net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <asm/uaccess.h>
  22
  23 /* Each xfrm_state may be linked to two tables:
  24
  25    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  26    2. Hash table by daddr to find what SAs exist for given
  27       destination/tunnel endpoint. (output)
  28  */
  29
  30 static DEFINE_SPINLOCK(xfrm_state_lock);
  31
  32 /* Hash table to find appropriate SA towards given target (endpoint
  33  * of tunnel or destination of transport mode) allowed by selector.
  34  *
  35  * Main use is finding SA after policy selected tunnel or transport mode.
  36  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  37  */
  38 static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE];
  39 static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE];
  40
  41 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
  42 EXPORT_SYMBOL(km_waitq);
  43
  44 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
  45 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
  46
  47 static struct work_struct xfrm_state_gc_work;
  48 static struct list_head xfrm_state_gc_list = LIST_HEAD_INIT(xfrm_state_gc_list);
  49 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
  50
  51 static int xfrm_state_gc_flush_bundles;
  52
  53 static void __xfrm_state_delete(struct xfrm_state *x);
  54
  55 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family);
  56 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  57
  58 static int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
  59 static void km_state_expired(struct xfrm_state *x, int hard);
  60
  61 static void xfrm_state_gc_destroy(struct xfrm_state *x)
  62 {
  63         if (del_timer(&x->timer))
  64                 BUG();
  65         if (x->aalg)
  66                 kfree(x->aalg);
  67         if (x->ealg)
  68                 kfree(x->ealg);
  69         if (x->calg)
  70                 kfree(x->calg);
  71         if (x->encap)
  72                 kfree(x->encap);
  73         if (x->type) {
  74                 x->type->destructor(x);
  75                 xfrm_put_type(x->type);
  76         }
  77         kfree(x);
  78 }
  79
  80 static void xfrm_state_gc_task(void *data)
  81 {
  82         struct xfrm_state *x;
  83         struct list_head *entry, *tmp;
  84         struct list_head gc_list = LIST_HEAD_INIT(gc_list);
  85
  86         if (xfrm_state_gc_flush_bundles) {
  87                 xfrm_state_gc_flush_bundles = 0;
  88                 xfrm_flush_bundles();
  89         }
  90
  91         spin_lock_bh(&xfrm_state_gc_lock);
  92         list_splice_init(&xfrm_state_gc_list, &gc_list);
  93         spin_unlock_bh(&xfrm_state_gc_lock);
  94
  95         list_for_each_safe(entry, tmp, &gc_list) {
  96                 x = list_entry(entry, struct xfrm_state, bydst);
  97                 xfrm_state_gc_destroy(x);
  98         }
  99         wake_up(&km_waitq);
 100 }
 101
 102 static inline unsigned long make_jiffies(long secs)
 103 {
 104         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 105                 return MAX_SCHEDULE_TIMEOUT-1;
 106         else
 107                 return secs*HZ;
 108 }
 109
 110 static void xfrm_timer_handler(unsigned long data)
 111 {
 112         struct xfrm_state *x = (struct xfrm_state*)data;
 113         unsigned long now = (unsigned long)xtime.tv_sec;
 114         long next = LONG_MAX;
 115         int warn = 0;
 116
 117         spin_lock(&x->lock);
 118         if (x->km.state == XFRM_STATE_DEAD)
 119                 goto out;
 120         if (x->km.state == XFRM_STATE_EXPIRED)
 121                 goto expired;
 122         if (x->lft.hard_add_expires_seconds) {
 123                 long tmo = x->lft.hard_add_expires_seconds +
 124                         x->curlft.add_time - now;
 125                 if (tmo <= 0)
 126                         goto expired;
 127                 if (tmo < next)
 128                         next = tmo;
 129         }
 130         if (x->lft.hard_use_expires_seconds) {
 131                 long tmo = x->lft.hard_use_expires_seconds +
 132                         (x->curlft.use_time ? : now) - now;
 133                 if (tmo <= 0)
 134                         goto expired;
 135                 if (tmo < next)
 136                         next = tmo;
