109c434b8SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
21da177e4SLinus Torvalds /* xfrm_user.c: User interface to configure xfrm engine.
31da177e4SLinus Torvalds *
41da177e4SLinus Torvalds * Copyright (C) 2002 David S. Miller (davem@redhat.com)
51da177e4SLinus Torvalds *
61da177e4SLinus Torvalds * Changes:
71da177e4SLinus Torvalds * Mitsuru KANDA @USAGI
81da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI
91da177e4SLinus Torvalds * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
101da177e4SLinus Torvalds * IPv6 support
111da177e4SLinus Torvalds *
121da177e4SLinus Torvalds */
131da177e4SLinus Torvalds
14b6459415SJakub Kicinski #include <linux/compat.h>
159409f38aSHerbert Xu #include <linux/crypto.h>
161da177e4SLinus Torvalds #include <linux/module.h>
171da177e4SLinus Torvalds #include <linux/kernel.h>
181da177e4SLinus Torvalds #include <linux/types.h>
191da177e4SLinus Torvalds #include <linux/slab.h>
201da177e4SLinus Torvalds #include <linux/socket.h>
211da177e4SLinus Torvalds #include <linux/string.h>
221da177e4SLinus Torvalds #include <linux/net.h>
231da177e4SLinus Torvalds #include <linux/skbuff.h>
241da177e4SLinus Torvalds #include <linux/pfkeyv2.h>
251da177e4SLinus Torvalds #include <linux/ipsec.h>
261da177e4SLinus Torvalds #include <linux/init.h>
271da177e4SLinus Torvalds #include <linux/security.h>
281da177e4SLinus Torvalds #include <net/sock.h>
291da177e4SLinus Torvalds #include <net/xfrm.h>
3088fc2c84SThomas Graf #include <net/netlink.h>
31fa6dd8a2SNicolas Dichtel #include <net/ah.h>
327c0f6ba6SLinus Torvalds #include <linux/uaccess.h>
33dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6)
34e23c7194SMasahide NAKAMURA #include <linux/in6.h>
35e23c7194SMasahide NAKAMURA #endif
36e33d4f13SSowmini Varadhan #include <asm/unaligned.h>
371da177e4SLinus Torvalds
verify_one_alg(struct nlattr ** attrs,enum xfrm_attr_type_t type,struct netlink_ext_ack * extack)381fc8fde5SSabrina Dubroca static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type,
391fc8fde5SSabrina Dubroca struct netlink_ext_ack *extack)
401da177e4SLinus Torvalds {
415424f32eSThomas Graf struct nlattr *rt = attrs[type];
421da177e4SLinus Torvalds struct xfrm_algo *algp;
431da177e4SLinus Torvalds
441da177e4SLinus Torvalds if (!rt)
451da177e4SLinus Torvalds return 0;
461da177e4SLinus Torvalds
475424f32eSThomas Graf algp = nla_data(rt);
481fc8fde5SSabrina Dubroca if (nla_len(rt) < (int)xfrm_alg_len(algp)) {
491fc8fde5SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid AUTH/CRYPT/COMP attribute length");
5031c26852SHerbert Xu return -EINVAL;
511fc8fde5SSabrina Dubroca }
5231c26852SHerbert Xu
531da177e4SLinus Torvalds switch (type) {
541da177e4SLinus Torvalds case XFRMA_ALG_AUTH:
551da177e4SLinus Torvalds case XFRMA_ALG_CRYPT:
561da177e4SLinus Torvalds case XFRMA_ALG_COMP:
571da177e4SLinus Torvalds break;
581da177e4SLinus Torvalds
591da177e4SLinus Torvalds default:
601fc8fde5SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid algorithm attribute type");
611da177e4SLinus Torvalds return -EINVAL;
623ff50b79SStephen Hemminger }
631da177e4SLinus Torvalds
64633439f5SHerbert Xu algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
651da177e4SLinus Torvalds return 0;
661da177e4SLinus Torvalds }
671da177e4SLinus Torvalds
verify_auth_trunc(struct nlattr ** attrs,struct netlink_ext_ack * extack)681fc8fde5SSabrina Dubroca static int verify_auth_trunc(struct nlattr **attrs,
691fc8fde5SSabrina Dubroca struct netlink_ext_ack *extack)
704447bb33SMartin Willi {
714447bb33SMartin Willi struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
724447bb33SMartin Willi struct xfrm_algo_auth *algp;
734447bb33SMartin Willi
744447bb33SMartin Willi if (!rt)
754447bb33SMartin Willi return 0;
764447bb33SMartin Willi
774447bb33SMartin Willi algp = nla_data(rt);
781fc8fde5SSabrina Dubroca if (nla_len(rt) < (int)xfrm_alg_auth_len(algp)) {
791fc8fde5SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid AUTH_TRUNC attribute length");
804447bb33SMartin Willi return -EINVAL;
811fc8fde5SSabrina Dubroca }
824447bb33SMartin Willi
83633439f5SHerbert Xu algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
844447bb33SMartin Willi return 0;
854447bb33SMartin Willi }
864447bb33SMartin Willi
verify_aead(struct nlattr ** attrs,struct netlink_ext_ack * extack)871fc8fde5SSabrina Dubroca static int verify_aead(struct nlattr **attrs, struct netlink_ext_ack *extack)
881a6509d9SHerbert Xu {
891a6509d9SHerbert Xu struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
901a6509d9SHerbert Xu struct xfrm_algo_aead *algp;
911a6509d9SHerbert Xu
921a6509d9SHerbert Xu if (!rt)
931a6509d9SHerbert Xu return 0;
941a6509d9SHerbert Xu
951a6509d9SHerbert Xu algp = nla_data(rt);
961fc8fde5SSabrina Dubroca if (nla_len(rt) < (int)aead_len(algp)) {
971fc8fde5SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid AEAD attribute length");
981a6509d9SHerbert Xu return -EINVAL;
991fc8fde5SSabrina Dubroca }
1001a6509d9SHerbert Xu
101633439f5SHerbert Xu algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
1021a6509d9SHerbert Xu return 0;
1031a6509d9SHerbert Xu }
1041a6509d9SHerbert Xu
verify_one_addr(struct nlattr ** attrs,enum xfrm_attr_type_t type,xfrm_address_t ** addrp)1055424f32eSThomas Graf static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
106eb2971b6SMasahide NAKAMURA xfrm_address_t **addrp)
107eb2971b6SMasahide NAKAMURA {
1085424f32eSThomas Graf struct nlattr *rt = attrs[type];
109eb2971b6SMasahide NAKAMURA
110cf5cb79fSThomas Graf if (rt && addrp)
1115424f32eSThomas Graf *addrp = nla_data(rt);
112eb2971b6SMasahide NAKAMURA }
113df71837dSTrent Jaeger
verify_sec_ctx_len(struct nlattr ** attrs,struct netlink_ext_ack * extack)11408a717e4SSabrina Dubroca static inline int verify_sec_ctx_len(struct nlattr **attrs, struct netlink_ext_ack *extack)
115df71837dSTrent Jaeger {
1165424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX];
117df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx;
118df71837dSTrent Jaeger
119df71837dSTrent Jaeger if (!rt)
120df71837dSTrent Jaeger return 0;
121df71837dSTrent Jaeger
1225424f32eSThomas Graf uctx = nla_data(rt);
123171d449aSXin Long if (uctx->len > nla_len(rt) ||
12408a717e4SSabrina Dubroca uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) {
12508a717e4SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid security context length");
126df71837dSTrent Jaeger return -EINVAL;
12708a717e4SSabrina Dubroca }
128df71837dSTrent Jaeger
129df71837dSTrent Jaeger return 0;
130df71837dSTrent Jaeger }
131df71837dSTrent Jaeger
verify_replay(struct xfrm_usersa_info * p,struct nlattr ** attrs,u8 sa_dir,struct netlink_ext_ack * extack)132d8647b79SSteffen Klassert static inline int verify_replay(struct xfrm_usersa_info *p,
133a4a87fa4SAntony Antony struct nlattr **attrs, u8 sa_dir,
134785b87b2SSabrina Dubroca struct netlink_ext_ack *extack)
135d8647b79SSteffen Klassert {
136d8647b79SSteffen Klassert struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
137ecd79187SMathias Krause struct xfrm_replay_state_esn *rs;
138d8647b79SSteffen Klassert
139785b87b2SSabrina Dubroca if (!rt) {
140785b87b2SSabrina Dubroca if (p->flags & XFRM_STATE_ESN) {
141785b87b2SSabrina Dubroca NL_SET_ERR_MSG(extack, "Missing required attribute for ESN");
142785b87b2SSabrina Dubroca return -EINVAL;
143785b87b2SSabrina Dubroca }
144785b87b2SSabrina Dubroca return 0;
145785b87b2SSabrina Dubroca }
1467833aa05SSteffen Klassert
147ecd79187SMathias Krause rs = nla_data(rt);
148ecd79187SMathias Krause
149785b87b2SSabrina Dubroca if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) {
150785b87b2SSabrina Dubroca NL_SET_ERR_MSG(extack, "ESN bitmap length must be <= 128");
151ecd79187SMathias Krause return -EINVAL;
152785b87b2SSabrina Dubroca }
153ecd79187SMathias Krause
1545e708e47SAlexey Dobriyan if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
155785b87b2SSabrina Dubroca nla_len(rt) != sizeof(*rs)) {
156785b87b2SSabrina Dubroca NL_SET_ERR_MSG(extack, "ESN attribute is too short to fit the full bitmap length");
157ecd79187SMathias Krause return -EINVAL;
158785b87b2SSabrina Dubroca }
159d8647b79SSteffen Klassert
16001714109SFan Du /* As only ESP and AH support ESN feature. */
161785b87b2SSabrina Dubroca if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) {
162785b87b2SSabrina Dubroca NL_SET_ERR_MSG(extack, "ESN only supported for ESP and AH");
16302aadf72SSteffen Klassert return -EINVAL;
164785b87b2SSabrina Dubroca }
16502aadf72SSteffen Klassert
166785b87b2SSabrina Dubroca if (p->replay_window != 0) {
167785b87b2SSabrina Dubroca NL_SET_ERR_MSG(extack, "ESN not compatible with legacy replay_window");
168d8647b79SSteffen Klassert return -EINVAL;
169785b87b2SSabrina Dubroca }
170d8647b79SSteffen Klassert
171a4a87fa4SAntony Antony if (sa_dir == XFRM_SA_DIR_OUT) {
172a4a87fa4SAntony Antony if (rs->replay_window) {
173a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Replay window should be 0 for output SA");
174a4a87fa4SAntony Antony return -EINVAL;
175a4a87fa4SAntony Antony }
176a4a87fa4SAntony Antony if (rs->seq || rs->seq_hi) {
177a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack,
178a4a87fa4SAntony Antony "Replay seq and seq_hi should be 0 for output SA");
179a4a87fa4SAntony Antony return -EINVAL;
180a4a87fa4SAntony Antony }
181a4a87fa4SAntony Antony if (rs->bmp_len) {
182a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Replay bmp_len should 0 for output SA");
183a4a87fa4SAntony Antony return -EINVAL;
184a4a87fa4SAntony Antony }
185a4a87fa4SAntony Antony }
186a4a87fa4SAntony Antony
187a4a87fa4SAntony Antony if (sa_dir == XFRM_SA_DIR_IN) {
188a4a87fa4SAntony Antony if (rs->oseq || rs->oseq_hi) {
189a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack,
190a4a87fa4SAntony Antony "Replay oseq and oseq_hi should be 0 for input SA");
191a4a87fa4SAntony Antony return -EINVAL;
192a4a87fa4SAntony Antony }
193a4a87fa4SAntony Antony }
194a4a87fa4SAntony Antony
195d8647b79SSteffen Klassert return 0;
196d8647b79SSteffen Klassert }
197df71837dSTrent Jaeger
verify_newsa_info(struct xfrm_usersa_info * p,struct nlattr ** attrs,struct netlink_ext_ack * extack)1981da177e4SLinus Torvalds static int verify_newsa_info(struct xfrm_usersa_info *p,
1996999aae1SSabrina Dubroca struct nlattr **attrs,
2006999aae1SSabrina Dubroca struct netlink_ext_ack *extack)
2011da177e4SLinus Torvalds {
2021da177e4SLinus Torvalds int err;
203a4a87fa4SAntony Antony u8 sa_dir = attrs[XFRMA_SA_DIR] ? nla_get_u8(attrs[XFRMA_SA_DIR]) : 0;
2041da177e4SLinus Torvalds
2051da177e4SLinus Torvalds err = -EINVAL;
2061da177e4SLinus Torvalds switch (p->family) {
2071da177e4SLinus Torvalds case AF_INET:
208b38ff407SAnirudh Gupta break;
209b38ff407SAnirudh Gupta
210b38ff407SAnirudh Gupta case AF_INET6:
211b38ff407SAnirudh Gupta #if IS_ENABLED(CONFIG_IPV6)
212b38ff407SAnirudh Gupta break;
213b38ff407SAnirudh Gupta #else
214b38ff407SAnirudh Gupta err = -EAFNOSUPPORT;
2156999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "IPv6 support disabled");
216b38ff407SAnirudh Gupta goto out;
217b38ff407SAnirudh Gupta #endif
218b38ff407SAnirudh Gupta
219b38ff407SAnirudh Gupta default:
2206999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid address family");
221b38ff407SAnirudh Gupta goto out;
222b38ff407SAnirudh Gupta }
223b38ff407SAnirudh Gupta
224b38ff407SAnirudh Gupta switch (p->sel.family) {
225b8d6d007SNicolas Dichtel case AF_UNSPEC:
226b8d6d007SNicolas Dichtel break;
227b8d6d007SNicolas Dichtel
228b38ff407SAnirudh Gupta case AF_INET:
2296999aae1SSabrina Dubroca if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) {
2306999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 32 for IPv4)");
23107bf7908SSteffen Klassert goto out;
2326999aae1SSabrina Dubroca }
23307bf7908SSteffen Klassert
2341da177e4SLinus Torvalds break;
2351da177e4SLinus Torvalds
2361da177e4SLinus Torvalds case AF_INET6:
237dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6)
2386999aae1SSabrina Dubroca if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) {
2396999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 128 for IPv6)");
24007bf7908SSteffen Klassert goto out;
2416999aae1SSabrina Dubroca }
24207bf7908SSteffen Klassert
2431da177e4SLinus Torvalds break;
2441da177e4SLinus Torvalds #else
2456999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "IPv6 support disabled");
2461da177e4SLinus Torvalds err = -EAFNOSUPPORT;
2471da177e4SLinus Torvalds goto out;
2481da177e4SLinus Torvalds #endif
2491da177e4SLinus Torvalds
2501da177e4SLinus Torvalds default:
2516999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid address family in selector");
2521da177e4SLinus Torvalds goto out;
2533ff50b79SStephen Hemminger }
2541da177e4SLinus Torvalds
2551da177e4SLinus Torvalds err = -EINVAL;
2561da177e4SLinus Torvalds switch (p->id.proto) {
2571da177e4SLinus Torvalds case IPPROTO_AH:
2586999aae1SSabrina Dubroca if (!attrs[XFRMA_ALG_AUTH] &&
2596999aae1SSabrina Dubroca !attrs[XFRMA_ALG_AUTH_TRUNC]) {
2606999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Missing required attribute for AH: AUTH_TRUNC or AUTH");
2616999aae1SSabrina Dubroca goto out;
2626999aae1SSabrina Dubroca }
2636999aae1SSabrina Dubroca
2646999aae1SSabrina Dubroca if (attrs[XFRMA_ALG_AEAD] ||
26535a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] ||
26635d2856bSMartin Willi attrs[XFRMA_ALG_COMP] ||
2676999aae1SSabrina Dubroca attrs[XFRMA_TFCPAD]) {
2686999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid attributes for AH: AEAD, CRYPT, COMP, TFCPAD");
2691da177e4SLinus Torvalds goto out;
2706999aae1SSabrina Dubroca }
2711da177e4SLinus Torvalds break;
2721da177e4SLinus Torvalds
2731da177e4SLinus Torvalds case IPPROTO_ESP:
2746999aae1SSabrina Dubroca if (attrs[XFRMA_ALG_COMP]) {
2756999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid attribute for ESP: COMP");
2761a6509d9SHerbert Xu goto out;
2776999aae1SSabrina Dubroca }
2786999aae1SSabrina Dubroca
2791a6509d9SHerbert Xu if (!attrs[XFRMA_ALG_AUTH] &&
2804447bb33SMartin Willi !attrs[XFRMA_ALG_AUTH_TRUNC] &&
2811a6509d9SHerbert Xu !attrs[XFRMA_ALG_CRYPT] &&
2826999aae1SSabrina Dubroca !attrs[XFRMA_ALG_AEAD]) {
2836999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Missing required attribute for ESP: at least one of AUTH, AUTH_TRUNC, CRYPT, AEAD");
2841a6509d9SHerbert Xu goto out;
2856999aae1SSabrina Dubroca }
2866999aae1SSabrina Dubroca
2871a6509d9SHerbert Xu if ((attrs[XFRMA_ALG_AUTH] ||
2884447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] ||
2891a6509d9SHerbert Xu attrs[XFRMA_ALG_CRYPT]) &&
2906999aae1SSabrina Dubroca attrs[XFRMA_ALG_AEAD]) {
2916999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid attribute combination for ESP: AEAD can't be used with AUTH, AUTH_TRUNC, CRYPT");
2921da177e4SLinus Torvalds goto out;
2936999aae1SSabrina Dubroca }
2946999aae1SSabrina Dubroca
29535d2856bSMartin Willi if (attrs[XFRMA_TFCPAD] &&
2966999aae1SSabrina Dubroca p->mode != XFRM_MODE_TUNNEL) {
2976999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "TFC padding can only be used in tunnel mode");
29835d2856bSMartin Willi goto out;
2996999aae1SSabrina Dubroca }
3001da177e4SLinus Torvalds break;
3011da177e4SLinus Torvalds
3021da177e4SLinus Torvalds case IPPROTO_COMP:
3036999aae1SSabrina Dubroca if (!attrs[XFRMA_ALG_COMP]) {
3046999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Missing required attribute for COMP: COMP");
3056999aae1SSabrina Dubroca goto out;
3066999aae1SSabrina Dubroca }
3076999aae1SSabrina Dubroca
3086999aae1SSabrina Dubroca if (attrs[XFRMA_ALG_AEAD] ||
30935a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] ||
3104447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] ||
31135d2856bSMartin Willi attrs[XFRMA_ALG_CRYPT] ||
3126999aae1SSabrina Dubroca attrs[XFRMA_TFCPAD]) {
3136999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid attributes for COMP: AEAD, AUTH, AUTH_TRUNC, CRYPT, TFCPAD");
3141da177e4SLinus Torvalds goto out;
3156999aae1SSabrina Dubroca }
3166999aae1SSabrina Dubroca
3176999aae1SSabrina Dubroca if (ntohl(p->id.spi) >= 0x10000) {
3186999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "SPI is too large for COMP (must be < 0x10000)");
3196999aae1SSabrina Dubroca goto out;
3206999aae1SSabrina Dubroca }
3211da177e4SLinus Torvalds break;
3221da177e4SLinus Torvalds
323dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6)
324e23c7194SMasahide NAKAMURA case IPPROTO_DSTOPTS:
325e23c7194SMasahide NAKAMURA case IPPROTO_ROUTING:
32635a7aa08SThomas Graf if (attrs[XFRMA_ALG_COMP] ||
32735a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] ||
3284447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] ||
3291a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] ||
33035a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] ||
33135a7aa08SThomas Graf attrs[XFRMA_ENCAP] ||
33235a7aa08SThomas Graf attrs[XFRMA_SEC_CTX] ||
3336999aae1SSabrina Dubroca attrs[XFRMA_TFCPAD]) {
3346999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid attributes for DSTOPTS/ROUTING");
335e23c7194SMasahide NAKAMURA goto out;
3366999aae1SSabrina Dubroca }
3376999aae1SSabrina Dubroca
3386999aae1SSabrina Dubroca if (!attrs[XFRMA_COADDR]) {
3396999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Missing required COADDR attribute for DSTOPTS/ROUTING");
3406999aae1SSabrina Dubroca goto out;
3416999aae1SSabrina Dubroca }
342e23c7194SMasahide NAKAMURA break;
343e23c7194SMasahide NAKAMURA #endif
344e23c7194SMasahide NAKAMURA
3451da177e4SLinus Torvalds default:
3466999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Unsupported protocol");
3471da177e4SLinus Torvalds goto out;
3483ff50b79SStephen Hemminger }
3491da177e4SLinus Torvalds
3501fc8fde5SSabrina Dubroca if ((err = verify_aead(attrs, extack)))
3511a6509d9SHerbert Xu goto out;
3521fc8fde5SSabrina Dubroca if ((err = verify_auth_trunc(attrs, extack)))
3534447bb33SMartin Willi goto out;
3541fc8fde5SSabrina Dubroca if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH, extack)))
3551da177e4SLinus Torvalds goto out;
3561fc8fde5SSabrina Dubroca if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT, extack)))
3571da177e4SLinus Torvalds goto out;
3581fc8fde5SSabrina Dubroca if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP, extack)))
3591da177e4SLinus Torvalds goto out;
3606999aae1SSabrina Dubroca if ((err = verify_sec_ctx_len(attrs, extack)))
361df71837dSTrent Jaeger goto out;
362a4a87fa4SAntony Antony if ((err = verify_replay(p, attrs, sa_dir, extack)))
363d8647b79SSteffen Klassert goto out;
3641da177e4SLinus Torvalds
3651da177e4SLinus Torvalds err = -EINVAL;
3661da177e4SLinus Torvalds switch (p->mode) {
3677e49e6deSMasahide NAKAMURA case XFRM_MODE_TRANSPORT:
3687e49e6deSMasahide NAKAMURA case XFRM_MODE_TUNNEL:
369060f02a3SNoriaki TAKAMIYA case XFRM_MODE_ROUTEOPTIMIZATION:
3700a69452cSDiego Beltrami case XFRM_MODE_BEET:
3711da177e4SLinus Torvalds break;
3721da177e4SLinus Torvalds
3731da177e4SLinus Torvalds default:
3746999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "Unsupported mode");
3751da177e4SLinus Torvalds goto out;
3763ff50b79SStephen Hemminger }
3771da177e4SLinus Torvalds
3781da177e4SLinus Torvalds err = 0;
3791da177e4SLinus Torvalds
3806999aae1SSabrina Dubroca if (attrs[XFRMA_MTIMER_THRESH]) {
3816999aae1SSabrina Dubroca if (!attrs[XFRMA_ENCAP]) {
3826999aae1SSabrina Dubroca NL_SET_ERR_MSG(extack, "MTIMER_THRESH attribute can only be set on ENCAP states");
3834e484b3eSAntony Antony err = -EINVAL;
3846999aae1SSabrina Dubroca goto out;
3856999aae1SSabrina Dubroca }
386a4a87fa4SAntony Antony
387a4a87fa4SAntony Antony if (sa_dir == XFRM_SA_DIR_OUT) {
388a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack,
389a4a87fa4SAntony Antony "MTIMER_THRESH attribute should not be set on output SA");
390a4a87fa4SAntony Antony err = -EINVAL;
391a4a87fa4SAntony Antony goto out;
392a4a87fa4SAntony Antony }
393a4a87fa4SAntony Antony }
394a4a87fa4SAntony Antony
395a4a87fa4SAntony Antony if (sa_dir == XFRM_SA_DIR_OUT) {
396a4a87fa4SAntony Antony if (p->flags & XFRM_STATE_DECAP_DSCP) {
397a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Flag DECAP_DSCP should not be set for output SA");
398a4a87fa4SAntony Antony err = -EINVAL;
399a4a87fa4SAntony Antony goto out;
400a4a87fa4SAntony Antony }
401a4a87fa4SAntony Antony
402a4a87fa4SAntony Antony if (p->flags & XFRM_STATE_ICMP) {
403a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Flag ICMP should not be set for output SA");
404a4a87fa4SAntony Antony err = -EINVAL;
405a4a87fa4SAntony Antony goto out;
406a4a87fa4SAntony Antony }
407a4a87fa4SAntony Antony
408a4a87fa4SAntony Antony if (p->flags & XFRM_STATE_WILDRECV) {
409a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Flag WILDRECV should not be set for output SA");
410a4a87fa4SAntony Antony err = -EINVAL;
411a4a87fa4SAntony Antony goto out;
412a4a87fa4SAntony Antony }
413a4a87fa4SAntony Antony
414a4a87fa4SAntony Antony if (p->replay_window) {
415a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Replay window should be 0 for output SA");
416a4a87fa4SAntony Antony err = -EINVAL;
417a4a87fa4SAntony Antony goto out;
418a4a87fa4SAntony Antony }
419a4a87fa4SAntony Antony
420a4a87fa4SAntony Antony if (attrs[XFRMA_REPLAY_VAL]) {
421a4a87fa4SAntony Antony struct xfrm_replay_state *replay;
422a4a87fa4SAntony Antony
423a4a87fa4SAntony Antony replay = nla_data(attrs[XFRMA_REPLAY_VAL]);
424a4a87fa4SAntony Antony
425a4a87fa4SAntony Antony if (replay->seq || replay->bitmap) {
426a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack,
427a4a87fa4SAntony Antony "Replay seq and bitmap should be 0 for output SA");
428a4a87fa4SAntony Antony err = -EINVAL;
429a4a87fa4SAntony Antony goto out;
430a4a87fa4SAntony Antony }
431a4a87fa4SAntony Antony }
432a4a87fa4SAntony Antony }
433a4a87fa4SAntony Antony
434a4a87fa4SAntony Antony if (sa_dir == XFRM_SA_DIR_IN) {
435a4a87fa4SAntony Antony if (p->flags & XFRM_STATE_NOPMTUDISC) {
436a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Flag NOPMTUDISC should not be set for input SA");
437a4a87fa4SAntony Antony err = -EINVAL;
438a4a87fa4SAntony Antony goto out;
439a4a87fa4SAntony Antony }
440a4a87fa4SAntony Antony
441a4a87fa4SAntony Antony if (attrs[XFRMA_SA_EXTRA_FLAGS]) {
442a4a87fa4SAntony Antony u32 xflags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
443a4a87fa4SAntony Antony
444a4a87fa4SAntony Antony if (xflags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP) {
445a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Flag DONT_ENCAP_DSCP should not be set for input SA");
446a4a87fa4SAntony Antony err = -EINVAL;
447a4a87fa4SAntony Antony goto out;
448a4a87fa4SAntony Antony }
449a4a87fa4SAntony Antony
450a4a87fa4SAntony Antony if (xflags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP) {
451a4a87fa4SAntony Antony NL_SET_ERR_MSG(extack, "Flag OSEQ_MAY_WRAP should not be set for input SA");
452a4a87fa4SAntony Antony err = -EINVAL;
453a4a87fa4SAntony Antony goto out;
454a4a87fa4SAntony Antony }
455a4a87fa4SAntony Antony
456a4a87fa4SAntony Antony }
4576999aae1SSabrina Dubroca }
4584e484b3eSAntony Antony
4591da177e4SLinus Torvalds out:
4601da177e4SLinus Torvalds return err;
4611da177e4SLinus Torvalds }
4621da177e4SLinus Torvalds
attach_one_algo(struct xfrm_algo ** algpp,u8 * props,struct xfrm_algo_desc * (* get_byname)(const char *,int),struct nlattr * rta,struct netlink_ext_ack * extack)4631da177e4SLinus Torvalds static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
4646f2f19edSDavid S. Miller struct xfrm_algo_desc *(*get_byname)(const char *, int),
4652b916826SSabrina Dubroca struct nlattr *rta, struct netlink_ext_ack *extack)
4661da177e4SLinus Torvalds {
4671da177e4SLinus Torvalds struct xfrm_algo *p, *ualg;
4681da177e4SLinus Torvalds struct xfrm_algo_desc *algo;
4691da177e4SLinus Torvalds
4701da177e4SLinus Torvalds if (!rta)
4711da177e4SLinus Torvalds return 0;
4721da177e4SLinus Torvalds
4735424f32eSThomas Graf ualg = nla_data(rta);
4741da177e4SLinus Torvalds
4751da177e4SLinus Torvalds algo = get_byname(ualg->alg_name, 1);
4762b916826SSabrina Dubroca if (!algo) {
4772b916826SSabrina Dubroca NL_SET_ERR_MSG(extack, "Requested COMP algorithm not found");
4781da177e4SLinus Torvalds return -ENOSYS;
4792b916826SSabrina Dubroca }
