11da177e4SLinus Torvalds /* xfrm_user.c: User interface to configure xfrm engine. 21da177e4SLinus Torvalds * 31da177e4SLinus Torvalds * Copyright (C) 2002 David S. Miller (davem@redhat.com) 41da177e4SLinus Torvalds * 51da177e4SLinus Torvalds * Changes: 61da177e4SLinus Torvalds * Mitsuru KANDA @USAGI 71da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI 81da177e4SLinus Torvalds * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 91da177e4SLinus Torvalds * IPv6 support 101da177e4SLinus Torvalds * 111da177e4SLinus Torvalds */ 121da177e4SLinus Torvalds 139409f38aSHerbert Xu #include <linux/crypto.h> 141da177e4SLinus Torvalds #include <linux/module.h> 151da177e4SLinus Torvalds #include <linux/kernel.h> 161da177e4SLinus Torvalds #include <linux/types.h> 171da177e4SLinus Torvalds #include <linux/slab.h> 181da177e4SLinus Torvalds #include <linux/socket.h> 191da177e4SLinus Torvalds #include <linux/string.h> 201da177e4SLinus Torvalds #include <linux/net.h> 211da177e4SLinus Torvalds #include <linux/skbuff.h> 221da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 231da177e4SLinus Torvalds #include <linux/ipsec.h> 241da177e4SLinus Torvalds #include <linux/init.h> 251da177e4SLinus Torvalds #include <linux/security.h> 261da177e4SLinus Torvalds #include <net/sock.h> 271da177e4SLinus Torvalds #include <net/xfrm.h> 2888fc2c84SThomas Graf #include <net/netlink.h> 29fa6dd8a2SNicolas Dichtel #include <net/ah.h> 307c0f6ba6SLinus Torvalds #include <linux/uaccess.h> 31dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 32e23c7194SMasahide NAKAMURA #include <linux/in6.h> 33e23c7194SMasahide NAKAMURA #endif 34e33d4f13SSowmini Varadhan #include <asm/unaligned.h> 351da177e4SLinus Torvalds 365424f32eSThomas Graf static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type) 371da177e4SLinus Torvalds { 385424f32eSThomas Graf struct nlattr *rt = attrs[type]; 391da177e4SLinus Torvalds struct xfrm_algo *algp; 401da177e4SLinus Torvalds 411da177e4SLinus Torvalds if (!rt) 421da177e4SLinus Torvalds return 0; 431da177e4SLinus Torvalds 445424f32eSThomas Graf algp = nla_data(rt); 450f99be0dSEric Dumazet if (nla_len(rt) < xfrm_alg_len(algp)) 4631c26852SHerbert Xu return -EINVAL; 4731c26852SHerbert Xu 481da177e4SLinus Torvalds switch (type) { 491da177e4SLinus Torvalds case XFRMA_ALG_AUTH: 501da177e4SLinus Torvalds case XFRMA_ALG_CRYPT: 511da177e4SLinus Torvalds case XFRMA_ALG_COMP: 521da177e4SLinus Torvalds break; 531da177e4SLinus Torvalds 541da177e4SLinus Torvalds default: 551da177e4SLinus Torvalds return -EINVAL; 563ff50b79SStephen Hemminger } 571da177e4SLinus Torvalds 58633439f5SHerbert Xu algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 591da177e4SLinus Torvalds return 0; 601da177e4SLinus Torvalds } 611da177e4SLinus Torvalds 624447bb33SMartin Willi static int verify_auth_trunc(struct nlattr **attrs) 634447bb33SMartin Willi { 644447bb33SMartin Willi struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC]; 654447bb33SMartin Willi struct xfrm_algo_auth *algp; 664447bb33SMartin Willi 674447bb33SMartin Willi if (!rt) 684447bb33SMartin Willi return 0; 694447bb33SMartin Willi 704447bb33SMartin Willi algp = nla_data(rt); 714447bb33SMartin Willi if (nla_len(rt) < xfrm_alg_auth_len(algp)) 724447bb33SMartin Willi return -EINVAL; 734447bb33SMartin Willi 74633439f5SHerbert Xu algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 754447bb33SMartin Willi return 0; 764447bb33SMartin Willi } 774447bb33SMartin Willi 781a6509d9SHerbert Xu static int verify_aead(struct nlattr **attrs) 791a6509d9SHerbert Xu { 801a6509d9SHerbert Xu struct nlattr *rt = attrs[XFRMA_ALG_AEAD]; 811a6509d9SHerbert Xu struct xfrm_algo_aead *algp; 821a6509d9SHerbert Xu 831a6509d9SHerbert Xu if (!rt) 841a6509d9SHerbert Xu return 0; 851a6509d9SHerbert Xu 861a6509d9SHerbert Xu algp = nla_data(rt); 871a6509d9SHerbert Xu if (nla_len(rt) < aead_len(algp)) 881a6509d9SHerbert Xu return -EINVAL; 891a6509d9SHerbert Xu 90633439f5SHerbert Xu algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 911a6509d9SHerbert Xu return 0; 921a6509d9SHerbert Xu } 931a6509d9SHerbert Xu 945424f32eSThomas Graf static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type, 95eb2971b6SMasahide NAKAMURA xfrm_address_t **addrp) 96eb2971b6SMasahide NAKAMURA { 975424f32eSThomas Graf struct nlattr *rt = attrs[type]; 98eb2971b6SMasahide NAKAMURA 99cf5cb79fSThomas Graf if (rt && addrp) 1005424f32eSThomas Graf *addrp = nla_data(rt); 101eb2971b6SMasahide NAKAMURA } 102df71837dSTrent Jaeger 1035424f32eSThomas Graf static inline int verify_sec_ctx_len(struct nlattr **attrs) 104df71837dSTrent Jaeger { 1055424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 106df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx; 107df71837dSTrent Jaeger 108df71837dSTrent Jaeger if (!rt) 109df71837dSTrent Jaeger return 0; 110df71837dSTrent Jaeger 1115424f32eSThomas Graf uctx = nla_data(rt); 112cf5cb79fSThomas Graf if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) 113df71837dSTrent Jaeger return -EINVAL; 114df71837dSTrent Jaeger 115df71837dSTrent Jaeger return 0; 116df71837dSTrent Jaeger } 117df71837dSTrent Jaeger 118d8647b79SSteffen Klassert static inline int verify_replay(struct xfrm_usersa_info *p, 119d8647b79SSteffen Klassert struct nlattr **attrs) 120d8647b79SSteffen Klassert { 121d8647b79SSteffen Klassert struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; 122ecd79187SMathias Krause struct xfrm_replay_state_esn *rs; 123d8647b79SSteffen Klassert 124ecd79187SMathias Krause if (p->flags & XFRM_STATE_ESN) { 125ecd79187SMathias Krause if (!rt) 1267833aa05SSteffen Klassert return -EINVAL; 1277833aa05SSteffen Klassert 128ecd79187SMathias Krause rs = nla_data(rt); 129ecd79187SMathias Krause 130ecd79187SMathias Krause if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) 131ecd79187SMathias Krause return -EINVAL; 132ecd79187SMathias Krause 133ecd79187SMathias Krause if (nla_len(rt) < xfrm_replay_state_esn_len(rs) && 134ecd79187SMathias Krause nla_len(rt) != sizeof(*rs)) 135ecd79187SMathias Krause return -EINVAL; 136ecd79187SMathias Krause } 137ecd79187SMathias Krause 138d8647b79SSteffen Klassert if (!rt) 139d8647b79SSteffen Klassert return 0; 140d8647b79SSteffen Klassert 14101714109SFan Du /* As only ESP and AH support ESN feature. */ 14201714109SFan Du if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) 14302aadf72SSteffen Klassert return -EINVAL; 14402aadf72SSteffen Klassert 145d8647b79SSteffen Klassert if (p->replay_window != 0) 146d8647b79SSteffen Klassert return -EINVAL; 147d8647b79SSteffen Klassert 148d8647b79SSteffen Klassert return 0; 149d8647b79SSteffen Klassert } 150df71837dSTrent Jaeger 1511da177e4SLinus Torvalds static int verify_newsa_info(struct xfrm_usersa_info *p, 1525424f32eSThomas Graf struct nlattr **attrs) 1531da177e4SLinus Torvalds { 1541da177e4SLinus Torvalds int err; 1551da177e4SLinus Torvalds 1561da177e4SLinus Torvalds err = -EINVAL; 1571da177e4SLinus Torvalds switch (p->family) { 1581da177e4SLinus Torvalds case AF_INET: 1591da177e4SLinus Torvalds break; 1601da177e4SLinus Torvalds 1611da177e4SLinus Torvalds case AF_INET6: 162dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 1631da177e4SLinus Torvalds break; 1641da177e4SLinus Torvalds #else 1651da177e4SLinus Torvalds err = -EAFNOSUPPORT; 1661da177e4SLinus Torvalds goto out; 1671da177e4SLinus Torvalds #endif 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds default: 1701da177e4SLinus Torvalds goto out; 1713ff50b79SStephen Hemminger } 1721da177e4SLinus Torvalds 1731da177e4SLinus Torvalds err = -EINVAL; 1741da177e4SLinus Torvalds switch (p->id.proto) { 1751da177e4SLinus Torvalds case IPPROTO_AH: 1764447bb33SMartin Willi if ((!attrs[XFRMA_ALG_AUTH] && 1774447bb33SMartin Willi !attrs[XFRMA_ALG_AUTH_TRUNC]) || 1781a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 17935a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] || 18035d2856bSMartin Willi attrs[XFRMA_ALG_COMP] || 181a0e5ef53STobias Brunner attrs[XFRMA_TFCPAD]) 1821da177e4SLinus Torvalds goto out; 1831da177e4SLinus Torvalds break; 1841da177e4SLinus Torvalds 1851da177e4SLinus Torvalds case IPPROTO_ESP: 1861a6509d9SHerbert Xu if (attrs[XFRMA_ALG_COMP]) 1871a6509d9SHerbert Xu goto out; 1881a6509d9SHerbert Xu if (!attrs[XFRMA_ALG_AUTH] && 1894447bb33SMartin Willi !attrs[XFRMA_ALG_AUTH_TRUNC] && 1901a6509d9SHerbert Xu !attrs[XFRMA_ALG_CRYPT] && 1911a6509d9SHerbert Xu !attrs[XFRMA_ALG_AEAD]) 1921a6509d9SHerbert Xu goto out; 1931a6509d9SHerbert Xu if ((attrs[XFRMA_ALG_AUTH] || 1944447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] || 1951a6509d9SHerbert Xu attrs[XFRMA_ALG_CRYPT]) && 1961a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD]) 1971da177e4SLinus Torvalds goto out; 19835d2856bSMartin Willi if (attrs[XFRMA_TFCPAD] && 19935d2856bSMartin Willi p->mode != XFRM_MODE_TUNNEL) 20035d2856bSMartin Willi goto out; 2011da177e4SLinus Torvalds break; 2021da177e4SLinus Torvalds 2031da177e4SLinus Torvalds case IPPROTO_COMP: 20435a7aa08SThomas Graf if (!attrs[XFRMA_ALG_COMP] || 2051a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 20635a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] || 2074447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] || 20835d2856bSMartin Willi attrs[XFRMA_ALG_CRYPT] || 209a0e5ef53STobias Brunner attrs[XFRMA_TFCPAD] || 210a0e5ef53STobias Brunner (ntohl(p->id.spi) >= 0x10000)) 2111da177e4SLinus Torvalds goto out; 2121da177e4SLinus Torvalds break; 2131da177e4SLinus Torvalds 214dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 215e23c7194SMasahide NAKAMURA case IPPROTO_DSTOPTS: 216e23c7194SMasahide NAKAMURA case IPPROTO_ROUTING: 21735a7aa08SThomas Graf if (attrs[XFRMA_ALG_COMP] || 21835a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] || 2194447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] || 2201a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 22135a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] || 22235a7aa08SThomas Graf attrs[XFRMA_ENCAP] || 22335a7aa08SThomas Graf attrs[XFRMA_SEC_CTX] || 22435d2856bSMartin Willi attrs[XFRMA_TFCPAD] || 22535a7aa08SThomas Graf !attrs[XFRMA_COADDR]) 226e23c7194SMasahide NAKAMURA goto out; 227e23c7194SMasahide NAKAMURA break; 228e23c7194SMasahide NAKAMURA #endif 229e23c7194SMasahide NAKAMURA 2301da177e4SLinus Torvalds default: 2311da177e4SLinus Torvalds goto out; 2323ff50b79SStephen Hemminger } 2331da177e4SLinus Torvalds 2341a6509d9SHerbert Xu if ((err = verify_aead(attrs))) 2351a6509d9SHerbert Xu goto out; 2364447bb33SMartin Willi if ((err = verify_auth_trunc(attrs))) 2374447bb33SMartin Willi goto out; 23835a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH))) 2391da177e4SLinus Torvalds goto out; 24035a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT))) 2411da177e4SLinus Torvalds goto out; 24235a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP))) 2431da177e4SLinus Torvalds goto out; 24435a7aa08SThomas Graf if ((err = verify_sec_ctx_len(attrs))) 245df71837dSTrent Jaeger goto out; 246d8647b79SSteffen Klassert if ((err = verify_replay(p, attrs))) 247d8647b79SSteffen Klassert goto out; 2481da177e4SLinus Torvalds 2491da177e4SLinus Torvalds err = -EINVAL; 2501da177e4SLinus Torvalds switch (p->mode) { 2517e49e6deSMasahide NAKAMURA case XFRM_MODE_TRANSPORT: 2527e49e6deSMasahide NAKAMURA case XFRM_MODE_TUNNEL: 253060f02a3SNoriaki TAKAMIYA case XFRM_MODE_ROUTEOPTIMIZATION: 2540a69452cSDiego Beltrami case XFRM_MODE_BEET: 2551da177e4SLinus Torvalds break; 2561da177e4SLinus Torvalds 2571da177e4SLinus Torvalds default: 2581da177e4SLinus Torvalds goto out; 2593ff50b79SStephen Hemminger } 2601da177e4SLinus Torvalds 2611da177e4SLinus Torvalds err = 0; 2621da177e4SLinus Torvalds 2631da177e4SLinus Torvalds out: 2641da177e4SLinus Torvalds return err; 2651da177e4SLinus Torvalds } 2661da177e4SLinus Torvalds 2671da177e4SLinus Torvalds static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 2686f2f19edSDavid S. Miller struct xfrm_algo_desc *(*get_byname)(const char *, int), 2695424f32eSThomas Graf struct nlattr *rta) 2701da177e4SLinus Torvalds { 2711da177e4SLinus Torvalds struct xfrm_algo *p, *ualg; 2721da177e4SLinus Torvalds struct xfrm_algo_desc *algo; 2731da177e4SLinus Torvalds 2741da177e4SLinus Torvalds if (!rta) 2751da177e4SLinus Torvalds return 0; 2761da177e4SLinus Torvalds 2775424f32eSThomas Graf ualg = nla_data(rta); 2781da177e4SLinus Torvalds 2791da177e4SLinus Torvalds algo = get_byname(ualg->alg_name, 1); 2801da177e4SLinus Torvalds if (!algo) 2811da177e4SLinus Torvalds return -ENOSYS; 2821da177e4SLinus Torvalds *props = algo->desc.sadb_alg_id; 2831da177e4SLinus Torvalds 2840f99be0dSEric Dumazet p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 2851da177e4SLinus Torvalds if (!p) 2861da177e4SLinus Torvalds return -ENOMEM; 2871da177e4SLinus Torvalds 28804ff1260SHerbert Xu strcpy(p->alg_name, algo->name); 2891da177e4SLinus Torvalds *algpp = p; 2901da177e4SLinus Torvalds return 0; 2911da177e4SLinus Torvalds } 2921da177e4SLinus Torvalds 29369b0137fSHerbert Xu static int attach_crypt(struct xfrm_state *x, struct nlattr *rta) 29469b0137fSHerbert Xu { 29569b0137fSHerbert Xu struct xfrm_algo *p, *ualg; 29669b0137fSHerbert Xu struct xfrm_algo_desc *algo; 29769b0137fSHerbert Xu 29869b0137fSHerbert Xu if (!rta) 29969b0137fSHerbert Xu return 0; 30069b0137fSHerbert Xu 30169b0137fSHerbert Xu ualg = nla_data(rta); 30269b0137fSHerbert Xu 30369b0137fSHerbert Xu algo = xfrm_ealg_get_byname(ualg->alg_name, 1); 30469b0137fSHerbert Xu if (!algo) 30569b0137fSHerbert Xu return -ENOSYS; 30669b0137fSHerbert Xu x->props.ealgo = algo->desc.sadb_alg_id; 30769b0137fSHerbert Xu 30869b0137fSHerbert Xu p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 30969b0137fSHerbert Xu if (!p) 31069b0137fSHerbert Xu return -ENOMEM; 31169b0137fSHerbert Xu 31269b0137fSHerbert Xu strcpy(p->alg_name, algo->name); 31369b0137fSHerbert Xu x->ealg = p; 31469b0137fSHerbert Xu x->geniv = algo->uinfo.encr.geniv; 31569b0137fSHerbert Xu return 0; 31669b0137fSHerbert Xu } 31769b0137fSHerbert Xu 3184447bb33SMartin Willi static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props, 3194447bb33SMartin Willi struct nlattr *rta) 3204447bb33SMartin Willi { 3214447bb33SMartin Willi struct xfrm_algo *ualg; 3224447bb33SMartin Willi struct xfrm_algo_auth *p; 3234447bb33SMartin Willi struct xfrm_algo_desc *algo; 3244447bb33SMartin Willi 3254447bb33SMartin Willi if (!rta) 3264447bb33SMartin Willi return 0; 3274447bb33SMartin Willi 3284447bb33SMartin Willi ualg = nla_data(rta); 3294447bb33SMartin Willi 3304447bb33SMartin Willi algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 3314447bb33SMartin Willi if (!algo) 3324447bb33SMartin Willi return -ENOSYS; 3334447bb33SMartin Willi *props = algo->desc.sadb_alg_id; 3344447bb33SMartin Willi 3354447bb33SMartin Willi p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL); 3364447bb33SMartin Willi if (!p) 3374447bb33SMartin Willi return -ENOMEM; 3384447bb33SMartin Willi 3394447bb33SMartin Willi strcpy(p->alg_name, algo->name); 3404447bb33SMartin Willi p->alg_key_len = ualg->alg_key_len; 3414447bb33SMartin Willi p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 3424447bb33SMartin Willi memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8); 3434447bb33SMartin Willi 3444447bb33SMartin Willi *algpp = p; 3454447bb33SMartin Willi return 0; 3464447bb33SMartin Willi } 3474447bb33SMartin Willi 3484447bb33SMartin Willi static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props, 3494447bb33SMartin Willi struct nlattr *rta) 3504447bb33SMartin Willi { 3514447bb33SMartin Willi struct xfrm_algo_auth *p, *ualg; 3524447bb33SMartin Willi struct xfrm_algo_desc *algo; 3534447bb33SMartin Willi 3544447bb33SMartin Willi if (!rta) 3554447bb33SMartin Willi return 0; 3564447bb33SMartin Willi 3574447bb33SMartin Willi ualg = nla_data(rta); 3584447bb33SMartin Willi 3594447bb33SMartin Willi algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 3604447bb33SMartin Willi if (!algo) 3614447bb33SMartin Willi return -ENOSYS; 362689f1c9dSHerbert Xu if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) 3634447bb33SMartin Willi return -EINVAL; 3644447bb33SMartin Willi *props = algo->desc.sadb_alg_id; 3654447bb33SMartin Willi 3664447bb33SMartin Willi p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL); 3674447bb33SMartin Willi if (!p) 3684447bb33SMartin Willi return -ENOMEM; 3694447bb33SMartin Willi 3704447bb33SMartin Willi strcpy(p->alg_name, algo->name); 3714447bb33SMartin Willi if (!p->alg_trunc_len) 3724447bb33SMartin Willi p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 3734447bb33SMartin Willi 3744447bb33SMartin Willi *algpp = p; 3754447bb33SMartin Willi return 0; 3764447bb33SMartin Willi } 3774447bb33SMartin Willi 37869b0137fSHerbert Xu static int attach_aead(struct xfrm_state *x, struct nlattr *rta) 3791a6509d9SHerbert Xu { 3801a6509d9SHerbert Xu struct xfrm_algo_aead *p, *ualg; 3811a6509d9SHerbert Xu struct xfrm_algo_desc *algo; 3821a6509d9SHerbert Xu 3831a6509d9SHerbert Xu if (!rta) 3841a6509d9SHerbert Xu return 0; 3851a6509d9SHerbert Xu 3861a6509d9SHerbert Xu ualg = nla_data(rta); 3871a6509d9SHerbert Xu 3881a6509d9SHerbert Xu algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1); 3891a6509d9SHerbert Xu if (!algo) 3901a6509d9SHerbert Xu return -ENOSYS; 39169b0137fSHerbert Xu x->props.ealgo = algo->desc.sadb_alg_id; 3921a6509d9SHerbert Xu 3931a6509d9SHerbert Xu p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL); 3941a6509d9SHerbert Xu if (!p) 3951a6509d9SHerbert Xu return -ENOMEM; 3961a6509d9SHerbert Xu 3971a6509d9SHerbert Xu strcpy(p->alg_name, algo->name); 39869b0137fSHerbert Xu x->aead = p; 39969b0137fSHerbert Xu x->geniv = algo->uinfo.aead.geniv; 4001a6509d9SHerbert Xu return 0; 4011a6509d9SHerbert Xu } 4021a6509d9SHerbert Xu 403e2b19125SSteffen Klassert static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn, 404e2b19125SSteffen Klassert struct nlattr *rp) 405e2b19125SSteffen Klassert { 406e2b19125SSteffen Klassert struct xfrm_replay_state_esn *up; 407ecd79187SMathias Krause int ulen; 408e2b19125SSteffen Klassert 409e2b19125SSteffen Klassert if (!replay_esn || !rp) 410e2b19125SSteffen Klassert return 0; 411e2b19125SSteffen Klassert 412e2b19125SSteffen Klassert up = nla_data(rp); 413ecd79187SMathias Krause ulen = xfrm_replay_state_esn_len(up); 414e2b19125SSteffen Klassert 415f843ee6dSAndy Whitcroft /* Check the overall length and the internal bitmap length to avoid 416f843ee6dSAndy Whitcroft * potential overflow. */ 417f843ee6dSAndy Whitcroft if (nla_len(rp) < ulen || 418f843ee6dSAndy Whitcroft xfrm_replay_state_esn_len(replay_esn) != ulen || 419f843ee6dSAndy Whitcroft replay_esn->bmp_len != up->bmp_len) 420e2b19125SSteffen Klassert return -EINVAL; 421e2b19125SSteffen Klassert 422677e806dSAndy Whitcroft if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) 423677e806dSAndy Whitcroft return -EINVAL; 424677e806dSAndy Whitcroft 425e2b19125SSteffen Klassert return 0; 426e2b19125SSteffen Klassert } 427e2b19125SSteffen Klassert 428d8647b79SSteffen Klassert static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn, 429d8647b79SSteffen Klassert struct xfrm_replay_state_esn **preplay_esn, 430d8647b79SSteffen Klassert struct nlattr *rta) 431d8647b79SSteffen Klassert { 432d8647b79SSteffen Klassert struct xfrm_replay_state_esn *p, *pp, *up; 433ecd79187SMathias Krause int klen, ulen; 434d8647b79SSteffen Klassert 435d8647b79SSteffen Klassert if (!rta) 436d8647b79SSteffen Klassert return 0; 437d8647b79SSteffen Klassert 438d8647b79SSteffen Klassert up = nla_data(rta); 439ecd79187SMathias Krause klen = xfrm_replay_state_esn_len(up); 440ecd79187SMathias Krause ulen = nla_len(rta) >= klen ? klen : sizeof(*up); 441d8647b79SSteffen Klassert 442ecd79187SMathias Krause p = kzalloc(klen, GFP_KERNEL); 