xfrm_user.c 70.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9
/* xfrm_user.c: User interface to configure xfrm engine.
 *
 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
 *
 * Changes:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
10
 *
L
Linus Torvalds 已提交
11 12
 */

13
#include <linux/crypto.h>
L
Linus Torvalds 已提交
14 15 16 17 18 19 20 21 22 23 24 25 26 27
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/socket.h>
#include <linux/string.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/pfkeyv2.h>
#include <linux/ipsec.h>
#include <linux/init.h>
#include <linux/security.h>
#include <net/sock.h>
#include <net/xfrm.h>
28
#include <net/netlink.h>
29
#include <net/ah.h>
L
Linus Torvalds 已提交
30
#include <asm/uaccess.h>
E
Eric Dumazet 已提交
31
#if IS_ENABLED(CONFIG_IPV6)
32 33
#include <linux/in6.h>
#endif
L
Linus Torvalds 已提交
34

35 36 37 38 39
static inline int aead_len(struct xfrm_algo_aead *alg)
{
	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
}

40
static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
L
Linus Torvalds 已提交
41
{
42
	struct nlattr *rt = attrs[type];
L
Linus Torvalds 已提交
43 44 45 46 47
	struct xfrm_algo *algp;

	if (!rt)
		return 0;

48
	algp = nla_data(rt);
49
	if (nla_len(rt) < xfrm_alg_len(algp))
50 51
		return -EINVAL;

L
Linus Torvalds 已提交
52 53 54 55 56 57 58 59
	switch (type) {
	case XFRMA_ALG_AUTH:
	case XFRMA_ALG_CRYPT:
	case XFRMA_ALG_COMP:
		break;

	default:
		return -EINVAL;
60
	}
L
Linus Torvalds 已提交
61 62 63 64 65

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81
static int verify_auth_trunc(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
	struct xfrm_algo_auth *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < xfrm_alg_auth_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97
static int verify_aead(struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
	struct xfrm_algo_aead *algp;

	if (!rt)
		return 0;

	algp = nla_data(rt);
	if (nla_len(rt) < aead_len(algp))
		return -EINVAL;

	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
	return 0;
}

98
static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
99 100
			   xfrm_address_t **addrp)
{
101
	struct nlattr *rt = attrs[type];
102

103
	if (rt && addrp)
104
		*addrp = nla_data(rt);
105
}
106

107
static inline int verify_sec_ctx_len(struct nlattr **attrs)
108
{
109
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
110 111 112 113 114
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

115
	uctx = nla_data(rt);
116
	if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
117 118 119 120 121
		return -EINVAL;

	return 0;
}

122 123 124 125
static inline int verify_replay(struct xfrm_usersa_info *p,
				struct nlattr **attrs)
{
	struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
126
	struct xfrm_replay_state_esn *rs;
127

128 129 130 131 132 133 134 135 136 137 138 139 140
	if (p->flags & XFRM_STATE_ESN) {
		if (!rt)
			return -EINVAL;

		rs = nla_data(rt);

		if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
			return -EINVAL;

		if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
		    nla_len(rt) != sizeof(*rs))
			return -EINVAL;
	}
141

142 143 144
	if (!rt)
		return 0;

145 146 147
	if (p->id.proto != IPPROTO_ESP)
		return -EINVAL;

148 149 150 151 152
	if (p->replay_window != 0)
		return -EINVAL;

	return 0;
}
153

L
Linus Torvalds 已提交
154
static int verify_newsa_info(struct xfrm_usersa_info *p,
155
			     struct nlattr **attrs)
L
Linus Torvalds 已提交
156 157 158 159 160 161 162 163 164
{
	int err;

	err = -EINVAL;
	switch (p->family) {
	case AF_INET:
		break;

	case AF_INET6:
E
Eric Dumazet 已提交
165
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
166 167 168 169 170 171 172 173
		break;
#else
		err = -EAFNOSUPPORT;
		goto out;
#endif

	default:
		goto out;
174
	}
L
Linus Torvalds 已提交
175 176 177 178

	err = -EINVAL;
	switch (p->id.proto) {
	case IPPROTO_AH:
179 180
		if ((!attrs[XFRMA_ALG_AUTH]	&&
		     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
181
		    attrs[XFRMA_ALG_AEAD]	||
182
		    attrs[XFRMA_ALG_CRYPT]	||
183 184
		    attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_TFCPAD])
L
Linus Torvalds 已提交
185 186 187 188
			goto out;
		break;

	case IPPROTO_ESP:
189 190 191
		if (attrs[XFRMA_ALG_COMP])
			goto out;
		if (!attrs[XFRMA_ALG_AUTH] &&
192
		    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
193 194 195 196
		    !attrs[XFRMA_ALG_CRYPT] &&
		    !attrs[XFRMA_ALG_AEAD])
			goto out;
		if ((attrs[XFRMA_ALG_AUTH] ||
197
		     attrs[XFRMA_ALG_AUTH_TRUNC] ||
198 199
		     attrs[XFRMA_ALG_CRYPT]) &&
		    attrs[XFRMA_ALG_AEAD])
L
Linus Torvalds 已提交
200
			goto out;
201 202 203
		if (attrs[XFRMA_TFCPAD] &&
		    p->mode != XFRM_MODE_TUNNEL)
			goto out;
L
Linus Torvalds 已提交
204 205 206
		break;

	case IPPROTO_COMP:
207
		if (!attrs[XFRMA_ALG_COMP]	||
208
		    attrs[XFRMA_ALG_AEAD]	||
209
		    attrs[XFRMA_ALG_AUTH]	||
210
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
211 212
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_TFCPAD])
L
Linus Torvalds 已提交
213 214 215
			goto out;
		break;

E
Eric Dumazet 已提交
216
#if IS_ENABLED(CONFIG_IPV6)
217 218
	case IPPROTO_DSTOPTS:
	case IPPROTO_ROUTING:
219 220
		if (attrs[XFRMA_ALG_COMP]	||
		    attrs[XFRMA_ALG_AUTH]	||
221
		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
222
		    attrs[XFRMA_ALG_AEAD]	||
223 224 225
		    attrs[XFRMA_ALG_CRYPT]	||
		    attrs[XFRMA_ENCAP]		||
		    attrs[XFRMA_SEC_CTX]	||
226
		    attrs[XFRMA_TFCPAD]		||
227
		    !attrs[XFRMA_COADDR])
228 229 230 231
			goto out;
		break;
#endif

L
Linus Torvalds 已提交
232 233
	default:
		goto out;
234
	}
L
Linus Torvalds 已提交
235

236 237
	if ((err = verify_aead(attrs)))
		goto out;
238 239
	if ((err = verify_auth_trunc(attrs)))
		goto out;
240
	if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
L
Linus Torvalds 已提交
241
		goto out;
242
	if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
L
Linus Torvalds 已提交
243
		goto out;
244
	if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
L
Linus Torvalds 已提交
245
		goto out;
246
	if ((err = verify_sec_ctx_len(attrs)))
247
		goto out;
248 249
	if ((err = verify_replay(p, attrs)))
		goto out;
L
Linus Torvalds 已提交
250 251 252

	err = -EINVAL;
	switch (p->mode) {
253 254
	case XFRM_MODE_TRANSPORT:
	case XFRM_MODE_TUNNEL:
255
	case XFRM_MODE_ROUTEOPTIMIZATION:
D
Diego Beltrami 已提交
256
	case XFRM_MODE_BEET:
L
Linus Torvalds 已提交
257 258 259 260
		break;

	default:
		goto out;
261
	}
L
Linus Torvalds 已提交
262 263 264 265 266 267 268 269

	err = 0;

out:
	return err;
}

static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
270
			   struct xfrm_algo_desc *(*get_byname)(const char *, int),
271
			   struct nlattr *rta)
L
Linus Torvalds 已提交
272 273 274 275 276 277 278
{
	struct xfrm_algo *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

279
	ualg = nla_data(rta);
L
Linus Torvalds 已提交
280 281 282 283 284 285

	algo = get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

286
	p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
L
Linus Torvalds 已提交
287 288 289
	if (!p)
		return -ENOMEM;

290
	strcpy(p->alg_name, algo->name);
L
Linus Torvalds 已提交
291 292 293 294
	*algpp = p;
	return 0;
}

295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338
static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo *ualg;
	struct xfrm_algo_auth *p;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	p->alg_key_len = ualg->alg_key_len;
	p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
	memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);

	*algpp = p;
	return 0;
}

static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
			     struct nlattr *rta)
{
	struct xfrm_algo_auth *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
	if (!algo)
		return -ENOSYS;
339 340
	if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
	    ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
341 342 343 344 345 346 347 348 349 350 351 352 353 354 355
		return -EINVAL;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	if (!p->alg_trunc_len)
		p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;

	*algpp = p;
	return 0;
}

356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380
static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
		       struct nlattr *rta)
{
	struct xfrm_algo_aead *p, *ualg;
	struct xfrm_algo_desc *algo;

	if (!rta)
		return 0;

	ualg = nla_data(rta);

	algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
	if (!algo)
		return -ENOSYS;
	*props = algo->desc.sadb_alg_id;

	p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	strcpy(p->alg_name, algo->name);
	*algpp = p;
	return 0;
}

381 382 383 384
static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
					 struct nlattr *rp)
{
	struct xfrm_replay_state_esn *up;
385
	int ulen;
386 387 388 389 390

	if (!replay_esn || !rp)
		return 0;

	up = nla_data(rp);
391
	ulen = xfrm_replay_state_esn_len(up);
392

393
	if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
394 395 396 397 398
		return -EINVAL;

	return 0;
}

399 400 401 402 403
static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
				       struct xfrm_replay_state_esn **preplay_esn,
				       struct nlattr *rta)
{
	struct xfrm_replay_state_esn *p, *pp, *up;
404
	int klen, ulen;
405 406 407 408 409

	if (!rta)
		return 0;

	up = nla_data(rta);
410 411
	klen = xfrm_replay_state_esn_len(up);
	ulen = nla_len(rta) >= klen ? klen : sizeof(*up);
412

413
	p = kzalloc(klen, GFP_KERNEL);
414 415 416
	if (!p)
		return -ENOMEM;

417
	pp = kzalloc(klen, GFP_KERNEL);
418 419 420 421 422
	if (!pp) {
		kfree(p);
		return -ENOMEM;
	}

423 424 425
	memcpy(p, up, ulen);
	memcpy(pp, up, ulen);

426 427 428 429 430 431
	*replay_esn = p;
	*preplay_esn = pp;

	return 0;
}

432
static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
433 434 435 436 437 438 439 440 441 442
{
	int len = 0;

	if (xfrm_ctx) {
		len += sizeof(struct xfrm_user_sec_ctx);
		len += xfrm_ctx->ctx_len;
	}
	return len;
}

L
Linus Torvalds 已提交
443 444 445 446 447 448 449 450 451
static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
	memcpy(&x->id, &p->id, sizeof(x->id));
	memcpy(&x->sel, &p->sel, sizeof(x->sel));
	memcpy(&x->lft, &p->lft, sizeof(x->lft));
	x->props.mode = p->mode;
	x->props.replay_window = p->replay_window;
	x->props.reqid = p->reqid;
	x->props.family = p->family;
452
	memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
L
Linus Torvalds 已提交
453
	x->props.flags = p->flags;
454

455
	if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
456
		x->sel.family = p->family;
L
Linus Torvalds 已提交
457 458
}

