xref: /linux/net/xfrm/xfrm_user.c (revision 7b67c8575f1ed0d5fd7524a33d34f5c88c52a194)
11da177e4SLinus Torvalds /* xfrm_user.c: User interface to configure xfrm engine.
21da177e4SLinus Torvalds  *
31da177e4SLinus Torvalds  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
41da177e4SLinus Torvalds  *
51da177e4SLinus Torvalds  * Changes:
61da177e4SLinus Torvalds  *	Mitsuru KANDA @USAGI
71da177e4SLinus Torvalds  * 	Kazunori MIYAZAWA @USAGI
81da177e4SLinus Torvalds  * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
91da177e4SLinus Torvalds  * 		IPv6 support
101da177e4SLinus Torvalds  *
111da177e4SLinus Torvalds  */
121da177e4SLinus Torvalds 
139409f38aSHerbert Xu #include <linux/crypto.h>
141da177e4SLinus Torvalds #include <linux/module.h>
151da177e4SLinus Torvalds #include <linux/kernel.h>
161da177e4SLinus Torvalds #include <linux/types.h>
171da177e4SLinus Torvalds #include <linux/slab.h>
181da177e4SLinus Torvalds #include <linux/socket.h>
191da177e4SLinus Torvalds #include <linux/string.h>
201da177e4SLinus Torvalds #include <linux/net.h>
211da177e4SLinus Torvalds #include <linux/skbuff.h>
221da177e4SLinus Torvalds #include <linux/rtnetlink.h>
231da177e4SLinus Torvalds #include <linux/pfkeyv2.h>
241da177e4SLinus Torvalds #include <linux/ipsec.h>
251da177e4SLinus Torvalds #include <linux/init.h>
261da177e4SLinus Torvalds #include <linux/security.h>
271da177e4SLinus Torvalds #include <net/sock.h>
281da177e4SLinus Torvalds #include <net/xfrm.h>
2988fc2c84SThomas Graf #include <net/netlink.h>
301da177e4SLinus Torvalds #include <asm/uaccess.h>
31e23c7194SMasahide NAKAMURA #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
32e23c7194SMasahide NAKAMURA #include <linux/in6.h>
33e23c7194SMasahide NAKAMURA #endif
34161a09e7SJoy Latten #include <linux/audit.h>
351da177e4SLinus Torvalds 
361da177e4SLinus Torvalds static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type)
371da177e4SLinus Torvalds {
381da177e4SLinus Torvalds 	struct rtattr *rt = xfrma[type - 1];
391da177e4SLinus Torvalds 	struct xfrm_algo *algp;
4031c26852SHerbert Xu 	int len;
411da177e4SLinus Torvalds 
421da177e4SLinus Torvalds 	if (!rt)
431da177e4SLinus Torvalds 		return 0;
441da177e4SLinus Torvalds 
4531c26852SHerbert Xu 	len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp);
4631c26852SHerbert Xu 	if (len < 0)
471da177e4SLinus Torvalds 		return -EINVAL;
481da177e4SLinus Torvalds 
491da177e4SLinus Torvalds 	algp = RTA_DATA(rt);
5031c26852SHerbert Xu 
5131c26852SHerbert Xu 	len -= (algp->alg_key_len + 7U) / 8;
5231c26852SHerbert Xu 	if (len < 0)
5331c26852SHerbert Xu 		return -EINVAL;
5431c26852SHerbert Xu 
551da177e4SLinus Torvalds 	switch (type) {
561da177e4SLinus Torvalds 	case XFRMA_ALG_AUTH:
571da177e4SLinus Torvalds 		if (!algp->alg_key_len &&
581da177e4SLinus Torvalds 		    strcmp(algp->alg_name, "digest_null") != 0)
591da177e4SLinus Torvalds 			return -EINVAL;
601da177e4SLinus Torvalds 		break;
611da177e4SLinus Torvalds 
621da177e4SLinus Torvalds 	case XFRMA_ALG_CRYPT:
631da177e4SLinus Torvalds 		if (!algp->alg_key_len &&
641da177e4SLinus Torvalds 		    strcmp(algp->alg_name, "cipher_null") != 0)
651da177e4SLinus Torvalds 			return -EINVAL;
661da177e4SLinus Torvalds 		break;
671da177e4SLinus Torvalds 
681da177e4SLinus Torvalds 	case XFRMA_ALG_COMP:
691da177e4SLinus Torvalds 		/* Zero length keys are legal.  */
701da177e4SLinus Torvalds 		break;
711da177e4SLinus Torvalds 
721da177e4SLinus Torvalds 	default:
731da177e4SLinus Torvalds 		return -EINVAL;
743ff50b79SStephen Hemminger 	}
751da177e4SLinus Torvalds 
761da177e4SLinus Torvalds 	algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
771da177e4SLinus Torvalds 	return 0;
781da177e4SLinus Torvalds }
791da177e4SLinus Torvalds 
801da177e4SLinus Torvalds static int verify_encap_tmpl(struct rtattr **xfrma)
811da177e4SLinus Torvalds {
821da177e4SLinus Torvalds 	struct rtattr *rt = xfrma[XFRMA_ENCAP - 1];
831da177e4SLinus Torvalds 	struct xfrm_encap_tmpl *encap;
841da177e4SLinus Torvalds 
851da177e4SLinus Torvalds 	if (!rt)
861da177e4SLinus Torvalds 		return 0;
871da177e4SLinus Torvalds 
881da177e4SLinus Torvalds 	if ((rt->rta_len - sizeof(*rt)) < sizeof(*encap))
891da177e4SLinus Torvalds 		return -EINVAL;
901da177e4SLinus Torvalds 
911da177e4SLinus Torvalds 	return 0;
921da177e4SLinus Torvalds }
931da177e4SLinus Torvalds 
94eb2971b6SMasahide NAKAMURA static int verify_one_addr(struct rtattr **xfrma, enum xfrm_attr_type_t type,
95eb2971b6SMasahide NAKAMURA 			   xfrm_address_t **addrp)
96eb2971b6SMasahide NAKAMURA {
97eb2971b6SMasahide NAKAMURA 	struct rtattr *rt = xfrma[type - 1];
98eb2971b6SMasahide NAKAMURA 
99eb2971b6SMasahide NAKAMURA 	if (!rt)
100eb2971b6SMasahide NAKAMURA 		return 0;
101eb2971b6SMasahide NAKAMURA 
102eb2971b6SMasahide NAKAMURA 	if ((rt->rta_len - sizeof(*rt)) < sizeof(**addrp))
103eb2971b6SMasahide NAKAMURA 		return -EINVAL;
104eb2971b6SMasahide NAKAMURA 
105eb2971b6SMasahide NAKAMURA 	if (addrp)
106eb2971b6SMasahide NAKAMURA 		*addrp = RTA_DATA(rt);
107eb2971b6SMasahide NAKAMURA 
108eb2971b6SMasahide NAKAMURA 	return 0;
109eb2971b6SMasahide NAKAMURA }
110df71837dSTrent Jaeger 
111df71837dSTrent Jaeger static inline int verify_sec_ctx_len(struct rtattr **xfrma)
112df71837dSTrent Jaeger {
113df71837dSTrent Jaeger 	struct rtattr *rt = xfrma[XFRMA_SEC_CTX - 1];
114df71837dSTrent Jaeger 	struct xfrm_user_sec_ctx *uctx;
115df71837dSTrent Jaeger 	int len = 0;
116df71837dSTrent Jaeger 
117df71837dSTrent Jaeger 	if (!rt)
118df71837dSTrent Jaeger 		return 0;
119df71837dSTrent Jaeger 
120df71837dSTrent Jaeger 	if (rt->rta_len < sizeof(*uctx))
121df71837dSTrent Jaeger 		return -EINVAL;
122df71837dSTrent Jaeger 
123df71837dSTrent Jaeger 	uctx = RTA_DATA(rt);
124df71837dSTrent Jaeger 
125df71837dSTrent Jaeger 	len += sizeof(struct xfrm_user_sec_ctx);
126df71837dSTrent Jaeger 	len += uctx->ctx_len;
127df71837dSTrent Jaeger 
128df71837dSTrent Jaeger 	if (uctx->len != len)
129df71837dSTrent Jaeger 		return -EINVAL;
130df71837dSTrent Jaeger 
131df71837dSTrent Jaeger 	return 0;
132df71837dSTrent Jaeger }
133df71837dSTrent Jaeger 
134df71837dSTrent Jaeger 
1351da177e4SLinus Torvalds static int verify_newsa_info(struct xfrm_usersa_info *p,
1361da177e4SLinus Torvalds 			     struct rtattr **xfrma)
1371da177e4SLinus Torvalds {
1381da177e4SLinus Torvalds 	int err;
1391da177e4SLinus Torvalds 
1401da177e4SLinus Torvalds 	err = -EINVAL;
1411da177e4SLinus Torvalds 	switch (p->family) {
1421da177e4SLinus Torvalds 	case AF_INET:
1431da177e4SLinus Torvalds 		break;
1441da177e4SLinus Torvalds 
1451da177e4SLinus Torvalds 	case AF_INET6:
1461da177e4SLinus Torvalds #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1471da177e4SLinus Torvalds 		break;
1481da177e4SLinus Torvalds #else
1491da177e4SLinus Torvalds 		err = -EAFNOSUPPORT;
1501da177e4SLinus Torvalds 		goto out;
1511da177e4SLinus Torvalds #endif
1521da177e4SLinus Torvalds 
1531da177e4SLinus Torvalds 	default:
1541da177e4SLinus Torvalds 		goto out;
1553ff50b79SStephen Hemminger 	}
1561da177e4SLinus Torvalds 
1571da177e4SLinus Torvalds 	err = -EINVAL;
1581da177e4SLinus Torvalds 	switch (p->id.proto) {
1591da177e4SLinus Torvalds 	case IPPROTO_AH:
1601da177e4SLinus Torvalds 		if (!xfrma[XFRMA_ALG_AUTH-1]	||
1611da177e4SLinus Torvalds 		    xfrma[XFRMA_ALG_CRYPT-1]	||
1621da177e4SLinus Torvalds 		    xfrma[XFRMA_ALG_COMP-1])
1631da177e4SLinus Torvalds 			goto out;
1641da177e4SLinus Torvalds 		break;
1651da177e4SLinus Torvalds 
1661da177e4SLinus Torvalds 	case IPPROTO_ESP:
1671da177e4SLinus Torvalds 		if ((!xfrma[XFRMA_ALG_AUTH-1] &&
1681da177e4SLinus Torvalds 		     !xfrma[XFRMA_ALG_CRYPT-1])	||
1691da177e4SLinus Torvalds 		    xfrma[XFRMA_ALG_COMP-1])
1701da177e4SLinus Torvalds 			goto out;
1711da177e4SLinus Torvalds 		break;
1721da177e4SLinus Torvalds 
1731da177e4SLinus Torvalds 	case IPPROTO_COMP:
1741da177e4SLinus Torvalds 		if (!xfrma[XFRMA_ALG_COMP-1]	||
1751da177e4SLinus Torvalds 		    xfrma[XFRMA_ALG_AUTH-1]	||
1761da177e4SLinus Torvalds 		    xfrma[XFRMA_ALG_CRYPT-1])
1771da177e4SLinus Torvalds 			goto out;
1781da177e4SLinus Torvalds 		break;
1791da177e4SLinus Torvalds 
180e23c7194SMasahide NAKAMURA #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
181e23c7194SMasahide NAKAMURA 	case IPPROTO_DSTOPTS:
182e23c7194SMasahide NAKAMURA 	case IPPROTO_ROUTING:
183e23c7194SMasahide NAKAMURA 		if (xfrma[XFRMA_ALG_COMP-1]	||
184e23c7194SMasahide NAKAMURA 		    xfrma[XFRMA_ALG_AUTH-1]	||
185e23c7194SMasahide NAKAMURA 		    xfrma[XFRMA_ALG_CRYPT-1]	||
186e23c7194SMasahide NAKAMURA 		    xfrma[XFRMA_ENCAP-1]	||
187e23c7194SMasahide NAKAMURA 		    xfrma[XFRMA_SEC_CTX-1]	||
188e23c7194SMasahide NAKAMURA 		    !xfrma[XFRMA_COADDR-1])
189e23c7194SMasahide NAKAMURA 			goto out;
190e23c7194SMasahide NAKAMURA 		break;
191e23c7194SMasahide NAKAMURA #endif
192e23c7194SMasahide NAKAMURA 
1931da177e4SLinus Torvalds 	default:
1941da177e4SLinus Torvalds 		goto out;
1953ff50b79SStephen Hemminger 	}
1961da177e4SLinus Torvalds 
1971da177e4SLinus Torvalds 	if ((err = verify_one_alg(xfrma, XFRMA_ALG_AUTH)))
1981da177e4SLinus Torvalds 		goto out;
1991da177e4SLinus Torvalds 	if ((err = verify_one_alg(xfrma, XFRMA_ALG_CRYPT)))
2001da177e4SLinus Torvalds 		goto out;
2011da177e4SLinus Torvalds 	if ((err = verify_one_alg(xfrma, XFRMA_ALG_COMP)))
2021da177e4SLinus Torvalds 		goto out;
2031da177e4SLinus Torvalds 	if ((err = verify_encap_tmpl(xfrma)))
2041da177e4SLinus Torvalds 		goto out;
205df71837dSTrent Jaeger 	if ((err = verify_sec_ctx_len(xfrma)))
206df71837dSTrent Jaeger 		goto out;
207060f02a3SNoriaki TAKAMIYA 	if ((err = verify_one_addr(xfrma, XFRMA_COADDR, NULL)))
208060f02a3SNoriaki TAKAMIYA 		goto out;
2091da177e4SLinus Torvalds 
2101da177e4SLinus Torvalds 	err = -EINVAL;
2111da177e4SLinus Torvalds 	switch (p->mode) {
2127e49e6deSMasahide NAKAMURA 	case XFRM_MODE_TRANSPORT:
2137e49e6deSMasahide NAKAMURA 	case XFRM_MODE_TUNNEL:
214060f02a3SNoriaki TAKAMIYA 	case XFRM_MODE_ROUTEOPTIMIZATION:
2150a69452cSDiego Beltrami 	case XFRM_MODE_BEET:
2161da177e4SLinus Torvalds 		break;
2171da177e4SLinus Torvalds 
2181da177e4SLinus Torvalds 	default:
2191da177e4SLinus Torvalds 		goto out;
2203ff50b79SStephen Hemminger 	}
2211da177e4SLinus Torvalds 
2221da177e4SLinus Torvalds 	err = 0;
2231da177e4SLinus Torvalds 
2241da177e4SLinus Torvalds out:
2251da177e4SLinus Torvalds 	return err;
2261da177e4SLinus Torvalds }
2271da177e4SLinus Torvalds 
2281da177e4SLinus Torvalds static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
2291da177e4SLinus Torvalds 			   struct xfrm_algo_desc *(*get_byname)(char *, int),
2301da177e4SLinus Torvalds 			   struct rtattr *u_arg)
2311da177e4SLinus Torvalds {
2321da177e4SLinus Torvalds 	struct rtattr *rta = u_arg;
2331da177e4SLinus Torvalds 	struct xfrm_algo *p, *ualg;
2341da177e4SLinus Torvalds 	struct xfrm_algo_desc *algo;
235b9e9deadSHerbert Xu 	int len;
2361da177e4SLinus Torvalds 
2371da177e4SLinus Torvalds 	if (!rta)
2381da177e4SLinus Torvalds 		return 0;
2391da177e4SLinus Torvalds 
2401da177e4SLinus Torvalds 	ualg = RTA_DATA(rta);
2411da177e4SLinus Torvalds 
2421da177e4SLinus Torvalds 	algo = get_byname(ualg->alg_name, 1);
2431da177e4SLinus Torvalds 	if (!algo)
2441da177e4SLinus Torvalds 		return -ENOSYS;
2451da177e4SLinus Torvalds 	*props = algo->desc.sadb_alg_id;
2461da177e4SLinus Torvalds 
247b9e9deadSHerbert Xu 	len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8;
248cdbc6daeSArnaldo Carvalho de Melo 	p = kmemdup(ualg, len, GFP_KERNEL);
2491da177e4SLinus Torvalds 	if (!p)
2501da177e4SLinus Torvalds 		return -ENOMEM;
2511da177e4SLinus Torvalds 
25204ff1260SHerbert Xu 	strcpy(p->alg_name, algo->name);
2531da177e4SLinus Torvalds 	*algpp = p;
2541da177e4SLinus Torvalds 	return 0;
2551da177e4SLinus Torvalds }
2561da177e4SLinus Torvalds 
2571da177e4SLinus Torvalds static int attach_encap_tmpl(struct xfrm_encap_tmpl **encapp, struct rtattr *u_arg)
2581da177e4SLinus Torvalds {
2591da177e4SLinus Torvalds 	struct rtattr *rta = u_arg;
2601da177e4SLinus Torvalds 	struct xfrm_encap_tmpl *p, *uencap;
2611da177e4SLinus Torvalds 
2621da177e4SLinus Torvalds 	if (!rta)
2631da177e4SLinus Torvalds 		return 0;
2641da177e4SLinus Torvalds 
2651da177e4SLinus Torvalds 	uencap = RTA_DATA(rta);
266cdbc6daeSArnaldo Carvalho de Melo 	p = kmemdup(uencap, sizeof(*p), GFP_KERNEL);
2671da177e4SLinus Torvalds 	if (!p)
2681da177e4SLinus Torvalds 		return -ENOMEM;
2691da177e4SLinus Torvalds 
2701da177e4SLinus Torvalds 	*encapp = p;
2711da177e4SLinus Torvalds 	return 0;
2721da177e4SLinus Torvalds }
2731da177e4SLinus Torvalds 
274df71837dSTrent Jaeger 
275661697f7SJoy Latten static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
276df71837dSTrent Jaeger {
277df71837dSTrent Jaeger 	int len = 0;
278df71837dSTrent Jaeger 
279df71837dSTrent Jaeger 	if (xfrm_ctx) {
280df71837dSTrent Jaeger 		len += sizeof(struct xfrm_user_sec_ctx);
281df71837dSTrent Jaeger 		len += xfrm_ctx->ctx_len;
282df71837dSTrent Jaeger 	}
283df71837dSTrent Jaeger 	return len;
284df71837dSTrent Jaeger }
285df71837dSTrent Jaeger 
286df71837dSTrent Jaeger static int attach_sec_ctx(struct xfrm_state *x, struct rtattr *u_arg)
287df71837dSTrent Jaeger {
288df71837dSTrent Jaeger 	struct xfrm_user_sec_ctx *uctx;
289df71837dSTrent Jaeger 
290df71837dSTrent Jaeger 	if (!u_arg)
291df71837dSTrent Jaeger 		return 0;
292df71837dSTrent Jaeger 
293df71837dSTrent Jaeger 	uctx = RTA_DATA(u_arg);
294df71837dSTrent Jaeger 	return security_xfrm_state_alloc(x, uctx);
295df71837dSTrent Jaeger }
296df71837dSTrent Jaeger 
297060f02a3SNoriaki TAKAMIYA static int attach_one_addr(xfrm_address_t **addrpp, struct rtattr *u_arg)
298060f02a3SNoriaki TAKAMIYA {
299060f02a3SNoriaki TAKAMIYA 	struct rtattr *rta = u_arg;
300060f02a3SNoriaki TAKAMIYA 	xfrm_address_t *p, *uaddrp;
301060f02a3SNoriaki TAKAMIYA 
302060f02a3SNoriaki TAKAMIYA 	if (!rta)
303060f02a3SNoriaki TAKAMIYA 		return 0;
304060f02a3SNoriaki TAKAMIYA 
305060f02a3SNoriaki TAKAMIYA 	uaddrp = RTA_DATA(rta);
306cdbc6daeSArnaldo Carvalho de Melo 	p = kmemdup(uaddrp, sizeof(*p), GFP_KERNEL);
307060f02a3SNoriaki TAKAMIYA 	if (!p)
308060f02a3SNoriaki TAKAMIYA 		return -ENOMEM;
309060f02a3SNoriaki TAKAMIYA 
310060f02a3SNoriaki TAKAMIYA 	*addrpp = p;
311060f02a3SNoriaki TAKAMIYA 	return 0;
312060f02a3SNoriaki TAKAMIYA }
313060f02a3SNoriaki TAKAMIYA 
3141da177e4SLinus Torvalds static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
3151da177e4SLinus Torvalds {
3161da177e4SLinus Torvalds 	memcpy(&x->id, &p->id, sizeof(x->id));
3171da177e4SLinus Torvalds 	memcpy(&x->sel, &p->sel, sizeof(x->sel));
3181da177e4SLinus Torvalds 	memcpy(&x->lft, &p->lft, sizeof(x->lft));
3191da177e4SLinus Torvalds 	x->props.mode = p->mode;
3201da177e4SLinus Torvalds 	x->props.replay_window = p->replay_window;
3211da177e4SLinus Torvalds 	x->props.reqid = p->reqid;
3221da177e4SLinus Torvalds 	x->props.family = p->family;
32354489c14SDavid S. Miller 	memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
3241da177e4SLinus Torvalds 	x->props.flags = p->flags;
325196b0036SHerbert Xu 
326196b0036SHerbert Xu 	/*
327196b0036SHerbert Xu 	 * Set inner address family if the KM left it as zero.
328196b0036SHerbert Xu 	 * See comment in validate_tmpl.
