projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[XFRM]: State selection update to use inner addresses.
[deliverable/linux.git] / net / xfrm / xfrm_state.c
CommitLineData
1da177e4
LT		 1/*
2 * xfrm_state.c
3 *
4 * Changes:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
df71837d 13 *
1da177e4
LT		 14 */
15
16#include <linux/workqueue.h>
17#include <net/xfrm.h>
18#include <linux/pfkeyv2.h>
19#include <linux/ipsec.h>
20#include <linux/module.h>
f034b5d4 21#include <linux/cache.h>
1da177e4 22#include <asm/uaccess.h>
161a09e7 23#include <linux/audit.h>
01e67d08 24#include <linux/cache.h>
1da177e4 25
44e36b42
DM		 26#include "xfrm_hash.h"
27
ee857a7d
DM		 28struct sock *xfrm_nl;
29EXPORT_SYMBOL(xfrm_nl);
30
01e67d08 31u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
a70fcb0b
DM		 32EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
33
01e67d08 34u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
a70fcb0b
DM		 35EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
36
01e67d08
DM		 37u32 sysctl_xfrm_acq_expires __read_mostly = 30;
38
1da177e4
LT		 39/* Each xfrm_state may be linked to two tables:
40
41 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
a624c108 42 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
1da177e4
LT		 43 destination/tunnel endpoint. (output)
44 */
45
46static DEFINE_SPINLOCK(xfrm_state_lock);
47
48/* Hash table to find appropriate SA towards given target (endpoint
49 * of tunnel or destination of transport mode) allowed by selector.
50 *
51 * Main use is finding SA after policy selected tunnel or transport mode.
52 * Also, it can be used by ah/esp icmp error handler to find offending SA.
53 */
f034b5d4
DM		 54static struct hlist_head *xfrm_state_bydst __read_mostly;
55static struct hlist_head *xfrm_state_bysrc __read_mostly;
56static struct hlist_head *xfrm_state_byspi __read_mostly;
57static unsigned int xfrm_state_hmask __read_mostly;
58static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
59static unsigned int xfrm_state_num;
9d4a706d 60static unsigned int xfrm_state_genid;
f034b5d4 61
c1969f29
DM		 62static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
63 xfrm_address_t *saddr,
64 u32 reqid,
a624c108 65 unsigned short family)
f034b5d4 66{
c1969f29 67 return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
f034b5d4
DM		 68}
69
667bbcb6
MN		 70static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
71 xfrm_address_t *saddr,
44e36b42 72 unsigned short family)
f034b5d4 73{
667bbcb6 74 return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
f034b5d4
DM		 75}
76
f034b5d4 77static inline unsigned int
8122adf0 78xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
f034b5d4 79{
c1969f29 80 return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
f034b5d4
DM		 81}
82
f034b5d4
DM		 83static void xfrm_hash_transfer(struct hlist_head *list,
84 struct hlist_head *ndsttable,
85 struct hlist_head *nsrctable,
86 struct hlist_head *nspitable,
87 unsigned int nhashmask)
88{
89 struct hlist_node *entry, *tmp;
90 struct xfrm_state *x;
91
92 hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
93 unsigned int h;
94
c1969f29
DM		 95 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
96 x->props.reqid, x->props.family,
97 nhashmask);
f034b5d4
DM		 98 hlist_add_head(&x->bydst, ndsttable+h);
99
667bbcb6
MN		 100 h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
101 x->props.family,
f034b5d4
DM		 102 nhashmask);
103 hlist_add_head(&x->bysrc, nsrctable+h);
104
7b4dc360
MN		 105 if (x->id.spi) {
106 h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
107 x->id.proto, x->props.family,
108 nhashmask);
109 hlist_add_head(&x->byspi, nspitable+h);
110 }
f034b5d4
DM		 111 }
112}
113
114static unsigned long xfrm_hash_new_size(void)
115{
116 return ((xfrm_state_hmask + 1) << 1) *
117 sizeof(struct hlist_head);
118}
119
120static DEFINE_MUTEX(hash_resize_mutex);
121
c4028958 122static void xfrm_hash_resize(struct work_struct *__unused)
f034b5d4
DM		 123{
124 struct hlist_head *ndst, *nsrc, *nspi, *odst, *osrc, *ospi;
125 unsigned long nsize, osize;
126 unsigned int nhashmask, ohashmask;
127 int i;
128
129 mutex_lock(&hash_resize_mutex);
130
131 nsize = xfrm_hash_new_size();
44e36b42 132 ndst = xfrm_hash_alloc(nsize);
f034b5d4
DM		 133 if (!ndst)
134 goto out_unlock;
44e36b42 135 nsrc = xfrm_hash_alloc(nsize);
f034b5d4 136 if (!nsrc) {
44e36b42 137 xfrm_hash_free(ndst, nsize);
f034b5d4
DM		 138 goto out_unlock;
139 }
44e36b42 140 nspi = xfrm_hash_alloc(nsize);
f034b5d4 141 if (!nspi) {
44e36b42
DM		 142 xfrm_hash_free(ndst, nsize);
143 xfrm_hash_free(nsrc, nsize);
f034b5d4
DM		 144 goto out_unlock;
145 }
146
147 spin_lock_bh(&xfrm_state_lock);
148
149 nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
150 for (i = xfrm_state_hmask; i >= 0; i--)
151 xfrm_hash_transfer(xfrm_state_bydst+i, ndst, nsrc, nspi,
152 nhashmask);
153
154 odst = xfrm_state_bydst;
155 osrc = xfrm_state_bysrc;
156 ospi = xfrm_state_byspi;
157 ohashmask = xfrm_state_hmask;
158
159 xfrm_state_bydst = ndst;
160 xfrm_state_bysrc = nsrc;
161 xfrm_state_byspi = nspi;
162 xfrm_state_hmask = nhashmask;
163
164 spin_unlock_bh(&xfrm_state_lock);
165
166 osize = (ohashmask + 1) * sizeof(struct hlist_head);
44e36b42
DM		 167 xfrm_hash_free(odst, osize);
168 xfrm_hash_free(osrc, osize);
169 xfrm_hash_free(ospi, osize);
f034b5d4
DM		 170
171out_unlock:
172 mutex_unlock(&hash_resize_mutex);
173}
174
c4028958 175static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
f034b5d4 176
1da177e4
LT		 177DECLARE_WAIT_QUEUE_HEAD(km_waitq);
178EXPORT_SYMBOL(km_waitq);
179
180static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
181static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
182
183static struct work_struct xfrm_state_gc_work;
