6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific functions
11 * Derek Atkins <derek@ihtfp.com>
12 * Add UDP Encapsulation
16 #include <linux/workqueue.h>
18 #include <linux/pfkeyv2.h>
19 #include <linux/ipsec.h>
20 #include <linux/module.h>
21 #include <linux/bootmem.h>
22 #include <linux/vmalloc.h>
23 #include <linux/cache.h>
24 #include <asm/uaccess.h>
27 EXPORT_SYMBOL(xfrm_nl
);
29 u32 sysctl_xfrm_aevent_etime
= XFRM_AE_ETIME
;
30 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime
);
32 u32 sysctl_xfrm_aevent_rseqth
= XFRM_AE_SEQT_SIZE
;
33 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth
);
35 /* Each xfrm_state may be linked to two tables:
37 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
38 2. Hash table by (daddr,family,reqid) to find what SAs exist for given
39 destination/tunnel endpoint. (output)
42 static DEFINE_SPINLOCK(xfrm_state_lock
);
44 /* Hash table to find appropriate SA towards given target (endpoint
45 * of tunnel or destination of transport mode) allowed by selector.
47 * Main use is finding SA after policy selected tunnel or transport mode.
48 * Also, it can be used by ah/esp icmp error handler to find offending SA.
50 static struct hlist_head
*xfrm_state_bydst __read_mostly
;
51 static struct hlist_head
*xfrm_state_bysrc __read_mostly
;
52 static struct hlist_head
*xfrm_state_byspi __read_mostly
;
53 static unsigned int xfrm_state_hmask __read_mostly
;
54 static unsigned int xfrm_state_hashmax __read_mostly
= 1 * 1024 * 1024;
55 static unsigned int xfrm_state_num
;
56 static unsigned int xfrm_state_genid
;
58 static inline unsigned int __xfrm4_addr_hash(xfrm_address_t
*addr
)
60 return ntohl(addr
->a4
);
63 static inline unsigned int __xfrm6_addr_hash(xfrm_address_t
*addr
)
65 return ntohl(addr
->a6
[2]^addr
->a6
[3]);
68 static inline unsigned int __xfrm_dst_hash(xfrm_address_t
*addr
,
69 u32 reqid
, unsigned short family
,
72 unsigned int h
= family
^ reqid
;
75 h
^= __xfrm4_addr_hash(addr
);
78 h
^= __xfrm6_addr_hash(addr
);
81 return (h
^ (h
>> 16)) & hmask
;
84 static inline unsigned int xfrm_dst_hash(xfrm_address_t
*addr
, u32 reqid
,
85 unsigned short family
)
87 return __xfrm_dst_hash(addr
, reqid
, family
, xfrm_state_hmask
);
90 static inline unsigned __xfrm_src_hash(xfrm_address_t
*addr
, unsigned short family
,
93 unsigned int h
= family
;
96 h
^= __xfrm4_addr_hash(addr
);
99 h
^= __xfrm6_addr_hash(addr
);
102 return (h
^ (h
>> 16)) & hmask
;
105 static inline unsigned xfrm_src_hash(xfrm_address_t
*addr
, unsigned short family
)
107 return __xfrm_src_hash(addr
, family
, xfrm_state_hmask
);
110 static inline unsigned int
111 __xfrm_spi_hash(xfrm_address_t
*addr
, u32 spi
, u8 proto
, unsigned short family
,
114 unsigned int h
= spi
^ proto
;
117 h
^= __xfrm4_addr_hash(addr
);
120 h
^= __xfrm6_addr_hash(addr
);
123 return (h
^ (h
>> 10) ^ (h
>> 20)) & hmask
;
126 static inline unsigned int
127 xfrm_spi_hash(xfrm_address_t
*addr
, u32 spi
, u8 proto
, unsigned short family
)
129 return __xfrm_spi_hash(addr
, spi
, proto
, family
, xfrm_state_hmask
);
132 static struct hlist_head
*xfrm_state_hash_alloc(unsigned int sz
)
134 struct hlist_head
*n
;
137 n
= kmalloc(sz
, GFP_KERNEL
);
139 n
= __vmalloc(sz
, GFP_KERNEL
, PAGE_KERNEL
);
141 n
= (struct hlist_head
*)
142 __get_free_pages(GFP_KERNEL
, get_order(sz
));
150 static void xfrm_state_hash_free(struct hlist_head
*n
, unsigned int sz
)
157 free_pages((unsigned long)n
, get_order(sz
));
160 static void xfrm_hash_transfer(struct hlist_head
*list
,
161 struct hlist_head
*ndsttable
,
162 struct hlist_head
*nsrctable
,
163 struct hlist_head
*nspitable
,
164 unsigned int nhashmask
)
166 struct hlist_node
*entry
, *tmp
;
167 struct xfrm_state
*x
;
169 hlist_for_each_entry_safe(x
, entry
, tmp
, list
, bydst
) {
172 h
= __xfrm_dst_hash(&x
->id
.daddr
, x
->props
.reqid
,
173 x
->props
.family
, nhashmask
);
174 hlist_add_head(&x
->bydst
, ndsttable
+h
);
176 h
= __xfrm_src_hash(&x
->props
.saddr
, x
->props
.family
,
178 hlist_add_head(&x
->bysrc
, nsrctable
+h
);
180 h
= __xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
, x
->id
.proto
,
181 x
->props
.family
, nhashmask
);
182 hlist_add_head(&x
->byspi
, nspitable
+h
);
186 static unsigned long xfrm_hash_new_size(void)
188 return ((xfrm_state_hmask
+ 1) << 1) *
189 sizeof(struct hlist_head
);
192 static DEFINE_MUTEX(hash_resize_mutex
);
194 static void xfrm_hash_resize(void *__unused
)
196 struct hlist_head
*ndst
, *nsrc
, *nspi
, *odst
, *osrc
, *ospi
;
197 unsigned long nsize
, osize
;
198 unsigned int nhashmask
, ohashmask
;
201 mutex_lock(&hash_resize_mutex
);
203 nsize
= xfrm_hash_new_size();
204 ndst
= xfrm_state_hash_alloc(nsize
);
207 nsrc
= xfrm_state_hash_alloc(nsize
);
209 xfrm_state_hash_free(ndst
, nsize
);
212 nspi
= xfrm_state_hash_alloc(nsize
);
214 xfrm_state_hash_free(ndst
, nsize
);
215 xfrm_state_hash_free(nsrc
, nsize
);
219 spin_lock_bh(&xfrm_state_lock
);
221 nhashmask
= (nsize
/ sizeof(struct hlist_head
)) - 1U;
222 for (i
= xfrm_state_hmask
; i
