xfrm_user.c 80 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /* xfrm_user.c: User interface to configure xfrm engine.
  3. *
  4. * Copyright (C) 2002 David S. Miller (davem@redhat.com)
  5. *
  6. * Changes:
  7. * Mitsuru KANDA @USAGI
  8. * Kazunori MIYAZAWA @USAGI
  9. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  10. * IPv6 support
  11. *
  12. */
  13. #include <linux/crypto.h>
  14. #include <linux/module.h>
  15. #include <linux/kernel.h>
  16. #include <linux/types.h>
  17. #include <linux/slab.h>
  18. #include <linux/socket.h>
  19. #include <linux/string.h>
  20. #include <linux/net.h>
  21. #include <linux/skbuff.h>
  22. #include <linux/pfkeyv2.h>
  23. #include <linux/ipsec.h>
  24. #include <linux/init.h>
  25. #include <linux/security.h>
  26. #include <net/sock.h>
  27. #include <net/xfrm.h>
  28. #include <net/netlink.h>
  29. #include <net/ah.h>
  30. #include <linux/uaccess.h>
  31. #if IS_ENABLED(CONFIG_IPV6)
  32. #include <linux/in6.h>
  33. #endif
  34. #include <asm/unaligned.h>
  35. static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
  36. {
  37. struct nlattr *rt = attrs[type];
  38. struct xfrm_algo *algp;
  39. if (!rt)
  40. return 0;
  41. algp = nla_data(rt);
  42. if (nla_len(rt) < (int)xfrm_alg_len(algp))
  43. return -EINVAL;
  44. switch (type) {
  45. case XFRMA_ALG_AUTH:
  46. case XFRMA_ALG_CRYPT:
  47. case XFRMA_ALG_COMP:
  48. break;
  49. default:
  50. return -EINVAL;
  51. }
  52. algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
  53. return 0;
  54. }
  55. static int verify_auth_trunc(struct nlattr **attrs)
  56. {
  57. struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
  58. struct xfrm_algo_auth *algp;
  59. if (!rt)
  60. return 0;
  61. algp = nla_data(rt);
  62. if (nla_len(rt) < (int)xfrm_alg_auth_len(algp))
  63. return -EINVAL;
  64. algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
  65. return 0;
  66. }
  67. static int verify_aead(struct nlattr **attrs)
  68. {
  69. struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
  70. struct xfrm_algo_aead *algp;
  71. if (!rt)
  72. return 0;
  73. algp = nla_data(rt);
  74. if (nla_len(rt) < (int)aead_len(algp))
  75. return -EINVAL;
  76. algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
  77. return 0;
  78. }
  79. static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
  80. xfrm_address_t **addrp)
  81. {
  82. struct nlattr *rt = attrs[type];
  83. if (rt && addrp)
  84. *addrp = nla_data(rt);
  85. }
  86. static inline int verify_sec_ctx_len(struct nlattr **attrs)
  87. {
  88. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  89. struct xfrm_user_sec_ctx *uctx;
  90. if (!rt)
  91. return 0;
  92. uctx = nla_data(rt);
  93. if (uctx->len > nla_len(rt) ||
  94. uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
  95. return -EINVAL;
  96. return 0;
  97. }
  98. static inline int verify_replay(struct xfrm_usersa_info *p,
  99. struct nlattr **attrs)
  100. {
  101. struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
  102. struct xfrm_replay_state_esn *rs;
  103. if (!rt)
  104. return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
  105. rs = nla_data(rt);
  106. if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
  107. return -EINVAL;
  108. if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
  109. nla_len(rt) != sizeof(*rs))
  110. return -EINVAL;
  111. /* As only ESP and AH support ESN feature. */
  112. if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))
  113. return -EINVAL;
  114. if (p->replay_window != 0)
  115. return -EINVAL;
  116. return 0;
  117. }
  118. static int verify_newsa_info(struct xfrm_usersa_info *p,
  119. struct nlattr **attrs)
  120. {
  121. int err;
  122. err = -EINVAL;
  123. switch (p->family) {
  124. case AF_INET:
  125. break;
  126. case AF_INET6:
  127. #if IS_ENABLED(CONFIG_IPV6)
  128. break;
  129. #else
  130. err = -EAFNOSUPPORT;
  131. goto out;
  132. #endif
  133. default:
  134. goto out;
  135. }
  136. switch (p->sel.family) {
  137. case AF_UNSPEC:
  138. break;
  139. case AF_INET:
  140. if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
  141. goto out;
  142. break;
  143. case AF_INET6:
  144. #if IS_ENABLED(CONFIG_IPV6)
  145. if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
  146. goto out;
  147. break;
  148. #else
  149. err = -EAFNOSUPPORT;
  150. goto out;
  151. #endif
  152. default:
  153. goto out;
  154. }
  155. err = -EINVAL;
  156. switch (p->id.proto) {
  157. case IPPROTO_AH:
  158. if ((!attrs[XFRMA_ALG_AUTH] &&
  159. !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
  160. attrs[XFRMA_ALG_AEAD] ||
  161. attrs[XFRMA_ALG_CRYPT] ||
  162. attrs[XFRMA_ALG_COMP] ||
  163. attrs[XFRMA_TFCPAD])
  164. goto out;
  165. break;
  166. case IPPROTO_ESP:
  167. if (attrs[XFRMA_ALG_COMP])
  168. goto out;
  169. if (!attrs[XFRMA_ALG_AUTH] &&
  170. !attrs[XFRMA_ALG_AUTH_TRUNC] &&
  171. !attrs[XFRMA_ALG_CRYPT] &&
  172. !attrs[XFRMA_ALG_AEAD])
  173. goto out;
  174. if ((attrs[XFRMA_ALG_AUTH] ||
  175. attrs[XFRMA_ALG_AUTH_TRUNC] ||
  176. attrs[XFRMA_ALG_CRYPT]) &&
  177. attrs[XFRMA_ALG_AEAD])
  178. goto out;
  179. if (attrs[XFRMA_TFCPAD] &&
  180. p->mode != XFRM_MODE_TUNNEL)
  181. goto out;
  182. break;
  183. case IPPROTO_COMP:
  184. if (!attrs[XFRMA_ALG_COMP] ||
  185. attrs[XFRMA_ALG_AEAD] ||
  186. attrs[XFRMA_ALG_AUTH] ||
  187. attrs[XFRMA_ALG_AUTH_TRUNC] ||
  188. attrs[XFRMA_ALG_CRYPT] ||
  189. attrs[XFRMA_TFCPAD] ||
  190. (ntohl(p->id.spi) >= 0x10000))
  191. goto out;
  192. break;
  193. #if IS_ENABLED(CONFIG_IPV6)
  194. case IPPROTO_DSTOPTS:
  195. case IPPROTO_ROUTING:
  196. if (attrs[XFRMA_ALG_COMP] ||
  197. attrs[XFRMA_ALG_AUTH] ||
  198. attrs[XFRMA_ALG_AUTH_TRUNC] ||
  199. attrs[XFRMA_ALG_AEAD] ||
  200. attrs[XFRMA_ALG_CRYPT] ||
  201. attrs[XFRMA_ENCAP] ||
  202. attrs[XFRMA_SEC_CTX] ||
  203. attrs[XFRMA_TFCPAD] ||
  204. !attrs[XFRMA_COADDR])
  205. goto out;
  206. break;
  207. #endif
  208. default:
  209. goto out;
  210. }
  211. if ((err = verify_aead(attrs)))
  212. goto out;
  213. if ((err = verify_auth_trunc(attrs)))
  214. goto out;
  215. if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
  216. goto out;
  217. if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
  218. goto out;
  219. if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
  220. goto out;
  221. if ((err = verify_sec_ctx_len(attrs)))
  222. goto out;
  223. if ((err = verify_replay(p, attrs)))
  224. goto out;
  225. err = -EINVAL;
  226. switch (p->mode) {
  227. case XFRM_MODE_TRANSPORT:
  228. case XFRM_MODE_TUNNEL:
  229. case XFRM_MODE_ROUTEOPTIMIZATION:
  230. case XFRM_MODE_BEET:
  231. break;
  232. default:
  233. goto out;
  234. }
  235. err = 0;
  236. out:
  237. return err;
  238. }
  239. static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
  240. struct xfrm_algo_desc *(*get_byname)(const char *, int),
  241. struct nlattr *rta)
  242. {
  243. struct xfrm_algo *p, *ualg;
  244. struct xfrm_algo_desc *algo;
  245. if (!rta)
  246. return 0;
  247. ualg = nla_data(rta);
  248. algo = get_byname(ualg->alg_name, 1);
  249. if (!algo)
  250. return -ENOSYS;
  251. *props = algo->desc.sadb_alg_id;
  252. p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
  253. if (!p)
  254. return -ENOMEM;
  255. strcpy(p->alg_name, algo->name);
  256. *algpp = p;
  257. return 0;
  258. }
  259. static int attach_crypt(struct xfrm_state *x, struct nlattr *rta)
  260. {
  261. struct xfrm_algo *p, *ualg;
  262. struct xfrm_algo_desc *algo;
  263. if (!rta)
  264. return 0;
  265. ualg = nla_data(rta);
  266. algo = xfrm_ealg_get_byname(ualg->alg_name, 1);
  267. if (!algo)
  268. return -ENOSYS;
  269. x->props.ealgo = algo->desc.sadb_alg_id;
  270. p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
  271. if (!p)
  272. return -ENOMEM;
  273. strcpy(p->alg_name, algo->name);
  274. x->ealg = p;
  275. x->geniv = algo->uinfo.encr.geniv;
  276. return 0;
  277. }
  278. static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
  279. struct nlattr *rta)
  280. {
  281. struct xfrm_algo *ualg;
  282. struct xfrm_algo_auth *p;
  283. struct xfrm_algo_desc *algo;
  284. if (!rta)
  285. return 0;
  286. ualg = nla_data(rta);
  287. algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
  288. if (!algo)
  289. return -ENOSYS;
  290. *props = algo->desc.sadb_alg_id;
  291. p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
  292. if (!p)
  293. return -ENOMEM;
  294. strcpy(p->alg_name, algo->name);
  295. p->alg_key_len = ualg->alg_key_len;
  296. p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
  297. memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
  298. *algpp = p;
  299. return 0;
  300. }
  301. static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
  302. struct nlattr *rta)
  303. {
  304. struct xfrm_algo_auth *p, *ualg;
  305. struct xfrm_algo_desc *algo;
  306. if (!rta)
  307. return 0;
  308. ualg = nla_data(rta);
  309. algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
  310. if (!algo)
  311. return -ENOSYS;
  312. if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
  313. return -EINVAL;
  314. *props = algo->desc.sadb_alg_id;
  315. p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
  316. if (!p)
  317. return -ENOMEM;
  318. strcpy(p->alg_name, algo->name);
  319. if (!p->alg_trunc_len)
  320. p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
  321. *algpp = p;
  322. return 0;
  323. }
  324. static int attach_aead(struct xfrm_state *x, struct nlattr *rta)
  325. {
  326. struct xfrm_algo_aead *p, *ualg;
  327. struct xfrm_algo_desc *algo;
  328. if (!rta)
  329. return 0;
  330. ualg = nla_data(rta);
  331. algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
  332. if (!algo)
  333. return -ENOSYS;
  334. x->props.ealgo = algo->desc.sadb_alg_id;
  335. p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
  336. if (!p)
  337. return -ENOMEM;
  338. strcpy(p->alg_name, algo->name);
  339. x->aead = p;
  340. x->geniv = algo->uinfo.aead.geniv;
  341. return 0;
  342. }
  343. static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
  344. struct nlattr *rp)
  345. {
  346. struct xfrm_replay_state_esn *up;
  347. unsigned int ulen;
  348. if (!replay_esn || !rp)
  349. return 0;
  350. up = nla_data(rp);
  351. ulen = xfrm_replay_state_esn_len(up);
  352. /* Check the overall length and the internal bitmap length to avoid
  353. * potential overflow. */
  354. if (nla_len(rp) < (int)ulen ||
  355. xfrm_replay_state_esn_len(replay_esn) != ulen ||
  356. replay_esn->bmp_len != up->bmp_len)
  357. return -EINVAL;
  358. if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
  359. return -EINVAL;
  360. return 0;
  361. }
  362. static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
  363. struct xfrm_replay_state_esn **preplay_esn,
  364. struct nlattr *rta)
  365. {
  366. struct xfrm_replay_state_esn *p, *pp, *up;
  367. unsigned int klen, ulen;