 137         }
 138         if (x->km.dying)
 139                 goto resched;
 140         if (x->lft.soft_add_expires_seconds) {
 141                 long tmo = x->lft.soft_add_expires_seconds +
 142                         x->curlft.add_time - now;
 143                 if (tmo <= 0)
 144                         warn = 1;
 145                 else if (tmo < next)
 146                         next = tmo;
 147         }
 148         if (x->lft.soft_use_expires_seconds) {
 149                 long tmo = x->lft.soft_use_expires_seconds +
 150                         (x->curlft.use_time ? : now) - now;
 151                 if (tmo <= 0)
 152                         warn = 1;
 153                 else if (tmo < next)
 154                         next = tmo;
 155         }
 156
 157         if (warn)
 158                 km_state_expired(x, 0);
 159 resched:
 160         if (next != LONG_MAX &&
 161             !mod_timer(&x->timer, jiffies + make_jiffies(next)))
 162                 xfrm_state_hold(x);
 163         goto out;
 164
 165 expired:
 166         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 167                 x->km.state = XFRM_STATE_EXPIRED;
 168                 wake_up(&km_waitq);
 169                 next = 2;
 170                 goto resched;
 171         }
 172         if (x->id.spi != 0)
 173                 km_state_expired(x, 1);
 174         __xfrm_state_delete(x);
 175
 176 out:
 177         spin_unlock(&x->lock);
 178         xfrm_state_put(x);
 179 }
 180
 181 struct xfrm_state *xfrm_state_alloc(void)
 182 {
 183         struct xfrm_state *x;
 184
 185         x = kmalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 186
 187         if (x) {
 188                 memset(x, 0, sizeof(struct xfrm_state));
 189                 atomic_set(&x->refcnt, 1);
 190                 atomic_set(&x->tunnel_users, 0);
 191                 INIT_LIST_HEAD(&x->bydst);
 192                 INIT_LIST_HEAD(&x->byspi);
 193                 init_timer(&x->timer);
 194                 x->timer.function = xfrm_timer_handler;
 195                 x->timer.data     = (unsigned long)x;
 196                 x->curlft.add_time = (unsigned long)xtime.tv_sec;
 197                 x->lft.soft_byte_limit = XFRM_INF;
 198                 x->lft.soft_packet_limit = XFRM_INF;
 199                 x->lft.hard_byte_limit = XFRM_INF;
 200                 x->lft.hard_packet_limit = XFRM_INF;
 201                 spin_lock_init(&x->lock);
 202         }
 203         return x;
 204 }
 205 EXPORT_SYMBOL(xfrm_state_alloc);
 206
 207 void __xfrm_state_destroy(struct xfrm_state *x)
 208 {
 209         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 210
 211         spin_lock_bh(&xfrm_state_gc_lock);
 212         list_add(&x->bydst, &xfrm_state_gc_list);
 213         spin_unlock_bh(&xfrm_state_gc_lock);
 214         schedule_work(&xfrm_state_gc_work);
 215 }
 216 EXPORT_SYMBOL(__xfrm_state_destroy);
 217
 218 static void __xfrm_state_delete(struct xfrm_state *x)
 219 {
 220         if (x->km.state != XFRM_STATE_DEAD) {
 221                 x->km.state = XFRM_STATE_DEAD;
 222                 spin_lock(&xfrm_state_lock);
 223                 list_del(&x->bydst);
 224                 atomic_dec(&x->refcnt);
 225                 if (x->id.spi) {
 226                         list_del(&x->byspi);
 227                         atomic_dec(&x->refcnt);
 228                 }
 229                 spin_unlock(&xfrm_state_lock);
 230                 if (del_timer(&x->timer))
 231                         atomic_dec(&x->refcnt);
 232
 233                 /* The number two in this test is the reference
 234                  * mentioned in the comment below plus the reference
 235                  * our caller holds.  A larger value means that
 236                  * there are DSTs attached to this xfrm_state.
 237                  */
 238                 if (atomic_read(&x->refcnt) > 2) {
 239                         xfrm_state_gc_flush_bundles = 1;
 240                         schedule_work(&xfrm_state_gc_work);
 241                 }
 242
 243                 /* All xfrm_state objects are created by xfrm_state_alloc.
 244                  * The xfrm_state_alloc call gives a reference, and that
 245                  * is what we are dropping here.
