1 // SPDX-License-Identifier: GPL-2.0-only 2 /* xfrm_user.c: User interface to configure xfrm engine. 3 * 4 * Copyright (C) 2002 David S. Miller (davem@redhat.com) 5 * 6 * Changes: 7 * Mitsuru KANDA @USAGI 8 * Kazunori MIYAZAWA @USAGI 9 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 10 * IPv6 support 11 * 12 */ 13 14 #include <linux/compat.h> 15 #include <linux/crypto.h> 16 #include <linux/module.h> 17 #include <linux/kernel.h> 18 #include <linux/types.h> 19 #include <linux/slab.h> 20 #include <linux/socket.h> 21 #include <linux/string.h> 22 #include <linux/net.h> 23 #include <linux/skbuff.h> 24 #include <linux/pfkeyv2.h> 25 #include <linux/ipsec.h> 26 #include <linux/init.h> 27 #include <linux/security.h> 28 #include <net/sock.h> 29 #include <net/xfrm.h> 30 #include <net/netlink.h> 31 #include <net/ah.h> 32 #include <linux/uaccess.h> 33 #if IS_ENABLED(CONFIG_IPV6) 34 #include <linux/in6.h> 35 #endif 36 #include <linux/unaligned.h> 37 38 static struct sock *xfrm_net_nlsk(const struct net *net, const struct sk_buff *skb) 39 { 40 /* get the source of this request, see netlink_unicast_kernel */ 41 const struct sock *sk = NETLINK_CB(skb).sk; 42 43 /* sk is refcounted, the netns stays alive and nlsk with it */ 44 return rcu_dereference_protected(net->xfrm.nlsk, sk->sk_net_refcnt); 45 } 46 47 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type, 48 struct netlink_ext_ack *extack) 49 { 50 struct nlattr *rt = attrs[type]; 51 struct xfrm_algo *algp; 52 53 if (!rt) 54 return 0; 55 56 algp = nla_data(rt); 57 if (nla_len(rt) < (int)xfrm_alg_len(algp)) { 58 NL_SET_ERR_MSG(extack, "Invalid AUTH/CRYPT/COMP attribute length"); 59 return -EINVAL; 60 } 61 62 switch (type) { 63 case XFRMA_ALG_AUTH: 64 case XFRMA_ALG_CRYPT: 65 case XFRMA_ALG_COMP: 66 break; 67 68 default: 69 NL_SET_ERR_MSG(extack, "Invalid algorithm attribute type"); 70 return -EINVAL; 71 } 72 73 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 74 return 0; 75 } 76 77 static int verify_auth_trunc(struct nlattr **attrs, 78 struct netlink_ext_ack *extack) 79 { 80 struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC]; 81 struct xfrm_algo_auth *algp; 82 83 if (!rt) 84 return 0; 85 86 algp = nla_data(rt); 87 if (nla_len(rt) < (int)xfrm_alg_auth_len(algp)) { 88 NL_SET_ERR_MSG(extack, "Invalid AUTH_TRUNC attribute length"); 89 return -EINVAL; 90 } 91 92 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 93 return 0; 94 } 95 96 static int verify_aead(struct nlattr **attrs, struct netlink_ext_ack *extack) 97 { 98 struct nlattr *rt = attrs[XFRMA_ALG_AEAD]; 99 struct xfrm_algo_aead *algp; 100 101 if (!rt) 102 return 0; 103 104 algp = nla_data(rt); 105 if (nla_len(rt) < (int)aead_len(algp)) { 106 NL_SET_ERR_MSG(extack, "Invalid AEAD attribute length"); 107 return -EINVAL; 108 } 109 110 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 111 return 0; 112 } 113 114 static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type, 115 xfrm_address_t **addrp) 116 { 117 struct nlattr *rt = attrs[type]; 118 119 if (rt && addrp) 120 *addrp = nla_data(rt); 121 } 122 123 static inline int verify_sec_ctx_len(struct nlattr **attrs, struct netlink_ext_ack *extack) 124 { 125 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 126 struct xfrm_user_sec_ctx *uctx; 127 128 if (!rt) 129 return 0; 130 131 uctx = nla_data(rt); 132 if (uctx->len > nla_len(rt) || 133 uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) { 134 NL_SET_ERR_MSG(extack, "Invalid security context length"); 135 return -EINVAL; 136 } 137 138 return 0; 139 } 140 141 static inline int verify_replay(struct xfrm_usersa_info *p, 142 struct nlattr **attrs, u8 sa_dir, 143 struct netlink_ext_ack *extack) 144 { 145 struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; 146 struct xfrm_replay_state_esn *rs; 147 148 if (!rt) { 149 if (p->flags & XFRM_STATE_ESN) { 150 NL_SET_ERR_MSG(extack, "Missing required attribute for ESN"); 151 return -EINVAL; 152 } 153 return 0; 154 } 155 156 rs = nla_data(rt); 157 158 if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) { 159 NL_SET_ERR_MSG(extack, "ESN bitmap length must be <= 128"); 160 return -EINVAL; 161 } 162 163 if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) && 164 nla_len(rt) != sizeof(*rs)) { 165 NL_SET_ERR_MSG(extack, "ESN attribute is too short to fit the full bitmap length"); 166 return -EINVAL; 167 } 168 169 /* As only ESP and AH support ESN feature. */ 170 if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) { 171 NL_SET_ERR_MSG(extack, "ESN only supported for ESP and AH"); 172 return -EINVAL; 173 } 174 175 if (p->replay_window != 0) { 176 NL_SET_ERR_MSG(extack, "ESN not compatible with legacy replay_window"); 177 return -EINVAL; 178 } 179 180 if (sa_dir == XFRM_SA_DIR_OUT) { 181 if (rs->replay_window) { 182 NL_SET_ERR_MSG(extack, "Replay window should be 0 for output SA"); 183 return -EINVAL; 184 } 185 if (rs->seq || rs->seq_hi) { 186 NL_SET_ERR_MSG(extack, 187 "Replay seq and seq_hi should be 0 for output SA"); 188 return -EINVAL; 189 } 190 191 if (!(p->flags & XFRM_STATE_ESN)) { 192 if (rs->oseq_hi) { 193 NL_SET_ERR_MSG( 194 extack, 195 "Replay oseq_hi should be 0 in non-ESN mode for output SA"); 196 return -EINVAL; 197 } 198 if (rs->oseq == U32_MAX) { 199 NL_SET_ERR_MSG( 200 extack, 201 "Replay oseq should be less than 0xFFFFFFFF in non-ESN mode for output SA"); 202 return -EINVAL; 203 } 204 } else { 205 if (rs->oseq == U32_MAX && rs->oseq_hi == U32_MAX) { 206 NL_SET_ERR_MSG( 207 extack, 208 "Replay oseq and oseq_hi should be less than 0xFFFFFFFF for output SA"); 209 return -EINVAL; 210 } 211 } 212 if (rs->bmp_len) { 213 NL_SET_ERR_MSG(extack, "Replay bmp_len should 0 for output SA"); 214 return -EINVAL; 215 } 216 } 217 218 if (sa_dir == XFRM_SA_DIR_IN) { 219 if (rs->oseq || rs->oseq_hi) { 220 NL_SET_ERR_MSG(extack, 221 "Replay oseq and oseq_hi should be 0 for input SA"); 222 return -EINVAL; 223 } 224 if (!(p->flags & XFRM_STATE_ESN)) { 225 if (rs->seq_hi) { 226 NL_SET_ERR_MSG( 227 extack, 228 "Replay seq_hi should be 0 in non-ESN mode for input SA"); 229 return -EINVAL; 230 } 231 232 if (rs->seq == U32_MAX) { 233 NL_SET_ERR_MSG( 234 extack, 235 "Replay seq should be less than 0xFFFFFFFF in non-ESN mode for input SA"); 236 return -EINVAL; 237 } 238 } else { 239 if (rs->seq == U32_MAX && rs->seq_hi == U32_MAX) { 240 NL_SET_ERR_MSG( 241 extack, 242 "Replay seq and seq_hi should be less than 0xFFFFFFFF for input SA"); 243 return -EINVAL; 244 } 245 } 246 } 247 248 return 0; 249 } 250 251 static int verify_mtimer_thresh(bool has_encap, u8 dir, 252 struct netlink_ext_ack *extack) 253 { 254 if (!has_encap) { 255 NL_SET_ERR_MSG(extack, 256 "MTIMER_THRESH requires encapsulation"); 257 return -EINVAL; 258 } 259 if (dir == XFRM_SA_DIR_OUT) { 260 NL_SET_ERR_MSG(extack, 261 "MTIMER_THRESH should not be set on output SA"); 262 return -EINVAL; 263 } 264 return 0; 265 } 266 267 static int verify_xfrm_family(u16 family, struct netlink_ext_ack *extack) 268 { 269 switch (family) { 270 case AF_INET: 271 return 0; 272 case AF_INET6: 273 #if IS_ENABLED(CONFIG_IPV6) 274 return 0; 275 #else 276 NL_SET_ERR_MSG(extack, "IPv6 support disabled"); 277 return -EAFNOSUPPORT; 278 #endif 279 default: 280 NL_SET_ERR_MSG(extack, "Invalid address family"); 281 return -EINVAL; 282 } 283 } 284 285 static int verify_selector_prefixlen(u16 family, 286 const struct xfrm_selector *sel, 287 struct netlink_ext_ack *extack) 288 { 289 switch (family) { 290 case AF_UNSPEC: 291 return 0; 292 case AF_INET: 293 if (sel->prefixlen_d > 32 || sel->prefixlen_s > 32) { 294 NL_SET_ERR_MSG(extack, 295 "Invalid prefix length in selector (must be <= 32 for IPv4)"); 296 return -EINVAL; 297 } 298 return 0; 299 case AF_INET6: 300 #if IS_ENABLED(CONFIG_IPV6) 301 if (sel->prefixlen_d > 128 || sel->prefixlen_s > 128) { 302 NL_SET_ERR_MSG(extack, 303 "Invalid prefix length in selector (must be <= 128 for IPv6)"); 304 return -EINVAL; 305 } 306 return 0; 307 #else 308 NL_SET_ERR_MSG(extack, "IPv6 support disabled"); 309 return -EAFNOSUPPORT; 310 #endif 311 default: 312 NL_SET_ERR_MSG(extack, "Invalid address family in selector"); 313 return -EINVAL; 314 } 315 } 316 317 static int verify_newsa_info(struct xfrm_usersa_info *p, 318 struct nlattr **attrs, 319 struct netlink_ext_ack *extack) 320 { 321 int err; 322 u8 sa_dir = nla_get_u8_default(attrs[XFRMA_SA_DIR], 0); 323 u16 family = p->sel.family; 324 325 err = verify_xfrm_family(p->family, extack); 326 if (err) 327 goto out; 328 329 if (!family && !(p->flags & XFRM_STATE_AF_UNSPEC)) 330 family = p->family; 331 332 err = verify_selector_prefixlen(family, &p->sel, extack); 333 if (err) 334 goto out; 335 336 err = -EINVAL; 337 switch (p->id.proto) { 338 case IPPROTO_AH: 339 if (!attrs[XFRMA_ALG_AUTH] && 340 !attrs[XFRMA_ALG_AUTH_TRUNC]) { 341 NL_SET_ERR_MSG(extack, "Missing required attribute for AH: AUTH_TRUNC or AUTH"); 342 goto out; 343 } 344 345 if (attrs[XFRMA_ALG_AEAD] || 346 attrs[XFRMA_ALG_CRYPT] || 347 attrs[XFRMA_ALG_COMP] || 348 attrs[XFRMA_TFCPAD]) { 349 NL_SET_ERR_MSG(extack, "Invalid attributes for AH: AEAD, CRYPT, COMP, TFCPAD"); 350 goto out; 351 } 352 break; 353 354 case IPPROTO_ESP: 355 if (attrs[XFRMA_ALG_COMP]) { 356 NL_SET_ERR_MSG(extack, "Invalid attribute for ESP: COMP"); 357 goto out; 358 } 359 360 if (!attrs[XFRMA_ALG_AUTH] && 361 !attrs[XFRMA_ALG_AUTH_TRUNC] && 362 !attrs[XFRMA_ALG_CRYPT] && 363 !attrs[XFRMA_ALG_AEAD]) { 364 NL_SET_ERR_MSG(extack, "Missing required attribute for ESP: at least one of AUTH, AUTH_TRUNC, CRYPT, AEAD"); 365 goto out; 366 } 367 368 if ((attrs[XFRMA_ALG_AUTH] || 369 attrs[XFRMA_ALG_AUTH_TRUNC] || 370 attrs[XFRMA_ALG_CRYPT]) && 371 attrs[XFRMA_ALG_AEAD]) { 372 NL_SET_ERR_MSG(extack, "Invalid attribute combination for ESP: AEAD can't be used with AUTH, AUTH_TRUNC, CRYPT"); 373 goto out; 374 } 375 376 if (attrs[XFRMA_TFCPAD] && 377 p->mode != XFRM_MODE_TUNNEL) { 378 NL_SET_ERR_MSG(extack, "TFC padding can only be used in tunnel mode"); 379 goto out; 380 } 381 if ((attrs[XFRMA_IPTFS_DROP_TIME] || 382 attrs[XFRMA_IPTFS_REORDER_WINDOW] || 383 attrs[XFRMA_IPTFS_DONT_FRAG] || 384 attrs[XFRMA_IPTFS_INIT_DELAY] || 385 attrs[XFRMA_IPTFS_MAX_QSIZE] || 386 attrs[XFRMA_IPTFS_PKT_SIZE]) && 387 p->mode != XFRM_MODE_IPTFS) { 388 NL_SET_ERR_MSG(extack, "IP-TFS options can only be used in IP-TFS mode"); 389 goto out; 390 } 391 break; 392 393 case IPPROTO_COMP: 394 if (!attrs[XFRMA_ALG_COMP]) { 395 NL_SET_ERR_MSG(extack, "Missing required attribute for COMP: COMP"); 396 goto out; 397 } 398 399 if (attrs[XFRMA_ALG_AEAD] || 400 attrs[XFRMA_ALG_AUTH] || 401 attrs[XFRMA_ALG_AUTH_TRUNC] || 402 attrs[XFRMA_ALG_CRYPT] || 403 attrs[XFRMA_TFCPAD]) { 404 NL_SET_ERR_MSG(extack, "Invalid attributes for COMP: AEAD, AUTH, AUTH_TRUNC, CRYPT, TFCPAD"); 405 goto out; 406 } 407 408 if (ntohl(p->id.spi) >= 0x10000) { 409 NL_SET_ERR_MSG(extack, "SPI is too large for COMP (must be < 0x10000)"); 410 goto out; 411 } 412 break; 413 414 #if IS_ENABLED(CONFIG_IPV6) 415 case IPPROTO_DSTOPTS: 416 case IPPROTO_ROUTING: 417 if (attrs[XFRMA_ALG_COMP] || 418 attrs[XFRMA_ALG_AUTH] || 419 attrs[XFRMA_ALG_AUTH_TRUNC] || 420 attrs[XFRMA_ALG_AEAD] || 421 attrs[XFRMA_ALG_CRYPT] || 422 attrs[XFRMA_ENCAP] || 423 attrs[XFRMA_SEC_CTX] || 424 attrs[XFRMA_TFCPAD]) { 425 NL_SET_ERR_MSG(extack, "Invalid attributes for DSTOPTS/ROUTING"); 426 goto out; 427 } 428 429 if (!attrs[XFRMA_COADDR]) { 430 NL_SET_ERR_MSG(extack, "Missing required COADDR attribute for DSTOPTS/ROUTING"); 431 goto out; 432 } 433 break; 434 #endif 435 436 default: 437 NL_SET_ERR_MSG(extack, "Unsupported protocol"); 438 goto out; 439 } 440 441 if ((err = verify_aead(attrs, extack))) 442 goto out; 443 if ((err = verify_auth_trunc(attrs, extack))) 444 goto out; 445 if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH, extack))) 446 goto out; 447 if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT, extack))) 448 goto out; 449 if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP, extack))) 450 goto out; 451 if ((err = verify_sec_ctx_len(attrs, extack))) 452 goto out; 453 if ((err = verify_replay(p, attrs, sa_dir, extack))) 454 goto out; 455 456 err = -EINVAL; 457 switch (p->mode) { 458 case XFRM_MODE_TRANSPORT: 459 case XFRM_MODE_TUNNEL: 460 case XFRM_MODE_ROUTEOPTIMIZATION: 461 case XFRM_MODE_BEET: 462 break; 463 case XFRM_MODE_IPTFS: 464 if (p->id.proto != IPPROTO_ESP) { 465 NL_SET_ERR_MSG(extack, "IP-TFS mode only supported with ESP"); 466 goto out; 467 } 468 if (sa_dir == 0) { 469 NL_SET_ERR_MSG(extack, "IP-TFS mode requires in or out direction attribute"); 470 goto out; 471 } 472 break; 473 474 default: 475 NL_SET_ERR_MSG(extack, "Unsupported mode"); 476 goto out; 477 } 478 479 err = 0; 480 481 if (attrs[XFRMA_MTIMER_THRESH]) { 482 err = verify_mtimer_thresh(!!attrs[XFRMA_ENCAP], sa_dir, extack); 483 if (err) 484 goto out; 485 } 486 487 if (sa_dir == XFRM_SA_DIR_OUT) { 488 if (p->flags & XFRM_STATE_DECAP_DSCP) { 489 NL_SET_ERR_MSG(extack, "Flag DECAP_DSCP should not be set for output SA"); 490 err = -EINVAL; 491 goto out; 492 } 493 494 if (p->flags & XFRM_STATE_ICMP) { 495 NL_SET_ERR_MSG(extack, "Flag ICMP should not be set for output SA"); 496 err = -EINVAL; 497 goto out; 498 } 499 500 if (p->flags & XFRM_STATE_WILDRECV) { 501 NL_SET_ERR_MSG(extack, "Flag WILDRECV should not be set for output SA"); 502 err = -EINVAL; 503 goto out; 504 } 505 506 if (p->replay_window) { 507 NL_SET_ERR_MSG(extack, "Replay window should be 0 for output SA"); 508 err = -EINVAL; 509 goto out; 510 } 511 512 if (attrs[XFRMA_IPTFS_DROP_TIME]) { 513 NL_SET_ERR_MSG(extack, "IP-TFS drop time should not be set for output SA"); 514 err = -EINVAL; 515 goto out; 516 } 517 518 if (attrs[XFRMA_IPTFS_REORDER_WINDOW]) { 519 NL_SET_ERR_MSG(extack, "IP-TFS reorder window should not be set for output SA"); 520 err = -EINVAL; 521 goto out; 522 } 523 524 if (attrs[XFRMA_REPLAY_VAL]) { 525 struct xfrm_replay_state *replay; 526 527 replay = nla_data(attrs[XFRMA_REPLAY_VAL]); 528 529 if (replay->seq || replay->bitmap) { 530 NL_SET_ERR_MSG(extack, 531 "Replay seq and bitmap should be 0 for output SA"); 532 err = -EINVAL; 533 goto out; 534 } 535 } 536 } 537 538 if (sa_dir == XFRM_SA_DIR_IN) { 539 if (p->flags & XFRM_STATE_NOPMTUDISC) { 540 NL_SET_ERR_MSG(extack, "Flag NOPMTUDISC should not be set for input SA"); 541 err = -EINVAL; 542 goto out; 543 } 544 545 if (attrs[XFRMA_SA_EXTRA_FLAGS]) { 546 u32 xflags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); 547 548 if (xflags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP) { 549 NL_SET_ERR_MSG(extack, "Flag DONT_ENCAP_DSCP should not be set for input SA"); 550 err = -EINVAL; 551 goto out; 552 } 553 554 if (xflags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP) { 555 NL_SET_ERR_MSG(extack, "Flag OSEQ_MAY_WRAP should not be set for input SA"); 556 err = -EINVAL; 557 goto out; 558 } 559 560 } 561 562 if (attrs[XFRMA_IPTFS_DONT_FRAG]) { 563 NL_SET_ERR_MSG(extack, "IP-TFS don't fragment should not be set for input SA"); 564 err = -EINVAL; 565 goto out; 566 } 567 568 if (attrs[XFRMA_IPTFS_INIT_DELAY]) { 569 NL_SET_ERR_MSG(extack, "IP-TFS initial delay should not be set for input SA"); 570 err = -EINVAL; 571 goto out; 572 } 573 574 if (attrs[XFRMA_IPTFS_MAX_QSIZE]) { 575 NL_SET_ERR_MSG(extack, "IP-TFS max queue size should not be set for input SA"); 576 err = -EINVAL; 577 goto out; 578 } 579 580 if (attrs[XFRMA_IPTFS_PKT_SIZE]) { 581 NL_SET_ERR_MSG(extack, "IP-TFS packet size should not be set for input SA"); 582 err = -EINVAL; 583 goto out; 584 } 585 } 586 587 if (!sa_dir && attrs[XFRMA_SA_PCPU]) { 588 NL_SET_ERR_MSG(extack, "SA_PCPU only supported with SA_DIR"); 589 err = -EINVAL; 590 goto out; 591 } 592 593 out: 594 return err; 595 } 596 597 static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 598 struct xfrm_algo_desc *(*get_byname)(const char *, int), 599 struct nlattr *rta, struct netlink_ext_ack *extack) 600 { 601 struct xfrm_algo *p, *ualg; 602 struct xfrm_algo_desc *algo; 603 604 if (!rta) 605 return 0; 606 607 ualg = nla_data(rta); 608 609 algo = get_byname(ualg->alg_name, 1); 610 if (!algo) { 611 NL_SET_ERR_MSG(extack, "Requested COMP algorithm not found"); 612 return -ENOSYS; 613 } 614 *props = algo->desc.sadb_alg_id; 