net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <linux/cache.h>
  22 #include <linux/audit.h>
  23 #include <asm/uaccess.h>
  24
  25 #include "xfrm_hash.h"
  26
  27 struct sock *xfrm_nl;
  28 EXPORT_SYMBOL(xfrm_nl);
  29
  30 u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
  31 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
  32
  33 u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
  34 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
  35
  36 u32 sysctl_xfrm_acq_expires __read_mostly = 30;
  37
  38 /* Each xfrm_state may be linked to two tables:
  39
  40    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  41    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
  42       destination/tunnel endpoint. (output)
  43  */
  44
  45 static DEFINE_SPINLOCK(xfrm_state_lock);
  46
  47 /* Hash table to find appropriate SA towards given target (endpoint
  48  * of tunnel or destination of transport mode) allowed by selector.
  49  *
  50  * Main use is finding SA after policy selected tunnel or transport mode.
  51  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  52  */
  53 static LIST_HEAD(xfrm_state_all);
  54 static struct hlist_head *xfrm_state_bydst __read_mostly;
  55 static struct hlist_head *xfrm_state_bysrc __read_mostly;
  56 static struct hlist_head *xfrm_state_byspi __read_mostly;
  57 static unsigned int xfrm_state_hmask __read_mostly;
  58 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
  59 static unsigned int xfrm_state_num;
  60 static unsigned int xfrm_state_genid;
  61
  62 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
  63 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  64
  65 #ifdef CONFIG_AUDITSYSCALL
  66 static void xfrm_audit_state_replay(struct xfrm_state *x,
  67                                     struct sk_buff *skb, __be32 net_seq);
  68 #else
  69 #define xfrm_audit_state_replay(x, s, sq)       do { ; } while (0)
  70 #endif /* CONFIG_AUDITSYSCALL */
  71
  72 static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
  73                                          xfrm_address_t *saddr,
  74                                          u32 reqid,
  75                                          unsigned short family)
  76 {
  77         return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
  78 }
  79
  80 static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
  81                                          xfrm_address_t *saddr,
  82                                          unsigned short family)
  83 {
  84         return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
  85 }
  86
  87 static inline unsigned int
  88 xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
  89 {
  90         return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
  91 }
  92
  93 static void xfrm_hash_transfer(struct hlist_head *list,
  94                                struct hlist_head *ndsttable,
  95                                struct hlist_head *nsrctable,
  96                                struct hlist_head *nspitable,
  97                                unsigned int nhashmask)
  98 {
  99         struct hlist_node *entry, *tmp;
 100         struct xfrm_state *x;
 101
 102         hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
 103                 unsigned int h;
 104
 105                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 106                                     x->props.reqid, x->props.family,
 107                                     nhashmask);
 108                 hlist_add_head(&x->bydst, ndsttable+h);
 109
 110                 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
 111                                     x->props.family,
 112                                     nhashmask);
 113                 hlist_add_head(&x->bysrc, nsrctable+h);
 114
 115                 if (x->id.spi) {
 116                         h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
 117                                             x->id.proto, x->props.family,
 118                                             nhashmask);
 119                         hlist_add_head(&x->byspi, nspitable+h);
 120                 }
 121         }
 122 }
 123
 124 static unsigned long xfrm_hash_new_size(void)
 125 {
 126         return ((xfrm_state_hmask + 1) << 1) *
 127                 sizeof(struct hlist_head);
 128 }
 129
 130 static DEFINE_MUTEX(hash_resize_mutex);
 131
 132 static void xfrm_hash_resize(struct work_struct *__unused)
 133 {
 134         struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
 135         unsigned long nsize, osize;
 136         unsigned int nhashmask, ohashmask;
 137         int i;
 138
 139         mutex_lock(&hash_resize_mutex);
 140
 141         nsize = xfrm_hash_new_size();
 142         ndst = xfrm_hash_alloc(nsize);
 143         if (!ndst)
 144                 goto out_unlock;
 145         nsrc = xfrm_hash_alloc(nsize);
 146         if (!nsrc) {
 147                 xfrm_hash_free(ndst, nsize);
 148                 goto out_unlock;
 149         }
 150         nspi = xfrm_hash_alloc(nsize);
 151         if (!nspi) {
 152                 xfrm_hash_free(ndst, nsize);
 153                 xfrm_hash_free(nsrc, nsize);
 154                 goto out_unlock;
 155         }
 156
 157         spin_lock_bh(&xfrm_state_lock);
 158
 159         nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
 160         for (i = xfrm_state_hmask; i >= 0; i--)
 161                 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
 162                                    nhashmask);
 163
 164         odst = xfrm_state_bydst;
 165         osrc = xfrm_state_bysrc;
 166         ospi = xfrm_state_byspi;
 167         ohashmask = xfrm_state_hmask;
 168
 169         xfrm_state_bydst = ndst;
 170         xfrm_state_bysrc = nsrc;
 171         xfrm_state_byspi = nspi;
 172         xfrm_state_hmask = nhashmask;
 173
 174         spin_unlock_bh(&xfrm_state_lock);
 175
 176         osize = (ohashmask + 1) * sizeof(struct hlist_head);
 177         xfrm_hash_free(odst, osize);
 178         xfrm_hash_free(osrc, osize);
 179         xfrm_hash_free(ospi, osize);
 180
 181 out_unlock:
 182         mutex_unlock(&hash_resize_mutex);
 183 }
 184
 185 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
 186
 187 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
 188 EXPORT_SYMBOL(km_waitq);
 189
 190 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 191 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 192
 193 static struct work_struct xfrm_state_gc_work;
 194 static HLIST_HEAD(xfrm_state_gc_list);
 195 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 196
 197 int __xfrm_state_delete(struct xfrm_state *x);
 198
 199 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 200 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 201
 202 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
 203 {
 204         struct xfrm_state_afinfo *afinfo;
 205         if (unlikely(family >= NPROTO))
 206                 return NULL;
 207         write_lock_bh(&xfrm_state_afinfo_lock);
 208         afinfo = xfrm_state_afinfo[family];
 209         if (unlikely(!afinfo))
 210                 write_unlock_bh(&xfrm_state_afinfo_lock);
 211         return afinfo;
 212 }
 213
 214 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
 215         __releases(xfrm_state_afinfo_lock)
 216 {
 217         write_unlock_bh(&xfrm_state_afinfo_lock);
 218 }
 219
 220 int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
 221 {
 222         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 223         const struct xfrm_type **typemap;
 224         int err = 0;
 225
 226         if (unlikely(afinfo == NULL))
 227                 return -EAFNOSUPPORT;
 228         typemap = afinfo->type_map;
 229
 230         if (likely(typemap[type->proto] == NULL))
 231                 typemap[type->proto] = type;
 232         else
 233                 err = -EEXIST;
 234         xfrm_state_unlock_afinfo(afinfo);
 235         return err;
 236 }
 237 EXPORT_SYMBOL(xfrm_register_type);
 238
 239 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
 240 {
 241         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 242         const struct xfrm_type **typemap;
 243         int err = 0;
 244
 245         if (unlikely(afinfo == NULL))
 246                 return -EAFNOSUPPORT;
 247         typemap = afinfo->type_map;
 248
 249         if (unlikely(typemap[type->proto] != type))
 250                 err = -ENOENT;
 251         else
 252                 typemap[type->proto] = NULL;
 253         xfrm_state_unlock_afinfo(afinfo);
 254         return err;
 255 }
 256 EXPORT_SYMBOL(xfrm_unregister_type);
 257
 258 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
 259 {
 260         struct xfrm_state_afinfo *afinfo;
 261         const struct xfrm_type **typemap;
 262         const struct xfrm_type *type;
 263         int modload_attempted = 0;
 264
 265 retry:
 266         afinfo = xfrm_state_get_afinfo(family);
 267         if (unlikely(afinfo == NULL))
 268                 return NULL;
 269         typemap = afinfo->type_map;
 270
 271         type = typemap[proto];
 272         if (unlikely(type && !try_module_get(type->owner)))
 273                 type = NULL;
 274         if (!type && !modload_attempted) {
 275                 xfrm_state_put_afinfo(afinfo);
 276                 request_module("xfrm-type-%d-%d", family, proto);
 277                 modload_attempted = 1;
 278                 goto retry;
 279         }
 280
 281         xfrm_state_put_afinfo(afinfo);
 282         return type;
 283 }
 284
 285 static void xfrm_put_type(const struct xfrm_type *type)