329196b0036SHerbert Xu 	 */
330196b0036SHerbert Xu 	if (!x->sel.family)
331196b0036SHerbert Xu 		x->sel.family = p->family;
3321da177e4SLinus Torvalds }
3331da177e4SLinus Torvalds 
334d51d081dSJamal Hadi Salim /*
335d51d081dSJamal Hadi Salim  * someday when pfkey also has support, we could have the code
336d51d081dSJamal Hadi Salim  * somehow made shareable and move it to xfrm_state.c - JHS
337d51d081dSJamal Hadi Salim  *
338d51d081dSJamal Hadi Salim */
339d51d081dSJamal Hadi Salim static int xfrm_update_ae_params(struct xfrm_state *x, struct rtattr **xfrma)
340d51d081dSJamal Hadi Salim {
341d51d081dSJamal Hadi Salim 	int err = - EINVAL;
342d51d081dSJamal Hadi Salim 	struct rtattr *rp = xfrma[XFRMA_REPLAY_VAL-1];
343d51d081dSJamal Hadi Salim 	struct rtattr *lt = xfrma[XFRMA_LTIME_VAL-1];
344d51d081dSJamal Hadi Salim 	struct rtattr *et = xfrma[XFRMA_ETIMER_THRESH-1];
345d51d081dSJamal Hadi Salim 	struct rtattr *rt = xfrma[XFRMA_REPLAY_THRESH-1];
346d51d081dSJamal Hadi Salim 
347d51d081dSJamal Hadi Salim 	if (rp) {
348d51d081dSJamal Hadi Salim 		struct xfrm_replay_state *replay;
349d51d081dSJamal Hadi Salim 		if (RTA_PAYLOAD(rp) < sizeof(*replay))
350d51d081dSJamal Hadi Salim 			goto error;
351d51d081dSJamal Hadi Salim 		replay = RTA_DATA(rp);
352d51d081dSJamal Hadi Salim 		memcpy(&x->replay, replay, sizeof(*replay));
353d51d081dSJamal Hadi Salim 		memcpy(&x->preplay, replay, sizeof(*replay));
354d51d081dSJamal Hadi Salim 	}
355d51d081dSJamal Hadi Salim 
356d51d081dSJamal Hadi Salim 	if (lt) {
357d51d081dSJamal Hadi Salim 		struct xfrm_lifetime_cur *ltime;
358d51d081dSJamal Hadi Salim 		if (RTA_PAYLOAD(lt) < sizeof(*ltime))
359d51d081dSJamal Hadi Salim 			goto error;
360d51d081dSJamal Hadi Salim 		ltime = RTA_DATA(lt);
361d51d081dSJamal Hadi Salim 		x->curlft.bytes = ltime->bytes;
362d51d081dSJamal Hadi Salim 		x->curlft.packets = ltime->packets;
363d51d081dSJamal Hadi Salim 		x->curlft.add_time = ltime->add_time;
364d51d081dSJamal Hadi Salim 		x->curlft.use_time = ltime->use_time;
365d51d081dSJamal Hadi Salim 	}
366d51d081dSJamal Hadi Salim 
367d51d081dSJamal Hadi Salim 	if (et) {
368d51d081dSJamal Hadi Salim 		if (RTA_PAYLOAD(et) < sizeof(u32))
369d51d081dSJamal Hadi Salim 			goto error;
370d51d081dSJamal Hadi Salim 		x->replay_maxage = *(u32*)RTA_DATA(et);
371d51d081dSJamal Hadi Salim 	}
372d51d081dSJamal Hadi Salim 
373d51d081dSJamal Hadi Salim 	if (rt) {
374d51d081dSJamal Hadi Salim 		if (RTA_PAYLOAD(rt) < sizeof(u32))
375d51d081dSJamal Hadi Salim 			goto error;
376d51d081dSJamal Hadi Salim 		x->replay_maxdiff = *(u32*)RTA_DATA(rt);
377d51d081dSJamal Hadi Salim 	}
378d51d081dSJamal Hadi Salim 
379d51d081dSJamal Hadi Salim 	return 0;
380d51d081dSJamal Hadi Salim error:
381d51d081dSJamal Hadi Salim 	return err;
382d51d081dSJamal Hadi Salim }
383d51d081dSJamal Hadi Salim 
3841da177e4SLinus Torvalds static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
3851da177e4SLinus Torvalds 					       struct rtattr **xfrma,
3861da177e4SLinus Torvalds 					       int *errp)
3871da177e4SLinus Torvalds {
3881da177e4SLinus Torvalds 	struct xfrm_state *x = xfrm_state_alloc();
3891da177e4SLinus Torvalds 	int err = -ENOMEM;
3901da177e4SLinus Torvalds 
3911da177e4SLinus Torvalds 	if (!x)
3921da177e4SLinus Torvalds 		goto error_no_put;
3931da177e4SLinus Torvalds 
3941da177e4SLinus Torvalds 	copy_from_user_state(x, p);
3951da177e4SLinus Torvalds 
3961da177e4SLinus Torvalds 	if ((err = attach_one_algo(&x->aalg, &x->props.aalgo,
3971da177e4SLinus Torvalds 				   xfrm_aalg_get_byname,
3981da177e4SLinus Torvalds 				   xfrma[XFRMA_ALG_AUTH-1])))
3991da177e4SLinus Torvalds 		goto error;
4001da177e4SLinus Torvalds 	if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
4011da177e4SLinus Torvalds 				   xfrm_ealg_get_byname,
4021da177e4SLinus Torvalds 				   xfrma[XFRMA_ALG_CRYPT-1])))
4031da177e4SLinus Torvalds 		goto error;
4041da177e4SLinus Torvalds 	if ((err = attach_one_algo(&x->calg, &x->props.calgo,
4051da177e4SLinus Torvalds 				   xfrm_calg_get_byname,
4061da177e4SLinus Torvalds 				   xfrma[XFRMA_ALG_COMP-1])))
4071da177e4SLinus Torvalds 		goto error;
4081da177e4SLinus Torvalds 	if ((err = attach_encap_tmpl(&x->encap, xfrma[XFRMA_ENCAP-1])))
4091da177e4SLinus Torvalds 		goto error;
410060f02a3SNoriaki TAKAMIYA 	if ((err = attach_one_addr(&x->coaddr, xfrma[XFRMA_COADDR-1])))
411060f02a3SNoriaki TAKAMIYA 		goto error;
41272cb6962SHerbert Xu 	err = xfrm_init_state(x);
4131da177e4SLinus Torvalds 	if (err)
4141da177e4SLinus Torvalds 		goto error;
4151da177e4SLinus Torvalds 
416df71837dSTrent Jaeger 	if ((err = attach_sec_ctx(x, xfrma[XFRMA_SEC_CTX-1])))
417df71837dSTrent Jaeger 		goto error;
418df71837dSTrent Jaeger 
4191da177e4SLinus Torvalds 	x->km.seq = p->seq;
420d51d081dSJamal Hadi Salim 	x->replay_maxdiff = sysctl_xfrm_aevent_rseqth;
421d51d081dSJamal Hadi Salim 	/* sysctl_xfrm_aevent_etime is in 100ms units */
422d51d081dSJamal Hadi Salim 	x->replay_maxage = (sysctl_xfrm_aevent_etime*HZ)/XFRM_AE_ETH_M;
423d51d081dSJamal Hadi Salim 	x->preplay.bitmap = 0;
424d51d081dSJamal Hadi Salim 	x->preplay.seq = x->replay.seq+x->replay_maxdiff;
425d51d081dSJamal Hadi Salim 	x->preplay.oseq = x->replay.oseq +x->replay_maxdiff;
426d51d081dSJamal Hadi Salim 
427d51d081dSJamal Hadi Salim 	/* override default values from above */
428d51d081dSJamal Hadi Salim 
429d51d081dSJamal Hadi Salim 	err = xfrm_update_ae_params(x, (struct rtattr **)xfrma);
430d51d081dSJamal Hadi Salim 	if (err	< 0)
431d51d081dSJamal Hadi Salim 		goto error;
4321da177e4SLinus Torvalds 
4331da177e4SLinus Torvalds 	return x;
4341da177e4SLinus Torvalds 
4351da177e4SLinus Torvalds error:
4361da177e4SLinus Torvalds 	x->km.state = XFRM_STATE_DEAD;
4371da177e4SLinus Torvalds 	xfrm_state_put(x);
4381da177e4SLinus Torvalds error_no_put:
4391da177e4SLinus Torvalds 	*errp = err;
4401da177e4SLinus Torvalds 	return NULL;
4411da177e4SLinus Torvalds }
4421da177e4SLinus Torvalds 
44322e70050SChristoph Hellwig static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
44422e70050SChristoph Hellwig 		struct rtattr **xfrma)
4451da177e4SLinus Torvalds {
446*7b67c857SThomas Graf 	struct xfrm_usersa_info *p = nlmsg_data(nlh);
4471da177e4SLinus Torvalds 	struct xfrm_state *x;
4481da177e4SLinus Torvalds 	int err;
44926b15dadSJamal Hadi Salim 	struct km_event c;
4501da177e4SLinus Torvalds 
45122e70050SChristoph Hellwig 	err = verify_newsa_info(p, xfrma);
4521da177e4SLinus Torvalds 	if (err)
4531da177e4SLinus Torvalds 		return err;
4541da177e4SLinus Torvalds 
45522e70050SChristoph Hellwig 	x = xfrm_state_construct(p, xfrma, &err);
4561da177e4SLinus Torvalds 	if (!x)
4571da177e4SLinus Torvalds 		return err;
4581da177e4SLinus Torvalds 
45926b15dadSJamal Hadi Salim 	xfrm_state_hold(x);
4601da177e4SLinus Torvalds 	if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
4611da177e4SLinus Torvalds 		err = xfrm_state_add(x);
4621da177e4SLinus Torvalds 	else
4631da177e4SLinus Torvalds 		err = xfrm_state_update(x);
4641da177e4SLinus Torvalds 
465161a09e7SJoy Latten 	xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
466161a09e7SJoy Latten 		       AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
467161a09e7SJoy Latten 
4681da177e4SLinus Torvalds 	if (err < 0) {
4691da177e4SLinus Torvalds 		x->km.state = XFRM_STATE_DEAD;
47021380b81SHerbert Xu 		__xfrm_state_put(x);
4717d6dfe1fSPatrick McHardy 		goto out;
4721da177e4SLinus Torvalds 	}
4731da177e4SLinus Torvalds 
47426b15dadSJamal Hadi Salim 	c.seq = nlh->nlmsg_seq;
47526b15dadSJamal Hadi Salim 	c.pid = nlh->nlmsg_pid;
476f60f6b8fSHerbert Xu 	c.event = nlh->nlmsg_type;
47726b15dadSJamal Hadi Salim 
47826b15dadSJamal Hadi Salim 	km_state_notify(x, &c);
4797d6dfe1fSPatrick McHardy out:
48026b15dadSJamal Hadi Salim 	xfrm_state_put(x);
4811da177e4SLinus Torvalds 	return err;
4821da177e4SLinus Torvalds }
4831da177e4SLinus Torvalds 
484eb2971b6SMasahide NAKAMURA static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
485eb2971b6SMasahide NAKAMURA 						 struct rtattr **xfrma,
486eb2971b6SMasahide NAKAMURA 						 int *errp)
487eb2971b6SMasahide NAKAMURA {
488eb2971b6SMasahide NAKAMURA 	struct xfrm_state *x = NULL;
489eb2971b6SMasahide NAKAMURA 	int err;
490eb2971b6SMasahide NAKAMURA 
491eb2971b6SMasahide NAKAMURA 	if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
492eb2971b6SMasahide NAKAMURA 		err = -ESRCH;
493eb2971b6SMasahide NAKAMURA 		x = xfrm_state_lookup(&p->daddr, p->spi, p->proto, p->family);
494eb2971b6SMasahide NAKAMURA 	} else {
495eb2971b6SMasahide NAKAMURA 		xfrm_address_t *saddr = NULL;
496eb2971b6SMasahide NAKAMURA 
497eb2971b6SMasahide NAKAMURA 		err = verify_one_addr(xfrma, XFRMA_SRCADDR, &saddr);
498eb2971b6SMasahide NAKAMURA 		if (err)
499eb2971b6SMasahide NAKAMURA 			goto out;
500eb2971b6SMasahide NAKAMURA 
501eb2971b6SMasahide NAKAMURA 		if (!saddr) {
502eb2971b6SMasahide NAKAMURA 			err = -EINVAL;
503eb2971b6SMasahide NAKAMURA 			goto out;
504eb2971b6SMasahide NAKAMURA 		}
505eb2971b6SMasahide NAKAMURA 
5069abbffeeSMasahide NAKAMURA 		err = -ESRCH;
507eb2971b6SMasahide NAKAMURA 		x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto,
508eb2971b6SMasahide NAKAMURA 					     p->family);
509eb2971b6SMasahide NAKAMURA 	}
510eb2971b6SMasahide NAKAMURA 
511eb2971b6SMasahide NAKAMURA  out:
512eb2971b6SMasahide NAKAMURA 	if (!x && errp)
513eb2971b6SMasahide NAKAMURA 		*errp = err;
514eb2971b6SMasahide NAKAMURA 	return x;
515eb2971b6SMasahide NAKAMURA }
516eb2971b6SMasahide NAKAMURA 
51722e70050SChristoph Hellwig static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
51822e70050SChristoph Hellwig 		struct rtattr **xfrma)
5191da177e4SLinus Torvalds {
5201da177e4SLinus Torvalds 	struct xfrm_state *x;
521eb2971b6SMasahide NAKAMURA 	int err = -ESRCH;
52226b15dadSJamal Hadi Salim 	struct km_event c;
523*7b67c857SThomas Graf 	struct xfrm_usersa_id *p = nlmsg_data(nlh);
5241da177e4SLinus Torvalds 
52522e70050SChristoph Hellwig 	x = xfrm_user_state_lookup(p, xfrma, &err);
5261da177e4SLinus Torvalds 	if (x == NULL)
527eb2971b6SMasahide NAKAMURA 		return err;
5281da177e4SLinus Torvalds 
5296f68dc37SDavid S. Miller 	if ((err = security_xfrm_state_delete(x)) != 0)
530c8c05a8eSCatherine Zhang 		goto out;
531c8c05a8eSCatherine Zhang 
5321da177e4SLinus Torvalds 	if (xfrm_state_kern(x)) {
533c8c05a8eSCatherine Zhang 		err = -EPERM;
534c8c05a8eSCatherine Zhang 		goto out;
5351da177e4SLinus Torvalds 	}
5361da177e4SLinus Torvalds 
53726b15dadSJamal Hadi Salim 	err = xfrm_state_delete(x);
538161a09e7SJoy Latten 
539c8c05a8eSCatherine Zhang 	if (err < 0)
540c8c05a8eSCatherine Zhang 		goto out;
54126b15dadSJamal Hadi Salim 
54226b15dadSJamal Hadi Salim 	c.seq = nlh->nlmsg_seq;
54326b15dadSJamal Hadi Salim 	c.pid = nlh->nlmsg_pid;
544f60f6b8fSHerbert Xu 	c.event = nlh->nlmsg_type;
54526b15dadSJamal Hadi Salim 	km_state_notify(x, &c);
5461da177e4SLinus Torvalds 
547c8c05a8eSCatherine Zhang out:
54816bec31dSEric Paris 	xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
54916bec31dSEric Paris 		       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
550c8c05a8eSCatherine Zhang 	xfrm_state_put(x);
55126b15dadSJamal Hadi Salim 	return err;
5521da177e4SLinus Torvalds }
5531da177e4SLinus Torvalds 
5541da177e4SLinus Torvalds static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
5551da177e4SLinus Torvalds {
5561da177e4SLinus Torvalds 	memcpy(&p->id, &x->id, sizeof(p->id));
5571da177e4SLinus Torvalds 	memcpy(&p->sel, &x->sel, sizeof(p->sel));
5581da177e4SLinus Torvalds 	memcpy(&p->lft, &x->lft, sizeof(p->lft));
5591da177e4SLinus Torvalds 	memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
5601da177e4SLinus Torvalds 	memcpy(&p->stats, &x->stats, sizeof(p->stats));
56154489c14SDavid S. Miller 	memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
5621da177e4SLinus Torvalds 	p->mode = x->props.mode;
5631da177e4SLinus Torvalds 	p->replay_window = x->props.replay_window;
5641da177e4SLinus Torvalds 	p->reqid = x->props.reqid;
5651da177e4SLinus Torvalds 	p->family = x->props.family;
5661da177e4SLinus Torvalds 	p->flags = x->props.flags;
5671da177e4SLinus Torvalds 	p->seq = x->km.seq;
5681da177e4SLinus Torvalds }
5691da177e4SLinus Torvalds 
5701da177e4SLinus Torvalds struct xfrm_dump_info {
5711da177e4SLinus Torvalds 	struct sk_buff *in_skb;
5721da177e4SLinus Torvalds 	struct sk_buff *out_skb;
5731da177e4SLinus Torvalds 	u32 nlmsg_seq;
5741da177e4SLinus Torvalds 	u16 nlmsg_flags;
5751da177e4SLinus Torvalds 	int start_idx;
5761da177e4SLinus Torvalds 	int this_idx;
5771da177e4SLinus Torvalds };
5781da177e4SLinus Torvalds 
5791da177e4SLinus Torvalds static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
5801da177e4SLinus Torvalds {
5811da177e4SLinus Torvalds 	struct xfrm_dump_info *sp = ptr;
5821da177e4SLinus Torvalds 	struct sk_buff *in_skb = sp->in_skb;
5831da177e4SLinus Torvalds 	struct sk_buff *skb = sp->out_skb;
5841da177e4SLinus Torvalds 	struct xfrm_usersa_info *p;
5851da177e4SLinus Torvalds 	struct nlmsghdr *nlh;
5861da177e4SLinus Torvalds 
5871da177e4SLinus Torvalds 	if (sp->this_idx < sp->start_idx)
5881da177e4SLinus Torvalds 		goto out;
5891da177e4SLinus Torvalds 
59079b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
59179b8b7f4SThomas Graf 			XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
59279b8b7f4SThomas Graf 	if (nlh == NULL)
59379b8b7f4SThomas Graf 		return -EMSGSIZE;
5941da177e4SLinus Torvalds 
595*7b67c857SThomas Graf 	p = nlmsg_data(nlh);
5961da177e4SLinus Torvalds 	copy_to_user_state(x, p);
5971da177e4SLinus Torvalds 
5981da177e4SLinus Torvalds 	if (x->aalg)
5991da177e4SLinus Torvalds 		RTA_PUT(skb, XFRMA_ALG_AUTH,
6001da177e4SLinus Torvalds 			sizeof(*(x->aalg))+(x->aalg->alg_key_len+7)/8, x->aalg);
6011da177e4SLinus Torvalds 	if (x->ealg)
6021da177e4SLinus Torvalds 		RTA_PUT(skb, XFRMA_ALG_CRYPT,
6031da177e4SLinus Torvalds 			sizeof(*(x->ealg))+(x->ealg->alg_key_len+7)/8, x->ealg);
6041da177e4SLinus Torvalds 	if (x->calg)
6051da177e4SLinus Torvalds 		RTA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
6061da177e4SLinus Torvalds 
6071da177e4SLinus Torvalds 	if (x->encap)
6081da177e4SLinus Torvalds 		RTA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
6091da177e4SLinus Torvalds 
610df71837dSTrent Jaeger 	if (x->security) {
611df71837dSTrent Jaeger 		int ctx_size = sizeof(struct xfrm_sec_ctx) +
612df71837dSTrent Jaeger 				x->security->ctx_len;
613df71837dSTrent Jaeger 		struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
614df71837dSTrent Jaeger 		struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
615df71837dSTrent Jaeger 
616df71837dSTrent Jaeger 		uctx->exttype = XFRMA_SEC_CTX;
617df71837dSTrent Jaeger 		uctx->len = ctx_size;
618df71837dSTrent Jaeger 		uctx->ctx_doi = x->security->ctx_doi;
619df71837dSTrent Jaeger 		uctx->ctx_alg = x->security->ctx_alg;
620df71837dSTrent Jaeger 		uctx->ctx_len = x->security->ctx_len;
621df71837dSTrent Jaeger 		memcpy(uctx + 1, x->security->ctx_str, x->security->ctx_len);
622df71837dSTrent Jaeger 	}
623060f02a3SNoriaki TAKAMIYA 
624060f02a3SNoriaki TAKAMIYA 	if (x->coaddr)
625060f02a3SNoriaki TAKAMIYA 		RTA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
626060f02a3SNoriaki TAKAMIYA 
6279afaca05SMasahide NAKAMURA 	if (x->lastused)
6289afaca05SMasahide NAKAMURA 		RTA_PUT(skb, XFRMA_LASTUSED, sizeof(x->lastused), &x->lastused);
6299afaca05SMasahide NAKAMURA 
6309825069dSThomas Graf 	nlmsg_end(skb, nlh);
6311da177e4SLinus Torvalds out:
6321da177e4SLinus Torvalds 	sp->this_idx++;
6331da177e4SLinus Torvalds 	return 0;
6341da177e4SLinus Torvalds 
6351da177e4SLinus Torvalds rtattr_failure:
6369825069dSThomas Graf 	nlmsg_cancel(skb, nlh);
6379825069dSThomas Graf 	return -EMSGSIZE;
6381da177e4SLinus Torvalds }
6391da177e4SLinus Torvalds 
6401da177e4SLinus Torvalds static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
6411da177e4SLinus Torvalds {
6421da177e4SLinus Torvalds 	struct xfrm_dump_info info;
6431da177e4SLinus Torvalds 
6441da177e4SLinus Torvalds 	info.in_skb = cb->skb;
6451da177e4SLinus Torvalds 	info.out_skb = skb;
6461da177e4SLinus Torvalds 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
6471da177e4SLinus Torvalds 	info.nlmsg_flags = NLM_F_MULTI;
6481da177e4SLinus Torvalds 	info.this_idx = 0;
6491da177e4SLinus Torvalds 	info.start_idx = cb->args[0];
650dc00a525SMasahide NAKAMURA 	(void) xfrm_state_walk(0, dump_one_state, &info);
6511da177e4SLinus Torvalds 	cb->args[0] = info.this_idx;
6521da177e4SLinus Torvalds 
6531da177e4SLinus Torvalds 	return skb->len;
6541da177e4SLinus Torvalds }
6551da177e4SLinus Torvalds 
6561da177e4SLinus Torvalds static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
6571da177e4SLinus Torvalds 					  struct xfrm_state *x, u32 seq)
6581da177e4SLinus Torvalds {
6591da177e4SLinus Torvalds 	struct xfrm_dump_info info;
6601da177e4SLinus Torvalds 	struct sk_buff *skb;
