projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[IPSEC]: Allow async algorithms
[linux-2.6-block.git] / net / xfrm / xfrm_user.c
CommitLineData
1da177e4
LT		 1/* xfrm_user.c: User interface to configure xfrm engine.
2 *
3 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
4 *
5 * Changes:
6 * Mitsuru KANDA @USAGI
7 * Kazunori MIYAZAWA @USAGI
8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9 * IPv6 support
df71837d 10 *
1da177e4
LT		 11 */
12
9409f38a 13#include <linux/crypto.h>
1da177e4
LT		 14#include <linux/module.h>
15#include <linux/kernel.h>
16#include <linux/types.h>
17#include <linux/slab.h>
18#include <linux/socket.h>
19#include <linux/string.h>
20#include <linux/net.h>
21#include <linux/skbuff.h>
1da177e4
LT		 22#include <linux/pfkeyv2.h>
23#include <linux/ipsec.h>
24#include <linux/init.h>
25#include <linux/security.h>
26#include <net/sock.h>
27#include <net/xfrm.h>
88fc2c84 28#include <net/netlink.h>
1da177e4 29#include <asm/uaccess.h>
e23c7194
MN		 30#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
31#include <linux/in6.h>
32#endif
1da177e4 33
5424f32e 34static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
1da177e4 35{
5424f32e 36 struct nlattr *rt = attrs[type];
1da177e4
LT		 37 struct xfrm_algo *algp;
38
39 if (!rt)
40 return 0;
41
5424f32e 42 algp = nla_data(rt);
0f99be0d 43 if (nla_len(rt) < xfrm_alg_len(algp))
31c26852
HX		 44 return -EINVAL;
45
1da177e4
LT		 46 switch (type) {
47 case XFRMA_ALG_AUTH:
48 if (!algp->alg_key_len &&
49 strcmp(algp->alg_name, "digest_null") != 0)
50 return -EINVAL;
51 break;
52
53 case XFRMA_ALG_CRYPT:
54 if (!algp->alg_key_len &&
55 strcmp(algp->alg_name, "cipher_null") != 0)
56 return -EINVAL;
57 break;
58
59 case XFRMA_ALG_COMP:
60 /* Zero length keys are legal. */
61 break;
62
63 default:
64 return -EINVAL;
3ff50b79 65 }
1da177e4
LT		 66
67 algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
68 return 0;
69}
70
5424f32e 71static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
eb2971b6
MN		 72 xfrm_address_t **addrp)
73{
5424f32e 74 struct nlattr *rt = attrs[type];
eb2971b6 75
cf5cb79f 76 if (rt && addrp)
5424f32e 77 *addrp = nla_data(rt);
eb2971b6 78}
df71837d 79
5424f32e 80static inline int verify_sec_ctx_len(struct nlattr **attrs)
df71837d 81{
5424f32e 82 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
df71837d 83 struct xfrm_user_sec_ctx *uctx;
df71837d
TJ		 84
85 if (!rt)
86 return 0;
87
5424f32e 88 uctx = nla_data(rt);
cf5cb79f 89 if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
df71837d
TJ		 90 return -EINVAL;
91
92 return 0;
93}
94
95
1da177e4 96static int verify_newsa_info(struct xfrm_usersa_info *p,
5424f32e 97 struct nlattr **attrs)
1da177e4
LT		 98{
99 int err;
100
101 err = -EINVAL;
102 switch (p->family) {
103 case AF_INET:
104 break;
105
106 case AF_INET6:
107#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
108 break;
109#else
110 err = -EAFNOSUPPORT;
111 goto out;
112#endif
113
114 default:
115 goto out;
3ff50b79 116 }
1da177e4
LT		 117
118 err = -EINVAL;
119 switch (p->id.proto) {
120 case IPPROTO_AH:
35a7aa08
TG		 121 if (!attrs[XFRMA_ALG_AUTH] ||
122 attrs[XFRMA_ALG_CRYPT] ||
123 attrs[XFRMA_ALG_COMP])
1da177e4
LT		 124 goto out;
125 break;
126
127 case IPPROTO_ESP:
35a7aa08
TG		 128 if ((!attrs[XFRMA_ALG_AUTH] &&
129 !attrs[XFRMA_ALG_CRYPT]) ||
130 attrs[XFRMA_ALG_COMP])
1da177e4
LT		 131 goto out;
132 break;
133
134 case IPPROTO_COMP:
35a7aa08
TG		 135 if (!attrs[XFRMA_ALG_COMP] ||
136 attrs[XFRMA_ALG_AUTH] ||
137 attrs[XFRMA_ALG_CRYPT])
1da177e4
LT		 138 goto out;
139 break;
140
e23c7194
MN		 141#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
142 case IPPROTO_DSTOPTS:
143 case IPPROTO_ROUTING:
35a7aa08
TG		 144 if (attrs[XFRMA_ALG_COMP] ||
145 attrs[XFRMA_ALG_AUTH] ||
146 attrs[XFRMA_ALG_CRYPT] ||
147 attrs[XFRMA_ENCAP] ||
148 attrs[XFRMA_SEC_CTX] ||
149 !attrs[XFRMA_COADDR])
e23c7194
MN		 150 goto out;
151 break;
152#endif
153
1da177e4
LT		 154 default:
155 goto out;
3ff50b79 156 }
1da177e4 157
35a7aa08 158 if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
1da177e4 159 goto out;
35a7aa08 160 if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
1da177e4 161 goto out;
35a7aa08 162 if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
1da177e4 163 goto out;
35a7aa08 164 if ((err = verify_sec_ctx_len(attrs)))
df71837d 165 goto out;
1da177e4
LT		 166
167 err = -EINVAL;
168 switch (p->mode) {
7e49e6de
MN		 169 case XFRM_MODE_TRANSPORT:
170 case XFRM_MODE_TUNNEL:
060f02a3 171 case XFRM_MODE_ROUTEOPTIMIZATION:
0a69452c 172 case XFRM_MODE_BEET:
1da177e4
LT		 173 break;
174
175 default:
176 goto out;
3ff50b79 177 }
1da177e4
LT		 178
179 err = 0;
180
181out:
182 return err;
183}
184
185static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
186 struct xfrm_algo_desc *(*get_byname)(char *, int),
5424f32e 187 struct nlattr *rta)
1da177e4 188{
1da177e4
LT		 189 struct xfrm_algo *p, *ualg;
190 struct xfrm_algo_desc *algo;
191
192 if (!rta)
193 return 0;
194
5424f32e 195 ualg = nla_data(rta);
1da177e4
LT		 196
197 algo = get_byname(ualg->alg_name, 1);
198 if (!algo)
199 return -ENOSYS;
200 *props = algo->desc.sadb_alg_id;
201
0f99be0d 202 p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
1da177e4
LT		 203 if (!p)
204 return -ENOMEM;
205
04ff1260 206 strcpy(p->alg_name, algo->name);
1da177e4
LT		 207 *algpp = p;
208 return 0;
209}
210
661697f7 211static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
df71837d 212{
df71837d
TJ		 213 int len = 0;
214
215 if (xfrm_ctx) {
216 len += sizeof(struct xfrm_user_sec_ctx);
217 len += xfrm_ctx->ctx_len;
218 }
219 return len;
220}
221
1da177e4
LT		 222static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
223{
224 memcpy(&x->id, &p->id, sizeof(x->id));
225 memcpy(&x->sel, &p->sel, sizeof(x->sel));
226 memcpy(&x->lft, &p->lft, sizeof(x->lft));
227 x->props.mode = p->mode;
228 x->props.replay_window = p->replay_window;
229 x->props.reqid = p->reqid;
230 x->props.family = p->family;
54489c14 231 memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
1da177e4 232 x->props.flags = p->flags;
196b0036
HX		 233
234 /*
235 * Set inner address family if the KM left it as zero.
236 * See comment in validate_tmpl.
