^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * xfrm_state.c
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Changes:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Mitsuru KANDA @USAGI
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Kazunori MIYAZAWA @USAGI
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * IPv6 support
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * YOSHIFUJI Hideaki @USAGI
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) * Split up af-specific functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * Derek Atkins <derek@ihtfp.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) * Add UDP Encapsulation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/workqueue.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <net/xfrm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/pfkeyv2.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <linux/ipsec.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <linux/module.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <linux/cache.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <linux/audit.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <linux/ktime.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include <linux/interrupt.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <crypto/aead.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #include "xfrm_hash.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) #define xfrm_state_deref_prot(table, net) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) rcu_dereference_protected((table), lockdep_is_held(&(net)->xfrm.xfrm_state_lock))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) static void xfrm_state_gc_task(struct work_struct *work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) /* Each xfrm_state may be linked to two tables:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) destination/tunnel endpoint. (output)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) static struct kmem_cache *xfrm_state_cache __ro_after_init;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) static HLIST_HEAD(xfrm_state_gc_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) return refcount_inc_not_zero(&x->refcnt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) static inline unsigned int xfrm_dst_hash(struct net *net,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) const xfrm_address_t *daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) const xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) u32 reqid,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) static inline unsigned int xfrm_src_hash(struct net *net,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) const xfrm_address_t *daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) const xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) static inline unsigned int
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) __be32 spi, u8 proto, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) static void xfrm_hash_transfer(struct hlist_head *list,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) struct hlist_head *ndsttable,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) struct hlist_head *nsrctable,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) struct hlist_head *nspitable,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) unsigned int nhashmask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) struct hlist_node *tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) hlist_for_each_entry_safe(x, tmp, list, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) unsigned int h;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) x->props.reqid, x->props.family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) nhashmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) hlist_add_head_rcu(&x->bydst, ndsttable + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) x->props.family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) nhashmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) hlist_add_head_rcu(&x->bysrc, nsrctable + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) if (x->id.spi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) x->id.proto, x->props.family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) nhashmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) hlist_add_head_rcu(&x->byspi, nspitable + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) static unsigned long xfrm_hash_new_size(unsigned int state_hmask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) return ((state_hmask + 1) << 1) * sizeof(struct hlist_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) static void xfrm_hash_resize(struct work_struct *work)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) struct net *net = container_of(work, struct net, xfrm.state_hash_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) unsigned long nsize, osize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) unsigned int nhashmask, ohashmask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) nsize = xfrm_hash_new_size(net->xfrm.state_hmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) ndst = xfrm_hash_alloc(nsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) if (!ndst)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) nsrc = xfrm_hash_alloc(nsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) if (!nsrc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) xfrm_hash_free(ndst, nsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) nspi = xfrm_hash_alloc(nsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) if (!nspi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) xfrm_hash_free(ndst, nsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) xfrm_hash_free(nsrc, nsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) write_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) for (i = net->xfrm.state_hmask; i >= 0; i--)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) xfrm_hash_transfer(odst + i, ndst, nsrc, nspi, nhashmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) osrc = xfrm_state_deref_prot(net->xfrm.state_bysrc, net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) ospi = xfrm_state_deref_prot(net->xfrm.state_byspi, net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) ohashmask = net->xfrm.state_hmask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) rcu_assign_pointer(net->xfrm.state_bydst, ndst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) rcu_assign_pointer(net->xfrm.state_bysrc, nsrc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) rcu_assign_pointer(net->xfrm.state_byspi, nspi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) net->xfrm.state_hmask = nhashmask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) write_seqcount_end(&net->xfrm.xfrm_state_hash_generation);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) osize = (ohashmask + 1) * sizeof(struct hlist_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) synchronize_rcu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) xfrm_hash_free(odst, osize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) xfrm_hash_free(osrc, osize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) xfrm_hash_free(ospi, osize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) static DEFINE_SPINLOCK(xfrm_state_afinfo_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) static DEFINE_SPINLOCK(xfrm_state_gc_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) int __xfrm_state_delete(struct xfrm_state *x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) static bool km_is_alive(const struct km_event *c);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) if (!afinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) return -EAFNOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) #define X(afi, T, name) do { \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) WARN_ON((afi)->type_ ## name); \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) (afi)->type_ ## name = (T); \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) } while (0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) switch (type->proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) case IPPROTO_COMP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) X(afinfo, type, comp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) case IPPROTO_AH:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) X(afinfo, type, ah);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) X(afinfo, type, esp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) case IPPROTO_IPIP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) X(afinfo, type, ipip);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) case IPPROTO_DSTOPTS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) X(afinfo, type, dstopts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) case IPPROTO_ROUTING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) X(afinfo, type, routing);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) case IPPROTO_IPV6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) X(afinfo, type, ipip6);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) WARN_ON(1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) err = -EPROTONOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) #undef X
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) EXPORT_SYMBOL(xfrm_register_type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) if (unlikely(afinfo == NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) #define X(afi, T, name) do { \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) WARN_ON((afi)->type_ ## name != (T)); \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) (afi)->type_ ## name = NULL; \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) } while (0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) switch (type->proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) case IPPROTO_COMP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) X(afinfo, type, comp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) case IPPROTO_AH:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) X(afinfo, type, ah);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) X(afinfo, type, esp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) case IPPROTO_IPIP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) X(afinfo, type, ipip);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) case IPPROTO_DSTOPTS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) X(afinfo, type, dstopts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) case IPPROTO_ROUTING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) X(afinfo, type, routing);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) case IPPROTO_IPV6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) X(afinfo, type, ipip6);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) WARN_ON(1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) #undef X
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) EXPORT_SYMBOL(xfrm_unregister_type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) const struct xfrm_type *type = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) struct xfrm_state_afinfo *afinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) int modload_attempted = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) retry:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) afinfo = xfrm_state_get_afinfo(family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) if (unlikely(afinfo == NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) switch (proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) case IPPROTO_COMP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) type = afinfo->type_comp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) case IPPROTO_AH:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) type = afinfo->type_ah;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) type = afinfo->type_esp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) case IPPROTO_IPIP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) type = afinfo->type_ipip;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) case IPPROTO_DSTOPTS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) type = afinfo->type_dstopts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) case IPPROTO_ROUTING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) type = afinfo->type_routing;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) case IPPROTO_IPV6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) type = afinfo->type_ipip6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) if (unlikely(type && !try_module_get(type->owner)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) type = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) if (!type && !modload_attempted) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) request_module("xfrm-type-%d-%d", family, proto);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) modload_attempted = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) goto retry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) return type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) static void xfrm_put_type(const struct xfrm_type *type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) module_put(type->owner);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) int xfrm_register_type_offload(const struct xfrm_type_offload *type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) if (unlikely(afinfo == NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) return -EAFNOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) switch (type->proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) WARN_ON(afinfo->type_offload_esp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) afinfo->type_offload_esp = type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) WARN_ON(1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) err = -EPROTONOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) EXPORT_SYMBOL(xfrm_register_type_offload);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) void xfrm_unregister_type_offload(const struct xfrm_type_offload *type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) if (unlikely(afinfo == NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) switch (type->proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) WARN_ON(afinfo->type_offload_esp != type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) afinfo->type_offload_esp = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) WARN_ON(1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) EXPORT_SYMBOL(xfrm_unregister_type_offload);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) static const struct xfrm_type_offload *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) xfrm_get_type_offload(u8 proto, unsigned short family, bool try_load)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) const struct xfrm_type_offload *type = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) struct xfrm_state_afinfo *afinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) retry:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) afinfo = xfrm_state_get_afinfo(family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) if (unlikely(afinfo == NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) switch (proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) type = afinfo->type_offload_esp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) if ((type && !try_module_get(type->owner)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) type = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) if (!type && try_load) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) request_module("xfrm-offload-%d-%d", family, proto);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) try_load = false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) goto retry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) return type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) static void xfrm_put_type_offload(const struct xfrm_type_offload *type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) module_put(type->owner);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) static const struct xfrm_mode xfrm4_mode_map[XFRM_MODE_MAX] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) [XFRM_MODE_BEET] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) .encap = XFRM_MODE_BEET,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) .flags = XFRM_MODE_FLAG_TUNNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) .family = AF_INET,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) [XFRM_MODE_TRANSPORT] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) .encap = XFRM_MODE_TRANSPORT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) .family = AF_INET,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) [XFRM_MODE_TUNNEL] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) .encap = XFRM_MODE_TUNNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) .flags = XFRM_MODE_FLAG_TUNNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) .family = AF_INET,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) static const struct xfrm_mode xfrm6_mode_map[XFRM_MODE_MAX] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) [XFRM_MODE_BEET] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) .encap = XFRM_MODE_BEET,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) .flags = XFRM_MODE_FLAG_TUNNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) .family = AF_INET6,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) [XFRM_MODE_ROUTEOPTIMIZATION] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) .encap = XFRM_MODE_ROUTEOPTIMIZATION,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) .family = AF_INET6,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) [XFRM_MODE_TRANSPORT] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) .encap = XFRM_MODE_TRANSPORT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) .family = AF_INET6,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) [XFRM_MODE_TUNNEL] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) .encap = XFRM_MODE_TUNNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) .flags = XFRM_MODE_FLAG_TUNNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) .family = AF_INET6,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) static const struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) const struct xfrm_mode *mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) if (unlikely(encap >= XFRM_MODE_MAX))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) switch (family) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) case AF_INET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) mode = &xfrm4_mode_map[encap];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) if (mode->family == family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) return mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) case AF_INET6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) mode = &xfrm6_mode_map[encap];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) if (mode->family == family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) return mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) void xfrm_state_free(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) kmem_cache_free(xfrm_state_cache, x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) EXPORT_SYMBOL(xfrm_state_free);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) static void ___xfrm_state_destroy(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) hrtimer_cancel(&x->mtimer);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) del_timer_sync(&x->rtimer);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) kfree(x->aead);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) kfree(x->aalg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) kfree(x->ealg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) kfree(x->calg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) kfree(x->encap);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) kfree(x->coaddr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) kfree(x->replay_esn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) kfree(x->preplay_esn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) if (x->type_offload)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) xfrm_put_type_offload(x->type_offload);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) if (x->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) x->type->destructor(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) xfrm_put_type(x->type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) if (x->xfrag.page)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) put_page(x->xfrag.page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) xfrm_dev_state_free(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) security_xfrm_state_free(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) xfrm_state_free(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) static void xfrm_state_gc_task(struct work_struct *work)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) struct hlist_node *tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) struct hlist_head gc_list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) spin_lock_bh(&xfrm_state_gc_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) hlist_move_list(&xfrm_state_gc_list, &gc_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) spin_unlock_bh(&xfrm_state_gc_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) synchronize_rcu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) ___xfrm_state_destroy(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) struct xfrm_state *x = container_of(me, struct xfrm_state, mtimer);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) enum hrtimer_restart ret = HRTIMER_NORESTART;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) time64_t now = ktime_get_real_seconds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) time64_t next = TIME64_MAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) int warn = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) spin_lock(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) if (x->km.state == XFRM_STATE_DEAD)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) if (x->km.state == XFRM_STATE_EXPIRED)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) goto expired;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) if (x->lft.hard_add_expires_seconds) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) long tmo = x->lft.hard_add_expires_seconds +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) x->curlft.add_time - now;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) if (tmo <= 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) if (x->xflags & XFRM_SOFT_EXPIRE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) /* enter hard expire without soft expire first?!
