xfrm_policy.c 80.5 KB
Newer Older
1
/*
L
Linus Torvalds 已提交
2 3 4 5 6 7 8 9 10 11 12
 * xfrm_policy.c
 *
 * Changes:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
 * 	Kazunori MIYAZAWA @USAGI
 * 	YOSHIFUJI Hideaki
 * 		Split up af-specific portion
 *	Derek Atkins <derek@ihtfp.com>		Add the post_input processor
13
 *
L
Linus Torvalds 已提交
14 15
 */

16
#include <linux/err.h>
L
Linus Torvalds 已提交
17 18 19 20 21 22 23
#include <linux/slab.h>
#include <linux/kmod.h>
#include <linux/list.h>
#include <linux/spinlock.h>
#include <linux/workqueue.h>
#include <linux/notifier.h>
#include <linux/netdevice.h>
24
#include <linux/netfilter.h>
L
Linus Torvalds 已提交
25
#include <linux/module.h>
26
#include <linux/cache.h>
P
Paul Moore 已提交
27
#include <linux/audit.h>
28
#include <net/dst.h>
29
#include <net/flow.h>
L
Linus Torvalds 已提交
30 31
#include <net/xfrm.h>
#include <net/ip.h>
32 33 34
#ifdef CONFIG_XFRM_STATISTICS
#include <net/snmp.h>
#endif
L
Linus Torvalds 已提交
35

36 37
#include "xfrm_hash.h"

38 39 40 41
#define XFRM_QUEUE_TMO_MIN ((unsigned)(HZ/10))
#define XFRM_QUEUE_TMO_MAX ((unsigned)(60*HZ))
#define XFRM_MAX_QUEUE_LEN	100

42 43 44 45 46
struct xfrm_flo {
	struct dst_entry *dst_orig;
	u8 flags;
};

47 48 49
static DEFINE_SPINLOCK(xfrm_policy_afinfo_lock);
static struct xfrm_policy_afinfo __rcu *xfrm_policy_afinfo[NPROTO]
						__read_mostly;
L
Linus Torvalds 已提交
50

51
static struct kmem_cache *xfrm_dst_cache __read_mostly;
52
static __read_mostly seqcount_t xfrm_policy_hash_generation;
L
Linus Torvalds 已提交
53

54
static void xfrm_init_pmtu(struct dst_entry *dst);
55
static int stale_bundle(struct dst_entry *dst);
56
static int xfrm_bundle_ok(struct xfrm_dst *xdst);
57
static void xfrm_policy_queue_process(unsigned long arg);
L
Linus Torvalds 已提交
58

59
static void __xfrm_policy_link(struct xfrm_policy *pol, int dir);
W
Wei Yongjun 已提交
60 61 62
static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
						int dir);

63 64 65 66 67
static inline bool xfrm_pol_hold_rcu(struct xfrm_policy *policy)
{
	return atomic_inc_not_zero(&policy->refcnt);
}

68
static inline bool
69
__xfrm4_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
70
{
71 72
	const struct flowi4 *fl4 = &fl->u.ip4;

73 74
	return  addr4_match(fl4->daddr, sel->daddr.a4, sel->prefixlen_d) &&
		addr4_match(fl4->saddr, sel->saddr.a4, sel->prefixlen_s) &&
75 76 77 78
		!((xfrm_flowi_dport(fl, &fl4->uli) ^ sel->dport) & sel->dport_mask) &&
		!((xfrm_flowi_sport(fl, &fl4->uli) ^ sel->sport) & sel->sport_mask) &&
		(fl4->flowi4_proto == sel->proto || !sel->proto) &&
		(fl4->flowi4_oif == sel->ifindex || !sel->ifindex);
79 80
}

81
static inline bool
82
__xfrm6_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
83
{
84 85 86 87 88 89 90 91
	const struct flowi6 *fl6 = &fl->u.ip6;

	return  addr_match(&fl6->daddr, &sel->daddr, sel->prefixlen_d) &&
		addr_match(&fl6->saddr, &sel->saddr, sel->prefixlen_s) &&
		!((xfrm_flowi_dport(fl, &fl6->uli) ^ sel->dport) & sel->dport_mask) &&
		!((xfrm_flowi_sport(fl, &fl6->uli) ^ sel->sport) & sel->sport_mask) &&
		(fl6->flowi6_proto == sel->proto || !sel->proto) &&
		(fl6->flowi6_oif == sel->ifindex || !sel->ifindex);
92 93
}

94 95
bool xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
			 unsigned short family)
96 97 98 99 100 101 102
{
	switch (family) {
	case AF_INET:
		return __xfrm4_selector_match(sel, fl);
	case AF_INET6:
		return __xfrm6_selector_match(sel, fl);
	}
103
	return false;
104 105
}

E
Eric Dumazet 已提交
106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123
static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
{
	struct xfrm_policy_afinfo *afinfo;

	if (unlikely(family >= NPROTO))
		return NULL;
	rcu_read_lock();
	afinfo = rcu_dereference(xfrm_policy_afinfo[family]);
	if (unlikely(!afinfo))
		rcu_read_unlock();
	return afinfo;
}

static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo)
{
	rcu_read_unlock();
}

D
David Ahern 已提交
124 125
static inline struct dst_entry *__xfrm_dst_lookup(struct net *net,
						  int tos, int oif,
126 127
						  const xfrm_address_t *saddr,
						  const xfrm_address_t *daddr,
128 129 130 131 132 133 134 135 136
						  int family)
{
	struct xfrm_policy_afinfo *afinfo;
	struct dst_entry *dst;

	afinfo = xfrm_policy_get_afinfo(family);
	if (unlikely(afinfo == NULL))
		return ERR_PTR(-EAFNOSUPPORT);

D
David Ahern 已提交
137
	dst = afinfo->dst_lookup(net, tos, oif, saddr, daddr);
138 139 140 141 142 143

	xfrm_policy_put_afinfo(afinfo);

	return dst;
}

D
David Ahern 已提交
144 145
static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x,
						int tos, int oif,
146 147
						xfrm_address_t *prev_saddr,
						xfrm_address_t *prev_daddr,
148
						int family)
L
Linus Torvalds 已提交
149
{
150
	struct net *net = xs_net(x);
151 152 153 154
	xfrm_address_t *saddr = &x->props.saddr;
	xfrm_address_t *daddr = &x->id.daddr;
	struct dst_entry *dst;

155
	if (x->type->flags & XFRM_TYPE_LOCAL_COADDR) {
156
		saddr = x->coaddr;
157 158 159 160
		daddr = prev_daddr;
	}
	if (x->type->flags & XFRM_TYPE_REMOTE_COADDR) {
		saddr = prev_saddr;
161
		daddr = x->coaddr;
162
	}
L
Linus Torvalds 已提交
163

D
David Ahern 已提交
164
	dst = __xfrm_dst_lookup(net, tos, oif, saddr, daddr, family);
165 166 167 168 169 170 171

	if (!IS_ERR(dst)) {
		if (prev_saddr != saddr)
			memcpy(prev_saddr, saddr,  sizeof(*prev_saddr));
		if (prev_daddr != daddr)
			memcpy(prev_daddr, daddr,  sizeof(*prev_daddr));
	}
L
Linus Torvalds 已提交
172

173
	return dst;
L
Linus Torvalds 已提交
174 175 176 177 178 179 180
}

static inline unsigned long make_jiffies(long secs)
{
	if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
		return MAX_SCHEDULE_TIMEOUT-1;
	else
181
		return secs*HZ;
L
Linus Torvalds 已提交
182 183 184 185
}

static void xfrm_policy_timer(unsigned long data)
{
186
	struct xfrm_policy *xp = (struct xfrm_policy *)data;
187
	unsigned long now = get_seconds();
L
Linus Torvalds 已提交
188 189 190 191 192 193
	long next = LONG_MAX;
	int warn = 0;
	int dir;

	read_lock(&xp->lock);

194
	if (unlikely(xp->walk.dead))
L
Linus Torvalds 已提交
195 196
		goto out;

197
	dir = xfrm_policy_id2dir(xp->index);
L
Linus Torvalds 已提交
198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236

	if (xp->lft.hard_add_expires_seconds) {
		long tmo = xp->lft.hard_add_expires_seconds +
			xp->curlft.add_time - now;
		if (tmo <= 0)
			goto expired;
		if (tmo < next)
			next = tmo;
	}
	if (xp->lft.hard_use_expires_seconds) {
		long tmo = xp->lft.hard_use_expires_seconds +
			(xp->curlft.use_time ? : xp->curlft.add_time) - now;
		if (tmo <= 0)
			goto expired;
		if (tmo < next)
			next = tmo;
	}
	if (xp->lft.soft_add_expires_seconds) {
		long tmo = xp->lft.soft_add_expires_seconds +
			xp->curlft.add_time - now;
		if (tmo <= 0) {
			warn = 1;
			tmo = XFRM_KM_TIMEOUT;
		}
		if (tmo < next)
			next = tmo;
	}
	if (xp->lft.soft_use_expires_seconds) {
		long tmo = xp->lft.soft_use_expires_seconds +
			(xp->curlft.use_time ? : xp->curlft.add_time) - now;
		if (tmo <= 0) {
			warn = 1;
			tmo = XFRM_KM_TIMEOUT;
		}
		if (tmo < next)
			next = tmo;
	}

	if (warn)
237
		km_policy_expired(xp, dir, 0, 0);
L
Linus Torvalds 已提交
238 239 240 241 242 243 244 245 246 247 248
	if (next != LONG_MAX &&
	    !mod_timer(&xp->timer, jiffies + make_jiffies(next)))
		xfrm_pol_hold(xp);

out:
	read_unlock(&xp->lock);
	xfrm_pol_put(xp);
	return;

expired:
	read_unlock(&xp->lock);
249
	if (!xfrm_policy_delete(xp, dir))
250
		km_policy_expired(xp, dir, 1, 0);
L
Linus Torvalds 已提交
251 252 253
	xfrm_pol_put(xp);
}

254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282
static struct flow_cache_object *xfrm_policy_flo_get(struct flow_cache_object *flo)
{
	struct xfrm_policy *pol = container_of(flo, struct xfrm_policy, flo);

	if (unlikely(pol->walk.dead))
		flo = NULL;
	else
		xfrm_pol_hold(pol);

	return flo;
}

static int xfrm_policy_flo_check(struct flow_cache_object *flo)
{
	struct xfrm_policy *pol = container_of(flo, struct xfrm_policy, flo);

	return !pol->walk.dead;
}

static void xfrm_policy_flo_delete(struct flow_cache_object *flo)
{
	xfrm_pol_put(container_of(flo, struct xfrm_policy, flo));
}

static const struct flow_cache_ops xfrm_policy_fc_ops = {
	.get = xfrm_policy_flo_get,
	.check = xfrm_policy_flo_check,
	.delete = xfrm_policy_flo_delete,
};
L
Linus Torvalds 已提交
283 284 285 286 287

/* Allocate xfrm_policy. Not used here, it is supposed to be used by pfkeyv2
 * SPD calls.
 */

288
struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
L
Linus Torvalds 已提交
289 290 291
{
	struct xfrm_policy *policy;

292
	policy = kzalloc(sizeof(struct xfrm_policy), gfp);
L
Linus Torvalds 已提交
293 294

	if (policy) {
295
		write_pnet(&policy->xp_net, net);
H
Herbert Xu 已提交
296
		INIT_LIST_HEAD(&policy->walk.all);
297 298
		INIT_HLIST_NODE(&policy->bydst);
		INIT_HLIST_NODE(&policy->byidx);
L
Linus Torvalds 已提交
299
		rwlock_init(&policy->lock);
300
		atomic_set(&policy->refcnt, 1);
301
		skb_queue_head_init(&policy->polq.hold_queue);
302 303
		setup_timer(&policy->timer, xfrm_policy_timer,
				(unsigned long)policy);
304 305
		setup_timer(&policy->polq.hold_timer, xfrm_policy_queue_process,
			    (unsigned long)policy);
306
		policy->flo.ops = &xfrm_policy_fc_ops;
L
Linus Torvalds 已提交
307 308 309 310 311
	}
	return policy;
}
EXPORT_SYMBOL(xfrm_policy_alloc);

312 313 314 315 316 317 318 319
static void xfrm_policy_destroy_rcu(struct rcu_head *head)
{
	struct xfrm_policy *policy = container_of(head, struct xfrm_policy, rcu);

	security_xfrm_policy_free(policy->security);
	kfree(policy);
}

L
Linus Torvalds 已提交
320 321
/* Destroy xfrm_policy: descendant resources must be released to this moment. */

322
void xfrm_policy_destroy(struct xfrm_policy *policy)
L
Linus Torvalds 已提交
323
{
H
Herbert Xu 已提交
324
	BUG_ON(!policy->walk.dead);
L
Linus Torvalds 已提交
325

326
	if (del_timer(&policy->timer) || del_timer(&policy->polq.hold_timer))
L
Linus Torvalds 已提交
327 328
		BUG();

329
	call_rcu(&policy->rcu, xfrm_policy_destroy_rcu);
L
Linus Torvalds 已提交
330
}
331
EXPORT_SYMBOL(xfrm_policy_destroy);
L
Linus Torvalds 已提交
332 333 334 335 336 337 338

/* Rule must be locked. Release descentant resources, announce
 * entry dead. The rule must be unlinked from lists to the moment.
 */

static void xfrm_policy_kill(struct xfrm_policy *policy)
{
H
Herbert Xu 已提交
339
	policy->walk.dead = 1;
L
Linus Torvalds 已提交
340

341
	atomic_inc(&policy->genid);
L
Linus Torvalds 已提交
342

343 344
	if (del_timer(&policy->polq.hold_timer))
		xfrm_pol_put(policy);
345
	skb_queue_purge(&policy->polq.hold_queue);
346

347 348 349 350
	if (del_timer(&policy->timer))
		xfrm_pol_put(policy);

	xfrm_pol_put(policy);
L
Linus Torvalds 已提交
351 352
}

353 354
static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024;

355
static inline unsigned int idx_hash(struct net *net, u32 index)
356
{
357
	return __idx_hash(index, net->xfrm.policy_idx_hmask);
358 359
}

360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381
/* calculate policy hash thresholds */
static void __get_hash_thresh(struct net *net,
			      unsigned short family, int dir,
			      u8 *dbits, u8 *sbits)
{
	switch (family) {
	case AF_INET:
		*dbits = net->xfrm.policy_bydst[dir].dbits4;
		*sbits = net->xfrm.policy_bydst[dir].sbits4;
		break;

	case AF_INET6:
		*dbits = net->xfrm.policy_bydst[dir].dbits6;
		*sbits = net->xfrm.policy_bydst[dir].sbits6;
		break;

	default:
		*dbits = 0;
		*sbits = 0;
	}
}

382 383 384
static struct hlist_head *policy_hash_bysel(struct net *net,
					    const struct xfrm_selector *sel,
					    unsigned short family, int dir)
385
{
386
	unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
387 388 389 390 391 392
	unsigned int hash;
	u8 dbits;
	u8 sbits;

	__get_hash_thresh(net, family, dir, &dbits, &sbits);
	hash = __sel_hash(sel, family, hmask, dbits, sbits);
393

394 395 396 397 398
	if (hash == hmask + 1)
		return &net->xfrm.policy_inexact[dir];

	return rcu_dereference_check(net->xfrm.policy_bydst[dir].table,
		     lockdep_is_held(&net->xfrm.xfrm_policy_lock)) + hash;
399 400
}

401 402 403 404
static struct hlist_head *policy_hash_direct(struct net *net,
					     const xfrm_address_t *daddr,
					     const xfrm_address_t *saddr,
					     unsigned short family, int dir)
405
{
406
	unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
407 408 409 410 411 412
	unsigned int hash;
	u8 dbits;
	u8 sbits;

	__get_hash_thresh(net, family, dir, &dbits, &sbits);
	hash = __addr_hash(daddr, saddr, family, hmask, dbits, sbits);
413

414 415
	return rcu_dereference_check(net->xfrm.policy_bydst[dir].table,
		     lockdep_is_held(&net->xfrm.xfrm_policy_lock)) + hash;
416 417
}