 246                  */
 247                 atomic_dec(&x->refcnt);
 248         }
 249 }
 250
 251 void xfrm_state_delete(struct xfrm_state *x)
 252 {
 253         spin_lock_bh(&x->lock);
 254         __xfrm_state_delete(x);
 255         spin_unlock_bh(&x->lock);
 256 }
 257 EXPORT_SYMBOL(xfrm_state_delete);
 258
 259 void xfrm_state_flush(u8 proto)
 260 {
 261         int i;
 262         struct xfrm_state *x;
 263
 264         spin_lock_bh(&xfrm_state_lock);
 265         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 266 restart:
 267                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 268                         if (!xfrm_state_kern(x) &&
 269                             (proto == IPSEC_PROTO_ANY || x->id.proto == proto)) {
 270                                 xfrm_state_hold(x);
 271                                 spin_unlock_bh(&xfrm_state_lock);
 272
 273                                 xfrm_state_delete(x);
 274                                 xfrm_state_put(x);
 275
 276                                 spin_lock_bh(&xfrm_state_lock);
 277                                 goto restart;
 278                         }
 279                 }
 280         }
 281         spin_unlock_bh(&xfrm_state_lock);
 282         wake_up(&km_waitq);
 283 }
 284 EXPORT_SYMBOL(xfrm_state_flush);
 285
 286 static int
 287 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 288                   struct xfrm_tmpl *tmpl,
 289                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 290                   unsigned short family)
 291 {
 292         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 293         if (!afinfo)
 294                 return -1;
 295         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 296         xfrm_state_put_afinfo(afinfo);
 297         return 0;
 298 }
 299
 300 struct xfrm_state *
 301 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 302                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 303                 struct xfrm_policy *pol, int *err,
 304                 unsigned short family)
 305 {
 306         unsigned h = xfrm_dst_hash(daddr, family);
 307         struct xfrm_state *x, *x0;
 308         int acquire_in_progress = 0;
 309         int error = 0;
 310         struct xfrm_state *best = NULL;
 311         struct xfrm_state_afinfo *afinfo;
 312
 313         afinfo = xfrm_state_get_afinfo(family);
 314         if (afinfo == NULL) {
 315                 *err = -EAFNOSUPPORT;
 316                 return NULL;
 317         }
 318
 319         spin_lock_bh(&xfrm_state_lock);
 320         list_for_each_entry(x, xfrm_state_bydst+h, bydst) {
 321                 if (x->props.family == family &&
 322                     x->props.reqid == tmpl->reqid &&
 323                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 324                     tmpl->mode == x->props.mode &&
 325                     tmpl->id.proto == x->id.proto &&
 326                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 327                         /* Resolution logic:
 328                            1. There is a valid state with matching selector.
 329                               Done.
 330                            2. Valid state with inappropriate selector. Skip.
 331
 332                            Entering area of "sysdeps".
 333
 334                            3. If state is not valid, selector is temporary,
 335                               it selects only session which triggered
 336                               previous resolution. Key manager will do
 337                               something to install a state with proper
 338                               selector.
 339                          */
 340                         if (x->km.state == XFRM_STATE_VALID) {
 341                                 if (!xfrm_selector_match(&x->sel, fl, family))
 342                                         continue;
 343                                 if (!best ||
 344                                     best->km.dying > x->km.dying ||
 345                                     (best->km.dying == x->km.dying &&
 346                                      best->curlft.add_time < x->curlft.add_time))
 347                                         best = x;
 348                         } else if (x->km.state == XFRM_STATE_ACQ) {
 349                                 acquire_in_progress = 1;
 350                         } else if (x->km.state == XFRM_STATE_ERROR ||
 351                                    x->km.state == XFRM_STATE_EXPIRED) {
