net/xfrm/xfrm_state.c

   1 /*
   2  * xfrm_state.c
   3  *
   4  * Changes:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki @USAGI
  10  *              Split up af-specific functions
  11  *      Derek Atkins <derek@ihtfp.com>
  12  *              Add UDP Encapsulation
  13  *
  14  */
  15
  16 #include <linux/workqueue.h>
  17 #include <net/xfrm.h>
  18 #include <linux/pfkeyv2.h>
  19 #include <linux/ipsec.h>
  20 #include <linux/module.h>
  21 #include <linux/cache.h>
  22 #include <asm/uaccess.h>
  23
  24 #include "xfrm_hash.h"
  25
  26 struct sock *xfrm_nl;
  27 EXPORT_SYMBOL(xfrm_nl);
  28
  29 u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
  30 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
  31
  32 u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
  33 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
  34
  35 u32 sysctl_xfrm_acq_expires __read_mostly = 30;
  36
  37 /* Each xfrm_state may be linked to two tables:
  38
  39    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
  40    2. Hash table by (daddr,family,reqid) to find what SAs exist for given
  41       destination/tunnel endpoint. (output)
  42  */
  43
  44 static DEFINE_SPINLOCK(xfrm_state_lock);
  45
  46 /* Hash table to find appropriate SA towards given target (endpoint
  47  * of tunnel or destination of transport mode) allowed by selector.
  48  *
  49  * Main use is finding SA after policy selected tunnel or transport mode.
  50  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  51  */
  52 static struct hlist_head *xfrm_state_bydst __read_mostly;
  53 static struct hlist_head *xfrm_state_bysrc __read_mostly;
  54 static struct hlist_head *xfrm_state_byspi __read_mostly;
  55 static unsigned int xfrm_state_hmask __read_mostly;
  56 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
  57 static unsigned int xfrm_state_num;
  58 static unsigned int xfrm_state_genid;
  59
  60 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
  61 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
  62
  63 static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
  64                                          xfrm_address_t *saddr,
  65                                          u32 reqid,
  66                                          unsigned short family)
  67 {
  68         return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
  69 }
  70
  71 static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
  72                                          xfrm_address_t *saddr,
  73                                          unsigned short family)
  74 {
  75         return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
  76 }
  77
  78 static inline unsigned int
  79 xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
  80 {
  81         return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
  82 }
  83
  84 static void xfrm_hash_transfer(struct hlist_head *list,
  85                                struct hlist_head *ndsttable,
  86                                struct hlist_head *nsrctable,
  87                                struct hlist_head *nspitable,
  88                                unsigned int nhashmask)
  89 {
  90         struct hlist_node *entry, *tmp;
  91         struct xfrm_state *x;
  92
  93         hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
  94                 unsigned int h;
  95
  96                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
  97                                     x->props.reqid, x->props.family,
  98                                     nhashmask);
  99                 hlist_add_head(&x->bydst, ndsttable+h);
 100
 101                 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
 102                                     x->props.family,
 103                                     nhashmask);
 104                 hlist_add_head(&x->bysrc, nsrctable+h);
 105
 106                 if (x->id.spi) {
 107                         h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
 108                                             x->id.proto, x->props.family,
 109                                             nhashmask);
 110                         hlist_add_head(&x->byspi, nspitable+h);
 111                 }
 112         }
 113 }
 114
 115 static unsigned long xfrm_hash_new_size(void)
 116 {
 117         return ((xfrm_state_hmask + 1) << 1) *
 118                 sizeof(struct hlist_head);
 119 }
 120
 121 static DEFINE_MUTEX(hash_resize_mutex);
 122
 123 static void xfrm_hash_resize(struct work_struct *__unused)
 124 {
 125         struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
 126         unsigned long nsize, osize;
 127         unsigned int nhashmask, ohashmask;
 128         int i;
 129
 130         mutex_lock(&hash_resize_mutex);
 131
 132         nsize = xfrm_hash_new_size();
 133         ndst = xfrm_hash_alloc(nsize);
 134         if (!ndst)
 135                 goto out_unlock;
 136         nsrc = xfrm_hash_alloc(nsize);
 137         if (!nsrc) {
 138                 xfrm_hash_free(ndst, nsize);
 139                 goto out_unlock;
 140         }
 141         nspi = xfrm_hash_alloc(nsize);
 142         if (!nspi) {
 143                 xfrm_hash_free(ndst, nsize);
 144                 xfrm_hash_free(nsrc, nsize);
 145                 goto out_unlock;
 146         }
 147
 148         spin_lock_bh(&xfrm_state_lock);
 149
 150         nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
 151         for (i = xfrm_state_hmask; i >= 0; i--)
 152                 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
 153                                    nhashmask);
 154
 155         odst = xfrm_state_bydst;
 156         osrc = xfrm_state_bysrc;
 157         ospi = xfrm_state_byspi;
 158         ohashmask = xfrm_state_hmask;
 159
 160         xfrm_state_bydst = ndst;
 161         xfrm_state_bysrc = nsrc;
 162         xfrm_state_byspi = nspi;
 163         xfrm_state_hmask = nhashmask;
 164
 165         spin_unlock_bh(&xfrm_state_lock);
 166
 167         osize = (ohashmask + 1) * sizeof(struct hlist_head);
 168         xfrm_hash_free(odst, osize);
 169         xfrm_hash_free(osrc, osize);
 170         xfrm_hash_free(ospi, osize);
 171
 172 out_unlock:
 173         mutex_unlock(&hash_resize_mutex);
 174 }
 175
 176 static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
 177
 178 DECLARE_WAIT_QUEUE_HEAD(km_waitq);
 179 EXPORT_SYMBOL(km_waitq);
 180
 181 static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 182 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 183
 184 static struct work_struct xfrm_state_gc_work;
 185 static HLIST_HEAD(xfrm_state_gc_list);
 186 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 187
 188 int __xfrm_state_delete(struct xfrm_state *x);
 189
 190 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 191 void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 192
 193 static struct xfrm_state_afinfo *xfrm_state_lock_afinfo(unsigned int family)
 194 {
 195         struct xfrm_state_afinfo *afinfo;
 196         if (unlikely(family >= NPROTO))
 197                 return NULL;
 198         write_lock_bh(&xfrm_state_afinfo_lock);
 199         afinfo = xfrm_state_afinfo[family];
 200         if (unlikely(!afinfo))
 201                 write_unlock_bh(&xfrm_state_afinfo_lock);
 202         return afinfo;
 203 }
 204
 205 static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
 206 {
 207         write_unlock_bh(&xfrm_state_afinfo_lock);
 208 }
 209
 210 int xfrm_register_type(struct xfrm_type *type, unsigned short family)
 211 {
 212         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 213         struct xfrm_type **typemap;
 214         int err = 0;
 215
 216         if (unlikely(afinfo == NULL))
 217                 return -EAFNOSUPPORT;
 218         typemap = afinfo->type_map;
 219
 220         if (likely(typemap[type->proto] == NULL))
 221                 typemap[type->proto] = type;
 222         else
 223                 err = -EEXIST;
 224         xfrm_state_unlock_afinfo(afinfo);
 225         return err;
 226 }
 227 EXPORT_SYMBOL(xfrm_register_type);
 228
 229 int xfrm_unregister_type(struct xfrm_type *type, unsigned short family)
 230 {
 231         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
 232         struct xfrm_type **typemap;
 233         int err = 0;
 234
 235         if (unlikely(afinfo == NULL))
 236                 return -EAFNOSUPPORT;
 237         typemap = afinfo->type_map;
 238
 239         if (unlikely(typemap[type->proto] != type))
 240                 err = -ENOENT;
 241         else
 242                 typemap[type->proto] = NULL;
 243         xfrm_state_unlock_afinfo(afinfo);
 244         return err;
 245 }
 246 EXPORT_SYMBOL(xfrm_unregister_type);
 247
 248 static struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
 249 {
 250         struct xfrm_state_afinfo *afinfo;
 251         struct xfrm_type **typemap;
 252         struct xfrm_type *type;
 253         int modload_attempted = 0;
 254
 255 retry:
 256         afinfo = xfrm_state_get_afinfo(family);
 257         if (unlikely(afinfo == NULL))
 258                 return NULL;
 259         typemap = afinfo->type_map;
 260
 261         type = typemap[proto];
 262         if (unlikely(type && !try_module_get(type->owner)))
 263                 type = NULL;
 264         if (!type && !modload_attempted) {
 265                 xfrm_state_put_afinfo(afinfo);
 266                 request_module("xfrm-type-%d-%d", family, proto);
 267                 modload_attempted = 1;