8f126e37 184static HLIST_HEAD(xfrm_state_gc_list);
1da177e4
LT		 185static DEFINE_SPINLOCK(xfrm_state_gc_lock);
186
53bc6b4d 187int __xfrm_state_delete(struct xfrm_state *x);
1da177e4 188
980ebd25 189int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
53bc6b4d 190void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
1da177e4
LT		 191
192static void xfrm_state_gc_destroy(struct xfrm_state *x)
193{
a47f0ce0
DM		 194 del_timer_sync(&x->timer);
195 del_timer_sync(&x->rtimer);
a51482bd
JJ		 196 kfree(x->aalg);
197 kfree(x->ealg);
198 kfree(x->calg);
199 kfree(x->encap);
060f02a3 200 kfree(x->coaddr);
b59f45d0
HX		 201 if (x->mode)
202 xfrm_put_mode(x->mode);
1da177e4
LT		 203 if (x->type) {
204 x->type->destructor(x);
205 xfrm_put_type(x->type);
206 }
df71837d 207 security_xfrm_state_free(x);
1da177e4
LT		 208 kfree(x);
209}
210
c4028958 211static void xfrm_state_gc_task(struct work_struct *data)
1da177e4
LT		 212{
213 struct xfrm_state *x;
8f126e37
DM		 214 struct hlist_node *entry, *tmp;
215 struct hlist_head gc_list;
1da177e4 216
1da177e4 217 spin_lock_bh(&xfrm_state_gc_lock);
8f126e37
DM		 218 gc_list.first = xfrm_state_gc_list.first;
219 INIT_HLIST_HEAD(&xfrm_state_gc_list);
1da177e4
LT		 220 spin_unlock_bh(&xfrm_state_gc_lock);
221
8f126e37 222 hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
1da177e4 223 xfrm_state_gc_destroy(x);
8f126e37 224
1da177e4
LT		 225 wake_up(&km_waitq);
226}
227
228static inline unsigned long make_jiffies(long secs)
229{
230 if (secs >= (MAX_SCHEDULE_TIMEOUT-1)/HZ)
231 return MAX_SCHEDULE_TIMEOUT-1;
232 else
a716c119 233 return secs*HZ;
1da177e4
LT		 234}
235
236static void xfrm_timer_handler(unsigned long data)
237{
238 struct xfrm_state *x = (struct xfrm_state*)data;
9d729f72 239 unsigned long now = get_seconds();
1da177e4
LT		 240 long next = LONG_MAX;
241 int warn = 0;
161a09e7 242 int err = 0;
1da177e4
LT		 243
244 spin_lock(&x->lock);
245 if (x->km.state == XFRM_STATE_DEAD)
246 goto out;
247 if (x->km.state == XFRM_STATE_EXPIRED)
248 goto expired;
249 if (x->lft.hard_add_expires_seconds) {
250 long tmo = x->lft.hard_add_expires_seconds +
251 x->curlft.add_time - now;
252 if (tmo <= 0)
253 goto expired;
254 if (tmo < next)
255 next = tmo;
256 }
257 if (x->lft.hard_use_expires_seconds) {
258 long tmo = x->lft.hard_use_expires_seconds +
259 (x->curlft.use_time ? : now) - now;
260 if (tmo <= 0)
261 goto expired;
262 if (tmo < next)
263 next = tmo;
264 }
265 if (x->km.dying)
266 goto resched;
267 if (x->lft.soft_add_expires_seconds) {
268 long tmo = x->lft.soft_add_expires_seconds +
269 x->curlft.add_time - now;
270 if (tmo <= 0)
271 warn = 1;
272 else if (tmo < next)
273 next = tmo;
274 }
275 if (x->lft.soft_use_expires_seconds) {
276 long tmo = x->lft.soft_use_expires_seconds +
277 (x->curlft.use_time ? : now) - now;
278 if (tmo <= 0)
279 warn = 1;
280 else if (tmo < next)
281 next = tmo;
282 }
283
4666faab 284 x->km.dying = warn;
1da177e4 285 if (warn)
53bc6b4d 286 km_state_expired(x, 0, 0);
1da177e4 287resched:
a47f0ce0
DM		 288 if (next != LONG_MAX)
289 mod_timer(&x->timer, jiffies + make_jiffies(next));
290
1da177e4
LT		 291 goto out;
292
293expired:
294 if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
295 x->km.state = XFRM_STATE_EXPIRED;
296 wake_up(&km_waitq);
297 next = 2;
298 goto resched;
299 }
161a09e7
JL		 300
301 err = __xfrm_state_delete(x);
302 if (!err && x->id.spi)
53bc6b4d 303 km_state_expired(x, 1, 0);
1da177e4 304
161a09e7
JL		 305 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
306 AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
307
1da177e4
LT		 308out:
309 spin_unlock(&x->lock);
1da177e4
LT		 310}
311
0ac84752
DM		 312static void xfrm_replay_timer_handler(unsigned long data);
313
1da177e4
LT		 314struct xfrm_state *xfrm_state_alloc(void)
315{
316 struct xfrm_state *x;
317
0da974f4 318 x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
1da177e4
LT		 319
320 if (x) {
1da177e4
LT		 321 atomic_set(&x->refcnt, 1);
322 atomic_set(&x->tunnel_users, 0);
8f126e37
DM		 323 INIT_HLIST_NODE(&x->bydst);
324 INIT_HLIST_NODE(&x->bysrc);
325 INIT_HLIST_NODE(&x->byspi);
1da177e4
LT		 326 init_timer(&x->timer);
327 x->timer.function = xfrm_timer_handler;
328 x->timer.data = (unsigned long)x;
f8cd5488
JHS		 329 init_timer(&x->rtimer);
330 x->rtimer.function = xfrm_replay_timer_handler;
331 x->rtimer.data = (unsigned long)x;
9d729f72 332 x->curlft.add_time = get_seconds();
1da177e4
LT		 333 x->lft.soft_byte_limit = XFRM_INF;
334 x->lft.soft_packet_limit = XFRM_INF;
335 x->lft.hard_byte_limit = XFRM_INF;
336 x->lft.hard_packet_limit = XFRM_INF;
f8cd5488
JHS		 337 x->replay_maxage = 0;
338 x->replay_maxdiff = 0;
1da177e4
LT		 339 spin_lock_init(&x->lock);
340 }
341 return x;
342}
343EXPORT_SYMBOL(xfrm_state_alloc);
344
345void __xfrm_state_destroy(struct xfrm_state *x)
346{
347 BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
348
349 spin_lock_bh(&xfrm_state_gc_lock);
8f126e37 350 hlist_add_head(&x->bydst, &xfrm_state_gc_list);
1da177e4
LT		 351 spin_unlock_bh(&xfrm_state_gc_lock);
352 schedule_work(&xfrm_state_gc_work);
353}
354EXPORT_SYMBOL(__xfrm_state_destroy);
355
53bc6b4d 356int __xfrm_state_delete(struct xfrm_state *x)
1da177e4 357{
26b15dad
JHS		 358 int err = -ESRCH;
359
1da177e4
LT		 360 if (x->km.state != XFRM_STATE_DEAD) {
361 x->km.state = XFRM_STATE_DEAD;
362 spin_lock(&xfrm_state_lock);
8f126e37 363 hlist_del(&x->bydst);
8f126e37 364 hlist_del(&x->bysrc);
a47f0ce0 365 if (x->id.spi)
8f126e37 366 hlist_del(&x->byspi);
f034b5d4 367 xfrm_state_num--;
1da177e4 368 spin_unlock(&xfrm_state_lock);
1da177e4 369
1da177e4
LT		 370 /* All xfrm_state objects are created by xfrm_state_alloc.
371 * The xfrm_state_alloc call gives a reference, and that
372 * is what we are dropping here.
