netns xfrm: per-netns sysctls
[linux-2.6.git] / net / xfrm / xfrm_policy.c
1 /*
2  * xfrm_policy.c
3  *
4  * Changes:
5  *      Mitsuru KANDA @USAGI
6  *      Kazunori MIYAZAWA @USAGI
7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8  *              IPv6 support
9  *      Kazunori MIYAZAWA @USAGI
10  *      YOSHIFUJI Hideaki
11  *              Split up af-specific portion
12  *      Derek Atkins <derek@ihtfp.com>          Add the post_input processor
13  *
14  */
15
16 #include <linux/err.h>
17 #include <linux/slab.h>
18 #include <linux/kmod.h>
19 #include <linux/list.h>
20 #include <linux/spinlock.h>
21 #include <linux/workqueue.h>
22 #include <linux/notifier.h>
23 #include <linux/netdevice.h>
24 #include <linux/netfilter.h>
25 #include <linux/module.h>
26 #include <linux/cache.h>
27 #include <linux/audit.h>
28 #include <net/dst.h>
29 #include <net/xfrm.h>
30 #include <net/ip.h>
31 #ifdef CONFIG_XFRM_STATISTICS
32 #include <net/snmp.h>
33 #endif
34
35 #include "xfrm_hash.h"
36
37 DEFINE_MUTEX(xfrm_cfg_mutex);
38 EXPORT_SYMBOL(xfrm_cfg_mutex);
39
40 static DEFINE_RWLOCK(xfrm_policy_lock);
41
42 static DEFINE_RWLOCK(xfrm_policy_afinfo_lock);
43 static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO];
44
45 static struct kmem_cache *xfrm_dst_cache __read_mostly;
46
47 static HLIST_HEAD(xfrm_policy_gc_list);
48 static DEFINE_SPINLOCK(xfrm_policy_gc_lock);
49
50 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
51 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
52 static void xfrm_init_pmtu(struct dst_entry *dst);
53
54 static inline int
55 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
56 {
57         return  addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
58                 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
59                 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
60                 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
61                 (fl->proto == sel->proto || !sel->proto) &&
62                 (fl->oif == sel->ifindex || !sel->ifindex);
63 }
64
65 static inline int
66 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
67 {
68         return  addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
69                 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
70                 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
71                 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
72                 (fl->proto == sel->proto || !sel->proto) &&
73                 (fl->oif == sel->ifindex || !sel->ifindex);
74 }
75
76 int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
77                     unsigned short family)
78 {
79         switch (family) {
80         case AF_INET:
81                 return __xfrm4_selector_match(sel, fl);
82         case AF_INET6:
83                 return __xfrm6_selector_match(sel, fl);
84         }
85         return 0;
86 }
87
88 static inline struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos,
89                                                   xfrm_address_t *saddr,
90                                                   xfrm_address_t *daddr,
91                                                   int family)
92 {
93         struct xfrm_policy_afinfo *afinfo;
94         struct dst_entry *dst;
95
96         afinfo = xfrm_policy_get_afinfo(family);
97         if (unlikely(afinfo == NULL))
98                 return ERR_PTR(-EAFNOSUPPORT);
99
100         dst = afinfo->dst_lookup(net, tos, saddr, daddr);
101
102         xfrm_policy_put_afinfo(afinfo);
103
104         return dst;
105 }
106
107 static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, int tos,
108                                                 xfrm_address_t *prev_saddr,
109                                                 xfrm_address_t *prev_daddr,
110                                                 int family)
111 {
112         struct net *net = xs_net(x);
113         xfrm_address_t *saddr = &x->props.saddr;
114         xfrm_address_t *daddr = &x->id.daddr;
115         struct dst_entry *dst;
116
117         if (x->type->flags & XFRM_TYPE_LOCAL_COADDR) {
118                 saddr = x->coaddr;
119                 daddr = prev_daddr;
120         }
121         if (x->type->flags & XFRM_TYPE_REMOTE_COADDR) {
122                 saddr = prev_saddr;
123                 daddr = x->coaddr;
124         }
125
126         dst = __xfrm_dst_lookup(net, tos, saddr, daddr, family);
127
128         if (!IS_ERR(dst)) {
129                 if (prev_saddr != saddr)
130                         memcpy(prev_saddr, saddr,  sizeof(*prev_saddr));
131                 if (prev_daddr != daddr)
132                         memcpy(prev_daddr, daddr,  sizeof(*prev_daddr));
133         }
134
135         return dst;
136 }
137
138 static inline unsigned long make_jiffies(long secs)
139 {
140         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
141                 return MAX_SCHEDULE_TIMEOUT-1;
142         else
143                 return secs*HZ;
144 }
145
146 static void xfrm_policy_timer(unsigned long data)
147 {
148         struct xfrm_policy *xp = (struct xfrm_policy*)data;
149         unsigned long now = get_seconds();
150         long next = LONG_MAX;
151         int warn = 0;
152         int dir;
153
154         read_lock(&xp->lock);
155
156         if (xp->walk.dead)
157                 goto out;
158
159         dir = xfrm_policy_id2dir(xp->index);
160
161         if (xp->lft.hard_add_expires_seconds) {
162                 long tmo = xp->lft.hard_add_expires_seconds +
163                         xp->curlft.add_time - now;
164                 if (tmo <= 0)
165                         goto expired;
166                 if (tmo < next)
167                         next = tmo;
168         }
169         if (xp->lft.hard_use_expires_seconds) {
170                 long tmo = xp->lft.hard_use_expires_seconds +
171                         (xp->curlft.use_time ? : xp->curlft.add_time) - now;
172                 if (tmo <= 0)
173                         goto expired;
174                 if (tmo < next)
175                         next = tmo;
176         }
177         if (xp->lft.soft_add_expires_seconds) {
178                 long tmo = xp->lft.soft_add_expires_seconds +
179                         xp->curlft.add_time - now;
180                 if (tmo <= 0) {
181                         warn = 1;
182                         tmo = XFRM_KM_TIMEOUT;
183                 }
184                 if (tmo < next)
185                         next = tmo;
186         }
187         if (xp->lft.soft_use_expires_seconds) {
188                 long tmo = xp->lft.soft_use_expires_seconds +
189                         (xp->curlft.use_time ? : xp->curlft.add_time) - now;
190                 if (tmo <= 0) {
191                         warn = 1;
192                         tmo = XFRM_KM_TIMEOUT;
193                 }
194                 if (tmo < next)
195                         next = tmo;
196         }
197
198         if (warn)
199                 km_policy_expired(xp, dir, 0, 0);
200         if (next != LONG_MAX &&
201             !mod_timer(&xp->timer, jiffies + make_jiffies(next)))
202                 xfrm_pol_hold(xp);
203
204 out:
205         read_unlock(&xp->lock);
206         xfrm_pol_put(xp);
207         return;
208
209 expired:
210         read_unlock(&xp->lock);
211         if (!xfrm_policy_delete(xp, dir))
212                 km_policy_expired(xp, dir, 1, 0);
213         xfrm_pol_put(xp);
214 }
215
216
217 /* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2
218  * SPD calls.
219  */
220
221 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
222 {
223         struct xfrm_policy *policy;
224
225         policy = kzalloc(sizeof(struct xfrm_policy), gfp);
226
227         if (policy) {
228                 write_pnet(&policy->xp_net, net);
229                 INIT_LIST_HEAD(&policy->walk.all);
230                 INIT_HLIST_NODE(&policy->bydst);
231                 INIT_HLIST_NODE(&policy->byidx);
232                 rwlock_init(&policy->lock);
233                 atomic_set(&policy->refcnt, 1);
234                 setup_timer(&policy->timer, xfrm_policy_timer,
235                                 (unsigned long)policy);
236         }
237         return policy;
238 }
239 EXPORT_SYMBOL(xfrm_policy_alloc);
240
241 /* Destroy xfrm_policy: descendant resources must be released to this moment. */
242
243 void xfrm_policy_destroy(struct xfrm_policy *policy)
244 {
245         BUG_ON(!policy->walk.dead);
246
247         BUG_ON(policy->bundles);
248
249         if (del_timer(&policy->timer))
250                 BUG();
251
252         security_xfrm_policy_free(policy->security);
253         kfree(policy);
254 }
255 EXPORT_SYMBOL(xfrm_policy_destroy);
256
257 static void xfrm_policy_gc_kill(struct xfrm_policy *policy)
258 {
259         struct dst_entry *dst;
260
261         while ((dst = policy->bundles) != NULL) {
262                 policy->bundles = dst->next;
263                 dst_free(dst);
264         }
265
266         if (del_timer(&policy->timer))
267                 atomic_dec(&policy->refcnt);
268
269         if (atomic_read(&policy->refcnt) > 1)
270                 flow_cache_flush();
271
272         xfrm_pol_put(policy);
273 }
274
275 static void xfrm_policy_gc_task(struct work_struct *work)
276 {
277         struct xfrm_policy *policy;
278         struct hlist_node *entry, *tmp;
279         struct hlist_head gc_list;
280
281         spin_lock_bh(&xfrm_policy_gc_lock);
282         gc_list.first = xfrm_policy_gc_list.first;
283         INIT_HLIST_HEAD(&xfrm_policy_gc_list);
284         spin_unlock_bh(&xfrm_policy_gc_lock);
285
286         hlist_for_each_entry_safe(policy, entry, tmp, &gc_list, bydst)
287                 xfrm_policy_gc_kill(policy);
288 }
289 static DECLARE_WORK(xfrm_policy_gc_work, xfrm_policy_gc_task);
290
291 /* Rule must be locked. Release descentant resources, announce
292  * entry dead. The rule must be unlinked from lists to the moment.
293  */
294
295 static void xfrm_policy_kill(struct xfrm_policy *policy)
296 {
297         int dead;
298
299         write_lock_bh(&policy->lock);
300         dead = policy->walk.dead;
301         policy->walk.dead = 1;
302         write_unlock_bh(&policy->lock);
303
304         if (unlikely(dead)) {
305                 WARN_ON(1);
306                 return;
307         }
308
309         spin_lock_bh(&xfrm_policy_gc_lock);
310         hlist_add_head(&policy->bydst, &xfrm_policy_gc_list);
311         spin_unlock_bh(&xfrm_policy_gc_lock);
312
313         schedule_work(&xfrm_policy_gc_work);
314 }
315
316 static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024;
317
318 static inline unsigned int idx_hash(struct net *net, u32 index)
319 {
320         return __idx_hash(index, net->xfrm.policy_idx_hmask);
321 }
322
323 static struct hlist_head *policy_hash_bysel(struct net *net, struct xfrm_selector *sel, unsigned short family, int dir)
324 {
325         unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
326         unsigned int hash = __sel_hash(sel, family, hmask);
327
328         return (hash == hmask + 1 ?
