xfrm_user.c 64.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9
/* xfrm_user.c: User interface to configure xfrm engine.
 *
 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
 *
 * Changes:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
10
 *
L
Linus Torvalds 已提交
11 12
 */

13
#include <linux/crypto.h>
L
Linus Torvalds 已提交
14 15 16 17 18 19 20 21 22 23 24 25 26 27
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/socket.h>
#include <linux/string.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/pfkeyv2.h>
#include <linux/ipsec.h>
#include <linux/init.h>
#include <linux/security.h>
#include <net/sock.h>
#include <net/xfrm.h>
28
#include <net/netlink.h>
L
Linus Torvalds 已提交
29
#include <asm/uaccess.h>
30 31 32
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
#include <linux/in6.h>
#endif
L
Linus Torvalds 已提交
33

34 35 36 37 38
static inline int aead_len(struct xfrm_algo_aead *alg)
{
	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
}

39
static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
L
Linus Torvalds 已提交
40
{
41
	struct nlattr *rt = attrs[type];
L
Linus Torvalds 已提交
42 43 44 45 46
	struct xfrm_algo *algp;

	if (!rt)
		return 0;

47
	algp = nla_data(rt);
48
	if (nla_len(rt) < xfrm_alg_len(algp))
49 50
		return -EINVAL;

L
Linus Torvalds 已提交
51 52 53 54 55 56 57 58
	switch (type) {
	case XFRMA_ALG_AUTH:
	case XFRMA_ALG_CRYPT:
	case XFRMA_ALG_COMP:
		break;

	default:
		return -EINVAL;
59
	}
L
Linus Torvalds 已提交
60 61 62 63 64

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80
static int verify_auth_trunc(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
	struct xfrm_algo_auth *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < xfrm_alg_auth_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96
static int verify_aead(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
	struct xfrm_algo_aead *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < aead_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

97
static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
98 99
			   xfrm_address_t **addrp)
{
100
	struct nlattr *rt = attrs[type];
101

102
	if (rt && addrp)
103
		*addrp = nla_data(rt);
104
}
105

106
static inline int verify_sec_ctx_len(struct nlattr **attrs)
107
{
108
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
109 110 111 112 113
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

114
	uctx = nla_data(rt);
115
	if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
116 117 118 119 120 121
		return -EINVAL;

	return 0;
}


L
Linus Torvalds 已提交
122
static int verify_newsa_info(struct xfrm_usersa_info *p,
123
			     struct nlattr **attrs)
L
Linus Torvalds 已提交
124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141
{
	int err;

	err = -EINVAL;
	switch (p->family) {
	case AF_INET:
		break;

	case AF_INET6:
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
		break;
#else
		err = -EAFNOSUPPORT;
		goto out;
#endif

	default:
		goto out;
142
	}
L
Linus Torvalds 已提交
143 144 145 146

	err = -EINVAL;
	switch (p->id.proto) {
	case IPPROTO_AH:
147 148
		if ((!attrs[XFRMA_ALG_AUTH]	&&
		     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
149
		    attrs[XFRMA_ALG_AEAD]	||
150 151
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_ALG_COMP])
L
Linus Torvalds 已提交
152 153 154 155
			goto out;
		break;

	case IPPROTO_ESP:
156 157 158
		if (attrs[XFRMA_ALG_COMP])
			goto out;
		if (!attrs[XFRMA_ALG_AUTH] &&
159
		    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
160 161 162 163
		    !attrs[XFRMA_ALG_CRYPT] &&
		    !attrs[XFRMA_ALG_AEAD])
			goto out;
		if ((attrs[XFRMA_ALG_AUTH] ||
164
		     attrs[XFRMA_ALG_AUTH_TRUNC] ||
165 166
		     attrs[XFRMA_ALG_CRYPT]) &&
		    attrs[XFRMA_ALG_AEAD])
L
Linus Torvalds 已提交
167 168 169 170
			goto out;
		break;

	case IPPROTO_COMP:
171
		if (!attrs[XFRMA_ALG_COMP]	||
172
		    attrs[XFRMA_ALG_AEAD]	||
173
		    attrs[XFRMA_ALG_AUTH]	||
174
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
175
		    attrs[XFRMA_ALG_CRYPT])
L
Linus Torvalds 已提交
176 177 178
			goto out;
		break;

179 180 181
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
	case IPPROTO_DSTOPTS:
	case IPPROTO_ROUTING:
182 183
		if (attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_ALG_AUTH]	||
184
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
185
		    attrs[XFRMA_ALG_AEAD]	||
186 187 188 189
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_ENCAP]		||
		    attrs[XFRMA_SEC_CTX]	||
		    !attrs[XFRMA_COADDR])
190 191 192 193
			goto out;
		break;
#endif

L
Linus Torvalds 已提交
194 195
	default:
		goto out;
196
	}
L
Linus Torvalds 已提交
197

198 199
	if ((err = verify_aead(attrs)))
		goto out;
200 201
	if ((err = verify_auth_trunc(attrs)))
		goto out;
202
	if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
L
Linus Torvalds 已提交
203
		goto out;
204
	if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
L
Linus Torvalds 已提交
205
		goto out;
206
	if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
L
Linus Torvalds 已提交
207
		goto out;
208
	if ((err = verify_sec_ctx_len(attrs)))
209
		goto out;
L
Linus Torvalds 已提交
210 211 212

	err = -EINVAL;
	switch (p->mode) {
213 214
	case XFRM_MODE_TRANSPORT:
	case XFRM_MODE_TUNNEL:
215
	case XFRM_MODE_ROUTEOPTIMIZATION:
D
Diego Beltrami 已提交
216
	case XFRM_MODE_BEET:
L
Linus Torvalds 已提交
217 218 219 220
		break;

	default:
		goto out;
221
	}
L
Linus Torvalds 已提交
222 223 224 225 226 227 228 229 230

	err = 0;

out:
	return err;
}

static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
			   struct xfrm_algo_desc *(*get_byname)(char *, int),
231
			   struct nlattr *rta)
L
Linus Torvalds 已提交
232 233 234 235 236 237 238
{
	struct xfrm_algo *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

239
	ualg = nla_data(rta);
L
Linus Torvalds 已提交
240 241 242 243 244 245

	algo = get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

246
	p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
L
Linus Torvalds 已提交
247 248 249
	if (!p)
		return -ENOMEM;

250
	strcpy(p->alg_name, algo->name);
L
Linus Torvalds 已提交
251 252 253 254
	*algpp = p;
	return 0;
}

255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314
static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo *ualg;
	struct xfrm_algo_auth *p;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	p->alg_key_len = ualg->alg_key_len;
	p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
	memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);

	*algpp = p;
	return 0;
}

static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
			     struct nlattr *rta)
{
	struct xfrm_algo_auth *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
		return -EINVAL;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	if (!p->alg_trunc_len)
		p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;

	*algpp = p;
	return 0;
}

315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339
static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo_aead *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	*algpp = p;
	return 0;
}

340
static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
341 342 343 344 345 346 347 348 349 350
{
	int len = 0;

	if (xfrm_ctx) {
		len += sizeof(struct xfrm_user_sec_ctx);
		len += xfrm_ctx->ctx_len;
	}
	return len;
}

L
Linus Torvalds 已提交
351 352 353 354 355 356 357 358 359
static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&x->id, &p->id, sizeof(x->id));
	memcpy(&x->sel, &p->sel, sizeof(x->sel));
	memcpy(&x->lft, &p->lft, sizeof(x->lft));
	x->props.mode = p->mode;
	x->props.replay_window = p->replay_window;
	x->props.reqid = p->reqid;
	x->props.family = p->family;
360
	memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
L
Linus Torvalds 已提交
361
	x->props.flags = p->flags;
362

363
	if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
364
		x->sel.family = p->family;
L
Linus Torvalds 已提交
365 366
}

J
Jamal Hadi Salim 已提交
367 368 369 370 371
/*
 * someday when pfkey also has support, we could have the code
 * somehow made shareable and move it to xfrm_state.c - JHS
 *
*/
372
static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
373
{
374 375 376 377
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
J
Jamal Hadi Salim 已提交
378 379 380

	if (rp) {
		struct xfrm_replay_state *replay;
381
		replay = nla_data(rp);
J
Jamal Hadi Salim 已提交
382 383 384 385 386 387
		memcpy(&x->replay, replay, sizeof(*replay));
		memcpy(&x->preplay, replay, sizeof(*replay));
	}

	if (lt) {
		struct xfrm_lifetime_cur *ltime;
388
		ltime = nla_data(lt);
J
Jamal Hadi Salim 已提交
389 390 391 392 393 394
		x->curlft.bytes = ltime->bytes;
		x->curlft.packets = ltime->packets;
		x->curlft.add_time = ltime->add_time;
		x->curlft.use_time = ltime->use_time;
	}

395
	if (et)
396
		x->replay_maxage = nla_get_u32(et);
J
Jamal Hadi Salim 已提交
397

398
	if (rt)
399
		x->replay_maxdiff = nla_get_u32(rt);
J
Jamal Hadi Salim 已提交
400 401
}

402 403
static struct xfrm_state *xfrm_state_construct(struct net *net,
					       struct xfrm_usersa_info *p,
404
					       struct nlattr **attrs,
L
Linus Torvalds 已提交
405 406
					       int *errp)
{
407
	struct xfrm_state *x = xfrm_state_alloc(net);
L
Linus Torvalds 已提交
408 409 410 411 412 413 414
	int err = -ENOMEM;

	if (!x)
		goto error_no_put;

	copy_from_user_state(x, p);

