11da177e4SLinus Torvalds /* xfrm_user.c: User interface to configure xfrm engine. 21da177e4SLinus Torvalds * 31da177e4SLinus Torvalds * Copyright (C) 2002 David S. Miller (davem@redhat.com) 41da177e4SLinus Torvalds * 51da177e4SLinus Torvalds * Changes: 61da177e4SLinus Torvalds * Mitsuru KANDA @USAGI 71da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI 81da177e4SLinus Torvalds * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 91da177e4SLinus Torvalds * IPv6 support 101da177e4SLinus Torvalds * 111da177e4SLinus Torvalds */ 121da177e4SLinus Torvalds 139409f38aSHerbert Xu #include <linux/crypto.h> 141da177e4SLinus Torvalds #include <linux/module.h> 151da177e4SLinus Torvalds #include <linux/kernel.h> 161da177e4SLinus Torvalds #include <linux/types.h> 171da177e4SLinus Torvalds #include <linux/slab.h> 181da177e4SLinus Torvalds #include <linux/socket.h> 191da177e4SLinus Torvalds #include <linux/string.h> 201da177e4SLinus Torvalds #include <linux/net.h> 211da177e4SLinus Torvalds #include <linux/skbuff.h> 221da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 231da177e4SLinus Torvalds #include <linux/ipsec.h> 241da177e4SLinus Torvalds #include <linux/init.h> 251da177e4SLinus Torvalds #include <linux/security.h> 261da177e4SLinus Torvalds #include <net/sock.h> 271da177e4SLinus Torvalds #include <net/xfrm.h> 2888fc2c84SThomas Graf #include <net/netlink.h> 291da177e4SLinus Torvalds #include <asm/uaccess.h> 30e23c7194SMasahide NAKAMURA #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 31e23c7194SMasahide NAKAMURA #include <linux/in6.h> 32e23c7194SMasahide NAKAMURA #endif 331da177e4SLinus Torvalds 341a6509d9SHerbert Xu static inline int aead_len(struct xfrm_algo_aead *alg) 351a6509d9SHerbert Xu { 361a6509d9SHerbert Xu return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 371a6509d9SHerbert Xu } 381a6509d9SHerbert Xu 395424f32eSThomas Graf static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type) 401da177e4SLinus Torvalds { 415424f32eSThomas Graf struct nlattr *rt = attrs[type]; 421da177e4SLinus Torvalds struct xfrm_algo *algp; 431da177e4SLinus Torvalds 441da177e4SLinus Torvalds if (!rt) 451da177e4SLinus Torvalds return 0; 461da177e4SLinus Torvalds 475424f32eSThomas Graf algp = nla_data(rt); 480f99be0dSEric Dumazet if (nla_len(rt) < xfrm_alg_len(algp)) 4931c26852SHerbert Xu return -EINVAL; 5031c26852SHerbert Xu 511da177e4SLinus Torvalds switch (type) { 521da177e4SLinus Torvalds case XFRMA_ALG_AUTH: 531da177e4SLinus Torvalds if (!algp->alg_key_len && 541da177e4SLinus Torvalds strcmp(algp->alg_name, "digest_null") != 0) 551da177e4SLinus Torvalds return -EINVAL; 561da177e4SLinus Torvalds break; 571da177e4SLinus Torvalds 581da177e4SLinus Torvalds case XFRMA_ALG_CRYPT: 591da177e4SLinus Torvalds if (!algp->alg_key_len && 601da177e4SLinus Torvalds strcmp(algp->alg_name, "cipher_null") != 0) 611da177e4SLinus Torvalds return -EINVAL; 621da177e4SLinus Torvalds break; 631da177e4SLinus Torvalds 641da177e4SLinus Torvalds case XFRMA_ALG_COMP: 651da177e4SLinus Torvalds /* Zero length keys are legal. */ 661da177e4SLinus Torvalds break; 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds default: 691da177e4SLinus Torvalds return -EINVAL; 703ff50b79SStephen Hemminger } 711da177e4SLinus Torvalds 721da177e4SLinus Torvalds algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0'; 731da177e4SLinus Torvalds return 0; 741da177e4SLinus Torvalds } 751da177e4SLinus Torvalds 761a6509d9SHerbert Xu static int verify_aead(struct nlattr **attrs) 771a6509d9SHerbert Xu { 781a6509d9SHerbert Xu struct nlattr *rt = attrs[XFRMA_ALG_AEAD]; 791a6509d9SHerbert Xu struct xfrm_algo_aead *algp; 801a6509d9SHerbert Xu 811a6509d9SHerbert Xu if (!rt) 821a6509d9SHerbert Xu return 0; 831a6509d9SHerbert Xu 841a6509d9SHerbert Xu algp = nla_data(rt); 851a6509d9SHerbert Xu if (nla_len(rt) < aead_len(algp)) 861a6509d9SHerbert Xu return -EINVAL; 871a6509d9SHerbert Xu 881a6509d9SHerbert Xu algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0'; 891a6509d9SHerbert Xu return 0; 901a6509d9SHerbert Xu } 911a6509d9SHerbert Xu 925424f32eSThomas Graf static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type, 93eb2971b6SMasahide NAKAMURA xfrm_address_t **addrp) 94eb2971b6SMasahide NAKAMURA { 955424f32eSThomas Graf struct nlattr *rt = attrs[type]; 96eb2971b6SMasahide NAKAMURA 97cf5cb79fSThomas Graf if (rt && addrp) 985424f32eSThomas Graf *addrp = nla_data(rt); 99eb2971b6SMasahide NAKAMURA } 100df71837dSTrent Jaeger 1015424f32eSThomas Graf static inline int verify_sec_ctx_len(struct nlattr **attrs) 102df71837dSTrent Jaeger { 1035424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 104df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx; 105df71837dSTrent Jaeger 106df71837dSTrent Jaeger if (!rt) 107df71837dSTrent Jaeger return 0; 108df71837dSTrent Jaeger 1095424f32eSThomas Graf uctx = nla_data(rt); 110cf5cb79fSThomas Graf if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) 111df71837dSTrent Jaeger return -EINVAL; 112df71837dSTrent Jaeger 113df71837dSTrent Jaeger return 0; 114df71837dSTrent Jaeger } 115df71837dSTrent Jaeger 116df71837dSTrent Jaeger 1171da177e4SLinus Torvalds static int verify_newsa_info(struct xfrm_usersa_info *p, 1185424f32eSThomas Graf struct nlattr **attrs) 1191da177e4SLinus Torvalds { 1201da177e4SLinus Torvalds int err; 1211da177e4SLinus Torvalds 1221da177e4SLinus Torvalds err = -EINVAL; 1231da177e4SLinus Torvalds switch (p->family) { 1241da177e4SLinus Torvalds case AF_INET: 1251da177e4SLinus Torvalds break; 1261da177e4SLinus Torvalds 1271da177e4SLinus Torvalds case AF_INET6: 1281da177e4SLinus Torvalds #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1291da177e4SLinus Torvalds break; 1301da177e4SLinus Torvalds #else 1311da177e4SLinus Torvalds err = -EAFNOSUPPORT; 1321da177e4SLinus Torvalds goto out; 1331da177e4SLinus Torvalds #endif 1341da177e4SLinus Torvalds 1351da177e4SLinus Torvalds default: 1361da177e4SLinus Torvalds goto out; 1373ff50b79SStephen Hemminger } 1381da177e4SLinus Torvalds 1391da177e4SLinus Torvalds err = -EINVAL; 1401da177e4SLinus Torvalds switch (p->id.proto) { 1411da177e4SLinus Torvalds case IPPROTO_AH: 14235a7aa08SThomas Graf if (!attrs[XFRMA_ALG_AUTH] || 1431a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 14435a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] || 14535a7aa08SThomas Graf attrs[XFRMA_ALG_COMP]) 1461da177e4SLinus Torvalds goto out; 1471da177e4SLinus Torvalds break; 1481da177e4SLinus Torvalds 1491da177e4SLinus Torvalds case IPPROTO_ESP: 1501a6509d9SHerbert Xu if (attrs[XFRMA_ALG_COMP]) 1511a6509d9SHerbert Xu goto out; 1521a6509d9SHerbert Xu if (!attrs[XFRMA_ALG_AUTH] && 1531a6509d9SHerbert Xu !attrs[XFRMA_ALG_CRYPT] && 1541a6509d9SHerbert Xu !attrs[XFRMA_ALG_AEAD]) 1551a6509d9SHerbert Xu goto out; 1561a6509d9SHerbert Xu if ((attrs[XFRMA_ALG_AUTH] || 1571a6509d9SHerbert Xu attrs[XFRMA_ALG_CRYPT]) && 1581a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD]) 1591da177e4SLinus Torvalds goto out; 1601da177e4SLinus Torvalds break; 1611da177e4SLinus Torvalds 1621da177e4SLinus Torvalds case IPPROTO_COMP: 16335a7aa08SThomas Graf if (!attrs[XFRMA_ALG_COMP] || 1641a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 16535a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] || 16635a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT]) 1671da177e4SLinus Torvalds goto out; 1681da177e4SLinus Torvalds break; 1691da177e4SLinus Torvalds 170e23c7194SMasahide NAKAMURA #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 171e23c7194SMasahide NAKAMURA case IPPROTO_DSTOPTS: 172e23c7194SMasahide NAKAMURA case IPPROTO_ROUTING: 17335a7aa08SThomas Graf if (attrs[XFRMA_ALG_COMP] || 17435a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] || 1751a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 17635a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] || 17735a7aa08SThomas Graf attrs[XFRMA_ENCAP] || 17835a7aa08SThomas Graf attrs[XFRMA_SEC_CTX] || 17935a7aa08SThomas Graf !attrs[XFRMA_COADDR]) 180e23c7194SMasahide NAKAMURA goto out; 181e23c7194SMasahide NAKAMURA break; 182e23c7194SMasahide NAKAMURA #endif 183e23c7194SMasahide NAKAMURA 1841da177e4SLinus Torvalds default: 1851da177e4SLinus Torvalds goto out; 1863ff50b79SStephen Hemminger } 1871da177e4SLinus Torvalds 1881a6509d9SHerbert Xu if ((err = verify_aead(attrs))) 1891a6509d9SHerbert Xu goto out; 19035a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH))) 1911da177e4SLinus Torvalds goto out; 19235a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT))) 1931da177e4SLinus Torvalds goto out; 19435a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP))) 1951da177e4SLinus Torvalds goto out; 19635a7aa08SThomas Graf if ((err = verify_sec_ctx_len(attrs))) 197df71837dSTrent Jaeger goto out; 1981da177e4SLinus Torvalds 1991da177e4SLinus Torvalds err = -EINVAL; 2001da177e4SLinus Torvalds switch (p->mode) { 2017e49e6deSMasahide NAKAMURA case XFRM_MODE_TRANSPORT: 2027e49e6deSMasahide NAKAMURA case XFRM_MODE_TUNNEL: 203060f02a3SNoriaki TAKAMIYA case XFRM_MODE_ROUTEOPTIMIZATION: 2040a69452cSDiego Beltrami case XFRM_MODE_BEET: 2051da177e4SLinus Torvalds break; 2061da177e4SLinus Torvalds 2071da177e4SLinus Torvalds default: 2081da177e4SLinus Torvalds goto out; 2093ff50b79SStephen Hemminger } 2101da177e4SLinus Torvalds 2111da177e4SLinus Torvalds err = 0; 2121da177e4SLinus Torvalds 2131da177e4SLinus Torvalds out: 2141da177e4SLinus Torvalds return err; 2151da177e4SLinus Torvalds } 2161da177e4SLinus Torvalds 2171da177e4SLinus Torvalds static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 2181da177e4SLinus Torvalds struct xfrm_algo_desc *(*get_byname)(char *, int), 2195424f32eSThomas Graf struct nlattr *rta) 2201da177e4SLinus Torvalds { 2211da177e4SLinus Torvalds struct xfrm_algo *p, *ualg; 2221da177e4SLinus Torvalds struct xfrm_algo_desc *algo; 2231da177e4SLinus Torvalds 2241da177e4SLinus Torvalds if (!rta) 2251da177e4SLinus Torvalds return 0; 2261da177e4SLinus Torvalds 2275424f32eSThomas Graf ualg = nla_data(rta); 2281da177e4SLinus Torvalds 2291da177e4SLinus Torvalds algo = get_byname(ualg->alg_name, 1); 2301da177e4SLinus Torvalds if (!algo) 2311da177e4SLinus Torvalds return -ENOSYS; 2321da177e4SLinus Torvalds *props = algo->desc.sadb_alg_id; 2331da177e4SLinus Torvalds 2340f99be0dSEric Dumazet p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 2351da177e4SLinus Torvalds if (!p) 2361da177e4SLinus Torvalds return -ENOMEM; 2371da177e4SLinus Torvalds 23804ff1260SHerbert Xu strcpy(p->alg_name, algo->name); 2391da177e4SLinus Torvalds *algpp = p; 2401da177e4SLinus Torvalds return 0; 2411da177e4SLinus Torvalds } 2421da177e4SLinus Torvalds 2431a6509d9SHerbert Xu static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props, 2441a6509d9SHerbert Xu struct nlattr *rta) 2451a6509d9SHerbert Xu { 2461a6509d9SHerbert Xu struct xfrm_algo_aead *p, *ualg; 2471a6509d9SHerbert Xu struct xfrm_algo_desc *algo; 2481a6509d9SHerbert Xu 2491a6509d9SHerbert Xu if (!rta) 2501a6509d9SHerbert Xu return 0; 2511a6509d9SHerbert Xu 2521a6509d9SHerbert Xu ualg = nla_data(rta); 2531a6509d9SHerbert Xu 2541a6509d9SHerbert Xu algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1); 2551a6509d9SHerbert Xu if (!algo) 2561a6509d9SHerbert Xu return -ENOSYS; 2571a6509d9SHerbert Xu *props = algo->desc.sadb_alg_id; 2581a6509d9SHerbert Xu 2591a6509d9SHerbert Xu p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL); 2601a6509d9SHerbert Xu if (!p) 2611a6509d9SHerbert Xu return -ENOMEM; 2621a6509d9SHerbert Xu 2631a6509d9SHerbert Xu strcpy(p->alg_name, algo->name); 2641a6509d9SHerbert Xu *algpp = p; 2651a6509d9SHerbert Xu return 0; 2661a6509d9SHerbert Xu } 2671a6509d9SHerbert Xu 268661697f7SJoy Latten static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx) 269df71837dSTrent Jaeger { 270df71837dSTrent Jaeger int len = 0; 271df71837dSTrent Jaeger 272df71837dSTrent Jaeger if (xfrm_ctx) { 273df71837dSTrent Jaeger len += sizeof(struct xfrm_user_sec_ctx); 274df71837dSTrent Jaeger len += xfrm_ctx->ctx_len; 275df71837dSTrent Jaeger } 276df71837dSTrent Jaeger return len; 277df71837dSTrent Jaeger } 278df71837dSTrent Jaeger 2791da177e4SLinus Torvalds static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 2801da177e4SLinus Torvalds { 2811da177e4SLinus Torvalds memcpy(&x->id, &p->id, sizeof(x->id)); 2821da177e4SLinus Torvalds memcpy(&x->sel, &p->sel, sizeof(x->sel)); 2831da177e4SLinus Torvalds memcpy(&x->lft, &p->lft, sizeof(x->lft)); 2841da177e4SLinus Torvalds x->props.mode = p->mode; 2851da177e4SLinus Torvalds x->props.replay_window = p->replay_window; 2861da177e4SLinus Torvalds x->props.reqid = p->reqid; 2871da177e4SLinus Torvalds x->props.family = p->family; 28854489c14SDavid S. Miller memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr)); 2891da177e4SLinus Torvalds x->props.flags = p->flags; 290196b0036SHerbert Xu 291bcf0dda8SPatrick McHardy if (!x->sel.family) 292196b0036SHerbert Xu x->sel.family = p->family; 293df9dcb45SKazunori MIYAZAWA 2941da177e4SLinus Torvalds } 2951da177e4SLinus Torvalds 296d51d081dSJamal Hadi Salim /* 297d51d081dSJamal Hadi Salim * someday when pfkey also has support, we could have the code 298d51d081dSJamal Hadi Salim * somehow made shareable and move it to xfrm_state.c - JHS 299d51d081dSJamal Hadi Salim * 300d51d081dSJamal Hadi Salim */ 3015424f32eSThomas Graf static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs) 302d51d081dSJamal Hadi Salim { 3035424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 3045424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 3055424f32eSThomas Graf struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 3065424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 307d51d081dSJamal Hadi Salim 308d51d081dSJamal Hadi Salim if (rp) { 309d51d081dSJamal Hadi Salim struct xfrm_replay_state *replay; 3105424f32eSThomas Graf replay = nla_data(rp); 311d51d081dSJamal Hadi Salim memcpy(&x->replay, replay, sizeof(*replay)); 312d51d081dSJamal Hadi Salim memcpy(&x->preplay, replay, sizeof(*replay)); 313d51d081dSJamal Hadi Salim } 314d51d081dSJamal Hadi Salim 315d51d081dSJamal Hadi Salim if (lt) { 316d51d081dSJamal Hadi Salim struct xfrm_lifetime_cur *ltime; 3175424f32eSThomas Graf ltime = nla_data(lt); 318d51d081dSJamal Hadi Salim x->curlft.bytes = ltime->bytes; 319d51d081dSJamal Hadi Salim x->curlft.packets = ltime->packets; 320d51d081dSJamal Hadi Salim x->curlft.add_time = ltime->add_time; 321d51d081dSJamal Hadi Salim x->curlft.use_time = ltime->use_time; 322d51d081dSJamal Hadi Salim } 323d51d081dSJamal Hadi Salim 324cf5cb79fSThomas Graf if (et) 3255424f32eSThomas Graf x->replay_maxage = nla_get_u32(et); 326d51d081dSJamal Hadi Salim 327cf5cb79fSThomas Graf if (rt) 3285424f32eSThomas Graf x->replay_maxdiff = nla_get_u32(rt); 329d51d081dSJamal Hadi Salim } 330d51d081dSJamal Hadi Salim 3311da177e4SLinus Torvalds static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p, 3325424f32eSThomas Graf struct nlattr **attrs, 3331da177e4SLinus Torvalds int *errp) 3341da177e4SLinus Torvalds { 3351da177e4SLinus Torvalds struct xfrm_state *x = xfrm_state_alloc(); 3361da177e4SLinus Torvalds int err = -ENOMEM; 3371da177e4SLinus