blob: ee62c239a7e39f27f862a427f0c2ddb656c88a31 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm_state.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
Trent Jaegerdf718372005-12-13 23:12:27 -080013 *
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 */
15
16#include <linux/workqueue.h>
17#include <net/xfrm.h>
18#include <linux/pfkeyv2.h>
19#include <linux/ipsec.h>
20#include <linux/module.h>
21#include <asm/uaccess.h>
22
David S. Milleree857a72006-03-20 19:18:37 -080023struct sock *xfrm_nl;
24EXPORT_SYMBOL(xfrm_nl);
25
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -080026u32 sysctl_xfrm_aevent_etime = XFRM_AE_ETIME;
David S. Millera70fcb02006-03-20 19:18:52 -080027EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
28
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -080029u32 sysctl_xfrm_aevent_rseqth = XFRM_AE_SEQT_SIZE;
David S. Millera70fcb02006-03-20 19:18:52 -080030EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
31
Linus Torvalds1da177e2005-04-16 15:20:36 -070032/* Each xfrm_state may be linked to two tables:
33
34 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
35 2. Hash table by daddr to find what SAs exist for given
36 destination/tunnel endpoint. (output)
37 */
38
39static DEFINE_SPINLOCK(xfrm_state_lock);
40
41/* Hash table to find appropriate SA towards given target (endpoint
42 * of tunnel or destination of transport mode) allowed by selector.
43 *
44 * Main use is finding SA after policy selected tunnel or transport mode.
45 * Also, it can be used by ah/esp icmp error handler to find offending SA.
46 */
47static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE];
48static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE];
49
50DECLARE_WAIT_QUEUE_HEAD(km_waitq);
51EXPORT_SYMBOL(km_waitq);
52
53static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
54static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
55
56static struct work_struct xfrm_state_gc_work;
57static struct list_head xfrm_state_gc_list = LIST_HEAD_INIT(xfrm_state_gc_list);
58static DEFINE_SPINLOCK(xfrm_state_gc_lock);
59
60static int xfrm_state_gc_flush_bundles;
61
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -080062int __xfrm_state_delete(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -070063
64static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family);
65static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
66
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -080067int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -080068void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
Linus Torvalds1da177e2005-04-16 15:20:36 -070069
70static void xfrm_state_gc_destroy(struct xfrm_state *x)
71{
72 if (del_timer(&x->timer))
73 BUG();
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -080074 if (del_timer(&x->rtimer))
75 BUG();
Jesper Juhla51482b2005-11-08 09:41:34 -080076 kfree(x->aalg);
77 kfree(x->ealg);
78 kfree(x->calg);
79 kfree(x->encap);
Linus Torvalds1da177e2005-04-16 15:20:36 -070080 if (x->type) {
81 x->type->destructor(x);
82 xfrm_put_type(x->type);
83 }
Trent Jaegerdf718372005-12-13 23:12:27 -080084 security_xfrm_state_free(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -070085 kfree(x);
86}
87
88static void xfrm_state_gc_task(void *data)
89{
90 struct xfrm_state *x;
91 struct list_head *entry, *tmp;
92 struct list_head gc_list = LIST_HEAD_INIT(gc_list);
93
94 if (xfrm_state_gc_flush_bundles) {
95 xfrm_state_gc_flush_bundles = 0;
96 xfrm_flush_bundles();
97 }
98
99 spin_lock_bh(&xfrm_state_gc_lock);
100 list_splice_init(&xfrm_state_gc_list, &gc_list);
101 spin_unlock_bh(&xfrm_state_gc_lock);
102
103 list_for_each_safe(entry, tmp, &gc_list) {
104 x = list_entry(entry, struct xfrm_state, bydst);
105 xfrm_state_gc_destroy(x);
106 }
107 wake_up(&km_waitq);
108}
109
110static inline unsigned long make_jiffies(long secs)
111{
112 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
113 return MAX_SCHEDULE_TIMEOUT-1;
114 else
115 return secs*HZ;
116}
117
118static void xfrm_timer_handler(unsigned long data)
119{
120 struct xfrm_state *x = (struct xfrm_state*)data;
121 unsigned long now = (unsigned long)xtime.tv_sec;
122 long next = LONG_MAX;
123 int warn = 0;
124
125 spin_lock(&x->lock);
126 if (x->km.state == XFRM_STATE_DEAD)
127 goto out;
128 if (x->km.state == XFRM_STATE_EXPIRED)
129 goto expired;
130 if (x->lft.hard_add_expires_seconds) {
131 long tmo = x->lft.hard_add_expires_seconds +
132 x->curlft.add_time - now;
133 if (tmo <= 0)
134 goto expired;
135 if (tmo < next)
136 next = tmo;
137 }
138 if (x->lft.hard_use_expires_seconds) {
