1 /* 2 * net/key/af_key.c An implementation of PF_KEYv2 sockets. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Maxim Giryaev <gem@asplinux.ru> 10 * David S. Miller <davem@redhat.com> 11 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 12 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 13 * Kazunori MIYAZAWA / USAGI Project <miyazawa@linux-ipv6.org> 14 * Derek Atkins <derek@ihtfp.com> 15 */ 16 17 #include <linux/capability.h> 18 #include <linux/module.h> 19 #include <linux/kernel.h> 20 #include <linux/socket.h> 21 #include <linux/pfkeyv2.h> 22 #include <linux/ipsec.h> 23 #include <linux/skbuff.h> 24 #include <linux/rtnetlink.h> 25 #include <linux/in.h> 26 #include <linux/in6.h> 27 #include <linux/proc_fs.h> 28 #include <linux/init.h> 29 #include <net/xfrm.h> 30 #include <linux/audit.h> 31 32 #include <net/sock.h> 33 34 #define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x)) 35 #define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x)) 36 37 38 /* List of all pfkey sockets. */ 39 static HLIST_HEAD(pfkey_table); 40 static DECLARE_WAIT_QUEUE_HEAD(pfkey_table_wait); 41 static DEFINE_RWLOCK(pfkey_table_lock); 42 static atomic_t pfkey_table_users = ATOMIC_INIT(0); 43 44 static atomic_t pfkey_socks_nr = ATOMIC_INIT(0); 45 46 struct pfkey_sock { 47 /* struct sock must be the first member of struct pfkey_sock */ 48 struct sock sk; 49 int registered; 50 int promisc; 51 }; 52 53 static inline struct pfkey_sock *pfkey_sk(struct sock *sk) 54 { 55 return (struct pfkey_sock *)sk; 56 } 57 58 static void pfkey_sock_destruct(struct sock *sk) 59 { 60 skb_queue_purge(&sk->sk_receive_queue); 61 62 if (!sock_flag(sk, SOCK_DEAD)) { 63 printk("Attempt to release alive pfkey socket: %p\n", sk); 64 return; 65 } 66 67 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc)); 68 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc)); 69 70 atomic_dec(&pfkey_socks_nr); 71 } 72 73 static void pfkey_table_grab(void) 74 { 75 write_lock_bh(&pfkey_table_lock); 76 77 if (atomic_read(&pfkey_table_users)) { 78 DECLARE_WAITQUEUE(wait, current); 79 80 add_wait_queue_exclusive(&pfkey_table_wait, &wait); 81 for(;;) { 82 set_current_state(TASK_UNINTERRUPTIBLE); 83 if (atomic_read(&pfkey_table_users) == 0) 84 break; 85 write_unlock_bh(&pfkey_table_lock); 86 schedule(); 87 write_lock_bh(&pfkey_table_lock); 88 } 89 90 __set_current_state(TASK_RUNNING); 91 remove_wait_queue(&pfkey_table_wait, &wait); 92 } 93 } 94 95 static __inline__ void pfkey_table_ungrab(void) 96 { 97 write_unlock_bh(&pfkey_table_lock); 98 wake_up(&pfkey_table_wait); 99 } 100 101 static __inline__ void pfkey_lock_table(void) 102 { 103 /* read_lock() synchronizes us to pfkey_table_grab */ 104 105 read_lock(&pfkey_table_lock); 106 atomic_inc(&pfkey_table_users); 107 read_unlock(&pfkey_table_lock); 108 } 109 110 static __inline__ void pfkey_unlock_table(void) 111 { 112 if (atomic_dec_and_test(&pfkey_table_users)) 113 wake_up(&pfkey_table_wait); 114 } 115 116 117 static const struct proto_ops pfkey_ops; 118 119 static void pfkey_insert(struct sock *sk) 120 { 121 pfkey_table_grab(); 122 sk_add_node(sk, &pfkey_table); 123 pfkey_table_ungrab(); 124 } 125 126 static void pfkey_remove(struct sock *sk) 127 { 128 pfkey_table_grab(); 129 sk_del_node_init(sk); 130 pfkey_table_ungrab(); 131 } 132 133 static struct proto key_proto = { 134 .name = "KEY", 135 .owner = THIS_MODULE, 136 .obj_size = sizeof(struct pfkey_sock), 137 }; 138 139 static int pfkey_create(struct socket *sock, int protocol) 140 { 141 struct sock *sk; 142 int err; 143 144 if (!capable(CAP_NET_ADMIN)) 145 return -EPERM; 146 if (sock->type != SOCK_RAW) 147 return -ESOCKTNOSUPPORT; 148 if (protocol != PF_KEY_V2) 149 return -EPROTONOSUPPORT; 150 151 err = -ENOMEM; 152 sk = sk_alloc(PF_KEY, GFP_KERNEL, &key_proto, 1); 153 if (sk == NULL) 154 goto out; 155 156 sock->ops = &pfkey_ops; 157 sock_init_data(sock, sk); 158 159 sk->sk_family = PF_KEY; 160 sk->sk_destruct = pfkey_sock_destruct; 161 162 atomic_inc(&pfkey_socks_nr); 163 164 pfkey_insert(sk); 165 166 return 0; 167 out: 168 return err; 169 } 170 171 static int pfkey_release(struct socket *sock) 172 { 173 struct sock *sk = sock->sk; 174 175 if (!sk) 176 return 0; 177 178 pfkey_remove(sk); 179 180 sock_orphan(sk); 181 sock->sk = NULL; 182 skb_queue_purge(&sk->sk_write_queue); 183 sock_put(sk); 184 185 return 0; 186 } 187 188 static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, 189 gfp_t allocation, struct sock *sk) 190 { 191 int err = -ENOBUFS; 192 193 sock_hold(sk); 194 if (*skb2 == NULL) { 195 if (atomic_read(&skb->users) != 1) { 196 *skb2 = skb_clone(skb, allocation); 197 } else { 198 *skb2 = skb; 199 atomic_inc(&skb->users); 200 } 201 } 202 if (*skb2 != NULL) { 203 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) { 204 skb_orphan(*skb2); 205 skb_set_owner_r(*skb2, sk); 206 skb_queue_tail(&sk->sk_receive_queue, *skb2); 207 sk->sk_data_ready(sk, (*skb2)->len); 208 *skb2 = NULL; 209 err = 0; 210 } 211 } 212 sock_put(sk); 213 return err; 214 } 215 216 /* Send SKB to all pfkey sockets matching selected criteria. */ 217 #define BROADCAST_ALL 0 218 #define BROADCAST_ONE 1 219 #define BROADCAST_REGISTERED 2 220 #define BROADCAST_PROMISC_ONLY 4 221 static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, 222 int broadcast_flags, struct sock *one_sk) 223 { 224 struct sock *sk; 225 struct hlist_node *node; 226 struct sk_buff *skb2 = NULL; 227 int err = -ESRCH; 228 229 /* XXX Do we need something like netlink_overrun? I think 230 * XXX PF_KEY socket apps will not mind current behavior. 231 */ 232 if (!skb) 233 return -ENOMEM; 234 235 pfkey_lock_table(); 236 sk_for_each(sk, node, &pfkey_table) { 237 struct pfkey_sock *pfk = pfkey_sk(sk); 238 int err2; 239 240 /* Yes, it means that if you are meant to receive this 241 * pfkey message you receive it twice as promiscuous 242 * socket. 243 */ 244 if (pfk->promisc) 245 pfkey_broadcast_one(skb, &skb2, allocation, sk); 246 247 /* the exact target will be processed later */ 248 if (sk == one_sk) 249 continue; 250 if (broadcast_flags != BROADCAST_ALL) { 251 if (broadcast_flags & BROADCAST_PROMISC_ONLY) 252 continue; 253 if ((broadcast_flags & BROADCAST_REGISTERED) && 254 !pfk->registered) 255 continue; 256 if (broadcast_flags & BROADCAST_ONE) 257 continue; 258 } 259 260 err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk); 261 262 /* Error is cleare after succecful sending to at least one 263 * registered KM */ 264 if ((broadcast_flags & BROADCAST_REGISTERED) && err) 265 err = err2; 266 } 267 pfkey_unlock_table(); 268 269 if (one_sk != NULL) 270 err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk); 271 272 if (skb2) 273 kfree_skb(skb2); 274 kfree_skb(skb); 275 return err; 276 } 277 278 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig) 279 { 280 *new = *orig; 281 } 282 283 static int pfkey_error(struct sadb_msg *orig, int err, struct sock *sk) 284 { 285 struct sk_buff *skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_KERNEL); 286 struct sadb_msg *hdr; 287 288 if (!skb) 289 return -ENOBUFS; 290 291 /* Woe be to the platform trying to support PFKEY yet 292 * having normal errnos outside the 1-255 range, inclusive. 293 */ 294 err = -err; 295 if (err == ERESTARTSYS || 296 err == ERESTARTNOHAND || 297 err == ERESTARTNOINTR) 298 err = EINTR; 299 if (err >= 512) 300 err = EINVAL; 301 BUG_ON(err <= 0 || err >= 256); 302 303 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 304 pfkey_hdr_dup(hdr, orig); 305 hdr->sadb_msg_errno = (uint8_t) err; 306 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / 307 sizeof(uint64_t)); 308 309 pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk); 310 311 return 0; 312 } 313 314 static u8 sadb_ext_min_len[] = { 315 [SADB_EXT_RESERVED] = (u8) 0, 316 [SADB_EXT_SA] = (u8) sizeof(struct sadb_sa), 317 [SADB_EXT_LIFETIME_CURRENT] = (u8) sizeof(struct sadb_lifetime), 318 [SADB_EXT_LIFETIME_HARD] = (u8) sizeof(struct sadb_lifetime), 319 [SADB_EXT_LIFETIME_SOFT] = (u8) sizeof(struct sadb_lifetime), 320 [SADB_EXT_ADDRESS_SRC] = (u8) sizeof(struct sadb_address), 321 [SADB_EXT_ADDRESS_DST] = (u8) sizeof(struct sadb_address), 322 [SADB_EXT_ADDRESS_PROXY] = (u8) sizeof(struct sadb_address), 323 [SADB_EXT_KEY_AUTH] = (u8) sizeof(struct sadb_key), 324 [SADB_EXT_KEY_ENCRYPT] = (u8) sizeof(struct sadb_key), 325 [SADB_EXT_IDENTITY_SRC] = (u8) sizeof(struct sadb_ident), 326 [SADB_EXT_IDENTITY_DST] = (u8) sizeof(struct sadb_ident), 327 [SADB_EXT_SENSITIVITY] = (u8) sizeof(struct sadb_sens), 328 [SADB_EXT_PROPOSAL] = (u8) sizeof(struct sadb_prop), 329 [SADB_EXT_SUPPORTED_AUTH] = (u8) sizeof(struct sadb_supported), 330 [SADB_EXT_SUPPORTED_ENCRYPT] = (u8) sizeof(struct sadb_supported), 331 [SADB_EXT_SPIRANGE] = (u8) sizeof(struct sadb_spirange), 332 [SADB_X_EXT_KMPRIVATE] = (u8) sizeof(struct sadb_x_kmprivate), 333 [SADB_X_EXT_POLICY] = (u8) sizeof(struct sadb_x_policy), 334 [SADB_X_EXT_SA2] = (u8) sizeof(struct sadb_x_sa2), 335 [SADB_X_EXT_NAT_T_TYPE] = (u8) sizeof(struct sadb_x_nat_t_type), 336 [SADB_X_EXT_NAT_T_SPORT] = (u8) sizeof(struct sadb_x_nat_t_port), 337 [SADB_X_EXT_NAT_T_DPORT] = (u8) sizeof(struct sadb_x_nat_t_port), 338 [SADB_X_EXT_NAT_T_OA] = (u8) sizeof(struct sadb_address), 339 [SADB_X_EXT_SEC_CTX] = (u8) sizeof(struct sadb_x_sec_ctx), 340 }; 341 342 /* Verify sadb_address_{len,prefixlen} against sa_family. */ 343 static int verify_address_len(void *p) 344 { 345 struct sadb_address *sp = p; 346 struct sockaddr *addr = (struct sockaddr *)(sp + 1); 347 struct sockaddr_in *sin; 348 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 349 struct sockaddr_in6 *sin6; 350 #endif 351 int len; 352 353 switch (addr->sa_family) { 354 case AF_INET: 355 len = sizeof(*sp) + sizeof(*sin) + (sizeof(uint64_t) - 1); 356 len /= sizeof(uint64_t); 357 if (sp->sadb_address_len != len || 358 sp->sadb_address_prefixlen > 32) 359 return -EINVAL; 360 break; 361 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 362 case AF_INET6: 363 len = sizeof(*sp) + sizeof(*sin6) + (sizeof(uint64_t) - 1); 364 len /= sizeof(uint64_t); 365 if (sp->sadb_address_len != len || 366 sp->sadb_address_prefixlen > 128) 367 return -EINVAL; 368 break; 369 #endif 370 default: 371 /* It is user using kernel to keep track of security 372 * associations for another protocol, such as 373 * OSPF/RSVP/RIPV2/MIP. It is user's job to verify 374 * lengths. 375 * 376 * XXX Actually, association/policy database is not yet 377 * XXX able to cope with arbitrary sockaddr families. 378 * XXX When it can, remove this -EINVAL. -DaveM 379 */ 380 return -EINVAL; 381 break; 382 } 383 384 return 0; 385 } 386 387 static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx) 388 { 389 int len = 0; 390 391 len += sizeof(struct sadb_x_sec_ctx); 392 len += sec_ctx->sadb_x_ctx_len; 393 len += sizeof(uint64_t) - 1; 394 len /= sizeof(uint64_t); 395 396 return len; 397 } 398 399 static inline int verify_sec_ctx_len(void *p) 400 { 401 struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p; 402 int len; 403 404 if (sec_ctx->sadb_x_ctx_len > PAGE_SIZE) 405 return -EINVAL; 406 407 len = pfkey_sec_ctx_len(sec_ctx); 408 409 if (sec_ctx->sadb_x_sec_len != len) 410 return -EINVAL; 411 412 return 0; 413 } 414 415 static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(struct sadb_x_sec_ctx *sec_ctx) 416 { 417 struct xfrm_user_sec_ctx *uctx = NULL; 418 int ctx_size = sec_ctx->sadb_x_ctx_len; 419 420 uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL); 421 422 if (!uctx) 423 return NULL; 424 425 uctx->len = pfkey_sec_ctx_len(sec_ctx); 426 uctx->exttype = sec_ctx->sadb_x_sec_exttype; 427 uctx->ctx_doi = sec_ctx->sadb_x_ctx_doi; 428 uctx->ctx_alg = sec_ctx->sadb_x_ctx_alg; 429 uctx->ctx_len = sec_ctx->sadb_x_ctx_len; 430 memcpy(uctx + 1, sec_ctx + 1, 431 uctx->ctx_len); 432 433 return uctx; 434 } 435 436 static int present_and_same_family(struct sadb_address *src, 437 struct sadb_address *dst) 438 { 439 struct sockaddr *s_addr, *d_addr; 440 441 if (!src || !dst) 442 return 0; 443 444 s_addr = (struct sockaddr *)(src + 1); 445 d_addr = (struct sockaddr *)(dst + 1); 446 if (s_addr->sa_family != d_addr->sa_family) 447 return 0; 448 if (s_addr->sa_family != AF_INET 449 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 450 && s_addr->sa_family != AF_INET6 451 #endif 452 ) 453 return 0; 454 455 return 1; 456 } 457 458 static int parse_exthdrs(struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 459 { 460 char *p = (char *) hdr; 461 int len = skb->len; 462 463 len -= sizeof(*hdr); 464 p += sizeof(*hdr); 465 while (len > 0) { 466 struct sadb_ext *ehdr = (struct sadb_ext *) p; 467 uint16_t ext_type; 468 int ext_len; 469 470 ext_len = ehdr->sadb_ext_len; 471 ext_len *= sizeof(uint64_t); 472 ext_type = ehdr->sadb_ext_type; 473 if (ext_len < sizeof(uint64_t) || 474 ext_len > len || 475 ext_type == SADB_EXT_RESERVED) 476 return -EINVAL; 477 478 if (ext_type <= SADB_EXT_MAX) { 479 int min = (int) sadb_ext_min_len[ext_type]; 480 if (ext_len < min) 481 return -EINVAL; 482 if (ext_hdrs[ext_type-1] != NULL) 483 return -EINVAL; 484 if (ext_type == SADB_EXT_ADDRESS_SRC || 485 ext_type == SADB_EXT_ADDRESS_DST || 486 ext_type == SADB_EXT_ADDRESS_PROXY || 487 ext_type == SADB_X_EXT_NAT_T_OA) { 488 if (verify_address_len(p)) 489 return -EINVAL; 490 } 491 if (ext_type == SADB_X_EXT_SEC_CTX) { 492 if (verify_sec_ctx_len(p)) 493 return -EINVAL; 494 } 495 ext_hdrs[ext_type-1] = p; 496 } 497 p += ext_len; 498 len -= ext_len; 499 } 500 501 return 0; 502 } 503 504 static uint16_t 505 pfkey_satype2proto(uint8_t satype) 506 { 507 switch (satype) { 508 case SADB_SATYPE_UNSPEC: 509 return IPSEC_PROTO_ANY; 510 case SADB_SATYPE_AH: 511 return IPPROTO_AH; 512 case SADB_SATYPE_ESP: 513 return IPPROTO_ESP; 514 case SADB_X_SATYPE_IPCOMP: 515 return IPPROTO_COMP; 516 break; 517 default: 518 return 0; 519 } 520 /* NOTREACHED */ 521 } 522 523 static uint8_t 524 pfkey_proto2satype(uint16_t proto) 525 { 526 switch (proto) { 527 case IPPROTO_AH: 528 return SADB_SATYPE_AH; 529 case IPPROTO_ESP: 530 return SADB_SATYPE_ESP; 531 case IPPROTO_COMP: 532 return SADB_X_SATYPE_IPCOMP; 533 break; 534 default: 535 return 0; 536 } 537 /* NOTREACHED */ 538 } 539 540 /* BTW, this scheme means that there is no way with PFKEY2 sockets to 541 * say specifically 'just raw sockets' as we encode them as 255. 