418 419
static void xfrm_dst_hash_transfer(struct net *net,
				   struct hlist_head *list,
420
				   struct hlist_head *ndsttable,
421 422
				   unsigned int nhashmask,
				   int dir)
423
{
424
	struct hlist_node *tmp, *entry0 = NULL;
425
	struct xfrm_policy *pol;
426
	unsigned int h0 = 0;
427 428
	u8 dbits;
	u8 sbits;
429

430
redo:
431
	hlist_for_each_entry_safe(pol, tmp, list, bydst) {
432 433
		unsigned int h;

434
		__get_hash_thresh(net, pol->family, dir, &dbits, &sbits);
435
		h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr,
436
				pol->family, nhashmask, dbits, sbits);
437
		if (!entry0) {
438 439
			hlist_del_rcu(&pol->bydst);
			hlist_add_head_rcu(&pol->bydst, ndsttable + h);
440 441 442 443
			h0 = h;
		} else {
			if (h != h0)
				continue;
444 445
			hlist_del_rcu(&pol->bydst);
			hlist_add_behind_rcu(&pol->bydst, entry0);
446
		}
447
		entry0 = &pol->bydst;
448 449 450 451
	}
	if (!hlist_empty(list)) {
		entry0 = NULL;
		goto redo;
452 453 454 455 456 457 458
	}
}

static void xfrm_idx_hash_transfer(struct hlist_head *list,
				   struct hlist_head *nidxtable,
				   unsigned int nhashmask)
{
459
	struct hlist_node *tmp;
460 461
	struct xfrm_policy *pol;

462
	hlist_for_each_entry_safe(pol, tmp, list, byidx) {
463 464 465 466 467 468 469 470 471 472 473 474
		unsigned int h;

		h = __idx_hash(pol->index, nhashmask);
		hlist_add_head(&pol->byidx, nidxtable+h);
	}
}

static unsigned long xfrm_new_hash_mask(unsigned int old_hmask)
{
	return ((old_hmask + 1) << 1) - 1;
}

475
static void xfrm_bydst_resize(struct net *net, int dir)
476
{
477
	unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
478 479
	unsigned int nhashmask = xfrm_new_hash_mask(hmask);
	unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
480
	struct hlist_head *ndst = xfrm_hash_alloc(nsize);
481
	struct hlist_head *odst;
482 483 484 485 486
	int i;

	if (!ndst)
		return;

F
Fan Du 已提交
487
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
488 489 490 491
	write_seqcount_begin(&xfrm_policy_hash_generation);

	odst = rcu_dereference_protected(net->xfrm.policy_bydst[dir].table,
				lockdep_is_held(&net->xfrm.xfrm_policy_lock));
492

493 494 495
	odst = rcu_dereference_protected(net->xfrm.policy_bydst[dir].table,
				lockdep_is_held(&net->xfrm.xfrm_policy_lock));

496
	for (i = hmask; i >= 0; i--)
497
		xfrm_dst_hash_transfer(net, odst + i, ndst, nhashmask, dir);
498

499
	rcu_assign_pointer(net->xfrm.policy_bydst[dir].table, ndst);
500
	net->xfrm.policy_bydst[dir].hmask = nhashmask;
501

502
	write_seqcount_end(&xfrm_policy_hash_generation);
F
Fan Du 已提交
503
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
504

505 506
	synchronize_rcu();

507
	xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head));
508 509
}

510
static void xfrm_byidx_resize(struct net *net, int total)
511
{
512
	unsigned int hmask = net->xfrm.policy_idx_hmask;
513 514
	unsigned int nhashmask = xfrm_new_hash_mask(hmask);
	unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
515
	struct hlist_head *oidx = net->xfrm.policy_byidx;
516
	struct hlist_head *nidx = xfrm_hash_alloc(nsize);
517 518 519 520 521
	int i;

	if (!nidx)
		return;

F
Fan Du 已提交
522
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
523 524 525 526

	for (i = hmask; i >= 0; i--)
		xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask);

527 528
	net->xfrm.policy_byidx = nidx;
	net->xfrm.policy_idx_hmask = nhashmask;
529

F
Fan Du 已提交
530
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
531

532
	xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head));
533 534
}

535
static inline int xfrm_bydst_should_resize(struct net *net, int dir, int *total)
536
{
537 538
	unsigned int cnt = net->xfrm.policy_count[dir];
	unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
539 540 541 542 543 544 545 546 547 548 549

	if (total)
		*total += cnt;

	if ((hmask + 1) < xfrm_policy_hashmax &&
	    cnt > hmask)
		return 1;

	return 0;
}

550
static inline int xfrm_byidx_should_resize(struct net *net, int total)
551
{
552
	unsigned int hmask = net->xfrm.policy_idx_hmask;
553 554 555 556 557 558 559 560

	if ((hmask + 1) < xfrm_policy_hashmax &&
	    total > hmask)
		return 1;

	return 0;
}

561
void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si)
J
Jamal Hadi Salim 已提交
562
{
563 564 565 566 567 568 569
	si->incnt = net->xfrm.policy_count[XFRM_POLICY_IN];
	si->outcnt = net->xfrm.policy_count[XFRM_POLICY_OUT];
	si->fwdcnt = net->xfrm.policy_count[XFRM_POLICY_FWD];
	si->inscnt = net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
	si->outscnt = net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
	si->fwdscnt = net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
	si->spdhcnt = net->xfrm.policy_idx_hmask;
J
Jamal Hadi Salim 已提交
570 571 572
	si->spdhmcnt = xfrm_policy_hashmax;
}
EXPORT_SYMBOL(xfrm_spd_getinfo);
573

J
Jamal Hadi Salim 已提交
574
static DEFINE_MUTEX(hash_resize_mutex);
575
static void xfrm_hash_resize(struct work_struct *work)
576
{
577
	struct net *net = container_of(work, struct net, xfrm.policy_hash_work);
578 579 580 581 582
	int dir, total;

	mutex_lock(&hash_resize_mutex);

	total = 0;
H
Herbert Xu 已提交
583
	for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
584 585
		if (xfrm_bydst_should_resize(net, dir, &total))
			xfrm_bydst_resize(net, dir);
586
	}
587 588
	if (xfrm_byidx_should_resize(net, total))
		xfrm_byidx_resize(net, total);
589 590 591 592

	mutex_unlock(&hash_resize_mutex);
}

593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622
static void xfrm_hash_rebuild(struct work_struct *work)
{
	struct net *net = container_of(work, struct net,
				       xfrm.policy_hthresh.work);
	unsigned int hmask;
	struct xfrm_policy *pol;
	struct xfrm_policy *policy;
	struct hlist_head *chain;
	struct hlist_head *odst;
	struct hlist_node *newpos;
	int i;
	int dir;
	unsigned seq;
	u8 lbits4, rbits4, lbits6, rbits6;

	mutex_lock(&hash_resize_mutex);

	/* read selector prefixlen thresholds */
	do {
		seq = read_seqbegin(&net->xfrm.policy_hthresh.lock);

		lbits4 = net->xfrm.policy_hthresh.lbits4;
		rbits4 = net->xfrm.policy_hthresh.rbits4;
		lbits6 = net->xfrm.policy_hthresh.lbits6;
		rbits6 = net->xfrm.policy_hthresh.rbits6;
	} while (read_seqretry(&net->xfrm.policy_hthresh.lock, seq));

	write_lock_bh(&net->xfrm.xfrm_policy_lock);

	/* reset the bydst and inexact table in all directions */
H
Herbert Xu 已提交
623
	for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672
		INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
		hmask = net->xfrm.policy_bydst[dir].hmask;
		odst = net->xfrm.policy_bydst[dir].table;
		for (i = hmask; i >= 0; i--)
			INIT_HLIST_HEAD(odst + i);
		if ((dir & XFRM_POLICY_MASK) == XFRM_POLICY_OUT) {
			/* dir out => dst = remote, src = local */
			net->xfrm.policy_bydst[dir].dbits4 = rbits4;
			net->xfrm.policy_bydst[dir].sbits4 = lbits4;
			net->xfrm.policy_bydst[dir].dbits6 = rbits6;
			net->xfrm.policy_bydst[dir].sbits6 = lbits6;
		} else {
			/* dir in/fwd => dst = local, src = remote */
			net->xfrm.policy_bydst[dir].dbits4 = lbits4;
			net->xfrm.policy_bydst[dir].sbits4 = rbits4;
			net->xfrm.policy_bydst[dir].dbits6 = lbits6;
			net->xfrm.policy_bydst[dir].sbits6 = rbits6;
		}
	}

	/* re-insert all policies by order of creation */
	list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
		newpos = NULL;
		chain = policy_hash_bysel(net, &policy->selector,
					  policy->family,
					  xfrm_policy_id2dir(policy->index));
		hlist_for_each_entry(pol, chain, bydst) {
			if (policy->priority >= pol->priority)
				newpos = &pol->bydst;
			else
				break;
		}
		if (newpos)
			hlist_add_behind(&policy->bydst, newpos);
		else
			hlist_add_head(&policy->bydst, chain);
	}

	write_unlock_bh(&net->xfrm.xfrm_policy_lock);

	mutex_unlock(&hash_resize_mutex);
}

void xfrm_policy_hash_rebuild(struct net *net)
{
	schedule_work(&net->xfrm.policy_hthresh.work);
}
EXPORT_SYMBOL(xfrm_policy_hash_rebuild);

L
Linus Torvalds 已提交
673 674
/* Generate new index... KAME seems to generate them ordered by cost
 * of an absolute inpredictability of ordering of rules. This will not pass. */
675
static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
L
Linus Torvalds 已提交
676 677 678 679
{
	static u32 idx_generator;

	for (;;) {
680 681 682 683 684
		struct hlist_head *list;
		struct xfrm_policy *p;
		u32 idx;
		int found;

685 686 687 688 689 690 691 692
		if (!index) {
			idx = (idx_generator | dir);
			idx_generator += 8;
		} else {
			idx = index;
			index = 0;
		}

L
Linus Torvalds 已提交
693 694
		if (idx == 0)
			idx = 8;
695
		list = net->xfrm.policy_byidx + idx_hash(net, idx);
696
		found = 0;
697
		hlist_for_each_entry(p, list, byidx) {
698 699
			if (p->index == idx) {
				found = 1;
L
Linus Torvalds 已提交
700
				break;
701
			}
L
Linus Torvalds 已提交
702
		}
703
		if (!found)
L
Linus Torvalds 已提交
704 705 706 707
			return idx;
	}
}

708 709 710 711 712 713 714 715 716 717 718 719 720 721 722
static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s2)
{
	u32 *p1 = (u32 *) s1;
	u32 *p2 = (u32 *) s2;
	int len = sizeof(struct xfrm_selector) / sizeof(u32);
	int i;

	for (i = 0; i < len; i++) {
		if (p1[i] != p2[i])
			return 1;
	}

	return 0;
}

723 724 725 726 727 728
static void xfrm_policy_requeue(struct xfrm_policy *old,
				struct xfrm_policy *new)
{
	struct xfrm_policy_queue *pq = &old->polq;
	struct sk_buff_head list;

729 730 731
	if (skb_queue_empty(&pq->hold_queue))
		return;

732 733 734 735
	__skb_queue_head_init(&list);

	spin_lock_bh(&pq->hold_queue.lock);
	skb_queue_splice_init(&pq->hold_queue, &list);
736 737
	if (del_timer(&pq->hold_timer))
		xfrm_pol_put(old);
738 739 740 741 742 743 744
	spin_unlock_bh(&pq->hold_queue.lock);

	pq = &new->polq;

	spin_lock_bh(&pq->hold_queue.lock);
	skb_queue_splice(&list, &pq->hold_queue);
	pq->timeout = XFRM_QUEUE_TMO_MIN;
745 746
	if (!mod_timer(&pq->hold_timer, jiffies))
		xfrm_pol_hold(new);
747 748 749
	spin_unlock_bh(&pq->hold_queue.lock);
}

750 751 752 753 754 755 756 757 758 759 760 761 762 763 764
static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
				   struct xfrm_policy *pol)
{
	u32 mark = policy->mark.v & policy->mark.m;

	if (policy->mark.v == pol->mark.v && policy->mark.m == pol->mark.m)
		return true;

	if ((mark & pol->mark.m) == pol->mark.v &&
	    policy->priority == pol->priority)
		return true;

	return false;
}

L
Linus Torvalds 已提交
765 766
int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
{
767
	struct net *net = xp_net(policy);
768 769 770
	struct xfrm_policy *pol;
	struct xfrm_policy *delpol;
	struct hlist_head *chain;
771
	struct hlist_node *newpos;
L
Linus Torvalds 已提交
772

F
Fan Du 已提交
773
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
774
	chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
775 776
	delpol = NULL;
	newpos = NULL;
777
	hlist_for_each_entry(pol, chain, bydst) {
H
Herbert Xu 已提交
778
		if (pol->type == policy->type &&
779
		    !selector_cmp(&pol->selector, &policy->selector) &&
780
		    xfrm_policy_mark_match(policy, pol) &&
H
Herbert Xu 已提交
781 782
		    xfrm_sec_ctx_match(pol->security, policy->security) &&
		    !WARN_ON(delpol)) {
L
Linus Torvalds 已提交
783
			if (excl) {
F
Fan Du 已提交
784
				write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
785 786 787 788 789 790
				return -EEXIST;
			}
			delpol = pol;
			if (policy->priority > pol->priority)
				continue;
		} else if (policy->priority >= pol->priority) {
H
Herbert Xu 已提交
791
			newpos = &pol->bydst;
L
Linus Torvalds 已提交
792 793 794 795 796 797
			continue;
		}
		if (delpol)
			break;
	}
	if (newpos)
798
		hlist_add_behind(&policy->bydst, newpos);
799 800
	else
		hlist_add_head(&policy->bydst, chain);
801
	__xfrm_policy_link(policy, dir);
802
	atomic_inc(&net->xfrm.flow_cache_genid);
F
fan.du 已提交
803 804 805 806 807 808 809

	/* After previous checking, family can either be AF_INET or AF_INET6 */
	if (policy->family == AF_INET)
		rt_genid_bump_ipv4(net);
	else
		rt_genid_bump_ipv6(net);

810 811
	if (delpol) {
		xfrm_policy_requeue(delpol, policy);
W
Wei Yongjun 已提交
812
		__xfrm_policy_unlink(delpol, dir);
813
	}
814
	policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir, policy->index);
815
	hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index));
816
	policy->curlft.add_time = get_seconds();
L
Linus Torvalds 已提交
817 818 819
	policy->curlft.use_time = 0;
	if (!mod_timer(&policy->timer, jiffies + HZ))
		xfrm_pol_hold(policy);
F
Fan Du 已提交
820
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
821

822
	if (delpol)
L
Linus Torvalds 已提交
823
		xfrm_policy_kill(delpol);
824 825
	else if (xfrm_bydst_should_resize(net, dir, NULL))
		schedule_work(&net->xfrm.policy_hash_work);
826

L
Linus Torvalds 已提交
827 828 829 830
	return 0;
}
EXPORT_SYMBOL(xfrm_policy_insert);

831 832
struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
					  int dir, struct xfrm_selector *sel,
833 834
					  struct xfrm_sec_ctx *ctx, int delete,
					  int *err)
L
Linus Torvalds 已提交
835
{
836 837
	struct xfrm_policy *pol, *ret;
	struct hlist_head *chain;
L
Linus Torvalds 已提交
838