J
Jamal Hadi Salim 已提交
459 460 461 462 463
/*
 * someday when pfkey also has support, we could have the code
 * somehow made shareable and move it to xfrm_state.c - JHS
 *
*/
464 465
static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
				  int update_esn)
J
Jamal Hadi Salim 已提交
466
{
467
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
468
	struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
469 470 471
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
J
Jamal Hadi Salim 已提交
472

473 474 475 476 477 478 479 480 481
	if (re) {
		struct xfrm_replay_state_esn *replay_esn;
		replay_esn = nla_data(re);
		memcpy(x->replay_esn, replay_esn,
		       xfrm_replay_state_esn_len(replay_esn));
		memcpy(x->preplay_esn, replay_esn,
		       xfrm_replay_state_esn_len(replay_esn));
	}

J
Jamal Hadi Salim 已提交
482 483
	if (rp) {
		struct xfrm_replay_state *replay;
484
		replay = nla_data(rp);
J
Jamal Hadi Salim 已提交
485 486 487 488 489 490
		memcpy(&x->replay, replay, sizeof(*replay));
		memcpy(&x->preplay, replay, sizeof(*replay));
	}

	if (lt) {
		struct xfrm_lifetime_cur *ltime;
491
		ltime = nla_data(lt);
J
Jamal Hadi Salim 已提交
492 493 494 495 496 497
		x->curlft.bytes = ltime->bytes;
		x->curlft.packets = ltime->packets;
		x->curlft.add_time = ltime->add_time;
		x->curlft.use_time = ltime->use_time;
	}

498
	if (et)
499
		x->replay_maxage = nla_get_u32(et);
J
Jamal Hadi Salim 已提交
500

501
	if (rt)
502
		x->replay_maxdiff = nla_get_u32(rt);
J
Jamal Hadi Salim 已提交
503 504
}

505 506
static struct xfrm_state *xfrm_state_construct(struct net *net,
					       struct xfrm_usersa_info *p,
507
					       struct nlattr **attrs,
L
Linus Torvalds 已提交
508 509
					       int *errp)
{
510
	struct xfrm_state *x = xfrm_state_alloc(net);
L
Linus Torvalds 已提交
511 512 513 514 515 516 517
	int err = -ENOMEM;

	if (!x)
		goto error_no_put;

	copy_from_user_state(x, p);

518 519 520
	if (attrs[XFRMA_SA_EXTRA_FLAGS])
		x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);

521 522 523
	if ((err = attach_aead(&x->aead, &x->props.ealgo,
			       attrs[XFRMA_ALG_AEAD])))
		goto error;
524 525
	if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
				     attrs[XFRMA_ALG_AUTH_TRUNC])))
L
Linus Torvalds 已提交
526
		goto error;
527 528 529 530 531
	if (!x->props.aalgo) {
		if ((err = attach_auth(&x->aalg, &x->props.aalgo,
				       attrs[XFRMA_ALG_AUTH])))
			goto error;
	}
L
Linus Torvalds 已提交
532 533
	if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
				   xfrm_ealg_get_byname,
534
				   attrs[XFRMA_ALG_CRYPT])))
L
Linus Torvalds 已提交
535 536 537
		goto error;
	if ((err = attach_one_algo(&x->calg, &x->props.calgo,
				   xfrm_calg_get_byname,
538
				   attrs[XFRMA_ALG_COMP])))
L
Linus Torvalds 已提交
539
		goto error;
540 541 542 543 544 545 546 547

	if (attrs[XFRMA_ENCAP]) {
		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
				   sizeof(*x->encap), GFP_KERNEL);
		if (x->encap == NULL)
			goto error;
	}

548 549 550
	if (attrs[XFRMA_TFCPAD])
		x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);

551 552 553 554 555 556 557
	if (attrs[XFRMA_COADDR]) {
		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
				    sizeof(*x->coaddr), GFP_KERNEL);
		if (x->coaddr == NULL)
			goto error;
	}

558 559
	xfrm_mark_get(attrs, &x->mark);

560
	err = __xfrm_init_state(x, false);
L
Linus Torvalds 已提交
561 562 563
	if (err)
		goto error;

564 565
	if (attrs[XFRMA_SEC_CTX] &&
	    security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
566 567
		goto error;

568 569 570 571
	if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
					       attrs[XFRMA_REPLAY_ESN_VAL])))
		goto error;

L
Linus Torvalds 已提交
572
	x->km.seq = p->seq;
A
Alexey Dobriyan 已提交
573
	x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
J
Jamal Hadi Salim 已提交
574
	/* sysctl_xfrm_aevent_etime is in 100ms units */
A
Alexey Dobriyan 已提交
575
	x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
J
Jamal Hadi Salim 已提交
576

577 578
	if ((err = xfrm_init_replay(x)))
		goto error;
J
Jamal Hadi Salim 已提交
579

580
	/* override default values from above */
581
	xfrm_update_ae_params(x, attrs, 0);
L
Linus Torvalds 已提交
582 583 584 585 586 587 588 589 590 591 592

	return x;

error:
	x->km.state = XFRM_STATE_DEAD;
	xfrm_state_put(x);
error_no_put:
	*errp = err;
	return NULL;
}

593
static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
594
		struct nlattr **attrs)
L
Linus Torvalds 已提交
595
{
596
	struct net *net = sock_net(skb->sk);
597
	struct xfrm_usersa_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
598 599
	struct xfrm_state *x;
	int err;
600
	struct km_event c;
601
	kuid_t loginuid = audit_get_loginuid(current);
602 603
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
604

605
	err = verify_newsa_info(p, attrs);
L
Linus Torvalds 已提交
606 607 608
	if (err)
		return err;

609
	x = xfrm_state_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
610 611 612
	if (!x)
		return err;

613
	xfrm_state_hold(x);
L
Linus Torvalds 已提交
614 615 616 617 618
	if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
		err = xfrm_state_add(x);
	else
		err = xfrm_state_update(x);

619
	security_task_getsecid(current, &sid);
620
	xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
621

L
Linus Torvalds 已提交
622 623
	if (err < 0) {
		x->km.state = XFRM_STATE_DEAD;
624
		__xfrm_state_put(x);
625
		goto out;
L
Linus Torvalds 已提交
626 627
	}

628
	c.seq = nlh->nlmsg_seq;
629
	c.portid = nlh->nlmsg_pid;
630
	c.event = nlh->nlmsg_type;
631 632

	km_state_notify(x, &c);
633
out:
634
	xfrm_state_put(x);
L
Linus Torvalds 已提交
635 636 637
	return err;
}

638 639
static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
						 struct xfrm_usersa_id *p,
640
						 struct nlattr **attrs,
641 642 643
						 int *errp)
{
	struct xfrm_state *x = NULL;
644
	struct xfrm_mark m;
645
	int err;
646
	u32 mark = xfrm_mark_get(attrs, &m);
647 648 649

	if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
		err = -ESRCH;
650
		x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
651 652 653
	} else {
		xfrm_address_t *saddr = NULL;

654
		verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
655 656 657 658 659
		if (!saddr) {
			err = -EINVAL;
			goto out;
		}

660
		err = -ESRCH;
661 662
		x = xfrm_state_lookup_byaddr(net, mark,
					     &p->daddr, saddr,
663
					     p->proto, p->family);
664 665 666 667 668 669 670 671
	}

 out:
	if (!x && errp)
		*errp = err;
	return x;
}

672
static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
673
		struct nlattr **attrs)
L
Linus Torvalds 已提交
674
{
675
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
676
	struct xfrm_state *x;
677
	int err = -ESRCH;
678
	struct km_event c;
679
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
680
	kuid_t loginuid = audit_get_loginuid(current);
681 682
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
683

684
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
685
	if (x == NULL)
686
		return err;
L
Linus Torvalds 已提交
687

688
	if ((err = security_xfrm_state_delete(x)) != 0)
C
Catherine Zhang 已提交
689 690
		goto out;

L
Linus Torvalds 已提交
691
	if (xfrm_state_kern(x)) {
C
Catherine Zhang 已提交
692 693
		err = -EPERM;
		goto out;
L
Linus Torvalds 已提交
694 695
	}

696
	err = xfrm_state_delete(x);
J
Joy Latten 已提交
697

C
Catherine Zhang 已提交
698 699
	if (err < 0)
		goto out;
700 701

	c.seq = nlh->nlmsg_seq;
702
	c.portid = nlh->nlmsg_pid;
703
	c.event = nlh->nlmsg_type;
704
	km_state_notify(x, &c);
L
Linus Torvalds 已提交
705

C
Catherine Zhang 已提交
706
out:
707
	security_task_getsecid(current, &sid);
708
	xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
C
Catherine Zhang 已提交
709
	xfrm_state_put(x);
710
	return err;
L
Linus Torvalds 已提交
711 712 713 714
}

static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
{
715
	memset(p, 0, sizeof(*p));
L
Linus Torvalds 已提交
716 717 718 719 720
	memcpy(&p->id, &x->id, sizeof(p->id));
	memcpy(&p->sel, &x->sel, sizeof(p->sel));
	memcpy(&p->lft, &x->lft, sizeof(p->lft));
	memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
	memcpy(&p->stats, &x->stats, sizeof(p->stats));
721
	memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
L
Linus Torvalds 已提交
722 723 724 725 726 727 728 729 730 731 732 733 734 735 736
	p->mode = x->props.mode;
	p->replay_window = x->props.replay_window;
	p->reqid = x->props.reqid;
	p->family = x->props.family;
	p->flags = x->props.flags;
	p->seq = x->km.seq;
}

struct xfrm_dump_info {
	struct sk_buff *in_skb;
	struct sk_buff *out_skb;
	u32 nlmsg_seq;
	u16 nlmsg_flags;
};

737 738 739 740
static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
{
	struct xfrm_user_sec_ctx *uctx;
	struct nlattr *attr;
741
	int ctx_size = sizeof(*uctx) + s->ctx_len;
742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757

	attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
	if (attr == NULL)
		return -EMSGSIZE;

	uctx = nla_data(attr);
	uctx->exttype = XFRMA_SEC_CTX;
	uctx->len = ctx_size;
	uctx->ctx_doi = s->ctx_doi;
	uctx->ctx_alg = s->ctx_alg;
	uctx->ctx_len = s->ctx_len;
	memcpy(uctx + 1, s->ctx_str, s->ctx_len);

	return 0;
}

758 759 760 761 762 763 764 765 766 767 768
static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
{
	struct xfrm_algo *algo;
	struct nlattr *nla;

	nla = nla_reserve(skb, XFRMA_ALG_AUTH,
			  sizeof(*algo) + (auth->alg_key_len + 7) / 8);
	if (!nla)
		return -EMSGSIZE;

	algo = nla_data(nla);
769
	strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
770 771 772 773 774 775
	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
	algo->alg_key_len = auth->alg_key_len;

	return 0;
}

776 777 778 779
/* Don't change this without updating xfrm_sa_len! */
static int copy_to_user_state_extra(struct xfrm_state *x,
				    struct xfrm_usersa_info *p,
				    struct sk_buff *skb)
L
Linus Torvalds 已提交
780
{
781
	int ret = 0;
782

783
	copy_to_user_state(x, p);
784

785 786 787 788 789 790 791
	if (x->props.extra_flags) {
		ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS,
				  x->props.extra_flags);
		if (ret)
			goto out;
	}

