net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <asm/uaccess.h>
  22
  23 struct sock *xfrm_nl;
  24 EXPORT_SYMBOL(xfrm_nl);
  25
  26 u32 sysctl_xfrm_aevent_etime = XFRM_AE_ETIME;
  27 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
  28
  29 u32 sysctl_xfrm_aevent_rseqth = XFRM_AE_SEQT_SIZE;
  30 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
  31
  32 /* Each xfrm_state may be linked to two tables:
  33
  34    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  35    2. Hash table by daddr to find what SAs exist for given
  36       destination/tunnel endpoint. (output)
  37  */
  38
  39 static DEFINE_SPINLOCK(xfrm_state_lock);
  40
  41 /* Hash table to find appropriate SA towards given target (endpoint
  42  * of tunnel or destination of transport mode) allowed by selector.
  43  *
  44  * Main use is finding SA after policy selected tunnel or transport mode.
  45  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  46  */
  47 static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE];
  48 static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE];
  49
  50 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
  51 EXPORT_SYMBOL(km_waitq);
  52
  53 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
  54 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
  55
  56 static struct work_struct xfrm_state_gc_work;
  57 static struct list_head xfrm_state_gc_list = LIST_HEAD_INIT(xfrm_state_gc_list);
  58 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
  59
  60 static int xfrm_state_gc_flush_bundles;
  61
  62 int __xfrm_state_delete(struct xfrm_state *x);
  63
  64 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family);
  65 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  66
  67 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
  68 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
  69
  70 static void xfrm_state_gc_destroy(struct xfrm_state *x)
  71 {
  72         if (del_timer(&x->timer))
  73                 BUG();
  74         if (del_timer(&x->rtimer))
  75                 BUG();
  76         kfree(x->aalg);
  77         kfree(x->ealg);
  78         kfree(x->calg);
  79         kfree(x->encap);
  80         if (x->type) {
  81                 x->type->destructor(x);
  82                 xfrm_put_type(x->type);
  83         }
  84         security_xfrm_state_free(x);
  85         kfree(x);
  86 }
  87
  88 static void xfrm_state_gc_task(void *data)
  89 {
  90         struct xfrm_state *x;
  91         struct list_head *entry, *tmp;
  92         struct list_head gc_list = LIST_HEAD_INIT(gc_list);
  93
  94         if (xfrm_state_gc_flush_bundles) {
  95                 xfrm_state_gc_flush_bundles = 0;
  96                 xfrm_flush_bundles();
  97         }
  98
  99         spin_lock_bh(&xfrm_state_gc_lock);
 100         list_splice_init(&xfrm_state_gc_list, &gc_list);
 101         spin_unlock_bh(&xfrm_state_gc_lock);
 102
 103         list_for_each_safe(entry, tmp, &gc_list) {
 104                 x = list_entry(entry, struct xfrm_state, bydst);
 105                 xfrm_state_gc_destroy(x);
 106         }
 107         wake_up(&km_waitq);
 108 }
 109
 110 static inline unsigned long make_jiffies(long secs)
 111 {
 112         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 113                 return MAX_SCHEDULE_TIMEOUT-1;
 114         else
 115                 return secs*HZ;
 116 }
 117
 118 static void xfrm_timer_handler(unsigned long data)
 119 {
 120         struct xfrm_state *x = (struct xfrm_state*)data;
 121         unsigned long now = (unsigned long)xtime.tv_sec;
 122         long next = LONG_MAX;
 123         int warn = 0;
 124
 125         spin_lock(&x->lock);
 126         if (x->km.state == XFRM_STATE_DEAD)
 127                 goto out;
 128         if (x->km.state == XFRM_STATE_EXPIRED)
 129                 goto expired;
 130         if (x->lft.hard_add_expires_seconds) {
 131                 long tmo = x->lft.hard_add_expires_seconds +
 132                         x->curlft.add_time - now;
 133                 if (tmo <= 0)
 134                         goto expired;
 135                 if (tmo < next)
 136                         next = tmo;
 137         }
 138         if (x->lft.hard_use_expires_seconds) {
 139                 long tmo = x->lft.hard_use_expires_seconds +
 140                         (x->curlft.use_time ? : now) - now;
 141                 if (tmo <= 0)
 142                         goto expired;
 143                 if (tmo < next)
 144                         next = tmo;
 145         }
 146         if (x->km.dying)
 147                 goto resched;
