Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * xfrm_state.c
0004  *
0005  * Changes:
0006  *  Mitsuru KANDA @USAGI
0007  *  Kazunori MIYAZAWA @USAGI
0008  *  Kunihiro Ishiguro <kunihiro@ipinfusion.com>
0009  *      IPv6 support
0010  *  YOSHIFUJI Hideaki @USAGI
0011  *      Split up af-specific functions
0012  *  Derek Atkins <derek@ihtfp.com>
0013  *      Add UDP Encapsulation
0014  *
0015  */
0016 
0017 #include <linux/compat.h>
0018 #include <linux/workqueue.h>
0019 #include <net/xfrm.h>
0020 #include <linux/pfkeyv2.h>
0021 #include <linux/ipsec.h>
0022 #include <linux/module.h>
0023 #include <linux/cache.h>
0024 #include <linux/audit.h>
0025 #include <linux/uaccess.h>
0026 #include <linux/ktime.h>
0027 #include <linux/slab.h>
0028 #include <linux/interrupt.h>
0029 #include <linux/kernel.h>
0030 
0031 #include <crypto/aead.h>
0032 
0033 #include "xfrm_hash.h"
0034 
0035 #define xfrm_state_deref_prot(table, net) \
0036     rcu_dereference_protected((table), lockdep_is_held(&(net)->xfrm.xfrm_state_lock))
0037 
0038 static void xfrm_state_gc_task(struct work_struct *work);
0039 
0040 /* Each xfrm_state may be linked to two tables:
0041 
0042    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
0043    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
0044       destination/tunnel endpoint. (output)
0045  */
0046 
0047 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
0048 static struct kmem_cache *xfrm_state_cache __ro_after_init;
0049 
0050 static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task);
0051 static HLIST_HEAD(xfrm_state_gc_list);
0052 
0053 static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x)
0054 {
0055     return refcount_inc_not_zero(&x->refcnt);
0056 }
0057 
0058 static inline unsigned int xfrm_dst_hash(struct net *net,
0059                      const xfrm_address_t *daddr,
0060                      const xfrm_address_t *saddr,
0061                      u32 reqid,
0062                      unsigned short family)
0063 {
0064     return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
0065 }
0066 
0067 static inline unsigned int xfrm_src_hash(struct net *net,
0068                      const xfrm_address_t *daddr,
0069                      const xfrm_address_t *saddr,
0070                      unsigned short family)
0071 {
0072     return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
0073 }
0074 
0075 static inline unsigned int
0076 xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr,
0077           __be32 spi, u8 proto, unsigned short family)
0078 {
0079     return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
0080 }
0081 
0082 static unsigned int xfrm_seq_hash(struct net *net, u32 seq)
0083 {
0084     return __xfrm_seq_hash(seq, net->xfrm.state_hmask);
0085 }
0086 
0087 static void xfrm_hash_transfer(struct hlist_head *list,
0088                    struct hlist_head *ndsttable,
0089                    struct hlist_head *nsrctable,
0090                    struct hlist_head *nspitable,
0091                    struct hlist_head *nseqtable,
0092                    unsigned int nhashmask)
0093 {
0094     struct hlist_node *tmp;
0095     struct xfrm_state *x;
0096 
0097     hlist_for_each_entry_safe(x, tmp, list, bydst) {
0098         unsigned int h;
0099 
0100         h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
0101                     x->props.reqid, x->props.family,
0102                     nhashmask);
0103         hlist_add_head_rcu(&x->bydst, ndsttable + h);
0104 
0105         h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
0106                     x->props.family,
0107                     nhashmask);
0108         hlist_add_head_rcu(&x->bysrc, nsrctable + h);
0109 
0110         if (x->id.spi) {
0111             h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
0112                         x->id.proto, x->props.family,
0113                         nhashmask);
0114             hlist_add_head_rcu(&x->byspi, nspitable + h);
0115         }
0116 
0117         if (x->km.seq) {
0118             h = __xfrm_seq_hash(x->km.seq, nhashmask);
0119             hlist_add_head_rcu(&x->byseq, nseqtable + h);
0120         }
0121     }
0122 }
0123 
0124 static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
0125 {
0126     return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
0127 }
0128 
0129 static void xfrm_hash_resize(struct work_struct *work)
0130 {
0131     struct net *net = container_of(work, struct net, xfrm.state_hash_work);
0132     struct hlist_head *ndst, *nsrc, *nspi, *nseq, *odst, *osrc, *ospi, *oseq;
0133     unsigned long nsize, osize;
0134     unsigned int nhashmask, ohashmask;
0135     int i;
0136 
0137     nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
0138     ndst = xfrm_hash_alloc(nsize);
0139     if (!ndst)
0140         return;
0141     nsrc = xfrm_hash_alloc(nsize);
0142     if (!nsrc) {
0143         xfrm_hash_free(ndst, nsize);
0144         return;
0145     }
0146     nspi = xfrm_hash_alloc(nsize);
0147     if (!nspi) {
0148         xfrm_hash_free(ndst, nsize);
0149         xfrm_hash_free(nsrc, nsize);
0150         return;
0151     }
0152     nseq = xfrm_hash_alloc(nsize);
0153     if (!nseq) {
0154         xfrm_hash_free(ndst, nsize);
0155         xfrm_hash_free(nsrc, nsize);
0156         xfrm_hash_free(nspi, nsize);
0157         return;
0158     }
0159 
0160     spin_lock_bh(&net->xfrm.xfrm_state_lock);
0161     write_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
0162 
0163     nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
0164     odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net);
0165     for (i = net->xfrm.state_hmask; i >= 0; i--)
0166         xfrm_hash_transfer(odst + i, ndst, nsrc, nspi, nseq, nhashmask);
0167 
0168     osrc = xfrm_state_deref_prot(net->xfrm.state_bysrc, net);
0169     ospi = xfrm_state_deref_prot(net->xfrm.state_byspi, net);
0170     oseq = xfrm_state_deref_prot(net->xfrm.state_byseq, net);
0171     ohashmask = net->xfrm.state_hmask;
0172 
0173     rcu_assign_pointer(net->xfrm.state_bydst, ndst);
0174     rcu_assign_pointer(net->xfrm.state_bysrc, nsrc);
0175     rcu_assign_pointer(net->xfrm.state_byspi, nspi);
0176     rcu_assign_pointer(net->xfrm.state_byseq, nseq);
0177     net->xfrm.state_hmask = nhashmask;
0178 
0179     write_seqcount_end(&net->xfrm.xfrm_state_hash_generation);
0180     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
0181 
0182     osize = (ohashmask + 1) * sizeof(struct hlist_head);
0183 
0184     synchronize_rcu();
0185 
0186     xfrm_hash_free(odst, osize);
0187     xfrm_hash_free(osrc, osize);
0188     xfrm_hash_free(ospi, osize);
0189     xfrm_hash_free(oseq, osize);
0190 }
0191 
0192 static DEFINE_SPINLOCK(xfrm_state_afinfo_lock);
0193 static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO];
0194 
0195 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
0196 
0197 int __xfrm_state_delete(struct xfrm_state *x);
0198 
0199 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
0200 static bool km_is_alive(const struct km_event *c);
0201 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
0202 
0203 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
0204 {
0205     struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
0206     int err = 0;
0207 
0208     if (!afinfo)
0209         return -EAFNOSUPPORT;
0210 
0211 #define X(afi, T, name) do {            \
0212         WARN_ON((afi)->type_ ## name);  \
0213         (afi)->type_ ## name = (T); \
0214     } while (0)
0215 
0216     switch (type->proto) {
0217     case IPPROTO_COMP:
0218         X(afinfo, type, comp);
0219         break;
0220     case IPPROTO_AH:
0221         X(afinfo, type, ah);
0222         break;
0223     case IPPROTO_ESP:
0224         X(afinfo, type, esp);
0225         break;
0226     case IPPROTO_IPIP:
0227         X(afinfo, type, ipip);
0228         break;
0229     case IPPROTO_DSTOPTS:
0230         X(afinfo, type, dstopts);
0231         break;
0232     case IPPROTO_ROUTING:
0233         X(afinfo, type, routing);
0234         break;
0235     case IPPROTO_IPV6:
0236         X(afinfo, type, ipip6);
0237         break;
0238     default:
0239         WARN_ON(1);
0240         err = -EPROTONOSUPPORT;
0241         break;
0242     }
0243 #undef X
0244     rcu_read_unlock();
0245     return err;
0246 }
0247 EXPORT_SYMBOL(xfrm_register_type);
0248 
0249 void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
0250 {
0251     struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
0252 
0253     if (unlikely(afinfo == NULL))
0254         return;
0255 
0256 #define X(afi, T, name) do {                \
0257         WARN_ON((afi)->type_ ## name != (T));   \
0258         (afi)->type_ ## name = NULL;        \
0259     } while (0)
0260 
0261     switch (type->proto) {
0262     case IPPROTO_COMP:
0263         X(afinfo, type, comp);
0264         break;
0265     case IPPROTO_AH:
0266         X(afinfo, type, ah);
0267         break;
0268     case IPPROTO_ESP:
0269         X(afinfo, type, esp);
0270         break;
0271     case IPPROTO_IPIP:
0272         X(afinfo, type, ipip);
0273         break;
0274     case IPPROTO_DSTOPTS:
0275         X(afinfo, type, dstopts);
0276         break;
0277     case IPPROTO_ROUTING:
0278         X(afinfo, type, routing);
0279         break;
0280     case IPPROTO_IPV6:
0281         X(afinfo, type, ipip6);
0282         break;
0283     default:
0284         WARN_ON(1);
0285         break;
0286     }
0287 #undef X
0288     rcu_read_unlock();
0289 }
0290 EXPORT_SYMBOL(xfrm_unregister_type);
0291 
0292 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
0293 {
0294     const struct xfrm_type *type = NULL;
0295     struct xfrm_state_afinfo *afinfo;
0296     int modload_attempted = 0;
0297 
0298 retry:
0299     afinfo = xfrm_state_get_afinfo(family);
0300     if (unlikely(afinfo == NULL))
0301         return NULL;
0302 
0303     switch (proto) {
0304     case IPPROTO_COMP:
0305         type = afinfo->type_comp;
0306         break;
0307     case IPPROTO_AH:
0308         type = afinfo->type_ah;
0309         break;
0310     case IPPROTO_ESP:
0311         type = afinfo->type_esp;
0312         break;
0313     case IPPROTO_IPIP:
0314         type = afinfo->type_ipip;
0315         break;
0316     case IPPROTO_DSTOPTS:
0317         type = afinfo->type_dstopts;
0318         break;
0319     case IPPROTO_ROUTING:
0320         type = afinfo->type_routing;
0321         break;
0322     case IPPROTO_IPV6:
0323         type = afinfo->type_ipip6;
0324         break;
0325     default:
0326         break;
0327     }
0328 
0329     if (unlikely(type && !try_module_get(type->owner)))
0330         type = NULL;
0331 
0332     rcu_read_unlock();
0333 
0334     if (!type && !modload_attempted) {
0335         request_module("xfrm-type-%d-%d", family, proto);
0336         modload_attempted = 1;
0337         goto retry;
0338     }
0339 
0340     return type;
0341 }
0342 
0343 static void xfrm_put_type(const struct xfrm_type *type)
0344 {
0345     module_put(type->owner);
0346 }
0347 
