aboutsummaryrefslogtreecommitdiffstats
path: root/net/xfrm
diff options
context:
space:
mode:
authorGlenn Elliott <gelliott@cs.unc.edu>2012-03-04 19:47:13 -0500
committerGlenn Elliott <gelliott@cs.unc.edu>2012-03-04 19:47:13 -0500
commitc71c03bda1e86c9d5198c5d83f712e695c4f2a1e (patch)
treeecb166cb3e2b7e2adb3b5e292245fefd23381ac8 /net/xfrm
parentea53c912f8a86a8567697115b6a0d8152beee5c8 (diff)
parent6a00f206debf8a5c8899055726ad127dbeeed098 (diff)
Merge branch 'mpi-master' into wip-k-fmlpwip-k-fmlp
Conflicts: litmus/sched_cedf.c
Diffstat (limited to 'net/xfrm')
-rw-r--r--net/xfrm/Makefile2
-rw-r--r--net/xfrm/xfrm_algo.c8
-rw-r--r--net/xfrm/xfrm_hash.c2
-rw-r--r--net/xfrm/xfrm_hash.h32
-rw-r--r--net/xfrm/xfrm_input.c15
-rw-r--r--net/xfrm/xfrm_output.c19
-rw-r--r--net/xfrm/xfrm_policy.c257
-rw-r--r--net/xfrm/xfrm_replay.c550
-rw-r--r--net/xfrm/xfrm_state.c212
-rw-r--r--net/xfrm/xfrm_user.c267
10 files changed, 1001 insertions, 363 deletions
diff --git a/net/xfrm/Makefile b/net/xfrm/Makefile
index c631047e1b27..aa429eefe919 100644
--- a/net/xfrm/Makefile
+++ b/net/xfrm/Makefile
@@ -4,7 +4,7 @@
4 4
5obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \ 5obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \
6 xfrm_input.o xfrm_output.o xfrm_algo.o \ 6 xfrm_input.o xfrm_output.o xfrm_algo.o \
7 xfrm_sysctl.o 7 xfrm_sysctl.o xfrm_replay.o
8obj-$(CONFIG_XFRM_STATISTICS) += xfrm_proc.o 8obj-$(CONFIG_XFRM_STATISTICS) += xfrm_proc.o
9obj-$(CONFIG_XFRM_USER) += xfrm_user.o 9obj-$(CONFIG_XFRM_USER) += xfrm_user.o
10obj-$(CONFIG_XFRM_IPCOMP) += xfrm_ipcomp.o 10obj-$(CONFIG_XFRM_IPCOMP) += xfrm_ipcomp.o
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 8b4d6e3246e5..58064d9e565d 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -618,21 +618,21 @@ static int xfrm_alg_name_match(const struct xfrm_algo_desc *entry,
618 (entry->compat && !strcmp(name, entry->compat))); 618 (entry->compat && !strcmp(name, entry->compat)));
619} 619}
620 620
621struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe) 621struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe)
622{ 622{
623 return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_name_match, name, 623 return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_name_match, name,
624 probe); 624 probe);
625} 625}
626EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname); 626EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
627 627
628struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe) 628struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe)
629{ 629{
630 return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_name_match, name, 630 return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_name_match, name,
631 probe); 631 probe);
632} 632}
633EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname); 633EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
634 634
635struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe) 635struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe)
636{ 636{
637 return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_name_match, name, 637 return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_name_match, name,
638 probe); 638 probe);
@@ -654,7 +654,7 @@ static int xfrm_aead_name_match(const struct xfrm_algo_desc *entry,
654 !strcmp(name, entry->name); 654 !strcmp(name, entry->name);
655} 655}
656 656
657struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len, int probe) 657struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, int probe)
658{ 658{
659 struct xfrm_aead_name data = { 659 struct xfrm_aead_name data = {
660 .name = name, 660 .name = name,
diff --git a/net/xfrm/xfrm_hash.c b/net/xfrm/xfrm_hash.c
index a2023ec52329..1e98bc0fe0a5 100644
--- a/net/xfrm/xfrm_hash.c
+++ b/net/xfrm/xfrm_hash.c
@@ -19,7 +19,7 @@ struct hlist_head *xfrm_hash_alloc(unsigned int sz)
19 if (sz <= PAGE_SIZE) 19 if (sz <= PAGE_SIZE)
20 n = kzalloc(sz, GFP_KERNEL); 20 n = kzalloc(sz, GFP_KERNEL);
21 else if (hashdist) 21 else if (hashdist)
22 n = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL); 22 n = vzalloc(sz);
23 else 23 else
24 n = (struct hlist_head *) 24 n = (struct hlist_head *)
25 __get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO, 25 __get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index 8e69533d2313..7199d78b2aa1 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -4,29 +4,32 @@
4#include <linux/xfrm.h> 4#include <linux/xfrm.h>
5#include <linux/socket.h> 5#include <linux/socket.h>
6 6
7static inline unsigned int __xfrm4_addr_hash(xfrm_address_t *addr) 7static inline unsigned int __xfrm4_addr_hash(const xfrm_address_t *addr)
8{ 8{
9 return ntohl(addr->a4); 9 return ntohl(addr->a4);
10} 10}
11 11
12static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr) 12static inline unsigned int __xfrm6_addr_hash(const xfrm_address_t *addr)
13{ 13{
14 return ntohl(addr->a6[2] ^ addr->a6[3]); 14 return ntohl(addr->a6[2] ^ addr->a6[3]);
15} 15}
16 16
17static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr) 17static inline unsigned int __xfrm4_daddr_saddr_hash(const xfrm_address_t *daddr,
18 const xfrm_address_t *saddr)
18{ 19{
19 u32 sum = (__force u32)daddr->a4 + (__force u32)saddr->a4; 20 u32 sum = (__force u32)daddr->a4 + (__force u32)saddr->a4;
20 return ntohl((__force __be32)sum); 21 return ntohl((__force __be32)sum);
21} 22}
22 23
23static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr) 24static inline unsigned int __xfrm6_daddr_saddr_hash(const xfrm_address_t *daddr,
25 const xfrm_address_t *saddr)
24{ 26{
25 return ntohl(daddr->a6[2] ^ daddr->a6[3] ^ 27 return ntohl(daddr->a6[2] ^ daddr->a6[3] ^
26 saddr->a6[2] ^ saddr->a6[3]); 28 saddr->a6[2] ^ saddr->a6[3]);
27} 29}
28 30
29static inline unsigned int __xfrm_dst_hash(xfrm_address_t *daddr, xfrm_address_t *saddr, 31static inline unsigned int __xfrm_dst_hash(const xfrm_address_t *daddr,
32 const xfrm_address_t *saddr,
30 u32 reqid, unsigned short family, 33 u32 reqid, unsigned short family,
31 unsigned int hmask) 34 unsigned int hmask)
32{ 35{
@@ -42,8 +45,8 @@ static inline unsigned int __xfrm_dst_hash(xfrm_address_t *daddr, xfrm_address_t
42 return (h ^ (h >> 16)) & hmask; 45 return (h ^ (h >> 16)) & hmask;
43} 46}
44 47
45static inline unsigned __xfrm_src_hash(xfrm_address_t *daddr, 48static inline unsigned __xfrm_src_hash(const xfrm_address_t *daddr,
46 xfrm_address_t *saddr, 49 const xfrm_address_t *saddr,
47 unsigned short family, 50 unsigned short family,
48 unsigned int hmask) 51 unsigned int hmask)
49{ 52{
@@ -60,8 +63,8 @@ static inline unsigned __xfrm_src_hash(xfrm_address_t *daddr,
60} 63}
61 64
62static inline unsigned int 65static inline unsigned int
63__xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family, 66__xfrm_spi_hash(const xfrm_address_t *daddr, __be32 spi, u8 proto,
64 unsigned int hmask) 67 unsigned short family, unsigned int hmask)
65{ 68{
66 unsigned int h = (__force u32)spi ^ proto; 69 unsigned int h = (__force u32)spi ^ proto;
67 switch (family) { 70 switch (family) {
@@ -80,10 +83,11 @@ static inline unsigned int __idx_hash(u32 index, unsigned int hmask)
80 return (index ^ (index >> 8)) & hmask; 83 return (index ^ (index >> 8)) & hmask;
81} 84}
82 85
83static inline unsigned int __sel_hash(struct xfrm_selector *sel, unsigned short family, unsigned int hmask) 86static inline unsigned int __sel_hash(const struct xfrm_selector *sel,
87 unsigned short family, unsigned int hmask)
84{ 88{
85 xfrm_address_t *daddr = &sel->daddr; 89 const xfrm_address_t *daddr = &sel->daddr;
86 xfrm_address_t *saddr = &sel->saddr; 90 const xfrm_address_t *saddr = &sel->saddr;
87 unsigned int h = 0; 91 unsigned int h = 0;
88 92
89 switch (family) { 93 switch (family) {
@@ -107,7 +111,9 @@ static inline unsigned int __sel_hash(struct xfrm_selector *sel, unsigned short
107 return h & hmask; 111 return h & hmask;
108} 112}
109 113
110static inline unsigned int __addr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr, unsigned short family, unsigned int hmask) 114static inline unsigned int __addr_hash(const xfrm_address_t *daddr,
115 const xfrm_address_t *saddr,
116 unsigned short family, unsigned int hmask)
111{ 117{
112 unsigned int h = 0; 118 unsigned int h = 0;
113 119
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 45f1c98d4fce..a026b0ef2443 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -107,6 +107,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
107 struct net *net = dev_net(skb->dev); 107 struct net *net = dev_net(skb->dev);
108 int err; 108 int err;
109 __be32 seq; 109 __be32 seq;
110 __be32 seq_hi;
110 struct xfrm_state *x; 111 struct xfrm_state *x;
111 xfrm_address_t *daddr; 112 xfrm_address_t *daddr;
112 struct xfrm_mode *inner_mode; 113 struct xfrm_mode *inner_mode;
@@ -118,7 +119,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
118 if (encap_type < 0) { 119 if (encap_type < 0) {
119 async = 1; 120 async = 1;
120 x = xfrm_input_state(skb); 121 x = xfrm_input_state(skb);
121 seq = XFRM_SKB_CB(skb)->seq.input; 122 seq = XFRM_SKB_CB(skb)->seq.input.low;
122 goto resume; 123 goto resume;
123 } 124 }
124 125
@@ -172,7 +173,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
172 goto drop_unlock; 173 goto drop_unlock;
173 } 174 }
174 175
175 if (x->props.replay_window && xfrm_replay_check(x, skb, seq)) { 176 if (x->repl->check(x, skb, seq)) {
176 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR); 177 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
177 goto drop_unlock; 178 goto drop_unlock;
178 } 179 }
@@ -184,7 +185,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
184 185
185 spin_unlock(&x->lock); 186 spin_unlock(&x->lock);
186 187
187 XFRM_SKB_CB(skb)->seq.input = seq; 188 seq_hi = htonl(xfrm_replay_seqhi(x, seq));
189
190 XFRM_SKB_CB(skb)->seq.input.low = seq;
191 XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
192
193 skb_dst_force(skb);
188 194
189 nexthdr = x->type->input(x, skb); 195 nexthdr = x->type->input(x, skb);
190 196
@@ -206,8 +212,7 @@ resume:
206 /* only the first xfrm gets the encap type */ 212 /* only the first xfrm gets the encap type */
207 encap_type = 0; 213 encap_type = 0;
208 214
209 if (x->props.replay_window) 215 x->repl->advance(x, seq);
210 xfrm_replay_advance(x, seq);
211 216
212 x->curlft.bytes += skb->len; 217 x->curlft.bytes += skb->len;
213 x->curlft.packets++; 218 x->curlft.packets++;
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 64f2ae1fdc15..47bacd8c0250 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -67,17 +67,10 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
67 goto error; 67 goto error;
68 } 68 }
69 69
70 if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { 70 err = x->repl->overflow(x, skb);
71 XFRM_SKB_CB(skb)->seq.output = ++x->replay.oseq; 71 if (err) {
72 if (unlikely(x->replay.oseq == 0)) { 72 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR);
73 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); 73 goto error;
74 x->replay.oseq--;
75 xfrm_audit_state_replay_overflow(x, skb);
76 err = -EOVERFLOW;
77 goto error;
78 }
79 if (xfrm_aevent_is_on(net))
80 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
81 } 74 }
82 75
83 x->curlft.bytes += skb->len; 76 x->curlft.bytes += skb->len;
@@ -85,6 +78,8 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
85 78
86 spin_unlock_bh(&x->lock); 79 spin_unlock_bh(&x->lock);
87 80
81 skb_dst_force(skb);
82
88 err = x->type->output(x, skb); 83 err = x->type->output(x, skb);
89 if (err == -EINPROGRESS) 84 if (err == -EINPROGRESS)
90 goto out_exit; 85 goto out_exit;
@@ -101,7 +96,7 @@ resume:
101 err = -EHOSTUNREACH; 96 err = -EHOSTUNREACH;
102 goto error_nolock; 97 goto error_nolock;
103 } 98 }
104 skb_dst_set(skb, dst_clone(dst)); 99 skb_dst_set(skb, dst);
105 x = dst->xfrm; 100 x = dst->xfrm;
106 } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); 101 } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
107 102
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cbab6e1a8c9c..5ce74a385525 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -50,34 +50,40 @@ static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
50static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo); 50static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
51static void xfrm_init_pmtu(struct dst_entry *dst); 51static void xfrm_init_pmtu(struct dst_entry *dst);
52static int stale_bundle(struct dst_entry *dst); 52static int stale_bundle(struct dst_entry *dst);
53static int xfrm_bundle_ok(struct xfrm_dst *xdst);
54
53 55
54static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, 56static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
55 int dir); 57 int dir);
56 58
57static inline int 59static inline int
58__xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl) 60__xfrm4_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
59{ 61{
60 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) && 62 const struct flowi4 *fl4 = &fl->u.ip4;
61 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) && 63
62 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 64 return addr_match(&fl4->daddr, &sel->daddr, sel->prefixlen_d) &&
63 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 65 addr_match(&fl4->saddr, &sel->saddr, sel->prefixlen_s) &&
64 (fl->proto == sel->proto || !sel->proto) && 66 !((xfrm_flowi_dport(fl, &fl4->uli) ^ sel->dport) & sel->dport_mask) &&
65 (fl->oif == sel->ifindex || !sel->ifindex); 67 !((xfrm_flowi_sport(fl, &fl4->uli) ^ sel->sport) & sel->sport_mask) &&
68 (fl4->flowi4_proto == sel->proto || !sel->proto) &&
69 (fl4->flowi4_oif == sel->ifindex || !sel->ifindex);
66} 70}
67 71
68static inline int 72static inline int
69__xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl) 73__xfrm6_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
70{ 74{
71 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) && 75 const struct flowi6 *fl6 = &fl->u.ip6;
72 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) && 76
73 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 77 return addr_match(&fl6->daddr, &sel->daddr, sel->prefixlen_d) &&
74 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 78 addr_match(&fl6->saddr, &sel->saddr, sel->prefixlen_s) &&
75 (fl->proto == sel->proto || !sel->proto) && 79 !((xfrm_flowi_dport(fl, &fl6->uli) ^ sel->dport) & sel->dport_mask) &&
76 (fl->oif == sel->ifindex || !sel->ifindex); 80 !((xfrm_flowi_sport(fl, &fl6->uli) ^ sel->sport) & sel->sport_mask) &&
81 (fl6->flowi6_proto == sel->proto || !sel->proto) &&
82 (fl6->flowi6_oif == sel->ifindex || !sel->ifindex);
77} 83}
78 84
79int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl, 85int xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
80 unsigned short family) 86 unsigned short family)
81{ 87{
82 switch (family) { 88 switch (family) {
83 case AF_INET: 89 case AF_INET:
@@ -89,8 +95,8 @@ int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
89} 95}
90 96
91static inline struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, 97static inline struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos,
92 xfrm_address_t *saddr, 98 const xfrm_address_t *saddr,
93 xfrm_address_t *daddr, 99 const xfrm_address_t *daddr,
94 int family) 100 int family)
95{ 101{
96 struct xfrm_policy_afinfo *afinfo; 102 struct xfrm_policy_afinfo *afinfo;
@@ -308,7 +314,9 @@ static inline unsigned int idx_hash(struct net *net, u32 index)
308 return __idx_hash(index, net->xfrm.policy_idx_hmask); 314 return __idx_hash(index, net->xfrm.policy_idx_hmask);
309} 315}
310 316
311static struct hlist_head *policy_hash_bysel(struct net *net, struct xfrm_selector *sel, unsigned short family, int dir) 317static struct hlist_head *policy_hash_bysel(struct net *net,
318 const struct xfrm_selector *sel,
319 unsigned short family, int dir)
312{ 320{
313 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 321 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
314 unsigned int hash = __sel_hash(sel, family, hmask); 322 unsigned int hash = __sel_hash(sel, family, hmask);
@@ -318,7 +326,10 @@ static struct hlist_head *policy_hash_bysel(struct net *net, struct xfrm_selecto
318 net->xfrm.policy_bydst[dir].table + hash); 326 net->xfrm.policy_bydst[dir].table + hash);
319} 327}
320 328
321static struct hlist_head *policy_hash_direct(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, unsigned short family, int dir) 329static struct hlist_head *policy_hash_direct(struct net *net,
330 const xfrm_address_t *daddr,
331 const xfrm_address_t *saddr,
332 unsigned short family, int dir)
322{ 333{
323 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask; 334 unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
324 unsigned int hash = __addr_hash(daddr, saddr, family, hmask); 335 unsigned int hash = __addr_hash(daddr, saddr, family, hmask);
@@ -861,32 +872,33 @@ EXPORT_SYMBOL(xfrm_policy_walk_done);
861 * 872 *
862 * Returns 0 if policy found, else an -errno. 873 * Returns 0 if policy found, else an -errno.