4801da177e4SLinus Torvalds *props = algo->desc.sadb_alg_id;
4811da177e4SLinus Torvalds
4820f99be0dSEric Dumazet p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
4831da177e4SLinus Torvalds if (!p)
4841da177e4SLinus Torvalds return -ENOMEM;
4851da177e4SLinus Torvalds
48604ff1260SHerbert Xu strcpy(p->alg_name, algo->name);
4871da177e4SLinus Torvalds *algpp = p;
4881da177e4SLinus Torvalds return 0;
4891da177e4SLinus Torvalds }
4901da177e4SLinus Torvalds
attach_crypt(struct xfrm_state * x,struct nlattr * rta,struct netlink_ext_ack * extack)4912b916826SSabrina Dubroca static int attach_crypt(struct xfrm_state *x, struct nlattr *rta,
4922b916826SSabrina Dubroca struct netlink_ext_ack *extack)
49369b0137fSHerbert Xu {
49469b0137fSHerbert Xu struct xfrm_algo *p, *ualg;
49569b0137fSHerbert Xu struct xfrm_algo_desc *algo;
49669b0137fSHerbert Xu
49769b0137fSHerbert Xu if (!rta)
49869b0137fSHerbert Xu return 0;
49969b0137fSHerbert Xu
50069b0137fSHerbert Xu ualg = nla_data(rta);
50169b0137fSHerbert Xu
50269b0137fSHerbert Xu algo = xfrm_ealg_get_byname(ualg->alg_name, 1);
5032b916826SSabrina Dubroca if (!algo) {
5042b916826SSabrina Dubroca NL_SET_ERR_MSG(extack, "Requested CRYPT algorithm not found");
50569b0137fSHerbert Xu return -ENOSYS;
5062b916826SSabrina Dubroca }
50769b0137fSHerbert Xu x->props.ealgo = algo->desc.sadb_alg_id;
50869b0137fSHerbert Xu
50969b0137fSHerbert Xu p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
51069b0137fSHerbert Xu if (!p)
51169b0137fSHerbert Xu return -ENOMEM;
51269b0137fSHerbert Xu
51369b0137fSHerbert Xu strcpy(p->alg_name, algo->name);
51469b0137fSHerbert Xu x->ealg = p;
51569b0137fSHerbert Xu x->geniv = algo->uinfo.encr.geniv;
51669b0137fSHerbert Xu return 0;
51769b0137fSHerbert Xu }
51869b0137fSHerbert Xu
attach_auth(struct xfrm_algo_auth ** algpp,u8 * props,struct nlattr * rta,struct netlink_ext_ack * extack)5194447bb33SMartin Willi static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
5202b916826SSabrina Dubroca struct nlattr *rta, struct netlink_ext_ack *extack)
5214447bb33SMartin Willi {
5224447bb33SMartin Willi struct xfrm_algo *ualg;
5234447bb33SMartin Willi struct xfrm_algo_auth *p;
5244447bb33SMartin Willi struct xfrm_algo_desc *algo;
5254447bb33SMartin Willi
5264447bb33SMartin Willi if (!rta)
5274447bb33SMartin Willi return 0;
5284447bb33SMartin Willi
5294447bb33SMartin Willi ualg = nla_data(rta);
5304447bb33SMartin Willi
5314447bb33SMartin Willi algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
5322b916826SSabrina Dubroca if (!algo) {
5332b916826SSabrina Dubroca NL_SET_ERR_MSG(extack, "Requested AUTH algorithm not found");
5344447bb33SMartin Willi return -ENOSYS;
5352b916826SSabrina Dubroca }
5364447bb33SMartin Willi *props = algo->desc.sadb_alg_id;
5374447bb33SMartin Willi
5384447bb33SMartin Willi p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
5394447bb33SMartin Willi if (!p)
5404447bb33SMartin Willi return -ENOMEM;
5414447bb33SMartin Willi
5424447bb33SMartin Willi strcpy(p->alg_name, algo->name);
5434447bb33SMartin Willi p->alg_key_len = ualg->alg_key_len;
5444447bb33SMartin Willi p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
5454447bb33SMartin Willi memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
5464447bb33SMartin Willi
5474447bb33SMartin Willi *algpp = p;
5484447bb33SMartin Willi return 0;
5494447bb33SMartin Willi }
5504447bb33SMartin Willi
attach_auth_trunc(struct xfrm_algo_auth ** algpp,u8 * props,struct nlattr * rta,struct netlink_ext_ack * extack)5514447bb33SMartin Willi static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
5522b916826SSabrina Dubroca struct nlattr *rta, struct netlink_ext_ack *extack)
5534447bb33SMartin Willi {
5544447bb33SMartin Willi struct xfrm_algo_auth *p, *ualg;
5554447bb33SMartin Willi struct xfrm_algo_desc *algo;
5564447bb33SMartin Willi
5574447bb33SMartin Willi if (!rta)
5584447bb33SMartin Willi return 0;
5594447bb33SMartin Willi
5604447bb33SMartin Willi ualg = nla_data(rta);
5614447bb33SMartin Willi
5624447bb33SMartin Willi algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
5632b916826SSabrina Dubroca if (!algo) {
5642b916826SSabrina Dubroca NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found");
5654447bb33SMartin Willi return -ENOSYS;
5662b916826SSabrina Dubroca }
5672b916826SSabrina Dubroca if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) {
5682b916826SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV");
5694447bb33SMartin Willi return -EINVAL;
5702b916826SSabrina Dubroca }
5714447bb33SMartin Willi *props = algo->desc.sadb_alg_id;
5724447bb33SMartin Willi
5734447bb33SMartin Willi p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
5744447bb33SMartin Willi if (!p)
5754447bb33SMartin Willi return -ENOMEM;
5764447bb33SMartin Willi
5774447bb33SMartin Willi strcpy(p->alg_name, algo->name);
5784447bb33SMartin Willi if (!p->alg_trunc_len)
5794447bb33SMartin Willi p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
5804447bb33SMartin Willi
5814447bb33SMartin Willi *algpp = p;
5824447bb33SMartin Willi return 0;
5834447bb33SMartin Willi }
5844447bb33SMartin Willi
attach_aead(struct xfrm_state * x,struct nlattr * rta,struct netlink_ext_ack * extack)5852b916826SSabrina Dubroca static int attach_aead(struct xfrm_state *x, struct nlattr *rta,
5862b916826SSabrina Dubroca struct netlink_ext_ack *extack)
5871a6509d9SHerbert Xu {
5881a6509d9SHerbert Xu struct xfrm_algo_aead *p, *ualg;
5891a6509d9SHerbert Xu struct xfrm_algo_desc *algo;
5901a6509d9SHerbert Xu
5911a6509d9SHerbert Xu if (!rta)
5921a6509d9SHerbert Xu return 0;
5931a6509d9SHerbert Xu
5941a6509d9SHerbert Xu ualg = nla_data(rta);
5951a6509d9SHerbert Xu
5961a6509d9SHerbert Xu algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
5972b916826SSabrina Dubroca if (!algo) {
5982b916826SSabrina Dubroca NL_SET_ERR_MSG(extack, "Requested AEAD algorithm not found");
5991a6509d9SHerbert Xu return -ENOSYS;
6002b916826SSabrina Dubroca }
60169b0137fSHerbert Xu x->props.ealgo = algo->desc.sadb_alg_id;
6021a6509d9SHerbert Xu
6031a6509d9SHerbert Xu p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
6041a6509d9SHerbert Xu if (!p)
6051a6509d9SHerbert Xu return -ENOMEM;
6061a6509d9SHerbert Xu
6071a6509d9SHerbert Xu strcpy(p->alg_name, algo->name);
60869b0137fSHerbert Xu x->aead = p;
60969b0137fSHerbert Xu x->geniv = algo->uinfo.aead.geniv;
6101a6509d9SHerbert Xu return 0;
6111a6509d9SHerbert Xu }
6121a6509d9SHerbert Xu
xfrm_replay_verify_len(struct xfrm_replay_state_esn * replay_esn,struct nlattr * rp,struct netlink_ext_ack * extack)613e2b19125SSteffen Klassert static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
614643bc1a2SSabrina Dubroca struct nlattr *rp,
615643bc1a2SSabrina Dubroca struct netlink_ext_ack *extack)
616e2b19125SSteffen Klassert {
617e2b19125SSteffen Klassert struct xfrm_replay_state_esn *up;
6185e708e47SAlexey Dobriyan unsigned int ulen;
619e2b19125SSteffen Klassert
620e2b19125SSteffen Klassert if (!replay_esn || !rp)
621e2b19125SSteffen Klassert return 0;
622e2b19125SSteffen Klassert
623e2b19125SSteffen Klassert up = nla_data(rp);
624ecd79187SMathias Krause ulen = xfrm_replay_state_esn_len(up);
625e2b19125SSteffen Klassert
626f843ee6dSAndy Whitcroft /* Check the overall length and the internal bitmap length to avoid
627f843ee6dSAndy Whitcroft * potential overflow. */
628643bc1a2SSabrina Dubroca if (nla_len(rp) < (int)ulen) {
629643bc1a2SSabrina Dubroca NL_SET_ERR_MSG(extack, "ESN attribute is too short");
630e2b19125SSteffen Klassert return -EINVAL;
631643bc1a2SSabrina Dubroca }
632e2b19125SSteffen Klassert
633643bc1a2SSabrina Dubroca if (xfrm_replay_state_esn_len(replay_esn) != ulen) {
634643bc1a2SSabrina Dubroca NL_SET_ERR_MSG(extack, "New ESN size doesn't match the existing SA's ESN size");
635677e806dSAndy Whitcroft return -EINVAL;
636643bc1a2SSabrina Dubroca }
637643bc1a2SSabrina Dubroca
638643bc1a2SSabrina Dubroca if (replay_esn->bmp_len != up->bmp_len) {
639643bc1a2SSabrina Dubroca NL_SET_ERR_MSG(extack, "New ESN bitmap size doesn't match the existing SA's ESN bitmap");
640643bc1a2SSabrina Dubroca return -EINVAL;
641643bc1a2SSabrina Dubroca }
642643bc1a2SSabrina Dubroca
643643bc1a2SSabrina Dubroca if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) {
644643bc1a2SSabrina Dubroca NL_SET_ERR_MSG(extack, "ESN replay window is longer than the bitmap");
645643bc1a2SSabrina Dubroca return -EINVAL;
646643bc1a2SSabrina Dubroca }
647677e806dSAndy Whitcroft
648e2b19125SSteffen Klassert return 0;
649e2b19125SSteffen Klassert }
650e2b19125SSteffen Klassert
xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn ** replay_esn,struct xfrm_replay_state_esn ** preplay_esn,struct nlattr * rta)651d8647b79SSteffen Klassert static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
652d8647b79SSteffen Klassert struct xfrm_replay_state_esn **preplay_esn,
653d8647b79SSteffen Klassert struct nlattr *rta)
654d8647b79SSteffen Klassert {
655d8647b79SSteffen Klassert struct xfrm_replay_state_esn *p, *pp, *up;
6565e708e47SAlexey Dobriyan unsigned int klen, ulen;
657d8647b79SSteffen Klassert
658d8647b79SSteffen Klassert if (!rta)
659d8647b79SSteffen Klassert return 0;
660d8647b79SSteffen Klassert
661d8647b79SSteffen Klassert up = nla_data(rta);
662ecd79187SMathias Krause klen = xfrm_replay_state_esn_len(up);
6635e708e47SAlexey Dobriyan ulen = nla_len(rta) >= (int)klen ? klen : sizeof(*up);
664d8647b79SSteffen Klassert
665ecd79187SMathias Krause p = kzalloc(klen, GFP_KERNEL);
666d8647b79SSteffen Klassert if (!p)
667d8647b79SSteffen Klassert return -ENOMEM;
668d8647b79SSteffen Klassert
669ecd79187SMathias Krause pp = kzalloc(klen, GFP_KERNEL);
670d8647b79SSteffen Klassert if (!pp) {
671d8647b79SSteffen Klassert kfree(p);
672d8647b79SSteffen Klassert return -ENOMEM;
673d8647b79SSteffen Klassert }
674d8647b79SSteffen Klassert
675ecd79187SMathias Krause memcpy(p, up, ulen);
676ecd79187SMathias Krause memcpy(pp, up, ulen);
677ecd79187SMathias Krause
678d8647b79SSteffen Klassert *replay_esn = p;
679d8647b79SSteffen Klassert *preplay_esn = pp;
680d8647b79SSteffen Klassert
681d8647b79SSteffen Klassert return 0;
682d8647b79SSteffen Klassert }
683d8647b79SSteffen Klassert
xfrm_user_sec_ctx_size(struct xfrm_sec_ctx * xfrm_ctx)684a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
685df71837dSTrent Jaeger {
686a1b831f2SAlexey Dobriyan unsigned int len = 0;
687df71837dSTrent Jaeger
688df71837dSTrent Jaeger if (xfrm_ctx) {
689df71837dSTrent Jaeger len += sizeof(struct xfrm_user_sec_ctx);
690df71837dSTrent Jaeger len += xfrm_ctx->ctx_len;
691df71837dSTrent Jaeger }
692df71837dSTrent Jaeger return len;
693df71837dSTrent Jaeger }
694df71837dSTrent Jaeger
copy_from_user_state(struct xfrm_state * x,struct xfrm_usersa_info * p)6951da177e4SLinus Torvalds static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
6961da177e4SLinus Torvalds {
6971da177e4SLinus Torvalds memcpy(&x->id, &p->id, sizeof(x->id));
6981da177e4SLinus Torvalds memcpy(&x->sel, &p->sel, sizeof(x->sel));
6991da177e4SLinus Torvalds memcpy(&x->lft, &p->lft, sizeof(x->lft));
7001da177e4SLinus Torvalds x->props.mode = p->mode;
70133fce60dSFan Du x->props.replay_window = min_t(unsigned int, p->replay_window,
70233fce60dSFan Du sizeof(x->replay.bitmap) * 8);
7031da177e4SLinus Torvalds x->props.reqid = p->reqid;
7041da177e4SLinus Torvalds x->props.family = p->family;
70554489c14SDavid S. Miller memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
7061da177e4SLinus Torvalds x->props.flags = p->flags;
707196b0036SHerbert Xu
708ccf9b3b8SSteffen Klassert if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
709196b0036SHerbert Xu x->sel.family = p->family;
7101da177e4SLinus Torvalds }
7111da177e4SLinus Torvalds
712d51d081dSJamal Hadi Salim /*
713d51d081dSJamal Hadi Salim * someday when pfkey also has support, we could have the code
714d51d081dSJamal Hadi Salim * somehow made shareable and move it to xfrm_state.c - JHS
715d51d081dSJamal Hadi Salim *
716d51d081dSJamal Hadi Salim */
xfrm_update_ae_params(struct xfrm_state * x,struct nlattr ** attrs,int update_esn)717e3ac104dSMathias Krause static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
718e3ac104dSMathias Krause int update_esn)
719d51d081dSJamal Hadi Salim {
7205424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
721e3ac104dSMathias Krause struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
7225424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
7235424f32eSThomas Graf struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
7245424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
7254e484b3eSAntony Antony struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
726d51d081dSJamal Hadi Salim
72700374d9bSLin Ma if (re && x->replay_esn && x->preplay_esn) {
728d8647b79SSteffen Klassert struct xfrm_replay_state_esn *replay_esn;
729d8647b79SSteffen Klassert replay_esn = nla_data(re);
730d8647b79SSteffen Klassert memcpy(x->replay_esn, replay_esn,
731d8647b79SSteffen Klassert xfrm_replay_state_esn_len(replay_esn));
732d8647b79SSteffen Klassert memcpy(x->preplay_esn, replay_esn,
733d8647b79SSteffen Klassert xfrm_replay_state_esn_len(replay_esn));
734d8647b79SSteffen Klassert }
735d8647b79SSteffen Klassert
736d51d081dSJamal Hadi Salim if (rp) {
737d51d081dSJamal Hadi Salim struct xfrm_replay_state *replay;
7385424f32eSThomas Graf replay = nla_data(rp);
739d51d081dSJamal Hadi Salim memcpy(&x->replay, replay, sizeof(*replay));
740d51d081dSJamal Hadi Salim memcpy(&x->preplay, replay, sizeof(*replay));
741d51d081dSJamal Hadi Salim }
742d51d081dSJamal Hadi Salim
743d51d081dSJamal Hadi Salim if (lt) {
744d51d081dSJamal Hadi Salim struct xfrm_lifetime_cur *ltime;
7455424f32eSThomas Graf ltime = nla_data(lt);
746d51d081dSJamal Hadi Salim x->curlft.bytes = ltime->bytes;
747d51d081dSJamal Hadi Salim x->curlft.packets = ltime->packets;
748d51d081dSJamal Hadi Salim x->curlft.add_time = ltime->add_time;
749d51d081dSJamal Hadi Salim x->curlft.use_time = ltime->use_time;
750d51d081dSJamal Hadi Salim }
751d51d081dSJamal Hadi Salim
752cf5cb79fSThomas Graf if (et)
7535424f32eSThomas Graf x->replay_maxage = nla_get_u32(et);
754d51d081dSJamal Hadi Salim
755cf5cb79fSThomas Graf if (rt)
7565424f32eSThomas Graf x->replay_maxdiff = nla_get_u32(rt);
7574e484b3eSAntony Antony
7584e484b3eSAntony Antony if (mt)
7594e484b3eSAntony Antony x->mapping_maxage = nla_get_u32(mt);
760d51d081dSJamal Hadi Salim }
761d51d081dSJamal Hadi Salim
xfrm_smark_init(struct nlattr ** attrs,struct xfrm_mark * m)7629b42c1f1SSteffen Klassert static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
7639b42c1f1SSteffen Klassert {
7649b42c1f1SSteffen Klassert if (attrs[XFRMA_SET_MARK]) {
7659b42c1f1SSteffen Klassert m->v = nla_get_u32(attrs[XFRMA_SET_MARK]);
7669b42c1f1SSteffen Klassert if (attrs[XFRMA_SET_MARK_MASK])
7679b42c1f1SSteffen Klassert m->m = nla_get_u32(attrs[XFRMA_SET_MARK_MASK]);
7689b42c1f1SSteffen Klassert else
7699b42c1f1SSteffen Klassert m->m = 0xffffffff;
7709b42c1f1SSteffen Klassert } else {
7719b42c1f1SSteffen Klassert m->v = m->m = 0;
7729b42c1f1SSteffen Klassert }
7739b42c1f1SSteffen Klassert }
7749b42c1f1SSteffen Klassert
xfrm_state_construct(struct net * net,struct xfrm_usersa_info * p,struct nlattr ** attrs,int * errp,struct netlink_ext_ack * extack)775fc34acd3SAlexey Dobriyan static struct xfrm_state *xfrm_state_construct(struct net *net,
776fc34acd3SAlexey Dobriyan struct xfrm_usersa_info *p,
7775424f32eSThomas Graf struct nlattr **attrs,
778adb5c33eSSabrina Dubroca int *errp,
779adb5c33eSSabrina Dubroca struct netlink_ext_ack *extack)
7801da177e4SLinus Torvalds {
781fc34acd3SAlexey Dobriyan struct xfrm_state *x = xfrm_state_alloc(net);
7821da177e4SLinus Torvalds int err = -ENOMEM;
7831da177e4SLinus Torvalds
7841da177e4SLinus Torvalds if (!x)
7851da177e4SLinus Torvalds goto error_no_put;
7861da177e4SLinus Torvalds
7871da177e4SLinus Torvalds copy_from_user_state(x, p);
7881da177e4SLinus Torvalds
7896fd06963SSteffen Klassert if (attrs[XFRMA_ENCAP]) {
7906fd06963SSteffen Klassert x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
7916fd06963SSteffen Klassert sizeof(*x->encap), GFP_KERNEL);
7926fd06963SSteffen Klassert if (x->encap == NULL)
7936fd06963SSteffen Klassert goto error;
7946fd06963SSteffen Klassert }
7956fd06963SSteffen Klassert
7966fd06963SSteffen Klassert if (attrs[XFRMA_COADDR]) {
7976fd06963SSteffen Klassert x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
7986fd06963SSteffen Klassert sizeof(*x->coaddr), GFP_KERNEL);
7996fd06963SSteffen Klassert if (x->coaddr == NULL)
8006fd06963SSteffen Klassert goto error;
8016fd06963SSteffen Klassert }
8026fd06963SSteffen Klassert
803a947b0a9SNicolas Dichtel if (attrs[XFRMA_SA_EXTRA_FLAGS])
804a947b0a9SNicolas Dichtel x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
805a947b0a9SNicolas Dichtel
8062b916826SSabrina Dubroca if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD], extack)))
8071a6509d9SHerbert Xu goto error;
8084447bb33SMartin Willi if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
8092b916826SSabrina Dubroca attrs[XFRMA_ALG_AUTH_TRUNC], extack)))
8104447bb33SMartin Willi goto error;
8114447bb33SMartin Willi if (!x->props.aalgo) {
8124447bb33SMartin Willi if ((err = attach_auth(&x->aalg, &x->props.aalgo,
8132b916826SSabrina Dubroca attrs[XFRMA_ALG_AUTH], extack)))
8141da177e4SLinus Torvalds goto error;
8154447bb33SMartin Willi }
8162b916826SSabrina Dubroca if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT], extack)))
8171da177e4SLinus Torvalds goto error;
8181da177e4SLinus Torvalds if ((err = attach_one_algo(&x->calg, &x->props.calgo,
8191da177e4SLinus Torvalds xfrm_calg_get_byname,
8202b916826SSabrina Dubroca attrs[XFRMA_ALG_COMP], extack)))
8211da177e4SLinus Torvalds goto error;
822fd21150aSThomas Graf
82335d2856bSMartin Willi if (attrs[XFRMA_TFCPAD])
82435d2856bSMartin Willi x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
82535d2856bSMartin Willi
8266f26b61eSJamal Hadi Salim xfrm_mark_get(attrs, &x->mark);
8276f26b61eSJamal Hadi Salim
8289b42c1f1SSteffen Klassert xfrm_smark_init(attrs, &x->props.smark);
829077fbac4SLorenzo Colitti
830a3d9001bSKai Lueke if (attrs[XFRMA_IF_ID])
8317e652640SSteffen Klassert x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
832fd21150aSThomas Graf
833a4a87fa4SAntony Antony if (attrs[XFRMA_SA_DIR])
834a4a87fa4SAntony Antony x->dir = nla_get_u8(attrs[XFRMA_SA_DIR]);
835a4a87fa4SAntony Antony
836*f531d13bSEyal Birger if (attrs[XFRMA_NAT_KEEPALIVE_INTERVAL])
837*f531d13bSEyal Birger x->nat_keepalive_interval =
838*f531d13bSEyal Birger nla_get_u32(attrs[XFRMA_NAT_KEEPALIVE_INTERVAL]);
839*f531d13bSEyal Birger
840741f9a10SSabrina Dubroca err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV], extack);
8411da177e4SLinus Torvalds if (err)
8421da177e4SLinus Torvalds goto error;
8431da177e4SLinus Torvalds
8442f30ea50SMathias Krause if (attrs[XFRMA_SEC_CTX]) {
8452f30ea50SMathias Krause err = security_xfrm_state_alloc(x,
8462f30ea50SMathias Krause nla_data(attrs[XFRMA_SEC_CTX]));
8472f30ea50SMathias Krause if (err)
848df71837dSTrent Jaeger goto error;
8492f30ea50SMathias Krause }
850df71837dSTrent Jaeger
851d8647b79SSteffen Klassert if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
852d8647b79SSteffen Klassert attrs[XFRMA_REPLAY_ESN_VAL])))
853d8647b79SSteffen Klassert goto error;
854d8647b79SSteffen Klassert
8551da177e4SLinus Torvalds x->km.seq = p->seq;
856b27aeadbSAlexey Dobriyan x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
857d51d081dSJamal Hadi Salim /* sysctl_xfrm_aevent_etime is in 100ms units */
858b27aeadbSAlexey Dobriyan x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
859d51d081dSJamal Hadi Salim
8601cf9a3aeSSabrina Dubroca if ((err = xfrm_init_replay(x, extack)))
8619fdc4883SSteffen Klassert goto error;
862d51d081dSJamal Hadi Salim
8639fdc4883SSteffen Klassert /* override default values from above */
864e3ac104dSMathias Krause xfrm_update_ae_params(x, attrs, 0);
8651da177e4SLinus Torvalds
866cc01572eSYossi Kuperman /* configure the hardware if offload is requested */
867cc01572eSYossi Kuperman if (attrs[XFRMA_OFFLOAD_DEV]) {
868cc01572eSYossi Kuperman err = xfrm_dev_state_add(net, x,
869adb5c33eSSabrina Dubroca nla_data(attrs[XFRMA_OFFLOAD_DEV]),
870adb5c33eSSabrina Dubroca extack);
871cc01572eSYossi Kuperman if (err)
872cc01572eSYossi Kuperman goto error;
873cc01572eSYossi Kuperman }
874cc01572eSYossi Kuperman
8751da177e4SLinus Torvalds return x;
8761da177e4SLinus Torvalds
8771da177e4SLinus Torvalds error:
8781da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD;
8791da177e4SLinus Torvalds xfrm_state_put(x);
8801da177e4SLinus Torvalds error_no_put:
8811da177e4SLinus Torvalds *errp = err;
8821da177e4SLinus Torvalds return NULL;
8831da177e4SLinus Torvalds }
8841da177e4SLinus Torvalds
xfrm_add_sa(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)88522e70050SChristoph Hellwig static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
8863bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
8871da177e4SLinus Torvalds {
888fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
8897b67c857SThomas Graf struct xfrm_usersa_info *p = nlmsg_data(nlh);
8901da177e4SLinus Torvalds struct xfrm_state *x;
8911da177e4SLinus Torvalds int err;
89226b15dadSJamal Hadi Salim struct km_event c;
8931da177e4SLinus Torvalds
8946999aae1SSabrina Dubroca err = verify_newsa_info(p, attrs, extack);
8951da177e4SLinus Torvalds if (err)
8961da177e4SLinus Torvalds return err;
8971da177e4SLinus Torvalds
898adb5c33eSSabrina Dubroca x = xfrm_state_construct(net, p, attrs, &err, extack);
8991da177e4SLinus Torvalds if (!x)
9001da177e4SLinus Torvalds return err;
9011da177e4SLinus Torvalds
90226b15dadSJamal Hadi Salim xfrm_state_hold(x);
9031da177e4SLinus Torvalds if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
9041da177e4SLinus Torvalds err = xfrm_state_add(x);
9051da177e4SLinus Torvalds else
9061da177e4SLinus Torvalds err = xfrm_state_update(x);
9071da177e4SLinus Torvalds
9082e71029eSTetsuo Handa xfrm_audit_state_add(x, err ? 0 : 1, true);
909161a09e7SJoy Latten
9101da177e4SLinus Torvalds if (err < 0) {
9111da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD;
912c5d4d7d8SSteffen Klassert xfrm_dev_state_delete(x);
91321380b81SHerbert Xu __xfrm_state_put(x);
9147d6dfe1fSPatrick McHardy goto out;
9151da177e4SLinus Torvalds }
9161da177e4SLinus Torvalds
917cc01572eSYossi Kuperman if (x->km.state == XFRM_STATE_VOID)
918cc01572eSYossi Kuperman x->km.state = XFRM_STATE_VALID;
919cc01572eSYossi Kuperman
92026b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
92115e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
922f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type;
92326b15dadSJamal Hadi Salim
92426b15dadSJamal Hadi Salim km_state_notify(x, &c);
9257d6dfe1fSPatrick McHardy out:
92626b15dadSJamal Hadi Salim xfrm_state_put(x);
9271da177e4SLinus Torvalds return err;
9281da177e4SLinus Torvalds }
9291da177e4SLinus Torvalds
xfrm_user_state_lookup(struct net * net,struct xfrm_usersa_id * p,struct nlattr ** attrs,int * errp)930fc34acd3SAlexey Dobriyan static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
931fc34acd3SAlexey Dobriyan struct xfrm_usersa_id *p,
9325424f32eSThomas Graf struct nlattr **attrs,
933eb2971b6SMasahide NAKAMURA int *errp)
934eb2971b6SMasahide NAKAMURA {
935eb2971b6SMasahide NAKAMURA struct xfrm_state *x = NULL;
9366f26b61eSJamal Hadi Salim struct xfrm_mark m;
937eb2971b6SMasahide NAKAMURA int err;
9386f26b61eSJamal Hadi Salim u32 mark = xfrm_mark_get(attrs, &m);
939eb2971b6SMasahide NAKAMURA
940eb2971b6SMasahide NAKAMURA if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
941eb2971b6SMasahide NAKAMURA err = -ESRCH;
9426f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
943eb2971b6SMasahide NAKAMURA } else {
944eb2971b6SMasahide NAKAMURA xfrm_address_t *saddr = NULL;
945eb2971b6SMasahide NAKAMURA
94635a7aa08SThomas Graf verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
947eb2971b6SMasahide NAKAMURA if (!saddr) {
948eb2971b6SMasahide NAKAMURA err = -EINVAL;
949eb2971b6SMasahide NAKAMURA goto out;
950eb2971b6SMasahide NAKAMURA }
951eb2971b6SMasahide NAKAMURA
9529abbffeeSMasahide NAKAMURA err = -ESRCH;
9536f26b61eSJamal Hadi Salim x = xfrm_state_lookup_byaddr(net, mark,