415 416 417
	if ((err = attach_aead(&x->aead, &x->props.ealgo,
			       attrs[XFRMA_ALG_AEAD])))
		goto error;
418 419
	if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
				     attrs[XFRMA_ALG_AUTH_TRUNC])))
L
Linus Torvalds 已提交
420
		goto error;
421 422 423 424 425
	if (!x->props.aalgo) {
		if ((err = attach_auth(&x->aalg, &x->props.aalgo,
				       attrs[XFRMA_ALG_AUTH])))
			goto error;
	}
L
Linus Torvalds 已提交
426 427
	if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
				   xfrm_ealg_get_byname,
428
				   attrs[XFRMA_ALG_CRYPT])))
L
Linus Torvalds 已提交
429 430 431
		goto error;
	if ((err = attach_one_algo(&x->calg, &x->props.calgo,
				   xfrm_calg_get_byname,
432
				   attrs[XFRMA_ALG_COMP])))
L
Linus Torvalds 已提交
433
		goto error;
434 435 436 437 438 439 440 441 442 443 444 445 446 447 448

	if (attrs[XFRMA_ENCAP]) {
		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
				   sizeof(*x->encap), GFP_KERNEL);
		if (x->encap == NULL)
			goto error;
	}

	if (attrs[XFRMA_COADDR]) {
		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
				    sizeof(*x->coaddr), GFP_KERNEL);
		if (x->coaddr == NULL)
			goto error;
	}

H
Herbert Xu 已提交
449
	err = xfrm_init_state(x);
L
Linus Torvalds 已提交
450 451 452
	if (err)
		goto error;

453 454
	if (attrs[XFRMA_SEC_CTX] &&
	    security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
455 456
		goto error;

L
Linus Torvalds 已提交
457
	x->km.seq = p->seq;
A
Alexey Dobriyan 已提交
458
	x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
J
Jamal Hadi Salim 已提交
459
	/* sysctl_xfrm_aevent_etime is in 100ms units */
A
Alexey Dobriyan 已提交
460
	x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
J
Jamal Hadi Salim 已提交
461 462 463 464 465 466
	x->preplay.bitmap = 0;
	x->preplay.seq = x->replay.seq+x->replay_maxdiff;
	x->preplay.oseq = x->replay.oseq +x->replay_maxdiff;

	/* override default values from above */

467
	xfrm_update_ae_params(x, attrs);
L
Linus Torvalds 已提交
468 469 470 471 472 473 474 475 476 477 478

	return x;

error:
	x->km.state = XFRM_STATE_DEAD;
	xfrm_state_put(x);
error_no_put:
	*errp = err;
	return NULL;
}

479
static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
480
		struct nlattr **attrs)
L
Linus Torvalds 已提交
481
{
482
	struct net *net = sock_net(skb->sk);
483
	struct xfrm_usersa_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
484 485
	struct xfrm_state *x;
	int err;
486
	struct km_event c;
487 488 489
	uid_t loginuid = NETLINK_CB(skb).loginuid;
	u32 sessionid = NETLINK_CB(skb).sessionid;
	u32 sid = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
490

491
	err = verify_newsa_info(p, attrs);
L
Linus Torvalds 已提交
492 493 494
	if (err)
		return err;

495
	x = xfrm_state_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
496 497 498
	if (!x)
		return err;

499
	xfrm_state_hold(x);
L
Linus Torvalds 已提交
500 501 502 503 504
	if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
		err = xfrm_state_add(x);
	else
		err = xfrm_state_update(x);

505
	xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
506

L
Linus Torvalds 已提交
507 508
	if (err < 0) {
		x->km.state = XFRM_STATE_DEAD;
509
		__xfrm_state_put(x);
510
		goto out;
L
Linus Torvalds 已提交
511 512
	}

513 514
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
515
	c.event = nlh->nlmsg_type;
516 517

	km_state_notify(x, &c);
518
out:
519
	xfrm_state_put(x);
L
Linus Torvalds 已提交
520 521 522
	return err;
}

523 524
static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
						 struct xfrm_usersa_id *p,
525
						 struct nlattr **attrs,
526 527 528 529 530 531 532
						 int *errp)
{
	struct xfrm_state *x = NULL;
	int err;

	if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
		err = -ESRCH;
533
		x = xfrm_state_lookup(net, &p->daddr, p->spi, p->proto, p->family);
534 535 536
	} else {
		xfrm_address_t *saddr = NULL;

537
		verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
538 539 540 541 542
		if (!saddr) {
			err = -EINVAL;
			goto out;
		}

543
		err = -ESRCH;
544
		x = xfrm_state_lookup_byaddr(net, &p->daddr, saddr,
545
					     p->proto, p->family);
546 547 548 549 550 551 552 553
	}

 out:
	if (!x && errp)
		*errp = err;
	return x;
}

554
static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
555
		struct nlattr **attrs)
L
Linus Torvalds 已提交
556
{
557
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
558
	struct xfrm_state *x;
559
	int err = -ESRCH;
560
	struct km_event c;
561
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
562 563 564
	uid_t loginuid = NETLINK_CB(skb).loginuid;
	u32 sessionid = NETLINK_CB(skb).sessionid;
	u32 sid = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
565

566
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
567
	if (x == NULL)
568
		return err;
L
Linus Torvalds 已提交
569

570
	if ((err = security_xfrm_state_delete(x)) != 0)
C
Catherine Zhang 已提交
571 572
		goto out;

L
Linus Torvalds 已提交
573
	if (xfrm_state_kern(x)) {
C
Catherine Zhang 已提交
574 575
		err = -EPERM;
		goto out;
L
Linus Torvalds 已提交
576 577
	}

578
	err = xfrm_state_delete(x);
J
Joy Latten 已提交
579

C
Catherine Zhang 已提交
580 581
	if (err < 0)
		goto out;
582 583 584

	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
585
	c.event = nlh->nlmsg_type;
586
	km_state_notify(x, &c);
L
Linus Torvalds 已提交
587

C
Catherine Zhang 已提交
588
out:
589
	xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
C
Catherine Zhang 已提交
590
	xfrm_state_put(x);
591
	return err;
L
Linus Torvalds 已提交
592 593 594 595 596 597 598 599 600
}

static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&p->id, &x->id, sizeof(p->id));
	memcpy(&p->sel, &x->sel, sizeof(p->sel));
	memcpy(&p->lft, &x->lft, sizeof(p->lft));
	memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
	memcpy(&p->stats, &x->stats, sizeof(p->stats));
601
	memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
L
Linus Torvalds 已提交
602 603 604 605 606 607 608 609 610 611 612 613 614 615 616
	p->mode = x->props.mode;
	p->replay_window = x->props.replay_window;
	p->reqid = x->props.reqid;
	p->family = x->props.family;
	p->flags = x->props.flags;
	p->seq = x->km.seq;
}

struct xfrm_dump_info {
	struct sk_buff *in_skb;
	struct sk_buff *out_skb;
	u32 nlmsg_seq;
	u16 nlmsg_flags;
};

617 618 619 620
static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
{
	struct xfrm_user_sec_ctx *uctx;
	struct nlattr *attr;
621
	int ctx_size = sizeof(*uctx) + s->ctx_len;
622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637

	attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
	if (attr == NULL)
		return -EMSGSIZE;

	uctx = nla_data(attr);
	uctx->exttype = XFRMA_SEC_CTX;
	uctx->len = ctx_size;
	uctx->ctx_doi = s->ctx_doi;
	uctx->ctx_alg = s->ctx_alg;
	uctx->ctx_len = s->ctx_len;
	memcpy(uctx + 1, s->ctx_str, s->ctx_len);

	return 0;
}

638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655
static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
{
	struct xfrm_algo *algo;
	struct nlattr *nla;

	nla = nla_reserve(skb, XFRMA_ALG_AUTH,
			  sizeof(*algo) + (auth->alg_key_len + 7) / 8);
	if (!nla)
		return -EMSGSIZE;

	algo = nla_data(nla);
	strcpy(algo->alg_name, auth->alg_name);
	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
	algo->alg_key_len = auth->alg_key_len;

	return 0;
}

656 657 658 659
/* Don't change this without updating xfrm_sa_len! */
static int copy_to_user_state_extra(struct xfrm_state *x,
				    struct xfrm_usersa_info *p,
				    struct sk_buff *skb)
L
Linus Torvalds 已提交
660 661 662
{
	copy_to_user_state(x, p);

663 664 665 666 667 668
	if (x->coaddr)
		NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);

	if (x->lastused)
		NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);

669 670
	if (x->aead)
		NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
671 672 673 674 675 676 677
	if (x->aalg) {
		if (copy_to_user_auth(x->aalg, skb))
			goto nla_put_failure;

		NLA_PUT(skb, XFRMA_ALG_AUTH_TRUNC,
			xfrm_alg_auth_len(x->aalg), x->aalg);
	}
L
Linus Torvalds 已提交
678
	if (x->ealg)
679
		NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
L
Linus Torvalds 已提交
680
	if (x->calg)
681
		NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
L
Linus Torvalds 已提交
682 683

	if (x->encap)
684
		NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
L
Linus Torvalds 已提交
685

686 687
	if (x->security && copy_sec_ctx(x->security, skb) < 0)
		goto nla_put_failure;
688

689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714
	return 0;

nla_put_failure:
	return -EMSGSIZE;
}

static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct xfrm_usersa_info *p;
	struct nlmsghdr *nlh;
	int err;

	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;

	p = nlmsg_data(nlh);

	err = copy_to_user_state_extra(x, p, skb);
	if (err)
		goto nla_put_failure;

715
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
716 717
	return 0;

718
nla_put_failure:
719
	nlmsg_cancel(skb, nlh);
720
	return err;
L
Linus Torvalds 已提交
721 722
}

