be02bd981d12f51aa43def59a7aad9b34def3306
[linux-2.6.git] / net / xfrm / xfrm_state.c
1 /*
2  * xfrm_state.c
3  *
4  * Changes:
5  *      Mitsuru KANDA @USAGI
6  *      Kazunori MIYAZAWA @USAGI
7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8  *              IPv6 support
9  *      YOSHIFUJI Hideaki @USAGI
10  *              Split up af-specific functions
11  *      Derek Atkins <derek@ihtfp.com>
12  *              Add UDP Encapsulation
13  *
14  */
15
16 #include <linux/workqueue.h>
17 #include <net/xfrm.h>
18 #include <linux/pfkeyv2.h>
19 #include <linux/ipsec.h>
20 #include <linux/module.h>
21 #include <asm/uaccess.h>
22
23 struct sock *xfrm_nl;
24 EXPORT_SYMBOL(xfrm_nl);
25
26 u32 sysctl_xfrm_aevent_etime = XFRM_AE_ETIME;
27 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
28
29 u32 sysctl_xfrm_aevent_rseqth = XFRM_AE_SEQT_SIZE;
30 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
31
32 /* Each xfrm_state may be linked to two tables:
33
34    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
35    2. Hash table by daddr to find what SAs exist for given
36       destination/tunnel endpoint. (output)
37  */
38
39 static DEFINE_SPINLOCK(xfrm_state_lock);
40
41 /* Hash table to find appropriate SA towards given target (endpoint
42  * of tunnel or destination of transport mode) allowed by selector.
43  *
44  * Main use is finding SA after policy selected tunnel or transport mode.
45  * Also, it can be used by ah/esp icmp error handler to find offending SA.
46  */
47 static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE];
48 static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE];
49
50 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
51 EXPORT_SYMBOL(km_waitq);
52
53 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
54 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
55
56 static struct work_struct xfrm_state_gc_work;
57 static struct list_head xfrm_state_gc_list = LIST_HEAD_INIT(xfrm_state_gc_list);
58 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
59
60 static int xfrm_state_gc_flush_bundles;
61
62 int __xfrm_state_delete(struct xfrm_state *x);
63
64 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family);
65 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
66
67 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
68 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
69
70 static void xfrm_state_gc_destroy(struct xfrm_state *x)
71 {
72         if (del_timer(&x->timer))
73                 BUG();
74         if (del_timer(&x->rtimer))
75                 BUG();
76         kfree(x->aalg);
77         kfree(x->ealg);
78         kfree(x->calg);
79         kfree(x->encap);
80         if (x->mode)
81                 xfrm_put_mode(x->mode);
82         if (x->type) {
83                 x->type->destructor(x);
84                 xfrm_put_type(x->type);
85         }
86         security_xfrm_state_free(x);
87         kfree(x);
88 }
89
90 static void xfrm_state_gc_task(void *data)
91 {
92         struct xfrm_state *x;
93         struct list_head *entry, *tmp;
94         struct list_head gc_list = LIST_HEAD_INIT(gc_list);
95
96         if (xfrm_state_gc_flush_bundles) {
97                 xfrm_state_gc_flush_bundles = 0;
98                 xfrm_flush_bundles();
99         }
100
101         spin_lock_bh(&xfrm_state_gc_lock);
102         list_splice_init(&xfrm_state_gc_list, &gc_list);
103         spin_unlock_bh(&xfrm_state_gc_lock);
104
105         list_for_each_safe(entry, tmp, &gc_list) {
106                 x = list_entry(entry, struct xfrm_state, bydst);
107                 xfrm_state_gc_destroy(x);
108         }
109         wake_up(&km_waitq);
110 }
111
112 static inline unsigned long make_jiffies(long secs)
113 {
114         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
115                 return MAX_SCHEDULE_TIMEOUT-1;
116         else
117                 return secs*HZ;
118 }
119
120 static void xfrm_timer_handler(unsigned long data)
121 {
122         struct xfrm_state *x = (struct xfrm_state*)data;
123         unsigned long now = (unsigned long)xtime.tv_sec;
124         long next = LONG_MAX;
125         int warn = 0;
126
127         spin_lock(&x->lock);
128         if (x->km.state == XFRM_STATE_DEAD)
129                 goto out;
130         if (x->km.state == XFRM_STATE_EXPIRED)
131                 goto expired;
132         if (x->lft.hard_add_expires_seconds) {
133                 long tmo = x->lft.hard_add_expires_seconds +
134                         x->curlft.add_time - now;
135                 if (tmo <= 0)
136                         goto expired;
137                 if (tmo < next)
138                         next = tmo;
139         }
140         if (x->lft.hard_use_expires_seconds) {
141                 long tmo = x->lft.hard_use_expires_seconds +