329                 &net->xfrm.policy_inexact[dir] :
330                 net->xfrm.policy_bydst[dir].table + hash);
331 }
332
333 static struct hlist_head *policy_hash_direct(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, unsigned short family, int dir)
334 {
335         unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
336         unsigned int hash = __addr_hash(daddr, saddr, family, hmask);
337
338         return net->xfrm.policy_bydst[dir].table + hash;
339 }
340
341 static void xfrm_dst_hash_transfer(struct hlist_head *list,
342                                    struct hlist_head *ndsttable,
343                                    unsigned int nhashmask)
344 {
345         struct hlist_node *entry, *tmp, *entry0 = NULL;
346         struct xfrm_policy *pol;
347         unsigned int h0 = 0;
348
349 redo:
350         hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) {
351                 unsigned int h;
352
353                 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr,
354                                 pol->family, nhashmask);
355                 if (!entry0) {
356                         hlist_del(entry);
357                         hlist_add_head(&pol->bydst, ndsttable+h);
358                         h0 = h;
359                 } else {
360                         if (h != h0)
361                                 continue;
362                         hlist_del(entry);
363                         hlist_add_after(entry0, &pol->bydst);
364                 }
365                 entry0 = entry;
366         }
367         if (!hlist_empty(list)) {
368                 entry0 = NULL;
369                 goto redo;
370         }
371 }
372
373 static void xfrm_idx_hash_transfer(struct hlist_head *list,
374                                    struct hlist_head *nidxtable,
375                                    unsigned int nhashmask)
376 {
377         struct hlist_node *entry, *tmp;
378         struct xfrm_policy *pol;
379
380         hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) {
381                 unsigned int h;
382
383                 h = __idx_hash(pol->index, nhashmask);
384                 hlist_add_head(&pol->byidx, nidxtable+h);
385         }
386 }
387
388 static unsigned long xfrm_new_hash_mask(unsigned int old_hmask)
389 {
390         return ((old_hmask + 1) << 1) - 1;
391 }
392
393 static void xfrm_bydst_resize(struct net *net, int dir)
394 {
395         unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
396         unsigned int nhashmask = xfrm_new_hash_mask(hmask);
397         unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
398         struct hlist_head *odst = net->xfrm.policy_bydst[dir].table;
399         struct hlist_head *ndst = xfrm_hash_alloc(nsize);
400         int i;
401
402         if (!ndst)
403                 return;
404
405         write_lock_bh(&xfrm_policy_lock);
406
407         for (i = hmask; i >= 0; i--)
408                 xfrm_dst_hash_transfer(odst + i, ndst, nhashmask);
409
410         net->xfrm.policy_bydst[dir].table = ndst;
411         net->xfrm.policy_bydst[dir].hmask = nhashmask;
412
413         write_unlock_bh(&xfrm_policy_lock);
414
415         xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head));
416 }
417
418 static void xfrm_byidx_resize(struct net *net, int total)
419 {
420         unsigned int hmask = net->xfrm.policy_idx_hmask;
421         unsigned int nhashmask = xfrm_new_hash_mask(hmask);
422         unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
423         struct hlist_head *oidx = net->xfrm.policy_byidx;
424         struct hlist_head *nidx = xfrm_hash_alloc(nsize);
425         int i;
426
427         if (!nidx)
428                 return;
429
430         write_lock_bh(&xfrm_policy_lock);
431
432         for (i = hmask; i >= 0; i--)
433                 xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask);
434
435         net->xfrm.policy_byidx = nidx;
436         net->xfrm.policy_idx_hmask = nhashmask;
437
438         write_unlock_bh(&xfrm_policy_lock);
439
440         xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head));
441 }
442
443 static inline int xfrm_bydst_should_resize(struct net *net, int dir, int *total)
444 {
445         unsigned int cnt = net->xfrm.policy_count[dir];
446         unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
447
448         if (total)
449                 *total += cnt;
450
451         if ((hmask + 1) < xfrm_policy_hashmax &&
452             cnt > hmask)
453                 return 1;
454
455         return 0;
456 }
457
458 static inline int xfrm_byidx_should_resize(struct net *net, int total)
459 {
460         unsigned int hmask = net->xfrm.policy_idx_hmask;
461
462         if ((hmask + 1) < xfrm_policy_hashmax &&
463             total > hmask)
464                 return 1;
465
466         return 0;
467 }
468
469 void xfrm_spd_getinfo(struct xfrmk_spdinfo *si)
470 {
471         read_lock_bh(&xfrm_policy_lock);
472         si->incnt = init_net.xfrm.policy_count[XFRM_POLICY_IN];
473         si->outcnt = init_net.xfrm.policy_count[XFRM_POLICY_OUT];
474         si->fwdcnt = init_net.xfrm.policy_count[XFRM_POLICY_FWD];
475         si->inscnt = init_net.xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
476         si->outscnt = init_net.xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
477         si->fwdscnt = init_net.xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
478         si->spdhcnt = init_net.xfrm.policy_idx_hmask;
479         si->spdhmcnt = xfrm_policy_hashmax;
480         read_unlock_bh(&xfrm_policy_lock);
481 }
482 EXPORT_SYMBOL(xfrm_spd_getinfo);
483
484 static DEFINE_MUTEX(hash_resize_mutex);
485 static void xfrm_hash_resize(struct work_struct *work)
486 {
487         struct net *net = container_of(work, struct net, xfrm.policy_hash_work);
488         int dir, total;
489
490         mutex_lock(&hash_resize_mutex);
491
492         total = 0;
493         for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
494                 if (xfrm_bydst_should_resize(net, dir, &total))
495                         xfrm_bydst_resize(net, dir);
496         }
497         if (xfrm_byidx_should_resize(net, total))
498                 xfrm_byidx_resize(net, total);
499
500         mutex_unlock(&hash_resize_mutex);
501 }
502
503 /* Generate new index... KAME seems to generate them ordered by cost
504  * of an absolute inpredictability of ordering of rules. This will not pass. */
505 static u32 xfrm_gen_index(struct net *net, int dir)
506 {
507         static u32 idx_generator;
508
509         for (;;) {
510                 struct hlist_node *entry;
511                 struct hlist_head *list;
512                 struct xfrm_policy *p;
513                 u32 idx;
514                 int found;
515
516                 idx = (idx_generator | dir);
517                 idx_generator += 8;
518                 if (idx == 0)
519                         idx = 8;
520                 list = net->xfrm.policy_byidx + idx_hash(net, idx);
521                 found = 0;
522                 hlist_for_each_entry(p, entry, list, byidx) {
523                         if (p->index == idx) {
524                                 found = 1;
525                                 break;
526                         }
527                 }
528                 if (!found)
529                         return idx;
530         }
531 }
532
533 static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s2)
534 {
535         u32 *p1 = (u32 *) s1;
536         u32 *p2 = (u32 *) s2;
537         int len = sizeof(struct xfrm_selector) / sizeof(u32);
538         int i;
539
540         for (i = 0; i < len; i++) {
541                 if (p1[i] != p2[i])
542                         return 1;
543         }
544
545         return 0;
546 }
547
548 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
549 {
550         struct net *net = xp_net(policy);
551         struct xfrm_policy *pol;
552         struct xfrm_policy *delpol;
553         struct hlist_head *chain;
554         struct hlist_node *entry, *newpos;
555         struct dst_entry *gc_list;
556
557         write_lock_bh(&xfrm_policy_lock);
558         chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
559         delpol = NULL;
560         newpos = NULL;
561         hlist_for_each_entry(pol, entry, chain, bydst) {
562                 if (pol->type == policy->type &&
563                     !selector_cmp(&pol->selector, &policy->selector) &&
564                     xfrm_sec_ctx_match(pol->security, policy->security) &&
565                     !WARN_ON(delpol)) {
566                         if (excl) {
567                                 write_unlock_bh(&xfrm_policy_lock);
568                                 return -EEXIST;
569                         }
570                         delpol = pol;
571                         if (policy->priority > pol->priority)
572                                 continue;
573                 } else if (policy->priority >= pol->priority) {
574                         newpos = &pol->bydst;
575                         continue;
576                 }
577                 if (delpol)
578                         break;
579         }
580         if (newpos)
581                 hlist_add_after(newpos, &policy->bydst);
582         else
583                 hlist_add_head(&policy->bydst, chain);
584         xfrm_pol_hold(policy);
585         net->xfrm.policy_count[dir]++;
586         atomic_inc(&flow_cache_genid);
587         if (delpol) {
588                 hlist_del(&delpol->bydst);
589                 hlist_del(&delpol->byidx);
590                 list_del(&delpol->walk.all);
591                 net->xfrm.policy_count[dir]--;
592         }
593         policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
594         hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index));
595         policy->curlft.add_time = get_seconds();
596         policy->curlft.use_time = 0;
597         if (!mod_timer(&policy->timer, jiffies + HZ))
598                 xfrm_pol_hold(policy);
599         list_add(&policy->walk.all, &net->xfrm.policy_all);
600         write_unlock_bh(&xfrm_policy_lock);
601
602         if (delpol)
603                 xfrm_policy_kill(delpol);
604         else if (xfrm_bydst_should_resize(net, dir, NULL))
605                 schedule_work(&net->xfrm.policy_hash_work);
606
607         read_lock_bh(&xfrm_policy_lock);
608         gc_list = NULL;
609         entry = &policy->bydst;
610         hlist_for_each_entry_continue(policy, entry, bydst) {
611                 struct dst_entry *dst;
612
613                 write_lock(&policy->lock);
614                 dst = policy->bundles;
615                 if (dst) {
616                         struct dst_entry *tail = dst;
617                         while (tail->next)
618                                 tail = tail->next;
619                         tail->next = gc_list;
620                         gc_list = dst;
621
622                         policy->bundles = NULL;
623                 }
624                 write_unlock(&policy->lock);
625         }
626         read_unlock_bh(&xfrm_policy_lock);
627
628         while (gc_list) {
629                 struct dst_entry *dst = gc_list;
630
631                 gc_list = dst->next;
632                 dst_free(dst);
633         }
634
635         return 0;
636 }
637 EXPORT_SYMBOL(xfrm_policy_insert);
638
639 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
640                                           struct xfrm_selector *sel,
641                                           struct xfrm_sec_ctx *ctx, int delete,
642                                           int *err)
643 {
644         struct xfrm_policy *pol, *ret;
645         struct hlist_head *chain;
646         struct hlist_node *entry;
647
648         *err = 0;
649         write_lock_bh(&xfrm_policy_lock);
650         chain = policy_hash_bysel(net, sel, sel->family, dir);
651         ret = NULL;
652         hlist_for_each_entry(pol, entry, chain, bydst) {
653                 if (pol->type == type &&
654                     !selector_cmp(sel, &pol->selector) &&
655                     xfrm_sec_ctx_match(ctx, pol->security)) {
656                         xfrm_pol_hold(pol);
657                         if (delete) {
658                                 *err = security_xfrm_policy_delete(
659                                                                 pol->security);
660                                 if (*err) {
661                                         write_unlock_bh(&xfrm_policy_lock);
662                                         return pol;
663                                 }
664                                 hlist_del(&pol->bydst);
665                                 hlist_del(&pol->byidx);
666                                 list_del(&pol->walk.all);
667                                 net->xfrm.policy_count[dir]--;
668                         }
669                         ret = pol;
670                         break;
671                 }
672         }
673         write_unlock_bh(&xfrm_policy_lock);
674
675         if (ret && delete) {
676                 atomic_inc(&flow_cache_genid);
677                 xfrm_policy_kill(ret);
678         }
679         return ret;
680 }
681 EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
682
683 struct xfrm_policy *xfrm_policy_byid(struct net *net, u8 type, int dir, u32 id,
684                                      int delete, int *err)
685 {
686         struct xfrm_policy *pol, *ret;
687         struct hlist_head *chain;
688         struct hlist_node *entry;
689
690         *err = -ENOENT;
691         if (xfrm_policy_id2dir(id) != dir)
692                 return NULL;
693
694         *err = 0;
695         write_lock_bh(&xfrm_policy_lock);
696         chain = net->xfrm.policy_byidx + idx_hash(net, id);
697         ret = NULL;
698         hlist_for_each_entry(pol, entry, chain, byidx) {
699                 if (pol->type == type && pol->index == id) {
700                         xfrm_pol_hold(pol);
701                         if (delete) {
702                                 *err = security_xfrm_policy_delete(
703                                                                 pol->security);
704                                 if (*err) {
705                                         write_unlock_bh(&xfrm_policy_lock);
706                                         return pol;
707                                 }
708                                 hlist_del(&pol->bydst);
709                                 hlist_del(&pol->byidx);
710                                 list_del(&pol->walk.all);
711                                 net->xfrm.policy_count[dir]--;
712                         }
713                         ret = pol;
714                         break;
715                 }