 148         if (x->lft.soft_add_expires_seconds) {
 149                 long tmo = x->lft.soft_add_expires_seconds +
 150                         x->curlft.add_time - now;
 151                 if (tmo <= 0)
 152                         warn = 1;
 153                 else if (tmo < next)
 154                         next = tmo;
 155         }
 156         if (x->lft.soft_use_expires_seconds) {
 157                 long tmo = x->lft.soft_use_expires_seconds +
 158                         (x->curlft.use_time ? : now) - now;
 159                 if (tmo <= 0)
 160                         warn = 1;
 161                 else if (tmo < next)
 162                         next = tmo;
 163         }
 164
 165         x->km.dying = warn;
 166         if (warn)
 167                 km_state_expired(x, 0, 0);
 168 resched:
 169         if (next != LONG_MAX &&
 170             !mod_timer(&x->timer, jiffies + make_jiffies(next)))
 171                 xfrm_state_hold(x);
 172         goto out;
 173
 174 expired:
 175         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 176                 x->km.state = XFRM_STATE_EXPIRED;
 177                 wake_up(&km_waitq);
 178                 next = 2;
 179                 goto resched;
 180         }
 181         if (!__xfrm_state_delete(x) && x->id.spi)
 182                 km_state_expired(x, 1, 0);
 183
 184 out:
 185         spin_unlock(&x->lock);
 186         xfrm_state_put(x);
 187 }
 188
 189 static void xfrm_replay_timer_handler(unsigned long data);
 190
 191 struct xfrm_state *xfrm_state_alloc(void)
 192 {
 193         struct xfrm_state *x;
 194
 195         x = kmalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 196
 197         if (x) {
 198                 memset(x, 0, sizeof(struct xfrm_state));
 199                 atomic_set(&x->refcnt, 1);
 200                 atomic_set(&x->tunnel_users, 0);
 201                 INIT_LIST_HEAD(&x->bydst);
 202                 INIT_LIST_HEAD(&x->byspi);
 203                 init_timer(&x->timer);
 204                 x->timer.function = xfrm_timer_handler;
 205                 x->timer.data     = (unsigned long)x;
 206                 init_timer(&x->rtimer);
 207                 x->rtimer.function = xfrm_replay_timer_handler;
 208                 x->rtimer.data     = (unsigned long)x;
 209                 x->curlft.add_time = (unsigned long)xtime.tv_sec;
 210                 x->lft.soft_byte_limit = XFRM_INF;
 211                 x->lft.soft_packet_limit = XFRM_INF;
 212                 x->lft.hard_byte_limit = XFRM_INF;
 213                 x->lft.hard_packet_limit = XFRM_INF;
 214                 x->replay_maxage = 0;
 215                 x->replay_maxdiff = 0;
 216                 spin_lock_init(&x->lock);
 217         }
 218         return x;
 219 }
 220 EXPORT_SYMBOL(xfrm_state_alloc);
 221
 222 void __xfrm_state_destroy(struct xfrm_state *x)
 223 {
 224         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 225
 226         spin_lock_bh(&xfrm_state_gc_lock);
 227         list_add(&x->bydst, &xfrm_state_gc_list);
 228         spin_unlock_bh(&xfrm_state_gc_lock);
 229         schedule_work(&xfrm_state_gc_work);
 230 }
 231 EXPORT_SYMBOL(__xfrm_state_destroy);
 232
 233 int __xfrm_state_delete(struct xfrm_state *x)
 234 {
 235         int err = -ESRCH;
 236
 237         if (x->km.state != XFRM_STATE_DEAD) {
 238                 x->km.state = XFRM_STATE_DEAD;
 239                 spin_lock(&xfrm_state_lock);
 240                 list_del(&x->bydst);
 241                 __xfrm_state_put(x);
 242                 if (x->id.spi) {
 243                         list_del(&x->byspi);
 244                         __xfrm_state_put(x);
 245                 }
 246                 spin_unlock(&xfrm_state_lock);
 247                 if (del_timer(&x->timer))
 248                         __xfrm_state_put(x);
 249                 if (del_timer(&x->rtimer))
 250                         __xfrm_state_put(x);
 251
 252                 /* The number two in this test is the reference
 253                  * mentioned in the comment below plus the reference
 254                  * our caller holds.  A larger value means that
 255                  * there are DSTs attached to this xfrm_state.
 256                  */
 257                 if (atomic_read(&x->refcnt) > 2) {
 258                         xfrm_state_gc_flush_bundles = 1;
 259                         schedule_work(&xfrm_state_gc_work);
 260                 }
 261
 262                 /* All xfrm_state objects are created by xfrm_state_alloc.
 263                  * The xfrm_state_alloc call gives a reference, and that
 264                  * is what we are dropping here.