 286 {
 287         module_put(type->owner);
 288 }
 289
 290 int xfrm_register_mode(struct xfrm_mode *mode, int family)
 291 {
 292         struct xfrm_state_afinfo *afinfo;
 293         struct xfrm_mode **modemap;
 294         int err;
 295
 296         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 297                 return -EINVAL;
 298
 299         afinfo = xfrm_state_lock_afinfo(family);
 300         if (unlikely(afinfo == NULL))
 301                 return -EAFNOSUPPORT;
 302
 303         err = -EEXIST;
 304         modemap = afinfo->mode_map;
 305         if (modemap[mode->encap])
 306                 goto out;
 307
 308         err = -ENOENT;
 309         if (!try_module_get(afinfo->owner))
 310                 goto out;
 311
 312         mode->afinfo = afinfo;
 313         modemap[mode->encap] = mode;
 314         err = 0;
 315
 316 out:
 317         xfrm_state_unlock_afinfo(afinfo);
 318         return err;
 319 }
 320 EXPORT_SYMBOL(xfrm_register_mode);
 321
 322 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
 323 {
 324         struct xfrm_state_afinfo *afinfo;
 325         struct xfrm_mode **modemap;
 326         int err;
 327
 328         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 329                 return -EINVAL;
 330
 331         afinfo = xfrm_state_lock_afinfo(family);
 332         if (unlikely(afinfo == NULL))
 333                 return -EAFNOSUPPORT;
 334
 335         err = -ENOENT;
 336         modemap = afinfo->mode_map;
 337         if (likely(modemap[mode->encap] == mode)) {
 338                 modemap[mode->encap] = NULL;
 339                 module_put(mode->afinfo->owner);
 340                 err = 0;
 341         }
 342
 343         xfrm_state_unlock_afinfo(afinfo);
 344         return err;
 345 }
 346 EXPORT_SYMBOL(xfrm_unregister_mode);
 347
 348 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
 349 {
 350         struct xfrm_state_afinfo *afinfo;
 351         struct xfrm_mode *mode;
 352         int modload_attempted = 0;
 353
 354         if (unlikely(encap >= XFRM_MODE_MAX))
 355                 return NULL;
 356
 357 retry:
 358         afinfo = xfrm_state_get_afinfo(family);
 359         if (unlikely(afinfo == NULL))
 360                 return NULL;
 361
 362         mode = afinfo->mode_map[encap];
 363         if (unlikely(mode && !try_module_get(mode->owner)))
 364                 mode = NULL;
 365         if (!mode && !modload_attempted) {
 366                 xfrm_state_put_afinfo(afinfo);
 367                 request_module("xfrm-mode-%d-%d", family, encap);
 368                 modload_attempted = 1;
 369                 goto retry;
 370         }
 371
 372         xfrm_state_put_afinfo(afinfo);
 373         return mode;
 374 }
 375
 376 static void xfrm_put_mode(struct xfrm_mode *mode)
 377 {
 378         module_put(mode->owner);
 379 }
 380
 381 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 382 {
 383         del_timer_sync(&x->timer);
 384         del_timer_sync(&x->rtimer);
 385         kfree(x->aalg);
 386         kfree(x->ealg);
 387         kfree(x->calg);
 388         kfree(x->encap);
 389         kfree(x->coaddr);
 390         if (x->inner_mode)
 391                 xfrm_put_mode(x->inner_mode);
 392         if (x->inner_mode_iaf)
 393                 xfrm_put_mode(x->inner_mode_iaf);
 394         if (x->outer_mode)
 395                 xfrm_put_mode(x->outer_mode);
 396         if (x->type) {
 397                 x->type->destructor(x);
 398                 xfrm_put_type(x->type);
 399         }
 400         security_xfrm_state_free(x);
 401         kfree(x);
 402 }
 403
 404 static void xfrm_state_gc_task(struct work_struct *data)
 405 {
 406         struct xfrm_state *x;
 407         struct hlist_node *entry, *tmp;
 408         struct hlist_head gc_list;
 409
 410         spin_lock_bh(&xfrm_state_gc_lock);
 411         gc_list.first = xfrm_state_gc_list.first;
 412         INIT_HLIST_HEAD(&xfrm_state_gc_list);
 413         spin_unlock_bh(&xfrm_state_gc_lock);
 414
 415         hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
 416                 xfrm_state_gc_destroy(x);
 417
 418         wake_up(&km_waitq);
 419 }
 420
 421 static inline unsigned long make_jiffies(long secs)
 422 {
 423         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 424                 return MAX_SCHEDULE_TIMEOUT-1;
 425         else
 426                 return secs*HZ;
 427 }
 428
 429 static void xfrm_timer_handler(unsigned long data)
 430 {
 431         struct xfrm_state *x = (struct xfrm_state*)data;
 432         unsigned long now = get_seconds();
 433         long next = LONG_MAX;
 434         int warn = 0;
 435         int err = 0;
 436
 437         spin_lock(&x->lock);
 438         if (x->km.state == XFRM_STATE_DEAD)
 439                 goto out;
 440         if (x->km.state == XFRM_STATE_EXPIRED)
 441                 goto expired;
 442         if (x->lft.hard_add_expires_seconds) {
 443                 long tmo = x->lft.hard_add_expires_seconds +
 444                         x->curlft.add_time - now;
 445                 if (tmo <= 0)
 446                         goto expired;
 447                 if (tmo < next)
 448                         next = tmo;
 449         }
 450         if (x->lft.hard_use_expires_seconds) {
 451                 long tmo = x->lft.hard_use_expires_seconds +
 452                         (x->curlft.use_time ? : now) - now;
 453                 if (tmo <= 0)
 454                         goto expired;
 455                 if (tmo < next)
 456                         next = tmo;
 457         }
 458         if (x->km.dying)
 459                 goto resched;
 460         if (x->lft.soft_add_expires_seconds) {
 461                 long tmo = x->lft.soft_add_expires_seconds +
 462                         x->curlft.add_time - now;
 463                 if (tmo <= 0)
 464                         warn = 1;
 465                 else if (tmo < next)
 466                         next = tmo;
 467         }
 468         if (x->lft.soft_use_expires_seconds) {
 469                 long tmo = x->lft.soft_use_expires_seconds +
 470                         (x->curlft.use_time ? : now) - now;
 471                 if (tmo <= 0)
 472                         warn = 1;
 473                 else if (tmo < next)
 474                         next = tmo;
 475         }
 476
 477         x->km.dying = warn;
 478         if (warn)
 479                 km_state_expired(x, 0, 0);
 480 resched:
 481         if (next != LONG_MAX)
 482                 mod_timer(&x->timer, jiffies + make_jiffies(next));
 483
 484         goto out;
 485
 486 expired:
 487         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 488                 x->km.state = XFRM_STATE_EXPIRED;
 489                 wake_up(&km_waitq);
 490                 next = 2;
 491                 goto resched;
 492         }
 493
 494         err = __xfrm_state_delete(x);
 495         if (!err && x->id.spi)
 496                 km_state_expired(x, 1, 0);
 497
 498         xfrm_audit_state_delete(x, err ? 0 : 1,
 499                                 audit_get_loginuid(current), 0);
 500
 501 out:
 502         spin_unlock(&x->lock);
 503 }
 504
 505 static void xfrm_replay_timer_handler(unsigned long data);
 506
 507 struct xfrm_state *xfrm_state_alloc(void)
 508 {
 509         struct xfrm_state *x;
 510
 511         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 512
 513         if (x) {
 514                 atomic_set(&x->refcnt, 1);
 515                 atomic_set(&x->tunnel_users, 0);
 516                 INIT_LIST_HEAD(&x->all);
 517                 INIT_HLIST_NODE(&x->bydst);
 518                 INIT_HLIST_NODE(&x->bysrc);
 519                 INIT_HLIST_NODE(&x->byspi);
 520                 setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
 521                 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
 522                                 (unsigned long)x);
 523                 x->curlft.add_time = get_seconds();
 524                 x->lft.soft_byte_limit = XFRM_INF;
 525                 x->lft.soft_packet_limit = XFRM_INF;
 526                 x->lft.hard_byte_limit = XFRM_INF;
 527                 x->lft.hard_packet_limit = XFRM_INF;
 528                 x->replay_maxage = 0;
 529                 x->replay_maxdiff = 0;
 530                 x->inner_mode = NULL;
 531                 x->inner_mode_iaf = NULL;
 532                 spin_lock_init(&x->lock);
 533         }
 534         return x;
 535 }
 536 EXPORT_SYMBOL(xfrm_state_alloc);
 537
 538 void __xfrm_state_destroy(struct xfrm_state *x)
 539 {
 540         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 541
 542         spin_lock_bh(&xfrm_state_lock);
 543         list_del(&x->all);
 544         spin_unlock_bh(&xfrm_state_lock);
 545
 546         spin_lock_bh(&xfrm_state_gc_lock);
 547         hlist_add_head(&x->bydst, &xfrm_state_gc_list);
 548         spin_unlock_bh(&xfrm_state_gc_lock);
 549         schedule_work(&xfrm_state_gc_work);
 550 }
 551 EXPORT_SYMBOL(__xfrm_state_destroy);
 552
 553 int __xfrm_state_delete(struct xfrm_state *x)
 554 {
 555         int err = -ESRCH;
 556
 557         if (x->km.state != XFRM_STATE_DEAD) {
 558                 x->km.state = XFRM_STATE_DEAD;
 559                 spin_lock(&xfrm_state_lock);
 560                 hlist_del(&x->bydst);
 561                 hlist_del(&x->bysrc);
 562                 if (x->id.spi)
 563                         hlist_del(&x->byspi);
 564                 xfrm_state_num--;
 565                 spin_unlock(&xfrm_state_lock);
 566
 567                 /* All xfrm_state objects are created by xfrm_state_alloc.