 268                 goto retry;
 269         }
 270
 271         xfrm_state_put_afinfo(afinfo);
 272         return type;
 273 }
 274
 275 static void xfrm_put_type(struct xfrm_type *type)
 276 {
 277         module_put(type->owner);
 278 }
 279
 280 int xfrm_register_mode(struct xfrm_mode *mode, int family)
 281 {
 282         struct xfrm_state_afinfo *afinfo;
 283         struct xfrm_mode **modemap;
 284         int err;
 285
 286         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 287                 return -EINVAL;
 288
 289         afinfo = xfrm_state_lock_afinfo(family);
 290         if (unlikely(afinfo == NULL))
 291                 return -EAFNOSUPPORT;
 292
 293         err = -EEXIST;
 294         modemap = afinfo->mode_map;
 295         if (modemap[mode->encap])
 296                 goto out;
 297
 298         err = -ENOENT;
 299         if (!try_module_get(afinfo->owner))
 300                 goto out;
 301
 302         mode->afinfo = afinfo;
 303         modemap[mode->encap] = mode;
 304         err = 0;
 305
 306 out:
 307         xfrm_state_unlock_afinfo(afinfo);
 308         return err;
 309 }
 310 EXPORT_SYMBOL(xfrm_register_mode);
 311
 312 int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
 313 {
 314         struct xfrm_state_afinfo *afinfo;
 315         struct xfrm_mode **modemap;
 316         int err;
 317
 318         if (unlikely(mode->encap >= XFRM_MODE_MAX))
 319                 return -EINVAL;
 320
 321         afinfo = xfrm_state_lock_afinfo(family);
 322         if (unlikely(afinfo == NULL))
 323                 return -EAFNOSUPPORT;
 324
 325         err = -ENOENT;
 326         modemap = afinfo->mode_map;
 327         if (likely(modemap[mode->encap] == mode)) {
 328                 modemap[mode->encap] = NULL;
 329                 module_put(mode->afinfo->owner);
 330                 err = 0;
 331         }
 332
 333         xfrm_state_unlock_afinfo(afinfo);
 334         return err;
 335 }
 336 EXPORT_SYMBOL(xfrm_unregister_mode);
 337
 338 static struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
 339 {
 340         struct xfrm_state_afinfo *afinfo;
 341         struct xfrm_mode *mode;
 342         int modload_attempted = 0;
 343
 344         if (unlikely(encap >= XFRM_MODE_MAX))
 345                 return NULL;
 346
 347 retry:
 348         afinfo = xfrm_state_get_afinfo(family);
 349         if (unlikely(afinfo == NULL))
 350                 return NULL;
 351
 352         mode = afinfo->mode_map[encap];
 353         if (unlikely(mode && !try_module_get(mode->owner)))
 354                 mode = NULL;
 355         if (!mode && !modload_attempted) {
 356                 xfrm_state_put_afinfo(afinfo);
 357                 request_module("xfrm-mode-%d-%d", family, encap);
 358                 modload_attempted = 1;
 359                 goto retry;
 360         }
 361
 362         xfrm_state_put_afinfo(afinfo);
 363         return mode;
 364 }
 365
 366 static void xfrm_put_mode(struct xfrm_mode *mode)
 367 {
 368         module_put(mode->owner);
 369 }
 370
 371 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 372 {
 373         del_timer_sync(&x->timer);
 374         del_timer_sync(&x->rtimer);
 375         kfree(x->aalg);
 376         kfree(x->ealg);
 377         kfree(x->calg);
 378         kfree(x->encap);
 379         kfree(x->coaddr);
 380         if (x->mode)
 381                 xfrm_put_mode(x->mode);
 382         if (x->type) {
 383                 x->type->destructor(x);
 384                 xfrm_put_type(x->type);
 385         }
 386         security_xfrm_state_free(x);
 387         kfree(x);
 388 }
 389
 390 static void xfrm_state_gc_task(struct work_struct *data)
 391 {
 392         struct xfrm_state *x;
 393         struct hlist_node *entry, *tmp;
 394         struct hlist_head gc_list;
 395
 396         spin_lock_bh(&xfrm_state_gc_lock);
 397         gc_list.first = xfrm_state_gc_list.first;
 398         INIT_HLIST_HEAD(&xfrm_state_gc_list);
 399         spin_unlock_bh(&xfrm_state_gc_lock);
 400
 401         hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
 402                 xfrm_state_gc_destroy(x);
 403
 404         wake_up(&km_waitq);
 405 }
 406
 407 static inline unsigned long make_jiffies(long secs)
 408 {
 409         if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
 410                 return MAX_SCHEDULE_TIMEOUT-1;
 411         else
 412                 return secs*HZ;
 413 }
 414
 415 static void xfrm_timer_handler(unsigned long data)
 416 {
 417         struct xfrm_state *x = (struct xfrm_state*)data;
 418         unsigned long now = get_seconds();
 419         long next = LONG_MAX;
 420         int warn = 0;
 421         int err = 0;
 422
 423         spin_lock(&x->lock);
 424         if (x->km.state == XFRM_STATE_DEAD)
 425                 goto out;
 426         if (x->km.state == XFRM_STATE_EXPIRED)
 427                 goto expired;
 428         if (x->lft.hard_add_expires_seconds) {
 429                 long tmo = x->lft.hard_add_expires_seconds +
 430                         x->curlft.add_time - now;
 431                 if (tmo <= 0)
 432                         goto expired;
 433                 if (tmo < next)
 434                         next = tmo;
 435         }
 436         if (x->lft.hard_use_expires_seconds) {
 437                 long tmo = x->lft.hard_use_expires_seconds +
 438                         (x->curlft.use_time ? : now) - now;
 439                 if (tmo <= 0)
 440                         goto expired;
 441                 if (tmo < next)
 442                         next = tmo;
 443         }
 444         if (x->km.dying)
 445                 goto resched;
 446         if (x->lft.soft_add_expires_seconds) {
 447                 long tmo = x->lft.soft_add_expires_seconds +
 448                         x->curlft.add_time - now;
 449                 if (tmo <= 0)
 450                         warn = 1;
 451                 else if (tmo < next)
 452                         next = tmo;
 453         }
 454         if (x->lft.soft_use_expires_seconds) {
 455                 long tmo = x->lft.soft_use_expires_seconds +
 456                         (x->curlft.use_time ? : now) - now;
 457                 if (tmo <= 0)
 458                         warn = 1;
 459                 else if (tmo < next)
 460                         next = tmo;
 461         }
 462
 463         x->km.dying = warn;
 464         if (warn)
 465                 km_state_expired(x, 0, 0);
 466 resched:
 467         if (next != LONG_MAX)
 468                 mod_timer(&x->timer, jiffies + make_jiffies(next));
 469
 470         goto out;
 471
 472 expired:
 473         if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
 474                 x->km.state = XFRM_STATE_EXPIRED;
 475                 wake_up(&km_waitq);
 476                 next = 2;
 477                 goto resched;
 478         }
 479
 480         err = __xfrm_state_delete(x);
 481         if (!err && x->id.spi)
 482                 km_state_expired(x, 1, 0);
 483
 484         xfrm_audit_state_delete(x, err ? 0 : 1,
 485                                 audit_get_loginuid(current->audit_context), 0);
 486
 487 out:
 488         spin_unlock(&x->lock);
 489 }
 490
 491 static void xfrm_replay_timer_handler(unsigned long data);
 492
 493 struct xfrm_state *xfrm_state_alloc(void)
 494 {
 495         struct xfrm_state *x;
 496
 497         x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
 498
 499         if (x) {
 500                 atomic_set(&x->refcnt, 1);
 501                 atomic_set(&x->tunnel_users, 0);
 502                 INIT_HLIST_NODE(&x->bydst);
 503                 INIT_HLIST_NODE(&x->bysrc);
 504                 INIT_HLIST_NODE(&x->byspi);
 505                 init_timer(&x->timer);
 506                 x->timer.function = xfrm_timer_handler;
 507                 x->timer.data     = (unsigned long)x;
 508                 init_timer(&x->rtimer);
 509                 x->rtimer.function = xfrm_replay_timer_handler;
 510                 x->rtimer.data     = (unsigned long)x;
 511                 x->curlft.add_time = get_seconds();
 512                 x->lft.soft_byte_limit = XFRM_INF;
 513                 x->lft.soft_packet_limit = XFRM_INF;
 514                 x->lft.hard_byte_limit = XFRM_INF;
 515                 x->lft.hard_packet_limit = XFRM_INF;
 516                 x->replay_maxage = 0;
 517                 x->replay_maxdiff = 0;
 518                 spin_lock_init(&x->lock);
 519         }
 520         return x;
 521 }
 522 EXPORT_SYMBOL(xfrm_state_alloc);
 523
 524 void __xfrm_state_destroy(struct xfrm_state *x)
 525 {
 526         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 527
 528         spin_lock_bh(&xfrm_state_gc_lock);
 529         hlist_add_head(&x->bydst, &xfrm_state_gc_list);
 530         spin_unlock_bh(&xfrm_state_gc_lock);
 531         schedule_work(&xfrm_state_gc_work);
 532 }
 533 EXPORT_SYMBOL(__xfrm_state_destroy);
 534
 535 int __xfrm_state_delete(struct xfrm_state *x)
 536 {
 537         int err = -ESRCH;
 538
 539         if (x->km.state != XFRM_STATE_DEAD) {
 540                 x->km.state = XFRM_STATE_DEAD;
 541                 spin_lock(&xfrm_state_lock);
 542                 hlist_del(&x->bydst);
 543                 hlist_del(&x->bysrc);
 544                 if (x->id.spi)
 545                         hlist_del(&x->byspi);
 546                 xfrm_state_num--;
 547                 spin_unlock(&xfrm_state_lock);
 548
 549                 /* All xfrm_state objects are created by xfrm_state_alloc.