>= 0; i
--)
223 xfrm_hash_transfer(xfrm_state_bydst
+i
, ndst
, nsrc
, nspi
,
226 odst
= xfrm_state_bydst
;
227 osrc
= xfrm_state_bysrc
;
228 ospi
= xfrm_state_byspi
;
229 ohashmask
= xfrm_state_hmask
;
231 xfrm_state_bydst
= ndst
;
232 xfrm_state_bysrc
= nsrc
;
233 xfrm_state_byspi
= nspi
;
234 xfrm_state_hmask
= nhashmask
;
236 spin_unlock_bh(&xfrm_state_lock
);
238 osize
= (ohashmask
+ 1) * sizeof(struct hlist_head
);
239 xfrm_state_hash_free(odst
, osize
);
240 xfrm_state_hash_free(osrc
, osize
);
241 xfrm_state_hash_free(ospi
, osize
);
244 mutex_unlock(&hash_resize_mutex
);
247 static DECLARE_WORK(xfrm_hash_work
, xfrm_hash_resize
, NULL
);
249 DECLARE_WAIT_QUEUE_HEAD(km_waitq
);
250 EXPORT_SYMBOL(km_waitq
);
252 static DEFINE_RWLOCK(xfrm_state_afinfo_lock
);
253 static struct xfrm_state_afinfo
*xfrm_state_afinfo
[NPROTO
];
255 static struct work_struct xfrm_state_gc_work
;
256 static HLIST_HEAD(xfrm_state_gc_list
);
257 static DEFINE_SPINLOCK(xfrm_state_gc_lock
);
259 int __xfrm_state_delete(struct xfrm_state
*x
);
261 static struct xfrm_state_afinfo
*xfrm_state_get_afinfo(unsigned short family
);
262 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo
*afinfo
);
264 int km_query(struct xfrm_state
*x
, struct xfrm_tmpl
*t
, struct xfrm_policy
*pol
);
265 void km_state_expired(struct xfrm_state
*x
, int hard
, u32 pid
);
267 static void xfrm_state_gc_destroy(struct xfrm_state
*x
)
269 if (del_timer(&x
->timer
))
271 if (del_timer(&x
->rtimer
))
279 xfrm_put_mode(x
->mode
);
281 x
->type
->destructor(x
);
282 xfrm_put_type(x
->type
);
284 security_xfrm_state_free(x
);
288 static void xfrm_state_gc_task(void *data
)
290 struct xfrm_state
*x
;
291 struct hlist_node
*entry
, *tmp
;
292 struct hlist_head gc_list
;
294 spin_lock_bh(&xfrm_state_gc_lock
);
295 gc_list
.first
= xfrm_state_gc_list
.first
;
296 INIT_HLIST_HEAD(&xfrm_state_gc_list
);
297 spin_unlock_bh(&xfrm_state_gc_lock
);
299 hlist_for_each_entry_safe(x
, entry
, tmp
, &gc_list
, bydst
)
300 xfrm_state_gc_destroy(x
);
305 static inline unsigned long make_jiffies(long secs
)
307 if (secs
>= (MAX_SCHEDULE_TIMEOUT
-1)/HZ
)
308 return MAX_SCHEDULE_TIMEOUT
-1;
313 static void xfrm_timer_handler(unsigned long data
)
315 struct xfrm_state
*x
= (struct xfrm_state
*)data
;
316 unsigned long now
= (unsigned long)xtime
.tv_sec
;
317 long next
= LONG_MAX
;
321 if (x
->km
.state
== XFRM_STATE_DEAD
)
323 if (x
->km
.state
== XFRM_STATE_EXPIRED
)
325 if (x
->lft
.hard_add_expires_seconds
) {
326 long tmo
= x
->lft
.hard_add_expires_seconds
+
327 x
->curlft
.add_time
- now
;
333 if (x
->lft
.hard_use_expires_seconds
) {
334 long tmo
= x
->lft
.hard_use_expires_seconds
+
335 (x
->curlft
.use_time
? : now
) - now
;
343 if (x
->lft
.soft_add_expires_seconds
) {
344 long tmo
= x
->lft
.soft_add_expires_seconds
+
345 x
->curlft
.add_time
- now
;
351 if (x
->lft
.soft_use_expires_seconds
) {
352 long tmo
= x
->lft
.soft_use_expires_seconds
+
353 (x
->curlft
.use_time
? : now
) - now
;
362 km_state_expired(x
, 0, 0);
364 if (next
!= LONG_MAX
&&
365 !mod_timer(&x
->timer
, jiffies
+ make_jiffies(next
)))
370 if (x
->km
.state
== XFRM_STATE_ACQ
&& x
->id
.spi
== 0) {
371 x
->km
.state
= XFRM_STATE_EXPIRED
;
376 if (!__xfrm_state_delete(x
) && x
->id
.spi
)
377 km_state_expired(x
, 1, 0);
380 spin_unlock(&x
->lock
);
384 static void xfrm_replay_timer_handler(unsigned long data
);
386 struct xfrm_state
*xfrm_state_alloc(void)
388 struct xfrm_state
*x
;
390 x
= kzalloc(sizeof(struct xfrm_state
), GFP_ATOMIC
);
393 atomic_set(&x
->refcnt
, 1);
394 atomic_set(&x
->tunnel_users
, 0);
395 INIT_HLIST_NODE(&x
->bydst
);
396 INIT_HLIST_NODE(&x
->bysrc
);
397 INIT_HLIST_NODE(&x
->byspi
);
398 init_timer(&x
->timer
);
399 x
->timer
.function
= xfrm_timer_handler
;
400 x
->timer
.data
= (unsigned long)x
;
401 init_timer(&x
->rtimer
);
402 x
->rtimer
.function
= xfrm_replay_timer_handler
;
403 x
->rtimer
.data
= (unsigned long)x
;
404 x
->curlft
.add_time
= (unsigned long)xtime
.tv_sec
;
405 x
->lft
.soft_byte_limit
= XFRM_INF
;
406 x
->lft
.soft_packet_limit
= XFRM_INF
;
407 x
->lft
.hard_byte_limit
= XFRM_INF
;
408 x
->lft
.hard_packet_limit
= XFRM_INF
;
409 x
->replay_maxage
= 0;
410 x
->replay_maxdiff
= 0;
411 spin_lock_init(&x
->lock
);
415 EXPORT_SYMBOL(xfrm_state_alloc
);
417 void __xfrm_state_destroy(struct xfrm_state
*x
)
419 BUG_TRAP(x
->km
.state
== XFRM_STATE_DEAD
);
421 spin_lock_bh(&xfrm_state_gc_lock
);
422 hlist_add_head(&x
->bydst
, &xfrm_state_gc_list
);
423 spin_unlock_bh(&xfrm_state_gc_lock
);
424 schedule_work(&xfrm_state_gc_work
);
426 EXPORT_SYMBOL(__xfrm_state_destroy
);
428 int __xfrm_state_delete(struct xfrm_state
*x
)
432 if (x
->km
.state
!= XFRM_STATE_DEAD
) {
433 x
->km
.state
= XFRM_STATE_DEAD
;
434 spin_lock(&xfrm_state_lock
);
435 hlist_del(&x
->bydst
);
437 hlist_del(&x
->bysrc
);
440 hlist_del(&x
->byspi
);
444 spin_unlock(&xfrm_state_lock
);
445 if (del_timer(&x
->timer
))
447 if (del_timer(&x
->rtimer
))
450 /* All xfrm_state objects are created by xfrm_state_alloc.
