xfrm_user.c 69.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9
/* xfrm_user.c: User interface to configure xfrm engine.
 *
 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
 *
 * Changes:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
10
 *
L
Linus Torvalds 已提交
11 12
 */

13
#include <linux/crypto.h>
L
Linus Torvalds 已提交
14 15 16 17 18 19 20 21 22 23 24 25 26 27
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/socket.h>
#include <linux/string.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/pfkeyv2.h>
#include <linux/ipsec.h>
#include <linux/init.h>
#include <linux/security.h>
#include <net/sock.h>
#include <net/xfrm.h>
28
#include <net/netlink.h>
29
#include <net/ah.h>
L
Linus Torvalds 已提交
30
#include <asm/uaccess.h>
E
Eric Dumazet 已提交
31
#if IS_ENABLED(CONFIG_IPV6)
32 33
#include <linux/in6.h>
#endif
L
Linus Torvalds 已提交
34

35 36 37 38 39
static inline int aead_len(struct xfrm_algo_aead *alg)
{
	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
}

40
static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
L
Linus Torvalds 已提交
41
{
42
	struct nlattr *rt = attrs[type];
L
Linus Torvalds 已提交
43 44 45 46 47
	struct xfrm_algo *algp;

	if (!rt)
		return 0;

48
	algp = nla_data(rt);
49
	if (nla_len(rt) < xfrm_alg_len(algp))
50 51
		return -EINVAL;

L
Linus Torvalds 已提交
52 53 54 55 56 57 58 59
	switch (type) {
	case XFRMA_ALG_AUTH:
	case XFRMA_ALG_CRYPT:
	case XFRMA_ALG_COMP:
		break;

	default:
		return -EINVAL;
60
	}
L
Linus Torvalds 已提交
61 62 63 64 65

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81
static int verify_auth_trunc(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
	struct xfrm_algo_auth *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < xfrm_alg_auth_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97
static int verify_aead(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
	struct xfrm_algo_aead *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < aead_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

98
static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
99 100
			   xfrm_address_t **addrp)
{
101
	struct nlattr *rt = attrs[type];
102

103
	if (rt && addrp)
104
		*addrp = nla_data(rt);
105
}
106

107
static inline int verify_sec_ctx_len(struct nlattr **attrs)
108
{
109
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
110 111 112 113 114
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

115
	uctx = nla_data(rt);
116
	if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
117 118 119 120 121
		return -EINVAL;

	return 0;
}

122 123 124 125
static inline int verify_replay(struct xfrm_usersa_info *p,
				struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
126
	struct xfrm_replay_state_esn *rs;
127

128 129 130 131 132 133 134 135 136 137 138 139 140
	if (p->flags & XFRM_STATE_ESN) {
		if (!rt)
			return -EINVAL;

		rs = nla_data(rt);

		if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
			return -EINVAL;

		if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
		    nla_len(rt) != sizeof(*rs))
			return -EINVAL;
	}
141

142 143 144
	if (!rt)
		return 0;

145 146 147
	if (p->id.proto != IPPROTO_ESP)
		return -EINVAL;

148 149 150 151 152
	if (p->replay_window != 0)
		return -EINVAL;

	return 0;
}
153

L
Linus Torvalds 已提交
154
static int verify_newsa_info(struct xfrm_usersa_info *p,
155
			     struct nlattr **attrs)
L
Linus Torvalds 已提交
156 157 158 159 160 161 162 163 164
{
	int err;

	err = -EINVAL;
	switch (p->family) {
	case AF_INET:
		break;

	case AF_INET6:
E
Eric Dumazet 已提交
165
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
166 167 168 169 170 171 172 173
		break;
#else
		err = -EAFNOSUPPORT;
		goto out;
#endif

	default:
		goto out;
174
	}
L
Linus Torvalds 已提交
175 176 177 178

	err = -EINVAL;
	switch (p->id.proto) {
	case IPPROTO_AH:
179 180
		if ((!attrs[XFRMA_ALG_AUTH]	&&
		     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
181
		    attrs[XFRMA_ALG_AEAD]	||
182
		    attrs[XFRMA_ALG_CRYPT]	||
183 184
		    attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_TFCPAD])
L
Linus Torvalds 已提交
185 186 187 188
			goto out;
		break;

	case IPPROTO_ESP:
189 190 191
		if (attrs[XFRMA_ALG_COMP])
			goto out;
		if (!attrs[XFRMA_ALG_AUTH] &&
192
		    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
193 194 195 196
		    !attrs[XFRMA_ALG_CRYPT] &&
		    !attrs[XFRMA_ALG_AEAD])
			goto out;
		if ((attrs[XFRMA_ALG_AUTH] ||
197
		     attrs[XFRMA_ALG_AUTH_TRUNC] ||
198 199
		     attrs[XFRMA_ALG_CRYPT]) &&
		    attrs[XFRMA_ALG_AEAD])
L
Linus Torvalds 已提交
200
			goto out;
201 202 203
		if (attrs[XFRMA_TFCPAD] &&
		    p->mode != XFRM_MODE_TUNNEL)
			goto out;
L
Linus Torvalds 已提交
204 205 206
		break;

	case IPPROTO_COMP:
207
		if (!attrs[XFRMA_ALG_COMP]	||
208
		    attrs[XFRMA_ALG_AEAD]	||
209
		    attrs[XFRMA_ALG_AUTH]	||
210
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
211 212
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_TFCPAD])
L
Linus Torvalds 已提交
213 214 215
			goto out;
		break;

E
Eric Dumazet 已提交
216
#if IS_ENABLED(CONFIG_IPV6)
217 218
	case IPPROTO_DSTOPTS:
	case IPPROTO_ROUTING:
219 220
		if (attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_ALG_AUTH]	||
221
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
222
		    attrs[XFRMA_ALG_AEAD]	||
223 224 225
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_ENCAP]		||
		    attrs[XFRMA_SEC_CTX]	||
226
		    attrs[XFRMA_TFCPAD]		||
227
		    !attrs[XFRMA_COADDR])
228 229 230 231
			goto out;
		break;
#endif

L
Linus Torvalds 已提交
232 233
	default:
		goto out;
234
	}
L
Linus Torvalds 已提交
235

236 237
	if ((err = verify_aead(attrs)))
		goto out;
238 239
	if ((err = verify_auth_trunc(attrs)))
		goto out;
240
	if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
L
Linus Torvalds 已提交
241
		goto out;
242
	if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
L
Linus Torvalds 已提交
243
		goto out;
244
	if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
L
Linus Torvalds 已提交
245
		goto out;
246
	if ((err = verify_sec_ctx_len(attrs)))
247
		goto out;
248 249
	if ((err = verify_replay(p, attrs)))
		goto out;
L
Linus Torvalds 已提交
250 251 252

	err = -EINVAL;
	switch (p->mode) {
253 254
	case XFRM_MODE_TRANSPORT:
	case XFRM_MODE_TUNNEL:
255
	case XFRM_MODE_ROUTEOPTIMIZATION:
D
Diego Beltrami 已提交
256
	case XFRM_MODE_BEET:
L
Linus Torvalds 已提交
257 258 259 260
		break;

	default:
		goto out;
261
	}
L
Linus Torvalds 已提交
262 263 264 265 266 267 268 269

	err = 0;

out:
	return err;
}

static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
270
			   struct xfrm_algo_desc *(*get_byname)(const char *, int),
271
			   struct nlattr *rta)
L
Linus Torvalds 已提交
272 273 274 275 276 277 278
{
	struct xfrm_algo *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

279
	ualg = nla_data(rta);
L
Linus Torvalds 已提交
280 281 282 283 284 285

	algo = get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

286
	p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
L
Linus Torvalds 已提交
287 288 289
	if (!p)
		return -ENOMEM;

290
	strcpy(p->alg_name, algo->name);
L
Linus Torvalds 已提交
291 292 293 294
	*algpp = p;
	return 0;
}

295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338
static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo *ualg;
	struct xfrm_algo_auth *p;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	p->alg_key_len = ualg->alg_key_len;
	p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
	memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);

	*algpp = p;
	return 0;
}

static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
			     struct nlattr *rta)
{
	struct xfrm_algo_auth *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
339 340
	if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
	    ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
341 342 343 344 345 346 347 348 349 350 351 352 353 354 355
		return -EINVAL;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	if (!p->alg_trunc_len)
		p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;

	*algpp = p;
	return 0;
}

356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380
static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo_aead *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	*algpp = p;
	return 0;
}

381 382 383 384
static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
					 struct nlattr *rp)
{
	struct xfrm_replay_state_esn *up;
385
	int ulen;
386 387 388 389 390

	if (!replay_esn || !rp)
		return 0;

	up = nla_data(rp);
391
	ulen = xfrm_replay_state_esn_len(up);
392

393
	if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
394 395 396 397 398
		return -EINVAL;

	return 0;
}

399 400 401 402 403
static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
				       struct xfrm_replay_state_esn **preplay_esn,
				       struct nlattr *rta)
{
	struct xfrm_replay_state_esn *p, *pp, *up;
404
	int klen, ulen;
405 406 407 408 409

	if (!rta)
		return 0;

	up = nla_data(rta);
410 411
	klen = xfrm_replay_state_esn_len(up);
	ulen = nla_len(rta) >= klen ? klen : sizeof(*up);
412

413
	p = kzalloc(klen, GFP_KERNEL);
414 415 416
	if (!p)
		return -ENOMEM;

417
	pp = kzalloc(klen, GFP_KERNEL);
418 419 420 421 422
	if (!pp) {
		kfree(p);
		return -ENOMEM;
	}

423 424 425
	memcpy(p, up, ulen);
	memcpy(pp, up, ulen);

426 427 428 429 430 431
	*replay_esn = p;
	*preplay_esn = pp;

	return 0;
}

432
static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
433 434 435 436 437 438 439 440 441 442
{
	int len = 0;

	if (xfrm_ctx) {
		len += sizeof(struct xfrm_user_sec_ctx);
		len += xfrm_ctx->ctx_len;
	}
	return len;
}

L
Linus Torvalds 已提交
443 444 445 446 447 448 449 450 451
static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&x->id, &p->id, sizeof(x->id));
	memcpy(&x->sel, &p->sel, sizeof(x->sel));
	memcpy(&x->lft, &p->lft, sizeof(x->lft));
	x->props.mode = p->mode;
	x->props.replay_window = p->replay_window;
	x->props.reqid = p->reqid;
	x->props.family = p->family;
452
	memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
L
Linus Torvalds 已提交
453
	x->props.flags = p->flags;
454

