xfrm_user.c 69.2 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9
/* xfrm_user.c: User interface to configure xfrm engine.
 *
 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
 *
 * Changes:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
10
 *
L
Linus Torvalds 已提交
11 12
 */

13
#include <linux/crypto.h>
L
Linus Torvalds 已提交
14 15 16 17 18 19 20 21 22 23 24 25 26 27
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/socket.h>
#include <linux/string.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/pfkeyv2.h>
#include <linux/ipsec.h>
#include <linux/init.h>
#include <linux/security.h>
#include <net/sock.h>
#include <net/xfrm.h>
28
#include <net/netlink.h>
29
#include <net/ah.h>
L
Linus Torvalds 已提交
30
#include <asm/uaccess.h>
E
Eric Dumazet 已提交
31
#if IS_ENABLED(CONFIG_IPV6)
32 33
#include <linux/in6.h>
#endif
L
Linus Torvalds 已提交
34

35 36 37 38 39
static inline int aead_len(struct xfrm_algo_aead *alg)
{
	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
}

40
static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
L
Linus Torvalds 已提交
41
{
42
	struct nlattr *rt = attrs[type];
L
Linus Torvalds 已提交
43 44 45 46 47
	struct xfrm_algo *algp;

	if (!rt)
		return 0;

48
	algp = nla_data(rt);
49
	if (nla_len(rt) < xfrm_alg_len(algp))
50 51
		return -EINVAL;

L
Linus Torvalds 已提交
52 53 54 55 56 57 58 59
	switch (type) {
	case XFRMA_ALG_AUTH:
	case XFRMA_ALG_CRYPT:
	case XFRMA_ALG_COMP:
		break;

	default:
		return -EINVAL;
60
	}
L
Linus Torvalds 已提交
61 62 63 64 65

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81
static int verify_auth_trunc(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
	struct xfrm_algo_auth *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < xfrm_alg_auth_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97
static int verify_aead(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
	struct xfrm_algo_aead *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < aead_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

98
static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
99 100
			   xfrm_address_t **addrp)
{
101
	struct nlattr *rt = attrs[type];
102

103
	if (rt && addrp)
104
		*addrp = nla_data(rt);
105
}
106

107
static inline int verify_sec_ctx_len(struct nlattr **attrs)
108
{
109
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
110 111 112 113 114
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

115
	uctx = nla_data(rt);
116
	if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
117 118 119 120 121
		return -EINVAL;

	return 0;
}

122 123 124 125 126
static inline int verify_replay(struct xfrm_usersa_info *p,
				struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];

127 128 129
	if ((p->flags & XFRM_STATE_ESN) && !rt)
		return -EINVAL;

130 131 132
	if (!rt)
		return 0;

133 134 135
	if (p->id.proto != IPPROTO_ESP)
		return -EINVAL;

136 137 138 139 140
	if (p->replay_window != 0)
		return -EINVAL;

	return 0;
}
141

L
Linus Torvalds 已提交
142
static int verify_newsa_info(struct xfrm_usersa_info *p,
143
			     struct nlattr **attrs)
L
Linus Torvalds 已提交
144 145 146 147 148 149 150 151 152
{
	int err;

	err = -EINVAL;
	switch (p->family) {
	case AF_INET:
		break;

	case AF_INET6:
E
Eric Dumazet 已提交
153
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
154 155 156 157 158 159 160 161
		break;
#else
		err = -EAFNOSUPPORT;
		goto out;
#endif

	default:
		goto out;
162
	}
L
Linus Torvalds 已提交
163 164 165 166

	err = -EINVAL;
	switch (p->id.proto) {
	case IPPROTO_AH:
167 168
		if ((!attrs[XFRMA_ALG_AUTH]	&&
		     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
169
		    attrs[XFRMA_ALG_AEAD]	||
170
		    attrs[XFRMA_ALG_CRYPT]	||
171 172
		    attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_TFCPAD])
L
Linus Torvalds 已提交
173 174 175 176
			goto out;
		break;

	case IPPROTO_ESP:
177 178 179
		if (attrs[XFRMA_ALG_COMP])
			goto out;
		if (!attrs[XFRMA_ALG_AUTH] &&
180
		    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
181 182 183 184
		    !attrs[XFRMA_ALG_CRYPT] &&
		    !attrs[XFRMA_ALG_AEAD])
			goto out;
		if ((attrs[XFRMA_ALG_AUTH] ||
185
		     attrs[XFRMA_ALG_AUTH_TRUNC] ||
186 187
		     attrs[XFRMA_ALG_CRYPT]) &&
		    attrs[XFRMA_ALG_AEAD])
L
Linus Torvalds 已提交
188
			goto out;
189 190 191
		if (attrs[XFRMA_TFCPAD] &&
		    p->mode != XFRM_MODE_TUNNEL)
			goto out;
L
Linus Torvalds 已提交
192 193 194
		break;

	case IPPROTO_COMP:
195
		if (!attrs[XFRMA_ALG_COMP]	||
196
		    attrs[XFRMA_ALG_AEAD]	||
197
		    attrs[XFRMA_ALG_AUTH]	||
198
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
199 200
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_TFCPAD])
L
Linus Torvalds 已提交
201 202 203
			goto out;
		break;

E
Eric Dumazet 已提交
204
#if IS_ENABLED(CONFIG_IPV6)
205 206
	case IPPROTO_DSTOPTS:
	case IPPROTO_ROUTING:
207 208
		if (attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_ALG_AUTH]	||
209
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
210
		    attrs[XFRMA_ALG_AEAD]	||
211 212 213
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_ENCAP]		||
		    attrs[XFRMA_SEC_CTX]	||
214
		    attrs[XFRMA_TFCPAD]		||
215
		    !attrs[XFRMA_COADDR])
216 217 218 219
			goto out;
		break;
#endif

L
Linus Torvalds 已提交
220 221
	default:
		goto out;
222
	}
L
Linus Torvalds 已提交
223

224 225
	if ((err = verify_aead(attrs)))
		goto out;
226 227
	if ((err = verify_auth_trunc(attrs)))
		goto out;
228
	if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
L
Linus Torvalds 已提交
229
		goto out;
230
	if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
L
Linus Torvalds 已提交
231
		goto out;
232
	if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
L
Linus Torvalds 已提交
233
		goto out;
234
	if ((err = verify_sec_ctx_len(attrs)))
235
		goto out;
236 237
	if ((err = verify_replay(p, attrs)))
		goto out;
L
Linus Torvalds 已提交
238 239 240

	err = -EINVAL;
	switch (p->mode) {
241 242
	case XFRM_MODE_TRANSPORT:
	case XFRM_MODE_TUNNEL:
243
	case XFRM_MODE_ROUTEOPTIMIZATION:
D
Diego Beltrami 已提交
244
	case XFRM_MODE_BEET:
L
Linus Torvalds 已提交
245 246 247 248
		break;

	default:
		goto out;
249
	}
L
Linus Torvalds 已提交
250 251 252 253 254 255 256 257

	err = 0;

out:
	return err;
}

static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
258
			   struct xfrm_algo_desc *(*get_byname)(const char *, int),
259
			   struct nlattr *rta)
L
Linus Torvalds 已提交
260 261 262 263 264 265 266
{
	struct xfrm_algo *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

267
	ualg = nla_data(rta);
L
Linus Torvalds 已提交
268 269 270 271 272 273

	algo = get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

274
	p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
L
Linus Torvalds 已提交
275 276 277
	if (!p)
		return -ENOMEM;

278
	strcpy(p->alg_name, algo->name);
L
Linus Torvalds 已提交
279 280 281 282
	*algpp = p;
	return 0;
}

283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326
static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo *ualg;
	struct xfrm_algo_auth *p;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	p->alg_key_len = ualg->alg_key_len;
	p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
	memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);

	*algpp = p;
	return 0;
}

static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
			     struct nlattr *rta)
{
	struct xfrm_algo_auth *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
327 328
	if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
	    ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
329 330 331 332 333 334 335 336 337 338 339 340 341 342 343
		return -EINVAL;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	if (!p->alg_trunc_len)
		p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;

	*algpp = p;
	return 0;
}

344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368
static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo_aead *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	*algpp = p;
	return 0;
}

369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385
static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
					 struct nlattr *rp)
{
	struct xfrm_replay_state_esn *up;

	if (!replay_esn || !rp)
		return 0;

	up = nla_data(rp);

	if (xfrm_replay_state_esn_len(replay_esn) !=
			xfrm_replay_state_esn_len(up))
		return -EINVAL;

	return 0;
}

386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412
static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
				       struct xfrm_replay_state_esn **preplay_esn,
				       struct nlattr *rta)
{
	struct xfrm_replay_state_esn *p, *pp, *up;

	if (!rta)
		return 0;

	up = nla_data(rta);

	p = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	pp = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
	if (!pp) {
		kfree(p);
		return -ENOMEM;
	}

	*replay_esn = p;
	*preplay_esn = pp;

	return 0;
}

413
static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
414 415 416 417 418 419 420 421 422 423
{
	int len = 0;

	if (xfrm_ctx) {
		len += sizeof(struct xfrm_user_sec_ctx);
		len += xfrm_ctx->ctx_len;
	}
	return len;
}

L
Linus Torvalds 已提交
424 425 426 427 428 429 430 431 432
static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&x->id, &p->id, sizeof(x->id));
	memcpy(&x->sel, &p->sel, sizeof(x->sel));
	memcpy(&x->lft, &p->lft, sizeof(x->lft));
	x->props.mode = p->mode;
	x->props.replay_window = p->replay_window;
	x->props.reqid = p->reqid;
	x->props.family = p->family;
433
	memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
L
Linus Torvalds 已提交
434
	x->props.flags = p->flags;
435

436
	if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
437
		x->sel.family = p->family;
L
Linus Torvalds 已提交
438 439
}

J
Jamal Hadi Salim 已提交
440 441 442 443 444
/*
 * someday when pfkey also has support, we could have the code
 * somehow made shareable and move it to xfrm_state.c - JHS
 *
*/
445
static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
446
{
447
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
448
	struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
449 450 451
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
J
Jamal Hadi Salim 已提交
452

