?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ACPI: thinkpad-acpi: add development version tag
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / xfrm / xfrm_policy.c
blob9fc4c315f6cd9702a223b5758d3f61e26c89808b
1 /*
2 * xfrm_policy.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * Kazunori MIYAZAWA @USAGI
10 * YOSHIFUJI Hideaki
11 * Split up af-specific portion
12 * Derek Atkins <derek@ihtfp.com> Add the post_input processor
13 *
14 */
15
16 #include <linux/err.h>
17 #include <linux/slab.h>
18 #include <linux/kmod.h>
19 #include <linux/list.h>
20 #include <linux/spinlock.h>
21 #include <linux/workqueue.h>
22 #include <linux/notifier.h>
23 #include <linux/netdevice.h>
24 #include <linux/netfilter.h>
25 #include <linux/module.h>
26 #include <linux/cache.h>
27 #include <linux/audit.h>
28 #include <net/dst.h>
29 #include <net/xfrm.h>
30 #include <net/ip.h>
31 #ifdef CONFIG_XFRM_STATISTICS
32 #include <net/snmp.h>
33 #endif
34
35 #include "xfrm_hash.h"
36
37 int sysctl_xfrm_larval_drop __read_mostly;
38
39 #ifdef CONFIG_XFRM_STATISTICS
40 DEFINE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics) __read_mostly;
41 EXPORT_SYMBOL(xfrm_statistics);
42 #endif
43
44 DEFINE_MUTEX(xfrm_cfg_mutex);
45 EXPORT_SYMBOL(xfrm_cfg_mutex);
46
47 static DEFINE_RWLOCK(xfrm_policy_lock);
48
49 unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];
50 EXPORT_SYMBOL(xfrm_policy_count);
51
52 static DEFINE_RWLOCK(xfrm_policy_afinfo_lock);
53 static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO];
54
55 static struct kmem_cache *xfrm_dst_cache __read_mostly;
56
57 static struct work_struct xfrm_policy_gc_work;
58 static HLIST_HEAD(xfrm_policy_gc_list);
59 static DEFINE_SPINLOCK(xfrm_policy_gc_lock);
60
61 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
62 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
63 static void xfrm_init_pmtu(struct dst_entry *dst);
64
65 static inline int
66 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
67 {
68 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
69 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
70 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
71 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
72 (fl->proto == sel->proto || !sel->proto) &&
73 (fl->oif == sel->ifindex || !sel->ifindex);
74 }
75
76 static inline int
77 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
78 {
79 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
80 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
81 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
82 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
83 (fl->proto == sel->proto || !sel->proto) &&
84 (fl->oif == sel->ifindex || !sel->ifindex);
85 }
86
87 int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
88 unsigned short family)
89 {
90 switch (family) {
91 case AF_INET:
92 return __xfrm4_selector_match(sel, fl);
93 case AF_INET6:
94 return __xfrm6_selector_match(sel, fl);
95 }
96 return 0;
97 }
98
99 static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, int tos,
100 int family)
101 {
102 xfrm_address_t *saddr = &x->props.saddr;
103 xfrm_address_t *daddr = &x->id.daddr;
104 struct xfrm_policy_afinfo *afinfo;
105 struct dst_entry *dst;
106
107 if (x->type->flags & XFRM_TYPE_LOCAL_COADDR)
108 saddr = x->coaddr;
109 if (x->type->flags & XFRM_TYPE_REMOTE_COADDR)
110 daddr = x->coaddr;
111
112 afinfo = xfrm_policy_get_afinfo(family);
113 if (unlikely(afinfo == NULL))
114 return ERR_PTR(-EAFNOSUPPORT);
115
116 dst = afinfo->dst_lookup(tos, saddr, daddr);
117 xfrm_policy_put_afinfo(afinfo);
118 return dst;
119 }
120
121 static inline unsigned long make_jiffies(long secs)
122 {
123 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
124 return MAX_SCHEDULE_TIMEOUT-1;
125 else
126 return secs*HZ;
127 }
128
129 static void xfrm_policy_timer(unsigned long data)
130 {
131 struct xfrm_policy *xp = (struct xfrm_policy*)data;
132 unsigned long now = get_seconds();
133 long next = LONG_MAX;
134 int warn = 0;
135 int dir;
136
137 read_lock(&xp->lock);
138
139 if (xp->dead)
140 goto out;
141
142 dir = xfrm_policy_id2dir(xp->index);
143
144 if (xp->lft.hard_add_expires_seconds) {
145 long tmo = xp->lft.hard_add_expires_seconds +
146 xp->curlft.add_time - now;
147 if (tmo <= 0)
148 goto expired;
149 if (tmo < next)
150 next = tmo;
151 }
152 if (xp->lft.hard_use_expires_seconds) {
153 long tmo = xp->lft.hard_use_expires_seconds +
154 (xp->curlft.use_time ? : xp->curlft.add_time) - now;
155 if (tmo <= 0)
156 goto expired;
157 if (tmo < next)
158 next = tmo;
159 }
160 if (xp->lft.soft_add_expires_seconds) {
161 long tmo = xp->lft.soft_add_expires_seconds +
162 xp->curlft.add_time - now;
163 if (tmo <= 0) {
164 warn = 1;
165 tmo = XFRM_KM_TIMEOUT;
166 }
167 if (tmo < next)
168 next = tmo;
169 }
170 if (xp->lft.soft_use_expires_seconds) {
171 long tmo = xp->lft.soft_use_expires_seconds +
172 (xp->curlft.use_time ? : xp->curlft.add_time) - now;
173 if (tmo <= 0) {
174 warn = 1;
175 tmo = XFRM_KM_TIMEOUT;
176 }
177 if (tmo < next)
178 next = tmo;
179 }
180
181 if (warn)
182 km_policy_expired(xp, dir, 0, 0);
183 if (next != LONG_MAX &&
184 !mod_timer(&xp->timer, jiffies + make_jiffies(next)))
185 xfrm_pol_hold(xp);
186
187 out:
188 read_unlock(&xp->lock);
189 xfrm_pol_put(xp);
190 return;
191
192 expired:
193 read_unlock(&xp->lock);
194 if (!xfrm_policy_delete(xp, dir))
195 km_policy_expired(xp, dir, 1, 0);
196 xfrm_pol_put(xp);
197 }
198
199
200 /* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2
201 * SPD calls.
202 */
203
204 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp)
205 {
206 struct xfrm_policy *policy;
207
208 policy = kzalloc(sizeof(struct xfrm_policy), gfp);
209
210 if (policy) {
211 INIT_HLIST_NODE(&policy->bydst);
212 INIT_HLIST_NODE(&policy->byidx);
213 rwlock_init(&policy->lock);
214 atomic_set(&policy->refcnt, 1);
215 setup_timer(&policy->timer, xfrm_policy_timer,
216 (unsigned long)policy);
217 }
218 return policy;
219 }
220 EXPORT_SYMBOL(xfrm_policy_alloc);
221
222 /* Destroy xfrm_policy: descendant resources must be released to this moment. */
223
224 void xfrm_policy_destroy(struct xfrm_policy *policy)
225 {
226 BUG_ON(!policy->dead);
227
228 BUG_ON(policy->bundles);
229
230 if (del_timer(&policy->timer))
231 BUG();
232
233 security_xfrm_policy_free(policy);
234 kfree(policy);
235 }
236 EXPORT_SYMBOL(xfrm_policy_destroy);
237
238 static void xfrm_policy_gc_kill(struct xfrm_policy *policy)
239 {
240 struct dst_entry *dst;
241
242 while ((dst = policy->bundles) != NULL) {
243 policy->bundles = dst->next;
244 dst_free(dst);
245 }
246
247 if (del_timer(&policy->timer))
248 atomic_dec(&policy->refcnt);
249
250 if (atomic_read(&policy->refcnt) > 1)
251 flow_cache_flush();
252
253 xfrm_pol_put(policy);
254 }
255
256 static void xfrm_policy_gc_task(struct work_struct *work)
257 {
258 struct xfrm_policy *policy;
259 struct hlist_node *entry, *tmp;
260 struct hlist_head gc_list;
261
262 spin_lock_bh(&xfrm_policy_gc_lock);
263 gc_list.first = xfrm_policy_gc_list.first;
264 INIT_HLIST_HEAD(&xfrm_policy_gc_list);
265 spin_unlock_bh(&xfrm_policy_gc_lock);
266
267 hlist_for_each_entry_safe(policy, entry, tmp, &gc_list, bydst)
268 xfrm_policy_gc_kill(policy);
269 }
270
271 /* Rule must be locked. Release descentant resources, announce
272 * entry dead. The rule must be unlinked from lists to the moment.
273 */
274
275 static void xfrm_policy_kill(struct xfrm_policy *policy)
276 {
277 int dead;
278
279 write_lock_bh(&policy->lock);
280 dead = policy->dead;
281 policy->dead = 1;
282 write_unlock_bh(&policy->lock);
283
284 if (unlikely(dead)) {
285 WARN_ON(1);
286 return;
287 }
288
289 spin_lock(&xfrm_policy_gc_lock);
290 hlist_add_head(&policy->bydst, &xfrm_policy_gc_list);
291 spin_unlock(&xfrm_policy_gc_lock);
292
293 schedule_work(&xfrm_policy_gc_work);
294 }
295
296 struct xfrm_policy_hash {
297 struct hlist_head *table;
298 unsigned int hmask;
299 };
300
301 static struct hlist_head xfrm_policy_inexact[XFRM_POLICY_MAX*2];
302 static struct xfrm_policy_hash xfrm_policy_bydst[XFRM_POLICY_MAX*2] __read_mostly;
303 static struct hlist_head *xfrm_policy_byidx __read_mostly;
304 static unsigned int xfrm_idx_hmask __read_mostly;
305 static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024;
306
307 static inline unsigned int idx_hash(u32 index)
308 {
309 return __idx_hash(index, xfrm_idx_hmask);
310 }
311
312 static struct hlist_head *policy_hash_bysel(struct xfrm_selector *sel, unsigned short family, int dir)
313 {
314 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
315 unsigned int hash = __sel_hash(sel, family, hmask);
316
317 return (hash == hmask + 1 ?