139 long tmo = x->lft.hard_use_expires_seconds +
140 (x->curlft.use_time ? : now) - now;
141 if (tmo <= 0)
142 goto expired;
143 if (tmo < next)
144 next = tmo;
145 }
146 if (x->km.dying)
147 goto resched;
148 if (x->lft.soft_add_expires_seconds) {
149 long tmo = x->lft.soft_add_expires_seconds +
150 x->curlft.add_time - now;
151 if (tmo <= 0)
152 warn = 1;
153 else if (tmo < next)
154 next = tmo;
155 }
156 if (x->lft.soft_use_expires_seconds) {
157 long tmo = x->lft.soft_use_expires_seconds +
158 (x->curlft.use_time ? : now) - now;
159 if (tmo <= 0)
160 warn = 1;
161 else if (tmo < next)
162 next = tmo;
163 }
164
Herbert Xu4666faa2005-06-18 22:43:22 -0700165 x->km.dying = warn;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700166 if (warn)
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800167 km_state_expired(x, 0, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168resched:
169 if (next != LONG_MAX &&
170 !mod_timer(&x->timer, jiffies + make_jiffies(next)))
171 xfrm_state_hold(x);
172 goto out;
173
174expired:
175 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
176 x->km.state = XFRM_STATE_EXPIRED;
177 wake_up(&km_waitq);
178 next = 2;
179 goto resched;
180 }
Herbert Xu4666faa2005-06-18 22:43:22 -0700181 if (!__xfrm_state_delete(x) && x->id.spi)
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800182 km_state_expired(x, 1, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700183
184out:
185 spin_unlock(&x->lock);
186 xfrm_state_put(x);
187}
188
David S. Miller0ac84752006-03-20 19:18:23 -0800189static void xfrm_replay_timer_handler(unsigned long data);
190
Linus Torvalds1da177e2005-04-16 15:20:36 -0700191struct xfrm_state *xfrm_state_alloc(void)
192{
193 struct xfrm_state *x;
194
195 x = kmalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
196
197 if (x) {
198 memset(x, 0, sizeof(struct xfrm_state));
199 atomic_set(&x->refcnt, 1);
200 atomic_set(&x->tunnel_users, 0);
201 INIT_LIST_HEAD(&x->bydst);
202 INIT_LIST_HEAD(&x->byspi);
203 init_timer(&x->timer);
204 x->timer.function = xfrm_timer_handler;
205 x->timer.data = (unsigned long)x;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800206 init_timer(&x->rtimer);
207 x->rtimer.function = xfrm_replay_timer_handler;
208 x->rtimer.data = (unsigned long)x;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209 x->curlft.add_time = (unsigned long)xtime.tv_sec;
210 x->lft.soft_byte_limit = XFRM_INF;
211 x->lft.soft_packet_limit = XFRM_INF;
212 x->lft.hard_byte_limit = XFRM_INF;
213 x->lft.hard_packet_limit = XFRM_INF;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800214 x->replay_maxage = 0;
215 x->replay_maxdiff = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700216 spin_lock_init(&x->lock);
217 }
218 return x;
219}
220EXPORT_SYMBOL(xfrm_state_alloc);
221
222void __xfrm_state_destroy(struct xfrm_state *x)
223{
224 BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
225
226 spin_lock_bh(&xfrm_state_gc_lock);
227 list_add(&x->bydst, &xfrm_state_gc_list);
228 spin_unlock_bh(&xfrm_state_gc_lock);
229 schedule_work(&xfrm_state_gc_work);
230}
231EXPORT_SYMBOL(__xfrm_state_destroy);
232
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800233int __xfrm_state_delete(struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234{
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700235 int err = -ESRCH;
236
Linus Torvalds1da177e2005-04-16 15:20:36 -0700237 if (x->km.state != XFRM_STATE_DEAD) {
238 x->km.state = XFRM_STATE_DEAD;
239 spin_lock(&xfrm_state_lock);
240 list_del(&x->bydst);
Herbert Xu21380b82006-02-22 14:47:13 -0800241 __xfrm_state_put(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242 if (x->id.spi) {
243 list_del(&x->byspi);
Herbert Xu21380b82006-02-22 14:47:13 -0800244 __xfrm_state_put(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245 }
246 spin_unlock(&xfrm_state_lock);
247 if (del_timer(&x->timer))
Herbert Xu21380b82006-02-22 14:47:13 -0800248 __xfrm_state_put(x);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800249 if (del_timer(&x->rtimer))
250 __xfrm_state_put(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251
252 /* The number two in this test is the reference
253 * mentioned in the comment below plus the reference
254 * our caller holds. A larger value means that
255 * there are DSTs attached to this xfrm_state.
256 */
257 if (atomic_read(&x->refcnt) > 2) {
258 xfrm_state_gc_flush_bundles = 1;
259 schedule_work(&xfrm_state_gc_work);
260 }
261
262 /* All xfrm_state objects are created by xfrm_state_alloc.
263 * The xfrm_state_alloc call gives a reference, and that
264 * is what we are dropping here.