373 */
21380b81 374 __xfrm_state_put(x);
26b15dad 375 err = 0;
1da177e4 376 }
26b15dad
JHS		 377
378 return err;
1da177e4 379}
53bc6b4d 380EXPORT_SYMBOL(__xfrm_state_delete);
1da177e4 381
26b15dad 382int xfrm_state_delete(struct xfrm_state *x)
1da177e4 383{
26b15dad
JHS		 384 int err;
385
1da177e4 386 spin_lock_bh(&x->lock);
26b15dad 387 err = __xfrm_state_delete(x);
1da177e4 388 spin_unlock_bh(&x->lock);
26b15dad
JHS		 389
390 return err;
1da177e4
LT		 391}
392EXPORT_SYMBOL(xfrm_state_delete);
393
4aa2e62c
JL		 394#ifdef CONFIG_SECURITY_NETWORK_XFRM
395static inline int
396xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
1da177e4 397{
4aa2e62c
JL		 398 int i, err = 0;
399
400 for (i = 0; i <= xfrm_state_hmask; i++) {
401 struct hlist_node *entry;
402 struct xfrm_state *x;
403
404 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
405 if (xfrm_id_proto_match(x->id.proto, proto) &&
406 (err = security_xfrm_state_delete(x)) != 0) {
407 xfrm_audit_log(audit_info->loginuid,
408 audit_info->secid,
409 AUDIT_MAC_IPSEC_DELSA,
7dc12d6d 410 0, NULL, x);
4aa2e62c
JL		 411
412 return err;
413 }
414 }
415 }
416
417 return err;
418}
419#else
420static inline int
421xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
422{
423 return 0;
424}
425#endif
426
427int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
428{
429 int i, err = 0;
1da177e4
LT		 430
431 spin_lock_bh(&xfrm_state_lock);
4aa2e62c
JL		 432 err = xfrm_state_flush_secctx_check(proto, audit_info);
433 if (err)
434 goto out;
435
a9917c06 436 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37
DM		 437 struct hlist_node *entry;
438 struct xfrm_state *x;
1da177e4 439restart:
8f126e37 440 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1da177e4 441 if (!xfrm_state_kern(x) &&
5794708f 442 xfrm_id_proto_match(x->id.proto, proto)) {
1da177e4
LT		 443 xfrm_state_hold(x);
444 spin_unlock_bh(&xfrm_state_lock);
445
161a09e7
JL		 446 err = xfrm_state_delete(x);
447 xfrm_audit_log(audit_info->loginuid,
448 audit_info->secid,
449 AUDIT_MAC_IPSEC_DELSA,
450 err ? 0 : 1, NULL, x);
1da177e4
LT		 451 xfrm_state_put(x);
452
453 spin_lock_bh(&xfrm_state_lock);
454 goto restart;
455 }
456 }
457 }
4aa2e62c
JL		 458 err = 0;
459
460out:
1da177e4
LT		 461 spin_unlock_bh(&xfrm_state_lock);
462 wake_up(&km_waitq);
4aa2e62c 463 return err;
1da177e4
LT		 464}
465EXPORT_SYMBOL(xfrm_state_flush);
466
af11e316 467void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
28d8909b
JHS		 468{
469 spin_lock_bh(&xfrm_state_lock);
470 si->sadcnt = xfrm_state_num;
471 si->sadhcnt = xfrm_state_hmask;
472 si->sadhmcnt = xfrm_state_hashmax;
473 spin_unlock_bh(&xfrm_state_lock);
474}
475EXPORT_SYMBOL(xfrm_sad_getinfo);
476
1da177e4
LT		 477static int
478xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
479 struct xfrm_tmpl *tmpl,
480 xfrm_address_t *daddr, xfrm_address_t *saddr,
481 unsigned short family)
482{
483 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
484 if (!afinfo)
485 return -1;
486 afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
487 xfrm_state_put_afinfo(afinfo);
488 return 0;
489}
490
a94cfd19 491static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
edcd5821
DM		 492{
493 unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
494 struct xfrm_state *x;
8f126e37 495 struct hlist_node *entry;
edcd5821 496
8f126e37 497 hlist_for_each_entry(x, entry, xfrm_state_byspi+h, byspi) {
edcd5821
DM		 498 if (x->props.family != family ||
499 x->id.spi != spi ||
500 x->id.proto != proto)
501 continue;
502
503 switch (family) {
504 case AF_INET:
505 if (x->id.daddr.a4 != daddr->a4)
506 continue;
507 break;
508 case AF_INET6:
509 if (!ipv6_addr_equal((struct in6_addr *)daddr,
510 (struct in6_addr *)
511 x->id.daddr.a6))
512 continue;
513 break;
3ff50b79 514 }
edcd5821
DM		 515
516 xfrm_state_hold(x);
517 return x;
518 }
519
520 return NULL;
521}
522
523static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
524{
667bbcb6 525 unsigned int h = xfrm_src_hash(daddr, saddr, family);
edcd5821 526 struct xfrm_state *x;
8f126e37 527 struct hlist_node *entry;
edcd5821 528
8f126e37 529 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
edcd5821
DM		 530 if (x->props.family != family ||
531 x->id.proto != proto)
532 continue;
533
534 switch (family) {
535 case AF_INET:
536 if (x->id.daddr.a4 != daddr->a4 ||
537 x->props.saddr.a4 != saddr->a4)
538 continue;
539 break;
540 case AF_INET6:
541 if (!ipv6_addr_equal((struct in6_addr *)daddr,
542 (struct in6_addr *)
543 x->id.daddr.a6) ||
544 !ipv6_addr_equal((struct in6_addr *)saddr,
545 (struct in6_addr *)
546 x->props.saddr.a6))
547 continue;
548 break;
3ff50b79 549 }
edcd5821
DM		 550
551 xfrm_state_hold(x);
552 return x;
553 }
554
555 return NULL;
556}
557
558static inline struct xfrm_state *
559__xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
560{
561 if (use_spi)
562 return __xfrm_state_lookup(&x->id.daddr, x->id.spi,
563 x->id.proto, family);
564 else
565 return __xfrm_state_lookup_byaddr(&x->id.daddr,
566 &x->props.saddr,
567 x->id.proto, family);
568}
569
2fab22f2
PM		 570static void xfrm_hash_grow_check(int have_hash_collision)
571{
572 if (have_hash_collision &&
573 (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
574 xfrm_state_num > xfrm_state_hmask)
575 schedule_work(&xfrm_hash_work);
576}
577
1da177e4 578struct xfrm_state *
a716c119 579xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1da177e4
LT		 580 struct flowi *fl, struct xfrm_tmpl *tmpl,
581 struct xfrm_policy *pol, int *err,
582 unsigned short family)
583{
c1969f29 584 unsigned int h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
8f126e37 585 struct hlist_node *entry;
1da177e4
LT		 586 struct xfrm_state *x, *x0;
587 int acquire_in_progress = 0;
588 int error = 0;
589 struct xfrm_state *best = NULL;
a716c119 590
1da177e4 591 spin_lock_bh(&xfrm_state_lock);
8f126e37 592 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1da177e4
LT		 593 if (x->props.family == family &&
594 x->props.reqid == tmpl->reqid &&
fbd9a5b4 595 !(x->props.flags & XFRM_STATE_WILDRECV) &&
1da177e4
LT		 596 xfrm_state_addr_check(x, daddr, saddr, family) &&
597 tmpl->mode == x->props.mode &&
598 tmpl->id.proto == x->id.proto &&
599 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
600 /* Resolution logic:
601 1. There is a valid state with matching selector.
602 Done.
603 2. Valid state with inappropriate selector. Skip.
604
605 Entering area of "sysdeps".
606
607 3. If state is not valid, selector is temporary,
608 it selects only session which triggered
609 previous resolution. Key manager will do
610 something to install a state with proper
611 selector.