792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848
	if (x->coaddr) {
		ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
		if (ret)
			goto out;
	}
	if (x->lastused) {
		ret = nla_put_u64(skb, XFRMA_LASTUSED, x->lastused);
		if (ret)
			goto out;
	}
	if (x->aead) {
		ret = nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
		if (ret)
			goto out;
	}
	if (x->aalg) {
		ret = copy_to_user_auth(x->aalg, skb);
		if (!ret)
			ret = nla_put(skb, XFRMA_ALG_AUTH_TRUNC,
				      xfrm_alg_auth_len(x->aalg), x->aalg);
		if (ret)
			goto out;
	}
	if (x->ealg) {
		ret = nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
		if (ret)
			goto out;
	}
	if (x->calg) {
		ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
		if (ret)
			goto out;
	}
	if (x->encap) {
		ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
		if (ret)
			goto out;
	}
	if (x->tfcpad) {
		ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad);
		if (ret)
			goto out;
	}
	ret = xfrm_mark_put(skb, &x->mark);
	if (ret)
		goto out;
	if (x->replay_esn) {
		ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
			      xfrm_replay_state_esn_len(x->replay_esn),
			      x->replay_esn);
		if (ret)
			goto out;
	}
	if (x->security)
		ret = copy_sec_ctx(x->security, skb);
out:
	return ret;
849 850 851 852 853 854 855 856 857 858 859
}

static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct xfrm_usersa_info *p;
	struct nlmsghdr *nlh;
	int err;

860
	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
861 862 863 864 865 866 867
			XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;

	p = nlmsg_data(nlh);

	err = copy_to_user_state_extra(x, p, skb);
868 869 870 871
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
872
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
873 874 875
	return 0;
}

876 877 878 879 880 881 882
static int xfrm_dump_sa_done(struct netlink_callback *cb)
{
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
	xfrm_state_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
883 884
static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
{
885
	struct net *net = sock_net(skb->sk);
886
	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
L
Linus Torvalds 已提交
887 888
	struct xfrm_dump_info info;

889 890 891
	BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
892 893 894 895
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
896 897 898 899 900 901

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_state_walk_init(walk, 0);
	}

902
	(void) xfrm_state_walk(net, walk, dump_one_state, &info);
L
Linus Torvalds 已提交
903 904 905 906 907 908 909 910 911

	return skb->len;
}

static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
					  struct xfrm_state *x, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;
912
	int err;
L
Linus Torvalds 已提交
913

914
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
L
Linus Torvalds 已提交
915 916 917 918 919 920 921 922
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

923 924
	err = dump_one_state(x, 0, &info);
	if (err) {
L
Linus Torvalds 已提交
925
		kfree_skb(skb);
926
		return ERR_PTR(err);
L
Linus Torvalds 已提交
927 928 929 930 931
	}

	return skb;
}

932 933 934 935 936 937 938
static inline size_t xfrm_spdinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_spdinfo))
	       + nla_total_size(sizeof(struct xfrmu_spdhinfo));
}

939
static int build_spdinfo(struct sk_buff *skb, struct net *net,
940
			 u32 portid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
941
{
942 943 944
	struct xfrmk_spdinfo si;
	struct xfrmu_spdinfo spc;
	struct xfrmu_spdhinfo sph;
J
Jamal Hadi Salim 已提交
945
	struct nlmsghdr *nlh;
946
	int err;
J
Jamal Hadi Salim 已提交
947 948
	u32 *f;

949
	nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
L
Lucas De Marchi 已提交
950
	if (nlh == NULL) /* shouldn't really happen ... */
J
Jamal Hadi Salim 已提交
951 952 953 954
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
955
	xfrm_spd_getinfo(net, &si);
956 957 958 959 960 961 962 963 964
	spc.incnt = si.incnt;
	spc.outcnt = si.outcnt;
	spc.fwdcnt = si.fwdcnt;
	spc.inscnt = si.inscnt;
	spc.outscnt = si.outscnt;
	spc.fwdscnt = si.fwdscnt;
	sph.spdhcnt = si.spdhcnt;
	sph.spdhmcnt = si.spdhmcnt;

965 966 967 968 969 970 971
	err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
	if (!err)
		err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
J
Jamal Hadi Salim 已提交
972 973 974 975 976

	return nlmsg_end(skb, nlh);
}

static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
977
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
978
{
979
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
980
	struct sk_buff *r_skb;
981
	u32 *flags = nlmsg_data(nlh);
982
	u32 sportid = NETLINK_CB(skb).portid;
J
Jamal Hadi Salim 已提交
983 984
	u32 seq = nlh->nlmsg_seq;

985
	r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
986 987 988
	if (r_skb == NULL)
		return -ENOMEM;

989
	if (build_spdinfo(r_skb, net, sportid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
990 991
		BUG();

992
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
J
Jamal Hadi Salim 已提交
993 994
}

995 996 997 998 999 1000 1001
static inline size_t xfrm_sadinfo_msgsize(void)
{
	return NLMSG_ALIGN(4)
	       + nla_total_size(sizeof(struct xfrmu_sadhinfo))
	       + nla_total_size(4); /* XFRMA_SAD_CNT */
}

1002
static int build_sadinfo(struct sk_buff *skb, struct net *net,
1003
			 u32 portid, u32 seq, u32 flags)
J
Jamal Hadi Salim 已提交
1004
{
1005 1006
	struct xfrmk_sadinfo si;
	struct xfrmu_sadhinfo sh;
J
Jamal Hadi Salim 已提交
1007
	struct nlmsghdr *nlh;
1008
	int err;
J
Jamal Hadi Salim 已提交
1009 1010
	u32 *f;

1011
	nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
L
Lucas De Marchi 已提交
1012
	if (nlh == NULL) /* shouldn't really happen ... */
J
Jamal Hadi Salim 已提交
1013 1014 1015 1016
		return -EMSGSIZE;

	f = nlmsg_data(nlh);
	*f = flags;
1017
	xfrm_sad_getinfo(net, &si);
J
Jamal Hadi Salim 已提交
1018

1019 1020 1021
	sh.sadhmcnt = si.sadhmcnt;
	sh.sadhcnt = si.sadhcnt;

1022 1023 1024 1025 1026 1027 1028
	err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt);
	if (!err)
		err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
J
Jamal Hadi Salim 已提交
1029 1030 1031 1032 1033

	return nlmsg_end(skb, nlh);
}

static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
1034
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1035
{
1036
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1037
	struct sk_buff *r_skb;
1038
	u32 *flags = nlmsg_data(nlh);
1039
	u32 sportid = NETLINK_CB(skb).portid;
J
Jamal Hadi Salim 已提交
1040 1041
	u32 seq = nlh->nlmsg_seq;

1042
	r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
1043 1044 1045
	if (r_skb == NULL)
		return -ENOMEM;

1046
	if (build_sadinfo(r_skb, net, sportid, seq, *flags) < 0)
J
Jamal Hadi Salim 已提交
1047 1048
		BUG();

1049
	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
J
Jamal Hadi Salim 已提交
1050 1051
}

1052
static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1053
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1054
{
1055
	struct net *net = sock_net(skb->sk);
1056
	struct xfrm_usersa_id *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1057 1058
	struct xfrm_state *x;
	struct sk_buff *resp_skb;
1059
	int err = -ESRCH;
L
Linus Torvalds 已提交
1060

1061
	x = xfrm_user_state_lookup(net, p, attrs, &err);
L
Linus Torvalds 已提交
1062 1063 1064 1065 1066 1067 1068
	if (x == NULL)
		goto out_noput;

	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
	} else {
1069
		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
L
Linus Torvalds 已提交
1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090
	}
	xfrm_state_put(x);
out_noput:
	return err;
}

static int verify_userspi_info(struct xfrm_userspi_info *p)
{
	switch (p->info.id.proto) {
	case IPPROTO_AH:
	case IPPROTO_ESP:
		break;

	case IPPROTO_COMP:
		/* IPCOMP spi is 16-bits. */
		if (p->max >= 0x10000)
			return -EINVAL;
		break;

	default:
		return -EINVAL;
1091
	}
L
Linus Torvalds 已提交
1092 1093 1094 1095 1096 1097 1098

	if (p->min > p->max)
		return -EINVAL;

	return 0;
}

1099
static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
1100
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1101
{
1102
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1103 1104 1105 1106 1107 1108
	struct xfrm_state *x;
	struct xfrm_userspi_info *p;
	struct sk_buff *resp_skb;
	xfrm_address_t *daddr;
	int family;
	int err;
1109 1110
	u32 mark;
	struct xfrm_mark m;
L
Linus Torvalds 已提交
1111

1112
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1113 1114 1115 1116 1117 1118 1119 1120
	err = verify_userspi_info(p);
	if (err)
		goto out_noput;

	family = p->info.family;
	daddr = &p->info.id.daddr;

	x = NULL;
1121 1122

	mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
1123
	if (p->info.seq) {
1124
		x = xfrm_find_acq_byseq(net, mark, p->info.seq);
1125
		if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) {
L
Linus Torvalds 已提交
1126 1127 1128 1129 1130 1131
			xfrm_state_put(x);
			x = NULL;
		}
	}

	if (!x)
1132
		x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
L
Linus Torvalds 已提交
1133 1134 1135 1136 1137 1138 1139
				  p->info.id.proto, daddr,
				  &p->info.saddr, 1,
				  family);
	err = -ENOENT;
	if (x == NULL)
		goto out_noput;

1140 1141 1142
	err = xfrm_alloc_spi(x, p->min, p->max);
	if (err)
		goto out;
L
Linus Torvalds 已提交
1143

1144
	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
L
Linus Torvalds 已提交
1145 1146 1147 1148 1149
	if (IS_ERR(resp_skb)) {
		err = PTR_ERR(resp_skb);
		goto out;
	}

1150
	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
L
Linus Torvalds 已提交
1151 1152 1153 1154 1155 1156 1157

out:
	xfrm_state_put(x);
out_noput:
	return err;
}

1158
static int verify_policy_dir(u8 dir)
L
Linus Torvalds 已提交
1159 1160 1161 1162 1163 1164 1165 1166 1167
{
	switch (dir) {
	case XFRM_POLICY_IN:
	case XFRM_POLICY_OUT:
	case XFRM_POLICY_FWD:
		break;

	default:
		return -EINVAL;
1168
	}
L
Linus Torvalds 已提交
1169 1170 1171 1172

	return 0;
}

1173
static int verify_policy_type(u8 type)
1174 1175 1176 1177 1178 1179 1180 1181 1182 1183
{
	switch (type) {
	case XFRM_POLICY_TYPE_MAIN:
#ifdef CONFIG_XFRM_SUB_POLICY
	case XFRM_POLICY_TYPE_SUB:
#endif
		break;

	default:
		return -EINVAL;
1184
	}
1185 1186 1187 1188

	return 0;
}

L
Linus Torvalds 已提交
1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199
static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
{
	switch (p->share) {
	case XFRM_SHARE_ANY:
	case XFRM_SHARE_SESSION:
	case XFRM_SHARE_USER:
	case XFRM_SHARE_UNIQUE:
		break;

	default:
		return -EINVAL;
1200
	}
L
Linus Torvalds 已提交
1201 1202 1203 1204 1205 1206 1207 1208

	switch (p->action) {
	case XFRM_POLICY_ALLOW:
	case XFRM_POLICY_BLOCK:
		break;

	default:
		return -EINVAL;
1209
	}
L
Linus Torvalds 已提交
1210 1211 1212 1213 1214 1215

	switch (p->sel.family) {
	case AF_INET:
		break;

	case AF_INET6:
E
Eric Dumazet 已提交
1216
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
1217 1218 1219 1220 1221 1222 1223
		break;
#else
		return  -EAFNOSUPPORT;
#endif

	default:
		return -EINVAL;
1224
	}
L
Linus Torvalds 已提交
1225 1226 1227 1228

	return verify_policy_dir(p->dir);
}

1229
static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
1230
{
1231
	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1232 1233 1234 1235 1236
	struct xfrm_user_sec_ctx *uctx;

	if (!rt)
		return 0;