723 724 725 726 727 728 729
static int xfrm_dump_sa_done(struct netlink_callback *cb)
{
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
	xfrm_state_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
730 731
static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
{
732
	struct net *net = sock_net(skb->sk);
733
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
L
Linus Torvalds 已提交
734 735
	struct xfrm_dump_info info;

736 737 738
	BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
739 740 741 742
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
743 744 745 746 747 748

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_state_walk_init(walk, 0);
	}

749
	(void) xfrm_state_walk(net, walk, dump_one_state, &info);
L
Linus Torvalds 已提交
750 751 752 753 754 755 756 757 758 759

	return skb->len;
}

static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
					  struct xfrm_state *x, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;

760
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
L
Linus Torvalds 已提交
761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

	if (dump_one_state(x, 0, &info)) {
		kfree_skb(skb);
		return NULL;
	}

	return skb;
}

777 778 779 780 781 782 783
static inline size_t xfrm_spdinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_spdinfo))
	       + nla_total_size(sizeof(struct xfrmu_spdhinfo));
}

784 785
static int build_spdinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
786
{
787 788 789
	struct xfrmk_spdinfo si;
	struct xfrmu_spdinfo spc;
	struct xfrmu_spdhinfo sph;
J
Jamal Hadi Salim 已提交
790 791 792 793 794 795 796 797 798
	struct nlmsghdr *nlh;
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
	if (nlh == NULL) /* shouldnt really happen ... */
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
799
	xfrm_spd_getinfo(net, &si);
800 801 802 803 804 805 806 807 808 809 810
	spc.incnt = si.incnt;
	spc.outcnt = si.outcnt;
	spc.fwdcnt = si.fwdcnt;
	spc.inscnt = si.inscnt;
	spc.outscnt = si.outscnt;
	spc.fwdscnt = si.fwdscnt;
	sph.spdhcnt = si.spdhcnt;
	sph.spdhmcnt = si.spdhmcnt;

	NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
	NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
J
Jamal Hadi Salim 已提交
811 812 813 814 815 816 817 818 819

	return nlmsg_end(skb, nlh);

nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
}

static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
820
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
821
{
822
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
823
	struct sk_buff *r_skb;
824
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
825 826 827
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

828
	r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
829 830 831
	if (r_skb == NULL)
		return -ENOMEM;

832
	if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
833 834
		BUG();

835
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
836 837
}

838 839 840 841 842 843 844
static inline size_t xfrm_sadinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_sadhinfo))
	       + nla_total_size(4); /* XFRMA_SAD_CNT */
}

845 846
static int build_sadinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
847
{
848 849
	struct xfrmk_sadinfo si;
	struct xfrmu_sadhinfo sh;
J
Jamal Hadi Salim 已提交
850 851 852 853 854 855 856 857 858
	struct nlmsghdr *nlh;
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
	if (nlh == NULL) /* shouldnt really happen ... */
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
859
	xfrm_sad_getinfo(net, &si);
J
Jamal Hadi Salim 已提交
860

861 862 863 864 865
	sh.sadhmcnt = si.sadhmcnt;
	sh.sadhcnt = si.sadhcnt;

	NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
	NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
J
Jamal Hadi Salim 已提交
866 867 868 869 870 871 872 873 874

	return nlmsg_end(skb, nlh);

nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
}

static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
875
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
876
{
877
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
878
	struct sk_buff *r_skb;
879
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
880 881 882
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

883
	r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
884 885 886
	if (r_skb == NULL)
		return -ENOMEM;

887
	if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
888 889
		BUG();

890
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
891 892
}

893
static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
894
		struct nlattr **attrs)
L
Linus Torvalds 已提交
895
{
896
	struct net *net = sock_net(skb->sk);
897
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
898 899
	struct xfrm_state *x;
	struct sk_buff *resp_skb;
900
	int err = -ESRCH;
L
Linus Torvalds 已提交
901

902
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
903 904 905 906 907 908 909
	if (x == NULL)
		goto out_noput;

	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
	} else {
910
		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931
	}
	xfrm_state_put(x);
out_noput:
	return err;
}

static int verify_userspi_info(struct xfrm_userspi_info *p)
{
	switch (p->info.id.proto) {
	case IPPROTO_AH:
	case IPPROTO_ESP:
		break;

	case IPPROTO_COMP:
		/* IPCOMP spi is 16-bits. */
		if (p->max >= 0x10000)
			return -EINVAL;
		break;

	default:
		return -EINVAL;
932
	}
L
Linus Torvalds 已提交
933 934 935 936 937 938 939

	if (p->min > p->max)
		return -EINVAL;

	return 0;
}

940
static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
941
		struct nlattr **attrs)
L
Linus Torvalds 已提交
942
{
943
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
944 945 946 947 948 949 950
	struct xfrm_state *x;
	struct xfrm_userspi_info *p;
	struct sk_buff *resp_skb;
	xfrm_address_t *daddr;
	int family;
	int err;

951
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
952 953 954 955 956 957 958 959 960
	err = verify_userspi_info(p);
	if (err)
		goto out_noput;

	family = p->info.family;
	daddr = &p->info.id.daddr;

	x = NULL;
	if (p->info.seq) {
961
		x = xfrm_find_acq_byseq(net, p->info.seq);
L
Linus Torvalds 已提交
962 963 964 965 966 967 968
		if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
			xfrm_state_put(x);
			x = NULL;
		}
	}

	if (!x)
969
		x = xfrm_find_acq(net, p->info.mode, p->info.reqid,
L
Linus Torvalds 已提交
970 971 972 973 974 975 976
				  p->info.id.proto, daddr,
				  &p->info.saddr, 1,
				  family);
	err = -ENOENT;
	if (x == NULL)
		goto out_noput;

977 978 979
	err = xfrm_alloc_spi(x, p->min, p->max);
	if (err)
		goto out;
L
Linus Torvalds 已提交
980

981
	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
L
Linus Torvalds 已提交
982 983 984 985 986
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
		goto out;
	}

987
	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
988 989 990 991 992 993 994

out:
	xfrm_state_put(x);
out_noput:
	return err;
}

995
static int verify_policy_dir(u8 dir)
L
Linus Torvalds 已提交
996 997 998 999 1000 1001 1002 1003 1004
{
	switch (dir) {
	case XFRM_POLICY_IN:
	case XFRM_POLICY_OUT:
	case XFRM_POLICY_FWD:
		break;

	default:
		return -EINVAL;
1005
	}
L
Linus Torvalds 已提交
1006 1007 1008 1009

	return 0;
}

1010
static int verify_policy_type(u8 type)
1011 1012 1013 1014 1015 1016 1017 1018 1019 1020
{
	switch (type) {
	case XFRM_POLICY_TYPE_MAIN:
#ifdef CONFIG_XFRM_SUB_POLICY
	case XFRM_POLICY_TYPE_SUB:
#endif
		break;

	default:
		return -EINVAL;
1021
	}
1022 1023 1024 1025

	return 0;
}

L
Linus Torvalds 已提交
1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036
static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
{
	switch (p->share) {
	case XFRM_SHARE_ANY:
	case XFRM_SHARE_SESSION:
	case XFRM_SHARE_USER:
	case XFRM_SHARE_UNIQUE:
		break;

	default:
		return -EINVAL;
1037
	}
L
Linus Torvalds 已提交
1038 1039 1040 1041 1042 1043 1044 1045

	switch (p->action) {
	case XFRM_POLICY_ALLOW:
	case XFRM_POLICY_BLOCK:
		break;

	default:
		return -EINVAL;
1046
	}
L
Linus Torvalds 已提交
1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060

	switch (p->sel.family) {
	case AF_INET:
		break;

	case AF_INET6:
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
		break;
#else
		return  -EAFNOSUPPORT;
#endif

	default:
		return -EINVAL;
1061
	}
L
Linus Torvalds 已提交
1062 1063 1064 1065

	return verify_policy_dir(p->dir);
}

1066
static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
1067
{
1068
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1069 1070 1071 1072 1073
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

1074
	uctx = nla_data(rt);
1075
	return security_xfrm_policy_alloc(&pol->security, uctx);
1076 1077
}

L
Linus Torvalds 已提交
1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096
static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
			   int nr)
{
	int i;

	xp->xfrm_nr = nr;
	for (i = 0; i < nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];

		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
		memcpy(&t->saddr, &ut->saddr,
		       sizeof(xfrm_address_t));
		t->reqid = ut->reqid;
		t->mode = ut->mode;
		t->share = ut->share;
		t->optional = ut->optional;
		t->aalgos = ut->aalgos;
		t->ealgos = ut->ealgos;
		t->calgos = ut->calgos;
1097 1098
		/* If all masks are ~0, then we allow all algorithms. */
		t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1099
		t->encap_family = ut->family;
L
Linus Torvalds 已提交
1100 1101 1102
	}
}

1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129
static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
{
	int i;

	if (nr > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < nr; i++) {
		/* We never validated the ut->family value, so many
		 * applications simply leave it at zero.  The check was
		 * never made and ut->family was ignored because all
		 * templates could be assumed to have the same family as
		 * the policy itself.  Now that we will have ipv4-in-ipv6
		 * and ipv6-in-ipv4 tunnels, this is no longer true.
		 */
		if (!ut[i].family)
			ut[i].family = family;

		switch (ut[i].family) {
		case AF_INET:
			break;
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
		case AF_INET6:
			break;
#endif
		default:
			return -EINVAL;
1130
		}
1131 1132 1133 1134 1135
	}

	return 0;
}

1136
static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
L
Linus Torvalds 已提交
1137
{
1138
	struct nlattr *rt = attrs[XFRMA_TMPL];
L
Linus Torvalds 已提交
1139 1140 1141 1142

	if (!rt) {
		pol->xfrm_nr = 0;
	} else {
1143 1144
		struct xfrm_user_tmpl *utmpl = nla_data(rt);
		int nr = nla_len(rt) / sizeof(*utmpl);
1145
		int err;
L
Linus Torvalds 已提交
1146

