11da177e4SLinus Torvalds /* xfrm_user.c: User interface to configure xfrm engine. 21da177e4SLinus Torvalds * 31da177e4SLinus Torvalds * Copyright (C) 2002 David S. Miller (davem@redhat.com) 41da177e4SLinus Torvalds * 51da177e4SLinus Torvalds * Changes: 61da177e4SLinus Torvalds * Mitsuru KANDA @USAGI 71da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI 81da177e4SLinus Torvalds * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 91da177e4SLinus Torvalds * IPv6 support 101da177e4SLinus Torvalds * 111da177e4SLinus Torvalds */ 121da177e4SLinus Torvalds 139409f38aSHerbert Xu #include <linux/crypto.h> 141da177e4SLinus Torvalds #include <linux/module.h> 151da177e4SLinus Torvalds #include <linux/kernel.h> 161da177e4SLinus Torvalds #include <linux/types.h> 171da177e4SLinus Torvalds #include <linux/slab.h> 181da177e4SLinus Torvalds #include <linux/socket.h> 191da177e4SLinus Torvalds #include <linux/string.h> 201da177e4SLinus Torvalds #include <linux/net.h> 211da177e4SLinus Torvalds #include <linux/skbuff.h> 221da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 231da177e4SLinus Torvalds #include <linux/ipsec.h> 241da177e4SLinus Torvalds #include <linux/init.h> 251da177e4SLinus Torvalds #include <linux/security.h> 261da177e4SLinus Torvalds #include <net/sock.h> 271da177e4SLinus Torvalds #include <net/xfrm.h> 2888fc2c84SThomas Graf #include <net/netlink.h> 29fa6dd8a2SNicolas Dichtel #include <net/ah.h> 301da177e4SLinus Torvalds #include <asm/uaccess.h> 31dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 32e23c7194SMasahide NAKAMURA #include <linux/in6.h> 33e23c7194SMasahide NAKAMURA #endif 34*e33d4f13SSowmini Varadhan #include <asm/unaligned.h> 351da177e4SLinus Torvalds 365424f32eSThomas Graf static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type) 371da177e4SLinus Torvalds { 385424f32eSThomas Graf struct nlattr *rt = attrs[type]; 391da177e4SLinus Torvalds struct xfrm_algo *algp; 401da177e4SLinus Torvalds 411da177e4SLinus Torvalds if (!rt) 421da177e4SLinus Torvalds return 0; 431da177e4SLinus Torvalds 445424f32eSThomas Graf algp = nla_data(rt); 450f99be0dSEric Dumazet if (nla_len(rt) < xfrm_alg_len(algp)) 4631c26852SHerbert Xu return -EINVAL; 4731c26852SHerbert Xu 481da177e4SLinus Torvalds switch (type) { 491da177e4SLinus Torvalds case XFRMA_ALG_AUTH: 501da177e4SLinus Torvalds case XFRMA_ALG_CRYPT: 511da177e4SLinus Torvalds case XFRMA_ALG_COMP: 521da177e4SLinus Torvalds break; 531da177e4SLinus Torvalds 541da177e4SLinus Torvalds default: 551da177e4SLinus Torvalds return -EINVAL; 563ff50b79SStephen Hemminger } 571da177e4SLinus Torvalds 581da177e4SLinus Torvalds algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0'; 591da177e4SLinus Torvalds return 0; 601da177e4SLinus Torvalds } 611da177e4SLinus Torvalds 624447bb33SMartin Willi static int verify_auth_trunc(struct nlattr **attrs) 634447bb33SMartin Willi { 644447bb33SMartin Willi struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC]; 654447bb33SMartin Willi struct xfrm_algo_auth *algp; 664447bb33SMartin Willi 674447bb33SMartin Willi if (!rt) 684447bb33SMartin Willi return 0; 694447bb33SMartin Willi 704447bb33SMartin Willi algp = nla_data(rt); 714447bb33SMartin Willi if (nla_len(rt) < xfrm_alg_auth_len(algp)) 724447bb33SMartin Willi return -EINVAL; 734447bb33SMartin Willi 744447bb33SMartin Willi algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0'; 754447bb33SMartin Willi return 0; 764447bb33SMartin Willi } 774447bb33SMartin Willi 781a6509d9SHerbert Xu static int verify_aead(struct nlattr **attrs) 791a6509d9SHerbert Xu { 801a6509d9SHerbert Xu struct nlattr *rt = attrs[XFRMA_ALG_AEAD]; 811a6509d9SHerbert Xu struct xfrm_algo_aead *algp; 821a6509d9SHerbert Xu 831a6509d9SHerbert Xu if (!rt) 841a6509d9SHerbert Xu return 0; 851a6509d9SHerbert Xu 861a6509d9SHerbert Xu algp = nla_data(rt); 871a6509d9SHerbert Xu if (nla_len(rt) < aead_len(algp)) 881a6509d9SHerbert Xu return -EINVAL; 891a6509d9SHerbert Xu 901a6509d9SHerbert Xu algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0'; 911a6509d9SHerbert Xu return 0; 921a6509d9SHerbert Xu } 931a6509d9SHerbert Xu 945424f32eSThomas Graf static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type, 95eb2971b6SMasahide NAKAMURA xfrm_address_t **addrp) 96eb2971b6SMasahide NAKAMURA { 975424f32eSThomas Graf struct nlattr *rt = attrs[type]; 98eb2971b6SMasahide NAKAMURA 99cf5cb79fSThomas Graf if (rt && addrp) 1005424f32eSThomas Graf *addrp = nla_data(rt); 101eb2971b6SMasahide NAKAMURA } 102df71837dSTrent Jaeger 1035424f32eSThomas Graf static inline int verify_sec_ctx_len(struct nlattr **attrs) 104df71837dSTrent Jaeger { 1055424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 106df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx; 107df71837dSTrent Jaeger 108df71837dSTrent Jaeger if (!rt) 109df71837dSTrent Jaeger return 0; 110df71837dSTrent Jaeger 1115424f32eSThomas Graf uctx = nla_data(rt); 112cf5cb79fSThomas Graf if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) 113df71837dSTrent Jaeger return -EINVAL; 114df71837dSTrent Jaeger 115df71837dSTrent Jaeger return 0; 116df71837dSTrent Jaeger } 117df71837dSTrent Jaeger 118d8647b79SSteffen Klassert static inline int verify_replay(struct xfrm_usersa_info *p, 119d8647b79SSteffen Klassert struct nlattr **attrs) 120d8647b79SSteffen Klassert { 121d8647b79SSteffen Klassert struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; 122ecd79187SMathias Krause struct xfrm_replay_state_esn *rs; 123d8647b79SSteffen Klassert 124ecd79187SMathias Krause if (p->flags & XFRM_STATE_ESN) { 125ecd79187SMathias Krause if (!rt) 1267833aa05SSteffen Klassert return -EINVAL; 1277833aa05SSteffen Klassert 128ecd79187SMathias Krause rs = nla_data(rt); 129ecd79187SMathias Krause 130ecd79187SMathias Krause if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) 131ecd79187SMathias Krause return -EINVAL; 132ecd79187SMathias Krause 133ecd79187SMathias Krause if (nla_len(rt) < xfrm_replay_state_esn_len(rs) && 134ecd79187SMathias Krause nla_len(rt) != sizeof(*rs)) 135ecd79187SMathias Krause return -EINVAL; 136ecd79187SMathias Krause } 137ecd79187SMathias Krause 138d8647b79SSteffen Klassert if (!rt) 139d8647b79SSteffen Klassert return 0; 140d8647b79SSteffen Klassert 14101714109SFan Du /* As only ESP and AH support ESN feature. */ 14201714109SFan Du if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) 14302aadf72SSteffen Klassert return -EINVAL; 14402aadf72SSteffen Klassert 145d8647b79SSteffen Klassert if (p->replay_window != 0) 146d8647b79SSteffen Klassert return -EINVAL; 147d8647b79SSteffen Klassert 148d8647b79SSteffen Klassert return 0; 149d8647b79SSteffen Klassert } 150df71837dSTrent Jaeger 1511da177e4SLinus Torvalds static int verify_newsa_info(struct xfrm_usersa_info *p, 1525424f32eSThomas Graf struct nlattr **attrs) 1531da177e4SLinus Torvalds { 1541da177e4SLinus Torvalds int err; 1551da177e4SLinus Torvalds 1561da177e4SLinus Torvalds err = -EINVAL; 1571da177e4SLinus Torvalds switch (p->family) { 1581da177e4SLinus Torvalds case AF_INET: 1591da177e4SLinus Torvalds break; 1601da177e4SLinus Torvalds 1611da177e4SLinus Torvalds case AF_INET6: 162dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 1631da177e4SLinus Torvalds break; 1641da177e4SLinus Torvalds #else 1651da177e4SLinus Torvalds err = -EAFNOSUPPORT; 1661da177e4SLinus Torvalds goto out; 1671da177e4SLinus Torvalds #endif 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds default: 1701da177e4SLinus Torvalds goto out; 1713ff50b79SStephen Hemminger } 1721da177e4SLinus Torvalds 1731da177e4SLinus Torvalds err = -EINVAL; 1741da177e4SLinus Torvalds switch (p->id.proto) { 1751da177e4SLinus Torvalds case IPPROTO_AH: 1764447bb33SMartin Willi if ((!attrs[XFRMA_ALG_AUTH] && 1774447bb33SMartin Willi !attrs[XFRMA_ALG_AUTH_TRUNC]) || 1781a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 17935a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] || 18035d2856bSMartin Willi attrs[XFRMA_ALG_COMP] || 181a0e5ef53STobias Brunner attrs[XFRMA_TFCPAD]) 1821da177e4SLinus Torvalds goto out; 1831da177e4SLinus Torvalds break; 1841da177e4SLinus Torvalds 1851da177e4SLinus Torvalds case IPPROTO_ESP: 1861a6509d9SHerbert Xu if (attrs[XFRMA_ALG_COMP]) 1871a6509d9SHerbert Xu goto out; 1881a6509d9SHerbert Xu if (!attrs[XFRMA_ALG_AUTH] && 1894447bb33SMartin Willi !attrs[XFRMA_ALG_AUTH_TRUNC] && 1901a6509d9SHerbert Xu !attrs[XFRMA_ALG_CRYPT] && 1911a6509d9SHerbert Xu !attrs[XFRMA_ALG_AEAD]) 1921a6509d9SHerbert Xu goto out; 1931a6509d9SHerbert Xu if ((attrs[XFRMA_ALG_AUTH] || 1944447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] || 1951a6509d9SHerbert Xu attrs[XFRMA_ALG_CRYPT]) && 1961a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD]) 1971da177e4SLinus Torvalds goto out; 19835d2856bSMartin Willi if (attrs[XFRMA_TFCPAD] && 19935d2856bSMartin Willi p->mode != XFRM_MODE_TUNNEL) 20035d2856bSMartin Willi goto out; 2011da177e4SLinus Torvalds break; 2021da177e4SLinus Torvalds 2031da177e4SLinus Torvalds case IPPROTO_COMP: 20435a7aa08SThomas Graf if (!attrs[XFRMA_ALG_COMP] || 2051a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 20635a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] || 2074447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] || 20835d2856bSMartin Willi attrs[XFRMA_ALG_CRYPT] || 209a0e5ef53STobias Brunner attrs[XFRMA_TFCPAD] || 210a0e5ef53STobias Brunner (ntohl(p->id.spi) >= 0x10000)) 2111da177e4SLinus Torvalds goto out; 2121da177e4SLinus Torvalds break; 2131da177e4SLinus Torvalds 214dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 215e23c7194SMasahide NAKAMURA case IPPROTO_DSTOPTS: 216e23c7194SMasahide NAKAMURA case IPPROTO_ROUTING: 21735a7aa08SThomas Graf if (attrs[XFRMA_ALG_COMP] || 21835a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH] || 2194447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC] || 2201a6509d9SHerbert Xu attrs[XFRMA_ALG_AEAD] || 22135a7aa08SThomas Graf attrs[XFRMA_ALG_CRYPT] || 22235a7aa08SThomas Graf attrs[XFRMA_ENCAP] || 22335a7aa08SThomas Graf attrs[XFRMA_SEC_CTX] || 22435d2856bSMartin Willi attrs[XFRMA_TFCPAD] || 22535a7aa08SThomas Graf !attrs[XFRMA_COADDR]) 226e23c7194SMasahide NAKAMURA goto out; 227e23c7194SMasahide NAKAMURA break; 228e23c7194SMasahide NAKAMURA #endif 229e23c7194SMasahide NAKAMURA 2301da177e4SLinus Torvalds default: 2311da177e4SLinus Torvalds goto out; 2323ff50b79SStephen Hemminger } 2331da177e4SLinus Torvalds 2341a6509d9SHerbert Xu if ((err = verify_aead(attrs))) 2351a6509d9SHerbert Xu goto out; 2364447bb33SMartin Willi if ((err = verify_auth_trunc(attrs))) 2374447bb33SMartin Willi goto out; 23835a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH))) 2391da177e4SLinus Torvalds goto out; 24035a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT))) 2411da177e4SLinus Torvalds goto out; 24235a7aa08SThomas Graf if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP))) 2431da177e4SLinus Torvalds goto out; 24435a7aa08SThomas Graf if ((err = verify_sec_ctx_len(attrs))) 245df71837dSTrent Jaeger goto out; 246d8647b79SSteffen Klassert if ((err = verify_replay(p, attrs))) 247d8647b79SSteffen Klassert goto out; 2481da177e4SLinus Torvalds 2491da177e4SLinus Torvalds err = -EINVAL; 2501da177e4SLinus Torvalds switch (p->mode) { 2517e49e6deSMasahide NAKAMURA case XFRM_MODE_TRANSPORT: 2527e49e6deSMasahide NAKAMURA case XFRM_MODE_TUNNEL: 253060f02a3SNoriaki TAKAMIYA case XFRM_MODE_ROUTEOPTIMIZATION: 2540a69452cSDiego Beltrami case XFRM_MODE_BEET: 2551da177e4SLinus Torvalds break; 2561da177e4SLinus Torvalds 2571da177e4SLinus Torvalds default: 2581da177e4SLinus Torvalds goto out; 2593ff50b79SStephen Hemminger } 2601da177e4SLinus Torvalds 2611da177e4SLinus Torvalds err = 0; 2621da177e4SLinus Torvalds 2631da177e4SLinus Torvalds out: 2641da177e4SLinus Torvalds return err; 2651da177e4SLinus Torvalds } 2661da177e4SLinus Torvalds 2671da177e4SLinus Torvalds static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 2686f2f19edSDavid S. Miller struct xfrm_algo_desc *(*get_byname)(const char *, int), 2695424f32eSThomas Graf struct nlattr *rta) 2701da177e4SLinus Torvalds { 2711da177e4SLinus Torvalds struct xfrm_algo *p, *ualg; 2721da177e4SLinus Torvalds struct xfrm_algo_desc *algo; 2731da177e4SLinus Torvalds 2741da177e4SLinus Torvalds if (!rta) 2751da177e4SLinus Torvalds return 0; 2761da177e4SLinus Torvalds 2775424f32eSThomas Graf ualg = nla_data(rta); 2781da177e4SLinus Torvalds 2791da177e4SLinus Torvalds algo = get_byname(ualg->alg_name, 1); 2801da177e4SLinus Torvalds if (!algo) 2811da177e4SLinus Torvalds return -ENOSYS; 2821da177e4SLinus Torvalds *props = algo->desc.sadb_alg_id; 2831da177e4SLinus Torvalds 2840f99be0dSEric Dumazet p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 2851da177e4SLinus Torvalds if (!p) 2861da177e4SLinus Torvalds return -ENOMEM; 2871da177e4SLinus Torvalds 28804ff1260SHerbert Xu strcpy(p->alg_name, algo->name); 2891da177e4SLinus Torvalds *algpp = p; 2901da177e4SLinus Torvalds return 0; 2911da177e4SLinus Torvalds } 2921da177e4SLinus Torvalds 29369b0137fSHerbert Xu static int attach_crypt(struct xfrm_state *x, struct nlattr *rta) 29469b0137fSHerbert Xu { 29569b0137fSHerbert Xu struct xfrm_algo *p, *ualg; 29669b0137fSHerbert Xu struct xfrm_algo_desc *algo; 29769b0137fSHerbert Xu 29869b0137fSHerbert Xu if (!rta) 29969b0137fSHerbert Xu return 0; 30069b0137fSHerbert Xu 30169b0137fSHerbert Xu ualg = nla_data(rta); 30269b0137fSHerbert Xu 30369b0137fSHerbert Xu algo = xfrm_ealg_get_byname(ualg->alg_name, 1); 30469b0137fSHerbert Xu if (!algo) 30569b0137fSHerbert Xu return -ENOSYS; 30669b0137fSHerbert Xu x->props.ealgo = algo->desc.sadb_alg_id; 30769b0137fSHerbert Xu 30869b0137fSHerbert Xu p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 30969b0137fSHerbert Xu if (!p) 31069b0137fSHerbert Xu return -ENOMEM; 31169b0137fSHerbert Xu 31269b0137fSHerbert Xu strcpy(p->alg_name, algo->name); 31369b0137fSHerbert Xu x->ealg = p; 31469b0137fSHerbert Xu x->geniv = algo->uinfo.encr.geniv; 31569b0137fSHerbert Xu return 0; 31669b0137fSHerbert Xu } 31769b0137fSHerbert Xu 3184447bb33SMartin Willi static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props, 3194447bb33SMartin Willi struct nlattr *rta) 3204447bb33SMartin Willi { 3214447bb33SMartin Willi struct xfrm_algo *ualg; 3224447bb33SMartin Willi struct xfrm_algo_auth *p; 3234447bb33SMartin Willi struct xfrm_algo_desc *algo; 3244447bb33SMartin Willi 3254447bb33SMartin Willi if (!rta) 3264447bb33SMartin Willi return 0; 3274447bb33SMartin Willi 3284447bb33SMartin Willi ualg = nla_data(rta); 3294447bb33SMartin Willi 3304447bb33SMartin Willi algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 3314447bb33SMartin Willi if (!algo) 3324447bb33SMartin Willi return -ENOSYS; 3334447bb33SMartin Willi *props = algo->desc.sadb_alg_id; 3344447bb33SMartin Willi 3354447bb33SMartin Willi p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL); 3364447bb33SMartin Willi if (!p) 3374447bb33SMartin Willi return -ENOMEM; 3384447bb33SMartin Willi 3394447bb33SMartin Willi strcpy(p->alg_name, algo->name); 3404447bb33SMartin Willi p->alg_key_len = ualg->alg_key_len; 3414447bb33SMartin Willi p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 3424447bb33SMartin Willi memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8); 3434447bb33SMartin Willi 3444447bb33SMartin Willi *algpp = p; 3454447bb33SMartin Willi return 0; 3464447bb33SMartin Willi } 3474447bb33SMartin Willi 3484447bb33SMartin Willi static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props, 3494447bb33SMartin Willi struct nlattr *rta) 3504447bb33SMartin Willi { 3514447bb33SMartin Willi struct xfrm_algo_auth *p, *ualg; 3524447bb33SMartin Willi struct xfrm_algo_desc *algo; 3534447bb33SMartin Willi 3544447bb33SMartin Willi if (!rta) 3554447bb33SMartin Willi return 0; 3564447bb33SMartin Willi 3574447bb33SMartin Willi ualg = nla_data(rta); 3584447bb33SMartin Willi 3594447bb33SMartin Willi algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 3604447bb33SMartin Willi if (!algo) 3614447bb33SMartin Willi return -ENOSYS; 362689f1c9dSHerbert Xu if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) 3634447bb33SMartin Willi return -EINVAL; 3644447bb33SMartin Willi *props = algo->desc.sadb_alg_id; 3654447bb33SMartin Willi 3664447bb33SMartin Willi p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL); 3674447bb33SMartin Willi if (!p) 3684447bb33SMartin Willi return -ENOMEM; 3694447bb33SMartin Willi 3704447bb33SMartin Willi strcpy(p->alg_name, algo->name); 3714447bb33SMartin Willi if (!p->alg_trunc_len) 3724447bb33SMartin Willi p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 3734447bb33SMartin Willi 3744447bb33SMartin Willi *algpp = p; 3754447bb33SMartin Willi return 0; 3764447bb33SMartin Willi } 3774447bb33SMartin Willi 37869b0137fSHerbert Xu static int attach_aead(struct xfrm_state *x, struct nlattr *rta) 3791a6509d9SHerbert Xu { 3801a6509d9SHerbert Xu struct xfrm_algo_aead *p, *ualg; 3811a6509d9SHerbert Xu struct xfrm_algo_desc *algo; 3821a6509d9SHerbert Xu 3831a6509d9SHerbert Xu if (!rta) 3841a6509d9SHerbert Xu return 0; 3851a6509d9SHerbert Xu 3861a6509d9SHerbert Xu ualg = nla_data(rta); 3871a6509d9SHerbert Xu 3881a6509d9SHerbert Xu algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1); 3891a6509d9SHerbert Xu if (!algo) 3901a6509d9SHerbert Xu return -ENOSYS; 39169b0137fSHerbert Xu x->props.ealgo = algo->desc.sadb_alg_id; 3921a6509d9SHerbert Xu 3931a6509d9SHerbert Xu p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL); 3941a6509d9SHerbert Xu if (!p) 3951a6509d9SHerbert Xu return -ENOMEM; 3961a6509d9SHerbert Xu 3971a6509d9SHerbert Xu strcpy(p->alg_name, algo->name); 39869b0137fSHerbert Xu x->aead = p; 39969b0137fSHerbert Xu x->geniv = algo->uinfo.aead.geniv; 4001a6509d9SHerbert Xu return 0; 4011a6509d9SHerbert Xu } 4021a6509d9SHerbert Xu 403e2b19125SSteffen Klassert static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn, 404e2b19125SSteffen Klassert struct nlattr *rp) 405e2b19125SSteffen Klassert { 406e2b19125SSteffen Klassert struct xfrm_replay_state_esn *up; 407ecd79187SMathias Krause int ulen; 408e2b19125SSteffen Klassert 409e2b19125SSteffen Klassert if (!replay_esn || !rp) 410e2b19125SSteffen Klassert return 0; 411e2b19125SSteffen Klassert 412e2b19125SSteffen Klassert up = nla_data(rp); 413ecd79187SMathias Krause ulen = xfrm_replay_state_esn_len(up); 414e2b19125SSteffen Klassert 415ecd79187SMathias Krause if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) 416e2b19125SSteffen Klassert return -EINVAL; 417e2b19125SSteffen Klassert 418e2b19125SSteffen Klassert return 0; 419e2b19125SSteffen Klassert } 420e2b19125SSteffen Klassert 421d8647b79SSteffen Klassert static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn, 422d8647b79SSteffen Klassert struct xfrm_replay_state_esn **preplay_esn, 423d8647b79SSteffen Klassert struct nlattr *rta) 424d8647b79SSteffen Klassert { 425d8647b79SSteffen Klassert struct xfrm_replay_state_esn *p, *pp, *up; 426ecd79187SMathias Krause int klen, ulen; 427d8647b79SSteffen Klassert 428d8647b79SSteffen Klassert if (!rta) 429d8647b79SSteffen Klassert return 0; 430d8647b79SSteffen Klassert 431d8647b79SSteffen Klassert up = nla_data(rta); 432ecd79187SMathias Krause klen = xfrm_replay_state_esn_len(up); 433ecd79187SMathias Krause ulen = nla_len(rta) >= klen ? klen : sizeof(*up); 434d8647b79SSteffen Klassert 435ecd79187SMathias Krause p = kzalloc(klen, GFP_KERNEL); 436d8647b79SSteffen Klassert if (!p) 437d8647b79SSteffen Klassert return -ENOMEM; 438d8647b79SSteffen Klassert 439ecd79187SMathias Krause pp = kzalloc(klen, GFP_KERNEL); 440d8647b79SSteffen Klassert if (!pp) { 441d8647b79SSteffen Klassert kfree(p); 442d8647b79SSteffen Klassert return -ENOMEM; 443d8647b79SSteffen Klassert } 444d8647b79SSteffen Klassert 445ecd79187SMathias Krause memcpy(p, up, ulen); 446ecd79187SMathias Krause memcpy(pp, up, ulen); 447ecd79187SMathias Krause 448d8647b79SSteffen Klassert *replay_esn = p; 449d8647b79SSteffen Klassert *preplay_esn = pp; 450d8647b79SSteffen Klassert 451d8647b79SSteffen Klassert return 0; 452d8647b79SSteffen Klassert } 453d8647b79SSteffen Klassert 454661697f7SJoy Latten static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx) 455df71837dSTrent Jaeger { 456df71837dSTrent Jaeger int len = 0; 457df71837dSTrent Jaeger 458df71837dSTrent Jaeger if (xfrm_ctx) { 459df71837dSTrent Jaeger len += sizeof(struct xfrm_user_sec_ctx); 460df71837dSTrent Jaeger len += xfrm_ctx->ctx_len; 461df71837dSTrent Jaeger } 462df71837dSTrent Jaeger return len; 463df71837dSTrent Jaeger } 464df71837dSTrent Jaeger 4651da177e4SLinus Torvalds static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 4661da177e4SLinus Torvalds { 4671da177e4SLinus Torvalds memcpy(&x->id, &p->id, sizeof(x->id)); 4681da177e4SLinus Torvalds memcpy(&x->sel, &p->sel, sizeof(x->sel)); 4691da177e4SLinus Torvalds memcpy(&x->lft, &p->lft, sizeof(x->lft)); 4701da177e4SLinus Torvalds x->props.mode = p->mode; 47133fce60dSFan Du x->props.replay_window = min_t(unsigned int, p->replay_window, 47233fce60dSFan Du sizeof(x->replay.bitmap) * 8); 4731da177e4SLinus Torvalds x->props.reqid = p->reqid; 4741da177e4SLinus Torvalds x->props.family = p->family; 47554489c14SDavid S. Miller memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr)); 4761da177e4SLinus Torvalds x->props.flags = p->flags; 477196b0036SHerbert Xu 478ccf9b3b8SSteffen Klassert if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC)) 479196b0036SHerbert Xu x->sel.family = p->family; 4801da177e4SLinus Torvalds } 4811da177e4SLinus Torvalds 482d51d081dSJamal Hadi Salim /* 483d51d081dSJamal Hadi Salim * someday when pfkey also has support, we could have the code 484d51d081dSJamal Hadi Salim * somehow made shareable and move it to xfrm_state.c - JHS 485d51d081dSJamal Hadi Salim * 486d51d081dSJamal Hadi Salim */ 487e3ac104dSMathias Krause static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, 488e3ac104dSMathias Krause int update_esn) 489d51d081dSJamal Hadi Salim { 4905424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 491e3ac104dSMathias Krause struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL; 4925424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 4935424f32eSThomas Graf struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 4945424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 495d51d081dSJamal Hadi Salim 496d8647b79SSteffen Klassert if (re) { 497d8647b79SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 498d8647b79SSteffen Klassert replay_esn = nla_data(re); 499d8647b79SSteffen Klassert memcpy(x->replay_esn, replay_esn, 500d8647b79SSteffen Klassert xfrm_replay_state_esn_len(replay_esn)); 501d8647b79SSteffen Klassert memcpy(x->preplay_esn, replay_esn, 502d8647b79SSteffen Klassert xfrm_replay_state_esn_len(replay_esn)); 503d8647b79SSteffen Klassert } 504d8647b79SSteffen Klassert 505d51d081dSJamal Hadi Salim if (rp) { 506d51d081dSJamal Hadi Salim struct xfrm_replay_state *replay; 5075424f32eSThomas Graf replay = nla_data(rp); 508d51d081dSJamal Hadi Salim memcpy(&x->replay, replay, sizeof(*replay)); 509d51d081dSJamal Hadi Salim memcpy(&x->preplay, replay, sizeof(*replay)); 510d51d081dSJamal Hadi Salim } 511d51d081dSJamal Hadi Salim 512d51d081dSJamal Hadi Salim if (lt) { 513d51d081dSJamal Hadi Salim struct xfrm_lifetime_cur *ltime; 5145424f32eSThomas Graf ltime = nla_data(lt); 515d51d081dSJamal Hadi Salim x->curlft.bytes = ltime->bytes; 516d51d081dSJamal Hadi Salim x->curlft.packets = ltime->packets; 517d51d081dSJamal Hadi Salim x->curlft.add_time = ltime->add_time; 518d51d081dSJamal Hadi Salim x->curlft.use_time = ltime->use_time; 519d51d081dSJamal Hadi Salim } 520d51d081dSJamal Hadi Salim 521cf5cb79fSThomas Graf if (et) 5225424f32eSThomas Graf x->replay_maxage = nla_get_u32(et); 523d51d081dSJamal Hadi Salim 524cf5cb79fSThomas Graf if (rt) 5255424f32eSThomas Graf x->replay_maxdiff = nla_get_u32(rt); 526d51d081dSJamal Hadi Salim } 527d51d081dSJamal Hadi Salim 528fc34acd3SAlexey Dobriyan static struct xfrm_state *xfrm_state_construct(struct net *net, 529fc34acd3SAlexey Dobriyan struct xfrm_usersa_info *p, 5305424f32eSThomas Graf struct nlattr **attrs, 5311da177e4SLinus Torvalds int *errp) 5321da177e4SLinus Torvalds { 533fc34acd3SAlexey Dobriyan struct xfrm_state *x = xfrm_state_alloc(net); 5341da177e4SLinus Torvalds int err = -ENOMEM; 5351da177e4SLinus Torvalds 5361da177e4SLinus Torvalds if (!x) 5371da177e4SLinus Torvalds goto error_no_put; 5381da177e4SLinus Torvalds 5391da177e4SLinus Torvalds copy_from_user_state(x, p); 5401da177e4SLinus Torvalds 541a947b0a9SNicolas Dichtel if (attrs[XFRMA_SA_EXTRA_FLAGS]) 542a947b0a9SNicolas Dichtel x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); 543a947b0a9SNicolas Dichtel 54469b0137fSHerbert Xu if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD]))) 5451a6509d9SHerbert Xu goto error; 5464447bb33SMartin Willi if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo, 5474447bb33SMartin Willi attrs[XFRMA_ALG_AUTH_TRUNC]))) 5484447bb33SMartin Willi goto error; 5494447bb33SMartin Willi if (!x->props.aalgo) { 5504447bb33SMartin Willi if ((err = attach_auth(&x->aalg, &x->props.aalgo, 55135a7aa08SThomas Graf attrs[XFRMA_ALG_AUTH]))) 5521da177e4SLinus Torvalds goto error; 5534447bb33SMartin Willi } 55469b0137fSHerbert Xu if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT]))) 5551da177e4SLinus Torvalds goto error; 5561da177e4SLinus Torvalds if ((err = attach_one_algo(&x->calg, &x->props.calgo, 5571da177e4SLinus Torvalds xfrm_calg_get_byname, 55835a7aa08SThomas Graf attrs[XFRMA_ALG_COMP]))) 5591da177e4SLinus Torvalds goto error; 560fd21150aSThomas Graf 561fd21150aSThomas Graf if (attrs[XFRMA_ENCAP]) { 562fd21150aSThomas Graf x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 563fd21150aSThomas Graf sizeof(*x->encap), GFP_KERNEL); 564fd21150aSThomas Graf if (x->encap == NULL) 5651da177e4SLinus Torvalds goto error; 566fd21150aSThomas Graf } 567fd21150aSThomas Graf 56835d2856bSMartin Willi if (attrs[XFRMA_TFCPAD]) 56935d2856bSMartin Willi x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]); 57035d2856bSMartin Willi 571fd21150aSThomas Graf if (attrs[XFRMA_COADDR]) { 572fd21150aSThomas Graf x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), 573fd21150aSThomas Graf sizeof(*x->coaddr), GFP_KERNEL); 574fd21150aSThomas Graf if (x->coaddr == NULL) 575060f02a3SNoriaki TAKAMIYA goto error; 576fd21150aSThomas Graf } 577fd21150aSThomas Graf 5786f26b61eSJamal Hadi Salim xfrm_mark_get(attrs, &x->mark); 5796f26b61eSJamal Hadi Salim 580a454f0ccSWei Yongjun err = __xfrm_init_state(x, false); 5811da177e4SLinus Torvalds if (err) 5821da177e4SLinus Torvalds goto error; 5831da177e4SLinus Torvalds 584fd21150aSThomas Graf if (attrs[XFRMA_SEC_CTX] && 585fd21150aSThomas Graf security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX]))) 586df71837dSTrent Jaeger goto error; 587df71837dSTrent Jaeger 588d8647b79SSteffen Klassert if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn, 589d8647b79SSteffen Klassert attrs[XFRMA_REPLAY_ESN_VAL]))) 590d8647b79SSteffen Klassert goto error; 591d8647b79SSteffen Klassert 5921da177e4SLinus Torvalds x->km.seq = p->seq; 593b27aeadbSAlexey Dobriyan x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth; 594d51d081dSJamal Hadi Salim /* sysctl_xfrm_aevent_etime is in 100ms units */ 595b27aeadbSAlexey Dobriyan x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M; 596d51d081dSJamal Hadi Salim 5979fdc4883SSteffen Klassert if ((err = xfrm_init_replay(x))) 5989fdc4883SSteffen Klassert goto error; 599d51d081dSJamal Hadi Salim 6009fdc4883SSteffen Klassert /* override default values from above */ 601e3ac104dSMathias Krause xfrm_update_ae_params(x, attrs, 0); 6021da177e4SLinus Torvalds 6031da177e4SLinus Torvalds return x; 6041da177e4SLinus Torvalds 6051da177e4SLinus Torvalds error: 6061da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD; 6071da177e4SLinus Torvalds xfrm_state_put(x); 6081da177e4SLinus Torvalds error_no_put: 6091da177e4SLinus Torvalds *errp = err; 6101da177e4SLinus Torvalds return NULL; 6111da177e4SLinus Torvalds } 6121da177e4SLinus Torvalds 61322e70050SChristoph Hellwig static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 6145424f32eSThomas Graf struct nlattr **attrs) 6151da177e4SLinus Torvalds { 616fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 6177b67c857SThomas Graf struct xfrm_usersa_info *p = nlmsg_data(nlh); 6181da177e4SLinus Torvalds struct xfrm_state *x; 6191da177e4SLinus Torvalds int err; 62026b15dadSJamal Hadi Salim struct km_event c; 6211da177e4SLinus Torvalds 62235a7aa08SThomas Graf err = verify_newsa_info(p, attrs); 6231da177e4SLinus Torvalds if (err) 6241da177e4SLinus Torvalds return err; 6251da177e4SLinus Torvalds 626fc34acd3SAlexey Dobriyan x = xfrm_state_construct(net, p, attrs, &err); 6271da177e4SLinus Torvalds if (!x) 6281da177e4SLinus Torvalds return err; 6291da177e4SLinus Torvalds 63026b15dadSJamal Hadi Salim xfrm_state_hold(x); 6311da177e4SLinus Torvalds if (nlh->nlmsg_type == XFRM_MSG_NEWSA) 6321da177e4SLinus Torvalds err = xfrm_state_add(x); 6331da177e4SLinus Torvalds else 6341da177e4SLinus Torvalds err = xfrm_state_update(x); 6351da177e4SLinus Torvalds 6362e71029eSTetsuo Handa xfrm_audit_state_add(x, err ? 0 : 1, true); 637161a09e7SJoy Latten 6381da177e4SLinus Torvalds if (err < 0) { 6391da177e4SLinus Torvalds x->km.state = XFRM_STATE_DEAD; 64021380b81SHerbert Xu __xfrm_state_put(x); 6417d6dfe1fSPatrick McHardy goto out; 6421da177e4SLinus Torvalds } 6431da177e4SLinus Torvalds 64426b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 64515e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 646f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 64726b15dadSJamal Hadi Salim 64826b15dadSJamal Hadi Salim km_state_notify(x, &c); 6497d6dfe1fSPatrick McHardy out: 65026b15dadSJamal Hadi Salim xfrm_state_put(x); 6511da177e4SLinus Torvalds return err; 6521da177e4SLinus Torvalds } 6531da177e4SLinus Torvalds 654fc34acd3SAlexey Dobriyan static struct xfrm_state *xfrm_user_state_lookup(struct net *net, 655fc34acd3SAlexey Dobriyan struct xfrm_usersa_id *p, 6565424f32eSThomas Graf struct nlattr **attrs, 657eb2971b6SMasahide NAKAMURA int *errp) 658eb2971b6SMasahide NAKAMURA { 659eb2971b6SMasahide NAKAMURA struct xfrm_state *x = NULL; 6606f26b61eSJamal Hadi Salim struct xfrm_mark m; 661eb2971b6SMasahide NAKAMURA int err; 6626f26b61eSJamal Hadi Salim u32 mark = xfrm_mark_get(attrs, &m); 663eb2971b6SMasahide NAKAMURA 664eb2971b6SMasahide NAKAMURA if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) { 665eb2971b6SMasahide NAKAMURA err = -ESRCH; 6666f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family); 667eb2971b6SMasahide NAKAMURA } else { 668eb2971b6SMasahide NAKAMURA xfrm_address_t *saddr = NULL; 669eb2971b6SMasahide NAKAMURA 67035a7aa08SThomas Graf verify_one_addr(attrs, XFRMA_SRCADDR, &saddr); 671eb2971b6SMasahide NAKAMURA if (!saddr) { 672eb2971b6SMasahide NAKAMURA err = -EINVAL; 673eb2971b6SMasahide NAKAMURA goto out; 674eb2971b6SMasahide NAKAMURA } 675eb2971b6SMasahide NAKAMURA 6769abbffeeSMasahide NAKAMURA err = -ESRCH; 6776f26b61eSJamal Hadi Salim x = xfrm_state_lookup_byaddr(net, mark, 6786f26b61eSJamal Hadi Salim &p->daddr, saddr, 679221df1edSAlexey Dobriyan p->proto, p->family); 680eb2971b6SMasahide NAKAMURA } 681eb2971b6SMasahide NAKAMURA 682eb2971b6SMasahide NAKAMURA out: 683eb2971b6SMasahide NAKAMURA if (!x && errp) 684eb2971b6SMasahide NAKAMURA *errp = err; 685eb2971b6SMasahide NAKAMURA return x; 686eb2971b6SMasahide NAKAMURA } 687eb2971b6SMasahide NAKAMURA 68822e70050SChristoph Hellwig static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 6895424f32eSThomas Graf struct nlattr **attrs) 6901da177e4SLinus Torvalds { 691fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 6921da177e4SLinus Torvalds struct xfrm_state *x; 693eb2971b6SMasahide NAKAMURA int err = -ESRCH; 69426b15dadSJamal Hadi Salim struct km_event c; 6957b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh); 6961da177e4SLinus Torvalds 697fc34acd3SAlexey Dobriyan x = xfrm_user_state_lookup(net, p, attrs, &err); 6981da177e4SLinus Torvalds if (x == NULL) 699eb2971b6SMasahide NAKAMURA return err; 7001da177e4SLinus Torvalds 7016f68dc37SDavid S. Miller if ((err = security_xfrm_state_delete(x)) != 0) 702c8c05a8eSCatherine Zhang goto out; 703c8c05a8eSCatherine Zhang 7041da177e4SLinus Torvalds if (xfrm_state_kern(x)) { 705c8c05a8eSCatherine Zhang err = -EPERM; 706c8c05a8eSCatherine Zhang goto out; 7071da177e4SLinus Torvalds } 7081da177e4SLinus Torvalds 70926b15dadSJamal Hadi Salim err = xfrm_state_delete(x); 710161a09e7SJoy Latten 711c8c05a8eSCatherine Zhang if (err < 0) 712c8c05a8eSCatherine Zhang goto out; 71326b15dadSJamal Hadi Salim 71426b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 71515e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 716f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 71726b15dadSJamal Hadi Salim km_state_notify(x, &c); 7181da177e4SLinus Torvalds 719c8c05a8eSCatherine Zhang out: 7202e71029eSTetsuo Handa xfrm_audit_state_delete(x, err ? 0 : 1, true); 721c8c05a8eSCatherine Zhang xfrm_state_put(x); 72226b15dadSJamal Hadi Salim return err; 7231da177e4SLinus Torvalds } 7241da177e4SLinus Torvalds 7251da177e4SLinus Torvalds static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 7261da177e4SLinus Torvalds { 727f778a636SMathias Krause memset(p, 0, sizeof(*p)); 7281da177e4SLinus Torvalds memcpy(&p->id, &x->id, sizeof(p->id)); 7291da177e4SLinus Torvalds memcpy(&p->sel, &x->sel, sizeof(p->sel)); 7301da177e4SLinus Torvalds memcpy(&p->lft, &x->lft, sizeof(p->lft)); 7311da177e4SLinus Torvalds memcpy(&p->curlft, &x->curlft, sizeof(p->curlft)); 732*e33d4f13SSowmini Varadhan put_unaligned(x->stats.replay_window, &p->stats.replay_window); 733*e33d4f13SSowmini Varadhan put_unaligned(x->stats.replay, &p->stats.replay); 734*e33d4f13SSowmini Varadhan put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed); 73554489c14SDavid S. Miller memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr)); 7361da177e4SLinus Torvalds p->mode = x->props.mode; 7371da177e4SLinus Torvalds p->replay_window = x->props.replay_window; 7381da177e4SLinus Torvalds p->reqid = x->props.reqid; 7391da177e4SLinus Torvalds p->family = x->props.family; 7401da177e4SLinus Torvalds p->flags = x->props.flags; 7411da177e4SLinus Torvalds p->seq = x->km.seq; 7421da177e4SLinus Torvalds } 7431da177e4SLinus Torvalds 7441da177e4SLinus Torvalds struct xfrm_dump_info { 7451da177e4SLinus Torvalds struct sk_buff *in_skb; 7461da177e4SLinus Torvalds struct sk_buff *out_skb; 7471da177e4SLinus Torvalds u32 nlmsg_seq; 7481da177e4SLinus Torvalds u16 nlmsg_flags; 7491da177e4SLinus Torvalds }; 7501da177e4SLinus Torvalds 751c0144beaSThomas Graf static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb) 752c0144beaSThomas Graf { 753c0144beaSThomas Graf struct xfrm_user_sec_ctx *uctx; 754c0144beaSThomas Graf struct nlattr *attr; 75568325d3bSHerbert Xu int ctx_size = sizeof(*uctx) + s->ctx_len; 756c0144beaSThomas Graf 757c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size); 758c0144beaSThomas Graf if (attr == NULL) 759c0144beaSThomas Graf return -EMSGSIZE; 760c0144beaSThomas Graf 761c0144beaSThomas Graf uctx = nla_data(attr); 762c0144beaSThomas Graf uctx->exttype = XFRMA_SEC_CTX; 763c0144beaSThomas Graf uctx->len = ctx_size; 764c0144beaSThomas Graf uctx->ctx_doi = s->ctx_doi; 765c0144beaSThomas Graf uctx->ctx_alg = s->ctx_alg; 766c0144beaSThomas Graf uctx->ctx_len = s->ctx_len; 767c0144beaSThomas Graf memcpy(uctx + 1, s->ctx_str, s->ctx_len); 768c0144beaSThomas Graf 769c0144beaSThomas Graf return 0; 770c0144beaSThomas Graf } 771c0144beaSThomas Graf 7724447bb33SMartin Willi static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb) 7734447bb33SMartin Willi { 7744447bb33SMartin Willi struct xfrm_algo *algo; 7754447bb33SMartin Willi struct nlattr *nla; 7764447bb33SMartin Willi 7774447bb33SMartin Willi nla = nla_reserve(skb, XFRMA_ALG_AUTH, 7784447bb33SMartin Willi sizeof(*algo) + (auth->alg_key_len + 7) / 8); 7794447bb33SMartin Willi if (!nla) 7804447bb33SMartin Willi return -EMSGSIZE; 7814447bb33SMartin Willi 7824447bb33SMartin Willi algo = nla_data(nla); 7834c87308bSMathias Krause strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name)); 7844447bb33SMartin Willi memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8); 7854447bb33SMartin Willi algo->alg_key_len = auth->alg_key_len; 7864447bb33SMartin Willi 7874447bb33SMartin Willi return 0; 7884447bb33SMartin Willi } 7894447bb33SMartin Willi 79068325d3bSHerbert Xu /* Don't change this without updating xfrm_sa_len! */ 79168325d3bSHerbert Xu static int copy_to_user_state_extra(struct xfrm_state *x, 79268325d3bSHerbert Xu struct xfrm_usersa_info *p, 79368325d3bSHerbert Xu struct sk_buff *skb) 7941da177e4SLinus Torvalds { 7951d1e34ddSDavid S. Miller int ret = 0; 7961d1e34ddSDavid S. Miller 7971da177e4SLinus Torvalds copy_to_user_state(x, p); 7981da177e4SLinus Torvalds 799a947b0a9SNicolas Dichtel if (x->props.extra_flags) { 800a947b0a9SNicolas Dichtel ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS, 801a947b0a9SNicolas Dichtel x->props.extra_flags); 802a947b0a9SNicolas Dichtel if (ret) 803a947b0a9SNicolas Dichtel goto out; 804a947b0a9SNicolas Dichtel } 805a947b0a9SNicolas Dichtel 8061d1e34ddSDavid S. Miller if (x->coaddr) { 8071d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr); 8081d1e34ddSDavid S. Miller if (ret) 8091d1e34ddSDavid S. Miller goto out; 8101d1e34ddSDavid S. Miller } 8111d1e34ddSDavid S. Miller if (x->lastused) { 8121d1e34ddSDavid S. Miller ret = nla_put_u64(skb, XFRMA_LASTUSED, x->lastused); 8131d1e34ddSDavid S. Miller if (ret) 8141d1e34ddSDavid S. Miller goto out; 8151d1e34ddSDavid S. Miller } 8161d1e34ddSDavid S. Miller if (x->aead) { 8171d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead); 8181d1e34ddSDavid S. Miller if (ret) 8191d1e34ddSDavid S. Miller goto out; 8201d1e34ddSDavid S. Miller } 8211d1e34ddSDavid S. Miller if (x->aalg) { 8221d1e34ddSDavid S. Miller ret = copy_to_user_auth(x->aalg, skb); 8231d1e34ddSDavid S. Miller if (!ret) 8241d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_AUTH_TRUNC, 8251d1e34ddSDavid S. Miller xfrm_alg_auth_len(x->aalg), x->aalg); 8261d1e34ddSDavid S. Miller if (ret) 8271d1e34ddSDavid S. Miller goto out; 8281d1e34ddSDavid S. Miller } 8291d1e34ddSDavid S. Miller if (x->ealg) { 8301d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg); 8311d1e34ddSDavid S. Miller if (ret) 8321d1e34ddSDavid S. Miller goto out; 8331d1e34ddSDavid S. Miller } 8341d1e34ddSDavid S. Miller if (x->calg) { 8351d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg); 8361d1e34ddSDavid S. Miller if (ret) 8371d1e34ddSDavid S. Miller goto out; 8381d1e34ddSDavid S. Miller } 8391d1e34ddSDavid S. Miller if (x->encap) { 8401d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); 8411d1e34ddSDavid S. Miller if (ret) 8421d1e34ddSDavid S. Miller goto out; 8431d1e34ddSDavid S. Miller } 8441d1e34ddSDavid S. Miller if (x->tfcpad) { 8451d1e34ddSDavid S. Miller ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad); 8461d1e34ddSDavid S. Miller if (ret) 8471d1e34ddSDavid S. Miller goto out; 8481d1e34ddSDavid S. Miller } 8491d1e34ddSDavid S. Miller ret = xfrm_mark_put(skb, &x->mark); 8501d1e34ddSDavid S. Miller if (ret) 8511d1e34ddSDavid S. Miller goto out; 852f293a5e3Sdingzhi if (x->replay_esn) 8531d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 854d0fde795SDavid S. Miller xfrm_replay_state_esn_len(x->replay_esn), 8551d1e34ddSDavid S. Miller x->replay_esn); 856f293a5e3Sdingzhi else 857f293a5e3Sdingzhi ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 858f293a5e3Sdingzhi &x->replay); 8591d1e34ddSDavid S. Miller if (ret) 8601d1e34ddSDavid S. Miller goto out; 8611d1e34ddSDavid S. Miller if (x->security) 8621d1e34ddSDavid S. Miller ret = copy_sec_ctx(x->security, skb); 8631d1e34ddSDavid S. Miller out: 8641d1e34ddSDavid S. Miller return ret; 86568325d3bSHerbert Xu } 86668325d3bSHerbert Xu 86768325d3bSHerbert Xu static int dump_one_state(struct xfrm_state *x, int count, void *ptr) 86868325d3bSHerbert Xu { 86968325d3bSHerbert Xu struct xfrm_dump_info *sp = ptr; 87068325d3bSHerbert Xu struct sk_buff *in_skb = sp->in_skb; 87168325d3bSHerbert Xu struct sk_buff *skb = sp->out_skb; 87268325d3bSHerbert Xu struct xfrm_usersa_info *p; 87368325d3bSHerbert Xu struct nlmsghdr *nlh; 87468325d3bSHerbert Xu int err; 87568325d3bSHerbert Xu 87615e47304SEric W. Biederman nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 87768325d3bSHerbert Xu XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags); 87868325d3bSHerbert Xu if (nlh == NULL) 87968325d3bSHerbert Xu return -EMSGSIZE; 88068325d3bSHerbert Xu 88168325d3bSHerbert Xu p = nlmsg_data(nlh); 88268325d3bSHerbert Xu 88368325d3bSHerbert Xu err = copy_to_user_state_extra(x, p, skb); 8841d1e34ddSDavid S. Miller if (err) { 8859825069dSThomas Graf nlmsg_cancel(skb, nlh); 88668325d3bSHerbert Xu return err; 8871da177e4SLinus Torvalds } 8881d1e34ddSDavid S. Miller nlmsg_end(skb, nlh); 8891d1e34ddSDavid S. Miller return 0; 8901d1e34ddSDavid S. Miller } 8911da177e4SLinus Torvalds 8924c563f76STimo Teras static int xfrm_dump_sa_done(struct netlink_callback *cb) 8934c563f76STimo Teras { 8944c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 895283bc9f3SFan Du struct sock *sk = cb->skb->sk; 896283bc9f3SFan Du struct net *net = sock_net(sk); 897283bc9f3SFan Du 898283bc9f3SFan Du xfrm_state_walk_done(walk, net); 8994c563f76STimo Teras return 0; 9004c563f76STimo Teras } 9014c563f76STimo Teras 902d3623099SNicolas Dichtel static const struct nla_policy xfrma_policy[XFRMA_MAX+1]; 9031da177e4SLinus Torvalds static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) 9041da177e4SLinus Torvalds { 905fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 9064c563f76STimo Teras struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 9071da177e4SLinus Torvalds struct xfrm_dump_info info; 9081da177e4SLinus Torvalds 9094c563f76STimo Teras BUILD_BUG_ON(sizeof(struct xfrm_state_walk) > 9104c563f76STimo Teras sizeof(cb->args) - sizeof(cb->args[0])); 9114c563f76STimo Teras 9121da177e4SLinus Torvalds info.in_skb = cb->skb; 9131da177e4SLinus Torvalds info.out_skb = skb; 9141da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq; 9151da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI; 9164c563f76STimo Teras 9174c563f76STimo Teras if (!cb->args[0]) { 918d3623099SNicolas Dichtel struct nlattr *attrs[XFRMA_MAX+1]; 919870a2df4SNicolas Dichtel struct xfrm_address_filter *filter = NULL; 920d3623099SNicolas Dichtel u8 proto = 0; 921d3623099SNicolas Dichtel int err; 922d3623099SNicolas Dichtel 9234c563f76STimo Teras cb->args[0] = 1; 924d3623099SNicolas Dichtel 925d3623099SNicolas Dichtel err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX, 926d3623099SNicolas Dichtel xfrma_policy); 927d3623099SNicolas Dichtel if (err < 0) 928d3623099SNicolas Dichtel return err; 929d3623099SNicolas Dichtel 930870a2df4SNicolas Dichtel if (attrs[XFRMA_ADDRESS_FILTER]) { 931df367561SAndrzej Hajda filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), 932df367561SAndrzej Hajda sizeof(*filter), GFP_KERNEL); 933d3623099SNicolas Dichtel if (filter == NULL) 934d3623099SNicolas Dichtel return -ENOMEM; 935d3623099SNicolas Dichtel } 936d3623099SNicolas Dichtel 937d3623099SNicolas Dichtel if (attrs[XFRMA_PROTO]) 938d3623099SNicolas Dichtel proto = nla_get_u8(attrs[XFRMA_PROTO]); 939d3623099SNicolas Dichtel 940d3623099SNicolas Dichtel xfrm_state_walk_init(walk, proto, filter); 9414c563f76STimo Teras } 9424c563f76STimo Teras 943fc34acd3SAlexey Dobriyan (void) xfrm_state_walk(net, walk, dump_one_state, &info); 9441da177e4SLinus Torvalds 9451da177e4SLinus Torvalds return skb->len; 9461da177e4SLinus Torvalds } 9471da177e4SLinus Torvalds 9481da177e4SLinus Torvalds static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, 9491da177e4SLinus Torvalds struct xfrm_state *x, u32 seq) 9501da177e4SLinus Torvalds { 9511da177e4SLinus Torvalds struct xfrm_dump_info info; 9521da177e4SLinus Torvalds struct sk_buff *skb; 953864745d2SMathias Krause int err; 9541da177e4SLinus Torvalds 9557deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 9561da177e4SLinus Torvalds if (!skb) 9571da177e4SLinus Torvalds return ERR_PTR(-ENOMEM); 9581da177e4SLinus Torvalds 9591da177e4SLinus Torvalds info.in_skb = in_skb; 9601da177e4SLinus Torvalds info.out_skb = skb; 9611da177e4SLinus Torvalds info.nlmsg_seq = seq; 9621da177e4SLinus Torvalds info.nlmsg_flags = 0; 9631da177e4SLinus Torvalds 964864745d2SMathias Krause err = dump_one_state(x, 0, &info); 965864745d2SMathias Krause if (err) { 9661da177e4SLinus Torvalds kfree_skb(skb); 967864745d2SMathias Krause return ERR_PTR(err); 9681da177e4SLinus Torvalds } 9691da177e4SLinus Torvalds 9701da177e4SLinus Torvalds return skb; 9711da177e4SLinus Torvalds } 9721da177e4SLinus Torvalds 97321ee543eSMichal Kubecek /* A wrapper for nlmsg_multicast() checking that nlsk is still available. 97421ee543eSMichal Kubecek * Must be called with RCU read lock. 97521ee543eSMichal Kubecek */ 97621ee543eSMichal Kubecek static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb, 97721ee543eSMichal Kubecek u32 pid, unsigned int group) 97821ee543eSMichal Kubecek { 97921ee543eSMichal Kubecek struct sock *nlsk = rcu_dereference(net->xfrm.nlsk); 98021ee543eSMichal Kubecek 98121ee543eSMichal Kubecek if (nlsk) 98221ee543eSMichal Kubecek return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); 98321ee543eSMichal Kubecek else 98421ee543eSMichal Kubecek return -1; 98521ee543eSMichal Kubecek } 98621ee543eSMichal Kubecek 9877deb2264SThomas Graf static inline size_t xfrm_spdinfo_msgsize(void) 9887deb2264SThomas Graf { 9897deb2264SThomas Graf return NLMSG_ALIGN(4) 9907deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_spdinfo)) 991880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhinfo)) 992880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhthresh)) 993880a6fabSChristophe Gouault + nla_total_size(sizeof(struct xfrmu_spdhthresh)); 9947deb2264SThomas Graf } 9957deb2264SThomas Graf 996e071041bSAlexey Dobriyan static int build_spdinfo(struct sk_buff *skb, struct net *net, 99715e47304SEric W. Biederman u32 portid, u32 seq, u32 flags) 998ecfd6b18SJamal Hadi Salim { 9995a6d3416SJamal Hadi Salim struct xfrmk_spdinfo si; 10005a6d3416SJamal Hadi Salim struct xfrmu_spdinfo spc; 10015a6d3416SJamal Hadi Salim struct xfrmu_spdhinfo sph; 1002880a6fabSChristophe Gouault struct xfrmu_spdhthresh spt4, spt6; 1003ecfd6b18SJamal Hadi Salim struct nlmsghdr *nlh; 10041d1e34ddSDavid S. Miller int err; 1005ecfd6b18SJamal Hadi Salim u32 *f; 1006880a6fabSChristophe Gouault unsigned lseq; 1007ecfd6b18SJamal Hadi Salim 100815e47304SEric W. Biederman nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0); 100925985edcSLucas De Marchi if (nlh == NULL) /* shouldn't really happen ... */ 1010ecfd6b18SJamal Hadi Salim return -EMSGSIZE; 1011ecfd6b18SJamal Hadi Salim 1012ecfd6b18SJamal Hadi Salim f = nlmsg_data(nlh); 1013ecfd6b18SJamal Hadi Salim *f = flags; 1014e071041bSAlexey Dobriyan xfrm_spd_getinfo(net, &si); 10155a6d3416SJamal Hadi Salim spc.incnt = si.incnt; 10165a6d3416SJamal Hadi Salim spc.outcnt = si.outcnt; 10175a6d3416SJamal Hadi Salim spc.fwdcnt = si.fwdcnt; 10185a6d3416SJamal Hadi Salim spc.inscnt = si.inscnt; 10195a6d3416SJamal Hadi Salim spc.outscnt = si.outscnt; 10205a6d3416SJamal Hadi Salim spc.fwdscnt = si.fwdscnt; 10215a6d3416SJamal Hadi Salim sph.spdhcnt = si.spdhcnt; 10225a6d3416SJamal Hadi Salim sph.spdhmcnt = si.spdhmcnt; 1023ecfd6b18SJamal Hadi Salim 1024880a6fabSChristophe Gouault do { 1025880a6fabSChristophe Gouault lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock); 1026880a6fabSChristophe Gouault 1027880a6fabSChristophe Gouault spt4.lbits = net->xfrm.policy_hthresh.lbits4; 1028880a6fabSChristophe Gouault spt4.rbits = net->xfrm.policy_hthresh.rbits4; 1029880a6fabSChristophe Gouault spt6.lbits = net->xfrm.policy_hthresh.lbits6; 1030880a6fabSChristophe Gouault spt6.rbits = net->xfrm.policy_hthresh.rbits6; 1031880a6fabSChristophe Gouault } while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq)); 1032880a6fabSChristophe Gouault 10331d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc); 10341d1e34ddSDavid S. Miller if (!err) 10351d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph); 1036880a6fabSChristophe Gouault if (!err) 1037880a6fabSChristophe Gouault err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4); 1038880a6fabSChristophe Gouault if (!err) 1039880a6fabSChristophe Gouault err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6); 10401d1e34ddSDavid S. Miller if (err) { 10411d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 10421d1e34ddSDavid S. Miller return err; 10431d1e34ddSDavid S. Miller } 1044ecfd6b18SJamal Hadi Salim 1045053c095aSJohannes Berg nlmsg_end(skb, nlh); 1046053c095aSJohannes Berg return 0; 1047ecfd6b18SJamal Hadi Salim } 1048ecfd6b18SJamal Hadi Salim 1049880a6fabSChristophe Gouault static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1050880a6fabSChristophe Gouault struct nlattr **attrs) 1051880a6fabSChristophe Gouault { 1052880a6fabSChristophe Gouault struct net *net = sock_net(skb->sk); 1053880a6fabSChristophe Gouault struct xfrmu_spdhthresh *thresh4 = NULL; 1054880a6fabSChristophe Gouault struct xfrmu_spdhthresh *thresh6 = NULL; 1055880a6fabSChristophe Gouault 1056880a6fabSChristophe Gouault /* selector prefixlen thresholds to hash policies */ 1057880a6fabSChristophe Gouault if (attrs[XFRMA_SPD_IPV4_HTHRESH]) { 1058880a6fabSChristophe Gouault struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH]; 1059880a6fabSChristophe Gouault 1060880a6fabSChristophe Gouault if (nla_len(rta) < sizeof(*thresh4)) 1061880a6fabSChristophe Gouault return -EINVAL; 1062880a6fabSChristophe Gouault thresh4 = nla_data(rta); 1063880a6fabSChristophe Gouault if (thresh4->lbits > 32 || thresh4->rbits > 32) 1064880a6fabSChristophe Gouault return -EINVAL; 1065880a6fabSChristophe Gouault } 1066880a6fabSChristophe Gouault if (attrs[XFRMA_SPD_IPV6_HTHRESH]) { 1067880a6fabSChristophe Gouault struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH]; 1068880a6fabSChristophe Gouault 1069880a6fabSChristophe Gouault if (nla_len(rta) < sizeof(*thresh6)) 1070880a6fabSChristophe Gouault return -EINVAL; 1071880a6fabSChristophe Gouault thresh6 = nla_data(rta); 1072880a6fabSChristophe Gouault if (thresh6->lbits > 128 || thresh6->rbits > 128) 1073880a6fabSChristophe Gouault return -EINVAL; 1074880a6fabSChristophe Gouault } 1075880a6fabSChristophe Gouault 1076880a6fabSChristophe Gouault if (thresh4 || thresh6) { 1077880a6fabSChristophe Gouault write_seqlock(&net->xfrm.policy_hthresh.lock); 1078880a6fabSChristophe Gouault if (thresh4) { 1079880a6fabSChristophe Gouault net->xfrm.policy_hthresh.lbits4 = thresh4->lbits; 1080880a6fabSChristophe Gouault net->xfrm.policy_hthresh.rbits4 = thresh4->rbits; 1081880a6fabSChristophe Gouault } 1082880a6fabSChristophe Gouault if (thresh6) { 1083880a6fabSChristophe Gouault net->xfrm.policy_hthresh.lbits6 = thresh6->lbits; 1084880a6fabSChristophe Gouault net->xfrm.policy_hthresh.rbits6 = thresh6->rbits; 1085880a6fabSChristophe Gouault } 1086880a6fabSChristophe Gouault write_sequnlock(&net->xfrm.policy_hthresh.lock); 1087880a6fabSChristophe Gouault 1088880a6fabSChristophe Gouault xfrm_policy_hash_rebuild(net); 1089880a6fabSChristophe Gouault } 1090880a6fabSChristophe Gouault 1091880a6fabSChristophe Gouault return 0; 1092880a6fabSChristophe Gouault } 1093880a6fabSChristophe Gouault 1094ecfd6b18SJamal Hadi Salim static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 10955424f32eSThomas Graf struct nlattr **attrs) 1096ecfd6b18SJamal Hadi Salim { 1097a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk); 1098ecfd6b18SJamal Hadi Salim struct sk_buff *r_skb; 10997b67c857SThomas Graf u32 *flags = nlmsg_data(nlh); 110015e47304SEric W. Biederman u32 sportid = NETLINK_CB(skb).portid; 1101ecfd6b18SJamal Hadi Salim u32 seq = nlh->nlmsg_seq; 1102ecfd6b18SJamal Hadi Salim 11037deb2264SThomas Graf r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC); 1104ecfd6b18SJamal Hadi Salim if (r_skb == NULL) 1105ecfd6b18SJamal Hadi Salim return -ENOMEM; 1106ecfd6b18SJamal Hadi Salim 110715e47304SEric W. Biederman if (build_spdinfo(r_skb, net, sportid, seq, *flags) < 0) 1108ecfd6b18SJamal Hadi Salim BUG(); 1109ecfd6b18SJamal Hadi Salim 111015e47304SEric W. Biederman return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid); 1111ecfd6b18SJamal Hadi Salim } 1112ecfd6b18SJamal Hadi Salim 11137deb2264SThomas Graf static inline size_t xfrm_sadinfo_msgsize(void) 11147deb2264SThomas Graf { 11157deb2264SThomas Graf return NLMSG_ALIGN(4) 11167deb2264SThomas Graf + nla_total_size(sizeof(struct xfrmu_sadhinfo)) 11177deb2264SThomas Graf + nla_total_size(4); /* XFRMA_SAD_CNT */ 11187deb2264SThomas Graf } 11197deb2264SThomas Graf 1120e071041bSAlexey Dobriyan static int build_sadinfo(struct sk_buff *skb, struct net *net, 112115e47304SEric W. Biederman u32 portid, u32 seq, u32 flags) 112228d8909bSJamal Hadi Salim { 1123af11e316SJamal Hadi Salim struct xfrmk_sadinfo si; 1124af11e316SJamal Hadi Salim struct xfrmu_sadhinfo sh; 112528d8909bSJamal Hadi Salim struct nlmsghdr *nlh; 11261d1e34ddSDavid S. Miller int err; 112728d8909bSJamal Hadi Salim u32 *f; 112828d8909bSJamal Hadi Salim 112915e47304SEric W. Biederman nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0); 113025985edcSLucas De Marchi if (nlh == NULL) /* shouldn't really happen ... */ 113128d8909bSJamal Hadi Salim return -EMSGSIZE; 113228d8909bSJamal Hadi Salim 113328d8909bSJamal Hadi Salim f = nlmsg_data(nlh); 113428d8909bSJamal Hadi Salim *f = flags; 1135e071041bSAlexey Dobriyan xfrm_sad_getinfo(net, &si); 113628d8909bSJamal Hadi Salim 1137af11e316SJamal Hadi Salim sh.sadhmcnt = si.sadhmcnt; 1138af11e316SJamal Hadi Salim sh.sadhcnt = si.sadhcnt; 1139af11e316SJamal Hadi Salim 11401d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt); 11411d1e34ddSDavid S. Miller if (!err) 11421d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh); 11431d1e34ddSDavid S. Miller if (err) { 11441d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 11451d1e34ddSDavid S. Miller return err; 11461d1e34ddSDavid S. Miller } 114728d8909bSJamal Hadi Salim 1148053c095aSJohannes Berg nlmsg_end(skb, nlh); 1149053c095aSJohannes Berg return 0; 115028d8909bSJamal Hadi Salim } 115128d8909bSJamal Hadi Salim 115228d8909bSJamal Hadi Salim static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 11535424f32eSThomas Graf struct nlattr **attrs) 115428d8909bSJamal Hadi Salim { 1155a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk); 115628d8909bSJamal Hadi Salim struct sk_buff *r_skb; 11577b67c857SThomas Graf u32 *flags = nlmsg_data(nlh); 115815e47304SEric W. Biederman u32 sportid = NETLINK_CB(skb).portid; 115928d8909bSJamal Hadi Salim u32 seq = nlh->nlmsg_seq; 116028d8909bSJamal Hadi Salim 11617deb2264SThomas Graf r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC); 116228d8909bSJamal Hadi Salim if (r_skb == NULL) 116328d8909bSJamal Hadi Salim return -ENOMEM; 116428d8909bSJamal Hadi Salim 116515e47304SEric W. Biederman if (build_sadinfo(r_skb, net, sportid, seq, *flags) < 0) 116628d8909bSJamal Hadi Salim BUG(); 116728d8909bSJamal Hadi Salim 116815e47304SEric W. Biederman return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid); 116928d8909bSJamal Hadi Salim } 117028d8909bSJamal Hadi Salim 117122e70050SChristoph Hellwig static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 11725424f32eSThomas Graf struct nlattr **attrs) 11731da177e4SLinus Torvalds { 1174fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 11757b67c857SThomas Graf struct xfrm_usersa_id *p = nlmsg_data(nlh); 11761da177e4SLinus Torvalds struct xfrm_state *x; 11771da177e4SLinus Torvalds struct sk_buff *resp_skb; 1178eb2971b6SMasahide NAKAMURA int err = -ESRCH; 11791da177e4SLinus Torvalds 1180fc34acd3SAlexey Dobriyan x = xfrm_user_state_lookup(net, p, attrs, &err); 11811da177e4SLinus Torvalds if (x == NULL) 11821da177e4SLinus Torvalds goto out_noput; 11831da177e4SLinus Torvalds 11841da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 11851da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 11861da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 11871da177e4SLinus Torvalds } else { 118815e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid); 11891da177e4SLinus Torvalds } 11901da177e4SLinus Torvalds xfrm_state_put(x); 11911da177e4SLinus Torvalds out_noput: 11921da177e4SLinus Torvalds return err; 11931da177e4SLinus Torvalds } 11941da177e4SLinus Torvalds 119522e70050SChristoph Hellwig static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, 11965424f32eSThomas Graf struct nlattr **attrs) 11971da177e4SLinus Torvalds { 1198fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 11991da177e4SLinus Torvalds struct xfrm_state *x; 12001da177e4SLinus Torvalds struct xfrm_userspi_info *p; 12011da177e4SLinus Torvalds struct sk_buff *resp_skb; 12021da177e4SLinus Torvalds xfrm_address_t *daddr; 12031da177e4SLinus Torvalds int family; 12041da177e4SLinus Torvalds int err; 12056f26b61eSJamal Hadi Salim u32 mark; 12066f26b61eSJamal Hadi Salim struct xfrm_mark m; 12071da177e4SLinus Torvalds 12087b67c857SThomas Graf p = nlmsg_data(nlh); 1209776e9dd9SFan Du err = verify_spi_info(p->info.id.proto, p->min, p->max); 12101da177e4SLinus Torvalds if (err) 12111da177e4SLinus Torvalds goto out_noput; 12121da177e4SLinus Torvalds 12131da177e4SLinus Torvalds family = p->info.family; 12141da177e4SLinus Torvalds daddr = &p->info.id.daddr; 12151da177e4SLinus Torvalds 12161da177e4SLinus Torvalds x = NULL; 12176f26b61eSJamal Hadi Salim 12186f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m); 12191da177e4SLinus Torvalds if (p->info.seq) { 12206f26b61eSJamal Hadi Salim x = xfrm_find_acq_byseq(net, mark, p->info.seq); 122170e94e66SYOSHIFUJI Hideaki / 吉藤英明 if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) { 12221da177e4SLinus Torvalds xfrm_state_put(x); 12231da177e4SLinus Torvalds x = NULL; 12241da177e4SLinus Torvalds } 12251da177e4SLinus Torvalds } 12261da177e4SLinus Torvalds 12271da177e4SLinus Torvalds if (!x) 12286f26b61eSJamal Hadi Salim x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid, 12291da177e4SLinus Torvalds p->info.id.proto, daddr, 12301da177e4SLinus Torvalds &p->info.saddr, 1, 12311da177e4SLinus Torvalds family); 12321da177e4SLinus Torvalds err = -ENOENT; 12331da177e4SLinus Torvalds if (x == NULL) 12341da177e4SLinus Torvalds goto out_noput; 12351da177e4SLinus Torvalds 1236658b219eSHerbert Xu err = xfrm_alloc_spi(x, p->min, p->max); 1237658b219eSHerbert Xu if (err) 1238658b219eSHerbert Xu goto out; 12391da177e4SLinus Torvalds 12401da177e4SLinus Torvalds resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 12411da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 12421da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 12431da177e4SLinus Torvalds goto out; 12441da177e4SLinus Torvalds } 12451da177e4SLinus Torvalds 124615e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid); 12471da177e4SLinus Torvalds 12481da177e4SLinus Torvalds out: 12491da177e4SLinus Torvalds xfrm_state_put(x); 12501da177e4SLinus Torvalds out_noput: 12511da177e4SLinus Torvalds return err; 12521da177e4SLinus Torvalds } 12531da177e4SLinus Torvalds 1254b798a9edSJamal Hadi Salim static int verify_policy_dir(u8 dir) 12551da177e4SLinus Torvalds { 12561da177e4SLinus Torvalds switch (dir) { 12571da177e4SLinus Torvalds case XFRM_POLICY_IN: 12581da177e4SLinus Torvalds case XFRM_POLICY_OUT: 12591da177e4SLinus Torvalds case XFRM_POLICY_FWD: 12601da177e4SLinus Torvalds break; 12611da177e4SLinus Torvalds 12621da177e4SLinus Torvalds default: 12631da177e4SLinus Torvalds return -EINVAL; 12643ff50b79SStephen Hemminger } 12651da177e4SLinus Torvalds 12661da177e4SLinus Torvalds return 0; 12671da177e4SLinus Torvalds } 12681da177e4SLinus Torvalds 1269b798a9edSJamal Hadi Salim static int verify_policy_type(u8 type) 1270f7b6983fSMasahide NAKAMURA { 1271f7b6983fSMasahide NAKAMURA switch (type) { 1272f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_MAIN: 1273f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1274f7b6983fSMasahide NAKAMURA case XFRM_POLICY_TYPE_SUB: 1275f7b6983fSMasahide NAKAMURA #endif 1276f7b6983fSMasahide NAKAMURA break; 1277f7b6983fSMasahide NAKAMURA 1278f7b6983fSMasahide NAKAMURA default: 1279f7b6983fSMasahide NAKAMURA return -EINVAL; 12803ff50b79SStephen Hemminger } 1281f7b6983fSMasahide NAKAMURA 1282f7b6983fSMasahide NAKAMURA return 0; 1283f7b6983fSMasahide NAKAMURA } 1284f7b6983fSMasahide NAKAMURA 12851da177e4SLinus Torvalds static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) 12861da177e4SLinus Torvalds { 1287e682adf0SFan Du int ret; 1288e682adf0SFan Du 12891da177e4SLinus Torvalds switch (p->share) { 12901da177e4SLinus Torvalds case XFRM_SHARE_ANY: 12911da177e4SLinus Torvalds case XFRM_SHARE_SESSION: 12921da177e4SLinus Torvalds case XFRM_SHARE_USER: 12931da177e4SLinus Torvalds case XFRM_SHARE_UNIQUE: 12941da177e4SLinus Torvalds break; 12951da177e4SLinus Torvalds 12961da177e4SLinus Torvalds default: 12971da177e4SLinus Torvalds return -EINVAL; 12983ff50b79SStephen Hemminger } 12991da177e4SLinus Torvalds 13001da177e4SLinus Torvalds switch (p->action) { 13011da177e4SLinus Torvalds case XFRM_POLICY_ALLOW: 13021da177e4SLinus Torvalds case XFRM_POLICY_BLOCK: 13031da177e4SLinus Torvalds break; 13041da177e4SLinus Torvalds 13051da177e4SLinus Torvalds default: 13061da177e4SLinus Torvalds return -EINVAL; 13073ff50b79SStephen Hemminger } 13081da177e4SLinus Torvalds 13091da177e4SLinus Torvalds switch (p->sel.family) { 13101da177e4SLinus Torvalds case AF_INET: 13111da177e4SLinus Torvalds break; 13121da177e4SLinus Torvalds 13131da177e4SLinus Torvalds case AF_INET6: 1314dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 13151da177e4SLinus Torvalds break; 13161da177e4SLinus Torvalds #else 13171da177e4SLinus Torvalds return -EAFNOSUPPORT; 13181da177e4SLinus Torvalds #endif 13191da177e4SLinus Torvalds 13201da177e4SLinus Torvalds default: 13211da177e4SLinus Torvalds return -EINVAL; 13223ff50b79SStephen Hemminger } 13231da177e4SLinus Torvalds 1324e682adf0SFan Du ret = verify_policy_dir(p->dir); 1325e682adf0SFan Du if (ret) 1326e682adf0SFan Du return ret; 1327e682adf0SFan Du if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir)) 1328e682adf0SFan Du return -EINVAL; 1329e682adf0SFan Du 1330e682adf0SFan Du return 0; 13311da177e4SLinus Torvalds } 13321da177e4SLinus Torvalds 13335424f32eSThomas Graf static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs) 1334df71837dSTrent Jaeger { 13355424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 1336df71837dSTrent Jaeger struct xfrm_user_sec_ctx *uctx; 1337df71837dSTrent Jaeger 1338df71837dSTrent Jaeger if (!rt) 1339df71837dSTrent Jaeger return 0; 1340df71837dSTrent Jaeger 13415424f32eSThomas Graf uctx = nla_data(rt); 134252a4c640SNikolay Aleksandrov return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL); 1343df71837dSTrent Jaeger } 1344df71837dSTrent Jaeger 13451da177e4SLinus Torvalds static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, 13461da177e4SLinus Torvalds int nr) 13471da177e4SLinus Torvalds { 13481da177e4SLinus Torvalds int i; 13491da177e4SLinus Torvalds 13501da177e4SLinus Torvalds xp->xfrm_nr = nr; 13511da177e4SLinus Torvalds for (i = 0; i < nr; i++, ut++) { 13521da177e4SLinus Torvalds struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 13531da177e4SLinus Torvalds 13541da177e4SLinus Torvalds memcpy(&t->id, &ut->id, sizeof(struct xfrm_id)); 13551da177e4SLinus Torvalds memcpy(&t->saddr, &ut->saddr, 13561da177e4SLinus Torvalds sizeof(xfrm_address_t)); 13571da177e4SLinus Torvalds t->reqid = ut->reqid; 13581da177e4SLinus Torvalds t->mode = ut->mode; 13591da177e4SLinus Torvalds t->share = ut->share; 13601da177e4SLinus Torvalds t->optional = ut->optional; 13611da177e4SLinus Torvalds t->aalgos = ut->aalgos; 13621da177e4SLinus Torvalds t->ealgos = ut->ealgos; 13631da177e4SLinus Torvalds t->calgos = ut->calgos; 1364c5d18e98SHerbert Xu /* If all masks are ~0, then we allow all algorithms. */ 1365c5d18e98SHerbert Xu t->allalgs = !~(t->aalgos & t->ealgos & t->calgos); 13668511d01dSMiika Komu t->encap_family = ut->family; 13671da177e4SLinus Torvalds } 13681da177e4SLinus Torvalds } 13691da177e4SLinus Torvalds 1370b4ad86bfSDavid S. Miller static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) 1371b4ad86bfSDavid S. Miller { 1372b4ad86bfSDavid S. Miller int i; 1373b4ad86bfSDavid S. Miller 1374b4ad86bfSDavid S. Miller if (nr > XFRM_MAX_DEPTH) 1375b4ad86bfSDavid S. Miller return -EINVAL; 1376b4ad86bfSDavid S. Miller 1377b4ad86bfSDavid S. Miller for (i = 0; i < nr; i++) { 1378b4ad86bfSDavid S. Miller /* We never validated the ut->family value, so many 1379b4ad86bfSDavid S. Miller * applications simply leave it at zero. The check was 1380b4ad86bfSDavid S. Miller * never made and ut->family was ignored because all 1381b4ad86bfSDavid S. Miller * templates could be assumed to have the same family as 1382b4ad86bfSDavid S. Miller * the policy itself. Now that we will have ipv4-in-ipv6 1383b4ad86bfSDavid S. Miller * and ipv6-in-ipv4 tunnels, this is no longer true. 1384b4ad86bfSDavid S. Miller */ 1385b4ad86bfSDavid S. Miller if (!ut[i].family) 1386b4ad86bfSDavid S. Miller ut[i].family = family; 1387b4ad86bfSDavid S. Miller 1388b4ad86bfSDavid S. Miller switch (ut[i].family) { 1389b4ad86bfSDavid S. Miller case AF_INET: 1390b4ad86bfSDavid S. Miller break; 1391dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 1392b4ad86bfSDavid S. Miller case AF_INET6: 1393b4ad86bfSDavid S. Miller break; 1394b4ad86bfSDavid S. Miller #endif 1395b4ad86bfSDavid S. Miller default: 1396b4ad86bfSDavid S. Miller return -EINVAL; 13973ff50b79SStephen Hemminger } 1398b4ad86bfSDavid S. Miller } 1399b4ad86bfSDavid S. Miller 1400b4ad86bfSDavid S. Miller return 0; 1401b4ad86bfSDavid S. Miller } 1402b4ad86bfSDavid S. Miller 14035424f32eSThomas Graf static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs) 14041da177e4SLinus Torvalds { 14055424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL]; 14061da177e4SLinus Torvalds 14071da177e4SLinus Torvalds if (!rt) { 14081da177e4SLinus Torvalds pol->xfrm_nr = 0; 14091da177e4SLinus Torvalds } else { 14105424f32eSThomas Graf struct xfrm_user_tmpl *utmpl = nla_data(rt); 14115424f32eSThomas Graf int nr = nla_len(rt) / sizeof(*utmpl); 1412b4ad86bfSDavid S. Miller int err; 14131da177e4SLinus Torvalds 1414b4ad86bfSDavid S. Miller err = validate_tmpl(nr, utmpl, pol->family); 1415b4ad86bfSDavid S. Miller if (err) 1416b4ad86bfSDavid S. Miller return err; 14171da177e4SLinus Torvalds 14185424f32eSThomas Graf copy_templates(pol, utmpl, nr); 14191da177e4SLinus Torvalds } 14201da177e4SLinus Torvalds return 0; 14211da177e4SLinus Torvalds } 14221da177e4SLinus Torvalds 14235424f32eSThomas Graf static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs) 1424f7b6983fSMasahide NAKAMURA { 14255424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_POLICY_TYPE]; 1426f7b6983fSMasahide NAKAMURA struct xfrm_userpolicy_type *upt; 1427b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 1428f7b6983fSMasahide NAKAMURA int err; 1429f7b6983fSMasahide NAKAMURA 1430f7b6983fSMasahide NAKAMURA if (rt) { 14315424f32eSThomas Graf upt = nla_data(rt); 1432f7b6983fSMasahide NAKAMURA type = upt->type; 1433f7b6983fSMasahide NAKAMURA } 1434f7b6983fSMasahide NAKAMURA 1435f7b6983fSMasahide NAKAMURA err = verify_policy_type(type); 1436f7b6983fSMasahide NAKAMURA if (err) 1437f7b6983fSMasahide NAKAMURA return err; 1438f7b6983fSMasahide NAKAMURA 1439f7b6983fSMasahide NAKAMURA *tp = type; 1440f7b6983fSMasahide NAKAMURA return 0; 1441f7b6983fSMasahide NAKAMURA } 1442f7b6983fSMasahide NAKAMURA 14431da177e4SLinus Torvalds static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p) 14441da177e4SLinus Torvalds { 14451da177e4SLinus Torvalds xp->priority = p->priority; 14461da177e4SLinus Torvalds xp->index = p->index; 14471da177e4SLinus Torvalds memcpy(&xp->selector, &p->sel, sizeof(xp->selector)); 14481da177e4SLinus Torvalds memcpy(&xp->lft, &p->lft, sizeof(xp->lft)); 14491da177e4SLinus Torvalds xp->action = p->action; 14501da177e4SLinus Torvalds xp->flags = p->flags; 14511da177e4SLinus Torvalds xp->family = p->sel.family; 14521da177e4SLinus Torvalds /* XXX xp->share = p->share; */ 14531da177e4SLinus Torvalds } 14541da177e4SLinus Torvalds 14551da177e4SLinus Torvalds static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir) 14561da177e4SLinus Torvalds { 14577b789836SMathias Krause memset(p, 0, sizeof(*p)); 14581da177e4SLinus Torvalds memcpy(&p->sel, &xp->selector, sizeof(p->sel)); 14591da177e4SLinus Torvalds memcpy(&p->lft, &xp->lft, sizeof(p->lft)); 14601da177e4SLinus Torvalds memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft)); 14611da177e4SLinus Torvalds p->priority = xp->priority; 14621da177e4SLinus Torvalds p->index = xp->index; 14631da177e4SLinus Torvalds p->sel.family = xp->family; 14641da177e4SLinus Torvalds p->dir = dir; 14651da177e4SLinus Torvalds p->action = xp->action; 14661da177e4SLinus Torvalds p->flags = xp->flags; 14671da177e4SLinus Torvalds p->share = XFRM_SHARE_ANY; /* XXX xp->share */ 14681da177e4SLinus Torvalds } 14691da177e4SLinus Torvalds 1470fc34acd3SAlexey Dobriyan static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp) 14711da177e4SLinus Torvalds { 1472fc34acd3SAlexey Dobriyan struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL); 14731da177e4SLinus Torvalds int err; 14741da177e4SLinus Torvalds 14751da177e4SLinus Torvalds if (!xp) { 14761da177e4SLinus Torvalds *errp = -ENOMEM; 14771da177e4SLinus Torvalds return NULL; 14781da177e4SLinus Torvalds } 14791da177e4SLinus Torvalds 14801da177e4SLinus Torvalds copy_from_user_policy(xp, p); 1481df71837dSTrent Jaeger 148235a7aa08SThomas Graf err = copy_from_user_policy_type(&xp->type, attrs); 1483f7b6983fSMasahide NAKAMURA if (err) 1484f7b6983fSMasahide NAKAMURA goto error; 1485f7b6983fSMasahide NAKAMURA 148635a7aa08SThomas Graf if (!(err = copy_from_user_tmpl(xp, attrs))) 148735a7aa08SThomas Graf err = copy_from_user_sec_ctx(xp, attrs); 1488f7b6983fSMasahide NAKAMURA if (err) 1489f7b6983fSMasahide NAKAMURA goto error; 14901da177e4SLinus Torvalds 1491295fae56SJamal Hadi Salim xfrm_mark_get(attrs, &xp->mark); 1492295fae56SJamal Hadi Salim 14931da177e4SLinus Torvalds return xp; 1494f7b6983fSMasahide NAKAMURA error: 1495f7b6983fSMasahide NAKAMURA *errp = err; 149612a169e7SHerbert Xu xp->walk.dead = 1; 149764c31b3fSWANG Cong xfrm_policy_destroy(xp); 1498f7b6983fSMasahide NAKAMURA return NULL; 14991da177e4SLinus Torvalds } 15001da177e4SLinus Torvalds 150122e70050SChristoph Hellwig static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 15025424f32eSThomas Graf struct nlattr **attrs) 15031da177e4SLinus Torvalds { 1504fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 15057b67c857SThomas Graf struct xfrm_userpolicy_info *p = nlmsg_data(nlh); 15061da177e4SLinus Torvalds struct xfrm_policy *xp; 150726b15dadSJamal Hadi Salim struct km_event c; 15081da177e4SLinus Torvalds int err; 15091da177e4SLinus Torvalds int excl; 15101da177e4SLinus Torvalds 15111da177e4SLinus Torvalds err = verify_newpolicy_info(p); 15121da177e4SLinus Torvalds if (err) 15131da177e4SLinus Torvalds return err; 151435a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 1515df71837dSTrent Jaeger if (err) 1516df71837dSTrent Jaeger return err; 15171da177e4SLinus Torvalds 1518fc34acd3SAlexey Dobriyan xp = xfrm_policy_construct(net, p, attrs, &err); 15191da177e4SLinus Torvalds if (!xp) 15201da177e4SLinus Torvalds return err; 15211da177e4SLinus Torvalds 152225985edcSLucas De Marchi /* shouldn't excl be based on nlh flags?? 152326b15dadSJamal Hadi Salim * Aha! this is anti-netlink really i.e more pfkey derived 152426b15dadSJamal Hadi Salim * in netlink excl is a flag and you wouldnt need 152526b15dadSJamal Hadi Salim * a type XFRM_MSG_UPDPOLICY - JHS */ 15261da177e4SLinus Torvalds excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; 15271da177e4SLinus Torvalds err = xfrm_policy_insert(p->dir, xp, excl); 15282e71029eSTetsuo Handa xfrm_audit_policy_add(xp, err ? 0 : 1, true); 1529161a09e7SJoy Latten 15301da177e4SLinus Torvalds if (err) { 153103e1ad7bSPaul Moore security_xfrm_policy_free(xp->security); 15321da177e4SLinus Torvalds kfree(xp); 15331da177e4SLinus Torvalds return err; 15341da177e4SLinus Torvalds } 15351da177e4SLinus Torvalds 1536f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 153726b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 153815e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 153926b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c); 154026b15dadSJamal Hadi Salim 15411da177e4SLinus Torvalds xfrm_pol_put(xp); 15421da177e4SLinus Torvalds 15431da177e4SLinus Torvalds return 0; 15441da177e4SLinus Torvalds } 15451da177e4SLinus Torvalds 15461da177e4SLinus Torvalds static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb) 15471da177e4SLinus Torvalds { 15481da177e4SLinus Torvalds struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH]; 15491da177e4SLinus Torvalds int i; 15501da177e4SLinus Torvalds 15511da177e4SLinus Torvalds if (xp->xfrm_nr == 0) 15521da177e4SLinus Torvalds return 0; 15531da177e4SLinus Torvalds 15541da177e4SLinus Torvalds for (i = 0; i < xp->xfrm_nr; i++) { 15551da177e4SLinus Torvalds struct xfrm_user_tmpl *up = &vec[i]; 15561da177e4SLinus Torvalds struct xfrm_tmpl *kp = &xp->xfrm_vec[i]; 15571da177e4SLinus Torvalds 15581f86840fSMathias Krause memset(up, 0, sizeof(*up)); 15591da177e4SLinus Torvalds memcpy(&up->id, &kp->id, sizeof(up->id)); 15608511d01dSMiika Komu up->family = kp->encap_family; 15611da177e4SLinus Torvalds memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr)); 15621da177e4SLinus Torvalds up->reqid = kp->reqid; 15631da177e4SLinus Torvalds up->mode = kp->mode; 15641da177e4SLinus Torvalds up->share = kp->share; 15651da177e4SLinus Torvalds up->optional = kp->optional; 15661da177e4SLinus Torvalds up->aalgos = kp->aalgos; 15671da177e4SLinus Torvalds up->ealgos = kp->ealgos; 15681da177e4SLinus Torvalds up->calgos = kp->calgos; 15691da177e4SLinus Torvalds } 15701da177e4SLinus Torvalds 1571c0144beaSThomas Graf return nla_put(skb, XFRMA_TMPL, 1572c0144beaSThomas Graf sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec); 1573df71837dSTrent Jaeger } 1574df71837dSTrent Jaeger 15750d681623SSerge Hallyn static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb) 15760d681623SSerge Hallyn { 15770d681623SSerge Hallyn if (x->security) { 15780d681623SSerge Hallyn return copy_sec_ctx(x->security, skb); 15790d681623SSerge Hallyn } 15800d681623SSerge Hallyn return 0; 15810d681623SSerge Hallyn } 15820d681623SSerge Hallyn 15830d681623SSerge Hallyn static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb) 15840d681623SSerge Hallyn { 15851d1e34ddSDavid S. Miller if (xp->security) 15860d681623SSerge Hallyn return copy_sec_ctx(xp->security, skb); 15870d681623SSerge Hallyn return 0; 15880d681623SSerge Hallyn } 1589cfbfd45aSThomas Graf static inline size_t userpolicy_type_attrsize(void) 1590cfbfd45aSThomas Graf { 1591cfbfd45aSThomas Graf #ifdef CONFIG_XFRM_SUB_POLICY 1592cfbfd45aSThomas Graf return nla_total_size(sizeof(struct xfrm_userpolicy_type)); 1593cfbfd45aSThomas Graf #else 1594cfbfd45aSThomas Graf return 0; 1595cfbfd45aSThomas Graf #endif 1596cfbfd45aSThomas Graf } 15970d681623SSerge Hallyn 1598f7b6983fSMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1599b798a9edSJamal Hadi Salim static int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 1600f7b6983fSMasahide NAKAMURA { 1601c0144beaSThomas Graf struct xfrm_userpolicy_type upt = { 1602c0144beaSThomas Graf .type = type, 1603c0144beaSThomas Graf }; 1604f7b6983fSMasahide NAKAMURA 1605c0144beaSThomas Graf return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt); 1606f7b6983fSMasahide NAKAMURA } 1607f7b6983fSMasahide NAKAMURA 1608f7b6983fSMasahide NAKAMURA #else 1609b798a9edSJamal Hadi Salim static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 1610f7b6983fSMasahide NAKAMURA { 1611f7b6983fSMasahide NAKAMURA return 0; 1612f7b6983fSMasahide NAKAMURA } 1613f7b6983fSMasahide NAKAMURA #endif 1614f7b6983fSMasahide NAKAMURA 16151da177e4SLinus Torvalds static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr) 16161da177e4SLinus Torvalds { 16171da177e4SLinus Torvalds struct xfrm_dump_info *sp = ptr; 16181da177e4SLinus Torvalds struct xfrm_userpolicy_info *p; 16191da177e4SLinus Torvalds struct sk_buff *in_skb = sp->in_skb; 16201da177e4SLinus Torvalds struct sk_buff *skb = sp->out_skb; 16211da177e4SLinus Torvalds struct nlmsghdr *nlh; 16221d1e34ddSDavid S. Miller int err; 16231da177e4SLinus Torvalds 162415e47304SEric W. Biederman nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 162579b8b7f4SThomas Graf XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags); 162679b8b7f4SThomas Graf if (nlh == NULL) 162779b8b7f4SThomas Graf return -EMSGSIZE; 16281da177e4SLinus Torvalds 16297b67c857SThomas Graf p = nlmsg_data(nlh); 16301da177e4SLinus Torvalds copy_to_user_policy(xp, p, dir); 16311d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 16321d1e34ddSDavid S. Miller if (!err) 16331d1e34ddSDavid S. Miller err = copy_to_user_sec_ctx(xp, skb); 16341d1e34ddSDavid S. Miller if (!err) 16351d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 16361d1e34ddSDavid S. Miller if (!err) 16371d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 16381d1e34ddSDavid S. Miller if (err) { 16391d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 16401d1e34ddSDavid S. Miller return err; 16411d1e34ddSDavid S. Miller } 16429825069dSThomas Graf nlmsg_end(skb, nlh); 16431da177e4SLinus Torvalds return 0; 16441da177e4SLinus Torvalds } 16451da177e4SLinus Torvalds 16464c563f76STimo Teras static int xfrm_dump_policy_done(struct netlink_callback *cb) 16474c563f76STimo Teras { 16484c563f76STimo Teras struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; 1649283bc9f3SFan Du struct net *net = sock_net(cb->skb->sk); 16504c563f76STimo Teras 1651283bc9f3SFan Du xfrm_policy_walk_done(walk, net); 16524c563f76STimo Teras return 0; 16534c563f76STimo Teras } 16544c563f76STimo Teras 16551da177e4SLinus Torvalds static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb) 16561da177e4SLinus Torvalds { 1657fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 16584c563f76STimo Teras struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; 16591da177e4SLinus Torvalds struct xfrm_dump_info info; 16601da177e4SLinus Torvalds 16614c563f76STimo Teras BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) > 16624c563f76STimo Teras sizeof(cb->args) - sizeof(cb->args[0])); 16634c563f76STimo Teras 16641da177e4SLinus Torvalds info.in_skb = cb->skb; 16651da177e4SLinus Torvalds info.out_skb = skb; 16661da177e4SLinus Torvalds info.nlmsg_seq = cb->nlh->nlmsg_seq; 16671da177e4SLinus Torvalds info.nlmsg_flags = NLM_F_MULTI; 16684c563f76STimo Teras 16694c563f76STimo Teras if (!cb->args[0]) { 16704c563f76STimo Teras cb->args[0] = 1; 16714c563f76STimo Teras xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY); 16724c563f76STimo Teras } 16734c563f76STimo Teras 1674fc34acd3SAlexey Dobriyan (void) xfrm_policy_walk(net, walk, dump_one_policy, &info); 16751da177e4SLinus Torvalds 16761da177e4SLinus Torvalds return skb->len; 16771da177e4SLinus Torvalds } 16781da177e4SLinus Torvalds 16791da177e4SLinus Torvalds static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, 16801da177e4SLinus Torvalds struct xfrm_policy *xp, 16811da177e4SLinus Torvalds int dir, u32 seq) 16821da177e4SLinus Torvalds { 16831da177e4SLinus Torvalds struct xfrm_dump_info info; 16841da177e4SLinus Torvalds struct sk_buff *skb; 1685c2546372SMathias Krause int err; 16861da177e4SLinus Torvalds 16877deb2264SThomas Graf skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 16881da177e4SLinus Torvalds if (!skb) 16891da177e4SLinus Torvalds return ERR_PTR(-ENOMEM); 16901da177e4SLinus Torvalds 16911da177e4SLinus Torvalds info.in_skb = in_skb; 16921da177e4SLinus Torvalds info.out_skb = skb; 16931da177e4SLinus Torvalds info.nlmsg_seq = seq; 16941da177e4SLinus Torvalds info.nlmsg_flags = 0; 16951da177e4SLinus Torvalds 1696c2546372SMathias Krause err = dump_one_policy(xp, dir, 0, &info); 1697c2546372SMathias Krause if (err) { 16981da177e4SLinus Torvalds kfree_skb(skb); 1699c2546372SMathias Krause return ERR_PTR(err); 17001da177e4SLinus Torvalds } 17011da177e4SLinus Torvalds 17021da177e4SLinus Torvalds return skb; 17031da177e4SLinus Torvalds } 17041da177e4SLinus Torvalds 170522e70050SChristoph Hellwig static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 17065424f32eSThomas Graf struct nlattr **attrs) 17071da177e4SLinus Torvalds { 1708fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 17091da177e4SLinus Torvalds struct xfrm_policy *xp; 17101da177e4SLinus Torvalds struct xfrm_userpolicy_id *p; 1711b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 17121da177e4SLinus Torvalds int err; 171326b15dadSJamal Hadi Salim struct km_event c; 17141da177e4SLinus Torvalds int delete; 1715295fae56SJamal Hadi Salim struct xfrm_mark m; 1716295fae56SJamal Hadi Salim u32 mark = xfrm_mark_get(attrs, &m); 17171da177e4SLinus Torvalds 17187b67c857SThomas Graf p = nlmsg_data(nlh); 17191da177e4SLinus Torvalds delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY; 17201da177e4SLinus Torvalds 172135a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 1722f7b6983fSMasahide NAKAMURA if (err) 1723f7b6983fSMasahide NAKAMURA return err; 1724f7b6983fSMasahide NAKAMURA 17251da177e4SLinus Torvalds err = verify_policy_dir(p->dir); 17261da177e4SLinus Torvalds if (err) 17271da177e4SLinus Torvalds return err; 17281da177e4SLinus Torvalds 17291da177e4SLinus Torvalds if (p->index) 1730295fae56SJamal Hadi Salim xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err); 1731df71837dSTrent Jaeger else { 17325424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 173303e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx; 1734df71837dSTrent Jaeger 173535a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 1736df71837dSTrent Jaeger if (err) 1737df71837dSTrent Jaeger return err; 1738df71837dSTrent Jaeger 17392c8dd116SDenis V. Lunev ctx = NULL; 1740df71837dSTrent Jaeger if (rt) { 17415424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt); 1742df71837dSTrent Jaeger 174352a4c640SNikolay Aleksandrov err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 174403e1ad7bSPaul Moore if (err) 1745df71837dSTrent Jaeger return err; 17462c8dd116SDenis V. Lunev } 1747295fae56SJamal Hadi Salim xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel, 17486f26b61eSJamal Hadi Salim ctx, delete, &err); 174903e1ad7bSPaul Moore security_xfrm_policy_free(ctx); 1750df71837dSTrent Jaeger } 17511da177e4SLinus Torvalds if (xp == NULL) 17521da177e4SLinus Torvalds return -ENOENT; 17531da177e4SLinus Torvalds 17541da177e4SLinus Torvalds if (!delete) { 17551da177e4SLinus Torvalds struct sk_buff *resp_skb; 17561da177e4SLinus Torvalds 17571da177e4SLinus Torvalds resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq); 17581da177e4SLinus Torvalds if (IS_ERR(resp_skb)) { 17591da177e4SLinus Torvalds err = PTR_ERR(resp_skb); 17601da177e4SLinus Torvalds } else { 1761a6483b79SAlexey Dobriyan err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, 176215e47304SEric W. Biederman NETLINK_CB(skb).portid); 17631da177e4SLinus Torvalds } 176426b15dadSJamal Hadi Salim } else { 17652e71029eSTetsuo Handa xfrm_audit_policy_delete(xp, err ? 0 : 1, true); 176613fcfbb0SDavid S. Miller 176713fcfbb0SDavid S. Miller if (err != 0) 1768c8c05a8eSCatherine Zhang goto out; 176913fcfbb0SDavid S. Miller 1770e7443892SHerbert Xu c.data.byid = p->index; 1771f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 177226b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 177315e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 177426b15dadSJamal Hadi Salim km_policy_notify(xp, p->dir, &c); 17751da177e4SLinus Torvalds } 17761da177e4SLinus Torvalds 1777c8c05a8eSCatherine Zhang out: 1778ef41aaa0SEric Paris xfrm_pol_put(xp); 1779e4c17216SPaul Moore if (delete && err == 0) 1780e4c17216SPaul Moore xfrm_garbage_collect(net); 17811da177e4SLinus Torvalds return err; 17821da177e4SLinus Torvalds } 17831da177e4SLinus Torvalds 178422e70050SChristoph Hellwig static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 17855424f32eSThomas Graf struct nlattr **attrs) 17861da177e4SLinus Torvalds { 1787fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 178826b15dadSJamal Hadi Salim struct km_event c; 17897b67c857SThomas Graf struct xfrm_usersa_flush *p = nlmsg_data(nlh); 17904aa2e62cSJoy Latten int err; 17911da177e4SLinus Torvalds 17922e71029eSTetsuo Handa err = xfrm_state_flush(net, p->proto, true); 17939e64cc95SJamal Hadi Salim if (err) { 17949e64cc95SJamal Hadi Salim if (err == -ESRCH) /* empty table */ 17959e64cc95SJamal Hadi Salim return 0; 1796069c474eSDavid S. Miller return err; 17979e64cc95SJamal Hadi Salim } 1798bf08867fSHerbert Xu c.data.proto = p->proto; 1799f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 180026b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 180115e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 18027067802eSAlexey Dobriyan c.net = net; 180326b15dadSJamal Hadi Salim km_state_notify(NULL, &c); 180426b15dadSJamal Hadi Salim 18051da177e4SLinus Torvalds return 0; 18061da177e4SLinus Torvalds } 18071da177e4SLinus Torvalds 1808d8647b79SSteffen Klassert static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x) 18097deb2264SThomas Graf { 1810d8647b79SSteffen Klassert size_t replay_size = x->replay_esn ? 1811d8647b79SSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn) : 1812d8647b79SSteffen Klassert sizeof(struct xfrm_replay_state); 1813d8647b79SSteffen Klassert 18147deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id)) 1815d8647b79SSteffen Klassert + nla_total_size(replay_size) 18167deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_lifetime_cur)) 18176f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)) 18187deb2264SThomas Graf + nla_total_size(4) /* XFRM_AE_RTHR */ 18197deb2264SThomas Graf + nla_total_size(4); /* XFRM_AE_ETHR */ 18207deb2264SThomas Graf } 1821d51d081dSJamal Hadi Salim 1822214e005bSDavid S. Miller static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 1823d51d081dSJamal Hadi Salim { 1824d51d081dSJamal Hadi Salim struct xfrm_aevent_id *id; 1825d51d081dSJamal Hadi Salim struct nlmsghdr *nlh; 18261d1e34ddSDavid S. Miller int err; 1827d51d081dSJamal Hadi Salim 182815e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0); 182979b8b7f4SThomas Graf if (nlh == NULL) 183079b8b7f4SThomas Graf return -EMSGSIZE; 1831d51d081dSJamal Hadi Salim 18327b67c857SThomas Graf id = nlmsg_data(nlh); 18332b5f6dccSJamal Hadi Salim memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr)); 1834d51d081dSJamal Hadi Salim id->sa_id.spi = x->id.spi; 1835d51d081dSJamal Hadi Salim id->sa_id.family = x->props.family; 1836d51d081dSJamal Hadi Salim id->sa_id.proto = x->id.proto; 18372b5f6dccSJamal Hadi Salim memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr)); 18382b5f6dccSJamal Hadi Salim id->reqid = x->props.reqid; 1839d51d081dSJamal Hadi Salim id->flags = c->data.aevent; 1840d51d081dSJamal Hadi Salim 1841d0fde795SDavid S. Miller if (x->replay_esn) { 18421d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 1843d8647b79SSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 18441d1e34ddSDavid S. Miller x->replay_esn); 1845d0fde795SDavid S. Miller } else { 18461d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 18471d1e34ddSDavid S. Miller &x->replay); 1848d0fde795SDavid S. Miller } 18491d1e34ddSDavid S. Miller if (err) 18501d1e34ddSDavid S. Miller goto out_cancel; 18511d1e34ddSDavid S. Miller err = nla_put(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft); 18521d1e34ddSDavid S. Miller if (err) 18531d1e34ddSDavid S. Miller goto out_cancel; 1854d8647b79SSteffen Klassert 18551d1e34ddSDavid S. Miller if (id->flags & XFRM_AE_RTHR) { 18561d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff); 18571d1e34ddSDavid S. Miller if (err) 18581d1e34ddSDavid S. Miller goto out_cancel; 18591d1e34ddSDavid S. Miller } 18601d1e34ddSDavid S. Miller if (id->flags & XFRM_AE_ETHR) { 18611d1e34ddSDavid S. Miller err = nla_put_u32(skb, XFRMA_ETIMER_THRESH, 18621d1e34ddSDavid S. Miller x->replay_maxage * 10 / HZ); 18631d1e34ddSDavid S. Miller if (err) 18641d1e34ddSDavid S. Miller goto out_cancel; 18651d1e34ddSDavid S. Miller } 18661d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &x->mark); 18671d1e34ddSDavid S. Miller if (err) 18681d1e34ddSDavid S. Miller goto out_cancel; 18696f26b61eSJamal Hadi Salim 1870053c095aSJohannes Berg nlmsg_end(skb, nlh); 1871053c095aSJohannes Berg return 0; 1872d51d081dSJamal Hadi Salim 18731d1e34ddSDavid S. Miller out_cancel: 18749825069dSThomas Graf nlmsg_cancel(skb, nlh); 18751d1e34ddSDavid S. Miller return err; 1876d51d081dSJamal Hadi Salim } 1877d51d081dSJamal Hadi Salim 187822e70050SChristoph Hellwig static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 18795424f32eSThomas Graf struct nlattr **attrs) 1880d51d081dSJamal Hadi Salim { 1881fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 1882d51d081dSJamal Hadi Salim struct xfrm_state *x; 1883d51d081dSJamal Hadi Salim struct sk_buff *r_skb; 1884d51d081dSJamal Hadi Salim int err; 1885d51d081dSJamal Hadi Salim struct km_event c; 18866f26b61eSJamal Hadi Salim u32 mark; 18876f26b61eSJamal Hadi Salim struct xfrm_mark m; 18887b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh); 1889d51d081dSJamal Hadi Salim struct xfrm_usersa_id *id = &p->sa_id; 1890d51d081dSJamal Hadi Salim 18916f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m); 18926f26b61eSJamal Hadi Salim 18936f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family); 1894d8647b79SSteffen Klassert if (x == NULL) 1895d51d081dSJamal Hadi Salim return -ESRCH; 1896d8647b79SSteffen Klassert 1897d8647b79SSteffen Klassert r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 1898d8647b79SSteffen Klassert if (r_skb == NULL) { 1899d8647b79SSteffen Klassert xfrm_state_put(x); 1900d8647b79SSteffen Klassert return -ENOMEM; 1901d51d081dSJamal Hadi Salim } 1902d51d081dSJamal Hadi Salim 1903d51d081dSJamal Hadi Salim /* 1904d51d081dSJamal Hadi Salim * XXX: is this lock really needed - none of the other 1905d51d081dSJamal Hadi Salim * gets lock (the concern is things getting updated 1906d51d081dSJamal Hadi Salim * while we are still reading) - jhs 1907d51d081dSJamal Hadi Salim */ 1908d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock); 1909d51d081dSJamal Hadi Salim c.data.aevent = p->flags; 1910d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 191115e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 1912d51d081dSJamal Hadi Salim 1913d51d081dSJamal Hadi Salim if (build_aevent(r_skb, x, &c) < 0) 1914d51d081dSJamal Hadi Salim BUG(); 191515e47304SEric W. Biederman err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid); 1916d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock); 1917d51d081dSJamal Hadi Salim xfrm_state_put(x); 1918d51d081dSJamal Hadi Salim return err; 1919d51d081dSJamal Hadi Salim } 1920d51d081dSJamal Hadi Salim 192122e70050SChristoph Hellwig static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 19225424f32eSThomas Graf struct nlattr **attrs) 1923d51d081dSJamal Hadi Salim { 1924fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 1925d51d081dSJamal Hadi Salim struct xfrm_state *x; 1926d51d081dSJamal Hadi Salim struct km_event c; 1927d51d081dSJamal Hadi Salim int err = -EINVAL; 19286f26b61eSJamal Hadi Salim u32 mark = 0; 19296f26b61eSJamal Hadi Salim struct xfrm_mark m; 19307b67c857SThomas Graf struct xfrm_aevent_id *p = nlmsg_data(nlh); 19315424f32eSThomas Graf struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 1932d8647b79SSteffen Klassert struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL]; 19335424f32eSThomas Graf struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 1934d51d081dSJamal Hadi Salim 1935d8647b79SSteffen Klassert if (!lt && !rp && !re) 1936d51d081dSJamal Hadi Salim return err; 1937d51d081dSJamal Hadi Salim 1938d51d081dSJamal Hadi Salim /* pedantic mode - thou shalt sayeth replaceth */ 1939d51d081dSJamal Hadi Salim if (!(nlh->nlmsg_flags&NLM_F_REPLACE)) 1940d51d081dSJamal Hadi Salim return err; 1941d51d081dSJamal Hadi Salim 19426f26b61eSJamal Hadi Salim mark = xfrm_mark_get(attrs, &m); 19436f26b61eSJamal Hadi Salim 19446f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family); 1945d51d081dSJamal Hadi Salim if (x == NULL) 1946d51d081dSJamal Hadi Salim return -ESRCH; 1947d51d081dSJamal Hadi Salim 1948d51d081dSJamal Hadi Salim if (x->km.state != XFRM_STATE_VALID) 1949d51d081dSJamal Hadi Salim goto out; 1950d51d081dSJamal Hadi Salim 19514479ff76SSteffen Klassert err = xfrm_replay_verify_len(x->replay_esn, re); 1952e2b19125SSteffen Klassert if (err) 1953e2b19125SSteffen Klassert goto out; 1954e2b19125SSteffen Klassert 1955d51d081dSJamal Hadi Salim spin_lock_bh(&x->lock); 1956e3ac104dSMathias Krause xfrm_update_ae_params(x, attrs, 1); 1957d51d081dSJamal Hadi Salim spin_unlock_bh(&x->lock); 1958d51d081dSJamal Hadi Salim 1959d51d081dSJamal Hadi Salim c.event = nlh->nlmsg_type; 1960d51d081dSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 196115e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 1962d51d081dSJamal Hadi Salim c.data.aevent = XFRM_AE_CU; 1963d51d081dSJamal Hadi Salim km_state_notify(x, &c); 1964d51d081dSJamal Hadi Salim err = 0; 1965d51d081dSJamal Hadi Salim out: 1966d51d081dSJamal Hadi Salim xfrm_state_put(x); 1967d51d081dSJamal Hadi Salim return err; 1968d51d081dSJamal Hadi Salim } 1969d51d081dSJamal Hadi Salim 197022e70050SChristoph Hellwig static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 19715424f32eSThomas Graf struct nlattr **attrs) 19721da177e4SLinus Torvalds { 1973fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 197426b15dadSJamal Hadi Salim struct km_event c; 1975b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 1976f7b6983fSMasahide NAKAMURA int err; 197726b15dadSJamal Hadi Salim 197835a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 1979f7b6983fSMasahide NAKAMURA if (err) 1980f7b6983fSMasahide NAKAMURA return err; 1981f7b6983fSMasahide NAKAMURA 19822e71029eSTetsuo Handa err = xfrm_policy_flush(net, type, true); 19832f1eb65fSJamal Hadi Salim if (err) { 19842f1eb65fSJamal Hadi Salim if (err == -ESRCH) /* empty table */ 19852f1eb65fSJamal Hadi Salim return 0; 1986069c474eSDavid S. Miller return err; 19872f1eb65fSJamal Hadi Salim } 19882f1eb65fSJamal Hadi Salim 1989f7b6983fSMasahide NAKAMURA c.data.type = type; 1990f60f6b8fSHerbert Xu c.event = nlh->nlmsg_type; 199126b15dadSJamal Hadi Salim c.seq = nlh->nlmsg_seq; 199215e47304SEric W. Biederman c.portid = nlh->nlmsg_pid; 19937067802eSAlexey Dobriyan c.net = net; 199426b15dadSJamal Hadi Salim km_policy_notify(NULL, 0, &c); 19951da177e4SLinus Torvalds return 0; 19961da177e4SLinus Torvalds } 19971da177e4SLinus Torvalds 199822e70050SChristoph Hellwig static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 19995424f32eSThomas Graf struct nlattr **attrs) 20006c5c8ca7SJamal Hadi Salim { 2001fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 20026c5c8ca7SJamal Hadi Salim struct xfrm_policy *xp; 20037b67c857SThomas Graf struct xfrm_user_polexpire *up = nlmsg_data(nlh); 20046c5c8ca7SJamal Hadi Salim struct xfrm_userpolicy_info *p = &up->pol; 2005b798a9edSJamal Hadi Salim u8 type = XFRM_POLICY_TYPE_MAIN; 20066c5c8ca7SJamal Hadi Salim int err = -ENOENT; 2007295fae56SJamal Hadi Salim struct xfrm_mark m; 2008295fae56SJamal Hadi Salim u32 mark = xfrm_mark_get(attrs, &m); 20096c5c8ca7SJamal Hadi Salim 201035a7aa08SThomas Graf err = copy_from_user_policy_type(&type, attrs); 2011f7b6983fSMasahide NAKAMURA if (err) 2012f7b6983fSMasahide NAKAMURA return err; 2013f7b6983fSMasahide NAKAMURA 2014c8bf4d04STimo Teräs err = verify_policy_dir(p->dir); 2015c8bf4d04STimo Teräs if (err) 2016c8bf4d04STimo Teräs return err; 2017c8bf4d04STimo Teräs 20186c5c8ca7SJamal Hadi Salim if (p->index) 2019295fae56SJamal Hadi Salim xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err); 20206c5c8ca7SJamal Hadi Salim else { 20215424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 202203e1ad7bSPaul Moore struct xfrm_sec_ctx *ctx; 20236c5c8ca7SJamal Hadi Salim 202435a7aa08SThomas Graf err = verify_sec_ctx_len(attrs); 20256c5c8ca7SJamal Hadi Salim if (err) 20266c5c8ca7SJamal Hadi Salim return err; 20276c5c8ca7SJamal Hadi Salim 20282c8dd116SDenis V. Lunev ctx = NULL; 20296c5c8ca7SJamal Hadi Salim if (rt) { 20305424f32eSThomas Graf struct xfrm_user_sec_ctx *uctx = nla_data(rt); 20316c5c8ca7SJamal Hadi Salim 203252a4c640SNikolay Aleksandrov err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 203303e1ad7bSPaul Moore if (err) 20346c5c8ca7SJamal Hadi Salim return err; 20352c8dd116SDenis V. Lunev } 2036295fae56SJamal Hadi Salim xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, 20376f26b61eSJamal Hadi Salim &p->sel, ctx, 0, &err); 203803e1ad7bSPaul Moore security_xfrm_policy_free(ctx); 20396c5c8ca7SJamal Hadi Salim } 20406c5c8ca7SJamal Hadi Salim if (xp == NULL) 2041ef41aaa0SEric Paris return -ENOENT; 204203e1ad7bSPaul Moore 2043ea2dea9dSTimo Teräs if (unlikely(xp->walk.dead)) 20446c5c8ca7SJamal Hadi Salim goto out; 20456c5c8ca7SJamal Hadi Salim 20466c5c8ca7SJamal Hadi Salim err = 0; 20476c5c8ca7SJamal Hadi Salim if (up->hard) { 20486c5c8ca7SJamal Hadi Salim xfrm_policy_delete(xp, p->dir); 20492e71029eSTetsuo Handa xfrm_audit_policy_delete(xp, 1, true); 20506c5c8ca7SJamal Hadi Salim } else { 20516c5c8ca7SJamal Hadi Salim // reset the timers here? 20520c199a90SJakub Wilk WARN(1, "Don't know what to do with soft policy expire\n"); 20536c5c8ca7SJamal Hadi Salim } 2054c6bb8136SEric W. Biederman km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid); 20556c5c8ca7SJamal Hadi Salim 20566c5c8ca7SJamal Hadi Salim out: 20576c5c8ca7SJamal Hadi Salim xfrm_pol_put(xp); 20586c5c8ca7SJamal Hadi Salim return err; 20596c5c8ca7SJamal Hadi Salim } 20606c5c8ca7SJamal Hadi Salim 206122e70050SChristoph Hellwig static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 20625424f32eSThomas Graf struct nlattr **attrs) 206353bc6b4dSJamal Hadi Salim { 2064fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 206553bc6b4dSJamal Hadi Salim struct xfrm_state *x; 206653bc6b4dSJamal Hadi Salim int err; 20677b67c857SThomas Graf struct xfrm_user_expire *ue = nlmsg_data(nlh); 206853bc6b4dSJamal Hadi Salim struct xfrm_usersa_info *p = &ue->state; 20696f26b61eSJamal Hadi Salim struct xfrm_mark m; 2070928497f0SNicolas Dichtel u32 mark = xfrm_mark_get(attrs, &m); 207153bc6b4dSJamal Hadi Salim 20726f26b61eSJamal Hadi Salim x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family); 207353bc6b4dSJamal Hadi Salim 20743a765aa5SDavid S. Miller err = -ENOENT; 207553bc6b4dSJamal Hadi Salim if (x == NULL) 207653bc6b4dSJamal Hadi Salim return err; 207753bc6b4dSJamal Hadi Salim 207853bc6b4dSJamal Hadi Salim spin_lock_bh(&x->lock); 20793a765aa5SDavid S. Miller err = -EINVAL; 208053bc6b4dSJamal Hadi Salim if (x->km.state != XFRM_STATE_VALID) 208153bc6b4dSJamal Hadi Salim goto out; 2082c6bb8136SEric W. Biederman km_state_expired(x, ue->hard, nlh->nlmsg_pid); 208353bc6b4dSJamal Hadi Salim 2084161a09e7SJoy Latten if (ue->hard) { 208553bc6b4dSJamal Hadi Salim __xfrm_state_delete(x); 20862e71029eSTetsuo Handa xfrm_audit_state_delete(x, 1, true); 2087161a09e7SJoy Latten } 20883a765aa5SDavid S. Miller err = 0; 208953bc6b4dSJamal Hadi Salim out: 209053bc6b4dSJamal Hadi Salim spin_unlock_bh(&x->lock); 209153bc6b4dSJamal Hadi Salim xfrm_state_put(x); 209253bc6b4dSJamal Hadi Salim return err; 209353bc6b4dSJamal Hadi Salim } 209453bc6b4dSJamal Hadi Salim 209522e70050SChristoph Hellwig static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, 20965424f32eSThomas Graf struct nlattr **attrs) 2097980ebd25SJamal Hadi Salim { 2098fc34acd3SAlexey Dobriyan struct net *net = sock_net(skb->sk); 2099980ebd25SJamal Hadi Salim struct xfrm_policy *xp; 2100980ebd25SJamal Hadi Salim struct xfrm_user_tmpl *ut; 2101980ebd25SJamal Hadi Salim int i; 21025424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_TMPL]; 21036f26b61eSJamal Hadi Salim struct xfrm_mark mark; 2104980ebd25SJamal Hadi Salim 21057b67c857SThomas Graf struct xfrm_user_acquire *ua = nlmsg_data(nlh); 2106fc34acd3SAlexey Dobriyan struct xfrm_state *x = xfrm_state_alloc(net); 2107980ebd25SJamal Hadi Salim int err = -ENOMEM; 2108980ebd25SJamal Hadi Salim 2109980ebd25SJamal Hadi Salim if (!x) 2110d8eb9307SIlpo Järvinen goto nomem; 2111980ebd25SJamal Hadi Salim 21126f26b61eSJamal Hadi Salim xfrm_mark_get(attrs, &mark); 21136f26b61eSJamal Hadi Salim 2114980ebd25SJamal Hadi Salim err = verify_newpolicy_info(&ua->policy); 2115d8eb9307SIlpo Järvinen if (err) 2116d8eb9307SIlpo Järvinen goto bad_policy; 2117980ebd25SJamal Hadi Salim 2118980ebd25SJamal Hadi Salim /* build an XP */ 2119fc34acd3SAlexey Dobriyan xp = xfrm_policy_construct(net, &ua->policy, attrs, &err); 2120d8eb9307SIlpo Järvinen if (!xp) 2121d8eb9307SIlpo Järvinen goto free_state; 2122980ebd25SJamal Hadi Salim 2123980ebd25SJamal Hadi Salim memcpy(&x->id, &ua->id, sizeof(ua->id)); 2124980ebd25SJamal Hadi Salim memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr)); 2125980ebd25SJamal Hadi Salim memcpy(&x->sel, &ua->sel, sizeof(ua->sel)); 21266f26b61eSJamal Hadi Salim xp->mark.m = x->mark.m = mark.m; 21276f26b61eSJamal Hadi Salim xp->mark.v = x->mark.v = mark.v; 21285424f32eSThomas Graf ut = nla_data(rt); 2129980ebd25SJamal Hadi Salim /* extract the templates and for each call km_key */ 2130980ebd25SJamal Hadi Salim for (i = 0; i < xp->xfrm_nr; i++, ut++) { 2131980ebd25SJamal Hadi Salim struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 2132980ebd25SJamal Hadi Salim memcpy(&x->id, &t->id, sizeof(x->id)); 2133980ebd25SJamal Hadi Salim x->props.mode = t->mode; 2134980ebd25SJamal Hadi Salim x->props.reqid = t->reqid; 2135980ebd25SJamal Hadi Salim x->props.family = ut->family; 2136980ebd25SJamal Hadi Salim t->aalgos = ua->aalgos; 2137980ebd25SJamal Hadi Salim t->ealgos = ua->ealgos; 2138980ebd25SJamal Hadi Salim t->calgos = ua->calgos; 2139980ebd25SJamal Hadi Salim err = km_query(x, t, xp); 2140980ebd25SJamal Hadi Salim 2141980ebd25SJamal Hadi Salim } 2142980ebd25SJamal Hadi Salim 2143980ebd25SJamal Hadi Salim kfree(x); 2144980ebd25SJamal Hadi Salim kfree(xp); 2145980ebd25SJamal Hadi Salim 2146980ebd25SJamal Hadi Salim return 0; 2147d8eb9307SIlpo Järvinen 2148d8eb9307SIlpo Järvinen bad_policy: 214962db5cfdSstephen hemminger WARN(1, "BAD policy passed\n"); 2150d8eb9307SIlpo Järvinen free_state: 2151d8eb9307SIlpo Järvinen kfree(x); 2152d8eb9307SIlpo Järvinen nomem: 2153d8eb9307SIlpo Järvinen return err; 2154980ebd25SJamal Hadi Salim } 2155980ebd25SJamal Hadi Salim 21565c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 21575c79de6eSShinta Sugimoto static int copy_from_user_migrate(struct xfrm_migrate *ma, 215813c1d189SArnaud Ebalard struct xfrm_kmaddress *k, 21595424f32eSThomas Graf struct nlattr **attrs, int *num) 21605c79de6eSShinta Sugimoto { 21615424f32eSThomas Graf struct nlattr *rt = attrs[XFRMA_MIGRATE]; 21625c79de6eSShinta Sugimoto struct xfrm_user_migrate *um; 21635c79de6eSShinta Sugimoto int i, num_migrate; 21645c79de6eSShinta Sugimoto 216513c1d189SArnaud Ebalard if (k != NULL) { 216613c1d189SArnaud Ebalard struct xfrm_user_kmaddress *uk; 216713c1d189SArnaud Ebalard 216813c1d189SArnaud Ebalard uk = nla_data(attrs[XFRMA_KMADDRESS]); 216913c1d189SArnaud Ebalard memcpy(&k->local, &uk->local, sizeof(k->local)); 217013c1d189SArnaud Ebalard memcpy(&k->remote, &uk->remote, sizeof(k->remote)); 217113c1d189SArnaud Ebalard k->family = uk->family; 217213c1d189SArnaud Ebalard k->reserved = uk->reserved; 217313c1d189SArnaud Ebalard } 217413c1d189SArnaud Ebalard 21755424f32eSThomas Graf um = nla_data(rt); 21765424f32eSThomas Graf num_migrate = nla_len(rt) / sizeof(*um); 21775c79de6eSShinta Sugimoto 21785c79de6eSShinta Sugimoto if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH) 21795c79de6eSShinta Sugimoto return -EINVAL; 21805c79de6eSShinta Sugimoto 21815c79de6eSShinta Sugimoto for (i = 0; i < num_migrate; i++, um++, ma++) { 21825c79de6eSShinta Sugimoto memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr)); 21835c79de6eSShinta Sugimoto memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr)); 21845c79de6eSShinta Sugimoto memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr)); 21855c79de6eSShinta Sugimoto memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr)); 21865c79de6eSShinta Sugimoto 21875c79de6eSShinta Sugimoto ma->proto = um->proto; 21885c79de6eSShinta Sugimoto ma->mode = um->mode; 21895c79de6eSShinta Sugimoto ma->reqid = um->reqid; 21905c79de6eSShinta Sugimoto 21915c79de6eSShinta Sugimoto ma->old_family = um->old_family; 21925c79de6eSShinta Sugimoto ma->new_family = um->new_family; 21935c79de6eSShinta Sugimoto } 21945c79de6eSShinta Sugimoto 21955c79de6eSShinta Sugimoto *num = i; 21965c79de6eSShinta Sugimoto return 0; 21975c79de6eSShinta Sugimoto } 21985c79de6eSShinta Sugimoto 21995c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 22005424f32eSThomas Graf struct nlattr **attrs) 22015c79de6eSShinta Sugimoto { 22027b67c857SThomas Graf struct xfrm_userpolicy_id *pi = nlmsg_data(nlh); 22035c79de6eSShinta Sugimoto struct xfrm_migrate m[XFRM_MAX_DEPTH]; 220413c1d189SArnaud Ebalard struct xfrm_kmaddress km, *kmp; 22055c79de6eSShinta Sugimoto u8 type; 22065c79de6eSShinta Sugimoto int err; 22075c79de6eSShinta Sugimoto int n = 0; 22088d549c4fSFan Du struct net *net = sock_net(skb->sk); 22095c79de6eSShinta Sugimoto 221035a7aa08SThomas Graf if (attrs[XFRMA_MIGRATE] == NULL) 2211cf5cb79fSThomas Graf return -EINVAL; 22125c79de6eSShinta Sugimoto 221313c1d189SArnaud Ebalard kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL; 221413c1d189SArnaud Ebalard 22155424f32eSThomas Graf err = copy_from_user_policy_type(&type, attrs); 22165c79de6eSShinta Sugimoto if (err) 22175c79de6eSShinta Sugimoto return err; 22185c79de6eSShinta Sugimoto 221913c1d189SArnaud Ebalard err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n); 22205c79de6eSShinta Sugimoto if (err) 22215c79de6eSShinta Sugimoto return err; 22225c79de6eSShinta Sugimoto 22235c79de6eSShinta Sugimoto if (!n) 22245c79de6eSShinta Sugimoto return 0; 22255c79de6eSShinta Sugimoto 22268d549c4fSFan Du xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net); 22275c79de6eSShinta Sugimoto 22285c79de6eSShinta Sugimoto return 0; 22295c79de6eSShinta Sugimoto } 22305c79de6eSShinta Sugimoto #else 22315c79de6eSShinta Sugimoto static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 22325424f32eSThomas Graf struct nlattr **attrs) 22335c79de6eSShinta Sugimoto { 22345c79de6eSShinta Sugimoto return -ENOPROTOOPT; 22355c79de6eSShinta Sugimoto } 22365c79de6eSShinta Sugimoto #endif 22375c79de6eSShinta Sugimoto 22385c79de6eSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 2239183cad12SDavid S. Miller static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb) 22405c79de6eSShinta Sugimoto { 22415c79de6eSShinta Sugimoto struct xfrm_user_migrate um; 22425c79de6eSShinta Sugimoto 22435c79de6eSShinta Sugimoto memset(&um, 0, sizeof(um)); 22445c79de6eSShinta Sugimoto um.proto = m->proto; 22455c79de6eSShinta Sugimoto um.mode = m->mode; 22465c79de6eSShinta Sugimoto um.reqid = m->reqid; 22475c79de6eSShinta Sugimoto um.old_family = m->old_family; 22485c79de6eSShinta Sugimoto memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr)); 22495c79de6eSShinta Sugimoto memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr)); 22505c79de6eSShinta Sugimoto um.new_family = m->new_family; 22515c79de6eSShinta Sugimoto memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr)); 22525c79de6eSShinta Sugimoto memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr)); 22535c79de6eSShinta Sugimoto 2254c0144beaSThomas Graf return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um); 22555c79de6eSShinta Sugimoto } 22565c79de6eSShinta Sugimoto 2257183cad12SDavid S. Miller static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb) 225813c1d189SArnaud Ebalard { 225913c1d189SArnaud Ebalard struct xfrm_user_kmaddress uk; 226013c1d189SArnaud Ebalard 226113c1d189SArnaud Ebalard memset(&uk, 0, sizeof(uk)); 226213c1d189SArnaud Ebalard uk.family = k->family; 226313c1d189SArnaud Ebalard uk.reserved = k->reserved; 226413c1d189SArnaud Ebalard memcpy(&uk.local, &k->local, sizeof(uk.local)); 2265a1caa322SArnaud Ebalard memcpy(&uk.remote, &k->remote, sizeof(uk.remote)); 226613c1d189SArnaud Ebalard 226713c1d189SArnaud Ebalard return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk); 226813c1d189SArnaud Ebalard } 226913c1d189SArnaud Ebalard 227013c1d189SArnaud Ebalard static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma) 22717deb2264SThomas Graf { 22727deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id)) 227313c1d189SArnaud Ebalard + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0) 22747deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate) 22757deb2264SThomas Graf + userpolicy_type_attrsize(); 22767deb2264SThomas Graf } 22777deb2264SThomas Graf 2278183cad12SDavid S. Miller static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m, 2279183cad12SDavid S. Miller int num_migrate, const struct xfrm_kmaddress *k, 2280183cad12SDavid S. Miller const struct xfrm_selector *sel, u8 dir, u8 type) 22815c79de6eSShinta Sugimoto { 2282183cad12SDavid S. Miller const struct xfrm_migrate *mp; 22835c79de6eSShinta Sugimoto struct xfrm_userpolicy_id *pol_id; 22845c79de6eSShinta Sugimoto struct nlmsghdr *nlh; 22851d1e34ddSDavid S. Miller int i, err; 22865c79de6eSShinta Sugimoto 228779b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0); 228879b8b7f4SThomas Graf if (nlh == NULL) 228979b8b7f4SThomas Graf return -EMSGSIZE; 22905c79de6eSShinta Sugimoto 22917b67c857SThomas Graf pol_id = nlmsg_data(nlh); 22925c79de6eSShinta Sugimoto /* copy data from selector, dir, and type to the pol_id */ 22935c79de6eSShinta Sugimoto memset(pol_id, 0, sizeof(*pol_id)); 22945c79de6eSShinta Sugimoto memcpy(&pol_id->sel, sel, sizeof(pol_id->sel)); 22955c79de6eSShinta Sugimoto pol_id->dir = dir; 22965c79de6eSShinta Sugimoto 22971d1e34ddSDavid S. Miller if (k != NULL) { 22981d1e34ddSDavid S. Miller err = copy_to_user_kmaddress(k, skb); 22991d1e34ddSDavid S. Miller if (err) 23001d1e34ddSDavid S. Miller goto out_cancel; 23011d1e34ddSDavid S. Miller } 23021d1e34ddSDavid S. Miller err = copy_to_user_policy_type(type, skb); 23031d1e34ddSDavid S. Miller if (err) 23041d1e34ddSDavid S. Miller goto out_cancel; 23055c79de6eSShinta Sugimoto for (i = 0, mp = m ; i < num_migrate; i++, mp++) { 23061d1e34ddSDavid S. Miller err = copy_to_user_migrate(mp, skb); 23071d1e34ddSDavid S. Miller if (err) 23081d1e34ddSDavid S. Miller goto out_cancel; 23095c79de6eSShinta Sugimoto } 23105c79de6eSShinta Sugimoto 2311053c095aSJohannes Berg nlmsg_end(skb, nlh); 2312053c095aSJohannes Berg return 0; 23131d1e34ddSDavid S. Miller 23141d1e34ddSDavid S. Miller out_cancel: 23159825069dSThomas Graf nlmsg_cancel(skb, nlh); 23161d1e34ddSDavid S. Miller return err; 23175c79de6eSShinta Sugimoto } 23185c79de6eSShinta Sugimoto 2319183cad12SDavid S. Miller static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 2320183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_migrate, 2321183cad12SDavid S. Miller const struct xfrm_kmaddress *k) 23225c79de6eSShinta Sugimoto { 2323a6483b79SAlexey Dobriyan struct net *net = &init_net; 23245c79de6eSShinta Sugimoto struct sk_buff *skb; 23255c79de6eSShinta Sugimoto 232613c1d189SArnaud Ebalard skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC); 23275c79de6eSShinta Sugimoto if (skb == NULL) 23285c79de6eSShinta Sugimoto return -ENOMEM; 23295c79de6eSShinta Sugimoto 23305c79de6eSShinta Sugimoto /* build migrate */ 233113c1d189SArnaud Ebalard if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0) 23325c79de6eSShinta Sugimoto BUG(); 23335c79de6eSShinta Sugimoto 233421ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE); 23355c79de6eSShinta Sugimoto } 23365c79de6eSShinta Sugimoto #else 2337183cad12SDavid S. Miller static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 2338183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_migrate, 2339183cad12SDavid S. Miller const struct xfrm_kmaddress *k) 23405c79de6eSShinta Sugimoto { 23415c79de6eSShinta Sugimoto return -ENOPROTOOPT; 23425c79de6eSShinta Sugimoto } 23435c79de6eSShinta Sugimoto #endif 2344d51d081dSJamal Hadi Salim 2345a7bd9a45SThomas Graf #define XMSGSIZE(type) sizeof(struct type) 2346492b558bSThomas Graf 2347492b558bSThomas Graf static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = { 234866f9a259SDavid S. Miller [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 2349492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 2350492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 2351492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 2352492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 2353492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 2354492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info), 2355980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire), 235653bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire), 2357492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 235866f9a259SDavid S. Miller [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 23596c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire), 2360492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush), 2361a7bd9a45SThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0, 2362d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 2363d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 236497a64b45SMasahide NAKAMURA [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report), 23655c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 2366a7bd9a45SThomas Graf [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32), 2367880a6fabSChristophe Gouault [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 2368a7bd9a45SThomas Graf [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 23691da177e4SLinus Torvalds }; 23701da177e4SLinus Torvalds 2371492b558bSThomas Graf #undef XMSGSIZE 2372492b558bSThomas Graf 2373cf5cb79fSThomas Graf static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { 2374c28e9304Sjamal [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)}, 2375c28e9304Sjamal [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)}, 2376c28e9304Sjamal [XFRMA_LASTUSED] = { .type = NLA_U64}, 2377c28e9304Sjamal [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)}, 23781a6509d9SHerbert Xu [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) }, 2379cf5cb79fSThomas Graf [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) }, 2380cf5cb79fSThomas Graf [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) }, 2381cf5cb79fSThomas Graf [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, 2382cf5cb79fSThomas Graf [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, 2383cf5cb79fSThomas Graf [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, 2384cf5cb79fSThomas Graf [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) }, 2385cf5cb79fSThomas Graf [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, 2386cf5cb79fSThomas Graf [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, 2387cf5cb79fSThomas Graf [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 }, 2388cf5cb79fSThomas Graf [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 }, 2389cf5cb79fSThomas Graf [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) }, 2390cf5cb79fSThomas Graf [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) }, 2391cf5cb79fSThomas Graf [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)}, 2392cf5cb79fSThomas Graf [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, 239313c1d189SArnaud Ebalard [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) }, 23946f26b61eSJamal Hadi Salim [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) }, 239535d2856bSMartin Willi [XFRMA_TFCPAD] = { .type = NLA_U32 }, 2396d8647b79SSteffen Klassert [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) }, 2397a947b0a9SNicolas Dichtel [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 }, 2398d3623099SNicolas Dichtel [XFRMA_PROTO] = { .type = NLA_U8 }, 2399870a2df4SNicolas Dichtel [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) }, 2400cf5cb79fSThomas Graf }; 2401cf5cb79fSThomas Graf 2402880a6fabSChristophe Gouault static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = { 2403880a6fabSChristophe Gouault [XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 2404880a6fabSChristophe Gouault [XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 2405880a6fabSChristophe Gouault }; 2406880a6fabSChristophe Gouault 240705600a79SMathias Krause static const struct xfrm_link { 24085424f32eSThomas Graf int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **); 24091da177e4SLinus Torvalds int (*dump)(struct sk_buff *, struct netlink_callback *); 24104c563f76STimo Teras int (*done)(struct netlink_callback *); 2411880a6fabSChristophe Gouault const struct nla_policy *nla_pol; 2412880a6fabSChristophe Gouault int nla_max; 2413492b558bSThomas Graf } xfrm_dispatch[XFRM_NR_MSGTYPES] = { 2414492b558bSThomas Graf [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 2415492b558bSThomas Graf [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa }, 2416492b558bSThomas Graf [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa, 24174c563f76STimo Teras .dump = xfrm_dump_sa, 24184c563f76STimo Teras .done = xfrm_dump_sa_done }, 2419492b558bSThomas Graf [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 2420492b558bSThomas Graf [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy }, 2421492b558bSThomas Graf [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy, 24224c563f76STimo Teras .dump = xfrm_dump_policy, 24234c563f76STimo Teras .done = xfrm_dump_policy_done }, 2424492b558bSThomas Graf [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi }, 2425980ebd25SJamal Hadi Salim [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire }, 242653bc6b4dSJamal Hadi Salim [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire }, 2427492b558bSThomas Graf [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 2428492b558bSThomas Graf [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 24296c5c8ca7SJamal Hadi Salim [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire}, 2430492b558bSThomas Graf [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa }, 2431492b558bSThomas Graf [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy }, 2432d51d081dSJamal Hadi Salim [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae }, 2433d51d081dSJamal Hadi Salim [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae }, 24345c79de6eSShinta Sugimoto [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate }, 243528d8909bSJamal Hadi Salim [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo }, 2436880a6fabSChristophe Gouault [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo, 2437880a6fabSChristophe Gouault .nla_pol = xfrma_spd_policy, 2438880a6fabSChristophe Gouault .nla_max = XFRMA_SPD_MAX }, 2439ecfd6b18SJamal Hadi Salim [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo }, 24401da177e4SLinus Torvalds }; 24411da177e4SLinus Torvalds 24421d00a4ebSThomas Graf static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 24431da177e4SLinus Torvalds { 2444a6483b79SAlexey Dobriyan struct net *net = sock_net(skb->sk); 244535a7aa08SThomas Graf struct nlattr *attrs[XFRMA_MAX+1]; 244605600a79SMathias Krause const struct xfrm_link *link; 2447a7bd9a45SThomas Graf int type, err; 24481da177e4SLinus Torvalds 244974005991SFan Du #ifdef CONFIG_COMPAT 245074005991SFan Du if (is_compat_task()) 245174005991SFan Du return -ENOTSUPP; 245274005991SFan Du #endif 245374005991SFan Du 24541da177e4SLinus Torvalds type = nlh->nlmsg_type; 24551da177e4SLinus Torvalds if (type > XFRM_MSG_MAX) 24561d00a4ebSThomas Graf return -EINVAL; 24571da177e4SLinus Torvalds 24581da177e4SLinus Torvalds type -= XFRM_MSG_BASE; 24591da177e4SLinus Torvalds link = &xfrm_dispatch[type]; 24601da177e4SLinus Torvalds 24611da177e4SLinus Torvalds /* All operations require privileges, even GET */ 246290f62cf3SEric W. Biederman if (!netlink_net_capable(skb, CAP_NET_ADMIN)) 24631d00a4ebSThomas Graf return -EPERM; 24641da177e4SLinus Torvalds 2465492b558bSThomas Graf if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || 2466492b558bSThomas Graf type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) && 2467b8f3ab42SDavid S. Miller (nlh->nlmsg_flags & NLM_F_DUMP)) { 24681da177e4SLinus Torvalds if (link->dump == NULL) 24691d00a4ebSThomas Graf return -EINVAL; 24701da177e4SLinus Torvalds 247180d326faSPablo Neira Ayuso { 247280d326faSPablo Neira Ayuso struct netlink_dump_control c = { 247380d326faSPablo Neira Ayuso .dump = link->dump, 247480d326faSPablo Neira Ayuso .done = link->done, 247580d326faSPablo Neira Ayuso }; 247680d326faSPablo Neira Ayuso return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c); 247780d326faSPablo Neira Ayuso } 24781da177e4SLinus Torvalds } 24791da177e4SLinus Torvalds 2480880a6fabSChristophe Gouault err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, 2481880a6fabSChristophe Gouault link->nla_max ? : XFRMA_MAX, 2482880a6fabSChristophe Gouault link->nla_pol ? : xfrma_policy); 2483a7bd9a45SThomas Graf if (err < 0) 2484a7bd9a45SThomas Graf return err; 24851da177e4SLinus Torvalds 24861da177e4SLinus Torvalds if (link->doit == NULL) 24871d00a4ebSThomas Graf return -EINVAL; 24881da177e4SLinus Torvalds 24895424f32eSThomas Graf return link->doit(skb, nlh, attrs); 24901da177e4SLinus Torvalds } 24911da177e4SLinus Torvalds 2492cd40b7d3SDenis V. Lunev static void xfrm_netlink_rcv(struct sk_buff *skb) 24931da177e4SLinus Torvalds { 2494283bc9f3SFan Du struct net *net = sock_net(skb->sk); 2495283bc9f3SFan Du 2496283bc9f3SFan Du mutex_lock(&net->xfrm.xfrm_cfg_mutex); 2497cd40b7d3SDenis V. Lunev netlink_rcv_skb(skb, &xfrm_user_rcv_msg); 2498283bc9f3SFan Du mutex_unlock(&net->xfrm.xfrm_cfg_mutex); 24991da177e4SLinus Torvalds } 25001da177e4SLinus Torvalds 25017deb2264SThomas Graf static inline size_t xfrm_expire_msgsize(void) 25027deb2264SThomas Graf { 25036f26b61eSJamal Hadi Salim return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) 25046f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)); 25057deb2264SThomas Graf } 25067deb2264SThomas Graf 2507214e005bSDavid S. Miller static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 25081da177e4SLinus Torvalds { 25091da177e4SLinus Torvalds struct xfrm_user_expire *ue; 25101da177e4SLinus Torvalds struct nlmsghdr *nlh; 25111d1e34ddSDavid S. Miller int err; 25121da177e4SLinus Torvalds 251315e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0); 251479b8b7f4SThomas Graf if (nlh == NULL) 251579b8b7f4SThomas Graf return -EMSGSIZE; 25161da177e4SLinus Torvalds 25177b67c857SThomas Graf ue = nlmsg_data(nlh); 25181da177e4SLinus Torvalds copy_to_user_state(x, &ue->state); 2519d51d081dSJamal Hadi Salim ue->hard = (c->data.hard != 0) ? 1 : 0; 25201da177e4SLinus Torvalds 25211d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &x->mark); 25221d1e34ddSDavid S. Miller if (err) 25231d1e34ddSDavid S. Miller return err; 25246f26b61eSJamal Hadi Salim 2525053c095aSJohannes Berg nlmsg_end(skb, nlh); 2526053c095aSJohannes Berg return 0; 25271da177e4SLinus Torvalds } 25281da177e4SLinus Torvalds 2529214e005bSDavid S. Miller static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c) 25301da177e4SLinus Torvalds { 2531fc34acd3SAlexey Dobriyan struct net *net = xs_net(x); 25321da177e4SLinus Torvalds struct sk_buff *skb; 25331da177e4SLinus Torvalds 25347deb2264SThomas Graf skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC); 25351da177e4SLinus Torvalds if (skb == NULL) 25361da177e4SLinus Torvalds return -ENOMEM; 25371da177e4SLinus Torvalds 25386f26b61eSJamal Hadi Salim if (build_expire(skb, x, c) < 0) { 25396f26b61eSJamal Hadi Salim kfree_skb(skb); 25406f26b61eSJamal Hadi Salim return -EMSGSIZE; 25416f26b61eSJamal Hadi Salim } 25421da177e4SLinus Torvalds 254321ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 25441da177e4SLinus Torvalds } 25451da177e4SLinus Torvalds 2546214e005bSDavid S. Miller static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c) 2547d51d081dSJamal Hadi Salim { 2548fc34acd3SAlexey Dobriyan struct net *net = xs_net(x); 2549d51d081dSJamal Hadi Salim struct sk_buff *skb; 2550d51d081dSJamal Hadi Salim 2551d8647b79SSteffen Klassert skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 2552d51d081dSJamal Hadi Salim if (skb == NULL) 2553d51d081dSJamal Hadi Salim return -ENOMEM; 2554d51d081dSJamal Hadi Salim 2555d51d081dSJamal Hadi Salim if (build_aevent(skb, x, c) < 0) 2556d51d081dSJamal Hadi Salim BUG(); 2557d51d081dSJamal Hadi Salim 255821ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS); 2559d51d081dSJamal Hadi Salim } 2560d51d081dSJamal Hadi Salim 2561214e005bSDavid S. Miller static int xfrm_notify_sa_flush(const struct km_event *c) 256226b15dadSJamal Hadi Salim { 25637067802eSAlexey Dobriyan struct net *net = c->net; 256426b15dadSJamal Hadi Salim struct xfrm_usersa_flush *p; 256526b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 256626b15dadSJamal Hadi Salim struct sk_buff *skb; 25677deb2264SThomas Graf int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush)); 256826b15dadSJamal Hadi Salim 25697deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 257026b15dadSJamal Hadi Salim if (skb == NULL) 257126b15dadSJamal Hadi Salim return -ENOMEM; 257226b15dadSJamal Hadi Salim 257315e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0); 257479b8b7f4SThomas Graf if (nlh == NULL) { 257579b8b7f4SThomas Graf kfree_skb(skb); 257679b8b7f4SThomas Graf return -EMSGSIZE; 257779b8b7f4SThomas Graf } 257826b15dadSJamal Hadi Salim 25797b67c857SThomas Graf p = nlmsg_data(nlh); 2580bf08867fSHerbert Xu p->proto = c->data.proto; 258126b15dadSJamal Hadi Salim 25829825069dSThomas Graf nlmsg_end(skb, nlh); 258326b15dadSJamal Hadi Salim 258421ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 258526b15dadSJamal Hadi Salim } 258626b15dadSJamal Hadi Salim 25877deb2264SThomas Graf static inline size_t xfrm_sa_len(struct xfrm_state *x) 258826b15dadSJamal Hadi Salim { 25897deb2264SThomas Graf size_t l = 0; 25901a6509d9SHerbert Xu if (x->aead) 25911a6509d9SHerbert Xu l += nla_total_size(aead_len(x->aead)); 25924447bb33SMartin Willi if (x->aalg) { 25934447bb33SMartin Willi l += nla_total_size(sizeof(struct xfrm_algo) + 25944447bb33SMartin Willi (x->aalg->alg_key_len + 7) / 8); 25954447bb33SMartin Willi l += nla_total_size(xfrm_alg_auth_len(x->aalg)); 25964447bb33SMartin Willi } 259726b15dadSJamal Hadi Salim if (x->ealg) 25980f99be0dSEric Dumazet l += nla_total_size(xfrm_alg_len(x->ealg)); 259926b15dadSJamal Hadi Salim if (x->calg) 26007deb2264SThomas Graf l += nla_total_size(sizeof(*x->calg)); 260126b15dadSJamal Hadi Salim if (x->encap) 26027deb2264SThomas Graf l += nla_total_size(sizeof(*x->encap)); 260335d2856bSMartin Willi if (x->tfcpad) 260435d2856bSMartin Willi l += nla_total_size(sizeof(x->tfcpad)); 2605d8647b79SSteffen Klassert if (x->replay_esn) 2606d8647b79SSteffen Klassert l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn)); 2607f293a5e3Sdingzhi else 2608f293a5e3Sdingzhi l += nla_total_size(sizeof(struct xfrm_replay_state)); 260968325d3bSHerbert Xu if (x->security) 261068325d3bSHerbert Xu l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) + 261168325d3bSHerbert Xu x->security->ctx_len); 261268325d3bSHerbert Xu if (x->coaddr) 261368325d3bSHerbert Xu l += nla_total_size(sizeof(*x->coaddr)); 2614a947b0a9SNicolas Dichtel if (x->props.extra_flags) 2615a947b0a9SNicolas Dichtel l += nla_total_size(sizeof(x->props.extra_flags)); 261668325d3bSHerbert Xu 2617d26f3984SHerbert Xu /* Must count x->lastused as it may become non-zero behind our back. */ 2618d26f3984SHerbert Xu l += nla_total_size(sizeof(u64)); 261926b15dadSJamal Hadi Salim 262026b15dadSJamal Hadi Salim return l; 262126b15dadSJamal Hadi Salim } 262226b15dadSJamal Hadi Salim 2623214e005bSDavid S. Miller static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c) 262426b15dadSJamal Hadi Salim { 2625fc34acd3SAlexey Dobriyan struct net *net = xs_net(x); 262626b15dadSJamal Hadi Salim struct xfrm_usersa_info *p; 26270603eac0SHerbert Xu struct xfrm_usersa_id *id; 262826b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 262926b15dadSJamal Hadi Salim struct sk_buff *skb; 263026b15dadSJamal Hadi Salim int len = xfrm_sa_len(x); 26311d1e34ddSDavid S. Miller int headlen, err; 26320603eac0SHerbert Xu 26330603eac0SHerbert Xu headlen = sizeof(*p); 26340603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) { 26357deb2264SThomas Graf len += nla_total_size(headlen); 26360603eac0SHerbert Xu headlen = sizeof(*id); 26376f26b61eSJamal Hadi Salim len += nla_total_size(sizeof(struct xfrm_mark)); 26380603eac0SHerbert Xu } 26397deb2264SThomas Graf len += NLMSG_ALIGN(headlen); 264026b15dadSJamal Hadi Salim 26417deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 264226b15dadSJamal Hadi Salim if (skb == NULL) 264326b15dadSJamal Hadi Salim return -ENOMEM; 264426b15dadSJamal Hadi Salim 264515e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 26461d1e34ddSDavid S. Miller err = -EMSGSIZE; 264779b8b7f4SThomas Graf if (nlh == NULL) 26481d1e34ddSDavid S. Miller goto out_free_skb; 264926b15dadSJamal Hadi Salim 26507b67c857SThomas Graf p = nlmsg_data(nlh); 26510603eac0SHerbert Xu if (c->event == XFRM_MSG_DELSA) { 2652c0144beaSThomas Graf struct nlattr *attr; 2653c0144beaSThomas Graf 26547b67c857SThomas Graf id = nlmsg_data(nlh); 26550603eac0SHerbert Xu memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr)); 26560603eac0SHerbert Xu id->spi = x->id.spi; 26570603eac0SHerbert Xu id->family = x->props.family; 26580603eac0SHerbert Xu id->proto = x->id.proto; 26590603eac0SHerbert Xu 2660c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_SA, sizeof(*p)); 26611d1e34ddSDavid S. Miller err = -EMSGSIZE; 2662c0144beaSThomas Graf if (attr == NULL) 26631d1e34ddSDavid S. Miller goto out_free_skb; 2664c0144beaSThomas Graf 2665c0144beaSThomas Graf p = nla_data(attr); 26660603eac0SHerbert Xu } 26671d1e34ddSDavid S. Miller err = copy_to_user_state_extra(x, p, skb); 26681d1e34ddSDavid S. Miller if (err) 26691d1e34ddSDavid S. Miller goto out_free_skb; 267026b15dadSJamal Hadi Salim 26719825069dSThomas Graf nlmsg_end(skb, nlh); 267226b15dadSJamal Hadi Salim 267321ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 267426b15dadSJamal Hadi Salim 26751d1e34ddSDavid S. Miller out_free_skb: 267626b15dadSJamal Hadi Salim kfree_skb(skb); 26771d1e34ddSDavid S. Miller return err; 267826b15dadSJamal Hadi Salim } 267926b15dadSJamal Hadi Salim 2680214e005bSDavid S. Miller static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c) 268126b15dadSJamal Hadi Salim { 268226b15dadSJamal Hadi Salim 268326b15dadSJamal Hadi Salim switch (c->event) { 2684f60f6b8fSHerbert Xu case XFRM_MSG_EXPIRE: 268526b15dadSJamal Hadi Salim return xfrm_exp_state_notify(x, c); 2686d51d081dSJamal Hadi Salim case XFRM_MSG_NEWAE: 2687d51d081dSJamal Hadi Salim return xfrm_aevent_state_notify(x, c); 2688f60f6b8fSHerbert Xu case XFRM_MSG_DELSA: 2689f60f6b8fSHerbert Xu case XFRM_MSG_UPDSA: 2690f60f6b8fSHerbert Xu case XFRM_MSG_NEWSA: 269126b15dadSJamal Hadi Salim return xfrm_notify_sa(x, c); 2692f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHSA: 269326b15dadSJamal Hadi Salim return xfrm_notify_sa_flush(c); 269426b15dadSJamal Hadi Salim default: 269562db5cfdSstephen hemminger printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n", 269662db5cfdSstephen hemminger c->event); 269726b15dadSJamal Hadi Salim break; 269826b15dadSJamal Hadi Salim } 269926b15dadSJamal Hadi Salim 270026b15dadSJamal Hadi Salim return 0; 270126b15dadSJamal Hadi Salim 270226b15dadSJamal Hadi Salim } 270326b15dadSJamal Hadi Salim 27047deb2264SThomas Graf static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x, 27057deb2264SThomas Graf struct xfrm_policy *xp) 27067deb2264SThomas Graf { 27077deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire)) 27087deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 27096f26b61eSJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)) 27107deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(x->security)) 27117deb2264SThomas Graf + userpolicy_type_attrsize(); 27127deb2264SThomas Graf } 27137deb2264SThomas Graf 27141da177e4SLinus Torvalds static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, 271565e0736bSFan Du struct xfrm_tmpl *xt, struct xfrm_policy *xp) 27161da177e4SLinus Torvalds { 27171d1e34ddSDavid S. Miller __u32 seq = xfrm_get_acqseq(); 27181da177e4SLinus Torvalds struct xfrm_user_acquire *ua; 27191da177e4SLinus Torvalds struct nlmsghdr *nlh; 27201d1e34ddSDavid S. Miller int err; 27211da177e4SLinus Torvalds 272279b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0); 272379b8b7f4SThomas Graf if (nlh == NULL) 272479b8b7f4SThomas Graf return -EMSGSIZE; 27251da177e4SLinus Torvalds 27267b67c857SThomas Graf ua = nlmsg_data(nlh); 27271da177e4SLinus Torvalds memcpy(&ua->id, &x->id, sizeof(ua->id)); 27281da177e4SLinus Torvalds memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr)); 27291da177e4SLinus Torvalds memcpy(&ua->sel, &x->sel, sizeof(ua->sel)); 273065e0736bSFan Du copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT); 27311da177e4SLinus Torvalds ua->aalgos = xt->aalgos; 27321da177e4SLinus Torvalds ua->ealgos = xt->ealgos; 27331da177e4SLinus Torvalds ua->calgos = xt->calgos; 27341da177e4SLinus Torvalds ua->seq = x->km.seq = seq; 27351da177e4SLinus Torvalds 27361d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 27371d1e34ddSDavid S. Miller if (!err) 27381d1e34ddSDavid S. Miller err = copy_to_user_state_sec_ctx(x, skb); 27391d1e34ddSDavid S. Miller if (!err) 27401d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 27411d1e34ddSDavid S. Miller if (!err) 27421d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 27431d1e34ddSDavid S. Miller if (err) { 27441d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 27451d1e34ddSDavid S. Miller return err; 27461d1e34ddSDavid S. Miller } 27471da177e4SLinus Torvalds 2748053c095aSJohannes Berg nlmsg_end(skb, nlh); 2749053c095aSJohannes Berg return 0; 27501da177e4SLinus Torvalds } 27511da177e4SLinus Torvalds 27521da177e4SLinus Torvalds static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt, 275365e0736bSFan Du struct xfrm_policy *xp) 27541da177e4SLinus Torvalds { 2755a6483b79SAlexey Dobriyan struct net *net = xs_net(x); 27561da177e4SLinus Torvalds struct sk_buff *skb; 27571da177e4SLinus Torvalds 27587deb2264SThomas Graf skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC); 27591da177e4SLinus Torvalds if (skb == NULL) 27601da177e4SLinus Torvalds return -ENOMEM; 27611da177e4SLinus Torvalds 276265e0736bSFan Du if (build_acquire(skb, x, xt, xp) < 0) 27631da177e4SLinus Torvalds BUG(); 27641da177e4SLinus Torvalds 276521ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE); 27661da177e4SLinus Torvalds } 27671da177e4SLinus Torvalds 27681da177e4SLinus Torvalds /* User gives us xfrm_user_policy_info followed by an array of 0 27691da177e4SLinus Torvalds * or more templates. 27701da177e4SLinus Torvalds */ 2771cb969f07SVenkat Yekkirala static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt, 27721da177e4SLinus Torvalds u8 *data, int len, int *dir) 27731da177e4SLinus Torvalds { 2774fc34acd3SAlexey Dobriyan struct net *net = sock_net(sk); 27751da177e4SLinus Torvalds struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data; 27761da177e4SLinus Torvalds struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1); 27771da177e4SLinus Torvalds struct xfrm_policy *xp; 27781da177e4SLinus Torvalds int nr; 27791da177e4SLinus Torvalds 2780cb969f07SVenkat Yekkirala switch (sk->sk_family) { 27811da177e4SLinus Torvalds case AF_INET: 27821da177e4SLinus Torvalds if (opt != IP_XFRM_POLICY) { 27831da177e4SLinus Torvalds *dir = -EOPNOTSUPP; 27841da177e4SLinus Torvalds return NULL; 27851da177e4SLinus Torvalds } 27861da177e4SLinus Torvalds break; 2787dfd56b8bSEric Dumazet #if IS_ENABLED(CONFIG_IPV6) 27881da177e4SLinus Torvalds case AF_INET6: 27891da177e4SLinus Torvalds if (opt != IPV6_XFRM_POLICY) { 27901da177e4SLinus Torvalds *dir = -EOPNOTSUPP; 27911da177e4SLinus Torvalds return NULL; 27921da177e4SLinus Torvalds } 27931da177e4SLinus Torvalds break; 27941da177e4SLinus Torvalds #endif 27951da177e4SLinus Torvalds default: 27961da177e4SLinus Torvalds *dir = -EINVAL; 27971da177e4SLinus Torvalds return NULL; 27981da177e4SLinus Torvalds } 27991da177e4SLinus Torvalds 28001da177e4SLinus Torvalds *dir = -EINVAL; 28011da177e4SLinus Torvalds 28021da177e4SLinus Torvalds if (len < sizeof(*p) || 28031da177e4SLinus Torvalds verify_newpolicy_info(p)) 28041da177e4SLinus Torvalds return NULL; 28051da177e4SLinus Torvalds 28061da177e4SLinus Torvalds nr = ((len - sizeof(*p)) / sizeof(*ut)); 2807b4ad86bfSDavid S. Miller if (validate_tmpl(nr, ut, p->sel.family)) 28081da177e4SLinus Torvalds return NULL; 28091da177e4SLinus Torvalds 2810a4f1bac6SHerbert Xu if (p->dir > XFRM_POLICY_OUT) 2811a4f1bac6SHerbert Xu return NULL; 2812a4f1bac6SHerbert Xu 28132f09a4d5SHerbert Xu xp = xfrm_policy_alloc(net, GFP_ATOMIC); 28141da177e4SLinus Torvalds if (xp == NULL) { 28151da177e4SLinus Torvalds *dir = -ENOBUFS; 28161da177e4SLinus Torvalds return NULL; 28171da177e4SLinus Torvalds } 28181da177e4SLinus Torvalds 28191da177e4SLinus Torvalds copy_from_user_policy(xp, p); 2820f7b6983fSMasahide NAKAMURA xp->type = XFRM_POLICY_TYPE_MAIN; 28211da177e4SLinus Torvalds copy_templates(xp, ut, nr); 28221da177e4SLinus Torvalds 28231da177e4SLinus Torvalds *dir = p->dir; 28241da177e4SLinus Torvalds 28251da177e4SLinus Torvalds return xp; 28261da177e4SLinus Torvalds } 28271da177e4SLinus Torvalds 28287deb2264SThomas Graf static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp) 28297deb2264SThomas Graf { 28307deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire)) 28317deb2264SThomas Graf + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 28327deb2264SThomas Graf + nla_total_size(xfrm_user_sec_ctx_size(xp->security)) 2833295fae56SJamal Hadi Salim + nla_total_size(sizeof(struct xfrm_mark)) 28347deb2264SThomas Graf + userpolicy_type_attrsize(); 28357deb2264SThomas Graf } 28367deb2264SThomas Graf 28371da177e4SLinus Torvalds static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, 2838214e005bSDavid S. Miller int dir, const struct km_event *c) 28391da177e4SLinus Torvalds { 28401da177e4SLinus Torvalds struct xfrm_user_polexpire *upe; 2841d51d081dSJamal Hadi Salim int hard = c->data.hard; 28421d1e34ddSDavid S. Miller struct nlmsghdr *nlh; 28431d1e34ddSDavid S. Miller int err; 28441da177e4SLinus Torvalds 284515e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0); 284679b8b7f4SThomas Graf if (nlh == NULL) 284779b8b7f4SThomas Graf return -EMSGSIZE; 28481da177e4SLinus Torvalds 28497b67c857SThomas Graf upe = nlmsg_data(nlh); 28501da177e4SLinus Torvalds copy_to_user_policy(xp, &upe->pol, dir); 28511d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 28521d1e34ddSDavid S. Miller if (!err) 28531d1e34ddSDavid S. Miller err = copy_to_user_sec_ctx(xp, skb); 28541d1e34ddSDavid S. Miller if (!err) 28551d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 28561d1e34ddSDavid S. Miller if (!err) 28571d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 28581d1e34ddSDavid S. Miller if (err) { 28591d1e34ddSDavid S. Miller nlmsg_cancel(skb, nlh); 28601d1e34ddSDavid S. Miller return err; 28611d1e34ddSDavid S. Miller } 28621da177e4SLinus Torvalds upe->hard = !!hard; 28631da177e4SLinus Torvalds 2864053c095aSJohannes Berg nlmsg_end(skb, nlh); 2865053c095aSJohannes Berg return 0; 28661da177e4SLinus Torvalds } 28671da177e4SLinus Torvalds 2868214e005bSDavid S. Miller static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 28691da177e4SLinus Torvalds { 2870fc34acd3SAlexey Dobriyan struct net *net = xp_net(xp); 28711da177e4SLinus Torvalds struct sk_buff *skb; 28721da177e4SLinus Torvalds 28737deb2264SThomas Graf skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC); 28741da177e4SLinus Torvalds if (skb == NULL) 28751da177e4SLinus Torvalds return -ENOMEM; 28761da177e4SLinus Torvalds 2877d51d081dSJamal Hadi Salim if (build_polexpire(skb, xp, dir, c) < 0) 28781da177e4SLinus Torvalds BUG(); 28791da177e4SLinus Torvalds 288021ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 28811da177e4SLinus Torvalds } 28821da177e4SLinus Torvalds 2883214e005bSDavid S. Miller static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c) 288426b15dadSJamal Hadi Salim { 28851d1e34ddSDavid S. Miller int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 2886fc34acd3SAlexey Dobriyan struct net *net = xp_net(xp); 288726b15dadSJamal Hadi Salim struct xfrm_userpolicy_info *p; 28880603eac0SHerbert Xu struct xfrm_userpolicy_id *id; 288926b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 289026b15dadSJamal Hadi Salim struct sk_buff *skb; 28911d1e34ddSDavid S. Miller int headlen, err; 28920603eac0SHerbert Xu 28930603eac0SHerbert Xu headlen = sizeof(*p); 28940603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) { 28957deb2264SThomas Graf len += nla_total_size(headlen); 28960603eac0SHerbert Xu headlen = sizeof(*id); 28970603eac0SHerbert Xu } 2898cfbfd45aSThomas Graf len += userpolicy_type_attrsize(); 2899295fae56SJamal Hadi Salim len += nla_total_size(sizeof(struct xfrm_mark)); 29007deb2264SThomas Graf len += NLMSG_ALIGN(headlen); 290126b15dadSJamal Hadi Salim 29027deb2264SThomas Graf skb = nlmsg_new(len, GFP_ATOMIC); 290326b15dadSJamal Hadi Salim if (skb == NULL) 290426b15dadSJamal Hadi Salim return -ENOMEM; 290526b15dadSJamal Hadi Salim 290615e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 29071d1e34ddSDavid S. Miller err = -EMSGSIZE; 290879b8b7f4SThomas Graf if (nlh == NULL) 29091d1e34ddSDavid S. Miller goto out_free_skb; 291026b15dadSJamal Hadi Salim 29117b67c857SThomas Graf p = nlmsg_data(nlh); 29120603eac0SHerbert Xu if (c->event == XFRM_MSG_DELPOLICY) { 2913c0144beaSThomas Graf struct nlattr *attr; 2914c0144beaSThomas Graf 29157b67c857SThomas Graf id = nlmsg_data(nlh); 29160603eac0SHerbert Xu memset(id, 0, sizeof(*id)); 29170603eac0SHerbert Xu id->dir = dir; 29180603eac0SHerbert Xu if (c->data.byid) 29190603eac0SHerbert Xu id->index = xp->index; 29200603eac0SHerbert Xu else 29210603eac0SHerbert Xu memcpy(&id->sel, &xp->selector, sizeof(id->sel)); 29220603eac0SHerbert Xu 2923c0144beaSThomas Graf attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p)); 29241d1e34ddSDavid S. Miller err = -EMSGSIZE; 2925c0144beaSThomas Graf if (attr == NULL) 29261d1e34ddSDavid S. Miller goto out_free_skb; 2927c0144beaSThomas Graf 2928c0144beaSThomas Graf p = nla_data(attr); 29290603eac0SHerbert Xu } 293026b15dadSJamal Hadi Salim 293126b15dadSJamal Hadi Salim copy_to_user_policy(xp, p, dir); 29321d1e34ddSDavid S. Miller err = copy_to_user_tmpl(xp, skb); 29331d1e34ddSDavid S. Miller if (!err) 29341d1e34ddSDavid S. Miller err = copy_to_user_policy_type(xp->type, skb); 29351d1e34ddSDavid S. Miller if (!err) 29361d1e34ddSDavid S. Miller err = xfrm_mark_put(skb, &xp->mark); 29371d1e34ddSDavid S. Miller if (err) 29381d1e34ddSDavid S. Miller goto out_free_skb; 2939295fae56SJamal Hadi Salim 29409825069dSThomas Graf nlmsg_end(skb, nlh); 294126b15dadSJamal Hadi Salim 294221ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 294326b15dadSJamal Hadi Salim 29441d1e34ddSDavid S. Miller out_free_skb: 294526b15dadSJamal Hadi Salim kfree_skb(skb); 29461d1e34ddSDavid S. Miller return err; 294726b15dadSJamal Hadi Salim } 294826b15dadSJamal Hadi Salim 2949214e005bSDavid S. Miller static int xfrm_notify_policy_flush(const struct km_event *c) 295026b15dadSJamal Hadi Salim { 29517067802eSAlexey Dobriyan struct net *net = c->net; 295226b15dadSJamal Hadi Salim struct nlmsghdr *nlh; 295326b15dadSJamal Hadi Salim struct sk_buff *skb; 29541d1e34ddSDavid S. Miller int err; 295526b15dadSJamal Hadi Salim 29567deb2264SThomas Graf skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC); 295726b15dadSJamal Hadi Salim if (skb == NULL) 295826b15dadSJamal Hadi Salim return -ENOMEM; 295926b15dadSJamal Hadi Salim 296015e47304SEric W. Biederman nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0); 29611d1e34ddSDavid S. Miller err = -EMSGSIZE; 296279b8b7f4SThomas Graf if (nlh == NULL) 29631d1e34ddSDavid S. Miller goto out_free_skb; 29641d1e34ddSDavid S. Miller err = copy_to_user_policy_type(c->data.type, skb); 29651d1e34ddSDavid S. Miller if (err) 29661d1e34ddSDavid S. Miller goto out_free_skb; 296726b15dadSJamal Hadi Salim 29689825069dSThomas Graf nlmsg_end(skb, nlh); 296926b15dadSJamal Hadi Salim 297021ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 297126b15dadSJamal Hadi Salim 29721d1e34ddSDavid S. Miller out_free_skb: 297326b15dadSJamal Hadi Salim kfree_skb(skb); 29741d1e34ddSDavid S. Miller return err; 297526b15dadSJamal Hadi Salim } 297626b15dadSJamal Hadi Salim 2977214e005bSDavid S. Miller static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 297826b15dadSJamal Hadi Salim { 297926b15dadSJamal Hadi Salim 298026b15dadSJamal Hadi Salim switch (c->event) { 2981f60f6b8fSHerbert Xu case XFRM_MSG_NEWPOLICY: 2982f60f6b8fSHerbert Xu case XFRM_MSG_UPDPOLICY: 2983f60f6b8fSHerbert Xu case XFRM_MSG_DELPOLICY: 298426b15dadSJamal Hadi Salim return xfrm_notify_policy(xp, dir, c); 2985f60f6b8fSHerbert Xu case XFRM_MSG_FLUSHPOLICY: 298626b15dadSJamal Hadi Salim return xfrm_notify_policy_flush(c); 2987f60f6b8fSHerbert Xu case XFRM_MSG_POLEXPIRE: 298826b15dadSJamal Hadi Salim return xfrm_exp_policy_notify(xp, dir, c); 298926b15dadSJamal Hadi Salim default: 299062db5cfdSstephen hemminger printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n", 299162db5cfdSstephen hemminger c->event); 299226b15dadSJamal Hadi Salim } 299326b15dadSJamal Hadi Salim 299426b15dadSJamal Hadi Salim return 0; 299526b15dadSJamal Hadi Salim 299626b15dadSJamal Hadi Salim } 299726b15dadSJamal Hadi Salim 29987deb2264SThomas Graf static inline size_t xfrm_report_msgsize(void) 29997deb2264SThomas Graf { 30007deb2264SThomas Graf return NLMSG_ALIGN(sizeof(struct xfrm_user_report)); 30017deb2264SThomas Graf } 30027deb2264SThomas Graf 300397a64b45SMasahide NAKAMURA static int build_report(struct sk_buff *skb, u8 proto, 300497a64b45SMasahide NAKAMURA struct xfrm_selector *sel, xfrm_address_t *addr) 300597a64b45SMasahide NAKAMURA { 300697a64b45SMasahide NAKAMURA struct xfrm_user_report *ur; 300797a64b45SMasahide NAKAMURA struct nlmsghdr *nlh; 300897a64b45SMasahide NAKAMURA 300979b8b7f4SThomas Graf nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0); 301079b8b7f4SThomas Graf if (nlh == NULL) 301179b8b7f4SThomas Graf return -EMSGSIZE; 301297a64b45SMasahide NAKAMURA 30137b67c857SThomas Graf ur = nlmsg_data(nlh); 301497a64b45SMasahide NAKAMURA ur->proto = proto; 301597a64b45SMasahide NAKAMURA memcpy(&ur->sel, sel, sizeof(ur->sel)); 301697a64b45SMasahide NAKAMURA 30171d1e34ddSDavid S. Miller if (addr) { 30181d1e34ddSDavid S. Miller int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr); 30191d1e34ddSDavid S. Miller if (err) { 30209825069dSThomas Graf nlmsg_cancel(skb, nlh); 30211d1e34ddSDavid S. Miller return err; 30221d1e34ddSDavid S. Miller } 30231d1e34ddSDavid S. Miller } 3024053c095aSJohannes Berg nlmsg_end(skb, nlh); 3025053c095aSJohannes Berg return 0; 302697a64b45SMasahide NAKAMURA } 302797a64b45SMasahide NAKAMURA 3028db983c11SAlexey Dobriyan static int xfrm_send_report(struct net *net, u8 proto, 3029db983c11SAlexey Dobriyan struct xfrm_selector *sel, xfrm_address_t *addr) 303097a64b45SMasahide NAKAMURA { 303197a64b45SMasahide NAKAMURA struct sk_buff *skb; 303297a64b45SMasahide NAKAMURA 30337deb2264SThomas Graf skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC); 303497a64b45SMasahide NAKAMURA if (skb == NULL) 303597a64b45SMasahide NAKAMURA return -ENOMEM; 303697a64b45SMasahide NAKAMURA 303797a64b45SMasahide NAKAMURA if (build_report(skb, proto, sel, addr) < 0) 303897a64b45SMasahide NAKAMURA BUG(); 303997a64b45SMasahide NAKAMURA 304021ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT); 304197a64b45SMasahide NAKAMURA } 304297a64b45SMasahide NAKAMURA 30433a2dfbe8SMartin Willi static inline size_t xfrm_mapping_msgsize(void) 30443a2dfbe8SMartin Willi { 30453a2dfbe8SMartin Willi return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping)); 30463a2dfbe8SMartin Willi } 30473a2dfbe8SMartin Willi 30483a2dfbe8SMartin Willi static int build_mapping(struct sk_buff *skb, struct xfrm_state *x, 30493a2dfbe8SMartin Willi xfrm_address_t *new_saddr, __be16 new_sport) 30503a2dfbe8SMartin Willi { 30513a2dfbe8SMartin Willi struct xfrm_user_mapping *um; 30523a2dfbe8SMartin Willi struct nlmsghdr *nlh; 30533a2dfbe8SMartin Willi 30543a2dfbe8SMartin Willi nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0); 30553a2dfbe8SMartin Willi if (nlh == NULL) 30563a2dfbe8SMartin Willi return -EMSGSIZE; 30573a2dfbe8SMartin Willi 30583a2dfbe8SMartin Willi um = nlmsg_data(nlh); 30593a2dfbe8SMartin Willi 30603a2dfbe8SMartin Willi memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr)); 30613a2dfbe8SMartin Willi um->id.spi = x->id.spi; 30623a2dfbe8SMartin Willi um->id.family = x->props.family; 30633a2dfbe8SMartin Willi um->id.proto = x->id.proto; 30643a2dfbe8SMartin Willi memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr)); 30653a2dfbe8SMartin Willi memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr)); 30663a2dfbe8SMartin Willi um->new_sport = new_sport; 30673a2dfbe8SMartin Willi um->old_sport = x->encap->encap_sport; 30683a2dfbe8SMartin Willi um->reqid = x->props.reqid; 30693a2dfbe8SMartin Willi 3070053c095aSJohannes Berg nlmsg_end(skb, nlh); 3071053c095aSJohannes Berg return 0; 30723a2dfbe8SMartin Willi } 30733a2dfbe8SMartin Willi 30743a2dfbe8SMartin Willi static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, 30753a2dfbe8SMartin Willi __be16 sport) 30763a2dfbe8SMartin Willi { 3077a6483b79SAlexey Dobriyan struct net *net = xs_net(x); 30783a2dfbe8SMartin Willi struct sk_buff *skb; 30793a2dfbe8SMartin Willi 30803a2dfbe8SMartin Willi if (x->id.proto != IPPROTO_ESP) 30813a2dfbe8SMartin Willi return -EINVAL; 30823a2dfbe8SMartin Willi 30833a2dfbe8SMartin Willi if (!x->encap) 30843a2dfbe8SMartin Willi return -EINVAL; 30853a2dfbe8SMartin Willi 30863a2dfbe8SMartin Willi skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC); 30873a2dfbe8SMartin Willi if (skb == NULL) 30883a2dfbe8SMartin Willi return -ENOMEM; 30893a2dfbe8SMartin Willi 30903a2dfbe8SMartin Willi if (build_mapping(skb, x, ipaddr, sport) < 0) 30913a2dfbe8SMartin Willi BUG(); 30923a2dfbe8SMartin Willi 309321ee543eSMichal Kubecek return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING); 30943a2dfbe8SMartin Willi } 30953a2dfbe8SMartin Willi 30960f24558eSHoria Geanta static bool xfrm_is_alive(const struct km_event *c) 30970f24558eSHoria Geanta { 30980f24558eSHoria Geanta return (bool)xfrm_acquire_is_on(c->net); 30990f24558eSHoria Geanta } 31000f24558eSHoria Geanta 31011da177e4SLinus Torvalds static struct xfrm_mgr netlink_mgr = { 31021da177e4SLinus Torvalds .id = "netlink", 31031da177e4SLinus Torvalds .notify = xfrm_send_state_notify, 31041da177e4SLinus Torvalds .acquire = xfrm_send_acquire, 31051da177e4SLinus Torvalds .compile_policy = xfrm_compile_policy, 31061da177e4SLinus Torvalds .notify_policy = xfrm_send_policy_notify, 310797a64b45SMasahide NAKAMURA .report = xfrm_send_report, 31085c79de6eSShinta Sugimoto .migrate = xfrm_send_migrate, 31093a2dfbe8SMartin Willi .new_mapping = xfrm_send_mapping, 31100f24558eSHoria Geanta .is_alive = xfrm_is_alive, 31111da177e4SLinus Torvalds }; 31121da177e4SLinus Torvalds 3113a6483b79SAlexey Dobriyan static int __net_init xfrm_user_net_init(struct net *net) 31141da177e4SLinus Torvalds { 3115be33690dSPatrick McHardy struct sock *nlsk; 3116a31f2d17SPablo Neira Ayuso struct netlink_kernel_cfg cfg = { 3117a31f2d17SPablo Neira Ayuso .groups = XFRMNLGRP_MAX, 3118a31f2d17SPablo Neira Ayuso .input = xfrm_netlink_rcv, 3119a31f2d17SPablo Neira Ayuso }; 3120be33690dSPatrick McHardy 31219f00d977SPablo Neira Ayuso nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg); 3122be33690dSPatrick McHardy if (nlsk == NULL) 31231da177e4SLinus Torvalds return -ENOMEM; 3124d79d792eSEric W. Biederman net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */ 3125cf778b00SEric Dumazet rcu_assign_pointer(net->xfrm.nlsk, nlsk); 31261da177e4SLinus Torvalds return 0; 31271da177e4SLinus Torvalds } 31281da177e4SLinus Torvalds 3129d79d792eSEric W. Biederman static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list) 3130a6483b79SAlexey Dobriyan { 3131d79d792eSEric W. Biederman struct net *net; 3132d79d792eSEric W. Biederman list_for_each_entry(net, net_exit_list, exit_list) 3133a9b3cd7fSStephen Hemminger RCU_INIT_POINTER(net->xfrm.nlsk, NULL); 3134d79d792eSEric W. Biederman synchronize_net(); 3135d79d792eSEric W. Biederman list_for_each_entry(net, net_exit_list, exit_list) 3136d79d792eSEric W. Biederman netlink_kernel_release(net->xfrm.nlsk_stash); 3137a6483b79SAlexey Dobriyan } 3138a6483b79SAlexey Dobriyan 3139a6483b79SAlexey Dobriyan static struct pernet_operations xfrm_user_net_ops = { 3140a6483b79SAlexey Dobriyan .init = xfrm_user_net_init, 3141d79d792eSEric W. Biederman .exit_batch = xfrm_user_net_exit, 3142a6483b79SAlexey Dobriyan }; 3143a6483b79SAlexey Dobriyan 3144a6483b79SAlexey Dobriyan static int __init xfrm_user_init(void) 3145a6483b79SAlexey Dobriyan { 3146a6483b79SAlexey Dobriyan int rv; 3147a6483b79SAlexey Dobriyan 3148a6483b79SAlexey Dobriyan printk(KERN_INFO "Initializing XFRM netlink socket\n"); 3149a6483b79SAlexey Dobriyan 3150a6483b79SAlexey Dobriyan rv = register_pernet_subsys(&xfrm_user_net_ops); 3151a6483b79SAlexey Dobriyan if (rv < 0) 3152a6483b79SAlexey Dobriyan return rv; 3153a6483b79SAlexey Dobriyan rv = xfrm_register_km(&netlink_mgr); 3154a6483b79SAlexey Dobriyan if (rv < 0) 3155a6483b79SAlexey Dobriyan unregister_pernet_subsys(&xfrm_user_net_ops); 3156a6483b79SAlexey Dobriyan return rv; 3157a6483b79SAlexey Dobriyan } 3158a6483b79SAlexey Dobriyan 31591da177e4SLinus Torvalds static void __exit xfrm_user_exit(void) 31601da177e4SLinus Torvalds { 31611da177e4SLinus Torvalds xfrm_unregister_km(&netlink_mgr); 3162a6483b79SAlexey Dobriyan unregister_pernet_subsys(&xfrm_user_net_ops); 31631da177e4SLinus Torvalds } 31641da177e4SLinus Torvalds 31651da177e4SLinus Torvalds module_init(xfrm_user_init); 31661da177e4SLinus Torvalds module_exit(xfrm_user_exit); 31671da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 31684fdb3bb7SHarald Welte MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM); 3169f8cd5488SJamal Hadi Salim 3170