6611da177e4SLinus Torvalds 
6621da177e4SLinus Torvalds 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
6631da177e4SLinus Torvalds 	if (!skb)
6641da177e4SLinus Torvalds 		return ERR_PTR(-ENOMEM);
6651da177e4SLinus Torvalds 
6661da177e4SLinus Torvalds 	info.in_skb = in_skb;
6671da177e4SLinus Torvalds 	info.out_skb = skb;
6681da177e4SLinus Torvalds 	info.nlmsg_seq = seq;
6691da177e4SLinus Torvalds 	info.nlmsg_flags = 0;
6701da177e4SLinus Torvalds 	info.this_idx = info.start_idx = 0;
6711da177e4SLinus Torvalds 
6721da177e4SLinus Torvalds 	if (dump_one_state(x, 0, &info)) {
6731da177e4SLinus Torvalds 		kfree_skb(skb);
6741da177e4SLinus Torvalds 		return NULL;
6751da177e4SLinus Torvalds 	}
6761da177e4SLinus Torvalds 
6771da177e4SLinus Torvalds 	return skb;
6781da177e4SLinus Torvalds }
6791da177e4SLinus Torvalds 
680ecfd6b18SJamal Hadi Salim static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
681ecfd6b18SJamal Hadi Salim {
6825a6d3416SJamal Hadi Salim 	struct xfrmk_spdinfo si;
6835a6d3416SJamal Hadi Salim 	struct xfrmu_spdinfo spc;
6845a6d3416SJamal Hadi Salim 	struct xfrmu_spdhinfo sph;
685ecfd6b18SJamal Hadi Salim 	struct nlmsghdr *nlh;
686ecfd6b18SJamal Hadi Salim 	u32 *f;
687ecfd6b18SJamal Hadi Salim 
688ecfd6b18SJamal Hadi Salim 	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
689ecfd6b18SJamal Hadi Salim 	if (nlh == NULL) /* shouldnt really happen ... */
690ecfd6b18SJamal Hadi Salim 		return -EMSGSIZE;
691ecfd6b18SJamal Hadi Salim 
692ecfd6b18SJamal Hadi Salim 	f = nlmsg_data(nlh);
693ecfd6b18SJamal Hadi Salim 	*f = flags;
694ecfd6b18SJamal Hadi Salim 	xfrm_spd_getinfo(&si);
6955a6d3416SJamal Hadi Salim 	spc.incnt = si.incnt;
6965a6d3416SJamal Hadi Salim 	spc.outcnt = si.outcnt;
6975a6d3416SJamal Hadi Salim 	spc.fwdcnt = si.fwdcnt;
6985a6d3416SJamal Hadi Salim 	spc.inscnt = si.inscnt;
6995a6d3416SJamal Hadi Salim 	spc.outscnt = si.outscnt;
7005a6d3416SJamal Hadi Salim 	spc.fwdscnt = si.fwdscnt;
7015a6d3416SJamal Hadi Salim 	sph.spdhcnt = si.spdhcnt;
7025a6d3416SJamal Hadi Salim 	sph.spdhmcnt = si.spdhmcnt;
703ecfd6b18SJamal Hadi Salim 
7045a6d3416SJamal Hadi Salim 	NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
7055a6d3416SJamal Hadi Salim 	NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
706ecfd6b18SJamal Hadi Salim 
707ecfd6b18SJamal Hadi Salim 	return nlmsg_end(skb, nlh);
708ecfd6b18SJamal Hadi Salim 
709ecfd6b18SJamal Hadi Salim nla_put_failure:
710ecfd6b18SJamal Hadi Salim 	nlmsg_cancel(skb, nlh);
711ecfd6b18SJamal Hadi Salim 	return -EMSGSIZE;
712ecfd6b18SJamal Hadi Salim }
713ecfd6b18SJamal Hadi Salim 
714ecfd6b18SJamal Hadi Salim static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
715ecfd6b18SJamal Hadi Salim 		struct rtattr **xfrma)
716ecfd6b18SJamal Hadi Salim {
717ecfd6b18SJamal Hadi Salim 	struct sk_buff *r_skb;
718*7b67c857SThomas Graf 	u32 *flags = nlmsg_data(nlh);
719ecfd6b18SJamal Hadi Salim 	u32 spid = NETLINK_CB(skb).pid;
720ecfd6b18SJamal Hadi Salim 	u32 seq = nlh->nlmsg_seq;
721ecfd6b18SJamal Hadi Salim 	int len = NLMSG_LENGTH(sizeof(u32));
722ecfd6b18SJamal Hadi Salim 
7235a6d3416SJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrmu_spdinfo));
7245a6d3416SJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrmu_spdhinfo));
725ecfd6b18SJamal Hadi Salim 
726ecfd6b18SJamal Hadi Salim 	r_skb = alloc_skb(len, GFP_ATOMIC);
727ecfd6b18SJamal Hadi Salim 	if (r_skb == NULL)
728ecfd6b18SJamal Hadi Salim 		return -ENOMEM;
729ecfd6b18SJamal Hadi Salim 
730ecfd6b18SJamal Hadi Salim 	if (build_spdinfo(r_skb, spid, seq, *flags) < 0)
731ecfd6b18SJamal Hadi Salim 		BUG();
732ecfd6b18SJamal Hadi Salim 
733ecfd6b18SJamal Hadi Salim 	return nlmsg_unicast(xfrm_nl, r_skb, spid);
734ecfd6b18SJamal Hadi Salim }
735ecfd6b18SJamal Hadi Salim 
73628d8909bSJamal Hadi Salim static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
73728d8909bSJamal Hadi Salim {
738af11e316SJamal Hadi Salim 	struct xfrmk_sadinfo si;
739af11e316SJamal Hadi Salim 	struct xfrmu_sadhinfo sh;
74028d8909bSJamal Hadi Salim 	struct nlmsghdr *nlh;
74128d8909bSJamal Hadi Salim 	u32 *f;
74228d8909bSJamal Hadi Salim 
74328d8909bSJamal Hadi Salim 	nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
74428d8909bSJamal Hadi Salim 	if (nlh == NULL) /* shouldnt really happen ... */
74528d8909bSJamal Hadi Salim 		return -EMSGSIZE;
74628d8909bSJamal Hadi Salim 
74728d8909bSJamal Hadi Salim 	f = nlmsg_data(nlh);
74828d8909bSJamal Hadi Salim 	*f = flags;
74928d8909bSJamal Hadi Salim 	xfrm_sad_getinfo(&si);
75028d8909bSJamal Hadi Salim 
751af11e316SJamal Hadi Salim 	sh.sadhmcnt = si.sadhmcnt;
752af11e316SJamal Hadi Salim 	sh.sadhcnt = si.sadhcnt;
753af11e316SJamal Hadi Salim 
754af11e316SJamal Hadi Salim 	NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
755af11e316SJamal Hadi Salim 	NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
75628d8909bSJamal Hadi Salim 
75728d8909bSJamal Hadi Salim 	return nlmsg_end(skb, nlh);
75828d8909bSJamal Hadi Salim 
75928d8909bSJamal Hadi Salim nla_put_failure:
76028d8909bSJamal Hadi Salim 	nlmsg_cancel(skb, nlh);
76128d8909bSJamal Hadi Salim 	return -EMSGSIZE;
76228d8909bSJamal Hadi Salim }
76328d8909bSJamal Hadi Salim 
76428d8909bSJamal Hadi Salim static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
76528d8909bSJamal Hadi Salim 		struct rtattr **xfrma)
76628d8909bSJamal Hadi Salim {
76728d8909bSJamal Hadi Salim 	struct sk_buff *r_skb;
768*7b67c857SThomas Graf 	u32 *flags = nlmsg_data(nlh);
76928d8909bSJamal Hadi Salim 	u32 spid = NETLINK_CB(skb).pid;
77028d8909bSJamal Hadi Salim 	u32 seq = nlh->nlmsg_seq;
77128d8909bSJamal Hadi Salim 	int len = NLMSG_LENGTH(sizeof(u32));
77228d8909bSJamal Hadi Salim 
773af11e316SJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrmu_sadhinfo));
77428d8909bSJamal Hadi Salim 	len += RTA_SPACE(sizeof(u32));
77528d8909bSJamal Hadi Salim 
77628d8909bSJamal Hadi Salim 	r_skb = alloc_skb(len, GFP_ATOMIC);
77728d8909bSJamal Hadi Salim 
77828d8909bSJamal Hadi Salim 	if (r_skb == NULL)
77928d8909bSJamal Hadi Salim 		return -ENOMEM;
78028d8909bSJamal Hadi Salim 
78128d8909bSJamal Hadi Salim 	if (build_sadinfo(r_skb, spid, seq, *flags) < 0)
78228d8909bSJamal Hadi Salim 		BUG();
78328d8909bSJamal Hadi Salim 
78428d8909bSJamal Hadi Salim 	return nlmsg_unicast(xfrm_nl, r_skb, spid);
78528d8909bSJamal Hadi Salim }
78628d8909bSJamal Hadi Salim 
78722e70050SChristoph Hellwig static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
78822e70050SChristoph Hellwig 		struct rtattr **xfrma)
7891da177e4SLinus Torvalds {
790*7b67c857SThomas Graf 	struct xfrm_usersa_id *p = nlmsg_data(nlh);
7911da177e4SLinus Torvalds 	struct xfrm_state *x;
7921da177e4SLinus Torvalds 	struct sk_buff *resp_skb;
793eb2971b6SMasahide NAKAMURA 	int err = -ESRCH;
7941da177e4SLinus Torvalds 
79522e70050SChristoph Hellwig 	x = xfrm_user_state_lookup(p, xfrma, &err);
7961da177e4SLinus Torvalds 	if (x == NULL)
7971da177e4SLinus Torvalds 		goto out_noput;
7981da177e4SLinus Torvalds 
7991da177e4SLinus Torvalds 	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
8001da177e4SLinus Torvalds 	if (IS_ERR(resp_skb)) {
8011da177e4SLinus Torvalds 		err = PTR_ERR(resp_skb);
8021da177e4SLinus Torvalds 	} else {
8031da177e4SLinus Torvalds 		err = netlink_unicast(xfrm_nl, resp_skb,
8041da177e4SLinus Torvalds 				      NETLINK_CB(skb).pid, MSG_DONTWAIT);
8051da177e4SLinus Torvalds 	}
8061da177e4SLinus Torvalds 	xfrm_state_put(x);
8071da177e4SLinus Torvalds out_noput:
8081da177e4SLinus Torvalds 	return err;
8091da177e4SLinus Torvalds }
8101da177e4SLinus Torvalds 
8111da177e4SLinus Torvalds static int verify_userspi_info(struct xfrm_userspi_info *p)
8121da177e4SLinus Torvalds {
8131da177e4SLinus Torvalds 	switch (p->info.id.proto) {
8141da177e4SLinus Torvalds 	case IPPROTO_AH:
8151da177e4SLinus Torvalds 	case IPPROTO_ESP:
8161da177e4SLinus Torvalds 		break;
8171da177e4SLinus Torvalds 
8181da177e4SLinus Torvalds 	case IPPROTO_COMP:
8191da177e4SLinus Torvalds 		/* IPCOMP spi is 16-bits. */
8201da177e4SLinus Torvalds 		if (p->max >= 0x10000)
8211da177e4SLinus Torvalds 			return -EINVAL;
8221da177e4SLinus Torvalds 		break;
8231da177e4SLinus Torvalds 
8241da177e4SLinus Torvalds 	default:
8251da177e4SLinus Torvalds 		return -EINVAL;
8263ff50b79SStephen Hemminger 	}
8271da177e4SLinus Torvalds 
8281da177e4SLinus Torvalds 	if (p->min > p->max)
8291da177e4SLinus Torvalds 		return -EINVAL;
8301da177e4SLinus Torvalds 
8311da177e4SLinus Torvalds 	return 0;
8321da177e4SLinus Torvalds }
8331da177e4SLinus Torvalds 
83422e70050SChristoph Hellwig static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
83522e70050SChristoph Hellwig 		struct rtattr **xfrma)
8361da177e4SLinus Torvalds {
8371da177e4SLinus Torvalds 	struct xfrm_state *x;
8381da177e4SLinus Torvalds 	struct xfrm_userspi_info *p;
8391da177e4SLinus Torvalds 	struct sk_buff *resp_skb;
8401da177e4SLinus Torvalds 	xfrm_address_t *daddr;
8411da177e4SLinus Torvalds 	int family;
8421da177e4SLinus Torvalds 	int err;
8431da177e4SLinus Torvalds 
844*7b67c857SThomas Graf 	p = nlmsg_data(nlh);
8451da177e4SLinus Torvalds 	err = verify_userspi_info(p);
8461da177e4SLinus Torvalds 	if (err)
8471da177e4SLinus Torvalds 		goto out_noput;
8481da177e4SLinus Torvalds 
8491da177e4SLinus Torvalds 	family = p->info.family;
8501da177e4SLinus Torvalds 	daddr = &p->info.id.daddr;
8511da177e4SLinus Torvalds 
8521da177e4SLinus Torvalds 	x = NULL;
8531da177e4SLinus Torvalds 	if (p->info.seq) {
8541da177e4SLinus Torvalds 		x = xfrm_find_acq_byseq(p->info.seq);
8551da177e4SLinus Torvalds 		if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
8561da177e4SLinus Torvalds 			xfrm_state_put(x);
8571da177e4SLinus Torvalds 			x = NULL;
8581da177e4SLinus Torvalds 		}
8591da177e4SLinus Torvalds 	}
8601da177e4SLinus Torvalds 
8611da177e4SLinus Torvalds 	if (!x)
8621da177e4SLinus Torvalds 		x = xfrm_find_acq(p->info.mode, p->info.reqid,
8631da177e4SLinus Torvalds 				  p->info.id.proto, daddr,
8641da177e4SLinus Torvalds 				  &p->info.saddr, 1,
8651da177e4SLinus Torvalds 				  family);
8661da177e4SLinus Torvalds 	err = -ENOENT;
8671da177e4SLinus Torvalds 	if (x == NULL)
8681da177e4SLinus Torvalds 		goto out_noput;
8691da177e4SLinus Torvalds 
8701da177e4SLinus Torvalds 	resp_skb = ERR_PTR(-ENOENT);
8711da177e4SLinus Torvalds 
8721da177e4SLinus Torvalds 	spin_lock_bh(&x->lock);
8731da177e4SLinus Torvalds 	if (x->km.state != XFRM_STATE_DEAD) {
8741da177e4SLinus Torvalds 		xfrm_alloc_spi(x, htonl(p->min), htonl(p->max));
8751da177e4SLinus Torvalds 		if (x->id.spi)
8761da177e4SLinus Torvalds 			resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
8771da177e4SLinus Torvalds 	}
8781da177e4SLinus Torvalds 	spin_unlock_bh(&x->lock);
8791da177e4SLinus Torvalds 
8801da177e4SLinus Torvalds 	if (IS_ERR(resp_skb)) {
8811da177e4SLinus Torvalds 		err = PTR_ERR(resp_skb);
8821da177e4SLinus Torvalds 		goto out;
8831da177e4SLinus Torvalds 	}
8841da177e4SLinus Torvalds 
8851da177e4SLinus Torvalds 	err = netlink_unicast(xfrm_nl, resp_skb,
8861da177e4SLinus Torvalds 			      NETLINK_CB(skb).pid, MSG_DONTWAIT);
8871da177e4SLinus Torvalds 
8881da177e4SLinus Torvalds out:
8891da177e4SLinus Torvalds 	xfrm_state_put(x);
8901da177e4SLinus Torvalds out_noput:
8911da177e4SLinus Torvalds 	return err;
8921da177e4SLinus Torvalds }
8931da177e4SLinus Torvalds 
894b798a9edSJamal Hadi Salim static int verify_policy_dir(u8 dir)
8951da177e4SLinus Torvalds {
8961da177e4SLinus Torvalds 	switch (dir) {
8971da177e4SLinus Torvalds 	case XFRM_POLICY_IN:
8981da177e4SLinus Torvalds 	case XFRM_POLICY_OUT:
8991da177e4SLinus Torvalds 	case XFRM_POLICY_FWD:
9001da177e4SLinus Torvalds 		break;
9011da177e4SLinus Torvalds 
9021da177e4SLinus Torvalds 	default:
9031da177e4SLinus Torvalds 		return -EINVAL;
9043ff50b79SStephen Hemminger 	}
9051da177e4SLinus Torvalds 
9061da177e4SLinus Torvalds 	return 0;
9071da177e4SLinus Torvalds }
9081da177e4SLinus Torvalds 
909b798a9edSJamal Hadi Salim static int verify_policy_type(u8 type)
910f7b6983fSMasahide NAKAMURA {
911f7b6983fSMasahide NAKAMURA 	switch (type) {
912f7b6983fSMasahide NAKAMURA 	case XFRM_POLICY_TYPE_MAIN:
913f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY
914f7b6983fSMasahide NAKAMURA 	case XFRM_POLICY_TYPE_SUB:
915f7b6983fSMasahide NAKAMURA #endif
916f7b6983fSMasahide NAKAMURA 		break;
917f7b6983fSMasahide NAKAMURA 
918f7b6983fSMasahide NAKAMURA 	default:
919f7b6983fSMasahide NAKAMURA 		return -EINVAL;
9203ff50b79SStephen Hemminger 	}
921f7b6983fSMasahide NAKAMURA 
922f7b6983fSMasahide NAKAMURA 	return 0;
923f7b6983fSMasahide NAKAMURA }
924f7b6983fSMasahide NAKAMURA 
9251da177e4SLinus Torvalds static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
9261da177e4SLinus Torvalds {
9271da177e4SLinus Torvalds 	switch (p->share) {
9281da177e4SLinus Torvalds 	case XFRM_SHARE_ANY:
9291da177e4SLinus Torvalds 	case XFRM_SHARE_SESSION:
9301da177e4SLinus Torvalds 	case XFRM_SHARE_USER:
9311da177e4SLinus Torvalds 	case XFRM_SHARE_UNIQUE:
9321da177e4SLinus Torvalds 		break;
9331da177e4SLinus Torvalds 
9341da177e4SLinus Torvalds 	default:
9351da177e4SLinus Torvalds 		return -EINVAL;
9363ff50b79SStephen Hemminger 	}
9371da177e4SLinus Torvalds 
9381da177e4SLinus Torvalds 	switch (p->action) {
9391da177e4SLinus Torvalds 	case XFRM_POLICY_ALLOW:
9401da177e4SLinus Torvalds 	case XFRM_POLICY_BLOCK:
9411da177e4SLinus Torvalds 		break;
9421da177e4SLinus Torvalds 
9431da177e4SLinus Torvalds 	default:
9441da177e4SLinus Torvalds 		return -EINVAL;
9453ff50b79SStephen Hemminger 	}
9461da177e4SLinus Torvalds 
9471da177e4SLinus Torvalds 	switch (p->sel.family) {
9481da177e4SLinus Torvalds 	case AF_INET:
9491da177e4SLinus Torvalds 		break;
9501da177e4SLinus Torvalds 
9511da177e4SLinus Torvalds 	case AF_INET6:
9521da177e4SLinus Torvalds #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
9531da177e4SLinus Torvalds 		break;
9541da177e4SLinus Torvalds #else
9551da177e4SLinus Torvalds 		return  -EAFNOSUPPORT;
9561da177e4SLinus Torvalds #endif
9571da177e4SLinus Torvalds 
9581da177e4SLinus Torvalds 	default:
9591da177e4SLinus Torvalds 		return -EINVAL;
9603ff50b79SStephen Hemminger 	}
9611da177e4SLinus Torvalds 
9621da177e4SLinus Torvalds 	return verify_policy_dir(p->dir);
9631da177e4SLinus Torvalds }
9641da177e4SLinus Torvalds 
965df71837dSTrent Jaeger static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct rtattr **xfrma)
966df71837dSTrent Jaeger {
967df71837dSTrent Jaeger 	struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
968df71837dSTrent Jaeger 	struct xfrm_user_sec_ctx *uctx;
969df71837dSTrent Jaeger 
970df71837dSTrent Jaeger 	if (!rt)
971df71837dSTrent Jaeger 		return 0;
972df71837dSTrent Jaeger 
973df71837dSTrent Jaeger 	uctx = RTA_DATA(rt);
974df71837dSTrent Jaeger 	return security_xfrm_policy_alloc(pol, uctx);
975df71837dSTrent Jaeger }
976df71837dSTrent Jaeger 
9771da177e4SLinus Torvalds static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
9781da177e4SLinus Torvalds 			   int nr)
9791da177e4SLinus Torvalds {
9801da177e4SLinus Torvalds 	int i;
9811da177e4SLinus Torvalds 
9821da177e4SLinus Torvalds 	xp->xfrm_nr = nr;
9831da177e4SLinus Torvalds 	for (i = 0; i < nr; i++, ut++) {
9841da177e4SLinus Torvalds 		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
9851da177e4SLinus Torvalds 
9861da177e4SLinus Torvalds 		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
9871da177e4SLinus Torvalds 		memcpy(&t->saddr, &ut->saddr,
9881da177e4SLinus Torvalds 		       sizeof(xfrm_address_t));
9891da177e4SLinus Torvalds 		t->reqid = ut->reqid;
9901da177e4SLinus Torvalds 		t->mode = ut->mode;
9911da177e4SLinus Torvalds 		t->share = ut->share;
9921da177e4SLinus Torvalds 		t->optional = ut->optional;
9931da177e4SLinus Torvalds 		t->aalgos = ut->aalgos;
9941da177e4SLinus Torvalds 		t->ealgos = ut->ealgos;
9951da177e4SLinus Torvalds 		t->calgos = ut->calgos;
9968511d01dSMiika Komu 		t->encap_family = ut->family;
9971da177e4SLinus Torvalds 	}
9981da177e4SLinus Torvalds }
9991da177e4SLinus Torvalds 
1000b4ad86bfSDavid S. Miller static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
1001b4ad86bfSDavid S. Miller {
1002b4ad86bfSDavid S. Miller 	int i;
1003b4ad86bfSDavid S. Miller 
1004b4ad86bfSDavid S. Miller 	if (nr > XFRM_MAX_DEPTH)
1005b4ad86bfSDavid S. Miller 		return -EINVAL;
1006b4ad86bfSDavid S. Miller 
1007b4ad86bfSDavid S. Miller 	for (i = 0; i < nr; i++) {
1008b4ad86bfSDavid S. Miller 		/* We never validated the ut->family value, so many
1009b4ad86bfSDavid S. Miller 		 * applications simply leave it at zero.  The check was
1010b4ad86bfSDavid S. Miller 		 * never made and ut->family was ignored because all
1011b4ad86bfSDavid S. Miller 		 * templates could be assumed to have the same family as
1012b4ad86bfSDavid S. Miller 		 * the policy itself.  Now that we will have ipv4-in-ipv6
1013b4ad86bfSDavid S. Miller 		 * and ipv6-in-ipv4 tunnels, this is no longer true.
