_audit_start("SA-replay-overflow"); 2253 if (audit_buf == NULL) 2254 return; 2255 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2256 /* don't record the sequence number because it's inherent in this kind 2257 * of audit message */ 2258 spi = ntohl(x->id.spi); 2259 audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); 2260 audit_log_end(audit_buf); 2261 } 2262 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow); 2263 2264 void xfrm_audit_state_replay(struct xfrm_state *x, 2265 struct sk_buff *skb, __be32 net_seq) 2266 { 2267 struct audit_buffer *audit_buf; 2268 u32 spi; 2269 2270 audit_buf = xfrm_audit_start("SA-replayed-pkt"); 2271 if (audit_buf == NULL) 2272 return; 2273 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2274 spi = ntohl(x->id.spi); 2275 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2276 spi, spi, ntohl(net_seq)); 2277 audit_log_end(audit_buf); 2278 } 2279 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay); 2280 2281 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family) 2282 { 2283 struct audit_buffer *audit_buf; 2284 2285 audit_buf = xfrm_audit_start("SA-notfound"); 2286 if (audit_buf == NULL) 2287 return; 2288 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2289 audit_log_end(audit_buf); 2290 } 2291 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple); 2292 2293 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 2294 __be32 net_spi, __be32 net_seq) 2295 { 2296 struct audit_buffer *audit_buf; 2297 u32 spi; 2298 2299 audit_buf = xfrm_audit_start("SA-notfound"); 2300 if (audit_buf == NULL) 2301 return; 2302 xfrm_audit_helper_pktinfo(skb, family, audit_buf); 2303 spi = ntohl(net_spi); 2304 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2305 spi, spi, ntohl(net_seq)); 2306 audit_log_end(audit_buf); 2307 } 2308 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound); 2309 2310 void xfrm_audit_state_icvfail(struct xfrm_state *x, 2311 struct sk_buff *skb, u8 proto) 2312 { 2313 struct audit_buffer *audit_buf; 2314 __be32 net_spi; 2315 __be32 net_seq; 2316 2317 audit_buf = xfrm_audit_start("SA-icv-failure"); 2318 if (audit_buf == NULL) 2319 return; 2320 xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); 2321 if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) { 2322 u32 spi = ntohl(net_spi); 2323 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", 2324 spi, spi, ntohl(net_seq)); 2325 } 2326 audit_log_end(audit_buf); 2327 } 2328 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail); 2329 #endif /* CONFIG_AUDITSYSCALL */ 2330