 568                  * The xfrm_state_alloc call gives a reference, and that
 569                  * is what we are dropping here.
 570                  */
 571                 xfrm_state_put(x);
 572                 err = 0;
 573         }
 574
 575         return err;
 576 }
 577 EXPORT_SYMBOL(__xfrm_state_delete);
 578
 579 int xfrm_state_delete(struct xfrm_state *x)
 580 {
 581         int err;
 582
 583         spin_lock_bh(&x->lock);
 584         err = __xfrm_state_delete(x);
 585         spin_unlock_bh(&x->lock);
 586
 587         return err;
 588 }
 589 EXPORT_SYMBOL(xfrm_state_delete);
 590
 591 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 592 static inline int
 593 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 594 {
 595         int i, err = 0;
 596
 597         for (i = 0; i <= xfrm_state_hmask; i++) {
 598                 struct hlist_node *entry;
 599                 struct xfrm_state *x;
 600
 601                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 602                         if (xfrm_id_proto_match(x->id.proto, proto) &&
 603                            (err = security_xfrm_state_delete(x)) != 0) {
 604                                 xfrm_audit_state_delete(x, 0,
 605                                                         audit_info->loginuid,
 606                                                         audit_info->secid);
 607                                 return err;
 608                         }
 609                 }
 610         }
 611
 612         return err;
 613 }
 614 #else
 615 static inline int
 616 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 617 {
 618         return 0;
 619 }
 620 #endif
 621
 622 int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
 623 {
 624         int i, err = 0;
 625
 626         spin_lock_bh(&xfrm_state_lock);
 627         err = xfrm_state_flush_secctx_check(proto, audit_info);
 628         if (err)
 629                 goto out;
 630
 631         for (i = 0; i <= xfrm_state_hmask; i++) {
 632                 struct hlist_node *entry;
 633                 struct xfrm_state *x;
 634 restart:
 635                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 636                         if (!xfrm_state_kern(x) &&
 637                             xfrm_id_proto_match(x->id.proto, proto)) {
 638                                 xfrm_state_hold(x);
 639                                 spin_unlock_bh(&xfrm_state_lock);
 640
 641                                 err = xfrm_state_delete(x);
 642                                 xfrm_audit_state_delete(x, err ? 0 : 1,
 643                                                         audit_info->loginuid,
 644                                                         audit_info->secid);
 645                                 xfrm_state_put(x);
 646
 647                                 spin_lock_bh(&xfrm_state_lock);
 648                                 goto restart;
 649                         }
 650                 }
 651         }
 652         err = 0;
 653
 654 out:
 655         spin_unlock_bh(&xfrm_state_lock);
 656         wake_up(&km_waitq);
 657         return err;
 658 }
 659 EXPORT_SYMBOL(xfrm_state_flush);
 660
 661 void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
 662 {
 663         spin_lock_bh(&xfrm_state_lock);
 664         si->sadcnt = xfrm_state_num;
 665         si->sadhcnt = xfrm_state_hmask;
 666         si->sadhmcnt = xfrm_state_hashmax;
 667         spin_unlock_bh(&xfrm_state_lock);
 668 }
 669 EXPORT_SYMBOL(xfrm_sad_getinfo);
 670
 671 static int
 672 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 673                   struct xfrm_tmpl *tmpl,
 674                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 675                   unsigned short family)
 676 {
 677         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 678         if (!afinfo)
 679                 return -1;
 680         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 681         xfrm_state_put_afinfo(afinfo);
 682         return 0;
 683 }
 684
 685 static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 686 {
 687         unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
 688         struct xfrm_state *x;
 689         struct hlist_node *entry;
 690
 691         hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
 692                 if (x->props.family != family ||
 693                     x->id.spi       != spi ||
 694                     x->id.proto     != proto)
 695                         continue;
 696
 697                 switch (family) {
 698                 case AF_INET:
 699                         if (x->id.daddr.a4 != daddr->a4)
 700                                 continue;
 701                         break;
 702                 case AF_INET6:
 703                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 704                                              (struct in6_addr *)
 705                                              x->id.daddr.a6))
 706                                 continue;
 707                         break;
 708                 }
 709
 710                 xfrm_state_hold(x);
 711                 return x;
 712         }
 713
 714         return NULL;
 715 }
 716
 717 static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 718 {
 719         unsigned int h = xfrm_src_hash(daddr, saddr, family);
 720         struct xfrm_state *x;
 721         struct hlist_node *entry;
 722
 723         hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
 724                 if (x->props.family != family ||
 725                     x->id.proto     != proto)
 726                         continue;
 727
 728                 switch (family) {
 729                 case AF_INET:
 730                         if (x->id.daddr.a4 != daddr->a4 ||
 731                             x->props.saddr.a4 != saddr->a4)
 732                                 continue;
 733                         break;
 734                 case AF_INET6:
 735                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 736                                              (struct in6_addr *)
 737                                              x->id.daddr.a6) ||
 738                             !ipv6_addr_equal((struct in6_addr *)saddr,
 739                                              (struct in6_addr *)
 740                                              x->props.saddr.a6))
 741                                 continue;
 742                         break;
 743                 }
 744
 745                 xfrm_state_hold(x);
 746                 return x;
 747         }
 748
 749         return NULL;
 750 }
 751
 752 static inline struct xfrm_state *
 753 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
 754 {
 755         if (use_spi)
 756                 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
 757                                            x->id.proto, family);
 758         else
 759                 return __xfrm_state_lookup_byaddr(&x->id.daddr,
 760                                                   &x->props.saddr,
 761                                                   x->id.proto, family);
 762 }
 763
 764 static void xfrm_hash_grow_check(int have_hash_collision)
 765 {
 766         if (have_hash_collision &&
 767             (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
 768             xfrm_state_num > xfrm_state_hmask)
 769                 schedule_work(&xfrm_hash_work);
 770 }
 771
 772 struct xfrm_state *
 773 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 774                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 775                 struct xfrm_policy *pol, int *err,
 776                 unsigned short family)
 777 {
 778         unsigned int h;
 779         struct hlist_node *entry;
 780         struct xfrm_state *x, *x0;
 781         int acquire_in_progress = 0;
 782         int error = 0;
 783         struct xfrm_state *best = NULL;
 784
 785         spin_lock_bh(&xfrm_state_lock);
 786         h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
 787         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 788                 if (x->props.family == family &&
 789                     x->props.reqid == tmpl->reqid &&
 790                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 791                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 792                     tmpl->mode == x->props.mode &&
 793                     tmpl->id.proto == x->id.proto &&
 794                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 795                         /* Resolution logic:
 796                            1. There is a valid state with matching selector.
 797                               Done.
 798                            2. Valid state with inappropriate selector. Skip.
 799
 800                            Entering area of "sysdeps".
 801
 802                            3. If state is not valid, selector is temporary,
 803                               it selects only session which triggered
 804                               previous resolution. Key manager will do
 805                               something to install a state with proper
 806                               selector.