1147 1148 1149
		err = validate_tmpl(nr, utmpl, pol->family);
		if (err)
			return err;
L
Linus Torvalds 已提交
1150

1151
		copy_templates(pol, utmpl, nr);
L
Linus Torvalds 已提交
1152 1153 1154 1155
	}
	return 0;
}

1156
static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
1157
{
1158
	struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1159
	struct xfrm_userpolicy_type *upt;
1160
	u8 type = XFRM_POLICY_TYPE_MAIN;
1161 1162 1163
	int err;

	if (rt) {
1164
		upt = nla_data(rt);
1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175
		type = upt->type;
	}

	err = verify_policy_type(type);
	if (err)
		return err;

	*tp = type;
	return 0;
}

L
Linus Torvalds 已提交
1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201
static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
{
	xp->priority = p->priority;
	xp->index = p->index;
	memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
	memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
	xp->action = p->action;
	xp->flags = p->flags;
	xp->family = p->sel.family;
	/* XXX xp->share = p->share; */
}

static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
{
	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
	p->priority = xp->priority;
	p->index = xp->index;
	p->sel.family = xp->family;
	p->dir = dir;
	p->action = xp->action;
	p->flags = xp->flags;
	p->share = XFRM_SHARE_ANY; /* XXX xp->share */
}

1202
static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
L
Linus Torvalds 已提交
1203
{
1204
	struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
L
Linus Torvalds 已提交
1205 1206 1207 1208 1209 1210 1211 1212
	int err;

	if (!xp) {
		*errp = -ENOMEM;
		return NULL;
	}

	copy_from_user_policy(xp, p);
1213

1214
	err = copy_from_user_policy_type(&xp->type, attrs);
1215 1216 1217
	if (err)
		goto error;

1218 1219
	if (!(err = copy_from_user_tmpl(xp, attrs)))
		err = copy_from_user_sec_ctx(xp, attrs);
1220 1221
	if (err)
		goto error;
L
Linus Torvalds 已提交
1222 1223

	return xp;
1224 1225
 error:
	*errp = err;
H
Herbert Xu 已提交
1226
	xp->walk.dead = 1;
1227
	xfrm_policy_destroy(xp);
1228
	return NULL;
L
Linus Torvalds 已提交
1229 1230
}

1231
static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1232
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1233
{
1234
	struct net *net = sock_net(skb->sk);
1235
	struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1236
	struct xfrm_policy *xp;
1237
	struct km_event c;
L
Linus Torvalds 已提交
1238 1239
	int err;
	int excl;
1240 1241 1242
	uid_t loginuid = NETLINK_CB(skb).loginuid;
	u32 sessionid = NETLINK_CB(skb).sessionid;
	u32 sid = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
1243 1244

	err = verify_newpolicy_info(p);
1245 1246
	if (err)
		return err;
1247
	err = verify_sec_ctx_len(attrs);
L
Linus Torvalds 已提交
1248 1249 1250
	if (err)
		return err;

1251
	xp = xfrm_policy_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
1252 1253 1254
	if (!xp)
		return err;

1255 1256 1257 1258
	/* shouldnt excl be based on nlh flags??
	 * Aha! this is anti-netlink really i.e  more pfkey derived
	 * in netlink excl is a flag and you wouldnt need
	 * a type XFRM_MSG_UPDPOLICY - JHS */
L
Linus Torvalds 已提交
1259 1260
	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
	err = xfrm_policy_insert(p->dir, xp, excl);
1261
	xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1262

L
Linus Torvalds 已提交
1263
	if (err) {
1264
		security_xfrm_policy_free(xp->security);
L
Linus Torvalds 已提交
1265 1266 1267 1268
		kfree(xp);
		return err;
	}

1269
	c.event = nlh->nlmsg_type;
1270 1271 1272 1273
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	km_policy_notify(xp, p->dir, &c);

L
Linus Torvalds 已提交
1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291
	xfrm_pol_put(xp);

	return 0;
}

static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
{
	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
	int i;

	if (xp->xfrm_nr == 0)
		return 0;

	for (i = 0; i < xp->xfrm_nr; i++) {
		struct xfrm_user_tmpl *up = &vec[i];
		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];

		memcpy(&up->id, &kp->id, sizeof(up->id));
1292
		up->family = kp->encap_family;
L
Linus Torvalds 已提交
1293 1294 1295 1296 1297 1298 1299 1300 1301
		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
		up->reqid = kp->reqid;
		up->mode = kp->mode;
		up->share = kp->share;
		up->optional = kp->optional;
		up->aalgos = kp->aalgos;
		up->ealgos = kp->ealgos;
		up->calgos = kp->calgos;
	}
1302

1303 1304
	return nla_put(skb, XFRMA_TMPL,
		       sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
1305 1306 1307 1308 1309 1310
}

static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
{
	if (x->security) {
		return copy_sec_ctx(x->security, skb);
1311 1312
	}
	return 0;
1313
}
1314

1315 1316 1317 1318 1319 1320
static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
{
	if (xp->security) {
		return copy_sec_ctx(xp->security, skb);
	}
	return 0;
1321
}
1322 1323 1324 1325 1326 1327 1328 1329
static inline size_t userpolicy_type_attrsize(void)
{
#ifdef CONFIG_XFRM_SUB_POLICY
	return nla_total_size(sizeof(struct xfrm_userpolicy_type));
#else
	return 0;
#endif
}
1330

1331
#ifdef CONFIG_XFRM_SUB_POLICY
1332
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1333
{
1334 1335 1336
	struct xfrm_userpolicy_type upt = {
		.type = type,
	};
1337

1338
	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1339 1340 1341
}

#else
1342
static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1343 1344 1345 1346 1347
{
	return 0;
}
#endif

L
Linus Torvalds 已提交
1348 1349 1350 1351 1352 1353 1354 1355
static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct xfrm_userpolicy_info *p;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct nlmsghdr *nlh;

1356 1357 1358 1359
	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
1360

1361
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1362 1363 1364
	copy_to_user_policy(xp, p, dir);
	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
1365 1366
	if (copy_to_user_sec_ctx(xp, skb))
		goto nlmsg_failure;
1367
	if (copy_to_user_policy_type(xp->type, skb) < 0)
1368
		goto nlmsg_failure;
L
Linus Torvalds 已提交
1369

1370
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
1371 1372 1373
	return 0;

nlmsg_failure:
1374 1375
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
1376 1377
}

1378 1379 1380 1381 1382 1383 1384 1385
static int xfrm_dump_policy_done(struct netlink_callback *cb)
{
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];

	xfrm_policy_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
1386 1387
static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
{
1388
	struct net *net = sock_net(skb->sk);
1389
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
L
Linus Torvalds 已提交
1390 1391
	struct xfrm_dump_info info;

1392 1393 1394
	BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
1395 1396 1397 1398
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
1399 1400 1401 1402 1403 1404

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
	}

1405
	(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
L
Linus Torvalds 已提交
1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416

	return skb->len;
}

static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
					  struct xfrm_policy *xp,
					  int dir, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;

1417
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
L
Linus Torvalds 已提交
1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

	if (dump_one_policy(xp, dir, 0, &info) < 0) {
		kfree_skb(skb);
		return NULL;
	}

	return skb;
}

1434
static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1435
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1436
{
1437
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1438 1439
	struct xfrm_policy *xp;
	struct xfrm_userpolicy_id *p;
1440
	u8 type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
1441
	int err;
1442
	struct km_event c;
L
Linus Torvalds 已提交
1443 1444
	int delete;

1445
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1446 1447
	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;

1448
	err = copy_from_user_policy_type(&type, attrs);
1449 1450 1451
	if (err)
		return err;

L
Linus Torvalds 已提交
1452 1453 1454 1455 1456
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

	if (p->index)
1457
		xp = xfrm_policy_byid(net, type, p->dir, p->index, delete, &err);
1458
	else {
1459
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1460
		struct xfrm_sec_ctx *ctx;
1461

1462
		err = verify_sec_ctx_len(attrs);
1463 1464 1465
		if (err)
			return err;

1466
		ctx = NULL;
1467
		if (rt) {
1468
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1469

1470 1471
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1472
				return err;
1473
		}
1474
		xp = xfrm_policy_bysel_ctx(net, type, p->dir, &p->sel, ctx,
1475
					   delete, &err);
1476
		security_xfrm_policy_free(ctx);
1477
	}
L
Linus Torvalds 已提交
1478 1479 1480 1481 1482 1483 1484 1485 1486 1487
	if (xp == NULL)
		return -ENOENT;

	if (!delete) {
		struct sk_buff *resp_skb;

		resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
		if (IS_ERR(resp_skb)) {
			err = PTR_ERR(resp_skb);
		} else {
1488
			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
1489
					    NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1490
		}
1491
	} else {
1492 1493 1494 1495 1496 1497
		uid_t loginuid = NETLINK_CB(skb).loginuid;
		u32 sessionid = NETLINK_CB(skb).sessionid;
		u32 sid = NETLINK_CB(skb).sid;

		xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
					 sid);
1498 1499

		if (err != 0)
C
Catherine Zhang 已提交
1500
			goto out;
1501

1502
		c.data.byid = p->index;
1503
		c.event = nlh->nlmsg_type;
1504 1505 1506
		c.seq = nlh->nlmsg_seq;
		c.pid = nlh->nlmsg_pid;
		km_policy_notify(xp, p->dir, &c);
L
Linus Torvalds 已提交
1507 1508
	}