453 454 455 456 457 458 459 460 461
	if (re) {
		struct xfrm_replay_state_esn *replay_esn;
		replay_esn = nla_data(re);
		memcpy(x->replay_esn, replay_esn,
		       xfrm_replay_state_esn_len(replay_esn));
		memcpy(x->preplay_esn, replay_esn,
		       xfrm_replay_state_esn_len(replay_esn));
	}

J
Jamal Hadi Salim 已提交
462 463
	if (rp) {
		struct xfrm_replay_state *replay;
464
		replay = nla_data(rp);
J
Jamal Hadi Salim 已提交
465 466 467 468 469 470
		memcpy(&x->replay, replay, sizeof(*replay));
		memcpy(&x->preplay, replay, sizeof(*replay));
	}

	if (lt) {
		struct xfrm_lifetime_cur *ltime;
471
		ltime = nla_data(lt);
J
Jamal Hadi Salim 已提交
472 473 474 475 476 477
		x->curlft.bytes = ltime->bytes;
		x->curlft.packets = ltime->packets;
		x->curlft.add_time = ltime->add_time;
		x->curlft.use_time = ltime->use_time;
	}

478
	if (et)
479
		x->replay_maxage = nla_get_u32(et);
J
Jamal Hadi Salim 已提交
480

481
	if (rt)
482
		x->replay_maxdiff = nla_get_u32(rt);
J
Jamal Hadi Salim 已提交
483 484
}

485 486
static struct xfrm_state *xfrm_state_construct(struct net *net,
					       struct xfrm_usersa_info *p,
487
					       struct nlattr **attrs,
L
Linus Torvalds 已提交
488 489
					       int *errp)
{
490
	struct xfrm_state *x = xfrm_state_alloc(net);
L
Linus Torvalds 已提交
491 492 493 494 495 496 497
	int err = -ENOMEM;

	if (!x)
		goto error_no_put;

	copy_from_user_state(x, p);

498 499 500
	if ((err = attach_aead(&x->aead, &x->props.ealgo,
			       attrs[XFRMA_ALG_AEAD])))
		goto error;
501 502
	if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
				     attrs[XFRMA_ALG_AUTH_TRUNC])))
L
Linus Torvalds 已提交
503
		goto error;
504 505 506 507 508
	if (!x->props.aalgo) {
		if ((err = attach_auth(&x->aalg, &x->props.aalgo,
				       attrs[XFRMA_ALG_AUTH])))
			goto error;
	}
L
Linus Torvalds 已提交
509 510
	if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
				   xfrm_ealg_get_byname,
511
				   attrs[XFRMA_ALG_CRYPT])))
L
Linus Torvalds 已提交
512 513 514
		goto error;
	if ((err = attach_one_algo(&x->calg, &x->props.calgo,
				   xfrm_calg_get_byname,
515
				   attrs[XFRMA_ALG_COMP])))
L
Linus Torvalds 已提交
516
		goto error;
517 518 519 520 521 522 523 524

	if (attrs[XFRMA_ENCAP]) {
		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
				   sizeof(*x->encap), GFP_KERNEL);
		if (x->encap == NULL)
			goto error;
	}

525 526 527
	if (attrs[XFRMA_TFCPAD])
		x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);

528 529 530 531 532 533 534
	if (attrs[XFRMA_COADDR]) {
		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
				    sizeof(*x->coaddr), GFP_KERNEL);
		if (x->coaddr == NULL)
			goto error;
	}

535 536
	xfrm_mark_get(attrs, &x->mark);

537
	err = __xfrm_init_state(x, false);
L
Linus Torvalds 已提交
538 539 540
	if (err)
		goto error;

541 542
	if (attrs[XFRMA_SEC_CTX] &&
	    security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
543 544
		goto error;

545 546 547 548
	if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
					       attrs[XFRMA_REPLAY_ESN_VAL])))
		goto error;

L
Linus Torvalds 已提交
549
	x->km.seq = p->seq;
A
Alexey Dobriyan 已提交
550
	x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
J
Jamal Hadi Salim 已提交
551
	/* sysctl_xfrm_aevent_etime is in 100ms units */
A
Alexey Dobriyan 已提交
552
	x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
J
Jamal Hadi Salim 已提交
553

554 555
	if ((err = xfrm_init_replay(x)))
		goto error;
J
Jamal Hadi Salim 已提交
556

557
	/* override default values from above */
558
	xfrm_update_ae_params(x, attrs);
L
Linus Torvalds 已提交
559 560 561 562 563 564 565 566 567 568 569

	return x;

error:
	x->km.state = XFRM_STATE_DEAD;
	xfrm_state_put(x);
error_no_put:
	*errp = err;
	return NULL;
}

570
static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
571
		struct nlattr **attrs)
L
Linus Torvalds 已提交
572
{
573
	struct net *net = sock_net(skb->sk);
574
	struct xfrm_usersa_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
575 576
	struct xfrm_state *x;
	int err;
577
	struct km_event c;
578 579 580
	uid_t loginuid = audit_get_loginuid(current);
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
581

582
	err = verify_newsa_info(p, attrs);
L
Linus Torvalds 已提交
583 584 585
	if (err)
		return err;

586
	x = xfrm_state_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
587 588 589
	if (!x)
		return err;

590
	xfrm_state_hold(x);
L
Linus Torvalds 已提交
591 592 593 594 595
	if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
		err = xfrm_state_add(x);
	else
		err = xfrm_state_update(x);

596
	security_task_getsecid(current, &sid);
597
	xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
598

L
Linus Torvalds 已提交
599 600
	if (err < 0) {
		x->km.state = XFRM_STATE_DEAD;
601
		__xfrm_state_put(x);
602
		goto out;
L
Linus Torvalds 已提交
603 604
	}

605 606
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
607
	c.event = nlh->nlmsg_type;
608 609

	km_state_notify(x, &c);
610
out:
611
	xfrm_state_put(x);
L
Linus Torvalds 已提交
612 613 614
	return err;
}

615 616
static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
						 struct xfrm_usersa_id *p,
617
						 struct nlattr **attrs,
618 619 620
						 int *errp)
{
	struct xfrm_state *x = NULL;
621
	struct xfrm_mark m;
622
	int err;
623
	u32 mark = xfrm_mark_get(attrs, &m);
624 625 626

	if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
		err = -ESRCH;
627
		x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
628 629 630
	} else {
		xfrm_address_t *saddr = NULL;

631
		verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
632 633 634 635 636
		if (!saddr) {
			err = -EINVAL;
			goto out;
		}

637
		err = -ESRCH;
638 639
		x = xfrm_state_lookup_byaddr(net, mark,
					     &p->daddr, saddr,
640
					     p->proto, p->family);
641 642 643 644 645 646 647 648
	}

 out:
	if (!x && errp)
		*errp = err;
	return x;
}

649
static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
650
		struct nlattr **attrs)
L
Linus Torvalds 已提交
651
{
652
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
653
	struct xfrm_state *x;
654
	int err = -ESRCH;
655
	struct km_event c;
656
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
657 658 659
	uid_t loginuid = audit_get_loginuid(current);
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
660

661
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
662
	if (x == NULL)
663
		return err;
L
Linus Torvalds 已提交
664

665
	if ((err = security_xfrm_state_delete(x)) != 0)
C
Catherine Zhang 已提交
666 667
		goto out;

L
Linus Torvalds 已提交
668
	if (xfrm_state_kern(x)) {
C
Catherine Zhang 已提交
669 670
		err = -EPERM;
		goto out;
L
Linus Torvalds 已提交
671 672
	}

673
	err = xfrm_state_delete(x);
J
Joy Latten 已提交
674

C
Catherine Zhang 已提交
675 676
	if (err < 0)
		goto out;
677 678 679

	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
680
	c.event = nlh->nlmsg_type;
681
	km_state_notify(x, &c);
L
Linus Torvalds 已提交
682

C
Catherine Zhang 已提交
683
out:
684
	security_task_getsecid(current, &sid);
685
	xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
C
Catherine Zhang 已提交
686
	xfrm_state_put(x);
687
	return err;
L
Linus Torvalds 已提交
688 689 690 691 692 693 694 695 696
}

static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&p->id, &x->id, sizeof(p->id));
	memcpy(&p->sel, &x->sel, sizeof(p->sel));
	memcpy(&p->lft, &x->lft, sizeof(p->lft));
	memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
	memcpy(&p->stats, &x->stats, sizeof(p->stats));
697
	memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
L
Linus Torvalds 已提交
698 699 700 701 702 703 704 705 706 707 708 709 710 711 712
	p->mode = x->props.mode;
	p->replay_window = x->props.replay_window;
	p->reqid = x->props.reqid;
	p->family = x->props.family;
	p->flags = x->props.flags;
	p->seq = x->km.seq;
}

struct xfrm_dump_info {
	struct sk_buff *in_skb;
	struct sk_buff *out_skb;
	u32 nlmsg_seq;
	u16 nlmsg_flags;
};

713 714 715 716
static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
{
	struct xfrm_user_sec_ctx *uctx;
	struct nlattr *attr;
717
	int ctx_size = sizeof(*uctx) + s->ctx_len;
718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733

	attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
	if (attr == NULL)
		return -EMSGSIZE;

	uctx = nla_data(attr);
	uctx->exttype = XFRMA_SEC_CTX;
	uctx->len = ctx_size;
	uctx->ctx_doi = s->ctx_doi;
	uctx->ctx_alg = s->ctx_alg;
	uctx->ctx_len = s->ctx_len;
	memcpy(uctx + 1, s->ctx_str, s->ctx_len);

	return 0;
}

734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751
static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
{
	struct xfrm_algo *algo;
	struct nlattr *nla;

	nla = nla_reserve(skb, XFRMA_ALG_AUTH,
			  sizeof(*algo) + (auth->alg_key_len + 7) / 8);
	if (!nla)
		return -EMSGSIZE;

	algo = nla_data(nla);
	strcpy(algo->alg_name, auth->alg_name);
	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
	algo->alg_key_len = auth->alg_key_len;

	return 0;
}

752 753 754 755
/* Don't change this without updating xfrm_sa_len! */
static int copy_to_user_state_extra(struct xfrm_state *x,
				    struct xfrm_usersa_info *p,
				    struct sk_buff *skb)
L
Linus Torvalds 已提交
756
{
757
	int ret = 0;
758