455
	if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
456
		x->sel.family = p->family;
L
Linus Torvalds 已提交
457 458
}

J
Jamal Hadi Salim 已提交
459 460 461 462 463
/*
 * someday when pfkey also has support, we could have the code
 * somehow made shareable and move it to xfrm_state.c - JHS
 *
*/
464 465
static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
				  int update_esn)
J
Jamal Hadi Salim 已提交
466
{
467
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
468
	struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
469 470 471
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
J
Jamal Hadi Salim 已提交
472

473 474 475 476 477 478 479 480 481
	if (re) {
		struct xfrm_replay_state_esn *replay_esn;
		replay_esn = nla_data(re);
		memcpy(x->replay_esn, replay_esn,
		       xfrm_replay_state_esn_len(replay_esn));
		memcpy(x->preplay_esn, replay_esn,
		       xfrm_replay_state_esn_len(replay_esn));
	}

J
Jamal Hadi Salim 已提交
482 483
	if (rp) {
		struct xfrm_replay_state *replay;
484
		replay = nla_data(rp);
J
Jamal Hadi Salim 已提交
485 486 487 488 489 490
		memcpy(&x->replay, replay, sizeof(*replay));
		memcpy(&x->preplay, replay, sizeof(*replay));
	}

	if (lt) {
		struct xfrm_lifetime_cur *ltime;
491
		ltime = nla_data(lt);
J
Jamal Hadi Salim 已提交
492 493 494 495 496 497
		x->curlft.bytes = ltime->bytes;
		x->curlft.packets = ltime->packets;
		x->curlft.add_time = ltime->add_time;
		x->curlft.use_time = ltime->use_time;
	}

498
	if (et)
499
		x->replay_maxage = nla_get_u32(et);
J
Jamal Hadi Salim 已提交
500

501
	if (rt)
502
		x->replay_maxdiff = nla_get_u32(rt);
J
Jamal Hadi Salim 已提交
503 504
}

505 506
static struct xfrm_state *xfrm_state_construct(struct net *net,
					       struct xfrm_usersa_info *p,
507
					       struct nlattr **attrs,
L
Linus Torvalds 已提交
508 509
					       int *errp)
{
510
	struct xfrm_state *x = xfrm_state_alloc(net);
L
Linus Torvalds 已提交
511 512 513 514 515 516 517
	int err = -ENOMEM;

	if (!x)
		goto error_no_put;

	copy_from_user_state(x, p);

518 519 520
	if ((err = attach_aead(&x->aead, &x->props.ealgo,
			       attrs[XFRMA_ALG_AEAD])))
		goto error;
521 522
	if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
				     attrs[XFRMA_ALG_AUTH_TRUNC])))
L
Linus Torvalds 已提交
523
		goto error;
524 525 526 527 528
	if (!x->props.aalgo) {
		if ((err = attach_auth(&x->aalg, &x->props.aalgo,
				       attrs[XFRMA_ALG_AUTH])))
			goto error;
	}
L
Linus Torvalds 已提交
529 530
	if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
				   xfrm_ealg_get_byname,
531
				   attrs[XFRMA_ALG_CRYPT])))
L
Linus Torvalds 已提交
532 533 534
		goto error;
	if ((err = attach_one_algo(&x->calg, &x->props.calgo,
				   xfrm_calg_get_byname,
535
				   attrs[XFRMA_ALG_COMP])))
L
Linus Torvalds 已提交
536
		goto error;
537 538 539 540 541 542 543 544

	if (attrs[XFRMA_ENCAP]) {
		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
				   sizeof(*x->encap), GFP_KERNEL);
		if (x->encap == NULL)
			goto error;
	}

545 546 547
	if (attrs[XFRMA_TFCPAD])
		x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);

548 549 550 551 552 553 554
	if (attrs[XFRMA_COADDR]) {
		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
				    sizeof(*x->coaddr), GFP_KERNEL);
		if (x->coaddr == NULL)
			goto error;
	}

555 556
	xfrm_mark_get(attrs, &x->mark);

557
	err = __xfrm_init_state(x, false);
L
Linus Torvalds 已提交
558 559 560
	if (err)
		goto error;

561 562
	if (attrs[XFRMA_SEC_CTX] &&
	    security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
563 564
		goto error;

565 566 567 568
	if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
					       attrs[XFRMA_REPLAY_ESN_VAL])))
		goto error;

L
Linus Torvalds 已提交
569
	x->km.seq = p->seq;
A
Alexey Dobriyan 已提交
570
	x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
J
Jamal Hadi Salim 已提交
571
	/* sysctl_xfrm_aevent_etime is in 100ms units */
A
Alexey Dobriyan 已提交
572
	x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
J
Jamal Hadi Salim 已提交
573

574 575
	if ((err = xfrm_init_replay(x)))
		goto error;
J
Jamal Hadi Salim 已提交
576

577
	/* override default values from above */
578
	xfrm_update_ae_params(x, attrs, 0);
L
Linus Torvalds 已提交
579 580 581 582 583 584 585 586 587 588 589

	return x;

error:
	x->km.state = XFRM_STATE_DEAD;
	xfrm_state_put(x);
error_no_put:
	*errp = err;
	return NULL;
}

590
static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
591
		struct nlattr **attrs)
L
Linus Torvalds 已提交
592
{
593
	struct net *net = sock_net(skb->sk);
594
	struct xfrm_usersa_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
595 596
	struct xfrm_state *x;
	int err;
597
	struct km_event c;
598 599 600
	uid_t loginuid = audit_get_loginuid(current);
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
601

602
	err = verify_newsa_info(p, attrs);
L
Linus Torvalds 已提交
603 604 605
	if (err)
		return err;

606
	x = xfrm_state_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
607 608 609
	if (!x)
		return err;

610
	xfrm_state_hold(x);
L
Linus Torvalds 已提交
611 612 613 614 615
	if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
		err = xfrm_state_add(x);
	else
		err = xfrm_state_update(x);

616
	security_task_getsecid(current, &sid);
617
	xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
618

L
Linus Torvalds 已提交
619 620
	if (err < 0) {
		x->km.state = XFRM_STATE_DEAD;
621
		__xfrm_state_put(x);
622
		goto out;
L
Linus Torvalds 已提交
623 624
	}

625 626
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
627
	c.event = nlh->nlmsg_type;
628 629

	km_state_notify(x, &c);
630
out:
631
	xfrm_state_put(x);
L
Linus Torvalds 已提交
632 633 634
	return err;
}

635 636
static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
						 struct xfrm_usersa_id *p,
637
						 struct nlattr **attrs,
638 639 640
						 int *errp)
{
	struct xfrm_state *x = NULL;
641
	struct xfrm_mark m;
642
	int err;
643
	u32 mark = xfrm_mark_get(attrs, &m);
644 645 646

	if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
		err = -ESRCH;
647
		x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
648 649 650
	} else {
		xfrm_address_t *saddr = NULL;

651
		verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
652 653 654 655 656
		if (!saddr) {
			err = -EINVAL;
			goto out;
		}

657
		err = -ESRCH;
658 659
		x = xfrm_state_lookup_byaddr(net, mark,
					     &p->daddr, saddr,
660
					     p->proto, p->family);
661 662 663 664 665 666 667 668
	}

 out:
	if (!x && errp)
		*errp = err;
	return x;
}

669
static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
670
		struct nlattr **attrs)
L
Linus Torvalds 已提交
671
{
672
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
673
	struct xfrm_state *x;
674
	int err = -ESRCH;
675
	struct km_event c;
676
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
677 678 679
	uid_t loginuid = audit_get_loginuid(current);
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
680

681
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
682
	if (x == NULL)
683
		return err;
L
Linus Torvalds 已提交
684

685
	if ((err = security_xfrm_state_delete(x)) != 0)
C
Catherine Zhang 已提交
686 687
		goto out;

L
Linus Torvalds 已提交
688
	if (xfrm_state_kern(x)) {
C
Catherine Zhang 已提交
689 690
		err = -EPERM;
		goto out;
L
Linus Torvalds 已提交
691 692
	}

693
	err = xfrm_state_delete(x);
J
Joy Latten 已提交
694

C
Catherine Zhang 已提交
695 696
	if (err < 0)
		goto out;
697 698 699

	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
700
	c.event = nlh->nlmsg_type;
701
	km_state_notify(x, &c);
L
Linus Torvalds 已提交
702

C
Catherine Zhang 已提交
703
out:
704
	security_task_getsecid(current, &sid);
705
	xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
C
Catherine Zhang 已提交
706
	xfrm_state_put(x);
707
	return err;
L
Linus Torvalds 已提交
708 709 710 711
}

static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
712
	memset(p, 0, sizeof(*p));
L
Linus Torvalds 已提交
713 714 715 716 717
	memcpy(&p->id, &x->id, sizeof(p->id));
	memcpy(&p->sel, &x->sel, sizeof(p->sel));
	memcpy(&p->lft, &x->lft, sizeof(p->lft));
	memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
	memcpy(&p->stats, &x->stats, sizeof(p->stats));
718
	memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
L
Linus Torvalds 已提交
719 720 721 722 723 724 725 726 727 728 729 730 731 732 733
	p->mode = x->props.mode;
	p->replay_window = x->props.replay_window;
	p->reqid = x->props.reqid;
	p->family = x->props.family;
	p->flags = x->props.flags;
	p->seq = x->km.seq;
}

struct xfrm_dump_info {
	struct sk_buff *in_skb;
	struct sk_buff *out_skb;
	u32 nlmsg_seq;
	u16 nlmsg_flags;
};

734 735 736 737
static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
{
	struct xfrm_user_sec_ctx *uctx;
	struct nlattr *attr;
738
	int ctx_size = sizeof(*uctx) + s->ctx_len;
739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754

	attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
	if (attr == NULL)
		return -EMSGSIZE;

	uctx = nla_data(attr);
	uctx->exttype = XFRMA_SEC_CTX;
	uctx->len = ctx_size;
	uctx->ctx_doi = s->ctx_doi;
	uctx->ctx_alg = s->ctx_alg;
	uctx->ctx_len = s->ctx_len;
	memcpy(uctx + 1, s->ctx_str, s->ctx_len);

	return 0;
}

755 756 757 758 759 760 761 762 763 764 765
static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
{
	struct xfrm_algo *algo;
	struct nlattr *nla;

	nla = nla_reserve(skb, XFRMA_ALG_AUTH,
			  sizeof(*algo) + (auth->alg_key_len + 7) / 8);
	if (!nla)
		return -EMSGSIZE;

	algo = nla_data(nla);
766
	strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
767 768 769 770 771 772
	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
	algo->alg_key_len = auth->alg_key_len;

	return 0;
}

773 774 775 776
/* Don't change this without updating xfrm_sa_len! */
static int copy_to_user_state_extra(struct xfrm_state *x,
				    struct xfrm_usersa_info *p,
				    struct sk_buff *skb)
L
Linus Torvalds 已提交
777
{
778
	int ret = 0;
779