  368. if (!rta)
  369. return 0;
  370. up = nla_data(rta);
  371. klen = xfrm_replay_state_esn_len(up);
  372. ulen = nla_len(rta) >= (int)klen ? klen : sizeof(*up);
  373. p = kzalloc(klen, GFP_KERNEL);
  374. if (!p)
  375. return -ENOMEM;
  376. pp = kzalloc(klen, GFP_KERNEL);
  377. if (!pp) {
  378. kfree(p);
  379. return -ENOMEM;
  380. }
  381. memcpy(p, up, ulen);
  382. memcpy(pp, up, ulen);
  383. *replay_esn = p;
  384. *preplay_esn = pp;
  385. return 0;
  386. }
  387. static inline unsigned int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
  388. {
  389. unsigned int len = 0;
  390. if (xfrm_ctx) {
  391. len += sizeof(struct xfrm_user_sec_ctx);
  392. len += xfrm_ctx->ctx_len;
  393. }
  394. return len;
  395. }
  396. static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
  397. {
  398. memcpy(&x->id, &p->id, sizeof(x->id));
  399. memcpy(&x->sel, &p->sel, sizeof(x->sel));
  400. memcpy(&x->lft, &p->lft, sizeof(x->lft));
  401. x->props.mode = p->mode;
  402. x->props.replay_window = min_t(unsigned int, p->replay_window,
  403. sizeof(x->replay.bitmap) * 8);
  404. x->props.reqid = p->reqid;
  405. x->props.family = p->family;
  406. memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
  407. x->props.flags = p->flags;
  408. if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
  409. x->sel.family = p->family;
  410. }
  411. /*
  412. * someday when pfkey also has support, we could have the code
  413. * somehow made shareable and move it to xfrm_state.c - JHS
  414. *
  415. */
  416. static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
  417. int update_esn)
  418. {
  419. struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
  420. struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
  421. struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
  422. struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
  423. struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
  424. if (re) {
  425. struct xfrm_replay_state_esn *replay_esn;
  426. replay_esn = nla_data(re);
  427. memcpy(x->replay_esn, replay_esn,
  428. xfrm_replay_state_esn_len(replay_esn));
  429. memcpy(x->preplay_esn, replay_esn,
  430. xfrm_replay_state_esn_len(replay_esn));
  431. }
  432. if (rp) {
  433. struct xfrm_replay_state *replay;
  434. replay = nla_data(rp);
  435. memcpy(&x->replay, replay, sizeof(*replay));
  436. memcpy(&x->preplay, replay, sizeof(*replay));
  437. }
  438. if (lt) {
  439. struct xfrm_lifetime_cur *ltime;
  440. ltime = nla_data(lt);
  441. x->curlft.bytes = ltime->bytes;
  442. x->curlft.packets = ltime->packets;
  443. x->curlft.add_time = ltime->add_time;
  444. x->curlft.use_time = ltime->use_time;
  445. }
  446. if (et)
  447. x->replay_maxage = nla_get_u32(et);
  448. if (rt)
  449. x->replay_maxdiff = nla_get_u32(rt);
  450. }
  451. static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
  452. {
  453. if (attrs[XFRMA_SET_MARK]) {
  454. m->v = nla_get_u32(attrs[XFRMA_SET_MARK]);
  455. if (attrs[XFRMA_SET_MARK_MASK])
  456. m->m = nla_get_u32(attrs[XFRMA_SET_MARK_MASK]);
  457. else
  458. m->m = 0xffffffff;
  459. } else {
  460. m->v = m->m = 0;
  461. }
  462. }
  463. static struct xfrm_state *xfrm_state_construct(struct net *net,
  464. struct xfrm_usersa_info *p,
  465. struct nlattr **attrs,
  466. int *errp)
  467. {
  468. struct xfrm_state *x = xfrm_state_alloc(net);
  469. int err = -ENOMEM;
  470. if (!x)
  471. goto error_no_put;
  472. copy_from_user_state(x, p);
  473. if (attrs[XFRMA_ENCAP]) {
  474. x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
  475. sizeof(*x->encap), GFP_KERNEL);
  476. if (x->encap == NULL)
  477. goto error;
  478. }
  479. if (attrs[XFRMA_COADDR]) {
  480. x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
  481. sizeof(*x->coaddr), GFP_KERNEL);
  482. if (x->coaddr == NULL)
  483. goto error;
  484. }
  485. if (attrs[XFRMA_SA_EXTRA_FLAGS])
  486. x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
  487. if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD])))
  488. goto error;
  489. if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
  490. attrs[XFRMA_ALG_AUTH_TRUNC])))
  491. goto error;
  492. if (!x->props.aalgo) {
  493. if ((err = attach_auth(&x->aalg, &x->props.aalgo,
  494. attrs[XFRMA_ALG_AUTH])))
  495. goto error;
  496. }
  497. if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT])))
  498. goto error;
  499. if ((err = attach_one_algo(&x->calg, &x->props.calgo,
  500. xfrm_calg_get_byname,
  501. attrs[XFRMA_ALG_COMP])))
  502. goto error;
  503. if (attrs[XFRMA_TFCPAD])
  504. x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
  505. xfrm_mark_get(attrs, &x->mark);
  506. xfrm_smark_init(attrs, &x->props.smark);
  507. if (attrs[XFRMA_IF_ID])
  508. x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
  509. err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]);
  510. if (err)
  511. goto error;
  512. if (attrs[XFRMA_SEC_CTX]) {
  513. err = security_xfrm_state_alloc(x,
  514. nla_data(attrs[XFRMA_SEC_CTX]));
  515. if (err)
  516. goto error;
  517. }
  518. if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
  519. attrs[XFRMA_REPLAY_ESN_VAL])))
  520. goto error;
  521. x->km.seq = p->seq;
  522. x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
  523. /* sysctl_xfrm_aevent_etime is in 100ms units */
  524. x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
  525. if ((err = xfrm_init_replay(x)))
  526. goto error;
  527. /* override default values from above */
  528. xfrm_update_ae_params(x, attrs, 0);
  529. /* configure the hardware if offload is requested */
  530. if (attrs[XFRMA_OFFLOAD_DEV]) {
  531. err = xfrm_dev_state_add(net, x,
  532. nla_data(attrs[XFRMA_OFFLOAD_DEV]));
  533. if (err)
  534. goto error;
  535. }
  536. return x;
  537. error:
  538. x->km.state = XFRM_STATE_DEAD;
  539. xfrm_state_put(x);
  540. error_no_put:
  541. *errp = err;
  542. return NULL;
  543. }
  544. static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  545. struct nlattr **attrs)
  546. {
  547. struct net *net = sock_net(skb->sk);
  548. struct xfrm_usersa_info *p = nlmsg_data(nlh);
  549. struct xfrm_state *x;
  550. int err;
  551. struct km_event c;
  552. err = verify_newsa_info(p, attrs);
  553. if (err)
  554. return err;
  555. x = xfrm_state_construct(net, p, attrs, &err);
  556. if (!x)
  557. return err;
  558. xfrm_state_hold(x);
  559. if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
  560. err = xfrm_state_add(x);
  561. else
  562. err = xfrm_state_update(x);
  563. xfrm_audit_state_add(x, err ? 0 : 1, true);
  564. if (err < 0) {
  565. x->km.state = XFRM_STATE_DEAD;
  566. xfrm_dev_state_delete(x);
  567. __xfrm_state_put(x);
  568. goto out;
  569. }
  570. if (x->km.state == XFRM_STATE_VOID)
  571. x->km.state = XFRM_STATE_VALID;
  572. c.seq = nlh->nlmsg_seq;
  573. c.portid = nlh->nlmsg_pid;
  574. c.event = nlh->nlmsg_type;
  575. km_state_notify(x, &c);
  576. out:
  577. xfrm_state_put(x);
  578. return err;
  579. }
  580. static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
  581. struct xfrm_usersa_id *p,
  582. struct nlattr **attrs,
  583. int *errp)
  584. {
  585. struct xfrm_state *x = NULL;
  586. struct xfrm_mark m;
  587. int err;
  588. u32 mark = xfrm_mark_get(attrs, &m);
  589. if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
  590. err = -ESRCH;
  591. x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
  592. } else {
  593. xfrm_address_t *saddr = NULL;
  594. verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
  595. if (!saddr) {
  596. err = -EINVAL;
  597. goto out;
  598. }
  599. err = -ESRCH;
  600. x = xfrm_state_lookup_byaddr(net, mark,
  601. &p->daddr, saddr,
  602. p->proto, p->family);
  603. }
  604. out:
  605. if (!x && errp)
  606. *errp = err;
  607. return x;
  608. }
  609. static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  610. struct nlattr **attrs)
  611. {
  612. struct net *net = sock_net(skb->sk);
  613. struct xfrm_state *x;
  614. int err = -ESRCH;
  615. struct km_event c;
  616. struct xfrm_usersa_id *p = nlmsg_data(nlh);
  617. x = xfrm_user_state_lookup(net, p, attrs, &err);
  618. if (x == NULL)
  619. return err;
  620. if ((err = security_xfrm_state_delete(x)) != 0)
  621. goto out;
  622. if (xfrm_state_kern(x)) {
  623. err = -EPERM;
  624. goto out;
  625. }
  626. err = xfrm_state_delete(x);
  627. if (err < 0)
  628. goto out;
  629. c.seq = nlh->nlmsg_seq;
  630. c.portid = nlh->nlmsg_pid;
  631. c.event = nlh->nlmsg_type;
  632. km_state_notify(x, &c);
  633. out:
  634. xfrm_audit_state_delete(x, err ? 0 : 1, true);
  635. xfrm_state_put(x);
  636. return err;
  637. }
  638. static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
  639. {
  640. memset(p, 0, sizeof(*p));
  641. memcpy(&p->id, &x->id, sizeof(p->id));
  642. memcpy(&p->sel, &x->sel, sizeof(p->sel));
  643. memcpy(&p->lft, &x->lft, sizeof(p->lft));
  644. memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
  645. put_unaligned(x->stats.replay_window, &p->stats.replay_window);
  646. put_unaligned(x->stats.replay, &p->stats.replay);
  647. put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed);
  648. memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
  649. p->mode = x->props.mode;
  650. p->replay_window = x->props.replay_window;
  651. p->reqid = x->props.reqid;
  652. p->family = x->props.family;
  653. p->flags = x->props.flags;
  654. p->seq = x->km.seq;
  655. }
  656. struct xfrm_dump_info {
  657. struct sk_buff *in_skb;
  658. struct sk_buff *out_skb;
  659. u32 nlmsg_seq;
  660. u16 nlmsg_flags;
  661. };
  662. static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
  663. {
  664. struct xfrm_user_sec_ctx *uctx;
  665. struct nlattr *attr;
  666. int ctx_size = sizeof(*uctx) + s->ctx_len;
  667. attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
  668. if (attr == NULL)
  669. return -EMSGSIZE;
  670. uctx = nla_data(attr);
  671. uctx->exttype = XFRMA_SEC_CTX;
  672. uctx->len = ctx_size;
  673. uctx->ctx_doi = s->ctx_doi;
  674. uctx->ctx_alg = s->ctx_alg;
  675. uctx->ctx_len = s->ctx_len;
  676. memcpy(uctx + 1, s->ctx_str, s->ctx_len);
  677. return 0;
  678. }
  679. static int copy_user_offload(struct xfrm_state_offload *xso, struct sk_buff *skb)
  680. {
  681. struct xfrm_user_offload *xuo;
  682. struct nlattr *attr;
  683. attr = nla_reserve(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo));
  684. if (attr == NULL)
  685. return -EMSGSIZE;
  686. xuo = nla_data(attr);
  687. memset(xuo, 0, sizeof(*xuo));
  688. xuo->ifindex = xso->dev->ifindex;
  689. xuo->flags = xso->flags;
  690. return 0;
  691. }
  692. static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
  693. {
  694. struct xfrm_algo *algo;
  695. struct nlattr *nla;
  696. nla = nla_reserve(skb, XFRMA_ALG_AUTH,
  697. sizeof(*algo) + (auth->alg_key_len + 7) / 8);
  698. if (!nla)
  699. return -EMSGSIZE;
  700. algo = nla_data(nla);