237 */
238 if (!x->sel.family)
239 x->sel.family = p->family;
1da177e4
LT		 240}
241
d51d081d
JHS		 242/*
243 * someday when pfkey also has support, we could have the code
244 * somehow made shareable and move it to xfrm_state.c - JHS
245 *
246*/
5424f32e 247static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
d51d081d 248{
5424f32e
TG		 249 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
250 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
251 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
252 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
d51d081d
JHS		 253
254 if (rp) {
255 struct xfrm_replay_state *replay;
5424f32e 256 replay = nla_data(rp);
d51d081d
JHS		 257 memcpy(&x->replay, replay, sizeof(*replay));
258 memcpy(&x->preplay, replay, sizeof(*replay));
259 }
260
261 if (lt) {
262 struct xfrm_lifetime_cur *ltime;
5424f32e 263 ltime = nla_data(lt);
d51d081d
JHS		 264 x->curlft.bytes = ltime->bytes;
265 x->curlft.packets = ltime->packets;
266 x->curlft.add_time = ltime->add_time;
267 x->curlft.use_time = ltime->use_time;
268 }
269
cf5cb79f 270 if (et)
5424f32e 271 x->replay_maxage = nla_get_u32(et);
d51d081d 272
cf5cb79f 273 if (rt)
5424f32e 274 x->replay_maxdiff = nla_get_u32(rt);
d51d081d
JHS		 275}
276
1da177e4 277static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
5424f32e 278 struct nlattr **attrs,
1da177e4
LT		 279 int *errp)
280{
281 struct xfrm_state *x = xfrm_state_alloc();
282 int err = -ENOMEM;
283
284 if (!x)
285 goto error_no_put;
286
287 copy_from_user_state(x, p);
288
289 if ((err = attach_one_algo(&x->aalg, &x->props.aalgo,
290 xfrm_aalg_get_byname,
35a7aa08 291 attrs[XFRMA_ALG_AUTH])))
1da177e4
LT		 292 goto error;
293 if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
294 xfrm_ealg_get_byname,
35a7aa08 295 attrs[XFRMA_ALG_CRYPT])))
1da177e4
LT		 296 goto error;
297 if ((err = attach_one_algo(&x->calg, &x->props.calgo,
298 xfrm_calg_get_byname,
35a7aa08 299 attrs[XFRMA_ALG_COMP])))
1da177e4 300 goto error;
fd21150a
TG		 301
302 if (attrs[XFRMA_ENCAP]) {
303 x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
304 sizeof(*x->encap), GFP_KERNEL);
305 if (x->encap == NULL)
306 goto error;
307 }
308
309 if (attrs[XFRMA_COADDR]) {
310 x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
311 sizeof(*x->coaddr), GFP_KERNEL);
312 if (x->coaddr == NULL)
313 goto error;
314 }
315
72cb6962 316 err = xfrm_init_state(x);
1da177e4
LT		 317 if (err)
318 goto error;
319
fd21150a
TG		 320 if (attrs[XFRMA_SEC_CTX] &&
321 security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
df71837d
TJ		 322 goto error;
323
1da177e4 324 x->km.seq = p->seq;
d51d081d
JHS		 325 x->replay_maxdiff = sysctl_xfrm_aevent_rseqth;
326 /* sysctl_xfrm_aevent_etime is in 100ms units */
327 x->replay_maxage = (sysctl_xfrm_aevent_etime*HZ)/XFRM_AE_ETH_M;
328 x->preplay.bitmap = 0;
329 x->preplay.seq = x->replay.seq+x->replay_maxdiff;
330 x->preplay.oseq = x->replay.oseq +x->replay_maxdiff;
331
332 /* override default values from above */
333
5424f32e 334 xfrm_update_ae_params(x, attrs);
1da177e4
LT		 335
336 return x;
337
338error:
339 x->km.state = XFRM_STATE_DEAD;
340 xfrm_state_put(x);
341error_no_put:
342 *errp = err;
343 return NULL;
344}
345
22e70050 346static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 347 struct nlattr **attrs)
1da177e4 348{
7b67c857 349 struct xfrm_usersa_info *p = nlmsg_data(nlh);
1da177e4
LT		 350 struct xfrm_state *x;
351 int err;
26b15dad 352 struct km_event c;
1da177e4 353
35a7aa08 354 err = verify_newsa_info(p, attrs);
1da177e4
LT		 355 if (err)
356 return err;
357
35a7aa08 358 x = xfrm_state_construct(p, attrs, &err);
1da177e4
LT		 359 if (!x)
360 return err;
361
26b15dad 362 xfrm_state_hold(x);
1da177e4
LT		 363 if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
364 err = xfrm_state_add(x);
365 else
366 err = xfrm_state_update(x);
367
ab5f5e8b
JL		 368 xfrm_audit_state_add(x, err ? 0 : 1, NETLINK_CB(skb).loginuid,
369 NETLINK_CB(skb).sid);
161a09e7 370
1da177e4
LT		 371 if (err < 0) {
372 x->km.state = XFRM_STATE_DEAD;
21380b81 373 __xfrm_state_put(x);
7d6dfe1f 374 goto out;
1da177e4
LT		 375 }
376
26b15dad
JHS		 377 c.seq = nlh->nlmsg_seq;
378 c.pid = nlh->nlmsg_pid;
f60f6b8f 379 c.event = nlh->nlmsg_type;
26b15dad
JHS		 380
381 km_state_notify(x, &c);
7d6dfe1f 382out:
26b15dad 383 xfrm_state_put(x);
1da177e4
LT		 384 return err;
385}
386
eb2971b6 387static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
5424f32e 388 struct nlattr **attrs,
eb2971b6
MN		 389 int *errp)
390{
391 struct xfrm_state *x = NULL;
392 int err;
393
394 if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
395 err = -ESRCH;
396 x = xfrm_state_lookup(&p->daddr, p->spi, p->proto, p->family);
397 } else {
398 xfrm_address_t *saddr = NULL;
399
35a7aa08 400 verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
eb2971b6
MN		 401 if (!saddr) {
402 err = -EINVAL;
403 goto out;
404 }
405
9abbffee 406 err = -ESRCH;
eb2971b6
MN		 407 x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto,
408 p->family);
409 }
410
411 out:
412 if (!x && errp)
413 *errp = err;
414 return x;
415}
416
22e70050 417static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 418 struct nlattr **attrs)
1da177e4
LT		 419{
420 struct xfrm_state *x;
eb2971b6 421 int err = -ESRCH;
26b15dad 422 struct km_event c;
7b67c857 423 struct xfrm_usersa_id *p = nlmsg_data(nlh);
1da177e4 424
35a7aa08 425 x = xfrm_user_state_lookup(p, attrs, &err);
1da177e4 426 if (x == NULL)
eb2971b6 427 return err;
1da177e4 428
6f68dc37 429 if ((err = security_xfrm_state_delete(x)) != 0)
c8c05a8e
CZ		 430 goto out;
431
1da177e4 432 if (xfrm_state_kern(x)) {
c8c05a8e
CZ		 433 err = -EPERM;
434 goto out;
1da177e4
LT		 435 }
436
26b15dad 437 err = xfrm_state_delete(x);
161a09e7 438
c8c05a8e
CZ		 439 if (err < 0)
440 goto out;
26b15dad
JHS		 441
442 c.seq = nlh->nlmsg_seq;
443 c.pid = nlh->nlmsg_pid;
f60f6b8f 444 c.event = nlh->nlmsg_type;
26b15dad 445 km_state_notify(x, &c);
1da177e4 446
c8c05a8e 447out:
ab5f5e8b
JL		 448 xfrm_audit_state_delete(x, err ? 0 : 1, NETLINK_CB(skb).loginuid,
449 NETLINK_CB(skb).sid);
c8c05a8e 450 xfrm_state_put(x);
26b15dad 451 return err;
1da177e4
LT		 452}
453
454static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
455{
456 memcpy(&p->id, &x->id, sizeof(p->id));
457 memcpy(&p->sel, &x->sel, sizeof(p->sel));
458 memcpy(&p->lft, &x->lft, sizeof(p->lft));
459 memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
460 memcpy(&p->stats, &x->stats, sizeof(p->stats));
54489c14 461 memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
1da177e4
LT		 462 p->mode = x->props.mode;
463 p->replay_window = x->props.replay_window;
464 p->reqid = x->props.reqid;
465 p->family = x->props.family;
466 p->flags = x->props.flags;
467 p->seq = x->km.seq;
468}
469
470struct xfrm_dump_info {
471 struct sk_buff *in_skb;
472 struct sk_buff *out_skb;
473 u32 nlmsg_seq;
474 u16 nlmsg_flags;
475 int start_idx;
476 int this_idx;
477};
478
c0144bea
TG		 479static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
480{
c0144bea
TG		 481 struct xfrm_user_sec_ctx *uctx;
482 struct nlattr *attr;
68325d3b 483 int ctx_size = sizeof(*uctx) + s->ctx_len;
c0144bea
TG		 484
485 attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
486 if (attr == NULL)
487 return -EMSGSIZE;
488
489 uctx = nla_data(attr);
490 uctx->exttype = XFRMA_SEC_CTX;
491 uctx->len = ctx_size;
492 uctx->ctx_doi = s->ctx_doi;
493 uctx->ctx_alg = s->ctx_alg;
494 uctx->ctx_len = s->ctx_len;
495 memcpy(uctx + 1, s->ctx_str, s->ctx_len);
496
497 return 0;
498}
499
68325d3b
HX		 500/* Don't change this without updating xfrm_sa_len! */
501static int copy_to_user_state_extra(struct xfrm_state *x,
502 struct xfrm_usersa_info *p,
503 struct sk_buff *skb)
1da177e4 504{
1da177e4
LT		 505 copy_to_user_state(x, p);
506
050f009e
HX		 507 if (x->coaddr)
508 NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
509
510 if (x->lastused)
511 NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
050f009e 512
1da177e4 513 if (x->aalg)
0f99be0d 514 NLA_PUT(skb, XFRMA_ALG_AUTH, xfrm_alg_len(x->aalg), x->aalg);
1da177e4 515 if (x->ealg)
0f99be0d 516 NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
1da177e4 517 if (x->calg)
c0144bea 518 NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
1da177e4
LT		 519
520 if (x->encap)
c0144bea 521 NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
1da177e4 522
c0144bea
TG		 523 if (x->security && copy_sec_ctx(x->security, skb) < 0)
524 goto nla_put_failure;
060f02a3 525
68325d3b
HX		 526 return 0;
527
528nla_put_failure:
529 return -EMSGSIZE;
530}
531
532static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
533{
534 struct xfrm_dump_info *sp = ptr;
535 struct sk_buff *in_skb = sp->in_skb;
536 struct sk_buff *skb = sp->out_skb;
537 struct xfrm_usersa_info *p;
538 struct nlmsghdr *nlh;
539 int err;
540
541 if (sp->this_idx < sp->start_idx)
542 goto out;
543
544 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
545 XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
546 if (nlh == NULL)
547 return -EMSGSIZE;
548
549 p = nlmsg_data(nlh);
550
551 err = copy_to_user_state_extra(x, p, skb);
552 if (err)
553 goto nla_put_failure;
554
9825069d 555 nlmsg_end(skb, nlh);
1da177e4
LT		 556out:
557 sp->this_idx++;
558 return 0;
559
c0144bea 560nla_put_failure:
9825069d 561 nlmsg_cancel(skb, nlh);
68325d3b 562 return err;
1da177e4
LT		 563}
564
565static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
566{
567 struct xfrm_dump_info info;
568
569 info.in_skb = cb->skb;
570 info.out_skb = skb;
571 info.nlmsg_seq = cb->nlh->nlmsg_seq;
572 info.nlmsg_flags = NLM_F_MULTI;
573 info.this_idx = 0;
574 info.start_idx = cb->args[0];
dc00a525 575 (void) xfrm_state_walk(0, dump_one_state, &info);
1da177e4
LT		 576 cb->args[0] = info.this_idx;
577
578 return skb->len;
579}
580
581static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
582 struct xfrm_state *x, u32 seq)
583{
584 struct xfrm_dump_info info;
585 struct sk_buff *skb;
586
7deb2264 587 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1da177e4
LT		 588 if (!skb)
589 return ERR_PTR(-ENOMEM);
590
1da177e4
LT		 591 info.in_skb = in_skb;
592 info.out_skb = skb;
593 info.nlmsg_seq = seq;
594 info.nlmsg_flags = 0;
595 info.this_idx = info.start_idx = 0;
596
597 if (dump_one_state(x, 0, &info)) {
598 kfree_skb(skb);
599 return NULL;
600 }
601
602 return skb;
603}
604
7deb2264
TG		 605static inline size_t xfrm_spdinfo_msgsize(void)
606{
607 return NLMSG_ALIGN(4)
608 + nla_total_size(sizeof(struct xfrmu_spdinfo))
609 + nla_total_size(sizeof(struct xfrmu_spdhinfo));
610}
611
ecfd6b18
JHS		 612static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
613{
5a6d3416
JHS		 614 struct xfrmk_spdinfo si;
615 struct xfrmu_spdinfo spc;
616 struct xfrmu_spdhinfo sph;
ecfd6b18
JHS		 617 struct nlmsghdr *nlh;
618 u32 *f;
619
620 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
621 if (nlh == NULL) /* shouldnt really happen ... */
622 return -EMSGSIZE;
623
624 f = nlmsg_data(nlh);
625 *f = flags;
626 xfrm_spd_getinfo(&si);
5a6d3416
JHS		 627 spc.incnt = si.incnt;
628 spc.outcnt = si.outcnt;
629 spc.fwdcnt = si.fwdcnt;
630 spc.inscnt = si.inscnt;
631 spc.outscnt = si.outscnt;
632 spc.fwdscnt = si.fwdscnt;
633 sph.spdhcnt = si.spdhcnt;
634 sph.spdhmcnt = si.spdhmcnt;
635
636 NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
637 NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
ecfd6b18
JHS		 638
639 return nlmsg_end(skb, nlh);
640
641nla_put_failure:
642 nlmsg_cancel(skb, nlh);
643 return -EMSGSIZE;
644}
645
646static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 647 struct nlattr **attrs)
ecfd6b18
JHS		 648{
649 struct sk_buff *r_skb;
7b67c857 650 u32 *flags = nlmsg_data(nlh);
ecfd6b18
JHS		 651 u32 spid = NETLINK_CB(skb).pid;
652 u32 seq = nlh->nlmsg_seq;
ecfd6b18 653
7deb2264 654 r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
ecfd6b18
JHS		 655 if (r_skb == NULL)
656 return -ENOMEM;
657
658 if (build_spdinfo(r_skb, spid, seq, *flags) < 0)
659 BUG();
660
661 return nlmsg_unicast(xfrm_nl, r_skb, spid);
662}
663
7deb2264
TG		 664static inline size_t xfrm_sadinfo_msgsize(void)
665{
666 return NLMSG_ALIGN(4)
667 + nla_total_size(sizeof(struct xfrmu_sadhinfo))
668 + nla_total_size(4); /* XFRMA_SAD_CNT */
669}
670
28d8909b
JHS		 671static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
672{
af11e316
JHS		 673 struct xfrmk_sadinfo si;
674 struct xfrmu_sadhinfo sh;
28d8909b
JHS		 675 struct nlmsghdr *nlh;
676 u32 *f;
677
678 nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
679 if (nlh == NULL) /* shouldnt really happen ... */
680 return -EMSGSIZE;
681
682 f = nlmsg_data(nlh);
683 *f = flags;
684 xfrm_sad_getinfo(&si);
685
af11e316
JHS		 686 sh.sadhmcnt = si.sadhmcnt;
687 sh.sadhcnt = si.sadhcnt;
688
689 NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
690 NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
28d8909b
JHS		 691
692 return nlmsg_end(skb, nlh);
693
694nla_put_failure:
695 nlmsg_cancel(skb, nlh);
696 return -EMSGSIZE;
697}
698
699static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 700 struct nlattr **attrs)
28d8909b
JHS		 701{
702 struct sk_buff *r_skb;
7b67c857 703 u32 *flags = nlmsg_data(nlh);
28d8909b
JHS		 704 u32 spid = NETLINK_CB(skb).pid;
705 u32 seq = nlh->nlmsg_seq;
28d8909b 706
7deb2264 707 r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
28d8909b
JHS		 708 if (r_skb == NULL)
709 return -ENOMEM;
710
711 if (build_sadinfo(r_skb, spid, seq, *flags) < 0)
712 BUG();
713
714 return nlmsg_unicast(xfrm_nl, r_skb, spid);
715}
716
22e70050 717static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 718 struct nlattr **attrs)
1da177e4 719{
7b67c857 720 struct xfrm_usersa_id *p = nlmsg_data(nlh);
1da177e4
LT		 721 struct xfrm_state *x;
722 struct sk_buff *resp_skb;
eb2971b6 723 int err = -ESRCH;
1da177e4 724
35a7aa08 725 x = xfrm_user_state_lookup(p, attrs, &err);
1da177e4
LT		 726 if (x == NULL)
727 goto out_noput;
728
729 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
730 if (IS_ERR(resp_skb)) {
731 err = PTR_ERR(resp_skb);
732 } else {
082a1ad5 733 err = nlmsg_unicast(xfrm_nl, resp_skb, NETLINK_CB(skb).pid);
1da177e4
LT		 734 }
735 xfrm_state_put(x);
736out_noput:
737 return err;
738}
739
740static int verify_userspi_info(struct xfrm_userspi_info *p)
741{
742 switch (p->info.id.proto) {
743 case IPPROTO_AH:
744 case IPPROTO_ESP:
745 break;
746
747 case IPPROTO_COMP:
748 /* IPCOMP spi is 16-bits. */
749 if (p->max >= 0x10000)
750 return -EINVAL;
751 break;
752
753 default:
754 return -EINVAL;
3ff50b79 755 }
1da177e4
LT		 756
757 if (p->min > p->max)
758 return -EINVAL;
759
760 return 0;
761}
762
22e70050 763static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 764 struct nlattr **attrs)
1da177e4
LT		 765{
766 struct xfrm_state *x;
767 struct xfrm_userspi_info *p;
768 struct sk_buff *resp_skb;
769 xfrm_address_t *daddr;
770 int family;
771 int err;
772
7b67c857 773 p = nlmsg_data(nlh);
1da177e4
LT		 774 err = verify_userspi_info(p);
775 if (err)
776 goto out_noput;
777
778 family = p->info.family;
779 daddr = &p->info.id.daddr;
780
781 x = NULL;
782 if (p->info.seq) {
783 x = xfrm_find_acq_byseq(p->info.seq);
784 if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
785 xfrm_state_put(x);
786 x = NULL;
787 }
788 }
789
790 if (!x)
791 x = xfrm_find_acq(p->info.mode, p->info.reqid,
792 p->info.id.proto, daddr,
793 &p->info.saddr, 1,
794 family);
795 err = -ENOENT;
796 if (x == NULL)
797 goto out_noput;
798
658b219e
HX		 799 err = xfrm_alloc_spi(x, p->min, p->max);
800 if (err)
801 goto out;
1da177e4 802
658b219e 803 resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
1da177e4
LT		 804 if (IS_ERR(resp_skb)) {
805 err = PTR_ERR(resp_skb);
806 goto out;
807 }
808
082a1ad5 809 err = nlmsg_unicast(xfrm_nl, resp_skb, NETLINK_CB(skb).pid);
1da177e4
LT		 810
811out:
812 xfrm_state_put(x);
813out_noput:
814 return err;
815}
816
b798a9ed 817static int verify_policy_dir(u8 dir)
1da177e4
LT		 818{
819 switch (dir) {
820 case XFRM_POLICY_IN:
821 case XFRM_POLICY_OUT:
822 case XFRM_POLICY_FWD:
823 break;
824
825 default:
826 return -EINVAL;
3ff50b79 827 }
1da177e4
LT		 828
829 return 0;
830}
831
b798a9ed 832static int verify_policy_type(u8 type)
f7b6983f
MN		 833{
834 switch (type) {
835 case XFRM_POLICY_TYPE_MAIN:
836#ifdef CONFIG_XFRM_SUB_POLICY
837 case XFRM_POLICY_TYPE_SUB:
838#endif
839 break;
840
841 default:
842 return -EINVAL;
3ff50b79 843 }
f7b6983f
MN		 844
845 return 0;
846}
847
1da177e4
LT		 848static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
849{
850 switch (p->share) {
851 case XFRM_SHARE_ANY:
852 case XFRM_SHARE_SESSION:
853 case XFRM_SHARE_USER:
854 case XFRM_SHARE_UNIQUE:
855 break;
856
857 default:
858 return -EINVAL;
3ff50b79 859 }
1da177e4
LT		 860
861 switch (p->action) {
862 case XFRM_POLICY_ALLOW:
863 case XFRM_POLICY_BLOCK:
864 break;
865
866 default:
867 return -EINVAL;
3ff50b79 868 }
1da177e4
LT		 869
870 switch (p->sel.family) {
871 case AF_INET:
872 break;
873
874 case AF_INET6:
875#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
876 break;
877#else
878 return -EAFNOSUPPORT;
879#endif
880
881 default:
882 return -EINVAL;
3ff50b79 883 }
1da177e4
LT		 884
885 return verify_policy_dir(p->dir);
886}
887
5424f32e 888static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
df71837d 889{
5424f32e 890 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
df71837d
TJ		 891 struct xfrm_user_sec_ctx *uctx;
892
893 if (!rt)
894 return 0;
895
5424f32e 896 uctx = nla_data(rt);
df71837d
TJ		 897 return security_xfrm_policy_alloc(pol, uctx);
898}
899
1da177e4
LT		 900static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
901 int nr)
902{
903 int i;
904
905 xp->xfrm_nr = nr;
906 for (i = 0; i < nr; i++, ut++) {
907 struct xfrm_tmpl *t = &xp->xfrm_vec[i];
908
909 memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
910 memcpy(&t->saddr, &ut->saddr,
911 sizeof(xfrm_address_t));
912 t->reqid = ut->reqid;
913 t->mode = ut->mode;
914 t->share = ut->share;
915 t->optional = ut->optional;
916 t->aalgos = ut->aalgos;
917 t->ealgos = ut->ealgos;
918 t->calgos = ut->calgos;
8511d01d 919 t->encap_family = ut->family;
1da177e4
LT		 920 }
921}
922
b4ad86bf
DM		 923static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
924{
925 int i;
926
927 if (nr > XFRM_MAX_DEPTH)
928 return -EINVAL;
929
930 for (i = 0; i < nr; i++) {
931 /* We never validated the ut->family value, so many
932 * applications simply leave it at zero. The check was
933 * never made and ut->family was ignored because all
934 * templates could be assumed to have the same family as
935 * the policy itself. Now that we will have ipv4-in-ipv6
936 * and ipv6-in-ipv4 tunnels, this is no longer true.
