Thomas Gleixner | 457c899 | 2019-05-19 13:08:55 +0100 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0-only |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2 | /* |
| 3 | * xfrm_state.c |
| 4 | * |
| 5 | * Changes: |
| 6 | * Mitsuru KANDA @USAGI |
| 7 | * Kazunori MIYAZAWA @USAGI |
| 8 | * Kunihiro Ishiguro <kunihiro@ipinfusion.com> |
| 9 | * IPv6 support |
| 10 | * YOSHIFUJI Hideaki @USAGI |
| 11 | * Split up af-specific functions |
| 12 | * Derek Atkins <derek@ihtfp.com> |
| 13 | * Add UDP Encapsulation |
Trent Jaeger | df71837 | 2005-12-13 23:12:27 -0800 | [diff] [blame] | 14 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 15 | */ |
| 16 | |
Jakub Kicinski | b645941 | 2021-12-28 16:49:13 -0800 | [diff] [blame] | 17 | #include <linux/compat.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 18 | #include <linux/workqueue.h> |
| 19 | #include <net/xfrm.h> |
| 20 | #include <linux/pfkeyv2.h> |
| 21 | #include <linux/ipsec.h> |
| 22 | #include <linux/module.h> |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 23 | #include <linux/cache.h> |
Paul Moore | 68277ac | 2007-12-20 20:49:33 -0800 | [diff] [blame] | 24 | #include <linux/audit.h> |
Linus Torvalds | 7c0f6ba | 2016-12-24 11:46:01 -0800 | [diff] [blame] | 25 | #include <linux/uaccess.h> |
Yury Polyanskiy | 9e0d57f | 2009-11-08 20:58:41 -0800 | [diff] [blame] | 26 | #include <linux/ktime.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 27 | #include <linux/slab.h> |
Yury Polyanskiy | 9e0d57f | 2009-11-08 20:58:41 -0800 | [diff] [blame] | 28 | #include <linux/interrupt.h> |
| 29 | #include <linux/kernel.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 30 | |
Florian Westphal | c7b37c7 | 2019-06-24 22:04:48 +0200 | [diff] [blame] | 31 | #include <crypto/aead.h> |
| 32 | |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 33 | #include "xfrm_hash.h" |
| 34 | |
Florian Westphal | c840699 | 2016-08-09 12:16:08 +0200 | [diff] [blame] | 35 | #define xfrm_state_deref_prot(table, net) \ |
| 36 | rcu_dereference_protected((table), lockdep_is_held(&(net)->xfrm.xfrm_state_lock)) |
| 37 | |
Florian Westphal | 35db57bb | 2016-08-23 16:00:12 +0200 | [diff] [blame] | 38 | static void xfrm_state_gc_task(struct work_struct *work); |
| 39 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 40 | /* Each xfrm_state may be linked to two tables: |
| 41 | |
| 42 | 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl) |
David S. Miller | a624c10 | 2006-08-24 03:24:33 -0700 | [diff] [blame] | 43 | 2. Hash table by (daddr,family,reqid) to find what SAs exist for given |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 44 | destination/tunnel endpoint. (output) |
| 45 | */ |
| 46 | |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 47 | static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024; |
Mathias Krause | 565f0fa | 2018-05-03 10:55:07 +0200 | [diff] [blame] | 48 | static struct kmem_cache *xfrm_state_cache __ro_after_init; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 49 | |
Florian Westphal | 35db57bb | 2016-08-23 16:00:12 +0200 | [diff] [blame] | 50 | static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task); |
| 51 | static HLIST_HEAD(xfrm_state_gc_list); |
| 52 | |
Florian Westphal | 02efdff | 2016-08-09 12:16:05 +0200 | [diff] [blame] | 53 | static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x) |
| 54 | { |
Reshetova, Elena | 88755e9c | 2017-07-04 15:53:21 +0300 | [diff] [blame] | 55 | return refcount_inc_not_zero(&x->refcnt); |
Florian Westphal | 02efdff | 2016-08-09 12:16:05 +0200 | [diff] [blame] | 56 | } |
| 57 | |
Alexey Dobriyan | 64d0cd0 | 2008-11-25 17:29:21 -0800 | [diff] [blame] | 58 | static inline unsigned int xfrm_dst_hash(struct net *net, |
David S. Miller | 2ab3850 | 2011-02-24 01:47:16 -0500 | [diff] [blame] | 59 | const xfrm_address_t *daddr, |
| 60 | const xfrm_address_t *saddr, |
David S. Miller | c1969f2 | 2006-08-24 04:00:03 -0700 | [diff] [blame] | 61 | u32 reqid, |
David S. Miller | a624c10 | 2006-08-24 03:24:33 -0700 | [diff] [blame] | 62 | unsigned short family) |
| 63 | { |
Alexey Dobriyan | 64d0cd0 | 2008-11-25 17:29:21 -0800 | [diff] [blame] | 64 | return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask); |
David S. Miller | a624c10 | 2006-08-24 03:24:33 -0700 | [diff] [blame] | 65 | } |
| 66 | |
Alexey Dobriyan | 64d0cd0 | 2008-11-25 17:29:21 -0800 | [diff] [blame] | 67 | static inline unsigned int xfrm_src_hash(struct net *net, |
David S. Miller | 2ab3850 | 2011-02-24 01:47:16 -0500 | [diff] [blame] | 68 | const xfrm_address_t *daddr, |
| 69 | const xfrm_address_t *saddr, |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 70 | unsigned short family) |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 71 | { |
Alexey Dobriyan | 64d0cd0 | 2008-11-25 17:29:21 -0800 | [diff] [blame] | 72 | return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 73 | } |
| 74 | |
David S. Miller | 2575b65 | 2006-08-24 03:26:44 -0700 | [diff] [blame] | 75 | static inline unsigned int |
David S. Miller | 2ab3850 | 2011-02-24 01:47:16 -0500 | [diff] [blame] | 76 | xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr, |
| 77 | __be32 spi, u8 proto, unsigned short family) |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 78 | { |
Alexey Dobriyan | 64d0cd0 | 2008-11-25 17:29:21 -0800 | [diff] [blame] | 79 | return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 80 | } |
| 81 | |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 82 | static unsigned int xfrm_seq_hash(struct net *net, u32 seq) |
| 83 | { |
| 84 | return __xfrm_seq_hash(seq, net->xfrm.state_hmask); |
| 85 | } |
| 86 | |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 87 | #define XFRM_STATE_INSERT(by, _n, _h, _type) \ |
| 88 | { \ |
| 89 | struct xfrm_state *_x = NULL; \ |
| 90 | \ |
| 91 | if (_type != XFRM_DEV_OFFLOAD_PACKET) { \ |
| 92 | hlist_for_each_entry_rcu(_x, _h, by) { \ |
| 93 | if (_x->xso.type == XFRM_DEV_OFFLOAD_PACKET) \ |
| 94 | continue; \ |
| 95 | break; \ |
| 96 | } \ |
| 97 | } \ |
| 98 | \ |
| 99 | if (!_x || _x->xso.type == XFRM_DEV_OFFLOAD_PACKET) \ |
| 100 | /* SAD is empty or consist from HW SAs only */ \ |
| 101 | hlist_add_head_rcu(_n, _h); \ |
| 102 | else \ |
| 103 | hlist_add_before_rcu(_n, &_x->by); \ |
| 104 | } |
| 105 | |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 106 | static void xfrm_hash_transfer(struct hlist_head *list, |
| 107 | struct hlist_head *ndsttable, |
| 108 | struct hlist_head *nsrctable, |
| 109 | struct hlist_head *nspitable, |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 110 | struct hlist_head *nseqtable, |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 111 | unsigned int nhashmask) |
| 112 | { |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 113 | struct hlist_node *tmp; |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 114 | struct xfrm_state *x; |
| 115 | |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 116 | hlist_for_each_entry_safe(x, tmp, list, bydst) { |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 117 | unsigned int h; |
| 118 | |
David S. Miller | c1969f2 | 2006-08-24 04:00:03 -0700 | [diff] [blame] | 119 | h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr, |
| 120 | x->props.reqid, x->props.family, |
| 121 | nhashmask); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 122 | XFRM_STATE_INSERT(bydst, &x->bydst, ndsttable + h, x->xso.type); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 123 | |
Masahide NAKAMURA | 667bbcb | 2006-10-03 15:56:09 -0700 | [diff] [blame] | 124 | h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr, |
| 125 | x->props.family, |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 126 | nhashmask); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 127 | XFRM_STATE_INSERT(bysrc, &x->bysrc, nsrctable + h, x->xso.type); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 128 | |
Masahide NAKAMURA | 7b4dc360 | 2006-09-27 22:21:52 -0700 | [diff] [blame] | 129 | if (x->id.spi) { |
| 130 | h = __xfrm_spi_hash(&x->id.daddr, x->id.spi, |
| 131 | x->id.proto, x->props.family, |
| 132 | nhashmask); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 133 | XFRM_STATE_INSERT(byspi, &x->byspi, nspitable + h, |
| 134 | x->xso.type); |
Masahide NAKAMURA | 7b4dc360 | 2006-09-27 22:21:52 -0700 | [diff] [blame] | 135 | } |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 136 | |
| 137 | if (x->km.seq) { |
| 138 | h = __xfrm_seq_hash(x->km.seq, nhashmask); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 139 | XFRM_STATE_INSERT(byseq, &x->byseq, nseqtable + h, |
| 140 | x->xso.type); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 141 | } |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 142 | } |
| 143 | } |
| 144 | |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 145 | static unsigned long xfrm_hash_new_size(unsigned int state_hmask) |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 146 | { |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 147 | return ((state_hmask + 1) << 1) * sizeof(struct hlist_head); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 148 | } |
| 149 | |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 150 | static void xfrm_hash_resize(struct work_struct *work) |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 151 | { |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 152 | struct net *net = container_of(work, struct net, xfrm.state_hash_work); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 153 | struct hlist_head *ndst, *nsrc, *nspi, *nseq, *odst, *osrc, *ospi, *oseq; |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 154 | unsigned long nsize, osize; |
| 155 | unsigned int nhashmask, ohashmask; |
| 156 | int i; |
| 157 | |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 158 | nsize = xfrm_hash_new_size(net->xfrm.state_hmask); |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 159 | ndst = xfrm_hash_alloc(nsize); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 160 | if (!ndst) |
Ying Xue | 0244790 | 2014-08-29 17:09:07 +0800 | [diff] [blame] | 161 | return; |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 162 | nsrc = xfrm_hash_alloc(nsize); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 163 | if (!nsrc) { |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 164 | xfrm_hash_free(ndst, nsize); |
Ying Xue | 0244790 | 2014-08-29 17:09:07 +0800 | [diff] [blame] | 165 | return; |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 166 | } |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 167 | nspi = xfrm_hash_alloc(nsize); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 168 | if (!nspi) { |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 169 | xfrm_hash_free(ndst, nsize); |
| 170 | xfrm_hash_free(nsrc, nsize); |
Ying Xue | 0244790 | 2014-08-29 17:09:07 +0800 | [diff] [blame] | 171 | return; |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 172 | } |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 173 | nseq = xfrm_hash_alloc(nsize); |
| 174 | if (!nseq) { |
| 175 | xfrm_hash_free(ndst, nsize); |
| 176 | xfrm_hash_free(nsrc, nsize); |
| 177 | xfrm_hash_free(nspi, nsize); |
| 178 | return; |
| 179 | } |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 180 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 181 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Ahmed S. Darwish | e88add1 | 2021-03-16 11:56:29 +0100 | [diff] [blame] | 182 | write_seqcount_begin(&net->xfrm.xfrm_state_hash_generation); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 183 | |
| 184 | nhashmask = (nsize / sizeof(struct hlist_head)) - 1U; |
Florian Westphal | c840699 | 2016-08-09 12:16:08 +0200 | [diff] [blame] | 185 | odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net); |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 186 | for (i = net->xfrm.state_hmask; i >= 0; i--) |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 187 | xfrm_hash_transfer(odst + i, ndst, nsrc, nspi, nseq, nhashmask); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 188 | |
Florian Westphal | c840699 | 2016-08-09 12:16:08 +0200 | [diff] [blame] | 189 | osrc = xfrm_state_deref_prot(net->xfrm.state_bysrc, net); |
| 190 | ospi = xfrm_state_deref_prot(net->xfrm.state_byspi, net); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 191 | oseq = xfrm_state_deref_prot(net->xfrm.state_byseq, net); |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 192 | ohashmask = net->xfrm.state_hmask; |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 193 | |
Florian Westphal | c840699 | 2016-08-09 12:16:08 +0200 | [diff] [blame] | 194 | rcu_assign_pointer(net->xfrm.state_bydst, ndst); |
| 195 | rcu_assign_pointer(net->xfrm.state_bysrc, nsrc); |
| 196 | rcu_assign_pointer(net->xfrm.state_byspi, nspi); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 197 | rcu_assign_pointer(net->xfrm.state_byseq, nseq); |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 198 | net->xfrm.state_hmask = nhashmask; |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 199 | |
Ahmed S. Darwish | e88add1 | 2021-03-16 11:56:29 +0100 | [diff] [blame] | 200 | write_seqcount_end(&net->xfrm.xfrm_state_hash_generation); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 201 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 202 | |
| 203 | osize = (ohashmask + 1) * sizeof(struct hlist_head); |
Florian Westphal | df7274e | 2016-08-09 12:16:06 +0200 | [diff] [blame] | 204 | |
| 205 | synchronize_rcu(); |
| 206 | |
David S. Miller | 44e36b4 | 2006-08-24 04:50:50 -0700 | [diff] [blame] | 207 | xfrm_hash_free(odst, osize); |
| 208 | xfrm_hash_free(osrc, osize); |
| 209 | xfrm_hash_free(ospi, osize); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 210 | xfrm_hash_free(oseq, osize); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 211 | } |
| 212 | |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 213 | static DEFINE_SPINLOCK(xfrm_state_afinfo_lock); |
| 214 | static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 215 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 216 | static DEFINE_SPINLOCK(xfrm_state_gc_lock); |
| 217 | |
Jamal Hadi Salim | 53bc6b4d | 2006-03-20 19:17:03 -0800 | [diff] [blame] | 218 | int __xfrm_state_delete(struct xfrm_state *x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 219 | |
Jamal Hadi Salim | 980ebd2 | 2006-03-20 19:16:40 -0800 | [diff] [blame] | 220 | int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); |
Florian Westphal | bb9cd07 | 2019-04-17 11:45:13 +0200 | [diff] [blame] | 221 | static bool km_is_alive(const struct km_event *c); |
Eric W. Biederman | 15e4730 | 2012-09-07 20:12:54 +0000 | [diff] [blame] | 222 | void km_state_expired(struct xfrm_state *x, int hard, u32 portid); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 223 | |
Eric Dumazet | 533cb5b | 2008-01-30 19:11:50 -0800 | [diff] [blame] | 224 | int xfrm_register_type(const struct xfrm_type *type, unsigned short family) |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 225 | { |
Cong Wang | 7a9885b | 2013-01-17 16:34:11 +0800 | [diff] [blame] | 226 | struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 227 | int err = 0; |
| 228 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 229 | if (!afinfo) |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 230 | return -EAFNOSUPPORT; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 231 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 232 | #define X(afi, T, name) do { \ |
| 233 | WARN_ON((afi)->type_ ## name); \ |
| 234 | (afi)->type_ ## name = (T); \ |
| 235 | } while (0) |
| 236 | |
| 237 | switch (type->proto) { |
| 238 | case IPPROTO_COMP: |
| 239 | X(afinfo, type, comp); |
| 240 | break; |
| 241 | case IPPROTO_AH: |
| 242 | X(afinfo, type, ah); |
| 243 | break; |
| 244 | case IPPROTO_ESP: |
| 245 | X(afinfo, type, esp); |
| 246 | break; |
| 247 | case IPPROTO_IPIP: |
| 248 | X(afinfo, type, ipip); |
| 249 | break; |
| 250 | case IPPROTO_DSTOPTS: |
| 251 | X(afinfo, type, dstopts); |
| 252 | break; |
| 253 | case IPPROTO_ROUTING: |
| 254 | X(afinfo, type, routing); |
| 255 | break; |
| 256 | case IPPROTO_IPV6: |
| 257 | X(afinfo, type, ipip6); |
| 258 | break; |
| 259 | default: |
| 260 | WARN_ON(1); |
| 261 | err = -EPROTONOSUPPORT; |
| 262 | break; |
| 263 | } |
| 264 | #undef X |
Florian Westphal | af5d27c4 | 2017-01-09 14:20:47 +0100 | [diff] [blame] | 265 | rcu_read_unlock(); |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 266 | return err; |
| 267 | } |
| 268 | EXPORT_SYMBOL(xfrm_register_type); |
| 269 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 270 | void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family) |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 271 | { |
Cong Wang | 7a9885b | 2013-01-17 16:34:11 +0800 | [diff] [blame] | 272 | struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 273 | |
| 274 | if (unlikely(afinfo == NULL)) |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 275 | return; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 276 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 277 | #define X(afi, T, name) do { \ |
| 278 | WARN_ON((afi)->type_ ## name != (T)); \ |
| 279 | (afi)->type_ ## name = NULL; \ |
| 280 | } while (0) |
| 281 | |
| 282 | switch (type->proto) { |
| 283 | case IPPROTO_COMP: |
| 284 | X(afinfo, type, comp); |
| 285 | break; |
| 286 | case IPPROTO_AH: |
| 287 | X(afinfo, type, ah); |
| 288 | break; |
| 289 | case IPPROTO_ESP: |
| 290 | X(afinfo, type, esp); |
| 291 | break; |
| 292 | case IPPROTO_IPIP: |
| 293 | X(afinfo, type, ipip); |
| 294 | break; |
| 295 | case IPPROTO_DSTOPTS: |
| 296 | X(afinfo, type, dstopts); |
| 297 | break; |
| 298 | case IPPROTO_ROUTING: |
| 299 | X(afinfo, type, routing); |
| 300 | break; |
| 301 | case IPPROTO_IPV6: |
| 302 | X(afinfo, type, ipip6); |
| 303 | break; |
| 304 | default: |
| 305 | WARN_ON(1); |
| 306 | break; |
| 307 | } |
| 308 | #undef X |
Florian Westphal | af5d27c4 | 2017-01-09 14:20:47 +0100 | [diff] [blame] | 309 | rcu_read_unlock(); |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 310 | } |
| 311 | EXPORT_SYMBOL(xfrm_unregister_type); |
| 312 | |
Eric Dumazet | 533cb5b | 2008-01-30 19:11:50 -0800 | [diff] [blame] | 313 | static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family) |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 314 | { |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 315 | const struct xfrm_type *type = NULL; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 316 | struct xfrm_state_afinfo *afinfo; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 317 | int modload_attempted = 0; |
| 318 | |
| 319 | retry: |
| 320 | afinfo = xfrm_state_get_afinfo(family); |
| 321 | if (unlikely(afinfo == NULL)) |
| 322 | return NULL; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 323 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 324 | switch (proto) { |
| 325 | case IPPROTO_COMP: |
| 326 | type = afinfo->type_comp; |
| 327 | break; |
| 328 | case IPPROTO_AH: |
| 329 | type = afinfo->type_ah; |
| 330 | break; |
| 331 | case IPPROTO_ESP: |
| 332 | type = afinfo->type_esp; |
| 333 | break; |
| 334 | case IPPROTO_IPIP: |
| 335 | type = afinfo->type_ipip; |
| 336 | break; |
| 337 | case IPPROTO_DSTOPTS: |
| 338 | type = afinfo->type_dstopts; |
| 339 | break; |
| 340 | case IPPROTO_ROUTING: |
| 341 | type = afinfo->type_routing; |
| 342 | break; |
| 343 | case IPPROTO_IPV6: |
| 344 | type = afinfo->type_ipip6; |
| 345 | break; |
| 346 | default: |
| 347 | break; |
| 348 | } |
| 349 | |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 350 | if (unlikely(type && !try_module_get(type->owner))) |
| 351 | type = NULL; |
Florian Westphal | 75cda62 | 2017-01-09 14:20:49 +0100 | [diff] [blame] | 352 | |
| 353 | rcu_read_unlock(); |
| 354 | |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 355 | if (!type && !modload_attempted) { |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 356 | request_module("xfrm-type-%d-%d", family, proto); |
| 357 | modload_attempted = 1; |
| 358 | goto retry; |
| 359 | } |
| 360 | |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 361 | return type; |
| 362 | } |
| 363 | |
Eric Dumazet | 533cb5b | 2008-01-30 19:11:50 -0800 | [diff] [blame] | 364 | static void xfrm_put_type(const struct xfrm_type *type) |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 365 | { |
| 366 | module_put(type->owner); |
| 367 | } |
| 368 | |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 369 | int xfrm_register_type_offload(const struct xfrm_type_offload *type, |
| 370 | unsigned short family) |
| 371 | { |
| 372 | struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 373 | int err = 0; |
| 374 | |
| 375 | if (unlikely(afinfo == NULL)) |
| 376 | return -EAFNOSUPPORT; |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 377 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 378 | switch (type->proto) { |
| 379 | case IPPROTO_ESP: |
| 380 | WARN_ON(afinfo->type_offload_esp); |
| 381 | afinfo->type_offload_esp = type; |
| 382 | break; |
| 383 | default: |
| 384 | WARN_ON(1); |
| 385 | err = -EPROTONOSUPPORT; |
| 386 | break; |
| 387 | } |
| 388 | |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 389 | rcu_read_unlock(); |
| 390 | return err; |
| 391 | } |
| 392 | EXPORT_SYMBOL(xfrm_register_type_offload); |
| 393 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 394 | void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, |
| 395 | unsigned short family) |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 396 | { |
| 397 | struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 398 | |
