1/* 2 * xfrm_policy.c 3 * 4 * Changes: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * Kazunori MIYAZAWA @USAGI 10 * YOSHIFUJI Hideaki 11 * Split up af-specific portion 12 * Derek Atkins <derek@ihtfp.com> Add the post_input processor 13 * 14 */ 15 16#include <linux/err.h> 17#include <linux/slab.h> 18#include <linux/kmod.h> 19#include <linux/list.h> 20#include <linux/spinlock.h> 21#include <linux/workqueue.h> 22#include <linux/notifier.h> 23#include <linux/netdevice.h> 24#include <linux/netfilter.h> 25#include <linux/module.h> 26#include <linux/cache.h> 27#include <linux/audit.h> 28#include <net/dst.h> 29#include <net/xfrm.h> 30#include <net/ip.h> 31#ifdef CONFIG_XFRM_STATISTICS 32#include <net/snmp.h> 33#endif 34 35#include "xfrm_hash.h" 36 37DEFINE_MUTEX(xfrm_cfg_mutex); 38EXPORT_SYMBOL(xfrm_cfg_mutex); 39 40static DEFINE_SPINLOCK(xfrm_policy_sk_bundle_lock); 41static struct dst_entry *xfrm_policy_sk_bundles; 42static DEFINE_RWLOCK(xfrm_policy_lock); 43 44static DEFINE_RWLOCK(xfrm_policy_afinfo_lock); 45static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO]; 46 47static struct kmem_cache *xfrm_dst_cache __read_mostly; 48 49static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family); 50static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo); 51static void xfrm_init_pmtu(struct dst_entry *dst); 52static int stale_bundle(struct dst_entry *dst); 53 54static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, 55 int dir); 56 57static inline int 58__xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl) 59{ 60 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) && 61 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) && 62 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 63 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 64 (fl->proto == sel->proto || !sel->proto) && 65 (fl->oif == sel->ifindex || !sel->ifindex); 66} 67 68static inline int 69__xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl) 70{ 71 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) && 72 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) && 73 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 74 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 75 (fl->proto == sel->proto || !sel->proto) && 76 (fl->oif == sel->ifindex || !sel->ifindex); 77} 78 79int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl, 80 unsigned short family) 81{ 82 switch (family) { 83 case AF_INET: 84 return __xfrm4_selector_match(sel, fl); 85 case AF_INET6: 86 return __xfrm6_selector_match(sel, fl); 87 } 88 return 0; 89} 90 91static inline struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, 92 xfrm_address_t *saddr, 93 xfrm_address_t *daddr, 94 int family) 95{ 96 struct xfrm_policy_afinfo *afinfo; 97 struct dst_entry *dst; 98 99 afinfo = xfrm_policy_get_afinfo(family); 100 if (unlikely(afinfo == NULL)) 101 return ERR_PTR(-EAFNOSUPPORT); 102 103 dst = afinfo->dst_lookup(net, tos, saddr, daddr); 104 105 xfrm_policy_put_afinfo(afinfo); 106 107 return dst; 108} 109 110static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, int tos, 111 xfrm_address_t *prev_saddr, 112 xfrm_address_t *prev_daddr, 113 int family) 114{ 115 struct net *net = xs_net(x); 116 xfrm_address_t *saddr = &x->props.saddr; 117 xfrm_address_t *daddr = &x->id.daddr; 118 struct dst_entry *dst; 119 120 if (x->type->flags & XFRM_TYPE_LOCAL_COADDR) { 121 saddr = x->coaddr; 122 daddr = prev_daddr; 123 } 124 if (x->type->flags & XFRM_TYPE_REMOTE_COADDR) { 125 saddr = prev_saddr; 126 daddr = x->coaddr; 127 } 128 129 dst = __xfrm_dst_lookup(net, tos, saddr, daddr, family); 130 131 if (!IS_ERR(dst)) { 132 if (prev_saddr != saddr) 133 memcpy(prev_saddr, saddr, sizeof(*prev_saddr)); 134 if (prev_daddr != daddr) 135 memcpy(prev_daddr, daddr, sizeof(*prev_daddr)); 136 } 137 138 return dst; 139} 140 141static inline unsigned long make_jiffies(long secs) 142{ 143 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ) 144 return MAX_SCHEDULE_TIMEOUT-1; 145 else 146 return secs*HZ; 147} 148 149static void xfrm_policy_timer(unsigned long data) 150{ 151 struct xfrm_policy *xp = (struct xfrm_policy*)data; 152 unsigned long now = get_seconds(); 153 long next = LONG_MAX; 154 int warn = 0; 155 int dir; 156 157 read_lock(&xp->lock); 158 159 if (unlikely(xp->walk.dead)) 160 goto out; 161 162 dir = xfrm_policy_id2dir(xp->index); 163 164 if (xp->lft.hard_add_expires_seconds) { 165 long tmo = xp->lft.hard_add_expires_seconds + 166 xp->curlft.add_time - now; 167 if (tmo <= 0) 168 goto expired; 169 if (tmo < next) 170 next = tmo; 171 } 172 if (xp->lft.hard_use_expires_seconds) { 173 long tmo = xp->lft.hard_use_expires_seconds + 174 (xp->curlft.use_time ? : xp->curlft.add_time) - now; 175 if (tmo <= 0) 176 goto expired; 177 if (tmo < next) 178 next = tmo; 179 } 180 if (xp->lft.soft_add_expires_seconds) { 181 long tmo = xp->lft.soft_add_expires_seconds + 182 xp->curlft.add_time - now; 183 if (tmo <= 0) { 184 warn = 1; 185 tmo = XFRM_KM_TIMEOUT; 186 } 187 if (tmo < next) 188 next = tmo; 189 } 190 if (xp->lft.soft_use_expires_seconds) { 191 long tmo = xp->lft.soft_use_expires_seconds + 192 (xp->curlft.use_time ? : xp->curlft.add_time) - now; 193 if (tmo <= 0) { 194 warn = 1; 195 tmo = XFRM_KM_TIMEOUT; 196 } 197 if (tmo < next) 198 next = tmo; 199 } 200 201 if (warn) 202 km_policy_expired(xp, dir, 0, 0); 203 if (next != LONG_MAX && 204 !mod_timer(&xp->timer, jiffies + make_jiffies(next))) 205 xfrm_pol_hold(xp); 206 207out: 208 read_unlock(&xp->lock); 209 xfrm_pol_put(xp); 210 return; 211 212expired: 213 read_unlock(&xp->lock); 214 if (!xfrm_policy_delete(xp, dir)) 215 km_policy_expired(xp, dir, 1, 0); 216 xfrm_pol_put(xp); 217} 218 219static struct flow_cache_object *xfrm_policy_flo_get(struct flow_cache_object *flo) 220{ 221 struct xfrm_policy *pol = container_of(flo, struct xfrm_policy, flo); 222 223 if (unlikely(pol->walk.dead)) 224 flo = NULL; 225 else 226 xfrm_pol_hold(pol); 227 228 return flo; 229} 230 231static int xfrm_policy_flo_check(struct flow_cache_object *flo) 232{ 233 struct xfrm_policy *pol = container_of(flo, struct xfrm_policy, flo); 234 235 return !pol->walk.dead; 236} 237 238static void xfrm_policy_flo_delete(struct flow_cache_object *flo) 239{ 240 xfrm_pol_put(container_of(flo, struct xfrm_policy, flo)); 241} 242 243static const struct flow_cache_ops xfrm_policy_fc_ops = { 244 .get = xfrm_policy_flo_get, 245 .check = xfrm_policy_flo_check, 246 .delete = xfrm_policy_flo_delete, 247}; 248 249/* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2 250 * SPD calls. 251 */ 252 253struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp) 254{ 255 struct xfrm_policy *policy; 256 257 policy = kzalloc(sizeof(struct xfrm_policy), gfp); 258 259 if (policy) { 260 write_pnet(&policy->xp_net, net); 261 INIT_LIST_HEAD(&policy->walk.all); 262 INIT_HLIST_NODE(&policy->bydst); 263 INIT_HLIST_NODE(&policy->byidx); 264 rwlock_init(&policy->lock); 265 atomic_set(&policy->refcnt, 1); 266 setup_timer(&policy->timer, xfrm_policy_timer, 267 (unsigned long)policy); 268 policy->flo.ops = &xfrm_policy_fc_ops; 269 } 270 return policy; 271} 272EXPORT_SYMBOL(xfrm_policy_alloc); 273 274/* Destroy xfrm_policy: descendant resources must be released to this moment. */ 275 276void xfrm_policy_destroy(struct xfrm_policy *policy) 277{ 278 BUG_ON(!policy->walk.dead); 279 280 if (del_timer(&policy->timer)) 281 BUG(); 282 283 security_xfrm_policy_free(policy->security); 284 kfree(policy); 285} 286EXPORT_SYMBOL(xfrm_policy_destroy); 287 288/* Rule must be locked. Release descentant resources, announce 289 * entry dead. The rule must be unlinked from lists to the moment. 290 */ 291 292static void xfrm_policy_kill(struct xfrm_policy *policy) 293{ 294 policy->walk.dead = 1; 295 296 atomic_inc(&policy->genid); 297 298 if (del_timer(&policy->timer)) 299 xfrm_pol_put(policy); 300 301 xfrm_pol_put(policy); 302} 303 304static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024; 305 306static inline unsigned int idx_hash(struct net *net, u32 index) 307{ 308 return __idx_hash(index, net->xfrm.policy_idx_hmask); 309} 310 311static struct hlist_head *policy_hash_bysel(struct net *net, struct xfrm_selector *sel, unsigned short family, int dir) 312{ 313 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 314 unsigned int hash = __sel_hash(sel, family, hmask); 315 316 return (hash == hmask + 1 ? 317 &net->xfrm.policy_inexact[dir] : 318 net->xfrm.policy_bydst[dir].table + hash); 319} 320 321static struct hlist_head *policy_hash_direct(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, unsigned short family, int dir) 322{ 323 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 324 unsigned int hash = __addr_hash(daddr, saddr, family, hmask); 325 326 return net->xfrm.policy_bydst[dir].table + hash; 327} 328 329static void xfrm_dst_hash_transfer(struct hlist_head *list, 330 struct hlist_head *ndsttable, 331 unsigned int nhashmask) 332{ 333 struct hlist_node *entry, *tmp, *entry0 = NULL; 334 struct xfrm_policy *pol; 335 unsigned int h0 = 0; 336 337redo: 338 hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) { 339 unsigned int h; 340 341 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr, 342 pol->family, nhashmask); 343 if (!entry0) { 344 hlist_del(entry); 345 hlist_add_head(&pol->bydst, ndsttable+h); 346 h0 = h; 347 } else { 348 if (h != h0) 349 continue; 350 hlist_del(entry); 351 hlist_add_after(entry0, &pol->bydst); 352 } 353 entry0 = entry; 354 } 355 if (!hlist_empty(list)) { 356 entry0 = NULL; 357 goto redo; 358 } 359} 360 361static void xfrm_idx_hash_transfer(struct hlist_head *list, 362 struct hlist_head *nidxtable, 363 unsigned int nhashmask) 364{ 365 struct hlist_node *entry, *tmp; 366 struct xfrm_policy *pol; 367 368 hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) { 369 unsigned int h; 370 371 h = __idx_hash(pol->index, nhashmask); 372 hlist_add_head(&pol->byidx, nidxtable+h); 