716         }
717         write_unlock_bh(&xfrm_policy_lock);
718
719         if (ret && delete) {
720                 atomic_inc(&flow_cache_genid);
721                 xfrm_policy_kill(ret);
722         }
723         return ret;
724 }
725 EXPORT_SYMBOL(xfrm_policy_byid);
726
727 #ifdef CONFIG_SECURITY_NETWORK_XFRM
728 static inline int
729 xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info)
730 {
731         int dir, err = 0;
732
733         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
734                 struct xfrm_policy *pol;
735                 struct hlist_node *entry;
736                 int i;
737
738                 hlist_for_each_entry(pol, entry,
739                                      &net->xfrm.policy_inexact[dir], bydst) {
740                         if (pol->type != type)
741                                 continue;
742                         err = security_xfrm_policy_delete(pol->security);
743                         if (err) {
744                                 xfrm_audit_policy_delete(pol, 0,
745                                                          audit_info->loginuid,
746                                                          audit_info->sessionid,
747                                                          audit_info->secid);
748                                 return err;
749                         }
750                 }
751                 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
752                         hlist_for_each_entry(pol, entry,
753                                              net->xfrm.policy_bydst[dir].table + i,
754                                              bydst) {
755                                 if (pol->type != type)
756                                         continue;
757                                 err = security_xfrm_policy_delete(
758                                                                 pol->security);
759                                 if (err) {
760                                         xfrm_audit_policy_delete(pol, 0,
761                                                         audit_info->loginuid,
762                                                         audit_info->sessionid,
763                                                         audit_info->secid);
764                                         return err;
765                                 }
766                         }
767                 }
768         }
769         return err;
770 }
771 #else
772 static inline int
773 xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info)
774 {
775         return 0;
776 }
777 #endif
778
779 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
780 {
781         int dir, err = 0;
782
783         write_lock_bh(&xfrm_policy_lock);
784
785         err = xfrm_policy_flush_secctx_check(net, type, audit_info);
786         if (err)
787                 goto out;
788
789         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
790                 struct xfrm_policy *pol;
791                 struct hlist_node *entry;
792                 int i, killed;
793
794                 killed = 0;
795         again1:
796                 hlist_for_each_entry(pol, entry,
797                                      &net->xfrm.policy_inexact[dir], bydst) {
798                         if (pol->type != type)
799                                 continue;
800                         hlist_del(&pol->bydst);
801                         hlist_del(&pol->byidx);
802                         write_unlock_bh(&xfrm_policy_lock);
803
804                         xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,
805                                                  audit_info->sessionid,
806                                                  audit_info->secid);
807
808                         xfrm_policy_kill(pol);
809                         killed++;
810
811                         write_lock_bh(&xfrm_policy_lock);
812                         goto again1;
813                 }
814
815                 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
816         again2:
817                         hlist_for_each_entry(pol, entry,
818                                              net->xfrm.policy_bydst[dir].table + i,
819                                              bydst) {
820                                 if (pol->type != type)
821                                         continue;
822                                 hlist_del(&pol->bydst);
823                                 hlist_del(&pol->byidx);
824                                 list_del(&pol->walk.all);
825                                 write_unlock_bh(&xfrm_policy_lock);
826
827                                 xfrm_audit_policy_delete(pol, 1,
828                                                          audit_info->loginuid,
829                                                          audit_info->sessionid,
830                                                          audit_info->secid);
831                                 xfrm_policy_kill(pol);
832                                 killed++;
833
834                                 write_lock_bh(&xfrm_policy_lock);
835                                 goto again2;
836                         }
837                 }
838
839                 net->xfrm.policy_count[dir] -= killed;
840         }
841         atomic_inc(&flow_cache_genid);
842 out:
843         write_unlock_bh(&xfrm_policy_lock);
844         return err;
845 }
846 EXPORT_SYMBOL(xfrm_policy_flush);
847
848 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
849                      int (*func)(struct xfrm_policy *, int, int, void*),
850                      void *data)
851 {
852         struct xfrm_policy *pol;
853         struct xfrm_policy_walk_entry *x;
854         int error = 0;
855
856         if (walk->type >= XFRM_POLICY_TYPE_MAX &&
857             walk->type != XFRM_POLICY_TYPE_ANY)
858                 return -EINVAL;
859
860         if (list_empty(&walk->walk.all) && walk->seq != 0)
861                 return 0;
862
863         write_lock_bh(&xfrm_policy_lock);
864         if (list_empty(&walk->walk.all))
865                 x = list_first_entry(&net->xfrm.policy_all, struct xfrm_policy_walk_entry, all);
866         else
867                 x = list_entry(&walk->walk.all, struct xfrm_policy_walk_entry, all);
868         list_for_each_entry_from(x, &net->xfrm.policy_all, all) {
869                 if (x->dead)
870                         continue;
871                 pol = container_of(x, struct xfrm_policy, walk);
872                 if (walk->type != XFRM_POLICY_TYPE_ANY &&
873                     walk->type != pol->type)
874                         continue;
875                 error = func(pol, xfrm_policy_id2dir(pol->index),
876                              walk->seq, data);
877                 if (error) {
878                         list_move_tail(&walk->walk.all, &x->all);
879                         goto out;
880                 }
881                 walk->seq++;
882         }
883         if (walk->seq == 0) {
884                 error = -ENOENT;
885                 goto out;
886         }
887         list_del_init(&walk->walk.all);
888 out:
889         write_unlock_bh(&xfrm_policy_lock);
890         return error;
891 }
892 EXPORT_SYMBOL(xfrm_policy_walk);
893
894 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type)
895 {
896         INIT_LIST_HEAD(&walk->walk.all);
897         walk->walk.dead = 1;
898         walk->type = type;
899         walk->seq = 0;
900 }
901 EXPORT_SYMBOL(xfrm_policy_walk_init);
902
903 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk)
904 {
905         if (list_empty(&walk->walk.all))
906                 return;
907
908         write_lock_bh(&xfrm_policy_lock);
909         list_del(&walk->walk.all);
910         write_unlock_bh(&xfrm_policy_lock);
911 }
912 EXPORT_SYMBOL(xfrm_policy_walk_done);
913
914 /*
915  * Find policy to apply to this flow.
916  *
917  * Returns 0 if policy found, else an -errno.
918  */
919 static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,
920                              u8 type, u16 family, int dir)
921 {
922         struct xfrm_selector *sel = &pol->selector;
923         int match, ret = -ESRCH;
924
925         if (pol->family != family ||
926             pol->type != type)
927                 return ret;
928
929         match = xfrm_selector_match(sel, fl, family);
930         if (match)
931                 ret = security_xfrm_policy_lookup(pol->security, fl->secid,
932                                                   dir);
933
934         return ret;
935 }
936
937 static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
938                                                      struct flowi *fl,
939                                                      u16 family, u8 dir)
940 {
941         int err;
942         struct xfrm_policy *pol, *ret;
943         xfrm_address_t *daddr, *saddr;
944         struct hlist_node *entry;
945         struct hlist_head *chain;
946         u32 priority = ~0U;
947
948         daddr = xfrm_flowi_daddr(fl, family);
949         saddr = xfrm_flowi_saddr(fl, family);
950         if (unlikely(!daddr || !saddr))
951                 return NULL;
952
953         read_lock_bh(&xfrm_policy_lock);
954         chain = policy_hash_direct(net, daddr, saddr, family, dir);
955         ret = NULL;
956         hlist_for_each_entry(pol, entry, chain, bydst) {
957                 err = xfrm_policy_match(pol, fl, type, family, dir);
958                 if (err) {
959                         if (err == -ESRCH)
960                                 continue;
961                         else {
962                                 ret = ERR_PTR(err);
963                                 goto fail;
964                         }
965                 } else {
966                         ret = pol;
967                         priority = ret->priority;
968                         break;
969                 }
970         }
971         chain = &net->xfrm.policy_inexact[dir];
972         hlist_for_each_entry(pol, entry, chain, bydst) {
973                 err = xfrm_policy_match(pol, fl, type, family, dir);
974                 if (err) {
975                         if (err == -ESRCH)
976                                 continue;
977                         else {
978                                 ret = ERR_PTR(err);
979                                 goto fail;
980                         }
981                 } else if (pol->priority < priority) {
982                         ret = pol;
983                         break;
984                 }
985         }
986         if (ret)
987                 xfrm_pol_hold(ret);
988 fail:
989         read_unlock_bh(&xfrm_policy_lock);
990
991         return ret;
992 }
993
994 static int xfrm_policy_lookup(struct net *net, struct flowi *fl, u16 family,
995                               u8 dir, void **objp, atomic_t **obj_refp)
996 {
997         struct xfrm_policy *pol;
998         int err = 0;
999
1000 #ifdef CONFIG_XFRM_SUB_POLICY
1001         pol = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_SUB, fl, family, dir);
1002         if (IS_ERR(pol)) {
1003                 err = PTR_ERR(pol);
1004                 pol = NULL;
1005         }
1006         if (pol || err)
1007                 goto end;
1008 #endif
1009         pol = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family, dir);
1010         if (IS_ERR(pol)) {
1011                 err = PTR_ERR(pol);
1012                 pol = NULL;
1013         }
1014 #ifdef CONFIG_XFRM_SUB_POLICY
1015 end:
1016 #endif
1017         if ((*objp = (void *) pol) != NULL)
1018                 *obj_refp = &pol->refcnt;
1019         return err;
1020 }
1021
1022 static inline int policy_to_flow_dir(int dir)
1023 {
1024         if (XFRM_POLICY_IN == FLOW_DIR_IN &&
1025             XFRM_POLICY_OUT == FLOW_DIR_OUT &&
1026             XFRM_POLICY_FWD == FLOW_DIR_FWD)
1027                 return dir;
1028         switch (dir) {
1029         default:
1030         case XFRM_POLICY_IN:
1031                 return FLOW_DIR_IN;
1032         case XFRM_POLICY_OUT:
1033                 return FLOW_DIR_OUT;
1034         case XFRM_POLICY_FWD:
1035                 return FLOW_DIR_FWD;
1036         }
1037 }
1038
1039 static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl)
1040 {
1041         struct xfrm_policy *pol;
1042
1043         read_lock_bh(&xfrm_policy_lock);
1044         if ((pol = sk->sk_policy[dir]) != NULL) {
1045                 int match = xfrm_selector_match(&pol->selector, fl,
1046                                                 sk->sk_family);
1047                 int err = 0;
1048
1049                 if (match) {
1050                         err = security_xfrm_policy_lookup(pol->security,
1051                                                       fl->secid,
1052                                                       policy_to_flow_dir(dir));
1053                         if (!err)
1054                                 xfrm_pol_hold(pol);
1055                         else if (err == -ESRCH)
1056                                 pol = NULL;
1057                         else
1058                                 pol = ERR_PTR(err);
1059                 } else
1060                         pol = NULL;
1061         }
1062         read_unlock_bh(&xfrm_policy_lock);
1063         return pol;
1064 }
1065
1066 static void __xfrm_policy_link(struct xfrm_policy *pol, int dir)
1067 {
1068         struct net *net = xp_net(pol);
1069         struct hlist_head *chain = policy_hash_bysel(net, &pol->selector,
1070                                                      pol->family, dir);
1071
1072         list_add(&pol->walk.all, &net->xfrm.policy_all);
1073         hlist_add_head(&pol->bydst, chain);
1074         hlist_add_head(&pol->byidx, net->xfrm.policy_byidx+idx_hash(net, pol->index));
1075         net->xfrm.policy_count[dir]++;
1076         xfrm_pol_hold(pol);
1077
1078         if (xfrm_bydst_should_resize(net, dir, NULL))
1079                 schedule_work(&net->xfrm.policy_hash_work);
1080 }
1081
1082 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
1083                                                 int dir)
1084 {
1085         struct net *net = xp_net(pol);
1086
1087         if (hlist_unhashed(&pol->bydst))
1088                 return NULL;
1089
1090         hlist_del(&pol->bydst);
1091         hlist_del(&pol->byidx);
1092         list_del(&pol->walk.all);
1093         net->xfrm.policy_count[dir]--;
1094
1095         return pol;
1096 }
1097
1098 int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
1099 {
1100         write_lock_bh(&xfrm_policy_lock);
1101         pol = __xfrm_policy_unlink(pol, dir);
1102         write_unlock_bh(&xfrm_policy_lock);
1103         if (pol) {