542 */ 543 544 static uint8_t pfkey_proto_to_xfrm(uint8_t proto) 545 { 546 return (proto == IPSEC_PROTO_ANY ? 0 : proto); 547 } 548 549 static uint8_t pfkey_proto_from_xfrm(uint8_t proto) 550 { 551 return (proto ? proto : IPSEC_PROTO_ANY); 552 } 553 554 static int pfkey_sadb_addr2xfrm_addr(struct sadb_address *addr, 555 xfrm_address_t *xaddr) 556 { 557 switch (((struct sockaddr*)(addr + 1))->sa_family) { 558 case AF_INET: 559 xaddr->a4 = 560 ((struct sockaddr_in *)(addr + 1))->sin_addr.s_addr; 561 return AF_INET; 562 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 563 case AF_INET6: 564 memcpy(xaddr->a6, 565 &((struct sockaddr_in6 *)(addr + 1))->sin6_addr, 566 sizeof(struct in6_addr)); 567 return AF_INET6; 568 #endif 569 default: 570 return 0; 571 } 572 /* NOTREACHED */ 573 } 574 575 static struct xfrm_state *pfkey_xfrm_state_lookup(struct sadb_msg *hdr, void **ext_hdrs) 576 { 577 struct sadb_sa *sa; 578 struct sadb_address *addr; 579 uint16_t proto; 580 unsigned short family; 581 xfrm_address_t *xaddr; 582 583 sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1]; 584 if (sa == NULL) 585 return NULL; 586 587 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 588 if (proto == 0) 589 return NULL; 590 591 /* sadb_address_len should be checked by caller */ 592 addr = (struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1]; 593 if (addr == NULL) 594 return NULL; 595 596 family = ((struct sockaddr *)(addr + 1))->sa_family; 597 switch (family) { 598 case AF_INET: 599 xaddr = (xfrm_address_t *)&((struct sockaddr_in *)(addr + 1))->sin_addr; 600 break; 601 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 602 case AF_INET6: 603 xaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(addr + 1))->sin6_addr; 604 break; 605 #endif 606 default: 607 xaddr = NULL; 608 } 609 610 if (!xaddr) 611 return NULL; 612 613 return xfrm_state_lookup(xaddr, sa->sadb_sa_spi, proto, family); 614 } 615 616 #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1))) 617 static int 618 pfkey_sockaddr_size(sa_family_t family) 619 { 620 switch (family) { 621 case AF_INET: 622 return PFKEY_ALIGN8(sizeof(struct sockaddr_in)); 623 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 624 case AF_INET6: 625 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6)); 626 #endif 627 default: 628 return 0; 629 } 630 /* NOTREACHED */ 631 } 632 633 static inline int pfkey_mode_from_xfrm(int mode) 634 { 635 switch(mode) { 636 case XFRM_MODE_TRANSPORT: 637 return IPSEC_MODE_TRANSPORT; 638 case XFRM_MODE_TUNNEL: 639 return IPSEC_MODE_TUNNEL; 640 case XFRM_MODE_BEET: 641 return IPSEC_MODE_BEET; 642 default: 643 return -1; 644 } 645 } 646 647 static inline int pfkey_mode_to_xfrm(int mode) 648 { 649 switch(mode) { 650 case IPSEC_MODE_ANY: /*XXX*/ 651 case IPSEC_MODE_TRANSPORT: 652 return XFRM_MODE_TRANSPORT; 653 case IPSEC_MODE_TUNNEL: 654 return XFRM_MODE_TUNNEL; 655 case IPSEC_MODE_BEET: 656 return XFRM_MODE_BEET; 657 default: 658 return -1; 659 } 660 } 661 662 static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys, int hsc) 663 { 664 struct sk_buff *skb; 665 struct sadb_msg *hdr; 666 struct sadb_sa *sa; 667 struct sadb_lifetime *lifetime; 668 struct sadb_address *addr; 669 struct sadb_key *key; 670 struct sadb_x_sa2 *sa2; 671 struct sockaddr_in *sin; 672 struct sadb_x_sec_ctx *sec_ctx; 673 struct xfrm_sec_ctx *xfrm_ctx; 674 int ctx_size = 0; 675 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 676 struct sockaddr_in6 *sin6; 677 #endif 678 int size; 679 int auth_key_size = 0; 680 int encrypt_key_size = 0; 681 int sockaddr_size; 682 struct xfrm_encap_tmpl *natt = NULL; 683 int mode; 684 685 /* address family check */ 686 sockaddr_size = pfkey_sockaddr_size(x->props.family); 687 if (!sockaddr_size) 688 return ERR_PTR(-EINVAL); 689 690 /* base, SA, (lifetime (HSC),) address(SD), (address(P),) 691 key(AE), (identity(SD),) (sensitivity)> */ 692 size = sizeof(struct sadb_msg) +sizeof(struct sadb_sa) + 693 sizeof(struct sadb_lifetime) + 694 ((hsc & 1) ? sizeof(struct sadb_lifetime) : 0) + 695 ((hsc & 2) ? sizeof(struct sadb_lifetime) : 0) + 696 sizeof(struct sadb_address)*2 + 697 sockaddr_size*2 + 698 sizeof(struct sadb_x_sa2); 699 700 if ((xfrm_ctx = x->security)) { 701 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len); 702 size += sizeof(struct sadb_x_sec_ctx) + ctx_size; 703 } 704 705 /* identity & sensitivity */ 706 707 if ((x->props.family == AF_INET && 708 x->sel.saddr.a4 != x->props.saddr.a4) 709 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 710 || (x->props.family == AF_INET6 && 711 memcmp (x->sel.saddr.a6, x->props.saddr.a6, sizeof (struct in6_addr))) 712 #endif 713 ) 714 size += sizeof(struct sadb_address) + sockaddr_size; 715 716 if (add_keys) { 717 if (x->aalg && x->aalg->alg_key_len) { 718 auth_key_size = 719 PFKEY_ALIGN8((x->aalg->alg_key_len + 7) / 8); 720 size += sizeof(struct sadb_key) + auth_key_size; 721 } 722 if (x->ealg && x->ealg->alg_key_len) { 723 encrypt_key_size = 724 PFKEY_ALIGN8((x->ealg->alg_key_len+7) / 8); 725 size += sizeof(struct sadb_key) + encrypt_key_size; 726 } 727 } 728 if (x->encap) 729 natt = x->encap; 730 731 if (natt && natt->encap_type) { 732 size += sizeof(struct sadb_x_nat_t_type); 733 size += sizeof(struct sadb_x_nat_t_port); 734 size += sizeof(struct sadb_x_nat_t_port); 735 } 736 737 skb = alloc_skb(size + 16, GFP_ATOMIC); 738 if (skb == NULL) 739 return ERR_PTR(-ENOBUFS); 740 741 /* call should fill header later */ 742 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 743 memset(hdr, 0, size); /* XXX do we need this ? */ 744 hdr->sadb_msg_len = size / sizeof(uint64_t); 745 746 /* sa */ 747 sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa)); 748 sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t); 749 sa->sadb_sa_exttype = SADB_EXT_SA; 750 sa->sadb_sa_spi = x->id.spi; 751 sa->sadb_sa_replay = x->props.replay_window; 752 switch (x->km.state) { 753 case XFRM_STATE_VALID: 754 sa->sadb_sa_state = x->km.dying ? 755 SADB_SASTATE_DYING : SADB_SASTATE_MATURE; 756 break; 757 case XFRM_STATE_ACQ: 758 sa->sadb_sa_state = SADB_SASTATE_LARVAL; 759 break; 760 default: 761 sa->sadb_sa_state = SADB_SASTATE_DEAD; 762 break; 763 } 764 sa->sadb_sa_auth = 0; 765 if (x->aalg) { 766 struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0); 767 sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0; 768 } 769 sa->sadb_sa_encrypt = 0; 770 BUG_ON(x->ealg && x->calg); 771 if (x->ealg) { 772 struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0); 773 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; 774 } 775 /* KAME compatible: sadb_sa_encrypt is overloaded with calg id */ 776 if (x->calg) { 777 struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0); 778 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; 779 } 780 781 sa->sadb_sa_flags = 0; 782 if (x->props.flags & XFRM_STATE_NOECN) 783 sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN; 784 if (x->props.flags & XFRM_STATE_DECAP_DSCP) 785 sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP; 786 if (x->props.flags & XFRM_STATE_NOPMTUDISC) 787 sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC; 788 789 /* hard time */ 790 if (hsc & 2) { 791 lifetime = (struct sadb_lifetime *) skb_put(skb, 792 sizeof(struct sadb_lifetime)); 793 lifetime->sadb_lifetime_len = 794 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 795 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 796 lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.hard_packet_limit); 797 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.hard_byte_limit); 798 lifetime->sadb_lifetime_addtime = x->lft.hard_add_expires_seconds; 799 lifetime->sadb_lifetime_usetime = x->lft.hard_use_expires_seconds; 800 } 801 /* soft time */ 802 if (hsc & 1) { 803 lifetime = (struct sadb_lifetime *) skb_put(skb, 804 sizeof(struct sadb_lifetime)); 805 lifetime->sadb_lifetime_len = 806 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 807 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 808 lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.soft_packet_limit); 809 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.soft_byte_limit); 810 lifetime->sadb_lifetime_addtime = x->lft.soft_add_expires_seconds; 811 lifetime->sadb_lifetime_usetime = x->lft.soft_use_expires_seconds; 812 } 813 /* current time */ 814 lifetime = (struct sadb_lifetime *) skb_put(skb, 815 sizeof(struct sadb_lifetime)); 816 lifetime->sadb_lifetime_len = 817 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 818 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 819 lifetime->sadb_lifetime_allocations = x->curlft.packets; 820 lifetime->sadb_lifetime_bytes = x->curlft.bytes; 821 lifetime->sadb_lifetime_addtime = x->curlft.add_time; 822 lifetime->sadb_lifetime_usetime = x->curlft.use_time; 823 /* src address */ 824 addr = (struct sadb_address*) skb_put(skb, 825 sizeof(struct sadb_address)+sockaddr_size); 826 addr->sadb_address_len = 827 (sizeof(struct sadb_address)+sockaddr_size)/ 828 sizeof(uint64_t); 829 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 830 /* "if the ports are non-zero, then the sadb_address_proto field, 831 normally zero, MUST be filled in with the transport 832 protocol's number." - RFC2367 */ 833 addr->sadb_address_proto = 0; 834 addr->sadb_address_reserved = 0; 835 if (x->props.family == AF_INET) { 836 addr->sadb_address_prefixlen = 32; 837 838 sin = (struct sockaddr_in *) (addr + 1); 839 sin->sin_family = AF_INET; 840 sin->sin_addr.s_addr = x->props.saddr.a4; 841 sin->sin_port = 0; 842 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 843 } 844 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 845 else if (x->props.family == AF_INET6) { 846 addr->sadb_address_prefixlen = 128; 847 848 sin6 = (struct sockaddr_in6 *) (addr + 1); 849 sin6->sin6_family = AF_INET6; 850 sin6->sin6_port = 0; 851 sin6->sin6_flowinfo = 0; 852 memcpy(&sin6->sin6_addr, x->props.saddr.a6, 853 sizeof(struct in6_addr)); 854 sin6->sin6_scope_id = 0; 855 } 856 #endif 857 else 858 BUG(); 859 860 /* dst address */ 861 addr = (struct sadb_address*) skb_put(skb, 862 sizeof(struct sadb_address)+sockaddr_size); 863 addr->sadb_address_len = 864 (sizeof(struct sadb_address)+sockaddr_size)/ 865 sizeof(uint64_t); 866 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 867 addr->sadb_address_proto = 0; 868 addr->sadb_address_prefixlen = 32; /* XXX */ 869 addr->sadb_address_reserved = 0; 870 if (x->props.family == AF_INET) { 871 sin = (struct sockaddr_in *) (addr + 1); 872 sin->sin_family = AF_INET; 873 sin->sin_addr.s_addr = x->id.daddr.a4; 874 sin->sin_port = 0; 875 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 876 877 if (x->sel.saddr.a4 != x->props.saddr.a4) { 878 addr = (struct sadb_address*) skb_put(skb, 879 sizeof(struct sadb_address)+sockaddr_size); 880 addr->sadb_address_len = 881 (sizeof(struct sadb_address)+sockaddr_size)/ 882 sizeof(uint64_t); 883 addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 884 addr->sadb_address_proto = 885 pfkey_proto_from_xfrm(x->sel.proto); 886 addr->sadb_address_prefixlen = x->sel.prefixlen_s; 887 addr->sadb_address_reserved = 0; 888 889 sin = (struct sockaddr_in *) (addr + 1); 890 sin->sin_family = AF_INET; 891 sin->sin_addr.s_addr = x->sel.saddr.a4; 892 sin->sin_port = x->sel.sport; 893 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 894 } 895 } 896 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 897 else if (x->props.family == AF_INET6) { 898 addr->sadb_address_prefixlen = 128; 899 900 sin6 = (struct sockaddr_in6 *) (addr + 1); 901 sin6->sin6_family = AF_INET6; 902 sin6->sin6_port = 0; 903 sin6->sin6_flowinfo = 0; 904 memcpy(&sin6->sin6_addr, x->id.daddr.a6, sizeof(struct in6_addr)); 905 sin6->sin6_scope_id = 0; 906 907 if (memcmp (x->sel.saddr.a6, x->props.saddr.a6, 908 sizeof(struct in6_addr))) { 909 addr = (struct sadb_address *) skb_put(skb, 910 sizeof(struct sadb_address)+sockaddr_size); 911 addr->sadb_address_len = 912 (sizeof(struct sadb_address)+sockaddr_size)/ 913 sizeof(uint64_t); 914 addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 915 addr->sadb_address_proto = 916 pfkey_proto_from_xfrm(x->sel.proto); 917 addr->sadb_address_prefixlen = x->sel.prefixlen_s; 918 addr->sadb_address_reserved = 0; 919 920 sin6 = (struct sockaddr_in6 *) (addr + 1); 921 sin6->sin6_family = AF_INET6; 922 sin6->sin6_port = x->sel.sport; 923 sin6->sin6_flowinfo = 0; 924 memcpy(&sin6->sin6_addr, x->sel.saddr.a6, 925 sizeof(struct in6_addr)); 926 sin6->sin6_scope_id = 0; 927 } 928 } 929 #endif 930 else 931 BUG(); 932 933 /* auth key */ 934 if (add_keys && auth_key_size) { 935 key = (struct sadb_key *) skb_put(skb, 936 sizeof(struct sadb_key)+auth_key_size); 937 key->sadb_key_len = (sizeof(struct sadb_key) + auth_key_size) / 938 sizeof(uint64_t); 939 key->sadb_key_exttype = SADB_EXT_KEY_AUTH; 940 key->sadb_key_bits = x->aalg->alg_key_len; 941 key->sadb_key_reserved = 0; 942 memcpy(key + 1, x->aalg->alg_key, (x->aalg->alg_key_len+7)/8); 943 } 944 /* encrypt key */ 945 if (add_keys && encrypt_key_size) { 946 key = (struct sadb_key *) skb_put(skb, 947 sizeof(struct sadb_key)+encrypt_key_size); 948 key->sadb_key_len = (sizeof(struct sadb_key) + 949 encrypt_key_size) / sizeof(uint64_t); 950 key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 951 key->sadb_key_bits = x->ealg->alg_key_len; 952 key->sadb_key_reserved = 0; 953 memcpy(key + 1, x->ealg->alg_key, 954 (x->ealg->alg_key_len+7)/8); 955 } 956 957 /* sa */ 958 sa2 = (struct sadb_x_sa2 *) skb_put(skb, sizeof(struct sadb_x_sa2)); 959 sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t); 960 sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2; 961 if ((mode = pfkey_mode_from_xfrm(x->props.mode)) < 0) { 962 kfree_skb(skb); 963 return ERR_PTR(-EINVAL); 964 } 965 sa2->sadb_x_sa2_mode = mode; 966 sa2->sadb_x_sa2_reserved1 = 0; 967 sa2->sadb_x_sa2_reserved2 = 0; 968 sa2->sadb_x_sa2_sequence = 0; 969 sa2->sadb_x_sa2_reqid = x->props.reqid; 970 971 if (natt && natt->encap_type) { 972 struct sadb_x_nat_t_type *n_type; 973 struct sadb_x_nat_t_port *n_port; 974 975 /* type */ 976 n_type = (struct sadb_x_nat_t_type*) skb_put(skb, sizeof(*n_type)); 977 n_type->sadb_x_nat_t_type_len = sizeof(*n_type)/sizeof(uint64_t); 978 n_type->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; 979 n_type->sadb_x_nat_t_type_type = natt->encap_type; 980 n_type->sadb_x_nat_t_type_reserved[0] = 0; 981 n_type->sadb_x_nat_t_type_reserved[1] = 0; 982 n_type->sadb_x_nat_t_type_reserved[2] = 0; 983 984 /* source port */ 985 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 986 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 987 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT; 988 n_port->sadb_x_nat_t_port_port = natt->encap_sport; 989 n_port->sadb_x_nat_t_port_reserved = 0; 990 991 /* dest port */ 992 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 993 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 994 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT; 995 n_port->sadb_x_nat_t_port_port = natt->encap_dport; 996 n_port->sadb_x_nat_t_port_reserved = 0; 997 } 998 999 /* security context */ 1000 if (xfrm_ctx) { 1001 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, 1002 sizeof(struct sadb_x_sec_ctx) + ctx_size); 1003 sec_ctx->sadb_x_sec_len = 1004 (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t); 1005 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 1006 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 1007 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 1008 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 1009 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 1010 xfrm_ctx->ctx_len); 1011 } 1012 1013 return skb; 1014 } 1015 1016 static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr, 1017 void **ext_hdrs) 1018 { 1019 struct xfrm_state *x; 1020 struct sadb_lifetime *lifetime; 1021 struct sadb_sa *sa; 1022 struct sadb_key *key; 1023 struct sadb_x_sec_ctx *sec_ctx; 1024 uint16_t proto; 1025 int err; 1026 1027 1028 sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1]; 1029 if (!sa || 1030 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1031 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1032 return ERR_PTR(-EINVAL); 1033 if (hdr->sadb_msg_satype == SADB_SATYPE_ESP && 1034 !ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]) 1035 return ERR_PTR(-EINVAL); 1036 if (hdr->sadb_msg_satype == SADB_SATYPE_AH && 1037 !ext_hdrs[SADB_EXT_KEY_AUTH-1]) 1038 return ERR_PTR(-EINVAL); 1039 if (!!ext_hdrs[SADB_EXT_LIFETIME_HARD-1] != 1040 !!ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) 1041 return ERR_PTR(-EINVAL); 1042 1043 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1044 if (proto == 0) 1045 return ERR_PTR(-EINVAL); 1046 1047 /* default error is no buffer space */ 1048 err = -ENOBUFS; 1049 1050 /* RFC2367: 1051 1052 Only SADB_SASTATE_MATURE SAs may be submitted in an SADB_ADD message. 1053 SADB_SASTATE_LARVAL SAs are created by SADB_GETSPI and it is not 1054 sensible to add a new SA in the DYING or SADB_SASTATE_DEAD state. 1055 Therefore, the sadb_sa_state field of all submitted SAs MUST be 1056 SADB_SASTATE_MATURE and the kernel MUST return an error if this is 1057 not true. 1058 1059 However, KAME setkey always uses SADB_SASTATE_LARVAL. 1060 Hence, we have to _ignore_ sadb_sa_state, which is also reasonable. 1061 */ 1062 if (sa->sadb_sa_auth > SADB_AALG_MAX || 1063 (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP && 1064 sa->sadb_sa_encrypt > SADB_X_CALG_MAX) || 1065 sa->sadb_sa_encrypt > SADB_EALG_MAX) 1066 return ERR_PTR(-EINVAL); 1067 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1]; 1068 if (key != NULL && 1069 sa->sadb_sa_auth != SADB_X_AALG_NULL && 1070 ((key->sadb_key_bits+7) / 8 == 0 || 1071 (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1072 return ERR_PTR(-EINVAL); 1073 key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; 1074 if (key != NULL && 1075 sa->sadb_sa_encrypt != SADB_EALG_NULL && 1076 ((key->sadb_key_bits+7) / 8 == 0 || 1077 (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1078 return ERR_PTR(-EINVAL); 1079 1080 x = xfrm_state_alloc(); 1081 if (x == NULL) 1082 return ERR_PTR(-ENOBUFS); 1083 1084 x->id.proto = proto; 1085 x->id.spi = sa->sadb_sa_spi; 1086 x->props.replay_window = sa->sadb_sa_replay; 1087 if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN) 1088 x->props.flags |= XFRM_STATE_NOECN; 1089 if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP) 1090 x->props.flags |= XFRM_STATE_DECAP_DSCP; 1091 if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC) 1092 x->props.flags |= XFRM_STATE_NOPMTUDISC; 1093 1094 lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_HARD-1]; 1095 if (lifetime != NULL) { 1096 x->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 1097 x->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 1098 x->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime; 1099 x->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime; 1100 } 1101 lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]; 1102 if (lifetime != NULL) { 1103 x->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 1104 x->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 1105 x->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime; 1106 x->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime; 1107 } 1108 1109 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 1110 if (sec_ctx != NULL) { 1111 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 1112 1113 if (!uctx) 1114 goto out; 1115 1116 err = security_xfrm_state_alloc(x, uctx); 1117 kfree(uctx); 1118 1119 if (err) 1120 goto out; 1121 } 1122 1123 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1]; 1124 if (sa->sadb_sa_auth) { 1125 int keysize = 0; 1126 struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth); 1127 if (!a) { 1128 err = -ENOSYS; 1129 goto out; 1130 } 1131 if (key) 1132 keysize = (key->sadb_key_bits + 7) / 8; 1133 x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL); 1134 if (!x->aalg) 1135 goto out; 1136 strcpy(x->aalg->alg_name, a->name); 1137 x->aalg->alg_key_len = 0; 1138 if (key) { 1139 x->aalg->alg_key_len = key->sadb_key_bits; 1140 memcpy(x->aalg->alg_key, key+1, keysize); 1141 } 1142 x->props.aalgo = sa->sadb_sa_auth; 1143 /* x->algo.flags = sa->sadb_sa_flags; */ 1144 } 1145 if (sa->sadb_sa_encrypt) { 1146 if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) { 1147 struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt); 1148 if (!a) { 1149 err = -ENOSYS; 1150 goto out; 1151 } 1152 x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL); 1153 if (!x->calg) 1154 goto out; 1155 strcpy(x->calg->alg_name, a->name); 1156 x->props.calgo = sa->sadb_sa_encrypt; 1157 } else { 1158 int keysize = 0; 1159 struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt); 1160 if (!a) { 1161 err = -ENOSYS; 1162 goto out; 1163 } 1164 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; 1165 if (key) 1166 keysize = (key->sadb_key_bits + 7) / 8; 1167 x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL); 1168 if (!x->ealg) 1169 goto out; 1170 strcpy(x->ealg->alg_name, a->name); 1171 x->ealg->alg_key_len = 0; 1172 if (key) { 1173 x->ealg->alg_key_len = key->sadb_key_bits; 1174 memcpy(x->ealg->alg_key, key+1, keysize); 1175 } 1176 x->props.ealgo = sa->sadb_sa_encrypt; 1177 } 1178 } 1179 /* x->algo.flags = sa->sadb_sa_flags; */ 1180 1181 x->props.family = pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1182 &x->props.saddr); 1183 if (!x->props.family) { 1184 err = -EAFNOSUPPORT; 1185 goto out; 1186 } 1187 pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1], 1188 &x->id.daddr); 1189 1190 if (ext_hdrs[SADB_X_EXT_SA2-1]) { 1191 struct sadb_x_sa2 *sa2 = (void*)ext_hdrs[SADB_X_EXT_SA2-1]; 1192 int mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode); 1193 if (mode < 0) { 1194 err = -EINVAL; 1195 goto out; 1196 } 1197 x->props.mode = mode; 1198 x->props.reqid = sa2->sadb_x_sa2_reqid; 1199 } 1200 1201 if (ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]) { 1202 struct sadb_address *addr = ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]; 1203 1204 /* Nobody uses this, but we try. */ 1205 x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, &x->sel.saddr); 1206 x->sel.prefixlen_s = addr->sadb_address_prefixlen; 1207 } 1208 1209 if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) { 1210 struct sadb_x_nat_t_type* n_type; 1211 struct xfrm_encap_tmpl *natt; 1212 1213 x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL); 1214 if (!x->encap) 1215 goto out; 1216 1217 natt = x->encap; 1218 n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]; 1219 natt->encap_type = n_type->sadb_x_nat_t_type_type; 1220 1221 if (ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]) { 1222 struct sadb_x_nat_t_port* n_port = 1223 ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]; 1224 natt->encap_sport = n_port->sadb_x_nat_t_port_port; 1225 } 1226 if (ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]) { 1227 struct sadb_x_nat_t_port* n_port = 1228 ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]; 1229 natt->encap_dport = n_port->sadb_x_nat_t_port_port; 1230 } 1231 } 1232 1233 err = xfrm_init_state(x); 1234 if (err) 1235 goto out; 1236 1237 x->km.seq = hdr->sadb_msg_seq; 1238 return x; 1239 1240 out: 1241 x->km.state = XFRM_STATE_DEAD; 1242 xfrm_state_put(x); 1243 return ERR_PTR(err); 1244 } 1245 1246 static int pfkey_reserved(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1247 { 1248 return -EOPNOTSUPP; 1249 } 1250 1251 static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1252 { 1253 struct sk_buff *resp_skb; 1254 struct sadb_x_sa2 *sa2; 1255 struct sadb_address *saddr, *daddr; 1256 struct sadb_msg *out_hdr; 1257 struct xfrm_state *x = NULL; 1258 int mode; 1259 u32 reqid; 1260 u8 proto; 1261 unsigned short family; 1262 xfrm_address_t *xsaddr = NULL, *xdaddr = NULL; 1263 1264 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1265 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1266 return -EINVAL; 1267 1268 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1269 if (proto == 0) 1270 return -EINVAL; 1271 1272 if ((sa2 = ext_hdrs[SADB_X_EXT_SA2-1]) != NULL) { 1273 mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode); 1274 if (mode < 0) 1275 return -EINVAL; 1276 reqid = sa2->sadb_x_sa2_reqid; 1277 } else { 1278 mode = 0; 1279 reqid = 0; 1280 } 1281 1282 saddr = ext_hdrs[SADB_EXT_ADDRESS_SRC-1]; 1283 daddr = ext_hdrs[SADB_EXT_ADDRESS_DST-1]; 1284 1285 family = ((struct sockaddr *)(saddr + 1))->sa_family; 1286 switch (family) { 1287 case AF_INET: 1288 xdaddr = (xfrm_address_t *)&((struct sockaddr_in *)(daddr + 1))->sin_addr.s_addr; 1289 xsaddr = (xfrm_address_t *)&((struct sockaddr_in *)(saddr + 1))->sin_addr.s_addr; 1290 break; 1291 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1292 case AF_INET6: 1293 xdaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(daddr + 1))->sin6_addr; 1294 xsaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(saddr + 1))->sin6_addr; 1295 break; 1296 #endif 1297 } 1298 1299 if (hdr->sadb_msg_seq) { 1300 x = xfrm_find_acq_byseq(hdr->sadb_msg_seq); 1301 if (x && xfrm_addr_cmp(&x->id.daddr, xdaddr, family)) { 1302 xfrm_state_put(x); 1303 x = NULL; 1304 } 1305 } 1306 1307 if (!x) 1308 x = xfrm_find_acq(mode, reqid, proto, xdaddr, xsaddr, 1, family); 1309 1310 if (x == NULL) 1311 return -ENOENT; 1312 1313 resp_skb = ERR_PTR(-ENOENT); 1314 1315 spin_lock_bh(&x->lock); 1316 if (x->km.state != XFRM_STATE_DEAD) { 1317 struct sadb_spirange *range = ext_hdrs[SADB_EXT_SPIRANGE-1]; 1318 u32 min_spi, max_spi; 1319 1320 if (range != NULL) { 1321 min_spi = range->sadb_spirange_min; 1322 max_spi = range->sadb_spirange_max; 1323 } else { 1324 min_spi = 0x100; 1325 max_spi = 0x0fffffff; 1326 } 1327 xfrm_alloc_spi(x, htonl(min_spi), htonl(max_spi)); 1328 if (x->id.spi) 1329 resp_skb = pfkey_xfrm_state2msg(x, 0, 3); 1330 } 1331 spin_unlock_bh(&x->lock); 1332 1333 if (IS_ERR(resp_skb)) { 1334 xfrm_state_put(x); 1335 return PTR_ERR(resp_skb); 1336 } 1337 1338 out_hdr = (struct sadb_msg *) resp_skb->data; 1339 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 1340 out_hdr->sadb_msg_type = SADB_GETSPI; 1341 out_hdr->sadb_msg_satype = pfkey_proto2satype(proto); 1342 out_hdr->sadb_msg_errno = 0; 1343 out_hdr->sadb_msg_reserved = 0; 1344 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 1345 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 1346 1347 xfrm_state_put(x); 1348 1349 pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk); 1350 1351 return 0; 1352 } 1353 1354 static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1355 { 1356 struct xfrm_state *x; 1357 1358 if (hdr->sadb_msg_len != sizeof(struct sadb_msg)/8) 1359 return -EOPNOTSUPP; 1360 1361 if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0) 1362 return 0; 1363 1364 x = xfrm_find_acq_byseq(hdr->sadb_msg_seq); 1365 if (x == NULL) 1366 return 0; 1367 1368 spin_lock_bh(&x->lock); 1369 if (x->km.state == XFRM_STATE_ACQ) { 1370 x->km.state = XFRM_STATE_ERROR; 1371 wake_up(&km_waitq); 1372 } 1373 spin_unlock_bh(&x->lock); 1374 xfrm_state_put(x); 1375 return 0; 1376 } 1377 1378 static inline int event2poltype(int event) 1379 { 1380 switch (event) { 1381 case XFRM_MSG_DELPOLICY: 1382 return SADB_X_SPDDELETE; 1383 case XFRM_MSG_NEWPOLICY: 1384 return SADB_X_SPDADD; 1385 case XFRM_MSG_UPDPOLICY: 1386 return SADB_X_SPDUPDATE; 1387 case XFRM_MSG_POLEXPIRE: 1388 // return SADB_X_SPDEXPIRE; 1389 default: 1390 printk("pfkey: Unknown policy event %d\n", event); 1391 break; 1392 } 1393 1394 return 0; 1395 } 1396 1397 static inline int event2keytype(int event) 1398 { 1399 switch (event) { 1400 case XFRM_MSG_DELSA: 1401 return SADB_DELETE; 1402 case XFRM_MSG_NEWSA: 1403 return SADB_ADD; 1404 case XFRM_MSG_UPDSA: 1405 return SADB_UPDATE; 1406 case XFRM_MSG_EXPIRE: 1407 return SADB_EXPIRE; 1408 default: 1409 printk("pfkey: Unknown SA event %d\n", event); 1410 break; 1411 } 1412 1413 return 0; 1414 } 1415 1416 /* ADD/UPD/DEL */ 1417 static int key_notify_sa(struct xfrm_state *x, struct km_event *c) 1418 { 1419 struct sk_buff *skb; 1420 struct sadb_msg *hdr; 1421 int hsc = 3; 1422 1423 if (c->event == XFRM_MSG_DELSA) 1424 hsc = 0; 1425 1426 skb = pfkey_xfrm_state2msg(x, 0, hsc); 1427 1428 if (IS_ERR(skb)) 1429 return PTR_ERR(skb); 1430 1431 hdr = (struct sadb_msg *) skb->data; 