net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <asm/uaccess.h>
  21
  22 /* Each xfrm_state may be linked to two tables:
  23
  24    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  25    2. Hash table by daddr to find what SAs exist for given
  26       destination/tunnel endpoint. (output)
  27  */
  28
  29 static spinlock_t xfrm_state_lock = SPIN_LOCK_UNLOCKED;
  30
  31 /* Hash table to find appropriate SA towards given target (endpoint
  32  * of tunnel or destination of transport mode) allowed by selector.
  33  *
  34  * Main use is finding SA after policy selected tunnel or transport mode.
  35  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  36  */
  37 static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE];
  38 static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE];
  39
  40 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
  41
  42 static rwlock_t xfrm_state_afinfo_lock = RW_LOCK_UNLOCKED;
  43 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
  44
  45 static struct work_struct xfrm_state_gc_work;
  46 static struct list_head xfrm_state_gc_list = LIST_HEAD_INIT(xfrm_state_gc_list);
  47 static spinlock_t xfrm_state_gc_lock = SPIN_LOCK_UNLOCKED;
  48
  49 static void __xfrm_state_delete(struct xfrm_state *x);
  50
  51 static void xfrm_state_gc_destroy(struct xfrm_state *x)
  52 {
  53         if (del_timer(&x->timer))
  54                 BUG();
  55         if (x->aalg)
  56                 kfree(x->aalg);
  57         if (x->ealg)
  58                 kfree(x->ealg);
  59         if (x->calg)
  60                 kfree(x->calg);
  61         if (x->encap)
  62                 kfree(x->encap);
  63         if (x->type) {
  64                 x->type->destructor(x);
  65                 xfrm_put_type(x->type);
  66         }
  67         kfree(x);
  68         wake_up(&km_waitq);
  69 }
  70
  71 static void xfrm_state_gc_task(void *data)
  72 {
  73         struct xfrm_state *x;
  74         struct list_head *entry, *tmp;
  75         struct list_head gc_list = LIST_HEAD_INIT(gc_list);
  76
  77         spin_lock_bh(&xfrm_state_gc_lock);
  78         list_splice_init(&xfrm_state_gc_list, &gc_list);
  79         spin_unlock_bh(&xfrm_state_gc_lock);
  80
  81         list_for_each_safe(entry, tmp, &gc_list) {
  82                 x = list_entry(entry, struct xfrm_state, bydst);
  83                 xfrm_state_gc_destroy(x);
  84         }
  85 }
  86
  87 static inline unsigned long make_jiffies(long secs)
  88 {
  89         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
  90                 return MAX_SCHEDULE_TIMEOUT-1;
  91         else
  92                 return secs*HZ;
  93 }
  94
  95 static void xfrm_timer_handler(unsigned long data)
  96 {
  97         struct xfrm_state *x = (struct xfrm_state*)data;
  98         unsigned long now = (unsigned long)xtime.tv_sec;
  99         long next = LONG_MAX;
 100         int warn = 0;
 101
 102         spin_lock(&x->lock);
 103         if (x->km.state == XFRM_STATE_DEAD)
 104                 goto out;
 105         if (x->km.state == XFRM_STATE_EXPIRED)
 106                 goto expired;
 107         if (x->lft.hard_add_expires_seconds) {
 108                 long tmo = x->lft.hard_add_expires_seconds +
 109                         x->curlft.add_time - now;
 110                 if (tmo <= 0)
 111                         goto expired;
 112                 if (tmo < next)
 113                         next = tmo;
 114         }
 115         if (x->lft.hard_use_expires_seconds) {
 116                 long tmo = x->lft.hard_use_expires_seconds +
 117                         (x->curlft.use_time ? : now) - now;
 118                 if (tmo <= 0)
 119                         goto expired;
 120                 if (tmo < next)
 121                         next = tmo;
 122         }
 123         if (x->km.dying)
 124                 goto resched;