  701. strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
  702. memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
  703. algo->alg_key_len = auth->alg_key_len;
  704. return 0;
  705. }
  706. static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m)
  707. {
  708. int ret = 0;
  709. if (m->v | m->m) {
  710. ret = nla_put_u32(skb, XFRMA_SET_MARK, m->v);
  711. if (!ret)
  712. ret = nla_put_u32(skb, XFRMA_SET_MARK_MASK, m->m);
  713. }
  714. return ret;
  715. }
  716. /* Don't change this without updating xfrm_sa_len! */
  717. static int copy_to_user_state_extra(struct xfrm_state *x,
  718. struct xfrm_usersa_info *p,
  719. struct sk_buff *skb)
  720. {
  721. int ret = 0;
  722. copy_to_user_state(x, p);
  723. if (x->props.extra_flags) {
  724. ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS,
  725. x->props.extra_flags);
  726. if (ret)
  727. goto out;
  728. }
  729. if (x->coaddr) {
  730. ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
  731. if (ret)
  732. goto out;
  733. }
  734. if (x->lastused) {
  735. ret = nla_put_u64_64bit(skb, XFRMA_LASTUSED, x->lastused,
  736. XFRMA_PAD);
  737. if (ret)
  738. goto out;
  739. }
  740. if (x->aead) {
  741. ret = nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
  742. if (ret)
  743. goto out;
  744. }
  745. if (x->aalg) {
  746. ret = copy_to_user_auth(x->aalg, skb);
  747. if (!ret)
  748. ret = nla_put(skb, XFRMA_ALG_AUTH_TRUNC,
  749. xfrm_alg_auth_len(x->aalg), x->aalg);
  750. if (ret)
  751. goto out;
  752. }
  753. if (x->ealg) {
  754. ret = nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
  755. if (ret)
  756. goto out;
  757. }
  758. if (x->calg) {
  759. ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
  760. if (ret)
  761. goto out;
  762. }
  763. if (x->encap) {
  764. ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
  765. if (ret)
  766. goto out;
  767. }
  768. if (x->tfcpad) {
  769. ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad);
  770. if (ret)
  771. goto out;
  772. }
  773. ret = xfrm_mark_put(skb, &x->mark);
  774. if (ret)
  775. goto out;
  776. ret = xfrm_smark_put(skb, &x->props.smark);
  777. if (ret)
  778. goto out;
  779. if (x->replay_esn)
  780. ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
  781. xfrm_replay_state_esn_len(x->replay_esn),
  782. x->replay_esn);
  783. else
  784. ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
  785. &x->replay);
  786. if (ret)
  787. goto out;
  788. if(x->xso.dev)
  789. ret = copy_user_offload(&x->xso, skb);
  790. if (ret)
  791. goto out;
  792. if (x->if_id) {
  793. ret = nla_put_u32(skb, XFRMA_IF_ID, x->if_id);
  794. if (ret)
  795. goto out;
  796. }
  797. if (x->security)
  798. ret = copy_sec_ctx(x->security, skb);
  799. out:
  800. return ret;
  801. }
  802. static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
  803. {
  804. struct xfrm_dump_info *sp = ptr;
  805. struct sk_buff *in_skb = sp->in_skb;
  806. struct sk_buff *skb = sp->out_skb;
  807. struct xfrm_translator *xtr;
  808. struct xfrm_usersa_info *p;
  809. struct nlmsghdr *nlh;
  810. int err;
  811. nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
  812. XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
  813. if (nlh == NULL)
  814. return -EMSGSIZE;
  815. p = nlmsg_data(nlh);
  816. err = copy_to_user_state_extra(x, p, skb);
  817. if (err) {
  818. nlmsg_cancel(skb, nlh);
  819. return err;
  820. }
  821. nlmsg_end(skb, nlh);
  822. xtr = xfrm_get_translator();
  823. if (xtr) {
  824. err = xtr->alloc_compat(skb, nlh);
  825. xfrm_put_translator(xtr);
  826. if (err) {
  827. nlmsg_cancel(skb, nlh);
  828. return err;
  829. }
  830. }
  831. return 0;
  832. }
  833. static int xfrm_dump_sa_done(struct netlink_callback *cb)
  834. {
  835. struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
  836. struct sock *sk = cb->skb->sk;
  837. struct net *net = sock_net(sk);
  838. if (cb->args[0])
  839. xfrm_state_walk_done(walk, net);
  840. return 0;
  841. }
  842. static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
  843. {
  844. struct net *net = sock_net(skb->sk);
  845. struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
  846. struct xfrm_dump_info info;
  847. BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
  848. sizeof(cb->args) - sizeof(cb->args[0]));
  849. info.in_skb = cb->skb;
  850. info.out_skb = skb;
  851. info.nlmsg_seq = cb->nlh->nlmsg_seq;
  852. info.nlmsg_flags = NLM_F_MULTI;
  853. if (!cb->args[0]) {
  854. struct nlattr *attrs[XFRMA_MAX+1];
  855. struct xfrm_address_filter *filter = NULL;
  856. u8 proto = 0;
  857. int err;
  858. err = nlmsg_parse_deprecated(cb->nlh, 0, attrs, XFRMA_MAX,
  859. xfrma_policy, cb->extack);
  860. if (err < 0)
  861. return err;
  862. if (attrs[XFRMA_ADDRESS_FILTER]) {
  863. filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
  864. sizeof(*filter), GFP_KERNEL);
  865. if (filter == NULL)
  866. return -ENOMEM;
  867. }
  868. if (attrs[XFRMA_PROTO])
  869. proto = nla_get_u8(attrs[XFRMA_PROTO]);
  870. xfrm_state_walk_init(walk, proto, filter);
  871. cb->args[0] = 1;
  872. }
  873. (void) xfrm_state_walk(net, walk, dump_one_state, &info);
  874. return skb->len;
  875. }
  876. static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
  877. struct xfrm_state *x, u32 seq)
  878. {
  879. struct xfrm_dump_info info;
  880. struct sk_buff *skb;
  881. int err;
  882. skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
  883. if (!skb)
  884. return ERR_PTR(-ENOMEM);
  885. info.in_skb = in_skb;
  886. info.out_skb = skb;
  887. info.nlmsg_seq = seq;
  888. info.nlmsg_flags = 0;
  889. err = dump_one_state(x, 0, &info);
  890. if (err) {
  891. kfree_skb(skb);
  892. return ERR_PTR(err);
  893. }
  894. return skb;
  895. }
  896. /* A wrapper for nlmsg_multicast() checking that nlsk is still available.
  897. * Must be called with RCU read lock.
  898. */
  899. static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
  900. u32 pid, unsigned int group)
  901. {
  902. struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
  903. struct xfrm_translator *xtr;
  904. if (!nlsk) {
  905. kfree_skb(skb);
  906. return -EPIPE;
  907. }
  908. xtr = xfrm_get_translator();
  909. if (xtr) {
  910. int err = xtr->alloc_compat(skb, nlmsg_hdr(skb));
  911. xfrm_put_translator(xtr);
  912. if (err) {
  913. kfree_skb(skb);
  914. return err;
  915. }
  916. }
  917. return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
  918. }
  919. static inline unsigned int xfrm_spdinfo_msgsize(void)
  920. {
  921. return NLMSG_ALIGN(4)
  922. + nla_total_size(sizeof(struct xfrmu_spdinfo))
  923. + nla_total_size(sizeof(struct xfrmu_spdhinfo))
  924. + nla_total_size(sizeof(struct xfrmu_spdhthresh))
  925. + nla_total_size(sizeof(struct xfrmu_spdhthresh));
  926. }
  927. static int build_spdinfo(struct sk_buff *skb, struct net *net,
  928. u32 portid, u32 seq, u32 flags)
  929. {
  930. struct xfrmk_spdinfo si;
  931. struct xfrmu_spdinfo spc;
  932. struct xfrmu_spdhinfo sph;
  933. struct xfrmu_spdhthresh spt4, spt6;
  934. struct nlmsghdr *nlh;
  935. int err;
  936. u32 *f;
  937. unsigned lseq;
  938. nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
  939. if (nlh == NULL) /* shouldn't really happen ... */
  940. return -EMSGSIZE;
  941. f = nlmsg_data(nlh);
  942. *f = flags;
  943. xfrm_spd_getinfo(net, &si);
  944. spc.incnt = si.incnt;
  945. spc.outcnt = si.outcnt;
  946. spc.fwdcnt = si.fwdcnt;
  947. spc.inscnt = si.inscnt;
  948. spc.outscnt = si.outscnt;
  949. spc.fwdscnt = si.fwdscnt;
  950. sph.spdhcnt = si.spdhcnt;
  951. sph.spdhmcnt = si.spdhmcnt;
  952. do {
  953. lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock);
  954. spt4.lbits = net->xfrm.policy_hthresh.lbits4;
  955. spt4.rbits = net->xfrm.policy_hthresh.rbits4;
  956. spt6.lbits = net->xfrm.policy_hthresh.lbits6;
  957. spt6.rbits = net->xfrm.policy_hthresh.rbits6;
  958. } while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq));
  959. err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
  960. if (!err)
  961. err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
  962. if (!err)
  963. err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4);
  964. if (!err)
  965. err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6);
  966. if (err) {
  967. nlmsg_cancel(skb, nlh);
  968. return err;
  969. }
  970. nlmsg_end(skb, nlh);
  971. return 0;
  972. }
  973. static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
  974. struct nlattr **attrs)
  975. {
  976. struct net *net = sock_net(skb->sk);
  977. struct xfrmu_spdhthresh *thresh4 = NULL;
  978. struct xfrmu_spdhthresh *thresh6 = NULL;
  979. /* selector prefixlen thresholds to hash policies */
  980. if (attrs[XFRMA_SPD_IPV4_HTHRESH]) {
  981. struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH];
  982. if (nla_len(rta) < sizeof(*thresh4))
  983. return -EINVAL;
  984. thresh4 = nla_data(rta);
  985. if (thresh4->lbits > 32 || thresh4->rbits > 32)
  986. return -EINVAL;
  987. }
  988. if (attrs[XFRMA_SPD_IPV6_HTHRESH]) {
  989. struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH];
  990. if (nla_len(rta) < sizeof(*thresh6))
  991. return -EINVAL;
  992. thresh6 = nla_data(rta);
  993. if (thresh6->lbits > 128 || thresh6->rbits > 128)
  994. return -EINVAL;
  995. }
  996. if (thresh4 || thresh6) {
  997. write_seqlock(&net->xfrm.policy_hthresh.lock);
  998. if (thresh4) {
  999. net->xfrm.policy_hthresh.lbits4 = thresh4->lbits;
  1000. net->xfrm.policy_hthresh.rbits4 = thresh4->rbits;
  1001. }
  1002. if (thresh6) {
  1003. net->xfrm.policy_hthresh.lbits6 = thresh6->lbits;
  1004. net->xfrm.policy_hthresh.rbits6 = thresh6->rbits;
  1005. }
  1006. write_sequnlock(&net->xfrm.policy_hthresh.lock);
  1007. xfrm_policy_hash_rebuild(net);
  1008. }
  1009. return 0;
  1010. }
  1011. static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
  1012. struct nlattr **attrs)
  1013. {
  1014. struct net *net = sock_net(skb->sk);
  1015. struct sk_buff *r_skb;
  1016. u32 *flags = nlmsg_data(nlh);
  1017. u32 sportid = NETLINK_CB(skb).portid;
  1018. u32 seq = nlh->nlmsg_seq;
  1019. int err;
  1020. r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
  1021. if (r_skb == NULL)
  1022. return -ENOMEM;
  1023. err = build_spdinfo(r_skb, net, sportid, seq, *flags);
  1024. BUG_ON(err < 0);
  1025. return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
  1026. }
  1027. static inline unsigned int xfrm_sadinfo_msgsize(void)
  1028. {
  1029. return NLMSG_ALIGN(4)
  1030. + nla_total_size(sizeof(struct xfrmu_sadhinfo))
  1031. + nla_total_size(4); /* XFRMA_SAD_CNT */
  1032. }
  1033. static int build_sadinfo(struct sk_buff *skb, struct net *net,
  1034. u32 portid, u32 seq, u32 flags)
  1035. {
  1036. struct xfrmk_sadinfo si;
  1037. struct xfrmu_sadhinfo sh;
  1038. struct nlmsghdr *nlh;
  1039. int err;
  1040. u32 *f;
  1041. nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