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) * setting a new date could trigger this.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) * workaround: fix x->curflt.add_time by below:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) x->curlft.add_time = now - x->saved_tmo - 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) tmo = x->lft.hard_add_expires_seconds - x->saved_tmo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) goto expired;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) if (tmo < next)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) next = tmo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) if (x->lft.hard_use_expires_seconds) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) long tmo = x->lft.hard_use_expires_seconds +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) (x->curlft.use_time ? : now) - now;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) if (tmo <= 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) goto expired;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) if (tmo < next)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) next = tmo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) if (x->km.dying)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) goto resched;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) if (x->lft.soft_add_expires_seconds) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562) long tmo = x->lft.soft_add_expires_seconds +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) x->curlft.add_time - now;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) if (tmo <= 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565) warn = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) x->xflags &= ~XFRM_SOFT_EXPIRE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) } else if (tmo < next) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) next = tmo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) x->xflags |= XFRM_SOFT_EXPIRE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) x->saved_tmo = tmo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) if (x->lft.soft_use_expires_seconds) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) long tmo = x->lft.soft_use_expires_seconds +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) (x->curlft.use_time ? : now) - now;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) if (tmo <= 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) warn = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578) else if (tmo < next)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) next = tmo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582) x->km.dying = warn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583) if (warn)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) km_state_expired(x, 0, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) resched:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) if (next != TIME64_MAX) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587) hrtimer_forward_now(&x->mtimer, ktime_set(next, 0));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) ret = HRTIMER_RESTART;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) expired:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595) x->km.state = XFRM_STATE_EXPIRED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) err = __xfrm_state_delete(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) if (!err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599) km_state_expired(x, 1, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) xfrm_audit_state_delete(x, err ? 0 : 1, true);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) spin_unlock(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) static void xfrm_replay_timer_handler(struct timer_list *t);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610) struct xfrm_state *xfrm_state_alloc(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) x = kmem_cache_zalloc(xfrm_state_cache, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616) if (x) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) write_pnet(&x->xs_net, net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618) refcount_set(&x->refcnt, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619) atomic_set(&x->tunnel_users, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620) INIT_LIST_HEAD(&x->km.all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) INIT_HLIST_NODE(&x->bydst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622) INIT_HLIST_NODE(&x->bysrc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) INIT_HLIST_NODE(&x->byspi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624) hrtimer_init(&x->mtimer, CLOCK_BOOTTIME, HRTIMER_MODE_ABS_SOFT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625) x->mtimer.function = xfrm_timer_handler;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626) timer_setup(&x->rtimer, xfrm_replay_timer_handler, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) x->curlft.add_time = ktime_get_real_seconds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) x->lft.soft_byte_limit = XFRM_INF;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) x->lft.soft_packet_limit = XFRM_INF;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630) x->lft.hard_byte_limit = XFRM_INF;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631) x->lft.hard_packet_limit = XFRM_INF;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) x->replay_maxage = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) x->replay_maxdiff = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634) spin_lock_init(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638) EXPORT_SYMBOL(xfrm_state_alloc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640) void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) WARN_ON(x->km.state != XFRM_STATE_DEAD);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644) if (sync) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645) synchronize_rcu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646) ___xfrm_state_destroy(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648) spin_lock_bh(&xfrm_state_gc_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) hlist_add_head(&x->gclist, &xfrm_state_gc_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650) spin_unlock_bh(&xfrm_state_gc_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) schedule_work(&xfrm_state_gc_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654) EXPORT_SYMBOL(__xfrm_state_destroy);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656) int __xfrm_state_delete(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658) struct net *net = xs_net(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) int err = -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661) if (x->km.state != XFRM_STATE_DEAD) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) x->km.state = XFRM_STATE_DEAD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663) spin_lock(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) list_del(&x->km.all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) hlist_del_rcu(&x->bydst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) hlist_del_rcu(&x->bysrc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667) if (x->id.spi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668) hlist_del_rcu(&x->byspi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) net->xfrm.state_num--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670) spin_unlock(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672) if (x->encap_sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) sock_put(rcu_dereference_raw(x->encap_sk));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675) xfrm_dev_state_delete(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677) /* All xfrm_state objects are created by xfrm_state_alloc.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) * The xfrm_state_alloc call gives a reference, and that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679) * is what we are dropping here.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681) xfrm_state_put(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) EXPORT_SYMBOL(__xfrm_state_delete);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689) int xfrm_state_delete(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693) spin_lock_bh(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) err = __xfrm_state_delete(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) spin_unlock_bh(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) EXPORT_SYMBOL(xfrm_state_delete);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701) #ifdef CONFIG_SECURITY_NETWORK_XFRM
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702) static inline int
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703) xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) int i, err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707) for (i = 0; i <= net->xfrm.state_hmask; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711) if (xfrm_id_proto_match(x->id.proto, proto) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) (err = security_xfrm_state_delete(x)) != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713) xfrm_audit_state_delete(x, 0, task_valid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) static inline int
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723) xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) int i, err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) for (i = 0; i <= net->xfrm.state_hmask; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) struct xfrm_state_offload *xso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731) hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) xso = &x->xso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734) if (xso->dev == dev &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) (err = security_xfrm_state_delete(x)) != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) xfrm_audit_state_delete(x, 0, task_valid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745) static inline int
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) static inline int
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758) int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760) int i, err = 0, cnt = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) err = xfrm_state_flush_secctx_check(net, proto, task_valid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767) err = -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) for (i = 0; i <= net->xfrm.state_hmask; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770) restart:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) if (!xfrm_state_kern(x) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773) xfrm_id_proto_match(x->id.proto, proto)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777) err = xfrm_state_delete(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778) xfrm_audit_state_delete(x, err ? 0 : 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) task_valid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780) if (sync)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) xfrm_state_put_sync(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783) xfrm_state_put(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784) if (!err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785) cnt++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) goto restart;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) if (cnt)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) EXPORT_SYMBOL(xfrm_state_flush);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801) int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803) int i, err = 0, cnt = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 806) err = xfrm_dev_state_flush_secctx_check(net, dev, task_valid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 807) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 808) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 809)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 810) err = -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 811) for (i = 0; i <= net->xfrm.state_hmask; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 812) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 813) struct xfrm_state_offload *xso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 814) restart:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 815) hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 816) xso = &x->xso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 817)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 818) if (!xfrm_state_kern(x) && xso->dev == dev) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 819) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 820) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 821)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 822) err = xfrm_state_delete(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 823) xfrm_audit_state_delete(x, err ? 0 : 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 824) task_valid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 825) xfrm_state_put(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 826) if (!err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 827) cnt++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 828)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 829) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 830) goto restart;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 831) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 832) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 833) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 834) if (cnt)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 835) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 836)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 837) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 838) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 839) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 840) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 841) EXPORT_SYMBOL(xfrm_dev_state_flush);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 842)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 843) void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 844) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 845) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 846) si->sadcnt = net->xfrm.state_num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 847) si->sadhcnt = net->xfrm.state_hmask + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 848) si->sadhmcnt = xfrm_state_hashmax;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 849) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 850) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 851) EXPORT_SYMBOL(xfrm_sad_getinfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 852)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 853) static void
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 854) __xfrm4_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 855) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 856) const struct flowi4 *fl4 = &fl->u.ip4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 857)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 858) sel->daddr.a4 = fl4->daddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 859) sel->saddr.a4 = fl4->saddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 860) sel->dport = xfrm_flowi_dport(fl, &fl4->uli);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 861) sel->dport_mask = htons(0xffff);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 862) sel->sport = xfrm_flowi_sport(fl, &fl4->uli);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 863) sel->sport_mask = htons(0xffff);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 864) sel->family = AF_INET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 865) sel->prefixlen_d = 32;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 866) sel->prefixlen_s = 32;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 867) sel->proto = fl4->flowi4_proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 868) sel->ifindex = fl4->flowi4_oif;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 869) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 870)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 871) static void
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 872) __xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 873) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 874) const struct flowi6 *fl6 = &fl->u.ip6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 875)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 876) /* Initialize temporary selector matching only to current session. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 877) *(struct in6_addr *)&sel->daddr = fl6->daddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 878) *(struct in6_addr *)&sel->saddr = fl6->saddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 879) sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 880) sel->dport_mask = htons(0xffff);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 881) sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 882) sel->sport_mask = htons(0xffff);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 883) sel->family = AF_INET6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 884) sel->prefixlen_d = 128;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 885) sel->prefixlen_s = 128;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 886) sel->proto = fl6->flowi6_proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 887) sel->ifindex = fl6->flowi6_oif;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 888) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 889)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 890) static void
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 891) xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 892) const struct xfrm_tmpl *tmpl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 893) const xfrm_address_t *daddr, const xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 894) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 895) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 896) switch (family) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 897) case AF_INET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 898) __xfrm4_init_tempsel(&x->sel, fl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 899) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 900) case AF_INET6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 901) __xfrm6_init_tempsel(&x->sel, fl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 902) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 903) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 904)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 905) x->id = tmpl->id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 906)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 907) switch (tmpl->encap_family) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 908) case AF_INET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 909) if (x->id.daddr.a4 == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 910) x->id.daddr.a4 = daddr->a4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 911) x->props.saddr = tmpl->saddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 912) if (x->props.saddr.a4 == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 913) x->props.saddr.a4 = saddr->a4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 914) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 915) case AF_INET6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 916) if (ipv6_addr_any((struct in6_addr *)&x->id.daddr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 917) memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 918) memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 919) if (ipv6_addr_any((struct in6_addr *)&x->props.saddr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 920) memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 921) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 922) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 923)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 924) x->props.mode = tmpl->mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 925) x->props.reqid = tmpl->reqid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 926) x->props.family = tmpl->encap_family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 927) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 928)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 929) static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 930) const xfrm_address_t *daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 931) __be32 spi, u8 proto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 932) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 933) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 934) unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 935) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 936)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 937) hlist_for_each_entry_rcu(x, net->xfrm.state_byspi + h, byspi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 938) if (x->props.family != family ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 939) x->id.spi != spi ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 940) x->id.proto != proto ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 941) !xfrm_addr_equal(&x->id.daddr, daddr, family))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 942) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 943)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 944) if ((mark & x->mark.m) != x->mark.v)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 945) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 946) if (!xfrm_state_hold_rcu(x))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 947) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 948) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 949) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 950)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 951) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 952) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 953)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 954) static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 955) const xfrm_address_t *daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 956) const xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 957) u8 proto, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 958) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 959) unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 960) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 961)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 962) hlist_for_each_entry_rcu(x, net->xfrm.state_bysrc + h, bysrc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 963) if (x->props.family != family ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 964) x->id.proto != proto ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 965) !