?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[ALSA] Remove SND_GENERIC_DRIVER from isa/Kconfig
[linux-2.6.git] / net / xfrm / xfrm_policy.c
blobd19e274b9c4a346b48bf32558ddec3db69fd5942
1 /*
2 * xfrm_policy.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * Kazunori MIYAZAWA @USAGI
10 * YOSHIFUJI Hideaki
11 * Split up af-specific portion
12 * Derek Atkins <derek@ihtfp.com> Add the post_input processor
13 *
14 */
15
16 #include <asm/bug.h>
17 #include <linux/config.h>
18 #include <linux/slab.h>
19 #include <linux/kmod.h>
20 #include <linux/list.h>
21 #include <linux/spinlock.h>
22 #include <linux/workqueue.h>
23 #include <linux/notifier.h>
24 #include <linux/netdevice.h>
25 #include <linux/module.h>
26 #include <net/xfrm.h>
27 #include <net/ip.h>
28
29 DECLARE_MUTEX(xfrm_cfg_sem);
30 EXPORT_SYMBOL(xfrm_cfg_sem);
31
32 static DEFINE_RWLOCK(xfrm_policy_lock);
33
34 struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
35 EXPORT_SYMBOL(xfrm_policy_list);
36
37 static DEFINE_RWLOCK(xfrm_policy_afinfo_lock);
38 static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO];
39
40 static kmem_cache_t *xfrm_dst_cache __read_mostly;
41
42 static struct work_struct xfrm_policy_gc_work;
43 static struct list_head xfrm_policy_gc_list =
44 LIST_HEAD_INIT(xfrm_policy_gc_list);
45 static DEFINE_SPINLOCK(xfrm_policy_gc_lock);
46
47 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
48 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
49
50 int xfrm_register_type(struct xfrm_type *type, unsigned short family)
51 {
52 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
53 struct xfrm_type_map *typemap;
54 int err = 0;
55
56 if (unlikely(afinfo == NULL))
57 return -EAFNOSUPPORT;
58 typemap = afinfo->type_map;
59
60 write_lock(&typemap->lock);
61 if (likely(typemap->map[type->proto] == NULL))
62 typemap->map[type->proto] = type;
63 else
64 err = -EEXIST;
65 write_unlock(&typemap->lock);
66 xfrm_policy_put_afinfo(afinfo);
67 return err;
68 }
69 EXPORT_SYMBOL(xfrm_register_type);
70
71 int xfrm_unregister_type(struct xfrm_type *type, unsigned short family)
72 {
73 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
74 struct xfrm_type_map *typemap;
75 int err = 0;
76
77 if (unlikely(afinfo == NULL))
78 return -EAFNOSUPPORT;
79 typemap = afinfo->type_map;
80
81 write_lock(&typemap->lock);
82 if (unlikely(typemap->map[type->proto] != type))
83 err = -ENOENT;
84 else
85 typemap->map[type->proto] = NULL;
86 write_unlock(&typemap->lock);
87 xfrm_policy_put_afinfo(afinfo);
88 return err;
89 }
90 EXPORT_SYMBOL(xfrm_unregister_type);
91
92 struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
93 {
94 struct xfrm_policy_afinfo *afinfo;
95 struct xfrm_type_map *typemap;
96 struct xfrm_type *type;
97 int modload_attempted = 0;
98
99 retry:
100 afinfo = xfrm_policy_get_afinfo(family);
101 if (unlikely(afinfo == NULL))
102 return NULL;
103 typemap = afinfo->type_map;
104
105 read_lock(&typemap->lock);
106 type = typemap->map[proto];
107 if (unlikely(type && !try_module_get(type->owner)))
108 type = NULL;
109 read_unlock(&typemap->lock);
110 if (!type && !modload_attempted) {
111 xfrm_policy_put_afinfo(afinfo);
112 request_module("xfrm-type-%d-%d",
113 (int) family, (int) proto);
114 modload_attempted = 1;
115 goto retry;
116 }
117
118 xfrm_policy_put_afinfo(afinfo);
119 return type;
120 }
121
122 int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl,
123 unsigned short family)
124 {
125 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
126 int err = 0;
127
128 if (unlikely(afinfo == NULL))
129 return -EAFNOSUPPORT;
130
131 if (likely(afinfo->dst_lookup != NULL))
132 err = afinfo->dst_lookup(dst, fl);
133 else
134 err = -EINVAL;
135 xfrm_policy_put_afinfo(afinfo);
136 return err;
137 }
138 EXPORT_SYMBOL(xfrm_dst_lookup);
139
140 void xfrm_put_type(struct xfrm_type *type)