 125         if (x->lft.soft_add_expires_seconds) {
 126                 long tmo = x->lft.soft_add_expires_seconds +
 127                         x->curlft.add_time - now;
 128                 if (tmo <= 0)
 129                         warn = 1;
 130                 else if (tmo < next)
 131                         next = tmo;
 132         }
 133         if (x->lft.soft_use_expires_seconds) {
 134                 long tmo = x->lft.soft_use_expires_seconds +
 135                         (x->curlft.use_time ? : now) - now;
 136                 if (tmo <= 0)
 137                         warn = 1;
 138                 else if (tmo < next)
 139                         next = tmo;
 140         }
 141
 142         if (warn)
 143                 km_state_expired(x, 0);
 144 resched:
 145         if (next != LONG_MAX &&
 146             !mod_timer(&x->timer, jiffies + make_jiffies(next)))
 147                 xfrm_state_hold(x);
 148         goto out;
 149
 150 expired:
 151         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 152                 x->km.state = XFRM_STATE_EXPIRED;
 153                 wake_up(&km_waitq);
 154                 next = 2;
 155                 goto resched;
 156         }
 157         if (x->id.spi != 0)
 158                 km_state_expired(x, 1);
 159         __xfrm_state_delete(x);
 160
 161 out:
 162         spin_unlock(&x->lock);
 163         xfrm_state_put(x);
 164 }
 165
 166 struct xfrm_state *xfrm_state_alloc(void)
 167 {
 168         struct xfrm_state *x;
 169
 170         x = kmalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 171
 172         if (x) {
 173                 memset(x, 0, sizeof(struct xfrm_state));
 174                 atomic_set(&x->refcnt, 1);
 175                 atomic_set(&x->tunnel_users, 0);
 176                 INIT_LIST_HEAD(&x->bydst);
 177                 INIT_LIST_HEAD(&x->byspi);
 178                 init_timer(&x->timer);
 179                 x->timer.function = xfrm_timer_handler;
 180                 x->timer.data     = (unsigned long)x;
 181                 x->curlft.add_time = (unsigned long)xtime.tv_sec;
 182                 x->lft.soft_byte_limit = XFRM_INF;
 183                 x->lft.soft_packet_limit = XFRM_INF;
 184                 x->lft.hard_byte_limit = XFRM_INF;
 185                 x->lft.hard_packet_limit = XFRM_INF;
 186                 x->lock = SPIN_LOCK_UNLOCKED;
 187         }
 188         return x;
 189 }
 190
 191 void __xfrm_state_destroy(struct xfrm_state *x)
 192 {
 193         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 194
 195         spin_lock_bh(&xfrm_state_gc_lock);
 196         list_add(&x->bydst, &xfrm_state_gc_list);
 197         spin_unlock_bh(&xfrm_state_gc_lock);
 198         schedule_work(&xfrm_state_gc_work);
 199 }
 200
 201 static void __xfrm_state_delete(struct xfrm_state *x)
 202 {
 203         if (x->km.state != XFRM_STATE_DEAD) {
 204                 x->km.state = XFRM_STATE_DEAD;
 205                 spin_lock(&xfrm_state_lock);
 206                 list_del(&x->bydst);
 207                 atomic_dec(&x->refcnt);
 208                 if (x->id.spi) {
 209                         list_del(&x->byspi);
 210                         atomic_dec(&x->refcnt);
 211                 }
 212                 spin_unlock(&xfrm_state_lock);
 213                 if (del_timer(&x->timer))
 214                         atomic_dec(&x->refcnt);
 215
 216                 /* The number two in this test is the reference
 217                  * mentioned in the comment below plus the reference
 218                  * our caller holds.  A larger value means that
 219                  * there are DSTs attached to this xfrm_state.
 220                  */
 221                 if (atomic_read(&x->refcnt) > 2)
 222                         xfrm_flush_bundles();
 223
 224                 /* All xfrm_state objects are created by xfrm_state_alloc.