443d8647b79SSteffen Klassert if (!p) 444d8647b79SSteffen Klassert return -ENOMEM; 445d8647b79SSteffen Klassert 446ecd79187SMathias Krause pp = kzalloc(klen, GFP_KERNEL); 447d8647b79SSteffen Klassert if (!pp) { 448d8647b79SSteffen Klassert kfree(p); 449d8647b79SSteffen Klassert return -ENOMEM; 450d8647b79SSteffen Klassert } 451d8647b79SSteffen Klassert 452ecd79187SMathias Krause memcpy(p, up, ulen); 453ecd79187SMathias Krause memcpy(pp, up, ulen); 454ecd79187SMathias Krause 455d8647b79SSteffen Klassert *replay_esn = p; 456d8647b79SSteffen Klassert *preplay_esn = pp; 457d8647b79SSteffen Klassert 458d8647b79SSteffen Klassert return 0; 459d8647b79SSteffen Klassert } 460d8647b79SSteffen Klassert 461661697f7SJoy Latten static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx) 462df71837dSTrent Jaeger { 463df71837dSTrent Jaeger int len = 0; 464df71837dSTrent Jaeger 465df71837dSTrent Jaeger if (xfrm_ctx) { 466df71837dSTrent Jaeger len += sizeof(struct xfrm_user_sec_ctx); 467df71837dSTrent Jaeger len += xfrm_ctx->ctx_len; 468df71837dSTrent Jaeger } 469df71837dSTrent Jaeger return len; 470df71837dSTrent Jaeger } 471df71837dSTrent Jaeger 4721da177e4SLinus Torvalds static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 4731da177e4SLinus Torvalds { 4741da177e4SLinus Torvalds memcpy(&x->id, &p->id, sizeof(x->id)); 4751da177e4SLinus Torvalds memcpy(&x->sel, &p->sel, sizeof(x->sel)); 4761da177e4SLinus Torvalds memcpy(&x->lft, &p->lft, sizeof(x->lft)); 4771da177e4SLinus Torvalds x->props.mode = p->mode; 47833fce60dSFan Du x->props.replay_window = min_t(unsigned int, p->replay_window, 47933fce60dSFan Du sizeof(x->replay.bitmap) * 8); 4801da177e4SLinus Torvalds x->props.reqid = p->reqid; 4811da177e4SLinus Torvalds x->props.family = p->family; 48254489c14SDavid S. Miller memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr)); 4831da177e4SLinus Torvalds x->props.flags = p->flags; 484196b0036SHerbert Xu 485ccf9b3b8SSteffen Klassert if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC)) 486196b0036SHerbert Xu x->sel.family = p->family; 4871da177e4SLinus Torvalds } 4881da177e4SLinus Torvalds 489d51d081dSJamal Hadi Salim /* 490d51d081dSJamal Hadi Salim * someday when pfkey also has support, we could have the code 491d51d081dSJamal Hadi Salim * somehow made shareable and move it to xfrm_state.c - JHS 492d51d081dSJamal Hadi Salim * 493d51d081dSJamal Hadi Salim */ 494e3ac104dSMathias Krause static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, 495e3ac104dSMathias Krause int update_esn) 496d51d081dSJamal Hadi Salim { 4975424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 498e3ac104dSMathias Krause struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL; 4995424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 5005424f32eSThomas Graf struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 5015424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 502d51d081dSJamal Hadi Salim 503d8647b79SSteffen Klassert if (re) { 504d8647b79SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 505d8647b79SSteffen Klassert replay_esn = nla_data(re); 506d8647b79SSteffen Klassert memcpy(x->replay_esn, replay_esn, 507d8647b79SSteffen Klassert xfrm_replay_state_esn_len(replay_esn)); 508d8647b79SSteffen Klassert memcpy(x->preplay_esn, replay_esn, 509d8647b79SSteffen Klassert xfrm_replay_state_esn_len(replay_esn)); 510d8647b79SSteffen Klassert } 511d8647b79SSteffen Klassert 512d51d081dSJamal Hadi Salim if (rp) { 513d51d081dSJamal Hadi Salim struct xfrm_replay_state *replay; 5145424f32eSThomas Graf replay = nla_data(rp); 515d51d081dSJamal Hadi Salim memcpy(&x->replay, replay, sizeof(*replay)); 516d51d081dSJamal Hadi Salim memcpy(&x->preplay, replay, sizeof(*replay)); 517d51d081dSJamal Hadi Salim } 518d51d081dSJamal Hadi Salim 519d51d081dSJamal Hadi Salim if (lt) { 520d51d081dSJamal Hadi Salim struct xfrm_lifetime_cur *ltime; 5215424f32eSThomas Graf ltime = nla_data(lt); 522d51d081dSJamal Hadi Salim x->curlft.bytes = ltime->bytes; 523d51d081dSJamal Hadi Salim x->curlft.packets = ltime->packets; 524d51d081dSJamal Hadi Salim x->curlft.add_time = ltime->add_time; 525d51d081dSJamal Hadi Salim x->curlft.use_time = ltime->use_time; 526d51d081dSJamal Hadi Salim } 527d51d081dSJamal Hadi Salim 528cf5cb79fSThomas Graf if (et) 5295424f32eSThomas Graf x->replay_maxage = nla_get_u32(et); 530d51d081dSJamal Hadi Salim 531cf5cb79fSThomas Graf if (rt) 5325424f32eSThomas Graf x->replay_maxdiff = nla_get_u32(rt); 533d51d081dSJamal Hadi Salim } 534d51d081dSJamal Hadi Salim 535fc34acd3SAlexey Dobriyan static struct xfrm_state *xfrm_state_construct(struct net *net, 536fc34acd3SAlexey Dobriyan struct xfrm_usersa_info *p, 5375424f32eSThomas Graf struct nlattr **attrs, 5381da177e4SLinus Torvalds int *errp) 5391da177e4SLinus Torvalds { 540fc34acd3SAlexey Dobriyan struct xfrm_state *x = xfrm_state_alloc(net); 5411da177e4SLinus Torvalds int err = -ENOMEM; 5421da177e4SLinus Torvalds 5431da177e4SLinus Torvalds if (!x) 5441da177e4SLinus Torvalds goto error_no_put; 5451da177e4SLinus Torvalds 5461da177e4SLinus Torvalds copy_from_user_state(x, p); 5471da177e4SLinus Torvalds 548a947b0a9SNicolas Dichtel if (attrs[XFRMA_SA_EXTRA_FLAGS]) 549a947b0a9SNicolas Dichtel x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); 550a947b0a9SNicolas Dichtel 55169b0137fSHerbert Xu if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD]))) 5521a6509d9SHerbert Xu goto error; 5534447bb33SMartin Willi if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo, 5544447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC]))) 5554447bb33SMartin Willi goto error; 5564447bb33SMartin Willi if (!x->props.aalgo) { 5574447bb33SMartin Willi if ((err = attach_auth(&x->aalg, &x->props.aalgo, 55835a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH]))) 5591da177e4SLinus Torvalds goto error; 5604447bb33SMartin Willi } 56169b0137fSHerbert Xu if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT]))) 5621da177e4SLinus Torvalds goto error; 5631da177e4SLinus Torvalds if ((err = attach_one_algo(&x->calg, &x->props.calgo, 5641da177e4SLinus Torvalds xfrm_calg_get_byname, 56535a7aa08SThomas Graf attrs[XFRMA_ALG_COMP]))) 5661da177e4SLinus Torvalds goto error; 567fd21150aSThomas Graf 568fd21150aSThomas Graf if (attrs[XFRMA_ENCAP]) { 569fd21150aSThomas Graf x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 570fd21150aSThomas Graf sizeof(*x->encap), GFP_KERNEL); 571fd21150aSThomas Graf if (x->encap == NULL) 5721da177e4SLinus Torvalds goto error; 573fd21150aSThomas Graf } 574fd21150aSThomas Graf 57535d2856bSMartin Willi if (attrs[XFRMA_TFCPAD]) 57635d2856bSMartin Willi x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]); 57735d2856bSMartin Willi 578fd21150aSThomas Graf if (attrs[XFRMA_COADDR]) { 579fd21150aSThomas Graf x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), 580fd21150aSThomas Graf sizeof(*x->coaddr), GFP_KERNEL); 581fd21150aSThomas Graf if (x->coaddr == NULL) 582060f02a3SNoriaki TAKAMIYA goto error; 583fd21150aSThomas Graf } 584fd21150aSThomas Graf 5856f26b61eSJamal Hadi Salim xfrm_mark_get(attrs, &x->mark); 5866f26b61eSJamal Hadi Salim 587a454f0ccSWei Yongjun err = __xfrm_init_state(x, false); 5881da177e4SLinus Torvalds if (err) 5891da177e4SLinus Torvalds goto error; 5901da177e4SLinus Torvalds 5912f30ea50SMathias Krause if (attrs[XFRMA_SEC_CTX]) { 5922f30ea50SMathias Krause err = security_xfrm_state_alloc(x, 5932f30ea50SMathias Krause nla_data(attrs[XFRMA_SEC_CTX])); 5942f30ea50SMathias Krause if (err) 595df71837dSTrent Jaeger goto error; 5962f30ea50SMathias Krause } 597df71837dSTrent Jaeger 598152afb9bSIlan Tayari if (attrs[XFRMA_OFFLOAD_DEV]) { 599152afb9bSIlan Tayari err = xfrm_dev_state_add(net, x, 600152afb9bSIlan Tayari nla_data(attrs[XFRMA_OFFLOAD_DEV])); 601152afb9bSIlan Tayari if (err) 602d77e38e6SSteffen Klassert goto error; 603152afb9bSIlan Tayari } 604d77e38e6SSteffen Klassert 605d8647b79SSteffen Klassert if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn, 606d8647b79SSteffen Klassert attrs[XFRMA_REPLAY_ESN_VAL]))) 607d8647b79SSteffen Klassert goto error; 608d8647b79SSteffen Klassert 6091da177e4SLinus Torvalds x->km.seq = p->seq; 610b27aeadbSAlexey Dobriyan x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth; 611d51d081dSJamal Hadi Salim /* sysctl_xfrm_aevent_etime is in 100ms units */ 612b27aeadbSAlexey Dobriyan x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M; 613d51d081dSJamal Hadi Salim 6149fdc4883SSteffen Klassert if ((err = xfrm_init_replay(x))) 6159fdc4883SSteffen Klassert goto error; 616d51d081dSJamal Hadi Salim 6179fdc4883SSteffen Klassert /* override default values from above */ 618e3ac104dSMathias Krause xfrm_update_ae_params(x, attrs, 0); 6191da177e4SLinus Torvalds 6201da177e4SLinus Torvalds return x; 6211da177e4SLinus Torvalds 6221da177e4SLinus Torvalds error: 6231da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD; 6241da177e4SLinus Torvalds xfrm_state_put(x); 6251da177e4SLinus Torvalds error_no_put: 6261da177e4SLinus Torvalds *errp = err; 6271da177e4SLinus Torvalds return NULL; 6281da177e4SLinus Torvalds } 6291da177e4SLinus Torvalds 63022e70050SChristoph Hellwig static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 6315424f32eSThomas Graf struct nlattr **attrs) 6321da177e4SLinus Torvalds { 633fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 6347b67c857SThomas Graf struct xfrm_usersa_info *p = nlmsg_data(nlh); 6351da177e4SLinus Torvalds struct xfrm_state *x; 6361da177e4SLinus Torvalds int err; 63726b15dadSJamal Hadi Salim struct km_event c; 6381da177e4SLinus Torvalds 63935a7aa08SThomas Graf err = verify_newsa_info(p, attrs); 6401da177e4SLinus Torvalds if (err) 6411da177e4SLinus Torvalds return err; 6421da177e4SLinus Torvalds 643fc34acd3SAlexey Dobriyan x = xfrm_state_construct(net, p, attrs, &err); 6441da177e4SLinus Torvalds if (!x) 6451da177e4SLinus Torvalds return err; 6461da177e4SLinus Torvalds 64726b15dadSJamal Hadi Salim xfrm_state_hold(x); 6481da177e4SLinus Torvalds if (nlh->nlmsg_type == XFRM_MSG_NEWSA) 6491da177e4SLinus Torvalds err = xfrm_state_add(x); 6501da177e4SLinus Torvalds else 6511da177e4SLinus Torvalds err = xfrm_state_update(x); 6521da177e4SLinus Torvalds 6532e71029eSTetsuo Handa xfrm_audit_state_add(x, err ? 0 : 1, true); 654161a09e7SJoy Latten 6551da177e4SLinus Torvalds if (err < 0) { 6561da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD; 65721380b81SHerbert Xu __xfrm_state_put(x); 6587d6dfe1fSPatrick McHardy goto out; 6591da177e4SLinus Torvalds } 6601da177e4SLinus Torvalds 66126b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 66215e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 663f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 66426b15dadSJamal Hadi Salim 66526b15dadSJamal Hadi Salim km_state_notify(x, &c); 6667d6dfe1fSPatrick McHardy out: 66726b15dadSJamal Hadi Salim xfrm_state_put(x); 6681da177e4SLinus Torvalds return err; 6691da177e4SLinus Torvalds } 6701da177e4SLinus Torvalds 671fc34acd3SAlexey Dobriyan static struct xfrm_state *xfrm_user_state_lookup(struct net *net, 672fc34acd3SAlexey Dobriyan struct xfrm_usersa_id *p, 6735424f32eSThomas Graf struct nlattr **attrs, 674eb2971b6SMasahide NAKAMURA int *errp) 675eb2971b6SMasahide NAKAMURA { 676eb2971b6SMasahide NAKAMURA struct xfrm_state *x = NULL; 6776f26b61eSJamal Hadi Salim struct xfrm_mark m; 678eb2971b6SMasahide NAKAMURA int err; 6796f26b61eSJamal Hadi Salim u32 mark = xfrm_mark_get(attrs, &m); 680eb2971b6SMasahide NAKAMURA 681eb2971b6SMasahide NAKAMURA if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) { 682eb2971b6SMasahide NAKAMURA err = -ESRCH; 6836f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family); 684eb2971b6SMasahide NAKAMURA } else { 685eb2971b6SMasahide NAKAMURA xfrm_address_t *saddr = NULL; 686eb2971b6SMasahide NAKAMURA 68735a7aa08SThomas Graf verify_one_addr(attrs, XFRMA_SRCADDR, &saddr); 688eb2971b6SMasahide NAKAMURA if (!saddr) { 689eb2971b6SMasahide NAKAMURA err = -EINVAL; 690eb2971b6SMasahide NAKAMURA goto out; 691eb2971b6SMasahide NAKAMURA } 692eb2971b6SMasahide NAKAMURA 6939abbffeeSMasahide NAKAMURA err = -ESRCH; 6946f26b61eSJamal Hadi Salim x = xfrm_state_lookup_byaddr(net, mark, 6956f26b61eSJamal Hadi Salim &p->daddr, saddr, 696221df1edSAlexey Dobriyan p->proto, p->family); 697eb2971b6SMasahide NAKAMURA } 698eb2971b6SMasahide NAKAMURA 699eb2971b6SMasahide NAKAMURA out: 700eb2971b6SMasahide NAKAMURA if (!x && errp) 701eb2971b6SMasahide NAKAMURA *errp = err; 702eb2971b6SMasahide NAKAMURA return x; 703eb2971b6SMasahide NAKAMURA } 704eb2971b6SMasahide NAKAMURA 70522e70050SChristoph Hellwig static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 7065424f32eSThomas Graf struct nlattr **attrs) 7071da177e4SLinus Torvalds { 708fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 7091da177e4SLinus Torvalds struct xfrm_state *x; 710eb2971b6SMasahide NAKAMURA int err = -ESRCH; 71126b15dadSJamal Hadi Salim struct km_event c; 7127b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh); 7131da177e4SLinus Torvalds 714fc34acd3SAlexey Dobriyan x = xfrm_user_state_lookup(net, p, attrs, &err); 7151da177e4SLinus Torvalds if (x == NULL) 716eb2971b6SMasahide NAKAMURA return err; 7171da177e4SLinus Torvalds 7186f68dc37SDavid S. Miller if ((err = security_xfrm_state_delete(x)) != 0) 719c8c05a8eSCatherine Zhang goto out; 720c8c05a8eSCatherine Zhang 7211da177e4SLinus Torvalds if (xfrm_state_kern(x)) { 722c8c05a8eSCatherine Zhang err = -EPERM; 723c8c05a8eSCatherine Zhang goto out; 7241da177e4SLinus Torvalds } 7251da177e4SLinus Torvalds 72626b15dadSJamal Hadi Salim err = xfrm_state_delete(x); 727161a09e7SJoy Latten 728c8c05a8eSCatherine Zhang if (err < 0) 729c8c05a8eSCatherine Zhang goto out; 73026b15dadSJamal Hadi Salim 73126b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 73215e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 733f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 73426b15dadSJamal Hadi Salim km_state_notify(x, &c); 7351da177e4SLinus Torvalds 736c8c05a8eSCatherine Zhang out: 7372e71029eSTetsuo Handa xfrm_audit_state_delete(x, err ? 0 : 1, true); 738c8c05a8eSCatherine Zhang xfrm_state_put(x); 73926b15dadSJamal Hadi Salim return err; 7401da177e4SLinus Torvalds } 7411da177e4SLinus Torvalds 7421da177e4SLinus Torvalds static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 7431da177e4SLinus Torvalds { 744f778a636SMathias Krause memset(p, 0, sizeof(*p)); 7451da177e4SLinus Torvalds memcpy(&p->id, &x->id, sizeof(p->id)); 7461da177e4SLinus Torvalds memcpy(&p->sel, &x->sel, sizeof(p->sel)); 7471da177e4SLinus Torvalds memcpy(&p->lft, &x->lft, sizeof(p->lft)); 7481da177e4SLinus Torvalds memcpy(&p->curlft, &x->curlft, sizeof(p->curlft)); 749e33d4f13SSowmini Varadhan put_unaligned(x->stats.replay_window, &p->stats.replay_window); 750e33d4f13SSowmini Varadhan put_unaligned(x->stats.replay, &p->stats.replay); 751e33d4f13SSowmini Varadhan put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed); 75254489c14SDavid S. Miller memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr)); 7531da177e4SLinus Torvalds p->mode = x->props.mode; 7541da177e4SLinus Torvalds p->replay_window = x->props.replay_window; 7551da177e4SLinus Torvalds p->reqid = x->props.reqid; 7561da177e4SLinus Torvalds p->family = x->props.family; 7571da177e4SLinus Torvalds p->flags = x->props.flags; 7581da177e4SLinus Torvalds p->seq = x->km.seq; 7591da177e4SLinus Torvalds } 7601da177e4SLinus Torvalds 7611da177e4SLinus Torvalds struct xfrm_dump_info { 7621da177e4SLinus Torvalds struct sk_buff *in_skb; 7631da177e4SLinus Torvalds struct sk_buff *out_skb; 7641da177e4SLinus Torvalds u32 nlmsg_seq; 7651da177e4SLinus Torvalds u16 nlmsg_flags; 7661da177e4SLinus Torvalds }; 7671da177e4SLinus Torvalds 768c0144beaSThomas Graf static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb) 769c0144beaSThomas Graf { 770c0144beaSThomas Graf struct xfrm_user_sec_ctx *uctx; 771c0144beaSThomas Graf struct nlattr *attr; 77268325d3bSHerbert Xu int ctx_size = sizeof(*uctx) + s->ctx_len; 773c0144beaSThomas Graf 774c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size); 775c0144beaSThomas Graf if (attr == NULL) 776c0144beaSThomas Graf return -EMSGSIZE; 777c0144beaSThomas Graf 778c0144beaSThomas Graf uctx = nla_data(attr); 779c0144beaSThomas Graf uctx->exttype = XFRMA_SEC_CTX; 780c0144beaSThomas Graf uctx->len = ctx_size; 781c0144beaSThomas Graf uctx->ctx_doi = s->ctx_doi; 782c0144beaSThomas Graf uctx->ctx_alg = s->ctx_alg; 783c0144beaSThomas Graf uctx->ctx_len = s->ctx_len; 784c0144beaSThomas Graf memcpy(uctx + 1, s->ctx_str, s->ctx_len); 785c0144beaSThomas Graf 786c0144beaSThomas Graf return 0; 787c0144beaSThomas Graf } 788c0144beaSThomas Graf 789d77e38e6SSteffen Klassert static int copy_user_offload(struct xfrm_state_offload *xso, struct sk_buff *skb) 790d77e38e6SSteffen Klassert { 791d77e38e6SSteffen Klassert struct xfrm_user_offload *xuo; 792d77e38e6SSteffen Klassert struct nlattr *attr; 793d77e38e6SSteffen Klassert 794d77e38e6SSteffen Klassert attr = nla_reserve(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo)); 795d77e38e6SSteffen Klassert if (attr == NULL) 796d77e38e6SSteffen Klassert return -EMSGSIZE; 797d77e38e6SSteffen Klassert 798d77e38e6SSteffen Klassert xuo = nla_data(attr); 7995fe0d4bdSMathias Krause memset(xuo, 0, sizeof(*xuo)); 800d77e38e6SSteffen Klassert xuo->ifindex = xso->dev->ifindex; 801d77e38e6SSteffen Klassert xuo->flags = xso->flags; 802d77e38e6SSteffen Klassert 803d77e38e6SSteffen Klassert return 0; 804d77e38e6SSteffen Klassert } 805d77e38e6SSteffen Klassert 8064447bb33SMartin Willi static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb) 8074447bb33SMartin Willi { 8084447bb33SMartin Willi struct xfrm_algo *algo; 8094447bb33SMartin Willi struct nlattr *nla; 8104447bb33SMartin Willi 8114447bb33SMartin Willi nla = nla_reserve(skb, XFRMA_ALG_AUTH, 8124447bb33SMartin Willi sizeof(*algo) + (auth->alg_key_len + 7) / 8); 8134447bb33SMartin Willi if (!nla) 8144447bb33SMartin Willi return -EMSGSIZE; 8154447bb33SMartin Willi 8164447bb33SMartin Willi algo = nla_data(nla); 8174c87308bSMathias Krause strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name)); 8184447bb33SMartin Willi memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8); 8194447bb33SMartin Willi algo->alg_key_len = auth->alg_key_len; 8204447bb33SMartin Willi 8214447bb33SMartin Willi return 0; 8224447bb33SMartin Willi } 8234447bb33SMartin Willi 82468325d3bSHerbert Xu /* Don't change this without updating xfrm_sa_len! */ 82568325d3bSHerbert Xu static int copy_to_user_state_extra(struct xfrm_state *x, 82668325d3bSHerbert Xu struct xfrm_usersa_info *p, 82768325d3bSHerbert Xu struct sk_buff *skb) 8281da177e4SLinus Torvalds { 8291d1e34ddSDavid S. Miller int ret = 0; 8301d1e34ddSDavid S. Miller 8311da177e4SLinus Torvalds copy_to_user_state(x, p); 8321da177e4SLinus Torvalds 833a947b0a9SNicolas Dichtel if (x->props.extra_flags) { 834a947b0a9SNicolas Dichtel ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS, 835a947b0a9SNicolas Dichtel x->props.extra_flags); 836a947b0a9SNicolas Dichtel if (ret) 837a947b0a9SNicolas Dichtel goto out; 838a947b0a9SNicolas Dichtel } 839a947b0a9SNicolas Dichtel 8401d1e34ddSDavid S. Miller if (x->coaddr) { 8411d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr); 8421d1e34ddSDavid S. Miller if (ret) 8431d1e34ddSDavid S. Miller goto out; 8441d1e34ddSDavid S. Miller } 8451d1e34ddSDavid S. Miller if (x->lastused) { 846de95c4a4SNicolas Dichtel ret = nla_put_u64_64bit(skb, XFRMA_LASTUSED, x->lastused, 847de95c4a4SNicolas Dichtel XFRMA_PAD); 8481d1e34ddSDavid S. Miller if (ret) 8491d1e34ddSDavid S. Miller goto out; 8501d1e34ddSDavid S. Miller } 8511d1e34ddSDavid S. Miller if (x->aead) { 8521d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead); 