373 } 374} 375 376static unsigned long xfrm_new_hash_mask(unsigned int old_hmask) 377{ 378 return ((old_hmask + 1) << 1) - 1; 379} 380 381static void xfrm_bydst_resize(struct net *net, int dir) 382{ 383 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 384 unsigned int nhashmask = xfrm_new_hash_mask(hmask); 385 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head); 386 struct hlist_head *odst = net->xfrm.policy_bydst[dir].table; 387 struct hlist_head *ndst = xfrm_hash_alloc(nsize); 388 int i; 389 390 if (!ndst) 391 return; 392 393 write_lock_bh(&xfrm_policy_lock); 394 395 for (i = hmask; i >= 0; i--) 396 xfrm_dst_hash_transfer(odst + i, ndst, nhashmask); 397 398 net->xfrm.policy_bydst[dir].table = ndst; 399 net->xfrm.policy_bydst[dir].hmask = nhashmask; 400 401 write_unlock_bh(&xfrm_policy_lock); 402 403 xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head)); 404} 405 406static void xfrm_byidx_resize(struct net *net, int total) 407{ 408 unsigned int hmask = net->xfrm.policy_idx_hmask; 409 unsigned int nhashmask = xfrm_new_hash_mask(hmask); 410 unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head); 411 struct hlist_head *oidx = net->xfrm.policy_byidx; 412 struct hlist_head *nidx = xfrm_hash_alloc(nsize); 413 int i; 414 415 if (!nidx) 416 return; 417 418 write_lock_bh(&xfrm_policy_lock); 419 420 for (i = hmask; i >= 0; i--) 421 xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask); 422 423 net->xfrm.policy_byidx = nidx; 424 net->xfrm.policy_idx_hmask = nhashmask; 425 426 write_unlock_bh(&xfrm_policy_lock); 427 428 xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head)); 429} 430 431static inline int xfrm_bydst_should_resize(struct net *net, int dir, int *total) 432{ 433 unsigned int cnt = net->xfrm.policy_count[dir]; 434 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 435 436 if (total) 437 *total += cnt; 438 439 if ((hmask + 1) < xfrm_policy_hashmax && 440 cnt > hmask) 441 return 1; 442 443 return 0; 444} 445 446static inline int xfrm_byidx_should_resize(struct net *net, int total) 447{ 448 unsigned int hmask = net->xfrm.policy_idx_hmask; 449 450 if ((hmask + 1) < xfrm_policy_hashmax && 451 total > hmask) 452 return 1; 453 454 return 0; 455} 456 457void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si) 458{ 459 read_lock_bh(&xfrm_policy_lock); 460 si->incnt = net->xfrm.policy_count[XFRM_POLICY_IN]; 461 si->outcnt = net->xfrm.policy_count[XFRM_POLICY_OUT]; 462 si->fwdcnt = net->xfrm.policy_count[XFRM_POLICY_FWD]; 463 si->inscnt = net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX]; 464 si->outscnt = net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX]; 465 si->fwdscnt = net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX]; 466 si->spdhcnt = net->xfrm.policy_idx_hmask; 467 si->spdhmcnt = xfrm_policy_hashmax; 468 read_unlock_bh(&xfrm_policy_lock); 469} 470EXPORT_SYMBOL(xfrm_spd_getinfo); 471 472static DEFINE_MUTEX(hash_resize_mutex); 473static void xfrm_hash_resize(struct work_struct *work) 474{ 475 struct net *net = container_of(work, struct net, xfrm.policy_hash_work); 476 int dir, total; 477 478 mutex_lock(&hash_resize_mutex); 479 480 total = 0; 481 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 482 if (xfrm_bydst_should_resize(net, dir, &total)) 483 xfrm_bydst_resize(net, dir); 484 } 485 if (xfrm_byidx_should_resize(net, total)) 486 xfrm_byidx_resize(net, total); 487 488 mutex_unlock(&hash_resize_mutex); 489} 490 491/* Generate new index... KAME seems to generate them ordered by cost 492 * of an absolute inpredictability of ordering of rules. This will not pass. */ 493static u32 xfrm_gen_index(struct net *net, int dir) 494{ 495 static u32 idx_generator; 496 497 for (;;) { 498 struct hlist_node *entry; 499 struct hlist_head *list; 500 struct xfrm_policy *p; 501 u32 idx; 502 int found; 503 504 idx = (idx_generator | dir); 505 idx_generator += 8; 506 if (idx == 0) 507 idx = 8; 508 list = net->xfrm.policy_byidx + idx_hash(net, idx); 509 found = 0; 510 hlist_for_each_entry(p, entry, list, byidx) { 511 if (p->index == idx) { 512 found = 1; 513 break; 514 } 515 } 516 if (!found) 517 return idx; 518 } 519} 520 521static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s2) 522{ 523 u32 *p1 = (u32 *) s1; 524 u32 *p2 = (u32 *) s2; 525 int len = sizeof(struct xfrm_selector) / sizeof(u32); 526 int i; 527 528 for (i = 0; i < len; i++) { 529 if (p1[i] != p2[i]) 530 return 1; 531 } 532 533 return 0; 534} 535 536int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) 537{ 538 struct net *net = xp_net(policy); 539 struct xfrm_policy *pol; 540 struct xfrm_policy *delpol; 541 struct hlist_head *chain; 542 struct hlist_node *entry, *newpos; 543 u32 mark = policy->mark.v & policy->mark.m; 544 545 write_lock_bh(&xfrm_policy_lock); 546 chain = policy_hash_bysel(net, &policy->selector, policy->family, dir); 547 delpol = NULL; 548 newpos = NULL; 549 hlist_for_each_entry(pol, entry, chain, bydst) { 550 if (pol->type == policy->type && 551 !selector_cmp(&pol->selector, &policy->selector) && 552 (mark & pol->mark.m) == pol->mark.v && 553 xfrm_sec_ctx_match(pol->security, policy->security) && 554 !WARN_ON(delpol)) { 555 if (excl) { 556 write_unlock_bh(&xfrm_policy_lock); 557 return -EEXIST; 558 } 559 delpol = pol; 560 if (policy->priority > pol->priority) 561 continue; 562 } else if (policy->priority >= pol->priority) { 563 newpos = &pol->bydst; 564 continue; 565 } 566 if (delpol) 567 break; 568 } 569 if (newpos) 570 hlist_add_after(newpos, &policy->bydst); 571 else 572 hlist_add_head(&policy->bydst, chain); 573 xfrm_pol_hold(policy); 574 net->xfrm.policy_count[dir]++; 575 atomic_inc(&flow_cache_genid); 576 if (delpol) 577 __xfrm_policy_unlink(delpol, dir); 578 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir); 579 hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index)); 580 policy->curlft.add_time = get_seconds(); 581 policy->curlft.use_time = 0; 582 if (!mod_timer(&policy->timer, jiffies + HZ)) 583 xfrm_pol_hold(policy); 584 list_add(&policy->walk.all, &net->xfrm.policy_all); 585 write_unlock_bh(&xfrm_policy_lock); 586 587 if (delpol) 588 xfrm_policy_kill(delpol); 589 else if (xfrm_bydst_should_resize(net, dir, NULL)) 590 schedule_work(&net->xfrm.policy_hash_work); 591 592 return 0; 593} 594EXPORT_SYMBOL(xfrm_policy_insert); 595 596struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type, 597 int dir, struct xfrm_selector *sel, 598 struct xfrm_sec_ctx *ctx, int delete, 599 int *err) 600{ 601 struct xfrm_policy *pol, *ret; 602 struct hlist_head *chain; 603 struct hlist_node *entry; 604 605 *err = 0; 606 write_lock_bh(&xfrm_policy_lock); 607 chain = policy_hash_bysel(net, sel, sel->family, dir); 608 ret = NULL; 609 hlist_for_each_entry(pol, entry, chain, bydst) { 610 if (pol->type == type && 611 (mark & pol->mark.m) == pol->mark.v && 612 !selector_cmp(sel, &pol->selector) && 613 xfrm_sec_ctx_match(ctx, pol->security)) { 614 xfrm_pol_hold(pol); 615 if (delete) { 616 *err = security_xfrm_policy_delete( 617 pol->security); 618 if (*err) { 619 write_unlock_bh(&xfrm_policy_lock); 620 return pol; 621 } 622 __xfrm_policy_unlink(pol, dir); 623 } 624 ret = pol; 625 break; 626 } 627 } 628 write_unlock_bh(&xfrm_policy_lock); 629 630 if (ret && delete) 631 xfrm_policy_kill(ret); 632 return ret; 633} 634EXPORT_SYMBOL(xfrm_policy_bysel_ctx); 635 636struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type, 637 int dir, u32 id, int delete, int *err) 638{ 639 struct xfrm_policy *pol, *ret; 640 struct hlist_head *chain; 641 struct hlist_node *entry; 642 643 *err = -ENOENT; 644 if (xfrm_policy_id2dir(id) != dir) 645 return NULL; 646 647 *err = 0; 648 write_lock_bh(&xfrm_policy_lock); 649 chain = net->xfrm.policy_byidx + idx_hash(net, id); 650 ret = NULL; 651 hlist_for_each_entry(pol, entry, chain, byidx) { 652 if (pol->type == type && pol->index == id && 653 (mark & pol->mark.m) == pol->mark.v) { 654 xfrm_pol_hold(pol); 655 if (delete) { 656 *err = security_xfrm_policy_delete( 657 pol->security); 658 if (*err) { 659 write_unlock_bh(&xfrm_policy_lock); 660 return pol; 661 } 662 __xfrm_policy_unlink(pol, dir); 663 } 664 ret = pol; 665 break; 666 } 667 } 668 write_unlock_bh(&xfrm_policy_lock); 669 670 if (ret && delete) 671 xfrm_policy_kill(ret); 672 return ret; 673} 674EXPORT_SYMBOL(xfrm_policy_byid); 675 676#ifdef CONFIG_SECURITY_NETWORK_XFRM 677static inline int 678xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info) 679{ 680 int dir, err = 0; 681 682 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { 683 struct xfrm_policy *pol; 684 struct hlist_node *entry; 685 int i; 686 687 hlist_for_each_entry(pol, entry, 688 &net->xfrm.policy_inexact[dir], bydst) { 689 if (pol->type != type) 690 continue; 691 err = security_xfrm_policy_delete(pol->security); 692 if (err) { 693 xfrm_audit_policy_delete(pol, 0, 694 audit_info->loginuid, 695 audit_info->sessionid, 696 audit_info->secid); 697 return err; 698 } 699 } 700 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) { 701 hlist_for_each_entry(pol, entry, 702 net->xfrm.policy_bydst[dir].table + i, 703 bydst) { 704 if (pol->type != type) 705 continue; 706 err = security_xfrm_policy_delete( 707 pol->security); 708 if (err) { 709 xfrm_audit_policy_delete(pol, 0, 710 audit_info->loginuid, 711 audit_info->sessionid, 712 audit_info->secid); 713 return err; 714 } 715 } 716 } 717 } 718 return err; 719} 720#else 721static inline int 722xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info) 723{ 724 return 0; 725} 726#endif 727 728int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info) 729{ 730 int dir, err = 0, cnt = 0; 731 732 write_lock_bh(&xfrm_policy_lock); 733 734 err = xfrm_policy_flush_secctx_check(net, type, audit_info); 735 if (err) 736 goto out; 737 738 for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { 739 struct xfrm_policy *pol; 740 struct hlist_node *entry; 741 int i; 742 743 