net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <asm/uaccess.h>
  21
  22 /* Each xfrm_state may be linked to two tables:
  23
  24    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  25    2. Hash table by daddr to find what SAs exist for given
  26       destination/tunnel endpoint. (output)
  27  */
  28
  29 static spinlock_t xfrm_state_lock = SPIN_LOCK_UNLOCKED;
  30
  31 /* Hash table to find appropriate SA towards given target (endpoint
  32  * of tunnel or destination of transport mode) allowed by selector.
  33  *
  34  * Main use is finding SA after policy selected tunnel or transport mode.
  35  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  36  */
  37 static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE];
  38 static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE];
  39
  40 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
  41
  42 static rwlock_t xfrm_state_afinfo_lock = RW_LOCK_UNLOCKED;
  43 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
  44
  45 static struct work_struct xfrm_state_gc_work;
  46 static struct list_head xfrm_state_gc_list = LIST_HEAD_INIT(xfrm_state_gc_list);
  47 static spinlock_t xfrm_state_gc_lock = SPIN_LOCK_UNLOCKED;
  48
  49 static void __xfrm_state_delete(struct xfrm_state *x);
  50
  51 static void xfrm_state_gc_destroy(struct xfrm_state *x)
  52 {
  53         if (del_timer(&x->timer))
  54                 BUG();
  55         if (x->aalg)
  56                 kfree(x->aalg);
  57         if (x->ealg)
  58                 kfree(x->ealg);
  59         if (x->calg)
  60                 kfree(x->calg);
  61         if (x->encap)
  62                 kfree(x->encap);
  63         if (x->type) {
  64                 x->type->destructor(x);
  65                 xfrm_put_type(x->type);
  66         }
  67         kfree(x);
  68         wake_up(&km_waitq);
  69 }
  70
  71 static void xfrm_state_gc_task(void *data)
  72 {
  73         struct xfrm_state *x;
  74         struct list_head *entry, *tmp;
  75         struct list_head gc_list = LIST_HEAD_INIT(gc_list);
  76
  77         spin_lock_bh(&xfrm_state_gc_lock);
  78         list_splice_init(&xfrm_state_gc_list, &gc_list);
  79         spin_unlock_bh(&xfrm_state_gc_lock);
  80
  81         list_for_each_safe(entry, tmp, &gc_list) {
  82                 x = list_entry(entry, struct xfrm_state, bydst);
  83                 xfrm_state_gc_destroy(x);
  84         }
  85 }
  86
  87 static inline unsigned long make_jiffies(long secs)
  88 {
  89         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
  90                 return MAX_SCHEDULE_TIMEOUT-1;
  91         else
  92                 return secs*HZ;
  93 }
  94
  95 static void xfrm_timer_handler(unsigned long data)
  96 {
  97         struct xfrm_state *x = (struct xfrm_state*)data;
  98         unsigned long now = (unsigned long)xtime.tv_sec;
  99         long next = LONG_MAX;
 100         int warn = 0;
 101
 102         spin_lock(&x->lock);
 103         if (x->km.state == XFRM_STATE_DEAD)
 104                 goto out;
 105         if (x->km.state == XFRM_STATE_EXPIRED)
 106                 goto expired;
 107         if (x->lft.hard_add_expires_seconds) {
 108                 long tmo = x->lft.hard_add_expires_seconds +
 109                         x->curlft.add_time - now;
 110                 if (tmo <= 0)
 111                         goto expired;
 112                 if (tmo < next)
 113                         next = tmo;
 114         }
 115         if (x->lft.hard_use_expires_seconds) {
 116                 long tmo = x->lft.hard_use_expires_seconds +
 117                         (x->curlft.use_time ? : now) - now;
 118                 if (tmo <= 0)
 119                         goto expired;
 120                 if (tmo < next)
 121                         next = tmo;
 122         }
 123         if (x->km.dying)
 124                 goto resched;
 125         if (x->lft.soft_add_expires_seconds) {