142                         (x->curlft.use_time ? : now) - now;
143                 if (tmo <= 0)
144                         goto expired;
145                 if (tmo < next)
146                         next = tmo;
147         }
148         if (x->km.dying)
149                 goto resched;
150         if (x->lft.soft_add_expires_seconds) {
151                 long tmo = x->lft.soft_add_expires_seconds +
152                         x->curlft.add_time - now;
153                 if (tmo <= 0)
154                         warn = 1;
155                 else if (tmo < next)
156                         next = tmo;
157         }
158         if (x->lft.soft_use_expires_seconds) {
159                 long tmo = x->lft.soft_use_expires_seconds +
160                         (x->curlft.use_time ? : now) - now;
161                 if (tmo <= 0)
162                         warn = 1;
163                 else if (tmo < next)
164                         next = tmo;
165         }
166
167         x->km.dying = warn;
168         if (warn)
169                 km_state_expired(x, 0, 0);
170 resched:
171         if (next != LONG_MAX &&
172             !mod_timer(&x->timer, jiffies + make_jiffies(next)))
173                 xfrm_state_hold(x);
174         goto out;
175
176 expired:
177         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
178                 x->km.state = XFRM_STATE_EXPIRED;
179                 wake_up(&km_waitq);
180                 next = 2;
181                 goto resched;
182         }
183         if (!__xfrm_state_delete(x) && x->id.spi)
184                 km_state_expired(x, 1, 0);
185
186 out:
187         spin_unlock(&x->lock);
188         xfrm_state_put(x);
189 }
190
191 static void xfrm_replay_timer_handler(unsigned long data);
192
193 struct xfrm_state *xfrm_state_alloc(void)
194 {
195         struct xfrm_state *x;
196
197         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
198
199         if (x) {
200                 atomic_set(&x->refcnt, 1);
201                 atomic_set(&x->tunnel_users, 0);
202                 INIT_LIST_HEAD(&x->bydst);
203                 INIT_LIST_HEAD(&x->byspi);
204                 init_timer(&x->timer);
205                 x->timer.function = xfrm_timer_handler;
206                 x->timer.data     = (unsigned long)x;
207                 init_timer(&x->rtimer);
208                 x->rtimer.function = xfrm_replay_timer_handler;
209                 x->rtimer.data     = (unsigned long)x;
210                 x->curlft.add_time = (unsigned long)xtime.tv_sec;
211                 x->lft.soft_byte_limit = XFRM_INF;
212                 x->lft.soft_packet_limit = XFRM_INF;
213                 x->lft.hard_byte_limit = XFRM_INF;
214                 x->lft.hard_packet_limit = XFRM_INF;
215                 x->replay_maxage = 0;
216                 x->replay_maxdiff = 0;
217                 spin_lock_init(&x->lock);
218         }
219         return x;
220 }
221 EXPORT_SYMBOL(xfrm_state_alloc);
222
223 void __xfrm_state_destroy(struct xfrm_state *x)
224 {
225         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
226
227         spin_lock_bh(&xfrm_state_gc_lock);
228         list_add(&x->bydst, &xfrm_state_gc_list);
229         spin_unlock_bh(&xfrm_state_gc_lock);
230         schedule_work(&xfrm_state_gc_work);
231 }
232 EXPORT_SYMBOL(__xfrm_state_destroy);
233
234 int __xfrm_state_delete(struct xfrm_state *x)
235 {
236         int err = -ESRCH;
237
238         if (x->km.state != XFRM_STATE_DEAD) {
239                 x->km.state = XFRM_STATE_DEAD;
240                 spin_lock(&xfrm_state_lock);
241                 list_del(&x->bydst);
242                 __xfrm_state_put(x);
243                 if (x->id.spi) {
244                         list_del(&x->byspi);
245                         __xfrm_state_put(x);
246                 }
247                 spin_unlock(&xfrm_state_lock);
248                 if (del_timer(&x->timer))
249                         __xfrm_state_put(x);
250                 if (del_timer(&x->rtimer))
251                         __xfrm_state_put(x);
252
253                 /* The number two in this test is the reference
254                  * mentioned in the comment below plus the reference
255                  * our caller holds.  A larger value means that
256                  * there are DSTs attached to this xfrm_state.
257                  */
258                 if (atomic_read(&x->refcnt) > 2) {
259                         xfrm_state_gc_flush_bundles = 1;
260                         schedule_work(&xfrm_state_gc_work);
261                 }
262
263                 /* All xfrm_state objects are created by xfrm_state_alloc.
264                  * The xfrm_state_alloc call gives a reference, and that
265                  * is what we are dropping here.