780
	copy_to_user_state(x, p);
781

782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838
	if (x->coaddr) {
		ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
		if (ret)
			goto out;
	}
	if (x->lastused) {
		ret = nla_put_u64(skb, XFRMA_LASTUSED, x->lastused);
		if (ret)
			goto out;
	}
	if (x->aead) {
		ret = nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
		if (ret)
			goto out;
	}
	if (x->aalg) {
		ret = copy_to_user_auth(x->aalg, skb);
		if (!ret)
			ret = nla_put(skb, XFRMA_ALG_AUTH_TRUNC,
				      xfrm_alg_auth_len(x->aalg), x->aalg);
		if (ret)
			goto out;
	}
	if (x->ealg) {
		ret = nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
		if (ret)
			goto out;
	}
	if (x->calg) {
		ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
		if (ret)
			goto out;
	}
	if (x->encap) {
		ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
		if (ret)
			goto out;
	}
	if (x->tfcpad) {
		ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad);
		if (ret)
			goto out;
	}
	ret = xfrm_mark_put(skb, &x->mark);
	if (ret)
		goto out;
	if (x->replay_esn) {
		ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
			      xfrm_replay_state_esn_len(x->replay_esn),
			      x->replay_esn);
		if (ret)
			goto out;
	}
	if (x->security)
		ret = copy_sec_ctx(x->security, skb);
out:
	return ret;
839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857
}

static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct xfrm_usersa_info *p;
	struct nlmsghdr *nlh;
	int err;

	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;

	p = nlmsg_data(nlh);

	err = copy_to_user_state_extra(x, p, skb);
858 859 860 861
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
862
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
863 864 865
	return 0;
}

866 867 868 869 870 871 872
static int xfrm_dump_sa_done(struct netlink_callback *cb)
{
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
	xfrm_state_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
873 874
static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
{
875
	struct net *net = sock_net(skb->sk);
876
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
L
Linus Torvalds 已提交
877 878
	struct xfrm_dump_info info;

879 880 881
	BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
882 883 884 885
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
886 887 888 889 890 891

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_state_walk_init(walk, 0);
	}

892
	(void) xfrm_state_walk(net, walk, dump_one_state, &info);
L
Linus Torvalds 已提交
893 894 895 896 897 898 899 900 901

	return skb->len;
}

static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
					  struct xfrm_state *x, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;
902
	int err;
L
Linus Torvalds 已提交
903

904
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
L
Linus Torvalds 已提交
905 906 907 908 909 910 911 912
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

913 914
	err = dump_one_state(x, 0, &info);
	if (err) {
L
Linus Torvalds 已提交
915
		kfree_skb(skb);
916
		return ERR_PTR(err);
L
Linus Torvalds 已提交
917 918 919 920 921
	}

	return skb;
}

922 923 924 925 926 927 928
static inline size_t xfrm_spdinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_spdinfo))
	       + nla_total_size(sizeof(struct xfrmu_spdhinfo));
}

929 930
static int build_spdinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
931
{
932 933 934
	struct xfrmk_spdinfo si;
	struct xfrmu_spdinfo spc;
	struct xfrmu_spdhinfo sph;
J
Jamal Hadi Salim 已提交
935
	struct nlmsghdr *nlh;
936
	int err;
J
Jamal Hadi Salim 已提交
937 938 939
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
L
Lucas De Marchi 已提交
940
	if (nlh == NULL) /* shouldn't really happen ... */
J
Jamal Hadi Salim 已提交
941 942 943 944
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
945
	xfrm_spd_getinfo(net, &si);
946 947 948 949 950 951 952 953 954
	spc.incnt = si.incnt;
	spc.outcnt = si.outcnt;
	spc.fwdcnt = si.fwdcnt;
	spc.inscnt = si.inscnt;
	spc.outscnt = si.outscnt;
	spc.fwdscnt = si.fwdscnt;
	sph.spdhcnt = si.spdhcnt;
	sph.spdhmcnt = si.spdhmcnt;

955 956 957 958 959 960 961
	err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
	if (!err)
		err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
J
Jamal Hadi Salim 已提交
962 963 964 965 966

	return nlmsg_end(skb, nlh);
}

static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
967
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
968
{
969
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
970
	struct sk_buff *r_skb;
971
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
972 973 974
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

975
	r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
976 977 978
	if (r_skb == NULL)
		return -ENOMEM;

979
	if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
980 981
		BUG();

982
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
983 984
}

985 986 987 988 989 990 991
static inline size_t xfrm_sadinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_sadhinfo))
	       + nla_total_size(4); /* XFRMA_SAD_CNT */
}

992 993
static int build_sadinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
994
{
995 996
	struct xfrmk_sadinfo si;
	struct xfrmu_sadhinfo sh;
J
Jamal Hadi Salim 已提交
997
	struct nlmsghdr *nlh;
998
	int err;
J
Jamal Hadi Salim 已提交
999 1000 1001
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
L
Lucas De Marchi 已提交
1002
	if (nlh == NULL) /* shouldn't really happen ... */
J
Jamal Hadi Salim 已提交
1003 1004 1005 1006
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
1007
	xfrm_sad_getinfo(net, &si);
J
Jamal Hadi Salim 已提交
1008

1009 1010 1011
	sh.sadhmcnt = si.sadhmcnt;
	sh.sadhcnt = si.sadhcnt;

1012 1013 1014 1015 1016 1017 1018
	err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt);
	if (!err)
		err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
J
Jamal Hadi Salim 已提交
1019 1020 1021 1022 1023

	return nlmsg_end(skb, nlh);
}

static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
1024
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1025
{
1026
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1027
	struct sk_buff *r_skb;
1028
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
1029 1030 1031
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

1032
	r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
1033 1034 1035
	if (r_skb == NULL)
		return -ENOMEM;

1036
	if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
1037 1038
		BUG();

1039
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
1040 1041
}

1042
static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1043
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1044
{
1045
	struct net *net = sock_net(skb->sk);
1046
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1047 1048
	struct xfrm_state *x;
	struct sk_buff *resp_skb;
1049
	int err = -ESRCH;
L
Linus Torvalds 已提交
1050

1051
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
1052 1053 1054 1055 1056 1057 1058
	if (x == NULL)
		goto out_noput;

	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
	} else {
1059
		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080
	}
	xfrm_state_put(x);
out_noput:
	return err;
}

static int verify_userspi_info(struct xfrm_userspi_info *p)
{
	switch (p->info.id.proto) {
	case IPPROTO_AH:
	case IPPROTO_ESP:
		break;

	case IPPROTO_COMP:
		/* IPCOMP spi is 16-bits. */
		if (p->max >= 0x10000)
			return -EINVAL;
		break;

	default:
		return -EINVAL;
1081
	}
L
Linus Torvalds 已提交
1082 1083 1084 1085 1086 1087 1088

	if (p->min > p->max)
		return -EINVAL;

	return 0;
}

1089
static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
1090
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1091
{
1092
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1093 1094 1095 1096 1097 1098
	struct xfrm_state *x;
	struct xfrm_userspi_info *p;
	struct sk_buff *resp_skb;
	xfrm_address_t *daddr;
	int family;
	int err;
1099 1100
	u32 mark;
	struct xfrm_mark m;
L
Linus Torvalds 已提交
1101

1102
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1103 1104 1105 1106 1107 1108 1109 1110
	err = verify_userspi_info(p);
	if (err)
		goto out_noput;

	family = p->info.family;
	daddr = &p->info.id.daddr;

	x = NULL;
1111 1112

	mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
1113
	if (p->info.seq) {
1114
		x = xfrm_find_acq_byseq(net, mark, p->info.seq);
L
Linus Torvalds 已提交
1115 1116 1117 1118 1119 1120 1121
		if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
			xfrm_state_put(x);
			x = NULL;
		}
	}

	if (!x)
1122
		x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
L
Linus Torvalds 已提交
1123 1124 1125 1126 1127 1128 1129
				  p->info.id.proto, daddr,
				  &p->info.saddr, 1,
				  family);
	err = -ENOENT;
	if (x == NULL)
		goto out_noput;

1130 1131 1132
	err = xfrm_alloc_spi(x, p->min, p->max);
	if (err)
		goto out;
L
Linus Torvalds 已提交
1133

1134
	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
L
Linus Torvalds 已提交
1135 1136 1137 1138 1139
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
		goto out;
	}

1140
	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1141 1142 1143 1144 1145 1146 1147

out:
	xfrm_state_put(x);
out_noput:
	return err;
}

1148
static int verify_policy_dir(u8 dir)
L
Linus Torvalds 已提交
1149 1150 1151 1152 1153 1154 1155 1156 1157
{
	switch (dir) {
	case XFRM_POLICY_IN:
	case XFRM_POLICY_OUT:
	case XFRM_POLICY_FWD:
		break;

	default:
		return -EINVAL;
1158
	}
L
Linus Torvalds 已提交
1159 1160 1161 1162

	return 0;
}

1163
static int verify_policy_type(u8 type)
1164 1165 1166 1167 1168 1169 1170 1171 1172 1173
{
	switch (type) {
	case XFRM_POLICY_TYPE_MAIN:
#ifdef CONFIG_XFRM_SUB_POLICY
	case XFRM_POLICY_TYPE_SUB:
#endif
		break;

	default:
		return -EINVAL;
1174
	}
1175 1176 1177 1178

	return 0;
}

L
Linus Torvalds 已提交
1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189
static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
{
	switch (p->share) {
	case XFRM_SHARE_ANY:
	case XFRM_SHARE_SESSION:
	case XFRM_SHARE_USER:
	case XFRM_SHARE_UNIQUE:
		break;

	default:
		return -EINVAL;
1190
	}
L
Linus Torvalds 已提交
1191 1192 1193 1194 1195 1196 1197 1198

	switch (p->action) {
	case XFRM_POLICY_ALLOW:
	case XFRM_POLICY_BLOCK:
		break;

	default:
		return -EINVAL;
1199
	}
L
Linus Torvalds 已提交
1200 1201 1202 1203 1204 1205

	switch (p->sel.family) {
	case AF_INET:
		break;

	case AF_INET6:
E
Eric Dumazet 已提交
1206
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
1207 1208 1209 1210 1211 1212 1213
		break;
#else
		return  -EAFNOSUPPORT;
#endif

	default:
		return -EINVAL;
1214
	}
L
Linus Torvalds 已提交
1215 1216 1217 1218

	return verify_policy_dir(p->dir);
}

1219
static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
1220
{
1221
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1222 1223 1224 1225 1226
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