0348 int xfrm_register_type_offload(const struct xfrm_type_offload *type,
0349                    unsigned short family)
0350 {
0351     struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
0352     int err = 0;
0353 
0354     if (unlikely(afinfo == NULL))
0355         return -EAFNOSUPPORT;
0356 
0357     switch (type->proto) {
0358     case IPPROTO_ESP:
0359         WARN_ON(afinfo->type_offload_esp);
0360         afinfo->type_offload_esp = type;
0361         break;
0362     default:
0363         WARN_ON(1);
0364         err = -EPROTONOSUPPORT;
0365         break;
0366     }
0367 
0368     rcu_read_unlock();
0369     return err;
0370 }
0371 EXPORT_SYMBOL(xfrm_register_type_offload);
0372 
0373 void xfrm_unregister_type_offload(const struct xfrm_type_offload *type,
0374                   unsigned short family)
0375 {
0376     struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
0377 
0378     if (unlikely(afinfo == NULL))
0379         return;
0380 
0381     switch (type->proto) {
0382     case IPPROTO_ESP:
0383         WARN_ON(afinfo->type_offload_esp != type);
0384         afinfo->type_offload_esp = NULL;
0385         break;
0386     default:
0387         WARN_ON(1);
0388         break;
0389     }
0390     rcu_read_unlock();
0391 }
0392 EXPORT_SYMBOL(xfrm_unregister_type_offload);
0393 
0394 static const struct xfrm_type_offload *
0395 xfrm_get_type_offload(u8 proto, unsigned short family, bool try_load)
0396 {
0397     const struct xfrm_type_offload *type = NULL;
0398     struct xfrm_state_afinfo *afinfo;
0399 
0400 retry:
0401     afinfo = xfrm_state_get_afinfo(family);
0402     if (unlikely(afinfo == NULL))
0403         return NULL;
0404 
0405     switch (proto) {
0406     case IPPROTO_ESP:
0407         type = afinfo->type_offload_esp;
0408         break;
0409     default:
0410         break;
0411     }
0412 
0413     if ((type && !try_module_get(type->owner)))
0414         type = NULL;
0415 
0416     rcu_read_unlock();
0417 
0418     if (!type && try_load) {
0419         request_module("xfrm-offload-%d-%d", family, proto);
0420         try_load = false;
0421         goto retry;
0422     }
0423 
0424     return type;
0425 }
0426 
0427 static void xfrm_put_type_offload(const struct xfrm_type_offload *type)
0428 {
0429     module_put(type->owner);
0430 }
0431 
0432 static const struct xfrm_mode xfrm4_mode_map[XFRM_MODE_MAX] = {
0433     [XFRM_MODE_BEET] = {
0434         .encap = XFRM_MODE_BEET,
0435         .flags = XFRM_MODE_FLAG_TUNNEL,
0436         .family = AF_INET,
0437     },
0438     [XFRM_MODE_TRANSPORT] = {
0439         .encap = XFRM_MODE_TRANSPORT,
0440         .family = AF_INET,
0441     },
0442     [XFRM_MODE_TUNNEL] = {
0443         .encap = XFRM_MODE_TUNNEL,
0444         .flags = XFRM_MODE_FLAG_TUNNEL,
0445         .family = AF_INET,
0446     },
0447 };
0448 
0449 static const struct xfrm_mode xfrm6_mode_map[XFRM_MODE_MAX] = {
0450     [XFRM_MODE_BEET] = {
0451         .encap = XFRM_MODE_BEET,
0452         .flags = XFRM_MODE_FLAG_TUNNEL,
0453         .family = AF_INET6,
0454     },
0455     [XFRM_MODE_ROUTEOPTIMIZATION] = {
0456         .encap = XFRM_MODE_ROUTEOPTIMIZATION,
0457         .family = AF_INET6,
0458     },
0459     [XFRM_MODE_TRANSPORT] = {
0460         .encap = XFRM_MODE_TRANSPORT,
0461         .family = AF_INET6,
0462     },
0463     [XFRM_MODE_TUNNEL] = {
0464         .encap = XFRM_MODE_TUNNEL,
0465         .flags = XFRM_MODE_FLAG_TUNNEL,
0466         .family = AF_INET6,
0467     },
0468 };
0469 
0470 static const struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
0471 {
0472     const struct xfrm_mode *mode;
0473 
0474     if (unlikely(encap >= XFRM_MODE_MAX))
0475         return NULL;
0476 
0477     switch (family) {
0478     case AF_INET:
0479         mode = &xfrm4_mode_map[encap];
0480         if (mode->family == family)
0481             return mode;
0482         break;
0483     case AF_INET6:
0484         mode = &xfrm6_mode_map[encap];
0485         if (mode->family == family)
0486             return mode;
0487         break;
0488     default:
0489         break;
0490     }
0491 
0492     return NULL;
0493 }
0494 
0495 void xfrm_state_free(struct xfrm_state *x)
0496 {
0497     kmem_cache_free(xfrm_state_cache, x);
0498 }
0499 EXPORT_SYMBOL(xfrm_state_free);
0500 
0501 static void ___xfrm_state_destroy(struct xfrm_state *x)
0502 {
0503     hrtimer_cancel(&x->mtimer);
0504     del_timer_sync(&x->rtimer);
0505     kfree(x->aead);
0506     kfree(x->aalg);
0507     kfree(x->ealg);
0508     kfree(x->calg);
0509     kfree(x->encap);
0510     kfree(x->coaddr);
0511     kfree(x->replay_esn);
0512     kfree(x->preplay_esn);
0513     if (x->type_offload)
0514         xfrm_put_type_offload(x->type_offload);
0515     if (x->type) {
0516         x->type->destructor(x);
0517         xfrm_put_type(x->type);
0518     }
0519     if (x->xfrag.page)
0520         put_page(x->xfrag.page);
0521     xfrm_dev_state_free(x);
0522     security_xfrm_state_free(x);
0523     xfrm_state_free(x);
0524 }
0525 
0526 static void xfrm_state_gc_task(struct work_struct *work)
0527 {
0528     struct xfrm_state *x;
0529     struct hlist_node *tmp;
0530     struct hlist_head gc_list;
0531 
0532     spin_lock_bh(&xfrm_state_gc_lock);
0533     hlist_move_list(&xfrm_state_gc_list, &gc_list);
0534     spin_unlock_bh(&xfrm_state_gc_lock);
0535 
0536     synchronize_rcu();
0537 
0538     hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
0539         ___xfrm_state_destroy(x);
0540 }
0541 
0542 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
0543 {
0544     struct xfrm_state *x = container_of(me, struct xfrm_state, mtimer);
0545     enum hrtimer_restart ret = HRTIMER_NORESTART;
0546     time64_t now = ktime_get_real_seconds();
0547     time64_t next = TIME64_MAX;
0548     int warn = 0;
0549     int err = 0;
0550 
0551     spin_lock(&x->lock);
0552     if (x->km.state == XFRM_STATE_DEAD)
0553         goto out;
0554     if (x->km.state == XFRM_STATE_EXPIRED)
0555         goto expired;
0556     if (x->lft.hard_add_expires_seconds) {
0557         long tmo = x->lft.hard_add_expires_seconds +
0558             x->curlft.add_time - now;
0559         if (tmo <= 0) {
0560             if (x->xflags & XFRM_SOFT_EXPIRE) {
0561                 /* enter hard expire without soft expire first?!
0562                  * setting a new date could trigger this.
0563                  * workaround: fix x->curflt.add_time by below:
0564                  */
0565                 x->curlft.add_time = now - x->saved_tmo - 1;
0566                 tmo = x->lft.hard_add_expires_seconds - x->saved_tmo;
0567             } else
0568                 goto expired;
0569         }
0570         if (tmo < next)
0571             next = tmo;
0572     }
0573     if (x->lft.hard_use_expires_seconds) {
0574         long tmo = x->lft.hard_use_expires_seconds +
0575             (x->curlft.use_time ? : now) - now;
0576         if (tmo <= 0)
0577             goto expired;
0578         if (tmo < next)
0579             next = tmo;
0580     }
0581     if (x->km.dying)
0582         goto resched;
0583     if (x->lft.soft_add_expires_seconds) {
0584         long tmo = x->lft.soft_add_expires_seconds +
0585             x->curlft.add_time - now;
0586         if (tmo <= 0) {
0587             warn = 1;
0588             x->xflags &= ~XFRM_SOFT_EXPIRE;
0589         } else if (tmo < next) {
0590             next = tmo;
0591             x->xflags |= XFRM_SOFT_EXPIRE;
0592             x->saved_tmo = tmo;
0593         }
0594     }
0595     if (x->lft.soft_use_expires_seconds) {
0596         long tmo = x->lft.soft_use_expires_seconds +
0597             (x->curlft.use_time ? : now) - now;
0598         if (tmo <= 0)
0599             warn = 1;
0600         else if (tmo < next)
0601             next = tmo;
0602     }
0603 
0604     x->km.dying = warn;
0605     if (warn)
0606         km_state_expired(x, 0, 0);
0607 resched:
0608     if (next != TIME64_MAX) {
0609         hrtimer_forward_now(&x->mtimer, ktime_set(next, 0));
0610         ret = HRTIMER_RESTART;
0611     }
0612 
0613     goto out;
0614 
0615 expired:
0616     if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0)
0617         x->km.state = XFRM_STATE_EXPIRED;
0618 
0619     err = __xfrm_state_delete(x);
0620     if (!err)
0621         km_state_expired(x, 1, 0);
0622 
0623     xfrm_audit_state_delete(x, err ? 0 : 1, true);
0624 
0625 out:
0626     spin_unlock(&x->lock);
0627     return ret;
0628 }
0629 
0630 static void xfrm_replay_timer_handler(struct timer_list *t);
0631 
0632 struct xfrm_state *xfrm_state_alloc(struct net *net)
0633 {
0634     struct xfrm_state *x;
0635 
0636     x = kmem_cache_zalloc(xfrm_state_cache, GFP_ATOMIC);
0637 
0638     if (x) {
0639         write_pnet(&x->xs_net, net);
0640         refcount_set(&x->refcnt, 1);
0641         atomic_set(&x->tunnel_users, 0);
0642         INIT_LIST_HEAD(&x->km.all);
0643         INIT_HLIST_NODE(&x->bydst);
0644         INIT_HLIST_NODE(&x->bysrc);
0645         INIT_HLIST_NODE(&x->byspi);
0646         INIT_HLIST_NODE(&x->byseq);
0647         hrtimer_init(&x->mtimer, CLOCK_BOOTTIME, HRTIMER_MODE_ABS_SOFT);
0648         x->mtimer.function = xfrm_timer_handler;
0649         timer_setup(&x->rtimer, xfrm_replay_timer_handler, 0);
0650         x->curlft.add_time = ktime_get_real_seconds();
0651         x->lft.soft_byte_limit = XFRM_INF;
0652         x->lft.soft_packet_limit = XFRM_INF;
0653         x->lft.hard_byte_limit = XFRM_INF;
0654         x->lft.hard_packet_limit = XFRM_INF;
0655         x->replay_maxage = 0;
0656         x->replay_maxdiff = 0;
0657         spin_lock_init(&x->lock);
0658     }
0659     return x;
0660 }
0661 EXPORT_SYMBOL(xfrm_state_alloc);
0662 
0663 void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
0664 {
0665     WARN_ON(x->km.state != XFRM_STATE_DEAD);
0666 
0667     if (sync) {
0668         synchronize_rcu();
0669         ___xfrm_state_destroy(x);
0670     } else {
0671         spin_lock_bh(&xfrm_state_gc_lock);
0672         hlist_add_head(&x->gclist, &xfrm_state_gc_list);
0673         spin_unlock_bh(&xfrm_state_gc_lock);
0674         schedule_work(&xfrm_state_gc_work);
0675     }
0676 }
0677 EXPORT_SYMBOL(__xfrm_state_destroy);
0678 
0679 int __xfrm_state_delete(struct xfrm_state *x)
0680 {
0681     struct net *net = xs_net(x);
0682     int err = -ESRCH;
0683 
0684     if (x->km.state != XFRM_STATE_DEAD) {
0685         x->km.state = XFRM_STATE_DEAD;
0686         spin_lock(&net->xfrm.xfrm_state_lock);
0687         list_del(&x->km.all);
0688         hlist_del_rcu(&x->bydst);
0689         hlist_del_rcu(&x->bysrc);
0690         if (x->km.seq)
0691             hlist_del_rcu(&x->byseq);
0692         if (x->id.spi)
0693             hlist_del_rcu(&x->byspi);
0694         net->xfrm.state_num--;
0695         spin_unlock(&net->xfrm.xfrm_state_lock);
0696 
0697         if (x->encap_sk)
0698             sock_put(rcu_dereference_raw(x->encap_sk));
0699 
0700         xfrm_dev_state_delete(x);
0701 
0702         /* All xfrm_state objects are created by xfrm_state_alloc.