141 {
142 module_put(type->owner);
143 }
144
145 static inline unsigned long make_jiffies(long secs)
146 {
147 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
148 return MAX_SCHEDULE_TIMEOUT-1;
149 else
150 return secs*HZ;
151 }
152
153 static void xfrm_policy_timer(unsigned long data)
154 {
155 struct xfrm_policy *xp = (struct xfrm_policy*)data;
156 unsigned long now = (unsigned long)xtime.tv_sec;
157 long next = LONG_MAX;
158 int warn = 0;
159 int dir;
160
161 read_lock(&xp->lock);
162
163 if (xp->dead)
164 goto out;
165
166 dir = xfrm_policy_id2dir(xp->index);
167
168 if (xp->lft.hard_add_expires_seconds) {
169 long tmo = xp->lft.hard_add_expires_seconds +
170 xp->curlft.add_time - now;
171 if (tmo <= 0)
172 goto expired;
173 if (tmo < next)
174 next = tmo;
175 }
176 if (xp->lft.hard_use_expires_seconds) {
177 long tmo = xp->lft.hard_use_expires_seconds +
178 (xp->curlft.use_time ? : xp->curlft.add_time) - now;
179 if (tmo <= 0)
180 goto expired;
181 if (tmo < next)
182 next = tmo;
183 }
184 if (xp->lft.soft_add_expires_seconds) {
185 long tmo = xp->lft.soft_add_expires_seconds +
186 xp->curlft.add_time - now;
187 if (tmo <= 0) {
188 warn = 1;
189 tmo = XFRM_KM_TIMEOUT;
190 }
191 if (tmo < next)
192 next = tmo;
193 }
194 if (xp->lft.soft_use_expires_seconds) {
195 long tmo = xp->lft.soft_use_expires_seconds +
196 (xp->curlft.use_time ? : xp->curlft.add_time) - now;
197 if (tmo <= 0) {
198 warn = 1;
199 tmo = XFRM_KM_TIMEOUT;
200 }
201 if (tmo < next)
202 next = tmo;
203 }
204
205 if (warn)
206 km_policy_expired(xp, dir, 0);
207 if (next != LONG_MAX &&
208 !mod_timer(&xp->timer, jiffies + make_jiffies(next)))
209 xfrm_pol_hold(xp);
210
211 out:
212 read_unlock(&xp->lock);
213 xfrm_pol_put(xp);
214 return;
215
216 expired:
217 read_unlock(&xp->lock);
218 if (!xfrm_policy_delete(xp, dir))
219 km_policy_expired(xp, dir, 1);
220 xfrm_pol_put(xp);
221 }
222
223
224 /* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2
225 * SPD calls.
226 */
227
228 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp)
229 {
230 struct xfrm_policy *policy;
231
232 policy = kmalloc(sizeof(struct xfrm_policy), gfp);
233
234 if (policy) {
235 memset(policy, 0, sizeof(struct xfrm_policy));
236 atomic_set(&policy->refcnt, 1);
237 rwlock_init(&policy->lock);
238 init_timer(&policy->timer);
239 policy->timer.data = (unsigned long)policy;
240 policy->timer.function = xfrm_policy_timer;
241 }
242 return policy;
243 }
244 EXPORT_SYMBOL(xfrm_policy_alloc);
245
246 /* Destroy xfrm_policy: descendant resources must be released to this moment. */
247
248 void __xfrm_policy_destroy(struct xfrm_policy *policy)
249 {
250 if (!policy->dead)
251 BUG();
252
253 if (policy->bundles)
254 BUG();
255
256 if (del_timer(&policy->timer))
257 BUG();
258
259 kfree(policy);
260 }
261 EXPORT_SYMBOL(__xfrm_policy_destroy);
262
263 static void xfrm_policy_gc_kill(struct xfrm_policy *policy)
264 {
265 struct dst_entry *dst;
266
267 while ((dst = policy->bundles) != NULL) {
268 policy->bundles = dst->next;
269 dst_free(dst);
270 }
271
272 if (del_timer(&policy->timer))
273 atomic_dec(&policy->refcnt);
274
275 if (atomic_read(&policy->refcnt) > 1)
276 flow_cache_flush();
277
278 xfrm_pol_put(policy);
279 }
280
281 static void xfrm_policy_gc_task(void *data)
282 {
283 struct xfrm_policy *policy;
284 struct list_head *entry, *tmp;
285 struct list_head gc_list = LIST_HEAD_INIT(gc_list);
286
287 spin_lock_bh(&xfrm_policy_gc_lock);
288 list_splice_init(&xfrm_policy_gc_list, &gc_list);
289 spin_unlock_bh(&xfrm_policy_gc_lock);
290
291 list_for_each_safe(entry, tmp, &gc_list) {
292 policy = list_entry(entry, struct xfrm_policy, list);
293 xfrm_policy_gc_kill(policy);
294 }
295 }
296
297 /* Rule must be locked. Release descentant resources, announce
298 * entry dead. The rule must be unlinked from lists to the moment.