839
	*err = 0;
F
Fan Du 已提交
840
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
841
	chain = policy_hash_bysel(net, sel, sel->family, dir);
842
	ret = NULL;
843
	hlist_for_each_entry(pol, chain, bydst) {
844
		if (pol->type == type &&
J
Jamal Hadi Salim 已提交
845
		    (mark & pol->mark.m) == pol->mark.v &&
846 847
		    !selector_cmp(sel, &pol->selector) &&
		    xfrm_sec_ctx_match(ctx, pol->security)) {
L
Linus Torvalds 已提交
848
			xfrm_pol_hold(pol);
849
			if (delete) {
850 851
				*err = security_xfrm_policy_delete(
								pol->security);
852
				if (*err) {
F
Fan Du 已提交
853
					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
854 855
					return pol;
				}
W
Wei Yongjun 已提交
856
				__xfrm_policy_unlink(pol, dir);
857 858
			}
			ret = pol;
L
Linus Torvalds 已提交
859 860 861
			break;
		}
	}
F
Fan Du 已提交
862
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
863

864
	if (ret && delete)
865 866
		xfrm_policy_kill(ret);
	return ret;
L
Linus Torvalds 已提交
867
}
868
EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
L
Linus Torvalds 已提交
869

870 871
struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
				     int dir, u32 id, int delete, int *err)
L
Linus Torvalds 已提交
872
{
873 874
	struct xfrm_policy *pol, *ret;
	struct hlist_head *chain;
L
Linus Torvalds 已提交
875

876 877 878 879
	*err = -ENOENT;
	if (xfrm_policy_id2dir(id) != dir)
		return NULL;

880
	*err = 0;
F
Fan Du 已提交
881
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
882
	chain = net->xfrm.policy_byidx + idx_hash(net, id);
883
	ret = NULL;
884
	hlist_for_each_entry(pol, chain, byidx) {
J
Jamal Hadi Salim 已提交
885 886
		if (pol->type == type && pol->index == id &&
		    (mark & pol->mark.m) == pol->mark.v) {
L
Linus Torvalds 已提交
887
			xfrm_pol_hold(pol);
888
			if (delete) {
889 890
				*err = security_xfrm_policy_delete(
								pol->security);
891
				if (*err) {
F
Fan Du 已提交
892
					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
893 894
					return pol;
				}
W
Wei Yongjun 已提交
895
				__xfrm_policy_unlink(pol, dir);
896 897
			}
			ret = pol;
L
Linus Torvalds 已提交
898 899 900
			break;
		}
	}
F
Fan Du 已提交
901
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
902

903
	if (ret && delete)
904 905
		xfrm_policy_kill(ret);
	return ret;
L
Linus Torvalds 已提交
906 907 908
}
EXPORT_SYMBOL(xfrm_policy_byid);

909 910
#ifdef CONFIG_SECURITY_NETWORK_XFRM
static inline int
911
xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
L
Linus Torvalds 已提交
912
{
913 914 915 916 917 918
	int dir, err = 0;

	for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
		struct xfrm_policy *pol;
		int i;

919
		hlist_for_each_entry(pol,
920
				     &net->xfrm.policy_inexact[dir], bydst) {
921 922
			if (pol->type != type)
				continue;
923
			err = security_xfrm_policy_delete(pol->security);
924
			if (err) {
925
				xfrm_audit_policy_delete(pol, 0, task_valid);
926 927
				return err;
			}
928
		}
929
		for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
930
			hlist_for_each_entry(pol,
931
					     net->xfrm.policy_bydst[dir].table + i,
932 933 934
					     bydst) {
				if (pol->type != type)
					continue;
935 936
				err = security_xfrm_policy_delete(
								pol->security);
937
				if (err) {
J
Joy Latten 已提交
938
					xfrm_audit_policy_delete(pol, 0,
939
								 task_valid);
940 941 942 943 944 945 946 947 948
					return err;
				}
			}
		}
	}
	return err;
}
#else
static inline int
949
xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
950 951 952 953 954
{
	return 0;
}
#endif

955
int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
956
{
957
	int dir, err = 0, cnt = 0;
L
Linus Torvalds 已提交
958

F
Fan Du 已提交
959
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
960

961
	err = xfrm_policy_flush_secctx_check(net, type, task_valid);
962 963 964
	if (err)
		goto out;

L
Linus Torvalds 已提交
965
	for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
966
		struct xfrm_policy *pol;
W
Wei Yongjun 已提交
967
		int i;
968 969

	again1:
970
		hlist_for_each_entry(pol,
971
				     &net->xfrm.policy_inexact[dir], bydst) {
972 973
			if (pol->type != type)
				continue;
974
			__xfrm_policy_unlink(pol, dir);
F
Fan Du 已提交
975
			write_unlock_bh(&net->xfrm.xfrm_policy_lock);
976
			cnt++;
L
Linus Torvalds 已提交
977

978
			xfrm_audit_policy_delete(pol, 1, task_valid);
J
Joy Latten 已提交
979

980
			xfrm_policy_kill(pol);
L
Linus Torvalds 已提交
981

F
Fan Du 已提交
982
			write_lock_bh(&net->xfrm.xfrm_policy_lock);
983 984 985
			goto again1;
		}

986
		for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
987
	again2:
988
			hlist_for_each_entry(pol,
989
					     net->xfrm.policy_bydst[dir].table + i,
990 991 992
					     bydst) {
				if (pol->type != type)
					continue;
993
				__xfrm_policy_unlink(pol, dir);
F
Fan Du 已提交
994
				write_unlock_bh(&net->xfrm.xfrm_policy_lock);
995
				cnt++;
996

997
				xfrm_audit_policy_delete(pol, 1, task_valid);
998 999
				xfrm_policy_kill(pol);

F
Fan Du 已提交
1000
				write_lock_bh(&net->xfrm.xfrm_policy_lock);
1001 1002
				goto again2;
			}
L
Linus Torvalds 已提交
1003
		}
1004

L
Linus Torvalds 已提交
1005
	}
1006 1007
	if (!cnt)
		err = -ESRCH;
1008
out:
F
Fan Du 已提交
1009
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
1010
	return err;
L
Linus Torvalds 已提交
1011 1012 1013
}
EXPORT_SYMBOL(xfrm_policy_flush);

1014
int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1015
		     int (*func)(struct xfrm_policy *, int, int, void*),
L
Linus Torvalds 已提交
1016 1017
		     void *data)
{
H
Herbert Xu 已提交
1018 1019
	struct xfrm_policy *pol;
	struct xfrm_policy_walk_entry *x;
1020 1021 1022 1023 1024
	int error = 0;

	if (walk->type >= XFRM_POLICY_TYPE_MAX &&
	    walk->type != XFRM_POLICY_TYPE_ANY)
		return -EINVAL;
L
Linus Torvalds 已提交
1025

H
Herbert Xu 已提交
1026
	if (list_empty(&walk->walk.all) && walk->seq != 0)
1027 1028
		return 0;

F
Fan Du 已提交
1029
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
H
Herbert Xu 已提交
1030
	if (list_empty(&walk->walk.all))
1031
		x = list_first_entry(&net->xfrm.policy_all, struct xfrm_policy_walk_entry, all);
H
Herbert Xu 已提交
1032
	else
1033 1034 1035
		x = list_first_entry(&walk->walk.all,
				     struct xfrm_policy_walk_entry, all);

1036
	list_for_each_entry_from(x, &net->xfrm.policy_all, all) {
H
Herbert Xu 已提交
1037
		if (x->dead)
1038
			continue;
H
Herbert Xu 已提交
1039 1040 1041 1042 1043 1044 1045 1046 1047
		pol = container_of(x, struct xfrm_policy, walk);
		if (walk->type != XFRM_POLICY_TYPE_ANY &&
		    walk->type != pol->type)
			continue;
		error = func(pol, xfrm_policy_id2dir(pol->index),
			     walk->seq, data);
		if (error) {
			list_move_tail(&walk->walk.all, &x->all);
			goto out;
1048
		}
H
Herbert Xu 已提交
1049
		walk->seq++;
L
Linus Torvalds 已提交
1050
	}
H
Herbert Xu 已提交
1051
	if (walk->seq == 0) {
J
Jamal Hadi Salim 已提交
1052 1053 1054
		error = -ENOENT;
		goto out;
	}
H
Herbert Xu 已提交
1055
	list_del_init(&walk->walk.all);
L
Linus Torvalds 已提交
1056
out:
F
Fan Du 已提交
1057
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
1058 1059 1060 1061
	return error;
}
EXPORT_SYMBOL(xfrm_policy_walk);

H
Herbert Xu 已提交
1062 1063 1064 1065 1066 1067 1068 1069 1070
void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type)
{
	INIT_LIST_HEAD(&walk->walk.all);
	walk->walk.dead = 1;
	walk->type = type;
	walk->seq = 0;
}
EXPORT_SYMBOL(xfrm_policy_walk_init);

F
Fan Du 已提交
1071
void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net)
H
Herbert Xu 已提交
1072 1073 1074 1075
{
	if (list_empty(&walk->walk.all))
		return;

F
Fan Du 已提交
1076
	write_lock_bh(&net->xfrm.xfrm_policy_lock); /*FIXME where is net? */
H
Herbert Xu 已提交
1077
	list_del(&walk->walk.all);
F
Fan Du 已提交
1078
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
H
Herbert Xu 已提交
1079 1080 1081
}
EXPORT_SYMBOL(xfrm_policy_walk_done);

1082 1083 1084 1085 1086
/*
 * Find policy to apply to this flow.
 *
 * Returns 0 if policy found, else an -errno.
 */
1087 1088
static int xfrm_policy_match(const struct xfrm_policy *pol,
			     const struct flowi *fl,
1089
			     u8 type, u16 family, int dir)
L
Linus Torvalds 已提交
1090
{
1091
	const struct xfrm_selector *sel = &pol->selector;
1092 1093
	int ret = -ESRCH;
	bool match;
L
Linus Torvalds 已提交
1094

1095
	if (pol->family != family ||
1096
	    (fl->flowi_mark & pol->mark.m) != pol->mark.v ||
1097
	    pol->type != type)
1098
		return ret;
L
Linus Torvalds 已提交
1099

1100
	match = xfrm_selector_match(sel, fl, family);
1101
	if (match)
1102
		ret = security_xfrm_policy_lookup(pol->security, fl->flowi_secid,
1103
						  dir);
1104

1105
	return ret;
1106
}
L
Linus Torvalds 已提交
1107

A
Alexey Dobriyan 已提交
1108
static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
1109
						     const struct flowi *fl,
1110 1111
						     u16 family, u8 dir)
{
1112
	int err;
1113
	struct xfrm_policy *pol, *ret;
1114
	const xfrm_address_t *daddr, *saddr;
1115
	struct hlist_head *chain;
1116 1117
	unsigned int sequence;
	u32 priority;
1118

1119 1120 1121 1122 1123
	daddr = xfrm_flowi_daddr(fl, family);
	saddr = xfrm_flowi_saddr(fl, family);
	if (unlikely(!daddr || !saddr))
		return NULL;

1124
	rcu_read_lock();
1125 1126 1127 1128 1129 1130 1131
 retry:
	do {
		sequence = read_seqcount_begin(&xfrm_policy_hash_generation);
		chain = policy_hash_direct(net, daddr, saddr, family, dir);
	} while (read_seqcount_retry(&xfrm_policy_hash_generation, sequence));

	priority = ~0U;
1132
	ret = NULL;
1133
	hlist_for_each_entry_rcu(pol, chain, bydst) {
1134 1135 1136 1137 1138 1139 1140 1141 1142
		err = xfrm_policy_match(pol, fl, type, family, dir);
		if (err) {
			if (err == -ESRCH)
				continue;
			else {
				ret = ERR_PTR(err);
				goto fail;
			}
		} else {
1143
			ret = pol;
1144
			priority = ret->priority;
1145 1146 1147
			break;
		}
	}
A
Alexey Dobriyan 已提交
1148
	chain = &net->xfrm.policy_inexact[dir];
1149
	hlist_for_each_entry_rcu(pol, chain, bydst) {
1150 1151 1152
		if ((pol->priority >= priority) && ret)
			break;

1153 1154 1155 1156 1157 1158 1159 1160
		err = xfrm_policy_match(pol, fl, type, family, dir);
		if (err) {
			if (err == -ESRCH)
				continue;
			else {
				ret = ERR_PTR(err);
				goto fail;
			}
1161
		} else {
1162 1163
			ret = pol;
			break;
L
Linus Torvalds 已提交
1164 1165
		}
	}
1166

1167 1168 1169
	if (read_seqcount_retry(&xfrm_policy_hash_generation, sequence))
		goto retry;

1170 1171
	if (ret && !xfrm_pol_hold_rcu(ret))
		goto retry;
1172
fail:
1173
	rcu_read_unlock();
1174

1175
	return ret;
1176 1177
}

1178
static struct xfrm_policy *
1179
__xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir)
1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190
{
#ifdef CONFIG_XFRM_SUB_POLICY
	struct xfrm_policy *pol;

	pol = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_SUB, fl, family, dir);
	if (pol != NULL)
		return pol;
#endif
	return xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family, dir);
}

1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208
static int flow_to_policy_dir(int dir)
{
	if (XFRM_POLICY_IN == FLOW_DIR_IN &&
	    XFRM_POLICY_OUT == FLOW_DIR_OUT &&
	    XFRM_POLICY_FWD == FLOW_DIR_FWD)
		return dir;

	switch (dir) {
	default:
	case FLOW_DIR_IN:
		return XFRM_POLICY_IN;
	case FLOW_DIR_OUT:
		return XFRM_POLICY_OUT;
	case FLOW_DIR_FWD:
		return XFRM_POLICY_FWD;
	}
}

1209
static struct flow_cache_object *
1210
xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family,
1211
		   u8 dir, struct flow_cache_object *old_obj, void *ctx)
1212 1213
{
	struct xfrm_policy *pol;
1214 1215 1216

	if (old_obj)
		xfrm_pol_put(container_of(old_obj, struct xfrm_policy, flo));
1217

1218
	pol = __xfrm_policy_lookup(net, fl, family, flow_to_policy_dir(dir));
1219
	if (IS_ERR_OR_NULL(pol))
1220 1221 1222 1223 1224 1225 1226
		return ERR_CAST(pol);

	/* Resolver returns two references:
	 * one for cache and one for caller of flow_cache_lookup() */
	xfrm_pol_hold(pol);

	return &pol->flo;
L
Linus Torvalds 已提交
1227 1228
}

1229 1230 1231
static inline int policy_to_flow_dir(int dir)
{
	if (XFRM_POLICY_IN == FLOW_DIR_IN &&
1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242
	    XFRM_POLICY_OUT == FLOW_DIR_OUT &&
	    XFRM_POLICY_FWD == FLOW_DIR_FWD)
		return dir;
	switch (dir) {
	default:
	case XFRM_POLICY_IN:
		return FLOW_DIR_IN;
	case XFRM_POLICY_OUT:
		return FLOW_DIR_OUT;
	case XFRM_POLICY_FWD:
		return FLOW_DIR_FWD;
1243
	}
1244 1245
}

1246
static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
1247
						 const struct flowi *fl)
L
Linus Torvalds 已提交
1248 1249 1250
{
	struct xfrm_policy *pol;

1251
	rcu_read_lock();
1252
 again:
1253 1254
	pol = rcu_dereference(sk->sk_policy[dir]);
	if (pol != NULL) {
1255 1256
		bool match = xfrm_selector_match(&pol->selector, fl,
						 sk->sk_family);
1257
		int err = 0;
1258

1259
		if (match) {
J
Jamal Hadi Salim 已提交
1260 1261 1262 1263
			if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
				pol = NULL;
				goto out;
			}
1264
			err = security_xfrm_policy_lookup(pol->security,
1265
						      fl->flowi_secid,
1266
						      policy_to_flow_dir(dir));
1267 1268
			if (!err && !xfrm_pol_hold_rcu(pol))
				goto again;
1269 1270 1271 1272 1273
			else if (err == -ESRCH)
				pol = NULL;
			else
				pol = ERR_PTR(err);
		} else
L
Linus Torvalds 已提交
1274 1275
			pol = NULL;
	}
J
Jamal Hadi Salim 已提交
1276
out:
1277
	rcu_read_unlock();
L
Linus Torvalds 已提交
1278 1279 1280 1281 1282
	return pol;
}

static void __xfrm_policy_link(struct xfrm_policy *pol, int dir)
{
1283
	struct net *net = xp_net(pol);
1284

