xfrm_user.c 70 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015
  1. /* xfrm_user.c: User interface to configure xfrm engine.
  2. *
  3. * Copyright (C) 2002 David S. Miller (davem@redhat.com)
  4. *
  5. * Changes:
  6. * Mitsuru KANDA @USAGI
  7. * Kazunori MIYAZAWA @USAGI
  8. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  9. * IPv6 support
  10. *
  11. */
  12. #include <linux/crypto.h>
  13. #include <linux/module.h>
  14. #include <linux/kernel.h>
  15. #include <linux/types.h>
  16. #include <linux/slab.h>
  17. #include <linux/socket.h>
  18. #include <linux/string.h>
  19. #include <linux/net.h>
  20. #include <linux/skbuff.h>
  21. #include <linux/pfkeyv2.h>
  22. #include <linux/ipsec.h>
  23. #include <linux/init.h>
  24. #include <linux/security.h>
  25. #include <net/sock.h>
  26. #include <net/xfrm.h>
  27. #include <net/netlink.h>
  28. #include <net/ah.h>
  29. #include <asm/uaccess.h>
  30. #if IS_ENABLED(CONFIG_IPV6)
  31. #include <linux/in6.h>
  32. #endif
  33. static inline int aead_len(struct xfrm_algo_aead *alg)
  34. {
  35. return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
  36. }
  37. static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
  38. {
  39. struct nlattr *rt = attrs[type];
  40. struct xfrm_algo *algp;
  41. if (!rt)
  42. return 0;
  43. algp = nla_data(rt);
  44. if (nla_len(rt) < xfrm_alg_len(algp))
  45. return -EINVAL;
  46. switch (type) {
  47. case XFRMA_ALG_AUTH:
  48. case XFRMA_ALG_CRYPT:
  49. case XFRMA_ALG_COMP:
  50. break;
  51. default:
  52. return -EINVAL;
  53. }
  54. algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
  55. return 0;
  56. }
  57. static int verify_auth_trunc(struct nlattr **attrs)
  58. {
  59. struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
  60. struct xfrm_algo_auth *algp;
  61. if (!rt)
  62. return 0;
  63. algp = nla_data(rt);
  64. if (nla_len(rt) < xfrm_alg_auth_len(algp))
  65. return -EINVAL;
  66. algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
  67. return 0;
  68. }
  69. static int verify_aead(struct nlattr **attrs)
  70. {
  71. struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
  72. struct xfrm_algo_aead *algp;
  73. if (!rt)
  74. return 0;
  75. algp = nla_data(rt);
  76. if (nla_len(rt) < aead_len(algp))
  77. return -EINVAL;
  78. algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
  79. return 0;
  80. }
  81. static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
  82. xfrm_address_t **addrp)
  83. {
  84. struct nlattr *rt = attrs[type];
  85. if (rt && addrp)
  86. *addrp = nla_data(rt);
  87. }
  88. static inline int verify_sec_ctx_len(struct nlattr **attrs)
  89. {
  90. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  91. struct xfrm_user_sec_ctx *uctx;
  92. if (!rt)
  93. return 0;
  94. uctx = nla_data(rt);
  95. if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
  96. return -EINVAL;
  97. return 0;
  98. }
  99. static inline int verify_replay(struct xfrm_usersa_info *p,
  100. struct nlattr **attrs)
  101. {
  102. struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
  103. struct xfrm_replay_state_esn *rs;
  104. if (p->flags & XFRM_STATE_ESN) {
  105. if (!rt)
  106. return -EINVAL;
  107. rs = nla_data(rt);
  108. if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
  109. return -EINVAL;
  110. if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
  111. nla_len(rt) != sizeof(*rs))
  112. return -EINVAL;
  113. }
  114. if (!rt)
  115. return 0;
  116. if (p->id.proto != IPPROTO_ESP)
  117. return -EINVAL;
  118. if (p->replay_window != 0)
  119. return -EINVAL;
  120. return 0;
  121. }
  122. static int verify_newsa_info(struct xfrm_usersa_info *p,
  123. struct nlattr **attrs)
  124. {
  125. int err;
  126. err = -EINVAL;
  127. switch (p->family) {
  128. case AF_INET:
  129. break;
  130. case AF_INET6:
  131. #if IS_ENABLED(CONFIG_IPV6)
  132. break;
  133. #else
  134. err = -EAFNOSUPPORT;
  135. goto out;
  136. #endif
  137. default:
  138. goto out;
  139. }
  140. err = -EINVAL;
  141. switch (p->id.proto) {
  142. case IPPROTO_AH:
  143. if ((!attrs[XFRMA_ALG_AUTH] &&
  144. !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
  145. attrs[XFRMA_ALG_AEAD] ||
  146. attrs[XFRMA_ALG_CRYPT] ||
  147. attrs[XFRMA_ALG_COMP] ||
  148. attrs[XFRMA_TFCPAD])
  149. goto out;
  150. break;
  151. case IPPROTO_ESP:
  152. if (attrs[XFRMA_ALG_COMP])
  153. goto out;
  154. if (!attrs[XFRMA_ALG_AUTH] &&
  155. !attrs[XFRMA_ALG_AUTH_TRUNC] &&
  156. !attrs[XFRMA_ALG_CRYPT] &&
  157. !attrs[XFRMA_ALG_AEAD])
  158. goto out;
  159. if ((attrs[XFRMA_ALG_AUTH] ||
  160. attrs[XFRMA_ALG_AUTH_TRUNC] ||
  161. attrs[XFRMA_ALG_CRYPT]) &&
  162. attrs[XFRMA_ALG_AEAD])
  163. goto out;
  164. if (attrs[XFRMA_TFCPAD] &&
  165. p->mode != XFRM_MODE_TUNNEL)
  166. goto out;
  167. break;
  168. case IPPROTO_COMP:
  169. if (!attrs[XFRMA_ALG_COMP] ||
  170. attrs[XFRMA_ALG_AEAD] ||
  171. attrs[XFRMA_ALG_AUTH] ||
  172. attrs[XFRMA_ALG_AUTH_TRUNC] ||
  173. attrs[XFRMA_ALG_CRYPT] ||
  174. attrs[XFRMA_TFCPAD])
  175. goto out;
  176. break;
  177. #if IS_ENABLED(CONFIG_IPV6)
  178. case IPPROTO_DSTOPTS:
  179. case IPPROTO_ROUTING:
  180. if (attrs[XFRMA_ALG_COMP] ||
  181. attrs[XFRMA_ALG_AUTH] ||
  182. attrs[XFRMA_ALG_AUTH_TRUNC] ||
  183. attrs[XFRMA_ALG_AEAD] ||
  184. attrs[XFRMA_ALG_CRYPT] ||
  185. attrs[XFRMA_ENCAP] ||
  186. attrs[XFRMA_SEC_CTX] ||
  187. attrs[XFRMA_TFCPAD] ||
  188. !attrs[XFRMA_COADDR])
  189. goto out;
  190. break;
  191. #endif
  192. default:
  193. goto out;
  194. }
  195. if ((err = verify_aead(attrs)))
  196. goto out;
  197. if ((err = verify_auth_trunc(attrs)))
  198. goto out;
  199. if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
  200. goto out;
  201. if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
  202. goto out;
  203. if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
  204. goto out;
  205. if ((err = verify_sec_ctx_len(attrs)))
  206. goto out;
  207. if ((err = verify_replay(p, attrs)))
  208. goto out;
  209. err = -EINVAL;
  210. switch (p->mode) {
  211. case XFRM_MODE_TRANSPORT:
  212. case XFRM_MODE_TUNNEL:
  213. case XFRM_MODE_ROUTEOPTIMIZATION:
  214. case XFRM_MODE_BEET:
  215. break;
  216. default:
  217. goto out;
  218. }
  219. err = 0;
  220. out:
  221. return err;
  222. }
  223. static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
  224. struct xfrm_algo_desc *(*get_byname)(const char *, int),
  225. struct nlattr *rta)
  226. {
  227. struct xfrm_algo *p, *ualg;
  228. struct xfrm_algo_desc *algo;
  229. if (!rta)
  230. return 0;
  231. ualg = nla_data(rta);
  232. algo = get_byname(ualg->alg_name, 1);
  233. if (!algo)
  234. return -ENOSYS;
  235. *props = algo->desc.sadb_alg_id;
  236. p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
  237. if (!p)
  238. return -ENOMEM;
  239. strcpy(p->alg_name, algo->name);
  240. *algpp = p;
  241. return 0;
  242. }
  243. static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
  244. struct nlattr *rta)
  245. {
  246. struct xfrm_algo *ualg;
  247. struct xfrm_algo_auth *p;
  248. struct xfrm_algo_desc *algo;
  249. if (!rta)
  250. return 0;
  251. ualg = nla_data(rta);
  252. algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
  253. if (!algo)
  254. return -ENOSYS;
  255. *props = algo->desc.sadb_alg_id;
  256. p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
  257. if (!p)
  258. return -ENOMEM;
  259. strcpy(p->alg_name, algo->name);
  260. p->alg_key_len = ualg->alg_key_len;
  261. p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
  262. memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
  263. *algpp = p;
  264. return 0;
  265. }
  266. static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
  267. struct nlattr *rta)
  268. {
  269. struct xfrm_algo_auth *p, *ualg;
  270. struct xfrm_algo_desc *algo;
  271. if (!rta)
  272. return 0;
  273. ualg = nla_data(rta);
  274. algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
  275. if (!algo)
  276. return -ENOSYS;
  277. if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
  278. ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
  279. return -EINVAL;
  280. *props = algo->desc.sadb_alg_id;
  281. p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
  282. if (!p)
  283. return -ENOMEM;
  284. strcpy(p->alg_name, algo->name);
  285. if (!p->alg_trunc_len)
  286. p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
  287. *algpp = p;
  288. return 0;
  289. }
  290. static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
  291. struct nlattr *rta)
  292. {
  293. struct xfrm_algo_aead *p, *ualg;
  294. struct xfrm_algo_desc *algo;
  295. if (!rta)
  296. return 0;
  297. ualg = nla_data(rta);
  298. algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
  299. if (!algo)
  300. return -ENOSYS;
  301. *props = algo->desc.sadb_alg_id;
  302. p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
  303. if (!p)
  304. return -ENOMEM;
  305. strcpy(p->alg_name, algo->name);
  306. *algpp = p;
  307. return 0;
  308. }
  309. static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
  310. struct nlattr *rp)
  311. {
  312. struct xfrm_replay_state_esn *up;
  313. int ulen;
  314. if (!replay_esn || !rp)
  315. return 0;
  316. up = nla_data(rp);
  317. ulen = xfrm_replay_state_esn_len(up);
  318. /* Check the overall length and the internal bitmap length to avoid
  319. * potential overflow. */
  320. if (nla_len(rp) < ulen ||
  321. xfrm_replay_state_esn_len(replay_esn) != ulen ||
  322. replay_esn->bmp_len != up->bmp_len)
  323. return -EINVAL;
  324. if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
  325. return -EINVAL;
  326. return 0;
  327. }
  328. static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
  329. struct xfrm_replay_state_esn **preplay_esn,
  330. struct nlattr *rta)
  331. {
  332. struct xfrm_replay_state_esn *p, *pp, *up;
  333. int klen, ulen;
  334. if (!rta)
  335. return 0;
  336. up = nla_data(rta);
  337. klen = xfrm_replay_state_esn_len(up);
  338. ulen = nla_len(rta) >= klen ? klen : sizeof(*up);
  339. p = kzalloc(klen, GFP_KERNEL);
  340. if (!p)
  341. return -ENOMEM;
  342. pp = kzalloc(klen, GFP_KERNEL);
  343. if (!pp) {
  344. kfree(p);
  345. return -ENOMEM;
  346. }
  347. memcpy(p, up, ulen);
  348. memcpy(pp, up, ulen);
  349. *replay_esn = p;
  350. *preplay_esn = pp;
  351. return 0;
  352. }
  353. static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
  354. {
  355. int len = 0;
  356. if (xfrm_ctx) {
  357. len += sizeof(struct xfrm_user_sec_ctx);
  358. len += xfrm_ctx->ctx_len;
  359. }
  360. return len;
