[XFRM]: Extension for dynamic update of endpoint address(es)

Extend the XFRM framework so that endpoint address(es) in the XFRM
databases could be dynamically updated according to a request (MIGRATE
message) from user application. Target XFRM policy is first identified
by the selector in the MIGRATE message. Next, the endpoint addresses
of the matching templates and XFRM states are updated according to
the MIGRATE message.

Signed-off-by: Shinta Sugimoto <shinta.sugimoto@ericsson.com>
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 174 insertions, 0 deletions

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 24f7bfd07af2..91b02687db52 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -828,6 +828,160 @@ out:
 }
 EXPORT_SYMBOL(xfrm_state_add);
 
+#ifdef CONFIG_XFRM_MIGRATE
+struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
+{
+        int err = -ENOMEM;
+        struct xfrm_state *x = xfrm_state_alloc();
+        if (!x)
+                goto error;
+
+        memcpy(&x->id, &orig->id, sizeof(x->id));
+        memcpy(&x->sel, &orig->sel, sizeof(x->sel));
+        memcpy(&x->lft, &orig->lft, sizeof(x->lft));
+        x->props.mode = orig->props.mode;
+        x->props.replay_window = orig->props.replay_window;
+        x->props.reqid = orig->props.reqid;
+        x->props.family = orig->props.family;
+        x->props.saddr = orig->props.saddr;
+
+        if (orig->aalg) {
+                x->aalg = xfrm_algo_clone(orig->aalg);
+                if (!x->aalg)
+                        goto error;
+        }
+        x->props.aalgo = orig->props.aalgo;
+
+        if (orig->ealg) {
+                x->ealg = xfrm_algo_clone(orig->ealg);
+                if (!x->ealg)
+                        goto error;
+        }
+        x->props.ealgo = orig->props.ealgo;
+
+        if (orig->calg) {
+                x->calg = xfrm_algo_clone(orig->calg);
+                if (!x->calg)
+                        goto error;
+        }
+        x->props.calgo = orig->props.calgo;
+
+        if (orig->encap) {
+                x->encap = kmemdup(orig->encap, sizeof(*x->encap), GFP_KERNEL);
+                if (!x->encap)
+                        goto error;
+        }
+
+        if (orig->coaddr) {
+                x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
+                                    GFP_KERNEL);
+                if (!x->coaddr)
+                        goto error;
+        }
+
+        err = xfrm_init_state(x);
+        if (err)
+                goto error;
+
+        x->props.flags = orig->props.flags;
+
+        x->curlft.add_time = orig->curlft.add_time;
+        x->km.state = orig->km.state;
+        x->km.seq = orig->km.seq;
+
+        return x;
+
+ error:
+        if (errp)
+                *errp = err;
+        if (x) {
+                kfree(x->aalg);
+                kfree(x->ealg);
+                kfree(x->calg);
+                kfree(x->encap);
+                kfree(x->coaddr);
+        }
+        kfree(x);
+        return NULL;
+}
+EXPORT_SYMBOL(xfrm_state_clone);
+
+/* xfrm_state_lock is held */
+struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
+{
+        unsigned int h;
+        struct xfrm_state *x;
+        struct hlist_node *entry;
+
+        if (m->reqid) {
+                h = xfrm_dst_hash(&m->old_daddr, &m->old_saddr,
+                                  m->reqid, m->old_family);
+                hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
+                        if (x->props.mode != m->mode ||
+                            x->id.proto != m->proto)
+                                continue;
+                        if (m->reqid && x->props.reqid != m->reqid)
+                                continue;
+                        if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
+                                          m->old_family) ||
+                            xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
+                                          m->old_family))
+                                continue;
+                        xfrm_state_hold(x);
+                        return x;
+                }
+        } else {
+                h = xfrm_src_hash(&m->old_daddr, &m->old_saddr,
+                                  m->old_family);
+                hlist_for_each_entry(x, entry, xfrm_state_bysrc+h, bysrc) {
+                        if (x->props.mode != m->mode ||
+                            x->id.proto != m->proto)
+                                continue;
+                        if (xfrm_addr_cmp(&x->id.daddr, &m->old_daddr,
+                                          m->old_family) ||
+                            xfrm_addr_cmp(&x->props.saddr, &m->old_saddr,
+                                          m->old_family))
+                                continue;
+                        xfrm_state_hold(x);
+                        return x;
+                }
+        }
+
+        return NULL;
+}
+EXPORT_SYMBOL(xfrm_migrate_state_find);
+
+struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
+                                       struct xfrm_migrate *m)
+{
+        struct xfrm_state *xc;
+        int err;
+
+        xc = xfrm_state_clone(x, &err);
+        if (!xc)
+                return NULL;
+
+        memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
+        memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
+
+        /* add state */
+        if (!xfrm_addr_cmp(&x->id.daddr, &m->new_daddr, m->new_family)) {
+                /* a care is needed when the destination address of the
+                   state is to be updated as it is a part of triplet */
+                xfrm_state_insert(xc);
+        } else {
+                if ((err = xfrm_state_add(xc)) < 0)
+                        goto error;
+        }
+
+        return xc;
+error:
+        kfree(xc);
+        return NULL;
+}
+EXPORT_SYMBOL(xfrm_state_migrate);
+#endif
+
 int xfrm_state_update(struct xfrm_state *x)
 {
         struct xfrm_state *x1;
@@ -1342,6 +1496,26 @@ void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
 }
 EXPORT_SYMBOL(km_policy_expired);
 
+int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
+               struct xfrm_migrate *m, int num_migrate)
+{
+        int err = -EINVAL;
+        int ret;
+        struct xfrm_mgr *km;
+
+        read_lock(&xfrm_km_lock);
+        list_for_each_entry(km, &xfrm_km_list, list) {
+                if (km->migrate) {
+                        ret = km->migrate(sel, dir, type, m, num_migrate);
+                        if (!ret)
+                                err = ret;
+                }
+        }
+        read_unlock(&xfrm_km_lock);
+        return err;
+}
+EXPORT_SYMBOL(km_migrate);
+
 int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr)
 {
         int err = -EINVAL;