 550                  * The xfrm_state_alloc call gives a reference, and that
 551                  * is what we are dropping here.
 552                  */
 553                 __xfrm_state_put(x);
 554                 err = 0;
 555         }
 556
 557         return err;
 558 }
 559 EXPORT_SYMBOL(__xfrm_state_delete);
 560
 561 int xfrm_state_delete(struct xfrm_state *x)
 562 {
 563         int err;
 564
 565         spin_lock_bh(&x->lock);
 566         err = __xfrm_state_delete(x);
 567         spin_unlock_bh(&x->lock);
 568
 569         return err;
 570 }
 571 EXPORT_SYMBOL(xfrm_state_delete);
 572
 573 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 574 static inline int
 575 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 576 {
 577         int i, err = 0;
 578
 579         for (i = 0; i <= xfrm_state_hmask; i++) {
 580                 struct hlist_node *entry;
 581                 struct xfrm_state *x;
 582
 583                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 584                         if (xfrm_id_proto_match(x->id.proto, proto) &&
 585                            (err = security_xfrm_state_delete(x)) != 0) {
 586                                 xfrm_audit_state_delete(x, 0,
 587                                                         audit_info->loginuid,
 588                                                         audit_info->secid);
 589                                 return err;
 590                         }
 591                 }
 592         }
 593
 594         return err;
 595 }
 596 #else
 597 static inline int
 598 xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 599 {
 600         return 0;
 601 }
 602 #endif
 603
 604 int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
 605 {
 606         int i, err = 0;
 607
 608         spin_lock_bh(&xfrm_state_lock);
 609         err = xfrm_state_flush_secctx_check(proto, audit_info);
 610         if (err)
 611                 goto out;
 612
 613         for (i = 0; i <= xfrm_state_hmask; i++) {
 614                 struct hlist_node *entry;
 615                 struct xfrm_state *x;
 616 restart:
 617                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
 618                         if (!xfrm_state_kern(x) &&
 619                             xfrm_id_proto_match(x->id.proto, proto)) {
 620                                 xfrm_state_hold(x);
 621                                 spin_unlock_bh(&xfrm_state_lock);
 622
 623                                 err = xfrm_state_delete(x);
 624                                 xfrm_audit_state_delete(x, err ? 0 : 1,
 625                                                         audit_info->loginuid,
 626                                                         audit_info->secid);
 627                                 xfrm_state_put(x);
 628
 629                                 spin_lock_bh(&xfrm_state_lock);
 630                                 goto restart;
 631                         }
 632                 }
 633         }
 634         err = 0;
 635
 636 out:
 637         spin_unlock_bh(&xfrm_state_lock);
 638         wake_up(&km_waitq);
 639         return err;
 640 }
 641 EXPORT_SYMBOL(xfrm_state_flush);
 642
 643 void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
 644 {
 645         spin_lock_bh(&xfrm_state_lock);
 646         si->sadcnt = xfrm_state_num;
 647         si->sadhcnt = xfrm_state_hmask;
 648         si->sadhmcnt = xfrm_state_hashmax;
 649         spin_unlock_bh(&xfrm_state_lock);
 650 }
 651 EXPORT_SYMBOL(xfrm_sad_getinfo);
 652
 653 static int
 654 xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
 655                   struct xfrm_tmpl *tmpl,
 656                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 657                   unsigned short family)
 658 {
 659         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
 660         if (!afinfo)
 661                 return -1;
 662         afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
 663         xfrm_state_put_afinfo(afinfo);
 664         return 0;
 665 }
 666
 667 static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 668 {
 669         unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
 670         struct xfrm_state *x;
 671         struct hlist_node *entry;
 672
 673         hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
 674                 if (x->props.family != family ||
 675                     x->id.spi       != spi ||
 676                     x->id.proto     != proto)
 677                         continue;
 678
 679                 switch (family) {
 680                 case AF_INET:
 681                         if (x->id.daddr.a4 != daddr->a4)
 682                                 continue;
 683                         break;
 684                 case AF_INET6:
 685                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 686                                              (struct in6_addr *)
 687                                              x->id.daddr.a6))
 688                                 continue;
 689                         break;
 690                 }
 691
 692                 xfrm_state_hold(x);
 693                 return x;
 694         }
 695
 696         return NULL;
 697 }
 698
 699 static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 700 {
 701         unsigned int h = xfrm_src_hash(daddr, saddr, family);
 702         struct xfrm_state *x;
 703         struct hlist_node *entry;
 704
 705         hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
 706                 if (x->props.family != family ||
 707                     x->id.proto     != proto)
 708                         continue;
 709
 710                 switch (family) {
 711                 case AF_INET:
 712                         if (x->id.daddr.a4 != daddr->a4 ||
 713                             x->props.saddr.a4 != saddr->a4)
 714                                 continue;
 715                         break;
 716                 case AF_INET6:
 717                         if (!ipv6_addr_equal((struct in6_addr *)daddr,
 718                                              (struct in6_addr *)
 719                                              x->id.daddr.a6) ||
 720                             !ipv6_addr_equal((struct in6_addr *)saddr,
 721                                              (struct in6_addr *)
 722                                              x->props.saddr.a6))
 723                                 continue;
 724                         break;
 725                 }
 726
 727                 xfrm_state_hold(x);
 728                 return x;
 729         }
 730
 731         return NULL;
 732 }
 733
 734 static inline struct xfrm_state *
 735 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
 736 {
 737         if (use_spi)
 738                 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
 739                                            x->id.proto, family);
 740         else
 741                 return __xfrm_state_lookup_byaddr(&x->id.daddr,
 742                                                   &x->props.saddr,
 743                                                   x->id.proto, family);
 744 }
 745
 746 static void xfrm_hash_grow_check(int have_hash_collision)
 747 {
 748         if (have_hash_collision &&
 749             (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
 750             xfrm_state_num > xfrm_state_hmask)
 751                 schedule_work(&xfrm_hash_work);
 752 }
 753
 754 struct xfrm_state *
 755 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 756                 struct flowi *fl, struct xfrm_tmpl *tmpl,
 757                 struct xfrm_policy *pol, int *err,
 758                 unsigned short family)
 759 {
 760         unsigned int h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
 761         struct hlist_node *entry;
 762         struct xfrm_state *x, *x0;
 763         int acquire_in_progress = 0;
 764         int error = 0;
 765         struct xfrm_state *best = NULL;
 766
 767         spin_lock_bh(&xfrm_state_lock);
 768         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 769                 if (x->props.family == family &&
 770                     x->props.reqid == tmpl->reqid &&
 771                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 772                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 773                     tmpl->mode == x->props.mode &&
 774                     tmpl->id.proto == x->id.proto &&
 775                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
 776                         /* Resolution logic:
 777                            1. There is a valid state with matching selector.