8531d1e34ddSDavid S. Miller if (ret) 8541d1e34ddSDavid S. Miller goto out; 8551d1e34ddSDavid S. Miller } 8561d1e34ddSDavid S. Miller if (x->aalg) { 8571d1e34ddSDavid S. Miller ret = copy_to_user_auth(x->aalg, skb); 8581d1e34ddSDavid S. Miller if (!ret) 8591d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_AUTH_TRUNC, 8601d1e34ddSDavid S. Miller xfrm_alg_auth_len(x->aalg), x->aalg); 8611d1e34ddSDavid S. Miller if (ret) 8621d1e34ddSDavid S. Miller goto out; 8631d1e34ddSDavid S. Miller } 8641d1e34ddSDavid S. Miller if (x->ealg) { 8651d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg); 8661d1e34ddSDavid S. Miller if (ret) 8671d1e34ddSDavid S. Miller goto out; 8681d1e34ddSDavid S. Miller } 8691d1e34ddSDavid S. Miller if (x->calg) { 8701d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg); 8711d1e34ddSDavid S. Miller if (ret) 8721d1e34ddSDavid S. Miller goto out; 8731d1e34ddSDavid S. Miller } 8741d1e34ddSDavid S. Miller if (x->encap) { 8751d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); 8761d1e34ddSDavid S. Miller if (ret) 8771d1e34ddSDavid S. Miller goto out; 8781d1e34ddSDavid S. Miller } 8791d1e34ddSDavid S. Miller if (x->tfcpad) { 8801d1e34ddSDavid S. Miller ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad); 8811d1e34ddSDavid S. Miller if (ret) 8821d1e34ddSDavid S. Miller goto out; 8831d1e34ddSDavid S. Miller } 8841d1e34ddSDavid S. Miller ret = xfrm_mark_put(skb, &x->mark); 8851d1e34ddSDavid S. Miller if (ret) 8861d1e34ddSDavid S. Miller goto out; 887f293a5e3Sdingzhi if (x->replay_esn) 8881d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 889d0fde795SDavid S. Miller xfrm_replay_state_esn_len(x->replay_esn), 8901d1e34ddSDavid S. Miller x->replay_esn); 891f293a5e3Sdingzhi else 892f293a5e3Sdingzhi ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 893f293a5e3Sdingzhi &x->replay); 8941d1e34ddSDavid S. Miller if (ret) 8951d1e34ddSDavid S. Miller goto out; 896d77e38e6SSteffen Klassert if(x->xso.dev) 897d77e38e6SSteffen Klassert ret = copy_user_offload(&x->xso, skb); 898d77e38e6SSteffen Klassert if (ret) 899d77e38e6SSteffen Klassert goto out; 9001d1e34ddSDavid S. Miller if (x->security) 9011d1e34ddSDavid S. Miller ret = copy_sec_ctx(x->security, skb); 9021d1e34ddSDavid S. Miller out: 9031d1e34ddSDavid S. Miller return ret; 90468325d3bSHerbert Xu } 90568325d3bSHerbert Xu 90668325d3bSHerbert Xu static int dump_one_state(struct xfrm_state *x, int count, void *ptr) 90768325d3bSHerbert Xu { 90868325d3bSHerbert Xu struct xfrm_dump_info *sp = ptr; 90968325d3bSHerbert Xu struct sk_buff *in_skb = sp->in_skb; 91068325d3bSHerbert Xu struct sk_buff *skb = sp->out_skb; 91168325d3bSHerbert Xu struct xfrm_usersa_info *p; 91268325d3bSHerbert Xu struct nlmsghdr *nlh; 91368325d3bSHerbert Xu int err; 91468325d3bSHerbert Xu 91515e47304SEric W. Biederman nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 91668325d3bSHerbert Xu XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags); 91768325d3bSHerbert Xu if (nlh == NULL) 91868325d3bSHerbert Xu return -EMSGSIZE; 91968325d3bSHerbert Xu 92068325d3bSHerbert Xu p = nlmsg_data(nlh); 92168325d3bSHerbert Xu 92268325d3bSHerbert Xu err = copy_to_user_state_extra(x, p, skb); 9231d1e34ddSDavid S. Miller if (err) { 9249825069dSThomas Graf nlmsg_cancel(skb, nlh); 92568325d3bSHerbert Xu return err; 9261da177e4SLinus Torvalds } 9271d1e34ddSDavid S. Miller nlmsg_end(skb, nlh); 9281d1e34ddSDavid S. Miller return 0; 9291d1e34ddSDavid S. Miller } 9301da177e4SLinus Torvalds 9314c563f76STimo Teras static int xfrm_dump_sa_done(struct netlink_callback *cb) 9324c563f76STimo Teras { 9334c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 934283bc9f3SFan Du struct sock *sk = cb->skb->sk; 935283bc9f3SFan Du struct net *net = sock_net(sk); 936283bc9f3SFan Du 9371ba5bf99SVegard Nossum if (cb->args[0]) 938283bc9f3SFan Du xfrm_state_walk_done(walk, net); 9394c563f76STimo Teras return 0; 9404c563f76STimo Teras } 9414c563f76STimo Teras 942d3623099SNicolas Dichtel static const struct nla_policy xfrma_policy[XFRMA_MAX+1]; 9431da177e4SLinus Torvalds static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) 9441da177e4SLinus Torvalds { 945fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 9464c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 9471da177e4SLinus Torvalds struct xfrm_dump_info info; 9481da177e4SLinus Torvalds 9494c563f76STimo Teras BUILD_BUG_ON(sizeof(struct xfrm_state_walk) > 9504c563f76STimo Teras sizeof(cb->args) - sizeof(cb->args[0])); 9514c563f76STimo Teras 9521da177e4SLinus Torvalds info.in_skb = cb->skb; 9531da177e4SLinus Torvalds info.out_skb = skb; 9541da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq; 9551da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI; 9564c563f76STimo Teras 9574c563f76STimo Teras if (!cb->args[0]) { 958d3623099SNicolas Dichtel struct nlattr *attrs[XFRMA_MAX+1]; 959870a2df4SNicolas Dichtel struct xfrm_address_filter *filter = NULL; 960d3623099SNicolas Dichtel u8 proto = 0; 961d3623099SNicolas Dichtel int err; 962d3623099SNicolas Dichtel 963fceb6435SJohannes Berg err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX, xfrma_policy, 964fceb6435SJohannes Berg NULL); 965d3623099SNicolas Dichtel if (err < 0) 966d3623099SNicolas Dichtel return err; 967d3623099SNicolas Dichtel 968870a2df4SNicolas Dichtel if (attrs[XFRMA_ADDRESS_FILTER]) { 969df367561SAndrzej Hajda filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), 970df367561SAndrzej Hajda sizeof(*filter), GFP_KERNEL); 971d3623099SNicolas Dichtel if (filter == NULL) 972d3623099SNicolas Dichtel return -ENOMEM; 973d3623099SNicolas Dichtel } 974d3623099SNicolas Dichtel 975d3623099SNicolas Dichtel if (attrs[XFRMA_PROTO]) 976d3623099SNicolas Dichtel proto = nla_get_u8(attrs[XFRMA_PROTO]); 977d3623099SNicolas Dichtel 978d3623099SNicolas Dichtel xfrm_state_walk_init(walk, proto, filter); 9791ba5bf99SVegard Nossum cb->args[0] = 1; 9804c563f76STimo Teras } 9814c563f76STimo Teras 982fc34acd3SAlexey Dobriyan (void) xfrm_state_walk(net, walk, dump_one_state, &info); 9831da177e4SLinus Torvalds 9841da177e4SLinus Torvalds return skb->len; 9851da177e4SLinus Torvalds } 9861da177e4SLinus Torvalds 9871da177e4SLinus Torvalds static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, 9881da177e4SLinus Torvalds struct xfrm_state *x, u32 seq) 9891da177e4SLinus Torvalds { 9901da177e4SLinus Torvalds struct xfrm_dump_info info; 9911da177e4SLinus Torvalds struct sk_buff *skb; 992864745d2SMathias Krause int err; 9931da177e4SLinus Torvalds 9947deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 9951da177e4SLinus Torvalds if (!skb) 9961da177e4SLinus Torvalds return ERR_PTR(-ENOMEM); 9971da177e4SLinus Torvalds 9981da177e4SLinus Torvalds info.in_skb = in_skb; 9991da177e4SLinus Torvalds info.out_skb = skb; 10001da177e4SLinus Torvalds info.nlmsg_seq = seq; 10011da177e4SLinus Torvalds info.nlmsg_flags = 0; 10021da177e4SLinus Torvalds 1003864745d2SMathias Krause err = dump_one_state(x, 0, &info); 1004864745d2SMathias Krause if (err) { 10051da177e4SLinus Torvalds kfree_skb(skb); 1006864745d2SMathias Krause return ERR_PTR(err); 10071da177e4SLinus Torvalds } 10081da177e4SLinus Torvalds 10091da177e4SLinus Torvalds return skb; 10101da177e4SLinus Torvalds } 10111da177e4SLinus Torvalds 101221ee543eSMichal Kubecek /* A wrapper for nlmsg_multicast() checking that nlsk is still available. 101321ee543eSMichal Kubecek * Must be called with RCU read lock. 101421ee543eSMichal Kubecek */ 101521ee543eSMichal Kubecek static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb, 101621ee543eSMichal Kubecek u32 pid, unsigned int group) 101721ee543eSMichal Kubecek { 101821ee543eSMichal Kubecek struct sock *nlsk = rcu_dereference(net->xfrm.nlsk); 101921ee543eSMichal Kubecek 102021ee543eSMichal Kubecek if (nlsk) 102121ee543eSMichal Kubecek return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); 102221ee543eSMichal Kubecek else 102321ee543eSMichal Kubecek return -1; 102421ee543eSMichal Kubecek } 102521ee543eSMichal Kubecek 10267deb2264SThomas Graf static inline size_t xfrm_spdinfo_msgsize(void) 10277deb2264SThomas Graf { 10287deb2264SThomas Graf return NLMSG_ALIGN(4) 10297deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_spdinfo)) 1030880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhinfo)) 1031880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhthresh)) 1032880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhthresh)); 10337deb2264SThomas Graf } 10347deb2264SThomas Graf 1035e071041bSAlexey Dobriyan static int build_spdinfo(struct sk_buff *skb, struct net *net, 103615e47304SEric W. Biederman u32 portid, u32 seq, u32 flags) 1037ecfd6b18SJamal Hadi Salim { 10385a6d3416SJamal Hadi Salim struct xfrmk_spdinfo si; 10395a6d3416SJamal Hadi Salim struct xfrmu_spdinfo spc; 10405a6d3416SJamal Hadi Salim struct xfrmu_spdhinfo sph; 1041880a6fabSChristophe Gouault struct xfrmu_spdhthresh spt4, spt6; 1042ecfd6b18SJamal Hadi Salim struct nlmsghdr *nlh; 10431d1e34ddSDavid S. Miller int err; 1044ecfd6b18SJamal Hadi Salim u32 *f; 1045880a6fabSChristophe Gouault unsigned lseq; 1046ecfd6b18SJamal Hadi Salim 104715e47304SEric W. Biederman nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0); 104825985edcSLucas De Marchi if (nlh == NULL) /* shouldn't really happen ... */ 1049ecfd6b18SJamal Hadi Salim return -EMSGSIZE; 1050ecfd6b18SJamal Hadi Salim 1051ecfd6b18SJamal Hadi Salim f = nlmsg_data(nlh); 1052ecfd6b18SJamal Hadi Salim *f = flags; 1053e071041bSAlexey Dobriyan xfrm_spd_getinfo(net, &si); 10545a6d3416SJamal Hadi Salim spc.incnt = si.incnt; 10555a6d3416SJamal Hadi Salim spc.outcnt = si.outcnt; 10565a6d3416SJamal Hadi Salim spc.fwdcnt = si.fwdcnt; 10575a6d3416SJamal Hadi Salim spc.inscnt = si.inscnt; 10585a6d3416SJamal Hadi Salim spc.outscnt = si.outscnt; 10595a6d3416SJamal Hadi Salim spc.fwdscnt = si.fwdscnt; 10605a6d3416SJamal Hadi Salim sph.spdhcnt = si.spdhcnt; 10615a6d3416SJamal Hadi Salim sph.spdhmcnt = si.spdhmcnt; 1062ecfd6b18SJamal Hadi Salim 1063880a6fabSChristophe Gouault do { 1064880a6fabSChristophe Gouault lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock); 1065880a6fabSChristophe Gouault 1066880a6fabSChristophe Gouault spt4.lbits = net->xfrm.policy_hthresh.lbits4; 1067880a6fabSChristophe Gouault spt4.rbits = net->xfrm.policy_hthresh.rbits4; 1068880a6fabSChristophe Gouault spt6.lbits = net->xfrm.policy_hthresh.lbits6; 1069880a6fabSChristophe Gouault spt6.rbits = net->xfrm.policy_hthresh.rbits6; 1070880a6fabSChristophe Gouault } while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq)); 1071880a6fabSChristophe Gouault 10721d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc); 10731d1e34ddSDavid S. Miller if (!err) 10741d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph); 1075880a6fabSChristophe Gouault if (!err) 1076880a6fabSChristophe Gouault err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4); 1077880a6fabSChristophe Gouault if (!err) 1078880a6fabSChristophe Gouault err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6); 10791d1e34ddSDavid S. Miller if (err) { 10801d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 10811d1e34ddSDavid S. Miller return err; 10821d1e34ddSDavid S. Miller } 1083ecfd6b18SJamal Hadi Salim 1084053c095aSJohannes Berg nlmsg_end(skb, nlh); 1085053c095aSJohannes Berg return 0; 1086ecfd6b18SJamal Hadi Salim } 1087ecfd6b18SJamal Hadi Salim 1088880a6fabSChristophe Gouault static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1089880a6fabSChristophe Gouault struct nlattr **attrs) 1090880a6fabSChristophe Gouault { 1091880a6fabSChristophe Gouault struct net *net = sock_net(skb->sk); 1092880a6fabSChristophe Gouault struct xfrmu_spdhthresh *thresh4 = NULL; 1093880a6fabSChristophe Gouault struct xfrmu_spdhthresh *thresh6 = NULL; 1094880a6fabSChristophe Gouault 1095880a6fabSChristophe Gouault /* selector prefixlen thresholds to hash policies */ 1096880a6fabSChristophe Gouault if (attrs[XFRMA_SPD_IPV4_HTHRESH]) { 1097880a6fabSChristophe Gouault struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH]; 1098880a6fabSChristophe Gouault 1099880a6fabSChristophe Gouault if (nla_len(rta) < sizeof(*thresh4)) 1100880a6fabSChristophe Gouault return -EINVAL; 1101880a6fabSChristophe Gouault thresh4 = nla_data(rta); 1102880a6fabSChristophe Gouault if (thresh4->lbits > 32 || thresh4->rbits > 32) 1103880a6fabSChristophe Gouault return -EINVAL; 1104880a6fabSChristophe Gouault } 1105880a6fabSChristophe Gouault if (attrs[XFRMA_SPD_IPV6_HTHRESH]) { 1106880a6fabSChristophe Gouault struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH]; 1107880a6fabSChristophe Gouault 1108880a6fabSChristophe Gouault if (nla_len(rta) < sizeof(*thresh6)) 1109880a6fabSChristophe Gouault return -EINVAL; 1110880a6fabSChristophe Gouault thresh6 = nla_data(rta); 1111880a6fabSChristophe Gouault if (thresh6->lbits > 128 || thresh6->rbits > 128) 1112880a6fabSChristophe Gouault return -EINVAL; 1113880a6fabSChristophe Gouault } 1114880a6fabSChristophe Gouault 1115880a6fabSChristophe Gouault if (thresh4 || thresh6) { 1116880a6fabSChristophe Gouault write_seqlock(&net->xfrm.policy_hthresh.lock); 1117880a6fabSChristophe Gouault if (thresh4) { 1118880a6fabSChristophe Gouault net->xfrm.policy_hthresh.lbits4 = thresh4->lbits; 1119880a6fabSChristophe Gouault net->xfrm.policy_hthresh.rbits4 = thresh4->rbits; 1120880a6fabSChristophe Gouault } 1121880a6fabSChristophe Gouault if (thresh6) { 1122880a6fabSChristophe Gouault net->xfrm.policy_hthresh.lbits6 = thresh6->lbits; 1123880a6fabSChristophe Gouault net->xfrm.policy_hthresh.rbits6 = thresh6->rbits; 1124880a6fabSChristophe Gouault } 1125880a6fabSChristophe Gouault write_sequnlock(&net->xfrm.policy_hthresh.lock); 1126880a6fabSChristophe Gouault 1127880a6fabSChristophe Gouault xfrm_policy_hash_rebuild(net); 1128880a6fabSChristophe Gouault } 1129880a6fabSChristophe Gouault 1130880a6fabSChristophe Gouault return 0; 1131880a6fabSChristophe Gouault } 1132880a6fabSChristophe Gouault 1133ecfd6b18SJamal Hadi Salim static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 11345424f32eSThomas Graf struct nlattr **attrs) 1135ecfd6b18SJamal Hadi Salim { 1136a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk); 1137ecfd6b18SJamal Hadi Salim struct sk_buff *r_skb; 11387b67c857SThomas Graf u32 *flags = nlmsg_data(nlh); 113915e47304SEric W. Biederman u32 sportid = NETLINK_CB(skb).portid; 1140ecfd6b18SJamal Hadi Salim u32 seq = nlh->nlmsg_seq; 1141ecfd6b18SJamal Hadi Salim 11427deb2264SThomas Graf r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC); 1143ecfd6b18SJamal Hadi Salim if (r_skb == NULL) 1144ecfd6b18SJamal Hadi Salim return -ENOMEM; 1145ecfd6b18SJamal Hadi Salim 114615e47304SEric W. Biederman if (build_spdinfo(r_skb, net, sportid, seq, *flags) < 0) 1147ecfd6b18SJamal Hadi Salim BUG(); 1148ecfd6b18SJamal Hadi Salim 114915e47304SEric W. Biederman return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid); 1150ecfd6b18SJamal Hadi Salim } 1151ecfd6b18SJamal Hadi Salim 11527deb2264SThomas Graf static inline size_t xfrm_sadinfo_msgsize(void) 11537deb2264SThomas Graf { 11547deb2264SThomas Graf return NLMSG_ALIGN(4) 11557deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_sadhinfo)) 11567deb2264SThomas Graf + nla_total_size(4); /* XFRMA_SAD_CNT */ 11577deb2264SThomas Graf } 11587deb2264SThomas Graf 1159e071041bSAlexey Dobriyan static int build_sadinfo(struct sk_buff *skb, struct net *net, 116015e47304SEric W. Biederman u32 portid, u32 seq, u32 flags) 116128d8909bSJamal Hadi Salim { 1162af11e316SJamal Hadi Salim struct xfrmk_sadinfo si; 1163af11e316SJamal Hadi Salim struct xfrmu_sadhinfo sh; 116428d8909bSJamal Hadi Salim struct nlmsghdr *nlh; 11651d1e34ddSDavid S. Miller int err; 116628d8909bSJamal Hadi Salim u32 *f; 116728d8909bSJamal Hadi Salim 116815e47304SEric W. Biederman nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0); 116925985edcSLucas De Marchi if (nlh == NULL) /* shouldn't really happen ... */ 117028d8909bSJamal Hadi Salim return -EMSGSIZE; 117128d8909bSJamal Hadi Salim 117228d8909bSJamal Hadi Salim f = nlmsg_data(nlh); 117328d8909bSJamal Hadi Salim *f = flags; 1174e071041bSAlexey Dobriyan xfrm_sad_getinfo(net, &si); 117528d8909bSJamal Hadi Salim 1176af11e316SJamal Hadi Salim sh.sadhmcnt = si.sadhmcnt; 1177af11e316SJamal Hadi Salim sh.sadhcnt = si.sadhcnt; 1178af11e316SJamal Hadi Salim 11791d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt); 11801d1e34ddSDavid S. Miller if (!err) 11811d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh); 11821d1e34ddSDavid S. Miller if (err) { 11831d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 11841d1e34ddSDavid S. Miller return err; 11851d1e34ddSDavid S. Miller } 118628d8909bSJamal Hadi Salim 1187053c095aSJohannes Berg nlmsg_end(skb, nlh); 1188053c095aSJohannes Berg return 0; 118928d8909bSJamal Hadi Salim } 119028d8909bSJamal Hadi Salim 119128d8909bSJamal Hadi Salim static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 11925424f32eSThomas Graf struct nlattr **attrs) 119328d8909bSJamal Hadi Salim { 1194a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk); 119528d8909bSJamal Hadi Salim struct sk_buff *r_skb; 11967b67c857SThomas Graf u32 *flags = nlmsg_data(nlh); 119715e47304SEric W. Biederman u32 sportid = NETLINK_CB(skb).portid; 119828d8909bSJamal Hadi Salim u32 seq = nlh->nlmsg_seq; 119928d8909bSJamal Hadi Salim 12007deb2264SThomas Graf r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC); 120128d8909bSJamal Hadi Salim if (r_skb == NULL) 120228d8909bSJamal Hadi Salim return -ENOMEM; 120328d8909bSJamal Hadi Salim 120415e47304SEric W. Biederman if (build_sadinfo(r_skb, net, sportid, seq, *flags) < 0) 120528d8909bSJamal Hadi Salim BUG(); 120628d8909bSJamal Hadi Salim 120715e47304SEric W. Biederman return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid); 120828d8909bSJamal Hadi Salim } 120928d8909bSJamal Hadi Salim 121022e70050SChristoph Hellwig static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 12115424f32eSThomas Graf struct nlattr **attrs) 12121da177e4SLinus Torvalds { 1213fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 12147b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh); 12151da177e4SLinus Torvalds struct xfrm_state *x; 12161da177e4SLinus Torvalds struct sk_buff *resp_skb; 1217eb2971b6SMasahide NAKAMURA int err = -ESRCH; 12181da177e4SLinus Torvalds 1219fc34acd3SAlexey Dobriyan x = xfrm_user_state_lookup(net, p, attrs, &err); 12201da177e4SLinus Torvalds if (x == NULL) 12211da177e4SLinus Torvalds goto out_noput; 12221da177e4SLinus Torvalds 12231da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 12241da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 12251da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 12261da177e4SLinus Torvalds } else { 122715e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid); 12281da177e4SLinus Torvalds } 12291da177e4SLinus Torvalds xfrm_state_put(x); 12301da177e4SLinus Torvalds out_noput: 12311da177e4SLinus Torvalds return err; 12321da177e4SLinus Torvalds } 12331da177e4SLinus Torvalds 123422e70050SChristoph Hellwig static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, 12355424f32eSThomas Graf struct nlattr **attrs) 12361da177e4SLinus Torvalds { 1237fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 12381da177e4SLinus Torvalds struct xfrm_state *x; 12391da177e4SLinus Torvalds struct xfrm_userspi_info *p; 12401da177e4SLinus Torvalds struct sk_buff *resp_skb; 12411da177e4SLinus Torvalds xfrm_address_t *daddr; 12421da177e4SLinus Torvalds int family; 12431da177e4SLinus Torvalds int err; 12446f26b61eSJamal Hadi Salim u32 mark; 12456f26b61eSJamal Hadi Salim struct xfrm_mark m; 12461da177e4SLinus Torvalds 12477b67c857SThomas Graf p = nlmsg_data(nlh); 1248776e9dd9SFan Du err = verify_spi_info(p->info.id.proto, p->min, p->max); 