freeswan/klips/net/ipsec/ipsec_sa.c

   1 /*
   2  * Common routines for IPsec SA maintenance routines.
   3  *
   4  * Copyright (C) 1996, 1997  John Ioannidis.
   5  * Copyright (C) 1998, 1999, 2000, 2001  Richard Guy Briggs.
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  *
  17  * RCSID $Id: ipsec_sa.c,v 1.5 2002/01/29 17:17:56 mcr Exp $
  18  *
  19  * This is the file formerly known as "ipsec_xform.h"
  20  *
  21  */
  22
  23 #include <linux/config.h>
  24 #include <linux/version.h>
  25 #include <linux/kernel.h> /* printk() */
  26
  27 #include "ipsec_param.h"
  28
  29 #ifdef MALLOC_SLAB
  30 # include <linux/slab.h> /* kmalloc() */
  31 #else /* MALLOC_SLAB */
  32 # include <linux/malloc.h> /* kmalloc() */
  33 #endif /* MALLOC_SLAB */
  34 #include <linux/errno.h>  /* error codes */
  35 #include <linux/types.h>  /* size_t */
  36 #include <linux/interrupt.h> /* mark_bh */
  37
  38 #include <linux/netdevice.h>   /* struct device, and other headers */
  39 #include <linux/etherdevice.h> /* eth_type_trans */
  40 #include <linux/ip.h>          /* struct iphdr */
  41 #include <linux/skbuff.h>
  42 #include <linux/random.h>       /* get_random_bytes() */
  43 #include <freeswan.h>
  44 #ifdef SPINLOCK
  45 #ifdef SPINLOCK_23
  46 #include <linux/spinlock.h> /* *lock* */
  47 #else /* SPINLOCK_23 */
  48 #include <asm/spinlock.h> /* *lock* */
  49 #endif /* SPINLOCK_23 */
  50 #endif /* SPINLOCK */
  51 #ifdef NET_21
  52 #include <asm/uaccess.h>
  53 #include <linux/in6.h>
  54 #endif
  55 #include <asm/checksum.h>
  56 #include <net/ip.h>
  57
  58 #ifdef USE_IXP4XX_CRYPTO
  59 #include "ipsec_glue.h"         /* glue code */
  60 #include "ipsec_glue_desc.h"            /* glue code */
  61 #endif /* USE_IXP4XX_CRYPTO */
  62 #include "radij.h"
  63
  64 #include "ipsec_stats.h"
  65 #include "ipsec_life.h"
  66 #include "ipsec_sa.h"
  67 #include "ipsec_xform.h"
  68
  69 #include "ipsec_encap.h"
  70 #include "ipsec_radij.h"
  71 #include "ipsec_netlink.h"
  72 #include "ipsec_xform.h"
  73 #include "ipsec_ipe4.h"
  74 #include "ipsec_ah.h"
  75 #include "ipsec_esp.h"
  76
  77 #include <pfkeyv2.h>
  78 #include <pfkey.h>
  79
  80 #include "ipsec_proto.h"
  81 #include "ipsec_alg.h"
  82
  83
  84 #ifdef CONFIG_IPSEC_DEBUG
  85 int debug_xform = 0;
  86 #endif /* CONFIG_IPSEC_DEBUG */
  87
  88 #define SENDERR(_x) do { error = -(_x); goto errlab; } while (0)
  89
  90 struct ipsec_sa *ipsec_sadb_hash[SADB_HASHMOD];
  91 #ifdef SPINLOCK
  92 spinlock_t tdb_lock = SPIN_LOCK_UNLOCKED;
  93 #else /* SPINLOCK */
  94 spinlock_t tdb_lock;
  95 #endif /* SPINLOCK */
  96
  97 int
  98 ipsec_sadb_init(void)
  99 {
 100         int i;
 101
 102         for(i = 1; i < SADB_HASHMOD; i++) {
 103                 ipsec_sadb_hash[i] = NULL;
 104         }
 105         return 0;
 106 }
 107
 108 struct ipsec_sa *
 109 ipsec_sa_getbyid(struct sa_id *said)
 110 {
 111         int hashval;
 112         struct ipsec_sa *ips;
 113         char sa[SATOA_BUF];
 114         size_t sa_len;
 115
 116         if(!said) {
 117                 KLIPS_PRINT(debug_xform,
 118                             "klips_error:gettdb: "
 119                             "null pointer passed in!\n");
 120                 return NULL;
 121         }
 122
 123         sa_len = satoa(*said, 0, sa, SATOA_BUF);
 124
 125         hashval = (said->spi+said->dst.s_addr+said->proto) % SADB_HASHMOD;
 126
 127         KLIPS_PRINT(debug_xform,
 128                     "klips_debug:gettdb: "
 129                     "linked entry in tdb table for hash=%d of SA:%s requested.\n",
 130                     hashval,
 131                     sa_len ? sa : " (error)");
 132
 133         if(!(ips = ipsec_sadb_hash[hashval])) {
 134                 KLIPS_PRINT(debug_xform,
 135                             "klips_debug:gettdb: "
 136                             "no entries in tdb table for hash=%d of SA:%s.\n",
 137                             hashval,
 138                             sa_len ? sa : " (error)");
 139                 return NULL;
 140         }
 141
 142         for (; ips; ips = ips->ips_hnext) {
 143                 if ((ips->ips_said.spi == said->spi) &&
 144                     (ips->ips_said.dst.s_addr == said->dst.s_addr) &&
 145                     (ips->ips_said.proto == said->proto)) {
 146                         return ips;
 147                 }
 148         }
 149
 150         KLIPS_PRINT(debug_xform,
 151                     "klips_debug:gettdb: "