  361. }
  362. static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
  363. {
  364. memcpy(&x->id, &p->id, sizeof(x->id));
  365. memcpy(&x->sel, &p->sel, sizeof(x->sel));
  366. memcpy(&x->lft, &p->lft, sizeof(x->lft));
  367. x->props.mode = p->mode;
  368. x->props.replay_window = p->replay_window;
  369. x->props.reqid = p->reqid;
  370. x->props.family = p->family;
  371. memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
  372. x->props.flags = p->flags;
  373. if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
  374. x->sel.family = p->family;
  375. }
  376. /*
  377. * someday when pfkey also has support, we could have the code
  378. * somehow made shareable and move it to xfrm_state.c - JHS
  379. *
  380. */
  381. static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
  382. int update_esn)
  383. {
  384. struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
  385. struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
  386. struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
  387. struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
  388. struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
  389. if (re) {
  390. struct xfrm_replay_state_esn *replay_esn;
  391. replay_esn = nla_data(re);
  392. memcpy(x->replay_esn, replay_esn,
  393. xfrm_replay_state_esn_len(replay_esn));
  394. memcpy(x->preplay_esn, replay_esn,
  395. xfrm_replay_state_esn_len(replay_esn));
  396. }
  397. if (rp) {
  398. struct xfrm_replay_state *replay;
  399. replay = nla_data(rp);
  400. memcpy(&x->replay, replay, sizeof(*replay));
  401. memcpy(&x->preplay, replay, sizeof(*replay));
  402. }
  403. if (lt) {
  404. struct xfrm_lifetime_cur *ltime;
  405. ltime = nla_data(lt);
  406. x->curlft.bytes = ltime->bytes;
  407. x->curlft.packets = ltime->packets;
  408. x->curlft.add_time = ltime->add_time;
  409. x->curlft.use_time = ltime->use_time;
  410. }
  411. if (et)
  412. x->replay_maxage = nla_get_u32(et);
  413. if (rt)
  414. x->replay_maxdiff = nla_get_u32(rt);
  415. }
  416. static struct xfrm_state *xfrm_state_construct(struct net *net,
  417. struct xfrm_usersa_info *p,
  418. struct nlattr **attrs,
  419. int *errp)
  420. {
  421. struct xfrm_state *x = xfrm_state_alloc(net);
  422. int err = -ENOMEM;
  423. if (!x)
  424. goto error_no_put;
  425. copy_from_user_state(x, p);
  426. if ((err = attach_aead(&x->aead, &x->props.ealgo,
  427. attrs[XFRMA_ALG_AEAD])))
  428. goto error;
  429. if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
  430. attrs[XFRMA_ALG_AUTH_TRUNC])))
  431. goto error;
  432. if (!x->props.aalgo) {
  433. if ((err = attach_auth(&x->aalg, &x->props.aalgo,
  434. attrs[XFRMA_ALG_AUTH])))
  435. goto error;
  436. }
  437. if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
  438. xfrm_ealg_get_byname,
  439. attrs[XFRMA_ALG_CRYPT])))
  440. goto error;
  441. if ((err = attach_one_algo(&x->calg, &x->props.calgo,
  442. xfrm_calg_get_byname,
  443. attrs[XFRMA_ALG_COMP])))
  444. goto error;
  445. if (attrs[XFRMA_ENCAP]) {
  446. x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
  447. sizeof(*x->encap), GFP_KERNEL);
  448. if (x->encap == NULL)
  449. goto error;
  450. }
  451. if (attrs[XFRMA_TFCPAD])
  452. x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
  453. if (attrs[XFRMA_COADDR]) {
  454. x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
  455. sizeof(*x->coaddr), GFP_KERNEL);
  456. if (x->coaddr == NULL)
  457. goto error;
  458. }
  459. xfrm_mark_get(attrs, &x->mark);
  460. err = __xfrm_init_state(x, false);
  461. if (err)
  462. goto error;
  463. if (attrs[XFRMA_SEC_CTX] &&
  464. security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
  465. goto error;
  466. if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
  467. attrs[XFRMA_REPLAY_ESN_VAL])))
  468. goto error;
  469. x->km.seq = p->seq;
  470. x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
  471. /* sysctl_xfrm_aevent_etime is in 100ms units */
  472. x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
  473. if ((err = xfrm_init_replay(x)))
  474. goto error;
  475. /* override default values from above */
  476. xfrm_update_ae_params(x, attrs, 0);
  477. return x;
  478. error:
  479. x->km.state = XFRM_STATE_DEAD;
  480. xfrm_state_put(x);
  481. error_no_put:
  482. *errp = err;
  483. return NULL;
  484. }
  485. static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  486. struct nlattr **attrs)
  487. {
  488. struct net *net = sock_net(skb->sk);
  489. struct xfrm_usersa_info *p = nlmsg_data(nlh);
  490. struct xfrm_state *x;
  491. int err;
  492. struct km_event c;
  493. uid_t loginuid = audit_get_loginuid(current);
  494. u32 sessionid = audit_get_sessionid(current);
  495. u32 sid;
  496. err = verify_newsa_info(p, attrs);
  497. if (err)
  498. return err;
  499. x = xfrm_state_construct(net, p, attrs, &err);
  500. if (!x)
  501. return err;
  502. xfrm_state_hold(x);
  503. if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
  504. err = xfrm_state_add(x);
  505. else
  506. err = xfrm_state_update(x);
  507. security_task_getsecid(current, &sid);
  508. xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
  509. if (err < 0) {
  510. x->km.state = XFRM_STATE_DEAD;
  511. __xfrm_state_put(x);
  512. goto out;
  513. }
  514. c.seq = nlh->nlmsg_seq;
  515. c.pid = nlh->nlmsg_pid;
  516. c.event = nlh->nlmsg_type;
  517. km_state_notify(x, &c);
  518. out:
  519. xfrm_state_put(x);
  520. return err;
  521. }
  522. static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
  523. struct xfrm_usersa_id *p,
  524. struct nlattr **attrs,
  525. int *errp)
  526. {
  527. struct xfrm_state *x = NULL;
  528. struct xfrm_mark m;
  529. int err;
  530. u32 mark = xfrm_mark_get(attrs, &m);
  531. if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
  532. err = -ESRCH;
  533. x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
  534. } else {
  535. xfrm_address_t *saddr = NULL;
  536. verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
  537. if (!saddr) {
  538. err = -EINVAL;
  539. goto out;
  540. }
  541. err = -ESRCH;
  542. x = xfrm_state_lookup_byaddr(net, mark,
  543. &p->daddr, saddr,
  544. p->proto, p->family);
  545. }
  546. out:
  547. if (!x && errp)
  548. *errp = err;
  549. return x;
  550. }
  551. static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  552. struct nlattr **attrs)
  553. {
  554. struct net *net = sock_net(skb->sk);
  555. struct xfrm_state *x;
  556. int err = -ESRCH;
  557. struct km_event c;
  558. struct xfrm_usersa_id *p = nlmsg_data(nlh);
  559. uid_t loginuid = audit_get_loginuid(current);
  560. u32 sessionid = audit_get_sessionid(current);
  561. u32 sid;
  562. x = xfrm_user_state_lookup(net, p, attrs, &err);
  563. if (x == NULL)
  564. return err;
  565. if ((err = security_xfrm_state_delete(x)) != 0)
  566. goto out;
  567. if (xfrm_state_kern(x)) {
  568. err = -EPERM;
  569. goto out;
  570. }
  571. err = xfrm_state_delete(x);
  572. if (err < 0)
  573. goto out;
  574. c.seq = nlh->nlmsg_seq;
  575. c.pid = nlh->nlmsg_pid;
  576. c.event = nlh->nlmsg_type;
  577. km_state_notify(x, &c);
  578. out:
  579. security_task_getsecid(current, &sid);
  580. xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
  581. xfrm_state_put(x);
  582. return err;
  583. }
  584. static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
  585. {
  586. memset(p, 0, sizeof(*p));
  587. memcpy(&p->id, &x->id, sizeof(p->id));
  588. memcpy(&p->sel, &x->sel, sizeof(p->sel));
  589. memcpy(&p->lft, &x->lft, sizeof(p->lft));
  590. memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
  591. memcpy(&p->stats, &x->stats, sizeof(p->stats));
  592. memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
  593. p->mode = x->props.mode;
  594. p->replay_window = x->props.replay_window;
  595. p->reqid = x->props.reqid;
  596. p->family = x->props.family;
  597. p->flags = x->props.flags;
  598. p->seq = x->km.seq;
  599. }
  600. struct xfrm_dump_info {
  601. struct sk_buff *in_skb;
  602. struct sk_buff *out_skb;
  603. u32 nlmsg_seq;
  604. u16 nlmsg_flags;
  605. };
  606. static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
  607. {
  608. struct xfrm_user_sec_ctx *uctx;
  609. struct nlattr *attr;
  610. int ctx_size = sizeof(*uctx) + s->ctx_len;
  611. attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
  612. if (attr == NULL)
  613. return -EMSGSIZE;
  614. uctx = nla_data(attr);
  615. uctx->exttype = XFRMA_SEC_CTX;
  616. uctx->len = ctx_size;
  617. uctx->ctx_doi = s->ctx_doi;
  618. uctx->ctx_alg = s->ctx_alg;
  619. uctx->ctx_len = s->ctx_len;
  620. memcpy(uctx + 1, s->ctx_str, s->ctx_len);
  621. return 0;
  622. }
  623. static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
  624. {
  625. struct xfrm_algo *algo;
  626. struct nlattr *nla;
  627. nla = nla_reserve(skb, XFRMA_ALG_AUTH,
  628. sizeof(*algo) + (auth->alg_key_len + 7) / 8);
  629. if (!nla)
  630. return -EMSGSIZE;
  631. algo = nla_data(nla);
  632. strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
  633. memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
  634. algo->alg_key_len = auth->alg_key_len;
  635. return 0;
  636. }
  637. /* Don't change this without updating xfrm_sa_len! */
  638. static int copy_to_user_state_extra(struct xfrm_state *x,
  639. struct xfrm_usersa_info *p,
  640. struct sk_buff *skb)
  641. {
  642. copy_to_user_state(x, p);
  643. if (x->coaddr)
  644. NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
  645. if (x->lastused)
  646. NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
  647. if (x->aead)
  648. NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
  649. if (x->aalg) {
  650. if (copy_to_user_auth(x->aalg, skb))
  651. goto nla_put_failure;
  652. NLA_PUT(skb, XFRMA_ALG_AUTH_TRUNC,
  653. xfrm_alg_auth_len(x->aalg), x->aalg);
  654. }
  655. if (x->ealg)
  656. NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
  657. if (x->calg)
  658. NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
  659. if (x->encap)
  660. NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
  661. if (x->tfcpad)
  662. NLA_PUT_U32(skb, XFRMA_TFCPAD, x->tfcpad);
  663. if (xfrm_mark_put(skb, &x->mark))
  664. goto nla_put_failure;
  665. if (x->replay_esn)
  666. NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
  667. xfrm_replay_state_esn_len(x->replay_esn), x->replay_esn);
  668. if (x->security && copy_sec_ctx(x->security, skb) < 0)
  669. goto nla_put_failure;
  670. return 0;
  671. nla_put_failure:
  672. return -EMSGSIZE;
  673. }
  674. static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
