xfrm_user.c 66.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9
/* xfrm_user.c: User interface to configure xfrm engine.
 *
 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
 *
 * Changes:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
10
 *
L
Linus Torvalds 已提交
11 12
 */

13
#include <linux/crypto.h>
L
Linus Torvalds 已提交
14 15 16 17 18 19 20 21 22 23 24 25 26 27
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/socket.h>
#include <linux/string.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/pfkeyv2.h>
#include <linux/ipsec.h>
#include <linux/init.h>
#include <linux/security.h>
#include <net/sock.h>
#include <net/xfrm.h>
28
#include <net/netlink.h>
L
Linus Torvalds 已提交
29
#include <asm/uaccess.h>
30 31 32
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
#include <linux/in6.h>
#endif
L
Linus Torvalds 已提交
33

34 35 36 37 38
static inline int aead_len(struct xfrm_algo_aead *alg)
{
	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
}

39
static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
L
Linus Torvalds 已提交
40
{
41
	struct nlattr *rt = attrs[type];
L
Linus Torvalds 已提交
42 43 44 45 46
	struct xfrm_algo *algp;

	if (!rt)
		return 0;

47
	algp = nla_data(rt);
48
	if (nla_len(rt) < xfrm_alg_len(algp))
49 50
		return -EINVAL;

L
Linus Torvalds 已提交
51 52 53 54 55 56 57 58
	switch (type) {
	case XFRMA_ALG_AUTH:
	case XFRMA_ALG_CRYPT:
	case XFRMA_ALG_COMP:
		break;

	default:
		return -EINVAL;
59
	}
L
Linus Torvalds 已提交
60 61 62 63 64

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80
static int verify_auth_trunc(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
	struct xfrm_algo_auth *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < xfrm_alg_auth_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96
static int verify_aead(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
	struct xfrm_algo_aead *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < aead_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

97
static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
98 99
			   xfrm_address_t **addrp)
{
100
	struct nlattr *rt = attrs[type];
101

102
	if (rt && addrp)
103
		*addrp = nla_data(rt);
104
}
105

106
static inline int verify_sec_ctx_len(struct nlattr **attrs)
107
{
108
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
109 110 111 112 113
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

114
	uctx = nla_data(rt);
115
	if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
116 117 118 119 120 121
		return -EINVAL;

	return 0;
}


L
Linus Torvalds 已提交
122
static int verify_newsa_info(struct xfrm_usersa_info *p,
123
			     struct nlattr **attrs)
L
Linus Torvalds 已提交
124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141
{
	int err;

	err = -EINVAL;
	switch (p->family) {
	case AF_INET:
		break;

	case AF_INET6:
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
		break;
#else
		err = -EAFNOSUPPORT;
		goto out;
#endif

	default:
		goto out;
142
	}
L
Linus Torvalds 已提交
143 144 145 146

	err = -EINVAL;
	switch (p->id.proto) {
	case IPPROTO_AH:
147 148
		if ((!attrs[XFRMA_ALG_AUTH]	&&
		     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
149
		    attrs[XFRMA_ALG_AEAD]	||
150 151
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_ALG_COMP])
L
Linus Torvalds 已提交
152 153 154 155
			goto out;
		break;

	case IPPROTO_ESP:
156 157 158
		if (attrs[XFRMA_ALG_COMP])
			goto out;
		if (!attrs[XFRMA_ALG_AUTH] &&
159
		    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
160 161 162 163
		    !attrs[XFRMA_ALG_CRYPT] &&
		    !attrs[XFRMA_ALG_AEAD])
			goto out;
		if ((attrs[XFRMA_ALG_AUTH] ||
164
		     attrs[XFRMA_ALG_AUTH_TRUNC] ||
165 166
		     attrs[XFRMA_ALG_CRYPT]) &&
		    attrs[XFRMA_ALG_AEAD])
L
Linus Torvalds 已提交
167 168 169 170
			goto out;
		break;

	case IPPROTO_COMP:
171
		if (!attrs[XFRMA_ALG_COMP]	||
172
		    attrs[XFRMA_ALG_AEAD]	||
173
		    attrs[XFRMA_ALG_AUTH]	||
174
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
175
		    attrs[XFRMA_ALG_CRYPT])
L
Linus Torvalds 已提交
176 177 178
			goto out;
		break;

179 180 181
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
	case IPPROTO_DSTOPTS:
	case IPPROTO_ROUTING:
182 183
		if (attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_ALG_AUTH]	||
184
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
185
		    attrs[XFRMA_ALG_AEAD]	||
186 187 188 189
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_ENCAP]		||
		    attrs[XFRMA_SEC_CTX]	||
		    !attrs[XFRMA_COADDR])
190 191 192 193
			goto out;
		break;
#endif

L
Linus Torvalds 已提交
194 195
	default:
		goto out;
196
	}
L
Linus Torvalds 已提交
197

198 199
	if ((err = verify_aead(attrs)))
		goto out;
200 201
	if ((err = verify_auth_trunc(attrs)))
		goto out;
202
	if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
L
Linus Torvalds 已提交
203
		goto out;
204
	if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
L
Linus Torvalds 已提交
205
		goto out;
206
	if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
L
Linus Torvalds 已提交
207
		goto out;
208
	if ((err = verify_sec_ctx_len(attrs)))
209
		goto out;
L
Linus Torvalds 已提交
210 211 212

	err = -EINVAL;
	switch (p->mode) {
213 214
	case XFRM_MODE_TRANSPORT:
	case XFRM_MODE_TUNNEL:
215
	case XFRM_MODE_ROUTEOPTIMIZATION:
D
Diego Beltrami 已提交
216
	case XFRM_MODE_BEET:
L
Linus Torvalds 已提交
217 218 219 220
		break;

	default:
		goto out;
221
	}
L
Linus Torvalds 已提交
222 223 224 225 226 227 228 229 230

	err = 0;

out:
	return err;
}

static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
			   struct xfrm_algo_desc *(*get_byname)(char *, int),
231
			   struct nlattr *rta)
L
Linus Torvalds 已提交
232 233 234 235 236 237 238
{
	struct xfrm_algo *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

239
	ualg = nla_data(rta);
L
Linus Torvalds 已提交
240 241 242 243 244 245

	algo = get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

246
	p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
L
Linus Torvalds 已提交
247 248 249
	if (!p)
		return -ENOMEM;

250
	strcpy(p->alg_name, algo->name);
L
Linus Torvalds 已提交
251 252 253 254
	*algpp = p;
	return 0;
}

255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314
static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo *ualg;
	struct xfrm_algo_auth *p;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	p->alg_key_len = ualg->alg_key_len;
	p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
	memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);

	*algpp = p;
	return 0;
}

static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
			     struct nlattr *rta)
{
	struct xfrm_algo_auth *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
		return -EINVAL;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	if (!p->alg_trunc_len)
		p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;

	*algpp = p;
	return 0;
}

315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339
static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo_aead *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	*algpp = p;
	return 0;
}

340
static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
341 342 343 344 345 346 347 348 349 350
{
	int len = 0;

	if (xfrm_ctx) {
		len += sizeof(struct xfrm_user_sec_ctx);
		len += xfrm_ctx->ctx_len;
	}
	return len;
}

L
Linus Torvalds 已提交
351 352 353 354 355 356 357 358 359
static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&x->id, &p->id, sizeof(x->id));
	memcpy(&x->sel, &p->sel, sizeof(x->sel));
	memcpy(&x->lft, &p->lft, sizeof(x->lft));
	x->props.mode = p->mode;
	x->props.replay_window = p->replay_window;
	x->props.reqid = p->reqid;
	x->props.family = p->family;
360
	memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
L
Linus Torvalds 已提交
361
	x->props.flags = p->flags;
362

363
	if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
364
		x->sel.family = p->family;
L
Linus Torvalds 已提交
365 366
}

J
Jamal Hadi Salim 已提交
367 368 369 370 371
/*
 * someday when pfkey also has support, we could have the code
 * somehow made shareable and move it to xfrm_state.c - JHS
 *
*/
372
static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
373
{
374 375 376 377
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
J
Jamal Hadi Salim 已提交
378 379 380

	if (rp) {
		struct xfrm_replay_state *replay;
381
		replay = nla_data(rp);
J
Jamal Hadi Salim 已提交
382 383 384 385 386 387
		memcpy(&x->replay, replay, sizeof(*replay));
		memcpy(&x->preplay, replay, sizeof(*replay));
	}

	if (lt) {
		struct xfrm_lifetime_cur *ltime;
388
		ltime = nla_data(lt);
J
Jamal Hadi Salim 已提交
389 390 391 392 393 394
		x->curlft.bytes = ltime->bytes;
		x->curlft.packets = ltime->packets;
		x->curlft.add_time = ltime->add_time;
		x->curlft.use_time = ltime->use_time;
	}

395
	if (et)
396
		x->replay_maxage = nla_get_u32(et);
J
Jamal Hadi Salim 已提交
397

398
	if (rt)
399
		x->replay_maxdiff = nla_get_u32(rt);
J
Jamal Hadi Salim 已提交
400 401
}

402 403
static struct xfrm_state *xfrm_state_construct(struct net *net,
					       struct xfrm_usersa_info *p,
404
					       struct nlattr **attrs,
L
Linus Torvalds 已提交
405 406
					       int *errp)
{
407
	struct xfrm_state *x = xfrm_state_alloc(net);
L
Linus Torvalds 已提交
408 409 410 411 412 413 414
	int err = -ENOMEM;

	if (!x)
		goto error_no_put;

	copy_from_user_state(x, p);