863 */ 874 */
864static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl, 875static int xfrm_policy_match(const struct xfrm_policy *pol,
876 const struct flowi *fl,
865 u8 type, u16 family, int dir) 877 u8 type, u16 family, int dir)
866{ 878{
867 struct xfrm_selector *sel = &pol->selector; 879 const struct xfrm_selector *sel = &pol->selector;
868 int match, ret = -ESRCH; 880 int match, ret = -ESRCH;
869 881
870 if (pol->family != family || 882 if (pol->family != family ||
871 (fl->mark & pol->mark.m) != pol->mark.v || 883 (fl->flowi_mark & pol->mark.m) != pol->mark.v ||
872 pol->type != type) 884 pol->type != type)
873 return ret; 885 return ret;
874 886
875 match = xfrm_selector_match(sel, fl, family); 887 match = xfrm_selector_match(sel, fl, family);
876 if (match) 888 if (match)
877 ret = security_xfrm_policy_lookup(pol->security, fl->secid, 889 ret = security_xfrm_policy_lookup(pol->security, fl->flowi_secid,
878 dir); 890 dir);
879 891
880 return ret; 892 return ret;
881} 893}
882 894
883static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type, 895static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
884 struct flowi *fl, 896 const struct flowi *fl,
885 u16 family, u8 dir) 897 u16 family, u8 dir)
886{ 898{
887 int err; 899 int err;
888 struct xfrm_policy *pol, *ret; 900 struct xfrm_policy *pol, *ret;
889 xfrm_address_t *daddr, *saddr; 901 const xfrm_address_t *daddr, *saddr;
890 struct hlist_node *entry; 902 struct hlist_node *entry;
891 struct hlist_head *chain; 903 struct hlist_head *chain;
892 u32 priority = ~0U; 904 u32 priority = ~0U;
@@ -938,7 +950,7 @@ fail:
938} 950}
939 951
940static struct xfrm_policy * 952static struct xfrm_policy *
941__xfrm_policy_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir) 953__xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir)
942{ 954{
943#ifdef CONFIG_XFRM_SUB_POLICY 955#ifdef CONFIG_XFRM_SUB_POLICY
944 struct xfrm_policy *pol; 956 struct xfrm_policy *pol;
@@ -951,7 +963,7 @@ __xfrm_policy_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir)
951} 963}
952 964
953static struct flow_cache_object * 965static struct flow_cache_object *
954xfrm_policy_lookup(struct net *net, struct flowi *fl, u16 family, 966xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family,
955 u8 dir, struct flow_cache_object *old_obj, void *ctx) 967 u8 dir, struct flow_cache_object *old_obj, void *ctx)
956{ 968{
957 struct xfrm_policy *pol; 969 struct xfrm_policy *pol;
@@ -987,7 +999,8 @@ static inline int policy_to_flow_dir(int dir)
987 } 999 }
988} 1000}
989 1001
990static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl) 1002static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir,
1003 const struct flowi *fl)
991{ 1004{
992 struct xfrm_policy *pol; 1005 struct xfrm_policy *pol;
993 1006
@@ -1003,7 +1016,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
1003 goto out; 1016 goto out;
1004 } 1017 }
1005 err = security_xfrm_policy_lookup(pol->security, 1018 err = security_xfrm_policy_lookup(pol->security,
1006 fl->secid, 1019 fl->flowi_secid,
1007 policy_to_flow_dir(dir)); 1020 policy_to_flow_dir(dir));
1008 if (!err) 1021 if (!err)
1009 xfrm_pol_hold(pol); 1022 xfrm_pol_hold(pol);
@@ -1095,7 +1108,7 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
1095 return 0; 1108 return 0;
1096} 1109}
1097 1110
1098static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir) 1111static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
1099{ 1112{
1100 struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC); 1113 struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC);
1101 1114
@@ -1154,9 +1167,8 @@ xfrm_get_saddr(struct net *net, xfrm_address_t *local, xfrm_address_t *remote,
1154/* Resolve list of templates for the flow, given policy. */ 1167/* Resolve list of templates for the flow, given policy. */
1155 1168
1156static int 1169static int
1157xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl, 1170xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl,
1158 struct xfrm_state **xfrm, 1171 struct xfrm_state **xfrm, unsigned short family)
1159 unsigned short family)
1160{ 1172{
1161 struct net *net = xp_net(policy); 1173 struct net *net = xp_net(policy);
1162 int nx; 1174 int nx;
@@ -1211,9 +1223,8 @@ fail:
1211} 1223}
1212 1224
1213static int 1225static int
1214xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, struct flowi *fl, 1226xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, const struct flowi *fl,
1215 struct xfrm_state **xfrm, 1227 struct xfrm_state **xfrm, unsigned short family)
1216 unsigned short family)
1217{ 1228{
1218 struct xfrm_state *tp[XFRM_MAX_DEPTH]; 1229 struct xfrm_state *tp[XFRM_MAX_DEPTH];
1219 struct xfrm_state **tpp = (npols > 1) ? tp : xfrm; 1230 struct xfrm_state **tpp = (npols > 1) ? tp : xfrm;
@@ -1253,7 +1264,7 @@ xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, struct flowi *fl,
1253 * still valid. 1264 * still valid.
1254 */ 1265 */
1255 1266
1256static inline int xfrm_get_tos(struct flowi *fl, int family) 1267static inline int xfrm_get_tos(const struct flowi *fl, int family)
1257{ 1268{
1258 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); 1269 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1259 int tos; 1270 int tos;
@@ -1337,10 +1348,14 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
1337 default: 1348 default:
1338 BUG(); 1349 BUG();
1339 } 1350 }
1340 xdst = dst_alloc(dst_ops) ?: ERR_PTR(-ENOBUFS); 1351 xdst = dst_alloc(dst_ops, NULL, 0, 0, 0);
1352 memset(&xdst->u.rt6.rt6i_table, 0, sizeof(*xdst) - sizeof(struct dst_entry));
1341 xfrm_policy_put_afinfo(afinfo); 1353 xfrm_policy_put_afinfo(afinfo);
1342 1354
1343 xdst->flo.ops = &xfrm_bundle_fc_ops; 1355 if (likely(xdst))
1356 xdst->flo.ops = &xfrm_bundle_fc_ops;
1357 else
1358 xdst = ERR_PTR(-ENOBUFS);
1344 1359
1345 return xdst; 1360 return xdst;
1346} 1361}
@@ -1363,7 +1378,7 @@ static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst,
1363} 1378}
1364 1379
1365static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, 1380static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
1366 struct flowi *fl) 1381 const struct flowi *fl)
1367{ 1382{
1368 struct xfrm_policy_afinfo *afinfo = 1383 struct xfrm_policy_afinfo *afinfo =
1369 xfrm_policy_get_afinfo(xdst->u.dst.ops->family); 1384 xfrm_policy_get_afinfo(xdst->u.dst.ops->family);
@@ -1386,12 +1401,13 @@ static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
1386 1401
1387static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, 1402static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
1388 struct xfrm_state **xfrm, int nx, 1403 struct xfrm_state **xfrm, int nx,
1389 struct flowi *fl, 1404 const struct flowi *fl,
1390 struct dst_entry *dst) 1405 struct dst_entry *dst)
1391{ 1406{
1392 struct net *net = xp_net(policy); 1407 struct net *net = xp_net(policy);
1393 unsigned long now = jiffies; 1408 unsigned long now = jiffies;
1394 struct net_device *dev; 1409 struct net_device *dev;
1410 struct xfrm_mode *inner_mode;
1395 struct dst_entry *dst_prev = NULL; 1411 struct dst_entry *dst_prev = NULL;
1396 struct dst_entry *dst0 = NULL; 1412 struct dst_entry *dst0 = NULL;
1397 int i = 0; 1413 int i = 0;
@@ -1422,6 +1438,17 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
1422 goto put_states; 1438 goto put_states;
1423 } 1439 }
1424 1440
1441 if (xfrm[i]->sel.family == AF_UNSPEC) {
1442 inner_mode = xfrm_ip2inner_mode(xfrm[i],
1443 xfrm_af2proto(family));
1444 if (!inner_mode) {
1445 err = -EAFNOSUPPORT;
1446 dst_release(dst);
1447 goto put_states;
1448 }
1449 } else
1450 inner_mode = xfrm[i]->inner_mode;
1451
1425 if (!dst_prev) 1452 if (!dst_prev)
1426 dst0 = dst1; 1453 dst0 = dst1;
1427 else { 1454 else {
@@ -1430,7 +1457,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
1430 } 1457 }
1431 1458
1432 xdst->route = dst; 1459 xdst->route = dst;
1433 memcpy(&dst1->metrics, &dst->metrics, sizeof(dst->metrics)); 1460 dst_copy_metrics(dst1, dst);
1434 1461
1435 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) { 1462 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
1436 family = xfrm[i]->props.family; 1463 family = xfrm[i]->props.family;
@@ -1450,7 +1477,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
1450 dst1->lastuse = now; 1477 dst1->lastuse = now;
1451 1478
1452 dst1->input = dst_discard; 1479 dst1->input = dst_discard;
1453 dst1->output = xfrm[i]->outer_mode->afinfo->output; 1480 dst1->output = inner_mode->afinfo->output;
1454 1481
1455 dst1->next = dst_prev; 1482 dst1->next = dst_prev;
1456 dst_prev = dst1; 1483 dst_prev = dst1;
@@ -1502,7 +1529,7 @@ free_dst:
1502} 1529}
1503 1530
1504static int inline 1531static int inline
1505xfrm_dst_alloc_copy(void **target, void *src, int size) 1532xfrm_dst_alloc_copy(void **target, const void *src, int size)
1506{ 1533{
1507 if (!*target) { 1534 if (!*target) {
1508 *target = kmalloc(size, GFP_ATOMIC); 1535 *target = kmalloc(size, GFP_ATOMIC);
@@ -1514,7 +1541,7 @@ xfrm_dst_alloc_copy(void **target, void *src, int size)
1514} 1541}
1515 1542
1516static int inline 1543static int inline
1517xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel) 1544xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
1518{ 1545{
1519#ifdef CONFIG_XFRM_SUB_POLICY 1546#ifdef CONFIG_XFRM_SUB_POLICY
1520 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1547 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
@@ -1526,7 +1553,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
1526} 1553}
1527 1554
1528static int inline 1555static int inline
1529xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl) 1556xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl)
1530{ 1557{
1531#ifdef CONFIG_XFRM_SUB_POLICY 1558#ifdef CONFIG_XFRM_SUB_POLICY
1532 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1559 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
@@ -1536,7 +1563,7 @@ xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
1536#endif 1563#endif
1537} 1564}
1538 1565
1539static int xfrm_expand_policies(struct flowi *fl, u16 family, 1566static int xfrm_expand_policies(const struct flowi *fl, u16 family,
1540 struct xfrm_policy **pols, 1567 struct xfrm_policy **pols,
1541 int *num_pols, int *num_xfrms) 1568 int *num_pols, int *num_xfrms)
1542{ 1569{
@@ -1582,7 +1609,7 @@ static int xfrm_expand_policies(struct flowi *fl, u16 family,
1582 1609
1583static struct xfrm_dst * 1610static struct xfrm_dst *
1584xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, 1611xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
1585 struct flowi *fl, u16 family, 1612 const struct flowi *fl, u16 family,
1586 struct dst_entry *dst_orig) 1613 struct dst_entry *dst_orig)
1587{ 1614{
1588 struct net *net = xp_net(pols[0]); 1615 struct net *net = xp_net(pols[0]);
@@ -1625,7 +1652,7 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
1625} 1652}
1626 1653
1627static struct flow_cache_object * 1654static struct flow_cache_object *
1628xfrm_bundle_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir, 1655xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
1629 struct flow_cache_object *oldflo, void *ctx) 1656 struct flow_cache_object *oldflo, void *ctx)
1630{ 1657{
1631 struct dst_entry *dst_orig = (struct dst_entry *)ctx; 1658 struct dst_entry *dst_orig = (struct dst_entry *)ctx;
@@ -1724,18 +1751,36 @@ error:
1724 return ERR_PTR(err); 1751 return ERR_PTR(err);
1725} 1752}
1726 1753
1754static struct dst_entry *make_blackhole(struct net *net, u16 family,
1755 struct dst_entry *dst_orig)
1756{
1757 struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
1758 struct dst_entry *ret;
1759
1760 if (!afinfo) {
1761 dst_release(dst_orig);
1762 ret = ERR_PTR(-EINVAL);
1763 } else {
1764 ret = afinfo->blackhole_route(net, dst_orig);
1765 }
1766 xfrm_policy_put_afinfo(afinfo);
1767
1768 return ret;
1769}
1770
1727/* Main function: finds/creates a bundle for given flow. 1771/* Main function: finds/creates a bundle for given flow.