451 * The xfrm_state_alloc call gives a reference, and that
452 * is what we are dropping here.
460 EXPORT_SYMBOL(__xfrm_state_delete
);
462 int xfrm_state_delete(struct xfrm_state
*x
)
466 spin_lock_bh(&x
->lock
);
467 err
= __xfrm_state_delete(x
);
468 spin_unlock_bh(&x
->lock
);
472 EXPORT_SYMBOL(xfrm_state_delete
);
474 void xfrm_state_flush(u8 proto
)
478 spin_lock_bh(&xfrm_state_lock
);
479 for (i
= 0; i
< xfrm_state_hmask
; i
++) {
480 struct hlist_node
*entry
;
481 struct xfrm_state
*x
;
483 hlist_for_each_entry(x
, entry
, xfrm_state_bydst
+i
, bydst
) {
484 if (!xfrm_state_kern(x
) &&
485 xfrm_id_proto_match(x
->id
.proto
, proto
)) {
487 spin_unlock_bh(&xfrm_state_lock
);
489 xfrm_state_delete(x
);
492 spin_lock_bh(&xfrm_state_lock
);
497 spin_unlock_bh(&xfrm_state_lock
);
500 EXPORT_SYMBOL(xfrm_state_flush
);
503 xfrm_init_tempsel(struct xfrm_state
*x
, struct flowi
*fl
,
504 struct xfrm_tmpl
*tmpl
,
505 xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
506 unsigned short family
)
508 struct xfrm_state_afinfo
*afinfo
= xfrm_state_get_afinfo(family
);
511 afinfo
->init_tempsel(x
, fl
, tmpl
, daddr
, saddr
);
512 xfrm_state_put_afinfo(afinfo
);
516 static struct xfrm_state
*__xfrm_state_lookup(xfrm_address_t
*daddr
, u32 spi
, u8 proto
, unsigned short family
)
518 unsigned int h
= xfrm_spi_hash(daddr
, spi
, proto
, family
);
519 struct xfrm_state
*x
;
520 struct hlist_node
*entry
;
522 hlist_for_each_entry(x
, entry
, xfrm_state_byspi
+h
, byspi
) {
523 if (x
->props
.family
!= family
||
525 x
->id
.proto
!= proto
)
530 if (x
->id
.daddr
.a4
!= daddr
->a4
)
534 if (!ipv6_addr_equal((struct in6_addr
*)daddr
,
548 static struct xfrm_state
*__xfrm_state_lookup_byaddr(xfrm_address_t
*daddr
, xfrm_address_t
*saddr
, u8 proto
, unsigned short family
)
550 unsigned int h
= xfrm_src_hash(saddr
, family
);
551 struct xfrm_state
*x
;
552 struct hlist_node
*entry
;
554 hlist_for_each_entry(x
, entry
, xfrm_state_bysrc
+h
, bysrc
) {
555 if (x
->props
.family
!= family
||
556 x
->id
.proto
!= proto
)
561 if (x
->id
.daddr
.a4
!= daddr
->a4
||
562 x
->props
.saddr
.a4
!= saddr
->a4
)
566 if (!ipv6_addr_equal((struct in6_addr
*)daddr
,
569 !ipv6_addr_equal((struct in6_addr
*)saddr
,
583 static inline struct xfrm_state
*
584 __xfrm_state_locate(struct xfrm_state
*x
, int use_spi
, int family
)
587 return __xfrm_state_lookup(&x
->id
.daddr
, x
->id
.spi
,
588 x
->id
.proto
, family
);
590 return __xfrm_state_lookup_byaddr(&x
->id
.daddr
,
592 x
->id
.proto
, family
);
596 xfrm_state_find(xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
597 struct flowi
*fl
, struct xfrm_tmpl
*tmpl
,
598 struct xfrm_policy
*pol
, int *err
,
599 unsigned short family
)
601 unsigned int h
= xfrm_dst_hash(daddr
, tmpl
->reqid
, family
);
602 struct hlist_node
*entry
;
603 struct xfrm_state
*x
, *x0
;
604 int acquire_in_progress
= 0;
606 struct xfrm_state
*best
= NULL
;
608 spin_lock_bh(&xfrm_state_lock
);
609 hlist_for_each_entry(x
, entry
, xfrm_state_bydst
+h
, bydst
) {
610 if (x
->props
.family
== family
&&
611 x
->props
.reqid
== tmpl
->reqid
&&
612 !(x
->props
.flags
& XFRM_STATE_WILDRECV
) &&
613 xfrm_state_addr_check(x
, daddr
, saddr
, family
) &&
614 tmpl
->mode
== x
->props
.mode
&&
615 tmpl
->id
.proto
== x
->id
.proto
&&
616 (tmpl
->id
.spi
== x
->id
.spi
|| !tmpl
->id
.spi
)) {
618 1. There is a valid state with matching selector.
620 2. Valid state with inappropriate selector. Skip.
