xref: /openbmc/linux/net/key/af_key.c (revision e868d61272caa648214046a096e5a6bfc068dc8c)
1 /*
2  * net/key/af_key.c	An implementation of PF_KEYv2 sockets.
3  *
4  *		This program is free software; you can redistribute it and/or
5  *		modify it under the terms of the GNU General Public License
6  *		as published by the Free Software Foundation; either version
7  *		2 of the License, or (at your option) any later version.
8  *
9  * Authors:	Maxim Giryaev	<gem@asplinux.ru>
10  *		David S. Miller	<davem@redhat.com>
11  *		Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
12  *		Kunihiro Ishiguro <kunihiro@ipinfusion.com>
13  *		Kazunori MIYAZAWA / USAGI Project <miyazawa@linux-ipv6.org>
14  *		Derek Atkins <derek@ihtfp.com>
15  */
16 
17 #include <linux/capability.h>
18 #include <linux/module.h>
19 #include <linux/kernel.h>
20 #include <linux/socket.h>
21 #include <linux/pfkeyv2.h>
22 #include <linux/ipsec.h>
23 #include <linux/skbuff.h>
24 #include <linux/rtnetlink.h>
25 #include <linux/in.h>
26 #include <linux/in6.h>
27 #include <linux/proc_fs.h>
28 #include <linux/init.h>
29 #include <net/xfrm.h>
30 #include <linux/audit.h>
31 
32 #include <net/sock.h>
33 
34 #define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x))
35 #define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x))
36 
37 
38 /* List of all pfkey sockets. */
39 static HLIST_HEAD(pfkey_table);
40 static DECLARE_WAIT_QUEUE_HEAD(pfkey_table_wait);
41 static DEFINE_RWLOCK(pfkey_table_lock);
42 static atomic_t pfkey_table_users = ATOMIC_INIT(0);
43 
44 static atomic_t pfkey_socks_nr = ATOMIC_INIT(0);
45 
46 struct pfkey_sock {
47 	/* struct sock must be the first member of struct pfkey_sock */
48 	struct sock	sk;
49 	int		registered;
50 	int		promisc;
51 };
52 
53 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
54 {
55 	return (struct pfkey_sock *)sk;
56 }
57 
58 static void pfkey_sock_destruct(struct sock *sk)
59 {
60 	skb_queue_purge(&sk->sk_receive_queue);
61 
62 	if (!sock_flag(sk, SOCK_DEAD)) {
63 		printk("Attempt to release alive pfkey socket: %p\n", sk);
64 		return;
65 	}
66 
67 	BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
68 	BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
69 
70 	atomic_dec(&pfkey_socks_nr);
71 }
72 
73 static void pfkey_table_grab(void)
74 {
75 	write_lock_bh(&pfkey_table_lock);
76 
77 	if (atomic_read(&pfkey_table_users)) {
78 		DECLARE_WAITQUEUE(wait, current);
79 
80 		add_wait_queue_exclusive(&pfkey_table_wait, &wait);
81 		for(;;) {
82 			set_current_state(TASK_UNINTERRUPTIBLE);
83 			if (atomic_read(&pfkey_table_users) == 0)
84 				break;
85 			write_unlock_bh(&pfkey_table_lock);
86 			schedule();
87 			write_lock_bh(&pfkey_table_lock);
88 		}
89 
90 		__set_current_state(TASK_RUNNING);
91 		remove_wait_queue(&pfkey_table_wait, &wait);
92 	}
93 }
94 
95 static __inline__ void pfkey_table_ungrab(void)
96 {
97 	write_unlock_bh(&pfkey_table_lock);
98 	wake_up(&pfkey_table_wait);
99 }
100 
101 static __inline__ void pfkey_lock_table(void)
102 {
103 	/* read_lock() synchronizes us to pfkey_table_grab */
104 
105 	read_lock(&pfkey_table_lock);
106 	atomic_inc(&pfkey_table_users);
107 	read_unlock(&pfkey_table_lock);
108 }
109 
110 static __inline__ void pfkey_unlock_table(void)
111 {
112 	if (atomic_dec_and_test(&pfkey_table_users))
113 		wake_up(&pfkey_table_wait);
114 }
115 
116 
117 static const struct proto_ops pfkey_ops;
118 
119 static void pfkey_insert(struct sock *sk)
120 {
121 	pfkey_table_grab();
122 	sk_add_node(sk, &pfkey_table);
123 	pfkey_table_ungrab();
124 }
125 
126 static void pfkey_remove(struct sock *sk)
127 {
128 	pfkey_table_grab();
129 	sk_del_node_init(sk);
130 	pfkey_table_ungrab();
131 }
132 
133 static struct proto key_proto = {
134 	.name	  = "KEY",
135 	.owner	  = THIS_MODULE,
136 	.obj_size = sizeof(struct pfkey_sock),
137 };
138 
139 static int pfkey_create(struct socket *sock, int protocol)
140 {
141 	struct sock *sk;
142 	int err;
143 
144 	if (!capable(CAP_NET_ADMIN))
145 		return -EPERM;
146 	if (sock->type != SOCK_RAW)
147 		return -ESOCKTNOSUPPORT;
148 	if (protocol != PF_KEY_V2)
149 		return -EPROTONOSUPPORT;
150 
151 	err = -ENOMEM;
152 	sk = sk_alloc(PF_KEY, GFP_KERNEL, &key_proto, 1);
153 	if (sk == NULL)
154 		goto out;
155 
156 	sock->ops = &pfkey_ops;
157 	sock_init_data(sock, sk);
158 
159 	sk->sk_family = PF_KEY;
160 	sk->sk_destruct = pfkey_sock_destruct;
161 
162 	atomic_inc(&pfkey_socks_nr);
163 
164 	pfkey_insert(sk);
165 
166 	return 0;
167 out:
168 	return err;
169 }
170 
171 static int pfkey_release(struct socket *sock)
172 {
173 	struct sock *sk = sock->sk;
174 
175 	if (!sk)
176 		return 0;
177 
178 	pfkey_remove(sk);
179 
180 	sock_orphan(sk);
181 	sock->sk = NULL;
182 	skb_queue_purge(&sk->sk_write_queue);
183 	sock_put(sk);
184 
185 	return 0;
186 }
187 
188 static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
189 			       gfp_t allocation, struct sock *sk)
190 {
191 	int err = -ENOBUFS;
192 
193 	sock_hold(sk);
194 	if (*skb2 == NULL) {
195 		if (atomic_read(&skb->users) != 1) {
196 			*skb2 = skb_clone(skb, allocation);
197 		} else {
198 			*skb2 = skb;
199 			atomic_inc(&skb->users);
200 		}
201 	}
202 	if (*skb2 != NULL) {
203 		if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
204 			skb_orphan(*skb2);
205 			skb_set_owner_r(*skb2, sk);
206 			skb_queue_tail(&sk->sk_receive_queue, *skb2);
207 			sk->sk_data_ready(sk, (*skb2)->len);
208 			*skb2 = NULL;
209 			err = 0;
210 		}
211 	}
212 	sock_put(sk);
213 	return err;
214 }
215 
216 /* Send SKB to all pfkey sockets matching selected criteria.  */
217 #define BROADCAST_ALL		0
218 #define BROADCAST_ONE		1
219 #define BROADCAST_REGISTERED	2
220 #define BROADCAST_PROMISC_ONLY	4
221 static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
222 			   int broadcast_flags, struct sock *one_sk)
223 {
224 	struct sock *sk;
225 	struct hlist_node *node;
226 	struct sk_buff *skb2 = NULL;
227 	int err = -ESRCH;
228 
229 	/* XXX Do we need something like netlink_overrun?  I think
230 	 * XXX PF_KEY socket apps will not mind current behavior.
231 	 */
232 	if (!skb)
233 		return -ENOMEM;
234 
235 	pfkey_lock_table();
236 	sk_for_each(sk, node, &pfkey_table) {
237 		struct pfkey_sock *pfk = pfkey_sk(sk);
238 		int err2;
239 
240 		/* Yes, it means that if you are meant to receive this
241 		 * pfkey message you receive it twice as promiscuous
242 		 * socket.
243 		 */
244 		if (pfk->promisc)
245 			pfkey_broadcast_one(skb, &skb2, allocation, sk);
246 
247 		/* the exact target will be processed later */
248 		if (sk == one_sk)
249 			continue;
250 		if (broadcast_flags != BROADCAST_ALL) {
251 			if (broadcast_flags & BROADCAST_PROMISC_ONLY)
252 				continue;
253 			if ((broadcast_flags & BROADCAST_REGISTERED) &&
254 			    !pfk->registered)
255 				continue;
256 			if (broadcast_flags & BROADCAST_ONE)
257 				continue;
258 		}
259 
260 		err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk);
261 
262 		/* Error is cleare after succecful sending to at least one
263 		 * registered KM */
264 		if ((broadcast_flags & BROADCAST_REGISTERED) && err)
265 			err = err2;
266 	}
267 	pfkey_unlock_table();
268 
269 	if (one_sk != NULL)
270 		err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
271 
272 	if (skb2)
273 		kfree_skb(skb2);
274 	kfree_skb(skb);
275 	return err;
276 }
277 
278 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)
279 {
280 	*new = *orig;
281 }
282 
283 static int pfkey_error(struct sadb_msg *orig, int err, struct sock *sk)
284 {
285 	struct sk_buff *skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_KERNEL);
286 	struct sadb_msg *hdr;
287 
288 	if (!skb)
289 		return -ENOBUFS;
290 
291 	/* Woe be to the platform trying to support PFKEY yet
292 	 * having normal errnos outside the 1-255 range, inclusive.