299 */
300
301 static void xfrm_policy_kill(struct xfrm_policy *policy)
302 {
303 int dead;
304
305 write_lock_bh(&policy->lock);
306 dead = policy->dead;
307 policy->dead = 1;
308 write_unlock_bh(&policy->lock);
309
310 if (unlikely(dead)) {
311 WARN_ON(1);
312 return;
313 }
314
315 spin_lock(&xfrm_policy_gc_lock);
316 list_add(&policy->list, &xfrm_policy_gc_list);
317 spin_unlock(&xfrm_policy_gc_lock);
318
319 schedule_work(&xfrm_policy_gc_work);
320 }
321
322 /* Generate new index... KAME seems to generate them ordered by cost
323 * of an absolute inpredictability of ordering of rules. This will not pass. */
324 static u32 xfrm_gen_index(int dir)
325 {
326 u32 idx;
327 struct xfrm_policy *p;
328 static u32 idx_generator;
329
330 for (;;) {
331 idx = (idx_generator | dir);
332 idx_generator += 8;
333 if (idx == 0)
334 idx = 8;
335 for (p = xfrm_policy_list[dir]; p; p = p->next) {
336 if (p->index == idx)
337 break;
338 }
339 if (!p)
340 return idx;
341 }
342 }
343
344 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
345 {
346 struct xfrm_policy *pol, **p;
347 struct xfrm_policy *delpol = NULL;
348 struct xfrm_policy **newpos = NULL;
349 struct dst_entry *gc_list;
350
351 write_lock_bh(&xfrm_policy_lock);
352 for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL;) {
353 if (!delpol && memcmp(&policy->selector, &pol->selector, sizeof(pol->selector)) == 0) {
354 if (excl) {
355 write_unlock_bh(&xfrm_policy_lock);
356 return -EEXIST;
357 }
358 *p = pol->next;
359 delpol = pol;
360 if (policy->priority > pol->priority)
361 continue;
362 } else if (policy->priority >= pol->priority) {
363 p = &pol->next;
364 continue;
365 }
366 if (!newpos)
367 newpos = p;
368 if (delpol)
369 break;
370 p = &pol->next;
371 }
372 if (newpos)
373 p = newpos;
374 xfrm_pol_hold(policy);
375 policy->next = *p;
376 *p = policy;
377 atomic_inc(&flow_cache_genid);
378 policy->index = delpol ? delpol->index : xfrm_gen_index(dir);
379 policy->curlft.add_time = (unsigned long)xtime.tv_sec;
380 policy->curlft.use_time = 0;
381 if (!mod_timer(&policy->timer, jiffies + HZ))
382 xfrm_pol_hold(policy);
383 write_unlock_bh(&xfrm_policy_lock);
384
385 if (delpol)
386 xfrm_policy_kill(delpol);
387
388 read_lock_bh(&xfrm_policy_lock);
389 gc_list = NULL;
390 for (policy = policy->next; policy; policy = policy->next) {
391 struct dst_entry *dst;
392
393 write_lock(&policy->lock);
394 dst = policy->bundles;
395 if (dst) {
396 struct dst_entry *tail = dst;
397 while (tail->next)
398 tail = tail->next;
399 tail->next = gc_list;
400 gc_list = dst;
401
402 policy->bundles = NULL;
403 }
404 write_unlock(&policy->lock);
405 }
406 read_unlock_bh(&xfrm_policy_lock);
407
408 while (gc_list) {
409 struct dst_entry *dst = gc_list;
410
411 gc_list = dst->next;
412 dst_free(dst);
413 }
414
415 return 0;
416 }
417 EXPORT_SYMBOL(xfrm_policy_insert);
418
419 struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
420 int delete)
421 {
422 struct xfrm_policy *pol, **p;
423
424 write_lock_bh(&xfrm_policy_lock);
425 for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL; p = &pol->next) {
426 if (memcmp(sel, &pol->selector, sizeof(*sel)) == 0) {
427 xfrm_pol_hold(pol);
428 if (delete)
429 *p = pol->next;
430 break;
431 }
432 }
433 write_unlock_bh(&xfrm_policy_lock);
434
435 if (pol && delete) {
436 atomic_inc(&flow_cache_genid);
437 xfrm_policy_kill(pol);
438 }
439 return pol;
440 }
441 EXPORT_SYMBOL(xfrm_policy_bysel);
442
443 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete)
444 {
445 struct xfrm_policy *pol, **p;
446
447 write_lock_bh(&xfrm_policy_lock);
448 for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL; p = &pol->next) {
449 if (pol->index == id) {
450 xfrm_pol_hold(pol);
451 if (delete)
452 *p = pol->next;
453 break;
454 }
455 }
456 write_unlock_bh(&xfrm_policy_lock);
457
458 if (pol && delete) {
459 atomic_inc(&flow_cache_genid);
460 xfrm_policy_kill(pol);
461 }
462 return pol;
463 }
464 EXPORT_SYMBOL(xfrm_policy_byid);
465
466 void xfrm_policy_flush(void)
467 {
468 struct xfrm_policy *xp;
469 int dir;
470
471 write_lock_bh(&xfrm_policy_lock);
472 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
473 while ((xp = xfrm_policy_list[dir]) != NULL) {
474 xfrm_policy_list[dir] = xp->next;
475 write_unlock_bh(&xfrm_policy_lock);
476
477 xfrm_policy_kill(xp);
478
479 write_lock_bh(&xfrm_policy_lock);
480 }
481 }
482 atomic_inc(&flow_cache_genid);
483 write_unlock_bh(&xfrm_policy_lock);
484 }
485 EXPORT_SYMBOL(xfrm_policy_flush);
486
487 int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*),
488 void *data)
489 {
490 struct xfrm_policy *xp;
491 int dir;
492 int count = 0;
493 int error = 0;
494
495 read_lock_bh(&xfrm_policy_lock);
496 for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) {
497 for (xp = xfrm_policy_list[dir]; xp; xp = xp->next)
