?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
NET_SB1250_MAC: Rename to SB1250_MAC
[linux-2.6/mini2440.git] / net / xfrm / xfrm_policy.c
blob50682d3cd7a97c9bd66d6f5125d5f59cadd3179e
1 /*
2 * xfrm_policy.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * Kazunori MIYAZAWA @USAGI
10 * YOSHIFUJI Hideaki
11 * Split up af-specific portion
12 * Derek Atkins <derek@ihtfp.com> Add the post_input processor
13 *
14 */
15
16 #include <linux/slab.h>
17 #include <linux/kmod.h>
18 #include <linux/list.h>
19 #include <linux/spinlock.h>
20 #include <linux/workqueue.h>
21 #include <linux/notifier.h>
22 #include <linux/netdevice.h>
23 #include <linux/netfilter.h>
24 #include <linux/module.h>
25 #include <linux/cache.h>
26 #include <net/xfrm.h>
27 #include <net/ip.h>
28
29 #include "xfrm_hash.h"
30
31 int sysctl_xfrm_larval_drop __read_mostly;
32
33 DEFINE_MUTEX(xfrm_cfg_mutex);
34 EXPORT_SYMBOL(xfrm_cfg_mutex);
35
36 static DEFINE_RWLOCK(xfrm_policy_lock);
37
38 unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];
39 EXPORT_SYMBOL(xfrm_policy_count);
40
41 static DEFINE_RWLOCK(xfrm_policy_afinfo_lock);
42 static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO];
43
44 static struct kmem_cache *xfrm_dst_cache __read_mostly;
45
46 static struct work_struct xfrm_policy_gc_work;
47 static HLIST_HEAD(xfrm_policy_gc_list);
48 static DEFINE_SPINLOCK(xfrm_policy_gc_lock);
49
50 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
51 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
52 static struct xfrm_policy_afinfo *xfrm_policy_lock_afinfo(unsigned int family);
53 static void xfrm_policy_unlock_afinfo(struct xfrm_policy_afinfo *afinfo);
54
55 static inline int
56 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
57 {
58 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
59 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
60 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
61 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
62 (fl->proto == sel->proto || !sel->proto) &&
63 (fl->oif == sel->ifindex || !sel->ifindex);
64 }
65
66 static inline int
67 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
68 {
69 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
70 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
71 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
72 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
73 (fl->proto == sel->proto || !sel->proto) &&
74 (fl->oif == sel->ifindex || !sel->ifindex);
75 }
76
77 int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
78 unsigned short family)
79 {
80 switch (family) {
81 case AF_INET:
82 return __xfrm4_selector_match(sel, fl);
83 case AF_INET6:
84 return __xfrm6_selector_match(sel, fl);
85 }
86 return 0;
87 }
88
89 int xfrm_register_type(struct xfrm_type *type, unsigned short family)
90 {
91 struct xfrm_policy_afinfo *afinfo = xfrm_policy_lock_afinfo(family);
92 struct xfrm_type **typemap;
93 int err = 0;
94
95 if (unlikely(afinfo == NULL))
96 return -EAFNOSUPPORT;
97 typemap = afinfo->type_map;
98
99 if (likely(typemap[type->proto] == NULL))
100 typemap[type->proto] = type;
101 else
102 err = -EEXIST;
103 xfrm_policy_unlock_afinfo(afinfo);
104 return err;
105 }
106 EXPORT_SYMBOL(xfrm_register_type);
107
108 int xfrm_unregister_type(struct xfrm_type *type, unsigned short family)
109 {
110 struct xfrm_policy_afinfo *afinfo = xfrm_policy_lock_afinfo(family);
111 struct xfrm_type **typemap;
112 int err = 0;
113
114 if (unlikely(afinfo == NULL))
115 return -EAFNOSUPPORT;
116 typemap = afinfo->type_map;
117
118 if (unlikely(typemap[type->proto] != type))
119 err = -ENOENT;
120 else
121 typemap[type->proto] = NULL;
122 xfrm_policy_unlock_afinfo(afinfo);
123 return err;
124 }
125 EXPORT_SYMBOL(xfrm_unregister_type);
126
127 struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
128 {
129 struct xfrm_policy_afinfo *afinfo;
130 struct xfrm_type **typemap;
131 struct xfrm_type *type;
132 int modload_attempted = 0;
133
134 retry:
135 afinfo = xfrm_policy_get_afinfo(family);
136 if (unlikely(afinfo == NULL))
137 return NULL;
138 typemap = afinfo->type_map;
139
140 type = typemap[proto];
141 if (unlikely(type && !try_module_get(type->owner)))
142 type = NULL;
143 if (!type && !modload_attempted) {
144 xfrm_policy_put_afinfo(afinfo);
145 request_module("xfrm-type-%d-%d",
146 (int) family, (int) proto);
147 modload_attempted = 1;
148 goto retry;
149 }
150
151 xfrm_policy_put_afinfo(afinfo);
152 return type;
153 }
154
155 int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl,
156 unsigned short family)
157 {
158 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
159 int err = 0;
160
161 if (unlikely(afinfo == NULL))
162 return -EAFNOSUPPORT;
163
164 if (likely(afinfo->dst_lookup != NULL))
165 err = afinfo->dst_lookup(dst, fl);
166 else
167 err = -EINVAL;
168 xfrm_policy_put_afinfo(afinfo);
169 return err;
170 }
171 EXPORT_SYMBOL(xfrm_dst_lookup);
172
173 void xfrm_put_type(struct xfrm_type *type)
174 {
175 module_put(type->owner);
176 }
177
178 int xfrm_register_mode(struct xfrm_mode *mode, int family)
179 {
180 struct xfrm_policy_afinfo *afinfo;
181 struct xfrm_mode **modemap;
182 int err;
183
184 if (unlikely(mode->encap >= XFRM_MODE_MAX))
185 return -EINVAL;
186
187 afinfo = xfrm_policy_lock_afinfo(family);
188 if (unlikely(afinfo == NULL))
189 return -EAFNOSUPPORT;
190
191 err = -EEXIST;
192 modemap = afinfo->mode_map;
193 if (likely(modemap[mode->encap] == NULL)) {
194 modemap[mode->encap] = mode;
195 err = 0;
196 }
197
198 xfrm_policy_unlock_afinfo(afinfo);
199 return err;
200 }
201 EXPORT_SYMBOL(xfrm_register_mode);
202
203 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
204 {
205 struct xfrm_policy_afinfo *afinfo;
206 struct xfrm_mode **modemap;
207 int err;
208
209 if (unlikely(mode->encap >= XFRM_MODE_MAX))
210 return -EINVAL;
211
212 afinfo = xfrm_policy_lock_afinfo(family);
213 if (unlikely(afinfo == NULL))
214 return -EAFNOSUPPORT;
215
216 err = -ENOENT;
217 modemap = afinfo->mode_map;
218 if (likely(modemap[mode->encap] == mode)) {
219 modemap[mode->encap] = NULL;
220 err = 0;
221 }
222
223 xfrm_policy_unlock_afinfo(afinfo);
224 return err;
225 }
226 EXPORT_SYMBOL(xfrm_unregister_mode);
227
228 struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
229 {
230 struct xfrm_policy_afinfo *afinfo;
231 struct xfrm_mode *mode;
232 int modload_attempted = 0;
233
234 if (unlikely(encap >= XFRM_MODE_MAX))
235 return NULL;
236
237 retry:
238 afinfo = xfrm_policy_get_afinfo(family);
239 if (unlikely(afinfo == NULL))
240 return NULL;
241
242 mode = afinfo->mode_map[encap];
243 if (unlikely(mode && !try_module_get(mode->owner)))
244 mode = NULL;
245 if (!mode && !modload_attempted) {
246 xfrm_policy_put_afinfo(afinfo);
247 request_module("xfrm-mode-%d-%d", family, encap);
248 modload_attempted = 1;
249 goto retry;
250 }
251
252 xfrm_policy_put_afinfo(afinfo);
253 return mode;
254 }
255
256 void xfrm_put_mode(struct xfrm_mode *mode)
257 {
258 module_put(mode->owner);
259 }
260
261 static inline unsigned long make_jiffies(long secs)
262 {
263 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
264 return MAX_SCHEDULE_TIMEOUT-1;
265 else
266 return secs*HZ;
267 }
268
269 static void xfrm_policy_timer(unsigned long data)
270 {
271 struct xfrm_policy *xp = (struct xfrm_policy*)data;
272 unsigned long now = get_seconds();
273 long next = LONG_MAX;
274 int warn = 0;
275 int dir;
276
277 read_lock(&xp->lock);
278
279 if (xp->dead)
280 goto out;
281
282 dir = xfrm_policy_id2dir(xp->index);
283
284 if (xp->lft.hard_add_expires_seconds) {
285 long tmo = xp->lft.hard_add_expires_seconds +
286 xp->curlft.add_time - now;
287 if (tmo <= 0)
288 goto expired;
289 if (tmo < next)
290 next = tmo;
291 }
292 if (xp->lft.hard_use_expires_seconds) {
293 long tmo = xp->lft.hard_use_expires_seconds +
294 (xp->curlft.use_time ? : xp->curlft.add_time) - now;
295 if (tmo <= 0)
296 goto expired;
297 if (tmo < next)
298 next = tmo;
299 }
300 if (xp->lft.soft_add_expires_seconds) {
301 long tmo = xp->lft.soft_add_expires_seconds +
302 xp->curlft.add_time - now;
303 if (tmo <= 0) {
304 warn = 1;
305 tmo = XFRM_KM_TIMEOUT;
306 }
307 if (tmo < next)
308 next = tmo;
309 }
310 if (xp->lft.soft_use_expires_seconds) {
311 long tmo = xp->lft.soft_use_expires_seconds +
312 (xp->curlft.use_time ? : xp->curlft.add_time) - now;
313 if (tmo <= 0) {
314 warn = 1;
315 tmo = XFRM_KM_TIMEOUT;
316 }
317 if (tmo < next)
318 next = tmo;
319 }
320
321 if (warn)
322 km_policy_expired(xp, dir, 0, 0);
323 if (next != LONG_MAX &&
324 !mod_timer(&xp->timer, jiffies + make_jiffies(next)))
325 xfrm_pol_hold(xp);
326
327 out:
328 read_unlock(&xp->lock);
329 xfrm_pol_put(xp);
330 return;
331
332 expired:
333 read_unlock(&xp->lock);
334 if (!xfrm_policy_delete(xp, dir))
335 km_policy_expired(xp, dir, 1, 0);
336 xfrm_pol_put(xp);
337 }
338
339
340 /* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2
341 * SPD calls.