293 	 */
294 	err = -err;
295 	if (err == ERESTARTSYS ||
296 	    err == ERESTARTNOHAND ||
297 	    err == ERESTARTNOINTR)
298 		err = EINTR;
299 	if (err >= 512)
300 		err = EINVAL;
301 	BUG_ON(err <= 0 || err >= 256);
302 
303 	hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
304 	pfkey_hdr_dup(hdr, orig);
305 	hdr->sadb_msg_errno = (uint8_t) err;
306 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
307 			     sizeof(uint64_t));
308 
309 	pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk);
310 
311 	return 0;
312 }
313 
314 static u8 sadb_ext_min_len[] = {
315 	[SADB_EXT_RESERVED]		= (u8) 0,
316 	[SADB_EXT_SA]			= (u8) sizeof(struct sadb_sa),
317 	[SADB_EXT_LIFETIME_CURRENT]	= (u8) sizeof(struct sadb_lifetime),
318 	[SADB_EXT_LIFETIME_HARD]	= (u8) sizeof(struct sadb_lifetime),
319 	[SADB_EXT_LIFETIME_SOFT]	= (u8) sizeof(struct sadb_lifetime),
320 	[SADB_EXT_ADDRESS_SRC]		= (u8) sizeof(struct sadb_address),
321 	[SADB_EXT_ADDRESS_DST]		= (u8) sizeof(struct sadb_address),
322 	[SADB_EXT_ADDRESS_PROXY]	= (u8) sizeof(struct sadb_address),
323 	[SADB_EXT_KEY_AUTH]		= (u8) sizeof(struct sadb_key),
324 	[SADB_EXT_KEY_ENCRYPT]		= (u8) sizeof(struct sadb_key),
325 	[SADB_EXT_IDENTITY_SRC]		= (u8) sizeof(struct sadb_ident),
326 	[SADB_EXT_IDENTITY_DST]		= (u8) sizeof(struct sadb_ident),
327 	[SADB_EXT_SENSITIVITY]		= (u8) sizeof(struct sadb_sens),
328 	[SADB_EXT_PROPOSAL]		= (u8) sizeof(struct sadb_prop),
329 	[SADB_EXT_SUPPORTED_AUTH]	= (u8) sizeof(struct sadb_supported),
330 	[SADB_EXT_SUPPORTED_ENCRYPT]	= (u8) sizeof(struct sadb_supported),
331 	[SADB_EXT_SPIRANGE]		= (u8) sizeof(struct sadb_spirange),
332 	[SADB_X_EXT_KMPRIVATE]		= (u8) sizeof(struct sadb_x_kmprivate),
333 	[SADB_X_EXT_POLICY]		= (u8) sizeof(struct sadb_x_policy),
334 	[SADB_X_EXT_SA2]		= (u8) sizeof(struct sadb_x_sa2),
335 	[SADB_X_EXT_NAT_T_TYPE]		= (u8) sizeof(struct sadb_x_nat_t_type),
336 	[SADB_X_EXT_NAT_T_SPORT]	= (u8) sizeof(struct sadb_x_nat_t_port),
337 	[SADB_X_EXT_NAT_T_DPORT]	= (u8) sizeof(struct sadb_x_nat_t_port),
338 	[SADB_X_EXT_NAT_T_OA]		= (u8) sizeof(struct sadb_address),
339 	[SADB_X_EXT_SEC_CTX]		= (u8) sizeof(struct sadb_x_sec_ctx),
340 };
341 
342 /* Verify sadb_address_{len,prefixlen} against sa_family.  */
343 static int verify_address_len(void *p)
344 {
345 	struct sadb_address *sp = p;
346 	struct sockaddr *addr = (struct sockaddr *)(sp + 1);
347 	struct sockaddr_in *sin;
348 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
349 	struct sockaddr_in6 *sin6;
350 #endif
351 	int len;
352 
353 	switch (addr->sa_family) {
354 	case AF_INET:
355 		len  = sizeof(*sp) + sizeof(*sin) + (sizeof(uint64_t) - 1);
356 		len /= sizeof(uint64_t);
357 		if (sp->sadb_address_len != len ||
358 		    sp->sadb_address_prefixlen > 32)
359 			return -EINVAL;
360 		break;
361 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
362 	case AF_INET6:
363 		len  = sizeof(*sp) + sizeof(*sin6) + (sizeof(uint64_t) - 1);
364 		len /= sizeof(uint64_t);
365 		if (sp->sadb_address_len != len ||
366 		    sp->sadb_address_prefixlen > 128)
367 			return -EINVAL;
368 		break;
369 #endif
370 	default:
371 		/* It is user using kernel to keep track of security
372 		 * associations for another protocol, such as
373 		 * OSPF/RSVP/RIPV2/MIP.  It is user's job to verify
374 		 * lengths.
375 		 *
376 		 * XXX Actually, association/policy database is not yet
377 		 * XXX able to cope with arbitrary sockaddr families.
378 		 * XXX When it can, remove this -EINVAL.  -DaveM
379 		 */
380 		return -EINVAL;
381 		break;
382 	}
383 
384 	return 0;
385 }
386 
387 static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx)
388 {
389 	int len = 0;
390 
391 	len += sizeof(struct sadb_x_sec_ctx);
392 	len += sec_ctx->sadb_x_ctx_len;
393 	len += sizeof(uint64_t) - 1;
394 	len /= sizeof(uint64_t);
395 
396 	return len;
397 }
398 
399 static inline int verify_sec_ctx_len(void *p)
400 {
401 	struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p;
402 	int len;
403 
404 	if (sec_ctx->sadb_x_ctx_len > PAGE_SIZE)
405 		return -EINVAL;
406 
407 	len = pfkey_sec_ctx_len(sec_ctx);
408 
409 	if (sec_ctx->sadb_x_sec_len != len)
410 		return -EINVAL;
411 
412 	return 0;
413 }
414 
415 static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(struct sadb_x_sec_ctx *sec_ctx)
416 {
417 	struct xfrm_user_sec_ctx *uctx = NULL;
418 	int ctx_size = sec_ctx->sadb_x_ctx_len;
419 
420 	uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL);
421 
422 	if (!uctx)
423 		return NULL;
424 
425 	uctx->len = pfkey_sec_ctx_len(sec_ctx);
426 	uctx->exttype = sec_ctx->sadb_x_sec_exttype;
427 	uctx->ctx_doi = sec_ctx->sadb_x_ctx_doi;
428 	uctx->ctx_alg = sec_ctx->sadb_x_ctx_alg;
429 	uctx->ctx_len = sec_ctx->sadb_x_ctx_len;
430 	memcpy(uctx + 1, sec_ctx + 1,
431 	       uctx->ctx_len);
432 
433 	return uctx;
434 }
435 
436 static int present_and_same_family(struct sadb_address *src,
437 				   struct sadb_address *dst)
438 {
439 	struct sockaddr *s_addr, *d_addr;
440 
441 	if (!src || !dst)
442 		return 0;
443 
444 	s_addr = (struct sockaddr *)(src + 1);
445 	d_addr = (struct sockaddr *)(dst + 1);
446 	if (s_addr->sa_family != d_addr->sa_family)
447 		return 0;
448 	if (s_addr->sa_family != AF_INET
449 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
450 	    && s_addr->sa_family != AF_INET6
451 #endif
452 		)
453 		return 0;
454 
455 	return 1;
456 }
457 
458 static int parse_exthdrs(struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
459 {
460 	char *p = (char *) hdr;
461 	int len = skb->len;
462 
463 	len -= sizeof(*hdr);
464 	p += sizeof(*hdr);
465 	while (len > 0) {
466 		struct sadb_ext *ehdr = (struct sadb_ext *) p;
467 		uint16_t ext_type;
468 		int ext_len;
469 
470 		ext_len  = ehdr->sadb_ext_len;
471 		ext_len *= sizeof(uint64_t);
472 		ext_type = ehdr->sadb_ext_type;
473 		if (ext_len < sizeof(uint64_t) ||
474 		    ext_len > len ||
475 		    ext_type == SADB_EXT_RESERVED)
476 			return -EINVAL;
477 
478 		if (ext_type <= SADB_EXT_MAX) {
479 			int min = (int) sadb_ext_min_len[ext_type];
480 			if (ext_len < min)
481 				return -EINVAL;
482 			if (ext_hdrs[ext_type-1] != NULL)
483 				return -EINVAL;
484 			if (ext_type == SADB_EXT_ADDRESS_SRC ||
485 			    ext_type == SADB_EXT_ADDRESS_DST ||
486 			    ext_type == SADB_EXT_ADDRESS_PROXY ||
487 			    ext_type == SADB_X_EXT_NAT_T_OA) {
488 				if (verify_address_len(p))
489 					return -EINVAL;
490 			}
491 			if (ext_type == SADB_X_EXT_SEC_CTX) {
492 				if (verify_sec_ctx_len(p))
493 					return -EINVAL;
494 			}
495 			ext_hdrs[ext_type-1] = p;
496 		}
497 		p   += ext_len;
498 		len -= ext_len;
499 	}
500 
501 	return 0;
502 }
503 
504 static uint16_t
505 pfkey_satype2proto(uint8_t satype)
506 {
507 	switch (satype) {
508 	case SADB_SATYPE_UNSPEC:
509 		return IPSEC_PROTO_ANY;
510 	case SADB_SATYPE_AH:
511 		return IPPROTO_AH;
512 	case SADB_SATYPE_ESP:
513 		return IPPROTO_ESP;
514 	case SADB_X_SATYPE_IPCOMP:
515 		return IPPROTO_COMP;
516 		break;
517 	default:
518 		return 0;
519 	}
520 	/* NOTREACHED */
521 }
522 
523 static uint8_t
524 pfkey_proto2satype(uint16_t proto)
525 {
526 	switch (proto) {
527 	case IPPROTO_AH:
528 		return SADB_SATYPE_AH;
529 	case IPPROTO_ESP:
530 		return SADB_SATYPE_ESP;
531 	case IPPROTO_COMP:
532 		return SADB_X_SATYPE_IPCOMP;
533 		break;
534 	default:
535 		return 0;
536 	}
537 	/* NOTREACHED */
538 }
539 
540 /* BTW, this scheme means that there is no way with PFKEY2 sockets to
541  * say specifically 'just raw sockets' as we encode them as 255.