498 count++;
499 }
500
501 if (count == 0) {
502 error = -ENOENT;
503 goto out;
504 }
505
506 for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) {
507 for (xp = xfrm_policy_list[dir]; xp; xp = xp->next) {
508 error = func(xp, dir%XFRM_POLICY_MAX, --count, data);
509 if (error)
510 goto out;
511 }
512 }
513
514 out:
515 read_unlock_bh(&xfrm_policy_lock);
516 return error;
517 }
518 EXPORT_SYMBOL(xfrm_policy_walk);
519
520 /* Find policy to apply to this flow. */
521
522 static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
523 void **objp, atomic_t **obj_refp)
524 {
525 struct xfrm_policy *pol;
526
527 read_lock_bh(&xfrm_policy_lock);
528 for (pol = xfrm_policy_list[dir]; pol; pol = pol->next) {
529 struct xfrm_selector *sel = &pol->selector;
530 int match;
531
532 if (pol->family != family)
533 continue;
534
535 match = xfrm_selector_match(sel, fl, family);
536 if (match) {
537 xfrm_pol_hold(pol);
538 break;
539 }
540 }
541 read_unlock_bh(&xfrm_policy_lock);
542 if ((*objp = (void *) pol) != NULL)
543 *obj_refp = &pol->refcnt;
544 }
545
546 static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl)
547 {
548 struct xfrm_policy *pol;
549
550 read_lock_bh(&xfrm_policy_lock);
551 if ((pol = sk->sk_policy[dir]) != NULL) {
552 int match = xfrm_selector_match(&pol->selector, fl,
553 sk->sk_family);
554 if (match)
555 xfrm_pol_hold(pol);
556 else
557 pol = NULL;
558 }
559 read_unlock_bh(&xfrm_policy_lock);
560 return pol;
561 }
562
563 static void __xfrm_policy_link(struct xfrm_policy *pol, int dir)
564 {
565 pol->next = xfrm_policy_list[dir];
566 xfrm_policy_list[dir] = pol;
567 xfrm_pol_hold(pol);
568 }
569
570 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
571 int dir)
572 {
573 struct xfrm_policy **polp;
574
575 for (polp = &xfrm_policy_list[dir];
576 *polp != NULL; polp = &(*polp)->next) {
577 if (*polp == pol) {
578 *polp = pol->next;
579 return pol;
580 }
581 }
582 return NULL;
583 }
584
585 int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
586 {
587 write_lock_bh(&xfrm_policy_lock);
588 pol = __xfrm_policy_unlink(pol, dir);
589 write_unlock_bh(&xfrm_policy_lock);
590 if (pol) {
591 if (dir < XFRM_POLICY_MAX)
592 atomic_inc(&flow_cache_genid);
593 xfrm_policy_kill(pol);
594 return 0;
595 }
596 return -ENOENT;
597 }
598
599 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
600 {
601 struct xfrm_policy *old_pol;
602
603 write_lock_bh(&xfrm_policy_lock);
604 old_pol = sk->sk_policy[dir];
605 sk->sk_policy[dir] = pol;
606 if (pol) {
607 pol->curlft.add_time = (unsigned long)xtime.tv_sec;
608 pol->index = xfrm_gen_index(XFRM_POLICY_MAX+dir);
609 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
610 }
611 if (old_pol)
612 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
613 write_unlock_bh(&xfrm_policy_lock);
614
615 if (old_pol) {
616 xfrm_policy_kill(old_pol);
617 }
618 return 0;
619 }
620
621 static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
622 {
623 struct xfrm_policy *newp = xfrm_policy_alloc(GFP_ATOMIC);
624
625 if (newp) {
626 newp->selector = old->selector;
627 newp->lft = old->lft;
628 newp->curlft = old->curlft;
629 newp->action = old->action;
630 newp->flags = old->flags;
631 newp->xfrm_nr = old->xfrm_nr;
632 newp->index = old->index;
633 memcpy(newp->xfrm_vec, old->xfrm_vec,
634 newp->xfrm_nr*sizeof(struct xfrm_tmpl));
635 write_lock_bh(&xfrm_policy_lock);
636 __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir);
637 write_unlock_bh(&xfrm_policy_lock);
638 xfrm_pol_put(newp);
639 }
640 return newp;
641 }
642
643 int __xfrm_sk_clone_policy(struct sock *sk)
644 {
645 struct xfrm_policy *p0 = sk->sk_policy[0],
646 *p1 = sk->sk_policy[1];
647
648 sk->sk_policy[0] = sk->sk_policy[1] = NULL;
649 if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL)
650 return -ENOMEM;
651 if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL)
652 return -ENOMEM;
653 return 0;
654 }
655
656 /* Resolve list of templates for the flow, given policy. */
657
658 static int
659 xfrm_tmpl_resolve(struct xfrm_policy *policy, struct flowi *fl,
660 struct xfrm_state **xfrm,
661 unsigned short family)
662 {
663 int nx;
664 int i, error;
665 xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
666 xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
667
668 for (nx=0, i = 0; i < policy->xfrm_nr; i++) {
669 struct xfrm_state *x;
670 xfrm_address_t *remote = daddr;
671 xfrm_address_t *local = saddr;
672 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
673
674 if (tmpl->mode) {
675 remote = &tmpl->id.daddr;
676 local = &tmpl->saddr;
677 }
678
679 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
680
681 if (x && x->km.state == XFRM_STATE_VALID) {
682 xfrm[nx++] = x;
683 daddr = remote;
684 saddr = local;
685 continue;
686 }
687 if (x) {
688 error = (x->km.state == XFRM_STATE_ERROR ?