Torvalds 3381da177e4SLinus Torvalds if (!x) 3391da177e4SLinus Torvalds goto error_no_put; 3401da177e4SLinus Torvalds 3411da177e4SLinus Torvalds copy_from_user_state(x, p); 3421da177e4SLinus Torvalds 3431a6509d9SHerbert Xu if ((err = attach_aead(&x->aead, &x->props.ealgo, 3441a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD]))) 3451a6509d9SHerbert Xu goto error; 3461da177e4SLinus Torvalds if ((err = attach_one_algo(&x->aalg, &x->props.aalgo, 3471da177e4SLinus Torvalds xfrm_aalg_get_byname, 34835a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH]))) 3491da177e4SLinus Torvalds goto error; 3501da177e4SLinus Torvalds if ((err = attach_one_algo(&x->ealg, &x->props.ealgo, 3511da177e4SLinus Torvalds xfrm_ealg_get_byname, 35235a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT]))) 3531da177e4SLinus Torvalds goto error; 3541da177e4SLinus Torvalds if ((err = attach_one_algo(&x->calg, &x->props.calgo, 3551da177e4SLinus Torvalds xfrm_calg_get_byname, 35635a7aa08SThomas Graf attrs[XFRMA_ALG_COMP]))) 3571da177e4SLinus Torvalds goto error; 358fd21150aSThomas Graf 359fd21150aSThomas Graf if (attrs[XFRMA_ENCAP]) { 360fd21150aSThomas Graf x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 361fd21150aSThomas Graf sizeof(*x->encap), GFP_KERNEL); 362fd21150aSThomas Graf if (x->encap == NULL) 3631da177e4SLinus Torvalds goto error; 364fd21150aSThomas Graf } 365fd21150aSThomas Graf 366fd21150aSThomas Graf if (attrs[XFRMA_COADDR]) { 367fd21150aSThomas Graf x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), 368fd21150aSThomas Graf sizeof(*x->coaddr), GFP_KERNEL); 369fd21150aSThomas Graf if (x->coaddr == NULL) 370060f02a3SNoriaki TAKAMIYA goto error; 371fd21150aSThomas Graf } 372fd21150aSThomas Graf 37372cb6962SHerbert Xu err = xfrm_init_state(x); 3741da177e4SLinus Torvalds if (err) 3751da177e4SLinus Torvalds goto error; 3761da177e4SLinus Torvalds 377fd21150aSThomas Graf if (attrs[XFRMA_SEC_CTX] && 378fd21150aSThomas Graf security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX]))) 379df71837dSTrent Jaeger goto error; 380df71837dSTrent Jaeger 3811da177e4SLinus Torvalds x->km.seq = p->seq; 382d51d081dSJamal Hadi Salim x->replay_maxdiff = sysctl_xfrm_aevent_rseqth; 383d51d081dSJamal Hadi Salim /* sysctl_xfrm_aevent_etime is in 100ms units */ 384d51d081dSJamal Hadi Salim x->replay_maxage = (sysctl_xfrm_aevent_etime*HZ)/XFRM_AE_ETH_M; 385d51d081dSJamal Hadi Salim x->preplay.bitmap = 0; 386d51d081dSJamal Hadi Salim x->preplay.seq = x->replay.seq+x->replay_maxdiff; 387d51d081dSJamal Hadi Salim x->preplay.oseq = x->replay.oseq +x->replay_maxdiff; 388d51d081dSJamal Hadi Salim 389d51d081dSJamal Hadi Salim /* override default values from above */ 390d51d081dSJamal Hadi Salim 3915424f32eSThomas Graf xfrm_update_ae_params(x, attrs); 3921da177e4SLinus Torvalds 3931da177e4SLinus Torvalds return x; 3941da177e4SLinus Torvalds 3951da177e4SLinus Torvalds error: 3961da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD; 3971da177e4SLinus Torvalds xfrm_state_put(x); 3981da177e4SLinus Torvalds error_no_put: 3991da177e4SLinus Torvalds *errp = err; 4001da177e4SLinus Torvalds return NULL; 4011da177e4SLinus Torvalds } 4021da177e4SLinus Torvalds 40322e70050SChristoph Hellwig static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 4045424f32eSThomas Graf struct nlattr **attrs) 4051da177e4SLinus Torvalds { 4067b67c857SThomas Graf struct xfrm_usersa_info *p = nlmsg_data(nlh); 4071da177e4SLinus Torvalds struct xfrm_state *x; 4081da177e4SLinus Torvalds int err; 40926b15dadSJamal Hadi Salim struct km_event c; 4101da177e4SLinus Torvalds 41135a7aa08SThomas Graf err = verify_newsa_info(p, attrs); 4121da177e4SLinus Torvalds if (err) 4131da177e4SLinus Torvalds return err; 4141da177e4SLinus Torvalds 41535a7aa08SThomas Graf x = xfrm_state_construct(p, attrs, &err); 4161da177e4SLinus Torvalds if (!x) 4171da177e4SLinus Torvalds return err; 4181da177e4SLinus Torvalds 41926b15dadSJamal Hadi Salim xfrm_state_hold(x); 4201da177e4SLinus Torvalds if (nlh->nlmsg_type == XFRM_MSG_NEWSA) 4211da177e4SLinus Torvalds err = xfrm_state_add(x); 4221da177e4SLinus Torvalds else 4231da177e4SLinus Torvalds err = xfrm_state_update(x); 4241da177e4SLinus Torvalds 425ab5f5e8bSJoy Latten xfrm_audit_state_add(x, err ? 0 : 1, NETLINK_CB(skb).loginuid, 426ab5f5e8bSJoy Latten NETLINK_CB(skb).sid); 427161a09e7SJoy Latten 4281da177e4SLinus Torvalds if (err < 0) { 4291da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD; 43021380b81SHerbert Xu __xfrm_state_put(x); 4317d6dfe1fSPatrick McHardy goto out; 4321da177e4SLinus Torvalds } 4331da177e4SLinus Torvalds 43426b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 43526b15dadSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 436f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 43726b15dadSJamal Hadi Salim 43826b15dadSJamal Hadi Salim km_state_notify(x, &c); 4397d6dfe1fSPatrick McHardy out: 44026b15dadSJamal Hadi Salim xfrm_state_put(x); 4411da177e4SLinus Torvalds return err; 4421da177e4SLinus Torvalds } 4431da177e4SLinus Torvalds 444eb2971b6SMasahide NAKAMURA static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p, 4455424f32eSThomas Graf struct nlattr **attrs, 446eb2971b6SMasahide NAKAMURA int *errp) 447eb2971b6SMasahide NAKAMURA { 448eb2971b6SMasahide NAKAMURA struct xfrm_state *x = NULL; 449eb2971b6SMasahide NAKAMURA int err; 450eb2971b6SMasahide NAKAMURA 451eb2971b6SMasahide NAKAMURA if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) { 452eb2971b6SMasahide NAKAMURA err = -ESRCH; 453eb2971b6SMasahide NAKAMURA x = xfrm_state_lookup(&p->daddr, p->spi, p->proto, p->family); 454eb2971b6SMasahide NAKAMURA } else { 455eb2971b6SMasahide NAKAMURA xfrm_address_t *saddr = NULL; 456eb2971b6SMasahide NAKAMURA 45735a7aa08SThomas Graf verify_one_addr(attrs, XFRMA_SRCADDR, &saddr); 458eb2971b6SMasahide NAKAMURA if (!saddr) { 459eb2971b6SMasahide NAKAMURA err = -EINVAL; 460eb2971b6SMasahide NAKAMURA goto out; 461eb2971b6SMasahide NAKAMURA } 462eb2971b6SMasahide NAKAMURA 4639abbffeeSMasahide NAKAMURA err = -ESRCH; 464eb2971b6SMasahide NAKAMURA x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto, 465eb2971b6SMasahide NAKAMURA p->family); 466eb2971b6SMasahide NAKAMURA } 467eb2971b6SMasahide NAKAMURA 468eb2971b6SMasahide NAKAMURA out: 469eb2971b6SMasahide NAKAMURA if (!x && errp) 470eb2971b6SMasahide NAKAMURA *errp = err; 471eb2971b6SMasahide NAKAMURA return x; 472eb2971b6SMasahide NAKAMURA } 473eb2971b6SMasahide NAKAMURA 47422e70050SChristoph Hellwig static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 4755424f32eSThomas Graf struct nlattr **attrs) 4761da177e4SLinus Torvalds { 4771da177e4SLinus Torvalds struct xfrm_state *x; 478eb2971b6SMasahide NAKAMURA int err = -ESRCH; 47926b15dadSJamal Hadi Salim struct km_event c; 4807b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh); 4811da177e4SLinus Torvalds 48235a7aa08SThomas Graf x = xfrm_user_state_lookup(p, attrs, &err); 4831da177e4SLinus Torvalds if (x == NULL) 484eb2971b6SMasahide NAKAMURA return err; 4851da177e4SLinus Torvalds 4866f68dc37SDavid S. Miller if ((err = security_xfrm_state_delete(x)) != 0) 487c8c05a8eSCatherine Zhang goto out; 488c8c05a8eSCatherine Zhang 4891da177e4SLinus Torvalds if (xfrm_state_kern(x)) { 490c8c05a8eSCatherine Zhang err = -EPERM; 491c8c05a8eSCatherine Zhang goto out; 4921da177e4SLinus Torvalds } 4931da177e4SLinus Torvalds 49426b15dadSJamal Hadi Salim err = xfrm_state_delete(x); 495161a09e7SJoy Latten 496c8c05a8eSCatherine Zhang if (err < 0) 497c8c05a8eSCatherine Zhang goto out; 49826b15dadSJamal Hadi Salim 49926b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 50026b15dadSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 501f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 50226b15dadSJamal Hadi Salim km_state_notify(x, &c); 5031da177e4SLinus Torvalds 504c8c05a8eSCatherine Zhang out: 505ab5f5e8bSJoy Latten xfrm_audit_state_delete(x, err ? 0 : 1, NETLINK_CB(skb).loginuid, 506ab5f5e8bSJoy Latten NETLINK_CB(skb).sid); 507c8c05a8eSCatherine Zhang xfrm_state_put(x); 50826b15dadSJamal Hadi Salim return err; 5091da177e4SLinus Torvalds } 5101da177e4SLinus Torvalds 5111da177e4SLinus Torvalds static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 5121da177e4SLinus Torvalds { 5131da177e4SLinus Torvalds memcpy(&p->id, &x->id, sizeof(p->id)); 5141da177e4SLinus Torvalds memcpy(&p->sel, &x->sel, sizeof(p->sel)); 5151da177e4SLinus Torvalds memcpy(&p->lft, &x->lft, sizeof(p->lft)); 5161da177e4SLinus Torvalds memcpy(&p->curlft, &x->curlft, sizeof(p->curlft)); 5171da177e4SLinus Torvalds memcpy(&p->stats, &x->stats, sizeof(p->stats)); 51854489c14SDavid S. Miller memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr)); 5191da177e4SLinus Torvalds p->mode = x->props.mode; 5201da177e4SLinus Torvalds p->replay_window = x->props.replay_window; 5211da177e4SLinus Torvalds p->reqid = x->props.reqid; 5221da177e4SLinus Torvalds p->family = x->props.family; 5231da177e4SLinus Torvalds p->flags = x->props.flags; 5241da177e4SLinus Torvalds p->seq = x->km.seq; 5251da177e4SLinus Torvalds } 5261da177e4SLinus Torvalds 5271da177e4SLinus Torvalds struct xfrm_dump_info { 5281da177e4SLinus Torvalds struct sk_buff *in_skb; 5291da177e4SLinus Torvalds struct sk_buff *out_skb; 5301da177e4SLinus Torvalds u32 nlmsg_seq; 5311da177e4SLinus Torvalds u16 nlmsg_flags; 5321da177e4SLinus Torvalds }; 5331da177e4SLinus Torvalds 534c0144beaSThomas Graf static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb) 535c0144beaSThomas Graf { 536c0144beaSThomas Graf struct xfrm_user_sec_ctx *uctx; 537c0144beaSThomas Graf struct nlattr *attr; 53868325d3bSHerbert Xu int ctx_size = sizeof(*uctx) + s->ctx_len; 539c0144beaSThomas Graf 540c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size); 541c0144beaSThomas Graf if (attr == NULL) 542c0144beaSThomas Graf return -EMSGSIZE; 543c0144beaSThomas Graf 544c0144beaSThomas Graf uctx = nla_data(attr); 545c0144beaSThomas Graf uctx->exttype = XFRMA_SEC_CTX; 546c0144beaSThomas Graf uctx->len = ctx_size; 547c0144beaSThomas Graf uctx->ctx_doi = s->ctx_doi; 548c0144beaSThomas Graf uctx->ctx_alg = s->ctx_alg; 549c0144beaSThomas Graf uctx->ctx_len = s->ctx_len; 550c0144beaSThomas Graf memcpy(uctx + 1, s->ctx_str, s->ctx_len); 551c0144beaSThomas Graf 552c0144beaSThomas Graf return 0; 553c0144beaSThomas Graf } 554c0144beaSThomas Graf 55568325d3bSHerbert Xu /* Don't change this without updating xfrm_sa_len! */ 55668325d3bSHerbert Xu static int copy_to_user_state_extra(struct xfrm_state *x, 55768325d3bSHerbert Xu struct xfrm_usersa_info *p, 55868325d3bSHerbert Xu struct sk_buff *skb) 5591da177e4SLinus Torvalds { 5601da177e4SLinus Torvalds copy_to_user_state(x, p); 5611da177e4SLinus Torvalds 562050f009eSHerbert Xu if (x->coaddr) 563050f009eSHerbert Xu NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr); 564050f009eSHerbert Xu 565050f009eSHerbert Xu if (x->lastused) 566050f009eSHerbert Xu NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused); 567050f009eSHerbert Xu 5681a6509d9SHerbert Xu if (x->aead) 5691a6509d9SHerbert Xu NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead); 5701da177e4SLinus Torvalds if (x->aalg) 5710f99be0dSEric Dumazet NLA_PUT(skb, XFRMA_ALG_AUTH, xfrm_alg_len(x->aalg), x->aalg); 5721da177e4SLinus Torvalds if (x->ealg) 5730f99be0dSEric Dumazet NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg); 5741da177e4SLinus Torvalds if (x->calg) 575c0144beaSThomas Graf NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg); 5761da177e4SLinus Torvalds 5771da177e4SLinus Torvalds if (x->encap) 578c0144beaSThomas Graf NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); 5791da177e4SLinus Torvalds 580c0144beaSThomas Graf if (x->security && copy_sec_ctx(x->security, skb) < 0) 581c0144beaSThomas Graf goto nla_put_failure; 582060f02a3SNoriaki TAKAMIYA 58368325d3bSHerbert Xu return 0; 58468325d3bSHerbert Xu 58568325d3bSHerbert Xu nla_put_failure: 58668325d3bSHerbert Xu return -EMSGSIZE; 58768325d3bSHerbert Xu } 58868325d3bSHerbert Xu 58968325d3bSHerbert Xu static int dump_one_state(struct xfrm_state *x, int count, void *ptr) 59068325d3bSHerbert Xu { 59168325d3bSHerbert Xu struct xfrm_dump_info *sp = ptr; 59268325d3bSHerbert Xu struct sk_buff *in_skb = sp->in_skb; 59368325d3bSHerbert Xu struct sk_buff *skb = sp->out_skb; 59468325d3bSHerbert Xu struct xfrm_usersa_info *p; 59568325d3bSHerbert Xu struct nlmsghdr *nlh; 59668325d3bSHerbert Xu int err; 59768325d3bSHerbert Xu 59868325d3bSHerbert Xu nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq, 59968325d3bSHerbert Xu XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags); 60068325d3bSHerbert Xu if (nlh == NULL) 60168325d3bSHerbert Xu return -EMSGSIZE; 60268325d3bSHerbert Xu 60368325d3bSHerbert Xu p = nlmsg_data(nlh); 60468325d3bSHerbert Xu 60568325d3bSHerbert Xu err = copy_to_user_state_extra(x, p, skb); 60668325d3bSHerbert Xu if (err) 60768325d3bSHerbert Xu goto nla_put_failure; 60868325d3bSHerbert Xu 6099825069dSThomas Graf nlmsg_end(skb, nlh); 6101da177e4SLinus Torvalds return 0; 6111da177e4SLinus Torvalds 612c0144beaSThomas Graf nla_put_failure: 6139825069dSThomas Graf nlmsg_cancel(skb, nlh); 61468325d3bSHerbert Xu return err; 6151da177e4SLinus Torvalds } 6161da177e4SLinus Torvalds 6174c563f76STimo Teras static int xfrm_dump_sa_done(struct netlink_callback *cb) 6184c563f76STimo Teras { 6194c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 6204c563f76STimo Teras xfrm_state_walk_done(walk); 6214c563f76STimo Teras return 0; 6224c563f76STimo Teras } 6234c563f76STimo Teras 6241da177e4SLinus Torvalds static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) 6251da177e4SLinus Torvalds { 6264c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 6271da177e4SLinus Torvalds struct xfrm_dump_info info; 6281da177e4SLinus Torvalds 6294c563f76STimo Teras BUILD_BUG_ON(sizeof(struct xfrm_state_walk) > 6304c563f76STimo Teras sizeof(cb->args) - sizeof(cb->args[0])); 6314c563f76STimo Teras 6321da177e4SLinus Torvalds info.in_skb = cb->skb; 6331da177e4SLinus Torvalds info.out_skb = skb; 6341da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq; 6351da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI; 6364c563f76STimo Teras 6374c563f76STimo Teras if (!cb->args[0]) { 6384c563f76STimo Teras cb->args[0] = 1; 6394c563f76STimo Teras xfrm_state_walk_init(walk, 0); 6404c563f76STimo Teras } 6414c563f76STimo Teras 6424c563f76STimo Teras (void) xfrm_state_walk(walk, dump_one_state, &info); 6431da177e4SLinus Torvalds 6441da177e4SLinus Torvalds return skb->len; 6451da177e4SLinus Torvalds } 6461da177e4SLinus Torvalds 6471da177e4SLinus Torvalds static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, 6481da177e4SLinus Torvalds struct xfrm_state *x, u32 seq) 6491da177e4SLinus Torvalds { 6501da177e4SLinus Torvalds struct xfrm_dump_info info; 6511da177e4SLinus Torvalds struct sk_buff *skb; 6521da177e4SLinus Torvalds 6537deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 6541da177e4SLinus Torvalds if (!skb) 6551da177e4SLinus Torvalds return ERR_PTR(-ENOMEM); 6561da177e4SLinus Torvalds 6571da177e4SLinus Torvalds info.in_skb = in_skb; 6581da177e4SLinus Torvalds info.out_skb = skb; 6591da177e4SLinus Torvalds info.nlmsg_seq = seq; 6601da177e4SLinus Torvalds info.nlmsg_flags = 0; 6611da177e4SLinus Torvalds 6621da177e4SLinus Torvalds if (dump_one_state(x, 0, &info)) { 6631da177e4SLinus Torvalds kfree_skb(skb); 6641da177e4SLinus Torvalds return NULL; 6651da177e4SLinus Torvalds } 6661da177e4SLinus Torvalds 6671da177e4SLinus Torvalds return skb; 6681da177e4SLinus Torvalds } 6691da177e4SLinus Torvalds 6707deb2264SThomas Graf static inline size_t xfrm_spdinfo_msgsize(void) 6717deb2264SThomas Graf { 6727deb2264SThomas Graf return NLMSG_ALIGN(4) 6737deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_spdinfo)) 6747deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_spdhinfo)); 6757deb2264SThomas Graf } 6767deb2264SThomas Graf 677ecfd6b18SJamal Hadi Salim static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags) 678ecfd6b18SJamal Hadi Salim { 6795a6d3416SJamal Hadi Salim struct xfrmk_spdinfo si; 6805a6d3416SJamal Hadi Salim struct xfrmu_spdinfo spc; 6815a6d3416SJamal Hadi Salim struct xfrmu_spdhinfo sph; 682ecfd6b18SJamal Hadi Salim struct nlmsghdr *nlh; 683ecfd6b18SJamal Hadi Salim u32 *f; 684ecfd6b18SJamal Hadi Salim 685ecfd6b18SJamal Hadi Salim nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0); 686ecfd6b18SJamal Hadi Salim if (nlh == NULL) /* shouldnt really happen ... */ 687ecfd6b18SJamal Hadi Salim return -EMSGSIZE; 688ecfd6b18SJamal Hadi Salim 689ecfd6b18SJamal Hadi Salim f = nlmsg_data(nlh); 690ecfd6b18SJamal Hadi Salim *f = flags; 691ecfd6b18SJamal Hadi Salim xfrm_spd_getinfo(&si); 6925a6d3416SJamal Hadi Salim spc.incnt = si.incnt; 6935a6d3416SJamal Hadi Salim spc.outcnt = si.outcnt; 6945a6d3416SJamal Hadi Salim spc.fwdcnt = si.fwdcnt; 6955a6d3416SJamal Hadi Salim spc.inscnt = si.inscnt; 6965a6d3416SJamal Hadi Salim spc.outscnt = si.outscnt; 6975a6d3416SJamal Hadi Salim spc.fwdscnt = si.fwdscnt; 6985a6d3416SJamal Hadi Salim sph.spdhcnt = si.spdhcnt; 6995a6d3416SJamal Hadi Salim sph.spdhmcnt = si.spdhmcnt; 700ecfd6b18SJamal Hadi Salim 7015a6d3416SJamal Hadi Salim NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc); 7025a6d3416SJamal Hadi Salim NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph); 703ecfd6b18SJamal Hadi Salim 704ecfd6b18SJamal Hadi Salim return nlmsg_end(skb, nlh); 705ecfd6b18SJamal Hadi Salim 706ecfd6b18SJamal Hadi Salim nla_put_failure: 707ecfd6b18SJamal Hadi Salim nlmsg_cancel(skb, nlh); 708ecfd6b18SJamal Hadi Salim return -EMSGSIZE; 709ecfd6b18SJamal Hadi Salim } 710ecfd6b18SJamal Hadi Salim 711ecfd6b18SJamal Hadi Salim static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 7125424f32eSThomas Graf struct nlattr **attrs) 713ecfd6b18SJamal Hadi Salim { 714ecfd6b18SJamal Hadi Salim struct sk_buff *r_skb; 7157b67c857SThomas Graf u32 *flags = nlmsg_data(nlh); 716ecfd6b18SJamal Hadi Salim u32 spid = NETLINK_CB(skb).pid; 717ecfd6b18SJamal Hadi Salim u32 seq = nlh->nlmsg_seq; 718ecfd6b18SJamal Hadi Salim 7197deb2264SThomas Graf r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC); 720ecfd6b18SJamal Hadi Salim if (r_skb == NULL) 721ecfd6b18SJamal Hadi Salim return -ENOMEM; 722ecfd6b18SJamal Hadi Salim 723ecfd6b18SJamal Hadi Salim if (build_spdinfo(r_skb, spid, seq, *flags) < 0) 724ecfd6b18SJamal Hadi Salim BUG(); 725ecfd6b18SJamal Hadi Salim 726ecfd6b18SJamal Hadi Salim return nlmsg_unicast(xfrm_nl, r_skb, spid); 727ecfd6b18SJamal Hadi Salim } 728ecfd6b18SJamal Hadi Salim 7297deb2264SThomas Graf static inline size_t xfrm_sadinfo_msgsize(void) 7307deb2264SThomas Graf { 7317deb2264SThomas Graf return NLMSG_ALIGN(4) 7327deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_sadhinfo)) 7337deb2264SThomas Graf + nla_total_size(4); /* XFRMA_SAD_CNT */ 7347deb2264SThomas Graf } 7357deb2264SThomas Graf 73628d8909bSJamal Hadi Salim static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags) 73728d8909bSJamal Hadi Salim { 738af11e316SJamal Hadi Salim struct xfrmk_sadinfo si; 739af11e316SJamal Hadi Salim struct xfrmu_sadhinfo sh; 74028d8909bSJamal Hadi Salim struct nlmsghdr *nlh; 74128d8909bSJamal Hadi Salim u32 *f; 74228d8909bSJamal Hadi Salim 74328d8909bSJamal Hadi Salim nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0); 74428d8909bSJamal Hadi Salim if (nlh == NULL) /* shouldnt really happen ... */ 74528d8909bSJamal Hadi Salim return -EMSGSIZE; 74628d8909bSJamal Hadi Salim 74728d8909bSJamal Hadi Salim f = nlmsg_data(nlh); 74828d8909bSJamal Hadi Salim *f = flags; 74928d8909bSJamal Hadi Salim xfrm_sad_getinfo(&si); 75028d8909bSJamal Hadi Salim 751af11e316SJamal Hadi Salim sh.sadhmcnt = si.sadhmcnt; 752af11e316SJamal Hadi Salim sh.sadhcnt = si.sadhcnt; 753af11e316SJamal Hadi Salim 754af11e316SJamal Hadi Salim NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt); 755af11e316SJamal Hadi Salim NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh); 75628d8909bSJamal Hadi Salim 75728d8909bSJamal Hadi Salim return nlmsg_end(skb, nlh); 75828d8909bSJamal Hadi Salim 75928d8909bSJamal Hadi Salim nla_put_failure: 76028d8909bSJamal Hadi Salim nlmsg_cancel(skb, nlh); 76128d8909bSJamal Hadi Salim return -EMSGSIZE; 76228d8909bSJamal Hadi Salim } 76328d8909bSJamal Hadi Salim 76428d8909bSJamal Hadi Salim static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 7655424f32eSThomas Graf struct nlattr **attrs) 76628d8909bSJamal Hadi Salim { 76728d8909bSJamal Hadi Salim struct sk_buff *r_skb; 7687b67c857SThomas Graf u32 *flags = nlmsg_data(nlh); 76928d8909bSJamal Hadi Salim u32 spid = NETLINK_CB(skb).pid; 77028d8909bSJamal Hadi Salim u32 seq = nlh->nlmsg_seq; 77128d8909bSJamal Hadi Salim 7727deb2264SThomas Graf r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC); 77328d8909bSJamal Hadi Salim if (r_skb == NULL) 77428d8909bSJamal Hadi Salim return -ENOMEM; 77528d8909bSJamal Hadi Salim 77628d8909bSJamal Hadi Salim if (build_sadinfo(r_skb, spid, seq, *flags) < 0) 77728d8909bSJamal Hadi Salim BUG(); 77828d8909bSJamal Hadi Salim 77928d8909bSJamal Hadi Salim return nlmsg_unicast(xfrm_nl, r_skb, spid); 78028d8909bSJamal Hadi Salim } 78128d8909bSJamal Hadi Salim 78222e70050SChristoph Hellwig static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 7835424f32eSThomas Graf struct nlattr **attrs) 7841da177e4SLinus Torvalds { 7857b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh); 7861da177e4SLinus Torvalds struct xfrm_state *x; 7871da177e4SLinus Torvalds struct sk_buff *resp_skb; 788eb2971b6SMasahide NAKAMURA int err = -ESRCH; 7891da177e4SLinus Torvalds 79035a7aa08SThomas Graf x = xfrm_user_state_lookup(p, attrs, &err); 7911da177e4SLinus Torvalds if (x == NULL) 7921da177e4SLinus Torvalds goto out_noput; 7931da177e4SLinus Torvalds 7941da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 7951da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 7961da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 7971da177e4SLinus Torvalds } else { 798082a1ad5SThomas Graf err = nlmsg_unicast(xfrm_nl, resp_skb, NETLINK_CB(skb).pid); 7991da177e4SLinus Torvalds } 8001da177e4SLinus Torvalds xfrm_state_put(x); 8011da177e4SLinus Torvalds out_noput: 8021da177e4SLinus Torvalds return err; 8031da177e4SLinus Torvalds } 8041da177e4SLinus Torvalds 8051da177e4SLinus Torvalds static int verify_userspi_info(struct xfrm_userspi_info *p) 8061da177e4SLinus Torvalds { 8071da177e4SLinus Torvalds switch (p->info.id.proto) { 8081da177e4SLinus Torvalds case IPPROTO_AH: 8091da177e4SLinus Torvalds case IPPROTO_ESP: 8101da177e4SLinus Torvalds break; 8111da177e4SLinus Torvalds 8121da177e4SLinus Torvalds case IPPROTO_COMP: 8131da177e4SLinus Torvalds /* IPCOMP spi is 16-bits. */ 8141da177e4SLinus Torvalds if (p->max >= 0x10000) 8151da177e4SLinus Torvalds return -EINVAL; 8161da177e4SLinus Torvalds break; 8171da177e4SLinus Torvalds 8181da177e4SLinus Torvalds default: 8191da177e4SLinus Torvalds return -EINVAL; 8203ff50b79SStephen Hemminger } 8211da177e4SLinus Torvalds 8221da177e4SLinus Torvalds if (p->min > p->max) 8231da177e4SLinus Torvalds return -EINVAL; 8241da177e4SLinus Torvalds 8251da177e4SLinus Torvalds return 0; 8261da177e4SLinus Torvalds } 8271da177e4SLinus Torvalds 82822e70050SChristoph Hellwig static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, 8295424f32eSThomas Graf struct nlattr **attrs) 8301da177e4SLinus Torvalds { 8311da177e4SLinus Torvalds struct xfrm_state *x; 8321da177e4SLinus Torvalds struct xfrm_userspi_info *p; 8331da177e4SLinus Torvalds struct sk_buff *resp_skb; 8341da177e4SLinus Torvalds xfrm_address_t *daddr; 8351da177e4SLinus Torvalds int family; 8361da177e4SLinus Torvalds int err; 8371da177e4SLinus Torvalds 8387b67c857SThomas Graf p = nlmsg_data(nlh); 8391da177e4SLinus Torvalds err = verify_userspi_info(p); 8401da177e4SLinus Torvalds if (err) 8411da177e4SLinus Torvalds goto out_noput; 8421da177e4SLinus Torvalds 8431da177e4SLinus Torvalds family = p->info.family; 8441da177e4SLinus Torvalds daddr = &p->info.id.daddr; 8451da177e4SLinus Torvalds 8461da177e4SLinus Torvalds x = NULL; 8471da177e4SLinus Torvalds if (p->info.seq) { 8481da177e4SLinus Torvalds x = xfrm_find_acq_byseq(p->info.seq); 8491da177e4SLinus Torvalds if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) { 8501da177e4SLinus Torvalds xfrm_state_put(x); 8511da177e4SLinus Torvalds x = NULL; 8521da177e4SLinus Torvalds } 8531da177e4SLinus Torvalds } 8541da177e4SLinus Torvalds 8551da177e4SLinus Torvalds if (!x) 8561da177e4SLinus Torvalds x = xfrm_find_acq(p->info.mode, p->info.reqid, 8571da177e4SLinus Torvalds p->info.id.proto, daddr, 8581da177e4SLinus Torvalds &p->info.saddr, 1, 8591da177e4SLinus Torvalds family); 8601da177e4SLinus Torvalds err = -ENOENT; 8611da177e4SLinus Torvalds if (x == NULL) 8621da177e4SLinus Torvalds goto out_noput; 8631da177e4SLinus Torvalds 864658b219eSHerbert Xu err = xfrm_alloc_spi(x, p->min, p->max); 865658b219eSHerbert Xu if (err) 866658b219eSHerbert Xu goto out; 8671da177e4SLinus Torvalds 8681da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 8691da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 8701da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 8711da177e4SLinus Torvalds goto out; 8721da177e4SLinus Torvalds } 8731da177e4SLinus Torvalds 874082a1ad5SThomas Graf err = nlmsg_unicast(xfrm_nl, resp_skb, NETLINK_CB(skb).pid); 8751da177e4SLinus Torvalds 8761da177e4SLinus Torvalds out: 8771da177e4SLinus Torvalds xfrm_state_put(x); 8781da177e4SLinus Torvalds out_noput: 8791da177e4SLinus Torvalds return err; 8801da177e4SLinus Torvalds } 8811da177e4SLinus Torvalds 882b798a9edSJamal Hadi Salim static int verify_policy_dir(u8 dir) 8831da177e4SLinus Torvalds { 8841da177e4SLinus Torvalds switch (dir) { 8851da177e4SLinus Torvalds case XFRM_POLICY_IN: 8861da177e4SLinus Torvalds case XFRM_POLICY_OUT: 8871da177e4SLinus Torvalds case XFRM_POLICY_FWD: 8881da177e4SLinus Torvalds break; 8891da177e4SLinus Torvalds 8901da177e4SLinus Torvalds default: 8911da177e4SLinus Torvalds return -EINVAL; 8923ff50b79SStephen Hemminger } 8931da177e4SLinus Torvalds 8941da177e4SLinus Torvalds return 0; 8951da177e4SLinus Torvalds } 8961da177e4SLinus Torvalds 897b798a9edSJamal Hadi Salim static int verify_policy_type(u8 type) 898f7b6983fSMasahide NAKAMURA { 899f7b6983fSMasahide NAKAMURA switch (type) { 900f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_MAIN: 901f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 902f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_SUB: 903f7b6983fSMasahide NAKAMURA #endif 904f7b6983fSMasahide NAKAMURA break; 905f7b6983fSMasahide NAKAMURA 906f7b6983fSMasahide NAKAMURA default: 907f7b6983fSMasahide NAKAMURA return -EINVAL; 9083ff50b79SStephen Hemminger } 909f7b6983fSMasahide NAKAMURA 910f7b6983fSMasahide NAKAMURA return 0; 911f7b6983fSMasahide NAKAMURA } 912f7b6983fSMasahide NAKAMURA 9131da177e4SLinus Torvalds static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) 9141da177e4SLinus Torvalds { 9151da177e4SLinus Torvalds switch (p->share) { 9161da177e4SLinus Torvalds case XFRM_SHARE_ANY: 9171da177e4SLinus Torvalds case XFRM_SHARE_SESSION: 9181da177e4SLinus Torvalds case XFRM_SHARE_USER: 9191da177e4SLinus Torvalds case XFRM_SHARE_UNIQUE: 9201da177e4SLinus Torvalds break; 9211da177e4SLinus Torvalds 9221da177e4SLinus Torvalds default: 9231da177e4SLinus Torvalds return -EINVAL; 9243ff50b79SStephen Hemminger } 9251da177e4SLinus Torvalds 9261da177e4SLinus Torvalds switch (p->action) { 9271da177e4SLinus Torvalds case XFRM_POLICY_ALLOW: 9281da177e4SLinus Torvalds case XFRM_POLICY_BLOCK: 9291da177e4SLinus Torvalds break; 9301da177e4SLinus Torvalds 9311da177e4SLinus Torvalds default: 9321da177e4SLinus Torvalds return -EINVAL; 9333ff50b79SStephen Hemminger } 9341da177e4SLinus Torvalds 9351da177e4SLinus Torvalds switch (p->sel.family) { 9361da177e4SLinus Torvalds case AF_INET: 9371da177e4SLinus Torvalds break; 9381da177e4SLinus Torvalds 9391da177e4SLinus Torvalds case AF_INET6: 9401da177e4SLinus Torvalds #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 9411da177e4SLinus Torvalds break; 9421da177e4SLinus Torvalds #else 9431da177e4SLinus Torvalds return -EAFNOSUPPORT; 9441da177e4SLinus Torvalds #endif 9451da177e4SLinus Torvalds 9461da177e4SLinus Torvalds default: 9471da177e4SLinus Torvalds return -EINVAL; 9483ff50b79SStephen Hemminger } 9491da177e4SLinus Torvalds 9501da177e4SLinus Torvalds return verify_policy_dir(p->dir); 9511da177e4SLinus Torvalds } 9521da177e4SLinus Torvalds 9535424f32eSThomas Graf static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs) 954df71837dSTrent Jaeger { 9555424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 956df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx; 957df71837dSTrent Jaeger 958df71837dSTrent Jaeger if (!rt) 959df71837dSTrent Jaeger return 0; 960df71837dSTrent Jaeger 9615424f32eSThomas Graf uctx = nla_data(rt); 96203e1ad7bSPaul Moore return security_xfrm_policy_alloc(&pol->security, uctx); 963df71837dSTrent Jaeger } 964df71837dSTrent Jaeger 9651da177e4SLinus Torvalds static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, 9661da177e4SLinus Torvalds int nr) 9671da177e4SLinus Torvalds { 9681da177e4SLinus Torvalds int i; 9691da177e4SLinus Torvalds 9701da177e4SLinus Torvalds xp->xfrm_nr = nr; 9711da177e4SLinus Torvalds for (i = 0; i < nr; i++, ut++) { 9721da177e4SLinus Torvalds struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 9731da177e4SLinus Torvalds 9741da177e4SLinus Torvalds memcpy(&t->id, &ut->id, sizeof(struct xfrm_id)); 9751da177e4SLinus Torvalds memcpy(&t->saddr, &ut->saddr, 9761da177e4SLinus Torvalds sizeof(xfrm_address_t)); 9771da177e4SLinus Torvalds t->reqid = ut->reqid; 9781da177e4SLinus Torvalds t->mode = ut->mode; 9791da177e4SLinus Torvalds t->share = ut->share; 9801da177e4SLinus Torvalds t->optional = ut->optional; 9811da177e4SLinus Torvalds t->aalgos = ut->aalgos; 9821da177e4SLinus Torvalds t->ealgos = ut->ealgos; 9831da177e4SLinus Torvalds t->calgos = ut->calgos; 9848511d01dSMiika Komu t->encap_family = ut->family; 9851da177e4SLinus Torvalds } 9861da177e4SLinus Torvalds } 9871da177e4SLinus Torvalds 988b4ad86bfSDavid S. Miller static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) 989b4ad86bfSDavid S. Miller { 990b4ad86bfSDavid S. Miller int i; 991b4ad86bfSDavid S. Miller 