1237
	uctx = nla_data(rt);
1238
	return security_xfrm_policy_alloc(&pol->security, uctx);
1239 1240
}

L
Linus Torvalds 已提交
1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259
static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
			   int nr)
{
	int i;

	xp->xfrm_nr = nr;
	for (i = 0; i < nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];

		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
		memcpy(&t->saddr, &ut->saddr,
		       sizeof(xfrm_address_t));
		t->reqid = ut->reqid;
		t->mode = ut->mode;
		t->share = ut->share;
		t->optional = ut->optional;
		t->aalgos = ut->aalgos;
		t->ealgos = ut->ealgos;
		t->calgos = ut->calgos;
1260 1261
		/* If all masks are ~0, then we allow all algorithms. */
		t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1262
		t->encap_family = ut->family;
L
Linus Torvalds 已提交
1263 1264 1265
	}
}

1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286
static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
{
	int i;

	if (nr > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < nr; i++) {
		/* We never validated the ut->family value, so many
		 * applications simply leave it at zero.  The check was
		 * never made and ut->family was ignored because all
		 * templates could be assumed to have the same family as
		 * the policy itself.  Now that we will have ipv4-in-ipv6
		 * and ipv6-in-ipv4 tunnels, this is no longer true.
		 */
		if (!ut[i].family)
			ut[i].family = family;

		switch (ut[i].family) {
		case AF_INET:
			break;
E
Eric Dumazet 已提交
1287
#if IS_ENABLED(CONFIG_IPV6)
1288 1289 1290 1291 1292
		case AF_INET6:
			break;
#endif
		default:
			return -EINVAL;
1293
		}
1294 1295 1296 1297 1298
	}

	return 0;
}

1299
static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
L
Linus Torvalds 已提交
1300
{
1301
	struct nlattr *rt = attrs[XFRMA_TMPL];
L
Linus Torvalds 已提交
1302 1303 1304 1305

	if (!rt) {
		pol->xfrm_nr = 0;
	} else {
1306 1307
		struct xfrm_user_tmpl *utmpl = nla_data(rt);
		int nr = nla_len(rt) / sizeof(*utmpl);
1308
		int err;
L
Linus Torvalds 已提交
1309

1310 1311 1312
		err = validate_tmpl(nr, utmpl, pol->family);
		if (err)
			return err;
L
Linus Torvalds 已提交
1313

1314
		copy_templates(pol, utmpl, nr);
L
Linus Torvalds 已提交
1315 1316 1317 1318
	}
	return 0;
}

1319
static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
1320
{
1321
	struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1322
	struct xfrm_userpolicy_type *upt;
1323
	u8 type = XFRM_POLICY_TYPE_MAIN;
1324 1325 1326
	int err;

	if (rt) {
1327
		upt = nla_data(rt);
1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338
		type = upt->type;
	}

	err = verify_policy_type(type);
	if (err)
		return err;

	*tp = type;
	return 0;
}

L
Linus Torvalds 已提交
1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352
static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
{
	xp->priority = p->priority;
	xp->index = p->index;
	memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
	memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
	xp->action = p->action;
	xp->flags = p->flags;
	xp->family = p->sel.family;
	/* XXX xp->share = p->share; */
}

static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
{
1353
	memset(p, 0, sizeof(*p));
L
Linus Torvalds 已提交
1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365
	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
	p->priority = xp->priority;
	p->index = xp->index;
	p->sel.family = xp->family;
	p->dir = dir;
	p->action = xp->action;
	p->flags = xp->flags;
	p->share = XFRM_SHARE_ANY; /* XXX xp->share */
}

1366
static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
L
Linus Torvalds 已提交
1367
{
1368
	struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
L
Linus Torvalds 已提交
1369 1370 1371 1372 1373 1374 1375 1376
	int err;

	if (!xp) {
		*errp = -ENOMEM;
		return NULL;
	}

	copy_from_user_policy(xp, p);
1377

1378
	err = copy_from_user_policy_type(&xp->type, attrs);
1379 1380 1381
	if (err)
		goto error;

1382 1383
	if (!(err = copy_from_user_tmpl(xp, attrs)))
		err = copy_from_user_sec_ctx(xp, attrs);
1384 1385
	if (err)
		goto error;
L
Linus Torvalds 已提交
1386

1387 1388
	xfrm_mark_get(attrs, &xp->mark);

L
Linus Torvalds 已提交
1389
	return xp;
1390 1391
 error:
	*errp = err;
H
Herbert Xu 已提交
1392
	xp->walk.dead = 1;
1393
	xfrm_policy_destroy(xp);
1394
	return NULL;
L
Linus Torvalds 已提交
1395 1396
}

1397
static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1398
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1399
{
1400
	struct net *net = sock_net(skb->sk);
1401
	struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1402
	struct xfrm_policy *xp;
1403
	struct km_event c;
L
Linus Torvalds 已提交
1404 1405
	int err;
	int excl;
1406
	kuid_t loginuid = audit_get_loginuid(current);
1407 1408
	u32 sessionid = audit_get_sessionid(current);
	u32 sid;
L
Linus Torvalds 已提交
1409 1410

	err = verify_newpolicy_info(p);
1411 1412
	if (err)
		return err;
1413
	err = verify_sec_ctx_len(attrs);
L
Linus Torvalds 已提交
1414 1415 1416
	if (err)
		return err;

1417
	xp = xfrm_policy_construct(net, p, attrs, &err);
L
Linus Torvalds 已提交
1418 1419 1420
	if (!xp)
		return err;

L
Lucas De Marchi 已提交
1421
	/* shouldn't excl be based on nlh flags??
1422 1423 1424
	 * Aha! this is anti-netlink really i.e  more pfkey derived
	 * in netlink excl is a flag and you wouldnt need
	 * a type XFRM_MSG_UPDPOLICY - JHS */
L
Linus Torvalds 已提交
1425 1426
	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
	err = xfrm_policy_insert(p->dir, xp, excl);
1427
	security_task_getsecid(current, &sid);
1428
	xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1429

L
Linus Torvalds 已提交
1430
	if (err) {
1431
		security_xfrm_policy_free(xp->security);
L
Linus Torvalds 已提交
1432 1433 1434 1435
		kfree(xp);
		return err;
	}

1436
	c.event = nlh->nlmsg_type;
1437
	c.seq = nlh->nlmsg_seq;
1438
	c.portid = nlh->nlmsg_pid;
1439 1440
	km_policy_notify(xp, p->dir, &c);

L
Linus Torvalds 已提交
1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457
	xfrm_pol_put(xp);

	return 0;
}

static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
{
	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
	int i;

	if (xp->xfrm_nr == 0)
		return 0;

	for (i = 0; i < xp->xfrm_nr; i++) {
		struct xfrm_user_tmpl *up = &vec[i];
		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];

1458
		memset(up, 0, sizeof(*up));
L
Linus Torvalds 已提交
1459
		memcpy(&up->id, &kp->id, sizeof(up->id));
1460
		up->family = kp->encap_family;
L
Linus Torvalds 已提交
1461 1462 1463 1464 1465 1466 1467 1468 1469
		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
		up->reqid = kp->reqid;
		up->mode = kp->mode;
		up->share = kp->share;
		up->optional = kp->optional;
		up->aalgos = kp->aalgos;
		up->ealgos = kp->ealgos;
		up->calgos = kp->calgos;
	}
1470

1471 1472
	return nla_put(skb, XFRMA_TMPL,
		       sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
1473 1474 1475 1476 1477 1478
}

static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
{
	if (x->security) {
		return copy_sec_ctx(x->security, skb);
1479 1480
	}
	return 0;
1481
}
1482

1483 1484
static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
{
1485
	if (xp->security)
1486 1487
		return copy_sec_ctx(xp->security, skb);
	return 0;
1488
}
1489 1490 1491 1492 1493 1494 1495 1496
static inline size_t userpolicy_type_attrsize(void)
{
#ifdef CONFIG_XFRM_SUB_POLICY
	return nla_total_size(sizeof(struct xfrm_userpolicy_type));
#else
	return 0;
#endif
}
1497

1498
#ifdef CONFIG_XFRM_SUB_POLICY
1499
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1500
{
1501 1502 1503
	struct xfrm_userpolicy_type upt = {
		.type = type,
	};
1504

1505
	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1506 1507 1508
}

#else
1509
static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1510 1511 1512 1513 1514
{
	return 0;
}
#endif

L
Linus Torvalds 已提交
1515 1516 1517 1518 1519 1520 1521
static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
{
	struct xfrm_dump_info *sp = ptr;
	struct xfrm_userpolicy_info *p;
	struct sk_buff *in_skb = sp->in_skb;
	struct sk_buff *skb = sp->out_skb;
	struct nlmsghdr *nlh;
1522
	int err;
L
Linus Torvalds 已提交
1523

1524
	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
1525 1526 1527
			XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
1528

1529
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1530
	copy_to_user_policy(xp, p, dir);
1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_sec_ctx(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
1542
	nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
1543 1544 1545
	return 0;
}

1546 1547 1548 1549 1550 1551 1552 1553
static int xfrm_dump_policy_done(struct netlink_callback *cb)
{
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];

	xfrm_policy_walk_done(walk);
	return 0;
}

L
Linus Torvalds 已提交
1554 1555
static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
{
1556
	struct net *net = sock_net(skb->sk);
1557
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
L
Linus Torvalds 已提交
1558 1559
	struct xfrm_dump_info info;

1560 1561 1562
	BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

L
Linus Torvalds 已提交
1563 1564 1565 1566
	info.in_skb = cb->skb;
	info.out_skb = skb;
	info.nlmsg_seq = cb->nlh->nlmsg_seq;
	info.nlmsg_flags = NLM_F_MULTI;
1567 1568 1569 1570 1571 1572

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
	}

1573
	(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
L
Linus Torvalds 已提交
1574 1575 1576 1577 1578 1579 1580 1581 1582 1583

	return skb->len;
}

static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
					  struct xfrm_policy *xp,
					  int dir, u32 seq)
{
	struct xfrm_dump_info info;
	struct sk_buff *skb;
1584
	int err;
L
Linus Torvalds 已提交
1585

1586
	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
L
Linus Torvalds 已提交
1587 1588 1589 1590 1591 1592 1593 1594
	if (!skb)
		return ERR_PTR(-ENOMEM);

	info.in_skb = in_skb;
	info.out_skb = skb;
	info.nlmsg_seq = seq;
	info.nlmsg_flags = 0;