  675. {
  676. struct xfrm_dump_info *sp = ptr;
  677. struct sk_buff *in_skb = sp->in_skb;
  678. struct sk_buff *skb = sp->out_skb;
  679. struct xfrm_usersa_info *p;
  680. struct nlmsghdr *nlh;
  681. int err;
  682. nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
  683. XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
  684. if (nlh == NULL)
  685. return -EMSGSIZE;
  686. p = nlmsg_data(nlh);
  687. err = copy_to_user_state_extra(x, p, skb);
  688. if (err)
  689. goto nla_put_failure;
  690. nlmsg_end(skb, nlh);
  691. return 0;
  692. nla_put_failure:
  693. nlmsg_cancel(skb, nlh);
  694. return err;
  695. }
  696. static int xfrm_dump_sa_done(struct netlink_callback *cb)
  697. {
  698. struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
  699. xfrm_state_walk_done(walk);
  700. return 0;
  701. }
  702. static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
  703. {
  704. struct net *net = sock_net(skb->sk);
  705. struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
  706. struct xfrm_dump_info info;
  707. BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
  708. sizeof(cb->args) - sizeof(cb->args[0]));
  709. info.in_skb = cb->skb;
  710. info.out_skb = skb;
  711. info.nlmsg_seq = cb->nlh->nlmsg_seq;
  712. info.nlmsg_flags = NLM_F_MULTI;
  713. if (!cb->args[0]) {
  714. cb->args[0] = 1;
  715. xfrm_state_walk_init(walk, 0);
  716. }
  717. (void) xfrm_state_walk(net, walk, dump_one_state, &info);
  718. return skb->len;
  719. }
  720. static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
  721. struct xfrm_state *x, u32 seq)
  722. {
  723. struct xfrm_dump_info info;
  724. struct sk_buff *skb;
  725. int err;
  726. skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
  727. if (!skb)
  728. return ERR_PTR(-ENOMEM);
  729. info.in_skb = in_skb;
  730. info.out_skb = skb;
  731. info.nlmsg_seq = seq;
  732. info.nlmsg_flags = 0;
  733. err = dump_one_state(x, 0, &info);
  734. if (err) {
  735. kfree_skb(skb);
  736. return ERR_PTR(err);
  737. }
  738. return skb;
  739. }
  740. static inline size_t xfrm_spdinfo_msgsize(void)
  741. {
  742. return NLMSG_ALIGN(4)
  743. + nla_total_size(sizeof(struct xfrmu_spdinfo))
  744. + nla_total_size(sizeof(struct xfrmu_spdhinfo));
  745. }
  746. static int build_spdinfo(struct sk_buff *skb, struct net *net,
  747. u32 pid, u32 seq, u32 flags)
  748. {
  749. struct xfrmk_spdinfo si;
  750. struct xfrmu_spdinfo spc;
  751. struct xfrmu_spdhinfo sph;
  752. struct nlmsghdr *nlh;
  753. u32 *f;
  754. nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
  755. if (nlh == NULL) /* shouldn't really happen ... */
  756. return -EMSGSIZE;
  757. f = nlmsg_data(nlh);
  758. *f = flags;
  759. xfrm_spd_getinfo(net, &si);
  760. spc.incnt = si.incnt;
  761. spc.outcnt = si.outcnt;
  762. spc.fwdcnt = si.fwdcnt;
  763. spc.inscnt = si.inscnt;
  764. spc.outscnt = si.outscnt;
  765. spc.fwdscnt = si.fwdscnt;
  766. sph.spdhcnt = si.spdhcnt;
  767. sph.spdhmcnt = si.spdhmcnt;
  768. NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
  769. NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
  770. return nlmsg_end(skb, nlh);
  771. nla_put_failure:
  772. nlmsg_cancel(skb, nlh);
  773. return -EMSGSIZE;
  774. }
  775. static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
  776. struct nlattr **attrs)
  777. {
  778. struct net *net = sock_net(skb->sk);
  779. struct sk_buff *r_skb;
  780. u32 *flags = nlmsg_data(nlh);
  781. u32 spid = NETLINK_CB(skb).pid;
  782. u32 seq = nlh->nlmsg_seq;
  783. r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
  784. if (r_skb == NULL)
  785. return -ENOMEM;
  786. if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
  787. BUG();
  788. return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
  789. }
  790. static inline size_t xfrm_sadinfo_msgsize(void)
  791. {
  792. return NLMSG_ALIGN(4)
  793. + nla_total_size(sizeof(struct xfrmu_sadhinfo))
  794. + nla_total_size(4); /* XFRMA_SAD_CNT */
  795. }
  796. static int build_sadinfo(struct sk_buff *skb, struct net *net,
  797. u32 pid, u32 seq, u32 flags)
  798. {
  799. struct xfrmk_sadinfo si;
  800. struct xfrmu_sadhinfo sh;
  801. struct nlmsghdr *nlh;
  802. u32 *f;
  803. nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
  804. if (nlh == NULL) /* shouldn't really happen ... */
  805. return -EMSGSIZE;
  806. f = nlmsg_data(nlh);
  807. *f = flags;
  808. xfrm_sad_getinfo(net, &si);
  809. sh.sadhmcnt = si.sadhmcnt;
  810. sh.sadhcnt = si.sadhcnt;
  811. NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
  812. NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
  813. return nlmsg_end(skb, nlh);
  814. nla_put_failure:
  815. nlmsg_cancel(skb, nlh);
  816. return -EMSGSIZE;
  817. }
  818. static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
  819. struct nlattr **attrs)
  820. {
  821. struct net *net = sock_net(skb->sk);
  822. struct sk_buff *r_skb;
  823. u32 *flags = nlmsg_data(nlh);
  824. u32 spid = NETLINK_CB(skb).pid;
  825. u32 seq = nlh->nlmsg_seq;
  826. r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
  827. if (r_skb == NULL)
  828. return -ENOMEM;
  829. if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
  830. BUG();
  831. return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
  832. }
  833. static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  834. struct nlattr **attrs)
  835. {
  836. struct net *net = sock_net(skb->sk);
  837. struct xfrm_usersa_id *p = nlmsg_data(nlh);
  838. struct xfrm_state *x;
  839. struct sk_buff *resp_skb;
  840. int err = -ESRCH;
  841. x = xfrm_user_state_lookup(net, p, attrs, &err);
  842. if (x == NULL)
  843. goto out_noput;
  844. resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
  845. if (IS_ERR(resp_skb)) {
  846. err = PTR_ERR(resp_skb);
  847. } else {
  848. err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
  849. }
  850. xfrm_state_put(x);
  851. out_noput:
  852. return err;
  853. }
  854. static int verify_userspi_info(struct xfrm_userspi_info *p)
  855. {
  856. switch (p->info.id.proto) {
  857. case IPPROTO_AH:
  858. case IPPROTO_ESP:
  859. break;
  860. case IPPROTO_COMP:
  861. /* IPCOMP spi is 16-bits. */
  862. if (p->max >= 0x10000)
  863. return -EINVAL;
  864. break;
  865. default:
  866. return -EINVAL;
  867. }
  868. if (p->min > p->max)
  869. return -EINVAL;
  870. return 0;
  871. }
  872. static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
  873. struct nlattr **attrs)
  874. {
  875. struct net *net = sock_net(skb->sk);
  876. struct xfrm_state *x;
  877. struct xfrm_userspi_info *p;
  878. struct sk_buff *resp_skb;
  879. xfrm_address_t *daddr;
  880. int family;
  881. int err;
  882. u32 mark;
  883. struct xfrm_mark m;
  884. p = nlmsg_data(nlh);
  885. err = verify_userspi_info(p);
  886. if (err)
  887. goto out_noput;
  888. family = p->info.family;
  889. daddr = &p->info.id.daddr;
  890. x = NULL;
  891. mark = xfrm_mark_get(attrs, &m);
  892. if (p->info.seq) {
  893. x = xfrm_find_acq_byseq(net, mark, p->info.seq);
  894. if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
  895. xfrm_state_put(x);
  896. x = NULL;
  897. }
  898. }
  899. if (!x)
  900. x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
  901. p->info.id.proto, daddr,
  902. &p->info.saddr, 1,
  903. family);
  904. err = -ENOENT;
  905. if (x == NULL)
  906. goto out_noput;
  907. err = xfrm_alloc_spi(x, p->min, p->max);
  908. if (err)
  909. goto out;
  910. resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
  911. if (IS_ERR(resp_skb)) {
  912. err = PTR_ERR(resp_skb);
  913. goto out;
  914. }
  915. err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
  916. out:
  917. xfrm_state_put(x);
  918. out_noput:
  919. return err;
  920. }
  921. static int verify_policy_dir(u8 dir)
  922. {
  923. switch (dir) {
  924. case XFRM_POLICY_IN:
  925. case XFRM_POLICY_OUT:
  926. case XFRM_POLICY_FWD:
  927. break;
  928. default:
  929. return -EINVAL;
  930. }
  931. return 0;
  932. }
  933. static int verify_policy_type(u8 type)
  934. {
  935. switch (type) {
  936. case XFRM_POLICY_TYPE_MAIN:
  937. #ifdef CONFIG_XFRM_SUB_POLICY
  938. case XFRM_POLICY_TYPE_SUB:
  939. #endif
  940. break;
  941. default:
  942. return -EINVAL;
  943. }
  944. return 0;
  945. }
  946. static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
  947. {
  948. switch (p->share) {
  949. case XFRM_SHARE_ANY:
  950. case XFRM_SHARE_SESSION:
  951. case XFRM_SHARE_USER:
  952. case XFRM_SHARE_UNIQUE:
  953. break;
  954. default:
  955. return -EINVAL;
  956. }
  957. switch (p->action) {
  958. case XFRM_POLICY_ALLOW:
  959. case XFRM_POLICY_BLOCK:
  960. break;
  961. default:
  962. return -EINVAL;
  963. }
  964. switch (p->sel.family) {
  965. case AF_INET:
  966. break;
  967. case AF_INET6:
  968. #if IS_ENABLED(CONFIG_IPV6)
  969. break;
  970. #else
  971. return -EAFNOSUPPORT;
  972. #endif
  973. default:
  974. return -EINVAL;
  975. }
  976. return verify_policy_dir(p->dir);
  977. }
  978. static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
  979. {
  980. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  981. struct xfrm_user_sec_ctx *uctx;
  982. if (!rt)
  983. return 0;
  984. uctx = nla_data(rt);
  985. return security_xfrm_policy_alloc(&pol->security, uctx);
  986. }
  987. static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
  988. int nr)
  989. {
  990. int i;
  991. xp->xfrm_nr = nr;
  992. for (i = 0; i < nr; i++, ut++) {
  993. struct xfrm_tmpl *t = &xp->xfrm_vec[i];
  994. memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
  995. memcpy(&t->saddr, &ut->saddr,
  996. sizeof(xfrm_address_t));
  997. t->reqid = ut->reqid;
  998. t->mode = ut->mode;
  999. t->share = ut->share;
  1000. t->optional = ut->optional;
  1001. t->aalgos = ut->aalgos;
  1002. t->ealgos = ut->ealgos;
  1003. t->calgos = ut->calgos;
  1004. /* If all masks are ~0, then we allow all algorithms. */
  1005. t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
  1006. t->encap_family = ut->family;
  1007. }
  1008. }
  1009. static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
  1010. {
  1011. int i;
  1012. if (nr > XFRM_MAX_DEPTH)
  1013. return -EINVAL;
  1014. for (i = 0; i < nr; i++) {
  1015. /* We never validated the ut->family value, so many
  1016. * applications simply leave it at zero. The check was
  1017. * never made and ut->family was ignored because all
  1018. * templates could be assumed to have the same family as
  1019. * the policy itself. Now that we will have ipv4-in-ipv6
  1020. * and ipv6-in-ipv4 tunnels, this is no longer true.