0703          * The xfrm_state_alloc call gives a reference, and that
0704          * is what we are dropping here.
0705          */
0706         xfrm_state_put(x);
0707         err = 0;
0708     }
0709 
0710     return err;
0711 }
0712 EXPORT_SYMBOL(__xfrm_state_delete);
0713 
0714 int xfrm_state_delete(struct xfrm_state *x)
0715 {
0716     int err;
0717 
0718     spin_lock_bh(&x->lock);
0719     err = __xfrm_state_delete(x);
0720     spin_unlock_bh(&x->lock);
0721 
0722     return err;
0723 }
0724 EXPORT_SYMBOL(xfrm_state_delete);
0725 
0726 #ifdef CONFIG_SECURITY_NETWORK_XFRM
0727 static inline int
0728 xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
0729 {
0730     int i, err = 0;
0731 
0732     for (i = 0; i <= net->xfrm.state_hmask; i++) {
0733         struct xfrm_state *x;
0734 
0735         hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
0736             if (xfrm_id_proto_match(x->id.proto, proto) &&
0737                (err = security_xfrm_state_delete(x)) != 0) {
0738                 xfrm_audit_state_delete(x, 0, task_valid);
0739                 return err;
0740             }
0741         }
0742     }
0743 
0744     return err;
0745 }
0746 
0747 static inline int
0748 xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
0749 {
0750     int i, err = 0;
0751 
0752     for (i = 0; i <= net->xfrm.state_hmask; i++) {
0753         struct xfrm_state *x;
0754         struct xfrm_dev_offload *xso;
0755 
0756         hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
0757             xso = &x->xso;
0758 
0759             if (xso->dev == dev &&
0760                (err = security_xfrm_state_delete(x)) != 0) {
0761                 xfrm_audit_state_delete(x, 0, task_valid);
0762                 return err;
0763             }
0764         }
0765     }
0766 
0767     return err;
0768 }
0769 #else
0770 static inline int
0771 xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
0772 {
0773     return 0;
0774 }
0775 
0776 static inline int
0777 xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
0778 {
0779     return 0;
0780 }
0781 #endif
0782 
0783 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync)
0784 {
0785     int i, err = 0, cnt = 0;
0786 
0787     spin_lock_bh(&net->xfrm.xfrm_state_lock);
0788     err = xfrm_state_flush_secctx_check(net, proto, task_valid);
0789     if (err)
0790         goto out;
0791 
0792     err = -ESRCH;
0793     for (i = 0; i <= net->xfrm.state_hmask; i++) {
0794         struct xfrm_state *x;
0795 restart:
0796         hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
0797             if (!xfrm_state_kern(x) &&
0798                 xfrm_id_proto_match(x->id.proto, proto)) {
0799                 xfrm_state_hold(x);
0800                 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
0801 
0802                 err = xfrm_state_delete(x);
0803                 xfrm_audit_state_delete(x, err ? 0 : 1,
0804                             task_valid);
0805                 if (sync)
0806                     xfrm_state_put_sync(x);
0807                 else
0808                     xfrm_state_put(x);
0809                 if (!err)
0810                     cnt++;
0811 
0812                 spin_lock_bh(&net->xfrm.xfrm_state_lock);
0813                 goto restart;
0814             }
0815         }
0816     }
0817 out:
0818     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
0819     if (cnt)
0820         err = 0;
0821 
0822     return err;
0823 }
0824 EXPORT_SYMBOL(xfrm_state_flush);
0825 
0826 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid)
0827 {
0828     int i, err = 0, cnt = 0;
0829 
0830     spin_lock_bh(&net->xfrm.xfrm_state_lock);
0831     err = xfrm_dev_state_flush_secctx_check(net, dev, task_valid);
0832     if (err)
0833         goto out;
0834 
0835     err = -ESRCH;
0836     for (i = 0; i <= net->xfrm.state_hmask; i++) {
0837         struct xfrm_state *x;
0838         struct xfrm_dev_offload *xso;
0839 restart:
0840         hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
0841             xso = &x->xso;
0842 
0843             if (!xfrm_state_kern(x) && xso->dev == dev) {
0844                 xfrm_state_hold(x);
0845                 spin_unlock_bh(&net->xfrm.xfrm_state_lock);
0846 
0847                 err = xfrm_state_delete(x);
0848                 xfrm_audit_state_delete(x, err ? 0 : 1,
0849                             task_valid);
0850                 xfrm_state_put(x);
0851                 if (!err)
0852                     cnt++;
0853 
0854                 spin_lock_bh(&net->xfrm.xfrm_state_lock);
0855                 goto restart;
0856             }
0857         }
0858     }
0859     if (cnt)
0860         err = 0;
0861 
0862 out:
0863     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
0864     return err;
0865 }
0866 EXPORT_SYMBOL(xfrm_dev_state_flush);
0867 
0868 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
0869 {
0870     spin_lock_bh(&net->xfrm.xfrm_state_lock);
0871     si->sadcnt = net->xfrm.state_num;
0872     si->sadhcnt = net->xfrm.state_hmask + 1;
0873     si->sadhmcnt = xfrm_state_hashmax;
0874     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
0875 }
0876 EXPORT_SYMBOL(xfrm_sad_getinfo);
0877 
0878 static void
0879 __xfrm4_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
0880 {
0881     const struct flowi4 *fl4 = &fl->u.ip4;
0882 
0883     sel->daddr.a4 = fl4->daddr;
0884     sel->saddr.a4 = fl4->saddr;
0885     sel->dport = xfrm_flowi_dport(fl, &fl4->uli);
0886     sel->dport_mask = htons(0xffff);
0887     sel->sport = xfrm_flowi_sport(fl, &fl4->uli);
0888     sel->sport_mask = htons(0xffff);
0889     sel->family = AF_INET;
0890     sel->prefixlen_d = 32;
0891     sel->prefixlen_s = 32;
0892     sel->proto = fl4->flowi4_proto;
0893     sel->ifindex = fl4->flowi4_oif;
0894 }
0895 
0896 static void
0897 __xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
0898 {
0899     const struct flowi6 *fl6 = &fl->u.ip6;
0900 
0901     /* Initialize temporary selector matching only to current session. */
0902     *(struct in6_addr *)&sel->daddr = fl6->daddr;
0903     *(struct in6_addr *)&sel->saddr = fl6->saddr;
0904     sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
0905     sel->dport_mask = htons(0xffff);
0906     sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
0907     sel->sport_mask = htons(0xffff);
0908     sel->family = AF_INET6;
0909     sel->prefixlen_d = 128;
0910     sel->prefixlen_s = 128;
0911     sel->proto = fl6->flowi6_proto;
0912     sel->ifindex = fl6->flowi6_oif;
0913 }
0914 
0915 static void
0916 xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl,
0917             const struct xfrm_tmpl *tmpl,
0918             const xfrm_address_t *daddr, const xfrm_address_t *saddr,
0919             unsigned short family)
0920 {
0921     switch (family) {
0922     case AF_INET:
0923         __xfrm4_init_tempsel(&x->sel, fl);
0924         break;
0925     case AF_INET6:
0926         __xfrm6_init_tempsel(&x->sel, fl);
0927         break;
0928     }
0929 
0930     x->id = tmpl->id;
0931 
0932     switch (tmpl->encap_family) {
0933     case AF_INET:
0934         if (x->id.daddr.a4 == 0)
0935             x->id.daddr.a4 = daddr->a4;
0936         x->props.saddr = tmpl->saddr;
0937         if (x->props.saddr.a4 == 0)
0938             x->props.saddr.a4 = saddr->a4;
0939         break;
0940     case AF_INET6:
0941         if (ipv6_addr_any((struct in6_addr *)&x->id.daddr))
0942             memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
0943         memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
0944         if (ipv6_addr_any((struct in6_addr *)&x->props.saddr))
0945             memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
0946         break;
0947     }
0948 
0949     x->props.mode = tmpl->mode;
0950     x->props.reqid = tmpl->reqid;
0951     x->props.family = tmpl->encap_family;
0952 }
0953 
0954 static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
0955                           const xfrm_address_t *daddr,
0956                           __be32 spi, u8 proto,
0957                           unsigned short family)
0958 {
0959     unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
0960     struct xfrm_state *x;
0961 
0962     hlist_for_each_entry_rcu(x, net->xfrm.state_byspi + h, byspi) {
0963         if (x->props.family != family ||
0964             x->id.spi       != spi ||
0965             x->id.proto     != proto ||
0966             !xfrm_addr_equal(&x->id.daddr, daddr, family))
0967             continue;
0968 
0969         if ((mark & x->mark.m) != x->mark.v)
0970             continue;
0971         if (!xfrm_state_hold_rcu(x))
0972             continue;
0973         return x;
0974     }
0975 
0976     return NULL;
0977 }
0978 
0979 static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
0980                              const xfrm_address_t *daddr,
0981                              const xfrm_address_t *saddr,
0982                              u8 proto, unsigned short family)
0983 {
0984     unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
0985     struct xfrm_state *x;
0986 
0987     hlist_for_each_entry_rcu(x, net->xfrm.state_bysrc + h, bysrc) {
0988         if (x->props.family != family ||
0989             x->id.proto     != proto ||
0990             !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
0991             !xfrm_addr_equal(&x->props.saddr, saddr, family))
0992             continue;
0993 
0994         if ((mark & x->mark.m) != x->mark.v)
0995             continue;
0996         if (!xfrm_state_hold_rcu(x))
0997             continue;
0998         return x;
0999     }
1000 
1001     return NULL;
1002 }
1003 
1004 static inline struct xfrm_state *
1005 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
1006 {
1007     struct net *net = xs_net(x);
1008     u32 mark = x->mark.v & x->mark.m;
1009 
1010     if (use_spi)
1011         return __xfrm_state_lookup(net, mark, &x->id.daddr,
1012                        x->id.spi, x->id.proto, family);
1013     else
1014         return __xfrm_state_lookup_byaddr(net, mark,
1015                           &x->id.daddr,
1016                           &x->props.saddr,
1017                           x->id.proto, family);
1018 }
1019 
1020 static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
1021 {
1022     if (have_hash_collision &&
1023         (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
1024         net->xfrm.state_num > net->xfrm.state_hmask)
1025         schedule_work(&net->xfrm.state_hash_work);
1026 }
1027 
1028 static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
1029                    const struct flowi *fl, unsigned short family,
1030                    struct xfrm_state **best, int *acq_in_progress,
1031                    int *error)
1032 {
1033     /* Resolution logic:
1034      * 1. There is a valid state with matching selector. Done.
1035      * 2. Valid state with inappropriate selector. Skip.
1036      *
1037      * Entering area of "sysdeps".
1038      *
1039      * 3. If state is not valid, selector is temporary, it selects
1040      *    only session which triggered previous resolution. Key
1041      *    manager will do something to install a state with proper
1042      *    selector.