992b4ad86bfSDavid S. Miller if (nr > XFRM_MAX_DEPTH) 993b4ad86bfSDavid S. Miller return -EINVAL; 994b4ad86bfSDavid S. Miller 995b4ad86bfSDavid S. Miller for (i = 0; i < nr; i++) { 996b4ad86bfSDavid S. Miller /* We never validated the ut->family value, so many 997b4ad86bfSDavid S. Miller * applications simply leave it at zero. The check was 998b4ad86bfSDavid S. Miller * never made and ut->family was ignored because all 999b4ad86bfSDavid S. Miller * templates could be assumed to have the same family as 1000b4ad86bfSDavid S. Miller * the policy itself. Now that we will have ipv4-in-ipv6 1001b4ad86bfSDavid S. Miller * and ipv6-in-ipv4 tunnels, this is no longer true. 1002b4ad86bfSDavid S. Miller */ 1003b4ad86bfSDavid S. Miller if (!ut[i].family) 1004b4ad86bfSDavid S. Miller ut[i].family = family; 1005b4ad86bfSDavid S. Miller 1006b4ad86bfSDavid S. Miller switch (ut[i].family) { 1007b4ad86bfSDavid S. Miller case AF_INET: 1008b4ad86bfSDavid S. Miller break; 1009b4ad86bfSDavid S. Miller #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1010b4ad86bfSDavid S. Miller case AF_INET6: 1011b4ad86bfSDavid S. Miller break; 1012b4ad86bfSDavid S. Miller #endif 1013b4ad86bfSDavid S. Miller default: 1014b4ad86bfSDavid S. Miller return -EINVAL; 10153ff50b79SStephen Hemminger } 1016b4ad86bfSDavid S. Miller } 1017b4ad86bfSDavid S. Miller 1018b4ad86bfSDavid S. Miller return 0; 1019b4ad86bfSDavid S. Miller } 1020b4ad86bfSDavid S. Miller 10215424f32eSThomas Graf static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs) 10221da177e4SLinus Torvalds { 10235424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL]; 10241da177e4SLinus Torvalds 10251da177e4SLinus Torvalds if (!rt) { 10261da177e4SLinus Torvalds pol->xfrm_nr = 0; 10271da177e4SLinus Torvalds } else { 10285424f32eSThomas Graf struct xfrm_user_tmpl *utmpl = nla_data(rt); 10295424f32eSThomas Graf int nr = nla_len(rt) / sizeof(*utmpl); 1030b4ad86bfSDavid S. Miller int err; 10311da177e4SLinus Torvalds 1032b4ad86bfSDavid S. Miller err = validate_tmpl(nr, utmpl, pol->family); 1033b4ad86bfSDavid S. Miller if (err) 1034b4ad86bfSDavid S. Miller return err; 10351da177e4SLinus Torvalds 10365424f32eSThomas Graf copy_templates(pol, utmpl, nr); 10371da177e4SLinus Torvalds } 10381da177e4SLinus Torvalds return 0; 10391da177e4SLinus Torvalds } 10401da177e4SLinus Torvalds 10415424f32eSThomas Graf static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs) 1042f7b6983fSMasahide NAKAMURA { 10435424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_POLICY_TYPE]; 1044f7b6983fSMasahide NAKAMURA struct xfrm_userpolicy_type *upt; 1045b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 1046f7b6983fSMasahide NAKAMURA int err; 1047f7b6983fSMasahide NAKAMURA 1048f7b6983fSMasahide NAKAMURA if (rt) { 10495424f32eSThomas Graf upt = nla_data(rt); 1050f7b6983fSMasahide NAKAMURA type = upt->type; 1051f7b6983fSMasahide NAKAMURA } 1052f7b6983fSMasahide NAKAMURA 1053f7b6983fSMasahide NAKAMURA err = verify_policy_type(type); 1054f7b6983fSMasahide NAKAMURA if (err) 1055f7b6983fSMasahide NAKAMURA return err; 1056f7b6983fSMasahide NAKAMURA 1057f7b6983fSMasahide NAKAMURA *tp = type; 1058f7b6983fSMasahide NAKAMURA return 0; 1059f7b6983fSMasahide NAKAMURA } 1060f7b6983fSMasahide NAKAMURA 10611da177e4SLinus Torvalds static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p) 10621da177e4SLinus Torvalds { 10631da177e4SLinus Torvalds xp->priority = p->priority; 10641da177e4SLinus Torvalds xp->index = p->index; 10651da177e4SLinus Torvalds memcpy(&xp->selector, &p->sel, sizeof(xp->selector)); 10661da177e4SLinus Torvalds memcpy(&xp->lft, &p->lft, sizeof(xp->lft)); 10671da177e4SLinus Torvalds xp->action = p->action; 10681da177e4SLinus Torvalds xp->flags = p->flags; 10691da177e4SLinus Torvalds xp->family = p->sel.family; 10701da177e4SLinus Torvalds /* XXX xp->share = p->share; */ 10711da177e4SLinus Torvalds } 10721da177e4SLinus Torvalds 10731da177e4SLinus Torvalds static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir) 10741da177e4SLinus Torvalds { 10751da177e4SLinus Torvalds memcpy(&p->sel, &xp->selector, sizeof(p->sel)); 10761da177e4SLinus Torvalds memcpy(&p->lft, &xp->lft, sizeof(p->lft)); 10771da177e4SLinus Torvalds memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft)); 10781da177e4SLinus Torvalds p->priority = xp->priority; 10791da177e4SLinus Torvalds p->index = xp->index; 10801da177e4SLinus Torvalds p->sel.family = xp->family; 10811da177e4SLinus Torvalds p->dir = dir; 10821da177e4SLinus Torvalds p->action = xp->action; 10831da177e4SLinus Torvalds p->flags = xp->flags; 10841da177e4SLinus Torvalds p->share = XFRM_SHARE_ANY; /* XXX xp->share */ 10851da177e4SLinus Torvalds } 10861da177e4SLinus Torvalds 10875424f32eSThomas Graf static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp) 10881da177e4SLinus Torvalds { 10891da177e4SLinus Torvalds struct xfrm_policy *xp = xfrm_policy_alloc(GFP_KERNEL); 10901da177e4SLinus Torvalds int err; 10911da177e4SLinus Torvalds 10921da177e4SLinus Torvalds if (!xp) { 10931da177e4SLinus Torvalds *errp = -ENOMEM; 10941da177e4SLinus Torvalds return NULL; 10951da177e4SLinus Torvalds } 10961da177e4SLinus Torvalds 10971da177e4SLinus Torvalds copy_from_user_policy(xp, p); 1098df71837dSTrent Jaeger 109935a7aa08SThomas Graf err = copy_from_user_policy_type(&xp->type, attrs); 1100f7b6983fSMasahide NAKAMURA if (err) 1101f7b6983fSMasahide NAKAMURA goto error; 1102f7b6983fSMasahide NAKAMURA 110335a7aa08SThomas Graf if (!(err = copy_from_user_tmpl(xp, attrs))) 110435a7aa08SThomas Graf err = copy_from_user_sec_ctx(xp, attrs); 1105f7b6983fSMasahide NAKAMURA if (err) 1106f7b6983fSMasahide NAKAMURA goto error; 11071da177e4SLinus Torvalds 11081da177e4SLinus Torvalds return xp; 1109f7b6983fSMasahide NAKAMURA error: 1110f7b6983fSMasahide NAKAMURA *errp = err; 1111073a3719SYOSHIFUJI Hideaki xp->dead = 1; 111264c31b3fSWANG Cong xfrm_policy_destroy(xp); 1113f7b6983fSMasahide NAKAMURA return NULL; 11141da177e4SLinus Torvalds } 11151da177e4SLinus Torvalds 111622e70050SChristoph Hellwig static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 11175424f32eSThomas Graf struct nlattr **attrs) 11181da177e4SLinus Torvalds { 11197b67c857SThomas Graf struct xfrm_userpolicy_info *p = nlmsg_data(nlh); 11201da177e4SLinus Torvalds struct xfrm_policy *xp; 112126b15dadSJamal Hadi Salim struct km_event c; 11221da177e4SLinus Torvalds int err; 11231da177e4SLinus Torvalds int excl; 11241da177e4SLinus Torvalds 11251da177e4SLinus Torvalds err = verify_newpolicy_info(p); 11261da177e4SLinus Torvalds if (err) 11271da177e4SLinus Torvalds return err; 112835a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 1129df71837dSTrent Jaeger if (err) 1130df71837dSTrent Jaeger return err; 11311da177e4SLinus Torvalds 113235a7aa08SThomas Graf xp = xfrm_policy_construct(p, attrs, &err); 11331da177e4SLinus Torvalds if (!xp) 11341da177e4SLinus Torvalds return err; 11351da177e4SLinus Torvalds 113626b15dadSJamal Hadi Salim /* shouldnt excl be based on nlh flags?? 113726b15dadSJamal Hadi Salim * Aha! this is anti-netlink really i.e more pfkey derived 113826b15dadSJamal Hadi Salim * in netlink excl is a flag and you wouldnt need 113926b15dadSJamal Hadi Salim * a type XFRM_MSG_UPDPOLICY - JHS */ 11401da177e4SLinus Torvalds excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; 11411da177e4SLinus Torvalds err = xfrm_policy_insert(p->dir, xp, excl); 1142ab5f5e8bSJoy Latten xfrm_audit_policy_add(xp, err ? 0 : 1, NETLINK_CB(skb).loginuid, 1143ab5f5e8bSJoy Latten NETLINK_CB(skb).sid); 1144161a09e7SJoy Latten 11451da177e4SLinus Torvalds if (err) { 114603e1ad7bSPaul Moore security_xfrm_policy_free(xp->security); 11471da177e4SLinus Torvalds kfree(xp); 11481da177e4SLinus Torvalds return err; 11491da177e4SLinus Torvalds } 11501da177e4SLinus Torvalds 1151f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 115226b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 115326b15dadSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 115426b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c); 115526b15dadSJamal Hadi Salim 11561da177e4SLinus Torvalds xfrm_pol_put(xp); 11571da177e4SLinus Torvalds 11581da177e4SLinus Torvalds return 0; 11591da177e4SLinus Torvalds } 11601da177e4SLinus Torvalds 11611da177e4SLinus Torvalds static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb) 11621da177e4SLinus Torvalds { 11631da177e4SLinus Torvalds struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH]; 11641da177e4SLinus Torvalds int i; 11651da177e4SLinus Torvalds 11661da177e4SLinus Torvalds if (xp->xfrm_nr == 0) 11671da177e4SLinus Torvalds return 0; 11681da177e4SLinus Torvalds 11691da177e4SLinus Torvalds for (i = 0; i < xp->xfrm_nr; i++) { 11701da177e4SLinus Torvalds struct xfrm_user_tmpl *up = &vec[i]; 11711da177e4SLinus Torvalds struct xfrm_tmpl *kp = &xp->xfrm_vec[i]; 11721da177e4SLinus Torvalds 11731da177e4SLinus Torvalds memcpy(&up->id, &kp->id, sizeof(up->id)); 11748511d01dSMiika Komu up->family = kp->encap_family; 11751da177e4SLinus Torvalds memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr)); 11761da177e4SLinus Torvalds up->reqid = kp->reqid; 11771da177e4SLinus Torvalds up->mode = kp->mode; 11781da177e4SLinus Torvalds up->share = kp->share; 11791da177e4SLinus Torvalds up->optional = kp->optional; 11801da177e4SLinus Torvalds up->aalgos = kp->aalgos; 11811da177e4SLinus Torvalds up->ealgos = kp->ealgos; 11821da177e4SLinus Torvalds up->calgos = kp->calgos; 11831da177e4SLinus Torvalds } 11841da177e4SLinus Torvalds 1185c0144beaSThomas Graf return nla_put(skb, XFRMA_TMPL, 1186c0144beaSThomas Graf sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec); 1187df71837dSTrent Jaeger } 1188df71837dSTrent Jaeger 11890d681623SSerge Hallyn static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb) 11900d681623SSerge Hallyn { 11910d681623SSerge Hallyn if (x->security) { 11920d681623SSerge Hallyn return copy_sec_ctx(x->security, skb); 11930d681623SSerge Hallyn } 11940d681623SSerge Hallyn return 0; 11950d681623SSerge Hallyn } 11960d681623SSerge Hallyn 11970d681623SSerge Hallyn static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb) 11980d681623SSerge Hallyn { 11990d681623SSerge Hallyn if (xp->security) { 12000d681623SSerge Hallyn return copy_sec_ctx(xp->security, skb); 12010d681623SSerge Hallyn } 12020d681623SSerge Hallyn return 0; 12030d681623SSerge Hallyn } 1204cfbfd45aSThomas Graf static inline size_t userpolicy_type_attrsize(void) 1205cfbfd45aSThomas Graf { 1206cfbfd45aSThomas Graf #ifdef CONFIG_XFRM_SUB_POLICY 1207cfbfd45aSThomas Graf return nla_total_size(sizeof(struct xfrm_userpolicy_type)); 1208cfbfd45aSThomas Graf #else 1209cfbfd45aSThomas Graf return 0; 1210cfbfd45aSThomas Graf #endif 1211cfbfd45aSThomas Graf } 12120d681623SSerge Hallyn 1213f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1214b798a9edSJamal Hadi Salim static int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 1215f7b6983fSMasahide NAKAMURA { 1216c0144beaSThomas Graf struct xfrm_userpolicy_type upt = { 1217c0144beaSThomas Graf .type = type, 1218c0144beaSThomas Graf }; 1219f7b6983fSMasahide NAKAMURA 1220c0144beaSThomas Graf return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt); 1221f7b6983fSMasahide NAKAMURA } 1222f7b6983fSMasahide NAKAMURA 1223f7b6983fSMasahide NAKAMURA #else 1224b798a9edSJamal Hadi Salim static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 1225f7b6983fSMasahide NAKAMURA { 1226f7b6983fSMasahide NAKAMURA return 0; 1227f7b6983fSMasahide NAKAMURA } 1228f7b6983fSMasahide NAKAMURA #endif 1229f7b6983fSMasahide NAKAMURA 12301da177e4SLinus Torvalds static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr) 12311da177e4SLinus Torvalds { 12321da177e4SLinus Torvalds struct xfrm_dump_info *sp = ptr; 12331da177e4SLinus Torvalds struct xfrm_userpolicy_info *p; 12341da177e4SLinus Torvalds struct sk_buff *in_skb = sp->in_skb; 12351da177e4SLinus Torvalds struct sk_buff *skb = sp->out_skb; 12361da177e4SLinus Torvalds struct nlmsghdr *nlh; 12371da177e4SLinus Torvalds 123879b8b7f4SThomas Graf nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq, 123979b8b7f4SThomas Graf XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags); 124079b8b7f4SThomas Graf if (nlh == NULL) 124179b8b7f4SThomas Graf return -EMSGSIZE; 12421da177e4SLinus Torvalds 12437b67c857SThomas Graf p = nlmsg_data(nlh); 12441da177e4SLinus Torvalds copy_to_user_policy(xp, p, dir); 12451da177e4SLinus Torvalds if (copy_to_user_tmpl(xp, skb) < 0) 12461da177e4SLinus Torvalds goto nlmsg_failure; 1247df71837dSTrent Jaeger if (copy_to_user_sec_ctx(xp, skb)) 1248df71837dSTrent Jaeger goto nlmsg_failure; 12491459bb36SJamal Hadi Salim if (copy_to_user_policy_type(xp->type, skb) < 0) 1250f7b6983fSMasahide NAKAMURA goto nlmsg_failure; 12511da177e4SLinus Torvalds 12529825069dSThomas Graf nlmsg_end(skb, nlh); 12531da177e4SLinus Torvalds return 0; 12541da177e4SLinus Torvalds 12551da177e4SLinus Torvalds nlmsg_failure: 12569825069dSThomas Graf nlmsg_cancel(skb, nlh); 12579825069dSThomas Graf return -EMSGSIZE; 12581da177e4SLinus Torvalds } 12591da177e4SLinus Torvalds 12604c563f76STimo Teras static int xfrm_dump_policy_done(struct netlink_callback *cb) 12614c563f76STimo Teras { 12624c563f76STimo Teras struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; 12634c563f76STimo Teras 12644c563f76STimo Teras xfrm_policy_walk_done(walk); 12654c563f76STimo Teras return 0; 12664c563f76STimo Teras } 12674c563f76STimo Teras 12681da177e4SLinus Torvalds static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb) 12691da177e4SLinus Torvalds { 12704c563f76STimo Teras struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; 12711da177e4SLinus Torvalds struct xfrm_dump_info info; 12721da177e4SLinus Torvalds 12734c563f76STimo Teras BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) > 12744c563f76STimo Teras sizeof(cb->args) - sizeof(cb->args[0])); 12754c563f76STimo Teras 12761da177e4SLinus Torvalds info.in_skb = cb->skb; 12771da177e4SLinus Torvalds info.out_skb = skb; 12781da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq; 12791da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI; 12804c563f76STimo Teras 12814c563f76STimo Teras if (!cb->args[0]) { 12824c563f76STimo Teras cb->args[0] = 1; 12834c563f76STimo Teras xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY); 12844c563f76STimo Teras } 12854c563f76STimo Teras 12864c563f76STimo Teras (void) xfrm_policy_walk(walk, dump_one_policy, &info); 12871da177e4SLinus Torvalds 12881da177e4SLinus Torvalds return skb->len; 12891da177e4SLinus Torvalds } 12901da177e4SLinus Torvalds 12911da177e4SLinus Torvalds static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, 12921da177e4SLinus Torvalds struct xfrm_policy *xp, 12931da177e4SLinus Torvalds int dir, u32 seq) 12941da177e4SLinus Torvalds { 12951da177e4SLinus Torvalds struct xfrm_dump_info info; 12961da177e4SLinus Torvalds struct sk_buff *skb; 12971da177e4SLinus Torvalds 12987deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12991da177e4SLinus Torvalds if (!skb) 13001da177e4SLinus Torvalds return ERR_PTR(-ENOMEM); 13011da177e4SLinus Torvalds 13021da177e4SLinus Torvalds info.in_skb = in_skb; 