1432 hdr->sadb_msg_version = PF_KEY_V2; 1433 hdr->sadb_msg_type = event2keytype(c->event); 1434 hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 1435 hdr->sadb_msg_errno = 0; 1436 hdr->sadb_msg_reserved = 0; 1437 hdr->sadb_msg_seq = c->seq; 1438 hdr->sadb_msg_pid = c->pid; 1439 1440 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 1441 1442 return 0; 1443 } 1444 1445 static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1446 { 1447 struct xfrm_state *x; 1448 int err; 1449 struct km_event c; 1450 1451 x = pfkey_msg2xfrm_state(hdr, ext_hdrs); 1452 if (IS_ERR(x)) 1453 return PTR_ERR(x); 1454 1455 xfrm_state_hold(x); 1456 if (hdr->sadb_msg_type == SADB_ADD) 1457 err = xfrm_state_add(x); 1458 else 1459 err = xfrm_state_update(x); 1460 1461 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 1462 AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x); 1463 1464 if (err < 0) { 1465 x->km.state = XFRM_STATE_DEAD; 1466 __xfrm_state_put(x); 1467 goto out; 1468 } 1469 1470 if (hdr->sadb_msg_type == SADB_ADD) 1471 c.event = XFRM_MSG_NEWSA; 1472 else 1473 c.event = XFRM_MSG_UPDSA; 1474 c.seq = hdr->sadb_msg_seq; 1475 c.pid = hdr->sadb_msg_pid; 1476 km_state_notify(x, &c); 1477 out: 1478 xfrm_state_put(x); 1479 return err; 1480 } 1481 1482 static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1483 { 1484 struct xfrm_state *x; 1485 struct km_event c; 1486 int err; 1487 1488 if (!ext_hdrs[SADB_EXT_SA-1] || 1489 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1490 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1491 return -EINVAL; 1492 1493 x = pfkey_xfrm_state_lookup(hdr, ext_hdrs); 1494 if (x == NULL) 1495 return -ESRCH; 1496 1497 if ((err = security_xfrm_state_delete(x))) 1498 goto out; 1499 1500 if (xfrm_state_kern(x)) { 1501 err = -EPERM; 1502 goto out; 1503 } 1504 1505 err = xfrm_state_delete(x); 1506 1507 if (err < 0) 1508 goto out; 1509 1510 c.seq = hdr->sadb_msg_seq; 1511 c.pid = hdr->sadb_msg_pid; 1512 c.event = XFRM_MSG_DELSA; 1513 km_state_notify(x, &c); 1514 out: 1515 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 1516 AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x); 1517 xfrm_state_put(x); 1518 1519 return err; 1520 } 1521 1522 static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1523 { 1524 __u8 proto; 1525 struct sk_buff *out_skb; 1526 struct sadb_msg *out_hdr; 1527 struct xfrm_state *x; 1528 1529 if (!ext_hdrs[SADB_EXT_SA-1] || 1530 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1531 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1532 return -EINVAL; 1533 1534 x = pfkey_xfrm_state_lookup(hdr, ext_hdrs); 1535 if (x == NULL) 1536 return -ESRCH; 1537 1538 out_skb = pfkey_xfrm_state2msg(x, 1, 3); 1539 proto = x->id.proto; 1540 xfrm_state_put(x); 1541 if (IS_ERR(out_skb)) 1542 return PTR_ERR(out_skb); 1543 1544 out_hdr = (struct sadb_msg *) out_skb->data; 1545 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 1546 out_hdr->sadb_msg_type = SADB_DUMP; 1547 out_hdr->sadb_msg_satype = pfkey_proto2satype(proto); 1548 out_hdr->sadb_msg_errno = 0; 1549 out_hdr->sadb_msg_reserved = 0; 1550 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 1551 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 1552 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk); 1553 1554 return 0; 1555 } 1556 1557 static struct sk_buff *compose_sadb_supported(struct sadb_msg *orig, 1558 gfp_t allocation) 1559 { 1560 struct sk_buff *skb; 1561 struct sadb_msg *hdr; 1562 int len, auth_len, enc_len, i; 1563 1564 auth_len = xfrm_count_auth_supported(); 1565 if (auth_len) { 1566 auth_len *= sizeof(struct sadb_alg); 1567 auth_len += sizeof(struct sadb_supported); 1568 } 1569 1570 enc_len = xfrm_count_enc_supported(); 1571 if (enc_len) { 1572 enc_len *= sizeof(struct sadb_alg); 1573 enc_len += sizeof(struct sadb_supported); 1574 } 1575 1576 len = enc_len + auth_len + sizeof(struct sadb_msg); 1577 1578 skb = alloc_skb(len + 16, allocation); 1579 if (!skb) 1580 goto out_put_algs; 1581 1582 hdr = (struct sadb_msg *) skb_put(skb, sizeof(*hdr)); 1583 pfkey_hdr_dup(hdr, orig); 1584 hdr->sadb_msg_errno = 0; 1585 hdr->sadb_msg_len = len / sizeof(uint64_t); 1586 1587 if (auth_len) { 1588 struct sadb_supported *sp; 1589 struct sadb_alg *ap; 1590 1591 sp = (struct sadb_supported *) skb_put(skb, auth_len); 1592 ap = (struct sadb_alg *) (sp + 1); 1593 1594 sp->sadb_supported_len = auth_len / sizeof(uint64_t); 1595 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH; 1596 1597 for (i = 0; ; i++) { 1598 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 1599 if (!aalg) 1600 break; 1601 if (aalg->available) 1602 *ap++ = aalg->desc; 1603 } 1604 } 1605 1606 if (enc_len) { 1607 struct sadb_supported *sp; 1608 struct sadb_alg *ap; 1609 1610 sp = (struct sadb_supported *) skb_put(skb, enc_len); 1611 ap = (struct sadb_alg *) (sp + 1); 1612 1613 sp->sadb_supported_len = enc_len / sizeof(uint64_t); 1614 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT; 1615 1616 for (i = 0; ; i++) { 1617 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 1618 if (!ealg) 1619 break; 1620 if (ealg->available) 1621 *ap++ = ealg->desc; 1622 } 1623 } 1624 1625 out_put_algs: 1626 return skb; 1627 } 1628 1629 static int pfkey_register(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1630 { 1631 struct pfkey_sock *pfk = pfkey_sk(sk); 1632 struct sk_buff *supp_skb; 1633 1634 if (hdr->sadb_msg_satype > SADB_SATYPE_MAX) 1635 return -EINVAL; 1636 1637 if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) { 1638 if (pfk->registered&(1<<hdr->sadb_msg_satype)) 1639 return -EEXIST; 1640 pfk->registered |= (1<<hdr->sadb_msg_satype); 1641 } 1642 1643 xfrm_probe_algs(); 1644 1645 supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); 1646 if (!supp_skb) { 1647 if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) 1648 pfk->registered &= ~(1<<hdr->sadb_msg_satype); 1649 1650 return -ENOBUFS; 1651 } 1652 1653 pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk); 1654 1655 return 0; 1656 } 1657 1658 static int key_notify_sa_flush(struct km_event *c) 1659 { 1660 struct sk_buff *skb; 1661 struct sadb_msg *hdr; 1662 1663 skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC); 1664 if (!skb) 1665 return -ENOBUFS; 1666 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 1667 hdr->sadb_msg_satype = pfkey_proto2satype(c->data.proto); 1668 hdr->sadb_msg_type = SADB_FLUSH; 1669 hdr->sadb_msg_seq = c->seq; 1670 hdr->sadb_msg_pid = c->pid; 1671 hdr->sadb_msg_version = PF_KEY_V2; 1672 hdr->sadb_msg_errno = (uint8_t) 0; 1673 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 1674 1675 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 1676 1677 return 0; 1678 } 1679 1680 static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1681 { 1682 unsigned proto; 1683 struct km_event c; 1684 struct xfrm_audit audit_info; 1685 1686 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1687 if (proto == 0) 1688 return -EINVAL; 1689 1690 audit_info.loginuid = audit_get_loginuid(current->audit_context); 1691 audit_info.secid = 0; 1692 xfrm_state_flush(proto, &audit_info); 1693 c.data.proto = proto; 1694 c.seq = hdr->sadb_msg_seq; 1695 c.pid = hdr->sadb_msg_pid; 1696 c.event = XFRM_MSG_FLUSHSA; 1697 km_state_notify(NULL, &c); 1698 1699 return 0; 1700 } 1701 1702 struct pfkey_dump_data 1703 { 1704 struct sk_buff *skb; 1705 struct sadb_msg *hdr; 1706 struct sock *sk; 1707 }; 1708 1709 static int dump_sa(struct xfrm_state *x, int count, void *ptr) 1710 { 1711 struct pfkey_dump_data *data = ptr; 1712 struct sk_buff *out_skb; 1713 struct sadb_msg *out_hdr; 1714 1715 out_skb = pfkey_xfrm_state2msg(x, 1, 3); 1716 if (IS_ERR(out_skb)) 1717 return PTR_ERR(out_skb); 1718 1719 out_hdr = (struct sadb_msg *) out_skb->data; 1720 out_hdr->sadb_msg_version = data->hdr->sadb_msg_version; 1721 out_hdr->sadb_msg_type = SADB_DUMP; 1722 out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 1723 out_hdr->sadb_msg_errno = 0; 1724 out_hdr->sadb_msg_reserved = 0; 1725 out_hdr->sadb_msg_seq = count; 1726 out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid; 1727 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk); 1728 return 0; 1729 } 1730 1731 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1732 { 1733 u8 proto; 1734 struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk }; 1735 1736 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1737 if (proto == 0) 1738 return -EINVAL; 1739 1740 return xfrm_state_walk(proto, dump_sa, &data); 1741 } 1742 1743 static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1744 { 1745 struct pfkey_sock *pfk = pfkey_sk(sk); 1746 int satype = hdr->sadb_msg_satype; 1747 1748 if (hdr->sadb_msg_len == (sizeof(*hdr) / sizeof(uint64_t))) { 1749 /* XXX we mangle packet... */ 1750 hdr->sadb_msg_errno = 0; 1751 if (satype != 0 && satype != 1) 1752 return -EINVAL; 1753 pfk->promisc = satype; 1754 } 1755 pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, BROADCAST_ALL, NULL); 1756 return 0; 1757 } 1758 1759 static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr) 1760 { 1761 int i; 1762 u32 reqid = *(u32*)ptr; 1763 1764 for (i=0; i<xp->xfrm_nr; i++) { 1765 if (xp->xfrm_vec[i].reqid == reqid) 1766 return -EEXIST; 1767 } 1768 return 0; 1769 } 1770 1771 static u32 gen_reqid(void) 1772 { 1773 u32 start; 1774 static u32 reqid = IPSEC_MANUAL_REQID_MAX; 1775 1776 start = reqid; 1777 do { 1778 ++reqid; 1779 if (reqid == 0) 1780 reqid = IPSEC_MANUAL_REQID_MAX+1; 1781 if (xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, check_reqid, 1782 (void*)&reqid) != -EEXIST) 1783 return reqid; 1784 } while (reqid != start); 1785 return 0; 1786 } 1787 1788 static int 1789 parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) 1790 { 1791 struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr; 1792 struct sockaddr_in *sin; 1793 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1794 struct sockaddr_in6 *sin6; 1795 #endif 1796 int mode; 1797 1798 if (xp->xfrm_nr >= XFRM_MAX_DEPTH) 1799 return -ELOOP; 1800 1801 if (rq->sadb_x_ipsecrequest_mode == 0) 1802 return -EINVAL; 1803 1804 t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */ 1805 if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0) 1806 return -EINVAL; 1807 t->mode = mode; 1808 if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) 1809 t->optional = 1; 1810 else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) { 1811 t->reqid = rq->sadb_x_ipsecrequest_reqid; 1812 if (t->reqid > IPSEC_MANUAL_REQID_MAX) 1813 t->reqid = 0; 1814 if (!t->reqid && !(t->reqid = gen_reqid())) 1815 return -ENOBUFS; 1816 } 1817 1818 /* addresses present only in tunnel mode */ 1819 if (t->mode == XFRM_MODE_TUNNEL) { 1820 struct sockaddr *sa; 1821 sa = (struct sockaddr *)(rq+1); 1822 switch(sa->sa_family) { 1823 case AF_INET: 1824 sin = (struct sockaddr_in*)sa; 1825 t->saddr.a4 = sin->sin_addr.s_addr; 1826 sin++; 1827 if (sin->sin_family != AF_INET) 1828 return -EINVAL; 1829 t->id.daddr.a4 = sin->sin_addr.s_addr; 1830 break; 1831 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1832 case AF_INET6: 1833 sin6 = (struct sockaddr_in6*)sa; 1834 memcpy(t->saddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); 1835 sin6++; 1836 if (sin6->sin6_family != AF_INET6) 1837 return -EINVAL; 1838 memcpy(t->id.daddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); 1839 break; 1840 #endif 1841 default: 1842 return -EINVAL; 1843 } 1844 t->encap_family = sa->sa_family; 1845 } else 1846 t->encap_family = xp->family; 1847 1848 /* No way to set this via kame pfkey */ 1849 t->aalgos = t->ealgos = t->calgos = ~0; 1850 xp->xfrm_nr++; 1851 return 0; 1852 } 1853 1854 static int 1855 parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol) 1856 { 1857 int err; 1858 int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy); 1859 struct sadb_x_ipsecrequest *rq = (void*)(pol+1); 1860 1861 while (len >= sizeof(struct sadb_x_ipsecrequest)) { 1862 if ((err = parse_ipsecrequest(xp, rq)) < 0) 1863 return err; 1864 len -= rq->sadb_x_ipsecrequest_len; 1865 rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len); 1866 } 1867 return 0; 1868 } 1869 1870 static inline int pfkey_xfrm_policy2sec_ctx_size(struct xfrm_policy *xp) 1871 { 1872 struct xfrm_sec_ctx *xfrm_ctx = xp->security; 1873 1874 if (xfrm_ctx) { 1875 int len = sizeof(struct sadb_x_sec_ctx); 1876 len += xfrm_ctx->ctx_len; 1877 return PFKEY_ALIGN8(len); 1878 } 1879 return 0; 1880 } 1881 1882 static int pfkey_xfrm_policy2msg_size(struct xfrm_policy *xp) 1883 { 1884 struct xfrm_tmpl *t; 1885 int sockaddr_size = pfkey_sockaddr_size(xp->family); 1886 int socklen = 0; 1887 int i; 1888 1889 for (i=0; i<xp->xfrm_nr; i++) { 1890 t = xp->xfrm_vec + i; 1891 socklen += (t->encap_family == AF_INET ? 1892 sizeof(struct sockaddr_in) : 1893 sizeof(struct sockaddr_in6)); 1894 } 1895 1896 return sizeof(struct sadb_msg) + 1897 (sizeof(struct sadb_lifetime) * 3) + 1898 (sizeof(struct sadb_address) * 2) + 1899 (sockaddr_size * 2) + 1900 sizeof(struct sadb_x_policy) + 1901 (xp->xfrm_nr * sizeof(struct sadb_x_ipsecrequest)) + 1902 (socklen * 2) + 1903 pfkey_xfrm_policy2sec_ctx_size(xp); 1904 } 1905 1906 static struct sk_buff * pfkey_xfrm_policy2msg_prep(struct xfrm_policy *xp) 1907 { 1908 struct sk_buff *skb; 1909 int size; 1910 1911 size = pfkey_xfrm_policy2msg_size(xp); 1912 1913 skb = alloc_skb(size + 16, GFP_ATOMIC); 1914 if (skb == NULL) 1915 return ERR_PTR(-ENOBUFS); 1916 1917 return skb; 1918 } 1919 1920 static int pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, int dir) 1921 { 1922 struct sadb_msg *hdr; 1923 struct sadb_address *addr; 1924 struct sadb_lifetime *lifetime; 1925 struct sadb_x_policy *pol; 1926 struct sockaddr_in *sin; 1927 struct sadb_x_sec_ctx *sec_ctx; 1928 struct xfrm_sec_ctx *xfrm_ctx; 1929 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1930 struct sockaddr_in6 *sin6; 1931 #endif 1932 int i; 1933 int size; 1934 int sockaddr_size = pfkey_sockaddr_size(xp->family); 1935 int socklen = (xp->family == AF_INET ? 