1104                 if (dir < XFRM_POLICY_MAX)
1105                         atomic_inc(&flow_cache_genid);
1106                 xfrm_policy_kill(pol);
1107                 return 0;
1108         }
1109         return -ENOENT;
1110 }
1111 EXPORT_SYMBOL(xfrm_policy_delete);
1112
1113 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
1114 {
1115         struct net *net = xp_net(pol);
1116         struct xfrm_policy *old_pol;
1117
1118 #ifdef CONFIG_XFRM_SUB_POLICY
1119         if (pol && pol->type != XFRM_POLICY_TYPE_MAIN)
1120                 return -EINVAL;
1121 #endif
1122
1123         write_lock_bh(&xfrm_policy_lock);
1124         old_pol = sk->sk_policy[dir];
1125         sk->sk_policy[dir] = pol;
1126         if (pol) {
1127                 pol->curlft.add_time = get_seconds();
1128                 pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir);
1129                 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
1130         }
1131         if (old_pol)
1132                 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
1133         write_unlock_bh(&xfrm_policy_lock);
1134
1135         if (old_pol) {
1136                 xfrm_policy_kill(old_pol);
1137         }
1138         return 0;
1139 }
1140
1141 static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
1142 {
1143         struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC);
1144
1145         if (newp) {
1146                 newp->selector = old->selector;
1147                 if (security_xfrm_policy_clone(old->security,
1148                                                &newp->security)) {
1149                         kfree(newp);
1150                         return NULL;  /* ENOMEM */
1151                 }
1152                 newp->lft = old->lft;
1153                 newp->curlft = old->curlft;
1154                 newp->action = old->action;
1155                 newp->flags = old->flags;
1156                 newp->xfrm_nr = old->xfrm_nr;
1157                 newp->index = old->index;
1158                 newp->type = old->type;
1159                 memcpy(newp->xfrm_vec, old->xfrm_vec,
1160                        newp->xfrm_nr*sizeof(struct xfrm_tmpl));
1161                 write_lock_bh(&xfrm_policy_lock);
1162                 __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir);
1163                 write_unlock_bh(&xfrm_policy_lock);
1164                 xfrm_pol_put(newp);
1165         }
1166         return newp;
1167 }
1168
1169 int __xfrm_sk_clone_policy(struct sock *sk)
1170 {
1171         struct xfrm_policy *p0 = sk->sk_policy[0],
1172                            *p1 = sk->sk_policy[1];
1173
1174         sk->sk_policy[0] = sk->sk_policy[1] = NULL;
1175         if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL)
1176                 return -ENOMEM;
1177         if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL)
1178                 return -ENOMEM;
1179         return 0;
1180 }
1181
1182 static int
1183 xfrm_get_saddr(struct net *net, xfrm_address_t *local, xfrm_address_t *remote,
1184                unsigned short family)
1185 {
1186         int err;
1187         struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1188
1189         if (unlikely(afinfo == NULL))
1190                 return -EINVAL;
1191         err = afinfo->get_saddr(net, local, remote);
1192         xfrm_policy_put_afinfo(afinfo);
1193         return err;
1194 }
1195
1196 /* Resolve list of templates for the flow, given policy. */
1197
1198 static int
1199 xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
1200                       struct xfrm_state **xfrm,
1201                       unsigned short family)
1202 {
1203         struct net *net = xp_net(policy);
1204         int nx;
1205         int i, error;
1206         xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
1207         xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
1208         xfrm_address_t tmp;
1209
1210         for (nx=0, i = 0; i < policy->xfrm_nr; i++) {
1211                 struct xfrm_state *x;
1212                 xfrm_address_t *remote = daddr;
1213                 xfrm_address_t *local  = saddr;
1214                 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
1215
1216                 if (tmpl->mode == XFRM_MODE_TUNNEL ||
1217                     tmpl->mode == XFRM_MODE_BEET) {
1218                         remote = &tmpl->id.daddr;
1219                         local = &tmpl->saddr;
1220                         family = tmpl->encap_family;
1221                         if (xfrm_addr_any(local, family)) {
1222                                 error = xfrm_get_saddr(net, &tmp, remote, family);
1223                                 if (error)
1224                                         goto fail;
1225                                 local = &tmp;
1226                         }
1227                 }
1228
1229                 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
1230
1231                 if (x && x->km.state == XFRM_STATE_VALID) {
1232                         xfrm[nx++] = x;
1233                         daddr = remote;
1234                         saddr = local;
1235                         continue;
1236                 }
1237                 if (x) {
1238                         error = (x->km.state == XFRM_STATE_ERROR ?
1239                                  -EINVAL : -EAGAIN);
1240                         xfrm_state_put(x);
1241                 }
1242                 else if (error == -ESRCH)
1243                         error = -EAGAIN;
1244
1245                 if (!tmpl->optional)
1246                         goto fail;
1247         }
1248         return nx;
1249
1250 fail:
1251         for (nx--; nx>=0; nx--)
1252                 xfrm_state_put(xfrm[nx]);
1253         return error;
1254 }
1255
1256 static int
1257 xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, struct flowi *fl,
1258                   struct xfrm_state **xfrm,
1259                   unsigned short family)
1260 {
1261         struct xfrm_state *tp[XFRM_MAX_DEPTH];
1262         struct xfrm_state **tpp = (npols > 1) ? tp : xfrm;
1263         int cnx = 0;
1264         int error;
1265         int ret;
1266         int i;
1267
1268         for (i = 0; i < npols; i++) {
1269                 if (cnx + pols[i]->xfrm_nr >= XFRM_MAX_DEPTH) {
1270                         error = -ENOBUFS;
1271                         goto fail;
1272                 }
1273
1274                 ret = xfrm_tmpl_resolve_one(pols[i], fl, &tpp[cnx], family);
1275                 if (ret < 0) {
1276                         error = ret;
1277                         goto fail;
1278                 } else
1279                         cnx += ret;
1280         }
1281
1282         /* found states are sorted for outbound processing */
1283         if (npols > 1)
1284                 xfrm_state_sort(xfrm, tpp, cnx, family);
1285
1286         return cnx;
1287
1288  fail:
1289         for (cnx--; cnx>=0; cnx--)
1290                 xfrm_state_put(tpp[cnx]);
1291         return error;
1292
1293 }
1294
1295 /* Check that the bundle accepts the flow and its components are
1296  * still valid.
1297  */
1298
1299 static struct dst_entry *
1300 xfrm_find_bundle(struct flowi *fl, struct xfrm_policy *policy, unsigned short family)
1301 {
1302         struct dst_entry *x;
1303         struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1304         if (unlikely(afinfo == NULL))
1305                 return ERR_PTR(-EINVAL);
1306         x = afinfo->find_bundle(fl, policy);
1307         xfrm_policy_put_afinfo(afinfo);
1308         return x;
1309 }
1310
1311 static inline int xfrm_get_tos(struct flowi *fl, int family)
1312 {
1313         struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1314         int tos;
1315
1316         if (!afinfo)
1317                 return -EINVAL;
1318
1319         tos = afinfo->get_tos(fl);
1320
1321         xfrm_policy_put_afinfo(afinfo);
1322
1323         return tos;
1324 }
1325
1326 static inline struct xfrm_dst *xfrm_alloc_dst(int family)
1327 {
1328         struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1329         struct xfrm_dst *xdst;
1330
1331         if (!afinfo)
1332                 return ERR_PTR(-EINVAL);
1333
1334         xdst = dst_alloc(afinfo->dst_ops) ?: ERR_PTR(-ENOBUFS);
1335
1336         xfrm_policy_put_afinfo(afinfo);
1337
1338         return xdst;
1339 }
1340
1341 static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst,
1342                                  int nfheader_len)
1343 {
1344         struct xfrm_policy_afinfo *afinfo =
1345                 xfrm_policy_get_afinfo(dst->ops->family);
1346         int err;
1347
1348         if (!afinfo)
1349                 return -EINVAL;
1350
1351         err = afinfo->init_path(path, dst, nfheader_len);
1352
1353         xfrm_policy_put_afinfo(afinfo);
1354
1355         return err;
1356 }
1357
1358 static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
1359 {
1360         struct xfrm_policy_afinfo *afinfo =
1361                 xfrm_policy_get_afinfo(xdst->u.dst.ops->family);
1362         int err;
1363
1364         if (!afinfo)
1365                 return -EINVAL;
1366
1367         err = afinfo->fill_dst(xdst, dev);
1368
1369         xfrm_policy_put_afinfo(afinfo);
1370
1371         return err;
1372 }
1373
1374 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
1375  * all the metrics... Shortly, bundle a bundle.
1376  */
1377
1378 static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
1379                                             struct xfrm_state **xfrm, int nx,
1380                                             struct flowi *fl,
1381                                             struct dst_entry *dst)
1382 {
1383         unsigned long now = jiffies;
1384         struct net_device *dev;
1385         struct dst_entry *dst_prev = NULL;
1386         struct dst_entry *dst0 = NULL;
1387         int i = 0;
1388         int err;
1389         int header_len = 0;
1390         int nfheader_len = 0;
1391         int trailer_len = 0;
1392         int tos;
1393         int family = policy->selector.family;
1394         xfrm_address_t saddr, daddr;
1395
1396         xfrm_flowi_addr_get(fl, &saddr, &daddr, family);
1397
1398         tos = xfrm_get_tos(fl, family);
1399         err = tos;
1400         if (tos < 0)
1401                 goto put_states;
1402
1403         dst_hold(dst);
1404
1405         for (; i < nx; i++) {
1406                 struct xfrm_dst *xdst = xfrm_alloc_dst(family);
1407                 struct dst_entry *dst1 = &xdst->u.dst;
1408
1409                 err = PTR_ERR(xdst);
1410                 if (IS_ERR(xdst)) {
1411                         dst_release(dst);
1412                         goto put_states;
1413                 }
1414
1415                 if (!dst_prev)
1416                         dst0 = dst1;
1417                 else {
1418                         dst_prev->child = dst_clone(dst1);
1419                         dst1->flags |= DST_NOHASH;
1420                 }
1421
1422                 xdst->route = dst;
1423                 memcpy(&dst1->metrics, &dst->metrics, sizeof(dst->metrics));
1424
1425                 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
1426                         family = xfrm[i]->props.family;
1427                         dst = xfrm_dst_lookup(xfrm[i], tos, &saddr, &daddr,
1428                                               family);
1429                         err = PTR_ERR(dst);
1430                         if (IS_ERR(dst))
1431                                 goto put_states;
1432                 } else
1433                         dst_hold(dst);
1434
1435                 dst1->xfrm = xfrm[i];
1436                 xdst->genid = xfrm[i]->genid;
1437
1438                 dst1->obsolete = -1;
1439                 dst1->flags |= DST_HOST;
1440                 dst1->lastuse = now;
1441
1442                 dst1->input = dst_discard;
1443                 dst1->output = xfrm[i]->outer_mode->afinfo->output;
1444
1445                 dst1->next = dst_prev;
1446                 dst_prev = dst1;
1447
1448                 header_len += xfrm[i]->props.header_len;
1449                 if (xfrm[i]->type->flags & XFRM_TYPE_NON_FRAGMENT)
1450                         nfheader_len += xfrm[i]->props.header_len;
1451                 trailer_len += xfrm[i]->props.trailer_len;
1452         }
1453
1454         dst_prev->child = dst;
1455         dst0->path = dst;
1456
1457         err = -ENODEV;
1458         dev = dst->dev;
1459         if (!dev)
1460                 goto free_dst;
1461
1462         /* Copy neighbout for reachability confirmation */
1463         dst0->neighbour = neigh_clone(dst->neighbour);
1464
1465         xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len);
1466         xfrm_init_pmtu(dst_prev);
1467
1468         for (dst_prev = dst0; dst_prev != dst; dst_prev = dst_prev->child) {
1469                 struct xfrm_dst *xdst = (struct xfrm_dst *)dst_prev;
1470
1471                 err = xfrm_fill_dst(xdst, dev);
1472                 if (err)
1473                         goto free_dst;
1474
1475                 dst_prev->header_len = header_len;
1476                 dst_prev->trailer_len = trailer_len;
1477                 header_len -= xdst->u.dst.xfrm->props.header_len;
1478                 trailer_len -= xdst->u.dst.xfrm->props.trailer_len;
1479         }
1480
1481 out:
1482         return dst0;
1483
1484 put_states:
1485         for (; i < nx; i++)
1486                 xfrm_state_put(xfrm[i]);
1487 free_dst:
1488         if (dst0)
1489                 dst_free(dst0);
1490         dst0 = ERR_PTR(err);
1491         goto out;
1492 }
1493
1494 static int inline
1495 xfrm_dst_alloc_copy(void **target, void *src, int size)
1496 {
1497         if (!*target) {
1498                 *target = kmalloc(size, GFP_ATOMIC);
1499                 if (!*target)
1500                         return -ENOMEM;
1501         }
1502         memcpy(*target, src, size);
1503         return 0;
1504 }
1505
1506 static int inline
1507 xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
1508 {
1509 #ifdef CONFIG_XFRM_SUB_POLICY
1510         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1511         return xfrm_dst_alloc_copy((void **)&(xdst->partner),
1512                                    sel, sizeof(*sel));
1513 #else
1514         return 0;
1515 #endif
1516 }
1517
1518 static int inline
1519 xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
1520 {
1521 #ifdef CONFIG_XFRM_SUB_POLICY
1522         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1523         return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
1524 #else
1525         return 0;
1526 #endif
1527 }
1528
1529 static int stale_bundle(struct dst_entry *dst);
1530
1531 /* Main function: finds/creates a bundle for given flow.