689 -EINVAL : -EAGAIN);
690 xfrm_state_put(x);
691 }
692
693 if (!tmpl->optional)
694 goto fail;
695 }
696 return nx;
697
698 fail:
699 for (nx--; nx>=0; nx--)
700 xfrm_state_put(xfrm[nx]);
701 return error;
702 }
703
704 /* Check that the bundle accepts the flow and its components are
705 * still valid.
706 */
707
708 static struct dst_entry *
709 xfrm_find_bundle(struct flowi *fl, struct xfrm_policy *policy, unsigned short family)
710 {
711 struct dst_entry *x;
712 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
713 if (unlikely(afinfo == NULL))
714 return ERR_PTR(-EINVAL);
715 x = afinfo->find_bundle(fl, policy);
716 xfrm_policy_put_afinfo(afinfo);
717 return x;
718 }
719
720 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
721 * all the metrics... Shortly, bundle a bundle.
722 */
723
724 static int
725 xfrm_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
726 struct flowi *fl, struct dst_entry **dst_p,
727 unsigned short family)
728 {
729 int err;
730 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
731 if (unlikely(afinfo == NULL))
732 return -EINVAL;
733 err = afinfo->bundle_create(policy, xfrm, nx, fl, dst_p);
734 xfrm_policy_put_afinfo(afinfo);
735 return err;
736 }
737
738 static inline int policy_to_flow_dir(int dir)
739 {
740 if (XFRM_POLICY_IN == FLOW_DIR_IN &&
741 XFRM_POLICY_OUT == FLOW_DIR_OUT &&
742 XFRM_POLICY_FWD == FLOW_DIR_FWD)
743 return dir;
744 switch (dir) {
745 default:
746 case XFRM_POLICY_IN:
747 return FLOW_DIR_IN;
748 case XFRM_POLICY_OUT:
749 return FLOW_DIR_OUT;
750 case XFRM_POLICY_FWD:
751 return FLOW_DIR_FWD;
752 };
753 }
754
755 static int stale_bundle(struct dst_entry *dst);
756
757 /* Main function: finds/creates a bundle for given flow.
758 *
759 * At the moment we eat a raw IP route. Mostly to speed up lookups
760 * on interfaces with disabled IPsec.
761 */
762 int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
763 struct sock *sk, int flags)
764 {
765 struct xfrm_policy *policy;
766 struct xfrm_state *xfrm[XFRM_MAX_DEPTH];
767 struct dst_entry *dst, *dst_orig = *dst_p;
768 int nx = 0;
769 int err;
770 u32 genid;
771 u16 family = dst_orig->ops->family;
772 restart:
773 genid = atomic_read(&flow_cache_genid);
774 policy = NULL;
775 if (sk && sk->sk_policy[1])
776 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
777
778 if (!policy) {
779 /* To accelerate a bit... */
780 if ((dst_orig->flags & DST_NOXFRM) || !xfrm_policy_list[XFRM_POLICY_OUT])
781 return 0;
782
783 policy = flow_cache_lookup(fl, family,
784 policy_to_flow_dir(XFRM_POLICY_OUT),
785 xfrm_policy_lookup);
786 }
787
788 if (!policy)
789 return 0;
790
791 policy->curlft.use_time = (unsigned long)xtime.tv_sec;
792
793 switch (policy->action) {
794 case XFRM_POLICY_BLOCK:
795 /* Prohibit the flow */
796 err = -EPERM;
797 goto error;
798
799 case XFRM_POLICY_ALLOW:
800 if (policy->xfrm_nr == 0) {
801 /* Flow passes not transformed. */
802 xfrm_pol_put(policy);
803 return 0;
804 }
805
806 /* Try to find matching bundle.
807 *
808 * LATER: help from flow cache. It is optional, this
809 * is required only for output policy.
810 */
811 dst = xfrm_find_bundle(fl, policy, family);
812 if (IS_ERR(dst)) {
813 err = PTR_ERR(dst);
814 goto error;
815 }
816
817 if (dst)
818 break;
819
820 nx = xfrm_tmpl_resolve(policy, fl, xfrm, family);
821
822 if (unlikely(nx<0)) {
823 err = nx;
824 if (err == -EAGAIN && flags) {
825 DECLARE_WAITQUEUE(wait, current);
826
827 add_wait_queue(&km_waitq, &wait);
828 set_current_state(TASK_INTERRUPTIBLE);
829 schedule();
830 set_current_state(TASK_RUNNING);
831 remove_wait_queue(&km_waitq, &wait);
832
833 nx = xfrm_tmpl_resolve(policy, fl, xfrm, family);
834
835 if (nx == -EAGAIN && signal_pending(current)) {
836 err = -ERESTART;
837 goto error;
838 }
839 if (nx == -EAGAIN ||
840 genid != atomic_read(&flow_cache_genid)) {
841 xfrm_pol_put(policy);
842 goto restart;
843 }
844 err = nx;
845 }
846 if (err < 0)
847 goto error;
848 }
849 if (nx == 0) {
850 /* Flow passes not transformed. */
851 xfrm_pol_put(policy);
852 return 0;
853 }
854
855 dst = dst_orig;
856 err = xfrm_bundle_create(policy, xfrm, nx, fl, &dst, family);
857
858 if (unlikely(err)) {
859 int i;
860 for (i=0; i<nx; i++)
861 xfrm_state_put(xfrm[i]);
862 goto error;
863 }
864
865 write_lock_bh(&policy->lock);
866 if (unlikely(policy->dead || stale_bundle(dst))) {
867 /* Wow! While we worked on resolving, this
868 * policy has gone. Retry. It is not paranoia,
869 * we just cannot enlist new bundle to dead object.