1728 * 1772 *
1729 * At the moment we eat a raw IP route. Mostly to speed up lookups 1773 * At the moment we eat a raw IP route. Mostly to speed up lookups
1730 * on interfaces with disabled IPsec. 1774 * on interfaces with disabled IPsec.
1731 */ 1775 */
1732int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl, 1776struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
1733 struct sock *sk, int flags) 1777 const struct flowi *fl,
1778 struct sock *sk, int flags)
1734{ 1779{
1735 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1780 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1736 struct flow_cache_object *flo; 1781 struct flow_cache_object *flo;
1737 struct xfrm_dst *xdst; 1782 struct xfrm_dst *xdst;
1738 struct dst_entry *dst, *dst_orig = *dst_p, *route; 1783 struct dst_entry *dst, *route;
1739 u16 family = dst_orig->ops->family; 1784 u16 family = dst_orig->ops->family;
1740 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT); 1785 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
1741 int i, err, num_pols, num_xfrms = 0, drop_pols = 0; 1786 int i, err, num_pols, num_xfrms = 0, drop_pols = 0;
@@ -1772,6 +1817,8 @@ restart:
1772 goto no_transform; 1817 goto no_transform;
1773 } 1818 }
1774 1819
1820 dst_hold(&xdst->u.dst);
1821
1775 spin_lock_bh(&xfrm_policy_sk_bundle_lock); 1822 spin_lock_bh(&xfrm_policy_sk_bundle_lock);
1776 xdst->u.dst.next = xfrm_policy_sk_bundles; 1823 xdst->u.dst.next = xfrm_policy_sk_bundles;
1777 xfrm_policy_sk_bundles = &xdst->u.dst; 1824 xfrm_policy_sk_bundles = &xdst->u.dst;
@@ -1817,9 +1864,10 @@ restart:
1817 dst_release(dst); 1864 dst_release(dst);
1818 xfrm_pols_put(pols, drop_pols); 1865 xfrm_pols_put(pols, drop_pols);
1819 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1866 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
1820 return -EREMOTE; 1867
1868 return make_blackhole(net, family, dst_orig);
1821 } 1869 }
1822 if (flags & XFRM_LOOKUP_WAIT) { 1870 if (fl->flowi_flags & FLOWI_FLAG_CAN_SLEEP) {
1823 DECLARE_WAITQUEUE(wait, current); 1871 DECLARE_WAITQUEUE(wait, current);
1824 1872
1825 add_wait_queue(&net->xfrm.km_waitq, &wait); 1873 add_wait_queue(&net->xfrm.km_waitq, &wait);
@@ -1861,47 +1909,33 @@ no_transform:
1861 goto error; 1909 goto error;
1862 } else if (num_xfrms > 0) { 1910 } else if (num_xfrms > 0) {
1863 /* Flow transformed */ 1911 /* Flow transformed */
1864 *dst_p = dst;
1865 dst_release(dst_orig); 1912 dst_release(dst_orig);
1866 } else { 1913 } else {
1867 /* Flow passes untransformed */ 1914 /* Flow passes untransformed */
1868 dst_release(dst); 1915 dst_release(dst);
1916 dst = dst_orig;
1869 } 1917 }
1870ok: 1918ok:
1871 xfrm_pols_put(pols, drop_pols); 1919 xfrm_pols_put(pols, drop_pols);
1872 return 0; 1920 return dst;
1873 1921
1874nopol: 1922nopol:
1875 if (!(flags & XFRM_LOOKUP_ICMP)) 1923 if (!(flags & XFRM_LOOKUP_ICMP)) {
1924 dst = dst_orig;
1876 goto ok; 1925 goto ok;
1926 }
1877 err = -ENOENT; 1927 err = -ENOENT;
1878error: 1928error:
1879 dst_release(dst); 1929 dst_release(dst);
1880dropdst: 1930dropdst:
1881 dst_release(dst_orig); 1931 dst_release(dst_orig);
1882 *dst_p = NULL;
1883 xfrm_pols_put(pols, drop_pols); 1932 xfrm_pols_put(pols, drop_pols);
1884 return err; 1933 return ERR_PTR(err);
1885}
1886EXPORT_SYMBOL(__xfrm_lookup);
1887
1888int xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
1889 struct sock *sk, int flags)
1890{
1891 int err = __xfrm_lookup(net, dst_p, fl, sk, flags);
1892
1893 if (err == -EREMOTE) {
1894 dst_release(*dst_p);
1895 *dst_p = NULL;
1896 err = -EAGAIN;
1897 }
1898
1899 return err;
1900} 1934}
1901EXPORT_SYMBOL(xfrm_lookup); 1935EXPORT_SYMBOL(xfrm_lookup);
1902 1936
1903static inline int 1937static inline int
1904xfrm_secpath_reject(int idx, struct sk_buff *skb, struct flowi *fl) 1938xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl)
1905{ 1939{
1906 struct xfrm_state *x; 1940 struct xfrm_state *x;
1907 1941
@@ -1920,7 +1954,7 @@ xfrm_secpath_reject(int idx, struct sk_buff *skb, struct flowi *fl)
1920 */ 1954 */
1921 1955
1922static inline int 1956static inline int
1923xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x, 1957xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
1924 unsigned short family) 1958 unsigned short family)
1925{ 1959{
1926 if (xfrm_state_kern(x)) 1960 if (xfrm_state_kern(x))
@@ -1943,7 +1977,7 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
1943 * Otherwise "-2 - errored_index" is returned. 1977 * Otherwise "-2 - errored_index" is returned.
1944 */ 1978 */
1945static inline int 1979static inline int
1946xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start, 1980xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,
1947 unsigned short family) 1981 unsigned short family)
1948{ 1982{
1949 int idx = start; 1983 int idx = start;
@@ -1975,13 +2009,13 @@ int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1975 return -EAFNOSUPPORT; 2009 return -EAFNOSUPPORT;
1976 2010
1977 afinfo->decode_session(skb, fl, reverse); 2011 afinfo->decode_session(skb, fl, reverse);
1978 err = security_xfrm_decode_session(skb, &fl->secid); 2012 err = security_xfrm_decode_session(skb, &fl->flowi_secid);
1979 xfrm_policy_put_afinfo(afinfo); 2013 xfrm_policy_put_afinfo(afinfo);
1980 return err; 2014 return err;
1981} 2015}
1982EXPORT_SYMBOL(__xfrm_decode_session); 2016EXPORT_SYMBOL(__xfrm_decode_session);
1983 2017
1984static inline int secpath_has_nontransport(struct sec_path *sp, int k, int *idxp) 2018static inline int secpath_has_nontransport(const struct sec_path *sp, int k, int *idxp)
1985{ 2019{
1986 for (; k < sp->len; k++) { 2020 for (; k < sp->len; k++) {
1987 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) { 2021 if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT) {
@@ -2156,7 +2190,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
2156 struct net *net = dev_net(skb->dev); 2190 struct net *net = dev_net(skb->dev);
2157 struct flowi fl; 2191 struct flowi fl;
2158 struct dst_entry *dst; 2192 struct dst_entry *dst;
2159 int res; 2193 int res = 1;
2160 2194
2161 if (xfrm_decode_session(skb, &fl, family) < 0) { 2195 if (xfrm_decode_session(skb, &fl, family) < 0) {
2162 XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR); 2196 XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
@@ -2164,9 +2198,12 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
2164 } 2198 }
2165 2199
2166 skb_dst_force(skb); 2200 skb_dst_force(skb);
2167 dst = skb_dst(skb);
2168 2201
2169 res = xfrm_lookup(net, &dst, &fl, NULL, 0) == 0; 2202 dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, 0);
2203 if (IS_ERR(dst)) {
2204 res = 0;
2205 dst = NULL;
2206 }
2170 skb_dst_set(skb, dst); 2207 skb_dst_set(skb, dst);
2171 return res; 2208 return res;
2172} 2209}
@@ -2204,7 +2241,7 @@ static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
2204 2241
2205static int stale_bundle(struct dst_entry *dst) 2242static int stale_bundle(struct dst_entry *dst)
2206{ 2243{
2207 return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0); 2244 return !xfrm_bundle_ok((struct xfrm_dst *)dst);
2208} 2245}
2209 2246
2210void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev) 2247void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
@@ -2268,7 +2305,7 @@ static void xfrm_init_pmtu(struct dst_entry *dst)
2268 if (pmtu > route_mtu_cached) 2305 if (pmtu > route_mtu_cached)
2269 pmtu = route_mtu_cached; 2306 pmtu = route_mtu_cached;
2270 2307
2271 dst->metrics[RTAX_MTU-1] = pmtu; 2308 dst_metric_set(dst, RTAX_MTU, pmtu);
2272 } while ((dst = dst->next)); 2309 } while ((dst = dst->next));
2273} 2310}
2274 2311
@@ -2276,8 +2313,7 @@ static void xfrm_init_pmtu(struct dst_entry *dst)
2276 * still valid. 2313 * still valid.