1532  *
1533  * At the moment we eat a raw IP route. Mostly to speed up lookups
1534  * on interfaces with disabled IPsec.
1535  */
1536 int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
1537                   struct sock *sk, int flags)
1538 {
1539         struct xfrm_policy *policy;
1540         struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1541         int npols;
1542         int pol_dead;
1543         int xfrm_nr;
1544         int pi;
1545         struct xfrm_state *xfrm[XFRM_MAX_DEPTH];
1546         struct dst_entry *dst, *dst_orig = *dst_p;
1547         int nx = 0;
1548         int err;
1549         u32 genid;
1550         u16 family;
1551         u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
1552
1553 restart:
1554         genid = atomic_read(&flow_cache_genid);
1555         policy = NULL;
1556         for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
1557                 pols[pi] = NULL;
1558         npols = 0;
1559         pol_dead = 0;
1560         xfrm_nr = 0;
1561
1562         if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
1563                 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
1564                 err = PTR_ERR(policy);
1565                 if (IS_ERR(policy)) {
1566                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
1567                         goto dropdst;
1568                 }
1569         }
1570
1571         if (!policy) {
1572                 /* To accelerate a bit...  */
1573                 if ((dst_orig->flags & DST_NOXFRM) ||
1574                     !net->xfrm.policy_count[XFRM_POLICY_OUT])
1575                         goto nopol;
1576
1577                 policy = flow_cache_lookup(net, fl, dst_orig->ops->family,
1578                                            dir, xfrm_policy_lookup);
1579                 err = PTR_ERR(policy);
1580                 if (IS_ERR(policy)) {
1581                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
1582                         goto dropdst;
1583                 }
1584         }
1585
1586         if (!policy)
1587                 goto nopol;
1588
1589         family = dst_orig->ops->family;
1590         pols[0] = policy;
1591         npols ++;
1592         xfrm_nr += pols[0]->xfrm_nr;
1593
1594         err = -ENOENT;
1595         if ((flags & XFRM_LOOKUP_ICMP) && !(policy->flags & XFRM_POLICY_ICMP))
1596                 goto error;
1597
1598         policy->curlft.use_time = get_seconds();
1599
1600         switch (policy->action) {
1601         default:
1602         case XFRM_POLICY_BLOCK:
1603                 /* Prohibit the flow */
1604                 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLBLOCK);
1605                 err = -EPERM;
1606                 goto error;
1607
1608         case XFRM_POLICY_ALLOW:
1609 #ifndef CONFIG_XFRM_SUB_POLICY
1610                 if (policy->xfrm_nr == 0) {
1611                         /* Flow passes not transformed. */
1612                         xfrm_pol_put(policy);
1613                         return 0;
1614                 }
1615 #endif
1616
1617                 /* Try to find matching bundle.
1618                  *
1619                  * LATER: help from flow cache. It is optional, this
1620                  * is required only for output policy.
1621                  */
1622                 dst = xfrm_find_bundle(fl, policy, family);
1623                 if (IS_ERR(dst)) {
1624                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
1625                         err = PTR_ERR(dst);
1626                         goto error;
1627                 }
1628
1629                 if (dst)
1630                         break;
1631
1632 #ifdef CONFIG_XFRM_SUB_POLICY
1633                 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
1634                         pols[1] = xfrm_policy_lookup_bytype(net,
1635                                                             XFRM_POLICY_TYPE_MAIN,
1636                                                             fl, family,
1637                                                             XFRM_POLICY_OUT);
1638                         if (pols[1]) {
1639                                 if (IS_ERR(pols[1])) {
1640                                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
1641                                         err = PTR_ERR(pols[1]);
1642                                         goto error;
1643                                 }
1644                                 if (pols[1]->action == XFRM_POLICY_BLOCK) {
1645                                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLBLOCK);
1646                                         err = -EPERM;
1647                                         goto error;
1648                                 }
1649                                 npols ++;
1650                                 xfrm_nr += pols[1]->xfrm_nr;
1651                         }
1652                 }
1653
1654                 /*
1655                  * Because neither flowi nor bundle information knows about
1656                  * transformation template size. On more than one policy usage
1657                  * we can realize whether all of them is bypass or not after
1658                  * they are searched. See above not-transformed bypass
1659                  * is surrounded by non-sub policy configuration, too.
1660                  */
1661                 if (xfrm_nr == 0) {
1662                         /* Flow passes not transformed. */
1663                         xfrm_pols_put(pols, npols);
1664                         return 0;
1665                 }
1666
1667 #endif
1668                 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family);
1669
1670                 if (unlikely(nx<0)) {
1671                         err = nx;
1672                         if (err == -EAGAIN && net->xfrm.sysctl_larval_drop) {
1673                                 /* EREMOTE tells the caller to generate
1674                                  * a one-shot blackhole route.
1675                                  */
1676                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
1677                                 xfrm_pol_put(policy);
1678                                 return -EREMOTE;
1679                         }
1680                         if (err == -EAGAIN && (flags & XFRM_LOOKUP_WAIT)) {
1681                                 DECLARE_WAITQUEUE(wait, current);
1682
1683                                 add_wait_queue(&net->xfrm.km_waitq, &wait);
1684                                 set_current_state(TASK_INTERRUPTIBLE);
1685                                 schedule();
1686                                 set_current_state(TASK_RUNNING);
1687                                 remove_wait_queue(&net->xfrm.km_waitq, &wait);
1688
1689                                 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family);
1690
1691                                 if (nx == -EAGAIN && signal_pending(current)) {
1692                                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
1693                                         err = -ERESTART;
1694                                         goto error;
1695                                 }
1696                                 if (nx == -EAGAIN ||
1697                                     genid != atomic_read(&flow_cache_genid)) {
1698                                         xfrm_pols_put(pols, npols);
1699                                         goto restart;
1700                                 }
1701                                 err = nx;
1702                         }
1703                         if (err < 0) {
1704                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
1705                                 goto error;
1706                         }
1707                 }
1708                 if (nx == 0) {
1709                         /* Flow passes not transformed. */
1710                         xfrm_pols_put(pols, npols);
1711                         return 0;
1712                 }
1713
1714                 dst = xfrm_bundle_create(policy, xfrm, nx, fl, dst_orig);
1715                 err = PTR_ERR(dst);
1716                 if (IS_ERR(dst)) {
1717                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLEGENERROR);
1718                         goto error;
1719                 }
1720
1721                 for (pi = 0; pi < npols; pi++) {
1722                         read_lock_bh(&pols[pi]->lock);
1723                         pol_dead |= pols[pi]->walk.dead;
1724                         read_unlock_bh(&pols[pi]->lock);
1725                 }
1726
1727                 write_lock_bh(&policy->lock);
1728                 if (unlikely(pol_dead || stale_bundle(dst))) {
1729                         /* Wow! While we worked on resolving, this
1730                          * policy has gone. Retry. It is not paranoia,
1731                          * we just cannot enlist new bundle to dead object.
1732                          * We can't enlist stable bundles either.
1733                          */
1734                         write_unlock_bh(&policy->lock);
1735                         dst_free(dst);
1736
1737                         if (pol_dead)
1738                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLDEAD);
1739                         else
1740                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
1741                         err = -EHOSTUNREACH;
1742                         goto error;
1743                 }
1744
1745                 if (npols > 1)
1746                         err = xfrm_dst_update_parent(dst, &pols[1]->selector);
1747                 else
1748                         err = xfrm_dst_update_origin(dst, fl);
1749                 if (unlikely(err)) {
1750                         write_unlock_bh(&policy->lock);
1751                         dst_free(dst);
1752                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
1753                         goto error;
1754                 }
1755
1756                 dst->next = policy->bundles;
1757                 policy->bundles = dst;
1758                 dst_hold(dst);
1759                 write_unlock_bh(&policy->lock);
1760         }
1761         *dst_p = dst;
1762         dst_release(dst_orig);
1763         xfrm_pols_put(pols, npols);
1764         return 0;
1765
1766 error:
1767         xfrm_pols_put(pols, npols);
1768 dropdst:
1769         dst_release(dst_orig);
1770         *dst_p = NULL;
1771         return err;
1772
1773 nopol:
1774         err = -ENOENT;
1775         if (flags & XFRM_LOOKUP_ICMP)
1776                 goto dropdst;
1777         return 0;
1778 }
1779 EXPORT_SYMBOL(__xfrm_lookup);
1780
1781 int xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
1782                 struct sock *sk, int flags)
1783 {
1784         int err = __xfrm_lookup(net, dst_p, fl, sk, flags);
1785
1786         if (err == -EREMOTE) {
1787                 dst_release(*dst_p);
1788                 *dst_p = NULL;
1789                 err = -EAGAIN;
1790         }
1791
1792         return err;
1793 }
1794 EXPORT_SYMBOL(xfrm_lookup);
1795
1796 static inline int
1797 xfrm_secpath_reject(int idx, struct sk_buff *skb, struct flowi *fl)
1798 {
1799         struct xfrm_state *x;
1800
1801         if (!skb->sp || idx < 0 || idx >= skb->sp->len)
1802                 return 0;
1803         x = skb->sp->xvec[idx];
1804         if (!x->type->reject)
1805                 return 0;
1806         return x->type->reject(x, skb, fl);
1807 }
1808
1809 /* When skb is transformed back to its "native" form, we have to
1810  * check policy restrictions. At the moment we make this in maximally
1811  * stupid way. Shame on me. :-) Of course, connected sockets must
1812  * have policy cached at them.