1936 sizeof(struct sockaddr_in) : 1937 sizeof(struct sockaddr_in6)); 1938 1939 size = pfkey_xfrm_policy2msg_size(xp); 1940 1941 /* call should fill header later */ 1942 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 1943 memset(hdr, 0, size); /* XXX do we need this ? */ 1944 1945 /* src address */ 1946 addr = (struct sadb_address*) skb_put(skb, 1947 sizeof(struct sadb_address)+sockaddr_size); 1948 addr->sadb_address_len = 1949 (sizeof(struct sadb_address)+sockaddr_size)/ 1950 sizeof(uint64_t); 1951 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 1952 addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto); 1953 addr->sadb_address_prefixlen = xp->selector.prefixlen_s; 1954 addr->sadb_address_reserved = 0; 1955 /* src address */ 1956 if (xp->family == AF_INET) { 1957 sin = (struct sockaddr_in *) (addr + 1); 1958 sin->sin_family = AF_INET; 1959 sin->sin_addr.s_addr = xp->selector.saddr.a4; 1960 sin->sin_port = xp->selector.sport; 1961 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 1962 } 1963 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1964 else if (xp->family == AF_INET6) { 1965 sin6 = (struct sockaddr_in6 *) (addr + 1); 1966 sin6->sin6_family = AF_INET6; 1967 sin6->sin6_port = xp->selector.sport; 1968 sin6->sin6_flowinfo = 0; 1969 memcpy(&sin6->sin6_addr, xp->selector.saddr.a6, 1970 sizeof(struct in6_addr)); 1971 sin6->sin6_scope_id = 0; 1972 } 1973 #endif 1974 else 1975 BUG(); 1976 1977 /* dst address */ 1978 addr = (struct sadb_address*) skb_put(skb, 1979 sizeof(struct sadb_address)+sockaddr_size); 1980 addr->sadb_address_len = 1981 (sizeof(struct sadb_address)+sockaddr_size)/ 1982 sizeof(uint64_t); 1983 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 1984 addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto); 1985 addr->sadb_address_prefixlen = xp->selector.prefixlen_d; 1986 addr->sadb_address_reserved = 0; 1987 if (xp->family == AF_INET) { 1988 sin = (struct sockaddr_in *) (addr + 1); 1989 sin->sin_family = AF_INET; 1990 sin->sin_addr.s_addr = xp->selector.daddr.a4; 1991 sin->sin_port = xp->selector.dport; 1992 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 1993 } 1994 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1995 else if (xp->family == AF_INET6) { 1996 sin6 = (struct sockaddr_in6 *) (addr + 1); 1997 sin6->sin6_family = AF_INET6; 1998 sin6->sin6_port = xp->selector.dport; 1999 sin6->sin6_flowinfo = 0; 2000 memcpy(&sin6->sin6_addr, xp->selector.daddr.a6, 2001 sizeof(struct in6_addr)); 2002 sin6->sin6_scope_id = 0; 2003 } 2004 #endif 2005 else 2006 BUG(); 2007 2008 /* hard time */ 2009 lifetime = (struct sadb_lifetime *) skb_put(skb, 2010 sizeof(struct sadb_lifetime)); 2011 lifetime->sadb_lifetime_len = 2012 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2013 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 2014 lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.hard_packet_limit); 2015 lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.hard_byte_limit); 2016 lifetime->sadb_lifetime_addtime = xp->lft.hard_add_expires_seconds; 2017 lifetime->sadb_lifetime_usetime = xp->lft.hard_use_expires_seconds; 2018 /* soft time */ 2019 lifetime = (struct sadb_lifetime *) skb_put(skb, 2020 sizeof(struct sadb_lifetime)); 2021 lifetime->sadb_lifetime_len = 2022 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2023 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 2024 lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.soft_packet_limit); 2025 lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.soft_byte_limit); 2026 lifetime->sadb_lifetime_addtime = xp->lft.soft_add_expires_seconds; 2027 lifetime->sadb_lifetime_usetime = xp->lft.soft_use_expires_seconds; 2028 /* current time */ 2029 lifetime = (struct sadb_lifetime *) skb_put(skb, 2030 sizeof(struct sadb_lifetime)); 2031 lifetime->sadb_lifetime_len = 2032 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2033 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 2034 lifetime->sadb_lifetime_allocations = xp->curlft.packets; 2035 lifetime->sadb_lifetime_bytes = xp->curlft.bytes; 2036 lifetime->sadb_lifetime_addtime = xp->curlft.add_time; 2037 lifetime->sadb_lifetime_usetime = xp->curlft.use_time; 2038 2039 pol = (struct sadb_x_policy *) skb_put(skb, sizeof(struct sadb_x_policy)); 2040 pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t); 2041 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 2042 pol->sadb_x_policy_type = IPSEC_POLICY_DISCARD; 2043 if (xp->action == XFRM_POLICY_ALLOW) { 2044 if (xp->xfrm_nr) 2045 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 2046 else 2047 pol->sadb_x_policy_type = IPSEC_POLICY_NONE; 2048 } 2049 pol->sadb_x_policy_dir = dir+1; 2050 pol->sadb_x_policy_id = xp->index; 2051 pol->sadb_x_policy_priority = xp->priority; 2052 2053 for (i=0; i<xp->xfrm_nr; i++) { 2054 struct sadb_x_ipsecrequest *rq; 2055 struct xfrm_tmpl *t = xp->xfrm_vec + i; 2056 int req_size; 2057 int mode; 2058 2059 req_size = sizeof(struct sadb_x_ipsecrequest); 2060 if (t->mode == XFRM_MODE_TUNNEL) 2061 req_size += ((t->encap_family == AF_INET ? 2062 sizeof(struct sockaddr_in) : 2063 sizeof(struct sockaddr_in6)) * 2); 2064 else 2065 size -= 2*socklen; 2066 rq = (void*)skb_put(skb, req_size); 2067 pol->sadb_x_policy_len += req_size/8; 2068 memset(rq, 0, sizeof(*rq)); 2069 rq->sadb_x_ipsecrequest_len = req_size; 2070 rq->sadb_x_ipsecrequest_proto = t->id.proto; 2071 if ((mode = pfkey_mode_from_xfrm(t->mode)) < 0) 2072 return -EINVAL; 2073 rq->sadb_x_ipsecrequest_mode = mode; 2074 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE; 2075 if (t->reqid) 2076 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE; 2077 if (t->optional) 2078 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE; 2079 rq->sadb_x_ipsecrequest_reqid = t->reqid; 2080 if (t->mode == XFRM_MODE_TUNNEL) { 2081 switch (t->encap_family) { 2082 case AF_INET: 2083 sin = (void*)(rq+1); 2084 sin->sin_family = AF_INET; 2085 sin->sin_addr.s_addr = t->saddr.a4; 2086 sin->sin_port = 0; 2087 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2088 sin++; 2089 sin->sin_family = AF_INET; 2090 sin->sin_addr.s_addr = t->id.daddr.a4; 2091 sin->sin_port = 0; 2092 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2093 break; 2094 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2095 case AF_INET6: 2096 sin6 = (void*)(rq+1); 2097 sin6->sin6_family = AF_INET6; 2098 sin6->sin6_port = 0; 2099 sin6->sin6_flowinfo = 0; 2100 memcpy(&sin6->sin6_addr, t->saddr.a6, 2101 sizeof(struct in6_addr)); 2102 sin6->sin6_scope_id = 0; 2103 2104 sin6++; 2105 sin6->sin6_family = AF_INET6; 2106 sin6->sin6_port = 0; 2107 sin6->sin6_flowinfo = 0; 2108 memcpy(&sin6->sin6_addr, t->id.daddr.a6, 2109 sizeof(struct in6_addr)); 2110 sin6->sin6_scope_id = 0; 2111 break; 2112 #endif 2113 default: 2114 break; 2115 } 2116 } 2117 } 2118 2119 /* security context */ 2120 if ((xfrm_ctx = xp->security)) { 2121 int ctx_size = pfkey_xfrm_policy2sec_ctx_size(xp); 2122 2123 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, ctx_size); 2124 sec_ctx->sadb_x_sec_len = ctx_size / sizeof(uint64_t); 2125 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 2126 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 2127 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 2128 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 2129 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 2130 xfrm_ctx->ctx_len); 2131 } 2132 2133 hdr->sadb_msg_len = size / sizeof(uint64_t); 2134 hdr->sadb_msg_reserved = atomic_read(&xp->refcnt); 2135 2136 return 0; 2137 } 2138 2139 static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c) 2140 { 2141 struct sk_buff *out_skb; 2142 struct sadb_msg *out_hdr; 2143 int err; 2144 2145 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2146 if (IS_ERR(out_skb)) { 2147 err = PTR_ERR(out_skb); 2148 goto out; 2149 } 2150 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2151 if (err < 0) 2152 return err; 2153 2154 out_hdr = (struct sadb_msg *) out_skb->data; 2155 out_hdr->sadb_msg_version = PF_KEY_V2; 2156 2157 if (c->data.byid && c->event == XFRM_MSG_DELPOLICY) 2158 out_hdr->sadb_msg_type = SADB_X_SPDDELETE2; 2159 else 2160 out_hdr->sadb_msg_type = event2poltype(c->event); 2161 out_hdr->sadb_msg_errno = 0; 2162 out_hdr->sadb_msg_seq = c->seq; 2163 out_hdr->sadb_msg_pid = c->pid; 2164 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 2165 out: 2166 return 0; 2167 2168 } 2169 2170 static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2171 { 2172 int err = 0; 2173 struct sadb_lifetime *lifetime; 2174 struct sadb_address *sa; 2175 struct sadb_x_policy *pol; 2176 struct xfrm_policy *xp; 2177 struct km_event c; 2178 struct sadb_x_sec_ctx *sec_ctx; 2179 2180 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2181 ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || 2182 !ext_hdrs[SADB_X_EXT_POLICY-1]) 2183 return -EINVAL; 2184 2185 pol = ext_hdrs[SADB_X_EXT_POLICY-1]; 2186 if (pol->sadb_x_policy_type > IPSEC_POLICY_IPSEC) 2187 return -EINVAL; 2188 if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) 2189 return -EINVAL; 2190 2191 xp = xfrm_policy_alloc(GFP_KERNEL); 2192 if (xp == NULL) 2193 return -ENOBUFS; 2194 2195 xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? 2196 XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); 2197 xp->priority = pol->sadb_x_policy_priority; 2198 2199 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2200 xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr); 2201 if (!xp->family) { 2202 err = -EINVAL; 2203 goto out; 2204 } 2205 xp->selector.family = xp->family; 2206 xp->selector.prefixlen_s = sa->sadb_address_prefixlen; 2207 xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2208 xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port; 2209 if (xp->selector.sport) 2210 xp->selector.sport_mask = htons(0xffff); 2211 2212 sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 2213 pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr); 2214 xp->selector.prefixlen_d = sa->sadb_address_prefixlen; 2215 2216 /* Amusing, we set this twice. KAME apps appear to set same value 2217 * in both addresses. 2218 */ 2219 xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2220 2221 xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port; 2222 if (xp->selector.dport) 2223 xp->selector.dport_mask = htons(0xffff); 2224 2225 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 2226 if (sec_ctx != NULL) { 2227 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 2228 2229 if (!uctx) { 2230 err = -ENOBUFS; 2231 goto out; 2232 } 2233 2234 err = security_xfrm_policy_alloc(xp, uctx); 2235 kfree(uctx); 2236 2237 if (err) 2238 goto out; 2239 } 2240 2241 xp->lft.soft_byte_limit = XFRM_INF; 2242 xp->lft.hard_byte_limit = XFRM_INF; 2243 xp->lft.soft_packet_limit = XFRM_INF; 2244 xp->lft.hard_packet_limit = XFRM_INF; 2245 if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD-1]) != NULL) { 2246 xp->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 2247 xp->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 2248 xp->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime; 2249 xp->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime; 2250 } 2251 if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) != NULL) { 2252 xp->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 2253 xp->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 2254 xp->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime; 2255 xp->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime; 2256 } 2257 xp->xfrm_nr = 0; 2258 if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 2259 (err = parse_ipsecrequests(xp, pol)) < 0) 2260 goto out; 2261 2262 err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp, 2263 hdr->sadb_msg_type != SADB_X_SPDUPDATE); 2264 2265 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 2266 AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL); 2267 2268 if (err) 2269 goto out; 2270 2271 if (hdr->sadb_msg_type == SADB_X_SPDUPDATE) 2272 c.event = XFRM_MSG_UPDPOLICY; 2273 else 2274 c.event = XFRM_MSG_NEWPOLICY; 2275 2276 c.seq = hdr->sadb_msg_seq; 2277 c.pid = hdr->sadb_msg_pid; 2278 2279 km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c); 2280 xfrm_pol_put(xp); 2281 return 0; 2282 2283 out: 2284 security_xfrm_policy_free(xp); 2285 kfree(xp); 2286 return err; 2287 } 2288 2289 static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2290 { 2291 int err; 2292 struct sadb_address *sa; 2293 struct sadb_x_policy *pol; 2294 struct xfrm_policy *xp, tmp; 2295 struct xfrm_selector sel; 2296 struct km_event c; 2297 struct sadb_x_sec_ctx *sec_ctx; 2298 2299 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2300 ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || 2301 !ext_hdrs[SADB_X_EXT_POLICY-1]) 2302 return -EINVAL; 2303 2304 pol = ext_hdrs[SADB_X_EXT_POLICY-1]; 2305 if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) 2306 return -EINVAL; 2307 2308 memset(&sel, 0, sizeof(sel)); 2309 2310 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2311 sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr); 2312 sel.prefixlen_s = sa->sadb_address_prefixlen; 2313 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2314 sel.sport = ((struct sockaddr_in *)(sa+1))->sin_port; 2315 if (sel.sport) 2316 sel.sport_mask = htons(0xffff); 2317 2318 sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 2319 pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr); 2320 sel.prefixlen_d = sa->sadb_address_prefixlen; 2321 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2322 sel.dport = ((struct sockaddr_in *)(sa+1))->sin_port; 2323 if (sel.dport) 2324 sel.dport_mask = htons(0xffff); 2325 2326 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 2327 memset(&tmp, 0, sizeof(struct xfrm_policy)); 2328 2329 if (sec_ctx != NULL) { 2330 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 2331 2332 if (!uctx) 2333 return -ENOMEM; 2334 2335 err = security_xfrm_policy_alloc(&tmp, uctx); 2336 kfree(uctx); 2337 2338 if (err) 2339 return err; 2340 } 2341 2342 xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1, 2343 &sel, tmp.security, 1, &err); 2344 security_xfrm_policy_free(&tmp); 2345 2346 if (xp == NULL) 2347 return -ENOENT; 2348 2349 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 2350 AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); 2351 2352 if (err) 2353 goto out; 2354 2355 c.seq = hdr->sadb_msg_seq; 2356 c.pid = hdr->sadb_msg_pid; 2357 