612 */
613 if (x->km.state == XFRM_STATE_VALID) {
48b8d783 614 if (!xfrm_selector_match(&x->sel, fl, x->sel.family) ||
e0d1caa7 615 !security_xfrm_state_pol_flow_match(x, pol, fl))
1da177e4
LT		 616 continue;
617 if (!best ||
618 best->km.dying > x->km.dying ||
619 (best->km.dying == x->km.dying &&
620 best->curlft.add_time < x->curlft.add_time))
621 best = x;
622 } else if (x->km.state == XFRM_STATE_ACQ) {
623 acquire_in_progress = 1;
624 } else if (x->km.state == XFRM_STATE_ERROR ||
625 x->km.state == XFRM_STATE_EXPIRED) {
48b8d783 626 if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
e0d1caa7 627 security_xfrm_state_pol_flow_match(x, pol, fl))
1da177e4
LT		 628 error = -ESRCH;
629 }
630 }
631 }
632
633 x = best;
634 if (!x && !error && !acquire_in_progress) {
5c5d281a 635 if (tmpl->id.spi &&
edcd5821
DM		 636 (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
637 tmpl->id.proto, family)) != NULL) {
1da177e4
LT		 638 xfrm_state_put(x0);
639 error = -EEXIST;
640 goto out;
641 }
642 x = xfrm_state_alloc();
643 if (x == NULL) {
644 error = -ENOMEM;
645 goto out;
646 }
647 /* Initialize temporary selector matching only
648 * to current session. */
649 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
650
e0d1caa7
VY		 651 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
652 if (error) {
653 x->km.state = XFRM_STATE_DEAD;
654 xfrm_state_put(x);
655 x = NULL;
656 goto out;
657 }
658
1da177e4
LT		 659 if (km_query(x, tmpl, pol) == 0) {
660 x->km.state = XFRM_STATE_ACQ;
8f126e37 661 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
667bbcb6 662 h = xfrm_src_hash(daddr, saddr, family);
8f126e37 663 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1da177e4
LT		 664 if (x->id.spi) {
665 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
8f126e37 666 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1da177e4 667 }
01e67d08
DM		 668 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
669 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
1da177e4 670 add_timer(&x->timer);
2fab22f2
PM		 671 xfrm_state_num++;
672 xfrm_hash_grow_check(x->bydst.next != NULL);
1da177e4
LT		 673 } else {
674 x->km.state = XFRM_STATE_DEAD;
675 xfrm_state_put(x);
676 x = NULL;
677 error = -ESRCH;
678 }
679 }
680out:
681 if (x)
682 xfrm_state_hold(x);
683 else
684 *err = acquire_in_progress ? -EAGAIN : error;
685 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 686 return x;
687}
688
628529b6
JHS		 689struct xfrm_state *
690xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
691 unsigned short family, u8 mode, u8 proto, u32 reqid)
692{
693 unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
694 struct xfrm_state *rx = NULL, *x = NULL;
695 struct hlist_node *entry;
696
697 spin_lock(&xfrm_state_lock);
698 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
699 if (x->props.family == family &&
700 x->props.reqid == reqid &&
701 !(x->props.flags & XFRM_STATE_WILDRECV) &&
702 xfrm_state_addr_check(x, daddr, saddr, family) &&
703 mode == x->props.mode &&
704 proto == x->id.proto &&
705 x->km.state == XFRM_STATE_VALID) {
706 rx = x;
707 break;
708 }
709 }
710
711 if (rx)
712 xfrm_state_hold(rx);
713 spin_unlock(&xfrm_state_lock);
714
715
716 return rx;
717}
718EXPORT_SYMBOL(xfrm_stateonly_find);
719
1da177e4
LT		 720static void __xfrm_state_insert(struct xfrm_state *x)
721{
a624c108 722 unsigned int h;
1da177e4 723
9d4a706d
DM		 724 x->genid = ++xfrm_state_genid;
725
c1969f29
DM		 726 h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
727 x->props.reqid, x->props.family);
8f126e37 728 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
1da177e4 729
667bbcb6 730 h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
8f126e37 731 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
1da177e4 732
7b4dc360 733 if (x->id.spi) {
6c44e6b7
MN		 734 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
735 x->props.family);
736
8f126e37 737 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
6c44e6b7
MN		 738 }
739
a47f0ce0
DM		 740 mod_timer(&x->timer, jiffies + HZ);
741 if (x->replay_maxage)
742 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
f8cd5488 743
1da177e4 744 wake_up(&km_waitq);
f034b5d4
DM		 745
746 xfrm_state_num++;
747
918049f0 748 xfrm_hash_grow_check(x->bydst.next != NULL);
1da177e4
LT		 749}
750
c7f5ea3a
DM		 751/* xfrm_state_lock is held */
752static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
753{
754 unsigned short family = xnew->props.family;
755 u32 reqid = xnew->props.reqid;
756 struct xfrm_state *x;
757 struct hlist_node *entry;
758 unsigned int h;
759
c1969f29 760 h = xfrm_dst_hash(&xnew->id.daddr, &xnew->props.saddr, reqid, family);
c7f5ea3a
DM		 761 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
762 if (x->props.family == family &&
763 x->props.reqid == reqid &&
c1969f29
DM		 764 !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
765 !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
c7f5ea3a
DM		 766 x->genid = xfrm_state_genid;
767 }
768}
769
1da177e4
LT		 770void xfrm_state_insert(struct xfrm_state *x)
771{
772 spin_lock_bh(&xfrm_state_lock);
c7f5ea3a 773 __xfrm_state_bump_genids(x);
1da177e4
LT		 774 __xfrm_state_insert(x);
775 spin_unlock_bh(&xfrm_state_lock);
776}
777EXPORT_SYMBOL(xfrm_state_insert);
778
2770834c
DM		 779/* xfrm_state_lock is held */
780static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
781{
c1969f29 782 unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);
8f126e37 783 struct hlist_node *entry;
2770834c
DM		 784 struct xfrm_state *x;
785
8f126e37 786 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
2770834c
DM		 787 if (x->props.reqid != reqid ||
788 x->props.mode != mode ||
789 x->props.family != family ||
790 x->km.state != XFRM_STATE_ACQ ||
75e252d9
JL		 791 x->id.spi != 0 ||
792 x->id.proto != proto)
2770834c
DM		 793 continue;
794
795 switch (family) {
796 case AF_INET:
797 if (x->id.daddr.a4 != daddr->a4 ||
798 x->props.saddr.a4 != saddr->a4)
799 continue;
800 break;
801 case AF_INET6:
802 if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
803 (struct in6_addr *)daddr) ||
804 !ipv6_addr_equal((struct in6_addr *)
805 x->props.saddr.a6,
806 (struct in6_addr *)saddr))
807 continue;
808 break;
3ff50b79 809 }
2770834c
DM		 810
811 xfrm_state_hold(x);
812 return x;
813 }
814
815 if (!create)
816 return NULL;
817
818 x = xfrm_state_alloc();
819 if (likely(x)) {
820 switch (family) {
821 case AF_INET:
822 x->sel.daddr.a4 = daddr->a4;
823 x->sel.saddr.a4 = saddr->a4;
824 x->sel.prefixlen_d = 32;
825 x->sel.prefixlen_s = 32;
826 x->props.saddr.a4 = saddr->a4;
827 x->id.daddr.a4 = daddr->a4;
828 break;
829
830 case AF_INET6:
831 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
832 (struct in6_addr *)daddr);
833 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
834 (struct in6_addr *)saddr);
835 x->sel.prefixlen_d = 128;
836 x->sel.prefixlen_s = 128;
837 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
838 (struct in6_addr *)saddr);
839 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
840 (struct in6_addr *)daddr);
841 break;
3ff50b79 842 }
2770834c
DM		 843
844 x->km.state = XFRM_STATE_ACQ;
845 x->id.proto = proto;
846 x->props.family = family;
847 x->props.mode = mode;
848 x->props.reqid = reqid;
01e67d08 849 x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