1043      */
1044     if (x->km.state == XFRM_STATE_VALID) {
1045         if ((x->sel.family &&
1046              (x->sel.family != family ||
1047               !xfrm_selector_match(&x->sel, fl, family))) ||
1048             !security_xfrm_state_pol_flow_match(x, pol,
1049                             &fl->u.__fl_common))
1050             return;
1051 
1052         if (!*best ||
1053             (*best)->km.dying > x->km.dying ||
1054             ((*best)->km.dying == x->km.dying &&
1055              (*best)->curlft.add_time < x->curlft.add_time))
1056             *best = x;
1057     } else if (x->km.state == XFRM_STATE_ACQ) {
1058         *acq_in_progress = 1;
1059     } else if (x->km.state == XFRM_STATE_ERROR ||
1060            x->km.state == XFRM_STATE_EXPIRED) {
1061         if ((!x->sel.family ||
1062              (x->sel.family == family &&
1063               xfrm_selector_match(&x->sel, fl, family))) &&
1064             security_xfrm_state_pol_flow_match(x, pol,
1065                                &fl->u.__fl_common))
1066             *error = -ESRCH;
1067     }
1068 }
1069 
1070 struct xfrm_state *
1071 xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1072         const struct flowi *fl, struct xfrm_tmpl *tmpl,
1073         struct xfrm_policy *pol, int *err,
1074         unsigned short family, u32 if_id)
1075 {
1076     static xfrm_address_t saddr_wildcard = { };
1077     struct net *net = xp_net(pol);
1078     unsigned int h, h_wildcard;
1079     struct xfrm_state *x, *x0, *to_put;
1080     int acquire_in_progress = 0;
1081     int error = 0;
1082     struct xfrm_state *best = NULL;
1083     u32 mark = pol->mark.v & pol->mark.m;
1084     unsigned short encap_family = tmpl->encap_family;
1085     unsigned int sequence;
1086     struct km_event c;
1087 
1088     to_put = NULL;
1089 
1090     sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
1091 
1092     rcu_read_lock();
1093     h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
1094     hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) {
1095         if (x->props.family == encap_family &&
1096             x->props.reqid == tmpl->reqid &&
1097             (mark & x->mark.m) == x->mark.v &&
1098             x->if_id == if_id &&
1099             !(x->props.flags & XFRM_STATE_WILDRECV) &&
1100             xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
1101             tmpl->mode == x->props.mode &&
1102             tmpl->id.proto == x->id.proto &&
1103             (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
1104             xfrm_state_look_at(pol, x, fl, family,
1105                        &best, &acquire_in_progress, &error);
1106     }
1107     if (best || acquire_in_progress)
1108         goto found;
1109 
1110     h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
1111     hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h_wildcard, bydst) {
1112         if (x->props.family == encap_family &&
1113             x->props.reqid == tmpl->reqid &&
1114             (mark & x->mark.m) == x->mark.v &&
1115             x->if_id == if_id &&
1116             !(x->props.flags & XFRM_STATE_WILDRECV) &&
1117             xfrm_addr_equal(&x->id.daddr, daddr, encap_family) &&
1118             tmpl->mode == x->props.mode &&
1119             tmpl->id.proto == x->id.proto &&
1120             (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
1121             xfrm_state_look_at(pol, x, fl, family,
1122                        &best, &acquire_in_progress, &error);
1123     }
1124 
1125 found:
1126     x = best;
1127     if (!x && !error && !acquire_in_progress) {
1128         if (tmpl->id.spi &&
1129             (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
1130                           tmpl->id.proto, encap_family)) != NULL) {
1131             to_put = x0;
1132             error = -EEXIST;
1133             goto out;
1134         }
1135 
1136         c.net = net;
1137         /* If the KMs have no listeners (yet...), avoid allocating an SA
1138          * for each and every packet - garbage collection might not
1139          * handle the flood.
1140          */
1141         if (!km_is_alive(&c)) {
1142             error = -ESRCH;
1143             goto out;
1144         }
1145 
1146         x = xfrm_state_alloc(net);
1147         if (x == NULL) {
1148             error = -ENOMEM;
1149             goto out;
1150         }
1151         /* Initialize temporary state matching only
1152          * to current session. */
1153         xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
1154         memcpy(&x->mark, &pol->mark, sizeof(x->mark));
1155         x->if_id = if_id;
1156 
1157         error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid);
1158         if (error) {
1159             x->km.state = XFRM_STATE_DEAD;
1160             to_put = x;
1161             x = NULL;
1162             goto out;
1163         }
1164 
1165         if (km_query(x, tmpl, pol) == 0) {
1166             spin_lock_bh(&net->xfrm.xfrm_state_lock);
1167             x->km.state = XFRM_STATE_ACQ;
1168             list_add(&x->km.all, &net->xfrm.state_all);
1169             hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h);
1170             h = xfrm_src_hash(net, daddr, saddr, encap_family);
1171             hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h);
1172             if (x->id.spi) {
1173                 h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
1174                 hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h);
1175             }
1176             if (x->km.seq) {
1177                 h = xfrm_seq_hash(net, x->km.seq);
1178                 hlist_add_head_rcu(&x->byseq, net->xfrm.state_byseq + h);
1179             }
1180             x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
1181             hrtimer_start(&x->mtimer,
1182                       ktime_set(net->xfrm.sysctl_acq_expires, 0),
1183                       HRTIMER_MODE_REL_SOFT);
1184             net->xfrm.state_num++;
1185             xfrm_hash_grow_check(net, x->bydst.next != NULL);
1186             spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1187         } else {
1188             x->km.state = XFRM_STATE_DEAD;
1189             to_put = x;
1190             x = NULL;
1191             error = -ESRCH;
1192         }
1193     }
1194 out:
1195     if (x) {
1196         if (!xfrm_state_hold_rcu(x)) {
1197             *err = -EAGAIN;
1198             x = NULL;
1199         }
1200     } else {
1201         *err = acquire_in_progress ? -EAGAIN : error;
1202     }
1203     rcu_read_unlock();
1204     if (to_put)
1205         xfrm_state_put(to_put);
1206 
1207     if (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, sequence)) {
1208         *err = -EAGAIN;
1209         if (x) {
1210             xfrm_state_put(x);
1211             x = NULL;
1212         }
1213     }
1214 
1215     return x;
1216 }
1217 
1218 struct xfrm_state *
1219 xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1220             xfrm_address_t *daddr, xfrm_address_t *saddr,
1221             unsigned short family, u8 mode, u8 proto, u32 reqid)
1222 {
1223     unsigned int h;
1224     struct xfrm_state *rx = NULL, *x = NULL;
1225 
1226     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1227     h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
1228     hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
1229         if (x->props.family == family &&
1230             x->props.reqid == reqid &&
1231             (mark & x->mark.m) == x->mark.v &&
1232             x->if_id == if_id &&
1233             !(x->props.flags & XFRM_STATE_WILDRECV) &&
1234             xfrm_state_addr_check(x, daddr, saddr, family) &&
1235             mode == x->props.mode &&
1236             proto == x->id.proto &&
1237             x->km.state == XFRM_STATE_VALID) {
1238             rx = x;
1239             break;
1240         }
1241     }
1242 
1243     if (rx)
1244         xfrm_state_hold(rx);
1245     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1246 
1247 
1248     return rx;
1249 }
1250 EXPORT_SYMBOL(xfrm_stateonly_find);
1251 
1252 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1253                           unsigned short family)
1254 {
1255     struct xfrm_state *x;
1256     struct xfrm_state_walk *w;
1257 
1258     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1259     list_for_each_entry(w, &net->xfrm.state_all, all) {
1260         x = container_of(w, struct xfrm_state, km);
1261         if (x->props.family != family ||
1262             x->id.spi != spi)
1263             continue;
1264 
1265         xfrm_state_hold(x);
1266         spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1267         return x;
1268     }
1269     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1270     return NULL;
1271 }
1272 EXPORT_SYMBOL(xfrm_state_lookup_byspi);
1273 
1274 static void __xfrm_state_insert(struct xfrm_state *x)
1275 {
1276     struct net *net = xs_net(x);
1277     unsigned int h;
1278 
1279     list_add(&x->km.all, &net->xfrm.state_all);
1280 
1281     h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
1282               x->props.reqid, x->props.family);
1283     hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h);
1284 
1285     h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
1286     hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h);
1287 
1288     if (x->id.spi) {
1289         h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
1290                   x->props.family);
1291 
1292         hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h);
1293     }
1294 
1295     if (x->km.seq) {
1296         h = xfrm_seq_hash(net, x->km.seq);
1297 
1298         hlist_add_head_rcu(&x->byseq, net->xfrm.state_byseq + h);
1299     }
1300 
1301     hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT);
1302     if (x->replay_maxage)
1303         mod_timer(&x->rtimer, jiffies + x->replay_maxage);
1304 
1305     net->xfrm.state_num++;
1306 
1307     xfrm_hash_grow_check(net, x->bydst.next != NULL);
1308 }
1309 
1310 /* net->xfrm.xfrm_state_lock is held */
1311 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
1312 {
1313     struct net *net = xs_net(xnew);
1314     unsigned short family = xnew->props.family;
1315     u32 reqid = xnew->props.reqid;
1316     struct xfrm_state *x;
1317     unsigned int h;
1318     u32 mark = xnew->mark.v & xnew->mark.m;
1319     u32 if_id = xnew->if_id;
1320 
1321     h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
1322     hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
1323         if (x->props.family == family &&
1324             x->props.reqid  == reqid &&
1325             x->if_id        == if_id &&
1326             (mark & x->mark.m) == x->mark.v &&
1327             xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) &&
1328             xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family))
1329             x->genid++;
1330     }
1331 }
1332 
1333 void xfrm_state_insert(struct xfrm_state *x)
1334 {
1335     struct net *net = xs_net(x);
1336 
1337     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1338     __xfrm_state_bump_genids(x);
1339     __xfrm_state_insert(x);
1340     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1341 }
1342 EXPORT_SYMBOL(xfrm_state_insert);
1343 
1344 /* net->xfrm.xfrm_state_lock is held */
1345 static struct xfrm_state *__find_acq_core(struct net *net,
1346                       const struct xfrm_mark *m,
1347                       unsigned short family, u8 mode,
1348                       u32 reqid, u32 if_id, u8 proto,
1349                       const xfrm_address_t *daddr,
1350                       const xfrm_address_t *saddr,
1351                       int create)
1352 {
1353     unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
1354     struct xfrm_state *x;
1355     u32 mark = m->v & m->m;
1356 
1357     hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
1358         if (x->props.reqid  != reqid ||
1359             x->props.mode   != mode ||
1360             x->props.family != family ||