| 399 | if (unlikely(afinfo == NULL)) |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 400 | return; |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 401 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 402 | switch (type->proto) { |
| 403 | case IPPROTO_ESP: |
| 404 | WARN_ON(afinfo->type_offload_esp != type); |
| 405 | afinfo->type_offload_esp = NULL; |
| 406 | break; |
| 407 | default: |
| 408 | WARN_ON(1); |
| 409 | break; |
| 410 | } |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 411 | rcu_read_unlock(); |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 412 | } |
| 413 | EXPORT_SYMBOL(xfrm_unregister_type_offload); |
| 414 | |
Ilan Tayari | ffdb521 | 2017-08-01 12:49:08 +0300 | [diff] [blame] | 415 | static const struct xfrm_type_offload * |
| 416 | xfrm_get_type_offload(u8 proto, unsigned short family, bool try_load) |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 417 | { |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 418 | const struct xfrm_type_offload *type = NULL; |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 419 | struct xfrm_state_afinfo *afinfo; |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 420 | |
Ilan Tayari | ffdb521 | 2017-08-01 12:49:08 +0300 | [diff] [blame] | 421 | retry: |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 422 | afinfo = xfrm_state_get_afinfo(family); |
| 423 | if (unlikely(afinfo == NULL)) |
| 424 | return NULL; |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 425 | |
Florian Westphal | 4f518e8 | 2019-05-03 17:46:19 +0200 | [diff] [blame] | 426 | switch (proto) { |
| 427 | case IPPROTO_ESP: |
| 428 | type = afinfo->type_offload_esp; |
| 429 | break; |
| 430 | default: |
| 431 | break; |
| 432 | } |
| 433 | |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 434 | if ((type && !try_module_get(type->owner))) |
| 435 | type = NULL; |
| 436 | |
Sabrina Dubroca | 2f10a61 | 2017-12-31 16:18:56 +0100 | [diff] [blame] | 437 | rcu_read_unlock(); |
| 438 | |
Ilan Tayari | ffdb521 | 2017-08-01 12:49:08 +0300 | [diff] [blame] | 439 | if (!type && try_load) { |
| 440 | request_module("xfrm-offload-%d-%d", family, proto); |
Gustavo A. R. Silva | 545d8ae | 2018-01-22 16:34:09 -0600 | [diff] [blame] | 441 | try_load = false; |
Ilan Tayari | ffdb521 | 2017-08-01 12:49:08 +0300 | [diff] [blame] | 442 | goto retry; |
| 443 | } |
| 444 | |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 445 | return type; |
| 446 | } |
| 447 | |
| 448 | static void xfrm_put_type_offload(const struct xfrm_type_offload *type) |
| 449 | { |
| 450 | module_put(type->owner); |
| 451 | } |
| 452 | |
Florian Westphal | 4c145dc | 2019-03-29 21:16:31 +0100 | [diff] [blame] | 453 | static const struct xfrm_mode xfrm4_mode_map[XFRM_MODE_MAX] = { |
| 454 | [XFRM_MODE_BEET] = { |
| 455 | .encap = XFRM_MODE_BEET, |
| 456 | .flags = XFRM_MODE_FLAG_TUNNEL, |
| 457 | .family = AF_INET, |
| 458 | }, |
| 459 | [XFRM_MODE_TRANSPORT] = { |
| 460 | .encap = XFRM_MODE_TRANSPORT, |
| 461 | .family = AF_INET, |
| 462 | }, |
| 463 | [XFRM_MODE_TUNNEL] = { |
| 464 | .encap = XFRM_MODE_TUNNEL, |
| 465 | .flags = XFRM_MODE_FLAG_TUNNEL, |
| 466 | .family = AF_INET, |
| 467 | }, |
| 468 | }; |
| 469 | |
| 470 | static const struct xfrm_mode xfrm6_mode_map[XFRM_MODE_MAX] = { |
| 471 | [XFRM_MODE_BEET] = { |
| 472 | .encap = XFRM_MODE_BEET, |
| 473 | .flags = XFRM_MODE_FLAG_TUNNEL, |
| 474 | .family = AF_INET6, |
| 475 | }, |
| 476 | [XFRM_MODE_ROUTEOPTIMIZATION] = { |
| 477 | .encap = XFRM_MODE_ROUTEOPTIMIZATION, |
| 478 | .family = AF_INET6, |
| 479 | }, |
| 480 | [XFRM_MODE_TRANSPORT] = { |
| 481 | .encap = XFRM_MODE_TRANSPORT, |
| 482 | .family = AF_INET6, |
| 483 | }, |
| 484 | [XFRM_MODE_TUNNEL] = { |
| 485 | .encap = XFRM_MODE_TUNNEL, |
| 486 | .flags = XFRM_MODE_FLAG_TUNNEL, |
| 487 | .family = AF_INET6, |
| 488 | }, |
| 489 | }; |
| 490 | |
| 491 | static const struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family) |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 492 | { |
Florian Westphal | 4c145dc | 2019-03-29 21:16:31 +0100 | [diff] [blame] | 493 | const struct xfrm_mode *mode; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 494 | |
| 495 | if (unlikely(encap >= XFRM_MODE_MAX)) |
| 496 | return NULL; |
| 497 | |
Florian Westphal | 4c145dc | 2019-03-29 21:16:31 +0100 | [diff] [blame] | 498 | switch (family) { |
| 499 | case AF_INET: |
| 500 | mode = &xfrm4_mode_map[encap]; |
| 501 | if (mode->family == family) |
| 502 | return mode; |
| 503 | break; |
| 504 | case AF_INET6: |
| 505 | mode = &xfrm6_mode_map[encap]; |
| 506 | if (mode->family == family) |
| 507 | return mode; |
| 508 | break; |
| 509 | default: |
| 510 | break; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 511 | } |
| 512 | |
Florian Westphal | 4c145dc | 2019-03-29 21:16:31 +0100 | [diff] [blame] | 513 | return NULL; |
Herbert Xu | aa5d62c | 2007-10-17 21:31:12 -0700 | [diff] [blame] | 514 | } |
| 515 | |
Mathias Krause | 4a135e5 | 2018-11-21 21:09:23 +0100 | [diff] [blame] | 516 | void xfrm_state_free(struct xfrm_state *x) |
| 517 | { |
| 518 | kmem_cache_free(xfrm_state_cache, x); |
| 519 | } |
| 520 | EXPORT_SYMBOL(xfrm_state_free); |
| 521 | |
Cong Wang | f75a280 | 2019-01-31 13:05:49 -0800 | [diff] [blame] | 522 | static void ___xfrm_state_destroy(struct xfrm_state *x) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 523 | { |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 524 | hrtimer_cancel(&x->mtimer); |
David S. Miller | a47f0ce | 2006-08-24 03:54:22 -0700 | [diff] [blame] | 525 | del_timer_sync(&x->rtimer); |
Ilan Tayari | b588479 | 2016-09-18 07:42:53 +0000 | [diff] [blame] | 526 | kfree(x->aead); |
Jesper Juhl | a51482b | 2005-11-08 09:41:34 -0800 | [diff] [blame] | 527 | kfree(x->aalg); |
| 528 | kfree(x->ealg); |
| 529 | kfree(x->calg); |
| 530 | kfree(x->encap); |
Noriaki TAKAMIYA | 060f02a | 2006-08-23 18:18:55 -0700 | [diff] [blame] | 531 | kfree(x->coaddr); |
Steffen Klassert | d8647b7 | 2011-03-08 00:10:27 +0000 | [diff] [blame] | 532 | kfree(x->replay_esn); |
| 533 | kfree(x->preplay_esn); |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 534 | if (x->type_offload) |
| 535 | xfrm_put_type_offload(x->type_offload); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 536 | if (x->type) { |
| 537 | x->type->destructor(x); |
| 538 | xfrm_put_type(x->type); |
| 539 | } |
Steffen Klassert | 86c6739 | 2019-11-06 08:13:49 +0100 | [diff] [blame] | 540 | if (x->xfrag.page) |
| 541 | put_page(x->xfrag.page); |
Steffen Klassert | d77e38e | 2017-04-14 10:06:10 +0200 | [diff] [blame] | 542 | xfrm_dev_state_free(x); |
Trent Jaeger | df71837 | 2005-12-13 23:12:27 -0800 | [diff] [blame] | 543 | security_xfrm_state_free(x); |
Mathias Krause | 4a135e5 | 2018-11-21 21:09:23 +0100 | [diff] [blame] | 544 | xfrm_state_free(x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 545 | } |
| 546 | |
Alexey Dobriyan | c783714 | 2008-11-25 17:20:36 -0800 | [diff] [blame] | 547 | static void xfrm_state_gc_task(struct work_struct *work) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 548 | { |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 549 | struct xfrm_state *x; |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 550 | struct hlist_node *tmp; |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 551 | struct hlist_head gc_list; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 552 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 553 | spin_lock_bh(&xfrm_state_gc_lock); |
Florian Westphal | 35db57bb | 2016-08-23 16:00:12 +0200 | [diff] [blame] | 554 | hlist_move_list(&xfrm_state_gc_list, &gc_list); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 555 | spin_unlock_bh(&xfrm_state_gc_lock); |
| 556 | |
Florian Westphal | df7274e | 2016-08-09 12:16:06 +0200 | [diff] [blame] | 557 | synchronize_rcu(); |
| 558 | |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 559 | hlist_for_each_entry_safe(x, tmp, &gc_list, gclist) |
Cong Wang | f75a280 | 2019-01-31 13:05:49 -0800 | [diff] [blame] | 560 | ___xfrm_state_destroy(x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 561 | } |
| 562 | |
Weilong Chen | 3e94c2d | 2013-12-24 09:43:47 +0800 | [diff] [blame] | 563 | static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 564 | { |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 565 | struct xfrm_state *x = container_of(me, struct xfrm_state, mtimer); |
| 566 | enum hrtimer_restart ret = HRTIMER_NORESTART; |
Arnd Bergmann | 386c568 | 2018-07-11 12:19:13 +0200 | [diff] [blame] | 567 | time64_t now = ktime_get_real_seconds(); |
| 568 | time64_t next = TIME64_MAX; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 569 | int warn = 0; |
Joy Latten | 161a09e | 2006-11-27 13:11:54 -0600 | [diff] [blame] | 570 | int err = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 571 | |
| 572 | spin_lock(&x->lock); |
Leon Romanovsky | f3da86d | 2022-12-02 20:41:33 +0200 | [diff] [blame] | 573 | xfrm_dev_state_update_curlft(x); |
| 574 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 575 | if (x->km.state == XFRM_STATE_DEAD) |
| 576 | goto out; |
| 577 | if (x->km.state == XFRM_STATE_EXPIRED) |
| 578 | goto expired; |
| 579 | if (x->lft.hard_add_expires_seconds) { |
| 580 | long tmo = x->lft.hard_add_expires_seconds + |
| 581 | x->curlft.add_time - now; |
Fan Du | e3c0d04 | 2012-07-30 21:43:54 +0000 | [diff] [blame] | 582 | if (tmo <= 0) { |
| 583 | if (x->xflags & XFRM_SOFT_EXPIRE) { |
| 584 | /* enter hard expire without soft expire first?! |
| 585 | * setting a new date could trigger this. |
Alexander Alemayhu | 1365e547c | 2017-01-03 17:13:20 +0100 | [diff] [blame] | 586 | * workaround: fix x->curflt.add_time by below: |
Fan Du | e3c0d04 | 2012-07-30 21:43:54 +0000 | [diff] [blame] | 587 | */ |
| 588 | x->curlft.add_time = now - x->saved_tmo - 1; |
| 589 | tmo = x->lft.hard_add_expires_seconds - x->saved_tmo; |
| 590 | } else |
| 591 | goto expired; |
| 592 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 593 | if (tmo < next) |
| 594 | next = tmo; |
| 595 | } |
| 596 | if (x->lft.hard_use_expires_seconds) { |
| 597 | long tmo = x->lft.hard_use_expires_seconds + |
| 598 | (x->curlft.use_time ? : now) - now; |
| 599 | if (tmo <= 0) |
| 600 | goto expired; |
| 601 | if (tmo < next) |
| 602 | next = tmo; |
| 603 | } |
| 604 | if (x->km.dying) |
| 605 | goto resched; |
| 606 | if (x->lft.soft_add_expires_seconds) { |
| 607 | long tmo = x->lft.soft_add_expires_seconds + |
| 608 | x->curlft.add_time - now; |
Fan Du | e3c0d04 | 2012-07-30 21:43:54 +0000 | [diff] [blame] | 609 | if (tmo <= 0) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 610 | warn = 1; |
Fan Du | e3c0d04 | 2012-07-30 21:43:54 +0000 | [diff] [blame] | 611 | x->xflags &= ~XFRM_SOFT_EXPIRE; |
| 612 | } else if (tmo < next) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 613 | next = tmo; |
Fan Du | e3c0d04 | 2012-07-30 21:43:54 +0000 | [diff] [blame] | 614 | x->xflags |= XFRM_SOFT_EXPIRE; |
| 615 | x->saved_tmo = tmo; |
| 616 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 617 | } |
| 618 | if (x->lft.soft_use_expires_seconds) { |
| 619 | long tmo = x->lft.soft_use_expires_seconds + |
| 620 | (x->curlft.use_time ? : now) - now; |
| 621 | if (tmo <= 0) |
| 622 | warn = 1; |
| 623 | else if (tmo < next) |
| 624 | next = tmo; |
| 625 | } |
| 626 | |
Herbert Xu | 4666faa | 2005-06-18 22:43:22 -0700 | [diff] [blame] | 627 | x->km.dying = warn; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 628 | if (warn) |
Jamal Hadi Salim | 53bc6b4d | 2006-03-20 19:17:03 -0800 | [diff] [blame] | 629 | km_state_expired(x, 0, 0); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 630 | resched: |
Arnd Bergmann | 386c568 | 2018-07-11 12:19:13 +0200 | [diff] [blame] | 631 | if (next != TIME64_MAX) { |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 632 | hrtimer_forward_now(&x->mtimer, ktime_set(next, 0)); |
| 633 | ret = HRTIMER_RESTART; |
Yury Polyanskiy | 9e0d57f | 2009-11-08 20:58:41 -0800 | [diff] [blame] | 634 | } |
David S. Miller | a47f0ce | 2006-08-24 03:54:22 -0700 | [diff] [blame] | 635 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 636 | goto out; |
| 637 | |
| 638 | expired: |
Steffen Klassert | 5b8ef34 | 2013-08-27 13:43:30 +0200 | [diff] [blame] | 639 | if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 640 | x->km.state = XFRM_STATE_EXPIRED; |
Joy Latten | 161a09e | 2006-11-27 13:11:54 -0600 | [diff] [blame] | 641 | |
| 642 | err = __xfrm_state_delete(x); |
Nicolas Dichtel | 0806ae4 | 2013-08-23 15:46:08 +0200 | [diff] [blame] | 643 | if (!err) |
Jamal Hadi Salim | 53bc6b4d | 2006-03-20 19:17:03 -0800 | [diff] [blame] | 644 | km_state_expired(x, 1, 0); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 645 | |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 646 | xfrm_audit_state_delete(x, err ? 0 : 1, true); |
Joy Latten | 161a09e | 2006-11-27 13:11:54 -0600 | [diff] [blame] | 647 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 648 | out: |
| 649 | spin_unlock(&x->lock); |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 650 | return ret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 651 | } |
| 652 | |
Kees Cook | e99e88a | 2017-10-16 14:43:17 -0700 | [diff] [blame] | 653 | static void xfrm_replay_timer_handler(struct timer_list *t); |
David S. Miller | 0ac8475 | 2006-03-20 19:18:23 -0800 | [diff] [blame] | 654 | |
Alexey Dobriyan | 673c09be | 2008-11-25 17:15:16 -0800 | [diff] [blame] | 655 | struct xfrm_state *xfrm_state_alloc(struct net *net) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 656 | { |
| 657 | struct xfrm_state *x; |
| 658 | |
Huang Zijiang | a4c278d1 | 2020-02-12 17:54:36 +0800 | [diff] [blame] | 659 | x = kmem_cache_zalloc(xfrm_state_cache, GFP_ATOMIC); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 660 | |
| 661 | if (x) { |
Alexey Dobriyan | 673c09be | 2008-11-25 17:15:16 -0800 | [diff] [blame] | 662 | write_pnet(&x->xs_net, net); |
Reshetova, Elena | 88755e9c | 2017-07-04 15:53:21 +0300 | [diff] [blame] | 663 | refcount_set(&x->refcnt, 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 664 | atomic_set(&x->tunnel_users, 0); |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 665 | INIT_LIST_HEAD(&x->km.all); |
David S. Miller | 8f126e3 | 2006-08-24 02:45:07 -0700 | [diff] [blame] | 666 | INIT_HLIST_NODE(&x->bydst); |
| 667 | INIT_HLIST_NODE(&x->bysrc); |
| 668 | INIT_HLIST_NODE(&x->byspi); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 669 | INIT_HLIST_NODE(&x->byseq); |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 670 | hrtimer_init(&x->mtimer, CLOCK_BOOTTIME, HRTIMER_MODE_ABS_SOFT); |
| 671 | x->mtimer.function = xfrm_timer_handler; |
Kees Cook | e99e88a | 2017-10-16 14:43:17 -0700 | [diff] [blame] | 672 | timer_setup(&x->rtimer, xfrm_replay_timer_handler, 0); |
Arnd Bergmann | 386c568 | 2018-07-11 12:19:13 +0200 | [diff] [blame] | 673 | x->curlft.add_time = ktime_get_real_seconds(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 674 | x->lft.soft_byte_limit = XFRM_INF; |
| 675 | x->lft.soft_packet_limit = XFRM_INF; |
| 676 | x->lft.hard_byte_limit = XFRM_INF; |
| 677 | x->lft.hard_packet_limit = XFRM_INF; |
Jamal Hadi Salim | f8cd548 | 2006-03-20 19:15:11 -0800 | [diff] [blame] | 678 | x->replay_maxage = 0; |
| 679 | x->replay_maxdiff = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 680 | spin_lock_init(&x->lock); |
| 681 | } |
| 682 | return x; |
| 683 | } |
| 684 | EXPORT_SYMBOL(xfrm_state_alloc); |
| 685 | |
Cong Wang | f75a280 | 2019-01-31 13:05:49 -0800 | [diff] [blame] | 686 | void __xfrm_state_destroy(struct xfrm_state *x, bool sync) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 687 | { |
Ilpo Järvinen | 547b792 | 2008-07-25 21:43:18 -0700 | [diff] [blame] | 688 | WARN_ON(x->km.state != XFRM_STATE_DEAD); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 689 | |
Cong Wang | f75a280 | 2019-01-31 13:05:49 -0800 | [diff] [blame] | 690 | if (sync) { |
| 691 | synchronize_rcu(); |
| 692 | ___xfrm_state_destroy(x); |
| 693 | } else { |
| 694 | spin_lock_bh(&xfrm_state_gc_lock); |
| 695 | hlist_add_head(&x->gclist, &xfrm_state_gc_list); |
| 696 | spin_unlock_bh(&xfrm_state_gc_lock); |
| 697 | schedule_work(&xfrm_state_gc_work); |
| 698 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 699 | } |
| 700 | EXPORT_SYMBOL(__xfrm_state_destroy); |
| 701 | |
Jamal Hadi Salim | 53bc6b4d | 2006-03-20 19:17:03 -0800 | [diff] [blame] | 702 | int __xfrm_state_delete(struct xfrm_state *x) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 703 | { |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 704 | struct net *net = xs_net(x); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 705 | int err = -ESRCH; |
| 706 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 707 | if (x->km.state != XFRM_STATE_DEAD) { |
| 708 | x->km.state = XFRM_STATE_DEAD; |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 709 | spin_lock(&net->xfrm.xfrm_state_lock); |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 710 | list_del(&x->km.all); |
Florian Westphal | ae3fb6d | 2016-08-09 12:16:04 +0200 | [diff] [blame] | 711 | hlist_del_rcu(&x->bydst); |
| 712 | hlist_del_rcu(&x->bysrc); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 713 | if (x->km.seq) |
| 714 | hlist_del_rcu(&x->byseq); |
David S. Miller | a47f0ce | 2006-08-24 03:54:22 -0700 | [diff] [blame] | 715 | if (x->id.spi) |
Florian Westphal | ae3fb6d | 2016-08-09 12:16:04 +0200 | [diff] [blame] | 716 | hlist_del_rcu(&x->byspi); |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 717 | net->xfrm.state_num--; |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 718 | spin_unlock(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 719 | |
Sabrina Dubroca | e27cca9 | 2019-11-25 14:49:02 +0100 | [diff] [blame] | 720 | if (x->encap_sk) |
| 721 | sock_put(rcu_dereference_raw(x->encap_sk)); |
| 722 | |
Steffen Klassert | d77e38e | 2017-04-14 10:06:10 +0200 | [diff] [blame] | 723 | xfrm_dev_state_delete(x); |
| 724 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 725 | /* All xfrm_state objects are created by xfrm_state_alloc. |
| 726 | * The xfrm_state_alloc call gives a reference, and that |
| 727 | * is what we are dropping here. |
| 728 | */ |
Patrick McHardy | 5dba479 | 2007-11-27 11:10:07 +0800 | [diff] [blame] | 729 | xfrm_state_put(x); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 730 | err = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 731 | } |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 732 | |
| 733 | return err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 734 | } |
Jamal Hadi Salim | 53bc6b4d | 2006-03-20 19:17:03 -0800 | [diff] [blame] | 735 | EXPORT_SYMBOL(__xfrm_state_delete); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 736 | |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 737 | int xfrm_state_delete(struct xfrm_state *x) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 738 | { |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 739 | int err; |
| 740 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 741 | spin_lock_bh(&x->lock); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 742 | err = __xfrm_state_delete(x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 743 | spin_unlock_bh(&x->lock); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 744 | |
| 745 | return err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 746 | } |
| 747 | EXPORT_SYMBOL(xfrm_state_delete); |
| 748 | |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 749 | #ifdef CONFIG_SECURITY_NETWORK_XFRM |
| 750 | static inline int |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 751 | xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 752 | { |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 753 | int i, err = 0; |
| 754 | |
Alexey Dobriyan | 0e60245 | 2008-11-25 17:30:18 -0800 | [diff] [blame] | 755 | for (i = 0; i <= net->xfrm.state_hmask; i++) { |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 756 | struct xfrm_state *x; |
| 757 | |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 758 | hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 759 | if (xfrm_id_proto_match(x->id.proto, proto) && |
| 760 | (err = security_xfrm_state_delete(x)) != 0) { |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 761 | xfrm_audit_state_delete(x, 0, task_valid); |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 762 | return err; |
| 763 | } |
| 764 | } |
| 765 | } |
| 766 | |
| 767 | return err; |
| 768 | } |
Steffen Klassert | d77e38e | 2017-04-14 10:06:10 +0200 | [diff] [blame] | 769 | |
| 770 | static inline int |
| 771 | xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid) |
| 772 | { |
| 773 | int i, err = 0; |
| 774 | |
| 775 | for (i = 0; i <= net->xfrm.state_hmask; i++) { |
| 776 | struct xfrm_state *x; |
Leon Romanovsky | 87e0a94 | 2022-05-05 13:06:40 +0300 | [diff] [blame] | 777 | struct xfrm_dev_offload *xso; |
Steffen Klassert | d77e38e | 2017-04-14 10:06:10 +0200 | [diff] [blame] | 778 | |
| 779 | hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { |
| 780 | xso = &x->xso; |
| 781 | |
| 782 | if (xso->dev == dev && |
| 783 | (err = security_xfrm_state_delete(x)) != 0) { |
| 784 | xfrm_audit_state_delete(x, 0, task_valid); |
| 785 | return err; |
| 786 | } |
| 787 | } |
| 788 | } |
| 789 | |
| 790 | return err; |
| 791 | } |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 792 | #else |
| 793 | static inline int |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 794 | xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid) |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 795 | { |
| 796 | return 0; |
| 797 | } |
Steffen Klassert | d77e38e | 2017-04-14 10:06:10 +0200 | [diff] [blame] | 798 | |
| 799 | static inline int |