13031da177e4SLinus Torvalds info.out_skb = skb; 13041da177e4SLinus Torvalds info.nlmsg_seq = seq; 13051da177e4SLinus Torvalds info.nlmsg_flags = 0; 13061da177e4SLinus Torvalds 13071da177e4SLinus Torvalds if (dump_one_policy(xp, dir, 0, &info) < 0) { 13081da177e4SLinus Torvalds kfree_skb(skb); 13091da177e4SLinus Torvalds return NULL; 13101da177e4SLinus Torvalds } 13111da177e4SLinus Torvalds 13121da177e4SLinus Torvalds return skb; 13131da177e4SLinus Torvalds } 13141da177e4SLinus Torvalds 131522e70050SChristoph Hellwig static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 13165424f32eSThomas Graf struct nlattr **attrs) 13171da177e4SLinus Torvalds { 13181da177e4SLinus Torvalds struct xfrm_policy *xp; 13191da177e4SLinus Torvalds struct xfrm_userpolicy_id *p; 1320b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 13211da177e4SLinus Torvalds int err; 132226b15dadSJamal Hadi Salim struct km_event c; 13231da177e4SLinus Torvalds int delete; 13241da177e4SLinus Torvalds 13257b67c857SThomas Graf p = nlmsg_data(nlh); 13261da177e4SLinus Torvalds delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY; 13271da177e4SLinus Torvalds 132835a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 1329f7b6983fSMasahide NAKAMURA if (err) 1330f7b6983fSMasahide NAKAMURA return err; 1331f7b6983fSMasahide NAKAMURA 13321da177e4SLinus Torvalds err = verify_policy_dir(p->dir); 13331da177e4SLinus Torvalds if (err) 13341da177e4SLinus Torvalds return err; 13351da177e4SLinus Torvalds 13361da177e4SLinus Torvalds if (p->index) 1337ef41aaa0SEric Paris xp = xfrm_policy_byid(type, p->dir, p->index, delete, &err); 1338df71837dSTrent Jaeger else { 13395424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 134003e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx; 1341df71837dSTrent Jaeger 134235a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 1343df71837dSTrent Jaeger if (err) 1344df71837dSTrent Jaeger return err; 1345df71837dSTrent Jaeger 1346*2c8dd116SDenis V. Lunev ctx = NULL; 1347df71837dSTrent Jaeger if (rt) { 13485424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt); 1349df71837dSTrent Jaeger 135003e1ad7bSPaul Moore err = security_xfrm_policy_alloc(&ctx, uctx); 135103e1ad7bSPaul Moore if (err) 1352df71837dSTrent Jaeger return err; 1353*2c8dd116SDenis V. Lunev } 135403e1ad7bSPaul Moore xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, ctx, 1355ef41aaa0SEric Paris delete, &err); 135603e1ad7bSPaul Moore security_xfrm_policy_free(ctx); 1357df71837dSTrent Jaeger } 13581da177e4SLinus Torvalds if (xp == NULL) 13591da177e4SLinus Torvalds return -ENOENT; 13601da177e4SLinus Torvalds 13611da177e4SLinus Torvalds if (!delete) { 13621da177e4SLinus Torvalds struct sk_buff *resp_skb; 13631da177e4SLinus Torvalds 13641da177e4SLinus Torvalds resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq); 13651da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 13661da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 13671da177e4SLinus Torvalds } else { 1368082a1ad5SThomas Graf err = nlmsg_unicast(xfrm_nl, resp_skb, 1369082a1ad5SThomas Graf NETLINK_CB(skb).pid); 13701da177e4SLinus Torvalds } 137126b15dadSJamal Hadi Salim } else { 1372ab5f5e8bSJoy Latten xfrm_audit_policy_delete(xp, err ? 0 : 1, 1373ab5f5e8bSJoy Latten NETLINK_CB(skb).loginuid, 1374ab5f5e8bSJoy Latten NETLINK_CB(skb).sid); 137513fcfbb0SDavid S. Miller 137613fcfbb0SDavid S. Miller if (err != 0) 1377c8c05a8eSCatherine Zhang goto out; 137813fcfbb0SDavid S. Miller 1379e7443892SHerbert Xu c.data.byid = p->index; 1380f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 138126b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 138226b15dadSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 138326b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c); 13841da177e4SLinus Torvalds } 13851da177e4SLinus Torvalds 1386c8c05a8eSCatherine Zhang out: 1387ef41aaa0SEric Paris xfrm_pol_put(xp); 13881da177e4SLinus Torvalds return err; 13891da177e4SLinus Torvalds } 13901da177e4SLinus Torvalds 139122e70050SChristoph Hellwig static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 13925424f32eSThomas Graf struct nlattr **attrs) 13931da177e4SLinus Torvalds { 139426b15dadSJamal Hadi Salim struct km_event c; 13957b67c857SThomas Graf struct xfrm_usersa_flush *p = nlmsg_data(nlh); 1396161a09e7SJoy Latten struct xfrm_audit audit_info; 13974aa2e62cSJoy Latten int err; 13981da177e4SLinus Torvalds 1399161a09e7SJoy Latten audit_info.loginuid = NETLINK_CB(skb).loginuid; 1400161a09e7SJoy Latten audit_info.secid = NETLINK_CB(skb).sid; 14014aa2e62cSJoy Latten err = xfrm_state_flush(p->proto, &audit_info); 14024aa2e62cSJoy Latten if (err) 14034aa2e62cSJoy Latten return err; 1404bf08867fSHerbert Xu c.data.proto = p->proto; 1405f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 140626b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 140726b15dadSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 140826b15dadSJamal Hadi Salim km_state_notify(NULL, &c); 140926b15dadSJamal Hadi Salim 14101da177e4SLinus Torvalds return 0; 14111da177e4SLinus Torvalds } 14121da177e4SLinus Torvalds 14137deb2264SThomas Graf static inline size_t xfrm_aevent_msgsize(void) 14147deb2264SThomas Graf { 14157deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id)) 14167deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_replay_state)) 14177deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_lifetime_cur)) 14187deb2264SThomas Graf + nla_total_size(4) /* XFRM_AE_RTHR */ 14197deb2264SThomas Graf + nla_total_size(4); /* XFRM_AE_ETHR */ 14207deb2264SThomas Graf } 1421d51d081dSJamal Hadi Salim 1422d51d081dSJamal Hadi Salim static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c) 1423d51d081dSJamal Hadi Salim { 1424d51d081dSJamal Hadi Salim struct xfrm_aevent_id *id; 1425d51d081dSJamal Hadi Salim struct nlmsghdr *nlh; 1426d51d081dSJamal Hadi Salim 142779b8b7f4SThomas Graf nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0); 142879b8b7f4SThomas Graf if (nlh == NULL) 142979b8b7f4SThomas Graf return -EMSGSIZE; 1430d51d081dSJamal Hadi Salim 14317b67c857SThomas Graf id = nlmsg_data(nlh); 14322b5f6dccSJamal Hadi Salim memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr)); 1433d51d081dSJamal Hadi Salim id->sa_id.spi = x->id.spi; 1434d51d081dSJamal Hadi Salim id->sa_id.family = x->props.family; 1435d51d081dSJamal Hadi Salim id->sa_id.proto = x->id.proto; 14362b5f6dccSJamal Hadi Salim memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr)); 14372b5f6dccSJamal Hadi Salim id->reqid = x->props.reqid; 1438d51d081dSJamal Hadi Salim id->flags = c->data.aevent; 1439d51d081dSJamal Hadi Salim 1440c0144beaSThomas Graf NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay); 1441c0144beaSThomas Graf NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft); 1442d51d081dSJamal Hadi Salim 1443c0144beaSThomas Graf if (id->flags & XFRM_AE_RTHR) 1444c0144beaSThomas Graf NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff); 1445d51d081dSJamal Hadi Salim 1446c0144beaSThomas Graf if (id->flags & XFRM_AE_ETHR) 1447c0144beaSThomas Graf NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH, 1448c0144beaSThomas Graf x->replay_maxage * 10 / HZ); 1449d51d081dSJamal Hadi Salim 14509825069dSThomas Graf return nlmsg_end(skb, nlh); 1451d51d081dSJamal Hadi Salim 1452c0144beaSThomas Graf nla_put_failure: 14539825069dSThomas Graf nlmsg_cancel(skb, nlh); 14549825069dSThomas Graf return -EMSGSIZE; 1455d51d081dSJamal Hadi Salim } 1456d51d081dSJamal Hadi Salim 145722e70050SChristoph Hellwig static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 14585424f32eSThomas Graf struct nlattr **attrs) 1459d51d081dSJamal Hadi Salim { 1460d51d081dSJamal Hadi Salim struct xfrm_state *x; 1461d51d081dSJamal Hadi Salim struct sk_buff *r_skb; 1462d51d081dSJamal Hadi Salim int err; 1463d51d081dSJamal Hadi Salim struct km_event c; 14647b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh); 1465d51d081dSJamal Hadi Salim struct xfrm_usersa_id *id = &p->sa_id; 1466d51d081dSJamal Hadi Salim 14677deb2264SThomas Graf r_skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC); 1468d51d081dSJamal Hadi Salim if (r_skb == NULL) 1469d51d081dSJamal Hadi Salim return -ENOMEM; 1470d51d081dSJamal Hadi Salim 1471d51d081dSJamal Hadi Salim x = xfrm_state_lookup(&id->daddr, id->spi, id->proto, id->family); 1472d51d081dSJamal Hadi Salim if (x == NULL) { 1473b08d5840SPatrick McHardy kfree_skb(r_skb); 1474d51d081dSJamal Hadi Salim return -ESRCH; 1475d51d081dSJamal Hadi Salim } 1476d51d081dSJamal Hadi Salim 1477d51d081dSJamal Hadi Salim /* 1478d51d081dSJamal Hadi Salim * XXX: is this lock really needed - none of the other 1479d51d081dSJamal Hadi Salim * gets lock (the concern is things getting updated 1480d51d081dSJamal Hadi Salim * while we are still reading) - jhs 1481d51d081dSJamal Hadi Salim */ 1482d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock); 1483d51d081dSJamal Hadi Salim c.data.aevent = p->flags; 1484d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 1485d51d081dSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 1486d51d081dSJamal Hadi Salim 1487d51d081dSJamal Hadi Salim if (build_aevent(r_skb, x, &c) < 0) 1488d51d081dSJamal Hadi Salim BUG(); 1489082a1ad5SThomas Graf err = nlmsg_unicast(xfrm_nl, r_skb, NETLINK_CB(skb).pid); 1490d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock); 1491d51d081dSJamal Hadi Salim xfrm_state_put(x); 1492d51d081dSJamal Hadi Salim return err; 1493d51d081dSJamal Hadi Salim } 1494d51d081dSJamal Hadi Salim 149522e70050SChristoph Hellwig static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 14965424f32eSThomas Graf struct nlattr **attrs) 1497d51d081dSJamal Hadi Salim { 1498d51d081dSJamal Hadi Salim struct xfrm_state *x; 1499d51d081dSJamal Hadi Salim struct km_event c; 1500d51d081dSJamal Hadi Salim int err = - EINVAL; 15017b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh); 15025424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 15035424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 1504d51d081dSJamal Hadi Salim 1505d51d081dSJamal Hadi Salim if (!lt && !rp) 1506d51d081dSJamal Hadi Salim return err; 1507d51d081dSJamal Hadi Salim 1508d51d081dSJamal Hadi Salim /* pedantic mode - thou shalt sayeth replaceth */ 1509d51d081dSJamal Hadi Salim if (!(nlh->nlmsg_flags&NLM_F_REPLACE)) 1510d51d081dSJamal Hadi Salim return err; 1511d51d081dSJamal Hadi Salim 1512d51d081dSJamal Hadi Salim x = xfrm_state_lookup(&p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family); 1513d51d081dSJamal Hadi Salim if (x == NULL) 1514d51d081dSJamal Hadi Salim return -ESRCH; 1515d51d081dSJamal Hadi Salim 1516d51d081dSJamal Hadi Salim if (x->km.state != XFRM_STATE_VALID) 1517d51d081dSJamal Hadi Salim goto out; 1518d51d081dSJamal Hadi Salim 1519d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock); 152035a7aa08SThomas Graf xfrm_update_ae_params(x, attrs); 1521d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock); 1522d51d081dSJamal Hadi Salim 1523d51d081dSJamal Hadi Salim c.event = nlh->nlmsg_type; 1524d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 1525d51d081dSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 1526d51d081dSJamal Hadi Salim c.data.aevent = XFRM_AE_CU; 1527d51d081dSJamal Hadi Salim km_state_notify(x, &c); 1528d51d081dSJamal Hadi Salim err = 0; 1529d51d081dSJamal Hadi Salim out: 1530d51d081dSJamal Hadi Salim xfrm_state_put(x); 1531d51d081dSJamal Hadi Salim return err; 1532d51d081dSJamal Hadi Salim } 1533d51d081dSJamal Hadi Salim 153422e70050SChristoph Hellwig static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 15355424f32eSThomas Graf struct nlattr **attrs) 15361da177e4SLinus Torvalds { 153726b15dadSJamal Hadi Salim struct km_event c; 1538b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 1539f7b6983fSMasahide NAKAMURA int err; 1540161a09e7SJoy Latten struct xfrm_audit audit_info; 154126b15dadSJamal Hadi Salim 154235a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 1543f7b6983fSMasahide NAKAMURA if (err) 1544f7b6983fSMasahide NAKAMURA return err; 1545f7b6983fSMasahide NAKAMURA 1546161a09e7SJoy Latten audit_info.loginuid = NETLINK_CB(skb).loginuid; 1547161a09e7SJoy Latten audit_info.secid = NETLINK_CB(skb).sid; 15484aa2e62cSJoy Latten err = xfrm_policy_flush(type, &audit_info); 15494aa2e62cSJoy Latten if (err) 15504aa2e62cSJoy Latten return err; 1551f7b6983fSMasahide NAKAMURA c.data.type = type; 1552f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 155326b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 155426b15dadSJamal Hadi Salim c.pid = nlh->nlmsg_pid; 155526b15dadSJamal Hadi Salim km_policy_notify(NULL, 0, &c); 15561da177e4SLinus Torvalds return 0; 15571da177e4SLinus Torvalds } 15581da177e4SLinus Torvalds 155922e70050SChristoph Hellwig static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 15605424f32eSThomas Graf struct nlattr **attrs) 15616c5c8ca7SJamal Hadi Salim { 15626c5c8ca7SJamal Hadi Salim struct xfrm_policy *xp; 15637b67c857SThomas Graf struct xfrm_user_polexpire *up = nlmsg_data(nlh); 15646c5c8ca7SJamal Hadi Salim struct xfrm_userpolicy_info *p = &up->pol; 1565b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 15666c5c8ca7SJamal Hadi Salim int err = -ENOENT; 15676c5c8ca7SJamal Hadi Salim 156835a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 1569f7b6983fSMasahide NAKAMURA if (err) 1570f7b6983fSMasahide NAKAMURA return err; 1571f7b6983fSMasahide NAKAMURA 15726c5c8ca7SJamal Hadi Salim if (p->index) 1573ef41aaa0SEric Paris xp = xfrm_policy_byid(type, p->dir, p->index, 0, &err); 15746c5c8ca7SJamal Hadi Salim else { 15755424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 157603e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx; 15776c5c8ca7SJamal Hadi Salim 157835a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 15796c5c8ca7SJamal Hadi Salim if (err) 15806c5c8ca7SJamal Hadi Salim return err; 15816c5c8ca7SJamal Hadi Salim 1582*2c8dd116SDenis V. Lunev ctx = NULL; 15836c5c8ca7SJamal Hadi Salim if (rt) { 15845424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt); 15856c5c8ca7SJamal Hadi Salim 158603e1ad7bSPaul Moore err = security_xfrm_policy_alloc(&ctx, uctx); 158703e1ad7bSPaul Moore if (err) 15886c5c8ca7SJamal Hadi Salim return err; 1589*2c8dd116SDenis V. Lunev } 159003e1ad7bSPaul Moore xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, ctx, 0, &err); 159103e1ad7bSPaul Moore security_xfrm_policy_free(ctx); 15926c5c8ca7SJamal Hadi Salim } 15936c5c8ca7SJamal Hadi Salim if (xp == NULL) 1594ef41aaa0SEric Paris return -ENOENT; 159503e1ad7bSPaul Moore 15966c5c8ca7SJamal Hadi Salim read_lock(&xp->lock); 15976c5c8ca7SJamal Hadi Salim if (xp->dead) { 15986c5c8ca7SJamal Hadi Salim read_unlock(&xp->lock); 15996c5c8ca7SJamal Hadi Salim goto out; 16006c5c8ca7SJamal Hadi Salim } 16016c5c8ca7SJamal Hadi Salim 16026c5c8ca7SJamal Hadi Salim read_unlock(&xp->lock); 16036c5c8ca7SJamal Hadi Salim err = 0; 16046c5c8ca7SJamal Hadi Salim if (up->hard) { 16056c5c8ca7SJamal Hadi Salim xfrm_policy_delete(xp, p->dir); 1606ab5f5e8bSJoy Latten xfrm_audit_policy_delete(xp, 1, NETLINK_CB(skb).loginuid, 1607ab5f5e8bSJoy Latten NETLINK_CB(skb).sid); 