 126                 long tmo = x->lft.soft_add_expires_seconds +
 127                         x->curlft.add_time - now;
 128                 if (tmo <= 0)
 129                         warn = 1;
 130                 else if (tmo < next)
 131                         next = tmo;
 132         }
 133         if (x->lft.soft_use_expires_seconds) {
 134                 long tmo = x->lft.soft_use_expires_seconds +
 135                         (x->curlft.use_time ? : now) - now;
 136                 if (tmo <= 0)
 137                         warn = 1;
 138                 else if (tmo < next)
 139                         next = tmo;
 140         }
 141
 142         if (warn)
 143                 km_state_expired(x, 0);
 144 resched:
 145         if (next != LONG_MAX &&
 146             !mod_timer(&x->timer, jiffies + make_jiffies(next)))
 147                 xfrm_state_hold(x);
 148         goto out;
 149
 150 expired:
 151         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 152                 x->km.state = XFRM_STATE_EXPIRED;
 153                 wake_up(&km_waitq);
 154                 next = 2;
 155                 goto resched;
 156         }
 157         if (x->id.spi != 0)
 158                 km_state_expired(x, 1);
 159         __xfrm_state_delete(x);
 160
 161 out:
 162         spin_unlock(&x->lock);
 163         xfrm_state_put(x);
 164 }
 165
 166 struct xfrm_state *xfrm_state_alloc(void)
 167 {
 168         struct xfrm_state *x;
 169
 170         x = kmalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 171
 172         if (x) {
 173                 memset(x, 0, sizeof(struct xfrm_state));
 174                 atomic_set(&x->refcnt, 1);
 175                 atomic_set(&x->tunnel_users, 0);
 176                 INIT_LIST_HEAD(&x->bydst);
 177                 INIT_LIST_HEAD(&x->byspi);
 178                 init_timer(&x->timer);
 179                 x->timer.function = xfrm_timer_handler;
 180                 x->timer.data     = (unsigned long)x;
 181                 x->curlft.add_time = (unsigned long)xtime.tv_sec;
 182                 x->lft.soft_byte_limit = XFRM_INF;
 183                 x->lft.soft_packet_limit = XFRM_INF;
 184                 x->lft.hard_byte_limit = XFRM_INF;
 185                 x->lft.hard_packet_limit = XFRM_INF;
 186                 x->lock = SPIN_LOCK_UNLOCKED;
 187         }
 188         return x;
 189 }
 190
 191 void __xfrm_state_destroy(struct xfrm_state *x)
 192 {
 193         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 194
 195         spin_lock_bh(&xfrm_state_gc_lock);
 196         list_add(&x->bydst, &xfrm_state_gc_list);
 197         spin_unlock_bh(&xfrm_state_gc_lock);
 198         schedule_work(&xfrm_state_gc_work);
 199 }
 200
 201 static void __xfrm_state_delete(struct xfrm_state *x)
 202 {
 203         if (x->km.state != XFRM_STATE_DEAD) {
 204                 x->km.state = XFRM_STATE_DEAD;
 205                 spin_lock(&xfrm_state_lock);
 206                 list_del(&x->bydst);
 207                 atomic_dec(&x->refcnt);
 208                 if (x->id.spi) {
 209                         list_del(&x->byspi);
 210                         atomic_dec(&x->refcnt);
 211                 }
 212                 spin_unlock(&xfrm_state_lock);
 213                 if (del_timer(&x->timer))
 214                         atomic_dec(&x->refcnt);
 215
 216                 /* The number two in this test is the reference
 217                  * mentioned in the comment below plus the reference
 218                  * our caller holds.  A larger value means that
 219                  * there are DSTs attached to this xfrm_state.
 220                  */
 221                 if (atomic_read(&x->refcnt) > 2)
 222                         xfrm_flush_bundles();
 223
 224                 /* All xfrm_state objects are created by xfrm_state_alloc.
 225                  * The xfrm_state_alloc call gives a reference, and that
 226                  * is what we are dropping here.