 265                  */
 266                 __xfrm_state_put(x);
 267                 err = 0;
 268         }
 269
 270         return err;
 271 }
 272 EXPORT_SYMBOL(__xfrm_state_delete);
 273
 274 int xfrm_state_delete(struct xfrm_state *x)
 275 {
 276         int err;
 277
 278         spin_lock_bh(&x->lock);
 279         err = __xfrm_state_delete(x);
 280         spin_unlock_bh(&x->lock);
 281
 282         return err;
 283 }
 284 EXPORT_SYMBOL(xfrm_state_delete);
 285
 286 void xfrm_state_flush(u8 proto)
 287 {
 288         int i;
 289         struct xfrm_state *x;
 290
 291         spin_lock_bh(&xfrm_state_lock);
 292         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 293 restart:
 294                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 295                         if (!xfrm_state_kern(x) &&
 296                             (proto == IPSEC_PROTO_ANY || x->id.proto == proto)) {
 297                                 xfrm_state_hold(x);
 298                                 spin_unlock_bh(&xfrm_state_lock);
 299
 300                                 xfrm_state_delete(x);
 301                                 xfrm_state_put(x);
 302
 303                                 spin_lock_bh(&xfrm_state_lock);
 304                                 goto restart;
 305                         }
 306                 }
 307         }
 308         spin_unlock_bh(&xfrm_state_lock);
 309         wake_up(&km_waitq);
 310 }
 311 EXPORT_SYMBOL(xfrm_state_flush);
 312
 313 static int
 314 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 315                   struct xfrm_tmpl *tmpl,
 316                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 317                   unsigned short family)
 318 {
 319         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 320         if (!afinfo)
 321                 return -1;
 322         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 323         xfrm_state_put_afinfo(afinfo);
 324         return 0;
 325 }
 326
 327 struct xfrm_state *
 328 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 329                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 330                 struct xfrm_policy *pol, int *err,
 331                 unsigned short family)
 332 {
 333         unsigned h = xfrm_dst_hash(daddr, family);
 334         struct xfrm_state *x, *x0;
 335         int acquire_in_progress = 0;
 336         int error = 0;
 337         struct xfrm_state *best = NULL;
 338         struct xfrm_state_afinfo *afinfo;
 339
 340         afinfo = xfrm_state_get_afinfo(family);
 341         if (afinfo == NULL) {
 342                 *err = -EAFNOSUPPORT;
 343                 return NULL;
 344         }
 345
 346         spin_lock_bh(&xfrm_state_lock);
 347         list_for_each_entry(x, xfrm_state_bydst+h, bydst) {
 348                 if (x->props.family == family &&
 349                     x->props.reqid == tmpl->reqid &&
 350                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 351                     tmpl->mode == x->props.mode &&
 352                     tmpl->id.proto == x->id.proto &&
 353                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 354                         /* Resolution logic:
 355                            1. There is a valid state with matching selector.
 356                               Done.
 357                            2. Valid state with inappropriate selector. Skip.
 358
 359                            Entering area of "sysdeps".
 360
 361                            3. If state is not valid, selector is temporary,
 362                               it selects only session which triggered
 363                               previous resolution. Key manager will do
 364                               something to install a state with proper
 365                               selector.
 366                          */
 367                         if (x->km.state == XFRM_STATE_VALID) {
 368                                 if (!xfrm_selector_match(&x->sel, fl, family) ||
 369                                     !xfrm_sec_ctx_match(pol->security, x->security))
 370                                         continue;
 371                                 if (!best ||
 372                                     best->km.dying > x->km.dying ||
 373                                     (best->km.dying == x->km.dying &&
 374                                      best->curlft.add_time < x->curlft.add_time))
 375                                         best = x;
 376                         } else if (x->km.state == XFRM_STATE_ACQ) {
 377                                 acquire_in_progress = 1;
 378                         } else if (x->km.state == XFRM_STATE_ERROR ||
 379                                    x->km.state == XFRM_STATE_EXPIRED) {
 380                                 if (xfrm_selector_match(&x->sel, fl, family) &&
 381                                     xfrm_sec_ctx_match(pol->security, x->security))
 382                                         error = -ESRCH;
 383                         }
 384                 }
 385         }
 386
 387         x = best;
 388         if (!x && !error && !acquire_in_progress) {
 389                 if (tmpl->id.spi &&
 390                     (x0 = afinfo->state_lookup(daddr, tmpl->id.spi,