1608161a09e7SJoy Latten 16096c5c8ca7SJamal Hadi Salim } else { 16106c5c8ca7SJamal Hadi Salim // reset the timers here? 16116c5c8ca7SJamal Hadi Salim printk("Dont know what to do with soft policy expire\n"); 16126c5c8ca7SJamal Hadi Salim } 16136c5c8ca7SJamal Hadi Salim km_policy_expired(xp, p->dir, up->hard, current->pid); 16146c5c8ca7SJamal Hadi Salim 16156c5c8ca7SJamal Hadi Salim out: 16166c5c8ca7SJamal Hadi Salim xfrm_pol_put(xp); 16176c5c8ca7SJamal Hadi Salim return err; 16186c5c8ca7SJamal Hadi Salim } 16196c5c8ca7SJamal Hadi Salim 162022e70050SChristoph Hellwig static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 16215424f32eSThomas Graf struct nlattr **attrs) 162253bc6b4dSJamal Hadi Salim { 162353bc6b4dSJamal Hadi Salim struct xfrm_state *x; 162453bc6b4dSJamal Hadi Salim int err; 16257b67c857SThomas Graf struct xfrm_user_expire *ue = nlmsg_data(nlh); 162653bc6b4dSJamal Hadi Salim struct xfrm_usersa_info *p = &ue->state; 162753bc6b4dSJamal Hadi Salim 162853bc6b4dSJamal Hadi Salim x = xfrm_state_lookup(&p->id.daddr, p->id.spi, p->id.proto, p->family); 162953bc6b4dSJamal Hadi Salim 16303a765aa5SDavid S. Miller err = -ENOENT; 163153bc6b4dSJamal Hadi Salim if (x == NULL) 163253bc6b4dSJamal Hadi Salim return err; 163353bc6b4dSJamal Hadi Salim 163453bc6b4dSJamal Hadi Salim spin_lock_bh(&x->lock); 16353a765aa5SDavid S. Miller err = -EINVAL; 163653bc6b4dSJamal Hadi Salim if (x->km.state != XFRM_STATE_VALID) 163753bc6b4dSJamal Hadi Salim goto out; 163853bc6b4dSJamal Hadi Salim km_state_expired(x, ue->hard, current->pid); 163953bc6b4dSJamal Hadi Salim 1640161a09e7SJoy Latten if (ue->hard) { 164153bc6b4dSJamal Hadi Salim __xfrm_state_delete(x); 1642ab5f5e8bSJoy Latten xfrm_audit_state_delete(x, 1, NETLINK_CB(skb).loginuid, 1643ab5f5e8bSJoy Latten NETLINK_CB(skb).sid); 1644161a09e7SJoy Latten } 16453a765aa5SDavid S. Miller err = 0; 164653bc6b4dSJamal Hadi Salim out: 164753bc6b4dSJamal Hadi Salim spin_unlock_bh(&x->lock); 164853bc6b4dSJamal Hadi Salim xfrm_state_put(x); 164953bc6b4dSJamal Hadi Salim return err; 165053bc6b4dSJamal Hadi Salim } 165153bc6b4dSJamal Hadi Salim 165222e70050SChristoph Hellwig static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, 16535424f32eSThomas Graf struct nlattr **attrs) 1654980ebd25SJamal Hadi Salim { 1655980ebd25SJamal Hadi Salim struct xfrm_policy *xp; 1656980ebd25SJamal Hadi Salim struct xfrm_user_tmpl *ut; 1657980ebd25SJamal Hadi Salim int i; 16585424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL]; 1659980ebd25SJamal Hadi Salim 16607b67c857SThomas Graf struct xfrm_user_acquire *ua = nlmsg_data(nlh); 1661980ebd25SJamal Hadi Salim struct xfrm_state *x = xfrm_state_alloc(); 1662980ebd25SJamal Hadi Salim int err = -ENOMEM; 1663980ebd25SJamal Hadi Salim 1664980ebd25SJamal Hadi Salim if (!x) 1665980ebd25SJamal Hadi Salim return err; 1666980ebd25SJamal Hadi Salim 1667980ebd25SJamal Hadi Salim err = verify_newpolicy_info(&ua->policy); 1668980ebd25SJamal Hadi Salim if (err) { 1669980ebd25SJamal Hadi Salim printk("BAD policy passed\n"); 1670980ebd25SJamal Hadi Salim kfree(x); 1671980ebd25SJamal Hadi Salim return err; 1672980ebd25SJamal Hadi Salim } 1673980ebd25SJamal Hadi Salim 1674980ebd25SJamal Hadi Salim /* build an XP */ 16755424f32eSThomas Graf xp = xfrm_policy_construct(&ua->policy, attrs, &err); 1676b4ad86bfSDavid S. Miller if (!xp) { 1677980ebd25SJamal Hadi Salim kfree(x); 1678980ebd25SJamal Hadi Salim return err; 1679980ebd25SJamal Hadi Salim } 1680980ebd25SJamal Hadi Salim 1681980ebd25SJamal Hadi Salim memcpy(&x->id, &ua->id, sizeof(ua->id)); 1682980ebd25SJamal Hadi Salim memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr)); 1683980ebd25SJamal Hadi Salim memcpy(&x->sel, &ua->sel, sizeof(ua->sel)); 1684980ebd25SJamal Hadi Salim 16855424f32eSThomas Graf ut = nla_data(rt); 1686980ebd25SJamal Hadi Salim /* extract the templates and for each call km_key */ 1687980ebd25SJamal Hadi Salim for (i = 0; i < xp->xfrm_nr; i++, ut++) { 1688980ebd25SJamal Hadi Salim struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 1689980ebd25SJamal Hadi Salim memcpy(&x->id, &t->id, sizeof(x->id)); 1690980ebd25SJamal Hadi Salim x->props.mode = t->mode; 1691980ebd25SJamal Hadi Salim x->props.reqid = t->reqid; 1692980ebd25SJamal Hadi Salim x->props.family = ut->family; 1693980ebd25SJamal Hadi Salim t->aalgos = ua->aalgos; 1694980ebd25SJamal Hadi Salim t->ealgos = ua->ealgos; 1695980ebd25SJamal Hadi Salim t->calgos = ua->calgos; 1696980ebd25SJamal Hadi Salim err = km_query(x, t, xp); 1697980ebd25SJamal Hadi Salim 1698980ebd25SJamal Hadi Salim } 1699980ebd25SJamal Hadi Salim 1700980ebd25SJamal Hadi Salim kfree(x); 1701980ebd25SJamal Hadi Salim kfree(xp); 1702980ebd25SJamal Hadi Salim 1703980ebd25SJamal Hadi Salim return 0; 1704980ebd25SJamal Hadi Salim } 1705980ebd25SJamal Hadi Salim 17065c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 17075c79de6eSShinta Sugimoto static int copy_from_user_migrate(struct xfrm_migrate *ma, 17085424f32eSThomas Graf struct nlattr **attrs, int *num) 17095c79de6eSShinta Sugimoto { 17105424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_MIGRATE]; 17115c79de6eSShinta Sugimoto struct xfrm_user_migrate *um; 17125c79de6eSShinta Sugimoto int i, num_migrate; 17135c79de6eSShinta Sugimoto 17145424f32eSThomas Graf um = nla_data(rt); 17155424f32eSThomas Graf num_migrate = nla_len(rt) / sizeof(*um); 17165c79de6eSShinta Sugimoto 17175c79de6eSShinta Sugimoto if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH) 17185c79de6eSShinta Sugimoto return -EINVAL; 17195c79de6eSShinta Sugimoto 17205c79de6eSShinta Sugimoto for (i = 0; i < num_migrate; i++, um++, ma++) { 17215c79de6eSShinta Sugimoto memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr)); 17225c79de6eSShinta Sugimoto memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr)); 17235c79de6eSShinta Sugimoto memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr)); 17245c79de6eSShinta Sugimoto memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr)); 17255c79de6eSShinta Sugimoto 17265c79de6eSShinta Sugimoto ma->proto = um->proto; 17275c79de6eSShinta Sugimoto ma->mode = um->mode; 17285c79de6eSShinta Sugimoto ma->reqid = um->reqid; 17295c79de6eSShinta Sugimoto 17305c79de6eSShinta Sugimoto ma->old_family = um->old_family; 17315c79de6eSShinta Sugimoto ma->new_family = um->new_family; 17325c79de6eSShinta Sugimoto } 17335c79de6eSShinta Sugimoto 17345c79de6eSShinta Sugimoto *num = i; 17355c79de6eSShinta Sugimoto return 0; 17365c79de6eSShinta Sugimoto } 17375c79de6eSShinta Sugimoto 17385c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 17395424f32eSThomas Graf struct nlattr **attrs) 17405c79de6eSShinta Sugimoto { 17417b67c857SThomas Graf struct xfrm_userpolicy_id *pi = nlmsg_data(nlh); 17425c79de6eSShinta Sugimoto struct xfrm_migrate m[XFRM_MAX_DEPTH]; 17435c79de6eSShinta Sugimoto u8 type; 17445c79de6eSShinta Sugimoto int err; 17455c79de6eSShinta Sugimoto int n = 0; 17465c79de6eSShinta Sugimoto 174735a7aa08SThomas Graf if (attrs[XFRMA_MIGRATE] == NULL) 1748cf5cb79fSThomas Graf return -EINVAL; 17495c79de6eSShinta Sugimoto 17505424f32eSThomas Graf err = copy_from_user_policy_type(&type, attrs); 17515c79de6eSShinta Sugimoto if (err) 17525c79de6eSShinta Sugimoto return err; 17535c79de6eSShinta Sugimoto 17545c79de6eSShinta Sugimoto err = copy_from_user_migrate((struct xfrm_migrate *)m, 17555424f32eSThomas Graf attrs, &n); 17565c79de6eSShinta Sugimoto if (err) 17575c79de6eSShinta Sugimoto return err; 17585c79de6eSShinta Sugimoto 17595c79de6eSShinta Sugimoto if (!n) 17605c79de6eSShinta Sugimoto return 0; 17615c79de6eSShinta Sugimoto 17625c79de6eSShinta Sugimoto xfrm_migrate(&pi->sel, pi->dir, type, m, n); 17635c79de6eSShinta Sugimoto 17645c79de6eSShinta Sugimoto return 0; 17655c79de6eSShinta Sugimoto } 17665c79de6eSShinta Sugimoto #else 17675c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 17685424f32eSThomas Graf struct nlattr **attrs) 17695c79de6eSShinta Sugimoto { 17705c79de6eSShinta Sugimoto return -ENOPROTOOPT; 17715c79de6eSShinta Sugimoto } 17725c79de6eSShinta Sugimoto #endif 17735c79de6eSShinta Sugimoto 17745c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 17755c79de6eSShinta Sugimoto static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb) 17765c79de6eSShinta Sugimoto { 17775c79de6eSShinta Sugimoto struct xfrm_user_migrate um; 17785c79de6eSShinta Sugimoto 17795c79de6eSShinta Sugimoto memset(&um, 0, sizeof(um)); 17805c79de6eSShinta Sugimoto um.proto = m->proto; 17815c79de6eSShinta Sugimoto um.mode = m->mode; 17825c79de6eSShinta Sugimoto um.reqid = m->reqid; 17835c79de6eSShinta Sugimoto um.old_family = m->old_family; 17845c79de6eSShinta Sugimoto memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr)); 17855c79de6eSShinta Sugimoto memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr)); 17865c79de6eSShinta Sugimoto um.new_family = m->new_family; 17875c79de6eSShinta Sugimoto memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr)); 17885c79de6eSShinta Sugimoto memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr)); 17895c79de6eSShinta Sugimoto 1790c0144beaSThomas Graf return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um); 17915c79de6eSShinta Sugimoto } 17925c79de6eSShinta Sugimoto 17937deb2264SThomas Graf static inline size_t xfrm_migrate_msgsize(int num_migrate) 17947deb2264SThomas Graf { 17957deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id)) 17967deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate) 17977deb2264SThomas Graf + userpolicy_type_attrsize(); 17987deb2264SThomas Graf } 17997deb2264SThomas Graf 18005c79de6eSShinta Sugimoto static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m, 18015c79de6eSShinta Sugimoto int num_migrate, struct xfrm_selector *sel, 18025c79de6eSShinta Sugimoto u8 dir, u8 type) 18035c79de6eSShinta Sugimoto { 18045c79de6eSShinta Sugimoto struct xfrm_migrate *mp; 18055c79de6eSShinta Sugimoto struct xfrm_userpolicy_id *pol_id; 18065c79de6eSShinta Sugimoto struct nlmsghdr *nlh; 18075c79de6eSShinta Sugimoto int i; 18085c79de6eSShinta Sugimoto 180979b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0); 181079b8b7f4SThomas Graf if (nlh == NULL) 181179b8b7f4SThomas Graf return -EMSGSIZE; 18125c79de6eSShinta Sugimoto 18137b67c857SThomas Graf pol_id = nlmsg_data(nlh); 18145c79de6eSShinta Sugimoto /* copy data from selector, dir, and type to the pol_id */ 18155c79de6eSShinta Sugimoto memset(pol_id, 0, sizeof(*pol_id)); 18165c79de6eSShinta Sugimoto memcpy(&pol_id->sel, sel, sizeof(pol_id->sel)); 18175c79de6eSShinta Sugimoto pol_id->dir = dir; 18185c79de6eSShinta Sugimoto 18195c79de6eSShinta Sugimoto if (copy_to_user_policy_type(type, skb) < 0) 18205c79de6eSShinta Sugimoto goto nlmsg_failure; 18215c79de6eSShinta Sugimoto 18225c79de6eSShinta Sugimoto for (i = 0, mp = m ; i < num_migrate; i++, mp++) { 18235c79de6eSShinta Sugimoto if (copy_to_user_migrate(mp, skb) < 0) 18245c79de6eSShinta Sugimoto goto nlmsg_failure; 18255c79de6eSShinta Sugimoto } 18265c79de6eSShinta Sugimoto 18279825069dSThomas Graf return nlmsg_end(skb, nlh); 18285c79de6eSShinta Sugimoto nlmsg_failure: 18299825069dSThomas Graf nlmsg_cancel(skb, nlh); 18309825069dSThomas Graf return -EMSGSIZE; 18315c79de6eSShinta Sugimoto } 18325c79de6eSShinta Sugimoto 18335c79de6eSShinta Sugimoto static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 18345c79de6eSShinta Sugimoto struct xfrm_migrate *m, int num_migrate) 18355c79de6eSShinta Sugimoto { 18365c79de6eSShinta Sugimoto struct sk_buff *skb; 18375c79de6eSShinta Sugimoto 18387deb2264SThomas Graf skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate), GFP_ATOMIC); 18395c79de6eSShinta Sugimoto if (skb == NULL) 18405c79de6eSShinta Sugimoto return -ENOMEM; 18415c79de6eSShinta Sugimoto 18425c79de6eSShinta Sugimoto /* build migrate */ 18435c79de6eSShinta Sugimoto if (build_migrate(skb, m, num_migrate, sel, dir, type) < 0) 18445c79de6eSShinta Sugimoto BUG(); 18455c79de6eSShinta Sugimoto 1846082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC); 18475c79de6eSShinta Sugimoto } 18485c79de6eSShinta Sugimoto #else 18495c79de6eSShinta Sugimoto static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 18505c79de6eSShinta Sugimoto struct xfrm_migrate *m, int num_migrate) 18515c79de6eSShinta Sugimoto { 18525c79de6eSShinta Sugimoto return -ENOPROTOOPT; 18535c79de6eSShinta Sugimoto } 18545c79de6eSShinta Sugimoto #endif 1855d51d081dSJamal Hadi Salim 1856a7bd9a45SThomas Graf #define XMSGSIZE(type) sizeof(struct type) 1857492b558bSThomas Graf 1858492b558bSThomas Graf static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = { 1859492b558bSThomas Graf [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 1860492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 1861492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 1862492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 1863492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 1864492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 1865492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info), 1866980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire), 186753bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire), 1868492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 1869492b558bSThomas Graf [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 18706c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire), 1871492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush), 1872a7bd9a45SThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0, 1873d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 1874d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 187597a64b45SMasahide NAKAMURA [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report), 18765c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 1877a7bd9a45SThomas Graf [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32), 1878a7bd9a45SThomas Graf [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 18791da177e4SLinus Torvalds }; 18801da177e4SLinus Torvalds 1881492b558bSThomas Graf #undef XMSGSIZE 1882492b558bSThomas Graf 1883cf5cb79fSThomas Graf static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { 18841a6509d9SHerbert Xu [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) }, 1885cf5cb79fSThomas Graf [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) }, 1886cf5cb79fSThomas Graf [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) }, 1887cf5cb79fSThomas Graf [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, 1888cf5cb79fSThomas Graf [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, 1889cf5cb79fSThomas Graf [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, 1890cf5cb79fSThomas Graf [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) }, 1891cf5cb79fSThomas Graf [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, 1892cf5cb79fSThomas Graf [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, 1893cf5cb79fSThomas Graf [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 }, 1894cf5cb79fSThomas Graf [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 }, 1895cf5cb79fSThomas Graf [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) }, 