 352                                 if (xfrm_selector_match(&x->sel, fl, family))
 353                                         error = -ESRCH;
 354                         }
 355                 }
 356         }
 357
 358         x = best;
 359         if (!x && !error && !acquire_in_progress) {
 360                 if (tmpl->id.spi &&
 361                     (x0 = afinfo->state_lookup(daddr, tmpl->id.spi,
 362                                                tmpl->id.proto)) != NULL) {
 363                         xfrm_state_put(x0);
 364                         error = -EEXIST;
 365                         goto out;
 366                 }
 367                 x = xfrm_state_alloc();
 368                 if (x == NULL) {
 369                         error = -ENOMEM;
 370                         goto out;
 371                 }
 372                 /* Initialize temporary selector matching only
 373                  * to current session. */
 374                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 375
 376                 if (km_query(x, tmpl, pol) == 0) {
 377                         x->km.state = XFRM_STATE_ACQ;
 378                         list_add_tail(&x->bydst, xfrm_state_bydst+h);
 379                         xfrm_state_hold(x);
 380                         if (x->id.spi) {
 381                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 382                                 list_add(&x->byspi, xfrm_state_byspi+h);
 383                                 xfrm_state_hold(x);
 384                         }
 385                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
 386                         xfrm_state_hold(x);
 387                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
 388                         add_timer(&x->timer);
 389                 } else {
 390                         x->km.state = XFRM_STATE_DEAD;
 391                         xfrm_state_put(x);
 392                         x = NULL;
 393                         error = -ESRCH;
 394                 }
 395         }
 396 out:
 397         if (x)
 398                 xfrm_state_hold(x);
 399         else
 400                 *err = acquire_in_progress ? -EAGAIN : error;
 401         spin_unlock_bh(&xfrm_state_lock);
 402         xfrm_state_put_afinfo(afinfo);
 403         return x;
 404 }
 405
 406 static void __xfrm_state_insert(struct xfrm_state *x)
 407 {
 408         unsigned h = xfrm_dst_hash(&x->id.daddr, x->props.family);
 409
 410         list_add(&x->bydst, xfrm_state_bydst+h);
 411         xfrm_state_hold(x);
 412
 413         h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 414
 415         list_add(&x->byspi, xfrm_state_byspi+h);
 416         xfrm_state_hold(x);
 417
 418         if (!mod_timer(&x->timer, jiffies + HZ))
 419                 xfrm_state_hold(x);
 420
 421         wake_up(&km_waitq);
 422 }
 423
 424 void xfrm_state_insert(struct xfrm_state *x)
 425 {
 426         spin_lock_bh(&xfrm_state_lock);
 427         __xfrm_state_insert(x);
 428         spin_unlock_bh(&xfrm_state_lock);
 429 }
 430 EXPORT_SYMBOL(xfrm_state_insert);
 431
 432 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
 433
 434 int xfrm_state_add(struct xfrm_state *x)
 435 {
 436         struct xfrm_state_afinfo *afinfo;
 437         struct xfrm_state *x1;
 438         int family;
 439         int err;
 440
 441         family = x->props.family;
 442         afinfo = xfrm_state_get_afinfo(family);
 443         if (unlikely(afinfo == NULL))
 444                 return -EAFNOSUPPORT;
 445
 446         spin_lock_bh(&xfrm_state_lock);
 447
 448         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 449         if (x1) {
 450                 xfrm_state_put(x1);
 451                 x1 = NULL;
 452                 err = -EEXIST;
 453                 goto out;
 454         }
 455
 456         if (x->km.seq) {
 457                 x1 = __xfrm_find_acq_byseq(x->km.seq);
 458                 if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
 459                         xfrm_state_put(x1);
 460                         x1 = NULL;
 461                 }
 462         }
 463
 464         if (!x1)
 465                 x1 = afinfo->find_acq(
 466                         x->props.mode, x->props.reqid, x->id.proto,
 467                         &x->id.daddr, &x->props.saddr, 0);
 468
 469         __xfrm_state_insert(x);
 470         err = 0;
 471
 472 out:
 473         spin_unlock_bh(&xfrm_state_lock);
 474         xfrm_state_put_afinfo(afinfo);
 475
 476         if (x1) {