 152                     "no entry in linked list for hash=%d of SA:%s.\n",
 153                     hashval,
 154                     sa_len ? sa : " (error)");
 155         return NULL;
 156 }
 157
 158 /*
 159   The tdb table better *NOT* be locked before it is handed in, or SMP locks will happen
 160 */
 161 int
 162 ipsec_sa_put(struct ipsec_sa *ips)
 163 {
 164         int error = 0;
 165         unsigned int hashval;
 166
 167         if(!ips) {
 168                 KLIPS_PRINT(debug_xform,
 169                             "klips_error:puttdb: "
 170                             "null pointer passed in!\n");
 171                 return -ENODATA;
 172         }
 173         hashval = ((ips->ips_said.spi + ips->ips_said.dst.s_addr + ips->ips_said.proto) % SADB_HASHMOD);
 174
 175 #ifndef USE_IXP4XX_CRYPTO
 176         spin_lock_bh(&tdb_lock);
 177
 178         ips->ips_hnext = ipsec_sadb_hash[hashval];
 179         ipsec_sadb_hash[hashval] = ips;
 180
 181         spin_unlock_bh(&tdb_lock);
 182 #endif
 183
 184 #ifdef USE_IXP4XX_CRYPTO
 185         /* Add correspond crypto context for hardware accelarator */
 186         if (IPSEC_GLUE_STATUS_FAIL == ipsec_glue_crypto_context_put (ips))
 187         {
 188                 KLIPS_PRINT(debug_xform,
 189                             "klips_error:puttdb: "
 190                             "Cannot add crypto context!\n");
 191                 error = 1;
 192         } else {
 193                 /* adding the crypt context succeded -  only now can we add the ips
 194                  * to the hash table */
 195                 spin_lock_bh(&tdb_lock);
 196
 197                 ips->ips_hnext = ipsec_sadb_hash[hashval];
 198                 ipsec_sadb_hash[hashval] = ips;
 199
 200                 spin_unlock_bh(&tdb_lock);
 201         }
 202 #endif /*USE_IXP4XX_CRYPTO */
 203         return error;
 204 }
 205
 206 /*
 207   The tdb table better be locked before it is handed in, or races might happen
 208 */
 209 int
 210 ipsec_sa_del(struct ipsec_sa *ips)
 211 {
 212         unsigned int hashval;
 213         struct ipsec_sa *tdbtp;
 214         char sa[SATOA_BUF];
 215         size_t sa_len;
 216         struct _IpsecRcvDesc *p = NULL;
 217         struct _IpsecXmitDesc *q = NULL;
 218
 219         if(!ips) {
 220                 KLIPS_PRINT(debug_xform,
 221                             "klips_error:deltdb: "
 222                             "null pointer passed in!\n");
 223                 return -ENODATA;
 224         }
 225
 226         sa_len = satoa(ips->ips_said, 0, sa, SATOA_BUF);
 227         if(ips->ips_inext || ips->ips_onext) {
 228                 KLIPS_PRINT(debug_xform,
 229                             "klips_error:deltdb: "
 230                             "SA:%s still linked!\n",
 231                             sa_len ? sa : " (error)");
 232                 return -EMLINK;
 233         }
 234
 235 #ifdef USE_IXP4XX_CRYPTO
 236         for (p = ips->RcvDesc_head; p != NULL; p = p->RcvDesc_next) {
 237                 p->tdbp = NULL;
 238         }
 239
 240         for (q = ips->XmitDesc_head; q != NULL; q = q->XmitDesc_next) {
 241                 q->tdbp = NULL;
 242         }
 243 #endif
 244
 245         hashval = ((ips->ips_said.spi + ips->ips_said.dst.s_addr + ips->ips_said.proto) % SADB_HASHMOD);
 246
 247         KLIPS_PRINT(debug_xform,
 248                     "klips_debug:deltdb: "
 249                     "deleting SA:%s, hashval=%d.\n",
 250                     sa_len ? sa : " (error)",
 251                     hashval);
 252         if(!ipsec_sadb_hash[hashval]) {
 253                 KLIPS_PRINT(debug_xform,
 254                             "klips_debug:deltdb: "
 255                             "no entries in tdb table for hash=%d of SA:%s.\n",
 256                             hashval,
 257                             sa_len ? sa : " (error)");
 258                 return -ENOENT;
 259         }
 260
 261         if (ips == ipsec_sadb_hash[hashval]) {
 262                 ipsec_sadb_hash[hashval] = ipsec_sadb_hash[hashval]->ips_hnext;
 263 #ifndef USE_IXP4XX_CRYPTO
 264                 ips->ips_hnext = NULL;
 265 #endif /* USE_IXP4XX_CRYPTO */
 266                 KLIPS_PRINT(debug_xform,
 267                             "klips_debug:deltdb: "
 268                             "successfully deleted first tdb in chain.\n");
 269 #ifdef USE_IXP4XX_CRYPTO
 270                 /* Delete cryto context associate with this SA */