1896cf5cb79fSThomas Graf [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) }, 1897cf5cb79fSThomas Graf [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)}, 1898cf5cb79fSThomas Graf [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, 1899cf5cb79fSThomas Graf }; 1900cf5cb79fSThomas Graf 19011da177e4SLinus Torvalds static struct xfrm_link { 19025424f32eSThomas Graf int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **); 19031da177e4SLinus Torvalds int (*dump)(struct sk_buff *, struct netlink_callback *); 19044c563f76STimo Teras int (*done)(struct netlink_callback *); 1905492b558bSThomas Graf } xfrm_dispatch[XFRM_NR_MSGTYPES] = { 1906492b558bSThomas Graf [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 1907492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa }, 1908492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa, 19094c563f76STimo Teras .dump = xfrm_dump_sa, 19104c563f76STimo Teras .done = xfrm_dump_sa_done }, 1911492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 1912492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy }, 1913492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy, 19144c563f76STimo Teras .dump = xfrm_dump_policy, 19154c563f76STimo Teras .done = xfrm_dump_policy_done }, 1916492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi }, 1917980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire }, 191853bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire }, 1919492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 1920492b558bSThomas Graf [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 19216c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire}, 1922492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa }, 1923492b558bSThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy }, 1924d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae }, 1925d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae }, 19265c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate }, 192728d8909bSJamal Hadi Salim [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo }, 1928ecfd6b18SJamal Hadi Salim [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo }, 19291da177e4SLinus Torvalds }; 19301da177e4SLinus Torvalds 19311d00a4ebSThomas Graf static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 19321da177e4SLinus Torvalds { 193335a7aa08SThomas Graf struct nlattr *attrs[XFRMA_MAX+1]; 19341da177e4SLinus Torvalds struct xfrm_link *link; 1935a7bd9a45SThomas Graf int type, err; 19361da177e4SLinus Torvalds 19371da177e4SLinus Torvalds type = nlh->nlmsg_type; 19381da177e4SLinus Torvalds if (type > XFRM_MSG_MAX) 19391d00a4ebSThomas Graf return -EINVAL; 19401da177e4SLinus Torvalds 19411da177e4SLinus Torvalds type -= XFRM_MSG_BASE; 19421da177e4SLinus Torvalds link = &xfrm_dispatch[type]; 19431da177e4SLinus Torvalds 19441da177e4SLinus Torvalds /* All operations require privileges, even GET */ 19451d00a4ebSThomas Graf if (security_netlink_recv(skb, CAP_NET_ADMIN)) 19461d00a4ebSThomas Graf return -EPERM; 19471da177e4SLinus Torvalds 1948492b558bSThomas Graf if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || 1949492b558bSThomas Graf type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) && 1950492b558bSThomas Graf (nlh->nlmsg_flags & NLM_F_DUMP)) { 19511da177e4SLinus Torvalds if (link->dump == NULL) 19521d00a4ebSThomas Graf return -EINVAL; 19531da177e4SLinus Torvalds 19544c563f76STimo Teras return netlink_dump_start(xfrm_nl, skb, nlh, link->dump, link->done); 19551da177e4SLinus Torvalds } 19561da177e4SLinus Torvalds 195735a7aa08SThomas Graf err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX, 1958cf5cb79fSThomas Graf xfrma_policy); 1959a7bd9a45SThomas Graf if (err < 0) 1960a7bd9a45SThomas Graf return err; 19611da177e4SLinus Torvalds 19621da177e4SLinus Torvalds if (link->doit == NULL) 19631d00a4ebSThomas Graf return -EINVAL; 19641da177e4SLinus Torvalds 19655424f32eSThomas Graf return link->doit(skb, nlh, attrs); 19661da177e4SLinus Torvalds } 19671da177e4SLinus Torvalds 1968cd40b7d3SDenis V. Lunev static void xfrm_netlink_rcv(struct sk_buff *skb) 19691da177e4SLinus Torvalds { 19704a3e2f71SArjan van de Ven mutex_lock(&xfrm_cfg_mutex); 1971cd40b7d3SDenis V. Lunev netlink_rcv_skb(skb, &xfrm_user_rcv_msg); 19724a3e2f71SArjan van de Ven mutex_unlock(&xfrm_cfg_mutex); 19731da177e4SLinus Torvalds } 19741da177e4SLinus Torvalds 19757deb2264SThomas Graf static inline size_t xfrm_expire_msgsize(void) 19767deb2264SThomas Graf { 19777deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)); 19787deb2264SThomas Graf } 19797deb2264SThomas Graf 1980d51d081dSJamal Hadi Salim static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c) 19811da177e4SLinus Torvalds { 19821da177e4SLinus Torvalds struct xfrm_user_expire *ue; 19831da177e4SLinus Torvalds struct nlmsghdr *nlh; 19841da177e4SLinus Torvalds 198579b8b7f4SThomas Graf nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0); 198679b8b7f4SThomas Graf if (nlh == NULL) 198779b8b7f4SThomas Graf return -EMSGSIZE; 19881da177e4SLinus Torvalds 19897b67c857SThomas Graf ue = nlmsg_data(nlh); 19901da177e4SLinus Torvalds copy_to_user_state(x, &ue->state); 1991d51d081dSJamal Hadi Salim ue->hard = (c->data.hard != 0) ? 1 : 0; 19921da177e4SLinus Torvalds 19939825069dSThomas Graf return nlmsg_end(skb, nlh); 19941da177e4SLinus Torvalds } 19951da177e4SLinus Torvalds 199626b15dadSJamal Hadi Salim static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c) 19971da177e4SLinus Torvalds { 19981da177e4SLinus Torvalds struct sk_buff *skb; 19991da177e4SLinus Torvalds 20007deb2264SThomas Graf skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC); 20011da177e4SLinus Torvalds if (skb == NULL) 20021da177e4SLinus Torvalds return -ENOMEM; 20031da177e4SLinus Torvalds 2004d51d081dSJamal Hadi Salim if (build_expire(skb, x, c) < 0) 20051da177e4SLinus Torvalds BUG(); 20061da177e4SLinus Torvalds 2007082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC); 20081da177e4SLinus Torvalds } 20091da177e4SLinus Torvalds 2010d51d081dSJamal Hadi Salim static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c) 2011d51d081dSJamal Hadi Salim { 2012d51d081dSJamal Hadi Salim struct sk_buff *skb; 2013d51d081dSJamal Hadi Salim 20147deb2264SThomas Graf skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC); 2015d51d081dSJamal Hadi Salim if (skb == NULL) 2016d51d081dSJamal Hadi Salim return -ENOMEM; 2017d51d081dSJamal Hadi Salim 2018d51d081dSJamal Hadi Salim if (build_aevent(skb, x, c) < 0) 2019d51d081dSJamal Hadi Salim BUG(); 2020d51d081dSJamal Hadi Salim 2021082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC); 2022d51d081dSJamal Hadi Salim } 2023d51d081dSJamal Hadi Salim 202426b15dadSJamal Hadi Salim static int xfrm_notify_sa_flush(struct km_event *c) 202526b15dadSJamal Hadi Salim { 202626b15dadSJamal Hadi Salim struct xfrm_usersa_flush *p; 202726b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 202826b15dadSJamal Hadi Salim struct sk_buff *skb; 20297deb2264SThomas Graf int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush)); 203026b15dadSJamal Hadi Salim 20317deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 203226b15dadSJamal Hadi Salim if (skb == NULL) 203326b15dadSJamal Hadi Salim return -ENOMEM; 203426b15dadSJamal Hadi Salim 203579b8b7f4SThomas Graf nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0); 203679b8b7f4SThomas Graf if (nlh == NULL) { 203779b8b7f4SThomas Graf kfree_skb(skb); 203879b8b7f4SThomas Graf return -EMSGSIZE; 203979b8b7f4SThomas Graf } 204026b15dadSJamal Hadi Salim 20417b67c857SThomas Graf p = nlmsg_data(nlh); 2042bf08867fSHerbert Xu p->proto = c->data.proto; 204326b15dadSJamal Hadi Salim 20449825069dSThomas Graf nlmsg_end(skb, nlh); 204526b15dadSJamal Hadi Salim 2046082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC); 204726b15dadSJamal Hadi Salim } 204826b15dadSJamal Hadi Salim 20497deb2264SThomas Graf static inline size_t xfrm_sa_len(struct xfrm_state *x) 205026b15dadSJamal Hadi Salim { 20517deb2264SThomas Graf size_t l = 0; 20521a6509d9SHerbert Xu if (x->aead) 20531a6509d9SHerbert Xu l += nla_total_size(aead_len(x->aead)); 205426b15dadSJamal Hadi Salim if (x->aalg) 20550f99be0dSEric Dumazet l += nla_total_size(xfrm_alg_len(x->aalg)); 205626b15dadSJamal Hadi Salim if (x->ealg) 20570f99be0dSEric Dumazet l += nla_total_size(xfrm_alg_len(x->ealg)); 205826b15dadSJamal Hadi Salim if (x->calg) 20597deb2264SThomas Graf l += nla_total_size(sizeof(*x->calg)); 206026b15dadSJamal Hadi Salim if (x->encap) 20617deb2264SThomas Graf l += nla_total_size(sizeof(*x->encap)); 206268325d3bSHerbert Xu if (x->security) 206368325d3bSHerbert Xu l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) + 206468325d3bSHerbert Xu x->security->ctx_len); 206568325d3bSHerbert Xu if (x->coaddr) 206668325d3bSHerbert Xu l += nla_total_size(sizeof(*x->coaddr)); 206768325d3bSHerbert Xu 2068d26f3984SHerbert Xu /* Must count x->lastused as it may become non-zero behind our back. */ 2069d26f3984SHerbert Xu l += nla_total_size(sizeof(u64)); 207026b15dadSJamal Hadi Salim 207126b15dadSJamal Hadi Salim return l; 207226b15dadSJamal Hadi Salim } 207326b15dadSJamal Hadi Salim 207426b15dadSJamal Hadi Salim static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c) 207526b15dadSJamal Hadi Salim { 207626b15dadSJamal Hadi Salim struct xfrm_usersa_info *p; 20770603eac0SHerbert Xu struct xfrm_usersa_id *id; 207826b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 207926b15dadSJamal Hadi Salim struct sk_buff *skb; 208026b15dadSJamal Hadi Salim int len = xfrm_sa_len(x); 20810603eac0SHerbert Xu int headlen; 20820603eac0SHerbert Xu 20830603eac0SHerbert Xu headlen = sizeof(*p); 20840603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) { 20857deb2264SThomas Graf len += nla_total_size(headlen); 20860603eac0SHerbert Xu headlen = sizeof(*id); 20870603eac0SHerbert Xu } 20887deb2264SThomas Graf len += NLMSG_ALIGN(headlen); 208926b15dadSJamal Hadi Salim 20907deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 209126b15dadSJamal Hadi Salim if (skb == NULL) 209226b15dadSJamal Hadi Salim return -ENOMEM; 209326b15dadSJamal Hadi Salim 209479b8b7f4SThomas Graf nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0); 209579b8b7f4SThomas Graf if (nlh == NULL) 2096c0144beaSThomas Graf goto nla_put_failure; 209726b15dadSJamal Hadi Salim 20987b67c857SThomas Graf p = nlmsg_data(nlh); 20990603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) { 2100c0144beaSThomas Graf struct nlattr *attr; 2101c0144beaSThomas Graf 21027b67c857SThomas Graf id = nlmsg_data(nlh); 21030603eac0SHerbert Xu memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr)); 21040603eac0SHerbert Xu id->spi = x->id.spi; 21050603eac0SHerbert Xu id->family = x->props.family; 21060603eac0SHerbert Xu id->proto = x->id.proto; 21070603eac0SHerbert Xu 2108c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SA, sizeof(*p)); 2109c0144beaSThomas Graf if (attr == NULL) 2110c0144beaSThomas Graf goto nla_put_failure; 2111c0144beaSThomas Graf 2112c0144beaSThomas Graf p = nla_data(attr); 21130603eac0SHerbert Xu } 21140603eac0SHerbert Xu 211568325d3bSHerbert Xu if (copy_to_user_state_extra(x, p, skb)) 211668325d3bSHerbert Xu goto nla_put_failure; 211726b15dadSJamal Hadi Salim 21189825069dSThomas Graf nlmsg_end(skb, nlh); 211926b15dadSJamal Hadi Salim 2120082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC); 212126b15dadSJamal Hadi Salim 2122c0144beaSThomas Graf nla_put_failure: 212368325d3bSHerbert Xu /* Somebody screwed up with xfrm_sa_len! */ 212468325d3bSHerbert Xu WARN_ON(1); 212526b15dadSJamal Hadi Salim kfree_skb(skb); 212626b15dadSJamal Hadi Salim return -1; 212726b15dadSJamal Hadi Salim } 212826b15dadSJamal Hadi Salim 212926b15dadSJamal Hadi Salim static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c) 213026b15dadSJamal Hadi Salim { 213126b15dadSJamal Hadi Salim 213226b15dadSJamal Hadi Salim switch (c->event) { 2133f60f6b8fSHerbert Xu case XFRM_MSG_EXPIRE: 213426b15dadSJamal Hadi Salim return xfrm_exp_state_notify(x, c); 2135d51d081dSJamal Hadi Salim case XFRM_MSG_NEWAE: 2136d51d081dSJamal Hadi Salim return xfrm_aevent_state_notify(x, c); 2137f60f6b8fSHerbert Xu case XFRM_MSG_DELSA: 2138f60f6b8fSHerbert Xu case XFRM_MSG_UPDSA: 2139f60f6b8fSHerbert Xu case XFRM_MSG_NEWSA: 214026b15dadSJamal Hadi Salim return xfrm_notify_sa(x, c); 2141f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHSA: 214226b15dadSJamal Hadi Salim return xfrm_notify_sa_flush(c); 214326b15dadSJamal Hadi Salim default: 214426b15dadSJamal Hadi Salim printk("xfrm_user: Unknown SA event %d\n", c->event); 214526b15dadSJamal Hadi Salim break; 214626b15dadSJamal Hadi Salim } 214726b15dadSJamal Hadi Salim 214826b15dadSJamal Hadi Salim return 0; 214926b15dadSJamal Hadi Salim 215026b15dadSJamal Hadi Salim } 215126b15dadSJamal Hadi Salim 21527deb2264SThomas Graf static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x, 21537deb2264SThomas Graf struct xfrm_policy *xp) 21547deb2264SThomas Graf { 21557deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire)) 21567deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 21577deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(x->security)) 21587deb2264SThomas Graf + userpolicy_type_attrsize(); 21597deb2264SThomas Graf } 21607deb2264SThomas Graf 21611da177e4SLinus Torvalds static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, 21621da177e4SLinus Torvalds struct xfrm_tmpl *xt, struct xfrm_policy *xp, 21631da177e4SLinus Torvalds int dir) 21641da177e4SLinus Torvalds { 21651da177e4SLinus Torvalds struct xfrm_user_acquire *ua; 21661da177e4SLinus Torvalds struct nlmsghdr *nlh; 21671da177e4SLinus Torvalds __u32 seq = xfrm_get_acqseq(); 21681da177e4SLinus Torvalds 216979b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0); 217079b8b7f4SThomas Graf if (nlh == NULL) 217179b8b7f4SThomas Graf return -EMSGSIZE; 21721da177e4SLinus Torvalds 21737b67c857SThomas Graf ua = nlmsg_data(nlh); 21741da177e4SLinus Torvalds memcpy(&ua->id, &x->id, sizeof(ua->id)); 21751da177e4SLinus Torvalds memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr)); 21761da177e4SLinus Torvalds memcpy(&ua->sel, &x->sel, sizeof(ua->sel)); 21771da177e4SLinus Torvalds copy_to_user_policy(xp, &ua->policy, dir); 21781da177e4SLinus Torvalds ua->aalgos = xt->aalgos; 21791da177e4SLinus Torvalds ua->ealgos = xt->ealgos; 21801da177e4SLinus Torvalds ua->calgos = xt->calgos; 21811da177e4SLinus Torvalds ua->seq = x->km.seq = seq; 21821da177e4SLinus Torvalds 21831da177e4SLinus Torvalds if (copy_to_user_tmpl(xp, skb) < 0) 21841da177e4SLinus Torvalds goto nlmsg_failure; 21850d681623SSerge Hallyn if (copy_to_user_state_sec_ctx(x, skb)) 2186df71837dSTrent Jaeger goto nlmsg_failure; 21871459bb36SJamal Hadi Salim if (copy_to_user_policy_type(xp->type, skb) < 0) 2188f7b6983fSMasahide NAKAMURA goto nlmsg_failure; 21891da177e4SLinus Torvalds 21909825069dSThomas Graf return nlmsg_end(skb, nlh); 21911da177e4SLinus Torvalds 21921da177e4SLinus Torvalds nlmsg_failure: 21939825069dSThomas Graf nlmsg_cancel(skb, nlh); 21949825069dSThomas Graf return -EMSGSIZE; 21951da177e4SLinus Torvalds } 21961da177e4SLinus Torvalds 21971da177e4SLinus Torvalds static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt, 21981da177e4SLinus Torvalds struct xfrm_policy *xp, int dir) 21991da177e4SLinus Torvalds { 22001da177e4SLinus Torvalds struct sk_buff *skb; 22011da177e4SLinus Torvalds 22027deb2264SThomas Graf skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC); 22031da177e4SLinus Torvalds if (skb == NULL) 22041da177e4SLinus Torvalds return -ENOMEM; 22051da177e4SLinus Torvalds 22061da177e4SLinus Torvalds if (build_acquire(skb, x, xt, xp, dir) < 0) 22071da177e4SLinus Torvalds BUG(); 22081da177e4SLinus Torvalds 2209082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC); 22101da177e4SLinus Torvalds } 22111da177e4SLinus Torvalds 22121da177e4SLinus Torvalds /* User gives us xfrm_user_policy_info followed by an array of 0 22131da177e4SLinus Torvalds * or more templates. 