 227                  */
 228                 atomic_dec(&x->refcnt);
 229         }
 230 }
 231
 232 void xfrm_state_delete(struct xfrm_state *x)
 233 {
 234         xfrm_state_delete_tunnel(x);
 235         spin_lock_bh(&x->lock);
 236         __xfrm_state_delete(x);
 237         spin_unlock_bh(&x->lock);
 238 }
 239
 240 void xfrm_state_flush(u8 proto)
 241 {
 242         int i;
 243         struct xfrm_state *x;
 244
 245         spin_lock_bh(&xfrm_state_lock);
 246         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 247 restart:
 248                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 249                         if (!xfrm_state_kern(x) &&
 250                             (proto == IPSEC_PROTO_ANY || x->id.proto == proto)) {
 251                                 xfrm_state_hold(x);
 252                                 spin_unlock_bh(&xfrm_state_lock);
 253
 254                                 xfrm_state_delete(x);
 255                                 xfrm_state_put(x);
 256
 257                                 spin_lock_bh(&xfrm_state_lock);
 258                                 goto restart;
 259                         }
 260                 }
 261         }
 262         spin_unlock_bh(&xfrm_state_lock);
 263         wake_up(&km_waitq);
 264 }
 265
 266 static int
 267 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 268                   struct xfrm_tmpl *tmpl,
 269                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 270                   unsigned short family)
 271 {
 272         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 273         if (!afinfo)
 274                 return -1;
 275         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 276         xfrm_state_put_afinfo(afinfo);
 277         return 0;
 278 }
 279
 280 struct xfrm_state *
 281 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 282                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 283                 struct xfrm_policy *pol, int *err,
 284                 unsigned short family)
 285 {
 286         unsigned h = xfrm_dst_hash(daddr, family);
 287         struct xfrm_state *x;
 288         int acquire_in_progress = 0;
 289         int error = 0;
 290         struct xfrm_state *best = NULL;
 291
 292         spin_lock_bh(&xfrm_state_lock);
 293         list_for_each_entry(x, xfrm_state_bydst+h, bydst) {
 294                 if (x->props.family == family &&
 295                     x->props.reqid == tmpl->reqid &&
 296                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 297                     tmpl->mode == x->props.mode &&
 298                     tmpl->id.proto == x->id.proto) {
 299                         /* Resolution logic:
 300                            1. There is a valid state with matching selector.
 301                               Done.
 302                            2. Valid state with inappropriate selector. Skip.
 303
 304                            Entering area of "sysdeps".
 305
 306                            3. If state is not valid, selector is temporary,
 307                               it selects only session which triggered
 308                               previous resolution. Key manager will do
 309                               something to install a state with proper
 310                               selector.
 311                          */
 312                         if (x->km.state == XFRM_STATE_VALID) {
 313                                 if (!xfrm_selector_match(&x->sel, fl, family))
 314                                         continue;
 315                                 if (!best ||
 316                                     best->km.dying > x->km.dying ||
 317                                     (best->km.dying == x->km.dying &&
 318                                      best->curlft.add_time < x->curlft.add_time))
 319                                         best = x;
 320                         } else if (x->km.state == XFRM_STATE_ACQ) {
 321                                 acquire_in_progress = 1;
 322                         } else if (x->km.state == XFRM_STATE_ERROR ||
 323                                    x->km.state == XFRM_STATE_EXPIRED) {
 324                                 if (xfrm_selector_match(&x->sel, fl, family))
 325                                         error = 1;
 326                         }
 327                 }
 328         }
 329
 330         x = best;
 331         if (!x && !error && !acquire_in_progress &&
 332             ((x = xfrm_state_alloc()) != NULL)) {
 333                 /* Initialize temporary selector matching only
 334                  * to current session. */
 335                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 336
 337                 if (km_query(x, tmpl, pol) == 0) {
 338                         x->km.state = XFRM_STATE_ACQ;
 339                         list_add_tail(&x->bydst, xfrm_state_bydst+h);