| 800 | xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid) |
| 801 | { |
| 802 | return 0; |
| 803 | } |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 804 | #endif |
| 805 | |
Cong Wang | f75a280 | 2019-01-31 13:05:49 -0800 | [diff] [blame] | 806 | int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync) |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 807 | { |
Jamal Hadi Salim | 9e64cc9 | 2010-02-19 02:00:41 +0000 | [diff] [blame] | 808 | int i, err = 0, cnt = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 809 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 810 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 811 | err = xfrm_state_flush_secctx_check(net, proto, task_valid); |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 812 | if (err) |
| 813 | goto out; |
| 814 | |
Jamal Hadi Salim | 9e64cc9 | 2010-02-19 02:00:41 +0000 | [diff] [blame] | 815 | err = -ESRCH; |
Alexey Dobriyan | 0e60245 | 2008-11-25 17:30:18 -0800 | [diff] [blame] | 816 | for (i = 0; i <= net->xfrm.state_hmask; i++) { |
David S. Miller | 8f126e3 | 2006-08-24 02:45:07 -0700 | [diff] [blame] | 817 | struct xfrm_state *x; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 818 | restart: |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 819 | hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 820 | if (!xfrm_state_kern(x) && |
Masahide NAKAMURA | 5794708 | 2006-09-22 15:06:24 -0700 | [diff] [blame] | 821 | xfrm_id_proto_match(x->id.proto, proto)) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 822 | xfrm_state_hold(x); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 823 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 824 | |
Joy Latten | 161a09e | 2006-11-27 13:11:54 -0600 | [diff] [blame] | 825 | err = xfrm_state_delete(x); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 826 | xfrm_audit_state_delete(x, err ? 0 : 1, |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 827 | task_valid); |
Cong Wang | f75a280 | 2019-01-31 13:05:49 -0800 | [diff] [blame] | 828 | if (sync) |
| 829 | xfrm_state_put_sync(x); |
| 830 | else |
| 831 | xfrm_state_put(x); |
Jamal Hadi Salim | 9e64cc9 | 2010-02-19 02:00:41 +0000 | [diff] [blame] | 832 | if (!err) |
| 833 | cnt++; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 834 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 835 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 836 | goto restart; |
| 837 | } |
| 838 | } |
| 839 | } |
Artem Savkov | dd269db | 2017-09-27 14:25:37 +0200 | [diff] [blame] | 840 | out: |
| 841 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Florian Westphal | e4db5b6 | 2018-06-25 17:26:02 +0200 | [diff] [blame] | 842 | if (cnt) |
Jamal Hadi Salim | 9e64cc9 | 2010-02-19 02:00:41 +0000 | [diff] [blame] | 843 | err = 0; |
Florian Westphal | e4db5b6 | 2018-06-25 17:26:02 +0200 | [diff] [blame] | 844 | |
Joy Latten | 4aa2e62 | 2007-06-04 19:05:57 -0400 | [diff] [blame] | 845 | return err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 846 | } |
| 847 | EXPORT_SYMBOL(xfrm_state_flush); |
| 848 | |
Steffen Klassert | d77e38e | 2017-04-14 10:06:10 +0200 | [diff] [blame] | 849 | int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid) |
| 850 | { |
| 851 | int i, err = 0, cnt = 0; |
| 852 | |
| 853 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
| 854 | err = xfrm_dev_state_flush_secctx_check(net, dev, task_valid); |
| 855 | if (err) |
| 856 | goto out; |
| 857 | |
| 858 | err = -ESRCH; |
| 859 | for (i = 0; i <= net->xfrm.state_hmask; i++) { |
| 860 | struct xfrm_state *x; |
Leon Romanovsky | 87e0a94 | 2022-05-05 13:06:40 +0300 | [diff] [blame] | 861 | struct xfrm_dev_offload *xso; |
Steffen Klassert | d77e38e | 2017-04-14 10:06:10 +0200 | [diff] [blame] | 862 | restart: |
| 863 | hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { |
| 864 | xso = &x->xso; |
| 865 | |
| 866 | if (!xfrm_state_kern(x) && xso->dev == dev) { |
| 867 | xfrm_state_hold(x); |
| 868 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
| 869 | |
| 870 | err = xfrm_state_delete(x); |
| 871 | xfrm_audit_state_delete(x, err ? 0 : 1, |
| 872 | task_valid); |
| 873 | xfrm_state_put(x); |
| 874 | if (!err) |
| 875 | cnt++; |
| 876 | |
| 877 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
| 878 | goto restart; |
| 879 | } |
| 880 | } |
| 881 | } |
| 882 | if (cnt) |
| 883 | err = 0; |
| 884 | |
| 885 | out: |
| 886 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
| 887 | return err; |
| 888 | } |
| 889 | EXPORT_SYMBOL(xfrm_dev_state_flush); |
| 890 | |
Alexey Dobriyan | e071041 | 2010-01-23 13:37:10 +0000 | [diff] [blame] | 891 | void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si) |
Jamal Hadi Salim | 28d8909 | 2007-04-26 00:10:29 -0700 | [diff] [blame] | 892 | { |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 893 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Alexey Dobriyan | e071041 | 2010-01-23 13:37:10 +0000 | [diff] [blame] | 894 | si->sadcnt = net->xfrm.state_num; |
Benjamin Poirier | ca92e17 | 2018-11-05 17:00:53 +0900 | [diff] [blame] | 895 | si->sadhcnt = net->xfrm.state_hmask + 1; |
Jamal Hadi Salim | 28d8909 | 2007-04-26 00:10:29 -0700 | [diff] [blame] | 896 | si->sadhmcnt = xfrm_state_hashmax; |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 897 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Jamal Hadi Salim | 28d8909 | 2007-04-26 00:10:29 -0700 | [diff] [blame] | 898 | } |
| 899 | EXPORT_SYMBOL(xfrm_sad_getinfo); |
| 900 | |
Florian Westphal | 711059b | 2017-01-09 14:20:48 +0100 | [diff] [blame] | 901 | static void |
Florian Westphal | bac9593 | 2019-05-03 17:46:14 +0200 | [diff] [blame] | 902 | __xfrm4_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl) |
| 903 | { |
| 904 | const struct flowi4 *fl4 = &fl->u.ip4; |
| 905 | |
| 906 | sel->daddr.a4 = fl4->daddr; |
| 907 | sel->saddr.a4 = fl4->saddr; |
| 908 | sel->dport = xfrm_flowi_dport(fl, &fl4->uli); |
| 909 | sel->dport_mask = htons(0xffff); |
| 910 | sel->sport = xfrm_flowi_sport(fl, &fl4->uli); |
| 911 | sel->sport_mask = htons(0xffff); |
| 912 | sel->family = AF_INET; |
| 913 | sel->prefixlen_d = 32; |
| 914 | sel->prefixlen_s = 32; |
| 915 | sel->proto = fl4->flowi4_proto; |
| 916 | sel->ifindex = fl4->flowi4_oif; |
| 917 | } |
| 918 | |
| 919 | static void |
| 920 | __xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl) |
| 921 | { |
| 922 | const struct flowi6 *fl6 = &fl->u.ip6; |
| 923 | |
| 924 | /* Initialize temporary selector matching only to current session. */ |
| 925 | *(struct in6_addr *)&sel->daddr = fl6->daddr; |
| 926 | *(struct in6_addr *)&sel->saddr = fl6->saddr; |
| 927 | sel->dport = xfrm_flowi_dport(fl, &fl6->uli); |
| 928 | sel->dport_mask = htons(0xffff); |
| 929 | sel->sport = xfrm_flowi_sport(fl, &fl6->uli); |
| 930 | sel->sport_mask = htons(0xffff); |
| 931 | sel->family = AF_INET6; |
| 932 | sel->prefixlen_d = 128; |
| 933 | sel->prefixlen_s = 128; |
| 934 | sel->proto = fl6->flowi6_proto; |
| 935 | sel->ifindex = fl6->flowi6_oif; |
| 936 | } |
| 937 | |
| 938 | static void |
David S. Miller | 1a89859 | 2011-02-22 18:22:34 -0800 | [diff] [blame] | 939 | xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl, |
David S. Miller | 0468601 | 2011-02-24 01:50:12 -0500 | [diff] [blame] | 940 | const struct xfrm_tmpl *tmpl, |
David S. Miller | 33765d0 | 2011-02-24 01:55:45 -0500 | [diff] [blame] | 941 | const xfrm_address_t *daddr, const xfrm_address_t *saddr, |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 942 | unsigned short family) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 943 | { |
Florian Westphal | bac9593 | 2019-05-03 17:46:14 +0200 | [diff] [blame] | 944 | switch (family) { |
| 945 | case AF_INET: |
| 946 | __xfrm4_init_tempsel(&x->sel, fl); |
| 947 | break; |
| 948 | case AF_INET6: |
| 949 | __xfrm6_init_tempsel(&x->sel, fl); |
| 950 | break; |
| 951 | } |
| 952 | |
Florian Westphal | 5c1b9ab | 2019-05-03 17:46:15 +0200 | [diff] [blame] | 953 | x->id = tmpl->id; |
Florian Westphal | bac9593 | 2019-05-03 17:46:14 +0200 | [diff] [blame] | 954 | |
Florian Westphal | 5c1b9ab | 2019-05-03 17:46:15 +0200 | [diff] [blame] | 955 | switch (tmpl->encap_family) { |
| 956 | case AF_INET: |
| 957 | if (x->id.daddr.a4 == 0) |
| 958 | x->id.daddr.a4 = daddr->a4; |
| 959 | x->props.saddr = tmpl->saddr; |
| 960 | if (x->props.saddr.a4 == 0) |
| 961 | x->props.saddr.a4 = saddr->a4; |
| 962 | break; |
| 963 | case AF_INET6: |
| 964 | if (ipv6_addr_any((struct in6_addr *)&x->id.daddr)) |
| 965 | memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr)); |
| 966 | memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr)); |
| 967 | if (ipv6_addr_any((struct in6_addr *)&x->props.saddr)) |
| 968 | memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr)); |
| 969 | break; |
| 970 | } |
Florian Westphal | 3819a35 | 2017-01-13 14:55:14 +0100 | [diff] [blame] | 971 | |
Florian Westphal | 5c1b9ab | 2019-05-03 17:46:15 +0200 | [diff] [blame] | 972 | x->props.mode = tmpl->mode; |
| 973 | x->props.reqid = tmpl->reqid; |
| 974 | x->props.family = tmpl->encap_family; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 975 | } |
| 976 | |
Leon Romanovsky | f8a70af | 2022-12-02 20:41:30 +0200 | [diff] [blame] | 977 | static struct xfrm_state *__xfrm_state_lookup_all(struct net *net, u32 mark, |
| 978 | const xfrm_address_t *daddr, |
| 979 | __be32 spi, u8 proto, |
| 980 | unsigned short family, |
| 981 | struct xfrm_dev_offload *xdo) |
| 982 | { |
| 983 | unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); |
| 984 | struct xfrm_state *x; |
| 985 | |
| 986 | hlist_for_each_entry_rcu(x, net->xfrm.state_byspi + h, byspi) { |
| 987 | #ifdef CONFIG_XFRM_OFFLOAD |
| 988 | if (xdo->type == XFRM_DEV_OFFLOAD_PACKET) { |
| 989 | if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) |
| 990 | /* HW states are in the head of list, there is |
| 991 | * no need to iterate further. |
| 992 | */ |
| 993 | break; |
| 994 | |
| 995 | /* Packet offload: both policy and SA should |
| 996 | * have same device. |
| 997 | */ |
| 998 | if (xdo->dev != x->xso.dev) |
| 999 | continue; |
| 1000 | } else if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) |
| 1001 | /* Skip HW policy for SW lookups */ |
| 1002 | continue; |
| 1003 | #endif |
| 1004 | if (x->props.family != family || |
| 1005 | x->id.spi != spi || |
| 1006 | x->id.proto != proto || |
| 1007 | !xfrm_addr_equal(&x->id.daddr, daddr, family)) |
| 1008 | continue; |
| 1009 | |
| 1010 | if ((mark & x->mark.m) != x->mark.v) |
| 1011 | continue; |
| 1012 | if (!xfrm_state_hold_rcu(x)) |
| 1013 | continue; |
| 1014 | return x; |
| 1015 | } |
| 1016 | |
| 1017 | return NULL; |
| 1018 | } |
| 1019 | |
David S. Miller | 9aa6008 | 2011-02-24 01:51:36 -0500 | [diff] [blame] | 1020 | static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, |
| 1021 | const xfrm_address_t *daddr, |
| 1022 | __be32 spi, u8 proto, |
| 1023 | unsigned short family) |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1024 | { |
Alexey Dobriyan | 221df1e | 2008-11-25 17:30:50 -0800 | [diff] [blame] | 1025 | unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1026 | struct xfrm_state *x; |
| 1027 | |
Florian Westphal | ae3fb6d | 2016-08-09 12:16:04 +0200 | [diff] [blame] | 1028 | hlist_for_each_entry_rcu(x, net->xfrm.state_byspi + h, byspi) { |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1029 | if (x->props.family != family || |
| 1030 | x->id.spi != spi || |
Wei Yongjun | 1802571 | 2009-06-28 18:42:53 +0000 | [diff] [blame] | 1031 | x->id.proto != proto || |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1032 | !xfrm_addr_equal(&x->id.daddr, daddr, family)) |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1033 | continue; |
| 1034 | |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1035 | if ((mark & x->mark.m) != x->mark.v) |
| 1036 | continue; |
Florian Westphal | 02efdff | 2016-08-09 12:16:05 +0200 | [diff] [blame] | 1037 | if (!xfrm_state_hold_rcu(x)) |
| 1038 | continue; |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1039 | return x; |
| 1040 | } |
| 1041 | |
| 1042 | return NULL; |
| 1043 | } |
| 1044 | |
David S. Miller | 9aa6008 | 2011-02-24 01:51:36 -0500 | [diff] [blame] | 1045 | static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, |
| 1046 | const xfrm_address_t *daddr, |
| 1047 | const xfrm_address_t *saddr, |
| 1048 | u8 proto, unsigned short family) |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1049 | { |
Alexey Dobriyan | 221df1e | 2008-11-25 17:30:50 -0800 | [diff] [blame] | 1050 | unsigned int h = xfrm_src_hash(net, daddr, saddr, family); |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1051 | struct xfrm_state *x; |
| 1052 | |
Florian Westphal | ae3fb6d | 2016-08-09 12:16:04 +0200 | [diff] [blame] | 1053 | hlist_for_each_entry_rcu(x, net->xfrm.state_bysrc + h, bysrc) { |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1054 | if (x->props.family != family || |
Wei Yongjun | 1802571 | 2009-06-28 18:42:53 +0000 | [diff] [blame] | 1055 | x->id.proto != proto || |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1056 | !xfrm_addr_equal(&x->id.daddr, daddr, family) || |
| 1057 | !xfrm_addr_equal(&x->props.saddr, saddr, family)) |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1058 | continue; |
| 1059 | |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1060 | if ((mark & x->mark.m) != x->mark.v) |
| 1061 | continue; |
Florian Westphal | 02efdff | 2016-08-09 12:16:05 +0200 | [diff] [blame] | 1062 | if (!xfrm_state_hold_rcu(x)) |
| 1063 | continue; |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1064 | return x; |
| 1065 | } |
| 1066 | |
| 1067 | return NULL; |
| 1068 | } |
| 1069 | |
| 1070 | static inline struct xfrm_state * |
| 1071 | __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) |
| 1072 | { |
Alexey Dobriyan | 221df1e | 2008-11-25 17:30:50 -0800 | [diff] [blame] | 1073 | struct net *net = xs_net(x); |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1074 | u32 mark = x->mark.v & x->mark.m; |
Alexey Dobriyan | 221df1e | 2008-11-25 17:30:50 -0800 | [diff] [blame] | 1075 | |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1076 | if (use_spi) |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1077 | return __xfrm_state_lookup(net, mark, &x->id.daddr, |
| 1078 | x->id.spi, x->id.proto, family); |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1079 | else |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1080 | return __xfrm_state_lookup_byaddr(net, mark, |
| 1081 | &x->id.daddr, |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1082 | &x->props.saddr, |
| 1083 | x->id.proto, family); |
| 1084 | } |
| 1085 | |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1086 | static void xfrm_hash_grow_check(struct net *net, int have_hash_collision) |
Patrick McHardy | 2fab22f | 2006-10-24 15:34:00 -0700 | [diff] [blame] | 1087 | { |
| 1088 | if (have_hash_collision && |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1089 | (net->xfrm.state_hmask + 1) < xfrm_state_hashmax && |
| 1090 | net->xfrm.state_num > net->xfrm.state_hmask) |
| 1091 | schedule_work(&net->xfrm.state_hash_work); |
Patrick McHardy | 2fab22f | 2006-10-24 15:34:00 -0700 | [diff] [blame] | 1092 | } |
| 1093 | |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1094 | static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, |
David S. Miller | 4a08ab0 | 2011-02-22 18:21:31 -0800 | [diff] [blame] | 1095 | const struct flowi *fl, unsigned short family, |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1096 | struct xfrm_state **best, int *acq_in_progress, |
| 1097 | int *error) |
| 1098 | { |
| 1099 | /* Resolution logic: |
| 1100 | * 1. There is a valid state with matching selector. Done. |
| 1101 | * 2. Valid state with inappropriate selector. Skip. |
| 1102 | * |
| 1103 | * Entering area of "sysdeps". |
| 1104 | * |
| 1105 | * 3. If state is not valid, selector is temporary, it selects |
| 1106 | * only session which triggered previous resolution. Key |
| 1107 | * manager will do something to install a state with proper |
| 1108 | * selector. |
| 1109 | */ |
| 1110 | if (x->km.state == XFRM_STATE_VALID) { |
| 1111 | if ((x->sel.family && |
Herbert Xu | e94ee17 | 2020-09-25 14:42:56 +1000 | [diff] [blame] | 1112 | (x->sel.family != family || |
| 1113 | !xfrm_selector_match(&x->sel, fl, family))) || |
Paul Moore | 3df98d7 | 2020-09-27 22:38:26 -0400 | [diff] [blame] | 1114 | !security_xfrm_state_pol_flow_match(x, pol, |
| 1115 | &fl->u.__fl_common)) |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1116 | return; |
| 1117 | |
| 1118 | if (!*best || |
| 1119 | (*best)->km.dying > x->km.dying || |
| 1120 | ((*best)->km.dying == x->km.dying && |
| 1121 | (*best)->curlft.add_time < x->curlft.add_time)) |
| 1122 | *best = x; |
| 1123 | } else if (x->km.state == XFRM_STATE_ACQ) { |
| 1124 | *acq_in_progress = 1; |
| 1125 | } else if (x->km.state == XFRM_STATE_ERROR || |
| 1126 | x->km.state == XFRM_STATE_EXPIRED) { |
Herbert Xu | e94ee17 | 2020-09-25 14:42:56 +1000 | [diff] [blame] | 1127 | if ((!x->sel.family || |
| 1128 | (x->sel.family == family && |
| 1129 | xfrm_selector_match(&x->sel, fl, family))) && |
Paul Moore | 3df98d7 | 2020-09-27 22:38:26 -0400 | [diff] [blame] | 1130 | security_xfrm_state_pol_flow_match(x, pol, |
| 1131 | &fl->u.__fl_common)) |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1132 | *error = -ESRCH; |
| 1133 | } |
| 1134 | } |
| 1135 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1136 | struct xfrm_state * |
David S. Miller | 33765d0 | 2011-02-24 01:55:45 -0500 | [diff] [blame] | 1137 | xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, |
David S. Miller | b520e9f | 2011-02-22 18:24:19 -0800 | [diff] [blame] | 1138 | const struct flowi *fl, struct xfrm_tmpl *tmpl, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1139 | struct xfrm_policy *pol, int *err, |
Benedict Wong | bc56b33 | 2018-07-19 10:50:44 -0700 | [diff] [blame] | 1140 | unsigned short family, u32 if_id) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1141 | { |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1142 | static xfrm_address_t saddr_wildcard = { }; |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1143 | struct net *net = xp_net(pol); |
Nicolas Dichtel | 6a783c9 | 2009-04-27 02:58:59 -0700 | [diff] [blame] | 1144 | unsigned int h, h_wildcard; |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1145 | struct xfrm_state *x, *x0, *to_put; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1146 | int acquire_in_progress = 0; |
| 1147 | int error = 0; |
| 1148 | struct xfrm_state *best = NULL; |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1149 | u32 mark = pol->mark.v & pol->mark.m; |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1150 | unsigned short encap_family = tmpl->encap_family; |
Florian Westphal | b65e3d7 | 2016-08-09 12:16:07 +0200 | [diff] [blame] | 1151 | unsigned int sequence; |
Horia Geanta | 0f24558 | 2014-02-12 16:20:06 +0200 | [diff] [blame] | 1152 | struct km_event c; |
YOSHIFUJI Hideaki | a716c11 | 2007-02-09 23:25:29 +0900 | [diff] [blame] | 1153 | |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1154 | to_put = NULL; |
| 1155 | |
Ahmed S. Darwish | e88add1 | 2021-03-16 11:56:29 +0100 | [diff] [blame] | 1156 | sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation); |
Florian Westphal | b65e3d7 | 2016-08-09 12:16:07 +0200 | [diff] [blame] | 1157 | |
Florian Westphal | d737a58 | 2016-08-09 12:16:09 +0200 | [diff] [blame] | 1158 | rcu_read_lock(); |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1159 | h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); |
Florian Westphal | ae3fb6d | 2016-08-09 12:16:04 +0200 | [diff] [blame] | 1160 | hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { |
Leon Romanovsky | f8a70af | 2022-12-02 20:41:30 +0200 | [diff] [blame] | 1161 | #ifdef CONFIG_XFRM_OFFLOAD |
| 1162 | if (pol->xdo.type == XFRM_DEV_OFFLOAD_PACKET) { |
| 1163 | if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) |
| 1164 | /* HW states are in the head of list, there is |
| 1165 | * no need to iterate further. |
| 1166 | */ |
| 1167 | break; |
| 1168 | |
| 1169 | /* Packet offload: both policy and SA should |
| 1170 | * have same device. |
| 1171 | */ |
| 1172 | if (pol->xdo.dev != x->xso.dev) |
| 1173 | continue; |
| 1174 | } else if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) |
| 1175 | /* Skip HW policy for SW lookups */ |
| 1176 | continue; |
| 1177 | #endif |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1178 | if (x->props.family == encap_family && |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1179 | x->props.reqid == tmpl->reqid && |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1180 | (mark & x->mark.m) == x->mark.v && |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1181 | x->if_id == if_id && |
Masahide NAKAMURA | fbd9a5b | 2006-08-23 18:08:21 -0700 | [diff] [blame] | 1182 | !(x->props.flags & XFRM_STATE_WILDRECV) && |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1183 | xfrm_state_addr_check(x, daddr, saddr, encap_family) && |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1184 | tmpl->mode == x->props.mode && |
| 1185 | tmpl->id.proto == x->id.proto && |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1186 | (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) |
Herbert Xu | e94ee17 | 2020-09-25 14:42:56 +1000 | [diff] [blame] | 1187 | xfrm_state_look_at(pol, x, fl, family, |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1188 | &best, &acquire_in_progress, &error); |
| 1189 | } |