 477                 xfrm_state_delete(x1);
 478                 xfrm_state_put(x1);
 479         }
 480
 481         return err;
 482 }
 483 EXPORT_SYMBOL(xfrm_state_add);
 484
 485 int xfrm_state_update(struct xfrm_state *x)
 486 {
 487         struct xfrm_state_afinfo *afinfo;
 488         struct xfrm_state *x1;
 489         int err;
 490
 491         afinfo = xfrm_state_get_afinfo(x->props.family);
 492         if (unlikely(afinfo == NULL))
 493                 return -EAFNOSUPPORT;
 494
 495         spin_lock_bh(&xfrm_state_lock);
 496         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
 497
 498         err = -ESRCH;
 499         if (!x1)
 500                 goto out;
 501
 502         if (xfrm_state_kern(x1)) {
 503                 xfrm_state_put(x1);
 504                 err = -EEXIST;
 505                 goto out;
 506         }
 507
 508         if (x1->km.state == XFRM_STATE_ACQ) {
 509                 __xfrm_state_insert(x);
 510                 x = NULL;
 511         }
 512         err = 0;
 513
 514 out:
 515         spin_unlock_bh(&xfrm_state_lock);
 516         xfrm_state_put_afinfo(afinfo);
 517
 518         if (err)
 519                 return err;
 520
 521         if (!x) {
 522                 xfrm_state_delete(x1);
 523                 xfrm_state_put(x1);
 524                 return 0;
 525         }
 526
 527         err = -EINVAL;
 528         spin_lock_bh(&x1->lock);
 529         if (likely(x1->km.state == XFRM_STATE_VALID)) {
 530                 if (x->encap && x1->encap)
 531                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
 532                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
 533                 x1->km.dying = 0;
 534
 535                 if (!mod_timer(&x1->timer, jiffies + HZ))
 536                         xfrm_state_hold(x1);
 537                 if (x1->curlft.use_time)
 538                         xfrm_state_check_expire(x1);
 539
 540                 err = 0;
 541         }
 542         spin_unlock_bh(&x1->lock);
 543
 544         xfrm_state_put(x1);
 545
 546         return err;
 547 }
 548 EXPORT_SYMBOL(xfrm_state_update);
 549
 550 int xfrm_state_check_expire(struct xfrm_state *x)
 551 {
 552         if (!x->curlft.use_time)
 553                 x->curlft.use_time = (unsigned long)xtime.tv_sec;
 554
 555         if (x->km.state != XFRM_STATE_VALID)
 556                 return -EINVAL;
 557
 558         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
 559             x->curlft.packets >= x->lft.hard_packet_limit) {
 560                 km_state_expired(x, 1);
 561                 if (!mod_timer(&x->timer, jiffies + XFRM_ACQ_EXPIRES*HZ))
 562                         xfrm_state_hold(x);
 563                 return -EINVAL;
 564         }
 565
 566         if (!x->km.dying &&
 567             (x->curlft.bytes >= x->lft.soft_byte_limit ||
 568              x->curlft.packets >= x->lft.soft_packet_limit))
 569                 km_state_expired(x, 0);
 570         return 0;
 571 }
 572 EXPORT_SYMBOL(xfrm_state_check_expire);
 573
 574 static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
 575 {
 576         int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
 577                 - skb_headroom(skb);
 578
 579         if (nhead > 0)
 580                 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
 581
 582         /* Check tail too... */
 583         return 0;
 584 }
 585
 586 int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
 587 {
 588         int err = xfrm_state_check_expire(x);
 589         if (err < 0)
 590                 goto err;
 591         err = xfrm_state_check_space(x, skb);
 592 err:
 593         return err;
 594 }
 595 EXPORT_SYMBOL(xfrm_state_check);
 596
 597 struct xfrm_state *
 598 xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
 599                   unsigned short family)
 600 {
 601         struct xfrm_state *x;
 602         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 603         if (!afinfo)
 604                 return NULL;
 605
 606         spin_lock_bh(&xfrm_state_lock);
 607         x = afinfo->state_lookup(daddr, spi, proto);
 608         spin_unlock_bh(&xfrm_state_lock);
 609         xfrm_state_put_afinfo(afinfo);
 610         return x;
 611 }
 612 EXPORT_SYMBOL(xfrm_state_lookup);
 613
 614 struct xfrm_state *
 615 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 616               xfrm_address_t *daddr, xfrm_address_t *saddr,
 617               int create, unsigned short family)
 618 {
 619         struct xfrm_state *x;