1227
	uctx = nla_data(rt);
1228
	return security_xfrm_policy_alloc(&pol->security, uctx);
1229 1230
}

L
Linus Torvalds 已提交
1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249
static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
			   int nr)
{
	int i;

	xp->xfrm_nr = nr;
	for (i = 0; i < nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];

		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
		memcpy(&t->saddr, &ut->saddr,
		       sizeof(xfrm_address_t));
		t->reqid = ut->reqid;
		t->mode = ut->mode;
		t->share = ut->share;
		t->optional = ut->optional;
		t->aalgos = ut->aalgos;
		t->ealgos = ut->ealgos;
		t->calgos = ut->calgos;
1250 1251
		/* If all masks are ~0, then we allow all algorithms. */
		t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1252
		t->encap_family = ut->family;
L
Linus Torvalds 已提交
1253 1254 1255
	}
}

1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276
static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
{
	int i;

	if (nr > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < nr; i++) {
		/* We never validated the ut->family value, so many
		 * applications simply leave it at zero.  The check was
		 * never made and ut->family was ignored because all
		 * templates could be assumed to have the same family as
		 * the policy itself.  Now that we will have ipv4-in-ipv6
		 * and ipv6-in-ipv4 tunnels, this is no longer true.
		 */
		if (!ut[i].family)
			ut[i].family = family;

		switch (ut[i].family) {
		case AF_INET:
			break;
E
Eric Dumazet 已提交
1277
#if IS_ENABLED(CONFIG_IPV6)
1278 1279 1280 1281 1282
		case AF_INET6:
			break;
#endif
		default:
			return -EINVAL;
1283
		}
1284 1285 1286 1287 1288
	}

	return 0;
}

1289
static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
L
Linus Torvalds 已提交
1290
{
1291
	struct nlattr *rt = attrs[XFRMA_TMPL];
L
Linus Torvalds 已提交
1292 1293 1294 1295

	if (!rt) {
		pol->xfrm_nr = 0;
	} else {
1296 1297
		struct xfrm_user_tmpl *utmpl = nla_data(rt);
		int nr = nla_len(rt) / sizeof(*utmpl);
1298
		int err;
L
Linus Torvalds 已提交
1299

1300 1301 1302
		err = validate_tmpl(nr, utmpl, pol->family);
		if (err)
			return err;
L
Linus Torvalds 已提交
1303

1304
		copy_templates(pol, utmpl, nr);
L
Linus Torvalds 已提交
1305 1306 1307 1308
	}
	return 0;
}

1309
static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
1310
{
1311
	struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1312
	struct xfrm_userpolicy_type *upt;
1313
	u8 type = XFRM_POLICY_TYPE_MAIN;
1314 1315 1316
	int err;

	if (rt) {
1317
		upt = nla_data(rt);
1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328
		type = upt->type;
	}

	err = verify_policy_type(type);
	if (err)
		return err;

	*tp = type;
	return 0;
}

L
Linus Torvalds 已提交
1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
{
	xp->priority = p->priority;
	xp->index = p->index;
	memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
	memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
	xp->action = p->action;
	xp->flags = p->flags;
	xp->family = p->sel.family;
	/* XXX xp->share = p->share; */
}

static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
{
1343
	memset(p, 0, sizeof(*p));
L
Linus Torvalds 已提交
1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355
	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
	p->priority = xp->priority;
	p->index = xp->index;
	p->sel.family = xp->family;
	p->dir = dir;
	p->action = xp->action;
	p->flags = xp->flags;
	p->share = XFRM_SHARE_ANY; /* XXX xp->share */
}

1356
static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
L
Linus Torvalds 已提交
1357
{
1358
	struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
L
Linus Torvalds 已提交
1359 1360 1361 1362 1363 1364 1365 1366
	int err;

	if (!xp) {
		*errp = -ENOMEM;
		return NULL;
	}

	copy_from_user_policy(xp, p);
1367

1368
	err = copy_from_user_policy_type(&xp->type, attrs);
1369 1370 1371
	if (err)
		goto error;

1372 1373
	if (!(err = copy_from_user_tmpl(xp, attrs)))
		err = copy_from_user_sec_ctx(xp, attrs);
1374 1375
	if (err)
		goto error;
L
Linus Torvalds 已提交
1376

1377 1378
	xfrm_mark_get(attrs, &xp->mark);

L
Linus Torvalds 已提交
1379
	return xp;
1380 1381
 error:
	*errp = err;
H
Herbert Xu 已提交
1382
	xp->walk.dead = 1;
1383
	xfrm_policy_destroy(xp);
1384
	return NULL;
L
Linus Torvalds 已提交
1385 1386
}

1387
static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1388
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1389
{
1390
	struct net *net = sock_net(skb->sk);
1391
	struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1392
	struct xfrm_policy *xp;
1393
	struct km_event c;
L
Linus Torvalds 已提交
1394 1395
	int err;
	int excl;
1396 1397 1398
	uid_t loginuid = audit_get_loginuid(current);
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
1399 1400

	err = verify_newpolicy_info(p);
1401 1402
	if (err)
		return err;
1403
	err = verify_sec_ctx_len(attrs);
L
Linus Torvalds 已提交
1404 1405 1406
	if (err)
		return err;

1407
	xp = xfrm_policy_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
1408 1409 1410
	if (!xp)
		return err;

L
Lucas De Marchi 已提交
1411
	/* shouldn't excl be based on nlh flags??
1412 1413 1414
	 * Aha! this is anti-netlink really i.e  more pfkey derived
	 * in netlink excl is a flag and you wouldnt need
	 * a type XFRM_MSG_UPDPOLICY - JHS */
L
Linus Torvalds 已提交
1415 1416
	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
	err = xfrm_policy_insert(p->dir, xp, excl);
1417
	security_task_getsecid(current, &sid);
1418
	xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1419

L
Linus Torvalds 已提交
1420
	if (err) {
1421
		security_xfrm_policy_free(xp->security);
L
Linus Torvalds 已提交
1422 1423 1424 1425
		kfree(xp);
		return err;
	}

1426
	c.event = nlh->nlmsg_type;
1427 1428 1429 1430
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	km_policy_notify(xp, p->dir, &c);

L
Linus Torvalds 已提交
1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447
	xfrm_pol_put(xp);

	return 0;
}

static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
{
	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
	int i;

	if (xp->xfrm_nr == 0)
		return 0;

	for (i = 0; i < xp->xfrm_nr; i++) {
		struct xfrm_user_tmpl *up = &vec[i];
		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];

1448
		memset(up, 0, sizeof(*up));
L
Linus Torvalds 已提交
1449
		memcpy(&up->id, &kp->id, sizeof(up->id));
1450
		up->family = kp->encap_family;
L
Linus Torvalds 已提交
1451 1452 1453 1454 1455 1456 1457 1458 1459
		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
		up->reqid = kp->reqid;
		up->mode = kp->mode;
		up->share = kp->share;
		up->optional = kp->optional;
		up->aalgos = kp->aalgos;
		up->ealgos = kp->ealgos;
		up->calgos = kp->calgos;
	}
1460

1461 1462
	return nla_put(skb, XFRMA_TMPL,
		       sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
1463 1464 1465 1466 1467 1468
}

static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
{
	if (x->security) {
		return copy_sec_ctx(x->security, skb);
1469 1470
	}
	return 0;
1471
}
1472

1473 1474
static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
{
1475
	if (xp->security)
1476 1477
		return copy_sec_ctx(xp->security, skb);
	return 0;
1478
}
1479 1480 1481 1482 1483 1484 1485 1486
static inline size_t userpolicy_type_attrsize(void)
{
#ifdef CONFIG_XFRM_SUB_POLICY
	return nla_total_size(sizeof(struct xfrm_userpolicy_type));
#else
	return 0;
#endif
}
1487

1488
#ifdef CONFIG_XFRM_SUB_POLICY
1489
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1490
{
1491 1492 1493
	struct xfrm_userpolicy_type upt = {
		.type = type,
	};
1494

1495
	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1496 1497 1498
}

#else
1499
static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1500 1501 1502 1503 1504
{
	return 0;
}
#endif

L
Linus Torvalds 已提交
1505 1506 1507 1508 1509 1510 1511
static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct xfrm_userpolicy_info *p;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct nlmsghdr *nlh;
1512
	int err;
L
Linus Torvalds 已提交
1513

1514 1515 1516 1517
	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
1518

1519
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1520
	copy_to_user_policy(xp, p, dir);
1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_sec_ctx(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
1532
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
1533 1534 1535
	return 0;
}

1536 1537 1538 1539 1540 1541 1542 1543
static int xfrm_dump_policy_done(struct netlink_callback *cb)
{
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];

	xfrm_policy_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
1544 1545
static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
{
1546
	struct net *net = sock_net(skb->sk);
1547
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
L
Linus Torvalds 已提交
1548 1549
	struct xfrm_dump_info info;

1550 1551 1552
	BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
1553 1554 1555 1556
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
1557 1558 1559 1560 1561 1562

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
	}

1563
	(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
L
Linus Torvalds 已提交
1564 1565 1566 1567 1568 1569 1570 1571 1572 1573

	return skb->len;
}

static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
					  struct xfrm_policy *xp,
					  int dir, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;
1574
	int err;
L
Linus Torvalds 已提交
1575

1576
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
L
Linus Torvalds 已提交
1577 1578 1579 1580 1581 1582 1583 1584
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

1585 1586
	err = dump_one_policy(xp, dir, 0, &info);
	if (err) {
L
Linus Torvalds 已提交
1587
		kfree_skb(skb);
1588
		return ERR_PTR(err);
L
Linus Torvalds 已提交
1589 1590 1591 1592 1593
	}

	return skb;
}

1594
static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1595
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1596
{
1597
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1598 1599
	struct xfrm_policy *xp;
	struct xfrm_userpolicy_id *p;
1600
	u8 type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
1601
	int err;
1602
	struct km_event c;
L
Linus Torvalds 已提交
1603
	int delete;
1604 1605
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
1606