937 */
938 if (!ut[i].family)
939 ut[i].family = family;
940
941 switch (ut[i].family) {
942 case AF_INET:
943 break;
944#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
945 case AF_INET6:
946 break;
947#endif
948 default:
949 return -EINVAL;
3ff50b79 950 }
b4ad86bf
DM		 951 }
952
953 return 0;
954}
955
5424f32e 956static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
1da177e4 957{
5424f32e 958 struct nlattr *rt = attrs[XFRMA_TMPL];
1da177e4
LT		 959
960 if (!rt) {
961 pol->xfrm_nr = 0;
962 } else {
5424f32e
TG		 963 struct xfrm_user_tmpl *utmpl = nla_data(rt);
964 int nr = nla_len(rt) / sizeof(*utmpl);
b4ad86bf 965 int err;
1da177e4 966
b4ad86bf
DM		 967 err = validate_tmpl(nr, utmpl, pol->family);
968 if (err)
969 return err;
1da177e4 970
5424f32e 971 copy_templates(pol, utmpl, nr);
1da177e4
LT		 972 }
973 return 0;
974}
975
5424f32e 976static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
f7b6983f 977{
5424f32e 978 struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
f7b6983f 979 struct xfrm_userpolicy_type *upt;
b798a9ed 980 u8 type = XFRM_POLICY_TYPE_MAIN;
f7b6983f
MN		 981 int err;
982
983 if (rt) {
5424f32e 984 upt = nla_data(rt);
f7b6983f
MN		 985 type = upt->type;
986 }
987
988 err = verify_policy_type(type);
989 if (err)
990 return err;
991
992 *tp = type;
993 return 0;
994}
995
1da177e4
LT		 996static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
997{
998 xp->priority = p->priority;
999 xp->index = p->index;
1000 memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
1001 memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
1002 xp->action = p->action;
1003 xp->flags = p->flags;
1004 xp->family = p->sel.family;
1005 /* XXX xp->share = p->share; */
1006}
1007
1008static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
1009{
1010 memcpy(&p->sel, &xp->selector, sizeof(p->sel));
1011 memcpy(&p->lft, &xp->lft, sizeof(p->lft));
1012 memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
1013 p->priority = xp->priority;
1014 p->index = xp->index;
1015 p->sel.family = xp->family;
1016 p->dir = dir;
1017 p->action = xp->action;
1018 p->flags = xp->flags;
1019 p->share = XFRM_SHARE_ANY; /* XXX xp->share */
1020}
1021
5424f32e 1022static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
1da177e4
LT		 1023{
1024 struct xfrm_policy *xp = xfrm_policy_alloc(GFP_KERNEL);
1025 int err;
1026
1027 if (!xp) {
1028 *errp = -ENOMEM;
1029 return NULL;
1030 }
1031
1032 copy_from_user_policy(xp, p);
df71837d 1033
35a7aa08 1034 err = copy_from_user_policy_type(&xp->type, attrs);
f7b6983f
MN		 1035 if (err)
1036 goto error;
1037
35a7aa08
TG		 1038 if (!(err = copy_from_user_tmpl(xp, attrs)))
1039 err = copy_from_user_sec_ctx(xp, attrs);
f7b6983f
MN		 1040 if (err)
1041 goto error;
1da177e4
LT		 1042
1043 return xp;
f7b6983f
MN		 1044 error:
1045 *errp = err;
64c31b3f 1046 xfrm_policy_destroy(xp);
f7b6983f 1047 return NULL;
1da177e4
LT		 1048}
1049
22e70050 1050static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1051 struct nlattr **attrs)
1da177e4 1052{
7b67c857 1053 struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
1da177e4 1054 struct xfrm_policy *xp;
26b15dad 1055 struct km_event c;
1da177e4
LT		 1056 int err;
1057 int excl;
1058
1059 err = verify_newpolicy_info(p);
df71837d
TJ		 1060 if (err)
1061 return err;
35a7aa08 1062 err = verify_sec_ctx_len(attrs);
1da177e4
LT		 1063 if (err)
1064 return err;
1065
35a7aa08 1066 xp = xfrm_policy_construct(p, attrs, &err);
1da177e4
LT		 1067 if (!xp)
1068 return err;
1069
26b15dad
JHS		 1070 /* shouldnt excl be based on nlh flags??
1071 * Aha! this is anti-netlink really i.e more pfkey derived
1072 * in netlink excl is a flag and you wouldnt need
1073 * a type XFRM_MSG_UPDPOLICY - JHS */
1da177e4
LT		 1074 excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
1075 err = xfrm_policy_insert(p->dir, xp, excl);
ab5f5e8b
JL		 1076 xfrm_audit_policy_add(xp, err ? 0 : 1, NETLINK_CB(skb).loginuid,
1077 NETLINK_CB(skb).sid);
161a09e7 1078
1da177e4 1079 if (err) {
5f8ac64b 1080 security_xfrm_policy_free(xp);
1da177e4
LT		 1081 kfree(xp);
1082 return err;
1083 }
1084
f60f6b8f 1085 c.event = nlh->nlmsg_type;
26b15dad
JHS		 1086 c.seq = nlh->nlmsg_seq;
1087 c.pid = nlh->nlmsg_pid;
1088 km_policy_notify(xp, p->dir, &c);
1089
1da177e4
LT		 1090 xfrm_pol_put(xp);
1091
1092 return 0;
1093}
1094
1095static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
1096{
1097 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
1098 int i;
1099
1100 if (xp->xfrm_nr == 0)
1101 return 0;
1102
1103 for (i = 0; i < xp->xfrm_nr; i++) {
1104 struct xfrm_user_tmpl *up = &vec[i];
1105 struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
1106
1107 memcpy(&up->id, &kp->id, sizeof(up->id));
8511d01d 1108 up->family = kp->encap_family;
1da177e4
LT		 1109 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
1110 up->reqid = kp->reqid;
1111 up->mode = kp->mode;
1112 up->share = kp->share;
1113 up->optional = kp->optional;
1114 up->aalgos = kp->aalgos;
1115 up->ealgos = kp->ealgos;
1116 up->calgos = kp->calgos;
1117 }
df71837d 1118
c0144bea
TG		 1119 return nla_put(skb, XFRMA_TMPL,
1120 sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
0d681623
SH		 1121}
1122
1123static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
1124{
1125 if (x->security) {
1126 return copy_sec_ctx(x->security, skb);
df71837d
TJ		 1127 }
1128 return 0;
0d681623 1129}
df71837d 1130
0d681623
SH		 1131static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
1132{
1133 if (xp->security) {
1134 return copy_sec_ctx(xp->security, skb);
1135 }
1136 return 0;
df71837d 1137}
cfbfd45a
TG		 1138static inline size_t userpolicy_type_attrsize(void)
1139{
1140#ifdef CONFIG_XFRM_SUB_POLICY
1141 return nla_total_size(sizeof(struct xfrm_userpolicy_type));
1142#else
1143 return 0;
1144#endif
1145}
df71837d 1146
f7b6983f 1147#ifdef CONFIG_XFRM_SUB_POLICY
b798a9ed 1148static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
f7b6983f 1149{
c0144bea
TG		 1150 struct xfrm_userpolicy_type upt = {
1151 .type = type,
1152 };
f7b6983f 1153
c0144bea 1154 return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
f7b6983f
MN		 1155}
1156
1157#else
b798a9ed 1158static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
f7b6983f
MN		 1159{
1160 return 0;
1161}
1162#endif
1163
1da177e4
LT		 1164static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
1165{
1166 struct xfrm_dump_info *sp = ptr;
1167 struct xfrm_userpolicy_info *p;
1168 struct sk_buff *in_skb = sp->in_skb;
1169 struct sk_buff *skb = sp->out_skb;
1170 struct nlmsghdr *nlh;
1da177e4
LT		 1171
1172 if (sp->this_idx < sp->start_idx)
1173 goto out;
1174
79b8b7f4
TG		 1175 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
1176 XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
1177 if (nlh == NULL)
1178 return -EMSGSIZE;
1da177e4 1179
7b67c857 1180 p = nlmsg_data(nlh);
1da177e4
LT		 1181 copy_to_user_policy(xp, p, dir);
1182 if (copy_to_user_tmpl(xp, skb) < 0)
1183 goto nlmsg_failure;
df71837d
TJ		 1184 if (copy_to_user_sec_ctx(xp, skb))
1185 goto nlmsg_failure;
1459bb36 1186 if (copy_to_user_policy_type(xp->type, skb) < 0)
f7b6983f 1187 goto nlmsg_failure;
1da177e4 1188
9825069d 1189 nlmsg_end(skb, nlh);
1da177e4
LT		 1190out:
1191 sp->this_idx++;
1192 return 0;
1193
1194nlmsg_failure:
9825069d
TG		 1195 nlmsg_cancel(skb, nlh);
1196 return -EMSGSIZE;
1da177e4
LT		 1197}
1198
1199static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
1200{
1201 struct xfrm_dump_info info;
1202
1203 info.in_skb = cb->skb;
1204 info.out_skb = skb;
1205 info.nlmsg_seq = cb->nlh->nlmsg_seq;
1206 info.nlmsg_flags = NLM_F_MULTI;
1207 info.this_idx = 0;
1208 info.start_idx = cb->args[0];
f7b6983f
MN		 1209 (void) xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_one_policy, &info);
1210#ifdef CONFIG_XFRM_SUB_POLICY
1211 (void) xfrm_policy_walk(XFRM_POLICY_TYPE_SUB, dump_one_policy, &info);
1212#endif
1da177e4
LT		 1213 cb->args[0] = info.this_idx;
1214
1215 return skb->len;
1216}
1217
1218static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
1219 struct xfrm_policy *xp,
1220 int dir, u32 seq)
1221{
1222 struct xfrm_dump_info info;
1223 struct sk_buff *skb;
1224
7deb2264 1225 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1da177e4
LT		 1226 if (!skb)
1227 return ERR_PTR(-ENOMEM);
1228
1da177e4
LT		 1229 info.in_skb = in_skb;
1230 info.out_skb = skb;
1231 info.nlmsg_seq = seq;
1232 info.nlmsg_flags = 0;
1233 info.this_idx = info.start_idx = 0;
1234
1235 if (dump_one_policy(xp, dir, 0, &info) < 0) {
1236 kfree_skb(skb);
1237 return NULL;
1238 }
1239
1240 return skb;
1241}
1242
22e70050 1243static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1244 struct nlattr **attrs)
1da177e4
LT		 1245{
1246 struct xfrm_policy *xp;
1247 struct xfrm_userpolicy_id *p;
b798a9ed 1248 u8 type = XFRM_POLICY_TYPE_MAIN;
1da177e4 1249 int err;
26b15dad 1250 struct km_event c;
1da177e4
LT		 1251 int delete;
1252
7b67c857 1253 p = nlmsg_data(nlh);
1da177e4
LT		 1254 delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
1255
35a7aa08 1256 err = copy_from_user_policy_type(&type, attrs);
f7b6983f
MN		 1257 if (err)
1258 return err;
1259
1da177e4
LT		 1260 err = verify_policy_dir(p->dir);
1261 if (err)
1262 return err;
1263
1264 if (p->index)
ef41aaa0 1265 xp = xfrm_policy_byid(type, p->dir, p->index, delete, &err);
df71837d 1266 else {
5424f32e 1267 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
df71837d
TJ		 1268 struct xfrm_policy tmp;
1269
35a7aa08 1270 err = verify_sec_ctx_len(attrs);
df71837d
TJ		 1271 if (err)
1272 return err;
1273
1274 memset(&tmp, 0, sizeof(struct xfrm_policy));
1275 if (rt) {
5424f32e 1276 struct xfrm_user_sec_ctx *uctx = nla_data(rt);
df71837d
TJ		 1277
1278 if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
1279 return err;
1280 }
ef41aaa0
EP		 1281 xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
1282 delete, &err);
df71837d
TJ		 1283 security_xfrm_policy_free(&tmp);
1284 }
1da177e4
LT		 1285 if (xp == NULL)
1286 return -ENOENT;
1287
1288 if (!delete) {
1289 struct sk_buff *resp_skb;
1290
1291 resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
1292 if (IS_ERR(resp_skb)) {
1293 err = PTR_ERR(resp_skb);
1294 } else {
082a1ad5
TG		 1295 err = nlmsg_unicast(xfrm_nl, resp_skb,
1296 NETLINK_CB(skb).pid);
1da177e4 1297 }
26b15dad 1298 } else {
ab5f5e8b
JL		 1299 xfrm_audit_policy_delete(xp, err ? 0 : 1,
1300 NETLINK_CB(skb).loginuid,
1301 NETLINK_CB(skb).sid);
13fcfbb0
DM		 1302
1303 if (err != 0)
c8c05a8e 1304 goto out;
13fcfbb0 1305
e7443892 1306 c.data.byid = p->index;
f60f6b8f 1307 c.event = nlh->nlmsg_type;
26b15dad
JHS		 1308 c.seq = nlh->nlmsg_seq;
1309 c.pid = nlh->nlmsg_pid;
1310 km_policy_notify(xp, p->dir, &c);
1da177e4
LT		 1311 }
1312
c8c05a8e 1313out:
ef41aaa0 1314 xfrm_pol_put(xp);
1da177e4
LT		 1315 return err;
1316}
1317
22e70050 1318static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1319 struct nlattr **attrs)
1da177e4 1320{
26b15dad 1321 struct km_event c;
7b67c857 1322 struct xfrm_usersa_flush *p = nlmsg_data(nlh);
161a09e7 1323 struct xfrm_audit audit_info;
4aa2e62c 1324 int err;
1da177e4 1325
161a09e7
JL		 1326 audit_info.loginuid = NETLINK_CB(skb).loginuid;
1327 audit_info.secid = NETLINK_CB(skb).sid;
4aa2e62c
JL		 1328 err = xfrm_state_flush(p->proto, &audit_info);
1329 if (err)
1330 return err;
bf08867f 1331 c.data.proto = p->proto;
f60f6b8f 1332 c.event = nlh->nlmsg_type;
26b15dad
JHS		 1333 c.seq = nlh->nlmsg_seq;
1334 c.pid = nlh->nlmsg_pid;
1335 km_state_notify(NULL, &c);
1336
1da177e4
LT		 1337 return 0;
1338}
1339
7deb2264
TG		 1340static inline size_t xfrm_aevent_msgsize(void)
1341{
1342 return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
1343 + nla_total_size(sizeof(struct xfrm_replay_state))
1344 + nla_total_size(sizeof(struct xfrm_lifetime_cur))
1345 + nla_total_size(4) /* XFRM_AE_RTHR */
1346 + nla_total_size(4); /* XFRM_AE_ETHR */
1347}
d51d081d
JHS		 1348
1349static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
1350{
1351 struct xfrm_aevent_id *id;
1352 struct nlmsghdr *nlh;
d51d081d 1353
79b8b7f4
TG		 1354 nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
1355 if (nlh == NULL)
1356 return -EMSGSIZE;
d51d081d 1357
7b67c857 1358 id = nlmsg_data(nlh);
2b5f6dcc 1359 memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
d51d081d
JHS		 1360 id->sa_id.spi = x->id.spi;
1361 id->sa_id.family = x->props.family;
1362 id->sa_id.proto = x->id.proto;
2b5f6dcc
JHS		 1363 memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
1364 id->reqid = x->props.reqid;
d51d081d
JHS		 1365 id->flags = c->data.aevent;
1366
c0144bea
TG		 1367 NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
1368 NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
d51d081d 1369
c0144bea
TG		 1370 if (id->flags & XFRM_AE_RTHR)
1371 NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
d51d081d 1372
c0144bea
TG		 1373 if (id->flags & XFRM_AE_ETHR)
1374 NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
1375 x->replay_maxage * 10 / HZ);
d51d081d 1376
9825069d 1377 return nlmsg_end(skb, nlh);
d51d081d 1378
c0144bea 1379nla_put_failure:
9825069d
TG		 1380 nlmsg_cancel(skb, nlh);
1381 return -EMSGSIZE;
d51d081d
JHS		 1382}
1383
22e70050 1384static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1385 struct nlattr **attrs)
d51d081d
JHS		 1386{
1387 struct xfrm_state *x;
1388 struct sk_buff *r_skb;
1389 int err;
1390 struct km_event c;
7b67c857 1391 struct xfrm_aevent_id *p = nlmsg_data(nlh);
d51d081d
JHS		 1392 struct xfrm_usersa_id *id = &p->sa_id;
1393
7deb2264 1394 r_skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
d51d081d
JHS		 1395 if (r_skb == NULL)
1396 return -ENOMEM;
1397
1398 x = xfrm_state_lookup(&id->daddr, id->spi, id->proto, id->family);
1399 if (x == NULL) {
b08d5840 1400 kfree_skb(r_skb);
d51d081d
JHS		 1401 return -ESRCH;
1402 }
1403
1404 /*
1405 * XXX: is this lock really needed - none of the other
1406 * gets lock (the concern is things getting updated
1407 * while we are still reading) - jhs
1408 */
1409 spin_lock_bh(&x->lock);
1410 c.data.aevent = p->flags;
1411 c.seq = nlh->nlmsg_seq;
1412 c.pid = nlh->nlmsg_pid;
1413
1414 if (build_aevent(r_skb, x, &c) < 0)
1415 BUG();
082a1ad5 1416 err = nlmsg_unicast(xfrm_nl, r_skb, NETLINK_CB(skb).pid);
d51d081d
JHS		 1417 spin_unlock_bh(&x->lock);
1418 xfrm_state_put(x);
1419 return err;
1420}
1421
22e70050 1422static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1423 struct nlattr **attrs)
d51d081d
JHS		 1424{
1425 struct xfrm_state *x;
1426 struct km_event c;
1427 int err = - EINVAL;
7b67c857 1428 struct xfrm_aevent_id *p = nlmsg_data(nlh);
5424f32e
TG		 1429 struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
1430 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
d51d081d
JHS		 1431
1432 if (!lt && !rp)
1433 return err;
1434
1435 /* pedantic mode - thou shalt sayeth replaceth */
1436 if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
1437 return err;
1438
1439 x = xfrm_state_lookup(&p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
1440 if (x == NULL)
1441 return -ESRCH;
1442
1443 if (x->km.state != XFRM_STATE_VALID)
1444 goto out;
1445
1446 spin_lock_bh(&x->lock);
35a7aa08 1447 xfrm_update_ae_params(x, attrs);
d51d081d 1448 spin_unlock_bh(&x->lock);
d51d081d
JHS		 1449
1450 c.event = nlh->nlmsg_type;
1451 c.seq = nlh->nlmsg_seq;
1452 c.pid = nlh->nlmsg_pid;
1453 c.data.aevent = XFRM_AE_CU;
1454 km_state_notify(x, &c);
1455 err = 0;
1456out:
1457 xfrm_state_put(x);
1458 return err;
1459}
1460
22e70050 1461static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1462 struct nlattr **attrs)
1da177e4 1463{
f7b6983f 1464 struct km_event c;
b798a9ed 1465 u8 type = XFRM_POLICY_TYPE_MAIN;
f7b6983f 1466 int err;
161a09e7 1467 struct xfrm_audit audit_info;
f7b6983f 1468
35a7aa08 1469 err = copy_from_user_policy_type(&type, attrs);
f7b6983f
MN		 1470 if (err)
1471 return err;
26b15dad 1472
161a09e7
JL		 1473 audit_info.loginuid = NETLINK_CB(skb).loginuid;
1474 audit_info.secid = NETLINK_CB(skb).sid;
4aa2e62c
JL		 1475 err = xfrm_policy_flush(type, &audit_info);
1476 if (err)
1477 return err;
f7b6983f 1478 c.data.type = type;
f60f6b8f 1479 c.event = nlh->nlmsg_type;
26b15dad
JHS		 1480 c.seq = nlh->nlmsg_seq;
1481 c.pid = nlh->nlmsg_pid;
1482 km_policy_notify(NULL, 0, &c);
1da177e4
LT		 1483 return 0;
1484}
1485
22e70050 1486static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1487 struct nlattr **attrs)
6c5c8ca7
JHS		 1488{
1489 struct xfrm_policy *xp;
7b67c857 1490 struct xfrm_user_polexpire *up = nlmsg_data(nlh);
6c5c8ca7 1491 struct xfrm_userpolicy_info *p = &up->pol;
b798a9ed 1492 u8 type = XFRM_POLICY_TYPE_MAIN;
6c5c8ca7
JHS		 1493 int err = -ENOENT;
1494
35a7aa08 1495 err = copy_from_user_policy_type(&type, attrs);
f7b6983f
MN		 1496 if (err)
1497 return err;
1498
6c5c8ca7 1499 if (p->index)
ef41aaa0 1500 xp = xfrm_policy_byid(type, p->dir, p->index, 0, &err);
6c5c8ca7 1501 else {
5424f32e 1502 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
6c5c8ca7
JHS		 1503 struct xfrm_policy tmp;
1504
35a7aa08 1505 err = verify_sec_ctx_len(attrs);
6c5c8ca7
JHS		 1506 if (err)
1507 return err;
1508
1509 memset(&tmp, 0, sizeof(struct xfrm_policy));
1510 if (rt) {
5424f32e 1511 struct xfrm_user_sec_ctx *uctx = nla_data(rt);
6c5c8ca7
JHS		 1512
1513 if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
1514 return err;
1515 }
ef41aaa0
EP		 1516 xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
1517 0, &err);
6c5c8ca7
JHS		 1518 security_xfrm_policy_free(&tmp);
1519 }
1520
1521 if (xp == NULL)
ef41aaa0
EP		 1522 return -ENOENT;
1523 read_lock(&xp->lock);
6c5c8ca7
JHS		 1524 if (xp->dead) {
1525 read_unlock(&xp->lock);
1526 goto out;
1527 }
1528
1529 read_unlock(&xp->lock);
1530 err = 0;
1531 if (up->hard) {
1532 xfrm_policy_delete(xp, p->dir);
ab5f5e8b
JL		 1533 xfrm_audit_policy_delete(xp, 1, NETLINK_CB(skb).loginuid,
1534 NETLINK_CB(skb).sid);
161a09e7 1535
6c5c8ca7
JHS		 1536 } else {
1537 // reset the timers here?