 778                               Done.
 779                            2. Valid state with inappropriate selector. Skip.
 780
 781                            Entering area of "sysdeps".
 782
 783                            3. If state is not valid, selector is temporary,
 784                               it selects only session which triggered
 785                               previous resolution. Key manager will do
 786                               something to install a state with proper
 787                               selector.
 788                          */
 789                         if (x->km.state == XFRM_STATE_VALID) {
 790                                 if (!xfrm_selector_match(&x->sel, fl, x->sel.family) ||
 791                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
 792                                         continue;
 793                                 if (!best ||
 794                                     best->km.dying > x->km.dying ||
 795                                     (best->km.dying == x->km.dying &&
 796                                      best->curlft.add_time < x->curlft.add_time))
 797                                         best = x;
 798                         } else if (x->km.state == XFRM_STATE_ACQ) {
 799                                 acquire_in_progress = 1;
 800                         } else if (x->km.state == XFRM_STATE_ERROR ||
 801                                    x->km.state == XFRM_STATE_EXPIRED) {
 802                                 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
 803                                     security_xfrm_state_pol_flow_match(x, pol, fl))
 804                                         error = -ESRCH;
 805                         }
 806                 }
 807         }
 808
 809         x = best;
 810         if (!x && !error && !acquire_in_progress) {
 811                 if (tmpl->id.spi &&
 812                     (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
 813                                               tmpl->id.proto, family)) != NULL) {
 814                         xfrm_state_put(x0);
 815                         error = -EEXIST;
 816                         goto out;
 817                 }
 818                 x = xfrm_state_alloc();
 819                 if (x == NULL) {
 820                         error = -ENOMEM;
 821                         goto out;
 822                 }
 823                 /* Initialize temporary selector matching only
 824                  * to current session. */
 825                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
 826
 827                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
 828                 if (error) {
 829                         x->km.state = XFRM_STATE_DEAD;
 830                         xfrm_state_put(x);
 831                         x = NULL;
 832                         goto out;
 833                 }
 834
 835                 if (km_query(x, tmpl, pol) == 0) {
 836                         x->km.state = XFRM_STATE_ACQ;
 837                         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 838                         h = xfrm_src_hash(daddr, saddr, family);
 839                         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 840                         if (x->id.spi) {
 841                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 842                                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 843                         }
 844                         x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
 845                         x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
 846                         add_timer(&x->timer);
 847                         xfrm_state_num++;
 848                         xfrm_hash_grow_check(x->bydst.next != NULL);
 849                 } else {
 850                         x->km.state = XFRM_STATE_DEAD;
 851                         xfrm_state_put(x);
 852                         x = NULL;
 853                         error = -ESRCH;
 854                 }
 855         }
 856 out:
 857         if (x)
 858                 xfrm_state_hold(x);
 859         else
 860                 *err = acquire_in_progress ? -EAGAIN : error;
 861         spin_unlock_bh(&xfrm_state_lock);
 862         return x;
 863 }
 864
 865 struct xfrm_state *
 866 xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 867                     unsigned short family, u8 mode, u8 proto, u32 reqid)
 868 {
 869         unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
 870         struct xfrm_state *rx = NULL, *x = NULL;
 871         struct hlist_node *entry;
 872
 873         spin_lock(&xfrm_state_lock);
 874         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 875                 if (x->props.family == family &&
 876                     x->props.reqid == reqid &&
 877                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
 878                     xfrm_state_addr_check(x, daddr, saddr, family) &&
 879                     mode == x->props.mode &&
 880                     proto == x->id.proto &&
 881                     x->km.state == XFRM_STATE_VALID) {
 882                         rx = x;
 883                         break;
 884                 }
 885         }
 886
 887         if (rx)
 888                 xfrm_state_hold(rx);
 889         spin_unlock(&xfrm_state_lock);
 890
 891
 892         return rx;
 893 }
 894 EXPORT_SYMBOL(xfrm_stateonly_find);
 895
 896 static void __xfrm_state_insert(struct xfrm_state *x)
 897 {
 898         unsigned int h;
 899
 900         x->genid = ++xfrm_state_genid;
 901
 902         h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
 903                           x->props.reqid, x->props.family);
 904         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 905
 906         h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
 907         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 908
 909         if (x->id.spi) {
 910                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
 911                                   x->props.family);
 912
 913                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
 914         }
 915
 916         mod_timer(&x->timer, jiffies + HZ);
 917         if (x->replay_maxage)
 918                 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
 919
 920         wake_up(&km_waitq);
 921
 922         xfrm_state_num++;
 923
 924         xfrm_hash_grow_check(x->bydst.next != NULL);
 925 }
 926
 927 /* xfrm_state_lock is held */
 928 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 929 {
 930         unsigned short family = xnew->props.family;
 931         u32 reqid = xnew->props.reqid;
 932         struct xfrm_state *x;
 933         struct hlist_node *entry;
 934         unsigned int h;
 935
 936         h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
 937         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 938                 if (x->props.family     == family &&
 939                     x->props.reqid      == reqid &&
 940                     !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
 941                     !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
 942                         x->genid = xfrm_state_genid;
 943         }
 944 }
 945
 946 void xfrm_state_insert(struct xfrm_state *x)
 947 {
 948         spin_lock_bh(&xfrm_state_lock);
 949         __xfrm_state_bump_genids(x);
 950         __xfrm_state_insert(x);
 951         spin_unlock_bh(&xfrm_state_lock);
 952 }
 953 EXPORT_SYMBOL(xfrm_state_insert);
 954
 955 /* xfrm_state_lock is held */
 956 static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
 957 {
 958         unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
 959         struct hlist_node *entry;
 960         struct xfrm_state *x;
 961
 962         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
 963                 if (x->props.reqid  != reqid ||
 964                     x->props.mode   != mode ||
 965                     x->props.family != family ||
 966                     x->km.state     != XFRM_STATE_ACQ ||
 967                     x->id.spi       != 0 ||
 968                     x->id.proto     != proto)
 969                         continue;
 970
 971                 switch (family) {
 972                 case AF_INET:
 973                         if (x->id.daddr.a4    != daddr->a4 ||
 974                             x->props.saddr.a4 != saddr->a4)
 975                                 continue;
 976                         break;
 977                 case AF_INET6:
 978                         if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
 979                                              (struct in6_addr *)daddr) ||
 980                             !ipv6_addr_equal((struct in6_addr *)
 981                                              x->props.saddr.a6,
 982                                              (struct in6_addr *)saddr))
 983                                 continue;
 984                         break;
 985                 }
 986
 987                 xfrm_state_hold(x);
 988                 return x;
 989         }
 990
 991         if (!create)
 992                 return NULL;
 993
 994         x = xfrm_state_alloc();
 995         if (likely(x)) {
 996                 switch (family) {
 997                 case AF_INET:
 998                         x->sel.daddr.a4 = daddr->a4;
 999                         x->sel.saddr.a4 = saddr->a4;
1000                         x->sel.prefixlen_d = 32;
1001                         x->sel.prefixlen_s = 32;
1002                         x->props.saddr.a4 = saddr->a4;