2770834c 850 xfrm_state_hold(x);
01e67d08 851 x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
2770834c 852 add_timer(&x->timer);
8f126e37 853 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
667bbcb6 854 h = xfrm_src_hash(daddr, saddr, family);
8f126e37 855 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
2770834c 856 wake_up(&km_waitq);
918049f0
DM		 857
858 xfrm_state_num++;
859
860 xfrm_hash_grow_check(x->bydst.next != NULL);
2770834c
DM		 861 }
862
863 return x;
864}
865
1da177e4
LT		 866static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
867
868int xfrm_state_add(struct xfrm_state *x)
869{
1da177e4
LT		 870 struct xfrm_state *x1;
871 int family;
872 int err;
eb2971b6 873 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1da177e4
LT		 874
875 family = x->props.family;
1da177e4
LT		 876
877 spin_lock_bh(&xfrm_state_lock);
878
edcd5821 879 x1 = __xfrm_state_locate(x, use_spi, family);
1da177e4
LT		 880 if (x1) {
881 xfrm_state_put(x1);
882 x1 = NULL;
883 err = -EEXIST;
884 goto out;
885 }
886
eb2971b6 887 if (use_spi && x->km.seq) {
1da177e4 888 x1 = __xfrm_find_acq_byseq(x->km.seq);
75e252d9
JL		 889 if (x1 && ((x1->id.proto != x->id.proto) ||
890 xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
1da177e4
LT		 891 xfrm_state_put(x1);
892 x1 = NULL;
893 }
894 }
895
eb2971b6 896 if (use_spi && !x1)
2770834c
DM		 897 x1 = __find_acq_core(family, x->props.mode, x->props.reqid,
898 x->id.proto,
899 &x->id.daddr, &x->props.saddr, 0);
1da177e4 900
c7f5ea3a 901 __xfrm_state_bump_genids(x);
1da177e4
LT		 902 __xfrm_state_insert(x);
903 err = 0;
904
905out:
906 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 907
908 if (x1) {
909 xfrm_state_delete(x1);
910 xfrm_state_put(x1);
911 }
912
913 return err;
914}
915EXPORT_SYMBOL(xfrm_state_add);
916
80c9abaa
SS		 917#ifdef CONFIG_XFRM_MIGRATE
918struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
919{
920 int err = -ENOMEM;
921 struct xfrm_state *x = xfrm_state_alloc();
922 if (!x)
923 goto error;
924
925 memcpy(&x->id, &orig->id, sizeof(x->id));
926 memcpy(&x->sel, &orig->sel, sizeof(x->sel));
927 memcpy(&x->lft, &orig->lft, sizeof(x->lft));
928 x->props.mode = orig->props.mode;
929 x->props.replay_window = orig->props.replay_window;
930 x->props.reqid = orig->props.reqid;
931 x->props.family = orig->props.family;
932 x->props.saddr = orig->props.saddr;
933
934 if (orig->aalg) {
935 x->aalg = xfrm_algo_clone(orig->aalg);
936 if (!x->aalg)
937 goto error;
938 }
939 x->props.aalgo = orig->props.aalgo;
940
941 if (orig->ealg) {
942 x->ealg = xfrm_algo_clone(orig->ealg);
943 if (!x->ealg)
944 goto error;
945 }
946 x->props.ealgo = orig->props.ealgo;
947
948 if (orig->calg) {
949 x->calg = xfrm_algo_clone(orig->calg);
950 if (!x->calg)
951 goto error;
952 }
953 x->props.calgo = orig->props.calgo;
954
a716c119 955 if (orig->encap) {
80c9abaa
SS		 956 x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
957 if (!x->encap)
958 goto error;
959 }
960
961 if (orig->coaddr) {
962 x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
963 GFP_KERNEL);
964 if (!x->coaddr)
965 goto error;
966 }
967
968 err = xfrm_init_state(x);
969 if (err)
970 goto error;
971
972 x->props.flags = orig->props.flags;
973
974 x->curlft.add_time = orig->curlft.add_time;
975 x->km.state = orig->km.state;
976 x->km.seq = orig->km.seq;
977
978 return x;
979
980 error:
981 if (errp)
982 *errp = err;
983 if (x) {
984 kfree(x->aalg);
985 kfree(x->ealg);
986 kfree(x->calg);
987 kfree(x->encap);
988 kfree(x->coaddr);
989 }
990 kfree(x);
991 return NULL;
992}
993EXPORT_SYMBOL(xfrm_state_clone);
994
995/* xfrm_state_lock is held */
996struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
997{
998 unsigned int h;
999 struct xfrm_state *x;
1000 struct hlist_node *entry;
1001
1002 if (m->reqid) {
1003 h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
1004 m->reqid, m->old_family);
1005 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
1006 if (x->props.mode != m->mode ||
1007 x->id.proto != m->proto)
1008 continue;
1009 if (m->reqid && x->props.reqid != m->reqid)
1010 continue;
1011 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1012 m->old_family) ||
1013 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1014 m->old_family))
1015 continue;
1016 xfrm_state_hold(x);
1017 return x;
1018 }
1019 } else {
1020 h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
1021 m->old_family);
1022 hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
1023 if (x->props.mode != m->mode ||
1024 x->id.proto != m->proto)
1025 continue;
1026 if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
1027 m->old_family) ||
1028 xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
1029 m->old_family))
1030 continue;
1031 xfrm_state_hold(x);
1032 return x;
1033 }
1034 }
1035
a716c119 1036 return NULL;
80c9abaa
SS		 1037}
1038EXPORT_SYMBOL(xfrm_migrate_state_find);
1039
1040struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1041 struct xfrm_migrate *m)
1042{
1043 struct xfrm_state *xc;
1044 int err;
1045
1046 xc = xfrm_state_clone(x, &err);
1047 if (!xc)
1048 return NULL;
1049
1050 memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
1051 memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
1052
1053 /* add state */
1054 if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
1055 /* a care is needed when the destination address of the
1056 state is to be updated as it is a part of triplet */
1057 xfrm_state_insert(xc);
1058 } else {
1059 if ((err = xfrm_state_add(xc)) < 0)
1060 goto error;
1061 }
1062
1063 return xc;
1064error:
1065 kfree(xc);
1066 return NULL;
1067}
1068EXPORT_SYMBOL(xfrm_state_migrate);
1069#endif
1070
1da177e4
LT		 1071int xfrm_state_update(struct xfrm_state *x)
1072{
1da177e4
LT		 1073 struct xfrm_state *x1;
1074 int err;
eb2971b6 1075 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
1da177e4 1076
1da177e4 1077 spin_lock_bh(&xfrm_state_lock);
edcd5821 1078 x1 = __xfrm_state_locate(x, use_spi, x->props.family);
1da177e4
LT		 1079
1080 err = -ESRCH;
1081 if (!x1)
1082 goto out;
1083
1084 if (xfrm_state_kern(x1)) {
1085 xfrm_state_put(x1);
1086 err = -EEXIST;
1087 goto out;
1088 }
1089
1090 if (x1->km.state == XFRM_STATE_ACQ) {
1091 __xfrm_state_insert(x);
1092 x = NULL;
1093 }
1094 err = 0;
1095
1096out:
1097 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 1098
1099 if (err)
1100 return err;
1101
1102 if (!x) {
1103 xfrm_state_delete(x1);
1104 xfrm_state_put(x1);
1105 return 0;
1106 }
1107
1108 err = -EINVAL;
1109 spin_lock_bh(&x1->lock);
1110 if (likely(x1->km.state == XFRM_STATE_VALID)) {
1111 if (x->encap && x1->encap)
1112 memcpy(x1->encap, x->encap, sizeof(*x1->encap));
060f02a3
NT		 1113 if (x->coaddr && x1->coaddr) {
1114 memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
1115 }
1116 if (!use_spi && memcmp(&x1->sel, &x->sel, sizeof(x1->sel)))
1117 memcpy(&x1->sel, &x->sel, sizeof(x1->sel));
1da177e4
LT		 1118 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
1119 x1->km.dying = 0;
1120
a47f0ce0 1121 mod_timer(&x1->timer, jiffies + HZ);
1da177e4
LT		 1122 if (x1->curlft.use_time)
1123 xfrm_state_check_expire(x1);
1124
1125 err = 0;
1126 }
1127 spin_unlock_bh(&x1->lock);
1128
1129 xfrm_state_put(x1);
1130
1131 return err;
1132}