 225                  * The xfrm_state_alloc call gives a reference, and that
 226                  * is what we are dropping here.
 227                  */
 228                 atomic_dec(&x->refcnt);
 229         }
 230 }
 231
 232 void xfrm_state_delete(struct xfrm_state *x)
 233 {
 234         spin_lock_bh(&x->lock);
 235         __xfrm_state_delete(x);
 236         spin_unlock_bh(&x->lock);
 237 }
 238
 239 void xfrm_state_flush(u8 proto)
 240 {
 241         int i;
 242         struct xfrm_state *x;
 243
 244         spin_lock_bh(&xfrm_state_lock);
 245         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 246 restart:
 247                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 248                         if (!xfrm_state_kern(x) &&
 249                             (proto == IPSEC_PROTO_ANY || x->id.proto == proto)) {
 250                                 xfrm_state_hold(x);
 251                                 spin_unlock_bh(&xfrm_state_lock);
 252
 253                                 xfrm_state_delete(x);
 254                                 xfrm_state_put(x);
 255
 256                                 spin_lock_bh(&xfrm_state_lock);
 257                                 goto restart;
 258                         }
 259                 }
 260         }
 261         spin_unlock_bh(&xfrm_state_lock);
 262         wake_up(&km_waitq);
 263 }
 264
 265 static int
 266 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 267                   struct xfrm_tmpl *tmpl,
 268                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 269                   unsigned short family)
 270 {
 271         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 272         if (!afinfo)
 273                 return -1;
 274         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 275         xfrm_state_put_afinfo(afinfo);
 276         return 0;
 277 }
 278
 279 struct xfrm_state *
 280 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 281                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 282                 struct xfrm_policy *pol, int *err,
 283                 unsigned short family)
 284 {
 285         unsigned h = xfrm_dst_hash(daddr, family);
 286         struct xfrm_state *x;
 287         int acquire_in_progress = 0;
 288         int error = 0;
 289         struct xfrm_state *best = NULL;
 290
 291         spin_lock_bh(&xfrm_state_lock);
 292         list_for_each_entry(x, xfrm_state_bydst+h, bydst) {
 293                 if (x->props.family == family &&
 294                     x->props.reqid == tmpl->reqid &&
 295                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 296                     tmpl->mode == x->props.mode &&
 297                     tmpl->id.proto == x->id.proto) {
 298                         /* Resolution logic:
 299                            1. There is a valid state with matching selector.
 300                               Done.
 301                            2. Valid state with inappropriate selector. Skip.
 302
 303                            Entering area of "sysdeps".
 304
 305                            3. If state is not valid, selector is temporary,
 306                               it selects only session which triggered
 307                               previous resolution. Key manager will do
 308                               something to install a state with proper
 309                               selector.