1014b4ad86bfSDavid S. Miller 		 */
1015b4ad86bfSDavid S. Miller 		if (!ut[i].family)
1016b4ad86bfSDavid S. Miller 			ut[i].family = family;
1017b4ad86bfSDavid S. Miller 
1018b4ad86bfSDavid S. Miller 		switch (ut[i].family) {
1019b4ad86bfSDavid S. Miller 		case AF_INET:
1020b4ad86bfSDavid S. Miller 			break;
1021b4ad86bfSDavid S. Miller #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1022b4ad86bfSDavid S. Miller 		case AF_INET6:
1023b4ad86bfSDavid S. Miller 			break;
1024b4ad86bfSDavid S. Miller #endif
1025b4ad86bfSDavid S. Miller 		default:
1026b4ad86bfSDavid S. Miller 			return -EINVAL;
10273ff50b79SStephen Hemminger 		}
1028b4ad86bfSDavid S. Miller 	}
1029b4ad86bfSDavid S. Miller 
1030b4ad86bfSDavid S. Miller 	return 0;
1031b4ad86bfSDavid S. Miller }
1032b4ad86bfSDavid S. Miller 
10331da177e4SLinus Torvalds static int copy_from_user_tmpl(struct xfrm_policy *pol, struct rtattr **xfrma)
10341da177e4SLinus Torvalds {
10351da177e4SLinus Torvalds 	struct rtattr *rt = xfrma[XFRMA_TMPL-1];
10361da177e4SLinus Torvalds 
10371da177e4SLinus Torvalds 	if (!rt) {
10381da177e4SLinus Torvalds 		pol->xfrm_nr = 0;
10391da177e4SLinus Torvalds 	} else {
1040b4ad86bfSDavid S. Miller 		struct xfrm_user_tmpl *utmpl = RTA_DATA(rt);
1041b4ad86bfSDavid S. Miller 		int nr = (rt->rta_len - sizeof(*rt)) / sizeof(*utmpl);
1042b4ad86bfSDavid S. Miller 		int err;
10431da177e4SLinus Torvalds 
1044b4ad86bfSDavid S. Miller 		err = validate_tmpl(nr, utmpl, pol->family);
1045b4ad86bfSDavid S. Miller 		if (err)
1046b4ad86bfSDavid S. Miller 			return err;
10471da177e4SLinus Torvalds 
10481da177e4SLinus Torvalds 		copy_templates(pol, RTA_DATA(rt), nr);
10491da177e4SLinus Torvalds 	}
10501da177e4SLinus Torvalds 	return 0;
10511da177e4SLinus Torvalds }
10521da177e4SLinus Torvalds 
1053f7b6983fSMasahide NAKAMURA static int copy_from_user_policy_type(u8 *tp, struct rtattr **xfrma)
1054f7b6983fSMasahide NAKAMURA {
1055f7b6983fSMasahide NAKAMURA 	struct rtattr *rt = xfrma[XFRMA_POLICY_TYPE-1];
1056f7b6983fSMasahide NAKAMURA 	struct xfrm_userpolicy_type *upt;
1057b798a9edSJamal Hadi Salim 	u8 type = XFRM_POLICY_TYPE_MAIN;
1058f7b6983fSMasahide NAKAMURA 	int err;
1059f7b6983fSMasahide NAKAMURA 
1060f7b6983fSMasahide NAKAMURA 	if (rt) {
1061f7b6983fSMasahide NAKAMURA 		if (rt->rta_len < sizeof(*upt))
1062f7b6983fSMasahide NAKAMURA 			return -EINVAL;
1063f7b6983fSMasahide NAKAMURA 
1064f7b6983fSMasahide NAKAMURA 		upt = RTA_DATA(rt);
1065f7b6983fSMasahide NAKAMURA 		type = upt->type;
1066f7b6983fSMasahide NAKAMURA 	}
1067f7b6983fSMasahide NAKAMURA 
1068f7b6983fSMasahide NAKAMURA 	err = verify_policy_type(type);
1069f7b6983fSMasahide NAKAMURA 	if (err)
1070f7b6983fSMasahide NAKAMURA 		return err;
1071f7b6983fSMasahide NAKAMURA 
1072f7b6983fSMasahide NAKAMURA 	*tp = type;
1073f7b6983fSMasahide NAKAMURA 	return 0;
1074f7b6983fSMasahide NAKAMURA }
1075f7b6983fSMasahide NAKAMURA 
10761da177e4SLinus Torvalds static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
10771da177e4SLinus Torvalds {
10781da177e4SLinus Torvalds 	xp->priority = p->priority;
10791da177e4SLinus Torvalds 	xp->index = p->index;
10801da177e4SLinus Torvalds 	memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
10811da177e4SLinus Torvalds 	memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
10821da177e4SLinus Torvalds 	xp->action = p->action;
10831da177e4SLinus Torvalds 	xp->flags = p->flags;
10841da177e4SLinus Torvalds 	xp->family = p->sel.family;
10851da177e4SLinus Torvalds 	/* XXX xp->share = p->share; */
10861da177e4SLinus Torvalds }
10871da177e4SLinus Torvalds 
10881da177e4SLinus Torvalds static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
10891da177e4SLinus Torvalds {
10901da177e4SLinus Torvalds 	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
10911da177e4SLinus Torvalds 	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
10921da177e4SLinus Torvalds 	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
10931da177e4SLinus Torvalds 	p->priority = xp->priority;
10941da177e4SLinus Torvalds 	p->index = xp->index;
10951da177e4SLinus Torvalds 	p->sel.family = xp->family;
10961da177e4SLinus Torvalds 	p->dir = dir;
10971da177e4SLinus Torvalds 	p->action = xp->action;
10981da177e4SLinus Torvalds 	p->flags = xp->flags;
10991da177e4SLinus Torvalds 	p->share = XFRM_SHARE_ANY; /* XXX xp->share */
11001da177e4SLinus Torvalds }
11011da177e4SLinus Torvalds 
11021da177e4SLinus Torvalds static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p, struct rtattr **xfrma, int *errp)
11031da177e4SLinus Torvalds {
11041da177e4SLinus Torvalds 	struct xfrm_policy *xp = xfrm_policy_alloc(GFP_KERNEL);
11051da177e4SLinus Torvalds 	int err;
11061da177e4SLinus Torvalds 
11071da177e4SLinus Torvalds 	if (!xp) {
11081da177e4SLinus Torvalds 		*errp = -ENOMEM;
11091da177e4SLinus Torvalds 		return NULL;
11101da177e4SLinus Torvalds 	}
11111da177e4SLinus Torvalds 
11121da177e4SLinus Torvalds 	copy_from_user_policy(xp, p);
1113df71837dSTrent Jaeger 
1114f7b6983fSMasahide NAKAMURA 	err = copy_from_user_policy_type(&xp->type, xfrma);
1115f7b6983fSMasahide NAKAMURA 	if (err)
1116f7b6983fSMasahide NAKAMURA 		goto error;
1117f7b6983fSMasahide NAKAMURA 
1118df71837dSTrent Jaeger 	if (!(err = copy_from_user_tmpl(xp, xfrma)))
1119df71837dSTrent Jaeger 		err = copy_from_user_sec_ctx(xp, xfrma);
1120f7b6983fSMasahide NAKAMURA 	if (err)
1121f7b6983fSMasahide NAKAMURA 		goto error;
11221da177e4SLinus Torvalds 
11231da177e4SLinus Torvalds 	return xp;
1124f7b6983fSMasahide NAKAMURA  error:
1125f7b6983fSMasahide NAKAMURA 	*errp = err;
1126f7b6983fSMasahide NAKAMURA 	kfree(xp);
1127f7b6983fSMasahide NAKAMURA 	return NULL;
11281da177e4SLinus Torvalds }
11291da177e4SLinus Torvalds 
113022e70050SChristoph Hellwig static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
113122e70050SChristoph Hellwig 		struct rtattr **xfrma)
11321da177e4SLinus Torvalds {
1133*7b67c857SThomas Graf 	struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
11341da177e4SLinus Torvalds 	struct xfrm_policy *xp;
113526b15dadSJamal Hadi Salim 	struct km_event c;
11361da177e4SLinus Torvalds 	int err;
11371da177e4SLinus Torvalds 	int excl;
11381da177e4SLinus Torvalds 
11391da177e4SLinus Torvalds 	err = verify_newpolicy_info(p);
11401da177e4SLinus Torvalds 	if (err)
11411da177e4SLinus Torvalds 		return err;
114222e70050SChristoph Hellwig 	err = verify_sec_ctx_len(xfrma);
1143df71837dSTrent Jaeger 	if (err)
1144df71837dSTrent Jaeger 		return err;
11451da177e4SLinus Torvalds 
114622e70050SChristoph Hellwig 	xp = xfrm_policy_construct(p, xfrma, &err);
11471da177e4SLinus Torvalds 	if (!xp)
11481da177e4SLinus Torvalds 		return err;
11491da177e4SLinus Torvalds 
115026b15dadSJamal Hadi Salim 	/* shouldnt excl be based on nlh flags??
115126b15dadSJamal Hadi Salim 	 * Aha! this is anti-netlink really i.e  more pfkey derived
115226b15dadSJamal Hadi Salim 	 * in netlink excl is a flag and you wouldnt need
115326b15dadSJamal Hadi Salim 	 * a type XFRM_MSG_UPDPOLICY - JHS */
11541da177e4SLinus Torvalds 	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
11551da177e4SLinus Torvalds 	err = xfrm_policy_insert(p->dir, xp, excl);
1156161a09e7SJoy Latten 	xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
1157161a09e7SJoy Latten 		       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
1158161a09e7SJoy Latten 
11591da177e4SLinus Torvalds 	if (err) {
11605f8ac64bSTrent Jaeger 		security_xfrm_policy_free(xp);
11611da177e4SLinus Torvalds 		kfree(xp);
11621da177e4SLinus Torvalds 		return err;
11631da177e4SLinus Torvalds 	}
11641da177e4SLinus Torvalds 
1165f60f6b8fSHerbert Xu 	c.event = nlh->nlmsg_type;
116626b15dadSJamal Hadi Salim 	c.seq = nlh->nlmsg_seq;
116726b15dadSJamal Hadi Salim 	c.pid = nlh->nlmsg_pid;
116826b15dadSJamal Hadi Salim 	km_policy_notify(xp, p->dir, &c);
116926b15dadSJamal Hadi Salim 
11701da177e4SLinus Torvalds 	xfrm_pol_put(xp);
11711da177e4SLinus Torvalds 
11721da177e4SLinus Torvalds 	return 0;
11731da177e4SLinus Torvalds }
11741da177e4SLinus Torvalds 
11751da177e4SLinus Torvalds static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
11761da177e4SLinus Torvalds {
11771da177e4SLinus Torvalds 	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
11781da177e4SLinus Torvalds 	int i;
11791da177e4SLinus Torvalds 
11801da177e4SLinus Torvalds 	if (xp->xfrm_nr == 0)
11811da177e4SLinus Torvalds 		return 0;
11821da177e4SLinus Torvalds 
11831da177e4SLinus Torvalds 	for (i = 0; i < xp->xfrm_nr; i++) {
11841da177e4SLinus Torvalds 		struct xfrm_user_tmpl *up = &vec[i];
11851da177e4SLinus Torvalds 		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
11861da177e4SLinus Torvalds 
11871da177e4SLinus Torvalds 		memcpy(&up->id, &kp->id, sizeof(up->id));
11888511d01dSMiika Komu 		up->family = kp->encap_family;
11891da177e4SLinus Torvalds 		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
11901da177e4SLinus Torvalds 		up->reqid = kp->reqid;
11911da177e4SLinus Torvalds 		up->mode = kp->mode;
11921da177e4SLinus Torvalds 		up->share = kp->share;
11931da177e4SLinus Torvalds 		up->optional = kp->optional;
11941da177e4SLinus Torvalds 		up->aalgos = kp->aalgos;
11951da177e4SLinus Torvalds 		up->ealgos = kp->ealgos;
11961da177e4SLinus Torvalds 		up->calgos = kp->calgos;
11971da177e4SLinus Torvalds 	}
11981da177e4SLinus Torvalds 	RTA_PUT(skb, XFRMA_TMPL,
11991da177e4SLinus Torvalds 		(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr),
12001da177e4SLinus Torvalds 		vec);
12011da177e4SLinus Torvalds 
12021da177e4SLinus Torvalds 	return 0;
12031da177e4SLinus Torvalds 
12041da177e4SLinus Torvalds rtattr_failure:
12051da177e4SLinus Torvalds 	return -1;
12061da177e4SLinus Torvalds }
12071da177e4SLinus Torvalds 
12080d681623SSerge Hallyn static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
1209df71837dSTrent Jaeger {
12100d681623SSerge Hallyn 	int ctx_size = sizeof(struct xfrm_sec_ctx) + s->ctx_len;
1211df71837dSTrent Jaeger 	struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
1212df71837dSTrent Jaeger 	struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
1213df71837dSTrent Jaeger 
1214df71837dSTrent Jaeger 	uctx->exttype = XFRMA_SEC_CTX;
1215df71837dSTrent Jaeger 	uctx->len = ctx_size;
12160d681623SSerge Hallyn 	uctx->ctx_doi = s->ctx_doi;
12170d681623SSerge Hallyn 	uctx->ctx_alg = s->ctx_alg;
12180d681623SSerge Hallyn 	uctx->ctx_len = s->ctx_len;
12190d681623SSerge Hallyn 	memcpy(uctx + 1, s->ctx_str, s->ctx_len);
1220df71837dSTrent Jaeger 	return 0;
1221df71837dSTrent Jaeger 
1222df71837dSTrent Jaeger  rtattr_failure:
1223df71837dSTrent Jaeger 	return -1;
1224df71837dSTrent Jaeger }
1225df71837dSTrent Jaeger 
12260d681623SSerge Hallyn static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
12270d681623SSerge Hallyn {
12280d681623SSerge Hallyn 	if (x->security) {
12290d681623SSerge Hallyn 		return copy_sec_ctx(x->security, skb);
12300d681623SSerge Hallyn 	}
12310d681623SSerge Hallyn 	return 0;
12320d681623SSerge Hallyn }
12330d681623SSerge Hallyn 
12340d681623SSerge Hallyn static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
12350d681623SSerge Hallyn {
12360d681623SSerge Hallyn 	if (xp->security) {
12370d681623SSerge Hallyn 		return copy_sec_ctx(xp->security, skb);
12380d681623SSerge Hallyn 	}
12390d681623SSerge Hallyn 	return 0;
12400d681623SSerge Hallyn }
12410d681623SSerge Hallyn 
1242f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY
1243b798a9edSJamal Hadi Salim static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1244f7b6983fSMasahide NAKAMURA {
1245f7b6983fSMasahide NAKAMURA 	struct xfrm_userpolicy_type upt;
1246f7b6983fSMasahide NAKAMURA 
1247f7b6983fSMasahide NAKAMURA 	memset(&upt, 0, sizeof(upt));
12481459bb36SJamal Hadi Salim 	upt.type = type;
1249f7b6983fSMasahide NAKAMURA 
1250f7b6983fSMasahide NAKAMURA 	RTA_PUT(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1251f7b6983fSMasahide NAKAMURA 
1252f7b6983fSMasahide NAKAMURA 	return 0;
1253f7b6983fSMasahide NAKAMURA 
1254f7b6983fSMasahide NAKAMURA rtattr_failure:
1255f7b6983fSMasahide NAKAMURA 	return -1;
1256f7b6983fSMasahide NAKAMURA }
1257f7b6983fSMasahide NAKAMURA 
1258f7b6983fSMasahide NAKAMURA #else
1259b798a9edSJamal Hadi Salim static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1260f7b6983fSMasahide NAKAMURA {
1261f7b6983fSMasahide NAKAMURA 	return 0;
1262f7b6983fSMasahide NAKAMURA }
1263f7b6983fSMasahide NAKAMURA #endif
1264f7b6983fSMasahide NAKAMURA 
12651da177e4SLinus Torvalds static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
12661da177e4SLinus Torvalds {
12671da177e4SLinus Torvalds 	struct xfrm_dump_info *sp = ptr;
12681da177e4SLinus Torvalds 	struct xfrm_userpolicy_info *p;
12691da177e4SLinus Torvalds 	struct sk_buff *in_skb = sp->in_skb;
12701da177e4SLinus Torvalds 	struct sk_buff *skb = sp->out_skb;
12711da177e4SLinus Torvalds 	struct nlmsghdr *nlh;
12721da177e4SLinus Torvalds 
12731da177e4SLinus Torvalds 	if (sp->this_idx < sp->start_idx)
12741da177e4SLinus Torvalds 		goto out;
12751da177e4SLinus Torvalds 
127679b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
127779b8b7f4SThomas Graf 			XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
127879b8b7f4SThomas Graf 	if (nlh == NULL)
127979b8b7f4SThomas Graf 		return -EMSGSIZE;
12801da177e4SLinus Torvalds 
1281*7b67c857SThomas Graf 	p = nlmsg_data(nlh);
12821da177e4SLinus Torvalds 	copy_to_user_policy(xp, p, dir);
12831da177e4SLinus Torvalds 	if (copy_to_user_tmpl(xp, skb) < 0)
12841da177e4SLinus Torvalds 		goto nlmsg_failure;
1285df71837dSTrent Jaeger 	if (copy_to_user_sec_ctx(xp, skb))
1286df71837dSTrent Jaeger 		goto nlmsg_failure;
12871459bb36SJamal Hadi Salim 	if (copy_to_user_policy_type(xp->type, skb) < 0)
1288f7b6983fSMasahide NAKAMURA 		goto nlmsg_failure;
12891da177e4SLinus Torvalds 
12909825069dSThomas Graf 	nlmsg_end(skb, nlh);
12911da177e4SLinus Torvalds out:
12921da177e4SLinus Torvalds 	sp->this_idx++;
12931da177e4SLinus Torvalds 	return 0;
12941da177e4SLinus Torvalds 
12951da177e4SLinus Torvalds nlmsg_failure:
12969825069dSThomas Graf 	nlmsg_cancel(skb, nlh);
12979825069dSThomas Graf 	return -EMSGSIZE;
12981da177e4SLinus Torvalds }
12991da177e4SLinus Torvalds 
13001da177e4SLinus Torvalds static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
13011da177e4SLinus Torvalds {
13021da177e4SLinus Torvalds 	struct xfrm_dump_info info;
13031da177e4SLinus Torvalds 
13041da177e4SLinus Torvalds 	info.in_skb = cb->skb;
13051da177e4SLinus Torvalds 	info.out_skb = skb;
13061da177e4SLinus Torvalds 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
13071da177e4SLinus Torvalds 	info.nlmsg_flags = NLM_F_MULTI;
13081da177e4SLinus Torvalds 	info.this_idx = 0;
13091da177e4SLinus Torvalds 	info.start_idx = cb->args[0];
1310f7b6983fSMasahide NAKAMURA 	(void) xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_one_policy, &info);
1311f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY
1312f7b6983fSMasahide NAKAMURA 	(void) xfrm_policy_walk(XFRM_POLICY_TYPE_SUB, dump_one_policy, &info);
1313f7b6983fSMasahide NAKAMURA #endif
13141da177e4SLinus Torvalds 	cb->args[0] = info.this_idx;
13151da177e4SLinus Torvalds 
13161da177e4SLinus Torvalds 	return skb->len;
13171da177e4SLinus Torvalds }
13181da177e4SLinus Torvalds 
13191da177e4SLinus Torvalds static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
13201da177e4SLinus Torvalds 					  struct xfrm_policy *xp,
13211da177e4SLinus Torvalds 					  int dir, u32 seq)
13221da177e4SLinus Torvalds {
13231da177e4SLinus Torvalds 	struct xfrm_dump_info info;
13241da177e4SLinus Torvalds 	struct sk_buff *skb;
13251da177e4SLinus Torvalds 
13261da177e4SLinus Torvalds 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
13271da177e4SLinus Torvalds 	if (!skb)
13281da177e4SLinus Torvalds 		return ERR_PTR(-ENOMEM);
13291da177e4SLinus Torvalds 
13301da177e4SLinus Torvalds 	info.in_skb = in_skb;
13311da177e4SLinus Torvalds 	info.out_skb = skb;
13321da177e4SLinus Torvalds 	info.nlmsg_seq = seq;
13331da177e4SLinus Torvalds 	info.nlmsg_flags = 0;
13341da177e4SLinus Torvalds 	info.this_idx = info.start_idx = 0;
13351da177e4SLinus Torvalds 
13361da177e4SLinus Torvalds 	if (dump_one_policy(xp, dir, 0, &info) < 0) {
13371da177e4SLinus Torvalds 		kfree_skb(skb);
13381da177e4SLinus Torvalds 		return NULL;
13391da177e4SLinus Torvalds 	}