622 Entering area of "sysdeps".
624 3. If state is not valid, selector is temporary,
625 it selects only session which triggered
626 previous resolution. Key manager will do
627 something to install a state with proper
630 if (x
->km
.state
== XFRM_STATE_VALID
) {
631 if (!xfrm_selector_match(&x
->sel
, fl
, family
) ||
632 !security_xfrm_state_pol_flow_match(x
, pol
, fl
))
635 best
->km
.dying
> x
->km
.dying
||
636 (best
->km
.dying
== x
->km
.dying
&&
637 best
->curlft
.add_time
< x
->curlft
.add_time
))
639 } else if (x
->km
.state
== XFRM_STATE_ACQ
) {
640 acquire_in_progress
= 1;
641 } else if (x
->km
.state
== XFRM_STATE_ERROR
||
642 x
->km
.state
== XFRM_STATE_EXPIRED
) {
643 if (xfrm_selector_match(&x
->sel
, fl
, family
) &&
644 security_xfrm_state_pol_flow_match(x
, pol
, fl
))
651 if (!x
&& !error
&& !acquire_in_progress
) {
653 (x0
= __xfrm_state_lookup(daddr
, tmpl
->id
.spi
,
654 tmpl
->id
.proto
, family
)) != NULL
) {
659 x
= xfrm_state_alloc();
664 /* Initialize temporary selector matching only
665 * to current session. */
666 xfrm_init_tempsel(x
, fl
, tmpl
, daddr
, saddr
, family
);
668 error
= security_xfrm_state_alloc_acquire(x
, pol
->security
, fl
->secid
);
670 x
->km
.state
= XFRM_STATE_DEAD
;
676 if (km_query(x
, tmpl
, pol
) == 0) {
677 x
->km
.state
= XFRM_STATE_ACQ
;
678 hlist_add_head(&x
->bydst
, xfrm_state_bydst
+h
);
680 h
= xfrm_src_hash(saddr
, family
);
681 hlist_add_head(&x
->bysrc
, xfrm_state_bysrc
+h
);
684 h
= xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
, x
->id
.proto
, family
);
685 hlist_add_head(&x
->byspi
, xfrm_state_byspi
+h
);
688 x
->lft
.hard_add_expires_seconds
= XFRM_ACQ_EXPIRES
;
690 x
->timer
.expires
= jiffies
+ XFRM_ACQ_EXPIRES
*HZ
;
691 add_timer(&x
->timer
);
693 x
->km
.state
= XFRM_STATE_DEAD
;
703 *err
= acquire_in_progress
? -EAGAIN
: error
;
704 spin_unlock_bh(&xfrm_state_lock
);
708 static void __xfrm_state_insert(struct xfrm_state
*x
)
712 x
->genid
= ++xfrm_state_genid
;
714 h
= xfrm_dst_hash(&x
->id
.daddr
, x
->props
.reqid
, x
->props
.family
);
715 hlist_add_head(&x
->bydst
, xfrm_state_bydst
+h
);
718 h
= xfrm_src_hash(&x
->props
.saddr
, x
->props
.family
);
719 hlist_add_head(&x
->bysrc
, xfrm_state_bysrc
+h
);
722 if (xfrm_id_proto_match(x
->id
.proto
, IPSEC_PROTO_ANY
)) {
723 h
= xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
, x
->id
.proto
,
726 hlist_add_head(&x
->byspi
, xfrm_state_byspi
+h
);
730 if (!mod_timer(&x
->timer
, jiffies
+ HZ
))
733 if (x
->replay_maxage
&&
734 !mod_timer(&x
->rtimer
, jiffies
+ x
->replay_maxage
))
741 if (x
->bydst
.next
!= NULL
&&
742 (xfrm_state_hmask
+ 1) < xfrm_state_hashmax
&&
743 xfrm_state_num
> xfrm_state_hmask
)
744 schedule_work(&xfrm_hash_work
);
747 /* xfrm_state_lock is held */
748 static void __xfrm_state_bump_genids(struct xfrm_state
*xnew
)
750 unsigned short family
= xnew
->props
.family
;
751 u32 reqid
= xnew
->props
.reqid
;
752 struct xfrm_state
*x
;
753 struct hlist_node
*entry
;
756 h
= xfrm_dst_hash(&xnew
->id
.daddr
, reqid
, family
);
757 hlist_for_each_entry(x
, entry
, xfrm_state_bydst
+h
, bydst
) {
758 if (x
->props
.family
== family
&&
759 x
->props
.reqid
== reqid
&&
760 !xfrm_addr_cmp(&x
->id
.daddr
, &xnew
->id
.daddr
, family
))
761 x
->genid
= xfrm_state_genid
;
765 void xfrm_state_insert(struct xfrm_state
*x
)
767 spin_lock_bh(&xfrm_state_lock
);
768 __xfrm_state_bump_genids(x
);
769 __xfrm_state_insert(x
);
770 spin_unlock_bh(&xfrm_state_lock
);
772 EXPORT_SYMBOL(xfrm_state_insert
);
774 /* xfrm_state_lock is held */
775 static struct xfrm_state
*__find_acq_core(unsigned short family
, u8 mode
, u32 reqid
, u8 proto
, xfrm_address_t
*daddr
, xfrm_address_t
*saddr
, int create
)
777 unsigned int h
= xfrm_dst_hash(daddr
, reqid
, family
);
778 struct hlist_node
*entry
;
779 struct xfrm_state
*x
;
781 hlist_for_each_entry(x
, entry
, xfrm_state_bydst
+h
, bydst
) {
782 if (x
->props
.reqid
!= reqid
||
783 x
->props
.mode
!= mode
||
784 x
->props
.family
!= family
||
785 x
->km
.state
!= XFRM_STATE_ACQ
||
791 if (x
->id
.daddr
.a4
!= daddr
->a4
||
792 x
->props
.saddr
.a4
!= saddr
->a4
)
796 if (!ipv6_addr_equal((struct in6_addr
*)x
->id
.daddr
.a6
,
797 (struct in6_addr
*)daddr
) ||
798 !ipv6_addr_equal((struct in6_addr
*)
800 (struct in6_addr
*)saddr