 310                          */
 311                         if (x->km.state == XFRM_STATE_VALID) {
 312                                 if (!xfrm_selector_match(&x->sel, fl, family))
 313                                         continue;
 314                                 if (!best ||
 315                                     best->km.dying > x->km.dying ||
 316                                     (best->km.dying == x->km.dying &&
 317                                      best->curlft.add_time < x->curlft.add_time))
 318                                         best = x;
 319                         } else if (x->km.state == XFRM_STATE_ACQ) {
 320                                 acquire_in_progress = 1;
 321                         } else if (x->km.state == XFRM_STATE_ERROR ||
 322                                    x->km.state == XFRM_STATE_EXPIRED) {
 323                                 if (xfrm_selector_match(&x->sel, fl, family))
 324                                         error = 1;
 325                         }
 326                 }
 327         }
 328
 329         x = best;
 330         if (!x && !error && !acquire_in_progress &&
 331             ((x = xfrm_state_alloc()) != NULL)) {
 332                 /* Initialize temporary selector matching only
 333                  * to current session. */
 334                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 335
 336                 if (km_query(x, tmpl, pol) == 0) {
 337                         x->km.state = XFRM_STATE_ACQ;
 338                         list_add_tail(&x->bydst, xfrm_state_bydst+h);
 339                         xfrm_state_hold(x);
 340                         if (x->id.spi) {
 341                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 342                                 list_add(&x->byspi, xfrm_state_byspi+h);
 343                                 xfrm_state_hold(x);
 344                         }
 345                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
 346                         xfrm_state_hold(x);
 347                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
 348                         add_timer(&x->timer);
 349                 } else {
 350                         x->km.state = XFRM_STATE_DEAD;
 351                         xfrm_state_put(x);
 352                         x = NULL;
 353                         error = 1;
 354                 }
 355         }
 356         if (x)
 357                 xfrm_state_hold(x);
 358         else
 359                 *err = acquire_in_progress ? -EAGAIN :
 360                         (error ? -ESRCH : -ENOMEM);
 361         spin_unlock_bh(&xfrm_state_lock);
 362         return x;
 363 }
 364
 365 static void __xfrm_state_insert(struct xfrm_state *x)
 366 {
 367         unsigned h = xfrm_dst_hash(&x->id.daddr, x->props.family);
 368
 369         list_add(&x->bydst, xfrm_state_bydst+h);
 370         xfrm_state_hold(x);
 371
 372         h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 373
 374         list_add(&x->byspi, xfrm_state_byspi+h);
 375         xfrm_state_hold(x);
 376
 377         if (!mod_timer(&x->timer, jiffies + HZ))
 378                 xfrm_state_hold(x);
 379
 380         wake_up(&km_waitq);
 381 }
 382
 383 void xfrm_state_insert(struct xfrm_state *x)
 384 {
 385         spin_lock_bh(&xfrm_state_lock);
 386         __xfrm_state_insert(x);
 387         spin_unlock_bh(&xfrm_state_lock);
 388 }
 389
 390 int xfrm_state_add(struct xfrm_state *x)
 391 {
 392         struct xfrm_state_afinfo *afinfo;
 393         struct xfrm_state *x1;
 394         int err;
 395
 396         afinfo = xfrm_state_get_afinfo(x->props.family);
 397         if (unlikely(afinfo == NULL))
 398                 return -EAFNOSUPPORT;
 399
 400         spin_lock_bh(&xfrm_state_lock);
 401
 402         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 403         if (!x1) {
 404                 x1 = afinfo->find_acq(
 405                         x->props.mode, x->props.reqid, x->id.proto,
 406                         &x->id.daddr, &x->props.saddr, 0);
 407                 if (x1 && x1->id.spi != x->id.spi && x1->id.spi) {
 408                         xfrm_state_put(x1);
 409                         x1 = NULL;
 410                 }
 411         }
 412
 413         if (x1 && x1->id.spi) {