318 &xfrm_policy_inexact[dir] :
319 xfrm_policy_bydst[dir].table + hash);
320 }
321
322 static struct hlist_head *policy_hash_direct(xfrm_address_t *daddr, xfrm_address_t *saddr, unsigned short family, int dir)
323 {
324 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
325 unsigned int hash = __addr_hash(daddr, saddr, family, hmask);
326
327 return xfrm_policy_bydst[dir].table + hash;
328 }
329
330 static void xfrm_dst_hash_transfer(struct hlist_head *list,
331 struct hlist_head *ndsttable,
332 unsigned int nhashmask)
333 {
334 struct hlist_node *entry, *tmp, *entry0 = NULL;
335 struct xfrm_policy *pol;
336 unsigned int h0 = 0;
337
338 redo:
339 hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) {
340 unsigned int h;
341
342 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr,
343 pol->family, nhashmask);
344 if (!entry0) {
345 hlist_del(entry);
346 hlist_add_head(&pol->bydst, ndsttable+h);
347 h0 = h;
348 } else {
349 if (h != h0)
350 continue;
351 hlist_del(entry);
352 hlist_add_after(entry0, &pol->bydst);
353 }
354 entry0 = entry;
355 }
356 if (!hlist_empty(list)) {
357 entry0 = NULL;
358 goto redo;
359 }
360 }
361
362 static void xfrm_idx_hash_transfer(struct hlist_head *list,
363 struct hlist_head *nidxtable,
364 unsigned int nhashmask)
365 {
366 struct hlist_node *entry, *tmp;
367 struct xfrm_policy *pol;
368
369 hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) {
370 unsigned int h;
371
372 h = __idx_hash(pol->index, nhashmask);
373 hlist_add_head(&pol->byidx, nidxtable+h);
374 }
375 }
376
377 static unsigned long xfrm_new_hash_mask(unsigned int old_hmask)
378 {
379 return ((old_hmask + 1) << 1) - 1;
380 }
381
382 static void xfrm_bydst_resize(int dir)
383 {
384 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
385 unsigned int nhashmask = xfrm_new_hash_mask(hmask);
386 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
387 struct hlist_head *odst = xfrm_policy_bydst[dir].table;
388 struct hlist_head *ndst = xfrm_hash_alloc(nsize);
389 int i;
390
391 if (!ndst)
392 return;
393
394 write_lock_bh(&xfrm_policy_lock);
395
396 for (i = hmask; i >= 0; i--)
397 xfrm_dst_hash_transfer(odst + i, ndst, nhashmask);
398
399 xfrm_policy_bydst[dir].table = ndst;
400 xfrm_policy_bydst[dir].hmask = nhashmask;
401
402 write_unlock_bh(&xfrm_policy_lock);
403
404 xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head));
405 }
406
407 static void xfrm_byidx_resize(int total)
408 {
409 unsigned int hmask = xfrm_idx_hmask;
410 unsigned int nhashmask = xfrm_new_hash_mask(hmask);
411 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
412 struct hlist_head *oidx = xfrm_policy_byidx;
413 struct hlist_head *nidx = xfrm_hash_alloc(nsize);
414 int i;
415
416 if (!nidx)
417 return;
418
419 write_lock_bh(&xfrm_policy_lock);
420
421 for (i = hmask; i >= 0; i--)
422 xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask);
423
424 xfrm_policy_byidx = nidx;
425 xfrm_idx_hmask = nhashmask;
426
427 write_unlock_bh(&xfrm_policy_lock);
428
429 xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head));
430 }
431
432 static inline int xfrm_bydst_should_resize(int dir, int *total)
433 {
434 unsigned int cnt = xfrm_policy_count[dir];
435 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
436
437 if (total)
438 *total += cnt;
439
440 if ((hmask + 1) < xfrm_policy_hashmax &&
441 cnt > hmask)
442 return 1;
443
444 return 0;
445 }
446
447 static inline int xfrm_byidx_should_resize(int total)
448 {
449 unsigned int hmask = xfrm_idx_hmask;
450
451 if ((hmask + 1) < xfrm_policy_hashmax &&
452 total > hmask)
453 return 1;
454
455 return 0;
456 }
457
458 void xfrm_spd_getinfo(struct xfrmk_spdinfo *si)
459 {
460 read_lock_bh(&xfrm_policy_lock);
461 si->incnt = xfrm_policy_count[XFRM_POLICY_IN];
462 si->outcnt = xfrm_policy_count[XFRM_POLICY_OUT];
463 si->fwdcnt = xfrm_policy_count[XFRM_POLICY_FWD];
464 si->inscnt = xfrm_policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
465 si->outscnt = xfrm_policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
466 si->fwdscnt = xfrm_policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
467 si->spdhcnt = xfrm_idx_hmask;
468 si->spdhmcnt = xfrm_policy_hashmax;
469 read_unlock_bh(&xfrm_policy_lock);
470 }
471 EXPORT_SYMBOL(xfrm_spd_getinfo);
472
473 static DEFINE_MUTEX(hash_resize_mutex);
474 static void xfrm_hash_resize(struct work_struct *__unused)
475 {
476 int dir, total;
477
478 mutex_lock(&hash_resize_mutex);
479
480 total = 0;
481 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
482 if (xfrm_bydst_should_resize(dir, &total))
483 xfrm_bydst_resize(dir);
484 }
485 if (xfrm_byidx_should_resize(total))
486 xfrm_byidx_resize(total);
487
488 mutex_unlock(&hash_resize_mutex);
489 }
490
491 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
492
493 /* Generate new index... KAME seems to generate them ordered by cost
494 * of an absolute inpredictability of ordering of rules. This will not pass. */
495 static u32 xfrm_gen_index(u8 type, int dir)
496 {
497 static u32 idx_generator;
498
499 for (;;) {
500 struct hlist_node *entry;
501 struct hlist_head *list;
502 struct xfrm_policy *p;
503 u32 idx;
504 int found;
505
506 idx = (idx_generator | dir);
507 idx_generator += 8;
508 if (idx == 0)
509 idx = 8;
510 list = xfrm_policy_byidx + idx_hash(idx);
511 found = 0;
512 hlist_for_each_entry(p, entry, list, byidx) {
513 if (p->index == idx) {
514 found = 1;
515 break;
516 }
517 }
518 if (!found)
519 return idx;
520 }
521 }
522
523 static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s2)
524 {
525 u32 *p1 = (u32 *) s1;
526 u32 *p2 = (u32 *) s2;
527 int len = sizeof(struct xfrm_selector) / sizeof(u32);
528 int i;
529
530 for (i = 0; i < len; i++) {
531 if (p1[i] != p2[i])
532 return 1;
533 }
534
535 return 0;
536 }
537
538 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
539 {
540 struct xfrm_policy *pol;
541 struct xfrm_policy *delpol;
542 struct hlist_head *chain;
543 struct hlist_node *entry, *newpos;
544 struct dst_entry *gc_list;
545
546 write_lock_bh(&xfrm_policy_lock);
547 chain = policy_hash_bysel(&policy->selector, policy->family, dir);
548 delpol = NULL;
549 newpos = NULL;
550 hlist_for_each_entry(pol, entry, chain, bydst) {
551 if (pol->type == policy->type &&
552 !selector_cmp(&pol->selector, &policy->selector) &&
553 xfrm_sec_ctx_match(pol->security, policy->security) &&
554 !WARN_ON(delpol)) {
555 if (excl) {
556 write_unlock_bh(&xfrm_policy_lock);
557 return -EEXIST;
558 }
559 delpol = pol;
560 if (policy->priority > pol->priority)
561 continue;
562 } else if (policy->priority >= pol->priority) {
563 newpos = &pol->bydst;
564 continue;
565 }
566 if (delpol)
567 break;
568 }
569 if (newpos)
570 hlist_add_after(newpos, &policy->bydst);
571 else
572 hlist_add_head(&policy->bydst, chain);
573 xfrm_pol_hold(policy);
574 xfrm_policy_count[dir]++;
575 atomic_inc(&flow_cache_genid);
576 if (delpol) {
577 hlist_del(&delpol->bydst);
578 hlist_del(&delpol->byidx);
579 xfrm_policy_count[dir]--;
580 }
581 policy->index = delpol ? delpol->index : xfrm_gen_index(policy->type, dir);
582 hlist_add_head(&policy->byidx, xfrm_policy_byidx+idx_hash(policy->index));
583 policy->curlft.add_time = get_seconds();
584 policy->curlft.use_time = 0;
585 if (!mod_timer(&policy->timer, jiffies + HZ))
586 xfrm_pol_hold(policy);
587 write_unlock_bh(&xfrm_policy_lock);
588
589 if (delpol)
590 xfrm_policy_kill(delpol);
591 else if (xfrm_bydst_should_resize(dir, NULL))
592 schedule_work(&xfrm_hash_work);
593
594 read_lock_bh(&xfrm_policy_lock);
595 gc_list = NULL;
596 entry = &policy->bydst;
597 hlist_for_each_entry_continue(policy, entry, bydst) {
598 struct dst_entry *dst;
599
600 write_lock(&policy->lock);
601 dst = policy->bundles;
602 if (dst) {
603 struct dst_entry *tail = dst;
604 while (tail->next)
605 tail = tail->next;
606 tail->next = gc_list;
607 gc_list = dst;
608
609 policy->bundles = NULL;
610 }
611 write_unlock(&policy->lock);
612 }
613 read_unlock_bh(&xfrm_policy_lock);
614
615 while (gc_list) {
616 struct dst_entry *dst = gc_list;
617
618 gc_list = dst->next;
619 dst_free(dst);
620 }
621
622 return 0;
623 }
624 EXPORT_SYMBOL(xfrm_policy_insert);
625
626 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
627 struct xfrm_selector *sel,
628 struct xfrm_sec_ctx *ctx, int delete,
629 int *err)
630 {
631 struct xfrm_policy *pol, *ret;
632 struct hlist_head *chain;
633 struct hlist_node *entry;
634
635 *err = 0;