415 416 417
	if ((err = attach_aead(&x->aead, &x->props.ealgo,
			       attrs[XFRMA_ALG_AEAD])))
		goto error;
418 419
	if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
				     attrs[XFRMA_ALG_AUTH_TRUNC])))
L
Linus Torvalds 已提交
420
		goto error;
421 422 423 424 425
	if (!x->props.aalgo) {
		if ((err = attach_auth(&x->aalg, &x->props.aalgo,
				       attrs[XFRMA_ALG_AUTH])))
			goto error;
	}
L
Linus Torvalds 已提交
426 427
	if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
				   xfrm_ealg_get_byname,
428
				   attrs[XFRMA_ALG_CRYPT])))
L
Linus Torvalds 已提交
429 430 431
		goto error;
	if ((err = attach_one_algo(&x->calg, &x->props.calgo,
				   xfrm_calg_get_byname,
432
				   attrs[XFRMA_ALG_COMP])))
L
Linus Torvalds 已提交
433
		goto error;
434 435 436 437 438 439 440 441 442 443 444 445 446 447 448

	if (attrs[XFRMA_ENCAP]) {
		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
				   sizeof(*x->encap), GFP_KERNEL);
		if (x->encap == NULL)
			goto error;
	}

	if (attrs[XFRMA_COADDR]) {
		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
				    sizeof(*x->coaddr), GFP_KERNEL);
		if (x->coaddr == NULL)
			goto error;
	}

449 450
	xfrm_mark_get(attrs, &x->mark);

H
Herbert Xu 已提交
451
	err = xfrm_init_state(x);
L
Linus Torvalds 已提交
452 453 454
	if (err)
		goto error;

455 456
	if (attrs[XFRMA_SEC_CTX] &&
	    security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
457 458
		goto error;

L
Linus Torvalds 已提交
459
	x->km.seq = p->seq;
A
Alexey Dobriyan 已提交
460
	x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
J
Jamal Hadi Salim 已提交
461
	/* sysctl_xfrm_aevent_etime is in 100ms units */
A
Alexey Dobriyan 已提交
462
	x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
J
Jamal Hadi Salim 已提交
463 464 465 466 467 468
	x->preplay.bitmap = 0;
	x->preplay.seq = x->replay.seq+x->replay_maxdiff;
	x->preplay.oseq = x->replay.oseq +x->replay_maxdiff;

	/* override default values from above */

469
	xfrm_update_ae_params(x, attrs);
L
Linus Torvalds 已提交
470 471 472 473 474 475 476 477 478 479 480

	return x;

error:
	x->km.state = XFRM_STATE_DEAD;
	xfrm_state_put(x);
error_no_put:
	*errp = err;
	return NULL;
}

481
static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
482
		struct nlattr **attrs)
L
Linus Torvalds 已提交
483
{
484
	struct net *net = sock_net(skb->sk);
485
	struct xfrm_usersa_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
486 487
	struct xfrm_state *x;
	int err;
488
	struct km_event c;
489 490 491
	uid_t loginuid = NETLINK_CB(skb).loginuid;
	u32 sessionid = NETLINK_CB(skb).sessionid;
	u32 sid = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
492

493
	err = verify_newsa_info(p, attrs);
L
Linus Torvalds 已提交
494 495 496
	if (err)
		return err;

497
	x = xfrm_state_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
498 499 500
	if (!x)
		return err;

501
	xfrm_state_hold(x);
L
Linus Torvalds 已提交
502 503 504 505 506
	if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
		err = xfrm_state_add(x);
	else
		err = xfrm_state_update(x);

507
	xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
508

L
Linus Torvalds 已提交
509 510
	if (err < 0) {
		x->km.state = XFRM_STATE_DEAD;
511
		__xfrm_state_put(x);
512
		goto out;
L
Linus Torvalds 已提交
513 514
	}

515 516
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
517
	c.event = nlh->nlmsg_type;
518 519

	km_state_notify(x, &c);
520
out:
521
	xfrm_state_put(x);
L
Linus Torvalds 已提交
522 523 524
	return err;
}

525 526
static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
						 struct xfrm_usersa_id *p,
527
						 struct nlattr **attrs,
528 529 530
						 int *errp)
{
	struct xfrm_state *x = NULL;
531
	struct xfrm_mark m;
532
	int err;
533
	u32 mark = xfrm_mark_get(attrs, &m);
534 535 536

	if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
		err = -ESRCH;
537
		x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
538 539 540
	} else {
		xfrm_address_t *saddr = NULL;

541
		verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
542 543 544 545 546
		if (!saddr) {
			err = -EINVAL;
			goto out;
		}

547
		err = -ESRCH;
548 549
		x = xfrm_state_lookup_byaddr(net, mark,
					     &p->daddr, saddr,
550
					     p->proto, p->family);
551 552 553 554 555 556 557 558
	}

 out:
	if (!x && errp)
		*errp = err;
	return x;
}

559
static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
560
		struct nlattr **attrs)
L
Linus Torvalds 已提交
561
{
562
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
563
	struct xfrm_state *x;
564
	int err = -ESRCH;
565
	struct km_event c;
566
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
567 568 569
	uid_t loginuid = NETLINK_CB(skb).loginuid;
	u32 sessionid = NETLINK_CB(skb).sessionid;
	u32 sid = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
570

571
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
572
	if (x == NULL)
573
		return err;
L
Linus Torvalds 已提交
574

575
	if ((err = security_xfrm_state_delete(x)) != 0)
C
Catherine Zhang 已提交
576 577
		goto out;

L
Linus Torvalds 已提交
578
	if (xfrm_state_kern(x)) {
C
Catherine Zhang 已提交
579 580
		err = -EPERM;
		goto out;
L
Linus Torvalds 已提交
581 582
	}

583
	err = xfrm_state_delete(x);
J
Joy Latten 已提交
584

C
Catherine Zhang 已提交
585 586
	if (err < 0)
		goto out;
587 588 589

	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
590
	c.event = nlh->nlmsg_type;
591
	km_state_notify(x, &c);
L
Linus Torvalds 已提交
592

C
Catherine Zhang 已提交
593
out:
594
	xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
C
Catherine Zhang 已提交
595
	xfrm_state_put(x);
596
	return err;
L
Linus Torvalds 已提交
597 598 599 600 601 602 603 604 605
}

static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&p->id, &x->id, sizeof(p->id));
	memcpy(&p->sel, &x->sel, sizeof(p->sel));
	memcpy(&p->lft, &x->lft, sizeof(p->lft));
	memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
	memcpy(&p->stats, &x->stats, sizeof(p->stats));
606
	memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
L
Linus Torvalds 已提交
607 608 609 610 611 612 613 614 615 616 617 618 619 620 621
	p->mode = x->props.mode;
	p->replay_window = x->props.replay_window;
	p->reqid = x->props.reqid;
	p->family = x->props.family;
	p->flags = x->props.flags;
	p->seq = x->km.seq;
}

struct xfrm_dump_info {
	struct sk_buff *in_skb;
	struct sk_buff *out_skb;
	u32 nlmsg_seq;
	u16 nlmsg_flags;
};

622 623 624 625
static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
{
	struct xfrm_user_sec_ctx *uctx;
	struct nlattr *attr;
626
	int ctx_size = sizeof(*uctx) + s->ctx_len;
627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642

	attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
	if (attr == NULL)
		return -EMSGSIZE;

	uctx = nla_data(attr);
	uctx->exttype = XFRMA_SEC_CTX;
	uctx->len = ctx_size;
	uctx->ctx_doi = s->ctx_doi;
	uctx->ctx_alg = s->ctx_alg;
	uctx->ctx_len = s->ctx_len;
	memcpy(uctx + 1, s->ctx_str, s->ctx_len);

	return 0;
}

643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660
static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
{
	struct xfrm_algo *algo;
	struct nlattr *nla;

	nla = nla_reserve(skb, XFRMA_ALG_AUTH,
			  sizeof(*algo) + (auth->alg_key_len + 7) / 8);
	if (!nla)
		return -EMSGSIZE;

	algo = nla_data(nla);
	strcpy(algo->alg_name, auth->alg_name);
	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
	algo->alg_key_len = auth->alg_key_len;

	return 0;
}

661 662 663 664
/* Don't change this without updating xfrm_sa_len! */
static int copy_to_user_state_extra(struct xfrm_state *x,
				    struct xfrm_usersa_info *p,
				    struct sk_buff *skb)
L
Linus Torvalds 已提交
665 666 667
{
	copy_to_user_state(x, p);

668 669 670 671 672 673
	if (x->coaddr)
		NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);

	if (x->lastused)
		NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);

674 675
	if (x->aead)
		NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
676 677 678 679 680 681 682
	if (x->aalg) {
		if (copy_to_user_auth(x->aalg, skb))
			goto nla_put_failure;

		NLA_PUT(skb, XFRMA_ALG_AUTH_TRUNC,
			xfrm_alg_auth_len(x->aalg), x->aalg);
	}
L
Linus Torvalds 已提交
683
	if (x->ealg)
684
		NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
L
Linus Torvalds 已提交
685
	if (x->calg)
686
		NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
L
Linus Torvalds 已提交
687 688

	if (x->encap)
689
		NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
L
Linus Torvalds 已提交
690

691 692 693
	if (xfrm_mark_put(skb, &x->mark))
		goto nla_put_failure;

694 695
	if (x->security && copy_sec_ctx(x->security, skb) < 0)
		goto nla_put_failure;
696

697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722
	return 0;

nla_put_failure:
	return -EMSGSIZE;
}

static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct xfrm_usersa_info *p;
	struct nlmsghdr *nlh;
	int err;

	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;

	p = nlmsg_data(nlh);

	err = copy_to_user_state_extra(x, p, skb);
	if (err)
		goto nla_put_failure;

723
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
724 725
	return 0;

726
nla_put_failure:
727
	nlmsg_cancel(skb, nlh);
728
	return err;
L
Linus Torvalds 已提交
729 730
}

731 732 733 734 735 736 737
static int xfrm_dump_sa_done(struct netlink_callback *cb)
{
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
	xfrm_state_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
738 739
static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
{
740
	struct net *net = sock_net(skb->sk);
741
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
L
Linus Torvalds 已提交
742 743
	struct xfrm_dump_info info;