1595 1596
	err = dump_one_policy(xp, dir, 0, &info);
	if (err) {
L
Linus Torvalds 已提交
1597
		kfree_skb(skb);
1598
		return ERR_PTR(err);
L
Linus Torvalds 已提交
1599 1600 1601 1602 1603
	}

	return skb;
}

1604
static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1605
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1606
{
1607
	struct net *net = sock_net(skb->sk);
L
Linus Torvalds 已提交
1608 1609
	struct xfrm_policy *xp;
	struct xfrm_userpolicy_id *p;
1610
	u8 type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
1611
	int err;
1612
	struct km_event c;
L
Linus Torvalds 已提交
1613
	int delete;
1614 1615
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
L
Linus Torvalds 已提交
1616

1617
	p = nlmsg_data(nlh);
L
Linus Torvalds 已提交
1618 1619
	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;

1620
	err = copy_from_user_policy_type(&type, attrs);
1621 1622 1623
	if (err)
		return err;

L
Linus Torvalds 已提交
1624 1625 1626 1627 1628
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

	if (p->index)
1629
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
1630
	else {
1631
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1632
		struct xfrm_sec_ctx *ctx;
1633

1634
		err = verify_sec_ctx_len(attrs);
1635 1636 1637
		if (err)
			return err;

1638
		ctx = NULL;
1639
		if (rt) {
1640
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1641

1642 1643
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1644
				return err;
1645
		}
1646
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
1647
					   ctx, delete, &err);
1648
		security_xfrm_policy_free(ctx);
1649
	}
L
Linus Torvalds 已提交
1650 1651 1652 1653 1654 1655 1656 1657 1658 1659
	if (xp == NULL)
		return -ENOENT;

	if (!delete) {
		struct sk_buff *resp_skb;

		resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
		if (IS_ERR(resp_skb)) {
			err = PTR_ERR(resp_skb);
		} else {
1660
			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
1661
					    NETLINK_CB(skb).portid);
L
Linus Torvalds 已提交
1662
		}
1663
	} else {
1664
		kuid_t loginuid = audit_get_loginuid(current);
1665 1666
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;
1667

1668
		security_task_getsecid(current, &sid);
1669 1670
		xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
					 sid);
1671 1672

		if (err != 0)
C
Catherine Zhang 已提交
1673
			goto out;
1674

1675
		c.data.byid = p->index;
1676
		c.event = nlh->nlmsg_type;
1677
		c.seq = nlh->nlmsg_seq;
1678
		c.portid = nlh->nlmsg_pid;
1679
		km_policy_notify(xp, p->dir, &c);
L
Linus Torvalds 已提交
1680 1681
	}

C
Catherine Zhang 已提交
1682
out:
1683
	xfrm_pol_put(xp);
L
Linus Torvalds 已提交
1684 1685 1686
	return err;
}

1687
static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1688
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1689
{
1690
	struct net *net = sock_net(skb->sk);
1691
	struct km_event c;
1692
	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
J
Joy Latten 已提交
1693
	struct xfrm_audit audit_info;
1694
	int err;
L
Linus Torvalds 已提交
1695

1696 1697 1698
	audit_info.loginuid = audit_get_loginuid(current);
	audit_info.sessionid = audit_get_sessionid(current);
	security_task_getsecid(current, &audit_info.secid);
1699
	err = xfrm_state_flush(net, p->proto, &audit_info);
1700 1701 1702
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1703
		return err;
1704
	}
1705
	c.data.proto = p->proto;
1706
	c.event = nlh->nlmsg_type;
1707
	c.seq = nlh->nlmsg_seq;
1708
	c.portid = nlh->nlmsg_pid;
1709
	c.net = net;
1710 1711
	km_state_notify(NULL, &c);

L
Linus Torvalds 已提交
1712 1713 1714
	return 0;
}

1715
static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x)
1716
{
1717 1718 1719 1720
	size_t replay_size = x->replay_esn ?
			      xfrm_replay_state_esn_len(x->replay_esn) :
			      sizeof(struct xfrm_replay_state);

1721
	return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
1722
	       + nla_total_size(replay_size)
1723
	       + nla_total_size(sizeof(struct xfrm_lifetime_cur))
1724
	       + nla_total_size(sizeof(struct xfrm_mark))
1725 1726 1727
	       + nla_total_size(4) /* XFRM_AE_RTHR */
	       + nla_total_size(4); /* XFRM_AE_ETHR */
}
J
Jamal Hadi Salim 已提交
1728

1729
static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
J
Jamal Hadi Salim 已提交
1730 1731 1732
{
	struct xfrm_aevent_id *id;
	struct nlmsghdr *nlh;
1733
	int err;
J
Jamal Hadi Salim 已提交
1734

1735
	nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
1736 1737
	if (nlh == NULL)
		return -EMSGSIZE;
J
Jamal Hadi Salim 已提交
1738

1739
	id = nlmsg_data(nlh);
1740
	memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
J
Jamal Hadi Salim 已提交
1741 1742 1743
	id->sa_id.spi = x->id.spi;
	id->sa_id.family = x->props.family;
	id->sa_id.proto = x->id.proto;
1744 1745
	memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
	id->reqid = x->props.reqid;
J
Jamal Hadi Salim 已提交
1746 1747
	id->flags = c->data.aevent;

1748
	if (x->replay_esn) {
1749 1750 1751
		err = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
			      xfrm_replay_state_esn_len(x->replay_esn),
			      x->replay_esn);
1752
	} else {
1753 1754
		err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
			      &x->replay);
1755
	}
1756 1757 1758 1759 1760
	if (err)
		goto out_cancel;
	err = nla_put(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
	if (err)
		goto out_cancel;
J
Jamal Hadi Salim 已提交
1761

1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775
	if (id->flags & XFRM_AE_RTHR) {
		err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
		if (err)
			goto out_cancel;
	}
	if (id->flags & XFRM_AE_ETHR) {
		err = nla_put_u32(skb, XFRMA_ETIMER_THRESH,
				  x->replay_maxage * 10 / HZ);
		if (err)
			goto out_cancel;
	}
	err = xfrm_mark_put(skb, &x->mark);
	if (err)
		goto out_cancel;
1776

1777
	return nlmsg_end(skb, nlh);
J
Jamal Hadi Salim 已提交
1778

1779
out_cancel:
1780
	nlmsg_cancel(skb, nlh);
1781
	return err;
J
Jamal Hadi Salim 已提交
1782 1783
}

1784
static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1785
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1786
{
1787
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1788 1789 1790 1791
	struct xfrm_state *x;
	struct sk_buff *r_skb;
	int err;
	struct km_event c;
1792 1793
	u32 mark;
	struct xfrm_mark m;
1794
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
J
Jamal Hadi Salim 已提交
1795 1796
	struct xfrm_usersa_id *id = &p->sa_id;

1797 1798 1799
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
1800
	if (x == NULL)
J
Jamal Hadi Salim 已提交
1801
		return -ESRCH;
1802 1803 1804 1805 1806

	r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
	if (r_skb == NULL) {
		xfrm_state_put(x);
		return -ENOMEM;
J
Jamal Hadi Salim 已提交
1807 1808 1809 1810 1811 1812 1813 1814 1815 1816
	}

	/*
	 * XXX: is this lock really needed - none of the other
	 * gets lock (the concern is things getting updated
	 * while we are still reading) - jhs
	*/
	spin_lock_bh(&x->lock);
	c.data.aevent = p->flags;
	c.seq = nlh->nlmsg_seq;
1817
	c.portid = nlh->nlmsg_pid;
J
Jamal Hadi Salim 已提交
1818 1819 1820

	if (build_aevent(r_skb, x, &c) < 0)
		BUG();
1821
	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
J
Jamal Hadi Salim 已提交
1822 1823 1824 1825 1826
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

1827
static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1828
		struct nlattr **attrs)
J
Jamal Hadi Salim 已提交
1829
{
1830
	struct net *net = sock_net(skb->sk);
J
Jamal Hadi Salim 已提交
1831 1832 1833
	struct xfrm_state *x;
	struct km_event c;
	int err = - EINVAL;
1834 1835
	u32 mark = 0;
	struct xfrm_mark m;
1836
	struct xfrm_aevent_id *p = nlmsg_data(nlh);
1837
	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
1838
	struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
1839
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
J
Jamal Hadi Salim 已提交
1840

1841
	if (!lt && !rp && !re)
J
Jamal Hadi Salim 已提交
1842 1843 1844 1845 1846 1847
		return err;

	/* pedantic mode - thou shalt sayeth replaceth */
	if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
		return err;

1848 1849 1850
	mark = xfrm_mark_get(attrs, &m);

	x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
J
Jamal Hadi Salim 已提交
1851 1852 1853 1854 1855 1856
	if (x == NULL)
		return -ESRCH;

	if (x->km.state != XFRM_STATE_VALID)
		goto out;

1857 1858 1859 1860
	err = xfrm_replay_verify_len(x->replay_esn, rp);
	if (err)
		goto out;

J
Jamal Hadi Salim 已提交
1861
	spin_lock_bh(&x->lock);
1862
	xfrm_update_ae_params(x, attrs, 1);
J
Jamal Hadi Salim 已提交
1863 1864 1865 1866
	spin_unlock_bh(&x->lock);

	c.event = nlh->nlmsg_type;
	c.seq = nlh->nlmsg_seq;
1867
	c.portid = nlh->nlmsg_pid;
J
Jamal Hadi Salim 已提交
1868 1869 1870 1871 1872 1873 1874 1875
	c.data.aevent = XFRM_AE_CU;
	km_state_notify(x, &c);
	err = 0;
out:
	xfrm_state_put(x);
	return err;
}

1876
static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1877
		struct nlattr **attrs)
L
Linus Torvalds 已提交
1878
{
1879
	struct net *net = sock_net(skb->sk);
1880
	struct km_event c;
1881
	u8 type = XFRM_POLICY_TYPE_MAIN;
1882
	int err;
J
Joy Latten 已提交
1883
	struct xfrm_audit audit_info;
1884

1885
	err = copy_from_user_policy_type(&type, attrs);
1886 1887
	if (err)
		return err;
1888

1889 1890 1891
	audit_info.loginuid = audit_get_loginuid(current);
	audit_info.sessionid = audit_get_sessionid(current);
	security_task_getsecid(current, &audit_info.secid);
1892
	err = xfrm_policy_flush(net, type, &audit_info);
1893 1894 1895
	if (err) {
		if (err == -ESRCH) /* empty table */
			return 0;
1896
		return err;
1897 1898
	}

1899
	c.data.type = type;
1900
	c.event = nlh->nlmsg_type;
1901
	c.seq = nlh->nlmsg_seq;
1902
	c.portid = nlh->nlmsg_pid;
1903
	c.net = net;
1904
	km_policy_notify(NULL, 0, &c);
L
Linus Torvalds 已提交
1905 1906 1907
	return 0;
}

1908
static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1909
		struct nlattr **attrs)
1910
{
1911
	struct net *net = sock_net(skb->sk);
1912
	struct xfrm_policy *xp;
1913
	struct xfrm_user_polexpire *up = nlmsg_data(nlh);
1914
	struct xfrm_userpolicy_info *p = &up->pol;
1915
	u8 type = XFRM_POLICY_TYPE_MAIN;
1916
	int err = -ENOENT;
1917 1918
	struct xfrm_mark m;
	u32 mark = xfrm_mark_get(attrs, &m);
1919

1920
	err = copy_from_user_policy_type(&type, attrs);
1921 1922 1923
	if (err)
		return err;

1924 1925 1926 1927
	err = verify_policy_dir(p->dir);
	if (err)
		return err;