1003                         x->id.daddr.a4 = daddr->a4;
1004                         break;
1005
1006                 case AF_INET6:
1007                         ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1008                                        (struct in6_addr *)daddr);
1009                         ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1010                                        (struct in6_addr *)saddr);
1011                         x->sel.prefixlen_d = 128;
1012                         x->sel.prefixlen_s = 128;
1013                         ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1014                                        (struct in6_addr *)saddr);
1015                         ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1016                                        (struct in6_addr *)daddr);
1017                         break;
1018                 }
1019
1020                 x->km.state = XFRM_STATE_ACQ;
1021                 x->id.proto = proto;
1022                 x->props.family = family;
1023                 x->props.mode = mode;
1024                 x->props.reqid = reqid;
1025                 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
1026                 xfrm_state_hold(x);
1027                 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1028                 add_timer(&x->timer);
1029                 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1030                 h = xfrm_src_hash(daddr, saddr, family);
1031                 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1032
1033                 xfrm_state_num++;
1034
1035                 xfrm_hash_grow_check(x->bydst.next != NULL);
1036         }
1037
1038         return x;
1039 }
1040
1041 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
1042
1043 int xfrm_state_add(struct xfrm_state *x)
1044 {
1045         struct xfrm_state *x1;
1046         int family;
1047         int err;
1048         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1049
1050         family = x->props.family;
1051
1052         spin_lock_bh(&xfrm_state_lock);
1053
1054         x1 = __xfrm_state_locate(x, use_spi, family);
1055         if (x1) {
1056                 xfrm_state_put(x1);
1057                 x1 = NULL;
1058                 err = -EEXIST;
1059                 goto out;
1060         }
1061
1062         if (use_spi && x->km.seq) {
1063                 x1 = __xfrm_find_acq_byseq(x->km.seq);
1064                 if (x1 && ((x1->id.proto != x->id.proto) ||
1065                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1066                         xfrm_state_put(x1);
1067                         x1 = NULL;
1068                 }
1069         }
1070
1071         if (use_spi && !x1)
1072                 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
1073                                      x->id.proto,
1074                                      &x->id.daddr, &x->props.saddr, 0);
1075
1076         __xfrm_state_bump_genids(x);
1077         __xfrm_state_insert(x);
1078         err = 0;
1079
1080 out:
1081         spin_unlock_bh(&xfrm_state_lock);
1082
1083         if (x1) {
1084                 xfrm_state_delete(x1);
1085                 xfrm_state_put(x1);
1086         }
1087
1088         return err;
1089 }
1090 EXPORT_SYMBOL(xfrm_state_add);
1091
1092 #ifdef CONFIG_XFRM_MIGRATE
1093 struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1094 {
1095         int err = -ENOMEM;
1096         struct xfrm_state *x = xfrm_state_alloc();
1097         if (!x)
1098                 goto error;
1099
1100         memcpy(&x->id, &orig->id, sizeof(x->id));
1101         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
1102         memcpy(&x->lft, &orig->lft, sizeof(x->lft));
1103         x->props.mode = orig->props.mode;
1104         x->props.replay_window = orig->props.replay_window;
1105         x->props.reqid = orig->props.reqid;
1106         x->props.family = orig->props.family;
1107         x->props.saddr = orig->props.saddr;
1108
1109         if (orig->aalg) {
1110                 x->aalg = xfrm_algo_clone(orig->aalg);
1111                 if (!x->aalg)
1112                         goto error;
1113         }
1114         x->props.aalgo = orig->props.aalgo;
1115
1116         if (orig->ealg) {
1117                 x->ealg = xfrm_algo_clone(orig->ealg);
1118                 if (!x->ealg)
1119                         goto error;
1120         }
1121         x->props.ealgo = orig->props.ealgo;
1122
1123         if (orig->calg) {
1124                 x->calg = xfrm_algo_clone(orig->calg);
1125                 if (!x->calg)
1126                         goto error;
1127         }
1128         x->props.calgo = orig->props.calgo;
1129
1130         if (orig->encap) {
1131                 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
1132                 if (!x->encap)
1133                         goto error;
1134         }
1135
1136         if (orig->coaddr) {
1137                 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
1138                                     GFP_KERNEL);
1139                 if (!x->coaddr)
1140                         goto error;
1141         }
1142
1143         err = xfrm_init_state(x);
1144         if (err)
1145                 goto error;
1146
1147         x->props.flags = orig->props.flags;
1148
1149         x->curlft.add_time = orig->curlft.add_time;
1150         x->km.state = orig->km.state;
1151         x->km.seq = orig->km.seq;
1152
1153         return x;
1154
1155  error:
1156         if (errp)
1157                 *errp = err;
1158         if (x) {
1159                 kfree(x->aalg);
1160                 kfree(x->ealg);
1161                 kfree(x->calg);
1162                 kfree(x->encap);
1163                 kfree(x->coaddr);
1164         }
1165         kfree(x);
1166         return NULL;
1167 }
1168 EXPORT_SYMBOL(xfrm_state_clone);
1169
1170 /* xfrm_state_lock is held */
1171 struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
1172 {
1173         unsigned int h;
1174         struct xfrm_state *x;
1175         struct hlist_node *entry;
1176
1177         if (m->reqid) {
1178                 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1179                                   m->reqid, m->old_family);
1180                 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1181                         if (x->props.mode != m->mode ||
1182                             x->id.proto != m->proto)
1183                                 continue;
1184                         if (m->reqid && x->props.reqid != m->reqid)
1185                                 continue;
1186                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1187                                           m->old_family) ||
1188                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1189                                           m->old_family))
1190                                 continue;
1191                         xfrm_state_hold(x);
1192                         return x;
1193                 }
1194         } else {
1195                 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1196                                   m->old_family);
1197                 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1198                         if (x->props.mode != m->mode ||
1199                             x->id.proto != m->proto)
1200                                 continue;
1201                         if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1202                                           m->old_family) ||
1203                             xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1204                                           m->old_family))
1205                                 continue;
1206                         xfrm_state_hold(x);
1207                         return x;
1208                 }
1209         }
1210
1211         return NULL;
1212 }
1213 EXPORT_SYMBOL(xfrm_migrate_state_find);
1214
1215 struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1216                                        struct xfrm_migrate *m)
1217 {
1218         struct xfrm_state *xc;
1219         int err;
1220
1221         xc = xfrm_state_clone(x, &err);
1222         if (!xc)
1223                 return NULL;
1224
1225         memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1226         memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1227
1228         /* add state */
1229         if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1230                 /* a care is needed when the destination address of the
1231                    state is to be updated as it is a part of triplet */
1232                 xfrm_state_insert(xc);
1233         } else {
1234                 if ((err = xfrm_state_add(xc)) < 0)
1235                         goto error;
1236         }
1237
1238         return xc;
1239 error:
1240         kfree(xc);
1241         return NULL;
1242 }
1243 EXPORT_SYMBOL(xfrm_state_migrate);
1244 #endif
1245
1246 int xfrm_state_update(struct xfrm_state *x)
1247 {
1248         struct xfrm_state *x1;
1249         int err;
1250         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1251
1252         spin_lock_bh(&xfrm_state_lock);
1253         x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1254
1255         err = -ESRCH;
1256         if (!x1)
1257                 goto out;
1258
1259         if (xfrm_state_kern(x1)) {
1260                 xfrm_state_put(x1);
1261                 err = -EEXIST;
1262                 goto out;
1263         }
1264
1265         if (x1->km.state == XFRM_STATE_ACQ) {
1266                 __xfrm_state_insert(x);
1267                 x = NULL;