266                  */
267                 __xfrm_state_put(x);
268                 err = 0;
269         }
270
271         return err;
272 }
273 EXPORT_SYMBOL(__xfrm_state_delete);
274
275 int xfrm_state_delete(struct xfrm_state *x)
276 {
277         int err;
278
279         spin_lock_bh(&x->lock);
280         err = __xfrm_state_delete(x);
281         spin_unlock_bh(&x->lock);
282
283         return err;
284 }
285 EXPORT_SYMBOL(xfrm_state_delete);
286
287 void xfrm_state_flush(u8 proto)
288 {
289         int i;
290         struct xfrm_state *x;
291
292         spin_lock_bh(&xfrm_state_lock);
293         for (i = 0; i < XFRM_DST_HSIZE; i++) {
294 restart:
295                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
296                         if (!xfrm_state_kern(x) &&
297                             (proto == IPSEC_PROTO_ANY || x->id.proto == proto)) {
298                                 xfrm_state_hold(x);
299                                 spin_unlock_bh(&xfrm_state_lock);
300
301                                 xfrm_state_delete(x);
302                                 xfrm_state_put(x);
303
304                                 spin_lock_bh(&xfrm_state_lock);
305                                 goto restart;
306                         }
307                 }
308         }
309         spin_unlock_bh(&xfrm_state_lock);
310         wake_up(&km_waitq);
311 }
312 EXPORT_SYMBOL(xfrm_state_flush);
313
314 static int
315 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
316                   struct xfrm_tmpl *tmpl,
317                   xfrm_address_t *daddr, xfrm_address_t *saddr,
318                   unsigned short family)
319 {
320         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
321         if (!afinfo)
322                 return -1;
323         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
324         xfrm_state_put_afinfo(afinfo);
325         return 0;
326 }
327
328 struct xfrm_state *
329 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 
330                 struct flowi *fl, struct xfrm_tmpl *tmpl,
331                 struct xfrm_policy *pol, int *err,
332                 unsigned short family)
333 {
334         unsigned h = xfrm_dst_hash(daddr, family);
335         struct xfrm_state *x, *x0;
336         int acquire_in_progress = 0;
337         int error = 0;
338         struct xfrm_state *best = NULL;
339         struct xfrm_state_afinfo *afinfo;
340         
341         afinfo = xfrm_state_get_afinfo(family);
342         if (afinfo == NULL) {
343                 *err = -EAFNOSUPPORT;
344                 return NULL;
345         }
346
347         spin_lock_bh(&xfrm_state_lock);
348         list_for_each_entry(x, xfrm_state_bydst+h, bydst) {
349                 if (x->props.family == family &&
350                     x->props.reqid == tmpl->reqid &&
351                     xfrm_state_addr_check(x, daddr, saddr, family) &&
352                     tmpl->mode == x->props.mode &&
353                     tmpl->id.proto == x->id.proto &&
354                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
355                         /* Resolution logic:
356                            1. There is a valid state with matching selector.
357                               Done.
358                            2. Valid state with inappropriate selector. Skip.
359
360                            Entering area of "sysdeps".
361
362                            3. If state is not valid, selector is temporary,
363                               it selects only session which triggered
364                               previous resolution. Key manager will do
365                               something to install a state with proper
366                               selector.
367                          */
368                         if (x->km.state == XFRM_STATE_VALID) {
369                                 if (!xfrm_selector_match(&x->sel, fl, family) ||
370                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
371                                         continue;
372                                 if (!best ||
373                                     best->km.dying > x->km.dying ||
374                                     (best->km.dying == x->km.dying &&
375                                      best->curlft.add_time < x->curlft.add_time))
376                                         best = x;
377                         } else if (x->km.state == XFRM_STATE_ACQ) {
378                                 acquire_in_progress = 1;
379                         } else if (x->km.state == XFRM_STATE_ERROR ||
380                                    x->km.state == XFRM_STATE_EXPIRED) {
381                                 if (xfrm_selector_match(&x->sel, fl, family) &&
382                                     security_xfrm_state_pol_flow_match(x, pol, fl))
383                                         error = -ESRCH;
384                         }
385                 }
386         }
387
388         x = best;
389         if (!x && !error && !acquire_in_progress) {
390                 if (tmpl->id.spi &&
391                     (x0 = afinfo->state_lookup(daddr, tmpl->id.spi,
392                                                tmpl->id.proto)) != NULL) {
393                         xfrm_state_put(x0);
394                         error = -EEXIST;