12491da177e4SLinus Torvalds if (err) 12501da177e4SLinus Torvalds goto out_noput; 12511da177e4SLinus Torvalds 12521da177e4SLinus Torvalds family = p->info.family; 12531da177e4SLinus Torvalds daddr = &p->info.id.daddr; 12541da177e4SLinus Torvalds 12551da177e4SLinus Torvalds x = NULL; 12566f26b61eSJamal Hadi Salim 12576f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m); 12581da177e4SLinus Torvalds if (p->info.seq) { 12596f26b61eSJamal Hadi Salim x = xfrm_find_acq_byseq(net, mark, p->info.seq); 126070e94e66SYOSHIFUJI Hideaki / 吉藤英明 if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) { 12611da177e4SLinus Torvalds xfrm_state_put(x); 12621da177e4SLinus Torvalds x = NULL; 12631da177e4SLinus Torvalds } 12641da177e4SLinus Torvalds } 12651da177e4SLinus Torvalds 12661da177e4SLinus Torvalds if (!x) 12676f26b61eSJamal Hadi Salim x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid, 12681da177e4SLinus Torvalds p->info.id.proto, daddr, 12691da177e4SLinus Torvalds &p->info.saddr, 1, 12701da177e4SLinus Torvalds family); 12711da177e4SLinus Torvalds err = -ENOENT; 12721da177e4SLinus Torvalds if (x == NULL) 12731da177e4SLinus Torvalds goto out_noput; 12741da177e4SLinus Torvalds 1275658b219eSHerbert Xu err = xfrm_alloc_spi(x, p->min, p->max); 1276658b219eSHerbert Xu if (err) 1277658b219eSHerbert Xu goto out; 12781da177e4SLinus Torvalds 12791da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 12801da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 12811da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 12821da177e4SLinus Torvalds goto out; 12831da177e4SLinus Torvalds } 12841da177e4SLinus Torvalds 128515e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid); 12861da177e4SLinus Torvalds 12871da177e4SLinus Torvalds out: 12881da177e4SLinus Torvalds xfrm_state_put(x); 12891da177e4SLinus Torvalds out_noput: 12901da177e4SLinus Torvalds return err; 12911da177e4SLinus Torvalds } 12921da177e4SLinus Torvalds 1293b798a9edSJamal Hadi Salim static int verify_policy_dir(u8 dir) 12941da177e4SLinus Torvalds { 12951da177e4SLinus Torvalds switch (dir) { 12961da177e4SLinus Torvalds case XFRM_POLICY_IN: 12971da177e4SLinus Torvalds case XFRM_POLICY_OUT: 12981da177e4SLinus Torvalds case XFRM_POLICY_FWD: 12991da177e4SLinus Torvalds break; 13001da177e4SLinus Torvalds 13011da177e4SLinus Torvalds default: 13021da177e4SLinus Torvalds return -EINVAL; 13033ff50b79SStephen Hemminger } 13041da177e4SLinus Torvalds 13051da177e4SLinus Torvalds return 0; 13061da177e4SLinus Torvalds } 13071da177e4SLinus Torvalds 1308b798a9edSJamal Hadi Salim static int verify_policy_type(u8 type) 1309f7b6983fSMasahide NAKAMURA { 1310f7b6983fSMasahide NAKAMURA switch (type) { 1311f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_MAIN: 1312f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1313f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_SUB: 1314f7b6983fSMasahide NAKAMURA #endif 1315f7b6983fSMasahide NAKAMURA break; 1316f7b6983fSMasahide NAKAMURA 1317f7b6983fSMasahide NAKAMURA default: 1318f7b6983fSMasahide NAKAMURA return -EINVAL; 13193ff50b79SStephen Hemminger } 1320f7b6983fSMasahide NAKAMURA 1321f7b6983fSMasahide NAKAMURA return 0; 1322f7b6983fSMasahide NAKAMURA } 1323f7b6983fSMasahide NAKAMURA 13241da177e4SLinus Torvalds static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) 13251da177e4SLinus Torvalds { 1326e682adf0SFan Du int ret; 1327e682adf0SFan Du 13281da177e4SLinus Torvalds switch (p->share) { 13291da177e4SLinus Torvalds case XFRM_SHARE_ANY: 13301da177e4SLinus Torvalds case XFRM_SHARE_SESSION: 13311da177e4SLinus Torvalds case XFRM_SHARE_USER: 13321da177e4SLinus Torvalds case XFRM_SHARE_UNIQUE: 13331da177e4SLinus Torvalds break; 13341da177e4SLinus Torvalds 13351da177e4SLinus Torvalds default: 13361da177e4SLinus Torvalds return -EINVAL; 13373ff50b79SStephen Hemminger } 13381da177e4SLinus Torvalds 13391da177e4SLinus Torvalds switch (p->action) { 13401da177e4SLinus Torvalds case XFRM_POLICY_ALLOW: 13411da177e4SLinus Torvalds case XFRM_POLICY_BLOCK: 13421da177e4SLinus Torvalds break; 13431da177e4SLinus Torvalds 13441da177e4SLinus Torvalds default: 13451da177e4SLinus Torvalds return -EINVAL; 13463ff50b79SStephen Hemminger } 13471da177e4SLinus Torvalds 13481da177e4SLinus Torvalds switch (p->sel.family) { 13491da177e4SLinus Torvalds case AF_INET: 13501da177e4SLinus Torvalds break; 13511da177e4SLinus Torvalds 13521da177e4SLinus Torvalds case AF_INET6: 1353dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 13541da177e4SLinus Torvalds break; 13551da177e4SLinus Torvalds #else 13561da177e4SLinus Torvalds return -EAFNOSUPPORT; 13571da177e4SLinus Torvalds #endif 13581da177e4SLinus Torvalds 13591da177e4SLinus Torvalds default: 13601da177e4SLinus Torvalds return -EINVAL; 13613ff50b79SStephen Hemminger } 13621da177e4SLinus Torvalds 1363e682adf0SFan Du ret = verify_policy_dir(p->dir); 1364e682adf0SFan Du if (ret) 1365e682adf0SFan Du return ret; 1366e682adf0SFan Du if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir)) 1367e682adf0SFan Du return -EINVAL; 1368e682adf0SFan Du 1369e682adf0SFan Du return 0; 13701da177e4SLinus Torvalds } 13711da177e4SLinus Torvalds 13725424f32eSThomas Graf static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs) 1373df71837dSTrent Jaeger { 13745424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 1375df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx; 1376df71837dSTrent Jaeger 1377df71837dSTrent Jaeger if (!rt) 1378df71837dSTrent Jaeger return 0; 1379df71837dSTrent Jaeger 13805424f32eSThomas Graf uctx = nla_data(rt); 138152a4c640SNikolay Aleksandrov return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL); 1382df71837dSTrent Jaeger } 1383df71837dSTrent Jaeger 13841da177e4SLinus Torvalds static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, 13851da177e4SLinus Torvalds int nr) 13861da177e4SLinus Torvalds { 13871da177e4SLinus Torvalds int i; 13881da177e4SLinus Torvalds 13891da177e4SLinus Torvalds xp->xfrm_nr = nr; 13901da177e4SLinus Torvalds for (i = 0; i < nr; i++, ut++) { 13911da177e4SLinus Torvalds struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 13921da177e4SLinus Torvalds 13931da177e4SLinus Torvalds memcpy(&t->id, &ut->id, sizeof(struct xfrm_id)); 13941da177e4SLinus Torvalds memcpy(&t->saddr, &ut->saddr, 13951da177e4SLinus Torvalds sizeof(xfrm_address_t)); 13961da177e4SLinus Torvalds t->reqid = ut->reqid; 13971da177e4SLinus Torvalds t->mode = ut->mode; 13981da177e4SLinus Torvalds t->share = ut->share; 13991da177e4SLinus Torvalds t->optional = ut->optional; 14001da177e4SLinus Torvalds t->aalgos = ut->aalgos; 14011da177e4SLinus Torvalds t->ealgos = ut->ealgos; 14021da177e4SLinus Torvalds t->calgos = ut->calgos; 1403c5d18e98SHerbert Xu /* If all masks are ~0, then we allow all algorithms. */ 1404c5d18e98SHerbert Xu t->allalgs = !~(t->aalgos & t->ealgos & t->calgos); 14058511d01dSMiika Komu t->encap_family = ut->family; 14061da177e4SLinus Torvalds } 14071da177e4SLinus Torvalds } 14081da177e4SLinus Torvalds 1409b4ad86bfSDavid S. Miller static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) 1410b4ad86bfSDavid S. Miller { 1411b4ad86bfSDavid S. Miller int i; 1412b4ad86bfSDavid S. Miller 1413b4ad86bfSDavid S. Miller if (nr > XFRM_MAX_DEPTH) 1414b4ad86bfSDavid S. Miller return -EINVAL; 1415b4ad86bfSDavid S. Miller 1416b4ad86bfSDavid S. Miller for (i = 0; i < nr; i++) { 1417b4ad86bfSDavid S. Miller /* We never validated the ut->family value, so many 1418b4ad86bfSDavid S. Miller * applications simply leave it at zero. The check was 1419b4ad86bfSDavid S. Miller * never made and ut->family was ignored because all 1420b4ad86bfSDavid S. Miller * templates could be assumed to have the same family as 1421b4ad86bfSDavid S. Miller * the policy itself. Now that we will have ipv4-in-ipv6 1422b4ad86bfSDavid S. Miller * and ipv6-in-ipv4 tunnels, this is no longer true. 1423b4ad86bfSDavid S. Miller */ 1424b4ad86bfSDavid S. Miller if (!ut[i].family) 1425b4ad86bfSDavid S. Miller ut[i].family = family; 1426b4ad86bfSDavid S. Miller 1427b4ad86bfSDavid S. Miller switch (ut[i].family) { 1428b4ad86bfSDavid S. Miller case AF_INET: 1429b4ad86bfSDavid S. Miller break; 1430dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 1431b4ad86bfSDavid S. Miller case AF_INET6: 1432b4ad86bfSDavid S. Miller break; 1433b4ad86bfSDavid S. Miller #endif 1434b4ad86bfSDavid S. Miller default: 1435b4ad86bfSDavid S. Miller return -EINVAL; 14363ff50b79SStephen Hemminger } 1437b4ad86bfSDavid S. Miller } 1438b4ad86bfSDavid S. Miller 1439b4ad86bfSDavid S. Miller return 0; 1440b4ad86bfSDavid S. Miller } 1441b4ad86bfSDavid S. Miller 14425424f32eSThomas Graf static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs) 14431da177e4SLinus Torvalds { 14445424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL]; 14451da177e4SLinus Torvalds 14461da177e4SLinus Torvalds if (!rt) { 14471da177e4SLinus Torvalds pol->xfrm_nr = 0; 14481da177e4SLinus Torvalds } else { 14495424f32eSThomas Graf struct xfrm_user_tmpl *utmpl = nla_data(rt); 14505424f32eSThomas Graf int nr = nla_len(rt) / sizeof(*utmpl); 1451b4ad86bfSDavid S. Miller int err; 14521da177e4SLinus Torvalds 1453b4ad86bfSDavid S. Miller err = validate_tmpl(nr, utmpl, pol->family); 1454b4ad86bfSDavid S. Miller if (err) 1455b4ad86bfSDavid S. Miller return err; 14561da177e4SLinus Torvalds 14575424f32eSThomas Graf copy_templates(pol, utmpl, nr); 14581da177e4SLinus Torvalds } 14591da177e4SLinus Torvalds return 0; 14601da177e4SLinus Torvalds } 14611da177e4SLinus Torvalds 14625424f32eSThomas Graf static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs) 1463f7b6983fSMasahide NAKAMURA { 14645424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_POLICY_TYPE]; 1465f7b6983fSMasahide NAKAMURA struct xfrm_userpolicy_type *upt; 1466b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 1467f7b6983fSMasahide NAKAMURA int err; 1468f7b6983fSMasahide NAKAMURA 1469f7b6983fSMasahide NAKAMURA if (rt) { 14705424f32eSThomas Graf upt = nla_data(rt); 1471f7b6983fSMasahide NAKAMURA type = upt->type; 1472f7b6983fSMasahide NAKAMURA } 1473f7b6983fSMasahide NAKAMURA 1474f7b6983fSMasahide NAKAMURA err = verify_policy_type(type); 1475f7b6983fSMasahide NAKAMURA if (err) 1476f7b6983fSMasahide NAKAMURA return err; 1477f7b6983fSMasahide NAKAMURA 1478f7b6983fSMasahide NAKAMURA *tp = type; 1479f7b6983fSMasahide NAKAMURA return 0; 1480f7b6983fSMasahide NAKAMURA } 1481f7b6983fSMasahide NAKAMURA 14821da177e4SLinus Torvalds static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p) 14831da177e4SLinus Torvalds { 14841da177e4SLinus Torvalds xp->priority = p->priority; 14851da177e4SLinus Torvalds xp->index = p->index; 14861da177e4SLinus Torvalds memcpy(&xp->selector, &p->sel, sizeof(xp->selector)); 14871da177e4SLinus Torvalds memcpy(&xp->lft, &p->lft, sizeof(xp->lft)); 14881da177e4SLinus Torvalds xp->action = p->action; 14891da177e4SLinus Torvalds xp->flags = p->flags; 14901da177e4SLinus Torvalds xp->family = p->sel.family; 14911da177e4SLinus Torvalds /* XXX xp->share = p->share; */ 14921da177e4SLinus Torvalds } 14931da177e4SLinus Torvalds 14941da177e4SLinus Torvalds static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir) 14951da177e4SLinus Torvalds { 14967b789836SMathias Krause memset(p, 0, sizeof(*p)); 14971da177e4SLinus Torvalds memcpy(&p->sel, &xp->selector, sizeof(p->sel)); 14981da177e4SLinus Torvalds memcpy(&p->lft, &xp->lft, sizeof(p->lft)); 14991da177e4SLinus Torvalds memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft)); 15001da177e4SLinus Torvalds p->priority = xp->priority; 15011da177e4SLinus Torvalds p->index = xp->index; 15021da177e4SLinus Torvalds p->sel.family = xp->family; 15031da177e4SLinus Torvalds p->dir = dir; 15041da177e4SLinus Torvalds p->action = xp->action; 15051da177e4SLinus Torvalds p->flags = xp->flags; 15061da177e4SLinus Torvalds p->share = XFRM_SHARE_ANY; /* XXX xp->share */ 15071da177e4SLinus Torvalds } 15081da177e4SLinus Torvalds 1509fc34acd3SAlexey Dobriyan static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp) 15101da177e4SLinus Torvalds { 1511fc34acd3SAlexey Dobriyan struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL); 15121da177e4SLinus Torvalds int err; 15131da177e4SLinus Torvalds 15141da177e4SLinus Torvalds if (!xp) { 15151da177e4SLinus Torvalds *errp = -ENOMEM; 15161da177e4SLinus Torvalds return NULL; 15171da177e4SLinus Torvalds } 15181da177e4SLinus Torvalds 15191da177e4SLinus Torvalds copy_from_user_policy(xp, p); 1520df71837dSTrent Jaeger 152135a7aa08SThomas Graf err = copy_from_user_policy_type(&xp->type, attrs); 1522f7b6983fSMasahide NAKAMURA if (err) 1523f7b6983fSMasahide NAKAMURA goto error; 1524f7b6983fSMasahide NAKAMURA 152535a7aa08SThomas Graf if (!(err = copy_from_user_tmpl(xp, attrs))) 152635a7aa08SThomas Graf err = copy_from_user_sec_ctx(xp, attrs); 1527f7b6983fSMasahide NAKAMURA if (err) 1528f7b6983fSMasahide NAKAMURA goto error; 15291da177e4SLinus Torvalds 1530295fae56SJamal Hadi Salim xfrm_mark_get(attrs, &xp->mark); 1531295fae56SJamal Hadi Salim 15321da177e4SLinus Torvalds return xp; 1533f7b6983fSMasahide NAKAMURA error: 1534f7b6983fSMasahide NAKAMURA *errp = err; 153512a169e7SHerbert Xu xp->walk.dead = 1; 153664c31b3fSWANG Cong xfrm_policy_destroy(xp); 1537f7b6983fSMasahide NAKAMURA return NULL; 15381da177e4SLinus Torvalds } 15391da177e4SLinus Torvalds 154022e70050SChristoph Hellwig static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 15415424f32eSThomas Graf struct nlattr **attrs) 15421da177e4SLinus Torvalds { 1543fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 15447b67c857SThomas Graf struct xfrm_userpolicy_info *p = nlmsg_data(nlh); 15451da177e4SLinus Torvalds struct xfrm_policy *xp; 154626b15dadSJamal Hadi Salim struct km_event c; 15471da177e4SLinus Torvalds int err; 15481da177e4SLinus Torvalds int excl; 15491da177e4SLinus Torvalds 15501da177e4SLinus Torvalds err = verify_newpolicy_info(p); 15511da177e4SLinus Torvalds if (err) 15521da177e4SLinus Torvalds return err; 155335a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 1554df71837dSTrent Jaeger if (err) 1555df71837dSTrent Jaeger return err; 15561da177e4SLinus Torvalds 1557fc34acd3SAlexey Dobriyan xp = xfrm_policy_construct(net, p, attrs, &err); 15581da177e4SLinus Torvalds if (!xp) 15591da177e4SLinus Torvalds return err; 15601da177e4SLinus Torvalds 156125985edcSLucas De Marchi /* shouldn't excl be based on nlh flags?? 156226b15dadSJamal Hadi Salim * Aha! this is anti-netlink really i.e more pfkey derived 156326b15dadSJamal Hadi Salim * in netlink excl is a flag and you wouldnt need 156426b15dadSJamal Hadi Salim * a type XFRM_MSG_UPDPOLICY - JHS */ 15651da177e4SLinus Torvalds excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; 15661da177e4SLinus Torvalds err = xfrm_policy_insert(p->dir, xp, excl); 15672e71029eSTetsuo Handa xfrm_audit_policy_add(xp, err ? 0 : 1, true); 1568161a09e7SJoy Latten 15691da177e4SLinus Torvalds if (err) { 157003e1ad7bSPaul Moore security_xfrm_policy_free(xp->security); 15711da177e4SLinus Torvalds kfree(xp); 15721da177e4SLinus Torvalds return err; 15731da177e4SLinus Torvalds } 15741da177e4SLinus Torvalds 1575f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 157626b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 157715e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 157826b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c); 157926b15dadSJamal Hadi Salim 15801da177e4SLinus Torvalds xfrm_pol_put(xp); 15811da177e4SLinus Torvalds 15821da177e4SLinus Torvalds return 0; 15831da177e4SLinus Torvalds } 15841da177e4SLinus Torvalds 15851da177e4SLinus Torvalds static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb) 15861da177e4SLinus Torvalds { 15871da177e4SLinus Torvalds struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH]; 15881da177e4SLinus Torvalds int i; 15891da177e4SLinus Torvalds 15901da177e4SLinus Torvalds if (xp->xfrm_nr == 0) 15911da177e4SLinus Torvalds return 0; 15921da177e4SLinus Torvalds 15931da177e4SLinus Torvalds for (i = 0; i < xp->xfrm_nr; i++) { 15941da177e4SLinus Torvalds struct xfrm_user_tmpl *up = &vec[i]; 15951da177e4SLinus Torvalds struct xfrm_tmpl *kp = &xp->xfrm_vec[i]; 15961da177e4SLinus Torvalds 15971f86840fSMathias Krause memset(up, 0, sizeof(*up)); 15981da177e4SLinus Torvalds memcpy(&up->id, &kp->id, sizeof(up->id)); 15998511d01dSMiika Komu up->family = kp->encap_family; 16001da177e4SLinus Torvalds memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr)); 16011da177e4SLinus Torvalds up->reqid = kp->reqid; 16021da177e4SLinus Torvalds up->mode = kp->mode; 16031da177e4SLinus Torvalds up->share = kp->share; 16041da177e4SLinus Torvalds up->optional = kp->optional; 16051da177e4SLinus Torvalds up->aalgos = kp->aalgos; 16061da177e4SLinus Torvalds up->ealgos = kp->ealgos; 16071da177e4SLinus Torvalds up->calgos = kp->calgos; 16081da177e4SLinus Torvalds } 16091da177e4SLinus Torvalds 1610c0144beaSThomas Graf return nla_put(skb, XFRMA_TMPL, 1611c0144beaSThomas Graf sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec); 1612df71837dSTrent Jaeger } 1613df71837dSTrent Jaeger 16140d681623SSerge Hallyn static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb) 16150d681623SSerge Hallyn { 16160d681623SSerge Hallyn if (x->security) { 16170d681623SSerge Hallyn return copy_sec_ctx(x->security, skb); 16180d681623SSerge Hallyn } 16190d681623SSerge Hallyn return 0; 16200d681623SSerge Hallyn } 16210d681623SSerge Hallyn 16220d681623SSerge Hallyn static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb) 16230d681623SSerge Hallyn { 16241d1e34ddSDavid S. Miller if (xp->security) 16250d681623SSerge Hallyn return copy_sec_ctx(xp->security, skb); 16260d681623SSerge Hallyn return 0; 16270d681623SSerge Hallyn } 1628cfbfd45aSThomas Graf static inline size_t userpolicy_type_attrsize(void) 1629cfbfd45aSThomas Graf { 1630cfbfd45aSThomas Graf #ifdef CONFIG_XFRM_SUB_POLICY 1631cfbfd45aSThomas Graf return nla_total_size(sizeof(struct xfrm_userpolicy_type)); 1632cfbfd45aSThomas Graf #else 1633cfbfd45aSThomas Graf return 0; 1634cfbfd45aSThomas Graf #endif 1635cfbfd45aSThomas Graf } 16360d681623SSerge Hallyn 1637f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1638b798a9edSJamal Hadi Salim static int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 1639f7b6983fSMasahide NAKAMURA { 1640c0144beaSThomas Graf struct xfrm_userpolicy_type upt = { 1641c0144beaSThomas Graf .type = type, 1642c0144beaSThomas Graf }; 1643f7b6983fSMasahide NAKAMURA 1644c0144beaSThomas Graf return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt); 1645f7b6983fSMasahide NAKAMURA } 1646f7b6983fSMasahide NAKAMURA 1647f7b6983fSMasahide NAKAMURA #else 1648b798a9edSJamal Hadi Salim static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 1649f7b6983fSMasahide NAKAMURA { 1650f7b6983fSMasahide NAKAMURA return 0; 1651f7b6983fSMasahide NAKAMURA } 1652f7b6983fSMasahide NAKAMURA #endif 1653f7b6983fSMasahide NAKAMURA 16541da177e4SLinus Torvalds static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr) 16551da177e4SLinus Torvalds { 16561da177e4SLinus Torvalds struct xfrm_dump_info *sp = ptr; 16571da177e4SLinus Torvalds struct xfrm_userpolicy_info *p; 16581da177e4SLinus Torvalds struct sk_buff *in_skb = sp->in_skb; 16591da177e4SLinus Torvalds struct sk_buff *skb = sp->out_skb; 16601da177e4SLinus Torvalds struct nlmsghdr *nlh; 16611d1e34ddSDavid S. Miller int err; 16621da177e4SLinus Torvalds 166315e47304SEric W. Biederman nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 166479b8b7f4SThomas Graf XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags); 166579b8b7f4SThomas Graf if (nlh == NULL) 166679b8b7f4SThomas Graf return -EMSGSIZE; 16671da177e4SLinus Torvalds 16687b67c857SThomas Graf p = nlmsg_data(nlh); 16691da177e4SLinus Torvalds copy_to_user_policy(xp, p, dir); 