 340                         xfrm_state_hold(x);
 341                         if (x->id.spi) {
 342                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 343                                 list_add(&x->byspi, xfrm_state_byspi+h);
 344                                 xfrm_state_hold(x);
 345                         }
 346                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
 347                         xfrm_state_hold(x);
 348                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
 349                         add_timer(&x->timer);
 350                 } else {
 351                         x->km.state = XFRM_STATE_DEAD;
 352                         xfrm_state_put(x);
 353                         x = NULL;
 354                         error = 1;
 355                 }
 356         }
 357         if (x)
 358                 xfrm_state_hold(x);
 359         else
 360                 *err = acquire_in_progress ? -EAGAIN :
 361                         (error ? -ESRCH : -ENOMEM);
 362         spin_unlock_bh(&xfrm_state_lock);
 363         return x;
 364 }
 365
 366 static void __xfrm_state_insert(struct xfrm_state *x)
 367 {
 368         unsigned h = xfrm_dst_hash(&x->id.daddr, x->props.family);
 369
 370         list_add(&x->bydst, xfrm_state_bydst+h);
 371         xfrm_state_hold(x);
 372
 373         h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 374
 375         list_add(&x->byspi, xfrm_state_byspi+h);
 376         xfrm_state_hold(x);
 377
 378         if (!mod_timer(&x->timer, jiffies + HZ))
 379                 xfrm_state_hold(x);
 380
 381         wake_up(&km_waitq);
 382 }
 383
 384 void xfrm_state_insert(struct xfrm_state *x)
 385 {
 386         spin_lock_bh(&xfrm_state_lock);
 387         __xfrm_state_insert(x);
 388         spin_unlock_bh(&xfrm_state_lock);
 389 }
 390
 391 int xfrm_state_add(struct xfrm_state *x)
 392 {
 393         struct xfrm_state_afinfo *afinfo;
 394         struct xfrm_state *x1;
 395         int err;
 396
 397         afinfo = xfrm_state_get_afinfo(x->props.family);
 398         if (unlikely(afinfo == NULL))
 399                 return -EAFNOSUPPORT;
 400
 401         spin_lock_bh(&xfrm_state_lock);
 402
 403         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 404         if (!x1) {
 405                 x1 = afinfo->find_acq(
 406                         x->props.mode, x->props.reqid, x->id.proto,
 407                         &x->id.daddr, &x->props.saddr, 0);
 408                 if (x1 && x1->id.spi != x->id.spi && x1->id.spi) {
 409                         xfrm_state_put(x1);
 410                         x1 = NULL;
 411                 }
 412         }
 413
 414         if (x1 && x1->id.spi) {
 415                 xfrm_state_put(x1);
 416                 x1 = NULL;
 417                 err = -EEXIST;
 418                 goto out;
 419         }
 420
 421         __xfrm_state_insert(x);
 422         err = 0;
 423
 424 out:
 425         spin_unlock_bh(&xfrm_state_lock);
 426         xfrm_state_put_afinfo(afinfo);
 427
 428         if (x1) {
 429                 xfrm_state_delete(x1);
 430                 xfrm_state_put(x1);
 431         }
 432
 433         return err;
 434 }
 435
 436 int xfrm_state_update(struct xfrm_state *x)
 437 {
 438         struct xfrm_state_afinfo *afinfo;
 439         struct xfrm_state *x1;
 440         int err;
 441
 442         afinfo = xfrm_state_get_afinfo(x->props.family);
 443         if (unlikely(afinfo == NULL))
 444                 return -EAFNOSUPPORT;
 445
 446         spin_lock_bh(&xfrm_state_lock);
 447         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 448
 449         err = -ESRCH;
 450         if (!x1)
 451                 goto out;
 452
 453         if (xfrm_state_kern(x1)) {
 454                 xfrm_state_put(x1);
 455                 err = -EEXIST;
 456                 goto out;
 457         }
 458
 459         if (x1->km.state == XFRM_STATE_ACQ) {
 460                 __xfrm_state_insert(x);
 461                 x = NULL;
 462         }
 463         err = 0;
 464
 465 out:
 466         spin_unlock_bh(&xfrm_state_lock);
 467         xfrm_state_put_afinfo(afinfo);
 468
 469         if (err)
 470                 return err;
 471
 472         if (!x) {
 473                 xfrm_state_delete(x1);
 474                 xfrm_state_put(x1);
 475                 return 0;
 476         }
 477
 478         err = -EINVAL;
 479         spin_lock_bh(&x1->lock);
 480         if (likely(x1->km.state == XFRM_STATE_VALID)) {
 481                 if (x->encap && x1->encap)
 482                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
 483                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
 484                 x1->km.dying = 0;
 485
 486                 if (!mod_timer(&x1->timer, jiffies + HZ))
 487                         xfrm_state_hold(x1);