 271                 /*
 272                  * Delete on SA and skip deleting the non crypto context becuase no
 273                  * associate crypto context for unsupported SA (e.g. IPCOMP)
 274                  */
 275                 if (ips->ips_crypto_state >= IPSEC_GLUE_UNSUPPORTED_CTXID)
 276                 {
 277                         KLIPS_PRINT(debug_xform,
 278                         "klips_debug:deltdb: "
 279                         "Delete on SA and no crypto context associated!\n");
 280                 }
 281                 else
 282                 {
 283                         if (IPSEC_GLUE_STATUS_FAIL ==
 284                         ipsec_glue_crypto_context_del(ips->ips_crypto_context_id))
 285                         {
 286                         KLIPS_PRINT(debug_xform,
 287                                 "klips_error:deltdb: "
 288                                 "Cannot delete crypto context!\n");
 289                                 return (IPSEC_GLUE_STATUS_FAIL);
 290                         }
 291                 }
 292                 /* Set crypto context ID to default value */
 293                 ips->ips_crypto_state = IPSEC_GLUE_INIT_CTXID;
 294                 ips->ips_hnext = NULL;
 295 #endif /* USE_IXP4XX_CRYPTO */
 296                 return 0;
 297         } else {
 298                 for (tdbtp = ipsec_sadb_hash[hashval];
 299                      tdbtp;
 300                      tdbtp = tdbtp->ips_hnext) {
 301                         if (tdbtp->ips_hnext == ips) {
 302 #ifndef USE_IXP4XX_CRYPTO
 303                                 tdbtp->ips_hnext = ips->ips_hnext;
 304                                 ips->ips_hnext = NULL;
 305 #endif
 306                                 KLIPS_PRINT(debug_xform,
 307                                             "klips_debug:deltdb: "
 308                                             "successfully deleted link in tdb chain.\n");
 309 #ifdef USE_IXP4XX_CRYPTO
 310                                 /*
 311                                  * Delete on SA and skip deleting the non crypto context becuase no
 312                                  * associate crypto context for unsupported SA (e.g. IPCOMP)
 313                                  */
 314                                 if (ips->ips_crypto_state >= IPSEC_GLUE_UNSUPPORTED_CTXID)
 315                                 {
 316                                         KLIPS_PRINT(debug_xform,
 317                                         "klips_debug:deltdb: "
 318                                         "Delete on SA and no crypto context associated!\n");
 319                                 }
 320                                 else
 321                                 {
 322                                         /* Delete cryto context associate with this SA -in the chain */
 323                                         if (IPSEC_GLUE_STATUS_FAIL ==
 324                                         ipsec_glue_crypto_context_del(ips->ips_crypto_context_id))
 325                                         {
 326                                         KLIPS_PRINT(debug_xform,
 327                                                 "klips_error:deltdb: "
 328                                                 "Cannot delete crypto context!\n");
 329                                                 return (IPSEC_GLUE_STATUS_FAIL);
 330                                         }
 331                                 }
 332                                 /* Set crypto context ID to default value */
 333                                 ips->ips_crypto_state = IPSEC_GLUE_INIT_CTXID;
 334                                 tdbtp->ips_hnext = ips->ips_hnext;
 335                                 ips->ips_hnext = NULL;
 336 #endif /* USE_IXP4XX_CRYPTO */
 337                                 return 0;
 338                         }
 339                 }
 340         }
 341
 342         KLIPS_PRINT(debug_xform,
 343                     "klips_debug:deltdb: "
 344                     "no entries in linked list for hash=%d of SA:%s.\n",
 345                     hashval,
 346                     sa_len ? sa : " (error)");
 347         return -ENOENT;
 348 }
 349
 350 /*
 351   The tdb table better be locked before it is handed in, or races might happen
 352 */
 353 int
 354 ipsec_sa_delchain(struct ipsec_sa *ips)
 355 {
 356         struct ipsec_sa *tdbdel;
 357 #ifdef USE_IXP4XX_CRYPTO