759
	copy_to_user_state(x, p);
760

761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817
	if (x->coaddr) {
		ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
		if (ret)
			goto out;
	}
	if (x->lastused) {
		ret = nla_put_u64(skb, XFRMA_LASTUSED, x->lastused);
		if (ret)
			goto out;
	}
	if (x->aead) {
		ret = nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
		if (ret)
			goto out;
	}
	if (x->aalg) {
		ret = copy_to_user_auth(x->aalg, skb);
		if (!ret)
			ret = nla_put(skb, XFRMA_ALG_AUTH_TRUNC,
				      xfrm_alg_auth_len(x->aalg), x->aalg);
		if (ret)
			goto out;
	}
	if (x->ealg) {
		ret = nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
		if (ret)
			goto out;
	}
	if (x->calg) {
		ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
		if (ret)
			goto out;
	}
	if (x->encap) {
		ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
		if (ret)
			goto out;
	}
	if (x->tfcpad) {
		ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad);
		if (ret)
			goto out;
	}
	ret = xfrm_mark_put(skb, &x->mark);
	if (ret)
		goto out;
	if (x->replay_esn) {
		ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
			      xfrm_replay_state_esn_len(x->replay_esn),
			      x->replay_esn);
		if (ret)
			goto out;
	}
	if (x->security)
		ret = copy_sec_ctx(x->security, skb);
out:
	return ret;
818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836
}

static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct xfrm_usersa_info *p;
	struct nlmsghdr *nlh;
	int err;

	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;

	p = nlmsg_data(nlh);

	err = copy_to_user_state_extra(x, p, skb);
837 838 839 840
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
841
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
842 843 844
	return 0;
}

845 846 847 848 849 850 851
static int xfrm_dump_sa_done(struct netlink_callback *cb)
{
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
	xfrm_state_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
852 853
static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
{
854
	struct net *net = sock_net(skb->sk);
855
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
L
Linus Torvalds 已提交
856 857
	struct xfrm_dump_info info;

858 859 860
	BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
861 862 863 864
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
865 866 867 868 869 870

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_state_walk_init(walk, 0);
	}

871
	(void) xfrm_state_walk(net, walk, dump_one_state, &info);
L
Linus Torvalds 已提交
872 873 874 875 876 877 878 879 880 881

	return skb->len;
}

static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
					  struct xfrm_state *x, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;

882
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
L
Linus Torvalds 已提交
883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

	if (dump_one_state(x, 0, &info)) {
		kfree_skb(skb);
		return NULL;
	}

	return skb;
}

899 900 901 902 903 904 905
static inline size_t xfrm_spdinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_spdinfo))
	       + nla_total_size(sizeof(struct xfrmu_spdhinfo));
}

906 907
static int build_spdinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
908
{
909 910 911
	struct xfrmk_spdinfo si;
	struct xfrmu_spdinfo spc;
	struct xfrmu_spdhinfo sph;
J
Jamal Hadi Salim 已提交
912
	struct nlmsghdr *nlh;
913
	int err;
J
Jamal Hadi Salim 已提交
914 915 916
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
L
Lucas De Marchi 已提交
917
	if (nlh == NULL) /* shouldn't really happen ... */
J
Jamal Hadi Salim 已提交
918 919 920 921
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
922
	xfrm_spd_getinfo(net, &si);
923 924 925 926 927 928 929 930 931
	spc.incnt = si.incnt;
	spc.outcnt = si.outcnt;
	spc.fwdcnt = si.fwdcnt;
	spc.inscnt = si.inscnt;
	spc.outscnt = si.outscnt;
	spc.fwdscnt = si.fwdscnt;
	sph.spdhcnt = si.spdhcnt;
	sph.spdhmcnt = si.spdhmcnt;

932 933 934 935 936 937 938
	err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
	if (!err)
		err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
J
Jamal Hadi Salim 已提交
939 940 941 942 943

	return nlmsg_end(skb, nlh);
}

static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
944
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
945
{
946
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
947
	struct sk_buff *r_skb;
948
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
949 950 951
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

952
	r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
953 954 955
	if (r_skb == NULL)
		return -ENOMEM;

956
	if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
957 958
		BUG();

959
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
960 961
}

962 963 964 965 966 967 968
static inline size_t xfrm_sadinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_sadhinfo))
	       + nla_total_size(4); /* XFRMA_SAD_CNT */
}

969 970
static int build_sadinfo(struct sk_buff *skb, struct net *net,
			 u32 pid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
971
{
972 973
	struct xfrmk_sadinfo si;
	struct xfrmu_sadhinfo sh;
J
Jamal Hadi Salim 已提交
974
	struct nlmsghdr *nlh;
975
	int err;
J
Jamal Hadi Salim 已提交
976 977 978
	u32 *f;

	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
L
Lucas De Marchi 已提交
979
	if (nlh == NULL) /* shouldn't really happen ... */
J
Jamal Hadi Salim 已提交
980 981 982 983
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
984
	xfrm_sad_getinfo(net, &si);
J
Jamal Hadi Salim 已提交
985

986 987 988
	sh.sadhmcnt = si.sadhmcnt;
	sh.sadhcnt = si.sadhcnt;

989 990 991 992 993 994 995
	err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt);
	if (!err)
		err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
J
Jamal Hadi Salim 已提交
996 997 998 999 1000

	return nlmsg_end(skb, nlh);
}

static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
1001
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1002
{
1003
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1004
	struct sk_buff *r_skb;
1005
	u32 *flags = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
1006 1007 1008
	u32 spid = NETLINK_CB(skb).pid;
	u32 seq = nlh->nlmsg_seq;

1009
	r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
1010 1011 1012
	if (r_skb == NULL)
		return -ENOMEM;

1013
	if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
1014 1015
		BUG();

1016
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
J
Jamal Hadi Salim 已提交
1017 1018
}

1019
static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1020
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1021
{
1022
	struct net *net = sock_net(skb->sk);
1023
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1024 1025
	struct xfrm_state *x;
	struct sk_buff *resp_skb;
1026
	int err = -ESRCH;
L
Linus Torvalds 已提交
1027

1028
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
1029 1030 1031 1032 1033 1034 1035
	if (x == NULL)
		goto out_noput;

	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
	} else {
1036
		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057
	}
	xfrm_state_put(x);
out_noput:
	return err;
}

static int verify_userspi_info(struct xfrm_userspi_info *p)
{
	switch (p->info.id.proto) {
	case IPPROTO_AH:
	case IPPROTO_ESP:
		break;

	case IPPROTO_COMP:
		/* IPCOMP spi is 16-bits. */
		if (p->max >= 0x10000)
			return -EINVAL;
		break;

	default:
		return -EINVAL;
1058
	}
L
Linus Torvalds 已提交
1059 1060 1061 1062 1063 1064 1065

	if (p->min > p->max)
		return -EINVAL;

	return 0;
}

1066
static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
1067
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1068
{
1069
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1070 1071 1072 1073 1074 1075
	struct xfrm_state *x;
	struct xfrm_userspi_info *p;
	struct sk_buff *resp_skb;
	xfrm_address_t *daddr;
	int family;
	int err;
1076 1077
	u32 mark;
	struct xfrm_mark m;
L
Linus Torvalds 已提交
1078

1079
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1080 1081 1082 1083 1084 1085 1086 1087
	err = verify_userspi_info(p);
	if (err)
		goto out_noput;

	family = p->info.family;
	daddr = &p->info.id.daddr;

	x = NULL;
1088 1089

	mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
1090
	if (p->info.seq) {
1091
		x = xfrm_find_acq_byseq(net, mark, p->info.seq);
L
Linus Torvalds 已提交
1092 1093 1094 1095 1096 1097 1098
		if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
			xfrm_state_put(x);
			x = NULL;
		}
	}

	if (!x)
1099
		x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
L
Linus Torvalds 已提交
1100 1101 1102 1103 1104 1105 1106
				  p->info.id.proto, daddr,
				  &p->info.saddr, 1,
				  family);
	err = -ENOENT;
	if (x == NULL)
		goto out_noput;

1107 1108 1109
	err = xfrm_alloc_spi(x, p->min, p->max);
	if (err)
		goto out;
L
Linus Torvalds 已提交
1110

1111
	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
L
Linus Torvalds 已提交
1112 1113 1114 1115 1116
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
		goto out;
	}

1117
	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1118 1119 1120 1121 1122 1123 1124

out:
	xfrm_state_put(x);
out_noput:
	return err;
}

1125
static int verify_policy_dir(u8 dir)
L
Linus Torvalds 已提交
1126 1127 1128 1129 1130 1131 1132 1133 1134
{
	switch (dir) {
	case XFRM_POLICY_IN:
	case XFRM_POLICY_OUT:
	case XFRM_POLICY_FWD:
		break;

	default:
		return -EINVAL;
1135
	}
L
Linus Torvalds 已提交
1136 1137 1138 1139

	return 0;
}

1140
static int verify_policy_type(u8 type)
1141 1142 1143 1144 1145 1146 1147 1148 1149 1150
{
	switch (type) {
	case XFRM_POLICY_TYPE_MAIN:
#ifdef CONFIG_XFRM_SUB_POLICY
	case XFRM_POLICY_TYPE_SUB:
#endif
		break;

	default:
		return -EINVAL;
1151
	}
1152 1153 1154 1155

	return 0;
}

L
Linus Torvalds 已提交
1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166
static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
{
	switch (p->share) {
	case XFRM_SHARE_ANY:
	case XFRM_SHARE_SESSION:
	case XFRM_SHARE_USER:
	case XFRM_SHARE_UNIQUE:
		break;

	default:
		return -EINVAL;
1167
	}
L
Linus Torvalds 已提交
1168 1169 1170 1171 1172 1173 1174 1175

	switch (p->action) {
	case XFRM_POLICY_ALLOW:
	case XFRM_POLICY_BLOCK:
		break;

	default:
		return -EINVAL;
1176
	}
L
Linus Torvalds 已提交
1177 1178 1179 1180 1181 1182

	switch (p->sel.family) {
	case AF_INET:
		break;

	case AF_INET6:
E
Eric Dumazet 已提交
1183
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
1184 1185 1186 1187 1188 1189 1190
		break;
#else
		return  -EAFNOSUPPORT;
#endif

	default:
		return -EINVAL;
1191
	}
L
Linus Torvalds 已提交
1192 1193 1194 1195

	return verify_policy_dir(p->dir);
}

1196
static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
1197
{
1198
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1199 1200 1201 1202 1203
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