 488                 if (x1->curlft.use_time)
 489                         xfrm_state_check_expire(x1);
 490
 491                 err = 0;
 492         }
 493         spin_unlock_bh(&x1->lock);
 494
 495         xfrm_state_put(x1);
 496
 497         return err;
 498 }
 499
 500 int xfrm_state_check_expire(struct xfrm_state *x)
 501 {
 502         if (!x->curlft.use_time)
 503                 x->curlft.use_time = (unsigned long)xtime.tv_sec;
 504
 505         if (x->km.state != XFRM_STATE_VALID)
 506                 return -EINVAL;
 507
 508         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
 509             x->curlft.packets >= x->lft.hard_packet_limit) {
 510                 km_state_expired(x, 1);
 511                 if (!mod_timer(&x->timer, jiffies + XFRM_ACQ_EXPIRES*HZ))
 512                         xfrm_state_hold(x);
 513                 return -EINVAL;
 514         }
 515
 516         if (!x->km.dying &&
 517             (x->curlft.bytes >= x->lft.soft_byte_limit ||
 518              x->curlft.packets >= x->lft.soft_packet_limit))
 519                 km_state_expired(x, 0);
 520         return 0;
 521 }
 522
 523 int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
 524 {
 525         int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
 526                 - skb_headroom(skb);
 527
 528         if (nhead > 0)
 529                 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
 530
 531         /* Check tail too... */
 532         return 0;
 533 }
 534
 535 struct xfrm_state *
 536 xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
 537                   unsigned short family)
 538 {
 539         struct xfrm_state *x;
 540         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 541         if (!afinfo)
 542                 return NULL;
 543
 544         spin_lock_bh(&xfrm_state_lock);
 545         x = afinfo->state_lookup(daddr, spi, proto);
 546         spin_unlock_bh(&xfrm_state_lock);
 547         xfrm_state_put_afinfo(afinfo);
 548         return x;
 549 }
 550
 551 struct xfrm_state *
 552 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 553               xfrm_address_t *daddr, xfrm_address_t *saddr,
 554               int create, unsigned short family)
 555 {
 556         struct xfrm_state *x;
 557         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 558         if (!afinfo)
 559                 return NULL;
 560
 561         spin_lock_bh(&xfrm_state_lock);
 562         x = afinfo->find_acq(mode, reqid, proto, daddr, saddr, create);
 563         spin_unlock_bh(&xfrm_state_lock);
 564         xfrm_state_put_afinfo(afinfo);
 565         return x;
 566 }
 567
 568 /* Silly enough, but I'm lazy to build resolution list */
 569
 570 struct xfrm_state * xfrm_find_acq_byseq(u32 seq)
 571 {
 572         int i;
 573         struct xfrm_state *x;
 574
 575         spin_lock_bh(&xfrm_state_lock);
 576         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 577                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 578                         if (x->km.seq == seq) {
 579                                 xfrm_state_hold(x);
 580                                 spin_unlock_bh(&xfrm_state_lock);
 581                                 return x;
 582                         }
 583                 }
 584         }
 585         spin_unlock_bh(&xfrm_state_lock);
 586         return NULL;
 587 }
 588
 589 u32 xfrm_get_acqseq(void)
 590 {
 591         u32 res;
 592         static u32 acqseq;
 593         static spinlock_t acqseq_lock = SPIN_LOCK_UNLOCKED;
 594
 595         spin_lock_bh(&acqseq_lock);
 596         res = (++acqseq ? : ++acqseq);
 597         spin_unlock_bh(&acqseq_lock);
 598         return res;
 599 }
 600
 601 void
 602 xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
 603 {
 604         u32 h;
 605         struct xfrm_state *x0;
 606
 607         if (x->id.spi)
 608                 return;
 609
 610         if (minspi == maxspi) {
 611                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
 612                 if (x0) {
 613                         xfrm_state_put(x0);
 614                         return;
 615                 }
 616                 x->id.spi = minspi;
 617         } else {
 618                 u32 spi = 0;
 619                 minspi = ntohl(minspi);
 620                 maxspi = ntohl(maxspi);
 621                 for (h=0; h<maxspi-minspi+1; h++) {
 622                         spi = minspi + net_random()%(maxspi-minspi+1);
 623                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
 624                         if (x0 == NULL)
 625                                 break;
 626                         xfrm_state_put(x0);
 627                 }
 628                 x->id.spi = htonl(spi);
 629         }
 630         if (x->id.spi) {
 631                 spin_lock_bh(&xfrm_state_lock);