  1021. */
  1022. if (!ut[i].family)
  1023. ut[i].family = family;
  1024. switch (ut[i].family) {
  1025. case AF_INET:
  1026. break;
  1027. #if IS_ENABLED(CONFIG_IPV6)
  1028. case AF_INET6:
  1029. break;
  1030. #endif
  1031. default:
  1032. return -EINVAL;
  1033. }
  1034. }
  1035. return 0;
  1036. }
  1037. static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
  1038. {
  1039. struct nlattr *rt = attrs[XFRMA_TMPL];
  1040. if (!rt) {
  1041. pol->xfrm_nr = 0;
  1042. } else {
  1043. struct xfrm_user_tmpl *utmpl = nla_data(rt);
  1044. int nr = nla_len(rt) / sizeof(*utmpl);
  1045. int err;
  1046. err = validate_tmpl(nr, utmpl, pol->family);
  1047. if (err)
  1048. return err;
  1049. copy_templates(pol, utmpl, nr);
  1050. }
  1051. return 0;
  1052. }
  1053. static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
  1054. {
  1055. struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
  1056. struct xfrm_userpolicy_type *upt;
  1057. u8 type = XFRM_POLICY_TYPE_MAIN;
  1058. int err;
  1059. if (rt) {
  1060. upt = nla_data(rt);
  1061. type = upt->type;
  1062. }
  1063. err = verify_policy_type(type);
  1064. if (err)
  1065. return err;
  1066. *tp = type;
  1067. return 0;
  1068. }
  1069. static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
  1070. {
  1071. xp->priority = p->priority;
  1072. xp->index = p->index;
  1073. memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
  1074. memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
  1075. xp->action = p->action;
  1076. xp->flags = p->flags;
  1077. xp->family = p->sel.family;
  1078. /* XXX xp->share = p->share; */
  1079. }
  1080. static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
  1081. {
  1082. memset(p, 0, sizeof(*p));
  1083. memcpy(&p->sel, &xp->selector, sizeof(p->sel));
  1084. memcpy(&p->lft, &xp->lft, sizeof(p->lft));
  1085. memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
  1086. p->priority = xp->priority;
  1087. p->index = xp->index;
  1088. p->sel.family = xp->family;
  1089. p->dir = dir;
  1090. p->action = xp->action;
  1091. p->flags = xp->flags;
  1092. p->share = XFRM_SHARE_ANY; /* XXX xp->share */
  1093. }
  1094. static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
  1095. {
  1096. struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
  1097. int err;
  1098. if (!xp) {
  1099. *errp = -ENOMEM;
  1100. return NULL;
  1101. }
  1102. copy_from_user_policy(xp, p);
  1103. err = copy_from_user_policy_type(&xp->type, attrs);
  1104. if (err)
  1105. goto error;
  1106. if (!(err = copy_from_user_tmpl(xp, attrs)))
  1107. err = copy_from_user_sec_ctx(xp, attrs);
  1108. if (err)
  1109. goto error;
  1110. xfrm_mark_get(attrs, &xp->mark);
  1111. return xp;
  1112. error:
  1113. *errp = err;
  1114. xp->walk.dead = 1;
  1115. xfrm_policy_destroy(xp);
  1116. return NULL;
  1117. }
  1118. static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
  1119. struct nlattr **attrs)
  1120. {
  1121. struct net *net = sock_net(skb->sk);
  1122. struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
  1123. struct xfrm_policy *xp;
  1124. struct km_event c;
  1125. int err;
  1126. int excl;
  1127. uid_t loginuid = audit_get_loginuid(current);
  1128. u32 sessionid = audit_get_sessionid(current);
  1129. u32 sid;
  1130. err = verify_newpolicy_info(p);
  1131. if (err)
  1132. return err;
  1133. err = verify_sec_ctx_len(attrs);
  1134. if (err)
  1135. return err;
  1136. xp = xfrm_policy_construct(net, p, attrs, &err);
  1137. if (!xp)
  1138. return err;
  1139. /* shouldn't excl be based on nlh flags??
  1140. * Aha! this is anti-netlink really i.e more pfkey derived
  1141. * in netlink excl is a flag and you wouldnt need
  1142. * a type XFRM_MSG_UPDPOLICY - JHS */
  1143. excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
  1144. err = xfrm_policy_insert(p->dir, xp, excl);
  1145. security_task_getsecid(current, &sid);
  1146. xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
  1147. if (err) {
  1148. security_xfrm_policy_free(xp->security);
  1149. kfree(xp);
  1150. return err;
  1151. }
  1152. c.event = nlh->nlmsg_type;
  1153. c.seq = nlh->nlmsg_seq;
  1154. c.pid = nlh->nlmsg_pid;
  1155. km_policy_notify(xp, p->dir, &c);
  1156. xfrm_pol_put(xp);
  1157. return 0;
  1158. }
  1159. static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
  1160. {
  1161. struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
  1162. int i;
  1163. if (xp->xfrm_nr == 0)
  1164. return 0;
  1165. for (i = 0; i < xp->xfrm_nr; i++) {
  1166. struct xfrm_user_tmpl *up = &vec[i];
  1167. struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
  1168. memset(up, 0, sizeof(*up));
  1169. memcpy(&up->id, &kp->id, sizeof(up->id));
  1170. up->family = kp->encap_family;
  1171. memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
  1172. up->reqid = kp->reqid;
  1173. up->mode = kp->mode;
  1174. up->share = kp->share;
  1175. up->optional = kp->optional;
  1176. up->aalgos = kp->aalgos;
  1177. up->ealgos = kp->ealgos;
  1178. up->calgos = kp->calgos;
  1179. }
  1180. return nla_put(skb, XFRMA_TMPL,
  1181. sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
  1182. }
  1183. static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
  1184. {
  1185. if (x->security) {
  1186. return copy_sec_ctx(x->security, skb);
  1187. }
  1188. return 0;
  1189. }
  1190. static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
  1191. {
  1192. if (xp->security) {
  1193. return copy_sec_ctx(xp->security, skb);
  1194. }
  1195. return 0;
  1196. }
  1197. static inline size_t userpolicy_type_attrsize(void)
  1198. {
  1199. #ifdef CONFIG_XFRM_SUB_POLICY
  1200. return nla_total_size(sizeof(struct xfrm_userpolicy_type));
  1201. #else
  1202. return 0;
  1203. #endif
  1204. }
  1205. #ifdef CONFIG_XFRM_SUB_POLICY
  1206. static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
  1207. {
  1208. struct xfrm_userpolicy_type upt = {
  1209. .type = type,
  1210. };
  1211. return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
  1212. }
  1213. #else
  1214. static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
  1215. {
  1216. return 0;
  1217. }
  1218. #endif
  1219. static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
  1220. {
  1221. struct xfrm_dump_info *sp = ptr;
  1222. struct xfrm_userpolicy_info *p;
  1223. struct sk_buff *in_skb = sp->in_skb;
  1224. struct sk_buff *skb = sp->out_skb;
  1225. struct nlmsghdr *nlh;
  1226. nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
  1227. XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
  1228. if (nlh == NULL)
  1229. return -EMSGSIZE;
  1230. p = nlmsg_data(nlh);
  1231. copy_to_user_policy(xp, p, dir);
  1232. if (copy_to_user_tmpl(xp, skb) < 0)
  1233. goto nlmsg_failure;
  1234. if (copy_to_user_sec_ctx(xp, skb))
  1235. goto nlmsg_failure;
  1236. if (copy_to_user_policy_type(xp->type, skb) < 0)
  1237. goto nlmsg_failure;
  1238. if (xfrm_mark_put(skb, &xp->mark))
  1239. goto nla_put_failure;
  1240. nlmsg_end(skb, nlh);
  1241. return 0;
  1242. nla_put_failure:
  1243. nlmsg_failure:
  1244. nlmsg_cancel(skb, nlh);
  1245. return -EMSGSIZE;
  1246. }
  1247. static int xfrm_dump_policy_done(struct netlink_callback *cb)
  1248. {
  1249. struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
  1250. if (cb->args[0])
  1251. xfrm_policy_walk_done(walk);
  1252. return 0;
  1253. }
  1254. static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
  1255. {
  1256. struct net *net = sock_net(skb->sk);
  1257. struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
  1258. struct xfrm_dump_info info;
  1259. BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
  1260. sizeof(cb->args) - sizeof(cb->args[0]));
  1261. info.in_skb = cb->skb;
  1262. info.out_skb = skb;
  1263. info.nlmsg_seq = cb->nlh->nlmsg_seq;
  1264. info.nlmsg_flags = NLM_F_MULTI;
  1265. if (!cb->args[0]) {
  1266. cb->args[0] = 1;
  1267. xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
  1268. }
  1269. (void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
  1270. return skb->len;
  1271. }
  1272. static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
  1273. struct xfrm_policy *xp,
  1274. int dir, u32 seq)
  1275. {
  1276. struct xfrm_dump_info info;
  1277. struct sk_buff *skb;
  1278. int err;
  1279. skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  1280. if (!skb)
  1281. return ERR_PTR(-ENOMEM);
  1282. info.in_skb = in_skb;
  1283. info.out_skb = skb;
  1284. info.nlmsg_seq = seq;
  1285. info.nlmsg_flags = 0;
  1286. err = dump_one_policy(xp, dir, 0, &info);
  1287. if (err) {
  1288. kfree_skb(skb);
  1289. return ERR_PTR(err);
  1290. }
  1291. return skb;
  1292. }
  1293. static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
  1294. struct nlattr **attrs)
  1295. {
  1296. struct net *net = sock_net(skb->sk);
  1297. struct xfrm_policy *xp;
  1298. struct xfrm_userpolicy_id *p;
  1299. u8 type = XFRM_POLICY_TYPE_MAIN;
  1300. int err;
  1301. struct km_event c;
  1302. int delete;
  1303. struct xfrm_mark m;
  1304. u32 mark = xfrm_mark_get(attrs, &m);
  1305. p = nlmsg_data(nlh);
  1306. delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
  1307. err = copy_from_user_policy_type(&type, attrs);
  1308. if (err)
  1309. return err;
  1310. err = verify_policy_dir(p->dir);
  1311. if (err)
  1312. return err;
  1313. if (p->index)