c.event = XFRM_MSG_DELPOLICY; 2358 km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c); 2359 2360 out: 2361 xfrm_pol_put(xp); 2362 return err; 2363 } 2364 2365 static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, struct sadb_msg *hdr, int dir) 2366 { 2367 int err; 2368 struct sk_buff *out_skb; 2369 struct sadb_msg *out_hdr; 2370 err = 0; 2371 2372 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2373 if (IS_ERR(out_skb)) { 2374 err = PTR_ERR(out_skb); 2375 goto out; 2376 } 2377 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2378 if (err < 0) 2379 goto out; 2380 2381 out_hdr = (struct sadb_msg *) out_skb->data; 2382 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 2383 out_hdr->sadb_msg_type = hdr->sadb_msg_type; 2384 out_hdr->sadb_msg_satype = 0; 2385 out_hdr->sadb_msg_errno = 0; 2386 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 2387 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 2388 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk); 2389 err = 0; 2390 2391 out: 2392 return err; 2393 } 2394 2395 #ifdef CONFIG_NET_KEY_MIGRATE 2396 static int pfkey_sockaddr_pair_size(sa_family_t family) 2397 { 2398 switch (family) { 2399 case AF_INET: 2400 return PFKEY_ALIGN8(sizeof(struct sockaddr_in) * 2); 2401 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2402 case AF_INET6: 2403 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6) * 2); 2404 #endif 2405 default: 2406 return 0; 2407 } 2408 /* NOTREACHED */ 2409 } 2410 2411 static int parse_sockaddr_pair(struct sadb_x_ipsecrequest *rq, 2412 xfrm_address_t *saddr, xfrm_address_t *daddr, 2413 u16 *family) 2414 { 2415 struct sockaddr *sa = (struct sockaddr *)(rq + 1); 2416 if (rq->sadb_x_ipsecrequest_len < 2417 pfkey_sockaddr_pair_size(sa->sa_family)) 2418 return -EINVAL; 2419 2420 switch (sa->sa_family) { 2421 case AF_INET: 2422 { 2423 struct sockaddr_in *sin; 2424 sin = (struct sockaddr_in *)sa; 2425 if ((sin+1)->sin_family != AF_INET) 2426 return -EINVAL; 2427 memcpy(&saddr->a4, &sin->sin_addr, sizeof(saddr->a4)); 2428 sin++; 2429 memcpy(&daddr->a4, &sin->sin_addr, sizeof(daddr->a4)); 2430 *family = AF_INET; 2431 break; 2432 } 2433 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2434 case AF_INET6: 2435 { 2436 struct sockaddr_in6 *sin6; 2437 sin6 = (struct sockaddr_in6 *)sa; 2438 if ((sin6+1)->sin6_family != AF_INET6) 2439 return -EINVAL; 2440 memcpy(&saddr->a6, &sin6->sin6_addr, 2441 sizeof(saddr->a6)); 2442 sin6++; 2443 memcpy(&daddr->a6, &sin6->sin6_addr, 2444 sizeof(daddr->a6)); 2445 *family = AF_INET6; 2446 break; 2447 } 2448 #endif 2449 default: 2450 return -EINVAL; 2451 } 2452 2453 return 0; 2454 } 2455 2456 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, 2457 struct xfrm_migrate *m) 2458 { 2459 int err; 2460 struct sadb_x_ipsecrequest *rq2; 2461 int mode; 2462 2463 if (len <= sizeof(struct sadb_x_ipsecrequest) || 2464 len < rq1->sadb_x_ipsecrequest_len) 2465 return -EINVAL; 2466 2467 /* old endoints */ 2468 err = parse_sockaddr_pair(rq1, &m->old_saddr, &m->old_daddr, 2469 &m->old_family); 2470 if (err) 2471 return err; 2472 2473 rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len); 2474 len -= rq1->sadb_x_ipsecrequest_len; 2475 2476 if (len <= sizeof(struct sadb_x_ipsecrequest) || 2477 len < rq2->sadb_x_ipsecrequest_len) 2478 return -EINVAL; 2479 2480 /* new endpoints */ 2481 err = parse_sockaddr_pair(rq2, &m->new_saddr, &m->new_daddr, 2482 &m->new_family); 2483 if (err) 2484 return err; 2485 2486 if (rq1->sadb_x_ipsecrequest_proto != rq2->sadb_x_ipsecrequest_proto || 2487 rq1->sadb_x_ipsecrequest_mode != rq2->sadb_x_ipsecrequest_mode || 2488 rq1->sadb_x_ipsecrequest_reqid != rq2->sadb_x_ipsecrequest_reqid) 2489 return -EINVAL; 2490 2491 m->proto = rq1->sadb_x_ipsecrequest_proto; 2492 if ((mode = pfkey_mode_to_xfrm(rq1->sadb_x_ipsecrequest_mode)) < 0) 2493 return -EINVAL; 2494 m->mode = mode; 2495 m->reqid = rq1->sadb_x_ipsecrequest_reqid; 2496 2497 return ((int)(rq1->sadb_x_ipsecrequest_len + 2498 rq2->sadb_x_ipsecrequest_len)); 2499 } 2500 2501 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, 2502 struct sadb_msg *hdr, void **ext_hdrs) 2503 { 2504 int i, len, ret, err = -EINVAL; 2505 u8 dir; 2506 struct sadb_address *sa; 2507 struct sadb_x_policy *pol; 2508 struct sadb_x_ipsecrequest *rq; 2509 struct xfrm_selector sel; 2510 struct xfrm_migrate m[XFRM_MAX_DEPTH]; 2511 2512 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1], 2513 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) || 2514 !ext_hdrs[SADB_X_EXT_POLICY - 1]) { 2515 err = -EINVAL; 2516 goto out; 2517 } 2518 2519 pol = ext_hdrs[SADB_X_EXT_POLICY - 1]; 2520 if (!pol) { 2521 err = -EINVAL; 2522 goto out; 2523 } 2524 2525 if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) { 2526 err = -EINVAL; 2527 goto out; 2528 } 2529 2530 dir = pol->sadb_x_policy_dir - 1; 2531 memset(&sel, 0, sizeof(sel)); 2532 2533 /* set source address info of selector */ 2534 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC - 1]; 2535 sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr); 2536 sel.prefixlen_s = sa->sadb_address_prefixlen; 2537 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2538 sel.sport = ((struct sockaddr_in *)(sa + 1))->sin_port; 2539 if (sel.sport) 2540 sel.sport_mask = ~0; 2541 2542 /* set destination address info of selector */ 2543 sa = ext_hdrs[SADB_EXT_ADDRESS_DST - 1], 2544 pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr); 2545 sel.prefixlen_d = sa->sadb_address_prefixlen; 2546 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2547 sel.dport = ((struct sockaddr_in *)(sa + 1))->sin_port; 2548 if (sel.dport) 2549 sel.dport_mask = ~0; 2550 2551 rq = (struct sadb_x_ipsecrequest *)(pol + 1); 2552 2553 /* extract ipsecrequests */ 2554 i = 0; 2555 len = pol->sadb_x_policy_len * 8 - sizeof(struct sadb_x_policy); 2556 2557 while (len > 0 && i < XFRM_MAX_DEPTH) { 2558 ret = ipsecrequests_to_migrate(rq, len, &m[i]); 2559 if (ret < 0) { 2560 err = ret; 2561 goto out; 2562 } else { 2563 rq = (struct sadb_x_ipsecrequest *)((u8 *)rq + ret); 2564 len -= ret; 2565 i++; 2566 } 2567 } 2568 2569 if (!i || len > 0) { 2570 err = -EINVAL; 2571 goto out; 2572 } 2573 2574 return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i); 2575 2576 out: 2577 return err; 2578 } 2579 #else 2580 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, 2581 struct sadb_msg *hdr, void **ext_hdrs) 2582 { 2583 return -ENOPROTOOPT; 2584 } 2585 #endif 2586 2587 2588 static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2589 { 2590 unsigned int dir; 2591 int err = 0, delete; 2592 struct sadb_x_policy *pol; 2593 struct xfrm_policy *xp; 2594 struct km_event c; 2595 2596 if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL) 2597 return -EINVAL; 2598 2599 dir = xfrm_policy_id2dir(pol->sadb_x_policy_id); 2600 if (dir >= XFRM_POLICY_MAX) 2601 return -EINVAL; 2602 2603 delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2); 2604 xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id, 2605 delete, &err); 2606 if (xp == NULL) 2607 return -ENOENT; 2608 2609 if (delete) { 2610 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 2611 AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); 2612 2613 if (err) 2614 goto out; 2615 c.seq = hdr->sadb_msg_seq; 2616 c.pid = hdr->sadb_msg_pid; 2617 c.data.byid = 1; 2618 c.event = XFRM_MSG_DELPOLICY; 2619 km_policy_notify(xp, dir, &c); 2620 } else { 2621 err = key_pol_get_resp(sk, xp, hdr, dir); 2622 } 2623 2624 out: 2625 xfrm_pol_put(xp); 2626 return err; 2627 } 2628 2629 static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr) 2630 { 2631 struct pfkey_dump_data *data = ptr; 2632 struct sk_buff *out_skb; 2633 struct sadb_msg *out_hdr; 2634 int err; 2635 2636 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2637 if (IS_ERR(out_skb)) 2638 return PTR_ERR(out_skb); 2639 2640 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2641 if (err < 0) 2642 return err; 2643 2644 out_hdr = (struct sadb_msg *) out_skb->data; 2645 out_hdr->sadb_msg_version = data->hdr->sadb_msg_version; 2646 out_hdr->sadb_msg_type = SADB_X_SPDDUMP; 2647 out_hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; 2648 out_hdr->sadb_msg_errno = 0; 2649 out_hdr->sadb_msg_seq = count; 2650 out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid; 2651 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk); 2652 return 0; 2653 } 2654 2655 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2656 { 2657 struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk }; 2658 2659 return xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_sp, &data); 2660 } 2661 2662 static int key_notify_policy_flush(struct km_event *c) 2663 { 2664 struct sk_buff *skb_out; 2665 struct sadb_msg *hdr; 2666 2667 skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC); 2668 if (!skb_out) 2669 return -ENOBUFS; 2670 hdr = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg)); 2671 hdr->sadb_msg_type = SADB_X_SPDFLUSH; 2672 hdr->sadb_msg_seq = c->seq; 2673 hdr->sadb_msg_pid = c->pid; 2674 hdr->sadb_msg_version = PF_KEY_V2; 2675 hdr->sadb_msg_errno = (uint8_t) 0; 2676 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 2677 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL); 2678 return 0; 2679 2680 } 2681 2682 static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2683 { 2684 struct km_event c; 2685 struct xfrm_audit audit_info; 2686 2687 audit_info.loginuid = audit_get_loginuid(current->audit_context); 2688 audit_info.secid = 0; 2689 xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info); 2690 c.data.type = XFRM_POLICY_TYPE_MAIN; 2691 c.event = XFRM_MSG_FLUSHPOLICY; 2692 c.pid = hdr->sadb_msg_pid; 2693 c.seq = hdr->sadb_msg_seq; 2694 km_policy_notify(NULL, 0, &c); 2695 2696 return 0; 2697 } 2698 2699 typedef int (*pfkey_handler)(struct sock *sk, struct sk_buff *skb, 2700 struct sadb_msg *hdr, void **ext_hdrs); 2701 static pfkey_handler pfkey_funcs[SADB_MAX + 1] = { 2702 [SADB_RESERVED] = pfkey_reserved, 2703 [SADB_GETSPI] = pfkey_getspi, 2704 [SADB_UPDATE] = pfkey_add, 2705 [SADB_ADD] = pfkey_add, 2706 [SADB_DELETE] = pfkey_delete, 2707 [SADB_GET] = pfkey_get, 2708 [SADB_ACQUIRE] = pfkey_acquire, 2709 [SADB_REGISTER] = pfkey_register, 2710 [SADB_EXPIRE] = NULL, 2711 [SADB_FLUSH] = pfkey_flush, 2712 [SADB_DUMP] = pfkey_dump, 2713 [SADB_X_PROMISC] = pfkey_promisc, 2714 [SADB_X_PCHANGE] = NULL, 2715 [SADB_X_SPDUPDATE] = pfkey_spdadd, 2716 [SADB_X_SPDADD] = pfkey_spdadd, 2717 [SADB_X_SPDDELETE] = pfkey_spddelete, 2718 [SADB_X_SPDGET] = pfkey_spdget, 2719 [SADB_X_SPDACQUIRE] = NULL, 2720 [SADB_X_SPDDUMP] = pfkey_spddump, 2721 [SADB_X_SPDFLUSH] = pfkey_spdflush, 2722 [SADB_X_SPDSETIDX] = pfkey_spdadd, 2723 [SADB_X_SPDDELETE2] = pfkey_spdget, 2724 [SADB_X_MIGRATE] = pfkey_migrate, 2725 }; 2726 2727 static int pfkey_process(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr) 2728 { 2729 void *ext_hdrs[SADB_EXT_MAX]; 2730 int err; 2731 2732 pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, 2733 BROADCAST_PROMISC_ONLY, NULL); 2734 2735 memset(ext_hdrs, 0, sizeof(ext_hdrs)); 2736 err = parse_exthdrs(skb, hdr, ext_hdrs); 2737 if (!err) { 2738 err = -EOPNOTSUPP; 2739 if (pfkey_funcs[hdr->sadb_msg_type]) 2740 err = pfkey_funcs[hdr->sadb_msg_type](sk, skb, hdr, ext_hdrs); 2741 } 2742 return err; 2743 } 2744 2745 static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp) 2746 { 2747 struct sadb_msg *hdr = NULL; 2748 2749 if (skb->len < sizeof(*hdr)) { 2750 *errp = -EMSGSIZE; 2751 } else { 2752 hdr = (struct sadb_msg *) skb->data; 2753 if (hdr->sadb_msg_version != PF_KEY_V2 || 2754 hdr->sadb_msg_reserved != 0 || 2755 (hdr->sadb_msg_type <= SADB_RESERVED || 2756 hdr->sadb_msg_type > SADB_MAX)) { 2757 hdr = NULL; 2758 *errp = -EINVAL; 2759 } else if (hdr->sadb_msg_len != (skb->len / 2760 sizeof(uint64_t)) || 2761 hdr->sadb_msg_len < (sizeof(struct sadb_msg) / 2762 sizeof(uint64_t))) { 2763 hdr = NULL; 2764 *errp = -EMSGSIZE; 2765 } else { 2766 *errp = 0; 2767 } 2768 } 2769 return hdr; 2770 } 2771 2772 static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2773 { 2774 return t->aalgos & (1 << d->desc.sadb_alg_id); 2775 } 2776 2777 static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2778 { 2779 return t->ealgos & (1 << d->desc.sadb_alg_id); 2780 } 2781 2782 static int count_ah_combs(struct xfrm_tmpl *t) 2783 { 2784 int i, sz = 0; 2785 2786 for (i = 0; ; i++) { 2787 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 2788 if (!aalg) 2789 break; 2790 if (aalg_tmpl_set(t, aalg) && aalg->available) 2791 sz += sizeof(struct sadb_comb); 2792 } 2793 return sz + sizeof(struct sadb_prop); 2794 } 2795 2796 static int count_esp_combs(struct xfrm_tmpl *t) 2797 { 2798 int i, k, sz = 0; 2799 2800 for (i = 0; ; i++) { 2801 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 2802 if (!ealg) 2803 break; 2804 2805 if (!(ealg_tmpl_set(t, ealg) && ealg->available)) 2806 continue; 2807 2808 for (k = 1; ; k++) { 2809 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k); 2810 if (!aalg) 2811 break; 2812 2813 if (aalg_tmpl_set(t, aalg) && aalg->available) 2814 sz += sizeof(struct sadb_comb); 2815 } 2816 } 2817 return sz + sizeof(struct sadb_prop); 2818 } 2819 2820 static void dump_ah_combs(struct sk_buff *skb, struct xfrm_tmpl *t) 2821 { 2822 struct sadb_prop *p; 2823 int i; 2824 2825 p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop)); 2826 p->sadb_prop_len = sizeof(struct sadb_prop)/8; 2827 p->sadb_prop_exttype = SADB_EXT_PROPOSAL; 2828 p->sadb_prop_replay = 32; 2829 memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved)); 2830 2831 for (i = 0; ; i++) { 2832 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 2833 if (!aalg) 2834 break; 2835 2836 if (aalg_tmpl_set(t, aalg) && aalg->available) { 2837 struct sadb_comb *c; 2838 c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); 2839 memset(c, 0, sizeof(*c)); 2840 p->sadb_prop_len += sizeof(struct sadb_comb)/8; 2841 c->sadb_comb_auth = aalg->desc.sadb_alg_id; 2842 c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits; 2843 c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits; 2844 c->sadb_comb_hard_addtime = 24*60*60; 2845 c->sadb_comb_soft_addtime = 20*60*60; 2846 c->sadb_comb_hard_usetime = 8*60*60; 2847 c->sadb_comb_soft_usetime = 7*60*60; 2848 } 2849 } 2850 } 2851 2852 static void dump_esp_combs(struct sk_buff *skb, struct xfrm_tmpl *t) 2853 { 2854 struct sadb_prop *p; 2855 int i, k; 2856 2857 p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop)); 2858 p->sadb_prop_len = sizeof(struct sadb_prop)/8; 2859 p->sadb_prop_exttype = SADB_EXT_PROPOSAL; 2860 p->sadb_prop_replay = 32; 2861 memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved)); 2862 2863 for (i=0; ; i++) { 2864 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 2865 if (!ealg) 2866 break; 2867 2868 if (!