636 write_lock_bh(&xfrm_policy_lock);
637 chain = policy_hash_bysel(sel, sel->family, dir);
638 ret = NULL;
639 hlist_for_each_entry(pol, entry, chain, bydst) {
640 if (pol->type == type &&
641 !selector_cmp(sel, &pol->selector) &&
642 xfrm_sec_ctx_match(ctx, pol->security)) {
643 xfrm_pol_hold(pol);
644 if (delete) {
645 *err = security_xfrm_policy_delete(pol);
646 if (*err) {
647 write_unlock_bh(&xfrm_policy_lock);
648 return pol;
649 }
650 hlist_del(&pol->bydst);
651 hlist_del(&pol->byidx);
652 xfrm_policy_count[dir]--;
653 }
654 ret = pol;
655 break;
656 }
657 }
658 write_unlock_bh(&xfrm_policy_lock);
659
660 if (ret && delete) {
661 atomic_inc(&flow_cache_genid);
662 xfrm_policy_kill(ret);
663 }
664 return ret;
665 }
666 EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
667
668 struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
669 int *err)
670 {
671 struct xfrm_policy *pol, *ret;
672 struct hlist_head *chain;
673 struct hlist_node *entry;
674
675 *err = -ENOENT;
676 if (xfrm_policy_id2dir(id) != dir)
677 return NULL;
678
679 *err = 0;
680 write_lock_bh(&xfrm_policy_lock);
681 chain = xfrm_policy_byidx + idx_hash(id);
682 ret = NULL;
683 hlist_for_each_entry(pol, entry, chain, byidx) {
684 if (pol->type == type && pol->index == id) {
685 xfrm_pol_hold(pol);
686 if (delete) {
687 *err = security_xfrm_policy_delete(pol);
688 if (*err) {
689 write_unlock_bh(&xfrm_policy_lock);
690 return pol;
691 }
692 hlist_del(&pol->bydst);
693 hlist_del(&pol->byidx);
694 xfrm_policy_count[dir]--;
695 }
696 ret = pol;
697 break;
698 }
699 }
700 write_unlock_bh(&xfrm_policy_lock);
701
702 if (ret && delete) {
703 atomic_inc(&flow_cache_genid);
704 xfrm_policy_kill(ret);
705 }
706 return ret;
707 }
708 EXPORT_SYMBOL(xfrm_policy_byid);
709
710 #ifdef CONFIG_SECURITY_NETWORK_XFRM
711 static inline int
712 xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
713 {
714 int dir, err = 0;
715
716 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
717 struct xfrm_policy *pol;
718 struct hlist_node *entry;
719 int i;
720
721 hlist_for_each_entry(pol, entry,
722 &xfrm_policy_inexact[dir], bydst) {
723 if (pol->type != type)
724 continue;
725 err = security_xfrm_policy_delete(pol);
726 if (err) {
727 xfrm_audit_policy_delete(pol, 0,
728 audit_info->loginuid,
729 audit_info->secid);
730 return err;
731 }
732 }
733 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
734 hlist_for_each_entry(pol, entry,
735 xfrm_policy_bydst[dir].table + i,
736 bydst) {
737 if (pol->type != type)
738 continue;
739 err = security_xfrm_policy_delete(pol);
740 if (err) {
741 xfrm_audit_policy_delete(pol, 0,
742 audit_info->loginuid,
743 audit_info->secid);
744 return err;
745 }
746 }
747 }
748 }
749 return err;
750 }
751 #else
752 static inline int
753 xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
754 {
755 return 0;
756 }
757 #endif
758
759 int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
760 {
761 int dir, err = 0;
762
763 write_lock_bh(&xfrm_policy_lock);
764
765 err = xfrm_policy_flush_secctx_check(type, audit_info);
766 if (err)
767 goto out;
768
769 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
770 struct xfrm_policy *pol;
771 struct hlist_node *entry;
772 int i, killed;
773
774 killed = 0;
775 again1:
776 hlist_for_each_entry(pol, entry,
777 &xfrm_policy_inexact[dir], bydst) {
778 if (pol->type != type)
779 continue;
780 hlist_del(&pol->bydst);
781 hlist_del(&pol->byidx);
782 write_unlock_bh(&xfrm_policy_lock);
783
784 xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,
785 audit_info->secid);
786
787 xfrm_policy_kill(pol);
788 killed++;
789
790 write_lock_bh(&xfrm_policy_lock);
791 goto again1;
792 }
793
794 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
795 again2:
796 hlist_for_each_entry(pol, entry,
797 xfrm_policy_bydst[dir].table + i,
798 bydst) {
799 if (pol->type != type)
800 continue;
801 hlist_del(&pol->bydst);
802 hlist_del(&pol->byidx);
803 write_unlock_bh(&xfrm_policy_lock);
804
805 xfrm_audit_policy_delete(pol, 1,
806 audit_info->loginuid,
807 audit_info->secid);
808 xfrm_policy_kill(pol);
809 killed++;
810
811 write_lock_bh(&xfrm_policy_lock);
812 goto again2;
813 }
814 }
815
816 xfrm_policy_count[dir] -= killed;
817 }
818 atomic_inc(&flow_cache_genid);
819 out:
820 write_unlock_bh(&xfrm_policy_lock);
821 return err;
822 }
823 EXPORT_SYMBOL(xfrm_policy_flush);
824
825 int xfrm_policy_walk(u8 type, int (*func)(struct xfrm_policy *, int, int, void*),
826 void *data)
827 {
828 struct xfrm_policy *pol, *last = NULL;
829 struct hlist_node *entry;
830 int dir, last_dir = 0, count, error;
831
832 read_lock_bh(&xfrm_policy_lock);
833 count = 0;
834
835 for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) {
836 struct hlist_head *table = xfrm_policy_bydst[dir].table;
837 int i;
838
839 hlist_for_each_entry(pol, entry,
840 &xfrm_policy_inexact[dir], bydst) {
841 if (pol->type != type)
842 continue;
843 if (last) {
844 error = func(last, last_dir % XFRM_POLICY_MAX,
845 count, data);
846 if (error)
847 goto out;
848 }
849 last = pol;
850 last_dir = dir;
851 count++;
852 }
853 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
854 hlist_for_each_entry(pol, entry, table + i, bydst) {
855 if (pol->type != type)
856 continue;
857 if (last) {
858 error = func(last, last_dir % XFRM_POLICY_MAX,
859 count, data);
860 if (error)
861 goto out;
862 }
863 last = pol;
864 last_dir = dir;
865 count++;
866 }
867 }
868 }
869 if (count == 0) {
870 error = -ENOENT;
871 goto out;
872 }
873 error = func(last, last_dir % XFRM_POLICY_MAX, 0, data);
874 out:
875 read_unlock_bh(&xfrm_policy_lock);
876 return error;
877 }
878 EXPORT_SYMBOL(xfrm_policy_walk);
879
880 /*
881 * Find policy to apply to this flow.
882 *
883 * Returns 0 if policy found, else an -errno.
884 */
885 static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,
886 u8 type, u16 family, int dir)
887 {
888 struct xfrm_selector *sel = &pol->selector;
889 int match, ret = -ESRCH;
890
891 if (pol->family != family ||
892 pol->type != type)
893 return ret;
894
895 match = xfrm_selector_match(sel, fl, family);
896 if (match)
897 ret = security_xfrm_policy_lookup(pol, fl->secid, dir);
898
899 return ret;
900 }
901
902 static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
903 u16 family, u8 dir)
904 {
905 int err;
906 struct xfrm_policy *pol, *ret;
907 xfrm_address_t *daddr, *saddr;
908 struct hlist_node *entry;
909 struct hlist_head *chain;
910 u32 priority = ~0U;
911
912 daddr = xfrm_flowi_daddr(fl, family);
913 saddr = xfrm_flowi_saddr(fl, family);
914 if (unlikely(!daddr || !saddr))
915 return NULL;
916
917 read_lock_bh(&xfrm_policy_lock);
918 chain = policy_hash_direct(daddr, saddr, family, dir);
919 ret = NULL;
920 hlist_for_each_entry(pol, entry, chain, bydst) {
921 err = xfrm_policy_match(pol, fl, type, family, dir);
922 if (err) {
923 if (err == -ESRCH)
924 continue;
925 else {
926 ret = ERR_PTR(err);
927 goto fail;
928 }
929 } else {
930 ret = pol;
931 priority = ret->priority;
932 break;
933 }
934 }
935 chain = &xfrm_policy_inexact[dir];
936 hlist_for_each_entry(pol, entry, chain, bydst) {
937 err = xfrm_policy_match(pol, fl, type, family, dir);
938 if (err) {
939 if (err == -ESRCH)
940 continue;
941 else {
942 ret = ERR_PTR(err);
943 goto fail;
944 }
945 } else if (pol->priority < priority) {
946 ret = pol;
947 break;
948 }
949 }
950 if (ret)
951 xfrm_pol_hold(ret);
952 fail:
953 read_unlock_bh(&xfrm_policy_lock);
954
955 return ret;
956 }
957
958 static int xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
959 void **objp, atomic_t **obj_refp)
960 {
961 struct xfrm_policy *pol;
962 int err = 0;
963
964 #ifdef CONFIG_XFRM_SUB_POLICY
965 pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_SUB, fl, family, dir);
966 if (IS_ERR(pol)) {
967 err = PTR_ERR(pol);
968 pol = NULL;
969 }
970 if (pol || err)
971 goto end;
972 #endif
973 pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, fl, family, dir);
974 if (IS_ERR(pol)) {
975 err = PTR_ERR(pol);
976 pol = NULL;
977 }
978 #ifdef CONFIG_XFRM_SUB_POLICY
979 end:
980 #endif
981 if ((*objp = (void *) pol) != NULL)
982 *obj_refp = &pol->refcnt;
983 return err;
984 }
985
986 static inline int policy_to_flow_dir(int dir)
987 {
988 if (XFRM_POLICY_IN == FLOW_DIR_IN &&
989 XFRM_POLICY_OUT == FLOW_DIR_OUT &&
990 XFRM_POLICY_FWD == FLOW_DIR_FWD)
991 return dir;
992 switch (dir) {
993 default:
994 case XFRM_POLICY_IN:
995 return FLOW_DIR_IN;
996 case XFRM_POLICY_OUT:
997 return FLOW_DIR_OUT;
998 case XFRM_POLICY_FWD:
999 return FLOW_DIR_FWD;
1000 }
1001 }
1002
1003 static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl)
1004 {
1005 struct xfrm_policy *pol;
1006
1007 read_lock_bh(&xfrm_policy_lock);
1008 if ((pol = sk->sk_policy[dir]) != NULL) {
1009 int match = xfrm_selector_match(&pol->selector, fl,
1010 sk->sk_family);
1011 int err = 0;
1012
1013 if (match) {
1014 err = security_xfrm_policy_lookup(pol, fl->secid,
1015 policy_to_flow_dir(dir));
1016 if (!err)
1017 xfrm_pol_hold(pol);
1018 else if (err == -ESRCH)
1019 pol = NULL;
1020 else
1021 pol = ERR_PTR(err);
1022 } else
1023 pol = NULL;
1024 }
1025 read_unlock_bh(&xfrm_policy_lock);
1026 return pol;
1027 }
1028
1029 static void __xfrm_policy_link(struct xfrm_policy *pol, int dir)
1030 {
1031 struct hlist_head *chain = policy_hash_bysel(&pol->selector,
1032 pol->family, dir);
1033
1034 hlist_add_head(&pol->bydst, chain);
1035 hlist_add_head(&pol->byidx, xfrm_policy_byidx+idx_hash(pol->index));
1036 xfrm_policy_count[dir]++;
1037 xfrm_pol_hold(pol);
1038
1039 if (xfrm_bydst_should_resize(dir, NULL))
1040 schedule_work(&xfrm_hash_work);
1041 }
1042
1043 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
1044 int dir)
1045 {
1046 if (hlist_unhashed(&pol->bydst))
1047 return NULL;
1048
1049 hlist_del(&pol->bydst);
1050 hlist_del(&pol->byidx);
1051 xfrm_policy_count[dir]--;
1052
1053 return pol;
1054 }
1055
1056 int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
1057 {
1058 write_lock_bh(&xfrm_policy_lock);
1059 pol = __xfrm_policy_unlink(pol, dir);
1060 write_unlock_bh(&xfrm_policy_lock);
1061 if (pol) {
1062 if (dir < XFRM_POLICY_MAX)
1063 atomic_inc(&flow_cache_genid);
1064 xfrm_policy_kill(pol);
1065 return 0;
1066 }
1067 return -ENOENT;
1068 }
1069 EXPORT_SYMBOL(xfrm_policy_delete);
1070
1071 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
1072 {
1073 struct xfrm_policy *old_pol;
1074
1075 #ifdef CONFIG_XFRM_SUB_POLICY
1076 if (pol && pol->type != XFRM_POLICY_TYPE_MAIN)
1077 return -EINVAL;
1078 #endif
1079
1080 write_lock_bh(&xfrm_policy_lock);
1081 old_pol = sk->sk_policy[dir];
1082 sk->sk_policy[dir] = pol;
1083 if (pol) {
1084 pol->curlft.add_time = get_seconds();
1085 pol->index = xfrm_gen_index(pol->type, XFRM_POLICY_MAX+dir);
1086 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
1087 }
1088 if (old_pol)
1089 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
1090 write_unlock_bh(&xfrm_policy_lock);
1091
1092 if (old_pol) {
1093 xfrm_policy_kill(old_pol);
1094 }
1095 return 0;
1096 }
1097
1098 static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
1099 {
1100 struct xfrm_policy *newp = xfrm_policy_alloc(GFP_ATOMIC);
1101
1102 if (newp) {
1103 newp->selector = old->selector;
1104 if (security_xfrm_policy_clone(old, newp)) {
1105 kfree(newp);
1106 return NULL; /* ENOMEM */
1107 }
1108 newp->lft = old->lft;
1109 newp->curlft = old->curlft;
1110 newp->action = old->action;
1111 newp->flags = old->flags;
1112 newp->xfrm_nr = old->xfrm_nr;
1113 newp->index = old->index;
1114 newp->type = old->type;
1115 memcpy(newp->xfrm_vec, old->xfrm_vec,
1116 newp->xfrm_nr*sizeof(struct xfrm_tmpl));
1117 write_lock_bh(&xfrm_policy_lock);
1118 __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir);
1119 write_unlock_bh(&xfrm_policy_lock);
1120 xfrm_pol_put(newp);
1121 }
1122 return newp;
1123 }
1124
1125 int __xfrm_sk_clone_policy(struct sock *sk)
1126 {
1127 struct xfrm_policy *p0 = sk->sk_policy[0],
1128 *p1 = sk->sk_policy[1];
1129
1130 sk->sk_policy[0] = sk->sk_policy[1] = NULL;
1131 if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL)
1132 return -ENOMEM;
1133 if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL)
1134 return -ENOMEM;
1135 return 0;
1136 }
1137
1138 static int
1139 xfrm_get_saddr(xfrm_address_t *local, xfrm_address_t *remote,
1140 unsigned short family)
1141 {
1142 int err;
1143 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1144
1145 if (unlikely(afinfo == NULL))
1146 return -EINVAL;
1147 err = afinfo->get_saddr(local, remote);
1148 xfrm_policy_put_afinfo(afinfo);
1149 return err;
1150 }
1151
1152 /* Resolve list of templates for the flow, given policy. */
1153
1154 static int
1155 xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
1156 struct xfrm_state **xfrm,
1157 unsigned short family)
1158 {
1159 int nx;
1160 int i, error;
1161 xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
1162 xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
1163 xfrm_address_t tmp;
1164
1165 for (nx=0, i = 0; i < policy->xfrm_nr; i++) {
1166 struct xfrm_state *x;
1167 xfrm_address_t *remote = daddr;
1168 xfrm_address_t *local = saddr;
1169 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
1170
1171 if (tmpl->mode == XFRM_MODE_TUNNEL ||
1172 tmpl->mode == XFRM_MODE_BEET) {
1173 remote = &tmpl->id.daddr;
1174 local = &tmpl->saddr;
1175 family = tmpl->encap_family;
1176 if (xfrm_addr_any(local, family)) {
1177 error = xfrm_get_saddr(&tmp, remote, family);
1178 if (error)
1179 goto fail;
1180 local = &tmp;
1181 }
1182 }
1183
1184 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
1185
1186 if (x && x->km.state == XFRM_STATE_VALID) {
1187 xfrm[nx++] = x;
1188 daddr = remote;
1189 saddr = local;
1190 continue;
1191 }
1192 if (x) {
1193 error = (x->km.state == XFRM_STATE_ERROR ?
1194 -EINVAL : -EAGAIN);
1195 xfrm_state_put(x);
1196 }
1197
1198 if (!tmpl->optional)
1199 goto fail;
1200 }
1201 return nx;
1202
1203 fail:
1204 for (nx--; nx>=0; nx--)
1205 xfrm_state_put(xfrm[nx]);
1206 return error;
1207 }
1208
1209 static int
1210 xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, struct flowi *fl,
1211 struct xfrm_state **xfrm,
1212 unsigned short family)
1213 {
1214 struct xfrm_state *tp[XFRM_MAX_DEPTH];
1215 struct xfrm_state **tpp = (npols > 1) ? tp : xfrm;
1216 int cnx = 0;
1217 int error;
1218 int ret;
1219 int i;
1220
1221 for (i = 0; i < npols; i++) {
1222 if (cnx + pols[i]->xfrm_nr >= XFRM_MAX_DEPTH) {
1223 error = -ENOBUFS;
1224 goto fail;
1225 }
1226
1227 ret = xfrm_tmpl_resolve_one(pols[i], fl, &tpp[cnx], family);
1228 if (ret < 0) {
1229 error = ret;
1230 goto fail;
1231 } else
1232 cnx += ret;
1233 }
1234
1235 /* found states are sorted for outbound processing */
1236 if (npols > 1)
1237 xfrm_state_sort(xfrm, tpp, cnx, family);
1238
1239 return cnx;
1240
1241 fail:
1242 for (cnx--; cnx>=0; cnx--)
1243 xfrm_state_put(tpp[cnx]);
1244 return error;
1245
1246 }
1247
1248 /* Check that the bundle accepts the flow and its components are
1249 * still valid.
1250 */
1251
1252 static struct dst_entry *
1253 xfrm_find_bundle(struct flowi *fl, struct xfrm_policy *policy, unsigned short family)
1254 {
1255 struct dst_entry *x;
1256 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1257 if (unlikely(afinfo == NULL))
1258 return ERR_PTR(-EINVAL);
1259 x = afinfo->find_bundle(fl, policy);
1260 xfrm_policy_put_afinfo(afinfo);
1261 return x;
1262 }
1263
1264 static inline int xfrm_get_tos(struct flowi *fl, int family)
1265 {
1266 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1267 int tos;
1268
1269 if (!afinfo)
1270 return -EINVAL;
1271
1272 tos = afinfo->get_tos(fl);
1273
1274 xfrm_policy_put_afinfo(afinfo);
1275
1276 return tos;
1277 }
1278
1279 static inline struct xfrm_dst *xfrm_alloc_dst(int family)
1280 {
1281 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1282 struct xfrm_dst *xdst;
1283
1284 if (!afinfo)
1285 return ERR_PTR(-EINVAL);
1286
1287 xdst = dst_alloc(afinfo->dst_ops) ?: ERR_PTR(-ENOBUFS);
1288
1289 xfrm_policy_put_afinfo(afinfo);
1290
1291 return xdst;
1292 }
1293
1294 static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst,
1295 int nfheader_len)
1296 {
1297 struct xfrm_policy_afinfo *afinfo =
1298 xfrm_policy_get_afinfo(dst->ops->family);
1299 int err;
1300
1301 if (!afinfo)
1302 return -EINVAL;
1303
1304 err = afinfo->init_path(path, dst, nfheader_len);
1305
1306 xfrm_policy_put_afinfo(afinfo);
1307
1308 return err;
1309 }
1310
1311 static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
1312 {
1313 struct xfrm_policy_afinfo *afinfo =
1314 xfrm_policy_get_afinfo(xdst->u.dst.ops->family);
1315 int err;
1316
1317 if (!afinfo)
1318 return -EINVAL;
1319
1320 err = afinfo->fill_dst(xdst, dev);
1321
1322 xfrm_policy_put_afinfo(afinfo);
1323
1324 return err;
1325 }
1326
1327 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
1328 * all the metrics... Shortly, bundle a bundle.