1204
	uctx = nla_data(rt);
1205
	return security_xfrm_policy_alloc(&pol->security, uctx);
1206 1207
}

L
Linus Torvalds 已提交
1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226
static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
			   int nr)
{
	int i;

	xp->xfrm_nr = nr;
	for (i = 0; i < nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];

		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
		memcpy(&t->saddr, &ut->saddr,
		       sizeof(xfrm_address_t));
		t->reqid = ut->reqid;
		t->mode = ut->mode;
		t->share = ut->share;
		t->optional = ut->optional;
		t->aalgos = ut->aalgos;
		t->ealgos = ut->ealgos;
		t->calgos = ut->calgos;
1227 1228
		/* If all masks are ~0, then we allow all algorithms. */
		t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1229
		t->encap_family = ut->family;
L
Linus Torvalds 已提交
1230 1231 1232
	}
}

1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253
static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
{
	int i;

	if (nr > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < nr; i++) {
		/* We never validated the ut->family value, so many
		 * applications simply leave it at zero.  The check was
		 * never made and ut->family was ignored because all
		 * templates could be assumed to have the same family as
		 * the policy itself.  Now that we will have ipv4-in-ipv6
		 * and ipv6-in-ipv4 tunnels, this is no longer true.
		 */
		if (!ut[i].family)
			ut[i].family = family;

		switch (ut[i].family) {
		case AF_INET:
			break;
E
Eric Dumazet 已提交
1254
#if IS_ENABLED(CONFIG_IPV6)
1255 1256 1257 1258 1259
		case AF_INET6:
			break;
#endif
		default:
			return -EINVAL;
1260
		}
1261 1262 1263 1264 1265
	}

	return 0;
}

1266
static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
L
Linus Torvalds 已提交
1267
{
1268
	struct nlattr *rt = attrs[XFRMA_TMPL];
L
Linus Torvalds 已提交
1269 1270 1271 1272

	if (!rt) {
		pol->xfrm_nr = 0;
	} else {
1273 1274
		struct xfrm_user_tmpl *utmpl = nla_data(rt);
		int nr = nla_len(rt) / sizeof(*utmpl);
1275
		int err;
L
Linus Torvalds 已提交
1276

1277 1278 1279
		err = validate_tmpl(nr, utmpl, pol->family);
		if (err)
			return err;
L
Linus Torvalds 已提交
1280

1281
		copy_templates(pol, utmpl, nr);
L
Linus Torvalds 已提交
1282 1283 1284 1285
	}
	return 0;
}

1286
static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
1287
{
1288
	struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1289
	struct xfrm_userpolicy_type *upt;
1290
	u8 type = XFRM_POLICY_TYPE_MAIN;
1291 1292 1293
	int err;

	if (rt) {
1294
		upt = nla_data(rt);
1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305
		type = upt->type;
	}

	err = verify_policy_type(type);
	if (err)
		return err;

	*tp = type;
	return 0;
}

L
Linus Torvalds 已提交
1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331
static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
{
	xp->priority = p->priority;
	xp->index = p->index;
	memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
	memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
	xp->action = p->action;
	xp->flags = p->flags;
	xp->family = p->sel.family;
	/* XXX xp->share = p->share; */
}

static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
{
	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
	p->priority = xp->priority;
	p->index = xp->index;
	p->sel.family = xp->family;
	p->dir = dir;
	p->action = xp->action;
	p->flags = xp->flags;
	p->share = XFRM_SHARE_ANY; /* XXX xp->share */
}

1332
static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
L
Linus Torvalds 已提交
1333
{
1334
	struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
L
Linus Torvalds 已提交
1335 1336 1337 1338 1339 1340 1341 1342
	int err;

	if (!xp) {
		*errp = -ENOMEM;
		return NULL;
	}

	copy_from_user_policy(xp, p);
1343

1344
	err = copy_from_user_policy_type(&xp->type, attrs);
1345 1346 1347
	if (err)
		goto error;

1348 1349
	if (!(err = copy_from_user_tmpl(xp, attrs)))
		err = copy_from_user_sec_ctx(xp, attrs);
1350 1351
	if (err)
		goto error;
L
Linus Torvalds 已提交
1352

1353 1354
	xfrm_mark_get(attrs, &xp->mark);

L
Linus Torvalds 已提交
1355
	return xp;
1356 1357
 error:
	*errp = err;
H
Herbert Xu 已提交
1358
	xp->walk.dead = 1;
1359
	xfrm_policy_destroy(xp);
1360
	return NULL;
L
Linus Torvalds 已提交
1361 1362
}

1363
static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1364
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1365
{
1366
	struct net *net = sock_net(skb->sk);
1367
	struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1368
	struct xfrm_policy *xp;
1369
	struct km_event c;
L
Linus Torvalds 已提交
1370 1371
	int err;
	int excl;
1372 1373 1374
	uid_t loginuid = audit_get_loginuid(current);
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
1375 1376

	err = verify_newpolicy_info(p);
1377 1378
	if (err)
		return err;
1379
	err = verify_sec_ctx_len(attrs);
L
Linus Torvalds 已提交
1380 1381 1382
	if (err)
		return err;

1383
	xp = xfrm_policy_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
1384 1385 1386
	if (!xp)
		return err;

L
Lucas De Marchi 已提交
1387
	/* shouldn't excl be based on nlh flags??
1388 1389 1390
	 * Aha! this is anti-netlink really i.e  more pfkey derived
	 * in netlink excl is a flag and you wouldnt need
	 * a type XFRM_MSG_UPDPOLICY - JHS */
L
Linus Torvalds 已提交
1391 1392
	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
	err = xfrm_policy_insert(p->dir, xp, excl);
1393
	security_task_getsecid(current, &sid);
1394
	xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1395

L
Linus Torvalds 已提交
1396
	if (err) {
1397
		security_xfrm_policy_free(xp->security);
L
Linus Torvalds 已提交
1398 1399 1400 1401
		kfree(xp);
		return err;
	}

1402
	c.event = nlh->nlmsg_type;
1403 1404 1405 1406
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	km_policy_notify(xp, p->dir, &c);

L
Linus Torvalds 已提交
1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424
	xfrm_pol_put(xp);

	return 0;
}

static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
{
	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
	int i;

	if (xp->xfrm_nr == 0)
		return 0;

	for (i = 0; i < xp->xfrm_nr; i++) {
		struct xfrm_user_tmpl *up = &vec[i];
		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];

		memcpy(&up->id, &kp->id, sizeof(up->id));
1425
		up->family = kp->encap_family;
L
Linus Torvalds 已提交
1426 1427 1428 1429 1430 1431 1432 1433 1434
		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
		up->reqid = kp->reqid;
		up->mode = kp->mode;
		up->share = kp->share;
		up->optional = kp->optional;
		up->aalgos = kp->aalgos;
		up->ealgos = kp->ealgos;
		up->calgos = kp->calgos;
	}
1435

1436 1437
	return nla_put(skb, XFRMA_TMPL,
		       sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
1438 1439 1440 1441 1442 1443
}

static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
{
	if (x->security) {
		return copy_sec_ctx(x->security, skb);
1444 1445
	}
	return 0;
1446
}
1447

1448 1449
static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
{
1450
	if (xp->security)
1451 1452
		return copy_sec_ctx(xp->security, skb);
	return 0;
1453
}
1454 1455 1456 1457 1458 1459 1460 1461
static inline size_t userpolicy_type_attrsize(void)
{
#ifdef CONFIG_XFRM_SUB_POLICY
	return nla_total_size(sizeof(struct xfrm_userpolicy_type));
#else
	return 0;
#endif
}
1462

1463
#ifdef CONFIG_XFRM_SUB_POLICY
1464
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1465
{
1466 1467 1468
	struct xfrm_userpolicy_type upt = {
		.type = type,
	};
1469

1470
	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1471 1472 1473
}

#else
1474
static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1475 1476 1477 1478 1479
{
	return 0;
}
#endif

L
Linus Torvalds 已提交
1480 1481 1482 1483 1484 1485 1486
static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct xfrm_userpolicy_info *p;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct nlmsghdr *nlh;
1487
	int err;
L
Linus Torvalds 已提交
1488

1489 1490 1491 1492
	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
			XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
1493

1494
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1495
	copy_to_user_policy(xp, p, dir);
1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_sec_ctx(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
1507
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
1508 1509 1510
	return 0;
}

1511 1512 1513 1514 1515 1516 1517 1518
static int xfrm_dump_policy_done(struct netlink_callback *cb)
{
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];

	xfrm_policy_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
1519 1520
static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
{
1521
	struct net *net = sock_net(skb->sk);
1522
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
L
Linus Torvalds 已提交
1523 1524
	struct xfrm_dump_info info;

1525 1526 1527
	BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
1528 1529 1530 1531
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
1532 1533 1534 1535 1536 1537

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
	}

1538
	(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
L
Linus Torvalds 已提交
1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549

	return skb->len;
}

static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
					  struct xfrm_policy *xp,
					  int dir, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;

1550
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
L
Linus Torvalds 已提交
1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

	if (dump_one_policy(xp, dir, 0, &info) < 0) {
		kfree_skb(skb);
		return NULL;
	}

	return skb;
}

1567
static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1568
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1569
{
1570
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1571 1572
	struct xfrm_policy *xp;
	struct xfrm_userpolicy_id *p;
1573
	u8 type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
1574
	int err;
1575
	struct km_event c;
L
Linus Torvalds 已提交
1576
	int delete;
1577 1578
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
1579

1580
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1581 1582
	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;

1583
	err = copy_from_user_policy_type(&type, attrs);
1584 1585 1586
	if (err)
		return err;

L
Linus Torvalds 已提交
1587 1588 1589 1590 1591
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

	if (p->index)
1592
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
1593
	else {
1594
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1595
		struct xfrm_sec_ctx *ctx;
1596

1597
		err = verify_sec_ctx_len(attrs);
1598 1599 1600
		if (err)
			return err;

1601
		ctx = NULL;
1602
		if (rt) {
1603
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1604