342 */
343
344 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp)
345 {
346 struct xfrm_policy *policy;
347
348 policy = kzalloc(sizeof(struct xfrm_policy), gfp);
349
350 if (policy) {
351 INIT_HLIST_NODE(&policy->bydst);
352 INIT_HLIST_NODE(&policy->byidx);
353 rwlock_init(&policy->lock);
354 atomic_set(&policy->refcnt, 1);
355 init_timer(&policy->timer);
356 policy->timer.data = (unsigned long)policy;
357 policy->timer.function = xfrm_policy_timer;
358 }
359 return policy;
360 }
361 EXPORT_SYMBOL(xfrm_policy_alloc);
362
363 /* Destroy xfrm_policy: descendant resources must be released to this moment. */
364
365 void __xfrm_policy_destroy(struct xfrm_policy *policy)
366 {
367 BUG_ON(!policy->dead);
368
369 BUG_ON(policy->bundles);
370
371 if (del_timer(&policy->timer))
372 BUG();
373
374 security_xfrm_policy_free(policy);
375 kfree(policy);
376 }
377 EXPORT_SYMBOL(__xfrm_policy_destroy);
378
379 static void xfrm_policy_gc_kill(struct xfrm_policy *policy)
380 {
381 struct dst_entry *dst;
382
383 while ((dst = policy->bundles) != NULL) {
384 policy->bundles = dst->next;
385 dst_free(dst);
386 }
387
388 if (del_timer(&policy->timer))
389 atomic_dec(&policy->refcnt);
390
391 if (atomic_read(&policy->refcnt) > 1)
392 flow_cache_flush();
393
394 xfrm_pol_put(policy);
395 }
396
397 static void xfrm_policy_gc_task(struct work_struct *work)
398 {
399 struct xfrm_policy *policy;
400 struct hlist_node *entry, *tmp;
401 struct hlist_head gc_list;
402
403 spin_lock_bh(&xfrm_policy_gc_lock);
404 gc_list.first = xfrm_policy_gc_list.first;
405 INIT_HLIST_HEAD(&xfrm_policy_gc_list);
406 spin_unlock_bh(&xfrm_policy_gc_lock);
407
408 hlist_for_each_entry_safe(policy, entry, tmp, &gc_list, bydst)
409 xfrm_policy_gc_kill(policy);
410 }
411
412 /* Rule must be locked. Release descentant resources, announce
413 * entry dead. The rule must be unlinked from lists to the moment.
414 */
415
416 static void xfrm_policy_kill(struct xfrm_policy *policy)
417 {
418 int dead;
419
420 write_lock_bh(&policy->lock);
421 dead = policy->dead;
422 policy->dead = 1;
423 write_unlock_bh(&policy->lock);
424
425 if (unlikely(dead)) {
426 WARN_ON(1);
427 return;
428 }
429
430 spin_lock(&xfrm_policy_gc_lock);
431 hlist_add_head(&policy->bydst, &xfrm_policy_gc_list);
432 spin_unlock(&xfrm_policy_gc_lock);
433
434 schedule_work(&xfrm_policy_gc_work);
435 }
436
437 struct xfrm_policy_hash {
438 struct hlist_head *table;
439 unsigned int hmask;
440 };
441
442 static struct hlist_head xfrm_policy_inexact[XFRM_POLICY_MAX*2];
443 static struct xfrm_policy_hash xfrm_policy_bydst[XFRM_POLICY_MAX*2] __read_mostly;
444 static struct hlist_head *xfrm_policy_byidx __read_mostly;
445 static unsigned int xfrm_idx_hmask __read_mostly;
446 static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024;
447
448 static inline unsigned int idx_hash(u32 index)
449 {
450 return __idx_hash(index, xfrm_idx_hmask);
451 }
452
453 static struct hlist_head *policy_hash_bysel(struct xfrm_selector *sel, unsigned short family, int dir)
454 {
455 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
456 unsigned int hash = __sel_hash(sel, family, hmask);
457
458 return (hash == hmask + 1 ?
459 &xfrm_policy_inexact[dir] :
460 xfrm_policy_bydst[dir].table + hash);
461 }
462
463 static struct hlist_head *policy_hash_direct(xfrm_address_t *daddr, xfrm_address_t *saddr, unsigned short family, int dir)
464 {
465 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
466 unsigned int hash = __addr_hash(daddr, saddr, family, hmask);
467
468 return xfrm_policy_bydst[dir].table + hash;
469 }
470
471 static void xfrm_dst_hash_transfer(struct hlist_head *list,
472 struct hlist_head *ndsttable,
473 unsigned int nhashmask)
474 {
475 struct hlist_node *entry, *tmp;
476 struct xfrm_policy *pol;
477
478 hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) {
479 unsigned int h;
480
481 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr,
482 pol->family, nhashmask);
483 hlist_add_head(&pol->bydst, ndsttable+h);
484 }
485 }
486
487 static void xfrm_idx_hash_transfer(struct hlist_head *list,
488 struct hlist_head *nidxtable,
489 unsigned int nhashmask)
490 {
491 struct hlist_node *entry, *tmp;
492 struct xfrm_policy *pol;
493
494 hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) {
495 unsigned int h;
496
497 h = __idx_hash(pol->index, nhashmask);
498 hlist_add_head(&pol->byidx, nidxtable+h);
499 }
500 }
501
502 static unsigned long xfrm_new_hash_mask(unsigned int old_hmask)
503 {
504 return ((old_hmask + 1) << 1) - 1;
505 }
506
507 static void xfrm_bydst_resize(int dir)
508 {
509 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
510 unsigned int nhashmask = xfrm_new_hash_mask(hmask);
511 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
512 struct hlist_head *odst = xfrm_policy_bydst[dir].table;
513 struct hlist_head *ndst = xfrm_hash_alloc(nsize);
514 int i;
515
516 if (!ndst)
517 return;
518
519 write_lock_bh(&xfrm_policy_lock);
520
521 for (i = hmask; i >= 0; i--)
522 xfrm_dst_hash_transfer(odst + i, ndst, nhashmask);
523
524 xfrm_policy_bydst[dir].table = ndst;
525 xfrm_policy_bydst[dir].hmask = nhashmask;
526
527 write_unlock_bh(&xfrm_policy_lock);
528
529 xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head));
530 }
531
532 static void xfrm_byidx_resize(int total)
533 {
534 unsigned int hmask = xfrm_idx_hmask;
535 unsigned int nhashmask = xfrm_new_hash_mask(hmask);
536 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
537 struct hlist_head *oidx = xfrm_policy_byidx;
538 struct hlist_head *nidx = xfrm_hash_alloc(nsize);
539 int i;
540
541 if (!nidx)
542 return;
543
544 write_lock_bh(&xfrm_policy_lock);
545
546 for (i = hmask; i >= 0; i--)
547 xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask);
548
549 xfrm_policy_byidx = nidx;
550 xfrm_idx_hmask = nhashmask;
551
552 write_unlock_bh(&xfrm_policy_lock);
553
554 xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head));
555 }
556
557 static inline int xfrm_bydst_should_resize(int dir, int *total)
558 {
559 unsigned int cnt = xfrm_policy_count[dir];
560 unsigned int hmask = xfrm_policy_bydst[dir].hmask;
561
562 if (total)
563 *total += cnt;
564
565 if ((hmask + 1) < xfrm_policy_hashmax &&
566 cnt > hmask)
567 return 1;
568
569 return 0;
570 }
571
572 static inline int xfrm_byidx_should_resize(int total)
573 {
574 unsigned int hmask = xfrm_idx_hmask;
575
576 if ((hmask + 1) < xfrm_policy_hashmax &&
577 total > hmask)
578 return 1;
579
580 return 0;
581 }
582
583 void xfrm_spd_getinfo(struct xfrmk_spdinfo *si)
584 {
585 read_lock_bh(&xfrm_policy_lock);
586 si->incnt = xfrm_policy_count[XFRM_POLICY_IN];
587 si->outcnt = xfrm_policy_count[XFRM_POLICY_OUT];
588 si->fwdcnt = xfrm_policy_count[XFRM_POLICY_FWD];
589 si->inscnt = xfrm_policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
590 si->outscnt = xfrm_policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
591 si->fwdscnt = xfrm_policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
592 si->spdhcnt = xfrm_idx_hmask;
593 si->spdhmcnt = xfrm_policy_hashmax;
594 read_unlock_bh(&xfrm_policy_lock);
595 }
596 EXPORT_SYMBOL(xfrm_spd_getinfo);
597
598 static DEFINE_MUTEX(hash_resize_mutex);
599 static void xfrm_hash_resize(struct work_struct *__unused)
600 {
601 int dir, total;
602
603 mutex_lock(&hash_resize_mutex);
604
605 total = 0;
606 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
607 if (xfrm_bydst_should_resize(dir, &total))
608 xfrm_bydst_resize(dir);
609 }
610 if (xfrm_byidx_should_resize(total))
611 xfrm_byidx_resize(total);
612
613 mutex_unlock(&hash_resize_mutex);
614 }
615
616 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
617
618 /* Generate new index... KAME seems to generate them ordered by cost
619 * of an absolute inpredictability of ordering of rules. This will not pass. */
620 static u32 xfrm_gen_index(u8 type, int dir)
621 {
622 static u32 idx_generator;
623
624 for (;;) {
625 struct hlist_node *entry;
626 struct hlist_head *list;
627 struct xfrm_policy *p;
628 u32 idx;
629 int found;
630
631 idx = (idx_generator | dir);
632 idx_generator += 8;
633 if (idx == 0)
634 idx = 8;
635 list = xfrm_policy_byidx + idx_hash(idx);
636 found = 0;
637 hlist_for_each_entry(p, entry, list, byidx) {
638 if (p->index == idx) {
639 found = 1;
640 break;
641 }
642 }
643 if (!found)
644 return idx;
645 }
646 }
647
648 static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s2)
649 {
650 u32 *p1 = (u32 *) s1;
651 u32 *p2 = (u32 *) s2;
652 int len = sizeof(struct xfrm_selector) / sizeof(u32);
653 int i;