1928
	if (p->index)
1929
		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
1930
	else {
1931
		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1932
		struct xfrm_sec_ctx *ctx;
1933

1934
		err = verify_sec_ctx_len(attrs);
1935 1936 1937
		if (err)
			return err;

1938
		ctx = NULL;
1939
		if (rt) {
1940
			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1941

1942 1943
			err = security_xfrm_policy_alloc(&ctx, uctx);
			if (err)
1944
				return err;
1945
		}
1946
		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
1947
					   &p->sel, ctx, 0, &err);
1948
		security_xfrm_policy_free(ctx);
1949 1950
	}
	if (xp == NULL)
1951
		return -ENOENT;
1952

1953
	if (unlikely(xp->walk.dead))
1954 1955 1956 1957
		goto out;

	err = 0;
	if (up->hard) {
1958
		kuid_t loginuid = audit_get_loginuid(current);
1959 1960 1961 1962
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;

		security_task_getsecid(current, &sid);
1963
		xfrm_policy_delete(xp, p->dir);
1964
		xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
1965

1966 1967
	} else {
		// reset the timers here?
S
stephen hemminger 已提交
1968
		WARN(1, "Dont know what to do with soft policy expire\n");
1969
	}
1970
	km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
1971 1972 1973 1974 1975 1976

out:
	xfrm_pol_put(xp);
	return err;
}

1977
static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1978
		struct nlattr **attrs)
1979
{
1980
	struct net *net = sock_net(skb->sk);
1981 1982
	struct xfrm_state *x;
	int err;
1983
	struct xfrm_user_expire *ue = nlmsg_data(nlh);
1984
	struct xfrm_usersa_info *p = &ue->state;
1985
	struct xfrm_mark m;
1986
	u32 mark = xfrm_mark_get(attrs, &m);
1987

1988
	x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
1989

1990
	err = -ENOENT;
1991 1992 1993 1994
	if (x == NULL)
		return err;

	spin_lock_bh(&x->lock);
1995
	err = -EINVAL;
1996 1997
	if (x->km.state != XFRM_STATE_VALID)
		goto out;
1998
	km_state_expired(x, ue->hard, nlh->nlmsg_pid);
1999

J
Joy Latten 已提交
2000
	if (ue->hard) {
2001
		kuid_t loginuid = audit_get_loginuid(current);
2002 2003 2004 2005
		u32 sessionid = audit_get_sessionid(current);
		u32 sid;

		security_task_getsecid(current, &sid);
2006
		__xfrm_state_delete(x);
2007
		xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
J
Joy Latten 已提交
2008
	}
2009
	err = 0;
2010 2011 2012 2013 2014 2015
out:
	spin_unlock_bh(&x->lock);
	xfrm_state_put(x);
	return err;
}

2016
static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
2017
		struct nlattr **attrs)
2018
{
2019
	struct net *net = sock_net(skb->sk);
2020 2021 2022
	struct xfrm_policy *xp;
	struct xfrm_user_tmpl *ut;
	int i;
2023
	struct nlattr *rt = attrs[XFRMA_TMPL];
2024
	struct xfrm_mark mark;
2025

2026
	struct xfrm_user_acquire *ua = nlmsg_data(nlh);
2027
	struct xfrm_state *x = xfrm_state_alloc(net);
2028 2029 2030
	int err = -ENOMEM;

	if (!x)
I
Ilpo Järvinen 已提交
2031
		goto nomem;
2032

2033 2034
	xfrm_mark_get(attrs, &mark);

2035
	err = verify_newpolicy_info(&ua->policy);
I
Ilpo Järvinen 已提交
2036 2037
	if (err)
		goto bad_policy;
2038 2039

	/*   build an XP */
2040
	xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
I
Ilpo Järvinen 已提交
2041 2042
	if (!xp)
		goto free_state;
2043 2044 2045 2046

	memcpy(&x->id, &ua->id, sizeof(ua->id));
	memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
	memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
2047 2048
	xp->mark.m = x->mark.m = mark.m;
	xp->mark.v = x->mark.v = mark.v;
2049
	ut = nla_data(rt);
2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067
	/* extract the templates and for each call km_key */
	for (i = 0; i < xp->xfrm_nr; i++, ut++) {
		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
		memcpy(&x->id, &t->id, sizeof(x->id));
		x->props.mode = t->mode;
		x->props.reqid = t->reqid;
		x->props.family = ut->family;
		t->aalgos = ua->aalgos;
		t->ealgos = ua->ealgos;
		t->calgos = ua->calgos;
		err = km_query(x, t, xp);

	}

	kfree(x);
	kfree(xp);

	return 0;
I
Ilpo Järvinen 已提交
2068 2069

bad_policy:
S
stephen hemminger 已提交
2070
	WARN(1, "BAD policy passed\n");
I
Ilpo Järvinen 已提交
2071 2072 2073 2074
free_state:
	kfree(x);
nomem:
	return err;
2075 2076
}

2077 2078
#ifdef CONFIG_XFRM_MIGRATE
static int copy_from_user_migrate(struct xfrm_migrate *ma,
2079
				  struct xfrm_kmaddress *k,
2080
				  struct nlattr **attrs, int *num)
2081
{
2082
	struct nlattr *rt = attrs[XFRMA_MIGRATE];
2083 2084 2085
	struct xfrm_user_migrate *um;
	int i, num_migrate;

2086 2087 2088 2089 2090 2091 2092 2093 2094 2095
	if (k != NULL) {
		struct xfrm_user_kmaddress *uk;

		uk = nla_data(attrs[XFRMA_KMADDRESS]);
		memcpy(&k->local, &uk->local, sizeof(k->local));
		memcpy(&k->remote, &uk->remote, sizeof(k->remote));
		k->family = uk->family;
		k->reserved = uk->reserved;
	}

2096 2097
	um = nla_data(rt);
	num_migrate = nla_len(rt) / sizeof(*um);
2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120

	if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
		return -EINVAL;

	for (i = 0; i < num_migrate; i++, um++, ma++) {
		memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
		memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
		memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
		memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));

		ma->proto = um->proto;
		ma->mode = um->mode;
		ma->reqid = um->reqid;

		ma->old_family = um->old_family;
		ma->new_family = um->new_family;
	}

	*num = i;
	return 0;
}

static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2121
			   struct nlattr **attrs)
2122
{
2123
	struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
2124
	struct xfrm_migrate m[XFRM_MAX_DEPTH];
2125
	struct xfrm_kmaddress km, *kmp;
2126 2127 2128 2129
	u8 type;
	int err;
	int n = 0;

2130
	if (attrs[XFRMA_MIGRATE] == NULL)
2131
		return -EINVAL;
2132

2133 2134
	kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;

2135
	err = copy_from_user_policy_type(&type, attrs);
2136 2137 2138
	if (err)
		return err;

2139
	err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
2140 2141 2142 2143 2144 2145
	if (err)
		return err;

	if (!n)
		return 0;

2146
	xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
2147 2148 2149 2150 2151

	return 0;
}
#else
static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2152
			   struct nlattr **attrs)
2153 2154 2155 2156 2157 2158
{
	return -ENOPROTOOPT;
}
#endif

#ifdef CONFIG_XFRM_MIGRATE
2159
static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173
{
	struct xfrm_user_migrate um;

	memset(&um, 0, sizeof(um));
	um.proto = m->proto;
	um.mode = m->mode;
	um.reqid = m->reqid;
	um.old_family = m->old_family;
	memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
	memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
	um.new_family = m->new_family;
	memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
	memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));

2174
	return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
2175 2176
}

2177
static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
2178 2179 2180 2181 2182 2183 2184
{
	struct xfrm_user_kmaddress uk;

	memset(&uk, 0, sizeof(uk));
	uk.family = k->family;
	uk.reserved = k->reserved;
	memcpy(&uk.local, &k->local, sizeof(uk.local));
2185
	memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
2186 2187 2188 2189 2190

	return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
}

static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
2191 2192
{
	return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
2193 2194 2195
	      + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
	      + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
	      + userpolicy_type_attrsize();
2196 2197
}

2198 2199 2200
static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
			 int num_migrate, const struct xfrm_kmaddress *k,
			 const struct xfrm_selector *sel, u8 dir, u8 type)
2201
{
2202
	const struct xfrm_migrate *mp;
2203 2204
	struct xfrm_userpolicy_id *pol_id;
	struct nlmsghdr *nlh;
2205
	int i, err;
2206

2207 2208 2209
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2210

2211
	pol_id = nlmsg_data(nlh);
2212 2213 2214 2215 2216
	/* copy data from selector, dir, and type to the pol_id */
	memset(pol_id, 0, sizeof(*pol_id));
	memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
	pol_id->dir = dir;

2217 2218 2219 2220 2221 2222 2223 2224
	if (k != NULL) {
		err = copy_to_user_kmaddress(k, skb);
		if (err)
			goto out_cancel;
	}
	err = copy_to_user_policy_type(type, skb);
	if (err)
		goto out_cancel;
2225
	for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
2226 2227 2228
		err = copy_to_user_migrate(mp, skb);
		if (err)
			goto out_cancel;
2229 2230
	}

2231
	return nlmsg_end(skb, nlh);
2232 2233

out_cancel:
2234
	nlmsg_cancel(skb, nlh);
2235
	return err;
2236 2237
}

2238 2239 2240
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
			     const struct xfrm_migrate *m, int num_migrate,
			     const struct xfrm_kmaddress *k)
2241
{
2242
	struct net *net = &init_net;
2243 2244
	struct sk_buff *skb;

2245
	skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
2246 2247 2248 2249
	if (skb == NULL)
		return -ENOMEM;

	/* build migrate */
2250
	if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
2251 2252
		BUG();

2253
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
2254 2255
}
#else
2256 2257 2258
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
			     const struct xfrm_migrate *m, int num_migrate,
			     const struct xfrm_kmaddress *k)
2259 2260 2261 2262
{
	return -ENOPROTOOPT;
}
#endif
J
Jamal Hadi Salim 已提交
2263

2264
#define XMSGSIZE(type) sizeof(struct type)
2265 2266

static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
2267
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2268 2269 2270 2271 2272 2273
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
2274
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
2275
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
2276
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2277
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2278
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
2279
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
2280
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
J
Jamal Hadi Salim 已提交
2281 2282
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2283
	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
2284
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2285 2286
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
L
Linus Torvalds 已提交
2287 2288
};

2289 2290
#undef XMSGSIZE

2291
static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
J
jamal 已提交
2292 2293 2294 2295
	[XFRMA_SA]		= { .len = sizeof(struct xfrm_usersa_info)},
	[XFRMA_POLICY]		= { .len = sizeof(struct xfrm_userpolicy_info)},
	[XFRMA_LASTUSED]	= { .type = NLA_U64},
	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
2296
	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310
	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_sec_ctx) },
	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
2311
	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
2312
	[XFRMA_MARK]		= { .len = sizeof(struct xfrm_mark) },
2313
	[XFRMA_TFCPAD]		= { .type = NLA_U32 },
2314
	[XFRMA_REPLAY_ESN_VAL]	= { .len = sizeof(struct xfrm_replay_state_esn) },
2315
	[XFRMA_SA_EXTRA_FLAGS]	= { .type = NLA_U32 },
2316 2317
};