744 745 746
	BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
747 748 749 750
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
751 752 753 754 755 756

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_state_walk_init(walk, 0);
	}

757
	(void) xfrm_state_walk(net, walk, dump_one_state, &info);
L
Linus Torvalds 已提交
758 759 760 761 762 763 764 765 766 767

	return skb->len;
}

static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
					  struct xfrm_state *x, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;

768
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
L
Linus Torvalds 已提交
769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

	if (dump_one_state(x, 0, &info)) {
		kfree_skb(skb);
		return NULL;
	}

	return skb;
}

785 786 787 788 789 790 791
static inline size_t xfrm_spdinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_spdinfo))
	       + nla_total_size(sizeof(struct xfrmu_spdhinfo));
}

792 793
static int build_spdinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
794
{
795 796 797
	struct xfrmk_spdinfo si;
	struct xfrmu_spdinfo spc;
	struct xfrmu_spdhinfo sph;
J
Jamal Hadi Salim 已提交
798 799 800 801 802 803 804 805 806
	struct nlmsghdr *nlh;
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
	if (nlh == NULL) /* shouldnt really happen ... */
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
807
	xfrm_spd_getinfo(net, &si);
808 809 810 811 812 813 814 815 816 817 818
	spc.incnt = si.incnt;
	spc.outcnt = si.outcnt;
	spc.fwdcnt = si.fwdcnt;
	spc.inscnt = si.inscnt;
	spc.outscnt = si.outscnt;
	spc.fwdscnt = si.fwdscnt;
	sph.spdhcnt = si.spdhcnt;
	sph.spdhmcnt = si.spdhmcnt;

	NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
	NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
J
Jamal Hadi Salim 已提交
819 820 821 822 823 824 825 826 827

	return nlmsg_end(skb, nlh);

nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
}

static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
828
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
829
{
830
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
831
	struct sk_buff *r_skb;
832
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
833 834 835
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

836
	r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
837 838 839
	if (r_skb == NULL)
		return -ENOMEM;

840
	if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
841 842
		BUG();

843
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
844 845
}

846 847 848 849 850 851 852
static inline size_t xfrm_sadinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_sadhinfo))
	       + nla_total_size(4); /* XFRMA_SAD_CNT */
}

853 854
static int build_sadinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
855
{
856 857
	struct xfrmk_sadinfo si;
	struct xfrmu_sadhinfo sh;
J
Jamal Hadi Salim 已提交
858 859 860 861 862 863 864 865 866
	struct nlmsghdr *nlh;
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
	if (nlh == NULL) /* shouldnt really happen ... */
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
867
	xfrm_sad_getinfo(net, &si);
J
Jamal Hadi Salim 已提交
868

869 870 871 872 873
	sh.sadhmcnt = si.sadhmcnt;
	sh.sadhcnt = si.sadhcnt;

	NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
	NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
J
Jamal Hadi Salim 已提交
874 875 876 877 878 879 880 881 882

	return nlmsg_end(skb, nlh);

nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
}

static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
883
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
884
{
885
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
886
	struct sk_buff *r_skb;
887
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
888 889 890
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

891
	r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
892 893 894
	if (r_skb == NULL)
		return -ENOMEM;

895
	if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
896 897
		BUG();

898
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
899 900
}

901
static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
902
		struct nlattr **attrs)
L
Linus Torvalds 已提交
903
{
904
	struct net *net = sock_net(skb->sk);
905
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
906 907
	struct xfrm_state *x;
	struct sk_buff *resp_skb;
908
	int err = -ESRCH;
L
Linus Torvalds 已提交
909

910
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
911 912 913 914 915 916 917
	if (x == NULL)
		goto out_noput;

	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
	} else {
918
		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939
	}
	xfrm_state_put(x);
out_noput:
	return err;
}

static int verify_userspi_info(struct xfrm_userspi_info *p)
{
	switch (p->info.id.proto) {
	case IPPROTO_AH:
	case IPPROTO_ESP:
		break;

	case IPPROTO_COMP:
		/* IPCOMP spi is 16-bits. */
		if (p->max >= 0x10000)
			return -EINVAL;
		break;

	default:
		return -EINVAL;
940
	}
L
Linus Torvalds 已提交
941 942 943 944 945 946 947

	if (p->min > p->max)
		return -EINVAL;

	return 0;
}

948
static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
949
		struct nlattr **attrs)
L
Linus Torvalds 已提交
950
{
951
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
952 953 954 955 956 957
	struct xfrm_state *x;
	struct xfrm_userspi_info *p;
	struct sk_buff *resp_skb;
	xfrm_address_t *daddr;
	int family;
	int err;
958 959
	u32 mark;
	struct xfrm_mark m;
L
Linus Torvalds 已提交
960

961
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
962 963 964 965 966 967 968 969
	err = verify_userspi_info(p);
	if (err)
		goto out_noput;

	family = p->info.family;
	daddr = &p->info.id.daddr;

	x = NULL;
970 971

	mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
972
	if (p->info.seq) {
973
		x = xfrm_find_acq_byseq(net, mark, p->info.seq);
L
Linus Torvalds 已提交
974 975 976 977 978 979 980
		if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
			xfrm_state_put(x);
			x = NULL;
		}
	}

	if (!x)
981
		x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
L
Linus Torvalds 已提交
982 983 984 985 986 987 988
				  p->info.id.proto, daddr,
				  &p->info.saddr, 1,
				  family);
	err = -ENOENT;
	if (x == NULL)
		goto out_noput;

989 990 991
	err = xfrm_alloc_spi(x, p->min, p->max);
	if (err)
		goto out;
L
Linus Torvalds 已提交
992

993
	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
L
Linus Torvalds 已提交
994 995 996 997 998
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
		goto out;
	}

999
	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1000 1001 1002 1003 1004 1005 1006

out:
	xfrm_state_put(x);
out_noput:
	return err;
}

1007
static int verify_policy_dir(u8 dir)
L
Linus Torvalds 已提交
1008 1009 1010 1011 1012 1013 1014 1015 1016
{
	switch (dir) {
	case XFRM_POLICY_IN:
	case XFRM_POLICY_OUT:
	case XFRM_POLICY_FWD:
		break;

	default:
		return -EINVAL;
1017
	}
L
Linus Torvalds 已提交
1018 1019 1020 1021

	return 0;
}

1022
static int verify_policy_type(u8 type)
1023 1024 1025 1026 1027 1028 1029 1030 1031 1032
{
	switch (type) {
	case XFRM_POLICY_TYPE_MAIN:
#ifdef CONFIG_XFRM_SUB_POLICY
	case XFRM_POLICY_TYPE_SUB:
#endif
		break;

	default:
		return -EINVAL;
1033
	}
1034 1035 1036 1037

	return 0;
}

L
Linus Torvalds 已提交
1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048
static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
{
	switch (p->share) {
	case XFRM_SHARE_ANY:
	case XFRM_SHARE_SESSION:
	case XFRM_SHARE_USER:
	case XFRM_SHARE_UNIQUE:
		break;

	default:
		return -EINVAL;
1049
	}
L
Linus Torvalds 已提交
1050 1051 1052 1053 1054 1055 1056 1057

	switch (p->action) {
	case XFRM_POLICY_ALLOW:
	case XFRM_POLICY_BLOCK:
		break;

	default:
		return -EINVAL;
1058
	}
L
Linus Torvalds 已提交
1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072

	switch (p->sel.family) {
	case AF_INET:
		break;

	case AF_INET6:
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
		break;
#else
		return  -EAFNOSUPPORT;
#endif

	default:
		return -EINVAL;
1073
	}
L
Linus Torvalds 已提交
1074 1075 1076 1077

	return verify_policy_dir(p->dir);
}

1078
static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
1079
{
1080
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1081 1082 1083 1084 1085
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

1086
	uctx = nla_data(rt);
1087
	return security_xfrm_policy_alloc(&pol->security, uctx);
1088 1089
}

L
Linus Torvalds 已提交
1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108
static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
			   int nr)
{
	int i;

	xp->xfrm_nr = nr;
	for (i = 0; i < nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];

		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
		memcpy(&t->saddr, &ut->saddr,
		       sizeof(xfrm_address_t));
		t->reqid = ut->reqid;
		t->mode = ut->mode;
		t->share = ut->share;
		t->optional = ut->optional;
		t->aalgos = ut->aalgos;
		t->ealgos = ut->ealgos;
		t->calgos = ut->calgos;
1109 1110
		/* If all masks are ~0, then we allow all algorithms. */
		t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1111
		t->encap_family = ut->family;
L
Linus Torvalds 已提交
1112 1113 1114
	}
}

1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141
static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
{
	int i;

	if (nr > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < nr; i++) {
		/* We never validated the ut->family value, so many
		 * applications simply leave it at zero.  The check was
		 * never made and ut->family was ignored because all
		 * templates could be assumed to have the same family as
		 * the policy itself.  Now that we will have ipv4-in-ipv6
		 * and ipv6-in-ipv4 tunnels, this is no longer true.
		 */
		if (!ut[i].family)
			ut[i].family = family;

		switch (ut[i].family) {
		case AF_INET:
			break;
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
		case AF_INET6:
			break;
#endif
		default:
			return -EINVAL;
1142
		}
1143 1144 1145 1146 1147
	}

	return 0;
}

1148
static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
L
Linus Torvalds 已提交
1149
{
1150
	struct nlattr *rt = attrs[XFRMA_TMPL];
L
Linus Torvalds 已提交
1151 1152 1153 1154

	if (!rt) {
		pol->xfrm_nr = 0;
	} else {
1155 1156
		struct xfrm_user_tmpl *utmpl = nla_data(rt);
		int nr = nla_len(rt) / sizeof(*utmpl);
1157
		int err;
L
Linus Torvalds 已提交
1158

1159 1160 1161
		err = validate_tmpl(nr, utmpl, pol->family);
		if (err)
			return err;
L
Linus Torvalds 已提交
1162