615 616 p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 617 if (!p) 618 return -ENOMEM; 619 620 strscpy(p->alg_name, algo->name); 621 *algpp = p; 622 return 0; 623 } 624 625 static int attach_crypt(struct xfrm_state *x, struct nlattr *rta, 626 struct netlink_ext_ack *extack) 627 { 628 struct xfrm_algo *p, *ualg; 629 struct xfrm_algo_desc *algo; 630 631 if (!rta) 632 return 0; 633 634 ualg = nla_data(rta); 635 636 algo = xfrm_ealg_get_byname(ualg->alg_name, 1); 637 if (!algo) { 638 NL_SET_ERR_MSG(extack, "Requested CRYPT algorithm not found"); 639 return -ENOSYS; 640 } 641 x->props.ealgo = algo->desc.sadb_alg_id; 642 643 p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 644 if (!p) 645 return -ENOMEM; 646 647 strscpy(p->alg_name, algo->name); 648 x->ealg = p; 649 x->geniv = algo->uinfo.encr.geniv; 650 return 0; 651 } 652 653 static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props, 654 struct nlattr *rta, struct netlink_ext_ack *extack) 655 { 656 struct xfrm_algo *ualg; 657 struct xfrm_algo_auth *p; 658 struct xfrm_algo_desc *algo; 659 660 if (!rta) 661 return 0; 662 663 ualg = nla_data(rta); 664 665 algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 666 if (!algo) { 667 NL_SET_ERR_MSG(extack, "Requested AUTH algorithm not found"); 668 return -ENOSYS; 669 } 670 *props = algo->desc.sadb_alg_id; 671 672 p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL); 673 if (!p) 674 return -ENOMEM; 675 676 strscpy(p->alg_name, algo->name); 677 p->alg_key_len = ualg->alg_key_len; 678 p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 679 memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8); 680 681 *algpp = p; 682 return 0; 683 } 684 685 static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props, 686 struct nlattr *rta, struct netlink_ext_ack *extack) 687 { 688 struct xfrm_algo_auth *p, *ualg; 689 struct xfrm_algo_desc *algo; 690 691 if (!rta) 692 return 0; 693 694 ualg = nla_data(rta); 695 696 algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 697 if (!algo) { 698 NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found"); 699 return -ENOSYS; 700 } 701 if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) { 702 NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV"); 703 return -EINVAL; 704 } 705 *props = algo->desc.sadb_alg_id; 706 707 p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL); 708 if (!p) 709 return -ENOMEM; 710 711 strscpy(p->alg_name, algo->name); 712 if (!p->alg_trunc_len) 713 p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 714 715 *algpp = p; 716 return 0; 717 } 718 719 static int attach_aead(struct xfrm_state *x, struct nlattr *rta, 720 struct netlink_ext_ack *extack) 721 { 722 struct xfrm_algo_aead *p, *ualg; 723 struct xfrm_algo_desc *algo; 724 725 if (!rta) 726 return 0; 727 728 ualg = nla_data(rta); 729 730 algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1); 731 if (!algo) { 732 NL_SET_ERR_MSG(extack, "Requested AEAD algorithm not found"); 733 return -ENOSYS; 734 } 735 x->props.ealgo = algo->desc.sadb_alg_id; 736 737 p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL); 738 if (!p) 739 return -ENOMEM; 740 741 strscpy(p->alg_name, algo->name); 742 x->aead = p; 743 x->geniv = algo->uinfo.aead.geniv; 744 return 0; 745 } 746 747 static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn, 748 struct nlattr *rp, 749 struct netlink_ext_ack *extack) 750 { 751 struct xfrm_replay_state_esn *up; 752 unsigned int ulen; 753 754 if (!replay_esn || !rp) 755 return 0; 756 757 up = nla_data(rp); 758 ulen = xfrm_replay_state_esn_len(up); 759 760 /* Check the overall length and the internal bitmap length to avoid 761 * potential overflow. */ 762 if (nla_len(rp) < (int)ulen) { 763 NL_SET_ERR_MSG(extack, "ESN attribute is too short"); 764 return -EINVAL; 765 } 766 767 if (xfrm_replay_state_esn_len(replay_esn) != ulen) { 768 NL_SET_ERR_MSG(extack, "New ESN size doesn't match the existing SA's ESN size"); 769 return -EINVAL; 770 } 771 772 if (replay_esn->bmp_len != up->bmp_len) { 773 NL_SET_ERR_MSG(extack, "New ESN bitmap size doesn't match the existing SA's ESN bitmap"); 774 return -EINVAL; 775 } 776 777 if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) { 778 NL_SET_ERR_MSG(extack, "ESN replay window is longer than the bitmap"); 779 return -EINVAL; 780 } 781 782 return 0; 783 } 784 785 static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn, 786 struct xfrm_replay_state_esn **preplay_esn, 787 struct nlattr *rta) 788 { 789 struct xfrm_replay_state_esn *p, *pp, *up; 790 unsigned int klen, ulen; 791 792 if (!rta) 793 return 0; 794 795 up = nla_data(rta); 796 klen = xfrm_replay_state_esn_len(up); 797 ulen = nla_len(rta) >= (int)klen ? klen : sizeof(*up); 798 799 p = kzalloc(klen, GFP_KERNEL); 800 if (!p) 801 return -ENOMEM; 802 803 pp = kzalloc(klen, GFP_KERNEL); 804 if (!pp) { 805 kfree(p); 806 return -ENOMEM; 807 } 808 809 memcpy(p, up, ulen); 810 memcpy(pp, up, ulen); 811 812 *replay_esn = p; 813 *preplay_esn = pp; 814 815 return 0; 816 } 817 818 static inline unsigned int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx) 819 { 820 unsigned int len = 0; 821 822 if (xfrm_ctx) { 823 len += sizeof(struct xfrm_user_sec_ctx); 824 len += xfrm_ctx->ctx_len; 825 } 826 return len; 827 } 828 829 static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 830 { 831 memcpy(&x->id, &p->id, sizeof(x->id)); 832 memcpy(&x->sel, &p->sel, sizeof(x->sel)); 833 memcpy(&x->lft, &p->lft, sizeof(x->lft)); 834 x->props.mode = p->mode; 835 x->props.replay_window = min_t(unsigned int, p->replay_window, 836 sizeof(x->replay.bitmap) * 8); 837 x->props.reqid = p->reqid; 838 x->props.family = p->family; 839 memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr)); 840 x->props.flags = p->flags; 841 842 if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC)) 843 x->sel.family = p->family; 844 } 845 846 /* 847 * someday when pfkey also has support, we could have the code 848 * somehow made shareable and move it to xfrm_state.c - JHS 849 * 850 */ 851 static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, 852 int update_esn) 853 { 854 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 855 struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL; 856 struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 857 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 858 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 859 struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH]; 860 861 if (re && x->replay_esn && x->preplay_esn) { 862 struct xfrm_replay_state_esn *replay_esn; 863 replay_esn = nla_data(re); 864 memcpy(x->replay_esn, replay_esn, 865 xfrm_replay_state_esn_len(replay_esn)); 866 memcpy(x->preplay_esn, replay_esn, 867 xfrm_replay_state_esn_len(replay_esn)); 868 } 869 870 if (rp) { 871 struct xfrm_replay_state *replay; 872 replay = nla_data(rp); 873 memcpy(&x->replay, replay, sizeof(*replay)); 874 memcpy(&x->preplay, replay, sizeof(*replay)); 875 } 876 877 if (lt) { 878 struct xfrm_lifetime_cur *ltime; 879 ltime = nla_data(lt); 880 x->curlft.bytes = ltime->bytes; 881 x->curlft.packets = ltime->packets; 882 x->curlft.add_time = ltime->add_time; 883 x->curlft.use_time = ltime->use_time; 884 } 885 886 if (et) 887 x->replay_maxage = nla_get_u32(et); 888 889 if (rt) 890 x->replay_maxdiff = nla_get_u32(rt); 891 892 if (mt) 893 x->mapping_maxage = nla_get_u32(mt); 894 } 895 896 static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m) 897 { 898 if (attrs[XFRMA_SET_MARK]) { 899 m->v = nla_get_u32(attrs[XFRMA_SET_MARK]); 900 m->m = nla_get_u32_default(attrs[XFRMA_SET_MARK_MASK], 901 0xffffffff); 902 } else { 903 m->v = m->m = 0; 904 } 905 } 906 907 static struct xfrm_state *xfrm_state_construct(struct net *net, 908 struct xfrm_usersa_info *p, 909 struct nlattr **attrs, 910 int *errp, 911 struct netlink_ext_ack *extack) 912 { 913 struct xfrm_state *x = xfrm_state_alloc(net); 914 int err = -ENOMEM; 915 916 if (!x) 917 goto error_no_put; 918 919 copy_from_user_state(x, p); 920 921 if (attrs[XFRMA_ENCAP]) { 922 x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 923 sizeof(*x->encap), GFP_KERNEL); 924 if (x->encap == NULL) 925 goto error; 926 } 927 928 if (attrs[XFRMA_COADDR]) { 929 x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), 930 sizeof(*x->coaddr), GFP_KERNEL); 931 if (x->coaddr == NULL) 932 goto error; 933 } 934 935 if (attrs[XFRMA_SA_EXTRA_FLAGS]) 936 x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); 937 938 if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD], extack))) 939 goto error; 940 if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo, 941 attrs[XFRMA_ALG_AUTH_TRUNC], extack))) 942 goto error; 943 if (!x->aalg) { 944 if ((err = attach_auth(&x->aalg, &x->props.aalgo, 945 attrs[XFRMA_ALG_AUTH], extack))) 946 goto error; 947 } 948 if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT], extack))) 949 goto error; 950 if ((err = attach_one_algo(&x->calg, &x->props.calgo, 951 xfrm_calg_get_byname, 952 attrs[XFRMA_ALG_COMP], extack))) 953 goto error; 954 955 if (attrs[XFRMA_TFCPAD]) { 956 x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]); 957 if (x->tfcpad > IP_MAX_MTU) { 958 NL_SET_ERR_MSG(extack, "Excessive TFC padding"); 959 err = -EINVAL; 960 goto error; 961 } 962 } 963 964 xfrm_mark_get(attrs, &x->mark); 965 966 xfrm_smark_init(attrs, &x->props.smark); 967 968 if (attrs[XFRMA_IF_ID]) 969 x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 970 971 if (attrs[XFRMA_SA_DIR]) 972 x->dir = nla_get_u8(attrs[XFRMA_SA_DIR]); 973 974 if (attrs[XFRMA_NAT_KEEPALIVE_INTERVAL]) 975 x->nat_keepalive_interval = 976 nla_get_u32(attrs[XFRMA_NAT_KEEPALIVE_INTERVAL]); 977 978 if (attrs[XFRMA_SA_PCPU]) { 979 x->pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); 980 if (x->pcpu_num >= num_possible_cpus()) { 981 err = -ERANGE; 982 NL_SET_ERR_MSG(extack, "pCPU number too big"); 983 goto error; 984 } 985 } 986 987 err = __xfrm_init_state(x, extack); 988 if (err) 989 goto error; 990 991 if (attrs[XFRMA_SEC_CTX]) { 992 err = security_xfrm_state_alloc(x, 993 nla_data(attrs[XFRMA_SEC_CTX])); 994 if (err) 995 goto error; 996 } 997 998 if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn, 999 attrs[XFRMA_REPLAY_ESN_VAL]))) 1000 goto error; 1001 1002 x->km.seq = p->seq; 1003 x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth; 1004 /* sysctl_xfrm_aevent_etime is in 100ms units */ 1005 x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M; 1006 1007 if ((err = xfrm_init_replay(x, extack))) 1008 goto error; 1009 1010 /* override default values from above */ 1011 xfrm_update_ae_params(x, attrs, 0); 1012 1013 xfrm_set_type_offload(x, attrs[XFRMA_OFFLOAD_DEV]); 1014 /* configure the hardware if offload is requested */ 1015 if (attrs[XFRMA_OFFLOAD_DEV]) { 1016 err = xfrm_dev_state_add(net, x, 1017 nla_data(attrs[XFRMA_OFFLOAD_DEV]), 1018 extack); 1019 if (err) 1020 goto error; 1021 } 1022 1023 if (x->mode_cbs && x->mode_cbs->user_init) { 1024 err = x->mode_cbs->user_init(net, x, attrs, extack); 1025 if (err) 1026 goto error; 1027 } 1028 1029 return x; 1030 1031 error: 1032 x->km.state = XFRM_STATE_DEAD; 1033 xfrm_state_put(x); 1034 error_no_put: 1035 *errp = err; 1036 return NULL; 1037 } 1038 1039 static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 1040 struct nlattr **attrs, struct netlink_ext_ack *extack) 1041 { 1042 struct net *net = sock_net(skb->sk); 1043 struct xfrm_usersa_info *p = nlmsg_data(nlh); 1044 struct xfrm_state *x; 1045 int err; 1046 struct km_event c; 1047 1048 err = verify_newsa_info(p, attrs, extack); 1049 if (err) 1050 return err; 1051 1052 x = xfrm_state_construct(net, p, attrs, &err, extack); 1053 if (!x) 1054 return err; 1055 1056 xfrm_state_hold(x); 1057 if (nlh->nlmsg_type == XFRM_MSG_NEWSA) 1058 err = xfrm_state_add(x); 1059 else 1060 err = xfrm_state_update(x); 1061 1062 xfrm_audit_state_add(x, err ? 0 : 1, true); 1063 1064 if (err < 0) { 1065 x->km.state = XFRM_STATE_DEAD; 1066 xfrm_dev_state_delete(x); 1067 __xfrm_state_put(x); 1068 goto out; 1069 } 1070 1071 if (x->km.state == XFRM_STATE_VOID) 1072 x->km.state = XFRM_STATE_VALID; 1073 1074 c.seq = nlh->nlmsg_seq; 1075 c.portid = nlh->nlmsg_pid; 1076 c.event = nlh->nlmsg_type; 1077 1078 km_state_notify(x, &c); 1079 out: 1080 xfrm_state_put(x); 1081 return err; 1082 } 1083 1084 static struct xfrm_state *xfrm_user_state_lookup(struct net *net, 1085 struct xfrm_usersa_id *p, 1086 struct nlattr **attrs, 1087 int *errp) 1088 { 1089 struct xfrm_state *x = NULL; 1090 struct xfrm_mark m; 1091 int err; 1092 u32 mark = xfrm_mark_get(attrs, &m); 1093 1094 if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) { 1095 err = -ESRCH; 1096 x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family); 1097 } else { 1098 xfrm_address_t *saddr = NULL; 1099 1100 verify_one_addr(attrs, XFRMA_SRCADDR, &saddr); 1101 if (!saddr) { 1102 err = -EINVAL; 1103 goto out; 1104 } 1105 1106 err = -ESRCH; 1107 x = xfrm_state_lookup_byaddr(net, mark, 1108 &p->daddr, saddr, 1109 p->proto, p->family); 1110 } 1111 1112 out: 1113 if (!x && errp) 1114 *errp = err; 1115 return x; 1116 } 1117 1118 static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 1119 struct nlattr **attrs, struct netlink_ext_ack *extack) 1120 { 1121 struct net *net = sock_net(skb->sk); 1122 struct xfrm_state *x; 1123 int err = -ESRCH; 1124 struct km_event c; 1125 struct xfrm_usersa_id *p = nlmsg_data(nlh); 1126 1127 x = xfrm_user_state_lookup(net, p, attrs, &err); 1128 if (x == NULL) 1129 return err; 1130 1131 if ((err = security_xfrm_state_delete(x)) != 0) 1132 goto out; 1133 1134 if (xfrm_state_kern(x)) { 1135 NL_SET_ERR_MSG(extack, "SA is in use by tunnels"); 1136 err = -EPERM; 1137 goto out; 1138 } 1139 1140 err = xfrm_state_delete(x); 1141 if (err < 0) 1142 goto out; 1143 1144 c.seq = nlh->nlmsg_seq; 1145 c.portid = nlh->nlmsg_pid; 1146 c.event = nlh->nlmsg_type; 1147 km_state_notify(x, &c); 1148 1149 out: 1150 xfrm_audit_state_delete(x, err ? 