654
655 for (i = 0; i < len; i++) {
656 if (p1[i] != p2[i])
657 return 1;
658 }
659
660 return 0;
661 }
662
663 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
664 {
665 struct xfrm_policy *pol;
666 struct xfrm_policy *delpol;
667 struct hlist_head *chain;
668 struct hlist_node *entry, *newpos;
669 struct dst_entry *gc_list;
670
671 write_lock_bh(&xfrm_policy_lock);
672 chain = policy_hash_bysel(&policy->selector, policy->family, dir);
673 delpol = NULL;
674 newpos = NULL;
675 hlist_for_each_entry(pol, entry, chain, bydst) {
676 if (pol->type == policy->type &&
677 !selector_cmp(&pol->selector, &policy->selector) &&
678 xfrm_sec_ctx_match(pol->security, policy->security) &&
679 !WARN_ON(delpol)) {
680 if (excl) {
681 write_unlock_bh(&xfrm_policy_lock);
682 return -EEXIST;
683 }
684 delpol = pol;
685 if (policy->priority > pol->priority)
686 continue;
687 } else if (policy->priority >= pol->priority) {
688 newpos = &pol->bydst;
689 continue;
690 }
691 if (delpol)
692 break;
693 }
694 if (newpos)
695 hlist_add_after(newpos, &policy->bydst);
696 else
697 hlist_add_head(&policy->bydst, chain);
698 xfrm_pol_hold(policy);
699 xfrm_policy_count[dir]++;
700 atomic_inc(&flow_cache_genid);
701 if (delpol) {
702 hlist_del(&delpol->bydst);
703 hlist_del(&delpol->byidx);
704 xfrm_policy_count[dir]--;
705 }
706 policy->index = delpol ? delpol->index : xfrm_gen_index(policy->type, dir);
707 hlist_add_head(&policy->byidx, xfrm_policy_byidx+idx_hash(policy->index));
708 policy->curlft.add_time = get_seconds();
709 policy->curlft.use_time = 0;
710 if (!mod_timer(&policy->timer, jiffies + HZ))
711 xfrm_pol_hold(policy);
712 write_unlock_bh(&xfrm_policy_lock);
713
714 if (delpol)
715 xfrm_policy_kill(delpol);
716 else if (xfrm_bydst_should_resize(dir, NULL))
717 schedule_work(&xfrm_hash_work);
718
719 read_lock_bh(&xfrm_policy_lock);
720 gc_list = NULL;
721 entry = &policy->bydst;
722 hlist_for_each_entry_continue(policy, entry, bydst) {
723 struct dst_entry *dst;
724
725 write_lock(&policy->lock);
726 dst = policy->bundles;
727 if (dst) {
728 struct dst_entry *tail = dst;
729 while (tail->next)
730 tail = tail->next;
731 tail->next = gc_list;
732 gc_list = dst;
733
734 policy->bundles = NULL;
735 }
736 write_unlock(&policy->lock);
737 }
738 read_unlock_bh(&xfrm_policy_lock);
739
740 while (gc_list) {
741 struct dst_entry *dst = gc_list;
742
743 gc_list = dst->next;
744 dst_free(dst);
745 }
746
747 return 0;
748 }
749 EXPORT_SYMBOL(xfrm_policy_insert);
750
751 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
752 struct xfrm_selector *sel,
753 struct xfrm_sec_ctx *ctx, int delete,
754 int *err)
755 {
756 struct xfrm_policy *pol, *ret;
757 struct hlist_head *chain;
758 struct hlist_node *entry;
759
760 *err = 0;
761 write_lock_bh(&xfrm_policy_lock);
762 chain = policy_hash_bysel(sel, sel->family, dir);
763 ret = NULL;
764 hlist_for_each_entry(pol, entry, chain, bydst) {
765 if (pol->type == type &&
766 !selector_cmp(sel, &pol->selector) &&
767 xfrm_sec_ctx_match(ctx, pol->security)) {
768 xfrm_pol_hold(pol);
769 if (delete) {
770 *err = security_xfrm_policy_delete(pol);
771 if (*err) {
772 write_unlock_bh(&xfrm_policy_lock);
773 return pol;
774 }
775 hlist_del(&pol->bydst);
776 hlist_del(&pol->byidx);
777 xfrm_policy_count[dir]--;
778 }
779 ret = pol;
780 break;
781 }
782 }
783 write_unlock_bh(&xfrm_policy_lock);
784
785 if (ret && delete) {
786 atomic_inc(&flow_cache_genid);
787 xfrm_policy_kill(ret);
788 }
789 return ret;
790 }
791 EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
792
793 struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
794 int *err)
795 {
796 struct xfrm_policy *pol, *ret;
797 struct hlist_head *chain;
798 struct hlist_node *entry;
799
800 *err = -ENOENT;
801 if (xfrm_policy_id2dir(id) != dir)
802 return NULL;
803
804 *err = 0;
805 write_lock_bh(&xfrm_policy_lock);
806 chain = xfrm_policy_byidx + idx_hash(id);
807 ret = NULL;
808 hlist_for_each_entry(pol, entry, chain, byidx) {
809 if (pol->type == type && pol->index == id) {
810 xfrm_pol_hold(pol);
811 if (delete) {
812 *err = security_xfrm_policy_delete(pol);
813 if (*err) {
814 write_unlock_bh(&xfrm_policy_lock);
815 return pol;
816 }
817 hlist_del(&pol->bydst);
818 hlist_del(&pol->byidx);
819 xfrm_policy_count[dir]--;
820 }
821 ret = pol;
822 break;
823 }
824 }
825 write_unlock_bh(&xfrm_policy_lock);
826
827 if (ret && delete) {
828 atomic_inc(&flow_cache_genid);
829 xfrm_policy_kill(ret);
830 }
831 return ret;
832 }
833 EXPORT_SYMBOL(xfrm_policy_byid);
834
835 #ifdef CONFIG_SECURITY_NETWORK_XFRM
836 static inline int
837 xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
838 {
839 int dir, err = 0;
840
841 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
842 struct xfrm_policy *pol;
843 struct hlist_node *entry;
844 int i;
845
846 hlist_for_each_entry(pol, entry,
847 &xfrm_policy_inexact[dir], bydst) {
848 if (pol->type != type)
849 continue;
850 err = security_xfrm_policy_delete(pol);
851 if (err) {
852 xfrm_audit_policy_delete(pol, 0,
853 audit_info->loginuid,
854 audit_info->secid);
855 return err;
856 }
857 }
858 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
859 hlist_for_each_entry(pol, entry,
860 xfrm_policy_bydst[dir].table + i,
861 bydst) {
862 if (pol->type != type)
863 continue;
864 err = security_xfrm_policy_delete(pol);
865 if (err) {
866 xfrm_audit_policy_delete(pol, 0,
867 audit_info->loginuid,
868 audit_info->secid);
869 return err;
870 }
871 }
872 }
873 }
874 return err;
875 }
876 #else
877 static inline int
878 xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
879 {
880 return 0;
881 }
882 #endif
883
884 int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
885 {
886 int dir, err = 0;
887
888 write_lock_bh(&xfrm_policy_lock);
889
890 err = xfrm_policy_flush_secctx_check(type, audit_info);
891 if (err)
892 goto out;
893
894 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
895 struct xfrm_policy *pol;
896 struct hlist_node *entry;
897 int i, killed;
898
899 killed = 0;
900 again1:
901 hlist_for_each_entry(pol, entry,
902 &xfrm_policy_inexact[dir], bydst) {
903 if (pol->type != type)
904 continue;
905 hlist_del(&pol->bydst);
906 hlist_del(&pol->byidx);
907 write_unlock_bh(&xfrm_policy_lock);
908
909 xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,
910 audit_info->secid);
911
912 xfrm_policy_kill(pol);
913 killed++;
914
915 write_lock_bh(&xfrm_policy_lock);
916 goto again1;
917 }
918
919 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
920 again2:
921 hlist_for_each_entry(pol, entry,
922 xfrm_policy_bydst[dir].table + i,
923 bydst) {
924 if (pol->type != type)
925 continue;
926 hlist_del(&pol->bydst);
927 hlist_del(&pol->byidx);
928 write_unlock_bh(&xfrm_policy_lock);
929
930 xfrm_audit_policy_delete(pol, 1,
931 audit_info->loginuid,
932 audit_info->secid);
933 xfrm_policy_kill(pol);
934 killed++;
935
936 write_lock_bh(&xfrm_policy_lock);
937 goto again2;
938 }
939 }
940
941 xfrm_policy_count[dir] -= killed;
942 }
943 atomic_inc(&flow_cache_genid);
944 out:
945 write_unlock_bh(&xfrm_policy_lock);
946 return err;
947 }
948 EXPORT_SYMBOL(xfrm_policy_flush);
949
950 int xfrm_policy_walk(u8 type, int (*func)(struct xfrm_policy *, int, int, void*),
951 void *data)
952 {
953 struct xfrm_policy *pol, *last = NULL;
954 struct hlist_node *entry;
955 int dir, last_dir = 0, count, error;
956
957 read_lock_bh(&xfrm_policy_lock);
958 count = 0;
959
960 for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) {
961 struct hlist_head *table = xfrm_policy_bydst[dir].table;
962 int i;
963
964 hlist_for_each_entry(pol, entry,
965 &xfrm_policy_inexact[dir], bydst) {
966 if (pol->type != type)
967 continue;
968 if (last) {
969 error = func(last, last_dir % XFRM_POLICY_MAX,
970 count, data);
971 if (error)
972 goto out;
973 }
974 last = pol;
975 last_dir = dir;
976 count++;
977 }
978 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
979 hlist_for_each_entry(pol, entry, table + i, bydst) {
980 if (pol->type != type)
981 continue;
982 if (last) {
983 error = func(last, last_dir % XFRM_POLICY_MAX,
984 count, data);
985 if (error)
986 goto out;
987 }
988 last = pol;
989 last_dir = dir;
990 count++;
991 }
992 }
993 }
994 if (count == 0) {
995 error = -ENOENT;
996 goto out;
997 }
998 error = func(last, last_dir % XFRM_POLICY_MAX, 0, data);
999 out:
1000 read_unlock_bh(&xfrm_policy_lock);
1001 return error;
1002 }
1003 EXPORT_SYMBOL(xfrm_policy_walk);
1004
1005 /*
1006 * Find policy to apply to this flow.
1007 *
1008 * Returns 0 if policy found, else an -errno.