395                         goto out;
396                 }
397                 x = xfrm_state_alloc();
398                 if (x == NULL) {
399                         error = -ENOMEM;
400                         goto out;
401                 }
402                 /* Initialize temporary selector matching only
403                  * to current session. */
404                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
405
406                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
407                 if (error) {
408                         x->km.state = XFRM_STATE_DEAD;
409                         xfrm_state_put(x);
410                         x = NULL;
411                         goto out;
412                 }
413
414                 if (km_query(x, tmpl, pol) == 0) {
415                         x->km.state = XFRM_STATE_ACQ;
416                         list_add_tail(&x->bydst, xfrm_state_bydst+h);
417                         xfrm_state_hold(x);
418                         if (x->id.spi) {
419                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
420                                 list_add(&x->byspi, xfrm_state_byspi+h);
421                                 xfrm_state_hold(x);
422                         }
423                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
424                         xfrm_state_hold(x);
425                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
426                         add_timer(&x->timer);
427                 } else {
428                         x->km.state = XFRM_STATE_DEAD;
429                         xfrm_state_put(x);
430                         x = NULL;
431                         error = -ESRCH;
432                 }
433         }
434 out:
435         if (x)
436                 xfrm_state_hold(x);
437         else
438                 *err = acquire_in_progress ? -EAGAIN : error;
439         spin_unlock_bh(&xfrm_state_lock);
440         xfrm_state_put_afinfo(afinfo);
441         return x;
442 }
443
444 static void __xfrm_state_insert(struct xfrm_state *x)
445 {
446         unsigned h = xfrm_dst_hash(&x->id.daddr, x->props.family);
447
448         list_add(&x->bydst, xfrm_state_bydst+h);
449         xfrm_state_hold(x);
450
451         h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
452
453         list_add(&x->byspi, xfrm_state_byspi+h);
454         xfrm_state_hold(x);
455
456         if (!mod_timer(&x->timer, jiffies + HZ))
457                 xfrm_state_hold(x);
458
459         if (x->replay_maxage &&
460             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
461                 xfrm_state_hold(x);
462
463         wake_up(&km_waitq);
464 }
465
466 void xfrm_state_insert(struct xfrm_state *x)
467 {
468         spin_lock_bh(&xfrm_state_lock);
469         __xfrm_state_insert(x);
470         spin_unlock_bh(&xfrm_state_lock);
471
472         xfrm_flush_all_bundles();
473 }
474 EXPORT_SYMBOL(xfrm_state_insert);
475
476 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
477
478 int xfrm_state_add(struct xfrm_state *x)
479 {
480         struct xfrm_state_afinfo *afinfo;
481         struct xfrm_state *x1;
482         int family;
483         int err;
484
485         family = x->props.family;
486         afinfo = xfrm_state_get_afinfo(family);
487         if (unlikely(afinfo == NULL))
488                 return -EAFNOSUPPORT;
489
490         spin_lock_bh(&xfrm_state_lock);
491
492         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
493         if (x1) {
494                 xfrm_state_put(x1);
495                 x1 = NULL;
496                 err = -EEXIST;
497                 goto out;
498         }
499
500         if (x->km.seq) {
501                 x1 = __xfrm_find_acq_byseq(x->km.seq);
502                 if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
503                         xfrm_state_put(x1);
504                         x1 = NULL;
505                 }
506         }
507
508         if (!x1)
509                 x1 = afinfo->find_acq(
510                         x->props.mode, x->props.reqid, x->id.proto,
511                         &x->id.daddr, &x->props.saddr, 0);
512
513         __xfrm_state_insert(x);
514         err = 0;
515
516 out:
517         spin_unlock_bh(&xfrm_state_lock);
518         xfrm_state_put_afinfo(afinfo);
519
520         if (!err)
521                 xfrm_flush_all_bundles();
522
523         if (x1) {
524                 xfrm_state_delete(x1);
525                 xfrm_state_put(x1);
526         }
527
528         return err;
529 }
530 EXPORT_SYMBOL(xfrm_state_add);
531
532 int xfrm_state_update(struct xfrm_state *x)
533 {
534         struct xfrm_state_afinfo *afinfo;
535         struct xfrm_state *x1;
536         int err;
537
538         afinfo = xfrm_state_get_afinfo(x->props.family);
539         if (unlikely(afinfo == NULL))
540                 return -EAFNOSUPPORT;
541
542         spin_lock_bh(&xfrm_state_lock);
543         x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
544
545         err = -ESRCH;
546         if (!x1)
547                 goto out;
548
549         if (xfrm_state_kern(x1)) {
550                 xfrm_state_put(x1);
551                 err = -EEXIST;
552                 goto out;
553         }
554
555         if (x1->km.state == XFRM_STATE_ACQ) {
556                 __xfrm_state_insert(x);