Fan Du | 6f11563 | 2013-09-23 17:18:25 +0800 | [diff] [blame] | 1190 | if (best || acquire_in_progress) |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1191 | goto found; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1192 | |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1193 | h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family); |
Florian Westphal | ae3fb6d | 2016-08-09 12:16:04 +0200 | [diff] [blame] | 1194 | hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h_wildcard, bydst) { |
Leon Romanovsky | f8a70af | 2022-12-02 20:41:30 +0200 | [diff] [blame] | 1195 | #ifdef CONFIG_XFRM_OFFLOAD |
| 1196 | if (pol->xdo.type == XFRM_DEV_OFFLOAD_PACKET) { |
| 1197 | if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) |
| 1198 | /* HW states are in the head of list, there is |
| 1199 | * no need to iterate further. |
| 1200 | */ |
| 1201 | break; |
| 1202 | |
| 1203 | /* Packet offload: both policy and SA should |
| 1204 | * have same device. |
| 1205 | */ |
| 1206 | if (pol->xdo.dev != x->xso.dev) |
| 1207 | continue; |
| 1208 | } else if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) |
| 1209 | /* Skip HW policy for SW lookups */ |
| 1210 | continue; |
| 1211 | #endif |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1212 | if (x->props.family == encap_family && |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1213 | x->props.reqid == tmpl->reqid && |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1214 | (mark & x->mark.m) == x->mark.v && |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1215 | x->if_id == if_id && |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1216 | !(x->props.flags & XFRM_STATE_WILDRECV) && |
Fan Du | f59bbdf | 2013-09-27 16:32:50 +0800 | [diff] [blame] | 1217 | xfrm_addr_equal(&x->id.daddr, daddr, encap_family) && |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1218 | tmpl->mode == x->props.mode && |
| 1219 | tmpl->id.proto == x->id.proto && |
| 1220 | (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) |
Herbert Xu | e94ee17 | 2020-09-25 14:42:56 +1000 | [diff] [blame] | 1221 | xfrm_state_look_at(pol, x, fl, family, |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1222 | &best, &acquire_in_progress, &error); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1223 | } |
| 1224 | |
David S. Miller | 08ec9af | 2009-03-13 14:22:40 -0700 | [diff] [blame] | 1225 | found: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1226 | x = best; |
| 1227 | if (!x && !error && !acquire_in_progress) { |
Patrick McHardy | 5c5d281 | 2005-04-21 20:12:32 -0700 | [diff] [blame] | 1228 | if (tmpl->id.spi && |
Leon Romanovsky | f8a70af | 2022-12-02 20:41:30 +0200 | [diff] [blame] | 1229 | (x0 = __xfrm_state_lookup_all(net, mark, daddr, |
| 1230 | tmpl->id.spi, tmpl->id.proto, |
| 1231 | encap_family, |
| 1232 | &pol->xdo)) != NULL) { |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1233 | to_put = x0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1234 | error = -EEXIST; |
| 1235 | goto out; |
| 1236 | } |
Horia Geanta | 0f24558 | 2014-02-12 16:20:06 +0200 | [diff] [blame] | 1237 | |
| 1238 | c.net = net; |
| 1239 | /* If the KMs have no listeners (yet...), avoid allocating an SA |
| 1240 | * for each and every packet - garbage collection might not |
| 1241 | * handle the flood. |
| 1242 | */ |
| 1243 | if (!km_is_alive(&c)) { |
| 1244 | error = -ESRCH; |
| 1245 | goto out; |
| 1246 | } |
| 1247 | |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1248 | x = xfrm_state_alloc(net); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1249 | if (x == NULL) { |
| 1250 | error = -ENOMEM; |
| 1251 | goto out; |
| 1252 | } |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1253 | /* Initialize temporary state matching only |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1254 | * to current session. */ |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1255 | xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family); |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1256 | memcpy(&x->mark, &pol->mark, sizeof(x->mark)); |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1257 | x->if_id = if_id; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1258 | |
David S. Miller | 1d28f42 | 2011-03-12 00:29:39 -0500 | [diff] [blame] | 1259 | error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid); |
Venkat Yekkirala | e0d1caa | 2006-07-24 23:29:07 -0700 | [diff] [blame] | 1260 | if (error) { |
| 1261 | x->km.state = XFRM_STATE_DEAD; |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1262 | to_put = x; |
Venkat Yekkirala | e0d1caa | 2006-07-24 23:29:07 -0700 | [diff] [blame] | 1263 | x = NULL; |
| 1264 | goto out; |
| 1265 | } |
Leon Romanovsky | f8a70af | 2022-12-02 20:41:30 +0200 | [diff] [blame] | 1266 | #ifdef CONFIG_XFRM_OFFLOAD |
| 1267 | if (pol->xdo.type == XFRM_DEV_OFFLOAD_PACKET) { |
| 1268 | struct xfrm_dev_offload *xdo = &pol->xdo; |
| 1269 | struct xfrm_dev_offload *xso = &x->xso; |
Venkat Yekkirala | e0d1caa | 2006-07-24 23:29:07 -0700 | [diff] [blame] | 1270 | |
Leon Romanovsky | f8a70af | 2022-12-02 20:41:30 +0200 | [diff] [blame] | 1271 | xso->type = XFRM_DEV_OFFLOAD_PACKET; |
| 1272 | xso->dir = xdo->dir; |
| 1273 | xso->dev = xdo->dev; |
| 1274 | xso->real_dev = xdo->real_dev; |
| 1275 | netdev_tracker_alloc(xso->dev, &xso->dev_tracker, |
| 1276 | GFP_ATOMIC); |
| 1277 | error = xso->dev->xfrmdev_ops->xdo_dev_state_add(x); |
| 1278 | if (error) { |
| 1279 | xso->dir = 0; |
| 1280 | netdev_put(xso->dev, &xso->dev_tracker); |
| 1281 | xso->dev = NULL; |
| 1282 | xso->real_dev = NULL; |
| 1283 | xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED; |
| 1284 | x->km.state = XFRM_STATE_DEAD; |
| 1285 | to_put = x; |
| 1286 | x = NULL; |
| 1287 | goto out; |
| 1288 | } |
| 1289 | } |
| 1290 | #endif |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1291 | if (km_query(x, tmpl, pol) == 0) { |
Florian Westphal | d737a58 | 2016-08-09 12:16:09 +0200 | [diff] [blame] | 1292 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1293 | x->km.state = XFRM_STATE_ACQ; |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1294 | list_add(&x->km.all, &net->xfrm.state_all); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1295 | XFRM_STATE_INSERT(bydst, &x->bydst, |
| 1296 | net->xfrm.state_bydst + h, |
| 1297 | x->xso.type); |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1298 | h = xfrm_src_hash(net, daddr, saddr, encap_family); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1299 | XFRM_STATE_INSERT(bysrc, &x->bysrc, |
| 1300 | net->xfrm.state_bysrc + h, |
| 1301 | x->xso.type); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1302 | if (x->id.spi) { |
Thomas Egerer | 8444cf7 | 2010-09-20 11:11:38 -0700 | [diff] [blame] | 1303 | h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1304 | XFRM_STATE_INSERT(byspi, &x->byspi, |
| 1305 | net->xfrm.state_byspi + h, |
| 1306 | x->xso.type); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1307 | } |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 1308 | if (x->km.seq) { |
| 1309 | h = xfrm_seq_hash(net, x->km.seq); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1310 | XFRM_STATE_INSERT(byseq, &x->byseq, |
| 1311 | net->xfrm.state_byseq + h, |
| 1312 | x->xso.type); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 1313 | } |
Alexey Dobriyan | b27aead | 2008-11-25 18:00:48 -0800 | [diff] [blame] | 1314 | x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 1315 | hrtimer_start(&x->mtimer, |
| 1316 | ktime_set(net->xfrm.sysctl_acq_expires, 0), |
| 1317 | HRTIMER_MODE_REL_SOFT); |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1318 | net->xfrm.state_num++; |
| 1319 | xfrm_hash_grow_check(net, x->bydst.next != NULL); |
Florian Westphal | d737a58 | 2016-08-09 12:16:09 +0200 | [diff] [blame] | 1320 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1321 | } else { |
Leon Romanovsky | f8a70af | 2022-12-02 20:41:30 +0200 | [diff] [blame] | 1322 | #ifdef CONFIG_XFRM_OFFLOAD |
| 1323 | struct xfrm_dev_offload *xso = &x->xso; |
| 1324 | |
| 1325 | if (xso->type == XFRM_DEV_OFFLOAD_PACKET) { |
| 1326 | xso->dev->xfrmdev_ops->xdo_dev_state_delete(x); |
| 1327 | xso->dir = 0; |
| 1328 | netdev_put(xso->dev, &xso->dev_tracker); |
| 1329 | xso->dev = NULL; |
| 1330 | xso->real_dev = NULL; |
| 1331 | xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED; |
| 1332 | } |
| 1333 | #endif |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1334 | x->km.state = XFRM_STATE_DEAD; |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1335 | to_put = x; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1336 | x = NULL; |
| 1337 | error = -ESRCH; |
| 1338 | } |
| 1339 | } |
| 1340 | out: |
Florian Westphal | 02efdff | 2016-08-09 12:16:05 +0200 | [diff] [blame] | 1341 | if (x) { |
| 1342 | if (!xfrm_state_hold_rcu(x)) { |
| 1343 | *err = -EAGAIN; |
| 1344 | x = NULL; |
| 1345 | } |
| 1346 | } else { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1347 | *err = acquire_in_progress ? -EAGAIN : error; |
Florian Westphal | 02efdff | 2016-08-09 12:16:05 +0200 | [diff] [blame] | 1348 | } |
Florian Westphal | d737a58 | 2016-08-09 12:16:09 +0200 | [diff] [blame] | 1349 | rcu_read_unlock(); |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1350 | if (to_put) |
| 1351 | xfrm_state_put(to_put); |
Florian Westphal | b65e3d7 | 2016-08-09 12:16:07 +0200 | [diff] [blame] | 1352 | |
Ahmed S. Darwish | e88add1 | 2021-03-16 11:56:29 +0100 | [diff] [blame] | 1353 | if (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, sequence)) { |
Florian Westphal | b65e3d7 | 2016-08-09 12:16:07 +0200 | [diff] [blame] | 1354 | *err = -EAGAIN; |
| 1355 | if (x) { |
| 1356 | xfrm_state_put(x); |
| 1357 | x = NULL; |
| 1358 | } |
| 1359 | } |
| 1360 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1361 | return x; |
| 1362 | } |
| 1363 | |
Jamal Hadi Salim | 628529b | 2007-07-02 22:41:14 -0700 | [diff] [blame] | 1364 | struct xfrm_state * |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1365 | xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id, |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1366 | xfrm_address_t *daddr, xfrm_address_t *saddr, |
Jamal Hadi Salim | 628529b | 2007-07-02 22:41:14 -0700 | [diff] [blame] | 1367 | unsigned short family, u8 mode, u8 proto, u32 reqid) |
| 1368 | { |
Pavel Emelyanov | 4bda4f2 | 2007-12-14 11:38:04 -0800 | [diff] [blame] | 1369 | unsigned int h; |
Jamal Hadi Salim | 628529b | 2007-07-02 22:41:14 -0700 | [diff] [blame] | 1370 | struct xfrm_state *rx = NULL, *x = NULL; |
Jamal Hadi Salim | 628529b | 2007-07-02 22:41:14 -0700 | [diff] [blame] | 1371 | |
Fan Du | 4ae770b | 2014-01-03 11:18:29 +0800 | [diff] [blame] | 1372 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1373 | h = xfrm_dst_hash(net, daddr, saddr, reqid, family); |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 1374 | hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { |
Jamal Hadi Salim | 628529b | 2007-07-02 22:41:14 -0700 | [diff] [blame] | 1375 | if (x->props.family == family && |
| 1376 | x->props.reqid == reqid && |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1377 | (mark & x->mark.m) == x->mark.v && |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1378 | x->if_id == if_id && |
Jamal Hadi Salim | 628529b | 2007-07-02 22:41:14 -0700 | [diff] [blame] | 1379 | !(x->props.flags & XFRM_STATE_WILDRECV) && |
| 1380 | xfrm_state_addr_check(x, daddr, saddr, family) && |
| 1381 | mode == x->props.mode && |
| 1382 | proto == x->id.proto && |
| 1383 | x->km.state == XFRM_STATE_VALID) { |
| 1384 | rx = x; |
| 1385 | break; |
| 1386 | } |
| 1387 | } |
| 1388 | |
| 1389 | if (rx) |
| 1390 | xfrm_state_hold(rx); |
Fan Du | 4ae770b | 2014-01-03 11:18:29 +0800 | [diff] [blame] | 1391 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Jamal Hadi Salim | 628529b | 2007-07-02 22:41:14 -0700 | [diff] [blame] | 1392 | |
| 1393 | |
| 1394 | return rx; |
| 1395 | } |
| 1396 | EXPORT_SYMBOL(xfrm_stateonly_find); |
| 1397 | |
Fan Du | c454997 | 2014-01-03 11:18:32 +0800 | [diff] [blame] | 1398 | struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, |
| 1399 | unsigned short family) |
| 1400 | { |
| 1401 | struct xfrm_state *x; |
| 1402 | struct xfrm_state_walk *w; |
| 1403 | |
| 1404 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
| 1405 | list_for_each_entry(w, &net->xfrm.state_all, all) { |
| 1406 | x = container_of(w, struct xfrm_state, km); |
| 1407 | if (x->props.family != family || |
| 1408 | x->id.spi != spi) |
| 1409 | continue; |
| 1410 | |
Fan Du | c454997 | 2014-01-03 11:18:32 +0800 | [diff] [blame] | 1411 | xfrm_state_hold(x); |
Li RongQing | bdddbf6 | 2015-04-29 08:42:44 +0800 | [diff] [blame] | 1412 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Fan Du | c454997 | 2014-01-03 11:18:32 +0800 | [diff] [blame] | 1413 | return x; |
| 1414 | } |
| 1415 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
| 1416 | return NULL; |
| 1417 | } |
| 1418 | EXPORT_SYMBOL(xfrm_state_lookup_byspi); |
| 1419 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1420 | static void __xfrm_state_insert(struct xfrm_state *x) |
| 1421 | { |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1422 | struct net *net = xs_net(x); |
David S. Miller | a624c10 | 2006-08-24 03:24:33 -0700 | [diff] [blame] | 1423 | unsigned int h; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1424 | |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1425 | list_add(&x->km.all, &net->xfrm.state_all); |
Timo Teras | 4c563f7 | 2008-02-28 21:31:08 -0800 | [diff] [blame] | 1426 | |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1427 | h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr, |
David S. Miller | c1969f2 | 2006-08-24 04:00:03 -0700 | [diff] [blame] | 1428 | x->props.reqid, x->props.family); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1429 | XFRM_STATE_INSERT(bydst, &x->bydst, net->xfrm.state_bydst + h, |
| 1430 | x->xso.type); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1431 | |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1432 | h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1433 | XFRM_STATE_INSERT(bysrc, &x->bysrc, net->xfrm.state_bysrc + h, |
| 1434 | x->xso.type); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1435 | |
Masahide NAKAMURA | 7b4dc360 | 2006-09-27 22:21:52 -0700 | [diff] [blame] | 1436 | if (x->id.spi) { |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1437 | h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, |
Masahide NAKAMURA | 6c44e6b | 2006-08-23 17:53:57 -0700 | [diff] [blame] | 1438 | x->props.family); |
| 1439 | |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1440 | XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, |
| 1441 | x->xso.type); |
Masahide NAKAMURA | 6c44e6b | 2006-08-23 17:53:57 -0700 | [diff] [blame] | 1442 | } |
| 1443 | |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 1444 | if (x->km.seq) { |
| 1445 | h = xfrm_seq_hash(net, x->km.seq); |
| 1446 | |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1447 | XFRM_STATE_INSERT(byseq, &x->byseq, net->xfrm.state_byseq + h, |
| 1448 | x->xso.type); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 1449 | } |
| 1450 | |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 1451 | hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT); |
David S. Miller | a47f0ce | 2006-08-24 03:54:22 -0700 | [diff] [blame] | 1452 | if (x->replay_maxage) |
| 1453 | mod_timer(&x->rtimer, jiffies + x->replay_maxage); |
Jamal Hadi Salim | f8cd548 | 2006-03-20 19:15:11 -0800 | [diff] [blame] | 1454 | |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1455 | net->xfrm.state_num++; |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 1456 | |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1457 | xfrm_hash_grow_check(net, x->bydst.next != NULL); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1458 | } |
| 1459 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1460 | /* net->xfrm.xfrm_state_lock is held */ |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1461 | static void __xfrm_state_bump_genids(struct xfrm_state *xnew) |
| 1462 | { |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1463 | struct net *net = xs_net(xnew); |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1464 | unsigned short family = xnew->props.family; |
| 1465 | u32 reqid = xnew->props.reqid; |
| 1466 | struct xfrm_state *x; |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1467 | unsigned int h; |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1468 | u32 mark = xnew->mark.v & xnew->mark.m; |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1469 | u32 if_id = xnew->if_id; |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1470 | |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1471 | h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family); |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 1472 | hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1473 | if (x->props.family == family && |
| 1474 | x->props.reqid == reqid && |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1475 | x->if_id == if_id && |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1476 | (mark & x->mark.m) == x->mark.v && |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1477 | xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) && |
| 1478 | xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family)) |
Herbert Xu | 34996cb | 2010-03-31 01:19:49 +0000 | [diff] [blame] | 1479 | x->genid++; |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1480 | } |
| 1481 | } |
| 1482 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1483 | void xfrm_state_insert(struct xfrm_state *x) |
| 1484 | { |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1485 | struct net *net = xs_net(x); |
| 1486 | |
| 1487 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1488 | __xfrm_state_bump_genids(x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1489 | __xfrm_state_insert(x); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1490 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1491 | } |
| 1492 | EXPORT_SYMBOL(xfrm_state_insert); |
| 1493 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1494 | /* net->xfrm.xfrm_state_lock is held */ |
Mathias Krause | e473fcb | 2013-06-26 23:56:58 +0200 | [diff] [blame] | 1495 | static struct xfrm_state *__find_acq_core(struct net *net, |
| 1496 | const struct xfrm_mark *m, |
David S. Miller | a70486f | 2011-02-27 23:17:24 -0800 | [diff] [blame] | 1497 | unsigned short family, u8 mode, |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1498 | u32 reqid, u32 if_id, u8 proto, |
David S. Miller | a70486f | 2011-02-27 23:17:24 -0800 | [diff] [blame] | 1499 | const xfrm_address_t *daddr, |
Mathias Krause | e473fcb | 2013-06-26 23:56:58 +0200 | [diff] [blame] | 1500 | const xfrm_address_t *saddr, |
| 1501 | int create) |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1502 | { |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1503 | unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family); |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1504 | struct xfrm_state *x; |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1505 | u32 mark = m->v & m->m; |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1506 | |
Sasha Levin | b67bfe0 | 2013-02-27 17:06:00 -0800 | [diff] [blame] | 1507 | hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1508 | if (x->props.reqid != reqid || |
| 1509 | x->props.mode != mode || |
| 1510 | x->props.family != family || |
| 1511 | x->km.state != XFRM_STATE_ACQ || |
Joy Latten | 75e252d | 2007-03-12 17:14:07 -0700 | [diff] [blame] | 1512 | x->id.spi != 0 || |
Wei Yongjun | 1802571 | 2009-06-28 18:42:53 +0000 | [diff] [blame] | 1513 | x->id.proto != proto || |
Jamal Hadi Salim | 3d6acfa7 | 2010-02-22 11:32:56 +0000 | [diff] [blame] | 1514 | (mark & x->mark.m) != x->mark.v || |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1515 | !xfrm_addr_equal(&x->id.daddr, daddr, family) || |
| 1516 | !xfrm_addr_equal(&x->props.saddr, saddr, family)) |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1517 | continue; |
| 1518 | |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1519 | xfrm_state_hold(x); |
| 1520 | return x; |
| 1521 | } |
| 1522 | |
| 1523 | if (!create) |
| 1524 | return NULL; |
| 1525 | |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1526 | x = xfrm_state_alloc(net); |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1527 | if (likely(x)) { |
| 1528 | switch (family) { |
| 1529 | case AF_INET: |
| 1530 | x->sel.daddr.a4 = daddr->a4; |
| 1531 | x->sel.saddr.a4 = saddr->a4; |
| 1532 | x->sel.prefixlen_d = 32; |
| 1533 | x->sel.prefixlen_s = 32; |
| 1534 | x->props.saddr.a4 = saddr->a4; |
| 1535 | x->id.daddr.a4 = daddr->a4; |
| 1536 | break; |
| 1537 | |
| 1538 | case AF_INET6: |
Jiri Benc | 15e318b | 2015-03-29 16:59:24 +0200 | [diff] [blame] | 1539 | x->sel.daddr.in6 = daddr->in6; |
| 1540 | x->sel.saddr.in6 = saddr->in6; |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1541 | x->sel.prefixlen_d = 128; |
| 1542 | x->sel.prefixlen_s = 128; |
Jiri Benc | 15e318b | 2015-03-29 16:59:24 +0200 | [diff] [blame] | 1543 | x->props.saddr.in6 = saddr->in6; |
| 1544 | x->id.daddr.in6 = daddr->in6; |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1545 | break; |
Stephen Hemminger | 3ff50b7 | 2007-04-20 17:09:22 -0700 | [diff] [blame] | 1546 | } |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1547 | |
| 1548 | x->km.state = XFRM_STATE_ACQ; |
| 1549 | x->id.proto = proto; |
| 1550 | x->props.family = family; |
| 1551 | x->props.mode = mode; |
| 1552 | x->props.reqid = reqid; |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1553 | x->if_id = if_id; |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1554 | x->mark.v = m->v; |
