]> git.ipfire.org Git - thirdparty/linux.git/blame - net/xfrm/xfrm_user.c
projects / thirdparty / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branches 'clk-doc', 'clk-more-critical', 'clk-meson' and 'clk-basic-be' into...
[thirdparty/linux.git] / net / xfrm / xfrm_user.c
CommitLineData
1da177e4
LT		 1/* xfrm_user.c: User interface to configure xfrm engine.
2 *
3 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
4 *
5 * Changes:
6 * Mitsuru KANDA @USAGI
7 * Kazunori MIYAZAWA @USAGI
8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9 * IPv6 support
df71837d 10 *
1da177e4
LT		 11 */
12
9409f38a 13#include <linux/crypto.h>
1da177e4
LT		 14#include <linux/module.h>
15#include <linux/kernel.h>
16#include <linux/types.h>
17#include <linux/slab.h>
18#include <linux/socket.h>
19#include <linux/string.h>
20#include <linux/net.h>
21#include <linux/skbuff.h>
1da177e4
LT		 22#include <linux/pfkeyv2.h>
23#include <linux/ipsec.h>
24#include <linux/init.h>
25#include <linux/security.h>
26#include <net/sock.h>
27#include <net/xfrm.h>
88fc2c84 28#include <net/netlink.h>
fa6dd8a2 29#include <net/ah.h>
7c0f6ba6 30#include <linux/uaccess.h>
dfd56b8b 31#if IS_ENABLED(CONFIG_IPV6)
e23c7194
MN		 32#include <linux/in6.h>
33#endif
e33d4f13 34#include <asm/unaligned.h>
1da177e4 35
5424f32e 36static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
1da177e4 37{
5424f32e 38 struct nlattr *rt = attrs[type];
1da177e4
LT		 39 struct xfrm_algo *algp;
40
41 if (!rt)
42 return 0;
43
5424f32e 44 algp = nla_data(rt);
06cd22f8 45 if (nla_len(rt) < (int)xfrm_alg_len(algp))
31c26852
HX		 46 return -EINVAL;
47
1da177e4
LT		 48 switch (type) {
49 case XFRMA_ALG_AUTH:
1da177e4 50 case XFRMA_ALG_CRYPT:
1da177e4 51 case XFRMA_ALG_COMP:
1da177e4
LT		 52 break;
53
54 default:
55 return -EINVAL;
3ff50b79 56 }
1da177e4 57
633439f5 58 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
1da177e4
LT		 59 return 0;
60}
61
4447bb33
MW		 62static int verify_auth_trunc(struct nlattr **attrs)
63{
64 struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
65 struct xfrm_algo_auth *algp;
66
67 if (!rt)
68 return 0;
69
70 algp = nla_data(rt);
1bd963a7 71 if (nla_len(rt) < (int)xfrm_alg_auth_len(algp))
4447bb33
MW		 72 return -EINVAL;
73
633439f5 74 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
4447bb33
MW		 75 return 0;
76}
77
1a6509d9
HX		 78static int verify_aead(struct nlattr **attrs)
79{
80 struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
81 struct xfrm_algo_aead *algp;
82
83 if (!rt)
84 return 0;
85
86 algp = nla_data(rt);
373b8eeb 87 if (nla_len(rt) < (int)aead_len(algp))
1a6509d9
HX		 88 return -EINVAL;
89
633439f5 90 algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
1a6509d9
HX		 91 return 0;
92}
93
5424f32e 94static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
eb2971b6
MN		 95 xfrm_address_t **addrp)
96{
5424f32e 97 struct nlattr *rt = attrs[type];
eb2971b6 98
cf5cb79f 99 if (rt && addrp)
5424f32e 100 *addrp = nla_data(rt);
eb2971b6 101}
df71837d 102
5424f32e 103static inline int verify_sec_ctx_len(struct nlattr **attrs)
df71837d 104{
5424f32e 105 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
df71837d 106 struct xfrm_user_sec_ctx *uctx;
df71837d
TJ		 107
108 if (!rt)
109 return 0;
110
5424f32e 111 uctx = nla_data(rt);
cf5cb79f 112 if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
df71837d
TJ		 113 return -EINVAL;
114
115 return 0;
116}
117
d8647b79
SK		 118static inline int verify_replay(struct xfrm_usersa_info *p,
119 struct nlattr **attrs)
120{
121 struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
ecd79187 122 struct xfrm_replay_state_esn *rs;
d8647b79 123
d97ca5d7
FW		 124 if (!rt)
125 return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
ecd79187 126
d97ca5d7 127 rs = nla_data(rt);
ecd79187 128
d97ca5d7
FW		 129 if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
130 return -EINVAL;
7833aa05 131
d97ca5d7
FW		 132 if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
133 nla_len(rt) != sizeof(*rs))
134 return -EINVAL;
d8647b79 135
01714109
FD		 136 /* As only ESP and AH support ESN feature. */
137 if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))
02aadf72
SK		 138 return -EINVAL;
139
d8647b79
SK		 140 if (p->replay_window != 0)
141 return -EINVAL;
142
143 return 0;
144}
df71837d 145
1da177e4 146static int verify_newsa_info(struct xfrm_usersa_info *p,
5424f32e 147 struct nlattr **attrs)
1da177e4
LT		 148{
149 int err;
150
151 err = -EINVAL;
152 switch (p->family) {
153 case AF_INET:
07bf7908
SK		 154 if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
155 goto out;
156
1da177e4
LT		 157 break;
158
159 case AF_INET6:
dfd56b8b 160#if IS_ENABLED(CONFIG_IPV6)
07bf7908
SK		 161 if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
162 goto out;
163
1da177e4
LT		 164 break;
165#else
166 err = -EAFNOSUPPORT;
167 goto out;
168#endif
169
170 default:
171 goto out;
3ff50b79 172 }
1da177e4
LT		 173
174 err = -EINVAL;
175 switch (p->id.proto) {
176 case IPPROTO_AH:
4447bb33
MW		 177 if ((!attrs[XFRMA_ALG_AUTH] &&
178 !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
1a6509d9 179 attrs[XFRMA_ALG_AEAD] ||
35a7aa08 180 attrs[XFRMA_ALG_CRYPT] ||
35d2856b 181 attrs[XFRMA_ALG_COMP] ||
a0e5ef53 182 attrs[XFRMA_TFCPAD])
1da177e4
LT		 183 goto out;
184 break;
185
186 case IPPROTO_ESP:
1a6509d9
HX		 187 if (attrs[XFRMA_ALG_COMP])
188 goto out;
189 if (!attrs[XFRMA_ALG_AUTH] &&
4447bb33 190 !attrs[XFRMA_ALG_AUTH_TRUNC] &&
1a6509d9
HX		 191 !attrs[XFRMA_ALG_CRYPT] &&
192 !attrs[XFRMA_ALG_AEAD])
193 goto out;
194 if ((attrs[XFRMA_ALG_AUTH] ||
4447bb33 195 attrs[XFRMA_ALG_AUTH_TRUNC] ||
1a6509d9
HX		 196 attrs[XFRMA_ALG_CRYPT]) &&
197 attrs[XFRMA_ALG_AEAD])
1da177e4 198 goto out;
35d2856b
MW		 199 if (attrs[XFRMA_TFCPAD] &&
200 p->mode != XFRM_MODE_TUNNEL)
201 goto out;
1da177e4
LT		 202 break;
203
204 case IPPROTO_COMP:
35a7aa08 205 if (!attrs[XFRMA_ALG_COMP] ||
1a6509d9 206 attrs[XFRMA_ALG_AEAD] ||
35a7aa08 207 attrs[XFRMA_ALG_AUTH] ||
4447bb33 208 attrs[XFRMA_ALG_AUTH_TRUNC] ||
35d2856b 209 attrs[XFRMA_ALG_CRYPT] ||
a0e5ef53
TB		 210 attrs[XFRMA_TFCPAD] ||
211 (ntohl(p->id.spi) >= 0x10000))
1da177e4
LT		 212 goto out;
213 break;
214
dfd56b8b 215#if IS_ENABLED(CONFIG_IPV6)
e23c7194
MN		 216 case IPPROTO_DSTOPTS:
217 case IPPROTO_ROUTING:
35a7aa08
TG		 218 if (attrs[XFRMA_ALG_COMP] ||
219 attrs[XFRMA_ALG_AUTH] ||
4447bb33 220 attrs[XFRMA_ALG_AUTH_TRUNC] ||
1a6509d9 221 attrs[XFRMA_ALG_AEAD] ||
35a7aa08
TG		 222 attrs[XFRMA_ALG_CRYPT] ||
223 attrs[XFRMA_ENCAP] ||
224 attrs[XFRMA_SEC_CTX] ||
35d2856b 225 attrs[XFRMA_TFCPAD] ||
35a7aa08 226 !attrs[XFRMA_COADDR])
e23c7194
MN		 227 goto out;
228 break;
229#endif
230
1da177e4
LT		 231 default:
232 goto out;
3ff50b79 233 }
1da177e4 234
1a6509d9
HX		 235 if ((err = verify_aead(attrs)))
236 goto out;
4447bb33
MW		 237 if ((err = verify_auth_trunc(attrs)))
238 goto out;
35a7aa08 239 if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
1da177e4 240 goto out;
35a7aa08 241 if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
1da177e4 242 goto out;
35a7aa08 243 if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
1da177e4 244 goto out;
35a7aa08 245 if ((err = verify_sec_ctx_len(attrs)))
df71837d 246 goto out;
d8647b79
SK		 247 if ((err = verify_replay(p, attrs)))
248 goto out;
1da177e4
LT		 249
250 err = -EINVAL;
251 switch (p->mode) {
7e49e6de
MN		 252 case XFRM_MODE_TRANSPORT:
253 case XFRM_MODE_TUNNEL:
060f02a3 254 case XFRM_MODE_ROUTEOPTIMIZATION:
0a69452c 255 case XFRM_MODE_BEET:
1da177e4
LT		 256 break;
257
258 default:
259 goto out;
3ff50b79 260 }
1da177e4
LT		 261
262 err = 0;
263
264out:
265 return err;
266}
267
268static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
6f2f19ed 269 struct xfrm_algo_desc *(*get_byname)(const char *, int),
5424f32e 270 struct nlattr *rta)
1da177e4 271{
1da177e4
LT		 272 struct xfrm_algo *p, *ualg;
273 struct xfrm_algo_desc *algo;
274
275 if (!rta)
276 return 0;
277
5424f32e 278 ualg = nla_data(rta);
1da177e4
LT		 279
280 algo = get_byname(ualg->alg_name, 1);
281 if (!algo)
282 return -ENOSYS;
283 *props = algo->desc.sadb_alg_id;
284
0f99be0d 285 p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
1da177e4
LT		 286 if (!p)
287 return -ENOMEM;
288
04ff1260 289 strcpy(p->alg_name, algo->name);
1da177e4
LT		 290 *algpp = p;
291 return 0;
292}
293
69b0137f
HX		 294static int attach_crypt(struct xfrm_state *x, struct nlattr *rta)
295{
296 struct xfrm_algo *p, *ualg;
297 struct xfrm_algo_desc *algo;
298
299 if (!rta)
300 return 0;
301
302 ualg = nla_data(rta);
303
304 algo = xfrm_ealg_get_byname(ualg->alg_name, 1);
305 if (!algo)
306 return -ENOSYS;
307 x->props.ealgo = algo->desc.sadb_alg_id;
308
309 p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
310 if (!p)
311 return -ENOMEM;
312
313 strcpy(p->alg_name, algo->name);
314 x->ealg = p;
315 x->geniv = algo->uinfo.encr.geniv;
316 return 0;
317}
318
4447bb33
MW		 319static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
320 struct nlattr *rta)
321{
322 struct xfrm_algo *ualg;
323 struct xfrm_algo_auth *p;
324 struct xfrm_algo_desc *algo;
325
326 if (!rta)
327 return 0;
328
329 ualg = nla_data(rta);
330
331 algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
332 if (!algo)
333 return -ENOSYS;
334 *props = algo->desc.sadb_alg_id;
335
336 p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
337 if (!p)
338 return -ENOMEM;
339
340 strcpy(p->alg_name, algo->name);
341 p->alg_key_len = ualg->alg_key_len;
342 p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
343 memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
344
345 *algpp = p;
346 return 0;
347}
348
349static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
350 struct nlattr *rta)
351{
352 struct xfrm_algo_auth *p, *ualg;
353 struct xfrm_algo_desc *algo;
354
355 if (!rta)
356 return 0;
357
358 ualg = nla_data(rta);
359
360 algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
361 if (!algo)
362 return -ENOSYS;
689f1c9d 363 if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
4447bb33
MW		 364 return -EINVAL;
365 *props = algo->desc.sadb_alg_id;
366
367 p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
368 if (!p)
369 return -ENOMEM;
370
371 strcpy(p->alg_name, algo->name);
372 if (!p->alg_trunc_len)
373 p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
374
375 *algpp = p;
376 return 0;
377}
378
69b0137f 379static int attach_aead(struct xfrm_state *x, struct nlattr *rta)
1a6509d9
HX		 380{
381 struct xfrm_algo_aead *p, *ualg;
382 struct xfrm_algo_desc *algo;
383
384 if (!rta)
385 return 0;
386
387 ualg = nla_data(rta);
388
389 algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
390 if (!algo)
391 return -ENOSYS;
69b0137f 392 x->props.ealgo = algo->desc.sadb_alg_id;
1a6509d9
HX		 393
394 p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
395 if (!p)
396 return -ENOMEM;
397
398 strcpy(p->alg_name, algo->name);
69b0137f
HX		 399 x->aead = p;
400 x->geniv = algo->uinfo.aead.geniv;
1a6509d9
HX		 401 return 0;
402}
403
e2b19125
SK		 404static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
405 struct nlattr *rp)
406{
407 struct xfrm_replay_state_esn *up;
5e708e47 408 unsigned int ulen;
e2b19125
SK		 409
410 if (!replay_esn || !rp)
411 return 0;
412
413 up = nla_data(rp);
ecd79187 414 ulen = xfrm_replay_state_esn_len(up);
e2b19125 415
f843ee6d
AW		 416 /* Check the overall length and the internal bitmap length to avoid
417 * potential overflow. */
5e708e47 418 if (nla_len(rp) < (int)ulen ||
f843ee6d
AW		 419 xfrm_replay_state_esn_len(replay_esn) != ulen ||
420 replay_esn->bmp_len != up->bmp_len)
e2b19125
SK		 421 return -EINVAL;
422
677e806d
AW		 423 if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
424 return -EINVAL;
425
e2b19125
SK		 426 return 0;
427}
428
d8647b79
SK		 429static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
430 struct xfrm_replay_state_esn **preplay_esn,
431 struct nlattr *rta)
432{
433 struct xfrm_replay_state_esn *p, *pp, *up;
5e708e47 434 unsigned int klen, ulen;
d8647b79
SK		 435
436 if (!rta)
437 return 0;
438
439 up = nla_data(rta);
ecd79187 440 klen = xfrm_replay_state_esn_len(up);
5e708e47 441 ulen = nla_len(rta) >= (int)klen ? klen : sizeof(*up);
d8647b79 442
ecd79187 443 p = kzalloc(klen, GFP_KERNEL);
d8647b79
SK		 444 if (!p)
445 return -ENOMEM;
446
ecd79187 447 pp = kzalloc(klen, GFP_KERNEL);
d8647b79
SK		 448 if (!pp) {
449 kfree(p);
450 return -ENOMEM;
451 }
452
ecd79187
MK		 453 memcpy(p, up, ulen);
454 memcpy(pp, up, ulen);
455
d8647b79
SK		 456 *replay_esn = p;
457 *preplay_esn = pp;
458
459 return 0;
460}
461
a1b831f2 462static inline unsigned int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
df71837d 463{
a1b831f2 464 unsigned int len = 0;
df71837d
TJ		 465
466 if (xfrm_ctx) {
467 len += sizeof(struct xfrm_user_sec_ctx);
468 len += xfrm_ctx->ctx_len;
469 }
470 return len;
471}
472
1da177e4
LT		 473static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
474{
475 memcpy(&x->id, &p->id, sizeof(x->id));
476 memcpy(&x->sel, &p->sel, sizeof(x->sel));
477 memcpy(&x->lft, &p->lft, sizeof(x->lft));
478 x->props.mode = p->mode;
33fce60d
FD		 479 x->props.replay_window = min_t(unsigned int, p->replay_window,
480 sizeof(x->replay.bitmap) * 8);
1da177e4
LT		 481 x->props.reqid = p->reqid;
482 x->props.family = p->family;
54489c14 483 memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
1da177e4 484 x->props.flags = p->flags;
196b0036 485
ccf9b3b8 486 if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
196b0036 487 x->sel.family = p->family;
1da177e4
LT		 488}
489
d51d081d
JHS		 490/*
491 * someday when pfkey also has support, we could have the code
492 * somehow made shareable and move it to xfrm_state.c - JHS
493 *
494*/
e3ac104d
MK		 495static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
496 int update_esn)
d51d081d 497{
5424f32e 498 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
e3ac104d 499 struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
5424f32e
TG		 500 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
501 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
502 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
d51d081d 503
d8647b79
SK		 504 if (re) {
505 struct xfrm_replay_state_esn *replay_esn;
506 replay_esn = nla_data(re);
507 memcpy(x->replay_esn, replay_esn,
508 xfrm_replay_state_esn_len(replay_esn));
509 memcpy(x->preplay_esn, replay_esn,
510 xfrm_replay_state_esn_len(replay_esn));
511 }
512
d51d081d
JHS		 513 if (rp) {
514 struct xfrm_replay_state *replay;
5424f32e 515 replay = nla_data(rp);
d51d081d
JHS		 516 memcpy(&x->replay, replay, sizeof(*replay));
517 memcpy(&x->preplay, replay, sizeof(*replay));
518 }
519
520 if (lt) {
521 struct xfrm_lifetime_cur *ltime;
5424f32e 522 ltime = nla_data(lt);
d51d081d
JHS		 523 x->curlft.bytes = ltime->bytes;
524 x->curlft.packets = ltime->packets;
525 x->curlft.add_time = ltime->add_time;
526 x->curlft.use_time = ltime->use_time;
527 }
528
cf5cb79f 529 if (et)
5424f32e 530 x->replay_maxage = nla_get_u32(et);
d51d081d 531
cf5cb79f 532 if (rt)
5424f32e 533 x->replay_maxdiff = nla_get_u32(rt);
d51d081d
JHS		 534}
535
9b42c1f1
SK		 536static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
537{
538 if (attrs[XFRMA_SET_MARK]) {
539 m->v = nla_get_u32(attrs[XFRMA_SET_MARK]);
540 if (attrs[XFRMA_SET_MARK_MASK])
541 m->m = nla_get_u32(attrs[XFRMA_SET_MARK_MASK]);
542 else
543 m->m = 0xffffffff;
544 } else {
545 m->v = m->m = 0;
546 }
547}
548
fc34acd3
AD		 549static struct xfrm_state *xfrm_state_construct(struct net *net,
550 struct xfrm_usersa_info *p,
5424f32e 551 struct nlattr **attrs,
1da177e4
LT		 552 int *errp)
553{
fc34acd3 554 struct xfrm_state *x = xfrm_state_alloc(net);
1da177e4
LT		 555 int err = -ENOMEM;
556
557 if (!x)
558 goto error_no_put;
559
560 copy_from_user_state(x, p);
561
a947b0a9
ND		 562 if (attrs[XFRMA_SA_EXTRA_FLAGS])
563 x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
564
69b0137f 565 if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD])))
1a6509d9 566 goto error;
4447bb33
MW		 567 if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
568 attrs[XFRMA_ALG_AUTH_TRUNC])))
1da177e4 569 goto error;
4447bb33
MW		 570 if (!x->props.aalgo) {
571 if ((err = attach_auth(&x->aalg, &x->props.aalgo,
572 attrs[XFRMA_ALG_AUTH])))
573 goto error;
574 }
69b0137f 575 if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT])))
1da177e4
LT		 576 goto error;
577 if ((err = attach_one_algo(&x->calg, &x->props.calgo,
578 xfrm_calg_get_byname,
35a7aa08 579 attrs[XFRMA_ALG_COMP])))
1da177e4 580 goto error;
fd21150a
TG		 581
582 if (attrs[XFRMA_ENCAP]) {
583 x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
584 sizeof(*x->encap), GFP_KERNEL);
585 if (x->encap == NULL)
586 goto error;
587 }
588
35d2856b
MW		 589 if (attrs[XFRMA_TFCPAD])
590 x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
591
fd21150a
TG		 592 if (attrs[XFRMA_COADDR]) {
593 x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
594 sizeof(*x->coaddr), GFP_KERNEL);
595 if (x->coaddr == NULL)
596 goto error;
597 }
598
6f26b61e
JHS		 599 xfrm_mark_get(attrs, &x->mark);
600
9b42c1f1 601 xfrm_smark_init(attrs, &x->props.smark);
077fbac4 602
7e652640
SK		 603 if (attrs[XFRMA_IF_ID])
604 x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
077fbac4 605
ffdb5211 606 err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]);
1da177e4
LT		 607 if (err)
608 goto error;
609
2f30ea50
MK		 610 if (attrs[XFRMA_SEC_CTX]) {
611 err = security_xfrm_state_alloc(x,
612 nla_data(attrs[XFRMA_SEC_CTX]));
613 if (err)
614 goto error;
615 }
df71837d 616
d8647b79
SK		 617 if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
618 attrs[XFRMA_REPLAY_ESN_VAL])))
619 goto error;
620
1da177e4 621 x->km.seq = p->seq;
b27aeadb 622 x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
d51d081d 623 /* sysctl_xfrm_aevent_etime is in 100ms units */
b27aeadb 624 x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
d51d081d 625
9fdc4883
SK		 626 if ((err = xfrm_init_replay(x)))
627 goto error;
d51d081d 628
9fdc4883 629 /* override default values from above */
e3ac104d 630 xfrm_update_ae_params(x, attrs, 0);
1da177e4 631
cc01572e
YK		 632 /* configure the hardware if offload is requested */
633 if (attrs[XFRMA_OFFLOAD_DEV]) {
634 err = xfrm_dev_state_add(net, x,
635 nla_data(attrs[XFRMA_OFFLOAD_DEV]));
636 if (err)
637 goto error;
638 }
639
1da177e4
LT		 640 return x;
641
642error:
643 x->km.state = XFRM_STATE_DEAD;
644 xfrm_state_put(x);
645error_no_put:
646 *errp = err;
647 return NULL;
648}
649
22e70050 650static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 651 struct nlattr **attrs)
1da177e4 652{
fc34acd3 653 struct net *net = sock_net(skb->sk);
7b67c857 654 struct xfrm_usersa_info *p = nlmsg_data(nlh);
1da177e4
LT		 655 struct xfrm_state *x;
656 int err;
26b15dad 657 struct km_event c;
1da177e4 658
35a7aa08 659 err = verify_newsa_info(p, attrs);
1da177e4
LT		 660 if (err)
661 return err;
662
fc34acd3 663 x = xfrm_state_construct(net, p, attrs, &err);
1da177e4
LT		 664 if (!x)
665 return err;
666
26b15dad 667 xfrm_state_hold(x);
1da177e4
LT		 668 if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
669 err = xfrm_state_add(x);
670 else
671 err = xfrm_state_update(x);
672
2e71029e 673 xfrm_audit_state_add(x, err ? 0 : 1, true);
161a09e7 674
1da177e4
LT		 675 if (err < 0) {
676 x->km.state = XFRM_STATE_DEAD;
c5d4d7d8 677 xfrm_dev_state_delete(x);
21380b81 678 __xfrm_state_put(x);
7d6dfe1f 679 goto out;
1da177e4
LT		 680 }
681
cc01572e
YK		 682 if (x->km.state == XFRM_STATE_VOID)
683 x->km.state = XFRM_STATE_VALID;
684
26b15dad 685 c.seq = nlh->nlmsg_seq;
15e47304 686 c.portid = nlh->nlmsg_pid;
f60f6b8f 687 c.event = nlh->nlmsg_type;
26b15dad
JHS		 688
689 km_state_notify(x, &c);
7d6dfe1f 690out:
26b15dad 691 xfrm_state_put(x);
1da177e4
LT		 692 return err;
693}
694
fc34acd3
AD		 695static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
696 struct xfrm_usersa_id *p,
5424f32e 697 struct nlattr **attrs,
eb2971b6
MN		 698 int *errp)
699{
700 struct xfrm_state *x = NULL;
6f26b61e 701 struct xfrm_mark m;
eb2971b6 702 int err;
6f26b61e 703 u32 mark = xfrm_mark_get(attrs, &m);
eb2971b6
MN		 704
705 if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
706 err = -ESRCH;
6f26b61e 707 x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
eb2971b6
MN		 708 } else {
709 xfrm_address_t *saddr = NULL;
710
35a7aa08 711 verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
eb2971b6
MN		 712 if (!saddr) {
713 err = -EINVAL;
714 goto out;
715 }
716
9abbffee 717 err = -ESRCH;
6f26b61e
JHS		 718 x = xfrm_state_lookup_byaddr(net, mark,
719 &p->daddr, saddr,
221df1ed 720 p->proto, p->family);
eb2971b6
MN		 721 }
722
723 out:
724 if (!x && errp)
725 *errp = err;
726 return x;
727}
728
22e70050 729static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 730 struct nlattr **attrs)
1da177e4 731{
fc34acd3 732 struct net *net = sock_net(skb->sk);
1da177e4 733 struct xfrm_state *x;
eb2971b6 734 int err = -ESRCH;
26b15dad 735 struct km_event c;
7b67c857 736 struct xfrm_usersa_id *p = nlmsg_data(nlh);
1da177e4 737
fc34acd3 738 x = xfrm_user_state_lookup(net, p, attrs, &err);
1da177e4 739 if (x == NULL)
eb2971b6 740 return err;
1da177e4 741
6f68dc37 742 if ((err = security_xfrm_state_delete(x)) != 0)
c8c05a8e
CZ		 743 goto out;
744
1da177e4 745 if (xfrm_state_kern(x)) {
c8c05a8e
CZ		 746 err = -EPERM;
747 goto out;
1da177e4
LT		 748 }
749
26b15dad 750 err = xfrm_state_delete(x);
161a09e7 751
c8c05a8e
CZ		 752 if (err < 0)
753 goto out;
26b15dad
JHS		 754
755 c.seq = nlh->nlmsg_seq;
15e47304 756 c.portid = nlh->nlmsg_pid;
f60f6b8f 757 c.event = nlh->nlmsg_type;
26b15dad 758 km_state_notify(x, &c);
1da177e4 759
c8c05a8e 760out:
2e71029e 761 xfrm_audit_state_delete(x, err ? 0 : 1, true);
c8c05a8e 762 xfrm_state_put(x);
26b15dad 763 return err;
1da177e4
LT		 764}
765
766static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
767{
f778a636 768 memset(p, 0, sizeof(*p));
1da177e4
LT		 769 memcpy(&p->id, &x->id, sizeof(p->id));
770 memcpy(&p->sel, &x->sel, sizeof(p->sel));
771 memcpy(&p->lft, &x->lft, sizeof(p->lft));
772 memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
e33d4f13
SV		 773 put_unaligned(x->stats.replay_window, &p->stats.replay_window);
774 put_unaligned(x->stats.replay, &p->stats.replay);
775 put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed);
54489c14 776 memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
1da177e4
LT		 777 p->mode = x->props.mode;
778 p->replay_window = x->props.replay_window;
779 p->reqid = x->props.reqid;
780 p->family = x->props.family;
781 p->flags = x->props.flags;
782 p->seq = x->km.seq;
783}
784
785struct xfrm_dump_info {
786 struct sk_buff *in_skb;
787 struct sk_buff *out_skb;
788 u32 nlmsg_seq;
789 u16 nlmsg_flags;
1da177e4
LT		 790};
791
c0144bea
TG		 792static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
793{
c0144bea
TG		 794 struct xfrm_user_sec_ctx *uctx;
795 struct nlattr *attr;
68325d3b 796 int ctx_size = sizeof(*uctx) + s->ctx_len;
c0144bea
TG		 797
798 attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
799 if (attr == NULL)
800 return -EMSGSIZE;
801
802 uctx = nla_data(attr);
803 uctx->exttype = XFRMA_SEC_CTX;
804 uctx->len = ctx_size;
805 uctx->ctx_doi = s->ctx_doi;
806 uctx->ctx_alg = s->ctx_alg;
807 uctx->ctx_len = s->ctx_len;
808 memcpy(uctx + 1, s->ctx_str, s->ctx_len);
809
810 return 0;
811}
812
d77e38e6
SK		 813static int copy_user_offload(struct xfrm_state_offload *xso, struct sk_buff *skb)
814{
815 struct xfrm_user_offload *xuo;
816 struct nlattr *attr;
817
818 attr = nla_reserve(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo));
819 if (attr == NULL)
820 return -EMSGSIZE;
821
822 xuo = nla_data(attr);
5fe0d4bd 823 memset(xuo, 0, sizeof(*xuo));
d77e38e6
SK		 824 xuo->ifindex = xso->dev->ifindex;
825 xuo->flags = xso->flags;
826
827 return 0;
828}
829
4447bb33
MW		 830static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
831{
832 struct xfrm_algo *algo;
833 struct nlattr *nla;
834
835 nla = nla_reserve(skb, XFRMA_ALG_AUTH,
836 sizeof(*algo) + (auth->alg_key_len + 7) / 8);
837 if (!nla)
838 return -EMSGSIZE;
839
840 algo = nla_data(nla);
4c87308b 841 strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
4447bb33
MW		 842 memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
843 algo->alg_key_len = auth->alg_key_len;
844
845 return 0;
846}
847
9b42c1f1
SK		 848static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m)
849{
850 int ret = 0;
851
852 if (m->v | m->m) {
853 ret = nla_put_u32(skb, XFRMA_SET_MARK, m->v);
854 if (!ret)
855 ret = nla_put_u32(skb, XFRMA_SET_MARK_MASK, m->m);
856 }
857 return ret;
858}
859
68325d3b
HX		 860/* Don't change this without updating xfrm_sa_len! */
861static int copy_to_user_state_extra(struct xfrm_state *x,
862 struct xfrm_usersa_info *p,
863 struct sk_buff *skb)
1da177e4 864{
1d1e34dd 865 int ret = 0;
d0fde795 866
1d1e34dd 867 copy_to_user_state(x, p);
68325d3b 868
a947b0a9
ND		 869 if (x->props.extra_flags) {
870 ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS,
871 x->props.extra_flags);
872 if (ret)
873 goto out;
874 }
875
1d1e34dd
DM		 876 if (x->coaddr) {
877 ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
878 if (ret)
879 goto out;
880 }
881 if (x->lastused) {
de95c4a4
ND		 882 ret = nla_put_u64_64bit(skb, XFRMA_LASTUSED, x->lastused,
883 XFRMA_PAD);
1d1e34dd
DM		 884 if (ret)
885 goto out;
886 }
887 if (x->aead) {
888 ret = nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
889 if (ret)
890 goto out;
891 }
892 if (x->aalg) {
893 ret = copy_to_user_auth(x->aalg, skb);
894 if (!ret)
895 ret = nla_put(skb, XFRMA_ALG_AUTH_TRUNC,
896 xfrm_alg_auth_len(x->aalg), x->aalg);
897 if (ret)
898 goto out;
899 }
900 if (x->ealg) {
901 ret = nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
902 if (ret)
903 goto out;
904 }
905 if (x->calg) {
906 ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
907 if (ret)
908 goto out;
909 }
910 if (x->encap) {
911 ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
912 if (ret)
913 goto out;
914 }
915 if (x->tfcpad) {
916 ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad);
917 if (ret)
918 goto out;
919 }
920 ret = xfrm_mark_put(skb, &x->mark);
921 if (ret)
922 goto out;
9b42c1f1
SK		 923
924 ret = xfrm_smark_put(skb, &x->props.smark);
925 if (ret)
926 goto out;
927
f293a5e3 928 if (x->replay_esn)
1d1e34dd
DM		 929 ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
930 xfrm_replay_state_esn_len(x->replay_esn),
931 x->replay_esn);
f293a5e3 932 else
933 ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
934 &x->replay);
935 if (ret)
936 goto out;
d77e38e6
SK		 937 if(x->xso.dev)
938 ret = copy_user_offload(&x->xso, skb);
939 if (ret)
940 goto out;
7e652640
SK		 941 if (x->if_id) {
942 ret = nla_put_u32(skb, XFRMA_IF_ID, x->if_id);
077fbac4
LC		 943 if (ret)
944 goto out;
945 }
8598112d
SK		 946 if (x->security)
947 ret = copy_sec_ctx(x->security, skb);
1d1e34dd
DM		 948out:
949 return ret;
68325d3b
HX		 950}
951
952static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
953{
954 struct xfrm_dump_info *sp = ptr;
955 struct sk_buff *in_skb = sp->in_skb;
956 struct sk_buff *skb = sp->out_skb;
957 struct xfrm_usersa_info *p;
958 struct nlmsghdr *nlh;
959 int err;
960
15e47304 961 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
68325d3b
HX		 962 XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
963 if (nlh == NULL)
964 return -EMSGSIZE;
965
966 p = nlmsg_data(nlh);
967
968 err = copy_to_user_state_extra(x, p, skb);
1d1e34dd
DM		 969 if (err) {
970 nlmsg_cancel(skb, nlh);
971 return err;
972 }
9825069d 973 nlmsg_end(skb, nlh);
1da177e4 974 return 0;
1da177e4
LT		 975}
976
4c563f76
TT		 977static int xfrm_dump_sa_done(struct netlink_callback *cb)
978{
979 struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
283bc9f3
FD		 980 struct sock *sk = cb->skb->sk;
981 struct net *net = sock_net(sk);
982
1ba5bf99
VN		 983 if (cb->args[0])
984 xfrm_state_walk_done(walk, net);
4c563f76
TT		 985 return 0;
986}
987
d3623099 988static const struct nla_policy xfrma_policy[XFRMA_MAX+1];
1da177e4
LT		 989static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
990{
fc34acd3 991 struct net *net = sock_net(skb->sk);
4c563f76 992 struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
1da177e4
LT		 993 struct xfrm_dump_info info;
994
4c563f76
TT		 995 BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
996 sizeof(cb->args) - sizeof(cb->args[0]));
997
1da177e4
LT		 998 info.in_skb = cb->skb;
999 info.out_skb = skb;
1000 info.nlmsg_seq = cb->nlh->nlmsg_seq;
1001 info.nlmsg_flags = NLM_F_MULTI;
4c563f76
TT		 1002
1003 if (!cb->args[0]) {
d3623099 1004 struct nlattr *attrs[XFRMA_MAX+1];
870a2df4 1005 struct xfrm_address_filter *filter = NULL;
d3623099
ND		 1006 u8 proto = 0;
1007 int err;
1008
fceb6435 1009 err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX, xfrma_policy,
dac9c979 1010 cb->extack);
d3623099
ND		 1011 if (err < 0)
1012 return err;
1013
870a2df4 1014 if (attrs[XFRMA_ADDRESS_FILTER]) {
df367561
AH		 1015 filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
1016 sizeof(*filter), GFP_KERNEL);
d3623099
ND		 1017 if (filter == NULL)
1018 return -ENOMEM;
d3623099
ND		 1019 }
1020
1021 if (attrs[XFRMA_PROTO])
1022 proto = nla_get_u8(attrs[XFRMA_PROTO]);
1023
1024 xfrm_state_walk_init(walk, proto, filter);
1ba5bf99 1025 cb->args[0] = 1;
4c563f76
TT		 1026 }
1027
fc34acd3 1028 (void) xfrm_state_walk(net, walk, dump_one_state, &info);
1da177e4
LT		 1029
1030 return skb->len;
1031}
1032
1033static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
1034 struct xfrm_state *x, u32 seq)
1035{
1036 struct xfrm_dump_info info;
1037 struct sk_buff *skb;
864745d2 1038 int err;
1da177e4 1039
7deb2264 1040 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1da177e4
LT		 1041 if (!skb)
1042 return ERR_PTR(-ENOMEM);
1043
1da177e4
LT		 1044 info.in_skb = in_skb;
1045 info.out_skb = skb;
1046 info.nlmsg_seq = seq;
1047 info.nlmsg_flags = 0;
1da177e4 1048
864745d2
MK		 1049 err = dump_one_state(x, 0, &info);
1050 if (err) {
1da177e4 1051 kfree_skb(skb);
864745d2 1052 return ERR_PTR(err);
1da177e4
LT		 1053 }
1054
1055 return skb;
1056}
1057
21ee543e
MK		 1058/* A wrapper for nlmsg_multicast() checking that nlsk is still available.
1059 * Must be called with RCU read lock.
1060 */
1061static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
1062 u32 pid, unsigned int group)
1063{
1064 struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
1065
86126b77
FW		 1066 if (!nlsk) {
1067 kfree_skb(skb);
1068 return -EPIPE;
1069 }
1070
1071 return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
21ee543e
MK		 1072}
1073
a1b831f2 1074static inline unsigned int xfrm_spdinfo_msgsize(void)
7deb2264
TG		 1075{
1076 return NLMSG_ALIGN(4)
1077 + nla_total_size(sizeof(struct xfrmu_spdinfo))
880a6fab
CG		 1078 + nla_total_size(sizeof(struct xfrmu_spdhinfo))
1079 + nla_total_size(sizeof(struct xfrmu_spdhthresh))
1080 + nla_total_size(sizeof(struct xfrmu_spdhthresh));
7deb2264
TG		 1081}
1082
e071041b 1083static int build_spdinfo(struct sk_buff *skb, struct net *net,
15e47304 1084 u32 portid, u32 seq, u32 flags)
ecfd6b18 1085{
5a6d3416
JHS		 1086 struct xfrmk_spdinfo si;
1087 struct xfrmu_spdinfo spc;
1088 struct xfrmu_spdhinfo sph;
880a6fab 1089 struct xfrmu_spdhthresh spt4, spt6;
ecfd6b18 1090 struct nlmsghdr *nlh;
1d1e34dd 1091 int err;
ecfd6b18 1092 u32 *f;
880a6fab 1093 unsigned lseq;
ecfd6b18 1094
15e47304 1095 nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
25985edc 1096 if (nlh == NULL) /* shouldn't really happen ... */
ecfd6b18
JHS		 1097 return -EMSGSIZE;
1098
1099 f = nlmsg_data(nlh);
1100 *f = flags;
e071041b 1101 xfrm_spd_getinfo(net, &si);
5a6d3416
JHS		 1102 spc.incnt = si.incnt;
1103 spc.outcnt = si.outcnt;
1104 spc.fwdcnt = si.fwdcnt;
1105 spc.inscnt = si.inscnt;
1106 spc.outscnt = si.outscnt;
1107 spc.fwdscnt = si.fwdscnt;
1108 sph.spdhcnt = si.spdhcnt;
1109 sph.spdhmcnt = si.spdhmcnt;
1110
880a6fab
CG		 1111 do {
1112 lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock);
1113
1114 spt4.lbits = net->xfrm.policy_hthresh.lbits4;
1115 spt4.rbits = net->xfrm.policy_hthresh.rbits4;
1116 spt6.lbits = net->xfrm.policy_hthresh.lbits6;
1117 spt6.rbits = net->xfrm.policy_hthresh.rbits6;
1118 } while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq));
1119
1d1e34dd
DM		 1120 err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
1121 if (!err)
1122 err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
880a6fab
CG		 1123 if (!err)
1124 err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4);
1125 if (!err)
1126 err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6);
1d1e34dd
DM		 1127 if (err) {
1128 nlmsg_cancel(skb, nlh);
1129 return err;
1130 }
ecfd6b18 1131
053c095a
JB		 1132 nlmsg_end(skb, nlh);
1133 return 0;
ecfd6b18
JHS		 1134}
1135
880a6fab
CG		 1136static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
1137 struct nlattr **attrs)
1138{
1139 struct net *net = sock_net(skb->sk);
1140 struct xfrmu_spdhthresh *thresh4 = NULL;
1141 struct xfrmu_spdhthresh *thresh6 = NULL;
1142
1143 /* selector prefixlen thresholds to hash policies */
1144 if (attrs[XFRMA_SPD_IPV4_HTHRESH]) {
1145 struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH];
1146
1147 if (nla_len(rta) < sizeof(*thresh4))
1148 return -EINVAL;
1149 thresh4 = nla_data(rta);
1150 if (thresh4->lbits > 32 || thresh4->rbits > 32)
1151 return -EINVAL;
1152 }
1153 if (attrs[XFRMA_SPD_IPV6_HTHRESH]) {
1154 struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH];
1155
1156 if (nla_len(rta) < sizeof(*thresh6))
1157 return -EINVAL;
1158 thresh6 = nla_data(rta);
1159 if (thresh6->lbits > 128 || thresh6->rbits > 128)
1160 return -EINVAL;
1161 }
1162
1163 if (thresh4 || thresh6) {
1164 write_seqlock(&net->xfrm.policy_hthresh.lock);
1165 if (thresh4) {
1166 net->xfrm.policy_hthresh.lbits4 = thresh4->lbits;
1167 net->xfrm.policy_hthresh.rbits4 = thresh4->rbits;
1168 }
1169 if (thresh6) {
1170 net->xfrm.policy_hthresh.lbits6 = thresh6->lbits;
1171 net->xfrm.policy_hthresh.rbits6 = thresh6->rbits;
1172 }
1173 write_sequnlock(&net->xfrm.policy_hthresh.lock);
1174
1175 xfrm_policy_hash_rebuild(net);
1176 }
1177
1178 return 0;
1179}
1180
ecfd6b18 1181static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1182 struct nlattr **attrs)
ecfd6b18 1183{
a6483b79 1184 struct net *net = sock_net(skb->sk);
ecfd6b18 1185 struct sk_buff *r_skb;
7b67c857 1186 u32 *flags = nlmsg_data(nlh);
15e47304 1187 u32 sportid = NETLINK_CB(skb).portid;
ecfd6b18 1188 u32 seq = nlh->nlmsg_seq;
2fc5f83b 1189 int err;
ecfd6b18 1190
7deb2264 1191 r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
ecfd6b18
JHS		 1192 if (r_skb == NULL)
1193 return -ENOMEM;
1194
2fc5f83b
GS		 1195 err = build_spdinfo(r_skb, net, sportid, seq, *flags);
1196 BUG_ON(err < 0);
ecfd6b18 1197
bfc01ddf 1198 return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
ecfd6b18
JHS		 1199}
1200
a1b831f2 1201static inline unsigned int xfrm_sadinfo_msgsize(void)
7deb2264
TG		 1202{
1203 return NLMSG_ALIGN(4)
1204 + nla_total_size(sizeof(struct xfrmu_sadhinfo))
1205 + nla_total_size(4); /* XFRMA_SAD_CNT */
1206}
1207
e071041b 1208static int build_sadinfo(struct sk_buff *skb, struct net *net,
15e47304 1209 u32 portid, u32 seq, u32 flags)
28d8909b 1210{
af11e316
JHS		 1211 struct xfrmk_sadinfo si;
1212 struct xfrmu_sadhinfo sh;
28d8909b 1213 struct nlmsghdr *nlh;
1d1e34dd 1214 int err;
28d8909b
JHS		 1215 u32 *f;
1216
15e47304 1217 nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
25985edc 1218 if (nlh == NULL) /* shouldn't really happen ... */
28d8909b
JHS		 1219 return -EMSGSIZE;
1220
1221 f = nlmsg_data(nlh);
1222 *f = flags;
e071041b 1223 xfrm_sad_getinfo(net, &si);
28d8909b 1224
af11e316
JHS		 1225 sh.sadhmcnt = si.sadhmcnt;
1226 sh.sadhcnt = si.sadhcnt;
1227
1d1e34dd
DM		 1228 err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt);
1229 if (!err)
1230 err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
1231 if (err) {
1232 nlmsg_cancel(skb, nlh);
1233 return err;
1234 }
28d8909b 1235
053c095a
JB		 1236 nlmsg_end(skb, nlh);
1237 return 0;
28d8909b
JHS		 1238}
1239
1240static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1241 struct nlattr **attrs)
28d8909b 1242{
a6483b79 1243 struct net *net = sock_net(skb->sk);
28d8909b 1244 struct sk_buff *r_skb;
7b67c857 1245 u32 *flags = nlmsg_data(nlh);
15e47304 1246 u32 sportid = NETLINK_CB(skb).portid;
28d8909b 1247 u32 seq = nlh->nlmsg_seq;
2fc5f83b 1248 int err;
28d8909b 1249
7deb2264 1250 r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
28d8909b
JHS		 1251 if (r_skb == NULL)
1252 return -ENOMEM;
1253
2fc5f83b
GS		 1254 err = build_sadinfo(r_skb, net, sportid, seq, *flags);
1255 BUG_ON(err < 0);
28d8909b 1256
bfc01ddf 1257 return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
28d8909b
JHS		 1258}
1259
22e70050 1260static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1261 struct nlattr **attrs)
1da177e4 1262{
fc34acd3 1263 struct net *net = sock_net(skb->sk);
7b67c857 1264 struct xfrm_usersa_id *p = nlmsg_data(nlh);
1da177e4
LT		 1265 struct xfrm_state *x;
1266 struct sk_buff *resp_skb;
eb2971b6 1267 int err = -ESRCH;
1da177e4 1268
fc34acd3 1269 x = xfrm_user_state_lookup(net, p, attrs, &err);
1da177e4
LT		 1270 if (x == NULL)
1271 goto out_noput;
1272
1273 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
1274 if (IS_ERR(resp_skb)) {
1275 err = PTR_ERR(resp_skb);
1276 } else {
bfc01ddf 1277 err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
1da177e4
LT		 1278 }
1279 xfrm_state_put(x);
1280out_noput:
1281 return err;
1282}
1283
22e70050 1284static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1285 struct nlattr **attrs)
1da177e4 1286{
fc34acd3 1287 struct net *net = sock_net(skb->sk);
1da177e4
LT		 1288 struct xfrm_state *x;
1289 struct xfrm_userspi_info *p;
1290 struct sk_buff *resp_skb;
1291 xfrm_address_t *daddr;
1292 int family;
1293 int err;
6f26b61e
JHS		 1294 u32 mark;
1295 struct xfrm_mark m;
7e652640 1296 u32 if_id = 0;
1da177e4 1297
7b67c857 1298 p = nlmsg_data(nlh);
776e9dd9 1299 err = verify_spi_info(p->info.id.proto, p->min, p->max);
1da177e4
LT		 1300 if (err)
1301 goto out_noput;
1302
1303 family = p->info.family;
1304 daddr = &p->info.id.daddr;
1305
1306 x = NULL;
6f26b61e
JHS		 1307
1308 mark = xfrm_mark_get(attrs, &m);
7e652640
SK		 1309
1310 if (attrs[XFRMA_IF_ID])
1311 if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
1312
1da177e4 1313 if (p->info.seq) {
6f26b61e 1314 x = xfrm_find_acq_byseq(net, mark, p->info.seq);
70e94e66 1315 if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) {
1da177e4
LT		 1316 xfrm_state_put(x);
1317 x = NULL;
1318 }
1319 }
1320
1321 if (!x)
6f26b61e 1322 x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
7e652640 1323 if_id, p->info.id.proto, daddr,
1da177e4
LT		 1324 &p->info.saddr, 1,
1325 family);
1326 err = -ENOENT;
1327 if (x == NULL)
1328 goto out_noput;
1329
658b219e
HX		 1330 err = xfrm_alloc_spi(x, p->min, p->max);
1331 if (err)
1332 goto out;
1da177e4 1333
658b219e 1334 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
1da177e4
LT		 1335 if (IS_ERR(resp_skb)) {
1336 err = PTR_ERR(resp_skb);
1337 goto out;
1338 }
1339
bfc01ddf 1340 err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
1da177e4
LT		 1341
1342out:
1343 xfrm_state_put(x);
1344out_noput:
1345 return err;
1346}
1347
b798a9ed 1348static int verify_policy_dir(u8 dir)
1da177e4
LT		 1349{
1350 switch (dir) {
1351 case XFRM_POLICY_IN:
1352 case XFRM_POLICY_OUT:
1353 case XFRM_POLICY_FWD:
1354 break;
1355
1356 default:
1357 return -EINVAL;
3ff50b79 1358 }
1da177e4
LT		 1359
1360 return 0;
1361}
1362
b798a9ed 1363static int verify_policy_type(u8 type)
f7b6983f
MN		 1364{
1365 switch (type) {
1366 case XFRM_POLICY_TYPE_MAIN:
1367#ifdef CONFIG_XFRM_SUB_POLICY
1368 case XFRM_POLICY_TYPE_SUB:
1369#endif
1370 break;
1371
1372 default:
1373 return -EINVAL;
3ff50b79 1374 }
f7b6983f
MN		 1375
1376 return 0;
1377}
1378
1da177e4
LT		 1379static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
1380{
e682adf0
FD		 1381 int ret;
1382
1da177e4
LT		 1383 switch (p->share) {
1384 case XFRM_SHARE_ANY:
1385 case XFRM_SHARE_SESSION:
1386 case XFRM_SHARE_USER:
1387 case XFRM_SHARE_UNIQUE:
1388 break;
1389
1390 default:
1391 return -EINVAL;
3ff50b79 1392 }
1da177e4
LT		 1393
1394 switch (p->action) {
1395 case XFRM_POLICY_ALLOW:
1396 case XFRM_POLICY_BLOCK:
1397 break;
1398
1399 default:
1400 return -EINVAL;
3ff50b79 1401 }
1da177e4
LT		 1402
1403 switch (p->sel.family) {
1404 case AF_INET:
07bf7908
SK		 1405 if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
1406 return -EINVAL;
1407
1da177e4
LT		 1408 break;
1409
1410 case AF_INET6:
dfd56b8b 1411#if IS_ENABLED(CONFIG_IPV6)
07bf7908
SK		 1412 if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
1413 return -EINVAL;
1414
1da177e4
LT		 1415 break;
1416#else
1417 return -EAFNOSUPPORT;
1418#endif
1419
1420 default:
1421 return -EINVAL;
3ff50b79 1422 }
1da177e4 1423
e682adf0
FD		 1424 ret = verify_policy_dir(p->dir);
1425 if (ret)
1426 return ret;
b805d78d 1427 if (p->index && (xfrm_policy_id2dir(p->index) != p->dir))
e682adf0
FD		 1428 return -EINVAL;
1429
1430 return 0;
1da177e4
LT		 1431}
1432
5424f32e 1433static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
df71837d 1434{
5424f32e 1435 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
df71837d
TJ		 1436 struct xfrm_user_sec_ctx *uctx;
1437
1438 if (!rt)
1439 return 0;
1440
5424f32e 1441 uctx = nla_data(rt);
52a4c640 1442 return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL);
df71837d
TJ		 1443}
1444
1da177e4
LT		 1445static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
1446 int nr)
1447{
1448 int i;
1449
1450 xp->xfrm_nr = nr;
1451 for (i = 0; i < nr; i++, ut++) {
1452 struct xfrm_tmpl *t = &xp->xfrm_vec[i];
1453
1454 memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
1455 memcpy(&t->saddr, &ut->saddr,
1456 sizeof(xfrm_address_t));
1457 t->reqid = ut->reqid;
1458 t->mode = ut->mode;
1459 t->share = ut->share;
1460 t->optional = ut->optional;
1461 t->aalgos = ut->aalgos;
1462 t->ealgos = ut->ealgos;
1463 t->calgos = ut->calgos;
c5d18e98
HX		 1464 /* If all masks are ~0, then we allow all algorithms. */
1465 t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
8511d01d 1466 t->encap_family = ut->family;
1da177e4
LT		 1467 }
1468}
1469
b4ad86bf
DM		 1470static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
1471{
732706af 1472 u16 prev_family;
b4ad86bf
DM		 1473 int i;
1474
1475 if (nr > XFRM_MAX_DEPTH)
1476 return -EINVAL;
1477
732706af
SK		 1478 prev_family = family;
1479
b4ad86bf
DM		 1480 for (i = 0; i < nr; i++) {
1481 /* We never validated the ut->family value, so many
1482 * applications simply leave it at zero. The check was
1483 * never made and ut->family was ignored because all
1484 * templates could be assumed to have the same family as
1485 * the policy itself. Now that we will have ipv4-in-ipv6
1486 * and ipv6-in-ipv4 tunnels, this is no longer true.
1487 */
1488 if (!ut[i].family)
1489 ut[i].family = family;
1490
35e61038
FW		 1491 switch (ut[i].mode) {
1492 case XFRM_MODE_TUNNEL:
1493 case XFRM_MODE_BEET:
1494 break;
1495 default:
1496 if (ut[i].family != prev_family)
1497 return -EINVAL;
1498 break;
1499 }
32bf94fb
ST		 1500 if (ut[i].mode >= XFRM_MODE_MAX)
1501 return -EINVAL;
732706af
SK		 1502
1503 prev_family = ut[i].family;
1504
b4ad86bf
DM		 1505 switch (ut[i].family) {
1506 case AF_INET:
1507 break;
dfd56b8b 1508#if IS_ENABLED(CONFIG_IPV6)
b4ad86bf
DM		 1509 case AF_INET6:
1510 break;
1511#endif
1512 default:
1513 return -EINVAL;
3ff50b79 1514 }
6a53b759 1515
dbb2483b 1516 if (!xfrm_id_proto_valid(ut[i].id.proto))
6a53b759 1517 return -EINVAL;
b4ad86bf
DM		 1518 }
1519
1520 return 0;
1521}
1522
5424f32e 1523static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
1da177e4 1524{
5424f32e 1525 struct nlattr *rt = attrs[XFRMA_TMPL];
1da177e4
LT		 1526
1527 if (!rt) {
1528 pol->xfrm_nr = 0;
1529 } else {
5424f32e
TG		 1530 struct xfrm_user_tmpl *utmpl = nla_data(rt);
1531 int nr = nla_len(rt) / sizeof(*utmpl);
b4ad86bf 1532 int err;
1da177e4 1533
b4ad86bf
DM		 1534 err = validate_tmpl(nr, utmpl, pol->family);
1535 if (err)
1536 return err;
1da177e4 1537
5424f32e 1538 copy_templates(pol, utmpl, nr);
1da177e4
LT		 1539 }
1540 return 0;
1541}
1542
5424f32e 1543static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
f7b6983f 1544{
5424f32e 1545 struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
f7b6983f 1546 struct xfrm_userpolicy_type *upt;
b798a9ed 1547 u8 type = XFRM_POLICY_TYPE_MAIN;
f7b6983f
MN		 1548 int err;
1549
1550 if (rt) {
5424f32e 1551 upt = nla_data(rt);
f7b6983f
MN		 1552 type = upt->type;
1553 }
1554
1555 err = verify_policy_type(type);
1556 if (err)
1557 return err;
1558
1559 *tp = type;
1560 return 0;
1561}
1562
1da177e4
LT		 1563static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
1564{
1565 xp->priority = p->priority;
1566 xp->index = p->index;
1567 memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
1568 memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
1569 xp->action = p->action;
1570 xp->flags = p->flags;
1571 xp->family = p->sel.family;
1572 /* XXX xp->share = p->share; */
1573}
1574
1575static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
1576{
7b789836 1577 memset(p, 0, sizeof(*p));
1da177e4
LT		 1578 memcpy(&p->sel, &xp->selector, sizeof(p->sel));
1579 memcpy(&p->lft, &xp->lft, sizeof(p->lft));
1580 memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
1581 p->priority = xp->priority;
1582 p->index = xp->index;
1583 p->sel.family = xp->family;
1584 p->dir = dir;
1585 p->action = xp->action;
1586 p->flags = xp->flags;
1587 p->share = XFRM_SHARE_ANY; /* XXX xp->share */
1588}
1589
fc34acd3 1590static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
1da177e4 1591{
fc34acd3 1592 struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
1da177e4
LT		 1593 int err;
1594
1595 if (!xp) {
1596 *errp = -ENOMEM;
1597 return NULL;
1598 }
1599
1600 copy_from_user_policy(xp, p);
df71837d 1601
35a7aa08 1602 err = copy_from_user_policy_type(&xp->type, attrs);
f7b6983f
MN		 1603 if (err)
1604 goto error;
1605
35a7aa08
TG		 1606 if (!(err = copy_from_user_tmpl(xp, attrs)))
1607 err = copy_from_user_sec_ctx(xp, attrs);
f7b6983f
MN		 1608 if (err)
1609 goto error;
1da177e4 1610
295fae56
JHS		 1611 xfrm_mark_get(attrs, &xp->mark);
1612
7e652640
SK		 1613 if (attrs[XFRMA_IF_ID])
1614 xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
1615
1da177e4 1616 return xp;
f7b6983f
MN		 1617 error:
1618 *errp = err;
12a169e7 1619 xp->walk.dead = 1;
64c31b3f 1620 xfrm_policy_destroy(xp);
f7b6983f 1621 return NULL;
1da177e4
LT		 1622}
1623
22e70050 1624static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1625 struct nlattr **attrs)
1da177e4 1626{
fc34acd3 1627 struct net *net = sock_net(skb->sk);
7b67c857 1628 struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
1da177e4 1629 struct xfrm_policy *xp;
26b15dad 1630 struct km_event c;
1da177e4
LT		 1631 int err;
1632 int excl;
1633
1634 err = verify_newpolicy_info(p);
df71837d
TJ		 1635 if (err)
1636 return err;
35a7aa08 1637 err = verify_sec_ctx_len(attrs);
1da177e4
LT		 1638 if (err)
1639 return err;
1640
fc34acd3 1641 xp = xfrm_policy_construct(net, p, attrs, &err);
1da177e4
LT		 1642 if (!xp)
1643 return err;
1644
25985edc 1645 /* shouldn't excl be based on nlh flags??
26b15dad
JHS		 1646 * Aha! this is anti-netlink really i.e more pfkey derived
1647 * in netlink excl is a flag and you wouldnt need
1648 * a type XFRM_MSG_UPDPOLICY - JHS */
1da177e4
LT		 1649 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
1650 err = xfrm_policy_insert(p->dir, xp, excl);
2e71029e 1651 xfrm_audit_policy_add(xp, err ? 0 : 1, true);
161a09e7 1652
1da177e4 1653 if (err) {
03e1ad7b 1654 security_xfrm_policy_free(xp->security);
1da177e4
LT		 1655 kfree(xp);
1656 return err;
1657 }
1658
f60f6b8f 1659 c.event = nlh->nlmsg_type;
26b15dad 1660 c.seq = nlh->nlmsg_seq;
15e47304 1661 c.portid = nlh->nlmsg_pid;
26b15dad
JHS		 1662 km_policy_notify(xp, p->dir, &c);
1663
1da177e4
LT		 1664 xfrm_pol_put(xp);
1665
1666 return 0;
1667}
1668
1669static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
1670{
1671 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
1672 int i;
1673
1674 if (xp->xfrm_nr == 0)
1675 return 0;
1676
1677 for (i = 0; i < xp->xfrm_nr; i++) {
1678 struct xfrm_user_tmpl *up = &vec[i];
1679 struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
1680
1f86840f 1681 memset(up, 0, sizeof(*up));
1da177e4 1682 memcpy(&up->id, &kp->id, sizeof(up->id));
8511d01d 1683 up->family = kp->encap_family;
1da177e4
LT		 1684 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
1685 up->reqid = kp->reqid;
1686 up->mode = kp->mode;
1687 up->share = kp->share;
1688 up->optional = kp->optional;
1689 up->aalgos = kp->aalgos;
1690 up->ealgos = kp->ealgos;
1691 up->calgos = kp->calgos;
1692 }
df71837d 1693
c0144bea
TG		 1694 return nla_put(skb, XFRMA_TMPL,
1695 sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
0d681623
SH		 1696}
1697
1698static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
1699{
1700 if (x->security) {
1701 return copy_sec_ctx(x->security, skb);
df71837d
TJ		 1702 }
1703 return 0;
0d681623 1704}
df71837d 1705
0d681623
SH		 1706static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
1707{
1d1e34dd 1708 if (xp->security)
0d681623 1709 return copy_sec_ctx(xp->security, skb);
0d681623 1710 return 0;
df71837d 1711}
a1b831f2 1712static inline unsigned int userpolicy_type_attrsize(void)
cfbfd45a
TG		 1713{
1714#ifdef CONFIG_XFRM_SUB_POLICY
1715 return nla_total_size(sizeof(struct xfrm_userpolicy_type));
1716#else
1717 return 0;
1718#endif
1719}
df71837d 1720
f7b6983f 1721#ifdef CONFIG_XFRM_SUB_POLICY
b798a9ed 1722static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
f7b6983f 1723{
45c180bc
ED		 1724 struct xfrm_userpolicy_type upt;
1725
1726 /* Sadly there are two holes in struct xfrm_userpolicy_type */
1727 memset(&upt, 0, sizeof(upt));
1728 upt.type = type;
f7b6983f 1729
c0144bea 1730 return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
f7b6983f
MN		 1731}
1732
1733#else
b798a9ed 1734static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
f7b6983f
MN		 1735{
1736 return 0;
1737}
1738#endif
1739
1da177e4
LT		 1740static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
1741{
1742 struct xfrm_dump_info *sp = ptr;
1743 struct xfrm_userpolicy_info *p;
1744 struct sk_buff *in_skb = sp->in_skb;
1745 struct sk_buff *skb = sp->out_skb;
1746 struct nlmsghdr *nlh;
1d1e34dd 1747 int err;
1da177e4 1748
15e47304 1749 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
79b8b7f4
TG		 1750 XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
1751 if (nlh == NULL)
1752 return -EMSGSIZE;
1da177e4 1753
7b67c857 1754 p = nlmsg_data(nlh);
1da177e4 1755 copy_to_user_policy(xp, p, dir);
1d1e34dd
DM		 1756 err = copy_to_user_tmpl(xp, skb);
1757 if (!err)
1758 err = copy_to_user_sec_ctx(xp, skb);
1759 if (!err)
1760 err = copy_to_user_policy_type(xp->type, skb);
1761 if (!err)
1762 err = xfrm_mark_put(skb, &xp->mark);
7e652640
SK		 1763 if (!err)
1764 err = xfrm_if_id_put(skb, xp->if_id);
1d1e34dd
DM		 1765 if (err) {
1766 nlmsg_cancel(skb, nlh);
1767 return err;
1768 }
9825069d 1769 nlmsg_end(skb, nlh);
1da177e4 1770 return 0;
1da177e4
LT		 1771}
1772
4c563f76
TT		 1773static int xfrm_dump_policy_done(struct netlink_callback *cb)
1774{
1137b5e2 1775 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
283bc9f3 1776 struct net *net = sock_net(cb->skb->sk);
4c563f76 1777
283bc9f3 1778 xfrm_policy_walk_done(walk, net);
4c563f76
TT		 1779 return 0;
1780}
1781
1137b5e2
HX		 1782static int xfrm_dump_policy_start(struct netlink_callback *cb)
1783{
1784 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
1785
1786 BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
1787
1788 xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
1789 return 0;
1790}
1791
1da177e4
LT		 1792static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
1793{
fc34acd3 1794 struct net *net = sock_net(skb->sk);
1137b5e2 1795 struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
1da177e4
LT		 1796 struct xfrm_dump_info info;
1797
1798 info.in_skb = cb->skb;
1799 info.out_skb = skb;
1800 info.nlmsg_seq = cb->nlh->nlmsg_seq;
1801 info.nlmsg_flags = NLM_F_MULTI;
4c563f76 1802
fc34acd3 1803 (void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
1da177e4
LT		 1804
1805 return skb->len;
1806}
1807
1808static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
1809 struct xfrm_policy *xp,
1810 int dir, u32 seq)
1811{
1812 struct xfrm_dump_info info;
1813 struct sk_buff *skb;
c2546372 1814 int err;
1da177e4 1815
7deb2264 1816 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1da177e4
LT		 1817 if (!skb)
1818 return ERR_PTR(-ENOMEM);
1819
1da177e4
LT		 1820 info.in_skb = in_skb;
1821 info.out_skb = skb;
1822 info.nlmsg_seq = seq;
1823 info.nlmsg_flags = 0;
1da177e4 1824
c2546372
MK		 1825 err = dump_one_policy(xp, dir, 0, &info);
1826 if (err) {
1da177e4 1827 kfree_skb(skb);
c2546372 1828 return ERR_PTR(err);
1da177e4
LT		 1829 }
1830
1831 return skb;
1832}
1833
22e70050 1834static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1835 struct nlattr **attrs)
1da177e4 1836{
fc34acd3 1837 struct net *net = sock_net(skb->sk);
1da177e4
LT		 1838 struct xfrm_policy *xp;
1839 struct xfrm_userpolicy_id *p;
b798a9ed 1840 u8 type = XFRM_POLICY_TYPE_MAIN;
1da177e4 1841 int err;
26b15dad 1842 struct km_event c;
1da177e4 1843 int delete;
295fae56
JHS		 1844 struct xfrm_mark m;
1845 u32 mark = xfrm_mark_get(attrs, &m);
7e652640 1846 u32 if_id = 0;
1da177e4 1847
7b67c857 1848 p = nlmsg_data(nlh);
1da177e4
LT		 1849 delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
1850
35a7aa08 1851 err = copy_from_user_policy_type(&type, attrs);
f7b6983f
MN		 1852 if (err)
1853 return err;
1854
1da177e4
LT		 1855 err = verify_policy_dir(p->dir);
1856 if (err)
1857 return err;
1858
7e652640
SK		 1859 if (attrs[XFRMA_IF_ID])
1860 if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
1861
1da177e4 1862 if (p->index)
7e652640 1863 xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, delete, &err);
df71837d 1864 else {
5424f32e 1865 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
03e1ad7b 1866 struct xfrm_sec_ctx *ctx;
df71837d 1867
35a7aa08 1868 err = verify_sec_ctx_len(attrs);
df71837d
TJ		 1869 if (err)
1870 return err;
1871
2c8dd116 1872 ctx = NULL;
df71837d 1873 if (rt) {
5424f32e 1874 struct xfrm_user_sec_ctx *uctx = nla_data(rt);
df71837d 1875
52a4c640 1876 err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
03e1ad7b 1877 if (err)
df71837d 1878 return err;
2c8dd116 1879 }
7e652640 1880 xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir, &p->sel,
6f26b61e 1881 ctx, delete, &err);
03e1ad7b 1882 security_xfrm_policy_free(ctx);
df71837d 1883 }
1da177e4
LT		 1884 if (xp == NULL)
1885 return -ENOENT;
1886
1887 if (!delete) {
1888 struct sk_buff *resp_skb;
1889
1890 resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
1891 if (IS_ERR(resp_skb)) {
1892 err = PTR_ERR(resp_skb);
1893 } else {
bfc01ddf
SK		 1894 err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
1895 NETLINK_CB(skb).portid);
1da177e4 1896 }
26b15dad 1897 } else {
2e71029e 1898 xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
13fcfbb0
DM		 1899
1900 if (err != 0)
c8c05a8e 1901 goto out;
13fcfbb0 1902
e7443892 1903 c.data.byid = p->index;
f60f6b8f 1904 c.event = nlh->nlmsg_type;
26b15dad 1905 c.seq = nlh->nlmsg_seq;
15e47304 1906 c.portid = nlh->nlmsg_pid;
26b15dad 1907 km_policy_notify(xp, p->dir, &c);
1da177e4
LT		 1908 }
1909
c8c05a8e 1910out:
ef41aaa0 1911 xfrm_pol_put(xp);
1da177e4
LT		 1912 return err;
1913}
1914
22e70050 1915static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1916 struct nlattr **attrs)
1da177e4 1917{
fc34acd3 1918 struct net *net = sock_net(skb->sk);
26b15dad 1919 struct km_event c;
7b67c857 1920 struct xfrm_usersa_flush *p = nlmsg_data(nlh);
4aa2e62c 1921 int err;
1da177e4 1922
f75a2804 1923 err = xfrm_state_flush(net, p->proto, true, false);
9e64cc95
JHS		 1924 if (err) {
1925 if (err == -ESRCH) /* empty table */
1926 return 0;
069c474e 1927 return err;
9e64cc95 1928 }
bf08867f 1929 c.data.proto = p->proto;
f60f6b8f 1930 c.event = nlh->nlmsg_type;
26b15dad 1931 c.seq = nlh->nlmsg_seq;
15e47304 1932 c.portid = nlh->nlmsg_pid;
7067802e 1933 c.net = net;
26b15dad
JHS		 1934 km_state_notify(NULL, &c);
1935
1da177e4
LT		 1936 return 0;
1937}
1938
a1b831f2 1939static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x)
7deb2264 1940{
a1b831f2 1941 unsigned int replay_size = x->replay_esn ?
d8647b79
SK		 1942 xfrm_replay_state_esn_len(x->replay_esn) :
1943 sizeof(struct xfrm_replay_state);
1944
7deb2264 1945 return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
d8647b79 1946 + nla_total_size(replay_size)
de95c4a4 1947 + nla_total_size_64bit(sizeof(struct xfrm_lifetime_cur))
6f26b61e 1948 + nla_total_size(sizeof(struct xfrm_mark))
7deb2264
TG		 1949 + nla_total_size(4) /* XFRM_AE_RTHR */
1950 + nla_total_size(4); /* XFRM_AE_ETHR */
1951}
d51d081d 1952
214e005b 1953static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
d51d081d
JHS		 1954{
1955 struct xfrm_aevent_id *id;
1956 struct nlmsghdr *nlh;
1d1e34dd 1957 int err;
d51d081d 1958
15e47304 1959 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
79b8b7f4
TG		 1960 if (nlh == NULL)
1961 return -EMSGSIZE;
d51d081d 1962
7b67c857 1963 id = nlmsg_data(nlh);
931e79d7 1964 memset(&id->sa_id, 0, sizeof(id->sa_id));
9b7a787d 1965 memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr));
d51d081d
JHS		 1966 id->sa_id.spi = x->id.spi;
1967 id->sa_id.family = x->props.family;
1968 id->sa_id.proto = x->id.proto;
9b7a787d 1969 memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr));
2b5f6dcc 1970 id->reqid = x->props.reqid;
d51d081d
JHS		 1971 id->flags = c->data.aevent;
1972
d0fde795 1973 if (x->replay_esn) {
1d1e34dd
DM		 1974 err = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
1975 xfrm_replay_state_esn_len(x->replay_esn),
1976 x->replay_esn);
d0fde795 1977 } else {
1d1e34dd
DM		 1978 err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
1979 &x->replay);
d0fde795 1980 }
1d1e34dd
DM		 1981 if (err)
1982 goto out_cancel;
de95c4a4
ND		 1983 err = nla_put_64bit(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft,
1984 XFRMA_PAD);
1d1e34dd
DM		 1985 if (err)
1986 goto out_cancel;
d51d081d 1987
1d1e34dd
DM		 1988 if (id->flags & XFRM_AE_RTHR) {
1989 err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
1990 if (err)
1991 goto out_cancel;
1992 }
1993 if (id->flags & XFRM_AE_ETHR) {
1994 err = nla_put_u32(skb, XFRMA_ETIMER_THRESH,
1995 x->replay_maxage * 10 / HZ);
1996 if (err)
1997 goto out_cancel;
1998 }
1999 err = xfrm_mark_put(skb, &x->mark);
2000 if (err)
2001 goto out_cancel;
6f26b61e 2002
7e652640
SK		 2003 err = xfrm_if_id_put(skb, x->if_id);
2004 if (err)
2005 goto out_cancel;
2006
053c095a
JB		 2007 nlmsg_end(skb, nlh);
2008 return 0;
d51d081d 2009
1d1e34dd 2010out_cancel:
9825069d 2011 nlmsg_cancel(skb, nlh);
1d1e34dd 2012 return err;
d51d081d
JHS		 2013}
2014
22e70050 2015static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2016 struct nlattr **attrs)
d51d081d 2017{
fc34acd3 2018 struct net *net = sock_net(skb->sk);
d51d081d
JHS		 2019 struct xfrm_state *x;
2020 struct sk_buff *r_skb;
2021 int err;
2022 struct km_event c;
6f26b61e
JHS		 2023 u32 mark;
2024 struct xfrm_mark m;
7b67c857 2025 struct xfrm_aevent_id *p = nlmsg_data(nlh);
d51d081d
JHS		 2026 struct xfrm_usersa_id *id = &p->sa_id;
2027
6f26b61e
JHS		 2028 mark = xfrm_mark_get(attrs, &m);
2029
2030 x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
d8647b79 2031 if (x == NULL)
d51d081d 2032 return -ESRCH;
d8647b79
SK		 2033
2034 r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
2035 if (r_skb == NULL) {
2036 xfrm_state_put(x);
2037 return -ENOMEM;
d51d081d
JHS		 2038 }
2039
2040 /*
2041 * XXX: is this lock really needed - none of the other
2042 * gets lock (the concern is things getting updated
2043 * while we are still reading) - jhs
2044 */
2045 spin_lock_bh(&x->lock);
2046 c.data.aevent = p->flags;
2047 c.seq = nlh->nlmsg_seq;
15e47304 2048 c.portid = nlh->nlmsg_pid;
d51d081d 2049
2fc5f83b
GS		 2050 err = build_aevent(r_skb, x, &c);
2051 BUG_ON(err < 0);
2052
bfc01ddf 2053 err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
d51d081d
JHS		 2054 spin_unlock_bh(&x->lock);
2055 xfrm_state_put(x);
2056 return err;
2057}
2058
22e70050 2059static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2060 struct nlattr **attrs)
d51d081d 2061{
fc34acd3 2062 struct net *net = sock_net(skb->sk);
d51d081d
JHS		 2063 struct xfrm_state *x;
2064 struct km_event c;
02d0892f 2065 int err = -EINVAL;
6f26b61e
JHS		 2066 u32 mark = 0;
2067 struct xfrm_mark m;
7b67c857 2068 struct xfrm_aevent_id *p = nlmsg_data(nlh);
5424f32e 2069 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
d8647b79 2070 struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
5424f32e 2071 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
4e077237
MR		 2072 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
2073 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
d51d081d 2074
4e077237 2075 if (!lt && !rp && !re && !et && !rt)
d51d081d
JHS		 2076 return err;
2077
2078 /* pedantic mode - thou shalt sayeth replaceth */
2079 if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
2080 return err;
2081
6f26b61e
JHS		 2082 mark = xfrm_mark_get(attrs, &m);
2083
2084 x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
d51d081d
JHS		 2085 if (x == NULL)
2086 return -ESRCH;
2087
2088 if (x->km.state != XFRM_STATE_VALID)
2089 goto out;
2090
4479ff76 2091 err = xfrm_replay_verify_len(x->replay_esn, re);
e2b19125
SK		 2092 if (err)
2093 goto out;
2094
d51d081d 2095 spin_lock_bh(&x->lock);
e3ac104d 2096 xfrm_update_ae_params(x, attrs, 1);
d51d081d 2097 spin_unlock_bh(&x->lock);
d51d081d
JHS		 2098
2099 c.event = nlh->nlmsg_type;
2100 c.seq = nlh->nlmsg_seq;
15e47304 2101 c.portid = nlh->nlmsg_pid;
d51d081d
JHS		 2102 c.data.aevent = XFRM_AE_CU;
2103 km_state_notify(x, &c);
2104 err = 0;
2105out:
2106 xfrm_state_put(x);
2107 return err;
2108}
2109
22e70050 2110static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2111 struct nlattr **attrs)
1da177e4 2112{
fc34acd3 2113 struct net *net = sock_net(skb->sk);
f7b6983f 2114 struct km_event c;
b798a9ed 2115 u8 type = XFRM_POLICY_TYPE_MAIN;
f7b6983f
MN		 2116 int err;
2117
35a7aa08 2118 err = copy_from_user_policy_type(&type, attrs);
f7b6983f
MN		 2119 if (err)
2120 return err;
26b15dad 2121
2e71029e 2122 err = xfrm_policy_flush(net, type, true);
2f1eb65f
JHS		 2123 if (err) {
2124 if (err == -ESRCH) /* empty table */
2125 return 0;
069c474e 2126 return err;
2f1eb65f
JHS		 2127 }
2128
f7b6983f 2129 c.data.type = type;
f60f6b8f 2130 c.event = nlh->nlmsg_type;
26b15dad 2131 c.seq = nlh->nlmsg_seq;
15e47304 2132 c.portid = nlh->nlmsg_pid;
7067802e 2133 c.net = net;
26b15dad 2134 km_policy_notify(NULL, 0, &c);
1da177e4
LT		 2135 return 0;
2136}
2137
22e70050 2138static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2139 struct nlattr **attrs)
6c5c8ca7 2140{
fc34acd3 2141 struct net *net = sock_net(skb->sk);
6c5c8ca7 2142 struct xfrm_policy *xp;
7b67c857 2143 struct xfrm_user_polexpire *up = nlmsg_data(nlh);
6c5c8ca7 2144 struct xfrm_userpolicy_info *p = &up->pol;
b798a9ed 2145 u8 type = XFRM_POLICY_TYPE_MAIN;
6c5c8ca7 2146 int err = -ENOENT;
295fae56
JHS		 2147 struct xfrm_mark m;
2148 u32 mark = xfrm_mark_get(attrs, &m);
7e652640 2149 u32 if_id = 0;
6c5c8ca7 2150
35a7aa08 2151 err = copy_from_user_policy_type(&type, attrs);
f7b6983f
MN		 2152 if (err)
2153 return err;
2154
c8bf4d04
TT		 2155 err = verify_policy_dir(p->dir);
2156 if (err)
2157 return err;
2158
7e652640
SK		 2159 if (attrs[XFRMA_IF_ID])
2160 if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
2161
6c5c8ca7 2162 if (p->index)
7e652640 2163 xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, 0, &err);
6c5c8ca7 2164 else {
5424f32e 2165 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
03e1ad7b 2166 struct xfrm_sec_ctx *ctx;
6c5c8ca7 2167
35a7aa08 2168 err = verify_sec_ctx_len(attrs);
6c5c8ca7
JHS		 2169 if (err)
2170 return err;
2171
2c8dd116 2172 ctx = NULL;
6c5c8ca7 2173 if (rt) {
5424f32e 2174 struct xfrm_user_sec_ctx *uctx = nla_data(rt);
6c5c8ca7 2175
52a4c640 2176 err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
03e1ad7b 2177 if (err)
6c5c8ca7 2178 return err;
2c8dd116 2179 }
7e652640 2180 xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir,
6f26b61e 2181 &p->sel, ctx, 0, &err);
03e1ad7b 2182 security_xfrm_policy_free(ctx);
6c5c8ca7 2183 }
6c5c8ca7 2184 if (xp == NULL)
ef41aaa0 2185 return -ENOENT;
03e1ad7b 2186
ea2dea9d 2187 if (unlikely(xp->walk.dead))
6c5c8ca7 2188 goto out;
6c5c8ca7 2189
6c5c8ca7
JHS		 2190 err = 0;
2191 if (up->hard) {
2192 xfrm_policy_delete(xp, p->dir);
2e71029e 2193 xfrm_audit_policy_delete(xp, 1, true);
6c5c8ca7 2194 }
c6bb8136 2195 km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
6c5c8ca7
JHS		 2196
2197out:
2198 xfrm_pol_put(xp);
2199 return err;
2200}
2201
22e70050 2202static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2203 struct nlattr **attrs)
53bc6b4d 2204{
fc34acd3 2205 struct net *net = sock_net(skb->sk);
53bc6b4d
JHS		 2206 struct xfrm_state *x;
2207 int err;
7b67c857 2208 struct xfrm_user_expire *ue = nlmsg_data(nlh);
53bc6b4d 2209 struct xfrm_usersa_info *p = &ue->state;
6f26b61e 2210 struct xfrm_mark m;
928497f0 2211 u32 mark = xfrm_mark_get(attrs, &m);
53bc6b4d 2212
6f26b61e 2213 x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
53bc6b4d 2214
3a765aa5 2215 err = -ENOENT;
53bc6b4d
JHS		 2216 if (x == NULL)
2217 return err;
2218
53bc6b4d 2219 spin_lock_bh(&x->lock);
3a765aa5 2220 err = -EINVAL;
53bc6b4d
JHS		 2221 if (x->km.state != XFRM_STATE_VALID)
2222 goto out;
c6bb8136 2223 km_state_expired(x, ue->hard, nlh->nlmsg_pid);
53bc6b4d 2224
161a09e7 2225 if (ue->hard) {
53bc6b4d 2226 __xfrm_state_delete(x);
2e71029e 2227 xfrm_audit_state_delete(x, 1, true);
161a09e7 2228 }
3a765aa5 2229 err = 0;
53bc6b4d
JHS		 2230out:
2231 spin_unlock_bh(&x->lock);
2232 xfrm_state_put(x);
2233 return err;
2234}
2235
22e70050 2236static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2237 struct nlattr **attrs)
980ebd25 2238{
fc34acd3 2239 struct net *net = sock_net(skb->sk);
980ebd25
JHS		 2240 struct xfrm_policy *xp;
2241 struct xfrm_user_tmpl *ut;
2242 int i;
5424f32e 2243 struct nlattr *rt = attrs[XFRMA_TMPL];
6f26b61e 2244 struct xfrm_mark mark;
980ebd25 2245
7b67c857 2246 struct xfrm_user_acquire *ua = nlmsg_data(nlh);
fc34acd3 2247 struct xfrm_state *x = xfrm_state_alloc(net);
980ebd25
JHS		 2248 int err = -ENOMEM;
2249
2250 if (!x)
d8eb9307 2251 goto nomem;
980ebd25 2252
6f26b61e
JHS		 2253 xfrm_mark_get(attrs, &mark);
2254
980ebd25 2255 err = verify_newpolicy_info(&ua->policy);
d8eb9307 2256 if (err)
73efc324 2257 goto free_state;
980ebd25
JHS		 2258
2259 /* build an XP */
fc34acd3 2260 xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
d8eb9307
IJ		 2261 if (!xp)
2262 goto free_state;
980ebd25
JHS		 2263
2264 memcpy(&x->id, &ua->id, sizeof(ua->id));
2265 memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
2266 memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
6f26b61e
JHS		 2267 xp->mark.m = x->mark.m = mark.m;
2268 xp->mark.v = x->mark.v = mark.v;
5424f32e 2269 ut = nla_data(rt);
980ebd25
JHS		 2270 /* extract the templates and for each call km_key */
2271 for (i = 0; i < xp->xfrm_nr; i++, ut++) {
2272 struct xfrm_tmpl *t = &xp->xfrm_vec[i];
2273 memcpy(&x->id, &t->id, sizeof(x->id));
2274 x->props.mode = t->mode;
2275 x->props.reqid = t->reqid;
2276 x->props.family = ut->family;
2277 t->aalgos = ua->aalgos;
2278 t->ealgos = ua->ealgos;
2279 t->calgos = ua->calgos;
2280 err = km_query(x, t, xp);
2281
2282 }
2283
4a135e53 2284 xfrm_state_free(x);
980ebd25
JHS		 2285 kfree(xp);
2286
2287 return 0;
d8eb9307 2288
d8eb9307 2289free_state:
4a135e53 2290 xfrm_state_free(x);
d8eb9307
IJ		 2291nomem:
2292 return err;
980ebd25
JHS		 2293}
2294
5c79de6e 2295#ifdef CONFIG_XFRM_MIGRATE
5c79de6e 2296static int copy_from_user_migrate(struct xfrm_migrate *ma,
13c1d189 2297 struct xfrm_kmaddress *k,
5424f32e 2298 struct nlattr **attrs, int *num)
5c79de6e 2299{
5424f32e 2300 struct nlattr *rt = attrs[XFRMA_MIGRATE];
5c79de6e
SS		 2301 struct xfrm_user_migrate *um;
2302 int i, num_migrate;
2303
13c1d189
AE		 2304 if (k != NULL) {
2305 struct xfrm_user_kmaddress *uk;
2306
2307 uk = nla_data(attrs[XFRMA_KMADDRESS]);
2308 memcpy(&k->local, &uk->local, sizeof(k->local));
2309 memcpy(&k->remote, &uk->remote, sizeof(k->remote));
2310 k->family = uk->family;
2311 k->reserved = uk->reserved;
2312 }
2313
5424f32e
TG		 2314 um = nla_data(rt);
2315 num_migrate = nla_len(rt) / sizeof(*um);
5c79de6e
SS		 2316
2317 if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
2318 return -EINVAL;
2319
2320 for (i = 0; i < num_migrate; i++, um++, ma++) {
2321 memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
2322 memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
2323 memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
2324 memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
2325
2326 ma->proto = um->proto;
2327 ma->mode = um->mode;
2328 ma->reqid = um->reqid;
2329
2330 ma->old_family = um->old_family;
2331 ma->new_family = um->new_family;
2332 }
2333
2334 *num = i;
2335 return 0;
2336}
2337
2338static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2339 struct nlattr **attrs)
5c79de6e 2340{
7b67c857 2341 struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
5c79de6e 2342 struct xfrm_migrate m[XFRM_MAX_DEPTH];
13c1d189 2343 struct xfrm_kmaddress km, *kmp;
5c79de6e
SS		 2344 u8 type;
2345 int err;
2346 int n = 0;
8d549c4f 2347 struct net *net = sock_net(skb->sk);
4ab47d47 2348 struct xfrm_encap_tmpl *encap = NULL;
5c79de6e 2349
35a7aa08 2350 if (attrs[XFRMA_MIGRATE] == NULL)
cf5cb79f 2351 return -EINVAL;
5c79de6e 2352
13c1d189
AE		 2353 kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;
2354
5424f32e 2355 err = copy_from_user_policy_type(&type, attrs);
5c79de6e
SS		 2356 if (err)
2357 return err;
2358
13c1d189 2359 err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
5c79de6e
SS		 2360 if (err)
2361 return err;
2362
2363 if (!n)
2364 return 0;
2365
4ab47d47
AA		 2366 if (attrs[XFRMA_ENCAP]) {
2367 encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
2368 sizeof(*encap), GFP_KERNEL);
2369 if (!encap)
2370 return 0;
2371 }
5c79de6e 2372
4ab47d47
AA		 2373 err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap);
2374
2375 kfree(encap);
2376
2377 return err;
5c79de6e
SS		 2378}
2379#else
2380static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 2381 struct nlattr **attrs)
5c79de6e
SS		 2382{
2383 return -ENOPROTOOPT;
2384}
2385#endif
2386
2387#ifdef CONFIG_XFRM_MIGRATE
183cad12 2388static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
5c79de6e
SS		 2389{
2390 struct xfrm_user_migrate um;
2391
2392 memset(&um, 0, sizeof(um));
2393 um.proto = m->proto;
2394 um.mode = m->mode;
2395 um.reqid = m->reqid;
2396 um.old_family = m->old_family;
2397 memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
2398 memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
2399 um.new_family = m->new_family;
2400 memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
2401 memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
2402
c0144bea 2403 return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
5c79de6e
SS		 2404}
2405
183cad12 2406static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
13c1d189
AE		 2407{
2408 struct xfrm_user_kmaddress uk;
2409
2410 memset(&uk, 0, sizeof(uk));
2411 uk.family = k->family;
2412 uk.reserved = k->reserved;
2413 memcpy(&uk.local, &k->local, sizeof(uk.local));
a1caa322 2414 memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
13c1d189
AE		 2415
2416 return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
2417}
2418
a1b831f2
AD		 2419static inline unsigned int xfrm_migrate_msgsize(int num_migrate, int with_kma,
2420 int with_encp)
7deb2264
TG		 2421{
2422 return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
13c1d189 2423 + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
8bafd730 2424 + (with_encp ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0)
13c1d189
AE		 2425 + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
2426 + userpolicy_type_attrsize();
7deb2264
TG		 2427}
2428
183cad12
DM		 2429static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
2430 int num_migrate, const struct xfrm_kmaddress *k,
8bafd730
AA		 2431 const struct xfrm_selector *sel,
2432 const struct xfrm_encap_tmpl *encap, u8 dir, u8 type)
5c79de6e 2433{
183cad12 2434 const struct xfrm_migrate *mp;
5c79de6e
SS		 2435 struct xfrm_userpolicy_id *pol_id;
2436 struct nlmsghdr *nlh;
1d1e34dd 2437 int i, err;
5c79de6e 2438
79b8b7f4
TG		 2439 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
2440 if (nlh == NULL)
2441 return -EMSGSIZE;
5c79de6e 2442
7b67c857 2443 pol_id = nlmsg_data(nlh);
5c79de6e
SS		 2444 /* copy data from selector, dir, and type to the pol_id */
2445 memset(pol_id, 0, sizeof(*pol_id));
2446 memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
2447 pol_id->dir = dir;
2448
1d1e34dd
DM		 2449 if (k != NULL) {
2450 err = copy_to_user_kmaddress(k, skb);
2451 if (err)
2452 goto out_cancel;
2453 }
8bafd730
AA		 2454 if (encap) {
2455 err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap);
2456 if (err)
2457 goto out_cancel;
2458 }
1d1e34dd
DM		 2459 err = copy_to_user_policy_type(type, skb);
2460 if (err)
2461 goto out_cancel;
5c79de6e 2462 for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
1d1e34dd
DM		 2463 err = copy_to_user_migrate(mp, skb);
2464 if (err)
2465 goto out_cancel;
5c79de6e
SS		 2466 }
2467
053c095a
JB		 2468 nlmsg_end(skb, nlh);
2469 return 0;
1d1e34dd
DM		 2470
2471out_cancel:
9825069d 2472 nlmsg_cancel(skb, nlh);
1d1e34dd 2473 return err;
5c79de6e
SS		 2474}
2475
183cad12
DM		 2476static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2477 const struct xfrm_migrate *m, int num_migrate,
8bafd730
AA		 2478 const struct xfrm_kmaddress *k,
2479 const struct xfrm_encap_tmpl *encap)
5c79de6e 2480{
a6483b79 2481 struct net *net = &init_net;
5c79de6e 2482 struct sk_buff *skb;
2fc5f83b 2483 int err;
5c79de6e 2484
8bafd730
AA		 2485 skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap),
2486 GFP_ATOMIC);
5c79de6e
SS		 2487 if (skb == NULL)
2488 return -ENOMEM;
2489
2490 /* build migrate */
2fc5f83b
GS		 2491 err = build_migrate(skb, m, num_migrate, k, sel, encap, dir, type);
2492 BUG_ON(err < 0);
5c79de6e 2493
21ee543e 2494 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
5c79de6e
SS		 2495}
2496#else
183cad12
DM		 2497static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2498 const struct xfrm_migrate *m, int num_migrate,
8bafd730
AA		 2499 const struct xfrm_kmaddress *k,
2500 const struct xfrm_encap_tmpl *encap)
5c79de6e
SS		 2501{
2502 return -ENOPROTOOPT;
2503}
2504#endif
d51d081d 2505
a7bd9a45 2506#define XMSGSIZE(type) sizeof(struct type)
492b558b
TG		 2507
2508static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
66f9a259 2509 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
492b558b
TG		 2510 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
2511 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
2512 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2513 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2514 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2515 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
980ebd25 2516 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
53bc6b4d 2517 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
492b558b 2518 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
66f9a259 2519 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
6c5c8ca7 2520 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
492b558b 2521 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
a7bd9a45 2522 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
d51d081d
JHS		 2523 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2524 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
97a64b45 2525 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
5c79de6e 2526 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
a7bd9a45 2527 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
880a6fab 2528 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
a7bd9a45 2529 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
1da177e4
LT		 2530};
2531
492b558b
TG		 2532#undef XMSGSIZE
2533
cf5cb79f 2534static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
c28e9304 2535 [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)},
2536 [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)},
2537 [XFRMA_LASTUSED] = { .type = NLA_U64},
2538 [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)},
1a6509d9 2539 [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) },
cf5cb79f
TG		 2540 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
2541 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
2542 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
2543 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
2544 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
2545 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
2546 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
2547 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
2548 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
2549 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
2550 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
2551 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
2552 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
2553 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
13c1d189 2554 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
6f26b61e 2555 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
35d2856b 2556 [XFRMA_TFCPAD] = { .type = NLA_U32 },
d8647b79 2557 [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
a947b0a9 2558 [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 },
d3623099 2559 [XFRMA_PROTO] = { .type = NLA_U8 },
870a2df4 2560 [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) },
d77e38e6 2561 [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) },
9b42c1f1
SK		 2562 [XFRMA_SET_MARK] = { .type = NLA_U32 },
2563 [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
7e652640 2564 [XFRMA_IF_ID] = { .type = NLA_U32 },
cf5cb79f
TG		 2565};
2566
880a6fab
CG		 2567static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
2568 [XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
2569 [XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
2570};
2571
05600a79 2572static const struct xfrm_link {
5424f32e 2573 int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
1137b5e2 2574 int (*start)(struct netlink_callback *);
1da177e4 2575 int (*dump)(struct sk_buff *, struct netlink_callback *);
4c563f76 2576 int (*done)(struct netlink_callback *);
880a6fab
CG		 2577 const struct nla_policy *nla_pol;
2578 int nla_max;
492b558b
TG		 2579} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
2580 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
2581 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa },
2582 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
4c563f76
TT		 2583 .dump = xfrm_dump_sa,
2584 .done = xfrm_dump_sa_done },
492b558b
TG		 2585 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
2586 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
2587 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
1137b5e2 2588 .start = xfrm_dump_policy_start,
4c563f76
TT		 2589 .dump = xfrm_dump_policy,
2590 .done = xfrm_dump_policy_done },
492b558b 2591 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
980ebd25 2592 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire },
53bc6b4d 2593 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
492b558b
TG		 2594 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
2595 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
6c5c8ca7 2596 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
492b558b
TG		 2597 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa },
2598 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy },
d51d081d
JHS		 2599 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae },
2600 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae },
5c79de6e 2601 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate },
566ec034 2602 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo },
880a6fab
CG		 2603 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo,
2604 .nla_pol = xfrma_spd_policy,
2605 .nla_max = XFRMA_SPD_MAX },
ecfd6b18 2606 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo },
1da177e4
LT		 2607};
2608
2d4bc933
JB		 2609static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
2610 struct netlink_ext_ack *extack)
1da177e4 2611{
a6483b79 2612 struct net *net = sock_net(skb->sk);
35a7aa08 2613 struct nlattr *attrs[XFRMA_MAX+1];
05600a79 2614 const struct xfrm_link *link;
a7bd9a45 2615 int type, err;
1da177e4 2616
2bf8c476 2617 if (in_compat_syscall())
83e2d058 2618 return -EOPNOTSUPP;
74005991 2619
1da177e4 2620 type = nlh->nlmsg_type;
1da177e4 2621 if (type > XFRM_MSG_MAX)
1d00a4eb 2622 return -EINVAL;
1da177e4
LT		 2623
2624 type -= XFRM_MSG_BASE;
2625 link = &xfrm_dispatch[type];
2626
2627 /* All operations require privileges, even GET */
90f62cf3 2628 if (!netlink_net_capable(skb, CAP_NET_ADMIN))
1d00a4eb 2629 return -EPERM;
1da177e4 2630
492b558b
TG		 2631 if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
2632 type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
b8f3ab42 2633 (nlh->nlmsg_flags & NLM_F_DUMP)) {
1da177e4 2634 if (link->dump == NULL)
1d00a4eb 2635 return -EINVAL;
88fc2c84 2636
80d326fa
PNA		 2637 {
2638 struct netlink_dump_control c = {
1137b5e2 2639 .start = link->start,
80d326fa
PNA		 2640 .dump = link->dump,
2641 .done = link->done,
2642 };
2643 return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
2644 }
1da177e4
LT		 2645 }
2646
880a6fab
CG		 2647 err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs,
2648 link->nla_max ? : XFRMA_MAX,
fe52145f 2649 link->nla_pol ? : xfrma_policy, extack);
a7bd9a45
TG		 2650 if (err < 0)
2651 return err;
1da177e4
LT		 2652
2653 if (link->doit == NULL)
1d00a4eb 2654 return -EINVAL;
1da177e4 2655
5424f32e 2656 return link->doit(skb, nlh, attrs);
1da177e4
LT		 2657}
2658
cd40b7d3 2659static void xfrm_netlink_rcv(struct sk_buff *skb)
1da177e4 2660{
283bc9f3
FD		 2661 struct net *net = sock_net(skb->sk);
2662
2663 mutex_lock(&net->xfrm.xfrm_cfg_mutex);
cd40b7d3 2664 netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
283bc9f3 2665 mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
1da177e4
LT		 2666}
2667
a1b831f2 2668static inline unsigned int xfrm_expire_msgsize(void)
7deb2264 2669{
6f26b61e
JHS		 2670 return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
2671 + nla_total_size(sizeof(struct xfrm_mark));
7deb2264
TG		 2672}
2673
214e005b 2674static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
1da177e4
LT		 2675{
2676 struct xfrm_user_expire *ue;
2677 struct nlmsghdr *nlh;
1d1e34dd 2678 int err;
1da177e4 2679
15e47304 2680 nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
79b8b7f4
TG		 2681 if (nlh == NULL)
2682 return -EMSGSIZE;
1da177e4 2683
7b67c857 2684 ue = nlmsg_data(nlh);
1da177e4 2685 copy_to_user_state(x, &ue->state);
d51d081d 2686 ue->hard = (c->data.hard != 0) ? 1 : 0;
e3e5fc16
MK		 2687 /* clear the padding bytes */
2688 memset(&ue->hard + 1, 0, sizeof(*ue) - offsetofend(typeof(*ue), hard));
1da177e4 2689
1d1e34dd
DM		 2690 err = xfrm_mark_put(skb, &x->mark);
2691 if (err)
2692 return err;
6f26b61e 2693
7e652640
SK		 2694 err = xfrm_if_id_put(skb, x->if_id);
2695 if (err)
2696 return err;
2697
053c095a
JB		 2698 nlmsg_end(skb, nlh);
2699 return 0;
1da177e4
LT		 2700}
2701
214e005b 2702static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
1da177e4 2703{
fc34acd3 2704 struct net *net = xs_net(x);
1da177e4
LT		 2705 struct sk_buff *skb;
2706
7deb2264 2707 skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
1da177e4
LT		 2708 if (skb == NULL)
2709 return -ENOMEM;
2710
6f26b61e
JHS		 2711 if (build_expire(skb, x, c) < 0) {
2712 kfree_skb(skb);
2713 return -EMSGSIZE;
2714 }
1da177e4 2715
21ee543e 2716 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
1da177e4
LT		 2717}
2718
214e005b 2719static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
d51d081d 2720{
fc34acd3 2721 struct net *net = xs_net(x);
d51d081d 2722 struct sk_buff *skb;
2fc5f83b 2723 int err;
d51d081d 2724
d8647b79 2725 skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
d51d081d
JHS		 2726 if (skb == NULL)
2727 return -ENOMEM;
2728
2fc5f83b
GS		 2729 err = build_aevent(skb, x, c);
2730 BUG_ON(err < 0);
d51d081d 2731
21ee543e 2732 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS);
d51d081d
JHS		 2733}
2734
214e005b 2735static int xfrm_notify_sa_flush(const struct km_event *c)
26b15dad 2736{
7067802e 2737 struct net *net = c->net;
26b15dad
JHS		 2738 struct xfrm_usersa_flush *p;
2739 struct nlmsghdr *nlh;
2740 struct sk_buff *skb;
7deb2264 2741 int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
26b15dad 2742
7deb2264 2743 skb = nlmsg_new(len, GFP_ATOMIC);
26b15dad
JHS		 2744 if (skb == NULL)
2745 return -ENOMEM;
26b15dad 2746
15e47304 2747 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
79b8b7f4
TG		 2748 if (nlh == NULL) {
2749 kfree_skb(skb);
2750 return -EMSGSIZE;
2751 }
26b15dad 2752
7b67c857 2753 p = nlmsg_data(nlh);
bf08867f 2754 p->proto = c->data.proto;
26b15dad 2755
9825069d 2756 nlmsg_end(skb, nlh);
26b15dad 2757
21ee543e 2758 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
26b15dad
JHS		 2759}
2760
a1b831f2 2761static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
26b15dad 2762{
a1b831f2 2763 unsigned int l = 0;
1a6509d9
HX		 2764 if (x->aead)
2765 l += nla_total_size(aead_len(x->aead));
4447bb33
MW		 2766 if (x->aalg) {
2767 l += nla_total_size(sizeof(struct xfrm_algo) +
2768 (x->aalg->alg_key_len + 7) / 8);
2769 l += nla_total_size(xfrm_alg_auth_len(x->aalg));
2770 }
26b15dad 2771 if (x->ealg)
0f99be0d 2772 l += nla_total_size(xfrm_alg_len(x->ealg));
26b15dad 2773 if (x->calg)
7deb2264 2774 l += nla_total_size(sizeof(*x->calg));
26b15dad 2775 if (x->encap)
7deb2264 2776 l += nla_total_size(sizeof(*x->encap));
35d2856b
MW		 2777 if (x->tfcpad)
2778 l += nla_total_size(sizeof(x->tfcpad));
d8647b79
SK		 2779 if (x->replay_esn)
2780 l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
f293a5e3 2781 else
2782 l += nla_total_size(sizeof(struct xfrm_replay_state));
68325d3b
HX		 2783 if (x->security)
2784 l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
2785 x->security->ctx_len);
2786 if (x->coaddr)
2787 l += nla_total_size(sizeof(*x->coaddr));
a947b0a9
ND		 2788 if (x->props.extra_flags)
2789 l += nla_total_size(sizeof(x->props.extra_flags));
d77e38e6
SK		 2790 if (x->xso.dev)
2791 l += nla_total_size(sizeof(x->xso));
9b42c1f1
SK		 2792 if (x->props.smark.v | x->props.smark.m) {
2793 l += nla_total_size(sizeof(x->props.smark.v));
2794 l += nla_total_size(sizeof(x->props.smark.m));
2795 }
7e652640
SK		 2796 if (x->if_id)
2797 l += nla_total_size(sizeof(x->if_id));
68325d3b 2798
d26f3984 2799 /* Must count x->lastused as it may become non-zero behind our back. */
de95c4a4 2800 l += nla_total_size_64bit(sizeof(u64));
26b15dad
JHS		 2801
2802 return l;
2803}
2804
214e005b 2805static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
26b15dad 2806{
fc34acd3 2807 struct net *net = xs_net(x);
26b15dad 2808 struct xfrm_usersa_info *p;
0603eac0 2809 struct xfrm_usersa_id *id;
26b15dad
JHS		 2810 struct nlmsghdr *nlh;
2811 struct sk_buff *skb;
a1b831f2
AD		 2812 unsigned int len = xfrm_sa_len(x);
2813 unsigned int headlen;
2814 int err;
0603eac0
HX		 2815
2816 headlen = sizeof(*p);
2817 if (c->event == XFRM_MSG_DELSA) {
7deb2264 2818 len += nla_total_size(headlen);
0603eac0 2819 headlen = sizeof(*id);
6f26b61e 2820 len += nla_total_size(sizeof(struct xfrm_mark));
0603eac0 2821 }
7deb2264 2822 len += NLMSG_ALIGN(headlen);
26b15dad 2823
7deb2264 2824 skb = nlmsg_new(len, GFP_ATOMIC);
26b15dad
JHS		 2825 if (skb == NULL)
2826 return -ENOMEM;
26b15dad 2827
15e47304 2828 nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
1d1e34dd 2829 err = -EMSGSIZE;
79b8b7f4 2830 if (nlh == NULL)
1d1e34dd 2831 goto out_free_skb;
26b15dad 2832
7b67c857 2833 p = nlmsg_data(nlh);
0603eac0 2834 if (c->event == XFRM_MSG_DELSA) {
c0144bea
TG		 2835 struct nlattr *attr;
2836
7b67c857 2837 id = nlmsg_data(nlh);
50329c8a 2838 memset(id, 0, sizeof(*id));
0603eac0
HX		 2839 memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
2840 id->spi = x->id.spi;
2841 id->family = x->props.family;
2842 id->proto = x->id.proto;
2843
c0144bea 2844 attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
1d1e34dd 2845 err = -EMSGSIZE;
c0144bea 2846 if (attr == NULL)
1d1e34dd 2847 goto out_free_skb;
c0144bea
TG		 2848
2849 p = nla_data(attr);
0603eac0 2850 }
1d1e34dd
DM		 2851 err = copy_to_user_state_extra(x, p, skb);
2852 if (err)
2853 goto out_free_skb;
26b15dad 2854
9825069d 2855 nlmsg_end(skb, nlh);
26b15dad 2856
21ee543e 2857 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
26b15dad 2858
1d1e34dd 2859out_free_skb:
26b15dad 2860 kfree_skb(skb);
1d1e34dd 2861 return err;
26b15dad
JHS		 2862}
2863
214e005b 2864static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
26b15dad
JHS		 2865{
2866
2867 switch (c->event) {
f60f6b8f 2868 case XFRM_MSG_EXPIRE:
26b15dad 2869 return xfrm_exp_state_notify(x, c);
d51d081d
JHS		 2870 case XFRM_MSG_NEWAE:
2871 return xfrm_aevent_state_notify(x, c);
f60f6b8f
HX		 2872 case XFRM_MSG_DELSA:
2873 case XFRM_MSG_UPDSA:
2874 case XFRM_MSG_NEWSA:
26b15dad 2875 return xfrm_notify_sa(x, c);
f60f6b8f 2876 case XFRM_MSG_FLUSHSA:
26b15dad
JHS		 2877 return xfrm_notify_sa_flush(c);
2878 default:
62db5cfd 2879 printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
2880 c->event);
2881 break;
26b15dad
JHS		 2882 }
2883
2884 return 0;
2885
2886}
2887
a1b831f2
AD		 2888static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x,
2889 struct xfrm_policy *xp)
7deb2264
TG		 2890{
2891 return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
2892 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
6f26b61e 2893 + nla_total_size(sizeof(struct xfrm_mark))
7deb2264
TG		 2894 + nla_total_size(xfrm_user_sec_ctx_size(x->security))
2895 + userpolicy_type_attrsize();
2896}
2897
1da177e4 2898static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
65e0736b 2899 struct xfrm_tmpl *xt, struct xfrm_policy *xp)
1da177e4 2900{
1d1e34dd 2901 __u32 seq = xfrm_get_acqseq();
1da177e4
LT		 2902 struct xfrm_user_acquire *ua;
2903 struct nlmsghdr *nlh;
1d1e34dd 2904 int err;
1da177e4 2905
79b8b7f4
TG		 2906 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
2907 if (nlh == NULL)
2908 return -EMSGSIZE;
1da177e4 2909
7b67c857 2910 ua = nlmsg_data(nlh);
1da177e4
LT		 2911 memcpy(&ua->id, &x->id, sizeof(ua->id));
2912 memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
2913 memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
65e0736b 2914 copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT);
1da177e4
LT		 2915 ua->aalgos = xt->aalgos;
2916 ua->ealgos = xt->ealgos;
2917 ua->calgos = xt->calgos;
2918 ua->seq = x->km.seq = seq;
2919
1d1e34dd
DM		 2920 err = copy_to_user_tmpl(xp, skb);
2921 if (!err)
2922 err = copy_to_user_state_sec_ctx(x, skb);
2923 if (!err)
2924 err = copy_to_user_policy_type(xp->type, skb);
2925 if (!err)
2926 err = xfrm_mark_put(skb, &xp->mark);
7e652640
SK		 2927 if (!err)
2928 err = xfrm_if_id_put(skb, xp->if_id);
1d1e34dd
DM		 2929 if (err) {
2930 nlmsg_cancel(skb, nlh);
2931 return err;
2932 }
1da177e4 2933
053c095a
JB		 2934 nlmsg_end(skb, nlh);
2935 return 0;
1da177e4
LT		 2936}
2937
2938static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
65e0736b 2939 struct xfrm_policy *xp)
1da177e4 2940{
a6483b79 2941 struct net *net = xs_net(x);
1da177e4 2942 struct sk_buff *skb;
2fc5f83b 2943 int err;
1da177e4 2944
7deb2264 2945 skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
1da177e4
LT		 2946 if (skb == NULL)
2947 return -ENOMEM;
2948
2fc5f83b
GS		 2949 err = build_acquire(skb, x, xt, xp);
2950 BUG_ON(err < 0);
1da177e4 2951
21ee543e 2952 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
1da177e4
LT		 2953}
2954
2955/* User gives us xfrm_user_policy_info followed by an array of 0
2956 * or more templates.
2957 */
cb969f07 2958static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
1da177e4
LT		 2959 u8 *data, int len, int *dir)
2960{
fc34acd3 2961 struct net *net = sock_net(sk);
1da177e4
LT		 2962 struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
2963 struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
2964 struct xfrm_policy *xp;
2965 int nr;
2966
cb969f07 2967 switch (sk->sk_family) {
1da177e4
LT		 2968 case AF_INET:
2969 if (opt != IP_XFRM_POLICY) {
2970 *dir = -EOPNOTSUPP;
2971 return NULL;
2972 }
2973 break;
dfd56b8b 2974#if IS_ENABLED(CONFIG_IPV6)
1da177e4
LT		 2975 case AF_INET6:
2976 if (opt != IPV6_XFRM_POLICY) {
2977 *dir = -EOPNOTSUPP;
2978 return NULL;
2979 }
2980 break;
2981#endif
2982 default:
2983 *dir = -EINVAL;
2984 return NULL;
2985 }
2986
2987 *dir = -EINVAL;
2988
2989 if (len < sizeof(*p) ||
2990 verify_newpolicy_info(p))
2991 return NULL;
2992
2993 nr = ((len - sizeof(*p)) / sizeof(*ut));
b4ad86bf 2994 if (validate_tmpl(nr, ut, p->sel.family))
1da177e4
LT		 2995 return NULL;
2996
a4f1bac6
HX		 2997 if (p->dir > XFRM_POLICY_OUT)
2998 return NULL;
2999
2f09a4d5 3000 xp = xfrm_policy_alloc(net, GFP_ATOMIC);
1da177e4
LT		 3001 if (xp == NULL) {
3002 *dir = -ENOBUFS;
3003 return NULL;
3004 }
3005
3006 copy_from_user_policy(xp, p);
f7b6983f 3007 xp->type = XFRM_POLICY_TYPE_MAIN;
1da177e4
LT		 3008 copy_templates(xp, ut, nr);
3009
3010 *dir = p->dir;
3011
3012 return xp;
3013}
3014
a1b831f2 3015static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp)
7deb2264
TG		 3016{
3017 return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
3018 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
3019 + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
295fae56 3020 + nla_total_size(sizeof(struct xfrm_mark))
7deb2264
TG		 3021 + userpolicy_type_attrsize();
3022}
3023
1da177e4 3024static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
214e005b 3025 int dir, const struct km_event *c)
1da177e4
LT		 3026{
3027 struct xfrm_user_polexpire *upe;
d51d081d 3028 int hard = c->data.hard;
1d1e34dd
DM		 3029 struct nlmsghdr *nlh;
3030 int err;
1da177e4 3031
15e47304 3032 nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
79b8b7f4
TG		 3033 if (nlh == NULL)
3034 return -EMSGSIZE;
1da177e4 3035
7b67c857 3036 upe = nlmsg_data(nlh);
1da177e4 3037 copy_to_user_policy(xp, &upe->pol, dir);
1d1e34dd
DM		 3038 err = copy_to_user_tmpl(xp, skb);
3039 if (!err)
3040 err = copy_to_user_sec_ctx(xp, skb);
3041 if (!err)
3042 err = copy_to_user_policy_type(xp->type, skb);
3043 if (!err)
3044 err = xfrm_mark_put(skb, &xp->mark);
7e652640
SK		 3045 if (!err)
3046 err = xfrm_if_id_put(skb, xp->if_id);
1d1e34dd
DM		 3047 if (err) {
3048 nlmsg_cancel(skb, nlh);
3049 return err;
3050 }
1da177e4
LT		 3051 upe->hard = !!hard;
3052
053c095a
JB		 3053 nlmsg_end(skb, nlh);
3054 return 0;
1da177e4
LT		 3055}
3056
214e005b 3057static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
1da177e4 3058{
fc34acd3 3059 struct net *net = xp_net(xp);
1da177e4 3060 struct sk_buff *skb;
2fc5f83b 3061 int err;
1da177e4 3062
7deb2264 3063 skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
1da177e4
LT		 3064 if (skb == NULL)
3065 return -ENOMEM;
3066
2fc5f83b
GS		 3067 err = build_polexpire(skb, xp, dir, c);
3068 BUG_ON(err < 0);
1da177e4 3069
21ee543e 3070 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
1da177e4
LT		 3071}
3072
214e005b 3073static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
26b15dad 3074{
a1b831f2 3075 unsigned int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
fc34acd3 3076 struct net *net = xp_net(xp);
26b15dad 3077 struct xfrm_userpolicy_info *p;
0603eac0 3078 struct xfrm_userpolicy_id *id;
26b15dad
JHS		 3079 struct nlmsghdr *nlh;
3080 struct sk_buff *skb;
a1b831f2
AD		 3081 unsigned int headlen;
3082 int err;
0603eac0
HX		 3083
3084 headlen = sizeof(*p);
3085 if (c->event == XFRM_MSG_DELPOLICY) {
7deb2264 3086 len += nla_total_size(headlen);
0603eac0
HX		 3087 headlen = sizeof(*id);
3088 }
cfbfd45a 3089 len += userpolicy_type_attrsize();
295fae56 3090 len += nla_total_size(sizeof(struct xfrm_mark));
7deb2264 3091 len += NLMSG_ALIGN(headlen);
26b15dad 3092
7deb2264 3093 skb = nlmsg_new(len, GFP_ATOMIC);
26b15dad
JHS		 3094 if (skb == NULL)
3095 return -ENOMEM;
26b15dad 3096
15e47304 3097 nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
1d1e34dd 3098 err = -EMSGSIZE;
79b8b7f4 3099 if (nlh == NULL)
1d1e34dd 3100 goto out_free_skb;
26b15dad 3101
7b67c857 3102 p = nlmsg_data(nlh);
0603eac0 3103 if (c->event == XFRM_MSG_DELPOLICY) {
c0144bea
TG		 3104 struct nlattr *attr;
3105
7b67c857 3106 id = nlmsg_data(nlh);
0603eac0
HX		 3107 memset(id, 0, sizeof(*id));
3108 id->dir = dir;
3109 if (c->data.byid)
3110 id->index = xp->index;
3111 else
3112 memcpy(&id->sel, &xp->selector, sizeof(id->sel));
3113
c0144bea 3114 attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
1d1e34dd 3115 err = -EMSGSIZE;
c0144bea 3116 if (attr == NULL)
1d1e34dd 3117 goto out_free_skb;
c0144bea
TG		 3118
3119 p = nla_data(attr);
0603eac0 3120 }
26b15dad 3121
26b15dad 3122 copy_to_user_policy(xp, p, dir);
1d1e34dd
DM		 3123 err = copy_to_user_tmpl(xp, skb);
3124 if (!err)
3125 err = copy_to_user_policy_type(xp->type, skb);
3126 if (!err)
3127 err = xfrm_mark_put(skb, &xp->mark);
7e652640
SK		 3128 if (!err)
3129 err = xfrm_if_id_put(skb, xp->if_id);
1d1e34dd
DM		 3130 if (err)
3131 goto out_free_skb;
295fae56 3132
9825069d 3133 nlmsg_end(skb, nlh);
26b15dad 3134
21ee543e 3135 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
26b15dad 3136
1d1e34dd 3137out_free_skb:
26b15dad 3138 kfree_skb(skb);
1d1e34dd 3139 return err;
26b15dad
JHS		 3140}
3141
214e005b 3142static int xfrm_notify_policy_flush(const struct km_event *c)
26b15dad 3143{
7067802e 3144 struct net *net = c->net;
26b15dad
JHS		 3145 struct nlmsghdr *nlh;
3146 struct sk_buff *skb;
1d1e34dd 3147 int err;
26b15dad 3148
7deb2264 3149 skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
26b15dad
JHS		 3150 if (skb == NULL)
3151 return -ENOMEM;
26b15dad 3152
15e47304 3153 nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
1d1e34dd 3154 err = -EMSGSIZE;
79b8b7f4 3155 if (nlh == NULL)
1d1e34dd
DM		 3156 goto out_free_skb;
3157 err = copy_to_user_policy_type(c->data.type, skb);
3158 if (err)
3159 goto out_free_skb;
26b15dad 3160
9825069d 3161 nlmsg_end(skb, nlh);
26b15dad 3162
21ee543e 3163 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
26b15dad 3164
1d1e34dd 3165out_free_skb:
26b15dad 3166 kfree_skb(skb);
1d1e34dd 3167 return err;
26b15dad
JHS		 3168}
3169
214e005b 3170static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
26b15dad
JHS		 3171{
3172
3173 switch (c->event) {
f60f6b8f
HX		 3174 case XFRM_MSG_NEWPOLICY:
3175 case XFRM_MSG_UPDPOLICY:
3176 case XFRM_MSG_DELPOLICY:
26b15dad 3177 return xfrm_notify_policy(xp, dir, c);
f60f6b8f 3178 case XFRM_MSG_FLUSHPOLICY:
26b15dad 3179 return xfrm_notify_policy_flush(c);
f60f6b8f 3180 case XFRM_MSG_POLEXPIRE:
26b15dad
JHS		 3181 return xfrm_exp_policy_notify(xp, dir, c);
3182 default:
62db5cfd 3183 printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
3184 c->event);
26b15dad
JHS		 3185 }
3186
3187 return 0;
3188
3189}
3190
a1b831f2 3191static inline unsigned int xfrm_report_msgsize(void)
7deb2264
TG		 3192{
3193 return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
3194}
3195
97a64b45
MN		 3196static int build_report(struct sk_buff *skb, u8 proto,
3197 struct xfrm_selector *sel, xfrm_address_t *addr)
3198{
3199 struct xfrm_user_report *ur;
3200 struct nlmsghdr *nlh;
97a64b45 3201
79b8b7f4
TG		 3202 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
3203 if (nlh == NULL)
3204 return -EMSGSIZE;
97a64b45 3205
7b67c857 3206 ur = nlmsg_data(nlh);
97a64b45
MN		 3207 ur->proto = proto;
3208 memcpy(&ur->sel, sel, sizeof(ur->sel));
3209
1d1e34dd
DM		 3210 if (addr) {
3211 int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr);
3212 if (err) {
3213 nlmsg_cancel(skb, nlh);
3214 return err;
3215 }
3216 }
053c095a
JB		 3217 nlmsg_end(skb, nlh);
3218 return 0;
97a64b45
MN		 3219}
3220
db983c11
AD		 3221static int xfrm_send_report(struct net *net, u8 proto,
3222 struct xfrm_selector *sel, xfrm_address_t *addr)
97a64b45
MN		 3223{
3224 struct sk_buff *skb;
2fc5f83b 3225 int err;
97a64b45 3226
7deb2264 3227 skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
97a64b45
MN		 3228 if (skb == NULL)
3229 return -ENOMEM;
3230
2fc5f83b
GS		 3231 err = build_report(skb, proto, sel, addr);
3232 BUG_ON(err < 0);
97a64b45 3233
21ee543e 3234 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT);
97a64b45
MN		 3235}
3236
a1b831f2 3237static inline unsigned int xfrm_mapping_msgsize(void)
3a2dfbe8
MW		 3238{
3239 return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
3240}
3241
3242static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
3243 xfrm_address_t *new_saddr, __be16 new_sport)
3244{
3245 struct xfrm_user_mapping *um;
3246 struct nlmsghdr *nlh;
3247
3248 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
3249 if (nlh == NULL)
3250 return -EMSGSIZE;
3251
3252 um = nlmsg_data(nlh);
3253
3254 memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
3255 um->id.spi = x->id.spi;
3256 um->id.family = x->props.family;
3257 um->id.proto = x->id.proto;
3258 memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
3259 memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
3260 um->new_sport = new_sport;
3261 um->old_sport = x->encap->encap_sport;
3262 um->reqid = x->props.reqid;
3263
053c095a
JB		 3264 nlmsg_end(skb, nlh);
3265 return 0;
3a2dfbe8
MW		 3266}
3267
3268static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
3269 __be16 sport)
3270{
a6483b79 3271 struct net *net = xs_net(x);
3a2dfbe8 3272 struct sk_buff *skb;
2fc5f83b 3273 int err;
3a2dfbe8
MW		 3274
3275 if (x->id.proto != IPPROTO_ESP)
3276 return -EINVAL;
3277
3278 if (!x->encap)
3279 return -EINVAL;
3280
3281 skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
3282 if (skb == NULL)
3283 return -ENOMEM;
3284
2fc5f83b
GS		 3285 err = build_mapping(skb, x, ipaddr, sport);
3286 BUG_ON(err < 0);
3a2dfbe8 3287
21ee543e 3288 return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING);
3a2dfbe8
MW		 3289}
3290
0f24558e
HG		 3291static bool xfrm_is_alive(const struct km_event *c)
3292{
3293 return (bool)xfrm_acquire_is_on(c->net);
3294}
3295
1da177e4 3296static struct xfrm_mgr netlink_mgr = {
1da177e4
LT		 3297 .notify = xfrm_send_state_notify,
3298 .acquire = xfrm_send_acquire,
3299 .compile_policy = xfrm_compile_policy,
3300 .notify_policy = xfrm_send_policy_notify,
97a64b45 3301 .report = xfrm_send_report,
5c79de6e 3302 .migrate = xfrm_send_migrate,
3a2dfbe8 3303 .new_mapping = xfrm_send_mapping,
0f24558e 3304 .is_alive = xfrm_is_alive,
1da177e4
LT		 3305};
3306
a6483b79 3307static int __net_init xfrm_user_net_init(struct net *net)
1da177e4 3308{
be33690d 3309 struct sock *nlsk;
a31f2d17
PNA		 3310 struct netlink_kernel_cfg cfg = {
3311 .groups = XFRMNLGRP_MAX,
3312 .input = xfrm_netlink_rcv,
3313 };
be33690d 3314
9f00d977 3315 nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg);
be33690d 3316 if (nlsk == NULL)
1da177e4 3317 return -ENOMEM;
d79d792e 3318 net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
cf778b00 3319 rcu_assign_pointer(net->xfrm.nlsk, nlsk);
1da177e4
LT		 3320 return 0;
3321}
3322
d79d792e 3323static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
1da177e4 3324{
d79d792e
EB		 3325 struct net *net;
3326 list_for_each_entry(net, net_exit_list, exit_list)
a9b3cd7f 3327 RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
d79d792e
EB		 3328 synchronize_net();
3329 list_for_each_entry(net, net_exit_list, exit_list)
3330 netlink_kernel_release(net->xfrm.nlsk_stash);
1da177e4
LT		 3331}
3332
a6483b79 3333static struct pernet_operations xfrm_user_net_ops = {
d79d792e
EB		 3334 .init = xfrm_user_net_init,
3335 .exit_batch = xfrm_user_net_exit,
a6483b79
AD		 3336};
3337
3338static int __init xfrm_user_init(void)
3339{
3340 int rv;
3341
3342 printk(KERN_INFO "Initializing XFRM netlink socket\n");
3343
3344 rv = register_pernet_subsys(&xfrm_user_net_ops);
3345 if (rv < 0)
3346 return rv;
3347 rv = xfrm_register_km(&netlink_mgr);
3348 if (rv < 0)
3349 unregister_pernet_subsys(&xfrm_user_net_ops);
3350 return rv;
3351}
3352
3353static void __exit xfrm_user_exit(void)
3354{
3355 xfrm_unregister_km(&netlink_mgr);
3356 unregister_pernet_subsys(&xfrm_user_net_ops);
3357}
3358
1da177e4
LT		 3359module_init(xfrm_user_init);
3360module_exit(xfrm_user_exit);
3361MODULE_LICENSE("GPL");
4fdb3bb7 3362MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
A mirror of Linus' kernel repository