13401da177e4SLinus Torvalds 
13411da177e4SLinus Torvalds 	return skb;
13421da177e4SLinus Torvalds }
13431da177e4SLinus Torvalds 
134422e70050SChristoph Hellwig static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
134522e70050SChristoph Hellwig 		struct rtattr **xfrma)
13461da177e4SLinus Torvalds {
13471da177e4SLinus Torvalds 	struct xfrm_policy *xp;
13481da177e4SLinus Torvalds 	struct xfrm_userpolicy_id *p;
1349b798a9edSJamal Hadi Salim 	u8 type = XFRM_POLICY_TYPE_MAIN;
13501da177e4SLinus Torvalds 	int err;
135126b15dadSJamal Hadi Salim 	struct km_event c;
13521da177e4SLinus Torvalds 	int delete;
13531da177e4SLinus Torvalds 
1354*7b67c857SThomas Graf 	p = nlmsg_data(nlh);
13551da177e4SLinus Torvalds 	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
13561da177e4SLinus Torvalds 
135722e70050SChristoph Hellwig 	err = copy_from_user_policy_type(&type, xfrma);
1358f7b6983fSMasahide NAKAMURA 	if (err)
1359f7b6983fSMasahide NAKAMURA 		return err;
1360f7b6983fSMasahide NAKAMURA 
13611da177e4SLinus Torvalds 	err = verify_policy_dir(p->dir);
13621da177e4SLinus Torvalds 	if (err)
13631da177e4SLinus Torvalds 		return err;
13641da177e4SLinus Torvalds 
13651da177e4SLinus Torvalds 	if (p->index)
1366ef41aaa0SEric Paris 		xp = xfrm_policy_byid(type, p->dir, p->index, delete, &err);
1367df71837dSTrent Jaeger 	else {
136822e70050SChristoph Hellwig 		struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
1369df71837dSTrent Jaeger 		struct xfrm_policy tmp;
1370df71837dSTrent Jaeger 
137122e70050SChristoph Hellwig 		err = verify_sec_ctx_len(xfrma);
1372df71837dSTrent Jaeger 		if (err)
1373df71837dSTrent Jaeger 			return err;
1374df71837dSTrent Jaeger 
1375df71837dSTrent Jaeger 		memset(&tmp, 0, sizeof(struct xfrm_policy));
1376df71837dSTrent Jaeger 		if (rt) {
1377df71837dSTrent Jaeger 			struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
1378df71837dSTrent Jaeger 
1379df71837dSTrent Jaeger 			if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
1380df71837dSTrent Jaeger 				return err;
1381df71837dSTrent Jaeger 		}
1382ef41aaa0SEric Paris 		xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
1383ef41aaa0SEric Paris 					   delete, &err);
1384df71837dSTrent Jaeger 		security_xfrm_policy_free(&tmp);
1385df71837dSTrent Jaeger 	}
13861da177e4SLinus Torvalds 	if (xp == NULL)
13871da177e4SLinus Torvalds 		return -ENOENT;
13881da177e4SLinus Torvalds 
13891da177e4SLinus Torvalds 	if (!delete) {
13901da177e4SLinus Torvalds 		struct sk_buff *resp_skb;
13911da177e4SLinus Torvalds 
13921da177e4SLinus Torvalds 		resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
13931da177e4SLinus Torvalds 		if (IS_ERR(resp_skb)) {
13941da177e4SLinus Torvalds 			err = PTR_ERR(resp_skb);
13951da177e4SLinus Torvalds 		} else {
13961da177e4SLinus Torvalds 			err = netlink_unicast(xfrm_nl, resp_skb,
13971da177e4SLinus Torvalds 					      NETLINK_CB(skb).pid,
13981da177e4SLinus Torvalds 					      MSG_DONTWAIT);
13991da177e4SLinus Torvalds 		}
140026b15dadSJamal Hadi Salim 	} else {
140113fcfbb0SDavid S. Miller 		xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
140213fcfbb0SDavid S. Miller 			       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
140313fcfbb0SDavid S. Miller 
140413fcfbb0SDavid S. Miller 		if (err != 0)
1405c8c05a8eSCatherine Zhang 			goto out;
140613fcfbb0SDavid S. Miller 
1407e7443892SHerbert Xu 		c.data.byid = p->index;
1408f60f6b8fSHerbert Xu 		c.event = nlh->nlmsg_type;
140926b15dadSJamal Hadi Salim 		c.seq = nlh->nlmsg_seq;
141026b15dadSJamal Hadi Salim 		c.pid = nlh->nlmsg_pid;
141126b15dadSJamal Hadi Salim 		km_policy_notify(xp, p->dir, &c);
14121da177e4SLinus Torvalds 	}
14131da177e4SLinus Torvalds 
1414c8c05a8eSCatherine Zhang out:
1415ef41aaa0SEric Paris 	xfrm_pol_put(xp);
14161da177e4SLinus Torvalds 	return err;
14171da177e4SLinus Torvalds }
14181da177e4SLinus Torvalds 
141922e70050SChristoph Hellwig static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
142022e70050SChristoph Hellwig 		struct rtattr **xfrma)
14211da177e4SLinus Torvalds {
142226b15dadSJamal Hadi Salim 	struct km_event c;
1423*7b67c857SThomas Graf 	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
1424161a09e7SJoy Latten 	struct xfrm_audit audit_info;
14254aa2e62cSJoy Latten 	int err;
14261da177e4SLinus Torvalds 
1427161a09e7SJoy Latten 	audit_info.loginuid = NETLINK_CB(skb).loginuid;
1428161a09e7SJoy Latten 	audit_info.secid = NETLINK_CB(skb).sid;
14294aa2e62cSJoy Latten 	err = xfrm_state_flush(p->proto, &audit_info);
14304aa2e62cSJoy Latten 	if (err)
14314aa2e62cSJoy Latten 		return err;
1432bf08867fSHerbert Xu 	c.data.proto = p->proto;
1433f60f6b8fSHerbert Xu 	c.event = nlh->nlmsg_type;
143426b15dadSJamal Hadi Salim 	c.seq = nlh->nlmsg_seq;
143526b15dadSJamal Hadi Salim 	c.pid = nlh->nlmsg_pid;
143626b15dadSJamal Hadi Salim 	km_state_notify(NULL, &c);
143726b15dadSJamal Hadi Salim 
14381da177e4SLinus Torvalds 	return 0;
14391da177e4SLinus Torvalds }
14401da177e4SLinus Torvalds 
1441d51d081dSJamal Hadi Salim 
1442d51d081dSJamal Hadi Salim static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
1443d51d081dSJamal Hadi Salim {
1444d51d081dSJamal Hadi Salim 	struct xfrm_aevent_id *id;
1445d51d081dSJamal Hadi Salim 	struct nlmsghdr *nlh;
1446d51d081dSJamal Hadi Salim 	struct xfrm_lifetime_cur ltime;
1447d51d081dSJamal Hadi Salim 
144879b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
144979b8b7f4SThomas Graf 	if (nlh == NULL)
145079b8b7f4SThomas Graf 		return -EMSGSIZE;
1451d51d081dSJamal Hadi Salim 
1452*7b67c857SThomas Graf 	id = nlmsg_data(nlh);
14532b5f6dccSJamal Hadi Salim 	memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
1454d51d081dSJamal Hadi Salim 	id->sa_id.spi = x->id.spi;
1455d51d081dSJamal Hadi Salim 	id->sa_id.family = x->props.family;
1456d51d081dSJamal Hadi Salim 	id->sa_id.proto = x->id.proto;
14572b5f6dccSJamal Hadi Salim 	memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
14582b5f6dccSJamal Hadi Salim 	id->reqid = x->props.reqid;
1459d51d081dSJamal Hadi Salim 	id->flags = c->data.aevent;
1460d51d081dSJamal Hadi Salim 
1461d51d081dSJamal Hadi Salim 	RTA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
1462d51d081dSJamal Hadi Salim 
1463d51d081dSJamal Hadi Salim 	ltime.bytes = x->curlft.bytes;
1464d51d081dSJamal Hadi Salim 	ltime.packets = x->curlft.packets;
1465d51d081dSJamal Hadi Salim 	ltime.add_time = x->curlft.add_time;
1466d51d081dSJamal Hadi Salim 	ltime.use_time = x->curlft.use_time;
1467d51d081dSJamal Hadi Salim 
1468d51d081dSJamal Hadi Salim 	RTA_PUT(skb, XFRMA_LTIME_VAL, sizeof(struct xfrm_lifetime_cur), &ltime);
1469d51d081dSJamal Hadi Salim 
1470d51d081dSJamal Hadi Salim 	if (id->flags&XFRM_AE_RTHR) {
1471d51d081dSJamal Hadi Salim 		RTA_PUT(skb,XFRMA_REPLAY_THRESH,sizeof(u32),&x->replay_maxdiff);
1472d51d081dSJamal Hadi Salim 	}
1473d51d081dSJamal Hadi Salim 
1474d51d081dSJamal Hadi Salim 	if (id->flags&XFRM_AE_ETHR) {
1475d51d081dSJamal Hadi Salim 		u32 etimer = x->replay_maxage*10/HZ;
1476d51d081dSJamal Hadi Salim 		RTA_PUT(skb,XFRMA_ETIMER_THRESH,sizeof(u32),&etimer);
1477d51d081dSJamal Hadi Salim 	}
1478d51d081dSJamal Hadi Salim 
14799825069dSThomas Graf 	return nlmsg_end(skb, nlh);
1480d51d081dSJamal Hadi Salim 
1481d51d081dSJamal Hadi Salim rtattr_failure:
14829825069dSThomas Graf 	nlmsg_cancel(skb, nlh);
14839825069dSThomas Graf 	return -EMSGSIZE;
1484d51d081dSJamal Hadi Salim }
1485d51d081dSJamal Hadi Salim 
148622e70050SChristoph Hellwig static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
148722e70050SChristoph Hellwig 		struct rtattr **xfrma)
1488d51d081dSJamal Hadi Salim {
1489d51d081dSJamal Hadi Salim 	struct xfrm_state *x;
1490d51d081dSJamal Hadi Salim 	struct sk_buff *r_skb;
1491d51d081dSJamal Hadi Salim 	int err;
1492d51d081dSJamal Hadi Salim 	struct km_event c;
1493*7b67c857SThomas Graf 	struct xfrm_aevent_id *p = nlmsg_data(nlh);
1494d51d081dSJamal Hadi Salim 	int len = NLMSG_LENGTH(sizeof(struct xfrm_aevent_id));
1495d51d081dSJamal Hadi Salim 	struct xfrm_usersa_id *id = &p->sa_id;
1496d51d081dSJamal Hadi Salim 
1497d51d081dSJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_replay_state));
1498d51d081dSJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_lifetime_cur));
1499d51d081dSJamal Hadi Salim 
1500d51d081dSJamal Hadi Salim 	if (p->flags&XFRM_AE_RTHR)
1501d51d081dSJamal Hadi Salim 		len+=RTA_SPACE(sizeof(u32));
1502d51d081dSJamal Hadi Salim 
1503d51d081dSJamal Hadi Salim 	if (p->flags&XFRM_AE_ETHR)
1504d51d081dSJamal Hadi Salim 		len+=RTA_SPACE(sizeof(u32));
1505d51d081dSJamal Hadi Salim 
1506d51d081dSJamal Hadi Salim 	r_skb = alloc_skb(len, GFP_ATOMIC);
1507d51d081dSJamal Hadi Salim 	if (r_skb == NULL)
1508d51d081dSJamal Hadi Salim 		return -ENOMEM;
1509d51d081dSJamal Hadi Salim 
1510d51d081dSJamal Hadi Salim 	x = xfrm_state_lookup(&id->daddr, id->spi, id->proto, id->family);
1511d51d081dSJamal Hadi Salim 	if (x == NULL) {
1512b08d5840SPatrick McHardy 		kfree_skb(r_skb);
1513d51d081dSJamal Hadi Salim 		return -ESRCH;
1514d51d081dSJamal Hadi Salim 	}
1515d51d081dSJamal Hadi Salim 
1516d51d081dSJamal Hadi Salim 	/*
1517d51d081dSJamal Hadi Salim 	 * XXX: is this lock really needed - none of the other
1518d51d081dSJamal Hadi Salim 	 * gets lock (the concern is things getting updated
1519d51d081dSJamal Hadi Salim 	 * while we are still reading) - jhs
1520d51d081dSJamal Hadi Salim 	*/
1521d51d081dSJamal Hadi Salim 	spin_lock_bh(&x->lock);
1522d51d081dSJamal Hadi Salim 	c.data.aevent = p->flags;
1523d51d081dSJamal Hadi Salim 	c.seq = nlh->nlmsg_seq;
1524d51d081dSJamal Hadi Salim 	c.pid = nlh->nlmsg_pid;
1525d51d081dSJamal Hadi Salim 
1526d51d081dSJamal Hadi Salim 	if (build_aevent(r_skb, x, &c) < 0)
1527d51d081dSJamal Hadi Salim 		BUG();
1528d51d081dSJamal Hadi Salim 	err = netlink_unicast(xfrm_nl, r_skb,
1529d51d081dSJamal Hadi Salim 			      NETLINK_CB(skb).pid, MSG_DONTWAIT);
1530d51d081dSJamal Hadi Salim 	spin_unlock_bh(&x->lock);
1531d51d081dSJamal Hadi Salim 	xfrm_state_put(x);
1532d51d081dSJamal Hadi Salim 	return err;
1533d51d081dSJamal Hadi Salim }
1534d51d081dSJamal Hadi Salim 
153522e70050SChristoph Hellwig static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
153622e70050SChristoph Hellwig 		struct rtattr **xfrma)
1537d51d081dSJamal Hadi Salim {
1538d51d081dSJamal Hadi Salim 	struct xfrm_state *x;
1539d51d081dSJamal Hadi Salim 	struct km_event c;
1540d51d081dSJamal Hadi Salim 	int err = - EINVAL;
1541*7b67c857SThomas Graf 	struct xfrm_aevent_id *p = nlmsg_data(nlh);
1542d51d081dSJamal Hadi Salim 	struct rtattr *rp = xfrma[XFRMA_REPLAY_VAL-1];
1543d51d081dSJamal Hadi Salim 	struct rtattr *lt = xfrma[XFRMA_LTIME_VAL-1];
1544d51d081dSJamal Hadi Salim 
1545d51d081dSJamal Hadi Salim 	if (!lt && !rp)
1546d51d081dSJamal Hadi Salim 		return err;
1547d51d081dSJamal Hadi Salim 
1548d51d081dSJamal Hadi Salim 	/* pedantic mode - thou shalt sayeth replaceth */
1549d51d081dSJamal Hadi Salim 	if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
1550d51d081dSJamal Hadi Salim 		return err;
1551d51d081dSJamal Hadi Salim 
1552d51d081dSJamal Hadi Salim 	x = xfrm_state_lookup(&p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
1553d51d081dSJamal Hadi Salim 	if (x == NULL)
1554d51d081dSJamal Hadi Salim 		return -ESRCH;
1555d51d081dSJamal Hadi Salim 
1556d51d081dSJamal Hadi Salim 	if (x->km.state != XFRM_STATE_VALID)
1557d51d081dSJamal Hadi Salim 		goto out;
1558d51d081dSJamal Hadi Salim 
1559d51d081dSJamal Hadi Salim 	spin_lock_bh(&x->lock);
156022e70050SChristoph Hellwig 	err = xfrm_update_ae_params(x, xfrma);
1561d51d081dSJamal Hadi Salim 	spin_unlock_bh(&x->lock);
1562d51d081dSJamal Hadi Salim 	if (err	< 0)
1563d51d081dSJamal Hadi Salim 		goto out;
1564d51d081dSJamal Hadi Salim 
1565d51d081dSJamal Hadi Salim 	c.event = nlh->nlmsg_type;
1566d51d081dSJamal Hadi Salim 	c.seq = nlh->nlmsg_seq;
1567d51d081dSJamal Hadi Salim 	c.pid = nlh->nlmsg_pid;
1568d51d081dSJamal Hadi Salim 	c.data.aevent = XFRM_AE_CU;
1569d51d081dSJamal Hadi Salim 	km_state_notify(x, &c);
1570d51d081dSJamal Hadi Salim 	err = 0;
1571d51d081dSJamal Hadi Salim out:
1572d51d081dSJamal Hadi Salim 	xfrm_state_put(x);
1573d51d081dSJamal Hadi Salim 	return err;
1574d51d081dSJamal Hadi Salim }
1575d51d081dSJamal Hadi Salim 
157622e70050SChristoph Hellwig static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
157722e70050SChristoph Hellwig 		struct rtattr **xfrma)
15781da177e4SLinus Torvalds {
157926b15dadSJamal Hadi Salim 	struct km_event c;
1580b798a9edSJamal Hadi Salim 	u8 type = XFRM_POLICY_TYPE_MAIN;
1581f7b6983fSMasahide NAKAMURA 	int err;
1582161a09e7SJoy Latten 	struct xfrm_audit audit_info;
158326b15dadSJamal Hadi Salim 
158422e70050SChristoph Hellwig 	err = copy_from_user_policy_type(&type, xfrma);
1585f7b6983fSMasahide NAKAMURA 	if (err)
1586f7b6983fSMasahide NAKAMURA 		return err;
1587f7b6983fSMasahide NAKAMURA 
1588161a09e7SJoy Latten 	audit_info.loginuid = NETLINK_CB(skb).loginuid;
1589161a09e7SJoy Latten 	audit_info.secid = NETLINK_CB(skb).sid;
15904aa2e62cSJoy Latten 	err = xfrm_policy_flush(type, &audit_info);
15914aa2e62cSJoy Latten 	if (err)
15924aa2e62cSJoy Latten 		return err;
1593f7b6983fSMasahide NAKAMURA 	c.data.type = type;
1594f60f6b8fSHerbert Xu 	c.event = nlh->nlmsg_type;
159526b15dadSJamal Hadi Salim 	c.seq = nlh->nlmsg_seq;
159626b15dadSJamal Hadi Salim 	c.pid = nlh->nlmsg_pid;
159726b15dadSJamal Hadi Salim 	km_policy_notify(NULL, 0, &c);
15981da177e4SLinus Torvalds 	return 0;
15991da177e4SLinus Torvalds }
16001da177e4SLinus Torvalds 
160122e70050SChristoph Hellwig static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
160222e70050SChristoph Hellwig 		struct rtattr **xfrma)
16036c5c8ca7SJamal Hadi Salim {
16046c5c8ca7SJamal Hadi Salim 	struct xfrm_policy *xp;
1605*7b67c857SThomas Graf 	struct xfrm_user_polexpire *up = nlmsg_data(nlh);
16066c5c8ca7SJamal Hadi Salim 	struct xfrm_userpolicy_info *p = &up->pol;
1607b798a9edSJamal Hadi Salim 	u8 type = XFRM_POLICY_TYPE_MAIN;
16086c5c8ca7SJamal Hadi Salim 	int err = -ENOENT;
16096c5c8ca7SJamal Hadi Salim 
161022e70050SChristoph Hellwig 	err = copy_from_user_policy_type(&type, xfrma);
1611f7b6983fSMasahide NAKAMURA 	if (err)
1612f7b6983fSMasahide NAKAMURA 		return err;
1613f7b6983fSMasahide NAKAMURA 
16146c5c8ca7SJamal Hadi Salim 	if (p->index)
1615ef41aaa0SEric Paris 		xp = xfrm_policy_byid(type, p->dir, p->index, 0, &err);
16166c5c8ca7SJamal Hadi Salim 	else {
161722e70050SChristoph Hellwig 		struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
16186c5c8ca7SJamal Hadi Salim 		struct xfrm_policy tmp;
16196c5c8ca7SJamal Hadi Salim 
162022e70050SChristoph Hellwig 		err = verify_sec_ctx_len(xfrma);
16216c5c8ca7SJamal Hadi Salim 		if (err)
16226c5c8ca7SJamal Hadi Salim 			return err;
16236c5c8ca7SJamal Hadi Salim 
16246c5c8ca7SJamal Hadi Salim 		memset(&tmp, 0, sizeof(struct xfrm_policy));
16256c5c8ca7SJamal Hadi Salim 		if (rt) {
16266c5c8ca7SJamal Hadi Salim 			struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
16276c5c8ca7SJamal Hadi Salim 
16286c5c8ca7SJamal Hadi Salim 			if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
16296c5c8ca7SJamal Hadi Salim 				return err;
16306c5c8ca7SJamal Hadi Salim 		}
1631ef41aaa0SEric Paris 		xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
1632ef41aaa0SEric Paris 					   0, &err);
16336c5c8ca7SJamal Hadi Salim 		security_xfrm_policy_free(&tmp);
16346c5c8ca7SJamal Hadi Salim 	}
16356c5c8ca7SJamal Hadi Salim 
16366c5c8ca7SJamal Hadi Salim 	if (xp == NULL)
1637ef41aaa0SEric Paris 		return -ENOENT;
16386c5c8ca7SJamal Hadi Salim 	read_lock(&xp->lock);
16396c5c8ca7SJamal Hadi Salim 	if (xp->dead) {
16406c5c8ca7SJamal Hadi Salim 		read_unlock(&xp->lock);
16416c5c8ca7SJamal Hadi Salim 		goto out;
16426c5c8ca7SJamal Hadi Salim 	}
16436c5c8ca7SJamal Hadi Salim 
16446c5c8ca7SJamal Hadi Salim 	read_unlock(&xp->lock);
16456c5c8ca7SJamal Hadi Salim 	err = 0;
16466c5c8ca7SJamal Hadi Salim 	if (up->hard) {
16476c5c8ca7SJamal Hadi Salim 		xfrm_policy_delete(xp, p->dir);
1648161a09e7SJoy Latten 		xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
1649161a09e7SJoy Latten 				AUDIT_MAC_IPSEC_DELSPD, 1, xp, NULL);
1650161a09e7SJoy Latten 
16516c5c8ca7SJamal Hadi Salim 	} else {
16526c5c8ca7SJamal Hadi Salim 		// reset the timers here?