265 */
Herbert Xu21380b82006-02-22 14:47:13 -0800266 __xfrm_state_put(x);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700267 err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700268 }
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700269
270 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700271}
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800272EXPORT_SYMBOL(__xfrm_state_delete);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700273
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700274int xfrm_state_delete(struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275{
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700276 int err;
277
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278 spin_lock_bh(&x->lock);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700279 err = __xfrm_state_delete(x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700280 spin_unlock_bh(&x->lock);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700281
282 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700283}
284EXPORT_SYMBOL(xfrm_state_delete);
285
286void xfrm_state_flush(u8 proto)
287{
288 int i;
289 struct xfrm_state *x;
290
291 spin_lock_bh(&xfrm_state_lock);
292 for (i = 0; i < XFRM_DST_HSIZE; i++) {
293restart:
294 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
295 if (!xfrm_state_kern(x) &&
296 (proto == IPSEC_PROTO_ANY || x->id.proto == proto)) {
297 xfrm_state_hold(x);
298 spin_unlock_bh(&xfrm_state_lock);
299
300 xfrm_state_delete(x);
301 xfrm_state_put(x);
302
303 spin_lock_bh(&xfrm_state_lock);
304 goto restart;
305 }
306 }
307 }
308 spin_unlock_bh(&xfrm_state_lock);
309 wake_up(&km_waitq);
310}
311EXPORT_SYMBOL(xfrm_state_flush);
312
313static int
314xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
315 struct xfrm_tmpl *tmpl,
316 xfrm_address_t *daddr, xfrm_address_t *saddr,
317 unsigned short family)
318{
319 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
320 if (!afinfo)
321 return -1;
322 afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
323 xfrm_state_put_afinfo(afinfo);
324 return 0;
325}
326
327struct xfrm_state *
328xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
329 struct flowi *fl, struct xfrm_tmpl *tmpl,
330 struct xfrm_policy *pol, int *err,
331 unsigned short family)
332{
333 unsigned h = xfrm_dst_hash(daddr, family);
334 struct xfrm_state *x, *x0;
335 int acquire_in_progress = 0;
336 int error = 0;
337 struct xfrm_state *best = NULL;
338 struct xfrm_state_afinfo *afinfo;
339
340 afinfo = xfrm_state_get_afinfo(family);
341 if (afinfo == NULL) {
342 *err = -EAFNOSUPPORT;
343 return NULL;
344 }
345
346 spin_lock_bh(&xfrm_state_lock);
347 list_for_each_entry(x, xfrm_state_bydst+h, bydst) {
348 if (x->props.family == family &&
349 x->props.reqid == tmpl->reqid &&
350 xfrm_state_addr_check(x, daddr, saddr, family) &&
351 tmpl->mode == x->props.mode &&
352 tmpl->id.proto == x->id.proto &&
353 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
354 /* Resolution logic:
355 1. There is a valid state with matching selector.
356 Done.
357 2. Valid state with inappropriate selector. Skip.
358
359 Entering area of "sysdeps".
360
361 3. If state is not valid, selector is temporary,
362 it selects only session which triggered
363 previous resolution. Key manager will do
364 something to install a state with proper
365 selector.
366 */
367 if (x->km.state == XFRM_STATE_VALID) {
Trent Jaegerdf718372005-12-13 23:12:27 -0800368 if (!xfrm_selector_match(&x->sel, fl, family) ||
369 !xfrm_sec_ctx_match(pol->security, x->security))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 continue;
371 if (!best ||
372 best->km.dying > x->km.dying ||
373 (best->km.dying == x->km.dying &&
374 best->curlft.add_time < x->curlft.add_time))
375 best = x;
376 } else if (x->km.state == XFRM_STATE_ACQ) {
377 acquire_in_progress = 1;
378 } else if (x->km.state == XFRM_STATE_ERROR ||
379 x->km.state == XFRM_STATE_EXPIRED) {
Trent Jaegerdf718372005-12-13 23:12:27 -0800380 if (xfrm_selector_match(&x->sel, fl, family) &&
381 xfrm_sec_ctx_match(pol->security, x->security))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700382 error = -ESRCH;
383 }
384 }
385 }
386
387 x = best;
388 if (!x && !error && !acquire_in_progress) {
Patrick McHardy5c5d2812005-04-21 20:12:32 -0700389 if (tmpl->id.spi &&
390 (x0 = afinfo->state_lookup(daddr, tmpl->id.spi,
391 tmpl->id.proto)) != NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 xfrm_state_put(x0);
393 error = -EEXIST;
394 goto out;
395 }
396 x = xfrm_state_alloc();
397 if (x == NULL) {
398 error = -ENOMEM;
399 goto out;
400 }
401 /* Initialize temporary selector matching only