 807                          */
 808                         if (x->km.state == XFRM_STATE_VALID) {
 809                                 if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
 810                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
 811                                         continue;
 812                                 if (!best ||
 813                                     best->km.dying > x->km.dying ||
 814                                     (best->km.dying == x->km.dying &&
 815                                      best->curlft.add_time < x->curlft.add_time))
 816                                         best = x;
 817                         } else if (x->km.state == XFRM_STATE_ACQ) {
 818                                 acquire_in_progress = 1;
 819                         } else if (x->km.state == XFRM_STATE_ERROR ||
 820                                    x->km.state == XFRM_STATE_EXPIRED) {
 821                                 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
 822                                     security_xfrm_state_pol_flow_match(x, pol, fl))
 823                                         error = -ESRCH;
 824                         }
 825                 }
 826         }
 827
 828         x = best;
 829         if (!x && !error && !acquire_in_progress) {
 830                 if (tmpl->id.spi &&
 831                     (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
 832                                               tmpl->id.proto, family)) != NULL) {
 833                         xfrm_state_put(x0);
 834                         error = -EEXIST;
 835                         goto out;
 836                 }
 837                 x = xfrm_state_alloc();
 838                 if (x == NULL) {
 839                         error = -ENOMEM;
 840                         goto out;
 841                 }
 842                 /* Initialize temporary selector matching only
 843                  * to current session. */
 844                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 845
 846                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
 847                 if (error) {
 848                         x->km.state = XFRM_STATE_DEAD;
 849                         xfrm_state_put(x);
 850                         x = NULL;
 851                         goto out;
 852                 }
 853
 854                 if (km_query(x, tmpl, pol) == 0) {
 855                         x->km.state = XFRM_STATE_ACQ;
 856                         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 857                         h = xfrm_src_hash(daddr, saddr, family);
 858                         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 859                         if (x->id.spi) {
 860                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 861                                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 862                         }
 863                         x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
 864                         x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
 865                         add_timer(&x->timer);
 866                         xfrm_state_num++;
 867                         xfrm_hash_grow_check(x->bydst.next != NULL);
 868                 } else {
 869                         x->km.state = XFRM_STATE_DEAD;
 870                         xfrm_state_put(x);
 871                         x = NULL;
 872                         error = -ESRCH;
 873                 }
 874         }
 875 out:
 876         if (x)
 877                 xfrm_state_hold(x);
 878         else
 879                 *err = acquire_in_progress ? -EAGAIN : error;
 880         spin_unlock_bh(&xfrm_state_lock);
 881         return x;
 882 }
 883
 884 struct xfrm_state *
 885 xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 886                     unsigned short family, u8 mode, u8 proto, u32 reqid)
 887 {
 888         unsigned int h;
 889         struct xfrm_state *rx = NULL, *x = NULL;
 890         struct hlist_node *entry;
 891
 892         spin_lock(&xfrm_state_lock);
 893         h = xfrm_dst_hash(daddr, saddr, reqid, family);
 894         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 895                 if (x->props.family == family &&
 896                     x->props.reqid == reqid &&
 897                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 898                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 899                     mode == x->props.mode &&
 900                     proto == x->id.proto &&
 901                     x->km.state == XFRM_STATE_VALID) {
 902                         rx = x;
 903                         break;
 904                 }
 905         }
 906
 907         if (rx)
 908                 xfrm_state_hold(rx);
 909         spin_unlock(&xfrm_state_lock);
 910
 911
 912         return rx;
 913 }
 914 EXPORT_SYMBOL(xfrm_stateonly_find);
 915
 916 static void __xfrm_state_insert(struct xfrm_state *x)
 917 {
 918         unsigned int h;
 919
 920         x->genid = ++xfrm_state_genid;
 921
 922         list_add_tail(&x->all, &xfrm_state_all);
 923
 924         h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 925                           x->props.reqid, x->props.family);
 926         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 927
 928         h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
 929         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 930
 931         if (x->id.spi) {
 932                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
 933                                   x->props.family);
 934
 935                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 936         }
 937
 938         mod_timer(&x->timer, jiffies + HZ);
 939         if (x->replay_maxage)
 940                 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
 941
 942         wake_up(&km_waitq);
 943
 944         xfrm_state_num++;
 945
 946         xfrm_hash_grow_check(x->bydst.next != NULL);
 947 }
 948
 949 /* xfrm_state_lock is held */
 950 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 951 {
 952         unsigned short family = xnew->props.family;
 953         u32 reqid = xnew->props.reqid;
 954         struct xfrm_state *x;
 955         struct hlist_node *entry;
 956         unsigned int h;
 957
 958         h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
 959         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 960                 if (x->props.family     == family &&
 961                     x->props.reqid      == reqid &&
 962                     !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
 963                     !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
 964                         x->genid = xfrm_state_genid;
 965         }
 966 }
 967
 968 void xfrm_state_insert(struct xfrm_state *x)
 969 {
 970         spin_lock_bh(&xfrm_state_lock);
 971         __xfrm_state_bump_genids(x);
 972         __xfrm_state_insert(x);
 973         spin_unlock_bh(&xfrm_state_lock);
 974 }
 975 EXPORT_SYMBOL(xfrm_state_insert);
 976
 977 /* xfrm_state_lock is held */
 978 static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
 979 {
 980         unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
 981         struct hlist_node *entry;
 982         struct xfrm_state *x;
 983
 984         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 985                 if (x->props.reqid  != reqid ||
 986                     x->props.mode   != mode ||
 987                     x->props.family != family ||
 988                     x->km.state     != XFRM_STATE_ACQ ||
 989                     x->id.spi       != 0 ||
 990                     x->id.proto     != proto)
 991                         continue;
 992
 993                 switch (family) {
 994                 case AF_INET:
 995                         if (x->id.daddr.a4    != daddr->a4 ||
 996                             x->props.saddr.a4 != saddr->a4)
 997                                 continue;
 998                         break;
 999                 case AF_INET6:
1000                         if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
1001                                              (struct in6_addr *)daddr) ||
1002                             !ipv6_addr_equal((struct in6_addr *)
1003                                              x->props.saddr.a6,
1004                                              (struct in6_addr *)saddr))
1005                                 continue;
1006                         break;
1007                 }
1008
1009                 xfrm_state_hold(x);
1010                 return x;
1011         }
1012
1013         if (!create)
1014                 return NULL;
1015
1016         x = xfrm_state_alloc();
1017         if (likely(x)) {
1018                 switch (family) {
1019                 case AF_INET:
1020                         x->sel.daddr.a4 = daddr->a4;
1021                         x->sel.saddr.a4 = saddr->a4;
1022                         x->sel.prefixlen_d = 32;
1023                         x->sel.prefixlen_s = 32;
1024                         x->props.saddr.a4 = saddr->a4;
1025                         x->id.daddr.a4 = daddr->a4;
1026                         break;
1027
1028                 case AF_INET6:
1029                         ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1030                                        (struct in6_addr *)daddr);
1031                         ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1032                                        (struct in6_addr *)saddr);
1033                         x->sel.prefixlen_d = 128;
1034                         x->sel.prefixlen_s = 128;
1035                         ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1036                                        (struct in6_addr *)saddr);
1037                         ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1038                                        (struct in6_addr *)daddr);
1039                         break;
1040                 }
1041
1042                 x->km.state = XFRM_STATE_ACQ;
1043                 x->id.proto = proto;
1044                 x->props.family = family;