0 : 1, true); 1151 xfrm_state_put(x); 1152 return err; 1153 } 1154 1155 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 1156 { 1157 memset(p, 0, sizeof(*p)); 1158 memcpy(&p->id, &x->id, sizeof(p->id)); 1159 memcpy(&p->sel, &x->sel, sizeof(p->sel)); 1160 memcpy(&p->lft, &x->lft, sizeof(p->lft)); 1161 if (x->xso.dev) 1162 xfrm_dev_state_update_stats(x); 1163 memcpy(&p->curlft, &x->curlft, sizeof(p->curlft)); 1164 put_unaligned(x->stats.replay_window, &p->stats.replay_window); 1165 put_unaligned(x->stats.replay, &p->stats.replay); 1166 put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed); 1167 memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr)); 1168 p->mode = x->props.mode; 1169 p->replay_window = x->props.replay_window; 1170 p->reqid = x->props.reqid; 1171 p->family = x->props.family; 1172 p->flags = x->props.flags; 1173 p->seq = x->km.seq; 1174 } 1175 1176 struct xfrm_dump_info { 1177 struct sk_buff *in_skb; 1178 struct sk_buff *out_skb; 1179 u32 nlmsg_seq; 1180 u16 nlmsg_flags; 1181 }; 1182 1183 static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb) 1184 { 1185 struct xfrm_user_sec_ctx *uctx; 1186 struct nlattr *attr; 1187 int ctx_size = sizeof(*uctx) + s->ctx_len; 1188 1189 attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size); 1190 if (attr == NULL) 1191 return -EMSGSIZE; 1192 1193 uctx = nla_data(attr); 1194 uctx->exttype = XFRMA_SEC_CTX; 1195 uctx->len = ctx_size; 1196 uctx->ctx_doi = s->ctx_doi; 1197 uctx->ctx_alg = s->ctx_alg; 1198 uctx->ctx_len = s->ctx_len; 1199 memcpy(uctx + 1, s->ctx_str, s->ctx_len); 1200 1201 return 0; 1202 } 1203 1204 static void xso_to_xuo_ifindex(const struct xfrm_dev_offload *xso, int ifindex, 1205 struct xfrm_user_offload *xuo) 1206 { 1207 xuo->ifindex = ifindex; 1208 if (xso->dir == XFRM_DEV_OFFLOAD_IN) 1209 xuo->flags = XFRM_OFFLOAD_INBOUND; 1210 if (xso->type == XFRM_DEV_OFFLOAD_PACKET) 1211 xuo->flags |= XFRM_OFFLOAD_PACKET; 1212 } 1213 1214 #ifdef CONFIG_XFRM_MIGRATE 1215 static void xso_to_xuo(const struct xfrm_dev_offload *xso, 1216 struct xfrm_user_offload *xuo) 1217 { 1218 xso_to_xuo_ifindex(xso, xso->dev->ifindex, xuo); 1219 } 1220 #endif 1221 1222 static int copy_user_offload_ifindex(const struct xfrm_dev_offload *xso, 1223 int ifindex, struct sk_buff *skb) 1224 { 1225 struct xfrm_user_offload *xuo; 1226 struct nlattr *attr; 1227 1228 attr = nla_reserve(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo)); 1229 if (attr == NULL) 1230 return -EMSGSIZE; 1231 1232 xuo = nla_data(attr); 1233 memset(xuo, 0, sizeof(*xuo)); 1234 xso_to_xuo_ifindex(xso, ifindex, xuo); 1235 1236 return 0; 1237 } 1238 1239 static int copy_user_offload(struct xfrm_dev_offload *xso, struct sk_buff *skb) 1240 { 1241 return copy_user_offload_ifindex(xso, xso->dev->ifindex, skb); 1242 } 1243 1244 static int copy_user_state_offload(const struct xfrm_dev_offload *xso, 1245 struct sk_buff *skb) 1246 { 1247 return copy_user_offload_ifindex(xso, READ_ONCE(xso->ifindex), skb); 1248 } 1249 1250 static bool xfrm_redact(void) 1251 { 1252 return IS_ENABLED(CONFIG_SECURITY) && 1253 security_locked_down(LOCKDOWN_XFRM_SECRET); 1254 } 1255 1256 static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb) 1257 { 1258 struct xfrm_algo *algo; 1259 struct xfrm_algo_auth *ap; 1260 struct nlattr *nla; 1261 bool redact_secret = xfrm_redact(); 1262 1263 nla = nla_reserve(skb, XFRMA_ALG_AUTH, 1264 sizeof(*algo) + (auth->alg_key_len + 7) / 8); 1265 if (!nla) 1266 return -EMSGSIZE; 1267 algo = nla_data(nla); 1268 strscpy_pad(algo->alg_name, auth->alg_name); 1269 1270 if (redact_secret && auth->alg_key_len) 1271 memset(algo->alg_key, 0, (auth->alg_key_len + 7) / 8); 1272 else 1273 memcpy(algo->alg_key, auth->alg_key, 1274 (auth->alg_key_len + 7) / 8); 1275 algo->alg_key_len = auth->alg_key_len; 1276 1277 nla = nla_reserve(skb, XFRMA_ALG_AUTH_TRUNC, xfrm_alg_auth_len(auth)); 1278 if (!nla) 1279 return -EMSGSIZE; 1280 ap = nla_data(nla); 1281 strscpy_pad(ap->alg_name, auth->alg_name); 1282 ap->alg_key_len = auth->alg_key_len; 1283 ap->alg_trunc_len = auth->alg_trunc_len; 1284 if (redact_secret && auth->alg_key_len) 1285 memset(ap->alg_key, 0, (auth->alg_key_len + 7) / 8); 1286 else 1287 memcpy(ap->alg_key, auth->alg_key, 1288 (auth->alg_key_len + 7) / 8); 1289 return 0; 1290 } 1291 1292 static int copy_to_user_aead(struct xfrm_algo_aead *aead, struct sk_buff *skb) 1293 { 1294 struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_AEAD, aead_len(aead)); 1295 struct xfrm_algo_aead *ap; 1296 bool redact_secret = xfrm_redact(); 1297 1298 if (!nla) 1299 return -EMSGSIZE; 1300 1301 ap = nla_data(nla); 1302 strscpy_pad(ap->alg_name, aead->alg_name); 1303 ap->alg_key_len = aead->alg_key_len; 1304 ap->alg_icv_len = aead->alg_icv_len; 1305 1306 if (redact_secret && aead->alg_key_len) 1307 memset(ap->alg_key, 0, (aead->alg_key_len + 7) / 8); 1308 else 1309 memcpy(ap->alg_key, aead->alg_key, 1310 (aead->alg_key_len + 7) / 8); 1311 return 0; 1312 } 1313 1314 static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb) 1315 { 1316 struct xfrm_algo *ap; 1317 bool redact_secret = xfrm_redact(); 1318 struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_CRYPT, 1319 xfrm_alg_len(ealg)); 1320 if (!nla) 1321 return -EMSGSIZE; 1322 1323 ap = nla_data(nla); 1324 strscpy_pad(ap->alg_name, ealg->alg_name); 1325 ap->alg_key_len = ealg->alg_key_len; 1326 1327 if (redact_secret && ealg->alg_key_len) 1328 memset(ap->alg_key, 0, (ealg->alg_key_len + 7) / 8); 1329 else 1330 memcpy(ap->alg_key, ealg->alg_key, 1331 (ealg->alg_key_len + 7) / 8); 1332 1333 return 0; 1334 } 1335 1336 static int copy_to_user_calg(struct xfrm_algo *calg, struct sk_buff *skb) 1337 { 1338 struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_COMP, sizeof(*calg)); 1339 struct xfrm_algo *ap; 1340 1341 if (!nla) 1342 return -EMSGSIZE; 1343 1344 ap = nla_data(nla); 1345 strscpy_pad(ap->alg_name, calg->alg_name); 1346 ap->alg_key_len = 0; 1347 1348 return 0; 1349 } 1350 1351 static int copy_to_user_encap(struct xfrm_encap_tmpl *ep, struct sk_buff *skb) 1352 { 1353 struct nlattr *nla = nla_reserve(skb, XFRMA_ENCAP, sizeof(*ep)); 1354 struct xfrm_encap_tmpl *uep; 1355 1356 if (!nla) 1357 return -EMSGSIZE; 1358 1359 uep = nla_data(nla); 1360 memset(uep, 0, sizeof(*uep)); 1361 1362 uep->encap_type = ep->encap_type; 1363 uep->encap_sport = ep->encap_sport; 1364 uep->encap_dport = ep->encap_dport; 1365 uep->encap_oa = ep->encap_oa; 1366 1367 return 0; 1368 } 1369 1370 static int xfrm_smark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1371 { 1372 int ret = 0; 1373 1374 if (m->v | m->m) { 1375 ret = nla_put_u32(skb, XFRMA_SET_MARK, m->v); 1376 if (!ret) 1377 ret = nla_put_u32(skb, XFRMA_SET_MARK_MASK, m->m); 1378 } 1379 return ret; 1380 } 1381 1382 /* Don't change this without updating xfrm_sa_len! */ 1383 static int copy_to_user_state_extra(struct xfrm_state *x, 1384 struct xfrm_usersa_info *p, 1385 struct sk_buff *skb) 1386 { 1387 int ret = 0; 1388 1389 copy_to_user_state(x, p); 1390 1391 if (x->props.extra_flags) { 1392 ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS, 1393 x->props.extra_flags); 1394 if (ret) 1395 goto out; 1396 } 1397 1398 if (x->coaddr) { 1399 ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr); 1400 if (ret) 1401 goto out; 1402 } 1403 if (x->lastused) { 1404 ret = nla_put_u64_64bit(skb, XFRMA_LASTUSED, x->lastused, 1405 XFRMA_PAD); 1406 if (ret) 1407 goto out; 1408 } 1409 if (x->aead) { 1410 ret = copy_to_user_aead(x->aead, skb); 1411 if (ret) 1412 goto out; 1413 } 1414 if (x->aalg) { 1415 ret = copy_to_user_auth(x->aalg, skb); 1416 if (ret) 1417 goto out; 1418 } 1419 if (x->ealg) { 1420 ret = copy_to_user_ealg(x->ealg, skb); 1421 if (ret) 1422 goto out; 1423 } 1424 if (x->calg) { 1425 ret = copy_to_user_calg(x->calg, skb); 1426 if (ret) 1427 goto out; 1428 } 1429 if (x->encap) { 1430 ret = copy_to_user_encap(x->encap, skb); 1431 if (ret) 1432 goto out; 1433 } 1434 if (x->tfcpad) { 1435 ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad); 1436 if (ret) 1437 goto out; 1438 } 1439 ret = xfrm_mark_put(skb, &x->mark); 1440 if (ret) 1441 goto out; 1442 1443 ret = xfrm_smark_put(skb, &x->props.smark); 1444 if (ret) 1445 goto out; 1446 1447 if (x->replay_esn) 1448 ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 1449 xfrm_replay_state_esn_len(x->replay_esn), 1450 x->replay_esn); 1451 else 1452 ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 1453 &x->replay); 1454 if (ret) 1455 goto out; 1456 if (READ_ONCE(x->xso.dev)) 1457 ret = copy_user_state_offload(&x->xso, skb); 1458 if (ret) 1459 goto out; 1460 if (x->if_id) { 1461 ret = nla_put_u32(skb, XFRMA_IF_ID, x->if_id); 1462 if (ret) 1463 goto out; 1464 } 1465 if (x->security) { 1466 ret = copy_sec_ctx(x->security, skb); 1467 if (ret) 1468 goto out; 1469 } 1470 if (x->mode_cbs && x->mode_cbs->copy_to_user) 1471 ret = x->mode_cbs->copy_to_user(x, skb); 1472 if (ret) 1473 goto out; 1474 if (x->mapping_maxage) { 1475 ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH, x->mapping_maxage); 1476 if (ret) 1477 goto out; 1478 } 1479 if (x->pcpu_num != UINT_MAX) { 1480 ret = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 1481 if (ret) 1482 goto out; 1483 } 1484 if (x->dir) 1485 ret = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); 1486 1487 if (x->nat_keepalive_interval) { 1488 ret = nla_put_u32(skb, XFRMA_NAT_KEEPALIVE_INTERVAL, 1489 x->nat_keepalive_interval); 1490 if (ret) 1491 goto out; 1492 } 1493 out: 1494 return ret; 1495 } 1496 1497 static int dump_one_state(struct xfrm_state *x, int count, void *ptr) 1498 { 1499 struct xfrm_dump_info *sp = ptr; 1500 struct sk_buff *in_skb = sp->in_skb; 1501 struct sk_buff *skb = sp->out_skb; 1502 struct xfrm_translator *xtr; 1503 struct xfrm_usersa_info *p; 1504 struct nlmsghdr *nlh; 1505 int err; 1506 1507 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 1508 XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags); 1509 if (nlh == NULL) 1510 return -EMSGSIZE; 1511 1512 p = nlmsg_data(nlh); 1513 1514 err = copy_to_user_state_extra(x, p, skb); 1515 if (err) { 1516 nlmsg_cancel(skb, nlh); 1517 return err; 1518 } 1519 nlmsg_end(skb, nlh); 1520 1521 xtr = xfrm_get_translator(); 1522 if (xtr) { 1523 err = xtr->alloc_compat(skb, nlh); 1524 1525 xfrm_put_translator(xtr); 1526 if (err) { 1527 nlmsg_cancel(skb, nlh); 1528 return err; 1529 } 1530 } 1531 1532 return 0; 1533 } 1534 1535 static int xfrm_dump_sa_done(struct netlink_callback *cb) 1536 { 1537 struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 1538 struct sock *sk = cb->skb->sk; 1539 struct net *net = sock_net(sk); 1540 1541 if (cb->args[0]) 1542 xfrm_state_walk_done(walk, net); 1543 return 0; 1544 } 1545 1546 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) 1547 { 1548 struct net *net = sock_net(skb->sk); 1549 struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 1550 struct xfrm_dump_info info; 1551 1552 BUILD_BUG_ON(sizeof(struct xfrm_state_walk) > 1553 sizeof(cb->args) - sizeof(cb->args[0])); 1554 1555 info.in_skb = cb->skb; 1556 info.out_skb = skb; 1557 info.nlmsg_seq = cb->nlh->nlmsg_seq; 1558 info.nlmsg_flags = NLM_F_MULTI; 1559 1560 if (!cb->args[0]) { 1561 struct nlattr *attrs[XFRMA_MAX+1]; 1562 struct xfrm_address_filter *filter = NULL; 1563 u8 proto = 0; 1564 int err; 1565 1566 err = nlmsg_parse_deprecated(cb->nlh, 0, attrs, XFRMA_MAX, 1567 xfrma_policy, cb->extack); 1568 if (err < 0) 1569 return err; 1570 1571 if (attrs[XFRMA_ADDRESS_FILTER]) { 1572 filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), 1573 sizeof(*filter), GFP_KERNEL); 1574 if (filter == NULL) 1575 return -ENOMEM; 1576 1577 /* see addr_match(), (prefix length >> 5) << 2 1578 * will be used to compare xfrm_address_t 1579 */ 1580 if (filter->splen > (sizeof(xfrm_address_t) << 3) || 1581 filter->dplen > (sizeof(xfrm_address_t) << 3)) { 1582 kfree(filter); 1583 return -EINVAL; 1584 } 1585 } 1586 1587 if (attrs[XFRMA_PROTO]) 1588 proto = nla_get_u8(attrs[XFRMA_PROTO]); 1589 1590 xfrm_state_walk_init(walk, proto, filter); 1591 cb->args[0] = 1; 1592 } 1593 1594 (void) xfrm_state_walk(net, walk, dump_one_state, &info); 1595 1596 return skb->len; 1597 } 1598 1599 static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, 1600 struct xfrm_state *x, u32 seq) 1601 { 1602 struct xfrm_dump_info info; 1603 struct sk_buff *skb; 1604 int err; 1605 1606 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1607 if (!skb) 1608 return ERR_PTR(-ENOMEM); 1609 1610 info.in_skb = in_skb; 1611 info.out_skb = skb; 1612 info.nlmsg_seq = seq; 1613 info.nlmsg_flags = 0; 1614 1615 err = dump_one_state(x, 0, &info); 1616 if (err) { 1617 kfree_skb(skb); 1618 return ERR_PTR(err); 1619 } 1620 1621 return skb; 1622 } 1623 1624 /* A wrapper for nlmsg_multicast() checking that nlsk is still available. 1625 * Must be called with RCU read lock. 1626 */ 1627 static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb, 1628 u32 pid, unsigned int group) 1629 { 1630 struct sock *nlsk = rcu_dereference(net->xfrm.nlsk); 1631 struct xfrm_translator *xtr; 1632 1633 if (!nlsk) { 1634 kfree_skb(skb); 1635 return -EPIPE; 1636 } 1637 1638 xtr = xfrm_get_translator(); 1639 if (xtr) { 1640 int err = xtr->alloc_compat(skb, nlmsg_hdr(skb)); 1641 1642 xfrm_put_translator(xtr); 1643 if (err) { 1644 kfree_skb(skb); 1645 return err; 1646 } 1647 } 1648 1649 return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); 1650 } 1651 1652 static inline unsigned int xfrm_spdinfo_msgsize(void) 1653 { 1654 return NLMSG_ALIGN(4) 1655 + nla_total_size(sizeof(struct xfrmu_spdinfo)) 1656 + nla_total_size(sizeof(struct xfrmu_spdhinfo)) 1657 + nla_total_size(sizeof(struct xfrmu_spdhthresh)) 1658 + nla_total_size(sizeof(struct xfrmu_spdhthresh)); 1659 } 1660 1661 static int build_spdinfo(struct sk_buff *skb, struct net *net, 1662 u32 portid, u32 seq, u32 flags) 1663 { 1664 struct xfrmk_spdinfo si; 1665 struct xfrmu_spdinfo spc; 1666 struct xfrmu_spdhinfo sph; 1667 struct xfrmu_spdhthresh spt4, spt6; 1668 struct nlmsghdr *nlh; 1669 int err; 1670 u32 *f; 1671 unsigned lseq; 1672 1673 nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0); 1674 if (nlh == NULL) /* shouldn't really happen ... */ 1675 return -EMSGSIZE; 1676 1677 f = nlmsg_data(nlh); 1678 *f = flags; 1679 xfrm_spd_getinfo(net, &si); 1680 spc.incnt = si.incnt; 1681 spc.outcnt = si.outcnt; 1682 spc.fwdcnt = si.fwdcnt; 1683 spc.inscnt = si.inscnt; 1684 spc.outscnt = si.outscnt; 1685 spc.fwdscnt = si.fwdscnt; 1686 sph.spdhcnt = si.spdhcnt; 1687 sph.spdhmcnt = si.spdhmcnt; 1688 1689 do { 1690 lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock); 1691 1692 spt4.lbits = net->xfrm.policy_hthresh.lbits4; 1693 spt4.rbits = net->xfrm.policy_hthresh.rbits4; 1694 spt6.lbits = net->xfrm.policy_hthresh.lbits6; 1695 spt6.rbits = net->xfrm.policy_hthresh.rbits6; 1696 } while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq)); 1697 1698 err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc); 1699 if (!err) 1700 err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph); 1701 if (!err) 1702 err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4); 1703 if (!err) 1704 err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6); 1705 if (err) { 1706 nlmsg_cancel(skb, nlh); 1707 return err; 1708 } 1709 1710 nlmsg_end(skb, nlh); 1711 return 0; 1712 } 1713 1714 static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1715 struct nlattr **attrs, 1716 struct netlink_ext_ack *extack) 1717 { 1718 struct net *net = sock_net(skb->sk); 1719 struct xfrmu_spdhthresh *thresh4 = NULL; 1720 struct xfrmu_spdhthresh *thresh6 = NULL; 1721 1722 /* selector prefixlen thresholds to hash policies */ 1723 if (attrs[XFRMA_SPD_IPV4_HTHRESH]) { 1724 struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH]; 1725 1726 if (nla_len(rta) < sizeof(*thresh4)) { 1727 NL_SET_ERR_MSG(extack, "Invalid SPD_IPV4_HTHRESH attribute length"); 1728 return -EINVAL; 1729 } 1730 thresh4 = nla_data(rta); 1731 if (thresh4->lbits > 32 || thresh4->rbits > 32) { 1732 NL_SET_ERR_MSG(extack, "Invalid hash threshold (must be <= 32 for IPv4)"); 1733 return -EINVAL; 1734 } 1735 } 1736 if (attrs[XFRMA_SPD_IPV6_HTHRESH]) { 1737 struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH]; 1738 1739 if (nla_len(rta) < sizeof(*thresh6)) { 1740 NL_SET_ERR_MSG(extack, "Invalid SPD_IPV6_HTHRESH attribute length"); 1741 return -EINVAL; 1742 } 1743 thresh6 = nla_data(rta); 1744 if (thresh6->lbits > 128 || thresh6->rbits > 128) { 1745 NL_SET_ERR_MSG(extack, "Invalid hash threshold (must be <= 128 for IPv6)"); 1746 return -EINVAL; 1747 } 1748 } 1749 1750 if (thresh4 || thresh6) { 1751 write_seqlock(&net->xfrm.policy_hthresh.lock); 1752 if (thresh4) { 1753 net->xfrm.policy_hthresh.lbits4 = thresh4->lbits; 1754 net->xfrm.policy_hthresh.rbits4 = thresh4->rbits; 1755 } 1756 if (thresh6) { 1757 net->xfrm.policy_hthresh.lbits6 = thresh6->lbits; 1758 net->xfrm.policy_hthresh.rbits6 = thresh6->rbits; 1759 } 1760 write_sequnlock(&net->xfrm.policy_hthresh.lock); 1761 1762 xfrm_policy_hash_rebuild(net); 1763 } 1764 1765 return 0; 1766 } 1767 1768 static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1769 struct nlattr **attrs, 1770 struct netlink_ext_ack *extack) 1771 { 1772 struct net *net = sock_net(skb->sk); 1773 struct sk_buff *r_skb; 1774 u32 *flags = nlmsg_data(nlh); 1775 u32 sportid = NETLINK_CB(skb).portid; 1776 u32 seq = nlh->nlmsg_seq; 1777 int err; 1778 1779 r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC); 1780 if (r_skb == NULL) 1781 return -ENOMEM; 1782 1783 err = build_spdinfo(r_skb, net, sportid, seq, *flags); 1784 BUG_ON(err < 0); 1785 1786 return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, sportid); 1787 } 1788 1789 static inline unsigned int xfrm_sadinfo_msgsize(void) 1790 { 1791 return NLMSG_ALIGN(4) 1792 + nla_total_size(sizeof(struct xfrmu_sadhinfo)) 1793 + nla_total_size(4); /* XFRMA_SAD_CNT */ 1794 } 1795 1796 static int build_sadinfo(struct sk_buff *skb, struct net *net, 1797 u32 portid, u32 seq, u32 flags) 1798 { 1799 struct xfrmk_sadinfo si; 1800 struct xfrmu_sadhinfo sh; 1801 struct nlmsghdr *nlh; 1802 int err; 1803 u32 *f; 1804 1805 nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0); 1806 if (nlh == NULL) /* shouldn't really happen ... */ 1807 return -EMSGSIZE; 1808 1809 f = nlmsg_data(nlh); 1810 *f = flags; 1811 xfrm_sad_getinfo(net, &si); 1812 1813 sh.sadhmcnt = si.sadhmcnt; 1814 sh.sadhcnt = si.sadhcnt; 1815 1816 