L
Linus Torvalds 已提交
2318
static struct xfrm_link {
2319
	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
L
Linus Torvalds 已提交
2320
	int (*dump)(struct sk_buff *, struct netlink_callback *);
2321
	int (*done)(struct netlink_callback *);
2322 2323 2324 2325
} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
2326 2327
						   .dump = xfrm_dump_sa,
						   .done = xfrm_dump_sa_done  },
2328 2329 2330
	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
2331 2332
						   .dump = xfrm_dump_policy,
						   .done = xfrm_dump_policy_done },
2333
	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
2334
	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
2335
	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
2336 2337
	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
2338
	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
2339 2340
	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
J
Jamal Hadi Salim 已提交
2341 2342
	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = { .doit = xfrm_new_ae  },
	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = { .doit = xfrm_get_ae  },
2343
	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate    },
2344
	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo   },
J
Jamal Hadi Salim 已提交
2345
	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo   },
L
Linus Torvalds 已提交
2346 2347
};

2348
static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
2349
{
2350
	struct net *net = sock_net(skb->sk);
2351
	struct nlattr *attrs[XFRMA_MAX+1];
L
Linus Torvalds 已提交
2352
	struct xfrm_link *link;
2353
	int type, err;
L
Linus Torvalds 已提交
2354 2355 2356

	type = nlh->nlmsg_type;
	if (type > XFRM_MSG_MAX)
2357
		return -EINVAL;
L
Linus Torvalds 已提交
2358 2359 2360 2361 2362

	type -= XFRM_MSG_BASE;
	link = &xfrm_dispatch[type];

	/* All operations require privileges, even GET */
2363
	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2364
		return -EPERM;
L
Linus Torvalds 已提交
2365

2366 2367
	if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
	     type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
2368
	    (nlh->nlmsg_flags & NLM_F_DUMP)) {
L
Linus Torvalds 已提交
2369
		if (link->dump == NULL)
2370
			return -EINVAL;
2371

2372 2373 2374 2375 2376 2377 2378
		{
			struct netlink_dump_control c = {
				.dump = link->dump,
				.done = link->done,
			};
			return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
		}
L
Linus Torvalds 已提交
2379 2380
	}

2381
	err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
2382
			  xfrma_policy);
2383 2384
	if (err < 0)
		return err;
L
Linus Torvalds 已提交
2385 2386

	if (link->doit == NULL)
2387
		return -EINVAL;
L
Linus Torvalds 已提交
2388

2389
	return link->doit(skb, nlh, attrs);
L
Linus Torvalds 已提交
2390 2391
}

2392
static void xfrm_netlink_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
2393
{
2394 2395 2396
	mutex_lock(&xfrm_cfg_mutex);
	netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
	mutex_unlock(&xfrm_cfg_mutex);
L
Linus Torvalds 已提交
2397 2398
}

2399 2400
static inline size_t xfrm_expire_msgsize(void)
{
2401 2402
	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
	       + nla_total_size(sizeof(struct xfrm_mark));
2403 2404
}

2405
static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
L
Linus Torvalds 已提交
2406 2407 2408
{
	struct xfrm_user_expire *ue;
	struct nlmsghdr *nlh;
2409
	int err;
L
Linus Torvalds 已提交
2410

2411
	nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
2412 2413
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2414

2415
	ue = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2416
	copy_to_user_state(x, &ue->state);
J
Jamal Hadi Salim 已提交
2417
	ue->hard = (c->data.hard != 0) ? 1 : 0;
L
Linus Torvalds 已提交
2418

2419 2420 2421
	err = xfrm_mark_put(skb, &x->mark);
	if (err)
		return err;
2422

2423
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2424 2425
}

2426
static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
L
Linus Torvalds 已提交
2427
{
2428
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2429 2430
	struct sk_buff *skb;

2431
	skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
L
Linus Torvalds 已提交
2432 2433 2434
	if (skb == NULL)
		return -ENOMEM;

2435 2436 2437 2438
	if (build_expire(skb, x, c) < 0) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
L
Linus Torvalds 已提交
2439

2440
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2441 2442
}

2443
static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
J
Jamal Hadi Salim 已提交
2444
{
2445
	struct net *net = xs_net(x);
J
Jamal Hadi Salim 已提交
2446 2447
	struct sk_buff *skb;

2448
	skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2449 2450 2451 2452 2453 2454
	if (skb == NULL)
		return -ENOMEM;

	if (build_aevent(skb, x, c) < 0)
		BUG();

2455
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
J
Jamal Hadi Salim 已提交
2456 2457
}

2458
static int xfrm_notify_sa_flush(const struct km_event *c)
2459
{
2460
	struct net *net = c->net;
2461 2462 2463
	struct xfrm_usersa_flush *p;
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2464
	int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
2465

2466
	skb = nlmsg_new(len, GFP_ATOMIC);
2467 2468 2469
	if (skb == NULL)
		return -ENOMEM;

2470
	nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
2471 2472 2473 2474
	if (nlh == NULL) {
		kfree_skb(skb);
		return -EMSGSIZE;
	}
2475

2476
	p = nlmsg_data(nlh);
2477
	p->proto = c->data.proto;
2478

2479
	nlmsg_end(skb, nlh);
2480

2481
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2482 2483
}

2484
static inline size_t xfrm_sa_len(struct xfrm_state *x)
2485
{
2486
	size_t l = 0;
2487 2488
	if (x->aead)
		l += nla_total_size(aead_len(x->aead));
2489 2490 2491 2492 2493
	if (x->aalg) {
		l += nla_total_size(sizeof(struct xfrm_algo) +
				    (x->aalg->alg_key_len + 7) / 8);
		l += nla_total_size(xfrm_alg_auth_len(x->aalg));
	}
2494
	if (x->ealg)
2495
		l += nla_total_size(xfrm_alg_len(x->ealg));
2496
	if (x->calg)
2497
		l += nla_total_size(sizeof(*x->calg));
2498
	if (x->encap)
2499
		l += nla_total_size(sizeof(*x->encap));
2500 2501
	if (x->tfcpad)
		l += nla_total_size(sizeof(x->tfcpad));
2502 2503
	if (x->replay_esn)
		l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
2504 2505 2506 2507 2508
	if (x->security)
		l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
				    x->security->ctx_len);
	if (x->coaddr)
		l += nla_total_size(sizeof(*x->coaddr));
2509 2510
	if (x->props.extra_flags)
		l += nla_total_size(sizeof(x->props.extra_flags));
2511

2512 2513
	/* Must count x->lastused as it may become non-zero behind our back. */
	l += nla_total_size(sizeof(u64));
2514 2515 2516 2517

	return l;
}

2518
static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
2519
{
2520
	struct net *net = xs_net(x);
2521
	struct xfrm_usersa_info *p;
2522
	struct xfrm_usersa_id *id;
2523 2524 2525
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
	int len = xfrm_sa_len(x);
2526
	int headlen, err;
2527 2528 2529

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELSA) {
2530
		len += nla_total_size(headlen);
2531
		headlen = sizeof(*id);
2532
		len += nla_total_size(sizeof(struct xfrm_mark));
2533
	}
2534
	len += NLMSG_ALIGN(headlen);
2535

2536
	skb = nlmsg_new(len, GFP_ATOMIC);
2537 2538 2539
	if (skb == NULL)
		return -ENOMEM;

2540
	nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
2541
	err = -EMSGSIZE;
2542
	if (nlh == NULL)
2543
		goto out_free_skb;
2544

2545
	p = nlmsg_data(nlh);
2546
	if (c->event == XFRM_MSG_DELSA) {
2547 2548
		struct nlattr *attr;

2549
		id = nlmsg_data(nlh);
2550 2551 2552 2553 2554
		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
		id->spi = x->id.spi;
		id->family = x->props.family;
		id->proto = x->id.proto;

2555
		attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
2556
		err = -EMSGSIZE;
2557
		if (attr == NULL)
2558
			goto out_free_skb;
2559 2560

		p = nla_data(attr);
2561
	}
2562 2563 2564
	err = copy_to_user_state_extra(x, p, skb);
	if (err)
		goto out_free_skb;
2565

2566
	nlmsg_end(skb, nlh);
2567

2568
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2569

2570
out_free_skb:
2571
	kfree_skb(skb);
2572
	return err;
2573 2574
}

2575
static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
2576 2577 2578
{

	switch (c->event) {
2579
	case XFRM_MSG_EXPIRE:
2580
		return xfrm_exp_state_notify(x, c);
J
Jamal Hadi Salim 已提交
2581 2582
	case XFRM_MSG_NEWAE:
		return xfrm_aevent_state_notify(x, c);
2583 2584 2585
	case XFRM_MSG_DELSA:
	case XFRM_MSG_UPDSA:
	case XFRM_MSG_NEWSA:
2586
		return xfrm_notify_sa(x, c);
2587
	case XFRM_MSG_FLUSHSA:
2588 2589
		return xfrm_notify_sa_flush(c);
	default:
S
stephen hemminger 已提交
2590 2591 2592
		printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
		       c->event);
		break;
2593 2594 2595 2596 2597 2598
	}

	return 0;

}

2599 2600 2601 2602 2603
static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
					  struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2604
	       + nla_total_size(sizeof(struct xfrm_mark))
2605 2606 2607 2608
	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2609
static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
2610
			 struct xfrm_tmpl *xt, struct xfrm_policy *xp)
L
Linus Torvalds 已提交
2611
{
2612
	__u32 seq = xfrm_get_acqseq();
L
Linus Torvalds 已提交
2613 2614
	struct xfrm_user_acquire *ua;
	struct nlmsghdr *nlh;
2615
	int err;
L
Linus Torvalds 已提交
2616

2617 2618 2619
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2620

2621
	ua = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2622 2623 2624
	memcpy(&ua->id, &x->id, sizeof(ua->id));
	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
2625
	copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT);
L
Linus Torvalds 已提交
2626 2627 2628 2629 2630
	ua->aalgos = xt->aalgos;
	ua->ealgos = xt->ealgos;
	ua->calgos = xt->calgos;
	ua->seq = x->km.seq = seq;

2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_state_sec_ctx(x, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
L
Linus Torvalds 已提交
2642

2643
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2644 2645 2646
}

static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
2647
			     struct xfrm_policy *xp)
L
Linus Torvalds 已提交
2648
{
2649
	struct net *net = xs_net(x);
L
Linus Torvalds 已提交
2650 2651
	struct sk_buff *skb;

2652
	skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2653 2654 2655
	if (skb == NULL)
		return -ENOMEM;

2656
	if (build_acquire(skb, x, xt, xp) < 0)
L
Linus Torvalds 已提交
2657 2658
		BUG();

2659
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2660 2661 2662 2663 2664
}

/* User gives us xfrm_user_policy_info followed by an array of 0
 * or more templates.
 */
2665
static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
L
Linus Torvalds 已提交
2666 2667
					       u8 *data, int len, int *dir)
{
2668
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
2669 2670 2671 2672 2673
	struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
	struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
	struct xfrm_policy *xp;
	int nr;

2674
	switch (sk->sk_family) {
L
Linus Torvalds 已提交
2675 2676 2677 2678 2679 2680
	case AF_INET:
		if (opt != IP_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
E
Eric Dumazet 已提交
2681
#if IS_ENABLED(CONFIG_IPV6)
L
Linus Torvalds 已提交
2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700
	case AF_INET6:
		if (opt != IPV6_XFRM_POLICY) {
			*dir = -EOPNOTSUPP;
			return NULL;
		}
		break;
#endif
	default:
		*dir = -EINVAL;
		return NULL;
	}