542  */
543 
544 static uint8_t pfkey_proto_to_xfrm(uint8_t proto)
545 {
546 	return (proto == IPSEC_PROTO_ANY ? 0 : proto);
547 }
548 
549 static uint8_t pfkey_proto_from_xfrm(uint8_t proto)
550 {
551 	return (proto ? proto : IPSEC_PROTO_ANY);
552 }
553 
554 static int pfkey_sadb_addr2xfrm_addr(struct sadb_address *addr,
555 				     xfrm_address_t *xaddr)
556 {
557 	switch (((struct sockaddr*)(addr + 1))->sa_family) {
558 	case AF_INET:
559 		xaddr->a4 =
560 			((struct sockaddr_in *)(addr + 1))->sin_addr.s_addr;
561 		return AF_INET;
562 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
563 	case AF_INET6:
564 		memcpy(xaddr->a6,
565 		       &((struct sockaddr_in6 *)(addr + 1))->sin6_addr,
566 		       sizeof(struct in6_addr));
567 		return AF_INET6;
568 #endif
569 	default:
570 		return 0;
571 	}
572 	/* NOTREACHED */
573 }
574 
575 static struct  xfrm_state *pfkey_xfrm_state_lookup(struct sadb_msg *hdr, void **ext_hdrs)
576 {
577 	struct sadb_sa *sa;
578 	struct sadb_address *addr;
579 	uint16_t proto;
580 	unsigned short family;
581 	xfrm_address_t *xaddr;
582 
583 	sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1];
584 	if (sa == NULL)
585 		return NULL;
586 
587 	proto = pfkey_satype2proto(hdr->sadb_msg_satype);
588 	if (proto == 0)
589 		return NULL;
590 
591 	/* sadb_address_len should be checked by caller */
592 	addr = (struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1];
593 	if (addr == NULL)
594 		return NULL;
595 
596 	family = ((struct sockaddr *)(addr + 1))->sa_family;
597 	switch (family) {
598 	case AF_INET:
599 		xaddr = (xfrm_address_t *)&((struct sockaddr_in *)(addr + 1))->sin_addr;
600 		break;
601 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
602 	case AF_INET6:
603 		xaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(addr + 1))->sin6_addr;
604 		break;
605 #endif
606 	default:
607 		xaddr = NULL;
608 	}
609 
610 	if (!xaddr)
611 		return NULL;
612 
613 	return xfrm_state_lookup(xaddr, sa->sadb_sa_spi, proto, family);
614 }
615 
616 #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1)))
617 static int
618 pfkey_sockaddr_size(sa_family_t family)
619 {
620 	switch (family) {
621 	case AF_INET:
622 		return PFKEY_ALIGN8(sizeof(struct sockaddr_in));
623 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
624 	case AF_INET6:
625 		return PFKEY_ALIGN8(sizeof(struct sockaddr_in6));
626 #endif
627 	default:
628 		return 0;
629 	}
630 	/* NOTREACHED */
631 }
632 
633 static inline int pfkey_mode_from_xfrm(int mode)
634 {
635 	switch(mode) {
636 	case XFRM_MODE_TRANSPORT:
637 		return IPSEC_MODE_TRANSPORT;
638 	case XFRM_MODE_TUNNEL:
639 		return IPSEC_MODE_TUNNEL;
640 	case XFRM_MODE_BEET:
641 		return IPSEC_MODE_BEET;
642 	default:
643 		return -1;
644 	}
645 }
646 
647 static inline int pfkey_mode_to_xfrm(int mode)
648 {
649 	switch(mode) {
650 	case IPSEC_MODE_ANY:	/*XXX*/
651 	case IPSEC_MODE_TRANSPORT:
652 		return XFRM_MODE_TRANSPORT;
653 	case IPSEC_MODE_TUNNEL:
654 		return XFRM_MODE_TUNNEL;
655 	case IPSEC_MODE_BEET:
656 		return XFRM_MODE_BEET;
657 	default:
658 		return -1;
659 	}
660 }
661 
662 static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys, int hsc)
663 {
664 	struct sk_buff *skb;
665 	struct sadb_msg *hdr;
666 	struct sadb_sa *sa;
667 	struct sadb_lifetime *lifetime;
668 	struct sadb_address *addr;
669 	struct sadb_key *key;
670 	struct sadb_x_sa2 *sa2;
671 	struct sockaddr_in *sin;
672 	struct sadb_x_sec_ctx *sec_ctx;
673 	struct xfrm_sec_ctx *xfrm_ctx;
674 	int ctx_size = 0;
675 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
676 	struct sockaddr_in6 *sin6;
677 #endif
678 	int size;
679 	int auth_key_size = 0;
680 	int encrypt_key_size = 0;
681 	int sockaddr_size;
682 	struct xfrm_encap_tmpl *natt = NULL;
683 	int mode;
684 
685 	/* address family check */
686 	sockaddr_size = pfkey_sockaddr_size(x->props.family);
687 	if (!sockaddr_size)
688 		return ERR_PTR(-EINVAL);
689 
690 	/* base, SA, (lifetime (HSC),) address(SD), (address(P),)
691 	   key(AE), (identity(SD),) (sensitivity)> */
692 	size = sizeof(struct sadb_msg) +sizeof(struct sadb_sa) +
693 		sizeof(struct sadb_lifetime) +
694 		((hsc & 1) ? sizeof(struct sadb_lifetime) : 0) +
695 		((hsc & 2) ? sizeof(struct sadb_lifetime) : 0) +
696 			sizeof(struct sadb_address)*2 +
697 				sockaddr_size*2 +
698 					sizeof(struct sadb_x_sa2);
699 
700 	if ((xfrm_ctx = x->security)) {
701 		ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
702 		size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
703 	}
704 
705 	/* identity & sensitivity */
706 
707 	if ((x->props.family == AF_INET &&
708 	     x->sel.saddr.a4 != x->props.saddr.a4)
709 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
710 	    || (x->props.family == AF_INET6 &&
711 		memcmp (x->sel.saddr.a6, x->props.saddr.a6, sizeof (struct in6_addr)))
712 #endif
713 		)
714 		size += sizeof(struct sadb_address) + sockaddr_size;
715 
716 	if (add_keys) {
717 		if (x->aalg && x->aalg->alg_key_len) {
718 			auth_key_size =
719 				PFKEY_ALIGN8((x->aalg->alg_key_len + 7) / 8);
720 			size += sizeof(struct sadb_key) + auth_key_size;
721 		}
722 		if (x->ealg && x->ealg->alg_key_len) {
723 			encrypt_key_size =
724 				PFKEY_ALIGN8((x->ealg->alg_key_len+7) / 8);
725 			size += sizeof(struct sadb_key) + encrypt_key_size;
726 		}
727 	}
728 	if (x->encap)
729 		natt = x->encap;
730 
731 	if (natt && natt->encap_type) {
732 		size += sizeof(struct sadb_x_nat_t_type);
733 		size += sizeof(struct sadb_x_nat_t_port);
734 		size += sizeof(struct sadb_x_nat_t_port);
735 	}
736 
737 	skb =  alloc_skb(size + 16, GFP_ATOMIC);
738 	if (skb == NULL)
739 		return ERR_PTR(-ENOBUFS);
740 
741 	/* call should fill header later */
742 	hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
743 	memset(hdr, 0, size);	/* XXX do we need this ? */
744 	hdr->sadb_msg_len = size / sizeof(uint64_t);
745 
746 	/* sa */
747 	sa = (struct sadb_sa *)  skb_put(skb, sizeof(struct sadb_sa));
748 	sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t);
749 	sa->sadb_sa_exttype = SADB_EXT_SA;
750 	sa->sadb_sa_spi = x->id.spi;
751 	sa->sadb_sa_replay = x->props.replay_window;
752 	switch (x->km.state) {
753 	case XFRM_STATE_VALID:
754 		sa->sadb_sa_state = x->km.dying ?