16536c5c8ca7SJamal Hadi Salim 		printk("Dont know what to do with soft policy expire\n");
16546c5c8ca7SJamal Hadi Salim 	}
16556c5c8ca7SJamal Hadi Salim 	km_policy_expired(xp, p->dir, up->hard, current->pid);
16566c5c8ca7SJamal Hadi Salim 
16576c5c8ca7SJamal Hadi Salim out:
16586c5c8ca7SJamal Hadi Salim 	xfrm_pol_put(xp);
16596c5c8ca7SJamal Hadi Salim 	return err;
16606c5c8ca7SJamal Hadi Salim }
16616c5c8ca7SJamal Hadi Salim 
166222e70050SChristoph Hellwig static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
166322e70050SChristoph Hellwig 		struct rtattr **xfrma)
166453bc6b4dSJamal Hadi Salim {
166553bc6b4dSJamal Hadi Salim 	struct xfrm_state *x;
166653bc6b4dSJamal Hadi Salim 	int err;
1667*7b67c857SThomas Graf 	struct xfrm_user_expire *ue = nlmsg_data(nlh);
166853bc6b4dSJamal Hadi Salim 	struct xfrm_usersa_info *p = &ue->state;
166953bc6b4dSJamal Hadi Salim 
167053bc6b4dSJamal Hadi Salim 	x = xfrm_state_lookup(&p->id.daddr, p->id.spi, p->id.proto, p->family);
167153bc6b4dSJamal Hadi Salim 
16723a765aa5SDavid S. Miller 	err = -ENOENT;
167353bc6b4dSJamal Hadi Salim 	if (x == NULL)
167453bc6b4dSJamal Hadi Salim 		return err;
167553bc6b4dSJamal Hadi Salim 
167653bc6b4dSJamal Hadi Salim 	spin_lock_bh(&x->lock);
16773a765aa5SDavid S. Miller 	err = -EINVAL;
167853bc6b4dSJamal Hadi Salim 	if (x->km.state != XFRM_STATE_VALID)
167953bc6b4dSJamal Hadi Salim 		goto out;
168053bc6b4dSJamal Hadi Salim 	km_state_expired(x, ue->hard, current->pid);
168153bc6b4dSJamal Hadi Salim 
1682161a09e7SJoy Latten 	if (ue->hard) {
168353bc6b4dSJamal Hadi Salim 		__xfrm_state_delete(x);
1684161a09e7SJoy Latten 		xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
1685161a09e7SJoy Latten 			       AUDIT_MAC_IPSEC_DELSA, 1, NULL, x);
1686161a09e7SJoy Latten 	}
16873a765aa5SDavid S. Miller 	err = 0;
168853bc6b4dSJamal Hadi Salim out:
168953bc6b4dSJamal Hadi Salim 	spin_unlock_bh(&x->lock);
169053bc6b4dSJamal Hadi Salim 	xfrm_state_put(x);
169153bc6b4dSJamal Hadi Salim 	return err;
169253bc6b4dSJamal Hadi Salim }
169353bc6b4dSJamal Hadi Salim 
169422e70050SChristoph Hellwig static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
169522e70050SChristoph Hellwig 		struct rtattr **xfrma)
1696980ebd25SJamal Hadi Salim {
1697980ebd25SJamal Hadi Salim 	struct xfrm_policy *xp;
1698980ebd25SJamal Hadi Salim 	struct xfrm_user_tmpl *ut;
1699980ebd25SJamal Hadi Salim 	int i;
1700980ebd25SJamal Hadi Salim 	struct rtattr *rt = xfrma[XFRMA_TMPL-1];
1701980ebd25SJamal Hadi Salim 
1702*7b67c857SThomas Graf 	struct xfrm_user_acquire *ua = nlmsg_data(nlh);
1703980ebd25SJamal Hadi Salim 	struct xfrm_state *x = xfrm_state_alloc();
1704980ebd25SJamal Hadi Salim 	int err = -ENOMEM;
1705980ebd25SJamal Hadi Salim 
1706980ebd25SJamal Hadi Salim 	if (!x)
1707980ebd25SJamal Hadi Salim 		return err;
1708980ebd25SJamal Hadi Salim 
1709980ebd25SJamal Hadi Salim 	err = verify_newpolicy_info(&ua->policy);
1710980ebd25SJamal Hadi Salim 	if (err) {
1711980ebd25SJamal Hadi Salim 		printk("BAD policy passed\n");
1712980ebd25SJamal Hadi Salim 		kfree(x);
1713980ebd25SJamal Hadi Salim 		return err;
1714980ebd25SJamal Hadi Salim 	}
1715980ebd25SJamal Hadi Salim 
1716980ebd25SJamal Hadi Salim 	/*   build an XP */
1717b4ad86bfSDavid S. Miller 	xp = xfrm_policy_construct(&ua->policy, (struct rtattr **) xfrma, &err);
1718b4ad86bfSDavid S. Miller 	if (!xp) {
1719980ebd25SJamal Hadi Salim 		kfree(x);
1720980ebd25SJamal Hadi Salim 		return err;
1721980ebd25SJamal Hadi Salim 	}
1722980ebd25SJamal Hadi Salim 
1723980ebd25SJamal Hadi Salim 	memcpy(&x->id, &ua->id, sizeof(ua->id));
1724980ebd25SJamal Hadi Salim 	memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
1725980ebd25SJamal Hadi Salim 	memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
1726980ebd25SJamal Hadi Salim 
1727980ebd25SJamal Hadi Salim 	ut = RTA_DATA(rt);
1728980ebd25SJamal Hadi Salim 	/* extract the templates and for each call km_key */
1729980ebd25SJamal Hadi Salim 	for (i = 0; i < xp->xfrm_nr; i++, ut++) {
1730980ebd25SJamal Hadi Salim 		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
1731980ebd25SJamal Hadi Salim 		memcpy(&x->id, &t->id, sizeof(x->id));
1732980ebd25SJamal Hadi Salim 		x->props.mode = t->mode;
1733980ebd25SJamal Hadi Salim 		x->props.reqid = t->reqid;
1734980ebd25SJamal Hadi Salim 		x->props.family = ut->family;
1735980ebd25SJamal Hadi Salim 		t->aalgos = ua->aalgos;
1736980ebd25SJamal Hadi Salim 		t->ealgos = ua->ealgos;
1737980ebd25SJamal Hadi Salim 		t->calgos = ua->calgos;
1738980ebd25SJamal Hadi Salim 		err = km_query(x, t, xp);
1739980ebd25SJamal Hadi Salim 
1740980ebd25SJamal Hadi Salim 	}
1741980ebd25SJamal Hadi Salim 
1742980ebd25SJamal Hadi Salim 	kfree(x);
1743980ebd25SJamal Hadi Salim 	kfree(xp);
1744980ebd25SJamal Hadi Salim 
1745980ebd25SJamal Hadi Salim 	return 0;
1746980ebd25SJamal Hadi Salim }
1747980ebd25SJamal Hadi Salim 
17485c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE
17495c79de6eSShinta Sugimoto static int verify_user_migrate(struct rtattr **xfrma)
17505c79de6eSShinta Sugimoto {
17515c79de6eSShinta Sugimoto 	struct rtattr *rt = xfrma[XFRMA_MIGRATE-1];
17525c79de6eSShinta Sugimoto 	struct xfrm_user_migrate *um;
17535c79de6eSShinta Sugimoto 
17545c79de6eSShinta Sugimoto 	if (!rt)
17555c79de6eSShinta Sugimoto 		return -EINVAL;
17565c79de6eSShinta Sugimoto 
17575c79de6eSShinta Sugimoto 	if ((rt->rta_len - sizeof(*rt)) < sizeof(*um))
17585c79de6eSShinta Sugimoto 		return -EINVAL;
17595c79de6eSShinta Sugimoto 
17605c79de6eSShinta Sugimoto 	return 0;
17615c79de6eSShinta Sugimoto }
17625c79de6eSShinta Sugimoto 
17635c79de6eSShinta Sugimoto static int copy_from_user_migrate(struct xfrm_migrate *ma,
17645c79de6eSShinta Sugimoto 				  struct rtattr **xfrma, int *num)
17655c79de6eSShinta Sugimoto {
17665c79de6eSShinta Sugimoto 	struct rtattr *rt = xfrma[XFRMA_MIGRATE-1];
17675c79de6eSShinta Sugimoto 	struct xfrm_user_migrate *um;
17685c79de6eSShinta Sugimoto 	int i, num_migrate;
17695c79de6eSShinta Sugimoto 
17705c79de6eSShinta Sugimoto 	um = RTA_DATA(rt);
17715c79de6eSShinta Sugimoto 	num_migrate = (rt->rta_len - sizeof(*rt)) / sizeof(*um);
17725c79de6eSShinta Sugimoto 
17735c79de6eSShinta Sugimoto 	if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
17745c79de6eSShinta Sugimoto 		return -EINVAL;
17755c79de6eSShinta Sugimoto 
17765c79de6eSShinta Sugimoto 	for (i = 0; i < num_migrate; i++, um++, ma++) {
17775c79de6eSShinta Sugimoto 		memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
17785c79de6eSShinta Sugimoto 		memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
17795c79de6eSShinta Sugimoto 		memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
17805c79de6eSShinta Sugimoto 		memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
17815c79de6eSShinta Sugimoto 
17825c79de6eSShinta Sugimoto 		ma->proto = um->proto;
17835c79de6eSShinta Sugimoto 		ma->mode = um->mode;
17845c79de6eSShinta Sugimoto 		ma->reqid = um->reqid;
17855c79de6eSShinta Sugimoto 
17865c79de6eSShinta Sugimoto 		ma->old_family = um->old_family;
17875c79de6eSShinta Sugimoto 		ma->new_family = um->new_family;
17885c79de6eSShinta Sugimoto 	}
17895c79de6eSShinta Sugimoto 
17905c79de6eSShinta Sugimoto 	*num = i;
17915c79de6eSShinta Sugimoto 	return 0;
17925c79de6eSShinta Sugimoto }
17935c79de6eSShinta Sugimoto 
17945c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
17955c79de6eSShinta Sugimoto 			   struct rtattr **xfrma)
17965c79de6eSShinta Sugimoto {
1797*7b67c857SThomas Graf 	struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
17985c79de6eSShinta Sugimoto 	struct xfrm_migrate m[XFRM_MAX_DEPTH];
17995c79de6eSShinta Sugimoto 	u8 type;
18005c79de6eSShinta Sugimoto 	int err;
18015c79de6eSShinta Sugimoto 	int n = 0;
18025c79de6eSShinta Sugimoto 
18035c79de6eSShinta Sugimoto 	err = verify_user_migrate((struct rtattr **)xfrma);
18045c79de6eSShinta Sugimoto 	if (err)
18055c79de6eSShinta Sugimoto 		return err;
18065c79de6eSShinta Sugimoto 
18075c79de6eSShinta Sugimoto 	err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
18085c79de6eSShinta Sugimoto 	if (err)
18095c79de6eSShinta Sugimoto 		return err;
18105c79de6eSShinta Sugimoto 
18115c79de6eSShinta Sugimoto 	err = copy_from_user_migrate((struct xfrm_migrate *)m,
18125c79de6eSShinta Sugimoto 				     (struct rtattr **)xfrma, &n);
18135c79de6eSShinta Sugimoto 	if (err)
18145c79de6eSShinta Sugimoto 		return err;
18155c79de6eSShinta Sugimoto 
18165c79de6eSShinta Sugimoto 	if (!n)
18175c79de6eSShinta Sugimoto 		return 0;
18185c79de6eSShinta Sugimoto 
18195c79de6eSShinta Sugimoto 	xfrm_migrate(&pi->sel, pi->dir, type, m, n);
18205c79de6eSShinta Sugimoto 
18215c79de6eSShinta Sugimoto 	return 0;
18225c79de6eSShinta Sugimoto }
18235c79de6eSShinta Sugimoto #else
18245c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
18255c79de6eSShinta Sugimoto 			   struct rtattr **xfrma)
18265c79de6eSShinta Sugimoto {
18275c79de6eSShinta Sugimoto 	return -ENOPROTOOPT;
18285c79de6eSShinta Sugimoto }
18295c79de6eSShinta Sugimoto #endif
18305c79de6eSShinta Sugimoto 
18315c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE
18325c79de6eSShinta Sugimoto static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb)
18335c79de6eSShinta Sugimoto {
18345c79de6eSShinta Sugimoto 	struct xfrm_user_migrate um;
18355c79de6eSShinta Sugimoto 
18365c79de6eSShinta Sugimoto 	memset(&um, 0, sizeof(um));
18375c79de6eSShinta Sugimoto 	um.proto = m->proto;
18385c79de6eSShinta Sugimoto 	um.mode = m->mode;
18395c79de6eSShinta Sugimoto 	um.reqid = m->reqid;
18405c79de6eSShinta Sugimoto 	um.old_family = m->old_family;
18415c79de6eSShinta Sugimoto 	memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
18425c79de6eSShinta Sugimoto 	memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
18435c79de6eSShinta Sugimoto 	um.new_family = m->new_family;
18445c79de6eSShinta Sugimoto 	memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
18455c79de6eSShinta Sugimoto 	memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
18465c79de6eSShinta Sugimoto 
18475c79de6eSShinta Sugimoto 	RTA_PUT(skb, XFRMA_MIGRATE, sizeof(um), &um);
18485c79de6eSShinta Sugimoto 	return 0;
18495c79de6eSShinta Sugimoto 
18505c79de6eSShinta Sugimoto rtattr_failure:
18515c79de6eSShinta Sugimoto 	return -1;
18525c79de6eSShinta Sugimoto }
18535c79de6eSShinta Sugimoto 
18545c79de6eSShinta Sugimoto static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
18555c79de6eSShinta Sugimoto 			 int num_migrate, struct xfrm_selector *sel,
18565c79de6eSShinta Sugimoto 			 u8 dir, u8 type)
18575c79de6eSShinta Sugimoto {
18585c79de6eSShinta Sugimoto 	struct xfrm_migrate *mp;
18595c79de6eSShinta Sugimoto 	struct xfrm_userpolicy_id *pol_id;
18605c79de6eSShinta Sugimoto 	struct nlmsghdr *nlh;
18615c79de6eSShinta Sugimoto 	int i;
18625c79de6eSShinta Sugimoto 
186379b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
186479b8b7f4SThomas Graf 	if (nlh == NULL)
186579b8b7f4SThomas Graf 		return -EMSGSIZE;
18665c79de6eSShinta Sugimoto 
1867*7b67c857SThomas Graf 	pol_id = nlmsg_data(nlh);
18685c79de6eSShinta Sugimoto 	/* copy data from selector, dir, and type to the pol_id */
18695c79de6eSShinta Sugimoto 	memset(pol_id, 0, sizeof(*pol_id));
18705c79de6eSShinta Sugimoto 	memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
18715c79de6eSShinta Sugimoto 	pol_id->dir = dir;
18725c79de6eSShinta Sugimoto 
18735c79de6eSShinta Sugimoto 	if (copy_to_user_policy_type(type, skb) < 0)
18745c79de6eSShinta Sugimoto 		goto nlmsg_failure;
18755c79de6eSShinta Sugimoto 
18765c79de6eSShinta Sugimoto 	for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
18775c79de6eSShinta Sugimoto 		if (copy_to_user_migrate(mp, skb) < 0)
18785c79de6eSShinta Sugimoto 			goto nlmsg_failure;
18795c79de6eSShinta Sugimoto 	}
18805c79de6eSShinta Sugimoto 
18819825069dSThomas Graf 	return nlmsg_end(skb, nlh);
18825c79de6eSShinta Sugimoto nlmsg_failure:
18839825069dSThomas Graf 	nlmsg_cancel(skb, nlh);
18849825069dSThomas Graf 	return -EMSGSIZE;
18855c79de6eSShinta Sugimoto }
18865c79de6eSShinta Sugimoto 
18875c79de6eSShinta Sugimoto static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
18885c79de6eSShinta Sugimoto 			     struct xfrm_migrate *m, int num_migrate)
18895c79de6eSShinta Sugimoto {
18905c79de6eSShinta Sugimoto 	struct sk_buff *skb;
18915c79de6eSShinta Sugimoto 	size_t len;
18925c79de6eSShinta Sugimoto 
18935c79de6eSShinta Sugimoto 	len = RTA_SPACE(sizeof(struct xfrm_user_migrate) * num_migrate);
18945c79de6eSShinta Sugimoto 	len += NLMSG_SPACE(sizeof(struct xfrm_userpolicy_id));
18955c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_SUB_POLICY
18965c79de6eSShinta Sugimoto 	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
18975c79de6eSShinta Sugimoto #endif
18985c79de6eSShinta Sugimoto 	skb = alloc_skb(len, GFP_ATOMIC);
18995c79de6eSShinta Sugimoto 	if (skb == NULL)
19005c79de6eSShinta Sugimoto 		return -ENOMEM;
19015c79de6eSShinta Sugimoto 
19025c79de6eSShinta Sugimoto 	/* build migrate */
19035c79de6eSShinta Sugimoto 	if (build_migrate(skb, m, num_migrate, sel, dir, type) < 0)
19045c79de6eSShinta Sugimoto 		BUG();
19055c79de6eSShinta Sugimoto 
19065c79de6eSShinta Sugimoto 	NETLINK_CB(skb).dst_group = XFRMNLGRP_MIGRATE;
19075c79de6eSShinta Sugimoto 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_MIGRATE,
19085c79de6eSShinta Sugimoto 				 GFP_ATOMIC);
19095c79de6eSShinta Sugimoto }
19105c79de6eSShinta Sugimoto #else
19115c79de6eSShinta Sugimoto static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
19125c79de6eSShinta Sugimoto 			     struct xfrm_migrate *m, int num_migrate)
19135c79de6eSShinta Sugimoto {
19145c79de6eSShinta Sugimoto 	return -ENOPROTOOPT;
19155c79de6eSShinta Sugimoto }
19165c79de6eSShinta Sugimoto #endif
1917d51d081dSJamal Hadi Salim 
1918492b558bSThomas Graf #define XMSGSIZE(type) NLMSG_LENGTH(sizeof(struct type))
1919492b558bSThomas Graf 
1920492b558bSThomas Graf static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
1921492b558bSThomas Graf 	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
1922492b558bSThomas Graf 	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
1923492b558bSThomas Graf 	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
1924492b558bSThomas Graf 	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
1925492b558bSThomas Graf 	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1926492b558bSThomas Graf 	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1927492b558bSThomas Graf 	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
1928980ebd25SJamal Hadi Salim 	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
192953bc6b4dSJamal Hadi Salim 	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
1930492b558bSThomas Graf 	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
1931492b558bSThomas Graf 	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
19326c5c8ca7SJamal Hadi Salim 	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
1933492b558bSThomas Graf 	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
1934492b558bSThomas Graf 	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = NLMSG_LENGTH(0),
1935d51d081dSJamal Hadi Salim 	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
1936d51d081dSJamal Hadi Salim 	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
193797a64b45SMasahide NAKAMURA 	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
19385c79de6eSShinta Sugimoto 	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1939566ec034SJamal Hadi Salim 	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = NLMSG_LENGTH(sizeof(u32)),
1940ecfd6b18SJamal Hadi Salim 	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = NLMSG_LENGTH(sizeof(u32)),
19411da177e4SLinus Torvalds };
19421da177e4SLinus Torvalds 
1943492b558bSThomas Graf #undef XMSGSIZE
1944492b558bSThomas Graf 
19451da177e4SLinus Torvalds static struct xfrm_link {
194622e70050SChristoph Hellwig 	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct rtattr **);
19471da177e4SLinus Torvalds 	int (*dump)(struct sk_buff *, struct netlink_callback *);
1948492b558bSThomas Graf } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
1949492b558bSThomas Graf 	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
1950492b558bSThomas Graf 	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
1951492b558bSThomas Graf 	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
1952492b558bSThomas Graf 						   .dump = xfrm_dump_sa       },
1953492b558bSThomas Graf 	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
1954492b558bSThomas Graf 	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
1955492b558bSThomas Graf 	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