 632                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 633                 list_add(&x->byspi, xfrm_state_byspi+h);
 634                 xfrm_state_hold(x);
 635                 spin_unlock_bh(&xfrm_state_lock);
 636                 wake_up(&km_waitq);
 637         }
 638 }
 639
 640 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
 641                     void *data)
 642 {
 643         int i;
 644         struct xfrm_state *x;
 645         int count = 0;
 646         int err = 0;
 647
 648         spin_lock_bh(&xfrm_state_lock);
 649         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 650                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 651                         if (proto == IPSEC_PROTO_ANY || x->id.proto == proto)
 652                                 count++;
 653                 }
 654         }
 655         if (count == 0) {
 656                 err = -ENOENT;
 657                 goto out;
 658         }
 659
 660         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 661                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 662                         if (proto != IPSEC_PROTO_ANY && x->id.proto != proto)
 663                                 continue;
 664                         err = func(x, --count, data);
 665                         if (err)
 666                                 goto out;
 667                 }
 668         }
 669 out:
 670         spin_unlock_bh(&xfrm_state_lock);
 671         return err;
 672 }
 673
 674
 675 int xfrm_replay_check(struct xfrm_state *x, u32 seq)
 676 {
 677         u32 diff;
 678
 679         seq = ntohl(seq);
 680
 681         if (unlikely(seq == 0))
 682                 return -EINVAL;
 683
 684         if (likely(seq > x->replay.seq))
 685                 return 0;
 686
 687         diff = x->replay.seq - seq;
 688         if (diff >= x->props.replay_window) {
 689                 x->stats.replay_window++;
 690                 return -EINVAL;
 691         }
 692
 693         if (x->replay.bitmap & (1U << diff)) {
 694                 x->stats.replay++;
 695                 return -EINVAL;
 696         }
 697         return 0;
 698 }
 699
 700 void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
 701 {
 702         u32 diff;
 703
 704         seq = ntohl(seq);
 705
 706         if (seq > x->replay.seq) {
 707                 diff = seq - x->replay.seq;
 708                 if (diff < x->props.replay_window)
 709                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
 710                 else
 711                         x->replay.bitmap = 1;
 712                 x->replay.seq = seq;
 713         } else {
 714                 diff = x->replay.seq - seq;
 715                 x->replay.bitmap |= (1U << diff);
 716         }
 717 }
 718
 719 int xfrm_check_selectors(struct xfrm_state **x, int n, struct flowi *fl)
 720 {
 721         int i;
 722
 723         for (i=0; i<n; i++) {
 724                 int match;
 725                 match = xfrm_selector_match(&x[i]->sel, fl, x[i]->props.family);
 726                 if (!match)
 727                         return -EINVAL;
 728         }
 729         return 0;
 730 }
 731
 732 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
 733 static rwlock_t         xfrm_km_lock = RW_LOCK_UNLOCKED;
 734
 735 void km_state_expired(struct xfrm_state *x, int hard)
 736 {
 737         struct xfrm_mgr *km;
 738
 739         if (hard)
 740                 x->km.state = XFRM_STATE_EXPIRED;
 741         else
 742                 x->km.dying = 1;
 743
 744         read_lock(&xfrm_km_lock);
 745         list_for_each_entry(km, &xfrm_km_list, list)
 746                 km->notify(x, hard);
 747         read_unlock(&xfrm_km_lock);
 748
 749         if (hard)
 750                 wake_up(&km_waitq);
 751 }
 752
 753 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 754 {
 755         int err = -EINVAL;
 756         struct xfrm_mgr *km;
 757
 758         read_lock(&xfrm_km_lock);
 759         list_for_each_entry(km, &xfrm_km_list, list) {
 760                 err = km->acquire(x, t, pol, XFRM_POLICY_OUT);
 761                 if (!err)
 762                         break;
 763         }
 764         read_unlock(&xfrm_km_lock);
 765         return err;
 766 }
 767
 768 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport)
 769 {
 770         int err = -EINVAL;
 771         struct xfrm_mgr *km;
 772
 773         read_lock(&xfrm_km_lock);
 774         list_for_each_entry(km, &xfrm_km_list, list) {
 775                 if (km->new_mapping)
 776                         err = km->new_mapping(x, ipaddr, sport);
 777                 if (!err)
 778                         break;
 779         }
 780         read_unlock(&xfrm_km_lock);
 781         return err;
 782 }
 783
 784 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard)
 785 {
 786         struct xfrm_mgr *km;
 787
 788         read_lock(&xfrm_km_lock);