1607
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1608 1609
	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;

1610
	err = copy_from_user_policy_type(&type, attrs);
1611 1612 1613
	if (err)
		return err;

L
Linus Torvalds 已提交
1614 1615 1616 1617 1618
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

	if (p->index)
1619
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
1620
	else {
1621
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1622
		struct xfrm_sec_ctx *ctx;
1623

1624
		err = verify_sec_ctx_len(attrs);
1625 1626 1627
		if (err)
			return err;

1628
		ctx = NULL;
1629
		if (rt) {
1630
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1631

1632 1633
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1634
				return err;
1635
		}
1636
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
1637
					   ctx, delete, &err);
1638
		security_xfrm_policy_free(ctx);
1639
	}
L
Linus Torvalds 已提交
1640 1641 1642 1643 1644 1645 1646 1647 1648 1649
	if (xp == NULL)
		return -ENOENT;

	if (!delete) {
		struct sk_buff *resp_skb;

		resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
		if (IS_ERR(resp_skb)) {
			err = PTR_ERR(resp_skb);
		} else {
1650
			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
1651
					    NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1652
		}
1653
	} else {
1654 1655 1656
		uid_t loginuid = audit_get_loginuid(current);
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;
1657

1658
		security_task_getsecid(current, &sid);
1659 1660
		xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
					 sid);
1661 1662

		if (err != 0)
C
Catherine Zhang 已提交
1663
			goto out;
1664

1665
		c.data.byid = p->index;
1666
		c.event = nlh->nlmsg_type;
1667 1668 1669
		c.seq = nlh->nlmsg_seq;
		c.pid = nlh->nlmsg_pid;
		km_policy_notify(xp, p->dir, &c);
L
Linus Torvalds 已提交
1670 1671
	}

C
Catherine Zhang 已提交
1672
out:
1673
	xfrm_pol_put(xp);
L
Linus Torvalds 已提交
1674 1675 1676
	return err;
}

1677
static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1678
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1679
{
1680
	struct net *net = sock_net(skb->sk);
1681
	struct km_event c;
1682
	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
J
Joy Latten 已提交
1683
	struct xfrm_audit audit_info;
1684
	int err;
L
Linus Torvalds 已提交
1685

1686 1687 1688
	audit_info.loginuid = audit_get_loginuid(current);
	audit_info.sessionid = audit_get_sessionid(current);
	security_task_getsecid(current, &audit_info.secid);
1689
	err = xfrm_state_flush(net, p->proto, &audit_info);
1690 1691 1692
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1693
		return err;
1694
	}
1695
	c.data.proto = p->proto;
1696
	c.event = nlh->nlmsg_type;
1697 1698
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1699
	c.net = net;
1700 1701
	km_state_notify(NULL, &c);

L
Linus Torvalds 已提交
1702 1703 1704
	return 0;
}

1705
static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x)
1706
{
1707 1708 1709 1710
	size_t replay_size = x->replay_esn ?
			      xfrm_replay_state_esn_len(x->replay_esn) :
			      sizeof(struct xfrm_replay_state);

1711
	return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
1712
	       + nla_total_size(replay_size)
1713
	       + nla_total_size(sizeof(struct xfrm_lifetime_cur))
1714
	       + nla_total_size(sizeof(struct xfrm_mark))
1715 1716 1717
	       + nla_total_size(4) /* XFRM_AE_RTHR */
	       + nla_total_size(4); /* XFRM_AE_ETHR */
}
J
Jamal Hadi Salim 已提交
1718

1719
static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
J
Jamal Hadi Salim 已提交
1720 1721 1722
{
	struct xfrm_aevent_id *id;
	struct nlmsghdr *nlh;
1723
	int err;
J
Jamal Hadi Salim 已提交
1724

1725 1726 1727
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
J
Jamal Hadi Salim 已提交
1728

1729
	id = nlmsg_data(nlh);
1730
	memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
J
Jamal Hadi Salim 已提交
1731 1732 1733
	id->sa_id.spi = x->id.spi;
	id->sa_id.family = x->props.family;
	id->sa_id.proto = x->id.proto;
1734 1735
	memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
	id->reqid = x->props.reqid;
J
Jamal Hadi Salim 已提交
1736 1737
	id->flags = c->data.aevent;

1738
	if (x->replay_esn) {
1739 1740 1741
		err = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
			      xfrm_replay_state_esn_len(x->replay_esn),
			      x->replay_esn);
1742
	} else {
1743 1744
		err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
			      &x->replay);
1745
	}
1746 1747 1748 1749 1750
	if (err)
		goto out_cancel;
	err = nla_put(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
	if (err)
		goto out_cancel;
J
Jamal Hadi Salim 已提交
1751

1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765
	if (id->flags & XFRM_AE_RTHR) {
		err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
		if (err)
			goto out_cancel;
	}
	if (id->flags & XFRM_AE_ETHR) {
		err = nla_put_u32(skb, XFRMA_ETIMER_THRESH,
				  x->replay_maxage * 10 / HZ);
		if (err)
			goto out_cancel;
	}
	err = xfrm_mark_put(skb, &x->mark);
	if (err)
		goto out_cancel;
1766

1767
	return nlmsg_end(skb, nlh);
J
Jamal Hadi Salim 已提交
1768

1769
out_cancel:
1770
	nlmsg_cancel(skb, nlh);
1771
	return err;
J
Jamal Hadi Salim 已提交
1772 1773
}

1774
static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1775
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1776
{
1777
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1778 1779 1780 1781
	struct xfrm_state *x;
	struct sk_buff *r_skb;
	int err;
	struct km_event c;
1782 1783
	u32 mark;
	struct xfrm_mark m;
1784
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
1785 1786
	struct xfrm_usersa_id *id = &p->sa_id;

1787 1788 1789
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
1790
	if (x == NULL)
J
Jamal Hadi Salim 已提交
1791
		return -ESRCH;
1792 1793 1794 1795 1796

	r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
	if (r_skb == NULL) {
		xfrm_state_put(x);
		return -ENOMEM;
J
Jamal Hadi Salim 已提交
1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810
	}

	/*
	 * XXX: is this lock really needed - none of the other
	 * gets lock (the concern is things getting updated
	 * while we are still reading) - jhs
	*/
	spin_lock_bh(&x->lock);
	c.data.aevent = p->flags;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;

	if (build_aevent(r_skb, x, &c) < 0)
		BUG();
1811
	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).pid);
J
Jamal Hadi Salim 已提交
1812 1813 1814 1815 1816
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1817
static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1818
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1819
{
1820
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1821 1822 1823
	struct xfrm_state *x;
	struct km_event c;
	int err = - EINVAL;
1824 1825
	u32 mark = 0;
	struct xfrm_mark m;
1826
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
1827
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
1828
	struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
1829
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
J
Jamal Hadi Salim 已提交
1830

1831
	if (!lt && !rp && !re)
J
Jamal Hadi Salim 已提交
1832 1833 1834 1835 1836 1837
		return err;

	/* pedantic mode - thou shalt sayeth replaceth */
	if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
		return err;

1838 1839 1840
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
J
Jamal Hadi Salim 已提交
1841 1842 1843 1844 1845 1846
	if (x == NULL)
		return -ESRCH;

	if (x->km.state != XFRM_STATE_VALID)
		goto out;

1847 1848 1849 1850
	err = xfrm_replay_verify_len(x->replay_esn, rp);
	if (err)
		goto out;

J
Jamal Hadi Salim 已提交
1851
	spin_lock_bh(&x->lock);
1852
	xfrm_update_ae_params(x, attrs, 1);
J
Jamal Hadi Salim 已提交
1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865
	spin_unlock_bh(&x->lock);

	c.event = nlh->nlmsg_type;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	c.data.aevent = XFRM_AE_CU;
	km_state_notify(x, &c);
	err = 0;
out:
	xfrm_state_put(x);
	return err;
}

1866
static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1867
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1868
{
1869
	struct net *net = sock_net(skb->sk);
1870
	struct km_event c;
1871
	u8 type = XFRM_POLICY_TYPE_MAIN;
1872
	int err;
J
Joy Latten 已提交
1873
	struct xfrm_audit audit_info;
1874

1875
	err = copy_from_user_policy_type(&type, attrs);
1876 1877
	if (err)
		return err;
1878

1879 1880 1881
	audit_info.loginuid = audit_get_loginuid(current);
	audit_info.sessionid = audit_get_sessionid(current);
	security_task_getsecid(current, &audit_info.secid);
1882
	err = xfrm_policy_flush(net, type, &audit_info);
1883 1884 1885
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1886
		return err;
1887 1888
	}

1889
	c.data.type = type;
1890
	c.event = nlh->nlmsg_type;
1891 1892
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1893
	c.net = net;
1894
	km_policy_notify(NULL, 0, &c);
L
Linus Torvalds 已提交
1895 1896 1897
	return 0;
}

1898
static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1899
		struct nlattr **attrs)
1900
{
1901
	struct net *net = sock_net(skb->sk);
1902
	struct xfrm_policy *xp;
1903
	struct xfrm_user_polexpire *up = nlmsg_data(nlh);
1904
	struct xfrm_userpolicy_info *p = &up->pol;
1905
	u8 type = XFRM_POLICY_TYPE_MAIN;
1906
	int err = -ENOENT;
1907 1908
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
1909

1910
	err = copy_from_user_policy_type(&type, attrs);
1911 1912 1913
	if (err)
		return err;

1914 1915 1916 1917
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

1918
	if (p->index)
1919
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
1920
	else {
1921
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1922
		struct xfrm_sec_ctx *ctx;
1923

1924
		err = verify_sec_ctx_len(attrs);
1925 1926 1927
		if (err)
			return err;

1928
		ctx = NULL;
1929
		if (rt) {
1930
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1931

1932 1933
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1934
				return err;
1935
		}
1936
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
1937
					   &p->sel, ctx, 0, &err);
1938
		security_xfrm_policy_free(ctx);
1939 1940
	}
	if (xp == NULL)
1941
		return -ENOENT;
1942

1943
	if (unlikely(xp->walk.dead))
1944 1945 1946 1947
		goto out;

	err = 0;
	if (up->hard) {
1948 1949 1950 1951 1952
		uid_t loginuid = audit_get_loginuid(current);
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;

		security_task_getsecid(current, &sid);
1953
		xfrm_policy_delete(xp, p->dir);
1954
		xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1955