  1314. xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
  1315. else {
  1316. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  1317. struct xfrm_sec_ctx *ctx;
  1318. err = verify_sec_ctx_len(attrs);
  1319. if (err)
  1320. return err;
  1321. ctx = NULL;
  1322. if (rt) {
  1323. struct xfrm_user_sec_ctx *uctx = nla_data(rt);
  1324. err = security_xfrm_policy_alloc(&ctx, uctx);
  1325. if (err)
  1326. return err;
  1327. }
  1328. xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
  1329. ctx, delete, &err);
  1330. security_xfrm_policy_free(ctx);
  1331. }
  1332. if (xp == NULL)
  1333. return -ENOENT;
  1334. if (!delete) {
  1335. struct sk_buff *resp_skb;
  1336. resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
  1337. if (IS_ERR(resp_skb)) {
  1338. err = PTR_ERR(resp_skb);
  1339. } else {
  1340. err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
  1341. NETLINK_CB(skb).pid);
  1342. }
  1343. } else {
  1344. uid_t loginuid = audit_get_loginuid(current);
  1345. u32 sessionid = audit_get_sessionid(current);
  1346. u32 sid;
  1347. security_task_getsecid(current, &sid);
  1348. xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
  1349. sid);
  1350. if (err != 0)
  1351. goto out;
  1352. c.data.byid = p->index;
  1353. c.event = nlh->nlmsg_type;
  1354. c.seq = nlh->nlmsg_seq;
  1355. c.pid = nlh->nlmsg_pid;
  1356. km_policy_notify(xp, p->dir, &c);
  1357. }
  1358. out:
  1359. xfrm_pol_put(xp);
  1360. return err;
  1361. }
  1362. static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  1363. struct nlattr **attrs)
  1364. {
  1365. struct net *net = sock_net(skb->sk);
  1366. struct km_event c;
  1367. struct xfrm_usersa_flush *p = nlmsg_data(nlh);
  1368. struct xfrm_audit audit_info;
  1369. int err;
  1370. audit_info.loginuid = audit_get_loginuid(current);
  1371. audit_info.sessionid = audit_get_sessionid(current);
  1372. security_task_getsecid(current, &audit_info.secid);
  1373. err = xfrm_state_flush(net, p->proto, &audit_info);
  1374. if (err) {
  1375. if (err == -ESRCH) /* empty table */
  1376. return 0;
  1377. return err;
  1378. }
  1379. c.data.proto = p->proto;
  1380. c.event = nlh->nlmsg_type;
  1381. c.seq = nlh->nlmsg_seq;
  1382. c.pid = nlh->nlmsg_pid;
  1383. c.net = net;
  1384. km_state_notify(NULL, &c);
  1385. return 0;
  1386. }
  1387. static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x)
  1388. {
  1389. size_t replay_size = x->replay_esn ?
  1390. xfrm_replay_state_esn_len(x->replay_esn) :
  1391. sizeof(struct xfrm_replay_state);
  1392. return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
  1393. + nla_total_size(replay_size)
  1394. + nla_total_size(sizeof(struct xfrm_lifetime_cur))
  1395. + nla_total_size(sizeof(struct xfrm_mark))
  1396. + nla_total_size(4) /* XFRM_AE_RTHR */
  1397. + nla_total_size(4); /* XFRM_AE_ETHR */
  1398. }
  1399. static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
  1400. {
  1401. struct xfrm_aevent_id *id;
  1402. struct nlmsghdr *nlh;
  1403. nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
  1404. if (nlh == NULL)
  1405. return -EMSGSIZE;
  1406. id = nlmsg_data(nlh);
  1407. memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
  1408. id->sa_id.spi = x->id.spi;
  1409. id->sa_id.family = x->props.family;
  1410. id->sa_id.proto = x->id.proto;
  1411. memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
  1412. id->reqid = x->props.reqid;
  1413. id->flags = c->data.aevent;
  1414. if (x->replay_esn)
  1415. NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
  1416. xfrm_replay_state_esn_len(x->replay_esn),
  1417. x->replay_esn);
  1418. else
  1419. NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
  1420. NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
  1421. if (id->flags & XFRM_AE_RTHR)
  1422. NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
  1423. if (id->flags & XFRM_AE_ETHR)
  1424. NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
  1425. x->replay_maxage * 10 / HZ);
  1426. if (xfrm_mark_put(skb, &x->mark))
  1427. goto nla_put_failure;
  1428. return nlmsg_end(skb, nlh);
  1429. nla_put_failure:
  1430. nlmsg_cancel(skb, nlh);
  1431. return -EMSGSIZE;
  1432. }
  1433. static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
  1434. struct nlattr **attrs)
  1435. {
  1436. struct net *net = sock_net(skb->sk);
  1437. struct xfrm_state *x;
  1438. struct sk_buff *r_skb;
  1439. int err;
  1440. struct km_event c;
  1441. u32 mark;
  1442. struct xfrm_mark m;
  1443. struct xfrm_aevent_id *p = nlmsg_data(nlh);
  1444. struct xfrm_usersa_id *id = &p->sa_id;
  1445. mark = xfrm_mark_get(attrs, &m);
  1446. x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
  1447. if (x == NULL)
  1448. return -ESRCH;
  1449. r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
  1450. if (r_skb == NULL) {
  1451. xfrm_state_put(x);
  1452. return -ENOMEM;
  1453. }
  1454. /*
  1455. * XXX: is this lock really needed - none of the other
  1456. * gets lock (the concern is things getting updated
  1457. * while we are still reading) - jhs
  1458. */
  1459. spin_lock_bh(&x->lock);
  1460. c.data.aevent = p->flags;
  1461. c.seq = nlh->nlmsg_seq;
  1462. c.pid = nlh->nlmsg_pid;
  1463. if (build_aevent(r_skb, x, &c) < 0)
  1464. BUG();
  1465. err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).pid);
  1466. spin_unlock_bh(&x->lock);
  1467. xfrm_state_put(x);
  1468. return err;
  1469. }
  1470. static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
  1471. struct nlattr **attrs)
  1472. {
  1473. struct net *net = sock_net(skb->sk);
  1474. struct xfrm_state *x;
  1475. struct km_event c;
  1476. int err = - EINVAL;
  1477. u32 mark = 0;
  1478. struct xfrm_mark m;
  1479. struct xfrm_aevent_id *p = nlmsg_data(nlh);
  1480. struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
  1481. struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
  1482. struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
  1483. if (!lt && !rp && !re)
  1484. return err;
  1485. /* pedantic mode - thou shalt sayeth replaceth */
  1486. if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
  1487. return err;
  1488. mark = xfrm_mark_get(attrs, &m);
  1489. x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
  1490. if (x == NULL)
  1491. return -ESRCH;
  1492. if (x->km.state != XFRM_STATE_VALID)
  1493. goto out;
  1494. err = xfrm_replay_verify_len(x->replay_esn, rp);
  1495. if (err)
  1496. goto out;
  1497. spin_lock_bh(&x->lock);
  1498. xfrm_update_ae_params(x, attrs, 1);
  1499. spin_unlock_bh(&x->lock);
  1500. c.event = nlh->nlmsg_type;
  1501. c.seq = nlh->nlmsg_seq;
  1502. c.pid = nlh->nlmsg_pid;
  1503. c.data.aevent = XFRM_AE_CU;
  1504. km_state_notify(x, &c);
  1505. err = 0;
  1506. out:
  1507. xfrm_state_put(x);
  1508. return err;
  1509. }
  1510. static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
  1511. struct nlattr **attrs)
  1512. {
  1513. struct net *net = sock_net(skb->sk);
  1514. struct km_event c;
  1515. u8 type = XFRM_POLICY_TYPE_MAIN;
  1516. int err;
  1517. struct xfrm_audit audit_info;
  1518. err = copy_from_user_policy_type(&type, attrs);
  1519. if (err)
  1520. return err;
  1521. audit_info.loginuid = audit_get_loginuid(current);
  1522. audit_info.sessionid = audit_get_sessionid(current);
  1523. security_task_getsecid(current, &audit_info.secid);
  1524. err = xfrm_policy_flush(net, type, &audit_info);
  1525. if (err) {
  1526. if (err == -ESRCH) /* empty table */
  1527. return 0;
  1528. return err;
  1529. }
  1530. c.data.type = type;
  1531. c.event = nlh->nlmsg_type;
  1532. c.seq = nlh->nlmsg_seq;
  1533. c.pid = nlh->nlmsg_pid;
  1534. c.net = net;
  1535. km_policy_notify(NULL, 0, &c);
  1536. return 0;
  1537. }
  1538. static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
  1539. struct nlattr **attrs)
  1540. {
  1541. struct net *net = sock_net(skb->sk);
  1542. struct xfrm_policy *xp;
  1543. struct xfrm_user_polexpire *up = nlmsg_data(nlh);
  1544. struct xfrm_userpolicy_info *p = &up->pol;
  1545. u8 type = XFRM_POLICY_TYPE_MAIN;
  1546. int err = -ENOENT;
  1547. struct xfrm_mark m;
  1548. u32 mark = xfrm_mark_get(attrs, &m);
  1549. err = copy_from_user_policy_type(&type, attrs);
  1550. if (err)
  1551. return err;
  1552. err = verify_policy_dir(p->dir);
  1553. if (err)
  1554. return err;
  1555. if (p->index)
  1556. xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
  1557. else {
  1558. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  1559. struct xfrm_sec_ctx *ctx;
  1560. err = verify_sec_ctx_len(attrs);
  1561. if (err)
  1562. return err;
  1563. ctx = NULL;
  1564. if (rt) {
  1565. struct xfrm_user_sec_ctx *uctx = nla_data(rt);
  1566. err = security_xfrm_policy_alloc(&ctx, uctx);
  1567. if (err)
  1568. return err;
  1569. }
  1570. xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
  1571. &p->sel, ctx, 0, &err);
  1572. security_xfrm_policy_free(ctx);
  1573. }
  1574. if (xp == NULL)
  1575. return -ENOENT;
  1576. if (unlikely(xp->walk.dead))
  1577. goto out;
  1578. err = 0;
  1579. if (up->hard) {
  1580. uid_t loginuid = audit_get_loginuid(current);
  1581. u32 sessionid = audit_get_sessionid(current);
  1582. u32 sid;
  1583. security_task_getsecid(current, &sid);
  1584. xfrm_policy_delete(xp, p->dir);
  1585. xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
  1586. } else {
  1587. // reset the timers here?