| 1555 | x->mark.m = m->m; |
Alexey Dobriyan | b27aead | 2008-11-25 18:00:48 -0800 | [diff] [blame] | 1556 | x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires; |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1557 | xfrm_state_hold(x); |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 1558 | hrtimer_start(&x->mtimer, |
| 1559 | ktime_set(net->xfrm.sysctl_acq_expires, 0), |
| 1560 | HRTIMER_MODE_REL_SOFT); |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1561 | list_add(&x->km.all, &net->xfrm.state_all); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1562 | XFRM_STATE_INSERT(bydst, &x->bydst, net->xfrm.state_bydst + h, |
| 1563 | x->xso.type); |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1564 | h = xfrm_src_hash(net, daddr, saddr, family); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 1565 | XFRM_STATE_INSERT(bysrc, &x->bysrc, net->xfrm.state_bysrc + h, |
| 1566 | x->xso.type); |
David S. Miller | 918049f | 2006-10-12 22:03:24 -0700 | [diff] [blame] | 1567 | |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1568 | net->xfrm.state_num++; |
David S. Miller | 918049f | 2006-10-12 22:03:24 -0700 | [diff] [blame] | 1569 | |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1570 | xfrm_hash_grow_check(net, x->bydst.next != NULL); |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1571 | } |
| 1572 | |
| 1573 | return x; |
| 1574 | } |
| 1575 | |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1576 | static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1577 | |
| 1578 | int xfrm_state_add(struct xfrm_state *x) |
| 1579 | { |
Alexey Dobriyan | 5447c5e | 2008-11-25 17:31:51 -0800 | [diff] [blame] | 1580 | struct net *net = xs_net(x); |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1581 | struct xfrm_state *x1, *to_put; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1582 | int family; |
| 1583 | int err; |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1584 | u32 mark = x->mark.v & x->mark.m; |
Masahide NAKAMURA | eb2971b | 2006-08-23 17:56:04 -0700 | [diff] [blame] | 1585 | int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1586 | |
| 1587 | family = x->props.family; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1588 | |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1589 | to_put = NULL; |
| 1590 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1591 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1592 | |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1593 | x1 = __xfrm_state_locate(x, use_spi, family); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1594 | if (x1) { |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1595 | to_put = x1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1596 | x1 = NULL; |
| 1597 | err = -EEXIST; |
| 1598 | goto out; |
| 1599 | } |
| 1600 | |
Masahide NAKAMURA | eb2971b | 2006-08-23 17:56:04 -0700 | [diff] [blame] | 1601 | if (use_spi && x->km.seq) { |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1602 | x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq); |
Joy Latten | 75e252d | 2007-03-12 17:14:07 -0700 | [diff] [blame] | 1603 | if (x1 && ((x1->id.proto != x->id.proto) || |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1604 | !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) { |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1605 | to_put = x1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1606 | x1 = NULL; |
| 1607 | } |
| 1608 | } |
| 1609 | |
Masahide NAKAMURA | eb2971b | 2006-08-23 17:56:04 -0700 | [diff] [blame] | 1610 | if (use_spi && !x1) |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1611 | x1 = __find_acq_core(net, &x->mark, family, x->props.mode, |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1612 | x->props.reqid, x->if_id, x->id.proto, |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 1613 | &x->id.daddr, &x->props.saddr, 0); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1614 | |
David S. Miller | c7f5ea3 | 2006-08-24 03:29:04 -0700 | [diff] [blame] | 1615 | __xfrm_state_bump_genids(x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1616 | __xfrm_state_insert(x); |
| 1617 | err = 0; |
| 1618 | |
| 1619 | out: |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1620 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1621 | |
| 1622 | if (x1) { |
| 1623 | xfrm_state_delete(x1); |
| 1624 | xfrm_state_put(x1); |
| 1625 | } |
| 1626 | |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1627 | if (to_put) |
| 1628 | xfrm_state_put(to_put); |
| 1629 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1630 | return err; |
| 1631 | } |
| 1632 | EXPORT_SYMBOL(xfrm_state_add); |
| 1633 | |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1634 | #ifdef CONFIG_XFRM_MIGRATE |
Antony Antony | 7aa05d3 | 2020-09-04 08:50:11 +0200 | [diff] [blame] | 1635 | static inline int clone_security(struct xfrm_state *x, struct xfrm_sec_ctx *security) |
| 1636 | { |
| 1637 | struct xfrm_user_sec_ctx *uctx; |
| 1638 | int size = sizeof(*uctx) + security->ctx_len; |
| 1639 | int err; |
| 1640 | |
| 1641 | uctx = kmalloc(size, GFP_KERNEL); |
| 1642 | if (!uctx) |
| 1643 | return -ENOMEM; |
| 1644 | |
| 1645 | uctx->exttype = XFRMA_SEC_CTX; |
| 1646 | uctx->len = size; |
| 1647 | uctx->ctx_doi = security->ctx_doi; |
| 1648 | uctx->ctx_alg = security->ctx_alg; |
| 1649 | uctx->ctx_len = security->ctx_len; |
| 1650 | memcpy(uctx + 1, security->ctx_str, security->ctx_len); |
| 1651 | err = security_xfrm_state_alloc(x, uctx); |
| 1652 | kfree(uctx); |
| 1653 | if (err) |
| 1654 | return err; |
| 1655 | |
| 1656 | return 0; |
| 1657 | } |
| 1658 | |
Antony Antony | 4ab47d4 | 2017-06-06 12:12:13 +0200 | [diff] [blame] | 1659 | static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, |
| 1660 | struct xfrm_encap_tmpl *encap) |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1661 | { |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1662 | struct net *net = xs_net(orig); |
Alexey Dobriyan | 98806f7 | 2008-11-25 17:29:47 -0800 | [diff] [blame] | 1663 | struct xfrm_state *x = xfrm_state_alloc(net); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1664 | if (!x) |
Herbert Xu | 553f911 | 2010-02-15 20:00:51 +0000 | [diff] [blame] | 1665 | goto out; |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1666 | |
| 1667 | memcpy(&x->id, &orig->id, sizeof(x->id)); |
| 1668 | memcpy(&x->sel, &orig->sel, sizeof(x->sel)); |
| 1669 | memcpy(&x->lft, &orig->lft, sizeof(x->lft)); |
| 1670 | x->props.mode = orig->props.mode; |
| 1671 | x->props.replay_window = orig->props.replay_window; |
| 1672 | x->props.reqid = orig->props.reqid; |
| 1673 | x->props.family = orig->props.family; |
| 1674 | x->props.saddr = orig->props.saddr; |
| 1675 | |
| 1676 | if (orig->aalg) { |
Martin Willi | 4447bb3 | 2009-11-25 00:29:52 +0000 | [diff] [blame] | 1677 | x->aalg = xfrm_algo_auth_clone(orig->aalg); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1678 | if (!x->aalg) |
| 1679 | goto error; |
| 1680 | } |
| 1681 | x->props.aalgo = orig->props.aalgo; |
| 1682 | |
Steffen Klassert | ee5c231 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1683 | if (orig->aead) { |
| 1684 | x->aead = xfrm_algo_aead_clone(orig->aead); |
Antony Antony | 75bf50f | 2017-12-07 21:54:27 +0100 | [diff] [blame] | 1685 | x->geniv = orig->geniv; |
Steffen Klassert | ee5c231 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1686 | if (!x->aead) |
| 1687 | goto error; |
| 1688 | } |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1689 | if (orig->ealg) { |
| 1690 | x->ealg = xfrm_algo_clone(orig->ealg); |
| 1691 | if (!x->ealg) |
| 1692 | goto error; |
| 1693 | } |
| 1694 | x->props.ealgo = orig->props.ealgo; |
| 1695 | |
| 1696 | if (orig->calg) { |
| 1697 | x->calg = xfrm_algo_clone(orig->calg); |
| 1698 | if (!x->calg) |
| 1699 | goto error; |
| 1700 | } |
| 1701 | x->props.calgo = orig->props.calgo; |
| 1702 | |
Antony Antony | 4ab47d4 | 2017-06-06 12:12:13 +0200 | [diff] [blame] | 1703 | if (encap || orig->encap) { |
| 1704 | if (encap) |
| 1705 | x->encap = kmemdup(encap, sizeof(*x->encap), |
| 1706 | GFP_KERNEL); |
| 1707 | else |
| 1708 | x->encap = kmemdup(orig->encap, sizeof(*x->encap), |
| 1709 | GFP_KERNEL); |
| 1710 | |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1711 | if (!x->encap) |
| 1712 | goto error; |
| 1713 | } |
| 1714 | |
Antony Antony | 7aa05d3 | 2020-09-04 08:50:11 +0200 | [diff] [blame] | 1715 | if (orig->security) |
| 1716 | if (clone_security(x, orig->security)) |
| 1717 | goto error; |
| 1718 | |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1719 | if (orig->coaddr) { |
| 1720 | x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr), |
| 1721 | GFP_KERNEL); |
| 1722 | if (!x->coaddr) |
| 1723 | goto error; |
| 1724 | } |
| 1725 | |
Steffen Klassert | af2f464 | 2011-03-28 19:46:39 +0000 | [diff] [blame] | 1726 | if (orig->replay_esn) { |
Steffen Klassert | cc9ab60 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1727 | if (xfrm_replay_clone(x, orig)) |
Steffen Klassert | af2f464 | 2011-03-28 19:46:39 +0000 | [diff] [blame] | 1728 | goto error; |
| 1729 | } |
| 1730 | |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1731 | memcpy(&x->mark, &orig->mark, sizeof(x->mark)); |
Antony Antony | 545e5c5 | 2020-09-04 08:49:38 +0200 | [diff] [blame] | 1732 | memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark)); |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1733 | |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1734 | x->props.flags = orig->props.flags; |
Nicolas Dichtel | a947b0a | 2013-02-22 10:54:54 +0100 | [diff] [blame] | 1735 | x->props.extra_flags = orig->props.extra_flags; |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1736 | |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1737 | x->if_id = orig->if_id; |
Steffen Klassert | ee5c231 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1738 | x->tfcpad = orig->tfcpad; |
| 1739 | x->replay_maxdiff = orig->replay_maxdiff; |
| 1740 | x->replay_maxage = orig->replay_maxage; |
Antony Antony | 8366685 | 2020-09-04 08:50:29 +0200 | [diff] [blame] | 1741 | memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1742 | x->km.state = orig->km.state; |
| 1743 | x->km.seq = orig->km.seq; |
Antony Antony | a486cd2 | 2017-05-19 12:47:00 +0200 | [diff] [blame] | 1744 | x->replay = orig->replay; |
| 1745 | x->preplay = orig->preplay; |
Antony Antony | 4e484b3 | 2021-12-22 14:11:18 +0100 | [diff] [blame] | 1746 | x->mapping_maxage = orig->mapping_maxage; |
Antony Antony | 6aa811a | 2022-07-27 17:41:22 +0200 | [diff] [blame] | 1747 | x->lastused = orig->lastused; |
Antony Antony | 4e484b3 | 2021-12-22 14:11:18 +0100 | [diff] [blame] | 1748 | x->new_mapping = 0; |
| 1749 | x->new_mapping_sport = 0; |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1750 | |
| 1751 | return x; |
| 1752 | |
| 1753 | error: |
Herbert Xu | 553f911 | 2010-02-15 20:00:51 +0000 | [diff] [blame] | 1754 | xfrm_state_put(x); |
| 1755 | out: |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1756 | return NULL; |
| 1757 | } |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1758 | |
Yan Yan | c1aca30 | 2022-01-18 16:00:13 -0800 | [diff] [blame] | 1759 | struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, |
| 1760 | u32 if_id) |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1761 | { |
| 1762 | unsigned int h; |
Steffen Klassert | 8c0cba2 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1763 | struct xfrm_state *x = NULL; |
| 1764 | |
| 1765 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1766 | |
| 1767 | if (m->reqid) { |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1768 | h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr, |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1769 | m->reqid, m->old_family); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1770 | hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1771 | if (x->props.mode != m->mode || |
| 1772 | x->id.proto != m->proto) |
| 1773 | continue; |
| 1774 | if (m->reqid && x->props.reqid != m->reqid) |
| 1775 | continue; |
Yan Yan | c1aca30 | 2022-01-18 16:00:13 -0800 | [diff] [blame] | 1776 | if (if_id != 0 && x->if_id != if_id) |
| 1777 | continue; |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1778 | if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, |
| 1779 | m->old_family) || |
| 1780 | !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, |
| 1781 | m->old_family)) |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1782 | continue; |
| 1783 | xfrm_state_hold(x); |
Steffen Klassert | 8c0cba2 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1784 | break; |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1785 | } |
| 1786 | } else { |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1787 | h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr, |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1788 | m->old_family); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1789 | hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) { |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1790 | if (x->props.mode != m->mode || |
| 1791 | x->id.proto != m->proto) |
| 1792 | continue; |
Yan Yan | c1aca30 | 2022-01-18 16:00:13 -0800 | [diff] [blame] | 1793 | if (if_id != 0 && x->if_id != if_id) |
| 1794 | continue; |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1795 | if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, |
| 1796 | m->old_family) || |
| 1797 | !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, |
| 1798 | m->old_family)) |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1799 | continue; |
| 1800 | xfrm_state_hold(x); |
Steffen Klassert | 8c0cba2 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1801 | break; |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1802 | } |
| 1803 | } |
| 1804 | |
Steffen Klassert | 8c0cba2 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1805 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
| 1806 | |
| 1807 | return x; |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1808 | } |
| 1809 | EXPORT_SYMBOL(xfrm_migrate_state_find); |
| 1810 | |
Weilong Chen | 3e94c2d | 2013-12-24 09:43:47 +0800 | [diff] [blame] | 1811 | struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, |
Antony Antony | 4ab47d4 | 2017-06-06 12:12:13 +0200 | [diff] [blame] | 1812 | struct xfrm_migrate *m, |
| 1813 | struct xfrm_encap_tmpl *encap) |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1814 | { |
| 1815 | struct xfrm_state *xc; |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1816 | |
Antony Antony | 4ab47d4 | 2017-06-06 12:12:13 +0200 | [diff] [blame] | 1817 | xc = xfrm_state_clone(x, encap); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1818 | if (!xc) |
| 1819 | return NULL; |
| 1820 | |
Yan Yan | e03c3bb | 2022-01-18 16:00:14 -0800 | [diff] [blame] | 1821 | xc->props.family = m->new_family; |
| 1822 | |
| 1823 | if (xfrm_init_state(xc) < 0) |
| 1824 | goto error; |
| 1825 | |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1826 | memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); |
| 1827 | memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); |
| 1828 | |
| 1829 | /* add state */ |
YOSHIFUJI Hideaki / 吉藤英明 | 70e94e6 | 2013-01-29 12:48:50 +0000 | [diff] [blame] | 1830 | if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) { |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1831 | /* a care is needed when the destination address of the |
| 1832 | state is to be updated as it is a part of triplet */ |
| 1833 | xfrm_state_insert(xc); |
| 1834 | } else { |
Steffen Klassert | cc9ab60 | 2014-02-19 13:33:24 +0100 | [diff] [blame] | 1835 | if (xfrm_state_add(xc) < 0) |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1836 | goto error; |
| 1837 | } |
| 1838 | |
| 1839 | return xc; |
| 1840 | error: |
Thomas Egerer | 78347c8 | 2010-12-06 23:28:56 +0000 | [diff] [blame] | 1841 | xfrm_state_put(xc); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 1842 | return NULL; |
| 1843 | } |
| 1844 | EXPORT_SYMBOL(xfrm_state_migrate); |
| 1845 | #endif |
| 1846 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1847 | int xfrm_state_update(struct xfrm_state *x) |
| 1848 | { |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1849 | struct xfrm_state *x1, *to_put; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1850 | int err; |
Masahide NAKAMURA | eb2971b | 2006-08-23 17:56:04 -0700 | [diff] [blame] | 1851 | int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1852 | struct net *net = xs_net(x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1853 | |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1854 | to_put = NULL; |
| 1855 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1856 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 1857 | x1 = __xfrm_state_locate(x, use_spi, x->props.family); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1858 | |
| 1859 | err = -ESRCH; |
| 1860 | if (!x1) |
| 1861 | goto out; |
| 1862 | |
| 1863 | if (xfrm_state_kern(x1)) { |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1864 | to_put = x1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1865 | err = -EEXIST; |
| 1866 | goto out; |
| 1867 | } |
| 1868 | |
| 1869 | if (x1->km.state == XFRM_STATE_ACQ) { |
| 1870 | __xfrm_state_insert(x); |
| 1871 | x = NULL; |
| 1872 | } |
| 1873 | err = 0; |
| 1874 | |
| 1875 | out: |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1876 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1877 | |
David S. Miller | 37b08e3 | 2008-09-02 20:14:15 -0700 | [diff] [blame] | 1878 | if (to_put) |
| 1879 | xfrm_state_put(to_put); |
| 1880 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1881 | if (err) |
| 1882 | return err; |
| 1883 | |
| 1884 | if (!x) { |
| 1885 | xfrm_state_delete(x1); |
| 1886 | xfrm_state_put(x1); |
| 1887 | return 0; |
| 1888 | } |
| 1889 | |
| 1890 | err = -EINVAL; |
| 1891 | spin_lock_bh(&x1->lock); |
| 1892 | if (likely(x1->km.state == XFRM_STATE_VALID)) { |
Herbert Xu | 257a4b0 | 2017-12-26 17:34:44 +1100 | [diff] [blame] | 1893 | if (x->encap && x1->encap && |
| 1894 | x->encap->encap_type == x1->encap->encap_type) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1895 | memcpy(x1->encap, x->encap, sizeof(*x1->encap)); |
Herbert Xu | 257a4b0 | 2017-12-26 17:34:44 +1100 | [diff] [blame] | 1896 | else if (x->encap || x1->encap) |
| 1897 | goto fail; |
| 1898 | |
Noriaki TAKAMIYA | 060f02a | 2006-08-23 18:18:55 -0700 | [diff] [blame] | 1899 | if (x->coaddr && x1->coaddr) { |
| 1900 | memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr)); |
| 1901 | } |
| 1902 | if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel))) |
| 1903 | memcpy(&x1->sel, &x->sel, sizeof(x1->sel)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1904 | memcpy(&x1->lft, &x->lft, sizeof(x1->lft)); |
| 1905 | x1->km.dying = 0; |
| 1906 | |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 1907 | hrtimer_start(&x1->mtimer, ktime_set(1, 0), |
| 1908 | HRTIMER_MODE_REL_SOFT); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1909 | if (x1->curlft.use_time) |
| 1910 | xfrm_state_check_expire(x1); |
| 1911 | |
Nathan Harold | 5baf4f9 | 2018-07-19 19:07:47 -0700 | [diff] [blame] | 1912 | if (x->props.smark.m || x->props.smark.v || x->if_id) { |
Nathan Harold | 6d8e85f | 2018-06-29 15:07:10 -0700 | [diff] [blame] | 1913 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
| 1914 | |
Nathan Harold | 5baf4f9 | 2018-07-19 19:07:47 -0700 | [diff] [blame] | 1915 | if (x->props.smark.m || x->props.smark.v) |
| 1916 | x1->props.smark = x->props.smark; |
| 1917 | |
| 1918 | if (x->if_id) |
| 1919 | x1->if_id = x->if_id; |
Nathan Harold | 6d8e85f | 2018-06-29 15:07:10 -0700 | [diff] [blame] | 1920 | |
| 1921 | __xfrm_state_bump_genids(x1); |
| 1922 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
| 1923 | } |
| 1924 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1925 | err = 0; |
Tushar Gohad | 8fcbc63 | 2011-07-07 15:38:52 +0000 | [diff] [blame] | 1926 | x->km.state = XFRM_STATE_DEAD; |
| 1927 | __xfrm_state_put(x); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1928 | } |
Herbert Xu | 257a4b0 | 2017-12-26 17:34:44 +1100 | [diff] [blame] | 1929 | |
| 1930 | fail: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1931 | spin_unlock_bh(&x1->lock); |
| 1932 | |
| 1933 | xfrm_state_put(x1); |
| 1934 | |
| 1935 | return err; |
| 1936 | } |
| 1937 | EXPORT_SYMBOL(xfrm_state_update); |
| 1938 | |
| 1939 | int xfrm_state_check_expire(struct xfrm_state *x) |
| 1940 | { |
Leon Romanovsky | f3da86d | 2022-12-02 20:41:33 +0200 | [diff] [blame] | 1941 | xfrm_dev_state_update_curlft(x); |
| 1942 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1943 | if (!x->curlft.use_time) |
Arnd Bergmann | 386c568 | 2018-07-11 12:19:13 +0200 | [diff] [blame] | 1944 | x->curlft.use_time = ktime_get_real_seconds(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1945 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1946 | if (x->curlft.bytes >= x->lft.hard_byte_limit || |
| 1947 | x->curlft.packets >= x->lft.hard_packet_limit) { |
Herbert Xu | 4666faa | 2005-06-18 22:43:22 -0700 | [diff] [blame] | 1948 | x->km.state = XFRM_STATE_EXPIRED; |
Thomas Gleixner | 671422b | 2019-03-01 23:48:20 +0100 | [diff] [blame] | 1949 | hrtimer_start(&x->mtimer, 0, HRTIMER_MODE_REL_SOFT); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1950 | return -EINVAL; |
| 1951 | } |
| 1952 | |
| 1953 | if (!x->km.dying && |
| 1954 | (x->curlft.bytes >= x->lft.soft_byte_limit || |
Herbert Xu | 4666faa | 2005-06-18 22:43:22 -0700 | [diff] [blame] | 1955 | x->curlft.packets >= x->lft.soft_packet_limit)) { |