1956 1957
	} else {
		// reset the timers here?
S
stephen hemminger 已提交
1958
		WARN(1, "Dont know what to do with soft policy expire\n");
1959 1960 1961 1962 1963 1964 1965 1966
	}
	km_policy_expired(xp, p->dir, up->hard, current->pid);

out:
	xfrm_pol_put(xp);
	return err;
}

1967
static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1968
		struct nlattr **attrs)
1969
{
1970
	struct net *net = sock_net(skb->sk);
1971 1972
	struct xfrm_state *x;
	int err;
1973
	struct xfrm_user_expire *ue = nlmsg_data(nlh);
1974
	struct xfrm_usersa_info *p = &ue->state;
1975
	struct xfrm_mark m;
1976
	u32 mark = xfrm_mark_get(attrs, &m);
1977

1978
	x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
1979

1980
	err = -ENOENT;
1981 1982 1983 1984
	if (x == NULL)
		return err;

	spin_lock_bh(&x->lock);
1985
	err = -EINVAL;
1986 1987 1988 1989
	if (x->km.state != XFRM_STATE_VALID)
		goto out;
	km_state_expired(x, ue->hard, current->pid);

J
Joy Latten 已提交
1990
	if (ue->hard) {
1991 1992 1993 1994 1995
		uid_t loginuid = audit_get_loginuid(current);
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;

		security_task_getsecid(current, &sid);
1996
		__xfrm_state_delete(x);
1997
		xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1998
	}
1999
	err = 0;
2000 2001 2002 2003 2004 2005
out:
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

2006
static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
2007
		struct nlattr **attrs)
2008
{
2009
	struct net *net = sock_net(skb->sk);
2010 2011 2012
	struct xfrm_policy *xp;
	struct xfrm_user_tmpl *ut;
	int i;
2013
	struct nlattr *rt = attrs[XFRMA_TMPL];
2014
	struct xfrm_mark mark;
2015

2016
	struct xfrm_user_acquire *ua = nlmsg_data(nlh);
2017
	struct xfrm_state *x = xfrm_state_alloc(net);
2018 2019 2020
	int err = -ENOMEM;

	if (!x)
I
Ilpo Järvinen 已提交
2021
		goto nomem;
2022

2023 2024
	xfrm_mark_get(attrs, &mark);

2025
	err = verify_newpolicy_info(&ua->policy);
I
Ilpo Järvinen 已提交
2026 2027
	if (err)
		goto bad_policy;
2028 2029

	/*   build an XP */
2030
	xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
I
Ilpo Järvinen 已提交
2031 2032
	if (!xp)
		goto free_state;
2033 2034 2035 2036

	memcpy(&x->id, &ua->id, sizeof(ua->id));
	memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
	memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
2037 2038
	xp->mark.m = x->mark.m = mark.m;
	xp->mark.v = x->mark.v = mark.v;
2039
	ut = nla_data(rt);
2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057
	/* extract the templates and for each call km_key */
	for (i = 0; i < xp->xfrm_nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
		memcpy(&x->id, &t->id, sizeof(x->id));
		x->props.mode = t->mode;
		x->props.reqid = t->reqid;
		x->props.family = ut->family;
		t->aalgos = ua->aalgos;
		t->ealgos = ua->ealgos;
		t->calgos = ua->calgos;
		err = km_query(x, t, xp);

	}

	kfree(x);
	kfree(xp);

	return 0;
I
Ilpo Järvinen 已提交
2058 2059

bad_policy:
S
stephen hemminger 已提交
2060
	WARN(1, "BAD policy passed\n");
I
Ilpo Järvinen 已提交
2061 2062 2063 2064
free_state:
	kfree(x);
nomem:
	return err;
2065 2066
}

2067 2068
#ifdef CONFIG_XFRM_MIGRATE
static int copy_from_user_migrate(struct xfrm_migrate *ma,
2069
				  struct xfrm_kmaddress *k,
2070
				  struct nlattr **attrs, int *num)
2071
{
2072
	struct nlattr *rt = attrs[XFRMA_MIGRATE];
2073 2074 2075
	struct xfrm_user_migrate *um;
	int i, num_migrate;

2076 2077 2078 2079 2080 2081 2082 2083 2084 2085
	if (k != NULL) {
		struct xfrm_user_kmaddress *uk;

		uk = nla_data(attrs[XFRMA_KMADDRESS]);
		memcpy(&k->local, &uk->local, sizeof(k->local));
		memcpy(&k->remote, &uk->remote, sizeof(k->remote));
		k->family = uk->family;
		k->reserved = uk->reserved;
	}

2086 2087
	um = nla_data(rt);
	num_migrate = nla_len(rt) / sizeof(*um);
2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110

	if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < num_migrate; i++, um++, ma++) {
		memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
		memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
		memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
		memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));

		ma->proto = um->proto;
		ma->mode = um->mode;
		ma->reqid = um->reqid;

		ma->old_family = um->old_family;
		ma->new_family = um->new_family;
	}

	*num = i;
	return 0;
}

static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2111
			   struct nlattr **attrs)
2112
{
2113
	struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
2114
	struct xfrm_migrate m[XFRM_MAX_DEPTH];
2115
	struct xfrm_kmaddress km, *kmp;
2116 2117 2118 2119
	u8 type;
	int err;
	int n = 0;

2120
	if (attrs[XFRMA_MIGRATE] == NULL)
2121
		return -EINVAL;
2122

2123 2124
	kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;

2125
	err = copy_from_user_policy_type(&type, attrs);
2126 2127 2128
	if (err)
		return err;

2129
	err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
2130 2131 2132 2133 2134 2135
	if (err)
		return err;

	if (!n)
		return 0;

2136
	xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
2137 2138 2139 2140 2141

	return 0;
}
#else
static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2142
			   struct nlattr **attrs)
2143 2144 2145 2146 2147 2148
{
	return -ENOPROTOOPT;
}
#endif

#ifdef CONFIG_XFRM_MIGRATE
2149
static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
2150 2151 2152 2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163
{
	struct xfrm_user_migrate um;

	memset(&um, 0, sizeof(um));
	um.proto = m->proto;
	um.mode = m->mode;
	um.reqid = m->reqid;
	um.old_family = m->old_family;
	memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
	memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
	um.new_family = m->new_family;
	memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
	memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));

2164
	return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
2165 2166
}

2167
static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
2168 2169 2170 2171 2172 2173 2174
{
	struct xfrm_user_kmaddress uk;

	memset(&uk, 0, sizeof(uk));
	uk.family = k->family;
	uk.reserved = k->reserved;
	memcpy(&uk.local, &k->local, sizeof(uk.local));
2175
	memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
2176 2177 2178 2179 2180

	return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
}

static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
2181 2182
{
	return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
2183 2184 2185
	      + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
	      + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
	      + userpolicy_type_attrsize();
2186 2187
}

2188 2189 2190
static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
			 int num_migrate, const struct xfrm_kmaddress *k,
			 const struct xfrm_selector *sel, u8 dir, u8 type)
2191
{
2192
	const struct xfrm_migrate *mp;
2193 2194
	struct xfrm_userpolicy_id *pol_id;
	struct nlmsghdr *nlh;
2195
	int i, err;
2196

2197 2198 2199
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2200

2201
	pol_id = nlmsg_data(nlh);
2202 2203 2204 2205 2206
	/* copy data from selector, dir, and type to the pol_id */
	memset(pol_id, 0, sizeof(*pol_id));
	memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
	pol_id->dir = dir;

2207 2208 2209 2210 2211 2212 2213 2214
	if (k != NULL) {
		err = copy_to_user_kmaddress(k, skb);
		if (err)
			goto out_cancel;
	}
	err = copy_to_user_policy_type(type, skb);
	if (err)
		goto out_cancel;
2215
	for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
2216 2217 2218
		err = copy_to_user_migrate(mp, skb);
		if (err)
			goto out_cancel;
2219 2220
	}

2221
	return nlmsg_end(skb, nlh);
2222 2223

out_cancel:
2224
	nlmsg_cancel(skb, nlh);
2225
	return err;
2226 2227
}

2228 2229 2230
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
			     const struct xfrm_migrate *m, int num_migrate,
			     const struct xfrm_kmaddress *k)
2231
{
2232
	struct net *net = &init_net;
2233 2234
	struct sk_buff *skb;

2235
	skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
2236 2237 2238 2239
	if (skb == NULL)
		return -ENOMEM;

	/* build migrate */
2240
	if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
2241 2242
		BUG();

2243
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
2244 2245
}
#else
2246 2247 2248
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
			     const struct xfrm_migrate *m, int num_migrate,
			     const struct xfrm_kmaddress *k)
2249 2250 2251 2252
{
	return -ENOPROTOOPT;
}
#endif
J
Jamal Hadi Salim 已提交
2253

2254
#define XMSGSIZE(type) sizeof(struct type)
2255 2256

static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
2257
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2258 2259 2260 2261 2262 2263
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
2264
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
2265
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
2266
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2267
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2268
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
2269
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
2270
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
J
Jamal Hadi Salim 已提交
2271 2272
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2273
	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
2274
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2275 2276
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
L
Linus Torvalds 已提交
2277 2278
};

2279 2280
#undef XMSGSIZE

2281
static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
J
jamal 已提交
2282 2283 2284 2285
	[XFRMA_SA]		= { .len = sizeof(struct xfrm_usersa_info)},
	[XFRMA_POLICY]		= { .len = sizeof(struct xfrm_userpolicy_info)},
	[XFRMA_LASTUSED]	= { .type = NLA_U64},
	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
2286
	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300
	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_sec_ctx) },
	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
2301
	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
2302
	[XFRMA_MARK]		= { .len = sizeof(struct xfrm_mark) },
2303
	[XFRMA_TFCPAD]		= { .type = NLA_U32 },
2304
	[XFRMA_REPLAY_ESN_VAL]	= { .len = sizeof(struct xfrm_replay_state_esn) },
2305 2306
};

L
Linus Torvalds 已提交
2307
static struct xfrm_link {
2308
	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
L
Linus Torvalds 已提交
2309
	int (*dump)(struct sk_buff *, struct netlink_callback *);
2310
	int (*done)(struct netlink_callback *);
2311 2312 2313 2314
} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
2315 2316
						   .dump = xfrm_dump_sa,
						   .done = xfrm_dump_sa_done  },
2317 2318 2319
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
2320 2321
						   .dump = xfrm_dump_policy,
						   .done = xfrm_dump_policy_done },
2322
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
2323
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
2324
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
2325 2326
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
2327
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
2328 2329
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
J
Jamal Hadi Salim 已提交
2330 2331
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = { .doit = xfrm_new_ae  },
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = { .doit = xfrm_get_ae  },
2332
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate    },
2333
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo   },
J
Jamal Hadi Salim 已提交
2334
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo   },
L
Linus Torvalds 已提交
2335 2336
};