22141da177e4SLinus Torvalds */ 2215cb969f07SVenkat Yekkirala static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt, 22161da177e4SLinus Torvalds u8 *data, int len, int *dir) 22171da177e4SLinus Torvalds { 22181da177e4SLinus Torvalds struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data; 22191da177e4SLinus Torvalds struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1); 22201da177e4SLinus Torvalds struct xfrm_policy *xp; 22211da177e4SLinus Torvalds int nr; 22221da177e4SLinus Torvalds 2223cb969f07SVenkat Yekkirala switch (sk->sk_family) { 22241da177e4SLinus Torvalds case AF_INET: 22251da177e4SLinus Torvalds if (opt != IP_XFRM_POLICY) { 22261da177e4SLinus Torvalds *dir = -EOPNOTSUPP; 22271da177e4SLinus Torvalds return NULL; 22281da177e4SLinus Torvalds } 22291da177e4SLinus Torvalds break; 22301da177e4SLinus Torvalds #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 22311da177e4SLinus Torvalds case AF_INET6: 22321da177e4SLinus Torvalds if (opt != IPV6_XFRM_POLICY) { 22331da177e4SLinus Torvalds *dir = -EOPNOTSUPP; 22341da177e4SLinus Torvalds return NULL; 22351da177e4SLinus Torvalds } 22361da177e4SLinus Torvalds break; 22371da177e4SLinus Torvalds #endif 22381da177e4SLinus Torvalds default: 22391da177e4SLinus Torvalds *dir = -EINVAL; 22401da177e4SLinus Torvalds return NULL; 22411da177e4SLinus Torvalds } 22421da177e4SLinus Torvalds 22431da177e4SLinus Torvalds *dir = -EINVAL; 22441da177e4SLinus Torvalds 22451da177e4SLinus Torvalds if (len < sizeof(*p) || 22461da177e4SLinus Torvalds verify_newpolicy_info(p)) 22471da177e4SLinus Torvalds return NULL; 22481da177e4SLinus Torvalds 22491da177e4SLinus Torvalds nr = ((len - sizeof(*p)) / sizeof(*ut)); 2250b4ad86bfSDavid S. Miller if (validate_tmpl(nr, ut, p->sel.family)) 22511da177e4SLinus Torvalds return NULL; 22521da177e4SLinus Torvalds 2253a4f1bac6SHerbert Xu if (p->dir > XFRM_POLICY_OUT) 2254a4f1bac6SHerbert Xu return NULL; 2255a4f1bac6SHerbert Xu 22561da177e4SLinus Torvalds xp = xfrm_policy_alloc(GFP_KERNEL); 22571da177e4SLinus Torvalds if (xp == NULL) { 22581da177e4SLinus Torvalds *dir = -ENOBUFS; 22591da177e4SLinus Torvalds return NULL; 22601da177e4SLinus Torvalds } 22611da177e4SLinus Torvalds 22621da177e4SLinus Torvalds copy_from_user_policy(xp, p); 2263f7b6983fSMasahide NAKAMURA xp->type = XFRM_POLICY_TYPE_MAIN; 22641da177e4SLinus Torvalds copy_templates(xp, ut, nr); 22651da177e4SLinus Torvalds 22661da177e4SLinus Torvalds *dir = p->dir; 22671da177e4SLinus Torvalds 22681da177e4SLinus Torvalds return xp; 22691da177e4SLinus Torvalds } 22701da177e4SLinus Torvalds 22717deb2264SThomas Graf static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp) 22727deb2264SThomas Graf { 22737deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire)) 22747deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 22757deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(xp->security)) 22767deb2264SThomas Graf + userpolicy_type_attrsize(); 22777deb2264SThomas Graf } 22787deb2264SThomas Graf 22791da177e4SLinus Torvalds static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, 2280d51d081dSJamal Hadi Salim int dir, struct km_event *c) 22811da177e4SLinus Torvalds { 22821da177e4SLinus Torvalds struct xfrm_user_polexpire *upe; 22831da177e4SLinus Torvalds struct nlmsghdr *nlh; 2284d51d081dSJamal Hadi Salim int hard = c->data.hard; 22851da177e4SLinus Torvalds 228679b8b7f4SThomas Graf nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0); 228779b8b7f4SThomas Graf if (nlh == NULL) 228879b8b7f4SThomas Graf return -EMSGSIZE; 22891da177e4SLinus Torvalds 22907b67c857SThomas Graf upe = nlmsg_data(nlh); 22911da177e4SLinus Torvalds copy_to_user_policy(xp, &upe->pol, dir); 22921da177e4SLinus Torvalds if (copy_to_user_tmpl(xp, skb) < 0) 22931da177e4SLinus Torvalds goto nlmsg_failure; 2294df71837dSTrent Jaeger if (copy_to_user_sec_ctx(xp, skb)) 2295df71837dSTrent Jaeger goto nlmsg_failure; 22961459bb36SJamal Hadi Salim if (copy_to_user_policy_type(xp->type, skb) < 0) 2297f7b6983fSMasahide NAKAMURA goto nlmsg_failure; 22981da177e4SLinus Torvalds upe->hard = !!hard; 22991da177e4SLinus Torvalds 23009825069dSThomas Graf return nlmsg_end(skb, nlh); 23011da177e4SLinus Torvalds 23021da177e4SLinus Torvalds nlmsg_failure: 23039825069dSThomas Graf nlmsg_cancel(skb, nlh); 23049825069dSThomas Graf return -EMSGSIZE; 23051da177e4SLinus Torvalds } 23061da177e4SLinus Torvalds 230726b15dadSJamal Hadi Salim static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 23081da177e4SLinus Torvalds { 23091da177e4SLinus Torvalds struct sk_buff *skb; 23101da177e4SLinus Torvalds 23117deb2264SThomas Graf skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC); 23121da177e4SLinus Torvalds if (skb == NULL) 23131da177e4SLinus Torvalds return -ENOMEM; 23141da177e4SLinus Torvalds 2315d51d081dSJamal Hadi Salim if (build_polexpire(skb, xp, dir, c) < 0) 23161da177e4SLinus Torvalds BUG(); 23171da177e4SLinus Torvalds 2318082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC); 23191da177e4SLinus Torvalds } 23201da177e4SLinus Torvalds 232126b15dadSJamal Hadi Salim static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c) 232226b15dadSJamal Hadi Salim { 232326b15dadSJamal Hadi Salim struct xfrm_userpolicy_info *p; 23240603eac0SHerbert Xu struct xfrm_userpolicy_id *id; 232526b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 232626b15dadSJamal Hadi Salim struct sk_buff *skb; 23277deb2264SThomas Graf int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 23280603eac0SHerbert Xu int headlen; 23290603eac0SHerbert Xu 23300603eac0SHerbert Xu headlen = sizeof(*p); 23310603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) { 23327deb2264SThomas Graf len += nla_total_size(headlen); 23330603eac0SHerbert Xu headlen = sizeof(*id); 23340603eac0SHerbert Xu } 2335cfbfd45aSThomas Graf len += userpolicy_type_attrsize(); 23367deb2264SThomas Graf len += NLMSG_ALIGN(headlen); 233726b15dadSJamal Hadi Salim 23387deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 233926b15dadSJamal Hadi Salim if (skb == NULL) 234026b15dadSJamal Hadi Salim return -ENOMEM; 234126b15dadSJamal Hadi Salim 234279b8b7f4SThomas Graf nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0); 234379b8b7f4SThomas Graf if (nlh == NULL) 234479b8b7f4SThomas Graf goto nlmsg_failure; 234526b15dadSJamal Hadi Salim 23467b67c857SThomas Graf p = nlmsg_data(nlh); 23470603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) { 2348c0144beaSThomas Graf struct nlattr *attr; 2349c0144beaSThomas Graf 23507b67c857SThomas Graf id = nlmsg_data(nlh); 23510603eac0SHerbert Xu memset(id, 0, sizeof(*id)); 23520603eac0SHerbert Xu id->dir = dir; 23530603eac0SHerbert Xu if (c->data.byid) 23540603eac0SHerbert Xu id->index = xp->index; 23550603eac0SHerbert Xu else 23560603eac0SHerbert Xu memcpy(&id->sel, &xp->selector, sizeof(id->sel)); 23570603eac0SHerbert Xu 2358c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p)); 2359c0144beaSThomas Graf if (attr == NULL) 2360c0144beaSThomas Graf goto nlmsg_failure; 2361c0144beaSThomas Graf 2362c0144beaSThomas Graf p = nla_data(attr); 23630603eac0SHerbert Xu } 236426b15dadSJamal Hadi Salim 236526b15dadSJamal Hadi Salim copy_to_user_policy(xp, p, dir); 236626b15dadSJamal Hadi Salim if (copy_to_user_tmpl(xp, skb) < 0) 236726b15dadSJamal Hadi Salim goto nlmsg_failure; 23681459bb36SJamal Hadi Salim if (copy_to_user_policy_type(xp->type, skb) < 0) 2369f7b6983fSMasahide NAKAMURA goto nlmsg_failure; 237026b15dadSJamal Hadi Salim 23719825069dSThomas Graf nlmsg_end(skb, nlh); 237226b15dadSJamal Hadi Salim 2373082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC); 237426b15dadSJamal Hadi Salim 237526b15dadSJamal Hadi Salim nlmsg_failure: 237626b15dadSJamal Hadi Salim kfree_skb(skb); 237726b15dadSJamal Hadi Salim return -1; 237826b15dadSJamal Hadi Salim } 237926b15dadSJamal Hadi Salim 238026b15dadSJamal Hadi Salim static int xfrm_notify_policy_flush(struct km_event *c) 238126b15dadSJamal Hadi Salim { 238226b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 238326b15dadSJamal Hadi Salim struct sk_buff *skb; 238426b15dadSJamal Hadi Salim 23857deb2264SThomas Graf skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC); 238626b15dadSJamal Hadi Salim if (skb == NULL) 238726b15dadSJamal Hadi Salim return -ENOMEM; 238826b15dadSJamal Hadi Salim 238979b8b7f4SThomas Graf nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0); 239079b8b7f4SThomas Graf if (nlh == NULL) 239179b8b7f4SThomas Graf goto nlmsg_failure; 23920c51f53cSJamal Hadi Salim if (copy_to_user_policy_type(c->data.type, skb) < 0) 23930c51f53cSJamal Hadi Salim goto nlmsg_failure; 239426b15dadSJamal Hadi Salim 23959825069dSThomas Graf nlmsg_end(skb, nlh); 239626b15dadSJamal Hadi Salim 2397082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC); 239826b15dadSJamal Hadi Salim 239926b15dadSJamal Hadi Salim nlmsg_failure: 240026b15dadSJamal Hadi Salim kfree_skb(skb); 240126b15dadSJamal Hadi Salim return -1; 240226b15dadSJamal Hadi Salim } 240326b15dadSJamal Hadi Salim 240426b15dadSJamal Hadi Salim static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 240526b15dadSJamal Hadi Salim { 240626b15dadSJamal Hadi Salim 240726b15dadSJamal Hadi Salim switch (c->event) { 2408f60f6b8fSHerbert Xu case XFRM_MSG_NEWPOLICY: 2409f60f6b8fSHerbert Xu case XFRM_MSG_UPDPOLICY: 2410f60f6b8fSHerbert Xu case XFRM_MSG_DELPOLICY: 241126b15dadSJamal Hadi Salim return xfrm_notify_policy(xp, dir, c); 2412f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHPOLICY: 241326b15dadSJamal Hadi Salim return xfrm_notify_policy_flush(c); 2414f60f6b8fSHerbert Xu case XFRM_MSG_POLEXPIRE: 241526b15dadSJamal Hadi Salim return xfrm_exp_policy_notify(xp, dir, c); 241626b15dadSJamal Hadi Salim default: 241726b15dadSJamal Hadi Salim printk("xfrm_user: Unknown Policy event %d\n", c->event); 241826b15dadSJamal Hadi Salim } 241926b15dadSJamal Hadi Salim 242026b15dadSJamal Hadi Salim return 0; 242126b15dadSJamal Hadi Salim 242226b15dadSJamal Hadi Salim } 242326b15dadSJamal Hadi Salim 24247deb2264SThomas Graf static inline size_t xfrm_report_msgsize(void) 24257deb2264SThomas Graf { 24267deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_report)); 24277deb2264SThomas Graf } 24287deb2264SThomas Graf 242997a64b45SMasahide NAKAMURA static int build_report(struct sk_buff *skb, u8 proto, 243097a64b45SMasahide NAKAMURA struct xfrm_selector *sel, xfrm_address_t *addr) 243197a64b45SMasahide NAKAMURA { 243297a64b45SMasahide NAKAMURA struct xfrm_user_report *ur; 243397a64b45SMasahide NAKAMURA struct nlmsghdr *nlh; 243497a64b45SMasahide NAKAMURA 243579b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0); 243679b8b7f4SThomas Graf if (nlh == NULL) 243779b8b7f4SThomas Graf return -EMSGSIZE; 243897a64b45SMasahide NAKAMURA 24397b67c857SThomas Graf ur = nlmsg_data(nlh); 244097a64b45SMasahide NAKAMURA ur->proto = proto; 244197a64b45SMasahide NAKAMURA memcpy(&ur->sel, sel, sizeof(ur->sel)); 244297a64b45SMasahide NAKAMURA 244397a64b45SMasahide NAKAMURA if (addr) 2444c0144beaSThomas Graf NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr); 244597a64b45SMasahide NAKAMURA 24469825069dSThomas Graf return nlmsg_end(skb, nlh); 244797a64b45SMasahide NAKAMURA 2448c0144beaSThomas Graf nla_put_failure: 24499825069dSThomas Graf nlmsg_cancel(skb, nlh); 24509825069dSThomas Graf return -EMSGSIZE; 245197a64b45SMasahide NAKAMURA } 245297a64b45SMasahide NAKAMURA 245397a64b45SMasahide NAKAMURA static int xfrm_send_report(u8 proto, struct xfrm_selector *sel, 245497a64b45SMasahide NAKAMURA xfrm_address_t *addr) 245597a64b45SMasahide NAKAMURA { 245697a64b45SMasahide NAKAMURA struct sk_buff *skb; 245797a64b45SMasahide NAKAMURA 24587deb2264SThomas Graf skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC); 245997a64b45SMasahide NAKAMURA if (skb == NULL) 246097a64b45SMasahide NAKAMURA return -ENOMEM; 246197a64b45SMasahide NAKAMURA 246297a64b45SMasahide NAKAMURA if (build_report(skb, proto, sel, addr) < 0) 246397a64b45SMasahide NAKAMURA BUG(); 246497a64b45SMasahide NAKAMURA 2465082a1ad5SThomas Graf return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC); 246697a64b45SMasahide NAKAMURA } 246797a64b45SMasahide NAKAMURA 24681da177e4SLinus Torvalds static struct xfrm_mgr netlink_mgr = { 24691da177e4SLinus Torvalds .id = "netlink", 24701da177e4SLinus Torvalds .notify = xfrm_send_state_notify, 24711da177e4SLinus Torvalds .acquire = xfrm_send_acquire, 24721da177e4SLinus Torvalds .compile_policy = xfrm_compile_policy, 24731da177e4SLinus Torvalds .notify_policy = xfrm_send_policy_notify, 247497a64b45SMasahide NAKAMURA .report = xfrm_send_report, 24755c79de6eSShinta Sugimoto .migrate = xfrm_send_migrate, 24761da177e4SLinus Torvalds }; 24771da177e4SLinus Torvalds 24781da177e4SLinus Torvalds static int __init xfrm_user_init(void) 24791da177e4SLinus Torvalds { 2480be33690dSPatrick McHardy struct sock *nlsk; 2481be33690dSPatrick McHardy 2482654b32c6SMasahide NAKAMURA printk(KERN_INFO "Initializing XFRM netlink socket\n"); 24831da177e4SLinus Torvalds 2484b4b51029SEric W. Biederman nlsk = netlink_kernel_create(&init_net, NETLINK_XFRM, XFRMNLGRP_MAX, 2485af65bdfcSPatrick McHardy xfrm_netlink_rcv, NULL, THIS_MODULE); 2486be33690dSPatrick McHardy if (nlsk == NULL) 24871da177e4SLinus Torvalds return -ENOMEM; 2488be33690dSPatrick McHardy rcu_assign_pointer(xfrm_nl, nlsk); 24891da177e4SLinus Torvalds 24901da177e4SLinus Torvalds xfrm_register_km(&netlink_mgr); 24911da177e4SLinus Torvalds 24921da177e4SLinus Torvalds return 0; 24931da177e4SLinus Torvalds } 24941da177e4SLinus Torvalds 24951da177e4SLinus Torvalds static void __exit xfrm_user_exit(void) 24961da177e4SLinus Torvalds { 2497be33690dSPatrick McHardy struct sock *nlsk = xfrm_nl; 2498be33690dSPatrick McHardy 24991da177e4SLinus Torvalds xfrm_unregister_km(&netlink_mgr); 2500be33690dSPatrick McHardy rcu_assign_pointer(xfrm_nl, NULL); 2501be33690dSPatrick McHardy synchronize_rcu(); 2502b7c6ba6eSDenis V. Lunev netlink_kernel_release(nlsk); 25031da177e4SLinus Torvalds } 25041da177e4SLinus Torvalds 25051da177e4SLinus Torvalds module_init(xfrm_user_init); 25061da177e4SLinus Torvalds module_exit(xfrm_user_exit); 25071da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 25084fdb3bb7SHarald Welte MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM); 2509f8cd5488SJamal Hadi Salim 2510