1009 */
1010 static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,
1011 u8 type, u16 family, int dir)
1012 {
1013 struct xfrm_selector *sel = &pol->selector;
1014 int match, ret = -ESRCH;
1015
1016 if (pol->family != family ||
1017 pol->type != type)
1018 return ret;
1019
1020 match = xfrm_selector_match(sel, fl, family);
1021 if (match)
1022 ret = security_xfrm_policy_lookup(pol, fl->secid, dir);
1023
1024 return ret;
1025 }
1026
1027 static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
1028 u16 family, u8 dir)
1029 {
1030 int err;
1031 struct xfrm_policy *pol, *ret;
1032 xfrm_address_t *daddr, *saddr;
1033 struct hlist_node *entry;
1034 struct hlist_head *chain;
1035 u32 priority = ~0U;
1036
1037 daddr = xfrm_flowi_daddr(fl, family);
1038 saddr = xfrm_flowi_saddr(fl, family);
1039 if (unlikely(!daddr || !saddr))
1040 return NULL;
1041
1042 read_lock_bh(&xfrm_policy_lock);
1043 chain = policy_hash_direct(daddr, saddr, family, dir);
1044 ret = NULL;
1045 hlist_for_each_entry(pol, entry, chain, bydst) {
1046 err = xfrm_policy_match(pol, fl, type, family, dir);
1047 if (err) {
1048 if (err == -ESRCH)
1049 continue;
1050 else {
1051 ret = ERR_PTR(err);
1052 goto fail;
1053 }
1054 } else {
1055 ret = pol;
1056 priority = ret->priority;
1057 break;
1058 }
1059 }
1060 chain = &xfrm_policy_inexact[dir];
1061 hlist_for_each_entry(pol, entry, chain, bydst) {
1062 err = xfrm_policy_match(pol, fl, type, family, dir);
1063 if (err) {
1064 if (err == -ESRCH)
1065 continue;
1066 else {
1067 ret = ERR_PTR(err);
1068 goto fail;
1069 }
1070 } else if (pol->priority < priority) {
1071 ret = pol;
1072 break;
1073 }
1074 }
1075 if (ret)
1076 xfrm_pol_hold(ret);
1077 fail:
1078 read_unlock_bh(&xfrm_policy_lock);
1079
1080 return ret;
1081 }
1082
1083 static int xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
1084 void **objp, atomic_t **obj_refp)
1085 {
1086 struct xfrm_policy *pol;
1087 int err = 0;
1088
1089 #ifdef CONFIG_XFRM_SUB_POLICY
1090 pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_SUB, fl, family, dir);
1091 if (IS_ERR(pol)) {
1092 err = PTR_ERR(pol);
1093 pol = NULL;
1094 }
1095 if (pol || err)
1096 goto end;
1097 #endif
1098 pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, fl, family, dir);
1099 if (IS_ERR(pol)) {
1100 err = PTR_ERR(pol);
1101 pol = NULL;
1102 }
1103 #ifdef CONFIG_XFRM_SUB_POLICY
1104 end:
1105 #endif
1106 if ((*objp = (void *) pol) != NULL)
1107 *obj_refp = &pol->refcnt;
1108 return err;
1109 }
1110
1111 static inline int policy_to_flow_dir(int dir)
1112 {
1113 if (XFRM_POLICY_IN == FLOW_DIR_IN &&
1114 XFRM_POLICY_OUT == FLOW_DIR_OUT &&
1115 XFRM_POLICY_FWD == FLOW_DIR_FWD)
1116 return dir;
1117 switch (dir) {
1118 default:
1119 case XFRM_POLICY_IN:
1120 return FLOW_DIR_IN;
1121 case XFRM_POLICY_OUT:
1122 return FLOW_DIR_OUT;
1123 case XFRM_POLICY_FWD:
1124 return FLOW_DIR_FWD;
1125 }
1126 }
1127
1128 static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl)
1129 {
1130 struct xfrm_policy *pol;
1131
1132 read_lock_bh(&xfrm_policy_lock);
1133 if ((pol = sk->sk_policy[dir]) != NULL) {
1134 int match = xfrm_selector_match(&pol->selector, fl,
1135 sk->sk_family);
1136 int err = 0;
1137
1138 if (match) {
1139 err = security_xfrm_policy_lookup(pol, fl->secid,
1140 policy_to_flow_dir(dir));
1141 if (!err)
1142 xfrm_pol_hold(pol);
1143 else if (err == -ESRCH)
1144 pol = NULL;
1145 else
1146 pol = ERR_PTR(err);
1147 } else
1148 pol = NULL;
1149 }
1150 read_unlock_bh(&xfrm_policy_lock);
1151 return pol;
1152 }
1153
1154 static void __xfrm_policy_link(struct xfrm_policy *pol, int dir)
1155 {
1156 struct hlist_head *chain = policy_hash_bysel(&pol->selector,
1157 pol->family, dir);
1158
1159 hlist_add_head(&pol->bydst, chain);
1160 hlist_add_head(&pol->byidx, xfrm_policy_byidx+idx_hash(pol->index));
1161 xfrm_policy_count[dir]++;
1162 xfrm_pol_hold(pol);
1163
1164 if (xfrm_bydst_should_resize(dir, NULL))
1165 schedule_work(&xfrm_hash_work);
1166 }
1167
1168 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
1169 int dir)
1170 {
1171 if (hlist_unhashed(&pol->bydst))
1172 return NULL;
1173
1174 hlist_del(&pol->bydst);
1175 hlist_del(&pol->byidx);
1176 xfrm_policy_count[dir]--;
1177
1178 return pol;
1179 }
1180
1181 int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
1182 {
1183 write_lock_bh(&xfrm_policy_lock);
1184 pol = __xfrm_policy_unlink(pol, dir);
1185 write_unlock_bh(&xfrm_policy_lock);
1186 if (pol) {
1187 if (dir < XFRM_POLICY_MAX)
1188 atomic_inc(&flow_cache_genid);
1189 xfrm_policy_kill(pol);
1190 return 0;
1191 }
1192 return -ENOENT;
1193 }
1194 EXPORT_SYMBOL(xfrm_policy_delete);
1195
1196 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
1197 {
1198 struct xfrm_policy *old_pol;
1199
1200 #ifdef CONFIG_XFRM_SUB_POLICY
1201 if (pol && pol->type != XFRM_POLICY_TYPE_MAIN)
1202 return -EINVAL;
1203 #endif
1204
1205 write_lock_bh(&xfrm_policy_lock);
1206 old_pol = sk->sk_policy[dir];
1207 sk->sk_policy[dir] = pol;
1208 if (pol) {
1209 pol->curlft.add_time = get_seconds();
1210 pol->index = xfrm_gen_index(pol->type, XFRM_POLICY_MAX+dir);
1211 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
1212 }
1213 if (old_pol)
1214 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
1215 write_unlock_bh(&xfrm_policy_lock);
1216
1217 if (old_pol) {
1218 xfrm_policy_kill(old_pol);
1219 }
1220 return 0;
1221 }
1222
1223 static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
1224 {
1225 struct xfrm_policy *newp = xfrm_policy_alloc(GFP_ATOMIC);
1226
1227 if (newp) {
1228 newp->selector = old->selector;
1229 if (security_xfrm_policy_clone(old, newp)) {
1230 kfree(newp);
1231 return NULL; /* ENOMEM */
1232 }
1233 newp->lft = old->lft;
1234 newp->curlft = old->curlft;
1235 newp->action = old->action;
1236 newp->flags = old->flags;
1237 newp->xfrm_nr = old->xfrm_nr;
1238 newp->index = old->index;
1239 newp->type = old->type;
1240 memcpy(newp->xfrm_vec, old->xfrm_vec,
1241 newp->xfrm_nr*sizeof(struct xfrm_tmpl));
1242 write_lock_bh(&xfrm_policy_lock);
1243 __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir);
1244 write_unlock_bh(&xfrm_policy_lock);
1245 xfrm_pol_put(newp);
1246 }
1247 return newp;
1248 }
1249
1250 int __xfrm_sk_clone_policy(struct sock *sk)
1251 {
1252 struct xfrm_policy *p0 = sk->sk_policy[0],
1253 *p1 = sk->sk_policy[1];
1254
1255 sk->sk_policy[0] = sk->sk_policy[1] = NULL;
1256 if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL)
1257 return -ENOMEM;
1258 if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL)
1259 return -ENOMEM;
1260 return 0;
1261 }
1262
1263 static int
1264 xfrm_get_saddr(xfrm_address_t *local, xfrm_address_t *remote,
1265 unsigned short family)
1266 {
1267 int err;
1268 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1269
1270 if (unlikely(afinfo == NULL))
1271 return -EINVAL;
1272 err = afinfo->get_saddr(local, remote);
1273 xfrm_policy_put_afinfo(afinfo);
1274 return err;
1275 }
1276
1277 /* Resolve list of templates for the flow, given policy. */
1278
1279 static int
1280 xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
1281 struct xfrm_state **xfrm,
1282 unsigned short family)
1283 {
1284 int nx;
1285 int i, error;
1286 xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
1287 xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
1288 xfrm_address_t tmp;
1289
1290 for (nx=0, i = 0; i < policy->xfrm_nr; i++) {
1291 struct xfrm_state *x;
1292 xfrm_address_t *remote = daddr;
1293 xfrm_address_t *local = saddr;
1294 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
1295
1296 if (tmpl->mode == XFRM_MODE_TUNNEL ||
1297 tmpl->mode == XFRM_MODE_BEET) {
1298 remote = &tmpl->id.daddr;
1299 local = &tmpl->saddr;
1300 family = tmpl->encap_family;
1301 if (xfrm_addr_any(local, family)) {
1302 error = xfrm_get_saddr(&tmp, remote, family);
1303 if (error)
1304 goto fail;
1305 local = &tmp;
1306 }
1307 }
1308
1309 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
1310
1311 if (x && x->km.state == XFRM_STATE_VALID) {
1312 xfrm[nx++] = x;
1313 daddr = remote;
1314 saddr = local;
1315 continue;
1316 }
1317 if (x) {
1318 error = (x->km.state == XFRM_STATE_ERROR ?