2337
static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
2338
{
2339
	struct net *net = sock_net(skb->sk);
2340
	struct nlattr *attrs[XFRMA_MAX+1];
L
Linus Torvalds 已提交
2341
	struct xfrm_link *link;
2342
	int type, err;
L
Linus Torvalds 已提交
2343 2344 2345

	type = nlh->nlmsg_type;
	if (type > XFRM_MSG_MAX)
2346
		return -EINVAL;
L
Linus Torvalds 已提交
2347 2348 2349 2350 2351

	type -= XFRM_MSG_BASE;
	link = &xfrm_dispatch[type];

	/* All operations require privileges, even GET */
2352
	if (!capable(CAP_NET_ADMIN))
2353
		return -EPERM;
L
Linus Torvalds 已提交
2354

2355 2356
	if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
	     type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
2357
	    (nlh->nlmsg_flags & NLM_F_DUMP)) {
L
Linus Torvalds 已提交
2358
		if (link->dump == NULL)
2359
			return -EINVAL;
2360

2361 2362 2363 2364 2365 2366 2367
		{
			struct netlink_dump_control c = {
				.dump = link->dump,
				.done = link->done,
			};
			return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
		}
L
Linus Torvalds 已提交
2368 2369
	}

2370
	err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
2371
			  xfrma_policy);
2372 2373
	if (err < 0)
		return err;
L
Linus Torvalds 已提交
2374 2375

	if (link->doit == NULL)
2376
		return -EINVAL;
L
Linus Torvalds 已提交
2377

2378
	return link->doit(skb, nlh, attrs);
L
Linus Torvalds 已提交
2379 2380
}

2381
static void xfrm_netlink_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
2382
{
2383 2384 2385
	mutex_lock(&xfrm_cfg_mutex);
	netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
	mutex_unlock(&xfrm_cfg_mutex);
L
Linus Torvalds 已提交
2386 2387
}

2388 2389
static inline size_t xfrm_expire_msgsize(void)
{
2390 2391
	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
	       + nla_total_size(sizeof(struct xfrm_mark));
2392 2393
}

2394
static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
L
Linus Torvalds 已提交
2395 2396 2397
{
	struct xfrm_user_expire *ue;
	struct nlmsghdr *nlh;
2398
	int err;
L
Linus Torvalds 已提交
2399

2400 2401 2402
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2403

2404
	ue = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2405
	copy_to_user_state(x, &ue->state);
J
Jamal Hadi Salim 已提交
2406
	ue->hard = (c->data.hard != 0) ? 1 : 0;
L
Linus Torvalds 已提交
2407

2408 2409 2410
	err = xfrm_mark_put(skb, &x->mark);
	if (err)
		return err;
2411

2412
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2413 2414
}

2415
static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
L
Linus Torvalds 已提交
2416
{
2417
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2418 2419
	struct sk_buff *skb;

2420
	skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
L
Linus Torvalds 已提交
2421 2422 2423
	if (skb == NULL)
		return -ENOMEM;

2424 2425 2426 2427
	if (build_expire(skb, x, c) < 0) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
L
Linus Torvalds 已提交
2428

2429
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2430 2431
}

2432
static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
J
Jamal Hadi Salim 已提交
2433
{
2434
	struct net *net = xs_net(x);
J
Jamal Hadi Salim 已提交
2435 2436
	struct sk_buff *skb;

2437
	skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2438 2439 2440 2441 2442 2443
	if (skb == NULL)
		return -ENOMEM;

	if (build_aevent(skb, x, c) < 0)
		BUG();

2444
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2445 2446
}

2447
static int xfrm_notify_sa_flush(const struct km_event *c)
2448
{
2449
	struct net *net = c->net;
2450 2451 2452
	struct xfrm_usersa_flush *p;
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2453
	int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
2454

2455
	skb = nlmsg_new(len, GFP_ATOMIC);
2456 2457 2458
	if (skb == NULL)
		return -ENOMEM;

2459 2460 2461 2462 2463
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
	if (nlh == NULL) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
2464

2465
	p = nlmsg_data(nlh);
2466
	p->proto = c->data.proto;
2467

2468
	nlmsg_end(skb, nlh);
2469

2470
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2471 2472
}

2473
static inline size_t xfrm_sa_len(struct xfrm_state *x)
2474
{
2475
	size_t l = 0;
2476 2477
	if (x->aead)
		l += nla_total_size(aead_len(x->aead));
2478 2479 2480 2481 2482
	if (x->aalg) {
		l += nla_total_size(sizeof(struct xfrm_algo) +
				    (x->aalg->alg_key_len + 7) / 8);
		l += nla_total_size(xfrm_alg_auth_len(x->aalg));
	}
2483
	if (x->ealg)
2484
		l += nla_total_size(xfrm_alg_len(x->ealg));
2485
	if (x->calg)
2486
		l += nla_total_size(sizeof(*x->calg));
2487
	if (x->encap)
2488
		l += nla_total_size(sizeof(*x->encap));
2489 2490
	if (x->tfcpad)
		l += nla_total_size(sizeof(x->tfcpad));
2491 2492
	if (x->replay_esn)
		l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
2493 2494 2495 2496 2497 2498
	if (x->security)
		l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
				    x->security->ctx_len);
	if (x->coaddr)
		l += nla_total_size(sizeof(*x->coaddr));

2499 2500
	/* Must count x->lastused as it may become non-zero behind our back. */
	l += nla_total_size(sizeof(u64));
2501 2502 2503 2504

	return l;
}

2505
static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
2506
{
2507
	struct net *net = xs_net(x);
2508
	struct xfrm_usersa_info *p;
2509
	struct xfrm_usersa_id *id;
2510 2511 2512
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
	int len = xfrm_sa_len(x);
2513
	int headlen, err;
2514 2515 2516

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELSA) {
2517
		len += nla_total_size(headlen);
2518
		headlen = sizeof(*id);
2519
		len += nla_total_size(sizeof(struct xfrm_mark));
2520
	}
2521
	len += NLMSG_ALIGN(headlen);
2522

2523
	skb = nlmsg_new(len, GFP_ATOMIC);
2524 2525 2526
	if (skb == NULL)
		return -ENOMEM;

2527
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2528
	err = -EMSGSIZE;
2529
	if (nlh == NULL)
2530
		goto out_free_skb;
2531

2532
	p = nlmsg_data(nlh);
2533
	if (c->event == XFRM_MSG_DELSA) {
2534 2535
		struct nlattr *attr;

2536
		id = nlmsg_data(nlh);
2537 2538 2539 2540 2541
		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
		id->spi = x->id.spi;
		id->family = x->props.family;
		id->proto = x->id.proto;

2542
		attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
2543
		err = -EMSGSIZE;
2544
		if (attr == NULL)
2545
			goto out_free_skb;
2546 2547

		p = nla_data(attr);
2548
	}
2549 2550 2551
	err = copy_to_user_state_extra(x, p, skb);
	if (err)
		goto out_free_skb;
2552

2553
	nlmsg_end(skb, nlh);
2554

2555
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2556

2557
out_free_skb:
2558
	kfree_skb(skb);
2559
	return err;
2560 2561
}

2562
static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
2563 2564 2565
{

	switch (c->event) {
2566
	case XFRM_MSG_EXPIRE:
2567
		return xfrm_exp_state_notify(x, c);
J
Jamal Hadi Salim 已提交
2568 2569
	case XFRM_MSG_NEWAE:
		return xfrm_aevent_state_notify(x, c);
2570 2571 2572
	case XFRM_MSG_DELSA:
	case XFRM_MSG_UPDSA:
	case XFRM_MSG_NEWSA:
2573
		return xfrm_notify_sa(x, c);
2574
	case XFRM_MSG_FLUSHSA:
2575 2576
		return xfrm_notify_sa_flush(c);
	default:
S
stephen hemminger 已提交
2577 2578 2579
		printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
		       c->event);
		break;
2580 2581 2582 2583 2584 2585
	}

	return 0;

}

2586 2587 2588 2589 2590
static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
					  struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2591
	       + nla_total_size(sizeof(struct xfrm_mark))
2592 2593 2594 2595
	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2596 2597 2598 2599
static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
			 struct xfrm_tmpl *xt, struct xfrm_policy *xp,
			 int dir)
{
2600
	__u32 seq = xfrm_get_acqseq();
L
Linus Torvalds 已提交
2601 2602
	struct xfrm_user_acquire *ua;
	struct nlmsghdr *nlh;
2603
	int err;
L
Linus Torvalds 已提交
2604

2605 2606 2607
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2608

2609
	ua = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2610 2611 2612 2613 2614 2615 2616 2617 2618
	memcpy(&ua->id, &x->id, sizeof(ua->id));
	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
	copy_to_user_policy(xp, &ua->policy, dir);
	ua->aalgos = xt->aalgos;
	ua->ealgos = xt->ealgos;
	ua->calgos = xt->calgos;
	ua->seq = x->km.seq = seq;

2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_state_sec_ctx(x, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
L
Linus Torvalds 已提交
2630

2631
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2632 2633 2634 2635 2636
}

static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
			     struct xfrm_policy *xp, int dir)
{
2637
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2638 2639
	struct sk_buff *skb;

2640
	skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2641 2642 2643 2644 2645 2646
	if (skb == NULL)
		return -ENOMEM;

	if (build_acquire(skb, x, xt, xp, dir) < 0)
		BUG();

2647
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2648 2649 2650 2651 2652
}

/* User gives us xfrm_user_policy_info followed by an array of 0
 * or more templates.
 */
2653
static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
L
Linus Torvalds 已提交
2654 2655
					       u8 *data, int len, int *dir)
{
2656
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
2657 2658 2659 2660 2661
	struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
	struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
	struct xfrm_policy *xp;
	int nr;

2662
	switch (sk->sk_family) {
L
Linus Torvalds 已提交
2663 2664 2665 2666 2667 2668
	case AF_INET:
		if (opt != IP_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
E
Eric Dumazet 已提交
2669
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688
	case AF_INET6:
		if (opt != IPV6_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
#endif
	default:
		*dir = -EINVAL;
		return NULL;
	}