2277 */ 2314 */
2278 2315
2279int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first, 2316static int xfrm_bundle_ok(struct xfrm_dst *first)
2280 struct flowi *fl, int family, int strict)
2281{ 2317{
2282 struct dst_entry *dst = &first->u.dst; 2318 struct dst_entry *dst = &first->u.dst;
2283 struct xfrm_dst *last; 2319 struct xfrm_dst *last;
@@ -2286,26 +2322,12 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
2286 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) || 2322 if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) ||
2287 (dst->dev && !netif_running(dst->dev))) 2323 (dst->dev && !netif_running(dst->dev)))
2288 return 0; 2324 return 0;
2289#ifdef CONFIG_XFRM_SUB_POLICY
2290 if (fl) {
2291 if (first->origin && !flow_cache_uli_match(first->origin, fl))
2292 return 0;
2293 if (first->partner &&
2294 !xfrm_selector_match(first->partner, fl, family))
2295 return 0;
2296 }
2297#endif
2298 2325
2299 last = NULL; 2326 last = NULL;
2300 2327
2301 do { 2328 do {
2302 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 2329 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2303 2330
2304 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
2305 return 0;
2306 if (fl && pol &&
2307 !security_xfrm_state_pol_flow_match(dst->xfrm, pol, fl))
2308 return 0;
2309 if (dst->xfrm->km.state != XFRM_STATE_VALID) 2331 if (dst->xfrm->km.state != XFRM_STATE_VALID)
2310 return 0; 2332 return 0;
2311 if (xdst->xfrm_genid != dst->xfrm->genid) 2333 if (xdst->xfrm_genid != dst->xfrm->genid)
@@ -2314,11 +2336,6 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
2314 xdst->policy_genid != atomic_read(&xdst->pols[0]->genid)) 2336 xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
2315 return 0; 2337 return 0;
2316 2338
2317 if (strict && fl &&
2318 !(dst->xfrm->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
2319 !xfrm_state_addr_flow_check(dst->xfrm, fl, family))
2320 return 0;
2321
2322 mtu = dst_mtu(dst->child); 2339 mtu = dst_mtu(dst->child);
2323 if (xdst->child_mtu_cached != mtu) { 2340 if (xdst->child_mtu_cached != mtu) {
2324 last = xdst; 2341 last = xdst;
@@ -2346,7 +2363,7 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
2346 mtu = xfrm_state_mtu(dst->xfrm, mtu); 2363 mtu = xfrm_state_mtu(dst->xfrm, mtu);
2347 if (mtu > last->route_mtu_cached) 2364 if (mtu > last->route_mtu_cached)
2348 mtu = last->route_mtu_cached; 2365 mtu = last->route_mtu_cached;
2349 dst->metrics[RTAX_MTU-1] = mtu; 2366 dst_metric_set(dst, RTAX_MTU, mtu);
2350 2367
2351 if (last == first) 2368 if (last == first)
2352 break; 2369 break;
@@ -2358,7 +2375,15 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
2358 return 1; 2375 return 1;
2359} 2376}
2360 2377
2361EXPORT_SYMBOL(xfrm_bundle_ok); 2378static unsigned int xfrm_default_advmss(const struct dst_entry *dst)
2379{
2380 return dst_metric_advmss(dst->path);
2381}
2382
2383static unsigned int xfrm_default_mtu(const struct dst_entry *dst)
2384{
2385 return dst_mtu(dst->path);
2386}
2362 2387
2363int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo) 2388int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
2364{ 2389{
@@ -2377,6 +2402,10 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
2377 dst_ops->kmem_cachep = xfrm_dst_cache; 2402 dst_ops->kmem_cachep = xfrm_dst_cache;
2378 if (likely(dst_ops->check == NULL)) 2403 if (likely(dst_ops->check == NULL))
2379 dst_ops->check = xfrm_dst_check; 2404 dst_ops->check = xfrm_dst_check;
2405 if (likely(dst_ops->default_advmss == NULL))
2406 dst_ops->default_advmss = xfrm_default_advmss;
2407 if (likely(dst_ops->default_mtu == NULL))
2408 dst_ops->default_mtu = xfrm_default_mtu;
2380 if (likely(dst_ops->negative_advice == NULL)) 2409 if (likely(dst_ops->negative_advice == NULL))
2381 dst_ops->negative_advice = xfrm_negative_advice; 2410 dst_ops->negative_advice = xfrm_negative_advice;
2382 if (likely(dst_ops->link_failure == NULL)) 2411 if (likely(dst_ops->link_failure == NULL))
@@ -2717,8 +2746,8 @@ EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete);
2717#endif 2746#endif
2718 2747
2719#ifdef CONFIG_XFRM_MIGRATE 2748#ifdef CONFIG_XFRM_MIGRATE
2720static int xfrm_migrate_selector_match(struct xfrm_selector *sel_cmp, 2749static int xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp,
2721 struct xfrm_selector *sel_tgt) 2750 const struct xfrm_selector *sel_tgt)
2722{ 2751{
2723 if (sel_cmp->proto == IPSEC_ULPROTO_ANY) { 2752 if (sel_cmp->proto == IPSEC_ULPROTO_ANY) {
2724 if (sel_tgt->family == sel_cmp->family && 2753 if (sel_tgt->family == sel_cmp->family &&
@@ -2738,7 +2767,7 @@ static int xfrm_migrate_selector_match(struct xfrm_selector *sel_cmp,
2738 return 0; 2767 return 0;
2739} 2768}
2740 2769
2741static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel, 2770static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector *sel,
2742 u8 dir, u8 type) 2771 u8 dir, u8 type)
2743{ 2772{
2744 struct xfrm_policy *pol, *ret = NULL; 2773 struct xfrm_policy *pol, *ret = NULL;
@@ -2774,7 +2803,7 @@ static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel,
2774 return ret; 2803 return ret;
2775} 2804}
2776 2805
2777static int migrate_tmpl_match(struct xfrm_migrate *m, struct xfrm_tmpl *t) 2806static int migrate_tmpl_match(const struct xfrm_migrate *m, const struct xfrm_tmpl *t)
2778{ 2807{
2779 int match = 0; 2808 int match = 0;
2780 2809
@@ -2844,7 +2873,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol,
2844 return 0; 2873 return 0;
2845} 2874}
2846 2875
2847static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate) 2876static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate)
2848{ 2877{
2849 int i, j; 2878 int i, j;
2850 2879
@@ -2878,7 +2907,7 @@ static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate)
2878 return 0; 2907 return 0;
2879} 2908}
2880 2909
2881int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 2910int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2882 struct xfrm_migrate *m, int num_migrate, 2911 struct xfrm_migrate *m, int num_migrate,
2883 struct xfrm_kmaddress *k) 2912 struct xfrm_kmaddress *k)
2884{ 2913{
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
new file mode 100644
index 000000000000..b11ea692bd7d
--- /dev/null
+++ b/net/xfrm/xfrm_replay.c
@@ -0,0 +1,550 @@
1/*
2 * xfrm_replay.c - xfrm replay detection, derived from xfrm_state.c.
3 *
4 * Copyright (C) 2010 secunet Security Networks AG
5 * Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2, as published by the Free Software Foundation.
10 *
11 * This program is distributed in the hope it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
14 * more details.
15 *
16 * You should have received a copy of the GNU General Public License along with
17 * this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
19 */
20
21#include <net/xfrm.h>
22
23u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
24{
25 u32 seq, seq_hi, bottom;
26 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
27
28 if (!(x->props.flags & XFRM_STATE_ESN))
29 return 0;
30
31 seq = ntohl(net_seq);
32 seq_hi = replay_esn->seq_hi;
33 bottom = replay_esn->seq - replay_esn->replay_window + 1;
34
35 if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
36 /* A. same subspace */
37 if (unlikely(seq < bottom))
38 seq_hi++;
39 } else {
40 /* B. window spans two subspaces */
41 if (unlikely(seq >= bottom))
42 seq_hi--;
43 }
44
45 return seq_hi;
46}
47
48static void xfrm_replay_notify(struct xfrm_state *x, int event)
49{
50 struct km_event c;
51 /* we send notify messages in case
52 * 1. we updated on of the sequence numbers, and the seqno difference
53 * is at least x->replay_maxdiff, in this case we also update the
54 * timeout of our timer function
55 * 2. if x->replay_maxage has elapsed since last update,
56 * and there were changes
57 *
58 * The state structure must be locked!
59 */
60
61 switch (event) {
62 case XFRM_REPLAY_UPDATE:
63 if (x->replay_maxdiff &&
64 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
65 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
66 if (x->xflags & XFRM_TIME_DEFER)
67 event = XFRM_REPLAY_TIMEOUT;
68 else
69 return;
70 }
71
72 break;
73
74 case XFRM_REPLAY_TIMEOUT:
75 if (memcmp(&x->replay, &x->preplay,
76 sizeof(struct xfrm_replay_state)) == 0) {
77 x->xflags |= XFRM_TIME_DEFER;
78 return;
79 }
80
81 break;
82 }
83
84 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
85 c.event = XFRM_MSG_NEWAE;
86 c.data.aevent = event;
87 km_state_notify(x, &c);
88
89 if (x->replay_maxage &&
90 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
91 x->xflags &= ~XFRM_TIME_DEFER;
92}
93
94static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
95{
96 int err = 0;
97 struct net *net = xs_net(x);
98
99 if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
100 XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
101 if (unlikely(x->replay.oseq == 0)) {
102 x->replay.oseq--;
103 xfrm_audit_state_replay_overflow(x, skb);
104 err = -EOVERFLOW;
105
106 return err;
107 }
108 if (xfrm_aevent_is_on(net))
109 x->repl->notify(x, XFRM_REPLAY_UPDATE);
110 }
111
112 return err;
113}
114
115static int xfrm_replay_check(struct xfrm_state *x,
116 struct sk_buff *skb, __be32 net_seq)
117{
118 u32 diff;
119 u32 seq = ntohl(net_seq);
120
121 if (!x->props.replay_window)
122 return 0;
123
124 if (unlikely(seq == 0))
125 goto err;
126
127 if (likely(seq > x->replay.seq))
128 return 0;
129
130 diff = x->replay.seq - seq;
131 if (diff >= min_t(unsigned int, x->props.replay_window,
132 sizeof(x->replay.bitmap) * 8)) {
133 x->stats.replay_window++;
134 goto err;
135 }
136
137 if (x->replay.bitmap & (1U << diff)) {
138 x->stats.replay++;
139 goto err;
140 }
141 return 0;
142
143err:
144 xfrm_audit_state_replay(x, skb, net_seq);
145 return -EINVAL;
146}
147
148static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
149{
150 u32 diff;
151 u32 seq = ntohl(net_seq);
152
153 if (!x->props.replay_window)
154 return;
155
156 if (seq > x->replay.seq) {
157 diff = seq - x->replay.seq;
158 if (diff < x->props.replay_window)
159 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
160 else
161 x->replay.bitmap = 1;
162 x->replay.seq = seq;
163 } else {
164 diff = x->replay.seq - seq;
165 x->replay.bitmap |= (1U << diff);
166 }
167
168 if (xfrm_aevent_is_on(xs_net(x)))
169 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
170}
171
172static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
173{
174 int err = 0;
175 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
176 struct net *net = xs_net(x);
177
178 if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
179 XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
180 if (unlikely(replay_esn->oseq == 0)) {
181 replay_esn->oseq--;
182 xfrm_audit_state_replay_overflow(x, skb);
183 err = -EOVERFLOW;
184
185 return err;
186 }
187 if (xfrm_aevent_is_on(net))
188 x->repl->notify(x, XFRM_REPLAY_UPDATE);
189 }
190
191 return err;
192}
193
194static int xfrm_replay_check_bmp(struct xfrm_state *x,
195 struct sk_buff *skb, __be32 net_seq)
196{
197 unsigned int bitnr, nr;
198 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
199 u32 pos;
200 u32 seq = ntohl(net_seq);
201 u32 diff = replay_esn->seq - seq;
202
203 if (!replay_esn->replay_window)
204 return 0;
205
206 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
207
208 if (unlikely(seq == 0))
209 goto err;
210
211 if (likely(seq > replay_esn->seq))
212 return 0;
213
214 if (diff >= replay_esn->replay_window) {
215 x->stats.replay_window++;
216 goto err;
217 }
218
219 if (pos >= diff) {
220 bitnr = (pos - diff) % replay_esn->replay_window;
221 nr = bitnr >> 5;
222 bitnr = bitnr & 0x1F;
223 if (replay_esn->bmp[nr] & (1U << bitnr))
224 goto err_replay;
225 } else {
226 bitnr = replay_esn->replay_window - (diff - pos);
227 nr = bitnr >> 5;
228 bitnr = bitnr & 0x1F;
229 if (replay_esn->bmp[nr] & (1U << bitnr))
230 goto err_replay;
231 }
232 return 0;
233
234err_replay:
235 x->stats.replay++;
236err:
237 xfrm_audit_state_replay(x, skb, net_seq);
238 return -EINVAL;
239}
240
241static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
242{
243 unsigned int bitnr, nr, i;
244 u32 diff;
245 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
246 u32 seq = ntohl(net_seq);
247 u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
248
249 if (!replay_esn->replay_window)
250 return;
251
252 if (seq > replay_esn->seq) {
253 diff = seq - replay_esn->seq;
254
255 if (diff < replay_esn->replay_window) {
256 for (i = 1; i < diff; i++) {
257 bitnr = (pos + i) % replay_esn->replay_window;
258 nr = bitnr >> 5;
259 bitnr = bitnr & 0x1F;
260 replay_esn->bmp[nr] &= ~(1U << bitnr);
261 }
262
263 bitnr = (pos + diff) % replay_esn->replay_window;
264 nr = bitnr >> 5;
265 bitnr = bitnr & 0x1F;
266 replay_esn->bmp[nr] |= (1U << bitnr);
267 } else {
268 nr = (replay_esn->replay_window - 1) >> 5;
269 for (i = 0; i <= nr; i++)
270 replay_esn->bmp[i] = 0;
271
272 bitnr = (pos + diff) % replay_esn->replay_window;
273 nr = bitnr >> 5;
274 bitnr = bitnr & 0x1F;
275 replay_esn->bmp[nr] |= (1U << bitnr);
276 }
277
278 replay_esn->seq = seq;
279 } else {
280 diff = replay_esn->seq - seq;
281
282 if (pos >= diff) {
283 bitnr = (pos - diff) % replay_esn->replay_window;
284 nr = bitnr >> 5;
285 bitnr = bitnr & 0x1F;
286 replay_esn->bmp[nr] |= (1U << bitnr);
287 } else {
288 bitnr = replay_esn->replay_window - (diff - pos);
289 nr = bitnr >> 5;
290 bitnr = bitnr & 0x1F;
291 replay_esn->bmp[nr] |= (1U << bitnr);
292 }
293 }
294
295 if (xfrm_aevent_is_on(xs_net(x)))
296 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
297}
298
299static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
300{
301 struct km_event c;
302 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
303 struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
304
305 /* we send notify messages in case
306 * 1. we updated on of the sequence numbers, and the seqno difference
307 * is at least x->replay_maxdiff, in this case we also update the
308 * timeout of our timer function
309 * 2. if x->replay_maxage has elapsed since last update,
310 * and there were changes
311 *
312 * The state structure must be locked!