1361             x->km.state     != XFRM_STATE_ACQ ||
1362             x->id.spi       != 0 ||
1363             x->id.proto     != proto ||
1364             (mark & x->mark.m) != x->mark.v ||
1365             !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
1366             !xfrm_addr_equal(&x->props.saddr, saddr, family))
1367             continue;
1368 
1369         xfrm_state_hold(x);
1370         return x;
1371     }
1372 
1373     if (!create)
1374         return NULL;
1375 
1376     x = xfrm_state_alloc(net);
1377     if (likely(x)) {
1378         switch (family) {
1379         case AF_INET:
1380             x->sel.daddr.a4 = daddr->a4;
1381             x->sel.saddr.a4 = saddr->a4;
1382             x->sel.prefixlen_d = 32;
1383             x->sel.prefixlen_s = 32;
1384             x->props.saddr.a4 = saddr->a4;
1385             x->id.daddr.a4 = daddr->a4;
1386             break;
1387 
1388         case AF_INET6:
1389             x->sel.daddr.in6 = daddr->in6;
1390             x->sel.saddr.in6 = saddr->in6;
1391             x->sel.prefixlen_d = 128;
1392             x->sel.prefixlen_s = 128;
1393             x->props.saddr.in6 = saddr->in6;
1394             x->id.daddr.in6 = daddr->in6;
1395             break;
1396         }
1397 
1398         x->km.state = XFRM_STATE_ACQ;
1399         x->id.proto = proto;
1400         x->props.family = family;
1401         x->props.mode = mode;
1402         x->props.reqid = reqid;
1403         x->if_id = if_id;
1404         x->mark.v = m->v;
1405         x->mark.m = m->m;
1406         x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
1407         xfrm_state_hold(x);
1408         hrtimer_start(&x->mtimer,
1409                   ktime_set(net->xfrm.sysctl_acq_expires, 0),
1410                   HRTIMER_MODE_REL_SOFT);
1411         list_add(&x->km.all, &net->xfrm.state_all);
1412         hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h);
1413         h = xfrm_src_hash(net, daddr, saddr, family);
1414         hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h);
1415 
1416         net->xfrm.state_num++;
1417 
1418         xfrm_hash_grow_check(net, x->bydst.next != NULL);
1419     }
1420 
1421     return x;
1422 }
1423 
1424 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1425 
1426 int xfrm_state_add(struct xfrm_state *x)
1427 {
1428     struct net *net = xs_net(x);
1429     struct xfrm_state *x1, *to_put;
1430     int family;
1431     int err;
1432     u32 mark = x->mark.v & x->mark.m;
1433     int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1434 
1435     family = x->props.family;
1436 
1437     to_put = NULL;
1438 
1439     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1440 
1441     x1 = __xfrm_state_locate(x, use_spi, family);
1442     if (x1) {
1443         to_put = x1;
1444         x1 = NULL;
1445         err = -EEXIST;
1446         goto out;
1447     }
1448 
1449     if (use_spi && x->km.seq) {
1450         x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq);
1451         if (x1 && ((x1->id.proto != x->id.proto) ||
1452             !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) {
1453             to_put = x1;
1454             x1 = NULL;
1455         }
1456     }
1457 
1458     if (use_spi && !x1)
1459         x1 = __find_acq_core(net, &x->mark, family, x->props.mode,
1460                      x->props.reqid, x->if_id, x->id.proto,
1461                      &x->id.daddr, &x->props.saddr, 0);
1462 
1463     __xfrm_state_bump_genids(x);
1464     __xfrm_state_insert(x);
1465     err = 0;
1466 
1467 out:
1468     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1469 
1470     if (x1) {
1471         xfrm_state_delete(x1);
1472         xfrm_state_put(x1);
1473     }
1474 
1475     if (to_put)
1476         xfrm_state_put(to_put);
1477 
1478     return err;
1479 }
1480 EXPORT_SYMBOL(xfrm_state_add);
1481 
1482 #ifdef CONFIG_XFRM_MIGRATE
1483 static inline int clone_security(struct xfrm_state *x, struct xfrm_sec_ctx *security)
1484 {
1485     struct xfrm_user_sec_ctx *uctx;
1486     int size = sizeof(*uctx) + security->ctx_len;
1487     int err;
1488 
1489     uctx = kmalloc(size, GFP_KERNEL);
1490     if (!uctx)
1491         return -ENOMEM;
1492 
1493     uctx->exttype = XFRMA_SEC_CTX;
1494     uctx->len = size;
1495     uctx->ctx_doi = security->ctx_doi;
1496     uctx->ctx_alg = security->ctx_alg;
1497     uctx->ctx_len = security->ctx_len;
1498     memcpy(uctx + 1, security->ctx_str, security->ctx_len);
1499     err = security_xfrm_state_alloc(x, uctx);
1500     kfree(uctx);
1501     if (err)
1502         return err;
1503 
1504     return 0;
1505 }
1506 
1507 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
1508                        struct xfrm_encap_tmpl *encap)
1509 {
1510     struct net *net = xs_net(orig);
1511     struct xfrm_state *x = xfrm_state_alloc(net);
1512     if (!x)
1513         goto out;
1514 
1515     memcpy(&x->id, &orig->id, sizeof(x->id));
1516     memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1517     memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1518     x->props.mode = orig->props.mode;
1519     x->props.replay_window = orig->props.replay_window;
1520     x->props.reqid = orig->props.reqid;
1521     x->props.family = orig->props.family;
1522     x->props.saddr = orig->props.saddr;
1523 
1524     if (orig->aalg) {
1525         x->aalg = xfrm_algo_auth_clone(orig->aalg);
1526         if (!x->aalg)
1527             goto error;
1528     }
1529     x->props.aalgo = orig->props.aalgo;
1530 
1531     if (orig->aead) {
1532         x->aead = xfrm_algo_aead_clone(orig->aead);
1533         x->geniv = orig->geniv;
1534         if (!x->aead)
1535             goto error;
1536     }
1537     if (orig->ealg) {
1538         x->ealg = xfrm_algo_clone(orig->ealg);
1539         if (!x->ealg)
1540             goto error;
1541     }
1542     x->props.ealgo = orig->props.ealgo;
1543 
1544     if (orig->calg) {
1545         x->calg = xfrm_algo_clone(orig->calg);
1546         if (!x->calg)
1547             goto error;
1548     }
1549     x->props.calgo = orig->props.calgo;
1550 
1551     if (encap || orig->encap) {
1552         if (encap)
1553             x->encap = kmemdup(encap, sizeof(*x->encap),
1554                     GFP_KERNEL);
1555         else
1556             x->encap = kmemdup(orig->encap, sizeof(*x->encap),
1557                     GFP_KERNEL);
1558 
1559         if (!x->encap)
1560             goto error;
1561     }
1562 
1563     if (orig->security)
1564         if (clone_security(x, orig->security))
1565             goto error;
1566 
1567     if (orig->coaddr) {
1568         x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1569                     GFP_KERNEL);
1570         if (!x->coaddr)
1571             goto error;
1572     }
1573 
1574     if (orig->replay_esn) {
1575         if (xfrm_replay_clone(x, orig))
1576             goto error;
1577     }
1578 
1579     memcpy(&x->mark, &orig->mark, sizeof(x->mark));
1580     memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark));
1581 
1582     x->props.flags = orig->props.flags;
1583     x->props.extra_flags = orig->props.extra_flags;
1584 
1585     x->if_id = orig->if_id;
1586     x->tfcpad = orig->tfcpad;
1587     x->replay_maxdiff = orig->replay_maxdiff;
1588     x->replay_maxage = orig->replay_maxage;
1589     memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft));
1590     x->km.state = orig->km.state;
1591     x->km.seq = orig->km.seq;
1592     x->replay = orig->replay;
1593     x->preplay = orig->preplay;
1594     x->mapping_maxage = orig->mapping_maxage;
1595     x->lastused = orig->lastused;
1596     x->new_mapping = 0;
1597     x->new_mapping_sport = 0;
1598 
1599     return x;
1600 
1601  error:
1602     xfrm_state_put(x);
1603 out:
1604     return NULL;
1605 }
1606 
1607 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
1608                         u32 if_id)
1609 {
1610     unsigned int h;
1611     struct xfrm_state *x = NULL;
1612 
1613     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1614 
1615     if (m->reqid) {
1616         h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
1617                   m->reqid, m->old_family);
1618         hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
1619             if (x->props.mode != m->mode ||
1620                 x->id.proto != m->proto)
1621                 continue;
1622             if (m->reqid && x->props.reqid != m->reqid)
1623                 continue;
1624             if (if_id != 0 && x->if_id != if_id)
1625                 continue;
1626             if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
1627                          m->old_family) ||
1628                 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
1629                          m->old_family))
1630                 continue;
1631             xfrm_state_hold(x);
1632             break;
1633         }
1634     } else {
1635         h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
1636                   m->old_family);
1637         hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
1638             if (x->props.mode != m->mode ||
1639                 x->id.proto != m->proto)
1640                 continue;
1641             if (if_id != 0 && x->if_id != if_id)
1642                 continue;
1643             if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
1644                          m->old_family) ||
1645                 !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
1646                          m->old_family))
1647                 continue;
1648             xfrm_state_hold(x);
1649             break;
1650         }
1651     }
1652 
1653     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1654 
1655     return x;
1656 }
1657 EXPORT_SYMBOL(xfrm_migrate_state_find);
1658 
1659 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1660                       struct xfrm_migrate *m,
1661                       struct xfrm_encap_tmpl *encap)
1662 {
1663     struct xfrm_state *xc;
1664 
1665     xc = xfrm_state_clone(x, encap);
1666     if (!xc)
1667         return NULL;
1668 
1669     xc->props.family = m->new_family;
1670 
1671     if (xfrm_init_state(xc) < 0)
1672         goto error;
1673 
1674     memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1675     memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1676 
1677     /* add state */
1678     if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) {
1679         /* a care is needed when the destination address of the
1680            state is to be updated as it is a part of triplet */
1681         xfrm_state_insert(xc);
1682     } else {
1683         if (xfrm_state_add(xc) < 0)
1684             goto error;
1685     }
1686 
1687     return xc;
1688 error:
1689     xfrm_state_put(xc);
1690     return NULL;
1691 }
1692 EXPORT_SYMBOL(xfrm_state_migrate);
1693 #endif
1694 
1695 int xfrm_state_update(struct xfrm_state *x)
1696 {
1697     struct xfrm_state *x1, *to_put;
1698     int err;
1699     int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1700     struct net *net = xs_net(x);
1701 
1702     to_put = NULL;
1703 
1704     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1705     x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1706 
1707     err = -ESRCH;
1708     if (!x1)
1709         goto out;
1710 
1711     if (xfrm_state_kern(x1)) {
1712         to_put = x1;
1713         err = -EEXIST;
1714         goto out;
1715     }
1716 
1717     if (x1->km.state == XFRM_STATE_ACQ) {
1718         __xfrm_state_insert(x);
1719         x = NULL;
1720     }
1721     err = 0;
1722 
1723 out:
1724     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1725 
1726     if (to_put)
1727         xfrm_state_put(to_put);
1728 
1729     if (err)
1730         return err;
1731 
1732     if (!x) {
1733         xfrm_state_delete(x1);
1734         xfrm_state_put(x1);
1735         return 0;
1736     }
1737 
1738     err = -EINVAL;
1739     spin_lock_bh(&x1->lock);
1740     if (likely(x1->km.state == XFRM_STATE_VALID)) {
1741         if (x->encap && x1->encap &&