870 * We can't enlist stable bundles either.
871 */
872 write_unlock_bh(&policy->lock);
873
874 xfrm_pol_put(policy);
875 if (dst)
876 dst_free(dst);
877 goto restart;
878 }
879 dst->next = policy->bundles;
880 policy->bundles = dst;
881 dst_hold(dst);
882 write_unlock_bh(&policy->lock);
883 }
884 *dst_p = dst;
885 dst_release(dst_orig);
886 xfrm_pol_put(policy);
887 return 0;
888
889 error:
890 dst_release(dst_orig);
891 xfrm_pol_put(policy);
892 *dst_p = NULL;
893 return err;
894 }
895 EXPORT_SYMBOL(xfrm_lookup);
896
897 /* When skb is transformed back to its "native" form, we have to
898 * check policy restrictions. At the moment we make this in maximally
899 * stupid way. Shame on me. :-) Of course, connected sockets must
900 * have policy cached at them.
901 */
902
903 static inline int
904 xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
905 unsigned short family)
906 {
907 if (xfrm_state_kern(x))
908 return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, family);
909 return x->id.proto == tmpl->id.proto &&
910 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
911 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
912 x->props.mode == tmpl->mode &&
913 (tmpl->aalgos & (1<<x->props.aalgo)) &&
914 !(x->props.mode && xfrm_state_addr_cmp(tmpl, x, family));
915 }
916
917 static inline int
918 xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
919 unsigned short family)
920 {
921 int idx = start;
922
923 if (tmpl->optional) {
924 if (!tmpl->mode)
925 return start;
926 } else
927 start = -1;
928 for (; idx < sp->len; idx++) {
929 if (xfrm_state_ok(tmpl, sp->x[idx].xvec, family))
930 return ++idx;
931 if (sp->x[idx].xvec->props.mode)
932 break;
933 }
934 return start;
935 }
936
937 static int
938 _decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family)
939 {
940 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
941
942 if (unlikely(afinfo == NULL))
943 return -EAFNOSUPPORT;
944
945 afinfo->decode_session(skb, fl);
946 xfrm_policy_put_afinfo(afinfo);
947 return 0;
948 }
949
950 static inline int secpath_has_tunnel(struct sec_path *sp, int k)
951 {
952 for (; k < sp->len; k++) {
953 if (sp->x[k].xvec->props.mode)
954 return 1;
955 }
956
957 return 0;
958 }
959
960 int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
961 unsigned short family)
962 {
963 struct xfrm_policy *pol;
964 struct flowi fl;
965
966 if (_decode_session(skb, &fl, family) < 0)
967 return 0;
968
969 /* First, check used SA against their selectors. */
970 if (skb->sp) {
971 int i;
972
973 for (i=skb->sp->len-1; i>=0; i--) {
974 struct sec_decap_state *xvec = &(skb->sp->x[i]);
975 if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
976 return 0;
977
978 /* If there is a post_input processor, try running it */
979 if (xvec->xvec->type->post_input &&
980 (xvec->xvec->type->post_input)(xvec->xvec,
981 &(xvec->decap),
982 skb) != 0)
983 return 0;
984 }
985 }
986
987 pol = NULL;
988 if (sk && sk->sk_policy[dir])
989 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
990
991 if (!pol)
992 pol = flow_cache_lookup(&fl, family,
993 policy_to_flow_dir(dir),
994 xfrm_policy_lookup);
995
996 if (!pol)
997 return !skb->sp || !secpath_has_tunnel(skb->sp, 0);
998
999 pol->curlft.use_time = (unsigned long)xtime.tv_sec;
1000
1001 if (pol->action == XFRM_POLICY_ALLOW) {
1002 struct sec_path *sp;
1003 static struct sec_path dummy;
1004 int i, k;
1005
1006 if ((sp = skb->sp) == NULL)
1007 sp = &dummy;
1008
1009 /* For each tunnel xfrm, find the first matching tmpl.
1010 * For each tmpl before that, find corresponding xfrm.
1011 * Order is _important_. Later we will implement
1012 * some barriers, but at the moment barriers
1013 * are implied between each two transformations.