9546f26b61eSJamal Hadi Salim &p->daddr, saddr,
955221df1edSAlexey Dobriyan p->proto, p->family);
956eb2971b6SMasahide NAKAMURA }
957eb2971b6SMasahide NAKAMURA
958eb2971b6SMasahide NAKAMURA out:
959eb2971b6SMasahide NAKAMURA if (!x && errp)
960eb2971b6SMasahide NAKAMURA *errp = err;
961eb2971b6SMasahide NAKAMURA return x;
962eb2971b6SMasahide NAKAMURA }
963eb2971b6SMasahide NAKAMURA
xfrm_del_sa(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)96422e70050SChristoph Hellwig static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
9653bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
9661da177e4SLinus Torvalds {
967fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
9681da177e4SLinus Torvalds struct xfrm_state *x;
969eb2971b6SMasahide NAKAMURA int err = -ESRCH;
97026b15dadSJamal Hadi Salim struct km_event c;
9717b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh);
9721da177e4SLinus Torvalds
973fc34acd3SAlexey Dobriyan x = xfrm_user_state_lookup(net, p, attrs, &err);
9741da177e4SLinus Torvalds if (x == NULL)
975eb2971b6SMasahide NAKAMURA return err;
9761da177e4SLinus Torvalds
9776f68dc37SDavid S. Miller if ((err = security_xfrm_state_delete(x)) != 0)
978c8c05a8eSCatherine Zhang goto out;
979c8c05a8eSCatherine Zhang
9801da177e4SLinus Torvalds if (xfrm_state_kern(x)) {
981880e475dSSabrina Dubroca NL_SET_ERR_MSG(extack, "SA is in use by tunnels");
982c8c05a8eSCatherine Zhang err = -EPERM;
983c8c05a8eSCatherine Zhang goto out;
9841da177e4SLinus Torvalds }
9851da177e4SLinus Torvalds
98626b15dadSJamal Hadi Salim err = xfrm_state_delete(x);
987c8c05a8eSCatherine Zhang if (err < 0)
988c8c05a8eSCatherine Zhang goto out;
98926b15dadSJamal Hadi Salim
99026b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
99115e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
992f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type;
99326b15dadSJamal Hadi Salim km_state_notify(x, &c);
9941da177e4SLinus Torvalds
995c8c05a8eSCatherine Zhang out:
9962e71029eSTetsuo Handa xfrm_audit_state_delete(x, err ? 0 : 1, true);
997c8c05a8eSCatherine Zhang xfrm_state_put(x);
99826b15dadSJamal Hadi Salim return err;
9991da177e4SLinus Torvalds }
10001da177e4SLinus Torvalds
copy_to_user_state(struct xfrm_state * x,struct xfrm_usersa_info * p)10011da177e4SLinus Torvalds static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
10021da177e4SLinus Torvalds {
1003f778a636SMathias Krause memset(p, 0, sizeof(*p));
10041da177e4SLinus Torvalds memcpy(&p->id, &x->id, sizeof(p->id));
10051da177e4SLinus Torvalds memcpy(&p->sel, &x->sel, sizeof(p->sel));
10061da177e4SLinus Torvalds memcpy(&p->lft, &x->lft, sizeof(p->lft));
1007c9fa320bSRaed Salem if (x->xso.dev)
1008fd2bc419SLeon Romanovsky xfrm_dev_state_update_stats(x);
10091da177e4SLinus Torvalds memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
1010e33d4f13SSowmini Varadhan put_unaligned(x->stats.replay_window, &p->stats.replay_window);
1011e33d4f13SSowmini Varadhan put_unaligned(x->stats.replay, &p->stats.replay);
1012e33d4f13SSowmini Varadhan put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed);
101354489c14SDavid S. Miller memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
10141da177e4SLinus Torvalds p->mode = x->props.mode;
10151da177e4SLinus Torvalds p->replay_window = x->props.replay_window;
10161da177e4SLinus Torvalds p->reqid = x->props.reqid;
10171da177e4SLinus Torvalds p->family = x->props.family;
10181da177e4SLinus Torvalds p->flags = x->props.flags;
10191da177e4SLinus Torvalds p->seq = x->km.seq;
10201da177e4SLinus Torvalds }
10211da177e4SLinus Torvalds
10221da177e4SLinus Torvalds struct xfrm_dump_info {
10231da177e4SLinus Torvalds struct sk_buff *in_skb;
10241da177e4SLinus Torvalds struct sk_buff *out_skb;
10251da177e4SLinus Torvalds u32 nlmsg_seq;
10261da177e4SLinus Torvalds u16 nlmsg_flags;
10271da177e4SLinus Torvalds };
10281da177e4SLinus Torvalds
copy_sec_ctx(struct xfrm_sec_ctx * s,struct sk_buff * skb)1029c0144beaSThomas Graf static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
1030c0144beaSThomas Graf {
1031c0144beaSThomas Graf struct xfrm_user_sec_ctx *uctx;
1032c0144beaSThomas Graf struct nlattr *attr;
103368325d3bSHerbert Xu int ctx_size = sizeof(*uctx) + s->ctx_len;
1034c0144beaSThomas Graf
1035c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
1036c0144beaSThomas Graf if (attr == NULL)
1037c0144beaSThomas Graf return -EMSGSIZE;
1038c0144beaSThomas Graf
1039c0144beaSThomas Graf uctx = nla_data(attr);
1040c0144beaSThomas Graf uctx->exttype = XFRMA_SEC_CTX;
1041c0144beaSThomas Graf uctx->len = ctx_size;
1042c0144beaSThomas Graf uctx->ctx_doi = s->ctx_doi;
1043c0144beaSThomas Graf uctx->ctx_alg = s->ctx_alg;
1044c0144beaSThomas Graf uctx->ctx_len = s->ctx_len;
1045c0144beaSThomas Graf memcpy(uctx + 1, s->ctx_str, s->ctx_len);
1046c0144beaSThomas Graf
1047c0144beaSThomas Graf return 0;
1048c0144beaSThomas Graf }
1049c0144beaSThomas Graf
copy_user_offload(struct xfrm_dev_offload * xso,struct sk_buff * skb)105087e0a94eSLeon Romanovsky static int copy_user_offload(struct xfrm_dev_offload *xso, struct sk_buff *skb)
1051d77e38e6SSteffen Klassert {
1052d77e38e6SSteffen Klassert struct xfrm_user_offload *xuo;
1053d77e38e6SSteffen Klassert struct nlattr *attr;
1054d77e38e6SSteffen Klassert
1055d77e38e6SSteffen Klassert attr = nla_reserve(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo));
1056d77e38e6SSteffen Klassert if (attr == NULL)
1057d77e38e6SSteffen Klassert return -EMSGSIZE;
1058d77e38e6SSteffen Klassert
1059d77e38e6SSteffen Klassert xuo = nla_data(attr);
10605fe0d4bdSMathias Krause memset(xuo, 0, sizeof(*xuo));
1061d77e38e6SSteffen Klassert xuo->ifindex = xso->dev->ifindex;
1062482db2f1SLeon Romanovsky if (xso->dir == XFRM_DEV_OFFLOAD_IN)
1063482db2f1SLeon Romanovsky xuo->flags = XFRM_OFFLOAD_INBOUND;
1064d14f28b8SLeon Romanovsky if (xso->type == XFRM_DEV_OFFLOAD_PACKET)
1065d14f28b8SLeon Romanovsky xuo->flags |= XFRM_OFFLOAD_PACKET;
1066d77e38e6SSteffen Klassert
1067d77e38e6SSteffen Klassert return 0;
1068d77e38e6SSteffen Klassert }
1069d77e38e6SSteffen Klassert
xfrm_redact(void)1070c7a5899eSAntony Antony static bool xfrm_redact(void)
1071c7a5899eSAntony Antony {
1072c7a5899eSAntony Antony return IS_ENABLED(CONFIG_SECURITY) &&
1073c7a5899eSAntony Antony security_locked_down(LOCKDOWN_XFRM_SECRET);
1074c7a5899eSAntony Antony }
1075c7a5899eSAntony Antony
copy_to_user_auth(struct xfrm_algo_auth * auth,struct sk_buff * skb)10764447bb33SMartin Willi static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
10774447bb33SMartin Willi {
10784447bb33SMartin Willi struct xfrm_algo *algo;
1079c7a5899eSAntony Antony struct xfrm_algo_auth *ap;
10804447bb33SMartin Willi struct nlattr *nla;
1081c7a5899eSAntony Antony bool redact_secret = xfrm_redact();
10824447bb33SMartin Willi
10834447bb33SMartin Willi nla = nla_reserve(skb, XFRMA_ALG_AUTH,
10844447bb33SMartin Willi sizeof(*algo) + (auth->alg_key_len + 7) / 8);
10854447bb33SMartin Willi if (!nla)
10864447bb33SMartin Willi return -EMSGSIZE;
10874447bb33SMartin Willi algo = nla_data(nla);
10884c87308bSMathias Krause strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
1089c7a5899eSAntony Antony
1090c7a5899eSAntony Antony if (redact_secret && auth->alg_key_len)
1091c7a5899eSAntony Antony memset(algo->alg_key, 0, (auth->alg_key_len + 7) / 8);
1092c7a5899eSAntony Antony else
1093c7a5899eSAntony Antony memcpy(algo->alg_key, auth->alg_key,
1094c7a5899eSAntony Antony (auth->alg_key_len + 7) / 8);
10954447bb33SMartin Willi algo->alg_key_len = auth->alg_key_len;
10964447bb33SMartin Willi
1097c7a5899eSAntony Antony nla = nla_reserve(skb, XFRMA_ALG_AUTH_TRUNC, xfrm_alg_auth_len(auth));
1098c7a5899eSAntony Antony if (!nla)
1099c7a5899eSAntony Antony return -EMSGSIZE;
1100c7a5899eSAntony Antony ap = nla_data(nla);
1101c7a5899eSAntony Antony memcpy(ap, auth, sizeof(struct xfrm_algo_auth));
1102c7a5899eSAntony Antony if (redact_secret && auth->alg_key_len)
1103c7a5899eSAntony Antony memset(ap->alg_key, 0, (auth->alg_key_len + 7) / 8);
1104c7a5899eSAntony Antony else
1105c7a5899eSAntony Antony memcpy(ap->alg_key, auth->alg_key,
1106c7a5899eSAntony Antony (auth->alg_key_len + 7) / 8);
1107c7a5899eSAntony Antony return 0;
1108c7a5899eSAntony Antony }
1109c7a5899eSAntony Antony
copy_to_user_aead(struct xfrm_algo_aead * aead,struct sk_buff * skb)1110c7a5899eSAntony Antony static int copy_to_user_aead(struct xfrm_algo_aead *aead, struct sk_buff *skb)
1111c7a5899eSAntony Antony {
1112c7a5899eSAntony Antony struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_AEAD, aead_len(aead));
1113c7a5899eSAntony Antony struct xfrm_algo_aead *ap;
1114c7a5899eSAntony Antony bool redact_secret = xfrm_redact();
1115c7a5899eSAntony Antony
1116c7a5899eSAntony Antony if (!nla)
1117c7a5899eSAntony Antony return -EMSGSIZE;
1118c7a5899eSAntony Antony
1119c7a5899eSAntony Antony ap = nla_data(nla);
11208222d591SHerbert Xu strscpy_pad(ap->alg_name, aead->alg_name, sizeof(ap->alg_name));
11218222d591SHerbert Xu ap->alg_key_len = aead->alg_key_len;
11228222d591SHerbert Xu ap->alg_icv_len = aead->alg_icv_len;
1123c7a5899eSAntony Antony
1124c7a5899eSAntony Antony if (redact_secret && aead->alg_key_len)
1125c7a5899eSAntony Antony memset(ap->alg_key, 0, (aead->alg_key_len + 7) / 8);
1126c7a5899eSAntony Antony else
1127c7a5899eSAntony Antony memcpy(ap->alg_key, aead->alg_key,
1128c7a5899eSAntony Antony (aead->alg_key_len + 7) / 8);
1129c7a5899eSAntony Antony return 0;
1130c7a5899eSAntony Antony }
1131c7a5899eSAntony Antony
copy_to_user_ealg(struct xfrm_algo * ealg,struct sk_buff * skb)1132c7a5899eSAntony Antony static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb)
1133c7a5899eSAntony Antony {
1134c7a5899eSAntony Antony struct xfrm_algo *ap;
1135c7a5899eSAntony Antony bool redact_secret = xfrm_redact();
1136c7a5899eSAntony Antony struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_CRYPT,
1137c7a5899eSAntony Antony xfrm_alg_len(ealg));
1138c7a5899eSAntony Antony if (!nla)
1139c7a5899eSAntony Antony return -EMSGSIZE;
1140c7a5899eSAntony Antony
1141c7a5899eSAntony Antony ap = nla_data(nla);
11428222d591SHerbert Xu strscpy_pad(ap->alg_name, ealg->alg_name, sizeof(ap->alg_name));
11438222d591SHerbert Xu ap->alg_key_len = ealg->alg_key_len;
1144c7a5899eSAntony Antony
1145c7a5899eSAntony Antony if (redact_secret && ealg->alg_key_len)
1146c7a5899eSAntony Antony memset(ap->alg_key, 0, (ealg->alg_key_len + 7) / 8);
1147c7a5899eSAntony Antony else
1148c7a5899eSAntony Antony memcpy(ap->alg_key, ealg->alg_key,
1149c7a5899eSAntony Antony (ealg->alg_key_len + 7) / 8);
1150c7a5899eSAntony Antony
11514447bb33SMartin Willi return 0;
11524447bb33SMartin Willi }
11534447bb33SMartin Willi
copy_to_user_calg(struct xfrm_algo * calg,struct sk_buff * skb)11548222d591SHerbert Xu static int copy_to_user_calg(struct xfrm_algo *calg, struct sk_buff *skb)
11558222d591SHerbert Xu {
11568222d591SHerbert Xu struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_COMP, sizeof(*calg));
11578222d591SHerbert Xu struct xfrm_algo *ap;
11588222d591SHerbert Xu
11598222d591SHerbert Xu if (!nla)
11608222d591SHerbert Xu return -EMSGSIZE;
11618222d591SHerbert Xu
11628222d591SHerbert Xu ap = nla_data(nla);
11638222d591SHerbert Xu strscpy_pad(ap->alg_name, calg->alg_name, sizeof(ap->alg_name));
11648222d591SHerbert Xu ap->alg_key_len = 0;
11658222d591SHerbert Xu
11668222d591SHerbert Xu return 0;
11678222d591SHerbert Xu }
11688222d591SHerbert Xu
copy_to_user_encap(struct xfrm_encap_tmpl * ep,struct sk_buff * skb)11698222d591SHerbert Xu static int copy_to_user_encap(struct xfrm_encap_tmpl *ep, struct sk_buff *skb)
11708222d591SHerbert Xu {
11718222d591SHerbert Xu struct nlattr *nla = nla_reserve(skb, XFRMA_ENCAP, sizeof(*ep));
11728222d591SHerbert Xu struct xfrm_encap_tmpl *uep;
11738222d591SHerbert Xu
11748222d591SHerbert Xu if (!nla)
11758222d591SHerbert Xu return -EMSGSIZE;
11768222d591SHerbert Xu
11778222d591SHerbert Xu uep = nla_data(nla);
11788222d591SHerbert Xu memset(uep, 0, sizeof(*uep));
11798222d591SHerbert Xu
11808222d591SHerbert Xu uep->encap_type = ep->encap_type;
11818222d591SHerbert Xu uep->encap_sport = ep->encap_sport;
11828222d591SHerbert Xu uep->encap_dport = ep->encap_dport;
11838222d591SHerbert Xu uep->encap_oa = ep->encap_oa;
11848222d591SHerbert Xu
11858222d591SHerbert Xu return 0;
11868222d591SHerbert Xu }
11878222d591SHerbert Xu
xfrm_smark_put(struct sk_buff * skb,struct xfrm_mark * m)11889b42c1f1SSteffen Klassert static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m)
11899b42c1f1SSteffen Klassert {
11909b42c1f1SSteffen Klassert int ret = 0;
11919b42c1f1SSteffen Klassert
11929b42c1f1SSteffen Klassert if (m->v | m->m) {
11939b42c1f1SSteffen Klassert ret = nla_put_u32(skb, XFRMA_SET_MARK, m->v);
11949b42c1f1SSteffen Klassert if (!ret)
11959b42c1f1SSteffen Klassert ret = nla_put_u32(skb, XFRMA_SET_MARK_MASK, m->m);
11969b42c1f1SSteffen Klassert }
11979b42c1f1SSteffen Klassert return ret;
11989b42c1f1SSteffen Klassert }
11999b42c1f1SSteffen Klassert
120068325d3bSHerbert Xu /* Don't change this without updating xfrm_sa_len! */
copy_to_user_state_extra(struct xfrm_state * x,struct xfrm_usersa_info * p,struct sk_buff * skb)120168325d3bSHerbert Xu static int copy_to_user_state_extra(struct xfrm_state *x,
120268325d3bSHerbert Xu struct xfrm_usersa_info *p,
120368325d3bSHerbert Xu struct sk_buff *skb)
12041da177e4SLinus Torvalds {
12051d1e34ddSDavid S. Miller int ret = 0;
12061d1e34ddSDavid S. Miller
12071da177e4SLinus Torvalds copy_to_user_state(x, p);
12081da177e4SLinus Torvalds
1209a947b0a9SNicolas Dichtel if (x->props.extra_flags) {
1210a947b0a9SNicolas Dichtel ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS,
1211a947b0a9SNicolas Dichtel x->props.extra_flags);
1212a947b0a9SNicolas Dichtel if (ret)
1213a947b0a9SNicolas Dichtel goto out;
1214a947b0a9SNicolas Dichtel }
1215a947b0a9SNicolas Dichtel
12161d1e34ddSDavid S. Miller if (x->coaddr) {
12171d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
12181d1e34ddSDavid S. Miller if (ret)
12191d1e34ddSDavid S. Miller goto out;
12201d1e34ddSDavid S. Miller }
12211d1e34ddSDavid S. Miller if (x->lastused) {
1222de95c4a4SNicolas Dichtel ret = nla_put_u64_64bit(skb, XFRMA_LASTUSED, x->lastused,
1223de95c4a4SNicolas Dichtel XFRMA_PAD);
12241d1e34ddSDavid S. Miller if (ret)
12251d1e34ddSDavid S. Miller goto out;
12261d1e34ddSDavid S. Miller }
12271d1e34ddSDavid S. Miller if (x->aead) {
1228c7a5899eSAntony Antony ret = copy_to_user_aead(x->aead, skb);
12291d1e34ddSDavid S. Miller if (ret)
12301d1e34ddSDavid S. Miller goto out;
12311d1e34ddSDavid S. Miller }
12321d1e34ddSDavid S. Miller if (x->aalg) {
12331d1e34ddSDavid S. Miller ret = copy_to_user_auth(x->aalg, skb);
12341d1e34ddSDavid S. Miller if (ret)
12351d1e34ddSDavid S. Miller goto out;
12361d1e34ddSDavid S. Miller }
12371d1e34ddSDavid S. Miller if (x->ealg) {
1238c7a5899eSAntony Antony ret = copy_to_user_ealg(x->ealg, skb);
12391d1e34ddSDavid S. Miller if (ret)
12401d1e34ddSDavid S. Miller goto out;
12411d1e34ddSDavid S. Miller }
12421d1e34ddSDavid S. Miller if (x->calg) {
12438222d591SHerbert Xu ret = copy_to_user_calg(x->calg, skb);
12441d1e34ddSDavid S. Miller if (ret)
12451d1e34ddSDavid S. Miller goto out;
12461d1e34ddSDavid S. Miller }
12471d1e34ddSDavid S. Miller if (x->encap) {
12488222d591SHerbert Xu ret = copy_to_user_encap(x->encap, skb);
12491d1e34ddSDavid S. Miller if (ret)
12501d1e34ddSDavid S. Miller goto out;
12511d1e34ddSDavid S. Miller }
12521d1e34ddSDavid S. Miller if (x->tfcpad) {
12531d1e34ddSDavid S. Miller ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad);
12541d1e34ddSDavid S. Miller if (ret)
12551d1e34ddSDavid S. Miller goto out;
12561d1e34ddSDavid S. Miller }
12571d1e34ddSDavid S. Miller ret = xfrm_mark_put(skb, &x->mark);
12581d1e34ddSDavid S. Miller if (ret)
12591d1e34ddSDavid S. Miller goto out;
12609b42c1f1SSteffen Klassert
12619b42c1f1SSteffen Klassert ret = xfrm_smark_put(skb, &x->props.smark);
12629b42c1f1SSteffen Klassert if (ret)
12639b42c1f1SSteffen Klassert goto out;
12649b42c1f1SSteffen Klassert
1265f293a5e3Sdingzhi if (x->replay_esn)
12661d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
1267d0fde795SDavid S. Miller xfrm_replay_state_esn_len(x->replay_esn),
12681d1e34ddSDavid S. Miller x->replay_esn);
1269f293a5e3Sdingzhi else
1270f293a5e3Sdingzhi ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
1271f293a5e3Sdingzhi &x->replay);
12721d1e34ddSDavid S. Miller if (ret)
12731d1e34ddSDavid S. Miller goto out;
1274d77e38e6SSteffen Klassert if(x->xso.dev)
1275d77e38e6SSteffen Klassert ret = copy_user_offload(&x->xso, skb);
1276d77e38e6SSteffen Klassert if (ret)
1277d77e38e6SSteffen Klassert goto out;
12787e652640SSteffen Klassert if (x->if_id) {
12797e652640SSteffen Klassert ret = nla_put_u32(skb, XFRMA_IF_ID, x->if_id);
1280077fbac4SLorenzo Colitti if (ret)
1281077fbac4SLorenzo Colitti goto out;
1282077fbac4SLorenzo Colitti }
12834e484b3eSAntony Antony if (x->security) {
12848598112dSSteffen Klassert ret = copy_sec_ctx(x->security, skb);
12854e484b3eSAntony Antony if (ret)
12864e484b3eSAntony Antony goto out;
12874e484b3eSAntony Antony }
1288a4a87fa4SAntony Antony if (x->mapping_maxage) {
12894e484b3eSAntony Antony ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH, x->mapping_maxage);
1290a4a87fa4SAntony Antony if (ret)
1291a4a87fa4SAntony Antony goto out;
1292a4a87fa4SAntony Antony }
1293a4a87fa4SAntony Antony if (x->dir)
1294a4a87fa4SAntony Antony ret = nla_put_u8(skb, XFRMA_SA_DIR, x->dir);
1295*f531d13bSEyal Birger
1296*f531d13bSEyal Birger if (x->nat_keepalive_interval) {
1297*f531d13bSEyal Birger ret = nla_put_u32(skb, XFRMA_NAT_KEEPALIVE_INTERVAL,
1298*f531d13bSEyal Birger x->nat_keepalive_interval);
1299*f531d13bSEyal Birger if (ret)
1300*f531d13bSEyal Birger goto out;
1301*f531d13bSEyal Birger }
13021d1e34ddSDavid S. Miller out:
13031d1e34ddSDavid S. Miller return ret;
130468325d3bSHerbert Xu }
130568325d3bSHerbert Xu
dump_one_state(struct xfrm_state * x,int count,void * ptr)130668325d3bSHerbert Xu static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
130768325d3bSHerbert Xu {
130868325d3bSHerbert Xu struct xfrm_dump_info *sp = ptr;
130968325d3bSHerbert Xu struct sk_buff *in_skb = sp->in_skb;
131068325d3bSHerbert Xu struct sk_buff *skb = sp->out_skb;
13115f3eea6bSDmitry Safonov struct xfrm_translator *xtr;
131268325d3bSHerbert Xu struct xfrm_usersa_info *p;
131368325d3bSHerbert Xu struct nlmsghdr *nlh;
131468325d3bSHerbert Xu int err;
131568325d3bSHerbert Xu
131615e47304SEric W. Biederman nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
131768325d3bSHerbert Xu XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
131868325d3bSHerbert Xu if (nlh == NULL)
131968325d3bSHerbert Xu return -EMSGSIZE;
132068325d3bSHerbert Xu
132168325d3bSHerbert Xu p = nlmsg_data(nlh);
132268325d3bSHerbert Xu
132368325d3bSHerbert Xu err = copy_to_user_state_extra(x, p, skb);
13241d1e34ddSDavid S. Miller if (err) {
13259825069dSThomas Graf nlmsg_cancel(skb, nlh);
132668325d3bSHerbert Xu return err;
13271da177e4SLinus Torvalds }
13281d1e34ddSDavid S. Miller nlmsg_end(skb, nlh);
13295f3eea6bSDmitry Safonov
13305f3eea6bSDmitry Safonov xtr = xfrm_get_translator();
13315f3eea6bSDmitry Safonov if (xtr) {
13325f3eea6bSDmitry Safonov err = xtr->alloc_compat(skb, nlh);
13335f3eea6bSDmitry Safonov
13345f3eea6bSDmitry Safonov xfrm_put_translator(xtr);
13355f3eea6bSDmitry Safonov if (err) {
13365f3eea6bSDmitry Safonov nlmsg_cancel(skb, nlh);
13375f3eea6bSDmitry Safonov return err;
13385f3eea6bSDmitry Safonov }
13395f3eea6bSDmitry Safonov }
13405f3eea6bSDmitry Safonov
13411d1e34ddSDavid S. Miller return 0;
13421d1e34ddSDavid S. Miller }
13431da177e4SLinus Torvalds
xfrm_dump_sa_done(struct netlink_callback * cb)13444c563f76STimo Teras static int xfrm_dump_sa_done(struct netlink_callback *cb)
13454c563f76STimo Teras {
13464c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
1347283bc9f3SFan Du struct sock *sk = cb->skb->sk;
1348283bc9f3SFan Du struct net *net = sock_net(sk);
1349283bc9f3SFan Du
13501ba5bf99SVegard Nossum if (cb->args[0])
1351283bc9f3SFan Du xfrm_state_walk_done(walk, net);
13524c563f76STimo Teras return 0;
13534c563f76STimo Teras }
13544c563f76STimo Teras
xfrm_dump_sa(struct sk_buff * skb,struct netlink_callback * cb)13551da177e4SLinus Torvalds static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
13561da177e4SLinus Torvalds {
1357fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
13584c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
13591da177e4SLinus Torvalds struct xfrm_dump_info info;
13601da177e4SLinus Torvalds
13614c563f76STimo Teras BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
13624c563f76STimo Teras sizeof(cb->args) - sizeof(cb->args[0]));
13634c563f76STimo Teras
13641da177e4SLinus Torvalds info.in_skb = cb->skb;
13651da177e4SLinus Torvalds info.out_skb = skb;
13661da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq;
13671da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI;
13684c563f76STimo Teras
13694c563f76STimo Teras if (!cb->args[0]) {
1370d3623099SNicolas Dichtel struct nlattr *attrs[XFRMA_MAX+1];
1371870a2df4SNicolas Dichtel struct xfrm_address_filter *filter = NULL;
1372d3623099SNicolas Dichtel u8 proto = 0;
1373d3623099SNicolas Dichtel int err;
1374d3623099SNicolas Dichtel
13758cb08174SJohannes Berg err = nlmsg_parse_deprecated(cb->nlh, 0, attrs, XFRMA_MAX,
13768cb08174SJohannes Berg xfrma_policy, cb->extack);
1377d3623099SNicolas Dichtel if (err < 0)
1378d3623099SNicolas Dichtel return err;
1379d3623099SNicolas Dichtel
1380870a2df4SNicolas Dichtel if (attrs[XFRMA_ADDRESS_FILTER]) {
1381df367561SAndrzej Hajda filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
1382df367561SAndrzej Hajda sizeof(*filter), GFP_KERNEL);
1383d3623099SNicolas Dichtel if (filter == NULL)
1384d3623099SNicolas Dichtel return -ENOMEM;
1385dfa73c17SLin Ma
1386dfa73c17SLin Ma /* see addr_match(), (prefix length >> 5) << 2
1387dfa73c17SLin Ma * will be used to compare xfrm_address_t
1388dfa73c17SLin Ma */
1389dfa73c17SLin Ma if (filter->splen > (sizeof(xfrm_address_t) << 3) ||
1390dfa73c17SLin Ma filter->dplen > (sizeof(xfrm_address_t) << 3)) {
1391dfa73c17SLin Ma kfree(filter);
1392dfa73c17SLin Ma return -EINVAL;
1393dfa73c17SLin Ma }
1394d3623099SNicolas Dichtel }
1395d3623099SNicolas Dichtel
1396d3623099SNicolas Dichtel if (attrs[XFRMA_PROTO])
1397d3623099SNicolas Dichtel proto = nla_get_u8(attrs[XFRMA_PROTO]);
1398d3623099SNicolas Dichtel
1399d3623099SNicolas Dichtel xfrm_state_walk_init(walk, proto, filter);
14001ba5bf99SVegard Nossum cb->args[0] = 1;
14014c563f76STimo Teras }
14024c563f76STimo Teras
1403fc34acd3SAlexey Dobriyan (void) xfrm_state_walk(net, walk, dump_one_state, &info);
14041da177e4SLinus Torvalds
14051da177e4SLinus Torvalds return skb->len;
14061da177e4SLinus Torvalds }
14071da177e4SLinus Torvalds
xfrm_state_netlink(struct sk_buff * in_skb,struct xfrm_state * x,u32 seq)14081da177e4SLinus Torvalds static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
14091da177e4SLinus Torvalds struct xfrm_state *x, u32 seq)
14101da177e4SLinus Torvalds {
14111da177e4SLinus Torvalds struct xfrm_dump_info info;
14121da177e4SLinus Torvalds struct sk_buff *skb;
1413864745d2SMathias Krause int err;
14141da177e4SLinus Torvalds
14157deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14161da177e4SLinus Torvalds if (!skb)
14171da177e4SLinus Torvalds return ERR_PTR(-ENOMEM);
14181da177e4SLinus Torvalds
14191da177e4SLinus Torvalds info.in_skb = in_skb;
14201da177e4SLinus Torvalds info.out_skb = skb;
14211da177e4SLinus Torvalds info.nlmsg_seq = seq;
14221da177e4SLinus Torvalds info.nlmsg_flags = 0;
14231da177e4SLinus Torvalds
1424864745d2SMathias Krause err = dump_one_state(x, 0, &info);
1425864745d2SMathias Krause if (err) {
14261da177e4SLinus Torvalds kfree_skb(skb);
1427864745d2SMathias Krause return ERR_PTR(err);
14281da177e4SLinus Torvalds }
14291da177e4SLinus Torvalds
14301da177e4SLinus Torvalds return skb;
14311da177e4SLinus Torvalds }
14321da177e4SLinus Torvalds
143321ee543eSMichal Kubecek /* A wrapper for nlmsg_multicast() checking that nlsk is still available.
143421ee543eSMichal Kubecek * Must be called with RCU read lock.