755 			SADB_SASTATE_DYING : SADB_SASTATE_MATURE;
756 		break;
757 	case XFRM_STATE_ACQ:
758 		sa->sadb_sa_state = SADB_SASTATE_LARVAL;
759 		break;
760 	default:
761 		sa->sadb_sa_state = SADB_SASTATE_DEAD;
762 		break;
763 	}
764 	sa->sadb_sa_auth = 0;
765 	if (x->aalg) {
766 		struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
767 		sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0;
768 	}
769 	sa->sadb_sa_encrypt = 0;
770 	BUG_ON(x->ealg && x->calg);
771 	if (x->ealg) {
772 		struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0);
773 		sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
774 	}
775 	/* KAME compatible: sadb_sa_encrypt is overloaded with calg id */
776 	if (x->calg) {
777 		struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0);
778 		sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
779 	}
780 
781 	sa->sadb_sa_flags = 0;
782 	if (x->props.flags & XFRM_STATE_NOECN)
783 		sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN;
784 	if (x->props.flags & XFRM_STATE_DECAP_DSCP)
785 		sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP;
786 	if (x->props.flags & XFRM_STATE_NOPMTUDISC)
787 		sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC;
788 
789 	/* hard time */
790 	if (hsc & 2) {
791 		lifetime = (struct sadb_lifetime *)  skb_put(skb,
792 							     sizeof(struct sadb_lifetime));
793 		lifetime->sadb_lifetime_len =
794 			sizeof(struct sadb_lifetime)/sizeof(uint64_t);
795 		lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
796 		lifetime->sadb_lifetime_allocations =  _X2KEY(x->lft.hard_packet_limit);
797 		lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.hard_byte_limit);
798 		lifetime->sadb_lifetime_addtime = x->lft.hard_add_expires_seconds;
799 		lifetime->sadb_lifetime_usetime = x->lft.hard_use_expires_seconds;
800 	}
801 	/* soft time */
802 	if (hsc & 1) {
803 		lifetime = (struct sadb_lifetime *)  skb_put(skb,
804 							     sizeof(struct sadb_lifetime));
805 		lifetime->sadb_lifetime_len =
806 			sizeof(struct sadb_lifetime)/sizeof(uint64_t);
807 		lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
808 		lifetime->sadb_lifetime_allocations =  _X2KEY(x->lft.soft_packet_limit);
809 		lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.soft_byte_limit);
810 		lifetime->sadb_lifetime_addtime = x->lft.soft_add_expires_seconds;
811 		lifetime->sadb_lifetime_usetime = x->lft.soft_use_expires_seconds;
812 	}
813 	/* current time */
814 	lifetime = (struct sadb_lifetime *)  skb_put(skb,
815 						     sizeof(struct sadb_lifetime));
816 	lifetime->sadb_lifetime_len =
817 		sizeof(struct sadb_lifetime)/sizeof(uint64_t);
818 	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
819 	lifetime->sadb_lifetime_allocations = x->curlft.packets;
820 	lifetime->sadb_lifetime_bytes = x->curlft.bytes;
821 	lifetime->sadb_lifetime_addtime = x->curlft.add_time;
822 	lifetime->sadb_lifetime_usetime = x->curlft.use_time;
823 	/* src address */
824 	addr = (struct sadb_address*) skb_put(skb,
825 					      sizeof(struct sadb_address)+sockaddr_size);
826 	addr->sadb_address_len =
827 		(sizeof(struct sadb_address)+sockaddr_size)/
828 			sizeof(uint64_t);
829 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
830 	/* "if the ports are non-zero, then the sadb_address_proto field,
831 	   normally zero, MUST be filled in with the transport
832 	   protocol's number." - RFC2367 */
833 	addr->sadb_address_proto = 0;
834 	addr->sadb_address_reserved = 0;
835 	if (x->props.family == AF_INET) {
836 		addr->sadb_address_prefixlen = 32;
837 
838 		sin = (struct sockaddr_in *) (addr + 1);
839 		sin->sin_family = AF_INET;
840 		sin->sin_addr.s_addr = x->props.saddr.a4;
841 		sin->sin_port = 0;
842 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
843 	}
844 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
845 	else if (x->props.family == AF_INET6) {
846 		addr->sadb_address_prefixlen = 128;
847 
848 		sin6 = (struct sockaddr_in6 *) (addr + 1);
849 		sin6->sin6_family = AF_INET6;
850 		sin6->sin6_port = 0;
851 		sin6->sin6_flowinfo = 0;
852 		memcpy(&sin6->sin6_addr, x->props.saddr.a6,
853 		       sizeof(struct in6_addr));
854 		sin6->sin6_scope_id = 0;
855 	}
856 #endif
857 	else
858 		BUG();
859 
860 	/* dst address */
861 	addr = (struct sadb_address*) skb_put(skb,
862 					      sizeof(struct sadb_address)+sockaddr_size);
863 	addr->sadb_address_len =
864 		(sizeof(struct sadb_address)+sockaddr_size)/
865 			sizeof(uint64_t);
866 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
867 	addr->sadb_address_proto = 0;
868 	addr->sadb_address_prefixlen = 32; /* XXX */
869 	addr->sadb_address_reserved = 0;
870 	if (x->props.family == AF_INET) {
871 		sin = (struct sockaddr_in *) (addr + 1);
872 		sin->sin_family = AF_INET;
873 		sin->sin_addr.s_addr = x->id.daddr.a4;
874 		sin->sin_port = 0;
875 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
876 
877 		if (x->sel.saddr.a4 != x->props.saddr.a4) {
878 			addr = (struct sadb_address*) skb_put(skb,
879 				sizeof(struct sadb_address)+sockaddr_size);
880 			addr->sadb_address_len =
881 				(sizeof(struct sadb_address)+sockaddr_size)/
882 				sizeof(uint64_t);
883 			addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
884 			addr->sadb_address_proto =
885 				pfkey_proto_from_xfrm(x->sel.proto);
886 			addr->sadb_address_prefixlen = x->sel.prefixlen_s;
887 			addr->sadb_address_reserved = 0;
888 
889 			sin = (struct sockaddr_in *) (addr + 1);
890 			sin->sin_family = AF_INET;
891 			sin->sin_addr.s_addr = x->sel.saddr.a4;
892 			sin->sin_port = x->sel.sport;
893 			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
894 		}
895 	}
896 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
897 	else if (x->props.family == AF_INET6) {
898 		addr->sadb_address_prefixlen = 128;
899 
900 		sin6 = (struct sockaddr_in6 *) (addr + 1);
901 		sin6->sin6_family = AF_INET6;
902 		sin6->sin6_port = 0;
903 		sin6->sin6_flowinfo = 0;
904 		memcpy(&sin6->sin6_addr, x->id.daddr.a6, sizeof(struct in6_addr));
905 		sin6->sin6_scope_id = 0;
906 
907 		if (memcmp (x->sel.saddr.a6, x->props.saddr.a6,
908 			    sizeof(struct in6_addr))) {
909 			addr = (struct sadb_address *) skb_put(skb,
910 				sizeof(struct sadb_address)+sockaddr_size);
911 			addr->sadb_address_len =
912 				(sizeof(struct sadb_address)+sockaddr_size)/
913 				sizeof(uint64_t);
914 			addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
915 			addr->sadb_address_proto =
916 				pfkey_proto_from_xfrm(x->sel.proto);
917 			addr->sadb_address_prefixlen = x->sel.prefixlen_s;
918 			addr->sadb_address_reserved = 0;
919 
920 			sin6 = (struct sockaddr_in6 *) (addr + 1);
921 			sin6->sin6_family = AF_INET6;
922 			sin6->sin6_port = x->sel.sport;
923 			sin6->sin6_flowinfo = 0;
924 			memcpy(&sin6->sin6_addr, x->sel.saddr.a6,
925 			       sizeof(struct in6_addr));
926 			sin6->sin6_scope_id = 0;
927 		}
928 	}
929 #endif
930 	else
931 		BUG();
932 
933 	/* auth key */
934 	if (add_keys && auth_key_size) {
935 		key = (struct sadb_key *) skb_put(skb,
936 						  sizeof(struct sadb_key)+auth_key_size);
937 		key->sadb_key_len = (sizeof(struct sadb_key) + auth_key_size) /
938 			sizeof(uint64_t);
939 		key->sadb_key_exttype = SADB_EXT_KEY_AUTH;
940 		key->sadb_key_bits = x->aalg->alg_key_len;
941 		key->sadb_key_reserved = 0;
942 		memcpy(key + 1, x->aalg->alg_key, (x->aalg->alg_key_len+7)/8);
943 	}
944 	/* encrypt key */
945 	if (add_keys && encrypt_key_size) {
946 		key = (struct sadb_key *) skb_put(skb,
947 						  sizeof(struct sadb_key)+encrypt_key_size);
948 		key->sadb_key_len = (sizeof(struct sadb_key) +
949 				     encrypt_key_size) / sizeof(uint64_t);
950 		key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
951 		key->sadb_key_bits = x->ealg->alg_key_len;
952 		key->sadb_key_reserved = 0;
953 		memcpy(key + 1, x->ealg->alg_key,
954 		       (x->ealg->alg_key_len+7)/8);
955 	}
956 
957 	/* sa */
958 	sa2 = (struct sadb_x_sa2 *)  skb_put(skb, sizeof(struct sadb_x_sa2));
959 	sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t);
960 	sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
961 	if ((mode = pfkey_mode_from_xfrm(x->props.mode)) < 0) {
962 		kfree_skb(skb);
963 		return ERR_PTR(-EINVAL);
964 	}
965 	sa2->sadb_x_sa2_mode = mode;
966 	sa2->sadb_x_sa2_reserved1 = 0;
967 	sa2->sadb_x_sa2_reserved2 = 0;