 414                 xfrm_state_put(x1);
 415                 x1 = NULL;
 416                 err = -EEXIST;
 417                 goto out;
 418         }
 419
 420         __xfrm_state_insert(x);
 421         err = 0;
 422
 423 out:
 424         spin_unlock_bh(&xfrm_state_lock);
 425         xfrm_state_put_afinfo(afinfo);
 426
 427         if (x1) {
 428                 xfrm_state_delete(x1);
 429                 xfrm_state_put(x1);
 430         }
 431
 432         return err;
 433 }
 434
 435 int xfrm_state_update(struct xfrm_state *x)
 436 {
 437         struct xfrm_state_afinfo *afinfo;
 438         struct xfrm_state *x1;
 439         int err;
 440
 441         afinfo = xfrm_state_get_afinfo(x->props.family);
 442         if (unlikely(afinfo == NULL))
 443                 return -EAFNOSUPPORT;
 444
 445         spin_lock_bh(&xfrm_state_lock);
 446         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 447
 448         err = -ESRCH;
 449         if (!x1)
 450                 goto out;
 451
 452         if (xfrm_state_kern(x1)) {
 453                 xfrm_state_put(x1);
 454                 err = -EEXIST;
 455                 goto out;
 456         }
 457
 458         if (x1->km.state == XFRM_STATE_ACQ) {
 459                 __xfrm_state_insert(x);
 460                 x = NULL;
 461         }
 462         err = 0;
 463
 464 out:
 465         spin_unlock_bh(&xfrm_state_lock);
 466         xfrm_state_put_afinfo(afinfo);
 467
 468         if (err)
 469                 return err;
 470
 471         if (!x) {
 472                 xfrm_state_delete(x1);
 473                 xfrm_state_put(x1);
 474                 return 0;
 475         }
 476
 477         err = -EINVAL;
 478         spin_lock_bh(&x1->lock);
 479         if (likely(x1->km.state == XFRM_STATE_VALID)) {
 480                 if (x->encap && x1->encap)
 481                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
 482                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
 483                 x1->km.dying = 0;
 484
 485                 if (!mod_timer(&x1->timer, jiffies + HZ))
 486                         xfrm_state_hold(x1);
 487                 if (x1->curlft.use_time)
 488                         xfrm_state_check_expire(x1);
 489
 490                 err = 0;
 491         }
 492         spin_unlock_bh(&x1->lock);
 493
 494         xfrm_state_put(x1);
 495
 496         return err;
 497 }
 498
 499 int xfrm_state_check_expire(struct xfrm_state *x)
 500 {
 501         if (!x->curlft.use_time)
 502                 x->curlft.use_time = (unsigned long)xtime.tv_sec;
 503
 504         if (x->km.state != XFRM_STATE_VALID)
 505                 return -EINVAL;
 506
 507         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
 508             x->curlft.packets >= x->lft.hard_packet_limit) {
 509                 km_state_expired(x, 1);
 510                 if (!mod_timer(&x->timer, jiffies + XFRM_ACQ_EXPIRES*HZ))
 511                         xfrm_state_hold(x);
 512                 return -EINVAL;
 513         }
 514
 515         if (!x->km.dying &&
 516             (x->curlft.bytes >= x->lft.soft_byte_limit ||
 517              x->curlft.packets >= x->lft.soft_packet_limit))
 518                 km_state_expired(x, 0);
 519         return 0;
 520 }
 521
 522 int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
 523 {
 524         int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
 525                 - skb_headroom(skb);
 526
 527         if (nhead > 0)
 528                 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
 529
 530         /* Check tail too... */
 531         return 0;
 532 }
 533
 534 int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
 535 {
 536         int err = xfrm_state_check_expire(x);
 537         if (err < 0)
 538                 goto err;
 539         err = xfrm_state_check_space(x, skb);
 540 err:
 541         return err;
 542 }
 543
 544 struct xfrm_state *
 545 xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
 546                   unsigned short family)
 547 {
 548         struct xfrm_state *x;
 549         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 550         if (!afinfo)
 551                 return NULL;
 552
 553         spin_lock_bh(&xfrm_state_lock);