313 */
314
315 switch (event) {
316 case XFRM_REPLAY_UPDATE:
317 if (x->replay_maxdiff &&
318 (replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
319 (replay_esn->oseq - preplay_esn->oseq < x->replay_maxdiff)) {
320 if (x->xflags & XFRM_TIME_DEFER)
321 event = XFRM_REPLAY_TIMEOUT;
322 else
323 return;
324 }
325
326 break;
327
328 case XFRM_REPLAY_TIMEOUT:
329 if (memcmp(x->replay_esn, x->preplay_esn,
330 xfrm_replay_state_esn_len(replay_esn)) == 0) {
331 x->xflags |= XFRM_TIME_DEFER;
332 return;
333 }
334
335 break;
336 }
337
338 memcpy(x->preplay_esn, x->replay_esn,
339 xfrm_replay_state_esn_len(replay_esn));
340 c.event = XFRM_MSG_NEWAE;
341 c.data.aevent = event;
342 km_state_notify(x, &c);
343
344 if (x->replay_maxage &&
345 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
346 x->xflags &= ~XFRM_TIME_DEFER;
347}
348
349static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
350{
351 int err = 0;
352 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
353 struct net *net = xs_net(x);
354
355 if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
356 XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
357 XFRM_SKB_CB(skb)->seq.output.hi = replay_esn->oseq_hi;
358
359 if (unlikely(replay_esn->oseq == 0)) {
360 XFRM_SKB_CB(skb)->seq.output.hi = ++replay_esn->oseq_hi;
361
362 if (replay_esn->oseq_hi == 0) {
363 replay_esn->oseq--;
364 replay_esn->oseq_hi--;
365 xfrm_audit_state_replay_overflow(x, skb);
366 err = -EOVERFLOW;
367
368 return err;
369 }
370 }
371 if (xfrm_aevent_is_on(net))
372 x->repl->notify(x, XFRM_REPLAY_UPDATE);
373 }
374
375 return err;
376}
377
378static int xfrm_replay_check_esn(struct xfrm_state *x,
379 struct sk_buff *skb, __be32 net_seq)
380{
381 unsigned int bitnr, nr;
382 u32 diff;
383 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
384 u32 pos;
385 u32 seq = ntohl(net_seq);
386 u32 wsize = replay_esn->replay_window;
387 u32 top = replay_esn->seq;
388 u32 bottom = top - wsize + 1;
389
390 if (!wsize)
391 return 0;
392
393 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
394
395 if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
396 (replay_esn->seq < replay_esn->replay_window - 1)))
397 goto err;
398
399 diff = top - seq;
400
401 if (likely(top >= wsize - 1)) {
402 /* A. same subspace */
403 if (likely(seq > top) || seq < bottom)
404 return 0;
405 } else {
406 /* B. window spans two subspaces */
407 if (likely(seq > top && seq < bottom))
408 return 0;
409 if (seq >= bottom)
410 diff = ~seq + top + 1;
411 }
412
413 if (diff >= replay_esn->replay_window) {
414 x->stats.replay_window++;
415 goto err;
416 }
417
418 if (pos >= diff) {
419 bitnr = (pos - diff) % replay_esn->replay_window;
420 nr = bitnr >> 5;
421 bitnr = bitnr & 0x1F;
422 if (replay_esn->bmp[nr] & (1U << bitnr))
423 goto err_replay;
424 } else {
425 bitnr = replay_esn->replay_window - (diff - pos);
426 nr = bitnr >> 5;
427 bitnr = bitnr & 0x1F;
428 if (replay_esn->bmp[nr] & (1U << bitnr))
429 goto err_replay;
430 }
431 return 0;
432
433err_replay:
434 x->stats.replay++;
435err:
436 xfrm_audit_state_replay(x, skb, net_seq);
437 return -EINVAL;
438}
439
440static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
441{
442 unsigned int bitnr, nr, i;
443 int wrap;
444 u32 diff, pos, seq, seq_hi;
445 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
446
447 if (!replay_esn->replay_window)
448 return;
449
450 seq = ntohl(net_seq);
451 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
452 seq_hi = xfrm_replay_seqhi(x, net_seq);
453 wrap = seq_hi - replay_esn->seq_hi;
454
455 if ((!wrap && seq > replay_esn->seq) || wrap > 0) {
456 if (likely(!wrap))
457 diff = seq - replay_esn->seq;
458 else
459 diff = ~replay_esn->seq + seq + 1;
460
461 if (diff < replay_esn->replay_window) {
462 for (i = 1; i < diff; i++) {
463 bitnr = (pos + i) % replay_esn->replay_window;
464 nr = bitnr >> 5;
465 bitnr = bitnr & 0x1F;
466 replay_esn->bmp[nr] &= ~(1U << bitnr);
467 }
468
469 bitnr = (pos + diff) % replay_esn->replay_window;
470 nr = bitnr >> 5;
471 bitnr = bitnr & 0x1F;
472 replay_esn->bmp[nr] |= (1U << bitnr);
473 } else {
474 nr = (replay_esn->replay_window - 1) >> 5;
475 for (i = 0; i <= nr; i++)
476 replay_esn->bmp[i] = 0;
477
478 bitnr = (pos + diff) % replay_esn->replay_window;
479 nr = bitnr >> 5;
480 bitnr = bitnr & 0x1F;
481 replay_esn->bmp[nr] |= (1U << bitnr);
482 }
483
484 replay_esn->seq = seq;
485
486 if (unlikely(wrap > 0))
487 replay_esn->seq_hi++;
488 } else {
489 diff = replay_esn->seq - seq;
490
491 if (pos >= diff) {
492 bitnr = (pos - diff) % replay_esn->replay_window;
493 nr = bitnr >> 5;
494 bitnr = bitnr & 0x1F;
495 replay_esn->bmp[nr] |= (1U << bitnr);
496 } else {
497 bitnr = replay_esn->replay_window - (diff - pos);
498 nr = bitnr >> 5;
499 bitnr = bitnr & 0x1F;
500 replay_esn->bmp[nr] |= (1U << bitnr);
501 }
502 }
503
504 if (xfrm_aevent_is_on(xs_net(x)))
505 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
506}
507
508static struct xfrm_replay xfrm_replay_legacy = {
509 .advance = xfrm_replay_advance,
510 .check = xfrm_replay_check,
511 .notify = xfrm_replay_notify,
512 .overflow = xfrm_replay_overflow,
513};
514
515static struct xfrm_replay xfrm_replay_bmp = {
516 .advance = xfrm_replay_advance_bmp,
517 .check = xfrm_replay_check_bmp,
518 .notify = xfrm_replay_notify_bmp,
519 .overflow = xfrm_replay_overflow_bmp,
520};
521
522static struct xfrm_replay xfrm_replay_esn = {
523 .advance = xfrm_replay_advance_esn,
524 .check = xfrm_replay_check_esn,
525 .notify = xfrm_replay_notify_bmp,
526 .overflow = xfrm_replay_overflow_esn,
527};
528
529int xfrm_init_replay(struct xfrm_state *x)
530{
531 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
532
533 if (replay_esn) {
534 if (replay_esn->replay_window >
535 replay_esn->bmp_len * sizeof(__u32) * 8)
536 return -EINVAL;
537
538 if ((x->props.flags & XFRM_STATE_ESN) && replay_esn->replay_window == 0)
539 return -EINVAL;
540
541 if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
542 x->repl = &xfrm_replay_esn;
543 else
544 x->repl = &xfrm_replay_bmp;
545 } else
546 x->repl = &xfrm_replay_legacy;
547
548 return 0;
549}
550EXPORT_SYMBOL(xfrm_init_replay);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index eb96ce52f178..9414b9c5b1e4 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -42,16 +42,9 @@ static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
42static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 42static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
43static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo); 43static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
44 44
45#ifdef CONFIG_AUDITSYSCALL
46static void xfrm_audit_state_replay(struct xfrm_state *x,
47 struct sk_buff *skb, __be32 net_seq);
48#else
49#define xfrm_audit_state_replay(x, s, sq) do { ; } while (0)
50#endif /* CONFIG_AUDITSYSCALL */
51
52static inline unsigned int xfrm_dst_hash(struct net *net, 45static inline unsigned int xfrm_dst_hash(struct net *net,
53 xfrm_address_t *daddr, 46 const xfrm_address_t *daddr,
54 xfrm_address_t *saddr, 47 const xfrm_address_t *saddr,
55 u32 reqid, 48 u32 reqid,
56 unsigned short family) 49 unsigned short family)
57{ 50{
@@ -59,15 +52,16 @@ static inline unsigned int xfrm_dst_hash(struct net *net,
59} 52}
60 53
61static inline unsigned int xfrm_src_hash(struct net *net, 54static inline unsigned int xfrm_src_hash(struct net *net,
62 xfrm_address_t *daddr, 55 const xfrm_address_t *daddr,
63 xfrm_address_t *saddr, 56 const xfrm_address_t *saddr,
64 unsigned short family) 57 unsigned short family)
65{ 58{
66 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask); 59 return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask);
67} 60}
68 61
69static inline unsigned int 62static inline unsigned int
70xfrm_spi_hash(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family) 63xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr,
64 __be32 spi, u8 proto, unsigned short family)
71{ 65{
72 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask); 66 return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
73} 67}
@@ -362,6 +356,8 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
362 kfree(x->calg); 356 kfree(x->calg);
363 kfree(x->encap); 357 kfree(x->encap);
364 kfree(x->coaddr); 358 kfree(x->coaddr);
359 kfree(x->replay_esn);
360 kfree(x->preplay_esn);
365 if (x->inner_mode) 361 if (x->inner_mode)
366 xfrm_put_mode(x->inner_mode); 362 xfrm_put_mode(x->inner_mode);
367 if (x->inner_mode_iaf) 363 if (x->inner_mode_iaf)
@@ -656,9 +652,9 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
656EXPORT_SYMBOL(xfrm_sad_getinfo); 652EXPORT_SYMBOL(xfrm_sad_getinfo);
657 653
658static int 654static int
659xfrm_init_tempstate(struct xfrm_state *x, struct flowi *fl, 655xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl,
660 struct xfrm_tmpl *tmpl, 656 const struct xfrm_tmpl *tmpl,
661 xfrm_address_t *daddr, xfrm_address_t *saddr, 657 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
662 unsigned short family) 658 unsigned short family)
663{ 659{
664 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 660 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
@@ -677,7 +673,10 @@ xfrm_init_tempstate(struct xfrm_state *x, struct flowi *fl,
677 return 0; 673 return 0;
678} 674}
679 675
680static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family) 676static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
677 const xfrm_address_t *daddr,
678 __be32 spi, u8 proto,
679 unsigned short family)
681{ 680{
682 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); 681 unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
683 struct xfrm_state *x; 682 struct xfrm_state *x;
@@ -699,7 +698,10 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, xfrm_ad
699 return NULL; 698 return NULL;
700} 699}
701 700
702static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family) 701static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
702 const xfrm_address_t *daddr,
703 const xfrm_address_t *saddr,
704 u8 proto, unsigned short family)
703{ 705{
704 unsigned int h = xfrm_src_hash(net, daddr, saddr, family); 706 unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
705 struct xfrm_state *x; 707 struct xfrm_state *x;
@@ -746,8 +748,7 @@ static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
746} 748}
747 749
748static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, 750static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
749 struct flowi *fl, unsigned short family, 751 const struct flowi *fl, unsigned short family,
750 xfrm_address_t *daddr, xfrm_address_t *saddr,
751 struct xfrm_state **best, int *acq_in_progress, 752 struct xfrm_state **best, int *acq_in_progress,
752 int *error) 753 int *error)
753{ 754{
@@ -784,8 +785,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
784} 785}
785 786
786struct xfrm_state * 787struct xfrm_state *
787xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 788xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
788 struct flowi *fl, struct xfrm_tmpl *tmpl, 789 const struct flowi *fl, struct xfrm_tmpl *tmpl,
789 struct xfrm_policy *pol, int *err, 790 struct xfrm_policy *pol, int *err,
790 unsigned short family) 791 unsigned short family)
791{ 792{
@@ -813,7 +814,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
813 tmpl->mode == x->props.mode && 814 tmpl->mode == x->props.mode &&
814 tmpl->id.proto == x->id.proto && 815 tmpl->id.proto == x->id.proto &&
815 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 816 (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
816 xfrm_state_look_at(pol, x, fl, encap_family, daddr, saddr, 817 xfrm_state_look_at(pol, x, fl, encap_family,
817 &best, &acquire_in_progress, &error); 818 &best, &acquire_in_progress, &error);
818 } 819 }
819 if (best) 820 if (best)
@@ -829,7 +830,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
829 tmpl->mode == x->props.mode && 830 tmpl->mode == x->props.mode &&
830 tmpl->id.proto == x->id.proto && 831 tmpl->id.proto == x->id.proto &&
831 (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) 832 (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
832 xfrm_state_look_at(pol, x, fl, encap_family, daddr, saddr, 833 xfrm_state_look_at(pol, x, fl, encap_family,
833 &best, &acquire_in_progress, &error); 834 &best, &acquire_in_progress, &error);
834 } 835 }
835 836
@@ -853,7 +854,7 @@ found:
853 xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family); 854 xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
854 memcpy(&x->mark, &pol->mark, sizeof(x->mark)); 855 memcpy(&x->mark, &pol->mark, sizeof(x->mark));
855 856
856 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid); 857 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid);
857 if (error) { 858 if (error) {
858 x->km.state = XFRM_STATE_DEAD; 859 x->km.state = XFRM_STATE_DEAD;
859 to_put = x; 860 to_put = x;
@@ -991,7 +992,11 @@ void xfrm_state_insert(struct xfrm_state *x)
991EXPORT_SYMBOL(xfrm_state_insert); 992EXPORT_SYMBOL(xfrm_state_insert);
992 993
993/* xfrm_state_lock is held */ 994/* xfrm_state_lock is held */
994static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m, unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create) 995static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
996 unsigned short family, u8 mode,
997 u32 reqid, u8 proto,
998 const xfrm_address_t *daddr,
999 const xfrm_address_t *saddr, int create)
995{ 1000{
996 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family); 1001 unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
997 struct hlist_node *entry; 1002 struct hlist_node *entry;
@@ -1031,15 +1036,15 @@ static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
1031 1036
1032 case AF_INET6: 1037 case AF_INET6:
1033 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6, 1038 ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
1034 (struct in6_addr *)daddr); 1039 (const struct in6_addr *)daddr);
1035 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6, 1040 ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
1036 (struct in6_addr *)saddr); 1041 (const struct in6_addr *)saddr);
1037 x->sel.prefixlen_d = 128; 1042 x->sel.prefixlen_d = 128;
1038 x->sel.prefixlen_s = 128; 1043 x->sel.prefixlen_s = 128;
1039 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6, 1044 ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
1040 (struct in6_addr *)saddr); 1045 (const struct in6_addr *)saddr);
1041 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6, 1046 ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
1042 (struct in6_addr *)daddr); 1047 (const struct in6_addr *)daddr);
1043 break; 1048 break;
1044 } 1049 }
1045 1050
@@ -1176,6 +1181,12 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
1176 goto error; 1181 goto error;
1177 } 1182 }
1178 1183
1184 if (orig->replay_esn) {
1185 err = xfrm_replay_clone(x, orig);
1186 if (err)
1187 goto error;
1188 }
1189
1179 memcpy(&x->mark, &orig->mark, sizeof(x->mark)); 1190 memcpy(&x->mark, &orig->mark, sizeof(x->mark));
1180 1191
1181 err = xfrm_init_state(x); 1192 err = xfrm_init_state(x);
@@ -1268,7 +1279,7 @@ struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1268 1279
1269 return xc; 1280 return xc;
1270error: 1281error:
1271 kfree(xc); 1282 xfrm_state_put(xc);
1272 return NULL; 1283 return NULL;
1273} 1284}
1274EXPORT_SYMBOL(xfrm_state_migrate); 1285EXPORT_SYMBOL(xfrm_state_migrate);
@@ -1334,6 +1345,8 @@ out:
1334 xfrm_state_check_expire(x1); 1345 xfrm_state_check_expire(x1);
1335 1346
1336 err = 0; 1347 err = 0;
1348 x->km.state = XFRM_STATE_DEAD;
1349 __xfrm_state_put(x);
1337 } 1350 }
1338 spin_unlock_bh(&x1->lock); 1351 spin_unlock_bh(&x1->lock);
1339 1352
@@ -1369,7 +1382,7 @@ int xfrm_state_check_expire(struct xfrm_state *x)
1369EXPORT_SYMBOL(xfrm_state_check_expire); 1382EXPORT_SYMBOL(xfrm_state_check_expire);
1370 1383
1371struct xfrm_state * 1384struct xfrm_state *
1372xfrm_state_lookup(struct net *net, u32 mark, xfrm_address_t *daddr, __be32 spi, 1385xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi,
1373 u8 proto, unsigned short family) 1386 u8 proto, unsigned short family)
1374{ 1387{
1375 struct xfrm_state *x; 1388 struct xfrm_state *x;
@@ -1383,7 +1396,7 @@ EXPORT_SYMBOL(xfrm_state_lookup);
1383 1396
1384struct xfrm_state * 1397struct xfrm_state *
1385xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1398xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1386 xfrm_address_t *daddr, xfrm_address_t *saddr, 1399 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1387 u8 proto, unsigned short family) 1400 u8 proto, unsigned short family)
1388{ 1401{
1389 struct xfrm_state *x; 1402 struct xfrm_state *x;
@@ -1397,7 +1410,7 @@ EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
1397 1410
1398struct xfrm_state * 1411struct xfrm_state *
1399xfrm_find_acq(struct net *net, struct xfrm_mark *mark, u8 mode, u32 reqid, u8 proto, 1412xfrm_find_acq(struct net *net, struct xfrm_mark *mark, u8 mode, u32 reqid, u8 proto,
1400 xfrm_address_t *daddr, xfrm_address_t *saddr, 1413 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1401 int create, unsigned short family) 1414 int create, unsigned short family)
1402{ 1415{
1403 struct xfrm_state *x; 1416 struct xfrm_state *x;
@@ -1609,54 +1622,6 @@ void xfrm_state_walk_done(struct xfrm_state_walk *walk)
1609} 1622}
1610EXPORT_SYMBOL(xfrm_state_walk_done); 1623EXPORT_SYMBOL(xfrm_state_walk_done);
1611 1624
1612
1613void xfrm_replay_notify(struct xfrm_state *x, int event)
1614{
1615 struct km_event c;
1616 /* we send notify messages in case
1617 * 1. we updated on of the sequence numbers, and the seqno difference
1618 * is at least x->replay_maxdiff, in this case we also update the
1619 * timeout of our timer function
1620 * 2. if x->replay_maxage has elapsed since last update,
1621 * and there were changes
1622 *
1623 * The state structure must be locked!