again1: 744 hlist_for_each_entry(pol, entry, 745 &net->xfrm.policy_inexact[dir], bydst) { 746 if (pol->type != type) 747 continue; 748 __xfrm_policy_unlink(pol, dir); 749 write_unlock_bh(&xfrm_policy_lock); 750 cnt++; 751 752 xfrm_audit_policy_delete(pol, 1, audit_info->loginuid, 753 audit_info->sessionid, 754 audit_info->secid); 755 756 xfrm_policy_kill(pol); 757 758 write_lock_bh(&xfrm_policy_lock); 759 goto again1; 760 } 761 762 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) { 763 again2: 764 hlist_for_each_entry(pol, entry, 765 net->xfrm.policy_bydst[dir].table + i, 766 bydst) { 767 if (pol->type != type) 768 continue; 769 __xfrm_policy_unlink(pol, dir); 770 write_unlock_bh(&xfrm_policy_lock); 771 cnt++; 772 773 xfrm_audit_policy_delete(pol, 1, 774 audit_info->loginuid, 775 audit_info->sessionid, 776 audit_info->secid); 777 xfrm_policy_kill(pol); 778 779 write_lock_bh(&xfrm_policy_lock); 780 goto again2; 781 } 782 } 783 784 } 785 if (!cnt) 786 err = -ESRCH; 787out: 788 write_unlock_bh(&xfrm_policy_lock); 789 return err; 790} 791EXPORT_SYMBOL(xfrm_policy_flush); 792 793int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 794 int (*func)(struct xfrm_policy *, int, int, void*), 795 void *data) 796{ 797 struct xfrm_policy *pol; 798 struct xfrm_policy_walk_entry *x; 799 int error = 0; 800 801 if (walk->type >= XFRM_POLICY_TYPE_MAX && 802 walk->type != XFRM_POLICY_TYPE_ANY) 803 return -EINVAL; 804 805 if (list_empty(&walk->walk.all) && walk->seq != 0) 806 return 0; 807 808 write_lock_bh(&xfrm_policy_lock); 809 if (list_empty(&walk->walk.all)) 810 x = list_first_entry(&net->xfrm.policy_all, struct xfrm_policy_walk_entry, all); 811 else 812 x = list_entry(&walk->walk.all, struct xfrm_policy_walk_entry, all); 813 list_for_each_entry_from(x, &net->xfrm.policy_all, all) { 814 if (x->dead) 815 continue; 816 pol = container_of(x, struct xfrm_policy, walk); 817 if (walk->type != XFRM_POLICY_TYPE_ANY && 818 walk->type != pol->type) 819 continue; 820 error = func(pol, xfrm_policy_id2dir(pol->index), 821 walk->seq, data); 822 if (error) { 823 list_move_tail(&walk->walk.all, &x->all); 824 goto out; 825 } 826 walk->seq++; 827 } 828 if (walk->seq == 0) { 829 error = -ENOENT; 830 goto out; 831 } 832 list_del_init(&walk->walk.all); 833out: 834 write_unlock_bh(&xfrm_policy_lock); 835 return error; 836} 837EXPORT_SYMBOL(xfrm_policy_walk); 838 839void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type) 840{ 841 INIT_LIST_HEAD(&walk->walk.all); 842 walk->walk.dead = 1; 843 walk->type = type; 844 walk->seq = 0; 845} 846EXPORT_SYMBOL(xfrm_policy_walk_init); 847 848void xfrm_policy_walk_done(struct xfrm_policy_walk *walk) 849{ 850 if (list_empty(&walk->walk.all)) 851 return; 852 853 write_lock_bh(&xfrm_policy_lock); 854 list_del(&walk->walk.all); 855 write_unlock_bh(&xfrm_policy_lock); 856} 857EXPORT_SYMBOL(xfrm_policy_walk_done); 858 859/* 860 * Find policy to apply to this flow. 861 * 862 * Returns 0 if policy found, else an -errno. 863 */ 864static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl, 865 u8 type, u16 family, int dir) 866{ 867 struct xfrm_selector *sel = &pol->selector; 868 int match, ret = -ESRCH; 869 870 if (pol->family != family || 871 (fl->mark & pol->mark.m) != pol->mark.v || 872 pol->type != type) 873 return ret; 874 875 match = xfrm_selector_match(sel, fl, family); 876 if (match) 877 ret = security_xfrm_policy_lookup(pol->security, fl->secid, 878 dir); 879 880 return ret; 881} 882 883static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type, 884 struct flowi *fl, 885 u16 family, u8 dir) 886{ 887 int err; 888 struct xfrm_policy *pol, *ret; 889 xfrm_address_t *daddr, *saddr; 890 struct hlist_node *entry; 891 struct hlist_head *chain; 892 u32 priority = ~0U; 893 894 daddr = xfrm_flowi_daddr(fl, family); 895 saddr = xfrm_flowi_saddr(fl, family); 896 if (unlikely(!daddr || !saddr)) 897 return NULL; 898 899 read_lock_bh(&xfrm_policy_lock); 900 chain = policy_hash_direct(net, daddr, saddr, family, dir); 901 ret = NULL; 902 hlist_for_each_entry(pol, entry, chain, bydst) { 903 err = xfrm_policy_match(pol, fl, type, family, dir); 904 if (err) { 905 if (err == -ESRCH) 906 continue; 907 else { 908 ret = ERR_PTR(err); 909 goto fail; 910 } 911 } else { 912 ret = pol; 913 priority = ret->priority; 914 break; 915 } 916 } 917 chain = &net->xfrm.policy_inexact[dir]; 918 hlist_for_each_entry(pol, entry, chain, bydst) { 919 err = xfrm_policy_match(pol, fl, type, family, dir); 920 if (err) { 921 if (err == -ESRCH) 922 continue; 923 else { 924 ret = ERR_PTR(err); 925 goto fail; 926 } 927 } else if (pol->priority < priority) { 928 ret = pol; 929 break; 930 } 931 } 932 if (ret) 933 xfrm_pol_hold(ret); 934fail: 935 read_unlock_bh(&xfrm_policy_lock); 936 937 return ret; 938} 939 940static struct xfrm_policy * 941__xfrm_policy_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir) 942{ 943#ifdef CONFIG_XFRM_SUB_POLICY 944 struct xfrm_policy *pol; 945 946 pol = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_SUB, fl, family, dir); 947 if (pol != NULL) 948 return pol; 949#endif 950 return xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family, dir); 951} 952 953static struct flow_cache_object * 954xfrm_policy_lookup(struct net *net, struct flowi *fl, u16 family, 955 u8 dir, struct flow_cache_object *old_obj, void *ctx) 956{ 957 struct xfrm_policy *pol; 958 959 if (old_obj) 960 xfrm_pol_put(container_of(old_obj, struct xfrm_policy, flo)); 961 962 pol = __xfrm_policy_lookup(net, fl, family, dir); 963 if (IS_ERR_OR_NULL(pol)) 964 return ERR_CAST(pol); 965 966 /* Resolver returns two references: 967 * one for cache and one for caller of flow_cache_lookup() */ 968 xfrm_pol_hold(pol); 969 970 return &pol->flo; 971} 972 973static inline int policy_to_flow_dir(int dir) 974{ 975 if (XFRM_POLICY_IN == FLOW_DIR_IN && 976 XFRM_POLICY_OUT == FLOW_DIR_OUT && 977 XFRM_POLICY_FWD == FLOW_DIR_FWD) 978 return dir; 979 switch (dir) { 980 default: 981 case XFRM_POLICY_IN: 982 return FLOW_DIR_IN; 983 case XFRM_POLICY_OUT: 984 return FLOW_DIR_OUT; 985 case XFRM_POLICY_FWD: 986 return FLOW_DIR_FWD; 987 } 988} 989 990static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl) 991{ 992 struct xfrm_policy *pol; 993 994 read_lock_bh(&xfrm_policy_lock); 995 if ((pol = sk->sk_policy[dir]) != NULL) { 996 int match = xfrm_selector_match(&pol->selector, fl, 997 sk->sk_family); 998 int err = 0; 999 1000 if (match) { 1001 if ((sk->sk_mark & pol->mark.m) != pol->mark.v) { 1002 pol = NULL; 1003 goto out; 1004 } 1005 err = security_xfrm_policy_lookup(pol->security, 1006 fl->secid, 1007 policy_to_flow_dir(dir)); 1008 if (!err) 1009 xfrm_pol_hold(pol); 1010 else if (err == -ESRCH) 1011 pol = NULL; 1012 else 1013 pol = ERR_PTR(err); 1014 } else 1015 pol = NULL; 1016 } 1017out: 1018 read_unlock_bh(&xfrm_policy_lock); 1019 return pol; 1020} 1021 1022static void __xfrm_policy_link(struct xfrm_policy *pol, int dir) 1023{ 1024 struct net *net = xp_net(pol); 1025 struct hlist_head *chain = policy_hash_bysel(net, &pol->selector, 1026 pol->family, dir); 1027 1028 list_add(&pol->walk.all, &net->xfrm.policy_all); 1029 hlist_add_head(&pol->bydst, chain); 1030 hlist_add_head(&pol->byidx, net->xfrm.policy_byidx+idx_hash(net, pol->index)); 1031 net->xfrm.policy_count[dir]++; 1032 xfrm_pol_hold(pol); 1033 1034 if (xfrm_bydst_should_resize(net, dir, NULL)) 1035 schedule_work(&net->xfrm.policy_hash_work); 1036} 1037 1038static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, 1039 int dir) 1040{ 1041 struct net *net = xp_net(pol); 1042 1043 if (hlist_unhashed(&pol->bydst)) 1044 return NULL; 1045 1046 hlist_del(&pol->bydst); 1047 hlist_del(&pol->byidx); 1048 list_del(&pol->walk.all); 1049 net->xfrm.policy_count[dir]--; 1050 1051 return pol; 1052} 1053 1054int xfrm_policy_delete(struct xfrm_policy *pol, int dir) 1055{ 1056 write_lock_bh(&xfrm_policy_lock); 1057 pol = __xfrm_policy_unlink(pol, dir); 1058 write_unlock_bh(&xfrm_policy_lock); 1059 if (pol) { 1060 xfrm_policy_kill(pol); 1061 return 0; 1062 } 1063 return -ENOENT; 1064} 1065EXPORT_SYMBOL(xfrm_policy_delete); 1066 1067int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) 1068{ 1069 struct net *net = xp_net(pol); 1070 struct xfrm_policy *old_pol; 1071 1072#ifdef CONFIG_XFRM_SUB_POLICY 1073 if (pol && pol->type != XFRM_POLICY_TYPE_MAIN) 1074 return -EINVAL; 1075#endif 1076 1077 write_lock_bh(&xfrm_policy_lock); 1078 old_pol = sk->sk_policy[dir]; 1079 sk->sk_policy[dir] = pol; 1080 if (pol) { 1081 pol->curlft.add_time = get_seconds(); 1082 pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir); 1083 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir); 1084 } 1085 if (old_pol) 1086 /* Unlinking succeeds always. This is the only function 1087 * allowed to delete or replace socket policy. 