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 966) !xfrm_addr_equal(&x->props.saddr, saddr, family))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 967) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 968)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 969) if ((mark & x->mark.m) != x->mark.v)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 970) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 971) if (!xfrm_state_hold_rcu(x))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 972) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 973) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 974) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 975)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 976) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 977) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 978)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 979) static inline struct xfrm_state *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 980) __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 981) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 982) struct net *net = xs_net(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 983) u32 mark = x->mark.v & x->mark.m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 984)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 985) if (use_spi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 986) return __xfrm_state_lookup(net, mark, &x->id.daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 987) x->id.spi, x->id.proto, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 988) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 989) return __xfrm_state_lookup_byaddr(net, mark,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 990) &x->id.daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 991) &x->props.saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 992) x->id.proto, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 993) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 994)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 995) static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 996) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 997) if (have_hash_collision &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 998) (net->xfrm.state_hmask + 1) < xfrm_state_hashmax &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 999) net->xfrm.state_num > net->xfrm.state_hmask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1000) schedule_work(&net->xfrm.state_hash_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1001) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1002)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1003) static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1004) const struct flowi *fl, unsigned short family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1005) struct xfrm_state **best, int *acq_in_progress,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1006) int *error)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1007) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1008) /* Resolution logic:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1009) * 1. There is a valid state with matching selector. Done.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1010) * 2. Valid state with inappropriate selector. Skip.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1011) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1012) * Entering area of "sysdeps".
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1013) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1014) * 3. If state is not valid, selector is temporary, it selects
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1015) * only session which triggered previous resolution. Key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1016) * manager will do something to install a state with proper
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1017) * selector.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1018) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1019) if (x->km.state == XFRM_STATE_VALID) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1020) if ((x->sel.family &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1021) (x->sel.family != family ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1022) !xfrm_selector_match(&x->sel, fl, family))) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1023) !security_xfrm_state_pol_flow_match(x, pol, fl))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1024) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1025)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1026) if (!*best ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1027) (*best)->km.dying > x->km.dying ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1028) ((*best)->km.dying == x->km.dying &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1029) (*best)->curlft.add_time < x->curlft.add_time))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1030) *best = x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1031) } else if (x->km.state == XFRM_STATE_ACQ) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1032) *acq_in_progress = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1033) } else if (x->km.state == XFRM_STATE_ERROR ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1034) x->km.state == XFRM_STATE_EXPIRED) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1035) if ((!x->sel.family ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1036) (x->sel.family == family &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1037) xfrm_selector_match(&x->sel, fl, family))) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1038) security_xfrm_state_pol_flow_match(x, pol, fl))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1039) *error = -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1040) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1041) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1042)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1043) struct xfrm_state *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1044) xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1045) const struct flowi *fl, struct xfrm_tmpl *tmpl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1046) struct xfrm_policy *pol, int *err,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1047) unsigned short family, u32 if_id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1048) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1049) static xfrm_address_t saddr_wildcard = { };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1050) struct net *net = xp_net(pol);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1051) unsigned int h, h_wildcard;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1052) struct xfrm_state *x, *x0, *to_put;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1053) int acquire_in_progress = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1054) int error = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1055) struct xfrm_state *best = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1056) u32 mark = pol->mark.v & pol->mark.m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1057) unsigned short encap_family = tmpl->encap_family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1058) unsigned int sequence;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1059) struct km_event c;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1060)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1061) to_put = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1062)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1063) sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1064)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1065) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1066) h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1067) hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1068) if (x->props.family == encap_family &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1069) x->props.reqid == tmpl->reqid &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1070) (mark & x->mark.m) == x->mark.v &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1071) x->if_id == if_id &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1072) !(x->props.flags & XFRM_STATE_WILDRECV) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1073) xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1074) tmpl->mode == x->props.mode &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1075) tmpl->id.proto == x->id.proto &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1076) (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1077) xfrm_state_look_at(pol, x, fl, family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1078) &best, &acquire_in_progress, &error);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1079) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1080) if (best || acquire_in_progress)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1081) goto found;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1082)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1083) h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1084) hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h_wildcard, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1085) if (x->props.family == encap_family &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1086) x->props.reqid == tmpl->reqid &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1087) (mark & x->mark.m) == x->mark.v &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1088) x->if_id == if_id &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1089) !(x->props.flags & XFRM_STATE_WILDRECV) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1090) xfrm_addr_equal(&x->id.daddr, daddr, encap_family) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1091) tmpl->mode == x->props.mode &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1092) tmpl->id.proto == x->id.proto &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1093) (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1094) xfrm_state_look_at(pol, x, fl, family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1095) &best, &acquire_in_progress, &error);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1096) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1097)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1098) found:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1099) x = best;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1100) if (!x && !error && !acquire_in_progress) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1101) if (tmpl->id.spi &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1102) (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1103) tmpl->id.proto, encap_family)) != NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1104) to_put = x0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1105) error = -EEXIST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1106) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1107) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1109) c.net = net;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1110) /* If the KMs have no listeners (yet...), avoid allocating an SA
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1111) * for each and every packet - garbage collection might not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1112) * handle the flood.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1113) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1114) if (!km_is_alive(&c)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1115) error = -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1116) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1117) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1119) x = xfrm_state_alloc(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1120) if (x == NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1121) error = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1122) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1123) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1124) /* Initialize temporary state matching only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1125) * to current session. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1126) xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1127) memcpy(&x->mark, &pol->mark, sizeof(x->mark));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1128) x->if_id = if_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1130) error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1131) if (error) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1132) x->km.state = XFRM_STATE_DEAD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1133) to_put = x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1134) x = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1135) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1136) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1137)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1138) if (km_query(x, tmpl, pol) == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1139) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1140) x->km.state = XFRM_STATE_ACQ;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1141) list_add(&x->km.all, &net->xfrm.state_all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1142) hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1143) h = xfrm_src_hash(net, daddr, saddr, encap_family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1144) hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1145) if (x->id.spi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1146) h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1147) hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1148) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1149) x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1150) hrtimer_start(&x->mtimer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1151) ktime_set(net->xfrm.sysctl_acq_expires, 0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1152) HRTIMER_MODE_REL_SOFT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1153) net->xfrm.state_num++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1154) xfrm_hash_grow_check(net, x->bydst.next != NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1155) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1156) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1157) x->km.state = XFRM_STATE_DEAD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1158) to_put = x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1159) x = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1160) error = -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1161) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1162) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1163) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1164) if (x) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1165) if (!xfrm_state_hold_rcu(x)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1166) *err = -EAGAIN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1167) x = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1168) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1169) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1170) *err = acquire_in_progress ? -EAGAIN : error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1171) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1172) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1173) if (to_put)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1174) xfrm_state_put(to_put);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1176) if (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, sequence)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1177) *err = -EAGAIN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1178) if (x) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1179) xfrm_state_put(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1180) x = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1181) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1182) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1183)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1184) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1185) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1186)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1187) struct xfrm_state *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1188) xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1189) xfrm_address_t *daddr, xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1190) unsigned short family, u8 mode, u8 proto, u32 reqid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1191) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1192) unsigned int h;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1193) struct xfrm_state *rx = NULL, *x = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1194)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1195) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1196) h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1197) hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1198) if (x->props.family == family &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1199) x->props.reqid == reqid &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1200) (mark & x->mark.m) == x->mark.v &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1201) x->if_id == if_id &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1202) !(x->props.flags & XFRM_STATE_WILDRECV) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1203) xfrm_state_addr_check(x, daddr, saddr, family) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1204) mode == x->props.mode &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1205) proto == x->id.proto &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1206) x->km.state == XFRM_STATE_VALID) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1207) rx = x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1208) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1209) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1210) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1211)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1212) if (rx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1213) xfrm_state_hold(rx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1214) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1215)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1216)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1217) return rx;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1218) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1219) EXPORT_SYMBOL(xfrm_stateonly_find);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1220)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1221) struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1222) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1223) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1224) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1225) struct xfrm_state_walk *w;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1226)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1227) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1228) list_for_each_entry(w, &net->xfrm.state_all, all) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1229) x = container_of(w, struct xfrm_state, km);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1230) if (x->props.family != family ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1231) x->id.spi != spi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1232) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1233)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1234) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1235) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1236) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1237) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1238) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1239) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1240) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1241) EXPORT_SYMBOL(xfrm_state_lookup_byspi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1242)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1243) static void __xfrm_state_insert(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1244) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1245) struct net *net = xs_net(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1246) unsigned int h;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1247)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1248) list_add(&x->km.all, &net->xfrm.state_all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1249)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1250) h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1251) x->props.reqid, x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1252) hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1253)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1254) h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1255) hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1256)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1257) if (x->id.spi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1258) h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1259) x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1260)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1261) hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1262) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1263)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1264) hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1265) if (x->replay_maxage)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1266) mod_timer(&x->rtimer, jiffies + x->replay_maxage);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1267)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1268) net->xfrm.state_num++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1269)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1270) xfrm_hash_grow_check(net, x->bydst.next != NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1271) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1272)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1273) /* net->xfrm.xfrm_state_lock is held */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1274) static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1275) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1276) struct net *net = xs_net(xnew);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1277) unsigned short family = xnew->props.family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1278) u32 reqid = xnew->props.reqid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1279) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1280) unsigned int h;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1281) u32 mark = xnew->mark.v & xnew->mark.m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1282) u32 if_id = xnew->if_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1284) h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1285) hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1286) if (x->props.family == family &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1287) x->props.reqid == reqid &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1288) x->if_id == if_id &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1289) (mark & x->mark.m) == x->mark.v &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1290) xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1291) xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1292) x->genid++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1293) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1294) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1295)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1296) void xfrm_state_insert(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1297) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1298) struct net *net = xs_net(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1299)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1300) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1301) __xfrm_state_bump_genids(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1302) __xfrm_state_insert(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1303) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1304) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1305) EXPORT_SYMBOL(xfrm_state_insert);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1306)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1307) /* net->xfrm.xfrm_state_lock is held */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1308) static struct xfrm_state *__find_acq_core(struct net *net,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1309) const struct xfrm_mark *m,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1310) unsigned short family, u8 mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1311) u32 reqid, u32 if_id, u8 proto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1312) const xfrm_address_t *daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1313) const xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1314) int create)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1315) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1316) unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1317) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1318) u32 mark = m->v & m->m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1319)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1320) hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1321) if (x->props.reqid != reqid ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1322) x->props.mode != mode ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1323) x->props.family != family ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1324) x->km.state != XFRM_STATE_ACQ ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1325) x->id.spi != 0 ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1326) x->id.proto != proto ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1327) (mark & x->mark.m) != x->mark.v ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1328) !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1329) !xfrm_addr_equal(&x->props.saddr, saddr, family))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1330) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1331)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1332) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1333) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1334) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1335)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1336) if (!create)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1337) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1338)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1339) x = xfrm_state_alloc(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1340) if (likely(x)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1341) switch (family) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1342) case AF_INET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1343) x->sel.daddr.a4 = daddr->a4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1344) x->sel.saddr.a4 = saddr->a4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1345) x->sel.prefixlen_d = 32;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1346) x->sel.prefixlen_s = 32;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1347) x->props.saddr.a4 = saddr->a4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1348) x->id.daddr.a4 = daddr->a4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1349) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1350)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1351) case AF_INET6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1352) x->sel.daddr.in6 = daddr->in6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1353) x->sel.saddr.in6 = saddr->in6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1354) x->sel.prefixlen_d = 128;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1355) x->sel.prefixlen_s = 128;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1356) x->props.saddr.in6 = saddr->in6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1357) x->id.daddr.in6 = daddr->in6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1358) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1359) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1360)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1361) x->km.state = XFRM_STATE_ACQ;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1362) x->id.proto = proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1363) x->props.family = family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1364) x->props.mode = mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1365) x->props.reqid = reqid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1366) x->if_id = if_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1367) x->mark.v = m->v;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1368) x->mark.m = m->m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1369) x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1370) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1371) hrtimer_start(&x->mtimer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1372) ktime_set(net->xfrm.sysctl_acq_expires, 0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1373) HRTIMER_MODE_REL_SOFT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1374) list_add(&x->km.all, &net->xfrm.state_all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1375) hlist_add_head_rcu(&x->bydst, net->xfrm.state_bydst + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1376) h = xfrm_src_hash(net, daddr, saddr, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1377) hlist_add_head_rcu(&x->bysrc, net->xfrm.state_bysrc + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1378)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1379) net->xfrm.state_num++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1381) xfrm_hash_grow_check(net, x->bydst.next != NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1382) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1383)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1384) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1385) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1386)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1387) static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1388)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1389) int xfrm_state_add(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1390) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1391) struct net *net = xs_net(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1392) struct xfrm_state *x1, *to_put;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1393) int family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1394) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1395) u32 mark = x->mark.v & x->mark.m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1396) int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1397)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1398) family = x->props.family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1399)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1400) to_put = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1401)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1402) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1403)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1404) x1 = __xfrm_state_locate(x, use_spi, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1405) if (x1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1406) to_put = x1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1407) x1 = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1408) err = -EEXIST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1409) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1410) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1411)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1412) if (use_spi && x->km.seq) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1413) x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1414) if (x1 && ((x1->id.proto != x->id.proto) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1415) !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1416) to_put = x1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1417) x1 = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1418) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1419) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1420)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1421) if (use_spi && !x1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1422) x1 = __find_acq_core(net, &x->mark, family, x->props.mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1423) x->props.reqid, x->if_id, x->id.proto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1424) &x->id.daddr, &x->props.saddr, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1425)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1426) __xfrm_state_bump_genids(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1427) __xfrm_state_insert(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1428) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1429)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1430) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1431) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1432)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1433) if (x1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1434) xfrm_state_delete(x1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1435) xfrm_state_put(x1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1436) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1438) if (to_put)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1439) xfrm_state_put(to_put);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1440)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1441) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1442) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1443) EXPORT_SYMBOL(xfrm_state_add);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1444)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1445) #ifdef CONFIG_XFRM_MIGRATE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1446) static inline int clone_security(struct xfrm_state *x, struct xfrm_sec_ctx *security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1447) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1448) struct xfrm_user_sec_ctx *uctx;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1449) int size = sizeof(*uctx) + security->ctx_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1450) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1451)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1452) uctx = kmalloc(size, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1453) if (!uctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1454) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1455)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1456) uctx->exttype = XFRMA_SEC_CTX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1457) uctx->len = size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1458) uctx->ctx_doi = security->ctx_doi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1459) uctx->ctx_alg = security->ctx_alg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1460) uctx->ctx_len = security->ctx_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1461) memcpy(uctx + 1, security->ctx_str, security->ctx_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1462) err = security_xfrm_state_alloc(x, uctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1463) kfree(uctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1464) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1465) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1466)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1467) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1468) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1470) static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1471) struct xfrm_encap_tmpl *encap)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1472) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1473) struct net *net = xs_net(orig);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1474) struct xfrm_state *x = xfrm_state_alloc(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1475) if (!x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1476) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1477)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1478) memcpy(&x->id, &orig->id, sizeof(x->id));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1479) memcpy(&x->sel, &orig->sel, sizeof(x->sel));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1480) memcpy(&x->lft, &orig->lft, sizeof(x->lft));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1481) x->props.mode = orig->props.mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1482) x->props.replay_window = orig->props.replay_window;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1483) x->props.reqid = orig->props.reqid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1484) x->props.family = orig->props.family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1485) x->props.saddr = orig->props.saddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1486)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1487) if (orig->aalg) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1488) x->aalg = xfrm_algo_auth_clone(orig->aalg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1489) if (!x->aalg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1490) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1491) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1492) x->props.aalgo = orig->props.aalgo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1493)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1494) if (orig->aead) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1495) x->aead = xfrm_algo_aead_clone(orig->aead);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1496) x->geniv = orig->geniv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1497) if (!x->aead)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1498) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1499) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1500) if (orig->ealg) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1501) x->ealg = xfrm_algo_clone(orig->ealg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1502) if (!x->ealg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1503) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1504) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1505) x->props.ealgo = orig->props.ealgo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1506)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1507) if (orig->calg) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1508) x->calg = xfrm_algo_clone(orig->calg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1509) if (!x->calg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1510) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1511) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1512) x->props.calgo = orig->props.calgo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1513)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1514) if (encap || orig->encap) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1515) if (encap)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1516) x->encap = kmemdup(encap, sizeof(*x->encap),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1517) GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1518) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1519) x->encap = kmemdup(orig->encap, sizeof(*x->encap),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1520) GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1521)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1522) if (!x->encap)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1523) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1524) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1525)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1526) if (orig->security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1527) if (clone_security(x, orig->security))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1528) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1529)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1530) if (orig->coaddr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1531) x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1532) GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1533) if (!x->coaddr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1534) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1535) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1536)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1537) if (orig->replay_esn) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1538) if (xfrm_replay_clone(x, orig))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1539) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1540) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1541)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1542) memcpy(&x->mark, &orig->mark, sizeof(x->mark));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1543) memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1544)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1545) x->props.flags = orig->props.flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1546) x->props.extra_flags = orig->props.extra_flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1547)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1548) x->if_id = orig->if_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1549) x->tfcpad = orig->tfcpad;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1550) x->replay_maxdiff = orig->replay_maxdiff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1551) x->replay_maxage = orig->replay_maxage;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1552) memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1553) x->km.state = orig->km.state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1554) x->km.seq = orig->km.seq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1555) x->replay = orig->replay;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1556) x->preplay = orig->preplay;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1557)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1558) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1559)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1560) error:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1561) xfrm_state_put(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1562) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1563) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1564) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1565)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1566) struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1567) u32 if_id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1568) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1569) unsigned int h;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1570) struct xfrm_state *x = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1571)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1572) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1573)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1574) if (m->reqid) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1575) h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1576) m->reqid, m->old_family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1577) hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1578) if (x->props.mode != m->mode ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1579) x->id.proto != m->proto)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1580) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1581) if (m->reqid && x->props.reqid != m->reqid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1582) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1583) if (if_id != 0 && x->if_id != if_id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1584) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1585) if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1586) m->old_family) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1587) !