1624 */
1625
1626 switch (event) {
1627 case XFRM_REPLAY_UPDATE:
1628 if (x->replay_maxdiff &&
1629 (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
1630 (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
1631 if (x->xflags & XFRM_TIME_DEFER)
1632 event = XFRM_REPLAY_TIMEOUT;
1633 else
1634 return;
1635 }
1636
1637 break;
1638
1639 case XFRM_REPLAY_TIMEOUT:
1640 if ((x->replay.seq == x->preplay.seq) &&
1641 (x->replay.bitmap == x->preplay.bitmap) &&
1642 (x->replay.oseq == x->preplay.oseq)) {
1643 x->xflags |= XFRM_TIME_DEFER;
1644 return;
1645 }
1646
1647 break;
1648 }
1649
1650 memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
1651 c.event = XFRM_MSG_NEWAE;
1652 c.data.aevent = event;
1653 km_state_notify(x, &c);
1654
1655 if (x->replay_maxage &&
1656 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
1657 x->xflags &= ~XFRM_TIME_DEFER;
1658}
1659
1660static void xfrm_replay_timer_handler(unsigned long data) 1625static void xfrm_replay_timer_handler(unsigned long data)
1661{ 1626{
1662 struct xfrm_state *x = (struct xfrm_state*)data; 1627 struct xfrm_state *x = (struct xfrm_state*)data;
@@ -1665,7 +1630,7 @@ static void xfrm_replay_timer_handler(unsigned long data)
1665 1630
1666 if (x->km.state == XFRM_STATE_VALID) { 1631 if (x->km.state == XFRM_STATE_VALID) {
1667 if (xfrm_aevent_is_on(xs_net(x))) 1632 if (xfrm_aevent_is_on(xs_net(x)))
1668 xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT); 1633 x->repl->notify(x, XFRM_REPLAY_TIMEOUT);
1669 else 1634 else
1670 x->xflags |= XFRM_TIME_DEFER; 1635 x->xflags |= XFRM_TIME_DEFER;
1671 } 1636 }
@@ -1673,61 +1638,10 @@ static void xfrm_replay_timer_handler(unsigned long data)
1673 spin_unlock(&x->lock); 1638 spin_unlock(&x->lock);
1674} 1639}
1675 1640
1676int xfrm_replay_check(struct xfrm_state *x,
1677 struct sk_buff *skb, __be32 net_seq)
1678{
1679 u32 diff;
1680 u32 seq = ntohl(net_seq);
1681
1682 if (unlikely(seq == 0))
1683 goto err;
1684
1685 if (likely(seq > x->replay.seq))
1686 return 0;
1687
1688 diff = x->replay.seq - seq;
1689 if (diff >= min_t(unsigned int, x->props.replay_window,
1690 sizeof(x->replay.bitmap) * 8)) {
1691 x->stats.replay_window++;
1692 goto err;
1693 }
1694
1695 if (x->replay.bitmap & (1U << diff)) {
1696 x->stats.replay++;
1697 goto err;
1698 }
1699 return 0;
1700
1701err:
1702 xfrm_audit_state_replay(x, skb, net_seq);
1703 return -EINVAL;
1704}
1705
1706void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
1707{
1708 u32 diff;
1709 u32 seq = ntohl(net_seq);
1710
1711 if (seq > x->replay.seq) {
1712 diff = seq - x->replay.seq;
1713 if (diff < x->props.replay_window)
1714 x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
1715 else
1716 x->replay.bitmap = 1;
1717 x->replay.seq = seq;
1718 } else {
1719 diff = x->replay.seq - seq;
1720 x->replay.bitmap |= (1U << diff);
1721 }
1722
1723 if (xfrm_aevent_is_on(xs_net(x)))
1724 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1725}
1726
1727static LIST_HEAD(xfrm_km_list); 1641static LIST_HEAD(xfrm_km_list);
1728static DEFINE_RWLOCK(xfrm_km_lock); 1642static DEFINE_RWLOCK(xfrm_km_lock);
1729 1643
1730void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 1644void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
1731{ 1645{
1732 struct xfrm_mgr *km; 1646 struct xfrm_mgr *km;
1733 1647
@@ -1738,7 +1652,7 @@ void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1738 read_unlock(&xfrm_km_lock); 1652 read_unlock(&xfrm_km_lock);
1739} 1653}
1740 1654
1741void km_state_notify(struct xfrm_state *x, struct km_event *c) 1655void km_state_notify(struct xfrm_state *x, const struct km_event *c)
1742{ 1656{
1743 struct xfrm_mgr *km; 1657 struct xfrm_mgr *km;
1744 read_lock(&xfrm_km_lock); 1658 read_lock(&xfrm_km_lock);
@@ -1819,9 +1733,9 @@ void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid)
1819EXPORT_SYMBOL(km_policy_expired); 1733EXPORT_SYMBOL(km_policy_expired);
1820 1734
1821#ifdef CONFIG_XFRM_MIGRATE 1735#ifdef CONFIG_XFRM_MIGRATE
1822int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 1736int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1823 struct xfrm_migrate *m, int num_migrate, 1737 const struct xfrm_migrate *m, int num_migrate,
1824 struct xfrm_kmaddress *k) 1738 const struct xfrm_kmaddress *k)
1825{ 1739{
1826 int err = -EINVAL; 1740 int err = -EINVAL;
1827 int ret; 1741 int ret;
@@ -2001,7 +1915,7 @@ int xfrm_state_mtu(struct xfrm_state *x, int mtu)
2001 return res; 1915 return res;
2002} 1916}
2003 1917
2004int xfrm_init_state(struct xfrm_state *x) 1918int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
2005{ 1919{
2006 struct xfrm_state_afinfo *afinfo; 1920 struct xfrm_state_afinfo *afinfo;
2007 struct xfrm_mode *inner_mode; 1921 struct xfrm_mode *inner_mode;
@@ -2074,12 +1988,25 @@ int xfrm_init_state(struct xfrm_state *x)
2074 if (x->outer_mode == NULL) 1988 if (x->outer_mode == NULL)
2075 goto error; 1989 goto error;
2076 1990
1991 if (init_replay) {
1992 err = xfrm_init_replay(x);
1993 if (err)
1994 goto error;
1995 }
1996
2077 x->km.state = XFRM_STATE_VALID; 1997 x->km.state = XFRM_STATE_VALID;
2078 1998
2079error: 1999error:
2080 return err; 2000 return err;
2081} 2001}
2082 2002
2003EXPORT_SYMBOL(__xfrm_init_state);
2004
2005int xfrm_init_state(struct xfrm_state *x)
2006{
2007 return __xfrm_init_state(x, true);
2008}
2009
2083EXPORT_SYMBOL(xfrm_init_state); 2010EXPORT_SYMBOL(xfrm_init_state);
2084 2011
2085int __net_init xfrm_state_init(struct net *net) 2012int __net_init xfrm_state_init(struct net *net)
@@ -2167,8 +2094,8 @@ static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
2167static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, 2094static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
2168 struct audit_buffer *audit_buf) 2095 struct audit_buffer *audit_buf)
2169{ 2096{
2170 struct iphdr *iph4; 2097 const struct iphdr *iph4;
2171 struct ipv6hdr *iph6; 2098 const struct ipv6hdr *iph6;
2172 2099
2173 switch (family) { 2100 switch (family) {
2174 case AF_INET: 2101 case AF_INET:
@@ -2236,7 +2163,7 @@ void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
2236} 2163}
2237EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow); 2164EXPORT_SYMBOL_GPL(xfrm_audit_state_replay_overflow);
2238 2165
2239static void xfrm_audit_state_replay(struct xfrm_state *x, 2166void xfrm_audit_state_replay(struct xfrm_state *x,
2240 struct sk_buff *skb, __be32 net_seq) 2167 struct sk_buff *skb, __be32 net_seq)
2241{ 2168{
2242 struct audit_buffer *audit_buf; 2169 struct audit_buffer *audit_buf;
@@ -2251,6 +2178,7 @@ static void xfrm_audit_state_replay(struct xfrm_state *x,
2251 spi, spi, ntohl(net_seq)); 2178 spi, spi, ntohl(net_seq));
2252 audit_log_end(audit_buf); 2179 audit_log_end(audit_buf);
2253} 2180}
2181EXPORT_SYMBOL_GPL(xfrm_audit_state_replay);
2254 2182
2255void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family) 2183void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family)
2256{ 2184{
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 8bae6b22c846..c658cb3bc7c3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -26,6 +26,7 @@
26#include <net/sock.h> 26#include <net/sock.h>
27#include <net/xfrm.h> 27#include <net/xfrm.h>
28#include <net/netlink.h> 28#include <net/netlink.h>
29#include <net/ah.h>
29#include <asm/uaccess.h> 30#include <asm/uaccess.h>
30#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 31#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
31#include <linux/in6.h> 32#include <linux/in6.h>
@@ -118,6 +119,25 @@ static inline int verify_sec_ctx_len(struct nlattr **attrs)
118 return 0; 119 return 0;
119} 120}
120 121
122static inline int verify_replay(struct xfrm_usersa_info *p,
123 struct nlattr **attrs)
124{
125 struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
126
127 if ((p->flags & XFRM_STATE_ESN) && !rt)
128 return -EINVAL;
129
130 if (!rt)
131 return 0;
132
133 if (p->id.proto != IPPROTO_ESP)
134 return -EINVAL;
135
136 if (p->replay_window != 0)
137 return -EINVAL;
138
139 return 0;
140}
121 141
122static int verify_newsa_info(struct xfrm_usersa_info *p, 142static int verify_newsa_info(struct xfrm_usersa_info *p,
123 struct nlattr **attrs) 143 struct nlattr **attrs)
@@ -148,7 +168,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
148 !attrs[XFRMA_ALG_AUTH_TRUNC]) || 168 !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
149 attrs[XFRMA_ALG_AEAD] || 169 attrs[XFRMA_ALG_AEAD] ||
150 attrs[XFRMA_ALG_CRYPT] || 170 attrs[XFRMA_ALG_CRYPT] ||
151 attrs[XFRMA_ALG_COMP]) 171 attrs[XFRMA_ALG_COMP] ||
172 attrs[XFRMA_TFCPAD])
152 goto out; 173 goto out;
153 break; 174 break;
154 175
@@ -165,6 +186,9 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
165 attrs[XFRMA_ALG_CRYPT]) && 186 attrs[XFRMA_ALG_CRYPT]) &&
166 attrs[XFRMA_ALG_AEAD]) 187 attrs[XFRMA_ALG_AEAD])
167 goto out; 188 goto out;
189 if (attrs[XFRMA_TFCPAD] &&
190 p->mode != XFRM_MODE_TUNNEL)
191 goto out;
168 break; 192 break;
169 193
170 case IPPROTO_COMP: 194 case IPPROTO_COMP:
@@ -172,7 +196,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
172 attrs[XFRMA_ALG_AEAD] || 196 attrs[XFRMA_ALG_AEAD] ||
173 attrs[XFRMA_ALG_AUTH] || 197 attrs[XFRMA_ALG_AUTH] ||
174 attrs[XFRMA_ALG_AUTH_TRUNC] || 198 attrs[XFRMA_ALG_AUTH_TRUNC] ||
175 attrs[XFRMA_ALG_CRYPT]) 199 attrs[XFRMA_ALG_CRYPT] ||
200 attrs[XFRMA_TFCPAD])
176 goto out; 201 goto out;
177 break; 202 break;
178 203
@@ -186,6 +211,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
186 attrs[XFRMA_ALG_CRYPT] || 211 attrs[XFRMA_ALG_CRYPT] ||
187 attrs[XFRMA_ENCAP] || 212 attrs[XFRMA_ENCAP] ||
188 attrs[XFRMA_SEC_CTX] || 213 attrs[XFRMA_SEC_CTX] ||
214 attrs[XFRMA_TFCPAD] ||
189 !attrs[XFRMA_COADDR]) 215 !attrs[XFRMA_COADDR])
190 goto out; 216 goto out;
191 break; 217 break;
@@ -207,6 +233,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
207 goto out; 233 goto out;
208 if ((err = verify_sec_ctx_len(attrs))) 234 if ((err = verify_sec_ctx_len(attrs)))
209 goto out; 235 goto out;
236 if ((err = verify_replay(p, attrs)))
237 goto out;
210 238
211 err = -EINVAL; 239 err = -EINVAL;
212 switch (p->mode) { 240 switch (p->mode) {
@@ -227,7 +255,7 @@ out:
227} 255}
228 256
229static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 257static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
230 struct xfrm_algo_desc *(*get_byname)(char *, int), 258 struct xfrm_algo_desc *(*get_byname)(const char *, int),
231 struct nlattr *rta) 259 struct nlattr *rta)
232{ 260{
233 struct xfrm_algo *p, *ualg; 261 struct xfrm_algo *p, *ualg;
@@ -296,7 +324,8 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
296 algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 324 algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
297 if (!algo) 325 if (!algo)
298 return -ENOSYS; 326 return -ENOSYS;
299 if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) 327 if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
328 ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
300 return -EINVAL; 329 return -EINVAL;
301 *props = algo->desc.sadb_alg_id; 330 *props = algo->desc.sadb_alg_id;
302 331