 391                                                tmpl->id.proto)) != NULL) {
 392                         xfrm_state_put(x0);
 393                         error = -EEXIST;
 394                         goto out;
 395                 }
 396                 x = xfrm_state_alloc();
 397                 if (x == NULL) {
 398                         error = -ENOMEM;
 399                         goto out;
 400                 }
 401                 /* Initialize temporary selector matching only
 402                  * to current session. */
 403                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 404
 405                 if (km_query(x, tmpl, pol) == 0) {
 406                         x->km.state = XFRM_STATE_ACQ;
 407                         list_add_tail(&x->bydst, xfrm_state_bydst+h);
 408                         xfrm_state_hold(x);
 409                         if (x->id.spi) {
 410                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 411                                 list_add(&x->byspi, xfrm_state_byspi+h);
 412                                 xfrm_state_hold(x);
 413                         }
 414                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
 415                         xfrm_state_hold(x);
 416                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
 417                         add_timer(&x->timer);
 418                 } else {
 419                         x->km.state = XFRM_STATE_DEAD;
 420                         xfrm_state_put(x);
 421                         x = NULL;
 422                         error = -ESRCH;
 423                 }
 424         }
 425 out:
 426         if (x)
 427                 xfrm_state_hold(x);
 428         else
 429                 *err = acquire_in_progress ? -EAGAIN : error;
 430         spin_unlock_bh(&xfrm_state_lock);
 431         xfrm_state_put_afinfo(afinfo);
 432         return x;
 433 }
 434
 435 static void __xfrm_state_insert(struct xfrm_state *x)
 436 {
 437         unsigned h = xfrm_dst_hash(&x->id.daddr, x->props.family);
 438
 439         list_add(&x->bydst, xfrm_state_bydst+h);
 440         xfrm_state_hold(x);
 441
 442         h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 443
 444         list_add(&x->byspi, xfrm_state_byspi+h);
 445         xfrm_state_hold(x);
 446
 447         if (!mod_timer(&x->timer, jiffies + HZ))
 448                 xfrm_state_hold(x);
 449
 450         if (x->replay_maxage &&
 451             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
 452                 xfrm_state_hold(x);
 453
 454         wake_up(&km_waitq);
 455 }
 456
 457 void xfrm_state_insert(struct xfrm_state *x)
 458 {
 459         spin_lock_bh(&xfrm_state_lock);
 460         __xfrm_state_insert(x);
 461         spin_unlock_bh(&xfrm_state_lock);
 462
 463         xfrm_flush_all_bundles();
 464 }
 465 EXPORT_SYMBOL(xfrm_state_insert);
 466
 467 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
 468
 469 int xfrm_state_add(struct xfrm_state *x)
 470 {
 471         struct xfrm_state_afinfo *afinfo;
 472         struct xfrm_state *x1;
 473         int family;
 474         int err;
 475
 476         family = x->props.family;
 477         afinfo = xfrm_state_get_afinfo(family);
 478         if (unlikely(afinfo == NULL))
 479                 return -EAFNOSUPPORT;
 480
 481         spin_lock_bh(&xfrm_state_lock);
 482
 483         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 484         if (x1) {
 485                 xfrm_state_put(x1);
 486                 x1 = NULL;
 487                 err = -EEXIST;
 488                 goto out;
 489         }
 490
 491         if (x->km.seq) {
 492                 x1 = __xfrm_find_acq_byseq(x->km.seq);
 493                 if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
 494                         xfrm_state_put(x1);
 495                         x1 = NULL;
 496                 }
 497         }
 498
 499         if (!x1)
 500                 x1 = afinfo->find_acq(
 501                         x->props.mode, x->props.reqid, x->id.proto,
 502                         &x->id.daddr, &x->props.saddr, 0);
 503
 504         __xfrm_state_insert(x);
 505         err = 0;
 506
 507 out:
 508         spin_unlock_bh(&xfrm_state_lock);
 509         xfrm_state_put_afinfo(afinfo);
 510
 511         if (!err)
 512                 xfrm_flush_all_bundles();
 513
 514         if (x1) {
 515                 xfrm_state_delete(x1);
 516                 xfrm_state_put(x1);
 517         }
 518
 519         return err;
 520 }
 521 EXPORT_SYMBOL(xfrm_state_add);
 522
 523 int xfrm_state_update(struct xfrm_state *x)
 524 {
 525         struct xfrm_state_afinfo *afinfo;
 526         struct xfrm_state *x1;
 527         int err;
 528
 529         afinfo = xfrm_state_get_afinfo(x->props.family);
 530         if (unlikely(afinfo == NULL))
 531                 return -EAFNOSUPPORT;
 532
 533         spin_lock_bh(&xfrm_state_lock);
 534         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 535
 536         err = -ESRCH;
 537         if (!x1)
 538                 goto out;
 539
 540         if (xfrm_state_kern(x1)) {
 541                 xfrm_state_put(x1);
 542                 err = -EEXIST;
 543                 goto out;
 544         }
 545
 546         if (x1->km.state == XFRM_STATE_ACQ) {
 547                 __xfrm_state_insert(x);