1163
		copy_templates(pol, utmpl, nr);
L
Linus Torvalds 已提交
1164 1165 1166 1167
	}
	return 0;
}

1168
static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
1169
{
1170
	struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1171
	struct xfrm_userpolicy_type *upt;
1172
	u8 type = XFRM_POLICY_TYPE_MAIN;
1173 1174 1175
	int err;

	if (rt) {
1176
		upt = nla_data(rt);
1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187
		type = upt->type;
	}

	err = verify_policy_type(type);
	if (err)
		return err;

	*tp = type;
	return 0;
}

L
Linus Torvalds 已提交
1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213
static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
{
	xp->priority = p->priority;
	xp->index = p->index;
	memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
	memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
	xp->action = p->action;
	xp->flags = p->flags;
	xp->family = p->sel.family;
	/* XXX xp->share = p->share; */
}

static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
{
	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
	p->priority = xp->priority;
	p->index = xp->index;
	p->sel.family = xp->family;
	p->dir = dir;
	p->action = xp->action;
	p->flags = xp->flags;
	p->share = XFRM_SHARE_ANY; /* XXX xp->share */
}

1214
static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
L
Linus Torvalds 已提交
1215
{
1216
	struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
L
Linus Torvalds 已提交
1217 1218 1219 1220 1221 1222 1223 1224
	int err;

	if (!xp) {
		*errp = -ENOMEM;
		return NULL;
	}

	copy_from_user_policy(xp, p);
1225

1226
	err = copy_from_user_policy_type(&xp->type, attrs);
1227 1228 1229
	if (err)
		goto error;

1230 1231
	if (!(err = copy_from_user_tmpl(xp, attrs)))
		err = copy_from_user_sec_ctx(xp, attrs);
1232 1233
	if (err)
		goto error;
L
Linus Torvalds 已提交
1234

1235 1236
	xfrm_mark_get(attrs, &xp->mark);

L
Linus Torvalds 已提交
1237
	return xp;
1238 1239
 error:
	*errp = err;
H
Herbert Xu 已提交
1240
	xp->walk.dead = 1;
1241
	xfrm_policy_destroy(xp);
1242
	return NULL;
L
Linus Torvalds 已提交
1243 1244
}

1245
static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1246
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1247
{
1248
	struct net *net = sock_net(skb->sk);
1249
	struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1250
	struct xfrm_policy *xp;
1251
	struct km_event c;
L
Linus Torvalds 已提交
1252 1253
	int err;
	int excl;
1254 1255 1256
	uid_t loginuid = NETLINK_CB(skb).loginuid;
	u32 sessionid = NETLINK_CB(skb).sessionid;
	u32 sid = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
1257 1258

	err = verify_newpolicy_info(p);
1259 1260
	if (err)
		return err;
1261
	err = verify_sec_ctx_len(attrs);
L
Linus Torvalds 已提交
1262 1263 1264
	if (err)
		return err;

1265
	xp = xfrm_policy_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
1266 1267 1268
	if (!xp)
		return err;

1269 1270 1271 1272
	/* shouldnt excl be based on nlh flags??
	 * Aha! this is anti-netlink really i.e  more pfkey derived
	 * in netlink excl is a flag and you wouldnt need
	 * a type XFRM_MSG_UPDPOLICY - JHS */
L
Linus Torvalds 已提交
1273 1274
	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
	err = xfrm_policy_insert(p->dir, xp, excl);
1275
	xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1276

L
Linus Torvalds 已提交
1277
	if (err) {
1278
		security_xfrm_policy_free(xp->security);
L
Linus Torvalds 已提交
1279 1280 1281 1282
		kfree(xp);
		return err;
	}

1283
	c.event = nlh->nlmsg_type;
1284 1285 1286 1287
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	km_policy_notify(xp, p->dir, &c);

L
Linus Torvalds 已提交
1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305
	xfrm_pol_put(xp);

	return 0;
}

static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
{
	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
	int i;

	if (xp->xfrm_nr == 0)
		return 0;

	for (i = 0; i < xp->xfrm_nr; i++) {
		struct xfrm_user_tmpl *up = &vec[i];
		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];

		memcpy(&up->id, &kp->id, sizeof(up->id));
1306
		up->family = kp->encap_family;
L
Linus Torvalds 已提交
1307 1308 1309 1310 1311 1312 1313 1314 1315
		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
		up->reqid = kp->reqid;
		up->mode = kp->mode;
		up->share = kp->share;
		up->optional = kp->optional;
		up->aalgos = kp->aalgos;
		up->ealgos = kp->ealgos;
		up->calgos = kp->calgos;
	}
1316

1317 1318
	return nla_put(skb, XFRMA_TMPL,
		       sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
1319 1320 1321 1322 1323 1324
}

static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
{
	if (x->security) {
		return copy_sec_ctx(x->security, skb);
1325 1326
	}
	return 0;
1327
}
1328

1329 1330 1331 1332 1333 1334
static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
{
	if (xp->security) {
		return copy_sec_ctx(xp->security, skb);
	}
	return 0;
1335
}
1336 1337 1338 1339 1340 1341 1342 1343
static inline size_t userpolicy_type_attrsize(void)
{
#ifdef CONFIG_XFRM_SUB_POLICY
	return nla_total_size(sizeof(struct xfrm_userpolicy_type));
#else
	return 0;
#endif
}
1344

1345
#ifdef CONFIG_XFRM_SUB_POLICY
1346
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1347
{
1348 1349 1350
	struct xfrm_userpolicy_type upt = {
		.type = type,
	};
1351

1352
	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1353 1354 1355
}

#else
1356
static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1357 1358 1359 1360 1361
{
	return 0;
}
#endif

L
Linus Torvalds 已提交
1362 1363 1364 1365 1366 1367 1368 1369
static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct xfrm_userpolicy_info *p;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct nlmsghdr *nlh;

1370 1371 1372 1373
	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
1374

1375
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1376 1377 1378
	copy_to_user_policy(xp, p, dir);
	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
1379 1380
	if (copy_to_user_sec_ctx(xp, skb))
		goto nlmsg_failure;
1381
	if (copy_to_user_policy_type(xp->type, skb) < 0)
1382
		goto nlmsg_failure;
1383 1384
	if (xfrm_mark_put(skb, &xp->mark))
		goto nla_put_failure;
L
Linus Torvalds 已提交
1385

1386
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
1387 1388
	return 0;

1389
nla_put_failure:
L
Linus Torvalds 已提交
1390
nlmsg_failure:
1391 1392
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
1393 1394
}

1395 1396 1397 1398 1399 1400 1401 1402
static int xfrm_dump_policy_done(struct netlink_callback *cb)
{
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];

	xfrm_policy_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
1403 1404
static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
{
1405
	struct net *net = sock_net(skb->sk);
1406
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
L
Linus Torvalds 已提交
1407 1408
	struct xfrm_dump_info info;

1409 1410 1411
	BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
1412 1413 1414 1415
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
1416 1417 1418 1419 1420 1421

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
	}

1422
	(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
L
Linus Torvalds 已提交
1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433

	return skb->len;
}

static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
					  struct xfrm_policy *xp,
					  int dir, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;

1434
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
L
Linus Torvalds 已提交
1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

	if (dump_one_policy(xp, dir, 0, &info) < 0) {
		kfree_skb(skb);
		return NULL;
	}

	return skb;
}

1451
static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1452
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1453
{
1454
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1455 1456
	struct xfrm_policy *xp;
	struct xfrm_userpolicy_id *p;
1457
	u8 type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
1458
	int err;
1459
	struct km_event c;
L
Linus Torvalds 已提交
1460
	int delete;
1461 1462
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
1463

1464
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1465 1466
	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;

1467
	err = copy_from_user_policy_type(&type, attrs);
1468 1469 1470
	if (err)
		return err;

L
Linus Torvalds 已提交
1471 1472 1473 1474 1475
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

	if (p->index)
1476
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
1477
	else {
1478
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1479
		struct xfrm_sec_ctx *ctx;
1480

1481
		err = verify_sec_ctx_len(attrs);
1482 1483 1484
		if (err)
			return err;

1485
		ctx = NULL;
1486
		if (rt) {
1487
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1488

1489 1490
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1491
				return err;
1492
		}
1493
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
1494
					   ctx, delete, &err);
1495
		security_xfrm_policy_free(ctx);
1496
	}
L
Linus Torvalds 已提交
1497 1498 1499 1500 1501 1502 1503 1504 1505 1506
	if (xp == NULL)
		return -ENOENT;

	if (!delete) {
		struct sk_buff *resp_skb;

		resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
		if (IS_ERR(resp_skb)) {
			err = PTR_ERR(resp_skb);
		} else {
1507
			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
1508
					    NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1509
		}
1510
	} else {
1511 1512 1513 1514 1515 1516
		uid_t loginuid = NETLINK_CB(skb).loginuid;
		u32 sessionid = NETLINK_CB(skb).sessionid;
		u32 sid = NETLINK_CB(skb).sid;

		xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
					 sid);
1517 1518

		if (err != 0)
C
Catherine Zhang 已提交
1519
			goto out;
1520

1521
		c.data.byid = p->index;
1522
		c.event = nlh->nlmsg_type;
1523 1524 1525
		c.seq = nlh->nlmsg_seq;
		c.pid = nlh->nlmsg_pid;
		km_policy_notify(xp, p->dir, &c);
L
Linus Torvalds 已提交
1526 1527
	}

C
Catherine Zhang 已提交
1528
out:
1529
	xfrm_pol_put(xp);
L
Linus Torvalds 已提交
1530 1531 1532
	return err;
}

1533
static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1534
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1535
{
1536
	struct net *net = sock_net(skb->sk);
1537
	struct km_event c;
1538
	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
J
Joy Latten 已提交
1539
	struct xfrm_audit audit_info;
1540
	int err;
L
Linus Torvalds 已提交
1541