 620         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 621         if (!afinfo)
 622                 return NULL;
 623
 624         spin_lock_bh(&xfrm_state_lock);
 625         x = afinfo->find_acq(mode, reqid, proto, daddr, saddr, create);
 626         spin_unlock_bh(&xfrm_state_lock);
 627         xfrm_state_put_afinfo(afinfo);
 628         return x;
 629 }
 630 EXPORT_SYMBOL(xfrm_find_acq);
 631
 632 /* Silly enough, but I'm lazy to build resolution list */
 633
 634 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
 635 {
 636         int i;
 637         struct xfrm_state *x;
 638
 639         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 640                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 641                         if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
 642                                 xfrm_state_hold(x);
 643                                 return x;
 644                         }
 645                 }
 646         }
 647         return NULL;
 648 }
 649
 650 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
 651 {
 652         struct xfrm_state *x;
 653
 654         spin_lock_bh(&xfrm_state_lock);
 655         x = __xfrm_find_acq_byseq(seq);
 656         spin_unlock_bh(&xfrm_state_lock);
 657         return x;
 658 }
 659 EXPORT_SYMBOL(xfrm_find_acq_byseq);
 660
 661 u32 xfrm_get_acqseq(void)
 662 {
 663         u32 res;
 664         static u32 acqseq;
 665         static DEFINE_SPINLOCK(acqseq_lock);
 666
 667         spin_lock_bh(&acqseq_lock);
 668         res = (++acqseq ? : ++acqseq);
 669         spin_unlock_bh(&acqseq_lock);
 670         return res;
 671 }
 672 EXPORT_SYMBOL(xfrm_get_acqseq);
 673
 674 void
 675 xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
 676 {
 677         u32 h;
 678         struct xfrm_state *x0;
 679
 680         if (x->id.spi)
 681                 return;
 682
 683         if (minspi == maxspi) {
 684                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
 685                 if (x0) {
 686                         xfrm_state_put(x0);
 687                         return;
 688                 }
 689                 x->id.spi = minspi;
 690         } else {
 691                 u32 spi = 0;
 692                 minspi = ntohl(minspi);
 693                 maxspi = ntohl(maxspi);
 694                 for (h=0; h<maxspi-minspi+1; h++) {
 695                         spi = minspi + net_random()%(maxspi-minspi+1);
 696                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
 697                         if (x0 == NULL) {
 698                                 x->id.spi = htonl(spi);
 699                                 break;
 700                         }
 701                         xfrm_state_put(x0);
 702                 }
 703         }
 704         if (x->id.spi) {
 705                 spin_lock_bh(&xfrm_state_lock);
 706                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 707                 list_add(&x->byspi, xfrm_state_byspi+h);
 708                 xfrm_state_hold(x);
 709                 spin_unlock_bh(&xfrm_state_lock);
 710                 wake_up(&km_waitq);
 711         }
 712 }
 713 EXPORT_SYMBOL(xfrm_alloc_spi);
 714
 715 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
 716                     void *data)
 717 {
 718         int i;
 719         struct xfrm_state *x;
 720         int count = 0;
 721         int err = 0;
 722
 723         spin_lock_bh(&xfrm_state_lock);
 724         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 725                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 726                         if (proto == IPSEC_PROTO_ANY || x->id.proto == proto)
 727                                 count++;
 728                 }
 729         }
 730         if (count == 0) {
 731                 err = -ENOENT;
 732                 goto out;
 733         }
 734
 735         for (i = 0; i < XFRM_DST_HSIZE; i++) {
 736                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 737                         if (proto != IPSEC_PROTO_ANY && x->id.proto != proto)
 738                                 continue;
 739                         err = func(x, --count, data);
 740                         if (err)
 741                                 goto out;
 742                 }
 743         }
 744 out:
 745         spin_unlock_bh(&xfrm_state_lock);
 746         return err;
 747 }
 748 EXPORT_SYMBOL(xfrm_state_walk);
 749
 750 int xfrm_replay_check(struct xfrm_state *x, u32 seq)
 751 {
 752         u32 diff;
 753