1605 1606
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1607
				return err;
1608
		}
1609
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
1610
					   ctx, delete, &err);
1611
		security_xfrm_policy_free(ctx);
1612
	}
L
Linus Torvalds 已提交
1613 1614 1615 1616 1617 1618 1619 1620 1621 1622
	if (xp == NULL)
		return -ENOENT;

	if (!delete) {
		struct sk_buff *resp_skb;

		resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
		if (IS_ERR(resp_skb)) {
			err = PTR_ERR(resp_skb);
		} else {
1623
			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
1624
					    NETLINK_CB(skb).pid);
L
Linus Torvalds 已提交
1625
		}
1626
	} else {
1627 1628 1629
		uid_t loginuid = audit_get_loginuid(current);
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;
1630

1631
		security_task_getsecid(current, &sid);
1632 1633
		xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
					 sid);
1634 1635

		if (err != 0)
C
Catherine Zhang 已提交
1636
			goto out;
1637

1638
		c.data.byid = p->index;
1639
		c.event = nlh->nlmsg_type;
1640 1641 1642
		c.seq = nlh->nlmsg_seq;
		c.pid = nlh->nlmsg_pid;
		km_policy_notify(xp, p->dir, &c);
L
Linus Torvalds 已提交
1643 1644
	}

C
Catherine Zhang 已提交
1645
out:
1646
	xfrm_pol_put(xp);
L
Linus Torvalds 已提交
1647 1648 1649
	return err;
}

1650
static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1651
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1652
{
1653
	struct net *net = sock_net(skb->sk);
1654
	struct km_event c;
1655
	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
J
Joy Latten 已提交
1656
	struct xfrm_audit audit_info;
1657
	int err;
L
Linus Torvalds 已提交
1658

1659 1660 1661
	audit_info.loginuid = audit_get_loginuid(current);
	audit_info.sessionid = audit_get_sessionid(current);
	security_task_getsecid(current, &audit_info.secid);
1662
	err = xfrm_state_flush(net, p->proto, &audit_info);
1663 1664 1665
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1666
		return err;
1667
	}
1668
	c.data.proto = p->proto;
1669
	c.event = nlh->nlmsg_type;
1670 1671
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1672
	c.net = net;
1673 1674
	km_state_notify(NULL, &c);

L
Linus Torvalds 已提交
1675 1676 1677
	return 0;
}

1678
static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x)
1679
{
1680 1681 1682 1683
	size_t replay_size = x->replay_esn ?
			      xfrm_replay_state_esn_len(x->replay_esn) :
			      sizeof(struct xfrm_replay_state);

1684
	return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
1685
	       + nla_total_size(replay_size)
1686
	       + nla_total_size(sizeof(struct xfrm_lifetime_cur))
1687
	       + nla_total_size(sizeof(struct xfrm_mark))
1688 1689 1690
	       + nla_total_size(4) /* XFRM_AE_RTHR */
	       + nla_total_size(4); /* XFRM_AE_ETHR */
}
J
Jamal Hadi Salim 已提交
1691

1692
static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
J
Jamal Hadi Salim 已提交
1693 1694 1695
{
	struct xfrm_aevent_id *id;
	struct nlmsghdr *nlh;
1696
	int err;
J
Jamal Hadi Salim 已提交
1697

1698 1699 1700
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
J
Jamal Hadi Salim 已提交
1701

1702
	id = nlmsg_data(nlh);
1703
	memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
J
Jamal Hadi Salim 已提交
1704 1705 1706
	id->sa_id.spi = x->id.spi;
	id->sa_id.family = x->props.family;
	id->sa_id.proto = x->id.proto;
1707 1708
	memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
	id->reqid = x->props.reqid;
J
Jamal Hadi Salim 已提交
1709 1710
	id->flags = c->data.aevent;

1711
	if (x->replay_esn) {
1712 1713 1714
		err = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
			      xfrm_replay_state_esn_len(x->replay_esn),
			      x->replay_esn);
1715
	} else {
1716 1717
		err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
			      &x->replay);
1718
	}
1719 1720 1721 1722 1723
	if (err)
		goto out_cancel;
	err = nla_put(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
	if (err)
		goto out_cancel;
J
Jamal Hadi Salim 已提交
1724

1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738
	if (id->flags & XFRM_AE_RTHR) {
		err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
		if (err)
			goto out_cancel;
	}
	if (id->flags & XFRM_AE_ETHR) {
		err = nla_put_u32(skb, XFRMA_ETIMER_THRESH,
				  x->replay_maxage * 10 / HZ);
		if (err)
			goto out_cancel;
	}
	err = xfrm_mark_put(skb, &x->mark);
	if (err)
		goto out_cancel;
1739

1740
	return nlmsg_end(skb, nlh);
J
Jamal Hadi Salim 已提交
1741

1742
out_cancel:
1743
	nlmsg_cancel(skb, nlh);
1744
	return err;
J
Jamal Hadi Salim 已提交
1745 1746
}

1747
static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1748
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1749
{
1750
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1751 1752 1753 1754
	struct xfrm_state *x;
	struct sk_buff *r_skb;
	int err;
	struct km_event c;
1755 1756
	u32 mark;
	struct xfrm_mark m;
1757
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
1758 1759
	struct xfrm_usersa_id *id = &p->sa_id;

1760 1761 1762
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
1763
	if (x == NULL)
J
Jamal Hadi Salim 已提交
1764
		return -ESRCH;
1765 1766 1767 1768 1769

	r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
	if (r_skb == NULL) {
		xfrm_state_put(x);
		return -ENOMEM;
J
Jamal Hadi Salim 已提交
1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783
	}

	/*
	 * XXX: is this lock really needed - none of the other
	 * gets lock (the concern is things getting updated
	 * while we are still reading) - jhs
	*/
	spin_lock_bh(&x->lock);
	c.data.aevent = p->flags;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;

	if (build_aevent(r_skb, x, &c) < 0)
		BUG();
1784
	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).pid);
J
Jamal Hadi Salim 已提交
1785 1786 1787 1788 1789
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1790
static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1791
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1792
{
1793
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1794 1795 1796
	struct xfrm_state *x;
	struct km_event c;
	int err = - EINVAL;
1797 1798
	u32 mark = 0;
	struct xfrm_mark m;
1799
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
1800
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
1801
	struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
1802
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
J
Jamal Hadi Salim 已提交
1803

1804
	if (!lt && !rp && !re)
J
Jamal Hadi Salim 已提交
1805 1806 1807 1808 1809 1810
		return err;

	/* pedantic mode - thou shalt sayeth replaceth */
	if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
		return err;

1811 1812 1813
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
J
Jamal Hadi Salim 已提交
1814 1815 1816 1817 1818 1819
	if (x == NULL)
		return -ESRCH;

	if (x->km.state != XFRM_STATE_VALID)
		goto out;

1820 1821 1822 1823
	err = xfrm_replay_verify_len(x->replay_esn, rp);
	if (err)
		goto out;

J
Jamal Hadi Salim 已提交
1824
	spin_lock_bh(&x->lock);
1825
	xfrm_update_ae_params(x, attrs);
J
Jamal Hadi Salim 已提交
1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838
	spin_unlock_bh(&x->lock);

	c.event = nlh->nlmsg_type;
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
	c.data.aevent = XFRM_AE_CU;
	km_state_notify(x, &c);
	err = 0;
out:
	xfrm_state_put(x);
	return err;
}

1839
static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1840
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1841
{
1842
	struct net *net = sock_net(skb->sk);
1843
	struct km_event c;
1844
	u8 type = XFRM_POLICY_TYPE_MAIN;
1845
	int err;
J
Joy Latten 已提交
1846
	struct xfrm_audit audit_info;
1847

1848
	err = copy_from_user_policy_type(&type, attrs);
1849 1850
	if (err)
		return err;
1851

1852 1853 1854
	audit_info.loginuid = audit_get_loginuid(current);
	audit_info.sessionid = audit_get_sessionid(current);
	security_task_getsecid(current, &audit_info.secid);
1855
	err = xfrm_policy_flush(net, type, &audit_info);
1856 1857 1858
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1859
		return err;
1860 1861
	}

1862
	c.data.type = type;
1863
	c.event = nlh->nlmsg_type;
1864 1865
	c.seq = nlh->nlmsg_seq;
	c.pid = nlh->nlmsg_pid;
1866
	c.net = net;
1867
	km_policy_notify(NULL, 0, &c);
L
Linus Torvalds 已提交
1868 1869 1870
	return 0;
}

1871
static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1872
		struct nlattr **attrs)
1873
{
1874
	struct net *net = sock_net(skb->sk);
1875
	struct xfrm_policy *xp;
1876
	struct xfrm_user_polexpire *up = nlmsg_data(nlh);
1877
	struct xfrm_userpolicy_info *p = &up->pol;
1878
	u8 type = XFRM_POLICY_TYPE_MAIN;
1879
	int err = -ENOENT;
1880 1881
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
1882

1883
	err = copy_from_user_policy_type(&type, attrs);
1884 1885 1886
	if (err)
		return err;

1887 1888 1889 1890
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

1891
	if (p->index)
1892
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
1893
	else {
1894
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1895
		struct xfrm_sec_ctx *ctx;
1896

1897
		err = verify_sec_ctx_len(attrs);
1898 1899 1900
		if (err)
			return err;

1901
		ctx = NULL;
1902
		if (rt) {
1903
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1904

1905 1906
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1907
				return err;
1908
		}
1909
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
1910
					   &p->sel, ctx, 0, &err);
1911
		security_xfrm_policy_free(ctx);
1912 1913
	}
	if (xp == NULL)
1914
		return -ENOENT;
1915

1916
	if (unlikely(xp->walk.dead))
1917 1918 1919 1920
		goto out;

	err = 0;
	if (up->hard) {
1921 1922 1923 1924 1925
		uid_t loginuid = audit_get_loginuid(current);
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;

		security_task_getsecid(current, &sid);
1926
		xfrm_policy_delete(xp, p->dir);
1927
		xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1928

1929 1930
	} else {
		// reset the timers here?
S
stephen hemminger 已提交
1931
		WARN(1, "Dont know what to do with soft policy expire\n");
1932 1933 1934 1935 1936 1937 1938 1939
	}
	km_policy_expired(xp, p->dir, up->hard, current->pid);

out:
	xfrm_pol_put(xp);
	return err;
}

1940
static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1941
		struct nlattr **attrs)
1942
{
1943
	struct net *net = sock_net(skb->sk);
1944 1945
	struct xfrm_state *x;
	int err;
1946
	struct xfrm_user_expire *ue = nlmsg_data(nlh);
1947
	struct xfrm_usersa_info *p = &ue->state;
1948
	struct xfrm_mark m;
1949
	u32 mark = xfrm_mark_get(attrs, &m);
1950