 358         int temp_count, temp_done_count;
 359 #endif /* USE_IXP4XX_CRYPTO */
 360         int error = 0;
 361         char sa[SATOA_BUF];
 362         size_t sa_len;
 363
 364         if(!ips) {
 365                 KLIPS_PRINT(debug_xform,
 366                             "klips_error:deltdbchain: "
 367                             "null pointer passed in!\n");
 368                 return -ENODATA;
 369         }
 370
 371         sa_len = satoa(ips->ips_said, 0, sa, SATOA_BUF);
 372         KLIPS_PRINT(debug_xform,
 373                     "klips_debug:deltdbchain: "
 374                     "passed SA:%s\n",
 375                     sa_len ? sa : " (error)");
 376         while(ips->ips_onext) {
 377 #ifdef USE_IXP4XX_CRYPTO
 378                 ipsec_glue_update_state(ips, IX_FAIL);
 379 #endif /* USE_IXP4XX_CRYPTO */
 380                 ips = ips->ips_onext;
 381         }
 382
 383 #ifdef USE_IXP4XX_CRYPTO
 384         ipsec_glue_update_state(ips, IX_FAIL);
 385 #endif /* USE_IXP4XX_CRYPTO */
 386         while(ips) {
 387                 /* XXX send a pfkey message up to advise of deleted TDB */
 388                 sa_len = satoa(ips->ips_said, 0, sa, SATOA_BUF);
 389                 KLIPS_PRINT(debug_xform,
 390                             "klips_debug:deltdbchain: "
 391                             "unlinking and delting SA:%s",
 392                             sa_len ? sa : " (error)");
 393                 tdbdel = ips;
 394                 ips = ips->ips_inext;
 395                 if(ips) {
 396                         sa_len = satoa(ips->ips_said, 0, sa, SATOA_BUF);
 397                         KLIPS_PRINT(debug_xform,
 398                                     ", inext=%s",
 399                                     sa_len ? sa : " (error)");
 400                         tdbdel->ips_inext = NULL;
 401                         ips->ips_onext = NULL;
 402                 }
 403                 KLIPS_PRINT(debug_xform,
 404                             ".\n");
 405                 if((error = ipsec_sa_del(tdbdel))) {
 406                         KLIPS_PRINT(debug_xform,
 407                                     "klips_debug:deltdbchain: "
 408                                     "deltdb returned error %d.\n", -error);
 409                         return error;
 410                 }
 411                 if((error = ipsec_sa_wipe(tdbdel))) {
 412                         KLIPS_PRINT(debug_xform,
 413                                     "klips_debug:deltdbchain: "
 414                                     "ipsec_tdbwipe returned error %d.\n", -error);
 415                         return error;
 416                 }
 417         }
 418         return error;
 419 }
 420
 421 int
 422 ipsec_sadb_cleanup(__u8 proto)
 423 {
 424         int i;
 425         int error = 0;
 426         struct ipsec_sa *ips, **ipsprev, *tdbdel;
 427         char sa[SATOA_BUF];
 428         size_t sa_len;
 429
 430         KLIPS_PRINT(debug_xform,
 431                     "klips_debug:ipsec_tdbcleanup: "
 432                     "cleaning up proto=%d.\n",
 433                     proto);
 434
 435         spin_lock_bh(&tdb_lock);
 436
 437         for (i = 0; i < SADB_HASHMOD; i++) {
 438                 ipsprev = &(ipsec_sadb_hash[i]);
 439                 ips = ipsec_sadb_hash[i];
 440                 for(; ips;) {
 441                         sa_len = satoa(ips->ips_said, 0, sa, SATOA_BUF);
 442                         KLIPS_PRINT(debug_xform,
 443                                     "klips_debug:ipsec_tdbcleanup: "
 444                                     "checking SA:%s, hash=%d",
 445                                     sa_len ? sa : " (error)",
 446                                     i);
 447                         tdbdel = ips;
 448                         ips = tdbdel->ips_hnext;
 449                         if(ips) {
 450                                 sa_len = satoa(ips->ips_said, 0, sa, SATOA_BUF);
 451                                 KLIPS_PRINT(debug_xform,
 452                                             ", hnext=%s",
 453                                             sa_len ? sa : " (error)");
 454                         }
 455                         if(*ipsprev) {
 456                                 sa_len = satoa((*ipsprev)->ips_said, 0, sa, SATOA_BUF);
 457                                 KLIPS_PRINT(debug_xform,
 458                                             ", *ipsprev=%s",
 459                                             sa_len ? sa : " (error)");