| 1956 | x->km.dying = 1; |
Jamal Hadi Salim | 53bc6b4d | 2006-03-20 19:17:03 -0800 | [diff] [blame] | 1957 | km_state_expired(x, 0, 0); |
Herbert Xu | 4666faa | 2005-06-18 22:43:22 -0700 | [diff] [blame] | 1958 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1959 | return 0; |
| 1960 | } |
| 1961 | EXPORT_SYMBOL(xfrm_state_check_expire); |
| 1962 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1963 | struct xfrm_state * |
David S. Miller | a70486f | 2011-02-27 23:17:24 -0800 | [diff] [blame] | 1964 | xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi, |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1965 | u8 proto, unsigned short family) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1966 | { |
| 1967 | struct xfrm_state *x; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1968 | |
Florian Westphal | c2f672f | 2016-09-20 15:45:26 +0200 | [diff] [blame] | 1969 | rcu_read_lock(); |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1970 | x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family); |
Florian Westphal | c2f672f | 2016-09-20 15:45:26 +0200 | [diff] [blame] | 1971 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1972 | return x; |
| 1973 | } |
| 1974 | EXPORT_SYMBOL(xfrm_state_lookup); |
| 1975 | |
| 1976 | struct xfrm_state * |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1977 | xfrm_state_lookup_byaddr(struct net *net, u32 mark, |
David S. Miller | a70486f | 2011-02-27 23:17:24 -0800 | [diff] [blame] | 1978 | const xfrm_address_t *daddr, const xfrm_address_t *saddr, |
Masahide NAKAMURA | eb2971b | 2006-08-23 17:56:04 -0700 | [diff] [blame] | 1979 | u8 proto, unsigned short family) |
| 1980 | { |
| 1981 | struct xfrm_state *x; |
Masahide NAKAMURA | eb2971b | 2006-08-23 17:56:04 -0700 | [diff] [blame] | 1982 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1983 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 1984 | x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1985 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Masahide NAKAMURA | eb2971b | 2006-08-23 17:56:04 -0700 | [diff] [blame] | 1986 | return x; |
| 1987 | } |
| 1988 | EXPORT_SYMBOL(xfrm_state_lookup_byaddr); |
| 1989 | |
| 1990 | struct xfrm_state * |
Mathias Krause | e473fcb | 2013-06-26 23:56:58 +0200 | [diff] [blame] | 1991 | xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid, |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1992 | u32 if_id, u8 proto, const xfrm_address_t *daddr, |
Mathias Krause | e473fcb | 2013-06-26 23:56:58 +0200 | [diff] [blame] | 1993 | const xfrm_address_t *saddr, int create, unsigned short family) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1994 | { |
| 1995 | struct xfrm_state *x; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1996 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1997 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Steffen Klassert | 7e65264 | 2018-06-12 14:07:07 +0200 | [diff] [blame] | 1998 | x = __find_acq_core(net, mark, family, mode, reqid, if_id, proto, daddr, saddr, create); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 1999 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
David S. Miller | 2770834 | 2006-08-24 00:13:10 -0700 | [diff] [blame] | 2000 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2001 | return x; |
| 2002 | } |
| 2003 | EXPORT_SYMBOL(xfrm_find_acq); |
| 2004 | |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2005 | #ifdef CONFIG_XFRM_SUB_POLICY |
Florian Westphal | 3aaf391 | 2019-05-03 17:46:17 +0200 | [diff] [blame] | 2006 | #if IS_ENABLED(CONFIG_IPV6) |
| 2007 | /* distribution counting sort function for xfrm_state and xfrm_tmpl */ |
| 2008 | static void |
| 2009 | __xfrm6_sort(void **dst, void **src, int n, |
| 2010 | int (*cmp)(const void *p), int maxclass) |
| 2011 | { |
| 2012 | int count[XFRM_MAX_DEPTH] = { }; |
| 2013 | int class[XFRM_MAX_DEPTH]; |
| 2014 | int i; |
| 2015 | |
| 2016 | for (i = 0; i < n; i++) { |
| 2017 | int c = cmp(src[i]); |
| 2018 | |
| 2019 | class[i] = c; |
| 2020 | count[c]++; |
| 2021 | } |
| 2022 | |
| 2023 | for (i = 2; i < maxclass; i++) |
| 2024 | count[i] += count[i - 1]; |
| 2025 | |
| 2026 | for (i = 0; i < n; i++) { |
| 2027 | dst[count[class[i] - 1]++] = src[i]; |
| 2028 | src[i] = NULL; |
| 2029 | } |
| 2030 | } |
| 2031 | |
| 2032 | /* Rule for xfrm_state: |
| 2033 | * |
| 2034 | * rule 1: select IPsec transport except AH |
| 2035 | * rule 2: select MIPv6 RO or inbound trigger |
| 2036 | * rule 3: select IPsec transport AH |
| 2037 | * rule 4: select IPsec tunnel |
| 2038 | * rule 5: others |
| 2039 | */ |
| 2040 | static int __xfrm6_state_sort_cmp(const void *p) |
| 2041 | { |
| 2042 | const struct xfrm_state *v = p; |
| 2043 | |
| 2044 | switch (v->props.mode) { |
| 2045 | case XFRM_MODE_TRANSPORT: |
| 2046 | if (v->id.proto != IPPROTO_AH) |
| 2047 | return 1; |
| 2048 | else |
| 2049 | return 3; |
| 2050 | #if IS_ENABLED(CONFIG_IPV6_MIP6) |
| 2051 | case XFRM_MODE_ROUTEOPTIMIZATION: |
| 2052 | case XFRM_MODE_IN_TRIGGER: |
| 2053 | return 2; |
| 2054 | #endif |
| 2055 | case XFRM_MODE_TUNNEL: |
| 2056 | case XFRM_MODE_BEET: |
| 2057 | return 4; |
| 2058 | } |
| 2059 | return 5; |
| 2060 | } |
| 2061 | |
| 2062 | /* Rule for xfrm_tmpl: |
| 2063 | * |
| 2064 | * rule 1: select IPsec transport |
| 2065 | * rule 2: select MIPv6 RO or inbound trigger |
| 2066 | * rule 3: select IPsec tunnel |
| 2067 | * rule 4: others |
| 2068 | */ |
| 2069 | static int __xfrm6_tmpl_sort_cmp(const void *p) |
| 2070 | { |
| 2071 | const struct xfrm_tmpl *v = p; |
| 2072 | |
| 2073 | switch (v->mode) { |
| 2074 | case XFRM_MODE_TRANSPORT: |
| 2075 | return 1; |
| 2076 | #if IS_ENABLED(CONFIG_IPV6_MIP6) |
| 2077 | case XFRM_MODE_ROUTEOPTIMIZATION: |
| 2078 | case XFRM_MODE_IN_TRIGGER: |
| 2079 | return 2; |
| 2080 | #endif |
| 2081 | case XFRM_MODE_TUNNEL: |
| 2082 | case XFRM_MODE_BEET: |
| 2083 | return 3; |
| 2084 | } |
| 2085 | return 4; |
| 2086 | } |
| 2087 | #else |
| 2088 | static inline int __xfrm6_state_sort_cmp(const void *p) { return 5; } |
| 2089 | static inline int __xfrm6_tmpl_sort_cmp(const void *p) { return 4; } |
| 2090 | |
| 2091 | static inline void |
| 2092 | __xfrm6_sort(void **dst, void **src, int n, |
| 2093 | int (*cmp)(const void *p), int maxclass) |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2094 | { |
Koichiro Den | 3f5a95a | 2017-08-01 23:21:46 +0900 | [diff] [blame] | 2095 | int i; |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2096 | |
Florian Westphal | 3aaf391 | 2019-05-03 17:46:17 +0200 | [diff] [blame] | 2097 | for (i = 0; i < n; i++) |
| 2098 | dst[i] = src[i]; |
| 2099 | } |
| 2100 | #endif /* CONFIG_IPV6 */ |
| 2101 | |
| 2102 | void |
| 2103 | xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, |
| 2104 | unsigned short family) |
| 2105 | { |
| 2106 | int i; |
| 2107 | |
| 2108 | if (family == AF_INET6) |
| 2109 | __xfrm6_sort((void **)dst, (void **)src, n, |
| 2110 | __xfrm6_tmpl_sort_cmp, 5); |
Koichiro Den | 3f5a95a | 2017-08-01 23:21:46 +0900 | [diff] [blame] | 2111 | else |
| 2112 | for (i = 0; i < n; i++) |
| 2113 | dst[i] = src[i]; |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2114 | } |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2115 | |
Florian Westphal | 3aaf391 | 2019-05-03 17:46:17 +0200 | [diff] [blame] | 2116 | void |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2117 | xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, |
| 2118 | unsigned short family) |
| 2119 | { |
Koichiro Den | 3f5a95a | 2017-08-01 23:21:46 +0900 | [diff] [blame] | 2120 | int i; |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2121 | |
Florian Westphal | 3aaf391 | 2019-05-03 17:46:17 +0200 | [diff] [blame] | 2122 | if (family == AF_INET6) |
| 2123 | __xfrm6_sort((void **)dst, (void **)src, n, |
| 2124 | __xfrm6_state_sort_cmp, 6); |
Koichiro Den | 3f5a95a | 2017-08-01 23:21:46 +0900 | [diff] [blame] | 2125 | else |
| 2126 | for (i = 0; i < n; i++) |
| 2127 | dst[i] = src[i]; |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2128 | } |
Masahide NAKAMURA | 41a49cc | 2006-08-23 22:48:31 -0700 | [diff] [blame] | 2129 | #endif |
| 2130 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2131 | /* Silly enough, but I'm lazy to build resolution list */ |
| 2132 | |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 2133 | static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2134 | { |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 2135 | unsigned int h = xfrm_seq_hash(net, seq); |
| 2136 | struct xfrm_state *x; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2137 | |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 2138 | hlist_for_each_entry_rcu(x, net->xfrm.state_byseq + h, byseq) { |
| 2139 | if (x->km.seq == seq && |
| 2140 | (mark & x->mark.m) == x->mark.v && |
| 2141 | x->km.state == XFRM_STATE_ACQ) { |
| 2142 | xfrm_state_hold(x); |
| 2143 | return x; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2144 | } |
| 2145 | } |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 2146 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2147 | return NULL; |
| 2148 | } |
| 2149 | |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 2150 | struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2151 | { |
| 2152 | struct xfrm_state *x; |
| 2153 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2154 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 2155 | x = __xfrm_find_acq_byseq(net, mark, seq); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2156 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2157 | return x; |
| 2158 | } |
| 2159 | EXPORT_SYMBOL(xfrm_find_acq_byseq); |
| 2160 | |
| 2161 | u32 xfrm_get_acqseq(void) |
| 2162 | { |
| 2163 | u32 res; |
jamal | 6836b9b | 2010-02-16 02:01:22 +0000 | [diff] [blame] | 2164 | static atomic_t acqseq; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2165 | |
jamal | 6836b9b | 2010-02-16 02:01:22 +0000 | [diff] [blame] | 2166 | do { |
| 2167 | res = atomic_inc_return(&acqseq); |
| 2168 | } while (!res); |
| 2169 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2170 | return res; |
| 2171 | } |
| 2172 | EXPORT_SYMBOL(xfrm_get_acqseq); |
| 2173 | |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2174 | int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack) |
Fan Du | 776e9dd | 2013-12-16 18:47:49 +0800 | [diff] [blame] | 2175 | { |
| 2176 | switch (proto) { |
| 2177 | case IPPROTO_AH: |
| 2178 | case IPPROTO_ESP: |
| 2179 | break; |
| 2180 | |
| 2181 | case IPPROTO_COMP: |
| 2182 | /* IPCOMP spi is 16-bits. */ |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2183 | if (max >= 0x10000) { |
| 2184 | NL_SET_ERR_MSG(extack, "IPCOMP SPI must be <= 65535"); |
Fan Du | 776e9dd | 2013-12-16 18:47:49 +0800 | [diff] [blame] | 2185 | return -EINVAL; |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2186 | } |
Fan Du | 776e9dd | 2013-12-16 18:47:49 +0800 | [diff] [blame] | 2187 | break; |
| 2188 | |
| 2189 | default: |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2190 | NL_SET_ERR_MSG(extack, "Invalid protocol, must be one of AH, ESP, IPCOMP"); |
Fan Du | 776e9dd | 2013-12-16 18:47:49 +0800 | [diff] [blame] | 2191 | return -EINVAL; |
| 2192 | } |
| 2193 | |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2194 | if (min > max) { |
| 2195 | NL_SET_ERR_MSG(extack, "Invalid SPI range: min > max"); |
Fan Du | 776e9dd | 2013-12-16 18:47:49 +0800 | [diff] [blame] | 2196 | return -EINVAL; |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2197 | } |
Fan Du | 776e9dd | 2013-12-16 18:47:49 +0800 | [diff] [blame] | 2198 | |
| 2199 | return 0; |
| 2200 | } |
| 2201 | EXPORT_SYMBOL(verify_spi_info); |
| 2202 | |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2203 | int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, |
| 2204 | struct netlink_ext_ack *extack) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2205 | { |
Alexey Dobriyan | 221df1e | 2008-11-25 17:30:50 -0800 | [diff] [blame] | 2206 | struct net *net = xs_net(x); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 2207 | unsigned int h; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2208 | struct xfrm_state *x0; |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2209 | int err = -ENOENT; |
| 2210 | __be32 minspi = htonl(low); |
| 2211 | __be32 maxspi = htonl(high); |
zhuoliang zhang | a779d91 | 2020-10-23 09:05:35 +0200 | [diff] [blame] | 2212 | __be32 newspi = 0; |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 2213 | u32 mark = x->mark.v & x->mark.m; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2214 | |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2215 | spin_lock_bh(&x->lock); |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2216 | if (x->km.state == XFRM_STATE_DEAD) { |
| 2217 | NL_SET_ERR_MSG(extack, "Target ACQUIRE is in DEAD state"); |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2218 | goto unlock; |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2219 | } |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2220 | |
| 2221 | err = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2222 | if (x->id.spi) |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2223 | goto unlock; |
| 2224 | |
| 2225 | err = -ENOENT; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2226 | |
| 2227 | if (minspi == maxspi) { |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 2228 | x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2229 | if (x0) { |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2230 | NL_SET_ERR_MSG(extack, "Requested SPI is already in use"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2231 | xfrm_state_put(x0); |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2232 | goto unlock; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2233 | } |
zhuoliang zhang | a779d91 | 2020-10-23 09:05:35 +0200 | [diff] [blame] | 2234 | newspi = minspi; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2235 | } else { |
| 2236 | u32 spi = 0; |
Weilong Chen | 9b7a787 | 2013-12-24 09:43:46 +0800 | [diff] [blame] | 2237 | for (h = 0; h < high-low+1; h++) { |
Jason A. Donenfeld | e8a533c | 2022-10-09 20:44:02 -0600 | [diff] [blame] | 2238 | spi = get_random_u32_inclusive(low, high); |
Jamal Hadi Salim | bd55775 | 2010-02-22 16:20:22 -0800 | [diff] [blame] | 2239 | x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2240 | if (x0 == NULL) { |
zhuoliang zhang | a779d91 | 2020-10-23 09:05:35 +0200 | [diff] [blame] | 2241 | newspi = htonl(spi); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2242 | break; |
| 2243 | } |
| 2244 | xfrm_state_put(x0); |
| 2245 | } |
| 2246 | } |
zhuoliang zhang | a779d91 | 2020-10-23 09:05:35 +0200 | [diff] [blame] | 2247 | if (newspi) { |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2248 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
zhuoliang zhang | a779d91 | 2020-10-23 09:05:35 +0200 | [diff] [blame] | 2249 | x->id.spi = newspi; |
Alexey Dobriyan | 12604d8 | 2008-11-25 17:31:18 -0800 | [diff] [blame] | 2250 | h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family); |
Leon Romanovsky | 3c611d4 | 2022-12-02 20:41:32 +0200 | [diff] [blame] | 2251 | XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, |
| 2252 | x->xso.type); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2253 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2254 | |
| 2255 | err = 0; |
Sabrina Dubroca | c2dad11 | 2022-11-24 15:43:43 +0100 | [diff] [blame] | 2256 | } else { |
| 2257 | NL_SET_ERR_MSG(extack, "No SPI available in the requested range"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2258 | } |
Herbert Xu | 658b219 | 2007-10-09 13:29:52 -0700 | [diff] [blame] | 2259 | |
| 2260 | unlock: |
| 2261 | spin_unlock_bh(&x->lock); |
| 2262 | |
| 2263 | return err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2264 | } |
| 2265 | EXPORT_SYMBOL(xfrm_alloc_spi); |
| 2266 | |
Nicolas Dichtel | d362309 | 2014-02-14 15:30:36 +0100 | [diff] [blame] | 2267 | static bool __xfrm_state_filter_match(struct xfrm_state *x, |
Nicolas Dichtel | 870a2df | 2014-03-06 18:24:29 +0100 | [diff] [blame] | 2268 | struct xfrm_address_filter *filter) |
Nicolas Dichtel | d362309 | 2014-02-14 15:30:36 +0100 | [diff] [blame] | 2269 | { |
| 2270 | if (filter) { |
| 2271 | if ((filter->family == AF_INET || |
| 2272 | filter->family == AF_INET6) && |
| 2273 | x->props.family != filter->family) |
| 2274 | return false; |
| 2275 | |
| 2276 | return addr_match(&x->props.saddr, &filter->saddr, |
| 2277 | filter->splen) && |
| 2278 | addr_match(&x->id.daddr, &filter->daddr, |
| 2279 | filter->dplen); |
| 2280 | } |
| 2281 | return true; |
| 2282 | } |
| 2283 | |
Alexey Dobriyan | 284fa7d | 2008-11-25 17:32:14 -0800 | [diff] [blame] | 2284 | int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, |
Timo Teras | 4c563f7 | 2008-02-28 21:31:08 -0800 | [diff] [blame] | 2285 | int (*func)(struct xfrm_state *, int, void*), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2286 | void *data) |
| 2287 | { |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2288 | struct xfrm_state *state; |
| 2289 | struct xfrm_state_walk *x; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2290 | int err = 0; |
| 2291 | |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2292 | if (walk->seq != 0 && list_empty(&walk->all)) |
Timo Teras | 4c563f7 | 2008-02-28 21:31:08 -0800 | [diff] [blame] | 2293 | return 0; |
| 2294 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2295 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2296 | if (list_empty(&walk->all)) |
Alexey Dobriyan | 284fa7d | 2008-11-25 17:32:14 -0800 | [diff] [blame] | 2297 | x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all); |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2298 | else |
Li RongQing | 8007770 | 2015-04-22 17:09:54 +0800 | [diff] [blame] | 2299 | x = list_first_entry(&walk->all, struct xfrm_state_walk, all); |
Alexey Dobriyan | 284fa7d | 2008-11-25 17:32:14 -0800 | [diff] [blame] | 2300 | list_for_each_entry_from(x, &net->xfrm.state_all, all) { |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2301 | if (x->state == XFRM_STATE_DEAD) |
Timo Teras | 4c563f7 | 2008-02-28 21:31:08 -0800 | [diff] [blame] | 2302 | continue; |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2303 | state = container_of(x, struct xfrm_state, km); |
| 2304 | if (!xfrm_id_proto_match(state->id.proto, walk->proto)) |
Timo Teras | 4c563f7 | 2008-02-28 21:31:08 -0800 | [diff] [blame] | 2305 | continue; |
Nicolas Dichtel | d362309 | 2014-02-14 15:30:36 +0100 | [diff] [blame] | 2306 | if (!__xfrm_state_filter_match(state, walk->filter)) |
| 2307 | continue; |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2308 | err = func(state, walk->seq, data); |
| 2309 | if (err) { |
| 2310 | list_move_tail(&walk->all, &x->all); |
| 2311 | goto out; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2312 | } |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2313 | walk->seq++; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2314 | } |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2315 | if (walk->seq == 0) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2316 | err = -ENOENT; |
| 2317 | goto out; |
| 2318 | } |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2319 | list_del_init(&walk->all); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2320 | out: |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2321 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2322 | return err; |
| 2323 | } |
| 2324 | EXPORT_SYMBOL(xfrm_state_walk); |
| 2325 | |
Nicolas Dichtel | d362309 | 2014-02-14 15:30:36 +0100 | [diff] [blame] | 2326 | void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, |
Nicolas Dichtel | 870a2df | 2014-03-06 18:24:29 +0100 | [diff] [blame] | 2327 | struct xfrm_address_filter *filter) |
Herbert Xu | 5c18245 | 2008-09-22 19:48:19 -0700 | [diff] [blame] | 2328 | { |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2329 | INIT_LIST_HEAD(&walk->all); |
Herbert Xu | 5c18245 | 2008-09-22 19:48:19 -0700 | [diff] [blame] | 2330 | walk->proto = proto; |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2331 | walk->state = XFRM_STATE_DEAD; |
| 2332 | walk->seq = 0; |
Nicolas Dichtel | d362309 | 2014-02-14 15:30:36 +0100 | [diff] [blame] | 2333 | walk->filter = filter; |
Herbert Xu | 5c18245 | 2008-09-22 19:48:19 -0700 | [diff] [blame] | 2334 | } |
| 2335 | EXPORT_SYMBOL(xfrm_state_walk_init); |
| 2336 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2337 | void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net) |
Herbert Xu | abb81c4 | 2008-09-09 19:58:29 -0700 | [diff] [blame] | 2338 | { |
Nicolas Dichtel | d362309 | 2014-02-14 15:30:36 +0100 | [diff] [blame] | 2339 | kfree(walk->filter); |
| 2340 | |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2341 | if (list_empty(&walk->all)) |
Herbert Xu | 5c18245 | 2008-09-22 19:48:19 -0700 | [diff] [blame] | 2342 | return; |
Herbert Xu | 5c18245 | 2008-09-22 19:48:19 -0700 | [diff] [blame] | 2343 | |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2344 | spin_lock_bh(&net->xfrm.xfrm_state_lock); |
Herbert Xu | 12a169e | 2008-10-01 07:03:24 -0700 | [diff] [blame] | 2345 | list_del(&walk->all); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2346 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |
Herbert Xu | abb81c4 | 2008-09-09 19:58:29 -0700 | [diff] [blame] | 2347 | } |
| 2348 | EXPORT_SYMBOL(xfrm_state_walk_done); |
| 2349 | |
Kees Cook | e99e88a | 2017-10-16 14:43:17 -0700 | [diff] [blame] | 2350 | static void xfrm_replay_timer_handler(struct timer_list *t) |
Jamal Hadi Salim | f8cd548 | 2006-03-20 19:15:11 -0800 | [diff] [blame] | 2351 | { |