  1042. if (nlh == NULL) /* shouldn't really happen ... */
  1043. return -EMSGSIZE;
  1044. f = nlmsg_data(nlh);
  1045. *f = flags;
  1046. xfrm_sad_getinfo(net, &si);
  1047. sh.sadhmcnt = si.sadhmcnt;
  1048. sh.sadhcnt = si.sadhcnt;
  1049. err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt);
  1050. if (!err)
  1051. err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
  1052. if (err) {
  1053. nlmsg_cancel(skb, nlh);
  1054. return err;
  1055. }
  1056. nlmsg_end(skb, nlh);
  1057. return 0;
  1058. }
  1059. static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
  1060. struct nlattr **attrs)
  1061. {
  1062. struct net *net = sock_net(skb->sk);
  1063. struct sk_buff *r_skb;
  1064. u32 *flags = nlmsg_data(nlh);
  1065. u32 sportid = NETLINK_CB(skb).portid;
  1066. u32 seq = nlh->nlmsg_seq;
  1067. int err;
  1068. r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
  1069. if (r_skb == NULL)
  1070. return -ENOMEM;
  1071. err = build_sadinfo(r_skb, net, sportid, seq, *flags);
  1072. BUG_ON(err < 0);
  1073. return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
  1074. }
  1075. static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  1076. struct nlattr **attrs)
  1077. {
  1078. struct net *net = sock_net(skb->sk);
  1079. struct xfrm_usersa_id *p = nlmsg_data(nlh);
  1080. struct xfrm_state *x;
  1081. struct sk_buff *resp_skb;
  1082. int err = -ESRCH;
  1083. x = xfrm_user_state_lookup(net, p, attrs, &err);
  1084. if (x == NULL)
  1085. goto out_noput;
  1086. resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
  1087. if (IS_ERR(resp_skb)) {
  1088. err = PTR_ERR(resp_skb);
  1089. } else {
  1090. err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
  1091. }
  1092. xfrm_state_put(x);
  1093. out_noput:
  1094. return err;
  1095. }
  1096. static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
  1097. struct nlattr **attrs)
  1098. {
  1099. struct net *net = sock_net(skb->sk);
  1100. struct xfrm_state *x;
  1101. struct xfrm_userspi_info *p;
  1102. struct xfrm_translator *xtr;
  1103. struct sk_buff *resp_skb;
  1104. xfrm_address_t *daddr;
  1105. int family;
  1106. int err;
  1107. u32 mark;
  1108. struct xfrm_mark m;
  1109. u32 if_id = 0;
  1110. p = nlmsg_data(nlh);
  1111. err = verify_spi_info(p->info.id.proto, p->min, p->max);
  1112. if (err)
  1113. goto out_noput;
  1114. family = p->info.family;
  1115. daddr = &p->info.id.daddr;
  1116. x = NULL;
  1117. mark = xfrm_mark_get(attrs, &m);
  1118. if (attrs[XFRMA_IF_ID])
  1119. if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
  1120. if (p->info.seq) {
  1121. x = xfrm_find_acq_byseq(net, mark, p->info.seq);
  1122. if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) {
  1123. xfrm_state_put(x);
  1124. x = NULL;
  1125. }
  1126. }
  1127. if (!x)
  1128. x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
  1129. if_id, p->info.id.proto, daddr,
  1130. &p->info.saddr, 1,
  1131. family);
  1132. err = -ENOENT;
  1133. if (x == NULL)
  1134. goto out_noput;
  1135. err = xfrm_alloc_spi(x, p->min, p->max);
  1136. if (err)
  1137. goto out;
  1138. resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
  1139. if (IS_ERR(resp_skb)) {
  1140. err = PTR_ERR(resp_skb);
  1141. goto out;
  1142. }
  1143. xtr = xfrm_get_translator();
  1144. if (xtr) {
  1145. err = xtr->alloc_compat(skb, nlmsg_hdr(skb));
  1146. xfrm_put_translator(xtr);
  1147. if (err) {
  1148. kfree_skb(resp_skb);
  1149. goto out;
  1150. }
  1151. }
  1152. err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
  1153. out:
  1154. xfrm_state_put(x);
  1155. out_noput:
  1156. return err;
  1157. }
  1158. static int verify_policy_dir(u8 dir)
  1159. {
  1160. switch (dir) {
  1161. case XFRM_POLICY_IN:
  1162. case XFRM_POLICY_OUT:
  1163. case XFRM_POLICY_FWD:
  1164. break;
  1165. default:
  1166. return -EINVAL;
  1167. }
  1168. return 0;
  1169. }
  1170. static int verify_policy_type(u8 type)
  1171. {
  1172. switch (type) {
  1173. case XFRM_POLICY_TYPE_MAIN:
  1174. #ifdef CONFIG_XFRM_SUB_POLICY
  1175. case XFRM_POLICY_TYPE_SUB:
  1176. #endif
  1177. break;
  1178. default:
  1179. return -EINVAL;
  1180. }
  1181. return 0;
  1182. }
  1183. static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
  1184. {
  1185. int ret;
  1186. switch (p->share) {
  1187. case XFRM_SHARE_ANY:
  1188. case XFRM_SHARE_SESSION:
  1189. case XFRM_SHARE_USER:
  1190. case XFRM_SHARE_UNIQUE:
  1191. break;
  1192. default:
  1193. return -EINVAL;
  1194. }
  1195. switch (p->action) {
  1196. case XFRM_POLICY_ALLOW:
  1197. case XFRM_POLICY_BLOCK:
  1198. break;
  1199. default:
  1200. return -EINVAL;
  1201. }
  1202. switch (p->sel.family) {
  1203. case AF_INET:
  1204. if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
  1205. return -EINVAL;
  1206. break;
  1207. case AF_INET6:
  1208. #if IS_ENABLED(CONFIG_IPV6)
  1209. if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
  1210. return -EINVAL;
  1211. break;
  1212. #else
  1213. return -EAFNOSUPPORT;
  1214. #endif
  1215. default:
  1216. return -EINVAL;
  1217. }
  1218. ret = verify_policy_dir(p->dir);
  1219. if (ret)
  1220. return ret;
  1221. if (p->index && (xfrm_policy_id2dir(p->index) != p->dir))
  1222. return -EINVAL;
  1223. return 0;
  1224. }
  1225. static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
  1226. {
  1227. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  1228. struct xfrm_user_sec_ctx *uctx;
  1229. if (!rt)
  1230. return 0;
  1231. uctx = nla_data(rt);
  1232. return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL);
  1233. }
  1234. static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
  1235. int nr)
  1236. {
  1237. int i;
  1238. xp->xfrm_nr = nr;
  1239. for (i = 0; i < nr; i++, ut++) {
  1240. struct xfrm_tmpl *t = &xp->xfrm_vec[i];
  1241. memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
  1242. memcpy(&t->saddr, &ut->saddr,
  1243. sizeof(xfrm_address_t));
  1244. t->reqid = ut->reqid;
  1245. t->mode = ut->mode;
  1246. t->share = ut->share;
  1247. t->optional = ut->optional;
  1248. t->aalgos = ut->aalgos;
  1249. t->ealgos = ut->ealgos;
  1250. t->calgos = ut->calgos;
  1251. /* If all masks are ~0, then we allow all algorithms. */
  1252. t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
  1253. t->encap_family = ut->family;
  1254. }
  1255. }
  1256. static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
  1257. {
  1258. u16 prev_family;
  1259. int i;
  1260. if (nr > XFRM_MAX_DEPTH)
  1261. return -EINVAL;
  1262. prev_family = family;
  1263. for (i = 0; i < nr; i++) {
  1264. /* We never validated the ut->family value, so many
  1265. * applications simply leave it at zero. The check was
  1266. * never made and ut->family was ignored because all
  1267. * templates could be assumed to have the same family as
  1268. * the policy itself. Now that we will have ipv4-in-ipv6
  1269. * and ipv6-in-ipv4 tunnels, this is no longer true.
  1270. */
  1271. if (!ut[i].family)
  1272. ut[i].family = family;
  1273. switch (ut[i].mode) {
  1274. case XFRM_MODE_TUNNEL:
  1275. case XFRM_MODE_BEET:
  1276. break;
  1277. default:
  1278. if (ut[i].family != prev_family)
  1279. return -EINVAL;
  1280. break;
  1281. }
  1282. if (ut[i].mode >= XFRM_MODE_MAX)
  1283. return -EINVAL;
  1284. prev_family = ut[i].family;
  1285. switch (ut[i].family) {
  1286. case AF_INET:
  1287. break;
  1288. #if IS_ENABLED(CONFIG_IPV6)
  1289. case AF_INET6:
  1290. break;
  1291. #endif
  1292. default:
  1293. return -EINVAL;
  1294. }
  1295. if (!xfrm_id_proto_valid(ut[i].id.proto))
  1296. return -EINVAL;
  1297. }
  1298. return 0;
  1299. }
  1300. static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
  1301. {
  1302. struct nlattr *rt = attrs[XFRMA_TMPL];
  1303. if (!rt) {
  1304. pol->xfrm_nr = 0;
  1305. } else {
  1306. struct xfrm_user_tmpl *utmpl = nla_data(rt);
  1307. int nr = nla_len(rt) / sizeof(*utmpl);
  1308. int err;
  1309. err = validate_tmpl(nr, utmpl, pol->family);
  1310. if (err)
  1311. return err;
  1312. copy_templates(pol, utmpl, nr);
  1313. }
  1314. return 0;
  1315. }
  1316. static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
  1317. {
  1318. struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
  1319. struct xfrm_userpolicy_type *upt;
  1320. u8 type = XFRM_POLICY_TYPE_MAIN;
  1321. int err;
  1322. if (rt) {
  1323. upt = nla_data(rt);
  1324. type = upt->type;
  1325. }
  1326. err = verify_policy_type(type);
  1327. if (err)
  1328. return err;
  1329. *tp = type;
  1330. return 0;
  1331. }
  1332. static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
  1333. {
  1334. xp->priority = p->priority;
  1335. xp->index = p->index;
  1336. memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
  1337. memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
  1338. xp->action = p->action;
  1339. xp->flags = p->flags;
  1340. xp->family = p->sel.family;
  1341. /* XXX xp->share = p->share; */
  1342. }
  1343. static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
  1344. {
  1345. memset(p, 0, sizeof(*p));
  1346. memcpy(&p->sel, &xp->selector, sizeof(p->sel));
  1347. memcpy(&p->lft, &xp->lft, sizeof(p->lft));
  1348. memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
  1349. p->priority = xp->priority;
  1350. p->index = xp->index;
  1351. p->sel.family = xp->family;
  1352. p->dir = dir;
  1353. p->action = xp->action;
  1354. p->flags = xp->flags;
  1355. p->share = XFRM_SHARE_ANY; /* XXX xp->share */
  1356. }
  1357. static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
  1358. {
  1359. struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
  1360. int err;
  1361. if (!xp) {
  1362. *errp = -ENOMEM;
  1363. return NULL;
  1364. }
  1365. copy_from_user_policy(xp, p);
  1366. err = copy_from_user_policy_type(&xp->type, attrs);
  1367. if (err)
  1368. goto error;
  1369. if (!(err = copy_from_user_tmpl(xp, attrs)))
  1370. err = copy_from_user_sec_ctx(xp, attrs);
  1371. if (err)
  1372. goto error;
  1373. xfrm_mark_get(attrs, &xp->mark);
  1374. if (attrs[XFRMA_IF_ID])
  1375. xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
  1376. return xp;
  1377. error:
  1378. *errp = err;
  1379. xp->walk.dead = 1;
  1380. xfrm_policy_destroy(xp);
  1381. return NULL;
  1382. }
  1383. static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
  1384. struct nlattr **attrs)
  1385. {
  1386. struct net *net = sock_net(skb->sk);
  1387. struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
  1388. struct xfrm_policy *xp;
  1389. struct km_event c;
  1390. int err;
  1391. int excl;
  1392. err = verify_newpolicy_info(p);
  1393. if (err)
  1394. return err;
  1395. err = verify_sec_ctx_len(attrs);
  1396. if (err)
  1397. return err;
  1398. xp = xfrm_policy_construct(net, p, attrs, &err);
  1399. if (!xp)
  1400. return err;
  1401. /* shouldn't excl be based on nlh flags??