402 * to current session. */
403 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
404
405 if (km_query(x, tmpl, pol) == 0) {
406 x->km.state = XFRM_STATE_ACQ;
407 list_add_tail(&x->bydst, xfrm_state_bydst+h);
408 xfrm_state_hold(x);
409 if (x->id.spi) {
410 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
411 list_add(&x->byspi, xfrm_state_byspi+h);
412 xfrm_state_hold(x);
413 }
414 x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
415 xfrm_state_hold(x);
416 x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
417 add_timer(&x->timer);
418 } else {
419 x->km.state = XFRM_STATE_DEAD;
420 xfrm_state_put(x);
421 x = NULL;
422 error = -ESRCH;
423 }
424 }
425out:
426 if (x)
427 xfrm_state_hold(x);
428 else
429 *err = acquire_in_progress ? -EAGAIN : error;
430 spin_unlock_bh(&xfrm_state_lock);
431 xfrm_state_put_afinfo(afinfo);
432 return x;
433}
434
435static void __xfrm_state_insert(struct xfrm_state *x)
436{
437 unsigned h = xfrm_dst_hash(&x->id.daddr, x->props.family);
438
439 list_add(&x->bydst, xfrm_state_bydst+h);
440 xfrm_state_hold(x);
441
442 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
443
444 list_add(&x->byspi, xfrm_state_byspi+h);
445 xfrm_state_hold(x);
446
447 if (!mod_timer(&x->timer, jiffies + HZ))
448 xfrm_state_hold(x);
449
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800450 if (x->replay_maxage &&
451 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
452 xfrm_state_hold(x);
453
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454 wake_up(&km_waitq);
455}
456
457void xfrm_state_insert(struct xfrm_state *x)
458{
459 spin_lock_bh(&xfrm_state_lock);
460 __xfrm_state_insert(x);
461 spin_unlock_bh(&xfrm_state_lock);
David S. Miller399c1802005-12-19 14:23:23 -0800462
463 xfrm_flush_all_bundles();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700464}
465EXPORT_SYMBOL(xfrm_state_insert);
466
467static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
468
469int xfrm_state_add(struct xfrm_state *x)
470{
471 struct xfrm_state_afinfo *afinfo;
472 struct xfrm_state *x1;
473 int family;
474 int err;
475
476 family = x->props.family;
477 afinfo = xfrm_state_get_afinfo(family);
478 if (unlikely(afinfo == NULL))
479 return -EAFNOSUPPORT;
480
481 spin_lock_bh(&xfrm_state_lock);
482
483 x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
484 if (x1) {
485 xfrm_state_put(x1);
486 x1 = NULL;
487 err = -EEXIST;
488 goto out;
489 }
490
491 if (x->km.seq) {
492 x1 = __xfrm_find_acq_byseq(x->km.seq);
493 if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
494 xfrm_state_put(x1);
495 x1 = NULL;
496 }
497 }
498
499 if (!x1)
500 x1 = afinfo->find_acq(
501 x->props.mode, x->props.reqid, x->id.proto,
502 &x->id.daddr, &x->props.saddr, 0);
503
504 __xfrm_state_insert(x);
505 err = 0;
506
507out:
508 spin_unlock_bh(&xfrm_state_lock);
509 xfrm_state_put_afinfo(afinfo);
510
David S. Miller399c1802005-12-19 14:23:23 -0800511 if (!err)
512 xfrm_flush_all_bundles();
513
Linus Torvalds1da177e2005-04-16 15:20:36 -0700514 if (x1) {
515 xfrm_state_delete(x1);
516 xfrm_state_put(x1);
517 }
518
519 return err;
520}
521EXPORT_SYMBOL(xfrm_state_add);
522
523int xfrm_state_update(struct xfrm_state *x)
524{
525 struct xfrm_state_afinfo *afinfo;
526 struct xfrm_state *x1;
527 int err;
528
529 afinfo = xfrm_state_get_afinfo(x->props.family);
530 if (unlikely(afinfo == NULL))
531 return -EAFNOSUPPORT;
532
533 spin_lock_bh(&xfrm_state_lock);
534 x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
535
536 err = -ESRCH;
537 if (!x1)
538 goto out;
539
540 if (xfrm_state_kern(x1)) {
541 xfrm_state_put(x1);
542 err = -EEXIST;
543 goto out;
544 }
545
546 if (x1->km.state == XFRM_STATE_ACQ) {
547 __xfrm_state_insert(x);
548 x = NULL;
549 }
550 err = 0;
551
552out:
553 spin_unlock_bh(&xfrm_state_lock);
554 xfrm_state_put_afinfo(afinfo);
555
556 if (err)
557 return err;
558
559 if (!x) {
560 xfrm_state_delete(x1);
561 xfrm_state_put(x1);
562 return 0;
563 }
564
565 err = -EINVAL;
566 spin_lock_bh(&x1->lock);
567 if (likely(x1->km.state == XFRM_STATE_VALID)) {
568 if (x->encap && x1->encap)
569 memcpy(x1->encap, x->encap, sizeof(*x1->encap));
570 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
571 x1->km.dying = 0;
572
573 if (!mod_timer(&x1->timer, jiffies + HZ))
574 xfrm_state_hold(x1);
575 if (x1->curlft.use_time)
576 xfrm_state_check_expire(x1);
577
578 err = 0;
579 }
580 spin_unlock_bh(&x1->lock);
581
582 xfrm_state_put(x1);
583
584 return err;
585}
586EXPORT_SYMBOL(xfrm_state_update);
587
588int xfrm_state_check_expire(struct xfrm_state *x)
589{
590 if (!x->curlft.use_time)
591 x->curlft.use_time = (unsigned long)xtime.tv_sec;
592