  1588. WARN(1, "Dont know what to do with soft policy expire\n");
  1589. }
  1590. km_policy_expired(xp, p->dir, up->hard, current->pid);
  1591. out:
  1592. xfrm_pol_put(xp);
  1593. return err;
  1594. }
  1595. static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
  1596. struct nlattr **attrs)
  1597. {
  1598. struct net *net = sock_net(skb->sk);
  1599. struct xfrm_state *x;
  1600. int err;
  1601. struct xfrm_user_expire *ue = nlmsg_data(nlh);
  1602. struct xfrm_usersa_info *p = &ue->state;
  1603. struct xfrm_mark m;
  1604. u32 mark = xfrm_mark_get(attrs, &m);
  1605. x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
  1606. err = -ENOENT;
  1607. if (x == NULL)
  1608. return err;
  1609. spin_lock_bh(&x->lock);
  1610. err = -EINVAL;
  1611. if (x->km.state != XFRM_STATE_VALID)
  1612. goto out;
  1613. km_state_expired(x, ue->hard, current->pid);
  1614. if (ue->hard) {
  1615. uid_t loginuid = audit_get_loginuid(current);
  1616. u32 sessionid = audit_get_sessionid(current);
  1617. u32 sid;
  1618. security_task_getsecid(current, &sid);
  1619. __xfrm_state_delete(x);
  1620. xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
  1621. }
  1622. err = 0;
  1623. out:
  1624. spin_unlock_bh(&x->lock);
  1625. xfrm_state_put(x);
  1626. return err;
  1627. }
  1628. static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
  1629. struct nlattr **attrs)
  1630. {
  1631. struct net *net = sock_net(skb->sk);
  1632. struct xfrm_policy *xp;
  1633. struct xfrm_user_tmpl *ut;
  1634. int i;
  1635. struct nlattr *rt = attrs[XFRMA_TMPL];
  1636. struct xfrm_mark mark;
  1637. struct xfrm_user_acquire *ua = nlmsg_data(nlh);
  1638. struct xfrm_state *x = xfrm_state_alloc(net);
  1639. int err = -ENOMEM;
  1640. if (!x)
  1641. goto nomem;
  1642. xfrm_mark_get(attrs, &mark);
  1643. err = verify_newpolicy_info(&ua->policy);
  1644. if (err)
  1645. goto bad_policy;
  1646. /* build an XP */
  1647. xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
  1648. if (!xp)
  1649. goto free_state;
  1650. memcpy(&x->id, &ua->id, sizeof(ua->id));
  1651. memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
  1652. memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
  1653. xp->mark.m = x->mark.m = mark.m;
  1654. xp->mark.v = x->mark.v = mark.v;
  1655. ut = nla_data(rt);
  1656. /* extract the templates and for each call km_key */
  1657. for (i = 0; i < xp->xfrm_nr; i++, ut++) {
  1658. struct xfrm_tmpl *t = &xp->xfrm_vec[i];
  1659. memcpy(&x->id, &t->id, sizeof(x->id));
  1660. x->props.mode = t->mode;
  1661. x->props.reqid = t->reqid;
  1662. x->props.family = ut->family;
  1663. t->aalgos = ua->aalgos;
  1664. t->ealgos = ua->ealgos;
  1665. t->calgos = ua->calgos;
  1666. err = km_query(x, t, xp);
  1667. }
  1668. kfree(x);
  1669. kfree(xp);
  1670. return 0;
  1671. bad_policy:
  1672. WARN(1, "BAD policy passed\n");
  1673. free_state:
  1674. kfree(x);
  1675. nomem:
  1676. return err;
  1677. }
  1678. #ifdef CONFIG_XFRM_MIGRATE
  1679. static int copy_from_user_migrate(struct xfrm_migrate *ma,
  1680. struct xfrm_kmaddress *k,
  1681. struct nlattr **attrs, int *num)
  1682. {
  1683. struct nlattr *rt = attrs[XFRMA_MIGRATE];
  1684. struct xfrm_user_migrate *um;
  1685. int i, num_migrate;
  1686. if (k != NULL) {
  1687. struct xfrm_user_kmaddress *uk;
  1688. uk = nla_data(attrs[XFRMA_KMADDRESS]);
  1689. memcpy(&k->local, &uk->local, sizeof(k->local));
  1690. memcpy(&k->remote, &uk->remote, sizeof(k->remote));
  1691. k->family = uk->family;
  1692. k->reserved = uk->reserved;
  1693. }
  1694. um = nla_data(rt);
  1695. num_migrate = nla_len(rt) / sizeof(*um);
  1696. if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
  1697. return -EINVAL;
  1698. for (i = 0; i < num_migrate; i++, um++, ma++) {
  1699. memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
  1700. memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
  1701. memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
  1702. memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
  1703. ma->proto = um->proto;
  1704. ma->mode = um->mode;
  1705. ma->reqid = um->reqid;
  1706. ma->old_family = um->old_family;
  1707. ma->new_family = um->new_family;
  1708. }
  1709. *num = i;
  1710. return 0;
  1711. }
  1712. static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
  1713. struct nlattr **attrs)
  1714. {
  1715. struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
  1716. struct xfrm_migrate m[XFRM_MAX_DEPTH];
  1717. struct xfrm_kmaddress km, *kmp;
  1718. u8 type;
  1719. int err;
  1720. int n = 0;
  1721. if (attrs[XFRMA_MIGRATE] == NULL)
  1722. return -EINVAL;
  1723. kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;
  1724. err = copy_from_user_policy_type(&type, attrs);
  1725. if (err)
  1726. return err;
  1727. err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
  1728. if (err)
  1729. return err;
  1730. if (!n)
  1731. return 0;
  1732. xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
  1733. return 0;
  1734. }
  1735. #else
  1736. static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
  1737. struct nlattr **attrs)
  1738. {
  1739. return -ENOPROTOOPT;
  1740. }
  1741. #endif
  1742. #ifdef CONFIG_XFRM_MIGRATE
  1743. static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
  1744. {
  1745. struct xfrm_user_migrate um;
  1746. memset(&um, 0, sizeof(um));
  1747. um.proto = m->proto;
  1748. um.mode = m->mode;
  1749. um.reqid = m->reqid;
  1750. um.old_family = m->old_family;
  1751. memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
  1752. memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
  1753. um.new_family = m->new_family;
  1754. memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
  1755. memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
  1756. return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
  1757. }
  1758. static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
  1759. {
  1760. struct xfrm_user_kmaddress uk;
  1761. memset(&uk, 0, sizeof(uk));
  1762. uk.family = k->family;
  1763. uk.reserved = k->reserved;
  1764. memcpy(&uk.local, &k->local, sizeof(uk.local));
  1765. memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
  1766. return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
  1767. }
  1768. static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
  1769. {
  1770. return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
  1771. + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
  1772. + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
  1773. + userpolicy_type_attrsize();
  1774. }
  1775. static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
  1776. int num_migrate, const struct xfrm_kmaddress *k,
  1777. const struct xfrm_selector *sel, u8 dir, u8 type)
  1778. {
  1779. const struct xfrm_migrate *mp;
  1780. struct xfrm_userpolicy_id *pol_id;
  1781. struct nlmsghdr *nlh;
  1782. int i;
  1783. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
  1784. if (nlh == NULL)
  1785. return -EMSGSIZE;
  1786. pol_id = nlmsg_data(nlh);
  1787. /* copy data from selector, dir, and type to the pol_id */
  1788. memset(pol_id, 0, sizeof(*pol_id));
  1789. memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
  1790. pol_id->dir = dir;
  1791. if (k != NULL && (copy_to_user_kmaddress(k, skb) < 0))
  1792. goto nlmsg_failure;
  1793. if (copy_to_user_policy_type(type, skb) < 0)
  1794. goto nlmsg_failure;
  1795. for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
  1796. if (copy_to_user_migrate(mp, skb) < 0)
  1797. goto nlmsg_failure;
  1798. }
  1799. return nlmsg_end(skb, nlh);
  1800. nlmsg_failure:
  1801. nlmsg_cancel(skb, nlh);
  1802. return -EMSGSIZE;
  1803. }
  1804. static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
  1805. const struct xfrm_migrate *m, int num_migrate,
  1806. const struct xfrm_kmaddress *k)
  1807. {
  1808. struct net *net = &init_net;
  1809. struct sk_buff *skb;
  1810. skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
  1811. if (skb == NULL)
  1812. return -ENOMEM;
  1813. /* build migrate */
  1814. if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
  1815. BUG();
  1816. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
  1817. }
  1818. #else
  1819. static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
  1820. const struct xfrm_migrate *m, int num_migrate,
  1821. const struct xfrm_kmaddress *k)
  1822. {
  1823. return -ENOPROTOOPT;
  1824. }
  1825. #endif
  1826. #define XMSGSIZE(type) sizeof(struct type)
  1827. static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
  1828. [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
  1829. [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
  1830. [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
  1831. [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
  1832. [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
  1833. [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
  1834. [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
  1835. [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
  1836. [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
  1837. [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
  1838. [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
  1839. [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
  1840. [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
  1841. [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
  1842. [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
  1843. [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
  1844. [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
  1845. [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
  1846. [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
  1847. [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
  1848. };
  1849. #undef XMSGSIZE
  1850. static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
  1851. [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)},
  1852. [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)},
  1853. [XFRMA_LASTUSED] = { .type = NLA_U64},
  1854. [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)},
  1855. [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) },
  1856. [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
  1857. [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
  1858. [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
  1859. [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
  1860. [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
  1861. [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
  1862. [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
  1863. [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
  1864. [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
  1865. [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
  1866. [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