@@ -337,6 +366,50 @@ static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
337 return 0; 366 return 0;
338} 367}
339 368
369static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
370 struct nlattr *rp)
371{
372 struct xfrm_replay_state_esn *up;
373
374 if (!replay_esn || !rp)
375 return 0;
376
377 up = nla_data(rp);
378
379 if (xfrm_replay_state_esn_len(replay_esn) !=
380 xfrm_replay_state_esn_len(up))
381 return -EINVAL;
382
383 return 0;
384}
385
386static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
387 struct xfrm_replay_state_esn **preplay_esn,
388 struct nlattr *rta)
389{
390 struct xfrm_replay_state_esn *p, *pp, *up;
391
392 if (!rta)
393 return 0;
394
395 up = nla_data(rta);
396
397 p = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
398 if (!p)
399 return -ENOMEM;
400
401 pp = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
402 if (!pp) {
403 kfree(p);
404 return -ENOMEM;
405 }
406
407 *replay_esn = p;
408 *preplay_esn = pp;
409
410 return 0;
411}
412
340static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx) 413static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
341{ 414{
342 int len = 0; 415 int len = 0;
@@ -372,10 +445,20 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
372static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs) 445static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
373{ 446{
374 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 447 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
448 struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
375 struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 449 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
376 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 450 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
377 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 451 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
378 452
453 if (re) {
454 struct xfrm_replay_state_esn *replay_esn;
455 replay_esn = nla_data(re);
456 memcpy(x->replay_esn, replay_esn,
457 xfrm_replay_state_esn_len(replay_esn));
458 memcpy(x->preplay_esn, replay_esn,
459 xfrm_replay_state_esn_len(replay_esn));
460 }
461
379 if (rp) { 462 if (rp) {
380 struct xfrm_replay_state *replay; 463 struct xfrm_replay_state *replay;
381 replay = nla_data(rp); 464 replay = nla_data(rp);
@@ -439,6 +522,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
439 goto error; 522 goto error;
440 } 523 }
441 524
525 if (attrs[XFRMA_TFCPAD])
526 x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
527
442 if (attrs[XFRMA_COADDR]) { 528 if (attrs[XFRMA_COADDR]) {
443 x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), 529 x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
444 sizeof(*x->coaddr), GFP_KERNEL); 530 sizeof(*x->coaddr), GFP_KERNEL);
@@ -448,7 +534,7 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
448 534
449 xfrm_mark_get(attrs, &x->mark); 535 xfrm_mark_get(attrs, &x->mark);
450 536
451 err = xfrm_init_state(x); 537 err = __xfrm_init_state(x, false);
452 if (err) 538 if (err)
453 goto error; 539 goto error;
454 540
@@ -456,16 +542,19 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
456 security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX]))) 542 security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
457 goto error; 543 goto error;
458 544
545 if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
546 attrs[XFRMA_REPLAY_ESN_VAL])))
547 goto error;
548
459 x->km.seq = p->seq; 549 x->km.seq = p->seq;
460 x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth; 550 x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
461 /* sysctl_xfrm_aevent_etime is in 100ms units */ 551 /* sysctl_xfrm_aevent_etime is in 100ms units */
462 x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M; 552 x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
463 x->preplay.bitmap = 0;
464 x->preplay.seq = x->replay.seq+x->replay_maxdiff;
465 x->preplay.oseq = x->replay.oseq +x->replay_maxdiff;
466 553
467 /* override default values from above */ 554 if ((err = xfrm_init_replay(x)))
555 goto error;
468 556
557 /* override default values from above */
469 xfrm_update_ae_params(x, attrs); 558 xfrm_update_ae_params(x, attrs);
470 559
471 return x; 560 return x;
@@ -486,9 +575,9 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
486 struct xfrm_state *x; 575 struct xfrm_state *x;
487 int err; 576 int err;
488 struct km_event c; 577 struct km_event c;
489 uid_t loginuid = NETLINK_CB(skb).loginuid; 578 uid_t loginuid = audit_get_loginuid(current);
490 u32 sessionid = NETLINK_CB(skb).sessionid; 579 u32 sessionid = audit_get_sessionid(current);
491 u32 sid = NETLINK_CB(skb).sid; 580 u32 sid;
492 581
493 err = verify_newsa_info(p, attrs); 582 err = verify_newsa_info(p, attrs);
494 if (err) 583 if (err)
@@ -504,6 +593,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
504 else 593 else
505 err = xfrm_state_update(x); 594 err = xfrm_state_update(x);
506 595
596 security_task_getsecid(current, &sid);
507 xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid); 597 xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
508 598
509 if (err < 0) { 599 if (err < 0) {
@@ -564,9 +654,9 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
564 int err = -ESRCH; 654 int err = -ESRCH;
565 struct km_event c; 655 struct km_event c;
566 struct xfrm_usersa_id *p = nlmsg_data(nlh); 656 struct xfrm_usersa_id *p = nlmsg_data(nlh);
567 uid_t loginuid = NETLINK_CB(skb).loginuid; 657 uid_t loginuid = audit_get_loginuid(current);
568 u32 sessionid = NETLINK_CB(skb).sessionid; 658 u32 sessionid = audit_get_sessionid(current);
569 u32 sid = NETLINK_CB(skb).sid; 659 u32 sid;
570 660
571 x = xfrm_user_state_lookup(net, p, attrs, &err); 661 x = xfrm_user_state_lookup(net, p, attrs, &err);
572 if (x == NULL) 662 if (x == NULL)
@@ -591,6 +681,7 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
591 km_state_notify(x, &c); 681 km_state_notify(x, &c);
592 682
593out: 683out:
684 security_task_getsecid(current, &sid);
594 xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid); 685 xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
595 xfrm_state_put(x); 686 xfrm_state_put(x);
596 return err; 687 return err;
@@ -688,9 +779,16 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
688 if (x->encap) 779 if (x->encap)
689 NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); 780 NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
690 781
782 if (x->tfcpad)
783 NLA_PUT_U32(skb, XFRMA_TFCPAD, x->tfcpad);
784
691 if (xfrm_mark_put(skb, &x->mark)) 785 if (xfrm_mark_put(skb, &x->mark))
692 goto nla_put_failure; 786 goto nla_put_failure;
693 787
788 if (x->replay_esn)
789 NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
790 xfrm_replay_state_esn_len(x->replay_esn), x->replay_esn);
791
694 if (x->security && copy_sec_ctx(x->security, skb) < 0) 792 if (x->security && copy_sec_ctx(x->security, skb) < 0)
695 goto nla_put_failure; 793 goto nla_put_failure;
696 794
@@ -799,7 +897,7 @@ static int build_spdinfo(struct sk_buff *skb, struct net *net,
799 u32 *f; 897 u32 *f;
800 898
801 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0); 899 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
802 if (nlh == NULL) /* shouldnt really happen ... */ 900 if (nlh == NULL) /* shouldn't really happen ... */
803 return -EMSGSIZE; 901 return -EMSGSIZE;
804 902
805 f = nlmsg_data(nlh); 903 f = nlmsg_data(nlh);
@@ -859,7 +957,7 @@ static int build_sadinfo(struct sk_buff *skb, struct net *net,
859 u32 *f; 957 u32 *f;
860 958
861 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0); 959 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
862 if (nlh == NULL) /* shouldnt really happen ... */ 960 if (nlh == NULL) /* shouldn't really happen ... */
863 return -EMSGSIZE; 961 return -EMSGSIZE;
864 962
865 f = nlmsg_data(nlh); 963 f = nlmsg_data(nlh);
@@ -1251,9 +1349,9 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1251 struct km_event c; 1349 struct km_event c;
1252 int err; 1350 int err;
1253 int excl; 1351 int excl;
1254 uid_t loginuid = NETLINK_CB(skb).loginuid; 1352 uid_t loginuid = audit_get_loginuid(current);
1255 u32 sessionid = NETLINK_CB(skb).sessionid; 1353 u32 sessionid = audit_get_sessionid(current);
1256 u32 sid = NETLINK_CB(skb).sid; 1354 u32 sid;
1257 1355
1258 err = verify_newpolicy_info(p); 1356 err = verify_newpolicy_info(p);
1259 if (err) 1357 if (err)
@@ -1266,12 +1364,13 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1266 if (!xp) 1364 if (!xp)
1267 return err; 1365 return err;
1268 1366
1269 /* shouldnt excl be based on nlh flags?? 1367 /* shouldn't excl be based on nlh flags??
1270 * Aha! this is anti-netlink really i.e more pfkey derived 1368 * Aha! this is anti-netlink really i.e more pfkey derived
1271 * in netlink excl is a flag and you wouldnt need 1369 * in netlink excl is a flag and you wouldnt need
1272 * a type XFRM_MSG_UPDPOLICY - JHS */ 1370 * a type XFRM_MSG_UPDPOLICY - JHS */
1273 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; 1371 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
1274 err = xfrm_policy_insert(p->dir, xp, excl); 1372 err = xfrm_policy_insert(p->dir, xp, excl);
1373 security_task_getsecid(current, &sid);
1275 xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid); 1374 xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
1276 1375
1277 if (err) { 1376 if (err) {
@@ -1508,10 +1607,11 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1508 NETLINK_CB(skb).pid); 1607 NETLINK_CB(skb).pid);
1509 } 1608 }
1510 } else { 1609 } else {
1511 uid_t loginuid = NETLINK_CB(skb).loginuid; 1610 uid_t loginuid = audit_get_loginuid(current);
1512 u32 sessionid = NETLINK_CB(skb).sessionid; 1611 u32 sessionid = audit_get_sessionid(current);
1513 u32 sid = NETLINK_CB(skb).sid; 1612 u32 sid;
1514 1613
1614 security_task_getsecid(current, &sid);
1515 xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid, 1615 xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
1516 sid); 1616 sid);
1517 1617
@@ -1539,9 +1639,9 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1539 struct xfrm_audit audit_info; 1639 struct xfrm_audit audit_info;
1540 int err; 1640 int err;
1541 1641
1542 audit_info.loginuid = NETLINK_CB(skb).loginuid; 1642 audit_info.loginuid = audit_get_loginuid(current);
1543 audit_info.sessionid = NETLINK_CB(skb).sessionid; 1643 audit_info.sessionid = audit_get_sessionid(current);
1544 audit_info.secid = NETLINK_CB(skb).sid; 1644 security_task_getsecid(current, &audit_info.secid);
1545 err = xfrm_state_flush(net, p->proto, &audit_info); 1645 err = xfrm_state_flush(net, p->proto, &audit_info);
1546 if (err) { 1646 if (err) {
1547 if (err == -ESRCH) /* empty table */ 1647 if (err == -ESRCH) /* empty table */
@@ -1558,17 +1658,21 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1558 return 0; 1658 return 0;
1559} 1659}
1560 1660
1561static inline size_t xfrm_aevent_msgsize(void) 1661static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x)
1562{ 1662{
1663 size_t replay_size = x->replay_esn ?