1813  */
1814
1815 static inline int
1816 xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
1817               unsigned short family)
1818 {
1819         if (xfrm_state_kern(x))
1820                 return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
1821         return  x->id.proto == tmpl->id.proto &&
1822                 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
1823                 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
1824                 x->props.mode == tmpl->mode &&
1825                 (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
1826                  !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
1827                 !(x->props.mode != XFRM_MODE_TRANSPORT &&
1828                   xfrm_state_addr_cmp(tmpl, x, family));
1829 }
1830
1831 /*
1832  * 0 or more than 0 is returned when validation is succeeded (either bypass
1833  * because of optional transport mode, or next index of the mathced secpath
1834  * state with the template.
1835  * -1 is returned when no matching template is found.
1836  * Otherwise "-2 - errored_index" is returned.
1837  */
1838 static inline int
1839 xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
1840                unsigned short family)
1841 {
1842         int idx = start;
1843
1844         if (tmpl->optional) {
1845                 if (tmpl->mode == XFRM_MODE_TRANSPORT)
1846                         return start;
1847         } else
1848                 start = -1;
1849         for (; idx < sp->len; idx++) {
1850                 if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
1851                         return ++idx;
1852                 if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
1853                         if (start == -1)
1854                                 start = -2-idx;
1855                         break;
1856                 }
1857         }
1858         return start;
1859 }
1860
1861 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1862                           unsigned int family, int reverse)
1863 {
1864         struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1865         int err;
1866
1867         if (unlikely(afinfo == NULL))
1868                 return -EAFNOSUPPORT;
1869
1870         afinfo->decode_session(skb, fl, reverse);
1871         err = security_xfrm_decode_session(skb, &fl->secid);
1872         xfrm_policy_put_afinfo(afinfo);
1873         return err;
1874 }
1875 EXPORT_SYMBOL(__xfrm_decode_session);
1876
1877 static inline int secpath_has_nontransport(struct sec_path *sp, int k, int *idxp)
1878 {
1879         for (; k < sp->len; k++) {
1880                 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) {
1881                         *idxp = k;
1882                         return 1;
1883                 }
1884         }
1885
1886         return 0;
1887 }
1888
1889 int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
1890                         unsigned short family)
1891 {
1892         struct net *net = dev_net(skb->dev);
1893         struct xfrm_policy *pol;
1894         struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1895         int npols = 0;
1896         int xfrm_nr;
1897         int pi;
1898         int reverse;
1899         struct flowi fl;
1900         u8 fl_dir;
1901         int xerr_idx = -1;
1902
1903         reverse = dir & ~XFRM_POLICY_MASK;
1904         dir &= XFRM_POLICY_MASK;
1905         fl_dir = policy_to_flow_dir(dir);
1906
1907         if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) {
1908                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
1909                 return 0;
1910         }
1911
1912         nf_nat_decode_session(skb, &fl, family);
1913
1914         /* First, check used SA against their selectors. */
1915         if (skb->sp) {
1916                 int i;
1917
1918                 for (i=skb->sp->len-1; i>=0; i--) {
1919                         struct xfrm_state *x = skb->sp->xvec[i];
1920                         if (!xfrm_selector_match(&x->sel, &fl, family)) {
1921                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH);
1922                                 return 0;
1923                         }
1924                 }
1925         }
1926
1927         pol = NULL;
1928         if (sk && sk->sk_policy[dir]) {
1929                 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
1930                 if (IS_ERR(pol)) {
1931                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
1932                         return 0;
1933                 }
1934         }
1935
1936         if (!pol)
1937                 pol = flow_cache_lookup(net, &fl, family, fl_dir,
1938                                         xfrm_policy_lookup);
1939
1940         if (IS_ERR(pol)) {
1941                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
1942                 return 0;
1943         }
1944
1945         if (!pol) {
1946                 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {
1947                         xfrm_secpath_reject(xerr_idx, skb, &fl);
1948                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS);
1949                         return 0;
1950                 }
1951                 return 1;
1952         }
1953
1954         pol->curlft.use_time = get_seconds();
1955
1956         pols[0] = pol;
1957         npols ++;
1958 #ifdef CONFIG_XFRM_SUB_POLICY
1959         if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
1960                 pols[1] = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN,
1961                                                     &fl, family,
1962                                                     XFRM_POLICY_IN);
1963                 if (pols[1]) {
1964                         if (IS_ERR(pols[1])) {
1965                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
1966                                 return 0;
1967                         }
1968                         pols[1]->curlft.use_time = get_seconds();
1969                         npols ++;
1970                 }
1971         }
1972 #endif
1973
1974         if (pol->action == XFRM_POLICY_ALLOW) {
1975                 struct sec_path *sp;
1976                 static struct sec_path dummy;
1977                 struct xfrm_tmpl *tp[XFRM_MAX_DEPTH];
1978                 struct xfrm_tmpl *stp[XFRM_MAX_DEPTH];
1979                 struct xfrm_tmpl **tpp = tp;
1980                 int ti = 0;
1981                 int i, k;
1982
1983                 if ((sp = skb->sp) == NULL)
1984                         sp = &dummy;
1985
1986                 for (pi = 0; pi < npols; pi++) {
1987                         if (pols[pi] != pol &&
1988                             pols[pi]->action != XFRM_POLICY_ALLOW) {
1989                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK);
1990                                 goto reject;
1991                         }
1992                         if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) {
1993                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
1994                                 goto reject_error;
1995                         }
1996                         for (i = 0; i < pols[pi]->xfrm_nr; i++)
1997                                 tpp[ti++] = &pols[pi]->xfrm_vec[i];
1998                 }
1999                 xfrm_nr = ti;
2000                 if (npols > 1) {
2001                         xfrm_tmpl_sort(stp, tpp, xfrm_nr, family);
2002                         tpp = stp;
2003                 }
2004
2005                 /* For each tunnel xfrm, find the first matching tmpl.
2006                  * For each tmpl before that, find corresponding xfrm.
2007                  * Order is _important_. Later we will implement
2008                  * some barriers, but at the moment barriers
2009                  * are implied between each two transformations.
2010                  */
2011                 for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
2012                         k = xfrm_policy_ok(tpp[i], sp, k, family);
2013                         if (k < 0) {
2014                                 if (k < -1)
2015                                         /* "-2 - errored_index" returned */
2016                                         xerr_idx = -(2+k);
2017                                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH);
2018                                 goto reject;
2019                         }
2020                 }
2021
2022                 if (secpath_has_nontransport(sp, k, &xerr_idx)) {
2023                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH);
2024                         goto reject;
2025                 }
2026
2027                 xfrm_pols_put(pols, npols);
2028                 return 1;
2029         }
2030         XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK);
2031
2032 reject:
2033         xfrm_secpath_reject(xerr_idx, skb, &fl);
2034 reject_error:
2035         xfrm_pols_put(pols, npols);
2036         return 0;
2037 }
2038 EXPORT_SYMBOL(__xfrm_policy_check);
2039
2040 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
2041 {
2042         struct net *net = dev_net(skb->dev);
2043         struct flowi fl;
2044
2045         if (xfrm_decode_session(skb, &fl, family) < 0) {
2046                 /* XXX: we should have something like FWDHDRERROR here. */
2047                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
2048                 return 0;
2049         }
2050
2051         return xfrm_lookup(net, &skb->dst, &fl, NULL, 0) == 0;
2052 }
2053 EXPORT_SYMBOL(__xfrm_route_forward);
2054
2055 /* Optimize later using cookies and generation ids. */
2056
2057 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
2058 {
2059         /* Code (such as __xfrm4_bundle_create()) sets dst->obsolete
2060          * to "-1" to force all XFRM destinations to get validated by
2061          * dst_ops->check on every use.  We do this because when a
2062          * normal route referenced by an XFRM dst is obsoleted we do
2063          * not go looking around for all parent referencing XFRM dsts
2064          * so that we can invalidate them.  It is just too much work.
2065          * Instead we make the checks here on every use.  For example:
2066          *
2067          *      XFRM dst A --> IPv4 dst X
2068          *
2069          * X is the "xdst->route" of A (X is also the "dst->path" of A
2070          * in this example).  If X is marked obsolete, "A" will not
2071          * notice.  That's what we are validating here via the
2072          * stale_bundle() check.
2073          *
2074          * When a policy's bundle is pruned, we dst_free() the XFRM
2075          * dst which causes it's ->obsolete field to be set to a
2076          * positive non-zero integer.  If an XFRM dst has been pruned
2077          * like this, we want to force a new route lookup.
2078          */
2079         if (dst->obsolete < 0 && !stale_bundle(dst))
2080                 return dst;
2081
2082         return NULL;
2083 }
2084
2085 static int stale_bundle(struct dst_entry *dst)
2086 {
2087         return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
2088 }
2089
2090 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
2091 {
2092         while ((dst = dst->child) && dst->xfrm && dst->dev == dev) {
2093                 dst->dev = dev_net(dev)->loopback_dev;
2094                 dev_hold(dst->dev);
2095                 dev_put(dev);
2096         }
2097 }
2098 EXPORT_SYMBOL(xfrm_dst_ifdown);
2099
2100 static void xfrm_link_failure(struct sk_buff *skb)
2101 {
2102         /* Impossible. Such dst must be popped before reaches point of failure. */
2103         return;
2104 }
2105
2106 static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
2107 {
2108         if (dst) {
2109                 if (dst->obsolete) {
2110                         dst_release(dst);
2111                         dst = NULL;
2112                 }
2113         }
2114         return dst;
2115 }
2116
2117 static void prune_one_bundle(struct xfrm_policy *pol, int (*func)(struct dst_entry *), struct dst_entry **gc_list_p)
2118 {
2119         struct dst_entry *dst, **dstp;
2120
2121         write_lock(&pol->lock);
2122         dstp = &pol->bundles;
2123         while ((dst=*dstp) != NULL) {
2124                 if (func(dst)) {
2125                         *dstp = dst->next;
2126                         dst->next = *gc_list_p;
2127                         *gc_list_p = dst;
2128                 } else {
2129                         dstp = &dst->next;
2130                 }
2131         }
2132         write_unlock(&pol->lock);
2133 }
2134
2135 static void xfrm_prune_bundles(struct net *net, int (*func)(struct dst_entry *))
2136 {
2137         struct dst_entry *gc_list = NULL;
2138         int dir;
2139
2140         read_lock_bh(&xfrm_policy_lock);
2141         for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
2142                 struct xfrm_policy *pol;
2143                 struct hlist_node *entry;
2144                 struct hlist_head *table;
2145                 int i;
2146
2147                 hlist_for_each_entry(pol, entry,
2148                                      &net->xfrm.policy_inexact[dir], bydst)
2149                         prune_one_bundle(pol, func, &gc_list);
2150
2151                 table = net->xfrm.policy_bydst[dir].table;
2152                 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
2153                         hlist_for_each_entry(pol, entry, table + i, bydst)
2154                                 prune_one_bundle(pol, func, &gc_list);
2155                 }
2156         }
2157         read_unlock_bh(&xfrm_policy_lock);
2158
2159         while (gc_list) {
2160                 struct dst_entry *dst = gc_list;
2161                 gc_list = dst->next;
2162                 dst_free(dst);
2163         }
2164 }
2165
2166 static int unused_bundle(struct dst_entry *dst)
2167 {
2168         return !atomic_read(&dst->__refcnt);
2169 }
2170
2171 static void __xfrm_garbage_collect(struct net *net)
2172 {
2173         xfrm_prune_bundles(net, unused_bundle);
2174 }
2175
2176 static int xfrm_flush_bundles(struct net *net)
2177 {
2178         xfrm_prune_bundles(net, stale_bundle);
2179         return 0;
2180 }
2181
2182 static void xfrm_init_pmtu(struct dst_entry *dst)
2183 {
2184         do {
2185                 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2186                 u32 pmtu, route_mtu_cached;
2187
2188                 pmtu = dst_mtu(dst->child);
2189                 xdst->child_mtu_cached = pmtu;
2190
2191                 pmtu = xfrm_state_mtu(dst->xfrm, pmtu);
2192
2193                 route_mtu_cached = dst_mtu(xdst->route);
2194                 xdst->route_mtu_cached = route_mtu_cached;
2195
2196                 if (pmtu > route_mtu_cached)
2197                         pmtu = route_mtu_cached;
2198
2199                 dst->metrics[RTAX_MTU-1] = pmtu;
2200         } while ((dst = dst->next));
2201 }
2202
2203 /* Check that the bundle accepts the flow and its components are
2204  * still valid.