1014 */
1015 for (i = pol->xfrm_nr-1, k = 0; i >= 0; i--) {
1016 k = xfrm_policy_ok(pol->xfrm_vec+i, sp, k, family);
1017 if (k < 0)
1018 goto reject;
1019 }
1020
1021 if (secpath_has_tunnel(sp, k))
1022 goto reject;
1023
1024 xfrm_pol_put(pol);
1025 return 1;
1026 }
1027
1028 reject:
1029 xfrm_pol_put(pol);
1030 return 0;
1031 }
1032 EXPORT_SYMBOL(__xfrm_policy_check);
1033
1034 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1035 {
1036 struct flowi fl;
1037
1038 if (_decode_session(skb, &fl, family) < 0)
1039 return 0;
1040
1041 return xfrm_lookup(&skb->dst, &fl, NULL, 0) == 0;
1042 }
1043 EXPORT_SYMBOL(__xfrm_route_forward);
1044
1045 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
1046 {
1047 /* If it is marked obsolete, which is how we even get here,
1048 * then we have purged it from the policy bundle list and we
1049 * did that for a good reason.
1050 */
1051 return NULL;
1052 }
1053
1054 static int stale_bundle(struct dst_entry *dst)
1055 {
1056 return !xfrm_bundle_ok((struct xfrm_dst *)dst, NULL, AF_UNSPEC);
1057 }
1058
1059 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
1060 {
1061 while ((dst = dst->child) && dst->xfrm && dst->dev == dev) {
1062 dst->dev = &loopback_dev;
1063 dev_hold(&loopback_dev);
1064 dev_put(dev);
1065 }
1066 }
1067 EXPORT_SYMBOL(xfrm_dst_ifdown);
1068
1069 static void xfrm_link_failure(struct sk_buff *skb)
1070 {
1071 /* Impossible. Such dst must be popped before reaches point of failure. */
1072 return;
1073 }
1074
1075 static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
1076 {
1077 if (dst) {
1078 if (dst->obsolete) {
1079 dst_release(dst);
1080 dst = NULL;
1081 }
1082 }
1083 return dst;
1084 }
1085
1086 static void xfrm_prune_bundles(int (*func)(struct dst_entry *))
1087 {
1088 int i;
1089 struct xfrm_policy *pol;
1090 struct dst_entry *dst, **dstp, *gc_list = NULL;
1091
1092 read_lock_bh(&xfrm_policy_lock);
1093 for (i=0; i<2*XFRM_POLICY_MAX; i++) {
1094 for (pol = xfrm_policy_list[i]; pol; pol = pol->next) {
1095 write_lock(&pol->lock);
1096 dstp = &pol->bundles;
1097 while ((dst=*dstp) != NULL) {
1098 if (func(dst)) {
1099 *dstp = dst->next;
1100 dst->next = gc_list;
1101 gc_list = dst;
1102 } else {
1103 dstp = &dst->next;
1104 }
1105 }
1106 write_unlock(&pol->lock);
1107 }
1108 }
1109 read_unlock_bh(&xfrm_policy_lock);
1110
1111 while (gc_list) {
1112 dst = gc_list;
1113 gc_list = dst->next;
1114 dst_free(dst);
1115 }
1116 }
1117
1118 static int unused_bundle(struct dst_entry *dst)
1119 {
1120 return !atomic_read(&dst->__refcnt);
1121 }
1122
1123 static void __xfrm_garbage_collect(void)
1124 {
1125 xfrm_prune_bundles(unused_bundle);
1126 }
1127
1128 int xfrm_flush_bundles(void)
1129 {
1130 xfrm_prune_bundles(stale_bundle);
1131 return 0;
1132 }
1133
1134 static int always_true(struct dst_entry *dst)
1135 {
1136 return 1;
1137 }
1138
1139 void xfrm_flush_all_bundles(void)
1140 {
1141 xfrm_prune_bundles(always_true);
1142 }
1143
1144 void xfrm_init_pmtu(struct dst_entry *dst)
1145 {
1146 do {
1147 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1148 u32 pmtu, route_mtu_cached;
1149
1150 pmtu = dst_mtu(dst->child);
1151 xdst->child_mtu_cached = pmtu;
1152
1153 pmtu = xfrm_state_mtu(dst->xfrm, pmtu);
1154
1155 route_mtu_cached = dst_mtu(xdst->route);
1156 xdst->route_mtu_cached = route_mtu_cached;
1157
1158 if (pmtu > route_mtu_cached)
1159 pmtu = route_mtu_cached;
1160
1161 dst->metrics[RTAX_MTU-1] = pmtu;
1162 } while ((dst = dst->next));
1163 }
1164
1165 EXPORT_SYMBOL(xfrm_init_pmtu);
1166
1167 /* Check that the bundle accepts the flow and its components are
1168 * still valid.