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1588) m->old_family))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1589) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1590) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1591) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1592) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1593) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1594) h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1595) m->old_family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1596) hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1597) if (x->props.mode != m->mode ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1598) x->id.proto != m->proto)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1599) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1600) if (if_id != 0 && x->if_id != if_id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1601) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1602) if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1603) m->old_family) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1604) !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1605) m->old_family))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1606) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1607) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1608) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1609) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1610) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1611)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1612) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1613)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1614) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1615) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1616) EXPORT_SYMBOL(xfrm_migrate_state_find);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1617)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1618) struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1619) struct xfrm_migrate *m,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1620) struct xfrm_encap_tmpl *encap)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1621) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1622) struct xfrm_state *xc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1623)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1624) xc = xfrm_state_clone(x, encap);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1625) if (!xc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1626) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1627)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1628) xc->props.family = m->new_family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1629)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1630) if (xfrm_init_state(xc) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1631) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1632)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1633) memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1634) memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1635)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1636) /* add state */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1637) if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1638) /* a care is needed when the destination address of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1639) state is to be updated as it is a part of triplet */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1640) xfrm_state_insert(xc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1641) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1642) if (xfrm_state_add(xc) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1643) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1644) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1645)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1646) return xc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1647) error:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1648) xfrm_state_put(xc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1649) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1650) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1651) EXPORT_SYMBOL(xfrm_state_migrate);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1652) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1653)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1654) int xfrm_state_update(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1655) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1656) struct xfrm_state *x1, *to_put;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1657) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1658) int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1659) struct net *net = xs_net(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1660)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1661) to_put = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1662)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1663) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1664) x1 = __xfrm_state_locate(x, use_spi, x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1665)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1666) err = -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1667) if (!x1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1668) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1669)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1670) if (xfrm_state_kern(x1)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1671) to_put = x1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1672) err = -EEXIST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1673) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1674) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1675)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1676) if (x1->km.state == XFRM_STATE_ACQ) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1677) __xfrm_state_insert(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1678) x = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1679) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1680) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1681)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1682) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1683) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1684)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1685) if (to_put)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1686) xfrm_state_put(to_put);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1687)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1688) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1689) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1690)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1691) if (!x) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1692) xfrm_state_delete(x1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1693) xfrm_state_put(x1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1694) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1695) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1696)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1697) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1698) spin_lock_bh(&x1->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1699) if (likely(x1->km.state == XFRM_STATE_VALID)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1700) if (x->encap && x1->encap &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1701) x->encap->encap_type == x1->encap->encap_type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1702) memcpy(x1->encap, x->encap, sizeof(*x1->encap));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1703) else if (x->encap || x1->encap)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1704) goto fail;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1705)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1706) if (x->coaddr && x1->coaddr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1707) memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1708) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1709) if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1710) memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1711) memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1712) x1->km.dying = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1713)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1714) hrtimer_start(&x1->mtimer, ktime_set(1, 0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1715) HRTIMER_MODE_REL_SOFT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1716) if (x1->curlft.use_time)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1717) xfrm_state_check_expire(x1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1718)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1719) if (x->props.smark.m || x->props.smark.v || x->if_id) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1720) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1721)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1722) if (x->props.smark.m || x->props.smark.v)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1723) x1->props.smark = x->props.smark;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1724)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1725) if (x->if_id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1726) x1->if_id = x->if_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1727)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1728) __xfrm_state_bump_genids(x1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1729) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1730) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1731)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1732) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1733) x->km.state = XFRM_STATE_DEAD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1734) __xfrm_state_put(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1735) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1736)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1737) fail:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1738) spin_unlock_bh(&x1->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1739)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1740) xfrm_state_put(x1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1741)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1742) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1743) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1744) EXPORT_SYMBOL(xfrm_state_update);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1745)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1746) int xfrm_state_check_expire(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1747) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1748) if (!x->curlft.use_time)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1749) x->curlft.use_time = ktime_get_real_seconds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1750)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1751) if (x->curlft.bytes >= x->lft.hard_byte_limit ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1752) x->curlft.packets >= x->lft.hard_packet_limit) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1753) x->km.state = XFRM_STATE_EXPIRED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1754) hrtimer_start(&x->mtimer, 0, HRTIMER_MODE_REL_SOFT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1755) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1756) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1757)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1758) if (!x->km.dying &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1759) (x->curlft.bytes >= x->lft.soft_byte_limit ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1760) x->curlft.packets >= x->lft.soft_packet_limit)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1761) x->km.dying = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1762) km_state_expired(x, 0, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1763) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1764) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1765) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1766) EXPORT_SYMBOL(xfrm_state_check_expire);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1767)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1768) struct xfrm_state *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1769) xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1770) u8 proto, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1771) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1772) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1773)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1774) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1775) x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1776) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1777) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1778) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1779) EXPORT_SYMBOL(xfrm_state_lookup);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1780)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1781) struct xfrm_state *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1782) xfrm_state_lookup_byaddr(struct net *net, u32 mark,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1783) const xfrm_address_t *daddr, const xfrm_address_t *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1784) u8 proto, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1785) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1786) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1787)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1788) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1789) x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1790) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1791) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1792) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1793) EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1794)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1795) struct xfrm_state *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1796) xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1797) u32 if_id, u8 proto, const xfrm_address_t *daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1798) const xfrm_address_t *saddr, int create, unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1799) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1800) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1801)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1802) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1803) x = __find_acq_core(net, mark, family, mode, reqid, if_id, proto, daddr, saddr, create);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1804) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1805)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1806) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1807) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1808) EXPORT_SYMBOL(xfrm_find_acq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1809)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1810) #ifdef CONFIG_XFRM_SUB_POLICY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1811) #if IS_ENABLED(CONFIG_IPV6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1812) /* distribution counting sort function for xfrm_state and xfrm_tmpl */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1813) static void
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1814) __xfrm6_sort(void **dst, void **src, int n,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1815) int (*cmp)(const void *p), int maxclass)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1816) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1817) int count[XFRM_MAX_DEPTH] = { };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1818) int class[XFRM_MAX_DEPTH];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1819) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1820)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1821) for (i = 0; i < n; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1822) int c = cmp(src[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1823)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1824) class[i] = c;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1825) count[c]++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1826) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1827)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1828) for (i = 2; i < maxclass; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1829) count[i] += count[i - 1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1830)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1831) for (i = 0; i < n; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1832) dst[count[class[i] - 1]++] = src[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1833) src[i] = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1834) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1835) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1836)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1837) /* Rule for xfrm_state:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1838) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1839) * rule 1: select IPsec transport except AH
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1840) * rule 2: select MIPv6 RO or inbound trigger
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1841) * rule 3: select IPsec transport AH
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1842) * rule 4: select IPsec tunnel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1843) * rule 5: others
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1844) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1845) static int __xfrm6_state_sort_cmp(const void *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1846) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1847) const struct xfrm_state *v = p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1848)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1849) switch (v->props.mode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1850) case XFRM_MODE_TRANSPORT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1851) if (v->id.proto != IPPROTO_AH)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1852) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1853) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1854) return 3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1855) #if IS_ENABLED(CONFIG_IPV6_MIP6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1856) case XFRM_MODE_ROUTEOPTIMIZATION:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1857) case XFRM_MODE_IN_TRIGGER:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1858) return 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1859) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1860) case XFRM_MODE_TUNNEL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1861) case XFRM_MODE_BEET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1862) return 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1863) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1864) return 5;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1865) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1866)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1867) /* Rule for xfrm_tmpl:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1868) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1869) * rule 1: select IPsec transport
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1870) * rule 2: select MIPv6 RO or inbound trigger
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1871) * rule 3: select IPsec tunnel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1872) * rule 4: others
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1873) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1874) static int __xfrm6_tmpl_sort_cmp(const void *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1875) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1876) const struct xfrm_tmpl *v = p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1877)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1878) switch (v->mode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1879) case XFRM_MODE_TRANSPORT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1880) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1881) #if IS_ENABLED(CONFIG_IPV6_MIP6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1882) case XFRM_MODE_ROUTEOPTIMIZATION:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1883) case XFRM_MODE_IN_TRIGGER:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1884) return 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1885) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1886) case XFRM_MODE_TUNNEL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1887) case XFRM_MODE_BEET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1888) return 3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1889) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1890) return 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1891) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1892) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1893) static inline int __xfrm6_state_sort_cmp(const void *p) { return 5; }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1894) static inline int __xfrm6_tmpl_sort_cmp(const void *p) { return 4; }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1895)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1896) static inline void
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1897) __xfrm6_sort(void **dst, void **src, int n,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1898) int (*cmp)(const void *p), int maxclass)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1899) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1900) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1901)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1902) for (i = 0; i < n; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1903) dst[i] = src[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1904) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1905) #endif /* CONFIG_IPV6 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1906)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1907) void