143521ee543eSMichal Kubecek */
xfrm_nlmsg_multicast(struct net * net,struct sk_buff * skb,u32 pid,unsigned int group)143621ee543eSMichal Kubecek static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
143721ee543eSMichal Kubecek u32 pid, unsigned int group)
143821ee543eSMichal Kubecek {
143921ee543eSMichal Kubecek struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
14405461fc0cSDmitry Safonov struct xfrm_translator *xtr;
144121ee543eSMichal Kubecek
144286126b77SFlorian Westphal if (!nlsk) {
144386126b77SFlorian Westphal kfree_skb(skb);
144486126b77SFlorian Westphal return -EPIPE;
144586126b77SFlorian Westphal }
144686126b77SFlorian Westphal
14475461fc0cSDmitry Safonov xtr = xfrm_get_translator();
14485461fc0cSDmitry Safonov if (xtr) {
14495461fc0cSDmitry Safonov int err = xtr->alloc_compat(skb, nlmsg_hdr(skb));
14505461fc0cSDmitry Safonov
14515461fc0cSDmitry Safonov xfrm_put_translator(xtr);
14525461fc0cSDmitry Safonov if (err) {
14535461fc0cSDmitry Safonov kfree_skb(skb);
14545461fc0cSDmitry Safonov return err;
14555461fc0cSDmitry Safonov }
14565461fc0cSDmitry Safonov }
14575461fc0cSDmitry Safonov
145821ee543eSMichal Kubecek return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
145921ee543eSMichal Kubecek }
146021ee543eSMichal Kubecek
xfrm_spdinfo_msgsize(void)1461a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_spdinfo_msgsize(void)
14627deb2264SThomas Graf {
14637deb2264SThomas Graf return NLMSG_ALIGN(4)
14647deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_spdinfo))
1465880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhinfo))
1466880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhthresh))
1467880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhthresh));
14687deb2264SThomas Graf }
14697deb2264SThomas Graf
build_spdinfo(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,u32 flags)1470e071041bSAlexey Dobriyan static int build_spdinfo(struct sk_buff *skb, struct net *net,
147115e47304SEric W. Biederman u32 portid, u32 seq, u32 flags)
1472ecfd6b18SJamal Hadi Salim {
14735a6d3416SJamal Hadi Salim struct xfrmk_spdinfo si;
14745a6d3416SJamal Hadi Salim struct xfrmu_spdinfo spc;
14755a6d3416SJamal Hadi Salim struct xfrmu_spdhinfo sph;
1476880a6fabSChristophe Gouault struct xfrmu_spdhthresh spt4, spt6;
1477ecfd6b18SJamal Hadi Salim struct nlmsghdr *nlh;
14781d1e34ddSDavid S. Miller int err;
1479ecfd6b18SJamal Hadi Salim u32 *f;
1480880a6fabSChristophe Gouault unsigned lseq;
1481ecfd6b18SJamal Hadi Salim
148215e47304SEric W. Biederman nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
148325985edcSLucas De Marchi if (nlh == NULL) /* shouldn't really happen ... */
1484ecfd6b18SJamal Hadi Salim return -EMSGSIZE;
1485ecfd6b18SJamal Hadi Salim
1486ecfd6b18SJamal Hadi Salim f = nlmsg_data(nlh);
1487ecfd6b18SJamal Hadi Salim *f = flags;
1488e071041bSAlexey Dobriyan xfrm_spd_getinfo(net, &si);
14895a6d3416SJamal Hadi Salim spc.incnt = si.incnt;
14905a6d3416SJamal Hadi Salim spc.outcnt = si.outcnt;
14915a6d3416SJamal Hadi Salim spc.fwdcnt = si.fwdcnt;
14925a6d3416SJamal Hadi Salim spc.inscnt = si.inscnt;
14935a6d3416SJamal Hadi Salim spc.outscnt = si.outscnt;
14945a6d3416SJamal Hadi Salim spc.fwdscnt = si.fwdscnt;
14955a6d3416SJamal Hadi Salim sph.spdhcnt = si.spdhcnt;
14965a6d3416SJamal Hadi Salim sph.spdhmcnt = si.spdhmcnt;
1497ecfd6b18SJamal Hadi Salim
1498880a6fabSChristophe Gouault do {
1499880a6fabSChristophe Gouault lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock);
1500880a6fabSChristophe Gouault
1501880a6fabSChristophe Gouault spt4.lbits = net->xfrm.policy_hthresh.lbits4;
1502880a6fabSChristophe Gouault spt4.rbits = net->xfrm.policy_hthresh.rbits4;
1503880a6fabSChristophe Gouault spt6.lbits = net->xfrm.policy_hthresh.lbits6;
1504880a6fabSChristophe Gouault spt6.rbits = net->xfrm.policy_hthresh.rbits6;
1505880a6fabSChristophe Gouault } while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq));
1506880a6fabSChristophe Gouault
15071d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
15081d1e34ddSDavid S. Miller if (!err)
15091d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
1510880a6fabSChristophe Gouault if (!err)
1511880a6fabSChristophe Gouault err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4);
1512880a6fabSChristophe Gouault if (!err)
1513880a6fabSChristophe Gouault err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6);
15141d1e34ddSDavid S. Miller if (err) {
15151d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh);
15161d1e34ddSDavid S. Miller return err;
15171d1e34ddSDavid S. Miller }
1518ecfd6b18SJamal Hadi Salim
1519053c095aSJohannes Berg nlmsg_end(skb, nlh);
1520053c095aSJohannes Berg return 0;
1521ecfd6b18SJamal Hadi Salim }
1522ecfd6b18SJamal Hadi Salim
xfrm_set_spdinfo(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)1523880a6fabSChristophe Gouault static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
15243bec6c3eSSabrina Dubroca struct nlattr **attrs,
15253bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
1526880a6fabSChristophe Gouault {
1527880a6fabSChristophe Gouault struct net *net = sock_net(skb->sk);
1528880a6fabSChristophe Gouault struct xfrmu_spdhthresh *thresh4 = NULL;
1529880a6fabSChristophe Gouault struct xfrmu_spdhthresh *thresh6 = NULL;
1530880a6fabSChristophe Gouault
1531880a6fabSChristophe Gouault /* selector prefixlen thresholds to hash policies */
1532880a6fabSChristophe Gouault if (attrs[XFRMA_SPD_IPV4_HTHRESH]) {
1533880a6fabSChristophe Gouault struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH];
1534880a6fabSChristophe Gouault
1535a7417216SSabrina Dubroca if (nla_len(rta) < sizeof(*thresh4)) {
1536a7417216SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid SPD_IPV4_HTHRESH attribute length");
1537880a6fabSChristophe Gouault return -EINVAL;
1538a7417216SSabrina Dubroca }
1539880a6fabSChristophe Gouault thresh4 = nla_data(rta);
1540a7417216SSabrina Dubroca if (thresh4->lbits > 32 || thresh4->rbits > 32) {
1541a7417216SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid hash threshold (must be <= 32 for IPv4)");
1542880a6fabSChristophe Gouault return -EINVAL;
1543880a6fabSChristophe Gouault }
1544a7417216SSabrina Dubroca }
1545880a6fabSChristophe Gouault if (attrs[XFRMA_SPD_IPV6_HTHRESH]) {
1546880a6fabSChristophe Gouault struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH];
1547880a6fabSChristophe Gouault
1548a7417216SSabrina Dubroca if (nla_len(rta) < sizeof(*thresh6)) {
1549a7417216SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid SPD_IPV6_HTHRESH attribute length");
1550880a6fabSChristophe Gouault return -EINVAL;
1551a7417216SSabrina Dubroca }
1552880a6fabSChristophe Gouault thresh6 = nla_data(rta);
1553a7417216SSabrina Dubroca if (thresh6->lbits > 128 || thresh6->rbits > 128) {
1554a7417216SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid hash threshold (must be <= 128 for IPv6)");
1555880a6fabSChristophe Gouault return -EINVAL;
1556880a6fabSChristophe Gouault }
1557a7417216SSabrina Dubroca }
1558880a6fabSChristophe Gouault
1559880a6fabSChristophe Gouault if (thresh4 || thresh6) {
1560880a6fabSChristophe Gouault write_seqlock(&net->xfrm.policy_hthresh.lock);
1561880a6fabSChristophe Gouault if (thresh4) {
1562880a6fabSChristophe Gouault net->xfrm.policy_hthresh.lbits4 = thresh4->lbits;
1563880a6fabSChristophe Gouault net->xfrm.policy_hthresh.rbits4 = thresh4->rbits;
1564880a6fabSChristophe Gouault }
1565880a6fabSChristophe Gouault if (thresh6) {
1566880a6fabSChristophe Gouault net->xfrm.policy_hthresh.lbits6 = thresh6->lbits;
1567880a6fabSChristophe Gouault net->xfrm.policy_hthresh.rbits6 = thresh6->rbits;
1568880a6fabSChristophe Gouault }
1569880a6fabSChristophe Gouault write_sequnlock(&net->xfrm.policy_hthresh.lock);
1570880a6fabSChristophe Gouault
1571880a6fabSChristophe Gouault xfrm_policy_hash_rebuild(net);
1572880a6fabSChristophe Gouault }
1573880a6fabSChristophe Gouault
1574880a6fabSChristophe Gouault return 0;
1575880a6fabSChristophe Gouault }
1576880a6fabSChristophe Gouault
xfrm_get_spdinfo(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)1577ecfd6b18SJamal Hadi Salim static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
15783bec6c3eSSabrina Dubroca struct nlattr **attrs,
15793bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
1580ecfd6b18SJamal Hadi Salim {
1581a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk);
1582ecfd6b18SJamal Hadi Salim struct sk_buff *r_skb;
15837b67c857SThomas Graf u32 *flags = nlmsg_data(nlh);
158415e47304SEric W. Biederman u32 sportid = NETLINK_CB(skb).portid;
1585ecfd6b18SJamal Hadi Salim u32 seq = nlh->nlmsg_seq;
15862fc5f83bSGustavo A. R. Silva int err;
1587ecfd6b18SJamal Hadi Salim
15887deb2264SThomas Graf r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
1589ecfd6b18SJamal Hadi Salim if (r_skb == NULL)
1590ecfd6b18SJamal Hadi Salim return -ENOMEM;
1591ecfd6b18SJamal Hadi Salim
15922fc5f83bSGustavo A. R. Silva err = build_spdinfo(r_skb, net, sportid, seq, *flags);
15932fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
1594ecfd6b18SJamal Hadi Salim
159515e47304SEric W. Biederman return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
1596ecfd6b18SJamal Hadi Salim }
1597ecfd6b18SJamal Hadi Salim
xfrm_sadinfo_msgsize(void)1598a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_sadinfo_msgsize(void)
15997deb2264SThomas Graf {
16007deb2264SThomas Graf return NLMSG_ALIGN(4)
16017deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_sadhinfo))
16027deb2264SThomas Graf + nla_total_size(4); /* XFRMA_SAD_CNT */
16037deb2264SThomas Graf }
16047deb2264SThomas Graf
build_sadinfo(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,u32 flags)1605e071041bSAlexey Dobriyan static int build_sadinfo(struct sk_buff *skb, struct net *net,
160615e47304SEric W. Biederman u32 portid, u32 seq, u32 flags)
160728d8909bSJamal Hadi Salim {
1608af11e316SJamal Hadi Salim struct xfrmk_sadinfo si;
1609af11e316SJamal Hadi Salim struct xfrmu_sadhinfo sh;
161028d8909bSJamal Hadi Salim struct nlmsghdr *nlh;
16111d1e34ddSDavid S. Miller int err;
161228d8909bSJamal Hadi Salim u32 *f;
161328d8909bSJamal Hadi Salim
161415e47304SEric W. Biederman nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
161525985edcSLucas De Marchi if (nlh == NULL) /* shouldn't really happen ... */
161628d8909bSJamal Hadi Salim return -EMSGSIZE;
161728d8909bSJamal Hadi Salim
161828d8909bSJamal Hadi Salim f = nlmsg_data(nlh);
161928d8909bSJamal Hadi Salim *f = flags;
1620e071041bSAlexey Dobriyan xfrm_sad_getinfo(net, &si);
162128d8909bSJamal Hadi Salim
1622af11e316SJamal Hadi Salim sh.sadhmcnt = si.sadhmcnt;
1623af11e316SJamal Hadi Salim sh.sadhcnt = si.sadhcnt;
1624af11e316SJamal Hadi Salim
16251d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt);
16261d1e34ddSDavid S. Miller if (!err)
16271d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
16281d1e34ddSDavid S. Miller if (err) {
16291d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh);
16301d1e34ddSDavid S. Miller return err;
16311d1e34ddSDavid S. Miller }
163228d8909bSJamal Hadi Salim
1633053c095aSJohannes Berg nlmsg_end(skb, nlh);
1634053c095aSJohannes Berg return 0;
163528d8909bSJamal Hadi Salim }
163628d8909bSJamal Hadi Salim
xfrm_get_sadinfo(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)163728d8909bSJamal Hadi Salim static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
16383bec6c3eSSabrina Dubroca struct nlattr **attrs,
16393bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
164028d8909bSJamal Hadi Salim {
1641a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk);
164228d8909bSJamal Hadi Salim struct sk_buff *r_skb;
16437b67c857SThomas Graf u32 *flags = nlmsg_data(nlh);
164415e47304SEric W. Biederman u32 sportid = NETLINK_CB(skb).portid;
164528d8909bSJamal Hadi Salim u32 seq = nlh->nlmsg_seq;
16462fc5f83bSGustavo A. R. Silva int err;
164728d8909bSJamal Hadi Salim
16487deb2264SThomas Graf r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
164928d8909bSJamal Hadi Salim if (r_skb == NULL)
165028d8909bSJamal Hadi Salim return -ENOMEM;
165128d8909bSJamal Hadi Salim
16522fc5f83bSGustavo A. R. Silva err = build_sadinfo(r_skb, net, sportid, seq, *flags);
16532fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
165428d8909bSJamal Hadi Salim
165515e47304SEric W. Biederman return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
165628d8909bSJamal Hadi Salim }
165728d8909bSJamal Hadi Salim
xfrm_get_sa(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)165822e70050SChristoph Hellwig static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
16593bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
16601da177e4SLinus Torvalds {
1661fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
16627b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh);
16631da177e4SLinus Torvalds struct xfrm_state *x;
16641da177e4SLinus Torvalds struct sk_buff *resp_skb;
1665eb2971b6SMasahide NAKAMURA int err = -ESRCH;
16661da177e4SLinus Torvalds
1667fc34acd3SAlexey Dobriyan x = xfrm_user_state_lookup(net, p, attrs, &err);
16681da177e4SLinus Torvalds if (x == NULL)
16691da177e4SLinus Torvalds goto out_noput;
16701da177e4SLinus Torvalds
16711da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
16721da177e4SLinus Torvalds if (IS_ERR(resp_skb)) {
16731da177e4SLinus Torvalds err = PTR_ERR(resp_skb);
16741da177e4SLinus Torvalds } else {
167515e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
16761da177e4SLinus Torvalds }
16771da177e4SLinus Torvalds xfrm_state_put(x);
16781da177e4SLinus Torvalds out_noput:
16791da177e4SLinus Torvalds return err;
16801da177e4SLinus Torvalds }
16811da177e4SLinus Torvalds
xfrm_alloc_userspi(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)168222e70050SChristoph Hellwig static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
16833bec6c3eSSabrina Dubroca struct nlattr **attrs,
16843bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
16851da177e4SLinus Torvalds {
1686fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
16871da177e4SLinus Torvalds struct xfrm_state *x;
16881da177e4SLinus Torvalds struct xfrm_userspi_info *p;
16895f3eea6bSDmitry Safonov struct xfrm_translator *xtr;
16901da177e4SLinus Torvalds struct sk_buff *resp_skb;
16911da177e4SLinus Torvalds xfrm_address_t *daddr;
16921da177e4SLinus Torvalds int family;
16931da177e4SLinus Torvalds int err;
16946f26b61eSJamal Hadi Salim u32 mark;
16956f26b61eSJamal Hadi Salim struct xfrm_mark m;
16967e652640SSteffen Klassert u32 if_id = 0;
16971da177e4SLinus Torvalds
16987b67c857SThomas Graf p = nlmsg_data(nlh);
1699c2dad11eSSabrina Dubroca err = verify_spi_info(p->info.id.proto, p->min, p->max, extack);
17001da177e4SLinus Torvalds if (err)
17011da177e4SLinus Torvalds goto out_noput;
17021da177e4SLinus Torvalds
17031da177e4SLinus Torvalds family = p->info.family;
17041da177e4SLinus Torvalds daddr = &p->info.id.daddr;
17051da177e4SLinus Torvalds
17061da177e4SLinus Torvalds x = NULL;
17076f26b61eSJamal Hadi Salim
17086f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m);
17097e652640SSteffen Klassert
1710a3d9001bSKai Lueke if (attrs[XFRMA_IF_ID])
17117e652640SSteffen Klassert if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
17127e652640SSteffen Klassert
17131da177e4SLinus Torvalds if (p->info.seq) {
17146f26b61eSJamal Hadi Salim x = xfrm_find_acq_byseq(net, mark, p->info.seq);
171570e94e66SYOSHIFUJI Hideaki / 吉藤英明 if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) {
17161da177e4SLinus Torvalds xfrm_state_put(x);
17171da177e4SLinus Torvalds x = NULL;
17181da177e4SLinus Torvalds }
17191da177e4SLinus Torvalds }
17201da177e4SLinus Torvalds
17211da177e4SLinus Torvalds if (!x)
17226f26b61eSJamal Hadi Salim x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
17237e652640SSteffen Klassert if_id, p->info.id.proto, daddr,
17241da177e4SLinus Torvalds &p->info.saddr, 1,
17251da177e4SLinus Torvalds family);
17261da177e4SLinus Torvalds err = -ENOENT;
1727c2dad11eSSabrina Dubroca if (!x) {
1728c2dad11eSSabrina Dubroca NL_SET_ERR_MSG(extack, "Target ACQUIRE not found");
17291da177e4SLinus Torvalds goto out_noput;
1730c2dad11eSSabrina Dubroca }
17311da177e4SLinus Torvalds
1732c2dad11eSSabrina Dubroca err = xfrm_alloc_spi(x, p->min, p->max, extack);
1733658b219eSHerbert Xu if (err)
1734658b219eSHerbert Xu goto out;
17351da177e4SLinus Torvalds
1736a4a87fa4SAntony Antony if (attrs[XFRMA_SA_DIR])
1737a4a87fa4SAntony Antony x->dir = nla_get_u8(attrs[XFRMA_SA_DIR]);
1738a4a87fa4SAntony Antony
17391da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
17401da177e4SLinus Torvalds if (IS_ERR(resp_skb)) {
17411da177e4SLinus Torvalds err = PTR_ERR(resp_skb);
17421da177e4SLinus Torvalds goto out;
17431da177e4SLinus Torvalds }
17441da177e4SLinus Torvalds
17455f3eea6bSDmitry Safonov xtr = xfrm_get_translator();
17465f3eea6bSDmitry Safonov if (xtr) {
17475f3eea6bSDmitry Safonov err = xtr->alloc_compat(skb, nlmsg_hdr(skb));
17485f3eea6bSDmitry Safonov
17495f3eea6bSDmitry Safonov xfrm_put_translator(xtr);
17505f3eea6bSDmitry Safonov if (err) {
17515f3eea6bSDmitry Safonov kfree_skb(resp_skb);
17525f3eea6bSDmitry Safonov goto out;
17535f3eea6bSDmitry Safonov }
17545f3eea6bSDmitry Safonov }
17555f3eea6bSDmitry Safonov
175615e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
17571da177e4SLinus Torvalds
17581da177e4SLinus Torvalds out:
17591da177e4SLinus Torvalds xfrm_state_put(x);
17601da177e4SLinus Torvalds out_noput:
17611da177e4SLinus Torvalds return err;
17621da177e4SLinus Torvalds }
17631da177e4SLinus Torvalds
verify_policy_dir(u8 dir,struct netlink_ext_ack * extack)176424fc544fSSabrina Dubroca static int verify_policy_dir(u8 dir, struct netlink_ext_ack *extack)
17651da177e4SLinus Torvalds {
17661da177e4SLinus Torvalds switch (dir) {
17671da177e4SLinus Torvalds case XFRM_POLICY_IN:
17681da177e4SLinus Torvalds case XFRM_POLICY_OUT:
17691da177e4SLinus Torvalds case XFRM_POLICY_FWD:
17701da177e4SLinus Torvalds break;
17711da177e4SLinus Torvalds
17721da177e4SLinus Torvalds default:
177324fc544fSSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid policy direction");
17741da177e4SLinus Torvalds return -EINVAL;
17753ff50b79SStephen Hemminger }
17761da177e4SLinus Torvalds
17771da177e4SLinus Torvalds return 0;
17781da177e4SLinus Torvalds }
17791da177e4SLinus Torvalds
verify_policy_type(u8 type,struct netlink_ext_ack * extack)1780fb7deabaSSabrina Dubroca static int verify_policy_type(u8 type, struct netlink_ext_ack *extack)
1781f7b6983fSMasahide NAKAMURA {
1782f7b6983fSMasahide NAKAMURA switch (type) {
1783f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_MAIN:
1784f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY
1785f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_SUB:
1786f7b6983fSMasahide NAKAMURA #endif
1787f7b6983fSMasahide NAKAMURA break;
1788f7b6983fSMasahide NAKAMURA
1789f7b6983fSMasahide NAKAMURA default:
1790fb7deabaSSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid policy type");
1791f7b6983fSMasahide NAKAMURA return -EINVAL;
17923ff50b79SStephen Hemminger }
1793f7b6983fSMasahide NAKAMURA
1794f7b6983fSMasahide NAKAMURA return 0;
1795f7b6983fSMasahide NAKAMURA }
1796f7b6983fSMasahide NAKAMURA
verify_newpolicy_info(struct xfrm_userpolicy_info * p,struct netlink_ext_ack * extack)1797ec2b4f01SSabrina Dubroca static int verify_newpolicy_info(struct xfrm_userpolicy_info *p,
1798ec2b4f01SSabrina Dubroca struct netlink_ext_ack *extack)
17991da177e4SLinus Torvalds {
1800e682adf0SFan Du int ret;
1801e682adf0SFan Du
18021da177e4SLinus Torvalds switch (p->share) {
18031da177e4SLinus Torvalds case XFRM_SHARE_ANY:
18041da177e4SLinus Torvalds case XFRM_SHARE_SESSION:
18051da177e4SLinus Torvalds case XFRM_SHARE_USER:
18061da177e4SLinus Torvalds case XFRM_SHARE_UNIQUE:
18071da177e4SLinus Torvalds break;
18081da177e4SLinus Torvalds
18091da177e4SLinus Torvalds default:
1810ec2b4f01SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid policy share");
18111da177e4SLinus Torvalds return -EINVAL;
18123ff50b79SStephen Hemminger }
18131da177e4SLinus Torvalds
18141da177e4SLinus Torvalds switch (p->action) {
18151da177e4SLinus Torvalds case XFRM_POLICY_ALLOW:
18161da177e4SLinus Torvalds case XFRM_POLICY_BLOCK:
18171da177e4SLinus Torvalds break;
18181da177e4SLinus Torvalds
18191da177e4SLinus Torvalds default:
1820ec2b4f01SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid policy action");
18211da177e4SLinus Torvalds return -EINVAL;
18223ff50b79SStephen Hemminger }
18231da177e4SLinus Torvalds
18241da177e4SLinus Torvalds switch (p->sel.family) {
18251da177e4SLinus Torvalds case AF_INET:
1826ec2b4f01SSabrina Dubroca if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) {
1827ec2b4f01SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 32 for IPv4)");
182807bf7908SSteffen Klassert return -EINVAL;
1829ec2b4f01SSabrina Dubroca }
183007bf7908SSteffen Klassert
18311da177e4SLinus Torvalds break;
18321da177e4SLinus Torvalds
18331da177e4SLinus Torvalds case AF_INET6:
1834dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6)
1835ec2b4f01SSabrina Dubroca if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) {
1836ec2b4f01SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 128 for IPv6)");
183707bf7908SSteffen Klassert return -EINVAL;
1838ec2b4f01SSabrina Dubroca }
183907bf7908SSteffen Klassert
18401da177e4SLinus Torvalds break;
18411da177e4SLinus Torvalds #else
1842ec2b4f01SSabrina Dubroca NL_SET_ERR_MSG(extack, "IPv6 support disabled");
18431da177e4SLinus Torvalds return -EAFNOSUPPORT;
18441da177e4SLinus Torvalds #endif
18451da177e4SLinus Torvalds
18461da177e4SLinus Torvalds default:
1847ec2b4f01SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid selector family");
18481da177e4SLinus Torvalds return -EINVAL;
18493ff50b79SStephen Hemminger }
18501da177e4SLinus Torvalds
185124fc544fSSabrina Dubroca ret = verify_policy_dir(p->dir, extack);
1852e682adf0SFan Du if (ret)
1853e682adf0SFan Du return ret;
1854ec2b4f01SSabrina Dubroca if (p->index && (xfrm_policy_id2dir(p->index) != p->dir)) {
1855ec2b4f01SSabrina Dubroca NL_SET_ERR_MSG(extack, "Policy index doesn't match direction");
1856e682adf0SFan Du return -EINVAL;
1857ec2b4f01SSabrina Dubroca }
1858e682adf0SFan Du
1859e682adf0SFan Du return 0;
18601da177e4SLinus Torvalds }
18611da177e4SLinus Torvalds
copy_from_user_sec_ctx(struct xfrm_policy * pol,struct nlattr ** attrs)18625424f32eSThomas Graf static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
1863df71837dSTrent Jaeger {
18645424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1865df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx;
1866df71837dSTrent Jaeger
1867df71837dSTrent Jaeger if (!rt)
1868df71837dSTrent Jaeger return 0;
1869df71837dSTrent Jaeger
18705424f32eSThomas Graf uctx = nla_data(rt);
187152a4c640SNikolay Aleksandrov return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL);
1872df71837dSTrent Jaeger }
1873df71837dSTrent Jaeger
copy_templates(struct xfrm_policy * xp,struct xfrm_user_tmpl * ut,int nr)18741da177e4SLinus Torvalds static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
18751da177e4SLinus Torvalds int nr)
18761da177e4SLinus Torvalds {
18771da177e4SLinus Torvalds int i;
18781da177e4SLinus Torvalds
18791da177e4SLinus Torvalds xp->xfrm_nr = nr;
18801da177e4SLinus Torvalds for (i = 0; i < nr; i++, ut++) {
18811da177e4SLinus Torvalds struct xfrm_tmpl *t = &xp->xfrm_vec[i];
18821da177e4SLinus Torvalds
18831da177e4SLinus Torvalds memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
18841da177e4SLinus Torvalds memcpy(&t->saddr, &ut->saddr,
18851da177e4SLinus Torvalds sizeof(xfrm_address_t));
18861da177e4SLinus Torvalds t->reqid = ut->reqid;
18871da177e4SLinus Torvalds t->mode = ut->mode;
18881da177e4SLinus Torvalds t->share = ut->share;
18891da177e4SLinus Torvalds t->optional = ut->optional;
18901da177e4SLinus Torvalds t->aalgos = ut->aalgos;
18911da177e4SLinus Torvalds t->ealgos = ut->ealgos;
18921da177e4SLinus Torvalds t->calgos = ut->calgos;
1893c5d18e98SHerbert Xu /* If all masks are ~0, then we allow all algorithms. */
1894c5d18e98SHerbert Xu t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
18958511d01dSMiika Komu t->encap_family = ut->family;
18961da177e4SLinus Torvalds }
18971da177e4SLinus Torvalds }
18981da177e4SLinus Torvalds
validate_tmpl(int nr,struct xfrm_user_tmpl * ut,u16 family,int dir,struct netlink_ext_ack * extack)1899d37bed89SSabrina Dubroca static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family,
19003d776e31STobias Brunner int dir, struct netlink_ext_ack *extack)
1901b4ad86bfSDavid S. Miller {
1902732706afSSteffen Klassert u16 prev_family;
1903b4ad86bfSDavid S. Miller int i;
1904b4ad86bfSDavid S. Miller
1905d37bed89SSabrina Dubroca if (nr > XFRM_MAX_DEPTH) {
1906d37bed89SSabrina Dubroca NL_SET_ERR_MSG(extack, "Template count must be <= XFRM_MAX_DEPTH (" __stringify(XFRM_MAX_DEPTH) ")");
1907b4ad86bfSDavid S. Miller return -EINVAL;
1908d37bed89SSabrina Dubroca }
1909b4ad86bfSDavid S. Miller
1910732706afSSteffen Klassert prev_family = family;
1911732706afSSteffen Klassert
1912b4ad86bfSDavid S. Miller for (i = 0; i < nr; i++) {
1913b4ad86bfSDavid S. Miller /* We never validated the ut->family value, so many
1914b4ad86bfSDavid S. Miller * applications simply leave it at zero. The check was
1915b4ad86bfSDavid S. Miller * never made and ut->family was ignored because all
1916b4ad86bfSDavid S. Miller * templates could be assumed to have the same family as
1917b4ad86bfSDavid S. Miller * the policy itself. Now that we will have ipv4-in-ipv6
1918b4ad86bfSDavid S. Miller * and ipv6-in-ipv4 tunnels, this is no longer true.