C
Catherine Zhang 已提交
1509
out:
1510
	xfrm_pol_put(xp);
L
Linus Torvalds 已提交
1511 1512 1513
	return err;
}

1514
static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1515
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1516
{
1517
	struct net *net = sock_net(skb->sk);
1518
	struct km_event c;
1519
	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
J
Joy Latten 已提交
1520
	struct xfrm_audit audit_info;
1521
	int err;
L
Linus Torvalds 已提交
1522

J
Joy Latten 已提交
1523
	audit_info.loginuid = NETLINK_CB(skb).loginuid;
1524
	audit_info.sessionid = NETLINK_CB(skb).sessionid;
J
Joy Latten 已提交
1525
	audit_info.secid = NETLINK_CB(skb).sid;
1526
	err = xfrm_state_flush(net, p->proto, &audit_info);
1527
	if (err)
1528
		return 0;
1529
	c.data.proto = p->proto;
1530
	c.event = nlh->nlmsg_type;
1531 1532
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1533
	c.net = net;
1534 1535
	km_state_notify(NULL, &c);

L
Linus Torvalds 已提交
1536 1537 1538
	return 0;
}

1539 1540 1541 1542 1543 1544 1545 1546
static inline size_t xfrm_aevent_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
	       + nla_total_size(sizeof(struct xfrm_replay_state))
	       + nla_total_size(sizeof(struct xfrm_lifetime_cur))
	       + nla_total_size(4) /* XFRM_AE_RTHR */
	       + nla_total_size(4); /* XFRM_AE_ETHR */
}
J
Jamal Hadi Salim 已提交
1547 1548 1549 1550 1551 1552

static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
{
	struct xfrm_aevent_id *id;
	struct nlmsghdr *nlh;

1553 1554 1555
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
J
Jamal Hadi Salim 已提交
1556

1557
	id = nlmsg_data(nlh);
1558
	memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
J
Jamal Hadi Salim 已提交
1559 1560 1561
	id->sa_id.spi = x->id.spi;
	id->sa_id.family = x->props.family;
	id->sa_id.proto = x->id.proto;
1562 1563
	memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
	id->reqid = x->props.reqid;
J
Jamal Hadi Salim 已提交
1564 1565
	id->flags = c->data.aevent;

1566 1567
	NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
	NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
J
Jamal Hadi Salim 已提交
1568

1569 1570
	if (id->flags & XFRM_AE_RTHR)
		NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
J
Jamal Hadi Salim 已提交
1571

1572 1573 1574
	if (id->flags & XFRM_AE_ETHR)
		NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
			    x->replay_maxage * 10 / HZ);
J
Jamal Hadi Salim 已提交
1575

1576
	return nlmsg_end(skb, nlh);
J
Jamal Hadi Salim 已提交
1577

1578
nla_put_failure:
1579 1580
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
J
Jamal Hadi Salim 已提交
1581 1582
}

1583
static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1584
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1585
{
1586
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1587 1588 1589 1590
	struct xfrm_state *x;
	struct sk_buff *r_skb;
	int err;
	struct km_event c;
1591
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
1592 1593
	struct xfrm_usersa_id *id = &p->sa_id;

1594
	r_skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
1595 1596 1597
	if (r_skb == NULL)
		return -ENOMEM;

1598
	x = xfrm_state_lookup(net, &id->daddr, id->spi, id->proto, id->family);
J
Jamal Hadi Salim 已提交
1599
	if (x == NULL) {
P
Patrick McHardy 已提交
1600
		kfree_skb(r_skb);
J
Jamal Hadi Salim 已提交
1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615
		return -ESRCH;
	}

	/*
	 * XXX: is this lock really needed - none of the other
	 * gets lock (the concern is things getting updated
	 * while we are still reading) - jhs
	*/
	spin_lock_bh(&x->lock);
	c.data.aevent = p->flags;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;

	if (build_aevent(r_skb, x, &c) < 0)
		BUG();
1616
	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).pid);
J
Jamal Hadi Salim 已提交
1617 1618 1619 1620 1621
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1622
static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1623
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1624
{
1625
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1626 1627 1628
	struct xfrm_state *x;
	struct km_event c;
	int err = - EINVAL;
1629
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
1630 1631
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
J
Jamal Hadi Salim 已提交
1632 1633 1634 1635 1636 1637 1638 1639

	if (!lt && !rp)
		return err;

	/* pedantic mode - thou shalt sayeth replaceth */
	if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
		return err;

1640
	x = xfrm_state_lookup(net, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
J
Jamal Hadi Salim 已提交
1641 1642 1643 1644 1645 1646 1647
	if (x == NULL)
		return -ESRCH;

	if (x->km.state != XFRM_STATE_VALID)
		goto out;

	spin_lock_bh(&x->lock);
1648
	xfrm_update_ae_params(x, attrs);
J
Jamal Hadi Salim 已提交
1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661
	spin_unlock_bh(&x->lock);

	c.event = nlh->nlmsg_type;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	c.data.aevent = XFRM_AE_CU;
	km_state_notify(x, &c);
	err = 0;
out:
	xfrm_state_put(x);
	return err;
}

1662
static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1663
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1664
{
1665
	struct net *net = sock_net(skb->sk);
1666
	struct km_event c;
1667
	u8 type = XFRM_POLICY_TYPE_MAIN;
1668
	int err;
J
Joy Latten 已提交
1669
	struct xfrm_audit audit_info;
1670

1671
	err = copy_from_user_policy_type(&type, attrs);
1672 1673
	if (err)
		return err;
1674

J
Joy Latten 已提交
1675
	audit_info.loginuid = NETLINK_CB(skb).loginuid;
1676
	audit_info.sessionid = NETLINK_CB(skb).sessionid;
J
Joy Latten 已提交
1677
	audit_info.secid = NETLINK_CB(skb).sid;
1678
	err = xfrm_policy_flush(net, type, &audit_info);
1679
	if (err)
1680
		return 0;
1681
	c.data.type = type;
1682
	c.event = nlh->nlmsg_type;
1683 1684
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1685
	c.net = net;
1686
	km_policy_notify(NULL, 0, &c);
L
Linus Torvalds 已提交
1687 1688 1689
	return 0;
}

1690
static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1691
		struct nlattr **attrs)
1692
{
1693
	struct net *net = sock_net(skb->sk);
1694
	struct xfrm_policy *xp;
1695
	struct xfrm_user_polexpire *up = nlmsg_data(nlh);
1696
	struct xfrm_userpolicy_info *p = &up->pol;
1697
	u8 type = XFRM_POLICY_TYPE_MAIN;
1698 1699
	int err = -ENOENT;

1700
	err = copy_from_user_policy_type(&type, attrs);
1701 1702 1703
	if (err)
		return err;

1704
	if (p->index)
1705
		xp = xfrm_policy_byid(net, type, p->dir, p->index, 0, &err);
1706
	else {
1707
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1708
		struct xfrm_sec_ctx *ctx;
1709

1710
		err = verify_sec_ctx_len(attrs);
1711 1712 1713
		if (err)
			return err;

1714
		ctx = NULL;
1715
		if (rt) {
1716
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1717

1718 1719
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1720
				return err;
1721
		}
1722
		xp = xfrm_policy_bysel_ctx(net, type, p->dir, &p->sel, ctx, 0, &err);
1723
		security_xfrm_policy_free(ctx);
1724 1725
	}
	if (xp == NULL)
1726
		return -ENOENT;
1727

1728
	read_lock(&xp->lock);
H
Herbert Xu 已提交
1729
	if (xp->walk.dead) {
1730 1731 1732 1733 1734 1735 1736
		read_unlock(&xp->lock);
		goto out;
	}

	read_unlock(&xp->lock);
	err = 0;
	if (up->hard) {
1737 1738 1739
		uid_t loginuid = NETLINK_CB(skb).loginuid;
		uid_t sessionid = NETLINK_CB(skb).sessionid;
		u32 sid = NETLINK_CB(skb).sid;
1740
		xfrm_policy_delete(xp, p->dir);
1741
		xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1742

1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753
	} else {
		// reset the timers here?
		printk("Dont know what to do with soft policy expire\n");
	}
	km_policy_expired(xp, p->dir, up->hard, current->pid);

out:
	xfrm_pol_put(xp);
	return err;
}

1754
static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1755
		struct nlattr **attrs)
1756
{
1757
	struct net *net = sock_net(skb->sk);
1758 1759
	struct xfrm_state *x;
	int err;
1760
	struct xfrm_user_expire *ue = nlmsg_data(nlh);
1761 1762
	struct xfrm_usersa_info *p = &ue->state;

1763
	x = xfrm_state_lookup(net, &p->id.daddr, p->id.spi, p->id.proto, p->family);
1764

1765
	err = -ENOENT;
1766 1767 1768 1769
	if (x == NULL)
		return err;

	spin_lock_bh(&x->lock);
1770
	err = -EINVAL;
1771 1772 1773 1774
	if (x->km.state != XFRM_STATE_VALID)
		goto out;
	km_state_expired(x, ue->hard, current->pid);

J
Joy Latten 已提交
1775
	if (ue->hard) {
1776 1777 1778
		uid_t loginuid = NETLINK_CB(skb).loginuid;
		uid_t sessionid = NETLINK_CB(skb).sessionid;
		u32 sid = NETLINK_CB(skb).sid;
1779
		__xfrm_state_delete(x);
1780
		xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1781
	}
1782
	err = 0;
1783 1784 1785 1786 1787 1788
out:
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1789
static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
1790
		struct nlattr **attrs)
1791
{
1792
	struct net *net = sock_net(skb->sk);
1793 1794 1795
	struct xfrm_policy *xp;
	struct xfrm_user_tmpl *ut;
	int i;
1796
	struct nlattr *rt = attrs[XFRMA_TMPL];
1797