J
Joy Latten 已提交
1542
	audit_info.loginuid = NETLINK_CB(skb).loginuid;
1543
	audit_info.sessionid = NETLINK_CB(skb).sessionid;
J
Joy Latten 已提交
1544
	audit_info.secid = NETLINK_CB(skb).sid;
1545
	err = xfrm_state_flush(net, p->proto, &audit_info);
1546 1547 1548
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1549
		return err;
1550
	}
1551
	c.data.proto = p->proto;
1552
	c.event = nlh->nlmsg_type;
1553 1554
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1555
	c.net = net;
1556 1557
	km_state_notify(NULL, &c);

L
Linus Torvalds 已提交
1558 1559 1560
	return 0;
}

1561 1562 1563 1564 1565
static inline size_t xfrm_aevent_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
	       + nla_total_size(sizeof(struct xfrm_replay_state))
	       + nla_total_size(sizeof(struct xfrm_lifetime_cur))
1566
	       + nla_total_size(sizeof(struct xfrm_mark))
1567 1568 1569
	       + nla_total_size(4) /* XFRM_AE_RTHR */
	       + nla_total_size(4); /* XFRM_AE_ETHR */
}
J
Jamal Hadi Salim 已提交
1570 1571 1572 1573 1574 1575

static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
{
	struct xfrm_aevent_id *id;
	struct nlmsghdr *nlh;

1576 1577 1578
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
J
Jamal Hadi Salim 已提交
1579

1580
	id = nlmsg_data(nlh);
1581
	memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
J
Jamal Hadi Salim 已提交
1582 1583 1584
	id->sa_id.spi = x->id.spi;
	id->sa_id.family = x->props.family;
	id->sa_id.proto = x->id.proto;
1585 1586
	memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
	id->reqid = x->props.reqid;
J
Jamal Hadi Salim 已提交
1587 1588
	id->flags = c->data.aevent;

1589 1590
	NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
	NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
J
Jamal Hadi Salim 已提交
1591

1592 1593
	if (id->flags & XFRM_AE_RTHR)
		NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
J
Jamal Hadi Salim 已提交
1594

1595 1596 1597
	if (id->flags & XFRM_AE_ETHR)
		NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
			    x->replay_maxage * 10 / HZ);
J
Jamal Hadi Salim 已提交
1598

1599 1600 1601
	if (xfrm_mark_put(skb, &x->mark))
		goto nla_put_failure;

1602
	return nlmsg_end(skb, nlh);
J
Jamal Hadi Salim 已提交
1603

1604
nla_put_failure:
1605 1606
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
J
Jamal Hadi Salim 已提交
1607 1608
}

1609
static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1610
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1611
{
1612
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1613 1614 1615 1616
	struct xfrm_state *x;
	struct sk_buff *r_skb;
	int err;
	struct km_event c;
1617 1618
	u32 mark;
	struct xfrm_mark m;
1619
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
1620 1621
	struct xfrm_usersa_id *id = &p->sa_id;

1622
	r_skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
1623 1624 1625
	if (r_skb == NULL)
		return -ENOMEM;

1626 1627 1628
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
J
Jamal Hadi Salim 已提交
1629
	if (x == NULL) {
P
Patrick McHardy 已提交
1630
		kfree_skb(r_skb);
J
Jamal Hadi Salim 已提交
1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645
		return -ESRCH;
	}

	/*
	 * XXX: is this lock really needed - none of the other
	 * gets lock (the concern is things getting updated
	 * while we are still reading) - jhs
	*/
	spin_lock_bh(&x->lock);
	c.data.aevent = p->flags;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;

	if (build_aevent(r_skb, x, &c) < 0)
		BUG();
1646
	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).pid);
J
Jamal Hadi Salim 已提交
1647 1648 1649 1650 1651
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1652
static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1653
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1654
{
1655
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1656 1657 1658
	struct xfrm_state *x;
	struct km_event c;
	int err = - EINVAL;
1659 1660
	u32 mark = 0;
	struct xfrm_mark m;
1661
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
1662 1663
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
J
Jamal Hadi Salim 已提交
1664 1665 1666 1667 1668 1669 1670 1671

	if (!lt && !rp)
		return err;

	/* pedantic mode - thou shalt sayeth replaceth */
	if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
		return err;

1672 1673 1674
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
J
Jamal Hadi Salim 已提交
1675 1676 1677 1678 1679 1680 1681
	if (x == NULL)
		return -ESRCH;

	if (x->km.state != XFRM_STATE_VALID)
		goto out;

	spin_lock_bh(&x->lock);
1682
	xfrm_update_ae_params(x, attrs);
J
Jamal Hadi Salim 已提交
1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695
	spin_unlock_bh(&x->lock);

	c.event = nlh->nlmsg_type;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	c.data.aevent = XFRM_AE_CU;
	km_state_notify(x, &c);
	err = 0;
out:
	xfrm_state_put(x);
	return err;
}

1696
static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1697
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1698
{
1699
	struct net *net = sock_net(skb->sk);
1700
	struct km_event c;
1701
	u8 type = XFRM_POLICY_TYPE_MAIN;
1702
	int err;
J
Joy Latten 已提交
1703
	struct xfrm_audit audit_info;
1704

1705
	err = copy_from_user_policy_type(&type, attrs);
1706 1707
	if (err)
		return err;
1708

J
Joy Latten 已提交
1709
	audit_info.loginuid = NETLINK_CB(skb).loginuid;
1710
	audit_info.sessionid = NETLINK_CB(skb).sessionid;
J
Joy Latten 已提交
1711
	audit_info.secid = NETLINK_CB(skb).sid;
1712
	err = xfrm_policy_flush(net, type, &audit_info);
1713 1714 1715
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1716
		return err;
1717 1718
	}

1719
	c.data.type = type;
1720
	c.event = nlh->nlmsg_type;
1721 1722
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1723
	c.net = net;
1724
	km_policy_notify(NULL, 0, &c);
L
Linus Torvalds 已提交
1725 1726 1727
	return 0;
}

1728
static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1729
		struct nlattr **attrs)
1730
{
1731
	struct net *net = sock_net(skb->sk);
1732
	struct xfrm_policy *xp;
1733
	struct xfrm_user_polexpire *up = nlmsg_data(nlh);
1734
	struct xfrm_userpolicy_info *p = &up->pol;
1735
	u8 type = XFRM_POLICY_TYPE_MAIN;
1736
	int err = -ENOENT;
1737 1738
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
1739

1740
	err = copy_from_user_policy_type(&type, attrs);
1741 1742 1743
	if (err)
		return err;

1744 1745 1746 1747
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

1748
	if (p->index)
1749
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
1750
	else {
1751
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1752
		struct xfrm_sec_ctx *ctx;
1753

1754
		err = verify_sec_ctx_len(attrs);
1755 1756 1757
		if (err)
			return err;

1758
		ctx = NULL;
1759
		if (rt) {
1760
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1761

1762 1763
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1764
				return err;
1765
		}
1766
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
1767
					   &p->sel, ctx, 0, &err);
1768
		security_xfrm_policy_free(ctx);
1769 1770
	}
	if (xp == NULL)
1771
		return -ENOENT;
1772

1773
	if (unlikely(xp->walk.dead))
1774 1775 1776 1777
		goto out;

	err = 0;
	if (up->hard) {
1778 1779 1780
		uid_t loginuid = NETLINK_CB(skb).loginuid;
		uid_t sessionid = NETLINK_CB(skb).sessionid;
		u32 sid = NETLINK_CB(skb).sid;
1781
		xfrm_policy_delete(xp, p->dir);
1782
		xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1783

1784 1785
	} else {
		// reset the timers here?
S
stephen hemminger 已提交
1786
		WARN(1, "Dont know what to do with soft policy expire\n");
1787 1788 1789 1790 1791 1792 1793 1794
	}
	km_policy_expired(xp, p->dir, up->hard, current->pid);

out:
	xfrm_pol_put(xp);
	return err;
}

1795
static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1796
		struct nlattr **attrs)
1797
{
1798
	struct net *net = sock_net(skb->sk);
1799 1800
	struct xfrm_state *x;
	int err;
1801
	struct xfrm_user_expire *ue = nlmsg_data(nlh);
1802
	struct xfrm_usersa_info *p = &ue->state;
1803 1804
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);;
1805

1806
	x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
1807

1808
	err = -ENOENT;
1809 1810 1811 1812
	if (x == NULL)
		return err;

	spin_lock_bh(&x->lock);
1813
	err = -EINVAL;
1814 1815 1816 1817
	if (x->km.state != XFRM_STATE_VALID)
		goto out;
	km_state_expired(x, ue->hard, current->pid);

J
Joy Latten 已提交
1818
	if (ue->hard) {
1819 1820 1821
		uid_t loginuid = NETLINK_CB(skb).loginuid;
		uid_t sessionid = NETLINK_CB(skb).sessionid;
		u32 sid = NETLINK_CB(skb).sid;
1822
		__xfrm_state_delete(x);
1823
		xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1824
	}
1825
	err = 0;
1826 1827 1828 1829 1830 1831
out:
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1832
static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
1833
		struct nlattr **attrs)
1834
{
1835
	struct net *net = sock_net(skb->sk);
1836 1837 1838
	struct xfrm_policy *xp;
	struct xfrm_user_tmpl *ut;
	int i;
1839
	struct nlattr *rt = attrs[XFRMA_TMPL];
1840
	struct xfrm_mark mark;
1841

1842
	struct xfrm_user_acquire *ua = nlmsg_data(nlh);
1843
	struct xfrm_state *x = xfrm_state_alloc(net);
1844 1845 1846
	int err = -ENOMEM;

	if (!x)
I
Ilpo Järvinen 已提交
1847
		goto nomem;
1848

1849 1850
	xfrm_mark_get(attrs, &mark);