 789         list_for_each_entry(km, &xfrm_km_list, list)
 790                 if (km->notify_policy)
 791                         km->notify_policy(pol, dir, hard);
 792         read_unlock(&xfrm_km_lock);
 793
 794         if (hard)
 795                 wake_up(&km_waitq);
 796 }
 797
 798 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 799 {
 800         int err;
 801         u8 *data;
 802         struct xfrm_mgr *km;
 803         struct xfrm_policy *pol = NULL;
 804
 805         if (optlen <= 0 || optlen > PAGE_SIZE)
 806                 return -EMSGSIZE;
 807
 808         data = kmalloc(optlen, GFP_KERNEL);
 809         if (!data)
 810                 return -ENOMEM;
 811
 812         err = -EFAULT;
 813         if (copy_from_user(data, optval, optlen))
 814                 goto out;
 815
 816         err = -EINVAL;
 817         read_lock(&xfrm_km_lock);
 818         list_for_each_entry(km, &xfrm_km_list, list) {
 819                 pol = km->compile_policy(sk->sk_family, optname, data,
 820                                          optlen, &err);
 821                 if (err >= 0)
 822                         break;
 823         }
 824         read_unlock(&xfrm_km_lock);
 825
 826         if (err >= 0) {
 827                 xfrm_sk_policy_insert(sk, err, pol);
 828                 xfrm_pol_put(pol);
 829                 err = 0;
 830         }
 831
 832 out:
 833         kfree(data);
 834         return err;
 835 }
 836
 837 int xfrm_register_km(struct xfrm_mgr *km)
 838 {
 839         write_lock_bh(&xfrm_km_lock);
 840         list_add_tail(&km->list, &xfrm_km_list);
 841         write_unlock_bh(&xfrm_km_lock);
 842         return 0;
 843 }
 844
 845 int xfrm_unregister_km(struct xfrm_mgr *km)
 846 {
 847         write_lock_bh(&xfrm_km_lock);
 848         list_del(&km->list);
 849         write_unlock_bh(&xfrm_km_lock);
 850         return 0;
 851 }
 852
 853 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
 854 {
 855         int err = 0;
 856         if (unlikely(afinfo == NULL))
 857                 return -EINVAL;
 858         if (unlikely(afinfo->family >= NPROTO))
 859                 return -EAFNOSUPPORT;
 860         write_lock(&xfrm_state_afinfo_lock);
 861         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
 862                 err = -ENOBUFS;
 863         else {
 864                 afinfo->state_bydst = xfrm_state_bydst;
 865                 afinfo->state_byspi = xfrm_state_byspi;
 866                 xfrm_state_afinfo[afinfo->family] = afinfo;
 867         }
 868         write_unlock(&xfrm_state_afinfo_lock);
 869         return err;
 870 }
 871
 872 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
 873 {
 874         int err = 0;
 875         if (unlikely(afinfo == NULL))
 876                 return -EINVAL;
 877         if (unlikely(afinfo->family >= NPROTO))
 878                 return -EAFNOSUPPORT;
 879         write_lock(&xfrm_state_afinfo_lock);
 880         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
 881                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
 882                         err = -EINVAL;
 883                 else {
 884                         xfrm_state_afinfo[afinfo->family] = NULL;
 885                         afinfo->state_byspi = NULL;
 886                         afinfo->state_bydst = NULL;
 887                 }
 888         }
 889         write_unlock(&xfrm_state_afinfo_lock);
 890         return err;
 891 }
 892
 893 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
 894 {
 895         struct xfrm_state_afinfo *afinfo;
 896         if (unlikely(family >= NPROTO))
 897                 return NULL;
 898         read_lock(&xfrm_state_afinfo_lock);
 899         afinfo = xfrm_state_afinfo[family];
 900         if (likely(afinfo != NULL))
 901                 read_lock(&afinfo->lock);
 902         read_unlock(&xfrm_state_afinfo_lock);
 903         return afinfo;
 904 }
 905
 906 void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
 907 {
 908         if (unlikely(afinfo == NULL))
 909                 return;
 910         read_unlock(&afinfo->lock);
 911 }
 912
 913 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
 914 void xfrm_state_delete_tunnel(struct xfrm_state *x)
 915 {
 916         if (x->tunnel) {
 917                 struct xfrm_state *t = x->tunnel;
 918
 919                 if (atomic_read(&t->tunnel_users) == 2)
 920                         xfrm_state_delete(t);
 921                 atomic_dec(&t->tunnel_users);
 922                 xfrm_state_put(t);
 923                 x->tunnel = NULL;
 924         }
 925 }
 926
 927 void __init xfrm_state_init(void)
 928 {
 929         int i;
 930
 931         for (i=0; i<XFRM_DST_HSIZE; i++) {
 932                 INIT_LIST_HEAD(&xfrm_state_bydst[i]);
 933                 INIT_LIST_HEAD(&xfrm_state_byspi[i]);
 934         }
 935         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task, NULL);
 936 }
 937