1919b4ad86bfSDavid S. Miller */
1920b4ad86bfSDavid S. Miller if (!ut[i].family)
1921b4ad86bfSDavid S. Miller ut[i].family = family;
1922b4ad86bfSDavid S. Miller
192335e61038SFlorian Westphal switch (ut[i].mode) {
192435e61038SFlorian Westphal case XFRM_MODE_TUNNEL:
192535e61038SFlorian Westphal case XFRM_MODE_BEET:
19263d776e31STobias Brunner if (ut[i].optional && dir == XFRM_POLICY_OUT) {
19273d776e31STobias Brunner NL_SET_ERR_MSG(extack, "Mode in optional template not allowed in outbound policy");
19283d776e31STobias Brunner return -EINVAL;
19293d776e31STobias Brunner }
193035e61038SFlorian Westphal break;
193135e61038SFlorian Westphal default:
1932d37bed89SSabrina Dubroca if (ut[i].family != prev_family) {
1933d37bed89SSabrina Dubroca NL_SET_ERR_MSG(extack, "Mode in template doesn't support a family change");
1934732706afSSteffen Klassert return -EINVAL;
1935d37bed89SSabrina Dubroca }
193635e61038SFlorian Westphal break;
193735e61038SFlorian Westphal }
1938d37bed89SSabrina Dubroca if (ut[i].mode >= XFRM_MODE_MAX) {
1939d37bed89SSabrina Dubroca NL_SET_ERR_MSG(extack, "Mode in template must be < XFRM_MODE_MAX (" __stringify(XFRM_MODE_MAX) ")");
194032bf94fbSSean Tranchetti return -EINVAL;
1941d37bed89SSabrina Dubroca }
194232bf94fbSSean Tranchetti
1943732706afSSteffen Klassert prev_family = ut[i].family;
1944732706afSSteffen Klassert
1945b4ad86bfSDavid S. Miller switch (ut[i].family) {
1946b4ad86bfSDavid S. Miller case AF_INET:
1947b4ad86bfSDavid S. Miller break;
1948dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6)
1949b4ad86bfSDavid S. Miller case AF_INET6:
1950b4ad86bfSDavid S. Miller break;
1951b4ad86bfSDavid S. Miller #endif
1952b4ad86bfSDavid S. Miller default:
1953d37bed89SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid family in template");
1954b4ad86bfSDavid S. Miller return -EINVAL;
19553ff50b79SStephen Hemminger }
19566a53b759SCong Wang
1957d37bed89SSabrina Dubroca if (!xfrm_id_proto_valid(ut[i].id.proto)) {
1958d37bed89SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid XFRM protocol in template");
19596a53b759SCong Wang return -EINVAL;
19606a53b759SCong Wang }
1961d37bed89SSabrina Dubroca }
19626a53b759SCong Wang
1963b4ad86bfSDavid S. Miller return 0;
1964b4ad86bfSDavid S. Miller }
1965b4ad86bfSDavid S. Miller
copy_from_user_tmpl(struct xfrm_policy * pol,struct nlattr ** attrs,int dir,struct netlink_ext_ack * extack)1966d37bed89SSabrina Dubroca static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs,
19673d776e31STobias Brunner int dir, struct netlink_ext_ack *extack)
19681da177e4SLinus Torvalds {
19695424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL];
19701da177e4SLinus Torvalds
19711da177e4SLinus Torvalds if (!rt) {
19721da177e4SLinus Torvalds pol->xfrm_nr = 0;
19731da177e4SLinus Torvalds } else {
19745424f32eSThomas Graf struct xfrm_user_tmpl *utmpl = nla_data(rt);
19755424f32eSThomas Graf int nr = nla_len(rt) / sizeof(*utmpl);
1976b4ad86bfSDavid S. Miller int err;
19771da177e4SLinus Torvalds
19783d776e31STobias Brunner err = validate_tmpl(nr, utmpl, pol->family, dir, extack);
1979b4ad86bfSDavid S. Miller if (err)
1980b4ad86bfSDavid S. Miller return err;
19811da177e4SLinus Torvalds
19825424f32eSThomas Graf copy_templates(pol, utmpl, nr);
19831da177e4SLinus Torvalds }
19841da177e4SLinus Torvalds return 0;
19851da177e4SLinus Torvalds }
19861da177e4SLinus Torvalds
copy_from_user_policy_type(u8 * tp,struct nlattr ** attrs,struct netlink_ext_ack * extack)1987fb7deabaSSabrina Dubroca static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs,
1988fb7deabaSSabrina Dubroca struct netlink_ext_ack *extack)
1989f7b6983fSMasahide NAKAMURA {
19905424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1991f7b6983fSMasahide NAKAMURA struct xfrm_userpolicy_type *upt;
1992b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN;
1993f7b6983fSMasahide NAKAMURA int err;
1994f7b6983fSMasahide NAKAMURA
1995f7b6983fSMasahide NAKAMURA if (rt) {
19965424f32eSThomas Graf upt = nla_data(rt);
1997f7b6983fSMasahide NAKAMURA type = upt->type;
1998f7b6983fSMasahide NAKAMURA }
1999f7b6983fSMasahide NAKAMURA
2000fb7deabaSSabrina Dubroca err = verify_policy_type(type, extack);
2001f7b6983fSMasahide NAKAMURA if (err)
2002f7b6983fSMasahide NAKAMURA return err;
2003f7b6983fSMasahide NAKAMURA
2004f7b6983fSMasahide NAKAMURA *tp = type;
2005f7b6983fSMasahide NAKAMURA return 0;
2006f7b6983fSMasahide NAKAMURA }
2007f7b6983fSMasahide NAKAMURA
copy_from_user_policy(struct xfrm_policy * xp,struct xfrm_userpolicy_info * p)20081da177e4SLinus Torvalds static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
20091da177e4SLinus Torvalds {
20101da177e4SLinus Torvalds xp->priority = p->priority;
20111da177e4SLinus Torvalds xp->index = p->index;
20121da177e4SLinus Torvalds memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
20131da177e4SLinus Torvalds memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
20141da177e4SLinus Torvalds xp->action = p->action;
20151da177e4SLinus Torvalds xp->flags = p->flags;
20161da177e4SLinus Torvalds xp->family = p->sel.family;
20171da177e4SLinus Torvalds /* XXX xp->share = p->share; */
20181da177e4SLinus Torvalds }
20191da177e4SLinus Torvalds
copy_to_user_policy(struct xfrm_policy * xp,struct xfrm_userpolicy_info * p,int dir)20201da177e4SLinus Torvalds static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
20211da177e4SLinus Torvalds {
20227b789836SMathias Krause memset(p, 0, sizeof(*p));
20231da177e4SLinus Torvalds memcpy(&p->sel, &xp->selector, sizeof(p->sel));
20241da177e4SLinus Torvalds memcpy(&p->lft, &xp->lft, sizeof(p->lft));
20251da177e4SLinus Torvalds memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
20261da177e4SLinus Torvalds p->priority = xp->priority;
20271da177e4SLinus Torvalds p->index = xp->index;
20281da177e4SLinus Torvalds p->sel.family = xp->family;
20291da177e4SLinus Torvalds p->dir = dir;
20301da177e4SLinus Torvalds p->action = xp->action;
20311da177e4SLinus Torvalds p->flags = xp->flags;
20321da177e4SLinus Torvalds p->share = XFRM_SHARE_ANY; /* XXX xp->share */
20331da177e4SLinus Torvalds }
20341da177e4SLinus Torvalds
xfrm_policy_construct(struct net * net,struct xfrm_userpolicy_info * p,struct nlattr ** attrs,int * errp,struct netlink_ext_ack * extack)2035fb7deabaSSabrina Dubroca static struct xfrm_policy *xfrm_policy_construct(struct net *net,
2036fb7deabaSSabrina Dubroca struct xfrm_userpolicy_info *p,
2037fb7deabaSSabrina Dubroca struct nlattr **attrs,
2038fb7deabaSSabrina Dubroca int *errp,
2039fb7deabaSSabrina Dubroca struct netlink_ext_ack *extack)
20401da177e4SLinus Torvalds {
2041fc34acd3SAlexey Dobriyan struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
20421da177e4SLinus Torvalds int err;
20431da177e4SLinus Torvalds
20441da177e4SLinus Torvalds if (!xp) {
20451da177e4SLinus Torvalds *errp = -ENOMEM;
20461da177e4SLinus Torvalds return NULL;
20471da177e4SLinus Torvalds }
20481da177e4SLinus Torvalds
20491da177e4SLinus Torvalds copy_from_user_policy(xp, p);
2050df71837dSTrent Jaeger
2051fb7deabaSSabrina Dubroca err = copy_from_user_policy_type(&xp->type, attrs, extack);
2052f7b6983fSMasahide NAKAMURA if (err)
2053f7b6983fSMasahide NAKAMURA goto error;
2054f7b6983fSMasahide NAKAMURA
20553d776e31STobias Brunner if (!(err = copy_from_user_tmpl(xp, attrs, p->dir, extack)))
205635a7aa08SThomas Graf err = copy_from_user_sec_ctx(xp, attrs);
2057f7b6983fSMasahide NAKAMURA if (err)
2058f7b6983fSMasahide NAKAMURA goto error;
20591da177e4SLinus Torvalds
2060295fae56SJamal Hadi Salim xfrm_mark_get(attrs, &xp->mark);
2061295fae56SJamal Hadi Salim
2062a3d9001bSKai Lueke if (attrs[XFRMA_IF_ID])
20637e652640SSteffen Klassert xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
20647e652640SSteffen Klassert
2065919e43faSLeon Romanovsky /* configure the hardware if offload is requested */
2066919e43faSLeon Romanovsky if (attrs[XFRMA_OFFLOAD_DEV]) {
2067919e43faSLeon Romanovsky err = xfrm_dev_policy_add(net, xp,
2068919e43faSLeon Romanovsky nla_data(attrs[XFRMA_OFFLOAD_DEV]),
2069919e43faSLeon Romanovsky p->dir, extack);
2070919e43faSLeon Romanovsky if (err)
2071919e43faSLeon Romanovsky goto error;
2072919e43faSLeon Romanovsky }
2073919e43faSLeon Romanovsky
20741da177e4SLinus Torvalds return xp;
2075f7b6983fSMasahide NAKAMURA error:
2076f7b6983fSMasahide NAKAMURA *errp = err;
207712a169e7SHerbert Xu xp->walk.dead = 1;
207864c31b3fSWANG Cong xfrm_policy_destroy(xp);
2079f7b6983fSMasahide NAKAMURA return NULL;
20801da177e4SLinus Torvalds }
20811da177e4SLinus Torvalds
xfrm_add_policy(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)208222e70050SChristoph Hellwig static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
20833bec6c3eSSabrina Dubroca struct nlattr **attrs,
20843bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
20851da177e4SLinus Torvalds {
2086fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
20877b67c857SThomas Graf struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
20881da177e4SLinus Torvalds struct xfrm_policy *xp;
208926b15dadSJamal Hadi Salim struct km_event c;
20901da177e4SLinus Torvalds int err;
20911da177e4SLinus Torvalds int excl;
20921da177e4SLinus Torvalds
2093ec2b4f01SSabrina Dubroca err = verify_newpolicy_info(p, extack);
20941da177e4SLinus Torvalds if (err)
20951da177e4SLinus Torvalds return err;
209608a717e4SSabrina Dubroca err = verify_sec_ctx_len(attrs, extack);
2097df71837dSTrent Jaeger if (err)
2098df71837dSTrent Jaeger return err;
20991da177e4SLinus Torvalds
2100fb7deabaSSabrina Dubroca xp = xfrm_policy_construct(net, p, attrs, &err, extack);
21011da177e4SLinus Torvalds if (!xp)
21021da177e4SLinus Torvalds return err;
21031da177e4SLinus Torvalds
210425985edcSLucas De Marchi /* shouldn't excl be based on nlh flags??
210526b15dadSJamal Hadi Salim * Aha! this is anti-netlink really i.e more pfkey derived
2106a7fd0e6dSBhaskar Chowdhury * in netlink excl is a flag and you wouldn't need
210726b15dadSJamal Hadi Salim * a type XFRM_MSG_UPDPOLICY - JHS */
21081da177e4SLinus Torvalds excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
21091da177e4SLinus Torvalds err = xfrm_policy_insert(p->dir, xp, excl);
21102e71029eSTetsuo Handa xfrm_audit_policy_add(xp, err ? 0 : 1, true);
2111161a09e7SJoy Latten
21121da177e4SLinus Torvalds if (err) {
2113919e43faSLeon Romanovsky xfrm_dev_policy_delete(xp);
211494b95dfaSLeon Romanovsky xfrm_dev_policy_free(xp);
211503e1ad7bSPaul Moore security_xfrm_policy_free(xp->security);
21161da177e4SLinus Torvalds kfree(xp);
21171da177e4SLinus Torvalds return err;
21181da177e4SLinus Torvalds }
21191da177e4SLinus Torvalds
2120f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type;
212126b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
212215e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
212326b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c);
212426b15dadSJamal Hadi Salim
21251da177e4SLinus Torvalds xfrm_pol_put(xp);
21261da177e4SLinus Torvalds
21271da177e4SLinus Torvalds return 0;
21281da177e4SLinus Torvalds }
21291da177e4SLinus Torvalds
copy_to_user_tmpl(struct xfrm_policy * xp,struct sk_buff * skb)21301da177e4SLinus Torvalds static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
21311da177e4SLinus Torvalds {
21321da177e4SLinus Torvalds struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
21331da177e4SLinus Torvalds int i;
21341da177e4SLinus Torvalds
21351da177e4SLinus Torvalds if (xp->xfrm_nr == 0)
21361da177e4SLinus Torvalds return 0;
21371da177e4SLinus Torvalds
21381a807e46SNathan Chancellor if (xp->xfrm_nr > XFRM_MAX_DEPTH)
21391a807e46SNathan Chancellor return -ENOBUFS;
21401a807e46SNathan Chancellor
21411da177e4SLinus Torvalds for (i = 0; i < xp->xfrm_nr; i++) {
21421da177e4SLinus Torvalds struct xfrm_user_tmpl *up = &vec[i];
21431da177e4SLinus Torvalds struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
21441da177e4SLinus Torvalds
21451f86840fSMathias Krause memset(up, 0, sizeof(*up));
21461da177e4SLinus Torvalds memcpy(&up->id, &kp->id, sizeof(up->id));
21478511d01dSMiika Komu up->family = kp->encap_family;
21481da177e4SLinus Torvalds memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
21491da177e4SLinus Torvalds up->reqid = kp->reqid;
21501da177e4SLinus Torvalds up->mode = kp->mode;
21511da177e4SLinus Torvalds up->share = kp->share;
21521da177e4SLinus Torvalds up->optional = kp->optional;
21531da177e4SLinus Torvalds up->aalgos = kp->aalgos;
21541da177e4SLinus Torvalds up->ealgos = kp->ealgos;
21551da177e4SLinus Torvalds up->calgos = kp->calgos;
21561da177e4SLinus Torvalds }
21571da177e4SLinus Torvalds
2158c0144beaSThomas Graf return nla_put(skb, XFRMA_TMPL,
2159c0144beaSThomas Graf sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
2160df71837dSTrent Jaeger }
2161df71837dSTrent Jaeger
copy_to_user_state_sec_ctx(struct xfrm_state * x,struct sk_buff * skb)21620d681623SSerge Hallyn static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
21630d681623SSerge Hallyn {
21640d681623SSerge Hallyn if (x->security) {
21650d681623SSerge Hallyn return copy_sec_ctx(x->security, skb);
21660d681623SSerge Hallyn }
21670d681623SSerge Hallyn return 0;
21680d681623SSerge Hallyn }
21690d681623SSerge Hallyn
copy_to_user_sec_ctx(struct xfrm_policy * xp,struct sk_buff * skb)21700d681623SSerge Hallyn static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
21710d681623SSerge Hallyn {
21721d1e34ddSDavid S. Miller if (xp->security)
21730d681623SSerge Hallyn return copy_sec_ctx(xp->security, skb);
21740d681623SSerge Hallyn return 0;
21750d681623SSerge Hallyn }
userpolicy_type_attrsize(void)2176a1b831f2SAlexey Dobriyan static inline unsigned int userpolicy_type_attrsize(void)
2177cfbfd45aSThomas Graf {
2178cfbfd45aSThomas Graf #ifdef CONFIG_XFRM_SUB_POLICY
2179cfbfd45aSThomas Graf return nla_total_size(sizeof(struct xfrm_userpolicy_type));
2180cfbfd45aSThomas Graf #else
2181cfbfd45aSThomas Graf return 0;
2182cfbfd45aSThomas Graf #endif
2183cfbfd45aSThomas Graf }
21840d681623SSerge Hallyn
2185f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY
copy_to_user_policy_type(u8 type,struct sk_buff * skb)2186b798a9edSJamal Hadi Salim static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
2187f7b6983fSMasahide NAKAMURA {
218845c180bcSEric Dumazet struct xfrm_userpolicy_type upt;
218945c180bcSEric Dumazet
219045c180bcSEric Dumazet /* Sadly there are two holes in struct xfrm_userpolicy_type */
219145c180bcSEric Dumazet memset(&upt, 0, sizeof(upt));
219245c180bcSEric Dumazet upt.type = type;
2193f7b6983fSMasahide NAKAMURA
2194c0144beaSThomas Graf return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
2195f7b6983fSMasahide NAKAMURA }
2196f7b6983fSMasahide NAKAMURA
2197f7b6983fSMasahide NAKAMURA #else
copy_to_user_policy_type(u8 type,struct sk_buff * skb)2198b798a9edSJamal Hadi Salim static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
2199f7b6983fSMasahide NAKAMURA {
2200f7b6983fSMasahide NAKAMURA return 0;
2201f7b6983fSMasahide NAKAMURA }
2202f7b6983fSMasahide NAKAMURA #endif
2203f7b6983fSMasahide NAKAMURA
dump_one_policy(struct xfrm_policy * xp,int dir,int count,void * ptr)22041da177e4SLinus Torvalds static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
22051da177e4SLinus Torvalds {
22061da177e4SLinus Torvalds struct xfrm_dump_info *sp = ptr;
22071da177e4SLinus Torvalds struct xfrm_userpolicy_info *p;
22081da177e4SLinus Torvalds struct sk_buff *in_skb = sp->in_skb;
22091da177e4SLinus Torvalds struct sk_buff *skb = sp->out_skb;
22105f3eea6bSDmitry Safonov struct xfrm_translator *xtr;
22111da177e4SLinus Torvalds struct nlmsghdr *nlh;
22121d1e34ddSDavid S. Miller int err;
22131da177e4SLinus Torvalds
221415e47304SEric W. Biederman nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
221579b8b7f4SThomas Graf XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
221679b8b7f4SThomas Graf if (nlh == NULL)
221779b8b7f4SThomas Graf return -EMSGSIZE;
22181da177e4SLinus Torvalds
22197b67c857SThomas Graf p = nlmsg_data(nlh);
22201da177e4SLinus Torvalds copy_to_user_policy(xp, p, dir);
22211d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb);
22221d1e34ddSDavid S. Miller if (!err)
22231d1e34ddSDavid S. Miller err = copy_to_user_sec_ctx(xp, skb);
22241d1e34ddSDavid S. Miller if (!err)
22251d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb);
22261d1e34ddSDavid S. Miller if (!err)
22271d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark);
22287e652640SSteffen Klassert if (!err)
22297e652640SSteffen Klassert err = xfrm_if_id_put(skb, xp->if_id);
2230919e43faSLeon Romanovsky if (!err && xp->xdo.dev)
2231919e43faSLeon Romanovsky err = copy_user_offload(&xp->xdo, skb);
22321d1e34ddSDavid S. Miller if (err) {
22331d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh);
22341d1e34ddSDavid S. Miller return err;
22351d1e34ddSDavid S. Miller }
22369825069dSThomas Graf nlmsg_end(skb, nlh);
22375f3eea6bSDmitry Safonov
22385f3eea6bSDmitry Safonov xtr = xfrm_get_translator();
22395f3eea6bSDmitry Safonov if (xtr) {
22405f3eea6bSDmitry Safonov err = xtr->alloc_compat(skb, nlh);
22415f3eea6bSDmitry Safonov
22425f3eea6bSDmitry Safonov xfrm_put_translator(xtr);
22435f3eea6bSDmitry Safonov if (err) {
22445f3eea6bSDmitry Safonov nlmsg_cancel(skb, nlh);
22455f3eea6bSDmitry Safonov return err;
22465f3eea6bSDmitry Safonov }
22475f3eea6bSDmitry Safonov }
22485f3eea6bSDmitry Safonov
22491da177e4SLinus Torvalds return 0;
22501da177e4SLinus Torvalds }
22511da177e4SLinus Torvalds
xfrm_dump_policy_done(struct netlink_callback * cb)22524c563f76STimo Teras static int xfrm_dump_policy_done(struct netlink_callback *cb)
22534c563f76STimo Teras {
22541137b5e2SHerbert Xu struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
2255283bc9f3SFan Du struct net *net = sock_net(cb->skb->sk);
22564c563f76STimo Teras
2257283bc9f3SFan Du xfrm_policy_walk_done(walk, net);
22584c563f76STimo Teras return 0;
22594c563f76STimo Teras }
22604c563f76STimo Teras
xfrm_dump_policy_start(struct netlink_callback * cb)22611137b5e2SHerbert Xu static int xfrm_dump_policy_start(struct netlink_callback *cb)
22621137b5e2SHerbert Xu {
22631137b5e2SHerbert Xu struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
22641137b5e2SHerbert Xu
22651137b5e2SHerbert Xu BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
22661137b5e2SHerbert Xu
22671137b5e2SHerbert Xu xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
22681137b5e2SHerbert Xu return 0;
22691137b5e2SHerbert Xu }
22701137b5e2SHerbert Xu
xfrm_dump_policy(struct sk_buff * skb,struct netlink_callback * cb)22711da177e4SLinus Torvalds static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
22721da177e4SLinus Torvalds {
2273fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
22741137b5e2SHerbert Xu struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
22751da177e4SLinus Torvalds struct xfrm_dump_info info;
22761da177e4SLinus Torvalds
22771da177e4SLinus Torvalds info.in_skb = cb->skb;
22781da177e4SLinus Torvalds info.out_skb = skb;
22791da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq;
22801da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI;
22814c563f76STimo Teras
2282fc34acd3SAlexey Dobriyan (void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
22831da177e4SLinus Torvalds
22841da177e4SLinus Torvalds return skb->len;
22851da177e4SLinus Torvalds }
22861da177e4SLinus Torvalds
xfrm_policy_netlink(struct sk_buff * in_skb,struct xfrm_policy * xp,int dir,u32 seq)22871da177e4SLinus Torvalds static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
22881da177e4SLinus Torvalds struct xfrm_policy *xp,
22891da177e4SLinus Torvalds int dir, u32 seq)
22901da177e4SLinus Torvalds {
22911da177e4SLinus Torvalds struct xfrm_dump_info info;
22921da177e4SLinus Torvalds struct sk_buff *skb;
2293c2546372SMathias Krause int err;
22941da177e4SLinus Torvalds
22957deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
22961da177e4SLinus Torvalds if (!skb)
22971da177e4SLinus Torvalds return ERR_PTR(-ENOMEM);
22981da177e4SLinus Torvalds
22991da177e4SLinus Torvalds info.in_skb = in_skb;
23001da177e4SLinus Torvalds info.out_skb = skb;
23011da177e4SLinus Torvalds info.nlmsg_seq = seq;
23021da177e4SLinus Torvalds info.nlmsg_flags = 0;
23031da177e4SLinus Torvalds
2304c2546372SMathias Krause err = dump_one_policy(xp, dir, 0, &info);
2305c2546372SMathias Krause if (err) {
23061da177e4SLinus Torvalds kfree_skb(skb);
2307c2546372SMathias Krause return ERR_PTR(err);
23081da177e4SLinus Torvalds }
23091da177e4SLinus Torvalds
23101da177e4SLinus Torvalds return skb;
23111da177e4SLinus Torvalds }
23121da177e4SLinus Torvalds
xfrm_notify_userpolicy(struct net * net)231388d0adb5SNicolas Dichtel static int xfrm_notify_userpolicy(struct net *net)
231488d0adb5SNicolas Dichtel {
231588d0adb5SNicolas Dichtel struct xfrm_userpolicy_default *up;
231688d0adb5SNicolas Dichtel int len = NLMSG_ALIGN(sizeof(*up));
231788d0adb5SNicolas Dichtel struct nlmsghdr *nlh;
231888d0adb5SNicolas Dichtel struct sk_buff *skb;
231993ec1320SNicolas Dichtel int err;
232088d0adb5SNicolas Dichtel
232188d0adb5SNicolas Dichtel skb = nlmsg_new(len, GFP_ATOMIC);
232288d0adb5SNicolas Dichtel if (skb == NULL)
232388d0adb5SNicolas Dichtel return -ENOMEM;
232488d0adb5SNicolas Dichtel
232588d0adb5SNicolas Dichtel nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_GETDEFAULT, sizeof(*up), 0);
232688d0adb5SNicolas Dichtel if (nlh == NULL) {
232788d0adb5SNicolas Dichtel kfree_skb(skb);
232888d0adb5SNicolas Dichtel return -EMSGSIZE;
232988d0adb5SNicolas Dichtel }
233088d0adb5SNicolas Dichtel
233188d0adb5SNicolas Dichtel up = nlmsg_data(nlh);
2332b58b1f56SNicolas Dichtel up->in = net->xfrm.policy_default[XFRM_POLICY_IN];
2333b58b1f56SNicolas Dichtel up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];
2334b58b1f56SNicolas Dichtel up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];
233588d0adb5SNicolas Dichtel
233688d0adb5SNicolas Dichtel nlmsg_end(skb, nlh);
233788d0adb5SNicolas Dichtel
233893ec1320SNicolas Dichtel rcu_read_lock();
233993ec1320SNicolas Dichtel err = xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
234093ec1320SNicolas Dichtel rcu_read_unlock();
234193ec1320SNicolas Dichtel
234293ec1320SNicolas Dichtel return err;
234388d0adb5SNicolas Dichtel }
234488d0adb5SNicolas Dichtel
xfrm_userpolicy_is_valid(__u8 policy)2345b58b1f56SNicolas Dichtel static bool xfrm_userpolicy_is_valid(__u8 policy)
2346b58b1f56SNicolas Dichtel {
2347b58b1f56SNicolas Dichtel return policy == XFRM_USERPOLICY_BLOCK ||
2348b58b1f56SNicolas Dichtel policy == XFRM_USERPOLICY_ACCEPT;
2349b58b1f56SNicolas Dichtel }
2350b58b1f56SNicolas Dichtel
xfrm_set_default(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)23512d151d39SSteffen Klassert static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh,
23523bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
23532d151d39SSteffen Klassert {
23542d151d39SSteffen Klassert struct net *net = sock_net(skb->sk);
23552d151d39SSteffen Klassert struct xfrm_userpolicy_default *up = nlmsg_data(nlh);
23562d151d39SSteffen Klassert
2357b58b1f56SNicolas Dichtel if (xfrm_userpolicy_is_valid(up->in))
2358b58b1f56SNicolas Dichtel net->xfrm.policy_default[XFRM_POLICY_IN] = up->in;
23595d8dbb7fSPavel Skripkin
2360b58b1f56SNicolas Dichtel if (xfrm_userpolicy_is_valid(up->fwd))
2361b58b1f56SNicolas Dichtel net->xfrm.policy_default[XFRM_POLICY_FWD] = up->fwd;
23625d8dbb7fSPavel Skripkin
2363b58b1f56SNicolas Dichtel if (xfrm_userpolicy_is_valid(up->out))
2364b58b1f56SNicolas Dichtel net->xfrm.policy_default[XFRM_POLICY_OUT] = up->out;
23652d151d39SSteffen Klassert
23662d151d39SSteffen Klassert rt_genid_bump_all(net);
23672d151d39SSteffen Klassert
236888d0adb5SNicolas Dichtel xfrm_notify_userpolicy(net);
23692d151d39SSteffen Klassert return 0;
23702d151d39SSteffen Klassert }
23712d151d39SSteffen Klassert
xfrm_get_default(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)23722d151d39SSteffen Klassert static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh,
23733bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
23742d151d39SSteffen Klassert {
23752d151d39SSteffen Klassert struct sk_buff *r_skb;
23762d151d39SSteffen Klassert struct nlmsghdr *r_nlh;
23772d151d39SSteffen Klassert struct net *net = sock_net(skb->sk);
2378f8d858e6SNicolas Dichtel struct xfrm_userpolicy_default *r_up;
23792d151d39SSteffen Klassert int len = NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_default));
23802d151d39SSteffen Klassert u32 portid = NETLINK_CB(skb).portid;
23812d151d39SSteffen Klassert u32 seq = nlh->nlmsg_seq;
23822d151d39SSteffen Klassert
23832d151d39SSteffen Klassert r_skb = nlmsg_new(len, GFP_ATOMIC);
23842d151d39SSteffen Klassert if (!r_skb)
23852d151d39SSteffen Klassert return -ENOMEM;
23862d151d39SSteffen Klassert
23872d151d39SSteffen Klassert r_nlh = nlmsg_put(r_skb, portid, seq, XFRM_MSG_GETDEFAULT, sizeof(*r_up), 0);
23882d151d39SSteffen Klassert if (!r_nlh) {
23892d151d39SSteffen Klassert kfree_skb(r_skb);
23902d151d39SSteffen Klassert return -EMSGSIZE;
23912d151d39SSteffen Klassert }
23922d151d39SSteffen Klassert
23932d151d39SSteffen Klassert r_up = nlmsg_data(r_nlh);
2394b58b1f56SNicolas Dichtel r_up->in = net->xfrm.policy_default[XFRM_POLICY_IN];
2395b58b1f56SNicolas Dichtel r_up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];
2396b58b1f56SNicolas Dichtel r_up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];
23972d151d39SSteffen Klassert nlmsg_end(r_skb, r_nlh);
23982d151d39SSteffen Klassert
23992d151d39SSteffen Klassert return nlmsg_unicast(net->xfrm.nlsk, r_skb, portid);
24002d151d39SSteffen Klassert }
24012d151d39SSteffen Klassert
xfrm_get_policy(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)240222e70050SChristoph Hellwig static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
24033bec6c3eSSabrina Dubroca struct nlattr **attrs,
24043bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
24051da177e4SLinus Torvalds {
2406fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
24071da177e4SLinus Torvalds struct xfrm_policy *xp;
24081da177e4SLinus Torvalds struct xfrm_userpolicy_id *p;
2409b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN;
24101da177e4SLinus Torvalds int err;
241126b15dadSJamal Hadi Salim struct km_event c;
24121da177e4SLinus Torvalds int delete;
2413295fae56SJamal Hadi Salim struct xfrm_mark m;
24147e652640SSteffen Klassert u32 if_id = 0;
24151da177e4SLinus Torvalds
24167b67c857SThomas Graf p = nlmsg_data(nlh);
24171da177e4SLinus Torvalds delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
24181da177e4SLinus Torvalds
2419fb7deabaSSabrina Dubroca err = copy_from_user_policy_type(&type, attrs, extack);
2420f7b6983fSMasahide NAKAMURA if (err)
2421f7b6983fSMasahide NAKAMURA return err;
2422f7b6983fSMasahide NAKAMURA
242324fc544fSSabrina Dubroca err = verify_policy_dir(p->dir, extack);
24241da177e4SLinus Torvalds if (err)
24251da177e4SLinus Torvalds return err;
24261da177e4SLinus Torvalds
24277e652640SSteffen Klassert if (attrs[XFRMA_IF_ID])
24287e652640SSteffen Klassert if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
24297e652640SSteffen Klassert
24304f47e8abSXin Long xfrm_mark_get(attrs, &m);
24314f47e8abSXin Long
24321da177e4SLinus Torvalds if (p->index)
24334f47e8abSXin Long xp = xfrm_policy_byid(net, &m, if_id, type, p->dir,
24344f47e8abSXin Long p->index, delete, &err);
2435df71837dSTrent Jaeger else {
24365424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX];
243703e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx;
2438df71837dSTrent Jaeger
243908a717e4SSabrina Dubroca err = verify_sec_ctx_len(attrs, extack);
2440df71837dSTrent Jaeger if (err)
2441df71837dSTrent Jaeger return err;
2442df71837dSTrent Jaeger
24432c8dd116SDenis V. Lunev ctx = NULL;
2444df71837dSTrent Jaeger if (rt) {
24455424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt);
2446df71837dSTrent Jaeger
244752a4c640SNikolay Aleksandrov err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
244803e1ad7bSPaul Moore if (err)
2449df71837dSTrent Jaeger return err;
24502c8dd116SDenis V. Lunev }
24514f47e8abSXin Long xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
24524f47e8abSXin Long &p->sel, ctx, delete, &err);
245303e1ad7bSPaul Moore security_xfrm_policy_free(ctx);
2454df71837dSTrent Jaeger }
24551da177e4SLinus Torvalds if (xp == NULL)
24561da177e4SLinus Torvalds return -ENOENT;
24571da177e4SLinus Torvalds
24581da177e4SLinus Torvalds if (!delete) {
24591da177e4SLinus Torvalds struct sk_buff *resp_skb;
24601da177e4SLinus Torvalds
24611da177e4SLinus Torvalds resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
24621da177e4SLinus Torvalds if (IS_ERR(resp_skb)) {
24631da177e4SLinus Torvalds err = PTR_ERR(resp_skb);
24641da177e4SLinus Torvalds } else {
2465a6483b79SAlexey Dobriyan err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
246615e47304SEric W. Biederman NETLINK_CB(skb).portid);
24671da177e4SLinus Torvalds }
246826b15dadSJamal Hadi Salim } else {
24692e71029eSTetsuo Handa xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
247013fcfbb0SDavid S. Miller
247113fcfbb0SDavid S. Miller if (err != 0)
2472c8c05a8eSCatherine Zhang goto out;
247313fcfbb0SDavid S. Miller
2474e7443892SHerbert Xu c.data.byid = p->index;
2475f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type;
247626b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
247715e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
247826b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c);
24791da177e4SLinus Torvalds }
24801da177e4SLinus Torvalds
2481c8c05a8eSCatherine Zhang out:
2482ef41aaa0SEric Paris xfrm_pol_put(xp);
24831da177e4SLinus Torvalds return err;
24841da177e4SLinus Torvalds }
24851da177e4SLinus Torvalds
xfrm_flush_sa(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)248622e70050SChristoph Hellwig static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
24873bec6c3eSSabrina Dubroca struct nlattr **attrs,
24883bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
24891da177e4SLinus Torvalds {
2490fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
249126b15dadSJamal Hadi Salim struct km_event c;
24927b67c857SThomas Graf struct xfrm_usersa_flush *p = nlmsg_data(nlh);
24934aa2e62cSJoy Latten int err;
24941da177e4SLinus Torvalds
2495f75a2804SCong Wang err = xfrm_state_flush(net, p->proto, true, false);
24969e64cc95SJamal Hadi Salim if (err) {
24979e64cc95SJamal Hadi Salim if (err == -ESRCH) /* empty table */
24989e64cc95SJamal Hadi Salim return 0;
2499069c474eSDavid S. Miller return err;
25009e64cc95SJamal Hadi Salim }
2501bf08867fSHerbert Xu c.data.proto = p->proto;
2502f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type;
250326b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
250415e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
25057067802eSAlexey Dobriyan c.net = net;
250626b15dadSJamal Hadi Salim km_state_notify(NULL, &c);
250726b15dadSJamal Hadi Salim
25081da177e4SLinus Torvalds return 0;
25091da177e4SLinus Torvalds }
25101da177e4SLinus Torvalds
xfrm_aevent_msgsize(struct xfrm_state * x)2511a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x)
25127deb2264SThomas Graf {
2513a1b831f2SAlexey Dobriyan unsigned int replay_size = x->replay_esn ?