1268         }
1269         err = 0;
1270
1271 out:
1272         spin_unlock_bh(&xfrm_state_lock);
1273
1274         if (err)
1275                 return err;
1276
1277         if (!x) {
1278                 xfrm_state_delete(x1);
1279                 xfrm_state_put(x1);
1280                 return 0;
1281         }
1282
1283         err = -EINVAL;
1284         spin_lock_bh(&x1->lock);
1285         if (likely(x1->km.state == XFRM_STATE_VALID)) {
1286                 if (x->encap && x1->encap)
1287                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
1288                 if (x->coaddr && x1->coaddr) {
1289                         memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1290                 }
1291                 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1292                         memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1293                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1294                 x1->km.dying = 0;
1295
1296                 mod_timer(&x1->timer, jiffies + HZ);
1297                 if (x1->curlft.use_time)
1298                         xfrm_state_check_expire(x1);
1299
1300                 err = 0;
1301         }
1302         spin_unlock_bh(&x1->lock);
1303
1304         xfrm_state_put(x1);
1305
1306         return err;
1307 }
1308 EXPORT_SYMBOL(xfrm_state_update);
1309
1310 int xfrm_state_check_expire(struct xfrm_state *x)
1311 {
1312         if (!x->curlft.use_time)
1313                 x->curlft.use_time = get_seconds();
1314
1315         if (x->km.state != XFRM_STATE_VALID)
1316                 return -EINVAL;
1317
1318         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1319             x->curlft.packets >= x->lft.hard_packet_limit) {
1320                 x->km.state = XFRM_STATE_EXPIRED;
1321                 mod_timer(&x->timer, jiffies);
1322                 return -EINVAL;
1323         }
1324
1325         if (!x->km.dying &&
1326             (x->curlft.bytes >= x->lft.soft_byte_limit ||
1327              x->curlft.packets >= x->lft.soft_packet_limit)) {
1328                 x->km.dying = 1;
1329                 km_state_expired(x, 0, 0);
1330         }
1331         return 0;
1332 }
1333 EXPORT_SYMBOL(xfrm_state_check_expire);
1334
1335 struct xfrm_state *
1336 xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1337                   unsigned short family)
1338 {
1339         struct xfrm_state *x;
1340
1341         spin_lock_bh(&xfrm_state_lock);
1342         x = __xfrm_state_lookup(daddr, spi, proto, family);
1343         spin_unlock_bh(&xfrm_state_lock);
1344         return x;
1345 }
1346 EXPORT_SYMBOL(xfrm_state_lookup);
1347
1348 struct xfrm_state *
1349 xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1350                          u8 proto, unsigned short family)
1351 {
1352         struct xfrm_state *x;
1353
1354         spin_lock_bh(&xfrm_state_lock);
1355         x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
1356         spin_unlock_bh(&xfrm_state_lock);
1357         return x;
1358 }
1359 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1360
1361 struct xfrm_state *
1362 xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1363               xfrm_address_t *daddr, xfrm_address_t *saddr,
1364               int create, unsigned short family)
1365 {
1366         struct xfrm_state *x;
1367
1368         spin_lock_bh(&xfrm_state_lock);
1369         x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1370         spin_unlock_bh(&xfrm_state_lock);
1371
1372         return x;
1373 }
1374 EXPORT_SYMBOL(xfrm_find_acq);
1375
1376 #ifdef CONFIG_XFRM_SUB_POLICY
1377 int
1378 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1379                unsigned short family)
1380 {
1381         int err = 0;
1382         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1383         if (!afinfo)
1384                 return -EAFNOSUPPORT;
1385
1386         spin_lock_bh(&xfrm_state_lock);
1387         if (afinfo->tmpl_sort)
1388                 err = afinfo->tmpl_sort(dst, src, n);
1389         spin_unlock_bh(&xfrm_state_lock);
1390         xfrm_state_put_afinfo(afinfo);
1391         return err;
1392 }
1393 EXPORT_SYMBOL(xfrm_tmpl_sort);
1394
1395 int
1396 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1397                 unsigned short family)
1398 {
1399         int err = 0;
1400         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1401         if (!afinfo)
1402                 return -EAFNOSUPPORT;
1403
1404         spin_lock_bh(&xfrm_state_lock);
1405         if (afinfo->state_sort)
1406                 err = afinfo->state_sort(dst, src, n);
1407         spin_unlock_bh(&xfrm_state_lock);
1408         xfrm_state_put_afinfo(afinfo);
1409         return err;
1410 }
1411 EXPORT_SYMBOL(xfrm_state_sort);
1412 #endif
1413
1414 /* Silly enough, but I'm lazy to build resolution list */
1415
1416 static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1417 {
1418         int i;
1419
1420         for (i = 0; i <= xfrm_state_hmask; i++) {
1421                 struct hlist_node *entry;
1422                 struct xfrm_state *x;
1423
1424                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1425                         if (x->km.seq == seq &&
1426                             x->km.state == XFRM_STATE_ACQ) {
1427                                 xfrm_state_hold(x);
1428                                 return x;
1429                         }
1430                 }
1431         }
1432         return NULL;
1433 }
1434
1435 struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1436 {
1437         struct xfrm_state *x;
1438
1439         spin_lock_bh(&xfrm_state_lock);
1440         x = __xfrm_find_acq_byseq(seq);
1441         spin_unlock_bh(&xfrm_state_lock);
1442         return x;
1443 }
1444 EXPORT_SYMBOL(xfrm_find_acq_byseq);
1445
1446 u32 xfrm_get_acqseq(void)
1447 {
1448         u32 res;
1449         static u32 acqseq;
1450         static DEFINE_SPINLOCK(acqseq_lock);
1451
1452         spin_lock_bh(&acqseq_lock);
1453         res = (++acqseq ? : ++acqseq);
1454         spin_unlock_bh(&acqseq_lock);
1455         return res;
1456 }
1457 EXPORT_SYMBOL(xfrm_get_acqseq);
1458
1459 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
1460 {
1461         unsigned int h;
1462         struct xfrm_state *x0;
1463         int err = -ENOENT;
1464         __be32 minspi = htonl(low);
1465         __be32 maxspi = htonl(high);
1466
1467         spin_lock_bh(&x->lock);
1468         if (x->km.state == XFRM_STATE_DEAD)
1469                 goto unlock;
1470
1471         err = 0;
1472         if (x->id.spi)
1473                 goto unlock;
1474
1475         err = -ENOENT;
1476
1477         if (minspi == maxspi) {
1478                 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1479                 if (x0) {
1480                         xfrm_state_put(x0);
1481                         goto unlock;
1482                 }
1483                 x->id.spi = minspi;
1484         } else {
1485                 u32 spi = 0;
1486                 for (h=0; h<high-low+1; h++) {
1487                         spi = low + net_random()%(high-low+1);
1488                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1489                         if (x0 == NULL) {
1490                                 x->id.spi = htonl(spi);
1491                                 break;
1492                         }
1493                         xfrm_state_put(x0);
1494                 }
1495         }
1496         if (x->id.spi) {
1497                 spin_lock_bh(&xfrm_state_lock);
1498                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
1499                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1500                 spin_unlock_bh(&xfrm_state_lock);
1501
1502                 err = 0;
1503         }
1504
1505 unlock:
1506         spin_unlock_bh(&x->lock);
1507
1508         return err;
1509 }
1510 EXPORT_SYMBOL(xfrm_alloc_spi);
1511
1512 int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
1513                     void *data)
1514 {
1515         int i;
1516         struct xfrm_state *x, *last = NULL;
1517         struct hlist_node *entry;
1518         int count = 0;
1519         int err = 0;
1520
1521         spin_lock_bh(&xfrm_state_lock);
1522         for (i = 0; i <= xfrm_state_hmask; i++) {
1523                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1524                         if (!xfrm_id_proto_match(x->id.proto, proto))
1525                                 continue;
1526                         if (last) {
1527                                 err = func(last, count, data);
1528                                 if (err)
1529                                         goto out;
1530                         }
1531                         last = x;
1532                         count++;
1533                 }
1534         }
1535         if (count == 0) {
1536                 err = -ENOENT;
1537                 goto out;
1538         }
1539         err = func(last, 0, data);
1540 out:
1541         spin_unlock_bh(&xfrm_state_lock);
1542         return err;
1543 }
1544 EXPORT_SYMBOL(xfrm_state_walk);
1545
1546
1547 void xfrm_replay_notify(struct xfrm_state *x, int event)
1548 {
1549         struct km_event c;
1550         /* we send notify messages in case
1551          *  1. we updated on of the sequence numbers, and the seqno difference
1552          *     is at least x->replay_maxdiff, in this case we also update the
1553          *     timeout of our timer function
1554          *  2. if x->replay_maxage has elapsed since last update,
1555          *     and there were changes
1556          *
1557          *  The state structure must be locked!