1851
	err = verify_newpolicy_info(&ua->policy);
I
Ilpo Järvinen 已提交
1852 1853
	if (err)
		goto bad_policy;
1854 1855

	/*   build an XP */
1856
	xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
I
Ilpo Järvinen 已提交
1857 1858
	if (!xp)
		goto free_state;
1859 1860 1861 1862

	memcpy(&x->id, &ua->id, sizeof(ua->id));
	memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
	memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
1863 1864
	xp->mark.m = x->mark.m = mark.m;
	xp->mark.v = x->mark.v = mark.v;
1865
	ut = nla_data(rt);
1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883
	/* extract the templates and for each call km_key */
	for (i = 0; i < xp->xfrm_nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
		memcpy(&x->id, &t->id, sizeof(x->id));
		x->props.mode = t->mode;
		x->props.reqid = t->reqid;
		x->props.family = ut->family;
		t->aalgos = ua->aalgos;
		t->ealgos = ua->ealgos;
		t->calgos = ua->calgos;
		err = km_query(x, t, xp);

	}

	kfree(x);
	kfree(xp);

	return 0;
I
Ilpo Järvinen 已提交
1884 1885

bad_policy:
S
stephen hemminger 已提交
1886
	WARN(1, "BAD policy passed\n");
I
Ilpo Järvinen 已提交
1887 1888 1889 1890
free_state:
	kfree(x);
nomem:
	return err;
1891 1892
}

1893 1894
#ifdef CONFIG_XFRM_MIGRATE
static int copy_from_user_migrate(struct xfrm_migrate *ma,
1895
				  struct xfrm_kmaddress *k,
1896
				  struct nlattr **attrs, int *num)
1897
{
1898
	struct nlattr *rt = attrs[XFRMA_MIGRATE];
1899 1900 1901
	struct xfrm_user_migrate *um;
	int i, num_migrate;

1902 1903 1904 1905 1906 1907 1908 1909 1910 1911
	if (k != NULL) {
		struct xfrm_user_kmaddress *uk;

		uk = nla_data(attrs[XFRMA_KMADDRESS]);
		memcpy(&k->local, &uk->local, sizeof(k->local));
		memcpy(&k->remote, &uk->remote, sizeof(k->remote));
		k->family = uk->family;
		k->reserved = uk->reserved;
	}

1912 1913
	um = nla_data(rt);
	num_migrate = nla_len(rt) / sizeof(*um);
1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936

	if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < num_migrate; i++, um++, ma++) {
		memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
		memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
		memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
		memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));

		ma->proto = um->proto;
		ma->mode = um->mode;
		ma->reqid = um->reqid;

		ma->old_family = um->old_family;
		ma->new_family = um->new_family;
	}

	*num = i;
	return 0;
}

static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
1937
			   struct nlattr **attrs)
1938
{
1939
	struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
1940
	struct xfrm_migrate m[XFRM_MAX_DEPTH];
1941
	struct xfrm_kmaddress km, *kmp;
1942 1943 1944 1945
	u8 type;
	int err;
	int n = 0;

1946
	if (attrs[XFRMA_MIGRATE] == NULL)
1947
		return -EINVAL;
1948

1949 1950
	kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;

1951
	err = copy_from_user_policy_type(&type, attrs);
1952 1953 1954
	if (err)
		return err;

1955
	err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
1956 1957 1958 1959 1960 1961
	if (err)
		return err;

	if (!n)
		return 0;

1962
	xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
1963 1964 1965 1966 1967

	return 0;
}
#else
static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
1968
			   struct nlattr **attrs)
1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989
{
	return -ENOPROTOOPT;
}
#endif

#ifdef CONFIG_XFRM_MIGRATE
static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb)
{
	struct xfrm_user_migrate um;

	memset(&um, 0, sizeof(um));
	um.proto = m->proto;
	um.mode = m->mode;
	um.reqid = m->reqid;
	um.old_family = m->old_family;
	memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
	memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
	um.new_family = m->new_family;
	memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
	memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));

1990
	return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
1991 1992
}

1993 1994 1995 1996 1997 1998 1999 2000
static int copy_to_user_kmaddress(struct xfrm_kmaddress *k, struct sk_buff *skb)
{
	struct xfrm_user_kmaddress uk;

	memset(&uk, 0, sizeof(uk));
	uk.family = k->family;
	uk.reserved = k->reserved;
	memcpy(&uk.local, &k->local, sizeof(uk.local));
2001
	memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
2002 2003 2004 2005 2006

	return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
}

static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
2007 2008
{
	return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
2009 2010 2011
	      + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
	      + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
	      + userpolicy_type_attrsize();
2012 2013
}

2014
static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
2015 2016
			 int num_migrate, struct xfrm_kmaddress *k,
			 struct xfrm_selector *sel, u8 dir, u8 type)
2017 2018 2019 2020 2021 2022
{
	struct xfrm_migrate *mp;
	struct xfrm_userpolicy_id *pol_id;
	struct nlmsghdr *nlh;
	int i;

2023 2024 2025
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2026

2027
	pol_id = nlmsg_data(nlh);
2028 2029 2030 2031 2032
	/* copy data from selector, dir, and type to the pol_id */
	memset(pol_id, 0, sizeof(*pol_id));
	memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
	pol_id->dir = dir;

2033 2034 2035
	if (k != NULL && (copy_to_user_kmaddress(k, skb) < 0))
			goto nlmsg_failure;

2036 2037 2038 2039 2040 2041 2042 2043
	if (copy_to_user_policy_type(type, skb) < 0)
		goto nlmsg_failure;

	for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
		if (copy_to_user_migrate(mp, skb) < 0)
			goto nlmsg_failure;
	}

2044
	return nlmsg_end(skb, nlh);
2045
nlmsg_failure:
2046 2047
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
2048 2049 2050
}

static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2051 2052
			     struct xfrm_migrate *m, int num_migrate,
			     struct xfrm_kmaddress *k)
2053
{
2054
	struct net *net = &init_net;
2055 2056
	struct sk_buff *skb;

2057
	skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
2058 2059 2060 2061
	if (skb == NULL)
		return -ENOMEM;

	/* build migrate */
2062
	if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
2063 2064
		BUG();

2065
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
2066 2067 2068
}
#else
static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
2069 2070
			     struct xfrm_migrate *m, int num_migrate,
			     struct xfrm_kmaddress *k)
2071 2072 2073 2074
{
	return -ENOPROTOOPT;
}
#endif
J
Jamal Hadi Salim 已提交
2075

2076
#define XMSGSIZE(type) sizeof(struct type)
2077 2078

static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
2079
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2080 2081 2082 2083 2084 2085
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
2086
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
2087
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
2088
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2089
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2090
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
2091
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
2092
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
J
Jamal Hadi Salim 已提交
2093 2094
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2095
	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
2096
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2097 2098
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
L
Linus Torvalds 已提交
2099 2100
};

2101 2102
#undef XMSGSIZE

2103
static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
J
jamal 已提交
2104 2105 2106 2107
	[XFRMA_SA]		= { .len = sizeof(struct xfrm_usersa_info)},
	[XFRMA_POLICY]		= { .len = sizeof(struct xfrm_userpolicy_info)},
	[XFRMA_LASTUSED]	= { .type = NLA_U64},
	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
2108
	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122
	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_sec_ctx) },
	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
2123
	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
2124
	[XFRMA_MARK]		= { .len = sizeof(struct xfrm_mark) },
2125 2126
};

L
Linus Torvalds 已提交
2127
static struct xfrm_link {
2128
	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
L
Linus Torvalds 已提交
2129
	int (*dump)(struct sk_buff *, struct netlink_callback *);
2130
	int (*done)(struct netlink_callback *);
2131 2132 2133 2134
} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
2135 2136
						   .dump = xfrm_dump_sa,
						   .done = xfrm_dump_sa_done  },
2137 2138 2139
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
2140 2141
						   .dump = xfrm_dump_policy,
						   .done = xfrm_dump_policy_done },
2142
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
2143
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
2144
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
2145 2146
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
2147
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
2148 2149
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
J
Jamal Hadi Salim 已提交
2150 2151
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = { .doit = xfrm_new_ae  },
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = { .doit = xfrm_get_ae  },
2152
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate    },
2153
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo   },
J
Jamal Hadi Salim 已提交
2154
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo   },
L
Linus Torvalds 已提交
2155 2156
};

2157
static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
2158
{
2159
	struct net *net = sock_net(skb->sk);
2160
	struct nlattr *attrs[XFRMA_MAX+1];
L
Linus Torvalds 已提交
2161
	struct xfrm_link *link;
2162
	int type, err;
L
Linus Torvalds 已提交
2163 2164 2165

	type = nlh->nlmsg_type;
	if (type > XFRM_MSG_MAX)
2166
		return -EINVAL;
L
Linus Torvalds 已提交
2167 2168 2169 2170 2171

	type -= XFRM_MSG_BASE;
	link = &xfrm_dispatch[type];

	/* All operations require privileges, even GET */
2172 2173
	if (security_netlink_recv(skb, CAP_NET_ADMIN))
		return -EPERM;
L
Linus Torvalds 已提交
2174

2175 2176 2177
	if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
	     type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
	    (nlh->nlmsg_flags & NLM_F_DUMP)) {
L
Linus Torvalds 已提交
2178
		if (link->dump == NULL)
2179
			return -EINVAL;
2180

2181
		return netlink_dump_start(net->xfrm.nlsk, skb, nlh, link->dump, link->done);
L
Linus Torvalds 已提交
2182 2183
	}

2184
	err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
2185
			  xfrma_policy);
2186 2187
	if (err < 0)
		return err;
L
Linus Torvalds 已提交
2188 2189

	if (link->doit == NULL)
2190
		return -EINVAL;
L
Linus Torvalds 已提交
2191

2192
	return link->doit(skb, nlh, attrs);
L
Linus Torvalds 已提交
2193 2194
}

2195
static void xfrm_netlink_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
2196
{
2197 2198 2199
	mutex_lock(&xfrm_cfg_mutex);
	netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
	mutex_unlock(&xfrm_cfg_mutex);
L
Linus Torvalds 已提交
2200 2201
}