593 if (x->km.state != XFRM_STATE_VALID)
594 return -EINVAL;
595
596 if (x->curlft.bytes >= x->lft.hard_byte_limit ||
597 x->curlft.packets >= x->lft.hard_packet_limit) {
Herbert Xu4666faa2005-06-18 22:43:22 -0700598 x->km.state = XFRM_STATE_EXPIRED;
599 if (!mod_timer(&x->timer, jiffies))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700600 xfrm_state_hold(x);
601 return -EINVAL;
602 }
603
604 if (!x->km.dying &&
605 (x->curlft.bytes >= x->lft.soft_byte_limit ||
Herbert Xu4666faa2005-06-18 22:43:22 -0700606 x->curlft.packets >= x->lft.soft_packet_limit)) {
607 x->km.dying = 1;
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800608 km_state_expired(x, 0, 0);
Herbert Xu4666faa2005-06-18 22:43:22 -0700609 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700610 return 0;
611}
612EXPORT_SYMBOL(xfrm_state_check_expire);
613
614static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
615{
616 int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
617 - skb_headroom(skb);
618
619 if (nhead > 0)
620 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
621
622 /* Check tail too... */
623 return 0;
624}
625
626int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
627{
628 int err = xfrm_state_check_expire(x);
629 if (err < 0)
630 goto err;
631 err = xfrm_state_check_space(x, skb);
632err:
633 return err;
634}
635EXPORT_SYMBOL(xfrm_state_check);
636
637struct xfrm_state *
638xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
639 unsigned short family)
640{
641 struct xfrm_state *x;
642 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
643 if (!afinfo)
644 return NULL;
645
646 spin_lock_bh(&xfrm_state_lock);
647 x = afinfo->state_lookup(daddr, spi, proto);
648 spin_unlock_bh(&xfrm_state_lock);
649 xfrm_state_put_afinfo(afinfo);
650 return x;
651}
652EXPORT_SYMBOL(xfrm_state_lookup);
653
654struct xfrm_state *
655xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
656 xfrm_address_t *daddr, xfrm_address_t *saddr,
657 int create, unsigned short family)
658{
659 struct xfrm_state *x;
660 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
661 if (!afinfo)
662 return NULL;
663
664 spin_lock_bh(&xfrm_state_lock);
665 x = afinfo->find_acq(mode, reqid, proto, daddr, saddr, create);
666 spin_unlock_bh(&xfrm_state_lock);
667 xfrm_state_put_afinfo(afinfo);
668 return x;
669}
670EXPORT_SYMBOL(xfrm_find_acq);
671
672/* Silly enough, but I'm lazy to build resolution list */
673
674static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
675{
676 int i;
677 struct xfrm_state *x;
678
679 for (i = 0; i < XFRM_DST_HSIZE; i++) {
680 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
681 if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
682 xfrm_state_hold(x);
683 return x;
684 }
685 }
686 }
687 return NULL;
688}
689
690struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
691{
692 struct xfrm_state *x;
693
694 spin_lock_bh(&xfrm_state_lock);
695 x = __xfrm_find_acq_byseq(seq);
696 spin_unlock_bh(&xfrm_state_lock);
697 return x;
698}
699EXPORT_SYMBOL(xfrm_find_acq_byseq);
700
701u32 xfrm_get_acqseq(void)
702{
703 u32 res;
704 static u32 acqseq;
705 static DEFINE_SPINLOCK(acqseq_lock);
706
707 spin_lock_bh(&acqseq_lock);
708 res = (++acqseq ? : ++acqseq);
709 spin_unlock_bh(&acqseq_lock);
710 return res;
711}
712EXPORT_SYMBOL(xfrm_get_acqseq);
713
714void
715xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
716{
717 u32 h;
718 struct xfrm_state *x0;
719
720 if (x->id.spi)
721 return;
722
723 if (minspi == maxspi) {
724 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
725 if (x0) {
726 xfrm_state_put(x0);
727 return;
728 }
729 x->id.spi = minspi;
730 } else {
731 u32 spi = 0;
732 minspi = ntohl(minspi);
733 maxspi = ntohl(maxspi);
734 for (h=0; h<maxspi-minspi+1; h++) {
735 spi = minspi + net_random()%(maxspi-minspi+1);
736 x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
737 if (x0 == NULL) {
738 x->id.spi = htonl(spi);
739 break;
740 }
741 xfrm_state_put(x0);
742 }
743 }
744 if (x->id.spi) {
745 spin_lock_bh(&xfrm_state_lock);
746 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
747 list_add(&x->byspi, xfrm_state_byspi+h);
748 xfrm_state_hold(x);
749 spin_unlock_bh(&xfrm_state_lock);
750 wake_up(&km_waitq);
751 }
752}
753EXPORT_SYMBOL(xfrm_alloc_spi);
754
755int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
756 void *data)
757{
758 int i;
759 struct xfrm_state *x;
760 int count = 0;
761 int err = 0;
762
763 spin_lock_bh(&xfrm_state_lock);
764 for (i = 0; i < XFRM_DST_HSIZE; i++) {
765 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
766 if (proto == IPSEC_PROTO_ANY || x->id.proto == proto)
767 count++;
768 }
769 }
770 if (count == 0) {