1319 -EINVAL : -EAGAIN);
1320 xfrm_state_put(x);
1321 }
1322
1323 if (!tmpl->optional)
1324 goto fail;
1325 }
1326 return nx;
1327
1328 fail:
1329 for (nx--; nx>=0; nx--)
1330 xfrm_state_put(xfrm[nx]);
1331 return error;
1332 }
1333
1334 static int
1335 xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, struct flowi *fl,
1336 struct xfrm_state **xfrm,
1337 unsigned short family)
1338 {
1339 struct xfrm_state *tp[XFRM_MAX_DEPTH];
1340 struct xfrm_state **tpp = (npols > 1) ? tp : xfrm;
1341 int cnx = 0;
1342 int error;
1343 int ret;
1344 int i;
1345
1346 for (i = 0; i < npols; i++) {
1347 if (cnx + pols[i]->xfrm_nr >= XFRM_MAX_DEPTH) {
1348 error = -ENOBUFS;
1349 goto fail;
1350 }
1351
1352 ret = xfrm_tmpl_resolve_one(pols[i], fl, &tpp[cnx], family);
1353 if (ret < 0) {
1354 error = ret;
1355 goto fail;
1356 } else
1357 cnx += ret;
1358 }
1359
1360 /* found states are sorted for outbound processing */
1361 if (npols > 1)
1362 xfrm_state_sort(xfrm, tpp, cnx, family);
1363
1364 return cnx;
1365
1366 fail:
1367 for (cnx--; cnx>=0; cnx--)
1368 xfrm_state_put(tpp[cnx]);
1369 return error;
1370
1371 }
1372
1373 /* Check that the bundle accepts the flow and its components are
1374 * still valid.
1375 */
1376
1377 static struct dst_entry *
1378 xfrm_find_bundle(struct flowi *fl, struct xfrm_policy *policy, unsigned short family)
1379 {
1380 struct dst_entry *x;
1381 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1382 if (unlikely(afinfo == NULL))
1383 return ERR_PTR(-EINVAL);
1384 x = afinfo->find_bundle(fl, policy);
1385 xfrm_policy_put_afinfo(afinfo);
1386 return x;
1387 }
1388
1389 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
1390 * all the metrics... Shortly, bundle a bundle.
1391 */
1392
1393 static int
1394 xfrm_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
1395 struct flowi *fl, struct dst_entry **dst_p,
1396 unsigned short family)
1397 {
1398 int err;
1399 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1400 if (unlikely(afinfo == NULL))
1401 return -EINVAL;
1402 err = afinfo->bundle_create(policy, xfrm, nx, fl, dst_p);
1403 xfrm_policy_put_afinfo(afinfo);
1404 return err;
1405 }
1406
1407 static int inline
1408 xfrm_dst_alloc_copy(void **target, void *src, int size)
1409 {
1410 if (!*target) {
1411 *target = kmalloc(size, GFP_ATOMIC);
1412 if (!*target)
1413 return -ENOMEM;
1414 }
1415 memcpy(*target, src, size);
1416 return 0;
1417 }
1418
1419 static int inline
1420 xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
1421 {
1422 #ifdef CONFIG_XFRM_SUB_POLICY
1423 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1424 return xfrm_dst_alloc_copy((void **)&(xdst->partner),
1425 sel, sizeof(*sel));
1426 #else
1427 return 0;
1428 #endif
1429 }
1430
1431 static int inline
1432 xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
1433 {
1434 #ifdef CONFIG_XFRM_SUB_POLICY
1435 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
1436 return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
1437 #else
1438 return 0;
1439 #endif
1440 }
1441
1442 static int stale_bundle(struct dst_entry *dst);
1443
1444 /* Main function: finds/creates a bundle for given flow.
1445 *
1446 * At the moment we eat a raw IP route. Mostly to speed up lookups
1447 * on interfaces with disabled IPsec.
1448 */
1449 int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
1450 struct sock *sk, int flags)
1451 {
1452 struct xfrm_policy *policy;
1453 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1454 int npols;
1455 int pol_dead;
1456 int xfrm_nr;
1457 int pi;
1458 struct xfrm_state *xfrm[XFRM_MAX_DEPTH];
1459 struct dst_entry *dst, *dst_orig = *dst_p;
1460 int nx = 0;
1461 int err;
1462 u32 genid;
1463 u16 family;
1464 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
1465
1466 restart:
1467 genid = atomic_read(&flow_cache_genid);
1468 policy = NULL;
1469 for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
1470 pols[pi] = NULL;
1471 npols = 0;
1472 pol_dead = 0;
1473 xfrm_nr = 0;
1474
1475 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
1476 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
1477 if (IS_ERR(policy))
1478 return PTR_ERR(policy);
1479 }
1480
1481 if (!policy) {
1482 /* To accelerate a bit... */
1483 if ((dst_orig->flags & DST_NOXFRM) ||
1484 !xfrm_policy_count[XFRM_POLICY_OUT])
1485 return 0;
1486
1487 policy = flow_cache_lookup(fl, dst_orig->ops->family,
1488 dir, xfrm_policy_lookup);
1489 if (IS_ERR(policy))
1490 return PTR_ERR(policy);
1491 }
1492
1493 if (!policy)
1494 return 0;
1495
1496 family = dst_orig->ops->family;
1497 policy->curlft.use_time = get_seconds();
1498 pols[0] = policy;
1499 npols ++;
1500 xfrm_nr += pols[0]->xfrm_nr;
1501
1502 switch (policy->action) {
1503 case XFRM_POLICY_BLOCK:
1504 /* Prohibit the flow */
1505 err = -EPERM;
1506 goto error;
1507
1508 case XFRM_POLICY_ALLOW:
1509 #ifndef CONFIG_XFRM_SUB_POLICY
1510 if (policy->xfrm_nr == 0) {
1511 /* Flow passes not transformed. */
1512 xfrm_pol_put(policy);
1513 return 0;
1514 }
1515 #endif
1516
1517 /* Try to find matching bundle.
1518 *
1519 * LATER: help from flow cache. It is optional, this
1520 * is required only for output policy.
1521 */
1522 dst = xfrm_find_bundle(fl, policy, family);
1523 if (IS_ERR(dst)) {
1524 err = PTR_ERR(dst);
1525 goto error;
1526 }
1527
1528 if (dst)
1529 break;
1530
1531 #ifdef CONFIG_XFRM_SUB_POLICY
1532 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
1533 pols[1] = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN,
1534 fl, family,
1535 XFRM_POLICY_OUT);
1536 if (pols[1]) {
1537 if (IS_ERR(pols[1])) {
1538 err = PTR_ERR(pols[1]);
1539 goto error;
1540 }
1541 if (pols[1]->action == XFRM_POLICY_BLOCK) {
1542 err = -EPERM;
1543 goto error;
1544 }
1545 npols ++;
1546 xfrm_nr += pols[1]->xfrm_nr;
1547 }
1548 }
1549
1550 /*
1551 * Because neither flowi nor bundle information knows about
1552 * transformation template size. On more than one policy usage
1553 * we can realize whether all of them is bypass or not after
1554 * they are searched. See above not-transformed bypass
1555 * is surrounded by non-sub policy configuration, too.
1556 */
1557 if (xfrm_nr == 0) {
1558 /* Flow passes not transformed. */
1559 xfrm_pols_put(pols, npols);
1560 return 0;
1561 }
1562
1563 #endif
1564 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family);
1565
1566 if (unlikely(nx<0)) {
1567 err = nx;
1568 if (err == -EAGAIN && sysctl_xfrm_larval_drop) {
1569 /* EREMOTE tells the caller to generate
1570 * a one-shot blackhole route.
1571 */
1572 xfrm_pol_put(policy);
1573 return -EREMOTE;
1574 }
1575 if (err == -EAGAIN && flags) {
1576 DECLARE_WAITQUEUE(wait, current);
1577
1578 add_wait_queue(&km_waitq, &wait);
1579 set_current_state(TASK_INTERRUPTIBLE);
1580 schedule();
1581 set_current_state(TASK_RUNNING);
1582 remove_wait_queue(&km_waitq, &wait);
1583
1584 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family);
1585
1586 if (nx == -EAGAIN && signal_pending(current)) {
1587 err = -ERESTART;
1588 goto error;
1589 }
1590 if (nx == -EAGAIN ||
1591 genid != atomic_read(&flow_cache_genid)) {
1592 xfrm_pols_put(pols, npols);
1593 goto restart;
1594 }
1595 err = nx;
1596 }
1597 if (err < 0)
1598 goto error;
1599 }
1600 if (nx == 0) {
1601 /* Flow passes not transformed. */
1602 xfrm_pols_put(pols, npols);
1603 return 0;
1604 }
1605
1606 dst = dst_orig;
1607 err = xfrm_bundle_create(policy, xfrm, nx, fl, &dst, family);
1608
1609 if (unlikely(err)) {
1610 int i;
1611 for (i=0; i<nx; i++)
1612 xfrm_state_put(xfrm[i]);
1613 goto error;
1614 }
1615
1616 for (pi = 0; pi < npols; pi++) {
1617 read_lock_bh(&pols[pi]->lock);
1618 pol_dead |= pols[pi]->dead;
1619 read_unlock_bh(&pols[pi]->lock);
1620 }
1621
1622 write_lock_bh(&policy->lock);
1623 if (unlikely(pol_dead || stale_bundle(dst))) {
1624 /* Wow! While we worked on resolving, this
1625 * policy has gone. Retry. It is not paranoia,
1626 * we just cannot enlist new bundle to dead object.
1627 * We can't enlist stable bundles either.
1628 */
1629 write_unlock_bh(&policy->lock);
1630 if (dst)
1631 dst_free(dst);
1632
1633 err = -EHOSTUNREACH;
1634 goto error;
1635 }
1636
1637 if (npols > 1)
1638 err = xfrm_dst_update_parent(dst, &pols[1]->selector);
1639 else
1640 err = xfrm_dst_update_origin(dst, fl);
1641 if (unlikely(err)) {
1642 write_unlock_bh(&policy->lock);
1643 if (dst)
1644 dst_free(dst);
1645 goto error;
1646 }
1647
1648 dst->next = policy->bundles;
1649 policy->bundles = dst;
1650 dst_hold(dst);
1651 write_unlock_bh(&policy->lock);
1652 }
1653 *dst_p = dst;
1654 dst_release(dst_orig);
1655 xfrm_pols_put(pols, npols);
1656 return 0;
1657
1658 error:
1659 dst_release(dst_orig);
1660 xfrm_pols_put(pols, npols);
1661 *dst_p = NULL;
1662 return err;
1663 }
1664 EXPORT_SYMBOL(__xfrm_lookup);
1665
1666 int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
1667 struct sock *sk, int flags)
1668 {
1669 int err = __xfrm_lookup(dst_p, fl, sk, flags);
1670
1671 if (err == -EREMOTE) {
1672 dst_release(*dst_p);
1673 *dst_p = NULL;
1674 err = -EAGAIN;
1675 }
1676
1677 return err;
1678 }
1679 EXPORT_SYMBOL(xfrm_lookup);
1680
1681 static inline int
1682 xfrm_secpath_reject(int idx, struct sk_buff *skb, struct flowi *fl)
1683 {
1684 struct xfrm_state *x;
1685 int err;
1686
1687 if (!skb->sp || idx < 0 || idx >= skb->sp->len)
1688 return 0;
1689 x = skb->sp->xvec[idx];
1690 if (!x->type->reject)
1691 return 0;
1692 xfrm_state_hold(x);
1693 err = x->type->reject(x, skb, fl);
1694 xfrm_state_put(x);
1695 return err;
1696 }
1697
1698 /* When skb is transformed back to its "native" form, we have to
1699 * check policy restrictions. At the moment we make this in maximally
1700 * stupid way. Shame on me. :-) Of course, connected sockets must
1701 * have policy cached at them.