1088 */ 1089 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir); 1090 write_unlock_bh(&xfrm_policy_lock); 1091 1092 if (old_pol) { 1093 xfrm_policy_kill(old_pol); 1094 } 1095 return 0; 1096} 1097 1098static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir) 1099{ 1100 struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC); 1101 1102 if (newp) { 1103 newp->selector = old->selector; 1104 if (security_xfrm_policy_clone(old->security, 1105 &newp->security)) { 1106 kfree(newp); 1107 return NULL; /* ENOMEM */ 1108 } 1109 newp->lft = old->lft; 1110 newp->curlft = old->curlft; 1111 newp->mark = old->mark; 1112 newp->action = old->action; 1113 newp->flags = old->flags; 1114 newp->xfrm_nr = old->xfrm_nr; 1115 newp->index = old->index; 1116 newp->type = old->type; 1117 memcpy(newp->xfrm_vec, old->xfrm_vec, 1118 newp->xfrm_nr*sizeof(struct xfrm_tmpl)); 1119 write_lock_bh(&xfrm_policy_lock); 1120 __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir); 1121 write_unlock_bh(&xfrm_policy_lock); 1122 xfrm_pol_put(newp); 1123 } 1124 return newp; 1125} 1126 1127int __xfrm_sk_clone_policy(struct sock *sk) 1128{ 1129 struct xfrm_policy *p0 = sk->sk_policy[0], 1130 *p1 = sk->sk_policy[1]; 1131 1132 sk->sk_policy[0] = sk->sk_policy[1] = NULL; 1133 if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL) 1134 return -ENOMEM; 1135 if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL) 1136 return -ENOMEM; 1137 return 0; 1138} 1139 1140static int 1141xfrm_get_saddr(struct net *net, xfrm_address_t *local, xfrm_address_t *remote, 1142 unsigned short family) 1143{ 1144 int err; 1145 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1146 1147 if (unlikely(afinfo == NULL)) 1148 return -EINVAL; 1149 err = afinfo->get_saddr(net, local, remote); 1150 xfrm_policy_put_afinfo(afinfo); 1151 return err; 1152} 1153 1154/* Resolve list of templates for the flow, given policy. */ 1155 1156static int 1157xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl, 1158 struct xfrm_state **xfrm, 1159 unsigned short family) 1160{ 1161 struct net *net = xp_net(policy); 1162 int nx; 1163 int i, error; 1164 xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family); 1165 xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family); 1166 xfrm_address_t tmp; 1167 1168 for (nx=0, i = 0; i < policy->xfrm_nr; i++) { 1169 struct xfrm_state *x; 1170 xfrm_address_t *remote = daddr; 1171 xfrm_address_t *local = saddr; 1172 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i]; 1173 1174 if (tmpl->mode == XFRM_MODE_TUNNEL || 1175 tmpl->mode == XFRM_MODE_BEET) { 1176 remote = &tmpl->id.daddr; 1177 local = &tmpl->saddr; 1178 if (xfrm_addr_any(local, tmpl->encap_family)) { 1179 error = xfrm_get_saddr(net, &tmp, remote, tmpl->encap_family); 1180 if (error) 1181 goto fail; 1182 local = &tmp; 1183 } 1184 } 1185 1186 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family); 1187 1188 if (x && x->km.state == XFRM_STATE_VALID) { 1189 xfrm[nx++] = x; 1190 daddr = remote; 1191 saddr = local; 1192 continue; 1193 } 1194 if (x) { 1195 error = (x->km.state == XFRM_STATE_ERROR ? 1196 -EINVAL : -EAGAIN); 1197 xfrm_state_put(x); 1198 } 1199 else if (error == -ESRCH) 1200 error = -EAGAIN; 1201 1202 if (!tmpl->optional) 1203 goto fail; 1204 } 1205 return nx; 1206 1207fail: 1208 for (nx--; nx>=0; nx--) 1209 xfrm_state_put(xfrm[nx]); 1210 return error; 1211} 1212 1213static int 1214xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, struct flowi *fl, 1215 struct xfrm_state **xfrm, 1216 unsigned short family) 1217{ 1218 struct xfrm_state *tp[XFRM_MAX_DEPTH]; 1219 struct xfrm_state **tpp = (npols > 1) ? tp : xfrm; 1220 int cnx = 0; 1221 int error; 1222 int ret; 1223 int i; 1224 1225 for (i = 0; i < npols; i++) { 1226 if (cnx + pols[i]->xfrm_nr >= XFRM_MAX_DEPTH) { 1227 error = -ENOBUFS; 1228 goto fail; 1229 } 1230 1231 ret = xfrm_tmpl_resolve_one(pols[i], fl, &tpp[cnx], family); 1232 if (ret < 0) { 1233 error = ret; 1234 goto fail; 1235 } else 1236 cnx += ret; 1237 } 1238 1239 /* found states are sorted for outbound processing */ 1240 if (npols > 1) 1241 xfrm_state_sort(xfrm, tpp, cnx, family); 1242 1243 return cnx; 1244 1245 fail: 1246 for (cnx--; cnx>=0; cnx--) 1247 xfrm_state_put(tpp[cnx]); 1248 return error; 1249 1250} 1251 1252/* Check that the bundle accepts the flow and its components are 1253 * still valid. 1254 */ 1255 1256static inline int xfrm_get_tos(struct flowi *fl, int family) 1257{ 1258 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1259 int tos; 1260 1261 if (!afinfo) 1262 return -EINVAL; 1263 1264 tos = afinfo->get_tos(fl); 1265 1266 xfrm_policy_put_afinfo(afinfo); 1267 1268 return tos; 1269} 1270 1271static struct flow_cache_object *xfrm_bundle_flo_get(struct flow_cache_object *flo) 1272{ 1273 struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo); 1274 struct dst_entry *dst = &xdst->u.dst; 1275 1276 if (xdst->route == NULL) { 1277 /* Dummy bundle - if it has xfrms we were not 1278 * able to build bundle as template resolution failed. 1279 * It means we need to try again resolving. */ 1280 if (xdst->num_xfrms > 0) 1281 return NULL; 1282 } else { 1283 /* Real bundle */ 1284 if (stale_bundle(dst)) 1285 return NULL; 1286 } 1287 1288 dst_hold(dst); 1289 return flo; 1290} 1291 1292static int xfrm_bundle_flo_check(struct flow_cache_object *flo) 1293{ 1294 struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo); 1295 struct dst_entry *dst = &xdst->u.dst; 1296 1297 if (!xdst->route) 1298 return 0; 1299 if (stale_bundle(dst)) 1300 return 0; 1301 1302 return 1; 1303} 1304 1305static void xfrm_bundle_flo_delete(struct flow_cache_object *flo) 1306{ 1307 struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo); 1308 struct dst_entry *dst = &xdst->u.dst; 1309 1310 dst_free(dst); 1311} 1312 1313static const struct flow_cache_ops xfrm_bundle_fc_ops = { 1314 .get = xfrm_bundle_flo_get, 1315 .check = xfrm_bundle_flo_check, 1316 .delete = xfrm_bundle_flo_delete, 1317}; 1318 1319static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family) 1320{ 1321 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1322 struct dst_ops *dst_ops; 1323 struct xfrm_dst *xdst; 1324 1325 if (!afinfo) 1326 return ERR_PTR(-EINVAL); 1327 1328 switch (family) { 1329 case AF_INET: 1330 dst_ops = &net->xfrm.xfrm4_dst_ops; 1331 break; 1332#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1333 case AF_INET6: 1334 dst_ops = &net->xfrm.xfrm6_dst_ops; 1335 break; 1336#endif 1337 default: 1338 BUG(); 1339 } 1340 xdst = dst_alloc(dst_ops) ?: ERR_PTR(-ENOBUFS); 1341 xfrm_policy_put_afinfo(afinfo); 1342 1343 xdst->flo.ops = &xfrm_bundle_fc_ops; 1344 1345 return xdst; 1346} 1347 1348static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst, 1349 int nfheader_len) 1350{ 1351 struct xfrm_policy_afinfo *afinfo = 1352 xfrm_policy_get_afinfo(dst->ops->family); 1353 int err; 1354 1355 if (!afinfo) 1356 return -EINVAL; 1357 1358 err = afinfo->init_path(path, dst, nfheader_len); 1359 1360 xfrm_policy_put_afinfo(afinfo); 1361 1362 return err; 1363} 1364 1365static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, 1366 struct flowi *fl) 1367{ 1368 struct xfrm_policy_afinfo *afinfo = 1369 xfrm_policy_get_afinfo(xdst->u.dst.ops->family); 1370 int err; 1371 1372 if (!afinfo) 1373 return -EINVAL; 1374 1375 err = afinfo->fill_dst(xdst, dev, fl); 1376 1377 xfrm_policy_put_afinfo(afinfo); 1378 1379 return err; 1380} 1381 1382 1383/* Allocate chain of dst_entry's, attach known xfrm's, calculate 1384 * all the metrics... Shortly, bundle a bundle. 1385 */ 1386 1387static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, 1388 struct xfrm_state **xfrm, int nx, 1389 struct flowi *fl, 1390 struct dst_entry *dst) 1391{ 1392 struct net *net = xp_net(policy); 1393 unsigned long now = jiffies; 1394 struct net_device *dev; 1395 struct dst_entry *dst_prev = NULL; 1396 struct dst_entry *dst0 = NULL; 1397 int i = 0; 1398 int err; 1399 int header_len = 0; 1400 int nfheader_len = 0; 1401 int trailer_len = 0; 1402 int tos; 1403 int family = policy->selector.family; 1404 xfrm_address_t saddr, daddr; 1405 1406 xfrm_flowi_addr_get(fl, &saddr, &daddr, family); 1407 1408 tos = xfrm_get_tos(fl, family); 1409 err = tos; 1410 if (tos < 0) 1411 goto put_states; 1412 1413 dst_hold(dst); 1414 1415 for (; i < nx; i++) { 1416 struct xfrm_dst *xdst = xfrm_alloc_dst(net, family); 1417 struct dst_entry *dst1 = &xdst->u.dst; 1418 1419 err = PTR_ERR(xdst); 1420 if (IS_ERR(xdst)) { 1421 dst_release(dst); 1422 goto put_states; 1423 } 1424 1425 if (!dst_prev) 1426 dst0 = dst1; 1427 else { 1428 dst_prev->child = dst_clone(dst1); 1429 dst1->flags |= DST_NOHASH; 1430 } 1431 1432 xdst->route = dst; 1433 memcpy(&dst1->metrics, &dst->metrics, sizeof(dst->metrics)); 1434 1435 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) { 1436 family = xfrm[i]->props.family; 1437 dst = xfrm_dst_lookup(xfrm[i], tos, &saddr, &daddr, 1438 family); 1439 err = PTR_ERR(dst); 1440 if (IS_ERR(dst)) 1441 goto put_states; 1442 } else 1443 dst_hold(dst); 1444 1445 dst1->xfrm = xfrm[i]; 1446 xdst->xfrm_genid = xfrm[i]->genid; 1447 1448 dst1->obsolete = -1; 1449 dst1->flags |= DST_HOST; 1450 dst1->lastuse = now; 1451 1452 dst1->input = dst_discard; 1453 dst1->output = xfrm[i]->outer_mode->afinfo->output; 1454 1455 dst1->next = dst_prev; 1456 dst_prev = dst1; 1457 1458 header_len += xfrm[i]->props.header_len; 1459 if (xfrm[i]->type->flags & XFRM_TYPE_NON_FRAGMENT) 1460 nfheader_len += xfrm[i]->props.header_len; 1461 trailer_len += xfrm[i]->props.trailer_len; 1462 } 1463 1464 dst_prev->child = dst; 1465 dst0->path = dst; 1466 1467 err = -ENODEV; 1468 dev = dst->dev; 1469 if (!dev) 1470 goto free_dst; 1471 1472 /* Copy neighbour for reachability confirmation */ 1473 dst0->neighbour = neigh_clone(dst->neighbour); 1474 1475 xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len); 1476 xfrm_init_pmtu(dst_prev); 1477 1478 for (dst_prev = dst0; dst_prev != dst; dst_prev = dst_prev->child) { 1479 struct xfrm_dst *xdst = (struct xfrm_dst *)dst_prev; 1480 1481 err = xfrm_fill_dst(xdst, dev, fl); 1482 if (err) 1483 goto free_dst; 1484 1485 dst_prev->header_len = header_len; 1486 dst_prev->trailer_len = trailer_len; 1487 header_len -= xdst->u.dst.xfrm->props.header_len; 1488 trailer_len -= xdst->u.dst.xfrm->props.trailer_len; 1489 } 1490 1491out: 1492 return dst0; 1493 1494put_states: 1495 for (; i < nx; i++) 1496 xfrm_state_put(xfrm[i]); 1497free_dst: 1498 if (dst0) 1499 dst_free(dst0); 1500 dst0 = ERR_PTR(err); 1501 goto out; 1502} 1503 1504static int inline 1505xfrm_dst_alloc_copy(void **target, void *src, int size) 1506{ 1507 if (!*target) { 1508 *target = kmalloc(size, GFP_ATOMIC); 1509 if (!