1951
	x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
1952

1953
	err = -ENOENT;
1954 1955 1956 1957
	if (x == NULL)
		return err;

	spin_lock_bh(&x->lock);
1958
	err = -EINVAL;
1959 1960 1961 1962
	if (x->km.state != XFRM_STATE_VALID)
		goto out;
	km_state_expired(x, ue->hard, current->pid);

J
Joy Latten 已提交
1963
	if (ue->hard) {
1964 1965 1966 1967 1968
		uid_t loginuid = audit_get_loginuid(current);
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;

		security_task_getsecid(current, &sid);
1969
		__xfrm_state_delete(x);
1970
		xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1971
	}
1972
	err = 0;
1973 1974 1975 1976 1977 1978
out:
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1979
static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
1980
		struct nlattr **attrs)
1981
{
1982
	struct net *net = sock_net(skb->sk);
1983 1984 1985
	struct xfrm_policy *xp;
	struct xfrm_user_tmpl *ut;
	int i;
1986
	struct nlattr *rt = attrs[XFRMA_TMPL];
1987
	struct xfrm_mark mark;
1988

1989
	struct xfrm_user_acquire *ua = nlmsg_data(nlh);
1990
	struct xfrm_state *x = xfrm_state_alloc(net);
1991 1992 1993
	int err = -ENOMEM;

	if (!x)
I
Ilpo Järvinen 已提交
1994
		goto nomem;
1995

1996 1997
	xfrm_mark_get(attrs, &mark);

1998
	err = verify_newpolicy_info(&ua->policy);
I
Ilpo Järvinen 已提交
1999 2000
	if (err)
		goto bad_policy;
2001 2002

	/*   build an XP */
2003
	xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
I
Ilpo Järvinen 已提交
2004 2005
	if (!xp)
		goto free_state;
2006 2007 2008 2009

	memcpy(&x->id, &ua->id, sizeof(ua->id));
	memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
	memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
2010 2011
	xp->mark.m = x->mark.m = mark.m;
	xp->mark.v = x->mark.v = mark.v;
2012
	ut = nla_data(rt);
2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030
	/* extract the templates and for each call km_key */
	for (i = 0; i < xp->xfrm_nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
		memcpy(&x->id, &t->id, sizeof(x->id));
		x->props.mode = t->mode;
		x->props.reqid = t->reqid;
		x->props.family = ut->family;
		t->aalgos = ua->aalgos;
		t->ealgos = ua->ealgos;
		t->calgos = ua->calgos;
		err = km_query(x, t, xp);

	}

	kfree(x);
	kfree(xp);

	return 0;
I
Ilpo Järvinen 已提交
2031 2032

bad_policy:
S
stephen hemminger 已提交
2033
	WARN(1, "BAD policy passed\n");
I
Ilpo Järvinen 已提交
2034 2035 2036 2037
free_state:
	kfree(x);
nomem:
	return err;
2038 2039
}

2040 2041
#ifdef CONFIG_XFRM_MIGRATE
static int copy_from_user_migrate(struct xfrm_migrate *ma,
2042
				  struct xfrm_kmaddress *k,
2043
				  struct nlattr **attrs, int *num)
2044
{
2045
	struct nlattr *rt = attrs[XFRMA_MIGRATE];
2046 2047 2048
	struct xfrm_user_migrate *um;
	int i, num_migrate;

2049 2050 2051 2052 2053 2054 2055 2056 2057 2058
	if (k != NULL) {
		struct xfrm_user_kmaddress *uk;

		uk = nla_data(attrs[XFRMA_KMADDRESS]);
		memcpy(&k->local, &uk->local, sizeof(k->local));
		memcpy(&k->remote, &uk->remote, sizeof(k->remote));
		k->family = uk->family;
		k->reserved = uk->reserved;
	}

2059 2060
	um = nla_data(rt);
	num_migrate = nla_len(rt) / sizeof(*um);
2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083

	if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < num_migrate; i++, um++, ma++) {
		memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
		memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
		memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
		memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));

		ma->proto = um->proto;
		ma->mode = um->mode;
		ma->reqid = um->reqid;

		ma->old_family = um->old_family;
		ma->new_family = um->new_family;
	}

	*num = i;
	return 0;
}

static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2084
			   struct nlattr **attrs)
2085
{
2086
	struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
2087
	struct xfrm_migrate m[XFRM_MAX_DEPTH];
2088
	struct xfrm_kmaddress km, *kmp;
2089 2090 2091 2092
	u8 type;
	int err;
	int n = 0;

2093
	if (attrs[XFRMA_MIGRATE] == NULL)
2094
		return -EINVAL;
2095

2096 2097
	kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;

2098
	err = copy_from_user_policy_type(&type, attrs);
2099 2100 2101
	if (err)
		return err;

2102
	err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
2103 2104 2105 2106 2107 2108
	if (err)
		return err;

	if (!n)
		return 0;

2109
	xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
2110 2111 2112 2113 2114

	return 0;
}
#else
static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2115
			   struct nlattr **attrs)
2116 2117 2118 2119 2120 2121
{
	return -ENOPROTOOPT;
}
#endif

#ifdef CONFIG_XFRM_MIGRATE
2122
static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136
{
	struct xfrm_user_migrate um;

	memset(&um, 0, sizeof(um));
	um.proto = m->proto;
	um.mode = m->mode;
	um.reqid = m->reqid;
	um.old_family = m->old_family;
	memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
	memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
	um.new_family = m->new_family;
	memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
	memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));

2137
	return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
2138 2139
}

2140
static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
2141 2142 2143 2144 2145 2146 2147
{
	struct xfrm_user_kmaddress uk;

	memset(&uk, 0, sizeof(uk));
	uk.family = k->family;
	uk.reserved = k->reserved;
	memcpy(&uk.local, &k->local, sizeof(uk.local));
2148
	memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
2149 2150 2151 2152 2153

	return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
}

static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
2154 2155
{
	return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
2156 2157 2158
	      + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
	      + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
	      + userpolicy_type_attrsize();
2159 2160
}

2161 2162 2163
static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
			 int num_migrate, const struct xfrm_kmaddress *k,
			 const struct xfrm_selector *sel, u8 dir, u8 type)
2164
{
2165
	const struct xfrm_migrate *mp;
2166 2167
	struct xfrm_userpolicy_id *pol_id;
	struct nlmsghdr *nlh;
2168
	int i, err;
2169

2170 2171 2172
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2173

2174
	pol_id = nlmsg_data(nlh);
2175 2176 2177 2178 2179
	/* copy data from selector, dir, and type to the pol_id */
	memset(pol_id, 0, sizeof(*pol_id));
	memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
	pol_id->dir = dir;

2180 2181 2182 2183 2184 2185 2186 2187
	if (k != NULL) {
		err = copy_to_user_kmaddress(k, skb);
		if (err)
			goto out_cancel;
	}
	err = copy_to_user_policy_type(type, skb);
	if (err)
		goto out_cancel;
2188
	for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
2189 2190 2191
		err = copy_to_user_migrate(mp, skb);
		if (err)
			goto out_cancel;
2192 2193
	}

2194
	return nlmsg_end(skb, nlh);
2195 2196

out_cancel:
2197
	nlmsg_cancel(skb, nlh);
2198
	return err;
2199 2200
}

2201 2202 2203
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
			     const struct xfrm_migrate *m, int num_migrate,
			     const struct xfrm_kmaddress *k)
2204
{
2205
	struct net *net = &init_net;
2206 2207
	struct sk_buff *skb;

2208
	skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
2209 2210 2211 2212
	if (skb == NULL)
		return -ENOMEM;

	/* build migrate */
2213
	if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
2214 2215
		BUG();

2216
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
2217 2218
}
#else
2219 2220 2221
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
			     const struct xfrm_migrate *m, int num_migrate,
			     const struct xfrm_kmaddress *k)
2222 2223 2224 2225
{
	return -ENOPROTOOPT;
}
#endif
J
Jamal Hadi Salim 已提交
2226

2227
#define XMSGSIZE(type) sizeof(struct type)
2228 2229

static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
2230
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2231 2232 2233 2234 2235 2236
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
2237
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
2238
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
2239
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2240
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2241
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
2242
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
2243
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
J
Jamal Hadi Salim 已提交
2244 2245
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2246
	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
2247
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2248 2249
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
L
Linus Torvalds 已提交
2250 2251
};

2252 2253
#undef XMSGSIZE

2254
static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
J
jamal 已提交
2255 2256 2257 2258
	[XFRMA_SA]		= { .len = sizeof(struct xfrm_usersa_info)},
	[XFRMA_POLICY]		= { .len = sizeof(struct xfrm_userpolicy_info)},
	[XFRMA_LASTUSED]	= { .type = NLA_U64},
	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
2259
	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273
	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_sec_ctx) },
	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
2274
	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
2275
	[XFRMA_MARK]		= { .len = sizeof(struct xfrm_mark) },
2276
	[XFRMA_TFCPAD]		= { .type = NLA_U32 },
2277
	[XFRMA_REPLAY_ESN_VAL]	= { .len = sizeof(struct xfrm_replay_state_esn) },
2278 2279
};

L
Linus Torvalds 已提交
2280
static struct xfrm_link {
2281
	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
L
Linus Torvalds 已提交
2282
	int (*dump)(struct sk_buff *, struct netlink_callback *);
2283
	int (*done)(struct netlink_callback *);
2284 2285 2286 2287
} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
2288 2289
						   .dump = xfrm_dump_sa,
						   .done = xfrm_dump_sa_done  },
2290 2291 2292
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
2293 2294
						   .dump = xfrm_dump_policy,
						   .done = xfrm_dump_policy_done },
2295
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
2296
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
2297
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
2298 2299
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
2300
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
2301 2302
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
J
Jamal Hadi Salim 已提交
2303 2304
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = { .doit = xfrm_new_ae  },
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = { .doit = xfrm_get_ae  },
2305
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate    },
2306
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo   },
J
Jamal Hadi Salim 已提交
2307
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo   },
L
Linus Torvalds 已提交
2308 2309
};