557                 x = NULL;
558         }
559         err = 0;
560
561 out:
562         spin_unlock_bh(&xfrm_state_lock);
563         xfrm_state_put_afinfo(afinfo);
564
565         if (err)
566                 return err;
567
568         if (!x) {
569                 xfrm_state_delete(x1);
570                 xfrm_state_put(x1);
571                 return 0;
572         }
573
574         err = -EINVAL;
575         spin_lock_bh(&x1->lock);
576         if (likely(x1->km.state == XFRM_STATE_VALID)) {
577                 if (x->encap && x1->encap)
578                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
579                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
580                 x1->km.dying = 0;
581
582                 if (!mod_timer(&x1->timer, jiffies + HZ))
583                         xfrm_state_hold(x1);
584                 if (x1->curlft.use_time)
585                         xfrm_state_check_expire(x1);
586
587                 err = 0;
588         }
589         spin_unlock_bh(&x1->lock);
590
591         xfrm_state_put(x1);
592
593         return err;
594 }
595 EXPORT_SYMBOL(xfrm_state_update);
596
597 int xfrm_state_check_expire(struct xfrm_state *x)
598 {
599         if (!x->curlft.use_time)
600                 x->curlft.use_time = (unsigned long)xtime.tv_sec;
601
602         if (x->km.state != XFRM_STATE_VALID)
603                 return -EINVAL;
604
605         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
606             x->curlft.packets >= x->lft.hard_packet_limit) {
607                 x->km.state = XFRM_STATE_EXPIRED;
608                 if (!mod_timer(&x->timer, jiffies))
609                         xfrm_state_hold(x);
610                 return -EINVAL;
611         }
612
613         if (!x->km.dying &&
614             (x->curlft.bytes >= x->lft.soft_byte_limit ||
615              x->curlft.packets >= x->lft.soft_packet_limit)) {
616                 x->km.dying = 1;
617                 km_state_expired(x, 0, 0);
618         }
619         return 0;
620 }
621 EXPORT_SYMBOL(xfrm_state_check_expire);
622
623 static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
624 {
625         int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
626                 - skb_headroom(skb);
627
628         if (nhead > 0)
629                 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
630
631         /* Check tail too... */
632         return 0;
633 }
634
635 int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
636 {
637         int err = xfrm_state_check_expire(x);
638         if (err < 0)
639                 goto err;
640         err = xfrm_state_check_space(x, skb);
641 err:
642         return err;
643 }
644 EXPORT_SYMBOL(xfrm_state_check);
645
646 struct xfrm_state *
647 xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
648                   unsigned short family)
649 {
650         struct xfrm_state *x;
651         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
652         if (!afinfo)
653                 return NULL;
654
655         spin_lock_bh(&xfrm_state_lock);
656         x = afinfo->state_lookup(daddr, spi, proto);
657         spin_unlock_bh(&xfrm_state_lock);
658         xfrm_state_put_afinfo(afinfo);
659         return x;
660 }
661 EXPORT_SYMBOL(xfrm_state_lookup);
662
663 struct xfrm_state *
664 xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 
665               xfrm_address_t *daddr, xfrm_address_t *saddr, 
666               int create, unsigned short family)
667 {
668         struct xfrm_state *x;
669         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
670         if (!afinfo)
671                 return NULL;
672
673         spin_lock_bh(&xfrm_state_lock);
674         x = afinfo->find_acq(mode, reqid, proto, daddr, saddr, create);
675         spin_unlock_bh(&xfrm_state_lock);
676         xfrm_state_put_afinfo(afinfo);
677         return x;
678 }
679 EXPORT_SYMBOL(xfrm_find_acq);
680
681 /* Silly enough, but I'm lazy to build resolution list */
682
683 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
684 {
685         int i;
686         struct xfrm_state *x;
687
688         for (i = 0; i < XFRM_DST_HSIZE; i++) {
689                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
690                         if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
691                                 xfrm_state_hold(x);
692                                 return x;
693                         }
694                 }
695         }
696         return NULL;
697 }
698
699 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
700 {
701         struct xfrm_state *x;
702
703         spin_lock_bh(&xfrm_state_lock);
704         x = __xfrm_find_acq_byseq(seq);
705         spin_unlock_bh(&xfrm_state_lock);
706         return x;
707 }
708 EXPORT_SYMBOL(xfrm_find_acq_byseq);
709
710 u32 xfrm_get_acqseq(void)
711 {
712         u32 res;
713         static u32 acqseq;
714         static DEFINE_SPINLOCK(acqseq_lock);
715
716         spin_lock_bh(&acqseq_lock);
717         res = (++acqseq ? : ++acqseq);
718         spin_unlock_bh(&acqseq_lock);
719         return res;
720 }
721 EXPORT_SYMBOL(xfrm_get_acqseq);
722
723 void
724 xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
725 {
726         u32 h;
727         struct xfrm_state *x0;
728
729         if (x->id.spi)
730                 return;
731