 460                                 if((*ipsprev)->ips_hnext) {
 461                                         sa_len = satoa((*ipsprev)->ips_hnext->ips_said, 0, sa, SATOA_BUF);
 462                                         KLIPS_PRINT(debug_xform,
 463                                                     ", *ipsprev->ips_hnext=%s",
 464                                                     sa_len ? sa : " (error)");
 465                                 }
 466                         }
 467                         KLIPS_PRINT(debug_xform,
 468                                     ".\n");
 469                         if(!proto || (proto == tdbdel->ips_said.proto)) {
 470                                 sa_len = satoa(tdbdel->ips_said, 0, sa, SATOA_BUF);
 471                                 KLIPS_PRINT(debug_xform,
 472                                             "klips_debug:ipsec_tdbcleanup: "
 473                                             "deleting SA chain:%s.\n",
 474                                             sa_len ? sa : " (error)");
 475                                 if((error = ipsec_sa_delchain(tdbdel))) {
 476                                         SENDERR(-error);
 477                                 }
 478                                 ipsprev = &(ipsec_sadb_hash[i]);
 479                                 ips = ipsec_sadb_hash[i];
 480                                 KLIPS_PRINT(debug_xform,
 481                                             "klips_debug:ipsec_tdbcleanup: "
 482                                             "deleted SA chain:%s",
 483                                             sa_len ? sa : " (error)");
 484                                 if(ips) {
 485                                         sa_len = satoa(ips->ips_said, 0, sa, SATOA_BUF);
 486                                         KLIPS_PRINT(debug_xform,
 487                                                     ", tdbh[%d]=%s",
 488                                                     i,
 489                                                     sa_len ? sa : " (error)");
 490                                 }
 491                                 if(*ipsprev) {
 492                                         sa_len = satoa((*ipsprev)->ips_said, 0, sa, SATOA_BUF);
 493                                         KLIPS_PRINT(debug_xform,
 494                                                     ", *ipsprev=%s",
 495                                                     sa_len ? sa : " (error)");
 496                                         if((*ipsprev)->ips_hnext) {
 497                                                 sa_len = satoa((*ipsprev)->ips_hnext->ips_said, 0, sa, SATOA_BUF);
 498                                                 KLIPS_PRINT(debug_xform,
 499                                                             ", *ipsprev->ips_hnext=%s",
 500                                                             sa_len ? sa : " (error)");
 501                                         }
 502                                 }
 503                                 KLIPS_PRINT(debug_xform,
 504                                             ".\n");
 505                         } else {
 506                                 ipsprev = &tdbdel;
 507                         }
 508                 }
 509         }
 510  errlab:
 511
 512         spin_unlock_bh(&tdb_lock);
 513
 514         return(error);
 515 }
 516
 517 int
 518 ipsec_sa_wipe(struct ipsec_sa *ips)
 519 {
 520         if(!ips) {
 521                 return -ENODATA;
 522         }
 523
 524         if(ips->ips_addr_s) {
 525                 memset((caddr_t)(ips->ips_addr_s), 0, ips->ips_addr_s_size);
 526                 kfree(ips->ips_addr_s);
 527         }
 528         ips->ips_addr_s = NULL;
 529
 530         if(ips->ips_addr_d) {
 531                 memset((caddr_t)(ips->ips_addr_d), 0, ips->ips_addr_d_size);
 532                 kfree(ips->ips_addr_d);
 533         }
 534         ips->ips_addr_d = NULL;
 535
 536         if(ips->ips_addr_p) {
 537                 memset((caddr_t)(ips->ips_addr_p), 0, ips->ips_addr_p_size);
 538                 kfree(ips->ips_addr_p);
 539         }
 540         ips->ips_addr_p = NULL;
 541
 542 #ifdef CONFIG_IPSEC_NAT_TRAVERSAL
 543         if(ips->ips_natt_oa) {
 544                 memset((caddr_t)(ips->ips_natt_oa), 0, ips->ips_natt_oa_size);
 545                 kfree(ips->ips_natt_oa);
 546         }
 547         ips->ips_natt_oa = NULL;