1558          */
1559
1560         switch (event) {
1561         case XFRM_REPLAY_UPDATE:
1562                 if (x->replay_maxdiff &&
1563                     (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1564                     (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1565                         if (x->xflags & XFRM_TIME_DEFER)
1566                                 event = XFRM_REPLAY_TIMEOUT;
1567                         else
1568                                 return;
1569                 }
1570
1571                 break;
1572
1573         case XFRM_REPLAY_TIMEOUT:
1574                 if ((x->replay.seq == x->preplay.seq) &&
1575                     (x->replay.bitmap == x->preplay.bitmap) &&
1576                     (x->replay.oseq == x->preplay.oseq)) {
1577                         x->xflags |= XFRM_TIME_DEFER;
1578                         return;
1579                 }
1580
1581                 break;
1582         }
1583
1584         memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1585         c.event = XFRM_MSG_NEWAE;
1586         c.data.aevent = event;
1587         km_state_notify(x, &c);
1588
1589         if (x->replay_maxage &&
1590             !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1591                 x->xflags &= ~XFRM_TIME_DEFER;
1592 }
1593
1594 static void xfrm_replay_timer_handler(unsigned long data)
1595 {
1596         struct xfrm_state *x = (struct xfrm_state*)data;
1597
1598         spin_lock(&x->lock);
1599
1600         if (x->km.state == XFRM_STATE_VALID) {
1601                 if (xfrm_aevent_is_on())
1602                         xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1603                 else
1604                         x->xflags |= XFRM_TIME_DEFER;
1605         }
1606
1607         spin_unlock(&x->lock);
1608 }
1609
1610 int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
1611 {
1612         u32 diff;
1613         u32 seq = ntohl(net_seq);
1614
1615         if (unlikely(seq == 0))
1616                 return -EINVAL;
1617
1618         if (likely(seq > x->replay.seq))
1619                 return 0;
1620
1621         diff = x->replay.seq - seq;
1622         if (diff >= min_t(unsigned int, x->props.replay_window,
1623                           sizeof(x->replay.bitmap) * 8)) {
1624                 x->stats.replay_window++;
1625                 return -EINVAL;
1626         }
1627
1628         if (x->replay.bitmap & (1U << diff)) {
1629                 x->stats.replay++;
1630                 return -EINVAL;
1631         }
1632         return 0;
1633 }
1634 EXPORT_SYMBOL(xfrm_replay_check);
1635
1636 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1637 {
1638         u32 diff;
1639         u32 seq = ntohl(net_seq);
1640
1641         if (seq > x->replay.seq) {
1642                 diff = seq - x->replay.seq;
1643                 if (diff < x->props.replay_window)
1644                         x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1645                 else
1646                         x->replay.bitmap = 1;
1647                 x->replay.seq = seq;
1648         } else {
1649                 diff = x->replay.seq - seq;
1650                 x->replay.bitmap |= (1U << diff);
1651         }
1652
1653         if (xfrm_aevent_is_on())
1654                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1655 }
1656 EXPORT_SYMBOL(xfrm_replay_advance);
1657
1658 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
1659 static DEFINE_RWLOCK(xfrm_km_lock);
1660
1661 void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1662 {
1663         struct xfrm_mgr *km;
1664
1665         read_lock(&xfrm_km_lock);
1666         list_for_each_entry(km, &xfrm_km_list, list)
1667                 if (km->notify_policy)
1668                         km->notify_policy(xp, dir, c);
1669         read_unlock(&xfrm_km_lock);
1670 }
1671
1672 void km_state_notify(struct xfrm_state *x, struct km_event *c)
1673 {
1674         struct xfrm_mgr *km;
1675         read_lock(&xfrm_km_lock);
1676         list_for_each_entry(km, &xfrm_km_list, list)
1677                 if (km->notify)
1678                         km->notify(x, c);
1679         read_unlock(&xfrm_km_lock);
1680 }
1681
1682 EXPORT_SYMBOL(km_policy_notify);
1683 EXPORT_SYMBOL(km_state_notify);
1684
1685 void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
1686 {
1687         struct km_event c;
1688
1689         c.data.hard = hard;
1690         c.pid = pid;
1691         c.event = XFRM_MSG_EXPIRE;
1692         km_state_notify(x, &c);
1693
1694         if (hard)
1695                 wake_up(&km_waitq);
1696 }
1697
1698 EXPORT_SYMBOL(km_state_expired);
1699 /*
1700  * We send to all registered managers regardless of failure
1701  * We are happy with one success
1702 */
1703 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1704 {
1705         int err = -EINVAL, acqret;
1706         struct xfrm_mgr *km;
1707
1708         read_lock(&xfrm_km_lock);
1709         list_for_each_entry(km, &xfrm_km_list, list) {
1710                 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1711                 if (!acqret)
1712                         err = acqret;
1713         }
1714         read_unlock(&xfrm_km_lock);
1715         return err;
1716 }
1717 EXPORT_SYMBOL(km_query);
1718
1719 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1720 {
1721         int err = -EINVAL;
1722         struct xfrm_mgr *km;
1723
1724         read_lock(&xfrm_km_lock);
1725         list_for_each_entry(km, &xfrm_km_list, list) {
1726                 if (km->new_mapping)
1727                         err = km->new_mapping(x, ipaddr, sport);
1728                 if (!err)
1729                         break;
1730         }
1731         read_unlock(&xfrm_km_lock);
1732         return err;
1733 }
1734 EXPORT_SYMBOL(km_new_mapping);
1735
1736 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1737 {
1738         struct km_event c;
1739
1740         c.data.hard = hard;
1741         c.pid = pid;
1742         c.event = XFRM_MSG_POLEXPIRE;
1743         km_policy_notify(pol, dir, &c);
1744
1745         if (hard)
1746                 wake_up(&km_waitq);
1747 }
1748 EXPORT_SYMBOL(km_policy_expired);
1749
1750 int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1751                struct xfrm_migrate *m, int num_migrate)
1752 {
1753         int err = -EINVAL;
1754         int ret;
1755         struct xfrm_mgr *km;
1756
1757         read_lock(&xfrm_km_lock);
1758         list_for_each_entry(km, &xfrm_km_list, list) {
1759                 if (km->migrate) {
1760                         ret = km->migrate(sel, dir, type, m, num_migrate);
1761                         if (!ret)
1762                                 err = ret;
1763                 }
1764         }
1765         read_unlock(&xfrm_km_lock);
1766         return err;
1767 }
1768 EXPORT_SYMBOL(km_migrate);
1769
1770 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1771 {
1772         int err = -EINVAL;
1773         int ret;
1774         struct xfrm_mgr *km;
1775
1776         read_lock(&xfrm_km_lock);
1777         list_for_each_entry(km, &xfrm_km_list, list) {
1778                 if (km->report) {
1779                         ret = km->report(proto, sel, addr);
1780                         if (!ret)
1781                                 err = ret;
1782                 }
1783         }
1784         read_unlock(&xfrm_km_lock);
1785         return err;
1786 }
1787 EXPORT_SYMBOL(km_report);
1788
1789 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1790 {
1791         int err;
1792         u8 *data;
1793         struct xfrm_mgr *km;
1794         struct xfrm_policy *pol = NULL;
1795
1796         if (optlen <= 0 || optlen > PAGE_SIZE)
1797                 return -EMSGSIZE;
1798
1799         data = kmalloc(optlen, GFP_KERNEL);
1800         if (!data)
1801                 return -ENOMEM;
1802
1803         err = -EFAULT;
1804         if (copy_from_user(data, optval, optlen))
1805                 goto out;
1806
1807         err = -EINVAL;
1808         read_lock(&xfrm_km_lock);
1809         list_for_each_entry(km, &xfrm_km_list, list) {
1810                 pol = km->compile_policy(sk, optname, data,
1811                                          optlen, &err);
1812                 if (err >= 0)
1813                         break;
1814         }
1815         read_unlock(&xfrm_km_lock);
1816