(ealg_tmpl_set(t, ealg) && ealg->available)) 2869 continue; 2870 2871 for (k = 1; ; k++) { 2872 struct sadb_comb *c; 2873 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k); 2874 if (!aalg) 2875 break; 2876 if (!(aalg_tmpl_set(t, aalg) && aalg->available)) 2877 continue; 2878 c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); 2879 memset(c, 0, sizeof(*c)); 2880 p->sadb_prop_len += sizeof(struct sadb_comb)/8; 2881 c->sadb_comb_auth = aalg->desc.sadb_alg_id; 2882 c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits; 2883 c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits; 2884 c->sadb_comb_encrypt = ealg->desc.sadb_alg_id; 2885 c->sadb_comb_encrypt_minbits = ealg->desc.sadb_alg_minbits; 2886 c->sadb_comb_encrypt_maxbits = ealg->desc.sadb_alg_maxbits; 2887 c->sadb_comb_hard_addtime = 24*60*60; 2888 c->sadb_comb_soft_addtime = 20*60*60; 2889 c->sadb_comb_hard_usetime = 8*60*60; 2890 c->sadb_comb_soft_usetime = 7*60*60; 2891 } 2892 } 2893 } 2894 2895 static int key_notify_policy_expire(struct xfrm_policy *xp, struct km_event *c) 2896 { 2897 return 0; 2898 } 2899 2900 static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c) 2901 { 2902 struct sk_buff *out_skb; 2903 struct sadb_msg *out_hdr; 2904 int hard; 2905 int hsc; 2906 2907 hard = c->data.hard; 2908 if (hard) 2909 hsc = 2; 2910 else 2911 hsc = 1; 2912 2913 out_skb = pfkey_xfrm_state2msg(x, 0, hsc); 2914 if (IS_ERR(out_skb)) 2915 return PTR_ERR(out_skb); 2916 2917 out_hdr = (struct sadb_msg *) out_skb->data; 2918 out_hdr->sadb_msg_version = PF_KEY_V2; 2919 out_hdr->sadb_msg_type = SADB_EXPIRE; 2920 out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 2921 out_hdr->sadb_msg_errno = 0; 2922 out_hdr->sadb_msg_reserved = 0; 2923 out_hdr->sadb_msg_seq = 0; 2924 out_hdr->sadb_msg_pid = 0; 2925 2926 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 2927 return 0; 2928 } 2929 2930 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c) 2931 { 2932 switch (c->event) { 2933 case XFRM_MSG_EXPIRE: 2934 return key_notify_sa_expire(x, c); 2935 case XFRM_MSG_DELSA: 2936 case XFRM_MSG_NEWSA: 2937 case XFRM_MSG_UPDSA: 2938 return key_notify_sa(x, c); 2939 case XFRM_MSG_FLUSHSA: 2940 return key_notify_sa_flush(c); 2941 case XFRM_MSG_NEWAE: /* not yet supported */ 2942 break; 2943 default: 2944 printk("pfkey: Unknown SA event %d\n", c->event); 2945 break; 2946 } 2947 2948 return 0; 2949 } 2950 2951 static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 2952 { 2953 if (xp && xp->type != XFRM_POLICY_TYPE_MAIN) 2954 return 0; 2955 2956 switch (c->event) { 2957 case XFRM_MSG_POLEXPIRE: 2958 return key_notify_policy_expire(xp, c); 2959 case XFRM_MSG_DELPOLICY: 2960 case XFRM_MSG_NEWPOLICY: 2961 case XFRM_MSG_UPDPOLICY: 2962 return key_notify_policy(xp, dir, c); 2963 case XFRM_MSG_FLUSHPOLICY: 2964 if (c->data.type != XFRM_POLICY_TYPE_MAIN) 2965 break; 2966 return key_notify_policy_flush(c); 2967 default: 2968 printk("pfkey: Unknown policy event %d\n", c->event); 2969 break; 2970 } 2971 2972 return 0; 2973 } 2974 2975 static u32 get_acqseq(void) 2976 { 2977 u32 res; 2978 static u32 acqseq; 2979 static DEFINE_SPINLOCK(acqseq_lock); 2980 2981 spin_lock_bh(&acqseq_lock); 2982 res = (++acqseq ? : ++acqseq); 2983 spin_unlock_bh(&acqseq_lock); 2984 return res; 2985 } 2986 2987 static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp, int dir) 2988 { 2989 struct sk_buff *skb; 2990 struct sadb_msg *hdr; 2991 struct sadb_address *addr; 2992 struct sadb_x_policy *pol; 2993 struct sockaddr_in *sin; 2994 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2995 struct sockaddr_in6 *sin6; 2996 #endif 2997 int sockaddr_size; 2998 int size; 2999 struct sadb_x_sec_ctx *sec_ctx; 3000 struct xfrm_sec_ctx *xfrm_ctx; 3001 int ctx_size = 0; 3002 3003 sockaddr_size = pfkey_sockaddr_size(x->props.family); 3004 if (!sockaddr_size) 3005 return -EINVAL; 3006 3007 size = sizeof(struct sadb_msg) + 3008 (sizeof(struct sadb_address) * 2) + 3009 (sockaddr_size * 2) + 3010 sizeof(struct sadb_x_policy); 3011 3012 if (x->id.proto == IPPROTO_AH) 3013 size += count_ah_combs(t); 3014 else if (x->id.proto == IPPROTO_ESP) 3015 size += count_esp_combs(t); 3016 3017 if ((xfrm_ctx = x->security)) { 3018 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len); 3019 size += sizeof(struct sadb_x_sec_ctx) + ctx_size; 3020 } 3021 3022 skb = alloc_skb(size + 16, GFP_ATOMIC); 3023 if (skb == NULL) 3024 return -ENOMEM; 3025 3026 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 3027 hdr->sadb_msg_version = PF_KEY_V2; 3028 hdr->sadb_msg_type = SADB_ACQUIRE; 3029 hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 3030 hdr->sadb_msg_len = size / sizeof(uint64_t); 3031 hdr->sadb_msg_errno = 0; 3032 hdr->sadb_msg_reserved = 0; 3033 hdr->sadb_msg_seq = x->km.seq = get_acqseq(); 3034 hdr->sadb_msg_pid = 0; 3035 3036 /* src address */ 3037 addr = (struct sadb_address*) skb_put(skb, 3038 sizeof(struct sadb_address)+sockaddr_size); 3039 addr->sadb_address_len = 3040 (sizeof(struct sadb_address)+sockaddr_size)/ 3041 sizeof(uint64_t); 3042 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 3043 addr->sadb_address_proto = 0; 3044 addr->sadb_address_reserved = 0; 3045 if (x->props.family == AF_INET) { 3046 addr->sadb_address_prefixlen = 32; 3047 3048 sin = (struct sockaddr_in *) (addr + 1); 3049 sin->sin_family = AF_INET; 3050 sin->sin_addr.s_addr = x->props.saddr.a4; 3051 sin->sin_port = 0; 3052 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3053 } 3054 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3055 else if (x->props.family == AF_INET6) { 3056 addr->sadb_address_prefixlen = 128; 3057 3058 sin6 = (struct sockaddr_in6 *) (addr + 1); 3059 sin6->sin6_family = AF_INET6; 3060 sin6->sin6_port = 0; 3061 sin6->sin6_flowinfo = 0; 3062 memcpy(&sin6->sin6_addr, 3063 x->props.saddr.a6, sizeof(struct in6_addr)); 3064 sin6->sin6_scope_id = 0; 3065 } 3066 #endif 3067 else 3068 BUG(); 3069 3070 /* dst address */ 3071 addr = (struct sadb_address*) skb_put(skb, 3072 sizeof(struct sadb_address)+sockaddr_size); 3073 addr->sadb_address_len = 3074 (sizeof(struct sadb_address)+sockaddr_size)/ 3075 sizeof(uint64_t); 3076 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 3077 addr->sadb_address_proto = 0; 3078 addr->sadb_address_reserved = 0; 3079 if (x->props.family == AF_INET) { 3080 addr->sadb_address_prefixlen = 32; 3081 3082 sin = (struct sockaddr_in *) (addr + 1); 3083 sin->sin_family = AF_INET; 3084 sin->sin_addr.s_addr = x->id.daddr.a4; 3085 sin->sin_port = 0; 3086 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3087 } 3088 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3089 else if (x->props.family == AF_INET6) { 3090 addr->sadb_address_prefixlen = 128; 3091 3092 sin6 = (struct sockaddr_in6 *) (addr + 1); 3093 sin6->sin6_family = AF_INET6; 3094 sin6->sin6_port = 0; 3095 sin6->sin6_flowinfo = 0; 3096 memcpy(&sin6->sin6_addr, 3097 x->id.daddr.a6, sizeof(struct in6_addr)); 3098 sin6->sin6_scope_id = 0; 3099 } 3100 #endif 3101 else 3102 BUG(); 3103 3104 pol = (struct sadb_x_policy *) skb_put(skb, sizeof(struct sadb_x_policy)); 3105 pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t); 3106 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 3107 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 3108 pol->sadb_x_policy_dir = dir+1; 3109 pol->sadb_x_policy_id = xp->index; 3110 3111 /* Set sadb_comb's. */ 3112 if (x->id.proto == IPPROTO_AH) 3113 dump_ah_combs(skb, t); 3114 else if (x->id.proto == IPPROTO_ESP) 3115 dump_esp_combs(skb, t); 3116 3117 /* security context */ 3118 if (xfrm_ctx) { 3119 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, 3120 sizeof(struct sadb_x_sec_ctx) + ctx_size); 3121 sec_ctx->sadb_x_sec_len = 3122 (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t); 3123 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 3124 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 3125 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 3126 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 3127 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 3128 xfrm_ctx->ctx_len); 3129 } 3130 3131 return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 3132 } 3133 3134 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, 3135 u8 *data, int len, int *dir) 3136 { 3137 struct xfrm_policy *xp; 3138 struct sadb_x_policy *pol = (struct sadb_x_policy*)data; 3139 struct sadb_x_sec_ctx *sec_ctx; 3140 3141 switch (sk->sk_family) { 3142 case AF_INET: 3143 if (opt != IP_IPSEC_POLICY) { 3144 *dir = -EOPNOTSUPP; 3145 return NULL; 3146 } 3147 break; 3148 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3149 case AF_INET6: 3150 if (opt != IPV6_IPSEC_POLICY) { 3151 *dir = -EOPNOTSUPP; 3152 return NULL; 3153 } 3154 break; 3155 #endif 3156 default: 3157 *dir = -EINVAL; 3158 return NULL; 3159 } 3160 3161 *dir = -EINVAL; 3162 3163 if (len < sizeof(struct sadb_x_policy) || 3164 pol->sadb_x_policy_len*8 > len || 3165 pol->sadb_x_policy_type > IPSEC_POLICY_BYPASS || 3166 (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir > IPSEC_DIR_OUTBOUND)) 3167 return NULL; 3168 3169 xp = xfrm_policy_alloc(GFP_ATOMIC); 3170 if (xp == NULL) { 3171 *dir = -ENOBUFS; 3172 return NULL; 3173 } 3174 3175 xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? 3176 XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); 3177 3178 xp->lft.soft_byte_limit = XFRM_INF; 3179 xp->lft.hard_byte_limit = XFRM_INF; 3180 xp->lft.soft_packet_limit = XFRM_INF; 3181 xp->lft.hard_packet_limit = XFRM_INF; 3182 xp->family = sk->sk_family; 3183 3184 xp->xfrm_nr = 0; 3185 if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 3186 (*dir = parse_ipsecrequests(xp, pol)) < 0) 3187 goto out; 3188 3189 /* security context too */ 3190 if (len >= (pol->sadb_x_policy_len*8 + 3191 sizeof(struct sadb_x_sec_ctx))) { 3192 char *p = (char *)pol; 3193 struct xfrm_user_sec_ctx *uctx; 3194 3195 p += pol->sadb_x_policy_len*8; 3196 sec_ctx = (struct sadb_x_sec_ctx *)p; 3197 if (len < pol->sadb_x_policy_len*8 + 3198 sec_ctx->sadb_x_sec_len) { 3199 *dir = -EINVAL; 3200 goto out; 3201 } 3202 if ((*dir = verify_sec_ctx_len(p))) 3203 goto out; 3204 uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 3205 *dir = security_xfrm_policy_alloc(xp, uctx); 3206 kfree(uctx); 3207 3208 if (*dir) 3209 goto out; 3210 } 3211 3212 *dir = pol->sadb_x_policy_dir-1; 3213 return xp; 3214 3215 out: 3216 security_xfrm_policy_free(xp); 3217 kfree(xp); 3218 return NULL; 3219 } 3220 3221 static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 3222 { 3223 struct sk_buff *skb; 3224 struct sadb_msg *hdr; 3225 struct sadb_sa *sa; 3226 struct sadb_address *addr; 3227 struct sadb_x_nat_t_port *n_port; 3228 struct sockaddr_in *sin; 3229 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3230 struct sockaddr_in6 *sin6; 3231 #endif 3232 int sockaddr_size; 3233 int size; 3234 __u8 satype = (x->id.proto == IPPROTO_ESP ? SADB_SATYPE_ESP : 0); 3235 struct xfrm_encap_tmpl *natt = NULL; 3236 3237 sockaddr_size = pfkey_sockaddr_size(x->props.family); 3238 if (!sockaddr_size) 3239 return -EINVAL; 3240 3241 if (!satype) 3242 return -EINVAL; 3243 3244 if (!x->encap) 3245 return -EINVAL; 3246 3247 natt = x->encap; 3248 3249 /* Build an SADB_X_NAT_T_NEW_MAPPING message: 3250 * 3251 * HDR | SA | ADDRESS_SRC (old addr) | NAT_T_SPORT (old port) | 3252 * ADDRESS_DST (new addr) | NAT_T_DPORT (new port) 3253 */ 3254 3255 size = sizeof(struct sadb_msg) + 3256 sizeof(struct sadb_sa) + 3257 (sizeof(struct sadb_address) * 2) + 3258 (sockaddr_size * 2) + 3259 (sizeof(struct sadb_x_nat_t_port) * 2); 3260 3261 skb = alloc_skb(size + 16, GFP_ATOMIC); 3262 if (skb == NULL) 3263 return -ENOMEM; 3264 3265 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 3266 hdr->sadb_msg_version = PF_KEY_V2; 3267 hdr->sadb_msg_type = SADB_X_NAT_T_NEW_MAPPING; 3268 hdr->sadb_msg_satype = satype; 3269 hdr->sadb_msg_len = size / sizeof(uint64_t); 3270 hdr->sadb_msg_errno = 0; 3271 hdr->sadb_msg_reserved = 0; 3272 hdr->sadb_msg_seq = x->km.seq = get_acqseq(); 3273 hdr->sadb_msg_pid = 0; 3274 3275 /* SA */ 3276 sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa)); 3277 sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t); 3278 sa->sadb_sa_exttype = SADB_EXT_SA; 3279 sa->sadb_sa_spi = x->id.spi; 3280 sa->sadb_sa_replay = 0; 3281 sa->sadb_sa_state = 0; 3282 sa->sadb_sa_auth = 0; 3283 sa->sadb_sa_encrypt = 0; 3284 sa->sadb_sa_flags = 0; 3285 3286 /* ADDRESS_SRC (old addr) */ 3287 addr = (struct sadb_address*) 3288 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size); 3289 addr->sadb_address_len = 3290 (sizeof(struct sadb_address)+sockaddr_size)/ 3291 sizeof(uint64_t); 3292 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 3293 addr->sadb_address_proto = 0; 3294 addr->sadb_address_reserved = 0; 3295 if (x->props.family == AF_INET) { 3296 addr->sadb_address_prefixlen = 32; 3297 3298 sin = (struct sockaddr_in *) (addr + 1); 3299 sin->sin_family = AF_INET; 3300 sin->sin_addr.s_addr = x->props.saddr.a4; 3301 sin->sin_port = 0; 3302 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3303 } 3304 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3305 else if (x->props.family == AF_INET6) { 3306 addr->sadb_address_prefixlen = 128; 3307 3308 sin6 = (struct sockaddr_in6 *) (addr + 1); 3309 sin6->sin6_family = AF_INET6; 3310 sin6->sin6_port = 0; 3311 sin6->sin6_flowinfo = 0; 3312 memcpy(&sin6->sin6_addr, 3313 x->props.saddr.a6, sizeof(struct in6_addr)); 3314 sin6->sin6_scope_id = 0; 3315 } 3316 #endif 3317 else 3318 BUG(); 3319 3320 /* NAT_T_SPORT (old port) */ 3321 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 3322 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 