732         if (minspi == maxspi) {
733                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
734                 if (x0) {
735                         xfrm_state_put(x0);
736                         return;
737                 }
738                 x->id.spi = minspi;
739         } else {
740                 u32 spi = 0;
741                 minspi = ntohl(minspi);
742                 maxspi = ntohl(maxspi);
743                 for (h=0; h<maxspi-minspi+1; h++) {
744                         spi = minspi + net_random()%(maxspi-minspi+1);
745                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
746                         if (x0 == NULL) {
747                                 x->id.spi = htonl(spi);
748                                 break;
749                         }
750                         xfrm_state_put(x0);
751                 }
752         }
753         if (x->id.spi) {
754                 spin_lock_bh(&xfrm_state_lock);
755                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
756                 list_add(&x->byspi, xfrm_state_byspi+h);
757                 xfrm_state_hold(x);
758                 spin_unlock_bh(&xfrm_state_lock);
759                 wake_up(&km_waitq);
760         }
761 }
762 EXPORT_SYMBOL(xfrm_alloc_spi);
763
764 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
765                     void *data)
766 {
767         int i;
768         struct xfrm_state *x;
769         int count = 0;
770         int err = 0;
771
772         spin_lock_bh(&xfrm_state_lock);
773         for (i = 0; i < XFRM_DST_HSIZE; i++) {
774                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
775                         if (proto == IPSEC_PROTO_ANY || x->id.proto == proto)
776                                 count++;
777                 }
778         }
779         if (count == 0) {
780                 err = -ENOENT;
781                 goto out;
782         }
783
784         for (i = 0; i < XFRM_DST_HSIZE; i++) {
785                 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
786                         if (proto != IPSEC_PROTO_ANY && x->id.proto != proto)
787                                 continue;
788                         err = func(x, --count, data);
789                         if (err)
790                                 goto out;
791                 }
792         }
793 out:
794         spin_unlock_bh(&xfrm_state_lock);
795         return err;
796 }
797 EXPORT_SYMBOL(xfrm_state_walk);
798
799
800 void xfrm_replay_notify(struct xfrm_state *x, int event)
801 {
802         struct km_event c;
803         /* we send notify messages in case
804          *  1. we updated on of the sequence numbers, and the seqno difference
805          *     is at least x->replay_maxdiff, in this case we also update the
806          *     timeout of our timer function
807          *  2. if x->replay_maxage has elapsed since last update,
808          *     and there were changes
809          *
810          *  The state structure must be locked!
811          */
812
813         switch (event) {
814         case XFRM_REPLAY_UPDATE:
815                 if (x->replay_maxdiff &&
816                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
817                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
818                         if (x->xflags & XFRM_TIME_DEFER)
819                                 event = XFRM_REPLAY_TIMEOUT;
820                         else
821                                 return;
822                 }
823
824                 break;
825
826         case XFRM_REPLAY_TIMEOUT:
827                 if ((x->replay.seq == x->preplay.seq) &&
828                     (x->replay.bitmap == x->preplay.bitmap) &&
829                     (x->replay.oseq == x->preplay.oseq)) {
830                         x->xflags |= XFRM_TIME_DEFER;
831                         return;
832                 }
833
834                 break;
835         }
836
837         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
838         c.event = XFRM_MSG_NEWAE;
839         c.data.aevent = event;
840         km_state_notify(x, &c);
841
842         if (x->replay_maxage &&
843             !mod_timer(&x->rtimer, jiffies + x->replay_maxage)) {
844                 xfrm_state_hold(x);
845                 x->xflags &= ~XFRM_TIME_DEFER;
846         }
847 }
848 EXPORT_SYMBOL(xfrm_replay_notify);
849
850 static void xfrm_replay_timer_handler(unsigned long data)
851 {
852         struct xfrm_state *x = (struct xfrm_state*)data;
853
854         spin_lock(&x->lock);
855
856         if (x->km.state == XFRM_STATE_VALID) {
857                 if (xfrm_aevent_is_on())
858                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
859                 else
860                         x->xflags |= XFRM_TIME_DEFER;
861         }
862
863         spin_unlock(&x->lock);
864         xfrm_state_put(x);
865 }
866
867 int xfrm_replay_check(struct xfrm_state *x, u32 seq)
868 {
869         u32 diff;
870
871         seq = ntohl(seq);
872
873         if (unlikely(seq == 0))
874                 return -EINVAL;
875
876         if (likely(seq > x->replay.seq))
877                 return 0;
878
879         diff = x->replay.seq - seq;
880         if (diff >= x->props.replay_window) {
881                 x->stats.replay_window++;
882                 return -EINVAL;
