projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
[XFRM] netlink: Remove dependency on rtnetlink
[deliverable/linux.git] / net / xfrm / xfrm_user.c
1 /* xfrm_user.c: User interface to configure xfrm engine.
2 *
3 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
4 *
5 * Changes:
6 * Mitsuru KANDA @USAGI
7 * Kazunori MIYAZAWA @USAGI
8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9 * IPv6 support
10 *
11 */
12
13 #include <linux/crypto.h>
14 #include <linux/module.h>
15 #include <linux/kernel.h>
16 #include <linux/types.h>
17 #include <linux/slab.h>
18 #include <linux/socket.h>
19 #include <linux/string.h>
20 #include <linux/net.h>
21 #include <linux/skbuff.h>
22 #include <linux/pfkeyv2.h>
23 #include <linux/ipsec.h>
24 #include <linux/init.h>
25 #include <linux/security.h>
26 #include <net/sock.h>
27 #include <net/xfrm.h>
28 #include <net/netlink.h>
29 #include <asm/uaccess.h>
30 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
31 #include <linux/in6.h>
32 #endif
33 #include <linux/audit.h>
34
35 static inline int alg_len(struct xfrm_algo *alg)
36 {
37 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
38 }
39
40 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
41 {
42 struct nlattr *rt = attrs[type];
43 struct xfrm_algo *algp;
44
45 if (!rt)
46 return 0;
47
48 algp = nla_data(rt);
49 if (nla_len(rt) < alg_len(algp))
50 return -EINVAL;
51
52 switch (type) {
53 case XFRMA_ALG_AUTH:
54 if (!algp->alg_key_len &&
55 strcmp(algp->alg_name, "digest_null") != 0)
56 return -EINVAL;
57 break;
58
59 case XFRMA_ALG_CRYPT:
60 if (!algp->alg_key_len &&
61 strcmp(algp->alg_name, "cipher_null") != 0)
62 return -EINVAL;
63 break;
64
65 case XFRMA_ALG_COMP:
66 /* Zero length keys are legal. */
67 break;
68
69 default:
70 return -EINVAL;
71 }
72
73 algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
74 return 0;
75 }
76
77 static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
78 xfrm_address_t **addrp)
79 {
80 struct nlattr *rt = attrs[type];
81
82 if (rt && addrp)
83 *addrp = nla_data(rt);
84 }
85
86 static inline int verify_sec_ctx_len(struct nlattr **attrs)
87 {
88 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
89 struct xfrm_user_sec_ctx *uctx;
90
91 if (!rt)
92 return 0;
93
94 uctx = nla_data(rt);
95 if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
96 return -EINVAL;
97
98 return 0;
99 }
100
101
102 static int verify_newsa_info(struct xfrm_usersa_info *p,
103 struct nlattr **attrs)
104 {
105 int err;
106
107 err = -EINVAL;
108 switch (p->family) {
109 case AF_INET:
110 break;
111
112 case AF_INET6:
113 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
114 break;
115 #else
116 err = -EAFNOSUPPORT;
117 goto out;
118 #endif
119
120 default:
121 goto out;
122 }
123
124 err = -EINVAL;
125 switch (p->id.proto) {
126 case IPPROTO_AH:
127 if (!attrs[XFRMA_ALG_AUTH] ||
128 attrs[XFRMA_ALG_CRYPT] ||
129 attrs[XFRMA_ALG_COMP])
130 goto out;
131 break;
132
133 case IPPROTO_ESP:
134 if ((!attrs[XFRMA_ALG_AUTH] &&
135 !attrs[XFRMA_ALG_CRYPT]) ||
136 attrs[XFRMA_ALG_COMP])
137 goto out;
138 break;
139
140 case IPPROTO_COMP:
141 if (!attrs[XFRMA_ALG_COMP] ||
142 attrs[XFRMA_ALG_AUTH] ||
143 attrs[XFRMA_ALG_CRYPT])
144 goto out;
145 break;
146
147 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
148 case IPPROTO_DSTOPTS:
149 case IPPROTO_ROUTING:
150 if (attrs[XFRMA_ALG_COMP] ||
151 attrs[XFRMA_ALG_AUTH] ||
152 attrs[XFRMA_ALG_CRYPT] ||
153 attrs[XFRMA_ENCAP] ||
154 attrs[XFRMA_SEC_CTX] ||
155 !attrs[XFRMA_COADDR])
156 goto out;
157 break;
158 #endif
159
160 default:
161 goto out;
162 }
163
164 if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
165 goto out;
166 if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
167 goto out;
168 if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
169 goto out;
170 if ((err = verify_sec_ctx_len(attrs)))
171 goto out;
172
173 err = -EINVAL;
174 switch (p->mode) {
175 case XFRM_MODE_TRANSPORT:
176 case XFRM_MODE_TUNNEL:
177 case XFRM_MODE_ROUTEOPTIMIZATION:
178 case XFRM_MODE_BEET:
179 break;
180
181 default:
182 goto out;
183 }
184
185 err = 0;
186
187 out:
188 return err;
189 }
190
191 static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
192 struct xfrm_algo_desc *(*get_byname)(char *, int),
193 struct nlattr *rta)
194 {
195 struct xfrm_algo *p, *ualg;
196 struct xfrm_algo_desc *algo;
197
198 if (!rta)
199 return 0;
200
201 ualg = nla_data(rta);
202
203 algo = get_byname(ualg->alg_name, 1);
204 if (!algo)
205 return -ENOSYS;
206 *props = algo->desc.sadb_alg_id;
207
208 p = kmemdup(ualg, alg_len(ualg), GFP_KERNEL);
209 if (!p)
210 return -ENOMEM;
211
212 strcpy(p->alg_name, algo->name);
213 *algpp = p;
214 return 0;
215 }
216
217 static int attach_encap_tmpl(struct xfrm_encap_tmpl **encapp, struct nlattr *rta)
218 {
219 struct xfrm_encap_tmpl *p, *uencap;
220
221 if (!rta)
222 return 0;
223
224 uencap = nla_data(rta);
225 p = kmemdup(uencap, sizeof(*p), GFP_KERNEL);
226 if (!p)
227 return -ENOMEM;
228
229 *encapp = p;
230 return 0;
231 }
232
233
234 static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
235 {
236 int len = 0;
237
238 if (xfrm_ctx) {
239 len += sizeof(struct xfrm_user_sec_ctx);
240 len += xfrm_ctx->ctx_len;
241 }
242 return len;
243 }
244
245 static int attach_sec_ctx(struct xfrm_state *x, struct nlattr *u_arg)
246 {
247 struct xfrm_user_sec_ctx *uctx;
248
249 if (!u_arg)
250 return 0;
251
252 uctx = nla_data(u_arg);
253 return security_xfrm_state_alloc(x, uctx);
254 }
255
256 static int attach_one_addr(xfrm_address_t **addrpp, struct nlattr *rta)
257 {
258 xfrm_address_t *p, *uaddrp;
259
260 if (!rta)
261 return 0;
262
263 uaddrp = nla_data(rta);
264 p = kmemdup(uaddrp, sizeof(*p), GFP_KERNEL);
265 if (!p)
266 return -ENOMEM;
267
268 *addrpp = p;
269 return 0;
270 }
271
272 static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
273 {
274 memcpy(&x->id, &p->id, sizeof(x->id));
275 memcpy(&x->sel, &p->sel, sizeof(x->sel));
276 memcpy(&x->lft, &p->lft, sizeof(x->lft));
277 x->props.mode = p->mode;
278 x->props.replay_window = p->replay_window;
279 x->props.reqid = p->reqid;
280 x->props.family = p->family;
281 memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
282 x->props.flags = p->flags;
283
284 /*
285 * Set inner address family if the KM left it as zero.
286 * See comment in validate_tmpl.
287 */
288 if (!x->sel.family)
289 x->sel.family = p->family;
290 }
291
292 /*
293 * someday when pfkey also has support, we could have the code
294 * somehow made shareable and move it to xfrm_state.c - JHS
295 *
296 */
297 static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
298 {
299 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
300 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
301 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
302 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
303
304 if (rp) {
305 struct xfrm_replay_state *replay;
306 replay = nla_data(rp);
307 memcpy(&x->replay, replay, sizeof(*replay));
308 memcpy(&x->preplay, replay, sizeof(*replay));
309 }
310
311 if (lt) {
312 struct xfrm_lifetime_cur *ltime;
313 ltime = nla_data(lt);
314 x->curlft.bytes = ltime->bytes;
315 x->curlft.packets = ltime->packets;
316 x->curlft.add_time = ltime->add_time;
317 x->curlft.use_time = ltime->use_time;
318 }
319
320 if (et)
321 x->replay_maxage = nla_get_u32(et);
322
323 if (rt)
324 x->replay_maxdiff = nla_get_u32(rt);
325 }
326
327 static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
328 struct nlattr **attrs,
329 int *errp)
330 {
331 struct xfrm_state *x = xfrm_state_alloc();
332 int err = -ENOMEM;
333
334 if (!x)
335 goto error_no_put;
336
337 copy_from_user_state(x, p);
338
339 if ((err = attach_one_algo(&x->aalg, &x->props.aalgo,
340 xfrm_aalg_get_byname,
341 attrs[XFRMA_ALG_AUTH])))
342 goto error;
343 if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
344 xfrm_ealg_get_byname,
345 attrs[XFRMA_ALG_CRYPT])))
346 goto error;
347 if ((err = attach_one_algo(&x->calg, &x->props.calgo,
348 xfrm_calg_get_byname,
349 attrs[XFRMA_ALG_COMP])))
350 goto error;
351 if ((err = attach_encap_tmpl(&x->encap, attrs[XFRMA_ENCAP])))
352 goto error;
353 if ((err = attach_one_addr(&x->coaddr, attrs[XFRMA_COADDR])))
354 goto error;
355 err = xfrm_init_state(x);
356 if (err)
357 goto error;
358
359 if ((err = attach_sec_ctx(x, attrs[XFRMA_SEC_CTX])))
360 goto error;
361
362 x->km.seq = p->seq;
363 x->replay_maxdiff = sysctl_xfrm_aevent_rseqth;
364 /* sysctl_xfrm_aevent_etime is in 100ms units */
365 x->replay_maxage = (sysctl_xfrm_aevent_etime*HZ)/XFRM_AE_ETH_M;
366 x->preplay.bitmap = 0;
367 x->preplay.seq = x->replay.seq+x->replay_maxdiff;
368 x->preplay.oseq = x->replay.oseq +x->replay_maxdiff;
369
370 /* override default values from above */
371
372 xfrm_update_ae_params(x, attrs);
373
374 return x;
375
376 error:
377 x->km.state = XFRM_STATE_DEAD;
378 xfrm_state_put(x);
379 error_no_put:
380 *errp = err;
381 return NULL;
382 }
383
384 static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
385 struct nlattr **attrs)
386 {
387 struct xfrm_usersa_info *p = nlmsg_data(nlh);
388 struct xfrm_state *x;
389 int err;
390 struct km_event c;
391
392 err = verify_newsa_info(p, attrs);
393 if (err)
394 return err;
395
396 x = xfrm_state_construct(p, attrs, &err);
397 if (!x)
398 return err;
399
400 xfrm_state_hold(x);
401 if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
402 err = xfrm_state_add(x);
403 else
404 err = xfrm_state_update(x);
405
406 xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
407 AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
408
409 if (err < 0) {
410 x->km.state = XFRM_STATE_DEAD;
411 __xfrm_state_put(x);
412 goto out;
413 }
414
415 c.seq = nlh->nlmsg_seq;
416 c.pid = nlh->nlmsg_pid;
417 c.event = nlh->nlmsg_type;
418
419 km_state_notify(x, &c);
420 out:
421 xfrm_state_put(x);
422 return err;
423 }
424
425 static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
426 struct nlattr **attrs,
427 int *errp)
428 {
429 struct xfrm_state *x = NULL;
430 int err;
431
432 if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
433 err = -ESRCH;
434 x = xfrm_state_lookup(&p->daddr, p->spi, p->proto, p->family);
435 } else {
436 xfrm_address_t *saddr = NULL;
437
438 verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
439 if (!saddr) {
440 err = -EINVAL;
441 goto out;
442 }
443
444 err = -ESRCH;
445 x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto,
446 p->family);
447 }
448
449 out:
450 if (!x && errp)
451 *errp = err;
452 return x;
453 }
454
455 static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
456 struct nlattr **attrs)
457 {
458 struct xfrm_state *x;
459 int err = -ESRCH;
460 struct km_event c;
461 struct xfrm_usersa_id *p = nlmsg_data(nlh);
462
463 x = xfrm_user_state_lookup(p, attrs, &err);
464 if (x == NULL)
465 return err;
466
467 if ((err = security_xfrm_state_delete(x)) != 0)
468 goto out;
469
470 if (xfrm_state_kern(x)) {
471 err = -EPERM;
472 goto out;
473 }
474
475 err = xfrm_state_delete(x);
476
477 if (err < 0)
478 goto out;
479
480 c.seq = nlh->nlmsg_seq;
481 c.pid = nlh->nlmsg_pid;
482 c.event = nlh->nlmsg_type;
483 km_state_notify(x, &c);
484
485 out:
486 xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
487 AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
488 xfrm_state_put(x);
489 return err;
490 }
491
492 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
493 {
494 memcpy(&p->id, &x->id, sizeof(p->id));
495 memcpy(&p->sel, &x->sel, sizeof(p->sel));
496 memcpy(&p->lft, &x->lft, sizeof(p->lft));
497 memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
498 memcpy(&p->stats, &x->stats, sizeof(p->stats));
499 memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
500 p->mode = x->props.mode;
501 p->replay_window = x->props.replay_window;
502 p->reqid = x->props.reqid;
503 p->family = x->props.family;
504 p->flags = x->props.flags;
505 p->seq = x->km.seq;
506 }
507
508 struct xfrm_dump_info {
509 struct sk_buff *in_skb;
510 struct sk_buff *out_skb;
511 u32 nlmsg_seq;
512 u16 nlmsg_flags;
513 int start_idx;
514 int this_idx;
515 };
516
517 static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
518 {
519 int ctx_size = sizeof(struct xfrm_sec_ctx) + s->ctx_len;
520 struct xfrm_user_sec_ctx *uctx;
521 struct nlattr *attr;
522
523 attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
524 if (attr == NULL)
525 return -EMSGSIZE;
526
527 uctx = nla_data(attr);
528 uctx->exttype = XFRMA_SEC_CTX;
529 uctx->len = ctx_size;
530 uctx->ctx_doi = s->ctx_doi;
531 uctx->ctx_alg = s->ctx_alg;
532 uctx->ctx_len = s->ctx_len;
533 memcpy(uctx + 1, s->ctx_str, s->ctx_len);
534
535 return 0;
536 }
537
538 static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
539 {
540 struct xfrm_dump_info *sp = ptr;
541 struct sk_buff *in_skb = sp->in_skb;
542 struct sk_buff *skb = sp->out_skb;
543 struct xfrm_usersa_info *p;
544 struct nlmsghdr *nlh;
545
546 if (sp->this_idx < sp->start_idx)
547 goto out;
548
549 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
550 XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
551 if (nlh == NULL)
552 return -EMSGSIZE;
553
554 p = nlmsg_data(nlh);
555 copy_to_user_state(x, p);
556
557 if (x->aalg)
558 NLA_PUT(skb, XFRMA_ALG_AUTH, alg_len(x->aalg), x->aalg);
559 if (x->ealg)
560 NLA_PUT(skb, XFRMA_ALG_CRYPT, alg_len(x->ealg), x->ealg);
561 if (x->calg)
562 NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
563
564 if (x->encap)
565 NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
566
567 if (x->security && copy_sec_ctx(x->security, skb) < 0)
568 goto nla_put_failure;
569
570 if (x->coaddr)
571 NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
572
573 if (x->lastused)
574 NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
575
576 nlmsg_end(skb, nlh);
577 out:
578 sp->this_idx++;
579 return 0;
580
581 nla_put_failure:
582 nlmsg_cancel(skb, nlh);
583 return -EMSGSIZE;
584 }
585
586 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
587 {
588 struct xfrm_dump_info info;
589
590 info.in_skb = cb->skb;
591 info.out_skb = skb;
592 info.nlmsg_seq = cb->nlh->nlmsg_seq;
593 info.nlmsg_flags = NLM_F_MULTI;
594 info.this_idx = 0;
595 info.start_idx = cb->args[0];
596 (void) xfrm_state_walk(0, dump_one_state, &info);
597 cb->args[0] = info.this_idx;
598
599 return skb->len;
600 }
601
602 static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
603 struct xfrm_state *x, u32 seq)
604 {
605 struct xfrm_dump_info info;
606 struct sk_buff *skb;
607
608 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
609 if (!skb)
610 return ERR_PTR(-ENOMEM);
611
612 info.in_skb = in_skb;
613 info.out_skb = skb;
614 info.nlmsg_seq = seq;
615 info.nlmsg_flags = 0;
616 info.this_idx = info.start_idx = 0;
617
618 if (dump_one_state(x, 0, &info)) {
619 kfree_skb(skb);
620 return NULL;
621 }
622
623 return skb;
624 }
625
626 static inline size_t xfrm_spdinfo_msgsize(void)
627 {
628 return NLMSG_ALIGN(4)
629 + nla_total_size(sizeof(struct xfrmu_spdinfo))
630 + nla_total_size(sizeof(struct xfrmu_spdhinfo));
631 }
632
633 static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
634 {
635 struct xfrmk_spdinfo si;
636 struct xfrmu_spdinfo spc;
637 struct xfrmu_spdhinfo sph;
638 struct nlmsghdr *nlh;
639 u32 *f;
640
641 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
642 if (nlh == NULL) /* shouldnt really happen ... */
643 return -EMSGSIZE;
644
645 f = nlmsg_data(nlh);
646 *f = flags;
647 xfrm_spd_getinfo(&si);
648 spc.incnt = si.incnt;
649 spc.outcnt = si.outcnt;
650 spc.fwdcnt = si.fwdcnt;
651 spc.inscnt = si.inscnt;
652 spc.outscnt = si.outscnt;
653 spc.fwdscnt = si.fwdscnt;
654 sph.spdhcnt = si.spdhcnt;
655 sph.spdhmcnt = si.spdhmcnt;
656
657 NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
658 NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
659
660 return nlmsg_end(skb, nlh);
661
662 nla_put_failure:
663 nlmsg_cancel(skb, nlh);
664 return -EMSGSIZE;
665 }
666
667 static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
668 struct nlattr **attrs)
669 {
670 struct sk_buff *r_skb;
671 u32 *flags = nlmsg_data(nlh);
672 u32 spid = NETLINK_CB(skb).pid;
673 u32 seq = nlh->nlmsg_seq;
674
675 r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
676 if (r_skb == NULL)
677 return -ENOMEM;
678
679 if (build_spdinfo(r_skb, spid, seq, *flags) < 0)
680 BUG();
681
682 return nlmsg_unicast(xfrm_nl, r_skb, spid);
683 }
684
685 static inline size_t xfrm_sadinfo_msgsize(void)
686 {
687 return NLMSG_ALIGN(4)
688 + nla_total_size(sizeof(struct xfrmu_sadhinfo))
689 + nla_total_size(4); /* XFRMA_SAD_CNT */
690 }
691
692 static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
693 {
694 struct xfrmk_sadinfo si;
695 struct xfrmu_sadhinfo sh;
696 struct nlmsghdr *nlh;
697 u32 *f;
698
699 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
700 if (nlh == NULL) /* shouldnt really happen ... */
701 return -EMSGSIZE;
702
703 f = nlmsg_data(nlh);
704 *f = flags;
705 xfrm_sad_getinfo(&si);
706
707 sh.sadhmcnt = si.sadhmcnt;
708 sh.sadhcnt = si.sadhcnt;
709
710 NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
711 NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
712
713 return nlmsg_end(skb, nlh);
714
715 nla_put_failure:
716 nlmsg_cancel(skb, nlh);
717 return -EMSGSIZE;
718 }
719
720 static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
721 struct nlattr **attrs)
722 {
723 struct sk_buff *r_skb;
724 u32 *flags = nlmsg_data(nlh);
725 u32 spid = NETLINK_CB(skb).pid;
726 u32 seq = nlh->nlmsg_seq;
727
728 r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
729 if (r_skb == NULL)
730 return -ENOMEM;
731
732 if (build_sadinfo(r_skb, spid, seq, *flags) < 0)
733 BUG();
734
735 return nlmsg_unicast(xfrm_nl, r_skb, spid);
736 }
737
738 static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
739 struct nlattr **attrs)
740 {
741 struct xfrm_usersa_id *p = nlmsg_data(nlh);
742 struct xfrm_state *x;
743 struct sk_buff *resp_skb;
744 int err = -ESRCH;
745
746 x = xfrm_user_state_lookup(p, attrs, &err);
747 if (x == NULL)
748 goto out_noput;
749
750 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
751 if (IS_ERR(resp_skb)) {
752 err = PTR_ERR(resp_skb);
753 } else {
754 err = nlmsg_unicast(xfrm_nl, resp_skb, NETLINK_CB(skb).pid);
755 }
756 xfrm_state_put(x);
757 out_noput:
758 return err;
759 }
760
761 static int verify_userspi_info(struct xfrm_userspi_info *p)
762 {
763 switch (p->info.id.proto) {
764 case IPPROTO_AH:
765 case IPPROTO_ESP:
766 break;
767
768 case IPPROTO_COMP:
769 /* IPCOMP spi is 16-bits. */
770 if (p->max >= 0x10000)
771 return -EINVAL;
772 break;
773
774 default:
775 return -EINVAL;
776 }
777
778 if (p->min > p->max)
779 return -EINVAL;
780
781 return 0;
782 }
783
784 static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
785 struct nlattr **attrs)
786 {
787 struct xfrm_state *x;
788 struct xfrm_userspi_info *p;
789 struct sk_buff *resp_skb;
790 xfrm_address_t *daddr;
791 int family;
792 int err;
793
794 p = nlmsg_data(nlh);
795 err = verify_userspi_info(p);
796 if (err)
797 goto out_noput;
798
799 family = p->info.family;
800 daddr = &p->info.id.daddr;
801
802 x = NULL;
803 if (p->info.seq) {
804 x = xfrm_find_acq_byseq(p->info.seq);
805 if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
806 xfrm_state_put(x);
807 x = NULL;
808 }
809 }
810
811 if (!x)
812 x = xfrm_find_acq(p->info.mode, p->info.reqid,
813 p->info.id.proto, daddr,
814 &p->info.saddr, 1,
815 family);
816 err = -ENOENT;
817 if (x == NULL)
818 goto out_noput;
819
820 resp_skb = ERR_PTR(-ENOENT);
821
822 spin_lock_bh(&x->lock);
823 if (x->km.state != XFRM_STATE_DEAD) {
824 xfrm_alloc_spi(x, htonl(p->min), htonl(p->max));
825 if (x->id.spi)
826 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
827 }
828 spin_unlock_bh(&x->lock);
829
830 if (IS_ERR(resp_skb)) {
831 err = PTR_ERR(resp_skb);
832 goto out;
833 }
834
835 err = nlmsg_unicast(xfrm_nl, resp_skb, NETLINK_CB(skb).pid);
836
837 out:
838 xfrm_state_put(x);
839 out_noput:
840 return err;
841 }
842
843 static int verify_policy_dir(u8 dir)
844 {
845 switch (dir) {
846 case XFRM_POLICY_IN:
847 case XFRM_POLICY_OUT:
848 case XFRM_POLICY_FWD:
849 break;
850
851 default:
852 return -EINVAL;
853 }
854
855 return 0;
856 }
857
858 static int verify_policy_type(u8 type)
859 {
860 switch (type) {
861 case XFRM_POLICY_TYPE_MAIN:
862 #ifdef CONFIG_XFRM_SUB_POLICY
863 case XFRM_POLICY_TYPE_SUB:
864 #endif
865 break;
866
867 default:
868 return -EINVAL;
869 }
870
871 return 0;
872 }
873
874 static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
875 {
876 switch (p->share) {
877 case XFRM_SHARE_ANY:
878 case XFRM_SHARE_SESSION:
879 case XFRM_SHARE_USER:
880 case XFRM_SHARE_UNIQUE:
881 break;
882
883 default:
884 return -EINVAL;
885 }
886
887 switch (p->action) {
888 case XFRM_POLICY_ALLOW:
889 case XFRM_POLICY_BLOCK:
890 break;
891
892 default:
893 return -EINVAL;
894 }
895
896 switch (p->sel.family) {
897 case AF_INET:
898 break;
899
900 case AF_INET6:
901 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
902 break;
903 #else
904 return -EAFNOSUPPORT;
905 #endif
906
907 default:
908 return -EINVAL;
909 }
910
911 return verify_policy_dir(p->dir);
912 }
913
914 static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
915 {
916 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
917 struct xfrm_user_sec_ctx *uctx;
918
919 if (!rt)
920 return 0;
921
922 uctx = nla_data(rt);
923 return security_xfrm_policy_alloc(pol, uctx);
924 }
925
926 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
927 int nr)
928 {
929 int i;
930
931 xp->xfrm_nr = nr;
932 for (i = 0; i < nr; i++, ut++) {
933 struct xfrm_tmpl *t = &xp->xfrm_vec[i];
934
935 memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
936 memcpy(&t->saddr, &ut->saddr,
937 sizeof(xfrm_address_t));
938 t->reqid = ut->reqid;
939 t->mode = ut->mode;
940 t->share = ut->share;
941 t->optional = ut->optional;
942 t->aalgos = ut->aalgos;
943 t->ealgos = ut->ealgos;
944 t->calgos = ut->calgos;
945 t->encap_family = ut->family;
946 }
947 }
948
949 static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
950 {
951 int i;
952
953 if (nr > XFRM_MAX_DEPTH)
954 return -EINVAL;
955
956 for (i = 0; i < nr; i++) {
957 /* We never validated the ut->family value, so many
958 * applications simply leave it at zero. The check was
959 * never made and ut->family was ignored because all
960 * templates could be assumed to have the same family as
961 * the policy itself. Now that we will have ipv4-in-ipv6
962 * and ipv6-in-ipv4 tunnels, this is no longer true.
963 */
964 if (!ut[i].family)
965 ut[i].family = family;
966
967 switch (ut[i].family) {
968 case AF_INET:
969 break;
970 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
971 case AF_INET6:
972 break;
973 #endif
974 default:
975 return -EINVAL;
976 }
977 }
978
979 return 0;
980 }
981
982 static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
983 {
984 struct nlattr *rt = attrs[XFRMA_TMPL];
985
986 if (!rt) {
987 pol->xfrm_nr = 0;
988 } else {
989 struct xfrm_user_tmpl *utmpl = nla_data(rt);
990 int nr = nla_len(rt) / sizeof(*utmpl);
991 int err;
992
993 err = validate_tmpl(nr, utmpl, pol->family);
994 if (err)
995 return err;
996
997 copy_templates(pol, utmpl, nr);
998 }
999 return 0;
1000 }
1001
1002 static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
1003 {
1004 struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1005 struct xfrm_userpolicy_type *upt;
1006 u8 type = XFRM_POLICY_TYPE_MAIN;
1007 int err;
1008
1009 if (rt) {
1010 upt = nla_data(rt);
1011 type = upt->type;
1012 }
1013
1014 err = verify_policy_type(type);
1015 if (err)
1016 return err;
1017
1018 *tp = type;
1019 return 0;
1020 }
1021
1022 static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
1023 {
1024 xp->priority = p->priority;
1025 xp->index = p->index;
1026 memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
1027 memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
1028 xp->action = p->action;
1029 xp->flags = p->flags;
1030 xp->family = p->sel.family;
1031 /* XXX xp->share = p->share; */
1032 }
1033
1034 static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
1035 {
1036 memcpy(&p->sel, &xp->selector, sizeof(p->sel));
1037 memcpy(&p->lft, &xp->lft, sizeof(p->lft));
1038 memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
1039 p->priority = xp->priority;
1040 p->index = xp->index;
1041 p->sel.family = xp->family;
1042 p->dir = dir;
1043 p->action = xp->action;
1044 p->flags = xp->flags;
1045 p->share = XFRM_SHARE_ANY; /* XXX xp->share */
1046 }
1047
1048 static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
1049 {
1050 struct xfrm_policy *xp = xfrm_policy_alloc(GFP_KERNEL);
1051 int err;
1052
1053 if (!xp) {
1054 *errp = -ENOMEM;
1055 return NULL;
1056 }
1057
1058 copy_from_user_policy(xp, p);
1059
1060 err = copy_from_user_policy_type(&xp->type, attrs);
1061 if (err)
1062 goto error;
1063
1064 if (!(err = copy_from_user_tmpl(xp, attrs)))
1065 err = copy_from_user_sec_ctx(xp, attrs);
1066 if (err)
1067 goto error;
1068
1069 return xp;
1070 error:
1071 *errp = err;
1072 kfree(xp);
1073 return NULL;
1074 }
1075
1076 static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1077 struct nlattr **attrs)
1078 {
1079 struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
1080 struct xfrm_policy *xp;
1081 struct km_event c;
1082 int err;
1083 int excl;
1084
1085 err = verify_newpolicy_info(p);
1086 if (err)
1087 return err;
1088 err = verify_sec_ctx_len(attrs);
1089 if (err)
1090 return err;
1091
1092 xp = xfrm_policy_construct(p, attrs, &err);
1093 if (!xp)
1094 return err;
1095
1096 /* shouldnt excl be based on nlh flags??
1097 * Aha! this is anti-netlink really i.e more pfkey derived
1098 * in netlink excl is a flag and you wouldnt need
1099 * a type XFRM_MSG_UPDPOLICY - JHS */
1100 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
1101 err = xfrm_policy_insert(p->dir, xp, excl);
1102 xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
1103 AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
1104
1105 if (err) {
1106 security_xfrm_policy_free(xp);
1107 kfree(xp);
1108 return err;
1109 }
1110
1111 c.event = nlh->nlmsg_type;
1112 c.seq = nlh->nlmsg_seq;
1113 c.pid = nlh->nlmsg_pid;
1114 km_policy_notify(xp, p->dir, &c);
1115
1116 xfrm_pol_put(xp);
1117
1118 return 0;
1119 }
1120
1121 static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
1122 {
1123 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
1124 int i;
1125
1126 if (xp->xfrm_nr == 0)
1127 return 0;
1128
1129 for (i = 0; i < xp->xfrm_nr; i++) {
1130 struct xfrm_user_tmpl *up = &vec[i];
1131 struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
1132
1133 memcpy(&up->id, &kp->id, sizeof(up->id));
1134 up->family = kp->encap_family;
1135 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
1136 up->reqid = kp->reqid;
1137 up->mode = kp->mode;
1138 up->share = kp->share;
1139 up->optional = kp->optional;
1140 up->aalgos = kp->aalgos;
1141 up->ealgos = kp->ealgos;
1142 up->calgos = kp->calgos;
1143 }
1144
1145 return nla_put(skb, XFRMA_TMPL,
1146 sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
1147 }
1148
1149 static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
1150 {
1151 if (x->security) {
1152 return copy_sec_ctx(x->security, skb);
1153 }
1154 return 0;
1155 }
1156
1157 static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
1158 {
1159 if (xp->security) {
1160 return copy_sec_ctx(xp->security, skb);
1161 }
1162 return 0;
1163 }
1164 static inline size_t userpolicy_type_attrsize(void)
1165 {
1166 #ifdef CONFIG_XFRM_SUB_POLICY
1167 return nla_total_size(sizeof(struct xfrm_userpolicy_type));
1168 #else
1169 return 0;
1170 #endif
1171 }
1172
1173 #ifdef CONFIG_XFRM_SUB_POLICY
1174 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1175 {
1176 struct xfrm_userpolicy_type upt = {
1177 .type = type,
1178 };
1179
1180 return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1181 }
1182
1183 #else
1184 static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1185 {
1186 return 0;
1187 }
1188 #endif
1189
1190 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
1191 {
1192 struct xfrm_dump_info *sp = ptr;
1193 struct xfrm_userpolicy_info *p;
1194 struct sk_buff *in_skb = sp->in_skb;
1195 struct sk_buff *skb = sp->out_skb;
1196 struct nlmsghdr *nlh;
1197
1198 if (sp->this_idx < sp->start_idx)
1199 goto out;
1200
1201 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
1202 XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
1203 if (nlh == NULL)
1204 return -EMSGSIZE;
1205
1206 p = nlmsg_data(nlh);
1207 copy_to_user_policy(xp, p, dir);
1208 if (copy_to_user_tmpl(xp, skb) < 0)
1209 goto nlmsg_failure;
1210 if (copy_to_user_sec_ctx(xp, skb))
1211 goto nlmsg_failure;
1212 if (copy_to_user_policy_type(xp->type, skb) < 0)
1213 goto nlmsg_failure;
1214
1215 nlmsg_end(skb, nlh);
1216 out:
1217 sp->this_idx++;
1218 return 0;
1219
1220 nlmsg_failure:
1221 nlmsg_cancel(skb, nlh);
1222 return -EMSGSIZE;
1223 }
1224
1225 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
1226 {
1227 struct xfrm_dump_info info;
1228
1229 info.in_skb = cb->skb;
1230 info.out_skb = skb;
1231 info.nlmsg_seq = cb->nlh->nlmsg_seq;
1232 info.nlmsg_flags = NLM_F_MULTI;
1233 info.this_idx = 0;
1234 info.start_idx = cb->args[0];
1235 (void) xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_one_policy, &info);
1236 #ifdef CONFIG_XFRM_SUB_POLICY
1237 (void) xfrm_policy_walk(XFRM_POLICY_TYPE_SUB, dump_one_policy, &info);
1238 #endif
1239 cb->args[0] = info.this_idx;
1240
1241 return skb->len;
1242 }
1243
1244 static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
1245 struct xfrm_policy *xp,
1246 int dir, u32 seq)
1247 {
1248 struct xfrm_dump_info info;
1249 struct sk_buff *skb;
1250
1251 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1252 if (!skb)
1253 return ERR_PTR(-ENOMEM);
1254
1255 info.in_skb = in_skb;
1256 info.out_skb = skb;
1257 info.nlmsg_seq = seq;
1258 info.nlmsg_flags = 0;
1259 info.this_idx = info.start_idx = 0;
1260
1261 if (dump_one_policy(xp, dir, 0, &info) < 0) {
1262 kfree_skb(skb);
1263 return NULL;
1264 }
1265
1266 return skb;
1267 }
1268
1269 static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1270 struct nlattr **attrs)
1271 {
1272 struct xfrm_policy *xp;
1273 struct xfrm_userpolicy_id *p;
1274 u8 type = XFRM_POLICY_TYPE_MAIN;
1275 int err;
1276 struct km_event c;
1277 int delete;
1278
1279 p = nlmsg_data(nlh);
1280 delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
1281
1282 err = copy_from_user_policy_type(&type, attrs);
1283 if (err)
1284 return err;
1285
1286 err = verify_policy_dir(p->dir);
1287 if (err)
1288 return err;
1289
1290 if (p->index)
1291 xp = xfrm_policy_byid(type, p->dir, p->index, delete, &err);
1292 else {
1293 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1294 struct xfrm_policy tmp;
1295
1296 err = verify_sec_ctx_len(attrs);
1297 if (err)
1298 return err;
1299
1300 memset(&tmp, 0, sizeof(struct xfrm_policy));
1301 if (rt) {
1302 struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1303
1304 if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
1305 return err;
1306 }
1307 xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
1308 delete, &err);
1309 security_xfrm_policy_free(&tmp);
1310 }
1311 if (xp == NULL)
1312 return -ENOENT;
1313
1314 if (!delete) {
1315 struct sk_buff *resp_skb;
1316
1317 resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
1318 if (IS_ERR(resp_skb)) {
1319 err = PTR_ERR(resp_skb);
1320 } else {
1321 err = nlmsg_unicast(xfrm_nl, resp_skb,
1322 NETLINK_CB(skb).pid);
1323 }
1324 } else {
1325 xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
1326 AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
1327
1328 if (err != 0)
1329 goto out;
1330
1331 c.data.byid = p->index;
1332 c.event = nlh->nlmsg_type;
1333 c.seq = nlh->nlmsg_seq;
1334 c.pid = nlh->nlmsg_pid;
1335 km_policy_notify(xp, p->dir, &c);
1336 }
1337
1338 out:
1339 xfrm_pol_put(xp);
1340 return err;
1341 }
1342
1343 static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1344 struct nlattr **attrs)
1345 {
1346 struct km_event c;
1347 struct xfrm_usersa_flush *p = nlmsg_data(nlh);
1348 struct xfrm_audit audit_info;
1349 int err;
1350
1351 audit_info.loginuid = NETLINK_CB(skb).loginuid;
1352 audit_info.secid = NETLINK_CB(skb).sid;
1353 err = xfrm_state_flush(p->proto, &audit_info);
1354 if (err)
1355 return err;
1356 c.data.proto = p->proto;
1357 c.event = nlh->nlmsg_type;
1358 c.seq = nlh->nlmsg_seq;
1359 c.pid = nlh->nlmsg_pid;
1360 km_state_notify(NULL, &c);
1361
1362 return 0;
1363 }
1364
1365 static inline size_t xfrm_aevent_msgsize(void)
1366 {
1367 return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
1368 + nla_total_size(sizeof(struct xfrm_replay_state))
1369 + nla_total_size(sizeof(struct xfrm_lifetime_cur))
1370 + nla_total_size(4) /* XFRM_AE_RTHR */
1371 + nla_total_size(4); /* XFRM_AE_ETHR */
1372 }
1373
1374 static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
1375 {
1376 struct xfrm_aevent_id *id;
1377 struct nlmsghdr *nlh;
1378
1379 nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
1380 if (nlh == NULL)
1381 return -EMSGSIZE;
1382
1383 id = nlmsg_data(nlh);
1384 memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
1385 id->sa_id.spi = x->id.spi;
1386 id->sa_id.family = x->props.family;
1387 id->sa_id.proto = x->id.proto;
1388 memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
1389 id->reqid = x->props.reqid;
1390 id->flags = c->data.aevent;
1391
1392 NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
1393 NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
1394
1395 if (id->flags & XFRM_AE_RTHR)
1396 NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
1397
1398 if (id->flags & XFRM_AE_ETHR)
1399 NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
1400 x->replay_maxage * 10 / HZ);
1401
1402 return nlmsg_end(skb, nlh);
1403
1404 nla_put_failure:
1405 nlmsg_cancel(skb, nlh);
1406 return -EMSGSIZE;
1407 }
1408
1409 static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1410 struct nlattr **attrs)
1411 {
1412 struct xfrm_state *x;
1413 struct sk_buff *r_skb;
1414 int err;
1415 struct km_event c;
1416 struct xfrm_aevent_id *p = nlmsg_data(nlh);
1417 struct xfrm_usersa_id *id = &p->sa_id;
1418
1419 r_skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
1420 if (r_skb == NULL)
1421 return -ENOMEM;
1422
1423 x = xfrm_state_lookup(&id->daddr, id->spi, id->proto, id->family);
1424 if (x == NULL) {
1425 kfree_skb(r_skb);
1426 return -ESRCH;
1427 }
1428
1429 /*
1430 * XXX: is this lock really needed - none of the other
1431 * gets lock (the concern is things getting updated
1432 * while we are still reading) - jhs
1433 */
1434 spin_lock_bh(&x->lock);
1435 c.data.aevent = p->flags;
1436 c.seq = nlh->nlmsg_seq;
1437 c.pid = nlh->nlmsg_pid;
1438
1439 if (build_aevent(r_skb, x, &c) < 0)
1440 BUG();
1441 err = nlmsg_unicast(xfrm_nl, r_skb, NETLINK_CB(skb).pid);
1442 spin_unlock_bh(&x->lock);
1443 xfrm_state_put(x);
1444 return err;
1445 }
1446
1447 static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
1448 struct nlattr **attrs)
1449 {
1450 struct xfrm_state *x;
1451 struct km_event c;
1452 int err = - EINVAL;
1453 struct xfrm_aevent_id *p = nlmsg_data(nlh);
1454 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
1455 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
1456
1457 if (!lt && !rp)
1458 return err;
1459
1460 /* pedantic mode - thou shalt sayeth replaceth */
1461 if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
1462 return err;
1463
1464 x = xfrm_state_lookup(&p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
1465 if (x == NULL)
1466 return -ESRCH;
1467
1468 if (x->km.state != XFRM_STATE_VALID)
1469 goto out;
1470
1471 spin_lock_bh(&x->lock);
1472 xfrm_update_ae_params(x, attrs);
1473 spin_unlock_bh(&x->lock);
1474
1475 c.event = nlh->nlmsg_type;
1476 c.seq = nlh->nlmsg_seq;
1477 c.pid = nlh->nlmsg_pid;
1478 c.data.aevent = XFRM_AE_CU;
1479 km_state_notify(x, &c);
1480 err = 0;
1481 out:
1482 xfrm_state_put(x);
1483 return err;
1484 }
1485
1486 static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1487 struct nlattr **attrs)
1488 {
1489 struct km_event c;
1490 u8 type = XFRM_POLICY_TYPE_MAIN;
1491 int err;
1492 struct xfrm_audit audit_info;
1493
1494 err = copy_from_user_policy_type(&type, attrs);
1495 if (err)
1496 return err;
1497
1498 audit_info.loginuid = NETLINK_CB(skb).loginuid;
1499 audit_info.secid = NETLINK_CB(skb).sid;
1500 err = xfrm_policy_flush(type, &audit_info);
1501 if (err)
1502 return err;
1503 c.data.type = type;
1504 c.event = nlh->nlmsg_type;
1505 c.seq = nlh->nlmsg_seq;
1506 c.pid = nlh->nlmsg_pid;
1507 km_policy_notify(NULL, 0, &c);
1508 return 0;
1509 }
1510
1511 static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1512 struct nlattr **attrs)
1513 {
1514 struct xfrm_policy *xp;
1515 struct xfrm_user_polexpire *up = nlmsg_data(nlh);
1516 struct xfrm_userpolicy_info *p = &up->pol;
1517 u8 type = XFRM_POLICY_TYPE_MAIN;
1518 int err = -ENOENT;
1519
1520 err = copy_from_user_policy_type(&type, attrs);
1521 if (err)
1522 return err;
1523
1524 if (p->index)
1525 xp = xfrm_policy_byid(type, p->dir, p->index, 0, &err);
1526 else {
1527 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1528 struct xfrm_policy tmp;
1529
1530 err = verify_sec_ctx_len(attrs);
1531 if (err)
1532 return err;
1533
1534 memset(&tmp, 0, sizeof(struct xfrm_policy));
1535 if (rt) {
1536 struct xfrm_user_sec_ctx *uctx = nla_data(rt);
1537
1538 if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
1539 return err;
1540 }
1541 xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
1542 0, &err);
1543 security_xfrm_policy_free(&tmp);
1544 }
1545
1546 if (xp == NULL)
1547 return -ENOENT;
1548 read_lock(&xp->lock);
1549 if (xp->dead) {
1550 read_unlock(&xp->lock);
1551 goto out;
1552 }
1553
1554 read_unlock(&xp->lock);
1555 err = 0;
1556 if (up->hard) {
1557 xfrm_policy_delete(xp, p->dir);
1558 xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
1559 AUDIT_MAC_IPSEC_DELSPD, 1, xp, NULL);
1560
1561 } else {
1562 // reset the timers here?
1563 printk("Dont know what to do with soft policy expire\n");
1564 }
1565 km_policy_expired(xp, p->dir, up->hard, current->pid);
1566
1567 out:
1568 xfrm_pol_put(xp);
1569 return err;
1570 }
1571
1572 static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
1573 struct nlattr **attrs)
1574 {
1575 struct xfrm_state *x;
1576 int err;
1577 struct xfrm_user_expire *ue = nlmsg_data(nlh);
1578 struct xfrm_usersa_info *p = &ue->state;
1579
1580 x = xfrm_state_lookup(&p->id.daddr, p->id.spi, p->id.proto, p->family);
1581
1582 err = -ENOENT;
1583 if (x == NULL)
1584 return err;
1585
1586 spin_lock_bh(&x->lock);
1587 err = -EINVAL;
1588 if (x->km.state != XFRM_STATE_VALID)
1589 goto out;
1590 km_state_expired(x, ue->hard, current->pid);
1591
1592 if (ue->hard) {
1593 __xfrm_state_delete(x);
1594 xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
1595 AUDIT_MAC_IPSEC_DELSA, 1, NULL, x);
1596 }
1597 err = 0;
1598 out:
1599 spin_unlock_bh(&x->lock);
1600 xfrm_state_put(x);
1601 return err;
1602 }
1603
1604 static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
1605 struct nlattr **attrs)
1606 {
1607 struct xfrm_policy *xp;
1608 struct xfrm_user_tmpl *ut;
1609 int i;
1610 struct nlattr *rt = attrs[XFRMA_TMPL];
1611
1612 struct xfrm_user_acquire *ua = nlmsg_data(nlh);
1613 struct xfrm_state *x = xfrm_state_alloc();
1614 int err = -ENOMEM;
1615
1616 if (!x)
1617 return err;
1618
1619 err = verify_newpolicy_info(&ua->policy);
1620 if (err) {
1621 printk("BAD policy passed\n");
1622 kfree(x);
1623 return err;
1624 }
1625
1626 /* build an XP */
1627 xp = xfrm_policy_construct(&ua->policy, attrs, &err);
1628 if (!xp) {
1629 kfree(x);
1630 return err;
1631 }
1632
1633 memcpy(&x->id, &ua->id, sizeof(ua->id));
1634 memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
1635 memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
1636
1637 ut = nla_data(rt);
1638 /* extract the templates and for each call km_key */
1639 for (i = 0; i < xp->xfrm_nr; i++, ut++) {
1640 struct xfrm_tmpl *t = &xp->xfrm_vec[i];
1641 memcpy(&x->id, &t->id, sizeof(x->id));
1642 x->props.mode = t->mode;
1643 x->props.reqid = t->reqid;
1644 x->props.family = ut->family;
1645 t->aalgos = ua->aalgos;
1646 t->ealgos = ua->ealgos;
1647 t->calgos = ua->calgos;
1648 err = km_query(x, t, xp);
1649
1650 }
1651
1652 kfree(x);
1653 kfree(xp);
1654
1655 return 0;
1656 }
1657
1658 #ifdef CONFIG_XFRM_MIGRATE
1659 static int copy_from_user_migrate(struct xfrm_migrate *ma,
1660 struct nlattr **attrs, int *num)
1661 {
1662 struct nlattr *rt = attrs[XFRMA_MIGRATE];
1663 struct xfrm_user_migrate *um;
1664 int i, num_migrate;
1665
1666 um = nla_data(rt);
1667 num_migrate = nla_len(rt) / sizeof(*um);
1668
1669 if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
1670 return -EINVAL;
1671
1672 for (i = 0; i < num_migrate; i++, um++, ma++) {
1673 memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
1674 memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
1675 memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
1676 memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
1677
1678 ma->proto = um->proto;
1679 ma->mode = um->mode;
1680 ma->reqid = um->reqid;
1681
1682 ma->old_family = um->old_family;
1683 ma->new_family = um->new_family;
1684 }
1685
1686 *num = i;
1687 return 0;
1688 }
1689
1690 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
1691 struct nlattr **attrs)
1692 {
1693 struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
1694 struct xfrm_migrate m[XFRM_MAX_DEPTH];
1695 u8 type;
1696 int err;
1697 int n = 0;
1698
1699 if (attrs[XFRMA_MIGRATE] == NULL)
1700 return -EINVAL;
1701
1702 err = copy_from_user_policy_type(&type, attrs);
1703 if (err)
1704 return err;
1705
1706 err = copy_from_user_migrate((struct xfrm_migrate *)m,
1707 attrs, &n);
1708 if (err)
1709 return err;
1710
1711 if (!n)
1712 return 0;
1713
1714 xfrm_migrate(&pi->sel, pi->dir, type, m, n);
1715
1716 return 0;
1717 }
1718 #else
1719 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
1720 struct nlattr **attrs)
1721 {
1722 return -ENOPROTOOPT;
1723 }
1724 #endif
1725
1726 #ifdef CONFIG_XFRM_MIGRATE
1727 static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb)
1728 {
1729 struct xfrm_user_migrate um;
1730
1731 memset(&um, 0, sizeof(um));
1732 um.proto = m->proto;
1733 um.mode = m->mode;
1734 um.reqid = m->reqid;
1735 um.old_family = m->old_family;
1736 memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
1737 memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
1738 um.new_family = m->new_family;
1739 memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
1740 memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
1741
1742 return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
1743 }
1744
1745 static inline size_t xfrm_migrate_msgsize(int num_migrate)
1746 {
1747 return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
1748 + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
1749 + userpolicy_type_attrsize();
1750 }
1751
1752 static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
1753 int num_migrate, struct xfrm_selector *sel,
1754 u8 dir, u8 type)
1755 {
1756 struct xfrm_migrate *mp;
1757 struct xfrm_userpolicy_id *pol_id;
1758 struct nlmsghdr *nlh;
1759 int i;
1760
1761 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
1762 if (nlh == NULL)
1763 return -EMSGSIZE;
1764
1765 pol_id = nlmsg_data(nlh);
1766 /* copy data from selector, dir, and type to the pol_id */
1767 memset(pol_id, 0, sizeof(*pol_id));
1768 memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
1769 pol_id->dir = dir;
1770
1771 if (copy_to_user_policy_type(type, skb) < 0)
1772 goto nlmsg_failure;
1773
1774 for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
1775 if (copy_to_user_migrate(mp, skb) < 0)
1776 goto nlmsg_failure;
1777 }
1778
1779 return nlmsg_end(skb, nlh);
1780 nlmsg_failure:
1781 nlmsg_cancel(skb, nlh);
1782 return -EMSGSIZE;
1783 }
1784
1785 static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1786 struct xfrm_migrate *m, int num_migrate)
1787 {
1788 struct sk_buff *skb;
1789
1790 skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate), GFP_ATOMIC);
1791 if (skb == NULL)
1792 return -ENOMEM;
1793
1794 /* build migrate */
1795 if (build_migrate(skb, m, num_migrate, sel, dir, type) < 0)
1796 BUG();
1797
1798 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
1799 }
1800 #else
1801 static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1802 struct xfrm_migrate *m, int num_migrate)
1803 {
1804 return -ENOPROTOOPT;
1805 }
1806 #endif
1807
1808 #define XMSGSIZE(type) sizeof(struct type)
1809
1810 static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
1811 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
1812 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
1813 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
1814 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
1815 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1816 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1817 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
1818 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
1819 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
1820 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
1821 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
1822 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
1823 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
1824 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
1825 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
1826 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
1827 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
1828 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1829 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
1830 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
1831 };
1832
1833 #undef XMSGSIZE
1834
1835 static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
1836 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
1837 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
1838 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
1839 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
1840 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
1841 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
1842 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
1843 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
1844 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
1845 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
1846 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
1847 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
1848 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
1849 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
1850 };
1851
1852 static struct xfrm_link {
1853 int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
1854 int (*dump)(struct sk_buff *, struct netlink_callback *);
1855 } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
1856 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
1857 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa },
1858 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
1859 .dump = xfrm_dump_sa },
1860 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
1861 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
1862 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
1863 .dump = xfrm_dump_policy },
1864 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
1865 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire },
1866 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
1867 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
1868 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
1869 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
1870 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa },
1871 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy },
1872 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae },
1873 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae },
1874 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate },
1875 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo },
1876 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo },
1877 };
1878
1879 static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
1880 {
1881 struct nlattr *attrs[XFRMA_MAX+1];
1882 struct xfrm_link *link;
1883 int type, err;
1884
1885 type = nlh->nlmsg_type;
1886 if (type > XFRM_MSG_MAX)
1887 return -EINVAL;
1888
1889 type -= XFRM_MSG_BASE;
1890 link = &xfrm_dispatch[type];
1891
1892 /* All operations require privileges, even GET */
1893 if (security_netlink_recv(skb, CAP_NET_ADMIN))
1894 return -EPERM;
1895
1896 if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
1897 type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
1898 (nlh->nlmsg_flags & NLM_F_DUMP)) {
1899 if (link->dump == NULL)
1900 return -EINVAL;
1901
1902 return netlink_dump_start(xfrm_nl, skb, nlh, link->dump, NULL);
1903 }
1904
1905 err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
1906 xfrma_policy);
1907 if (err < 0)
1908 return err;
1909
1910 if (link->doit == NULL)
1911 return -EINVAL;
1912
1913 return link->doit(skb, nlh, attrs);
1914 }
1915
1916 static void xfrm_netlink_rcv(struct sock *sk, int len)
1917 {
1918 unsigned int qlen = 0;
1919
1920 do {
1921 mutex_lock(&xfrm_cfg_mutex);
1922 netlink_run_queue(sk, &qlen, &xfrm_user_rcv_msg);
1923 mutex_unlock(&xfrm_cfg_mutex);
1924
1925 } while (qlen);
1926 }
1927
1928 static inline size_t xfrm_expire_msgsize(void)
1929 {
1930 return NLMSG_ALIGN(sizeof(struct xfrm_user_expire));
1931 }
1932
1933 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
1934 {
1935 struct xfrm_user_expire *ue;
1936 struct nlmsghdr *nlh;
1937
1938 nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
1939 if (nlh == NULL)
1940 return -EMSGSIZE;
1941
1942 ue = nlmsg_data(nlh);
1943 copy_to_user_state(x, &ue->state);
1944 ue->hard = (c->data.hard != 0) ? 1 : 0;
1945
1946 return nlmsg_end(skb, nlh);
1947 }
1948
1949 static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
1950 {
1951 struct sk_buff *skb;
1952
1953 skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
1954 if (skb == NULL)
1955 return -ENOMEM;
1956
1957 if (build_expire(skb, x, c) < 0)
1958 BUG();
1959
1960 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
1961 }
1962
1963 static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c)
1964 {
1965 struct sk_buff *skb;
1966
1967 skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
1968 if (skb == NULL)
1969 return -ENOMEM;
1970
1971 if (build_aevent(skb, x, c) < 0)
1972 BUG();
1973
1974 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
1975 }
1976
1977 static int xfrm_notify_sa_flush(struct km_event *c)
1978 {
1979 struct xfrm_usersa_flush *p;
1980 struct nlmsghdr *nlh;
1981 struct sk_buff *skb;
1982 int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
1983
1984 skb = nlmsg_new(len, GFP_ATOMIC);
1985 if (skb == NULL)
1986 return -ENOMEM;
1987
1988 nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
1989 if (nlh == NULL) {
1990 kfree_skb(skb);
1991 return -EMSGSIZE;
1992 }
1993
1994 p = nlmsg_data(nlh);
1995 p->proto = c->data.proto;
1996
1997 nlmsg_end(skb, nlh);
1998
1999 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2000 }
2001
2002 static inline size_t xfrm_sa_len(struct xfrm_state *x)
2003 {
2004 size_t l = 0;
2005 if (x->aalg)
2006 l += nla_total_size(alg_len(x->aalg));
2007 if (x->ealg)
2008 l += nla_total_size(alg_len(x->ealg));
2009 if (x->calg)
2010 l += nla_total_size(sizeof(*x->calg));
2011 if (x->encap)
2012 l += nla_total_size(sizeof(*x->encap));
2013
2014 return l;
2015 }
2016
2017 static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
2018 {
2019 struct xfrm_usersa_info *p;
2020 struct xfrm_usersa_id *id;
2021 struct nlmsghdr *nlh;
2022 struct sk_buff *skb;
2023 int len = xfrm_sa_len(x);
2024 int headlen;
2025
2026 headlen = sizeof(*p);
2027 if (c->event == XFRM_MSG_DELSA) {
2028 len += nla_total_size(headlen);
2029 headlen = sizeof(*id);
2030 }
2031 len += NLMSG_ALIGN(headlen);
2032
2033 skb = nlmsg_new(len, GFP_ATOMIC);
2034 if (skb == NULL)
2035 return -ENOMEM;
2036
2037 nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2038 if (nlh == NULL)
2039 goto nla_put_failure;
2040
2041 p = nlmsg_data(nlh);
2042 if (c->event == XFRM_MSG_DELSA) {
2043 struct nlattr *attr;
2044
2045 id = nlmsg_data(nlh);
2046 memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
2047 id->spi = x->id.spi;
2048 id->family = x->props.family;
2049 id->proto = x->id.proto;
2050
2051 attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
2052 if (attr == NULL)
2053 goto nla_put_failure;
2054
2055 p = nla_data(attr);
2056 }
2057
2058 copy_to_user_state(x, p);
2059
2060 if (x->aalg)
2061 NLA_PUT(skb, XFRMA_ALG_AUTH, alg_len(x->aalg), x->aalg);
2062 if (x->ealg)
2063 NLA_PUT(skb, XFRMA_ALG_CRYPT, alg_len(x->ealg), x->ealg);
2064 if (x->calg)
2065 NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
2066
2067 if (x->encap)
2068 NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
2069
2070 nlmsg_end(skb, nlh);
2071
2072 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
2073
2074 nla_put_failure:
2075 kfree_skb(skb);
2076 return -1;
2077 }
2078
2079 static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c)
2080 {
2081
2082 switch (c->event) {
2083 case XFRM_MSG_EXPIRE:
2084 return xfrm_exp_state_notify(x, c);
2085 case XFRM_MSG_NEWAE:
2086 return xfrm_aevent_state_notify(x, c);
2087 case XFRM_MSG_DELSA:
2088 case XFRM_MSG_UPDSA:
2089 case XFRM_MSG_NEWSA:
2090 return xfrm_notify_sa(x, c);
2091 case XFRM_MSG_FLUSHSA:
2092 return xfrm_notify_sa_flush(c);
2093 default:
2094 printk("xfrm_user: Unknown SA event %d\n", c->event);
2095 break;
2096 }
2097
2098 return 0;
2099
2100 }
2101
2102 static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
2103 struct xfrm_policy *xp)
2104 {
2105 return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
2106 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2107 + nla_total_size(xfrm_user_sec_ctx_size(x->security))
2108 + userpolicy_type_attrsize();
2109 }
2110
2111 static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
2112 struct xfrm_tmpl *xt, struct xfrm_policy *xp,
2113 int dir)
2114 {
2115 struct xfrm_user_acquire *ua;
2116 struct nlmsghdr *nlh;
2117 __u32 seq = xfrm_get_acqseq();
2118
2119 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
2120 if (nlh == NULL)
2121 return -EMSGSIZE;
2122
2123 ua = nlmsg_data(nlh);
2124 memcpy(&ua->id, &x->id, sizeof(ua->id));
2125 memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
2126 memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
2127 copy_to_user_policy(xp, &ua->policy, dir);
2128 ua->aalgos = xt->aalgos;
2129 ua->ealgos = xt->ealgos;
2130 ua->calgos = xt->calgos;
2131 ua->seq = x->km.seq = seq;
2132
2133 if (copy_to_user_tmpl(xp, skb) < 0)
2134 goto nlmsg_failure;
2135 if (copy_to_user_state_sec_ctx(x, skb))
2136 goto nlmsg_failure;
2137 if (copy_to_user_policy_type(xp->type, skb) < 0)
2138 goto nlmsg_failure;
2139
2140 return nlmsg_end(skb, nlh);
2141
2142 nlmsg_failure:
2143 nlmsg_cancel(skb, nlh);
2144 return -EMSGSIZE;
2145 }
2146
2147 static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
2148 struct xfrm_policy *xp, int dir)
2149 {
2150 struct sk_buff *skb;
2151
2152 skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
2153 if (skb == NULL)
2154 return -ENOMEM;
2155
2156 if (build_acquire(skb, x, xt, xp, dir) < 0)
2157 BUG();
2158
2159 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
2160 }
2161
2162 /* User gives us xfrm_user_policy_info followed by an array of 0
2163 * or more templates.
2164 */
2165 static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
2166 u8 *data, int len, int *dir)
2167 {
2168 struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
2169 struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
2170 struct xfrm_policy *xp;
2171 int nr;
2172
2173 switch (sk->sk_family) {
2174 case AF_INET:
2175 if (opt != IP_XFRM_POLICY) {
2176 *dir = -EOPNOTSUPP;
2177 return NULL;
2178 }
2179 break;
2180 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2181 case AF_INET6:
2182 if (opt != IPV6_XFRM_POLICY) {
2183 *dir = -EOPNOTSUPP;
2184 return NULL;
2185 }
2186 break;
2187 #endif
2188 default:
2189 *dir = -EINVAL;
2190 return NULL;
2191 }
2192
2193 *dir = -EINVAL;
2194
2195 if (len < sizeof(*p) ||
2196 verify_newpolicy_info(p))
2197 return NULL;
2198
2199 nr = ((len - sizeof(*p)) / sizeof(*ut));
2200 if (validate_tmpl(nr, ut, p->sel.family))
2201 return NULL;
2202
2203 if (p->dir > XFRM_POLICY_OUT)
2204 return NULL;
2205
2206 xp = xfrm_policy_alloc(GFP_KERNEL);
2207 if (xp == NULL) {
2208 *dir = -ENOBUFS;
2209 return NULL;
2210 }
2211
2212 copy_from_user_policy(xp, p);
2213 xp->type = XFRM_POLICY_TYPE_MAIN;
2214 copy_templates(xp, ut, nr);
2215
2216 *dir = p->dir;
2217
2218 return xp;
2219 }
2220
2221 static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
2222 {
2223 return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
2224 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2225 + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
2226 + userpolicy_type_attrsize();
2227 }
2228
2229 static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2230 int dir, struct km_event *c)
2231 {
2232 struct xfrm_user_polexpire *upe;
2233 struct nlmsghdr *nlh;
2234 int hard = c->data.hard;
2235
2236 nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
2237 if (nlh == NULL)
2238 return -EMSGSIZE;
2239
2240 upe = nlmsg_data(nlh);
2241 copy_to_user_policy(xp, &upe->pol, dir);
2242 if (copy_to_user_tmpl(xp, skb) < 0)
2243 goto nlmsg_failure;
2244 if (copy_to_user_sec_ctx(xp, skb))
2245 goto nlmsg_failure;
2246 if (copy_to_user_policy_type(xp->type, skb) < 0)
2247 goto nlmsg_failure;
2248 upe->hard = !!hard;
2249
2250 return nlmsg_end(skb, nlh);
2251
2252 nlmsg_failure:
2253 nlmsg_cancel(skb, nlh);
2254 return -EMSGSIZE;
2255 }
2256
2257 static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
2258 {
2259 struct sk_buff *skb;
2260
2261 skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
2262 if (skb == NULL)
2263 return -ENOMEM;
2264
2265 if (build_polexpire(skb, xp, dir, c) < 0)
2266 BUG();
2267
2268 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
2269 }
2270
2271 static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
2272 {
2273 struct xfrm_userpolicy_info *p;
2274 struct xfrm_userpolicy_id *id;
2275 struct nlmsghdr *nlh;
2276 struct sk_buff *skb;
2277 int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2278 int headlen;
2279
2280 headlen = sizeof(*p);
2281 if (c->event == XFRM_MSG_DELPOLICY) {
2282 len += nla_total_size(headlen);
2283 headlen = sizeof(*id);
2284 }
2285 len += userpolicy_type_attrsize();
2286 len += NLMSG_ALIGN(headlen);
2287
2288 skb = nlmsg_new(len, GFP_ATOMIC);
2289 if (skb == NULL)
2290 return -ENOMEM;
2291
2292 nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2293 if (nlh == NULL)
2294 goto nlmsg_failure;
2295
2296 p = nlmsg_data(nlh);
2297 if (c->event == XFRM_MSG_DELPOLICY) {
2298 struct nlattr *attr;
2299
2300 id = nlmsg_data(nlh);
2301 memset(id, 0, sizeof(*id));
2302 id->dir = dir;
2303 if (c->data.byid)
2304 id->index = xp->index;
2305 else
2306 memcpy(&id->sel, &xp->selector, sizeof(id->sel));
2307
2308 attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
2309 if (attr == NULL)
2310 goto nlmsg_failure;
2311
2312 p = nla_data(attr);
2313 }
2314
2315 copy_to_user_policy(xp, p, dir);
2316 if (copy_to_user_tmpl(xp, skb) < 0)
2317 goto nlmsg_failure;
2318 if (copy_to_user_policy_type(xp->type, skb) < 0)
2319 goto nlmsg_failure;
2320
2321 nlmsg_end(skb, nlh);
2322
2323 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2324
2325 nlmsg_failure:
2326 kfree_skb(skb);
2327 return -1;
2328 }
2329
2330 static int xfrm_notify_policy_flush(struct km_event *c)
2331 {
2332 struct nlmsghdr *nlh;
2333 struct sk_buff *skb;
2334
2335 skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
2336 if (skb == NULL)
2337 return -ENOMEM;
2338
2339 nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
2340 if (nlh == NULL)
2341 goto nlmsg_failure;
2342 if (copy_to_user_policy_type(c->data.type, skb) < 0)
2343 goto nlmsg_failure;
2344
2345 nlmsg_end(skb, nlh);
2346
2347 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
2348
2349 nlmsg_failure:
2350 kfree_skb(skb);
2351 return -1;
2352 }
2353
2354 static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
2355 {
2356
2357 switch (c->event) {
2358 case XFRM_MSG_NEWPOLICY:
2359 case XFRM_MSG_UPDPOLICY:
2360 case XFRM_MSG_DELPOLICY:
2361 return xfrm_notify_policy(xp, dir, c);
2362 case XFRM_MSG_FLUSHPOLICY:
2363 return xfrm_notify_policy_flush(c);
2364 case XFRM_MSG_POLEXPIRE:
2365 return xfrm_exp_policy_notify(xp, dir, c);
2366 default:
2367 printk("xfrm_user: Unknown Policy event %d\n", c->event);
2368 }
2369
2370 return 0;
2371
2372 }
2373
2374 static inline size_t xfrm_report_msgsize(void)
2375 {
2376 return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
2377 }
2378
2379 static int build_report(struct sk_buff *skb, u8 proto,
2380 struct xfrm_selector *sel, xfrm_address_t *addr)
2381 {
2382 struct xfrm_user_report *ur;
2383 struct nlmsghdr *nlh;
2384
2385 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
2386 if (nlh == NULL)
2387 return -EMSGSIZE;
2388
2389 ur = nlmsg_data(nlh);
2390 ur->proto = proto;
2391 memcpy(&ur->sel, sel, sizeof(ur->sel));
2392
2393 if (addr)
2394 NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
2395
2396 return nlmsg_end(skb, nlh);
2397
2398 nla_put_failure:
2399 nlmsg_cancel(skb, nlh);
2400 return -EMSGSIZE;
2401 }
2402
2403 static int xfrm_send_report(u8 proto, struct xfrm_selector *sel,
2404 xfrm_address_t *addr)
2405 {
2406 struct sk_buff *skb;
2407
2408 skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
2409 if (skb == NULL)
2410 return -ENOMEM;
2411
2412 if (build_report(skb, proto, sel, addr) < 0)
2413 BUG();
2414
2415 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
2416 }
2417
2418 static struct xfrm_mgr netlink_mgr = {
2419 .id = "netlink",
2420 .notify = xfrm_send_state_notify,
2421 .acquire = xfrm_send_acquire,
2422 .compile_policy = xfrm_compile_policy,
2423 .notify_policy = xfrm_send_policy_notify,
2424 .report = xfrm_send_report,
2425 .migrate = xfrm_send_migrate,
2426 };
2427
2428 static int __init xfrm_user_init(void)
2429 {
2430 struct sock *nlsk;
2431
2432 printk(KERN_INFO "Initializing XFRM netlink socket\n");
2433
2434 nlsk = netlink_kernel_create(NETLINK_XFRM, XFRMNLGRP_MAX,
2435 xfrm_netlink_rcv, NULL, THIS_MODULE);
2436 if (nlsk == NULL)
2437 return -ENOMEM;
2438 rcu_assign_pointer(xfrm_nl, nlsk);
2439
2440 xfrm_register_km(&netlink_mgr);
2441
2442 return 0;
2443 }
2444
2445 static void __exit xfrm_user_exit(void)
2446 {
2447 struct sock *nlsk = xfrm_nl;
2448
2449 xfrm_unregister_km(&netlink_mgr);
2450 rcu_assign_pointer(xfrm_nl, NULL);
2451 synchronize_rcu();
2452 sock_release(nlsk->sk_socket);
2453 }
2454
2455 module_init(xfrm_user_init);
2456 module_exit(xfrm_user_exit);
2457 MODULE_LICENSE("GPL");
2458 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
2459
Linux kernel - Deliverables
This page took 0.164922 seconds and 6 git commands to generate.