16701d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 16711d1e34ddSDavid S. Miller if (!err) 16721d1e34ddSDavid S. Miller err = copy_to_user_sec_ctx(xp, skb); 16731d1e34ddSDavid S. Miller if (!err) 16741d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 16751d1e34ddSDavid S. Miller if (!err) 16761d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 16771d1e34ddSDavid S. Miller if (err) { 16781d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 16791d1e34ddSDavid S. Miller return err; 16801d1e34ddSDavid S. Miller } 16819825069dSThomas Graf nlmsg_end(skb, nlh); 16821da177e4SLinus Torvalds return 0; 16831da177e4SLinus Torvalds } 16841da177e4SLinus Torvalds 16854c563f76STimo Teras static int xfrm_dump_policy_done(struct netlink_callback *cb) 16864c563f76STimo Teras { 16874c563f76STimo Teras struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; 1688283bc9f3SFan Du struct net *net = sock_net(cb->skb->sk); 16894c563f76STimo Teras 1690283bc9f3SFan Du xfrm_policy_walk_done(walk, net); 16914c563f76STimo Teras return 0; 16924c563f76STimo Teras } 16934c563f76STimo Teras 16941da177e4SLinus Torvalds static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb) 16951da177e4SLinus Torvalds { 1696fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 16974c563f76STimo Teras struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; 16981da177e4SLinus Torvalds struct xfrm_dump_info info; 16991da177e4SLinus Torvalds 17004c563f76STimo Teras BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) > 17014c563f76STimo Teras sizeof(cb->args) - sizeof(cb->args[0])); 17024c563f76STimo Teras 17031da177e4SLinus Torvalds info.in_skb = cb->skb; 17041da177e4SLinus Torvalds info.out_skb = skb; 17051da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq; 17061da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI; 17074c563f76STimo Teras 17084c563f76STimo Teras if (!cb->args[0]) { 17094c563f76STimo Teras cb->args[0] = 1; 17104c563f76STimo Teras xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY); 17114c563f76STimo Teras } 17124c563f76STimo Teras 1713fc34acd3SAlexey Dobriyan (void) xfrm_policy_walk(net, walk, dump_one_policy, &info); 17141da177e4SLinus Torvalds 17151da177e4SLinus Torvalds return skb->len; 17161da177e4SLinus Torvalds } 17171da177e4SLinus Torvalds 17181da177e4SLinus Torvalds static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, 17191da177e4SLinus Torvalds struct xfrm_policy *xp, 17201da177e4SLinus Torvalds int dir, u32 seq) 17211da177e4SLinus Torvalds { 17221da177e4SLinus Torvalds struct xfrm_dump_info info; 17231da177e4SLinus Torvalds struct sk_buff *skb; 1724c2546372SMathias Krause int err; 17251da177e4SLinus Torvalds 17267deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17271da177e4SLinus Torvalds if (!skb) 17281da177e4SLinus Torvalds return ERR_PTR(-ENOMEM); 17291da177e4SLinus Torvalds 17301da177e4SLinus Torvalds info.in_skb = in_skb; 17311da177e4SLinus Torvalds info.out_skb = skb; 17321da177e4SLinus Torvalds info.nlmsg_seq = seq; 17331da177e4SLinus Torvalds info.nlmsg_flags = 0; 17341da177e4SLinus Torvalds 1735c2546372SMathias Krause err = dump_one_policy(xp, dir, 0, &info); 1736c2546372SMathias Krause if (err) { 17371da177e4SLinus Torvalds kfree_skb(skb); 1738c2546372SMathias Krause return ERR_PTR(err); 17391da177e4SLinus Torvalds } 17401da177e4SLinus Torvalds 17411da177e4SLinus Torvalds return skb; 17421da177e4SLinus Torvalds } 17431da177e4SLinus Torvalds 174422e70050SChristoph Hellwig static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 17455424f32eSThomas Graf struct nlattr **attrs) 17461da177e4SLinus Torvalds { 1747fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 17481da177e4SLinus Torvalds struct xfrm_policy *xp; 17491da177e4SLinus Torvalds struct xfrm_userpolicy_id *p; 1750b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 17511da177e4SLinus Torvalds int err; 175226b15dadSJamal Hadi Salim struct km_event c; 17531da177e4SLinus Torvalds int delete; 1754295fae56SJamal Hadi Salim struct xfrm_mark m; 1755295fae56SJamal Hadi Salim u32 mark = xfrm_mark_get(attrs, &m); 17561da177e4SLinus Torvalds 17577b67c857SThomas Graf p = nlmsg_data(nlh); 17581da177e4SLinus Torvalds delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY; 17591da177e4SLinus Torvalds 176035a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 1761f7b6983fSMasahide NAKAMURA if (err) 1762f7b6983fSMasahide NAKAMURA return err; 1763f7b6983fSMasahide NAKAMURA 17641da177e4SLinus Torvalds err = verify_policy_dir(p->dir); 17651da177e4SLinus Torvalds if (err) 17661da177e4SLinus Torvalds return err; 17671da177e4SLinus Torvalds 17681da177e4SLinus Torvalds if (p->index) 1769295fae56SJamal Hadi Salim xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err); 1770df71837dSTrent Jaeger else { 17715424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 177203e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx; 1773df71837dSTrent Jaeger 177435a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 1775df71837dSTrent Jaeger if (err) 1776df71837dSTrent Jaeger return err; 1777df71837dSTrent Jaeger 17782c8dd116SDenis V. Lunev ctx = NULL; 1779df71837dSTrent Jaeger if (rt) { 17805424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt); 1781df71837dSTrent Jaeger 178252a4c640SNikolay Aleksandrov err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 178303e1ad7bSPaul Moore if (err) 1784df71837dSTrent Jaeger return err; 17852c8dd116SDenis V. Lunev } 1786295fae56SJamal Hadi Salim xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel, 17876f26b61eSJamal Hadi Salim ctx, delete, &err); 178803e1ad7bSPaul Moore security_xfrm_policy_free(ctx); 1789df71837dSTrent Jaeger } 17901da177e4SLinus Torvalds if (xp == NULL) 17911da177e4SLinus Torvalds return -ENOENT; 17921da177e4SLinus Torvalds 17931da177e4SLinus Torvalds if (!delete) { 17941da177e4SLinus Torvalds struct sk_buff *resp_skb; 17951da177e4SLinus Torvalds 17961da177e4SLinus Torvalds resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq); 17971da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 17981da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 17991da177e4SLinus Torvalds } else { 1800a6483b79SAlexey Dobriyan err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, 180115e47304SEric W. Biederman NETLINK_CB(skb).portid); 18021da177e4SLinus Torvalds } 180326b15dadSJamal Hadi Salim } else { 18042e71029eSTetsuo Handa xfrm_audit_policy_delete(xp, err ? 0 : 1, true); 180513fcfbb0SDavid S. Miller 180613fcfbb0SDavid S. Miller if (err != 0) 1807c8c05a8eSCatherine Zhang goto out; 180813fcfbb0SDavid S. Miller 1809e7443892SHerbert Xu c.data.byid = p->index; 1810f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 181126b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 181215e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 181326b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c); 18141da177e4SLinus Torvalds } 18151da177e4SLinus Torvalds 1816c8c05a8eSCatherine Zhang out: 1817ef41aaa0SEric Paris xfrm_pol_put(xp); 1818e4c17216SPaul Moore if (delete && err == 0) 1819e4c17216SPaul Moore xfrm_garbage_collect(net); 18201da177e4SLinus Torvalds return err; 18211da177e4SLinus Torvalds } 18221da177e4SLinus Torvalds 182322e70050SChristoph Hellwig static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 18245424f32eSThomas Graf struct nlattr **attrs) 18251da177e4SLinus Torvalds { 1826fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 182726b15dadSJamal Hadi Salim struct km_event c; 18287b67c857SThomas Graf struct xfrm_usersa_flush *p = nlmsg_data(nlh); 18294aa2e62cSJoy Latten int err; 18301da177e4SLinus Torvalds 18312e71029eSTetsuo Handa err = xfrm_state_flush(net, p->proto, true); 18329e64cc95SJamal Hadi Salim if (err) { 18339e64cc95SJamal Hadi Salim if (err == -ESRCH) /* empty table */ 18349e64cc95SJamal Hadi Salim return 0; 1835069c474eSDavid S. Miller return err; 18369e64cc95SJamal Hadi Salim } 1837bf08867fSHerbert Xu c.data.proto = p->proto; 1838f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 183926b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 184015e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 18417067802eSAlexey Dobriyan c.net = net; 184226b15dadSJamal Hadi Salim km_state_notify(NULL, &c); 184326b15dadSJamal Hadi Salim 18441da177e4SLinus Torvalds return 0; 18451da177e4SLinus Torvalds } 18461da177e4SLinus Torvalds 1847d8647b79SSteffen Klassert static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x) 18487deb2264SThomas Graf { 1849d8647b79SSteffen Klassert size_t replay_size = x->replay_esn ? 1850d8647b79SSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn) : 1851d8647b79SSteffen Klassert sizeof(struct xfrm_replay_state); 1852d8647b79SSteffen Klassert 18537deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id)) 1854d8647b79SSteffen Klassert + nla_total_size(replay_size) 1855de95c4a4SNicolas Dichtel + nla_total_size_64bit(sizeof(struct xfrm_lifetime_cur)) 18566f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)) 18577deb2264SThomas Graf + nla_total_size(4) /* XFRM_AE_RTHR */ 18587deb2264SThomas Graf + nla_total_size(4); /* XFRM_AE_ETHR */ 18597deb2264SThomas Graf } 1860d51d081dSJamal Hadi Salim 1861214e005bSDavid S. Miller static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 1862d51d081dSJamal Hadi Salim { 1863d51d081dSJamal Hadi Salim struct xfrm_aevent_id *id; 1864d51d081dSJamal Hadi Salim struct nlmsghdr *nlh; 18651d1e34ddSDavid S. Miller int err; 1866d51d081dSJamal Hadi Salim 186715e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0); 186879b8b7f4SThomas Graf if (nlh == NULL) 186979b8b7f4SThomas Graf return -EMSGSIZE; 1870d51d081dSJamal Hadi Salim 18717b67c857SThomas Graf id = nlmsg_data(nlh); 1872*931e79d7SMathias Krause memset(&id->sa_id, 0, sizeof(id->sa_id)); 18732b5f6dccSJamal Hadi Salim memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr)); 1874d51d081dSJamal Hadi Salim id->sa_id.spi = x->id.spi; 1875d51d081dSJamal Hadi Salim id->sa_id.family = x->props.family; 1876d51d081dSJamal Hadi Salim id->sa_id.proto = x->id.proto; 18772b5f6dccSJamal Hadi Salim memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr)); 18782b5f6dccSJamal Hadi Salim id->reqid = x->props.reqid; 1879d51d081dSJamal Hadi Salim id->flags = c->data.aevent; 1880d51d081dSJamal Hadi Salim 1881d0fde795SDavid S. Miller if (x->replay_esn) { 18821d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 1883d8647b79SSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 18841d1e34ddSDavid S. Miller x->replay_esn); 1885d0fde795SDavid S. Miller } else { 18861d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 18871d1e34ddSDavid S. Miller &x->replay); 1888d0fde795SDavid S. Miller } 18891d1e34ddSDavid S. Miller if (err) 18901d1e34ddSDavid S. Miller goto out_cancel; 1891de95c4a4SNicolas Dichtel err = nla_put_64bit(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft, 1892de95c4a4SNicolas Dichtel XFRMA_PAD); 18931d1e34ddSDavid S. Miller if (err) 18941d1e34ddSDavid S. Miller goto out_cancel; 1895d8647b79SSteffen Klassert 18961d1e34ddSDavid S. Miller if (id->flags & XFRM_AE_RTHR) { 18971d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff); 18981d1e34ddSDavid S. Miller if (err) 18991d1e34ddSDavid S. Miller goto out_cancel; 19001d1e34ddSDavid S. Miller } 19011d1e34ddSDavid S. Miller if (id->flags & XFRM_AE_ETHR) { 19021d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_ETIMER_THRESH, 19031d1e34ddSDavid S. Miller x->replay_maxage * 10 / HZ); 19041d1e34ddSDavid S. Miller if (err) 19051d1e34ddSDavid S. Miller goto out_cancel; 19061d1e34ddSDavid S. Miller } 19071d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &x->mark); 19081d1e34ddSDavid S. Miller if (err) 19091d1e34ddSDavid S. Miller goto out_cancel; 19106f26b61eSJamal Hadi Salim 1911053c095aSJohannes Berg nlmsg_end(skb, nlh); 1912053c095aSJohannes Berg return 0; 1913d51d081dSJamal Hadi Salim 19141d1e34ddSDavid S. Miller out_cancel: 19159825069dSThomas Graf nlmsg_cancel(skb, nlh); 19161d1e34ddSDavid S. Miller return err; 1917d51d081dSJamal Hadi Salim } 1918d51d081dSJamal Hadi Salim 191922e70050SChristoph Hellwig static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 19205424f32eSThomas Graf struct nlattr **attrs) 1921d51d081dSJamal Hadi Salim { 1922fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 1923d51d081dSJamal Hadi Salim struct xfrm_state *x; 1924d51d081dSJamal Hadi Salim struct sk_buff *r_skb; 1925d51d081dSJamal Hadi Salim int err; 1926d51d081dSJamal Hadi Salim struct km_event c; 19276f26b61eSJamal Hadi Salim u32 mark; 19286f26b61eSJamal Hadi Salim struct xfrm_mark m; 19297b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh); 1930d51d081dSJamal Hadi Salim struct xfrm_usersa_id *id = &p->sa_id; 1931d51d081dSJamal Hadi Salim 19326f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m); 19336f26b61eSJamal Hadi Salim 19346f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family); 1935d8647b79SSteffen Klassert if (x == NULL) 1936d51d081dSJamal Hadi Salim return -ESRCH; 1937d8647b79SSteffen Klassert 1938d8647b79SSteffen Klassert r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 1939d8647b79SSteffen Klassert if (r_skb == NULL) { 1940d8647b79SSteffen Klassert xfrm_state_put(x); 1941d8647b79SSteffen Klassert return -ENOMEM; 1942d51d081dSJamal Hadi Salim } 1943d51d081dSJamal Hadi Salim 1944d51d081dSJamal Hadi Salim /* 1945d51d081dSJamal Hadi Salim * XXX: is this lock really needed - none of the other 1946d51d081dSJamal Hadi Salim * gets lock (the concern is things getting updated 1947d51d081dSJamal Hadi Salim * while we are still reading) - jhs 1948d51d081dSJamal Hadi Salim */ 1949d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock); 1950d51d081dSJamal Hadi Salim c.data.aevent = p->flags; 1951d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 195215e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 1953d51d081dSJamal Hadi Salim 1954d51d081dSJamal Hadi Salim if (build_aevent(r_skb, x, &c) < 0) 1955d51d081dSJamal Hadi Salim BUG(); 195615e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid); 1957d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock); 1958d51d081dSJamal Hadi Salim xfrm_state_put(x); 1959d51d081dSJamal Hadi Salim return err; 1960d51d081dSJamal Hadi Salim } 1961d51d081dSJamal Hadi Salim 196222e70050SChristoph Hellwig static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 19635424f32eSThomas Graf struct nlattr **attrs) 1964d51d081dSJamal Hadi Salim { 1965fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 1966d51d081dSJamal Hadi Salim struct xfrm_state *x; 1967d51d081dSJamal Hadi Salim struct km_event c; 1968d51d081dSJamal Hadi Salim int err = -EINVAL; 19696f26b61eSJamal Hadi Salim u32 mark = 0; 19706f26b61eSJamal Hadi Salim struct xfrm_mark m; 19717b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh); 19725424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 1973d8647b79SSteffen Klassert struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL]; 19745424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 19754e077237SMichael Rossberg struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 19764e077237SMichael Rossberg struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 1977d51d081dSJamal Hadi Salim 19784e077237SMichael Rossberg if (!lt && !rp && !re && !et && !rt) 1979d51d081dSJamal Hadi Salim return err; 1980d51d081dSJamal Hadi Salim 1981d51d081dSJamal Hadi Salim /* pedantic mode - thou shalt sayeth replaceth */ 1982d51d081dSJamal Hadi Salim if (!(nlh->nlmsg_flags&NLM_F_REPLACE)) 1983d51d081dSJamal Hadi Salim return err; 1984d51d081dSJamal Hadi Salim 19856f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m); 19866f26b61eSJamal Hadi Salim 19876f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family); 1988d51d081dSJamal Hadi Salim if (x == NULL) 1989d51d081dSJamal Hadi Salim return -ESRCH; 1990d51d081dSJamal Hadi Salim 1991d51d081dSJamal Hadi Salim if (x->km.state != XFRM_STATE_VALID) 1992d51d081dSJamal Hadi Salim goto out; 1993d51d081dSJamal Hadi Salim 19944479ff76SSteffen Klassert err = xfrm_replay_verify_len(x->replay_esn, re); 1995e2b19125SSteffen Klassert if (err) 1996e2b19125SSteffen Klassert goto out; 1997e2b19125SSteffen Klassert 1998d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock); 1999e3ac104dSMathias Krause xfrm_update_ae_params(x, attrs, 1); 2000d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock); 2001d51d081dSJamal Hadi Salim 2002d51d081dSJamal Hadi Salim c.event = nlh->nlmsg_type; 2003d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 200415e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 2005d51d081dSJamal Hadi Salim c.data.aevent = XFRM_AE_CU; 2006d51d081dSJamal Hadi Salim km_state_notify(x, &c); 2007d51d081dSJamal Hadi Salim err = 0; 2008d51d081dSJamal Hadi Salim out: 2009d51d081dSJamal Hadi Salim xfrm_state_put(x); 2010d51d081dSJamal Hadi Salim return err; 2011d51d081dSJamal Hadi Salim } 2012d51d081dSJamal Hadi Salim 201322e70050SChristoph Hellwig static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 20145424f32eSThomas Graf struct nlattr **attrs) 20151da177e4SLinus Torvalds { 2016fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 201726b15dadSJamal Hadi Salim struct km_event c; 2018b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 2019f7b6983fSMasahide NAKAMURA int err; 202026b15dadSJamal Hadi Salim 202135a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 2022f7b6983fSMasahide NAKAMURA if (err) 2023f7b6983fSMasahide NAKAMURA return err; 2024f7b6983fSMasahide NAKAMURA 20252e71029eSTetsuo Handa err = xfrm_policy_flush(net, type, true); 20262f1eb65fSJamal Hadi Salim if (err) { 20272f1eb65fSJamal Hadi Salim if (err == -ESRCH) /* empty table */ 20282f1eb65fSJamal Hadi Salim return 0; 2029069c474eSDavid S. Miller return err; 20302f1eb65fSJamal Hadi Salim } 2031138437f5SHangbin Liu xfrm_garbage_collect(net); 20322f1eb65fSJamal Hadi Salim 2033f7b6983fSMasahide NAKAMURA c.data.type = type; 2034f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 203526b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 203615e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 20377067802eSAlexey Dobriyan c.net = net; 203826b15dadSJamal Hadi Salim km_policy_notify(NULL, 0, &c); 20391da177e4SLinus Torvalds return 0; 20401da177e4SLinus Torvalds } 20411da177e4SLinus Torvalds 204222e70050SChristoph Hellwig static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 20435424f32eSThomas Graf struct nlattr **attrs) 20446c5c8ca7SJamal Hadi Salim { 2045fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 20466c5c8ca7SJamal Hadi Salim struct xfrm_policy *xp; 20477b67c857SThomas Graf struct xfrm_user_polexpire *up = nlmsg_data(nlh); 20486c5c8ca7SJamal Hadi Salim struct xfrm_userpolicy_info *p = &up->pol; 2049b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 20506c5c8ca7SJamal Hadi Salim int err = -ENOENT; 2051295fae56SJamal Hadi Salim struct xfrm_mark m; 2052295fae56SJamal Hadi Salim u32 mark = xfrm_mark_get(attrs, &m); 20536c5c8ca7SJamal Hadi Salim 205435a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 2055f7b6983fSMasahide NAKAMURA if (err) 2056f7b6983fSMasahide NAKAMURA return err; 2057f7b6983fSMasahide NAKAMURA 2058c8bf4d04STimo Teräs err = verify_policy_dir(p->dir); 2059c8bf4d04STimo Teräs if (err) 2060c8bf4d04STimo Teräs return err; 2061c8bf4d04STimo Teräs 20626c5c8ca7SJamal Hadi Salim if (p->index) 2063295fae56SJamal Hadi Salim xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err); 20646c5c8ca7SJamal Hadi Salim else { 20655424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 206603e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx; 20676c5c8ca7SJamal Hadi Salim 206835a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 20696c5c8ca7SJamal Hadi Salim if (err) 20706c5c8ca7SJamal Hadi Salim return err; 20716c5c8ca7SJamal Hadi Salim 20722c8dd116SDenis V. Lunev ctx = NULL; 20736c5c8ca7SJamal Hadi Salim if (rt) { 20745424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt); 20756c5c8ca7SJamal Hadi Salim 207652a4c640SNikolay Aleksandrov err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 207703e1ad7bSPaul Moore if (err) 20786c5c8ca7SJamal Hadi Salim return err; 20792c8dd116SDenis V. Lunev } 2080295fae56SJamal Hadi Salim xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, 20816f26b61eSJamal Hadi Salim &p->sel, ctx, 0, &err); 208203e1ad7bSPaul Moore security_xfrm_policy_free(ctx); 20836c5c8ca7SJamal Hadi Salim } 20846c5c8ca7SJamal Hadi Salim if (xp == NULL) 2085ef41aaa0SEric Paris return -ENOENT; 208603e1ad7bSPaul Moore 2087ea2dea9dSTimo Teräs if (unlikely(xp->walk.dead)) 20886c5c8ca7SJamal Hadi Salim goto out; 20896c5c8ca7SJamal Hadi Salim 20906c5c8ca7SJamal Hadi Salim err = 0; 20916c5c8ca7SJamal Hadi Salim if (up->hard) { 20926c5c8ca7SJamal Hadi Salim xfrm_policy_delete(xp, p->dir); 20932e71029eSTetsuo Handa xfrm_audit_policy_delete(xp, 1, true); 20946c5c8ca7SJamal Hadi Salim } 2095c6bb8136SEric W. Biederman km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid); 20966c5c8ca7SJamal Hadi Salim 20976c5c8ca7SJamal Hadi Salim out: 20986c5c8ca7SJamal Hadi Salim xfrm_pol_put(xp); 20996c5c8ca7SJamal Hadi Salim return err; 21006c5c8ca7SJamal Hadi Salim } 21016c5c8ca7SJamal Hadi Salim 210222e70050SChristoph Hellwig static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 21035424f32eSThomas Graf struct nlattr **attrs) 210453bc6b4dSJamal Hadi Salim { 2105fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 210653bc6b4dSJamal Hadi Salim struct xfrm_state *x; 210753bc6b4dSJamal Hadi Salim int err; 21087b67c857SThomas Graf struct xfrm_user_expire *ue = nlmsg_data(nlh); 210953bc6b4dSJamal Hadi Salim struct xfrm_usersa_info *p = &ue->state; 21106f26b61eSJamal Hadi Salim struct xfrm_mark m; 2111928497f0SNicolas Dichtel u32 mark = xfrm_mark_get(attrs, &m); 211253bc6b4dSJamal Hadi Salim 21136f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family); 211453bc6b4dSJamal Hadi Salim 21153a765aa5SDavid S. Miller err = -ENOENT; 211653bc6b4dSJamal Hadi Salim if (x == NULL) 211753bc6b4dSJamal Hadi Salim return err; 211853bc6b4dSJamal Hadi Salim 211953bc6b4dSJamal Hadi Salim spin_lock_bh(&x->lock); 21203a765aa5SDavid S. Miller err = -EINVAL; 212153bc6b4dSJamal Hadi Salim if (x->km.state != XFRM_STATE_VALID) 212253bc6b4dSJamal Hadi Salim goto out; 2123c6bb8136SEric W. Biederman km_state_expired(x, ue->hard, nlh->nlmsg_pid); 212453bc6b4dSJamal Hadi Salim 2125161a09e7SJoy Latten if (ue->hard) { 212653bc6b4dSJamal Hadi Salim __xfrm_state_delete(x); 21272e71029eSTetsuo Handa xfrm_audit_state_delete(x, 1, true); 2128161a09e7SJoy Latten } 21293a765aa5SDavid S. Miller err = 0; 213053bc6b4dSJamal Hadi Salim out: 213153bc6b4dSJamal Hadi Salim spin_unlock_bh(&x->lock); 213253bc6b4dSJamal Hadi Salim xfrm_state_put(x); 213353bc6b4dSJamal Hadi Salim return err; 213453bc6b4dSJamal Hadi Salim } 213553bc6b4dSJamal Hadi Salim 213622e70050SChristoph Hellwig static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, 21375424f32eSThomas Graf struct nlattr **attrs) 2138980ebd25SJamal Hadi Salim { 2139fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 2140980ebd25SJamal Hadi Salim struct xfrm_policy *xp; 2141980ebd25SJamal Hadi Salim struct xfrm_user_tmpl *ut; 2142980ebd25SJamal Hadi Salim int i; 21435424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL]; 21446f26b61eSJamal Hadi Salim struct xfrm_mark mark; 2145980ebd25SJamal Hadi Salim 21467b67c857SThomas Graf struct xfrm_user_acquire *ua = nlmsg_data(nlh); 2147fc34acd3SAlexey Dobriyan struct xfrm_state *x = xfrm_state_alloc(net); 2148980ebd25SJamal Hadi Salim int err = -ENOMEM; 2149980ebd25SJamal Hadi Salim 2150980ebd25SJamal Hadi Salim if (!x) 2151d8eb9307SIlpo Järvinen goto nomem; 2152980ebd25SJamal Hadi Salim 21536f26b61eSJamal Hadi Salim xfrm_mark_get(attrs, &mark); 21546f26b61eSJamal Hadi Salim 2155980ebd25SJamal Hadi Salim err = verify_newpolicy_info(&ua->policy); 2156d8eb9307SIlpo Järvinen if (err) 215773efc324SVegard Nossum goto free_state; 2158980ebd25SJamal Hadi Salim 2159980ebd25SJamal Hadi Salim /* build an XP */ 2160fc34acd3SAlexey Dobriyan xp = xfrm_policy_construct(net, &ua->policy, attrs, &err); 2161d8eb9307SIlpo Järvinen if (!xp) 2162d8eb9307SIlpo Järvinen goto free_state; 2163980ebd25SJamal Hadi Salim 2164980ebd25SJamal Hadi Salim memcpy(&x->id, &ua->id, sizeof(ua->id)); 2165980ebd25SJamal Hadi Salim memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr)); 2166980ebd25SJamal Hadi Salim memcpy(&x->sel, &ua->sel, sizeof(ua->sel)); 21676f26b61eSJamal Hadi Salim xp->mark.m = x->mark.m = mark.m; 21686f26b61eSJamal Hadi Salim xp->mark.v = x->mark.v = mark.v; 21695424f32eSThomas Graf ut = nla_data(rt); 2170980ebd25SJamal Hadi Salim /* extract the templates and for each call km_key */ 2171980ebd25SJamal Hadi Salim for (i = 0; i < xp->xfrm_nr; i++, ut++) { 2172980ebd25SJamal Hadi Salim struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 2173980ebd25SJamal Hadi Salim memcpy(&x->id, &t->id, sizeof(x->id)); 2174980ebd25SJamal Hadi Salim x->props.mode = t->mode; 2175980ebd25SJamal Hadi Salim x->props.reqid = t->reqid; 2176980ebd25SJamal Hadi Salim x->props.family = ut->family; 2177980ebd25SJamal Hadi Salim t->aalgos = ua->aalgos; 2178980ebd25SJamal Hadi Salim t->ealgos = ua->ealgos; 2179980ebd25SJamal Hadi Salim t->calgos = ua->calgos; 2180980ebd25SJamal Hadi Salim err = km_query(x, t, xp); 2181980ebd25SJamal Hadi Salim 2182980ebd25SJamal Hadi Salim } 2183980ebd25SJamal Hadi Salim 2184980ebd25SJamal Hadi Salim kfree(x); 2185980ebd25SJamal Hadi Salim kfree(xp); 2186980ebd25SJamal Hadi Salim 2187980ebd25SJamal Hadi Salim return 0; 2188d8eb9307SIlpo Järvinen 2189d8eb9307SIlpo Järvinen free_state: 2190d8eb9307SIlpo Järvinen kfree(x); 2191d8eb9307SIlpo Järvinen nomem: 2192d8eb9307SIlpo Järvinen return err; 2193980ebd25SJamal Hadi Salim } 2194980ebd25SJamal Hadi Salim 21955c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 21965c79de6eSShinta Sugimoto static int copy_from_user_migrate(struct xfrm_migrate *ma, 219713c1d189SArnaud Ebalard struct xfrm_kmaddress *k, 21985424f32eSThomas Graf struct nlattr **attrs, int *num) 21995c79de6eSShinta Sugimoto { 22005424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_MIGRATE]; 22015c79de6eSShinta Sugimoto struct xfrm_user_migrate *um; 22025c79de6eSShinta Sugimoto int i, num_migrate; 22035c79de6eSShinta Sugimoto 220413c1d189SArnaud Ebalard if (k != NULL) { 220513c1d189SArnaud Ebalard struct xfrm_user_kmaddress *uk; 220613c1d189SArnaud Ebalard 220713c1d189SArnaud Ebalard uk = nla_data(attrs[XFRMA_KMADDRESS]); 220813c1d189SArnaud Ebalard memcpy(&k->local, &uk->local, sizeof(k->local)); 220913c1d189SArnaud Ebalard memcpy(&k->remote, &uk->remote, sizeof(k->remote)); 221013c1d189SArnaud Ebalard k->family = uk->family; 221113c1d189SArnaud Ebalard k->reserved = uk->reserved; 221213c1d189SArnaud Ebalard } 221313c1d189SArnaud Ebalard 22145424f32eSThomas Graf um = nla_data(rt); 22155424f32eSThomas Graf num_migrate = nla_len(rt) / sizeof(*um); 22165c79de6eSShinta Sugimoto 22175c79de6eSShinta Sugimoto if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH) 22185c79de6eSShinta Sugimoto return -EINVAL; 22195c79de6eSShinta Sugimoto 22205c79de6eSShinta Sugimoto for (i = 0; i < num_migrate; i++, um++, ma++) { 22215c79de6eSShinta Sugimoto memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr)); 22225c79de6eSShinta Sugimoto memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr)); 22235c79de6eSShinta Sugimoto memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr)); 22245c79de6eSShinta Sugimoto memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr)); 22255c79de6eSShinta Sugimoto 22265c79de6eSShinta Sugimoto ma->proto = um->proto; 22275c79de6eSShinta Sugimoto ma->mode = um->mode; 22285c79de6eSShinta Sugimoto ma->reqid = um->reqid; 22295c79de6eSShinta Sugimoto 22305c79de6eSShinta Sugimoto ma->old_family = um->old_family; 22315c79de6eSShinta Sugimoto ma->new_family = um->new_family; 22325c79de6eSShinta Sugimoto } 22335c79de6eSShinta Sugimoto 22345c79de6eSShinta Sugimoto *num = i; 22355c79de6eSShinta Sugimoto return 0; 22365c79de6eSShinta Sugimoto } 22375c79de6eSShinta Sugimoto 22385c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 22395424f32eSThomas Graf struct nlattr **attrs) 22405c79de6eSShinta Sugimoto { 22417b67c857SThomas Graf struct xfrm_userpolicy_id *pi = nlmsg_data(nlh); 22425c79de6eSShinta Sugimoto struct xfrm_migrate m[XFRM_MAX_DEPTH]; 224313c1d189SArnaud Ebalard struct xfrm_kmaddress km, *kmp; 22445c79de6eSShinta Sugimoto u8 type; 22455c79de6eSShinta Sugimoto int err; 22465c79de6eSShinta Sugimoto int n = 0; 22478d549c4fSFan Du struct net *net = sock_net(skb->sk); 22484ab47d47SAntony Antony struct xfrm_encap_tmpl *encap = NULL; 22495c79de6eSShinta Sugimoto 225035a7aa08SThomas Graf if (attrs[XFRMA_MIGRATE] == NULL) 2251cf5cb79fSThomas Graf return -EINVAL; 22525c79de6eSShinta Sugimoto 225313c1d189SArnaud Ebalard kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL; 225413c1d189SArnaud Ebalard 22555424f32eSThomas Graf err = copy_from_user_policy_type(&type, attrs); 22565c79de6eSShinta Sugimoto if (err) 22575c79de6eSShinta Sugimoto return err; 22585c79de6eSShinta Sugimoto 225913c1d189SArnaud Ebalard err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n); 22605c79de6eSShinta Sugimoto if (err) 22615c79de6eSShinta Sugimoto return err; 22625c79de6eSShinta Sugimoto 22635c79de6eSShinta Sugimoto if (!n) 22645c79de6eSShinta Sugimoto return 0; 22655c79de6eSShinta Sugimoto 22664ab47d47SAntony Antony if (attrs[XFRMA_ENCAP]) { 22674ab47d47SAntony Antony encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 22684ab47d47SAntony Antony sizeof(*encap), GFP_KERNEL); 22694ab47d47SAntony Antony if (!encap) 22705c79de6eSShinta Sugimoto return 0; 22715c79de6eSShinta Sugimoto } 22724ab47d47SAntony Antony 22734ab47d47SAntony Antony err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap); 22744ab47d47SAntony Antony 22754ab47d47SAntony Antony kfree(encap); 22764ab47d47SAntony Antony 22774ab47d47SAntony Antony return err; 22784ab47d47SAntony Antony } 22795c79de6eSShinta Sugimoto #else 22805c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 22815424f32eSThomas Graf struct nlattr **attrs) 22825c79de6eSShinta Sugimoto { 22835c79de6eSShinta Sugimoto return -ENOPROTOOPT; 22845c79de6eSShinta Sugimoto } 22855c79de6eSShinta Sugimoto #endif 22865c79de6eSShinta Sugimoto 22875c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 2288183cad12SDavid S. Miller static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb) 22895c79de6eSShinta Sugimoto { 22905c79de6eSShinta Sugimoto struct xfrm_user_migrate um; 22915c79de6eSShinta Sugimoto 22925c79de6eSShinta Sugimoto memset(&um, 0, sizeof(um)); 22935c79de6eSShinta Sugimoto um.proto = m->proto; 22945c79de6eSShinta Sugimoto um.mode = m->mode; 22955c79de6eSShinta Sugimoto um.reqid = m->reqid; 22965c79de6eSShinta Sugimoto um.old_family = m->old_family; 22975c79de6eSShinta Sugimoto memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr)); 22985c79de6eSShinta Sugimoto memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr)); 22995c79de6eSShinta Sugimoto um.new_family = m->new_family; 23005c79de6eSShinta Sugimoto memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr)); 23015c79de6eSShinta Sugimoto memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr)); 23025c79de6eSShinta Sugimoto 2303c0144beaSThomas Graf return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um); 23045c79de6eSShinta Sugimoto } 23055c79de6eSShinta Sugimoto 2306183cad12SDavid S. Miller static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb) 230713c1d189SArnaud Ebalard { 230813c1d189SArnaud Ebalard struct xfrm_user_kmaddress uk; 230913c1d189SArnaud Ebalard 231013c1d189SArnaud Ebalard memset(&uk, 0, sizeof(uk)); 231113c1d189SArnaud Ebalard uk.family = k->family; 231213c1d189SArnaud Ebalard uk.reserved = k->reserved; 231313c1d189SArnaud Ebalard memcpy(&uk.local, &k->local, sizeof(uk.local)); 2314a1caa322SArnaud Ebalard memcpy(&uk.remote, &k->remote, sizeof(uk.remote)); 231513c1d189SArnaud Ebalard 231613c1d189SArnaud Ebalard return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk); 231713c1d189SArnaud Ebalard } 231813c1d189SArnaud Ebalard 23198bafd730SAntony Antony static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma, 23208bafd730SAntony Antony int with_encp) 23217deb2264SThomas Graf { 23227deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id)) 232313c1d189SArnaud Ebalard + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0) 23248bafd730SAntony Antony + (with_encp ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0) 23257deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate) 23267deb2264SThomas Graf + userpolicy_type_attrsize(); 23277deb2264SThomas Graf } 23287deb2264SThomas Graf 2329183cad12SDavid S. Miller static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m, 2330183cad12SDavid S. Miller int num_migrate, const struct xfrm_kmaddress *k, 23318bafd730SAntony Antony const struct xfrm_selector *sel, 23328bafd730SAntony Antony const struct xfrm_encap_tmpl *encap, u8 dir, u8 type) 23335c79de6eSShinta Sugimoto { 2334183cad12SDavid S. Miller const struct xfrm_migrate *mp; 23355c79de6eSShinta Sugimoto struct xfrm_userpolicy_id *pol_id; 23365c79de6eSShinta Sugimoto struct nlmsghdr *nlh; 23371d1e34ddSDavid S. Miller int i, err; 23385c79de6eSShinta Sugimoto 233979b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0); 234079b8b7f4SThomas Graf if (nlh == NULL) 234179b8b7f4SThomas Graf return -EMSGSIZE; 23425c79de6eSShinta Sugimoto 23437b67c857SThomas Graf pol_id = nlmsg_data(nlh); 23445c79de6eSShinta Sugimoto /* copy data from selector, dir, and type to the pol_id */ 23455c79de6eSShinta Sugimoto memset(pol_id, 0, sizeof(*pol_id)); 23465c79de6eSShinta Sugimoto memcpy(&pol_id->sel, sel, sizeof(pol_id->sel)); 23475c79de6eSShinta Sugimoto pol_id->dir = dir; 23485c79de6eSShinta Sugimoto 23491d1e34ddSDavid S. Miller if (k != NULL) { 23501d1e34ddSDavid S. Miller err = copy_to_user_kmaddress(k, skb); 23511d1e34ddSDavid S. Miller if (err) 23521d1e34ddSDavid S. Miller goto out_cancel; 23531d1e34ddSDavid S. Miller } 23548bafd730SAntony Antony if (encap) { 23558bafd730SAntony Antony err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap); 23568bafd730SAntony Antony if (err) 23578bafd730SAntony Antony goto out_cancel; 23588bafd730SAntony Antony } 23591d1e34ddSDavid S. Miller err = copy_to_user_policy_type(type, skb); 23601d1e34ddSDavid S. Miller if (err) 23611d1e34ddSDavid S. Miller goto out_cancel; 23625c79de6eSShinta Sugimoto for (i = 0, mp = m ; i < num_migrate; i++, mp++) { 23631d1e34ddSDavid S. Miller err = copy_to_user_migrate(mp, skb); 23641d1e34ddSDavid S. Miller if (err) 23651d1e34ddSDavid S. Miller goto out_cancel; 23665c79de6eSShinta Sugimoto } 23675c79de6eSShinta Sugimoto 2368053c095aSJohannes Berg nlmsg_end(skb, nlh); 2369053c095aSJohannes Berg return 0; 23701d1e34ddSDavid S. Miller 23711d1e34ddSDavid S. Miller out_cancel: 23729825069dSThomas Graf nlmsg_cancel(skb, nlh); 23731d1e34ddSDavid S. Miller return err; 23745c79de6eSShinta Sugimoto } 23755c79de6eSShinta Sugimoto 2376183cad12SDavid S. Miller static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 2377183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_migrate, 23788bafd730SAntony Antony const struct xfrm_kmaddress *k, 23798bafd730SAntony Antony const struct xfrm_encap_tmpl *encap) 23805c79de6eSShinta Sugimoto { 2381a6483b79SAlexey Dobriyan struct net *net = &init_net; 23825c79de6eSShinta Sugimoto struct sk_buff *skb; 23835c79de6eSShinta Sugimoto 23848bafd730SAntony Antony skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap), 23858bafd730SAntony Antony GFP_ATOMIC); 23865c79de6eSShinta Sugimoto if (skb == NULL) 23875c79de6eSShinta Sugimoto return -ENOMEM; 23885c79de6eSShinta Sugimoto 23895c79de6eSShinta Sugimoto /* build migrate */ 23908bafd730SAntony Antony if (build_migrate(skb, m, num_migrate, k, sel, encap, dir, type) < 0) 23915c79de6eSShinta Sugimoto BUG(); 23925c79de6eSShinta Sugimoto 239321ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE); 23945c79de6eSShinta Sugimoto } 23955c79de6eSShinta Sugimoto #else 2396183cad12SDavid S. Miller static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 2397183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_migrate, 23988bafd730SAntony Antony const struct xfrm_kmaddress *k, 23998bafd730SAntony Antony const struct xfrm_encap_tmpl *encap) 24005c79de6eSShinta Sugimoto { 24015c79de6eSShinta Sugimoto return -ENOPROTOOPT; 24025c79de6eSShinta Sugimoto } 24035c79de6eSShinta Sugimoto #endif 2404d51d081dSJamal Hadi Salim 2405a7bd9a45SThomas Graf #define XMSGSIZE(type) sizeof(struct type) 2406492b558bSThomas Graf 2407492b558bSThomas Graf static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = { 240866f9a259SDavid S. Miller [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 2409492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 2410492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 2411492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 2412492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 2413492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 2414492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info), 2415980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire), 241653bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire), 2417492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 241866f9a259SDavid S. Miller [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 24196c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire), 2420492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush), 2421a7bd9a45SThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0, 2422d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 2423d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 242497a64b45SMasahide NAKAMURA [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report), 24255c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 2426a7bd9a45SThomas Graf [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32), 2427880a6fabSChristophe Gouault [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 2428a7bd9a45SThomas Graf [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 24291da177e4SLinus Torvalds }; 24301da177e4SLinus Torvalds 2431492b558bSThomas Graf #undef XMSGSIZE 2432492b558bSThomas Graf 2433cf5cb79fSThomas Graf static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { 2434c28e9304Sjamal [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)}, 2435c28e9304Sjamal [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)}, 2436c28e9304Sjamal [XFRMA_LASTUSED] = { .type = NLA_U64}, 2437c28e9304Sjamal [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)}, 24381a6509d9SHerbert Xu [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) }, 2439cf5cb79fSThomas Graf [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) }, 2440cf5cb79fSThomas Graf [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) }, 2441cf5cb79fSThomas Graf [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, 2442cf5cb79fSThomas Graf [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, 2443cf5cb79fSThomas Graf [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, 2444cf5cb79fSThomas Graf [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) }, 2445cf5cb79fSThomas Graf [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, 2446cf5cb79fSThomas Graf [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, 2447cf5cb79fSThomas Graf [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 }, 2448cf5cb79fSThomas Graf [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 }, 2449cf5cb79fSThomas Graf [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) }, 2450cf5cb79fSThomas Graf [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) }, 2451cf5cb79fSThomas Graf [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)}, 2452cf5cb79fSThomas Graf [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, 245313c1d189SArnaud Ebalard [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) }, 24546f26b61eSJamal Hadi Salim [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) }, 245535d2856bSMartin Willi [XFRMA_TFCPAD] = { .type = NLA_U32 }, 2456d8647b79SSteffen Klassert [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) }, 2457a947b0a9SNicolas Dichtel [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 }, 2458d3623099SNicolas Dichtel [XFRMA_PROTO] = { .type = NLA_U8 }, 2459870a2df4SNicolas Dichtel [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) }, 2460d77e38e6SSteffen Klassert [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) }, 2461cf5cb79fSThomas Graf }; 2462cf5cb79fSThomas Graf 2463880a6fabSChristophe Gouault static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = { 2464880a6fabSChristophe Gouault [XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 2465880a6fabSChristophe Gouault [XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 2466880a6fabSChristophe Gouault }; 2467880a6fabSChristophe Gouault 246805600a79SMathias Krause static const struct xfrm_link { 24695424f32eSThomas Graf int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **); 24701da177e4SLinus Torvalds int (*dump)(struct sk_buff *, struct netlink_callback *); 24714c563f76STimo Teras int (*done)(struct netlink_callback *); 2472880a6fabSChristophe Gouault const struct nla_policy *nla_pol; 2473880a6fabSChristophe Gouault int nla_max; 2474492b558bSThomas Graf } xfrm_dispatch[XFRM_NR_MSGTYPES] = { 2475492b558bSThomas Graf [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 2476492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa }, 2477492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa, 24784c563f76STimo Teras .dump = xfrm_dump_sa, 24794c563f76STimo Teras .done = xfrm_dump_sa_done }, 2480492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 2481492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy }, 2482492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy, 24834c563f76STimo Teras .dump = xfrm_dump_policy, 24844c563f76STimo Teras .done = xfrm_dump_policy_done }, 2485492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi }, 2486980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire }, 248753bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire }, 2488492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 2489492b558bSThomas Graf [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 24906c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire}, 2491492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa }, 2492492b558bSThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy }, 2493d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae }, 2494d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae }, 24955c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate }, 249628d8909bSJamal Hadi Salim [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo }, 2497880a6fabSChristophe Gouault [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo, 2498880a6fabSChristophe Gouault .nla_pol = xfrma_spd_policy, 2499880a6fabSChristophe Gouault .nla_max = XFRMA_SPD_MAX }, 2500ecfd6b18SJamal Hadi Salim [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo }, 25011da177e4SLinus Torvalds }; 25021da177e4SLinus Torvalds 25032d4bc933SJohannes Berg static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, 25042d4bc933SJohannes Berg struct netlink_ext_ack *extack) 25051da177e4SLinus Torvalds { 2506a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk); 250735a7aa08SThomas Graf struct nlattr *attrs[XFRMA_MAX+1]; 250805600a79SMathias Krause const struct xfrm_link *link; 2509a7bd9a45SThomas Graf int type, err; 25101da177e4SLinus Torvalds 251174005991SFan Du #ifdef CONFIG_COMPAT 25122bf8c476SAndy Lutomirski if (in_compat_syscall()) 251383e2d058SYi Zhao return -EOPNOTSUPP; 251474005991SFan Du #endif 251574005991SFan Du 25161da177e4SLinus Torvalds type = nlh->nlmsg_type; 25171da177e4SLinus Torvalds if (type > XFRM_MSG_MAX) 25181d00a4ebSThomas Graf return -EINVAL; 25191da177e4SLinus Torvalds 25201da177e4SLinus Torvalds type -= XFRM_MSG_BASE; 25211da177e4SLinus Torvalds link = &xfrm_dispatch[type]; 25221da177e4SLinus Torvalds 25231da177e4SLinus Torvalds /* All operations require privileges, even GET */ 252490f62cf3SEric W. Biederman if (!netlink_net_capable(skb, CAP_NET_ADMIN)) 25251d00a4ebSThomas Graf return -EPERM; 25261da177e4SLinus Torvalds 2527492b558bSThomas Graf if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || 2528492b558bSThomas Graf type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) && 2529b8f3ab42SDavid S. Miller (nlh->nlmsg_flags & NLM_F_DUMP)) { 25301da177e4SLinus Torvalds if (link->dump == NULL) 25311d00a4ebSThomas Graf return -EINVAL; 25321da177e4SLinus Torvalds 253380d326faSPablo Neira Ayuso { 253480d326faSPablo Neira Ayuso struct netlink_dump_control c = { 253580d326faSPablo Neira Ayuso .dump = link->dump, 253680d326faSPablo Neira Ayuso .done = link->done, 253780d326faSPablo Neira Ayuso }; 253880d326faSPablo Neira Ayuso return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c); 253980d326faSPablo Neira Ayuso } 25401da177e4SLinus Torvalds } 25411da177e4SLinus Torvalds 2542880a6fabSChristophe Gouault err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, 2543880a6fabSChristophe Gouault link->nla_max ? : XFRMA_MAX, 2544fe52145fSJohannes Berg link->nla_pol ? : xfrma_policy, extack); 2545a7bd9a45SThomas Graf if (err < 0) 2546a7bd9a45SThomas Graf return err; 25471da177e4SLinus Torvalds 25481da177e4SLinus Torvalds if (link->doit == NULL) 25491d00a4ebSThomas Graf return -EINVAL; 25501da177e4SLinus Torvalds 25515424f32eSThomas Graf return link->doit(skb, nlh, attrs); 25521da177e4SLinus Torvalds } 25531da177e4SLinus Torvalds 2554cd40b7d3SDenis V. Lunev static void xfrm_netlink_rcv(struct sk_buff *skb) 25551da177e4SLinus Torvalds { 2556283bc9f3SFan Du struct net *net = sock_net(skb->sk); 2557283bc9f3SFan Du 2558283bc9f3SFan Du mutex_lock(&net->xfrm.xfrm_cfg_mutex); 2559cd40b7d3SDenis V. Lunev netlink_rcv_skb(skb, &xfrm_user_rcv_msg); 2560283bc9f3SFan Du mutex_unlock(&net->xfrm.xfrm_cfg_mutex); 25611da177e4SLinus Torvalds } 25621da177e4SLinus Torvalds 25637deb2264SThomas Graf static inline size_t xfrm_expire_msgsize(void) 25647deb2264SThomas Graf { 25656f26b61eSJamal Hadi Salim return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) 25666f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)); 25677deb2264SThomas Graf } 25687deb2264SThomas Graf 2569214e005bSDavid S. Miller static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 25701da177e4SLinus Torvalds { 25711da177e4SLinus Torvalds struct xfrm_user_expire *ue; 25721da177e4SLinus Torvalds struct nlmsghdr *nlh; 25731d1e34ddSDavid S. Miller int err; 25741da177e4SLinus Torvalds 257515e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0); 257679b8b7f4SThomas Graf if (nlh == NULL) 257779b8b7f4SThomas Graf return -EMSGSIZE; 25781da177e4SLinus Torvalds 25797b67c857SThomas Graf ue = nlmsg_data(nlh); 25801da177e4SLinus Torvalds copy_to_user_state(x, &ue->state); 2581d51d081dSJamal Hadi Salim ue->hard = (c->data.hard != 0) ? 1 : 0; 2582e3e5fc16SMathias Krause /* clear the padding bytes */ 2583e3e5fc16SMathias Krause memset(&ue->hard + 1, 0, sizeof(*ue) - offsetofend(typeof(*ue), hard)); 25841da177e4SLinus Torvalds 25851d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &x->mark); 25861d1e34ddSDavid S. Miller if (err) 25871d1e34ddSDavid S. Miller return err; 25886f26b61eSJamal Hadi Salim 2589053c095aSJohannes Berg nlmsg_end(skb, nlh); 2590053c095aSJohannes Berg return 0; 25911da177e4SLinus Torvalds } 25921da177e4SLinus Torvalds 2593214e005bSDavid S. Miller static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c) 25941da177e4SLinus Torvalds { 2595fc34acd3SAlexey Dobriyan struct net *net = xs_net(x); 25961da177e4SLinus Torvalds struct sk_buff *skb; 25971da177e4SLinus Torvalds 25987deb2264SThomas Graf skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC); 25991da177e4SLinus Torvalds if (skb == NULL) 26001da177e4SLinus Torvalds return -ENOMEM; 26011da177e4SLinus Torvalds 26026f26b61eSJamal Hadi Salim if (build_expire(skb, x, c) < 0) { 26036f26b61eSJamal Hadi Salim kfree_skb(skb); 26046f26b61eSJamal Hadi Salim return -EMSGSIZE; 26056f26b61eSJamal Hadi Salim } 26061da177e4SLinus Torvalds 260721ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 26081da177e4SLinus Torvalds } 26091da177e4SLinus Torvalds 2610214e005bSDavid S. Miller static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c) 2611d51d081dSJamal Hadi Salim { 2612fc34acd3SAlexey Dobriyan struct net *net = xs_net(x); 2613d51d081dSJamal Hadi Salim struct sk_buff *skb; 2614d51d081dSJamal Hadi Salim 2615d8647b79SSteffen Klassert skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 2616d51d081dSJamal Hadi Salim if (skb == NULL) 2617d51d081dSJamal Hadi Salim return -ENOMEM; 2618d51d081dSJamal Hadi Salim 2619d51d081dSJamal Hadi Salim if (build_aevent(skb, x, c) < 0) 2620d51d081dSJamal Hadi Salim BUG(); 2621d51d081dSJamal Hadi Salim 262221ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS); 2623d51d081dSJamal Hadi Salim } 2624d51d081dSJamal Hadi Salim 2625214e005bSDavid S. Miller static int xfrm_notify_sa_flush(const struct km_event *c) 262626b15dadSJamal Hadi Salim { 26277067802eSAlexey Dobriyan struct net *net = c->net; 262826b15dadSJamal Hadi Salim struct xfrm_usersa_flush *p; 262926b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 263026b15dadSJamal Hadi Salim struct sk_buff *skb; 26317deb2264SThomas Graf int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush)); 263226b15dadSJamal Hadi Salim 26337deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 263426b15dadSJamal Hadi Salim if (skb == NULL) 263526b15dadSJamal Hadi Salim return -ENOMEM; 263626b15dadSJamal Hadi Salim 263715e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0); 263879b8b7f4SThomas Graf if (nlh == NULL) { 263979b8b7f4SThomas Graf kfree_skb(skb); 264079b8b7f4SThomas Graf return -EMSGSIZE; 264179b8b7f4SThomas Graf } 264226b15dadSJamal Hadi Salim 26437b67c857SThomas Graf p = nlmsg_data(nlh); 2644bf08867fSHerbert Xu p->proto = c->data.proto; 264526b15dadSJamal Hadi Salim 26469825069dSThomas Graf nlmsg_end(skb, nlh); 264726b15dadSJamal Hadi Salim 264821ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 264926b15dadSJamal Hadi Salim } 265026b15dadSJamal Hadi Salim 26517deb2264SThomas Graf static inline size_t xfrm_sa_len(struct xfrm_state *x) 265226b15dadSJamal Hadi Salim { 26537deb2264SThomas Graf size_t l = 0; 26541a6509d9SHerbert Xu if (x->aead) 26551a6509d9SHerbert Xu l += nla_total_size(aead_len(x->aead)); 26564447bb33SMartin Willi if (x->aalg) { 26574447bb33SMartin Willi l += nla_total_size(sizeof(struct xfrm_algo) + 26584447bb33SMartin Willi (x->aalg->alg_key_len + 7) / 8); 26594447bb33SMartin Willi l += nla_total_size(xfrm_alg_auth_len(x->aalg)); 26604447bb33SMartin Willi } 266126b15dadSJamal Hadi Salim if (x->ealg) 26620f99be0dSEric Dumazet l += nla_total_size(xfrm_alg_len(x->ealg)); 266326b15dadSJamal Hadi Salim if (x->calg) 26647deb2264SThomas Graf l += nla_total_size(sizeof(*x->calg)); 266526b15dadSJamal Hadi Salim if (x->encap) 26667deb2264SThomas Graf l += nla_total_size(sizeof(*x->encap)); 266735d2856bSMartin Willi if (x->tfcpad) 266835d2856bSMartin Willi l += nla_total_size(sizeof(x->tfcpad)); 2669d8647b79SSteffen Klassert if (x->replay_esn) 2670d8647b79SSteffen Klassert l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn)); 2671f293a5e3Sdingzhi else 2672f293a5e3Sdingzhi l += nla_total_size(sizeof(struct xfrm_replay_state)); 267368325d3bSHerbert Xu if (x->security) 267468325d3bSHerbert Xu l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) + 267568325d3bSHerbert Xu x->security->ctx_len); 267668325d3bSHerbert Xu if (x->coaddr) 267768325d3bSHerbert Xu l += nla_total_size(sizeof(*x->coaddr)); 2678a947b0a9SNicolas Dichtel if (x->props.extra_flags) 2679a947b0a9SNicolas Dichtel l += nla_total_size(sizeof(x->props.extra_flags)); 2680d77e38e6SSteffen Klassert if (x->xso.dev) 2681d77e38e6SSteffen Klassert l += nla_total_size(sizeof(x->xso)); 268268325d3bSHerbert Xu 2683d26f3984SHerbert Xu /* Must count x->lastused as it may become non-zero behind our back. */ 2684de95c4a4SNicolas Dichtel l += nla_total_size_64bit(sizeof(u64)); 268526b15dadSJamal Hadi Salim 268626b15dadSJamal Hadi Salim return l; 268726b15dadSJamal Hadi Salim } 268826b15dadSJamal Hadi Salim 2689214e005bSDavid S. Miller static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c) 269026b15dadSJamal Hadi Salim { 2691fc34acd3SAlexey Dobriyan struct net *net = xs_net(x); 269226b15dadSJamal Hadi Salim struct xfrm_usersa_info *p; 26930603eac0SHerbert Xu struct xfrm_usersa_id *id; 269426b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 269526b15dadSJamal Hadi Salim struct sk_buff *skb; 269626b15dadSJamal Hadi Salim int len = xfrm_sa_len(x); 26971d1e34ddSDavid S. Miller int headlen, err; 26980603eac0SHerbert Xu 26990603eac0SHerbert Xu headlen = sizeof(*p); 27000603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) { 27017deb2264SThomas Graf len += nla_total_size(headlen); 27020603eac0SHerbert Xu headlen = sizeof(*id); 27036f26b61eSJamal Hadi Salim len += nla_total_size(sizeof(struct xfrm_mark)); 27040603eac0SHerbert Xu } 27057deb2264SThomas Graf len += NLMSG_ALIGN(headlen); 270626b15dadSJamal Hadi Salim 27077deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 270826b15dadSJamal Hadi Salim if (skb == NULL) 270926b15dadSJamal Hadi Salim return -ENOMEM; 271026b15dadSJamal Hadi Salim 271115e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 27121d1e34ddSDavid S. Miller err = -EMSGSIZE; 271379b8b7f4SThomas Graf if (nlh == NULL) 27141d1e34ddSDavid S. Miller goto out_free_skb; 271526b15dadSJamal Hadi Salim 27167b67c857SThomas Graf p = nlmsg_data(nlh); 27170603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) { 2718c0144beaSThomas Graf struct nlattr *attr; 2719c0144beaSThomas Graf 27207b67c857SThomas Graf id = nlmsg_data(nlh); 272150329c8aSMathias Krause memset(id, 0, sizeof(*id)); 27220603eac0SHerbert Xu memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr)); 27230603eac0SHerbert Xu id->spi = x->id.spi; 27240603eac0SHerbert Xu id->family = x->props.family; 27250603eac0SHerbert Xu id->proto = x->id.proto; 27260603eac0SHerbert Xu 2727c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SA, sizeof(*p)); 27281d1e34ddSDavid S. Miller err = -EMSGSIZE; 2729c0144beaSThomas Graf if (attr == NULL) 27301d1e34ddSDavid S. Miller goto out_free_skb; 2731c0144beaSThomas Graf 2732c0144beaSThomas Graf p = nla_data(attr); 27330603eac0SHerbert Xu } 27341d1e34ddSDavid S. Miller err = copy_to_user_state_extra(x, p, skb); 27351d1e34ddSDavid S. Miller if (err) 27361d1e34ddSDavid S. Miller goto out_free_skb; 273726b15dadSJamal Hadi Salim 27389825069dSThomas Graf nlmsg_end(skb, nlh); 273926b15dadSJamal Hadi Salim 274021ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 274126b15dadSJamal Hadi Salim 27421d1e34ddSDavid S. Miller out_free_skb: 274326b15dadSJamal Hadi Salim kfree_skb(skb); 27441d1e34ddSDavid S. Miller return err; 274526b15dadSJamal Hadi Salim } 274626b15dadSJamal Hadi Salim 2747214e005bSDavid S. Miller static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c) 274826b15dadSJamal Hadi Salim { 274926b15dadSJamal Hadi Salim 275026b15dadSJamal Hadi Salim switch (c->event) { 2751f60f6b8fSHerbert Xu case XFRM_MSG_EXPIRE: 275226b15dadSJamal Hadi Salim return xfrm_exp_state_notify(x, c); 2753d51d081dSJamal Hadi Salim case XFRM_MSG_NEWAE: 2754d51d081dSJamal Hadi Salim return xfrm_aevent_state_notify(x, c); 2755f60f6b8fSHerbert Xu case XFRM_MSG_DELSA: 2756f60f6b8fSHerbert Xu case XFRM_MSG_UPDSA: 2757f60f6b8fSHerbert Xu case XFRM_MSG_NEWSA: 275826b15dadSJamal Hadi Salim return xfrm_notify_sa(x, c); 2759f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHSA: 276026b15dadSJamal Hadi Salim return xfrm_notify_sa_flush(c); 276126b15dadSJamal Hadi Salim default: 276262db5cfdSstephen hemminger printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n", 276362db5cfdSstephen hemminger c->event); 276426b15dadSJamal Hadi Salim break; 276526b15dadSJamal Hadi Salim } 276626b15dadSJamal Hadi Salim 276726b15dadSJamal Hadi Salim return 0; 276826b15dadSJamal Hadi Salim 276926b15dadSJamal Hadi Salim } 277026b15dadSJamal Hadi Salim 27717deb2264SThomas Graf static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x, 27727deb2264SThomas Graf struct xfrm_policy *xp) 27737deb2264SThomas Graf { 27747deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire)) 27757deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 27766f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)) 27777deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(x->security)) 27787deb2264SThomas Graf + userpolicy_type_attrsize(); 27797deb2264SThomas Graf } 27807deb2264SThomas Graf 27811da177e4SLinus Torvalds static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, 278265e0736bSFan Du struct xfrm_tmpl *xt, struct xfrm_policy *xp) 27831da177e4SLinus Torvalds { 27841d1e34ddSDavid S. Miller __u32 seq = xfrm_get_acqseq(); 27851da177e4SLinus Torvalds struct xfrm_user_acquire *ua; 27861da177e4SLinus Torvalds struct nlmsghdr *nlh; 27871d1e34ddSDavid S. Miller int err; 27881da177e4SLinus Torvalds 278979b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0); 279079b8b7f4SThomas Graf if (nlh == NULL) 279179b8b7f4SThomas Graf return -EMSGSIZE; 27921da177e4SLinus Torvalds 27937b67c857SThomas Graf ua = nlmsg_data(nlh); 27941da177e4SLinus Torvalds memcpy(&ua->id, &x->id, sizeof(ua->id)); 27951da177e4SLinus Torvalds memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr)); 27961da177e4SLinus Torvalds memcpy(&ua->sel, &x->sel, sizeof(ua->sel)); 279765e0736bSFan Du copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT); 27981da177e4SLinus Torvalds ua->aalgos = xt->aalgos; 27991da177e4SLinus Torvalds ua->ealgos = xt->ealgos; 28001da177e4SLinus Torvalds ua->calgos = xt->calgos; 28011da177e4SLinus Torvalds ua->seq = x->km.seq = seq; 28021da177e4SLinus Torvalds 28031d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 28041d1e34ddSDavid S. Miller if (!err) 28051d1e34ddSDavid S. Miller err = copy_to_user_state_sec_ctx(x, skb); 28061d1e34ddSDavid S. Miller if (!err) 28071d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 28081d1e34ddSDavid S. Miller if (!err) 28091d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 28101d1e34ddSDavid S. Miller if (err) { 28111d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 28121d1e34ddSDavid S. Miller return err; 28131d1e34ddSDavid S. Miller } 28141da177e4SLinus Torvalds 2815053c095aSJohannes Berg nlmsg_end(skb, nlh); 2816053c095aSJohannes Berg return 0; 28171da177e4SLinus Torvalds } 28181da177e4SLinus Torvalds 28191da177e4SLinus Torvalds static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt, 282065e0736bSFan Du struct xfrm_policy *xp) 28211da177e4SLinus Torvalds { 2822a6483b79SAlexey Dobriyan struct net *net = xs_net(x); 28231da177e4SLinus Torvalds struct sk_buff *skb; 28241da177e4SLinus Torvalds 28257deb2264SThomas Graf skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC); 28261da177e4SLinus Torvalds if (skb == NULL) 28271da177e4SLinus Torvalds return -ENOMEM; 28281da177e4SLinus Torvalds 282965e0736bSFan Du if (build_acquire(skb, x, xt, xp) < 0) 28301da177e4SLinus Torvalds BUG(); 28311da177e4SLinus Torvalds 283221ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE); 28331da177e4SLinus Torvalds } 28341da177e4SLinus Torvalds 28351da177e4SLinus Torvalds /* User gives us xfrm_user_policy_info followed by an array of 0 28361da177e4SLinus Torvalds * or more templates. 