 554         x = afinfo->state_lookup(daddr, spi, proto);
 555         spin_unlock_bh(&xfrm_state_lock);
 556         xfrm_state_put_afinfo(afinfo);
 557         return x;
 558 }
 559
 560 struct xfrm_state *
 561 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 562               xfrm_address_t *daddr, xfrm_address_t *saddr,
 563               int create, unsigned short family)
 564 {
 565         struct xfrm_state *x;
 566         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 567         if (!afinfo)
 568                 return NULL;
 569
 570         spin_lock_bh(&xfrm_state_lock);
 571         x = afinfo->find_acq(mode, reqid, proto, daddr, saddr, create);
 572         spin_unlock_bh(&xfrm_state_lock);
 573         xfrm_state_put_afinfo(afinfo);
 574         return x;
 575 }
 576
 577 /* Silly enough, but I'm lazy to build resolution list */
 578
 579 struct xfrm_state * xfrm_find_acq_byseq(u32 seq)
 580 {
 581         int i;
 582         struct xfrm_state *x;
 583
 584         spin_lock_bh(&xfrm_state_lock);
 585         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 586                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 587                         if (x->km.seq == seq) {
 588                                 xfrm_state_hold(x);
 589                                 spin_unlock_bh(&xfrm_state_lock);
 590                                 return x;
 591                         }
 592                 }
 593         }
 594         spin_unlock_bh(&xfrm_state_lock);
 595         return NULL;
 596 }
 597
 598 u32 xfrm_get_acqseq(void)
 599 {
 600         u32 res;
 601         static u32 acqseq;
 602         static spinlock_t acqseq_lock = SPIN_LOCK_UNLOCKED;
 603
 604         spin_lock_bh(&acqseq_lock);
 605         res = (++acqseq ? : ++acqseq);
 606         spin_unlock_bh(&acqseq_lock);
 607         return res;
 608 }
 609
 610 void
 611 xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
 612 {
 613         u32 h;
 614         struct xfrm_state *x0;
 615
 616         if (x->id.spi)
 617                 return;
 618
 619         if (minspi == maxspi) {
 620                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
 621                 if (x0) {
 622                         xfrm_state_put(x0);
 623                         return;
 624                 }
 625                 x->id.spi = minspi;
 626         } else {
 627                 u32 spi = 0;
 628                 minspi = ntohl(minspi);
 629                 maxspi = ntohl(maxspi);
 630                 for (h=0; h<maxspi-minspi+1; h++) {
 631                         spi = minspi + net_random()%(maxspi-minspi+1);
 632                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
 633                         if (x0 == NULL)
 634                                 break;
 635                         xfrm_state_put(x0);
 636                 }
 637                 x->id.spi = htonl(spi);
 638         }
 639         if (x->id.spi) {
 640                 spin_lock_bh(&xfrm_state_lock);
 641                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 642                 list_add(&x->byspi, xfrm_state_byspi+h);
 643                 xfrm_state_hold(x);
 644                 spin_unlock_bh(&xfrm_state_lock);
 645                 wake_up(&km_waitq);
 646         }
 647 }
 648
 649 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
 650                     void *data)
 651 {
 652         int i;
 653         struct xfrm_state *x;
 654         int count = 0;
 655         int err = 0;
 656
 657         spin_lock_bh(&xfrm_state_lock);
 658         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 659                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 660                         if (proto == IPSEC_PROTO_ANY || x->id.proto == proto)
 661                                 count++;
 662                 }
 663         }
 664         if (count == 0) {
 665                 err = -ENOENT;
 666                 goto out;
 667         }
 668
 669         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 670                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 671                         if (proto != IPSEC_PROTO_ANY && x->id.proto != proto)
 672                                 continue;
 673                         err = func(x, --count, data);