1133EXPORT_SYMBOL(xfrm_state_update);
1134
1135int xfrm_state_check_expire(struct xfrm_state *x)
1136{
1137 if (!x->curlft.use_time)
9d729f72 1138 x->curlft.use_time = get_seconds();
1da177e4
LT		 1139
1140 if (x->km.state != XFRM_STATE_VALID)
1141 return -EINVAL;
1142
1143 if (x->curlft.bytes >= x->lft.hard_byte_limit ||
1144 x->curlft.packets >= x->lft.hard_packet_limit) {
4666faab 1145 x->km.state = XFRM_STATE_EXPIRED;
a47f0ce0 1146 mod_timer(&x->timer, jiffies);
1da177e4
LT		 1147 return -EINVAL;
1148 }
1149
1150 if (!x->km.dying &&
1151 (x->curlft.bytes >= x->lft.soft_byte_limit ||
4666faab
HX		 1152 x->curlft.packets >= x->lft.soft_packet_limit)) {
1153 x->km.dying = 1;
53bc6b4d 1154 km_state_expired(x, 0, 0);
4666faab 1155 }
1da177e4
LT		 1156 return 0;
1157}
1158EXPORT_SYMBOL(xfrm_state_check_expire);
1159
1160static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
1161{
1162 int nhead = x->props.header_len + LL_RESERVED_SPACE(skb->dst->dev)
1163 - skb_headroom(skb);
1164
1165 if (nhead > 0)
1166 return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
1167
1168 /* Check tail too... */
1169 return 0;
1170}
1171
1172int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb)
1173{
1174 int err = xfrm_state_check_expire(x);
1175 if (err < 0)
1176 goto err;
1177 err = xfrm_state_check_space(x, skb);
1178err:
1179 return err;
1180}
1181EXPORT_SYMBOL(xfrm_state_check);
1182
1183struct xfrm_state *
a94cfd19 1184xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
1da177e4
LT		 1185 unsigned short family)
1186{
1187 struct xfrm_state *x;
1da177e4
LT		 1188
1189 spin_lock_bh(&xfrm_state_lock);
edcd5821 1190 x = __xfrm_state_lookup(daddr, spi, proto, family);
1da177e4 1191 spin_unlock_bh(&xfrm_state_lock);
1da177e4
LT		 1192 return x;
1193}
1194EXPORT_SYMBOL(xfrm_state_lookup);
1195
1196struct xfrm_state *
eb2971b6
MN		 1197xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr,
1198 u8 proto, unsigned short family)
1199{
1200 struct xfrm_state *x;
eb2971b6
MN		 1201
1202 spin_lock_bh(&xfrm_state_lock);
edcd5821 1203 x = __xfrm_state_lookup_byaddr(daddr, saddr, proto, family);
eb2971b6 1204 spin_unlock_bh(&xfrm_state_lock);
eb2971b6
MN		 1205 return x;
1206}
1207EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1208
1209struct xfrm_state *
a716c119
YH		 1210xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1211 xfrm_address_t *daddr, xfrm_address_t *saddr,
1da177e4
LT		 1212 int create, unsigned short family)
1213{
1214 struct xfrm_state *x;
1da177e4
LT		 1215
1216 spin_lock_bh(&xfrm_state_lock);
2770834c 1217 x = __find_acq_core(family, mode, reqid, proto, daddr, saddr, create);
1da177e4 1218 spin_unlock_bh(&xfrm_state_lock);
2770834c 1219
1da177e4
LT		 1220 return x;
1221}
1222EXPORT_SYMBOL(xfrm_find_acq);
1223
41a49cc3
MN		 1224#ifdef CONFIG_XFRM_SUB_POLICY
1225int
1226xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1227 unsigned short family)
1228{
1229 int err = 0;
1230 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1231 if (!afinfo)
1232 return -EAFNOSUPPORT;
1233
1234 spin_lock_bh(&xfrm_state_lock);
1235 if (afinfo->tmpl_sort)
1236 err = afinfo->tmpl_sort(dst, src, n);
1237 spin_unlock_bh(&xfrm_state_lock);
1238 xfrm_state_put_afinfo(afinfo);
1239 return err;
1240}
1241EXPORT_SYMBOL(xfrm_tmpl_sort);
1242
1243int
1244xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1245 unsigned short family)
1246{
1247 int err = 0;
1248 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
1249 if (!afinfo)
1250 return -EAFNOSUPPORT;
1251
1252 spin_lock_bh(&xfrm_state_lock);
1253 if (afinfo->state_sort)
1254 err = afinfo->state_sort(dst, src, n);
1255 spin_unlock_bh(&xfrm_state_lock);
1256 xfrm_state_put_afinfo(afinfo);
1257 return err;
1258}
1259EXPORT_SYMBOL(xfrm_state_sort);
1260#endif
1261
1da177e4
LT		 1262/* Silly enough, but I'm lazy to build resolution list */
1263
1264static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq)
1265{
1266 int i;
1da177e4 1267
f034b5d4 1268 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37
DM		 1269 struct hlist_node *entry;
1270 struct xfrm_state *x;
1271
1272 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
1273 if (x->km.seq == seq &&
1274 x->km.state == XFRM_STATE_ACQ) {
1da177e4
LT		 1275 xfrm_state_hold(x);
1276 return x;
1277 }
1278 }
1279 }
1280 return NULL;
1281}
1282
1283struct xfrm_state *xfrm_find_acq_byseq(u32 seq)
1284{
1285 struct xfrm_state *x;
1286
1287 spin_lock_bh(&xfrm_state_lock);
1288 x = __xfrm_find_acq_byseq(seq);
1289 spin_unlock_bh(&xfrm_state_lock);
1290 return x;
1291}
1292EXPORT_SYMBOL(xfrm_find_acq_byseq);
1293
1294u32 xfrm_get_acqseq(void)
1295{
1296 u32 res;
1297 static u32 acqseq;
1298 static DEFINE_SPINLOCK(acqseq_lock);
1299
1300 spin_lock_bh(&acqseq_lock);
1301 res = (++acqseq ? : ++acqseq);
1302 spin_unlock_bh(&acqseq_lock);
1303 return res;
1304}
1305EXPORT_SYMBOL(xfrm_get_acqseq);
1306
1307void
26977b4e 1308xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi)
1da177e4 1309{
f034b5d4 1310 unsigned int h;
1da177e4
LT		 1311 struct xfrm_state *x0;
1312
1313 if (x->id.spi)
1314 return;
1315
1316 if (minspi == maxspi) {
1317 x0 = xfrm_state_lookup(&x->id.daddr, minspi, x->id.proto, x->props.family);
1318 if (x0) {
1319 xfrm_state_put(x0);
1320 return;
1321 }
1322 x->id.spi = minspi;
1323 } else {
1324 u32 spi = 0;
26977b4e
AV		 1325 u32 low = ntohl(minspi);
1326 u32 high = ntohl(maxspi);
1327 for (h=0; h<high-low+1; h++) {
1328 spi = low + net_random()%(high-low+1);
1da177e4
LT		 1329 x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
1330 if (x0 == NULL) {
1331 x->id.spi = htonl(spi);
1332 break;
1333 }
1334 xfrm_state_put(x0);
1335 }
1336 }
1337 if (x->id.spi) {
1338 spin_lock_bh(&xfrm_state_lock);
1339 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
8f126e37 1340 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
1da177e4
LT		 1341 spin_unlock_bh(&xfrm_state_lock);
1342 wake_up(&km_waitq);
1343 }
1344}
1345EXPORT_SYMBOL(xfrm_alloc_spi);
1346
1347int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
1348 void *data)
1349{
1350 int i;
94b9bb54 1351 struct xfrm_state *x, *last = NULL;
8f126e37 1352 struct hlist_node *entry;
1da177e4
LT		 1353 int count = 0;
1354 int err = 0;
1355
1356 spin_lock_bh(&xfrm_state_lock);
f034b5d4 1357 for (i = 0; i <= xfrm_state_hmask; i++) {
8f126e37 1358 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
94b9bb54
JHS		 1359 if (!xfrm_id_proto_match(x->id.proto, proto))
1360 continue;
1361 if (last) {
1362 err = func(last, count, data);
1363 if (err)
1364 goto out;
1365 }
1366 last = x;
1367 count++;
1da177e4
LT		 1368 }
1369 }
1370 if (count == 0) {
1371 err = -ENOENT;
1372 goto out;
1373 }
94b9bb54 1374 err = func(last, 0, data);
1da177e4
LT		 1375out:
1376 spin_unlock_bh(&xfrm_state_lock);
1377 return err;
1378}
1379EXPORT_SYMBOL(xfrm_state_walk);
1380
f8cd5488
JHS		 1381
1382void xfrm_replay_notify(struct xfrm_state *x, int event)
1383{
1384 struct km_event c;
1385 /* we send notify messages in case
1386 * 1. we updated on of the sequence numbers, and the seqno difference
1387 * is at least x->replay_maxdiff, in this case we also update the
1388 * timeout of our timer function
1389 * 2. if x->replay_maxage has elapsed since last update,
1390 * and there were changes
1391 *
1392 * The state structure must be locked!