1956492b558bSThomas Graf 						   .dump = xfrm_dump_policy   },
1957492b558bSThomas Graf 	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
1958980ebd25SJamal Hadi Salim 	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
195953bc6b4dSJamal Hadi Salim 	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
1960492b558bSThomas Graf 	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
1961492b558bSThomas Graf 	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
19626c5c8ca7SJamal Hadi Salim 	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
1963492b558bSThomas Graf 	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
1964492b558bSThomas Graf 	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
1965d51d081dSJamal Hadi Salim 	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = { .doit = xfrm_new_ae  },
1966d51d081dSJamal Hadi Salim 	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = { .doit = xfrm_get_ae  },
19675c79de6eSShinta Sugimoto 	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate    },
196828d8909bSJamal Hadi Salim 	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo   },
1969ecfd6b18SJamal Hadi Salim 	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo   },
19701da177e4SLinus Torvalds };
19711da177e4SLinus Torvalds 
19721d00a4ebSThomas Graf static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
19731da177e4SLinus Torvalds {
19741da177e4SLinus Torvalds 	struct rtattr *xfrma[XFRMA_MAX];
19751da177e4SLinus Torvalds 	struct xfrm_link *link;
1976c702e804SThomas Graf 	int type, min_len;
19771da177e4SLinus Torvalds 
19781da177e4SLinus Torvalds 	type = nlh->nlmsg_type;
19791da177e4SLinus Torvalds 	if (type > XFRM_MSG_MAX)
19801d00a4ebSThomas Graf 		return -EINVAL;
19811da177e4SLinus Torvalds 
19821da177e4SLinus Torvalds 	type -= XFRM_MSG_BASE;
19831da177e4SLinus Torvalds 	link = &xfrm_dispatch[type];
19841da177e4SLinus Torvalds 
19851da177e4SLinus Torvalds 	/* All operations require privileges, even GET */
19861d00a4ebSThomas Graf 	if (security_netlink_recv(skb, CAP_NET_ADMIN))
19871d00a4ebSThomas Graf 		return -EPERM;
19881da177e4SLinus Torvalds 
1989492b558bSThomas Graf 	if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
1990492b558bSThomas Graf 	     type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
1991492b558bSThomas Graf 	    (nlh->nlmsg_flags & NLM_F_DUMP)) {
19921da177e4SLinus Torvalds 		if (link->dump == NULL)
19931d00a4ebSThomas Graf 			return -EINVAL;
19941da177e4SLinus Torvalds 
1995c702e804SThomas Graf 		return netlink_dump_start(xfrm_nl, skb, nlh, link->dump, NULL);
19961da177e4SLinus Torvalds 	}
19971da177e4SLinus Torvalds 
19981da177e4SLinus Torvalds 	memset(xfrma, 0, sizeof(xfrma));
19991da177e4SLinus Torvalds 
20001da177e4SLinus Torvalds 	if (nlh->nlmsg_len < (min_len = xfrm_msg_min[type]))
20011d00a4ebSThomas Graf 		return -EINVAL;
20021da177e4SLinus Torvalds 
20031da177e4SLinus Torvalds 	if (nlh->nlmsg_len > min_len) {
20041da177e4SLinus Torvalds 		int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
20051da177e4SLinus Torvalds 		struct rtattr *attr = (void *) nlh + NLMSG_ALIGN(min_len);
20061da177e4SLinus Torvalds 
20071da177e4SLinus Torvalds 		while (RTA_OK(attr, attrlen)) {
20081da177e4SLinus Torvalds 			unsigned short flavor = attr->rta_type;
20091da177e4SLinus Torvalds 			if (flavor) {
20101da177e4SLinus Torvalds 				if (flavor > XFRMA_MAX)
20111d00a4ebSThomas Graf 					return -EINVAL;
20121da177e4SLinus Torvalds 				xfrma[flavor - 1] = attr;
20131da177e4SLinus Torvalds 			}
20141da177e4SLinus Torvalds 			attr = RTA_NEXT(attr, attrlen);
20151da177e4SLinus Torvalds 		}
20161da177e4SLinus Torvalds 	}
20171da177e4SLinus Torvalds 
20181da177e4SLinus Torvalds 	if (link->doit == NULL)
20191d00a4ebSThomas Graf 		return -EINVAL;
20201da177e4SLinus Torvalds 
20211d00a4ebSThomas Graf 	return link->doit(skb, nlh, xfrma);
20221da177e4SLinus Torvalds }
20231da177e4SLinus Torvalds 
20241da177e4SLinus Torvalds static void xfrm_netlink_rcv(struct sock *sk, int len)
20251da177e4SLinus Torvalds {
202688fc2c84SThomas Graf 	unsigned int qlen = 0;
20272a0a6ebeSHerbert Xu 
20281da177e4SLinus Torvalds 	do {
20294a3e2f71SArjan van de Ven 		mutex_lock(&xfrm_cfg_mutex);
203088fc2c84SThomas Graf 		netlink_run_queue(sk, &qlen, &xfrm_user_rcv_msg);
20314a3e2f71SArjan van de Ven 		mutex_unlock(&xfrm_cfg_mutex);
20321da177e4SLinus Torvalds 
20332a0a6ebeSHerbert Xu 	} while (qlen);
20341da177e4SLinus Torvalds }
20351da177e4SLinus Torvalds 
2036d51d081dSJamal Hadi Salim static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
20371da177e4SLinus Torvalds {
20381da177e4SLinus Torvalds 	struct xfrm_user_expire *ue;
20391da177e4SLinus Torvalds 	struct nlmsghdr *nlh;
20401da177e4SLinus Torvalds 
204179b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
204279b8b7f4SThomas Graf 	if (nlh == NULL)
204379b8b7f4SThomas Graf 		return -EMSGSIZE;
20441da177e4SLinus Torvalds 
2045*7b67c857SThomas Graf 	ue = nlmsg_data(nlh);
20461da177e4SLinus Torvalds 	copy_to_user_state(x, &ue->state);
2047d51d081dSJamal Hadi Salim 	ue->hard = (c->data.hard != 0) ? 1 : 0;
20481da177e4SLinus Torvalds 
20499825069dSThomas Graf 	return nlmsg_end(skb, nlh);
20501da177e4SLinus Torvalds }
20511da177e4SLinus Torvalds 
205226b15dadSJamal Hadi Salim static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
20531da177e4SLinus Torvalds {
20541da177e4SLinus Torvalds 	struct sk_buff *skb;
2055ee57eef9SJamal Hadi Salim 	int len = NLMSG_LENGTH(sizeof(struct xfrm_user_expire));
20561da177e4SLinus Torvalds 
2057ee57eef9SJamal Hadi Salim 	skb = alloc_skb(len, GFP_ATOMIC);
20581da177e4SLinus Torvalds 	if (skb == NULL)
20591da177e4SLinus Torvalds 		return -ENOMEM;
20601da177e4SLinus Torvalds 
2061d51d081dSJamal Hadi Salim 	if (build_expire(skb, x, c) < 0)
20621da177e4SLinus Torvalds 		BUG();
20631da177e4SLinus Torvalds 
2064ac6d439dSPatrick McHardy 	NETLINK_CB(skb).dst_group = XFRMNLGRP_EXPIRE;
2065ac6d439dSPatrick McHardy 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
20661da177e4SLinus Torvalds }
20671da177e4SLinus Torvalds 
2068d51d081dSJamal Hadi Salim static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c)
2069d51d081dSJamal Hadi Salim {
2070d51d081dSJamal Hadi Salim 	struct sk_buff *skb;
2071d51d081dSJamal Hadi Salim 	int len = NLMSG_LENGTH(sizeof(struct xfrm_aevent_id));
2072d51d081dSJamal Hadi Salim 
2073d51d081dSJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_replay_state));
2074d51d081dSJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_lifetime_cur));
2075d51d081dSJamal Hadi Salim 	skb = alloc_skb(len, GFP_ATOMIC);
2076d51d081dSJamal Hadi Salim 	if (skb == NULL)
2077d51d081dSJamal Hadi Salim 		return -ENOMEM;
2078d51d081dSJamal Hadi Salim 
2079d51d081dSJamal Hadi Salim 	if (build_aevent(skb, x, c) < 0)
2080d51d081dSJamal Hadi Salim 		BUG();
2081d51d081dSJamal Hadi Salim 
2082d51d081dSJamal Hadi Salim 	NETLINK_CB(skb).dst_group = XFRMNLGRP_AEVENTS;
2083d51d081dSJamal Hadi Salim 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
2084d51d081dSJamal Hadi Salim }
2085d51d081dSJamal Hadi Salim 
208626b15dadSJamal Hadi Salim static int xfrm_notify_sa_flush(struct km_event *c)
208726b15dadSJamal Hadi Salim {
208826b15dadSJamal Hadi Salim 	struct xfrm_usersa_flush *p;
208926b15dadSJamal Hadi Salim 	struct nlmsghdr *nlh;
209026b15dadSJamal Hadi Salim 	struct sk_buff *skb;
209126b15dadSJamal Hadi Salim 	int len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush));
209226b15dadSJamal Hadi Salim 
209326b15dadSJamal Hadi Salim 	skb = alloc_skb(len, GFP_ATOMIC);
209426b15dadSJamal Hadi Salim 	if (skb == NULL)
209526b15dadSJamal Hadi Salim 		return -ENOMEM;
209626b15dadSJamal Hadi Salim 
209779b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
209879b8b7f4SThomas Graf 	if (nlh == NULL) {
209979b8b7f4SThomas Graf 		kfree_skb(skb);
210079b8b7f4SThomas Graf 		return -EMSGSIZE;
210179b8b7f4SThomas Graf 	}
210226b15dadSJamal Hadi Salim 
2103*7b67c857SThomas Graf 	p = nlmsg_data(nlh);
2104bf08867fSHerbert Xu 	p->proto = c->data.proto;
210526b15dadSJamal Hadi Salim 
21069825069dSThomas Graf 	nlmsg_end(skb, nlh);
210726b15dadSJamal Hadi Salim 
2108ac6d439dSPatrick McHardy 	NETLINK_CB(skb).dst_group = XFRMNLGRP_SA;
2109ac6d439dSPatrick McHardy 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
211026b15dadSJamal Hadi Salim }
211126b15dadSJamal Hadi Salim 
2112b6f99a21SDave Jones static inline int xfrm_sa_len(struct xfrm_state *x)
211326b15dadSJamal Hadi Salim {
21140603eac0SHerbert Xu 	int l = 0;
211526b15dadSJamal Hadi Salim 	if (x->aalg)
211626b15dadSJamal Hadi Salim 		l += RTA_SPACE(sizeof(*x->aalg) + (x->aalg->alg_key_len+7)/8);
211726b15dadSJamal Hadi Salim 	if (x->ealg)
211826b15dadSJamal Hadi Salim 		l += RTA_SPACE(sizeof(*x->ealg) + (x->ealg->alg_key_len+7)/8);
211926b15dadSJamal Hadi Salim 	if (x->calg)
212026b15dadSJamal Hadi Salim 		l += RTA_SPACE(sizeof(*x->calg));
212126b15dadSJamal Hadi Salim 	if (x->encap)
212226b15dadSJamal Hadi Salim 		l += RTA_SPACE(sizeof(*x->encap));
212326b15dadSJamal Hadi Salim 
212426b15dadSJamal Hadi Salim 	return l;
212526b15dadSJamal Hadi Salim }
212626b15dadSJamal Hadi Salim 
212726b15dadSJamal Hadi Salim static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
212826b15dadSJamal Hadi Salim {
212926b15dadSJamal Hadi Salim 	struct xfrm_usersa_info *p;
21300603eac0SHerbert Xu 	struct xfrm_usersa_id *id;
213126b15dadSJamal Hadi Salim 	struct nlmsghdr *nlh;
213226b15dadSJamal Hadi Salim 	struct sk_buff *skb;
213326b15dadSJamal Hadi Salim 	int len = xfrm_sa_len(x);
21340603eac0SHerbert Xu 	int headlen;
21350603eac0SHerbert Xu 
21360603eac0SHerbert Xu 	headlen = sizeof(*p);
21370603eac0SHerbert Xu 	if (c->event == XFRM_MSG_DELSA) {
21380603eac0SHerbert Xu 		len += RTA_SPACE(headlen);
21390603eac0SHerbert Xu 		headlen = sizeof(*id);
21400603eac0SHerbert Xu 	}
21410603eac0SHerbert Xu 	len += NLMSG_SPACE(headlen);
214226b15dadSJamal Hadi Salim 
214326b15dadSJamal Hadi Salim 	skb = alloc_skb(len, GFP_ATOMIC);
214426b15dadSJamal Hadi Salim 	if (skb == NULL)
214526b15dadSJamal Hadi Salim 		return -ENOMEM;
214626b15dadSJamal Hadi Salim 
214779b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
214879b8b7f4SThomas Graf 	if (nlh == NULL)
214979b8b7f4SThomas Graf 		goto nlmsg_failure;
215026b15dadSJamal Hadi Salim 
2151*7b67c857SThomas Graf 	p = nlmsg_data(nlh);
21520603eac0SHerbert Xu 	if (c->event == XFRM_MSG_DELSA) {
2153*7b67c857SThomas Graf 		id = nlmsg_data(nlh);
21540603eac0SHerbert Xu 		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
21550603eac0SHerbert Xu 		id->spi = x->id.spi;
21560603eac0SHerbert Xu 		id->family = x->props.family;
21570603eac0SHerbert Xu 		id->proto = x->id.proto;
21580603eac0SHerbert Xu 
21590603eac0SHerbert Xu 		p = RTA_DATA(__RTA_PUT(skb, XFRMA_SA, sizeof(*p)));
21600603eac0SHerbert Xu 	}
21610603eac0SHerbert Xu 
216226b15dadSJamal Hadi Salim 	copy_to_user_state(x, p);
216326b15dadSJamal Hadi Salim 
216426b15dadSJamal Hadi Salim 	if (x->aalg)
216526b15dadSJamal Hadi Salim 		RTA_PUT(skb, XFRMA_ALG_AUTH,
216626b15dadSJamal Hadi Salim 			sizeof(*(x->aalg))+(x->aalg->alg_key_len+7)/8, x->aalg);
216726b15dadSJamal Hadi Salim 	if (x->ealg)
216826b15dadSJamal Hadi Salim 		RTA_PUT(skb, XFRMA_ALG_CRYPT,
216926b15dadSJamal Hadi Salim 			sizeof(*(x->ealg))+(x->ealg->alg_key_len+7)/8, x->ealg);
217026b15dadSJamal Hadi Salim 	if (x->calg)
217126b15dadSJamal Hadi Salim 		RTA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
217226b15dadSJamal Hadi Salim 
217326b15dadSJamal Hadi Salim 	if (x->encap)
217426b15dadSJamal Hadi Salim 		RTA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
217526b15dadSJamal Hadi Salim 
21769825069dSThomas Graf 	nlmsg_end(skb, nlh);
217726b15dadSJamal Hadi Salim 
2178ac6d439dSPatrick McHardy 	NETLINK_CB(skb).dst_group = XFRMNLGRP_SA;
2179ac6d439dSPatrick McHardy 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
218026b15dadSJamal Hadi Salim 
218126b15dadSJamal Hadi Salim nlmsg_failure:
218226b15dadSJamal Hadi Salim rtattr_failure:
218326b15dadSJamal Hadi Salim 	kfree_skb(skb);
218426b15dadSJamal Hadi Salim 	return -1;
218526b15dadSJamal Hadi Salim }
218626b15dadSJamal Hadi Salim 
218726b15dadSJamal Hadi Salim static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c)
218826b15dadSJamal Hadi Salim {
218926b15dadSJamal Hadi Salim 
219026b15dadSJamal Hadi Salim 	switch (c->event) {
2191f60f6b8fSHerbert Xu 	case XFRM_MSG_EXPIRE:
219226b15dadSJamal Hadi Salim 		return xfrm_exp_state_notify(x, c);
2193d51d081dSJamal Hadi Salim 	case XFRM_MSG_NEWAE:
2194d51d081dSJamal Hadi Salim 		return xfrm_aevent_state_notify(x, c);
2195f60f6b8fSHerbert Xu 	case XFRM_MSG_DELSA:
2196f60f6b8fSHerbert Xu 	case XFRM_MSG_UPDSA:
2197f60f6b8fSHerbert Xu 	case XFRM_MSG_NEWSA:
219826b15dadSJamal Hadi Salim 		return xfrm_notify_sa(x, c);
2199f60f6b8fSHerbert Xu 	case XFRM_MSG_FLUSHSA:
220026b15dadSJamal Hadi Salim 		return xfrm_notify_sa_flush(c);
220126b15dadSJamal Hadi Salim 	default:
220226b15dadSJamal Hadi Salim 		 printk("xfrm_user: Unknown SA event %d\n", c->event);
220326b15dadSJamal Hadi Salim 		 break;
220426b15dadSJamal Hadi Salim 	}
220526b15dadSJamal Hadi Salim 
220626b15dadSJamal Hadi Salim 	return 0;
220726b15dadSJamal Hadi Salim 
220826b15dadSJamal Hadi Salim }
220926b15dadSJamal Hadi Salim 
22101da177e4SLinus Torvalds static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
22111da177e4SLinus Torvalds 			 struct xfrm_tmpl *xt, struct xfrm_policy *xp,
22121da177e4SLinus Torvalds 			 int dir)
22131da177e4SLinus Torvalds {
22141da177e4SLinus Torvalds 	struct xfrm_user_acquire *ua;
22151da177e4SLinus Torvalds 	struct nlmsghdr *nlh;
22161da177e4SLinus Torvalds 	__u32 seq = xfrm_get_acqseq();
22171da177e4SLinus Torvalds 
221879b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
221979b8b7f4SThomas Graf 	if (nlh == NULL)
222079b8b7f4SThomas Graf 		return -EMSGSIZE;
22211da177e4SLinus Torvalds 
2222*7b67c857SThomas Graf 	ua = nlmsg_data(nlh);
22231da177e4SLinus Torvalds 	memcpy(&ua->id, &x->id, sizeof(ua->id));
22241da177e4SLinus Torvalds 	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
22251da177e4SLinus Torvalds 	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
22261da177e4SLinus Torvalds 	copy_to_user_policy(xp, &ua->policy, dir);
22271da177e4SLinus Torvalds 	ua->aalgos = xt->aalgos;
22281da177e4SLinus Torvalds 	ua->ealgos = xt->ealgos;
22291da177e4SLinus Torvalds 	ua->calgos = xt->calgos;
22301da177e4SLinus Torvalds 	ua->seq = x->km.seq = seq;
22311da177e4SLinus Torvalds 
22321da177e4SLinus Torvalds 	if (copy_to_user_tmpl(xp, skb) < 0)
22331da177e4SLinus Torvalds 		goto nlmsg_failure;
22340d681623SSerge Hallyn 	if (copy_to_user_state_sec_ctx(x, skb))
2235df71837dSTrent Jaeger 		goto nlmsg_failure;
22361459bb36SJamal Hadi Salim 	if (copy_to_user_policy_type(xp->type, skb) < 0)
2237f7b6983fSMasahide NAKAMURA 		goto nlmsg_failure;
22381da177e4SLinus Torvalds 
22399825069dSThomas Graf 	return nlmsg_end(skb, nlh);
22401da177e4SLinus Torvalds 
22411da177e4SLinus Torvalds nlmsg_failure:
22429825069dSThomas Graf 	nlmsg_cancel(skb, nlh);
22439825069dSThomas Graf 	return -EMSGSIZE;
22441da177e4SLinus Torvalds }
22451da177e4SLinus Torvalds 
22461da177e4SLinus Torvalds static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
22471da177e4SLinus Torvalds 			     struct xfrm_policy *xp, int dir)
22481da177e4SLinus Torvalds {
22491da177e4SLinus Torvalds 	struct sk_buff *skb;
22501da177e4SLinus Torvalds 	size_t len;
22511da177e4SLinus Torvalds 
22521da177e4SLinus Torvalds 	len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
22531da177e4SLinus Torvalds 	len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
2254661697f7SJoy Latten 	len += RTA_SPACE(xfrm_user_sec_ctx_size(x->security));
2255785fd8b8SJamal Hadi Salim #ifdef CONFIG_XFRM_SUB_POLICY
2256785fd8b8SJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
2257785fd8b8SJamal Hadi Salim #endif
22581da177e4SLinus Torvalds 	skb = alloc_skb(len, GFP_ATOMIC);
22591da177e4SLinus Torvalds 	if (skb == NULL)
22601da177e4SLinus Torvalds 		return -ENOMEM;
22611da177e4SLinus Torvalds 
22621da177e4SLinus Torvalds 	if (build_acquire(skb, x, xt, xp, dir) < 0)
22631da177e4SLinus Torvalds 		BUG();
22641da177e4SLinus Torvalds 
2265ac6d439dSPatrick McHardy 	NETLINK_CB(skb).dst_group = XFRMNLGRP_ACQUIRE;
2266ac6d439dSPatrick McHardy 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
22671da177e4SLinus Torvalds }
22681da177e4SLinus Torvalds 
22691da177e4SLinus Torvalds /* User gives us xfrm_user_policy_info followed by an array of 0
22701da177e4SLinus Torvalds  * or more templates.