1169 */
1170
1171 int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family)
1172 {
1173 struct dst_entry *dst = &first->u.dst;
1174 struct xfrm_dst *last;
1175 u32 mtu;
1176
1177 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) ||
1178 (dst->dev && !netif_running(dst->dev)))
1179 return 0;
1180
1181 last = NULL;
1182
1183 do {
1184 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1185
1186 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
1187 return 0;
1188 if (dst->xfrm->km.state != XFRM_STATE_VALID)
1189 return 0;
1190
1191 mtu = dst_mtu(dst->child);
1192 if (xdst->child_mtu_cached != mtu) {
1193 last = xdst;
1194 xdst->child_mtu_cached = mtu;
1195 }
1196
1197 if (!dst_check(xdst->route, xdst->route_cookie))
1198 return 0;
1199 mtu = dst_mtu(xdst->route);
1200 if (xdst->route_mtu_cached != mtu) {
1201 last = xdst;
1202 xdst->route_mtu_cached = mtu;
1203 }
1204
1205 dst = dst->child;
1206 } while (dst->xfrm);
1207
1208 if (likely(!last))
1209 return 1;
1210
1211 mtu = last->child_mtu_cached;
1212 for (;;) {
1213 dst = &last->u.dst;
1214
1215 mtu = xfrm_state_mtu(dst->xfrm, mtu);
1216 if (mtu > last->route_mtu_cached)
1217 mtu = last->route_mtu_cached;
1218 dst->metrics[RTAX_MTU-1] = mtu;
1219
1220 if (last == first)
1221 break;
1222
1223 last = last->u.next;
1224 last->child_mtu_cached = mtu;
1225 }
1226
1227 return 1;
1228 }
1229
1230 EXPORT_SYMBOL(xfrm_bundle_ok);
1231
1232 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
1233 {
1234 int err = 0;
1235 if (unlikely(afinfo == NULL))
1236 return -EINVAL;
1237 if (unlikely(afinfo->family >= NPROTO))
1238 return -EAFNOSUPPORT;
1239 write_lock(&xfrm_policy_afinfo_lock);
1240 if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
1241 err = -ENOBUFS;
1242 else {
1243 struct dst_ops *dst_ops = afinfo->dst_ops;
1244 if (likely(dst_ops->kmem_cachep == NULL))
1245 dst_ops->kmem_cachep = xfrm_dst_cache;
1246 if (likely(dst_ops->check == NULL))
1247 dst_ops->check = xfrm_dst_check;
1248 if (likely(dst_ops->negative_advice == NULL))
1249 dst_ops->negative_advice = xfrm_negative_advice;
1250 if (likely(dst_ops->link_failure == NULL))
1251 dst_ops->link_failure = xfrm_link_failure;
1252 if (likely(afinfo->garbage_collect == NULL))
1253 afinfo->garbage_collect = __xfrm_garbage_collect;
1254 xfrm_policy_afinfo[afinfo->family] = afinfo;
1255 }
1256 write_unlock(&xfrm_policy_afinfo_lock);
1257 return err;
1258 }
1259 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
1260
1261 int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
1262 {
1263 int err = 0;
1264 if (unlikely(afinfo == NULL))
1265 return -EINVAL;
1266 if (unlikely(afinfo->family >= NPROTO))
1267 return -EAFNOSUPPORT;
1268 write_lock(&xfrm_policy_afinfo_lock);
1269 if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
1270 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
1271 err = -EINVAL;
1272 else {
1273 struct dst_ops *dst_ops = afinfo->dst_ops;
1274 xfrm_policy_afinfo[afinfo->family] = NULL;
1275 dst_ops->kmem_cachep = NULL;
1276 dst_ops->check = NULL;
1277 dst_ops->negative_advice = NULL;
1278 dst_ops->link_failure = NULL;
1279 afinfo->garbage_collect = NULL;
1280 }
1281 }
1282 write_unlock(&xfrm_policy_afinfo_lock);
1283 return err;
1284 }
1285 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
1286
1287 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
1288 {
1289 struct xfrm_policy_afinfo *afinfo;
1290 if (unlikely(family >= NPROTO))
1291 return NULL;
1292 read_lock(&xfrm_policy_afinfo_lock);
1293 afinfo = xfrm_policy_afinfo[family];
1294 if (likely(afinfo != NULL))
1295 read_lock(&afinfo->lock);
1296 read_unlock(&xfrm_policy_afinfo_lock);
1297 return afinfo;
1298 }
1299
1300 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo)
1301 {
1302 if (unlikely(afinfo == NULL))
1303 return;
1304 read_unlock(&afinfo->lock);
1305 }
1306
1307 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
1308 {
1309 switch (event) {
1310 case NETDEV_DOWN:
1311 xfrm_flush_bundles();
1312 }
1313 return NOTIFY_DONE;
1314 }
1315
1316 static struct notifier_block xfrm_dev_notifier = {
1317 xfrm_dev_event,
1318 NULL,
1319 0
1320 };
1321
1322 static void __init xfrm_policy_init(void)
1323 {
1324 xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache",
1325 sizeof(struct xfrm_dst),
1326 0, SLAB_HWCACHE_ALIGN,
1327 NULL, NULL);
1328 if (!xfrm_dst_cache)
1329 panic("XFRM: failed to allocate xfrm_dst_cache\n");
1330
1331 INIT_WORK(&xfrm_policy_gc_work, xfrm_policy_gc_task, NULL);
1332 register_netdevice_notifier(&xfrm_dev_notifier);
1333 }
1334
1335 void __init xfrm_init(void)
1336 {
1337 xfrm_state_init();
1338 xfrm_policy_init();
1339 xfrm_input_init();
1340 }
1341
Linus' kernel tree