1393 */
1394
1395 switch (event) {
1396 case XFRM_REPLAY_UPDATE:
1397 if (x->replay_maxdiff &&
1398 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
2717096a
JHS		 1399 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1400 if (x->xflags & XFRM_TIME_DEFER)
1401 event = XFRM_REPLAY_TIMEOUT;
1402 else
1403 return;
1404 }
f8cd5488
JHS		 1405
1406 break;
1407
1408 case XFRM_REPLAY_TIMEOUT:
1409 if ((x->replay.seq == x->preplay.seq) &&
1410 (x->replay.bitmap == x->preplay.bitmap) &&
2717096a
JHS		 1411 (x->replay.oseq == x->preplay.oseq)) {
1412 x->xflags |= XFRM_TIME_DEFER;
f8cd5488 1413 return;
2717096a 1414 }
f8cd5488
JHS		 1415
1416 break;
1417 }
1418
1419 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1420 c.event = XFRM_MSG_NEWAE;
1421 c.data.aevent = event;
1422 km_state_notify(x, &c);
1423
f8cd5488 1424 if (x->replay_maxage &&
a47f0ce0 1425 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
2717096a 1426 x->xflags &= ~XFRM_TIME_DEFER;
f8cd5488 1427}
a70fcb0b 1428EXPORT_SYMBOL(xfrm_replay_notify);
f8cd5488
JHS		 1429
1430static void xfrm_replay_timer_handler(unsigned long data)
1431{
1432 struct xfrm_state *x = (struct xfrm_state*)data;
1433
1434 spin_lock(&x->lock);
1435
2717096a
JHS		 1436 if (x->km.state == XFRM_STATE_VALID) {
1437 if (xfrm_aevent_is_on())
1438 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
1439 else
1440 x->xflags |= XFRM_TIME_DEFER;
1441 }
f8cd5488
JHS		 1442
1443 spin_unlock(&x->lock);
1444}
1445
a252cc23 1446int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
1da177e4
LT		 1447{
1448 u32 diff;
a252cc23 1449 u32 seq = ntohl(net_seq);
1da177e4
LT		 1450
1451 if (unlikely(seq == 0))
1452 return -EINVAL;
1453
1454 if (likely(seq > x->replay.seq))
1455 return 0;
1456
1457 diff = x->replay.seq - seq;
4c4d51a7
HX		 1458 if (diff >= min_t(unsigned int, x->props.replay_window,
1459 sizeof(x->replay.bitmap) * 8)) {
1da177e4
LT		 1460 x->stats.replay_window++;
1461 return -EINVAL;
1462 }
1463
1464 if (x->replay.bitmap & (1U << diff)) {
1465 x->stats.replay++;
1466 return -EINVAL;
1467 }
1468 return 0;
1469}
1470EXPORT_SYMBOL(xfrm_replay_check);
1471
61f4627b 1472void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1da177e4
LT		 1473{
1474 u32 diff;
61f4627b 1475 u32 seq = ntohl(net_seq);
1da177e4
LT		 1476
1477 if (seq > x->replay.seq) {
1478 diff = seq - x->replay.seq;
1479 if (diff < x->props.replay_window)
1480 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1481 else
1482 x->replay.bitmap = 1;
1483 x->replay.seq = seq;
1484 } else {
1485 diff = x->replay.seq - seq;
1486 x->replay.bitmap |= (1U << diff);
1487 }
f8cd5488
JHS		 1488
1489 if (xfrm_aevent_is_on())
1490 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1da177e4
LT		 1491}
1492EXPORT_SYMBOL(xfrm_replay_advance);
1493
1494static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
1495static DEFINE_RWLOCK(xfrm_km_lock);
1496
26b15dad 1497void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1da177e4
LT		 1498{
1499 struct xfrm_mgr *km;
1500
26b15dad
JHS		 1501 read_lock(&xfrm_km_lock);
1502 list_for_each_entry(km, &xfrm_km_list, list)
1503 if (km->notify_policy)
1504 km->notify_policy(xp, dir, c);
1505 read_unlock(&xfrm_km_lock);
1506}
1da177e4 1507
26b15dad
JHS		 1508void km_state_notify(struct xfrm_state *x, struct km_event *c)
1509{
1510 struct xfrm_mgr *km;
1da177e4
LT		 1511 read_lock(&xfrm_km_lock);
1512 list_for_each_entry(km, &xfrm_km_list, list)
26b15dad
JHS		 1513 if (km->notify)
1514 km->notify(x, c);
1da177e4 1515 read_unlock(&xfrm_km_lock);
26b15dad
JHS		 1516}
1517
1518EXPORT_SYMBOL(km_policy_notify);
1519EXPORT_SYMBOL(km_state_notify);
1520
53bc6b4d 1521void km_state_expired(struct xfrm_state *x, int hard, u32 pid)
26b15dad
JHS		 1522{
1523 struct km_event c;
1524
bf08867f 1525 c.data.hard = hard;
53bc6b4d 1526 c.pid = pid;
f60f6b8f 1527 c.event = XFRM_MSG_EXPIRE;
26b15dad 1528 km_state_notify(x, &c);
1da177e4
LT		 1529
1530 if (hard)
1531 wake_up(&km_waitq);
1532}
1533
53bc6b4d 1534EXPORT_SYMBOL(km_state_expired);
26b15dad
JHS		 1535/*
1536 * We send to all registered managers regardless of failure
1537 * We are happy with one success
1538*/
980ebd25 1539int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
1da177e4 1540{
26b15dad 1541 int err = -EINVAL, acqret;
1da177e4
LT		 1542 struct xfrm_mgr *km;
1543
1544 read_lock(&xfrm_km_lock);
1545 list_for_each_entry(km, &xfrm_km_list, list) {
26b15dad
JHS		 1546 acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
1547 if (!acqret)
1548 err = acqret;
1da177e4
LT		 1549 }
1550 read_unlock(&xfrm_km_lock);
1551 return err;
1552}
980ebd25 1553EXPORT_SYMBOL(km_query);
1da177e4 1554
5d36b180 1555int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
1da177e4
LT		 1556{
1557 int err = -EINVAL;
1558 struct xfrm_mgr *km;
1559
1560 read_lock(&xfrm_km_lock);
1561 list_for_each_entry(km, &xfrm_km_list, list) {
1562 if (km->new_mapping)
1563 err = km->new_mapping(x, ipaddr, sport);
1564 if (!err)
1565 break;
1566 }
1567 read_unlock(&xfrm_km_lock);
1568 return err;
1569}
1570EXPORT_SYMBOL(km_new_mapping);
1571
6c5c8ca7 1572void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1da177e4 1573{
26b15dad 1574 struct km_event c;
1da177e4 1575
bf08867f 1576 c.data.hard = hard;
6c5c8ca7 1577 c.pid = pid;
f60f6b8f 1578 c.event = XFRM_MSG_POLEXPIRE;
26b15dad 1579 km_policy_notify(pol, dir, &c);
1da177e4
LT		 1580
1581 if (hard)
1582 wake_up(&km_waitq);
1583}
a70fcb0b 1584EXPORT_SYMBOL(km_policy_expired);
1da177e4 1585
80c9abaa
SS		 1586int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1587 struct xfrm_migrate *m, int num_migrate)
1588{
1589 int err = -EINVAL;
1590 int ret;
1591 struct xfrm_mgr *km;
1592
1593 read_lock(&xfrm_km_lock);
1594 list_for_each_entry(km, &xfrm_km_list, list) {
1595 if (km->migrate) {
1596 ret = km->migrate(sel, dir, type, m, num_migrate);
1597 if (!ret)
1598 err = ret;
1599 }
1600 }
1601 read_unlock(&xfrm_km_lock);
1602 return err;
1603}
1604EXPORT_SYMBOL(km_migrate);
1605
97a64b45
MN		 1606int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
1607{
1608 int err = -EINVAL;