968 	sa2->sadb_x_sa2_sequence = 0;
969 	sa2->sadb_x_sa2_reqid = x->props.reqid;
970 
971 	if (natt && natt->encap_type) {
972 		struct sadb_x_nat_t_type *n_type;
973 		struct sadb_x_nat_t_port *n_port;
974 
975 		/* type */
976 		n_type = (struct sadb_x_nat_t_type*) skb_put(skb, sizeof(*n_type));
977 		n_type->sadb_x_nat_t_type_len = sizeof(*n_type)/sizeof(uint64_t);
978 		n_type->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
979 		n_type->sadb_x_nat_t_type_type = natt->encap_type;
980 		n_type->sadb_x_nat_t_type_reserved[0] = 0;
981 		n_type->sadb_x_nat_t_type_reserved[1] = 0;
982 		n_type->sadb_x_nat_t_type_reserved[2] = 0;
983 
984 		/* source port */
985 		n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
986 		n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
987 		n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
988 		n_port->sadb_x_nat_t_port_port = natt->encap_sport;
989 		n_port->sadb_x_nat_t_port_reserved = 0;
990 
991 		/* dest port */
992 		n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
993 		n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
994 		n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
995 		n_port->sadb_x_nat_t_port_port = natt->encap_dport;
996 		n_port->sadb_x_nat_t_port_reserved = 0;
997 	}
998 
999 	/* security context */
1000 	if (xfrm_ctx) {
1001 		sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
1002 				sizeof(struct sadb_x_sec_ctx) + ctx_size);
1003 		sec_ctx->sadb_x_sec_len =
1004 		  (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
1005 		sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
1006 		sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
1007 		sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
1008 		sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
1009 		memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
1010 		       xfrm_ctx->ctx_len);
1011 	}
1012 
1013 	return skb;
1014 }
1015 
1016 static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
1017 						void **ext_hdrs)
1018 {
1019 	struct xfrm_state *x;
1020 	struct sadb_lifetime *lifetime;
1021 	struct sadb_sa *sa;
1022 	struct sadb_key *key;
1023 	struct sadb_x_sec_ctx *sec_ctx;
1024 	uint16_t proto;
1025 	int err;
1026 
1027 
1028 	sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1];
1029 	if (!sa ||
1030 	    !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1031 				     ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1032 		return ERR_PTR(-EINVAL);
1033 	if (hdr->sadb_msg_satype == SADB_SATYPE_ESP &&
1034 	    !ext_hdrs[SADB_EXT_KEY_ENCRYPT-1])
1035 		return ERR_PTR(-EINVAL);
1036 	if (hdr->sadb_msg_satype == SADB_SATYPE_AH &&
1037 	    !ext_hdrs[SADB_EXT_KEY_AUTH-1])
1038 		return ERR_PTR(-EINVAL);
1039 	if (!!ext_hdrs[SADB_EXT_LIFETIME_HARD-1] !=
1040 	    !!ext_hdrs[SADB_EXT_LIFETIME_SOFT-1])
1041 		return ERR_PTR(-EINVAL);
1042 
1043 	proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1044 	if (proto == 0)
1045 		return ERR_PTR(-EINVAL);
1046 
1047 	/* default error is no buffer space */
1048 	err = -ENOBUFS;
1049 
1050 	/* RFC2367:
1051 
1052    Only SADB_SASTATE_MATURE SAs may be submitted in an SADB_ADD message.
1053    SADB_SASTATE_LARVAL SAs are created by SADB_GETSPI and it is not
1054    sensible to add a new SA in the DYING or SADB_SASTATE_DEAD state.
1055    Therefore, the sadb_sa_state field of all submitted SAs MUST be
1056    SADB_SASTATE_MATURE and the kernel MUST return an error if this is
1057    not true.
1058 
1059 	   However, KAME setkey always uses SADB_SASTATE_LARVAL.
1060 	   Hence, we have to _ignore_ sadb_sa_state, which is also reasonable.
1061 	 */
1062 	if (sa->sadb_sa_auth > SADB_AALG_MAX ||
1063 	    (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP &&
1064 	     sa->sadb_sa_encrypt > SADB_X_CALG_MAX) ||
1065 	    sa->sadb_sa_encrypt > SADB_EALG_MAX)
1066 		return ERR_PTR(-EINVAL);
1067 	key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1];
1068 	if (key != NULL &&
1069 	    sa->sadb_sa_auth != SADB_X_AALG_NULL &&
1070 	    ((key->sadb_key_bits+7) / 8 == 0 ||
1071 	     (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
1072 		return ERR_PTR(-EINVAL);
1073 	key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
1074 	if (key != NULL &&
1075 	    sa->sadb_sa_encrypt != SADB_EALG_NULL &&
1076 	    ((key->sadb_key_bits+7) / 8 == 0 ||
1077 	     (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
1078 		return ERR_PTR(-EINVAL);
1079 
1080 	x = xfrm_state_alloc();
1081 	if (x == NULL)
1082 		return ERR_PTR(-ENOBUFS);
1083 
1084 	x->id.proto = proto;
1085 	x->id.spi = sa->sadb_sa_spi;
1086 	x->props.replay_window = sa->sadb_sa_replay;
1087 	if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN)
1088 		x->props.flags |= XFRM_STATE_NOECN;
1089 	if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
1090 		x->props.flags |= XFRM_STATE_DECAP_DSCP;
1091 	if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC)
1092 		x->props.flags |= XFRM_STATE_NOPMTUDISC;
1093 
1094 	lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_HARD-1];
1095 	if (lifetime != NULL) {
1096 		x->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
1097 		x->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
1098 		x->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime;
1099 		x->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime;
1100 	}
1101 	lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_SOFT-1];
1102 	if (lifetime != NULL) {
1103 		x->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
1104 		x->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
1105 		x->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;
1106 		x->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;
1107 	}
1108 
1109 	sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
1110 	if (sec_ctx != NULL) {
1111 		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
1112 
1113 		if (!uctx)
1114 			goto out;
1115 
1116 		err = security_xfrm_state_alloc(x, uctx);
1117 		kfree(uctx);
1118 
1119 		if (err)
1120 			goto out;
1121 	}
1122 
1123 	key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1];
1124 	if (sa->sadb_sa_auth) {
1125 		int keysize = 0;
1126 		struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth);
1127 		if (!a) {
1128 			err = -ENOSYS;
1129 			goto out;
1130 		}
1131 		if (key)
1132 			keysize = (key->sadb_key_bits + 7) / 8;
1133 		x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
1134 		if (!x->aalg)
1135 			goto out;
1136 		strcpy(x->aalg->alg_name, a->name);
1137 		x->aalg->alg_key_len = 0;
1138 		if (key) {
1139 			x->aalg->alg_key_len = key->sadb_key_bits;
1140 			memcpy(x->aalg->alg_key, key+1, keysize);
1141 		}
1142 		x->props.aalgo = sa->sadb_sa_auth;
1143 		/* x->algo.flags = sa->sadb_sa_flags; */
1144 	}
1145 	if (sa->sadb_sa_encrypt) {
1146 		if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
1147 			struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt);
1148 			if (!a) {
1149 				err = -ENOSYS;
1150 				goto out;
1151 			}
1152 			x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
1153 			if (!x->calg)
1154 				goto out;
1155 			strcpy(x->calg->alg_name, a->name);
1156 			x->props.calgo = sa->sadb_sa_encrypt;
1157 		} else {
1158 			int keysize = 0;
1159 			struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt);
1160 			if (!a) {
1161 				err = -ENOSYS;
1162 				goto out;
1163 			}
1164 			key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
1165 			if (key)
1166 				keysize = (key->sadb_key_bits + 7) / 8;
1167 			x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
1168 			if (!x->ealg)
1169 				goto out;
1170 			strcpy(x->ealg->alg_name, a->name);
1171 			x->ealg->alg_key_len = 0;
1172 			if (key) {
1173 				x->ealg->alg_key_len = key->sadb_key_bits;
1174 				memcpy(x->ealg->alg_key, key+1, keysize);
1175 			}
1176 			x->props.ealgo = sa->sadb_sa_encrypt;
1177 		}
1178 	}
1179 	/* x->algo.flags = sa->sadb_sa_flags; */
1180 
1181 	x->props.family = pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1182 						    &x->props.saddr);
1183 	if (!x->props.family) {
1184 		err = -EAFNOSUPPORT;
1185 		goto out;
1186 	}
1187 	pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1],
1188 				  &x->id.daddr);
1189 
1190 	if (ext_hdrs[SADB_X_EXT_SA2-1]) {
1191 		struct sadb_x_sa2 *sa2 = (void*)ext_hdrs[SADB_X_EXT_SA2-1];