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1908) xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1909) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1910) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1911) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1912)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1913) if (family == AF_INET6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1914) __xfrm6_sort((void **)dst, (void **)src, n,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1915) __xfrm6_tmpl_sort_cmp, 5);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1916) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1917) for (i = 0; i < n; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1918) dst[i] = src[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1919) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1920)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1921) void
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1922) xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1923) unsigned short family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1924) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1925) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1926)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1927) if (family == AF_INET6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1928) __xfrm6_sort((void **)dst, (void **)src, n,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1929) __xfrm6_state_sort_cmp, 6);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1930) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1931) for (i = 0; i < n; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1932) dst[i] = src[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1933) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1934) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1935)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1936) /* Silly enough, but I'm lazy to build resolution list */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1937)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1938) static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1939) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1940) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1941)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1942) for (i = 0; i <= net->xfrm.state_hmask; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1943) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1944)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1945) hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1946) if (x->km.seq == seq &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1947) (mark & x->mark.m) == x->mark.v &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1948) x->km.state == XFRM_STATE_ACQ) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1949) xfrm_state_hold(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1950) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1951) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1952) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1953) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1954) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1955) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1956)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1957) struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1958) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1959) struct xfrm_state *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1960)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1961) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1962) x = __xfrm_find_acq_byseq(net, mark, seq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1963) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1964) return x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1965) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1966) EXPORT_SYMBOL(xfrm_find_acq_byseq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1967)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1968) u32 xfrm_get_acqseq(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1969) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1970) u32 res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1971) static atomic_t acqseq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1972)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1973) do {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1974) res = atomic_inc_return(&acqseq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1975) } while (!res);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1976)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1977) return res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1978) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1979) EXPORT_SYMBOL(xfrm_get_acqseq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1980)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1981) int verify_spi_info(u8 proto, u32 min, u32 max)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1982) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1983) switch (proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1984) case IPPROTO_AH:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1985) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1986) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1987)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1988) case IPPROTO_COMP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1989) /* IPCOMP spi is 16-bits. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1990) if (max >= 0x10000)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1991) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1992) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1993)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1994) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1995) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1996) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1997)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1998) if (min > max)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1999) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2000)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2001) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2002) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2003) EXPORT_SYMBOL(verify_spi_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2004)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2005) int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2006) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2007) struct net *net = xs_net(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2008) unsigned int h;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2009) struct xfrm_state *x0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2010) int err = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2011) __be32 minspi = htonl(low);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2012) __be32 maxspi = htonl(high);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2013) __be32 newspi = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2014) u32 mark = x->mark.v & x->mark.m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2015)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2016) spin_lock_bh(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2017) if (x->km.state == XFRM_STATE_DEAD)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2018) goto unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2019)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2020) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2021) if (x->id.spi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2022) goto unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2023)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2024) err = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2025)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2026) if (minspi == maxspi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2027) x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2028) if (x0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2029) xfrm_state_put(x0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2030) goto unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2031) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2032) newspi = minspi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2033) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2034) u32 spi = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2035) for (h = 0; h < high-low+1; h++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2036) spi = low + prandom_u32()%(high-low+1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2037) x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2038) if (x0 == NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2039) newspi = htonl(spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2040) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2041) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2042) xfrm_state_put(x0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2043) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2044) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2045) if (newspi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2046) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2047) x->id.spi = newspi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2048) h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2049) hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2050) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2051)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2052) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2053) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2054)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2055) unlock:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2056) spin_unlock_bh(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2057)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2058) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2059) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2060) EXPORT_SYMBOL(xfrm_alloc_spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2061)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2062) static bool __xfrm_state_filter_match(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2063) struct xfrm_address_filter *filter)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2064) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2065) if (filter) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2066) if ((filter->family == AF_INET ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2067) filter->family == AF_INET6) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2068) x->props.family != filter->family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2069) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2070)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2071) return addr_match(&x->props.saddr, &filter->saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2072) filter->splen) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2073) addr_match(&x->id.daddr, &filter->daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2074) filter->dplen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2075) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2076) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2077) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2078)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2079) int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2080) int (*func)(struct xfrm_state *, int, void*),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2081) void *data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2082) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2083) struct xfrm_state *state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2084) struct xfrm_state_walk *x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2085) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2086)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2087) if (walk->seq != 0 && list_empty(&walk->all))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2088) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2089)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2090) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2091) if (list_empty(&walk->all))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2092) x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2093) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2094) x = list_first_entry(&walk->all, struct xfrm_state_walk, all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2095) list_for_each_entry_from(x, &net->xfrm.state_all, all) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2096) if (x->state == XFRM_STATE_DEAD)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2097) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2098) state = container_of(x, struct xfrm_state, km);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2099) if (!xfrm_id_proto_match(state->id.proto, walk->proto))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2100) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2101) if (!__xfrm_state_filter_match(state, walk->filter))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2102) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2103) err = func(state, walk->seq, data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2104) if (err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2105) list_move_tail(&walk->all, &x->all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2106) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2107) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2108) walk->seq++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2109) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2110) if (walk->seq == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2111) err = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2112) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2113) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2114) list_del_init(&walk->all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2115) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2116) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2117) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2118) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2119) EXPORT_SYMBOL(xfrm_state_walk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2120)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2121) void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2122) struct xfrm_address_filter *filter)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2123) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2124) INIT_LIST_HEAD(&walk->all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2125) walk->proto = proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2126) walk->state = XFRM_STATE_DEAD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2127) walk->seq = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2128) walk->filter = filter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2129) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2130) EXPORT_SYMBOL(xfrm_state_walk_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2132) void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2133) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2134) kfree(walk->filter);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2136) if (list_empty(&walk->all))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2137) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2139) spin_lock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2140) list_del(&walk->all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2141) spin_unlock_bh(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2142) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2143) EXPORT_SYMBOL(xfrm_state_walk_done);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2144)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2145) static void xfrm_replay_timer_handler(struct timer_list *t)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2146) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2147) struct xfrm_state *x = from_timer(x, t, rtimer);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2149) spin_lock(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2150)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2151) if (x->km.state == XFRM_STATE_VALID) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2152) if (xfrm_aevent_is_on(xs_net(x)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2153) x->repl->notify(x, XFRM_REPLAY_TIMEOUT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2154) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2155) x->xflags |= XFRM_TIME_DEFER;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2156) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2158) spin_unlock(&x->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2159) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2161) static LIST_HEAD(xfrm_km_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2162)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2163) void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2164) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2165) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2166)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2167) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2168) list_for_each_entry_rcu(km, &xfrm_km_list, list)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2169) if (km->notify_policy)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2170) km->notify_policy(xp, dir, c);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2171) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2172) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2173)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2174) void km_state_notify(struct xfrm_state *x, const struct km_event *c)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2175) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2176) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2177) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2178) list_for_each_entry_rcu(km, &xfrm_km_list, list)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2179) if (km->notify)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2180) km->notify(x, c);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2181) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2182) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2183)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2184) EXPORT_SYMBOL(km_policy_notify);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2185) EXPORT_SYMBOL(km_state_notify);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2186)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2187) void km_state_expired(struct xfrm_state *x, int hard, u32 portid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2188) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2189) struct km_event c;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2190)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2191) c.data.hard = hard;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2192) c.portid = portid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2193) c.event = XFRM_MSG_EXPIRE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2194) km_state_notify(x, &c);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2195) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2196)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2197) EXPORT_SYMBOL(km_state_expired);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2198) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2199) * We send to all registered managers regardless of failure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2200) * We are happy with one success