*target) 1510 return -ENOMEM; 1511 } 1512 memcpy(*target, src, size); 1513 return 0; 1514} 1515 1516static int inline 1517xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel) 1518{ 1519#ifdef CONFIG_XFRM_SUB_POLICY 1520 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1521 return xfrm_dst_alloc_copy((void **)&(xdst->partner), 1522 sel, sizeof(*sel)); 1523#else 1524 return 0; 1525#endif 1526} 1527 1528static int inline 1529xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl) 1530{ 1531#ifdef CONFIG_XFRM_SUB_POLICY 1532 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1533 return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl)); 1534#else 1535 return 0; 1536#endif 1537} 1538 1539static int xfrm_expand_policies(struct flowi *fl, u16 family, 1540 struct xfrm_policy **pols, 1541 int *num_pols, int *num_xfrms) 1542{ 1543 int i; 1544 1545 if (*num_pols == 0 || !pols[0]) { 1546 *num_pols = 0; 1547 *num_xfrms = 0; 1548 return 0; 1549 } 1550 if (IS_ERR(pols[0])) 1551 return PTR_ERR(pols[0]); 1552 1553 *num_xfrms = pols[0]->xfrm_nr; 1554 1555#ifdef CONFIG_XFRM_SUB_POLICY 1556 if (pols[0] && pols[0]->action == XFRM_POLICY_ALLOW && 1557 pols[0]->type != XFRM_POLICY_TYPE_MAIN) { 1558 pols[1] = xfrm_policy_lookup_bytype(xp_net(pols[0]), 1559 XFRM_POLICY_TYPE_MAIN, 1560 fl, family, 1561 XFRM_POLICY_OUT); 1562 if (pols[1]) { 1563 if (IS_ERR(pols[1])) { 1564 xfrm_pols_put(pols, *num_pols); 1565 return PTR_ERR(pols[1]); 1566 } 1567 (*num_pols) ++; 1568 (*num_xfrms) += pols[1]->xfrm_nr; 1569 } 1570 } 1571#endif 1572 for (i = 0; i < *num_pols; i++) { 1573 if (pols[i]->action != XFRM_POLICY_ALLOW) { 1574 *num_xfrms = -1; 1575 break; 1576 } 1577 } 1578 1579 return 0; 1580 1581} 1582 1583static struct xfrm_dst * 1584xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, 1585 struct flowi *fl, u16 family, 1586 struct dst_entry *dst_orig) 1587{ 1588 struct net *net = xp_net(pols[0]); 1589 struct xfrm_state *xfrm[XFRM_MAX_DEPTH]; 1590 struct dst_entry *dst; 1591 struct xfrm_dst *xdst; 1592 int err; 1593 1594 /* Try to instantiate a bundle */ 1595 err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); 1596 if (err <= 0) { 1597 if (err != 0 && err != -EAGAIN) 1598 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); 1599 return ERR_PTR(err); 1600 } 1601 1602 dst = xfrm_bundle_create(pols[0], xfrm, err, fl, dst_orig); 1603 if (IS_ERR(dst)) { 1604 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLEGENERROR); 1605 return ERR_CAST(dst); 1606 } 1607 1608 xdst = (struct xfrm_dst *)dst; 1609 xdst->num_xfrms = err; 1610 if (num_pols > 1) 1611 err = xfrm_dst_update_parent(dst, &pols[1]->selector); 1612 else 1613 err = xfrm_dst_update_origin(dst, fl); 1614 if (unlikely(err)) { 1615 dst_free(dst); 1616 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1617 return ERR_PTR(err); 1618 } 1619 1620 xdst->num_pols = num_pols; 1621 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols); 1622 xdst->policy_genid = atomic_read(&pols[0]->genid); 1623 1624 return xdst; 1625} 1626 1627static struct flow_cache_object * 1628xfrm_bundle_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir, 1629 struct flow_cache_object *oldflo, void *ctx) 1630{ 1631 struct dst_entry *dst_orig = (struct dst_entry *)ctx; 1632 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1633 struct xfrm_dst *xdst, *new_xdst; 1634 int num_pols = 0, num_xfrms = 0, i, err, pol_dead; 1635 1636 /* Check if the policies from old bundle are usable */ 1637 xdst = NULL; 1638 if (oldflo) { 1639 xdst = container_of(oldflo, struct xfrm_dst, flo); 1640 num_pols = xdst->num_pols; 1641 num_xfrms = xdst->num_xfrms; 1642 pol_dead = 0; 1643 for (i = 0; i < num_pols; i++) { 1644 pols[i] = xdst->pols[i]; 1645 pol_dead |= pols[i]->walk.dead; 1646 } 1647 if (pol_dead) { 1648 dst_free(&xdst->u.dst); 1649 xdst = NULL; 1650 num_pols = 0; 1651 num_xfrms = 0; 1652 oldflo = NULL; 1653 } 1654 } 1655 1656 /* Resolve policies to use if we couldn't get them from 1657 * previous cache entry */ 1658 if (xdst == NULL) { 1659 num_pols = 1; 1660 pols[0] = __xfrm_policy_lookup(net, fl, family, dir); 1661 err = xfrm_expand_policies(fl, family, pols, 1662 &num_pols, &num_xfrms); 1663 if (err < 0) 1664 goto inc_error; 1665 if (num_pols == 0) 1666 return NULL; 1667 if (num_xfrms <= 0) 1668 goto make_dummy_bundle; 1669 } 1670 1671 new_xdst = xfrm_resolve_and_create_bundle(pols, num_pols, fl, family, dst_orig); 1672 if (IS_ERR(new_xdst)) { 1673 err = PTR_ERR(new_xdst); 1674 if (err != -EAGAIN) 1675 goto error; 1676 if (oldflo == NULL) 1677 goto make_dummy_bundle; 1678 dst_hold(&xdst->u.dst); 1679 return oldflo; 1680 } else if (new_xdst == NULL) { 1681 num_xfrms = 0; 1682 if (oldflo == NULL) 1683 goto make_dummy_bundle; 1684 xdst->num_xfrms = 0; 1685 dst_hold(&xdst->u.dst); 1686 return oldflo; 1687 } 1688 1689 /* Kill the previous bundle */ 1690 if (xdst) { 1691 /* The policies were stolen for newly generated bundle */ 1692 xdst->num_pols = 0; 1693 dst_free(&xdst->u.dst); 1694 } 1695 1696 /* Flow cache does not have reference, it dst_free()'s, 1697 * but we do need to return one reference for original caller */ 1698 dst_hold(&new_xdst->u.dst); 1699 return &new_xdst->flo; 1700 1701make_dummy_bundle: 1702 /* We found policies, but there's no bundles to instantiate: 1703 * either because the policy blocks, has no transformations or 1704 * we could not build template (no xfrm_states).*/ 1705 xdst = xfrm_alloc_dst(net, family); 1706 if (IS_ERR(xdst)) { 1707 xfrm_pols_put(pols, num_pols); 1708 return ERR_CAST(xdst); 1709 } 1710 xdst->num_pols = num_pols; 1711 xdst->num_xfrms = num_xfrms; 1712 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols); 1713 1714 dst_hold(&xdst->u.dst); 1715 return &xdst->flo; 1716 1717inc_error: 1718 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); 1719error: 1720 if (xdst != NULL) 1721 dst_free(&xdst->u.dst); 1722 else 1723 xfrm_pols_put(pols, num_pols); 1724 return ERR_PTR(err); 1725} 1726 1727/* Main function: finds/creates a bundle for given flow. 1728 * 1729 * At the moment we eat a raw IP route. Mostly to speed up lookups 1730 * on interfaces with disabled IPsec. 1731 */ 1732int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl, 1733 struct sock *sk, int flags) 1734{ 1735 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1736 struct flow_cache_object *flo; 1737 struct xfrm_dst *xdst; 1738 struct dst_entry *dst, *dst_orig = *dst_p, *route; 1739 u16 family = dst_orig->ops->family; 1740 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT); 1741 int i, err, num_pols, num_xfrms = 0, drop_pols = 0; 1742 1743restart: 1744 dst = NULL; 1745 xdst = NULL; 1746 route = NULL; 1747 1748 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { 1749 num_pols = 1; 1750 pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); 1751 err = xfrm_expand_policies(fl, family, pols, 1752 &num_pols, &num_xfrms); 1753 if (err < 0) 1754 goto dropdst; 1755 1756 if (num_pols) { 1757 if (num_xfrms <= 0) { 1758 drop_pols = num_pols; 1759 goto no_transform; 1760 } 1761 1762 xdst = xfrm_resolve_and_create_bundle( 1763 pols, num_pols, fl, 1764 family, dst_orig); 1765 if (IS_ERR(xdst)) { 1766 xfrm_pols_put(pols, num_pols); 1767 err = PTR_ERR(xdst); 1768 goto dropdst; 1769 } else if (xdst == NULL) { 1770 num_xfrms = 0; 1771 drop_pols = num_pols; 1772 goto no_transform; 1773 } 1774 1775 spin_lock_bh(&xfrm_policy_sk_bundle_lock); 1776 xdst->u.dst.next = xfrm_policy_sk_bundles; 1777 xfrm_policy_sk_bundles = &xdst->u.dst; 1778 spin_unlock_bh(&xfrm_policy_sk_bundle_lock); 1779 1780 route = xdst->route; 1781 } 1782 } 1783 1784 if (xdst == NULL) { 1785 /* To accelerate a bit... */ 1786 if ((dst_orig->flags & DST_NOXFRM) || 1787 !net->xfrm.policy_count[XFRM_POLICY_OUT]) 1788 goto nopol; 1789 1790 flo = flow_cache_lookup(net, fl, family, dir, 1791 xfrm_bundle_lookup, dst_orig); 1792 if (flo == NULL) 1793 goto nopol; 1794 if (IS_ERR(flo)) { 1795 err = PTR_ERR(flo); 1796 goto dropdst; 1797 } 1798 xdst = container_of(flo, struct xfrm_dst, flo); 1799 1800 num_pols = xdst->num_pols; 1801 num_xfrms = xdst->num_xfrms; 1802 memcpy(pols, xdst->pols, sizeof(struct xfrm_policy*) * num_pols); 1803 route = xdst->route; 1804 } 1805 1806 dst = &xdst->u.dst; 1807 if (route == NULL && num_xfrms > 0) { 1808 /* The only case when xfrm_bundle_lookup() returns a 1809 * bundle with null route, is when the template could 1810 * not be resolved. It means policies are there, but 1811 * bundle could not be created, since we don't yet 1812 * have the xfrm_state's. We need to wait for KM to 1813 * negotiate new SA's or bail out with error.*/ 1814 if (net->xfrm.sysctl_larval_drop) { 1815 /* EREMOTE tells the caller to generate 1816 * a one-shot blackhole route. */ 1817 dst_release(dst); 1818 xfrm_pols_put(pols, drop_pols); 1819 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1820 return -EREMOTE; 1821 } 1822 if (flags & XFRM_LOOKUP_WAIT) { 1823 DECLARE_WAITQUEUE(wait, current); 1824 1825 add_wait_queue(&net->xfrm.km_waitq, &wait); 1826 set_current_state(TASK_INTERRUPTIBLE); 1827 schedule(); 1828 set_current_state(TASK_RUNNING); 1829 remove_wait_queue(&net->xfrm.km_waitq, &wait); 1830 1831 if (!signal_pending(current)) { 1832 dst_release(dst); 1833 goto restart; 1834 } 1835 1836 err = -ERESTART; 1837 } else 1838 err = -EAGAIN; 1839 1840 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1841 goto error; 1842 } 1843 1844no_transform: 1845 if (num_pols == 0) 1846 goto nopol; 1847 1848 if ((flags & XFRM_LOOKUP_ICMP) && 1849 !(pols[0]->flags & XFRM_POLICY_ICMP)) { 1850 err = -ENOENT; 1851 goto error; 1852 } 1853 1854 for (i = 0; i < num_pols; i++) 1855 pols[i]->curlft.use_time = get_seconds(); 1856 1857 if (num_xfrms < 0) { 1858 /* Prohibit the flow */ 1859 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLBLOCK); 1860 err = -EPERM; 1861 goto error; 1862 } else if (num_xfrms > 0) { 1863 /* Flow transformed */ 1864 *dst_p = dst; 1865 dst_release(dst_orig); 1866 } else { 1867 /* Flow passes untransformed */ 1868 dst_release(dst); 1869 } 1870ok: 1871 xfrm_pols_put(pols, drop_pols); 1872 return 0; 1873 1874nopol: 1875 if (!