))
812 x
= xfrm_state_alloc();
816 x
->sel
.daddr
.a4
= daddr
->a4
;
817 x
->sel
.saddr
.a4
= saddr
->a4
;
818 x
->sel
.prefixlen_d
= 32;
819 x
->sel
.prefixlen_s
= 32;
820 x
->props
.saddr
.a4
= saddr
->a4
;
821 x
->id
.daddr
.a4
= daddr
->a4
;
825 ipv6_addr_copy((struct in6_addr
*)x
->sel
.daddr
.a6
,
826 (struct in6_addr
*)daddr
);
827 ipv6_addr_copy((struct in6_addr
*)x
->sel
.saddr
.a6
,
828 (struct in6_addr
*)saddr
);
829 x
->sel
.prefixlen_d
= 128;
830 x
->sel
.prefixlen_s
= 128;
831 ipv6_addr_copy((struct in6_addr
*)x
->props
.saddr
.a6
,
832 (struct in6_addr
*)saddr
);
833 ipv6_addr_copy((struct in6_addr
*)x
->id
.daddr
.a6
,
834 (struct in6_addr
*)daddr
);
838 x
->km
.state
= XFRM_STATE_ACQ
;
840 x
->props
.family
= family
;
841 x
->props
.mode
= mode
;
842 x
->props
.reqid
= reqid
;
843 x
->lft
.hard_add_expires_seconds
= XFRM_ACQ_EXPIRES
;
845 x
->timer
.expires
= jiffies
+ XFRM_ACQ_EXPIRES
*HZ
;
846 add_timer(&x
->timer
);
848 hlist_add_head(&x
->bydst
, xfrm_state_bydst
+h
);
849 h
= xfrm_src_hash(saddr
, family
);
851 hlist_add_head(&x
->bysrc
, xfrm_state_bysrc
+h
);
858 static struct xfrm_state
*__xfrm_find_acq_byseq(u32 seq
);
860 int xfrm_state_add(struct xfrm_state
*x
)
862 struct xfrm_state
*x1
;
865 int use_spi
= xfrm_id_proto_match(x
->id
.proto
, IPSEC_PROTO_ANY
);
867 family
= x
->props
.family
;
869 spin_lock_bh(&xfrm_state_lock
);
871 x1
= __xfrm_state_locate(x
, use_spi
, family
);
879 if (use_spi
&& x
->km
.seq
) {
880 x1
= __xfrm_find_acq_byseq(x
->km
.seq
);
881 if (x1
&& xfrm_addr_cmp(&x1
->id
.daddr
, &x
->id
.daddr
, family
)) {
888 x1
= __find_acq_core(family
, x
->props
.mode
, x
->props
.reqid
,
890 &x
->id
.daddr
, &x
->props
.saddr
, 0);
892 __xfrm_state_bump_genids(x
);
893 __xfrm_state_insert(x
);
897 spin_unlock_bh(&xfrm_state_lock
);
900 xfrm_state_delete(x1
);
906 EXPORT_SYMBOL(xfrm_state_add
);
908 int xfrm_state_update(struct xfrm_state
*x
)
910 struct xfrm_state
*x1
;
912 int use_spi
= xfrm_id_proto_match(x
->id
.proto
, IPSEC_PROTO_ANY
);
914 spin_lock_bh(&xfrm_state_lock
);
915 x1
= __xfrm_state_locate(x
, use_spi
, x
->props
.family
);
921 if (xfrm_state_kern(x1
)) {
927 if (x1
->km
.state
== XFRM_STATE_ACQ
) {
928 __xfrm_state_insert(x
);
934 spin_unlock_bh(&xfrm_state_lock
);
940 xfrm_state_delete(x1
);
946 spin_lock_bh(&x1
->lock
);
947 if (likely(x1
->km
.state
== XFRM_STATE_VALID
)) {
948 if (x
->encap
&& x1
->encap
)
949 memcpy(x1
->encap
, x
->encap
, sizeof(*x1
->encap
));
950 if (x
->coaddr
&& x1
->coaddr
) {
951 memcpy(x1
->coaddr
, x
->coaddr
, sizeof(*x1
->coaddr
));
953 if (!use_spi
&& memcmp(&x1
->sel
, &x
->sel
, sizeof(x1
->sel
)))
954 memcpy(&x1
->sel
, &x
->sel
, sizeof(x1
->sel
));
955 memcpy(&x1
->lft
, &x
->lft
, sizeof(x1
->lft
));
958 if (!mod_timer(&x1
->timer
, jiffies
+ HZ
))
960 if (x1
->curlft
.use_time
)
961 xfrm_state_check_expire(x1
);
965 spin_unlock_bh(&x1
->lock
);
971 EXPORT_SYMBOL(xfrm_state_update
);
973 int xfrm_state_check_expire(struct xfrm_state
*x
)
975 if (!x
->curlft
.use_time
)
976 x
->curlft
.use_time
= (unsigned long)xtime
.tv_sec
;
978 if (x
->km
.state
!= XFRM_STATE_VALID
)
981 if (x
->curlft
.bytes
>= x
->lft
.hard_byte_limit
||
982 x
->curlft
.packets
>= x
->lft
.hard_packet_limit
) {
983 x
->km
.state
= XFRM_STATE_EXPIRED
;
984 if (!mod_timer(&x
->timer
, jiffies
))
990 (x
->curlft
.bytes
>= x
->lft
.soft_byte_limit
||
991 x
->curlft
.packets
>= x
->lft
.soft_packet_limit
)) {
993 km_state_expired(x
, 0, 0);
997 EXPORT_SYMBOL(xfrm_state_check_expire
);
999 static int xfrm_state_check_space(struct xfrm_state
*x
, struct sk_buff
*skb
)
1001 int nhead
= x
->props
.header_len
+ LL_RESERVED_SPACE(skb
->dst
->dev
)
1002 - skb_headroom(skb
);
1005 return pskb_expand_head(skb
, nhead
, 0, GFP_ATOMIC
);
1007 /* Check tail too... */
1011 int xfrm_state_check(struct xfrm_state
*x
, struct sk_buff
*skb
)
1013 int err
= xfrm_state_check_expire(x
);
1016 err
= xfrm_state_check_space(x
, skb
);
1020 EXPORT_SYMBOL(xfrm_state_check
);
1023 xfrm_state_lookup(xfrm_address_t
*daddr
, u32 spi
, u8 proto
,
1024 unsigned short family
)
1026 struct xfrm_state
*x
;
1028 spin_lock_bh(&xfrm_state_lock
);
1029 x
= __xfrm_state_lookup(daddr
, spi
, proto
, family
);
1030 spin_unlock_bh(&xfrm_state_lock
);
1033 EXPORT_SYMBOL(xfrm_state_lookup
);