1192 		int mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode);
1193 		if (mode < 0) {
1194 			err = -EINVAL;
1195 			goto out;
1196 		}
1197 		x->props.mode = mode;
1198 		x->props.reqid = sa2->sadb_x_sa2_reqid;
1199 	}
1200 
1201 	if (ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]) {
1202 		struct sadb_address *addr = ext_hdrs[SADB_EXT_ADDRESS_PROXY-1];
1203 
1204 		/* Nobody uses this, but we try. */
1205 		x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, &x->sel.saddr);
1206 		x->sel.prefixlen_s = addr->sadb_address_prefixlen;
1207 	}
1208 
1209 	if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
1210 		struct sadb_x_nat_t_type* n_type;
1211 		struct xfrm_encap_tmpl *natt;
1212 
1213 		x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
1214 		if (!x->encap)
1215 			goto out;
1216 
1217 		natt = x->encap;
1218 		n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
1219 		natt->encap_type = n_type->sadb_x_nat_t_type_type;
1220 
1221 		if (ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]) {
1222 			struct sadb_x_nat_t_port* n_port =
1223 				ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1];
1224 			natt->encap_sport = n_port->sadb_x_nat_t_port_port;
1225 		}
1226 		if (ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]) {
1227 			struct sadb_x_nat_t_port* n_port =
1228 				ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1];
1229 			natt->encap_dport = n_port->sadb_x_nat_t_port_port;
1230 		}
1231 	}
1232 
1233 	err = xfrm_init_state(x);
1234 	if (err)
1235 		goto out;
1236 
1237 	x->km.seq = hdr->sadb_msg_seq;
1238 	return x;
1239 
1240 out:
1241 	x->km.state = XFRM_STATE_DEAD;
1242 	xfrm_state_put(x);
1243 	return ERR_PTR(err);
1244 }
1245 
1246 static int pfkey_reserved(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1247 {
1248 	return -EOPNOTSUPP;
1249 }
1250 
1251 static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1252 {
1253 	struct sk_buff *resp_skb;
1254 	struct sadb_x_sa2 *sa2;
1255 	struct sadb_address *saddr, *daddr;
1256 	struct sadb_msg *out_hdr;
1257 	struct xfrm_state *x = NULL;
1258 	int mode;
1259 	u32 reqid;
1260 	u8 proto;
1261 	unsigned short family;
1262 	xfrm_address_t *xsaddr = NULL, *xdaddr = NULL;
1263 
1264 	if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1265 				     ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1266 		return -EINVAL;
1267 
1268 	proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1269 	if (proto == 0)
1270 		return -EINVAL;
1271 
1272 	if ((sa2 = ext_hdrs[SADB_X_EXT_SA2-1]) != NULL) {
1273 		mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode);
1274 		if (mode < 0)
1275 			return -EINVAL;
1276 		reqid = sa2->sadb_x_sa2_reqid;
1277 	} else {
1278 		mode = 0;
1279 		reqid = 0;
1280 	}
1281 
1282 	saddr = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
1283 	daddr = ext_hdrs[SADB_EXT_ADDRESS_DST-1];
1284 
1285 	family = ((struct sockaddr *)(saddr + 1))->sa_family;
1286 	switch (family) {
1287 	case AF_INET:
1288 		xdaddr = (xfrm_address_t *)&((struct sockaddr_in *)(daddr + 1))->sin_addr.s_addr;
1289 		xsaddr = (xfrm_address_t *)&((struct sockaddr_in *)(saddr + 1))->sin_addr.s_addr;
1290 		break;
1291 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1292 	case AF_INET6:
1293 		xdaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(daddr + 1))->sin6_addr;
1294 		xsaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(saddr + 1))->sin6_addr;
1295 		break;
1296 #endif
1297 	}
1298 
1299 	if (hdr->sadb_msg_seq) {
1300 		x = xfrm_find_acq_byseq(hdr->sadb_msg_seq);
1301 		if (x && xfrm_addr_cmp(&x->id.daddr, xdaddr, family)) {
1302 			xfrm_state_put(x);
1303 			x = NULL;
1304 		}
1305 	}
1306 
1307 	if (!x)
1308 		x = xfrm_find_acq(mode, reqid, proto, xdaddr, xsaddr, 1, family);
1309 
1310 	if (x == NULL)
1311 		return -ENOENT;
1312 
1313 	resp_skb = ERR_PTR(-ENOENT);
1314 
1315 	spin_lock_bh(&x->lock);
1316 	if (x->km.state != XFRM_STATE_DEAD) {
1317 		struct sadb_spirange *range = ext_hdrs[SADB_EXT_SPIRANGE-1];
1318 		u32 min_spi, max_spi;
1319 
1320 		if (range != NULL) {
1321 			min_spi = range->sadb_spirange_min;
1322 			max_spi = range->sadb_spirange_max;
1323 		} else {
1324 			min_spi = 0x100;
1325 			max_spi = 0x0fffffff;
1326 		}
1327 		xfrm_alloc_spi(x, htonl(min_spi), htonl(max_spi));
1328 		if (x->id.spi)
1329 			resp_skb = pfkey_xfrm_state2msg(x, 0, 3);
1330 	}
1331 	spin_unlock_bh(&x->lock);
1332 
1333 	if (IS_ERR(resp_skb)) {
1334 		xfrm_state_put(x);
1335 		return  PTR_ERR(resp_skb);
1336 	}
1337 
1338 	out_hdr = (struct sadb_msg *) resp_skb->data;
1339 	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
1340 	out_hdr->sadb_msg_type = SADB_GETSPI;
1341 	out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
1342 	out_hdr->sadb_msg_errno = 0;
1343 	out_hdr->sadb_msg_reserved = 0;
1344 	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
1345 	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
1346 
1347 	xfrm_state_put(x);
1348 
1349 	pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk);
1350 
1351 	return 0;
1352 }
1353 
1354 static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1355 {
1356 	struct xfrm_state *x;
1357 
1358 	if (hdr->sadb_msg_len != sizeof(struct sadb_msg)/8)
1359 		return -EOPNOTSUPP;
1360 
1361 	if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0)
1362 		return 0;
1363 
1364 	x = xfrm_find_acq_byseq(hdr->sadb_msg_seq);
1365 	if (x == NULL)
1366 		return 0;
1367 
1368 	spin_lock_bh(&x->lock);
1369 	if (x->km.state == XFRM_STATE_ACQ) {
1370 		x->km.state = XFRM_STATE_ERROR;
1371 		wake_up(&km_waitq);
1372 	}
1373 	spin_unlock_bh(&x->lock);
1374 	xfrm_state_put(x);
1375 	return 0;
1376 }
1377 
1378 static inline int event2poltype(int event)
1379 {
1380 	switch (event) {
1381 	case XFRM_MSG_DELPOLICY:
1382 		return SADB_X_SPDDELETE;
1383 	case XFRM_MSG_NEWPOLICY:
1384 		return SADB_X_SPDADD;
1385 	case XFRM_MSG_UPDPOLICY:
1386 		return SADB_X_SPDUPDATE;
1387 	case XFRM_MSG_POLEXPIRE:
1388 	//	return SADB_X_SPDEXPIRE;
1389 	default:
1390 		printk("pfkey: Unknown policy event %d\n", event);
1391 		break;
1392 	}
1393 
1394 	return 0;
1395 }
1396 
1397 static inline int event2keytype(int event)
1398 {
1399 	switch (event) {
1400 	case XFRM_MSG_DELSA:
1401 		return SADB_DELETE;
1402 	case XFRM_MSG_NEWSA:
1403 		return SADB_ADD;
1404 	case XFRM_MSG_UPDSA:
1405 		return SADB_UPDATE;
1406 	case XFRM_MSG_EXPIRE:
1407 		return SADB_EXPIRE;
1408 	default:
1409 		printk("pfkey: Unknown SA event %d\n", event);
1410 		break;
1411 	}
1412 
1413 	return 0;
1414 }
1415 
1416 /* ADD/UPD/DEL */
1417 static int key_notify_sa(struct xfrm_state *x, struct km_event *c)
1418 {
1419 	struct sk_buff *skb;
1420 	struct sadb_msg *hdr;
1421 	int hsc = 3;
1422 
1423 	if (c->event == XFRM_MSG_DELSA)
1424 		hsc = 0;
1425 
1426 	skb = pfkey_xfrm_state2msg(x, 0, hsc);
1427 
1428 	if (IS_ERR(skb))
1429 		return PTR_ERR(skb);
1430 
1431 	hdr = (struct sadb_msg *) skb->data;
1432 	hdr->sadb_msg_version = PF_KEY_V2;
1433 	hdr->sadb_msg_type = event2keytype(c->event);
1434 	hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
1435 	hdr->sadb_msg_errno = 0;
1436 	hdr->sadb_msg_reserved = 0;
1437 	hdr->sadb_msg_seq = c->seq;
1438 	hdr->sadb_msg_pid = c->pid;
1439 
1440 	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
1441 
1442 	return 0;
1443 }
1444 
1445 static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1446 {
1447 	struct xfrm_state *x;
1448 	int err;
1449 	struct km_event c;
1450 
1451 	xfrm_probe_algs();
1452 
1453 	x = pfkey_msg2xfrm_state(hdr, ext_hdrs);
1454 	if (IS_ERR(x))
1455 		return PTR_ERR(x);
1456 
1457 	xfrm_state_hold(x);
1458 	if (hdr->sadb_msg_type == SADB_ADD)
1459 		err = xfrm_state_add(x);
1460 	else
1461 		err = xfrm_state_update(x);
1462 
1463 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
1464 		       AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
1465 
1466 	if (err < 0) {
1467 		x->km.state = XFRM_STATE_DEAD;
1468 		__xfrm_state_put(x);
1469 		goto out;
1470 	}
1471 
1472 	if (hdr->sadb_msg_type == SADB_ADD)
1473 		c.event = XFRM_MSG_NEWSA;
1474 	else
1475 		c.event = XFRM_MSG_UPDSA;
1476 	c.seq = hdr->sadb_msg_seq;
1477 	c.pid = hdr->sadb_msg_pid;
1478 	km_state_notify(x, &c);
1479 out:
1480 	xfrm_state_put(x);
1481 	return err;
1482 }