  1867. [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
  1868. [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
  1869. [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
  1870. [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
  1871. [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
  1872. [XFRMA_TFCPAD] = { .type = NLA_U32 },
  1873. [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
  1874. };
  1875. static struct xfrm_link {
  1876. int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
  1877. int (*dump)(struct sk_buff *, struct netlink_callback *);
  1878. int (*done)(struct netlink_callback *);
  1879. } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
  1880. [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
  1881. [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa },
  1882. [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
  1883. .dump = xfrm_dump_sa,
  1884. .done = xfrm_dump_sa_done },
  1885. [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
  1886. [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
  1887. [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
  1888. .dump = xfrm_dump_policy,
  1889. .done = xfrm_dump_policy_done },
  1890. [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
  1891. [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire },
  1892. [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
  1893. [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
  1894. [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
  1895. [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
  1896. [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa },
  1897. [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy },
  1898. [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae },
  1899. [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae },
  1900. [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate },
  1901. [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo },
  1902. [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo },
  1903. };
  1904. static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  1905. {
  1906. struct net *net = sock_net(skb->sk);
  1907. struct nlattr *attrs[XFRMA_MAX+1];
  1908. struct xfrm_link *link;
  1909. int type, err;
  1910. type = nlh->nlmsg_type;
  1911. if (type > XFRM_MSG_MAX)
  1912. return -EINVAL;
  1913. type -= XFRM_MSG_BASE;
  1914. link = &xfrm_dispatch[type];
  1915. /* All operations require privileges, even GET */
  1916. if (!capable(CAP_NET_ADMIN))
  1917. return -EPERM;
  1918. if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
  1919. type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
  1920. (nlh->nlmsg_flags & NLM_F_DUMP)) {
  1921. if (link->dump == NULL)
  1922. return -EINVAL;
  1923. {
  1924. struct netlink_dump_control c = {
  1925. .dump = link->dump,
  1926. .done = link->done,
  1927. };
  1928. return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
  1929. }
  1930. }
  1931. err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
  1932. xfrma_policy);
  1933. if (err < 0)
  1934. return err;
  1935. if (link->doit == NULL)
  1936. return -EINVAL;
  1937. return link->doit(skb, nlh, attrs);
  1938. }
  1939. static void xfrm_netlink_rcv(struct sk_buff *skb)
  1940. {
  1941. mutex_lock(&xfrm_cfg_mutex);
  1942. netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
  1943. mutex_unlock(&xfrm_cfg_mutex);
  1944. }
  1945. static inline size_t xfrm_expire_msgsize(void)
  1946. {
  1947. return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
  1948. + nla_total_size(sizeof(struct xfrm_mark));
  1949. }
  1950. static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
  1951. {
  1952. struct xfrm_user_expire *ue;
  1953. struct nlmsghdr *nlh;
  1954. nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
  1955. if (nlh == NULL)
  1956. return -EMSGSIZE;
  1957. ue = nlmsg_data(nlh);
  1958. copy_to_user_state(x, &ue->state);
  1959. ue->hard = (c->data.hard != 0) ? 1 : 0;
  1960. if (xfrm_mark_put(skb, &x->mark))
  1961. goto nla_put_failure;
  1962. return nlmsg_end(skb, nlh);
  1963. nla_put_failure:
  1964. return -EMSGSIZE;
  1965. }
  1966. static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
  1967. {
  1968. struct net *net = xs_net(x);
  1969. struct sk_buff *skb;
  1970. skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
  1971. if (skb == NULL)
  1972. return -ENOMEM;
  1973. if (build_expire(skb, x, c) < 0) {
  1974. kfree_skb(skb);
  1975. return -EMSGSIZE;
  1976. }
  1977. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
  1978. }
  1979. static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
  1980. {
  1981. struct net *net = xs_net(x);
  1982. struct sk_buff *skb;
  1983. skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
  1984. if (skb == NULL)
  1985. return -ENOMEM;
  1986. if (build_aevent(skb, x, c) < 0)
  1987. BUG();
  1988. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
  1989. }
  1990. static int xfrm_notify_sa_flush(const struct km_event *c)
  1991. {
  1992. struct net *net = c->net;
  1993. struct xfrm_usersa_flush *p;
  1994. struct nlmsghdr *nlh;
  1995. struct sk_buff *skb;
  1996. int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
  1997. skb = nlmsg_new(len, GFP_ATOMIC);
  1998. if (skb == NULL)
  1999. return -ENOMEM;
  2000. nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
  2001. if (nlh == NULL) {
  2002. kfree_skb(skb);
  2003. return -EMSGSIZE;
  2004. }
  2005. p = nlmsg_data(nlh);
  2006. p->proto = c->data.proto;
  2007. nlmsg_end(skb, nlh);
  2008. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
  2009. }
  2010. static inline size_t xfrm_sa_len(struct xfrm_state *x)
  2011. {
  2012. size_t l = 0;
  2013. if (x->aead)
  2014. l += nla_total_size(aead_len(x->aead));
  2015. if (x->aalg) {
  2016. l += nla_total_size(sizeof(struct xfrm_algo) +
  2017. (x->aalg->alg_key_len + 7) / 8);
  2018. l += nla_total_size(xfrm_alg_auth_len(x->aalg));
  2019. }
  2020. if (x->ealg)
  2021. l += nla_total_size(xfrm_alg_len(x->ealg));
  2022. if (x->calg)
  2023. l += nla_total_size(sizeof(*x->calg));
  2024. if (x->encap)
  2025. l += nla_total_size(sizeof(*x->encap));
  2026. if (x->tfcpad)
  2027. l += nla_total_size(sizeof(x->tfcpad));
  2028. if (x->replay_esn)
  2029. l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
  2030. if (x->security)
  2031. l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
  2032. x->security->ctx_len);
  2033. if (x->coaddr)
  2034. l += nla_total_size(sizeof(*x->coaddr));
  2035. /* Must count x->lastused as it may become non-zero behind our back. */
  2036. l += nla_total_size(sizeof(u64));
  2037. return l;
  2038. }
  2039. static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
  2040. {
  2041. struct net *net = xs_net(x);
  2042. struct xfrm_usersa_info *p;
  2043. struct xfrm_usersa_id *id;
  2044. struct nlmsghdr *nlh;
  2045. struct sk_buff *skb;
  2046. int len = xfrm_sa_len(x);
  2047. int headlen;
  2048. headlen = sizeof(*p);
  2049. if (c->event == XFRM_MSG_DELSA) {
  2050. len += nla_total_size(headlen);
  2051. headlen = sizeof(*id);
  2052. len += nla_total_size(sizeof(struct xfrm_mark));
  2053. }
  2054. len += NLMSG_ALIGN(headlen);
  2055. skb = nlmsg_new(len, GFP_ATOMIC);
  2056. if (skb == NULL)
  2057. return -ENOMEM;
  2058. nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
  2059. if (nlh == NULL)
  2060. goto nla_put_failure;
  2061. p = nlmsg_data(nlh);
  2062. if (c->event == XFRM_MSG_DELSA) {
  2063. struct nlattr *attr;
  2064. id = nlmsg_data(nlh);
  2065. memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
  2066. id->spi = x->id.spi;
  2067. id->family = x->props.family;
  2068. id->proto = x->id.proto;
  2069. attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
  2070. if (attr == NULL)
  2071. goto nla_put_failure;
  2072. p = nla_data(attr);
  2073. }
  2074. if (copy_to_user_state_extra(x, p, skb))
  2075. goto nla_put_failure;
  2076. nlmsg_end(skb, nlh);
  2077. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
  2078. nla_put_failure:
  2079. /* Somebody screwed up with xfrm_sa_len! */
  2080. WARN_ON(1);
  2081. kfree_skb(skb);
  2082. return -1;
  2083. }
  2084. static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
  2085. {
  2086. switch (c->event) {
  2087. case XFRM_MSG_EXPIRE:
  2088. return xfrm_exp_state_notify(x, c);
  2089. case XFRM_MSG_NEWAE:
  2090. return xfrm_aevent_state_notify(x, c);
  2091. case XFRM_MSG_DELSA:
  2092. case XFRM_MSG_UPDSA:
  2093. case XFRM_MSG_NEWSA:
  2094. return xfrm_notify_sa(x, c);
  2095. case XFRM_MSG_FLUSHSA:
  2096. return xfrm_notify_sa_flush(c);
  2097. default:
  2098. printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
  2099. c->event);
  2100. break;
  2101. }
  2102. return 0;
  2103. }
  2104. static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
  2105. struct xfrm_policy *xp)
  2106. {
  2107. return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
  2108. + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
  2109. + nla_total_size(sizeof(struct xfrm_mark))
  2110. + nla_total_size(xfrm_user_sec_ctx_size(x->security))
  2111. + userpolicy_type_attrsize();
  2112. }
  2113. static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
  2114. struct xfrm_tmpl *xt, struct xfrm_policy *xp,
  2115. int dir)
  2116. {
  2117. struct xfrm_user_acquire *ua;
  2118. struct nlmsghdr *nlh;
  2119. __u32 seq = xfrm_get_acqseq();
  2120. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
  2121. if (nlh == NULL)
  2122. return -EMSGSIZE;
  2123. ua = nlmsg_data(nlh);
  2124. memcpy(&ua->id, &x->id, sizeof(ua->id));
  2125. memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
  2126. memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
  2127. copy_to_user_policy(xp, &ua->policy, dir);
  2128. ua->aalgos = xt->aalgos;
  2129. ua->ealgos = xt->ealgos;
  2130. ua->calgos = xt->calgos;
  2131. ua->seq = x->km.seq = seq;
  2132. if (copy_to_user_tmpl(xp, skb) < 0)
  2133. goto nlmsg_failure;
  2134. if (copy_to_user_state_sec_ctx(x, skb))
  2135. goto nlmsg_failure;
  2136. if (copy_to_user_policy_type(xp->type, skb) < 0)
  2137. goto nlmsg_failure;
  2138. if (xfrm_mark_put(skb, &xp->mark))
  2139. goto nla_put_failure;
  2140. return nlmsg_end(skb, nlh);
  2141. nla_put_failure:
  2142. nlmsg_failure:
  2143. nlmsg_cancel(skb, nlh);
  2144. return -EMSGSIZE;
  2145. }
  2146. static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
  2147. struct xfrm_policy *xp, int dir)
  2148. {
  2149. struct net *net = xs_net(x);
  2150. struct sk_buff *skb;
  2151. skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
  2152. if (skb == NULL)
  2153. return -ENOMEM;
  2154. if (build_acquire(skb, x, xt, xp, dir) < 0)
  2155. BUG();
  2156. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
  2157. }
  2158. /* User gives us xfrm_user_policy_info followed by an array of 0
  2159. * or more templates.