1036 xfrm_state_lookup_byaddr(xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
1037 u8 proto
, unsigned short family
)
1039 struct xfrm_state
*x
;
1041 spin_lock_bh(&xfrm_state_lock
);
1042 x
= __xfrm_state_lookup_byaddr(daddr
, saddr
, proto
, family
);
1043 spin_unlock_bh(&xfrm_state_lock
);
1046 EXPORT_SYMBOL(xfrm_state_lookup_byaddr
);
1049 xfrm_find_acq(u8 mode
, u32 reqid
, u8 proto
,
1050 xfrm_address_t
*daddr
, xfrm_address_t
*saddr
,
1051 int create
, unsigned short family
)
1053 struct xfrm_state
*x
;
1055 spin_lock_bh(&xfrm_state_lock
);
1056 x
= __find_acq_core(family
, mode
, reqid
, proto
, daddr
, saddr
, create
);
1057 spin_unlock_bh(&xfrm_state_lock
);
1061 EXPORT_SYMBOL(xfrm_find_acq
);
1063 #ifdef CONFIG_XFRM_SUB_POLICY
1065 xfrm_tmpl_sort(struct xfrm_tmpl
**dst
, struct xfrm_tmpl
**src
, int n
,
1066 unsigned short family
)
1069 struct xfrm_state_afinfo
*afinfo
= xfrm_state_get_afinfo(family
);
1071 return -EAFNOSUPPORT
;
1073 spin_lock_bh(&xfrm_state_lock
);
1074 if (afinfo
->tmpl_sort
)
1075 err
= afinfo
->tmpl_sort(dst
, src
, n
);
1076 spin_unlock_bh(&xfrm_state_lock
);
1077 xfrm_state_put_afinfo(afinfo
);
1080 EXPORT_SYMBOL(xfrm_tmpl_sort
);
1083 xfrm_state_sort(struct xfrm_state
**dst
, struct xfrm_state
**src
, int n
,
1084 unsigned short family
)
1087 struct xfrm_state_afinfo
*afinfo
= xfrm_state_get_afinfo(family
);
1089 return -EAFNOSUPPORT
;
1091 spin_lock_bh(&xfrm_state_lock
);
1092 if (afinfo
->state_sort
)
1093 err
= afinfo
->state_sort(dst
, src
, n
);
1094 spin_unlock_bh(&xfrm_state_lock
);
1095 xfrm_state_put_afinfo(afinfo
);
1098 EXPORT_SYMBOL(xfrm_state_sort
);
1101 /* Silly enough, but I'm lazy to build resolution list */
1103 static struct xfrm_state
*__xfrm_find_acq_byseq(u32 seq
)
1107 for (i
= 0; i
<= xfrm_state_hmask
; i
++) {
1108 struct hlist_node
*entry
;
1109 struct xfrm_state
*x
;
1111 hlist_for_each_entry(x
, entry
, xfrm_state_bydst
+i
, bydst
) {
1112 if (x
->km
.seq
== seq
&&
1113 x
->km
.state
== XFRM_STATE_ACQ
) {
1122 struct xfrm_state
*xfrm_find_acq_byseq(u32 seq
)
1124 struct xfrm_state
*x
;
1126 spin_lock_bh(&xfrm_state_lock
);
1127 x
= __xfrm_find_acq_byseq(seq
);
1128 spin_unlock_bh(&xfrm_state_lock
);
1131 EXPORT_SYMBOL(xfrm_find_acq_byseq
);
1133 u32
xfrm_get_acqseq(void)
1137 static DEFINE_SPINLOCK(acqseq_lock
);
1139 spin_lock_bh(&acqseq_lock
);
1140 res
= (++acqseq
? : ++acqseq
);
1141 spin_unlock_bh(&acqseq_lock
);
1144 EXPORT_SYMBOL(xfrm_get_acqseq
);
1147 xfrm_alloc_spi(struct xfrm_state
*x
, u32 minspi
, u32 maxspi
)
1150 struct xfrm_state
*x0
;
1155 if (minspi
== maxspi
) {
1156 x0
= xfrm_state_lookup(&x
->id
.daddr
, minspi
, x
->id
.proto
, x
->props
.family
);
1164 minspi
= ntohl(minspi
);
1165 maxspi
= ntohl(maxspi
);
1166 for (h
=0; h
<maxspi
-minspi
+1; h
++) {
1167 spi
= minspi
+ net_random()%(maxspi
-minspi
+1);
1168 x0
= xfrm_state_lookup(&x
->id
.daddr
, htonl(spi
), x
->id
.proto
, x
->props
.family
);
1170 x
->id
.spi
= htonl(spi
);
1177 spin_lock_bh(&xfrm_state_lock
);
1178 h
= xfrm_spi_hash(&x
->id
.daddr
, x
->id
.spi
, x
->id
.proto
, x
->props
.family
);
1179 hlist_add_head(&x
->byspi
, xfrm_state_byspi
+h
);
1181 spin_unlock_bh(&xfrm_state_lock
);
1185 EXPORT_SYMBOL(xfrm_alloc_spi
);
1187 int xfrm_state_walk(u8 proto
, int (*func
)(struct xfrm_state
*, int, void*),
1191 struct xfrm_state
*x
;
1192 struct hlist_node
*entry
;
1196 spin_lock_bh(&xfrm_state_lock
);
1197 for (i
= 0; i
<= xfrm_state_hmask
; i
++) {
1198 hlist_for_each_entry(x
, entry
, xfrm_state_bydst
+i
, bydst
) {
1199 if (xfrm_id_proto_match(x
->id
.proto
, proto
))
1208 for (i
= 0; i
<= xfrm_state_hmask
; i
++) {
1209 hlist_for_each_entry(x
, entry
, xfrm_state_bydst
+i
, bydst
) {
1210 if (!xfrm_id_proto_match(x
->id
.proto
, proto
))
1212 err
= func(x
, --count
, data
);
1218 spin_unlock_bh(&xfrm_state_lock
);
1221 EXPORT_SYMBOL(xfrm_state_walk
);
1224 void xfrm_replay_notify(struct xfrm_state
*x
, int event
)
1227 /* we send notify messages in case
1228 * 1. we updated on of the sequence numbers, and the seqno difference
1229 * is at least x->replay_maxdiff, in this case we also update the
1230 * timeout of our timer function
1231 * 2. if x->replay_maxage has elapsed since last update,
1232 * and there were changes
1234 * The state structure must be locked!