1702 */
1703
1704 static inline int
1705 xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
1706 unsigned short family)
1707 {
1708 if (xfrm_state_kern(x))
1709 return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
1710 return x->id.proto == tmpl->id.proto &&
1711 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
1712 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
1713 x->props.mode == tmpl->mode &&
1714 ((tmpl->aalgos & (1<<x->props.aalgo)) ||
1715 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
1716 !(x->props.mode != XFRM_MODE_TRANSPORT &&
1717 xfrm_state_addr_cmp(tmpl, x, family));
1718 }
1719
1720 /*
1721 * 0 or more than 0 is returned when validation is succeeded (either bypass
1722 * because of optional transport mode, or next index of the mathced secpath
1723 * state with the template.
1724 * -1 is returned when no matching template is found.
1725 * Otherwise "-2 - errored_index" is returned.
1726 */
1727 static inline int
1728 xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
1729 unsigned short family)
1730 {
1731 int idx = start;
1732
1733 if (tmpl->optional) {
1734 if (tmpl->mode == XFRM_MODE_TRANSPORT)
1735 return start;
1736 } else
1737 start = -1;
1738 for (; idx < sp->len; idx++) {
1739 if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
1740 return ++idx;
1741 if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
1742 if (start == -1)
1743 start = -2-idx;
1744 break;
1745 }
1746 }
1747 return start;
1748 }
1749
1750 int
1751 xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family)
1752 {
1753 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1754 int err;
1755
1756 if (unlikely(afinfo == NULL))
1757 return -EAFNOSUPPORT;
1758
1759 afinfo->decode_session(skb, fl);
1760 err = security_xfrm_decode_session(skb, &fl->secid);
1761 xfrm_policy_put_afinfo(afinfo);
1762 return err;
1763 }
1764 EXPORT_SYMBOL(xfrm_decode_session);
1765
1766 static inline int secpath_has_nontransport(struct sec_path *sp, int k, int *idxp)
1767 {
1768 for (; k < sp->len; k++) {
1769 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) {
1770 *idxp = k;
1771 return 1;
1772 }
1773 }
1774
1775 return 0;
1776 }
1777
1778 int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
1779 unsigned short family)
1780 {
1781 struct xfrm_policy *pol;
1782 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1783 int npols = 0;
1784 int xfrm_nr;
1785 int pi;
1786 struct flowi fl;
1787 u8 fl_dir = policy_to_flow_dir(dir);
1788 int xerr_idx = -1;
1789
1790 if (xfrm_decode_session(skb, &fl, family) < 0)
1791 return 0;
1792 nf_nat_decode_session(skb, &fl, family);
1793
1794 /* First, check used SA against their selectors. */
1795 if (skb->sp) {
1796 int i;
1797
1798 for (i=skb->sp->len-1; i>=0; i--) {
1799 struct xfrm_state *x = skb->sp->xvec[i];
1800 if (!xfrm_selector_match(&x->sel, &fl, family))
1801 return 0;
1802 }
1803 }
1804
1805 pol = NULL;
1806 if (sk && sk->sk_policy[dir]) {
1807 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
1808 if (IS_ERR(pol))
1809 return 0;
1810 }
1811
1812 if (!pol)
1813 pol = flow_cache_lookup(&fl, family, fl_dir,
1814 xfrm_policy_lookup);
1815
1816 if (IS_ERR(pol))
1817 return 0;
1818
1819 if (!pol) {
1820 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {
1821 xfrm_secpath_reject(xerr_idx, skb, &fl);
1822 return 0;
1823 }
1824 return 1;
1825 }
1826
1827 pol->curlft.use_time = get_seconds();
1828
1829 pols[0] = pol;
1830 npols ++;
1831 #ifdef CONFIG_XFRM_SUB_POLICY
1832 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
1833 pols[1] = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN,
1834 &fl, family,
1835 XFRM_POLICY_IN);
1836 if (pols[1]) {
1837 if (IS_ERR(pols[1]))
1838 return 0;
1839 pols[1]->curlft.use_time = get_seconds();
1840 npols ++;
1841 }
1842 }
1843 #endif
1844
1845 if (pol->action == XFRM_POLICY_ALLOW) {
1846 struct sec_path *sp;
1847 static struct sec_path dummy;
1848 struct xfrm_tmpl *tp[XFRM_MAX_DEPTH];
1849 struct xfrm_tmpl *stp[XFRM_MAX_DEPTH];
1850 struct xfrm_tmpl **tpp = tp;
1851 int ti = 0;
1852 int i, k;
1853
1854 if ((sp = skb->sp) == NULL)
1855 sp = &dummy;
1856
1857 for (pi = 0; pi < npols; pi++) {
1858 if (pols[pi] != pol &&
1859 pols[pi]->action != XFRM_POLICY_ALLOW)
1860 goto reject;
1861 if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH)
1862 goto reject_error;
1863 for (i = 0; i < pols[pi]->xfrm_nr; i++)
1864 tpp[ti++] = &pols[pi]->xfrm_vec[i];
1865 }
1866 xfrm_nr = ti;
1867 if (npols > 1) {
1868 xfrm_tmpl_sort(stp, tpp, xfrm_nr, family);
1869 tpp = stp;
1870 }
1871
1872 /* For each tunnel xfrm, find the first matching tmpl.
1873 * For each tmpl before that, find corresponding xfrm.
1874 * Order is _important_. Later we will implement
1875 * some barriers, but at the moment barriers
1876 * are implied between each two transformations.
1877 */
1878 for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
1879 k = xfrm_policy_ok(tpp[i], sp, k, family);
1880 if (k < 0) {
1881 if (k < -1)
1882 /* "-2 - errored_index" returned */
1883 xerr_idx = -(2+k);
1884 goto reject;
1885 }
1886 }
1887
1888 if (secpath_has_nontransport(sp, k, &xerr_idx))
1889 goto reject;
1890
1891 xfrm_pols_put(pols, npols);
1892 return 1;
1893 }
1894
1895 reject:
1896 xfrm_secpath_reject(xerr_idx, skb, &fl);
1897 reject_error:
1898 xfrm_pols_put(pols, npols);
1899 return 0;
1900 }
1901 EXPORT_SYMBOL(__xfrm_policy_check);
1902
1903 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1904 {
1905 struct flowi fl;
1906
1907 if (xfrm_decode_session(skb, &fl, family) < 0)
1908 return 0;
1909
1910 return xfrm_lookup(&skb->dst, &fl, NULL, 0) == 0;
1911 }
1912 EXPORT_SYMBOL(__xfrm_route_forward);
1913
1914 /* Optimize later using cookies and generation ids. */
1915
1916 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
1917 {
1918 /* Code (such as __xfrm4_bundle_create()) sets dst->obsolete
1919 * to "-1" to force all XFRM destinations to get validated by
1920 * dst_ops->check on every use. We do this because when a
1921 * normal route referenced by an XFRM dst is obsoleted we do
1922 * not go looking around for all parent referencing XFRM dsts
1923 * so that we can invalidate them. It is just too much work.
1924 * Instead we make the checks here on every use. For example:
1925 *
1926 * XFRM dst A --> IPv4 dst X
1927 *
1928 * X is the "xdst->route" of A (X is also the "dst->path" of A
1929 * in this example). If X is marked obsolete, "A" will not
1930 * notice. That's what we are validating here via the
1931 * stale_bundle() check.
1932 *
1933 * When a policy's bundle is pruned, we dst_free() the XFRM
1934 * dst which causes it's ->obsolete field to be set to a
1935 * positive non-zero integer. If an XFRM dst has been pruned
1936 * like this, we want to force a new route lookup.