2202 2203
static inline size_t xfrm_expire_msgsize(void)
{
2204 2205
	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
	       + nla_total_size(sizeof(struct xfrm_mark));
2206 2207
}

J
Jamal Hadi Salim 已提交
2208
static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
L
Linus Torvalds 已提交
2209 2210 2211 2212
{
	struct xfrm_user_expire *ue;
	struct nlmsghdr *nlh;

2213 2214 2215
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2216

2217
	ue = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2218
	copy_to_user_state(x, &ue->state);
J
Jamal Hadi Salim 已提交
2219
	ue->hard = (c->data.hard != 0) ? 1 : 0;
L
Linus Torvalds 已提交
2220

2221 2222 2223
	if (xfrm_mark_put(skb, &x->mark))
		goto nla_put_failure;

2224
	return nlmsg_end(skb, nlh);
2225 2226 2227

nla_put_failure:
	return -EMSGSIZE;
L
Linus Torvalds 已提交
2228 2229
}

2230
static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
L
Linus Torvalds 已提交
2231
{
2232
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2233 2234
	struct sk_buff *skb;

2235
	skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
L
Linus Torvalds 已提交
2236 2237 2238
	if (skb == NULL)
		return -ENOMEM;

2239 2240 2241 2242
	if (build_expire(skb, x, c) < 0) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
L
Linus Torvalds 已提交
2243

2244
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2245 2246
}

J
Jamal Hadi Salim 已提交
2247 2248
static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c)
{
2249
	struct net *net = xs_net(x);
J
Jamal Hadi Salim 已提交
2250 2251
	struct sk_buff *skb;

2252
	skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2253 2254 2255 2256 2257 2258
	if (skb == NULL)
		return -ENOMEM;

	if (build_aevent(skb, x, c) < 0)
		BUG();

2259
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2260 2261
}

2262 2263
static int xfrm_notify_sa_flush(struct km_event *c)
{
2264
	struct net *net = c->net;
2265 2266 2267
	struct xfrm_usersa_flush *p;
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2268
	int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
2269

2270
	skb = nlmsg_new(len, GFP_ATOMIC);
2271 2272 2273
	if (skb == NULL)
		return -ENOMEM;

2274 2275 2276 2277 2278
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
	if (nlh == NULL) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
2279

2280
	p = nlmsg_data(nlh);
2281
	p->proto = c->data.proto;
2282

2283
	nlmsg_end(skb, nlh);
2284

2285
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2286 2287
}

2288
static inline size_t xfrm_sa_len(struct xfrm_state *x)
2289
{
2290
	size_t l = 0;
2291 2292
	if (x->aead)
		l += nla_total_size(aead_len(x->aead));
2293 2294 2295 2296 2297
	if (x->aalg) {
		l += nla_total_size(sizeof(struct xfrm_algo) +
				    (x->aalg->alg_key_len + 7) / 8);
		l += nla_total_size(xfrm_alg_auth_len(x->aalg));
	}
2298
	if (x->ealg)
2299
		l += nla_total_size(xfrm_alg_len(x->ealg));
2300
	if (x->calg)
2301
		l += nla_total_size(sizeof(*x->calg));
2302
	if (x->encap)
2303
		l += nla_total_size(sizeof(*x->encap));
2304 2305 2306 2307 2308 2309
	if (x->security)
		l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
				    x->security->ctx_len);
	if (x->coaddr)
		l += nla_total_size(sizeof(*x->coaddr));

2310 2311
	/* Must count x->lastused as it may become non-zero behind our back. */
	l += nla_total_size(sizeof(u64));
2312 2313 2314 2315 2316 2317

	return l;
}

static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
{
2318
	struct net *net = xs_net(x);
2319
	struct xfrm_usersa_info *p;
2320
	struct xfrm_usersa_id *id;
2321 2322 2323
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
	int len = xfrm_sa_len(x);
2324 2325 2326 2327
	int headlen;

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELSA) {
2328
		len += nla_total_size(headlen);
2329
		headlen = sizeof(*id);
2330
		len += nla_total_size(sizeof(struct xfrm_mark));
2331
	}
2332
	len += NLMSG_ALIGN(headlen);
2333

2334
	skb = nlmsg_new(len, GFP_ATOMIC);
2335 2336 2337
	if (skb == NULL)
		return -ENOMEM;

2338 2339
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
	if (nlh == NULL)
2340
		goto nla_put_failure;
2341

2342
	p = nlmsg_data(nlh);
2343
	if (c->event == XFRM_MSG_DELSA) {
2344 2345
		struct nlattr *attr;

2346
		id = nlmsg_data(nlh);
2347 2348 2349 2350 2351
		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
		id->spi = x->id.spi;
		id->family = x->props.family;
		id->proto = x->id.proto;

2352 2353 2354 2355 2356
		attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
		if (attr == NULL)
			goto nla_put_failure;

		p = nla_data(attr);
2357 2358
	}

2359 2360
	if (copy_to_user_state_extra(x, p, skb))
		goto nla_put_failure;
2361

2362
	nlmsg_end(skb, nlh);
2363

2364
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2365

2366
nla_put_failure:
2367 2368
	/* Somebody screwed up with xfrm_sa_len! */
	WARN_ON(1);
2369 2370 2371 2372 2373 2374 2375 2376
	kfree_skb(skb);
	return -1;
}

static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c)
{

	switch (c->event) {
2377
	case XFRM_MSG_EXPIRE:
2378
		return xfrm_exp_state_notify(x, c);
J
Jamal Hadi Salim 已提交
2379 2380
	case XFRM_MSG_NEWAE:
		return xfrm_aevent_state_notify(x, c);
2381 2382 2383
	case XFRM_MSG_DELSA:
	case XFRM_MSG_UPDSA:
	case XFRM_MSG_NEWSA:
2384
		return xfrm_notify_sa(x, c);
2385
	case XFRM_MSG_FLUSHSA:
2386 2387
		return xfrm_notify_sa_flush(c);
	default:
S
stephen hemminger 已提交
2388 2389 2390
		printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
		       c->event);
		break;
2391 2392 2393 2394 2395 2396
	}

	return 0;

}

2397 2398 2399 2400 2401
static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
					  struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2402
	       + nla_total_size(sizeof(struct xfrm_mark))
2403 2404 2405 2406
	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2407 2408 2409 2410 2411 2412 2413 2414
static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
			 struct xfrm_tmpl *xt, struct xfrm_policy *xp,
			 int dir)
{
	struct xfrm_user_acquire *ua;
	struct nlmsghdr *nlh;
	__u32 seq = xfrm_get_acqseq();

2415 2416 2417
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2418

2419
	ua = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430
	memcpy(&ua->id, &x->id, sizeof(ua->id));
	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
	copy_to_user_policy(xp, &ua->policy, dir);
	ua->aalgos = xt->aalgos;
	ua->ealgos = xt->ealgos;
	ua->calgos = xt->calgos;
	ua->seq = x->km.seq = seq;

	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
2431
	if (copy_to_user_state_sec_ctx(x, skb))
2432
		goto nlmsg_failure;
2433
	if (copy_to_user_policy_type(xp->type, skb) < 0)
2434
		goto nlmsg_failure;
2435 2436
	if (xfrm_mark_put(skb, &xp->mark))
		goto nla_put_failure;
L
Linus Torvalds 已提交
2437

2438
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2439

2440
nla_put_failure:
L
Linus Torvalds 已提交
2441
nlmsg_failure:
2442 2443
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
2444 2445 2446 2447 2448
}

static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
			     struct xfrm_policy *xp, int dir)
{
2449
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2450 2451
	struct sk_buff *skb;

2452
	skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2453 2454 2455 2456 2457 2458
	if (skb == NULL)
		return -ENOMEM;

	if (build_acquire(skb, x, xt, xp, dir) < 0)
		BUG();

2459
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2460 2461 2462 2463 2464
}

/* User gives us xfrm_user_policy_info followed by an array of 0
 * or more templates.
 */
2465
static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
L
Linus Torvalds 已提交
2466 2467
					       u8 *data, int len, int *dir)
{
2468
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
2469 2470 2471 2472 2473
	struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
	struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
	struct xfrm_policy *xp;
	int nr;

2474
	switch (sk->sk_family) {
L
Linus Torvalds 已提交
2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500
	case AF_INET:
		if (opt != IP_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
	case AF_INET6:
		if (opt != IPV6_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
#endif
	default:
		*dir = -EINVAL;
		return NULL;
	}

	*dir = -EINVAL;

	if (len < sizeof(*p) ||
	    verify_newpolicy_info(p))
		return NULL;

	nr = ((len - sizeof(*p)) / sizeof(*ut));
2501
	if (validate_tmpl(nr, ut, p->sel.family))
L
Linus Torvalds 已提交
2502 2503
		return NULL;

2504 2505 2506
	if (p->dir > XFRM_POLICY_OUT)
		return NULL;

2507
	xp = xfrm_policy_alloc(net, GFP_ATOMIC);
L
Linus Torvalds 已提交
2508 2509 2510 2511 2512 2513
	if (xp == NULL) {
		*dir = -ENOBUFS;
		return NULL;
	}

	copy_from_user_policy(xp, p);
2514
	xp->type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
2515 2516 2517 2518 2519 2520 2521
	copy_templates(xp, ut, nr);

	*dir = p->dir;

	return xp;
}

2522 2523 2524 2525 2526
static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
2527
	       + nla_total_size(sizeof(struct xfrm_mark))
2528 2529 2530
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2531
static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
J
Jamal Hadi Salim 已提交
2532
			   int dir, struct km_event *c)
L
Linus Torvalds 已提交
2533 2534 2535
{
	struct xfrm_user_polexpire *upe;
	struct nlmsghdr *nlh;
J
Jamal Hadi Salim 已提交
2536
	int hard = c->data.hard;
L
Linus Torvalds 已提交
2537