 548 #endif
 549
 550         if(ips->ips_key_a) {
 551                 memset((caddr_t)(ips->ips_key_a), 0, ips->ips_key_a_size);
 552                 kfree(ips->ips_key_a);
 553         }
 554         ips->ips_key_a = NULL;
 555
 556         if(ips->ips_key_e) {
 557                 memset((caddr_t)(ips->ips_key_e), 0, ips->ips_key_e_size);
 558                 kfree(ips->ips_key_e);
 559         }
 560         ips->ips_key_e = NULL;
 561
 562         if(ips->ips_iv) {
 563                 memset((caddr_t)(ips->ips_iv), 0, ips->ips_iv_size);
 564                 kfree(ips->ips_iv);
 565         }
 566         ips->ips_iv = NULL;
 567
 568         if(ips->ips_ident_s.data) {
 569                 memset((caddr_t)(ips->ips_ident_s.data),
 570                        0,
 571                        ips->ips_ident_s.len * IPSEC_PFKEYv2_ALIGN - sizeof(struct sadb_ident));
 572                 kfree(ips->ips_ident_s.data);
 573         }
 574         ips->ips_ident_s.data = NULL;
 575
 576         if(ips->ips_ident_d.data) {
 577                 memset((caddr_t)(ips->ips_ident_d.data),
 578                        0,
 579                        ips->ips_ident_d.len * IPSEC_PFKEYv2_ALIGN - sizeof(struct sadb_ident));
 580                 kfree(ips->ips_ident_d.data);
 581         }
 582         ips->ips_ident_d.data = NULL;
 583
 584 #ifdef USE_IXP4XX_CRYPTO
 585 #ifdef CONFIG_IPSEC_ALG
 586         if (IPSEC_ALG_SA_ESP_ENC(ips)||IPSEC_ALG_SA_ESP_AUTH(ips)) {
 587                 ipsec_alg_sa_wipe(ips);
 588         }
 589 #endif
 590 #endif /* USE_IXP4XX_CRYPTO */
 591
 592         memset((caddr_t)ips, 0, sizeof(*ips));
 593         kfree(ips);
 594         ips = NULL;
 595
 596         return 0;
 597 }
 598
 599 /*
 600  * $Log: ipsec_sa.c,v $
 601  * Revision 1.5  2002/01/29 17:17:56  mcr
 602  *      moved include of ipsec_param.h to after include of linux/kernel.h
 603  *      otherwise, it seems that some option that is set in ipsec_param.h
 604  *      screws up something subtle in the include path to kernel.h, and
 605  *      it complains on the snprintf() prototype.
 606  *
 607  * Revision 1.4  2002/01/29 04:00:52  mcr
 608  *      more excise of kversions.h header.
 609  *
 610  * Revision 1.3  2002/01/29 02:13:18  mcr
 611  *      introduction of ipsec_kversion.h means that include of
 612  *      ipsec_param.h must preceed any decisions about what files to
 613  *      include to deal with differences in kernel source.
 614  *
 615  * Revision 1.2  2001/11/26 09:16:15  rgb
 616  * Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
 617  *
 618  * Revision 1.1.2.2  2001/10/22 21:05:41  mcr
 619  *      removed phony prototype for des_set_key.
 620  *
 621  * Revision 1.1.2.1  2001/09/25 02:24:57  mcr
 622  *      struct tdb -> struct ipsec_sa.
 623  *      sa(tdb) manipulation functions renamed and moved to ipsec_sa.c
 624  *      ipsec_xform.c removed. header file still contains useful things.
 625  *
 626  *
 627  *
 628  * CLONED from ipsec_xform.c:
 629  * Revision 1.53  2001/09/08 21:13:34  rgb
 630  * Added pfkey ident extension support for ISAKMPd. (NetCelo)
 631  *
 632  * Revision 1.52  2001/06/14 19:35:11  rgb
 633  * Update copyright date.
 634  *
 635  * Revision 1.51  2001/05/30 08:14:03  rgb
 636  * Removed vestiges of esp-null transforms.
 637  *
 638  * Revision 1.50  2001/05/03 19:43:18  rgb
 639  * Initialise error return variable.
 640  * Update SENDERR macro.
 641  * Fix sign of error return code for ipsec_tdbcleanup().
 642  * Use more appropriate return code for ipsec_tdbwipe().
 643  *
 644  * Revision 1.49  2001/04/19 18:56:17  rgb
 645  * Fixed tdb table locking comments.
 646  *
 647  * Revision 1.48  2001/02/27 22:24:55  rgb
 648  * Re-formatting debug output (line-splitting, joining, 1arg/line).
 649  * Check for satoa() return codes.
 650  *
 651  * Revision 1.47  2000/11/06 04:32:08  rgb
 652  * Ditched spin_lock_irqsave in favour of spin_lock_bh.
 653  *
 654  * Revision 1.46  2000/09/20 16:21:57  rgb
 655  * Cleaned up ident string alloc/free.
 656  *
 657  * Revision 1.45  2000/09/08 19:16:51  rgb
 658  * Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
 659  * Removed all references to CONFIG_IPSEC_PFKEYv2.
 660  *
 661  * Revision 1.44  2000/08/30 05:29:04  rgb
 662  * Compiler-define out no longer used tdb_init() in ipsec_xform.c.
 663  *
 664  * Revision 1.43  2000/08/18 21:30:41  rgb
 665  * Purged all tdb_spi, tdb_proto and tdb_dst macros.  They are unclear.