1538 printk("Dont know what to do with soft policy expire\n");
1539 }
1540 km_policy_expired(xp, p->dir, up->hard, current->pid);
1541
1542out:
1543 xfrm_pol_put(xp);
1544 return err;
1545}
1546
22e70050 1547static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1548 struct nlattr **attrs)
53bc6b4d
JHS		 1549{
1550 struct xfrm_state *x;
1551 int err;
7b67c857 1552 struct xfrm_user_expire *ue = nlmsg_data(nlh);
53bc6b4d
JHS		 1553 struct xfrm_usersa_info *p = &ue->state;
1554
1555 x = xfrm_state_lookup(&p->id.daddr, p->id.spi, p->id.proto, p->family);
53bc6b4d 1556
3a765aa5 1557 err = -ENOENT;
53bc6b4d
JHS		 1558 if (x == NULL)
1559 return err;
1560
53bc6b4d 1561 spin_lock_bh(&x->lock);
3a765aa5 1562 err = -EINVAL;
53bc6b4d
JHS		 1563 if (x->km.state != XFRM_STATE_VALID)
1564 goto out;
1565 km_state_expired(x, ue->hard, current->pid);
1566
161a09e7 1567 if (ue->hard) {
53bc6b4d 1568 __xfrm_state_delete(x);
ab5f5e8b
JL		 1569 xfrm_audit_state_delete(x, 1, NETLINK_CB(skb).loginuid,
1570 NETLINK_CB(skb).sid);
161a09e7 1571 }
3a765aa5 1572 err = 0;
53bc6b4d
JHS		 1573out:
1574 spin_unlock_bh(&x->lock);
1575 xfrm_state_put(x);
1576 return err;
1577}
1578
22e70050 1579static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1580 struct nlattr **attrs)
980ebd25
JHS		 1581{
1582 struct xfrm_policy *xp;
1583 struct xfrm_user_tmpl *ut;
1584 int i;
5424f32e 1585 struct nlattr *rt = attrs[XFRMA_TMPL];
980ebd25 1586
7b67c857 1587 struct xfrm_user_acquire *ua = nlmsg_data(nlh);
980ebd25
JHS		 1588 struct xfrm_state *x = xfrm_state_alloc();
1589 int err = -ENOMEM;
1590
1591 if (!x)
1592 return err;
1593
1594 err = verify_newpolicy_info(&ua->policy);
1595 if (err) {
1596 printk("BAD policy passed\n");
1597 kfree(x);
1598 return err;
1599 }
1600
1601 /* build an XP */
5424f32e 1602 xp = xfrm_policy_construct(&ua->policy, attrs, &err);
b4ad86bf 1603 if (!xp) {
980ebd25
JHS		 1604 kfree(x);
1605 return err;
1606 }
1607
1608 memcpy(&x->id, &ua->id, sizeof(ua->id));
1609 memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
1610 memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
1611
5424f32e 1612 ut = nla_data(rt);
980ebd25
JHS		 1613 /* extract the templates and for each call km_key */
1614 for (i = 0; i < xp->xfrm_nr; i++, ut++) {
1615 struct xfrm_tmpl *t = &xp->xfrm_vec[i];
1616 memcpy(&x->id, &t->id, sizeof(x->id));
1617 x->props.mode = t->mode;
1618 x->props.reqid = t->reqid;
1619 x->props.family = ut->family;
1620 t->aalgos = ua->aalgos;
1621 t->ealgos = ua->ealgos;
1622 t->calgos = ua->calgos;
1623 err = km_query(x, t, xp);
1624
1625 }
1626
1627 kfree(x);
1628 kfree(xp);
1629
1630 return 0;
1631}
1632
5c79de6e 1633#ifdef CONFIG_XFRM_MIGRATE
5c79de6e 1634static int copy_from_user_migrate(struct xfrm_migrate *ma,
5424f32e 1635 struct nlattr **attrs, int *num)
5c79de6e 1636{
5424f32e 1637 struct nlattr *rt = attrs[XFRMA_MIGRATE];
5c79de6e
SS		 1638 struct xfrm_user_migrate *um;
1639 int i, num_migrate;
1640
5424f32e
TG		 1641 um = nla_data(rt);
1642 num_migrate = nla_len(rt) / sizeof(*um);
5c79de6e
SS		 1643
1644 if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
1645 return -EINVAL;
1646
1647 for (i = 0; i < num_migrate; i++, um++, ma++) {
1648 memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
1649 memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
1650 memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
1651 memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
1652
1653 ma->proto = um->proto;
1654 ma->mode = um->mode;
1655 ma->reqid = um->reqid;
1656
1657 ma->old_family = um->old_family;
1658 ma->new_family = um->new_family;
1659 }
1660
1661 *num = i;
1662 return 0;
1663}
1664
1665static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1666 struct nlattr **attrs)
5c79de6e 1667{
7b67c857 1668 struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
5c79de6e
SS		 1669 struct xfrm_migrate m[XFRM_MAX_DEPTH];
1670 u8 type;
1671 int err;
1672 int n = 0;
1673
35a7aa08 1674 if (attrs[XFRMA_MIGRATE] == NULL)
cf5cb79f 1675 return -EINVAL;
5c79de6e 1676
5424f32e 1677 err = copy_from_user_policy_type(&type, attrs);
5c79de6e
SS		 1678 if (err)
1679 return err;
1680
1681 err = copy_from_user_migrate((struct xfrm_migrate *)m,
5424f32e 1682 attrs, &n);
5c79de6e
SS		 1683 if (err)
1684 return err;
1685
1686 if (!n)
1687 return 0;
1688
1689 xfrm_migrate(&pi->sel, pi->dir, type, m, n);
1690
1691 return 0;
1692}
1693#else
1694static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
5424f32e 1695 struct nlattr **attrs)
5c79de6e
SS		 1696{
1697 return -ENOPROTOOPT;
1698}
1699#endif
1700
1701#ifdef CONFIG_XFRM_MIGRATE
1702static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb)
1703{
1704 struct xfrm_user_migrate um;
1705
1706 memset(&um, 0, sizeof(um));
1707 um.proto = m->proto;
1708 um.mode = m->mode;
1709 um.reqid = m->reqid;
1710 um.old_family = m->old_family;
1711 memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
1712 memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
1713 um.new_family = m->new_family;
1714 memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
1715 memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
1716
c0144bea 1717 return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
5c79de6e
SS		 1718}
1719
7deb2264
TG		 1720static inline size_t xfrm_migrate_msgsize(int num_migrate)
1721{
1722 return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
1723 + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
1724 + userpolicy_type_attrsize();
1725}
1726
5c79de6e
SS		 1727static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
1728 int num_migrate, struct xfrm_selector *sel,
1729 u8 dir, u8 type)
1730{
1731 struct xfrm_migrate *mp;
1732 struct xfrm_userpolicy_id *pol_id;
1733 struct nlmsghdr *nlh;
5c79de6e
SS		 1734 int i;
1735
79b8b7f4
TG		 1736 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
1737 if (nlh == NULL)
1738 return -EMSGSIZE;
5c79de6e 1739
7b67c857 1740 pol_id = nlmsg_data(nlh);
5c79de6e
SS		 1741 /* copy data from selector, dir, and type to the pol_id */
1742 memset(pol_id, 0, sizeof(*pol_id));
1743 memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
1744 pol_id->dir = dir;
1745
1746 if (copy_to_user_policy_type(type, skb) < 0)
1747 goto nlmsg_failure;
1748
1749 for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
1750 if (copy_to_user_migrate(mp, skb) < 0)
1751 goto nlmsg_failure;
1752 }
1753
9825069d 1754 return nlmsg_end(skb, nlh);
5c79de6e 1755nlmsg_failure:
9825069d
TG		 1756 nlmsg_cancel(skb, nlh);
1757 return -EMSGSIZE;
5c79de6e
SS		 1758}
1759
1760static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1761 struct xfrm_migrate *m, int num_migrate)
1762{
1763 struct sk_buff *skb;
5c79de6e 1764
7deb2264 1765 skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate), GFP_ATOMIC);
5c79de6e
SS		 1766 if (skb == NULL)
1767 return -ENOMEM;
1768
1769 /* build migrate */
1770 if (build_migrate(skb, m, num_migrate, sel, dir, type) < 0)
1771 BUG();
1772
082a1ad5 1773 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
5c79de6e
SS		 1774}
1775#else
1776static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1777 struct xfrm_migrate *m, int num_migrate)
1778{
1779 return -ENOPROTOOPT;
1780}
1781#endif
d51d081d 1782
a7bd9a45 1783#define XMSGSIZE(type) sizeof(struct type)
492b558b
TG		 1784
1785static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
1786 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
1787 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
1788 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
1789 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
1790 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1791 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
1792 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
980ebd25 1793 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
53bc6b4d 1794 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
492b558b
TG		 1795 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
1796 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
6c5c8ca7 1797 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
492b558b 1798 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
a7bd9a45 1799 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
d51d081d
JHS		 1800 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
1801 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
97a64b45 1802 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
5c79de6e 1803 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
a7bd9a45
TG		 1804 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
1805 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
1da177e4
LT		 1806};
1807
492b558b
TG		 1808#undef XMSGSIZE
1809
cf5cb79f
TG		 1810static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
1811 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
1812 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
1813 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
1814 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
1815 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
1816 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
1817 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
1818 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
1819 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
1820 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
1821 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
1822 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
1823 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
1824 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
1825};
1826
1da177e4 1827static struct xfrm_link {
5424f32e 1828 int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
1da177e4 1829 int (*dump)(struct sk_buff *, struct netlink_callback *);
492b558b
TG		 1830} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
1831 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
1832 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa },
1833 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
1834 .dump = xfrm_dump_sa },
1835 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
1836 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
1837 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
1838 .dump = xfrm_dump_policy },
1839 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
980ebd25 1840 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire },
53bc6b4d 1841 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
492b558b
TG		 1842 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
1843 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
6c5c8ca7 1844 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
492b558b
TG		 1845 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa },
1846 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy },
d51d081d
JHS		 1847 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae },
1848 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae },
5c79de6e 1849 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate },
566ec034 1850 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo },
ecfd6b18 1851 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo },
1da177e4
LT		 1852};
1853
1d00a4eb 1854static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
1da177e4 1855{
35a7aa08 1856 struct nlattr *attrs[XFRMA_MAX+1];
1da177e4 1857 struct xfrm_link *link;
a7bd9a45 1858 int type, err;
1da177e4 1859
1da177e4 1860 type = nlh->nlmsg_type;
1da177e4 1861 if (type > XFRM_MSG_MAX)
1d00a4eb 1862 return -EINVAL;
1da177e4
LT		 1863
1864 type -= XFRM_MSG_BASE;
1865 link = &xfrm_dispatch[type];
1866
1867 /* All operations require privileges, even GET */
1d00a4eb
TG		 1868 if (security_netlink_recv(skb, CAP_NET_ADMIN))
1869 return -EPERM;
1da177e4 1870
492b558b
TG		 1871 if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
1872 type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
1873 (nlh->nlmsg_flags & NLM_F_DUMP)) {
1da177e4 1874 if (link->dump == NULL)
1d00a4eb 1875 return -EINVAL;
88fc2c84 1876
c702e804 1877 return netlink_dump_start(xfrm_nl, skb, nlh, link->dump, NULL);
1da177e4
LT		 1878 }
1879
35a7aa08 1880 err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
cf5cb79f 1881 xfrma_policy);
a7bd9a45
TG		 1882 if (err < 0)
1883 return err;
1da177e4
LT		 1884
1885 if (link->doit == NULL)
1d00a4eb 1886 return -EINVAL;
1da177e4 1887
5424f32e 1888 return link->doit(skb, nlh, attrs);
1da177e4
LT		 1889}
1890
cd40b7d3 1891static void xfrm_netlink_rcv(struct sk_buff *skb)
1da177e4 1892{
cd40b7d3
DL		 1893 mutex_lock(&xfrm_cfg_mutex);
1894 netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
1895 mutex_unlock(&xfrm_cfg_mutex);
1da177e4
LT		 1896}
1897
7deb2264
TG		 1898static inline size_t xfrm_expire_msgsize(void)
1899{
1900 return NLMSG_ALIGN(sizeof(struct xfrm_user_expire));
1901}
1902
d51d081d 1903static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
1da177e4
LT		 1904{
1905 struct xfrm_user_expire *ue;
1906 struct nlmsghdr *nlh;
1da177e4 1907
79b8b7f4
TG		 1908 nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
1909 if (nlh == NULL)
1910 return -EMSGSIZE;
1da177e4 1911
7b67c857 1912 ue = nlmsg_data(nlh);
1da177e4 1913 copy_to_user_state(x, &ue->state);
d51d081d 1914 ue->hard = (c->data.hard != 0) ? 1 : 0;
1da177e4 1915
9825069d 1916 return nlmsg_end(skb, nlh);
1da177e4
LT		 1917}
1918
26b15dad 1919static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
1da177e4
LT		 1920{
1921 struct sk_buff *skb;
1922
7deb2264 1923 skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
1da177e4
LT		 1924 if (skb == NULL)
1925 return -ENOMEM;
1926
d51d081d 1927 if (build_expire(skb, x, c) < 0)
1da177e4
LT		 1928 BUG();
1929
082a1ad5 1930 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
1da177e4
LT		 1931}
1932
d51d081d
JHS		 1933static int xfrm_aevent_state_notify(struct xfrm_state *x, struct km_event *c)
1934{
1935 struct sk_buff *skb;
d51d081d 1936
7deb2264 1937 skb = nlmsg_new(xfrm_aevent_msgsize(), GFP_ATOMIC);
d51d081d
JHS		 1938 if (skb == NULL)
1939 return -ENOMEM;
1940
1941 if (build_aevent(skb, x, c) < 0)
1942 BUG();
1943
082a1ad5 1944 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
d51d081d
JHS		 1945}
1946
26b15dad
JHS		 1947static int xfrm_notify_sa_flush(struct km_event *c)
1948{
1949 struct xfrm_usersa_flush *p;
1950 struct nlmsghdr *nlh;
1951 struct sk_buff *skb;
7deb2264 1952 int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
26b15dad 1953
7deb2264 1954 skb = nlmsg_new(len, GFP_ATOMIC);
26b15dad
JHS		 1955 if (skb == NULL)
1956 return -ENOMEM;
26b15dad 1957
79b8b7f4
TG		 1958 nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
1959 if (nlh == NULL) {
1960 kfree_skb(skb);
1961 return -EMSGSIZE;
1962 }
26b15dad 1963
7b67c857 1964 p = nlmsg_data(nlh);
bf08867f 1965 p->proto = c->data.proto;
26b15dad 1966
9825069d 1967 nlmsg_end(skb, nlh);
26b15dad 1968
082a1ad5 1969 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
26b15dad
JHS		 1970}
1971
7deb2264 1972static inline size_t xfrm_sa_len(struct xfrm_state *x)
26b15dad 1973{
7deb2264 1974 size_t l = 0;
26b15dad 1975 if (x->aalg)
0f99be0d 1976 l += nla_total_size(xfrm_alg_len(x->aalg));
26b15dad 1977 if (x->ealg)
0f99be0d 1978 l += nla_total_size(xfrm_alg_len(x->ealg));
26b15dad 1979 if (x->calg)
7deb2264 1980 l += nla_total_size(sizeof(*x->calg));
26b15dad 1981 if (x->encap)
7deb2264 1982 l += nla_total_size(sizeof(*x->encap));
68325d3b
HX		 1983 if (x->security)
1984 l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
1985 x->security->ctx_len);
1986 if (x->coaddr)
1987 l += nla_total_size(sizeof(*x->coaddr));
1988
d26f3984
HX		 1989 /* Must count x->lastused as it may become non-zero behind our back. */
1990 l += nla_total_size(sizeof(u64));
26b15dad
JHS		 1991
1992 return l;
1993}
1994
1995static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
1996{
1997 struct xfrm_usersa_info *p;
0603eac0 1998 struct xfrm_usersa_id *id;
26b15dad
JHS		 1999 struct nlmsghdr *nlh;
2000 struct sk_buff *skb;
26b15dad 2001 int len = xfrm_sa_len(x);
0603eac0
HX		 2002 int headlen;
2003
2004 headlen = sizeof(*p);
2005 if (c->event == XFRM_MSG_DELSA) {
7deb2264 2006 len += nla_total_size(headlen);
0603eac0
HX		 2007 headlen = sizeof(*id);
2008 }
7deb2264 2009 len += NLMSG_ALIGN(headlen);
26b15dad 2010
7deb2264 2011 skb = nlmsg_new(len, GFP_ATOMIC);
26b15dad
JHS		 2012 if (skb == NULL)
2013 return -ENOMEM;
26b15dad 2014
79b8b7f4
TG		 2015 nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2016 if (nlh == NULL)
c0144bea 2017 goto nla_put_failure;
26b15dad 2018
7b67c857 2019 p = nlmsg_data(nlh);
0603eac0 2020 if (c->event == XFRM_MSG_DELSA) {
c0144bea
TG		 2021 struct nlattr *attr;
2022
7b67c857 2023 id = nlmsg_data(nlh);
0603eac0
HX		 2024 memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
2025 id->spi = x->id.spi;
2026 id->family = x->props.family;
2027 id->proto = x->id.proto;
2028
c0144bea
TG		 2029 attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
2030 if (attr == NULL)
2031 goto nla_put_failure;
2032
2033 p = nla_data(attr);
0603eac0
HX		 2034 }
2035
68325d3b
HX		 2036 if (copy_to_user_state_extra(x, p, skb))
2037 goto nla_put_failure;
26b15dad 2038
9825069d 2039 nlmsg_end(skb, nlh);
26b15dad 2040
082a1ad5 2041 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
26b15dad 2042
c0144bea 2043nla_put_failure:
68325d3b
HX		 2044 /* Somebody screwed up with xfrm_sa_len! */
2045 WARN_ON(1);
26b15dad
JHS		 2046 kfree_skb(skb);
2047 return -1;
2048}
2049
2050static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c)
2051{
2052
2053 switch (c->event) {
f60f6b8f 2054 case XFRM_MSG_EXPIRE:
26b15dad 2055 return xfrm_exp_state_notify(x, c);
d51d081d
JHS		 2056 case XFRM_MSG_NEWAE:
2057 return xfrm_aevent_state_notify(x, c);
f60f6b8f
HX		 2058 case XFRM_MSG_DELSA:
2059 case XFRM_MSG_UPDSA:
2060 case XFRM_MSG_NEWSA:
26b15dad 2061 return xfrm_notify_sa(x, c);
f60f6b8f 2062 case XFRM_MSG_FLUSHSA:
26b15dad
JHS		 2063 return xfrm_notify_sa_flush(c);
2064 default:
2065 printk("xfrm_user: Unknown SA event %d\n", c->event);
2066 break;
2067 }
2068
2069 return 0;
2070
2071}
2072
7deb2264
TG		 2073static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
2074 struct xfrm_policy *xp)
2075{
2076 return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
2077 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2078 + nla_total_size(xfrm_user_sec_ctx_size(x->security))
2079 + userpolicy_type_attrsize();
2080}
2081
1da177e4
LT		 2082static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
2083 struct xfrm_tmpl *xt, struct xfrm_policy *xp,
2084 int dir)
2085{
2086 struct xfrm_user_acquire *ua;
2087 struct nlmsghdr *nlh;
1da177e4
LT		 2088 __u32 seq = xfrm_get_acqseq();
2089
79b8b7f4
TG		 2090 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
2091 if (nlh == NULL)
2092 return -EMSGSIZE;
1da177e4 2093
7b67c857 2094 ua = nlmsg_data(nlh);
1da177e4
LT		 2095 memcpy(&ua->id, &x->id, sizeof(ua->id));
2096 memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
2097 memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
2098 copy_to_user_policy(xp, &ua->policy, dir);
2099 ua->aalgos = xt->aalgos;
2100 ua->ealgos = xt->ealgos;
2101 ua->calgos = xt->calgos;
2102 ua->seq = x->km.seq = seq;
2103
2104 if (copy_to_user_tmpl(xp, skb) < 0)
2105 goto nlmsg_failure;
0d681623 2106 if (copy_to_user_state_sec_ctx(x, skb))
df71837d 2107 goto nlmsg_failure;
1459bb36 2108 if (copy_to_user_policy_type(xp->type, skb) < 0)
f7b6983f 2109 goto nlmsg_failure;
1da177e4 2110
9825069d 2111 return nlmsg_end(skb, nlh);
1da177e4
LT		 2112
2113nlmsg_failure:
9825069d
TG		 2114 nlmsg_cancel(skb, nlh);
2115 return -EMSGSIZE;
1da177e4
LT		 2116}
2117
2118static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
2119 struct xfrm_policy *xp, int dir)
2120{
2121 struct sk_buff *skb;
1da177e4 2122
7deb2264 2123 skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
1da177e4
LT		 2124 if (skb == NULL)
2125 return -ENOMEM;
2126
2127 if (build_acquire(skb, x, xt, xp, dir) < 0)
2128 BUG();
2129
082a1ad5 2130 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
1da177e4
LT		 2131}
2132
2133/* User gives us xfrm_user_policy_info followed by an array of 0
2134 * or more templates.
2135 */
cb969f07 2136static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
1da177e4
LT		 2137 u8 *data, int len, int *dir)
2138{
2139 struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
2140 struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
2141 struct xfrm_policy *xp;
2142 int nr;
2143
cb969f07 2144 switch (sk->sk_family) {
1da177e4
LT		 2145 case AF_INET:
2146 if (opt != IP_XFRM_POLICY) {
2147 *dir = -EOPNOTSUPP;
2148 return NULL;
2149 }
2150 break;
2151#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2152 case AF_INET6:
2153 if (opt != IPV6_XFRM_POLICY) {
2154 *dir = -EOPNOTSUPP;
2155 return NULL;
2156 }
2157 break;
2158#endif
2159 default:
2160 *dir = -EINVAL;
2161 return NULL;
2162 }
2163
2164 *dir = -EINVAL;
2165
2166 if (len < sizeof(*p) ||
2167 verify_newpolicy_info(p))
2168 return NULL;
2169
2170 nr = ((len - sizeof(*p)) / sizeof(*ut));
b4ad86bf 2171 if (validate_tmpl(nr, ut, p->sel.family))
1da177e4
LT		 2172 return NULL;
2173
a4f1bac6
HX		 2174 if (p->dir > XFRM_POLICY_OUT)
2175 return NULL;
2176
1da177e4
LT		 2177 xp = xfrm_policy_alloc(GFP_KERNEL);
2178 if (xp == NULL) {
2179 *dir = -ENOBUFS;
2180 return NULL;
2181 }
2182
2183 copy_from_user_policy(xp, p);
f7b6983f 2184 xp->type = XFRM_POLICY_TYPE_MAIN;
1da177e4
LT		 2185 copy_templates(xp, ut, nr);
2186
2187 *dir = p->dir;
2188
2189 return xp;
2190}
2191
7deb2264
TG		 2192static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
2193{
2194 return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
2195 + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
2196 + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
2197 + userpolicy_type_attrsize();
2198}
2199
1da177e4 2200static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
d51d081d 2201 int dir, struct km_event *c)
1da177e4
LT		 2202{
2203 struct xfrm_user_polexpire *upe;
2204 struct nlmsghdr *nlh;
d51d081d 2205 int hard = c->data.hard;
1da177e4 2206
79b8b7f4
TG		 2207 nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
2208 if (nlh == NULL)
2209 return -EMSGSIZE;
1da177e4 2210
7b67c857 2211 upe = nlmsg_data(nlh);
1da177e4
LT		 2212 copy_to_user_policy(xp, &upe->pol, dir);
2213 if (copy_to_user_tmpl(xp, skb) < 0)
2214 goto nlmsg_failure;
df71837d
TJ		 2215 if (copy_to_user_sec_ctx(xp, skb))
2216 goto nlmsg_failure;
1459bb36 2217 if (copy_to_user_policy_type(xp->type, skb) < 0)
f7b6983f 2218 goto nlmsg_failure;
1da177e4
LT		 2219 upe->hard = !!hard;
2220
9825069d 2221 return nlmsg_end(skb, nlh);
1da177e4
LT		 2222
2223nlmsg_failure:
9825069d
TG		 2224 nlmsg_cancel(skb, nlh);
2225 return -EMSGSIZE;
1da177e4
LT		 2226}
2227
26b15dad 2228static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
1da177e4
LT		 2229{
2230 struct sk_buff *skb;
1da177e4 2231
7deb2264 2232 skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
1da177e4
LT		 2233 if (skb == NULL)
2234 return -ENOMEM;
2235
d51d081d 2236 if (build_polexpire(skb, xp, dir, c) < 0)
1da177e4
LT		 2237 BUG();
2238
082a1ad5 2239 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
1da177e4
LT		 2240}
2241
26b15dad
JHS		 2242static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
2243{
2244 struct xfrm_userpolicy_info *p;
0603eac0 2245 struct xfrm_userpolicy_id *id;
26b15dad
JHS		 2246 struct nlmsghdr *nlh;
2247 struct sk_buff *skb;
7deb2264 2248 int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
0603eac0
HX		 2249 int headlen;
2250
2251 headlen = sizeof(*p);
2252 if (c->event == XFRM_MSG_DELPOLICY) {
7deb2264 2253 len += nla_total_size(headlen);
0603eac0
HX		 2254 headlen = sizeof(*id);
2255 }
cfbfd45a 2256 len += userpolicy_type_attrsize();
7deb2264 2257 len += NLMSG_ALIGN(headlen);
26b15dad 2258
7deb2264 2259 skb = nlmsg_new(len, GFP_ATOMIC);
26b15dad
JHS		 2260 if (skb == NULL)
2261 return -ENOMEM;
26b15dad 2262
79b8b7f4
TG		 2263 nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
2264 if (nlh == NULL)
2265 goto nlmsg_failure;
26b15dad 2266
7b67c857 2267 p = nlmsg_data(nlh);
0603eac0 2268 if (c->event == XFRM_MSG_DELPOLICY) {
c0144bea
TG		 2269 struct nlattr *attr;
2270
7b67c857 2271 id = nlmsg_data(nlh);
0603eac0
HX		 2272 memset(id, 0, sizeof(*id));
2273 id->dir = dir;
2274 if (c->data.byid)
2275 id->index = xp->index;
2276 else
2277 memcpy(&id->sel, &xp->selector, sizeof(id->sel));
2278
c0144bea
TG		 2279 attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
2280 if (attr == NULL)
2281 goto nlmsg_failure;
2282
2283 p = nla_data(attr);
0603eac0 2284 }
26b15dad 2285
26b15dad
JHS		 2286 copy_to_user_policy(xp, p, dir);
2287 if (copy_to_user_tmpl(xp, skb) < 0)
2288 goto nlmsg_failure;
1459bb36 2289 if (copy_to_user_policy_type(xp->type, skb) < 0)
f7b6983f 2290 goto nlmsg_failure;
26b15dad 2291
9825069d 2292 nlmsg_end(skb, nlh);
26b15dad 2293
082a1ad5 2294 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
26b15dad
JHS		 2295
2296nlmsg_failure:
2297 kfree_skb(skb);
2298 return -1;
2299}
2300
2301static int xfrm_notify_policy_flush(struct km_event *c)
2302{
2303 struct nlmsghdr *nlh;
2304 struct sk_buff *skb;
26b15dad 2305
7deb2264 2306 skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
26b15dad
JHS		 2307 if (skb == NULL)
2308 return -ENOMEM;
26b15dad 2309
79b8b7f4
TG		 2310 nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
2311 if (nlh == NULL)
2312 goto nlmsg_failure;
0c51f53c
JHS		 2313 if (copy_to_user_policy_type(c->data.type, skb) < 0)
2314 goto nlmsg_failure;
26b15dad 2315
9825069d 2316 nlmsg_end(skb, nlh);
26b15dad 2317
082a1ad5 2318 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
26b15dad
JHS		 2319
2320nlmsg_failure:
2321 kfree_skb(skb);
2322 return -1;
2323}
2324
2325static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
2326{
2327
2328 switch (c->event) {
f60f6b8f
HX		 2329 case XFRM_MSG_NEWPOLICY:
2330 case XFRM_MSG_UPDPOLICY:
2331 case XFRM_MSG_DELPOLICY:
26b15dad 2332 return xfrm_notify_policy(xp, dir, c);
f60f6b8f 2333 case XFRM_MSG_FLUSHPOLICY:
26b15dad 2334 return xfrm_notify_policy_flush(c);
f60f6b8f 2335 case XFRM_MSG_POLEXPIRE:
26b15dad
JHS		 2336 return xfrm_exp_policy_notify(xp, dir, c);
2337 default:
2338 printk("xfrm_user: Unknown Policy event %d\n", c->event);
2339 }
2340
2341 return 0;
2342
2343}
2344
7deb2264
TG		 2345static inline size_t xfrm_report_msgsize(void)
2346{
2347 return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
2348}
2349
97a64b45
MN		 2350static int build_report(struct sk_buff *skb, u8 proto,
2351 struct xfrm_selector *sel, xfrm_address_t *addr)
2352{
2353 struct xfrm_user_report *ur;
2354 struct nlmsghdr *nlh;
97a64b45 2355
79b8b7f4
TG		 2356 nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
2357 if (nlh == NULL)
2358 return -EMSGSIZE;
97a64b45 2359
7b67c857 2360 ur = nlmsg_data(nlh);
97a64b45
MN		 2361 ur->proto = proto;
2362 memcpy(&ur->sel, sel, sizeof(ur->sel));
2363
2364 if (addr)
c0144bea 2365 NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
97a64b45 2366
9825069d 2367 return nlmsg_end(skb, nlh);
97a64b45 2368
c0144bea 2369nla_put_failure:
9825069d
TG		 2370 nlmsg_cancel(skb, nlh);
2371 return -EMSGSIZE;
97a64b45
MN		 2372}
2373
2374static int xfrm_send_report(u8 proto, struct xfrm_selector *sel,
2375 xfrm_address_t *addr)
2376{
2377 struct sk_buff *skb;
97a64b45 2378
7deb2264 2379 skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
97a64b45
MN		 2380 if (skb == NULL)
2381 return -ENOMEM;
2382
2383 if (build_report(skb, proto, sel, addr) < 0)
2384 BUG();
2385
082a1ad5 2386 return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
97a64b45
MN		 2387}
2388
1da177e4
LT		 2389static struct xfrm_mgr netlink_mgr = {
2390 .id = "netlink",
2391 .notify = xfrm_send_state_notify,
2392 .acquire = xfrm_send_acquire,
2393 .compile_policy = xfrm_compile_policy,
2394 .notify_policy = xfrm_send_policy_notify,
97a64b45 2395 .report = xfrm_send_report,
5c79de6e 2396 .migrate = xfrm_send_migrate,
1da177e4
LT		 2397};
2398
2399static int __init xfrm_user_init(void)
2400{
be33690d
PM		 2401 struct sock *nlsk;
2402
654b32c6 2403 printk(KERN_INFO "Initializing XFRM netlink socket\n");
1da177e4 2404
b4b51029 2405 nlsk = netlink_kernel_create(&init_net, NETLINK_XFRM, XFRMNLGRP_MAX,
af65bdfc 2406 xfrm_netlink_rcv, NULL, THIS_MODULE);
be33690d 2407 if (nlsk == NULL)
1da177e4 2408 return -ENOMEM;
be33690d 2409 rcu_assign_pointer(xfrm_nl, nlsk);
1da177e4
LT		 2410
2411 xfrm_register_km(&netlink_mgr);
2412
2413 return 0;
2414}
2415
2416static void __exit xfrm_user_exit(void)
2417{
be33690d
PM		 2418 struct sock *nlsk = xfrm_nl;
2419
1da177e4 2420 xfrm_unregister_km(&netlink_mgr);
be33690d
PM		 2421 rcu_assign_pointer(xfrm_nl, NULL);
2422 synchronize_rcu();
b7c6ba6e 2423 netlink_kernel_release(nlsk);
1da177e4
LT		 2424}
2425
2426module_init(xfrm_user_init);
2427module_exit(xfrm_user_exit);
2428MODULE_LICENSE("GPL");
4fdb3bb7 2429MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
f8cd5488 2430
Linux 6.x block layer and io_uring tree(s)