883         }
884
885         if (x->replay.bitmap & (1U << diff)) {
886                 x->stats.replay++;
887                 return -EINVAL;
888         }
889         return 0;
890 }
891 EXPORT_SYMBOL(xfrm_replay_check);
892
893 void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
894 {
895         u32 diff;
896
897         seq = ntohl(seq);
898
899         if (seq > x->replay.seq) {
900                 diff = seq - x->replay.seq;
901                 if (diff < x->props.replay_window)
902                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
903                 else
904                         x->replay.bitmap = 1;
905                 x->replay.seq = seq;
906         } else {
907                 diff = x->replay.seq - seq;
908                 x->replay.bitmap |= (1U << diff);
909         }
910
911         if (xfrm_aevent_is_on())
912                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
913 }
914 EXPORT_SYMBOL(xfrm_replay_advance);
915
916 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
917 static DEFINE_RWLOCK(xfrm_km_lock);
918
919 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
920 {
921         struct xfrm_mgr *km;
922
923         read_lock(&xfrm_km_lock);
924         list_for_each_entry(km, &xfrm_km_list, list)
925                 if (km->notify_policy)
926                         km->notify_policy(xp, dir, c);
927         read_unlock(&xfrm_km_lock);
928 }
929
930 void km_state_notify(struct xfrm_state *x, struct km_event *c)
931 {
932         struct xfrm_mgr *km;
933         read_lock(&xfrm_km_lock);
934         list_for_each_entry(km, &xfrm_km_list, list)
935                 if (km->notify)
936                         km->notify(x, c);
937         read_unlock(&xfrm_km_lock);
938 }
939
940 EXPORT_SYMBOL(km_policy_notify);
941 EXPORT_SYMBOL(km_state_notify);
942
943 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
944 {
945         struct km_event c;
946
947         c.data.hard = hard;
948         c.pid = pid;
949         c.event = XFRM_MSG_EXPIRE;
950         km_state_notify(x, &c);
951
952         if (hard)
953                 wake_up(&km_waitq);
954 }
955
956 EXPORT_SYMBOL(km_state_expired);
957 /*
958  * We send to all registered managers regardless of failure
959  * We are happy with one success
960 */
961 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
962 {
963         int err = -EINVAL, acqret;
964         struct xfrm_mgr *km;
965
966         read_lock(&xfrm_km_lock);
967         list_for_each_entry(km, &xfrm_km_list, list) {
968                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
969                 if (!acqret)
970                         err = acqret;
971         }
972         read_unlock(&xfrm_km_lock);
973         return err;
974 }
975 EXPORT_SYMBOL(km_query);
976
977 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport)
978 {
979         int err = -EINVAL;
980         struct xfrm_mgr *km;
981
982         read_lock(&xfrm_km_lock);
983         list_for_each_entry(km, &xfrm_km_list, list) {
984                 if (km->new_mapping)
985                         err = km->new_mapping(x, ipaddr, sport);
986                 if (!err)
987                         break;
988         }
989         read_unlock(&xfrm_km_lock);
990         return err;
991 }
992 EXPORT_SYMBOL(km_new_mapping);
993
994 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
995 {
996         struct km_event c;
997
998         c.data.hard = hard;
999         c.pid = pid;
1000         c.event = XFRM_MSG_POLEXPIRE;
1001         km_policy_notify(pol, dir, &c);
1002
1003         if (hard)
1004                 wake_up(&km_waitq);
1005 }
1006 EXPORT_SYMBOL(km_policy_expired);
1007
1008 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1009 {
1010         int err;
1011         u8 *data;
1012         struct xfrm_mgr *km;
1013         struct xfrm_policy *pol = NULL;
1014
1015         if (optlen <= 0 || optlen > PAGE_SIZE)
1016                 return -EMSGSIZE;
1017
1018         data = kmalloc(optlen, GFP_KERNEL);
1019         if (!data)
1020                 return -ENOMEM;
1021
1022         err = -EFAULT;
1023         if (copy_from_user(data, optval, optlen))
1024                 goto out;
1025
1026         err = -EINVAL;
1027         read_lock(&xfrm_km_lock);
1028         list_for_each_entry(km, &xfrm_km_list, list) {
1029                 pol = km->compile_policy(sk->sk_family, optname, data,
1030                                          optlen, &err);
1031                 if (err >= 0)
1032                         break;
1033         }
1034         read_unlock(&xfrm_km_lock);
1035
1036         if (err >= 0) {
1037                 xfrm_sk_policy_insert(sk, err, pol);
1038                 xfrm_pol_put(pol);
1039                 err = 0;
1040         }
1041
1042 out:
1043         kfree(data);
1044         return err;
1045 }
1046 EXPORT_SYMBOL(xfrm_user_policy);
1047
1048 int xfrm_register_km(struct xfrm_mgr *km)
1049 {
1050         write_lock_bh(&xfrm_km_lock);
1051         list_add_tail(&km->list, &xfrm_km_list);
1052         write_unlock_bh(&xfrm_km_lock);
1053         return 0;
1054 }
1055 EXPORT_SYMBOL(xfrm_register_km);
1056
1057 int xfrm_unregister_km(struct xfrm_mgr *km)
1058 {
1059         write_lock_bh(&xfrm_km_lock);
1060         list_del(&km->list);
1061         write_unlock_bh(&xfrm_km_lock);
1062         return 0;