1937 */
1938 if (dst->obsolete < 0 && !stale_bundle(dst))
1939 return dst;
1940
1941 return NULL;
1942 }
1943
1944 static int stale_bundle(struct dst_entry *dst)
1945 {
1946 return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
1947 }
1948
1949 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
1950 {
1951 while ((dst = dst->child) && dst->xfrm && dst->dev == dev) {
1952 dst->dev = &loopback_dev;
1953 dev_hold(&loopback_dev);
1954 dev_put(dev);
1955 }
1956 }
1957 EXPORT_SYMBOL(xfrm_dst_ifdown);
1958
1959 static void xfrm_link_failure(struct sk_buff *skb)
1960 {
1961 /* Impossible. Such dst must be popped before reaches point of failure. */
1962 return;
1963 }
1964
1965 static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
1966 {
1967 if (dst) {
1968 if (dst->obsolete) {
1969 dst_release(dst);
1970 dst = NULL;
1971 }
1972 }
1973 return dst;
1974 }
1975
1976 static void prune_one_bundle(struct xfrm_policy *pol, int (*func)(struct dst_entry *), struct dst_entry **gc_list_p)
1977 {
1978 struct dst_entry *dst, **dstp;
1979
1980 write_lock(&pol->lock);
1981 dstp = &pol->bundles;
1982 while ((dst=*dstp) != NULL) {
1983 if (func(dst)) {
1984 *dstp = dst->next;
1985 dst->next = *gc_list_p;
1986 *gc_list_p = dst;
1987 } else {
1988 dstp = &dst->next;
1989 }
1990 }
1991 write_unlock(&pol->lock);
1992 }
1993
1994 static void xfrm_prune_bundles(int (*func)(struct dst_entry *))
1995 {
1996 struct dst_entry *gc_list = NULL;
1997 int dir;
1998
1999 read_lock_bh(&xfrm_policy_lock);
2000 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
2001 struct xfrm_policy *pol;
2002 struct hlist_node *entry;
2003 struct hlist_head *table;
2004 int i;
2005
2006 hlist_for_each_entry(pol, entry,
2007 &xfrm_policy_inexact[dir], bydst)
2008 prune_one_bundle(pol, func, &gc_list);
2009
2010 table = xfrm_policy_bydst[dir].table;
2011 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
2012 hlist_for_each_entry(pol, entry, table + i, bydst)
2013 prune_one_bundle(pol, func, &gc_list);
2014 }
2015 }
2016 read_unlock_bh(&xfrm_policy_lock);
2017
2018 while (gc_list) {
2019 struct dst_entry *dst = gc_list;
2020 gc_list = dst->next;
2021 dst_free(dst);
2022 }
2023 }
2024
2025 static int unused_bundle(struct dst_entry *dst)
2026 {
2027 return !atomic_read(&dst->__refcnt);
2028 }
2029
2030 static void __xfrm_garbage_collect(void)
2031 {
2032 xfrm_prune_bundles(unused_bundle);
2033 }
2034
2035 static int xfrm_flush_bundles(void)
2036 {
2037 xfrm_prune_bundles(stale_bundle);
2038 return 0;
2039 }
2040
2041 void xfrm_init_pmtu(struct dst_entry *dst)
2042 {
2043 do {
2044 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2045 u32 pmtu, route_mtu_cached;
2046
2047 pmtu = dst_mtu(dst->child);
2048 xdst->child_mtu_cached = pmtu;
2049
2050 pmtu = xfrm_state_mtu(dst->xfrm, pmtu);
2051
2052 route_mtu_cached = dst_mtu(xdst->route);
2053 xdst->route_mtu_cached = route_mtu_cached;
2054
2055 if (pmtu > route_mtu_cached)
2056 pmtu = route_mtu_cached;
2057
2058 dst->metrics[RTAX_MTU-1] = pmtu;
2059 } while ((dst = dst->next));
2060 }
2061
2062 EXPORT_SYMBOL(xfrm_init_pmtu);
2063
2064 /* Check that the bundle accepts the flow and its components are
2065 * still valid.
2066 */
2067
2068 int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
2069 struct flowi *fl, int family, int strict)
2070 {
2071 struct dst_entry *dst = &first->u.dst;
2072 struct xfrm_dst *last;
2073 u32 mtu;
2074
2075 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) ||
2076 (dst->dev && !netif_running(dst->dev)))
2077 return 0;
2078 #ifdef CONFIG_XFRM_SUB_POLICY
2079 if (fl) {
2080 if (first->origin && !flow_cache_uli_match(first->origin, fl))
2081 return 0;
2082 if (first->partner &&
2083 !xfrm_selector_match(first->partner, fl, family))
2084 return 0;
2085 }
2086 #endif
2087
2088 last = NULL;
2089
2090 do {
2091 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2092
2093 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
2094 return 0;
2095 if (fl && pol &&
2096 !security_xfrm_state_pol_flow_match(dst->xfrm, pol, fl))
2097 return 0;
2098 if (dst->xfrm->km.state != XFRM_STATE_VALID)
2099 return 0;
2100 if (xdst->genid != dst->xfrm->genid)
2101 return 0;
2102
2103 if (strict && fl && dst->xfrm->props.mode != XFRM_MODE_TUNNEL &&
2104 !xfrm_state_addr_flow_check(dst->xfrm, fl, family))
2105 return 0;
2106
2107 mtu = dst_mtu(dst->child);
2108 if (xdst->child_mtu_cached != mtu) {
2109 last = xdst;
2110 xdst->child_mtu_cached = mtu;
2111 }
2112
2113 if (!dst_check(xdst->route, xdst->route_cookie))
2114 return 0;
2115 mtu = dst_mtu(xdst->route);
2116 if (xdst->route_mtu_cached != mtu) {
2117 last = xdst;
2118 xdst->route_mtu_cached = mtu;
2119 }
2120
2121 dst = dst->child;
2122 } while (dst->xfrm);
2123
2124 if (likely(!last))
2125 return 1;
2126
2127 mtu = last->child_mtu_cached;
2128 for (;;) {
2129 dst = &last->u.dst;
2130
2131 mtu = xfrm_state_mtu(dst->xfrm, mtu);
2132 if (mtu > last->route_mtu_cached)
2133 mtu = last->route_mtu_cached;
2134 dst->metrics[RTAX_MTU-1] = mtu;
2135
2136 if (last == first)
2137 break;
2138
2139 last = (struct xfrm_dst *)last->u.dst.next;
2140 last->child_mtu_cached = mtu;
2141 }
2142
2143 return 1;
2144 }
2145
2146 EXPORT_SYMBOL(xfrm_bundle_ok);
2147
2148 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
2149 {
2150 int err = 0;
2151 if (unlikely(afinfo == NULL))
2152 return -EINVAL;
2153 if (unlikely(afinfo->family >= NPROTO))
2154 return -EAFNOSUPPORT;
2155 write_lock_bh(&xfrm_policy_afinfo_lock);
2156 if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
2157 err = -ENOBUFS;
2158 else {
2159 struct dst_ops *dst_ops = afinfo->dst_ops;
2160 if (likely(dst_ops->kmem_cachep == NULL))
2161 dst_ops->kmem_cachep = xfrm_dst_cache;
2162 if (likely(dst_ops->check == NULL))
2163 dst_ops->check = xfrm_dst_check;
2164 if (likely(dst_ops->negative_advice == NULL))
2165 dst_ops->negative_advice = xfrm_negative_advice;
2166 if (likely(dst_ops->link_failure == NULL))
2167 dst_ops->link_failure = xfrm_link_failure;
2168 if (likely(afinfo->garbage_collect == NULL))
2169 afinfo->garbage_collect = __xfrm_garbage_collect;
2170 xfrm_policy_afinfo[afinfo->family] = afinfo;
2171 }
2172 write_unlock_bh(&xfrm_policy_afinfo_lock);
2173 return err;
2174 }
2175 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
2176
2177 int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
2178 {
2179 int err = 0;
2180 if (unlikely(afinfo == NULL))
2181 return -EINVAL;
2182 if (unlikely(afinfo->family >= NPROTO))
2183 return -EAFNOSUPPORT;
2184 write_lock_bh(&xfrm_policy_afinfo_lock);
2185 if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
2186 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
2187 err = -EINVAL;
2188 else {
2189 struct dst_ops *dst_ops = afinfo->dst_ops;
2190 xfrm_policy_afinfo[afinfo->family] = NULL;
2191 dst_ops->kmem_cachep = NULL;
2192 dst_ops->check = NULL;
2193 dst_ops->negative_advice = NULL;
2194 dst_ops->link_failure = NULL;
2195 afinfo->garbage_collect = NULL;
2196 }
2197 }
2198 write_unlock_bh(&xfrm_policy_afinfo_lock);
2199 return err;
2200 }
2201 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
2202
2203 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
2204 {
2205 struct xfrm_policy_afinfo *afinfo;
2206 if (unlikely(family >= NPROTO))
2207 return NULL;
2208 read_lock(&xfrm_policy_afinfo_lock);
2209 afinfo = xfrm_policy_afinfo[family];
2210 if (unlikely(!afinfo))
2211 read_unlock(&xfrm_policy_afinfo_lock);
2212 return afinfo;
2213 }
2214
2215 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo)
2216 {
2217 read_unlock(&xfrm_policy_afinfo_lock);
2218 }
2219
2220 static struct xfrm_policy_afinfo *xfrm_policy_lock_afinfo(unsigned int family)
2221 {
2222 struct xfrm_policy_afinfo *afinfo;
2223 if (unlikely(family >= NPROTO))
2224 return NULL;
2225 write_lock_bh(&xfrm_policy_afinfo_lock);
2226 afinfo = xfrm_policy_afinfo[family];
2227 if (unlikely(!afinfo))
2228 write_unlock_bh(&xfrm_policy_afinfo_lock);
2229 return afinfo;
2230 }
2231
2232 static void xfrm_policy_unlock_afinfo(struct xfrm_policy_afinfo *afinfo)
2233 {
2234 write_unlock_bh(&xfrm_policy_afinfo_lock);
2235 }
2236
2237 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
2238 {
2239 struct net_device *dev = ptr;
2240
2241 if (dev->nd_net != &init_net)
2242 return NOTIFY_DONE;
2243
2244 switch (event) {
2245 case NETDEV_DOWN:
2246 xfrm_flush_bundles();
2247 }
2248 return NOTIFY_DONE;
2249 }
2250
2251 static struct notifier_block xfrm_dev_notifier = {
2252 xfrm_dev_event,
2253 NULL,
2254 0
2255 };
2256
2257 static void __init xfrm_policy_init(void)
2258 {
2259 unsigned int hmask, sz;
2260 int dir;
2261
2262 xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache",
2263 sizeof(struct xfrm_dst),
2264 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
2265 NULL);
2266
2267 hmask = 8 - 1;
2268 sz = (hmask+1) * sizeof(struct hlist_head);
2269
2270 xfrm_policy_byidx = xfrm_hash_alloc(sz);
2271 xfrm_idx_hmask = hmask;