1285 1286
	list_add(&pol->walk.all, &net->xfrm.policy_all);
	net->xfrm.policy_count[dir]++;
L
Linus Torvalds 已提交
1287 1288 1289 1290 1291 1292
	xfrm_pol_hold(pol);
}

static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
						int dir)
{
1293 1294
	struct net *net = xp_net(pol);

H
Herbert Xu 已提交
1295
	if (list_empty(&pol->walk.all))
1296
		return NULL;
L
Linus Torvalds 已提交
1297

H
Herbert Xu 已提交
1298 1299
	/* Socket policies are not hashed. */
	if (!hlist_unhashed(&pol->bydst)) {
1300
		hlist_del_rcu(&pol->bydst);
H
Herbert Xu 已提交
1301 1302 1303 1304
		hlist_del(&pol->byidx);
	}

	list_del_init(&pol->walk.all);
1305
	net->xfrm.policy_count[dir]--;
1306 1307

	return pol;
L
Linus Torvalds 已提交
1308 1309
}

H
Herbert Xu 已提交
1310 1311 1312 1313 1314 1315 1316 1317 1318 1319
static void xfrm_sk_policy_link(struct xfrm_policy *pol, int dir)
{
	__xfrm_policy_link(pol, XFRM_POLICY_MAX + dir);
}

static void xfrm_sk_policy_unlink(struct xfrm_policy *pol, int dir)
{
	__xfrm_policy_unlink(pol, XFRM_POLICY_MAX + dir);
}

1320
int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
L
Linus Torvalds 已提交
1321
{
F
Fan Du 已提交
1322 1323 1324
	struct net *net = xp_net(pol);

	write_lock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
1325
	pol = __xfrm_policy_unlink(pol, dir);
F
Fan Du 已提交
1326
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
1327 1328
	if (pol) {
		xfrm_policy_kill(pol);
1329
		return 0;
L
Linus Torvalds 已提交
1330
	}
1331
	return -ENOENT;
L
Linus Torvalds 已提交
1332
}
1333
EXPORT_SYMBOL(xfrm_policy_delete);
L
Linus Torvalds 已提交
1334 1335 1336

int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
{
1337
	struct net *net = xp_net(pol);
L
Linus Torvalds 已提交
1338 1339
	struct xfrm_policy *old_pol;

1340 1341 1342 1343 1344
#ifdef CONFIG_XFRM_SUB_POLICY
	if (pol && pol->type != XFRM_POLICY_TYPE_MAIN)
		return -EINVAL;
#endif

F
Fan Du 已提交
1345
	write_lock_bh(&net->xfrm.xfrm_policy_lock);
1346 1347
	old_pol = rcu_dereference_protected(sk->sk_policy[dir],
				lockdep_is_held(&net->xfrm.xfrm_policy_lock));
L
Linus Torvalds 已提交
1348
	if (pol) {
1349
		pol->curlft.add_time = get_seconds();
1350
		pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir, 0);
H
Herbert Xu 已提交
1351
		xfrm_sk_policy_link(pol, dir);
L
Linus Torvalds 已提交
1352
	}
1353
	rcu_assign_pointer(sk->sk_policy[dir], pol);
1354 1355 1356 1357
	if (old_pol) {
		if (pol)
			xfrm_policy_requeue(old_pol, pol);

1358 1359 1360
		/* Unlinking succeeds always. This is the only function
		 * allowed to delete or replace socket policy.
		 */
H
Herbert Xu 已提交
1361
		xfrm_sk_policy_unlink(old_pol, dir);
1362
	}
F
Fan Du 已提交
1363
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
1364 1365 1366 1367 1368 1369 1370

	if (old_pol) {
		xfrm_policy_kill(old_pol);
	}
	return 0;
}

1371
static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
L
Linus Torvalds 已提交
1372
{
1373
	struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC);
F
Fan Du 已提交
1374
	struct net *net = xp_net(old);
L
Linus Torvalds 已提交
1375 1376 1377

	if (newp) {
		newp->selector = old->selector;
1378 1379
		if (security_xfrm_policy_clone(old->security,
					       &newp->security)) {
1380 1381 1382
			kfree(newp);
			return NULL;  /* ENOMEM */
		}
L
Linus Torvalds 已提交
1383 1384
		newp->lft = old->lft;
		newp->curlft = old->curlft;
1385
		newp->mark = old->mark;
L
Linus Torvalds 已提交
1386 1387 1388 1389
		newp->action = old->action;
		newp->flags = old->flags;
		newp->xfrm_nr = old->xfrm_nr;
		newp->index = old->index;
1390
		newp->type = old->type;
L
Linus Torvalds 已提交
1391 1392
		memcpy(newp->xfrm_vec, old->xfrm_vec,
		       newp->xfrm_nr*sizeof(struct xfrm_tmpl));
F
Fan Du 已提交
1393
		write_lock_bh(&net->xfrm.xfrm_policy_lock);
H
Herbert Xu 已提交
1394
		xfrm_sk_policy_link(newp, dir);
F
Fan Du 已提交
1395
		write_unlock_bh(&net->xfrm.xfrm_policy_lock);
L
Linus Torvalds 已提交
1396 1397 1398 1399 1400
		xfrm_pol_put(newp);
	}
	return newp;
}

1401
int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
L
Linus Torvalds 已提交
1402
{
1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420
	const struct xfrm_policy *p;
	struct xfrm_policy *np;
	int i, ret = 0;

	rcu_read_lock();
	for (i = 0; i < 2; i++) {
		p = rcu_dereference(osk->sk_policy[i]);
		if (p) {
			np = clone_policy(p, i);
			if (unlikely(!np)) {
				ret = -ENOMEM;
				break;
			}
			rcu_assign_pointer(sk->sk_policy[i], np);
		}
	}
	rcu_read_unlock();
	return ret;
L
Linus Torvalds 已提交
1421 1422
}

1423
static int
D
David Ahern 已提交
1424 1425
xfrm_get_saddr(struct net *net, int oif, xfrm_address_t *local,
	       xfrm_address_t *remote, unsigned short family)
1426 1427 1428 1429 1430 1431
{
	int err;
	struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);

	if (unlikely(afinfo == NULL))
		return -EINVAL;
D
David Ahern 已提交
1432
	err = afinfo->get_saddr(net, oif, local, remote);
1433 1434 1435 1436
	xfrm_policy_put_afinfo(afinfo);
	return err;
}

L
Linus Torvalds 已提交
1437 1438 1439
/* Resolve list of templates for the flow, given policy. */

static int
1440 1441
xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl,
		      struct xfrm_state **xfrm, unsigned short family)
L
Linus Torvalds 已提交
1442
{
A
Alexey Dobriyan 已提交
1443
	struct net *net = xp_net(policy);
L
Linus Torvalds 已提交
1444 1445 1446 1447
	int nx;
	int i, error;
	xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
	xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
1448
	xfrm_address_t tmp;
L
Linus Torvalds 已提交
1449

1450
	for (nx = 0, i = 0; i < policy->xfrm_nr; i++) {
L
Linus Torvalds 已提交
1451 1452 1453 1454 1455
		struct xfrm_state *x;
		xfrm_address_t *remote = daddr;
		xfrm_address_t *local  = saddr;
		struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];

1456 1457
		if (tmpl->mode == XFRM_MODE_TUNNEL ||
		    tmpl->mode == XFRM_MODE_BEET) {
L
Linus Torvalds 已提交
1458 1459
			remote = &tmpl->id.daddr;
			local = &tmpl->saddr;
1460
			if (xfrm_addr_any(local, tmpl->encap_family)) {
D
David Ahern 已提交
1461 1462 1463
				error = xfrm_get_saddr(net, fl->flowi_oif,
						       &tmp, remote,
						       tmpl->encap_family);
1464 1465 1466 1467
				if (error)
					goto fail;
				local = &tmp;
			}
L
Linus Torvalds 已提交
1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481
		}

		x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);

		if (x && x->km.state == XFRM_STATE_VALID) {
			xfrm[nx++] = x;
			daddr = remote;
			saddr = local;
			continue;
		}
		if (x) {
			error = (x->km.state == XFRM_STATE_ERROR ?
				 -EINVAL : -EAGAIN);
			xfrm_state_put(x);
W
Weilong Chen 已提交
1482
		} else if (error == -ESRCH) {
1483
			error = -EAGAIN;
W
Weilong Chen 已提交
1484
		}
L
Linus Torvalds 已提交
1485 1486 1487 1488 1489 1490 1491

		if (!tmpl->optional)
			goto fail;
	}
	return nx;

fail:
1492
	for (nx--; nx >= 0; nx--)
L
Linus Torvalds 已提交
1493 1494 1495 1496
		xfrm_state_put(xfrm[nx]);
	return error;
}

1497
static int
1498 1499
xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, const struct flowi *fl,
		  struct xfrm_state **xfrm, unsigned short family)
1500
{
1501 1502
	struct xfrm_state *tp[XFRM_MAX_DEPTH];
	struct xfrm_state **tpp = (npols > 1) ? tp : xfrm;
1503 1504 1505 1506 1507 1508 1509 1510 1511 1512
	int cnx = 0;
	int error;
	int ret;
	int i;

	for (i = 0; i < npols; i++) {
		if (cnx + pols[i]->xfrm_nr >= XFRM_MAX_DEPTH) {
			error = -ENOBUFS;
			goto fail;
		}
1513 1514

		ret = xfrm_tmpl_resolve_one(pols[i], fl, &tpp[cnx], family);
1515 1516 1517 1518 1519 1520 1521
		if (ret < 0) {
			error = ret;
			goto fail;
		} else
			cnx += ret;
	}

1522 1523 1524 1525
	/* found states are sorted for outbound processing */
	if (npols > 1)
		xfrm_state_sort(xfrm, tpp, cnx, family);

1526 1527 1528
	return cnx;

 fail:
1529
	for (cnx--; cnx >= 0; cnx--)
1530
		xfrm_state_put(tpp[cnx]);
1531 1532 1533 1534
	return error;

}

L
Linus Torvalds 已提交
1535 1536 1537 1538
/* Check that the bundle accepts the flow and its components are
 * still valid.
 */

1539
static inline int xfrm_get_tos(const struct flowi *fl, int family)
1540 1541 1542
{
	struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
	int tos;
L
Linus Torvalds 已提交
1543

1544 1545 1546 1547 1548 1549 1550 1551 1552 1553
	if (!afinfo)
		return -EINVAL;

	tos = afinfo->get_tos(fl);

	xfrm_policy_put_afinfo(afinfo);

	return tos;
}

1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564
static struct flow_cache_object *xfrm_bundle_flo_get(struct flow_cache_object *flo)
{
	struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo);
	struct dst_entry *dst = &xdst->u.dst;

	if (xdst->route == NULL) {
		/* Dummy bundle - if it has xfrms we were not
		 * able to build bundle as template resolution failed.
		 * It means we need to try again resolving. */
		if (xdst->num_xfrms > 0)
			return NULL;
1565 1566
	} else if (dst->flags & DST_XFRM_QUEUE) {
		return NULL;
1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603
	} else {
		/* Real bundle */
		if (stale_bundle(dst))
			return NULL;
	}

	dst_hold(dst);
	return flo;
}

static int xfrm_bundle_flo_check(struct flow_cache_object *flo)
{
	struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo);
	struct dst_entry *dst = &xdst->u.dst;

	if (!xdst->route)
		return 0;
	if (stale_bundle(dst))
		return 0;

	return 1;
}

static void xfrm_bundle_flo_delete(struct flow_cache_object *flo)
{
	struct xfrm_dst *xdst = container_of(flo, struct xfrm_dst, flo);
	struct dst_entry *dst = &xdst->u.dst;

	dst_free(dst);
}

static const struct flow_cache_ops xfrm_bundle_fc_ops = {
	.get = xfrm_bundle_flo_get,
	.check = xfrm_bundle_flo_check,
	.delete = xfrm_bundle_flo_delete,
};

1604
static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
L
Linus Torvalds 已提交
1605 1606
{
	struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1607
	struct dst_ops *dst_ops;
1608 1609 1610 1611 1612
	struct xfrm_dst *xdst;

	if (!afinfo)
		return ERR_PTR(-EINVAL);

1613 1614 1615 1616
	switch (family) {
	case AF_INET:
		dst_ops = &net->xfrm.xfrm4_dst_ops;
		break;
E
Eric Dumazet 已提交
1617
#if IS_ENABLED(CONFIG_IPV6)
1618 1619 1620 1621 1622 1623 1624
	case AF_INET6:
		dst_ops = &net->xfrm.xfrm6_dst_ops;
		break;
#endif
	default:
		BUG();
	}
1625
	xdst = dst_alloc(dst_ops, NULL, 0, DST_OBSOLETE_NONE, 0);
1626

1627
	if (likely(xdst)) {
1628 1629 1630
		struct dst_entry *dst = &xdst->u.dst;

		memset(dst + 1, 0, sizeof(*xdst) - sizeof(*dst));
1631
		xdst->flo.ops = &xfrm_bundle_fc_ops;
1632
	} else
1633
		xdst = ERR_PTR(-ENOBUFS);
1634

1635 1636
	xfrm_policy_put_afinfo(afinfo);

1637 1638 1639
	return xdst;
}

1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656
static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst,
				 int nfheader_len)
{
	struct xfrm_policy_afinfo *afinfo =
		xfrm_policy_get_afinfo(dst->ops->family);
	int err;

	if (!afinfo)
		return -EINVAL;

	err = afinfo->init_path(path, dst, nfheader_len);

	xfrm_policy_put_afinfo(afinfo);

	return err;
}

H
Herbert Xu 已提交
1657
static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
1658
				const struct flowi *fl)
1659 1660 1661 1662 1663 1664
{
	struct xfrm_policy_afinfo *afinfo =
		xfrm_policy_get_afinfo(xdst->u.dst.ops->family);
	int err;

	if (!afinfo)
L
Linus Torvalds 已提交
1665
		return -EINVAL;
1666

H
Herbert Xu 已提交
1667
	err = afinfo->fill_dst(xdst, dev, fl);
1668

L
Linus Torvalds 已提交
1669
	xfrm_policy_put_afinfo(afinfo);
1670

L
Linus Torvalds 已提交
1671 1672 1673
	return err;
}

1674

1675 1676 1677 1678 1679 1680
/* Allocate chain of dst_entry's, attach known xfrm's, calculate
 * all the metrics... Shortly, bundle a bundle.
 */

static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
					    struct xfrm_state **xfrm, int nx,
1681
					    const struct flowi *fl,
1682 1683
					    struct dst_entry *dst)
{
1684
	struct net *net = xp_net(policy);
1685 1686
	unsigned long now = jiffies;
	struct net_device *dev;
1687
	struct xfrm_mode *inner_mode;
1688 1689 1690 1691 1692
	struct dst_entry *dst_prev = NULL;
	struct dst_entry *dst0 = NULL;
	int i = 0;
	int err;
	int header_len = 0;
1693
	int nfheader_len = 0;
1694 1695 1696
	int trailer_len = 0;
	int tos;
	int family = policy->selector.family;
1697 1698 1699
	xfrm_address_t saddr, daddr;

	xfrm_flowi_addr_get(fl, &saddr, &daddr, family);
1700 1701 1702 1703 1704 1705 1706 1707 1708

	tos = xfrm_get_tos(fl, family);
	err = tos;
	if (tos < 0)
		goto put_states;

	dst_hold(dst);

	for (; i < nx; i++) {
1709
		struct xfrm_dst *xdst = xfrm_alloc_dst(net, family);
1710 1711 1712 1713 1714 1715 1716 1717
		struct dst_entry *dst1 = &xdst->u.dst;

		err = PTR_ERR(xdst);
		if (IS_ERR(xdst)) {
			dst_release(dst);
			goto put_states;
		}

1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728
		if (xfrm[i]->sel.family == AF_UNSPEC) {
			inner_mode = xfrm_ip2inner_mode(xfrm[i],
							xfrm_af2proto(family));
			if (!inner_mode) {
				err = -EAFNOSUPPORT;
				dst_release(dst);
				goto put_states;
			}
		} else
			inner_mode = xfrm[i]->inner_mode;