 548                 x = NULL;
 549         }
 550         err = 0;
 551
 552 out:
 553         spin_unlock_bh(&xfrm_state_lock);
 554         xfrm_state_put_afinfo(afinfo);
 555
 556         if (err)
 557                 return err;
 558
 559         if (!x) {
 560                 xfrm_state_delete(x1);
 561                 xfrm_state_put(x1);
 562                 return 0;
 563         }
 564
 565         err = -EINVAL;
 566         spin_lock_bh(&x1->lock);
 567         if (likely(x1->km.state == XFRM_STATE_VALID)) {
 568                 if (x->encap && x1->encap)
 569                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
 570                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
 571                 x1->km.dying = 0;
 572
 573                 if (!mod_timer(&x1->timer, jiffies + HZ))
 574                         xfrm_state_hold(x1);
 575                 if (x1->curlft.use_time)
 576                         xfrm_state_check_expire(x1);
 577
 578                 err = 0;
 579         }
 580         spin_unlock_bh(&x1->lock);
 581
 582         xfrm_state_put(x1);
 583
 584         return err;
 585 }
 586 EXPORT_SYMBOL(xfrm_state_update);
 587
 588 int xfrm_state_check_expire(struct xfrm_state *x)
 589 {
 590         if (!x->curlft.use_time)
 591                 x->curlft.use_time = (unsigned long)xtime.tv_sec;
 592
 593         if (x->km.state != XFRM_STATE_VALID)
 594                 return -EINVAL;
 595
 596         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
 597             x->curlft.packets >= x->lft.hard_packet_limit) {
 598                 x->km.state = XFRM_STATE_EXPIRED;
 599                 if (!mod_timer(&x->timer, jiffies))
 600                         xfrm_state_hold(x);
 601                 return -EINVAL;
 602         }
 603
 604         if (!x->km.dying &&
 605             (x->curlft.bytes >= x->lft.soft_byte_limit ||
 606              x->curlft.packets >= x->lft.soft_packet_limit)) {
 607                 x->km.dying = 1;
 608                 km_state_expired(x, 0, 0);
 609         }
 610         return 0;
 611 }
 612 EXPORT_SYMBOL(xfrm_state_check_expire);
 613
 614 static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
 615 {
 616         int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
 617                 - skb_headroom(skb);
 618
 619         if (nhead > 0)
 620                 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
 621
 622         /* Check tail too... */
 623         return 0;
 624 }
 625
 626 int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
 627 {
 628         int err = xfrm_state_check_expire(x);
 629         if (err < 0)
 630                 goto err;
 631         err = xfrm_state_check_space(x, skb);
 632 err:
 633         return err;
 634 }
 635 EXPORT_SYMBOL(xfrm_state_check);
 636
 637 struct xfrm_state *
 638 xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
 639                   unsigned short family)
 640 {
 641         struct xfrm_state *x;
 642         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 643         if (!afinfo)
 644                 return NULL;
 645
 646         spin_lock_bh(&xfrm_state_lock);
 647         x = afinfo->state_lookup(daddr, spi, proto);
 648         spin_unlock_bh(&xfrm_state_lock);
 649         xfrm_state_put_afinfo(afinfo);
 650         return x;
 651 }
 652 EXPORT_SYMBOL(xfrm_state_lookup);
 653
 654 struct xfrm_state *
 655 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 656               xfrm_address_t *daddr, xfrm_address_t *saddr,
 657               int create, unsigned short family)
 658 {
 659         struct xfrm_state *x;
 660         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 661         if (!afinfo)
 662                 return NULL;
 663
 664         spin_lock_bh(&xfrm_state_lock);
 665         x = afinfo->find_acq(mode, reqid, proto, daddr, saddr, create);
 666         spin_unlock_bh(&xfrm_state_lock);
 667         xfrm_state_put_afinfo(afinfo);
 668         return x;
 669 }
 670 EXPORT_SYMBOL(xfrm_find_acq);
 671
 672 /* Silly enough, but I'm lazy to build resolution list */
 673
 674 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
 675 {
 676         int i;
 677         struct xfrm_state *x;
 678
 679         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 680                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 681                         if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
 682                                 xfrm_state_hold(x);
 683                                 return x;
 684                         }
 685                 }
 686         }
 687         return NULL;
 688 }
 689
 690 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
 691 {
 692         struct xfrm_state *x;
 693
 694         spin_lock_bh(&xfrm_state_lock);
 695         x = __xfrm_find_acq_byseq(seq);
 696         spin_unlock_bh(&xfrm_state_lock);
 697         return x;
 698 }
 699 EXPORT_SYMBOL(xfrm_find_acq_byseq);
 700
 701 u32 xfrm_get_acqseq(void)
 702 {
 703         u32 res;
 704         static u32 acqseq;
 705         static DEFINE_SPINLOCK(acqseq_lock);
 706
 707         spin_lock_bh(&acqseq_lock);
 708         res = (++acqseq ? : ++acqseq);
 709         spin_unlock_bh(&acqseq_lock);
 710         return res;
 711 }
 712 EXPORT_SYMBOL(xfrm_get_acqseq);
 713
 714 void