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2201) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2202) int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2203) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2204) int err = -EINVAL, acqret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2205) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2206)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2207) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2208) list_for_each_entry_rcu(km, &xfrm_km_list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2209) acqret = km->acquire(x, t, pol);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2210) if (!acqret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2211) err = acqret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2212) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2213) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2214) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2215) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2216) EXPORT_SYMBOL(km_query);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2218) int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2219) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2220) int err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2221) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2222)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2223) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2224) list_for_each_entry_rcu(km, &xfrm_km_list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2225) if (km->new_mapping)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2226) err = km->new_mapping(x, ipaddr, sport);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2227) if (!err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2228) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2229) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2230) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2231) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2232) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2233) EXPORT_SYMBOL(km_new_mapping);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2234)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2235) void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2236) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2237) struct km_event c;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2238)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2239) c.data.hard = hard;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2240) c.portid = portid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2241) c.event = XFRM_MSG_POLEXPIRE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2242) km_policy_notify(pol, dir, &c);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2243) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2244) EXPORT_SYMBOL(km_policy_expired);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2245)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2246) #ifdef CONFIG_XFRM_MIGRATE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2247) int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2248) const struct xfrm_migrate *m, int num_migrate,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2249) const struct xfrm_kmaddress *k,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2250) const struct xfrm_encap_tmpl *encap)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2251) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2252) int err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2253) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2254) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2255)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2256) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2257) list_for_each_entry_rcu(km, &xfrm_km_list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2258) if (km->migrate) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2259) ret = km->migrate(sel, dir, type, m, num_migrate, k,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2260) encap);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2261) if (!ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2262) err = ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2263) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2264) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2265) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2266) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2267) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2268) EXPORT_SYMBOL(km_migrate);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2269) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2270)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2271) int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2272) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2273) int err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2274) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2275) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2276)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2277) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2278) list_for_each_entry_rcu(km, &xfrm_km_list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2279) if (km->report) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2280) ret = km->report(net, proto, sel, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2281) if (!ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2282) err = ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2283) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2284) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2285) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2286) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2287) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2288) EXPORT_SYMBOL(km_report);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2289)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2290) static bool km_is_alive(const struct km_event *c)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2291) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2292) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2293) bool is_alive = false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2294)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2295) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2296) list_for_each_entry_rcu(km, &xfrm_km_list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2297) if (km->is_alive && km->is_alive(c)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2298) is_alive = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2299) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2300) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2301) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2302) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2303)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2304) return is_alive;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2305) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2306)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2307) #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2308) static DEFINE_SPINLOCK(xfrm_translator_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2309) static struct xfrm_translator __rcu *xfrm_translator;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2310)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2311) struct xfrm_translator *xfrm_get_translator(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2312) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2313) struct xfrm_translator *xtr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2314)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2315) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2316) xtr = rcu_dereference(xfrm_translator);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2317) if (unlikely(!xtr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2318) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2319) if (!try_module_get(xtr->owner))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2320) xtr = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2321) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2322) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2323) return xtr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2324) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2325) EXPORT_SYMBOL_GPL(xfrm_get_translator);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2326)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2327) void xfrm_put_translator(struct xfrm_translator *xtr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2328) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2329) module_put(xtr->owner);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2330) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2331) EXPORT_SYMBOL_GPL(xfrm_put_translator);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2332)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2333) int xfrm_register_translator(struct xfrm_translator *xtr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2334) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2335) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2336)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2337) spin_lock_bh(&xfrm_translator_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2338) if (unlikely(xfrm_translator != NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2339) err = -EEXIST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2340) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2341) rcu_assign_pointer(xfrm_translator, xtr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2342) spin_unlock_bh(&xfrm_translator_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2343)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2344) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2345) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2346) EXPORT_SYMBOL_GPL(xfrm_register_translator);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2347)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2348) int xfrm_unregister_translator(struct xfrm_translator *xtr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2349) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2350) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2351)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2352) spin_lock_bh(&xfrm_translator_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2353) if (likely(xfrm_translator != NULL)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2354) if (rcu_access_pointer(xfrm_translator) != xtr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2355) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2356) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2357) RCU_INIT_POINTER(xfrm_translator, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2358) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2359) spin_unlock_bh(&xfrm_translator_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2360) synchronize_rcu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2361)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2362) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2363) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2364) EXPORT_SYMBOL_GPL(xfrm_unregister_translator);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2365) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2366)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2367) int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, int optlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2368) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2369) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2370) u8 *data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2371) struct xfrm_mgr *km;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2372) struct xfrm_policy *pol = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2373)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2374) if (sockptr_is_null(optval) && !optlen) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2375) xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2376) xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2377) __sk_dst_reset(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2378) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2379) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2381) if (optlen <= 0 || optlen > PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2382) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2383)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2384) data = memdup_sockptr(optval, optlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2385) if (IS_ERR(data))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2386) return PTR_ERR(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2387)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2388) /* Use the 64-bit / untranslated format on Android, even for compat */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2389) if (!IS_ENABLED(CONFIG_ANDROID) || IS_ENABLED(CONFIG_XFRM_USER_COMPAT)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2390) if (in_compat_syscall()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2391) struct xfrm_translator *xtr = xfrm_get_translator();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2392)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2393) if (!xtr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2394) kfree(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2395) return -EOPNOTSUPP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2396) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2397)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2398) err = xtr->xlate_user_policy_sockptr(&data, optlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2399) xfrm_put_translator(xtr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2400) if (err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2401) kfree(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2402) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2403) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2404) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2405) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2406)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2407) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2408) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2409) list_for_each_entry_rcu(km, &xfrm_km_list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2410) pol = km->compile_policy(sk, optname, data,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2411) optlen, &err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2412) if (err >= 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2413) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2414) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2415) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2416)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2417) if (err >= 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2418) xfrm_sk_policy_insert(sk, err, pol);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2419) xfrm_pol_put(pol);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2420) __sk_dst_reset(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2421) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2422) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2423)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2424) kfree(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2425) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2426) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2427) EXPORT_SYMBOL(xfrm_user_policy);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2428)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2429) static DEFINE_SPINLOCK(xfrm_km_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2430)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2431) int xfrm_register_km(struct xfrm_mgr *km)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2432) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2433) spin_lock_bh(&xfrm_km_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2434) list_add_tail_rcu(&km->list, &xfrm_km_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2435) spin_unlock_bh(&xfrm_km_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2436) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2437) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2438) EXPORT_SYMBOL(xfrm_register_km);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2439)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2440) int xfrm_unregister_km(struct xfrm_mgr *km)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2441) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2442) spin_lock_bh(&xfrm_km_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2443) list_del_rcu(&km->list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2444) spin_unlock_bh(&xfrm_km_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2445) synchronize_rcu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2446) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2447) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2448) EXPORT_SYMBOL(xfrm_unregister_km);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2449)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2450) int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2451) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2452) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2453)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2454) if (WARN_ON(afinfo->family >= NPROTO))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2455) return -EAFNOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2456)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2457) spin_lock_bh(&xfrm_state_afinfo_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2458) if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2459) err = -EEXIST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2460) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2461) rcu_assign_pointer(xfrm_state_afinfo[afinfo->family], afinfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2462) spin_unlock_bh(&xfrm_state_afinfo_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2463) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2464) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2465) EXPORT_SYMBOL(xfrm_state_register_afinfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2466)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2467) int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2468) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2469) int err = 0, family = afinfo->family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2470)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2471) if (WARN_ON(family >= NPROTO))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2472) return -EAFNOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2473)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2474) spin_lock_bh(&xfrm_state_afinfo_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2475) if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2476) if (rcu_access_pointer(xfrm_state_afinfo[family]) != afinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2477) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2478) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2479) RCU_INIT_POINTER(xfrm_state_afinfo[afinfo->family], NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2480) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2481) spin_unlock_bh(&xfrm_state_afinfo_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2482) synchronize_rcu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2483) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2484) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2485) EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2486)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2487) struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2488) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2489) if (unlikely(family >= NPROTO))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2490) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2491)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2492) return rcu_dereference(xfrm_state_afinfo[family]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2493) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2494) EXPORT_SYMBOL_GPL(xfrm_state_afinfo_get_rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2495)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2496) struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2497) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2498) struct xfrm_state_afinfo *afinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2499) if (unlikely(family >= NPROTO))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2500) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2501) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2502) afinfo = rcu_dereference(xfrm_state_afinfo[family]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2503) if (unlikely(!afinfo))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2504) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2505) return afinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2506) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2507)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2508) void xfrm_flush_gc(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2509) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2510) flush_work(&xfrm_state_gc_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2511) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2512) EXPORT_SYMBOL(xfrm_flush_gc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2513)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2514) /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2515) void xfrm_state_delete_tunnel(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2516) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2517) if (x->tunnel) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2518) struct xfrm_state *t = x->tunnel;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2519)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2520) if (atomic_read(&t->tunnel_users) == 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2521) xfrm_state_delete(t);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2522) atomic_dec(&t->tunnel_users);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2523) xfrm_state_put_sync(t);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2524) x->tunnel = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2525) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2526) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2527) EXPORT_SYMBOL(xfrm_state_delete_tunnel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2528)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2529) u32 xfrm_state_mtu(struct xfrm_state *x, int mtu)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2530) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2531) const struct xfrm_type *type = READ_ONCE(x->type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2532) struct crypto_aead *aead;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2533) u32 blksize, net_adj = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2534)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2535) if (x->km.state != XFRM_STATE_VALID ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2536) !type || type->proto != IPPROTO_ESP)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2537) return mtu - x->props.header_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2538)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2539) aead = x->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2540) blksize = ALIGN(crypto_aead_blocksize(aead), 4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2541)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2542) switch (x->props.mode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2543) case XFRM_MODE_TRANSPORT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2544) case XFRM_MODE_BEET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2545) if (x->props.family == AF_INET)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2546) net_adj = sizeof(struct iphdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2547) else if (x->props.family == AF_INET6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2548) net_adj = sizeof(struct ipv6hdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2549) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2550) case XFRM_MODE_TUNNEL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2551) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2552) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2553) WARN_ON_ONCE(1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2554) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2555) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2556)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2557) return ((mtu - x->props.header_len - crypto_aead_authsize(aead) -