2514d8647b79SSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn) :
2515d8647b79SSteffen Klassert sizeof(struct xfrm_replay_state);
2516d8647b79SSteffen Klassert
25177deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
2518d8647b79SSteffen Klassert + nla_total_size(replay_size)
2519de95c4a4SNicolas Dichtel + nla_total_size_64bit(sizeof(struct xfrm_lifetime_cur))
25206f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark))
25217deb2264SThomas Graf + nla_total_size(4) /* XFRM_AE_RTHR */
2522a4a87fa4SAntony Antony + nla_total_size(4) /* XFRM_AE_ETHR */
2523a4a87fa4SAntony Antony + nla_total_size(sizeof(x->dir)); /* XFRMA_SA_DIR */
25247deb2264SThomas Graf }
2525d51d081dSJamal Hadi Salim
build_aevent(struct sk_buff * skb,struct xfrm_state * x,const struct km_event * c)2526214e005bSDavid S. Miller static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
2527d51d081dSJamal Hadi Salim {
2528d51d081dSJamal Hadi Salim struct xfrm_aevent_id *id;
2529d51d081dSJamal Hadi Salim struct nlmsghdr *nlh;
25301d1e34ddSDavid S. Miller int err;
2531d51d081dSJamal Hadi Salim
253215e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
253379b8b7f4SThomas Graf if (nlh == NULL)
253479b8b7f4SThomas Graf return -EMSGSIZE;
2535d51d081dSJamal Hadi Salim
25367b67c857SThomas Graf id = nlmsg_data(nlh);
2537931e79d7SMathias Krause memset(&id->sa_id, 0, sizeof(id->sa_id));
25382b5f6dccSJamal Hadi Salim memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr));
2539d51d081dSJamal Hadi Salim id->sa_id.spi = x->id.spi;
2540d51d081dSJamal Hadi Salim id->sa_id.family = x->props.family;
2541d51d081dSJamal Hadi Salim id->sa_id.proto = x->id.proto;
25422b5f6dccSJamal Hadi Salim memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr));
25432b5f6dccSJamal Hadi Salim id->reqid = x->props.reqid;
2544d51d081dSJamal Hadi Salim id->flags = c->data.aevent;
2545d51d081dSJamal Hadi Salim
2546d0fde795SDavid S. Miller if (x->replay_esn) {
25471d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
2548d8647b79SSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn),
25491d1e34ddSDavid S. Miller x->replay_esn);
2550d0fde795SDavid S. Miller } else {
25511d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
25521d1e34ddSDavid S. Miller &x->replay);
2553d0fde795SDavid S. Miller }
25541d1e34ddSDavid S. Miller if (err)
25551d1e34ddSDavid S. Miller goto out_cancel;
2556de95c4a4SNicolas Dichtel err = nla_put_64bit(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft,
2557de95c4a4SNicolas Dichtel XFRMA_PAD);
25581d1e34ddSDavid S. Miller if (err)
25591d1e34ddSDavid S. Miller goto out_cancel;
2560d8647b79SSteffen Klassert
25611d1e34ddSDavid S. Miller if (id->flags & XFRM_AE_RTHR) {
25621d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
25631d1e34ddSDavid S. Miller if (err)
25641d1e34ddSDavid S. Miller goto out_cancel;
25651d1e34ddSDavid S. Miller }
25661d1e34ddSDavid S. Miller if (id->flags & XFRM_AE_ETHR) {
25671d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_ETIMER_THRESH,
25681d1e34ddSDavid S. Miller x->replay_maxage * 10 / HZ);
25691d1e34ddSDavid S. Miller if (err)
25701d1e34ddSDavid S. Miller goto out_cancel;
25711d1e34ddSDavid S. Miller }
25721d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &x->mark);
25731d1e34ddSDavid S. Miller if (err)
25741d1e34ddSDavid S. Miller goto out_cancel;
25756f26b61eSJamal Hadi Salim
25767e652640SSteffen Klassert err = xfrm_if_id_put(skb, x->if_id);
25777e652640SSteffen Klassert if (err)
25787e652640SSteffen Klassert goto out_cancel;
25797e652640SSteffen Klassert
2580a4a87fa4SAntony Antony if (x->dir) {
2581a4a87fa4SAntony Antony err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir);
2582a4a87fa4SAntony Antony if (err)
2583a4a87fa4SAntony Antony goto out_cancel;
2584a4a87fa4SAntony Antony }
2585a4a87fa4SAntony Antony
2586053c095aSJohannes Berg nlmsg_end(skb, nlh);
2587053c095aSJohannes Berg return 0;
2588d51d081dSJamal Hadi Salim
25891d1e34ddSDavid S. Miller out_cancel:
25909825069dSThomas Graf nlmsg_cancel(skb, nlh);
25911d1e34ddSDavid S. Miller return err;
2592d51d081dSJamal Hadi Salim }
2593d51d081dSJamal Hadi Salim
xfrm_get_ae(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)259422e70050SChristoph Hellwig static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
25953bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
2596d51d081dSJamal Hadi Salim {
2597fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
2598d51d081dSJamal Hadi Salim struct xfrm_state *x;
2599d51d081dSJamal Hadi Salim struct sk_buff *r_skb;
2600d51d081dSJamal Hadi Salim int err;
2601d51d081dSJamal Hadi Salim struct km_event c;
26026f26b61eSJamal Hadi Salim u32 mark;
26036f26b61eSJamal Hadi Salim struct xfrm_mark m;
26047b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh);
2605d51d081dSJamal Hadi Salim struct xfrm_usersa_id *id = &p->sa_id;
2606d51d081dSJamal Hadi Salim
26076f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m);
26086f26b61eSJamal Hadi Salim
26096f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
2610d8647b79SSteffen Klassert if (x == NULL)
2611d51d081dSJamal Hadi Salim return -ESRCH;
2612d8647b79SSteffen Klassert
2613d8647b79SSteffen Klassert r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
2614d8647b79SSteffen Klassert if (r_skb == NULL) {
2615d8647b79SSteffen Klassert xfrm_state_put(x);
2616d8647b79SSteffen Klassert return -ENOMEM;
2617d51d081dSJamal Hadi Salim }
2618d51d081dSJamal Hadi Salim
2619d51d081dSJamal Hadi Salim /*
2620d51d081dSJamal Hadi Salim * XXX: is this lock really needed - none of the other
2621d51d081dSJamal Hadi Salim * gets lock (the concern is things getting updated
2622d51d081dSJamal Hadi Salim * while we are still reading) - jhs
2623d51d081dSJamal Hadi Salim */
2624d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock);
2625d51d081dSJamal Hadi Salim c.data.aevent = p->flags;
2626d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
262715e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
2628d51d081dSJamal Hadi Salim
26292fc5f83bSGustavo A. R. Silva err = build_aevent(r_skb, x, &c);
26302fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
26312fc5f83bSGustavo A. R. Silva
263215e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
2633d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock);
2634d51d081dSJamal Hadi Salim xfrm_state_put(x);
2635d51d081dSJamal Hadi Salim return err;
2636d51d081dSJamal Hadi Salim }
2637d51d081dSJamal Hadi Salim
xfrm_new_ae(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)263822e70050SChristoph Hellwig static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
26393bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
2640d51d081dSJamal Hadi Salim {
2641fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
2642d51d081dSJamal Hadi Salim struct xfrm_state *x;
2643d51d081dSJamal Hadi Salim struct km_event c;
2644d51d081dSJamal Hadi Salim int err = -EINVAL;
26456f26b61eSJamal Hadi Salim u32 mark = 0;
26466f26b61eSJamal Hadi Salim struct xfrm_mark m;
26477b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh);
26485424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
2649d8647b79SSteffen Klassert struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
26505424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
26514e077237SMichael Rossberg struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
26524e077237SMichael Rossberg struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
2653d51d081dSJamal Hadi Salim
2654643bc1a2SSabrina Dubroca if (!lt && !rp && !re && !et && !rt) {
2655643bc1a2SSabrina Dubroca NL_SET_ERR_MSG(extack, "Missing required attribute for AE");
2656d51d081dSJamal Hadi Salim return err;
2657643bc1a2SSabrina Dubroca }
2658d51d081dSJamal Hadi Salim
2659d51d081dSJamal Hadi Salim /* pedantic mode - thou shalt sayeth replaceth */
2660643bc1a2SSabrina Dubroca if (!(nlh->nlmsg_flags & NLM_F_REPLACE)) {
2661643bc1a2SSabrina Dubroca NL_SET_ERR_MSG(extack, "NLM_F_REPLACE flag is required");
2662d51d081dSJamal Hadi Salim return err;
2663643bc1a2SSabrina Dubroca }
2664d51d081dSJamal Hadi Salim
26656f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m);
26666f26b61eSJamal Hadi Salim
26676f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
2668d51d081dSJamal Hadi Salim if (x == NULL)
2669d51d081dSJamal Hadi Salim return -ESRCH;
2670d51d081dSJamal Hadi Salim
2671643bc1a2SSabrina Dubroca if (x->km.state != XFRM_STATE_VALID) {
2672643bc1a2SSabrina Dubroca NL_SET_ERR_MSG(extack, "SA must be in VALID state");
2673d51d081dSJamal Hadi Salim goto out;
2674643bc1a2SSabrina Dubroca }
2675d51d081dSJamal Hadi Salim
2676643bc1a2SSabrina Dubroca err = xfrm_replay_verify_len(x->replay_esn, re, extack);
2677e2b19125SSteffen Klassert if (err)
2678e2b19125SSteffen Klassert goto out;
2679e2b19125SSteffen Klassert
2680d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock);
2681e3ac104dSMathias Krause xfrm_update_ae_params(x, attrs, 1);
2682d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock);
2683d51d081dSJamal Hadi Salim
2684d51d081dSJamal Hadi Salim c.event = nlh->nlmsg_type;
2685d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
268615e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
2687d51d081dSJamal Hadi Salim c.data.aevent = XFRM_AE_CU;
2688d51d081dSJamal Hadi Salim km_state_notify(x, &c);
2689d51d081dSJamal Hadi Salim err = 0;
2690d51d081dSJamal Hadi Salim out:
2691d51d081dSJamal Hadi Salim xfrm_state_put(x);
2692d51d081dSJamal Hadi Salim return err;
2693d51d081dSJamal Hadi Salim }
2694d51d081dSJamal Hadi Salim
xfrm_flush_policy(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)269522e70050SChristoph Hellwig static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
26963bec6c3eSSabrina Dubroca struct nlattr **attrs,
26973bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
26981da177e4SLinus Torvalds {
2699fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
270026b15dadSJamal Hadi Salim struct km_event c;
2701b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN;
2702f7b6983fSMasahide NAKAMURA int err;
270326b15dadSJamal Hadi Salim
2704fb7deabaSSabrina Dubroca err = copy_from_user_policy_type(&type, attrs, extack);
2705f7b6983fSMasahide NAKAMURA if (err)
2706f7b6983fSMasahide NAKAMURA return err;
2707f7b6983fSMasahide NAKAMURA
27082e71029eSTetsuo Handa err = xfrm_policy_flush(net, type, true);
27092f1eb65fSJamal Hadi Salim if (err) {
27102f1eb65fSJamal Hadi Salim if (err == -ESRCH) /* empty table */
27112f1eb65fSJamal Hadi Salim return 0;
2712069c474eSDavid S. Miller return err;
27132f1eb65fSJamal Hadi Salim }
27142f1eb65fSJamal Hadi Salim
2715f7b6983fSMasahide NAKAMURA c.data.type = type;
2716f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type;
271726b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq;
271815e47304SEric W. Biederman c.portid = nlh->nlmsg_pid;
27197067802eSAlexey Dobriyan c.net = net;
272026b15dadSJamal Hadi Salim km_policy_notify(NULL, 0, &c);
27211da177e4SLinus Torvalds return 0;
27221da177e4SLinus Torvalds }
27231da177e4SLinus Torvalds
xfrm_add_pol_expire(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)272422e70050SChristoph Hellwig static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
27253bec6c3eSSabrina Dubroca struct nlattr **attrs,
27263bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
27276c5c8ca7SJamal Hadi Salim {
2728fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
27296c5c8ca7SJamal Hadi Salim struct xfrm_policy *xp;
27307b67c857SThomas Graf struct xfrm_user_polexpire *up = nlmsg_data(nlh);
27316c5c8ca7SJamal Hadi Salim struct xfrm_userpolicy_info *p = &up->pol;
2732b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN;
27336c5c8ca7SJamal Hadi Salim int err = -ENOENT;
2734295fae56SJamal Hadi Salim struct xfrm_mark m;
27357e652640SSteffen Klassert u32 if_id = 0;
27366c5c8ca7SJamal Hadi Salim
2737fb7deabaSSabrina Dubroca err = copy_from_user_policy_type(&type, attrs, extack);
2738f7b6983fSMasahide NAKAMURA if (err)
2739f7b6983fSMasahide NAKAMURA return err;
2740f7b6983fSMasahide NAKAMURA
274124fc544fSSabrina Dubroca err = verify_policy_dir(p->dir, extack);
2742c8bf4d04STimo Teräs if (err)
2743c8bf4d04STimo Teräs return err;
2744c8bf4d04STimo Teräs
27457e652640SSteffen Klassert if (attrs[XFRMA_IF_ID])
27467e652640SSteffen Klassert if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
27477e652640SSteffen Klassert
27484f47e8abSXin Long xfrm_mark_get(attrs, &m);
27494f47e8abSXin Long
27506c5c8ca7SJamal Hadi Salim if (p->index)
27514f47e8abSXin Long xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index,
27524f47e8abSXin Long 0, &err);
27536c5c8ca7SJamal Hadi Salim else {
27545424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX];
275503e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx;
27566c5c8ca7SJamal Hadi Salim
275708a717e4SSabrina Dubroca err = verify_sec_ctx_len(attrs, extack);
27586c5c8ca7SJamal Hadi Salim if (err)
27596c5c8ca7SJamal Hadi Salim return err;
27606c5c8ca7SJamal Hadi Salim
27612c8dd116SDenis V. Lunev ctx = NULL;
27626c5c8ca7SJamal Hadi Salim if (rt) {
27635424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt);
27646c5c8ca7SJamal Hadi Salim
276552a4c640SNikolay Aleksandrov err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
276603e1ad7bSPaul Moore if (err)
27676c5c8ca7SJamal Hadi Salim return err;
27682c8dd116SDenis V. Lunev }
27694f47e8abSXin Long xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
27706f26b61eSJamal Hadi Salim &p->sel, ctx, 0, &err);
277103e1ad7bSPaul Moore security_xfrm_policy_free(ctx);
27726c5c8ca7SJamal Hadi Salim }
27736c5c8ca7SJamal Hadi Salim if (xp == NULL)
2774ef41aaa0SEric Paris return -ENOENT;
277503e1ad7bSPaul Moore
2776ea2dea9dSTimo Teräs if (unlikely(xp->walk.dead))
27776c5c8ca7SJamal Hadi Salim goto out;
27786c5c8ca7SJamal Hadi Salim
27796c5c8ca7SJamal Hadi Salim err = 0;
27806c5c8ca7SJamal Hadi Salim if (up->hard) {
27816c5c8ca7SJamal Hadi Salim xfrm_policy_delete(xp, p->dir);
27822e71029eSTetsuo Handa xfrm_audit_policy_delete(xp, 1, true);
27836c5c8ca7SJamal Hadi Salim }
2784c6bb8136SEric W. Biederman km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
27856c5c8ca7SJamal Hadi Salim
27866c5c8ca7SJamal Hadi Salim out:
27876c5c8ca7SJamal Hadi Salim xfrm_pol_put(xp);
27886c5c8ca7SJamal Hadi Salim return err;
27896c5c8ca7SJamal Hadi Salim }
27906c5c8ca7SJamal Hadi Salim
xfrm_add_sa_expire(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)279122e70050SChristoph Hellwig static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
27923bec6c3eSSabrina Dubroca struct nlattr **attrs,
27933bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
279453bc6b4dSJamal Hadi Salim {
2795fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
279653bc6b4dSJamal Hadi Salim struct xfrm_state *x;
279753bc6b4dSJamal Hadi Salim int err;
27987b67c857SThomas Graf struct xfrm_user_expire *ue = nlmsg_data(nlh);
279953bc6b4dSJamal Hadi Salim struct xfrm_usersa_info *p = &ue->state;
28006f26b61eSJamal Hadi Salim struct xfrm_mark m;
2801928497f0SNicolas Dichtel u32 mark = xfrm_mark_get(attrs, &m);
280253bc6b4dSJamal Hadi Salim
28036f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
280453bc6b4dSJamal Hadi Salim
28053a765aa5SDavid S. Miller err = -ENOENT;
280653bc6b4dSJamal Hadi Salim if (x == NULL)
280753bc6b4dSJamal Hadi Salim return err;
280853bc6b4dSJamal Hadi Salim
280953bc6b4dSJamal Hadi Salim spin_lock_bh(&x->lock);
28103a765aa5SDavid S. Miller err = -EINVAL;
2811a25b19f3SSabrina Dubroca if (x->km.state != XFRM_STATE_VALID) {
2812a25b19f3SSabrina Dubroca NL_SET_ERR_MSG(extack, "SA must be in VALID state");
281353bc6b4dSJamal Hadi Salim goto out;
2814a25b19f3SSabrina Dubroca }
2815a25b19f3SSabrina Dubroca
2816c6bb8136SEric W. Biederman km_state_expired(x, ue->hard, nlh->nlmsg_pid);
281753bc6b4dSJamal Hadi Salim
2818161a09e7SJoy Latten if (ue->hard) {
281953bc6b4dSJamal Hadi Salim __xfrm_state_delete(x);
28202e71029eSTetsuo Handa xfrm_audit_state_delete(x, 1, true);
2821161a09e7SJoy Latten }
28223a765aa5SDavid S. Miller err = 0;
282353bc6b4dSJamal Hadi Salim out:
282453bc6b4dSJamal Hadi Salim spin_unlock_bh(&x->lock);
282553bc6b4dSJamal Hadi Salim xfrm_state_put(x);
282653bc6b4dSJamal Hadi Salim return err;
282753bc6b4dSJamal Hadi Salim }
282853bc6b4dSJamal Hadi Salim
xfrm_add_acquire(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)282922e70050SChristoph Hellwig static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
28303bec6c3eSSabrina Dubroca struct nlattr **attrs,
28313bec6c3eSSabrina Dubroca struct netlink_ext_ack *extack)
2832980ebd25SJamal Hadi Salim {
2833fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk);
2834980ebd25SJamal Hadi Salim struct xfrm_policy *xp;
2835980ebd25SJamal Hadi Salim struct xfrm_user_tmpl *ut;
2836980ebd25SJamal Hadi Salim int i;
28375424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL];
28386f26b61eSJamal Hadi Salim struct xfrm_mark mark;
2839980ebd25SJamal Hadi Salim
28407b67c857SThomas Graf struct xfrm_user_acquire *ua = nlmsg_data(nlh);
2841fc34acd3SAlexey Dobriyan struct xfrm_state *x = xfrm_state_alloc(net);
2842980ebd25SJamal Hadi Salim int err = -ENOMEM;
2843980ebd25SJamal Hadi Salim
2844980ebd25SJamal Hadi Salim if (!x)
2845d8eb9307SIlpo Järvinen goto nomem;
2846980ebd25SJamal Hadi Salim
28476f26b61eSJamal Hadi Salim xfrm_mark_get(attrs, &mark);
28486f26b61eSJamal Hadi Salim
2849ec2b4f01SSabrina Dubroca err = verify_newpolicy_info(&ua->policy, extack);
2850d8eb9307SIlpo Järvinen if (err)
285173efc324SVegard Nossum goto free_state;
285208a717e4SSabrina Dubroca err = verify_sec_ctx_len(attrs, extack);
2853a1a7e3a3SXin Long if (err)
2854a1a7e3a3SXin Long goto free_state;
2855980ebd25SJamal Hadi Salim
2856980ebd25SJamal Hadi Salim /* build an XP */
2857fb7deabaSSabrina Dubroca xp = xfrm_policy_construct(net, &ua->policy, attrs, &err, extack);
2858d8eb9307SIlpo Järvinen if (!xp)
2859d8eb9307SIlpo Järvinen goto free_state;
2860980ebd25SJamal Hadi Salim
2861980ebd25SJamal Hadi Salim memcpy(&x->id, &ua->id, sizeof(ua->id));
2862980ebd25SJamal Hadi Salim memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
2863980ebd25SJamal Hadi Salim memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
28646f26b61eSJamal Hadi Salim xp->mark.m = x->mark.m = mark.m;
28656f26b61eSJamal Hadi Salim xp->mark.v = x->mark.v = mark.v;
28665424f32eSThomas Graf ut = nla_data(rt);
2867980ebd25SJamal Hadi Salim /* extract the templates and for each call km_key */
2868980ebd25SJamal Hadi Salim for (i = 0; i < xp->xfrm_nr; i++, ut++) {
2869980ebd25SJamal Hadi Salim struct xfrm_tmpl *t = &xp->xfrm_vec[i];
2870980ebd25SJamal Hadi Salim memcpy(&x->id, &t->id, sizeof(x->id));
2871980ebd25SJamal Hadi Salim x->props.mode = t->mode;
2872980ebd25SJamal Hadi Salim x->props.reqid = t->reqid;
2873980ebd25SJamal Hadi Salim x->props.family = ut->family;
2874980ebd25SJamal Hadi Salim t->aalgos = ua->aalgos;
2875980ebd25SJamal Hadi Salim t->ealgos = ua->ealgos;
2876980ebd25SJamal Hadi Salim t->calgos = ua->calgos;
2877980ebd25SJamal Hadi Salim err = km_query(x, t, xp);
2878980ebd25SJamal Hadi Salim
2879980ebd25SJamal Hadi Salim }
2880980ebd25SJamal Hadi Salim
28814a135e53SMathias Krause xfrm_state_free(x);
2882980ebd25SJamal Hadi Salim kfree(xp);
2883980ebd25SJamal Hadi Salim
2884980ebd25SJamal Hadi Salim return 0;
2885d8eb9307SIlpo Järvinen
2886d8eb9307SIlpo Järvinen free_state:
28874a135e53SMathias Krause xfrm_state_free(x);
2888d8eb9307SIlpo Järvinen nomem:
2889d8eb9307SIlpo Järvinen return err;
2890980ebd25SJamal Hadi Salim }
2891980ebd25SJamal Hadi Salim
28925c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE
copy_from_user_migrate(struct xfrm_migrate * ma,struct xfrm_kmaddress * k,struct nlattr ** attrs,int * num,struct netlink_ext_ack * extack)28935c79de6eSShinta Sugimoto static int copy_from_user_migrate(struct xfrm_migrate *ma,
289413c1d189SArnaud Ebalard struct xfrm_kmaddress *k,
2895bd122403SSabrina Dubroca struct nlattr **attrs, int *num,
2896bd122403SSabrina Dubroca struct netlink_ext_ack *extack)
28975c79de6eSShinta Sugimoto {
28985424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_MIGRATE];
28995c79de6eSShinta Sugimoto struct xfrm_user_migrate *um;
29005c79de6eSShinta Sugimoto int i, num_migrate;
29015c79de6eSShinta Sugimoto
290213c1d189SArnaud Ebalard if (k != NULL) {
290313c1d189SArnaud Ebalard struct xfrm_user_kmaddress *uk;
290413c1d189SArnaud Ebalard
290513c1d189SArnaud Ebalard uk = nla_data(attrs[XFRMA_KMADDRESS]);
290613c1d189SArnaud Ebalard memcpy(&k->local, &uk->local, sizeof(k->local));
290713c1d189SArnaud Ebalard memcpy(&k->remote, &uk->remote, sizeof(k->remote));
290813c1d189SArnaud Ebalard k->family = uk->family;
290913c1d189SArnaud Ebalard k->reserved = uk->reserved;
291013c1d189SArnaud Ebalard }
291113c1d189SArnaud Ebalard
29125424f32eSThomas Graf um = nla_data(rt);
29135424f32eSThomas Graf num_migrate = nla_len(rt) / sizeof(*um);
29145c79de6eSShinta Sugimoto
2915bd122403SSabrina Dubroca if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH) {
2916bd122403SSabrina Dubroca NL_SET_ERR_MSG(extack, "Invalid number of SAs to migrate, must be 0 < num <= XFRM_MAX_DEPTH (6)");
29175c79de6eSShinta Sugimoto return -EINVAL;
2918bd122403SSabrina Dubroca }
29195c79de6eSShinta Sugimoto
29205c79de6eSShinta Sugimoto for (i = 0; i < num_migrate; i++, um++, ma++) {
29215c79de6eSShinta Sugimoto memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
29225c79de6eSShinta Sugimoto memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
29235c79de6eSShinta Sugimoto memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
29245c79de6eSShinta Sugimoto memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
29255c79de6eSShinta Sugimoto
29265c79de6eSShinta Sugimoto ma->proto = um->proto;
29275c79de6eSShinta Sugimoto ma->mode = um->mode;
29285c79de6eSShinta Sugimoto ma->reqid = um->reqid;
29295c79de6eSShinta Sugimoto
29305c79de6eSShinta Sugimoto ma->old_family = um->old_family;
29315c79de6eSShinta Sugimoto ma->new_family = um->new_family;
29325c79de6eSShinta Sugimoto }
29335c79de6eSShinta Sugimoto
29345c79de6eSShinta Sugimoto *num = i;
29355c79de6eSShinta Sugimoto return 0;
29365c79de6eSShinta Sugimoto }
29375c79de6eSShinta Sugimoto
xfrm_do_migrate(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)29385c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
29393bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
29405c79de6eSShinta Sugimoto {
29417b67c857SThomas Graf struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
29425c79de6eSShinta Sugimoto struct xfrm_migrate m[XFRM_MAX_DEPTH];
294313c1d189SArnaud Ebalard struct xfrm_kmaddress km, *kmp;
29445c79de6eSShinta Sugimoto u8 type;
29455c79de6eSShinta Sugimoto int err;
29465c79de6eSShinta Sugimoto int n = 0;
29478d549c4fSFan Du struct net *net = sock_net(skb->sk);
29484ab47d47SAntony Antony struct xfrm_encap_tmpl *encap = NULL;
2949c1aca308SYan Yan u32 if_id = 0;
29505c79de6eSShinta Sugimoto
2951bd122403SSabrina Dubroca if (!attrs[XFRMA_MIGRATE]) {
2952bd122403SSabrina Dubroca NL_SET_ERR_MSG(extack, "Missing required MIGRATE attribute");
2953cf5cb79fSThomas Graf return -EINVAL;
2954bd122403SSabrina Dubroca }
29555c79de6eSShinta Sugimoto
295613c1d189SArnaud Ebalard kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;
295713c1d189SArnaud Ebalard
2958fb7deabaSSabrina Dubroca err = copy_from_user_policy_type(&type, attrs, extack);
29595c79de6eSShinta Sugimoto if (err)
29605c79de6eSShinta Sugimoto return err;
29615c79de6eSShinta Sugimoto
2962bd122403SSabrina Dubroca err = copy_from_user_migrate(m, kmp, attrs, &n, extack);
29635c79de6eSShinta Sugimoto if (err)
29645c79de6eSShinta Sugimoto return err;
29655c79de6eSShinta Sugimoto
29665c79de6eSShinta Sugimoto if (!n)
29675c79de6eSShinta Sugimoto return 0;
29685c79de6eSShinta Sugimoto
29694ab47d47SAntony Antony if (attrs[XFRMA_ENCAP]) {
29704ab47d47SAntony Antony encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
29714ab47d47SAntony Antony sizeof(*encap), GFP_KERNEL);
29724ab47d47SAntony Antony if (!encap)
29734ac7a6eeSZheng Yongjun return -ENOMEM;
29745c79de6eSShinta Sugimoto }
29754ab47d47SAntony Antony
2976c1aca308SYan Yan if (attrs[XFRMA_IF_ID])
2977c1aca308SYan Yan if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
2978c1aca308SYan Yan
2979bd122403SSabrina Dubroca err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap,
2980bd122403SSabrina Dubroca if_id, extack);
29814ab47d47SAntony Antony
29824ab47d47SAntony Antony kfree(encap);
29834ab47d47SAntony Antony
29844ab47d47SAntony Antony return err;
29854ab47d47SAntony Antony }
29865c79de6eSShinta Sugimoto #else
xfrm_do_migrate(struct sk_buff * skb,struct nlmsghdr * nlh,struct nlattr ** attrs,struct netlink_ext_ack * extack)29875c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
29883bec6c3eSSabrina Dubroca struct nlattr **attrs, struct netlink_ext_ack *extack)
29895c79de6eSShinta Sugimoto {
29905c79de6eSShinta Sugimoto return -ENOPROTOOPT;
29915c79de6eSShinta Sugimoto }
29925c79de6eSShinta Sugimoto #endif
29935c79de6eSShinta Sugimoto
29945c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE
copy_to_user_migrate(const struct xfrm_migrate * m,struct sk_buff * skb)2995183cad12SDavid S. Miller static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
29965c79de6eSShinta Sugimoto {
29975c79de6eSShinta Sugimoto struct xfrm_user_migrate um;
29985c79de6eSShinta Sugimoto
29995c79de6eSShinta Sugimoto memset(&um, 0, sizeof(um));
30005c79de6eSShinta Sugimoto um.proto = m->proto;
30015c79de6eSShinta Sugimoto um.mode = m->mode;
30025c79de6eSShinta Sugimoto um.reqid = m->reqid;
30035c79de6eSShinta Sugimoto um.old_family = m->old_family;
30045c79de6eSShinta Sugimoto memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
30055c79de6eSShinta Sugimoto memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
30065c79de6eSShinta Sugimoto um.new_family = m->new_family;
30075c79de6eSShinta Sugimoto memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
30085c79de6eSShinta Sugimoto memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
30095c79de6eSShinta Sugimoto
3010c0144beaSThomas Graf return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
30115c79de6eSShinta Sugimoto }
30125c79de6eSShinta Sugimoto
copy_to_user_kmaddress(const struct xfrm_kmaddress * k,struct sk_buff * skb)3013183cad12SDavid S. Miller static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
301413c1d189SArnaud Ebalard {
301513c1d189SArnaud Ebalard struct xfrm_user_kmaddress uk;
301613c1d189SArnaud Ebalard
301713c1d189SArnaud Ebalard memset(&uk, 0, sizeof(uk));
301813c1d189SArnaud Ebalard uk.family = k->family;
301913c1d189SArnaud Ebalard uk.reserved = k->reserved;
302013c1d189SArnaud Ebalard memcpy(&uk.local, &k->local, sizeof(uk.local));
3021a1caa322SArnaud Ebalard memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
302213c1d189SArnaud Ebalard
302313c1d189SArnaud Ebalard return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
302413c1d189SArnaud Ebalard }
302513c1d189SArnaud Ebalard
xfrm_migrate_msgsize(int num_migrate,int with_kma,int with_encp)3026a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_migrate_msgsize(int num_migrate, int with_kma,
30278bafd730SAntony Antony int with_encp)
30287deb2264SThomas Graf {
30297deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
303013c1d189SArnaud Ebalard + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
30318bafd730SAntony Antony + (with_encp ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0)
30327deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
30337deb2264SThomas Graf + userpolicy_type_attrsize();
30347deb2264SThomas Graf }
30357deb2264SThomas Graf
build_migrate(struct sk_buff * skb,const struct xfrm_migrate * m,int num_migrate,const struct xfrm_kmaddress * k,const struct xfrm_selector * sel,const struct xfrm_encap_tmpl * encap,u8 dir,u8 type)3036183cad12SDavid S. Miller static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
3037183cad12SDavid S. Miller int num_migrate, const struct xfrm_kmaddress *k,
30388bafd730SAntony Antony const struct xfrm_selector *sel,
30398bafd730SAntony Antony const struct xfrm_encap_tmpl *encap, u8 dir, u8 type)
30405c79de6eSShinta Sugimoto {
3041183cad12SDavid S. Miller const struct xfrm_migrate *mp;
30425c79de6eSShinta Sugimoto struct xfrm_userpolicy_id *pol_id;
30435c79de6eSShinta Sugimoto struct nlmsghdr *nlh;
30441d1e34ddSDavid S. Miller int i, err;
30455c79de6eSShinta Sugimoto
304679b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
304779b8b7f4SThomas Graf if (nlh == NULL)
304879b8b7f4SThomas Graf return -EMSGSIZE;
30495c79de6eSShinta Sugimoto
30507b67c857SThomas Graf pol_id = nlmsg_data(nlh);
30515c79de6eSShinta Sugimoto /* copy data from selector, dir, and type to the pol_id */
30525c79de6eSShinta Sugimoto memset(pol_id, 0, sizeof(*pol_id));
30535c79de6eSShinta Sugimoto memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
30545c79de6eSShinta Sugimoto pol_id->dir = dir;
30555c79de6eSShinta Sugimoto
30561d1e34ddSDavid S. Miller if (k != NULL) {
30571d1e34ddSDavid S. Miller err = copy_to_user_kmaddress(k, skb);
30581d1e34ddSDavid S. Miller if (err)
30591d1e34ddSDavid S. Miller goto out_cancel;
30601d1e34ddSDavid S. Miller }
30618bafd730SAntony Antony if (encap) {
30628bafd730SAntony Antony err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap);
30638bafd730SAntony Antony if (err)
30648bafd730SAntony Antony goto out_cancel;
30658bafd730SAntony Antony }
30661d1e34ddSDavid S. Miller err = copy_to_user_policy_type(type, skb);
30671d1e34ddSDavid S. Miller if (err)
30681d1e34ddSDavid S. Miller goto out_cancel;
30695c79de6eSShinta Sugimoto for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
30701d1e34ddSDavid S. Miller err = copy_to_user_migrate(mp, skb);
30711d1e34ddSDavid S. Miller if (err)
30721d1e34ddSDavid S. Miller goto out_cancel;
30735c79de6eSShinta Sugimoto }
30745c79de6eSShinta Sugimoto
3075053c095aSJohannes Berg nlmsg_end(skb, nlh);
3076053c095aSJohannes Berg return 0;
30771d1e34ddSDavid S. Miller
30781d1e34ddSDavid S. Miller out_cancel:
30799825069dSThomas Graf nlmsg_cancel(skb, nlh);
30801d1e34ddSDavid S. Miller return err;
30815c79de6eSShinta Sugimoto }
30825c79de6eSShinta Sugimoto
xfrm_send_migrate(const struct xfrm_selector * sel,u8 dir,u8 type,const struct xfrm_migrate * m,int num_migrate,const struct xfrm_kmaddress * k,const struct xfrm_encap_tmpl * encap)3083183cad12SDavid S. Miller static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
3084183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_migrate,
30858bafd730SAntony Antony const struct xfrm_kmaddress *k,
30868bafd730SAntony Antony const struct xfrm_encap_tmpl *encap)
30875c79de6eSShinta Sugimoto {
3088a6483b79SAlexey Dobriyan struct net *net = &init_net;
30895c79de6eSShinta Sugimoto struct sk_buff *skb;