1798
	struct xfrm_user_acquire *ua = nlmsg_data(nlh);
1799
	struct xfrm_state *x = xfrm_state_alloc(net);
1800 1801 1802
	int err = -ENOMEM;

	if (!x)
I
Ilpo Järvinen 已提交
1803
		goto nomem;
1804 1805

	err = verify_newpolicy_info(&ua->policy);
I
Ilpo Järvinen 已提交
1806 1807
	if (err)
		goto bad_policy;
1808 1809

	/*   build an XP */
1810
	xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
I
Ilpo Järvinen 已提交
1811 1812
	if (!xp)
		goto free_state;
1813 1814 1815 1816 1817

	memcpy(&x->id, &ua->id, sizeof(ua->id));
	memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
	memcpy(&x->sel, &ua->sel, sizeof(ua->sel));

1818
	ut = nla_data(rt);
1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836
	/* extract the templates and for each call km_key */
	for (i = 0; i < xp->xfrm_nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
		memcpy(&x->id, &t->id, sizeof(x->id));
		x->props.mode = t->mode;
		x->props.reqid = t->reqid;
		x->props.family = ut->family;
		t->aalgos = ua->aalgos;
		t->ealgos = ua->ealgos;
		t->calgos = ua->calgos;
		err = km_query(x, t, xp);

	}

	kfree(x);
	kfree(xp);

	return 0;
I
Ilpo Järvinen 已提交
1837 1838 1839 1840 1841 1842 1843

bad_policy:
	printk("BAD policy passed\n");
free_state:
	kfree(x);
nomem:
	return err;
1844 1845
}

1846 1847
#ifdef CONFIG_XFRM_MIGRATE
static int copy_from_user_migrate(struct xfrm_migrate *ma,
1848
				  struct xfrm_kmaddress *k,
1849
				  struct nlattr **attrs, int *num)
1850
{
1851
	struct nlattr *rt = attrs[XFRMA_MIGRATE];
1852 1853 1854
	struct xfrm_user_migrate *um;
	int i, num_migrate;

1855 1856 1857 1858 1859 1860 1861 1862 1863 1864
	if (k != NULL) {
		struct xfrm_user_kmaddress *uk;

		uk = nla_data(attrs[XFRMA_KMADDRESS]);
		memcpy(&k->local, &uk->local, sizeof(k->local));
		memcpy(&k->remote, &uk->remote, sizeof(k->remote));
		k->family = uk->family;
		k->reserved = uk->reserved;
	}

1865 1866
	um = nla_data(rt);
	num_migrate = nla_len(rt) / sizeof(*um);
1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889

	if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < num_migrate; i++, um++, ma++) {
		memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
		memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
		memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
		memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));

		ma->proto = um->proto;
		ma->mode = um->mode;
		ma->reqid = um->reqid;

		ma->old_family = um->old_family;
		ma->new_family = um->new_family;
	}

	*num = i;
	return 0;
}

static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
1890
			   struct nlattr **attrs)
1891
{
1892
	struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
1893
	struct xfrm_migrate m[XFRM_MAX_DEPTH];
1894
	struct xfrm_kmaddress km, *kmp;
1895 1896 1897 1898
	u8 type;
	int err;
	int n = 0;

1899
	if (attrs[XFRMA_MIGRATE] == NULL)
1900
		return -EINVAL;
1901

1902 1903
	kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;

1904
	err = copy_from_user_policy_type(&type, attrs);
1905 1906 1907
	if (err)
		return err;

1908
	err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
1909 1910 1911 1912 1913 1914
	if (err)
		return err;

	if (!n)
		return 0;

1915
	xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
1916 1917 1918 1919 1920

	return 0;
}
#else
static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
1921
			   struct nlattr **attrs)
1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942
{
	return -ENOPROTOOPT;
}
#endif

#ifdef CONFIG_XFRM_MIGRATE
static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb)
{
	struct xfrm_user_migrate um;

	memset(&um, 0, sizeof(um));
	um.proto = m->proto;
	um.mode = m->mode;
	um.reqid = m->reqid;
	um.old_family = m->old_family;
	memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
	memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
	um.new_family = m->new_family;
	memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
	memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));

1943
	return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
1944 1945
}

1946 1947 1948 1949 1950 1951 1952 1953
static int copy_to_user_kmaddress(struct xfrm_kmaddress *k, struct sk_buff *skb)
{
	struct xfrm_user_kmaddress uk;

	memset(&uk, 0, sizeof(uk));
	uk.family = k->family;
	uk.reserved = k->reserved;
	memcpy(&uk.local, &k->local, sizeof(uk.local));
1954
	memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
1955 1956 1957 1958 1959

	return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
}

static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
1960 1961
{
	return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
1962 1963 1964
	      + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
	      + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
	      + userpolicy_type_attrsize();
1965 1966
}

1967
static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
1968 1969
			 int num_migrate, struct xfrm_kmaddress *k,
			 struct xfrm_selector *sel, u8 dir, u8 type)
1970 1971 1972 1973 1974 1975
{
	struct xfrm_migrate *mp;
	struct xfrm_userpolicy_id *pol_id;
	struct nlmsghdr *nlh;
	int i;

1976 1977 1978
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
1979

1980
	pol_id = nlmsg_data(nlh);
1981 1982 1983 1984 1985
	/* copy data from selector, dir, and type to the pol_id */
	memset(pol_id, 0, sizeof(*pol_id));
	memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
	pol_id->dir = dir;

1986 1987 1988
	if (k != NULL && (copy_to_user_kmaddress(k, skb) < 0))
			goto nlmsg_failure;

1989 1990 1991 1992 1993 1994 1995 1996
	if (copy_to_user_policy_type(type, skb) < 0)
		goto nlmsg_failure;

	for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
		if (copy_to_user_migrate(mp, skb) < 0)
			goto nlmsg_failure;
	}

1997
	return nlmsg_end(skb, nlh);
1998
nlmsg_failure:
1999 2000
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
2001 2002 2003
}

static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2004 2005
			     struct xfrm_migrate *m, int num_migrate,
			     struct xfrm_kmaddress *k)
2006
{
2007
	struct net *net = &init_net;
2008 2009
	struct sk_buff *skb;

2010
	skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
2011 2012 2013 2014
	if (skb == NULL)
		return -ENOMEM;

	/* build migrate */
2015
	if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
2016 2017
		BUG();

2018
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
2019 2020 2021
}
#else
static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2022 2023
			     struct xfrm_migrate *m, int num_migrate,
			     struct xfrm_kmaddress *k)
2024 2025 2026 2027
{
	return -ENOPROTOOPT;
}
#endif
J
Jamal Hadi Salim 已提交
2028

2029
#define XMSGSIZE(type) sizeof(struct type)
2030 2031

static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
2032
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2033 2034 2035 2036 2037 2038
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
2039
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
2040
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
2041
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2042
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2043
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
2044
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
2045
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
J
Jamal Hadi Salim 已提交
2046 2047
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2048
	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
2049
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2050 2051
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
L
Linus Torvalds 已提交
2052 2053
};

2054 2055
#undef XMSGSIZE

2056
static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
J
jamal 已提交
2057 2058 2059 2060
	[XFRMA_SA]		= { .len = sizeof(struct xfrm_usersa_info)},
	[XFRMA_POLICY]		= { .len = sizeof(struct xfrm_userpolicy_info)},
	[XFRMA_LASTUSED]	= { .type = NLA_U64},
	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
2061
	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075
	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_sec_ctx) },
	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
2076
	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
2077 2078
};

L
Linus Torvalds 已提交
2079
static struct xfrm_link {
2080
	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
L
Linus Torvalds 已提交
2081
	int (*dump)(struct sk_buff *, struct netlink_callback *);
2082
	int (*done)(struct netlink_callback *);
2083 2084 2085 2086
} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
2087 2088
						   .dump = xfrm_dump_sa,
						   .done = xfrm_dump_sa_done  },
2089 2090 2091
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
2092 2093
						   .dump = xfrm_dump_policy,
						   .done = xfrm_dump_policy_done },
2094
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
2095
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
2096
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
2097 2098
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
2099
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
2100 2101
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
J
Jamal Hadi Salim 已提交
2102 2103
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = { .doit = xfrm_new_ae  },
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = { .doit = xfrm_get_ae  },
2104
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate    },
2105
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo   },
J
Jamal Hadi Salim 已提交
2106
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo   },
L
Linus Torvalds 已提交
2107 2108
};

2109
static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
2110
{
2111
	struct net *net = sock_net(skb->sk);
2112
	struct nlattr *attrs[XFRMA_MAX+1];
L
Linus Torvalds 已提交
2113
	struct xfrm_link *link;
2114
	int type, err;
L
Linus Torvalds 已提交
2115 2116 2117

	type = nlh->nlmsg_type;
	if (type > XFRM_MSG_MAX)
2118
		return -EINVAL;
L
Linus Torvalds 已提交
2119 2120 2121 2122 2123

	type -= XFRM_MSG_BASE;
	link = &xfrm_dispatch[type];

	/* All operations require privileges, even GET */
2124 2125
	if (security_netlink_recv(skb, CAP_NET_ADMIN))
		return -EPERM;
L
Linus Torvalds 已提交
2126