1729 1730 1731 1732 1733 1734 1735 1736
		if (!dst_prev)
			dst0 = dst1;
		else {
			dst_prev->child = dst_clone(dst1);
			dst1->flags |= DST_NOHASH;
		}

		xdst->route = dst;
1737
		dst_copy_metrics(dst1, dst);
1738 1739 1740

		if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
			family = xfrm[i]->props.family;
D
David Ahern 已提交
1741 1742
			dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
					      &saddr, &daddr, family);
1743 1744 1745 1746 1747 1748 1749
			err = PTR_ERR(dst);
			if (IS_ERR(dst))
				goto put_states;
		} else
			dst_hold(dst);

		dst1->xfrm = xfrm[i];
1750
		xdst->xfrm_genid = xfrm[i]->genid;
1751

1752
		dst1->obsolete = DST_OBSOLETE_FORCE_CHK;
1753 1754 1755 1756
		dst1->flags |= DST_HOST;
		dst1->lastuse = now;

		dst1->input = dst_discard;
1757
		dst1->output = inner_mode->afinfo->output;
1758 1759 1760 1761 1762

		dst1->next = dst_prev;
		dst_prev = dst1;

		header_len += xfrm[i]->props.header_len;
1763 1764
		if (xfrm[i]->type->flags & XFRM_TYPE_NON_FRAGMENT)
			nfheader_len += xfrm[i]->props.header_len;
1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775
		trailer_len += xfrm[i]->props.trailer_len;
	}

	dst_prev->child = dst;
	dst0->path = dst;

	err = -ENODEV;
	dev = dst->dev;
	if (!dev)
		goto free_dst;

1776
	xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len);
1777 1778 1779 1780 1781
	xfrm_init_pmtu(dst_prev);

	for (dst_prev = dst0; dst_prev != dst; dst_prev = dst_prev->child) {
		struct xfrm_dst *xdst = (struct xfrm_dst *)dst_prev;

H
Herbert Xu 已提交
1782
		err = xfrm_fill_dst(xdst, dev, fl);
1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804
		if (err)
			goto free_dst;

		dst_prev->header_len = header_len;
		dst_prev->trailer_len = trailer_len;
		header_len -= xdst->u.dst.xfrm->props.header_len;
		trailer_len -= xdst->u.dst.xfrm->props.trailer_len;
	}

out:
	return dst0;

put_states:
	for (; i < nx; i++)
		xfrm_state_put(xfrm[i]);
free_dst:
	if (dst0)
		dst_free(dst0);
	dst0 = ERR_PTR(err);
	goto out;
}

1805
#ifdef CONFIG_XFRM_SUB_POLICY
1806
static int xfrm_dst_alloc_copy(void **target, const void *src, int size)
1807 1808 1809 1810 1811 1812
{
	if (!*target) {
		*target = kmalloc(size, GFP_ATOMIC);
		if (!*target)
			return -ENOMEM;
	}
1813

1814 1815 1816
	memcpy(*target, src, size);
	return 0;
}
1817
#endif
1818

1819 1820
static int xfrm_dst_update_parent(struct dst_entry *dst,
				  const struct xfrm_selector *sel)
1821 1822 1823 1824 1825 1826 1827 1828 1829 1830
{
#ifdef CONFIG_XFRM_SUB_POLICY
	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
	return xfrm_dst_alloc_copy((void **)&(xdst->partner),
				   sel, sizeof(*sel));
#else
	return 0;
#endif
}

1831 1832
static int xfrm_dst_update_origin(struct dst_entry *dst,
				  const struct flowi *fl)
1833 1834 1835 1836 1837 1838 1839 1840
{
#ifdef CONFIG_XFRM_SUB_POLICY
	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
	return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
#else
	return 0;
#endif
}
L
Linus Torvalds 已提交
1841

1842
static int xfrm_expand_policies(const struct flowi *fl, u16 family,
1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869
				struct xfrm_policy **pols,
				int *num_pols, int *num_xfrms)
{
	int i;

	if (*num_pols == 0 || !pols[0]) {
		*num_pols = 0;
		*num_xfrms = 0;
		return 0;
	}
	if (IS_ERR(pols[0]))
		return PTR_ERR(pols[0]);

	*num_xfrms = pols[0]->xfrm_nr;

#ifdef CONFIG_XFRM_SUB_POLICY
	if (pols[0] && pols[0]->action == XFRM_POLICY_ALLOW &&
	    pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
		pols[1] = xfrm_policy_lookup_bytype(xp_net(pols[0]),
						    XFRM_POLICY_TYPE_MAIN,
						    fl, family,
						    XFRM_POLICY_OUT);
		if (pols[1]) {
			if (IS_ERR(pols[1])) {
				xfrm_pols_put(pols, *num_pols);
				return PTR_ERR(pols[1]);
			}
1870
			(*num_pols)++;
1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887
			(*num_xfrms) += pols[1]->xfrm_nr;
		}
	}
#endif
	for (i = 0; i < *num_pols; i++) {
		if (pols[i]->action != XFRM_POLICY_ALLOW) {
			*num_xfrms = -1;
			break;
		}
	}

	return 0;

}

static struct xfrm_dst *
xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
1888
			       const struct flowi *fl, u16 family,
1889 1890 1891 1892 1893 1894 1895 1896 1897 1898
			       struct dst_entry *dst_orig)
{
	struct net *net = xp_net(pols[0]);
	struct xfrm_state *xfrm[XFRM_MAX_DEPTH];
	struct dst_entry *dst;
	struct xfrm_dst *xdst;
	int err;

	/* Try to instantiate a bundle */
	err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
1899 1900
	if (err <= 0) {
		if (err != 0 && err != -EAGAIN)
1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923
			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
		return ERR_PTR(err);
	}

	dst = xfrm_bundle_create(pols[0], xfrm, err, fl, dst_orig);
	if (IS_ERR(dst)) {
		XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLEGENERROR);
		return ERR_CAST(dst);
	}

	xdst = (struct xfrm_dst *)dst;
	xdst->num_xfrms = err;
	if (num_pols > 1)
		err = xfrm_dst_update_parent(dst, &pols[1]->selector);
	else
		err = xfrm_dst_update_origin(dst, fl);
	if (unlikely(err)) {
		dst_free(dst);
		XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
		return ERR_PTR(err);
	}

	xdst->num_pols = num_pols;
1924
	memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
1925 1926 1927 1928 1929
	xdst->policy_genid = atomic_read(&pols[0]->genid);

	return xdst;
}

1930 1931 1932 1933 1934 1935
static void xfrm_policy_queue_process(unsigned long arg)
{
	struct sk_buff *skb;
	struct sock *sk;
	struct dst_entry *dst;
	struct xfrm_policy *pol = (struct xfrm_policy *)arg;
1936
	struct net *net = xp_net(pol);
1937 1938 1939 1940 1941 1942
	struct xfrm_policy_queue *pq = &pol->polq;
	struct flowi fl;
	struct sk_buff_head list;

	spin_lock(&pq->hold_queue.lock);
	skb = skb_peek(&pq->hold_queue);
1943 1944 1945 1946
	if (!skb) {
		spin_unlock(&pq->hold_queue.lock);
		goto out;
	}
1947 1948 1949 1950 1951 1952
	dst = skb_dst(skb);
	sk = skb->sk;
	xfrm_decode_session(skb, &fl, dst->ops->family);
	spin_unlock(&pq->hold_queue.lock);

	dst_hold(dst->path);
1953
	dst = xfrm_lookup(net, dst->path, &fl, sk, 0);
1954 1955 1956 1957 1958 1959 1960 1961 1962 1963
	if (IS_ERR(dst))
		goto purge_queue;

	if (dst->flags & DST_XFRM_QUEUE) {
		dst_release(dst);

		if (pq->timeout >= XFRM_QUEUE_TMO_MAX)
			goto purge_queue;

		pq->timeout = pq->timeout << 1;
1964 1965 1966
		if (!mod_timer(&pq->hold_timer, jiffies + pq->timeout))
			xfrm_pol_hold(pol);
	goto out;
1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982
	}

	dst_release(dst);

	__skb_queue_head_init(&list);

	spin_lock(&pq->hold_queue.lock);
	pq->timeout = 0;
	skb_queue_splice_init(&pq->hold_queue, &list);
	spin_unlock(&pq->hold_queue.lock);

	while (!skb_queue_empty(&list)) {
		skb = __skb_dequeue(&list);

		xfrm_decode_session(skb, &fl, skb_dst(skb)->ops->family);
		dst_hold(skb_dst(skb)->path);
1983
		dst = xfrm_lookup(net, skb_dst(skb)->path, &fl, skb->sk, 0);
1984 1985 1986 1987 1988 1989 1990 1991 1992
		if (IS_ERR(dst)) {
			kfree_skb(skb);
			continue;
		}

		nf_reset(skb);
		skb_dst_drop(skb);
		skb_dst_set(skb, dst);

1993
		dst_output(net, skb->sk, skb);
1994 1995
	}

1996 1997
out:
	xfrm_pol_put(pol);
1998 1999 2000 2001
	return;

purge_queue:
	pq->timeout = 0;
2002
	skb_queue_purge(&pq->hold_queue);
2003
	xfrm_pol_put(pol);
2004 2005
}

E
Eric W. Biederman 已提交
2006
static int xdst_queue_output(struct net *net, struct sock *sk, struct sk_buff *skb)
2007 2008 2009 2010
{
	unsigned long sched_next;
	struct dst_entry *dst = skb_dst(skb);
	struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
2011 2012
	struct xfrm_policy *pol = xdst->pols[0];
	struct xfrm_policy_queue *pq = &pol->polq;
2013

2014
	if (unlikely(skb_fclone_busy(sk, skb))) {
2015 2016 2017
		kfree_skb(skb);
		return 0;
	}
2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035

	if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
		kfree_skb(skb);
		return -EAGAIN;
	}

	skb_dst_force(skb);

	spin_lock_bh(&pq->hold_queue.lock);

	if (!pq->timeout)
		pq->timeout = XFRM_QUEUE_TMO_MIN;

	sched_next = jiffies + pq->timeout;

	if (del_timer(&pq->hold_timer)) {
		if (time_before(pq->hold_timer.expires, sched_next))
			sched_next = pq->hold_timer.expires;
2036
		xfrm_pol_put(pol);
2037 2038 2039
	}

	__skb_queue_tail(&pq->hold_queue, skb);
2040 2041
	if (!mod_timer(&pq->hold_timer, sched_next))
		xfrm_pol_hold(pol);
2042 2043 2044 2045 2046 2047 2048

	spin_unlock_bh(&pq->hold_queue.lock);

	return 0;
}

static struct xfrm_dst *xfrm_create_dummy_bundle(struct net *net,
2049
						 struct xfrm_flo *xflo,
2050 2051 2052 2053 2054 2055
						 const struct flowi *fl,
						 int num_xfrms,
						 u16 family)
{
	int err;
	struct net_device *dev;
2056
	struct dst_entry *dst;
2057 2058 2059 2060 2061 2062 2063
	struct dst_entry *dst1;
	struct xfrm_dst *xdst;

	xdst = xfrm_alloc_dst(net, family);
	if (IS_ERR(xdst))
		return xdst;

2064 2065 2066
	if (!(xflo->flags & XFRM_LOOKUP_QUEUE) ||
	    net->xfrm.sysctl_larval_drop ||
	    num_xfrms <= 0)
2067 2068
		return xdst;

2069
	dst = xflo->dst_orig;
2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106
	dst1 = &xdst->u.dst;
	dst_hold(dst);
	xdst->route = dst;

	dst_copy_metrics(dst1, dst);

	dst1->obsolete = DST_OBSOLETE_FORCE_CHK;
	dst1->flags |= DST_HOST | DST_XFRM_QUEUE;
	dst1->lastuse = jiffies;

	dst1->input = dst_discard;
	dst1->output = xdst_queue_output;

	dst_hold(dst);
	dst1->child = dst;
	dst1->path = dst;

	xfrm_init_path((struct xfrm_dst *)dst1, dst, 0);

	err = -ENODEV;
	dev = dst->dev;
	if (!dev)
		goto free_dst;

	err = xfrm_fill_dst(xdst, dev, fl);
	if (err)
		goto free_dst;

out:
	return xdst;

free_dst:
	dst_release(dst1);
	xdst = ERR_PTR(err);
	goto out;
}

2107
static struct flow_cache_object *
2108
xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
2109 2110
		   struct flow_cache_object *oldflo, void *ctx)
{
2111
	struct xfrm_flo *xflo = (struct xfrm_flo *)ctx;
2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139
	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
	struct xfrm_dst *xdst, *new_xdst;
	int num_pols = 0, num_xfrms = 0, i, err, pol_dead;

	/* Check if the policies from old bundle are usable */
	xdst = NULL;
	if (oldflo) {
		xdst = container_of(oldflo, struct xfrm_dst, flo);
		num_pols = xdst->num_pols;
		num_xfrms = xdst->num_xfrms;
		pol_dead = 0;
		for (i = 0; i < num_pols; i++) {
			pols[i] = xdst->pols[i];
			pol_dead |= pols[i]->walk.dead;
		}
		if (pol_dead) {
			dst_free(&xdst->u.dst);
			xdst = NULL;
			num_pols = 0;
			num_xfrms = 0;
			oldflo = NULL;
		}
	}

	/* Resolve policies to use if we couldn't get them from
	 * previous cache entry */
	if (xdst == NULL) {
		num_pols = 1;
2140 2141
		pols[0] = __xfrm_policy_lookup(net, fl, family,
					       flow_to_policy_dir(dir));
2142 2143 2144 2145 2146 2147 2148 2149 2150 2151
		err = xfrm_expand_policies(fl, family, pols,
					   &num_pols, &num_xfrms);
		if (err < 0)
			goto inc_error;
		if (num_pols == 0)
			return NULL;
		if (num_xfrms <= 0)
			goto make_dummy_bundle;
	}

2152 2153
	new_xdst = xfrm_resolve_and_create_bundle(pols, num_pols, fl, family,
						  xflo->dst_orig);
2154 2155 2156 2157 2158 2159 2160 2161
	if (IS_ERR(new_xdst)) {
		err = PTR_ERR(new_xdst);
		if (err != -EAGAIN)
			goto error;
		if (oldflo == NULL)
			goto make_dummy_bundle;
		dst_hold(&xdst->u.dst);
		return oldflo;
2162 2163 2164 2165 2166 2167 2168
	} else if (new_xdst == NULL) {
		num_xfrms = 0;
		if (oldflo == NULL)
			goto make_dummy_bundle;
		xdst->num_xfrms = 0;
		dst_hold(&xdst->u.dst);
		return oldflo;
2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186
	}

	/* Kill the previous bundle */
	if (xdst) {
		/* The policies were stolen for newly generated bundle */
		xdst->num_pols = 0;
		dst_free(&xdst->u.dst);
	}

	/* Flow cache does not have reference, it dst_free()'s,
	 * but we do need to return one reference for original caller */
	dst_hold(&new_xdst->u.dst);
	return &new_xdst->flo;

make_dummy_bundle:
	/* We found policies, but there's no bundles to instantiate:
	 * either because the policy blocks, has no transformations or
	 * we could not build template (no xfrm_states).*/
2187
	xdst = xfrm_create_dummy_bundle(net, xflo, fl, num_xfrms, family);
2188 2189 2190 2191 2192 2193
	if (IS_ERR(xdst)) {
		xfrm_pols_put(pols, num_pols);
		return ERR_CAST(xdst);
	}
	xdst->num_pols = num_pols;
	xdst->num_xfrms = num_xfrms;
2194
	memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207

	dst_hold(&xdst->u.dst);
	return &xdst->flo;

inc_error:
	XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
error:
	if (xdst != NULL)
		dst_free(&xdst->u.dst);
	else
		xfrm_pols_put(pols, num_pols);
	return ERR_PTR(err);
}
L
Linus Torvalds 已提交
2208