 715 xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
 716 {
 717         u32 h;
 718         struct xfrm_state *x0;
 719
 720         if (x->id.spi)
 721                 return;
 722
 723         if (minspi == maxspi) {
 724                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
 725                 if (x0) {
 726                         xfrm_state_put(x0);
 727                         return;
 728                 }
 729                 x->id.spi = minspi;
 730         } else {
 731                 u32 spi = 0;
 732                 minspi = ntohl(minspi);
 733                 maxspi = ntohl(maxspi);
 734                 for (h=0; h<maxspi-minspi+1; h++) {
 735                         spi = minspi + net_random()%(maxspi-minspi+1);
 736                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
 737                         if (x0 == NULL) {
 738                                 x->id.spi = htonl(spi);
 739                                 break;
 740                         }
 741                         xfrm_state_put(x0);
 742                 }
 743         }
 744         if (x->id.spi) {
 745                 spin_lock_bh(&xfrm_state_lock);
 746                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 747                 list_add(&x->byspi, xfrm_state_byspi+h);
 748                 xfrm_state_hold(x);
 749                 spin_unlock_bh(&xfrm_state_lock);
 750                 wake_up(&km_waitq);
 751         }
 752 }
 753 EXPORT_SYMBOL(xfrm_alloc_spi);
 754
 755 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
 756                     void *data)
 757 {
 758         int i;
 759         struct xfrm_state *x;
 760         int count = 0;
 761         int err = 0;
 762
 763         spin_lock_bh(&xfrm_state_lock);
 764         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 765                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 766                         if (proto == IPSEC_PROTO_ANY || x->id.proto == proto)
 767                                 count++;
 768                 }
 769         }
 770         if (count == 0) {
 771                 err = -ENOENT;
 772                 goto out;
 773         }
 774
 775         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 776                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 777                         if (proto != IPSEC_PROTO_ANY && x->id.proto != proto)
 778                                 continue;
 779                         err = func(x, --count, data);
 780                         if (err)
 781                                 goto out;
 782                 }
 783         }
 784 out:
 785         spin_unlock_bh(&xfrm_state_lock);
 786         return err;
 787 }
 788 EXPORT_SYMBOL(xfrm_state_walk);
 789
 790
 791 void xfrm_replay_notify(struct xfrm_state *x, int event)
 792 {
 793         struct km_event c;
 794         /* we send notify messages in case
 795          *  1. we updated on of the sequence numbers, and the seqno difference
 796          *     is at least x->replay_maxdiff, in this case we also update the
 797          *     timeout of our timer function
 798          *  2. if x->replay_maxage has elapsed since last update,
 799          *     and there were changes
 800          *
 801          *  The state structure must be locked!
 802          */
 803
 804         switch (event) {
 805         case XFRM_REPLAY_UPDATE:
 806                 if (x->replay_maxdiff &&
 807                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
 808                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))
 809                         return;
 810
 811                 break;
 812
 813         case XFRM_REPLAY_TIMEOUT:
 814                 if ((x->replay.seq == x->preplay.seq) &&
 815                     (x->replay.bitmap == x->preplay.bitmap) &&
 816                     (x->replay.oseq == x->preplay.oseq))
 817                         return;
 818
 819                 break;
 820         }
 821
 822         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
 823         c.event = XFRM_MSG_NEWAE;
 824         c.data.aevent = event;
 825         km_state_notify(x, &c);
 826
 827         if (x->replay_maxage &&
 828             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
 829                 xfrm_state_hold(x);
 830 }
 831 EXPORT_SYMBOL(xfrm_replay_notify);
 832
 833 static void xfrm_replay_timer_handler(unsigned long data)
 834 {
 835         struct xfrm_state *x = (struct xfrm_state*)data;
 836
 837         spin_lock(&x->lock);
 838
 839         if (xfrm_aevent_is_on() && x->km.state == XFRM_STATE_VALID)
 840                 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
 841
 842         spin_unlock(&x->lock);
 843 }
 844
 845 int xfrm_replay_check(struct xfrm_state *x, u32 seq)
 846 {
 847         u32 diff;
 848
 849         seq = ntohl(seq);
 850
 851         if (unlikely(seq == 0))
 852                 return -EINVAL;
 853
 854         if (likely(seq > x->replay.seq))
 855                 return 0;
 856
 857         diff = x->replay.seq - seq;
 858         if (diff >= x->props.replay_window) {
 859                 x->stats.replay_window++;
 860                 return -EINVAL;
 861         }
 862
 863         if (x->replay.bitmap & (1U << diff)) {
 864                 x->stats.replay++;