 754         seq = ntohl(seq);
 755
 756         if (unlikely(seq == 0))
 757                 return -EINVAL;
 758
 759         if (likely(seq > x->replay.seq))
 760                 return 0;
 761
 762         diff = x->replay.seq - seq;
 763         if (diff >= x->props.replay_window) {
 764                 x->stats.replay_window++;
 765                 return -EINVAL;
 766         }
 767
 768         if (x->replay.bitmap & (1U << diff)) {
 769                 x->stats.replay++;
 770                 return -EINVAL;
 771         }
 772         return 0;
 773 }
 774 EXPORT_SYMBOL(xfrm_replay_check);
 775
 776 void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
 777 {
 778         u32 diff;
 779
 780         seq = ntohl(seq);
 781
 782         if (seq > x->replay.seq) {
 783                 diff = seq - x->replay.seq;
 784                 if (diff < x->props.replay_window)
 785                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
 786                 else
 787                         x->replay.bitmap = 1;
 788                 x->replay.seq = seq;
 789         } else {
 790                 diff = x->replay.seq - seq;
 791                 x->replay.bitmap |= (1U << diff);
 792         }
 793 }
 794 EXPORT_SYMBOL(xfrm_replay_advance);
 795
 796 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
 797 static DEFINE_RWLOCK(xfrm_km_lock);
 798
 799 static void km_state_expired(struct xfrm_state *x, int hard)
 800 {
 801         struct xfrm_mgr *km;
 802
 803         if (hard)
 804                 x->km.state = XFRM_STATE_EXPIRED;
 805         else
 806                 x->km.dying = 1;
 807
 808         read_lock(&xfrm_km_lock);
 809         list_for_each_entry(km, &xfrm_km_list, list)
 810                 km->notify(x, hard);
 811         read_unlock(&xfrm_km_lock);
 812
 813         if (hard)
 814                 wake_up(&km_waitq);
 815 }
 816
 817 static int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 818 {
 819         int err = -EINVAL;
 820         struct xfrm_mgr *km;
 821
 822         read_lock(&xfrm_km_lock);
 823         list_for_each_entry(km, &xfrm_km_list, list) {
 824                 err = km->acquire(x, t, pol, XFRM_POLICY_OUT);
 825                 if (!err)
 826                         break;
 827         }
 828         read_unlock(&xfrm_km_lock);
 829         return err;
 830 }
 831
 832 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport)
 833 {
 834         int err = -EINVAL;
 835         struct xfrm_mgr *km;
 836
 837         read_lock(&xfrm_km_lock);
 838         list_for_each_entry(km, &xfrm_km_list, list) {
 839                 if (km->new_mapping)
 840                         err = km->new_mapping(x, ipaddr, sport);
 841                 if (!err)
 842                         break;
 843         }
 844         read_unlock(&xfrm_km_lock);
 845         return err;
 846 }
 847 EXPORT_SYMBOL(km_new_mapping);
 848
 849 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard)
 850 {
 851         struct xfrm_mgr *km;
 852
 853         read_lock(&xfrm_km_lock);
 854         list_for_each_entry(km, &xfrm_km_list, list)
 855                 if (km->notify_policy)
 856                         km->notify_policy(pol, dir, hard);
 857         read_unlock(&xfrm_km_lock);
 858
 859         if (hard)
 860                 wake_up(&km_waitq);
 861 }
 862
 863 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 864 {
 865         int err;
 866         u8 *data;
 867         struct xfrm_mgr *km;
 868         struct xfrm_policy *pol = NULL;
 869
 870         if (optlen <= 0 || optlen > PAGE_SIZE)
 871                 return -EMSGSIZE;
 872
 873         data = kmalloc(optlen, GFP_KERNEL);
 874         if (!data)
 875                 return -ENOMEM;
 876
 877         err = -EFAULT;
 878         if (copy_from_user(data, optval, optlen))
 879                 goto out;
 880
 881         err = -EINVAL;
 882         read_lock(&xfrm_km_lock);
 883         list_for_each_entry(km, &xfrm_km_list, list) {
 884                 pol = km->compile_policy(sk->sk_family, optname, data,
 885                                          optlen, &err);
 886                 if (err >= 0)
 887                         break;
 888         }
 889         read_unlock(&xfrm_km_lock);
 890
 891         if (err >= 0) {
 892                 xfrm_sk_policy_insert(sk, err, pol);
 893                 xfrm_pol_put(pol);
 894                 err = 0;
 895         }
 896
 897 out:
 898         kfree(data);
 899         return err;
 900 }
 901 EXPORT_SYMBOL(xfrm_user_policy);
 902