 666  *
 667  * Revision 1.42  2000/08/01 14:51:51  rgb
 668  * Removed _all_ remaining traces of DES.
 669  *
 670  * Revision 1.41  2000/07/28 14:58:31  rgb
 671  * Changed kfree_s to kfree, eliminating extra arg to fix 2.4.0-test5.
 672  *
 673  * Revision 1.40  2000/06/28 05:50:11  rgb
 674  * Actually set iv_bits.
 675  *
 676  * Revision 1.39  2000/05/10 23:11:09  rgb
 677  * Added netlink debugging output.
 678  * Added a cast to quiet down the ntohl bug.
 679  *
 680  * Revision 1.38  2000/05/10 19:18:42  rgb
 681  * Cast output of ntohl so that the broken prototype doesn't make our
 682  * compile noisy.
 683  *
 684  * Revision 1.37  2000/03/16 14:04:59  rgb
 685  * Hardwired CONFIG_IPSEC_PFKEYv2 on.
 686  *
 687  * Revision 1.36  2000/01/26 10:11:28  rgb
 688  * Fixed spacing in error text causing run-in words.
 689  *
 690  * Revision 1.35  2000/01/21 06:17:16  rgb
 691  * Tidied up compiler directive indentation for readability.
 692  * Added ictx,octx vars for simplification.(kravietz)
 693  * Added macros for HMAC padding magic numbers.(kravietz)
 694  * Fixed missing key length reporting bug.
 695  * Fixed bug in tdbwipe to return immediately on NULL tdbp passed in.
 696  *
 697  * Revision 1.34  1999/12/08 00:04:19  rgb
 698  * Fixed SA direction overwriting bug for netlink users.
 699  *
 700  * Revision 1.33  1999/12/01 22:16:44  rgb
 701  * Minor formatting changes in ESP MD5 initialisation.
 702  *
 703  * Revision 1.32  1999/11/25 09:06:36  rgb
 704  * Fixed error return messages, should be returning negative numbers.
 705  * Implemented SENDERR macro for propagating error codes.
 706  * Added debug message and separate error code for algorithms not compiled
 707  * in.
 708  *
 709  * Revision 1.31  1999/11/23 23:06:26  rgb
 710  * Sort out pfkey and freeswan headers, putting them in a library path.
 711  *
 712  * Revision 1.30  1999/11/18 04:09:20  rgb
 713  * Replaced all kernel version macros to shorter, readable form.
 714  *
 715  * Revision 1.29  1999/11/17 15:53:40  rgb
 716  * Changed all occurrences of #include "../../../lib/freeswan.h"
 717  * to #include <freeswan.h> which works due to -Ilibfreeswan in the
 718  * klips/net/ipsec/Makefile.
 719  *
 720  * Revision 1.28  1999/10/18 20:04:01  rgb
 721  * Clean-out unused cruft.
 722  *
 723  * Revision 1.27  1999/10/03 19:01:03  rgb
 724  * Spinlock support for 2.3.xx and 2.0.xx kernels.
 725  *
 726  * Revision 1.26  1999/10/01 16:22:24  rgb
 727  * Switch from assignment init. to functional init. of spinlocks.
 728  *
 729  * Revision 1.25  1999/10/01 15:44:54  rgb
 730  * Move spinlock header include to 2.1> scope.
 731  *
 732  * Revision 1.24  1999/10/01 00:03:46  rgb
 733  * Added tdb structure locking.
 734  * Minor formatting changes.
 735  * Add function to initialize tdb hash table.
 736  *
 737  * Revision 1.23  1999/05/25 22:42:12  rgb
 738  * Add deltdbchain() debugging.
 739  *
 740  * Revision 1.22  1999/05/25 21:24:31  rgb
 741  * Add debugging statements to deltdbchain().
 742  *
 743  * Revision 1.21  1999/05/25 03:51:48  rgb
 744  * Refix error return code.
 745  *
 746  * Revision 1.20  1999/05/25 03:34:07  rgb
 747  * Fix error return for flush.
 748  *
 749  * Revision 1.19  1999/05/09 03:25:37  rgb
 750  * Fix bug introduced by 2.2 quick-and-dirty patch.
 751  *
 752  * Revision 1.18  1999/05/05 22:02:32  rgb
 753  * Add a quick and dirty port to 2.2 kernels by Marc Boucher <marc@mbsi.ca>.
 754  *
 755  * Revision 1.17  1999/04/29 15:20:16  rgb
 756  * Change gettdb parameter to a pointer to reduce stack loading and
 757  * facilitate parameter sanity checking.
 758  * Add sanity checking for null pointer arguments.
 759  * Add debugging instrumentation.
 760  * Add function deltdbchain() which will take care of unlinking,
 761  * zeroing and deleting a chain of tdbs.
 762  * Add a parameter to tdbcleanup to be able to delete a class of SAs.