28371da177e4SLinus Torvalds */ 2838cb969f07SVenkat Yekkirala static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt, 28391da177e4SLinus Torvalds u8 *data, int len, int *dir) 28401da177e4SLinus Torvalds { 2841fc34acd3SAlexey Dobriyan struct net *net = sock_net(sk); 28421da177e4SLinus Torvalds struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data; 28431da177e4SLinus Torvalds struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1); 28441da177e4SLinus Torvalds struct xfrm_policy *xp; 28451da177e4SLinus Torvalds int nr; 28461da177e4SLinus Torvalds 2847cb969f07SVenkat Yekkirala switch (sk->sk_family) { 28481da177e4SLinus Torvalds case AF_INET: 28491da177e4SLinus Torvalds if (opt != IP_XFRM_POLICY) { 28501da177e4SLinus Torvalds *dir = -EOPNOTSUPP; 28511da177e4SLinus Torvalds return NULL; 28521da177e4SLinus Torvalds } 28531da177e4SLinus Torvalds break; 2854dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 28551da177e4SLinus Torvalds case AF_INET6: 28561da177e4SLinus Torvalds if (opt != IPV6_XFRM_POLICY) { 28571da177e4SLinus Torvalds *dir = -EOPNOTSUPP; 28581da177e4SLinus Torvalds return NULL; 28591da177e4SLinus Torvalds } 28601da177e4SLinus Torvalds break; 28611da177e4SLinus Torvalds #endif 28621da177e4SLinus Torvalds default: 28631da177e4SLinus Torvalds *dir = -EINVAL; 28641da177e4SLinus Torvalds return NULL; 28651da177e4SLinus Torvalds } 28661da177e4SLinus Torvalds 28671da177e4SLinus Torvalds *dir = -EINVAL; 28681da177e4SLinus Torvalds 28691da177e4SLinus Torvalds if (len < sizeof(*p) || 28701da177e4SLinus Torvalds verify_newpolicy_info(p)) 28711da177e4SLinus Torvalds return NULL; 28721da177e4SLinus Torvalds 28731da177e4SLinus Torvalds nr = ((len - sizeof(*p)) / sizeof(*ut)); 2874b4ad86bfSDavid S. Miller if (validate_tmpl(nr, ut, p->sel.family)) 28751da177e4SLinus Torvalds return NULL; 28761da177e4SLinus Torvalds 2877a4f1bac6SHerbert Xu if (p->dir > XFRM_POLICY_OUT) 2878a4f1bac6SHerbert Xu return NULL; 2879a4f1bac6SHerbert Xu 28802f09a4d5SHerbert Xu xp = xfrm_policy_alloc(net, GFP_ATOMIC); 28811da177e4SLinus Torvalds if (xp == NULL) { 28821da177e4SLinus Torvalds *dir = -ENOBUFS; 28831da177e4SLinus Torvalds return NULL; 28841da177e4SLinus Torvalds } 28851da177e4SLinus Torvalds 28861da177e4SLinus Torvalds copy_from_user_policy(xp, p); 2887f7b6983fSMasahide NAKAMURA xp->type = XFRM_POLICY_TYPE_MAIN; 28881da177e4SLinus Torvalds copy_templates(xp, ut, nr); 28891da177e4SLinus Torvalds 28901da177e4SLinus Torvalds *dir = p->dir; 28911da177e4SLinus Torvalds 28921da177e4SLinus Torvalds return xp; 28931da177e4SLinus Torvalds } 28941da177e4SLinus Torvalds 28957deb2264SThomas Graf static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp) 28967deb2264SThomas Graf { 28977deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire)) 28987deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 28997deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(xp->security)) 2900295fae56SJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)) 29017deb2264SThomas Graf + userpolicy_type_attrsize(); 29027deb2264SThomas Graf } 29037deb2264SThomas Graf 29041da177e4SLinus Torvalds static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, 2905214e005bSDavid S. Miller int dir, const struct km_event *c) 29061da177e4SLinus Torvalds { 29071da177e4SLinus Torvalds struct xfrm_user_polexpire *upe; 2908d51d081dSJamal Hadi Salim int hard = c->data.hard; 29091d1e34ddSDavid S. Miller struct nlmsghdr *nlh; 29101d1e34ddSDavid S. Miller int err; 29111da177e4SLinus Torvalds 291215e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0); 291379b8b7f4SThomas Graf if (nlh == NULL) 291479b8b7f4SThomas Graf return -EMSGSIZE; 29151da177e4SLinus Torvalds 29167b67c857SThomas Graf upe = nlmsg_data(nlh); 29171da177e4SLinus Torvalds copy_to_user_policy(xp, &upe->pol, dir); 29181d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 29191d1e34ddSDavid S. Miller if (!err) 29201d1e34ddSDavid S. Miller err = copy_to_user_sec_ctx(xp, skb); 29211d1e34ddSDavid S. Miller if (!err) 29221d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 29231d1e34ddSDavid S. Miller if (!err) 29241d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 29251d1e34ddSDavid S. Miller if (err) { 29261d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 29271d1e34ddSDavid S. Miller return err; 29281d1e34ddSDavid S. Miller } 29291da177e4SLinus Torvalds upe->hard = !!hard; 29301da177e4SLinus Torvalds 2931053c095aSJohannes Berg nlmsg_end(skb, nlh); 2932053c095aSJohannes Berg return 0; 29331da177e4SLinus Torvalds } 29341da177e4SLinus Torvalds 2935214e005bSDavid S. Miller static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 29361da177e4SLinus Torvalds { 2937fc34acd3SAlexey Dobriyan struct net *net = xp_net(xp); 29381da177e4SLinus Torvalds struct sk_buff *skb; 29391da177e4SLinus Torvalds 29407deb2264SThomas Graf skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC); 29411da177e4SLinus Torvalds if (skb == NULL) 29421da177e4SLinus Torvalds return -ENOMEM; 29431da177e4SLinus Torvalds 2944d51d081dSJamal Hadi Salim if (build_polexpire(skb, xp, dir, c) < 0) 29451da177e4SLinus Torvalds BUG(); 29461da177e4SLinus Torvalds 294721ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 29481da177e4SLinus Torvalds } 29491da177e4SLinus Torvalds 2950214e005bSDavid S. Miller static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c) 295126b15dadSJamal Hadi Salim { 29521d1e34ddSDavid S. Miller int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 2953fc34acd3SAlexey Dobriyan struct net *net = xp_net(xp); 295426b15dadSJamal Hadi Salim struct xfrm_userpolicy_info *p; 29550603eac0SHerbert Xu struct xfrm_userpolicy_id *id; 295626b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 295726b15dadSJamal Hadi Salim struct sk_buff *skb; 29581d1e34ddSDavid S. Miller int headlen, err; 29590603eac0SHerbert Xu 29600603eac0SHerbert Xu headlen = sizeof(*p); 29610603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) { 29627deb2264SThomas Graf len += nla_total_size(headlen); 29630603eac0SHerbert Xu headlen = sizeof(*id); 29640603eac0SHerbert Xu } 2965cfbfd45aSThomas Graf len += userpolicy_type_attrsize(); 2966295fae56SJamal Hadi Salim len += nla_total_size(sizeof(struct xfrm_mark)); 29677deb2264SThomas Graf len += NLMSG_ALIGN(headlen); 296826b15dadSJamal Hadi Salim 29697deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 297026b15dadSJamal Hadi Salim if (skb == NULL) 297126b15dadSJamal Hadi Salim return -ENOMEM; 297226b15dadSJamal Hadi Salim 297315e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 29741d1e34ddSDavid S. Miller err = -EMSGSIZE; 297579b8b7f4SThomas Graf if (nlh == NULL) 29761d1e34ddSDavid S. Miller goto out_free_skb; 297726b15dadSJamal Hadi Salim 29787b67c857SThomas Graf p = nlmsg_data(nlh); 29790603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) { 2980c0144beaSThomas Graf struct nlattr *attr; 2981c0144beaSThomas Graf 29827b67c857SThomas Graf id = nlmsg_data(nlh); 29830603eac0SHerbert Xu memset(id, 0, sizeof(*id)); 29840603eac0SHerbert Xu id->dir = dir; 29850603eac0SHerbert Xu if (c->data.byid) 29860603eac0SHerbert Xu id->index = xp->index; 29870603eac0SHerbert Xu else 29880603eac0SHerbert Xu memcpy(&id->sel, &xp->selector, sizeof(id->sel)); 29890603eac0SHerbert Xu 2990c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p)); 29911d1e34ddSDavid S. Miller err = -EMSGSIZE; 2992c0144beaSThomas Graf if (attr == NULL) 29931d1e34ddSDavid S. Miller goto out_free_skb; 2994c0144beaSThomas Graf 2995c0144beaSThomas Graf p = nla_data(attr); 29960603eac0SHerbert Xu } 299726b15dadSJamal Hadi Salim 299826b15dadSJamal Hadi Salim copy_to_user_policy(xp, p, dir); 29991d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 30001d1e34ddSDavid S. Miller if (!err) 30011d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 30021d1e34ddSDavid S. Miller if (!err) 30031d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 30041d1e34ddSDavid S. Miller if (err) 30051d1e34ddSDavid S. Miller goto out_free_skb; 3006295fae56SJamal Hadi Salim 30079825069dSThomas Graf nlmsg_end(skb, nlh); 300826b15dadSJamal Hadi Salim 300921ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 301026b15dadSJamal Hadi Salim 30111d1e34ddSDavid S. Miller out_free_skb: 301226b15dadSJamal Hadi Salim kfree_skb(skb); 30131d1e34ddSDavid S. Miller return err; 301426b15dadSJamal Hadi Salim } 301526b15dadSJamal Hadi Salim 3016214e005bSDavid S. Miller static int xfrm_notify_policy_flush(const struct km_event *c) 301726b15dadSJamal Hadi Salim { 30187067802eSAlexey Dobriyan struct net *net = c->net; 301926b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 302026b15dadSJamal Hadi Salim struct sk_buff *skb; 30211d1e34ddSDavid S. Miller int err; 302226b15dadSJamal Hadi Salim 30237deb2264SThomas Graf skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC); 302426b15dadSJamal Hadi Salim if (skb == NULL) 302526b15dadSJamal Hadi Salim return -ENOMEM; 302626b15dadSJamal Hadi Salim 302715e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0); 30281d1e34ddSDavid S. Miller err = -EMSGSIZE; 302979b8b7f4SThomas Graf if (nlh == NULL) 30301d1e34ddSDavid S. Miller goto out_free_skb; 30311d1e34ddSDavid S. Miller err = copy_to_user_policy_type(c->data.type, skb); 30321d1e34ddSDavid S. Miller if (err) 30331d1e34ddSDavid S. Miller goto out_free_skb; 303426b15dadSJamal Hadi Salim 30359825069dSThomas Graf nlmsg_end(skb, nlh); 303626b15dadSJamal Hadi Salim 303721ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 303826b15dadSJamal Hadi Salim 30391d1e34ddSDavid S. Miller out_free_skb: 304026b15dadSJamal Hadi Salim kfree_skb(skb); 30411d1e34ddSDavid S. Miller return err; 304226b15dadSJamal Hadi Salim } 304326b15dadSJamal Hadi Salim 3044214e005bSDavid S. Miller static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 304526b15dadSJamal Hadi Salim { 304626b15dadSJamal Hadi Salim 304726b15dadSJamal Hadi Salim switch (c->event) { 3048f60f6b8fSHerbert Xu case XFRM_MSG_NEWPOLICY: 3049f60f6b8fSHerbert Xu case XFRM_MSG_UPDPOLICY: 3050f60f6b8fSHerbert Xu case XFRM_MSG_DELPOLICY: 305126b15dadSJamal Hadi Salim return xfrm_notify_policy(xp, dir, c); 3052f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHPOLICY: 305326b15dadSJamal Hadi Salim return xfrm_notify_policy_flush(c); 3054f60f6b8fSHerbert Xu case XFRM_MSG_POLEXPIRE: 305526b15dadSJamal Hadi Salim return xfrm_exp_policy_notify(xp, dir, c); 305626b15dadSJamal Hadi Salim default: 305762db5cfdSstephen hemminger printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n", 305862db5cfdSstephen hemminger c->event); 305926b15dadSJamal Hadi Salim } 306026b15dadSJamal Hadi Salim 306126b15dadSJamal Hadi Salim return 0; 306226b15dadSJamal Hadi Salim 306326b15dadSJamal Hadi Salim } 306426b15dadSJamal Hadi Salim 30657deb2264SThomas Graf static inline size_t xfrm_report_msgsize(void) 30667deb2264SThomas Graf { 30677deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_report)); 30687deb2264SThomas Graf } 30697deb2264SThomas Graf 307097a64b45SMasahide NAKAMURA static int build_report(struct sk_buff *skb, u8 proto, 307197a64b45SMasahide NAKAMURA struct xfrm_selector *sel, xfrm_address_t *addr) 307297a64b45SMasahide NAKAMURA { 307397a64b45SMasahide NAKAMURA struct xfrm_user_report *ur; 307497a64b45SMasahide NAKAMURA struct nlmsghdr *nlh; 307597a64b45SMasahide NAKAMURA 307679b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0); 307779b8b7f4SThomas Graf if (nlh == NULL) 307879b8b7f4SThomas Graf return -EMSGSIZE; 307997a64b45SMasahide NAKAMURA 30807b67c857SThomas Graf ur = nlmsg_data(nlh); 308197a64b45SMasahide NAKAMURA ur->proto = proto; 308297a64b45SMasahide NAKAMURA memcpy(&ur->sel, sel, sizeof(ur->sel)); 308397a64b45SMasahide NAKAMURA 30841d1e34ddSDavid S. Miller if (addr) { 30851d1e34ddSDavid S. Miller int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr); 30861d1e34ddSDavid S. Miller if (err) { 30879825069dSThomas Graf nlmsg_cancel(skb, nlh); 30881d1e34ddSDavid S. Miller return err; 30891d1e34ddSDavid S. Miller } 30901d1e34ddSDavid S. Miller } 3091053c095aSJohannes Berg nlmsg_end(skb, nlh); 3092053c095aSJohannes Berg return 0; 309397a64b45SMasahide NAKAMURA } 309497a64b45SMasahide NAKAMURA 3095db983c11SAlexey Dobriyan static int xfrm_send_report(struct net *net, u8 proto, 3096db983c11SAlexey Dobriyan struct xfrm_selector *sel, xfrm_address_t *addr) 309797a64b45SMasahide NAKAMURA { 309897a64b45SMasahide NAKAMURA struct sk_buff *skb; 309997a64b45SMasahide NAKAMURA 31007deb2264SThomas Graf skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC); 310197a64b45SMasahide NAKAMURA if (skb == NULL) 310297a64b45SMasahide NAKAMURA return -ENOMEM; 310397a64b45SMasahide NAKAMURA 310497a64b45SMasahide NAKAMURA if (build_report(skb, proto, sel, addr) < 0) 310597a64b45SMasahide NAKAMURA BUG(); 310697a64b45SMasahide NAKAMURA 310721ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT); 310897a64b45SMasahide NAKAMURA } 310997a64b45SMasahide NAKAMURA 31103a2dfbe8SMartin Willi static inline size_t xfrm_mapping_msgsize(void) 31113a2dfbe8SMartin Willi { 31123a2dfbe8SMartin Willi return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping)); 31133a2dfbe8SMartin Willi } 31143a2dfbe8SMartin Willi 31153a2dfbe8SMartin Willi static int build_mapping(struct sk_buff *skb, struct xfrm_state *x, 31163a2dfbe8SMartin Willi xfrm_address_t *new_saddr, __be16 new_sport) 31173a2dfbe8SMartin Willi { 31183a2dfbe8SMartin Willi struct xfrm_user_mapping *um; 31193a2dfbe8SMartin Willi struct nlmsghdr *nlh; 31203a2dfbe8SMartin Willi 31213a2dfbe8SMartin Willi nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0); 31223a2dfbe8SMartin Willi if (nlh == NULL) 31233a2dfbe8SMartin Willi return -EMSGSIZE; 31243a2dfbe8SMartin Willi 31253a2dfbe8SMartin Willi um = nlmsg_data(nlh); 31263a2dfbe8SMartin Willi 31273a2dfbe8SMartin Willi memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr)); 31283a2dfbe8SMartin Willi um->id.spi = x->id.spi; 31293a2dfbe8SMartin Willi um->id.family = x->props.family; 31303a2dfbe8SMartin Willi um->id.proto = x->id.proto; 31313a2dfbe8SMartin Willi memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr)); 31323a2dfbe8SMartin Willi memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr)); 31333a2dfbe8SMartin Willi um->new_sport = new_sport; 31343a2dfbe8SMartin Willi um->old_sport = x->encap->encap_sport; 31353a2dfbe8SMartin Willi um->reqid = x->props.reqid; 31363a2dfbe8SMartin Willi 3137053c095aSJohannes Berg nlmsg_end(skb, nlh); 3138053c095aSJohannes Berg return 0; 31393a2dfbe8SMartin Willi } 31403a2dfbe8SMartin Willi 31413a2dfbe8SMartin Willi static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, 31423a2dfbe8SMartin Willi __be16 sport) 31433a2dfbe8SMartin Willi { 3144a6483b79SAlexey Dobriyan struct net *net = xs_net(x); 31453a2dfbe8SMartin Willi struct sk_buff *skb; 31463a2dfbe8SMartin Willi 31473a2dfbe8SMartin Willi if (x->id.proto != IPPROTO_ESP) 31483a2dfbe8SMartin Willi return -EINVAL; 31493a2dfbe8SMartin Willi 31503a2dfbe8SMartin Willi if (!x->encap) 31513a2dfbe8SMartin Willi return -EINVAL; 31523a2dfbe8SMartin Willi 31533a2dfbe8SMartin Willi skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC); 31543a2dfbe8SMartin Willi if (skb == NULL) 31553a2dfbe8SMartin Willi return -ENOMEM; 31563a2dfbe8SMartin Willi 31573a2dfbe8SMartin Willi if (build_mapping(skb, x, ipaddr, sport) < 0) 31583a2dfbe8SMartin Willi BUG(); 31593a2dfbe8SMartin Willi 316021ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING); 31613a2dfbe8SMartin Willi } 31623a2dfbe8SMartin Willi 31630f24558eSHoria Geanta static bool xfrm_is_alive(const struct km_event *c) 31640f24558eSHoria Geanta { 31650f24558eSHoria Geanta return (bool)xfrm_acquire_is_on(c->net); 31660f24558eSHoria Geanta } 31670f24558eSHoria Geanta 31681da177e4SLinus Torvalds static struct xfrm_mgr netlink_mgr = { 31691da177e4SLinus Torvalds .notify = xfrm_send_state_notify, 31701da177e4SLinus Torvalds .acquire = xfrm_send_acquire, 31711da177e4SLinus Torvalds .compile_policy = xfrm_compile_policy, 31721da177e4SLinus Torvalds .notify_policy = xfrm_send_policy_notify, 317397a64b45SMasahide NAKAMURA .report = xfrm_send_report, 31745c79de6eSShinta Sugimoto .migrate = xfrm_send_migrate, 31753a2dfbe8SMartin Willi .new_mapping = xfrm_send_mapping, 31760f24558eSHoria Geanta .is_alive = xfrm_is_alive, 31771da177e4SLinus Torvalds }; 31781da177e4SLinus Torvalds 3179a6483b79SAlexey Dobriyan static int __net_init xfrm_user_net_init(struct net *net) 31801da177e4SLinus Torvalds { 3181be33690dSPatrick McHardy struct sock *nlsk; 3182a31f2d17SPablo Neira Ayuso struct netlink_kernel_cfg cfg = { 3183a31f2d17SPablo Neira Ayuso .groups = XFRMNLGRP_MAX, 3184a31f2d17SPablo Neira Ayuso .input = xfrm_netlink_rcv, 3185a31f2d17SPablo Neira Ayuso }; 3186be33690dSPatrick McHardy 31879f00d977SPablo Neira Ayuso nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg); 3188be33690dSPatrick McHardy if (nlsk == NULL) 31891da177e4SLinus Torvalds return -ENOMEM; 3190d79d792eSEric W. Biederman net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */ 3191cf778b00SEric Dumazet rcu_assign_pointer(net->xfrm.nlsk, nlsk); 31921da177e4SLinus Torvalds return 0; 31931da177e4SLinus Torvalds } 31941da177e4SLinus Torvalds 3195d79d792eSEric W. Biederman static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list) 3196a6483b79SAlexey Dobriyan { 3197d79d792eSEric W. Biederman struct net *net; 3198d79d792eSEric W. Biederman list_for_each_entry(net, net_exit_list, exit_list) 3199a9b3cd7fSStephen Hemminger RCU_INIT_POINTER(net->xfrm.nlsk, NULL); 3200d79d792eSEric W. Biederman synchronize_net(); 3201d79d792eSEric W. Biederman list_for_each_entry(net, net_exit_list, exit_list) 3202d79d792eSEric W. Biederman netlink_kernel_release(net->xfrm.nlsk_stash); 3203a6483b79SAlexey Dobriyan } 3204a6483b79SAlexey Dobriyan 3205a6483b79SAlexey Dobriyan static struct pernet_operations xfrm_user_net_ops = { 3206a6483b79SAlexey Dobriyan .init = xfrm_user_net_init, 3207d79d792eSEric W. Biederman .exit_batch = xfrm_user_net_exit, 3208a6483b79SAlexey Dobriyan }; 3209a6483b79SAlexey Dobriyan 3210a6483b79SAlexey Dobriyan static int __init xfrm_user_init(void) 3211a6483b79SAlexey Dobriyan { 3212a6483b79SAlexey Dobriyan int rv; 3213a6483b79SAlexey Dobriyan 3214a6483b79SAlexey Dobriyan printk(KERN_INFO "Initializing XFRM netlink socket\n"); 3215a6483b79SAlexey Dobriyan 3216a6483b79SAlexey Dobriyan rv = register_pernet_subsys(&xfrm_user_net_ops); 3217a6483b79SAlexey Dobriyan if (rv < 0) 3218a6483b79SAlexey Dobriyan return rv; 3219a6483b79SAlexey Dobriyan rv = xfrm_register_km(&netlink_mgr); 3220a6483b79SAlexey Dobriyan if (rv < 0) 3221a6483b79SAlexey Dobriyan unregister_pernet_subsys(&xfrm_user_net_ops); 3222a6483b79SAlexey Dobriyan return rv; 3223a6483b79SAlexey Dobriyan } 3224a6483b79SAlexey Dobriyan 32251da177e4SLinus Torvalds static void __exit xfrm_user_exit(void) 32261da177e4SLinus Torvalds { 32271da177e4SLinus Torvalds xfrm_unregister_km(&netlink_mgr); 3228a6483b79SAlexey Dobriyan unregister_pernet_subsys(&xfrm_user_net_ops); 32291da177e4SLinus Torvalds } 32301da177e4SLinus Torvalds 32311da177e4SLinus Torvalds module_init(xfrm_user_init); 32321da177e4SLinus Torvalds module_exit(xfrm_user_exit); 32331da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 32344fdb3bb7SHarald Welte MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM); 3235f8cd5488SJamal Hadi Salim 3236