2310
static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
2311
{
2312
	struct net *net = sock_net(skb->sk);
2313
	struct nlattr *attrs[XFRMA_MAX+1];
L
Linus Torvalds 已提交
2314
	struct xfrm_link *link;
2315
	int type, err;
L
Linus Torvalds 已提交
2316 2317 2318

	type = nlh->nlmsg_type;
	if (type > XFRM_MSG_MAX)
2319
		return -EINVAL;
L
Linus Torvalds 已提交
2320 2321 2322 2323 2324

	type -= XFRM_MSG_BASE;
	link = &xfrm_dispatch[type];

	/* All operations require privileges, even GET */
2325
	if (!capable(CAP_NET_ADMIN))
2326
		return -EPERM;
L
Linus Torvalds 已提交
2327

2328 2329
	if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
	     type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
2330
	    (nlh->nlmsg_flags & NLM_F_DUMP)) {
L
Linus Torvalds 已提交
2331
		if (link->dump == NULL)
2332
			return -EINVAL;
2333

2334 2335 2336 2337 2338 2339 2340
		{
			struct netlink_dump_control c = {
				.dump = link->dump,
				.done = link->done,
			};
			return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
		}
L
Linus Torvalds 已提交
2341 2342
	}

2343
	err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
2344
			  xfrma_policy);
2345 2346
	if (err < 0)
		return err;
L
Linus Torvalds 已提交
2347 2348

	if (link->doit == NULL)
2349
		return -EINVAL;
L
Linus Torvalds 已提交
2350

2351
	return link->doit(skb, nlh, attrs);
L
Linus Torvalds 已提交
2352 2353
}

2354
static void xfrm_netlink_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
2355
{
2356 2357 2358
	mutex_lock(&xfrm_cfg_mutex);
	netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
	mutex_unlock(&xfrm_cfg_mutex);
L
Linus Torvalds 已提交
2359 2360
}

2361 2362
static inline size_t xfrm_expire_msgsize(void)
{
2363 2364
	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
	       + nla_total_size(sizeof(struct xfrm_mark));
2365 2366
}

2367
static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
L
Linus Torvalds 已提交
2368 2369 2370
{
	struct xfrm_user_expire *ue;
	struct nlmsghdr *nlh;
2371
	int err;
L
Linus Torvalds 已提交
2372

2373 2374 2375
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2376

2377
	ue = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2378
	copy_to_user_state(x, &ue->state);
J
Jamal Hadi Salim 已提交
2379
	ue->hard = (c->data.hard != 0) ? 1 : 0;
L
Linus Torvalds 已提交
2380

2381 2382 2383
	err = xfrm_mark_put(skb, &x->mark);
	if (err)
		return err;
2384

2385
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2386 2387
}

2388
static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
L
Linus Torvalds 已提交
2389
{
2390
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2391 2392
	struct sk_buff *skb;

2393
	skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
L
Linus Torvalds 已提交
2394 2395 2396
	if (skb == NULL)
		return -ENOMEM;

2397 2398 2399 2400
	if (build_expire(skb, x, c) < 0) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
L
Linus Torvalds 已提交
2401

2402
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2403 2404
}

2405
static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
J
Jamal Hadi Salim 已提交
2406
{
2407
	struct net *net = xs_net(x);
J
Jamal Hadi Salim 已提交
2408 2409
	struct sk_buff *skb;

2410
	skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2411 2412 2413 2414 2415 2416
	if (skb == NULL)
		return -ENOMEM;

	if (build_aevent(skb, x, c) < 0)
		BUG();

2417
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2418 2419
}

2420
static int xfrm_notify_sa_flush(const struct km_event *c)
2421
{
2422
	struct net *net = c->net;
2423 2424 2425
	struct xfrm_usersa_flush *p;
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2426
	int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
2427

2428
	skb = nlmsg_new(len, GFP_ATOMIC);
2429 2430 2431
	if (skb == NULL)
		return -ENOMEM;

2432 2433 2434 2435 2436
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
	if (nlh == NULL) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
2437

2438
	p = nlmsg_data(nlh);
2439
	p->proto = c->data.proto;
2440

2441
	nlmsg_end(skb, nlh);
2442

2443
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2444 2445
}

2446
static inline size_t xfrm_sa_len(struct xfrm_state *x)
2447
{
2448
	size_t l = 0;
2449 2450
	if (x->aead)
		l += nla_total_size(aead_len(x->aead));
2451 2452 2453 2454 2455
	if (x->aalg) {
		l += nla_total_size(sizeof(struct xfrm_algo) +
				    (x->aalg->alg_key_len + 7) / 8);
		l += nla_total_size(xfrm_alg_auth_len(x->aalg));
	}
2456
	if (x->ealg)
2457
		l += nla_total_size(xfrm_alg_len(x->ealg));
2458
	if (x->calg)
2459
		l += nla_total_size(sizeof(*x->calg));
2460
	if (x->encap)
2461
		l += nla_total_size(sizeof(*x->encap));
2462 2463
	if (x->tfcpad)
		l += nla_total_size(sizeof(x->tfcpad));
2464 2465
	if (x->replay_esn)
		l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
2466 2467 2468 2469 2470 2471
	if (x->security)
		l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
				    x->security->ctx_len);
	if (x->coaddr)
		l += nla_total_size(sizeof(*x->coaddr));

2472 2473
	/* Must count x->lastused as it may become non-zero behind our back. */
	l += nla_total_size(sizeof(u64));
2474 2475 2476 2477

	return l;
}

2478
static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
2479
{
2480
	struct net *net = xs_net(x);
2481
	struct xfrm_usersa_info *p;
2482
	struct xfrm_usersa_id *id;
2483 2484 2485
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
	int len = xfrm_sa_len(x);
2486
	int headlen, err;
2487 2488 2489

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELSA) {
2490
		len += nla_total_size(headlen);
2491
		headlen = sizeof(*id);
2492
		len += nla_total_size(sizeof(struct xfrm_mark));
2493
	}
2494
	len += NLMSG_ALIGN(headlen);
2495

2496
	skb = nlmsg_new(len, GFP_ATOMIC);
2497 2498 2499
	if (skb == NULL)
		return -ENOMEM;

2500
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2501
	err = -EMSGSIZE;
2502
	if (nlh == NULL)
2503
		goto out_free_skb;
2504

2505
	p = nlmsg_data(nlh);
2506
	if (c->event == XFRM_MSG_DELSA) {
2507 2508
		struct nlattr *attr;

2509
		id = nlmsg_data(nlh);
2510 2511 2512 2513 2514
		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
		id->spi = x->id.spi;
		id->family = x->props.family;
		id->proto = x->id.proto;

2515
		attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
2516
		err = -EMSGSIZE;
2517
		if (attr == NULL)
2518
			goto out_free_skb;
2519 2520

		p = nla_data(attr);
2521
	}
2522 2523 2524
	err = copy_to_user_state_extra(x, p, skb);
	if (err)
		goto out_free_skb;
2525

2526
	nlmsg_end(skb, nlh);
2527

2528
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2529

2530
out_free_skb:
2531
	kfree_skb(skb);
2532
	return err;
2533 2534
}

2535
static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
2536 2537 2538
{

	switch (c->event) {
2539
	case XFRM_MSG_EXPIRE:
2540
		return xfrm_exp_state_notify(x, c);
J
Jamal Hadi Salim 已提交
2541 2542
	case XFRM_MSG_NEWAE:
		return xfrm_aevent_state_notify(x, c);
2543 2544 2545
	case XFRM_MSG_DELSA:
	case XFRM_MSG_UPDSA:
	case XFRM_MSG_NEWSA:
2546
		return xfrm_notify_sa(x, c);
2547
	case XFRM_MSG_FLUSHSA:
2548 2549
		return xfrm_notify_sa_flush(c);
	default:
S
stephen hemminger 已提交
2550 2551 2552
		printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
		       c->event);
		break;
2553 2554 2555 2556 2557 2558
	}

	return 0;

}

2559 2560 2561 2562 2563
static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
					  struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2564
	       + nla_total_size(sizeof(struct xfrm_mark))
2565 2566 2567 2568
	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2569
static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
2570
			 struct xfrm_tmpl *xt, struct xfrm_policy *xp)
L
Linus Torvalds 已提交
2571
{
2572
	__u32 seq = xfrm_get_acqseq();
L
Linus Torvalds 已提交
2573 2574
	struct xfrm_user_acquire *ua;
	struct nlmsghdr *nlh;
2575
	int err;
L
Linus Torvalds 已提交
2576

2577 2578 2579
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2580

2581
	ua = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2582 2583 2584
	memcpy(&ua->id, &x->id, sizeof(ua->id));
	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
2585
	copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT);
L
Linus Torvalds 已提交
2586 2587 2588 2589 2590
	ua->aalgos = xt->aalgos;
	ua->ealgos = xt->ealgos;
	ua->calgos = xt->calgos;
	ua->seq = x->km.seq = seq;

2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_state_sec_ctx(x, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
L
Linus Torvalds 已提交
2602

2603
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2604 2605 2606
}

static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
2607
			     struct xfrm_policy *xp)
L
Linus Torvalds 已提交
2608
{
2609
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2610 2611
	struct sk_buff *skb;

2612
	skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2613 2614 2615
	if (skb == NULL)
		return -ENOMEM;

2616
	if (build_acquire(skb, x, xt, xp) < 0)
L
Linus Torvalds 已提交
2617 2618
		BUG();

2619
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2620 2621 2622 2623 2624
}

/* User gives us xfrm_user_policy_info followed by an array of 0
 * or more templates.
 */
2625
static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
L
Linus Torvalds 已提交
2626 2627
					       u8 *data, int len, int *dir)
{
2628
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
2629 2630 2631 2632 2633
	struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
	struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
	struct xfrm_policy *xp;
	int nr;

2634
	switch (sk->sk_family) {
L
Linus Torvalds 已提交
2635 2636 2637 2638 2639 2640
	case AF_INET:
		if (opt != IP_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
E
Eric Dumazet 已提交
2641
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660
	case AF_INET6:
		if (opt != IPV6_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
#endif
	default:
		*dir = -EINVAL;
		return NULL;
	}