err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt); 1817 if (!err) 1818 err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh); 1819 if (err) { 1820 nlmsg_cancel(skb, nlh); 1821 return err; 1822 } 1823 1824 nlmsg_end(skb, nlh); 1825 return 0; 1826 } 1827 1828 static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1829 struct nlattr **attrs, 1830 struct netlink_ext_ack *extack) 1831 { 1832 struct net *net = sock_net(skb->sk); 1833 struct sk_buff *r_skb; 1834 u32 *flags = nlmsg_data(nlh); 1835 u32 sportid = NETLINK_CB(skb).portid; 1836 u32 seq = nlh->nlmsg_seq; 1837 int err; 1838 1839 r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC); 1840 if (r_skb == NULL) 1841 return -ENOMEM; 1842 1843 err = build_sadinfo(r_skb, net, sportid, seq, *flags); 1844 BUG_ON(err < 0); 1845 1846 return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, sportid); 1847 } 1848 1849 static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 1850 struct nlattr **attrs, struct netlink_ext_ack *extack) 1851 { 1852 struct net *net = sock_net(skb->sk); 1853 struct xfrm_usersa_id *p = nlmsg_data(nlh); 1854 struct xfrm_state *x; 1855 struct sk_buff *resp_skb; 1856 int err = -ESRCH; 1857 1858 x = xfrm_user_state_lookup(net, p, attrs, &err); 1859 if (x == NULL) 1860 goto out_noput; 1861 1862 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 1863 if (IS_ERR(resp_skb)) { 1864 err = PTR_ERR(resp_skb); 1865 } else { 1866 err = nlmsg_unicast(xfrm_net_nlsk(net, skb), resp_skb, NETLINK_CB(skb).portid); 1867 } 1868 xfrm_state_put(x); 1869 out_noput: 1870 return err; 1871 } 1872 1873 static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, 1874 struct nlattr **attrs, 1875 struct netlink_ext_ack *extack) 1876 { 1877 struct net *net = sock_net(skb->sk); 1878 struct xfrm_state *x; 1879 struct xfrm_userspi_info *p; 1880 struct xfrm_translator *xtr; 1881 struct sk_buff *resp_skb; 1882 xfrm_address_t *daddr; 1883 int family; 1884 int err; 1885 u32 mark; 1886 struct xfrm_mark m; 1887 u32 if_id = 0; 1888 u32 pcpu_num = UINT_MAX; 1889 1890 p = nlmsg_data(nlh); 1891 err = verify_spi_info(p->info.id.proto, p->min, p->max, extack); 1892 if (err) 1893 goto out_noput; 1894 1895 family = p->info.family; 1896 daddr = &p->info.id.daddr; 1897 1898 x = NULL; 1899 1900 mark = xfrm_mark_get(attrs, &m); 1901 1902 if (attrs[XFRMA_IF_ID]) 1903 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 1904 1905 if (attrs[XFRMA_SA_PCPU]) { 1906 pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); 1907 if (pcpu_num >= num_possible_cpus()) { 1908 err = -EINVAL; 1909 NL_SET_ERR_MSG(extack, "pCPU number too big"); 1910 goto out_noput; 1911 } 1912 } 1913 1914 if (p->info.seq) { 1915 x = xfrm_find_acq_byseq(net, mark, p->info.seq, pcpu_num); 1916 if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) { 1917 xfrm_state_put(x); 1918 x = NULL; 1919 } 1920 } 1921 1922 if (!x) 1923 x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid, 1924 if_id, pcpu_num, p->info.id.proto, daddr, 1925 &p->info.saddr, 1, 1926 family); 1927 err = -ENOENT; 1928 if (!x) { 1929 NL_SET_ERR_MSG(extack, "Target ACQUIRE not found"); 1930 goto out_noput; 1931 } 1932 1933 err = xfrm_alloc_spi(x, p->min, p->max, extack); 1934 if (err) 1935 goto out; 1936 1937 if (attrs[XFRMA_SA_DIR]) 1938 x->dir = nla_get_u8(attrs[XFRMA_SA_DIR]); 1939 1940 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 1941 if (IS_ERR(resp_skb)) { 1942 err = PTR_ERR(resp_skb); 1943 goto out; 1944 } 1945 1946 xtr = xfrm_get_translator(); 1947 if (xtr) { 1948 err = xtr->alloc_compat(skb, nlmsg_hdr(skb)); 1949 1950 xfrm_put_translator(xtr); 1951 if (err) { 1952 kfree_skb(resp_skb); 1953 goto out; 1954 } 1955 } 1956 1957 err = nlmsg_unicast(xfrm_net_nlsk(net, skb), resp_skb, NETLINK_CB(skb).portid); 1958 1959 out: 1960 xfrm_state_put(x); 1961 out_noput: 1962 return err; 1963 } 1964 1965 static int verify_policy_dir(u8 dir, struct netlink_ext_ack *extack) 1966 { 1967 switch (dir) { 1968 case XFRM_POLICY_IN: 1969 case XFRM_POLICY_OUT: 1970 case XFRM_POLICY_FWD: 1971 break; 1972 1973 default: 1974 NL_SET_ERR_MSG(extack, "Invalid policy direction"); 1975 return -EINVAL; 1976 } 1977 1978 return 0; 1979 } 1980 1981 static int verify_policy_type(u8 type, struct netlink_ext_ack *extack) 1982 { 1983 switch (type) { 1984 case XFRM_POLICY_TYPE_MAIN: 1985 #ifdef CONFIG_XFRM_SUB_POLICY 1986 case XFRM_POLICY_TYPE_SUB: 1987 #endif 1988 break; 1989 1990 default: 1991 NL_SET_ERR_MSG(extack, "Invalid policy type"); 1992 return -EINVAL; 1993 } 1994 1995 return 0; 1996 } 1997 1998 static int verify_newpolicy_info(struct xfrm_userpolicy_info *p, 1999 struct netlink_ext_ack *extack) 2000 { 2001 int ret; 2002 2003 switch (p->share) { 2004 case XFRM_SHARE_ANY: 2005 case XFRM_SHARE_SESSION: 2006 case XFRM_SHARE_USER: 2007 case XFRM_SHARE_UNIQUE: 2008 break; 2009 2010 default: 2011 NL_SET_ERR_MSG(extack, "Invalid policy share"); 2012 return -EINVAL; 2013 } 2014 2015 switch (p->action) { 2016 case XFRM_POLICY_ALLOW: 2017 case XFRM_POLICY_BLOCK: 2018 break; 2019 2020 default: 2021 NL_SET_ERR_MSG(extack, "Invalid policy action"); 2022 return -EINVAL; 2023 } 2024 2025 switch (p->sel.family) { 2026 case AF_INET: 2027 if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) { 2028 NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 32 for IPv4)"); 2029 return -EINVAL; 2030 } 2031 2032 break; 2033 2034 case AF_INET6: 2035 #if IS_ENABLED(CONFIG_IPV6) 2036 if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) { 2037 NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 128 for IPv6)"); 2038 return -EINVAL; 2039 } 2040 2041 break; 2042 #else 2043 NL_SET_ERR_MSG(extack, "IPv6 support disabled"); 2044 return -EAFNOSUPPORT; 2045 #endif 2046 2047 default: 2048 NL_SET_ERR_MSG(extack, "Invalid selector family"); 2049 return -EINVAL; 2050 } 2051 2052 ret = verify_policy_dir(p->dir, extack); 2053 if (ret) 2054 return ret; 2055 if (p->index && (xfrm_policy_id2dir(p->index) != p->dir)) { 2056 NL_SET_ERR_MSG(extack, "Policy index doesn't match direction"); 2057 return -EINVAL; 2058 } 2059 2060 return 0; 2061 } 2062 2063 static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs) 2064 { 2065 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 2066 struct xfrm_user_sec_ctx *uctx; 2067 2068 if (!rt) 2069 return 0; 2070 2071 uctx = nla_data(rt); 2072 return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL); 2073 } 2074 2075 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, 2076 int nr) 2077 { 2078 int i; 2079 2080 xp->xfrm_nr = nr; 2081 for (i = 0; i < nr; i++, ut++) { 2082 struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 2083 2084 memcpy(&t->id, &ut->id, sizeof(struct xfrm_id)); 2085 memcpy(&t->saddr, &ut->saddr, 2086 sizeof(xfrm_address_t)); 2087 t->reqid = ut->reqid; 2088 t->mode = ut->mode; 2089 t->share = ut->share; 2090 t->optional = ut->optional; 2091 t->aalgos = ut->aalgos; 2092 t->ealgos = ut->ealgos; 2093 t->calgos = ut->calgos; 2094 /* If all masks are ~0, then we allow all algorithms. */ 2095 t->allalgs = !~(t->aalgos & t->ealgos & t->calgos); 2096 t->encap_family = ut->family; 2097 } 2098 } 2099 2100 static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family, 2101 int dir, struct netlink_ext_ack *extack) 2102 { 2103 u16 prev_family; 2104 int i; 2105 2106 if (nr > XFRM_MAX_DEPTH) { 2107 NL_SET_ERR_MSG(extack, "Template count must be <= XFRM_MAX_DEPTH (" __stringify(XFRM_MAX_DEPTH) ")"); 2108 return -EINVAL; 2109 } 2110 2111 prev_family = family; 2112 2113 for (i = 0; i < nr; i++) { 2114 /* We never validated the ut->family value, so many 2115 * applications simply leave it at zero. The check was 2116 * never made and ut->family was ignored because all 2117 * templates could be assumed to have the same family as 2118 * the policy itself. Now that we will have ipv4-in-ipv6 2119 * and ipv6-in-ipv4 tunnels, this is no longer true. 2120 */ 2121 if (!ut[i].family) 2122 ut[i].family = family; 2123 2124 switch (ut[i].mode) { 2125 case XFRM_MODE_TUNNEL: 2126 case XFRM_MODE_BEET: 2127 case XFRM_MODE_IPTFS: 2128 if (ut[i].optional && dir == XFRM_POLICY_OUT) { 2129 NL_SET_ERR_MSG(extack, "Mode in optional template not allowed in outbound policy"); 2130 return -EINVAL; 2131 } 2132 break; 2133 default: 2134 if (ut[i].family != prev_family) { 2135 NL_SET_ERR_MSG(extack, "Mode in template doesn't support a family change"); 2136 return -EINVAL; 2137 } 2138 break; 2139 } 2140 if (ut[i].mode >= XFRM_MODE_MAX) { 2141 NL_SET_ERR_MSG(extack, "Mode in template must be < XFRM_MODE_MAX (" __stringify(XFRM_MODE_MAX) ")"); 2142 return -EINVAL; 2143 } 2144 2145 prev_family = ut[i].family; 2146 2147 switch (ut[i].family) { 2148 case AF_INET: 2149 break; 2150 #if IS_ENABLED(CONFIG_IPV6) 2151 case AF_INET6: 2152 break; 2153 #endif 2154 default: 2155 NL_SET_ERR_MSG(extack, "Invalid family in template"); 2156 return -EINVAL; 2157 } 2158 2159 if (!xfrm_id_proto_valid(ut[i].id.proto)) { 2160 NL_SET_ERR_MSG(extack, "Invalid XFRM protocol in template"); 2161 return -EINVAL; 2162 } 2163 } 2164 2165 return 0; 2166 } 2167 2168 static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs, 2169 int dir, struct netlink_ext_ack *extack) 2170 { 2171 struct nlattr *rt = attrs[XFRMA_TMPL]; 2172 2173 if (!rt) { 2174 pol->xfrm_nr = 0; 2175 } else { 2176 struct xfrm_user_tmpl *utmpl = nla_data(rt); 2177 int nr = nla_len(rt) / sizeof(*utmpl); 2178 int err; 2179 2180 err = validate_tmpl(nr, utmpl, pol->family, dir, extack); 2181 if (err) 2182 return err; 2183 2184 copy_templates(pol, utmpl, nr); 2185 } 2186 return 0; 2187 } 2188 2189 static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs, 2190 struct netlink_ext_ack *extack) 2191 { 2192 struct nlattr *rt = attrs[XFRMA_POLICY_TYPE]; 2193 struct xfrm_userpolicy_type *upt; 2194 u8 type = XFRM_POLICY_TYPE_MAIN; 2195 int err; 2196 2197 if (rt) { 2198 upt = nla_data(rt); 2199 type = upt->type; 2200 } 2201 2202 err = verify_policy_type(type, extack); 2203 if (err) 2204 return err; 2205 2206 *tp = type; 2207 return 0; 2208 } 2209 2210 static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p) 2211 { 2212 xp->priority = p->priority; 2213 xp->index = p->index; 2214 memcpy(&xp->selector, &p->sel, sizeof(xp->selector)); 2215 memcpy(&xp->lft, &p->lft, sizeof(xp->lft)); 2216 xp->action = p->action; 2217 xp->flags = p->flags; 2218 xp->family = p->sel.family; 2219 /* XXX xp->share = p->share; */ 2220 } 2221 2222 static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir) 2223 { 2224 memset(p, 0, sizeof(*p)); 2225 memcpy(&p->sel, &xp->selector, sizeof(p->sel)); 2226 memcpy(&p->lft, &xp->lft, sizeof(p->lft)); 2227 memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft)); 2228 p->priority = xp->priority; 2229 p->index = xp->index; 2230 p->sel.family = xp->family; 2231 p->dir = dir; 2232 p->action = xp->action; 2233 p->flags = xp->flags; 2234 p->share = XFRM_SHARE_ANY; /* XXX xp->share */ 2235 } 2236 2237 static struct xfrm_policy *xfrm_policy_construct(struct net *net, 2238 struct xfrm_userpolicy_info *p, 2239 struct nlattr **attrs, 2240 int *errp, 2241 struct netlink_ext_ack *extack) 2242 { 2243 struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL); 2244 int err; 2245 2246 if (!xp) { 2247 *errp = -ENOMEM; 2248 return NULL; 2249 } 2250 2251 copy_from_user_policy(xp, p); 2252 2253 err = copy_from_user_policy_type(&xp->type, attrs, extack); 2254 if (err) 2255 goto error; 2256 2257 if (!(err = copy_from_user_tmpl(xp, attrs, p->dir, extack))) 2258 err = copy_from_user_sec_ctx(xp, attrs); 2259 if (err) 2260 goto error; 2261 2262 xfrm_mark_get(attrs, &xp->mark); 2263 2264 if (attrs[XFRMA_IF_ID]) 2265 xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 2266 2267 /* configure the hardware if offload is requested */ 2268 if (attrs[XFRMA_OFFLOAD_DEV]) { 2269 err = xfrm_dev_policy_add(net, xp, 2270 nla_data(attrs[XFRMA_OFFLOAD_DEV]), 2271 p->dir, extack); 2272 if (err) 2273 goto error; 2274 } 2275 2276 return xp; 2277 error: 2278 *errp = err; 2279 xp->walk.dead = 1; 2280 xfrm_policy_destroy(xp); 2281 return NULL; 2282 } 2283 2284 static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 2285 struct nlattr **attrs, 2286 struct netlink_ext_ack *extack) 2287 { 2288 struct net *net = sock_net(skb->sk); 2289 struct xfrm_userpolicy_info *p = nlmsg_data(nlh); 2290 struct xfrm_policy *xp; 2291 struct km_event c; 2292 int err; 2293 int excl; 2294 2295 err = verify_newpolicy_info(p, extack); 2296 if (err) 2297 return err; 2298 err = verify_sec_ctx_len(attrs, extack); 2299 if (err) 2300 return err; 2301 2302 xp = xfrm_policy_construct(net, p, attrs, &err, extack); 2303 if (!xp) 2304 return err; 2305 2306 /* shouldn't excl be based on nlh flags?? 2307 * Aha! this is anti-netlink really i.e more pfkey derived 2308 * in netlink excl is a flag and you wouldn't need 2309 * a type XFRM_MSG_UPDPOLICY - JHS */ 2310 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; 2311 err = xfrm_policy_insert(p->dir, xp, excl); 2312 xfrm_audit_policy_add(xp, err ? 0 : 1, true); 2313 2314 if (err) { 2315 xfrm_dev_policy_delete(xp); 2316 xp->walk.dead = 1; 2317 xfrm_policy_destroy(xp); 2318 return err; 2319 } 2320 2321 c.event = nlh->nlmsg_type; 2322 c.seq = nlh->nlmsg_seq; 2323 c.portid = nlh->nlmsg_pid; 2324 km_policy_notify(xp, p->dir, &c); 2325 2326 xfrm_pol_put(xp); 2327 2328 return 0; 2329 } 2330 2331 static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb) 2332 { 2333 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH]; 2334 int i; 2335 2336 if (xp->xfrm_nr == 0) 2337 return 0; 2338 2339 if (xp->xfrm_nr > XFRM_MAX_DEPTH) 2340 return -ENOBUFS; 2341 2342 for (i = 0; i < xp->xfrm_nr; i++) { 2343 struct xfrm_user_tmpl *up = &vec[i]; 2344 struct xfrm_tmpl *kp = &xp->xfrm_vec[i]; 2345 2346 memset(up, 0, sizeof(*up)); 2347 memcpy(&up->id, &kp->id, sizeof(up->id)); 2348 up->family = kp->encap_family; 2349 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr)); 2350 up->reqid = kp->reqid; 2351 up->mode = kp->mode; 2352 up->share = kp->share; 2353 up->optional = kp->optional; 2354 up->aalgos = kp->aalgos; 2355 up->ealgos = kp->ealgos; 2356 up->calgos = kp->calgos; 2357 } 2358 2359 return nla_put(skb, XFRMA_TMPL, 2360 sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec); 2361 } 2362 2363 static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb) 2364 { 2365 if (x->security) { 2366 return copy_sec_ctx(x->security, skb); 2367 } 2368 return 0; 2369 } 2370 2371 static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb) 2372 { 2373 if (xp->security) 2374 return copy_sec_ctx(xp->security, skb); 2375 return 0; 2376 } 2377 static inline unsigned int userpolicy_type_attrsize(void) 2378 { 2379 #ifdef CONFIG_XFRM_SUB_POLICY 2380 return nla_total_size(sizeof(struct xfrm_userpolicy_type)); 2381 #else 2382 return 0; 2383 #endif 2384 } 2385 2386 #ifdef CONFIG_XFRM_SUB_POLICY 2387 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 2388 { 2389 struct xfrm_userpolicy_type upt; 2390 2391 /* Sadly there are two holes in struct xfrm_userpolicy_type */ 2392 memset(&upt, 0, sizeof(upt)); 2393 upt.type = type; 2394 2395 return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt); 2396 } 2397 2398 #else 2399 static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 2400 { 2401 return 0; 2402 } 2403 #endif 2404 2405 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr) 2406 { 2407 struct xfrm_dump_info *sp = ptr; 2408 struct xfrm_userpolicy_info *p; 2409 struct sk_buff *in_skb = sp->in_skb; 2410 struct sk_buff *skb = sp->out_skb; 2411 struct xfrm_translator *xtr; 2412 struct nlmsghdr *nlh; 2413 int err; 2414 2415 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 2416 XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags); 2417 if (nlh == NULL) 2418 return -EMSGSIZE; 2419 2420 p = nlmsg_data(nlh); 2421 copy_to_user_policy(xp, p, dir); 2422 err = copy_to_user_tmpl(xp, skb); 2423 if (!err) 2424 err = copy_to_user_sec_ctx(xp, skb); 2425 if (!err) 2426 err = copy_to_user_policy_type(xp->type, skb); 2427 if (!err) 2428 err = xfrm_mark_put(skb, &xp->mark); 2429 if (!err) 2430 err = xfrm_if_id_put(skb, xp->if_id); 2431 if (!err && xp->xdo.dev) 2432 err = copy_user_offload(&xp->xdo, skb); 2433 if (err) { 2434 