 763  * tdbwipe now actually zeroes the tdb as well as any of its pointed
 764  * structures.
 765  *
 766  * Revision 1.16  1999/04/16 15:36:29  rgb
 767  * Fix cut-and-paste error causing a memory leak in IPIP TDB freeing.
 768  *
 769  * Revision 1.15  1999/04/11 00:29:01  henry
 770  * GPL boilerplate
 771  *
 772  * Revision 1.14  1999/04/06 04:54:28  rgb
 773  * Fix/Add RCSID Id: and Log: bits to make PHMDs happy.  This includes
 774  * patch shell fixes.
 775  *
 776  * Revision 1.13  1999/02/19 18:23:01  rgb
 777  * Nix debug off compile warning.
 778  *
 779  * Revision 1.12  1999/02/17 16:52:16  rgb
 780  * Consolidate satoa()s for space and speed efficiency.
 781  * Convert DEBUG_IPSEC to KLIPS_PRINT
 782  * Clean out unused cruft.
 783  * Ditch NET_IPIP dependancy.
 784  * Loop for 3des key setting.
 785  *
 786  * Revision 1.11  1999/01/26 02:09:05  rgb
 787  * Remove ah/esp/IPIP switching on include files.
 788  * Removed CONFIG_IPSEC_ALGO_SWITCH macro.
 789  * Removed dead code.
 790  * Clean up debug code when switched off.
 791  * Remove references to INET_GET_PROTOCOL.
 792  * Added code exclusion macros to reduce code from unused algorithms.
 793  *
 794  * Revision 1.10  1999/01/22 06:28:55  rgb
 795  * Cruft clean-out.
 796  * Put random IV generation in kernel.
 797  * Added algorithm switch code.
 798  * Enhanced debugging.
 799  * 64-bit clean-up.
 800  *
 801  * Revision 1.9  1998/11/30 13:22:55  rgb
 802  * Rationalised all the klips kernel file headers.  They are much shorter
 803  * now and won't conflict under RH5.2.
 804  *
 805  * Revision 1.8  1998/11/25 04:59:06  rgb
 806  * Add conditionals for no IPIP tunnel code.
 807  * Delete commented out code.
 808  *
 809  * Revision 1.7  1998/10/31 06:50:41  rgb
 810  * Convert xform ASCII names to no spaces.
 811  * Fixed up comments in #endif directives.
 812  *
 813  * Revision 1.6  1998/10/19 14:44:28  rgb
 814  * Added inclusion of freeswan.h.
 815  * sa_id structure implemented and used: now includes protocol.
 816  *
 817  * Revision 1.5  1998/10/09 04:32:19  rgb
 818  * Added 'klips_debug' prefix to all klips printk debug statements.
 819  *
 820  * Revision 1.4  1998/08/12 00:11:31  rgb
 821  * Added new xform functions to the xform table.
 822  * Fixed minor debug output spelling error.
 823  *
 824  * Revision 1.3  1998/07/09 17:45:31  rgb
 825  * Clarify algorithm not available message.
 826  *
 827  * Revision 1.2  1998/06/23 03:00:51  rgb
 828  * Check for presence of IPIP protocol if it is setup one way (we don't
 829  * know what has been set up the other way and can only assume it will be
 830  * symmetrical with the exception of keys).
 831  *
 832  * Revision 1.1  1998/06/18 21:27:51  henry
 833  * move sources from klips/src to klips/net/ipsec, to keep stupid
 834  * kernel-build scripts happier in the presence of symlinks
 835  *
 836  * Revision 1.3  1998/06/11 05:54:59  rgb
 837  * Added transform version string pointer to xformsw initialisations.
 838  *
 839  * Revision 1.2  1998/04/21 21:28:57  rgb
 840  * Rearrange debug switches to change on the fly debug output from user
 841  * space.  Only kernel changes checked in at this time.  radij.c was also
 842  * changed to temporarily remove buggy debugging code in rj_delete causing
 843  * an OOPS and hence, netlink device open errors.
 844  *
 845  * Revision 1.1  1998/04/09 03:06:13  henry
 846  * sources moved up from linux/net/ipsec
 847  *
 848  * Revision 1.1.1.1  1998/04/08 05:35:02  henry
 849  * RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
 850  *
 851  * Revision 0.5  1997/06/03 04:24:48  ji
 852  * Added ESP-3DES-MD5-96
 853  *
 854  * Revision 0.4  1997/01/15 01:28:15  ji
 855  * Added new transforms.
 856  *
 857  * Revision 0.3  1996/11/20 14:39:04  ji
 858  * Minor cleanups.
 859  * Rationalized debugging code.
 860  *
 861  * Revision 0.2  1996/11/02 00:18:33  ji
 862  * First limited release.
 863  *
 864  *
 865  */