1045                 x->props.mode = mode;
1046                 x->props.reqid = reqid;
1047                 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
1048                 xfrm_state_hold(x);
1049                 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1050                 add_timer(&x->timer);
1051                 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1052                 h = xfrm_src_hash(daddr, saddr, family);
1053                 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1054
1055                 xfrm_state_num++;
1056
1057                 xfrm_hash_grow_check(x->bydst.next != NULL);
1058         }
1059
1060         return x;
1061 }
1062
1063 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
1064
1065 int xfrm_state_add(struct xfrm_state *x)
1066 {
1067         struct xfrm_state *x1;
1068         int family;
1069         int err;
1070         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1071
1072         family = x->props.family;
1073
1074         spin_lock_bh(&xfrm_state_lock);
1075
1076         x1 = __xfrm_state_locate(x, use_spi, family);
1077         if (x1) {
1078                 xfrm_state_put(x1);
1079                 x1 = NULL;
1080                 err = -EEXIST;
1081                 goto out;
1082         }
1083
1084         if (use_spi && x->km.seq) {
1085                 x1 = __xfrm_find_acq_byseq(x->km.seq);
1086                 if (x1 && ((x1->id.proto != x->id.proto) ||
1087                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1088                         xfrm_state_put(x1);
1089                         x1 = NULL;
1090                 }
1091         }
1092
1093         if (use_spi && !x1)
1094                 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
1095                                      x->id.proto,
1096                                      &x->id.daddr, &x->props.saddr, 0);
1097
1098         __xfrm_state_bump_genids(x);
1099         __xfrm_state_insert(x);
1100         err = 0;
1101
1102 out:
1103         spin_unlock_bh(&xfrm_state_lock);
1104
1105         if (x1) {
1106                 xfrm_state_delete(x1);
1107                 xfrm_state_put(x1);
1108         }
1109
1110         return err;
1111 }
1112 EXPORT_SYMBOL(xfrm_state_add);
1113
1114 #ifdef CONFIG_XFRM_MIGRATE
1115 static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1116 {
1117         int err = -ENOMEM;
1118         struct xfrm_state *x = xfrm_state_alloc();
1119         if (!x)
1120                 goto error;
1121
1122         memcpy(&x->id, &orig->id, sizeof(x->id));
1123         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1124         memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1125         x->props.mode = orig->props.mode;
1126         x->props.replay_window = orig->props.replay_window;
1127         x->props.reqid = orig->props.reqid;
1128         x->props.family = orig->props.family;
1129         x->props.saddr = orig->props.saddr;
1130
1131         if (orig->aalg) {
1132                 x->aalg = xfrm_algo_clone(orig->aalg);
1133                 if (!x->aalg)
1134                         goto error;
1135         }
1136         x->props.aalgo = orig->props.aalgo;
1137
1138         if (orig->ealg) {
1139                 x->ealg = xfrm_algo_clone(orig->ealg);
1140                 if (!x->ealg)
1141                         goto error;
1142         }
1143         x->props.ealgo = orig->props.ealgo;
1144
1145         if (orig->calg) {
1146                 x->calg = xfrm_algo_clone(orig->calg);
1147                 if (!x->calg)
1148                         goto error;
1149         }
1150         x->props.calgo = orig->props.calgo;
1151
1152         if (orig->encap) {
1153                 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1154                 if (!x->encap)
1155                         goto error;
1156         }
1157
1158         if (orig->coaddr) {
1159                 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1160                                     GFP_KERNEL);
1161                 if (!x->coaddr)
1162                         goto error;
1163         }
1164
1165         err = xfrm_init_state(x);
1166         if (err)
1167                 goto error;
1168
1169         x->props.flags = orig->props.flags;
1170
1171         x->curlft.add_time = orig->curlft.add_time;
1172         x->km.state = orig->km.state;
1173         x->km.seq = orig->km.seq;
1174
1175         return x;
1176
1177  error:
1178         if (errp)
1179                 *errp = err;
1180         if (x) {
1181                 kfree(x->aalg);
1182                 kfree(x->ealg);
1183                 kfree(x->calg);
1184                 kfree(x->encap);
1185                 kfree(x->coaddr);
1186         }
1187         kfree(x);
1188         return NULL;
1189 }
1190
1191 /* xfrm_state_lock is held */
1192 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1193 {
1194         unsigned int h;
1195         struct xfrm_state *x;
1196         struct hlist_node *entry;
1197
1198         if (m->reqid) {
1199                 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1200                                   m->reqid, m->old_family);
1201                 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1202                         if (x->props.mode != m->mode ||
1203                             x->id.proto != m->proto)
1204                                 continue;
1205                         if (m->reqid && x->props.reqid != m->reqid)
1206                                 continue;
1207                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1208                                           m->old_family) ||
1209                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1210                                           m->old_family))
1211                                 continue;
1212                         xfrm_state_hold(x);
1213                         return x;
1214                 }
1215         } else {
1216                 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1217                                   m->old_family);
1218                 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1219                         if (x->props.mode != m->mode ||
1220                             x->id.proto != m->proto)
1221                                 continue;
1222                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1223                                           m->old_family) ||
1224                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1225                                           m->old_family))
1226                                 continue;
1227                         xfrm_state_hold(x);
1228                         return x;
1229                 }
1230         }
1231
1232         return NULL;
1233 }
1234 EXPORT_SYMBOL(xfrm_migrate_state_find);
1235
1236 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1237                                        struct xfrm_migrate *m)
1238 {
1239         struct xfrm_state *xc;
1240         int err;
1241
1242         xc = xfrm_state_clone(x, &err);
1243         if (!xc)
1244                 return NULL;
1245
1246         memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1247         memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1248
1249         /* add state */
1250         if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1251                 /* a care is needed when the destination address of the
1252                    state is to be updated as it is a part of triplet */
1253                 xfrm_state_insert(xc);
1254         } else {
1255                 if ((err = xfrm_state_add(xc)) < 0)
1256                         goto error;
1257         }
1258
1259         return xc;
1260 error:
1261         kfree(xc);
1262         return NULL;
1263 }
1264 EXPORT_SYMBOL(xfrm_state_migrate);
1265 #endif
1266
1267 int xfrm_state_update(struct xfrm_state *x)
1268 {
1269         struct xfrm_state *x1;
1270         int err;
1271         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1272
1273         spin_lock_bh(&xfrm_state_lock);
1274         x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1275
1276         err = -ESRCH;
1277         if (!x1)
1278                 goto out;
1279
1280         if (xfrm_state_kern(x1)) {
1281                 xfrm_state_put(x1);
1282                 err = -EEXIST;
1283                 goto out;
1284         }
1285
1286         if (x1->km.state == XFRM_STATE_ACQ) {
1287                 __xfrm_state_insert(x);
1288                 x = NULL;
1289         }
1290         err = 0;
1291
1292 out:
1293         spin_unlock_bh(&xfrm_state_lock);
1294
1295         if (err)
1296                 return err;
1297
1298         if (!x) {
1299                 xfrm_state_delete(x1);
1300                 xfrm_state_put(x1);
1301                 return 0;
1302         }
1303
1304         err = -EINVAL;
1305         spin_lock_bh(&x1->lock);
1306         if (likely(x1->km.state == XFRM_STATE_VALID)) {
1307                 if (x->encap && x1->encap)
1308                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1309                 if (x->coaddr && x1->coaddr) {
1310                         memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1311                 }
1312                 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1313                         memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1314                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1315                 x1->km.dying = 0;
1316
1317                 mod_timer(&x1->timer, jiffies + HZ);
1318                 if (x1->curlft.use_time)
1319                         xfrm_state_check_expire(x1);
1320
1321                 err = 0;
1322         }
1323         spin_unlock_bh(&x1->lock);
1324
1325         xfrm_state_put(x1);
1326
1327         return err;
1328 }
1329 EXPORT_SYMBOL(xfrm_state_update);
1330
1331 int xfrm_state_check_expire(struct xfrm_state *x)
1332 {
1333         if (!x->curlft.use_time)
1334                 x->curlft.use_time = get_seconds();
1335
1336         if (x->km.state != XFRM_STATE_VALID)
1337                 return -EINVAL;
1338
1339         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1340             x->curlft.packets >= x->lft.hard_packet_limit) {