771 err = -ENOENT;
772 goto out;
773 }
774
775 for (i = 0; i < XFRM_DST_HSIZE; i++) {
776 list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
777 if (proto != IPSEC_PROTO_ANY && x->id.proto != proto)
778 continue;
779 err = func(x, --count, data);
780 if (err)
781 goto out;
782 }
783 }
784out:
785 spin_unlock_bh(&xfrm_state_lock);
786 return err;
787}
788EXPORT_SYMBOL(xfrm_state_walk);
789
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800790
791void xfrm_replay_notify(struct xfrm_state *x, int event)
792{
793 struct km_event c;
794 /* we send notify messages in case
795 * 1. we updated on of the sequence numbers, and the seqno difference
796 * is at least x->replay_maxdiff, in this case we also update the
797 * timeout of our timer function
798 * 2. if x->replay_maxage has elapsed since last update,
799 * and there were changes
800 *
801 * The state structure must be locked!
802 */
803
804 switch (event) {
805 case XFRM_REPLAY_UPDATE:
806 if (x->replay_maxdiff &&
807 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700808 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
809 if (x->xflags & XFRM_TIME_DEFER)
810 event = XFRM_REPLAY_TIMEOUT;
811 else
812 return;
813 }
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800814
815 break;
816
817 case XFRM_REPLAY_TIMEOUT:
818 if ((x->replay.seq == x->preplay.seq) &&
819 (x->replay.bitmap == x->preplay.bitmap) &&
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700820 (x->replay.oseq == x->preplay.oseq)) {
821 x->xflags |= XFRM_TIME_DEFER;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800822 return;
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700823 }
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800824
825 break;
826 }
827
828 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
829 c.event = XFRM_MSG_NEWAE;
830 c.data.aevent = event;
831 km_state_notify(x, &c);
832
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800833 if (x->replay_maxage &&
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700834 !mod_timer(&x->rtimer, jiffies + x->replay_maxage)) {
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800835 xfrm_state_hold(x);
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700836 x->xflags &= ~XFRM_TIME_DEFER;
837 }
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800838}
David S. Millera70fcb02006-03-20 19:18:52 -0800839EXPORT_SYMBOL(xfrm_replay_notify);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800840
841static void xfrm_replay_timer_handler(unsigned long data)
842{
843 struct xfrm_state *x = (struct xfrm_state*)data;
844
845 spin_lock(&x->lock);
846
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700847 if (x->km.state == XFRM_STATE_VALID) {
848 if (xfrm_aevent_is_on())
849 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
850 else
851 x->xflags |= XFRM_TIME_DEFER;
852 }
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800853
854 spin_unlock(&x->lock);
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700855 xfrm_state_put(x);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800856}
857
Linus Torvalds1da177e2005-04-16 15:20:36 -0700858int xfrm_replay_check(struct xfrm_state *x, u32 seq)
859{
860 u32 diff;
861
862 seq = ntohl(seq);
863
864 if (unlikely(seq == 0))
865 return -EINVAL;
866
867 if (likely(seq > x->replay.seq))
868 return 0;
869
870 diff = x->replay.seq - seq;
871 if (diff >= x->props.replay_window) {
872 x->stats.replay_window++;
873 return -EINVAL;
874 }
875
876 if (x->replay.bitmap & (1U << diff)) {
877 x->stats.replay++;
878 return -EINVAL;
879 }
880 return 0;
881}
882EXPORT_SYMBOL(xfrm_replay_check);
883
884void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
885{
886 u32 diff;
887
888 seq = ntohl(seq);
889
890 if (seq > x->replay.seq) {
891 diff = seq - x->replay.seq;
892 if (diff < x->props.replay_window)
893 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
894 else
895 x->replay.bitmap = 1;
896 x->replay.seq = seq;
897 } else {
898 diff = x->replay.seq - seq;
899 x->replay.bitmap |= (1U << diff);
900 }
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800901
902 if (xfrm_aevent_is_on())
903 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700904}
905EXPORT_SYMBOL(xfrm_replay_advance);
906
907static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
908static DEFINE_RWLOCK(xfrm_km_lock);
909
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700910void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700911{
912 struct xfrm_mgr *km;
913
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700914 read_lock(&xfrm_km_lock);
915 list_for_each_entry(km, &xfrm_km_list, list)
916 if (km->notify_policy)