nlmsg_cancel(skb, nlh); 2435 return err; 2436 } 2437 nlmsg_end(skb, nlh); 2438 2439 xtr = xfrm_get_translator(); 2440 if (xtr) { 2441 err = xtr->alloc_compat(skb, nlh); 2442 2443 xfrm_put_translator(xtr); 2444 if (err) { 2445 nlmsg_cancel(skb, nlh); 2446 return err; 2447 } 2448 } 2449 2450 return 0; 2451 } 2452 2453 static int xfrm_dump_policy_done(struct netlink_callback *cb) 2454 { 2455 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; 2456 struct net *net = sock_net(cb->skb->sk); 2457 2458 xfrm_policy_walk_done(walk, net); 2459 return 0; 2460 } 2461 2462 static int xfrm_dump_policy_start(struct netlink_callback *cb) 2463 { 2464 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; 2465 2466 BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args)); 2467 2468 xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY); 2469 return 0; 2470 } 2471 2472 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb) 2473 { 2474 struct net *net = sock_net(skb->sk); 2475 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; 2476 struct xfrm_dump_info info; 2477 2478 info.in_skb = cb->skb; 2479 info.out_skb = skb; 2480 info.nlmsg_seq = cb->nlh->nlmsg_seq; 2481 info.nlmsg_flags = NLM_F_MULTI; 2482 2483 (void) xfrm_policy_walk(net, walk, dump_one_policy, &info); 2484 2485 return skb->len; 2486 } 2487 2488 static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, 2489 struct xfrm_policy *xp, 2490 int dir, u32 seq) 2491 { 2492 struct xfrm_dump_info info; 2493 struct sk_buff *skb; 2494 int err; 2495 2496 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2497 if (!skb) 2498 return ERR_PTR(-ENOMEM); 2499 2500 info.in_skb = in_skb; 2501 info.out_skb = skb; 2502 info.nlmsg_seq = seq; 2503 info.nlmsg_flags = 0; 2504 2505 err = dump_one_policy(xp, dir, 0, &info); 2506 if (err) { 2507 kfree_skb(skb); 2508 return ERR_PTR(err); 2509 } 2510 2511 return skb; 2512 } 2513 2514 static int xfrm_notify_userpolicy(struct net *net) 2515 { 2516 struct xfrm_userpolicy_default *up; 2517 int len = NLMSG_ALIGN(sizeof(*up)); 2518 struct nlmsghdr *nlh; 2519 struct sk_buff *skb; 2520 int err; 2521 2522 skb = nlmsg_new(len, GFP_ATOMIC); 2523 if (skb == NULL) 2524 return -ENOMEM; 2525 2526 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_GETDEFAULT, sizeof(*up), 0); 2527 if (nlh == NULL) { 2528 kfree_skb(skb); 2529 return -EMSGSIZE; 2530 } 2531 2532 up = nlmsg_data(nlh); 2533 up->in = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN]); 2534 up->fwd = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD]); 2535 up->out = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]); 2536 2537 nlmsg_end(skb, nlh); 2538 2539 rcu_read_lock(); 2540 err = xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 2541 rcu_read_unlock(); 2542 2543 return err; 2544 } 2545 2546 static bool xfrm_userpolicy_is_valid(__u8 policy) 2547 { 2548 return policy == XFRM_USERPOLICY_BLOCK || 2549 policy == XFRM_USERPOLICY_ACCEPT; 2550 } 2551 2552 static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh, 2553 struct nlattr **attrs, struct netlink_ext_ack *extack) 2554 { 2555 struct net *net = sock_net(skb->sk); 2556 struct xfrm_userpolicy_default *up = nlmsg_data(nlh); 2557 2558 if (xfrm_userpolicy_is_valid(up->in)) 2559 WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN], up->in); 2560 2561 if (xfrm_userpolicy_is_valid(up->fwd)) 2562 WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD], up->fwd); 2563 2564 if (xfrm_userpolicy_is_valid(up->out)) 2565 WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT], up->out); 2566 2567 rt_genid_bump_all(net); 2568 2569 xfrm_notify_userpolicy(net); 2570 return 0; 2571 } 2572 2573 static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh, 2574 struct nlattr **attrs, struct netlink_ext_ack *extack) 2575 { 2576 struct sk_buff *r_skb; 2577 struct nlmsghdr *r_nlh; 2578 struct net *net = sock_net(skb->sk); 2579 struct xfrm_userpolicy_default *r_up; 2580 int len = NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_default)); 2581 u32 portid = NETLINK_CB(skb).portid; 2582 u32 seq = nlh->nlmsg_seq; 2583 2584 r_skb = nlmsg_new(len, GFP_ATOMIC); 2585 if (!r_skb) 2586 return -ENOMEM; 2587 2588 r_nlh = nlmsg_put(r_skb, portid, seq, XFRM_MSG_GETDEFAULT, sizeof(*r_up), 0); 2589 if (!r_nlh) { 2590 kfree_skb(r_skb); 2591 return -EMSGSIZE; 2592 } 2593 2594 r_up = nlmsg_data(r_nlh); 2595 r_up->in = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN]); 2596 r_up->fwd = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD]); 2597 r_up->out = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]); 2598 nlmsg_end(r_skb, r_nlh); 2599 2600 return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, portid); 2601 } 2602 2603 static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 2604 struct nlattr **attrs, 2605 struct netlink_ext_ack *extack) 2606 { 2607 struct net *net = sock_net(skb->sk); 2608 struct xfrm_policy *xp; 2609 struct xfrm_userpolicy_id *p; 2610 u8 type = XFRM_POLICY_TYPE_MAIN; 2611 int err; 2612 struct km_event c; 2613 int delete; 2614 struct xfrm_mark m; 2615 u32 if_id = 0; 2616 2617 p = nlmsg_data(nlh); 2618 delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY; 2619 2620 err = copy_from_user_policy_type(&type, attrs, extack); 2621 if (err) 2622 return err; 2623 2624 err = verify_policy_dir(p->dir, extack); 2625 if (err) 2626 return err; 2627 2628 if (attrs[XFRMA_IF_ID]) 2629 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 2630 2631 xfrm_mark_get(attrs, &m); 2632 2633 if (p->index) 2634 xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, 2635 p->index, delete, &err); 2636 else { 2637 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 2638 struct xfrm_sec_ctx *ctx; 2639 2640 err = verify_sec_ctx_len(attrs, extack); 2641 if (err) 2642 return err; 2643 2644 ctx = NULL; 2645 if (rt) { 2646 struct xfrm_user_sec_ctx *uctx = nla_data(rt); 2647 2648 err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 2649 if (err) 2650 return err; 2651 } 2652 xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir, 2653 &p->sel, ctx, delete, &err); 2654 security_xfrm_policy_free(ctx); 2655 } 2656 if (xp == NULL) 2657 return -ENOENT; 2658 2659 if (!delete) { 2660 struct sk_buff *resp_skb; 2661 2662 resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq); 2663 if (IS_ERR(resp_skb)) { 2664 err = PTR_ERR(resp_skb); 2665 } else { 2666 err = nlmsg_unicast(xfrm_net_nlsk(net, skb), resp_skb, 2667 NETLINK_CB(skb).portid); 2668 } 2669 } else { 2670 xfrm_audit_policy_delete(xp, err ? 0 : 1, true); 2671 2672 if (err != 0) 2673 goto out; 2674 2675 c.data.byid = p->index; 2676 c.event = nlh->nlmsg_type; 2677 c.seq = nlh->nlmsg_seq; 2678 c.portid = nlh->nlmsg_pid; 2679 km_policy_notify(xp, p->dir, &c); 2680 } 2681 2682 out: 2683 xfrm_pol_put(xp); 2684 return err; 2685 } 2686 2687 static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 2688 struct nlattr **attrs, 2689 struct netlink_ext_ack *extack) 2690 { 2691 struct net *net = sock_net(skb->sk); 2692 struct km_event c; 2693 struct xfrm_usersa_flush *p = nlmsg_data(nlh); 2694 int err; 2695 2696 err = xfrm_state_flush(net, p->proto, true); 2697 if (err) { 2698 if (err == -ESRCH) /* empty table */ 2699 return 0; 2700 return err; 2701 } 2702 c.data.proto = p->proto; 2703 c.event = nlh->nlmsg_type; 2704 c.seq = nlh->nlmsg_seq; 2705 c.portid = nlh->nlmsg_pid; 2706 c.net = net; 2707 km_state_notify(NULL, &c); 2708 2709 return 0; 2710 } 2711 2712 static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x) 2713 { 2714 unsigned int replay_size = x->replay_esn ? 2715 xfrm_replay_state_esn_len(x->replay_esn) : 2716 sizeof(struct xfrm_replay_state); 2717 2718 return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id)) 2719 + nla_total_size(replay_size) 2720 + nla_total_size_64bit(sizeof(struct xfrm_lifetime_cur)) 2721 + nla_total_size(sizeof(struct xfrm_mark)) 2722 + nla_total_size(4) /* XFRM_AE_RTHR */ 2723 + nla_total_size(4) /* XFRM_AE_ETHR */ 2724 + nla_total_size(sizeof(x->dir)) /* XFRMA_SA_DIR */ 2725 + nla_total_size(4) /* XFRMA_SA_PCPU */ 2726 + nla_total_size(sizeof(x->if_id)); /* XFRMA_IF_ID */ 2727 } 2728 2729 static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 2730 { 2731 struct xfrm_aevent_id *id; 2732 struct nlmsghdr *nlh; 2733 int err; 2734 2735 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0); 2736 if (nlh == NULL) 2737 return -EMSGSIZE; 2738 2739 id = nlmsg_data(nlh); 2740 memset(&id->sa_id, 0, sizeof(id->sa_id)); 2741 memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr)); 2742 id->sa_id.spi = x->id.spi; 2743 id->sa_id.family = x->props.family; 2744 id->sa_id.proto = x->id.proto; 2745 memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr)); 2746 id->reqid = x->props.reqid; 2747 id->flags = c->data.aevent; 2748 2749 if (x->replay_esn) { 2750 err = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 2751 xfrm_replay_state_esn_len(x->replay_esn), 2752 x->replay_esn); 2753 } else { 2754 err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 2755 &x->replay); 2756 } 2757 if (err) 2758 goto out_cancel; 2759 err = nla_put_64bit(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft, 2760 XFRMA_PAD); 2761 if (err) 2762 goto out_cancel; 2763 2764 if (id->flags & XFRM_AE_RTHR) { 2765 err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff); 2766 if (err) 2767 goto out_cancel; 2768 } 2769 if (id->flags & XFRM_AE_ETHR) { 2770 err = nla_put_u32(skb, XFRMA_ETIMER_THRESH, 2771 x->replay_maxage * 10 / HZ); 2772 if (err) 2773 goto out_cancel; 2774 } 2775 err = xfrm_mark_put(skb, &x->mark); 2776 if (err) 2777 goto out_cancel; 2778 2779 err = xfrm_if_id_put(skb, x->if_id); 2780 if (err) 2781 goto out_cancel; 2782 if (x->pcpu_num != UINT_MAX) { 2783 err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 2784 if (err) 2785 goto out_cancel; 2786 } 2787 2788 if (x->dir) { 2789 err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); 2790 if (err) 2791 goto out_cancel; 2792 } 2793 2794 nlmsg_end(skb, nlh); 2795 return 0; 2796 2797 out_cancel: 2798 nlmsg_cancel(skb, nlh); 2799 return err; 2800 } 2801 2802 static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 2803 struct nlattr **attrs, struct netlink_ext_ack *extack) 2804 { 2805 struct net *net = sock_net(skb->sk); 2806 struct xfrm_state *x; 2807 struct sk_buff *r_skb; 2808 int err; 2809 struct km_event c; 2810 u32 mark; 2811 struct xfrm_mark m; 2812 struct xfrm_aevent_id *p = nlmsg_data(nlh); 2813 struct xfrm_usersa_id *id = &p->sa_id; 2814 2815 mark = xfrm_mark_get(attrs, &m); 2816 2817 x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family); 2818 if (x == NULL) 2819 return -ESRCH; 2820 2821 r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 2822 if (r_skb == NULL) { 2823 xfrm_state_put(x); 2824 return -ENOMEM; 2825 } 2826 2827 /* 2828 * XXX: is this lock really needed - none of the other 2829 * gets lock (the concern is things getting updated 2830 * while we are still reading) - jhs 2831 */ 2832 spin_lock_bh(&x->lock); 2833 c.data.aevent = p->flags; 2834 c.seq = nlh->nlmsg_seq; 2835 c.portid = nlh->nlmsg_pid; 2836 2837 err = build_aevent(r_skb, x, &c); 2838 if (err < 0) { 2839 spin_unlock_bh(&x->lock); 2840 xfrm_state_put(x); 2841 kfree_skb(r_skb); 2842 return err; 2843 } 2844 2845 err = nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, NETLINK_CB(skb).portid); 2846 spin_unlock_bh(&x->lock); 2847 xfrm_state_put(x); 2848 return err; 2849 } 2850 2851 static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 2852 struct nlattr **attrs, struct netlink_ext_ack *extack) 2853 { 2854 struct net *net = sock_net(skb->sk); 2855 struct xfrm_state *x; 2856 struct km_event c; 2857 int err = -EINVAL; 2858 u32 mark = 0; 2859 struct xfrm_mark m; 2860 struct xfrm_aevent_id *p = nlmsg_data(nlh); 2861 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 2862 struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL]; 2863 struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 2864 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 2865 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 2866 2867 if (!lt && !rp && !re && !et && !rt) { 2868 NL_SET_ERR_MSG(extack, "Missing required attribute for AE"); 2869 return err; 2870 } 2871 2872 /* pedantic mode - thou shalt sayeth replaceth */ 2873 if (!(nlh->nlmsg_flags & NLM_F_REPLACE)) { 2874 NL_SET_ERR_MSG(extack, "NLM_F_REPLACE flag is required"); 2875 return err; 2876 } 2877 2878 mark = xfrm_mark_get(attrs, &m); 2879 2880 x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family); 2881 if (x == NULL) 2882 return -ESRCH; 2883 2884 if (x->km.state != XFRM_STATE_VALID) { 2885 NL_SET_ERR_MSG(extack, "SA must be in VALID state"); 2886 goto out; 2887 } 2888 2889 err = xfrm_replay_verify_len(x->replay_esn, re, extack); 2890 if (err) 2891 goto out; 2892 2893 spin_lock_bh(&x->lock); 2894 xfrm_update_ae_params(x, attrs, 1); 2895 spin_unlock_bh(&x->lock); 2896 2897 c.event = nlh->nlmsg_type; 2898 c.seq = nlh->nlmsg_seq; 2899 c.portid = nlh->nlmsg_pid; 2900 c.data.aevent = XFRM_AE_CU; 2901 km_state_notify(x, &c); 2902 err = 0; 2903 out: 2904 xfrm_state_put(x); 2905 return err; 2906 } 2907 2908 static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 2909 struct nlattr **attrs, 2910 struct netlink_ext_ack *extack) 2911 { 2912 struct net *net = sock_net(skb->sk); 2913 struct km_event c; 2914 u8 type = XFRM_POLICY_TYPE_MAIN; 2915 int err; 2916 2917 err = copy_from_user_policy_type(&type, attrs, extack); 2918 if (err) 2919 return err; 2920 2921 err = xfrm_policy_flush(net, type, true); 2922 if (err) { 2923 if (err == -ESRCH) /* empty table */ 2924 return 0; 2925 return err; 2926 } 2927 2928 c.data.type = type; 2929 c.event = nlh->nlmsg_type; 2930 c.seq = nlh->nlmsg_seq; 2931 c.portid = nlh->nlmsg_pid; 2932 c.net = net; 2933 km_policy_notify(NULL, 0, &c); 2934 return 0; 2935 } 2936 2937 static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 2938 struct nlattr **attrs, 2939 struct netlink_ext_ack *extack) 2940 { 2941 struct net *net = sock_net(skb->sk); 2942 struct xfrm_policy *xp; 2943 struct xfrm_user_polexpire *up = nlmsg_data(nlh); 2944 struct xfrm_userpolicy_info *p = &up->pol; 2945 u8 type = XFRM_POLICY_TYPE_MAIN; 2946 int err = -ENOENT; 2947 struct xfrm_mark m; 2948 u32 if_id = 0; 2949 2950 err = copy_from_user_policy_type(&type, attrs, extack); 2951 if (err) 2952 return err; 2953 2954 err = verify_policy_dir(p->dir, extack); 2955 if (err) 2956 return err; 2957 2958 if (attrs[XFRMA_IF_ID]) 2959 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 2960 2961 xfrm_mark_get(attrs, &m); 2962 2963 if (p->index) 2964 xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index, 2965 0, &err); 2966 else { 2967 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 2968 struct xfrm_sec_ctx *ctx; 2969 2970 err = verify_sec_ctx_len(attrs, extack); 2971 if (err) 2972 return err; 2973 2974 ctx = NULL; 2975 if (rt) { 2976 struct xfrm_user_sec_ctx *uctx = nla_data(rt); 2977 2978 err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 2979 if (err) 2980 return err; 2981 } 2982 xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir, 2983 &p->sel, ctx, 0, &err); 2984 security_xfrm_policy_free(ctx); 2985 } 2986 if (xp == NULL) 2987 return -ENOENT; 2988 2989 if (unlikely(xp->walk.dead)) 2990 goto out; 2991 2992 err = 0; 2993 if (up->hard) { 2994 xfrm_policy_delete(xp, p->dir); 2995 xfrm_audit_policy_delete(xp, 1, true); 2996 } 2997 km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid); 2998 2999 out: 3000 xfrm_pol_put(xp); 3001 return err; 3002 } 3003 3004 static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 3005 struct nlattr **attrs, 3006 struct netlink_ext_ack *extack) 3007 { 3008 struct net *net = sock_net(skb->sk); 3009 struct xfrm_state *x; 3010 int err; 3011 struct xfrm_user_expire *ue = nlmsg_data(nlh); 3012 struct xfrm_usersa_info *p = &ue->state; 3013 struct xfrm_mark m; 3014 u32 mark = xfrm_mark_get(attrs, &m); 3015 3016 x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family); 3017 3018 err = -ENOENT; 3019 if (x == NULL) 3020 return err; 3021 3022 spin_lock_bh(&x->lock); 3023 err = -EINVAL; 3024 if (x->km.state != XFRM_STATE_VALID) { 3025 NL_SET_ERR_MSG(extack, "SA must be in VALID state"); 3026 