30902fc5f83bSGustavo A. R. Silva int err;
30915c79de6eSShinta Sugimoto
30928bafd730SAntony Antony skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap),
30938bafd730SAntony Antony GFP_ATOMIC);
30945c79de6eSShinta Sugimoto if (skb == NULL)
30955c79de6eSShinta Sugimoto return -ENOMEM;
30965c79de6eSShinta Sugimoto
30975c79de6eSShinta Sugimoto /* build migrate */
30982fc5f83bSGustavo A. R. Silva err = build_migrate(skb, m, num_migrate, k, sel, encap, dir, type);
30992fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
31005c79de6eSShinta Sugimoto
310121ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
31025c79de6eSShinta Sugimoto }
31035c79de6eSShinta Sugimoto #else
xfrm_send_migrate(const struct xfrm_selector * sel,u8 dir,u8 type,const struct xfrm_migrate * m,int num_migrate,const struct xfrm_kmaddress * k,const struct xfrm_encap_tmpl * encap)3104183cad12SDavid S. Miller static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
3105183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_migrate,
31068bafd730SAntony Antony const struct xfrm_kmaddress *k,
31078bafd730SAntony Antony const struct xfrm_encap_tmpl *encap)
31085c79de6eSShinta Sugimoto {
31095c79de6eSShinta Sugimoto return -ENOPROTOOPT;
31105c79de6eSShinta Sugimoto }
31115c79de6eSShinta Sugimoto #endif
3112d51d081dSJamal Hadi Salim
3113a7bd9a45SThomas Graf #define XMSGSIZE(type) sizeof(struct type)
3114492b558bSThomas Graf
31155461fc0cSDmitry Safonov const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
311666f9a259SDavid S. Miller [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
3117492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
3118492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
3119492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
3120492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
3121492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
3122492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
3123980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
312453bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
3125492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
312666f9a259SDavid S. Miller [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
31276c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
3128492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
3129a7bd9a45SThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
3130d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
3131d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
313297a64b45SMasahide NAKAMURA [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
31335c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
3134a7bd9a45SThomas Graf [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
3135880a6fabSChristophe Gouault [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
3136a7bd9a45SThomas Graf [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
31372d151d39SSteffen Klassert [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default),
31382d151d39SSteffen Klassert [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default),
31391da177e4SLinus Torvalds };
31405461fc0cSDmitry Safonov EXPORT_SYMBOL_GPL(xfrm_msg_min);
31411da177e4SLinus Torvalds
3142492b558bSThomas Graf #undef XMSGSIZE
3143492b558bSThomas Graf
31445106f4a8SDmitry Safonov const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
3145a4a87fa4SAntony Antony [XFRMA_UNSPEC] = { .strict_start_type = XFRMA_SA_DIR },
3146c28e9304Sjamal [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)},
3147c28e9304Sjamal [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)},
3148c28e9304Sjamal [XFRMA_LASTUSED] = { .type = NLA_U64},
3149c28e9304Sjamal [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)},
31501a6509d9SHerbert Xu [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) },
3151cf5cb79fSThomas Graf [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
3152cf5cb79fSThomas Graf [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
3153cf5cb79fSThomas Graf [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
3154cf5cb79fSThomas Graf [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
3155cf5cb79fSThomas Graf [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
3156d1e0e61dSLin Ma [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) },
3157cf5cb79fSThomas Graf [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
3158cf5cb79fSThomas Graf [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
3159cf5cb79fSThomas Graf [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
3160cf5cb79fSThomas Graf [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
3161cf5cb79fSThomas Graf [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
3162cf5cb79fSThomas Graf [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
3163cf5cb79fSThomas Graf [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
3164cf5cb79fSThomas Graf [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
316513c1d189SArnaud Ebalard [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
31666f26b61eSJamal Hadi Salim [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
316735d2856bSMartin Willi [XFRMA_TFCPAD] = { .type = NLA_U32 },
3168d8647b79SSteffen Klassert [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
3169a947b0a9SNicolas Dichtel [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 },
3170d3623099SNicolas Dichtel [XFRMA_PROTO] = { .type = NLA_U8 },
3171870a2df4SNicolas Dichtel [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) },
3172d77e38e6SSteffen Klassert [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) },
31739b42c1f1SSteffen Klassert [XFRMA_SET_MARK] = { .type = NLA_U32 },
31749b42c1f1SSteffen Klassert [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
31757e652640SSteffen Klassert [XFRMA_IF_ID] = { .type = NLA_U32 },
31765e242470SLin Ma [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 },
3177a4a87fa4SAntony Antony [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT),
3178*f531d13bSEyal Birger [XFRMA_NAT_KEEPALIVE_INTERVAL] = { .type = NLA_U32 },
3179cf5cb79fSThomas Graf };
31805106f4a8SDmitry Safonov EXPORT_SYMBOL_GPL(xfrma_policy);
3181cf5cb79fSThomas Graf
3182880a6fabSChristophe Gouault static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
3183880a6fabSChristophe Gouault [XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
3184880a6fabSChristophe Gouault [XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
3185880a6fabSChristophe Gouault };
3186880a6fabSChristophe Gouault
318705600a79SMathias Krause static const struct xfrm_link {
31883bec6c3eSSabrina Dubroca int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **,
31893bec6c3eSSabrina Dubroca struct netlink_ext_ack *);
31901137b5e2SHerbert Xu int (*start)(struct netlink_callback *);
31911da177e4SLinus Torvalds int (*dump)(struct sk_buff *, struct netlink_callback *);
31924c563f76STimo Teras int (*done)(struct netlink_callback *);
3193880a6fabSChristophe Gouault const struct nla_policy *nla_pol;
3194880a6fabSChristophe Gouault int nla_max;
3195492b558bSThomas Graf } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
3196492b558bSThomas Graf [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
3197492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa },
3198492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
31994c563f76STimo Teras .dump = xfrm_dump_sa,
32004c563f76STimo Teras .done = xfrm_dump_sa_done },
3201492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
3202492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
3203492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
32041137b5e2SHerbert Xu .start = xfrm_dump_policy_start,
32054c563f76STimo Teras .dump = xfrm_dump_policy,
32064c563f76STimo Teras .done = xfrm_dump_policy_done },
3207492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
3208980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire },
320953bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
3210492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
3211492b558bSThomas Graf [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
32126c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
3213492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa },
3214492b558bSThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy },
3215d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae },
3216d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae },
32175c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate },
321828d8909bSJamal Hadi Salim [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo },
3219880a6fabSChristophe Gouault [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo,
3220880a6fabSChristophe Gouault .nla_pol = xfrma_spd_policy,
3221880a6fabSChristophe Gouault .nla_max = XFRMA_SPD_MAX },
3222ecfd6b18SJamal Hadi Salim [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo },
32232d151d39SSteffen Klassert [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_set_default },
32242d151d39SSteffen Klassert [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_get_default },
32251da177e4SLinus Torvalds };
32261da177e4SLinus Torvalds
xfrm_reject_unused_attr(int type,struct nlattr ** attrs,struct netlink_ext_ack * extack)3227451b5096SAntony Antony static int xfrm_reject_unused_attr(int type, struct nlattr **attrs,
3228451b5096SAntony Antony struct netlink_ext_ack *extack)
3229451b5096SAntony Antony {
3230451b5096SAntony Antony if (attrs[XFRMA_SA_DIR]) {
3231451b5096SAntony Antony switch (type) {
3232451b5096SAntony Antony case XFRM_MSG_NEWSA:
3233451b5096SAntony Antony case XFRM_MSG_UPDSA:
3234451b5096SAntony Antony case XFRM_MSG_ALLOCSPI:
3235451b5096SAntony Antony break;
3236451b5096SAntony Antony default:
3237451b5096SAntony Antony NL_SET_ERR_MSG(extack, "Invalid attribute SA_DIR");
3238451b5096SAntony Antony return -EINVAL;
3239451b5096SAntony Antony }
3240451b5096SAntony Antony }
3241451b5096SAntony Antony
3242451b5096SAntony Antony return 0;
3243451b5096SAntony Antony }
3244451b5096SAntony Antony
xfrm_user_rcv_msg(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)32452d4bc933SJohannes Berg static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
32462d4bc933SJohannes Berg struct netlink_ext_ack *extack)
32471da177e4SLinus Torvalds {
3248a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk);
324935a7aa08SThomas Graf struct nlattr *attrs[XFRMA_MAX+1];
325005600a79SMathias Krause const struct xfrm_link *link;
32515106f4a8SDmitry Safonov struct nlmsghdr *nlh64 = NULL;
3252a7bd9a45SThomas Graf int type, err;
32531da177e4SLinus Torvalds
32541da177e4SLinus Torvalds type = nlh->nlmsg_type;
32551da177e4SLinus Torvalds if (type > XFRM_MSG_MAX)
32561d00a4ebSThomas Graf return -EINVAL;
32571da177e4SLinus Torvalds
32581da177e4SLinus Torvalds type -= XFRM_MSG_BASE;
32591da177e4SLinus Torvalds link = &xfrm_dispatch[type];
32601da177e4SLinus Torvalds
32611da177e4SLinus Torvalds /* All operations require privileges, even GET */
326290f62cf3SEric W. Biederman if (!netlink_net_capable(skb, CAP_NET_ADMIN))
32631d00a4ebSThomas Graf return -EPERM;
32641da177e4SLinus Torvalds
32655106f4a8SDmitry Safonov if (in_compat_syscall()) {
32665106f4a8SDmitry Safonov struct xfrm_translator *xtr = xfrm_get_translator();
32675106f4a8SDmitry Safonov
32685106f4a8SDmitry Safonov if (!xtr)
32695106f4a8SDmitry Safonov return -EOPNOTSUPP;
32705106f4a8SDmitry Safonov
32715106f4a8SDmitry Safonov nlh64 = xtr->rcv_msg_compat(nlh, link->nla_max,
32725106f4a8SDmitry Safonov link->nla_pol, extack);
32735106f4a8SDmitry Safonov xfrm_put_translator(xtr);
32745106f4a8SDmitry Safonov if (IS_ERR(nlh64))
32755106f4a8SDmitry Safonov return PTR_ERR(nlh64);
32765106f4a8SDmitry Safonov if (nlh64)
32775106f4a8SDmitry Safonov nlh = nlh64;
32785106f4a8SDmitry Safonov }
32795106f4a8SDmitry Safonov
3280492b558bSThomas Graf if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
3281492b558bSThomas Graf type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
3282b8f3ab42SDavid S. Miller (nlh->nlmsg_flags & NLM_F_DUMP)) {
328380d326faSPablo Neira Ayuso struct netlink_dump_control c = {
32841137b5e2SHerbert Xu .start = link->start,
328580d326faSPablo Neira Ayuso .dump = link->dump,
328680d326faSPablo Neira Ayuso .done = link->done,
328780d326faSPablo Neira Ayuso };
32885106f4a8SDmitry Safonov
32895106f4a8SDmitry Safonov if (link->dump == NULL) {
32905106f4a8SDmitry Safonov err = -EINVAL;
32915106f4a8SDmitry Safonov goto err;
329280d326faSPablo Neira Ayuso }
32935106f4a8SDmitry Safonov
32945106f4a8SDmitry Safonov err = netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
32955106f4a8SDmitry Safonov goto err;
32961da177e4SLinus Torvalds }
32971da177e4SLinus Torvalds
32988cb08174SJohannes Berg err = nlmsg_parse_deprecated(nlh, xfrm_msg_min[type], attrs,
3299880a6fabSChristophe Gouault link->nla_max ? : XFRMA_MAX,
3300fe52145fSJohannes Berg link->nla_pol ? : xfrma_policy, extack);
3301a7bd9a45SThomas Graf if (err < 0)
33025106f4a8SDmitry Safonov goto err;
33035106f4a8SDmitry Safonov
3304451b5096SAntony Antony if (!link->nla_pol || link->nla_pol == xfrma_policy) {
3305451b5096SAntony Antony err = xfrm_reject_unused_attr((type + XFRM_MSG_BASE), attrs, extack);
3306451b5096SAntony Antony if (err < 0)
3307451b5096SAntony Antony goto err;
3308451b5096SAntony Antony }
3309451b5096SAntony Antony
33105106f4a8SDmitry Safonov if (link->doit == NULL) {
33115106f4a8SDmitry Safonov err = -EINVAL;
33125106f4a8SDmitry Safonov goto err;
33135106f4a8SDmitry Safonov }
33145106f4a8SDmitry Safonov
33153bec6c3eSSabrina Dubroca err = link->doit(skb, nlh, attrs, extack);
33165106f4a8SDmitry Safonov
33177c1a80e8SPavel Skripkin /* We need to free skb allocated in xfrm_alloc_compat() before
33187c1a80e8SPavel Skripkin * returning from this function, because consume_skb() won't take
33197c1a80e8SPavel Skripkin * care of frag_list since netlink destructor sets
33207c1a80e8SPavel Skripkin * sbk->head to NULL. (see netlink_skb_destructor())
33217c1a80e8SPavel Skripkin */
33227c1a80e8SPavel Skripkin if (skb_has_frag_list(skb)) {
33237c1a80e8SPavel Skripkin kfree_skb(skb_shinfo(skb)->frag_list);
33247c1a80e8SPavel Skripkin skb_shinfo(skb)->frag_list = NULL;
33257c1a80e8SPavel Skripkin }
33267c1a80e8SPavel Skripkin
33275106f4a8SDmitry Safonov err:
33285106f4a8SDmitry Safonov kvfree(nlh64);
3329a7bd9a45SThomas Graf return err;
33301da177e4SLinus Torvalds }
33311da177e4SLinus Torvalds
xfrm_netlink_rcv(struct sk_buff * skb)3332cd40b7d3SDenis V. Lunev static void xfrm_netlink_rcv(struct sk_buff *skb)
33331da177e4SLinus Torvalds {
3334283bc9f3SFan Du struct net *net = sock_net(skb->sk);
3335283bc9f3SFan Du
3336283bc9f3SFan Du mutex_lock(&net->xfrm.xfrm_cfg_mutex);
3337cd40b7d3SDenis V. Lunev netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
3338283bc9f3SFan Du mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
33391da177e4SLinus Torvalds }
33401da177e4SLinus Torvalds
xfrm_expire_msgsize(void)3341a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_expire_msgsize(void)
33427deb2264SThomas Graf {
3343a4a87fa4SAntony Antony return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) +
3344a4a87fa4SAntony Antony nla_total_size(sizeof(struct xfrm_mark)) +
3345a4a87fa4SAntony Antony nla_total_size(sizeof_field(struct xfrm_state, dir));
33467deb2264SThomas Graf }
33477deb2264SThomas Graf
build_expire(struct sk_buff * skb,struct xfrm_state * x,const struct km_event * c)3348214e005bSDavid S. Miller static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
33491da177e4SLinus Torvalds {
33501da177e4SLinus Torvalds struct xfrm_user_expire *ue;
33511da177e4SLinus Torvalds struct nlmsghdr *nlh;
33521d1e34ddSDavid S. Miller int err;
33531da177e4SLinus Torvalds
335415e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
335579b8b7f4SThomas Graf if (nlh == NULL)
335679b8b7f4SThomas Graf return -EMSGSIZE;
33571da177e4SLinus Torvalds
33587b67c857SThomas Graf ue = nlmsg_data(nlh);
33591da177e4SLinus Torvalds copy_to_user_state(x, &ue->state);
3360d51d081dSJamal Hadi Salim ue->hard = (c->data.hard != 0) ? 1 : 0;
3361e3e5fc16SMathias Krause /* clear the padding bytes */
3362caf283d0SKees Cook memset_after(ue, 0, hard);
33631da177e4SLinus Torvalds
33641d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &x->mark);
33651d1e34ddSDavid S. Miller if (err)
33661d1e34ddSDavid S. Miller return err;
33676f26b61eSJamal Hadi Salim
33687e652640SSteffen Klassert err = xfrm_if_id_put(skb, x->if_id);
33697e652640SSteffen Klassert if (err)
33707e652640SSteffen Klassert return err;
33717e652640SSteffen Klassert
3372a4a87fa4SAntony Antony if (x->dir) {
3373a4a87fa4SAntony Antony err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir);
3374a4a87fa4SAntony Antony if (err)
3375a4a87fa4SAntony Antony return err;
3376a4a87fa4SAntony Antony }
3377a4a87fa4SAntony Antony
3378053c095aSJohannes Berg nlmsg_end(skb, nlh);
3379053c095aSJohannes Berg return 0;
33801da177e4SLinus Torvalds }
33811da177e4SLinus Torvalds
xfrm_exp_state_notify(struct xfrm_state * x,const struct km_event * c)3382214e005bSDavid S. Miller static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
33831da177e4SLinus Torvalds {
3384fc34acd3SAlexey Dobriyan struct net *net = xs_net(x);
33851da177e4SLinus Torvalds struct sk_buff *skb;
33861da177e4SLinus Torvalds
33877deb2264SThomas Graf skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
33881da177e4SLinus Torvalds if (skb == NULL)
33891da177e4SLinus Torvalds return -ENOMEM;
33901da177e4SLinus Torvalds
33916f26b61eSJamal Hadi Salim if (build_expire(skb, x, c) < 0) {
33926f26b61eSJamal Hadi Salim kfree_skb(skb);
33936f26b61eSJamal Hadi Salim return -EMSGSIZE;
33946f26b61eSJamal Hadi Salim }
33951da177e4SLinus Torvalds
339621ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
33971da177e4SLinus Torvalds }
33981da177e4SLinus Torvalds
xfrm_aevent_state_notify(struct xfrm_state * x,const struct km_event * c)3399214e005bSDavid S. Miller static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
3400d51d081dSJamal Hadi Salim {
3401fc34acd3SAlexey Dobriyan struct net *net = xs_net(x);
3402d51d081dSJamal Hadi Salim struct sk_buff *skb;
34032fc5f83bSGustavo A. R. Silva int err;
3404d51d081dSJamal Hadi Salim
3405d8647b79SSteffen Klassert skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
3406d51d081dSJamal Hadi Salim if (skb == NULL)
3407d51d081dSJamal Hadi Salim return -ENOMEM;
3408d51d081dSJamal Hadi Salim
34092fc5f83bSGustavo A. R. Silva err = build_aevent(skb, x, c);
34102fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
3411d51d081dSJamal Hadi Salim
341221ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS);
3413d51d081dSJamal Hadi Salim }
3414d51d081dSJamal Hadi Salim
xfrm_notify_sa_flush(const struct km_event * c)3415214e005bSDavid S. Miller static int xfrm_notify_sa_flush(const struct km_event *c)
341626b15dadSJamal Hadi Salim {
34177067802eSAlexey Dobriyan struct net *net = c->net;
341826b15dadSJamal Hadi Salim struct xfrm_usersa_flush *p;
341926b15dadSJamal Hadi Salim struct nlmsghdr *nlh;
342026b15dadSJamal Hadi Salim struct sk_buff *skb;
34217deb2264SThomas Graf int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
342226b15dadSJamal Hadi Salim
34237deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC);
342426b15dadSJamal Hadi Salim if (skb == NULL)
342526b15dadSJamal Hadi Salim return -ENOMEM;
342626b15dadSJamal Hadi Salim
342715e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
342879b8b7f4SThomas Graf if (nlh == NULL) {
342979b8b7f4SThomas Graf kfree_skb(skb);
343079b8b7f4SThomas Graf return -EMSGSIZE;
343179b8b7f4SThomas Graf }
343226b15dadSJamal Hadi Salim
34337b67c857SThomas Graf p = nlmsg_data(nlh);
3434bf08867fSHerbert Xu p->proto = c->data.proto;
343526b15dadSJamal Hadi Salim
34369825069dSThomas Graf nlmsg_end(skb, nlh);
343726b15dadSJamal Hadi Salim
343821ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
343926b15dadSJamal Hadi Salim }
344026b15dadSJamal Hadi Salim
xfrm_sa_len(struct xfrm_state * x)3441a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
344226b15dadSJamal Hadi Salim {
3443a1b831f2SAlexey Dobriyan unsigned int l = 0;
34441a6509d9SHerbert Xu if (x->aead)
34451a6509d9SHerbert Xu l += nla_total_size(aead_len(x->aead));
34464447bb33SMartin Willi if (x->aalg) {
34474447bb33SMartin Willi l += nla_total_size(sizeof(struct xfrm_algo) +
34484447bb33SMartin Willi (x->aalg->alg_key_len + 7) / 8);
34494447bb33SMartin Willi l += nla_total_size(xfrm_alg_auth_len(x->aalg));
34504447bb33SMartin Willi }
345126b15dadSJamal Hadi Salim if (x->ealg)
34520f99be0dSEric Dumazet l += nla_total_size(xfrm_alg_len(x->ealg));
345326b15dadSJamal Hadi Salim if (x->calg)
34547deb2264SThomas Graf l += nla_total_size(sizeof(*x->calg));
345526b15dadSJamal Hadi Salim if (x->encap)
34567deb2264SThomas Graf l += nla_total_size(sizeof(*x->encap));
345735d2856bSMartin Willi if (x->tfcpad)
345835d2856bSMartin Willi l += nla_total_size(sizeof(x->tfcpad));
3459d8647b79SSteffen Klassert if (x->replay_esn)
3460d8647b79SSteffen Klassert l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
3461f293a5e3Sdingzhi else
3462f293a5e3Sdingzhi l += nla_total_size(sizeof(struct xfrm_replay_state));
346368325d3bSHerbert Xu if (x->security)
346468325d3bSHerbert Xu l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
346568325d3bSHerbert Xu x->security->ctx_len);
346668325d3bSHerbert Xu if (x->coaddr)
346768325d3bSHerbert Xu l += nla_total_size(sizeof(*x->coaddr));
3468a947b0a9SNicolas Dichtel if (x->props.extra_flags)
3469a947b0a9SNicolas Dichtel l += nla_total_size(sizeof(x->props.extra_flags));
3470d77e38e6SSteffen Klassert if (x->xso.dev)
34717770a39dSEric Dumazet l += nla_total_size(sizeof(struct xfrm_user_offload));
34729b42c1f1SSteffen Klassert if (x->props.smark.v | x->props.smark.m) {
34739b42c1f1SSteffen Klassert l += nla_total_size(sizeof(x->props.smark.v));
34749b42c1f1SSteffen Klassert l += nla_total_size(sizeof(x->props.smark.m));
34759b42c1f1SSteffen Klassert }
34767e652640SSteffen Klassert if (x->if_id)
34777e652640SSteffen Klassert l += nla_total_size(sizeof(x->if_id));
347868325d3bSHerbert Xu
3479d26f3984SHerbert Xu /* Must count x->lastused as it may become non-zero behind our back. */
3480de95c4a4SNicolas Dichtel l += nla_total_size_64bit(sizeof(u64));
348126b15dadSJamal Hadi Salim
34824e484b3eSAntony Antony if (x->mapping_maxage)
34834e484b3eSAntony Antony l += nla_total_size(sizeof(x->mapping_maxage));
34844e484b3eSAntony Antony
3485a4a87fa4SAntony Antony if (x->dir)
3486a4a87fa4SAntony Antony l += nla_total_size(sizeof(x->dir));
3487a4a87fa4SAntony Antony
3488*f531d13bSEyal Birger if (x->nat_keepalive_interval)
3489*f531d13bSEyal Birger l += nla_total_size(sizeof(x->nat_keepalive_interval));
3490*f531d13bSEyal Birger
349126b15dadSJamal Hadi Salim return l;
349226b15dadSJamal Hadi Salim }
349326b15dadSJamal Hadi Salim
xfrm_notify_sa(struct xfrm_state * x,const struct km_event * c)3494214e005bSDavid S. Miller static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
349526b15dadSJamal Hadi Salim {
3496fc34acd3SAlexey Dobriyan struct net *net = xs_net(x);
349726b15dadSJamal Hadi Salim struct xfrm_usersa_info *p;
34980603eac0SHerbert Xu struct xfrm_usersa_id *id;
349926b15dadSJamal Hadi Salim struct nlmsghdr *nlh;
350026b15dadSJamal Hadi Salim struct sk_buff *skb;
3501a1b831f2SAlexey Dobriyan unsigned int len = xfrm_sa_len(x);
3502a1b831f2SAlexey Dobriyan unsigned int headlen;
3503a1b831f2SAlexey Dobriyan int err;
35040603eac0SHerbert Xu
35050603eac0SHerbert Xu headlen = sizeof(*p);
35060603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) {
35077deb2264SThomas Graf len += nla_total_size(headlen);
35080603eac0SHerbert Xu headlen = sizeof(*id);
35096f26b61eSJamal Hadi Salim len += nla_total_size(sizeof(struct xfrm_mark));
35100603eac0SHerbert Xu }
35117deb2264SThomas Graf len += NLMSG_ALIGN(headlen);
351226b15dadSJamal Hadi Salim
35137deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC);
351426b15dadSJamal Hadi Salim if (skb == NULL)
351526b15dadSJamal Hadi Salim return -ENOMEM;
351626b15dadSJamal Hadi Salim
351715e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
35181d1e34ddSDavid S. Miller err = -EMSGSIZE;
351979b8b7f4SThomas Graf if (nlh == NULL)
35201d1e34ddSDavid S. Miller goto out_free_skb;
352126b15dadSJamal Hadi Salim
35227b67c857SThomas Graf p = nlmsg_data(nlh);
35230603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) {
3524c0144beaSThomas Graf struct nlattr *attr;
3525c0144beaSThomas Graf
35267b67c857SThomas Graf id = nlmsg_data(nlh);
352750329c8aSMathias Krause memset(id, 0, sizeof(*id));
35280603eac0SHerbert Xu memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
35290603eac0SHerbert Xu id->spi = x->id.spi;
35300603eac0SHerbert Xu id->family = x->props.family;
35310603eac0SHerbert Xu id->proto = x->id.proto;
35320603eac0SHerbert Xu
3533c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
35341d1e34ddSDavid S. Miller err = -EMSGSIZE;
3535c0144beaSThomas Graf if (attr == NULL)
35361d1e34ddSDavid S. Miller goto out_free_skb;
3537c0144beaSThomas Graf
3538c0144beaSThomas Graf p = nla_data(attr);
35390603eac0SHerbert Xu }
35401d1e34ddSDavid S. Miller err = copy_to_user_state_extra(x, p, skb);
35411d1e34ddSDavid S. Miller if (err)
35421d1e34ddSDavid S. Miller goto out_free_skb;
354326b15dadSJamal Hadi Salim
35449825069dSThomas Graf nlmsg_end(skb, nlh);
354526b15dadSJamal Hadi Salim
354621ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
354726b15dadSJamal Hadi Salim
35481d1e34ddSDavid S. Miller out_free_skb:
354926b15dadSJamal Hadi Salim kfree_skb(skb);
35501d1e34ddSDavid S. Miller return err;
355126b15dadSJamal Hadi Salim }
355226b15dadSJamal Hadi Salim
xfrm_send_state_notify(struct xfrm_state * x,const struct km_event * c)3553214e005bSDavid S. Miller static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
355426b15dadSJamal Hadi Salim {
355526b15dadSJamal Hadi Salim
355626b15dadSJamal Hadi Salim switch (c->event) {
3557f60f6b8fSHerbert Xu case XFRM_MSG_EXPIRE:
355826b15dadSJamal Hadi Salim return xfrm_exp_state_notify(x, c);
3559d51d081dSJamal Hadi Salim case XFRM_MSG_NEWAE:
3560d51d081dSJamal Hadi Salim return xfrm_aevent_state_notify(x, c);
3561f60f6b8fSHerbert Xu case XFRM_MSG_DELSA:
3562f60f6b8fSHerbert Xu case XFRM_MSG_UPDSA:
3563f60f6b8fSHerbert Xu case XFRM_MSG_NEWSA:
356426b15dadSJamal Hadi Salim return xfrm_notify_sa(x, c);
3565f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHSA:
356626b15dadSJamal Hadi Salim return xfrm_notify_sa_flush(c);
356726b15dadSJamal Hadi Salim default:
356862db5cfdSstephen hemminger printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
356962db5cfdSstephen hemminger c->event);
357026b15dadSJamal Hadi Salim break;
357126b15dadSJamal Hadi Salim }
357226b15dadSJamal Hadi Salim
357326b15dadSJamal Hadi Salim return 0;
357426b15dadSJamal Hadi Salim
357526b15dadSJamal Hadi Salim }
357626b15dadSJamal Hadi Salim
xfrm_acquire_msgsize(struct xfrm_state * x,struct xfrm_policy * xp)3577a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x,
35787deb2264SThomas Graf struct xfrm_policy *xp)
35797deb2264SThomas Graf {
35807deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
35817deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
35826f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark))
35837deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(x->security))
35847deb2264SThomas Graf + userpolicy_type_attrsize();
35857deb2264SThomas Graf }
35867deb2264SThomas Graf
build_acquire(struct sk_buff * skb,struct xfrm_state * x,struct xfrm_tmpl * xt,struct xfrm_policy * xp)35871da177e4SLinus Torvalds static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
358865e0736bSFan Du struct xfrm_tmpl *xt, struct xfrm_policy *xp)
35891da177e4SLinus Torvalds {
35901d1e34ddSDavid S. Miller __u32 seq = xfrm_get_acqseq();
35911da177e4SLinus Torvalds struct xfrm_user_acquire *ua;
35921da177e4SLinus Torvalds struct nlmsghdr *nlh;
35931d1e34ddSDavid S. Miller int err;
35941da177e4SLinus Torvalds
359579b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
359679b8b7f4SThomas Graf if (nlh == NULL)
359779b8b7f4SThomas Graf return -EMSGSIZE;
35981da177e4SLinus Torvalds
35997b67c857SThomas Graf ua = nlmsg_data(nlh);
36001da177e4SLinus Torvalds memcpy(&ua->id, &x->id, sizeof(ua->id));
36011da177e4SLinus Torvalds memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
36021da177e4SLinus Torvalds memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
360365e0736bSFan Du copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT);
36041da177e4SLinus Torvalds ua->aalgos = xt->aalgos;
36051da177e4SLinus Torvalds ua->ealgos = xt->ealgos;
36061da177e4SLinus Torvalds ua->calgos = xt->calgos;
36071da177e4SLinus Torvalds ua->seq = x->km.seq = seq;
36081da177e4SLinus Torvalds
36091d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb);
36101d1e34ddSDavid S. Miller if (!err)
36111d1e34ddSDavid S. Miller err = copy_to_user_state_sec_ctx(x, skb);
36121d1e34ddSDavid S. Miller if (!err)
36131d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb);
36141d1e34ddSDavid S. Miller if (!err)
36151d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark);
36167e652640SSteffen Klassert if (!err)
36177e652640SSteffen Klassert err = xfrm_if_id_put(skb, xp->if_id);
3618919e43faSLeon Romanovsky if (!err && xp->xdo.dev)
3619919e43faSLeon Romanovsky err = copy_user_offload(&xp->xdo, skb);
36201d1e34ddSDavid S. Miller if (err) {
36211d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh);
36221d1e34ddSDavid S. Miller return err;
36231d1e34ddSDavid S. Miller }
36241da177e4SLinus Torvalds
3625053c095aSJohannes Berg nlmsg_end(skb, nlh);
3626053c095aSJohannes Berg return 0;
36271da177e4SLinus Torvalds }
36281da177e4SLinus Torvalds
xfrm_send_acquire(struct xfrm_state * x,struct xfrm_tmpl * xt,struct xfrm_policy * xp)36291da177e4SLinus Torvalds static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
363065e0736bSFan Du struct xfrm_policy *xp)
36311da177e4SLinus Torvalds {
3632a6483b79SAlexey Dobriyan struct net *net = xs_net(x);
36331da177e4SLinus Torvalds struct sk_buff *skb;
36342fc5f83bSGustavo A. R. Silva int err;
36351da177e4SLinus Torvalds
36367deb2264SThomas Graf skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
36371da177e4SLinus Torvalds if (skb == NULL)
36381da177e4SLinus Torvalds return -ENOMEM;
36391da177e4SLinus Torvalds
36402fc5f83bSGustavo A. R. Silva err = build_acquire(skb, x, xt, xp);
36412fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
36421da177e4SLinus Torvalds
364321ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
36441da177e4SLinus Torvalds }
36451da177e4SLinus Torvalds
36461da177e4SLinus Torvalds /* User gives us xfrm_user_policy_info followed by an array of 0
36471da177e4SLinus Torvalds * or more templates.