1329 */
1330
1331 static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
1332 struct xfrm_state **xfrm, int nx,
1333 struct flowi *fl,
1334 struct dst_entry *dst)
1335 {
1336 unsigned long now = jiffies;
1337 struct net_device *dev;
1338 struct dst_entry *dst_prev = NULL;
1339 struct dst_entry *dst0 = NULL;
1340 int i = 0;
1341 int err;
1342 int header_len = 0;
1343 int nfheader_len = 0;
1344 int trailer_len = 0;
1345 int tos;
1346 int family = policy->selector.family;
1347
1348 tos = xfrm_get_tos(fl, family);
1349 err = tos;
1350 if (tos < 0)
1351 goto put_states;
1352
1353 dst_hold(dst);
1354
1355 for (; i < nx; i++) {
1356 struct xfrm_dst *xdst = xfrm_alloc_dst(family);
1357 struct dst_entry *dst1 = &xdst->u.dst;
1358
1359 err = PTR_ERR(xdst);
1360 if (IS_ERR(xdst)) {
1361 dst_release(dst);
1362 goto put_states;
1363 }
1364
1365 if (!dst_prev)
1366 dst0 = dst1;
1367 else {
1368 dst_prev->child = dst_clone(dst1);
1369 dst1->flags |= DST_NOHASH;
1370 }
1371
1372 xdst->route = dst;
1373 memcpy(&dst1->metrics, &dst->metrics, sizeof(dst->metrics));
1374
1375 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
1376 family = xfrm[i]->props.family;
1377 dst = xfrm_dst_lookup(xfrm[i], tos, family);
1378 err = PTR_ERR(dst);
1379 if (IS_ERR(dst))
1380 goto put_states;
1381 } else
1382 dst_hold(dst);
1383
1384 dst1->xfrm = xfrm[i];
1385 xdst->genid = xfrm[i]->genid;
1386
1387 dst1->obsolete = -1;
1388 dst1->flags |= DST_HOST;
1389 dst1->lastuse = now;
1390
1391 dst1->input = dst_discard;
1392 dst1->output = xfrm[i]->outer_mode->afinfo->output;
1393
1394 dst1->next = dst_prev;
1395 dst_prev = dst1;
1396
1397 header_len += xfrm[i]->props.header_len;
1398 if (xfrm[i]->type->flags & XFRM_TYPE_NON_FRAGMENT)
1399 nfheader_len += xfrm[i]->props.header_len;
1400 trailer_len += xfrm[i]->props.trailer_len;
1401 }
1402
1403 dst_prev->child = dst;
1404 dst0->path = dst;
1405
1406 err = -ENODEV;
1407 dev = dst->dev;
1408 if (!dev)
1409 goto free_dst;
1410
1411 /* Copy neighbout for reachability confirmation */
1412 dst0->neighbour = neigh_clone(dst->neighbour);
1413
1414 xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len);
1415 xfrm_init_pmtu(dst_prev);
1416
1417 for (dst_prev = dst0; dst_prev != dst; dst_prev = dst_prev->child) {
1418 struct xfrm_dst *xdst = (struct xfrm_dst *)dst_prev;
1419
1420 err = xfrm_fill_dst(xdst, dev);
1421 if (err)
1422 goto free_dst;
1423
1424 dst_prev->header_len = header_len;
1425 dst_prev->trailer_len = trailer_len;
1426 header_len -= xdst->u.dst.xfrm->props.header_len;
1427 trailer_len -= xdst->u.dst.xfrm->props.trailer_len;
1428 }
1429
1430 out:
1431 return dst0;
1432
1433 put_states:
1434 for (; i < nx; i++)
1435 xfrm_state_put(xfrm[i]);
1436 free_dst:
1437 if (dst0)
1438 dst_free(dst0);
1439 dst0 = ERR_PTR(err);
1440 goto out;
1441 }
1442
1443 static int inline
1444 xfrm_dst_alloc_copy(void **target, void *src, int size)
1445 {
1446 if (!*target) {
1447 *target = kmalloc(size, GFP_ATOMIC);
1448 if (!*target)
1449 return -ENOMEM;
1450 }
1451 memcpy(*target, src, size);
1452 return 0;
1453 }
1454
1455 static int inline
1456 xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
1457 {
1458 #ifdef CONFIG_XFRM_SUB_POLICY
1459 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1460 return xfrm_dst_alloc_copy((void **)&(xdst->partner),
1461 sel, sizeof(*sel));
1462 #else
1463 return 0;
1464 #endif
1465 }
1466
1467 static int inline
1468 xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
1469 {
1470 #ifdef CONFIG_XFRM_SUB_POLICY
1471 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1472 return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
1473 #else
1474 return 0;
1475 #endif
1476 }
1477
1478 static int stale_bundle(struct dst_entry *dst);
1479
1480 /* Main function: finds/creates a bundle for given flow.
1481 *
1482 * At the moment we eat a raw IP route. Mostly to speed up lookups
1483 * on interfaces with disabled IPsec.
1484 */
1485 int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
1486 struct sock *sk, int flags)
1487 {
1488 struct xfrm_policy *policy;
1489 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1490 int npols;
1491 int pol_dead;
1492 int xfrm_nr;
1493 int pi;
1494 struct xfrm_state *xfrm[XFRM_MAX_DEPTH];
1495 struct dst_entry *dst, *dst_orig = *dst_p;
1496 int nx = 0;
1497 int err;
1498 u32 genid;
1499 u16 family;
1500 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
1501
1502 restart:
1503 genid = atomic_read(&flow_cache_genid);
1504 policy = NULL;
1505 for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
1506 pols[pi] = NULL;
1507 npols = 0;
1508 pol_dead = 0;
1509 xfrm_nr = 0;
1510
1511 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
1512 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
1513 err = PTR_ERR(policy);
1514 if (IS_ERR(policy)) {
1515 XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLERROR);
1516 goto dropdst;
1517 }
1518 }
1519
1520 if (!policy) {
1521 /* To accelerate a bit... */
1522 if ((dst_orig->flags & DST_NOXFRM) ||
1523 !xfrm_policy_count[XFRM_POLICY_OUT])
1524 goto nopol;
1525
1526 policy = flow_cache_lookup(fl, dst_orig->ops->family,
1527 dir, xfrm_policy_lookup);
1528 err = PTR_ERR(policy);
1529 if (IS_ERR(policy)) {
1530 XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLERROR);
1531 goto dropdst;
1532 }
1533 }
1534
1535 if (!policy)
1536 goto nopol;
1537
1538 family = dst_orig->ops->family;
1539 pols[0] = policy;
1540 npols ++;
1541 xfrm_nr += pols[0]->xfrm_nr;
1542
1543 err = -ENOENT;
1544 if ((flags & XFRM_LOOKUP_ICMP) && !(policy->flags & XFRM_POLICY_ICMP))
1545 goto error;
1546
1547 policy->curlft.use_time = get_seconds();
1548
1549 switch (policy->action) {
1550 default:
1551 case XFRM_POLICY_BLOCK:
1552 /* Prohibit the flow */
1553 XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLBLOCK);
1554 err = -EPERM;
1555 goto error;
1556
1557 case XFRM_POLICY_ALLOW:
1558 #ifndef CONFIG_XFRM_SUB_POLICY
1559 if (policy->xfrm_nr == 0) {
1560 /* Flow passes not transformed. */
1561 xfrm_pol_put(policy);
1562 return 0;
1563 }
1564 #endif
1565
1566 /* Try to find matching bundle.
1567 *
1568 * LATER: help from flow cache. It is optional, this
1569 * is required only for output policy.
1570 */
1571 dst = xfrm_find_bundle(fl, policy, family);
1572 if (IS_ERR(dst)) {
1573 XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
1574 err = PTR_ERR(dst);
1575 goto error;
1576 }
1577
1578 if (dst)
1579 break;
1580
1581 #ifdef CONFIG_XFRM_SUB_POLICY
1582 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
1583 pols[1] = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN,
1584 fl, family,
1585 XFRM_POLICY_OUT);
1586 if (pols[1]) {
1587 if (IS_ERR(pols[1])) {
1588 XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLERROR);
1589 err = PTR_ERR(pols[1]);
1590 goto error;
1591 }
1592 if (pols[1]->action == XFRM_POLICY_BLOCK) {
1593 XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLBLOCK);
1594 err = -EPERM;
1595 goto error;
1596 }
1597 npols ++;
1598 xfrm_nr += pols[1]->xfrm_nr;
1599 }
1600 }
1601
1602 /*
1603 * Because neither flowi nor bundle information knows about
1604 * transformation template size. On more than one policy usage
1605 * we can realize whether all of them is bypass or not after
1606 * they are searched. See above not-transformed bypass
1607 * is surrounded by non-sub policy configuration, too.
1608 */
1609 if (xfrm_nr == 0) {
1610 /* Flow passes not transformed. */
1611 xfrm_pols_put(pols, npols);
1612 return 0;
1613 }
1614
1615 #endif
1616 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family);
1617
1618 if (unlikely(nx<0)) {
1619 err = nx;
1620 if (err == -EAGAIN && sysctl_xfrm_larval_drop) {
1621 /* EREMOTE tells the caller to generate
1622 * a one-shot blackhole route.
1623 */
1624 XFRM_INC_STATS(LINUX_MIB_XFRMOUTNOSTATES);
1625 xfrm_pol_put(policy);
1626 return -EREMOTE;
1627 }
1628 if (err == -EAGAIN && (flags & XFRM_LOOKUP_WAIT)) {
1629 DECLARE_WAITQUEUE(wait, current);
1630
1631 add_wait_queue(&km_waitq, &wait);
1632 set_current_state(TASK_INTERRUPTIBLE);
1633 schedule();
1634 set_current_state(TASK_RUNNING);
1635 remove_wait_queue(&km_waitq, &wait);
1636
1637 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family);
1638
1639 if (nx == -EAGAIN && signal_pending(current)) {
1640 XFRM_INC_STATS(LINUX_MIB_XFRMOUTNOSTATES);
1641 err = -ERESTART;
1642 goto error;
1643 }
1644 if (nx == -EAGAIN ||
1645 genid != atomic_read(&flow_cache_genid)) {
1646 xfrm_pols_put(pols, npols);
1647 goto restart;
1648 }
1649 err = nx;
1650 }
1651 if (err < 0) {
1652 XFRM_INC_STATS(LINUX_MIB_XFRMOUTNOSTATES);
1653 goto error;
1654 }
1655 }
1656 if (nx == 0) {
1657 /* Flow passes not transformed. */
1658 xfrm_pols_put(pols, npols);
1659 return 0;
1660 }
1661
1662 dst = xfrm_bundle_create(policy, xfrm, nx, fl, dst_orig);
1663 err = PTR_ERR(dst);
1664 if (IS_ERR(dst)) {
1665 XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLEGENERROR);
1666 goto error;
1667 }
1668
1669 for (pi = 0; pi < npols; pi++) {
1670 read_lock_bh(&pols[pi]->lock);
1671 pol_dead |= pols[pi]->dead;
1672 read_unlock_bh(&pols[pi]->lock);
1673 }
1674
1675 write_lock_bh(&policy->lock);
1676 if (unlikely(pol_dead || stale_bundle(dst))) {
1677 /* Wow! While we worked on resolving, this
1678 * policy has gone. Retry. It is not paranoia,
1679 * we just cannot enlist new bundle to dead object.
1680 * We can't enlist stable bundles either.
1681 */
1682 write_unlock_bh(&policy->lock);
1683 if (dst)
1684 dst_free(dst);
1685
1686 if (pol_dead)
1687 XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLDEAD);
1688 else
1689 XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
1690 err = -EHOSTUNREACH;
1691 goto error;
1692 }
1693
1694 if (npols > 1)
1695 err = xfrm_dst_update_parent(dst, &pols[1]->selector);
1696 else
1697 err = xfrm_dst_update_origin(dst, fl);
1698 if (unlikely(err)) {
1699 write_unlock_bh(&policy->lock);
1700 if (dst)
1701 dst_free(dst);
1702 XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
1703 goto error;
1704 }
1705
1706 dst->next = policy->bundles;
1707 policy->bundles = dst;
1708 dst_hold(dst);
1709 write_unlock_bh(&policy->lock);
1710 }
1711 *dst_p = dst;
1712 dst_release(dst_orig);
1713 xfrm_pols_put(pols, npols);
1714 return 0;
1715
1716 error:
1717 xfrm_pols_put(pols, npols);
1718 dropdst:
1719 dst_release(dst_orig);
1720 *dst_p = NULL;
1721 return err;
1722
1723 nopol:
1724 err = -ENOENT;
1725 if (flags & XFRM_LOOKUP_ICMP)
1726 goto dropdst;
1727 return 0;
1728 }
1729 EXPORT_SYMBOL(__xfrm_lookup);
1730
1731 int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
1732 struct sock *sk, int flags)
1733 {
1734 int err = __xfrm_lookup(dst_p, fl, sk, flags);
1735
1736 if (err == -EREMOTE) {
1737 dst_release(*dst_p);
1738 *dst_p = NULL;
1739 err = -EAGAIN;
1740 }
1741
1742 return err;
1743 }
1744 EXPORT_SYMBOL(xfrm_lookup);
1745
1746 static inline int
1747 xfrm_secpath_reject(int idx, struct sk_buff *skb, struct flowi *fl)
1748 {
1749 struct xfrm_state *x;
1750
1751 if (!skb->sp || idx < 0 || idx >= skb->sp->len)
1752 return 0;
1753 x = skb->sp->xvec[idx];
1754 if (!x->type->reject)
1755 return 0;
1756 return x->type->reject(x, skb, fl);
1757 }
1758
1759 /* When skb is transformed back to its "native" form, we have to
1760 * check policy restrictions. At the moment we make this in maximally
1761 * stupid way. Shame on me. :-) Of course, connected sockets must
1762 * have policy cached at them.