2205  */
2206
2207 int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
2208                 struct flowi *fl, int family, int strict)
2209 {
2210         struct dst_entry *dst = &first->u.dst;
2211         struct xfrm_dst *last;
2212         u32 mtu;
2213
2214         if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) ||
2215             (dst->dev && !netif_running(dst->dev)))
2216                 return 0;
2217 #ifdef CONFIG_XFRM_SUB_POLICY
2218         if (fl) {
2219                 if (first->origin && !flow_cache_uli_match(first->origin, fl))
2220                         return 0;
2221                 if (first->partner &&
2222                     !xfrm_selector_match(first->partner, fl, family))
2223                         return 0;
2224         }
2225 #endif
2226
2227         last = NULL;
2228
2229         do {
2230                 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2231
2232                 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
2233                         return 0;
2234                 if (fl && pol &&
2235                     !security_xfrm_state_pol_flow_match(dst->xfrm, pol, fl))
2236                         return 0;
2237                 if (dst->xfrm->km.state != XFRM_STATE_VALID)
2238                         return 0;
2239                 if (xdst->genid != dst->xfrm->genid)
2240                         return 0;
2241
2242                 if (strict && fl &&
2243                     !(dst->xfrm->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2244                     !xfrm_state_addr_flow_check(dst->xfrm, fl, family))
2245                         return 0;
2246
2247                 mtu = dst_mtu(dst->child);
2248                 if (xdst->child_mtu_cached != mtu) {
2249                         last = xdst;
2250                         xdst->child_mtu_cached = mtu;
2251                 }
2252
2253                 if (!dst_check(xdst->route, xdst->route_cookie))
2254                         return 0;
2255                 mtu = dst_mtu(xdst->route);
2256                 if (xdst->route_mtu_cached != mtu) {
2257                         last = xdst;
2258                         xdst->route_mtu_cached = mtu;
2259                 }
2260
2261                 dst = dst->child;
2262         } while (dst->xfrm);
2263
2264         if (likely(!last))
2265                 return 1;
2266
2267         mtu = last->child_mtu_cached;
2268         for (;;) {
2269                 dst = &last->u.dst;
2270
2271                 mtu = xfrm_state_mtu(dst->xfrm, mtu);
2272                 if (mtu > last->route_mtu_cached)
2273                         mtu = last->route_mtu_cached;
2274                 dst->metrics[RTAX_MTU-1] = mtu;
2275
2276                 if (last == first)
2277                         break;
2278
2279                 last = (struct xfrm_dst *)last->u.dst.next;
2280                 last->child_mtu_cached = mtu;
2281         }
2282
2283         return 1;
2284 }
2285
2286 EXPORT_SYMBOL(xfrm_bundle_ok);
2287
2288 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
2289 {
2290         int err = 0;
2291         if (unlikely(afinfo == NULL))
2292                 return -EINVAL;
2293         if (unlikely(afinfo->family >= NPROTO))
2294                 return -EAFNOSUPPORT;
2295         write_lock_bh(&xfrm_policy_afinfo_lock);
2296         if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
2297                 err = -ENOBUFS;
2298         else {
2299                 struct dst_ops *dst_ops = afinfo->dst_ops;
2300                 if (likely(dst_ops->kmem_cachep == NULL))
2301                         dst_ops->kmem_cachep = xfrm_dst_cache;
2302                 if (likely(dst_ops->check == NULL))
2303                         dst_ops->check = xfrm_dst_check;
2304                 if (likely(dst_ops->negative_advice == NULL))
2305                         dst_ops->negative_advice = xfrm_negative_advice;
2306                 if (likely(dst_ops->link_failure == NULL))
2307                         dst_ops->link_failure = xfrm_link_failure;
2308                 if (likely(afinfo->garbage_collect == NULL))
2309                         afinfo->garbage_collect = __xfrm_garbage_collect;
2310                 xfrm_policy_afinfo[afinfo->family] = afinfo;
2311         }
2312         write_unlock_bh(&xfrm_policy_afinfo_lock);
2313         return err;
2314 }
2315 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
2316
2317 int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
2318 {
2319         int err = 0;
2320         if (unlikely(afinfo == NULL))
2321                 return -EINVAL;
2322         if (unlikely(afinfo->family >= NPROTO))
2323                 return -EAFNOSUPPORT;
2324         write_lock_bh(&xfrm_policy_afinfo_lock);
2325         if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
2326                 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
2327                         err = -EINVAL;
2328                 else {
2329                         struct dst_ops *dst_ops = afinfo->dst_ops;
2330                         xfrm_policy_afinfo[afinfo->family] = NULL;
2331                         dst_ops->kmem_cachep = NULL;
2332                         dst_ops->check = NULL;
2333                         dst_ops->negative_advice = NULL;
2334                         dst_ops->link_failure = NULL;
2335                         afinfo->garbage_collect = NULL;
2336                 }
2337         }
2338         write_unlock_bh(&xfrm_policy_afinfo_lock);
2339         return err;
2340 }
2341 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
2342
2343 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
2344 {
2345         struct xfrm_policy_afinfo *afinfo;
2346         if (unlikely(family >= NPROTO))
2347                 return NULL;
2348         read_lock(&xfrm_policy_afinfo_lock);
2349         afinfo = xfrm_policy_afinfo[family];
2350         if (unlikely(!afinfo))
2351                 read_unlock(&xfrm_policy_afinfo_lock);
2352         return afinfo;
2353 }
2354
2355 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo)
2356 {
2357         read_unlock(&xfrm_policy_afinfo_lock);
2358 }
2359
2360 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
2361 {
2362         struct net_device *dev = ptr;
2363
2364         switch (event) {
2365         case NETDEV_DOWN:
2366                 xfrm_flush_bundles(dev_net(dev));
2367         }
2368         return NOTIFY_DONE;
2369 }
2370
2371 static struct notifier_block xfrm_dev_notifier = {
2372         .notifier_call  = xfrm_dev_event,
2373 };
2374
2375 #ifdef CONFIG_XFRM_STATISTICS
2376 static int __net_init xfrm_statistics_init(struct net *net)
2377 {
2378         int rv;
2379
2380         if (snmp_mib_init((void **)net->mib.xfrm_statistics,
2381                           sizeof(struct linux_xfrm_mib)) < 0)
2382                 return -ENOMEM;
2383         rv = xfrm_proc_init(net);
2384         if (rv < 0)
2385                 snmp_mib_free((void **)net->mib.xfrm_statistics);
2386         return rv;
2387 }
2388
2389 static void xfrm_statistics_fini(struct net *net)
2390 {
2391         xfrm_proc_fini(net);
2392         snmp_mib_free((void **)net->mib.xfrm_statistics);
2393 }
2394 #else
2395 static int __net_init xfrm_statistics_init(struct net *net)
2396 {
2397         return 0;
2398 }
2399
2400 static void xfrm_statistics_fini(struct net *net)
2401 {
2402 }
2403 #endif
2404
2405 static int __net_init xfrm_policy_init(struct net *net)
2406 {
2407         unsigned int hmask, sz;
2408         int dir;
2409
2410         if (net_eq(net, &init_net))
2411                 xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache",
2412                                            sizeof(struct xfrm_dst),
2413                                            0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
2414                                            NULL);
2415
2416         hmask = 8 - 1;
2417         sz = (hmask+1) * sizeof(struct hlist_head);
2418
2419         net->xfrm.policy_byidx = xfrm_hash_alloc(sz);
2420         if (!net->xfrm.policy_byidx)
2421                 goto out_byidx;
2422         net->xfrm.policy_idx_hmask = hmask;
2423
2424         for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
2425                 struct xfrm_policy_hash *htab;
2426
2427                 net->xfrm.policy_count[dir] = 0;
2428                 INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
2429
2430                 htab = &net->xfrm.policy_bydst[dir];
2431                 htab->table = xfrm_hash_alloc(sz);
2432                 if (!htab->table)
2433                         goto out_bydst;
2434                 htab->hmask = hmask;
2435         }
2436
2437         INIT_LIST_HEAD(&net->xfrm.policy_all);
2438         INIT_WORK(&net->xfrm.policy_hash_work, xfrm_hash_resize);
2439         if (net_eq(net, &init_net))
2440                 register_netdevice_notifier(&xfrm_dev_notifier);
2441         return 0;
2442
2443 out_bydst:
2444         for (dir--; dir >= 0; dir--) {
2445                 struct xfrm_policy_hash *htab;
2446
2447                 htab = &net->xfrm.policy_bydst[dir];
2448                 xfrm_hash_free(htab->table, sz);
2449         }
2450         xfrm_hash_free(net->xfrm.policy_byidx, sz);
2451 out_byidx:
2452         return -ENOMEM;
2453 }
2454
2455 static void xfrm_policy_fini(struct net *net)
2456 {
2457         struct xfrm_audit audit_info;
2458         unsigned int sz;
2459         int dir;
2460
2461         flush_work(&net->xfrm.policy_hash_work);
2462 #ifdef CONFIG_XFRM_SUB_POLICY
2463         audit_info.loginuid = -1;
2464         audit_info.sessionid = -1;
2465         audit_info.secid = 0;
2466         xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info);
2467 #endif
2468         audit_info.loginuid = -1;
2469         audit_info.sessionid = -1;
2470         audit_info.secid = 0;
2471         xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);
2472         flush_work(&xfrm_policy_gc_work);
2473
2474         WARN_ON(!list_empty(&net->xfrm.policy_all));
2475
2476         for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
2477                 struct xfrm_policy_hash *htab;
2478
2479                 WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir]));
2480
2481                 htab = &net->xfrm.policy_bydst[dir];
2482                 sz = (htab->hmask + 1);
2483                 WARN_ON(!hlist_empty(htab->table));
2484                 xfrm_hash_free(htab->table, sz);
2485         }
2486
2487         sz = (net->xfrm.policy_idx_hmask + 1) * sizeof(struct hlist_head);
2488         WARN_ON(!hlist_empty(net->xfrm.policy_byidx));
2489         xfrm_hash_free(net->xfrm.policy_byidx, sz);
2490 }
2491
2492 static int __net_init xfrm_net_init(struct net *net)
2493 {
2494         int rv;
2495
2496         rv = xfrm_statistics_init(net);
2497         if (rv < 0)
2498                 goto out_statistics;
2499         rv = xfrm_state_init(net);
2500         if (rv < 0)
2501                 goto out_state;
2502         rv = xfrm_policy_init(net);
2503         if (rv < 0)
2504                 goto out_policy;
2505         rv = xfrm_sysctl_init(net);
2506         if (rv < 0)
2507                 goto out_sysctl;
2508         return 0;
2509
2510 out_sysctl:
2511         xfrm_policy_fini(net);
2512 out_policy:
2513         xfrm_state_fini(net);
2514 out_state:
2515         xfrm_statistics_fini(net);
2516 out_statistics:
2517         return rv;
2518 }
2519
2520 static void __net_exit xfrm_net_exit(struct net *net)
2521 {
2522         xfrm_sysctl_fini(net);
2523         xfrm_policy_fini(net);
2524         xfrm_state_fini(net);
2525         xfrm_statistics_fini(net);
2526 }
2527
2528 static struct pernet_operations __net_initdata xfrm_net_ops = {
2529         .init = xfrm_net_init,
2530         .exit = xfrm_net_exit,
2531 };
2532
2533 void __init xfrm_init(void)
2534 {
2535         register_pernet_subsys(&xfrm_net_ops);
2536         xfrm_input_init();
2537 }
2538
2539 #ifdef CONFIG_AUDITSYSCALL
2540 static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
2541                                          struct audit_buffer *audit_buf)
2542 {
2543         struct xfrm_sec_ctx *ctx = xp->security;