 674                         if (err)
 675                                 goto out;
 676                 }
 677         }
 678 out:
 679         spin_unlock_bh(&xfrm_state_lock);
 680         return err;
 681 }
 682
 683
 684 int xfrm_replay_check(struct xfrm_state *x, u32 seq)
 685 {
 686         u32 diff;
 687
 688         seq = ntohl(seq);
 689
 690         if (unlikely(seq == 0))
 691                 return -EINVAL;
 692
 693         if (likely(seq > x->replay.seq))
 694                 return 0;
 695
 696         diff = x->replay.seq - seq;
 697         if (diff >= x->props.replay_window) {
 698                 x->stats.replay_window++;
 699                 return -EINVAL;
 700         }
 701
 702         if (x->replay.bitmap & (1U << diff)) {
 703                 x->stats.replay++;
 704                 return -EINVAL;
 705         }
 706         return 0;
 707 }
 708
 709 void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
 710 {
 711         u32 diff;
 712
 713         seq = ntohl(seq);
 714
 715         if (seq > x->replay.seq) {
 716                 diff = seq - x->replay.seq;
 717                 if (diff < x->props.replay_window)
 718                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
 719                 else
 720                         x->replay.bitmap = 1;
 721                 x->replay.seq = seq;
 722         } else {
 723                 diff = x->replay.seq - seq;
 724                 x->replay.bitmap |= (1U << diff);
 725         }
 726 }
 727
 728 int xfrm_check_selectors(struct xfrm_state **x, int n, struct flowi *fl)
 729 {
 730         int i;
 731
 732         for (i=0; i<n; i++) {
 733                 int match;
 734                 match = xfrm_selector_match(&x[i]->sel, fl, x[i]->props.family);
 735                 if (!match)
 736                         return -EINVAL;
 737         }
 738         return 0;
 739 }
 740
 741 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
 742 static rwlock_t         xfrm_km_lock = RW_LOCK_UNLOCKED;
 743
 744 void km_state_expired(struct xfrm_state *x, int hard)
 745 {
 746         struct xfrm_mgr *km;
 747
 748         if (hard)
 749                 x->km.state = XFRM_STATE_EXPIRED;
 750         else
 751                 x->km.dying = 1;
 752
 753         read_lock(&xfrm_km_lock);
 754         list_for_each_entry(km, &xfrm_km_list, list)
 755                 km->notify(x, hard);
 756         read_unlock(&xfrm_km_lock);
 757
 758         if (hard)
 759                 wake_up(&km_waitq);
 760 }
 761
 762 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 763 {
 764         int err = -EINVAL;
 765         struct xfrm_mgr *km;
 766
 767         read_lock(&xfrm_km_lock);
 768         list_for_each_entry(km, &xfrm_km_list, list) {
 769                 err = km->acquire(x, t, pol, XFRM_POLICY_OUT);
 770                 if (!err)
 771                         break;
 772         }
 773         read_unlock(&xfrm_km_lock);
 774         return err;
 775 }
 776
 777 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport)
 778 {
 779         int err = -EINVAL;
 780         struct xfrm_mgr *km;
 781
 782         read_lock(&xfrm_km_lock);
 783         list_for_each_entry(km, &xfrm_km_list, list) {
 784                 if (km->new_mapping)
 785                         err = km->new_mapping(x, ipaddr, sport);
 786                 if (!err)
 787                         break;
 788         }
 789         read_unlock(&xfrm_km_lock);
 790         return err;
 791 }
 792
 793 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard)
 794 {
 795         struct xfrm_mgr *km;
 796
 797         read_lock(&xfrm_km_lock);
 798         list_for_each_entry(km, &xfrm_km_list, list)
 799                 if (km->notify_policy)
 800                         km->notify_policy(pol, dir, hard);
 801         read_unlock(&xfrm_km_lock);
 802
 803         if (hard)
 804                 wake_up(&km_waitq);
 805 }
 806
 807 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 808 {
 809         int err;
 810         u8 *data;
 811         struct xfrm_mgr *km;
 812         struct xfrm_policy *pol = NULL;
 813
 814         if (optlen <= 0 || optlen > PAGE_SIZE)
 815                 return -EMSGSIZE;
 816
 817         data = kmalloc(optlen, GFP_KERNEL);
 818         if (!data)