1763 */
1764
1765 static inline int
1766 xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
1767 unsigned short family)
1768 {
1769 if (xfrm_state_kern(x))
1770 return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
1771 return x->id.proto == tmpl->id.proto &&
1772 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
1773 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
1774 x->props.mode == tmpl->mode &&
1775 ((tmpl->aalgos & (1<<x->props.aalgo)) ||
1776 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
1777 !(x->props.mode != XFRM_MODE_TRANSPORT &&
1778 xfrm_state_addr_cmp(tmpl, x, family));
1779 }
1780
1781 /*
1782 * 0 or more than 0 is returned when validation is succeeded (either bypass
1783 * because of optional transport mode, or next index of the mathced secpath
1784 * state with the template.
1785 * -1 is returned when no matching template is found.
1786 * Otherwise "-2 - errored_index" is returned.
1787 */
1788 static inline int
1789 xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
1790 unsigned short family)
1791 {
1792 int idx = start;
1793
1794 if (tmpl->optional) {
1795 if (tmpl->mode == XFRM_MODE_TRANSPORT)
1796 return start;
1797 } else
1798 start = -1;
1799 for (; idx < sp->len; idx++) {
1800 if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
1801 return ++idx;
1802 if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
1803 if (start == -1)
1804 start = -2-idx;
1805 break;
1806 }
1807 }
1808 return start;
1809 }
1810
1811 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1812 unsigned int family, int reverse)
1813 {
1814 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1815 int err;
1816
1817 if (unlikely(afinfo == NULL))
1818 return -EAFNOSUPPORT;
1819
1820 afinfo->decode_session(skb, fl, reverse);
1821 err = security_xfrm_decode_session(skb, &fl->secid);
1822 xfrm_policy_put_afinfo(afinfo);
1823 return err;
1824 }
1825 EXPORT_SYMBOL(__xfrm_decode_session);
1826
1827 static inline int secpath_has_nontransport(struct sec_path *sp, int k, int *idxp)
1828 {
1829 for (; k < sp->len; k++) {
1830 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) {
1831 *idxp = k;
1832 return 1;
1833 }
1834 }
1835
1836 return 0;
1837 }
1838
1839 int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
1840 unsigned short family)
1841 {
1842 struct xfrm_policy *pol;
1843 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1844 int npols = 0;
1845 int xfrm_nr;
1846 int pi;
1847 int reverse;
1848 struct flowi fl;
1849 u8 fl_dir;
1850 int xerr_idx = -1;
1851
1852 reverse = dir & ~XFRM_POLICY_MASK;
1853 dir &= XFRM_POLICY_MASK;
1854 fl_dir = policy_to_flow_dir(dir);
1855
1856 if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) {
1857 XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR);
1858 return 0;
1859 }
1860
1861 nf_nat_decode_session(skb, &fl, family);
1862
1863 /* First, check used SA against their selectors. */
1864 if (skb->sp) {
1865 int i;
1866
1867 for (i=skb->sp->len-1; i>=0; i--) {
1868 struct xfrm_state *x = skb->sp->xvec[i];
1869 if (!xfrm_selector_match(&x->sel, &fl, family)) {
1870 XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMISMATCH);
1871 return 0;
1872 }
1873 }
1874 }
1875
1876 pol = NULL;
1877 if (sk && sk->sk_policy[dir]) {
1878 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
1879 if (IS_ERR(pol)) {
1880 XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR);
1881 return 0;
1882 }
1883 }
1884
1885 if (!pol)
1886 pol = flow_cache_lookup(&fl, family, fl_dir,
1887 xfrm_policy_lookup);
1888
1889 if (IS_ERR(pol)) {
1890 XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR);
1891 return 0;
1892 }
1893
1894 if (!pol) {
1895 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {
1896 xfrm_secpath_reject(xerr_idx, skb, &fl);
1897 XFRM_INC_STATS(LINUX_MIB_XFRMINNOPOLS);
1898 return 0;
1899 }
1900 return 1;
1901 }
1902
1903 pol->curlft.use_time = get_seconds();
1904
1905 pols[0] = pol;
1906 npols ++;
1907 #ifdef CONFIG_XFRM_SUB_POLICY
1908 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
1909 pols[1] = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN,
1910 &fl, family,
1911 XFRM_POLICY_IN);
1912 if (pols[1]) {
1913 if (IS_ERR(pols[1])) {
1914 XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR);
1915 return 0;
1916 }
1917 pols[1]->curlft.use_time = get_seconds();
1918 npols ++;
1919 }
1920 }
1921 #endif
1922
1923 if (pol->action == XFRM_POLICY_ALLOW) {
1924 struct sec_path *sp;
1925 static struct sec_path dummy;
1926 struct xfrm_tmpl *tp[XFRM_MAX_DEPTH];
1927 struct xfrm_tmpl *stp[XFRM_MAX_DEPTH];
1928 struct xfrm_tmpl **tpp = tp;
1929 int ti = 0;
1930 int i, k;
1931
1932 if ((sp = skb->sp) == NULL)
1933 sp = &dummy;
1934
1935 for (pi = 0; pi < npols; pi++) {
1936 if (pols[pi] != pol &&
1937 pols[pi]->action != XFRM_POLICY_ALLOW) {
1938 XFRM_INC_STATS(LINUX_MIB_XFRMINPOLBLOCK);
1939 goto reject;
1940 }
1941 if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) {
1942 XFRM_INC_STATS(LINUX_MIB_XFRMINBUFFERERROR);
1943 goto reject_error;
1944 }
1945 for (i = 0; i < pols[pi]->xfrm_nr; i++)
1946 tpp[ti++] = &pols[pi]->xfrm_vec[i];
1947 }
1948 xfrm_nr = ti;
1949 if (npols > 1) {
1950 xfrm_tmpl_sort(stp, tpp, xfrm_nr, family);
1951 tpp = stp;
1952 }
1953
1954 /* For each tunnel xfrm, find the first matching tmpl.
1955 * For each tmpl before that, find corresponding xfrm.
1956 * Order is _important_. Later we will implement
1957 * some barriers, but at the moment barriers
1958 * are implied between each two transformations.
1959 */
1960 for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
1961 k = xfrm_policy_ok(tpp[i], sp, k, family);
1962 if (k < 0) {
1963 if (k < -1)
1964 /* "-2 - errored_index" returned */
1965 xerr_idx = -(2+k);
1966 XFRM_INC_STATS(LINUX_MIB_XFRMINTMPLMISMATCH);
1967 goto reject;
1968 }
1969 }
1970
1971 if (secpath_has_nontransport(sp, k, &xerr_idx)) {
1972 XFRM_INC_STATS(LINUX_MIB_XFRMINTMPLMISMATCH);
1973 goto reject;
1974 }
1975
1976 xfrm_pols_put(pols, npols);
1977 return 1;
1978 }
1979 XFRM_INC_STATS(LINUX_MIB_XFRMINPOLBLOCK);
1980
1981 reject:
1982 xfrm_secpath_reject(xerr_idx, skb, &fl);
1983 reject_error:
1984 xfrm_pols_put(pols, npols);
1985 return 0;
1986 }
1987 EXPORT_SYMBOL(__xfrm_policy_check);
1988
1989 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1990 {
1991 struct flowi fl;
1992
1993 if (xfrm_decode_session(skb, &fl, family) < 0) {
1994 /* XXX: we should have something like FWDHDRERROR here. */
1995 XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR);
1996 return 0;
1997 }
1998
1999 return xfrm_lookup(&skb->dst, &fl, NULL, 0) == 0;
2000 }
2001 EXPORT_SYMBOL(__xfrm_route_forward);
2002
2003 /* Optimize later using cookies and generation ids. */
2004
2005 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
2006 {
2007 /* Code (such as __xfrm4_bundle_create()) sets dst->obsolete
2008 * to "-1" to force all XFRM destinations to get validated by
2009 * dst_ops->check on every use. We do this because when a
2010 * normal route referenced by an XFRM dst is obsoleted we do
2011 * not go looking around for all parent referencing XFRM dsts
2012 * so that we can invalidate them. It is just too much work.
2013 * Instead we make the checks here on every use. For example:
2014 *
2015 * XFRM dst A --> IPv4 dst X
2016 *
2017 * X is the "xdst->route" of A (X is also the "dst->path" of A
2018 * in this example). If X is marked obsolete, "A" will not
2019 * notice. That's what we are validating here via the
2020 * stale_bundle() check.
2021 *
2022 * When a policy's bundle is pruned, we dst_free() the XFRM
2023 * dst which causes it's ->obsolete field to be set to a
2024 * positive non-zero integer. If an XFRM dst has been pruned
2025 * like this, we want to force a new route lookup.