	*dir = -EINVAL;

	if (len < sizeof(*p) ||
	    verify_newpolicy_info(p))
		return NULL;

	nr = ((len - sizeof(*p)) / sizeof(*ut));
2701
	if (validate_tmpl(nr, ut, p->sel.family))
L
Linus Torvalds 已提交
2702 2703
		return NULL;

2704 2705 2706
	if (p->dir > XFRM_POLICY_OUT)
		return NULL;

2707
	xp = xfrm_policy_alloc(net, GFP_ATOMIC);
L
Linus Torvalds 已提交
2708 2709 2710 2711 2712 2713
	if (xp == NULL) {
		*dir = -ENOBUFS;
		return NULL;
	}

	copy_from_user_policy(xp, p);
2714
	xp->type = XFRM_POLICY_TYPE_MAIN;
L
Linus Torvalds 已提交
2715 2716 2717 2718 2719 2720 2721
	copy_templates(xp, ut, nr);

	*dir = p->dir;

	return xp;
}

2722 2723 2724 2725 2726
static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
2727
	       + nla_total_size(sizeof(struct xfrm_mark))
2728 2729 2730
	       + userpolicy_type_attrsize();
}

L
Linus Torvalds 已提交
2731
static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2732
			   int dir, const struct km_event *c)
L
Linus Torvalds 已提交
2733 2734
{
	struct xfrm_user_polexpire *upe;
J
Jamal Hadi Salim 已提交
2735
	int hard = c->data.hard;
2736 2737
	struct nlmsghdr *nlh;
	int err;
L
Linus Torvalds 已提交
2738

2739
	nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
2740 2741
	if (nlh == NULL)
		return -EMSGSIZE;
L
Linus Torvalds 已提交
2742

2743
	upe = nlmsg_data(nlh);
L
Linus Torvalds 已提交
2744
	copy_to_user_policy(xp, &upe->pol, dir);
2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_sec_ctx(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err) {
		nlmsg_cancel(skb, nlh);
		return err;
	}
L
Linus Torvalds 已提交
2756 2757
	upe->hard = !!hard;

2758
	return nlmsg_end(skb, nlh);
L
Linus Torvalds 已提交
2759 2760
}

2761
static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
L
Linus Torvalds 已提交
2762
{
2763
	struct net *net = xp_net(xp);
L
Linus Torvalds 已提交
2764 2765
	struct sk_buff *skb;

2766
	skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
L
Linus Torvalds 已提交
2767 2768 2769
	if (skb == NULL)
		return -ENOMEM;

J
Jamal Hadi Salim 已提交
2770
	if (build_polexpire(skb, xp, dir, c) < 0)
L
Linus Torvalds 已提交
2771 2772
		BUG();

2773
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
L
Linus Torvalds 已提交
2774 2775
}

2776
static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
2777
{
2778
	int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2779
	struct net *net = xp_net(xp);
2780
	struct xfrm_userpolicy_info *p;
2781
	struct xfrm_userpolicy_id *id;
2782 2783
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2784
	int headlen, err;
2785 2786 2787

	headlen = sizeof(*p);
	if (c->event == XFRM_MSG_DELPOLICY) {
2788
		len += nla_total_size(headlen);
2789 2790
		headlen = sizeof(*id);
	}
2791
	len += userpolicy_type_attrsize();
2792
	len += nla_total_size(sizeof(struct xfrm_mark));
2793
	len += NLMSG_ALIGN(headlen);
2794

2795
	skb = nlmsg_new(len, GFP_ATOMIC);
2796 2797 2798
	if (skb == NULL)
		return -ENOMEM;

2799
	nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
2800
	err = -EMSGSIZE;
2801
	if (nlh == NULL)
2802
		goto out_free_skb;
2803

2804
	p = nlmsg_data(nlh);
2805
	if (c->event == XFRM_MSG_DELPOLICY) {
2806 2807
		struct nlattr *attr;

2808
		id = nlmsg_data(nlh);
2809 2810 2811 2812 2813 2814 2815
		memset(id, 0, sizeof(*id));
		id->dir = dir;
		if (c->data.byid)
			id->index = xp->index;
		else
			memcpy(&id->sel, &xp->selector, sizeof(id->sel));

2816
		attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
2817
		err = -EMSGSIZE;
2818
		if (attr == NULL)
2819
			goto out_free_skb;
2820 2821

		p = nla_data(attr);
2822
	}
2823 2824

	copy_to_user_policy(xp, p, dir);
2825 2826 2827 2828 2829 2830 2831
	err = copy_to_user_tmpl(xp, skb);
	if (!err)
		err = copy_to_user_policy_type(xp->type, skb);
	if (!err)
		err = xfrm_mark_put(skb, &xp->mark);
	if (err)
		goto out_free_skb;
2832

2833
	nlmsg_end(skb, nlh);
2834

2835
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2836

2837
out_free_skb:
2838
	kfree_skb(skb);
2839
	return err;
2840 2841
}

2842
static int xfrm_notify_policy_flush(const struct km_event *c)
2843
{
2844
	struct net *net = c->net;
2845 2846
	struct nlmsghdr *nlh;
	struct sk_buff *skb;
2847
	int err;
2848

2849
	skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
2850 2851 2852
	if (skb == NULL)
		return -ENOMEM;

2853
	nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
2854
	err = -EMSGSIZE;
2855
	if (nlh == NULL)
2856 2857 2858 2859
		goto out_free_skb;
	err = copy_to_user_policy_type(c->data.type, skb);
	if (err)
		goto out_free_skb;
2860

2861
	nlmsg_end(skb, nlh);
2862

2863
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2864

2865
out_free_skb:
2866
	kfree_skb(skb);
2867
	return err;
2868 2869
}

2870
static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
2871 2872 2873
{

	switch (c->event) {
2874 2875 2876
	case XFRM_MSG_NEWPOLICY:
	case XFRM_MSG_UPDPOLICY:
	case XFRM_MSG_DELPOLICY:
2877
		return xfrm_notify_policy(xp, dir, c);
2878
	case XFRM_MSG_FLUSHPOLICY:
2879
		return xfrm_notify_policy_flush(c);
2880
	case XFRM_MSG_POLEXPIRE:
2881 2882
		return xfrm_exp_policy_notify(xp, dir, c);
	default:
S
stephen hemminger 已提交
2883 2884
		printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
		       c->event);
2885 2886 2887 2888 2889 2890
	}

	return 0;

}

2891 2892 2893 2894 2895
static inline size_t xfrm_report_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
}

2896 2897 2898 2899 2900 2901
static int build_report(struct sk_buff *skb, u8 proto,
			struct xfrm_selector *sel, xfrm_address_t *addr)
{
	struct xfrm_user_report *ur;
	struct nlmsghdr *nlh;

2902 2903 2904
	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
	if (nlh == NULL)
		return -EMSGSIZE;
2905

2906
	ur = nlmsg_data(nlh);
2907 2908 2909
	ur->proto = proto;
	memcpy(&ur->sel, sel, sizeof(ur->sel));

2910 2911 2912 2913 2914 2915 2916
	if (addr) {
		int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr);
		if (err) {
			nlmsg_cancel(skb, nlh);
			return err;
		}
	}
2917
	return nlmsg_end(skb, nlh);
2918 2919
}

2920 2921
static int xfrm_send_report(struct net *net, u8 proto,
			    struct xfrm_selector *sel, xfrm_address_t *addr)
2922 2923 2924
{
	struct sk_buff *skb;

2925
	skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
2926 2927 2928 2929 2930 2931
	if (skb == NULL)
		return -ENOMEM;

	if (build_report(skb, proto, sel, addr) < 0)
		BUG();

2932
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
2933 2934
}

2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967
static inline size_t xfrm_mapping_msgsize(void)
{
	return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
}

static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
			 xfrm_address_t *new_saddr, __be16 new_sport)
{
	struct xfrm_user_mapping *um;
	struct nlmsghdr *nlh;

	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
	if (nlh == NULL)
		return -EMSGSIZE;

	um = nlmsg_data(nlh);

	memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
	um->id.spi = x->id.spi;
	um->id.family = x->props.family;
	um->id.proto = x->id.proto;
	memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
	memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
	um->new_sport = new_sport;
	um->old_sport = x->encap->encap_sport;
	um->reqid = x->props.reqid;

	return nlmsg_end(skb, nlh);
}

static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
			     __be16 sport)
{
2968
	struct net *net = xs_net(x);
2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983
	struct sk_buff *skb;

	if (x->id.proto != IPPROTO_ESP)
		return -EINVAL;

	if (!x->encap)
		return -EINVAL;

	skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
	if (skb == NULL)
		return -ENOMEM;

	if (build_mapping(skb, x, ipaddr, sport) < 0)
		BUG();

2984
	return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
2985 2986
}

L
Linus Torvalds 已提交
2987 2988 2989 2990 2991 2992
static struct xfrm_mgr netlink_mgr = {
	.id		= "netlink",
	.notify		= xfrm_send_state_notify,
	.acquire	= xfrm_send_acquire,
	.compile_policy	= xfrm_compile_policy,
	.notify_policy	= xfrm_send_policy_notify,
2993
	.report		= xfrm_send_report,
2994
	.migrate	= xfrm_send_migrate,
2995
	.new_mapping	= xfrm_send_mapping,
L
Linus Torvalds 已提交
2996 2997
};

2998
static int __net_init xfrm_user_net_init(struct net *net)
L
Linus Torvalds 已提交
2999
{
3000
	struct sock *nlsk;
3001 3002 3003 3004
	struct netlink_kernel_cfg cfg = {
		.groups	= XFRMNLGRP_MAX,
		.input	= xfrm_netlink_rcv,
	};
3005

3006
	nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg);
3007
	if (nlsk == NULL)
L
Linus Torvalds 已提交
3008
		return -ENOMEM;
3009
	net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
3010
	rcu_assign_pointer(net->xfrm.nlsk, nlsk);
L
Linus Torvalds 已提交
3011 3012 3013
	return 0;
}

3014
static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
L
Linus Torvalds 已提交
3015
{
3016 3017
	struct net *net;
	list_for_each_entry(net, net_exit_list, exit_list)
3018
		RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
3019 3020 3021
	synchronize_net();
	list_for_each_entry(net, net_exit_list, exit_list)
		netlink_kernel_release(net->xfrm.nlsk_stash);
L
Linus Torvalds 已提交
3022 3023
}

3024
static struct pernet_operations xfrm_user_net_ops = {
3025 3026
	.init	    = xfrm_user_net_init,
	.exit_batch = xfrm_user_net_exit,
3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049
};

static int __init xfrm_user_init(void)
{
	int rv;

	printk(KERN_INFO "Initializing XFRM netlink socket\n");

	rv = register_pernet_subsys(&xfrm_user_net_ops);
	if (rv < 0)
		return rv;
	rv = xfrm_register_km(&netlink_mgr);
	if (rv < 0)
		unregister_pernet_subsys(&xfrm_user_net_ops);
	return rv;
}

static void __exit xfrm_user_exit(void)
{
	xfrm_unregister_km(&netlink_mgr);
	unregister_pernet_subsys(&xfrm_user_net_ops);
}

L
Linus Torvalds 已提交
3050 3051 3052
module_init(xfrm_user_init);
module_exit(xfrm_user_exit);
MODULE_LICENSE("GPL");
3053
MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
3054