1341                 x->km.state = XFRM_STATE_EXPIRED;
1342                 mod_timer(&x->timer, jiffies);
1343                 return -EINVAL;
1344         }
1345
1346         if (!x->km.dying &&
1347             (x->curlft.bytes >= x->lft.soft_byte_limit ||
1348              x->curlft.packets >= x->lft.soft_packet_limit)) {
1349                 x->km.dying = 1;
1350                 km_state_expired(x, 0, 0);
1351         }
1352         return 0;
1353 }
1354 EXPORT_SYMBOL(xfrm_state_check_expire);
1355
1356 struct xfrm_state *
1357 xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1358                   unsigned short family)
1359 {
1360         struct xfrm_state *x;
1361
1362         spin_lock_bh(&xfrm_state_lock);
1363         x = __xfrm_state_lookup(daddr, spi, proto, family);
1364         spin_unlock_bh(&xfrm_state_lock);
1365         return x;
1366 }
1367 EXPORT_SYMBOL(xfrm_state_lookup);
1368
1369 struct xfrm_state *
1370 xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1371                          u8 proto, unsigned short family)
1372 {
1373         struct xfrm_state *x;
1374
1375         spin_lock_bh(&xfrm_state_lock);
1376         x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
1377         spin_unlock_bh(&xfrm_state_lock);
1378         return x;
1379 }
1380 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1381
1382 struct xfrm_state *
1383 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1384               xfrm_address_t *daddr, xfrm_address_t *saddr,
1385               int create, unsigned short family)
1386 {
1387         struct xfrm_state *x;
1388
1389         spin_lock_bh(&xfrm_state_lock);
1390         x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1391         spin_unlock_bh(&xfrm_state_lock);
1392
1393         return x;
1394 }
1395 EXPORT_SYMBOL(xfrm_find_acq);
1396
1397 #ifdef CONFIG_XFRM_SUB_POLICY
1398 int
1399 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1400                unsigned short family)
1401 {
1402         int err = 0;
1403         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1404         if (!afinfo)
1405                 return -EAFNOSUPPORT;
1406
1407         spin_lock_bh(&xfrm_state_lock);
1408         if (afinfo->tmpl_sort)
1409                 err = afinfo->tmpl_sort(dst, src, n);
1410         spin_unlock_bh(&xfrm_state_lock);
1411         xfrm_state_put_afinfo(afinfo);
1412         return err;
1413 }
1414 EXPORT_SYMBOL(xfrm_tmpl_sort);
1415
1416 int
1417 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1418                 unsigned short family)
1419 {
1420         int err = 0;
1421         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1422         if (!afinfo)
1423                 return -EAFNOSUPPORT;
1424
1425         spin_lock_bh(&xfrm_state_lock);
1426         if (afinfo->state_sort)
1427                 err = afinfo->state_sort(dst, src, n);
1428         spin_unlock_bh(&xfrm_state_lock);
1429         xfrm_state_put_afinfo(afinfo);
1430         return err;
1431 }
1432 EXPORT_SYMBOL(xfrm_state_sort);
1433 #endif
1434
1435 /* Silly enough, but I'm lazy to build resolution list */
1436
1437 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1438 {
1439         int i;
1440
1441         for (i = 0; i <= xfrm_state_hmask; i++) {
1442                 struct hlist_node *entry;
1443                 struct xfrm_state *x;
1444
1445                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1446                         if (x->km.seq == seq &&
1447                             x->km.state == XFRM_STATE_ACQ) {
1448                                 xfrm_state_hold(x);
1449                                 return x;
1450                         }
1451                 }
1452         }
1453         return NULL;
1454 }
1455
1456 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1457 {
1458         struct xfrm_state *x;
1459
1460         spin_lock_bh(&xfrm_state_lock);
1461         x = __xfrm_find_acq_byseq(seq);
1462         spin_unlock_bh(&xfrm_state_lock);
1463         return x;
1464 }
1465 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1466
1467 u32 xfrm_get_acqseq(void)
1468 {
1469         u32 res;
1470         static u32 acqseq;
1471         static DEFINE_SPINLOCK(acqseq_lock);
1472
1473         spin_lock_bh(&acqseq_lock);
1474         res = (++acqseq ? : ++acqseq);
1475         spin_unlock_bh(&acqseq_lock);
1476         return res;
1477 }
1478 EXPORT_SYMBOL(xfrm_get_acqseq);
1479
1480 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1481 {
1482         unsigned int h;
1483         struct xfrm_state *x0;
1484         int err = -ENOENT;
1485         __be32 minspi = htonl(low);
1486         __be32 maxspi = htonl(high);
1487
1488         spin_lock_bh(&x->lock);
1489         if (x->km.state == XFRM_STATE_DEAD)
1490                 goto unlock;
1491
1492         err = 0;
1493         if (x->id.spi)
1494                 goto unlock;
1495
1496         err = -ENOENT;
1497
1498         if (minspi == maxspi) {
1499                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1500                 if (x0) {
1501                         xfrm_state_put(x0);
1502                         goto unlock;
1503                 }
1504                 x->id.spi = minspi;
1505         } else {
1506                 u32 spi = 0;
1507                 for (h=0; h<high-low+1; h++) {
1508                         spi = low + net_random()%(high-low+1);
1509                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1510                         if (x0 == NULL) {
1511                                 x->id.spi = htonl(spi);
1512                                 break;
1513                         }
1514                         xfrm_state_put(x0);
1515                 }
1516         }
1517         if (x->id.spi) {
1518                 spin_lock_bh(&xfrm_state_lock);
1519                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1520                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1521                 spin_unlock_bh(&xfrm_state_lock);
1522
1523                 err = 0;
1524         }
1525
1526 unlock:
1527         spin_unlock_bh(&x->lock);
1528
1529         return err;
1530 }
1531 EXPORT_SYMBOL(xfrm_alloc_spi);
1532
1533 int xfrm_state_walk(struct xfrm_state_walk *walk,
1534                     int (*func)(struct xfrm_state *, int, void*),
1535                     void *data)
1536 {
1537         struct xfrm_state *old, *x, *last = NULL;
1538         int err = 0;
1539
1540         if (walk->state == NULL && walk->count != 0)
1541                 return 0;
1542
1543         old = x = walk->state;
1544         walk->state = NULL;
1545         spin_lock_bh(&xfrm_state_lock);
1546         if (x == NULL)
1547                 x = list_first_entry(&xfrm_state_all, struct xfrm_state, all);
1548         list_for_each_entry_from(x, &xfrm_state_all, all) {
1549                 if (x->km.state == XFRM_STATE_DEAD)
1550                         continue;
1551                 if (!xfrm_id_proto_match(x->id.proto, walk->proto))
1552                         continue;
1553                 if (last) {
1554                         err = func(last, walk->count, data);
1555                         if (err) {
1556                                 xfrm_state_hold(last);
1557                                 walk->state = last;
1558                                 goto out;
1559                         }
1560                 }
1561                 last = x;
1562                 walk->count++;
1563         }
1564         if (walk->count == 0) {
1565                 err = -ENOENT;
1566                 goto out;
1567         }
1568         if (last)
1569                 err = func(last, 0, data);
1570 out:
1571         spin_unlock_bh(&xfrm_state_lock);
1572         if (old != NULL)
1573                 xfrm_state_put(old);
1574         return err;
1575 }
1576 EXPORT_SYMBOL(xfrm_state_walk);
1577
1578
1579 void xfrm_replay_notify(struct xfrm_state *x, int event)
1580 {
1581         struct km_event c;
1582         /* we send notify messages in case
1583          *  1. we updated on of the sequence numbers, and the seqno difference
1584          *     is at least x->replay_maxdiff, in this case we also update the
1585          *     timeout of our timer function
1586          *  2. if x->replay_maxage has elapsed since last update,
1587          *     and there were changes
1588          *
1589          *  The state structure must be locked!
1590          */
1591
1592         switch (event) {
1593         case XFRM_REPLAY_UPDATE:
1594                 if (x->replay_maxdiff &&
1595                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1596                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1597                         if (x->xflags & XFRM_TIME_DEFER)
1598                                 event = XFRM_REPLAY_TIMEOUT;
1599                         else
1600                                 return;
1601                 }
1602
1603                 break;
1604
1605         case XFRM_REPLAY_TIMEOUT:
1606                 if ((x->replay.seq == x->preplay.seq) &&
1607                     (x->replay.bitmap == x->preplay.bitmap) &&
1608                     (x->replay.oseq == x->preplay.oseq)) {
1609                         x->xflags |= XFRM_TIME_DEFER;
1610                         return;
1611                 }
1612
1613                 break;
1614         }
1615
1616         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1617         c.event = XFRM_MSG_NEWAE;
1618         c.data.aevent = event;
1619         km_state_notify(x, &c);
1620
1621         if (x->replay_maxage &&
1622             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1623                 x->xflags &= ~XFRM_TIME_DEFER;
1624 }
1625
1626 static void xfrm_replay_timer_handler(unsigned long data)
1627 {
1628         struct xfrm_state *x = (struct xfrm_state*)data;
1629
1630         spin_lock(&x->lock);
1631
1632         if (x->km.state == XFRM_STATE_VALID) {
1633                 if (xfrm_aevent_is_on())
1634                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1635                 else
1636                         x->xflags |= XFRM_TIME_DEFER;
1637         }
1638
1639         spin_unlock(&x->lock);
1640 }
1641
1642 int xfrm_replay_check(struct xfrm_state *x,