 865                 return -EINVAL;
 866         }
 867         return 0;
 868 }
 869 EXPORT_SYMBOL(xfrm_replay_check);
 870
 871 void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
 872 {
 873         u32 diff;
 874
 875         seq = ntohl(seq);
 876
 877         if (seq > x->replay.seq) {
 878                 diff = seq - x->replay.seq;
 879                 if (diff < x->props.replay_window)
 880                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
 881                 else
 882                         x->replay.bitmap = 1;
 883                 x->replay.seq = seq;
 884         } else {
 885                 diff = x->replay.seq - seq;
 886                 x->replay.bitmap |= (1U << diff);
 887         }
 888
 889         if (xfrm_aevent_is_on())
 890                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
 891 }
 892 EXPORT_SYMBOL(xfrm_replay_advance);
 893
 894 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
 895 static DEFINE_RWLOCK(xfrm_km_lock);
 896
 897 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
 898 {
 899         struct xfrm_mgr *km;
 900
 901         read_lock(&xfrm_km_lock);
 902         list_for_each_entry(km, &xfrm_km_list, list)
 903                 if (km->notify_policy)
 904                         km->notify_policy(xp, dir, c);
 905         read_unlock(&xfrm_km_lock);
 906 }
 907
 908 void km_state_notify(struct xfrm_state *x, struct km_event *c)
 909 {
 910         struct xfrm_mgr *km;
 911         read_lock(&xfrm_km_lock);
 912         list_for_each_entry(km, &xfrm_km_list, list)
 913                 if (km->notify)
 914                         km->notify(x, c);
 915         read_unlock(&xfrm_km_lock);
 916 }
 917
 918 EXPORT_SYMBOL(km_policy_notify);
 919 EXPORT_SYMBOL(km_state_notify);
 920
 921 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
 922 {
 923         struct km_event c;
 924
 925         c.data.hard = hard;
 926         c.pid = pid;
 927         c.event = XFRM_MSG_EXPIRE;
 928         km_state_notify(x, &c);
 929
 930         if (hard)
 931                 wake_up(&km_waitq);
 932 }
 933
 934 EXPORT_SYMBOL(km_state_expired);
 935 /*
 936  * We send to all registered managers regardless of failure
 937  * We are happy with one success
 938 */
 939 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 940 {
 941         int err = -EINVAL, acqret;
 942         struct xfrm_mgr *km;
 943
 944         read_lock(&xfrm_km_lock);
 945         list_for_each_entry(km, &xfrm_km_list, list) {
 946                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
 947                 if (!acqret)
 948                         err = acqret;
 949         }
 950         read_unlock(&xfrm_km_lock);
 951         return err;
 952 }
 953 EXPORT_SYMBOL(km_query);
 954
 955 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport)
 956 {
 957         int err = -EINVAL;
 958         struct xfrm_mgr *km;
 959
 960         read_lock(&xfrm_km_lock);
 961         list_for_each_entry(km, &xfrm_km_list, list) {
 962                 if (km->new_mapping)
 963                         err = km->new_mapping(x, ipaddr, sport);
 964                 if (!err)
 965                         break;
 966         }
 967         read_unlock(&xfrm_km_lock);
 968         return err;
 969 }
 970 EXPORT_SYMBOL(km_new_mapping);
 971
 972 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
 973 {
 974         struct km_event c;
 975
 976         c.data.hard = hard;
 977         c.pid = pid;
 978         c.event = XFRM_MSG_POLEXPIRE;
 979         km_policy_notify(pol, dir, &c);
 980
 981         if (hard)
 982                 wake_up(&km_waitq);
 983 }
 984 EXPORT_SYMBOL(km_policy_expired);
 985
 986 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 987 {
 988         int err;
 989         u8 *data;
 990         struct xfrm_mgr *km;
 991         struct xfrm_policy *pol = NULL;
 992
 993         if (optlen <= 0 || optlen > PAGE_SIZE)
 994                 return -EMSGSIZE;
 995
 996         data = kmalloc(optlen, GFP_KERNEL);
 997         if (!data)
 998                 return -ENOMEM;
 999
1000         err = -EFAULT;
1001         if (copy_from_user(data, optval, optlen))
1002                 goto out;
1003
1004         err = -EINVAL;
1005         read_lock(&xfrm_km_lock);
1006         list_for_each_entry(km, &xfrm_km_list, list) {
1007                 pol = km->compile_policy(sk->sk_family, optname, data,
1008                                          optlen, &err);
1009                 if (err >= 0)
1010                         break;
1011         }
1012         read_unlock(&xfrm_km_lock);
1013
1014         if (err >= 0) {
1015                 xfrm_sk_policy_insert(sk, err, pol);
1016                 xfrm_pol_put(pol);
1017                 err = 0;
1018         }
1019
1020 out:
1021         kfree(data);
1022         return err;
1023 }
1024 EXPORT_SYMBOL(xfrm_user_policy);
1025
1026 int xfrm_register_km(struct xfrm_mgr *km)
1027 {
1028         write_lock_bh(&xfrm_km_lock);
1029         list_add_tail(&km->list, &xfrm_km_list);
1030         write_unlock_bh(&xfrm_km_lock);
1031         return 0;
1032 }
1033 EXPORT_SYMBOL(xfrm_register_km);
1034
1035 int xfrm_unregister_km(struct xfrm_mgr *km)
1036 {
1037         write_lock_bh(&xfrm_km_lock);
1038         list_del(&km->list);
1039         write_unlock_bh(&xfrm_km_lock);
1040         return 0;