Kees Cook | e99e88a | 2017-10-16 14:43:17 -0700 | [diff] [blame] | 2352 | struct xfrm_state *x = from_timer(x, t, rtimer); |
Jamal Hadi Salim | f8cd548 | 2006-03-20 19:15:11 -0800 | [diff] [blame] | 2353 | |
| 2354 | spin_lock(&x->lock); |
| 2355 | |
Jamal Hadi Salim | 2717096 | 2006-04-14 15:03:05 -0700 | [diff] [blame] | 2356 | if (x->km.state == XFRM_STATE_VALID) { |
Alexey Dobriyan | a6483b7 | 2008-11-25 17:38:20 -0800 | [diff] [blame] | 2357 | if (xfrm_aevent_is_on(xs_net(x))) |
Florian Westphal | cfc61c5 | 2021-06-18 15:51:56 +0200 | [diff] [blame] | 2358 | xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT); |
Jamal Hadi Salim | 2717096 | 2006-04-14 15:03:05 -0700 | [diff] [blame] | 2359 | else |
| 2360 | x->xflags |= XFRM_TIME_DEFER; |
| 2361 | } |
Jamal Hadi Salim | f8cd548 | 2006-03-20 19:15:11 -0800 | [diff] [blame] | 2362 | |
| 2363 | spin_unlock(&x->lock); |
| 2364 | } |
| 2365 | |
Denis Cheng | df01812 | 2007-12-07 00:51:11 -0800 | [diff] [blame] | 2366 | static LIST_HEAD(xfrm_km_list); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2367 | |
David S. Miller | 214e005 | 2011-02-24 00:02:38 -0500 | [diff] [blame] | 2368 | void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2369 | { |
| 2370 | struct xfrm_mgr *km; |
| 2371 | |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2372 | rcu_read_lock(); |
| 2373 | list_for_each_entry_rcu(km, &xfrm_km_list, list) |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2374 | if (km->notify_policy) |
| 2375 | km->notify_policy(xp, dir, c); |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2376 | rcu_read_unlock(); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2377 | } |
| 2378 | |
David S. Miller | 214e005 | 2011-02-24 00:02:38 -0500 | [diff] [blame] | 2379 | void km_state_notify(struct xfrm_state *x, const struct km_event *c) |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2380 | { |
| 2381 | struct xfrm_mgr *km; |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2382 | rcu_read_lock(); |
| 2383 | list_for_each_entry_rcu(km, &xfrm_km_list, list) |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2384 | if (km->notify) |
| 2385 | km->notify(x, c); |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2386 | rcu_read_unlock(); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2387 | } |
| 2388 | |
| 2389 | EXPORT_SYMBOL(km_policy_notify); |
| 2390 | EXPORT_SYMBOL(km_state_notify); |
| 2391 | |
Eric W. Biederman | 15e4730 | 2012-09-07 20:12:54 +0000 | [diff] [blame] | 2392 | void km_state_expired(struct xfrm_state *x, int hard, u32 portid) |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2393 | { |
| 2394 | struct km_event c; |
| 2395 | |
Herbert Xu | bf08867f9 | 2005-06-18 22:44:00 -0700 | [diff] [blame] | 2396 | c.data.hard = hard; |
Eric W. Biederman | 15e4730 | 2012-09-07 20:12:54 +0000 | [diff] [blame] | 2397 | c.portid = portid; |
Herbert Xu | f60f6b8 | 2005-06-18 22:44:37 -0700 | [diff] [blame] | 2398 | c.event = XFRM_MSG_EXPIRE; |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2399 | km_state_notify(x, &c); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2400 | } |
| 2401 | |
Jamal Hadi Salim | 53bc6b4d | 2006-03-20 19:17:03 -0800 | [diff] [blame] | 2402 | EXPORT_SYMBOL(km_state_expired); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2403 | /* |
| 2404 | * We send to all registered managers regardless of failure |
| 2405 | * We are happy with one success |
| 2406 | */ |
Jamal Hadi Salim | 980ebd2 | 2006-03-20 19:16:40 -0800 | [diff] [blame] | 2407 | int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2408 | { |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2409 | int err = -EINVAL, acqret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2410 | struct xfrm_mgr *km; |
| 2411 | |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2412 | rcu_read_lock(); |
| 2413 | list_for_each_entry_rcu(km, &xfrm_km_list, list) { |
Fan Du | 65e0736 | 2012-08-15 10:13:47 +0800 | [diff] [blame] | 2414 | acqret = km->acquire(x, t, pol); |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2415 | if (!acqret) |
| 2416 | err = acqret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2417 | } |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2418 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2419 | return err; |
| 2420 | } |
Jamal Hadi Salim | 980ebd2 | 2006-03-20 19:16:40 -0800 | [diff] [blame] | 2421 | EXPORT_SYMBOL(km_query); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2422 | |
Antony Antony | 4e484b3 | 2021-12-22 14:11:18 +0100 | [diff] [blame] | 2423 | static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2424 | { |
| 2425 | int err = -EINVAL; |
| 2426 | struct xfrm_mgr *km; |
| 2427 | |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2428 | rcu_read_lock(); |
| 2429 | list_for_each_entry_rcu(km, &xfrm_km_list, list) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2430 | if (km->new_mapping) |
| 2431 | err = km->new_mapping(x, ipaddr, sport); |
| 2432 | if (!err) |
| 2433 | break; |
| 2434 | } |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2435 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2436 | return err; |
| 2437 | } |
Antony Antony | 4e484b3 | 2021-12-22 14:11:18 +0100 | [diff] [blame] | 2438 | |
| 2439 | int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) |
| 2440 | { |
| 2441 | int ret = 0; |
| 2442 | |
| 2443 | if (x->mapping_maxage) { |
| 2444 | if ((jiffies / HZ - x->new_mapping) > x->mapping_maxage || |
| 2445 | x->new_mapping_sport != sport) { |
| 2446 | x->new_mapping_sport = sport; |
| 2447 | x->new_mapping = jiffies / HZ; |
| 2448 | ret = __km_new_mapping(x, ipaddr, sport); |
| 2449 | } |
| 2450 | } else { |
| 2451 | ret = __km_new_mapping(x, ipaddr, sport); |
| 2452 | } |
| 2453 | |
| 2454 | return ret; |
| 2455 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2456 | EXPORT_SYMBOL(km_new_mapping); |
| 2457 | |
Eric W. Biederman | 15e4730 | 2012-09-07 20:12:54 +0000 | [diff] [blame] | 2458 | void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2459 | { |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2460 | struct km_event c; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2461 | |
Herbert Xu | bf08867f9 | 2005-06-18 22:44:00 -0700 | [diff] [blame] | 2462 | c.data.hard = hard; |
Eric W. Biederman | 15e4730 | 2012-09-07 20:12:54 +0000 | [diff] [blame] | 2463 | c.portid = portid; |
Herbert Xu | f60f6b8 | 2005-06-18 22:44:37 -0700 | [diff] [blame] | 2464 | c.event = XFRM_MSG_POLEXPIRE; |
Jamal Hadi Salim | 26b15da | 2005-06-18 22:42:13 -0700 | [diff] [blame] | 2465 | km_policy_notify(pol, dir, &c); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2466 | } |
David S. Miller | a70fcb0 | 2006-03-20 19:18:52 -0800 | [diff] [blame] | 2467 | EXPORT_SYMBOL(km_policy_expired); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2468 | |
Eric Dumazet | 2d60abc | 2008-01-03 20:43:21 -0800 | [diff] [blame] | 2469 | #ifdef CONFIG_XFRM_MIGRATE |
David S. Miller | 183cad1 | 2011-02-24 00:28:01 -0500 | [diff] [blame] | 2470 | int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, |
| 2471 | const struct xfrm_migrate *m, int num_migrate, |
Antony Antony | 8bafd73 | 2017-06-06 12:12:14 +0200 | [diff] [blame] | 2472 | const struct xfrm_kmaddress *k, |
| 2473 | const struct xfrm_encap_tmpl *encap) |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 2474 | { |
| 2475 | int err = -EINVAL; |
| 2476 | int ret; |
| 2477 | struct xfrm_mgr *km; |
| 2478 | |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2479 | rcu_read_lock(); |
| 2480 | list_for_each_entry_rcu(km, &xfrm_km_list, list) { |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 2481 | if (km->migrate) { |
Antony Antony | 8bafd73 | 2017-06-06 12:12:14 +0200 | [diff] [blame] | 2482 | ret = km->migrate(sel, dir, type, m, num_migrate, k, |
| 2483 | encap); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 2484 | if (!ret) |
| 2485 | err = ret; |
| 2486 | } |
| 2487 | } |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2488 | rcu_read_unlock(); |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 2489 | return err; |
| 2490 | } |
| 2491 | EXPORT_SYMBOL(km_migrate); |
Eric Dumazet | 2d60abc | 2008-01-03 20:43:21 -0800 | [diff] [blame] | 2492 | #endif |
Shinta Sugimoto | 80c9aba | 2007-02-08 13:11:42 -0800 | [diff] [blame] | 2493 | |
Alexey Dobriyan | db983c1 | 2008-11-25 17:51:01 -0800 | [diff] [blame] | 2494 | int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr) |
Masahide NAKAMURA | 97a64b4 | 2006-08-23 20:44:06 -0700 | [diff] [blame] | 2495 | { |
| 2496 | int err = -EINVAL; |
| 2497 | int ret; |
| 2498 | struct xfrm_mgr *km; |
| 2499 | |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2500 | rcu_read_lock(); |
| 2501 | list_for_each_entry_rcu(km, &xfrm_km_list, list) { |
Masahide NAKAMURA | 97a64b4 | 2006-08-23 20:44:06 -0700 | [diff] [blame] | 2502 | if (km->report) { |
Alexey Dobriyan | db983c1 | 2008-11-25 17:51:01 -0800 | [diff] [blame] | 2503 | ret = km->report(net, proto, sel, addr); |
Masahide NAKAMURA | 97a64b4 | 2006-08-23 20:44:06 -0700 | [diff] [blame] | 2504 | if (!ret) |
| 2505 | err = ret; |
| 2506 | } |
| 2507 | } |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2508 | rcu_read_unlock(); |
Masahide NAKAMURA | 97a64b4 | 2006-08-23 20:44:06 -0700 | [diff] [blame] | 2509 | return err; |
| 2510 | } |
| 2511 | EXPORT_SYMBOL(km_report); |
| 2512 | |
Florian Westphal | bb9cd07 | 2019-04-17 11:45:13 +0200 | [diff] [blame] | 2513 | static bool km_is_alive(const struct km_event *c) |
Horia Geanta | 0f24558 | 2014-02-12 16:20:06 +0200 | [diff] [blame] | 2514 | { |
| 2515 | struct xfrm_mgr *km; |
| 2516 | bool is_alive = false; |
| 2517 | |
| 2518 | rcu_read_lock(); |
| 2519 | list_for_each_entry_rcu(km, &xfrm_km_list, list) { |
| 2520 | if (km->is_alive && km->is_alive(c)) { |
| 2521 | is_alive = true; |
| 2522 | break; |
| 2523 | } |
| 2524 | } |
| 2525 | rcu_read_unlock(); |
| 2526 | |
| 2527 | return is_alive; |
| 2528 | } |
Horia Geanta | 0f24558 | 2014-02-12 16:20:06 +0200 | [diff] [blame] | 2529 | |
Dmitry Safonov | c9e7c76 | 2020-09-21 15:36:51 +0100 | [diff] [blame] | 2530 | #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT) |
| 2531 | static DEFINE_SPINLOCK(xfrm_translator_lock); |
| 2532 | static struct xfrm_translator __rcu *xfrm_translator; |
| 2533 | |
| 2534 | struct xfrm_translator *xfrm_get_translator(void) |
| 2535 | { |
| 2536 | struct xfrm_translator *xtr; |
| 2537 | |
| 2538 | rcu_read_lock(); |
| 2539 | xtr = rcu_dereference(xfrm_translator); |
| 2540 | if (unlikely(!xtr)) |
| 2541 | goto out; |
| 2542 | if (!try_module_get(xtr->owner)) |
| 2543 | xtr = NULL; |
| 2544 | out: |
| 2545 | rcu_read_unlock(); |
| 2546 | return xtr; |
| 2547 | } |
| 2548 | EXPORT_SYMBOL_GPL(xfrm_get_translator); |
| 2549 | |
| 2550 | void xfrm_put_translator(struct xfrm_translator *xtr) |
| 2551 | { |
| 2552 | module_put(xtr->owner); |
| 2553 | } |
| 2554 | EXPORT_SYMBOL_GPL(xfrm_put_translator); |
| 2555 | |
| 2556 | int xfrm_register_translator(struct xfrm_translator *xtr) |
| 2557 | { |
| 2558 | int err = 0; |
| 2559 | |
| 2560 | spin_lock_bh(&xfrm_translator_lock); |
| 2561 | if (unlikely(xfrm_translator != NULL)) |
| 2562 | err = -EEXIST; |
| 2563 | else |
| 2564 | rcu_assign_pointer(xfrm_translator, xtr); |
| 2565 | spin_unlock_bh(&xfrm_translator_lock); |
| 2566 | |
| 2567 | return err; |
| 2568 | } |
| 2569 | EXPORT_SYMBOL_GPL(xfrm_register_translator); |
| 2570 | |
| 2571 | int xfrm_unregister_translator(struct xfrm_translator *xtr) |
| 2572 | { |
| 2573 | int err = 0; |
| 2574 | |
| 2575 | spin_lock_bh(&xfrm_translator_lock); |
| 2576 | if (likely(xfrm_translator != NULL)) { |
| 2577 | if (rcu_access_pointer(xfrm_translator) != xtr) |
| 2578 | err = -EINVAL; |
| 2579 | else |
| 2580 | RCU_INIT_POINTER(xfrm_translator, NULL); |
| 2581 | } |
| 2582 | spin_unlock_bh(&xfrm_translator_lock); |
| 2583 | synchronize_rcu(); |
| 2584 | |
| 2585 | return err; |
| 2586 | } |
| 2587 | EXPORT_SYMBOL_GPL(xfrm_unregister_translator); |
| 2588 | #endif |
| 2589 | |
Christoph Hellwig | c6d1b26 | 2020-07-23 08:08:51 +0200 | [diff] [blame] | 2590 | int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, int optlen) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2591 | { |
| 2592 | int err; |
| 2593 | u8 *data; |
| 2594 | struct xfrm_mgr *km; |
| 2595 | struct xfrm_policy *pol = NULL; |
| 2596 | |
Christoph Hellwig | c6d1b26 | 2020-07-23 08:08:51 +0200 | [diff] [blame] | 2597 | if (sockptr_is_null(optval) && !optlen) { |
Lorenzo Colitti | be8f828 | 2017-11-20 19:26:02 +0900 | [diff] [blame] | 2598 | xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); |
| 2599 | xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); |
| 2600 | __sk_dst_reset(sk); |
| 2601 | return 0; |
| 2602 | } |
| 2603 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2604 | if (optlen <= 0 || optlen > PAGE_SIZE) |
| 2605 | return -EMSGSIZE; |
| 2606 | |
Christoph Hellwig | c6d1b26 | 2020-07-23 08:08:51 +0200 | [diff] [blame] | 2607 | data = memdup_sockptr(optval, optlen); |
Geliang Tang | a133d93 | 2017-05-06 23:42:21 +0800 | [diff] [blame] | 2608 | if (IS_ERR(data)) |
| 2609 | return PTR_ERR(data); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2610 | |
Dmitry Safonov | 96392ee | 2020-09-21 15:36:56 +0100 | [diff] [blame] | 2611 | if (in_compat_syscall()) { |
| 2612 | struct xfrm_translator *xtr = xfrm_get_translator(); |
| 2613 | |
Yu Kuai | 48f486e | 2020-11-10 09:14:43 +0800 | [diff] [blame] | 2614 | if (!xtr) { |
| 2615 | kfree(data); |
Dmitry Safonov | 96392ee | 2020-09-21 15:36:56 +0100 | [diff] [blame] | 2616 | return -EOPNOTSUPP; |
Yu Kuai | 48f486e | 2020-11-10 09:14:43 +0800 | [diff] [blame] | 2617 | } |
Dmitry Safonov | 96392ee | 2020-09-21 15:36:56 +0100 | [diff] [blame] | 2618 | |
| 2619 | err = xtr->xlate_user_policy_sockptr(&data, optlen); |
| 2620 | xfrm_put_translator(xtr); |
| 2621 | if (err) { |
| 2622 | kfree(data); |
| 2623 | return err; |
| 2624 | } |
| 2625 | } |
| 2626 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2627 | err = -EINVAL; |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2628 | rcu_read_lock(); |
| 2629 | list_for_each_entry_rcu(km, &xfrm_km_list, list) { |
Venkat Yekkirala | cb969f0 | 2006-07-24 23:32:20 -0700 | [diff] [blame] | 2630 | pol = km->compile_policy(sk, optname, data, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2631 | optlen, &err); |
| 2632 | if (err >= 0) |
| 2633 | break; |
| 2634 | } |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2635 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2636 | |
| 2637 | if (err >= 0) { |
| 2638 | xfrm_sk_policy_insert(sk, err, pol); |
| 2639 | xfrm_pol_put(pol); |
Jonathan Basseri | 2b06cdf | 2017-10-25 09:52:27 -0700 | [diff] [blame] | 2640 | __sk_dst_reset(sk); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2641 | err = 0; |
| 2642 | } |
| 2643 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2644 | kfree(data); |
| 2645 | return err; |
| 2646 | } |
| 2647 | EXPORT_SYMBOL(xfrm_user_policy); |
| 2648 | |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2649 | static DEFINE_SPINLOCK(xfrm_km_lock); |
| 2650 | |
Zhengchao Shao | f41b284 | 2022-06-15 09:55:19 +0800 | [diff] [blame] | 2651 | void xfrm_register_km(struct xfrm_mgr *km) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2652 | { |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2653 | spin_lock_bh(&xfrm_km_lock); |
| 2654 | list_add_tail_rcu(&km->list, &xfrm_km_list); |
| 2655 | spin_unlock_bh(&xfrm_km_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2656 | } |
| 2657 | EXPORT_SYMBOL(xfrm_register_km); |
| 2658 | |
Zhengchao Shao | f41b284 | 2022-06-15 09:55:19 +0800 | [diff] [blame] | 2659 | void xfrm_unregister_km(struct xfrm_mgr *km) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2660 | { |
Cong Wang | 85168c0 | 2013-01-16 16:05:06 +0800 | [diff] [blame] | 2661 | spin_lock_bh(&xfrm_km_lock); |
| 2662 | list_del_rcu(&km->list); |
| 2663 | spin_unlock_bh(&xfrm_km_lock); |
| 2664 | synchronize_rcu(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2665 | } |
| 2666 | EXPORT_SYMBOL(xfrm_unregister_km); |
| 2667 | |
| 2668 | int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo) |
| 2669 | { |
| 2670 | int err = 0; |
Florian Westphal | 423826a | 2017-01-09 14:20:46 +0100 | [diff] [blame] | 2671 | |
| 2672 | if (WARN_ON(afinfo->family >= NPROTO)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2673 | return -EAFNOSUPPORT; |
Florian Westphal | 423826a | 2017-01-09 14:20:46 +0100 | [diff] [blame] | 2674 | |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 2675 | spin_lock_bh(&xfrm_state_afinfo_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2676 | if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL)) |
Li RongQing | f31e8d4f | 2015-04-23 11:06:53 +0800 | [diff] [blame] | 2677 | err = -EEXIST; |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 2678 | else |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 2679 | rcu_assign_pointer(xfrm_state_afinfo[afinfo->family], afinfo); |
| 2680 | spin_unlock_bh(&xfrm_state_afinfo_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2681 | return err; |
| 2682 | } |
| 2683 | EXPORT_SYMBOL(xfrm_state_register_afinfo); |
| 2684 | |
| 2685 | int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo) |
| 2686 | { |
Florian Westphal | 423826a | 2017-01-09 14:20:46 +0100 | [diff] [blame] | 2687 | int err = 0, family = afinfo->family; |
| 2688 | |
| 2689 | if (WARN_ON(family >= NPROTO)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2690 | return -EAFNOSUPPORT; |
Florian Westphal | 423826a | 2017-01-09 14:20:46 +0100 | [diff] [blame] | 2691 | |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 2692 | spin_lock_bh(&xfrm_state_afinfo_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2693 | if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) { |
Florian Westphal | 423826a | 2017-01-09 14:20:46 +0100 | [diff] [blame] | 2694 | if (rcu_access_pointer(xfrm_state_afinfo[family]) != afinfo) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2695 | err = -EINVAL; |
David S. Miller | edcd582 | 2006-08-24 00:42:45 -0700 | [diff] [blame] | 2696 | else |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 2697 | RCU_INIT_POINTER(xfrm_state_afinfo[afinfo->family], NULL); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2698 | } |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 2699 | spin_unlock_bh(&xfrm_state_afinfo_lock); |
| 2700 | synchronize_rcu(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2701 | return err; |
| 2702 | } |
| 2703 | EXPORT_SYMBOL(xfrm_state_unregister_afinfo); |
| 2704 | |
Florian Westphal | 711059b | 2017-01-09 14:20:48 +0100 | [diff] [blame] | 2705 | struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family) |
| 2706 | { |
| 2707 | if (unlikely(family >= NPROTO)) |
| 2708 | return NULL; |
| 2709 | |
| 2710 | return rcu_dereference(xfrm_state_afinfo[family]); |
| 2711 | } |
Florian Westphal | 733a5fa | 2019-03-29 21:16:30 +0100 | [diff] [blame] | 2712 | EXPORT_SYMBOL_GPL(xfrm_state_afinfo_get_rcu); |
Florian Westphal | 711059b | 2017-01-09 14:20:48 +0100 | [diff] [blame] | 2713 | |
Hannes Frederic Sowa | 628e341 | 2013-08-14 13:05:23 +0200 | [diff] [blame] | 2714 | struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2715 | { |
| 2716 | struct xfrm_state_afinfo *afinfo; |
| 2717 | if (unlikely(family >= NPROTO)) |
| 2718 | return NULL; |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 2719 | rcu_read_lock(); |
| 2720 | afinfo = rcu_dereference(xfrm_state_afinfo[family]); |
Herbert Xu | 546be24 | 2006-05-27 23:03:58 -0700 | [diff] [blame] | 2721 | if (unlikely(!afinfo)) |
Cong Wang | 44abdc3 | 2013-01-16 16:05:05 +0800 | [diff] [blame] | 2722 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2723 | return afinfo; |
| 2724 | } |
| 2725 | |
Steffen Klassert | b48c05a | 2018-04-16 07:50:09 +0200 | [diff] [blame] | 2726 | void xfrm_flush_gc(void) |
| 2727 | { |
| 2728 | flush_work(&xfrm_state_gc_work); |
| 2729 | } |
| 2730 | EXPORT_SYMBOL(xfrm_flush_gc); |
| 2731 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2732 | /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ |
| 2733 | void xfrm_state_delete_tunnel(struct xfrm_state *x) |
| 2734 | { |
| 2735 | if (x->tunnel) { |
| 2736 | struct xfrm_state *t = x->tunnel; |
| 2737 | |
| 2738 | if (atomic_read(&t->tunnel_users) == 2) |
| 2739 | xfrm_state_delete(t); |
| 2740 | atomic_dec(&t->tunnel_users); |
Cong Wang | f75a280 | 2019-01-31 13:05:49 -0800 | [diff] [blame] | 2741 | xfrm_state_put_sync(t); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2742 | x->tunnel = NULL; |
| 2743 | } |
| 2744 | } |
| 2745 | EXPORT_SYMBOL(xfrm_state_delete_tunnel); |
| 2746 | |
Jiri Bohac | a6d95c5 | 2022-01-26 16:00:18 +0100 | [diff] [blame] | 2747 | u32 xfrm_state_mtu(struct xfrm_state *x, int mtu) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2748 | { |
Florian Westphal | b3b73b8 | 2017-01-05 13:23:58 +0100 | [diff] [blame] | 2749 | const struct xfrm_type *type = READ_ONCE(x->type); |
Florian Westphal | c7b37c7 | 2019-06-24 22:04:48 +0200 | [diff] [blame] | 2750 | struct crypto_aead *aead; |
| 2751 | u32 blksize, net_adj = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2752 | |
Florian Westphal | c7b37c7 | 2019-06-24 22:04:48 +0200 | [diff] [blame] | 2753 | if (x->km.state != XFRM_STATE_VALID || |
| 2754 | !type || type->proto != IPPROTO_ESP) |
| 2755 | return mtu - x->props.header_len; |
Florian Westphal | b3b73b8 | 2017-01-05 13:23:58 +0100 | [diff] [blame] | 2756 | |
Florian Westphal | c7b37c7 | 2019-06-24 22:04:48 +0200 | [diff] [blame] | 2757 | aead = x->data; |