1643                       struct sk_buff *skb, __be32 net_seq)
1644 {
1645         u32 diff;
1646         u32 seq = ntohl(net_seq);
1647
1648         if (unlikely(seq == 0))
1649                 goto err;
1650
1651         if (likely(seq > x->replay.seq))
1652                 return 0;
1653
1654         diff = x->replay.seq - seq;
1655         if (diff >= min_t(unsigned int, x->props.replay_window,
1656                           sizeof(x->replay.bitmap) * 8)) {
1657                 x->stats.replay_window++;
1658                 goto err;
1659         }
1660
1661         if (x->replay.bitmap & (1U << diff)) {
1662                 x->stats.replay++;
1663                 goto err;
1664         }
1665         return 0;
1666
1667 err:
1668         xfrm_audit_state_replay(x, skb, net_seq);
1669         return -EINVAL;
1670 }
1671
1672 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1673 {
1674         u32 diff;
1675         u32 seq = ntohl(net_seq);
1676
1677         if (seq > x->replay.seq) {
1678                 diff = seq - x->replay.seq;
1679                 if (diff < x->props.replay_window)
1680                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1681                 else
1682                         x->replay.bitmap = 1;
1683                 x->replay.seq = seq;
1684         } else {
1685                 diff = x->replay.seq - seq;
1686                 x->replay.bitmap |= (1U << diff);
1687         }
1688
1689         if (xfrm_aevent_is_on())
1690                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1691 }
1692
1693 static LIST_HEAD(xfrm_km_list);
1694 static DEFINE_RWLOCK(xfrm_km_lock);
1695
1696 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1697 {
1698         struct xfrm_mgr *km;
1699
1700         read_lock(&xfrm_km_lock);
1701         list_for_each_entry(km, &xfrm_km_list, list)
1702                 if (km->notify_policy)
1703                         km->notify_policy(xp, dir, c);
1704         read_unlock(&xfrm_km_lock);
1705 }
1706
1707 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1708 {
1709         struct xfrm_mgr *km;
1710         read_lock(&xfrm_km_lock);
1711         list_for_each_entry(km, &xfrm_km_list, list)
1712                 if (km->notify)
1713                         km->notify(x, c);
1714         read_unlock(&xfrm_km_lock);
1715 }
1716
1717 EXPORT_SYMBOL(km_policy_notify);
1718 EXPORT_SYMBOL(km_state_notify);
1719
1720 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1721 {
1722         struct km_event c;
1723
1724         c.data.hard = hard;
1725         c.pid = pid;
1726         c.event = XFRM_MSG_EXPIRE;
1727         km_state_notify(x, &c);
1728
1729         if (hard)
1730                 wake_up(&km_waitq);
1731 }
1732
1733 EXPORT_SYMBOL(km_state_expired);
1734 /*
1735  * We send to all registered managers regardless of failure
1736  * We are happy with one success
1737 */
1738 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1739 {
1740         int err = -EINVAL, acqret;
1741         struct xfrm_mgr *km;
1742
1743         read_lock(&xfrm_km_lock);
1744         list_for_each_entry(km, &xfrm_km_list, list) {
1745                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1746                 if (!acqret)
1747                         err = acqret;
1748         }
1749         read_unlock(&xfrm_km_lock);
1750         return err;
1751 }
1752 EXPORT_SYMBOL(km_query);
1753
1754 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1755 {
1756         int err = -EINVAL;
1757         struct xfrm_mgr *km;
1758
1759         read_lock(&xfrm_km_lock);
1760         list_for_each_entry(km, &xfrm_km_list, list) {
1761                 if (km->new_mapping)
1762                         err = km->new_mapping(x, ipaddr, sport);
1763                 if (!err)
1764                         break;
1765         }
1766         read_unlock(&xfrm_km_lock);
1767         return err;
1768 }
1769 EXPORT_SYMBOL(km_new_mapping);
1770
1771 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1772 {
1773         struct km_event c;
1774
1775         c.data.hard = hard;
1776         c.pid = pid;
1777         c.event = XFRM_MSG_POLEXPIRE;
1778         km_policy_notify(pol, dir, &c);
1779
1780         if (hard)
1781                 wake_up(&km_waitq);
1782 }
1783 EXPORT_SYMBOL(km_policy_expired);
1784
1785 #ifdef CONFIG_XFRM_MIGRATE
1786 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1787                struct xfrm_migrate *m, int num_migrate)
1788 {
1789         int err = -EINVAL;
1790         int ret;
1791         struct xfrm_mgr *km;
1792
1793         read_lock(&xfrm_km_lock);
1794         list_for_each_entry(km, &xfrm_km_list, list) {
1795                 if (km->migrate) {
1796                         ret = km->migrate(sel, dir, type, m, num_migrate);
1797                         if (!ret)
1798                                 err = ret;
1799                 }
1800         }
1801         read_unlock(&xfrm_km_lock);
1802         return err;
1803 }
1804 EXPORT_SYMBOL(km_migrate);
1805 #endif
1806
1807 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1808 {
1809         int err = -EINVAL;
1810         int ret;
1811         struct xfrm_mgr *km;
1812
1813         read_lock(&xfrm_km_lock);
1814         list_for_each_entry(km, &xfrm_km_list, list) {
1815                 if (km->report) {
1816                         ret = km->report(proto, sel, addr);
1817                         if (!ret)
1818                                 err = ret;
1819                 }
1820         }
1821         read_unlock(&xfrm_km_lock);
1822         return err;
1823 }
1824 EXPORT_SYMBOL(km_report);
1825
1826 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1827 {
1828         int err;
1829         u8 *data;
1830         struct xfrm_mgr *km;
1831         struct xfrm_policy *pol = NULL;
1832
1833         if (optlen <= 0 || optlen > PAGE_SIZE)
1834                 return -EMSGSIZE;
1835
1836         data = kmalloc(optlen, GFP_KERNEL);
1837         if (!data)
1838                 return -ENOMEM;
1839
1840         err = -EFAULT;
1841         if (copy_from_user(data, optval, optlen))
1842                 goto out;
1843
1844         err = -EINVAL;
1845         read_lock(&xfrm_km_lock);
1846         list_for_each_entry(km, &xfrm_km_list, list) {
1847                 pol = km->compile_policy(sk, optname, data,
1848                                          optlen, &err);
1849                 if (err >= 0)
1850                         break;
1851         }
1852         read_unlock(&xfrm_km_lock);
1853
1854         if (err >= 0) {
1855                 xfrm_sk_policy_insert(sk, err, pol);
1856                 xfrm_pol_put(pol);
1857                 err = 0;
1858         }
1859
1860 out:
1861         kfree(data);
1862         return err;
1863 }
1864 EXPORT_SYMBOL(xfrm_user_policy);
1865
1866 int xfrm_register_km(struct xfrm_mgr *km)
1867 {
1868         write_lock_bh(&xfrm_km_lock);
1869         list_add_tail(&km->list, &xfrm_km_list);
1870         write_unlock_bh(&xfrm_km_lock);
1871         return 0;
1872 }
1873 EXPORT_SYMBOL(xfrm_register_km);
1874
1875 int xfrm_unregister_km(struct xfrm_mgr *km)
1876 {
1877         write_lock_bh(&xfrm_km_lock);
1878         list_del(&km->list);
1879         write_unlock_bh(&xfrm_km_lock);
1880         return 0;
1881 }
1882 EXPORT_SYMBOL(xfrm_unregister_km);
1883
1884 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1885 {
1886         int err = 0;
1887         if (unlikely(afinfo == NULL))
1888                 return -EINVAL;
1889         if (unlikely(afinfo->family >= NPROTO))
1890                 return -EAFNOSUPPORT;
1891         write_lock_bh(&xfrm_state_afinfo_lock);
1892         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1893                 err = -ENOBUFS;
1894         else
1895                 xfrm_state_afinfo[afinfo->family] = afinfo;
1896         write_unlock_bh(&xfrm_state_afinfo_lock);
1897         return err;
1898 }
1899 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1900
1901 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1902 {
1903         int err = 0;
1904         if (unlikely(afinfo == NULL))
1905                 return -EINVAL;
1906         if (unlikely(afinfo->family >= NPROTO))
1907                 return -EAFNOSUPPORT;
1908         write_lock_bh(&xfrm_state_afinfo_lock);
1909         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1910                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1911                         err = -EINVAL;
1912                 else
1913                         xfrm_state_afinfo[afinfo->family] = NULL;
1914         }
1915         write_unlock_bh(&xfrm_state_afinfo_lock);
1916         return err;
1917 }
1918 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1919
1920 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1921 {
1922         struct xfrm_state_afinfo *afinfo;
1923         if (unlikely(family >= NPROTO))
1924                 return NULL;
1925         read_lock(&xfrm_state_afinfo_lock);
1926         afinfo = xfrm_state_afinfo[family];
1927         if (unlikely(!afinfo))
1928                 read_unlock(&xfrm_state_afinfo_lock);
1929         return afinfo;
1930 }
1931
1932 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1933         __releases(xfrm_state_afinfo_lock)
1934 {
1935         read_unlock(&xfrm_state_afinfo_lock);
1936 }
1937
1938 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1939 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1940 {
1941         if (x->tunnel) {
1942                 struct xfrm_state *t = x->tunnel;
1943
1944                 if (atomic_read(&t->tunnel_users) == 2)
1945                         xfrm_state_delete(t);
1946                 atomic_dec(&t->tunnel_users);
1947                 xfrm_state_put(t);
1948                 x->tunnel = NULL;
1949         }
1950 }
1951 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1952
1953 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1954 {
1955         int res;
1956
1957         spin_lock_bh(&x->lock);
1958         if (x->km.state == XFRM_STATE_VALID &&
1959             x->type && x->type->get_mtu)
1960                 res = x->type->get_mtu(x, mtu);
1961         else
1962                 res = mtu - x->props.header_len;
1963         spin_unlock_bh(&x->lock);
1964         return res;
1965 }
1966