1817         if (err >= 0) {
1818                 xfrm_sk_policy_insert(sk, err, pol);
1819                 xfrm_pol_put(pol);
1820                 err = 0;
1821         }
1822
1823 out:
1824         kfree(data);
1825         return err;
1826 }
1827 EXPORT_SYMBOL(xfrm_user_policy);
1828
1829 int xfrm_register_km(struct xfrm_mgr *km)
1830 {
1831         write_lock_bh(&xfrm_km_lock);
1832         list_add_tail(&km->list, &xfrm_km_list);
1833         write_unlock_bh(&xfrm_km_lock);
1834         return 0;
1835 }
1836 EXPORT_SYMBOL(xfrm_register_km);
1837
1838 int xfrm_unregister_km(struct xfrm_mgr *km)
1839 {
1840         write_lock_bh(&xfrm_km_lock);
1841         list_del(&km->list);
1842         write_unlock_bh(&xfrm_km_lock);
1843         return 0;
1844 }
1845 EXPORT_SYMBOL(xfrm_unregister_km);
1846
1847 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1848 {
1849         int err = 0;
1850         if (unlikely(afinfo == NULL))
1851                 return -EINVAL;
1852         if (unlikely(afinfo->family >= NPROTO))
1853                 return -EAFNOSUPPORT;
1854         write_lock_bh(&xfrm_state_afinfo_lock);
1855         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1856                 err = -ENOBUFS;
1857         else
1858                 xfrm_state_afinfo[afinfo->family] = afinfo;
1859         write_unlock_bh(&xfrm_state_afinfo_lock);
1860         return err;
1861 }
1862 EXPORT_SYMBOL(xfrm_state_register_afinfo);
1863
1864 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1865 {
1866         int err = 0;
1867         if (unlikely(afinfo == NULL))
1868                 return -EINVAL;
1869         if (unlikely(afinfo->family >= NPROTO))
1870                 return -EAFNOSUPPORT;
1871         write_lock_bh(&xfrm_state_afinfo_lock);
1872         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1873                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1874                         err = -EINVAL;
1875                 else
1876                         xfrm_state_afinfo[afinfo->family] = NULL;
1877         }
1878         write_unlock_bh(&xfrm_state_afinfo_lock);
1879         return err;
1880 }
1881 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1882
1883 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
1884 {
1885         struct xfrm_state_afinfo *afinfo;
1886         if (unlikely(family >= NPROTO))
1887                 return NULL;
1888         read_lock(&xfrm_state_afinfo_lock);
1889         afinfo = xfrm_state_afinfo[family];
1890         if (unlikely(!afinfo))
1891                 read_unlock(&xfrm_state_afinfo_lock);
1892         return afinfo;
1893 }
1894
1895 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1896 {
1897         read_unlock(&xfrm_state_afinfo_lock);
1898 }
1899
1900 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1901 void xfrm_state_delete_tunnel(struct xfrm_state *x)
1902 {
1903         if (x->tunnel) {
1904                 struct xfrm_state *t = x->tunnel;
1905
1906                 if (atomic_read(&t->tunnel_users) == 2)
1907                         xfrm_state_delete(t);
1908                 atomic_dec(&t->tunnel_users);
1909                 xfrm_state_put(t);
1910                 x->tunnel = NULL;
1911         }
1912 }
1913 EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1914
1915 int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1916 {
1917         int res;
1918
1919         spin_lock_bh(&x->lock);
1920         if (x->km.state == XFRM_STATE_VALID &&
1921             x->type && x->type->get_mtu)
1922                 res = x->type->get_mtu(x, mtu);
1923         else
1924                 res = mtu - x->props.header_len;
1925         spin_unlock_bh(&x->lock);
1926         return res;
1927 }
1928
1929 int xfrm_init_state(struct xfrm_state *x)
1930 {
1931         struct xfrm_state_afinfo *afinfo;
1932         int family = x->props.family;
1933         int err;
1934
1935         err = -EAFNOSUPPORT;
1936         afinfo = xfrm_state_get_afinfo(family);
1937         if (!afinfo)
1938                 goto error;
1939
1940         err = 0;
1941         if (afinfo->init_flags)
1942                 err = afinfo->init_flags(x);
1943
1944         xfrm_state_put_afinfo(afinfo);
1945
1946         if (err)
1947                 goto error;
1948
1949         err = -EPROTONOSUPPORT;
1950         x->type = xfrm_get_type(x->id.proto, family);
1951         if (x->type == NULL)
1952                 goto error;
1953
1954         err = x->type->init_state(x);
1955         if (err)
1956                 goto error;
1957
1958         x->mode = xfrm_get_mode(x->props.mode, family);
1959         if (x->mode == NULL)
1960                 goto error;
1961
1962         x->km.state = XFRM_STATE_VALID;
1963
1964 error:
1965         return err;
1966 }
1967
1968 EXPORT_SYMBOL(xfrm_init_state);
1969
1970 void __init xfrm_state_init(void)
1971 {
1972         unsigned int sz;
1973
1974         sz = sizeof(struct hlist_head) * 8;
1975
1976         xfrm_state_bydst = xfrm_hash_alloc(sz);
1977         xfrm_state_bysrc = xfrm_hash_alloc(sz);
1978         xfrm_state_byspi = xfrm_hash_alloc(sz);
1979         if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
1980                 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
1981         xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
1982
1983         INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
1984 }
1985
1986 #ifdef CONFIG_AUDITSYSCALL
1987 static inline void xfrm_audit_common_stateinfo(struct xfrm_state *x,
1988                                                struct audit_buffer *audit_buf)
1989 {
1990         if (x->security)
1991                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
1992                                  x->security->ctx_alg, x->security->ctx_doi,
1993                                  x->security->ctx_str);
1994
1995         switch(x->props.family) {
1996         case AF_INET:
1997                 audit_log_format(audit_buf, " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
1998                                  NIPQUAD(x->props.saddr.a4),
1999                                  NIPQUAD(x->id.daddr.a4));
2000                 break;
2001         case AF_INET6:
2002                 {
2003                         struct in6_addr saddr6, daddr6;
2004
2005                         memcpy(&saddr6, x->props.saddr.a6,
2006                                 sizeof(struct in6_addr));
2007                         memcpy(&daddr6, x->id.daddr.a6,
2008                                 sizeof(struct in6_addr));
2009                         audit_log_format(audit_buf,
2010                                          " src=" NIP6_FMT " dst=" NIP6_FMT,
2011                                          NIP6(saddr6), NIP6(daddr6));
2012                 }
2013                 break;
2014         }
2015 }
2016
2017 void
2018 xfrm_audit_state_add(struct xfrm_state *x, int result, u32 auid, u32 sid)
2019 {
2020         struct audit_buffer *audit_buf;
2021         extern int audit_enabled;
2022
2023         if (audit_enabled == 0)
2024                 return;
2025         audit_buf = xfrm_audit_start(sid, auid);
2026         if (audit_buf == NULL)
2027                 return;
2028         audit_log_format(audit_buf, " op=SAD-add res=%u",result);
2029         xfrm_audit_common_stateinfo(x, audit_buf);
2030         audit_log_format(audit_buf, " spi=%lu(0x%lx)",
2031                          (unsigned long)x->id.spi, (unsigned long)x->id.spi);
2032         audit_log_end(audit_buf);
2033 }
2034 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
2035
2036 void
2037 xfrm_audit_state_delete(struct xfrm_state *x, int result, u32 auid, u32 sid)
2038 {
2039         struct audit_buffer *audit_buf;
2040         extern int audit_enabled;
2041
2042         if (audit_enabled == 0)
2043                 return;
2044         audit_buf = xfrm_audit_start(sid, auid);
2045         if (audit_buf == NULL)
2046                 return;
2047         audit_log_format(audit_buf, " op=SAD-delete res=%u",result);
2048         xfrm_audit_common_stateinfo(x, audit_buf);
2049         audit_log_format(audit_buf, " spi=%lu(0x%lx)",
2050                          (unsigned long)x->id.spi, (unsigned long)x->id.spi);
2051         audit_log_end(audit_buf);
2052 }
2053 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
2054 #endif /* CONFIG_AUDITSYSCALL */