	*dir = -EINVAL;

	if (len < sizeof(*p) ||
	    verify_newpolicy_info(p))
		return NULL;

	nr = ((len - sizeof(*p)) / sizeof(*ut));
2661
	if (validate_tmpl(nr, ut, p->sel.family))
L
Linus Torvalds 已提交
2662 2663
		return NULL;

2664 2665 2666
	if (p->dir > XFRM_POLICY_OUT)
		return NULL;

2667
	xp = xfrm_policy_alloc(net, GFP_ATOMIC);
L
Linus Torvalds 已提交
2668 2669 2670 2671 2672 2673
	if (xp == NULL) {
		*dir = -ENOBUFS;
		return NULL;
	}

	copy_from_user_policy(xp, p);
2674
	xp->type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
2675 2676 2677 2678 2679 2680 2681
	copy_templates(xp, ut, nr);

	*dir = p->dir;

	return xp;
}

2682 2683 2684 2685 2686
static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
2687
	       + nla_total_size(sizeof(struct xfrm_mark))
2688 2689 2690
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2691
static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2692
			   int dir, const struct km_event *c)
L
Linus Torvalds 已提交
2693 2694
{
	struct xfrm_user_polexpire *upe;
J
Jamal Hadi Salim 已提交
2695
	int hard = c->data.hard;
2696 2697
	struct nlmsghdr *nlh;
	int err;
L
Linus Torvalds 已提交
2698

2699 2700 2701
	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2702

2703
	upe = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2704
	copy_to_user_policy(xp, &upe->pol, dir);
2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_sec_ctx(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
L
Linus Torvalds 已提交
2716 2717
	upe->hard = !!hard;

2718
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2719 2720
}

2721
static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
L
Linus Torvalds 已提交
2722
{
2723
	struct net *net = xp_net(xp);
L
Linus Torvalds 已提交
2724 2725
	struct sk_buff *skb;

2726
	skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2727 2728 2729
	if (skb == NULL)
		return -ENOMEM;

J
Jamal Hadi Salim 已提交
2730
	if (build_polexpire(skb, xp, dir, c) < 0)
L
Linus Torvalds 已提交
2731 2732
		BUG();

2733
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2734 2735
}

2736
static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
2737
{
2738
	int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2739
	struct net *net = xp_net(xp);
2740
	struct xfrm_userpolicy_info *p;
2741
	struct xfrm_userpolicy_id *id;
2742 2743
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2744
	int headlen, err;
2745 2746 2747

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELPOLICY) {
2748
		len += nla_total_size(headlen);
2749 2750
		headlen = sizeof(*id);
	}
2751
	len += userpolicy_type_attrsize();
2752
	len += nla_total_size(sizeof(struct xfrm_mark));
2753
	len += NLMSG_ALIGN(headlen);
2754

2755
	skb = nlmsg_new(len, GFP_ATOMIC);
2756 2757 2758
	if (skb == NULL)
		return -ENOMEM;

2759
	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2760
	err = -EMSGSIZE;
2761
	if (nlh == NULL)
2762
		goto out_free_skb;
2763

2764
	p = nlmsg_data(nlh);
2765
	if (c->event == XFRM_MSG_DELPOLICY) {
2766 2767
		struct nlattr *attr;

2768
		id = nlmsg_data(nlh);
2769 2770 2771 2772 2773 2774 2775
		memset(id, 0, sizeof(*id));
		id->dir = dir;
		if (c->data.byid)
			id->index = xp->index;
		else
			memcpy(&id->sel, &xp->selector, sizeof(id->sel));

2776
		attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
2777
		err = -EMSGSIZE;
2778
		if (attr == NULL)
2779
			goto out_free_skb;
2780 2781

		p = nla_data(attr);
2782
	}
2783 2784

	copy_to_user_policy(xp, p, dir);
2785 2786 2787 2788 2789 2790 2791
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err)
		goto out_free_skb;
2792

2793
	nlmsg_end(skb, nlh);
2794

2795
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2796

2797
out_free_skb:
2798
	kfree_skb(skb);
2799
	return err;
2800 2801
}

2802
static int xfrm_notify_policy_flush(const struct km_event *c)
2803
{
2804
	struct net *net = c->net;
2805 2806
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2807
	int err;
2808

2809
	skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
2810 2811 2812
	if (skb == NULL)
		return -ENOMEM;

2813
	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
2814
	err = -EMSGSIZE;
2815
	if (nlh == NULL)
2816 2817 2818 2819
		goto out_free_skb;
	err = copy_to_user_policy_type(c->data.type, skb);
	if (err)
		goto out_free_skb;
2820

2821
	nlmsg_end(skb, nlh);
2822

2823
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2824

2825
out_free_skb:
2826
	kfree_skb(skb);
2827
	return err;
2828 2829
}

2830
static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
2831 2832 2833
{

	switch (c->event) {
2834 2835 2836
	case XFRM_MSG_NEWPOLICY:
	case XFRM_MSG_UPDPOLICY:
	case XFRM_MSG_DELPOLICY:
2837
		return xfrm_notify_policy(xp, dir, c);
2838
	case XFRM_MSG_FLUSHPOLICY:
2839
		return xfrm_notify_policy_flush(c);
2840
	case XFRM_MSG_POLEXPIRE:
2841 2842
		return xfrm_exp_policy_notify(xp, dir, c);
	default:
S
stephen hemminger 已提交
2843 2844
		printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
		       c->event);
2845 2846 2847 2848 2849 2850
	}

	return 0;

}

2851 2852 2853 2854 2855
static inline size_t xfrm_report_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
}

2856 2857 2858 2859 2860 2861
static int build_report(struct sk_buff *skb, u8 proto,
			struct xfrm_selector *sel, xfrm_address_t *addr)
{
	struct xfrm_user_report *ur;
	struct nlmsghdr *nlh;

2862 2863 2864
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2865

2866
	ur = nlmsg_data(nlh);
2867 2868 2869
	ur->proto = proto;
	memcpy(&ur->sel, sel, sizeof(ur->sel));

2870 2871 2872 2873 2874 2875 2876
	if (addr) {
		int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr);
		if (err) {
			nlmsg_cancel(skb, nlh);
			return err;
		}
	}
2877
	return nlmsg_end(skb, nlh);
2878 2879
}

2880 2881
static int xfrm_send_report(struct net *net, u8 proto,
			    struct xfrm_selector *sel, xfrm_address_t *addr)
2882 2883 2884
{
	struct sk_buff *skb;

2885
	skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
2886 2887 2888 2889 2890 2891
	if (skb == NULL)
		return -ENOMEM;

	if (build_report(skb, proto, sel, addr) < 0)
		BUG();

2892
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
2893 2894
}

2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927
static inline size_t xfrm_mapping_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
}

static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
			 xfrm_address_t *new_saddr, __be16 new_sport)
{
	struct xfrm_user_mapping *um;
	struct nlmsghdr *nlh;

	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
	if (nlh == NULL)
		return -EMSGSIZE;

	um = nlmsg_data(nlh);

	memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
	um->id.spi = x->id.spi;
	um->id.family = x->props.family;
	um->id.proto = x->id.proto;
	memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
	memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
	um->new_sport = new_sport;
	um->old_sport = x->encap->encap_sport;
	um->reqid = x->props.reqid;

	return nlmsg_end(skb, nlh);
}

static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
			     __be16 sport)
{
2928
	struct net *net = xs_net(x);
2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943
	struct sk_buff *skb;

	if (x->id.proto != IPPROTO_ESP)
		return -EINVAL;

	if (!x->encap)
		return -EINVAL;

	skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
	if (skb == NULL)
		return -ENOMEM;

	if (build_mapping(skb, x, ipaddr, sport) < 0)
		BUG();

2944
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
2945 2946
}

L
Linus Torvalds 已提交
2947 2948 2949 2950 2951 2952
static struct xfrm_mgr netlink_mgr = {
	.id		= "netlink",
	.notify		= xfrm_send_state_notify,
	.acquire	= xfrm_send_acquire,
	.compile_policy	= xfrm_compile_policy,
	.notify_policy	= xfrm_send_policy_notify,
2953
	.report		= xfrm_send_report,
2954
	.migrate	= xfrm_send_migrate,
2955
	.new_mapping	= xfrm_send_mapping,
L
Linus Torvalds 已提交
2956 2957
};

2958
static int __net_init xfrm_user_net_init(struct net *net)
L
Linus Torvalds 已提交
2959
{
2960
	struct sock *nlsk;
2961 2962 2963 2964
	struct netlink_kernel_cfg cfg = {
		.groups	= XFRMNLGRP_MAX,
		.input	= xfrm_netlink_rcv,
	};
2965

2966
	nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg);
2967
	if (nlsk == NULL)
L
Linus Torvalds 已提交
2968
		return -ENOMEM;
2969
	net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
2970
	rcu_assign_pointer(net->xfrm.nlsk, nlsk);
L
Linus Torvalds 已提交
2971 2972 2973
	return 0;
}

2974
static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
L
Linus Torvalds 已提交
2975
{
2976 2977
	struct net *net;
	list_for_each_entry(net, net_exit_list, exit_list)
2978
		RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
2979 2980 2981
	synchronize_net();
	list_for_each_entry(net, net_exit_list, exit_list)
		netlink_kernel_release(net->xfrm.nlsk_stash);
L
Linus Torvalds 已提交
2982 2983
}

2984
static struct pernet_operations xfrm_user_net_ops = {
2985 2986
	.init	    = xfrm_user_net_init,
	.exit_batch = xfrm_user_net_exit,
2987 2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998 2999 3000 3001 3002 3003 3004 3005 3006 3007 3008 3009
};

static int __init xfrm_user_init(void)
{
	int rv;

	printk(KERN_INFO "Initializing XFRM netlink socket\n");

	rv = register_pernet_subsys(&xfrm_user_net_ops);
	if (rv < 0)
		return rv;
	rv = xfrm_register_km(&netlink_mgr);
	if (rv < 0)
		unregister_pernet_subsys(&xfrm_user_net_ops);
	return rv;
}

static void __exit xfrm_user_exit(void)
{
	xfrm_unregister_km(&netlink_mgr);
	unregister_pernet_subsys(&xfrm_user_net_ops);
}

L
Linus Torvalds 已提交
3010 3011 3012
module_init(xfrm_user_init);
module_exit(xfrm_user_exit);
MODULE_LICENSE("GPL");
3013
MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
3014