1609 int ret;
1610 struct xfrm_mgr *km;
1611
1612 read_lock(&xfrm_km_lock);
1613 list_for_each_entry(km, &xfrm_km_list, list) {
1614 if (km->report) {
1615 ret = km->report(proto, sel, addr);
1616 if (!ret)
1617 err = ret;
1618 }
1619 }
1620 read_unlock(&xfrm_km_lock);
1621 return err;
1622}
1623EXPORT_SYMBOL(km_report);
1624
1da177e4
LT		 1625int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1626{
1627 int err;
1628 u8 *data;
1629 struct xfrm_mgr *km;
1630 struct xfrm_policy *pol = NULL;
1631
1632 if (optlen <= 0 || optlen > PAGE_SIZE)
1633 return -EMSGSIZE;
1634
1635 data = kmalloc(optlen, GFP_KERNEL);
1636 if (!data)
1637 return -ENOMEM;
1638
1639 err = -EFAULT;
1640 if (copy_from_user(data, optval, optlen))
1641 goto out;
1642
1643 err = -EINVAL;
1644 read_lock(&xfrm_km_lock);
1645 list_for_each_entry(km, &xfrm_km_list, list) {
cb969f07 1646 pol = km->compile_policy(sk, optname, data,
1da177e4
LT		 1647 optlen, &err);
1648 if (err >= 0)
1649 break;
1650 }
1651 read_unlock(&xfrm_km_lock);
1652
1653 if (err >= 0) {
1654 xfrm_sk_policy_insert(sk, err, pol);
1655 xfrm_pol_put(pol);
1656 err = 0;
1657 }
1658
1659out:
1660 kfree(data);
1661 return err;
1662}
1663EXPORT_SYMBOL(xfrm_user_policy);
1664
1665int xfrm_register_km(struct xfrm_mgr *km)
1666{
1667 write_lock_bh(&xfrm_km_lock);
1668 list_add_tail(&km->list, &xfrm_km_list);
1669 write_unlock_bh(&xfrm_km_lock);
1670 return 0;
1671}
1672EXPORT_SYMBOL(xfrm_register_km);
1673
1674int xfrm_unregister_km(struct xfrm_mgr *km)
1675{
1676 write_lock_bh(&xfrm_km_lock);
1677 list_del(&km->list);
1678 write_unlock_bh(&xfrm_km_lock);
1679 return 0;
1680}
1681EXPORT_SYMBOL(xfrm_unregister_km);
1682
1683int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
1684{
1685 int err = 0;
1686 if (unlikely(afinfo == NULL))
1687 return -EINVAL;
1688 if (unlikely(afinfo->family >= NPROTO))
1689 return -EAFNOSUPPORT;
f3111502 1690 write_lock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1691 if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
1692 err = -ENOBUFS;
edcd5821 1693 else
1da177e4 1694 xfrm_state_afinfo[afinfo->family] = afinfo;
f3111502 1695 write_unlock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1696 return err;
1697}
1698EXPORT_SYMBOL(xfrm_state_register_afinfo);
1699
1700int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
1701{
1702 int err = 0;
1703 if (unlikely(afinfo == NULL))
1704 return -EINVAL;
1705 if (unlikely(afinfo->family >= NPROTO))
1706 return -EAFNOSUPPORT;
f3111502 1707 write_lock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1708 if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
1709 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
1710 err = -EINVAL;
edcd5821 1711 else
1da177e4 1712 xfrm_state_afinfo[afinfo->family] = NULL;
1da177e4 1713 }
f3111502 1714 write_unlock_bh(&xfrm_state_afinfo_lock);
1da177e4
LT		 1715 return err;
1716}
1717EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
1718
cdca7265 1719struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family)
1da177e4
LT		 1720{
1721 struct xfrm_state_afinfo *afinfo;
1722 if (unlikely(family >= NPROTO))
1723 return NULL;
1724 read_lock(&xfrm_state_afinfo_lock);
1725 afinfo = xfrm_state_afinfo[family];
546be240
HX		 1726 if (unlikely(!afinfo))
1727 read_unlock(&xfrm_state_afinfo_lock);
1da177e4
LT		 1728 return afinfo;
1729}
1730
cdca7265 1731void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
1da177e4 1732{
546be240 1733 read_unlock(&xfrm_state_afinfo_lock);
1da177e4
LT		 1734}
1735
cdca7265
MK		 1736EXPORT_SYMBOL(xfrm_state_get_afinfo);
1737EXPORT_SYMBOL(xfrm_state_put_afinfo);
1738
1da177e4
LT		 1739/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1740void xfrm_state_delete_tunnel(struct xfrm_state *x)
1741{
1742 if (x->tunnel) {
1743 struct xfrm_state *t = x->tunnel;
1744
1745 if (atomic_read(&t->tunnel_users) == 2)
1746 xfrm_state_delete(t);
1747 atomic_dec(&t->tunnel_users);
1748 xfrm_state_put(t);
1749 x->tunnel = NULL;
1750 }
1751}
1752EXPORT_SYMBOL(xfrm_state_delete_tunnel);
1753
1754int xfrm_state_mtu(struct xfrm_state *x, int mtu)
1755{
c5c25238 1756 int res;
1da177e4 1757
c5c25238
PM		 1758 spin_lock_bh(&x->lock);
1759 if (x->km.state == XFRM_STATE_VALID &&
1760 x->type && x->type->get_mtu)
1761 res = x->type->get_mtu(x, mtu);
1762 else
28121617 1763 res = mtu - x->props.header_len;
c5c25238 1764 spin_unlock_bh(&x->lock);
1da177e4
LT		 1765 return res;
1766}
1767
72cb6962
HX		 1768int xfrm_init_state(struct xfrm_state *x)
1769{
d094cd83
HX		 1770 struct xfrm_state_afinfo *afinfo;
1771 int family = x->props.family;
72cb6962
HX		 1772 int err;
1773
d094cd83
HX		 1774 err = -EAFNOSUPPORT;
1775 afinfo = xfrm_state_get_afinfo(family);
1776 if (!afinfo)
1777 goto error;
1778
1779 err = 0;
1780 if (afinfo->init_flags)
1781 err = afinfo->init_flags(x);
1782
1783 xfrm_state_put_afinfo(afinfo);
1784
1785 if (err)
1786 goto error;
1787
1788 err = -EPROTONOSUPPORT;
1789 x->type = xfrm_get_type(x->id.proto, family);
72cb6962
HX		 1790 if (x->type == NULL)
1791 goto error;
1792
1793 err = x->type->init_state(x);
1794 if (err)
1795 goto error;
1796
b59f45d0
HX		 1797 x->mode = xfrm_get_mode(x->props.mode, family);
1798 if (x->mode == NULL)
1799 goto error;
1800
72cb6962
HX		 1801 x->km.state = XFRM_STATE_VALID;
1802
1803error:
1804 return err;
1805}
1806
1807EXPORT_SYMBOL(xfrm_init_state);
a716c119 1808
1da177e4
LT		 1809void __init xfrm_state_init(void)
1810{
f034b5d4
DM		 1811 unsigned int sz;
1812
1813 sz = sizeof(struct hlist_head) * 8;
1814
44e36b42
DM		 1815 xfrm_state_bydst = xfrm_hash_alloc(sz);
1816 xfrm_state_bysrc = xfrm_hash_alloc(sz);
1817 xfrm_state_byspi = xfrm_hash_alloc(sz);
f034b5d4
DM		 1818 if (!xfrm_state_bydst || !xfrm_state_bysrc || !xfrm_state_byspi)
1819 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
1820 xfrm_state_hmask = ((sz / sizeof(struct hlist_head)) - 1);
1da177e4 1821
c4028958 1822 INIT_WORK(&xfrm_state_gc_work, xfrm_state_gc_task);
1da177e4
LT		 1823}
1824
Linux kernel - Deliverables
This page took 0.569228 seconds and 5 git commands to generate.