22711da177e4SLinus Torvalds  */
2272cb969f07SVenkat Yekkirala static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
22731da177e4SLinus Torvalds 					       u8 *data, int len, int *dir)
22741da177e4SLinus Torvalds {
22751da177e4SLinus Torvalds 	struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
22761da177e4SLinus Torvalds 	struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
22771da177e4SLinus Torvalds 	struct xfrm_policy *xp;
22781da177e4SLinus Torvalds 	int nr;
22791da177e4SLinus Torvalds 
2280cb969f07SVenkat Yekkirala 	switch (sk->sk_family) {
22811da177e4SLinus Torvalds 	case AF_INET:
22821da177e4SLinus Torvalds 		if (opt != IP_XFRM_POLICY) {
22831da177e4SLinus Torvalds 			*dir = -EOPNOTSUPP;
22841da177e4SLinus Torvalds 			return NULL;
22851da177e4SLinus Torvalds 		}
22861da177e4SLinus Torvalds 		break;
22871da177e4SLinus Torvalds #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
22881da177e4SLinus Torvalds 	case AF_INET6:
22891da177e4SLinus Torvalds 		if (opt != IPV6_XFRM_POLICY) {
22901da177e4SLinus Torvalds 			*dir = -EOPNOTSUPP;
22911da177e4SLinus Torvalds 			return NULL;
22921da177e4SLinus Torvalds 		}
22931da177e4SLinus Torvalds 		break;
22941da177e4SLinus Torvalds #endif
22951da177e4SLinus Torvalds 	default:
22961da177e4SLinus Torvalds 		*dir = -EINVAL;
22971da177e4SLinus Torvalds 		return NULL;
22981da177e4SLinus Torvalds 	}
22991da177e4SLinus Torvalds 
23001da177e4SLinus Torvalds 	*dir = -EINVAL;
23011da177e4SLinus Torvalds 
23021da177e4SLinus Torvalds 	if (len < sizeof(*p) ||
23031da177e4SLinus Torvalds 	    verify_newpolicy_info(p))
23041da177e4SLinus Torvalds 		return NULL;
23051da177e4SLinus Torvalds 
23061da177e4SLinus Torvalds 	nr = ((len - sizeof(*p)) / sizeof(*ut));
2307b4ad86bfSDavid S. Miller 	if (validate_tmpl(nr, ut, p->sel.family))
23081da177e4SLinus Torvalds 		return NULL;
23091da177e4SLinus Torvalds 
2310a4f1bac6SHerbert Xu 	if (p->dir > XFRM_POLICY_OUT)
2311a4f1bac6SHerbert Xu 		return NULL;
2312a4f1bac6SHerbert Xu 
23131da177e4SLinus Torvalds 	xp = xfrm_policy_alloc(GFP_KERNEL);
23141da177e4SLinus Torvalds 	if (xp == NULL) {
23151da177e4SLinus Torvalds 		*dir = -ENOBUFS;
23161da177e4SLinus Torvalds 		return NULL;
23171da177e4SLinus Torvalds 	}
23181da177e4SLinus Torvalds 
23191da177e4SLinus Torvalds 	copy_from_user_policy(xp, p);
2320f7b6983fSMasahide NAKAMURA 	xp->type = XFRM_POLICY_TYPE_MAIN;
23211da177e4SLinus Torvalds 	copy_templates(xp, ut, nr);
23221da177e4SLinus Torvalds 
23231da177e4SLinus Torvalds 	*dir = p->dir;
23241da177e4SLinus Torvalds 
23251da177e4SLinus Torvalds 	return xp;
23261da177e4SLinus Torvalds }
23271da177e4SLinus Torvalds 
23281da177e4SLinus Torvalds static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2329d51d081dSJamal Hadi Salim 			   int dir, struct km_event *c)
23301da177e4SLinus Torvalds {
23311da177e4SLinus Torvalds 	struct xfrm_user_polexpire *upe;
23321da177e4SLinus Torvalds 	struct nlmsghdr *nlh;
2333d51d081dSJamal Hadi Salim 	int hard = c->data.hard;
23341da177e4SLinus Torvalds 
233579b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
233679b8b7f4SThomas Graf 	if (nlh == NULL)
233779b8b7f4SThomas Graf 		return -EMSGSIZE;
23381da177e4SLinus Torvalds 
2339*7b67c857SThomas Graf 	upe = nlmsg_data(nlh);
23401da177e4SLinus Torvalds 	copy_to_user_policy(xp, &upe->pol, dir);
23411da177e4SLinus Torvalds 	if (copy_to_user_tmpl(xp, skb) < 0)
23421da177e4SLinus Torvalds 		goto nlmsg_failure;
2343df71837dSTrent Jaeger 	if (copy_to_user_sec_ctx(xp, skb))
2344df71837dSTrent Jaeger 		goto nlmsg_failure;
23451459bb36SJamal Hadi Salim 	if (copy_to_user_policy_type(xp->type, skb) < 0)
2346f7b6983fSMasahide NAKAMURA 		goto nlmsg_failure;
23471da177e4SLinus Torvalds 	upe->hard = !!hard;
23481da177e4SLinus Torvalds 
23499825069dSThomas Graf 	return nlmsg_end(skb, nlh);
23501da177e4SLinus Torvalds 
23511da177e4SLinus Torvalds nlmsg_failure:
23529825069dSThomas Graf 	nlmsg_cancel(skb, nlh);
23539825069dSThomas Graf 	return -EMSGSIZE;
23541da177e4SLinus Torvalds }
23551da177e4SLinus Torvalds 
235626b15dadSJamal Hadi Salim static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
23571da177e4SLinus Torvalds {
23581da177e4SLinus Torvalds 	struct sk_buff *skb;
23591da177e4SLinus Torvalds 	size_t len;
23601da177e4SLinus Torvalds 
23611da177e4SLinus Torvalds 	len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
23621da177e4SLinus Torvalds 	len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
2363661697f7SJoy Latten 	len += RTA_SPACE(xfrm_user_sec_ctx_size(xp->security));
2364785fd8b8SJamal Hadi Salim #ifdef CONFIG_XFRM_SUB_POLICY
2365785fd8b8SJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
2366785fd8b8SJamal Hadi Salim #endif
23671da177e4SLinus Torvalds 	skb = alloc_skb(len, GFP_ATOMIC);
23681da177e4SLinus Torvalds 	if (skb == NULL)
23691da177e4SLinus Torvalds 		return -ENOMEM;
23701da177e4SLinus Torvalds 
2371d51d081dSJamal Hadi Salim 	if (build_polexpire(skb, xp, dir, c) < 0)
23721da177e4SLinus Torvalds 		BUG();
23731da177e4SLinus Torvalds 
2374ac6d439dSPatrick McHardy 	NETLINK_CB(skb).dst_group = XFRMNLGRP_EXPIRE;
2375ac6d439dSPatrick McHardy 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
23761da177e4SLinus Torvalds }
23771da177e4SLinus Torvalds 
237826b15dadSJamal Hadi Salim static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
237926b15dadSJamal Hadi Salim {
238026b15dadSJamal Hadi Salim 	struct xfrm_userpolicy_info *p;
23810603eac0SHerbert Xu 	struct xfrm_userpolicy_id *id;
238226b15dadSJamal Hadi Salim 	struct nlmsghdr *nlh;
238326b15dadSJamal Hadi Salim 	struct sk_buff *skb;
238426b15dadSJamal Hadi Salim 	int len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
23850603eac0SHerbert Xu 	int headlen;
23860603eac0SHerbert Xu 
23870603eac0SHerbert Xu 	headlen = sizeof(*p);
23880603eac0SHerbert Xu 	if (c->event == XFRM_MSG_DELPOLICY) {
23890603eac0SHerbert Xu 		len += RTA_SPACE(headlen);
23900603eac0SHerbert Xu 		headlen = sizeof(*id);
23910603eac0SHerbert Xu 	}
2392334f3d45SJamal Hadi Salim #ifdef CONFIG_XFRM_SUB_POLICY
2393334f3d45SJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
2394334f3d45SJamal Hadi Salim #endif
23950603eac0SHerbert Xu 	len += NLMSG_SPACE(headlen);
239626b15dadSJamal Hadi Salim 
239726b15dadSJamal Hadi Salim 	skb = alloc_skb(len, GFP_ATOMIC);
239826b15dadSJamal Hadi Salim 	if (skb == NULL)
239926b15dadSJamal Hadi Salim 		return -ENOMEM;
240026b15dadSJamal Hadi Salim 
240179b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
240279b8b7f4SThomas Graf 	if (nlh == NULL)
240379b8b7f4SThomas Graf 		goto nlmsg_failure;
240426b15dadSJamal Hadi Salim 
2405*7b67c857SThomas Graf 	p = nlmsg_data(nlh);
24060603eac0SHerbert Xu 	if (c->event == XFRM_MSG_DELPOLICY) {
2407*7b67c857SThomas Graf 		id = nlmsg_data(nlh);
24080603eac0SHerbert Xu 		memset(id, 0, sizeof(*id));
24090603eac0SHerbert Xu 		id->dir = dir;
24100603eac0SHerbert Xu 		if (c->data.byid)
24110603eac0SHerbert Xu 			id->index = xp->index;
24120603eac0SHerbert Xu 		else
24130603eac0SHerbert Xu 			memcpy(&id->sel, &xp->selector, sizeof(id->sel));
24140603eac0SHerbert Xu 
24150603eac0SHerbert Xu 		p = RTA_DATA(__RTA_PUT(skb, XFRMA_POLICY, sizeof(*p)));
24160603eac0SHerbert Xu 	}
241726b15dadSJamal Hadi Salim 
241826b15dadSJamal Hadi Salim 	copy_to_user_policy(xp, p, dir);
241926b15dadSJamal Hadi Salim 	if (copy_to_user_tmpl(xp, skb) < 0)
242026b15dadSJamal Hadi Salim 		goto nlmsg_failure;
24211459bb36SJamal Hadi Salim 	if (copy_to_user_policy_type(xp->type, skb) < 0)
2422f7b6983fSMasahide NAKAMURA 		goto nlmsg_failure;
242326b15dadSJamal Hadi Salim 
24249825069dSThomas Graf 	nlmsg_end(skb, nlh);
242526b15dadSJamal Hadi Salim 
2426ac6d439dSPatrick McHardy 	NETLINK_CB(skb).dst_group = XFRMNLGRP_POLICY;
2427ac6d439dSPatrick McHardy 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
242826b15dadSJamal Hadi Salim 
242926b15dadSJamal Hadi Salim nlmsg_failure:
24300603eac0SHerbert Xu rtattr_failure:
243126b15dadSJamal Hadi Salim 	kfree_skb(skb);
243226b15dadSJamal Hadi Salim 	return -1;
243326b15dadSJamal Hadi Salim }
243426b15dadSJamal Hadi Salim 
243526b15dadSJamal Hadi Salim static int xfrm_notify_policy_flush(struct km_event *c)
243626b15dadSJamal Hadi Salim {
243726b15dadSJamal Hadi Salim 	struct nlmsghdr *nlh;
243826b15dadSJamal Hadi Salim 	struct sk_buff *skb;
2439785fd8b8SJamal Hadi Salim 	int len = 0;
2440f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY
2441785fd8b8SJamal Hadi Salim 	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
2442f7b6983fSMasahide NAKAMURA #endif
2443785fd8b8SJamal Hadi Salim 	len += NLMSG_LENGTH(0);
244426b15dadSJamal Hadi Salim 
244526b15dadSJamal Hadi Salim 	skb = alloc_skb(len, GFP_ATOMIC);
244626b15dadSJamal Hadi Salim 	if (skb == NULL)
244726b15dadSJamal Hadi Salim 		return -ENOMEM;
244826b15dadSJamal Hadi Salim 
244979b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
245079b8b7f4SThomas Graf 	if (nlh == NULL)
245179b8b7f4SThomas Graf 		goto nlmsg_failure;
24520c51f53cSJamal Hadi Salim 	if (copy_to_user_policy_type(c->data.type, skb) < 0)
24530c51f53cSJamal Hadi Salim 		goto nlmsg_failure;
245426b15dadSJamal Hadi Salim 
24559825069dSThomas Graf 	nlmsg_end(skb, nlh);
245626b15dadSJamal Hadi Salim 
2457ac6d439dSPatrick McHardy 	NETLINK_CB(skb).dst_group = XFRMNLGRP_POLICY;
2458ac6d439dSPatrick McHardy 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
245926b15dadSJamal Hadi Salim 
246026b15dadSJamal Hadi Salim nlmsg_failure:
246126b15dadSJamal Hadi Salim 	kfree_skb(skb);
246226b15dadSJamal Hadi Salim 	return -1;
246326b15dadSJamal Hadi Salim }
246426b15dadSJamal Hadi Salim 
246526b15dadSJamal Hadi Salim static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
246626b15dadSJamal Hadi Salim {
246726b15dadSJamal Hadi Salim 
246826b15dadSJamal Hadi Salim 	switch (c->event) {
2469f60f6b8fSHerbert Xu 	case XFRM_MSG_NEWPOLICY:
2470f60f6b8fSHerbert Xu 	case XFRM_MSG_UPDPOLICY:
2471f60f6b8fSHerbert Xu 	case XFRM_MSG_DELPOLICY:
247226b15dadSJamal Hadi Salim 		return xfrm_notify_policy(xp, dir, c);
2473f60f6b8fSHerbert Xu 	case XFRM_MSG_FLUSHPOLICY:
247426b15dadSJamal Hadi Salim 		return xfrm_notify_policy_flush(c);
2475f60f6b8fSHerbert Xu 	case XFRM_MSG_POLEXPIRE:
247626b15dadSJamal Hadi Salim 		return xfrm_exp_policy_notify(xp, dir, c);
247726b15dadSJamal Hadi Salim 	default:
247826b15dadSJamal Hadi Salim 		printk("xfrm_user: Unknown Policy event %d\n", c->event);
247926b15dadSJamal Hadi Salim 	}
248026b15dadSJamal Hadi Salim 
248126b15dadSJamal Hadi Salim 	return 0;
248226b15dadSJamal Hadi Salim 
248326b15dadSJamal Hadi Salim }
248426b15dadSJamal Hadi Salim 
248597a64b45SMasahide NAKAMURA static int build_report(struct sk_buff *skb, u8 proto,
248697a64b45SMasahide NAKAMURA 			struct xfrm_selector *sel, xfrm_address_t *addr)
248797a64b45SMasahide NAKAMURA {
248897a64b45SMasahide NAKAMURA 	struct xfrm_user_report *ur;
248997a64b45SMasahide NAKAMURA 	struct nlmsghdr *nlh;
249097a64b45SMasahide NAKAMURA 
249179b8b7f4SThomas Graf 	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
249279b8b7f4SThomas Graf 	if (nlh == NULL)
249379b8b7f4SThomas Graf 		return -EMSGSIZE;
249497a64b45SMasahide NAKAMURA 
2495*7b67c857SThomas Graf 	ur = nlmsg_data(nlh);
249697a64b45SMasahide NAKAMURA 	ur->proto = proto;
249797a64b45SMasahide NAKAMURA 	memcpy(&ur->sel, sel, sizeof(ur->sel));
249897a64b45SMasahide NAKAMURA 
249997a64b45SMasahide NAKAMURA 	if (addr)
250097a64b45SMasahide NAKAMURA 		RTA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
250197a64b45SMasahide NAKAMURA 
25029825069dSThomas Graf 	return nlmsg_end(skb, nlh);
250397a64b45SMasahide NAKAMURA 
250497a64b45SMasahide NAKAMURA rtattr_failure:
25059825069dSThomas Graf 	nlmsg_cancel(skb, nlh);
25069825069dSThomas Graf 	return -EMSGSIZE;
250797a64b45SMasahide NAKAMURA }
250897a64b45SMasahide NAKAMURA 
250997a64b45SMasahide NAKAMURA static int xfrm_send_report(u8 proto, struct xfrm_selector *sel,
251097a64b45SMasahide NAKAMURA 			    xfrm_address_t *addr)
251197a64b45SMasahide NAKAMURA {
251297a64b45SMasahide NAKAMURA 	struct sk_buff *skb;
251397a64b45SMasahide NAKAMURA 	size_t len;
251497a64b45SMasahide NAKAMURA 
251597a64b45SMasahide NAKAMURA 	len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(struct xfrm_user_report)));
251697a64b45SMasahide NAKAMURA 	skb = alloc_skb(len, GFP_ATOMIC);
251797a64b45SMasahide NAKAMURA 	if (skb == NULL)
251897a64b45SMasahide NAKAMURA 		return -ENOMEM;
251997a64b45SMasahide NAKAMURA 
252097a64b45SMasahide NAKAMURA 	if (build_report(skb, proto, sel, addr) < 0)
252197a64b45SMasahide NAKAMURA 		BUG();
252297a64b45SMasahide NAKAMURA 
252397a64b45SMasahide NAKAMURA 	NETLINK_CB(skb).dst_group = XFRMNLGRP_REPORT;
252497a64b45SMasahide NAKAMURA 	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
252597a64b45SMasahide NAKAMURA }
252697a64b45SMasahide NAKAMURA 
25271da177e4SLinus Torvalds static struct xfrm_mgr netlink_mgr = {
25281da177e4SLinus Torvalds 	.id		= "netlink",
25291da177e4SLinus Torvalds 	.notify		= xfrm_send_state_notify,
25301da177e4SLinus Torvalds 	.acquire	= xfrm_send_acquire,
25311da177e4SLinus Torvalds 	.compile_policy	= xfrm_compile_policy,
25321da177e4SLinus Torvalds 	.notify_policy	= xfrm_send_policy_notify,
253397a64b45SMasahide NAKAMURA 	.report		= xfrm_send_report,
25345c79de6eSShinta Sugimoto 	.migrate	= xfrm_send_migrate,
25351da177e4SLinus Torvalds };
25361da177e4SLinus Torvalds 
25371da177e4SLinus Torvalds static int __init xfrm_user_init(void)
25381da177e4SLinus Torvalds {
2539be33690dSPatrick McHardy 	struct sock *nlsk;
2540be33690dSPatrick McHardy 
2541654b32c6SMasahide NAKAMURA 	printk(KERN_INFO "Initializing XFRM netlink socket\n");
25421da177e4SLinus Torvalds 
2543be33690dSPatrick McHardy 	nlsk = netlink_kernel_create(NETLINK_XFRM, XFRMNLGRP_MAX,
2544af65bdfcSPatrick McHardy 				     xfrm_netlink_rcv, NULL, THIS_MODULE);
2545be33690dSPatrick McHardy 	if (nlsk == NULL)
25461da177e4SLinus Torvalds 		return -ENOMEM;
2547be33690dSPatrick McHardy 	rcu_assign_pointer(xfrm_nl, nlsk);
25481da177e4SLinus Torvalds 
25491da177e4SLinus Torvalds 	xfrm_register_km(&netlink_mgr);
25501da177e4SLinus Torvalds 
25511da177e4SLinus Torvalds 	return 0;
25521da177e4SLinus Torvalds }
25531da177e4SLinus Torvalds 
25541da177e4SLinus Torvalds static void __exit xfrm_user_exit(void)
25551da177e4SLinus Torvalds {
2556be33690dSPatrick McHardy 	struct sock *nlsk = xfrm_nl;
2557be33690dSPatrick McHardy 
25581da177e4SLinus Torvalds 	xfrm_unregister_km(&netlink_mgr);
2559be33690dSPatrick McHardy 	rcu_assign_pointer(xfrm_nl, NULL);
2560be33690dSPatrick McHardy 	synchronize_rcu();
2561be33690dSPatrick McHardy 	sock_release(nlsk->sk_socket);
25621da177e4SLinus Torvalds }
25631da177e4SLinus Torvalds 
25641da177e4SLinus Torvalds module_init(xfrm_user_init);
25651da177e4SLinus Torvalds module_exit(xfrm_user_exit);
25661da177e4SLinus Torvalds MODULE_LICENSE("GPL");
25674fdb3bb7SHarald Welte MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
2568f8cd5488SJamal Hadi Salim 
2569