2026 */
2027 if (dst->obsolete < 0 && !stale_bundle(dst))
2028 return dst;
2029
2030 return NULL;
2031 }
2032
2033 static int stale_bundle(struct dst_entry *dst)
2034 {
2035 return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
2036 }
2037
2038 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
2039 {
2040 while ((dst = dst->child) && dst->xfrm && dst->dev == dev) {
2041 dst->dev = dev->nd_net->loopback_dev;
2042 dev_hold(dst->dev);
2043 dev_put(dev);
2044 }
2045 }
2046 EXPORT_SYMBOL(xfrm_dst_ifdown);
2047
2048 static void xfrm_link_failure(struct sk_buff *skb)
2049 {
2050 /* Impossible. Such dst must be popped before reaches point of failure. */
2051 return;
2052 }
2053
2054 static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
2055 {
2056 if (dst) {
2057 if (dst->obsolete) {
2058 dst_release(dst);
2059 dst = NULL;
2060 }
2061 }
2062 return dst;
2063 }
2064
2065 static void prune_one_bundle(struct xfrm_policy *pol, int (*func)(struct dst_entry *), struct dst_entry **gc_list_p)
2066 {
2067 struct dst_entry *dst, **dstp;
2068
2069 write_lock(&pol->lock);
2070 dstp = &pol->bundles;
2071 while ((dst=*dstp) != NULL) {
2072 if (func(dst)) {
2073 *dstp = dst->next;
2074 dst->next = *gc_list_p;
2075 *gc_list_p = dst;
2076 } else {
2077 dstp = &dst->next;
2078 }
2079 }
2080 write_unlock(&pol->lock);
2081 }
2082
2083 static void xfrm_prune_bundles(int (*func)(struct dst_entry *))
2084 {
2085 struct dst_entry *gc_list = NULL;
2086 int dir;
2087
2088 read_lock_bh(&xfrm_policy_lock);
2089 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
2090 struct xfrm_policy *pol;
2091 struct hlist_node *entry;
2092 struct hlist_head *table;
2093 int i;
2094
2095 hlist_for_each_entry(pol, entry,
2096 &xfrm_policy_inexact[dir], bydst)
2097 prune_one_bundle(pol, func, &gc_list);
2098
2099 table = xfrm_policy_bydst[dir].table;
2100 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
2101 hlist_for_each_entry(pol, entry, table + i, bydst)
2102 prune_one_bundle(pol, func, &gc_list);
2103 }
2104 }
2105 read_unlock_bh(&xfrm_policy_lock);
2106
2107 while (gc_list) {
2108 struct dst_entry *dst = gc_list;
2109 gc_list = dst->next;
2110 dst_free(dst);
2111 }
2112 }
2113
2114 static int unused_bundle(struct dst_entry *dst)
2115 {
2116 return !atomic_read(&dst->__refcnt);
2117 }
2118
2119 static void __xfrm_garbage_collect(void)
2120 {
2121 xfrm_prune_bundles(unused_bundle);
2122 }
2123
2124 static int xfrm_flush_bundles(void)
2125 {
2126 xfrm_prune_bundles(stale_bundle);
2127 return 0;
2128 }
2129
2130 static void xfrm_init_pmtu(struct dst_entry *dst)
2131 {
2132 do {
2133 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2134 u32 pmtu, route_mtu_cached;
2135
2136 pmtu = dst_mtu(dst->child);
2137 xdst->child_mtu_cached = pmtu;
2138
2139 pmtu = xfrm_state_mtu(dst->xfrm, pmtu);
2140
2141 route_mtu_cached = dst_mtu(xdst->route);
2142 xdst->route_mtu_cached = route_mtu_cached;
2143
2144 if (pmtu > route_mtu_cached)
2145 pmtu = route_mtu_cached;
2146
2147 dst->metrics[RTAX_MTU-1] = pmtu;
2148 } while ((dst = dst->next));
2149 }
2150
2151 /* Check that the bundle accepts the flow and its components are
2152 * still valid.
2153 */
2154
2155 int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
2156 struct flowi *fl, int family, int strict)
2157 {
2158 struct dst_entry *dst = &first->u.dst;
2159 struct xfrm_dst *last;
2160 u32 mtu;
2161
2162 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) ||
2163 (dst->dev && !netif_running(dst->dev)))
2164 return 0;
2165 #ifdef CONFIG_XFRM_SUB_POLICY
2166 if (fl) {
2167 if (first->origin && !flow_cache_uli_match(first->origin, fl))
2168 return 0;
2169 if (first->partner &&
2170 !xfrm_selector_match(first->partner, fl, family))
2171 return 0;
2172 }
2173 #endif
2174
2175 last = NULL;
2176
2177 do {
2178 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2179
2180 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
2181 return 0;
2182 if (fl && pol &&
2183 !security_xfrm_state_pol_flow_match(dst->xfrm, pol, fl))
2184 return 0;
2185 if (dst->xfrm->km.state != XFRM_STATE_VALID)
2186 return 0;
2187 if (xdst->genid != dst->xfrm->genid)
2188 return 0;
2189
2190 if (strict && fl &&
2191 !(dst->xfrm->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2192 !xfrm_state_addr_flow_check(dst->xfrm, fl, family))
2193 return 0;
2194
2195 mtu = dst_mtu(dst->child);
2196 if (xdst->child_mtu_cached != mtu) {
2197 last = xdst;
2198 xdst->child_mtu_cached = mtu;
2199 }
2200
2201 if (!dst_check(xdst->route, xdst->route_cookie))
2202 return 0;
2203 mtu = dst_mtu(xdst->route);
2204 if (xdst->route_mtu_cached != mtu) {
2205 last = xdst;
2206 xdst->route_mtu_cached = mtu;
2207 }
2208
2209 dst = dst->child;
2210 } while (dst->xfrm);
2211
2212 if (likely(!last))
2213 return 1;
2214
2215 mtu = last->child_mtu_cached;
2216 for (;;) {
2217 dst = &last->u.dst;
2218
2219 mtu = xfrm_state_mtu(dst->xfrm, mtu);
2220 if (mtu > last->route_mtu_cached)
2221 mtu = last->route_mtu_cached;
2222 dst->metrics[RTAX_MTU-1] = mtu;
2223
2224 if (last == first)
2225 break;
2226
2227 last = (struct xfrm_dst *)last->u.dst.next;
2228 last->child_mtu_cached = mtu;
2229 }
2230
2231 return 1;
2232 }
2233
2234 EXPORT_SYMBOL(xfrm_bundle_ok);
2235
2236 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
2237 {
2238 int err = 0;
2239 if (unlikely(afinfo == NULL))
2240 return -EINVAL;
2241 if (unlikely(afinfo->family >= NPROTO))
2242 return -EAFNOSUPPORT;
2243 write_lock_bh(&xfrm_policy_afinfo_lock);
2244 if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
2245 err = -ENOBUFS;
2246 else {
2247 struct dst_ops *dst_ops = afinfo->dst_ops;
2248 if (likely(dst_ops->kmem_cachep == NULL))
2249 dst_ops->kmem_cachep = xfrm_dst_cache;
2250 if (likely(dst_ops->check == NULL))
2251 dst_ops->check = xfrm_dst_check;
2252 if (likely(dst_ops->negative_advice == NULL))
2253 dst_ops->negative_advice = xfrm_negative_advice;
2254 if (likely(dst_ops->link_failure == NULL))
2255 dst_ops->link_failure = xfrm_link_failure;
2256 if (likely(afinfo->garbage_collect == NULL))
2257 afinfo->garbage_collect = __xfrm_garbage_collect;
2258 xfrm_policy_afinfo[afinfo->family] = afinfo;
2259 }
2260 write_unlock_bh(&xfrm_policy_afinfo_lock);
2261 return err;
2262 }
2263 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
2264
2265 int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
2266 {
2267 int err = 0;
2268 if (unlikely(afinfo == NULL))
2269 return -EINVAL;
2270 if (unlikely(afinfo->family >= NPROTO))
2271 return -EAFNOSUPPORT;
2272 write_lock_bh(&xfrm_policy_afinfo_lock);
2273 if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
2274 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
2275 err = -EINVAL;
2276 else {
2277 struct dst_ops *dst_ops = afinfo->dst_ops;
2278 xfrm_policy_afinfo[afinfo->family] = NULL;
2279 dst_ops->kmem_cachep = NULL;
2280 dst_ops->check = NULL;
2281 dst_ops->negative_advice = NULL;
2282 dst_ops->link_failure = NULL;
2283 afinfo->garbage_collect = NULL;
2284 }
2285 }
2286 write_unlock_bh(&xfrm_policy_afinfo_lock);
2287 return err;
2288 }
2289 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
2290
2291 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
2292 {
2293 struct xfrm_policy_afinfo *afinfo;
2294 if (unlikely(family >= NPROTO))
2295 return NULL;
2296 read_lock(&xfrm_policy_afinfo_lock);
2297 afinfo = xfrm_policy_afinfo[family];
2298 if (unlikely(!afinfo))
2299 read_unlock(&xfrm_policy_afinfo_lock);
2300 return afinfo;
2301 }
2302
2303 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo)
2304 {
2305 read_unlock(&xfrm_policy_afinfo_lock);
2306 }
2307
2308 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
2309 {
2310 struct net_device *dev = ptr;
2311
2312 if (dev->nd_net != &init_net)
2313 return NOTIFY_DONE;
2314
2315 switch (event) {
2316 case NETDEV_DOWN:
2317 xfrm_flush_bundles();
2318 }
2319 return NOTIFY_DONE;
2320 }
2321
2322 static struct notifier_block xfrm_dev_notifier = {
2323 xfrm_dev_event,
2324 NULL,
2325 0
2326 };
2327
2328 #ifdef CONFIG_XFRM_STATISTICS
2329 static int __init xfrm_statistics_init(void)
2330 {
2331 if (snmp_mib_init((void **)xfrm_statistics,
2332 sizeof(struct linux_xfrm_mib)) < 0)
2333 return -ENOMEM;
2334 return 0;
2335 }
2336 #endif
2337
2338 static void __init xfrm_policy_init(void)
2339 {
2340 unsigned int hmask, sz;
2341 int dir;
2342
2343 xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache",
2344 sizeof(struct xfrm_dst),
2345 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
2346 NULL);
2347
2348 hmask = 8 - 1;
2349 sz = (hmask+1) * sizeof(struct hlist_head);
2350
2351 xfrm_policy_byidx = xfrm_hash_alloc(sz);
2352 xfrm_idx_hmask = hmask;
2353 if (!xfrm_policy_byidx)
2354 panic("XFRM: failed to allocate byidx hash\n");
2355
2356 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
2357 struct xfrm_policy_hash *htab;
2358
2359 INIT_HLIST_HEAD(&xfrm_policy_inexact[dir]);
2360
2361 htab = &xfrm_policy_bydst[dir];
2362 htab->table = xfrm_hash_alloc(sz);
2363 htab->hmask = hmask;
2364 if (!htab->table)