goto out; 3027 } 3028 3029 km_state_expired(x, ue->hard, nlh->nlmsg_pid); 3030 3031 if (ue->hard) { 3032 __xfrm_state_delete(x); 3033 xfrm_audit_state_delete(x, 1, true); 3034 } 3035 err = 0; 3036 out: 3037 spin_unlock_bh(&x->lock); 3038 xfrm_state_put(x); 3039 return err; 3040 } 3041 3042 static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, 3043 struct nlattr **attrs, 3044 struct netlink_ext_ack *extack) 3045 { 3046 struct net *net = sock_net(skb->sk); 3047 struct xfrm_policy *xp; 3048 struct xfrm_user_tmpl *ut; 3049 int i; 3050 struct nlattr *rt = attrs[XFRMA_TMPL]; 3051 struct xfrm_mark mark; 3052 3053 struct xfrm_user_acquire *ua = nlmsg_data(nlh); 3054 struct xfrm_state *x = xfrm_state_alloc(net); 3055 int err = -ENOMEM; 3056 3057 if (!x) 3058 goto nomem; 3059 3060 xfrm_mark_get(attrs, &mark); 3061 3062 if (attrs[XFRMA_SA_PCPU]) { 3063 x->pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); 3064 err = -EINVAL; 3065 if (x->pcpu_num >= num_possible_cpus()) { 3066 NL_SET_ERR_MSG(extack, "pCPU number too big"); 3067 goto free_state; 3068 } 3069 } 3070 3071 err = verify_newpolicy_info(&ua->policy, extack); 3072 if (err) 3073 goto free_state; 3074 err = verify_sec_ctx_len(attrs, extack); 3075 if (err) 3076 goto free_state; 3077 3078 /* build an XP */ 3079 xp = xfrm_policy_construct(net, &ua->policy, attrs, &err, extack); 3080 if (!xp) 3081 goto free_state; 3082 3083 memcpy(&x->id, &ua->id, sizeof(ua->id)); 3084 memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr)); 3085 memcpy(&x->sel, &ua->sel, sizeof(ua->sel)); 3086 xp->mark.m = x->mark.m = mark.m; 3087 xp->mark.v = x->mark.v = mark.v; 3088 ut = nla_data(rt); 3089 /* extract the templates and for each call km_key */ 3090 for (i = 0; i < xp->xfrm_nr; i++, ut++) { 3091 struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 3092 memcpy(&x->id, &t->id, sizeof(x->id)); 3093 x->props.mode = t->mode; 3094 x->props.reqid = t->reqid; 3095 x->props.family = ut->family; 3096 t->aalgos = ua->aalgos; 3097 t->ealgos = ua->ealgos; 3098 t->calgos = ua->calgos; 3099 err = km_query(x, t, xp); 3100 3101 } 3102 3103 xfrm_state_free(x); 3104 xfrm_dev_policy_delete(xp); 3105 xfrm_dev_policy_free(xp); 3106 security_xfrm_policy_free(xp->security); 3107 kfree(xp); 3108 3109 return 0; 3110 3111 free_state: 3112 xfrm_state_free(x); 3113 nomem: 3114 return err; 3115 } 3116 3117 #ifdef CONFIG_XFRM_MIGRATE 3118 static void copy_from_user_migrate_state(struct xfrm_migrate *ma, 3119 const struct xfrm_user_migrate_state *um) 3120 { 3121 memcpy(&ma->old_daddr, &um->id.daddr, sizeof(ma->old_daddr)); 3122 memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr)); 3123 memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr)); 3124 3125 ma->proto = um->id.proto; 3126 ma->new_reqid = um->new_reqid; 3127 3128 ma->old_family = um->id.family; 3129 ma->new_family = um->new_family; 3130 3131 ma->old_mark = um->old_mark; 3132 ma->flags = um->flags; 3133 ma->new_sel = &um->new_sel; 3134 ma->msg_type = XFRM_MSG_MIGRATE_STATE; 3135 } 3136 3137 static int copy_from_user_migrate(struct xfrm_migrate *ma, 3138 struct xfrm_kmaddress *k, 3139 struct nlattr **attrs, int *num, 3140 struct netlink_ext_ack *extack) 3141 { 3142 struct nlattr *rt = attrs[XFRMA_MIGRATE]; 3143 struct xfrm_user_migrate *um; 3144 int i, num_migrate; 3145 3146 if (k != NULL) { 3147 struct xfrm_user_kmaddress *uk; 3148 3149 uk = nla_data(attrs[XFRMA_KMADDRESS]); 3150 memcpy(&k->local, &uk->local, sizeof(k->local)); 3151 memcpy(&k->remote, &uk->remote, sizeof(k->remote)); 3152 k->family = uk->family; 3153 k->reserved = uk->reserved; 3154 } 3155 3156 um = nla_data(rt); 3157 num_migrate = nla_len(rt) / sizeof(*um); 3158 3159 if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH) { 3160 NL_SET_ERR_MSG(extack, "Invalid number of SAs to migrate, must be 0 < num <= XFRM_MAX_DEPTH (6)"); 3161 return -EINVAL; 3162 } 3163 3164 for (i = 0; i < num_migrate; i++, um++, ma++) { 3165 memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr)); 3166 memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr)); 3167 memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr)); 3168 memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr)); 3169 3170 ma->proto = um->proto; 3171 ma->mode = um->mode; 3172 ma->old_reqid = um->reqid; 3173 3174 ma->old_family = um->old_family; 3175 ma->new_family = um->new_family; 3176 ma->msg_type = XFRM_MSG_MIGRATE; 3177 } 3178 3179 *num = i; 3180 return 0; 3181 } 3182 3183 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 3184 struct nlattr **attrs, struct netlink_ext_ack *extack) 3185 { 3186 struct xfrm_userpolicy_id *pi = nlmsg_data(nlh); 3187 struct xfrm_migrate m[XFRM_MAX_DEPTH] = {}; 3188 struct xfrm_kmaddress km, *kmp; 3189 u8 type; 3190 int err; 3191 int n = 0; 3192 struct net *net = sock_net(skb->sk); 3193 struct xfrm_encap_tmpl *encap = NULL; 3194 struct xfrm_user_offload *xuo = NULL; 3195 u32 if_id = 0; 3196 3197 if (!attrs[XFRMA_MIGRATE]) { 3198 NL_SET_ERR_MSG(extack, "Missing required MIGRATE attribute"); 3199 return -EINVAL; 3200 } 3201 3202 kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL; 3203 3204 err = copy_from_user_policy_type(&type, attrs, extack); 3205 if (err) 3206 return err; 3207 3208 err = copy_from_user_migrate(m, kmp, attrs, &n, extack); 3209 if (err) 3210 return err; 3211 3212 if (!n) 3213 return 0; 3214 3215 if (attrs[XFRMA_ENCAP]) { 3216 encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 3217 sizeof(*encap), GFP_KERNEL); 3218 if (!encap) 3219 return -ENOMEM; 3220 } 3221 3222 if (attrs[XFRMA_IF_ID]) 3223 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 3224 3225 if (attrs[XFRMA_OFFLOAD_DEV]) { 3226 xuo = kmemdup(nla_data(attrs[XFRMA_OFFLOAD_DEV]), 3227 sizeof(*xuo), GFP_KERNEL); 3228 if (!xuo) { 3229 err = -ENOMEM; 3230 goto error; 3231 } 3232 } 3233 err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap, 3234 if_id, extack, xuo); 3235 error: 3236 kfree(encap); 3237 kfree(xuo); 3238 return err; 3239 } 3240 3241 static int build_migrate_state(struct sk_buff *skb, 3242 const struct xfrm_user_migrate_state *um, 3243 const struct xfrm_migrate *m, 3244 u8 dir, u32 portid, u32 seq) 3245 { 3246 int err; 3247 struct nlmsghdr *nlh; 3248 struct xfrm_user_migrate_state *hdr; 3249 3250 nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_MIGRATE_STATE, 3251 sizeof(struct xfrm_user_migrate_state), 0); 3252 if (!nlh) 3253 return -EMSGSIZE; 3254 3255 hdr = nlmsg_data(nlh); 3256 *hdr = *um; 3257 hdr->new_sel = *m->new_sel; 3258 3259 if (m->encap) { 3260 err = nla_put(skb, XFRMA_ENCAP, sizeof(*m->encap), m->encap); 3261 if (err) 3262 goto out_cancel; 3263 } 3264 3265 if (m->xuo) { 3266 err = nla_put(skb, XFRMA_OFFLOAD_DEV, sizeof(*m->xuo), m->xuo); 3267 if (err) 3268 goto out_cancel; 3269 } 3270 3271 if (m->new_mark) { 3272 err = nla_put(skb, XFRMA_MARK, sizeof(*m->new_mark), 3273 m->new_mark); 3274 if (err) 3275 goto out_cancel; 3276 } 3277 3278 err = xfrm_smark_put(skb, &m->smark); 3279 if (err) 3280 goto out_cancel; 3281 3282 if (m->mapping_maxage) { 3283 err = nla_put_u32(skb, XFRMA_MTIMER_THRESH, m->mapping_maxage); 3284 if (err) 3285 goto out_cancel; 3286 } 3287 3288 if (m->nat_keepalive_interval) { 3289 err = nla_put_u32(skb, XFRMA_NAT_KEEPALIVE_INTERVAL, 3290 m->nat_keepalive_interval); 3291 if (err) 3292 goto out_cancel; 3293 } 3294 3295 if (dir) { 3296 err = nla_put_u8(skb, XFRMA_SA_DIR, dir); 3297 if (err) 3298 goto out_cancel; 3299 } 3300 3301 nlmsg_end(skb, nlh); 3302 return 0; 3303 3304 out_cancel: 3305 nlmsg_cancel(skb, nlh); 3306 return err; 3307 } 3308 3309 static unsigned int xfrm_migrate_state_msgsize(const struct xfrm_migrate *m, 3310 u8 dir) 3311 { 3312 return NLMSG_ALIGN(sizeof(struct xfrm_user_migrate_state)) + 3313 (m->encap ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0) + 3314 (m->xuo ? nla_total_size(sizeof(struct xfrm_user_offload)) : 0) + 3315 (m->new_mark ? nla_total_size(sizeof(struct xfrm_mark)) : 0) + 3316 ((m->smark.v | m->smark.m) ? nla_total_size(sizeof(u32)) * 2 : 0) + 3317 (m->mapping_maxage ? nla_total_size(sizeof(u32)) : 0) + 3318 (m->nat_keepalive_interval ? nla_total_size(sizeof(u32)) : 0) + 3319 (dir ? nla_total_size(sizeof(u8)) : 0); /* XFRMA_SA_DIR */ 3320 } 3321 3322 static int xfrm_send_migrate_state(struct net *net, 3323 const struct xfrm_user_migrate_state *um, 3324 const struct xfrm_migrate *m, 3325 u8 dir, u32 portid, u32 seq) 3326 { 3327 int err; 3328 struct sk_buff *skb; 3329 3330 skb = nlmsg_new(xfrm_migrate_state_msgsize(m, dir), GFP_ATOMIC); 3331 if (!skb) 3332 return -ENOMEM; 3333 3334 err = build_migrate_state(skb, um, m, dir, portid, seq); 3335 if (err < 0) { 3336 kfree_skb(skb); 3337 return err; 3338 } 3339 3340 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE); 3341 } 3342 3343 static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, 3344 struct nlattr **attrs, struct netlink_ext_ack *extack) 3345 { 3346 struct xfrm_user_migrate_state *um = nlmsg_data(nlh); 3347 struct net *net = sock_net(skb->sk); 3348 struct xfrm_user_offload xuo = {}; 3349 struct xfrm_migrate m = {}; 3350 struct xfrm_state *xc; 3351 struct xfrm_state *x; 3352 int err; 3353 3354 if (!um->id.spi) { 3355 NL_SET_ERR_MSG(extack, "Invalid SPI 0x0"); 3356 return -EINVAL; 3357 } 3358 3359 if (um->reserved) { 3360 NL_SET_ERR_MSG(extack, "Reserved field must be zero"); 3361 return -EINVAL; 3362 } 3363 3364 if (um->flags & ~XFRM_MIGRATE_STATE_KNOWN_FLAGS) { 3365 NL_SET_ERR_MSG_FMT(extack, "Unknown flags: 0x%x", 3366 um->flags & ~XFRM_MIGRATE_STATE_KNOWN_FLAGS); 3367 return -EINVAL; 3368 } 3369 3370 err = verify_xfrm_family(um->new_family, extack); 3371 if (err) 3372 return err; 3373 3374 if (!(um->flags & XFRM_MIGRATE_STATE_UPDATE_H2H_SEL)) { 3375 err = verify_selector_prefixlen(um->new_sel.family, 3376 &um->new_sel, extack); 3377 if (err) 3378 return err; 3379 } 3380 3381 copy_from_user_migrate_state(&m, um); 3382 3383 x = xfrm_state_lookup(net, m.old_mark.v & m.old_mark.m, 3384 &um->id.daddr, um->id.spi, 3385 um->id.proto, um->id.family); 3386 if (!x) { 3387 NL_SET_ERR_MSG(extack, "Can not find state"); 3388 return -ESRCH; 3389 } 3390 3391 if (um->flags & XFRM_MIGRATE_STATE_UPDATE_H2H_SEL) { 3392 u8 prefixlen = (x->props.family == AF_INET6) ? 128 : 32; 3393 3394 if (x->sel.prefixlen_s != x->sel.prefixlen_d || 3395 x->sel.prefixlen_d != prefixlen || 3396 !xfrm_addr_equal(&x->sel.daddr, &x->id.daddr, x->props.family) || 3397 !xfrm_addr_equal(&x->sel.saddr, &x->props.saddr, x->props.family)) { 3398 NL_SET_ERR_MSG(extack, 3399 "SA selector is not a single-host match for SA addresses"); 3400 err = -EINVAL; 3401 goto out; 3402 } 3403 } 3404 3405 if (attrs[XFRMA_ENCAP]) { 3406 m.encap = nla_data(attrs[XFRMA_ENCAP]); 3407 if (m.encap->encap_type == 0) { 3408 m.encap = NULL; /* sentinel: remove encap */ 3409 } else if (m.encap->encap_type != UDP_ENCAP_ESPINUDP) { 3410 NL_SET_ERR_MSG(extack, "Unsupported encapsulation type"); 3411 err = -EINVAL; 3412 goto out; 3413 } 3414 } else { 3415 m.encap = x->encap; /* omit-to-inherit */ 3416 } 3417 3418 if (attrs[XFRMA_MTIMER_THRESH]) { 3419 err = verify_mtimer_thresh(!!m.encap, x->dir, extack); 3420 if (err) 3421 goto out; 3422 } 3423 3424 if (nla_get_u32_default(attrs[XFRMA_NAT_KEEPALIVE_INTERVAL], 0) && !m.encap) { 3425 NL_SET_ERR_MSG(extack, 3426 "NAT_KEEPALIVE_INTERVAL requires encapsulation"); 3427 err = -EINVAL; 3428 goto out; 3429 } 3430 3431 if (attrs[XFRMA_OFFLOAD_DEV]) { 3432 m.xuo = nla_data(attrs[XFRMA_OFFLOAD_DEV]); 3433 } else { 3434 bool inherit_offload = !(um->flags & XFRM_MIGRATE_STATE_CLEAR_OFFLOAD); 3435 3436 if (inherit_offload && x->xso.dev) { 3437 xso_to_xuo(&x->xso, &xuo); 3438 m.xuo = &xuo; 3439 } 3440 } 3441 3442 if (attrs[XFRMA_MARK]) 3443 m.new_mark = nla_data(attrs[XFRMA_MARK]); 3444 3445 if (attrs[XFRMA_SET_MARK]) 3446 xfrm_smark_init(attrs, &m.smark); 3447 else 3448 m.smark = x->props.smark; 3449 3450 m.mapping_maxage = nla_get_u32_default(attrs[XFRMA_MTIMER_THRESH], 3451 x->mapping_maxage); 3452 m.nat_keepalive_interval = nla_get_u32_default(attrs[XFRMA_NAT_KEEPALIVE_INTERVAL], 3453 x->nat_keepalive_interval); 3454 3455 if (m.new_family != um->id.family || 3456 !xfrm_addr_equal(&m.new_daddr, &um->id.daddr, um->id.family)) { 3457 u32 new_mark_key = m.new_mark ? m.new_mark->v & m.new_mark->m : 3458 m.old_mark.v & m.old_mark.m; 3459 struct xfrm_state *x_new; 3460 3461 x_new = xfrm_state_lookup(net, new_mark_key, &m.new_daddr, 3462 um->id.spi, um->id.proto, m.new_family); 3463 if (x_new) { 3464 xfrm_state_put(x_new); 3465 NL_SET_ERR_MSG(extack, "New SA tuple already occupied"); 3466 err = -EEXIST; 3467 goto out; 3468 } 3469 } 3470 3471 xc = xfrm_state_migrate_create(x, &m, net, extack); 3472 if (!xc) { 3473 NL_SET_ERR_MSG_WEAK(extack, "State migration clone failed"); 3474 err = -EINVAL; 3475 goto out; 3476 } 3477 3478 spin_lock_bh(&x->lock); 3479 if (x->km.state != XFRM_STATE_VALID) { 3480 spin_unlock_bh(&x->lock); 3481 NL_SET_ERR_MSG(extack, "State already deleted"); 3482 err = -ESRCH; 3483 goto out_xc; 3484 } 3485 xfrm_migrate_sync(xc, x); /* to prevent SN/IV reuse */ 3486 __xfrm_state_delete(x); 3487 spin_unlock_bh(&x->lock); 3488 3489 err = xfrm_state_migrate_install(x, xc, &m, extack); 3490 if (err < 0) { 3491 /* 3492 * Should not occur: pre-check above ensures the new tuple is 3493 * free under xfrm_cfg_mutex. Both SAs are gone if it does; 3494 * restoring x would risk SN/IV reuse. 3495 */ 3496 goto out; 3497 } 3498 3499 /* Restore encap cleared by sentinel (type=0) during migration. */ 3500 if (attrs[XFRMA_ENCAP]) 3501 m.encap = nla_data(attrs[XFRMA_ENCAP]); 3502 3503 m.new_sel = &xc->sel; 3504 m.mapping_maxage = xc->mapping_maxage; 3505 m.nat_keepalive_interval = xc->nat_keepalive_interval; 3506 3507 err = xfrm_send_migrate_state(net, um, &m, xc->dir, 3508 nlh->nlmsg_pid, nlh->nlmsg_seq); 3509 if (err < 0) { 3510 NL_SET_ERR_MSG(extack, "Failed to send migration notification"); 3511 err = 0; 3512 } 3513 3514 out: 3515 xfrm_state_put(x); 3516 return err; 3517 out_xc: 3518 xc->km.state = XFRM_STATE_DEAD; 3519 xfrm_state_put(xc); 3520 xfrm_state_put(x); 3521 return err; 3522 } 3523 3524 #else 3525 static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, 3526 struct nlattr **attrs, struct netlink_ext_ack *extack) 3527 { 3528 NL_SET_ERR_MSG(extack, "XFRM_MSG_MIGRATE_STATE is not supported"); 3529 return -ENOPROTOOPT; 3530 } 3531 3532 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 3533 struct nlattr **attrs, struct netlink_ext_ack *extack) 3534 { 3535 return -ENOPROTOOPT; 3536 } 3537 #endif 3538 3539 #ifdef CONFIG_XFRM_MIGRATE 3540 static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb) 3541 { 3542 struct xfrm_user_migrate um; 3543 3544 memset(&um, 0, sizeof(um)); 3545 um.proto = m->proto; 3546 um.mode = m->mode; 3547 um.reqid = m->old_reqid; 3548 um.old_family = m->old_family; 3549 memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr)); 3550 memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr)); 3551 um.new_family = m->new_family; 3552 memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr)); 3553 memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr)); 3554 3555 return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um); 3556 } 3557 3558 static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb) 3559 { 3560 struct xfrm_user_kmaddress uk; 3561 3562 memset(&uk, 0, sizeof(uk)); 3563 uk.family = k->family; 3564 uk.reserved = k->reserved; 3565 memcpy(&uk.local, &k->local, sizeof(uk.local)); 3566 memcpy(&uk.remote, &k->remote, sizeof(uk.remote)); 3567 3568 return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk); 3569 } 3570 3571 static inline unsigned int xfrm_migrate_msgsize(int num_migrate, int with_kma, 3572 int with_encp) 3573 { 3574 return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id)) 3575 + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0) 3576 + (with_encp ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0) 3577 + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate) 3578 + userpolicy_type_attrsize(); 3579 } 3580 3581 static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m, 3582 int num_migrate, const struct xfrm_kmaddress *k, 3583 const struct xfrm_selector *sel, 3584 const struct xfrm_encap_tmpl *encap, u8 dir, u8 type) 3585 { 3586 const struct xfrm_migrate *mp; 3587 struct xfrm_userpolicy_id *pol_id; 3588 struct nlmsghdr *nlh; 3589 int i, err; 3590 3591 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0); 3592 if (nlh == NULL) 3593 return -EMSGSIZE; 3594 3595 pol_id = nlmsg_data(nlh); 3596 /* copy data from selector, dir, and type to the pol_id */ 3597 memset(pol_id, 0, sizeof(*pol_id)); 3598 memcpy(&pol_id->sel, sel, sizeof(pol_id->sel)); 3599 pol_id->dir = dir; 3600 3601 if (k != NULL) { 3602 err = copy_to_user_kmaddress(k, skb); 3603 if (err) 3604 goto out_cancel; 3605 } 3606 if (encap) { 3607 err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap); 3608 if (err) 3609 goto out_cancel; 3610 } 3611 err = copy_to_user_policy_type(type, skb); 3612 if (err) 3613 goto out_cancel; 3614 for (i = 0, mp = m ; i < num_migrate; i++, mp++) { 3615 err = copy_to_user_migrate(mp, skb); 3616 if (err) 3617 goto out_cancel; 3618 } 3619 3620 nlmsg_end(skb, nlh); 3621 return 0; 3622 3623 out_cancel: 3624 nlmsg_cancel(skb, nlh); 3625 return err; 3626 } 3627 3628 static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 3629 const struct xfrm_migrate *m, int num_migrate, 3630 const struct xfrm_kmaddress *k, struct net *net, 3631 const struct xfrm_encap_tmpl *encap) 3632 { 3633 struct sk_buff *skb; 3634 int err; 3635 3636 skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap), 3637 GFP_ATOMIC); 3638 if (skb == NULL) 3639 return -ENOMEM; 3640 3641 /* build migrate */ 3642 err = build_migrate(skb, m, num_migrate, k, sel, encap, dir, type); 3643 BUG_ON(err < 0); 3644 3645 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE); 3646 } 3647 #else 3648 static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 3649 const struct xfrm_migrate *m, int num_migrate, 3650 const struct xfrm_kmaddress *k, struct net *net, 3651 const struct xfrm_encap_tmpl *encap) 3652 { 3653 return -ENOPROTOOPT; 3654 } 3655 #endif 3656 3657 #define XMSGSIZE(type) sizeof(struct type) 3658 3659 const int xfrm_msg_min[XFRM_NR_MSGTYPES] = { 3660 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 3661 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 3662 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 3663 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 3664 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 3665 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 3666 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info), 3667 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire), 3668 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire), 3669 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 3670 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 3671 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire), 3672 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush), 3673 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0, 3674 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 3675 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 3676 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report), 3677 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 3678 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32), 3679 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 3680 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 3681 [XFRM_MSG_MAPPING - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_mapping), 3682 [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), 3683 [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), 3684 [XFRM_MSG_MIGRATE_STATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_migrate_state), 3685 }; 3686 EXPORT_SYMBOL_GPL(xfrm_msg_min); 3687 3688 #undef XMSGSIZE 3689 3690 const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { 3691 [XFRMA_UNSPEC] = { .strict_start_type = XFRMA_SA_DIR }, 3692 [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)}, 3693 [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)}, 3694 [XFRMA_LASTUSED] = { .type = NLA_U64}, 3695 [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)}, 3696 [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) }, 3697 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) }, 3698 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) }, 3699 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, 3700 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, 3701 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, 3702 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) }, 3703 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, 3704 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, 3705 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 }, 3706 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 }, 3707 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) }, 3708 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) }, 3709 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)}, 3710 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, 3711 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) }, 3712 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) }, 3713 [XFRMA_TFCPAD] = { .type = NLA_U32 }, 3714 [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) }, 3715 [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 }, 3716 [XFRMA_PROTO] = { .type = NLA_U8 }, 3717 [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) }, 3718 [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) }, 3719 [XFRMA_SET_MARK] = { .type = NLA_U32 }, 3720 [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 }, 3721 [XFRMA_IF_ID] = { .type = NLA_U32 }, 3722 [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, 3723 [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT), 3724 [XFRMA_NAT_KEEPALIVE_INTERVAL] = { .type = NLA_U32 }, 3725 [XFRMA_SA_PCPU] = { .type = NLA_U32 }, 3726 [XFRMA_IPTFS_DROP_TIME] = { .type = NLA_U32 }, 3727 [XFRMA_IPTFS_REORDER_WINDOW] = { .type = NLA_U16 }, 3728 [XFRMA_IPTFS_DONT_FRAG] = { .type = NLA_FLAG }, 3729 [XFRMA_IPTFS_INIT_DELAY] = { .type = NLA_U32 }, 3730 [XFRMA_IPTFS_MAX_QSIZE] = { .type = NLA_U32 }, 3731 [XFRMA_IPTFS_PKT_SIZE] = { .type = NLA_U32 }, 3732 }; 3733 EXPORT_SYMBOL_GPL(xfrma_policy); 3734 3735 static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = { 3736 [XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 3737 [XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 3738 }; 3739 3740 static const struct xfrm_link { 3741 int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **, 3742 struct netlink_ext_ack *); 3743 int (*start)(struct netlink_callback *); 3744 int (*dump)(struct sk_buff *, struct netlink_callback *); 3745 int (*done)(struct netlink_callback *); 3746 const struct nla_policy *nla_pol; 3747 int nla_max; 3748 } xfrm_dispatch[XFRM_NR_MSGTYPES] = { 3749 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 3750 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa }, 3751 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa, 3752 .dump = xfrm_dump_sa, 3753 .done = xfrm_dump_sa_done }, 3754 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 3755 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy }, 3756 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy, 3757 .start = xfrm_dump_policy_start, 3758 .dump = xfrm_dump_policy, 3759 .done = xfrm_dump_policy_done }, 3760 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi }, 3761 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire }, 3762 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire }, 3763 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 3764 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 3765 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire}, 3766 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa }, 3767 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy }, 3768 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae }, 3769 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae }, 3770 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate }, 3771 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo }, 3772 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo, 3773 .nla_pol = xfrma_spd_policy, 3774 .nla_max = XFRMA_SPD_MAX }, 3775 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo }, 3776 [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_set_default }, 3777 [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_get_default }, 3778 [XFRM_MSG_MIGRATE_STATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate_state }, 3779 }; 3780 3781 static int xfrm_reject_unused_attr(int type, struct nlattr **attrs, 3782 struct netlink_ext_ack *extack) 3783 { 3784 if (attrs[XFRMA_SA_DIR]) { 3785 switch (type) { 3786 case XFRM_MSG_NEWSA: 3787 case XFRM_MSG_UPDSA: 3788 case XFRM_MSG_ALLOCSPI: 3789 break; 3790 default: 3791 NL_SET_ERR_MSG(extack, "Invalid attribute SA_DIR"); 3792 return -EINVAL; 3793 } 3794 } 3795 3796 if (attrs[XFRMA_SA_PCPU]) { 3797 switch (type) { 3798 case XFRM_MSG_NEWSA: 3799 case XFRM_MSG_UPDSA: 3800 case XFRM_MSG_ALLOCSPI: 3801 case XFRM_MSG_ACQUIRE: 3802 3803 break; 3804 default: 3805 NL_SET_ERR_MSG(extack, "Invalid attribute SA_PCPU"); 3806 return -EINVAL; 3807 } 3808 } 3809 3810 if (type == XFRM_MSG_MIGRATE_STATE) { 3811 int i; 3812 3813 for (i = 0; i <= XFRMA_MAX; i++) { 3814 if (!attrs[i]) 3815 continue; 3816 3817 switch (i) { 3818 case XFRMA_MARK: 3819 case XFRMA_ENCAP: 3820 case XFRMA_OFFLOAD_DEV: 3821 case XFRMA_SET_MARK: 3822 case XFRMA_SET_MARK_MASK: 3823 case XFRMA_MTIMER_THRESH: 3824 case XFRMA_NAT_KEEPALIVE_INTERVAL: 3825 break; 3826 default: 3827 NL_SET_ERR_MSG_ATTR(extack, attrs[i], 3828 "Unsupported attribute in XFRM_MSG_MIGRATE_STATE"); 3829 return -EINVAL; 3830 } 3831 } 3832 } 3833 3834 return 0; 3835 } 3836 3837 static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, 3838 struct netlink_ext_ack *extack) 3839 { 3840 struct net *net = sock_net(skb->sk); 3841 struct nlattr *attrs[XFRMA_MAX+1]; 3842 const struct xfrm_link *link; 3843 struct nlmsghdr *nlh64 = NULL; 3844 int type, err; 3845 3846 type = nlh->nlmsg_type; 3847 if (type > XFRM_MSG_MAX) 3848 return -EINVAL; 3849 3850 type -= XFRM_MSG_BASE; 3851 link = &xfrm_dispatch[type]; 3852 3853 /* All operations require privileges, even GET */ 3854 if (!netlink_net_capable(skb, CAP_NET_ADMIN)) 3855 return -EPERM; 3856 3857 if (IS_ENABLED(CONFIG_COMPAT_FOR_U64_ALIGNMENT) && in_compat_syscall()) { 3858 struct xfrm_translator *xtr = xfrm_get_translator(); 3859 3860 if (!xtr) 3861 return -EOPNOTSUPP; 3862 3863 nlh64 = xtr->rcv_msg_compat(nlh, link->nla_max, 3864 link->nla_pol, extack); 3865 xfrm_put_translator(xtr); 3866 if (IS_ERR(nlh64)) 3867 return PTR_ERR(nlh64); 3868 if (nlh64) 3869 nlh = nlh64; 3870 } 3871 3872 if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || 3873 type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) && 3874 (nlh->nlmsg_flags & NLM_F_DUMP)) { 3875 struct netlink_dump_control c = { 3876 .start = link->start, 3877 .dump = link->dump, 3878 .done = link->done, 3879 }; 3880 3881 if (link->dump == NULL) { 3882 err = -EINVAL; 3883 goto err; 3884 } 3885 3886 err = netlink_dump_start(xfrm_net_nlsk(net, skb), skb, nlh, &c); 3887 goto err; 3888 } 3889 3890 err = nlmsg_parse_deprecated(nlh, xfrm_msg_min[type], attrs, 3891 link->nla_max ? : XFRMA_MAX, 3892 link->nla_pol ? : xfrma_policy, extack); 3893 if (err < 0) 3894 goto err; 3895 3896 if (!link->nla_pol || link->nla_pol == xfrma_policy) { 3897 err = xfrm_reject_unused_attr((type + XFRM_MSG_BASE), attrs, extack); 3898 if (err < 0) 3899 goto err; 3900 } 3901 3902 if (link->doit == NULL) { 3903 err = -EINVAL; 3904 goto err; 3905 } 3906 3907 err = link->doit(skb, nlh, attrs, extack); 3908 3909 /* We need to free skb allocated in xfrm_alloc_compat() before 3910 * returning from this function, because consume_skb() won't take 3911 * care of frag_list since netlink destructor sets 3912 * sbk->head to NULL. (see netlink_skb_destructor()) 3913 */ 3914 if (skb_has_frag_list(skb)) { 3915 kfree_skb(skb_shinfo(skb)->frag_list); 3916 skb_shinfo(skb)->frag_list = NULL; 3917 } 3918 3919 err: 3920 kvfree(nlh64); 3921 return err; 3922 } 3923 3924 static void xfrm_netlink_rcv(struct sk_buff *skb) 3925 { 3926 struct net *net = sock_net(skb->sk); 3927 3928 mutex_lock(&net->xfrm.xfrm_cfg_mutex); 3929 netlink_rcv_skb(skb, &xfrm_user_rcv_msg); 3930 mutex_unlock(&net->xfrm.xfrm_cfg_mutex); 3931 } 3932 3933 static inline unsigned int xfrm_expire_msgsize(void) 3934 { 3935 return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) + 3936 nla_total_size(sizeof(struct xfrm_mark)) + 3937 nla_total_size(sizeof_field(struct xfrm_state, dir)) + 3938 nla_total_size(4); /* XFRMA_SA_PCPU */ 3939 } 3940 3941 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 3942 { 3943 struct xfrm_user_expire *ue; 3944 struct nlmsghdr *nlh; 3945 int err; 3946 3947 nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0); 3948 if (nlh == NULL) 3949 return -EMSGSIZE; 3950 3951 ue = nlmsg_data(nlh); 3952 copy_to_user_state(x, &ue->state); 3953 ue->hard = (c->data.hard != 0) ? 1 : 0; 3954 /* clear the padding bytes */ 3955 memset_after(ue, 0, hard); 3956 3957 err = xfrm_mark_put(skb, &x->mark); 3958 if (err) 3959 return err; 3960 3961 err = xfrm_if_id_put(skb, x->if_id); 3962 if (err) 3963 return err; 3964 if (x->pcpu_num != UINT_MAX) { 3965 err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 3966 if (err) 3967 return err; 3968 } 3969 3970 if (x->dir) { 3971 err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); 3972 if (err) 3973 return err; 3974 } 3975 3976 nlmsg_end(skb, nlh); 3977 return 0; 3978 } 3979 3980 static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c) 3981 { 3982 struct net *net = xs_net(x); 3983 struct sk_buff *skb; 3984 3985 skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC); 3986 if (skb == NULL) 3987 return -ENOMEM; 3988 3989 if (build_expire(skb, x, c) < 0) { 3990 kfree_skb(skb); 3991 return -EMSGSIZE; 3992 } 3993 3994 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 3995 } 3996 3997 static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c) 3998 { 3999 struct net *net = xs_net(x); 4000 struct sk_buff *skb; 4001 int err; 4002 4003 skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 4004 if (skb == NULL) 4005 return -ENOMEM; 4006 4007 err = build_aevent(skb, x, c); 4008 BUG_ON(err < 0); 4009 4010 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS); 4011 } 4012 4013 static int xfrm_notify_sa_flush(const struct km_event *c) 4014 { 4015 struct net *net = c->net; 4016 struct xfrm_usersa_flush *p; 4017 struct nlmsghdr *nlh; 4018 struct sk_buff *skb; 4019 int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush)); 4020 4021 skb = nlmsg_new(len, GFP_ATOMIC); 4022 if (skb == NULL) 4023 return -ENOMEM; 4024 4025 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0); 4026 if (nlh == NULL) { 4027 kfree_skb(skb); 4028 return -EMSGSIZE; 4029 } 4030 4031 p = nlmsg_data(nlh); 4032 p->proto = c->data.proto; 4033 4034 nlmsg_end(skb, nlh); 4035 4036 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 4037 } 4038 4039 static inline unsigned int xfrm_sa_len(struct xfrm_state *x) 4040 { 4041 unsigned int l = 0; 4042 if (x->aead) 4043 l += nla_total_size(aead_len(x->aead)); 4044 if (x->aalg) { 4045 l += nla_total_size(sizeof(struct xfrm_algo) + 4046 (x->aalg->alg_key_len + 7) / 8); 4047 l += nla_total_size(xfrm_alg_auth_len(x->aalg)); 4048 } 4049 if (x->ealg) 4050 l += nla_total_size(xfrm_alg_len(x->ealg)); 4051 if (x->calg) 4052 l += nla_total_size(sizeof(*x->calg)); 4053 if (x->encap) 4054 l += nla_total_size(sizeof(*x->encap)); 4055 if (x->tfcpad) 4056 l += nla_total_size(sizeof(x->tfcpad)); 4057 if (x->replay_esn) 4058 l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn)); 4059 else 4060 l += nla_total_size(sizeof(struct xfrm_replay_state)); 4061 if (x->security) 4062 l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) + 4063 x->security->ctx_len); 4064 if (x->coaddr) 4065 l += nla_total_size(sizeof(*x->coaddr)); 4066 if (x->props.extra_flags) 4067 l += nla_total_size(sizeof(x->props.extra_flags)); 4068 if (READ_ONCE(x->xso.dev)) 4069 l += nla_total_size(sizeof(struct xfrm_user_offload)); 4070 if (x->props.smark.v | x->props.smark.m) { 4071 l += nla_total_size(sizeof(x->props.smark.v)); 4072 l += nla_total_size(sizeof(x->props.smark.m)); 4073 } 4074 if (x->if_id) 4075 l += nla_total_size(sizeof(x->if_id)); 4076 if (x->pcpu_num != UINT_MAX) 4077 l += nla_total_size(sizeof(x->pcpu_num)); 4078 4079 /* Must count x->lastused as it may become non-zero behind our back. */ 4080 l += nla_total_size_64bit(sizeof(u64)); 4081 4082 if (x->mapping_maxage) 4083 l += nla_total_size(sizeof(x->mapping_maxage)); 4084 4085 if (x->dir) 4086 l += nla_total_size(sizeof(x->dir)); 4087 4088 if (x->nat_keepalive_interval) 4089 l += nla_total_size(sizeof(x->nat_keepalive_interval)); 4090 4091 if (x->mode_cbs && x->mode_cbs->sa_len) 4092 l += x->mode_cbs->sa_len(x); 4093 4094 return l; 4095 } 4096 4097 static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c) 4098 { 4099 struct net *net = xs_net(x); 4100 struct xfrm_usersa_info *p; 4101 struct xfrm_usersa_id *id; 4102 struct nlmsghdr *nlh; 4103 struct sk_buff *skb; 4104 unsigned int len = xfrm_sa_len(x); 4105 unsigned int headlen; 4106 int err; 4107 4108 headlen = sizeof(*p); 4109 if (c->event == XFRM_MSG_DELSA) { 4110 len += nla_total_size(headlen); 4111 headlen = sizeof(*id); 4112 len += nla_total_size(sizeof(struct xfrm_mark)); 4113 } 4114 len += NLMSG_ALIGN(headlen); 4115 4116 skb = nlmsg_new(len, GFP_ATOMIC); 4117 if (skb == NULL) 4118 return -ENOMEM; 4119 4120 nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 4121 err = -EMSGSIZE; 4122 if (nlh == NULL) 4123 goto out_free_skb; 4124 4125 p = nlmsg_data(nlh); 4126 if (c->event == XFRM_MSG_DELSA) { 4127 struct nlattr *attr; 4128 4129 id = nlmsg_data(nlh); 4130 memset(id, 0, sizeof(*id)); 4131 memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr)); 4132 id->spi = x->id.spi; 4133 id->family = x->props.family; 4134 id->proto = x->id.proto; 4135 4136 attr = nla_reserve(skb, XFRMA_SA, sizeof(*p)); 4137 err = -EMSGSIZE; 4138 if (attr == NULL) 4139 goto out_free_skb; 4140 4141 p = nla_data(attr); 4142 } 4143 err = copy_to_user_state_extra(x, p, skb); 4144 if (err) 4145 goto out_free_skb; 4146 4147 nlmsg_end(skb, nlh); 4148 4149 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 4150 4151 out_free_skb: 4152 kfree_skb(skb); 4153 return err; 4154 } 4155 4156 static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c) 4157 { 4158 4159 switch (c->event) { 4160 case XFRM_MSG_EXPIRE: 4161 return xfrm_exp_state_notify(x, c); 4162 case XFRM_MSG_NEWAE: 4163 return xfrm_aevent_state_notify(x, c); 4164 case XFRM_MSG_DELSA: 4165 case XFRM_MSG_UPDSA: 4166 case XFRM_MSG_NEWSA: 4167 return xfrm_notify_sa(x, c); 4168 case XFRM_MSG_FLUSHSA: 4169 return xfrm_notify_sa_flush(c); 4170 default: 4171 printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n", 4172 c->event); 4173 break; 4174 } 4175 4176 return 0; 4177 4178 } 4179 4180 static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x, 4181 struct xfrm_policy *xp) 4182 { 4183 return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire)) 4184 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 4185 + nla_total_size(sizeof(struct xfrm_mark)) 4186 + nla_total_size(xfrm_user_sec_ctx_size(x->security)) 4187 + nla_total_size(4) /* XFRMA_SA_PCPU */ 4188 + userpolicy_type_attrsize(); 4189 } 4190 4191 static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, 4192 struct xfrm_tmpl *xt, struct xfrm_policy *xp) 4193 { 4194 __u32 seq = xfrm_get_acqseq(); 4195 struct xfrm_user_acquire *ua; 4196 struct nlmsghdr *nlh; 4197 int err; 4198 4199 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0); 4200 if (nlh == NULL) 4201 return -EMSGSIZE; 4202 4203 ua = nlmsg_data(nlh); 4204 memcpy(&ua->id, &x->id, sizeof(ua->id)); 4205 memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr)); 4206 memcpy(&ua->sel, &x->sel, sizeof(ua->sel)); 4207 copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT); 4208 ua->aalgos = xt->aalgos; 4209 ua->ealgos = xt->ealgos; 4210 ua->calgos = xt->calgos; 4211 ua->seq = x->km.seq = seq; 4212 4213 err = copy_to_user_tmpl(xp, skb); 4214 if (!err) 4215 err = copy_to_user_state_sec_ctx(x, skb); 4216 if (!err) 4217 err = copy_to_user_policy_type(xp->type, skb); 4218 if (!err) 4219 err = xfrm_mark_put(skb, &xp->mark); 4220 if (!err) 4221 err = xfrm_if_id_put(skb, xp->if_id); 4222 if (!err && xp->xdo.dev) 4223 err = copy_user_offload(&xp->xdo, skb); 4224 if (!err && x->pcpu_num != UINT_MAX) 4225 err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 4226 if (err) { 4227 nlmsg_cancel(skb, nlh); 4228 return err; 4229 } 4230 4231 nlmsg_end(skb, nlh); 4232 return 0; 4233 } 4234 4235 static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt, 4236 struct xfrm_policy *xp) 4237 { 4238 struct net *net = xs_net(x); 4239 struct sk_buff *skb; 4240 int err; 4241 4242 skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC); 4243 if (skb == NULL) 4244 return -ENOMEM; 4245 4246 err = build_acquire(skb, x, xt, xp); 4247 BUG_ON(err < 0); 4248 4249 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE); 4250 } 4251 4252 /* User gives us xfrm_user_policy_info followed by an array of 0 4253 * or more templates. 4254 */ 4255 static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt, 4256 u8 *data, int len, int *dir) 4257 { 4258 struct net *net = sock_net(sk); 4259 struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data; 4260 struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1); 4261 struct xfrm_policy *xp; 4262 int nr; 4263 4264 switch (sk->sk_family) { 4265 case AF_INET: 4266 if (opt != IP_XFRM_POLICY) { 4267 *dir = -EOPNOTSUPP; 4268 return NULL; 4269 } 4270 break; 4271 #if IS_ENABLED(CONFIG_IPV6) 4272 case AF_INET6: 4273 if (opt != IPV6_XFRM_POLICY) { 4274 *dir = -EOPNOTSUPP; 4275 return NULL; 4276 } 4277 break; 4278 #endif 4279 default: 4280 *dir = -EINVAL; 4281 return NULL; 4282 } 4283 4284 *dir = -EINVAL; 4285 4286 if (len < sizeof(*p) || 4287 verify_newpolicy_info(p, NULL)) 4288 return NULL; 4289 4290 nr = ((len - sizeof(*p)) / sizeof(*ut)); 4291 if (validate_tmpl(nr, ut, p->sel.family, p->dir, NULL)) 4292 return NULL; 4293 4294 if (p->dir > XFRM_POLICY_OUT) 4295 return NULL; 4296 4297 xp = xfrm_policy_alloc(net, GFP_ATOMIC); 4298 if (xp == NULL) { 4299 *dir = -ENOBUFS; 4300 return NULL; 4301 } 4302 4303 copy_from_user_policy(xp, p); 4304 xp->type = XFRM_POLICY_TYPE_MAIN; 4305 copy_templates(xp, ut, nr); 4306 4307 *dir = p->dir; 4308 4309 return xp; 4310 } 4311 4312 static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp) 4313 { 4314 return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire)) 4315 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 4316 + nla_total_size(xfrm_user_sec_ctx_size(xp->security)) 4317 + nla_total_size(sizeof(struct xfrm_mark)) 4318 + userpolicy_type_attrsize(); 4319 } 4320 4321 static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, 4322 int dir, const struct km_event *c) 4323 { 4324 struct xfrm_user_polexpire *upe; 4325 int hard = c->data.hard; 4326 struct nlmsghdr *nlh; 4327 int err; 4328 4329 nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0); 4330 if (nlh == NULL) 4331 return -EMSGSIZE; 4332 4333 upe = nlmsg_data(nlh); 4334 copy_to_user_policy(xp, &upe->pol, dir); 4335 err = copy_to_user_tmpl(xp, skb); 4336 if (!err) 4337 err = copy_to_user_sec_ctx(xp, skb); 4338 if (!err) 4339 err = copy_to_user_policy_type(xp->type, skb); 4340 if (!err) 4341 err = xfrm_mark_put(skb, &xp->mark); 4342 if (!err) 4343 err = xfrm_if_id_put(skb, xp->if_id); 4344 if (!err && xp->xdo.dev) 4345 err = copy_user_offload(&xp->xdo, skb); 4346 if (err) { 4347 nlmsg_cancel(skb, nlh); 4348 return err; 4349 } 4350 upe->hard = !!hard; 4351 /* clear the padding bytes */ 4352 memset_after(upe, 0, hard); 4353 4354 nlmsg_end(skb, nlh); 4355 return 0; 4356 } 4357 4358 static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 4359 { 4360 struct net *net = xp_net(xp); 4361 struct sk_buff *skb; 4362 int err; 4363 4364 skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC); 4365 if (skb == NULL) 4366 return -ENOMEM; 4367 4368 err = build_polexpire(skb, xp, dir, c); 4369 BUG_ON(err < 0); 4370 4371 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 4372 } 4373 4374 static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c) 4375 { 4376 unsigned int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 4377 struct net *net = xp_net(xp); 4378 struct xfrm_userpolicy_info *p; 4379 struct xfrm_userpolicy_id *id; 4380 struct nlmsghdr *nlh; 4381 struct sk_buff *skb; 4382 unsigned int headlen; 4383 int err; 4384 4385 headlen = sizeof(*p); 4386 if (c->event == XFRM_MSG_DELPOLICY) { 4387 len += nla_total_size(headlen); 4388 headlen = sizeof(*id); 4389 } 4390 len += userpolicy_type_attrsize(); 4391 len += nla_total_size(sizeof(struct xfrm_mark)); 4392 len += NLMSG_ALIGN(headlen); 4393 4394 skb = nlmsg_new(len, GFP_ATOMIC); 4395 if (skb == NULL) 4396 return -ENOMEM; 4397 4398 nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 4399 err = -EMSGSIZE; 4400 if (nlh == NULL) 4401 goto out_free_skb; 4402 4403 p = nlmsg_data(nlh); 4404 if (c->event == XFRM_MSG_DELPOLICY) { 4405 struct nlattr *attr; 4406 4407 id = nlmsg_data(nlh); 4408 memset(id, 0, sizeof(*id)); 4409 id->dir = dir; 4410 if (c->data.byid) 4411 id->index = xp->index; 4412 else 4413 memcpy(&id->sel, &xp->selector, sizeof(id->sel)); 4414 4415 attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p)); 4416 err = -EMSGSIZE; 4417 if (attr == NULL) 4418 goto out_free_skb; 4419 4420 p = nla_data(attr); 4421 } 4422 4423 copy_to_user_policy(xp, p, dir); 4424 err = copy_to_user_tmpl(xp, skb); 4425 if (!err) 4426 err = copy_to_user_policy_type(xp->type, skb); 4427 if (!err) 4428 err = xfrm_mark_put(skb, &xp->mark); 4429 if (!err) 4430 err = xfrm_if_id_put(skb, xp->if_id); 4431 if (!err && xp->xdo.dev) 4432 err = copy_user_offload(&xp->xdo, skb); 4433 if (err) 4434 goto out_free_skb; 4435 4436 nlmsg_end(skb, nlh); 4437 4438 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 4439 4440 out_free_skb: 4441 kfree_skb(skb); 4442 return err; 4443 } 4444 4445 static int xfrm_notify_policy_flush(const struct km_event *c) 4446 { 4447 struct net *net = c->net; 4448 struct nlmsghdr *nlh; 4449 struct sk_buff *skb; 4450 int err; 4451 4452 skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC); 4453 if (skb == NULL) 4454 return -ENOMEM; 4455 4456 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0); 4457 err = -EMSGSIZE; 4458 if (nlh == NULL) 4459 goto out_free_skb; 4460 err = copy_to_user_policy_type(c->data.type, skb); 4461 if (err) 4462 goto out_free_skb; 4463 4464 nlmsg_end(skb, nlh); 4465 4466 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 4467 4468 out_free_skb: 4469 kfree_skb(skb); 4470 return err; 4471 } 4472 4473 static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 4474 { 4475 4476 switch (c->event) { 4477 case XFRM_MSG_NEWPOLICY: 4478 case XFRM_MSG_UPDPOLICY: 4479 case XFRM_MSG_DELPOLICY: 4480 return xfrm_notify_policy(xp, dir, c); 4481 case XFRM_MSG_FLUSHPOLICY: 4482 return xfrm_notify_policy_flush(c); 4483 case XFRM_MSG_POLEXPIRE: 4484 return xfrm_exp_policy_notify(xp, dir, c); 4485 default: 4486 printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n", 4487 c->event); 4488 } 4489 4490 return 0; 4491 4492 } 4493 4494 static inline unsigned int xfrm_report_msgsize(void) 4495 { 4496 return NLMSG_ALIGN(sizeof(struct xfrm_user_report)); 4497 } 4498 4499 static int build_report(struct sk_buff *skb, u8 proto, 4500 struct xfrm_selector *sel, xfrm_address_t *addr) 4501 { 4502 struct xfrm_user_report *ur; 4503 struct nlmsghdr *nlh; 4504 4505 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0); 4506 if (nlh == NULL) 4507 return -EMSGSIZE; 4508 4509 ur = nlmsg_data(nlh); 4510 memset(ur, 0, sizeof(*ur)); 4511 ur->proto = proto; 4512 memcpy(&ur->sel, sel, sizeof(ur->sel)); 4513 4514 if (addr) { 4515 int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr); 4516 if (err) { 4517 nlmsg_cancel(skb, nlh); 4518 return err; 4519 } 4520 } 4521 nlmsg_end(skb, nlh); 4522 return 0; 4523 } 4524 4525 static int xfrm_send_report(struct net *net, u8 proto, 4526 struct xfrm_selector *sel, xfrm_address_t *addr) 4527 { 4528 struct sk_buff *skb; 4529 int err; 4530 4531 skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC); 4532 if (skb == NULL) 4533 return -ENOMEM; 4534 4535 err = build_report(skb, proto, sel, addr); 4536 BUG_ON(err < 0); 4537 4538 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT); 4539 } 4540 4541 static inline unsigned int xfrm_mapping_msgsize(void) 4542 { 4543 return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping)); 4544 } 4545 4546 static int build_mapping(struct sk_buff *skb, struct xfrm_state *x, 4547 xfrm_address_t *new_saddr, __be16 new_sport) 4548 { 4549 struct xfrm_user_mapping *um; 4550 struct nlmsghdr *nlh; 4551 4552 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0); 4553 if (nlh == NULL) 4554 return -EMSGSIZE; 4555 4556 um = nlmsg_data(nlh); 4557 4558 memset(&um->id, 0, sizeof(um->id)); 4559 memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr)); 4560 um->id.spi = x->id.spi; 4561 um->id.family = x->props.family; 4562 um->id.proto = x->id.proto; 4563 memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr)); 4564 memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr)); 4565 um->new_sport = new_sport; 4566 um->old_sport = x->encap->encap_sport; 4567 um->reqid = x->props.reqid; 4568 4569 nlmsg_end(skb, nlh); 4570 return 0; 4571 } 4572 4573 static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, 4574 __be16 sport) 4575 { 4576 struct net *net = xs_net(x); 4577 struct sk_buff *skb; 4578 int err; 4579 4580 if (x->id.proto != IPPROTO_ESP) 4581 return -EINVAL; 4582 4583 if (!x->encap) 4584 return -EINVAL; 4585 4586 skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC); 4587 if (skb == NULL) 4588 return -ENOMEM; 4589 4590 err = build_mapping(skb, x, ipaddr, sport); 4591 BUG_ON(err < 0); 4592 4593 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING); 4594 } 4595 4596 static bool xfrm_is_alive(const struct km_event *c) 4597 { 4598 return (bool)xfrm_acquire_is_on(c->net); 4599 } 4600 4601 static struct xfrm_mgr netlink_mgr = { 4602 .notify = xfrm_send_state_notify, 4603 .acquire = xfrm_send_acquire, 4604 .compile_policy = xfrm_compile_policy, 4605 .notify_policy = xfrm_send_policy_notify, 4606 .report = xfrm_send_report, 4607 .migrate = xfrm_send_migrate, 4608 .new_mapping = xfrm_send_mapping, 4609 .is_alive = xfrm_is_alive, 4610 }; 4611 4612 static int __net_init xfrm_user_net_init(struct net *net) 4613 { 4614 struct sock *nlsk; 4615 struct netlink_kernel_cfg cfg = { 4616 .groups = XFRMNLGRP_MAX, 4617 .input = xfrm_netlink_rcv, 4618 }; 4619 4620 nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg); 4621 if (nlsk == NULL) 4622 return -ENOMEM; 4623 net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */ 4624 rcu_assign_pointer(net->xfrm.nlsk, nlsk); 4625 return 0; 4626 } 4627 4628 static void __net_exit xfrm_user_net_pre_exit(struct net *net) 4629 { 4630 RCU_INIT_POINTER(net->xfrm.nlsk, NULL); 4631 } 4632 4633 static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list) 4634 { 4635 struct net *net; 4636 4637 list_for_each_entry(net, net_exit_list, exit_list) 4638 netlink_kernel_release(net->xfrm.nlsk_stash); 4639 } 4640 4641 static struct pernet_operations xfrm_user_net_ops = { 4642 .init = xfrm_user_net_init, 4643 .pre_exit = xfrm_user_net_pre_exit, 4644 .exit_batch = xfrm_user_net_exit, 4645 }; 4646 4647 static int __init xfrm_user_init(void) 4648 { 4649 int rv; 4650 4651 printk(KERN_INFO "Initializing XFRM netlink socket\n"); 4652 4653 rv = register_pernet_subsys(&xfrm_user_net_ops); 4654 if (rv < 0) 4655 return rv; 4656 xfrm_register_km(&netlink_mgr); 4657 return 0; 4658 } 4659 4660 static void __exit xfrm_user_exit(void) 4661 { 4662 xfrm_unregister_km(&netlink_mgr); 4663 unregister_pernet_subsys(&xfrm_user_net_ops); 4664 } 4665 4666 module_init(xfrm_user_init); 4667 module_exit(xfrm_user_exit); 4668 MODULE_DESCRIPTION("XFRM User interface"); 4669 MODULE_LICENSE("GPL"); 4670 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM); 4671