1742             x->encap->encap_type == x1->encap->encap_type)
1743             memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1744         else if (x->encap || x1->encap)
1745             goto fail;
1746 
1747         if (x->coaddr && x1->coaddr) {
1748             memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1749         }
1750         if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1751             memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1752         memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1753         x1->km.dying = 0;
1754 
1755         hrtimer_start(&x1->mtimer, ktime_set(1, 0),
1756                   HRTIMER_MODE_REL_SOFT);
1757         if (x1->curlft.use_time)
1758             xfrm_state_check_expire(x1);
1759 
1760         if (x->props.smark.m || x->props.smark.v || x->if_id) {
1761             spin_lock_bh(&net->xfrm.xfrm_state_lock);
1762 
1763             if (x->props.smark.m || x->props.smark.v)
1764                 x1->props.smark = x->props.smark;
1765 
1766             if (x->if_id)
1767                 x1->if_id = x->if_id;
1768 
1769             __xfrm_state_bump_genids(x1);
1770             spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1771         }
1772 
1773         err = 0;
1774         x->km.state = XFRM_STATE_DEAD;
1775         __xfrm_state_put(x);
1776     }
1777 
1778 fail:
1779     spin_unlock_bh(&x1->lock);
1780 
1781     xfrm_state_put(x1);
1782 
1783     return err;
1784 }
1785 EXPORT_SYMBOL(xfrm_state_update);
1786 
1787 int xfrm_state_check_expire(struct xfrm_state *x)
1788 {
1789     if (!x->curlft.use_time)
1790         x->curlft.use_time = ktime_get_real_seconds();
1791 
1792     if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1793         x->curlft.packets >= x->lft.hard_packet_limit) {
1794         x->km.state = XFRM_STATE_EXPIRED;
1795         hrtimer_start(&x->mtimer, 0, HRTIMER_MODE_REL_SOFT);
1796         return -EINVAL;
1797     }
1798 
1799     if (!x->km.dying &&
1800         (x->curlft.bytes >= x->lft.soft_byte_limit ||
1801          x->curlft.packets >= x->lft.soft_packet_limit)) {
1802         x->km.dying = 1;
1803         km_state_expired(x, 0, 0);
1804     }
1805     return 0;
1806 }
1807 EXPORT_SYMBOL(xfrm_state_check_expire);
1808 
1809 struct xfrm_state *
1810 xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi,
1811           u8 proto, unsigned short family)
1812 {
1813     struct xfrm_state *x;
1814 
1815     rcu_read_lock();
1816     x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
1817     rcu_read_unlock();
1818     return x;
1819 }
1820 EXPORT_SYMBOL(xfrm_state_lookup);
1821 
1822 struct xfrm_state *
1823 xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1824              const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1825              u8 proto, unsigned short family)
1826 {
1827     struct xfrm_state *x;
1828 
1829     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1830     x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
1831     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1832     return x;
1833 }
1834 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1835 
1836 struct xfrm_state *
1837 xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid,
1838           u32 if_id, u8 proto, const xfrm_address_t *daddr,
1839           const xfrm_address_t *saddr, int create, unsigned short family)
1840 {
1841     struct xfrm_state *x;
1842 
1843     spin_lock_bh(&net->xfrm.xfrm_state_lock);
1844     x = __find_acq_core(net, mark, family, mode, reqid, if_id, proto, daddr, saddr, create);
1845     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
1846 
1847     return x;
1848 }
1849 EXPORT_SYMBOL(xfrm_find_acq);
1850 
1851 #ifdef CONFIG_XFRM_SUB_POLICY
1852 #if IS_ENABLED(CONFIG_IPV6)
1853 /* distribution counting sort function for xfrm_state and xfrm_tmpl */
1854 static void
1855 __xfrm6_sort(void **dst, void **src, int n,
1856          int (*cmp)(const void *p), int maxclass)
1857 {
1858     int count[XFRM_MAX_DEPTH] = { };
1859     int class[XFRM_MAX_DEPTH];
1860     int i;
1861 
1862     for (i = 0; i < n; i++) {
1863         int c = cmp(src[i]);
1864 
1865         class[i] = c;
1866         count[c]++;
1867     }
1868 
1869     for (i = 2; i < maxclass; i++)
1870         count[i] += count[i - 1];
1871 
1872     for (i = 0; i < n; i++) {
1873         dst[count[class[i] - 1]++] = src[i];
1874         src[i] = NULL;
1875     }
1876 }
1877 
1878 /* Rule for xfrm_state:
1879  *
1880  * rule 1: select IPsec transport except AH
1881  * rule 2: select MIPv6 RO or inbound trigger
1882  * rule 3: select IPsec transport AH
1883  * rule 4: select IPsec tunnel
1884  * rule 5: others
1885  */
1886 static int __xfrm6_state_sort_cmp(const void *p)
1887 {
1888     const struct xfrm_state *v = p;
1889 
1890     switch (v->props.mode) {
1891     case XFRM_MODE_TRANSPORT:
1892         if (v->id.proto != IPPROTO_AH)
1893             return 1;
1894         else
1895             return 3;
1896 #if IS_ENABLED(CONFIG_IPV6_MIP6)
1897     case XFRM_MODE_ROUTEOPTIMIZATION:
1898     case XFRM_MODE_IN_TRIGGER:
1899         return 2;
1900 #endif
1901     case XFRM_MODE_TUNNEL:
1902     case XFRM_MODE_BEET:
1903         return 4;
1904     }
1905     return 5;
1906 }
1907 
1908 /* Rule for xfrm_tmpl:
1909  *
1910  * rule 1: select IPsec transport
1911  * rule 2: select MIPv6 RO or inbound trigger
1912  * rule 3: select IPsec tunnel
1913  * rule 4: others
1914  */
1915 static int __xfrm6_tmpl_sort_cmp(const void *p)
1916 {
1917     const struct xfrm_tmpl *v = p;
1918 
1919     switch (v->mode) {
1920     case XFRM_MODE_TRANSPORT:
1921         return 1;
1922 #if IS_ENABLED(CONFIG_IPV6_MIP6)
1923     case XFRM_MODE_ROUTEOPTIMIZATION:
1924     case XFRM_MODE_IN_TRIGGER:
1925         return 2;
1926 #endif
1927     case XFRM_MODE_TUNNEL:
1928     case XFRM_MODE_BEET:
1929         return 3;
1930     }
1931     return 4;
1932 }
1933 #else
1934 static inline int __xfrm6_state_sort_cmp(const void *p) { return 5; }
1935 static inline int __xfrm6_tmpl_sort_cmp(const void *p) { return 4; }
1936 
1937 static inline void
1938 __xfrm6_sort(void **dst, void **src, int n,
1939          int (*cmp)(const void *p), int maxclass)
1940 {
1941     int i;
1942 
1943     for (i = 0; i < n; i++)
1944         dst[i] = src[i];
1945 }
1946 #endif /* CONFIG_IPV6 */
1947 
1948 void
1949 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1950            unsigned short family)
1951 {
1952     int i;
1953 
1954     if (family == AF_INET6)
1955         __xfrm6_sort((void **)dst, (void **)src, n,
1956                  __xfrm6_tmpl_sort_cmp, 5);
1957     else
1958         for (i = 0; i < n; i++)
1959             dst[i] = src[i];
1960 }
1961 
1962 void
1963 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1964         unsigned short family)
1965 {
1966     int i;
1967 
1968     if (family == AF_INET6)
1969         __xfrm6_sort((void **)dst, (void **)src, n,
1970                  __xfrm6_state_sort_cmp, 6);
1971     else
1972         for (i = 0; i < n; i++)
1973             dst[i] = src[i];
1974 }
1975 #endif
1976 
1977 /* Silly enough, but I'm lazy to build resolution list */
1978 
1979 static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
1980 {
1981     unsigned int h = xfrm_seq_hash(net, seq);
1982     struct xfrm_state *x;
1983 
1984     hlist_for_each_entry_rcu(x, net->xfrm.state_byseq + h, byseq) {
1985         if (x->km.seq == seq &&
1986             (mark & x->mark.m) == x->mark.v &&
1987             x->km.state == XFRM_STATE_ACQ) {
1988             xfrm_state_hold(x);
1989             return x;
1990         }
1991     }
1992 
1993     return NULL;
1994 }
1995 
1996 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
1997 {
1998     struct xfrm_state *x;
1999 
2000     spin_lock_bh(&net->xfrm.xfrm_state_lock);
2001     x = __xfrm_find_acq_byseq(net, mark, seq);
2002     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
2003     return x;
2004 }
2005 EXPORT_SYMBOL(xfrm_find_acq_byseq);
2006 
2007 u32 xfrm_get_acqseq(void)
2008 {
2009     u32 res;
2010     static atomic_t acqseq;
2011 
2012     do {
2013         res = atomic_inc_return(&acqseq);
2014     } while (!res);
2015 
2016     return res;
2017 }
2018 EXPORT_SYMBOL(xfrm_get_acqseq);
2019 
2020 int verify_spi_info(u8 proto, u32 min, u32 max)
2021 {
2022     switch (proto) {
2023     case IPPROTO_AH:
2024     case IPPROTO_ESP:
2025         break;
2026 
2027     case IPPROTO_COMP:
2028         /* IPCOMP spi is 16-bits. */
2029         if (max >= 0x10000)
2030             return -EINVAL;
2031         break;
2032 
2033     default:
2034         return -EINVAL;
2035     }
2036 
2037     if (min > max)
2038         return -EINVAL;
2039 
2040     return 0;
2041 }
2042 EXPORT_SYMBOL(verify_spi_info);
2043 
2044 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
2045 {
2046     struct net *net = xs_net(x);
2047     unsigned int h;
2048     struct xfrm_state *x0;
2049     int err = -ENOENT;
2050     __be32 minspi = htonl(low);
2051     __be32 maxspi = htonl(high);
2052     __be32 newspi = 0;
2053     u32 mark = x->mark.v & x->mark.m;
2054 
2055     spin_lock_bh(&x->lock);
2056     if (x->km.state == XFRM_STATE_DEAD)
2057         goto unlock;
2058 
2059     err = 0;
2060     if (x->id.spi)
2061         goto unlock;
2062 
2063     err = -ENOENT;
2064 
2065     if (minspi == maxspi) {
2066         x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
2067         if (x0) {
2068             xfrm_state_put(x0);
2069             goto unlock;
2070         }
2071         newspi = minspi;
2072     } else {
2073         u32 spi = 0;
2074         for (h = 0; h < high-low+1; h++) {
2075             spi = low + prandom_u32()%(high-low+1);
2076             x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
2077             if (x0 == NULL) {
2078                 newspi = htonl(spi);
2079                 break;
2080             }
2081             xfrm_state_put(x0);
2082         }
2083     }
2084     if (newspi) {
2085         spin_lock_bh(&net->xfrm.xfrm_state_lock);
2086         x->id.spi = newspi;
2087         h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
2088         hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h);
2089         spin_unlock_bh(&net->xfrm.xfrm_state_lock);
2090 
2091         err = 0;
2092     }
2093 
2094 unlock:
2095     spin_unlock_bh(&x->lock);
2096 
2097     return err;
2098 }
2099 EXPORT_SYMBOL(xfrm_alloc_spi);
2100 
2101 static bool __xfrm_state_filter_match(struct xfrm_state *x,
2102                       struct xfrm_address_filter *filter)
2103 {
2104     if (filter) {
2105         if ((filter->family == AF_INET ||
2106              filter->family == AF_INET6) &&
2107             x->props.family != filter->family)
2108             return false;
2109 
2110         return addr_match(&x->props.saddr, &filter->saddr,
2111                   filter->splen) &&
2112                addr_match(&x->id.daddr, &filter->daddr,
2113                   filter->dplen);
2114     }
2115     return true;
2116 }
2117 
2118 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
2119             int (*func)(struct xfrm_state *, int, void*),
2120             void *data)
2121 {
2122     struct xfrm_state *state;
2123     struct xfrm_state_walk *x;
2124     int err = 0;
2125 
2126     if (walk->seq != 0 && list_empty(&walk->all))
2127         return 0;
2128 
2129     spin_lock_bh(&net->xfrm.xfrm_state_lock);
2130     if (list_empty(&walk->all))
2131         x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
2132     else
2133         x = list_first_entry(&walk->all, struct xfrm_state_walk, all);
2134     list_for_each_entry_from(x, &net->xfrm.state_all, all) {
2135         if (x->state == XFRM_STATE_DEAD)
2136             continue;
2137         state = container_of(x, struct xfrm_state, km);
2138         if (!xfrm_id_proto_match(state->id.proto, walk->proto))
2139             continue;
2140         if (!__xfrm_state_filter_match(state, walk->filter))
2141             continue;
2142         err = func(state, walk->seq, data);
2143         if (err) {