  1402. * Aha! this is anti-netlink really i.e more pfkey derived
  1403. * in netlink excl is a flag and you wouldnt need
  1404. * a type XFRM_MSG_UPDPOLICY - JHS */
  1405. excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
  1406. err = xfrm_policy_insert(p->dir, xp, excl);
  1407. xfrm_audit_policy_add(xp, err ? 0 : 1, true);
  1408. if (err) {
  1409. security_xfrm_policy_free(xp->security);
  1410. kfree(xp);
  1411. return err;
  1412. }
  1413. c.event = nlh->nlmsg_type;
  1414. c.seq = nlh->nlmsg_seq;
  1415. c.portid = nlh->nlmsg_pid;
  1416. km_policy_notify(xp, p->dir, &c);
  1417. xfrm_pol_put(xp);
  1418. return 0;
  1419. }
  1420. static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
  1421. {
  1422. struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
  1423. int i;
  1424. if (xp->xfrm_nr == 0)
  1425. return 0;
  1426. for (i = 0; i < xp->xfrm_nr; i++) {
  1427. struct xfrm_user_tmpl *up = &vec[i];
  1428. struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
  1429. memset(up, 0, sizeof(*up));
  1430. memcpy(&up->id, &kp->id, sizeof(up->id));
  1431. up->family = kp->encap_family;
  1432. memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
  1433. up->reqid = kp->reqid;
  1434. up->mode = kp->mode;
  1435. up->share = kp->share;
  1436. up->optional = kp->optional;
  1437. up->aalgos = kp->aalgos;
  1438. up->ealgos = kp->ealgos;
  1439. up->calgos = kp->calgos;
  1440. }
  1441. return nla_put(skb, XFRMA_TMPL,
  1442. sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
  1443. }
  1444. static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
  1445. {
  1446. if (x->security) {
  1447. return copy_sec_ctx(x->security, skb);
  1448. }
  1449. return 0;
  1450. }
  1451. static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
  1452. {
  1453. if (xp->security)
  1454. return copy_sec_ctx(xp->security, skb);
  1455. return 0;
  1456. }
  1457. static inline unsigned int userpolicy_type_attrsize(void)
  1458. {
  1459. #ifdef CONFIG_XFRM_SUB_POLICY
  1460. return nla_total_size(sizeof(struct xfrm_userpolicy_type));
  1461. #else
  1462. return 0;
  1463. #endif
  1464. }
  1465. #ifdef CONFIG_XFRM_SUB_POLICY
  1466. static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
  1467. {
  1468. struct xfrm_userpolicy_type upt;
  1469. /* Sadly there are two holes in struct xfrm_userpolicy_type */
  1470. memset(&upt, 0, sizeof(upt));
  1471. upt.type = type;
  1472. return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
  1473. }
  1474. #else
  1475. static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
  1476. {
  1477. return 0;
  1478. }
  1479. #endif
  1480. static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
  1481. {
  1482. struct xfrm_dump_info *sp = ptr;
  1483. struct xfrm_userpolicy_info *p;
  1484. struct sk_buff *in_skb = sp->in_skb;
  1485. struct sk_buff *skb = sp->out_skb;
  1486. struct xfrm_translator *xtr;
  1487. struct nlmsghdr *nlh;
  1488. int err;
  1489. nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
  1490. XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
  1491. if (nlh == NULL)
  1492. return -EMSGSIZE;
  1493. p = nlmsg_data(nlh);
  1494. copy_to_user_policy(xp, p, dir);
  1495. err = copy_to_user_tmpl(xp, skb);
  1496. if (!err)
  1497. err = copy_to_user_sec_ctx(xp, skb);
  1498. if (!err)
  1499. err = copy_to_user_policy_type(xp->type, skb);
  1500. if (!err)
  1501. err = xfrm_mark_put(skb, &xp->mark);
  1502. if (!err)
  1503. err = xfrm_if_id_put(skb, xp->if_id);
  1504. if (err) {
  1505. nlmsg_cancel(skb, nlh);
  1506. return err;
  1507. }
  1508. nlmsg_end(skb, nlh);
  1509. xtr = xfrm_get_translator();
  1510. if (xtr) {
  1511. err = xtr->alloc_compat(skb, nlh);
  1512. xfrm_put_translator(xtr);
  1513. if (err) {
  1514. nlmsg_cancel(skb, nlh);
  1515. return err;
  1516. }
  1517. }
  1518. return 0;
  1519. }
  1520. static int xfrm_dump_policy_done(struct netlink_callback *cb)
  1521. {
  1522. struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
  1523. struct net *net = sock_net(cb->skb->sk);
  1524. xfrm_policy_walk_done(walk, net);
  1525. return 0;
  1526. }
  1527. static int xfrm_dump_policy_start(struct netlink_callback *cb)
  1528. {
  1529. struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
  1530. BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
  1531. xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
  1532. return 0;
  1533. }
  1534. static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
  1535. {
  1536. struct net *net = sock_net(skb->sk);
  1537. struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
  1538. struct xfrm_dump_info info;
  1539. info.in_skb = cb->skb;
  1540. info.out_skb = skb;
  1541. info.nlmsg_seq = cb->nlh->nlmsg_seq;
  1542. info.nlmsg_flags = NLM_F_MULTI;
  1543. (void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
  1544. return skb->len;
  1545. }
  1546. static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
  1547. struct xfrm_policy *xp,
  1548. int dir, u32 seq)
  1549. {
  1550. struct xfrm_dump_info info;
  1551. struct sk_buff *skb;
  1552. int err;
  1553. skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  1554. if (!skb)
  1555. return ERR_PTR(-ENOMEM);
  1556. info.in_skb = in_skb;
  1557. info.out_skb = skb;
  1558. info.nlmsg_seq = seq;
  1559. info.nlmsg_flags = 0;
  1560. err = dump_one_policy(xp, dir, 0, &info);
  1561. if (err) {
  1562. kfree_skb(skb);
  1563. return ERR_PTR(err);
  1564. }
  1565. return skb;
  1566. }
  1567. static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
  1568. struct nlattr **attrs)
  1569. {
  1570. struct net *net = sock_net(skb->sk);
  1571. struct xfrm_policy *xp;
  1572. struct xfrm_userpolicy_id *p;
  1573. u8 type = XFRM_POLICY_TYPE_MAIN;
  1574. int err;
  1575. struct km_event c;
  1576. int delete;
  1577. struct xfrm_mark m;
  1578. u32 if_id = 0;
  1579. p = nlmsg_data(nlh);
  1580. delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
  1581. err = copy_from_user_policy_type(&type, attrs);
  1582. if (err)
  1583. return err;
  1584. err = verify_policy_dir(p->dir);
  1585. if (err)
  1586. return err;
  1587. if (attrs[XFRMA_IF_ID])
  1588. if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
  1589. xfrm_mark_get(attrs, &m);
  1590. if (p->index)
  1591. xp = xfrm_policy_byid(net, &m, if_id, type, p->dir,
  1592. p->index, delete, &err);
  1593. else {
  1594. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  1595. struct xfrm_sec_ctx *ctx;
  1596. err = verify_sec_ctx_len(attrs);
  1597. if (err)
  1598. return err;
  1599. ctx = NULL;
  1600. if (rt) {
  1601. struct xfrm_user_sec_ctx *uctx = nla_data(rt);
  1602. err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
  1603. if (err)
  1604. return err;
  1605. }
  1606. xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
  1607. &p->sel, ctx, delete, &err);
  1608. security_xfrm_policy_free(ctx);
  1609. }
  1610. if (xp == NULL)
  1611. return -ENOENT;
  1612. if (!delete) {
  1613. struct sk_buff *resp_skb;
  1614. resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
  1615. if (IS_ERR(resp_skb)) {
  1616. err = PTR_ERR(resp_skb);
  1617. } else {
  1618. err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
  1619. NETLINK_CB(skb).portid);
  1620. }
  1621. } else {
  1622. xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
  1623. if (err != 0)
  1624. goto out;
  1625. c.data.byid = p->index;
  1626. c.event = nlh->nlmsg_type;
  1627. c.seq = nlh->nlmsg_seq;
  1628. c.portid = nlh->nlmsg_pid;
  1629. km_policy_notify(xp, p->dir, &c);
  1630. }
  1631. out:
  1632. xfrm_pol_put(xp);
  1633. return err;
  1634. }
  1635. static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
  1636. struct nlattr **attrs)
  1637. {
  1638. struct net *net = sock_net(skb->sk);
  1639. struct km_event c;
  1640. struct xfrm_usersa_flush *p = nlmsg_data(nlh);
  1641. int err;
  1642. err = xfrm_state_flush(net, p->proto, true, false);
  1643. if (err) {
  1644. if (err == -ESRCH) /* empty table */
  1645. return 0;
  1646. return err;
  1647. }
  1648. c.data.proto = p->proto;
  1649. c.event = nlh->nlmsg_type;
  1650. c.seq = nlh->nlmsg_seq;
  1651. c.portid = nlh->nlmsg_pid;
  1652. c.net = net;
  1653. km_state_notify(NULL, &c);
  1654. return 0;
  1655. }
  1656. static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x)
  1657. {
  1658. unsigned int replay_size = x->replay_esn ?
  1659. xfrm_replay_state_esn_len(x->replay_esn) :
  1660. sizeof(struct xfrm_replay_state);
  1661. return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
  1662. + nla_total_size(replay_size)
  1663. + nla_total_size_64bit(sizeof(struct xfrm_lifetime_cur))
  1664. + nla_total_size(sizeof(struct xfrm_mark))
  1665. + nla_total_size(4) /* XFRM_AE_RTHR */
  1666. + nla_total_size(4); /* XFRM_AE_ETHR */
  1667. }
  1668. static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
  1669. {
  1670. struct xfrm_aevent_id *id;
  1671. struct nlmsghdr *nlh;
  1672. int err;
  1673. nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
  1674. if (nlh == NULL)
  1675. return -EMSGSIZE;
  1676. id = nlmsg_data(nlh);
  1677. memset(&id->sa_id, 0, sizeof(id->sa_id));
  1678. memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr));
  1679. id->sa_id.spi = x->id.spi;
  1680. id->sa_id.family = x->props.family;
  1681. id->sa_id.proto = x->id.proto;
  1682. memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr));
  1683. id->reqid = x->props.reqid;
  1684. id->flags = c->data.aevent;
  1685. if (x->replay_esn) {
  1686. err = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
  1687. xfrm_replay_state_esn_len(x->replay_esn),
  1688. x->replay_esn);
  1689. } else {
  1690. err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
  1691. &x->replay);
  1692. }
  1693. if (err)
  1694. goto out_cancel;
  1695. err = nla_put_64bit(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft,
  1696. XFRMA_PAD);
  1697. if (err)
  1698. goto out_cancel;
  1699. if (id->flags & XFRM_AE_RTHR) {
  1700. err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
  1701. if (err)
  1702. goto out_cancel;
  1703. }
  1704. if (id->flags & XFRM_AE_ETHR) {
  1705. err = nla_put_u32(skb, XFRMA_ETIMER_THRESH,
  1706. x->replay_maxage * 10 / HZ);
  1707. if (err)
  1708. goto out_cancel;
  1709. }
  1710. err = xfrm_mark_put(skb, &x->mark);
  1711. if (err)
  1712. goto out_cancel;
  1713. err = xfrm_if_id_put(skb, x->if_id);
  1714. if (err)
  1715. goto out_cancel;
  1716. nlmsg_end(skb, nlh);
  1717. return 0;
  1718. out_cancel:
  1719. nlmsg_cancel(skb, nlh);
  1720. return err;
  1721. }
  1722. static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
  1723. struct nlattr **attrs)
  1724. {
  1725. struct net *net = sock_net(skb->sk);
  1726. struct xfrm_state *x;
  1727. struct sk_buff *r_skb;
  1728. int err;
  1729. struct km_event c;
  1730. u32 mark;
  1731. struct xfrm_mark m;
  1732. struct xfrm_aevent_id *p = nlmsg_data(nlh);
  1733. struct xfrm_usersa_id *id = &p->sa_id;
  1734. mark = xfrm_mark_get(attrs, &m);
  1735. x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
  1736. if (x == NULL)
  1737. return -ESRCH;
  1738. r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
  1739. if (r_skb == NULL) {
  1740. xfrm_state_put(x);
  1741. return -ENOMEM;
  1742. }
  1743. /*
  1744. * XXX: is this lock really needed - none of the other
  1745. * gets lock (the concern is things getting updated
  1746. * while we are still reading) - jhs
  1747. */
  1748. spin_lock_bh(&x->lock);
  1749. c.data.aevent = p->flags;
  1750. c.seq = nlh->nlmsg_seq;
  1751. c.portid = nlh->nlmsg_pid;
  1752. err = build_aevent(r_skb, x, &c);
  1753. BUG_ON(err < 0);
  1754. err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
  1755. spin_unlock_bh(&x->lock);
  1756. xfrm_state_put(x);
  1757. return err;
  1758. }
  1759. static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
  1760. struct nlattr **attrs)
  1761. {
  1762. struct net *net = sock_net(skb->sk);
  1763. struct xfrm_state *x;
  1764. struct km_event c;
  1765. int err = -EINVAL;
  1766. u32 mark = 0;
  1767. struct xfrm_mark m;
  1768. struct xfrm_aevent_id *p = nlmsg_data(nlh);
  1769. struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
  1770. struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
  1771. struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
  1772. struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
  1773. struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
  1774. if (!lt && !rp && !re && !et && !rt)
  1775. return err;
  1776. /* pedantic mode - thou shalt sayeth replaceth */
  1777. if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
  1778. return err;
  1779. mark = xfrm_mark_get(attrs, &m);
  1780. x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
  1781. if (x == NULL)
  1782. return -ESRCH;
  1783. if (x->km.state != XFRM_STATE_VALID)
  1784. goto out;
  1785. err = xfrm_replay_verify_len(x->replay_esn, re);
  1786. if (err)
  1787. goto out;
  1788. spin_lock_bh(&x->lock);
  1789. xfrm_update_ae_params(x, attrs, 1);
  1790. spin_unlock_bh(&x->lock);
  1791. c.event = nlh->nlmsg_type;
  1792. c.seq = nlh->nlmsg_seq;
  1793. c.portid = nlh->nlmsg_pid;
  1794. c.data.aevent = XFRM_AE_CU;
  1795. km_state_notify(x, &c);
  1796. err = 0;
  1797. out:
  1798. xfrm_state_put(x);
  1799. return err;
  1800. }
  1801. static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
  1802. struct nlattr **attrs)
  1803. {
  1804. struct net *net = sock_net(skb->sk);
  1805. struct km_event c;
  1806. u8 type = XFRM_POLICY_TYPE_MAIN;
  1807. int err;
  1808. err = copy_from_user_policy_type(&type, attrs);
  1809. if (err)
  1810. return err;
  1811. err = xfrm_policy_flush(net, type, true);
  1812. if (err) {
  1813. if (err == -ESRCH) /* empty table */