36481da177e4SLinus Torvalds */
xfrm_compile_policy(struct sock * sk,int opt,u8 * data,int len,int * dir)3649cb969f07SVenkat Yekkirala static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
36501da177e4SLinus Torvalds u8 *data, int len, int *dir)
36511da177e4SLinus Torvalds {
3652fc34acd3SAlexey Dobriyan struct net *net = sock_net(sk);
36531da177e4SLinus Torvalds struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
36541da177e4SLinus Torvalds struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
36551da177e4SLinus Torvalds struct xfrm_policy *xp;
36561da177e4SLinus Torvalds int nr;
36571da177e4SLinus Torvalds
3658cb969f07SVenkat Yekkirala switch (sk->sk_family) {
36591da177e4SLinus Torvalds case AF_INET:
36601da177e4SLinus Torvalds if (opt != IP_XFRM_POLICY) {
36611da177e4SLinus Torvalds *dir = -EOPNOTSUPP;
36621da177e4SLinus Torvalds return NULL;
36631da177e4SLinus Torvalds }
36641da177e4SLinus Torvalds break;
3665dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6)
36661da177e4SLinus Torvalds case AF_INET6:
36671da177e4SLinus Torvalds if (opt != IPV6_XFRM_POLICY) {
36681da177e4SLinus Torvalds *dir = -EOPNOTSUPP;
36691da177e4SLinus Torvalds return NULL;
36701da177e4SLinus Torvalds }
36711da177e4SLinus Torvalds break;
36721da177e4SLinus Torvalds #endif
36731da177e4SLinus Torvalds default:
36741da177e4SLinus Torvalds *dir = -EINVAL;
36751da177e4SLinus Torvalds return NULL;
36761da177e4SLinus Torvalds }
36771da177e4SLinus Torvalds
36781da177e4SLinus Torvalds *dir = -EINVAL;
36791da177e4SLinus Torvalds
36801da177e4SLinus Torvalds if (len < sizeof(*p) ||
3681ec2b4f01SSabrina Dubroca verify_newpolicy_info(p, NULL))
36821da177e4SLinus Torvalds return NULL;
36831da177e4SLinus Torvalds
36841da177e4SLinus Torvalds nr = ((len - sizeof(*p)) / sizeof(*ut));
36853d776e31STobias Brunner if (validate_tmpl(nr, ut, p->sel.family, p->dir, NULL))
36861da177e4SLinus Torvalds return NULL;
36871da177e4SLinus Torvalds
3688a4f1bac6SHerbert Xu if (p->dir > XFRM_POLICY_OUT)
3689a4f1bac6SHerbert Xu return NULL;
3690a4f1bac6SHerbert Xu
36912f09a4d5SHerbert Xu xp = xfrm_policy_alloc(net, GFP_ATOMIC);
36921da177e4SLinus Torvalds if (xp == NULL) {
36931da177e4SLinus Torvalds *dir = -ENOBUFS;
36941da177e4SLinus Torvalds return NULL;
36951da177e4SLinus Torvalds }
36961da177e4SLinus Torvalds
36971da177e4SLinus Torvalds copy_from_user_policy(xp, p);
3698f7b6983fSMasahide NAKAMURA xp->type = XFRM_POLICY_TYPE_MAIN;
36991da177e4SLinus Torvalds copy_templates(xp, ut, nr);
37001da177e4SLinus Torvalds
37011da177e4SLinus Torvalds *dir = p->dir;
37021da177e4SLinus Torvalds
37031da177e4SLinus Torvalds return xp;
37041da177e4SLinus Torvalds }
37051da177e4SLinus Torvalds
xfrm_polexpire_msgsize(struct xfrm_policy * xp)3706a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp)
37077deb2264SThomas Graf {
37087deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
37097deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
37107deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
3711295fae56SJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark))
37127deb2264SThomas Graf + userpolicy_type_attrsize();
37137deb2264SThomas Graf }
37147deb2264SThomas Graf
build_polexpire(struct sk_buff * skb,struct xfrm_policy * xp,int dir,const struct km_event * c)37151da177e4SLinus Torvalds static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
3716214e005bSDavid S. Miller int dir, const struct km_event *c)
37171da177e4SLinus Torvalds {
37181da177e4SLinus Torvalds struct xfrm_user_polexpire *upe;
3719d51d081dSJamal Hadi Salim int hard = c->data.hard;
37201d1e34ddSDavid S. Miller struct nlmsghdr *nlh;
37211d1e34ddSDavid S. Miller int err;
37221da177e4SLinus Torvalds
372315e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
372479b8b7f4SThomas Graf if (nlh == NULL)
372579b8b7f4SThomas Graf return -EMSGSIZE;
37261da177e4SLinus Torvalds
37277b67c857SThomas Graf upe = nlmsg_data(nlh);
37281da177e4SLinus Torvalds copy_to_user_policy(xp, &upe->pol, dir);
37291d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb);
37301d1e34ddSDavid S. Miller if (!err)
37311d1e34ddSDavid S. Miller err = copy_to_user_sec_ctx(xp, skb);
37321d1e34ddSDavid S. Miller if (!err)
37331d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb);
37341d1e34ddSDavid S. Miller if (!err)
37351d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark);
37367e652640SSteffen Klassert if (!err)
37377e652640SSteffen Klassert err = xfrm_if_id_put(skb, xp->if_id);
3738919e43faSLeon Romanovsky if (!err && xp->xdo.dev)
3739919e43faSLeon Romanovsky err = copy_user_offload(&xp->xdo, skb);
37401d1e34ddSDavid S. Miller if (err) {
37411d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh);
37421d1e34ddSDavid S. Miller return err;
37431d1e34ddSDavid S. Miller }
37441da177e4SLinus Torvalds upe->hard = !!hard;
37451da177e4SLinus Torvalds
3746053c095aSJohannes Berg nlmsg_end(skb, nlh);
3747053c095aSJohannes Berg return 0;
37481da177e4SLinus Torvalds }
37491da177e4SLinus Torvalds
xfrm_exp_policy_notify(struct xfrm_policy * xp,int dir,const struct km_event * c)3750214e005bSDavid S. Miller static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
37511da177e4SLinus Torvalds {
3752fc34acd3SAlexey Dobriyan struct net *net = xp_net(xp);
37531da177e4SLinus Torvalds struct sk_buff *skb;
37542fc5f83bSGustavo A. R. Silva int err;
37551da177e4SLinus Torvalds
37567deb2264SThomas Graf skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
37571da177e4SLinus Torvalds if (skb == NULL)
37581da177e4SLinus Torvalds return -ENOMEM;
37591da177e4SLinus Torvalds
37602fc5f83bSGustavo A. R. Silva err = build_polexpire(skb, xp, dir, c);
37612fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
37621da177e4SLinus Torvalds
376321ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
37641da177e4SLinus Torvalds }
37651da177e4SLinus Torvalds
xfrm_notify_policy(struct xfrm_policy * xp,int dir,const struct km_event * c)3766214e005bSDavid S. Miller static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
376726b15dadSJamal Hadi Salim {
3768a1b831f2SAlexey Dobriyan unsigned int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
3769fc34acd3SAlexey Dobriyan struct net *net = xp_net(xp);
377026b15dadSJamal Hadi Salim struct xfrm_userpolicy_info *p;
37710603eac0SHerbert Xu struct xfrm_userpolicy_id *id;
377226b15dadSJamal Hadi Salim struct nlmsghdr *nlh;
377326b15dadSJamal Hadi Salim struct sk_buff *skb;
3774a1b831f2SAlexey Dobriyan unsigned int headlen;
3775a1b831f2SAlexey Dobriyan int err;
37760603eac0SHerbert Xu
37770603eac0SHerbert Xu headlen = sizeof(*p);
37780603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) {
37797deb2264SThomas Graf len += nla_total_size(headlen);
37800603eac0SHerbert Xu headlen = sizeof(*id);
37810603eac0SHerbert Xu }
3782cfbfd45aSThomas Graf len += userpolicy_type_attrsize();
3783295fae56SJamal Hadi Salim len += nla_total_size(sizeof(struct xfrm_mark));
37847deb2264SThomas Graf len += NLMSG_ALIGN(headlen);
378526b15dadSJamal Hadi Salim
37867deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC);
378726b15dadSJamal Hadi Salim if (skb == NULL)
378826b15dadSJamal Hadi Salim return -ENOMEM;
378926b15dadSJamal Hadi Salim
379015e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
37911d1e34ddSDavid S. Miller err = -EMSGSIZE;
379279b8b7f4SThomas Graf if (nlh == NULL)
37931d1e34ddSDavid S. Miller goto out_free_skb;
379426b15dadSJamal Hadi Salim
37957b67c857SThomas Graf p = nlmsg_data(nlh);
37960603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) {
3797c0144beaSThomas Graf struct nlattr *attr;
3798c0144beaSThomas Graf
37997b67c857SThomas Graf id = nlmsg_data(nlh);
38000603eac0SHerbert Xu memset(id, 0, sizeof(*id));
38010603eac0SHerbert Xu id->dir = dir;
38020603eac0SHerbert Xu if (c->data.byid)
38030603eac0SHerbert Xu id->index = xp->index;
38040603eac0SHerbert Xu else
38050603eac0SHerbert Xu memcpy(&id->sel, &xp->selector, sizeof(id->sel));
38060603eac0SHerbert Xu
3807c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
38081d1e34ddSDavid S. Miller err = -EMSGSIZE;
3809c0144beaSThomas Graf if (attr == NULL)
38101d1e34ddSDavid S. Miller goto out_free_skb;
3811c0144beaSThomas Graf
3812c0144beaSThomas Graf p = nla_data(attr);
38130603eac0SHerbert Xu }
381426b15dadSJamal Hadi Salim
381526b15dadSJamal Hadi Salim copy_to_user_policy(xp, p, dir);
38161d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb);
38171d1e34ddSDavid S. Miller if (!err)
38181d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb);
38191d1e34ddSDavid S. Miller if (!err)
38201d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark);
38217e652640SSteffen Klassert if (!err)
38227e652640SSteffen Klassert err = xfrm_if_id_put(skb, xp->if_id);
3823919e43faSLeon Romanovsky if (!err && xp->xdo.dev)
3824919e43faSLeon Romanovsky err = copy_user_offload(&xp->xdo, skb);
38251d1e34ddSDavid S. Miller if (err)
38261d1e34ddSDavid S. Miller goto out_free_skb;
3827295fae56SJamal Hadi Salim
38289825069dSThomas Graf nlmsg_end(skb, nlh);
382926b15dadSJamal Hadi Salim
383021ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
383126b15dadSJamal Hadi Salim
38321d1e34ddSDavid S. Miller out_free_skb:
383326b15dadSJamal Hadi Salim kfree_skb(skb);
38341d1e34ddSDavid S. Miller return err;
383526b15dadSJamal Hadi Salim }
383626b15dadSJamal Hadi Salim
xfrm_notify_policy_flush(const struct km_event * c)3837214e005bSDavid S. Miller static int xfrm_notify_policy_flush(const struct km_event *c)
383826b15dadSJamal Hadi Salim {
38397067802eSAlexey Dobriyan struct net *net = c->net;
384026b15dadSJamal Hadi Salim struct nlmsghdr *nlh;
384126b15dadSJamal Hadi Salim struct sk_buff *skb;
38421d1e34ddSDavid S. Miller int err;
384326b15dadSJamal Hadi Salim
38447deb2264SThomas Graf skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
384526b15dadSJamal Hadi Salim if (skb == NULL)
384626b15dadSJamal Hadi Salim return -ENOMEM;
384726b15dadSJamal Hadi Salim
384815e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
38491d1e34ddSDavid S. Miller err = -EMSGSIZE;
385079b8b7f4SThomas Graf if (nlh == NULL)
38511d1e34ddSDavid S. Miller goto out_free_skb;
38521d1e34ddSDavid S. Miller err = copy_to_user_policy_type(c->data.type, skb);
38531d1e34ddSDavid S. Miller if (err)
38541d1e34ddSDavid S. Miller goto out_free_skb;
385526b15dadSJamal Hadi Salim
38569825069dSThomas Graf nlmsg_end(skb, nlh);
385726b15dadSJamal Hadi Salim
385821ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
385926b15dadSJamal Hadi Salim
38601d1e34ddSDavid S. Miller out_free_skb:
386126b15dadSJamal Hadi Salim kfree_skb(skb);
38621d1e34ddSDavid S. Miller return err;
386326b15dadSJamal Hadi Salim }
386426b15dadSJamal Hadi Salim
xfrm_send_policy_notify(struct xfrm_policy * xp,int dir,const struct km_event * c)3865214e005bSDavid S. Miller static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
386626b15dadSJamal Hadi Salim {
386726b15dadSJamal Hadi Salim
386826b15dadSJamal Hadi Salim switch (c->event) {
3869f60f6b8fSHerbert Xu case XFRM_MSG_NEWPOLICY:
3870f60f6b8fSHerbert Xu case XFRM_MSG_UPDPOLICY:
3871f60f6b8fSHerbert Xu case XFRM_MSG_DELPOLICY:
387226b15dadSJamal Hadi Salim return xfrm_notify_policy(xp, dir, c);
3873f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHPOLICY:
387426b15dadSJamal Hadi Salim return xfrm_notify_policy_flush(c);
3875f60f6b8fSHerbert Xu case XFRM_MSG_POLEXPIRE:
387626b15dadSJamal Hadi Salim return xfrm_exp_policy_notify(xp, dir, c);
387726b15dadSJamal Hadi Salim default:
387862db5cfdSstephen hemminger printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
387962db5cfdSstephen hemminger c->event);
388026b15dadSJamal Hadi Salim }
388126b15dadSJamal Hadi Salim
388226b15dadSJamal Hadi Salim return 0;
388326b15dadSJamal Hadi Salim
388426b15dadSJamal Hadi Salim }
388526b15dadSJamal Hadi Salim
xfrm_report_msgsize(void)3886a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_report_msgsize(void)
38877deb2264SThomas Graf {
38887deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
38897deb2264SThomas Graf }
38907deb2264SThomas Graf
build_report(struct sk_buff * skb,u8 proto,struct xfrm_selector * sel,xfrm_address_t * addr)389197a64b45SMasahide NAKAMURA static int build_report(struct sk_buff *skb, u8 proto,
389297a64b45SMasahide NAKAMURA struct xfrm_selector *sel, xfrm_address_t *addr)
389397a64b45SMasahide NAKAMURA {
389497a64b45SMasahide NAKAMURA struct xfrm_user_report *ur;
389597a64b45SMasahide NAKAMURA struct nlmsghdr *nlh;
389697a64b45SMasahide NAKAMURA
389779b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
389879b8b7f4SThomas Graf if (nlh == NULL)
389979b8b7f4SThomas Graf return -EMSGSIZE;
390097a64b45SMasahide NAKAMURA
39017b67c857SThomas Graf ur = nlmsg_data(nlh);
390297a64b45SMasahide NAKAMURA ur->proto = proto;
390397a64b45SMasahide NAKAMURA memcpy(&ur->sel, sel, sizeof(ur->sel));
390497a64b45SMasahide NAKAMURA
39051d1e34ddSDavid S. Miller if (addr) {
39061d1e34ddSDavid S. Miller int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr);
39071d1e34ddSDavid S. Miller if (err) {
39089825069dSThomas Graf nlmsg_cancel(skb, nlh);
39091d1e34ddSDavid S. Miller return err;
39101d1e34ddSDavid S. Miller }
39111d1e34ddSDavid S. Miller }
3912053c095aSJohannes Berg nlmsg_end(skb, nlh);
3913053c095aSJohannes Berg return 0;
391497a64b45SMasahide NAKAMURA }
391597a64b45SMasahide NAKAMURA
xfrm_send_report(struct net * net,u8 proto,struct xfrm_selector * sel,xfrm_address_t * addr)3916db983c11SAlexey Dobriyan static int xfrm_send_report(struct net *net, u8 proto,
3917db983c11SAlexey Dobriyan struct xfrm_selector *sel, xfrm_address_t *addr)
391897a64b45SMasahide NAKAMURA {
391997a64b45SMasahide NAKAMURA struct sk_buff *skb;
39202fc5f83bSGustavo A. R. Silva int err;
392197a64b45SMasahide NAKAMURA
39227deb2264SThomas Graf skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
392397a64b45SMasahide NAKAMURA if (skb == NULL)
392497a64b45SMasahide NAKAMURA return -ENOMEM;
392597a64b45SMasahide NAKAMURA
39262fc5f83bSGustavo A. R. Silva err = build_report(skb, proto, sel, addr);
39272fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
392897a64b45SMasahide NAKAMURA
392921ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT);
393097a64b45SMasahide NAKAMURA }
393197a64b45SMasahide NAKAMURA
xfrm_mapping_msgsize(void)3932a1b831f2SAlexey Dobriyan static inline unsigned int xfrm_mapping_msgsize(void)
39333a2dfbe8SMartin Willi {
39343a2dfbe8SMartin Willi return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
39353a2dfbe8SMartin Willi }
39363a2dfbe8SMartin Willi
build_mapping(struct sk_buff * skb,struct xfrm_state * x,xfrm_address_t * new_saddr,__be16 new_sport)39373a2dfbe8SMartin Willi static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
39383a2dfbe8SMartin Willi xfrm_address_t *new_saddr, __be16 new_sport)
39393a2dfbe8SMartin Willi {
39403a2dfbe8SMartin Willi struct xfrm_user_mapping *um;
39413a2dfbe8SMartin Willi struct nlmsghdr *nlh;
39423a2dfbe8SMartin Willi
39433a2dfbe8SMartin Willi nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
39443a2dfbe8SMartin Willi if (nlh == NULL)
39453a2dfbe8SMartin Willi return -EMSGSIZE;
39463a2dfbe8SMartin Willi
39473a2dfbe8SMartin Willi um = nlmsg_data(nlh);
39483a2dfbe8SMartin Willi
39493a2dfbe8SMartin Willi memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
39503a2dfbe8SMartin Willi um->id.spi = x->id.spi;
39513a2dfbe8SMartin Willi um->id.family = x->props.family;
39523a2dfbe8SMartin Willi um->id.proto = x->id.proto;
39533a2dfbe8SMartin Willi memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
39543a2dfbe8SMartin Willi memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
39553a2dfbe8SMartin Willi um->new_sport = new_sport;
39563a2dfbe8SMartin Willi um->old_sport = x->encap->encap_sport;
39573a2dfbe8SMartin Willi um->reqid = x->props.reqid;
39583a2dfbe8SMartin Willi
3959053c095aSJohannes Berg nlmsg_end(skb, nlh);
3960053c095aSJohannes Berg return 0;
39613a2dfbe8SMartin Willi }
39623a2dfbe8SMartin Willi
xfrm_send_mapping(struct xfrm_state * x,xfrm_address_t * ipaddr,__be16 sport)39633a2dfbe8SMartin Willi static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
39643a2dfbe8SMartin Willi __be16 sport)
39653a2dfbe8SMartin Willi {
3966a6483b79SAlexey Dobriyan struct net *net = xs_net(x);
39673a2dfbe8SMartin Willi struct sk_buff *skb;
39682fc5f83bSGustavo A. R. Silva int err;
39693a2dfbe8SMartin Willi
39703a2dfbe8SMartin Willi if (x->id.proto != IPPROTO_ESP)
39713a2dfbe8SMartin Willi return -EINVAL;
39723a2dfbe8SMartin Willi
39733a2dfbe8SMartin Willi if (!x->encap)
39743a2dfbe8SMartin Willi return -EINVAL;
39753a2dfbe8SMartin Willi
39763a2dfbe8SMartin Willi skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
39773a2dfbe8SMartin Willi if (skb == NULL)
39783a2dfbe8SMartin Willi return -ENOMEM;
39793a2dfbe8SMartin Willi
39802fc5f83bSGustavo A. R. Silva err = build_mapping(skb, x, ipaddr, sport);
39812fc5f83bSGustavo A. R. Silva BUG_ON(err < 0);
39823a2dfbe8SMartin Willi
398321ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING);
39843a2dfbe8SMartin Willi }
39853a2dfbe8SMartin Willi
xfrm_is_alive(const struct km_event * c)39860f24558eSHoria Geanta static bool xfrm_is_alive(const struct km_event *c)
39870f24558eSHoria Geanta {
39880f24558eSHoria Geanta return (bool)xfrm_acquire_is_on(c->net);
39890f24558eSHoria Geanta }
39900f24558eSHoria Geanta
39911da177e4SLinus Torvalds static struct xfrm_mgr netlink_mgr = {
39921da177e4SLinus Torvalds .notify = xfrm_send_state_notify,
39931da177e4SLinus Torvalds .acquire = xfrm_send_acquire,
39941da177e4SLinus Torvalds .compile_policy = xfrm_compile_policy,
39951da177e4SLinus Torvalds .notify_policy = xfrm_send_policy_notify,
399697a64b45SMasahide NAKAMURA .report = xfrm_send_report,
39975c79de6eSShinta Sugimoto .migrate = xfrm_send_migrate,
39983a2dfbe8SMartin Willi .new_mapping = xfrm_send_mapping,
39990f24558eSHoria Geanta .is_alive = xfrm_is_alive,
40001da177e4SLinus Torvalds };
40011da177e4SLinus Torvalds
xfrm_user_net_init(struct net * net)4002a6483b79SAlexey Dobriyan static int __net_init xfrm_user_net_init(struct net *net)
40031da177e4SLinus Torvalds {
4004be33690dSPatrick McHardy struct sock *nlsk;
4005a31f2d17SPablo Neira Ayuso struct netlink_kernel_cfg cfg = {
4006a31f2d17SPablo Neira Ayuso .groups = XFRMNLGRP_MAX,
4007a31f2d17SPablo Neira Ayuso .input = xfrm_netlink_rcv,
4008a31f2d17SPablo Neira Ayuso };
4009be33690dSPatrick McHardy
40109f00d977SPablo Neira Ayuso nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg);
4011be33690dSPatrick McHardy if (nlsk == NULL)
40121da177e4SLinus Torvalds return -ENOMEM;
4013d79d792eSEric W. Biederman net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
4014cf778b00SEric Dumazet rcu_assign_pointer(net->xfrm.nlsk, nlsk);
40151da177e4SLinus Torvalds return 0;
40161da177e4SLinus Torvalds }
40171da177e4SLinus Torvalds
xfrm_user_net_pre_exit(struct net * net)40186218fe18SFlorian Westphal static void __net_exit xfrm_user_net_pre_exit(struct net *net)
40196218fe18SFlorian Westphal {
40206218fe18SFlorian Westphal RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
40216218fe18SFlorian Westphal }
40226218fe18SFlorian Westphal
xfrm_user_net_exit(struct list_head * net_exit_list)4023d79d792eSEric W. Biederman static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
4024a6483b79SAlexey Dobriyan {
4025d79d792eSEric W. Biederman struct net *net;
40266218fe18SFlorian Westphal
4027d79d792eSEric W. Biederman list_for_each_entry(net, net_exit_list, exit_list)
4028d79d792eSEric W. Biederman netlink_kernel_release(net->xfrm.nlsk_stash);
4029a6483b79SAlexey Dobriyan }
4030a6483b79SAlexey Dobriyan
4031a6483b79SAlexey Dobriyan static struct pernet_operations xfrm_user_net_ops = {
4032a6483b79SAlexey Dobriyan .init = xfrm_user_net_init,
40336218fe18SFlorian Westphal .pre_exit = xfrm_user_net_pre_exit,
4034d79d792eSEric W. Biederman .exit_batch = xfrm_user_net_exit,
4035a6483b79SAlexey Dobriyan };
4036a6483b79SAlexey Dobriyan
xfrm_user_init(void)4037a6483b79SAlexey Dobriyan static int __init xfrm_user_init(void)
4038a6483b79SAlexey Dobriyan {
4039a6483b79SAlexey Dobriyan int rv;
4040a6483b79SAlexey Dobriyan
4041a6483b79SAlexey Dobriyan printk(KERN_INFO "Initializing XFRM netlink socket\n");
4042a6483b79SAlexey Dobriyan
4043a6483b79SAlexey Dobriyan rv = register_pernet_subsys(&xfrm_user_net_ops);
4044a6483b79SAlexey Dobriyan if (rv < 0)
4045a6483b79SAlexey Dobriyan return rv;
4046f41b284aSZhengchao Shao xfrm_register_km(&netlink_mgr);
4047f41b284aSZhengchao Shao return 0;
4048a6483b79SAlexey Dobriyan }
4049a6483b79SAlexey Dobriyan
xfrm_user_exit(void)40501da177e4SLinus Torvalds static void __exit xfrm_user_exit(void)
40511da177e4SLinus Torvalds {
40521da177e4SLinus Torvalds xfrm_unregister_km(&netlink_mgr);
4053a6483b79SAlexey Dobriyan unregister_pernet_subsys(&xfrm_user_net_ops);
40541da177e4SLinus Torvalds }
40551da177e4SLinus Torvalds
40561da177e4SLinus Torvalds module_init(xfrm_user_init);
40571da177e4SLinus Torvalds module_exit(xfrm_user_exit);
40582599bb5eSBreno Leitao MODULE_DESCRIPTION("XFRM User interface");
40591da177e4SLinus Torvalds MODULE_LICENSE("GPL");
40604fdb3bb7SHarald Welte MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
4061