  2160. */
  2161. static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
  2162. u8 *data, int len, int *dir)
  2163. {
  2164. struct net *net = sock_net(sk);
  2165. struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
  2166. struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
  2167. struct xfrm_policy *xp;
  2168. int nr;
  2169. switch (sk->sk_family) {
  2170. case AF_INET:
  2171. if (opt != IP_XFRM_POLICY) {
  2172. *dir = -EOPNOTSUPP;
  2173. return NULL;
  2174. }
  2175. break;
  2176. #if IS_ENABLED(CONFIG_IPV6)
  2177. case AF_INET6:
  2178. if (opt != IPV6_XFRM_POLICY) {
  2179. *dir = -EOPNOTSUPP;
  2180. return NULL;
  2181. }
  2182. break;
  2183. #endif
  2184. default:
  2185. *dir = -EINVAL;
  2186. return NULL;
  2187. }
  2188. *dir = -EINVAL;
  2189. if (len < sizeof(*p) ||
  2190. verify_newpolicy_info(p))
  2191. return NULL;
  2192. nr = ((len - sizeof(*p)) / sizeof(*ut));
  2193. if (validate_tmpl(nr, ut, p->sel.family))
  2194. return NULL;
  2195. if (p->dir > XFRM_POLICY_OUT)
  2196. return NULL;
  2197. xp = xfrm_policy_alloc(net, GFP_ATOMIC);
  2198. if (xp == NULL) {
  2199. *dir = -ENOBUFS;
  2200. return NULL;
  2201. }
  2202. copy_from_user_policy(xp, p);
  2203. xp->type = XFRM_POLICY_TYPE_MAIN;
  2204. copy_templates(xp, ut, nr);
  2205. *dir = p->dir;
  2206. return xp;
  2207. }
  2208. static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
  2209. {
  2210. return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
  2211. + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
  2212. + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
  2213. + nla_total_size(sizeof(struct xfrm_mark))
  2214. + userpolicy_type_attrsize();
  2215. }
  2216. static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
  2217. int dir, const struct km_event *c)
  2218. {
  2219. struct xfrm_user_polexpire *upe;
  2220. struct nlmsghdr *nlh;
  2221. int hard = c->data.hard;
  2222. nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
  2223. if (nlh == NULL)
  2224. return -EMSGSIZE;
  2225. upe = nlmsg_data(nlh);
  2226. copy_to_user_policy(xp, &upe->pol, dir);
  2227. if (copy_to_user_tmpl(xp, skb) < 0)
  2228. goto nlmsg_failure;
  2229. if (copy_to_user_sec_ctx(xp, skb))
  2230. goto nlmsg_failure;
  2231. if (copy_to_user_policy_type(xp->type, skb) < 0)
  2232. goto nlmsg_failure;
  2233. if (xfrm_mark_put(skb, &xp->mark))
  2234. goto nla_put_failure;
  2235. upe->hard = !!hard;
  2236. return nlmsg_end(skb, nlh);
  2237. nla_put_failure:
  2238. nlmsg_failure:
  2239. nlmsg_cancel(skb, nlh);
  2240. return -EMSGSIZE;
  2241. }
  2242. static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
  2243. {
  2244. struct net *net = xp_net(xp);
  2245. struct sk_buff *skb;
  2246. skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
  2247. if (skb == NULL)
  2248. return -ENOMEM;
  2249. if (build_polexpire(skb, xp, dir, c) < 0)
  2250. BUG();
  2251. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
  2252. }
  2253. static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
  2254. {
  2255. struct net *net = xp_net(xp);
  2256. struct xfrm_userpolicy_info *p;
  2257. struct xfrm_userpolicy_id *id;
  2258. struct nlmsghdr *nlh;
  2259. struct sk_buff *skb;
  2260. int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
  2261. int headlen;
  2262. headlen = sizeof(*p);
  2263. if (c->event == XFRM_MSG_DELPOLICY) {
  2264. len += nla_total_size(headlen);
  2265. headlen = sizeof(*id);
  2266. }
  2267. len += userpolicy_type_attrsize();
  2268. len += nla_total_size(sizeof(struct xfrm_mark));
  2269. len += NLMSG_ALIGN(headlen);
  2270. skb = nlmsg_new(len, GFP_ATOMIC);
  2271. if (skb == NULL)
  2272. return -ENOMEM;
  2273. nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
  2274. if (nlh == NULL)
  2275. goto nlmsg_failure;
  2276. p = nlmsg_data(nlh);
  2277. if (c->event == XFRM_MSG_DELPOLICY) {
  2278. struct nlattr *attr;
  2279. id = nlmsg_data(nlh);
  2280. memset(id, 0, sizeof(*id));
  2281. id->dir = dir;
  2282. if (c->data.byid)
  2283. id->index = xp->index;
  2284. else
  2285. memcpy(&id->sel, &xp->selector, sizeof(id->sel));
  2286. attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
  2287. if (attr == NULL)
  2288. goto nlmsg_failure;
  2289. p = nla_data(attr);
  2290. }
  2291. copy_to_user_policy(xp, p, dir);
  2292. if (copy_to_user_tmpl(xp, skb) < 0)
  2293. goto nlmsg_failure;
  2294. if (copy_to_user_policy_type(xp->type, skb) < 0)
  2295. goto nlmsg_failure;
  2296. if (xfrm_mark_put(skb, &xp->mark))
  2297. goto nla_put_failure;
  2298. nlmsg_end(skb, nlh);
  2299. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
  2300. nla_put_failure:
  2301. nlmsg_failure:
  2302. kfree_skb(skb);
  2303. return -1;
  2304. }
  2305. static int xfrm_notify_policy_flush(const struct km_event *c)
  2306. {
  2307. struct net *net = c->net;
  2308. struct nlmsghdr *nlh;
  2309. struct sk_buff *skb;
  2310. skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
  2311. if (skb == NULL)
  2312. return -ENOMEM;
  2313. nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
  2314. if (nlh == NULL)
  2315. goto nlmsg_failure;
  2316. if (copy_to_user_policy_type(c->data.type, skb) < 0)
  2317. goto nlmsg_failure;
  2318. nlmsg_end(skb, nlh);
  2319. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
  2320. nlmsg_failure:
  2321. kfree_skb(skb);
  2322. return -1;
  2323. }
  2324. static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
  2325. {
  2326. switch (c->event) {
  2327. case XFRM_MSG_NEWPOLICY:
  2328. case XFRM_MSG_UPDPOLICY:
  2329. case XFRM_MSG_DELPOLICY:
  2330. return xfrm_notify_policy(xp, dir, c);
  2331. case XFRM_MSG_FLUSHPOLICY:
  2332. return xfrm_notify_policy_flush(c);
  2333. case XFRM_MSG_POLEXPIRE:
  2334. return xfrm_exp_policy_notify(xp, dir, c);
  2335. default:
  2336. printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
  2337. c->event);
  2338. }
  2339. return 0;
  2340. }
  2341. static inline size_t xfrm_report_msgsize(void)
  2342. {
  2343. return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
  2344. }
  2345. static int build_report(struct sk_buff *skb, u8 proto,
  2346. struct xfrm_selector *sel, xfrm_address_t *addr)
  2347. {
  2348. struct xfrm_user_report *ur;
  2349. struct nlmsghdr *nlh;
  2350. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
  2351. if (nlh == NULL)
  2352. return -EMSGSIZE;
  2353. ur = nlmsg_data(nlh);
  2354. ur->proto = proto;
  2355. memcpy(&ur->sel, sel, sizeof(ur->sel));
  2356. if (addr)
  2357. NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
  2358. return nlmsg_end(skb, nlh);
  2359. nla_put_failure:
  2360. nlmsg_cancel(skb, nlh);
  2361. return -EMSGSIZE;
  2362. }
  2363. static int xfrm_send_report(struct net *net, u8 proto,
  2364. struct xfrm_selector *sel, xfrm_address_t *addr)
  2365. {
  2366. struct sk_buff *skb;
  2367. skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
  2368. if (skb == NULL)
  2369. return -ENOMEM;
  2370. if (build_report(skb, proto, sel, addr) < 0)
  2371. BUG();
  2372. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
  2373. }
  2374. static inline size_t xfrm_mapping_msgsize(void)
  2375. {
  2376. return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
  2377. }
  2378. static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
  2379. xfrm_address_t *new_saddr, __be16 new_sport)
  2380. {
  2381. struct xfrm_user_mapping *um;
  2382. struct nlmsghdr *nlh;
  2383. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
  2384. if (nlh == NULL)
  2385. return -EMSGSIZE;
  2386. um = nlmsg_data(nlh);
  2387. memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
  2388. um->id.spi = x->id.spi;
  2389. um->id.family = x->props.family;
  2390. um->id.proto = x->id.proto;
  2391. memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
  2392. memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
  2393. um->new_sport = new_sport;
  2394. um->old_sport = x->encap->encap_sport;
  2395. um->reqid = x->props.reqid;
  2396. return nlmsg_end(skb, nlh);
  2397. }
  2398. static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
  2399. __be16 sport)
  2400. {
  2401. struct net *net = xs_net(x);
  2402. struct sk_buff *skb;
  2403. if (x->id.proto != IPPROTO_ESP)
  2404. return -EINVAL;
  2405. if (!x->encap)
  2406. return -EINVAL;
  2407. skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
  2408. if (skb == NULL)
  2409. return -ENOMEM;
  2410. if (build_mapping(skb, x, ipaddr, sport) < 0)
  2411. BUG();
  2412. return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
  2413. }
  2414. static struct xfrm_mgr netlink_mgr = {
  2415. .id = "netlink",
  2416. .notify = xfrm_send_state_notify,
  2417. .acquire = xfrm_send_acquire,
  2418. .compile_policy = xfrm_compile_policy,
  2419. .notify_policy = xfrm_send_policy_notify,
  2420. .report = xfrm_send_report,
  2421. .migrate = xfrm_send_migrate,
  2422. .new_mapping = xfrm_send_mapping,
  2423. };
  2424. static int __net_init xfrm_user_net_init(struct net *net)
  2425. {
  2426. struct sock *nlsk;
  2427. nlsk = netlink_kernel_create(net, NETLINK_XFRM, XFRMNLGRP_MAX,
  2428. xfrm_netlink_rcv, NULL, THIS_MODULE);
  2429. if (nlsk == NULL)
  2430. return -ENOMEM;
  2431. net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
  2432. rcu_assign_pointer(net->xfrm.nlsk, nlsk);
  2433. return 0;
  2434. }
  2435. static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
  2436. {
  2437. struct net *net;
  2438. list_for_each_entry(net, net_exit_list, exit_list)
  2439. RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
  2440. synchronize_net();
  2441. list_for_each_entry(net, net_exit_list, exit_list)
  2442. netlink_kernel_release(net->xfrm.nlsk_stash);
  2443. }
  2444. static struct pernet_operations xfrm_user_net_ops = {
  2445. .init = xfrm_user_net_init,
  2446. .exit_batch = xfrm_user_net_exit,
  2447. };
  2448. static int __init xfrm_user_init(void)
  2449. {
  2450. int rv;
  2451. printk(KERN_INFO "Initializing XFRM netlink socket\n");
  2452. rv = register_pernet_subsys(&xfrm_user_net_ops);
  2453. if (rv < 0)
  2454. return rv;
  2455. rv = xfrm_register_km(&netlink_mgr);
  2456. if (rv < 0)
  2457. unregister_pernet_subsys(&xfrm_user_net_ops);
  2458. return rv;
  2459. }
  2460. static void __exit xfrm_user_exit(void)
  2461. {
  2462. xfrm_unregister_km(&netlink_mgr);
  2463. unregister_pernet_subsys(&xfrm_user_net_ops);
  2464. }
  2465. module_init(xfrm_user_init);
  2466. module_exit(xfrm_user_exit);
  2467. MODULE_LICENSE("GPL");
  2468. MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);