1041 }
1042 EXPORT_SYMBOL(xfrm_unregister_km);
1043
1044 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1045 {
1046         int err = 0;
1047         if (unlikely(afinfo == NULL))
1048                 return -EINVAL;
1049         if (unlikely(afinfo->family >= NPROTO))
1050                 return -EAFNOSUPPORT;
1051         write_lock(&xfrm_state_afinfo_lock);
1052         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1053                 err = -ENOBUFS;
1054         else {
1055                 afinfo->state_bydst = xfrm_state_bydst;
1056                 afinfo->state_byspi = xfrm_state_byspi;
1057                 xfrm_state_afinfo[afinfo->family] = afinfo;
1058         }
1059         write_unlock(&xfrm_state_afinfo_lock);
1060         return err;
1061 }
1062 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1063
1064 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1065 {
1066         int err = 0;
1067         if (unlikely(afinfo == NULL))
1068                 return -EINVAL;
1069         if (unlikely(afinfo->family >= NPROTO))
1070                 return -EAFNOSUPPORT;
1071         write_lock(&xfrm_state_afinfo_lock);
1072         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1073                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1074                         err = -EINVAL;
1075                 else {
1076                         xfrm_state_afinfo[afinfo->family] = NULL;
1077                         afinfo->state_byspi = NULL;
1078                         afinfo->state_bydst = NULL;
1079                 }
1080         }
1081         write_unlock(&xfrm_state_afinfo_lock);
1082         return err;
1083 }
1084 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1085
1086 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
1087 {
1088         struct xfrm_state_afinfo *afinfo;
1089         if (unlikely(family >= NPROTO))
1090                 return NULL;
1091         read_lock(&xfrm_state_afinfo_lock);
1092         afinfo = xfrm_state_afinfo[family];
1093         if (likely(afinfo != NULL))
1094                 read_lock(&afinfo->lock);
1095         read_unlock(&xfrm_state_afinfo_lock);
1096         return afinfo;
1097 }
1098
1099 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1100 {
1101         if (unlikely(afinfo == NULL))
1102                 return;
1103         read_unlock(&afinfo->lock);
1104 }
1105
1106 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1107 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1108 {
1109         if (x->tunnel) {
1110                 struct xfrm_state *t = x->tunnel;
1111
1112                 if (atomic_read(&t->tunnel_users) == 2)
1113                         xfrm_state_delete(t);
1114                 atomic_dec(&t->tunnel_users);
1115                 xfrm_state_put(t);
1116                 x->tunnel = NULL;
1117         }
1118 }
1119 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1120
1121 /*
1122  * This function is NOT optimal.  For example, with ESP it will give an
1123  * MTU that's usually two bytes short of being optimal.  However, it will
1124  * usually give an answer that's a multiple of 4 provided the input is
1125  * also a multiple of 4.
1126  */
1127 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1128 {
1129         int res = mtu;
1130
1131         res -= x->props.header_len;
1132
1133         for (;;) {
1134                 int m = res;
1135
1136                 if (m < 68)
1137                         return 68;
1138
1139                 spin_lock_bh(&x->lock);
1140                 if (x->km.state == XFRM_STATE_VALID &&
1141                     x->type && x->type->get_max_size)
1142                         m = x->type->get_max_size(x, m);
1143                 else
1144                         m += x->props.header_len;
1145                 spin_unlock_bh(&x->lock);
1146
1147                 if (m <= mtu)
1148                         break;
1149                 res -= (m - mtu);
1150         }
1151
1152         return res;
1153 }
1154
1155 EXPORT_SYMBOL(xfrm_state_mtu);
1156
1157 int xfrm_init_state(struct xfrm_state *x)
1158 {
1159         struct xfrm_state_afinfo *afinfo;
1160         int family = x->props.family;
1161         int err;
1162
1163         err = -EAFNOSUPPORT;
1164         afinfo = xfrm_state_get_afinfo(family);
1165         if (!afinfo)
1166                 goto error;
1167
1168         err = 0;
1169         if (afinfo->init_flags)
1170                 err = afinfo->init_flags(x);
1171
1172         xfrm_state_put_afinfo(afinfo);
1173
1174         if (err)
1175                 goto error;
1176
1177         err = -EPROTONOSUPPORT;
1178         x->type = xfrm_get_type(x->id.proto, family);
1179         if (x->type == NULL)
1180                 goto error;
1181
1182         err = x->type->init_state(x);
1183         if (err)
1184                 goto error;
1185
1186         x->km.state = XFRM_STATE_VALID;
1187
1188 error:
1189         return err;
1190 }
1191
1192 EXPORT_SYMBOL(xfrm_init_state);
1193
1194 void __init xfrm_state_init(void)
1195 {
1196         int i;
1197
1198         for (i=0; i<XFRM_DST_HSIZE; i++) {
1199                 INIT_LIST_HEAD(&xfrm_state_bydst[i]);
1200                 INIT_LIST_HEAD(&xfrm_state_byspi[i]);
1201         }
1202         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task, NULL);
1203 }
1204