1664 xfrm_replay_state_esn_len(x->replay_esn) :
1665 sizeof(struct xfrm_replay_state);
1666
1563 return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id)) 1667 return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
1564 + nla_total_size(sizeof(struct xfrm_replay_state)) 1668 + nla_total_size(replay_size)
1565 + nla_total_size(sizeof(struct xfrm_lifetime_cur)) 1669 + nla_total_size(sizeof(struct xfrm_lifetime_cur))
1566 + nla_total_size(sizeof(struct xfrm_mark)) 1670 + nla_total_size(sizeof(struct xfrm_mark))
1567 + nla_total_size(4) /* XFRM_AE_RTHR */ 1671 + nla_total_size(4) /* XFRM_AE_RTHR */
1568 + nla_total_size(4); /* XFRM_AE_ETHR */ 1672 + nla_total_size(4); /* XFRM_AE_ETHR */
1569} 1673}
1570 1674
1571static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c) 1675static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
1572{ 1676{
1573 struct xfrm_aevent_id *id; 1677 struct xfrm_aevent_id *id;
1574 struct nlmsghdr *nlh; 1678 struct nlmsghdr *nlh;
@@ -1586,7 +1690,13 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
1586 id->reqid = x->props.reqid; 1690 id->reqid = x->props.reqid;
1587 id->flags = c->data.aevent; 1691 id->flags = c->data.aevent;
1588 1692
1589 NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay); 1693 if (x->replay_esn)
1694 NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
1695 xfrm_replay_state_esn_len(x->replay_esn),
1696 x->replay_esn);
1697 else
1698 NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
1699
1590 NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft); 1700 NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
1591 1701
1592 if (id->flags & XFRM_AE_RTHR) 1702 if (id->flags & XFRM_AE_RTHR)
@@ -1619,16 +1729,16 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1619 struct xfrm_aevent_id *p = nlmsg_data(nlh); 1729 struct xfrm_aevent_id *p = nlmsg_data(nlh);
1620 struct xfrm_usersa_id *id = &p->sa_id; 1730 struct xfrm_usersa_id *id = &p->sa_id;
1621 1731
1622 r_skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
1623 if (r_skb == NULL)
1624 return -ENOMEM;
1625
1626 mark = xfrm_mark_get(attrs, &m); 1732 mark = xfrm_mark_get(attrs, &m);
1627 1733
1628 x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family); 1734 x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
1629 if (x == NULL) { 1735 if (x == NULL)
1630 kfree_skb(r_skb);
1631 return -ESRCH; 1736 return -ESRCH;
1737
1738 r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
1739 if (r_skb == NULL) {
1740 xfrm_state_put(x);
1741 return -ENOMEM;
1632 } 1742 }
1633 1743
1634 /* 1744 /*
@@ -1660,9 +1770,10 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1660 struct xfrm_mark m; 1770 struct xfrm_mark m;
1661 struct xfrm_aevent_id *p = nlmsg_data(nlh); 1771 struct xfrm_aevent_id *p = nlmsg_data(nlh);
1662 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 1772 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
1773 struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
1663 struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 1774 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
1664 1775
1665 if (!lt && !rp) 1776 if (!lt && !rp && !re)
1666 return err; 1777 return err;
1667 1778
1668 /* pedantic mode - thou shalt sayeth replaceth */ 1779 /* pedantic mode - thou shalt sayeth replaceth */
@@ -1678,6 +1789,10 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1678 if (x->km.state != XFRM_STATE_VALID) 1789 if (x->km.state != XFRM_STATE_VALID)
1679 goto out; 1790 goto out;
1680 1791
1792 err = xfrm_replay_verify_len(x->replay_esn, rp);
1793 if (err)
1794 goto out;
1795
1681 spin_lock_bh(&x->lock); 1796 spin_lock_bh(&x->lock);
1682 xfrm_update_ae_params(x, attrs); 1797 xfrm_update_ae_params(x, attrs);
1683 spin_unlock_bh(&x->lock); 1798 spin_unlock_bh(&x->lock);
@@ -1706,9 +1821,9 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1706 if (err) 1821 if (err)
1707 return err; 1822 return err;
1708 1823
1709 audit_info.loginuid = NETLINK_CB(skb).loginuid; 1824 audit_info.loginuid = audit_get_loginuid(current);
1710 audit_info.sessionid = NETLINK_CB(skb).sessionid; 1825 audit_info.sessionid = audit_get_sessionid(current);
1711 audit_info.secid = NETLINK_CB(skb).sid; 1826 security_task_getsecid(current, &audit_info.secid);
1712 err = xfrm_policy_flush(net, type, &audit_info); 1827 err = xfrm_policy_flush(net, type, &audit_info);
1713 if (err) { 1828 if (err) {
1714 if (err == -ESRCH) /* empty table */ 1829 if (err == -ESRCH) /* empty table */
@@ -1775,9 +1890,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1775 1890
1776 err = 0; 1891 err = 0;
1777 if (up->hard) { 1892 if (up->hard) {
1778 uid_t loginuid = NETLINK_CB(skb).loginuid; 1893 uid_t loginuid = audit_get_loginuid(current);
1779 uid_t sessionid = NETLINK_CB(skb).sessionid; 1894 u32 sessionid = audit_get_sessionid(current);
1780 u32 sid = NETLINK_CB(skb).sid; 1895 u32 sid;
1896
1897 security_task_getsecid(current, &sid);
1781 xfrm_policy_delete(xp, p->dir); 1898 xfrm_policy_delete(xp, p->dir);
1782 xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid); 1899 xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
1783 1900
@@ -1816,9 +1933,11 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1816 km_state_expired(x, ue->hard, current->pid); 1933 km_state_expired(x, ue->hard, current->pid);
1817 1934
1818 if (ue->hard) { 1935 if (ue->hard) {
1819 uid_t loginuid = NETLINK_CB(skb).loginuid; 1936 uid_t loginuid = audit_get_loginuid(current);
1820 uid_t sessionid = NETLINK_CB(skb).sessionid; 1937 u32 sessionid = audit_get_sessionid(current);
1821 u32 sid = NETLINK_CB(skb).sid; 1938 u32 sid;
1939
1940 security_task_getsecid(current, &sid);
1822 __xfrm_state_delete(x); 1941 __xfrm_state_delete(x);
1823 xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid); 1942 xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
1824 } 1943 }
@@ -1972,7 +2091,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
1972#endif 2091#endif
1973 2092
1974#ifdef CONFIG_XFRM_MIGRATE 2093#ifdef CONFIG_XFRM_MIGRATE
1975static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb) 2094static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
1976{ 2095{
1977 struct xfrm_user_migrate um; 2096 struct xfrm_user_migrate um;
1978 2097
@@ -1990,7 +2109,7 @@ static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb)
1990 return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um); 2109 return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
1991} 2110}
1992 2111
1993static int copy_to_user_kmaddress(struct xfrm_kmaddress *k, struct sk_buff *skb) 2112static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
1994{ 2113{
1995 struct xfrm_user_kmaddress uk; 2114 struct xfrm_user_kmaddress uk;
1996 2115
@@ -2011,11 +2130,11 @@ static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
2011 + userpolicy_type_attrsize(); 2130 + userpolicy_type_attrsize();
2012} 2131}
2013 2132
2014static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m, 2133static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
2015 int num_migrate, struct xfrm_kmaddress *k, 2134 int num_migrate, const struct xfrm_kmaddress *k,
2016 struct xfrm_selector *sel, u8 dir, u8 type) 2135 const struct xfrm_selector *sel, u8 dir, u8 type)
2017{ 2136{
2018 struct xfrm_migrate *mp; 2137 const struct xfrm_migrate *mp;
2019 struct xfrm_userpolicy_id *pol_id; 2138 struct xfrm_userpolicy_id *pol_id;
2020 struct nlmsghdr *nlh; 2139 struct nlmsghdr *nlh;
2021 int i; 2140 int i;
@@ -2047,9 +2166,9 @@ nlmsg_failure:
2047 return -EMSGSIZE; 2166 return -EMSGSIZE;
2048} 2167}
2049 2168
2050static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 2169static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2051 struct xfrm_migrate *m, int num_migrate, 2170 const struct xfrm_migrate *m, int num_migrate,
2052 struct xfrm_kmaddress *k) 2171 const struct xfrm_kmaddress *k)
2053{ 2172{
2054 struct net *net = &init_net; 2173 struct net *net = &init_net;
2055 struct sk_buff *skb; 2174 struct sk_buff *skb;
@@ -2065,9 +2184,9 @@ static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2065 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC); 2184 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
2066} 2185}
2067#else 2186#else
2068static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 2187static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2069 struct xfrm_migrate *m, int num_migrate, 2188 const struct xfrm_migrate *m, int num_migrate,
2070 struct xfrm_kmaddress *k) 2189 const struct xfrm_kmaddress *k)
2071{ 2190{
2072 return -ENOPROTOOPT; 2191 return -ENOPROTOOPT;
2073} 2192}
@@ -2122,6 +2241,8 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
2122 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, 2241 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
2123 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) }, 2242 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
2124 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) }, 2243 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
2244 [XFRMA_TFCPAD] = { .type = NLA_U32 },
2245 [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
2125}; 2246};
2126 2247
2127static struct xfrm_link { 2248static struct xfrm_link {
@@ -2205,7 +2326,7 @@ static inline size_t xfrm_expire_msgsize(void)
2205 + nla_total_size(sizeof(struct xfrm_mark)); 2326 + nla_total_size(sizeof(struct xfrm_mark));
2206} 2327}
2207 2328
2208static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c) 2329static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
2209{ 2330{
2210 struct xfrm_user_expire *ue; 2331 struct xfrm_user_expire *ue;
2211 struct nlmsghdr *nlh; 2332 struct nlmsghdr *nlh;
@@ -2227,7 +2348,7 @@ nla_put_failure:
2227 return -EMSGSIZE; 2348 return -EMSGSIZE;
2228} 2349}
2229 2350
2230static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c) 2351static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
2231{ 2352{
2232 struct net *net = xs_net(x); 2353 struct net *net = xs_net(x);
2233 struct sk_buff *skb; 2354 struct sk_buff *skb;
@@ -2244,12 +2365,12 @@ static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
2244 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC); 2365 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
2245} 2366}
2246 2367
2247static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c) 2368static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
2248{ 2369{
2249 struct net *net = xs_net(x); 2370 struct net *net = xs_net(x);
2250 struct sk_buff *skb; 2371 struct sk_buff *skb;
2251 2372
2252 skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC); 2373 skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
2253 if (skb == NULL) 2374 if (skb == NULL)
2254 return -ENOMEM; 2375 return -ENOMEM;
2255 2376
@@ -2259,7 +2380,7 @@ static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c)
2259 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC); 2380 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
2260} 2381}
2261 2382
2262static int xfrm_notify_sa_flush(struct km_event *c) 2383static int xfrm_notify_sa_flush(const struct km_event *c)
2263{ 2384{
2264 struct net *net = c->net; 2385 struct net *net = c->net;
2265 struct xfrm_usersa_flush *p; 2386 struct xfrm_usersa_flush *p;
@@ -2301,6 +2422,10 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
2301 l += nla_total_size(sizeof(*x->calg)); 2422 l += nla_total_size(sizeof(*x->calg));
2302 if (x->encap) 2423 if (x->encap)
2303 l += nla_total_size(sizeof(*x->encap)); 2424 l += nla_total_size(sizeof(*x->encap));
2425 if (x->tfcpad)
2426 l += nla_total_size(sizeof(x->tfcpad));
2427 if (x->replay_esn)
2428 l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
2304 if (x->security) 2429 if (x->security)
2305 l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) + 2430 l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
2306 x->security->ctx_len); 2431 x->security->ctx_len);
@@ -2313,7 +2438,7 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
2313 return l; 2438 return l;
2314} 2439}
2315 2440
2316static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c) 2441static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
2317{ 2442{
2318 struct net *net = xs_net(x); 2443 struct net *net = xs_net(x);
2319 struct xfrm_usersa_info *p; 2444 struct xfrm_usersa_info *p;
@@ -2370,7 +2495,7 @@ nla_put_failure:
2370 return -1; 2495 return -1;
2371} 2496}
2372 2497
2373static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c) 2498static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
2374{ 2499{
2375 2500
2376 switch (c->event) { 2501 switch (c->event) {
@@ -2529,7 +2654,7 @@ static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
2529} 2654}
2530 2655
2531static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, 2656static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2532 int dir, struct km_event *c) 2657 int dir, const struct km_event *c)
2533{ 2658{
2534 struct xfrm_user_polexpire *upe; 2659 struct xfrm_user_polexpire *upe;
2535 struct nlmsghdr *nlh; 2660 struct nlmsghdr *nlh;
@@ -2559,7 +2684,7 @@ nlmsg_failure:
2559 return -EMSGSIZE; 2684 return -EMSGSIZE;
2560} 2685}
2561 2686
2562static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 2687static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
2563{ 2688{
2564 struct net *net = xp_net(xp); 2689 struct net *net = xp_net(xp);
2565 struct sk_buff *skb; 2690 struct sk_buff *skb;
@@ -2574,7 +2699,7 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
2574 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC); 2699 return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
2575} 2700}
2576 2701
2577static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c) 2702static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
2578{ 2703{
2579 struct net *net = xp_net(xp); 2704 struct net *net = xp_net(xp);
2580 struct xfrm_userpolicy_info *p; 2705 struct xfrm_userpolicy_info *p;
@@ -2639,7 +2764,7 @@ nlmsg_failure:
2639 return -1; 2764 return -1;
2640} 2765}
2641 2766
2642static int xfrm_notify_policy_flush(struct km_event *c) 2767static int xfrm_notify_policy_flush(const struct km_event *c)
2643{ 2768{
2644 struct net *net = c->net; 2769 struct net *net = c->net;
2645 struct nlmsghdr *nlh; 2770 struct nlmsghdr *nlh;
@@ -2664,7 +2789,7 @@ nlmsg_failure:
2664 return -1; 2789 return -1;
2665} 2790}
2666 2791
2667static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 2792static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
2668{ 2793{
2669 2794
2670 switch (c->event) { 2795 switch (c->event) {
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-18 01:40:38 -0500