2144             list_move_tail(&walk->all, &x->all);
2145             goto out;
2146         }
2147         walk->seq++;
2148     }
2149     if (walk->seq == 0) {
2150         err = -ENOENT;
2151         goto out;
2152     }
2153     list_del_init(&walk->all);
2154 out:
2155     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
2156     return err;
2157 }
2158 EXPORT_SYMBOL(xfrm_state_walk);
2159 
2160 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
2161               struct xfrm_address_filter *filter)
2162 {
2163     INIT_LIST_HEAD(&walk->all);
2164     walk->proto = proto;
2165     walk->state = XFRM_STATE_DEAD;
2166     walk->seq = 0;
2167     walk->filter = filter;
2168 }
2169 EXPORT_SYMBOL(xfrm_state_walk_init);
2170 
2171 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net)
2172 {
2173     kfree(walk->filter);
2174 
2175     if (list_empty(&walk->all))
2176         return;
2177 
2178     spin_lock_bh(&net->xfrm.xfrm_state_lock);
2179     list_del(&walk->all);
2180     spin_unlock_bh(&net->xfrm.xfrm_state_lock);
2181 }
2182 EXPORT_SYMBOL(xfrm_state_walk_done);
2183 
2184 static void xfrm_replay_timer_handler(struct timer_list *t)
2185 {
2186     struct xfrm_state *x = from_timer(x, t, rtimer);
2187 
2188     spin_lock(&x->lock);
2189 
2190     if (x->km.state == XFRM_STATE_VALID) {
2191         if (xfrm_aevent_is_on(xs_net(x)))
2192             xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
2193         else
2194             x->xflags |= XFRM_TIME_DEFER;
2195     }
2196 
2197     spin_unlock(&x->lock);
2198 }
2199 
2200 static LIST_HEAD(xfrm_km_list);
2201 
2202 void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
2203 {
2204     struct xfrm_mgr *km;
2205 
2206     rcu_read_lock();
2207     list_for_each_entry_rcu(km, &xfrm_km_list, list)
2208         if (km->notify_policy)
2209             km->notify_policy(xp, dir, c);
2210     rcu_read_unlock();
2211 }
2212 
2213 void km_state_notify(struct xfrm_state *x, const struct km_event *c)
2214 {
2215     struct xfrm_mgr *km;
2216     rcu_read_lock();
2217     list_for_each_entry_rcu(km, &xfrm_km_list, list)
2218         if (km->notify)
2219             km->notify(x, c);
2220     rcu_read_unlock();
2221 }
2222 
2223 EXPORT_SYMBOL(km_policy_notify);
2224 EXPORT_SYMBOL(km_state_notify);
2225 
2226 void km_state_expired(struct xfrm_state *x, int hard, u32 portid)
2227 {
2228     struct km_event c;
2229 
2230     c.data.hard = hard;
2231     c.portid = portid;
2232     c.event = XFRM_MSG_EXPIRE;
2233     km_state_notify(x, &c);
2234 }
2235 
2236 EXPORT_SYMBOL(km_state_expired);
2237 /*
2238  * We send to all registered managers regardless of failure
2239  * We are happy with one success
2240 */
2241 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
2242 {
2243     int err = -EINVAL, acqret;
2244     struct xfrm_mgr *km;
2245 
2246     rcu_read_lock();
2247     list_for_each_entry_rcu(km, &xfrm_km_list, list) {
2248         acqret = km->acquire(x, t, pol);
2249         if (!acqret)
2250             err = acqret;
2251     }
2252     rcu_read_unlock();
2253     return err;
2254 }
2255 EXPORT_SYMBOL(km_query);
2256 
2257 static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
2258 {
2259     int err = -EINVAL;
2260     struct xfrm_mgr *km;
2261 
2262     rcu_read_lock();
2263     list_for_each_entry_rcu(km, &xfrm_km_list, list) {
2264         if (km->new_mapping)
2265             err = km->new_mapping(x, ipaddr, sport);
2266         if (!err)
2267             break;
2268     }
2269     rcu_read_unlock();
2270     return err;
2271 }
2272 
2273 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
2274 {
2275     int ret = 0;
2276 
2277     if (x->mapping_maxage) {
2278         if ((jiffies / HZ - x->new_mapping) > x->mapping_maxage ||
2279             x->new_mapping_sport != sport) {
2280             x->new_mapping_sport = sport;
2281             x->new_mapping = jiffies / HZ;
2282             ret = __km_new_mapping(x, ipaddr, sport);
2283         }
2284     } else {
2285         ret = __km_new_mapping(x, ipaddr, sport);
2286     }
2287 
2288     return ret;
2289 }
2290 EXPORT_SYMBOL(km_new_mapping);
2291 
2292 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
2293 {
2294     struct km_event c;
2295 
2296     c.data.hard = hard;
2297     c.portid = portid;
2298     c.event = XFRM_MSG_POLEXPIRE;
2299     km_policy_notify(pol, dir, &c);
2300 }
2301 EXPORT_SYMBOL(km_policy_expired);
2302 
2303 #ifdef CONFIG_XFRM_MIGRATE
2304 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2305            const struct xfrm_migrate *m, int num_migrate,
2306            const struct xfrm_kmaddress *k,
2307            const struct xfrm_encap_tmpl *encap)
2308 {
2309     int err = -EINVAL;
2310     int ret;
2311     struct xfrm_mgr *km;
2312 
2313     rcu_read_lock();
2314     list_for_each_entry_rcu(km, &xfrm_km_list, list) {
2315         if (km->migrate) {
2316             ret = km->migrate(sel, dir, type, m, num_migrate, k,
2317                       encap);
2318             if (!ret)
2319                 err = ret;
2320         }
2321     }
2322     rcu_read_unlock();
2323     return err;
2324 }
2325 EXPORT_SYMBOL(km_migrate);
2326 #endif
2327 
2328 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
2329 {
2330     int err = -EINVAL;
2331     int ret;
2332     struct xfrm_mgr *km;
2333 
2334     rcu_read_lock();
2335     list_for_each_entry_rcu(km, &xfrm_km_list, list) {
2336         if (km->report) {
2337             ret = km->report(net, proto, sel, addr);
2338             if (!ret)
2339                 err = ret;
2340         }
2341     }
2342     rcu_read_unlock();
2343     return err;
2344 }
2345 EXPORT_SYMBOL(km_report);
2346 
2347 static bool km_is_alive(const struct km_event *c)
2348 {
2349     struct xfrm_mgr *km;
2350     bool is_alive = false;
2351 
2352     rcu_read_lock();
2353     list_for_each_entry_rcu(km, &xfrm_km_list, list) {
2354         if (km->is_alive && km->is_alive(c)) {
2355             is_alive = true;
2356             break;
2357         }
2358     }
2359     rcu_read_unlock();
2360 
2361     return is_alive;
2362 }
2363 
2364 #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
2365 static DEFINE_SPINLOCK(xfrm_translator_lock);
2366 static struct xfrm_translator __rcu *xfrm_translator;
2367 
2368 struct xfrm_translator *xfrm_get_translator(void)
2369 {
2370     struct xfrm_translator *xtr;
2371 
2372     rcu_read_lock();
2373     xtr = rcu_dereference(xfrm_translator);
2374     if (unlikely(!xtr))
2375         goto out;
2376     if (!try_module_get(xtr->owner))
2377         xtr = NULL;
2378 out:
2379     rcu_read_unlock();
2380     return xtr;
2381 }
2382 EXPORT_SYMBOL_GPL(xfrm_get_translator);
2383 
2384 void xfrm_put_translator(struct xfrm_translator *xtr)
2385 {
2386     module_put(xtr->owner);
2387 }
2388 EXPORT_SYMBOL_GPL(xfrm_put_translator);
2389 
2390 int xfrm_register_translator(struct xfrm_translator *xtr)
2391 {
2392     int err = 0;
2393 
2394     spin_lock_bh(&xfrm_translator_lock);
2395     if (unlikely(xfrm_translator != NULL))
2396         err = -EEXIST;
2397     else
2398         rcu_assign_pointer(xfrm_translator, xtr);
2399     spin_unlock_bh(&xfrm_translator_lock);
2400 
2401     return err;
2402 }
2403 EXPORT_SYMBOL_GPL(xfrm_register_translator);
2404 
2405 int xfrm_unregister_translator(struct xfrm_translator *xtr)
2406 {
2407     int err = 0;
2408 
2409     spin_lock_bh(&xfrm_translator_lock);
2410     if (likely(xfrm_translator != NULL)) {
2411         if (rcu_access_pointer(xfrm_translator) != xtr)
2412             err = -EINVAL;
2413         else
2414             RCU_INIT_POINTER(xfrm_translator, NULL);
2415     }
2416     spin_unlock_bh(&xfrm_translator_lock);
2417     synchronize_rcu();
2418 
2419     return err;
2420 }
2421 EXPORT_SYMBOL_GPL(xfrm_unregister_translator);
2422 #endif
2423 
2424 int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, int optlen)
2425 {
2426     int err;
2427     u8 *data;
2428     struct xfrm_mgr *km;
2429     struct xfrm_policy *pol = NULL;
2430 
2431     if (sockptr_is_null(optval) && !optlen) {
2432         xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
2433         xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
2434         __sk_dst_reset(sk);
2435         return 0;
2436     }
2437 
2438     if (optlen <= 0 || optlen > PAGE_SIZE)
2439         return -EMSGSIZE;
2440 
2441     data = memdup_sockptr(optval, optlen);
2442     if (IS_ERR(data))
2443         return PTR_ERR(data);
2444 
2445     if (in_compat_syscall()) {
2446         struct xfrm_translator *xtr = xfrm_get_translator();
2447 
2448         if (!xtr) {
2449             kfree(data);
2450             return -EOPNOTSUPP;
2451         }
2452 
2453         err = xtr->xlate_user_policy_sockptr(&data, optlen);
2454         xfrm_put_translator(xtr);
2455         if (err) {
2456             kfree(data);
2457             return err;
2458         }
2459     }
2460 
2461     err = -EINVAL;
2462     rcu_read_lock();
2463     list_for_each_entry_rcu(km, &xfrm_km_list, list) {
2464         pol = km->compile_policy(sk, optname, data,
2465                      optlen, &err);
2466         if (err >= 0)
2467             break;
2468     }
2469     rcu_read_unlock();
2470 
2471     if (err >= 0) {
2472         xfrm_sk_policy_insert(sk, err, pol);
2473         xfrm_pol_put(pol);
2474         __sk_dst_reset(sk);
2475         err = 0;
2476     }
2477 
2478     kfree(data);
2479     return err;
2480 }
2481 EXPORT_SYMBOL(xfrm_user_policy);
2482 
2483 static DEFINE_SPINLOCK(xfrm_km_lock);
2484 
2485 void xfrm_register_km(struct xfrm_mgr *km)
2486 {
2487     spin_lock_bh(&xfrm_km_lock);
2488     list_add_tail_rcu(&km->list, &xfrm_km_list);
2489     spin_unlock_bh(&xfrm_km_lock);
2490 }
2491 EXPORT_SYMBOL(xfrm_register_km);
2492 
2493 void xfrm_unregister_km(struct xfrm_mgr *km)
2494 {
2495     spin_lock_bh(&xfrm_km_lock);
2496     list_del_rcu(&km->list);
2497     spin_unlock_bh(&xfrm_km_lock);
2498     synchronize_rcu();
2499 }
2500 EXPORT_SYMBOL(xfrm_unregister_km);
2501 
2502 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
2503 {
2504     int err = 0;
2505 
2506     if (WARN_ON(afinfo->family >= NPROTO))
2507         return -EAFNOSUPPORT;
2508 
2509     spin_lock_bh(&xfrm_state_afinfo_lock);
2510     if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
2511         err = -EEXIST;
2512     else
2513         rcu_assign_pointer(xfrm_state_afinfo[afinfo->family], afinfo);
2514     spin_unlock_bh(&xfrm_state_afinfo_lock);
2515     return err;
2516 }
2517 EXPORT_SYMBOL(xfrm_state_register_afinfo);
2518 
2519 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
2520 {
2521     int err = 0, family = afinfo->family;
2522 
2523     if (WARN_ON(family >= NPROTO))
2524         return -EAFNOSUPPORT;
2525 
2526     spin_lock_bh(&xfrm_state_afinfo_lock);
2527     if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
2528         if (rcu_access_pointer(xfrm_state_afinfo[family]) != afinfo)
2529             err = -EINVAL;
2530         else
2531             RCU_INIT_POINTER(xfrm_state_afinfo[afinfo->family], NULL);
2532     }
2533     spin_unlock_bh(&xfrm_state_afinfo_lock);
2534     synchronize_rcu();
2535     return err;
2536 }
2537 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
2538 
2539 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family)
2540 {
2541     if (unlikely(family >= NPROTO))
2542         return NULL;
2543 
2544     return rcu_dereference(xfrm_state_afinfo[family]);
2545 }
2546 EXPORT_SYMBOL_GPL(xfrm_state_afinfo_get_rcu);
2547 
2548 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
2549 {
2550     struct xfrm_state_afinfo *afinfo;
2551     if (unlikely(family >= NPROTO))
2552         return NULL;
2553     rcu_read_lock();
2554     afinfo = rcu_dereference(xfrm_state_afinfo[family]);
2555     if (unlikely(!afinfo))
2556         rcu_read_unlock();
2557     return afinfo;
2558 }
2559 
2560 void xfrm_flush_gc(void)
2561 {
2562     flush_work(&xfrm_state_gc_work);
2563 }
2564 EXPORT_SYMBOL(xfrm_flush_gc);
2565 
2566 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