917 km->notify_policy(xp, dir, c);
918 read_unlock(&xfrm_km_lock);
919}
920
921void km_state_notify(struct xfrm_state *x, struct km_event *c)
922{
923 struct xfrm_mgr *km;
924 read_lock(&xfrm_km_lock);
925 list_for_each_entry(km, &xfrm_km_list, list)
926 if (km->notify)
927 km->notify(x, c);
928 read_unlock(&xfrm_km_lock);
929}
930
931EXPORT_SYMBOL(km_policy_notify);
932EXPORT_SYMBOL(km_state_notify);
933
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800934void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700935{
936 struct km_event c;
937
Herbert Xubf088672005-06-18 22:44:00 -0700938 c.data.hard = hard;
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800939 c.pid = pid;
Herbert Xuf60f6b82005-06-18 22:44:37 -0700940 c.event = XFRM_MSG_EXPIRE;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700941 km_state_notify(x, &c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700942
943 if (hard)
944 wake_up(&km_waitq);
945}
946
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800947EXPORT_SYMBOL(km_state_expired);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700948/*
949 * We send to all registered managers regardless of failure
950 * We are happy with one success
951*/
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800952int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700953{
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700954 int err = -EINVAL, acqret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700955 struct xfrm_mgr *km;
956
957 read_lock(&xfrm_km_lock);
958 list_for_each_entry(km, &xfrm_km_list, list) {
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700959 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
960 if (!acqret)
961 err = acqret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700962 }
963 read_unlock(&xfrm_km_lock);
964 return err;
965}
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800966EXPORT_SYMBOL(km_query);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700967
968int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport)
969{
970 int err = -EINVAL;
971 struct xfrm_mgr *km;
972
973 read_lock(&xfrm_km_lock);
974 list_for_each_entry(km, &xfrm_km_list, list) {
975 if (km->new_mapping)
976 err = km->new_mapping(x, ipaddr, sport);
977 if (!err)
978 break;
979 }
980 read_unlock(&xfrm_km_lock);
981 return err;
982}
983EXPORT_SYMBOL(km_new_mapping);
984
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -0800985void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700986{
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700987 struct km_event c;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700988
Herbert Xubf088672005-06-18 22:44:00 -0700989 c.data.hard = hard;
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -0800990 c.pid = pid;
Herbert Xuf60f6b82005-06-18 22:44:37 -0700991 c.event = XFRM_MSG_POLEXPIRE;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700992 km_policy_notify(pol, dir, &c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700993
994 if (hard)
995 wake_up(&km_waitq);
996}
David S. Millera70fcb02006-03-20 19:18:52 -0800997EXPORT_SYMBOL(km_policy_expired);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700998
999int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1000{
1001 int err;
1002 u8 *data;
1003 struct xfrm_mgr *km;
1004 struct xfrm_policy *pol = NULL;
1005
1006 if (optlen <= 0 || optlen > PAGE_SIZE)
1007 return -EMSGSIZE;
1008
1009 data = kmalloc(optlen, GFP_KERNEL);
1010 if (!data)
1011 return -ENOMEM;
1012
1013 err = -EFAULT;
1014 if (copy_from_user(data, optval, optlen))
1015 goto out;
1016
1017 err = -EINVAL;
1018 read_lock(&xfrm_km_lock);
1019 list_for_each_entry(km, &xfrm_km_list, list) {
1020 pol = km->compile_policy(sk->sk_family, optname, data,
1021 optlen, &err);
1022 if (err >= 0)
1023 break;
1024 }
1025 read_unlock(&xfrm_km_lock);
1026
1027 if (err >= 0) {
1028 xfrm_sk_policy_insert(sk, err, pol);
1029 xfrm_pol_put(pol);
1030 err = 0;
1031 }
1032
1033out:
1034 kfree(data);
1035 return err;
1036}
1037EXPORT_SYMBOL(xfrm_user_policy);
1038
1039int xfrm_register_km(struct xfrm_mgr *km)
1040{
1041 write_lock_bh(&xfrm_km_lock);
1042 list_add_tail(&km->list, &xfrm_km_list);
1043 write_unlock_bh(&xfrm_km_lock);
1044 return 0;
1045}
1046EXPORT_SYMBOL(xfrm_register_km);
1047
1048int xfrm_unregister_km(struct xfrm_mgr *km)
1049{
1050 write_lock_bh(&xfrm_km_lock);
1051 list_del(&km->list);
1052 write_unlock_bh(&xfrm_km_lock);
1053 return 0;
1054}
1055EXPORT_SYMBOL(xfrm_unregister_km);
1056
1057int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1058{
1059 int err = 0;
1060 if (unlikely(afinfo == NULL))
1061 return -EINVAL;