1063 }
1064 EXPORT_SYMBOL(xfrm_unregister_km);
1065
1066 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1067 {
1068         int err = 0;
1069         if (unlikely(afinfo == NULL))
1070                 return -EINVAL;
1071         if (unlikely(afinfo->family >= NPROTO))
1072                 return -EAFNOSUPPORT;
1073         write_lock_bh(&xfrm_state_afinfo_lock);
1074         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1075                 err = -ENOBUFS;
1076         else {
1077                 afinfo->state_bydst = xfrm_state_bydst;
1078                 afinfo->state_byspi = xfrm_state_byspi;
1079                 xfrm_state_afinfo[afinfo->family] = afinfo;
1080         }
1081         write_unlock_bh(&xfrm_state_afinfo_lock);
1082         return err;
1083 }
1084 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1085
1086 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1087 {
1088         int err = 0;
1089         if (unlikely(afinfo == NULL))
1090                 return -EINVAL;
1091         if (unlikely(afinfo->family >= NPROTO))
1092                 return -EAFNOSUPPORT;
1093         write_lock_bh(&xfrm_state_afinfo_lock);
1094         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1095                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1096                         err = -EINVAL;
1097                 else {
1098                         xfrm_state_afinfo[afinfo->family] = NULL;
1099                         afinfo->state_byspi = NULL;
1100                         afinfo->state_bydst = NULL;
1101                 }
1102         }
1103         write_unlock_bh(&xfrm_state_afinfo_lock);
1104         return err;
1105 }
1106 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1107
1108 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
1109 {
1110         struct xfrm_state_afinfo *afinfo;
1111         if (unlikely(family >= NPROTO))
1112                 return NULL;
1113         read_lock(&xfrm_state_afinfo_lock);
1114         afinfo = xfrm_state_afinfo[family];
1115         if (unlikely(!afinfo))
1116                 read_unlock(&xfrm_state_afinfo_lock);
1117         return afinfo;
1118 }
1119
1120 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1121 {
1122         read_unlock(&xfrm_state_afinfo_lock);
1123 }
1124
1125 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1126 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1127 {
1128         if (x->tunnel) {
1129                 struct xfrm_state *t = x->tunnel;
1130
1131                 if (atomic_read(&t->tunnel_users) == 2)
1132                         xfrm_state_delete(t);
1133                 atomic_dec(&t->tunnel_users);
1134                 xfrm_state_put(t);
1135                 x->tunnel = NULL;
1136         }
1137 }
1138 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1139
1140 /*
1141  * This function is NOT optimal.  For example, with ESP it will give an
1142  * MTU that's usually two bytes short of being optimal.  However, it will
1143  * usually give an answer that's a multiple of 4 provided the input is
1144  * also a multiple of 4.
1145  */
1146 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1147 {
1148         int res = mtu;
1149
1150         res -= x->props.header_len;
1151
1152         for (;;) {
1153                 int m = res;
1154
1155                 if (m < 68)
1156                         return 68;
1157
1158                 spin_lock_bh(&x->lock);
1159                 if (x->km.state == XFRM_STATE_VALID &&
1160                     x->type && x->type->get_max_size)
1161                         m = x->type->get_max_size(x, m);
1162                 else
1163                         m += x->props.header_len;
1164                 spin_unlock_bh(&x->lock);
1165
1166                 if (m <= mtu)
1167                         break;
1168                 res -= (m - mtu);
1169         }
1170
1171         return res;
1172 }
1173
1174 int xfrm_init_state(struct xfrm_state *x)
1175 {
1176         struct xfrm_state_afinfo *afinfo;
1177         int family = x->props.family;
1178         int err;
1179
1180         err = -EAFNOSUPPORT;
1181         afinfo = xfrm_state_get_afinfo(family);
1182         if (!afinfo)
1183                 goto error;
1184
1185         err = 0;
1186         if (afinfo->init_flags)
1187                 err = afinfo->init_flags(x);
1188
1189         xfrm_state_put_afinfo(afinfo);
1190
1191         if (err)
1192                 goto error;
1193
1194         err = -EPROTONOSUPPORT;
1195         x->type = xfrm_get_type(x->id.proto, family);
1196         if (x->type == NULL)
1197                 goto error;
1198
1199         err = x->type->init_state(x);
1200         if (err)
1201                 goto error;
1202
1203         x->mode = xfrm_get_mode(x->props.mode, family);
1204         if (x->mode == NULL)
1205                 goto error;
1206
1207         x->km.state = XFRM_STATE_VALID;
1208
1209 error:
1210         return err;
1211 }
1212
1213 EXPORT_SYMBOL(xfrm_init_state);
1214  
1215 void __init xfrm_state_init(void)
1216 {
1217         int i;
1218
1219         for (i=0; i<XFRM_DST_HSIZE; i++) {
1220                 INIT_LIST_HEAD(&xfrm_state_bydst[i]);
1221                 INIT_LIST_HEAD(&xfrm_state_byspi[i]);
1222         }
1223         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task, NULL);
1224 }
1225