 819                 return -ENOMEM;
 820
 821         err = -EFAULT;
 822         if (copy_from_user(data, optval, optlen))
 823                 goto out;
 824
 825         err = -EINVAL;
 826         read_lock(&xfrm_km_lock);
 827         list_for_each_entry(km, &xfrm_km_list, list) {
 828                 pol = km->compile_policy(sk->sk_family, optname, data,
 829                                          optlen, &err);
 830                 if (err >= 0)
 831                         break;
 832         }
 833         read_unlock(&xfrm_km_lock);
 834
 835         if (err >= 0) {
 836                 xfrm_sk_policy_insert(sk, err, pol);
 837                 xfrm_pol_put(pol);
 838                 err = 0;
 839         }
 840
 841 out:
 842         kfree(data);
 843         return err;
 844 }
 845
 846 int xfrm_register_km(struct xfrm_mgr *km)
 847 {
 848         write_lock_bh(&xfrm_km_lock);
 849         list_add_tail(&km->list, &xfrm_km_list);
 850         write_unlock_bh(&xfrm_km_lock);
 851         return 0;
 852 }
 853
 854 int xfrm_unregister_km(struct xfrm_mgr *km)
 855 {
 856         write_lock_bh(&xfrm_km_lock);
 857         list_del(&km->list);
 858         write_unlock_bh(&xfrm_km_lock);
 859         return 0;
 860 }
 861
 862 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
 863 {
 864         int err = 0;
 865         if (unlikely(afinfo == NULL))
 866                 return -EINVAL;
 867         if (unlikely(afinfo->family >= NPROTO))
 868                 return -EAFNOSUPPORT;
 869         write_lock(&xfrm_state_afinfo_lock);
 870         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
 871                 err = -ENOBUFS;
 872         else {
 873                 afinfo->state_bydst = xfrm_state_bydst;
 874                 afinfo->state_byspi = xfrm_state_byspi;
 875                 xfrm_state_afinfo[afinfo->family] = afinfo;
 876         }
 877         write_unlock(&xfrm_state_afinfo_lock);
 878         return err;
 879 }
 880
 881 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
 882 {
 883         int err = 0;
 884         if (unlikely(afinfo == NULL))
 885                 return -EINVAL;
 886         if (unlikely(afinfo->family >= NPROTO))
 887                 return -EAFNOSUPPORT;
 888         write_lock(&xfrm_state_afinfo_lock);
 889         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
 890                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
 891                         err = -EINVAL;
 892                 else {
 893                         xfrm_state_afinfo[afinfo->family] = NULL;
 894                         afinfo->state_byspi = NULL;
 895                         afinfo->state_bydst = NULL;
 896                 }
 897         }
 898         write_unlock(&xfrm_state_afinfo_lock);
 899         return err;
 900 }
 901
 902 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
 903 {
 904         struct xfrm_state_afinfo *afinfo;
 905         if (unlikely(family >= NPROTO))
 906                 return NULL;
 907         read_lock(&xfrm_state_afinfo_lock);
 908         afinfo = xfrm_state_afinfo[family];
 909         if (likely(afinfo != NULL))
 910                 read_lock(&afinfo->lock);
 911         read_unlock(&xfrm_state_afinfo_lock);
 912         return afinfo;
 913 }
 914
 915 void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
 916 {
 917         if (unlikely(afinfo == NULL))
 918                 return;
 919         read_unlock(&afinfo->lock);
 920 }
 921
 922 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
 923 void xfrm_state_delete_tunnel(struct xfrm_state *x)
 924 {
 925         if (x->tunnel) {
 926                 struct xfrm_state *t = x->tunnel;
 927
 928                 if (atomic_read(&t->tunnel_users) == 2)
 929                         xfrm_state_delete(t);
 930                 atomic_dec(&t->tunnel_users);
 931                 xfrm_state_put(t);
 932                 x->tunnel = NULL;
 933         }
 934 }
 935
 936 void __init xfrm_state_init(void)
 937 {
 938         int i;
 939
 940         for (i=0; i<XFRM_DST_HSIZE; i++) {
 941                 INIT_LIST_HEAD(&xfrm_state_bydst[i]);
 942                 INIT_LIST_HEAD(&xfrm_state_byspi[i]);
 943         }
 944         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task, NULL);
 945 }
 946