(flags & XFRM_LOOKUP_ICMP)) 1876 goto ok; 1877 err = -ENOENT; 1878error: 1879 dst_release(dst); 1880dropdst: 1881 dst_release(dst_orig); 1882 *dst_p = NULL; 1883 xfrm_pols_put(pols, drop_pols); 1884 return err; 1885} 1886EXPORT_SYMBOL(__xfrm_lookup); 1887 1888int xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl, 1889 struct sock *sk, int flags) 1890{ 1891 int err = __xfrm_lookup(net, dst_p, fl, sk, flags); 1892 1893 if (err == -EREMOTE) { 1894 dst_release(*dst_p); 1895 *dst_p = NULL; 1896 err = -EAGAIN; 1897 } 1898 1899 return err; 1900} 1901EXPORT_SYMBOL(xfrm_lookup); 1902 1903static inline int 1904xfrm_secpath_reject(int idx, struct sk_buff *skb, struct flowi *fl) 1905{ 1906 struct xfrm_state *x; 1907 1908 if (!skb->sp || idx < 0 || idx >= skb->sp->len) 1909 return 0; 1910 x = skb->sp->xvec[idx]; 1911 if (!x->type->reject) 1912 return 0; 1913 return x->type->reject(x, skb, fl); 1914} 1915 1916/* When skb is transformed back to its "native" form, we have to 1917 * check policy restrictions. At the moment we make this in maximally 1918 * stupid way. Shame on me. :-) Of course, connected sockets must 1919 * have policy cached at them. 1920 */ 1921 1922static inline int 1923xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x, 1924 unsigned short family) 1925{ 1926 if (xfrm_state_kern(x)) 1927 return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family); 1928 return x->id.proto == tmpl->id.proto && 1929 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) && 1930 (x->props.reqid == tmpl->reqid || !tmpl->reqid) && 1931 x->props.mode == tmpl->mode && 1932 (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) || 1933 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) && 1934 !(x->props.mode != XFRM_MODE_TRANSPORT && 1935 xfrm_state_addr_cmp(tmpl, x, family)); 1936} 1937 1938/* 1939 * 0 or more than 0 is returned when validation is succeeded (either bypass 1940 * because of optional transport mode, or next index of the mathced secpath 1941 * state with the template. 1942 * -1 is returned when no matching template is found. 1943 * Otherwise "-2 - errored_index" is returned. 1944 */ 1945static inline int 1946xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start, 1947 unsigned short family) 1948{ 1949 int idx = start; 1950 1951 if (tmpl->optional) { 1952 if (tmpl->mode == XFRM_MODE_TRANSPORT) 1953 return start; 1954 } else 1955 start = -1; 1956 for (; idx < sp->len; idx++) { 1957 if (xfrm_state_ok(tmpl, sp->xvec[idx], family)) 1958 return ++idx; 1959 if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) { 1960 if (start == -1) 1961 start = -2-idx; 1962 break; 1963 } 1964 } 1965 return start; 1966} 1967 1968int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1969 unsigned int family, int reverse) 1970{ 1971 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1972 int err; 1973 1974 if (unlikely(afinfo == NULL)) 1975 return -EAFNOSUPPORT; 1976 1977 afinfo->decode_session(skb, fl, reverse); 1978 err = security_xfrm_decode_session(skb, &fl->secid); 1979 xfrm_policy_put_afinfo(afinfo); 1980 return err; 1981} 1982EXPORT_SYMBOL(__xfrm_decode_session); 1983 1984static inline int secpath_has_nontransport(struct sec_path *sp, int k, int *idxp) 1985{ 1986 for (; k < sp->len; k++) { 1987 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) { 1988 *idxp = k; 1989 return 1; 1990 } 1991 } 1992 1993 return 0; 1994} 1995 1996int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, 1997 unsigned short family) 1998{ 1999 struct net *net = dev_net(skb->dev); 2000 struct xfrm_policy *pol; 2001 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 2002 int npols = 0; 2003 int xfrm_nr; 2004 int pi; 2005 int reverse; 2006 struct flowi fl; 2007 u8 fl_dir; 2008 int xerr_idx = -1; 2009 2010 reverse = dir & ~XFRM_POLICY_MASK; 2011 dir &= XFRM_POLICY_MASK; 2012 fl_dir = policy_to_flow_dir(dir); 2013 2014 if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) { 2015 XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR); 2016 return 0; 2017 } 2018 2019 nf_nat_decode_session(skb, &fl, family); 2020 2021 /* First, check used SA against their selectors. */ 2022 if (skb->sp) { 2023 int i; 2024 2025 for (i=skb->sp->len-1; i>=0; i--) { 2026 struct xfrm_state *x = skb->sp->xvec[i]; 2027 if (!xfrm_selector_match(&x->sel, &fl, family)) { 2028 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH); 2029 return 0; 2030 } 2031 } 2032 } 2033 2034 pol = NULL; 2035 if (sk && sk->sk_policy[dir]) { 2036 pol = xfrm_sk_policy_lookup(sk, dir, &fl); 2037 if (IS_ERR(pol)) { 2038 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 2039 return 0; 2040 } 2041 } 2042 2043 if (!pol) { 2044 struct flow_cache_object *flo; 2045 2046 flo = flow_cache_lookup(net, &fl, family, fl_dir, 2047 xfrm_policy_lookup, NULL); 2048 if (IS_ERR_OR_NULL(flo)) 2049 pol = ERR_CAST(flo); 2050 else 2051 pol = container_of(flo, struct xfrm_policy, flo); 2052 } 2053 2054 if (IS_ERR(pol)) { 2055 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 2056 return 0; 2057 } 2058 2059 if (!pol) { 2060 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) { 2061 xfrm_secpath_reject(xerr_idx, skb, &fl); 2062 XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS); 2063 return 0; 2064 } 2065 return 1; 2066 } 2067 2068 pol->curlft.use_time = get_seconds(); 2069 2070 pols[0] = pol; 2071 npols ++; 2072#ifdef CONFIG_XFRM_SUB_POLICY 2073 if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) { 2074 pols[1] = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, 2075 &fl, family, 2076 XFRM_POLICY_IN); 2077 if (pols[1]) { 2078 if (IS_ERR(pols[1])) { 2079 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 2080 return 0; 2081 } 2082 pols[1]->curlft.use_time = get_seconds(); 2083 npols ++; 2084 } 2085 } 2086#endif 2087 2088 if (pol->action == XFRM_POLICY_ALLOW) { 2089 struct sec_path *sp; 2090 static struct sec_path dummy; 2091 struct xfrm_tmpl *tp[XFRM_MAX_DEPTH]; 2092 struct xfrm_tmpl *stp[XFRM_MAX_DEPTH]; 2093 struct xfrm_tmpl **tpp = tp; 2094 int ti = 0; 2095 int i, k; 2096 2097 if ((sp = skb->sp) == NULL) 2098 sp = &dummy; 2099 2100 for (pi = 0; pi < npols; pi++) { 2101 if (pols[pi] != pol && 2102 pols[pi]->action != XFRM_POLICY_ALLOW) { 2103 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK); 2104 goto reject; 2105 } 2106 if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) { 2107 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 2108 goto reject_error; 2109 } 2110 for (i = 0; i < pols[pi]->xfrm_nr; i++) 2111 tpp[ti++] = &pols[pi]->xfrm_vec[i]; 2112 } 2113 xfrm_nr = ti; 2114 if (npols > 1) { 2115 xfrm_tmpl_sort(stp, tpp, xfrm_nr, family); 2116 tpp = stp; 2117 } 2118 2119 /* For each tunnel xfrm, find the first matching tmpl. 2120 * For each tmpl before that, find corresponding xfrm. 2121 * Order is _important_. Later we will implement 2122 * some barriers, but at the moment barriers 2123 * are implied between each two transformations. 2124 */ 2125 for (i = xfrm_nr-1, k = 0; i >= 0; i--) { 2126 k = xfrm_policy_ok(tpp[i], sp, k, family); 2127 if (k < 0) { 2128 if (k < -1) 2129 /* "-2 - errored_index" returned */ 2130 xerr_idx = -(2+k); 2131 XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH); 2132 goto reject; 2133 } 2134 } 2135 2136 if (secpath_has_nontransport(sp, k, &xerr_idx)) { 2137 XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH); 2138 goto reject; 2139 } 2140 2141 xfrm_pols_put(pols, npols); 2142 return 1; 2143 } 2144 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK); 2145 2146reject: 2147 xfrm_secpath_reject(xerr_idx, skb, &fl); 2148reject_error: 2149 xfrm_pols_put(pols, npols); 2150 return 0; 2151} 2152EXPORT_SYMBOL(__xfrm_policy_check); 2153 2154int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) 2155{ 2156 struct net *net = dev_net(skb->dev); 2157 struct flowi fl; 2158 struct dst_entry *dst; 2159 int res; 2160 2161 if (xfrm_decode_session(skb, &fl, family) < 0) { 2162 XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR); 2163 return 0; 2164 } 2165 2166 skb_dst_force(skb); 2167 dst = skb_dst(skb); 2168 2169 res = xfrm_lookup(net, &dst, &fl, NULL, 0) == 0; 2170 skb_dst_set(skb, dst); 2171 return res; 2172} 2173EXPORT_SYMBOL(__xfrm_route_forward); 2174 2175/* Optimize later using cookies and generation ids. */ 2176 2177static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie) 2178{ 2179 /* Code (such as __xfrm4_bundle_create()) sets dst->obsolete 2180 * to "-1" to force all XFRM destinations to get validated by 2181 * dst_ops->check on every use. We do this because when a 2182 * normal route referenced by an XFRM dst is obsoleted we do 2183 * not go looking around for all parent referencing XFRM dsts 2184 * so that we can invalidate them. It is just too much work. 2185 * Instead we make the checks here on every use. For example: 2186 * 2187 * XFRM dst A --> IPv4 dst X 2188 * 2189 * X is the "xdst->route" of A (X is also the "dst->path" of A 2190 * in this example). If X is marked obsolete, "A" will not 2191 * notice. That's what we are validating here via the 2192 * stale_bundle() check. 2193 * 2194 * When a policy's bundle is pruned, we dst_free() the XFRM 2195 * dst which causes it's ->obsolete field to be set to a 2196 * positive non-zero integer. If an XFRM dst has been pruned 2197 * like this, we want to force a new route lookup. 