3323 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT; 3324 n_port->sadb_x_nat_t_port_port = natt->encap_sport; 3325 n_port->sadb_x_nat_t_port_reserved = 0; 3326 3327 /* ADDRESS_DST (new addr) */ 3328 addr = (struct sadb_address*) 3329 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size); 3330 addr->sadb_address_len = 3331 (sizeof(struct sadb_address)+sockaddr_size)/ 3332 sizeof(uint64_t); 3333 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 3334 addr->sadb_address_proto = 0; 3335 addr->sadb_address_reserved = 0; 3336 if (x->props.family == AF_INET) { 3337 addr->sadb_address_prefixlen = 32; 3338 3339 sin = (struct sockaddr_in *) (addr + 1); 3340 sin->sin_family = AF_INET; 3341 sin->sin_addr.s_addr = ipaddr->a4; 3342 sin->sin_port = 0; 3343 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3344 } 3345 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3346 else if (x->props.family == AF_INET6) { 3347 addr->sadb_address_prefixlen = 128; 3348 3349 sin6 = (struct sockaddr_in6 *) (addr + 1); 3350 sin6->sin6_family = AF_INET6; 3351 sin6->sin6_port = 0; 3352 sin6->sin6_flowinfo = 0; 3353 memcpy(&sin6->sin6_addr, &ipaddr->a6, sizeof(struct in6_addr)); 3354 sin6->sin6_scope_id = 0; 3355 } 3356 #endif 3357 else 3358 BUG(); 3359 3360 /* NAT_T_DPORT (new port) */ 3361 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 3362 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 3363 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT; 3364 n_port->sadb_x_nat_t_port_port = sport; 3365 n_port->sadb_x_nat_t_port_reserved = 0; 3366 3367 return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 3368 } 3369 3370 #ifdef CONFIG_NET_KEY_MIGRATE 3371 static int set_sadb_address(struct sk_buff *skb, int sasize, int type, 3372 struct xfrm_selector *sel) 3373 { 3374 struct sadb_address *addr; 3375 struct sockaddr_in *sin; 3376 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3377 struct sockaddr_in6 *sin6; 3378 #endif 3379 addr = (struct sadb_address *)skb_put(skb, sizeof(struct sadb_address) + sasize); 3380 addr->sadb_address_len = (sizeof(struct sadb_address) + sasize)/8; 3381 addr->sadb_address_exttype = type; 3382 addr->sadb_address_proto = sel->proto; 3383 addr->sadb_address_reserved = 0; 3384 3385 switch (type) { 3386 case SADB_EXT_ADDRESS_SRC: 3387 if (sel->family == AF_INET) { 3388 addr->sadb_address_prefixlen = sel->prefixlen_s; 3389 sin = (struct sockaddr_in *)(addr + 1); 3390 sin->sin_family = AF_INET; 3391 memcpy(&sin->sin_addr.s_addr, &sel->saddr, 3392 sizeof(sin->sin_addr.s_addr)); 3393 sin->sin_port = 0; 3394 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3395 } 3396 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3397 else if (sel->family == AF_INET6) { 3398 addr->sadb_address_prefixlen = sel->prefixlen_s; 3399 sin6 = (struct sockaddr_in6 *)(addr + 1); 3400 sin6->sin6_family = AF_INET6; 3401 sin6->sin6_port = 0; 3402 sin6->sin6_flowinfo = 0; 3403 sin6->sin6_scope_id = 0; 3404 memcpy(&sin6->sin6_addr.s6_addr, &sel->saddr, 3405 sizeof(sin6->sin6_addr.s6_addr)); 3406 } 3407 #endif 3408 break; 3409 case SADB_EXT_ADDRESS_DST: 3410 if (sel->family == AF_INET) { 3411 addr->sadb_address_prefixlen = sel->prefixlen_d; 3412 sin = (struct sockaddr_in *)(addr + 1); 3413 sin->sin_family = AF_INET; 3414 memcpy(&sin->sin_addr.s_addr, &sel->daddr, 3415 sizeof(sin->sin_addr.s_addr)); 3416 sin->sin_port = 0; 3417 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3418 } 3419 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3420 else if (sel->family == AF_INET6) { 3421 addr->sadb_address_prefixlen = sel->prefixlen_d; 3422 sin6 = (struct sockaddr_in6 *)(addr + 1); 3423 sin6->sin6_family = AF_INET6; 3424 sin6->sin6_port = 0; 3425 sin6->sin6_flowinfo = 0; 3426 sin6->sin6_scope_id = 0; 3427 memcpy(&sin6->sin6_addr.s6_addr, &sel->daddr, 3428 sizeof(sin6->sin6_addr.s6_addr)); 3429 } 3430 #endif 3431 break; 3432 default: 3433 return -EINVAL; 3434 } 3435 3436 return 0; 3437 } 3438 3439 static int set_ipsecrequest(struct sk_buff *skb, 3440 uint8_t proto, uint8_t mode, int level, 3441 uint32_t reqid, uint8_t family, 3442 xfrm_address_t *src, xfrm_address_t *dst) 3443 { 3444 struct sadb_x_ipsecrequest *rq; 3445 struct sockaddr_in *sin; 3446 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3447 struct sockaddr_in6 *sin6; 3448 #endif 3449 int size_req; 3450 3451 size_req = sizeof(struct sadb_x_ipsecrequest) + 3452 pfkey_sockaddr_pair_size(family); 3453 3454 rq = (struct sadb_x_ipsecrequest *)skb_put(skb, size_req); 3455 memset(rq, 0, size_req); 3456 rq->sadb_x_ipsecrequest_len = size_req; 3457 rq->sadb_x_ipsecrequest_proto = proto; 3458 rq->sadb_x_ipsecrequest_mode = mode; 3459 rq->sadb_x_ipsecrequest_level = level; 3460 rq->sadb_x_ipsecrequest_reqid = reqid; 3461 3462 switch (family) { 3463 case AF_INET: 3464 sin = (struct sockaddr_in *)(rq + 1); 3465 sin->sin_family = AF_INET; 3466 memcpy(&sin->sin_addr.s_addr, src, 3467 sizeof(sin->sin_addr.s_addr)); 3468 sin++; 3469 sin->sin_family = AF_INET; 3470 memcpy(&sin->sin_addr.s_addr, dst, 3471 sizeof(sin->sin_addr.s_addr)); 3472 break; 3473 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3474 case AF_INET6: 3475 sin6 = (struct sockaddr_in6 *)(rq + 1); 3476 sin6->sin6_family = AF_INET6; 3477 sin6->sin6_port = 0; 3478 sin6->sin6_flowinfo = 0; 3479 sin6->sin6_scope_id = 0; 3480 memcpy(&sin6->sin6_addr.s6_addr, src, 3481 sizeof(sin6->sin6_addr.s6_addr)); 3482 sin6++; 3483 sin6->sin6_family = AF_INET6; 3484 sin6->sin6_port = 0; 3485 sin6->sin6_flowinfo = 0; 3486 sin6->sin6_scope_id = 0; 3487 memcpy(&sin6->sin6_addr.s6_addr, dst, 3488 sizeof(sin6->sin6_addr.s6_addr)); 3489 break; 3490 #endif 3491 default: 3492 return -EINVAL; 3493 } 3494 3495 return 0; 3496 } 3497 #endif 3498 3499 #ifdef CONFIG_NET_KEY_MIGRATE 3500 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 3501 struct xfrm_migrate *m, int num_bundles) 3502 { 3503 int i; 3504 int sasize_sel; 3505 int size = 0; 3506 int size_pol = 0; 3507 struct sk_buff *skb; 3508 struct sadb_msg *hdr; 3509 struct sadb_x_policy *pol; 3510 struct xfrm_migrate *mp; 3511 3512 if (type != XFRM_POLICY_TYPE_MAIN) 3513 return 0; 3514 3515 if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH) 3516 return -EINVAL; 3517 3518 /* selector */ 3519 sasize_sel = pfkey_sockaddr_size(sel->family); 3520 if (!sasize_sel) 3521 return -EINVAL; 3522 size += (sizeof(struct sadb_address) + sasize_sel) * 2; 3523 3524 /* policy info */ 3525 size_pol += sizeof(struct sadb_x_policy); 3526 3527 /* ipsecrequests */ 3528 for (i = 0, mp = m; i < num_bundles; i++, mp++) { 3529 /* old locator pair */ 3530 size_pol += sizeof(struct sadb_x_ipsecrequest) + 3531 pfkey_sockaddr_pair_size(mp->old_family); 3532 /* new locator pair */ 3533 size_pol += sizeof(struct sadb_x_ipsecrequest) + 3534 pfkey_sockaddr_pair_size(mp->new_family); 3535 } 3536 3537 size += sizeof(struct sadb_msg) + size_pol; 3538 3539 /* alloc buffer */ 3540 skb = alloc_skb(size, GFP_ATOMIC); 3541 if (skb == NULL) 3542 return -ENOMEM; 3543 3544 hdr = (struct sadb_msg *)skb_put(skb, sizeof(struct sadb_msg)); 3545 hdr->sadb_msg_version = PF_KEY_V2; 3546 hdr->sadb_msg_type = SADB_X_MIGRATE; 3547 hdr->sadb_msg_satype = pfkey_proto2satype(m->proto); 3548 hdr->sadb_msg_len = size / 8; 3549 hdr->sadb_msg_errno = 0; 3550 hdr->sadb_msg_reserved = 0; 3551 hdr->sadb_msg_seq = 0; 3552 hdr->sadb_msg_pid = 0; 3553 3554 /* selector src */ 3555 set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel); 3556 3557 /* selector dst */ 3558 set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_DST, sel); 3559 3560 /* policy information */ 3561 pol = (struct sadb_x_policy *)skb_put(skb, sizeof(struct sadb_x_policy)); 3562 pol->sadb_x_policy_len = size_pol / 8; 3563 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 3564 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 3565 pol->sadb_x_policy_dir = dir + 1; 3566 pol->sadb_x_policy_id = 0; 3567 pol->sadb_x_policy_priority = 0; 3568 3569 for (i = 0, mp = m; i < num_bundles; i++, mp++) { 3570 /* old ipsecrequest */ 3571 int mode = pfkey_mode_from_xfrm(mp->mode); 3572 if (mode < 0) 3573 return -EINVAL; 3574 if (set_ipsecrequest(skb, mp->proto, mode, 3575 (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), 3576 mp->reqid, mp->old_family, 3577 &mp->old_saddr, &mp->old_daddr) < 0) { 3578 return -EINVAL; 3579 } 3580 3581 /* new ipsecrequest */ 3582 if (set_ipsecrequest(skb, mp->proto, mode, 3583 (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), 3584 mp->reqid, mp->new_family, 3585 &mp->new_saddr, &mp->new_daddr) < 0) { 3586 return -EINVAL; 3587 } 3588 } 3589 3590 /* broadcast migrate message to sockets */ 3591 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 3592 3593 return 0; 3594 } 3595 #else 3596 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 3597 struct xfrm_migrate *m, int num_bundles) 3598 { 3599 return -ENOPROTOOPT; 3600 } 3601 #endif 3602 3603 static int pfkey_sendmsg(struct kiocb *kiocb, 3604 struct socket *sock, struct msghdr *msg, size_t len) 3605 { 3606 struct sock *sk = sock->sk; 3607 struct sk_buff *skb = NULL; 3608 struct sadb_msg *hdr = NULL; 3609 int err; 3610 3611 err = -EOPNOTSUPP; 3612 if (msg->msg_flags & MSG_OOB) 3613 goto out; 3614 3615 err = -EMSGSIZE; 3616 if ((unsigned)len > sk->sk_sndbuf - 32) 3617 goto out; 3618 3619 err = -ENOBUFS; 3620 skb = alloc_skb(len, GFP_KERNEL); 3621 if (skb == NULL) 3622 goto out; 3623 3624 err = -EFAULT; 3625 if (memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len)) 3626 goto out; 3627 3628 hdr = pfkey_get_base_msg(skb, &err); 3629 if (!hdr) 3630 goto out; 3631 3632 mutex_lock(&xfrm_cfg_mutex); 3633 err = pfkey_process(sk, skb, hdr); 3634 mutex_unlock(&xfrm_cfg_mutex); 3635 3636 out: 3637 if (err && hdr && pfkey_error(hdr, err, sk) == 0) 3638 err = 0; 3639 if (skb) 3640 kfree_skb(skb); 3641 3642 return err ? : len; 3643 } 3644 3645 static int pfkey_recvmsg(struct kiocb *kiocb, 3646 struct socket *sock, struct msghdr *msg, size_t len, 3647 int flags) 3648 { 3649 struct sock *sk = sock->sk; 3650 struct sk_buff *skb; 3651 int copied, err; 3652 3653 err = -EINVAL; 3654 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT)) 3655 goto out; 3656 3657 msg->msg_namelen = 0; 3658 skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err); 3659 if (skb == NULL) 3660 goto out; 3661 3662 copied = skb->len; 3663 if (copied > len) { 3664 msg->msg_flags |= MSG_TRUNC; 3665 copied = len; 3666 } 3667 3668 skb_reset_transport_header(skb); 3669 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 3670 if (err) 3671 goto out_free; 3672 3673 sock_recv_timestamp(msg, sk, skb); 3674 3675 err = (flags & MSG_TRUNC) ? skb->len : copied; 3676 3677 out_free: 3678 skb_free_datagram(sk, skb); 3679 out: 3680 return err; 3681 } 3682 3683 static const struct proto_ops pfkey_ops = { 3684 .family = PF_KEY, 3685 .owner = THIS_MODULE, 3686 /* Operations that make no sense on pfkey sockets. */ 3687 .bind = sock_no_bind, 3688 .connect = sock_no_connect, 3689 .socketpair = sock_no_socketpair, 3690 .accept = sock_no_accept, 3691 .getname = sock_no_getname, 3692 .ioctl = sock_no_ioctl, 3693 .listen = sock_no_listen, 3694 .shutdown = sock_no_shutdown, 3695 .setsockopt = sock_no_setsockopt, 3696 .getsockopt = sock_no_getsockopt, 3697 .mmap = sock_no_mmap, 3698 .sendpage = sock_no_sendpage, 3699 3700 /* Now the operations that really occur. */ 3701 .release = pfkey_release, 3702 .poll = datagram_poll, 3703 .sendmsg = pfkey_sendmsg, 3704 .recvmsg = pfkey_recvmsg, 3705 }; 3706 3707 static struct net_proto_family pfkey_family_ops = { 3708 .family = PF_KEY, 3709 .create = pfkey_create, 3710 .owner = THIS_MODULE, 3711 }; 3712 3713 #ifdef CONFIG_PROC_FS 3714 static int pfkey_read_proc(char *buffer, char **start, off_t offset, 3715 int length, int *eof, void *data) 3716 { 3717 off_t pos = 0; 3718 off_t begin = 0; 3719 int len = 0; 3720 struct sock *s; 3721 struct hlist_node *node; 3722 3723 len += sprintf(buffer,"sk RefCnt Rmem Wmem User Inode\n"); 3724 3725 read_lock(&pfkey_table_lock); 3726 3727 sk_for_each(s, node, &pfkey_table) { 3728 len += sprintf(buffer+len,"%p %-6d %-6u %-6u %-6u %-6lu", 3729 s, 3730 atomic_read(&s->sk_refcnt), 3731 atomic_read(&s->sk_rmem_alloc), 3732 atomic_read(&s->sk_wmem_alloc), 3733 sock_i_uid(s), 3734 sock_i_ino(s) 3735 ); 3736 3737 buffer[len++] = '\n'; 3738 3739 pos = begin + len; 3740 if (pos < offset) { 3741 len = 0; 3742 begin = pos; 3743 } 3744 if(pos > offset + length) 3745 goto done; 3746 } 3747 *eof = 1; 3748 3749 done: 3750 read_unlock(&pfkey_table_lock); 3751 3752 *start = buffer + (offset - begin); 3753 len -= (offset - begin); 3754 3755 if (len > length) 3756 len = length; 3757 if (len < 0) 3758 len = 0; 3759 3760 return len; 3761 } 3762 #endif 3763 3764 static struct xfrm_mgr pfkeyv2_mgr = 3765 { 3766 .id = "pfkeyv2", 3767 .notify = pfkey_send_notify, 3768 .acquire = pfkey_send_acquire, 3769 .compile_policy = pfkey_compile_policy, 3770 .new_mapping = pfkey_send_new_mapping, 3771 .notify_policy = pfkey_send_policy_notify, 3772 .migrate = pfkey_send_migrate, 3773 }; 3774 3775 static void __exit ipsec_pfkey_exit(void) 3776 { 3777 xfrm_unregister_km(&pfkeyv2_mgr); 3778 remove_proc_entry("net/pfkey", NULL); 3779 sock_unregister(PF_KEY); 3780 proto_unregister(&key_proto); 3781 } 3782 3783 static int __init ipsec_pfkey_init(void) 3784 { 3785 int err = proto_register(&key_proto, 0); 3786 3787 if (err != 0) 3788 goto out; 3789 3790 err = sock_register(&pfkey_family_ops); 3791 if (err != 0) 3792 goto out_unregister_key_proto; 3793 #ifdef CONFIG_PROC_FS 3794 err = -ENOMEM; 3795 if (create_proc_read_entry("net/pfkey", 0, NULL, pfkey_read_proc, NULL) == NULL) 3796 goto out_sock_unregister; 3797 #endif 3798 err = xfrm_register_km(&pfkeyv2_mgr); 3799 if (err != 0) 3800 goto out_remove_proc_entry; 3801 out: 3802 return err; 3803 out_remove_proc_entry: 3804 #ifdef CONFIG_PROC_FS 3805 remove_proc_entry("net/pfkey", NULL); 3806 out_sock_unregister: 3807 #endif 3808 sock_unregister(PF_KEY); 3809 out_unregister_key_proto: 3810 proto_unregister(&key_proto); 3811 goto out; 3812 } 3813 3814 module_init(ipsec_pfkey_init); 3815 module_exit(ipsec_pfkey_exit); 3816 MODULE_LICENSE("GPL"); 3817 MODULE_ALIAS_NETPROTO(PF_KEY); 3818