1483 
1484 static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1485 {
1486 	struct xfrm_state *x;
1487 	struct km_event c;
1488 	int err;
1489 
1490 	if (!ext_hdrs[SADB_EXT_SA-1] ||
1491 	    !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1492 				     ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1493 		return -EINVAL;
1494 
1495 	x = pfkey_xfrm_state_lookup(hdr, ext_hdrs);
1496 	if (x == NULL)
1497 		return -ESRCH;
1498 
1499 	if ((err = security_xfrm_state_delete(x)))
1500 		goto out;
1501 
1502 	if (xfrm_state_kern(x)) {
1503 		err = -EPERM;
1504 		goto out;
1505 	}
1506 
1507 	err = xfrm_state_delete(x);
1508 
1509 	if (err < 0)
1510 		goto out;
1511 
1512 	c.seq = hdr->sadb_msg_seq;
1513 	c.pid = hdr->sadb_msg_pid;
1514 	c.event = XFRM_MSG_DELSA;
1515 	km_state_notify(x, &c);
1516 out:
1517 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
1518 		       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
1519 	xfrm_state_put(x);
1520 
1521 	return err;
1522 }
1523 
1524 static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1525 {
1526 	__u8 proto;
1527 	struct sk_buff *out_skb;
1528 	struct sadb_msg *out_hdr;
1529 	struct xfrm_state *x;
1530 
1531 	if (!ext_hdrs[SADB_EXT_SA-1] ||
1532 	    !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1533 				     ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1534 		return -EINVAL;
1535 
1536 	x = pfkey_xfrm_state_lookup(hdr, ext_hdrs);
1537 	if (x == NULL)
1538 		return -ESRCH;
1539 
1540 	out_skb = pfkey_xfrm_state2msg(x, 1, 3);
1541 	proto = x->id.proto;
1542 	xfrm_state_put(x);
1543 	if (IS_ERR(out_skb))
1544 		return  PTR_ERR(out_skb);
1545 
1546 	out_hdr = (struct sadb_msg *) out_skb->data;
1547 	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
1548 	out_hdr->sadb_msg_type = SADB_DUMP;
1549 	out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
1550 	out_hdr->sadb_msg_errno = 0;
1551 	out_hdr->sadb_msg_reserved = 0;
1552 	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
1553 	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
1554 	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk);
1555 
1556 	return 0;
1557 }
1558 
1559 static struct sk_buff *compose_sadb_supported(struct sadb_msg *orig,
1560 					      gfp_t allocation)
1561 {
1562 	struct sk_buff *skb;
1563 	struct sadb_msg *hdr;
1564 	int len, auth_len, enc_len, i;
1565 
1566 	auth_len = xfrm_count_auth_supported();
1567 	if (auth_len) {
1568 		auth_len *= sizeof(struct sadb_alg);
1569 		auth_len += sizeof(struct sadb_supported);
1570 	}
1571 
1572 	enc_len = xfrm_count_enc_supported();
1573 	if (enc_len) {
1574 		enc_len *= sizeof(struct sadb_alg);
1575 		enc_len += sizeof(struct sadb_supported);
1576 	}
1577 
1578 	len = enc_len + auth_len + sizeof(struct sadb_msg);
1579 
1580 	skb = alloc_skb(len + 16, allocation);
1581 	if (!skb)
1582 		goto out_put_algs;
1583 
1584 	hdr = (struct sadb_msg *) skb_put(skb, sizeof(*hdr));
1585 	pfkey_hdr_dup(hdr, orig);
1586 	hdr->sadb_msg_errno = 0;
1587 	hdr->sadb_msg_len = len / sizeof(uint64_t);
1588 
1589 	if (auth_len) {
1590 		struct sadb_supported *sp;
1591 		struct sadb_alg *ap;
1592 
1593 		sp = (struct sadb_supported *) skb_put(skb, auth_len);
1594 		ap = (struct sadb_alg *) (sp + 1);
1595 
1596 		sp->sadb_supported_len = auth_len / sizeof(uint64_t);
1597 		sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
1598 
1599 		for (i = 0; ; i++) {
1600 			struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
1601 			if (!aalg)
1602 				break;
1603 			if (aalg->available)
1604 				*ap++ = aalg->desc;
1605 		}
1606 	}
1607 
1608 	if (enc_len) {
1609 		struct sadb_supported *sp;
1610 		struct sadb_alg *ap;
1611 
1612 		sp = (struct sadb_supported *) skb_put(skb, enc_len);
1613 		ap = (struct sadb_alg *) (sp + 1);
1614 
1615 		sp->sadb_supported_len = enc_len / sizeof(uint64_t);
1616 		sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT;
1617 
1618 		for (i = 0; ; i++) {
1619 			struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
1620 			if (!ealg)
1621 				break;
1622 			if (ealg->available)
1623 				*ap++ = ealg->desc;
1624 		}
1625 	}
1626 
1627 out_put_algs:
1628 	return skb;
1629 }
1630 
1631 static int pfkey_register(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1632 {
1633 	struct pfkey_sock *pfk = pfkey_sk(sk);
1634 	struct sk_buff *supp_skb;
1635 
1636 	if (hdr->sadb_msg_satype > SADB_SATYPE_MAX)
1637 		return -EINVAL;
1638 
1639 	if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) {
1640 		if (pfk->registered&(1<<hdr->sadb_msg_satype))
1641 			return -EEXIST;
1642 		pfk->registered |= (1<<hdr->sadb_msg_satype);
1643 	}
1644 
1645 	xfrm_probe_algs();
1646 
1647 	supp_skb = compose_sadb_supported(hdr, GFP_KERNEL);
1648 	if (!supp_skb) {
1649 		if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC)
1650 			pfk->registered &= ~(1<<hdr->sadb_msg_satype);
1651 
1652 		return -ENOBUFS;
1653 	}
1654 
1655 	pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk);
1656 
1657 	return 0;
1658 }
1659 
1660 static int key_notify_sa_flush(struct km_event *c)
1661 {
1662 	struct sk_buff *skb;
1663 	struct sadb_msg *hdr;
1664 
1665 	skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
1666 	if (!skb)
1667 		return -ENOBUFS;
1668 	hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
1669 	hdr->sadb_msg_satype = pfkey_proto2satype(c->data.proto);
1670 	hdr->sadb_msg_type = SADB_FLUSH;
1671 	hdr->sadb_msg_seq = c->seq;
1672 	hdr->sadb_msg_pid = c->pid;
1673 	hdr->sadb_msg_version = PF_KEY_V2;
1674 	hdr->sadb_msg_errno = (uint8_t) 0;
1675 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
1676 
1677 	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
1678 
1679 	return 0;
1680 }
1681 
1682 static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1683 {
1684 	unsigned proto;
1685 	struct km_event c;
1686 	struct xfrm_audit audit_info;
1687 
1688 	proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1689 	if (proto == 0)
1690 		return -EINVAL;
1691 
1692 	audit_info.loginuid = audit_get_loginuid(current->audit_context);
1693 	audit_info.secid = 0;
1694 	xfrm_state_flush(proto, &audit_info);
1695 	c.data.proto = proto;
1696 	c.seq = hdr->sadb_msg_seq;
1697 	c.pid = hdr->sadb_msg_pid;
1698 	c.event = XFRM_MSG_FLUSHSA;
1699 	km_state_notify(NULL, &c);
1700 
1701 	return 0;
1702 }
1703 
1704 struct pfkey_dump_data
1705 {
1706 	struct sk_buff *skb;
1707 	struct sadb_msg *hdr;
1708 	struct sock *sk;
1709 };
1710 
1711 static int dump_sa(struct xfrm_state *x, int count, void *ptr)
1712 {
1713 	struct pfkey_dump_data *data = ptr;
1714 	struct sk_buff *out_skb;
1715 	struct sadb_msg *out_hdr;
1716 
1717 	out_skb = pfkey_xfrm_state2msg(x, 1, 3);
1718 	if (IS_ERR(out_skb))
1719 		return PTR_ERR(out_skb);
1720 
1721 	out_hdr = (struct sadb_msg *) out_skb->data;
1722 	out_hdr->sadb_msg_version = data->hdr->sadb_msg_version;
1723 	out_hdr->sadb_msg_type = SADB_DUMP;
1724 	out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
1725 	out_hdr->sadb_msg_errno = 0;
1726 	out_hdr->sadb_msg_reserved = 0;
1727 	out_hdr->sadb_msg_seq = count;
1728 	out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid;
1729 	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk);
1730 	return 0;
1731 }
1732 
1733 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1734 {
1735 	u8 proto;
1736 	struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk };
1737 
1738 	proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1739 	if (proto == 0)
1740 		return -EINVAL;
1741 
1742 	return xfrm_state_walk(proto, dump_sa, &data);
1743 }
1744 
1745 static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1746 {
1747 	struct pfkey_sock *pfk = pfkey_sk(sk);
1748 	int satype = hdr->sadb_msg_satype;
1749 
1750 	if (hdr->sadb_msg_len == (sizeof(*hdr) / sizeof(uint64_t))) {
1751 		/* XXX we mangle packet... */
1752 		hdr->sadb_msg_errno = 0;
1753 		if (satype != 0 && satype != 1)
1754 			return -EINVAL;
1755 		pfk->promisc = satype;
1756 	}
1757 	pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, BROADCAST_ALL, NULL);
1758 	return 0;
1759 }
1760 
1761 static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr)
1762 {
1763 	int i;
1764 	u32 reqid = *(u32*)ptr;
1765 
1766 	for (i=0; i<xp->xfrm_nr; i++) {
1767 		if (xp->xfrm_vec[i].reqid == reqid)
1768 			return -EEXIST;
1769 	}