2209 2210 2211 2212 2213 2214 2215 2216
static struct dst_entry *make_blackhole(struct net *net, u16 family,
					struct dst_entry *dst_orig)
{
	struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
	struct dst_entry *ret;

	if (!afinfo) {
		dst_release(dst_orig);
2217
		return ERR_PTR(-EINVAL);
2218 2219 2220 2221 2222 2223 2224 2225
	} else {
		ret = afinfo->blackhole_route(net, dst_orig);
	}
	xfrm_policy_put_afinfo(afinfo);

	return ret;
}

L
Linus Torvalds 已提交
2226 2227 2228 2229 2230
/* Main function: finds/creates a bundle for given flow.
 *
 * At the moment we eat a raw IP route. Mostly to speed up lookups
 * on interfaces with disabled IPsec.
 */
2231 2232
struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
			      const struct flowi *fl,
2233
			      const struct sock *sk, int flags)
L
Linus Torvalds 已提交
2234
{
2235
	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
2236 2237
	struct flow_cache_object *flo;
	struct xfrm_dst *xdst;
2238
	struct dst_entry *dst, *route;
2239
	u16 family = dst_orig->ops->family;
2240
	u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
2241
	int i, err, num_pols, num_xfrms = 0, drop_pols = 0;
2242

2243 2244 2245
	dst = NULL;
	xdst = NULL;
	route = NULL;
2246

E
Eric Dumazet 已提交
2247
	sk = sk_const_to_full_sk(sk);
2248
	if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
2249 2250 2251 2252 2253
		num_pols = 1;
		pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
		err = xfrm_expand_policies(fl, family, pols,
					   &num_pols, &num_xfrms);
		if (err < 0)
2254
			goto dropdst;
2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268

		if (num_pols) {
			if (num_xfrms <= 0) {
				drop_pols = num_pols;
				goto no_transform;
			}

			xdst = xfrm_resolve_and_create_bundle(
					pols, num_pols, fl,
					family, dst_orig);
			if (IS_ERR(xdst)) {
				xfrm_pols_put(pols, num_pols);
				err = PTR_ERR(xdst);
				goto dropdst;
2269 2270 2271 2272
			} else if (xdst == NULL) {
				num_xfrms = 0;
				drop_pols = num_pols;
				goto no_transform;
2273 2274
			}

2275 2276
			dst_hold(&xdst->u.dst);
			xdst->u.dst.flags |= DST_NOCACHE;
2277
			route = xdst->route;
2278
		}
2279
	}
L
Linus Torvalds 已提交
2280

2281
	if (xdst == NULL) {
2282 2283 2284 2285 2286
		struct xfrm_flo xflo;

		xflo.dst_orig = dst_orig;
		xflo.flags = flags;

L
Linus Torvalds 已提交
2287
		/* To accelerate a bit...  */
2288
		if ((dst_orig->flags & DST_NOXFRM) ||
A
Alexey Dobriyan 已提交
2289
		    !net->xfrm.policy_count[XFRM_POLICY_OUT])
2290
			goto nopol;
L
Linus Torvalds 已提交
2291

2292
		flo = flow_cache_lookup(net, fl, family, dir,
2293
					xfrm_bundle_lookup, &xflo);
2294 2295
		if (flo == NULL)
			goto nopol;
2296
		if (IS_ERR(flo)) {
2297
			err = PTR_ERR(flo);
2298
			goto dropdst;
2299
		}
2300 2301 2302 2303
		xdst = container_of(flo, struct xfrm_dst, flo);

		num_pols = xdst->num_pols;
		num_xfrms = xdst->num_xfrms;
2304
		memcpy(pols, xdst->pols, sizeof(struct xfrm_policy *) * num_pols);
2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317
		route = xdst->route;
	}

	dst = &xdst->u.dst;
	if (route == NULL && num_xfrms > 0) {
		/* The only case when xfrm_bundle_lookup() returns a
		 * bundle with null route, is when the template could
		 * not be resolved. It means policies are there, but
		 * bundle could not be created, since we don't yet
		 * have the xfrm_state's. We need to wait for KM to
		 * negotiate new SA's or bail out with error.*/
		if (net->xfrm.sysctl_larval_drop) {
			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
2318 2319
			err = -EREMOTE;
			goto error;
2320 2321
		}

2322
		err = -EAGAIN;
2323 2324 2325

		XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
		goto error;
L
Linus Torvalds 已提交
2326 2327
	}

2328 2329
no_transform:
	if (num_pols == 0)
2330
		goto nopol;
L
Linus Torvalds 已提交
2331

2332 2333 2334
	if ((flags & XFRM_LOOKUP_ICMP) &&
	    !(pols[0]->flags & XFRM_POLICY_ICMP)) {
		err = -ENOENT;
2335
		goto error;
2336
	}
2337

2338 2339
	for (i = 0; i < num_pols; i++)
		pols[i]->curlft.use_time = get_seconds();
2340

2341
	if (num_xfrms < 0) {
L
Linus Torvalds 已提交
2342
		/* Prohibit the flow */
A
Alexey Dobriyan 已提交
2343
		XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLBLOCK);
2344 2345
		err = -EPERM;
		goto error;
2346 2347 2348 2349 2350 2351
	} else if (num_xfrms > 0) {
		/* Flow transformed */
		dst_release(dst_orig);
	} else {
		/* Flow passes untransformed */
		dst_release(dst);
2352
		dst = dst_orig;
L
Linus Torvalds 已提交
2353
	}
2354 2355
ok:
	xfrm_pols_put(pols, drop_pols);
G
Gao feng 已提交
2356 2357 2358
	if (dst && dst->xfrm &&
	    dst->xfrm->props.mode == XFRM_MODE_TUNNEL)
		dst->flags |= DST_XFRM_TUNNEL;
2359
	return dst;
L
Linus Torvalds 已提交
2360

2361
nopol:
2362 2363
	if (!(flags & XFRM_LOOKUP_ICMP)) {
		dst = dst_orig;
2364
		goto ok;
2365
	}
2366
	err = -ENOENT;
L
Linus Torvalds 已提交
2367
error:
2368
	dst_release(dst);
2369
dropdst:
2370 2371
	if (!(flags & XFRM_LOOKUP_KEEP_DST_REF))
		dst_release(dst_orig);
2372
	xfrm_pols_put(pols, drop_pols);
2373
	return ERR_PTR(err);
L
Linus Torvalds 已提交
2374 2375 2376
}
EXPORT_SYMBOL(xfrm_lookup);

2377 2378 2379 2380 2381
/* Callers of xfrm_lookup_route() must ensure a call to dst_output().
 * Otherwise we may send out blackholed packets.
 */
struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
				    const struct flowi *fl,
2382
				    const struct sock *sk, int flags)
2383
{
2384
	struct dst_entry *dst = xfrm_lookup(net, dst_orig, fl, sk,
2385 2386
					    flags | XFRM_LOOKUP_QUEUE |
					    XFRM_LOOKUP_KEEP_DST_REF);
2387 2388 2389 2390 2391 2392 2393 2394

	if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
		return make_blackhole(net, dst_orig->ops->family, dst_orig);

	return dst;
}
EXPORT_SYMBOL(xfrm_lookup_route);

2395
static inline int
2396
xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl)
2397 2398 2399 2400 2401 2402 2403 2404
{
	struct xfrm_state *x;

	if (!skb->sp || idx < 0 || idx >= skb->sp->len)
		return 0;
	x = skb->sp->xvec[idx];
	if (!x->type->reject)
		return 0;
2405
	return x->type->reject(x, skb, fl);
2406 2407
}

L
Linus Torvalds 已提交
2408 2409 2410 2411 2412 2413 2414
/* When skb is transformed back to its "native" form, we have to
 * check policy restrictions. At the moment we make this in maximally
 * stupid way. Shame on me. :-) Of course, connected sockets must
 * have policy cached at them.
 */

static inline int
2415
xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
L
Linus Torvalds 已提交
2416 2417 2418
	      unsigned short family)
{
	if (xfrm_state_kern(x))
2419
		return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
L
Linus Torvalds 已提交
2420 2421 2422 2423
	return	x->id.proto == tmpl->id.proto &&
		(x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
		(x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
		x->props.mode == tmpl->mode &&
2424
		(tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
2425
		 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
2426 2427
		!(x->props.mode != XFRM_MODE_TRANSPORT &&
		  xfrm_state_addr_cmp(tmpl, x, family));
L
Linus Torvalds 已提交
2428 2429
}

2430 2431 2432 2433 2434 2435 2436
/*
 * 0 or more than 0 is returned when validation is succeeded (either bypass
 * because of optional transport mode, or next index of the mathced secpath
 * state with the template.
 * -1 is returned when no matching template is found.
 * Otherwise "-2 - errored_index" is returned.
 */
L
Linus Torvalds 已提交
2437
static inline int
2438
xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,
L
Linus Torvalds 已提交
2439 2440 2441 2442 2443
	       unsigned short family)
{
	int idx = start;

	if (tmpl->optional) {
2444
		if (tmpl->mode == XFRM_MODE_TRANSPORT)
L
Linus Torvalds 已提交
2445 2446 2447 2448
			return start;
	} else
		start = -1;
	for (; idx < sp->len; idx++) {
2449
		if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
L
Linus Torvalds 已提交
2450
			return ++idx;
2451 2452 2453
		if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
			if (start == -1)
				start = -2-idx;
L
Linus Torvalds 已提交
2454
			break;
2455
		}
L
Linus Torvalds 已提交
2456 2457 2458 2459
	}
	return start;
}

2460 2461
int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
			  unsigned int family, int reverse)
L
Linus Torvalds 已提交
2462 2463
{
	struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
2464
	int err;
L
Linus Torvalds 已提交
2465 2466 2467 2468

	if (unlikely(afinfo == NULL))
		return -EAFNOSUPPORT;

2469
	afinfo->decode_session(skb, fl, reverse);
2470
	err = security_xfrm_decode_session(skb, &fl->flowi_secid);
L
Linus Torvalds 已提交
2471
	xfrm_policy_put_afinfo(afinfo);
2472
	return err;
L
Linus Torvalds 已提交
2473
}
2474
EXPORT_SYMBOL(__xfrm_decode_session);
L
Linus Torvalds 已提交
2475

2476
static inline int secpath_has_nontransport(const struct sec_path *sp, int k, int *idxp)
L
Linus Torvalds 已提交
2477 2478
{
	for (; k < sp->len; k++) {
2479
		if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) {
2480
			*idxp = k;
L
Linus Torvalds 已提交
2481
			return 1;
2482
		}
L
Linus Torvalds 已提交
2483 2484 2485 2486 2487
	}

	return 0;
}

2488
int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
L
Linus Torvalds 已提交
2489 2490
			unsigned short family)
{
2491
	struct net *net = dev_net(skb->dev);
L
Linus Torvalds 已提交
2492
	struct xfrm_policy *pol;
2493 2494 2495 2496
	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
	int npols = 0;
	int xfrm_nr;
	int pi;
2497
	int reverse;
L
Linus Torvalds 已提交
2498
	struct flowi fl;
2499
	u8 fl_dir;
2500
	int xerr_idx = -1;
L
Linus Torvalds 已提交
2501

2502 2503 2504 2505
	reverse = dir & ~XFRM_POLICY_MASK;
	dir &= XFRM_POLICY_MASK;
	fl_dir = policy_to_flow_dir(dir);

2506
	if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) {
A
Alexey Dobriyan 已提交
2507
		XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
L
Linus Torvalds 已提交
2508
		return 0;
2509 2510
	}

2511
	nf_nat_decode_session(skb, &fl, family);
L
Linus Torvalds 已提交
2512 2513 2514 2515 2516

	/* First, check used SA against their selectors. */
	if (skb->sp) {
		int i;

2517
		for (i = skb->sp->len-1; i >= 0; i--) {
2518
			struct xfrm_state *x = skb->sp->xvec[i];
2519
			if (!xfrm_selector_match(&x->sel, &fl, family)) {
A
Alexey Dobriyan 已提交
2520
				XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH);
L
Linus Torvalds 已提交
2521
				return 0;
2522
			}
L
Linus Torvalds 已提交
2523 2524 2525 2526
		}
	}

	pol = NULL;
E
Eric Dumazet 已提交
2527
	sk = sk_to_full_sk(sk);
2528
	if (sk && sk->sk_policy[dir]) {
2529
		pol = xfrm_sk_policy_lookup(sk, dir, &fl);
2530
		if (IS_ERR(pol)) {
A
Alexey Dobriyan 已提交
2531
			XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
2532
			return 0;
2533
		}
2534
	}
L
Linus Torvalds 已提交
2535

2536 2537 2538 2539 2540 2541 2542 2543 2544 2545
	if (!pol) {
		struct flow_cache_object *flo;

		flo = flow_cache_lookup(net, &fl, family, fl_dir,
					xfrm_policy_lookup, NULL);
		if (IS_ERR_OR_NULL(flo))
			pol = ERR_CAST(flo);
		else
			pol = container_of(flo, struct xfrm_policy, flo);
	}
L
Linus Torvalds 已提交
2546

2547
	if (IS_ERR(pol)) {
A
Alexey Dobriyan 已提交
2548
		XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
2549
		return 0;
2550
	}
2551

2552
	if (!pol) {
2553
		if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {
2554
			xfrm_secpath_reject(xerr_idx, skb, &fl);
A
Alexey Dobriyan 已提交
2555
			XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS);
2556 2557 2558 2559
			return 0;
		}
		return 1;
	}
L
Linus Torvalds 已提交
2560

2561
	pol->curlft.use_time = get_seconds();
L
Linus Torvalds 已提交
2562

2563
	pols[0] = pol;
2564
	npols++;
2565 2566
#ifdef CONFIG_XFRM_SUB_POLICY
	if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
2567
		pols[1] = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN,
2568 2569 2570
						    &fl, family,
						    XFRM_POLICY_IN);
		if (pols[1]) {
2571
			if (IS_ERR(pols[1])) {
A
Alexey Dobriyan 已提交
2572
				XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
2573
				return 0;
2574
			}
2575
			pols[1]->curlft.use_time = get_seconds();
2576
			npols++;
2577 2578 2579 2580
		}
	}
#endif

L
Linus Torvalds 已提交
2581 2582 2583
	if (pol->action == XFRM_POLICY_ALLOW) {
		struct sec_path *sp;
		static struct sec_path dummy;
2584
		struct xfrm_tmpl *tp[XFRM_MAX_DEPTH];
2585
		struct xfrm_tmpl *stp[XFRM_MAX_DEPTH];
2586 2587
		struct xfrm_tmpl **tpp = tp;
		int ti = 0;
L
Linus Torvalds 已提交
2588 2589 2590 2591 2592
		int i, k;

		if ((sp = skb->sp) == NULL)
			sp = &dummy;

2593 2594
		for (pi = 0; pi < npols; pi++) {
			if (pols[pi] != pol &&
2595
			    pols[pi]->action != XFRM_POLICY_ALLOW) {
A
Alexey Dobriyan 已提交
2596
				XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK);
2597
				goto reject;
2598 2599
			}
			if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) {
A
Alexey Dobriyan 已提交
2600
				XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
2601
				goto reject_error;
2602
			}
2603 2604 2605 2606
			for (i = 0; i < pols[pi]->xfrm_nr; i++)
				tpp[ti++] = &pols[pi]->xfrm_vec[i];
		}
		xfrm_nr = ti;
2607
		if (npols > 1) {
F
Fan Du 已提交
2608
			xfrm_tmpl_sort(stp, tpp, xfrm_nr, family, net);
2609 2610
			tpp = stp;
		}
2611

L
Linus Torvalds 已提交
2612 2613 2614 2615 2616 2617
		/* For each tunnel xfrm, find the first matching tmpl.
		 * For each tmpl before that, find corresponding xfrm.
		 * Order is _important_. Later we will implement
		 * some barriers, but at the moment barriers
		 * are implied between each two transformations.
		 */
2618 2619
		for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
			k = xfrm_policy_ok(tpp[i], sp, k, family);
2620
			if (k < 0) {
2621 2622 2623
				if (k < -1)
					/* "-2 - errored_index" returned */
					xerr_idx = -(2+k);
A
Alexey Dobriyan 已提交
2624
				XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH);
L
Linus Torvalds 已提交
2625
				goto reject;
2626
			}
L
Linus Torvalds 已提交
2627 2628
		}