2365 panic("XFRM: failed to allocate bydst hash\n");
2366 }
2367
2368 INIT_WORK(&xfrm_policy_gc_work, xfrm_policy_gc_task);
2369 register_netdevice_notifier(&xfrm_dev_notifier);
2370 }
2371
2372 void __init xfrm_init(void)
2373 {
2374 #ifdef CONFIG_XFRM_STATISTICS
2375 xfrm_statistics_init();
2376 #endif
2377 xfrm_state_init();
2378 xfrm_policy_init();
2379 xfrm_input_init();
2380 #ifdef CONFIG_XFRM_STATISTICS
2381 xfrm_proc_init();
2382 #endif
2383 }
2384
2385 #ifdef CONFIG_AUDITSYSCALL
2386 static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
2387 struct audit_buffer *audit_buf)
2388 {
2389 struct xfrm_sec_ctx *ctx = xp->security;
2390 struct xfrm_selector *sel = &xp->selector;
2391
2392 if (ctx)
2393 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2394 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
2395
2396 switch(sel->family) {
2397 case AF_INET:
2398 audit_log_format(audit_buf, " src=" NIPQUAD_FMT,
2399 NIPQUAD(sel->saddr.a4));
2400 if (sel->prefixlen_s != 32)
2401 audit_log_format(audit_buf, " src_prefixlen=%d",
2402 sel->prefixlen_s);
2403 audit_log_format(audit_buf, " dst=" NIPQUAD_FMT,
2404 NIPQUAD(sel->daddr.a4));
2405 if (sel->prefixlen_d != 32)
2406 audit_log_format(audit_buf, " dst_prefixlen=%d",
2407 sel->prefixlen_d);
2408 break;
2409 case AF_INET6:
2410 audit_log_format(audit_buf, " src=" NIP6_FMT,
2411 NIP6(*(struct in6_addr *)sel->saddr.a6));
2412 if (sel->prefixlen_s != 128)
2413 audit_log_format(audit_buf, " src_prefixlen=%d",
2414 sel->prefixlen_s);
2415 audit_log_format(audit_buf, " dst=" NIP6_FMT,
2416 NIP6(*(struct in6_addr *)sel->daddr.a6));
2417 if (sel->prefixlen_d != 128)
2418 audit_log_format(audit_buf, " dst_prefixlen=%d",
2419 sel->prefixlen_d);
2420 break;
2421 }
2422 }
2423
2424 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
2425 u32 auid, u32 secid)
2426 {
2427 struct audit_buffer *audit_buf;
2428
2429 audit_buf = xfrm_audit_start("SPD-add");
2430 if (audit_buf == NULL)
2431 return;
2432 xfrm_audit_helper_usrinfo(auid, secid, audit_buf);
2433 audit_log_format(audit_buf, " res=%u", result);
2434 xfrm_audit_common_policyinfo(xp, audit_buf);
2435 audit_log_end(audit_buf);
2436 }
2437 EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);
2438
2439 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
2440 u32 auid, u32 secid)
2441 {
2442 struct audit_buffer *audit_buf;
2443
2444 audit_buf = xfrm_audit_start("SPD-delete");
2445 if (audit_buf == NULL)
2446 return;
2447 xfrm_audit_helper_usrinfo(auid, secid, audit_buf);
2448 audit_log_format(audit_buf, " res=%u", result);
2449 xfrm_audit_common_policyinfo(xp, audit_buf);
2450 audit_log_end(audit_buf);
2451 }
2452 EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete);
2453 #endif
2454
2455 #ifdef CONFIG_XFRM_MIGRATE
2456 static int xfrm_migrate_selector_match(struct xfrm_selector *sel_cmp,
2457 struct xfrm_selector *sel_tgt)
2458 {
2459 if (sel_cmp->proto == IPSEC_ULPROTO_ANY) {
2460 if (sel_tgt->family == sel_cmp->family &&
2461 xfrm_addr_cmp(&sel_tgt->daddr, &sel_cmp->daddr,
2462 sel_cmp->family) == 0 &&
2463 xfrm_addr_cmp(&sel_tgt->saddr, &sel_cmp->saddr,
2464 sel_cmp->family) == 0 &&
2465 sel_tgt->prefixlen_d == sel_cmp->prefixlen_d &&
2466 sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) {
2467 return 1;
2468 }
2469 } else {
2470 if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) {
2471 return 1;
2472 }
2473 }
2474 return 0;
2475 }
2476
2477 static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel,
2478 u8 dir, u8 type)
2479 {
2480 struct xfrm_policy *pol, *ret = NULL;
2481 struct hlist_node *entry;
2482 struct hlist_head *chain;
2483 u32 priority = ~0U;
2484
2485 read_lock_bh(&xfrm_policy_lock);
2486 chain = policy_hash_direct(&sel->daddr, &sel->saddr, sel->family, dir);
2487 hlist_for_each_entry(pol, entry, chain, bydst) {
2488 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
2489 pol->type == type) {
2490 ret = pol;
2491 priority = ret->priority;
2492 break;
2493 }
2494 }
2495 chain = &xfrm_policy_inexact[dir];
2496 hlist_for_each_entry(pol, entry, chain, bydst) {
2497 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
2498 pol->type == type &&
2499 pol->priority < priority) {
2500 ret = pol;
2501 break;
2502 }
2503 }
2504
2505 if (ret)
2506 xfrm_pol_hold(ret);
2507
2508 read_unlock_bh(&xfrm_policy_lock);
2509
2510 return ret;
2511 }
2512
2513 static int migrate_tmpl_match(struct xfrm_migrate *m, struct xfrm_tmpl *t)
2514 {
2515 int match = 0;
2516
2517 if (t->mode == m->mode && t->id.proto == m->proto &&
2518 (m->reqid == 0 || t->reqid == m->reqid)) {
2519 switch (t->mode) {
2520 case XFRM_MODE_TUNNEL:
2521 case XFRM_MODE_BEET:
2522 if (xfrm_addr_cmp(&t->id.daddr, &m->old_daddr,
2523 m->old_family) == 0 &&
2524 xfrm_addr_cmp(&t->saddr, &m->old_saddr,
2525 m->old_family) == 0) {
2526 match = 1;
2527 }
2528 break;
2529 case XFRM_MODE_TRANSPORT:
2530 /* in case of transport mode, template does not store
2531 any IP addresses, hence we just compare mode and
2532 protocol */
2533 match = 1;
2534 break;
2535 default:
2536 break;
2537 }
2538 }
2539 return match;
2540 }
2541
2542 /* update endpoint address(es) of template(s) */
2543 static int xfrm_policy_migrate(struct xfrm_policy *pol,
2544 struct xfrm_migrate *m, int num_migrate)
2545 {
2546 struct xfrm_migrate *mp;
2547 struct dst_entry *dst;
2548 int i, j, n = 0;
2549
2550 write_lock_bh(&pol->lock);
2551 if (unlikely(pol->dead)) {
2552 /* target policy has been deleted */
2553 write_unlock_bh(&pol->lock);
2554 return -ENOENT;
2555 }
2556
2557 for (i = 0; i < pol->xfrm_nr; i++) {
2558 for (j = 0, mp = m; j < num_migrate; j++, mp++) {
2559 if (!migrate_tmpl_match(mp, &pol->xfrm_vec[i]))
2560 continue;
2561 n++;
2562 if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL &&
2563 pol->xfrm_vec[i].mode != XFRM_MODE_BEET)
2564 continue;
2565 /* update endpoints */
2566 memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr,
2567 sizeof(pol->xfrm_vec[i].id.daddr));
2568 memcpy(&pol->xfrm_vec[i].saddr, &mp->new_saddr,
2569 sizeof(pol->xfrm_vec[i].saddr));
2570 pol->xfrm_vec[i].encap_family = mp->new_family;
2571 /* flush bundles */
2572 while ((dst = pol->bundles) != NULL) {
2573 pol->bundles = dst->next;
2574 dst_free(dst);
2575 }
2576 }
2577 }
2578
2579 write_unlock_bh(&pol->lock);
2580
2581 if (!n)
2582 return -ENODATA;
2583
2584 return 0;
2585 }
2586
2587 static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate)
2588 {
2589 int i, j;
2590
2591 if (num_migrate < 1 || num_migrate > XFRM_MAX_DEPTH)
2592 return -EINVAL;
2593
2594 for (i = 0; i < num_migrate; i++) {
2595 if ((xfrm_addr_cmp(&m[i].old_daddr, &m[i].new_daddr,
2596 m[i].old_family) == 0) &&
2597 (xfrm_addr_cmp(&m[i].old_saddr, &m[i].new_saddr,
2598 m[i].old_family) == 0))
2599 return -EINVAL;
2600 if (xfrm_addr_any(&m[i].new_daddr, m[i].new_family) ||
2601 xfrm_addr_any(&m[i].new_saddr, m[i].new_family))
2602 return -EINVAL;
2603
2604 /* check if there is any duplicated entry */
2605 for (j = i + 1; j < num_migrate; j++) {
2606 if (!memcmp(&m[i].old_daddr, &m[j].old_daddr,
2607 sizeof(m[i].old_daddr)) &&
2608 !memcmp(&m[i].old_saddr, &m[j].old_saddr,
2609 sizeof(m[i].old_saddr)) &&
2610 m[i].proto == m[j].proto &&
2611 m[i].mode == m[j].mode &&
2612 m[i].reqid == m[j].reqid &&
2613 m[i].old_family == m[j].old_family)
2614 return -EINVAL;
2615 }
2616 }
2617
2618 return 0;
2619 }
2620
2621 int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2622 struct xfrm_migrate *m, int num_migrate)
2623 {
2624 int i, err, nx_cur = 0, nx_new = 0;
2625 struct xfrm_policy *pol = NULL;
2626 struct xfrm_state *x, *xc;
2627 struct xfrm_state *x_cur[XFRM_MAX_DEPTH];
2628 struct xfrm_state *x_new[XFRM_MAX_DEPTH];
2629 struct xfrm_migrate *mp;
2630
2631 if ((err = xfrm_migrate_check(m, num_migrate)) < 0)
2632 goto out;
2633
2634 /* Stage 1 - find policy */
2635 if ((pol = xfrm_migrate_policy_find(sel, dir, type)) == NULL) {
2636 err = -ENOENT;
2637 goto out;
2638 }
2639
2640 /* Stage 2 - find and update state(s) */
2641 for (i = 0, mp = m; i < num_migrate; i++, mp++) {
2642 if ((x = xfrm_migrate_state_find(mp))) {
2643 x_cur[nx_cur] = x;
2644 nx_cur++;
2645 if ((xc = xfrm_state_migrate(x, mp))) {
2646 x_new[nx_new] = xc;
2647 nx_new++;
2648 } else {
2649 err = -ENODATA;
2650 goto restore_state;
2651 }
2652 }
2653 }
2654
2655 /* Stage 3 - update policy */
2656 if ((err = xfrm_policy_migrate(pol, m, num_migrate)) < 0)
2657 goto restore_state;
2658
2659 /* Stage 4 - delete old state(s) */
2660 if (nx_cur) {
2661 xfrm_states_put(x_cur, nx_cur);
2662 xfrm_states_delete(x_cur, nx_cur);
2663 }
2664
2665 /* Stage 5 - announce */
2666 km_migrate(sel, dir, type, m, num_migrate);
2667
2668 xfrm_pol_put(pol);
2669
2670 return 0;
2671 out:
2672 return err;
2673
2674 restore_state:
2675 if (pol)
2676 xfrm_pol_put(pol);
2677 if (nx_cur)
2678 xfrm_states_put(x_cur, nx_cur);
2679 if (nx_new)
2680 xfrm_states_delete(x_new, nx_new);
2681
2682 return err;
2683 }
2684 EXPORT_SYMBOL(xfrm_migrate);
2685 #endif
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree