1 // SPDX-License-Identifier: GPL-2.0-only 2 /* xfrm_user.c: User interface to configure xfrm engine. 3 * 4 * Copyright (C) 2002 David S. Miller (davem@redhat.com) 5 * 6 * Changes: 7 * Mitsuru KANDA @USAGI 8 * Kazunori MIYAZAWA @USAGI 9 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 10 * IPv6 support 11 * 12 */ 13 14 #include <linux/compat.h> 15 #include <linux/crypto.h> 16 #include <linux/module.h> 17 #include <linux/kernel.h> 18 #include <linux/types.h> 19 #include <linux/slab.h> 20 #include <linux/socket.h> 21 #include <linux/string.h> 22 #include <linux/net.h> 23 #include <linux/skbuff.h> 24 #include <linux/pfkeyv2.h> 25 #include <linux/ipsec.h> 26 #include <linux/init.h> 27 #include <linux/security.h> 28 #include <net/sock.h> 29 #include <net/xfrm.h> 30 #include <net/netlink.h> 31 #include <net/ah.h> 32 #include <linux/uaccess.h> 33 #if IS_ENABLED(CONFIG_IPV6) 34 #include <linux/in6.h> 35 #endif 36 #include <linux/unaligned.h> 37 38 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type, 39 struct netlink_ext_ack *extack) 40 { 41 struct nlattr *rt = attrs[type]; 42 struct xfrm_algo *algp; 43 44 if (!rt) 45 return 0; 46 47 algp = nla_data(rt); 48 if (nla_len(rt) < (int)xfrm_alg_len(algp)) { 49 NL_SET_ERR_MSG(extack, "Invalid AUTH/CRYPT/COMP attribute length"); 50 return -EINVAL; 51 } 52 53 switch (type) { 54 case XFRMA_ALG_AUTH: 55 case XFRMA_ALG_CRYPT: 56 case XFRMA_ALG_COMP: 57 break; 58 59 default: 60 NL_SET_ERR_MSG(extack, "Invalid algorithm attribute type"); 61 return -EINVAL; 62 } 63 64 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 65 return 0; 66 } 67 68 static int verify_auth_trunc(struct nlattr **attrs, 69 struct netlink_ext_ack *extack) 70 { 71 struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC]; 72 struct xfrm_algo_auth *algp; 73 74 if (!rt) 75 return 0; 76 77 algp = nla_data(rt); 78 if (nla_len(rt) < (int)xfrm_alg_auth_len(algp)) { 79 NL_SET_ERR_MSG(extack, "Invalid AUTH_TRUNC attribute length"); 80 return -EINVAL; 81 } 82 83 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 84 return 0; 85 } 86 87 static int verify_aead(struct nlattr **attrs, struct netlink_ext_ack *extack) 88 { 89 struct nlattr *rt = attrs[XFRMA_ALG_AEAD]; 90 struct xfrm_algo_aead *algp; 91 92 if (!rt) 93 return 0; 94 95 algp = nla_data(rt); 96 if (nla_len(rt) < (int)aead_len(algp)) { 97 NL_SET_ERR_MSG(extack, "Invalid AEAD attribute length"); 98 return -EINVAL; 99 } 100 101 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0'; 102 return 0; 103 } 104 105 static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type, 106 xfrm_address_t **addrp) 107 { 108 struct nlattr *rt = attrs[type]; 109 110 if (rt && addrp) 111 *addrp = nla_data(rt); 112 } 113 114 static inline int verify_sec_ctx_len(struct nlattr **attrs, struct netlink_ext_ack *extack) 115 { 116 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 117 struct xfrm_user_sec_ctx *uctx; 118 119 if (!rt) 120 return 0; 121 122 uctx = nla_data(rt); 123 if (uctx->len > nla_len(rt) || 124 uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) { 125 NL_SET_ERR_MSG(extack, "Invalid security context length"); 126 return -EINVAL; 127 } 128 129 return 0; 130 } 131 132 static inline int verify_replay(struct xfrm_usersa_info *p, 133 struct nlattr **attrs, u8 sa_dir, 134 struct netlink_ext_ack *extack) 135 { 136 struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; 137 struct xfrm_replay_state_esn *rs; 138 139 if (!rt) { 140 if (p->flags & XFRM_STATE_ESN) { 141 NL_SET_ERR_MSG(extack, "Missing required attribute for ESN"); 142 return -EINVAL; 143 } 144 return 0; 145 } 146 147 rs = nla_data(rt); 148 149 if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) { 150 NL_SET_ERR_MSG(extack, "ESN bitmap length must be <= 128"); 151 return -EINVAL; 152 } 153 154 if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) && 155 nla_len(rt) != sizeof(*rs)) { 156 NL_SET_ERR_MSG(extack, "ESN attribute is too short to fit the full bitmap length"); 157 return -EINVAL; 158 } 159 160 /* As only ESP and AH support ESN feature. */ 161 if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) { 162 NL_SET_ERR_MSG(extack, "ESN only supported for ESP and AH"); 163 return -EINVAL; 164 } 165 166 if (p->replay_window != 0) { 167 NL_SET_ERR_MSG(extack, "ESN not compatible with legacy replay_window"); 168 return -EINVAL; 169 } 170 171 if (sa_dir == XFRM_SA_DIR_OUT) { 172 if (rs->replay_window) { 173 NL_SET_ERR_MSG(extack, "Replay window should be 0 for output SA"); 174 return -EINVAL; 175 } 176 if (rs->seq || rs->seq_hi) { 177 NL_SET_ERR_MSG(extack, 178 "Replay seq and seq_hi should be 0 for output SA"); 179 return -EINVAL; 180 } 181 if (rs->bmp_len) { 182 NL_SET_ERR_MSG(extack, "Replay bmp_len should 0 for output SA"); 183 return -EINVAL; 184 } 185 } 186 187 if (sa_dir == XFRM_SA_DIR_IN) { 188 if (rs->oseq || rs->oseq_hi) { 189 NL_SET_ERR_MSG(extack, 190 "Replay oseq and oseq_hi should be 0 for input SA"); 191 return -EINVAL; 192 } 193 } 194 195 return 0; 196 } 197 198 static int verify_newsa_info(struct xfrm_usersa_info *p, 199 struct nlattr **attrs, 200 struct netlink_ext_ack *extack) 201 { 202 int err; 203 u8 sa_dir = nla_get_u8_default(attrs[XFRMA_SA_DIR], 0); 204 u16 family = p->sel.family; 205 206 err = -EINVAL; 207 switch (p->family) { 208 case AF_INET: 209 break; 210 211 case AF_INET6: 212 #if IS_ENABLED(CONFIG_IPV6) 213 break; 214 #else 215 err = -EAFNOSUPPORT; 216 NL_SET_ERR_MSG(extack, "IPv6 support disabled"); 217 goto out; 218 #endif 219 220 default: 221 NL_SET_ERR_MSG(extack, "Invalid address family"); 222 goto out; 223 } 224 225 if (!family && !(p->flags & XFRM_STATE_AF_UNSPEC)) 226 family = p->family; 227 228 switch (family) { 229 case AF_UNSPEC: 230 break; 231 232 case AF_INET: 233 if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) { 234 NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 32 for IPv4)"); 235 goto out; 236 } 237 238 break; 239 240 case AF_INET6: 241 #if IS_ENABLED(CONFIG_IPV6) 242 if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) { 243 NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 128 for IPv6)"); 244 goto out; 245 } 246 247 break; 248 #else 249 NL_SET_ERR_MSG(extack, "IPv6 support disabled"); 250 err = -EAFNOSUPPORT; 251 goto out; 252 #endif 253 254 default: 255 NL_SET_ERR_MSG(extack, "Invalid address family in selector"); 256 goto out; 257 } 258 259 err = -EINVAL; 260 switch (p->id.proto) { 261 case IPPROTO_AH: 262 if (!attrs[XFRMA_ALG_AUTH] && 263 !attrs[XFRMA_ALG_AUTH_TRUNC]) { 264 NL_SET_ERR_MSG(extack, "Missing required attribute for AH: AUTH_TRUNC or AUTH"); 265 goto out; 266 } 267 268 if (attrs[XFRMA_ALG_AEAD] || 269 attrs[XFRMA_ALG_CRYPT] || 270 attrs[XFRMA_ALG_COMP] || 271 attrs[XFRMA_TFCPAD]) { 272 NL_SET_ERR_MSG(extack, "Invalid attributes for AH: AEAD, CRYPT, COMP, TFCPAD"); 273 goto out; 274 } 275 break; 276 277 case IPPROTO_ESP: 278 if (attrs[XFRMA_ALG_COMP]) { 279 NL_SET_ERR_MSG(extack, "Invalid attribute for ESP: COMP"); 280 goto out; 281 } 282 283 if (!attrs[XFRMA_ALG_AUTH] && 284 !attrs[XFRMA_ALG_AUTH_TRUNC] && 285 !attrs[XFRMA_ALG_CRYPT] && 286 !attrs[XFRMA_ALG_AEAD]) { 287 NL_SET_ERR_MSG(extack, "Missing required attribute for ESP: at least one of AUTH, AUTH_TRUNC, CRYPT, AEAD"); 288 goto out; 289 } 290 291 if ((attrs[XFRMA_ALG_AUTH] || 292 attrs[XFRMA_ALG_AUTH_TRUNC] || 293 attrs[XFRMA_ALG_CRYPT]) && 294 attrs[XFRMA_ALG_AEAD]) { 295 NL_SET_ERR_MSG(extack, "Invalid attribute combination for ESP: AEAD can't be used with AUTH, AUTH_TRUNC, CRYPT"); 296 goto out; 297 } 298 299 if (attrs[XFRMA_TFCPAD] && 300 p->mode != XFRM_MODE_TUNNEL) { 301 NL_SET_ERR_MSG(extack, "TFC padding can only be used in tunnel mode"); 302 goto out; 303 } 304 break; 305 306 case IPPROTO_COMP: 307 if (!attrs[XFRMA_ALG_COMP]) { 308 NL_SET_ERR_MSG(extack, "Missing required attribute for COMP: COMP"); 309 goto out; 310 } 311 312 if (attrs[XFRMA_ALG_AEAD] || 313 attrs[XFRMA_ALG_AUTH] || 314 attrs[XFRMA_ALG_AUTH_TRUNC] || 315 attrs[XFRMA_ALG_CRYPT] || 316 attrs[XFRMA_TFCPAD]) { 317 NL_SET_ERR_MSG(extack, "Invalid attributes for COMP: AEAD, AUTH, AUTH_TRUNC, CRYPT, TFCPAD"); 318 goto out; 319 } 320 321 if (ntohl(p->id.spi) >= 0x10000) { 322 NL_SET_ERR_MSG(extack, "SPI is too large for COMP (must be < 0x10000)"); 323 goto out; 324 } 325 break; 326 327 #if IS_ENABLED(CONFIG_IPV6) 328 case IPPROTO_DSTOPTS: 329 case IPPROTO_ROUTING: 330 if (attrs[XFRMA_ALG_COMP] || 331 attrs[XFRMA_ALG_AUTH] || 332 attrs[XFRMA_ALG_AUTH_TRUNC] || 333 attrs[XFRMA_ALG_AEAD] || 334 attrs[XFRMA_ALG_CRYPT] || 335 attrs[XFRMA_ENCAP] || 336 attrs[XFRMA_SEC_CTX] || 337 attrs[XFRMA_TFCPAD]) { 338 NL_SET_ERR_MSG(extack, "Invalid attributes for DSTOPTS/ROUTING"); 339 goto out; 340 } 341 342 if (!attrs[XFRMA_COADDR]) { 343 NL_SET_ERR_MSG(extack, "Missing required COADDR attribute for DSTOPTS/ROUTING"); 344 goto out; 345 } 346 break; 347 #endif 348 349 default: 350 NL_SET_ERR_MSG(extack, "Unsupported protocol"); 351 goto out; 352 } 353 354 if ((err = verify_aead(attrs, extack))) 355 goto out; 356 if ((err = verify_auth_trunc(attrs, extack))) 357 goto out; 358 if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH, extack))) 359 goto out; 360 if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT, extack))) 361 goto out; 362 if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP, extack))) 363 goto out; 364 if ((err = verify_sec_ctx_len(attrs, extack))) 365 goto out; 366 if ((err = verify_replay(p, attrs, sa_dir, extack))) 367 goto out; 368 369 err = -EINVAL; 370 switch (p->mode) { 371 case XFRM_MODE_TRANSPORT: 372 case XFRM_MODE_TUNNEL: 373 case XFRM_MODE_ROUTEOPTIMIZATION: 374 case XFRM_MODE_BEET: 375 break; 376 377 default: 378 NL_SET_ERR_MSG(extack, "Unsupported mode"); 379 goto out; 380 } 381 382 err = 0; 383 384 if (attrs[XFRMA_MTIMER_THRESH]) { 385 if (!attrs[XFRMA_ENCAP]) { 386 NL_SET_ERR_MSG(extack, "MTIMER_THRESH attribute can only be set on ENCAP states"); 387 err = -EINVAL; 388 goto out; 389 } 390 391 if (sa_dir == XFRM_SA_DIR_OUT) { 392 NL_SET_ERR_MSG(extack, 393 "MTIMER_THRESH attribute should not be set on output SA"); 394 err = -EINVAL; 395 goto out; 396 } 397 } 398 399 if (sa_dir == XFRM_SA_DIR_OUT) { 400 if (p->flags & XFRM_STATE_DECAP_DSCP) { 401 NL_SET_ERR_MSG(extack, "Flag DECAP_DSCP should not be set for output SA"); 402 err = -EINVAL; 403 goto out; 404 } 405 406 if (p->flags & XFRM_STATE_ICMP) { 407 NL_SET_ERR_MSG(extack, "Flag ICMP should not be set for output SA"); 408 err = -EINVAL; 409 goto out; 410 } 411 412 if (p->flags & XFRM_STATE_WILDRECV) { 413 NL_SET_ERR_MSG(extack, "Flag WILDRECV should not be set for output SA"); 414 err = -EINVAL; 415 goto out; 416 } 417 418 if (p->replay_window) { 419 NL_SET_ERR_MSG(extack, "Replay window should be 0 for output SA"); 420 err = -EINVAL; 421 goto out; 422 } 423 424 if (attrs[XFRMA_REPLAY_VAL]) { 425 struct xfrm_replay_state *replay; 426 427 replay = nla_data(attrs[XFRMA_REPLAY_VAL]); 428 429 if (replay->seq || replay->bitmap) { 430 NL_SET_ERR_MSG(extack, 431 "Replay seq and bitmap should be 0 for output SA"); 432 err = -EINVAL; 433 goto out; 434 } 435 } 436 } 437 438 if (sa_dir == XFRM_SA_DIR_IN) { 439 if (p->flags & XFRM_STATE_NOPMTUDISC) { 440 NL_SET_ERR_MSG(extack, "Flag NOPMTUDISC should not be set for input SA"); 441 err = -EINVAL; 442 goto out; 443 } 444 445 if (attrs[XFRMA_SA_EXTRA_FLAGS]) { 446 u32 xflags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); 447 448 if (xflags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP) { 449 NL_SET_ERR_MSG(extack, "Flag DONT_ENCAP_DSCP should not be set for input SA"); 450 err = -EINVAL; 451 goto out; 452 } 453 454 if (xflags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP) { 455 NL_SET_ERR_MSG(extack, "Flag OSEQ_MAY_WRAP should not be set for input SA"); 456 err = -EINVAL; 457 goto out; 458 } 459 460 } 461 } 462 463 if (!sa_dir && attrs[XFRMA_SA_PCPU]) { 464 NL_SET_ERR_MSG(extack, "SA_PCPU only supported with SA_DIR"); 465 err = -EINVAL; 466 goto out; 467 } 468 469 out: 470 return err; 471 } 472 473 static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 474 struct xfrm_algo_desc *(*get_byname)(const char *, int), 475 struct nlattr *rta, struct netlink_ext_ack *extack) 476 { 477 struct xfrm_algo *p, *ualg; 478 struct xfrm_algo_desc *algo; 479 480 if (!rta) 481 return 0; 482 483 ualg = nla_data(rta); 484 485 algo = get_byname(ualg->alg_name, 1); 486 if (!algo) { 487 NL_SET_ERR_MSG(extack, "Requested COMP algorithm not found"); 488 return -ENOSYS; 489 } 490 *props = algo->desc.sadb_alg_id; 491 492 p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 493 if (!p) 494 return -ENOMEM; 495 496 strcpy(p->alg_name, algo->name); 497 *algpp = p; 498 return 0; 499 } 500 501 static int attach_crypt(struct xfrm_state *x, struct nlattr *rta, 502 struct netlink_ext_ack *extack) 503 { 504 struct xfrm_algo *p, *ualg; 505 struct xfrm_algo_desc *algo; 506 507 if (!rta) 508 return 0; 509 510 ualg = nla_data(rta); 511 512 algo = xfrm_ealg_get_byname(ualg->alg_name, 1); 513 if (!algo) { 514 NL_SET_ERR_MSG(extack, "Requested CRYPT algorithm not found"); 515 return -ENOSYS; 516 } 517 x->props.ealgo = algo->desc.sadb_alg_id; 518 519 p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL); 520 if (!p) 521 return -ENOMEM; 522 523 strcpy(p->alg_name, algo->name); 524 x->ealg = p; 525 x->geniv = algo->uinfo.encr.geniv; 526 return 0; 527 } 528 529 static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props, 530 struct nlattr *rta, struct netlink_ext_ack *extack) 531 { 532 struct xfrm_algo *ualg; 533 struct xfrm_algo_auth *p; 534 struct xfrm_algo_desc *algo; 535 536 if (!rta) 537 return 0; 538 539 ualg = nla_data(rta); 540 541 algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 542 if (!algo) { 543 NL_SET_ERR_MSG(extack, "Requested AUTH algorithm not found"); 544 return -ENOSYS; 545 } 546 *props = algo->desc.sadb_alg_id; 547 548 p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL); 549 if (!p) 550 return -ENOMEM; 551 552 strcpy(p->alg_name, algo->name); 553 p->alg_key_len = ualg->alg_key_len; 554 p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 555 memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8); 556 557 *algpp = p; 558 return 0; 559 } 560 561 static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props, 562 struct nlattr *rta, struct netlink_ext_ack *extack) 563 { 564 struct xfrm_algo_auth *p, *ualg; 565 struct xfrm_algo_desc *algo; 566 567 if (!rta) 568 return 0; 569 570 ualg = nla_data(rta); 571 572 algo = xfrm_aalg_get_byname(ualg->alg_name, 1); 573 if (!algo) { 574 NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found"); 575 return -ENOSYS; 576 } 577 if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) { 578 NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV"); 579 return -EINVAL; 580 } 581 *props = algo->desc.sadb_alg_id; 582 583 p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL); 584 if (!p) 585 return -ENOMEM; 586 587 strcpy(p->alg_name, algo->name); 588 if (!p->alg_trunc_len) 589 p->alg_trunc_len = algo->uinfo.auth.icv_truncbits; 590 591 *algpp = p; 592 return 0; 593 } 594 595 static int attach_aead(struct xfrm_state *x, struct nlattr *rta, 596 struct netlink_ext_ack *extack) 597 { 598 struct xfrm_algo_aead *p, *ualg; 599 struct xfrm_algo_desc *algo; 600 601 if (!rta) 602 return 0; 603 604 ualg = nla_data(rta); 605 606 algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1); 607 if (!algo) { 608 NL_SET_ERR_MSG(extack, "Requested AEAD algorithm not found"); 609 return -ENOSYS; 610 } 611 x->props.ealgo = algo->desc.sadb_alg_id; 612 613 p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL); 614 if (!p) 615 return -ENOMEM; 616 617 strcpy(p->alg_name, algo->name); 618 x->aead = p; 619 x->geniv = algo->uinfo.aead.geniv; 620 return 0; 621 } 622 623 static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn, 624 struct nlattr *rp, 625 struct netlink_ext_ack *extack) 626 { 627 struct xfrm_replay_state_esn *up; 628 unsigned int ulen; 629 630 if (!replay_esn || !rp) 631 return 0; 632 633 up = nla_data(rp); 634 ulen = xfrm_replay_state_esn_len(up); 635 636 /* Check the overall length and the internal bitmap length to avoid 637 * potential overflow. */ 638 if (nla_len(rp) < (int)ulen) { 639 NL_SET_ERR_MSG(extack, "ESN attribute is too short"); 640 return -EINVAL; 641 } 642 643 if (xfrm_replay_state_esn_len(replay_esn) != ulen) { 644 NL_SET_ERR_MSG(extack, "New ESN size doesn't match the existing SA's ESN size"); 645 return -EINVAL; 646 } 647 648 if (replay_esn->bmp_len != up->bmp_len) { 649 NL_SET_ERR_MSG(extack, "New ESN bitmap size doesn't match the existing SA's ESN bitmap"); 650 return -EINVAL; 651 } 652 653 if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) { 654 NL_SET_ERR_MSG(extack, "ESN replay window is longer than the bitmap"); 655 return -EINVAL; 656 } 657 658 return 0; 659 } 660 661 static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn, 662 struct xfrm_replay_state_esn **preplay_esn, 663 struct nlattr *rta) 664 { 665 struct xfrm_replay_state_esn *p, *pp, *up; 666 unsigned int klen, ulen; 667 668 if (!rta) 669 return 0; 670 671 up = nla_data(rta); 672 klen = xfrm_replay_state_esn_len(up); 673 ulen = nla_len(rta) >= (int)klen ? klen : sizeof(*up); 674 675 p = kzalloc(klen, GFP_KERNEL); 676 if (!p) 677 return -ENOMEM; 678 679 pp = kzalloc(klen, GFP_KERNEL); 680 if (!pp) { 681 kfree(p); 682 return -ENOMEM; 683 } 684 685 memcpy(p, up, ulen); 686 memcpy(pp, up, ulen); 687 688 *replay_esn = p; 689 *preplay_esn = pp; 690 691 return 0; 692 } 693 694 static inline unsigned int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx) 695 { 696 unsigned int len = 0; 697 698 if (xfrm_ctx) { 699 len += sizeof(struct xfrm_user_sec_ctx); 700 len += xfrm_ctx->ctx_len; 701 } 702 return len; 703 } 704 705 static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 706 { 707 memcpy(&x->id, &p->id, sizeof(x->id)); 708 memcpy(&x->sel, &p->sel, sizeof(x->sel)); 709 memcpy(&x->lft, &p->lft, sizeof(x->lft)); 710 x->props.mode = p->mode; 711 x->props.replay_window = min_t(unsigned int, p->replay_window, 712 sizeof(x->replay.bitmap) * 8); 713 x->props.reqid = p->reqid; 714 x->props.family = p->family; 715 memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr)); 716 x->props.flags = p->flags; 717 718 if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC)) 719 x->sel.family = p->family; 720 } 721 722 /* 723 * someday when pfkey also has support, we could have the code 724 * somehow made shareable and move it to xfrm_state.c - JHS 725 * 726 */ 727 static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, 728 int update_esn) 729 { 730 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 731 struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL; 732 struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 733 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 734 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 735 struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH]; 736 737 if (re && x->replay_esn && x->preplay_esn) { 738 struct xfrm_replay_state_esn *replay_esn; 739 replay_esn = nla_data(re); 740 memcpy(x->replay_esn, replay_esn, 741 xfrm_replay_state_esn_len(replay_esn)); 742 memcpy(x->preplay_esn, replay_esn, 743 xfrm_replay_state_esn_len(replay_esn)); 744 } 745 746 if (rp) { 747 struct xfrm_replay_state *replay; 748 replay = nla_data(rp); 749 memcpy(&x->replay, replay, sizeof(*replay)); 750 memcpy(&x->preplay, replay, sizeof(*replay)); 751 } 752 753 if (lt) { 754 struct xfrm_lifetime_cur *ltime; 755 ltime = nla_data(lt); 756 x->curlft.bytes = ltime->bytes; 757 x->curlft.packets = ltime->packets; 758 x->curlft.add_time = ltime->add_time; 759 x->curlft.use_time = ltime->use_time; 760 } 761 762 if (et) 763 x->replay_maxage = nla_get_u32(et); 764 765 if (rt) 766 x->replay_maxdiff = nla_get_u32(rt); 767 768 if (mt) 769 x->mapping_maxage = nla_get_u32(mt); 770 } 771 772 static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m) 773 { 774 if (attrs[XFRMA_SET_MARK]) { 775 m->v = nla_get_u32(attrs[XFRMA_SET_MARK]); 776 m->m = nla_get_u32_default(attrs[XFRMA_SET_MARK_MASK], 777 0xffffffff); 778 } else { 779 m->v = m->m = 0; 780 } 781 } 782 783 static struct xfrm_state *xfrm_state_construct(struct net *net, 784 struct xfrm_usersa_info *p, 785 struct nlattr **attrs, 786 int *errp, 787 struct netlink_ext_ack *extack) 788 { 789 struct xfrm_state *x = xfrm_state_alloc(net); 790 int err = -ENOMEM; 791 792 if (!x) 793 goto error_no_put; 794 795 copy_from_user_state(x, p); 796 797 if (attrs[XFRMA_ENCAP]) { 798 x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 799 sizeof(*x->encap), GFP_KERNEL); 800 if (x->encap == NULL) 801 goto error; 802 } 803 804 if (attrs[XFRMA_COADDR]) { 805 x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), 806 sizeof(*x->coaddr), GFP_KERNEL); 807 if (x->coaddr == NULL) 808 goto error; 809 } 810 811 if (attrs[XFRMA_SA_EXTRA_FLAGS]) 812 x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); 813 814 if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD], extack))) 815 goto error; 816 if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo, 817 attrs[XFRMA_ALG_AUTH_TRUNC], extack))) 818 goto error; 819 if (!x->props.aalgo) { 820 if ((err = attach_auth(&x->aalg, &x->props.aalgo, 821 attrs[XFRMA_ALG_AUTH], extack))) 822 goto error; 823 } 824 if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT], extack))) 825 goto error; 826 if ((err = attach_one_algo(&x->calg, &x->props.calgo, 827 xfrm_calg_get_byname, 828 attrs[XFRMA_ALG_COMP], extack))) 829 goto error; 830 831 if (attrs[XFRMA_TFCPAD]) 832 x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]); 833 834 xfrm_mark_get(attrs, &x->mark); 835 836 xfrm_smark_init(attrs, &x->props.smark); 837 838 if (attrs[XFRMA_IF_ID]) 839 x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 840 841 if (attrs[XFRMA_SA_DIR]) 842 x->dir = nla_get_u8(attrs[XFRMA_SA_DIR]); 843 844 if (attrs[XFRMA_NAT_KEEPALIVE_INTERVAL]) 845 x->nat_keepalive_interval = 846 nla_get_u32(attrs[XFRMA_NAT_KEEPALIVE_INTERVAL]); 847 848 if (attrs[XFRMA_SA_PCPU]) { 849 x->pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); 850 if (x->pcpu_num >= num_possible_cpus()) 851 goto error; 852 } 853 854 err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV], extack); 855 if (err) 856 goto error; 857 858 if (attrs[XFRMA_SEC_CTX]) { 859 err = security_xfrm_state_alloc(x, 860 nla_data(attrs[XFRMA_SEC_CTX])); 861 if (err) 862 goto error; 863 } 864 865 if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn, 866 attrs[XFRMA_REPLAY_ESN_VAL]))) 867 goto error; 868 869 x->km.seq = p->seq; 870 x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth; 871 /* sysctl_xfrm_aevent_etime is in 100ms units */ 872 x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M; 873 874 if ((err = xfrm_init_replay(x, extack))) 875 goto error; 876 877 /* override default values from above */ 878 xfrm_update_ae_params(x, attrs, 0); 879 880 /* configure the hardware if offload is requested */ 881 if (attrs[XFRMA_OFFLOAD_DEV]) { 882 err = xfrm_dev_state_add(net, x, 883 nla_data(attrs[XFRMA_OFFLOAD_DEV]), 884 extack); 885 if (err) 886 goto error; 887 } 888 889 return x; 890 891 error: 892 x->km.state = XFRM_STATE_DEAD; 893 xfrm_state_put(x); 894 error_no_put: 895 *errp = err; 896 return NULL; 897 } 898 899 static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 900 struct nlattr **attrs, struct netlink_ext_ack *extack) 901 { 902 struct net *net = sock_net(skb->sk); 903 struct xfrm_usersa_info *p = nlmsg_data(nlh); 904 struct xfrm_state *x; 905 int err; 906 struct km_event c; 907 908 err = verify_newsa_info(p, attrs, extack); 909 if (err) 910 return err; 911 912 x = xfrm_state_construct(net, p, attrs, &err, extack); 913 if (!x) 914 return err; 915 916 xfrm_state_hold(x); 917 if (nlh->nlmsg_type == XFRM_MSG_NEWSA) 918 err = xfrm_state_add(x); 919 else 920 err = xfrm_state_update(x); 921 922 xfrm_audit_state_add(x, err ? 0 : 1, true); 923 924 if (err < 0) { 925 x->km.state = XFRM_STATE_DEAD; 926 xfrm_dev_state_delete(x); 927 __xfrm_state_put(x); 928 goto out; 929 } 930 931 if (x->km.state == XFRM_STATE_VOID) 932 x->km.state = XFRM_STATE_VALID; 933 934 c.seq = nlh->nlmsg_seq; 935 c.portid = nlh->nlmsg_pid; 936 c.event = nlh->nlmsg_type; 937 938 km_state_notify(x, &c); 939 out: 940 xfrm_state_put(x); 941 return err; 942 } 943 944 static struct xfrm_state *xfrm_user_state_lookup(struct net *net, 945 struct xfrm_usersa_id *p, 946 struct nlattr **attrs, 947 int *errp) 948 { 949 struct xfrm_state *x = NULL; 950 struct xfrm_mark m; 951 int err; 952 u32 mark = xfrm_mark_get(attrs, &m); 953 954 if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) { 955 err = -ESRCH; 956 x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family); 957 } else { 958 xfrm_address_t *saddr = NULL; 959 960 verify_one_addr(attrs, XFRMA_SRCADDR, &saddr); 961 if (!saddr) { 962 err = -EINVAL; 963 goto out; 964 } 965 966 err = -ESRCH; 967 x = xfrm_state_lookup_byaddr(net, mark, 968 &p->daddr, saddr, 969 p->proto, p->family); 970 } 971 972 out: 973 if (!x && errp) 974 *errp = err; 975 return x; 976 } 977 978 static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 979 struct nlattr **attrs, struct netlink_ext_ack *extack) 980 { 981 struct net *net = sock_net(skb->sk); 982 struct xfrm_state *x; 983 int err = -ESRCH; 984 struct km_event c; 985 struct xfrm_usersa_id *p = nlmsg_data(nlh); 986 987 x = xfrm_user_state_lookup(net, p, attrs, &err); 988 if (x == NULL) 989 return err; 990 991 if ((err = security_xfrm_state_delete(x)) != 0) 992 goto out; 993 994 if (xfrm_state_kern(x)) { 995 NL_SET_ERR_MSG(extack, "SA is in use by tunnels"); 996 err = -EPERM; 997 goto out; 998 } 999 1000 err = xfrm_state_delete(x); 1001 if (err < 0) 1002 goto out; 1003 1004 c.seq = nlh->nlmsg_seq; 1005 c.portid = nlh->nlmsg_pid; 1006 c.event = nlh->nlmsg_type; 1007 km_state_notify(x, &c); 1008 1009 out: 1010 xfrm_audit_state_delete(x, err ? 0 : 1, true); 1011 xfrm_state_put(x); 1012 return err; 1013 } 1014 1015 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) 1016 { 1017 memset(p, 0, sizeof(*p)); 1018 memcpy(&p->id, &x->id, sizeof(p->id)); 1019 memcpy(&p->sel, &x->sel, sizeof(p->sel)); 1020 memcpy(&p->lft, &x->lft, sizeof(p->lft)); 1021 if (x->xso.dev) 1022 xfrm_dev_state_update_stats(x); 1023 memcpy(&p->curlft, &x->curlft, sizeof(p->curlft)); 1024 put_unaligned(x->stats.replay_window, &p->stats.replay_window); 1025 put_unaligned(x->stats.replay, &p->stats.replay); 1026 put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed); 1027 memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr)); 1028 p->mode = x->props.mode; 1029 p->replay_window = x->props.replay_window; 1030 p->reqid = x->props.reqid; 1031 p->family = x->props.family; 1032 p->flags = x->props.flags; 1033 p->seq = x->km.seq; 1034 } 1035 1036 struct xfrm_dump_info { 1037 struct sk_buff *in_skb; 1038 struct sk_buff *out_skb; 1039 u32 nlmsg_seq; 1040 u16 nlmsg_flags; 1041 }; 1042 1043 static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb) 1044 { 1045 struct xfrm_user_sec_ctx *uctx; 1046 struct nlattr *attr; 1047 int ctx_size = sizeof(*uctx) + s->ctx_len; 1048 1049 attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size); 1050 if (attr == NULL) 1051 return -EMSGSIZE; 1052 1053 uctx = nla_data(attr); 1054 uctx->exttype = XFRMA_SEC_CTX; 1055 uctx->len = ctx_size; 1056 uctx->ctx_doi = s->ctx_doi; 1057 uctx->ctx_alg = s->ctx_alg; 1058 uctx->ctx_len = s->ctx_len; 1059 memcpy(uctx + 1, s->ctx_str, s->ctx_len); 1060 1061 return 0; 1062 } 1063 1064 static int copy_user_offload(struct xfrm_dev_offload *xso, struct sk_buff *skb) 1065 { 1066 struct xfrm_user_offload *xuo; 1067 struct nlattr *attr; 1068 1069 attr = nla_reserve(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo)); 1070 if (attr == NULL) 1071 return -EMSGSIZE; 1072 1073 xuo = nla_data(attr); 1074 memset(xuo, 0, sizeof(*xuo)); 1075 xuo->ifindex = xso->dev->ifindex; 1076 if (xso->dir == XFRM_DEV_OFFLOAD_IN) 1077 xuo->flags = XFRM_OFFLOAD_INBOUND; 1078 if (xso->type == XFRM_DEV_OFFLOAD_PACKET) 1079 xuo->flags |= XFRM_OFFLOAD_PACKET; 1080 1081 return 0; 1082 } 1083 1084 static bool xfrm_redact(void) 1085 { 1086 return IS_ENABLED(CONFIG_SECURITY) && 1087 security_locked_down(LOCKDOWN_XFRM_SECRET); 1088 } 1089 1090 static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb) 1091 { 1092 struct xfrm_algo *algo; 1093 struct xfrm_algo_auth *ap; 1094 struct nlattr *nla; 1095 bool redact_secret = xfrm_redact(); 1096 1097 nla = nla_reserve(skb, XFRMA_ALG_AUTH, 1098 sizeof(*algo) + (auth->alg_key_len + 7) / 8); 1099 if (!nla) 1100 return -EMSGSIZE; 1101 algo = nla_data(nla); 1102 strscpy_pad(algo->alg_name, auth->alg_name, sizeof(algo->alg_name)); 1103 1104 if (redact_secret && auth->alg_key_len) 1105 memset(algo->alg_key, 0, (auth->alg_key_len + 7) / 8); 1106 else 1107 memcpy(algo->alg_key, auth->alg_key, 1108 (auth->alg_key_len + 7) / 8); 1109 algo->alg_key_len = auth->alg_key_len; 1110 1111 nla = nla_reserve(skb, XFRMA_ALG_AUTH_TRUNC, xfrm_alg_auth_len(auth)); 1112 if (!nla) 1113 return -EMSGSIZE; 1114 ap = nla_data(nla); 1115 strscpy_pad(ap->alg_name, auth->alg_name, sizeof(ap->alg_name)); 1116 ap->alg_key_len = auth->alg_key_len; 1117 ap->alg_trunc_len = auth->alg_trunc_len; 1118 if (redact_secret && auth->alg_key_len) 1119 memset(ap->alg_key, 0, (auth->alg_key_len + 7) / 8); 1120 else 1121 memcpy(ap->alg_key, auth->alg_key, 1122 (auth->alg_key_len + 7) / 8); 1123 return 0; 1124 } 1125 1126 static int copy_to_user_aead(struct xfrm_algo_aead *aead, struct sk_buff *skb) 1127 { 1128 struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_AEAD, aead_len(aead)); 1129 struct xfrm_algo_aead *ap; 1130 bool redact_secret = xfrm_redact(); 1131 1132 if (!nla) 1133 return -EMSGSIZE; 1134 1135 ap = nla_data(nla); 1136 strscpy_pad(ap->alg_name, aead->alg_name, sizeof(ap->alg_name)); 1137 ap->alg_key_len = aead->alg_key_len; 1138 ap->alg_icv_len = aead->alg_icv_len; 1139 1140 if (redact_secret && aead->alg_key_len) 1141 memset(ap->alg_key, 0, (aead->alg_key_len + 7) / 8); 1142 else 1143 memcpy(ap->alg_key, aead->alg_key, 1144 (aead->alg_key_len + 7) / 8); 1145 return 0; 1146 } 1147 1148 static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb) 1149 { 1150 struct xfrm_algo *ap; 1151 bool redact_secret = xfrm_redact(); 1152 struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_CRYPT, 1153 xfrm_alg_len(ealg)); 1154 if (!nla) 1155 return -EMSGSIZE; 1156 1157 ap = nla_data(nla); 1158 strscpy_pad(ap->alg_name, ealg->alg_name, sizeof(ap->alg_name)); 1159 ap->alg_key_len = ealg->alg_key_len; 1160 1161 if (redact_secret && ealg->alg_key_len) 1162 memset(ap->alg_key, 0, (ealg->alg_key_len + 7) / 8); 1163 else 1164 memcpy(ap->alg_key, ealg->alg_key, 1165 (ealg->alg_key_len + 7) / 8); 1166 1167 return 0; 1168 } 1169 1170 static int copy_to_user_calg(struct xfrm_algo *calg, struct sk_buff *skb) 1171 { 1172 struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_COMP, sizeof(*calg)); 1173 struct xfrm_algo *ap; 1174 1175 if (!nla) 1176 return -EMSGSIZE; 1177 1178 ap = nla_data(nla); 1179 strscpy_pad(ap->alg_name, calg->alg_name, sizeof(ap->alg_name)); 1180 ap->alg_key_len = 0; 1181 1182 return 0; 1183 } 1184 1185 static int copy_to_user_encap(struct xfrm_encap_tmpl *ep, struct sk_buff *skb) 1186 { 1187 struct nlattr *nla = nla_reserve(skb, XFRMA_ENCAP, sizeof(*ep)); 1188 struct xfrm_encap_tmpl *uep; 1189 1190 if (!nla) 1191 return -EMSGSIZE; 1192 1193 uep = nla_data(nla); 1194 memset(uep, 0, sizeof(*uep)); 1195 1196 uep->encap_type = ep->encap_type; 1197 uep->encap_sport = ep->encap_sport; 1198 uep->encap_dport = ep->encap_dport; 1199 uep->encap_oa = ep->encap_oa; 1200 1201 return 0; 1202 } 1203 1204 static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m) 1205 { 1206 int ret = 0; 1207 1208 if (m->v | m->m) { 1209 ret = nla_put_u32(skb, XFRMA_SET_MARK, m->v); 1210 if (!ret) 1211 ret = nla_put_u32(skb, XFRMA_SET_MARK_MASK, m->m); 1212 } 1213 return ret; 1214 } 1215 1216 /* Don't change this without updating xfrm_sa_len! */ 1217 static int copy_to_user_state_extra(struct xfrm_state *x, 1218 struct xfrm_usersa_info *p, 1219 struct sk_buff *skb) 1220 { 1221 int ret = 0; 1222 1223 copy_to_user_state(x, p); 1224 1225 if (x->props.extra_flags) { 1226 ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS, 1227 x->props.extra_flags); 1228 if (ret) 1229 goto out; 1230 } 1231 1232 if (x->coaddr) { 1233 ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr); 1234 if (ret) 1235 goto out; 1236 } 1237 if (x->lastused) { 1238 ret = nla_put_u64_64bit(skb, XFRMA_LASTUSED, x->lastused, 1239 XFRMA_PAD); 1240 if (ret) 1241 goto out; 1242 } 1243 if (x->aead) { 1244 ret = copy_to_user_aead(x->aead, skb); 1245 if (ret) 1246 goto out; 1247 } 1248 if (x->aalg) { 1249 ret = copy_to_user_auth(x->aalg, skb); 1250 if (ret) 1251 goto out; 1252 } 1253 if (x->ealg) { 1254 ret = copy_to_user_ealg(x->ealg, skb); 1255 if (ret) 1256 goto out; 1257 } 1258 if (x->calg) { 1259 ret = copy_to_user_calg(x->calg, skb); 1260 if (ret) 1261 goto out; 1262 } 1263 if (x->encap) { 1264 ret = copy_to_user_encap(x->encap, skb); 1265 if (ret) 1266 goto out; 1267 } 1268 if (x->tfcpad) { 1269 ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad); 1270 if (ret) 1271 goto out; 1272 } 1273 ret = xfrm_mark_put(skb, &x->mark); 1274 if (ret) 1275 goto out; 1276 1277 ret = xfrm_smark_put(skb, &x->props.smark); 1278 if (ret) 1279 goto out; 1280 1281 if (x->replay_esn) 1282 ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 1283 xfrm_replay_state_esn_len(x->replay_esn), 1284 x->replay_esn); 1285 else 1286 ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 1287 &x->replay); 1288 if (ret) 1289 goto out; 1290 if(x->xso.dev) 1291 ret = copy_user_offload(&x->xso, skb); 1292 if (ret) 1293 goto out; 1294 if (x->if_id) { 1295 ret = nla_put_u32(skb, XFRMA_IF_ID, x->if_id); 1296 if (ret) 1297 goto out; 1298 } 1299 if (x->security) { 1300 ret = copy_sec_ctx(x->security, skb); 1301 if (ret) 1302 goto out; 1303 } 1304 if (x->mapping_maxage) { 1305 ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH, x->mapping_maxage); 1306 if (ret) 1307 goto out; 1308 } 1309 if (x->pcpu_num != UINT_MAX) { 1310 ret = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 1311 if (ret) 1312 goto out; 1313 } 1314 if (x->dir) 1315 ret = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); 1316 1317 if (x->nat_keepalive_interval) { 1318 ret = nla_put_u32(skb, XFRMA_NAT_KEEPALIVE_INTERVAL, 1319 x->nat_keepalive_interval); 1320 if (ret) 1321 goto out; 1322 } 1323 out: 1324 return ret; 1325 } 1326 1327 static int dump_one_state(struct xfrm_state *x, int count, void *ptr) 1328 { 1329 struct xfrm_dump_info *sp = ptr; 1330 struct sk_buff *in_skb = sp->in_skb; 1331 struct sk_buff *skb = sp->out_skb; 1332 struct xfrm_translator *xtr; 1333 struct xfrm_usersa_info *p; 1334 struct nlmsghdr *nlh; 1335 int err; 1336 1337 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 1338 XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags); 1339 if (nlh == NULL) 1340 return -EMSGSIZE; 1341 1342 p = nlmsg_data(nlh); 1343 1344 err = copy_to_user_state_extra(x, p, skb); 1345 if (err) { 1346 nlmsg_cancel(skb, nlh); 1347 return err; 1348 } 1349 nlmsg_end(skb, nlh); 1350 1351 xtr = xfrm_get_translator(); 1352 if (xtr) { 1353 err = xtr->alloc_compat(skb, nlh); 1354 1355 xfrm_put_translator(xtr); 1356 if (err) { 1357 nlmsg_cancel(skb, nlh); 1358 return err; 1359 } 1360 } 1361 1362 return 0; 1363 } 1364 1365 static int xfrm_dump_sa_done(struct netlink_callback *cb) 1366 { 1367 struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 1368 struct sock *sk = cb->skb->sk; 1369 struct net *net = sock_net(sk); 1370 1371 if (cb->args[0]) 1372 xfrm_state_walk_done(walk, net); 1373 return 0; 1374 } 1375 1376 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) 1377 { 1378 struct net *net = sock_net(skb->sk); 1379 struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1]; 1380 struct xfrm_dump_info info; 1381 1382 BUILD_BUG_ON(sizeof(struct xfrm_state_walk) > 1383 sizeof(cb->args) - sizeof(cb->args[0])); 1384 1385 info.in_skb = cb->skb; 1386 info.out_skb = skb; 1387 info.nlmsg_seq = cb->nlh->nlmsg_seq; 1388 info.nlmsg_flags = NLM_F_MULTI; 1389 1390 if (!cb->args[0]) { 1391 struct nlattr *attrs[XFRMA_MAX+1]; 1392 struct xfrm_address_filter *filter = NULL; 1393 u8 proto = 0; 1394 int err; 1395 1396 err = nlmsg_parse_deprecated(cb->nlh, 0, attrs, XFRMA_MAX, 1397 xfrma_policy, cb->extack); 1398 if (err < 0) 1399 return err; 1400 1401 if (attrs[XFRMA_ADDRESS_FILTER]) { 1402 filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), 1403 sizeof(*filter), GFP_KERNEL); 1404 if (filter == NULL) 1405 return -ENOMEM; 1406 1407 /* see addr_match(), (prefix length >> 5) << 2 1408 * will be used to compare xfrm_address_t 1409 */ 1410 if (filter->splen > (sizeof(xfrm_address_t) << 3) || 1411 filter->dplen > (sizeof(xfrm_address_t) << 3)) { 1412 kfree(filter); 1413 return -EINVAL; 1414 } 1415 } 1416 1417 if (attrs[XFRMA_PROTO]) 1418 proto = nla_get_u8(attrs[XFRMA_PROTO]); 1419 1420 xfrm_state_walk_init(walk, proto, filter); 1421 cb->args[0] = 1; 1422 } 1423 1424 (void) xfrm_state_walk(net, walk, dump_one_state, &info); 1425 1426 return skb->len; 1427 } 1428 1429 static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb, 1430 struct xfrm_state *x, u32 seq) 1431 { 1432 struct xfrm_dump_info info; 1433 struct sk_buff *skb; 1434 int err; 1435 1436 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1437 if (!skb) 1438 return ERR_PTR(-ENOMEM); 1439 1440 info.in_skb = in_skb; 1441 info.out_skb = skb; 1442 info.nlmsg_seq = seq; 1443 info.nlmsg_flags = 0; 1444 1445 err = dump_one_state(x, 0, &info); 1446 if (err) { 1447 kfree_skb(skb); 1448 return ERR_PTR(err); 1449 } 1450 1451 return skb; 1452 } 1453 1454 /* A wrapper for nlmsg_multicast() checking that nlsk is still available. 1455 * Must be called with RCU read lock. 1456 */ 1457 static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb, 1458 u32 pid, unsigned int group) 1459 { 1460 struct sock *nlsk = rcu_dereference(net->xfrm.nlsk); 1461 struct xfrm_translator *xtr; 1462 1463 if (!nlsk) { 1464 kfree_skb(skb); 1465 return -EPIPE; 1466 } 1467 1468 xtr = xfrm_get_translator(); 1469 if (xtr) { 1470 int err = xtr->alloc_compat(skb, nlmsg_hdr(skb)); 1471 1472 xfrm_put_translator(xtr); 1473 if (err) { 1474 kfree_skb(skb); 1475 return err; 1476 } 1477 } 1478 1479 return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); 1480 } 1481 1482 static inline unsigned int xfrm_spdinfo_msgsize(void) 1483 { 1484 return NLMSG_ALIGN(4) 1485 + nla_total_size(sizeof(struct xfrmu_spdinfo)) 1486 + nla_total_size(sizeof(struct xfrmu_spdhinfo)) 1487 + nla_total_size(sizeof(struct xfrmu_spdhthresh)) 1488 + nla_total_size(sizeof(struct xfrmu_spdhthresh)); 1489 } 1490 1491 static int build_spdinfo(struct sk_buff *skb, struct net *net, 1492 u32 portid, u32 seq, u32 flags) 1493 { 1494 struct xfrmk_spdinfo si; 1495 struct xfrmu_spdinfo spc; 1496 struct xfrmu_spdhinfo sph; 1497 struct xfrmu_spdhthresh spt4, spt6; 1498 struct nlmsghdr *nlh; 1499 int err; 1500 u32 *f; 1501 unsigned lseq; 1502 1503 nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0); 1504 if (nlh == NULL) /* shouldn't really happen ... */ 1505 return -EMSGSIZE; 1506 1507 f = nlmsg_data(nlh); 1508 *f = flags; 1509 xfrm_spd_getinfo(net, &si); 1510 spc.incnt = si.incnt; 1511 spc.outcnt = si.outcnt; 1512 spc.fwdcnt = si.fwdcnt; 1513 spc.inscnt = si.inscnt; 1514 spc.outscnt = si.outscnt; 1515 spc.fwdscnt = si.fwdscnt; 1516 sph.spdhcnt = si.spdhcnt; 1517 sph.spdhmcnt = si.spdhmcnt; 1518 1519 do { 1520 lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock); 1521 1522 spt4.lbits = net->xfrm.policy_hthresh.lbits4; 1523 spt4.rbits = net->xfrm.policy_hthresh.rbits4; 1524 spt6.lbits = net->xfrm.policy_hthresh.lbits6; 1525 spt6.rbits = net->xfrm.policy_hthresh.rbits6; 1526 } while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq)); 1527 1528 err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc); 1529 if (!err) 1530 err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph); 1531 if (!err) 1532 err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4); 1533 if (!err) 1534 err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6); 1535 if (err) { 1536 nlmsg_cancel(skb, nlh); 1537 return err; 1538 } 1539 1540 nlmsg_end(skb, nlh); 1541 return 0; 1542 } 1543 1544 static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1545 struct nlattr **attrs, 1546 struct netlink_ext_ack *extack) 1547 { 1548 struct net *net = sock_net(skb->sk); 1549 struct xfrmu_spdhthresh *thresh4 = NULL; 1550 struct xfrmu_spdhthresh *thresh6 = NULL; 1551 1552 /* selector prefixlen thresholds to hash policies */ 1553 if (attrs[XFRMA_SPD_IPV4_HTHRESH]) { 1554 struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH]; 1555 1556 if (nla_len(rta) < sizeof(*thresh4)) { 1557 NL_SET_ERR_MSG(extack, "Invalid SPD_IPV4_HTHRESH attribute length"); 1558 return -EINVAL; 1559 } 1560 thresh4 = nla_data(rta); 1561 if (thresh4->lbits > 32 || thresh4->rbits > 32) { 1562 NL_SET_ERR_MSG(extack, "Invalid hash threshold (must be <= 32 for IPv4)"); 1563 return -EINVAL; 1564 } 1565 } 1566 if (attrs[XFRMA_SPD_IPV6_HTHRESH]) { 1567 struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH]; 1568 1569 if (nla_len(rta) < sizeof(*thresh6)) { 1570 NL_SET_ERR_MSG(extack, "Invalid SPD_IPV6_HTHRESH attribute length"); 1571 return -EINVAL; 1572 } 1573 thresh6 = nla_data(rta); 1574 if (thresh6->lbits > 128 || thresh6->rbits > 128) { 1575 NL_SET_ERR_MSG(extack, "Invalid hash threshold (must be <= 128 for IPv6)"); 1576 return -EINVAL; 1577 } 1578 } 1579 1580 if (thresh4 || thresh6) { 1581 write_seqlock(&net->xfrm.policy_hthresh.lock); 1582 if (thresh4) { 1583 net->xfrm.policy_hthresh.lbits4 = thresh4->lbits; 1584 net->xfrm.policy_hthresh.rbits4 = thresh4->rbits; 1585 } 1586 if (thresh6) { 1587 net->xfrm.policy_hthresh.lbits6 = thresh6->lbits; 1588 net->xfrm.policy_hthresh.rbits6 = thresh6->rbits; 1589 } 1590 write_sequnlock(&net->xfrm.policy_hthresh.lock); 1591 1592 xfrm_policy_hash_rebuild(net); 1593 } 1594 1595 return 0; 1596 } 1597 1598 static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1599 struct nlattr **attrs, 1600 struct netlink_ext_ack *extack) 1601 { 1602 struct net *net = sock_net(skb->sk); 1603 struct sk_buff *r_skb; 1604 u32 *flags = nlmsg_data(nlh); 1605 u32 sportid = NETLINK_CB(skb).portid; 1606 u32 seq = nlh->nlmsg_seq; 1607 int err; 1608 1609 r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC); 1610 if (r_skb == NULL) 1611 return -ENOMEM; 1612 1613 err = build_spdinfo(r_skb, net, sportid, seq, *flags); 1614 BUG_ON(err < 0); 1615 1616 return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid); 1617 } 1618 1619 static inline unsigned int xfrm_sadinfo_msgsize(void) 1620 { 1621 return NLMSG_ALIGN(4) 1622 + nla_total_size(sizeof(struct xfrmu_sadhinfo)) 1623 + nla_total_size(4); /* XFRMA_SAD_CNT */ 1624 } 1625 1626 static int build_sadinfo(struct sk_buff *skb, struct net *net, 1627 u32 portid, u32 seq, u32 flags) 1628 { 1629 struct xfrmk_sadinfo si; 1630 struct xfrmu_sadhinfo sh; 1631 struct nlmsghdr *nlh; 1632 int err; 1633 u32 *f; 1634 1635 nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0); 1636 if (nlh == NULL) /* shouldn't really happen ... */ 1637 return -EMSGSIZE; 1638 1639 f = nlmsg_data(nlh); 1640 *f = flags; 1641 xfrm_sad_getinfo(net, &si); 1642 1643 sh.sadhmcnt = si.sadhmcnt; 1644 sh.sadhcnt = si.sadhcnt; 1645 1646 err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt); 1647 if (!err) 1648 err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh); 1649 if (err) { 1650 nlmsg_cancel(skb, nlh); 1651 return err; 1652 } 1653 1654 nlmsg_end(skb, nlh); 1655 return 0; 1656 } 1657 1658 static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 1659 struct nlattr **attrs, 1660 struct netlink_ext_ack *extack) 1661 { 1662 struct net *net = sock_net(skb->sk); 1663 struct sk_buff *r_skb; 1664 u32 *flags = nlmsg_data(nlh); 1665 u32 sportid = NETLINK_CB(skb).portid; 1666 u32 seq = nlh->nlmsg_seq; 1667 int err; 1668 1669 r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC); 1670 if (r_skb == NULL) 1671 return -ENOMEM; 1672 1673 err = build_sadinfo(r_skb, net, sportid, seq, *flags); 1674 BUG_ON(err < 0); 1675 1676 return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid); 1677 } 1678 1679 static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 1680 struct nlattr **attrs, struct netlink_ext_ack *extack) 1681 { 1682 struct net *net = sock_net(skb->sk); 1683 struct xfrm_usersa_id *p = nlmsg_data(nlh); 1684 struct xfrm_state *x; 1685 struct sk_buff *resp_skb; 1686 int err = -ESRCH; 1687 1688 x = xfrm_user_state_lookup(net, p, attrs, &err); 1689 if (x == NULL) 1690 goto out_noput; 1691 1692 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 1693 if (IS_ERR(resp_skb)) { 1694 err = PTR_ERR(resp_skb); 1695 } else { 1696 err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid); 1697 } 1698 xfrm_state_put(x); 1699 out_noput: 1700 return err; 1701 } 1702 1703 static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, 1704 struct nlattr **attrs, 1705 struct netlink_ext_ack *extack) 1706 { 1707 struct net *net = sock_net(skb->sk); 1708 struct xfrm_state *x; 1709 struct xfrm_userspi_info *p; 1710 struct xfrm_translator *xtr; 1711 struct sk_buff *resp_skb; 1712 xfrm_address_t *daddr; 1713 int family; 1714 int err; 1715 u32 mark; 1716 struct xfrm_mark m; 1717 u32 if_id = 0; 1718 u32 pcpu_num = UINT_MAX; 1719 1720 p = nlmsg_data(nlh); 1721 err = verify_spi_info(p->info.id.proto, p->min, p->max, extack); 1722 if (err) 1723 goto out_noput; 1724 1725 family = p->info.family; 1726 daddr = &p->info.id.daddr; 1727 1728 x = NULL; 1729 1730 mark = xfrm_mark_get(attrs, &m); 1731 1732 if (attrs[XFRMA_IF_ID]) 1733 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 1734 1735 if (attrs[XFRMA_SA_PCPU]) { 1736 pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); 1737 if (pcpu_num >= num_possible_cpus()) { 1738 err = -EINVAL; 1739 goto out_noput; 1740 } 1741 } 1742 1743 if (p->info.seq) { 1744 x = xfrm_find_acq_byseq(net, mark, p->info.seq, pcpu_num); 1745 if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) { 1746 xfrm_state_put(x); 1747 x = NULL; 1748 } 1749 } 1750 1751 if (!x) 1752 x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid, 1753 if_id, pcpu_num, p->info.id.proto, daddr, 1754 &p->info.saddr, 1, 1755 family); 1756 err = -ENOENT; 1757 if (!x) { 1758 NL_SET_ERR_MSG(extack, "Target ACQUIRE not found"); 1759 goto out_noput; 1760 } 1761 1762 err = xfrm_alloc_spi(x, p->min, p->max, extack); 1763 if (err) 1764 goto out; 1765 1766 if (attrs[XFRMA_SA_DIR]) 1767 x->dir = nla_get_u8(attrs[XFRMA_SA_DIR]); 1768 1769 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq); 1770 if (IS_ERR(resp_skb)) { 1771 err = PTR_ERR(resp_skb); 1772 goto out; 1773 } 1774 1775 xtr = xfrm_get_translator(); 1776 if (xtr) { 1777 err = xtr->alloc_compat(skb, nlmsg_hdr(skb)); 1778 1779 xfrm_put_translator(xtr); 1780 if (err) { 1781 kfree_skb(resp_skb); 1782 goto out; 1783 } 1784 } 1785 1786 err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid); 1787 1788 out: 1789 xfrm_state_put(x); 1790 out_noput: 1791 return err; 1792 } 1793 1794 static int verify_policy_dir(u8 dir, struct netlink_ext_ack *extack) 1795 { 1796 switch (dir) { 1797 case XFRM_POLICY_IN: 1798 case XFRM_POLICY_OUT: 1799 case XFRM_POLICY_FWD: 1800 break; 1801 1802 default: 1803 NL_SET_ERR_MSG(extack, "Invalid policy direction"); 1804 return -EINVAL; 1805 } 1806 1807 return 0; 1808 } 1809 1810 static int verify_policy_type(u8 type, struct netlink_ext_ack *extack) 1811 { 1812 switch (type) { 1813 case XFRM_POLICY_TYPE_MAIN: 1814 #ifdef CONFIG_XFRM_SUB_POLICY 1815 case XFRM_POLICY_TYPE_SUB: 1816 #endif 1817 break; 1818 1819 default: 1820 NL_SET_ERR_MSG(extack, "Invalid policy type"); 1821 return -EINVAL; 1822 } 1823 1824 return 0; 1825 } 1826 1827 static int verify_newpolicy_info(struct xfrm_userpolicy_info *p, 1828 struct netlink_ext_ack *extack) 1829 { 1830 int ret; 1831 1832 switch (p->share) { 1833 case XFRM_SHARE_ANY: 1834 case XFRM_SHARE_SESSION: 1835 case XFRM_SHARE_USER: 1836 case XFRM_SHARE_UNIQUE: 1837 break; 1838 1839 default: 1840 NL_SET_ERR_MSG(extack, "Invalid policy share"); 1841 return -EINVAL; 1842 } 1843 1844 switch (p->action) { 1845 case XFRM_POLICY_ALLOW: 1846 case XFRM_POLICY_BLOCK: 1847 break; 1848 1849 default: 1850 NL_SET_ERR_MSG(extack, "Invalid policy action"); 1851 return -EINVAL; 1852 } 1853 1854 switch (p->sel.family) { 1855 case AF_INET: 1856 if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) { 1857 NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 32 for IPv4)"); 1858 return -EINVAL; 1859 } 1860 1861 break; 1862 1863 case AF_INET6: 1864 #if IS_ENABLED(CONFIG_IPV6) 1865 if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) { 1866 NL_SET_ERR_MSG(extack, "Invalid prefix length in selector (must be <= 128 for IPv6)"); 1867 return -EINVAL; 1868 } 1869 1870 break; 1871 #else 1872 NL_SET_ERR_MSG(extack, "IPv6 support disabled"); 1873 return -EAFNOSUPPORT; 1874 #endif 1875 1876 default: 1877 NL_SET_ERR_MSG(extack, "Invalid selector family"); 1878 return -EINVAL; 1879 } 1880 1881 ret = verify_policy_dir(p->dir, extack); 1882 if (ret) 1883 return ret; 1884 if (p->index && (xfrm_policy_id2dir(p->index) != p->dir)) { 1885 NL_SET_ERR_MSG(extack, "Policy index doesn't match direction"); 1886 return -EINVAL; 1887 } 1888 1889 return 0; 1890 } 1891 1892 static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs) 1893 { 1894 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 1895 struct xfrm_user_sec_ctx *uctx; 1896 1897 if (!rt) 1898 return 0; 1899 1900 uctx = nla_data(rt); 1901 return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL); 1902 } 1903 1904 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, 1905 int nr) 1906 { 1907 int i; 1908 1909 xp->xfrm_nr = nr; 1910 for (i = 0; i < nr; i++, ut++) { 1911 struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 1912 1913 memcpy(&t->id, &ut->id, sizeof(struct xfrm_id)); 1914 memcpy(&t->saddr, &ut->saddr, 1915 sizeof(xfrm_address_t)); 1916 t->reqid = ut->reqid; 1917 t->mode = ut->mode; 1918 t->share = ut->share; 1919 t->optional = ut->optional; 1920 t->aalgos = ut->aalgos; 1921 t->ealgos = ut->ealgos; 1922 t->calgos = ut->calgos; 1923 /* If all masks are ~0, then we allow all algorithms. */ 1924 t->allalgs = !~(t->aalgos & t->ealgos & t->calgos); 1925 t->encap_family = ut->family; 1926 } 1927 } 1928 1929 static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family, 1930 int dir, struct netlink_ext_ack *extack) 1931 { 1932 u16 prev_family; 1933 int i; 1934 1935 if (nr > XFRM_MAX_DEPTH) { 1936 NL_SET_ERR_MSG(extack, "Template count must be <= XFRM_MAX_DEPTH (" __stringify(XFRM_MAX_DEPTH) ")"); 1937 return -EINVAL; 1938 } 1939 1940 prev_family = family; 1941 1942 for (i = 0; i < nr; i++) { 1943 /* We never validated the ut->family value, so many 1944 * applications simply leave it at zero. The check was 1945 * never made and ut->family was ignored because all 1946 * templates could be assumed to have the same family as 1947 * the policy itself. Now that we will have ipv4-in-ipv6 1948 * and ipv6-in-ipv4 tunnels, this is no longer true. 1949 */ 1950 if (!ut[i].family) 1951 ut[i].family = family; 1952 1953 switch (ut[i].mode) { 1954 case XFRM_MODE_TUNNEL: 1955 case XFRM_MODE_BEET: 1956 if (ut[i].optional && dir == XFRM_POLICY_OUT) { 1957 NL_SET_ERR_MSG(extack, "Mode in optional template not allowed in outbound policy"); 1958 return -EINVAL; 1959 } 1960 break; 1961 default: 1962 if (ut[i].family != prev_family) { 1963 NL_SET_ERR_MSG(extack, "Mode in template doesn't support a family change"); 1964 return -EINVAL; 1965 } 1966 break; 1967 } 1968 if (ut[i].mode >= XFRM_MODE_MAX) { 1969 NL_SET_ERR_MSG(extack, "Mode in template must be < XFRM_MODE_MAX (" __stringify(XFRM_MODE_MAX) ")"); 1970 return -EINVAL; 1971 } 1972 1973 prev_family = ut[i].family; 1974 1975 switch (ut[i].family) { 1976 case AF_INET: 1977 break; 1978 #if IS_ENABLED(CONFIG_IPV6) 1979 case AF_INET6: 1980 break; 1981 #endif 1982 default: 1983 NL_SET_ERR_MSG(extack, "Invalid family in template"); 1984 return -EINVAL; 1985 } 1986 1987 if (!xfrm_id_proto_valid(ut[i].id.proto)) { 1988 NL_SET_ERR_MSG(extack, "Invalid XFRM protocol in template"); 1989 return -EINVAL; 1990 } 1991 } 1992 1993 return 0; 1994 } 1995 1996 static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs, 1997 int dir, struct netlink_ext_ack *extack) 1998 { 1999 struct nlattr *rt = attrs[XFRMA_TMPL]; 2000 2001 if (!rt) { 2002 pol->xfrm_nr = 0; 2003 } else { 2004 struct xfrm_user_tmpl *utmpl = nla_data(rt); 2005 int nr = nla_len(rt) / sizeof(*utmpl); 2006 int err; 2007 2008 err = validate_tmpl(nr, utmpl, pol->family, dir, extack); 2009 if (err) 2010 return err; 2011 2012 copy_templates(pol, utmpl, nr); 2013 } 2014 return 0; 2015 } 2016 2017 static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs, 2018 struct netlink_ext_ack *extack) 2019 { 2020 struct nlattr *rt = attrs[XFRMA_POLICY_TYPE]; 2021 struct xfrm_userpolicy_type *upt; 2022 u8 type = XFRM_POLICY_TYPE_MAIN; 2023 int err; 2024 2025 if (rt) { 2026 upt = nla_data(rt); 2027 type = upt->type; 2028 } 2029 2030 err = verify_policy_type(type, extack); 2031 if (err) 2032 return err; 2033 2034 *tp = type; 2035 return 0; 2036 } 2037 2038 static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p) 2039 { 2040 xp->priority = p->priority; 2041 xp->index = p->index; 2042 memcpy(&xp->selector, &p->sel, sizeof(xp->selector)); 2043 memcpy(&xp->lft, &p->lft, sizeof(xp->lft)); 2044 xp->action = p->action; 2045 xp->flags = p->flags; 2046 xp->family = p->sel.family; 2047 /* XXX xp->share = p->share; */ 2048 } 2049 2050 static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir) 2051 { 2052 memset(p, 0, sizeof(*p)); 2053 memcpy(&p->sel, &xp->selector, sizeof(p->sel)); 2054 memcpy(&p->lft, &xp->lft, sizeof(p->lft)); 2055 memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft)); 2056 p->priority = xp->priority; 2057 p->index = xp->index; 2058 p->sel.family = xp->family; 2059 p->dir = dir; 2060 p->action = xp->action; 2061 p->flags = xp->flags; 2062 p->share = XFRM_SHARE_ANY; /* XXX xp->share */ 2063 } 2064 2065 static struct xfrm_policy *xfrm_policy_construct(struct net *net, 2066 struct xfrm_userpolicy_info *p, 2067 struct nlattr **attrs, 2068 int *errp, 2069 struct netlink_ext_ack *extack) 2070 { 2071 struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL); 2072 int err; 2073 2074 if (!xp) { 2075 *errp = -ENOMEM; 2076 return NULL; 2077 } 2078 2079 copy_from_user_policy(xp, p); 2080 2081 err = copy_from_user_policy_type(&xp->type, attrs, extack); 2082 if (err) 2083 goto error; 2084 2085 if (!(err = copy_from_user_tmpl(xp, attrs, p->dir, extack))) 2086 err = copy_from_user_sec_ctx(xp, attrs); 2087 if (err) 2088 goto error; 2089 2090 xfrm_mark_get(attrs, &xp->mark); 2091 2092 if (attrs[XFRMA_IF_ID]) 2093 xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 2094 2095 /* configure the hardware if offload is requested */ 2096 if (attrs[XFRMA_OFFLOAD_DEV]) { 2097 err = xfrm_dev_policy_add(net, xp, 2098 nla_data(attrs[XFRMA_OFFLOAD_DEV]), 2099 p->dir, extack); 2100 if (err) 2101 goto error; 2102 } 2103 2104 return xp; 2105 error: 2106 *errp = err; 2107 xp->walk.dead = 1; 2108 xfrm_policy_destroy(xp); 2109 return NULL; 2110 } 2111 2112 static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 2113 struct nlattr **attrs, 2114 struct netlink_ext_ack *extack) 2115 { 2116 struct net *net = sock_net(skb->sk); 2117 struct xfrm_userpolicy_info *p = nlmsg_data(nlh); 2118 struct xfrm_policy *xp; 2119 struct km_event c; 2120 int err; 2121 int excl; 2122 2123 err = verify_newpolicy_info(p, extack); 2124 if (err) 2125 return err; 2126 err = verify_sec_ctx_len(attrs, extack); 2127 if (err) 2128 return err; 2129 2130 xp = xfrm_policy_construct(net, p, attrs, &err, extack); 2131 if (!xp) 2132 return err; 2133 2134 /* shouldn't excl be based on nlh flags?? 2135 * Aha! this is anti-netlink really i.e more pfkey derived 2136 * in netlink excl is a flag and you wouldn't need 2137 * a type XFRM_MSG_UPDPOLICY - JHS */ 2138 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; 2139 err = xfrm_policy_insert(p->dir, xp, excl); 2140 xfrm_audit_policy_add(xp, err ? 0 : 1, true); 2141 2142 if (err) { 2143 xfrm_dev_policy_delete(xp); 2144 xfrm_dev_policy_free(xp); 2145 security_xfrm_policy_free(xp->security); 2146 kfree(xp); 2147 return err; 2148 } 2149 2150 c.event = nlh->nlmsg_type; 2151 c.seq = nlh->nlmsg_seq; 2152 c.portid = nlh->nlmsg_pid; 2153 km_policy_notify(xp, p->dir, &c); 2154 2155 xfrm_pol_put(xp); 2156 2157 return 0; 2158 } 2159 2160 static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb) 2161 { 2162 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH]; 2163 int i; 2164 2165 if (xp->xfrm_nr == 0) 2166 return 0; 2167 2168 if (xp->xfrm_nr > XFRM_MAX_DEPTH) 2169 return -ENOBUFS; 2170 2171 for (i = 0; i < xp->xfrm_nr; i++) { 2172 struct xfrm_user_tmpl *up = &vec[i]; 2173 struct xfrm_tmpl *kp = &xp->xfrm_vec[i]; 2174 2175 memset(up, 0, sizeof(*up)); 2176 memcpy(&up->id, &kp->id, sizeof(up->id)); 2177 up->family = kp->encap_family; 2178 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr)); 2179 up->reqid = kp->reqid; 2180 up->mode = kp->mode; 2181 up->share = kp->share; 2182 up->optional = kp->optional; 2183 up->aalgos = kp->aalgos; 2184 up->ealgos = kp->ealgos; 2185 up->calgos = kp->calgos; 2186 } 2187 2188 return nla_put(skb, XFRMA_TMPL, 2189 sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec); 2190 } 2191 2192 static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb) 2193 { 2194 if (x->security) { 2195 return copy_sec_ctx(x->security, skb); 2196 } 2197 return 0; 2198 } 2199 2200 static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb) 2201 { 2202 if (xp->security) 2203 return copy_sec_ctx(xp->security, skb); 2204 return 0; 2205 } 2206 static inline unsigned int userpolicy_type_attrsize(void) 2207 { 2208 #ifdef CONFIG_XFRM_SUB_POLICY 2209 return nla_total_size(sizeof(struct xfrm_userpolicy_type)); 2210 #else 2211 return 0; 2212 #endif 2213 } 2214 2215 #ifdef CONFIG_XFRM_SUB_POLICY 2216 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 2217 { 2218 struct xfrm_userpolicy_type upt; 2219 2220 /* Sadly there are two holes in struct xfrm_userpolicy_type */ 2221 memset(&upt, 0, sizeof(upt)); 2222 upt.type = type; 2223 2224 return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt); 2225 } 2226 2227 #else 2228 static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb) 2229 { 2230 return 0; 2231 } 2232 #endif 2233 2234 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr) 2235 { 2236 struct xfrm_dump_info *sp = ptr; 2237 struct xfrm_userpolicy_info *p; 2238 struct sk_buff *in_skb = sp->in_skb; 2239 struct sk_buff *skb = sp->out_skb; 2240 struct xfrm_translator *xtr; 2241 struct nlmsghdr *nlh; 2242 int err; 2243 2244 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq, 2245 XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags); 2246 if (nlh == NULL) 2247 return -EMSGSIZE; 2248 2249 p = nlmsg_data(nlh); 2250 copy_to_user_policy(xp, p, dir); 2251 err = copy_to_user_tmpl(xp, skb); 2252 if (!err) 2253 err = copy_to_user_sec_ctx(xp, skb); 2254 if (!err) 2255 err = copy_to_user_policy_type(xp->type, skb); 2256 if (!err) 2257 err = xfrm_mark_put(skb, &xp->mark); 2258 if (!err) 2259 err = xfrm_if_id_put(skb, xp->if_id); 2260 if (!err && xp->xdo.dev) 2261 err = copy_user_offload(&xp->xdo, skb); 2262 if (err) { 2263 nlmsg_cancel(skb, nlh); 2264 return err; 2265 } 2266 nlmsg_end(skb, nlh); 2267 2268 xtr = xfrm_get_translator(); 2269 if (xtr) { 2270 err = xtr->alloc_compat(skb, nlh); 2271 2272 xfrm_put_translator(xtr); 2273 if (err) { 2274 nlmsg_cancel(skb, nlh); 2275 return err; 2276 } 2277 } 2278 2279 return 0; 2280 } 2281 2282 static int xfrm_dump_policy_done(struct netlink_callback *cb) 2283 { 2284 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; 2285 struct net *net = sock_net(cb->skb->sk); 2286 2287 xfrm_policy_walk_done(walk, net); 2288 return 0; 2289 } 2290 2291 static int xfrm_dump_policy_start(struct netlink_callback *cb) 2292 { 2293 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; 2294 2295 BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args)); 2296 2297 xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY); 2298 return 0; 2299 } 2300 2301 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb) 2302 { 2303 struct net *net = sock_net(skb->sk); 2304 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; 2305 struct xfrm_dump_info info; 2306 2307 info.in_skb = cb->skb; 2308 info.out_skb = skb; 2309 info.nlmsg_seq = cb->nlh->nlmsg_seq; 2310 info.nlmsg_flags = NLM_F_MULTI; 2311 2312 (void) xfrm_policy_walk(net, walk, dump_one_policy, &info); 2313 2314 return skb->len; 2315 } 2316 2317 static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, 2318 struct xfrm_policy *xp, 2319 int dir, u32 seq) 2320 { 2321 struct xfrm_dump_info info; 2322 struct sk_buff *skb; 2323 int err; 2324 2325 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2326 if (!skb) 2327 return ERR_PTR(-ENOMEM); 2328 2329 info.in_skb = in_skb; 2330 info.out_skb = skb; 2331 info.nlmsg_seq = seq; 2332 info.nlmsg_flags = 0; 2333 2334 err = dump_one_policy(xp, dir, 0, &info); 2335 if (err) { 2336 kfree_skb(skb); 2337 return ERR_PTR(err); 2338 } 2339 2340 return skb; 2341 } 2342 2343 static int xfrm_notify_userpolicy(struct net *net) 2344 { 2345 struct xfrm_userpolicy_default *up; 2346 int len = NLMSG_ALIGN(sizeof(*up)); 2347 struct nlmsghdr *nlh; 2348 struct sk_buff *skb; 2349 int err; 2350 2351 skb = nlmsg_new(len, GFP_ATOMIC); 2352 if (skb == NULL) 2353 return -ENOMEM; 2354 2355 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_GETDEFAULT, sizeof(*up), 0); 2356 if (nlh == NULL) { 2357 kfree_skb(skb); 2358 return -EMSGSIZE; 2359 } 2360 2361 up = nlmsg_data(nlh); 2362 up->in = net->xfrm.policy_default[XFRM_POLICY_IN]; 2363 up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD]; 2364 up->out = net->xfrm.policy_default[XFRM_POLICY_OUT]; 2365 2366 nlmsg_end(skb, nlh); 2367 2368 rcu_read_lock(); 2369 err = xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 2370 rcu_read_unlock(); 2371 2372 return err; 2373 } 2374 2375 static bool xfrm_userpolicy_is_valid(__u8 policy) 2376 { 2377 return policy == XFRM_USERPOLICY_BLOCK || 2378 policy == XFRM_USERPOLICY_ACCEPT; 2379 } 2380 2381 static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh, 2382 struct nlattr **attrs, struct netlink_ext_ack *extack) 2383 { 2384 struct net *net = sock_net(skb->sk); 2385 struct xfrm_userpolicy_default *up = nlmsg_data(nlh); 2386 2387 if (xfrm_userpolicy_is_valid(up->in)) 2388 net->xfrm.policy_default[XFRM_POLICY_IN] = up->in; 2389 2390 if (xfrm_userpolicy_is_valid(up->fwd)) 2391 net->xfrm.policy_default[XFRM_POLICY_FWD] = up->fwd; 2392 2393 if (xfrm_userpolicy_is_valid(up->out)) 2394 net->xfrm.policy_default[XFRM_POLICY_OUT] = up->out; 2395 2396 rt_genid_bump_all(net); 2397 2398 xfrm_notify_userpolicy(net); 2399 return 0; 2400 } 2401 2402 static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh, 2403 struct nlattr **attrs, struct netlink_ext_ack *extack) 2404 { 2405 struct sk_buff *r_skb; 2406 struct nlmsghdr *r_nlh; 2407 struct net *net = sock_net(skb->sk); 2408 struct xfrm_userpolicy_default *r_up; 2409 int len = NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_default)); 2410 u32 portid = NETLINK_CB(skb).portid; 2411 u32 seq = nlh->nlmsg_seq; 2412 2413 r_skb = nlmsg_new(len, GFP_ATOMIC); 2414 if (!r_skb) 2415 return -ENOMEM; 2416 2417 r_nlh = nlmsg_put(r_skb, portid, seq, XFRM_MSG_GETDEFAULT, sizeof(*r_up), 0); 2418 if (!r_nlh) { 2419 kfree_skb(r_skb); 2420 return -EMSGSIZE; 2421 } 2422 2423 r_up = nlmsg_data(r_nlh); 2424 r_up->in = net->xfrm.policy_default[XFRM_POLICY_IN]; 2425 r_up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD]; 2426 r_up->out = net->xfrm.policy_default[XFRM_POLICY_OUT]; 2427 nlmsg_end(r_skb, r_nlh); 2428 2429 return nlmsg_unicast(net->xfrm.nlsk, r_skb, portid); 2430 } 2431 2432 static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 2433 struct nlattr **attrs, 2434 struct netlink_ext_ack *extack) 2435 { 2436 struct net *net = sock_net(skb->sk); 2437 struct xfrm_policy *xp; 2438 struct xfrm_userpolicy_id *p; 2439 u8 type = XFRM_POLICY_TYPE_MAIN; 2440 int err; 2441 struct km_event c; 2442 int delete; 2443 struct xfrm_mark m; 2444 u32 if_id = 0; 2445 2446 p = nlmsg_data(nlh); 2447 delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY; 2448 2449 err = copy_from_user_policy_type(&type, attrs, extack); 2450 if (err) 2451 return err; 2452 2453 err = verify_policy_dir(p->dir, extack); 2454 if (err) 2455 return err; 2456 2457 if (attrs[XFRMA_IF_ID]) 2458 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 2459 2460 xfrm_mark_get(attrs, &m); 2461 2462 if (p->index) 2463 xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, 2464 p->index, delete, &err); 2465 else { 2466 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 2467 struct xfrm_sec_ctx *ctx; 2468 2469 err = verify_sec_ctx_len(attrs, extack); 2470 if (err) 2471 return err; 2472 2473 ctx = NULL; 2474 if (rt) { 2475 struct xfrm_user_sec_ctx *uctx = nla_data(rt); 2476 2477 err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 2478 if (err) 2479 return err; 2480 } 2481 xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir, 2482 &p->sel, ctx, delete, &err); 2483 security_xfrm_policy_free(ctx); 2484 } 2485 if (xp == NULL) 2486 return -ENOENT; 2487 2488 if (!delete) { 2489 struct sk_buff *resp_skb; 2490 2491 resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq); 2492 if (IS_ERR(resp_skb)) { 2493 err = PTR_ERR(resp_skb); 2494 } else { 2495 err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, 2496 NETLINK_CB(skb).portid); 2497 } 2498 } else { 2499 xfrm_audit_policy_delete(xp, err ? 0 : 1, true); 2500 2501 if (err != 0) 2502 goto out; 2503 2504 c.data.byid = p->index; 2505 c.event = nlh->nlmsg_type; 2506 c.seq = nlh->nlmsg_seq; 2507 c.portid = nlh->nlmsg_pid; 2508 km_policy_notify(xp, p->dir, &c); 2509 } 2510 2511 out: 2512 xfrm_pol_put(xp); 2513 return err; 2514 } 2515 2516 static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 2517 struct nlattr **attrs, 2518 struct netlink_ext_ack *extack) 2519 { 2520 struct net *net = sock_net(skb->sk); 2521 struct km_event c; 2522 struct xfrm_usersa_flush *p = nlmsg_data(nlh); 2523 int err; 2524 2525 err = xfrm_state_flush(net, p->proto, true, false); 2526 if (err) { 2527 if (err == -ESRCH) /* empty table */ 2528 return 0; 2529 return err; 2530 } 2531 c.data.proto = p->proto; 2532 c.event = nlh->nlmsg_type; 2533 c.seq = nlh->nlmsg_seq; 2534 c.portid = nlh->nlmsg_pid; 2535 c.net = net; 2536 km_state_notify(NULL, &c); 2537 2538 return 0; 2539 } 2540 2541 static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x) 2542 { 2543 unsigned int replay_size = x->replay_esn ? 2544 xfrm_replay_state_esn_len(x->replay_esn) : 2545 sizeof(struct xfrm_replay_state); 2546 2547 return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id)) 2548 + nla_total_size(replay_size) 2549 + nla_total_size_64bit(sizeof(struct xfrm_lifetime_cur)) 2550 + nla_total_size(sizeof(struct xfrm_mark)) 2551 + nla_total_size(4) /* XFRM_AE_RTHR */ 2552 + nla_total_size(4) /* XFRM_AE_ETHR */ 2553 + nla_total_size(sizeof(x->dir)) /* XFRMA_SA_DIR */ 2554 + nla_total_size(4); /* XFRMA_SA_PCPU */ 2555 } 2556 2557 static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 2558 { 2559 struct xfrm_aevent_id *id; 2560 struct nlmsghdr *nlh; 2561 int err; 2562 2563 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0); 2564 if (nlh == NULL) 2565 return -EMSGSIZE; 2566 2567 id = nlmsg_data(nlh); 2568 memset(&id->sa_id, 0, sizeof(id->sa_id)); 2569 memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr)); 2570 id->sa_id.spi = x->id.spi; 2571 id->sa_id.family = x->props.family; 2572 id->sa_id.proto = x->id.proto; 2573 memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr)); 2574 id->reqid = x->props.reqid; 2575 id->flags = c->data.aevent; 2576 2577 if (x->replay_esn) { 2578 err = nla_put(skb, XFRMA_REPLAY_ESN_VAL, 2579 xfrm_replay_state_esn_len(x->replay_esn), 2580 x->replay_esn); 2581 } else { 2582 err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), 2583 &x->replay); 2584 } 2585 if (err) 2586 goto out_cancel; 2587 err = nla_put_64bit(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft, 2588 XFRMA_PAD); 2589 if (err) 2590 goto out_cancel; 2591 2592 if (id->flags & XFRM_AE_RTHR) { 2593 err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff); 2594 if (err) 2595 goto out_cancel; 2596 } 2597 if (id->flags & XFRM_AE_ETHR) { 2598 err = nla_put_u32(skb, XFRMA_ETIMER_THRESH, 2599 x->replay_maxage * 10 / HZ); 2600 if (err) 2601 goto out_cancel; 2602 } 2603 err = xfrm_mark_put(skb, &x->mark); 2604 if (err) 2605 goto out_cancel; 2606 2607 err = xfrm_if_id_put(skb, x->if_id); 2608 if (err) 2609 goto out_cancel; 2610 if (x->pcpu_num != UINT_MAX) { 2611 err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 2612 if (err) 2613 goto out_cancel; 2614 } 2615 2616 if (x->dir) { 2617 err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); 2618 if (err) 2619 goto out_cancel; 2620 } 2621 2622 nlmsg_end(skb, nlh); 2623 return 0; 2624 2625 out_cancel: 2626 nlmsg_cancel(skb, nlh); 2627 return err; 2628 } 2629 2630 static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 2631 struct nlattr **attrs, struct netlink_ext_ack *extack) 2632 { 2633 struct net *net = sock_net(skb->sk); 2634 struct xfrm_state *x; 2635 struct sk_buff *r_skb; 2636 int err; 2637 struct km_event c; 2638 u32 mark; 2639 struct xfrm_mark m; 2640 struct xfrm_aevent_id *p = nlmsg_data(nlh); 2641 struct xfrm_usersa_id *id = &p->sa_id; 2642 2643 mark = xfrm_mark_get(attrs, &m); 2644 2645 x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family); 2646 if (x == NULL) 2647 return -ESRCH; 2648 2649 r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 2650 if (r_skb == NULL) { 2651 xfrm_state_put(x); 2652 return -ENOMEM; 2653 } 2654 2655 /* 2656 * XXX: is this lock really needed - none of the other 2657 * gets lock (the concern is things getting updated 2658 * while we are still reading) - jhs 2659 */ 2660 spin_lock_bh(&x->lock); 2661 c.data.aevent = p->flags; 2662 c.seq = nlh->nlmsg_seq; 2663 c.portid = nlh->nlmsg_pid; 2664 2665 err = build_aevent(r_skb, x, &c); 2666 BUG_ON(err < 0); 2667 2668 err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid); 2669 spin_unlock_bh(&x->lock); 2670 xfrm_state_put(x); 2671 return err; 2672 } 2673 2674 static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 2675 struct nlattr **attrs, struct netlink_ext_ack *extack) 2676 { 2677 struct net *net = sock_net(skb->sk); 2678 struct xfrm_state *x; 2679 struct km_event c; 2680 int err = -EINVAL; 2681 u32 mark = 0; 2682 struct xfrm_mark m; 2683 struct xfrm_aevent_id *p = nlmsg_data(nlh); 2684 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; 2685 struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL]; 2686 struct nlattr *lt = attrs[XFRMA_LTIME_VAL]; 2687 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; 2688 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; 2689 2690 if (!lt && !rp && !re && !et && !rt) { 2691 NL_SET_ERR_MSG(extack, "Missing required attribute for AE"); 2692 return err; 2693 } 2694 2695 /* pedantic mode - thou shalt sayeth replaceth */ 2696 if (!(nlh->nlmsg_flags & NLM_F_REPLACE)) { 2697 NL_SET_ERR_MSG(extack, "NLM_F_REPLACE flag is required"); 2698 return err; 2699 } 2700 2701 mark = xfrm_mark_get(attrs, &m); 2702 2703 x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family); 2704 if (x == NULL) 2705 return -ESRCH; 2706 2707 if (x->km.state != XFRM_STATE_VALID) { 2708 NL_SET_ERR_MSG(extack, "SA must be in VALID state"); 2709 goto out; 2710 } 2711 2712 err = xfrm_replay_verify_len(x->replay_esn, re, extack); 2713 if (err) 2714 goto out; 2715 2716 spin_lock_bh(&x->lock); 2717 xfrm_update_ae_params(x, attrs, 1); 2718 spin_unlock_bh(&x->lock); 2719 2720 c.event = nlh->nlmsg_type; 2721 c.seq = nlh->nlmsg_seq; 2722 c.portid = nlh->nlmsg_pid; 2723 c.data.aevent = XFRM_AE_CU; 2724 km_state_notify(x, &c); 2725 err = 0; 2726 out: 2727 xfrm_state_put(x); 2728 return err; 2729 } 2730 2731 static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 2732 struct nlattr **attrs, 2733 struct netlink_ext_ack *extack) 2734 { 2735 struct net *net = sock_net(skb->sk); 2736 struct km_event c; 2737 u8 type = XFRM_POLICY_TYPE_MAIN; 2738 int err; 2739 2740 err = copy_from_user_policy_type(&type, attrs, extack); 2741 if (err) 2742 return err; 2743 2744 err = xfrm_policy_flush(net, type, true); 2745 if (err) { 2746 if (err == -ESRCH) /* empty table */ 2747 return 0; 2748 return err; 2749 } 2750 2751 c.data.type = type; 2752 c.event = nlh->nlmsg_type; 2753 c.seq = nlh->nlmsg_seq; 2754 c.portid = nlh->nlmsg_pid; 2755 c.net = net; 2756 km_policy_notify(NULL, 0, &c); 2757 return 0; 2758 } 2759 2760 static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 2761 struct nlattr **attrs, 2762 struct netlink_ext_ack *extack) 2763 { 2764 struct net *net = sock_net(skb->sk); 2765 struct xfrm_policy *xp; 2766 struct xfrm_user_polexpire *up = nlmsg_data(nlh); 2767 struct xfrm_userpolicy_info *p = &up->pol; 2768 u8 type = XFRM_POLICY_TYPE_MAIN; 2769 int err = -ENOENT; 2770 struct xfrm_mark m; 2771 u32 if_id = 0; 2772 2773 err = copy_from_user_policy_type(&type, attrs, extack); 2774 if (err) 2775 return err; 2776 2777 err = verify_policy_dir(p->dir, extack); 2778 if (err) 2779 return err; 2780 2781 if (attrs[XFRMA_IF_ID]) 2782 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 2783 2784 xfrm_mark_get(attrs, &m); 2785 2786 if (p->index) 2787 xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index, 2788 0, &err); 2789 else { 2790 struct nlattr *rt = attrs[XFRMA_SEC_CTX]; 2791 struct xfrm_sec_ctx *ctx; 2792 2793 err = verify_sec_ctx_len(attrs, extack); 2794 if (err) 2795 return err; 2796 2797 ctx = NULL; 2798 if (rt) { 2799 struct xfrm_user_sec_ctx *uctx = nla_data(rt); 2800 2801 err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL); 2802 if (err) 2803 return err; 2804 } 2805 xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir, 2806 &p->sel, ctx, 0, &err); 2807 security_xfrm_policy_free(ctx); 2808 } 2809 if (xp == NULL) 2810 return -ENOENT; 2811 2812 if (unlikely(xp->walk.dead)) 2813 goto out; 2814 2815 err = 0; 2816 if (up->hard) { 2817 xfrm_policy_delete(xp, p->dir); 2818 xfrm_audit_policy_delete(xp, 1, true); 2819 } 2820 km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid); 2821 2822 out: 2823 xfrm_pol_put(xp); 2824 return err; 2825 } 2826 2827 static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, 2828 struct nlattr **attrs, 2829 struct netlink_ext_ack *extack) 2830 { 2831 struct net *net = sock_net(skb->sk); 2832 struct xfrm_state *x; 2833 int err; 2834 struct xfrm_user_expire *ue = nlmsg_data(nlh); 2835 struct xfrm_usersa_info *p = &ue->state; 2836 struct xfrm_mark m; 2837 u32 mark = xfrm_mark_get(attrs, &m); 2838 2839 x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family); 2840 2841 err = -ENOENT; 2842 if (x == NULL) 2843 return err; 2844 2845 spin_lock_bh(&x->lock); 2846 err = -EINVAL; 2847 if (x->km.state != XFRM_STATE_VALID) { 2848 NL_SET_ERR_MSG(extack, "SA must be in VALID state"); 2849 goto out; 2850 } 2851 2852 km_state_expired(x, ue->hard, nlh->nlmsg_pid); 2853 2854 if (ue->hard) { 2855 __xfrm_state_delete(x); 2856 xfrm_audit_state_delete(x, 1, true); 2857 } 2858 err = 0; 2859 out: 2860 spin_unlock_bh(&x->lock); 2861 xfrm_state_put(x); 2862 return err; 2863 } 2864 2865 static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, 2866 struct nlattr **attrs, 2867 struct netlink_ext_ack *extack) 2868 { 2869 struct net *net = sock_net(skb->sk); 2870 struct xfrm_policy *xp; 2871 struct xfrm_user_tmpl *ut; 2872 int i; 2873 struct nlattr *rt = attrs[XFRMA_TMPL]; 2874 struct xfrm_mark mark; 2875 2876 struct xfrm_user_acquire *ua = nlmsg_data(nlh); 2877 struct xfrm_state *x = xfrm_state_alloc(net); 2878 int err = -ENOMEM; 2879 2880 if (!x) 2881 goto nomem; 2882 2883 xfrm_mark_get(attrs, &mark); 2884 2885 if (attrs[XFRMA_SA_PCPU]) { 2886 x->pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); 2887 err = -EINVAL; 2888 if (x->pcpu_num >= num_possible_cpus()) 2889 goto free_state; 2890 } 2891 2892 err = verify_newpolicy_info(&ua->policy, extack); 2893 if (err) 2894 goto free_state; 2895 err = verify_sec_ctx_len(attrs, extack); 2896 if (err) 2897 goto free_state; 2898 2899 /* build an XP */ 2900 xp = xfrm_policy_construct(net, &ua->policy, attrs, &err, extack); 2901 if (!xp) 2902 goto free_state; 2903 2904 memcpy(&x->id, &ua->id, sizeof(ua->id)); 2905 memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr)); 2906 memcpy(&x->sel, &ua->sel, sizeof(ua->sel)); 2907 xp->mark.m = x->mark.m = mark.m; 2908 xp->mark.v = x->mark.v = mark.v; 2909 ut = nla_data(rt); 2910 /* extract the templates and for each call km_key */ 2911 for (i = 0; i < xp->xfrm_nr; i++, ut++) { 2912 struct xfrm_tmpl *t = &xp->xfrm_vec[i]; 2913 memcpy(&x->id, &t->id, sizeof(x->id)); 2914 x->props.mode = t->mode; 2915 x->props.reqid = t->reqid; 2916 x->props.family = ut->family; 2917 t->aalgos = ua->aalgos; 2918 t->ealgos = ua->ealgos; 2919 t->calgos = ua->calgos; 2920 err = km_query(x, t, xp); 2921 2922 } 2923 2924 xfrm_state_free(x); 2925 kfree(xp); 2926 2927 return 0; 2928 2929 free_state: 2930 xfrm_state_free(x); 2931 nomem: 2932 return err; 2933 } 2934 2935 #ifdef CONFIG_XFRM_MIGRATE 2936 static int copy_from_user_migrate(struct xfrm_migrate *ma, 2937 struct xfrm_kmaddress *k, 2938 struct nlattr **attrs, int *num, 2939 struct netlink_ext_ack *extack) 2940 { 2941 struct nlattr *rt = attrs[XFRMA_MIGRATE]; 2942 struct xfrm_user_migrate *um; 2943 int i, num_migrate; 2944 2945 if (k != NULL) { 2946 struct xfrm_user_kmaddress *uk; 2947 2948 uk = nla_data(attrs[XFRMA_KMADDRESS]); 2949 memcpy(&k->local, &uk->local, sizeof(k->local)); 2950 memcpy(&k->remote, &uk->remote, sizeof(k->remote)); 2951 k->family = uk->family; 2952 k->reserved = uk->reserved; 2953 } 2954 2955 um = nla_data(rt); 2956 num_migrate = nla_len(rt) / sizeof(*um); 2957 2958 if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH) { 2959 NL_SET_ERR_MSG(extack, "Invalid number of SAs to migrate, must be 0 < num <= XFRM_MAX_DEPTH (6)"); 2960 return -EINVAL; 2961 } 2962 2963 for (i = 0; i < num_migrate; i++, um++, ma++) { 2964 memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr)); 2965 memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr)); 2966 memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr)); 2967 memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr)); 2968 2969 ma->proto = um->proto; 2970 ma->mode = um->mode; 2971 ma->reqid = um->reqid; 2972 2973 ma->old_family = um->old_family; 2974 ma->new_family = um->new_family; 2975 } 2976 2977 *num = i; 2978 return 0; 2979 } 2980 2981 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 2982 struct nlattr **attrs, struct netlink_ext_ack *extack) 2983 { 2984 struct xfrm_userpolicy_id *pi = nlmsg_data(nlh); 2985 struct xfrm_migrate m[XFRM_MAX_DEPTH]; 2986 struct xfrm_kmaddress km, *kmp; 2987 u8 type; 2988 int err; 2989 int n = 0; 2990 struct net *net = sock_net(skb->sk); 2991 struct xfrm_encap_tmpl *encap = NULL; 2992 u32 if_id = 0; 2993 2994 if (!attrs[XFRMA_MIGRATE]) { 2995 NL_SET_ERR_MSG(extack, "Missing required MIGRATE attribute"); 2996 return -EINVAL; 2997 } 2998 2999 kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL; 3000 3001 err = copy_from_user_policy_type(&type, attrs, extack); 3002 if (err) 3003 return err; 3004 3005 err = copy_from_user_migrate(m, kmp, attrs, &n, extack); 3006 if (err) 3007 return err; 3008 3009 if (!n) 3010 return 0; 3011 3012 if (attrs[XFRMA_ENCAP]) { 3013 encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), 3014 sizeof(*encap), GFP_KERNEL); 3015 if (!encap) 3016 return -ENOMEM; 3017 } 3018 3019 if (attrs[XFRMA_IF_ID]) 3020 if_id = nla_get_u32(attrs[XFRMA_IF_ID]); 3021 3022 err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap, 3023 if_id, extack); 3024 3025 kfree(encap); 3026 3027 return err; 3028 } 3029 #else 3030 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, 3031 struct nlattr **attrs, struct netlink_ext_ack *extack) 3032 { 3033 return -ENOPROTOOPT; 3034 } 3035 #endif 3036 3037 #ifdef CONFIG_XFRM_MIGRATE 3038 static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb) 3039 { 3040 struct xfrm_user_migrate um; 3041 3042 memset(&um, 0, sizeof(um)); 3043 um.proto = m->proto; 3044 um.mode = m->mode; 3045 um.reqid = m->reqid; 3046 um.old_family = m->old_family; 3047 memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr)); 3048 memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr)); 3049 um.new_family = m->new_family; 3050 memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr)); 3051 memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr)); 3052 3053 return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um); 3054 } 3055 3056 static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb) 3057 { 3058 struct xfrm_user_kmaddress uk; 3059 3060 memset(&uk, 0, sizeof(uk)); 3061 uk.family = k->family; 3062 uk.reserved = k->reserved; 3063 memcpy(&uk.local, &k->local, sizeof(uk.local)); 3064 memcpy(&uk.remote, &k->remote, sizeof(uk.remote)); 3065 3066 return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk); 3067 } 3068 3069 static inline unsigned int xfrm_migrate_msgsize(int num_migrate, int with_kma, 3070 int with_encp) 3071 { 3072 return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id)) 3073 + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0) 3074 + (with_encp ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0) 3075 + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate) 3076 + userpolicy_type_attrsize(); 3077 } 3078 3079 static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m, 3080 int num_migrate, const struct xfrm_kmaddress *k, 3081 const struct xfrm_selector *sel, 3082 const struct xfrm_encap_tmpl *encap, u8 dir, u8 type) 3083 { 3084 const struct xfrm_migrate *mp; 3085 struct xfrm_userpolicy_id *pol_id; 3086 struct nlmsghdr *nlh; 3087 int i, err; 3088 3089 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0); 3090 if (nlh == NULL) 3091 return -EMSGSIZE; 3092 3093 pol_id = nlmsg_data(nlh); 3094 /* copy data from selector, dir, and type to the pol_id */ 3095 memset(pol_id, 0, sizeof(*pol_id)); 3096 memcpy(&pol_id->sel, sel, sizeof(pol_id->sel)); 3097 pol_id->dir = dir; 3098 3099 if (k != NULL) { 3100 err = copy_to_user_kmaddress(k, skb); 3101 if (err) 3102 goto out_cancel; 3103 } 3104 if (encap) { 3105 err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap); 3106 if (err) 3107 goto out_cancel; 3108 } 3109 err = copy_to_user_policy_type(type, skb); 3110 if (err) 3111 goto out_cancel; 3112 for (i = 0, mp = m ; i < num_migrate; i++, mp++) { 3113 err = copy_to_user_migrate(mp, skb); 3114 if (err) 3115 goto out_cancel; 3116 } 3117 3118 nlmsg_end(skb, nlh); 3119 return 0; 3120 3121 out_cancel: 3122 nlmsg_cancel(skb, nlh); 3123 return err; 3124 } 3125 3126 static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 3127 const struct xfrm_migrate *m, int num_migrate, 3128 const struct xfrm_kmaddress *k, 3129 const struct xfrm_encap_tmpl *encap) 3130 { 3131 struct net *net = &init_net; 3132 struct sk_buff *skb; 3133 int err; 3134 3135 skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap), 3136 GFP_ATOMIC); 3137 if (skb == NULL) 3138 return -ENOMEM; 3139 3140 /* build migrate */ 3141 err = build_migrate(skb, m, num_migrate, k, sel, encap, dir, type); 3142 BUG_ON(err < 0); 3143 3144 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE); 3145 } 3146 #else 3147 static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 3148 const struct xfrm_migrate *m, int num_migrate, 3149 const struct xfrm_kmaddress *k, 3150 const struct xfrm_encap_tmpl *encap) 3151 { 3152 return -ENOPROTOOPT; 3153 } 3154 #endif 3155 3156 #define XMSGSIZE(type) sizeof(struct type) 3157 3158 const int xfrm_msg_min[XFRM_NR_MSGTYPES] = { 3159 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 3160 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 3161 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 3162 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 3163 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 3164 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 3165 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info), 3166 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire), 3167 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire), 3168 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info), 3169 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info), 3170 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire), 3171 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush), 3172 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0, 3173 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 3174 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 3175 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report), 3176 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 3177 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32), 3178 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 3179 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 3180 [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), 3181 [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), 3182 }; 3183 EXPORT_SYMBOL_GPL(xfrm_msg_min); 3184 3185 #undef XMSGSIZE 3186 3187 const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { 3188 [XFRMA_UNSPEC] = { .strict_start_type = XFRMA_SA_DIR }, 3189 [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)}, 3190 [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)}, 3191 [XFRMA_LASTUSED] = { .type = NLA_U64}, 3192 [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)}, 3193 [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) }, 3194 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) }, 3195 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) }, 3196 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, 3197 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, 3198 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, 3199 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) }, 3200 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, 3201 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, 3202 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 }, 3203 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 }, 3204 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) }, 3205 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) }, 3206 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)}, 3207 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, 3208 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) }, 3209 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) }, 3210 [XFRMA_TFCPAD] = { .type = NLA_U32 }, 3211 [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) }, 3212 [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 }, 3213 [XFRMA_PROTO] = { .type = NLA_U8 }, 3214 [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) }, 3215 [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) }, 3216 [XFRMA_SET_MARK] = { .type = NLA_U32 }, 3217 [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 }, 3218 [XFRMA_IF_ID] = { .type = NLA_U32 }, 3219 [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, 3220 [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT), 3221 [XFRMA_NAT_KEEPALIVE_INTERVAL] = { .type = NLA_U32 }, 3222 [XFRMA_SA_PCPU] = { .type = NLA_U32 }, 3223 }; 3224 EXPORT_SYMBOL_GPL(xfrma_policy); 3225 3226 static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = { 3227 [XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 3228 [XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) }, 3229 }; 3230 3231 static const struct xfrm_link { 3232 int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **, 3233 struct netlink_ext_ack *); 3234 int (*start)(struct netlink_callback *); 3235 int (*dump)(struct sk_buff *, struct netlink_callback *); 3236 int (*done)(struct netlink_callback *); 3237 const struct nla_policy *nla_pol; 3238 int nla_max; 3239 } xfrm_dispatch[XFRM_NR_MSGTYPES] = { 3240 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 3241 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa }, 3242 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa, 3243 .dump = xfrm_dump_sa, 3244 .done = xfrm_dump_sa_done }, 3245 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 3246 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy }, 3247 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy, 3248 .start = xfrm_dump_policy_start, 3249 .dump = xfrm_dump_policy, 3250 .done = xfrm_dump_policy_done }, 3251 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi }, 3252 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire }, 3253 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire }, 3254 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, 3255 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa }, 3256 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire}, 3257 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa }, 3258 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy }, 3259 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae }, 3260 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae }, 3261 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate }, 3262 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo }, 3263 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo, 3264 .nla_pol = xfrma_spd_policy, 3265 .nla_max = XFRMA_SPD_MAX }, 3266 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo }, 3267 [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_set_default }, 3268 [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_get_default }, 3269 }; 3270 3271 static int xfrm_reject_unused_attr(int type, struct nlattr **attrs, 3272 struct netlink_ext_ack *extack) 3273 { 3274 if (attrs[XFRMA_SA_DIR]) { 3275 switch (type) { 3276 case XFRM_MSG_NEWSA: 3277 case XFRM_MSG_UPDSA: 3278 case XFRM_MSG_ALLOCSPI: 3279 break; 3280 default: 3281 NL_SET_ERR_MSG(extack, "Invalid attribute SA_DIR"); 3282 return -EINVAL; 3283 } 3284 } 3285 3286 if (attrs[XFRMA_SA_PCPU]) { 3287 switch (type) { 3288 case XFRM_MSG_NEWSA: 3289 case XFRM_MSG_UPDSA: 3290 case XFRM_MSG_ALLOCSPI: 3291 case XFRM_MSG_ACQUIRE: 3292 3293 break; 3294 default: 3295 NL_SET_ERR_MSG(extack, "Invalid attribute SA_PCPU"); 3296 return -EINVAL; 3297 } 3298 } 3299 3300 return 0; 3301 } 3302 3303 static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, 3304 struct netlink_ext_ack *extack) 3305 { 3306 struct net *net = sock_net(skb->sk); 3307 struct nlattr *attrs[XFRMA_MAX+1]; 3308 const struct xfrm_link *link; 3309 struct nlmsghdr *nlh64 = NULL; 3310 int type, err; 3311 3312 type = nlh->nlmsg_type; 3313 if (type > XFRM_MSG_MAX) 3314 return -EINVAL; 3315 3316 type -= XFRM_MSG_BASE; 3317 link = &xfrm_dispatch[type]; 3318 3319 /* All operations require privileges, even GET */ 3320 if (!netlink_net_capable(skb, CAP_NET_ADMIN)) 3321 return -EPERM; 3322 3323 if (in_compat_syscall()) { 3324 struct xfrm_translator *xtr = xfrm_get_translator(); 3325 3326 if (!xtr) 3327 return -EOPNOTSUPP; 3328 3329 nlh64 = xtr->rcv_msg_compat(nlh, link->nla_max, 3330 link->nla_pol, extack); 3331 xfrm_put_translator(xtr); 3332 if (IS_ERR(nlh64)) 3333 return PTR_ERR(nlh64); 3334 if (nlh64) 3335 nlh = nlh64; 3336 } 3337 3338 if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || 3339 type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) && 3340 (nlh->nlmsg_flags & NLM_F_DUMP)) { 3341 struct netlink_dump_control c = { 3342 .start = link->start, 3343 .dump = link->dump, 3344 .done = link->done, 3345 }; 3346 3347 if (link->dump == NULL) { 3348 err = -EINVAL; 3349 goto err; 3350 } 3351 3352 err = netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c); 3353 goto err; 3354 } 3355 3356 err = nlmsg_parse_deprecated(nlh, xfrm_msg_min[type], attrs, 3357 link->nla_max ? : XFRMA_MAX, 3358 link->nla_pol ? : xfrma_policy, extack); 3359 if (err < 0) 3360 goto err; 3361 3362 if (!link->nla_pol || link->nla_pol == xfrma_policy) { 3363 err = xfrm_reject_unused_attr((type + XFRM_MSG_BASE), attrs, extack); 3364 if (err < 0) 3365 goto err; 3366 } 3367 3368 if (link->doit == NULL) { 3369 err = -EINVAL; 3370 goto err; 3371 } 3372 3373 err = link->doit(skb, nlh, attrs, extack); 3374 3375 /* We need to free skb allocated in xfrm_alloc_compat() before 3376 * returning from this function, because consume_skb() won't take 3377 * care of frag_list since netlink destructor sets 3378 * sbk->head to NULL. (see netlink_skb_destructor()) 3379 */ 3380 if (skb_has_frag_list(skb)) { 3381 kfree_skb(skb_shinfo(skb)->frag_list); 3382 skb_shinfo(skb)->frag_list = NULL; 3383 } 3384 3385 err: 3386 kvfree(nlh64); 3387 return err; 3388 } 3389 3390 static void xfrm_netlink_rcv(struct sk_buff *skb) 3391 { 3392 struct net *net = sock_net(skb->sk); 3393 3394 mutex_lock(&net->xfrm.xfrm_cfg_mutex); 3395 netlink_rcv_skb(skb, &xfrm_user_rcv_msg); 3396 mutex_unlock(&net->xfrm.xfrm_cfg_mutex); 3397 } 3398 3399 static inline unsigned int xfrm_expire_msgsize(void) 3400 { 3401 return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) + 3402 nla_total_size(sizeof(struct xfrm_mark)) + 3403 nla_total_size(sizeof_field(struct xfrm_state, dir)) + 3404 nla_total_size(4); /* XFRMA_SA_PCPU */ 3405 } 3406 3407 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) 3408 { 3409 struct xfrm_user_expire *ue; 3410 struct nlmsghdr *nlh; 3411 int err; 3412 3413 nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0); 3414 if (nlh == NULL) 3415 return -EMSGSIZE; 3416 3417 ue = nlmsg_data(nlh); 3418 copy_to_user_state(x, &ue->state); 3419 ue->hard = (c->data.hard != 0) ? 1 : 0; 3420 /* clear the padding bytes */ 3421 memset_after(ue, 0, hard); 3422 3423 err = xfrm_mark_put(skb, &x->mark); 3424 if (err) 3425 return err; 3426 3427 err = xfrm_if_id_put(skb, x->if_id); 3428 if (err) 3429 return err; 3430 if (x->pcpu_num != UINT_MAX) { 3431 err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 3432 if (err) 3433 return err; 3434 } 3435 3436 if (x->dir) { 3437 err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); 3438 if (err) 3439 return err; 3440 } 3441 3442 nlmsg_end(skb, nlh); 3443 return 0; 3444 } 3445 3446 static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c) 3447 { 3448 struct net *net = xs_net(x); 3449 struct sk_buff *skb; 3450 3451 skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC); 3452 if (skb == NULL) 3453 return -ENOMEM; 3454 3455 if (build_expire(skb, x, c) < 0) { 3456 kfree_skb(skb); 3457 return -EMSGSIZE; 3458 } 3459 3460 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 3461 } 3462 3463 static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c) 3464 { 3465 struct net *net = xs_net(x); 3466 struct sk_buff *skb; 3467 int err; 3468 3469 skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC); 3470 if (skb == NULL) 3471 return -ENOMEM; 3472 3473 err = build_aevent(skb, x, c); 3474 BUG_ON(err < 0); 3475 3476 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS); 3477 } 3478 3479 static int xfrm_notify_sa_flush(const struct km_event *c) 3480 { 3481 struct net *net = c->net; 3482 struct xfrm_usersa_flush *p; 3483 struct nlmsghdr *nlh; 3484 struct sk_buff *skb; 3485 int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush)); 3486 3487 skb = nlmsg_new(len, GFP_ATOMIC); 3488 if (skb == NULL) 3489 return -ENOMEM; 3490 3491 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0); 3492 if (nlh == NULL) { 3493 kfree_skb(skb); 3494 return -EMSGSIZE; 3495 } 3496 3497 p = nlmsg_data(nlh); 3498 p->proto = c->data.proto; 3499 3500 nlmsg_end(skb, nlh); 3501 3502 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 3503 } 3504 3505 static inline unsigned int xfrm_sa_len(struct xfrm_state *x) 3506 { 3507 unsigned int l = 0; 3508 if (x->aead) 3509 l += nla_total_size(aead_len(x->aead)); 3510 if (x->aalg) { 3511 l += nla_total_size(sizeof(struct xfrm_algo) + 3512 (x->aalg->alg_key_len + 7) / 8); 3513 l += nla_total_size(xfrm_alg_auth_len(x->aalg)); 3514 } 3515 if (x->ealg) 3516 l += nla_total_size(xfrm_alg_len(x->ealg)); 3517 if (x->calg) 3518 l += nla_total_size(sizeof(*x->calg)); 3519 if (x->encap) 3520 l += nla_total_size(sizeof(*x->encap)); 3521 if (x->tfcpad) 3522 l += nla_total_size(sizeof(x->tfcpad)); 3523 if (x->replay_esn) 3524 l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn)); 3525 else 3526 l += nla_total_size(sizeof(struct xfrm_replay_state)); 3527 if (x->security) 3528 l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) + 3529 x->security->ctx_len); 3530 if (x->coaddr) 3531 l += nla_total_size(sizeof(*x->coaddr)); 3532 if (x->props.extra_flags) 3533 l += nla_total_size(sizeof(x->props.extra_flags)); 3534 if (x->xso.dev) 3535 l += nla_total_size(sizeof(struct xfrm_user_offload)); 3536 if (x->props.smark.v | x->props.smark.m) { 3537 l += nla_total_size(sizeof(x->props.smark.v)); 3538 l += nla_total_size(sizeof(x->props.smark.m)); 3539 } 3540 if (x->if_id) 3541 l += nla_total_size(sizeof(x->if_id)); 3542 if (x->pcpu_num) 3543 l += nla_total_size(sizeof(x->pcpu_num)); 3544 3545 /* Must count x->lastused as it may become non-zero behind our back. */ 3546 l += nla_total_size_64bit(sizeof(u64)); 3547 3548 if (x->mapping_maxage) 3549 l += nla_total_size(sizeof(x->mapping_maxage)); 3550 3551 if (x->dir) 3552 l += nla_total_size(sizeof(x->dir)); 3553 3554 if (x->nat_keepalive_interval) 3555 l += nla_total_size(sizeof(x->nat_keepalive_interval)); 3556 3557 return l; 3558 } 3559 3560 static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c) 3561 { 3562 struct net *net = xs_net(x); 3563 struct xfrm_usersa_info *p; 3564 struct xfrm_usersa_id *id; 3565 struct nlmsghdr *nlh; 3566 struct sk_buff *skb; 3567 unsigned int len = xfrm_sa_len(x); 3568 unsigned int headlen; 3569 int err; 3570 3571 headlen = sizeof(*p); 3572 if (c->event == XFRM_MSG_DELSA) { 3573 len += nla_total_size(headlen); 3574 headlen = sizeof(*id); 3575 len += nla_total_size(sizeof(struct xfrm_mark)); 3576 } 3577 len += NLMSG_ALIGN(headlen); 3578 3579 skb = nlmsg_new(len, GFP_ATOMIC); 3580 if (skb == NULL) 3581 return -ENOMEM; 3582 3583 nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 3584 err = -EMSGSIZE; 3585 if (nlh == NULL) 3586 goto out_free_skb; 3587 3588 p = nlmsg_data(nlh); 3589 if (c->event == XFRM_MSG_DELSA) { 3590 struct nlattr *attr; 3591 3592 id = nlmsg_data(nlh); 3593 memset(id, 0, sizeof(*id)); 3594 memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr)); 3595 id->spi = x->id.spi; 3596 id->family = x->props.family; 3597 id->proto = x->id.proto; 3598 3599 attr = nla_reserve(skb, XFRMA_SA, sizeof(*p)); 3600 err = -EMSGSIZE; 3601 if (attr == NULL) 3602 goto out_free_skb; 3603 3604 p = nla_data(attr); 3605 } 3606 err = copy_to_user_state_extra(x, p, skb); 3607 if (err) 3608 goto out_free_skb; 3609 3610 nlmsg_end(skb, nlh); 3611 3612 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA); 3613 3614 out_free_skb: 3615 kfree_skb(skb); 3616 return err; 3617 } 3618 3619 static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c) 3620 { 3621 3622 switch (c->event) { 3623 case XFRM_MSG_EXPIRE: 3624 return xfrm_exp_state_notify(x, c); 3625 case XFRM_MSG_NEWAE: 3626 return xfrm_aevent_state_notify(x, c); 3627 case XFRM_MSG_DELSA: 3628 case XFRM_MSG_UPDSA: 3629 case XFRM_MSG_NEWSA: 3630 return xfrm_notify_sa(x, c); 3631 case XFRM_MSG_FLUSHSA: 3632 return xfrm_notify_sa_flush(c); 3633 default: 3634 printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n", 3635 c->event); 3636 break; 3637 } 3638 3639 return 0; 3640 3641 } 3642 3643 static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x, 3644 struct xfrm_policy *xp) 3645 { 3646 return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire)) 3647 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 3648 + nla_total_size(sizeof(struct xfrm_mark)) 3649 + nla_total_size(xfrm_user_sec_ctx_size(x->security)) 3650 + nla_total_size(4) /* XFRMA_SA_PCPU */ 3651 + userpolicy_type_attrsize(); 3652 } 3653 3654 static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, 3655 struct xfrm_tmpl *xt, struct xfrm_policy *xp) 3656 { 3657 __u32 seq = xfrm_get_acqseq(); 3658 struct xfrm_user_acquire *ua; 3659 struct nlmsghdr *nlh; 3660 int err; 3661 3662 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0); 3663 if (nlh == NULL) 3664 return -EMSGSIZE; 3665 3666 ua = nlmsg_data(nlh); 3667 memcpy(&ua->id, &x->id, sizeof(ua->id)); 3668 memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr)); 3669 memcpy(&ua->sel, &x->sel, sizeof(ua->sel)); 3670 copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT); 3671 ua->aalgos = xt->aalgos; 3672 ua->ealgos = xt->ealgos; 3673 ua->calgos = xt->calgos; 3674 ua->seq = x->km.seq = seq; 3675 3676 err = copy_to_user_tmpl(xp, skb); 3677 if (!err) 3678 err = copy_to_user_state_sec_ctx(x, skb); 3679 if (!err) 3680 err = copy_to_user_policy_type(xp->type, skb); 3681 if (!err) 3682 err = xfrm_mark_put(skb, &xp->mark); 3683 if (!err) 3684 err = xfrm_if_id_put(skb, xp->if_id); 3685 if (!err && xp->xdo.dev) 3686 err = copy_user_offload(&xp->xdo, skb); 3687 if (!err && x->pcpu_num != UINT_MAX) 3688 err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); 3689 if (err) { 3690 nlmsg_cancel(skb, nlh); 3691 return err; 3692 } 3693 3694 nlmsg_end(skb, nlh); 3695 return 0; 3696 } 3697 3698 static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt, 3699 struct xfrm_policy *xp) 3700 { 3701 struct net *net = xs_net(x); 3702 struct sk_buff *skb; 3703 int err; 3704 3705 skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC); 3706 if (skb == NULL) 3707 return -ENOMEM; 3708 3709 err = build_acquire(skb, x, xt, xp); 3710 BUG_ON(err < 0); 3711 3712 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE); 3713 } 3714 3715 /* User gives us xfrm_user_policy_info followed by an array of 0 3716 * or more templates. 3717 */ 3718 static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt, 3719 u8 *data, int len, int *dir) 3720 { 3721 struct net *net = sock_net(sk); 3722 struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data; 3723 struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1); 3724 struct xfrm_policy *xp; 3725 int nr; 3726 3727 switch (sk->sk_family) { 3728 case AF_INET: 3729 if (opt != IP_XFRM_POLICY) { 3730 *dir = -EOPNOTSUPP; 3731 return NULL; 3732 } 3733 break; 3734 #if IS_ENABLED(CONFIG_IPV6) 3735 case AF_INET6: 3736 if (opt != IPV6_XFRM_POLICY) { 3737 *dir = -EOPNOTSUPP; 3738 return NULL; 3739 } 3740 break; 3741 #endif 3742 default: 3743 *dir = -EINVAL; 3744 return NULL; 3745 } 3746 3747 *dir = -EINVAL; 3748 3749 if (len < sizeof(*p) || 3750 verify_newpolicy_info(p, NULL)) 3751 return NULL; 3752 3753 nr = ((len - sizeof(*p)) / sizeof(*ut)); 3754 if (validate_tmpl(nr, ut, p->sel.family, p->dir, NULL)) 3755 return NULL; 3756 3757 if (p->dir > XFRM_POLICY_OUT) 3758 return NULL; 3759 3760 xp = xfrm_policy_alloc(net, GFP_ATOMIC); 3761 if (xp == NULL) { 3762 *dir = -ENOBUFS; 3763 return NULL; 3764 } 3765 3766 copy_from_user_policy(xp, p); 3767 xp->type = XFRM_POLICY_TYPE_MAIN; 3768 copy_templates(xp, ut, nr); 3769 3770 *dir = p->dir; 3771 3772 return xp; 3773 } 3774 3775 static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp) 3776 { 3777 return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire)) 3778 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) 3779 + nla_total_size(xfrm_user_sec_ctx_size(xp->security)) 3780 + nla_total_size(sizeof(struct xfrm_mark)) 3781 + userpolicy_type_attrsize(); 3782 } 3783 3784 static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, 3785 int dir, const struct km_event *c) 3786 { 3787 struct xfrm_user_polexpire *upe; 3788 int hard = c->data.hard; 3789 struct nlmsghdr *nlh; 3790 int err; 3791 3792 nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0); 3793 if (nlh == NULL) 3794 return -EMSGSIZE; 3795 3796 upe = nlmsg_data(nlh); 3797 copy_to_user_policy(xp, &upe->pol, dir); 3798 err = copy_to_user_tmpl(xp, skb); 3799 if (!err) 3800 err = copy_to_user_sec_ctx(xp, skb); 3801 if (!err) 3802 err = copy_to_user_policy_type(xp->type, skb); 3803 if (!err) 3804 err = xfrm_mark_put(skb, &xp->mark); 3805 if (!err) 3806 err = xfrm_if_id_put(skb, xp->if_id); 3807 if (!err && xp->xdo.dev) 3808 err = copy_user_offload(&xp->xdo, skb); 3809 if (err) { 3810 nlmsg_cancel(skb, nlh); 3811 return err; 3812 } 3813 upe->hard = !!hard; 3814 3815 nlmsg_end(skb, nlh); 3816 return 0; 3817 } 3818 3819 static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 3820 { 3821 struct net *net = xp_net(xp); 3822 struct sk_buff *skb; 3823 int err; 3824 3825 skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC); 3826 if (skb == NULL) 3827 return -ENOMEM; 3828 3829 err = build_polexpire(skb, xp, dir, c); 3830 BUG_ON(err < 0); 3831 3832 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE); 3833 } 3834 3835 static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c) 3836 { 3837 unsigned int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 3838 struct net *net = xp_net(xp); 3839 struct xfrm_userpolicy_info *p; 3840 struct xfrm_userpolicy_id *id; 3841 struct nlmsghdr *nlh; 3842 struct sk_buff *skb; 3843 unsigned int headlen; 3844 int err; 3845 3846 headlen = sizeof(*p); 3847 if (c->event == XFRM_MSG_DELPOLICY) { 3848 len += nla_total_size(headlen); 3849 headlen = sizeof(*id); 3850 } 3851 len += userpolicy_type_attrsize(); 3852 len += nla_total_size(sizeof(struct xfrm_mark)); 3853 len += NLMSG_ALIGN(headlen); 3854 3855 skb = nlmsg_new(len, GFP_ATOMIC); 3856 if (skb == NULL) 3857 return -ENOMEM; 3858 3859 nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0); 3860 err = -EMSGSIZE; 3861 if (nlh == NULL) 3862 goto out_free_skb; 3863 3864 p = nlmsg_data(nlh); 3865 if (c->event == XFRM_MSG_DELPOLICY) { 3866 struct nlattr *attr; 3867 3868 id = nlmsg_data(nlh); 3869 memset(id, 0, sizeof(*id)); 3870 id->dir = dir; 3871 if (c->data.byid) 3872 id->index = xp->index; 3873 else 3874 memcpy(&id->sel, &xp->selector, sizeof(id->sel)); 3875 3876 attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p)); 3877 err = -EMSGSIZE; 3878 if (attr == NULL) 3879 goto out_free_skb; 3880 3881 p = nla_data(attr); 3882 } 3883 3884 copy_to_user_policy(xp, p, dir); 3885 err = copy_to_user_tmpl(xp, skb); 3886 if (!err) 3887 err = copy_to_user_policy_type(xp->type, skb); 3888 if (!err) 3889 err = xfrm_mark_put(skb, &xp->mark); 3890 if (!err) 3891 err = xfrm_if_id_put(skb, xp->if_id); 3892 if (!err && xp->xdo.dev) 3893 err = copy_user_offload(&xp->xdo, skb); 3894 if (err) 3895 goto out_free_skb; 3896 3897 nlmsg_end(skb, nlh); 3898 3899 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 3900 3901 out_free_skb: 3902 kfree_skb(skb); 3903 return err; 3904 } 3905 3906 static int xfrm_notify_policy_flush(const struct km_event *c) 3907 { 3908 struct net *net = c->net; 3909 struct nlmsghdr *nlh; 3910 struct sk_buff *skb; 3911 int err; 3912 3913 skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC); 3914 if (skb == NULL) 3915 return -ENOMEM; 3916 3917 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0); 3918 err = -EMSGSIZE; 3919 if (nlh == NULL) 3920 goto out_free_skb; 3921 err = copy_to_user_policy_type(c->data.type, skb); 3922 if (err) 3923 goto out_free_skb; 3924 3925 nlmsg_end(skb, nlh); 3926 3927 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); 3928 3929 out_free_skb: 3930 kfree_skb(skb); 3931 return err; 3932 } 3933 3934 static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c) 3935 { 3936 3937 switch (c->event) { 3938 case XFRM_MSG_NEWPOLICY: 3939 case XFRM_MSG_UPDPOLICY: 3940 case XFRM_MSG_DELPOLICY: 3941 return xfrm_notify_policy(xp, dir, c); 3942 case XFRM_MSG_FLUSHPOLICY: 3943 return xfrm_notify_policy_flush(c); 3944 case XFRM_MSG_POLEXPIRE: 3945 return xfrm_exp_policy_notify(xp, dir, c); 3946 default: 3947 printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n", 3948 c->event); 3949 } 3950 3951 return 0; 3952 3953 } 3954 3955 static inline unsigned int xfrm_report_msgsize(void) 3956 { 3957 return NLMSG_ALIGN(sizeof(struct xfrm_user_report)); 3958 } 3959 3960 static int build_report(struct sk_buff *skb, u8 proto, 3961 struct xfrm_selector *sel, xfrm_address_t *addr) 3962 { 3963 struct xfrm_user_report *ur; 3964 struct nlmsghdr *nlh; 3965 3966 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0); 3967 if (nlh == NULL) 3968 return -EMSGSIZE; 3969 3970 ur = nlmsg_data(nlh); 3971 ur->proto = proto; 3972 memcpy(&ur->sel, sel, sizeof(ur->sel)); 3973 3974 if (addr) { 3975 int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr); 3976 if (err) { 3977 nlmsg_cancel(skb, nlh); 3978 return err; 3979 } 3980 } 3981 nlmsg_end(skb, nlh); 3982 return 0; 3983 } 3984 3985 static int xfrm_send_report(struct net *net, u8 proto, 3986 struct xfrm_selector *sel, xfrm_address_t *addr) 3987 { 3988 struct sk_buff *skb; 3989 int err; 3990 3991 skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC); 3992 if (skb == NULL) 3993 return -ENOMEM; 3994 3995 err = build_report(skb, proto, sel, addr); 3996 BUG_ON(err < 0); 3997 3998 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT); 3999 } 4000 4001 static inline unsigned int xfrm_mapping_msgsize(void) 4002 { 4003 return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping)); 4004 } 4005 4006 static int build_mapping(struct sk_buff *skb, struct xfrm_state *x, 4007 xfrm_address_t *new_saddr, __be16 new_sport) 4008 { 4009 struct xfrm_user_mapping *um; 4010 struct nlmsghdr *nlh; 4011 4012 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0); 4013 if (nlh == NULL) 4014 return -EMSGSIZE; 4015 4016 um = nlmsg_data(nlh); 4017 4018 memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr)); 4019 um->id.spi = x->id.spi; 4020 um->id.family = x->props.family; 4021 um->id.proto = x->id.proto; 4022 memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr)); 4023 memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr)); 4024 um->new_sport = new_sport; 4025 um->old_sport = x->encap->encap_sport; 4026 um->reqid = x->props.reqid; 4027 4028 nlmsg_end(skb, nlh); 4029 return 0; 4030 } 4031 4032 static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, 4033 __be16 sport) 4034 { 4035 struct net *net = xs_net(x); 4036 struct sk_buff *skb; 4037 int err; 4038 4039 if (x->id.proto != IPPROTO_ESP) 4040 return -EINVAL; 4041 4042 if (!x->encap) 4043 return -EINVAL; 4044 4045 skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC); 4046 if (skb == NULL) 4047 return -ENOMEM; 4048 4049 err = build_mapping(skb, x, ipaddr, sport); 4050 BUG_ON(err < 0); 4051 4052 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING); 4053 } 4054 4055 static bool xfrm_is_alive(const struct km_event *c) 4056 { 4057 return (bool)xfrm_acquire_is_on(c->net); 4058 } 4059 4060 static struct xfrm_mgr netlink_mgr = { 4061 .notify = xfrm_send_state_notify, 4062 .acquire = xfrm_send_acquire, 4063 .compile_policy = xfrm_compile_policy, 4064 .notify_policy = xfrm_send_policy_notify, 4065 .report = xfrm_send_report, 4066 .migrate = xfrm_send_migrate, 4067 .new_mapping = xfrm_send_mapping, 4068 .is_alive = xfrm_is_alive, 4069 }; 4070 4071 static int __net_init xfrm_user_net_init(struct net *net) 4072 { 4073 struct sock *nlsk; 4074 struct netlink_kernel_cfg cfg = { 4075 .groups = XFRMNLGRP_MAX, 4076 .input = xfrm_netlink_rcv, 4077 }; 4078 4079 nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg); 4080 if (nlsk == NULL) 4081 return -ENOMEM; 4082 net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */ 4083 rcu_assign_pointer(net->xfrm.nlsk, nlsk); 4084 return 0; 4085 } 4086 4087 static void __net_exit xfrm_user_net_pre_exit(struct net *net) 4088 { 4089 RCU_INIT_POINTER(net->xfrm.nlsk, NULL); 4090 } 4091 4092 static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list) 4093 { 4094 struct net *net; 4095 4096 list_for_each_entry(net, net_exit_list, exit_list) 4097 netlink_kernel_release(net->xfrm.nlsk_stash); 4098 } 4099 4100 static struct pernet_operations xfrm_user_net_ops = { 4101 .init = xfrm_user_net_init, 4102 .pre_exit = xfrm_user_net_pre_exit, 4103 .exit_batch = xfrm_user_net_exit, 4104 }; 4105 4106 static int __init xfrm_user_init(void) 4107 { 4108 int rv; 4109 4110 printk(KERN_INFO "Initializing XFRM netlink socket\n"); 4111 4112 rv = register_pernet_subsys(&xfrm_user_net_ops); 4113 if (rv < 0) 4114 return rv; 4115 xfrm_register_km(&netlink_mgr); 4116 return 0; 4117 } 4118 4119 static void __exit xfrm_user_exit(void) 4120 { 4121 xfrm_unregister_km(&netlink_mgr); 4122 unregister_pernet_subsys(&xfrm_user_net_ops); 4123 } 4124 4125 module_init(xfrm_user_init); 4126 module_exit(xfrm_user_exit); 4127 MODULE_DESCRIPTION("XFRM User interface"); 4128 MODULE_LICENSE("GPL"); 4129 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM); 4130