| 2758 | blksize = ALIGN(crypto_aead_blocksize(aead), 4); |
| 2759 | |
| 2760 | switch (x->props.mode) { |
| 2761 | case XFRM_MODE_TRANSPORT: |
| 2762 | case XFRM_MODE_BEET: |
| 2763 | if (x->props.family == AF_INET) |
| 2764 | net_adj = sizeof(struct iphdr); |
| 2765 | else if (x->props.family == AF_INET6) |
| 2766 | net_adj = sizeof(struct ipv6hdr); |
| 2767 | break; |
| 2768 | case XFRM_MODE_TUNNEL: |
| 2769 | break; |
| 2770 | default: |
| 2771 | WARN_ON_ONCE(1); |
| 2772 | break; |
| 2773 | } |
| 2774 | |
| 2775 | return ((mtu - x->props.header_len - crypto_aead_authsize(aead) - |
| 2776 | net_adj) & ~(blksize - 1)) + net_adj - 2; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2777 | } |
Jiri Bohac | a6d95c5 | 2022-01-26 16:00:18 +0100 | [diff] [blame] | 2778 | EXPORT_SYMBOL_GPL(xfrm_state_mtu); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2779 | |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2780 | int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload, |
| 2781 | struct netlink_ext_ack *extack) |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 2782 | { |
Florian Westphal | c9500d7 | 2019-03-29 21:16:32 +0100 | [diff] [blame] | 2783 | const struct xfrm_mode *inner_mode; |
| 2784 | const struct xfrm_mode *outer_mode; |
Herbert Xu | d094cd8 | 2005-06-20 13:19:41 -0700 | [diff] [blame] | 2785 | int family = x->props.family; |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 2786 | int err; |
| 2787 | |
Florian Westphal | e468174 | 2019-05-03 17:46:16 +0200 | [diff] [blame] | 2788 | if (family == AF_INET && |
Kuniyuki Iwashima | 0968d2a | 2022-07-13 13:51:52 -0700 | [diff] [blame] | 2789 | READ_ONCE(xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc)) |
Florian Westphal | e468174 | 2019-05-03 17:46:16 +0200 | [diff] [blame] | 2790 | x->props.flags |= XFRM_STATE_NOPMTUDISC; |
Herbert Xu | d094cd8 | 2005-06-20 13:19:41 -0700 | [diff] [blame] | 2791 | |
| 2792 | err = -EPROTONOSUPPORT; |
Herbert Xu | 1399637 | 2007-10-17 21:35:51 -0700 | [diff] [blame] | 2793 | |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2794 | if (x->sel.family != AF_UNSPEC) { |
| 2795 | inner_mode = xfrm_get_mode(x->props.mode, x->sel.family); |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2796 | if (inner_mode == NULL) { |
| 2797 | NL_SET_ERR_MSG(extack, "Requested mode not found"); |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2798 | goto error; |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2799 | } |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2800 | |
| 2801 | if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) && |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2802 | family != x->sel.family) { |
| 2803 | NL_SET_ERR_MSG(extack, "Only tunnel modes can accommodate a change of family"); |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2804 | goto error; |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2805 | } |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2806 | |
Florian Westphal | c9500d7 | 2019-03-29 21:16:32 +0100 | [diff] [blame] | 2807 | x->inner_mode = *inner_mode; |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2808 | } else { |
Florian Westphal | 4c145dc | 2019-03-29 21:16:31 +0100 | [diff] [blame] | 2809 | const struct xfrm_mode *inner_mode_iaf; |
Martin Willi | d81d228 | 2008-12-03 15:38:07 -0800 | [diff] [blame] | 2810 | int iafamily = AF_INET; |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2811 | |
Martin Willi | d81d228 | 2008-12-03 15:38:07 -0800 | [diff] [blame] | 2812 | inner_mode = xfrm_get_mode(x->props.mode, x->props.family); |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2813 | if (inner_mode == NULL) { |
| 2814 | NL_SET_ERR_MSG(extack, "Requested mode not found"); |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2815 | goto error; |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2816 | } |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2817 | |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2818 | if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) { |
| 2819 | NL_SET_ERR_MSG(extack, "Only tunnel modes can accommodate an AF_UNSPEC selector"); |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2820 | goto error; |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2821 | } |
Florian Westphal | 4c145dc | 2019-03-29 21:16:31 +0100 | [diff] [blame] | 2822 | |
Florian Westphal | c9500d7 | 2019-03-29 21:16:32 +0100 | [diff] [blame] | 2823 | x->inner_mode = *inner_mode; |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2824 | |
Martin Willi | d81d228 | 2008-12-03 15:38:07 -0800 | [diff] [blame] | 2825 | if (x->props.family == AF_INET) |
| 2826 | iafamily = AF_INET6; |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2827 | |
Martin Willi | d81d228 | 2008-12-03 15:38:07 -0800 | [diff] [blame] | 2828 | inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily); |
| 2829 | if (inner_mode_iaf) { |
| 2830 | if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL) |
Florian Westphal | c9500d7 | 2019-03-29 21:16:32 +0100 | [diff] [blame] | 2831 | x->inner_mode_iaf = *inner_mode_iaf; |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 2832 | } |
| 2833 | } |
Herbert Xu | 1399637 | 2007-10-17 21:35:51 -0700 | [diff] [blame] | 2834 | |
Herbert Xu | d094cd8 | 2005-06-20 13:19:41 -0700 | [diff] [blame] | 2835 | x->type = xfrm_get_type(x->id.proto, family); |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2836 | if (x->type == NULL) { |
| 2837 | NL_SET_ERR_MSG(extack, "Requested type not found"); |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 2838 | goto error; |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2839 | } |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 2840 | |
Ilan Tayari | ffdb521 | 2017-08-01 12:49:08 +0300 | [diff] [blame] | 2841 | x->type_offload = xfrm_get_type_offload(x->id.proto, family, offload); |
Steffen Klassert | 9d389d7 | 2017-04-14 10:05:44 +0200 | [diff] [blame] | 2842 | |
Sabrina Dubroca | e1e10b4 | 2022-09-27 17:45:29 +0200 | [diff] [blame] | 2843 | err = x->type->init_state(x, extack); |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 2844 | if (err) |
| 2845 | goto error; |
| 2846 | |
Florian Westphal | c9500d7 | 2019-03-29 21:16:32 +0100 | [diff] [blame] | 2847 | outer_mode = xfrm_get_mode(x->props.mode, family); |
| 2848 | if (!outer_mode) { |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2849 | NL_SET_ERR_MSG(extack, "Requested mode not found"); |
Julia Lawall | 599901c | 2012-08-29 06:49:15 +0000 | [diff] [blame] | 2850 | err = -EPROTONOSUPPORT; |
Herbert Xu | b59f45d | 2006-05-27 23:05:54 -0700 | [diff] [blame] | 2851 | goto error; |
Julia Lawall | 599901c | 2012-08-29 06:49:15 +0000 | [diff] [blame] | 2852 | } |
Herbert Xu | b59f45d | 2006-05-27 23:05:54 -0700 | [diff] [blame] | 2853 | |
Florian Westphal | c9500d7 | 2019-03-29 21:16:32 +0100 | [diff] [blame] | 2854 | x->outer_mode = *outer_mode; |
Wei Yongjun | a454f0c | 2011-03-21 18:08:28 -0700 | [diff] [blame] | 2855 | if (init_replay) { |
Sabrina Dubroca | 1cf9a3a | 2022-09-14 19:04:06 +0200 | [diff] [blame] | 2856 | err = xfrm_init_replay(x, extack); |
Wei Yongjun | a454f0c | 2011-03-21 18:08:28 -0700 | [diff] [blame] | 2857 | if (err) |
| 2858 | goto error; |
| 2859 | } |
| 2860 | |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 2861 | error: |
| 2862 | return err; |
| 2863 | } |
| 2864 | |
Wei Yongjun | a454f0c | 2011-03-21 18:08:28 -0700 | [diff] [blame] | 2865 | EXPORT_SYMBOL(__xfrm_init_state); |
| 2866 | |
| 2867 | int xfrm_init_state(struct xfrm_state *x) |
| 2868 | { |
Yossi Kuperman | cc01572 | 2018-01-17 15:52:41 +0200 | [diff] [blame] | 2869 | int err; |
| 2870 | |
Sabrina Dubroca | 741f9a1 | 2022-09-14 19:04:05 +0200 | [diff] [blame] | 2871 | err = __xfrm_init_state(x, true, false, NULL); |
Yossi Kuperman | cc01572 | 2018-01-17 15:52:41 +0200 | [diff] [blame] | 2872 | if (!err) |
| 2873 | x->km.state = XFRM_STATE_VALID; |
| 2874 | |
| 2875 | return err; |
Wei Yongjun | a454f0c | 2011-03-21 18:08:28 -0700 | [diff] [blame] | 2876 | } |
| 2877 | |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 2878 | EXPORT_SYMBOL(xfrm_init_state); |
YOSHIFUJI Hideaki | a716c11 | 2007-02-09 23:25:29 +0900 | [diff] [blame] | 2879 | |
Alexey Dobriyan | d62ddc2 | 2008-11-25 17:14:31 -0800 | [diff] [blame] | 2880 | int __net_init xfrm_state_init(struct net *net) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2881 | { |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 2882 | unsigned int sz; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2883 | |
Mathias Krause | 565f0fa | 2018-05-03 10:55:07 +0200 | [diff] [blame] | 2884 | if (net_eq(net, &init_net)) |
| 2885 | xfrm_state_cache = KMEM_CACHE(xfrm_state, |
| 2886 | SLAB_HWCACHE_ALIGN | SLAB_PANIC); |
| 2887 | |
Alexey Dobriyan | 9d4139c | 2008-11-25 17:16:11 -0800 | [diff] [blame] | 2888 | INIT_LIST_HEAD(&net->xfrm.state_all); |
| 2889 | |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 2890 | sz = sizeof(struct hlist_head) * 8; |
| 2891 | |
Alexey Dobriyan | 73d189d | 2008-11-25 17:16:58 -0800 | [diff] [blame] | 2892 | net->xfrm.state_bydst = xfrm_hash_alloc(sz); |
| 2893 | if (!net->xfrm.state_bydst) |
| 2894 | goto out_bydst; |
Alexey Dobriyan | d320bbb | 2008-11-25 17:17:24 -0800 | [diff] [blame] | 2895 | net->xfrm.state_bysrc = xfrm_hash_alloc(sz); |
| 2896 | if (!net->xfrm.state_bysrc) |
| 2897 | goto out_bysrc; |
Alexey Dobriyan | b754a4f | 2008-11-25 17:17:47 -0800 | [diff] [blame] | 2898 | net->xfrm.state_byspi = xfrm_hash_alloc(sz); |
| 2899 | if (!net->xfrm.state_byspi) |
| 2900 | goto out_byspi; |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 2901 | net->xfrm.state_byseq = xfrm_hash_alloc(sz); |
| 2902 | if (!net->xfrm.state_byseq) |
| 2903 | goto out_byseq; |
Alexey Dobriyan | 529983e | 2008-11-25 17:18:12 -0800 | [diff] [blame] | 2904 | net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1); |
David S. Miller | f034b5d | 2006-08-24 03:08:07 -0700 | [diff] [blame] | 2905 | |
Alexey Dobriyan | 0bf7c5b | 2008-11-25 17:18:39 -0800 | [diff] [blame] | 2906 | net->xfrm.state_num = 0; |
Alexey Dobriyan | 6308273 | 2008-11-25 17:19:07 -0800 | [diff] [blame] | 2907 | INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize); |
Fan Du | 283bc9f | 2013-11-07 17:47:50 +0800 | [diff] [blame] | 2908 | spin_lock_init(&net->xfrm.xfrm_state_lock); |
Ahmed S. Darwish | bc8e0ad | 2021-03-16 11:56:30 +0100 | [diff] [blame] | 2909 | seqcount_spinlock_init(&net->xfrm.xfrm_state_hash_generation, |
| 2910 | &net->xfrm.xfrm_state_lock); |
Alexey Dobriyan | d62ddc2 | 2008-11-25 17:14:31 -0800 | [diff] [blame] | 2911 | return 0; |
Alexey Dobriyan | 73d189d | 2008-11-25 17:16:58 -0800 | [diff] [blame] | 2912 | |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 2913 | out_byseq: |
| 2914 | xfrm_hash_free(net->xfrm.state_byspi, sz); |
Alexey Dobriyan | b754a4f | 2008-11-25 17:17:47 -0800 | [diff] [blame] | 2915 | out_byspi: |
| 2916 | xfrm_hash_free(net->xfrm.state_bysrc, sz); |
Alexey Dobriyan | d320bbb | 2008-11-25 17:17:24 -0800 | [diff] [blame] | 2917 | out_bysrc: |
| 2918 | xfrm_hash_free(net->xfrm.state_bydst, sz); |
Alexey Dobriyan | 73d189d | 2008-11-25 17:16:58 -0800 | [diff] [blame] | 2919 | out_bydst: |
| 2920 | return -ENOMEM; |
Alexey Dobriyan | d62ddc2 | 2008-11-25 17:14:31 -0800 | [diff] [blame] | 2921 | } |
| 2922 | |
| 2923 | void xfrm_state_fini(struct net *net) |
| 2924 | { |
Alexey Dobriyan | 73d189d | 2008-11-25 17:16:58 -0800 | [diff] [blame] | 2925 | unsigned int sz; |
| 2926 | |
Alexey Dobriyan | 7c2776e | 2008-11-25 17:57:44 -0800 | [diff] [blame] | 2927 | flush_work(&net->xfrm.state_hash_work); |
Florian Westphal | 35db57bb | 2016-08-23 16:00:12 +0200 | [diff] [blame] | 2928 | flush_work(&xfrm_state_gc_work); |
Cong Wang | dbb2483 | 2019-03-22 16:26:19 -0700 | [diff] [blame] | 2929 | xfrm_state_flush(net, 0, false, true); |
Alexey Dobriyan | 7c2776e | 2008-11-25 17:57:44 -0800 | [diff] [blame] | 2930 | |
Alexey Dobriyan | 9d4139c | 2008-11-25 17:16:11 -0800 | [diff] [blame] | 2931 | WARN_ON(!list_empty(&net->xfrm.state_all)); |
Alexey Dobriyan | 73d189d | 2008-11-25 17:16:58 -0800 | [diff] [blame] | 2932 | |
Alexey Dobriyan | 529983e | 2008-11-25 17:18:12 -0800 | [diff] [blame] | 2933 | sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head); |
Sabrina Dubroca | fe9f1d8 | 2021-04-25 21:47:12 +0200 | [diff] [blame] | 2934 | WARN_ON(!hlist_empty(net->xfrm.state_byseq)); |
| 2935 | xfrm_hash_free(net->xfrm.state_byseq, sz); |
Alexey Dobriyan | b754a4f | 2008-11-25 17:17:47 -0800 | [diff] [blame] | 2936 | WARN_ON(!hlist_empty(net->xfrm.state_byspi)); |
| 2937 | xfrm_hash_free(net->xfrm.state_byspi, sz); |
Alexey Dobriyan | d320bbb | 2008-11-25 17:17:24 -0800 | [diff] [blame] | 2938 | WARN_ON(!hlist_empty(net->xfrm.state_bysrc)); |
| 2939 | xfrm_hash_free(net->xfrm.state_bysrc, sz); |
Alexey Dobriyan | 73d189d | 2008-11-25 17:16:58 -0800 | [diff] [blame] | 2940 | WARN_ON(!hlist_empty(net->xfrm.state_bydst)); |
| 2941 | xfrm_hash_free(net->xfrm.state_bydst, sz); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2942 | } |
| 2943 | |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2944 | #ifdef CONFIG_AUDITSYSCALL |
Ilpo Järvinen | cf35f43 | 2008-01-05 23:13:20 -0800 | [diff] [blame] | 2945 | static void xfrm_audit_helper_sainfo(struct xfrm_state *x, |
| 2946 | struct audit_buffer *audit_buf) |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2947 | { |
Paul Moore | 68277ac | 2007-12-20 20:49:33 -0800 | [diff] [blame] | 2948 | struct xfrm_sec_ctx *ctx = x->security; |
| 2949 | u32 spi = ntohl(x->id.spi); |
| 2950 | |
| 2951 | if (ctx) |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2952 | audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", |
Paul Moore | 68277ac | 2007-12-20 20:49:33 -0800 | [diff] [blame] | 2953 | ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2954 | |
Weilong Chen | 9b7a787 | 2013-12-24 09:43:46 +0800 | [diff] [blame] | 2955 | switch (x->props.family) { |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2956 | case AF_INET: |
Harvey Harrison | 21454aa | 2008-10-31 00:54:56 -0700 | [diff] [blame] | 2957 | audit_log_format(audit_buf, " src=%pI4 dst=%pI4", |
| 2958 | &x->props.saddr.a4, &x->id.daddr.a4); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2959 | break; |
| 2960 | case AF_INET6: |
Harvey Harrison | 5b095d989 | 2008-10-29 12:52:50 -0700 | [diff] [blame] | 2961 | audit_log_format(audit_buf, " src=%pI6 dst=%pI6", |
Harvey Harrison | fdb46ee | 2008-10-28 16:10:17 -0700 | [diff] [blame] | 2962 | x->props.saddr.a6, x->id.daddr.a6); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2963 | break; |
| 2964 | } |
Paul Moore | 68277ac | 2007-12-20 20:49:33 -0800 | [diff] [blame] | 2965 | |
| 2966 | audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2967 | } |
| 2968 | |
Ilpo Järvinen | cf35f43 | 2008-01-05 23:13:20 -0800 | [diff] [blame] | 2969 | static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, |
| 2970 | struct audit_buffer *audit_buf) |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 2971 | { |
Eric Dumazet | b71d1d4 | 2011-04-22 04:53:02 +0000 | [diff] [blame] | 2972 | const struct iphdr *iph4; |
| 2973 | const struct ipv6hdr *iph6; |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 2974 | |
| 2975 | switch (family) { |
| 2976 | case AF_INET: |
| 2977 | iph4 = ip_hdr(skb); |
Harvey Harrison | 21454aa | 2008-10-31 00:54:56 -0700 | [diff] [blame] | 2978 | audit_log_format(audit_buf, " src=%pI4 dst=%pI4", |
| 2979 | &iph4->saddr, &iph4->daddr); |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 2980 | break; |
| 2981 | case AF_INET6: |
| 2982 | iph6 = ipv6_hdr(skb); |
| 2983 | audit_log_format(audit_buf, |
Harvey Harrison | 5b095d989 | 2008-10-29 12:52:50 -0700 | [diff] [blame] | 2984 | " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x", |
Weilong Chen | 9b7a787 | 2013-12-24 09:43:46 +0800 | [diff] [blame] | 2985 | &iph6->saddr, &iph6->daddr, |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 2986 | iph6->flow_lbl[0] & 0x0f, |
| 2987 | iph6->flow_lbl[1], |
| 2988 | iph6->flow_lbl[2]); |
| 2989 | break; |
| 2990 | } |
| 2991 | } |
| 2992 | |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 2993 | void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid) |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2994 | { |
| 2995 | struct audit_buffer *audit_buf; |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2996 | |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 2997 | audit_buf = xfrm_audit_start("SAD-add"); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 2998 | if (audit_buf == NULL) |
| 2999 | return; |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 3000 | xfrm_audit_helper_usrinfo(task_valid, audit_buf); |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 3001 | xfrm_audit_helper_sainfo(x, audit_buf); |
| 3002 | audit_log_format(audit_buf, " res=%u", result); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 3003 | audit_log_end(audit_buf); |
| 3004 | } |
| 3005 | EXPORT_SYMBOL_GPL(xfrm_audit_state_add); |
| 3006 | |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 3007 | void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid) |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 3008 | { |
| 3009 | struct audit_buffer *audit_buf; |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 3010 | |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 3011 | audit_buf = xfrm_audit_start("SAD-delete"); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 3012 | if (audit_buf == NULL) |
| 3013 | return; |
Tetsuo Handa | 2e71029 | 2014-04-22 21:48:30 +0900 | [diff] [blame] | 3014 | xfrm_audit_helper_usrinfo(task_valid, audit_buf); |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 3015 | xfrm_audit_helper_sainfo(x, audit_buf); |
| 3016 | audit_log_format(audit_buf, " res=%u", result); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 3017 | audit_log_end(audit_buf); |
| 3018 | } |
| 3019 | EXPORT_SYMBOL_GPL(xfrm_audit_state_delete); |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 3020 | |
| 3021 | void xfrm_audit_state_replay_overflow(struct xfrm_state *x, |
| 3022 | struct sk_buff *skb) |
| 3023 | { |
| 3024 | struct audit_buffer *audit_buf; |
| 3025 | u32 spi; |
| 3026 | |
| 3027 | audit_buf = xfrm_audit_start("SA-replay-overflow"); |
| 3028 | if (audit_buf == NULL) |
| 3029 | return; |
| 3030 | xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); |
| 3031 | /* don't record the sequence number because it's inherent in this kind |
| 3032 | * of audit message */ |
| 3033 | spi = ntohl(x->id.spi); |
| 3034 | audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi); |
| 3035 | audit_log_end(audit_buf); |
| 3036 | } |
| 3037 | EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow); |
| 3038 | |
Steffen Klassert | 9fdc488 | 2011-03-08 00:08:32 +0000 | [diff] [blame] | 3039 | void xfrm_audit_state_replay(struct xfrm_state *x, |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 3040 | struct sk_buff *skb, __be32 net_seq) |
| 3041 | { |
| 3042 | struct audit_buffer *audit_buf; |
| 3043 | u32 spi; |
| 3044 | |
| 3045 | audit_buf = xfrm_audit_start("SA-replayed-pkt"); |
| 3046 | if (audit_buf == NULL) |
| 3047 | return; |
| 3048 | xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); |
| 3049 | spi = ntohl(x->id.spi); |
| 3050 | audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", |
| 3051 | spi, spi, ntohl(net_seq)); |
| 3052 | audit_log_end(audit_buf); |
| 3053 | } |
Steffen Klassert | 9fdc488 | 2011-03-08 00:08:32 +0000 | [diff] [blame] | 3054 | EXPORT_SYMBOL_GPL(xfrm_audit_state_replay); |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 3055 | |
| 3056 | void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family) |
| 3057 | { |
| 3058 | struct audit_buffer *audit_buf; |
| 3059 | |
| 3060 | audit_buf = xfrm_audit_start("SA-notfound"); |
| 3061 | if (audit_buf == NULL) |
| 3062 | return; |
| 3063 | xfrm_audit_helper_pktinfo(skb, family, audit_buf); |
| 3064 | audit_log_end(audit_buf); |
| 3065 | } |
| 3066 | EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple); |
| 3067 | |
| 3068 | void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, |
| 3069 | __be32 net_spi, __be32 net_seq) |
| 3070 | { |
| 3071 | struct audit_buffer *audit_buf; |
| 3072 | u32 spi; |
| 3073 | |
| 3074 | audit_buf = xfrm_audit_start("SA-notfound"); |
| 3075 | if (audit_buf == NULL) |
| 3076 | return; |
| 3077 | xfrm_audit_helper_pktinfo(skb, family, audit_buf); |
| 3078 | spi = ntohl(net_spi); |
| 3079 | audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", |
| 3080 | spi, spi, ntohl(net_seq)); |
| 3081 | audit_log_end(audit_buf); |
| 3082 | } |
| 3083 | EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound); |
| 3084 | |
| 3085 | void xfrm_audit_state_icvfail(struct xfrm_state *x, |
| 3086 | struct sk_buff *skb, u8 proto) |
| 3087 | { |
| 3088 | struct audit_buffer *audit_buf; |
| 3089 | __be32 net_spi; |
| 3090 | __be32 net_seq; |
| 3091 | |
| 3092 | audit_buf = xfrm_audit_start("SA-icv-failure"); |
| 3093 | if (audit_buf == NULL) |
| 3094 | return; |
| 3095 | xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf); |
| 3096 | if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) { |
| 3097 | u32 spi = ntohl(net_spi); |
| 3098 | audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u", |
| 3099 | spi, spi, ntohl(net_seq)); |
| 3100 | } |
| 3101 | audit_log_end(audit_buf); |
| 3102 | } |
| 3103 | EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail); |
Joy Latten | ab5f5e8 | 2007-09-17 11:51:22 -0700 | [diff] [blame] | 3104 | #endif /* CONFIG_AUDITSYSCALL */ |