2127 2128 2129
	if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
	     type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
	    (nlh->nlmsg_flags & NLM_F_DUMP)) {
L
Linus Torvalds 已提交
2130
		if (link->dump == NULL)
2131
			return -EINVAL;
2132

2133
		return netlink_dump_start(net->xfrm.nlsk, skb, nlh, link->dump, link->done);
L
Linus Torvalds 已提交
2134 2135
	}

2136
	err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
2137
			  xfrma_policy);
2138 2139
	if (err < 0)
		return err;
L
Linus Torvalds 已提交
2140 2141

	if (link->doit == NULL)
2142
		return -EINVAL;
L
Linus Torvalds 已提交
2143

2144
	return link->doit(skb, nlh, attrs);
L
Linus Torvalds 已提交
2145 2146
}

2147
static void xfrm_netlink_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
2148
{
2149 2150 2151
	mutex_lock(&xfrm_cfg_mutex);
	netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
	mutex_unlock(&xfrm_cfg_mutex);
L
Linus Torvalds 已提交
2152 2153
}

2154 2155 2156 2157 2158
static inline size_t xfrm_expire_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire));
}

J
Jamal Hadi Salim 已提交
2159
static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
L
Linus Torvalds 已提交
2160 2161 2162 2163
{
	struct xfrm_user_expire *ue;
	struct nlmsghdr *nlh;

2164 2165 2166
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2167

2168
	ue = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2169
	copy_to_user_state(x, &ue->state);
J
Jamal Hadi Salim 已提交
2170
	ue->hard = (c->data.hard != 0) ? 1 : 0;
L
Linus Torvalds 已提交
2171

2172
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2173 2174
}

2175
static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
L
Linus Torvalds 已提交
2176
{
2177
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2178 2179
	struct sk_buff *skb;

2180
	skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
L
Linus Torvalds 已提交
2181 2182 2183
	if (skb == NULL)
		return -ENOMEM;

J
Jamal Hadi Salim 已提交
2184
	if (build_expire(skb, x, c) < 0)
L
Linus Torvalds 已提交
2185 2186
		BUG();

2187
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2188 2189
}

J
Jamal Hadi Salim 已提交
2190 2191
static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c)
{
2192
	struct net *net = xs_net(x);
J
Jamal Hadi Salim 已提交
2193 2194
	struct sk_buff *skb;

2195
	skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2196 2197 2198 2199 2200 2201
	if (skb == NULL)
		return -ENOMEM;

	if (build_aevent(skb, x, c) < 0)
		BUG();

2202
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2203 2204
}

2205 2206
static int xfrm_notify_sa_flush(struct km_event *c)
{
2207
	struct net *net = c->net;
2208 2209 2210
	struct xfrm_usersa_flush *p;
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2211
	int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
2212

2213
	skb = nlmsg_new(len, GFP_ATOMIC);
2214 2215 2216
	if (skb == NULL)
		return -ENOMEM;

2217 2218 2219 2220 2221
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
	if (nlh == NULL) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
2222

2223
	p = nlmsg_data(nlh);
2224
	p->proto = c->data.proto;
2225

2226
	nlmsg_end(skb, nlh);
2227

2228
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2229 2230
}

2231
static inline size_t xfrm_sa_len(struct xfrm_state *x)
2232
{
2233
	size_t l = 0;
2234 2235
	if (x->aead)
		l += nla_total_size(aead_len(x->aead));
2236 2237 2238 2239 2240
	if (x->aalg) {
		l += nla_total_size(sizeof(struct xfrm_algo) +
				    (x->aalg->alg_key_len + 7) / 8);
		l += nla_total_size(xfrm_alg_auth_len(x->aalg));
	}
2241
	if (x->ealg)
2242
		l += nla_total_size(xfrm_alg_len(x->ealg));
2243
	if (x->calg)
2244
		l += nla_total_size(sizeof(*x->calg));
2245
	if (x->encap)
2246
		l += nla_total_size(sizeof(*x->encap));
2247 2248 2249 2250 2251 2252
	if (x->security)
		l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
				    x->security->ctx_len);
	if (x->coaddr)
		l += nla_total_size(sizeof(*x->coaddr));

2253 2254
	/* Must count x->lastused as it may become non-zero behind our back. */
	l += nla_total_size(sizeof(u64));
2255 2256 2257 2258 2259 2260

	return l;
}

static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
{
2261
	struct net *net = xs_net(x);
2262
	struct xfrm_usersa_info *p;
2263
	struct xfrm_usersa_id *id;
2264 2265 2266
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
	int len = xfrm_sa_len(x);
2267 2268 2269 2270
	int headlen;

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELSA) {
2271
		len += nla_total_size(headlen);
2272 2273
		headlen = sizeof(*id);
	}
2274
	len += NLMSG_ALIGN(headlen);
2275

2276
	skb = nlmsg_new(len, GFP_ATOMIC);
2277 2278 2279
	if (skb == NULL)
		return -ENOMEM;

2280 2281
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
	if (nlh == NULL)
2282
		goto nla_put_failure;
2283

2284
	p = nlmsg_data(nlh);
2285
	if (c->event == XFRM_MSG_DELSA) {
2286 2287
		struct nlattr *attr;

2288
		id = nlmsg_data(nlh);
2289 2290 2291 2292 2293
		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
		id->spi = x->id.spi;
		id->family = x->props.family;
		id->proto = x->id.proto;

2294 2295 2296 2297 2298
		attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
		if (attr == NULL)
			goto nla_put_failure;

		p = nla_data(attr);
2299 2300
	}

2301 2302
	if (copy_to_user_state_extra(x, p, skb))
		goto nla_put_failure;
2303

2304
	nlmsg_end(skb, nlh);
2305

2306
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2307

2308
nla_put_failure:
2309 2310
	/* Somebody screwed up with xfrm_sa_len! */
	WARN_ON(1);
2311 2312 2313 2314 2315 2316 2317 2318
	kfree_skb(skb);
	return -1;
}

static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c)
{

	switch (c->event) {
2319
	case XFRM_MSG_EXPIRE:
2320
		return xfrm_exp_state_notify(x, c);
J
Jamal Hadi Salim 已提交
2321 2322
	case XFRM_MSG_NEWAE:
		return xfrm_aevent_state_notify(x, c);
2323 2324 2325
	case XFRM_MSG_DELSA:
	case XFRM_MSG_UPDSA:
	case XFRM_MSG_NEWSA:
2326
		return xfrm_notify_sa(x, c);
2327
	case XFRM_MSG_FLUSHSA:
2328 2329 2330 2331 2332 2333 2334 2335 2336 2337
		return xfrm_notify_sa_flush(c);
	default:
		 printk("xfrm_user: Unknown SA event %d\n", c->event);
		 break;
	}

	return 0;

}

2338 2339 2340 2341 2342 2343 2344 2345 2346
static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
					  struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2347 2348 2349 2350 2351 2352 2353 2354
static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
			 struct xfrm_tmpl *xt, struct xfrm_policy *xp,
			 int dir)
{
	struct xfrm_user_acquire *ua;
	struct nlmsghdr *nlh;
	__u32 seq = xfrm_get_acqseq();

2355 2356 2357
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2358

2359
	ua = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370
	memcpy(&ua->id, &x->id, sizeof(ua->id));
	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
	copy_to_user_policy(xp, &ua->policy, dir);
	ua->aalgos = xt->aalgos;
	ua->ealgos = xt->ealgos;
	ua->calgos = xt->calgos;
	ua->seq = x->km.seq = seq;

	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
2371
	if (copy_to_user_state_sec_ctx(x, skb))
2372
		goto nlmsg_failure;
2373
	if (copy_to_user_policy_type(xp->type, skb) < 0)
2374
		goto nlmsg_failure;
L
Linus Torvalds 已提交
2375

2376
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2377 2378

nlmsg_failure:
2379 2380
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
2381 2382 2383 2384 2385
}

static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
			     struct xfrm_policy *xp, int dir)
{
2386
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2387 2388
	struct sk_buff *skb;

2389
	skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2390 2391 2392 2393 2394 2395
	if (skb == NULL)
		return -ENOMEM;

	if (build_acquire(skb, x, xt, xp, dir) < 0)
		BUG();

2396
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2397 2398 2399 2400 2401
}

/* User gives us xfrm_user_policy_info followed by an array of 0
 * or more templates.
 */
2402
static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
L
Linus Torvalds 已提交
2403 2404
					       u8 *data, int len, int *dir)
{
2405
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
2406 2407 2408 2409 2410
	struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
	struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
	struct xfrm_policy *xp;
	int nr;

2411
	switch (sk->sk_family) {
L
Linus Torvalds 已提交
2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437
	case AF_INET:
		if (opt != IP_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
	case AF_INET6:
		if (opt != IPV6_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
#endif
	default:
		*dir = -EINVAL;
		return NULL;
	}

	*dir = -EINVAL;

	if (len < sizeof(*p) ||
	    verify_newpolicy_info(p))
		return NULL;

	nr = ((len - sizeof(*p)) / sizeof(*ut));
2438
	if (validate_tmpl(nr, ut, p->sel.family))
L
Linus Torvalds 已提交
2439 2440
		return NULL;

2441 2442 2443
	if (p->dir > XFRM_POLICY_OUT)
		return NULL;

2444
	xp = xfrm_policy_alloc(net, GFP_KERNEL);
L
Linus Torvalds 已提交
2445 2446 2447 2448 2449 2450
	if (xp == NULL) {
		*dir = -ENOBUFS;
		return NULL;
	}

	copy_from_user_policy(xp, p);
2451
	xp->type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
2452 2453 2454 2455 2456 2457 2458
	copy_templates(xp, ut, nr);