2629
		if (secpath_has_nontransport(sp, k, &xerr_idx)) {
A
Alexey Dobriyan 已提交
2630
			XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH);
L
Linus Torvalds 已提交
2631
			goto reject;
2632
		}
L
Linus Torvalds 已提交
2633

2634
		xfrm_pols_put(pols, npols);
L
Linus Torvalds 已提交
2635 2636
		return 1;
	}
A
Alexey Dobriyan 已提交
2637
	XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK);
L
Linus Torvalds 已提交
2638 2639

reject:
2640
	xfrm_secpath_reject(xerr_idx, skb, &fl);
2641 2642
reject_error:
	xfrm_pols_put(pols, npols);
L
Linus Torvalds 已提交
2643 2644 2645 2646 2647 2648
	return 0;
}
EXPORT_SYMBOL(__xfrm_policy_check);

int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
{
2649
	struct net *net = dev_net(skb->dev);
L
Linus Torvalds 已提交
2650
	struct flowi fl;
E
Eric Dumazet 已提交
2651
	struct dst_entry *dst;
E
Eric Dumazet 已提交
2652
	int res = 1;
L
Linus Torvalds 已提交
2653

2654
	if (xfrm_decode_session(skb, &fl, family) < 0) {
2655
		XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
L
Linus Torvalds 已提交
2656
		return 0;
2657
	}
L
Linus Torvalds 已提交
2658

2659
	skb_dst_force(skb);
E
Eric Dumazet 已提交
2660

2661
	dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, XFRM_LOOKUP_QUEUE);
2662
	if (IS_ERR(dst)) {
E
Eric Dumazet 已提交
2663
		res = 0;
2664 2665
		dst = NULL;
	}
E
Eric Dumazet 已提交
2666 2667
	skb_dst_set(skb, dst);
	return res;
L
Linus Torvalds 已提交
2668 2669 2670
}
EXPORT_SYMBOL(__xfrm_route_forward);

2671 2672
/* Optimize later using cookies and generation ids. */

L
Linus Torvalds 已提交
2673 2674
static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
{
2675
	/* Code (such as __xfrm4_bundle_create()) sets dst->obsolete
2676 2677 2678 2679 2680 2681 2682
	 * to DST_OBSOLETE_FORCE_CHK to force all XFRM destinations to
	 * get validated by dst_ops->check on every use.  We do this
	 * because when a normal route referenced by an XFRM dst is
	 * obsoleted we do not go looking around for all parent
	 * referencing XFRM dsts so that we can invalidate them.  It
	 * is just too much work.  Instead we make the checks here on
	 * every use.  For example:
2683 2684 2685 2686 2687 2688 2689 2690 2691
	 *
	 *	XFRM dst A --> IPv4 dst X
	 *
	 * X is the "xdst->route" of A (X is also the "dst->path" of A
	 * in this example).  If X is marked obsolete, "A" will not
	 * notice.  That's what we are validating here via the
	 * stale_bundle() check.
	 *
	 * When a policy's bundle is pruned, we dst_free() the XFRM
2692 2693 2694
	 * dst which causes it's ->obsolete field to be set to
	 * DST_OBSOLETE_DEAD.  If an XFRM dst has been pruned like
	 * this, we want to force a new route lookup.
2695
	 */
2696 2697 2698
	if (dst->obsolete < 0 && !stale_bundle(dst))
		return dst;

L
Linus Torvalds 已提交
2699 2700 2701 2702 2703
	return NULL;
}

static int stale_bundle(struct dst_entry *dst)
{
2704
	return !xfrm_bundle_ok((struct xfrm_dst *)dst);
L
Linus Torvalds 已提交
2705 2706
}

H
Herbert Xu 已提交
2707
void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
L
Linus Torvalds 已提交
2708 2709
{
	while ((dst = dst->child) && dst->xfrm && dst->dev == dev) {
2710
		dst->dev = dev_net(dev)->loopback_dev;
2711
		dev_hold(dst->dev);
L
Linus Torvalds 已提交
2712 2713 2714
		dev_put(dev);
	}
}
H
Herbert Xu 已提交
2715
EXPORT_SYMBOL(xfrm_dst_ifdown);
L
Linus Torvalds 已提交
2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732

static void xfrm_link_failure(struct sk_buff *skb)
{
	/* Impossible. Such dst must be popped before reaches point of failure. */
}

static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
{
	if (dst) {
		if (dst->obsolete) {
			dst_release(dst);
			dst = NULL;
		}
	}
	return dst;
}

2733
void xfrm_garbage_collect(struct net *net)
2734
{
2735
	flow_cache_flush(net);
2736
}
2737
EXPORT_SYMBOL(xfrm_garbage_collect);
2738 2739 2740

static void xfrm_garbage_collect_deferred(struct net *net)
{
2741
	flow_cache_flush_deferred(net);
2742 2743
}

2744
static void xfrm_init_pmtu(struct dst_entry *dst)
L
Linus Torvalds 已提交
2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760
{
	do {
		struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
		u32 pmtu, route_mtu_cached;

		pmtu = dst_mtu(dst->child);
		xdst->child_mtu_cached = pmtu;

		pmtu = xfrm_state_mtu(dst->xfrm, pmtu);

		route_mtu_cached = dst_mtu(xdst->route);
		xdst->route_mtu_cached = route_mtu_cached;

		if (pmtu > route_mtu_cached)
			pmtu = route_mtu_cached;

2761
		dst_metric_set(dst, RTAX_MTU, pmtu);
L
Linus Torvalds 已提交
2762 2763 2764 2765 2766 2767 2768
	} while ((dst = dst->next));
}

/* Check that the bundle accepts the flow and its components are
 * still valid.
 */

2769
static int xfrm_bundle_ok(struct xfrm_dst *first)
L
Linus Torvalds 已提交
2770 2771 2772 2773 2774
{
	struct dst_entry *dst = &first->u.dst;
	struct xfrm_dst *last;
	u32 mtu;

2775
	if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) ||
L
Linus Torvalds 已提交
2776 2777 2778
	    (dst->dev && !netif_running(dst->dev)))
		return 0;

2779 2780 2781
	if (dst->flags & DST_XFRM_QUEUE)
		return 1;

L
Linus Torvalds 已提交
2782 2783 2784 2785 2786 2787 2788
	last = NULL;

	do {
		struct xfrm_dst *xdst = (struct xfrm_dst *)dst;

		if (dst->xfrm->km.state != XFRM_STATE_VALID)
			return 0;
2789 2790
		if (xdst->xfrm_genid != dst->xfrm->genid)
			return 0;
2791 2792
		if (xdst->num_pols > 0 &&
		    xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
2793
			return 0;
2794

L
Linus Torvalds 已提交
2795 2796 2797 2798 2799 2800
		mtu = dst_mtu(dst->child);
		if (xdst->child_mtu_cached != mtu) {
			last = xdst;
			xdst->child_mtu_cached = mtu;
		}

2801
		if (!dst_check(xdst->route, xdst->route_cookie))
L
Linus Torvalds 已提交
2802 2803 2804 2805 2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821
			return 0;
		mtu = dst_mtu(xdst->route);
		if (xdst->route_mtu_cached != mtu) {
			last = xdst;
			xdst->route_mtu_cached = mtu;
		}

		dst = dst->child;
	} while (dst->xfrm);

	if (likely(!last))
		return 1;

	mtu = last->child_mtu_cached;
	for (;;) {
		dst = &last->u.dst;

		mtu = xfrm_state_mtu(dst->xfrm, mtu);
		if (mtu > last->route_mtu_cached)
			mtu = last->route_mtu_cached;
2822
		dst_metric_set(dst, RTAX_MTU, mtu);
L
Linus Torvalds 已提交
2823 2824 2825 2826

		if (last == first)
			break;

2827
		last = (struct xfrm_dst *)last->u.dst.next;
L
Linus Torvalds 已提交
2828 2829 2830 2831 2832 2833
		last->child_mtu_cached = mtu;
	}

	return 1;
}

2834 2835 2836 2837 2838
static unsigned int xfrm_default_advmss(const struct dst_entry *dst)
{
	return dst_metric_advmss(dst->path);
}

2839
static unsigned int xfrm_mtu(const struct dst_entry *dst)
2840
{
2841 2842 2843
	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);

	return mtu ? : dst_mtu(dst->path);
2844 2845
}

2846 2847 2848
static struct neighbour *xfrm_neigh_lookup(const struct dst_entry *dst,
					   struct sk_buff *skb,
					   const void *daddr)
2849
{
2850
	return dst->path->ops->neigh_lookup(dst, skb, daddr);
2851 2852
}

L
Linus Torvalds 已提交
2853 2854 2855 2856 2857 2858 2859
int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
{
	int err = 0;
	if (unlikely(afinfo == NULL))
		return -EINVAL;
	if (unlikely(afinfo->family >= NPROTO))
		return -EAFNOSUPPORT;
E
Eric Dumazet 已提交
2860
	spin_lock(&xfrm_policy_afinfo_lock);
L
Linus Torvalds 已提交
2861
	if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
2862
		err = -EEXIST;
L
Linus Torvalds 已提交
2863 2864 2865 2866 2867 2868
	else {
		struct dst_ops *dst_ops = afinfo->dst_ops;
		if (likely(dst_ops->kmem_cachep == NULL))
			dst_ops->kmem_cachep = xfrm_dst_cache;
		if (likely(dst_ops->check == NULL))
			dst_ops->check = xfrm_dst_check;
2869 2870
		if (likely(dst_ops->default_advmss == NULL))
			dst_ops->default_advmss = xfrm_default_advmss;
2871 2872
		if (likely(dst_ops->mtu == NULL))
			dst_ops->mtu = xfrm_mtu;
L
Linus Torvalds 已提交
2873 2874 2875 2876
		if (likely(dst_ops->negative_advice == NULL))
			dst_ops->negative_advice = xfrm_negative_advice;
		if (likely(dst_ops->link_failure == NULL))
			dst_ops->link_failure = xfrm_link_failure;
2877 2878
		if (likely(dst_ops->neigh_lookup == NULL))
			dst_ops->neigh_lookup = xfrm_neigh_lookup;
L
Linus Torvalds 已提交
2879
		if (likely(afinfo->garbage_collect == NULL))
2880
			afinfo->garbage_collect = xfrm_garbage_collect_deferred;
2881
		rcu_assign_pointer(xfrm_policy_afinfo[afinfo->family], afinfo);
L
Linus Torvalds 已提交
2882
	}
E
Eric Dumazet 已提交
2883
	spin_unlock(&xfrm_policy_afinfo_lock);
2884

L
Linus Torvalds 已提交
2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895
	return err;
}
EXPORT_SYMBOL(xfrm_policy_register_afinfo);

int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
{
	int err = 0;
	if (unlikely(afinfo == NULL))
		return -EINVAL;
	if (unlikely(afinfo->family >= NPROTO))
		return -EAFNOSUPPORT;
E
Eric Dumazet 已提交
2896
	spin_lock(&xfrm_policy_afinfo_lock);
L
Linus Torvalds 已提交
2897 2898 2899
	if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
		if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
			err = -EINVAL;
E
Eric Dumazet 已提交
2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914
		else
			RCU_INIT_POINTER(xfrm_policy_afinfo[afinfo->family],
					 NULL);
	}
	spin_unlock(&xfrm_policy_afinfo_lock);
	if (!err) {
		struct dst_ops *dst_ops = afinfo->dst_ops;

		synchronize_rcu();

		dst_ops->kmem_cachep = NULL;
		dst_ops->check = NULL;
		dst_ops->negative_advice = NULL;
		dst_ops->link_failure = NULL;
		afinfo->garbage_collect = NULL;
L
Linus Torvalds 已提交
2915 2916 2917 2918 2919 2920 2921
	}
	return err;
}
EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);

static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
{
2922
	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
2923

L
Linus Torvalds 已提交
2924 2925
	switch (event) {
	case NETDEV_DOWN:
2926
		xfrm_garbage_collect(dev_net(dev));
L
Linus Torvalds 已提交
2927 2928 2929 2930 2931
	}
	return NOTIFY_DONE;
}

static struct notifier_block xfrm_dev_notifier = {
A
Alexey Dobriyan 已提交
2932
	.notifier_call	= xfrm_dev_event,
L
Linus Torvalds 已提交
2933 2934
};

2935
#ifdef CONFIG_XFRM_STATISTICS
A
Alexey Dobriyan 已提交
2936
static int __net_init xfrm_statistics_init(struct net *net)
2937
{
2938
	int rv;
W
WANG Cong 已提交
2939 2940
	net->mib.xfrm_statistics = alloc_percpu(struct linux_xfrm_mib);
	if (!net->mib.xfrm_statistics)
2941
		return -ENOMEM;
2942 2943
	rv = xfrm_proc_init(net);
	if (rv < 0)
W
WANG Cong 已提交
2944
		free_percpu(net->mib.xfrm_statistics);
2945
	return rv;
2946
}
A
Alexey Dobriyan 已提交
2947 2948 2949

static void xfrm_statistics_fini(struct net *net)
{
2950
	xfrm_proc_fini(net);
W
WANG Cong 已提交
2951
	free_percpu(net->mib.xfrm_statistics);
A
Alexey Dobriyan 已提交
2952 2953 2954 2955 2956 2957 2958 2959 2960 2961
}
#else
static int __net_init xfrm_statistics_init(struct net *net)
{
	return 0;
}

static void xfrm_statistics_fini(struct net *net)
{
}
2962 2963
#endif

2964
static int __net_init xfrm_policy_init(struct net *net)
L
Linus Torvalds 已提交
2965
{
2966 2967 2968
	unsigned int hmask, sz;
	int dir;

2969 2970
	if (net_eq(net, &init_net))
		xfrm_dst_cache = kmem_cache_create("xfrm_dst_cache",
L
Linus Torvalds 已提交
2971
					   sizeof(struct xfrm_dst),
A
Alexey Dobriyan 已提交
2972
					   0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
2973
					   NULL);
L
Linus Torvalds 已提交
2974

2975 2976 2977
	hmask = 8 - 1;
	sz = (hmask+1) * sizeof(struct hlist_head);

2978 2979 2980
	net->xfrm.policy_byidx = xfrm_hash_alloc(sz);
	if (!net->xfrm.policy_byidx)
		goto out_byidx;
2981
	net->xfrm.policy_idx_hmask = hmask;
2982

H
Herbert Xu 已提交
2983
	for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
2984 2985
		struct xfrm_policy_hash *htab;

2986
		net->xfrm.policy_count[dir] = 0;
H
Herbert Xu 已提交
2987
		net->xfrm.policy_count[XFRM_POLICY_MAX + dir] = 0;
2988
		INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
2989

2990
		htab = &net->xfrm.policy_bydst[dir];
2991
		htab->table = xfrm_hash_alloc(sz);
2992
		if (!htab->table)
2993 2994
			goto out_bydst;
		htab->hmask = hmask;
2995 2996 2997 2998
		htab->dbits4 = 32;
		htab->sbits4 = 32;
		htab->dbits6 = 128;
		htab->sbits6 = 128;
2999
	}
3000 3001 3002 3003 3004 3005
	net->xfrm.policy_hthresh.lbits4 = 32;
	net->xfrm.policy_hthresh.rbits4 = 32;
	net->xfrm.policy_hthresh.lbits6 = 128;
	net->xfrm.policy_hthresh.rbits6 = 128;

	seqlock_init(&net->xfrm.policy_hthresh.lock);
3006

3007
	INIT_LIST_HEAD(&net->xfrm.policy_all);
3008
	INIT_WORK(&net->xfrm.policy_hash_work, xfrm_hash_resize);
3009
	INIT_WORK(&net->xfrm.policy_hthresh.work, xfrm_hash_rebuild);
3010 3011 3012
	if (net_eq(net, &init_net))
		register_netdevice_notifier(&xfrm_dev_notifier);
	return 0;
3013