1238 case XFRM_REPLAY_UPDATE
:
1239 if (x
->replay_maxdiff
&&
1240 (x
->replay
.seq
- x
->preplay
.seq
< x
->replay_maxdiff
) &&
1241 (x
->replay
.oseq
- x
->preplay
.oseq
< x
->replay_maxdiff
)) {
1242 if (x
->xflags
& XFRM_TIME_DEFER
)
1243 event
= XFRM_REPLAY_TIMEOUT
;
1250 case XFRM_REPLAY_TIMEOUT
:
1251 if ((x
->replay
.seq
== x
->preplay
.seq
) &&
1252 (x
->replay
.bitmap
== x
->preplay
.bitmap
) &&
1253 (x
->replay
.oseq
== x
->preplay
.oseq
)) {
1254 x
->xflags
|= XFRM_TIME_DEFER
;
1261 memcpy(&x
->preplay
, &x
->replay
, sizeof(struct xfrm_replay_state
));
1262 c
.event
= XFRM_MSG_NEWAE
;
1263 c
.data
.aevent
= event
;
1264 km_state_notify(x
, &c
);
1266 if (x
->replay_maxage
&&
1267 !mod_timer(&x
->rtimer
, jiffies
+ x
->replay_maxage
)) {
1269 x
->xflags
&= ~XFRM_TIME_DEFER
;
1272 EXPORT_SYMBOL(xfrm_replay_notify
);
1274 static void xfrm_replay_timer_handler(unsigned long data
)
1276 struct xfrm_state
*x
= (struct xfrm_state
*)data
;
1278 spin_lock(&x
->lock
);
1280 if (x
->km
.state
== XFRM_STATE_VALID
) {
1281 if (xfrm_aevent_is_on())
1282 xfrm_replay_notify(x
, XFRM_REPLAY_TIMEOUT
);
1284 x
->xflags
|= XFRM_TIME_DEFER
;
1287 spin_unlock(&x
->lock
);
1291 int xfrm_replay_check(struct xfrm_state
*x
, u32 seq
)
1297 if (unlikely(seq
== 0))
1300 if (likely(seq
> x
->replay
.seq
))
1303 diff
= x
->replay
.seq
- seq
;
1304 if (diff
>= x
->props
.replay_window
) {
1305 x
->stats
.replay_window
++;
1309 if (x
->replay
.bitmap
& (1U << diff
)) {
1315 EXPORT_SYMBOL(xfrm_replay_check
);
1317 void xfrm_replay_advance(struct xfrm_state
*x
, u32 seq
)
1323 if (seq
> x
->replay
.seq
) {
1324 diff
= seq
- x
->replay
.seq
;
1325 if (diff
< x
->props
.replay_window
)
1326 x
->replay
.bitmap
= ((x
->replay
.bitmap
) << diff
) | 1;
1328 x
->replay
.bitmap
= 1;
1329 x
->replay
.seq
= seq
;
1331 diff
= x
->replay
.seq
- seq
;
1332 x
->replay
.bitmap
|= (1U << diff
);
1335 if (xfrm_aevent_is_on())
1336 xfrm_replay_notify(x
, XFRM_REPLAY_UPDATE
);
1338 EXPORT_SYMBOL(xfrm_replay_advance
);
1340 static struct list_head xfrm_km_list
= LIST_HEAD_INIT(xfrm_km_list
);
1341 static DEFINE_RWLOCK(xfrm_km_lock
);
1343 void km_policy_notify(struct xfrm_policy
*xp
, int dir
, struct km_event
*c
)
1345 struct xfrm_mgr
*km
;
1347 read_lock(&xfrm_km_lock
);
1348 list_for_each_entry(km
, &xfrm_km_list
, list
)
1349 if (km
->notify_policy
)
1350 km
->notify_policy(xp
, dir
, c
);
1351 read_unlock(&xfrm_km_lock
);
1354 void km_state_notify(struct xfrm_state
*x
, struct km_event
*c
)
1356 struct xfrm_mgr
*km
;
1357 read_lock(&xfrm_km_lock
);
1358 list_for_each_entry(km
, &xfrm_km_list
, list
)
1361 read_unlock(&xfrm_km_lock
);
1364 EXPORT_SYMBOL(km_policy_notify
);
1365 EXPORT_SYMBOL(km_state_notify
);
1367 void km_state_expired(struct xfrm_state
*x
, int hard
, u32 pid
)
1373 c
.event
= XFRM_MSG_EXPIRE
;
1374 km_state_notify(x
, &c
);
1380 EXPORT_SYMBOL(km_state_expired
);
1382 * We send to all registered managers regardless of failure
1383 * We are happy with one success
1385 int km_query(struct xfrm_state
*x
, struct xfrm_tmpl
*t
, struct xfrm_policy
*pol
)
1387 int err
= -EINVAL
, acqret
;
1388 struct xfrm_mgr
*km
;
1390 read_lock(&xfrm_km_lock
);
1391 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1392 acqret
= km
->acquire(x
, t
, pol
, XFRM_POLICY_OUT
);
1396 read_unlock(&xfrm_km_lock
);
1399 EXPORT_SYMBOL(km_query
);
1401 int km_new_mapping(struct xfrm_state
*x
, xfrm_address_t
*ipaddr
, u16 sport
)
1404 struct xfrm_mgr
*km
;
1406 read_lock(&xfrm_km_lock
);
1407 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1408 if (km
->new_mapping
)
1409 err
= km
->new_mapping(x
, ipaddr
, sport
);
1413 read_unlock(&xfrm_km_lock
);
1416 EXPORT_SYMBOL(km_new_mapping
);
1418 void km_policy_expired(struct xfrm_policy
*pol
, int dir
, int hard
, u32 pid
)
1424 c
.event
= XFRM_MSG_POLEXPIRE
;
1425 km_policy_notify(pol
, dir
, &c
);
1430 EXPORT_SYMBOL(km_policy_expired
);
1432 int km_report(u8 proto
, struct xfrm_selector
*sel
, xfrm_address_t
*addr
)
1436 struct xfrm_mgr
*km
;
1438 read_lock(&xfrm_km_lock
);
1439 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1441 ret
= km
->report(proto
, sel
, addr
);
1446 read_unlock(&xfrm_km_lock
);
1449 EXPORT_SYMBOL(km_report
);
1451 int xfrm_user_policy(struct sock
*sk
, int optname
, u8 __user