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2558) net_adj) & ~(blksize - 1)) + net_adj - 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2559) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2560) EXPORT_SYMBOL_GPL(xfrm_state_mtu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2561)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2562) int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2563) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2564) const struct xfrm_mode *inner_mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2565) const struct xfrm_mode *outer_mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2566) int family = x->props.family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2567) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2568)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2569) if (family == AF_INET &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2570) xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2571) x->props.flags |= XFRM_STATE_NOPMTUDISC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2572)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2573) err = -EPROTONOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2574)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2575) if (x->sel.family != AF_UNSPEC) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2576) inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2577) if (inner_mode == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2578) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2579)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2580) if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2581) family != x->sel.family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2582) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2583)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2584) x->inner_mode = *inner_mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2585) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2586) const struct xfrm_mode *inner_mode_iaf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2587) int iafamily = AF_INET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2588)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2589) inner_mode = xfrm_get_mode(x->props.mode, x->props.family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2590) if (inner_mode == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2591) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2592)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2593) if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2594) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2595)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2596) x->inner_mode = *inner_mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2597)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2598) if (x->props.family == AF_INET)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2599) iafamily = AF_INET6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2600)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2601) inner_mode_iaf = xfrm_get_mode(x->props.mode, iafamily);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2602) if (inner_mode_iaf) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2603) if (inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2604) x->inner_mode_iaf = *inner_mode_iaf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2605) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2606) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2607)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2608) x->type = xfrm_get_type(x->id.proto, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2609) if (x->type == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2610) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2611)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2612) x->type_offload = xfrm_get_type_offload(x->id.proto, family, offload);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2613)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2614) err = x->type->init_state(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2615) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2616) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2617)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2618) outer_mode = xfrm_get_mode(x->props.mode, family);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2619) if (!outer_mode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2620) err = -EPROTONOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2621) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2622) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2623)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2624) x->outer_mode = *outer_mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2625) if (init_replay) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2626) err = xfrm_init_replay(x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2627) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2628) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2629) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2630)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2631) error:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2632) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2633) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2634)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2635) EXPORT_SYMBOL(__xfrm_init_state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2636)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2637) int xfrm_init_state(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2638) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2639) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2640)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2641) err = __xfrm_init_state(x, true, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2642) if (!err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2643) x->km.state = XFRM_STATE_VALID;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2644)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2645) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2646) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2647)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2648) EXPORT_SYMBOL(xfrm_init_state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2649)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2650) int __net_init xfrm_state_init(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2651) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2652) unsigned int sz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2653)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2654) if (net_eq(net, &init_net))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2655) xfrm_state_cache = KMEM_CACHE(xfrm_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2656) SLAB_HWCACHE_ALIGN | SLAB_PANIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2657)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2658) INIT_LIST_HEAD(&net->xfrm.state_all);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2659)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2660) sz = sizeof(struct hlist_head) * 8;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2661)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2662) net->xfrm.state_bydst = xfrm_hash_alloc(sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2663) if (!net->xfrm.state_bydst)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2664) goto out_bydst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2665) net->xfrm.state_bysrc = xfrm_hash_alloc(sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2666) if (!net->xfrm.state_bysrc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2667) goto out_bysrc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2668) net->xfrm.state_byspi = xfrm_hash_alloc(sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2669) if (!net->xfrm.state_byspi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2670) goto out_byspi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2671) net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2672)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2673) net->xfrm.state_num = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2674) INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2675) spin_lock_init(&net->xfrm.xfrm_state_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2676) seqcount_init(&net->xfrm.xfrm_state_hash_generation);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2677) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2678)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2679) out_byspi:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2680) xfrm_hash_free(net->xfrm.state_bysrc, sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2681) out_bysrc:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2682) xfrm_hash_free(net->xfrm.state_bydst, sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2683) out_bydst:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2684) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2685) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2686)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2687) void xfrm_state_fini(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2688) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2689) unsigned int sz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2690)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2691) flush_work(&net->xfrm.state_hash_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2692) flush_work(&xfrm_state_gc_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2693) xfrm_state_flush(net, 0, false, true);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2694)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2695) WARN_ON(!list_empty(&net->xfrm.state_all));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2696)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2697) sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2698) WARN_ON(!hlist_empty(net->xfrm.state_byspi));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2699) xfrm_hash_free(net->xfrm.state_byspi, sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2700) WARN_ON(!hlist_empty(net->xfrm.state_bysrc));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2701) xfrm_hash_free(net->xfrm.state_bysrc, sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2702) WARN_ON(!hlist_empty(net->xfrm.state_bydst));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2703) xfrm_hash_free(net->xfrm.state_bydst, sz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2704) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2705)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2706) #ifdef CONFIG_AUDITSYSCALL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2707) static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2708) struct audit_buffer *audit_buf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2709) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2710) struct xfrm_sec_ctx *ctx = x->security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2711) u32 spi = ntohl(x->id.spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2712)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2713) if (ctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2714) audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2715) ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2716)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2717) switch (x->props.family) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2718) case AF_INET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2719) audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2720) &x->props.saddr.a4, &x->id.daddr.a4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2721) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2722) case AF_INET6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2723) audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2724) x->props.saddr.a6, x->id.daddr.a6);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2725) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2726) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2727)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2728) audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2729) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2730)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2731) static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2732) struct audit_buffer *audit_buf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2733) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2734) const struct iphdr *iph4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2735) const struct ipv6hdr *iph6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2736)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2737) switch (family) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2738) case AF_INET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2739) iph4 = ip_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2740) audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2741) &iph4->saddr, &iph4->daddr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2742) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2743) case AF_INET6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2744) iph6 = ipv6_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2745) audit_log_format(audit_buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2746) " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2747) &iph6->saddr, &iph6->daddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2748) iph6->flow_lbl[0] & 0x0f,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2749) iph6->flow_lbl[1],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2750) iph6->flow_lbl[2]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2751) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2752) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2753) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2754)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2755) void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2756) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2757) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2758)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2759) audit_buf = xfrm_audit_start("SAD-add");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2760) if (audit_buf == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2761) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2762) xfrm_audit_helper_usrinfo(task_valid, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2763) xfrm_audit_helper_sainfo(x, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2764) audit_log_format(audit_buf, " res=%u", result);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2765) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2766) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2767) EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2768)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2769) void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2770) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2771) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2772)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2773) audit_buf = xfrm_audit_start("SAD-delete");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2774) if (audit_buf == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2775) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2776) xfrm_audit_helper_usrinfo(task_valid, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2777) xfrm_audit_helper_sainfo(x, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2778) audit_log_format(audit_buf, " res=%u", result);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2779) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2780) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2781) EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2782)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2783) void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2784) struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2785) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2786) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2787) u32 spi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2788)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2789) audit_buf = xfrm_audit_start("SA-replay-overflow");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2790) if (audit_buf == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2791) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2792) xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2793) /* don't record the sequence number because it's inherent in this kind
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2794) * of audit message */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2795) spi = ntohl(x->id.spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2796) audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2797) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2798) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2799) EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2800)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2801) void xfrm_audit_state_replay(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2802) struct sk_buff *skb, __be32 net_seq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2803) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2804) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2805) u32 spi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2806)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2807) audit_buf = xfrm_audit_start("SA-replayed-pkt");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2808) if (audit_buf == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2809) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2810) xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2811) spi = ntohl(x->id.spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2812) audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2813) spi, spi, ntohl(net_seq));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2814) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2815) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2816) EXPORT_SYMBOL_GPL(xfrm_audit_state_replay);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2817)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2818) void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2819) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2820) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2821)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2822) audit_buf = xfrm_audit_start("SA-notfound");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2823) if (audit_buf == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2824) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2825) xfrm_audit_helper_pktinfo(skb, family, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2826) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2827) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2828) EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound_simple);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2829)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2830) void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2831) __be32 net_spi, __be32 net_seq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2832) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2833) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2834) u32 spi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2835)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2836) audit_buf = xfrm_audit_start("SA-notfound");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2837) if (audit_buf == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2838) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2839) xfrm_audit_helper_pktinfo(skb, family, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2840) spi = ntohl(net_spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2841) audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2842) spi, spi, ntohl(net_seq));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2843) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2844) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2845) EXPORT_SYMBOL_GPL(xfrm_audit_state_notfound);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2846)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2847) void xfrm_audit_state_icvfail(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2848) struct sk_buff *skb, u8 proto)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2849) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2850) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2851) __be32 net_spi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2852) __be32 net_seq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2853)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2854) audit_buf = xfrm_audit_start("SA-icv-failure");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2855) if (audit_buf == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2856) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2857) xfrm_audit_helper_pktinfo(skb, x->props.family, audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2858) if (xfrm_parse_spi(skb, proto, &net_spi, &net_seq) == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2859) u32 spi = ntohl(net_spi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2860) audit_log_format(audit_buf, " spi=%u(0x%x) seqno=%u",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2861) spi, spi, ntohl(net_seq));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2862) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2863) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2864) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2865) EXPORT_SYMBOL_GPL(xfrm_audit_state_icvfail);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2866) #endif /* CONFIG_AUDITSYSCALL */
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags