1 /* xfrm_user.c: User interface to configure xfrm engine. 2 * 3 * Copyright (C) 2002 David S. Miller (davem@redhat.com) 4 * 5 * Changes: 6 * Mitsuru KANDA @USAGI 7 * Kazunori MIYAZAWA @USAGI 8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 9 * IPv6 support 10 * 11 */ 12 13 #include <linux/module.h> 14 #include <linux/kernel.h> 15 #include <linux/types.h> 16 #include <linux/slab.h> 17 #include <linux/socket.h> 18 #include <linux/string.h> 19 #include <linux/net.h> 20 #include <linux/skbuff.h> 21 #include <linux/netlink.h> 22 #include <linux/rtnetlink.h> 23 #include <linux/pfkeyv2.h> 24 #include <linux/ipsec.h> 25 #include <linux/init.h> 26 #include <linux/security.h> 27 #include <net/sock.h> 28 #include <net/xfrm.h> 29 #include <asm/uaccess.h> 30 31 static struct sock *xfrm_nl; 32 33 static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type) 34 { 35 struct rtattr *rt = xfrma[type - 1]; 36 struct xfrm_algo *algp; 37 int len; 38 39 if (!rt) 40 return 0; 41 42 len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp); 43 if (len < 0) 44 return -EINVAL; 45 46 algp = RTA_DATA(rt); 47 48 len -= (algp->alg_key_len + 7U) / 8; 49 if (len < 0) 50 return -EINVAL; 51 52 switch (type) { 53 case XFRMA_ALG_AUTH: 54 if (!algp->alg_key_len && 55 strcmp(algp->alg_name, "digest_null") != 0) 56 return -EINVAL; 57 break; 58 59 case XFRMA_ALG_CRYPT: 60 if (!algp->alg_key_len && 61 strcmp(algp->alg_name, "cipher_null") != 0) 62 return -EINVAL; 63 break; 64 65 case XFRMA_ALG_COMP: 66 /* Zero length keys are legal. */ 67 break; 68 69 default: 70 return -EINVAL; 71 }; 72 73 algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0'; 74 return 0; 75 } 76 77 static int verify_encap_tmpl(struct rtattr **xfrma) 78 { 79 struct rtattr *rt = xfrma[XFRMA_ENCAP - 1]; 80 struct xfrm_encap_tmpl *encap; 81 82 if (!rt) 83 return 0; 84 85 if ((rt->rta_len - sizeof(*rt)) < sizeof(*encap)) 86 return -EINVAL; 87 88 return 0; 89 } 90 91 static int verify_newsa_info(struct xfrm_usersa_info *p, 92 struct rtattr **xfrma) 93 { 94 int err; 95 96 err = -EINVAL; 97 switch (p->family) { 98 case AF_INET: 99 break; 100 101 case AF_INET6: 102 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 103 break; 104 #else 105 err = -EAFNOSUPPORT; 106 goto out; 107 #endif 108 109 default: 110 goto out; 111 }; 112 113 err = -EINVAL; 114 switch (p->id.proto) { 115 case IPPROTO_AH: 116 if (!xfrma[XFRMA_ALG_AUTH-1] || 117 xfrma[XFRMA_ALG_CRYPT-1] || 118 xfrma[XFRMA_ALG_COMP-1]) 119 goto out; 120 break; 121 122 case IPPROTO_ESP: 123 if ((!xfrma[XFRMA_ALG_AUTH-1] && 124 !xfrma[XFRMA_ALG_CRYPT-1]) || 125 xfrma[XFRMA_ALG_COMP-1]) 126 goto out; 127 break; 128 129 case IPPROTO_COMP: 130 if (!xfrma[XFRMA_ALG_COMP-1] || 131 xfrma[XFRMA_ALG_AUTH-1] || 132 xfrma[XFRMA_ALG_CRYPT-1]) 133 goto out; 134 break; 135 136 default: 137 goto out; 138 }; 139 140 if ((err = verify_one_alg(xfrma, XFRMA_ALG_AUTH))) 141 goto out; 142 if ((err = verify_one_alg(xfrma, XFRMA_ALG_CRYPT))) 143 goto out; 144 if ((err = verify_one_alg(xfrma, XFRMA_ALG_COMP))) 145 goto out; 146 if ((err = verify_encap_tmpl(xfrma))) 147 goto out; 148 149 err = -EINVAL; 150 switch (p->mode) { 151 case 0: 152 case 1: 153 break; 154 155 default: 156 goto out; 157 }; 158 159 err = 0; 160 161 out: 162 return err; 163 } 164 165 static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 166 struct xfrm_algo_desc *(*get_byname)(char *, int), 167 struct rtattr *u_arg) 168 { 169 struct rtattr *rta = u_arg; 170 struct xfrm_algo *p, *ualg; 171 struct xfrm_algo_desc *algo; 172 int len; 173 174 if (!rta) 175 return 0; 176 177 ualg = RTA_DATA(rta); 178 179 algo = get_byname(ualg->alg_name, 1); 180 if (!algo) 181 return -ENOSYS; 182 *props = algo->desc.sadb_alg_id; 183 184 len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8; 185 p = kmalloc(len, GFP_KERNEL); 186 if (!p) 187 return -ENOMEM; 188 189 memcpy(p, ualg, len); 190 *algpp = p; 191 return 0; 192 } 193 194 static int attach_encap_tmpl(struct xfrm_encap_tmpl **encapp, struct rtattr *u_arg) 195 { 196 struct rtattr *rta = u_arg; 197 struct xfrm_encap_tmpl *p, *uencap; 198 199 if (!rta) 200 return 0; 201 202 uencap = RTA_DATA(rta); 203 p = kmalloc(sizeof(*p), GFP_KERNEL); 204 if (!p) 205 return -ENOMEM; 206 207 memcpy(p, uencap, sizeof(*p)); 208 *encapp = p; 209 return 0; 210 } 211 212 static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 213 { 214 memcpy(&x->id, &p->id, sizeof(x->id)); 215 memcpy(&x->sel, &p->sel, sizeof(x->sel)); 216 memcpy(&x->lft, &p->lft, sizeof(x->lft)); 217 x->props.mode = p->mode; 218 x->props.replay_window = p->replay_window; 219 x->props.reqid = p->reqid; 220 x->props.family = p->family; 221 x->props.saddr = p->saddr; 222 x->props.flags = p->flags; 223 } 224 225 static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p, 226 struct rtattr **xfrma, 227 int *errp) 228 { 229 struct xfrm_state *x = xfrm_state_alloc(); 230 int err = -ENOMEM; 231 232 if (!x) 233 goto error_no_put; 234 235 copy_from_user_state(x, p); 236 237 if ((err = attach_one_algo(&x->aalg, &x->props.aalgo, 238 xfrm_aalg_get_byname, 239 xfrma[XFRMA_ALG_AUTH-1]))) 240 goto error; 241 if ((err = attach_one_algo(&x->ealg, &x->props.ealgo, 242 xfrm_ealg_get_byname, 243 xfrma[XFRMA_ALG_CRYPT-1]))) 244 goto error; 245 if ((err = attach_one_algo(&x->calg, &x->props.calgo, 246 xfrm_calg_get_byname, 247 xfrma[XFRMA_ALG_COMP-1]))) 248 goto error; 249 if ((err = attach_encap_tmpl(&x->encap, xfrma[XFRMA_ENCAP-1]))) 250 goto error; 251 252 err = -ENOENT; 253 x->type = xfrm_get_type(x->id.proto, x->props.family); 254 if (x->type == NULL) 255 goto error; 256 257 err = x->type->init_state(x, NULL); 258 if (err) 259 goto error; 260 261 x->curlft.add_time = (unsigned long) xtime.tv_sec; 262 x->km.state = XFRM_STATE_VALID; 263 x->km.seq = p->seq; 264 265 return x; 266 267 error: 268 x->km.state = XFRM_STATE_DEAD; 269 xfrm_state_put(x); 270 error_no_put: 271 *errp = err; 272 return NULL; 273 } 274 275 static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 276 { 277 struct xfrm_usersa_info *p = NLMSG_DATA(nlh); 278 struct xfrm_state *x; 279 int err; 280 281 err = verify_newsa_info(p, (struct rtattr **) xfrma); 282 if (err) 283 return err; 284 285 x = xfrm_state_construct(p, (struct rtattr **) xfrma, &err); 286 if (!x) 287 return err; 288 289 if (nlh->nlmsg_type == XFRM_MSG_NEWSA) 290 err = xfrm_state_add(x); 291 else 292 err = xfrm_state_update(x); 293 294 if (err < 0) { 295 x->km.state = XFRM_STATE_DEAD; 296 xfrm_state_put(x); 297 } 298 299 return err; 300 } 301 302 static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 303 { 304 struct xfrm_state *x; 305 struct xfrm_usersa_id *p = NLMSG_DATA(nlh); 306 307 x = xfrm_state_lookup(&p->daddr, p->spi, p->proto, p->family); 308 if (x == NULL) 309 return -ESRCH; 310 311 if (xfrm_state_kern(x)) { 312 xfrm_state_put(x); 313 return -EPERM; 314 } 315 316 xfrm_state_delete(x); 317 xfrm_state_put(x); 318 319 return 0; 320 } 321 322 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 323 { 324 memcpy(&p->id, &x->id, sizeof(p->id)); 325 memcpy(&p->sel, &x->sel, sizeof(p->sel)); 326 memcpy(&p->lft, &x->lft, sizeof(p->lft)); 327 memcpy(&p->curlft, &x->curlft, sizeof(p->curlft)); 328 memcpy(&p->stats, &x->stats, sizeof(p->stats)); 329 p->saddr = x->props.saddr; 330 p->mode = x->props.mode; 331 p->replay_window = x->props.replay_window; 332 p->reqid = x->props.reqid; 333 p->family = x->props.family; 334 p->flags = x->props.flags; 335 p->seq = x->km.seq; 336 } 337 338 struct xfrm_dump_info { 339 struct sk_buff *in_skb; 340 struct sk_buff *out_skb; 341 u32 nlmsg_seq; 342 u16 nlmsg_flags; 343 int start_idx; 344 int this_idx; 345 }; 346 347 static int dump_one_state(struct xfrm_state *x, int count, void *ptr) 348 { 349 struct xfrm_dump_info *sp = ptr; 350 struct sk_buff *in_skb = sp->in_skb; 351 struct sk_buff *skb = sp->out_skb; 352 struct xfrm_usersa_info *p; 353 struct nlmsghdr *nlh; 354 unsigned char *b = skb->tail; 355 356 if (sp->this_idx < sp->start_idx) 357 goto out; 358 359 nlh = NLMSG_PUT(skb, NETLINK_CB(in_skb).pid, 360 sp->nlmsg_seq, 361 XFRM_MSG_NEWSA, sizeof(*p)); 362 nlh->nlmsg_flags = sp->nlmsg_flags; 363 364 p = NLMSG_DATA(nlh); 365 copy_to_user_state(x, p); 366 367 if (x->aalg) 368 RTA_PUT(skb, XFRMA_ALG_AUTH, 369 sizeof(*(x->aalg))+(x->aalg->alg_key_len+7)/8, x->aalg); 370 if (x->ealg) 371 RTA_PUT(skb, XFRMA_ALG_CRYPT, 372 sizeof(*(x->ealg))+(x->ealg->alg_key_len+7)/8, x->ealg); 373 if (x->calg) 374 RTA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg); 375 376 if (x->encap) 377 RTA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); 378 379 nlh->nlmsg_len = skb->tail - b; 380 out: 381 sp->this_idx++; 382 return 0; 383 384 nlmsg_failure: 385 rtattr_failure: 386 skb_trim(skb, b - skb->data); 387 return -1; 388 } 389 390 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) 391 { 392 struct xfrm_dump_info info; 393 394 info.in_skb = cb->skb; 395 info.out_skb = skb; 396 info.nlmsg_seq = cb->nlh->nlmsg_seq; 397 info.nlmsg_flags = NLM_F_MULTI; 398 info.this_idx = 0; 399 info.start_idx = cb->args[0]; 400 (void) xfrm_state_walk(IPSEC_PROTO_ANY, dump_one_state, &info); 401 cb->args[0] = info.this_idx; 402 403 return skb->len; 404 } 405 406 static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, 407 struct xfrm_state *x, u32 seq) 408 { 409 struct xfrm_dump_info info; 410 struct sk_buff *skb; 411 412 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 413 if (!skb) 414 return ERR_PTR(-ENOMEM); 415 416 NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid; 417 info.in_skb = in_skb; 418 info.out_skb = skb; 419 info.nlmsg_seq = seq; 420 info.nlmsg_flags = 0; 421 info.this_idx = info.start_idx = 0; 422 423 if (dump_one_state(x, 0, &info)) { 424 kfree_skb(skb); 425 return NULL; 426 } 427 428 return skb; 429 } 430 431 static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 432 { 433 struct xfrm_usersa_id *p = NLMSG_DATA(nlh); 434 struct xfrm_state *x; 435 struct sk_buff *resp_skb; 436 int err; 437 438 x = xfrm_state_lookup(&p->daddr, p->spi, p->proto, p->family); 439 err = -ESRCH; 440 if (x == NULL) 441 goto out_noput; 442 443 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 444 if (IS_ERR(resp_skb)) { 445 err = PTR_ERR(resp_skb); 446 } else { 447 err = netlink_unicast(xfrm_nl, resp_skb, 448 NETLINK_CB(skb).pid, MSG_DONTWAIT); 449 } 450 xfrm_state_put(x); 451 out_noput: 452 return err; 453 } 454 455 static int verify_userspi_info(struct xfrm_userspi_info *p) 456 { 457 switch (p->info.id.proto) { 458 case IPPROTO_AH: 459 case IPPROTO_ESP: 460 break; 461 462 case IPPROTO_COMP: 463 /* IPCOMP spi is 16-bits. */ 464 if (p->max >= 0x10000) 465 return -EINVAL; 466 break; 467 468 default: 469 return -EINVAL; 470 }; 471 472 if (p->min > p->max) 473 return -EINVAL; 474 475 return 0; 476 } 477 478 static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 479 { 480 struct xfrm_state *x; 481 struct xfrm_userspi_info *p; 482 struct sk_buff *resp_skb; 483 xfrm_address_t *daddr; 484 int family; 485 int err; 486 487 p = NLMSG_DATA(nlh); 488 err = verify_userspi_info(p); 489 if (err) 490 goto out_noput; 491 492 family = p->info.family; 493 daddr = &p->info.id.daddr; 494 495 x = NULL; 496 if (p->info.seq) { 497 x = xfrm_find_acq_byseq(p->info.seq); 498 if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) { 499 xfrm_state_put(x); 500 x = NULL; 501 } 502 } 503 504 if (!x) 505 x = xfrm_find_acq(p->info.mode, p->info.reqid, 506 p->info.id.proto, daddr, 507 &p->info.saddr, 1, 508 family); 509 err = -ENOENT; 510 if (x == NULL) 511 goto out_noput; 512 513 resp_skb = ERR_PTR(-ENOENT); 514 515 spin_lock_bh(&x->lock); 516 if (x->km.state != XFRM_STATE_DEAD) { 517 xfrm_alloc_spi(x, htonl(p->min), htonl(p->max)); 518 if (x->id.spi) 519 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 520 } 521 spin_unlock_bh(&x->lock); 522 523 if (IS_ERR(resp_skb)) { 524 err = PTR_ERR(resp_skb); 525 goto out; 526 } 527 528 err = netlink_unicast(xfrm_nl, resp_skb, 529 NETLINK_CB(skb).pid, MSG_DONTWAIT); 530 531 out: 532 xfrm_state_put(x); 533 out_noput: 534 return err; 535 } 536 537 static int verify_policy_dir(__u8 dir) 538 { 539 switch (dir) { 540 case XFRM_POLICY_IN: 541 case XFRM_POLICY_OUT: 542 case XFRM_POLICY_FWD: 543 break; 544 545 default: 546 return -EINVAL; 547 }; 548 549 return 0; 550 } 551 552 static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) 553 { 554 switch (p->share) { 555 case XFRM_SHARE_ANY: 556 case XFRM_SHARE_SESSION: 557 case XFRM_SHARE_USER: 558 case XFRM_SHARE_UNIQUE: 559 break; 560 561 default: 562 return -EINVAL; 563 }; 564 565 switch (p->action) { 566 case XFRM_POLICY_ALLOW: 567 case XFRM_POLICY_BLOCK: 568 break; 569 570 default: 571 return -EINVAL; 572 }; 573 574 switch (p->sel.family) { 575 case AF_INET: 576 break; 577 578 case AF_INET6: 579 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 580 break; 581 #else 582 return -EAFNOSUPPORT; 583 #endif 584 585 default: 586 return -EINVAL; 587 }; 588 589 return verify_policy_dir(p->dir); 590 } 591 592 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, 593 int nr) 594 { 595 int i; 596 597 xp->xfrm_nr = nr; 598 for (i = 0; i < nr; i++, ut++) { 599 struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 600 601 memcpy(&t->id, &ut->id, sizeof(struct xfrm_id)); 602 memcpy(&t->saddr, &ut->saddr, 603 sizeof(xfrm_address_t)); 604 t->reqid = ut->reqid; 605 t->mode = ut->mode; 606 t->share = ut->share; 607 t->optional = ut->optional; 608 t->aalgos = ut->aalgos; 609 t->ealgos = ut->ealgos; 610 t->calgos = ut->calgos; 611 } 612 } 613 614 static int copy_from_user_tmpl(struct xfrm_policy *pol, struct rtattr **xfrma) 615 { 616 struct rtattr *rt = xfrma[XFRMA_TMPL-1]; 617 struct xfrm_user_tmpl *utmpl; 618 int nr; 619 620 if (!rt) { 621 pol->xfrm_nr = 0; 622 } else { 623 nr = (rt->rta_len - sizeof(*rt)) / sizeof(*utmpl); 624 625 if (nr > XFRM_MAX_DEPTH) 626 return -EINVAL; 627 628 copy_templates(pol, RTA_DATA(rt), nr); 629 } 630 return 0; 631 } 632 633 static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p) 634 { 635 xp->priority = p->priority; 636 xp->index = p->index; 637 memcpy(&xp->selector, &p->sel, sizeof(xp->selector)); 638 memcpy(&xp->lft, &p->lft, sizeof(xp->lft)); 639 xp->action = p->action; 640 xp->flags = p->flags; 641 xp->family = p->sel.family; 642 /* XXX xp->share = p->share; */ 643 } 644 645 static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir) 646 { 647 memcpy(&p->sel, &xp->selector, sizeof(p->sel)); 648 memcpy(&p->lft, &xp->lft, sizeof(p->lft)); 649 memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft)); 650 p->priority = xp->priority; 651 p->index = xp->index; 652 p->sel.family = xp->family; 653 p->dir = dir; 654 p->action = xp->action; 655 p->flags = xp->flags; 656 p->share = XFRM_SHARE_ANY; /* XXX xp->share */ 657 } 658 659 static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p, struct rtattr **xfrma, int *errp) 660 { 661 struct xfrm_policy *xp = xfrm_policy_alloc(GFP_KERNEL); 662 int err; 663 664 if (!xp) { 665 *errp = -ENOMEM; 666 return NULL; 667 } 668 669 copy_from_user_policy(xp, p); 670 err = copy_from_user_tmpl(xp, xfrma); 671 if (err) { 672 *errp = err; 673 kfree(xp); 674 xp = NULL; 675 } 676 677 return xp; 678 } 679 680 static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 681 { 682 struct xfrm_userpolicy_info *p = NLMSG_DATA(nlh); 683 struct xfrm_policy *xp; 684 int err; 685 int excl; 686 687 err = verify_newpolicy_info(p); 688 if (err) 689 return err; 690 691 xp = xfrm_policy_construct(p, (struct rtattr **) xfrma, &err); 692 if (!xp) 693 return err; 694 695 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; 696 err = xfrm_policy_insert(p->dir, xp, excl); 697 if (err) { 698 kfree(xp); 699 return err; 700 } 701 702 xfrm_pol_put(xp); 703 704 return 0; 705 } 706 707 static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb) 708 { 709 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH]; 710 int i; 711 712 if (xp->xfrm_nr == 0) 713 return 0; 714 715 for (i = 0; i < xp->xfrm_nr; i++) { 716 struct xfrm_user_tmpl *up = &vec[i]; 717 struct xfrm_tmpl *kp = &xp->xfrm_vec[i]; 718 719 memcpy(&up->id, &kp->id, sizeof(up->id)); 720 up->family = xp->family; 721 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr)); 722 up->reqid = kp->reqid; 723 up->mode = kp->mode; 724 up->share = kp->share; 725 up->optional = kp->optional; 726 up->aalgos = kp->aalgos; 727 up->ealgos = kp->ealgos; 728 up->calgos = kp->calgos; 729 } 730 RTA_PUT(skb, XFRMA_TMPL, 731 (sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr), 732 vec); 733 734 return 0; 735 736 rtattr_failure: 737 return -1; 738 } 739 740 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr) 741 { 742 struct xfrm_dump_info *sp = ptr; 743 struct xfrm_userpolicy_info *p; 744 struct sk_buff *in_skb = sp->in_skb; 745 struct sk_buff *skb = sp->out_skb; 746 struct nlmsghdr *nlh; 747 unsigned char *b = skb->tail; 748 749 if (sp->this_idx < sp->start_idx) 750 goto out; 751 752 nlh = NLMSG_PUT(skb, NETLINK_CB(in_skb).pid, 753 sp->nlmsg_seq, 754 XFRM_MSG_NEWPOLICY, sizeof(*p)); 755 p = NLMSG_DATA(nlh); 756 nlh->nlmsg_flags = sp->nlmsg_flags; 757 758 copy_to_user_policy(xp, p, dir); 759 if (copy_to_user_tmpl(xp, skb) < 0) 760 goto nlmsg_failure; 761 762 nlh->nlmsg_len = skb->tail - b; 763 out: 764 sp->this_idx++; 765 return 0; 766 767 nlmsg_failure: 768 skb_trim(skb, b - skb->data); 769 return -1; 770 } 771 772 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb) 773 { 774 struct xfrm_dump_info info; 775 776 info.in_skb = cb->skb; 777 info.out_skb = skb; 778 info.nlmsg_seq = cb->nlh->nlmsg_seq; 779 info.nlmsg_flags = NLM_F_MULTI; 780 info.this_idx = 0; 781 info.start_idx = cb->args[0]; 782 (void) xfrm_policy_walk(dump_one_policy, &info); 783 cb->args[0] = info.this_idx; 784 785 return skb->len; 786 } 787 788 static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, 789 struct xfrm_policy *xp, 790 int dir, u32 seq) 791 { 792 struct xfrm_dump_info info; 793 struct sk_buff *skb; 794 795 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 796 if (!skb) 797 return ERR_PTR(-ENOMEM); 798 799 NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid; 800 info.in_skb = in_skb; 801 info.out_skb = skb; 802 info.nlmsg_seq = seq; 803 info.nlmsg_flags = 0; 804 info.this_idx = info.start_idx = 0; 805 806 if (dump_one_policy(xp, dir, 0, &info) < 0) { 807 kfree_skb(skb); 808 return NULL; 809 } 810 811 return skb; 812 } 813 814 static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 815 { 816 struct xfrm_policy *xp; 817 struct xfrm_userpolicy_id *p; 818 int err; 819 int delete; 820 821 p = NLMSG_DATA(nlh); 822 delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY; 823 824 err = verify_policy_dir(p->dir); 825 if (err) 826 return err; 827 828 if (p->index) 829 xp = xfrm_policy_byid(p->dir, p->index, delete); 830 else 831 xp = xfrm_policy_bysel(p->dir, &p->sel, delete); 832 if (xp == NULL) 833 return -ENOENT; 834 835 if (!delete) { 836 struct sk_buff *resp_skb; 837 838 resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq); 839 if (IS_ERR(resp_skb)) { 840 err = PTR_ERR(resp_skb); 841 } else { 842 err = netlink_unicast(xfrm_nl, resp_skb, 843 NETLINK_CB(skb).pid, 844 MSG_DONTWAIT); 845 } 846 } 847 848 xfrm_pol_put(xp); 849 850 return err; 851 } 852 853 static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 854 { 855 struct xfrm_usersa_flush *p = NLMSG_DATA(nlh); 856 857 xfrm_state_flush(p->proto); 858 return 0; 859 } 860 861 static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) 862 { 863 xfrm_policy_flush(); 864 return 0; 865 } 866 867 #define XMSGSIZE(type) NLMSG_LENGTH(sizeof(struct type)) 868 869 static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = { 870 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 871 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 872 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 873 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 874 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 875 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 876 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info), 877 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire), 878 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire), 879 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 880 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 881 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire), 882 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush), 883 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = NLMSG_LENGTH(0), 884 }; 885 886 #undef XMSGSIZE 887 888 static struct xfrm_link { 889 int (*doit)(struct sk_buff *, struct nlmsghdr *, void **); 890 int (*dump)(struct sk_buff *, struct netlink_callback *); 891 } xfrm_dispatch[XFRM_NR_MSGTYPES] = { 892 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 893 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa }, 894 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa, 895 .dump = xfrm_dump_sa }, 896 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 897 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy }, 898 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy, 899 .dump = xfrm_dump_policy }, 900 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi }, 901 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 902 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 903 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa }, 904 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy }, 905 }; 906 907 static int xfrm_done(struct netlink_callback *cb) 908 { 909 return 0; 910 } 911 912 static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp) 913 { 914 struct rtattr *xfrma[XFRMA_MAX]; 915 struct xfrm_link *link; 916 int type, min_len; 917 918 if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) 919 return 0; 920 921 type = nlh->nlmsg_type; 922 923 /* A control message: ignore them */ 924 if (type < XFRM_MSG_BASE) 925 return 0; 926 927 /* Unknown message: reply with EINVAL */ 928 if (type > XFRM_MSG_MAX) 929 goto err_einval; 930 931 type -= XFRM_MSG_BASE; 932 link = &xfrm_dispatch[type]; 933 934 /* All operations require privileges, even GET */ 935 if (security_netlink_recv(skb)) { 936 *errp = -EPERM; 937 return -1; 938 } 939 940 if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || 941 type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) && 942 (nlh->nlmsg_flags & NLM_F_DUMP)) { 943 u32 rlen; 944 945 if (link->dump == NULL) 946 goto err_einval; 947 948 if ((*errp = netlink_dump_start(xfrm_nl, skb, nlh, 949 link->dump, 950 xfrm_done)) != 0) { 951 return -1; 952 } 953 rlen = NLMSG_ALIGN(nlh->nlmsg_len); 954 if (rlen > skb->len) 955 rlen = skb->len; 956 skb_pull(skb, rlen); 957 return -1; 958 } 959 960 memset(xfrma, 0, sizeof(xfrma)); 961 962 if (nlh->nlmsg_len < (min_len = xfrm_msg_min[type])) 963 goto err_einval; 964 965 if (nlh->nlmsg_len > min_len) { 966 int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len); 967 struct rtattr *attr = (void *) nlh + NLMSG_ALIGN(min_len); 968 969 while (RTA_OK(attr, attrlen)) { 970 unsigned short flavor = attr->rta_type; 971 if (flavor) { 972 if (flavor > XFRMA_MAX) 973 goto err_einval; 974 xfrma[flavor - 1] = attr; 975 } 976 attr = RTA_NEXT(attr, attrlen); 977 } 978 } 979 980 if (link->doit == NULL) 981 goto err_einval; 982 *errp = link->doit(skb, nlh, (void **) &xfrma); 983 984 return *errp; 985 986 err_einval: 987 *errp = -EINVAL; 988 return -1; 989 } 990 991 static int xfrm_user_rcv_skb(struct sk_buff *skb) 992 { 993 int err; 994 struct nlmsghdr *nlh; 995 996 while (skb->len >= NLMSG_SPACE(0)) { 997 u32 rlen; 998 999 nlh = (struct nlmsghdr *) skb->data; 1000 if (nlh->nlmsg_len < sizeof(*nlh) || 1001 skb->len < nlh->nlmsg_len) 1002 return 0; 1003 rlen = NLMSG_ALIGN(nlh->nlmsg_len); 1004 if (rlen > skb->len) 1005 rlen = skb->len; 1006 if (xfrm_user_rcv_msg(skb, nlh, &err) < 0) { 1007 if (err == 0) 1008 return -1; 1009 netlink_ack(skb, nlh, err); 1010 } else if (nlh->nlmsg_flags & NLM_F_ACK) 1011 netlink_ack(skb, nlh, 0); 1012 skb_pull(skb, rlen); 1013 } 1014 1015 return 0; 1016 } 1017 1018 static void xfrm_netlink_rcv(struct sock *sk, int len) 1019 { 1020 unsigned int qlen = skb_queue_len(&sk->sk_receive_queue); 1021 1022 do { 1023 struct sk_buff *skb; 1024 1025 down(&xfrm_cfg_sem); 1026 1027 if (qlen > skb_queue_len(&sk->sk_receive_queue)) 1028 qlen = skb_queue_len(&sk->sk_receive_queue); 1029 1030 for (; qlen; qlen--) { 1031 skb = skb_dequeue(&sk->sk_receive_queue); 1032 if (xfrm_user_rcv_skb(skb)) { 1033 if (skb->len) 1034 skb_queue_head(&sk->sk_receive_queue, 1035 skb); 1036 else { 1037 kfree_skb(skb); 1038 qlen--; 1039 } 1040 break; 1041 } 1042 kfree_skb(skb); 1043 } 1044 1045 up(&xfrm_cfg_sem); 1046 1047 } while (qlen); 1048 } 1049 1050 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, int hard) 1051 { 1052 struct xfrm_user_expire *ue; 1053 struct nlmsghdr *nlh; 1054 unsigned char *b = skb->tail; 1055 1056 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_EXPIRE, 1057 sizeof(*ue)); 1058 ue = NLMSG_DATA(nlh); 1059 nlh->nlmsg_flags = 0; 1060 1061 copy_to_user_state(x, &ue->state); 1062 ue->hard = (hard != 0) ? 1 : 0; 1063 1064 nlh->nlmsg_len = skb->tail - b; 1065 return skb->len; 1066 1067 nlmsg_failure: 1068 skb_trim(skb, b - skb->data); 1069 return -1; 1070 } 1071 1072 static int xfrm_send_state_notify(struct xfrm_state *x, int hard) 1073 { 1074 struct sk_buff *skb; 1075 1076 skb = alloc_skb(sizeof(struct xfrm_user_expire) + 16, GFP_ATOMIC); 1077 if (skb == NULL) 1078 return -ENOMEM; 1079 1080 if (build_expire(skb, x, hard) < 0) 1081 BUG(); 1082 1083 NETLINK_CB(skb).dst_groups = XFRMGRP_EXPIRE; 1084 1085 return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_EXPIRE, GFP_ATOMIC); 1086 } 1087 1088 static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, 1089 struct xfrm_tmpl *xt, struct xfrm_policy *xp, 1090 int dir) 1091 { 1092 struct xfrm_user_acquire *ua; 1093 struct nlmsghdr *nlh; 1094 unsigned char *b = skb->tail; 1095 __u32 seq = xfrm_get_acqseq(); 1096 1097 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_ACQUIRE, 1098 sizeof(*ua)); 1099 ua = NLMSG_DATA(nlh); 1100 nlh->nlmsg_flags = 0; 1101 1102 memcpy(&ua->id, &x->id, sizeof(ua->id)); 1103 memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr)); 1104 memcpy(&ua->sel, &x->sel, sizeof(ua->sel)); 1105 copy_to_user_policy(xp, &ua->policy, dir); 1106 ua->aalgos = xt->aalgos; 1107 ua->ealgos = xt->ealgos; 1108 ua->calgos = xt->calgos; 1109 ua->seq = x->km.seq = seq; 1110 1111 if (copy_to_user_tmpl(xp, skb) < 0) 1112 goto nlmsg_failure; 1113 1114 nlh->nlmsg_len = skb->tail - b; 1115 return skb->len; 1116 1117 nlmsg_failure: 1118 skb_trim(skb, b - skb->data); 1119 return -1; 1120 } 1121 1122 static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt, 1123 struct xfrm_policy *xp, int dir) 1124 { 1125 struct sk_buff *skb; 1126 size_t len; 1127 1128 len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 1129 len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire)); 1130 skb = alloc_skb(len, GFP_ATOMIC); 1131 if (skb == NULL) 1132 return -ENOMEM; 1133 1134 if (build_acquire(skb, x, xt, xp, dir) < 0) 1135 BUG(); 1136 1137 NETLINK_CB(skb).dst_groups = XFRMGRP_ACQUIRE; 1138 1139 return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_ACQUIRE, GFP_ATOMIC); 1140 } 1141 1142 /* User gives us xfrm_user_policy_info followed by an array of 0 1143 * or more templates. 1144 */ 1145 static struct xfrm_policy *xfrm_compile_policy(u16 family, int opt, 1146 u8 *data, int len, int *dir) 1147 { 1148 struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data; 1149 struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1); 1150 struct xfrm_policy *xp; 1151 int nr; 1152 1153 switch (family) { 1154 case AF_INET: 1155 if (opt != IP_XFRM_POLICY) { 1156 *dir = -EOPNOTSUPP; 1157 return NULL; 1158 } 1159 break; 1160 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1161 case AF_INET6: 1162 if (opt != IPV6_XFRM_POLICY) { 1163 *dir = -EOPNOTSUPP; 1164 return NULL; 1165 } 1166 break; 1167 #endif 1168 default: 1169 *dir = -EINVAL; 1170 return NULL; 1171 } 1172 1173 *dir = -EINVAL; 1174 1175 if (len < sizeof(*p) || 1176 verify_newpolicy_info(p)) 1177 return NULL; 1178 1179 nr = ((len - sizeof(*p)) / sizeof(*ut)); 1180 if (nr > XFRM_MAX_DEPTH) 1181 return NULL; 1182 1183 xp = xfrm_policy_alloc(GFP_KERNEL); 1184 if (xp == NULL) { 1185 *dir = -ENOBUFS; 1186 return NULL; 1187 } 1188 1189 copy_from_user_policy(xp, p); 1190 copy_templates(xp, ut, nr); 1191 1192 *dir = p->dir; 1193 1194 return xp; 1195 } 1196 1197 static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, 1198 int dir, int hard) 1199 { 1200 struct xfrm_user_polexpire *upe; 1201 struct nlmsghdr *nlh; 1202 unsigned char *b = skb->tail; 1203 1204 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe)); 1205 upe = NLMSG_DATA(nlh); 1206 nlh->nlmsg_flags = 0; 1207 1208 copy_to_user_policy(xp, &upe->pol, dir); 1209 if (copy_to_user_tmpl(xp, skb) < 0) 1210 goto nlmsg_failure; 1211 upe->hard = !!hard; 1212 1213 nlh->nlmsg_len = skb->tail - b; 1214 return skb->len; 1215 1216 nlmsg_failure: 1217 skb_trim(skb, b - skb->data); 1218 return -1; 1219 } 1220 1221 static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, int hard) 1222 { 1223 struct sk_buff *skb; 1224 size_t len; 1225 1226 len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 1227 len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire)); 1228 skb = alloc_skb(len, GFP_ATOMIC); 1229 if (skb == NULL) 1230 return -ENOMEM; 1231 1232 if (build_polexpire(skb, xp, dir, hard) < 0) 1233 BUG(); 1234 1235 NETLINK_CB(skb).dst_groups = XFRMGRP_EXPIRE; 1236 1237 return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_EXPIRE, GFP_ATOMIC); 1238 } 1239 1240 static struct xfrm_mgr netlink_mgr = { 1241 .id = "netlink", 1242 .notify = xfrm_send_state_notify, 1243 .acquire = xfrm_send_acquire, 1244 .compile_policy = xfrm_compile_policy, 1245 .notify_policy = xfrm_send_policy_notify, 1246 }; 1247 1248 static int __init xfrm_user_init(void) 1249 { 1250 printk(KERN_INFO "Initializing IPsec netlink socket\n"); 1251 1252 xfrm_nl = netlink_kernel_create(NETLINK_XFRM, xfrm_netlink_rcv); 1253 if (xfrm_nl == NULL) 1254 return -ENOMEM; 1255 1256 xfrm_register_km(&netlink_mgr); 1257 1258 return 0; 1259 } 1260 1261 static void __exit xfrm_user_exit(void) 1262 { 1263 xfrm_unregister_km(&netlink_mgr); 1264 sock_release(xfrm_nl->sk_socket); 1265 } 1266 1267 module_init(xfrm_user_init); 1268 module_exit(xfrm_user_exit); 1269 MODULE_LICENSE("GPL"); 1270