2544         struct xfrm_selector *sel = &xp->selector;
2545
2546         if (ctx)
2547                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2548                                  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2549
2550         switch(sel->family) {
2551         case AF_INET:
2552                 audit_log_format(audit_buf, " src=%pI4", &sel->saddr.a4);
2553                 if (sel->prefixlen_s != 32)
2554                         audit_log_format(audit_buf, " src_prefixlen=%d",
2555                                          sel->prefixlen_s);
2556                 audit_log_format(audit_buf, " dst=%pI4", &sel->daddr.a4);
2557                 if (sel->prefixlen_d != 32)
2558                         audit_log_format(audit_buf, " dst_prefixlen=%d",
2559                                          sel->prefixlen_d);
2560                 break;
2561         case AF_INET6:
2562                 audit_log_format(audit_buf, " src=%pI6", sel->saddr.a6);
2563                 if (sel->prefixlen_s != 128)
2564                         audit_log_format(audit_buf, " src_prefixlen=%d",
2565                                          sel->prefixlen_s);
2566                 audit_log_format(audit_buf, " dst=%pI6", sel->daddr.a6);
2567                 if (sel->prefixlen_d != 128)
2568                         audit_log_format(audit_buf, " dst_prefixlen=%d",
2569                                          sel->prefixlen_d);
2570                 break;
2571         }
2572 }
2573
2574 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
2575                            uid_t auid, u32 sessionid, u32 secid)
2576 {
2577         struct audit_buffer *audit_buf;
2578
2579         audit_buf = xfrm_audit_start("SPD-add");
2580         if (audit_buf == NULL)
2581                 return;
2582         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2583         audit_log_format(audit_buf, " res=%u", result);
2584         xfrm_audit_common_policyinfo(xp, audit_buf);
2585         audit_log_end(audit_buf);
2586 }
2587 EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);
2588
2589 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
2590                               uid_t auid, u32 sessionid, u32 secid)
2591 {
2592         struct audit_buffer *audit_buf;
2593
2594         audit_buf = xfrm_audit_start("SPD-delete");
2595         if (audit_buf == NULL)
2596                 return;
2597         xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
2598         audit_log_format(audit_buf, " res=%u", result);
2599         xfrm_audit_common_policyinfo(xp, audit_buf);
2600         audit_log_end(audit_buf);
2601 }
2602 EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete);
2603 #endif
2604
2605 #ifdef CONFIG_XFRM_MIGRATE
2606 static int xfrm_migrate_selector_match(struct xfrm_selector *sel_cmp,
2607                                        struct xfrm_selector *sel_tgt)
2608 {
2609         if (sel_cmp->proto == IPSEC_ULPROTO_ANY) {
2610                 if (sel_tgt->family == sel_cmp->family &&
2611                     xfrm_addr_cmp(&sel_tgt->daddr, &sel_cmp->daddr,
2612                                   sel_cmp->family) == 0 &&
2613                     xfrm_addr_cmp(&sel_tgt->saddr, &sel_cmp->saddr,
2614                                   sel_cmp->family) == 0 &&
2615                     sel_tgt->prefixlen_d == sel_cmp->prefixlen_d &&
2616                     sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) {
2617                         return 1;
2618                 }
2619         } else {
2620                 if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) {
2621                         return 1;
2622                 }
2623         }
2624         return 0;
2625 }
2626
2627 static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel,
2628                                                      u8 dir, u8 type)
2629 {
2630         struct xfrm_policy *pol, *ret = NULL;
2631         struct hlist_node *entry;
2632         struct hlist_head *chain;
2633         u32 priority = ~0U;
2634
2635         read_lock_bh(&xfrm_policy_lock);
2636         chain = policy_hash_direct(&init_net, &sel->daddr, &sel->saddr, sel->family, dir);
2637         hlist_for_each_entry(pol, entry, chain, bydst) {
2638                 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
2639                     pol->type == type) {
2640                         ret = pol;
2641                         priority = ret->priority;
2642                         break;
2643                 }
2644         }
2645         chain = &init_net.xfrm.policy_inexact[dir];
2646         hlist_for_each_entry(pol, entry, chain, bydst) {
2647                 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
2648                     pol->type == type &&
2649                     pol->priority < priority) {
2650                         ret = pol;
2651                         break;
2652                 }
2653         }
2654
2655         if (ret)
2656                 xfrm_pol_hold(ret);
2657
2658         read_unlock_bh(&xfrm_policy_lock);
2659
2660         return ret;
2661 }
2662
2663 static int migrate_tmpl_match(struct xfrm_migrate *m, struct xfrm_tmpl *t)
2664 {
2665         int match = 0;
2666
2667         if (t->mode == m->mode && t->id.proto == m->proto &&
2668             (m->reqid == 0 || t->reqid == m->reqid)) {
2669                 switch (t->mode) {
2670                 case XFRM_MODE_TUNNEL:
2671                 case XFRM_MODE_BEET:
2672                         if (xfrm_addr_cmp(&t->id.daddr, &m->old_daddr,
2673                                           m->old_family) == 0 &&
2674                             xfrm_addr_cmp(&t->saddr, &m->old_saddr,
2675                                           m->old_family) == 0) {
2676                                 match = 1;
2677                         }
2678                         break;
2679                 case XFRM_MODE_TRANSPORT:
2680                         /* in case of transport mode, template does not store
2681                            any IP addresses, hence we just compare mode and
2682                            protocol */
2683                         match = 1;
2684                         break;
2685                 default:
2686                         break;
2687                 }
2688         }
2689         return match;
2690 }
2691
2692 /* update endpoint address(es) of template(s) */
2693 static int xfrm_policy_migrate(struct xfrm_policy *pol,
2694                                struct xfrm_migrate *m, int num_migrate)
2695 {
2696         struct xfrm_migrate *mp;
2697         struct dst_entry *dst;
2698         int i, j, n = 0;
2699
2700         write_lock_bh(&pol->lock);
2701         if (unlikely(pol->walk.dead)) {
2702                 /* target policy has been deleted */
2703                 write_unlock_bh(&pol->lock);
2704                 return -ENOENT;
2705         }
2706
2707         for (i = 0; i < pol->xfrm_nr; i++) {
2708                 for (j = 0, mp = m; j < num_migrate; j++, mp++) {
2709                         if (!migrate_tmpl_match(mp, &pol->xfrm_vec[i]))
2710                                 continue;
2711                         n++;
2712                         if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL &&
2713                             pol->xfrm_vec[i].mode != XFRM_MODE_BEET)
2714                                 continue;
2715                         /* update endpoints */
2716                         memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr,
2717                                sizeof(pol->xfrm_vec[i].id.daddr));
2718                         memcpy(&pol->xfrm_vec[i].saddr, &mp->new_saddr,
2719                                sizeof(pol->xfrm_vec[i].saddr));
2720                         pol->xfrm_vec[i].encap_family = mp->new_family;
2721                         /* flush bundles */
2722                         while ((dst = pol->bundles) != NULL) {
2723                                 pol->bundles = dst->next;
2724                                 dst_free(dst);
2725                         }
2726                 }
2727         }
2728
2729         write_unlock_bh(&pol->lock);
2730
2731         if (!n)
2732                 return -ENODATA;
2733
2734         return 0;
2735 }
2736
2737 static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate)
2738 {
2739         int i, j;
2740
2741         if (num_migrate < 1 || num_migrate > XFRM_MAX_DEPTH)
2742                 return -EINVAL;
2743
2744         for (i = 0; i < num_migrate; i++) {
2745                 if ((xfrm_addr_cmp(&m[i].old_daddr, &m[i].new_daddr,
2746                                    m[i].old_family) == 0) &&
2747                     (xfrm_addr_cmp(&m[i].old_saddr, &m[i].new_saddr,
2748                                    m[i].old_family) == 0))
2749                         return -EINVAL;
2750                 if (xfrm_addr_any(&m[i].new_daddr, m[i].new_family) ||
2751                     xfrm_addr_any(&m[i].new_saddr, m[i].new_family))
2752                         return -EINVAL;
2753
2754                 /* check if there is any duplicated entry */
2755                 for (j = i + 1; j < num_migrate; j++) {
2756                         if (!memcmp(&m[i].old_daddr, &m[j].old_daddr,
2757                                     sizeof(m[i].old_daddr)) &&
2758                             !memcmp(&m[i].old_saddr, &m[j].old_saddr,
2759                                     sizeof(m[i].old_saddr)) &&
2760                             m[i].proto == m[j].proto &&
2761                             m[i].mode == m[j].mode &&
2762                             m[i].reqid == m[j].reqid &&
2763                             m[i].old_family == m[j].old_family)
2764                                 return -EINVAL;
2765                 }
2766         }
2767
2768         return 0;
2769 }
2770
2771 int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2772                  struct xfrm_migrate *m, int num_migrate,
2773                  struct xfrm_kmaddress *k)
2774 {
2775         int i, err, nx_cur = 0, nx_new = 0;
2776         struct xfrm_policy *pol = NULL;
2777         struct xfrm_state *x, *xc;
2778         struct xfrm_state *x_cur[XFRM_MAX_DEPTH];
2779         struct xfrm_state *x_new[XFRM_MAX_DEPTH];
2780         struct xfrm_migrate *mp;
2781
2782         if ((err = xfrm_migrate_check(m, num_migrate)) < 0)
2783                 goto out;
2784
2785         /* Stage 1 - find policy */
2786         if ((pol = xfrm_migrate_policy_find(sel, dir, type)) == NULL) {
2787                 err = -ENOENT;
2788                 goto out;
2789         }
2790
2791         /* Stage 2 - find and update state(s) */
2792         for (i = 0, mp = m; i < num_migrate; i++, mp++) {
2793                 if ((x = xfrm_migrate_state_find(mp))) {
2794                         x_cur[nx_cur] = x;
2795                         nx_cur++;
2796                         if ((xc = xfrm_state_migrate(x, mp))) {
2797                                 x_new[nx_new] = xc;
2798                                 nx_new++;
2799                         } else {
2800                                 err = -ENODATA;
2801                                 goto restore_state;
2802                         }
2803                 }
2804         }
2805
2806         /* Stage 3 - update policy */
2807         if ((err = xfrm_policy_migrate(pol, m, num_migrate)) < 0)
2808                 goto restore_state;
2809
2810         /* Stage 4 - delete old state(s) */
2811         if (nx_cur) {
2812                 xfrm_states_put(x_cur, nx_cur);
2813                 xfrm_states_delete(x_cur, nx_cur);
2814         }
2815
2816         /* Stage 5 - announce */
2817         km_migrate(sel, dir, type, m, num_migrate, k);
2818
2819         xfrm_pol_put(pol);
2820
2821         return 0;
2822 out:
2823         return err;
2824
2825 restore_state:
2826         if (pol)
2827                 xfrm_pol_put(pol);
2828         if (nx_cur)
2829                 xfrm_states_put(x_cur, nx_cur);
2830         if (nx_new)
2831                 xfrm_states_delete(x_new, nx_new);
2832
2833         return err;
2834 }
2835 EXPORT_SYMBOL(xfrm_migrate);
2836 #endif