2198 */ 2199 if (dst->obsolete < 0 && !stale_bundle(dst)) 2200 return dst; 2201 2202 return NULL; 2203} 2204 2205static int stale_bundle(struct dst_entry *dst) 2206{ 2207 return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0); 2208} 2209 2210void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev) 2211{ 2212 while ((dst = dst->child) && dst->xfrm && dst->dev == dev) { 2213 dst->dev = dev_net(dev)->loopback_dev; 2214 dev_hold(dst->dev); 2215 dev_put(dev); 2216 } 2217} 2218EXPORT_SYMBOL(xfrm_dst_ifdown); 2219 2220static void xfrm_link_failure(struct sk_buff *skb) 2221{ 2222 /* Impossible. Such dst must be popped before reaches point of failure. */ 2223} 2224 2225static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst) 2226{ 2227 if (dst) { 2228 if (dst->obsolete) { 2229 dst_release(dst); 2230 dst = NULL; 2231 } 2232 } 2233 return dst; 2234} 2235 2236static void __xfrm_garbage_collect(struct net *net) 2237{ 2238 struct dst_entry *head, *next; 2239 2240 flow_cache_flush(); 2241 2242 spin_lock_bh(&xfrm_policy_sk_bundle_lock); 2243 head = xfrm_policy_sk_bundles; 2244 xfrm_policy_sk_bundles = NULL; 2245 spin_unlock_bh(&xfrm_policy_sk_bundle_lock); 2246 2247 while (head) { 2248 next = head->next; 2249 dst_free(head); 2250 head = next; 2251 } 2252} 2253 2254static void xfrm_init_pmtu(struct dst_entry *dst) 2255{ 2256 do { 2257 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 2258 u32 pmtu, route_mtu_cached; 2259 2260 pmtu = dst_mtu(dst->child); 2261 xdst->child_mtu_cached = pmtu; 2262 2263 pmtu = xfrm_state_mtu(dst->xfrm, pmtu); 2264 2265 route_mtu_cached = dst_mtu(xdst->route); 2266 xdst->route_mtu_cached = route_mtu_cached; 2267 2268 if (pmtu > route_mtu_cached) 2269 pmtu = route_mtu_cached; 2270 2271 dst->metrics[RTAX_MTU-1] = pmtu; 2272 } while ((dst = dst->next)); 2273} 2274 2275/* Check that the bundle accepts the flow and its components are 2276 * still valid. 2277 */ 2278 2279int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first, 2280 struct flowi *fl, int family, int strict) 2281{ 2282 struct dst_entry *dst = &first->u.dst; 2283 struct xfrm_dst *last; 2284 u32 mtu; 2285 2286 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) || 2287 (dst->dev && !netif_running(dst->dev))) 2288 return 0; 2289#ifdef CONFIG_XFRM_SUB_POLICY 2290 if (fl) { 2291 if (first->origin && !flow_cache_uli_match(first->origin, fl)) 2292 return 0; 2293 if (first->partner && 2294 !xfrm_selector_match(first->partner, fl, family)) 2295 return 0; 2296 } 2297#endif 2298 2299 last = NULL; 2300 2301 do { 2302 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 2303 2304 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family)) 2305 return 0; 2306 if (fl && pol && 2307 !security_xfrm_state_pol_flow_match(dst->xfrm, pol, fl)) 2308 return 0; 2309 if (dst->xfrm->km.state != XFRM_STATE_VALID) 2310 return 0; 2311 if (xdst->xfrm_genid != dst->xfrm->genid) 2312 return 0; 2313 if (xdst->num_pols > 0 && 2314 xdst->policy_genid != atomic_read(&xdst->pols[0]->genid)) 2315 return 0; 2316 2317 if (strict && fl && 2318 !(dst->xfrm->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) && 2319 !xfrm_state_addr_flow_check(dst->xfrm, fl, family)) 2320 return 0; 2321 2322 mtu = dst_mtu(dst->child); 2323 if (xdst->child_mtu_cached != mtu) { 2324 last = xdst; 2325 xdst->child_mtu_cached = mtu; 2326 } 2327 2328 if (!dst_check(xdst->route, xdst->route_cookie)) 2329 return 0; 2330 mtu = dst_mtu(xdst->route); 2331 if (xdst->route_mtu_cached != mtu) { 2332 last = xdst; 2333 xdst->route_mtu_cached = mtu; 2334 } 2335 2336 dst = dst->child; 2337 } while (dst->xfrm); 2338 2339 if (likely(!last)) 2340 return 1; 2341 2342 mtu = last->child_mtu_cached; 2343 for (;;) { 2344 dst = &last->u.dst; 2345 2346 mtu = xfrm_state_mtu(dst->xfrm, mtu); 2347 if (mtu > last->route_mtu_cached) 2348 mtu = last->route_mtu_cached; 2349 dst->metrics[RTAX_MTU-1] = mtu; 2350 2351 if (last == first) 2352 break; 2353 2354 last = (struct xfrm_dst *)last->u.dst.next; 2355 last->child_mtu_cached = mtu; 2356 } 2357 2358 return 1; 2359} 2360 2361EXPORT_SYMBOL(xfrm_bundle_ok); 2362 2363int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo) 2364{ 2365 struct net *net; 2366 int err = 0; 2367 if (unlikely(afinfo == NULL)) 2368 return -EINVAL; 2369 if (unlikely(afinfo->family >= NPROTO)) 2370 return -EAFNOSUPPORT; 2371 write_lock_bh(&xfrm_policy_afinfo_lock); 2372 if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL)) 2373 err = -ENOBUFS; 2374 else { 2375 struct dst_ops *dst_ops = afinfo->dst_ops; 2376 if (likely(dst_ops->kmem_cachep == NULL)) 2377 dst_ops->kmem_cachep = xfrm_dst_cache; 2378 if (likely(dst_ops->check == NULL)) 2379 dst_ops->check = xfrm_dst_check; 2380 if (likely(dst_ops->negative_advice == NULL)) 2381 dst_ops->negative_advice = xfrm_negative_advice; 2382 if (likely(dst_ops->link_failure == NULL)) 2383 dst_ops->link_failure = xfrm_link_failure; 2384 if (likely(afinfo->garbage_collect == NULL)) 2385 afinfo->garbage_collect = __xfrm_garbage_collect; 2386 xfrm_policy_afinfo[afinfo->family] = afinfo; 2387 } 2388 write_unlock_bh(&xfrm_policy_afinfo_lock); 2389 2390 rtnl_lock(); 2391 for_each_net(net) { 2392 struct dst_ops *xfrm_dst_ops; 2393 2394 switch (afinfo->family) { 2395 case AF_INET: 2396 xfrm_dst_ops = &net->xfrm.xfrm4_dst_ops; 2397 break; 2398#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2399 case AF_INET6: 2400 xfrm_dst_ops = &net->xfrm.xfrm6_dst_ops; 2401 break; 2402#endif 2403 default: 2404 BUG(); 2405 } 2406 *xfrm_dst_ops = *afinfo->dst_ops; 2407 } 2408 rtnl_unlock(); 2409 2410 return err; 2411} 2412EXPORT_SYMBOL(xfrm_policy_register_afinfo); 2413 2414int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo) 2415{ 2416 int err = 0; 2417 if (unlikely(afinfo == NULL)) 2418 return -EINVAL; 2419 if (unlikely(afinfo->family >= NPROTO)) 2420 return -EAFNOSUPPORT; 2421 write_lock_bh(&xfrm_policy_afinfo_lock); 2422 if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) { 2423 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo)) 2424 err = -EINVAL; 2425 else { 2426 struct dst_ops *dst_ops = afinfo->dst_ops; 2427 xfrm_policy_afinfo[afinfo->family] = NULL; 2428 dst_ops->kmem_cachep = NULL; 2429 dst_ops->check = NULL; 2430 dst_ops->negative_advice = NULL; 2431 dst_ops->link_failure = NULL; 2432 afinfo->garbage_collect = NULL; 2433 } 2434 } 2435 write_unlock_bh(&xfrm_policy_afinfo_lock); 2436 return err; 2437} 2438EXPORT_SYMBOL(xfrm_policy_unregister_afinfo); 2439 2440static void __net_init xfrm_dst_ops_init(struct net *net) 2441{ 2442 struct xfrm_policy_afinfo *afinfo; 2443 2444 read_lock_bh(&xfrm_policy_afinfo_lock); 2445 afinfo = xfrm_policy_afinfo[AF_INET]; 2446 if (afinfo) 2447 net->xfrm.xfrm4_dst_ops = *afinfo->dst_ops; 2448#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2449 afinfo = xfrm_policy_afinfo[AF_INET6]; 2450 if (afinfo) 2451 net->xfrm.xfrm6_dst_ops = *afinfo->dst_ops; 2452#endif 2453 read_unlock_bh(&xfrm_policy_afinfo_lock); 2454} 2455 2456static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family) 2457{ 2458 struct xfrm_policy_afinfo *afinfo; 2459 if (unlikely(family >= NPROTO)) 2460 return NULL; 2461 read_lock(&xfrm_policy_afinfo_lock); 2462 afinfo = xfrm_policy_afinfo[family]; 2463 if (unlikely(!afinfo)) 2464 read_unlock(&xfrm_policy_afinfo_lock); 2465 return afinfo; 2466} 2467 2468static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo) 2469{ 2470 read_unlock(&xfrm_policy_afinfo_lock); 2471} 2472 2473static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr) 2474{ 2475 struct net_device *dev = ptr; 2476 2477 switch (event) { 2478 case NETDEV_DOWN: 2479 __xfrm_garbage_collect(dev_net(dev)); 2480 } 2481 return NOTIFY_DONE; 2482} 2483 2484static struct notifier_block xfrm_dev_notifier = { 2485 .notifier_call = xfrm_dev_event, 2486}; 2487 2488#ifdef CONFIG_XFRM_STATISTICS 2489static int __net_init xfrm_statistics_init(struct net *net) 2490{ 2491 int rv; 2492 2493 if (snmp_mib_init((void __percpu **)net->mib.xfrm_statistics, 2494 sizeof(struct linux_xfrm_mib), 2495 __alignof__(struct linux_xfrm_mib)) < 0) 2496 return -ENOMEM; 2497 rv = xfrm_proc_init(net); 2498 if (rv < 0) 2499 snmp_mib_free((void __percpu **)net->mib.xfrm_statistics); 2500 return rv; 2501} 2502 2503static void xfrm_statistics_fini(struct net *net) 2504{ 2505 xfrm_proc_fini(net); 2506 snmp_mib_free((void __percpu **)net->mib.xfrm_statistics); 2507} 2508#else 2509static int __net_init xfrm_statistics_init(struct net *net) 2510{ 2511 return 0; 2512} 2513 2514static void xfrm_statistics_fini(struct net *net) 2515{ 2516} 2517#endif 2518 2519static int __net_init xfrm_policy_init(struct net *net) 2520{ 2521 unsigned int hmask, sz; 2522 int dir; 2523 2524 if (net_eq(net, &init_net)) 2525 xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache", 2526 sizeof(struct xfrm_dst), 2527 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, 2528 NULL); 2529 2530 hmask = 8 - 1; 2531 sz = (hmask+1) * sizeof(struct hlist_head); 2532 2533 net->xfrm.policy_byidx = xfrm_hash_alloc(sz); 2534 if (!net->xfrm.policy_byidx) 2535 goto out_byidx; 2536 net->xfrm.policy_idx_hmask = hmask; 2537 2538 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 2539 struct xfrm_policy_hash *htab; 2540 2541 net->xfrm.policy_count[dir] = 0; 2542 INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]); 2543 2544 htab = &net->xfrm.policy_bydst[dir]; 2545 htab->table = xfrm_hash_alloc(sz); 2546 if (!htab->table) 2547 goto out_bydst; 2548 htab->hmask = hmask; 2549 } 2550 2551 INIT_LIST_HEAD(&net->xfrm.policy_all); 2552 INIT_WORK(&net->xfrm.policy_hash_work, xfrm_hash_resize); 2553 if (net_eq(net, &init_net)) 2554 register_netdevice_notifier(&xfrm_dev_notifier); 2555 return 0; 2556 2557out_bydst: 2558 for (dir--; dir >= 0; dir--) { 2559 struct xfrm_policy_hash *htab; 2560 2561 htab = &net->xfrm.policy_bydst[dir]; 2562 xfrm_hash_free(htab->table, sz); 2563 } 2564 xfrm_hash_free(net->xfrm.policy_byidx, sz); 2565out_byidx: 2566 return -ENOMEM; 2567} 2568 2569static void xfrm_policy_fini(struct net *net) 2570{ 2571 struct xfrm_audit audit_info; 2572 unsigned int sz; 2573 int dir; 2574 2575 flush_work(&net->xfrm.policy_hash_work); 2576#ifdef CONFIG_XFRM_SUB_POLICY 2577 audit_info.loginuid = -1; 2578 audit_info.sessionid = -1; 2579 audit_info.secid = 0; 2580 xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info); 2581#endif 2582 audit_info.loginuid = -1; 2583 audit_info.sessionid = -1; 2584 audit_info.secid = 0; 2585 xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info); 2586 2587 WARN_ON(!list_empty(&net->xfrm.policy_all)); 2588 2589 for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { 2590 struct xfrm_policy_hash *htab; 2591 2592 WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir])); 2593 2594 htab = &net->xfrm.policy_bydst[dir]; 2595 sz = (htab->hmask + 1); 2596 WARN_ON(!hlist_empty(htab->table)); 2597 xfrm_hash_free(htab->table, sz); 2598 } 2599 2600 sz = (net->xfrm.policy_idx_hmask + 1) * sizeof(struct hlist_head); 2601 WARN_ON(!hlist_empty(net->xfrm.policy_byidx)); 2602 xfrm_hash_free(net->xfrm.policy_byidx, sz); 2603} 2604 2605static int __net_init xfrm_net_init(struct net *net) 2606{ 2607 int rv; 2608 2609 rv = xfrm_statistics_init(net); 2610 if (rv < 0) 2611 goto out_statistics; 2612 rv = xfrm_state_init(net); 2613 if (rv < 0) 2614 goto out_state; 2615 rv = xfrm_policy_init(net); 2616 if (rv < 0) 2617 goto out_policy; 2618 xfrm_dst_ops_init(net); 2619 rv = xfrm_sysctl_init(net); 2620 if (rv < 0) 2621 goto out_sysctl; 2622 return 0; 2623 2624out_sysctl: 2625 xfrm_policy_fini(net); 2626out_policy: 2627 xfrm_state_fini(net); 2628out_state: 2629 xfrm_statistics_fini(net); 2630out_statistics: 2631 return rv; 2632} 2633 2634static void __net_exit xfrm_net_exit(struct net *net) 2635{ 2636 xfrm_sysctl_fini(net); 2637 xfrm_policy_fini(net); 2638 xfrm_state_fini(net); 2639 xfrm_statistics_fini(net); 2640} 2641 2642static struct pernet_operations __net_initdata xfrm_net_ops = { 2643 .init = xfrm_net_init, 2644 .exit = xfrm_net_exit, 2645}; 2646 2647void __init xfrm_init(void) 2648{ 2649 register_pernet_subsys(&xfrm_net_ops); 2650 xfrm_input_init(); 2651} 2652 2653#ifdef CONFIG_AUDITSYSCALL 2654static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp, 2655 struct audit_buffer *audit_buf) 2656{ 2657 struct xfrm_sec_ctx *ctx = xp->security; 2658 struct xfrm_selector *sel = &xp->selector; 2659 2660 if (ctx) 2661 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s", 2662 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str); 2663 2664 switch(sel->family) { 2665 case AF_INET: 2666 audit_log_format(audit_buf, " src=%pI4", &sel->saddr.a4); 2667 if (sel->prefixlen_s != 32) 2668 audit_log_format(audit_buf, " src_prefixlen=%d", 2669 sel->prefixlen_s); 2670 audit_log_format(audit_buf, " dst=%pI4", &sel->daddr.a4); 2671 if (sel->prefixlen_d != 32) 2672 audit_log_format(audit_buf, " dst_prefixlen=%d", 2673 sel->prefixlen_d); 2674 break; 2675 case AF_INET6: 2676 audit_log_format(audit_buf, " src=%pI6", sel->saddr.a6); 2677 if (sel->prefixlen_s != 128) 2678 audit_log_format(audit_buf, " src_prefixlen=%d", 2679 sel->prefixlen_s); 2680 audit_log_format(audit_buf, " dst=%pI6", sel->daddr.a6); 2681 if (sel->prefixlen_d != 128) 2682 audit_log_format(audit_buf, " dst_prefixlen=%d", 2683 sel->prefixlen_d); 2684 break; 2685 } 2686} 2687 2688void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 2689 uid_t auid, u32 sessionid, u32 secid) 2690{ 2691 struct audit_buffer *audit_buf; 2692 2693 audit_buf = xfrm_audit_start("SPD-add"); 2694 if (audit_buf == NULL) 2695 return; 2696 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2697 audit_log_format(audit_buf, " res=%u", result); 2698 xfrm_audit_common_policyinfo(xp, audit_buf); 2699 audit_log_end(audit_buf); 2700} 2701EXPORT_SYMBOL_GPL(xfrm_audit_policy_add); 2702 2703void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 2704 uid_t auid, u32 sessionid, u32 secid) 2705{ 2706 struct audit_buffer *audit_buf; 2707 2708 audit_buf = xfrm_audit_start("SPD-delete"); 2709 if (audit_buf == NULL) 2710 return; 2711 xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); 2712 audit_log_format(audit_buf, " res=%u", result); 2713 xfrm_audit_common_policyinfo(xp, audit_buf); 2714 audit_log_end(audit_buf); 2715} 2716EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete); 2717#endif 2718 2719#ifdef CONFIG_XFRM_MIGRATE 2720static int xfrm_migrate_selector_match(struct xfrm_selector *sel_cmp, 2721 struct xfrm_selector *sel_tgt) 2722{ 2723 if (sel_cmp->proto == IPSEC_ULPROTO_ANY) { 2724 if (sel_tgt->family == sel_cmp->family && 2725 xfrm_addr_cmp(&sel_tgt->daddr, &sel_cmp->daddr, 2726 sel_cmp->family) == 0 && 2727 xfrm_addr_cmp(&sel_tgt->saddr, &sel_cmp->saddr, 2728 sel_cmp->family) == 0 && 2729 sel_tgt->prefixlen_d == sel_cmp->prefixlen_d && 2730 sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) { 2731 return 1; 2732 } 2733 } else { 2734 if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) { 2735 return 1; 2736 } 2737 } 2738 return 0; 2739} 2740 2741static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel, 2742 u8 dir, u8 type) 2743{ 2744 struct xfrm_policy *pol, *ret = NULL; 2745 struct hlist_node *entry; 2746 struct hlist_head *chain; 2747 u32 priority = ~0U; 2748 2749 read_lock_bh(&xfrm_policy_lock); 2750 chain = policy_hash_direct(&init_net, &sel->daddr, &sel->saddr, sel->family, dir); 2751 hlist_for_each_entry(pol, entry, chain, bydst) { 2752 if (xfrm_migrate_selector_match(sel, &pol->selector) && 2753 pol->type == type) { 2754 ret = pol; 2755 priority = ret->priority; 2756 break; 2757 } 2758 } 2759 chain = &init_net.xfrm.policy_inexact[dir]; 2760 hlist_for_each_entry(pol, entry, chain, bydst) { 2761 if (xfrm_migrate_selector_match(sel, &pol->selector) && 2762 pol->type == type && 2763 pol->priority < priority) { 2764 ret = pol; 2765 break; 2766 } 2767 } 2768 2769 if (ret) 2770 xfrm_pol_hold(ret); 2771 2772 read_unlock_bh(&xfrm_policy_lock); 2773 2774 return ret; 2775} 2776 2777static int migrate_tmpl_match(struct xfrm_migrate *m, struct xfrm_tmpl *t) 2778{ 2779 int match = 0; 2780 2781 if (t->mode == m->mode && t->id.proto == m->proto && 2782 (m->reqid == 0 || t->reqid == m->reqid)) { 2783 switch (t->mode) { 2784 case XFRM_MODE_TUNNEL: 2785 case XFRM_MODE_BEET: 2786 if (xfrm_addr_cmp(&t->id.daddr, &m->old_daddr, 2787 m->old_family) == 0 && 2788 xfrm_addr_cmp(&t->saddr, &m->old_saddr, 2789 m->old_family) == 0) { 2790 match = 1; 2791 } 2792 break; 2793 case XFRM_MODE_TRANSPORT: 2794 /* in case of transport mode, template does not store 2795 any IP addresses, hence we just compare mode and 2796 protocol */ 2797 match = 1; 2798 break; 2799 default: 2800 break; 2801 } 2802 } 2803 return match; 2804} 2805 2806/* update endpoint address(es) of template(s) */ 2807static int xfrm_policy_migrate(struct xfrm_policy *pol, 2808 struct xfrm_migrate *m, int num_migrate) 2809{ 2810 struct xfrm_migrate *mp; 2811 int i, j, n = 0; 2812 2813 write_lock_bh(&pol->lock); 2814 if (unlikely(pol->walk.dead)) { 2815 /* target policy has been deleted */ 2816 write_unlock_bh(&pol->lock); 2817 return -ENOENT; 2818 } 2819 2820 for (i = 0; i < pol->xfrm_nr; i++) { 2821 for (j = 0, mp = m; j < num_migrate; j++, mp++) { 2822 if (!migrate_tmpl_match(mp, &pol->xfrm_vec[i])) 2823 continue; 2824 n++; 2825 if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL && 2826 pol->xfrm_vec[i].mode != XFRM_MODE_BEET) 2827 continue; 2828 /* update endpoints */ 2829 memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr, 2830 sizeof(pol->xfrm_vec[i].id.daddr)); 2831 memcpy(&pol->xfrm_vec[i].saddr, &mp->new_saddr, 2832 sizeof(pol->xfrm_vec[i].saddr)); 2833 pol->xfrm_vec[i].encap_family = mp->new_family; 2834 /* flush bundles */ 2835 atomic_inc(&pol->genid); 2836 } 2837 } 2838 2839 write_unlock_bh(&pol->lock); 2840 2841 if (!n) 2842 return -ENODATA; 2843 2844 return 0; 2845} 2846 2847static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate) 2848{ 2849 int i, j; 2850 2851 if (num_migrate < 1 || num_migrate > XFRM_MAX_DEPTH) 2852 return -EINVAL; 2853 2854 for (i = 0; i < num_migrate; i++) { 2855 if ((xfrm_addr_cmp(&m[i].old_daddr, &m[i].new_daddr, 2856 m[i].old_family) == 0) && 2857 (xfrm_addr_cmp(&m[i].old_saddr, &m[i].new_saddr, 2858 m[i].old_family) == 0)) 2859 return -EINVAL; 2860 if (xfrm_addr_any(&m[i].new_daddr, m[i].new_family) || 2861 xfrm_addr_any(&m[i].new_saddr, m[i].new_family)) 2862 return -EINVAL; 2863 2864 /* check if there is any duplicated entry */ 2865 for (j = i + 1; j < num_migrate; j++) { 2866 if (!memcmp(&m[i].old_daddr, &m[j].old_daddr, 2867 sizeof(m[i].old_daddr)) && 2868 !memcmp(&m[i].old_saddr, &m[j].old_saddr, 2869 sizeof(m[i].old_saddr)) && 2870 m[i].proto == m[j].proto && 2871 m[i].mode == m[j].mode && 2872 m[i].reqid == m[j].reqid && 2873 m[i].old_family == m[j].old_family) 2874 return -EINVAL; 2875 } 2876 } 2877 2878 return 0; 2879} 2880 2881int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 2882 struct xfrm_migrate *m, int num_migrate, 2883 struct xfrm_kmaddress *k) 2884{ 2885 int i, err, nx_cur = 0, nx_new = 0; 2886 struct xfrm_policy *pol = NULL; 2887 struct xfrm_state *x, *xc; 2888 struct xfrm_state *x_cur[XFRM_MAX_DEPTH]; 2889 struct xfrm_state *x_new[XFRM_MAX_DEPTH]; 2890 struct xfrm_migrate *mp; 2891 2892 if ((err = xfrm_migrate_check(m, num_migrate)) < 0) 2893 goto out; 2894 2895 /* Stage 1 - find policy */ 2896 if ((pol = xfrm_migrate_policy_find(sel, dir, type)) == NULL) { 2897 err = -ENOENT; 2898 goto out; 2899 } 2900 2901 /* Stage 2 - find and update state(s) */ 2902 for (i = 0, mp = m; i < num_migrate; i++, mp++) { 2903 if ((x = xfrm_migrate_state_find(mp))) { 2904 x_cur[nx_cur] = x; 2905 nx_cur++; 2906 if ((xc = xfrm_state_migrate(x, mp))) { 2907 x_new[nx_new] = xc; 2908 nx_new++; 2909 } else { 2910 err = -ENODATA; 2911 goto restore_state; 2912 } 2913 } 2914 } 2915 2916 /* Stage 3 - update policy */ 2917 if ((err = xfrm_policy_migrate(pol, m, num_migrate)) < 0) 2918 goto restore_state; 2919 2920 /* Stage 4 - delete old state(s) */ 2921 if (nx_cur) { 2922 xfrm_states_put(x_cur, nx_cur); 2923 xfrm_states_delete(x_cur, nx_cur); 2924 } 2925 2926 /* Stage 5 - announce */ 2927 km_migrate(sel, dir, type, m, num_migrate, k); 2928 2929 xfrm_pol_put(pol); 2930 2931 return 0; 2932out: 2933 return err; 2934 2935restore_state: 2936 if (pol) 2937 xfrm_pol_put(pol); 2938 if (nx_cur) 2939 xfrm_states_put(x_cur, nx_cur); 2940 if (nx_new) 2941 xfrm_states_delete(x_new, nx_new); 2942 2943 return err; 2944} 2945EXPORT_SYMBOL(xfrm_migrate); 2946#endif 2947