 903 int xfrm_register_km(struct xfrm_mgr *km)
 904 {
 905         write_lock_bh(&xfrm_km_lock);
 906         list_add_tail(&km->list, &xfrm_km_list);
 907         write_unlock_bh(&xfrm_km_lock);
 908         return 0;
 909 }
 910 EXPORT_SYMBOL(xfrm_register_km);
 911
 912 int xfrm_unregister_km(struct xfrm_mgr *km)
 913 {
 914         write_lock_bh(&xfrm_km_lock);
 915         list_del(&km->list);
 916         write_unlock_bh(&xfrm_km_lock);
 917         return 0;
 918 }
 919 EXPORT_SYMBOL(xfrm_unregister_km);
 920
 921 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
 922 {
 923         int err = 0;
 924         if (unlikely(afinfo == NULL))
 925                 return -EINVAL;
 926         if (unlikely(afinfo->family >= NPROTO))
 927                 return -EAFNOSUPPORT;
 928         write_lock(&xfrm_state_afinfo_lock);
 929         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
 930                 err = -ENOBUFS;
 931         else {
 932                 afinfo->state_bydst = xfrm_state_bydst;
 933                 afinfo->state_byspi = xfrm_state_byspi;
 934                 xfrm_state_afinfo[afinfo->family] = afinfo;
 935         }
 936         write_unlock(&xfrm_state_afinfo_lock);
 937         return err;
 938 }
 939 EXPORT_SYMBOL(xfrm_state_register_afinfo);
 940
 941 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
 942 {
 943         int err = 0;
 944         if (unlikely(afinfo == NULL))
 945                 return -EINVAL;
 946         if (unlikely(afinfo->family >= NPROTO))
 947                 return -EAFNOSUPPORT;
 948         write_lock(&xfrm_state_afinfo_lock);
 949         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
 950                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
 951                         err = -EINVAL;
 952                 else {
 953                         xfrm_state_afinfo[afinfo->family] = NULL;
 954                         afinfo->state_byspi = NULL;
 955                         afinfo->state_bydst = NULL;
 956                 }
 957         }
 958         write_unlock(&xfrm_state_afinfo_lock);
 959         return err;
 960 }
 961 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
 962
 963 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
 964 {
 965         struct xfrm_state_afinfo *afinfo;
 966         if (unlikely(family >= NPROTO))
 967                 return NULL;
 968         read_lock(&xfrm_state_afinfo_lock);
 969         afinfo = xfrm_state_afinfo[family];
 970         if (likely(afinfo != NULL))
 971                 read_lock(&afinfo->lock);
 972         read_unlock(&xfrm_state_afinfo_lock);
 973         return afinfo;
 974 }
 975
 976 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
 977 {
 978         if (unlikely(afinfo == NULL))
 979                 return;
 980         read_unlock(&afinfo->lock);
 981 }
 982
 983 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
 984 void xfrm_state_delete_tunnel(struct xfrm_state *x)
 985 {
 986         if (x->tunnel) {
 987                 struct xfrm_state *t = x->tunnel;
 988
 989                 if (atomic_read(&t->tunnel_users) == 2)
 990                         xfrm_state_delete(t);
 991                 atomic_dec(&t->tunnel_users);
 992                 xfrm_state_put(t);
 993                 x->tunnel = NULL;
 994         }
 995 }
 996 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
 997
 998 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
 999 {
1000         int res = mtu;
1001
1002         res -= x->props.header_len;
1003
1004         for (;;) {
1005                 int m = res;
1006
1007                 if (m < 68)
1008                         return 68;
1009
1010                 spin_lock_bh(&x->lock);
1011                 if (x->km.state == XFRM_STATE_VALID &&
1012                     x->type && x->type->get_max_size)
1013                         m = x->type->get_max_size(x, m);
1014                 else
1015                         m += x->props.header_len;
1016                 spin_unlock_bh(&x->lock);
1017
1018                 if (m <= mtu)
1019                         break;
1020                 res -= (m - mtu);
1021         }
1022
1023         return res;
1024 }
1025
1026 EXPORT_SYMBOL(xfrm_state_mtu);
1027
1028 void __init xfrm_state_init(void)
1029 {
1030         int i;
1031
1032         for (i=0; i<XFRM_DST_HSIZE; i++) {
1033                 INIT_LIST_HEAD(&xfrm_state_bydst[i]);
1034                 INIT_LIST_HEAD(&xfrm_state_byspi[i]);
1035         }
1036         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task, NULL);
1037 }
1038