2567 void xfrm_state_delete_tunnel(struct xfrm_state *x)
2568 {
2569     if (x->tunnel) {
2570         struct xfrm_state *t = x->tunnel;
2571 
2572         if (atomic_read(&t->tunnel_users) == 2)
2573             xfrm_state_delete(t);
2574         atomic_dec(&t->tunnel_users);
2575         xfrm_state_put_sync(t);
2576         x->tunnel = NULL;
2577     }
2578 }
2579 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
2580 
2581 u32 xfrm_state_mtu(struct xfrm_state *x, int mtu)
2582 {
2583     const struct xfrm_type *type = READ_ONCE(x->type);
2584     struct crypto_aead *aead;
2585     u32 blksize, net_adj = 0;
2586 
2587     if (x->km.state != XFRM_STATE_VALID ||
2588         !type || type->proto != IPPROTO_ESP)
2589         return mtu - x->props.header_len;
2590 
2591     aead = x->data;
2592     blksize = ALIGN(crypto_aead_blocksize(aead), 4);
2593 
2594     switch (x->props.mode) {
2595     case XFRM_MODE_TRANSPORT:
2596     case XFRM_MODE_BEET:
2597         if (x->props.family == AF_INET)
2598             net_adj = sizeof(struct iphdr);
2599         else if (x->props.family == AF_INET6)
2600             net_adj = sizeof(struct ipv6hdr);
2601         break;
2602     case XFRM_MODE_TUNNEL:
2603         break;
2604     default:
2605         WARN_ON_ONCE(1);
2606         break;
2607     }
2608 
2609     return ((mtu - x->props.header_len - crypto_aead_authsize(aead) -
2610          net_adj) & ~(blksize - 1)) + net_adj - 2;
2611 }
2612 EXPORT_SYMBOL_GPL(xfrm_state_mtu);
2613 
2614 int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload)
2615 {
2616     const struct xfrm_mode *inner_mode;
2617     const struct xfrm_mode *outer_mode;
2618     int family = x->props.family;
2619     int err;
2620 
2621     if (family == AF_INET &&
2622         READ_ONCE(xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc))
2623         x->props.flags |= XFRM_STATE_NOPMTUDISC;
2624 
2625     err = -EPROTONOSUPPORT;
2626 
2627     if (x->sel.family != AF_UNSPEC) {
2628         inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
2629         if (inner_mode == NULL)
2630             goto error;
2631 
2632         if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2633             family != x->sel.family)
2634             goto error;
2635 
2636         x->inner_mode = *inner_mode;
2637     } else {
2638         const struct xfrm_mode *inner_mode_iaf;
2639         int iafamily = AF_INET;
2640 
2641         inner_mode = xfrm_get_mode(x->props.mode, x->props.family);
2642         if (inner_mode == NULL)
2643             goto error;
2644 
2645         if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL))
2646             goto error;
2647 
2648         x->inner_mode = *inner_mode;
2649 
2650         if (x->props.family == AF_INET)
2651             iafamily = AF_INET6;
2652 
2653         inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily);
2654         if (inner_mode_iaf) {
2655             if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)
2656                 x->inner_mode_iaf = *inner_mode_iaf;
2657         }
2658     }
2659 
2660     x->type = xfrm_get_type(x->id.proto, family);
2661     if (x->type == NULL)
2662         goto error;
2663 
2664     x->type_offload = xfrm_get_type_offload(x->id.proto, family, offload);
2665 
2666     err = x->type->init_state(x);
2667     if (err)
2668         goto error;
2669 
2670     outer_mode = xfrm_get_mode(x->props.mode, family);
2671     if (!outer_mode) {
2672         err = -EPROTONOSUPPORT;
2673         goto error;
2674     }
2675 
2676     x->outer_mode = *outer_mode;
2677     if (init_replay) {
2678         err = xfrm_init_replay(x);
2679         if (err)
2680             goto error;
2681     }
2682 
2683 error:
2684     return err;
2685 }
2686 
2687 EXPORT_SYMBOL(__xfrm_init_state);
2688 
2689 int xfrm_init_state(struct xfrm_state *x)
2690 {
2691     int err;
2692 
2693     err = __xfrm_init_state(x, true, false);
2694     if (!err)
2695         x->km.state = XFRM_STATE_VALID;
2696 
2697     return err;
2698 }
2699 
2700 EXPORT_SYMBOL(xfrm_init_state);
2701 
2702 int __net_init xfrm_state_init(struct net *net)
2703 {
2704     unsigned int sz;
2705 
2706     if (net_eq(net, &init_net))
2707         xfrm_state_cache = KMEM_CACHE(xfrm_state,
2708                           SLAB_HWCACHE_ALIGN | SLAB_PANIC);
2709 
2710     INIT_LIST_HEAD(&net->xfrm.state_all);
2711 
2712     sz = sizeof(struct hlist_head) * 8;
2713 
2714     net->xfrm.state_bydst = xfrm_hash_alloc(sz);
2715     if (!net->xfrm.state_bydst)
2716         goto out_bydst;
2717     net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
2718     if (!net->xfrm.state_bysrc)
2719         goto out_bysrc;
2720     net->xfrm.state_byspi = xfrm_hash_alloc(sz);
2721     if (!net->xfrm.state_byspi)
2722         goto out_byspi;
2723     net->xfrm.state_byseq = xfrm_hash_alloc(sz);
2724     if (!net->xfrm.state_byseq)
2725         goto out_byseq;
2726     net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2727 
2728     net->xfrm.state_num = 0;
2729     INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
2730     spin_lock_init(&net->xfrm.xfrm_state_lock);
2731     seqcount_spinlock_init(&net->xfrm.xfrm_state_hash_generation,
2732                    &net->xfrm.xfrm_state_lock);
2733     return 0;
2734 
2735 out_byseq:
2736     xfrm_hash_free(net->xfrm.state_byspi, sz);
2737 out_byspi:
2738     xfrm_hash_free(net->xfrm.state_bysrc, sz);
2739 out_bysrc:
2740     xfrm_hash_free(net->xfrm.state_bydst, sz);
2741 out_bydst:
2742     return -ENOMEM;
2743 }
2744 
2745 void xfrm_state_fini(struct net *net)
2746 {
2747     unsigned int sz;
2748 
2749     flush_work(&net->xfrm.state_hash_work);
2750     flush_work(&xfrm_state_gc_work);
2751     xfrm_state_flush(net, 0, false, true);
2752 
2753     WARN_ON(!list_empty(&net->xfrm.state_all));
2754 
2755     sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
2756     WARN_ON(!hlist_empty(net->xfrm.state_byseq));
2757     xfrm_hash_free(net->xfrm.state_byseq, sz);
2758     WARN_ON(!hlist_empty(net->xfrm.state_byspi));
2759     xfrm_hash_free(net->xfrm.state_byspi, sz);
2760     WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
2761     xfrm_hash_free(net->xfrm.state_bysrc, sz);
2762     WARN_ON(!hlist_empty(net->xfrm.state_bydst));
2763     xfrm_hash_free(net->xfrm.state_bydst, sz);
2764 }
2765 
2766 #ifdef CONFIG_AUDITSYSCALL
2767 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2768                      struct audit_buffer *audit_buf)
2769 {
2770     struct xfrm_sec_ctx *ctx = x->security;
2771     u32 spi = ntohl(x->id.spi);
2772 
2773     if (ctx)
2774         audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2775                  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2776 
2777     switch (x->props.family) {
2778     case AF_INET:
2779         audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2780                  &x->props.saddr.a4, &x->id.daddr.a4);
2781         break;
2782     case AF_INET6:
2783         audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
2784                  x->props.saddr.a6, x->id.daddr.a6);
2785         break;
2786     }
2787 
2788     audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2789 }
2790 
2791 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2792                       struct audit_buffer *audit_buf)
2793 {
2794     const struct iphdr *iph4;
2795     const struct ipv6hdr *iph6;
2796 
2797     switch (family) {
2798     case AF_INET:
2799         iph4 = ip_hdr(skb);
2800         audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
2801                  &iph4->saddr, &iph4->daddr);
2802         break;
2803     case AF_INET6:
2804         iph6 = ipv6_hdr(skb);
2805         audit_log_format(audit_buf,
2806                  " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
2807                  &iph6->saddr, &iph6->daddr,
2808                  iph6->flow_lbl[0] & 0x0f,
2809                  iph6->flow_lbl[1],
2810                  iph6->flow_lbl[2]);
2811         break;
2812     }
2813 }
2814 
2815 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid)
2816 {
2817     struct audit_buffer *audit_buf;
2818 
2819     audit_buf = xfrm_audit_start("SAD-add");
2820     if (audit_buf == NULL)
2821         return;
2822     xfrm_audit_helper_usrinfo(task_valid, audit_buf);
2823     xfrm_audit_helper_sainfo(x, audit_buf);
2824     audit_log_format(audit_buf, " res=%u", result);
2825     audit_log_end(audit_buf);
2826 }
2827 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2828 
2829 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid)
2830 {
2831     struct audit_buffer *audit_buf;
2832 
2833     audit_buf = xfrm_audit_start("SAD-delete");
2834     if (audit_buf == NULL)
2835         return;
2836     xfrm_audit_helper_usrinfo(task_valid, audit_buf);
2837     xfrm_audit_helper_sainfo(x, audit_buf);
2838     audit_log_format(audit_buf, " res=%u", result);
2839     audit_log_end(audit_buf);
2840 }
2841 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2842 
2843 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2844                       struct sk_buff *skb)
2845 {
2846     struct audit_buffer *audit_buf;
2847     u32 spi;
2848 
2849     audit_buf = xfrm_audit_start("SA-replay-overflow");
2850     if (audit_buf == NULL)
2851         return;
2852     xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2853     /* don't record the sequence number because it's inherent in this kind
2854      * of audit message */
2855     spi = ntohl(x->id.spi);
2856     audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2857     audit_log_end(audit_buf);
2858 }
2859 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2860 
2861 void xfrm_audit_state_replay(struct xfrm_state *x,
2862                  struct sk_buff *skb, __be32 net_seq)
2863 {
2864     struct audit_buffer *audit_buf;
2865     u32 spi;
2866 
2867     audit_buf = xfrm_audit_start("SA-replayed-pkt");
2868     if (audit_buf == NULL)
2869         return;
2870     xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2871     spi = ntohl(x->id.spi);
2872     audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2873              spi, spi, ntohl(net_seq));
2874     audit_log_end(audit_buf);
2875 }
2876 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay);
2877 
2878 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2879 {
2880     struct audit_buffer *audit_buf;
2881 
2882     audit_buf = xfrm_audit_start("SA-notfound");
2883     if (audit_buf == NULL)
2884         return;
2885     xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2886     audit_log_end(audit_buf);
2887 }
2888 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2889 
2890 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2891                    __be32 net_spi, __be32 net_seq)
2892 {
2893     struct audit_buffer *audit_buf;
2894     u32 spi;
2895 
2896     audit_buf = xfrm_audit_start("SA-notfound");
2897     if (audit_buf == NULL)
2898         return;
2899     xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2900     spi = ntohl(net_spi);
2901     audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2902              spi, spi, ntohl(net_seq));
2903     audit_log_end(audit_buf);
2904 }
2905 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2906 
2907 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2908                   struct sk_buff *skb, u8 proto)
2909 {
2910     struct audit_buffer *audit_buf;
2911     __be32 net_spi;
2912     __be32 net_seq;
2913 
2914     audit_buf = xfrm_audit_start("SA-icv-failure");
2915     if (audit_buf == NULL)
2916         return;
2917     xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2918     if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2919         u32 spi = ntohl(net_spi);
2920         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2921                  spi, spi, ntohl(net_seq));
2922     }
2923     audit_log_end(audit_buf);
2924 }
2925 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2926 #endif /* CONFIG_AUDITSYSCALL */
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!