2272 if (!xfrm_policy_byidx)
2273 panic("XFRM: failed to allocate byidx hash\n");
2274
2275 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
2276 struct xfrm_policy_hash *htab;
2277
2278 INIT_HLIST_HEAD(&xfrm_policy_inexact[dir]);
2279
2280 htab = &xfrm_policy_bydst[dir];
2281 htab->table = xfrm_hash_alloc(sz);
2282 htab->hmask = hmask;
2283 if (!htab->table)
2284 panic("XFRM: failed to allocate bydst hash\n");
2285 }
2286
2287 INIT_WORK(&xfrm_policy_gc_work, xfrm_policy_gc_task);
2288 register_netdevice_notifier(&xfrm_dev_notifier);
2289 }
2290
2291 void __init xfrm_init(void)
2292 {
2293 xfrm_state_init();
2294 xfrm_policy_init();
2295 xfrm_input_init();
2296 }
2297
2298 #ifdef CONFIG_AUDITSYSCALL
2299 static inline void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
2300 struct audit_buffer *audit_buf)
2301 {
2302 if (xp->security)
2303 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
2304 xp->security->ctx_alg, xp->security->ctx_doi,
2305 xp->security->ctx_str);
2306
2307 switch(xp->selector.family) {
2308 case AF_INET:
2309 audit_log_format(audit_buf, " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
2310 NIPQUAD(xp->selector.saddr.a4),
2311 NIPQUAD(xp->selector.daddr.a4));
2312 break;
2313 case AF_INET6:
2314 {
2315 struct in6_addr saddr6, daddr6;
2316
2317 memcpy(&saddr6, xp->selector.saddr.a6,
2318 sizeof(struct in6_addr));
2319 memcpy(&daddr6, xp->selector.daddr.a6,
2320 sizeof(struct in6_addr));
2321 audit_log_format(audit_buf,
2322 " src=" NIP6_FMT " dst=" NIP6_FMT,
2323 NIP6(saddr6), NIP6(daddr6));
2324 }
2325 break;
2326 }
2327 }
2328
2329 void
2330 xfrm_audit_policy_add(struct xfrm_policy *xp, int result, u32 auid, u32 sid)
2331 {
2332 struct audit_buffer *audit_buf;
2333 extern int audit_enabled;
2334
2335 if (audit_enabled == 0)
2336 return;
2337 audit_buf = xfrm_audit_start(sid, auid);
2338 if (audit_buf == NULL)
2339 return;
2340 audit_log_format(audit_buf, " op=SPD-add res=%u", result);
2341 xfrm_audit_common_policyinfo(xp, audit_buf);
2342 audit_log_end(audit_buf);
2343 }
2344 EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);
2345
2346 void
2347 xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, u32 auid, u32 sid)
2348 {
2349 struct audit_buffer *audit_buf;
2350 extern int audit_enabled;
2351
2352 if (audit_enabled == 0)
2353 return;
2354 audit_buf = xfrm_audit_start(sid, auid);
2355 if (audit_buf == NULL)
2356 return;
2357 audit_log_format(audit_buf, " op=SPD-delete res=%u", result);
2358 xfrm_audit_common_policyinfo(xp, audit_buf);
2359 audit_log_end(audit_buf);
2360 }
2361 EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete);
2362 #endif
2363
2364 #ifdef CONFIG_XFRM_MIGRATE
2365 static int xfrm_migrate_selector_match(struct xfrm_selector *sel_cmp,
2366 struct xfrm_selector *sel_tgt)
2367 {
2368 if (sel_cmp->proto == IPSEC_ULPROTO_ANY) {
2369 if (sel_tgt->family == sel_cmp->family &&
2370 xfrm_addr_cmp(&sel_tgt->daddr, &sel_cmp->daddr,
2371 sel_cmp->family) == 0 &&
2372 xfrm_addr_cmp(&sel_tgt->saddr, &sel_cmp->saddr,
2373 sel_cmp->family) == 0 &&
2374 sel_tgt->prefixlen_d == sel_cmp->prefixlen_d &&
2375 sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) {
2376 return 1;
2377 }
2378 } else {
2379 if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) {
2380 return 1;
2381 }
2382 }
2383 return 0;
2384 }
2385
2386 static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel,
2387 u8 dir, u8 type)
2388 {
2389 struct xfrm_policy *pol, *ret = NULL;
2390 struct hlist_node *entry;
2391 struct hlist_head *chain;
2392 u32 priority = ~0U;
2393
2394 read_lock_bh(&xfrm_policy_lock);
2395 chain = policy_hash_direct(&sel->daddr, &sel->saddr, sel->family, dir);
2396 hlist_for_each_entry(pol, entry, chain, bydst) {
2397 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
2398 pol->type == type) {
2399 ret = pol;
2400 priority = ret->priority;
2401 break;
2402 }
2403 }
2404 chain = &xfrm_policy_inexact[dir];
2405 hlist_for_each_entry(pol, entry, chain, bydst) {
2406 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
2407 pol->type == type &&
2408 pol->priority < priority) {
2409 ret = pol;
2410 break;
2411 }
2412 }
2413
2414 if (ret)
2415 xfrm_pol_hold(ret);
2416
2417 read_unlock_bh(&xfrm_policy_lock);
2418
2419 return ret;
2420 }
2421
2422 static int migrate_tmpl_match(struct xfrm_migrate *m, struct xfrm_tmpl *t)
2423 {
2424 int match = 0;
2425
2426 if (t->mode == m->mode && t->id.proto == m->proto &&
2427 (m->reqid == 0 || t->reqid == m->reqid)) {
2428 switch (t->mode) {
2429 case XFRM_MODE_TUNNEL:
2430 case XFRM_MODE_BEET:
2431 if (xfrm_addr_cmp(&t->id.daddr, &m->old_daddr,
2432 m->old_family) == 0 &&
2433 xfrm_addr_cmp(&t->saddr, &m->old_saddr,
2434 m->old_family) == 0) {
2435 match = 1;
2436 }
2437 break;
2438 case XFRM_MODE_TRANSPORT:
2439 /* in case of transport mode, template does not store
2440 any IP addresses, hence we just compare mode and
2441 protocol */
2442 match = 1;
2443 break;
2444 default:
2445 break;
2446 }
2447 }
2448 return match;
2449 }
2450
2451 /* update endpoint address(es) of template(s) */
2452 static int xfrm_policy_migrate(struct xfrm_policy *pol,
2453 struct xfrm_migrate *m, int num_migrate)
2454 {
2455 struct xfrm_migrate *mp;
2456 struct dst_entry *dst;
2457 int i, j, n = 0;
2458
2459 write_lock_bh(&pol->lock);
2460 if (unlikely(pol->dead)) {
2461 /* target policy has been deleted */
2462 write_unlock_bh(&pol->lock);
2463 return -ENOENT;
2464 }
2465
2466 for (i = 0; i < pol->xfrm_nr; i++) {
2467 for (j = 0, mp = m; j < num_migrate; j++, mp++) {
2468 if (!migrate_tmpl_match(mp, &pol->xfrm_vec[i]))
2469 continue;
2470 n++;
2471 if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL)
2472 continue;
2473 /* update endpoints */
2474 memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr,
2475 sizeof(pol->xfrm_vec[i].id.daddr));
2476 memcpy(&pol->xfrm_vec[i].saddr, &mp->new_saddr,
2477 sizeof(pol->xfrm_vec[i].saddr));
2478 pol->xfrm_vec[i].encap_family = mp->new_family;
2479 /* flush bundles */
2480 while ((dst = pol->bundles) != NULL) {
2481 pol->bundles = dst->next;
2482 dst_free(dst);
2483 }
2484 }
2485 }
2486
2487 write_unlock_bh(&pol->lock);
2488
2489 if (!n)
2490 return -ENODATA;
2491
2492 return 0;
2493 }
2494
2495 static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate)
2496 {
2497 int i, j;
2498
2499 if (num_migrate < 1 || num_migrate > XFRM_MAX_DEPTH)
2500 return -EINVAL;
2501
2502 for (i = 0; i < num_migrate; i++) {
2503 if ((xfrm_addr_cmp(&m[i].old_daddr, &m[i].new_daddr,
2504 m[i].old_family) == 0) &&
2505 (xfrm_addr_cmp(&m[i].old_saddr, &m[i].new_saddr,
2506 m[i].old_family) == 0))
2507 return -EINVAL;
2508 if (xfrm_addr_any(&m[i].new_daddr, m[i].new_family) ||
2509 xfrm_addr_any(&m[i].new_saddr, m[i].new_family))
2510 return -EINVAL;
2511
2512 /* check if there is any duplicated entry */
2513 for (j = i + 1; j < num_migrate; j++) {
2514 if (!memcmp(&m[i].old_daddr, &m[j].old_daddr,
2515 sizeof(m[i].old_daddr)) &&
2516 !memcmp(&m[i].old_saddr, &m[j].old_saddr,
2517 sizeof(m[i].old_saddr)) &&
2518 m[i].proto == m[j].proto &&
2519 m[i].mode == m[j].mode &&
2520 m[i].reqid == m[j].reqid &&
2521 m[i].old_family == m[j].old_family)
2522 return -EINVAL;
2523 }
2524 }
2525
2526 return 0;
2527 }
2528
2529 int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2530 struct xfrm_migrate *m, int num_migrate)
2531 {
2532 int i, err, nx_cur = 0, nx_new = 0;
2533 struct xfrm_policy *pol = NULL;
2534 struct xfrm_state *x, *xc;
2535 struct xfrm_state *x_cur[XFRM_MAX_DEPTH];
2536 struct xfrm_state *x_new[XFRM_MAX_DEPTH];
2537 struct xfrm_migrate *mp;
2538
2539 if ((err = xfrm_migrate_check(m, num_migrate)) < 0)
2540 goto out;
2541
2542 /* Stage 1 - find policy */
2543 if ((pol = xfrm_migrate_policy_find(sel, dir, type)) == NULL) {
2544 err = -ENOENT;
2545 goto out;
2546 }
2547
2548 /* Stage 2 - find and update state(s) */
2549 for (i = 0, mp = m; i < num_migrate; i++, mp++) {
2550 if ((x = xfrm_migrate_state_find(mp))) {
2551 x_cur[nx_cur] = x;
2552 nx_cur++;
2553 if ((xc = xfrm_state_migrate(x, mp))) {
2554 x_new[nx_new] = xc;
2555 nx_new++;
2556 } else {
2557 err = -ENODATA;
2558 goto restore_state;
2559 }
2560 }
2561 }
2562
2563 /* Stage 3 - update policy */
2564 if ((err = xfrm_policy_migrate(pol, m, num_migrate)) < 0)
2565 goto restore_state;
2566
2567 /* Stage 4 - delete old state(s) */
2568 if (nx_cur) {
2569 xfrm_states_put(x_cur, nx_cur);
2570 xfrm_states_delete(x_cur, nx_cur);
2571 }
2572
2573 /* Stage 5 - announce */
2574 km_migrate(sel, dir, type, m, num_migrate);
2575
2576 xfrm_pol_put(pol);
2577
2578 return 0;
2579 out:
2580 return err;
2581
2582 restore_state:
2583 if (pol)
2584 xfrm_pol_put(pol);
2585 if (nx_cur)
2586 xfrm_states_put(x_cur, nx_cur);
2587 if (nx_new)
2588 xfrm_states_delete(x_new, nx_new);
2589
2590 return err;
2591 }
2592 EXPORT_SYMBOL(xfrm_migrate);
2593 #endif
Support for the Chinese Samsung S3C2440 based development boards