*optval
, int optlen
)
1455 struct xfrm_mgr
*km
;
1456 struct xfrm_policy
*pol
= NULL
;
1458 if (optlen
<= 0 || optlen
> PAGE_SIZE
)
1461 data
= kmalloc(optlen
, GFP_KERNEL
);
1466 if (copy_from_user(data
, optval
, optlen
))
1470 read_lock(&xfrm_km_lock
);
1471 list_for_each_entry(km
, &xfrm_km_list
, list
) {
1472 pol
= km
->compile_policy(sk
, optname
, data
,
1477 read_unlock(&xfrm_km_lock
);
1480 xfrm_sk_policy_insert(sk
, err
, pol
);
1489 EXPORT_SYMBOL(xfrm_user_policy
);
1491 int xfrm_register_km(struct xfrm_mgr
*km
)
1493 write_lock_bh(&xfrm_km_lock
);
1494 list_add_tail(&km
->list
, &xfrm_km_list
);
1495 write_unlock_bh(&xfrm_km_lock
);
1498 EXPORT_SYMBOL(xfrm_register_km
);
1500 int xfrm_unregister_km(struct xfrm_mgr
*km
)
1502 write_lock_bh(&xfrm_km_lock
);
1503 list_del(&km
->list
);
1504 write_unlock_bh(&xfrm_km_lock
);
1507 EXPORT_SYMBOL(xfrm_unregister_km
);
1509 int xfrm_state_register_afinfo(struct xfrm_state_afinfo
*afinfo
)
1512 if (unlikely(afinfo
== NULL
))
1514 if (unlikely(afinfo
->family
>= NPROTO
))
1515 return -EAFNOSUPPORT
;
1516 write_lock_bh(&xfrm_state_afinfo_lock
);
1517 if (unlikely(xfrm_state_afinfo
[afinfo
->family
] != NULL
))
1520 xfrm_state_afinfo
[afinfo
->family
] = afinfo
;
1521 write_unlock_bh(&xfrm_state_afinfo_lock
);
1524 EXPORT_SYMBOL(xfrm_state_register_afinfo
);
1526 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo
*afinfo
)
1529 if (unlikely(afinfo
== NULL
))
1531 if (unlikely(afinfo
->family
>= NPROTO
))
1532 return -EAFNOSUPPORT
;
1533 write_lock_bh(&xfrm_state_afinfo_lock
);
1534 if (likely(xfrm_state_afinfo
[afinfo
->family
] != NULL
)) {
1535 if (unlikely(xfrm_state_afinfo
[afinfo
->family
] != afinfo
))
1538 xfrm_state_afinfo
[afinfo
->family
] = NULL
;
1540 write_unlock_bh(&xfrm_state_afinfo_lock
);
1543 EXPORT_SYMBOL(xfrm_state_unregister_afinfo
);
1545 static struct xfrm_state_afinfo
*xfrm_state_get_afinfo(unsigned short family
)
1547 struct xfrm_state_afinfo
*afinfo
;
1548 if (unlikely(family
>= NPROTO
))
1550 read_lock(&xfrm_state_afinfo_lock
);
1551 afinfo
= xfrm_state_afinfo
[family
];
1552 if (unlikely(!afinfo
))
1553 read_unlock(&xfrm_state_afinfo_lock
);
1557 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo
*afinfo
)
1559 read_unlock(&xfrm_state_afinfo_lock
);
1562 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
1563 void xfrm_state_delete_tunnel(struct xfrm_state
*x
)
1566 struct xfrm_state
*t
= x
->tunnel
;
1568 if (atomic_read(&t
->tunnel_users
) == 2)
1569 xfrm_state_delete(t
);
1570 atomic_dec(&t
->tunnel_users
);
1575 EXPORT_SYMBOL(xfrm_state_delete_tunnel
);
1578 * This function is NOT optimal. For example, with ESP it will give an
1579 * MTU that's usually two bytes short of being optimal. However, it will
1580 * usually give an answer that's a multiple of 4 provided the input is
1581 * also a multiple of 4.
1583 int xfrm_state_mtu(struct xfrm_state
*x
, int mtu
)
1587 res
-= x
->props
.header_len
;
1595 spin_lock_bh(&x
->lock
);
1596 if (x
->km
.state
== XFRM_STATE_VALID
&&
1597 x
->type
&& x
->type
->get_max_size
)
1598 m
= x
->type
->get_max_size(x
, m
);
1600 m
+= x
->props
.header_len
;
1601 spin_unlock_bh(&x
->lock
);
1611 int xfrm_init_state(struct xfrm_state
*x
)
1613 struct xfrm_state_afinfo
*afinfo
;
1614 int family
= x
->props
.family
;
1617 err
= -EAFNOSUPPORT
;
1618 afinfo
= xfrm_state_get_afinfo(family
);
1623 if (afinfo
->init_flags
)
1624 err
= afinfo
->init_flags(x
);
1626 xfrm_state_put_afinfo(afinfo
);
1631 err
= -EPROTONOSUPPORT
;
1632 x
->type
= xfrm_get_type(x
->id
.proto
, family
);
1633 if (x
->type
== NULL
)
1636 err
= x
->type
->init_state(x
);
1640 x
->mode
= xfrm_get_mode(x
->props
.mode
, family
);
1641 if (x
->mode
== NULL
)
1644 x
->km
.state
= XFRM_STATE_VALID
;
1650 EXPORT_SYMBOL(xfrm_init_state
);
1652 void __init
xfrm_state_init(void)
1656 sz
= sizeof(struct hlist_head
) * 8;
1658 xfrm_state_bydst
= xfrm_state_hash_alloc(sz
);
1659 xfrm_state_bysrc
= xfrm_state_hash_alloc(sz
);
1660 xfrm_state_byspi
= xfrm_state_hash_alloc(sz
);
1661 if (!xfrm_state_bydst
|| !xfrm_state_bysrc
|| !xfrm_state_byspi
)
1662 panic("XFRM: Cannot allocate bydst/bysrc/byspi hashes.");
1663 xfrm_state_hmask
= ((sz
/ sizeof(struct hlist_head
)) - 1);
1665 INIT_WORK(&xfrm_state_gc_work
, xfrm_state_gc_task
, NULL
);