1967 int xfrm_init_state(struct xfrm_state *x)
1968 {
1969         struct xfrm_state_afinfo *afinfo;
1970         struct xfrm_mode *inner_mode;
1971         int family = x->props.family;
1972         int err;
1973
1974         err = -EAFNOSUPPORT;
1975         afinfo = xfrm_state_get_afinfo(family);
1976         if (!afinfo)
1977                 goto error;
1978
1979         err = 0;
1980         if (afinfo->init_flags)
1981                 err = afinfo->init_flags(x);
1982
1983         xfrm_state_put_afinfo(afinfo);
1984
1985         if (err)
1986                 goto error;
1987
1988         err = -EPROTONOSUPPORT;
1989
1990         if (x->sel.family != AF_UNSPEC) {
1991                 inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
1992                 if (inner_mode == NULL)
1993                         goto error;
1994
1995                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
1996                     family != x->sel.family) {
1997                         xfrm_put_mode(inner_mode);
1998                         goto error;
1999                 }
2000
2001                 x->inner_mode = inner_mode;
2002         } else {
2003                 struct xfrm_mode *inner_mode_iaf;
2004
2005                 inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
2006                 if (inner_mode == NULL)
2007                         goto error;
2008
2009                 if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
2010                         xfrm_put_mode(inner_mode);
2011                         goto error;
2012                 }
2013
2014                 inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
2015                 if (inner_mode_iaf == NULL)
2016                         goto error;
2017
2018                 if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
2019                         xfrm_put_mode(inner_mode_iaf);
2020                         goto error;
2021                 }
2022
2023                 if (x->props.family == AF_INET) {
2024                         x->inner_mode = inner_mode;
2025                         x->inner_mode_iaf = inner_mode_iaf;
2026                 } else {
2027                         x->inner_mode = inner_mode_iaf;
2028                         x->inner_mode_iaf = inner_mode;
2029                 }
2030         }
2031
2032         x->type = xfrm_get_type(x->id.proto, family);
2033         if (x->type == NULL)
2034                 goto error;
2035
2036         err = x->type->init_state(x);
2037         if (err)
2038                 goto error;
2039
2040         x->outer_mode = xfrm_get_mode(x->props.mode, family);
2041         if (x->outer_mode == NULL)
2042                 goto error;
2043
2044         x->km.state = XFRM_STATE_VALID;
2045
2046 error:
2047         return err;
2048 }
2049
2050 EXPORT_SYMBOL(xfrm_init_state);
2051
2052 void __init xfrm_state_init(void)
2053 {
2054         unsigned int sz;
2055
2056         sz = sizeof(struct hlist_head) * 8;
2057
2058         xfrm_state_bydst = xfrm_hash_alloc(sz);
2059         xfrm_state_bysrc = xfrm_hash_alloc(sz);
2060         xfrm_state_byspi = xfrm_hash_alloc(sz);
2061         if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
2062                 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
2063         xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
2064
2065         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
2066 }
2067
2068 #ifdef CONFIG_AUDITSYSCALL
2069 static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2070                                      struct audit_buffer *audit_buf)
2071 {
2072         struct xfrm_sec_ctx *ctx = x->security;
2073         u32 spi = ntohl(x->id.spi);
2074
2075         if (ctx)
2076                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2077                                  ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2078
2079         switch(x->props.family) {
2080         case AF_INET:
2081                 audit_log_format(audit_buf,
2082                                  " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2083                                  NIPQUAD(x->props.saddr.a4),
2084                                  NIPQUAD(x->id.daddr.a4));
2085                 break;
2086         case AF_INET6:
2087                 audit_log_format(audit_buf,
2088                                  " src=" NIP6_FMT " dst=" NIP6_FMT,
2089                                  NIP6(*(struct in6_addr *)x->props.saddr.a6),
2090                                  NIP6(*(struct in6_addr *)x->id.daddr.a6));
2091                 break;
2092         }
2093
2094         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2095 }
2096
2097 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2098                                       struct audit_buffer *audit_buf)
2099 {
2100         struct iphdr *iph4;
2101         struct ipv6hdr *iph6;
2102
2103         switch (family) {
2104         case AF_INET:
2105                 iph4 = ip_hdr(skb);
2106                 audit_log_format(audit_buf,
2107                                  " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
2108                                  NIPQUAD(iph4->saddr),
2109                                  NIPQUAD(iph4->daddr));
2110                 break;
2111         case AF_INET6:
2112                 iph6 = ipv6_hdr(skb);
2113                 audit_log_format(audit_buf,
2114                                  " src=" NIP6_FMT " dst=" NIP6_FMT
2115                                  " flowlbl=0x%x%x%x",
2116                                  NIP6(iph6->saddr),
2117                                  NIP6(iph6->daddr),
2118                                  iph6->flow_lbl[0] & 0x0f,
2119                                  iph6->flow_lbl[1],
2120                                  iph6->flow_lbl[2]);
2121                 break;
2122         }
2123 }
2124
2125 void xfrm_audit_state_add(struct xfrm_state *x, int result,
2126                           u32 auid, u32 secid)
2127 {
2128         struct audit_buffer *audit_buf;
2129
2130         audit_buf = xfrm_audit_start("SAD-add");
2131         if (audit_buf == NULL)
2132                 return;
2133         xfrm_audit_helper_usrinfo(auid, secid, audit_buf);
2134         xfrm_audit_helper_sainfo(x, audit_buf);
2135         audit_log_format(audit_buf, " res=%u", result);
2136         audit_log_end(audit_buf);
2137 }
2138 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2139
2140 void xfrm_audit_state_delete(struct xfrm_state *x, int result,
2141                              u32 auid, u32 secid)
2142 {
2143         struct audit_buffer *audit_buf;
2144
2145         audit_buf = xfrm_audit_start("SAD-delete");
2146         if (audit_buf == NULL)
2147                 return;
2148         xfrm_audit_helper_usrinfo(auid, secid, audit_buf);
2149         xfrm_audit_helper_sainfo(x, audit_buf);
2150         audit_log_format(audit_buf, " res=%u", result);
2151         audit_log_end(audit_buf);
2152 }
2153 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2154
2155 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2156                                       struct sk_buff *skb)
2157 {
2158         struct audit_buffer *audit_buf;
2159         u32 spi;
2160
2161         audit_buf = xfrm_audit_start("SA-replay-overflow");
2162         if (audit_buf == NULL)
2163                 return;
2164         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2165         /* don't record the sequence number because it's inherent in this kind
2166          * of audit message */
2167         spi = ntohl(x->id.spi);
2168         audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
2169         audit_log_end(audit_buf);
2170 }
2171 EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2172
2173 static void xfrm_audit_state_replay(struct xfrm_state *x,
2174                              struct sk_buff *skb, __be32 net_seq)
2175 {
2176         struct audit_buffer *audit_buf;
2177         u32 spi;
2178
2179         audit_buf = xfrm_audit_start("SA-replayed-pkt");
2180         if (audit_buf == NULL)
2181                 return;
2182         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2183         spi = ntohl(x->id.spi);
2184         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2185                          spi, spi, ntohl(net_seq));
2186         audit_log_end(audit_buf);
2187 }
2188
2189 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2190 {
2191         struct audit_buffer *audit_buf;
2192
2193         audit_buf = xfrm_audit_start("SA-notfound");
2194         if (audit_buf == NULL)
2195                 return;
2196         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2197         audit_log_end(audit_buf);
2198 }
2199 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
2200
2201 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
2202                                __be32 net_spi, __be32 net_seq)
2203 {
2204         struct audit_buffer *audit_buf;
2205         u32 spi;
2206
2207         audit_buf = xfrm_audit_start("SA-notfound");
2208         if (audit_buf == NULL)
2209                 return;
2210         xfrm_audit_helper_pktinfo(skb, family, audit_buf);
2211         spi = ntohl(net_spi);
2212         audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2213                          spi, spi, ntohl(net_seq));
2214         audit_log_end(audit_buf);
2215 }
2216 EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
2217
2218 void xfrm_audit_state_icvfail(struct xfrm_state *x,
2219                               struct sk_buff *skb, u8 proto)
2220 {
2221         struct audit_buffer *audit_buf;
2222         __be32 net_spi;
2223         __be32 net_seq;
2224
2225         audit_buf = xfrm_audit_start("SA-icv-failure");
2226         if (audit_buf == NULL)
2227                 return;
2228         xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
2229         if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
2230                 u32 spi = ntohl(net_spi);
2231                 audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
2232                                  spi, spi, ntohl(net_seq));
2233         }
2234         audit_log_end(audit_buf);
2235 }
2236 EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
2237 #endif /* CONFIG_AUDITSYSCALL */