2538 2539 2540
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2541

2542
	upe = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2543 2544 2545
	copy_to_user_policy(xp, &upe->pol, dir);
	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
2546 2547
	if (copy_to_user_sec_ctx(xp, skb))
		goto nlmsg_failure;
2548
	if (copy_to_user_policy_type(xp->type, skb) < 0)
2549
		goto nlmsg_failure;
2550 2551
	if (xfrm_mark_put(skb, &xp->mark))
		goto nla_put_failure;
L
Linus Torvalds 已提交
2552 2553
	upe->hard = !!hard;

2554
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2555

2556
nla_put_failure:
L
Linus Torvalds 已提交
2557
nlmsg_failure:
2558 2559
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
2560 2561
}

2562
static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
L
Linus Torvalds 已提交
2563
{
2564
	struct net *net = xp_net(xp);
L
Linus Torvalds 已提交
2565 2566
	struct sk_buff *skb;

2567
	skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2568 2569 2570
	if (skb == NULL)
		return -ENOMEM;

J
Jamal Hadi Salim 已提交
2571
	if (build_polexpire(skb, xp, dir, c) < 0)
L
Linus Torvalds 已提交
2572 2573
		BUG();

2574
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2575 2576
}

2577 2578
static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
{
2579
	struct net *net = xp_net(xp);
2580
	struct xfrm_userpolicy_info *p;
2581
	struct xfrm_userpolicy_id *id;
2582 2583
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2584
	int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2585 2586 2587 2588
	int headlen;

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELPOLICY) {
2589
		len += nla_total_size(headlen);
2590 2591
		headlen = sizeof(*id);
	}
2592
	len += userpolicy_type_attrsize();
2593
	len += nla_total_size(sizeof(struct xfrm_mark));
2594
	len += NLMSG_ALIGN(headlen);
2595

2596
	skb = nlmsg_new(len, GFP_ATOMIC);
2597 2598 2599
	if (skb == NULL)
		return -ENOMEM;

2600 2601 2602
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
	if (nlh == NULL)
		goto nlmsg_failure;
2603

2604
	p = nlmsg_data(nlh);
2605
	if (c->event == XFRM_MSG_DELPOLICY) {
2606 2607
		struct nlattr *attr;

2608
		id = nlmsg_data(nlh);
2609 2610 2611 2612 2613 2614 2615
		memset(id, 0, sizeof(*id));
		id->dir = dir;
		if (c->data.byid)
			id->index = xp->index;
		else
			memcpy(&id->sel, &xp->selector, sizeof(id->sel));

2616 2617 2618 2619 2620
		attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
		if (attr == NULL)
			goto nlmsg_failure;

		p = nla_data(attr);
2621
	}
2622 2623 2624 2625

	copy_to_user_policy(xp, p, dir);
	if (copy_to_user_tmpl(xp, skb) < 0)
		goto nlmsg_failure;
2626
	if (copy_to_user_policy_type(xp->type, skb) < 0)
2627
		goto nlmsg_failure;
2628

2629 2630 2631
	if (xfrm_mark_put(skb, &xp->mark))
		goto nla_put_failure;

2632
	nlmsg_end(skb, nlh);
2633

2634
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2635

2636
nla_put_failure:
2637 2638 2639 2640 2641 2642 2643
nlmsg_failure:
	kfree_skb(skb);
	return -1;
}

static int xfrm_notify_policy_flush(struct km_event *c)
{
2644
	struct net *net = c->net;
2645 2646 2647
	struct nlmsghdr *nlh;
	struct sk_buff *skb;

2648
	skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
2649 2650 2651
	if (skb == NULL)
		return -ENOMEM;

2652 2653 2654
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
	if (nlh == NULL)
		goto nlmsg_failure;
2655 2656
	if (copy_to_user_policy_type(c->data.type, skb) < 0)
		goto nlmsg_failure;
2657

2658
	nlmsg_end(skb, nlh);
2659

2660
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2661 2662 2663 2664 2665 2666 2667 2668 2669 2670

nlmsg_failure:
	kfree_skb(skb);
	return -1;
}

static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
{

	switch (c->event) {
2671 2672 2673
	case XFRM_MSG_NEWPOLICY:
	case XFRM_MSG_UPDPOLICY:
	case XFRM_MSG_DELPOLICY:
2674
		return xfrm_notify_policy(xp, dir, c);
2675
	case XFRM_MSG_FLUSHPOLICY:
2676
		return xfrm_notify_policy_flush(c);
2677
	case XFRM_MSG_POLEXPIRE:
2678 2679
		return xfrm_exp_policy_notify(xp, dir, c);
	default:
S
stephen hemminger 已提交
2680 2681
		printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
		       c->event);
2682 2683 2684 2685 2686 2687
	}

	return 0;

}

2688 2689 2690 2691 2692
static inline size_t xfrm_report_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
}

2693 2694 2695 2696 2697 2698
static int build_report(struct sk_buff *skb, u8 proto,
			struct xfrm_selector *sel, xfrm_address_t *addr)
{
	struct xfrm_user_report *ur;
	struct nlmsghdr *nlh;

2699 2700 2701
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2702

2703
	ur = nlmsg_data(nlh);
2704 2705 2706 2707
	ur->proto = proto;
	memcpy(&ur->sel, sel, sizeof(ur->sel));

	if (addr)
2708
		NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
2709

2710
	return nlmsg_end(skb, nlh);
2711

2712
nla_put_failure:
2713 2714
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
2715 2716
}

2717 2718
static int xfrm_send_report(struct net *net, u8 proto,
			    struct xfrm_selector *sel, xfrm_address_t *addr)
2719 2720 2721
{
	struct sk_buff *skb;

2722
	skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
2723 2724 2725 2726 2727 2728
	if (skb == NULL)
		return -ENOMEM;

	if (build_report(skb, proto, sel, addr) < 0)
		BUG();

2729
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
2730 2731
}

2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764
static inline size_t xfrm_mapping_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
}

static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
			 xfrm_address_t *new_saddr, __be16 new_sport)
{
	struct xfrm_user_mapping *um;
	struct nlmsghdr *nlh;

	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
	if (nlh == NULL)
		return -EMSGSIZE;

	um = nlmsg_data(nlh);

	memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
	um->id.spi = x->id.spi;
	um->id.family = x->props.family;
	um->id.proto = x->id.proto;
	memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
	memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
	um->new_sport = new_sport;
	um->old_sport = x->encap->encap_sport;
	um->reqid = x->props.reqid;

	return nlmsg_end(skb, nlh);
}

static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
			     __be16 sport)
{
2765
	struct net *net = xs_net(x);
2766 2767 2768 2769 2770 2771 2772 2773 2774 2775 2776 2777 2778 2779 2780
	struct sk_buff *skb;

	if (x->id.proto != IPPROTO_ESP)
		return -EINVAL;

	if (!x->encap)
		return -EINVAL;

	skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
	if (skb == NULL)
		return -ENOMEM;

	if (build_mapping(skb, x, ipaddr, sport) < 0)
		BUG();

2781
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
2782 2783
}

L
Linus Torvalds 已提交
2784 2785 2786 2787 2788 2789
static struct xfrm_mgr netlink_mgr = {
	.id		= "netlink",
	.notify		= xfrm_send_state_notify,
	.acquire	= xfrm_send_acquire,
	.compile_policy	= xfrm_compile_policy,
	.notify_policy	= xfrm_send_policy_notify,
2790
	.report		= xfrm_send_report,
2791
	.migrate	= xfrm_send_migrate,
2792
	.new_mapping	= xfrm_send_mapping,
L
Linus Torvalds 已提交
2793 2794
};

2795
static int __net_init xfrm_user_net_init(struct net *net)
L
Linus Torvalds 已提交
2796
{
2797 2798
	struct sock *nlsk;

2799
	nlsk = netlink_kernel_create(net, NETLINK_XFRM, XFRMNLGRP_MAX,
2800
				     xfrm_netlink_rcv, NULL, THIS_MODULE);
2801
	if (nlsk == NULL)
L
Linus Torvalds 已提交
2802
		return -ENOMEM;
2803
	net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
2804
	rcu_assign_pointer(net->xfrm.nlsk, nlsk);
L
Linus Torvalds 已提交
2805 2806 2807
	return 0;
}

2808
static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
L
Linus Torvalds 已提交
2809
{
2810 2811 2812 2813 2814 2815
	struct net *net;
	list_for_each_entry(net, net_exit_list, exit_list)
		rcu_assign_pointer(net->xfrm.nlsk, NULL);
	synchronize_net();
	list_for_each_entry(net, net_exit_list, exit_list)
		netlink_kernel_release(net->xfrm.nlsk_stash);
L
Linus Torvalds 已提交
2816 2817
}

2818
static struct pernet_operations xfrm_user_net_ops = {
2819 2820
	.init	    = xfrm_user_net_init,
	.exit_batch = xfrm_user_net_exit,
2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843
};

static int __init xfrm_user_init(void)
{
	int rv;

	printk(KERN_INFO "Initializing XFRM netlink socket\n");

	rv = register_pernet_subsys(&xfrm_user_net_ops);
	if (rv < 0)
		return rv;
	rv = xfrm_register_km(&netlink_mgr);
	if (rv < 0)
		unregister_pernet_subsys(&xfrm_user_net_ops);
	return rv;
}

static void __exit xfrm_user_exit(void)
{
	xfrm_unregister_km(&netlink_mgr);
	unregister_pernet_subsys(&xfrm_user_net_ops);
}

L
Linus Torvalds 已提交
2844 2845 2846
module_init(xfrm_user_init);
module_exit(xfrm_user_exit);
MODULE_LICENSE("GPL");
2847
MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
2848