  1814. return 0;
  1815. return err;
  1816. }
  1817. c.data.type = type;
  1818. c.event = nlh->nlmsg_type;
  1819. c.seq = nlh->nlmsg_seq;
  1820. c.portid = nlh->nlmsg_pid;
  1821. c.net = net;
  1822. km_policy_notify(NULL, 0, &c);
  1823. return 0;
  1824. }
  1825. static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
  1826. struct nlattr **attrs)
  1827. {
  1828. struct net *net = sock_net(skb->sk);
  1829. struct xfrm_policy *xp;
  1830. struct xfrm_user_polexpire *up = nlmsg_data(nlh);
  1831. struct xfrm_userpolicy_info *p = &up->pol;
  1832. u8 type = XFRM_POLICY_TYPE_MAIN;
  1833. int err = -ENOENT;
  1834. struct xfrm_mark m;
  1835. u32 if_id = 0;
  1836. err = copy_from_user_policy_type(&type, attrs);
  1837. if (err)
  1838. return err;
  1839. err = verify_policy_dir(p->dir);
  1840. if (err)
  1841. return err;
  1842. if (attrs[XFRMA_IF_ID])
  1843. if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
  1844. xfrm_mark_get(attrs, &m);
  1845. if (p->index)
  1846. xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index,
  1847. 0, &err);
  1848. else {
  1849. struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  1850. struct xfrm_sec_ctx *ctx;
  1851. err = verify_sec_ctx_len(attrs);
  1852. if (err)
  1853. return err;
  1854. ctx = NULL;
  1855. if (rt) {
  1856. struct xfrm_user_sec_ctx *uctx = nla_data(rt);
  1857. err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
  1858. if (err)
  1859. return err;
  1860. }
  1861. xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
  1862. &p->sel, ctx, 0, &err);
  1863. security_xfrm_policy_free(ctx);
  1864. }
  1865. if (xp == NULL)
  1866. return -ENOENT;
  1867. if (unlikely(xp->walk.dead))
  1868. goto out;
  1869. err = 0;
  1870. if (up->hard) {
  1871. xfrm_policy_delete(xp, p->dir);
  1872. xfrm_audit_policy_delete(xp, 1, true);
  1873. }
  1874. km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
  1875. out:
  1876. xfrm_pol_put(xp);
  1877. return err;
  1878. }
  1879. static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
  1880. struct nlattr **attrs)
  1881. {
  1882. struct net *net = sock_net(skb->sk);
  1883. struct xfrm_state *x;
  1884. int err;
  1885. struct xfrm_user_expire *ue = nlmsg_data(nlh);
  1886. struct xfrm_usersa_info *p = &ue->state;
  1887. struct xfrm_mark m;
  1888. u32 mark = xfrm_mark_get(attrs, &m);
  1889. x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
  1890. err = -ENOENT;
  1891. if (x == NULL)
  1892. return err;
  1893. spin_lock_bh(&x->lock);
  1894. err = -EINVAL;
  1895. if (x->km.state != XFRM_STATE_VALID)
  1896. goto out;
  1897. km_state_expired(x, ue->hard, nlh->nlmsg_pid);
  1898. if (ue->hard) {
  1899. __xfrm_state_delete(x);
  1900. xfrm_audit_state_delete(x, 1, true);
  1901. }
  1902. err = 0;
  1903. out:
  1904. spin_unlock_bh(&x->lock);
  1905. xfrm_state_put(x);
  1906. return err;
  1907. }
  1908. static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
  1909. struct nlattr **attrs)
  1910. {
  1911. struct net *net = sock_net(skb->sk);
  1912. struct xfrm_policy *xp;
  1913. struct xfrm_user_tmpl *ut;
  1914. int i;
  1915. struct nlattr *rt = attrs[XFRMA_TMPL];
  1916. struct xfrm_mark mark;
  1917. struct xfrm_user_acquire *ua = nlmsg_data(nlh);
  1918. struct xfrm_state *x = xfrm_state_alloc(net);
  1919. int err = -ENOMEM;
  1920. if (!x)
  1921. goto nomem;
  1922. xfrm_mark_get(attrs, &mark);
  1923. err = verify_newpolicy_info(&ua->policy);
  1924. if (err)
  1925. goto free_state;
  1926. err = verify_sec_ctx_len(attrs);
  1927. if (err)
  1928. goto free_state;
  1929. /* build an XP */
  1930. xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
  1931. if (!xp)
  1932. goto free_state;
  1933. memcpy(&x->id, &ua->id, sizeof(ua->id));
  1934. memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
  1935. memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
  1936. xp->mark.m = x->mark.m = mark.m;
  1937. xp->mark.v = x->mark.v = mark.v;
  1938. ut = nla_data(rt);
  1939. /* extract the templates and for each call km_key */
  1940. for (i = 0; i < xp->xfrm_nr; i++, ut++) {
  1941. struct xfrm_tmpl *t = &xp->xfrm_vec[i];
  1942. memcpy(&x->id, &t->id, sizeof(x->id));
  1943. x->props.mode = t->mode;
  1944. x->props.reqid = t->reqid;
  1945. x->props.family = ut->family;
  1946. t->aalgos = ua->aalgos;
  1947. t->ealgos = ua->ealgos;
  1948. t->calgos = ua->calgos;
  1949. err = km_query(x, t, xp);
  1950. }
  1951. xfrm_state_free(x);
  1952. kfree(xp);
  1953. return 0;
  1954. free_state:
  1955. xfrm_state_free(x);
  1956. nomem:
  1957. return err;
  1958. }
  1959. #ifdef CONFIG_XFRM_MIGRATE
  1960. static int copy_from_user_migrate(struct xfrm_migrate *ma,
  1961. struct xfrm_kmaddress *k,
  1962. struct nlattr **attrs, int *num)
  1963. {
  1964. struct nlattr *rt = attrs[XFRMA_MIGRATE];
  1965. struct xfrm_user_migrate *um;
  1966. int i, num_migrate;
  1967. if (k != NULL) {
  1968. struct xfrm_user_kmaddress *uk;
  1969. uk = nla_data(attrs[XFRMA_KMADDRESS]);
  1970. memcpy(&k->local, &uk->local, sizeof(k->local));
  1971. memcpy(&k->remote, &uk->remote, sizeof(k->remote));
  1972. k->family = uk->family;
  1973. k->reserved = uk->reserved;
  1974. }
  1975. um = nla_data(rt);
  1976. num_migrate = nla_len(rt) / sizeof(*um);
  1977. if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
  1978. return -EINVAL;
  1979. for (i = 0; i < num_migrate; i++, um++, ma++) {
  1980. memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
  1981. memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
  1982. memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
  1983. memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
  1984. ma->proto = um->proto;
  1985. ma->mode = um->mode;
  1986. ma->reqid = um->reqid;
  1987. ma->old_family = um->old_family;
  1988. ma->new_family = um->new_family;
  1989. }
  1990. *num = i;
  1991. return 0;
  1992. }
  1993. static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
  1994. struct nlattr **attrs)
  1995. {
  1996. struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
  1997. struct xfrm_migrate m[XFRM_MAX_DEPTH];
  1998. struct xfrm_kmaddress km, *kmp;
  1999. u8 type;
  2000. int err;
  2001. int n = 0;
  2002. struct net *net = sock_net(skb->sk);
  2003. struct xfrm_encap_tmpl *encap = NULL;
  2004. u32 if_id = 0;
  2005. if (attrs[XFRMA_MIGRATE] == NULL)
  2006. return -EINVAL;
  2007. kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;
  2008. err = copy_from_user_policy_type(&type, attrs);
  2009. if (err)
  2010. return err;
  2011. err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
  2012. if (err)
  2013. return err;
  2014. if (!n)
  2015. return 0;
  2016. if (attrs[XFRMA_ENCAP]) {
  2017. encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
  2018. sizeof(*encap), GFP_KERNEL);
  2019. if (!encap)
  2020. return 0;
  2021. }
  2022. if (attrs[XFRMA_IF_ID])
  2023. if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
  2024. err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap, if_id);
  2025. kfree(encap);
  2026. return err;
  2027. }
  2028. #else
  2029. static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
  2030. struct nlattr **attrs)
  2031. {
  2032. return -ENOPROTOOPT;
  2033. }
  2034. #endif
  2035. #ifdef CONFIG_XFRM_MIGRATE
  2036. static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
  2037. {
  2038. struct xfrm_user_migrate um;
  2039. memset(&um, 0, sizeof(um));
  2040. um.proto = m->proto;
  2041. um.mode = m->mode;
  2042. um.reqid = m->reqid;
  2043. um.old_family = m->old_family;
  2044. memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
  2045. memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
  2046. um.new_family = m->new_family;
  2047. memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
  2048. memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
  2049. return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
  2050. }
  2051. static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
  2052. {
  2053. struct xfrm_user_kmaddress uk;
  2054. memset(&uk, 0, sizeof(uk));
  2055. uk.family = k->family;
  2056. uk.reserved = k->reserved;
  2057. memcpy(&uk.local, &k->local, sizeof(uk.local));
  2058. memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
  2059. return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
  2060. }
  2061. static inline unsigned int xfrm_migrate_msgsize(int num_migrate, int with_kma,
  2062. int with_encp)
  2063. {
  2064. return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
  2065. + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
  2066. + (with_encp ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0)
  2067. + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
  2068. + userpolicy_type_attrsize();
  2069. }
  2070. static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
  2071. int num_migrate, const struct xfrm_kmaddress *k,
  2072. const struct xfrm_selector *sel,
  2073. const struct xfrm_encap_tmpl *encap, u8 dir, u8 type)
  2074. {
  2075. const struct xfrm_migrate *mp;
  2076. struct xfrm_userpolicy_id *pol_id;
  2077. struct nlmsghdr *nlh;
  2078. int i, err;
  2079. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
  2080. if (nlh == NULL)
  2081. return -EMSGSIZE;
  2082. pol_id = nlmsg_data(nlh);
  2083. /* copy data from selector, dir, and type to the pol_id */
  2084. memset(pol_id, 0, sizeof(*pol_id));
  2085. memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
  2086. pol_id->dir = dir;
  2087. if (k != NULL) {
  2088. err = copy_to_user_kmaddress(k, skb);
  2089. if (err)
  2090. goto out_cancel;
  2091. }
  2092. if (encap) {
  2093. err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap);
  2094. if (err)
  2095. goto out_cancel;
  2096. }
  2097. err = copy_to_user_policy_type(type, skb);
  2098. if (err)
  2099. goto out_cancel;
  2100. for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
  2101. err = copy_to_user_migrate(mp, skb);
  2102. if (err)
  2103. goto out_cancel;
  2104. }
  2105. nlmsg_end(skb, nlh);
  2106. return 0;
  2107. out_cancel:
  2108. nlmsg_cancel(skb, nlh);
  2109. return err;
  2110. }
  2111. static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
  2112. const struct xfrm_migrate *m, int num_migrate,
  2113. const struct xfrm_kmaddress *k,
  2114. const struct xfrm_encap_tmpl *encap)
  2115. {
  2116. struct net *net = &init_net;
  2117. struct sk_buff *skb;
  2118. int err;
  2119. skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap),
  2120. GFP_ATOMIC);
  2121. if (skb == NULL)
  2122. return -ENOMEM;
  2123. /* build migrate */
  2124. err = build_migrate(skb, m, num_migrate, k, sel, encap, dir, type);
  2125. BUG_ON(err < 0);
  2126. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
  2127. }
  2128. #else
  2129. static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
  2130. const struct xfrm_migrate *m, int num_migrate,
  2131. const struct xfrm_kmaddress *k,
  2132. const struct xfrm_encap_tmpl *encap)
  2133. {
  2134. return -ENOPROTOOPT;
  2135. }
  2136. #endif
  2137. #define XMSGSIZE(type) sizeof(struct type)
  2138. const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
  2139. [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
  2140. [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
  2141. [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
  2142. [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
  2143. [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
  2144. [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
  2145. [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
  2146. [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
  2147. [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
  2148. [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
  2149. [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
  2150. [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
  2151. [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
  2152. [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
  2153. [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
  2154. [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
  2155. [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
  2156. [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
  2157. [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
  2158. [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
  2159. [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
  2160. };
  2161. EXPORT_SYMBOL_GPL(xfrm_msg_min);
  2162. #undef XMSGSIZE
  2163. const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
  2164. [XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)},
  2165. [XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)},
  2166. [XFRMA_LASTUSED] = { .type = NLA_U64},
  2167. [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)},
  2168. [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) },
  2169. [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
  2170. [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
  2171. [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
  2172. [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
  2173. [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
  2174. [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
  2175. [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
  2176. [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
  2177. [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
  2178. [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
  2179. [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
  2180. [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
  2181. [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
  2182. [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