3014 3015 3016 3017 3018 3019 3020 3021
out_bydst:
	for (dir--; dir >= 0; dir--) {
		struct xfrm_policy_hash *htab;

		htab = &net->xfrm.policy_bydst[dir];
		xfrm_hash_free(htab->table, sz);
	}
	xfrm_hash_free(net->xfrm.policy_byidx, sz);
3022 3023
out_byidx:
	return -ENOMEM;
3024 3025 3026 3027
}

static void xfrm_policy_fini(struct net *net)
{
3028
	unsigned int sz;
3029
	int dir;
3030

3031 3032
	flush_work(&net->xfrm.policy_hash_work);
#ifdef CONFIG_XFRM_SUB_POLICY
3033
	xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false);
3034
#endif
3035
	xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, false);
3036

3037
	WARN_ON(!list_empty(&net->xfrm.policy_all));
3038

H
Herbert Xu 已提交
3039
	for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
3040 3041
		struct xfrm_policy_hash *htab;

3042
		WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir]));
3043 3044

		htab = &net->xfrm.policy_bydst[dir];
3045
		sz = (htab->hmask + 1) * sizeof(struct hlist_head);
3046 3047
		WARN_ON(!hlist_empty(htab->table));
		xfrm_hash_free(htab->table, sz);
3048 3049
	}

3050
	sz = (net->xfrm.policy_idx_hmask + 1) * sizeof(struct hlist_head);
3051 3052
	WARN_ON(!hlist_empty(net->xfrm.policy_byidx));
	xfrm_hash_free(net->xfrm.policy_byidx, sz);
L
Linus Torvalds 已提交
3053 3054
}

3055 3056 3057 3058
static int __net_init xfrm_net_init(struct net *net)
{
	int rv;

A
Alexey Dobriyan 已提交
3059 3060 3061
	rv = xfrm_statistics_init(net);
	if (rv < 0)
		goto out_statistics;
3062 3063 3064 3065 3066 3067
	rv = xfrm_state_init(net);
	if (rv < 0)
		goto out_state;
	rv = xfrm_policy_init(net);
	if (rv < 0)
		goto out_policy;
A
Alexey Dobriyan 已提交
3068 3069 3070
	rv = xfrm_sysctl_init(net);
	if (rv < 0)
		goto out_sysctl;
3071 3072 3073
	rv = flow_cache_init(net);
	if (rv < 0)
		goto out;
F
Fan Du 已提交
3074 3075 3076 3077 3078 3079

	/* Initialize the per-net locks here */
	spin_lock_init(&net->xfrm.xfrm_state_lock);
	rwlock_init(&net->xfrm.xfrm_policy_lock);
	mutex_init(&net->xfrm.xfrm_cfg_mutex);

3080 3081
	return 0;

3082 3083
out:
	xfrm_sysctl_fini(net);
A
Alexey Dobriyan 已提交
3084 3085
out_sysctl:
	xfrm_policy_fini(net);
3086 3087 3088
out_policy:
	xfrm_state_fini(net);
out_state:
A
Alexey Dobriyan 已提交
3089 3090
	xfrm_statistics_fini(net);
out_statistics:
3091 3092 3093 3094 3095
	return rv;
}

static void __net_exit xfrm_net_exit(struct net *net)
{
3096
	flow_cache_fini(net);
A
Alexey Dobriyan 已提交
3097
	xfrm_sysctl_fini(net);
3098 3099
	xfrm_policy_fini(net);
	xfrm_state_fini(net);
A
Alexey Dobriyan 已提交
3100
	xfrm_statistics_fini(net);
3101 3102 3103 3104 3105 3106 3107
}

static struct pernet_operations __net_initdata xfrm_net_ops = {
	.init = xfrm_net_init,
	.exit = xfrm_net_exit,
};

L
Linus Torvalds 已提交
3108 3109
void __init xfrm_init(void)
{
3110
	register_pernet_subsys(&xfrm_net_ops);
3111
	seqcount_init(&xfrm_policy_hash_generation);
L
Linus Torvalds 已提交
3112 3113 3114
	xfrm_input_init();
}

J
Joy Latten 已提交
3115
#ifdef CONFIG_AUDITSYSCALL
3116 3117
static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
					 struct audit_buffer *audit_buf)
J
Joy Latten 已提交
3118
{
3119 3120 3121 3122
	struct xfrm_sec_ctx *ctx = xp->security;
	struct xfrm_selector *sel = &xp->selector;

	if (ctx)
J
Joy Latten 已提交
3123
		audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
3124
				 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
J
Joy Latten 已提交
3125

3126
	switch (sel->family) {
J
Joy Latten 已提交
3127
	case AF_INET:
H
Harvey Harrison 已提交
3128
		audit_log_format(audit_buf, " src=%pI4", &sel->saddr.a4);
3129 3130 3131
		if (sel->prefixlen_s != 32)
			audit_log_format(audit_buf, " src_prefixlen=%d",
					 sel->prefixlen_s);
H
Harvey Harrison 已提交
3132
		audit_log_format(audit_buf, " dst=%pI4", &sel->daddr.a4);
3133 3134 3135
		if (sel->prefixlen_d != 32)
			audit_log_format(audit_buf, " dst_prefixlen=%d",
					 sel->prefixlen_d);
J
Joy Latten 已提交
3136 3137
		break;
	case AF_INET6:
H
Harvey Harrison 已提交
3138
		audit_log_format(audit_buf, " src=%pI6", sel->saddr.a6);
3139 3140 3141
		if (sel->prefixlen_s != 128)
			audit_log_format(audit_buf, " src_prefixlen=%d",
					 sel->prefixlen_s);
H
Harvey Harrison 已提交
3142
		audit_log_format(audit_buf, " dst=%pI6", sel->daddr.a6);
3143 3144 3145
		if (sel->prefixlen_d != 128)
			audit_log_format(audit_buf, " dst_prefixlen=%d",
					 sel->prefixlen_d);
J
Joy Latten 已提交
3146 3147 3148 3149
		break;
	}
}

3150
void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid)
J
Joy Latten 已提交
3151 3152 3153
{
	struct audit_buffer *audit_buf;

P
Paul Moore 已提交
3154
	audit_buf = xfrm_audit_start("SPD-add");
J
Joy Latten 已提交
3155 3156
	if (audit_buf == NULL)
		return;
3157
	xfrm_audit_helper_usrinfo(task_valid, audit_buf);
P
Paul Moore 已提交
3158
	audit_log_format(audit_buf, " res=%u", result);
J
Joy Latten 已提交
3159 3160 3161 3162 3163
	xfrm_audit_common_policyinfo(xp, audit_buf);
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);

P
Paul Moore 已提交
3164
void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
3165
			      bool task_valid)
J
Joy Latten 已提交
3166 3167 3168
{
	struct audit_buffer *audit_buf;

P
Paul Moore 已提交
3169
	audit_buf = xfrm_audit_start("SPD-delete");
J
Joy Latten 已提交
3170 3171
	if (audit_buf == NULL)
		return;
3172
	xfrm_audit_helper_usrinfo(task_valid, audit_buf);
P
Paul Moore 已提交
3173
	audit_log_format(audit_buf, " res=%u", result);
J
Joy Latten 已提交
3174 3175 3176 3177 3178 3179
	xfrm_audit_common_policyinfo(xp, audit_buf);
	audit_log_end(audit_buf);
}
EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete);
#endif

3180
#ifdef CONFIG_XFRM_MIGRATE
3181 3182
static bool xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp,
					const struct xfrm_selector *sel_tgt)
3183 3184 3185
{
	if (sel_cmp->proto == IPSEC_ULPROTO_ANY) {
		if (sel_tgt->family == sel_cmp->family &&
3186 3187 3188 3189
		    xfrm_addr_equal(&sel_tgt->daddr, &sel_cmp->daddr,
				    sel_cmp->family) &&
		    xfrm_addr_equal(&sel_tgt->saddr, &sel_cmp->saddr,
				    sel_cmp->family) &&
3190 3191
		    sel_tgt->prefixlen_d == sel_cmp->prefixlen_d &&
		    sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) {
3192
			return true;
3193 3194 3195
		}
	} else {
		if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) {
3196
			return true;
3197 3198
		}
	}
3199
	return false;
3200 3201
}

3202 3203
static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *sel,
						    u8 dir, u8 type, struct net *net)
3204 3205 3206 3207 3208
{
	struct xfrm_policy *pol, *ret = NULL;
	struct hlist_head *chain;
	u32 priority = ~0U;

F
Fan Du 已提交
3209
	read_lock_bh(&net->xfrm.xfrm_policy_lock); /*FIXME*/
3210
	chain = policy_hash_direct(net, &sel->daddr, &sel->saddr, sel->family, dir);
3211
	hlist_for_each_entry(pol, chain, bydst) {
3212 3213 3214 3215 3216 3217 3218
		if (xfrm_migrate_selector_match(sel, &pol->selector) &&
		    pol->type == type) {
			ret = pol;
			priority = ret->priority;
			break;
		}
	}
3219
	chain = &net->xfrm.policy_inexact[dir];
3220
	hlist_for_each_entry(pol, chain, bydst) {
3221 3222 3223
		if ((pol->priority >= priority) && ret)
			break;

3224
		if (xfrm_migrate_selector_match(sel, &pol->selector) &&
3225
		    pol->type == type) {
3226 3227 3228 3229 3230
			ret = pol;
			break;
		}
	}

3231
	xfrm_pol_hold(ret);
3232

F
Fan Du 已提交
3233
	read_unlock_bh(&net->xfrm.xfrm_policy_lock);
3234 3235 3236 3237

	return ret;
}

3238
static int migrate_tmpl_match(const struct xfrm_migrate *m, const struct xfrm_tmpl *t)
3239 3240 3241 3242 3243 3244 3245 3246
{
	int match = 0;

	if (t->mode == m->mode && t->id.proto == m->proto &&
	    (m->reqid == 0 || t->reqid == m->reqid)) {
		switch (t->mode) {
		case XFRM_MODE_TUNNEL:
		case XFRM_MODE_BEET:
3247 3248 3249 3250
			if (xfrm_addr_equal(&t->id.daddr, &m->old_daddr,
					    m->old_family) &&
			    xfrm_addr_equal(&t->saddr, &m->old_saddr,
					    m->old_family)) {
3251 3252 3253 3254 3255 3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267 3268 3269 3270 3271 3272 3273 3274
				match = 1;
			}
			break;
		case XFRM_MODE_TRANSPORT:
			/* in case of transport mode, template does not store
			   any IP addresses, hence we just compare mode and
			   protocol */
			match = 1;
			break;
		default:
			break;
		}
	}
	return match;
}

/* update endpoint address(es) of template(s) */
static int xfrm_policy_migrate(struct xfrm_policy *pol,
			       struct xfrm_migrate *m, int num_migrate)
{
	struct xfrm_migrate *mp;
	int i, j, n = 0;

	write_lock_bh(&pol->lock);
H
Herbert Xu 已提交
3275
	if (unlikely(pol->walk.dead)) {
3276 3277 3278 3279 3280 3281 3282 3283 3284 3285
		/* target policy has been deleted */
		write_unlock_bh(&pol->lock);
		return -ENOENT;
	}

	for (i = 0; i < pol->xfrm_nr; i++) {
		for (j = 0, mp = m; j < num_migrate; j++, mp++) {
			if (!migrate_tmpl_match(mp, &pol->xfrm_vec[i]))
				continue;
			n++;
H
Herbert Xu 已提交
3286 3287
			if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL &&
			    pol->xfrm_vec[i].mode != XFRM_MODE_BEET)
3288 3289 3290 3291 3292 3293 3294 3295
				continue;
			/* update endpoints */
			memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr,
			       sizeof(pol->xfrm_vec[i].id.daddr));
			memcpy(&pol->xfrm_vec[i].saddr, &mp->new_saddr,
			       sizeof(pol->xfrm_vec[i].saddr));
			pol->xfrm_vec[i].encap_family = mp->new_family;
			/* flush bundles */
3296
			atomic_inc(&pol->genid);
3297 3298 3299 3300 3301 3302 3303 3304 3305 3306 3307
		}
	}

	write_unlock_bh(&pol->lock);

	if (!n)
		return -ENODATA;

	return 0;
}

3308
static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate)
3309 3310 3311 3312 3313 3314 3315
{
	int i, j;

	if (num_migrate < 1 || num_migrate > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < num_migrate; i++) {
3316 3317 3318 3319
		if (xfrm_addr_equal(&m[i].old_daddr, &m[i].new_daddr,
				    m[i].old_family) &&
		    xfrm_addr_equal(&m[i].old_saddr, &m[i].new_saddr,
				    m[i].old_family))
3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332 3333 3334 3335 3336 3337 3338 3339 3340 3341
			return -EINVAL;
		if (xfrm_addr_any(&m[i].new_daddr, m[i].new_family) ||
		    xfrm_addr_any(&m[i].new_saddr, m[i].new_family))
			return -EINVAL;

		/* check if there is any duplicated entry */
		for (j = i + 1; j < num_migrate; j++) {
			if (!memcmp(&m[i].old_daddr, &m[j].old_daddr,
				    sizeof(m[i].old_daddr)) &&
			    !memcmp(&m[i].old_saddr, &m[j].old_saddr,
				    sizeof(m[i].old_saddr)) &&
			    m[i].proto == m[j].proto &&
			    m[i].mode == m[j].mode &&
			    m[i].reqid == m[j].reqid &&
			    m[i].old_family == m[j].old_family)
				return -EINVAL;
		}
	}

	return 0;
}

3342
int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
3343
		 struct xfrm_migrate *m, int num_migrate,
3344
		 struct xfrm_kmaddress *k, struct net *net)
3345 3346 3347 3348 3349 3350 3351 3352 3353 3354 3355 3356
{
	int i, err, nx_cur = 0, nx_new = 0;
	struct xfrm_policy *pol = NULL;
	struct xfrm_state *x, *xc;
	struct xfrm_state *x_cur[XFRM_MAX_DEPTH];
	struct xfrm_state *x_new[XFRM_MAX_DEPTH];
	struct xfrm_migrate *mp;

	if ((err = xfrm_migrate_check(m, num_migrate)) < 0)
		goto out;

	/* Stage 1 - find policy */
3357
	if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
3358 3359 3360 3361 3362 3363
		err = -ENOENT;
		goto out;
	}

	/* Stage 2 - find and update state(s) */
	for (i = 0, mp = m; i < num_migrate; i++, mp++) {
F
Fan Du 已提交
3364
		if ((x = xfrm_migrate_state_find(mp, net))) {
3365 3366 3367 3368 3369 3370 3371 3372 3373 3374 3375 3376 3377 3378 3379 3380 3381 3382 3383 3384 3385 3386 3387
			x_cur[nx_cur] = x;
			nx_cur++;
			if ((xc = xfrm_state_migrate(x, mp))) {
				x_new[nx_new] = xc;
				nx_new++;
			} else {
				err = -ENODATA;
				goto restore_state;
			}
		}
	}

	/* Stage 3 - update policy */
	if ((err = xfrm_policy_migrate(pol, m, num_migrate)) < 0)
		goto restore_state;

	/* Stage 4 - delete old state(s) */
	if (nx_cur) {
		xfrm_states_put(x_cur, nx_cur);
		xfrm_states_delete(x_cur, nx_cur);
	}

	/* Stage 5 - announce */
3388
	km_migrate(sel, dir, type, m, num_migrate, k);
3389 3390 3391 3392 3393 3394 3395 3396 3397 3398 3399 3400 3401 3402 3403 3404 3405

	xfrm_pol_put(pol);

	return 0;
out:
	return err;

restore_state:
	if (pol)
		xfrm_pol_put(pol);
	if (nx_cur)
		xfrm_states_put(x_cur, nx_cur);
	if (nx_new)
		xfrm_states_delete(x_new, nx_new);

	return err;
}
3406
EXPORT_SYMBOL(xfrm_migrate);
3407
#endif