1062 if (unlikely(afinfo->family >= NPROTO))
1063 return -EAFNOSUPPORT;
Ingo Molnarf3111502006-04-28 15:30:03 -07001064 write_lock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001065 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1066 err = -ENOBUFS;
1067 else {
1068 afinfo->state_bydst = xfrm_state_bydst;
1069 afinfo->state_byspi = xfrm_state_byspi;
1070 xfrm_state_afinfo[afinfo->family] = afinfo;
1071 }
Ingo Molnarf3111502006-04-28 15:30:03 -07001072 write_unlock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001073 return err;
1074}
1075EXPORT_SYMBOL(xfrm_state_register_afinfo);
1076
1077int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1078{
1079 int err = 0;
1080 if (unlikely(afinfo == NULL))
1081 return -EINVAL;
1082 if (unlikely(afinfo->family >= NPROTO))
1083 return -EAFNOSUPPORT;
Ingo Molnarf3111502006-04-28 15:30:03 -07001084 write_lock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001085 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1086 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1087 err = -EINVAL;
1088 else {
1089 xfrm_state_afinfo[afinfo->family] = NULL;
1090 afinfo->state_byspi = NULL;
1091 afinfo->state_bydst = NULL;
1092 }
1093 }
Ingo Molnarf3111502006-04-28 15:30:03 -07001094 write_unlock_bh(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001095 return err;
1096}
1097EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1098
1099static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
1100{
1101 struct xfrm_state_afinfo *afinfo;
1102 if (unlikely(family >= NPROTO))
1103 return NULL;
1104 read_lock(&xfrm_state_afinfo_lock);
1105 afinfo = xfrm_state_afinfo[family];
Herbert Xu546be242006-05-27 23:03:58 -07001106 if (unlikely(!afinfo))
1107 read_unlock(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001108 return afinfo;
1109}
1110
1111static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1112{
Herbert Xu546be242006-05-27 23:03:58 -07001113 read_unlock(&xfrm_state_afinfo_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001114}
1115
1116/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1117void xfrm_state_delete_tunnel(struct xfrm_state *x)
1118{
1119 if (x->tunnel) {
1120 struct xfrm_state *t = x->tunnel;
1121
1122 if (atomic_read(&t->tunnel_users) == 2)
1123 xfrm_state_delete(t);
1124 atomic_dec(&t->tunnel_users);
1125 xfrm_state_put(t);
1126 x->tunnel = NULL;
1127 }
1128}
1129EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1130
Herbert Xu80b30c12005-10-15 10:58:30 +10001131/*
1132 * This function is NOT optimal. For example, with ESP it will give an
1133 * MTU that's usually two bytes short of being optimal. However, it will
1134 * usually give an answer that's a multiple of 4 provided the input is
1135 * also a multiple of 4.
1136 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001137int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1138{
1139 int res = mtu;
1140
1141 res -= x->props.header_len;
1142
1143 for (;;) {
1144 int m = res;
1145
1146 if (m < 68)
1147 return 68;
1148
1149 spin_lock_bh(&x->lock);
1150 if (x->km.state == XFRM_STATE_VALID &&
1151 x->type && x->type->get_max_size)
1152 m = x->type->get_max_size(x, m);
1153 else
1154 m += x->props.header_len;
1155 spin_unlock_bh(&x->lock);
1156
1157 if (m <= mtu)
1158 break;
1159 res -= (m - mtu);
1160 }
1161
1162 return res;
1163}
1164
1165EXPORT_SYMBOL(xfrm_state_mtu);
Herbert Xu72cb6962005-06-20 13:18:08 -07001166
1167int xfrm_init_state(struct xfrm_state *x)
1168{
Herbert Xud094cd82005-06-20 13:19:41 -07001169 struct xfrm_state_afinfo *afinfo;
1170 int family = x->props.family;
Herbert Xu72cb6962005-06-20 13:18:08 -07001171 int err;
1172
Herbert Xud094cd82005-06-20 13:19:41 -07001173 err = -EAFNOSUPPORT;
1174 afinfo = xfrm_state_get_afinfo(family);
1175 if (!afinfo)
1176 goto error;
1177
1178 err = 0;
1179 if (afinfo->init_flags)
1180 err = afinfo->init_flags(x);
1181
1182 xfrm_state_put_afinfo(afinfo);
1183
1184 if (err)
1185 goto error;
1186
1187 err = -EPROTONOSUPPORT;
1188 x->type = xfrm_get_type(x->id.proto, family);
Herbert Xu72cb6962005-06-20 13:18:08 -07001189 if (x->type == NULL)
1190 goto error;
1191
1192 err = x->type->init_state(x);
1193 if (err)
1194 goto error;
1195
1196 x->km.state = XFRM_STATE_VALID;
1197
1198error:
1199 return err;
1200}
1201
1202EXPORT_SYMBOL(xfrm_init_state);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001203
1204void __init xfrm_state_init(void)
1205{
1206 int i;
1207
1208 for (i=0; i<XFRM_DST_HSIZE; i++) {
1209 INIT_LIST_HEAD(&xfrm_state_bydst[i]);
1210 INIT_LIST_HEAD(&xfrm_state_byspi[i]);
1211 }
1212 INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task, NULL);
1213}
1214