	*dir = p->dir;

	return xp;
}

2459 2460 2461 2462 2463 2464 2465 2466
static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2467
static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
J
Jamal Hadi Salim 已提交
2468
			   int dir, struct km_event *c)
L
Linus Torvalds 已提交
2469 2470 2471
{
	struct xfrm_user_polexpire *upe;
	struct nlmsghdr *nlh;
J
Jamal Hadi Salim 已提交
2472
	int hard = c->data.hard;
L
Linus Torvalds 已提交
2473

2474 2475 2476
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2477

2478
	upe = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2479 2480 2481
	copy_to_user_policy(xp, &upe->pol, dir);
	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
2482 2483
	if (copy_to_user_sec_ctx(xp, skb))
		goto nlmsg_failure;
2484
	if (copy_to_user_policy_type(xp->type, skb) < 0)
2485
		goto nlmsg_failure;
L
Linus Torvalds 已提交
2486 2487
	upe->hard = !!hard;

2488
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2489 2490

nlmsg_failure:
2491 2492
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
2493 2494
}

2495
static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
L
Linus Torvalds 已提交
2496
{
2497
	struct net *net = xp_net(xp);
L
Linus Torvalds 已提交
2498 2499
	struct sk_buff *skb;

2500
	skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2501 2502 2503
	if (skb == NULL)
		return -ENOMEM;

J
Jamal Hadi Salim 已提交
2504
	if (build_polexpire(skb, xp, dir, c) < 0)
L
Linus Torvalds 已提交
2505 2506
		BUG();

2507
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2508 2509
}

2510 2511
static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
{
2512
	struct net *net = xp_net(xp);
2513
	struct xfrm_userpolicy_info *p;
2514
	struct xfrm_userpolicy_id *id;
2515 2516
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2517
	int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2518 2519 2520 2521
	int headlen;

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELPOLICY) {
2522
		len += nla_total_size(headlen);
2523 2524
		headlen = sizeof(*id);
	}
2525
	len += userpolicy_type_attrsize();
2526
	len += NLMSG_ALIGN(headlen);
2527

2528
	skb = nlmsg_new(len, GFP_ATOMIC);
2529 2530 2531
	if (skb == NULL)
		return -ENOMEM;

2532 2533 2534
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
	if (nlh == NULL)
		goto nlmsg_failure;
2535

2536
	p = nlmsg_data(nlh);
2537
	if (c->event == XFRM_MSG_DELPOLICY) {
2538 2539
		struct nlattr *attr;

2540
		id = nlmsg_data(nlh);
2541 2542 2543 2544 2545 2546 2547
		memset(id, 0, sizeof(*id));
		id->dir = dir;
		if (c->data.byid)
			id->index = xp->index;
		else
			memcpy(&id->sel, &xp->selector, sizeof(id->sel));

2548 2549 2550 2551 2552
		attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
		if (attr == NULL)
			goto nlmsg_failure;

		p = nla_data(attr);
2553
	}
2554 2555 2556 2557

	copy_to_user_policy(xp, p, dir);
	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
2558
	if (copy_to_user_policy_type(xp->type, skb) < 0)
2559
		goto nlmsg_failure;
2560

2561
	nlmsg_end(skb, nlh);
2562

2563
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2564 2565 2566 2567 2568 2569 2570 2571

nlmsg_failure:
	kfree_skb(skb);
	return -1;
}

static int xfrm_notify_policy_flush(struct km_event *c)
{
2572
	struct net *net = c->net;
2573 2574 2575
	struct nlmsghdr *nlh;
	struct sk_buff *skb;

2576
	skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
2577 2578 2579
	if (skb == NULL)
		return -ENOMEM;

2580 2581 2582
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
	if (nlh == NULL)
		goto nlmsg_failure;
2583 2584
	if (copy_to_user_policy_type(c->data.type, skb) < 0)
		goto nlmsg_failure;
2585

2586
	nlmsg_end(skb, nlh);
2587

2588
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2589 2590 2591 2592 2593 2594 2595 2596 2597 2598

nlmsg_failure:
	kfree_skb(skb);
	return -1;
}

static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
{

	switch (c->event) {
2599 2600 2601
	case XFRM_MSG_NEWPOLICY:
	case XFRM_MSG_UPDPOLICY:
	case XFRM_MSG_DELPOLICY:
2602
		return xfrm_notify_policy(xp, dir, c);
2603
	case XFRM_MSG_FLUSHPOLICY:
2604
		return xfrm_notify_policy_flush(c);
2605
	case XFRM_MSG_POLEXPIRE:
2606 2607 2608 2609 2610 2611 2612 2613 2614
		return xfrm_exp_policy_notify(xp, dir, c);
	default:
		printk("xfrm_user: Unknown Policy event %d\n", c->event);
	}

	return 0;

}

2615 2616 2617 2618 2619
static inline size_t xfrm_report_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
}

2620 2621 2622 2623 2624 2625
static int build_report(struct sk_buff *skb, u8 proto,
			struct xfrm_selector *sel, xfrm_address_t *addr)
{
	struct xfrm_user_report *ur;
	struct nlmsghdr *nlh;

2626 2627 2628
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2629

2630
	ur = nlmsg_data(nlh);
2631 2632 2633 2634
	ur->proto = proto;
	memcpy(&ur->sel, sel, sizeof(ur->sel));

	if (addr)
2635
		NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
2636

2637
	return nlmsg_end(skb, nlh);
2638

2639
nla_put_failure:
2640 2641
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
2642 2643
}

2644 2645
static int xfrm_send_report(struct net *net, u8 proto,
			    struct xfrm_selector *sel, xfrm_address_t *addr)
2646 2647 2648
{
	struct sk_buff *skb;

2649
	skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
2650 2651 2652 2653 2654 2655
	if (skb == NULL)
		return -ENOMEM;

	if (build_report(skb, proto, sel, addr) < 0)
		BUG();

2656
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
2657 2658
}

2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691
static inline size_t xfrm_mapping_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
}

static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
			 xfrm_address_t *new_saddr, __be16 new_sport)
{
	struct xfrm_user_mapping *um;
	struct nlmsghdr *nlh;

	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
	if (nlh == NULL)
		return -EMSGSIZE;

	um = nlmsg_data(nlh);

	memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
	um->id.spi = x->id.spi;
	um->id.family = x->props.family;
	um->id.proto = x->id.proto;
	memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
	memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
	um->new_sport = new_sport;
	um->old_sport = x->encap->encap_sport;
	um->reqid = x->props.reqid;

	return nlmsg_end(skb, nlh);
}

static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
			     __be16 sport)
{
2692
	struct net *net = xs_net(x);
2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707
	struct sk_buff *skb;

	if (x->id.proto != IPPROTO_ESP)
		return -EINVAL;

	if (!x->encap)
		return -EINVAL;

	skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
	if (skb == NULL)
		return -ENOMEM;

	if (build_mapping(skb, x, ipaddr, sport) < 0)
		BUG();

2708
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
2709 2710
}

L
Linus Torvalds 已提交
2711 2712 2713 2714 2715 2716
static struct xfrm_mgr netlink_mgr = {
	.id		= "netlink",
	.notify		= xfrm_send_state_notify,
	.acquire	= xfrm_send_acquire,
	.compile_policy	= xfrm_compile_policy,
	.notify_policy	= xfrm_send_policy_notify,
2717
	.report		= xfrm_send_report,
2718
	.migrate	= xfrm_send_migrate,
2719
	.new_mapping	= xfrm_send_mapping,
L
Linus Torvalds 已提交
2720 2721
};

2722
static int __net_init xfrm_user_net_init(struct net *net)
L
Linus Torvalds 已提交
2723
{
2724 2725
	struct sock *nlsk;

2726
	nlsk = netlink_kernel_create(net, NETLINK_XFRM, XFRMNLGRP_MAX,
2727
				     xfrm_netlink_rcv, NULL, THIS_MODULE);
2728
	if (nlsk == NULL)
L
Linus Torvalds 已提交
2729
		return -ENOMEM;
2730
	net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
2731
	rcu_assign_pointer(net->xfrm.nlsk, nlsk);
L
Linus Torvalds 已提交
2732 2733 2734
	return 0;
}

2735
static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
L
Linus Torvalds 已提交
2736
{
2737 2738 2739 2740 2741 2742
	struct net *net;
	list_for_each_entry(net, net_exit_list, exit_list)
		rcu_assign_pointer(net->xfrm.nlsk, NULL);
	synchronize_net();
	list_for_each_entry(net, net_exit_list, exit_list)
		netlink_kernel_release(net->xfrm.nlsk_stash);
L
Linus Torvalds 已提交
2743 2744
}

2745
static struct pernet_operations xfrm_user_net_ops = {
2746 2747
	.init	    = xfrm_user_net_init,
	.exit_batch = xfrm_user_net_exit,
2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770
};

static int __init xfrm_user_init(void)
{
	int rv;

	printk(KERN_INFO "Initializing XFRM netlink socket\n");

	rv = register_pernet_subsys(&xfrm_user_net_ops);
	if (rv < 0)
		return rv;
	rv = xfrm_register_km(&netlink_mgr);
	if (rv < 0)
		unregister_pernet_subsys(&xfrm_user_net_ops);
	return rv;
}

static void __exit xfrm_user_exit(void)
{
	xfrm_unregister_km(&netlink_mgr);
	unregister_pernet_subsys(&xfrm_user_net_ops);
}

L
Linus Torvalds 已提交
2771 2772 2773
module_init(xfrm_user_init);
module_exit(xfrm_user_exit);
MODULE_LICENSE("GPL");
2774
MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
2775