	*dir = -EINVAL;

	if (len < sizeof(*p) ||
	    verify_newpolicy_info(p))
		return NULL;

	nr = ((len - sizeof(*p)) / sizeof(*ut));
2689
	if (validate_tmpl(nr, ut, p->sel.family))
L
Linus Torvalds 已提交
2690 2691
		return NULL;

2692 2693 2694
	if (p->dir > XFRM_POLICY_OUT)
		return NULL;

2695
	xp = xfrm_policy_alloc(net, GFP_ATOMIC);
L
Linus Torvalds 已提交
2696 2697 2698 2699 2700 2701
	if (xp == NULL) {
		*dir = -ENOBUFS;
		return NULL;
	}

	copy_from_user_policy(xp, p);
2702
	xp->type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
2703 2704 2705 2706 2707 2708 2709
	copy_templates(xp, ut, nr);

	*dir = p->dir;

	return xp;
}

2710 2711 2712 2713 2714
static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
2715
	       + nla_total_size(sizeof(struct xfrm_mark))
2716 2717 2718
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2719
static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2720
			   int dir, const struct km_event *c)
L
Linus Torvalds 已提交
2721 2722
{
	struct xfrm_user_polexpire *upe;
J
Jamal Hadi Salim 已提交
2723
	int hard = c->data.hard;
2724 2725
	struct nlmsghdr *nlh;
	int err;
L
Linus Torvalds 已提交
2726

2727 2728 2729
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2730

2731
	upe = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2732
	copy_to_user_policy(xp, &upe->pol, dir);
2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_sec_ctx(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
L
Linus Torvalds 已提交
2744 2745
	upe->hard = !!hard;

2746
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2747 2748
}

2749
static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
L
Linus Torvalds 已提交
2750
{
2751
	struct net *net = xp_net(xp);
L
Linus Torvalds 已提交
2752 2753
	struct sk_buff *skb;

2754
	skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2755 2756 2757
	if (skb == NULL)
		return -ENOMEM;

J
Jamal Hadi Salim 已提交
2758
	if (build_polexpire(skb, xp, dir, c) < 0)
L
Linus Torvalds 已提交
2759 2760
		BUG();

2761
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2762 2763
}

2764
static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
2765
{
2766
	int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2767
	struct net *net = xp_net(xp);
2768
	struct xfrm_userpolicy_info *p;
2769
	struct xfrm_userpolicy_id *id;
2770 2771
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2772
	int headlen, err;
2773 2774 2775

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELPOLICY) {
2776
		len += nla_total_size(headlen);
2777 2778
		headlen = sizeof(*id);
	}
2779
	len += userpolicy_type_attrsize();
2780
	len += nla_total_size(sizeof(struct xfrm_mark));
2781
	len += NLMSG_ALIGN(headlen);
2782

2783
	skb = nlmsg_new(len, GFP_ATOMIC);
2784 2785 2786
	if (skb == NULL)
		return -ENOMEM;

2787
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2788
	err = -EMSGSIZE;
2789
	if (nlh == NULL)
2790
		goto out_free_skb;
2791

2792
	p = nlmsg_data(nlh);
2793
	if (c->event == XFRM_MSG_DELPOLICY) {
2794 2795
		struct nlattr *attr;

2796
		id = nlmsg_data(nlh);
2797 2798 2799 2800 2801 2802 2803
		memset(id, 0, sizeof(*id));
		id->dir = dir;
		if (c->data.byid)
			id->index = xp->index;
		else
			memcpy(&id->sel, &xp->selector, sizeof(id->sel));

2804
		attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
2805
		err = -EMSGSIZE;
2806
		if (attr == NULL)
2807
			goto out_free_skb;
2808 2809

		p = nla_data(attr);
2810
	}
2811 2812

	copy_to_user_policy(xp, p, dir);
2813 2814 2815 2816 2817 2818 2819
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err)
		goto out_free_skb;
2820

2821
	nlmsg_end(skb, nlh);
2822

2823
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2824

2825
out_free_skb:
2826
	kfree_skb(skb);
2827
	return err;
2828 2829
}

2830
static int xfrm_notify_policy_flush(const struct km_event *c)
2831
{
2832
	struct net *net = c->net;
2833 2834
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2835
	int err;
2836

2837
	skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
2838 2839 2840
	if (skb == NULL)
		return -ENOMEM;

2841
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
2842
	err = -EMSGSIZE;
2843
	if (nlh == NULL)
2844 2845 2846 2847
		goto out_free_skb;
	err = copy_to_user_policy_type(c->data.type, skb);
	if (err)
		goto out_free_skb;
2848

2849
	nlmsg_end(skb, nlh);
2850

2851
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2852

2853
out_free_skb:
2854
	kfree_skb(skb);
2855
	return err;
2856 2857
}

2858
static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
2859 2860 2861
{

	switch (c->event) {
2862 2863 2864
	case XFRM_MSG_NEWPOLICY:
	case XFRM_MSG_UPDPOLICY:
	case XFRM_MSG_DELPOLICY:
2865
		return xfrm_notify_policy(xp, dir, c);
2866
	case XFRM_MSG_FLUSHPOLICY:
2867
		return xfrm_notify_policy_flush(c);
2868
	case XFRM_MSG_POLEXPIRE:
2869 2870
		return xfrm_exp_policy_notify(xp, dir, c);
	default:
S
stephen hemminger 已提交
2871 2872
		printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
		       c->event);
2873 2874 2875 2876 2877 2878
	}

	return 0;

}

2879 2880 2881 2882 2883
static inline size_t xfrm_report_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
}

2884 2885 2886 2887 2888 2889
static int build_report(struct sk_buff *skb, u8 proto,
			struct xfrm_selector *sel, xfrm_address_t *addr)
{
	struct xfrm_user_report *ur;
	struct nlmsghdr *nlh;

2890 2891 2892
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2893

2894
	ur = nlmsg_data(nlh);
2895 2896 2897
	ur->proto = proto;
	memcpy(&ur->sel, sel, sizeof(ur->sel));

2898 2899 2900 2901 2902 2903 2904
	if (addr) {
		int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr);
		if (err) {
			nlmsg_cancel(skb, nlh);
			return err;
		}
	}
2905
	return nlmsg_end(skb, nlh);
2906 2907
}

2908 2909
static int xfrm_send_report(struct net *net, u8 proto,
			    struct xfrm_selector *sel, xfrm_address_t *addr)
2910 2911 2912
{
	struct sk_buff *skb;

2913
	skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
2914 2915 2916 2917 2918 2919
	if (skb == NULL)
		return -ENOMEM;

	if (build_report(skb, proto, sel, addr) < 0)
		BUG();

2920
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
2921 2922
}

2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955
static inline size_t xfrm_mapping_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
}

static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
			 xfrm_address_t *new_saddr, __be16 new_sport)
{
	struct xfrm_user_mapping *um;
	struct nlmsghdr *nlh;

	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
	if (nlh == NULL)
		return -EMSGSIZE;

	um = nlmsg_data(nlh);

	memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
	um->id.spi = x->id.spi;
	um->id.family = x->props.family;
	um->id.proto = x->id.proto;
	memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
	memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
	um->new_sport = new_sport;
	um->old_sport = x->encap->encap_sport;
	um->reqid = x->props.reqid;

	return nlmsg_end(skb, nlh);
}

static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
			     __be16 sport)
{
2956
	struct net *net = xs_net(x);
2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971
	struct sk_buff *skb;

	if (x->id.proto != IPPROTO_ESP)
		return -EINVAL;

	if (!x->encap)
		return -EINVAL;

	skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
	if (skb == NULL)
		return -ENOMEM;

	if (build_mapping(skb, x, ipaddr, sport) < 0)
		BUG();

2972
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
2973 2974
}

L
Linus Torvalds 已提交
2975 2976 2977 2978 2979 2980
static struct xfrm_mgr netlink_mgr = {
	.id		= "netlink",
	.notify		= xfrm_send_state_notify,
	.acquire	= xfrm_send_acquire,
	.compile_policy	= xfrm_compile_policy,
	.notify_policy	= xfrm_send_policy_notify,
2981
	.report		= xfrm_send_report,
2982
	.migrate	= xfrm_send_migrate,
2983
	.new_mapping	= xfrm_send_mapping,
L
Linus Torvalds 已提交
2984 2985
};

2986
static int __net_init xfrm_user_net_init(struct net *net)
L
Linus Torvalds 已提交
2987
{
2988
	struct sock *nlsk;
2989 2990 2991 2992
	struct netlink_kernel_cfg cfg = {
		.groups	= XFRMNLGRP_MAX,
		.input	= xfrm_netlink_rcv,
	};
2993

2994
	nlsk = netlink_kernel_create(net, NETLINK_XFRM, THIS_MODULE, &cfg);
2995
	if (nlsk == NULL)
L
Linus Torvalds 已提交
2996
		return -ENOMEM;
2997
	net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
2998
	rcu_assign_pointer(net->xfrm.nlsk, nlsk);
L
Linus Torvalds 已提交
2999 3000 3001
	return 0;
}

3002
static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
L
Linus Torvalds 已提交
3003
{
3004 3005
	struct net *net;
	list_for_each_entry(net, net_exit_list, exit_list)
3006
		RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
3007 3008 3009
	synchronize_net();
	list_for_each_entry(net, net_exit_list, exit_list)
		netlink_kernel_release(net->xfrm.nlsk_stash);
L
Linus Torvalds 已提交
3010 3011
}

3012
static struct pernet_operations xfrm_user_net_ops = {
3013 3014
	.init	    = xfrm_user_net_init,
	.exit_batch = xfrm_user_net_exit,
3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037
};

static int __init xfrm_user_init(void)
{
	int rv;

	printk(KERN_INFO "Initializing XFRM netlink socket\n");

	rv = register_pernet_subsys(&xfrm_user_net_ops);
	if (rv < 0)
		return rv;
	rv = xfrm_register_km(&netlink_mgr);
	if (rv < 0)
		unregister_pernet_subsys(&xfrm_user_net_ops);
	return rv;
}

static void __exit xfrm_user_exit(void)
{
	xfrm_unregister_km(&netlink_mgr);
	unregister_pernet_subsys(&xfrm_user_net_ops);
}

L
Linus Torvalds 已提交
3038 3039 3040
module_init(xfrm_user_init);
module_exit(xfrm_user_exit);
MODULE_LICENSE("GPL");
3041
MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
3042