  2183. [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
  2184. [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
  2185. [XFRMA_TFCPAD] = { .type = NLA_U32 },
  2186. [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
  2187. [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 },
  2188. [XFRMA_PROTO] = { .type = NLA_U8 },
  2189. [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) },
  2190. [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) },
  2191. [XFRMA_SET_MARK] = { .type = NLA_U32 },
  2192. [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
  2193. [XFRMA_IF_ID] = { .type = NLA_U32 },
  2194. };
  2195. EXPORT_SYMBOL_GPL(xfrma_policy);
  2196. static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
  2197. [XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
  2198. [XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
  2199. };
  2200. static const struct xfrm_link {
  2201. int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
  2202. int (*start)(struct netlink_callback *);
  2203. int (*dump)(struct sk_buff *, struct netlink_callback *);
  2204. int (*done)(struct netlink_callback *);
  2205. const struct nla_policy *nla_pol;
  2206. int nla_max;
  2207. } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
  2208. [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
  2209. [XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa },
  2210. [XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
  2211. .dump = xfrm_dump_sa,
  2212. .done = xfrm_dump_sa_done },
  2213. [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
  2214. [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
  2215. [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
  2216. .start = xfrm_dump_policy_start,
  2217. .dump = xfrm_dump_policy,
  2218. .done = xfrm_dump_policy_done },
  2219. [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
  2220. [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire },
  2221. [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
  2222. [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
  2223. [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
  2224. [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
  2225. [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa },
  2226. [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy },
  2227. [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae },
  2228. [XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae },
  2229. [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate },
  2230. [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo },
  2231. [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo,
  2232. .nla_pol = xfrma_spd_policy,
  2233. .nla_max = XFRMA_SPD_MAX },
  2234. [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo },
  2235. };
  2236. static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
  2237. struct netlink_ext_ack *extack)
  2238. {
  2239. struct net *net = sock_net(skb->sk);
  2240. struct nlattr *attrs[XFRMA_MAX+1];
  2241. const struct xfrm_link *link;
  2242. struct nlmsghdr *nlh64 = NULL;
  2243. int type, err;
  2244. type = nlh->nlmsg_type;
  2245. if (type > XFRM_MSG_MAX)
  2246. return -EINVAL;
  2247. type -= XFRM_MSG_BASE;
  2248. link = &xfrm_dispatch[type];
  2249. /* All operations require privileges, even GET */
  2250. if (!netlink_net_capable(skb, CAP_NET_ADMIN))
  2251. return -EPERM;
  2252. /* Use the 64-bit / untranslated format on Android, even for compat */
  2253. if (!IS_ENABLED(CONFIG_ANDROID) || IS_ENABLED(CONFIG_XFRM_USER_COMPAT)) {
  2254. if (in_compat_syscall()) {
  2255. struct xfrm_translator *xtr = xfrm_get_translator();
  2256. if (!xtr)
  2257. return -EOPNOTSUPP;
  2258. nlh64 = xtr->rcv_msg_compat(nlh, link->nla_max,
  2259. link->nla_pol, extack);
  2260. xfrm_put_translator(xtr);
  2261. if (IS_ERR(nlh64))
  2262. return PTR_ERR(nlh64);
  2263. if (nlh64)
  2264. nlh = nlh64;
  2265. }
  2266. }
  2267. if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
  2268. type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
  2269. (nlh->nlmsg_flags & NLM_F_DUMP)) {
  2270. struct netlink_dump_control c = {
  2271. .start = link->start,
  2272. .dump = link->dump,
  2273. .done = link->done,
  2274. };
  2275. if (link->dump == NULL) {
  2276. err = -EINVAL;
  2277. goto err;
  2278. }
  2279. err = netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
  2280. goto err;
  2281. }
  2282. err = nlmsg_parse_deprecated(nlh, xfrm_msg_min[type], attrs,
  2283. link->nla_max ? : XFRMA_MAX,
  2284. link->nla_pol ? : xfrma_policy, extack);
  2285. if (err < 0)
  2286. goto err;
  2287. if (link->doit == NULL) {
  2288. err = -EINVAL;
  2289. goto err;
  2290. }
  2291. err = link->doit(skb, nlh, attrs);
  2292. /* We need to free skb allocated in xfrm_alloc_compat() before
  2293. * returning from this function, because consume_skb() won't take
  2294. * care of frag_list since netlink destructor sets
  2295. * sbk->head to NULL. (see netlink_skb_destructor())
  2296. */
  2297. if (skb_has_frag_list(skb)) {
  2298. kfree_skb(skb_shinfo(skb)->frag_list);
  2299. skb_shinfo(skb)->frag_list = NULL;
  2300. }
  2301. err:
  2302. kvfree(nlh64);
  2303. return err;
  2304. }
  2305. static void xfrm_netlink_rcv(struct sk_buff *skb)
  2306. {
  2307. struct net *net = sock_net(skb->sk);
  2308. mutex_lock(&net->xfrm.xfrm_cfg_mutex);
  2309. netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
  2310. mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
  2311. }
  2312. static inline unsigned int xfrm_expire_msgsize(void)
  2313. {
  2314. return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
  2315. + nla_total_size(sizeof(struct xfrm_mark));
  2316. }
  2317. static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
  2318. {
  2319. struct xfrm_user_expire *ue;
  2320. struct nlmsghdr *nlh;
  2321. int err;
  2322. nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
  2323. if (nlh == NULL)
  2324. return -EMSGSIZE;
  2325. ue = nlmsg_data(nlh);
  2326. copy_to_user_state(x, &ue->state);
  2327. ue->hard = (c->data.hard != 0) ? 1 : 0;
  2328. /* clear the padding bytes */
  2329. memset(&ue->hard + 1, 0, sizeof(*ue) - offsetofend(typeof(*ue), hard));
  2330. err = xfrm_mark_put(skb, &x->mark);
  2331. if (err)
  2332. return err;
  2333. err = xfrm_if_id_put(skb, x->if_id);
  2334. if (err)
  2335. return err;
  2336. nlmsg_end(skb, nlh);
  2337. return 0;
  2338. }
  2339. static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
  2340. {
  2341. struct net *net = xs_net(x);
  2342. struct sk_buff *skb;
  2343. skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
  2344. if (skb == NULL)
  2345. return -ENOMEM;
  2346. if (build_expire(skb, x, c) < 0) {
  2347. kfree_skb(skb);
  2348. return -EMSGSIZE;
  2349. }
  2350. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
  2351. }
  2352. static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
  2353. {
  2354. struct net *net = xs_net(x);
  2355. struct sk_buff *skb;
  2356. int err;
  2357. skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
  2358. if (skb == NULL)
  2359. return -ENOMEM;
  2360. err = build_aevent(skb, x, c);
  2361. BUG_ON(err < 0);
  2362. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS);
  2363. }
  2364. static int xfrm_notify_sa_flush(const struct km_event *c)
  2365. {
  2366. struct net *net = c->net;
  2367. struct xfrm_usersa_flush *p;
  2368. struct nlmsghdr *nlh;
  2369. struct sk_buff *skb;
  2370. int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
  2371. skb = nlmsg_new(len, GFP_ATOMIC);
  2372. if (skb == NULL)
  2373. return -ENOMEM;
  2374. nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
  2375. if (nlh == NULL) {
  2376. kfree_skb(skb);
  2377. return -EMSGSIZE;
  2378. }
  2379. p = nlmsg_data(nlh);
  2380. p->proto = c->data.proto;
  2381. nlmsg_end(skb, nlh);
  2382. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
  2383. }
  2384. static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
  2385. {
  2386. unsigned int l = 0;
  2387. if (x->aead)
  2388. l += nla_total_size(aead_len(x->aead));
  2389. if (x->aalg) {
  2390. l += nla_total_size(sizeof(struct xfrm_algo) +
  2391. (x->aalg->alg_key_len + 7) / 8);
  2392. l += nla_total_size(xfrm_alg_auth_len(x->aalg));
  2393. }
  2394. if (x->ealg)
  2395. l += nla_total_size(xfrm_alg_len(x->ealg));
  2396. if (x->calg)
  2397. l += nla_total_size(sizeof(*x->calg));
  2398. if (x->encap)
  2399. l += nla_total_size(sizeof(*x->encap));
  2400. if (x->tfcpad)
  2401. l += nla_total_size(sizeof(x->tfcpad));
  2402. if (x->replay_esn)
  2403. l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
  2404. else
  2405. l += nla_total_size(sizeof(struct xfrm_replay_state));
  2406. if (x->security)
  2407. l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
  2408. x->security->ctx_len);
  2409. if (x->coaddr)
  2410. l += nla_total_size(sizeof(*x->coaddr));
  2411. if (x->props.extra_flags)
  2412. l += nla_total_size(sizeof(x->props.extra_flags));
  2413. if (x->xso.dev)
  2414. l += nla_total_size(sizeof(struct xfrm_user_offload));
  2415. if (x->props.smark.v | x->props.smark.m) {
  2416. l += nla_total_size(sizeof(x->props.smark.v));
  2417. l += nla_total_size(sizeof(x->props.smark.m));
  2418. }
  2419. if (x->if_id)
  2420. l += nla_total_size(sizeof(x->if_id));
  2421. /* Must count x->lastused as it may become non-zero behind our back. */
  2422. l += nla_total_size_64bit(sizeof(u64));
  2423. return l;
  2424. }
  2425. static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
  2426. {
  2427. struct net *net = xs_net(x);
  2428. struct xfrm_usersa_info *p;
  2429. struct xfrm_usersa_id *id;
  2430. struct nlmsghdr *nlh;
  2431. struct sk_buff *skb;
  2432. unsigned int len = xfrm_sa_len(x);
  2433. unsigned int headlen;
  2434. int err;
  2435. headlen = sizeof(*p);
  2436. if (c->event == XFRM_MSG_DELSA) {
  2437. len += nla_total_size(headlen);
  2438. headlen = sizeof(*id);
  2439. len += nla_total_size(sizeof(struct xfrm_mark));
  2440. }
  2441. len += NLMSG_ALIGN(headlen);
  2442. skb = nlmsg_new(len, GFP_ATOMIC);
  2443. if (skb == NULL)
  2444. return -ENOMEM;
  2445. nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
  2446. err = -EMSGSIZE;
  2447. if (nlh == NULL)
  2448. goto out_free_skb;
  2449. p = nlmsg_data(nlh);
  2450. if (c->event == XFRM_MSG_DELSA) {
  2451. struct nlattr *attr;
  2452. id = nlmsg_data(nlh);
  2453. memset(id, 0, sizeof(*id));
  2454. memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
  2455. id->spi = x->id.spi;
  2456. id->family = x->props.family;
  2457. id->proto = x->id.proto;
  2458. attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
  2459. err = -EMSGSIZE;
  2460. if (attr == NULL)
  2461. goto out_free_skb;
  2462. p = nla_data(attr);
  2463. }
  2464. err = copy_to_user_state_extra(x, p, skb);
  2465. if (err)
  2466. goto out_free_skb;
  2467. nlmsg_end(skb, nlh);
  2468. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
  2469. out_free_skb:
  2470. kfree_skb(skb);
  2471. return err;
  2472. }
  2473. static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
  2474. {
  2475. switch (c->event) {
  2476. case XFRM_MSG_EXPIRE:
  2477. return xfrm_exp_state_notify(x, c);
  2478. case XFRM_MSG_NEWAE:
  2479. return xfrm_aevent_state_notify(x, c);
  2480. case XFRM_MSG_DELSA:
  2481. case XFRM_MSG_UPDSA:
  2482. case XFRM_MSG_NEWSA:
  2483. return xfrm_notify_sa(x, c);
  2484. case XFRM_MSG_FLUSHSA:
  2485. return xfrm_notify_sa_flush(c);
  2486. default:
  2487. printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
  2488. c->event);
  2489. break;
  2490. }
  2491. return 0;
  2492. }
  2493. static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x,
  2494. struct xfrm_policy *xp)
  2495. {
  2496. return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
  2497. + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
  2498. + nla_total_size(sizeof(struct xfrm_mark))
  2499. + nla_total_size(xfrm_user_sec_ctx_size(x->security))
  2500. + userpolicy_type_attrsize();
  2501. }
  2502. static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
  2503. struct xfrm_tmpl *xt, struct xfrm_policy *xp)
  2504. {
  2505. __u32 seq = xfrm_get_acqseq();
  2506. struct xfrm_user_acquire *ua;
  2507. struct nlmsghdr *nlh;
  2508. int err;
  2509. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
  2510. if (nlh == NULL)
  2511. return -EMSGSIZE;
  2512. ua = nlmsg_data(nlh);
  2513. memcpy(&ua->id, &x->id, sizeof(ua->id));
  2514. memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
  2515. memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
  2516. copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT);
  2517. ua->aalgos = xt->aalgos;
  2518. ua->ealgos = xt->ealgos;
  2519. ua->calgos = xt->calgos;
  2520. ua->seq = x->km.seq = seq;
  2521. err = copy_to_user_tmpl(xp, skb);
  2522. if (!err)
  2523. err = copy_to_user_state_sec_ctx(x, skb);
  2524. if (!err)
  2525. err = copy_to_user_policy_type(xp->type, skb);
  2526. if (!err)
  2527. err = xfrm_mark_put(skb, &xp->mark);
  2528. if (!err)
  2529. err = xfrm_if_id_put(skb, xp->if_id);
  2530. if (err) {
  2531. nlmsg_cancel(skb, nlh);
  2532. return err;
  2533. }
  2534. nlmsg_end(skb, nlh);
  2535. return 0;
  2536. }
  2537. static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
  2538. struct xfrm_policy *xp)
  2539. {
  2540. struct net *net = xs_net(x);
  2541. struct sk_buff *skb;
  2542. int err;
  2543. skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
  2544. if (skb == NULL)
  2545. return -ENOMEM;
  2546. err = build_acquire(skb, x, xt, xp);
  2547. BUG_ON(err < 0);
  2548. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
  2549. }
  2550. /* User gives us xfrm_user_policy_info followed by an array of 0
  2551. * or more templates.
  2552. */
  2553. static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
  2554. u8 *data, int len, int *dir)
  2555. {
  2556. struct net *net = sock_net(sk);
  2557. struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
  2558. struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
  2559. struct xfrm_policy *xp;
  2560. int nr;
  2561. switch (sk->sk_family) {
  2562. case AF_INET:
  2563. if (opt != IP_XFRM_POLICY) {
  2564. *dir = -EOPNOTSUPP;
  2565. return NULL;
  2566. }
  2567. break;
  2568. #if IS_ENABLED(CONFIG_IPV6)
  2569. case AF_INET6:
  2570. if (opt != IPV6_XFRM_POLICY) {
  2571. *dir = -EOPNOTSUPP;
  2572. return NULL;
  2573. }
  2574. break;
  2575. #endif
  2576. default:
  2577. *dir = -EINVAL;
  2578. return NULL;
  2579. }
  2580. *dir = -EINVAL;
  2581. if (len < sizeof(*p) ||
  2582. verify_newpolicy_info(p))
  2583. return NULL;
  2584. nr = ((len - sizeof(*p)) / sizeof(*ut));
  2585. if (validate_tmpl(nr, ut, p->sel.family))
  2586. return NULL;
  2587. if (p->dir > XFRM_POLICY_OUT)
  2588. return NULL;
  2589. xp = xfrm_policy_alloc(net, GFP_ATOMIC);
  2590. if (xp == NULL) {
  2591. *dir = -ENOBUFS;
  2592. return NULL;
  2593. }
  2594. copy_from_user_policy(xp, p);
  2595. xp->type = XFRM_POLICY_TYPE_MAIN;
  2596. copy_templates(xp, ut, nr);
  2597. *dir = p->dir;
  2598. return xp;
  2599. }
  2600. static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp)
  2601. {
  2602. return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
  2603. + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
  2604. + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
  2605. + nla_total_size(sizeof(struct xfrm_mark))
  2606. + userpolicy_type_attrsize();
  2607. }
  2608. static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
  2609. int dir, const struct km_event *c)
  2610. {
  2611. struct xfrm_user_polexpire *upe;
  2612. int hard = c->data.hard;
  2613. struct nlmsghdr *nlh;
  2614. int err;
  2615. nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
  2616. if (nlh == NULL)
  2617. return -EMSGSIZE;
  2618. upe = nlmsg_data(nlh);
  2619. copy_to_user_policy(xp, &upe->pol, dir);
  2620. err = copy_to_user_tmpl(xp, skb);
  2621. if (!err)
  2622. err = copy_to_user_sec_ctx(xp, skb);
  2623. if (!err)
  2624. err = copy_to_user_policy_type(xp->type, skb);
  2625. if (!err)
  2626. err = xfrm_mark_put(skb, &xp->mark);
  2627. if (!err)
  2628. err = xfrm_if_id_put(skb, xp->if_id);
  2629. if (err) {
  2630. nlmsg_cancel(skb, nlh);
  2631. return err;
  2632. }
  2633. upe->hard = !!hard;
  2634. nlmsg_end(skb, nlh);
  2635. return 0;
  2636. }
  2637. static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
  2638. {
  2639. struct net *net = xp_net(xp);
  2640. struct sk_buff *skb;
  2641. int err;
  2642. skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
  2643. if (skb == NULL)
  2644. return -ENOMEM;
  2645. err = build_polexpire(skb, xp, dir, c);
  2646. BUG_ON(err < 0);
  2647. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
  2648. }
  2649. static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
  2650. {
  2651. unsigned int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
  2652. struct net *net = xp_net(xp);
  2653. struct xfrm_userpolicy_info *p;
  2654. struct xfrm_userpolicy_id *id;
  2655. struct nlmsghdr *nlh;
  2656. struct sk_buff *skb;
  2657. unsigned int headlen;
  2658. int err;
  2659. headlen = sizeof(*p);
  2660. if (c->event == XFRM_MSG_DELPOLICY) {
  2661. len += nla_total_size(headlen);
  2662. headlen = sizeof(*id);
  2663. }
  2664. len += userpolicy_type_attrsize();
  2665. len += nla_total_size(sizeof(struct xfrm_mark));
  2666. len += NLMSG_ALIGN(headlen);
  2667. skb = nlmsg_new(len, GFP_ATOMIC);
  2668. if (skb == NULL)
  2669. return -ENOMEM;
  2670. nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
  2671. err = -EMSGSIZE;
  2672. if (nlh == NULL)
  2673. goto out_free_skb;
  2674. p = nlmsg_data(nlh);
  2675. if (c->event == XFRM_MSG_DELPOLICY) {
  2676. struct nlattr *attr;
  2677. id = nlmsg_data(nlh);
  2678. memset(id, 0, sizeof(*id));
  2679. id->dir = dir;
  2680. if (c->data.byid)
  2681. id->index = xp->index;
  2682. else
  2683. memcpy(&id->sel, &xp->selector, sizeof(id->sel));
  2684. attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
  2685. err = -EMSGSIZE;
  2686. if (attr == NULL)
  2687. goto out_free_skb;
  2688. p = nla_data(attr);
  2689. }
  2690. copy_to_user_policy(xp, p, dir);
  2691. err = copy_to_user_tmpl(xp, skb);
  2692. if (!err)
  2693. err = copy_to_user_policy_type(xp->type, skb);
  2694. if (!err)
  2695. err = xfrm_mark_put(skb, &xp->mark);
  2696. if (!err)
  2697. err = xfrm_if_id_put(skb, xp->if_id);
  2698. if (err)
  2699. goto out_free_skb;
  2700. nlmsg_end(skb, nlh);
  2701. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
  2702. out_free_skb:
  2703. kfree_skb(skb);
  2704. return err;
  2705. }
  2706. static int xfrm_notify_policy_flush(const struct km_event *c)
  2707. {
  2708. struct net *net = c->net;
  2709. struct nlmsghdr *nlh;
  2710. struct sk_buff *skb;
  2711. int err;
  2712. skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
  2713. if (skb == NULL)
  2714. return -ENOMEM;
  2715. nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
  2716. err = -EMSGSIZE;
  2717. if (nlh == NULL)
  2718. goto out_free_skb;
  2719. err = copy_to_user_policy_type(c->data.type, skb);
  2720. if (err)
  2721. goto out_free_skb;
  2722. nlmsg_end(skb, nlh);
  2723. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
  2724. out_free_skb:
  2725. kfree_skb(skb);
  2726. return err;
  2727. }
  2728. static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
  2729. {
  2730. switch (c->event) {
  2731. case XFRM_MSG_NEWPOLICY:
  2732. case XFRM_MSG_UPDPOLICY:
  2733. case XFRM_MSG_DELPOLICY:
  2734. return xfrm_notify_policy(xp, dir, c);
  2735. case XFRM_MSG_FLUSHPOLICY:
  2736. return xfrm_notify_policy_flush(c);
  2737. case XFRM_MSG_POLEXPIRE:
  2738. return xfrm_exp_policy_notify(xp, dir, c);
  2739. default:
  2740. printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
  2741. c->event);
  2742. }
  2743. return 0;
  2744. }
  2745. static inline unsigned int xfrm_report_msgsize(void)
  2746. {
  2747. return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
  2748. }
  2749. static int build_report(struct sk_buff *skb, u8 proto,
  2750. struct xfrm_selector *sel, xfrm_address_t *addr)
  2751. {
  2752. struct xfrm_user_report *ur;
  2753. struct nlmsghdr *nlh;
  2754. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
  2755. if (nlh == NULL)
  2756. return -EMSGSIZE;
  2757. ur = nlmsg_data(nlh);
  2758. ur->proto = proto;
  2759. memcpy(&ur->sel, sel, sizeof(ur->sel));
  2760. if (addr) {
  2761. int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr);
  2762. if (err) {
  2763. nlmsg_cancel(skb, nlh);
  2764. return err;
  2765. }
  2766. }
  2767. nlmsg_end(skb, nlh);
  2768. return 0;
  2769. }
  2770. static int xfrm_send_report(struct net *net, u8 proto,
  2771. struct xfrm_selector *sel, xfrm_address_t *addr)
  2772. {
  2773. struct sk_buff *skb;
  2774. int err;
  2775. skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
  2776. if (skb == NULL)
  2777. return -ENOMEM;
  2778. err = build_report(skb, proto, sel, addr);
  2779. BUG_ON(err < 0);
  2780. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT);
  2781. }
  2782. static inline unsigned int xfrm_mapping_msgsize(void)
  2783. {
  2784. return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
  2785. }
  2786. static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
  2787. xfrm_address_t *new_saddr, __be16 new_sport)
  2788. {
  2789. struct xfrm_user_mapping *um;
  2790. struct nlmsghdr *nlh;
  2791. nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
  2792. if (nlh == NULL)
  2793. return -EMSGSIZE;
  2794. um = nlmsg_data(nlh);
  2795. memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
  2796. um->id.spi = x->id.spi;
  2797. um->id.family = x->props.family;
  2798. um->id.proto = x->id.proto;
  2799. memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
  2800. memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
  2801. um->new_sport = new_sport;
  2802. um->old_sport = x->encap->encap_sport;
  2803. um->reqid = x->props.reqid;
  2804. nlmsg_end(skb, nlh);
  2805. return 0;
  2806. }
  2807. static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
  2808. __be16 sport)
  2809. {
  2810. struct net *net = xs_net(x);
  2811. struct sk_buff *skb;
  2812. int err;
  2813. if (x->id.proto != IPPROTO_ESP)
  2814. return -EINVAL;
  2815. if (!x->encap)
  2816. return -EINVAL;
  2817. skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
  2818. if (skb == NULL)
  2819. return -ENOMEM;
  2820. err = build_mapping(skb, x, ipaddr, sport);
  2821. BUG_ON(err < 0);
  2822. return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING);
  2823. }
  2824. static bool xfrm_is_alive(const struct km_event *c)
  2825. {
  2826. return (bool)xfrm_acquire_is_on(c->net);
  2827. }
  2828. static struct xfrm_mgr netlink_mgr = {
  2829. .notify = xfrm_send_state_notify,
  2830. .acquire = xfrm_send_acquire,
  2831. .compile_policy = xfrm_compile_policy,
  2832. .notify_policy = xfrm_send_policy_notify,
  2833. .report = xfrm_send_report,
  2834. .migrate = xfrm_send_migrate,
  2835. .new_mapping = xfrm_send_mapping,
  2836. .is_alive = xfrm_is_alive,
  2837. };
  2838. static int __net_init xfrm_user_net_init(struct net *net)
  2839. {
  2840. struct sock *nlsk;
  2841. struct netlink_kernel_cfg cfg = {
  2842. .groups = XFRMNLGRP_MAX,
  2843. .input = xfrm_netlink_rcv,
  2844. };
  2845. nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg);
  2846. if (nlsk == NULL)
  2847. return -ENOMEM;
  2848. net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
  2849. rcu_assign_pointer(net->xfrm.nlsk, nlsk);
  2850. return 0;
  2851. }
  2852. static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
  2853. {
  2854. struct net *net;
  2855. list_for_each_entry(net, net_exit_list, exit_list)
  2856. RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
  2857. synchronize_net();
  2858. list_for_each_entry(net, net_exit_list, exit_list)
  2859. netlink_kernel_release(net->xfrm.nlsk_stash);
  2860. }
  2861. static struct pernet_operations xfrm_user_net_ops = {
  2862. .init = xfrm_user_net_init,
  2863. .exit_batch = xfrm_user_net_exit,
  2864. };
  2865. static int __init xfrm_user_init(void)
  2866. {
  2867. int rv;
  2868. printk(KERN_INFO "Initializing XFRM netlink socket\n");
  2869. rv = register_pernet_subsys(&xfrm_user_net_ops);
  2870. if (rv < 0)
  2871. return rv;
  2872. rv = xfrm_register_km(&netlink_mgr);
  2873. if (rv < 0)
  2874. unregister_pernet_subsys(&xfrm_user_net_ops);
  2875. return rv;
  2876. }
  2877. static void __exit xfrm_user_exit(void)
  2878. {
  2879. xfrm_unregister_km(&netlink_mgr);
  2880. unregister_pernet_subsys(&xfrm_user_net_ops);
  2881. }
  2882. module_init(xfrm_user_init);
  2883. module_exit(xfrm_user_exit);
  2884. MODULE_LICENSE("GPL");
  2885. MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);