1770 	return 0;
1771 }
1772 
1773 static u32 gen_reqid(void)
1774 {
1775 	u32 start;
1776 	static u32 reqid = IPSEC_MANUAL_REQID_MAX;
1777 
1778 	start = reqid;
1779 	do {
1780 		++reqid;
1781 		if (reqid == 0)
1782 			reqid = IPSEC_MANUAL_REQID_MAX+1;
1783 		if (xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, check_reqid,
1784 				     (void*)&reqid) != -EEXIST)
1785 			return reqid;
1786 	} while (reqid != start);
1787 	return 0;
1788 }
1789 
1790 static int
1791 parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
1792 {
1793 	struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr;
1794 	struct sockaddr_in *sin;
1795 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1796 	struct sockaddr_in6 *sin6;
1797 #endif
1798 	int mode;
1799 
1800 	if (xp->xfrm_nr >= XFRM_MAX_DEPTH)
1801 		return -ELOOP;
1802 
1803 	if (rq->sadb_x_ipsecrequest_mode == 0)
1804 		return -EINVAL;
1805 
1806 	t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */
1807 	if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
1808 		return -EINVAL;
1809 	t->mode = mode;
1810 	if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE)
1811 		t->optional = 1;
1812 	else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
1813 		t->reqid = rq->sadb_x_ipsecrequest_reqid;
1814 		if (t->reqid > IPSEC_MANUAL_REQID_MAX)
1815 			t->reqid = 0;
1816 		if (!t->reqid && !(t->reqid = gen_reqid()))
1817 			return -ENOBUFS;
1818 	}
1819 
1820 	/* addresses present only in tunnel mode */
1821 	if (t->mode == XFRM_MODE_TUNNEL) {
1822 		struct sockaddr *sa;
1823 		sa = (struct sockaddr *)(rq+1);
1824 		switch(sa->sa_family) {
1825 		case AF_INET:
1826 			sin = (struct sockaddr_in*)sa;
1827 			t->saddr.a4 = sin->sin_addr.s_addr;
1828 			sin++;
1829 			if (sin->sin_family != AF_INET)
1830 				return -EINVAL;
1831 			t->id.daddr.a4 = sin->sin_addr.s_addr;
1832 			break;
1833 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1834 		case AF_INET6:
1835 			sin6 = (struct sockaddr_in6*)sa;
1836 			memcpy(t->saddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr));
1837 			sin6++;
1838 			if (sin6->sin6_family != AF_INET6)
1839 				return -EINVAL;
1840 			memcpy(t->id.daddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr));
1841 			break;
1842 #endif
1843 		default:
1844 			return -EINVAL;
1845 		}
1846 		t->encap_family = sa->sa_family;
1847 	} else
1848 		t->encap_family = xp->family;
1849 
1850 	/* No way to set this via kame pfkey */
1851 	t->aalgos = t->ealgos = t->calgos = ~0;
1852 	xp->xfrm_nr++;
1853 	return 0;
1854 }
1855 
1856 static int
1857 parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
1858 {
1859 	int err;
1860 	int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy);
1861 	struct sadb_x_ipsecrequest *rq = (void*)(pol+1);
1862 
1863 	while (len >= sizeof(struct sadb_x_ipsecrequest)) {
1864 		if ((err = parse_ipsecrequest(xp, rq)) < 0)
1865 			return err;
1866 		len -= rq->sadb_x_ipsecrequest_len;
1867 		rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len);
1868 	}
1869 	return 0;
1870 }
1871 
1872 static inline int pfkey_xfrm_policy2sec_ctx_size(struct xfrm_policy *xp)
1873 {
1874   struct xfrm_sec_ctx *xfrm_ctx = xp->security;
1875 
1876 	if (xfrm_ctx) {
1877 		int len = sizeof(struct sadb_x_sec_ctx);
1878 		len += xfrm_ctx->ctx_len;
1879 		return PFKEY_ALIGN8(len);
1880 	}
1881 	return 0;
1882 }
1883 
1884 static int pfkey_xfrm_policy2msg_size(struct xfrm_policy *xp)
1885 {
1886 	struct xfrm_tmpl *t;
1887 	int sockaddr_size = pfkey_sockaddr_size(xp->family);
1888 	int socklen = 0;
1889 	int i;
1890 
1891 	for (i=0; i<xp->xfrm_nr; i++) {
1892 		t = xp->xfrm_vec + i;
1893 		socklen += (t->encap_family == AF_INET ?
1894 			    sizeof(struct sockaddr_in) :
1895 			    sizeof(struct sockaddr_in6));
1896 	}
1897 
1898 	return sizeof(struct sadb_msg) +
1899 		(sizeof(struct sadb_lifetime) * 3) +
1900 		(sizeof(struct sadb_address) * 2) +
1901 		(sockaddr_size * 2) +
1902 		sizeof(struct sadb_x_policy) +
1903 		(xp->xfrm_nr * sizeof(struct sadb_x_ipsecrequest)) +
1904 		(socklen * 2) +
1905 		pfkey_xfrm_policy2sec_ctx_size(xp);
1906 }
1907 
1908 static struct sk_buff * pfkey_xfrm_policy2msg_prep(struct xfrm_policy *xp)
1909 {
1910 	struct sk_buff *skb;
1911 	int size;
1912 
1913 	size = pfkey_xfrm_policy2msg_size(xp);
1914 
1915 	skb =  alloc_skb(size + 16, GFP_ATOMIC);
1916 	if (skb == NULL)
1917 		return ERR_PTR(-ENOBUFS);
1918 
1919 	return skb;
1920 }
1921 
1922 static int pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, int dir)
1923 {
1924 	struct sadb_msg *hdr;
1925 	struct sadb_address *addr;
1926 	struct sadb_lifetime *lifetime;
1927 	struct sadb_x_policy *pol;
1928 	struct sockaddr_in   *sin;
1929 	struct sadb_x_sec_ctx *sec_ctx;
1930 	struct xfrm_sec_ctx *xfrm_ctx;
1931 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1932 	struct sockaddr_in6  *sin6;
1933 #endif
1934 	int i;
1935 	int size;
1936 	int sockaddr_size = pfkey_sockaddr_size(xp->family);
1937 	int socklen = (xp->family == AF_INET ?
1938 		       sizeof(struct sockaddr_in) :
1939 		       sizeof(struct sockaddr_in6));
1940 
1941 	size = pfkey_xfrm_policy2msg_size(xp);
1942 
1943 	/* call should fill header later */
1944 	hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
1945 	memset(hdr, 0, size);	/* XXX do we need this ? */
1946 
1947 	/* src address */
1948 	addr = (struct sadb_address*) skb_put(skb,
1949 					      sizeof(struct sadb_address)+sockaddr_size);
1950 	addr->sadb_address_len =
1951 		(sizeof(struct sadb_address)+sockaddr_size)/
1952 			sizeof(uint64_t);
1953 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
1954 	addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto);
1955 	addr->sadb_address_prefixlen = xp->selector.prefixlen_s;
1956 	addr->sadb_address_reserved = 0;
1957 	/* src address */
1958 	if (xp->family == AF_INET) {
1959 		sin = (struct sockaddr_in *) (addr + 1);
1960 		sin->sin_family = AF_INET;
1961 		sin->sin_addr.s_addr = xp->selector.saddr.a4;
1962 		sin->sin_port = xp->selector.sport;
1963 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
1964 	}
1965 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1966 	else if (xp->family == AF_INET6) {
1967 		sin6 = (struct sockaddr_in6 *) (addr + 1);
1968 		sin6->sin6_family = AF_INET6;
1969 		sin6->sin6_port = xp->selector.sport;
1970 		sin6->sin6_flowinfo = 0;
1971 		memcpy(&sin6->sin6_addr, xp->selector.saddr.a6,
1972 		       sizeof(struct in6_addr));
1973 		sin6->sin6_scope_id = 0;
1974 	}
1975 #endif
1976 	else
1977 		BUG();
1978 
1979 	/* dst address */
1980 	addr = (struct sadb_address*) skb_put(skb,
1981 					      sizeof(struct sadb_address)+sockaddr_size);
1982 	addr->sadb_address_len =
1983 		(sizeof(struct sadb_address)+sockaddr_size)/
1984 			sizeof(uint64_t);
1985 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
1986 	addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto);
1987 	addr->sadb_address_prefixlen = xp->selector.prefixlen_d;
1988 	addr->sadb_address_reserved = 0;
1989 	if (xp->family == AF_INET) {
1990 		sin = (struct sockaddr_in *) (addr + 1);
1991 		sin->sin_family = AF_INET;
1992 		sin->sin_addr.s_addr = xp->selector.daddr.a4;
1993 		sin->sin_port = xp->selector.dport;
1994 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
1995 	}
1996 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1997 	else if (xp->family == AF_INET6) {
1998 		sin6 = (struct sockaddr_in6 *) (addr + 1);
1999 		sin6->sin6_family = AF_INET6;
2000 		sin6->sin6_port = xp->selector.dport;
2001 		sin6->sin6_flowinfo = 0;
2002 		memcpy(&sin6->sin6_addr, xp->selector.daddr.a6,
2003 		       sizeof(struct in6_addr));
2004 		sin6->sin6_scope_id = 0;
2005 	}
2006 #endif
2007 	else
2008 		BUG();
2009 
2010 	/* hard time */
2011 	lifetime = (struct sadb_lifetime *)  skb_put(skb,
2012 						     sizeof(struct sadb_lifetime));
2013 	lifetime->sadb_lifetime_len =
2014 		sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2015 	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
2016 	lifetime->sadb_lifetime_allocations =  _X2KEY(xp->lft.hard_packet_limit);
2017 	lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.hard_byte_limit);
2018 	lifetime->sadb_lifetime_addtime = xp->lft.hard_add_expires_seconds;
2019 	lifetime->sadb_lifetime_usetime = xp->lft.hard_use_expires_seconds;
2020 	/* soft time */
2021 	lifetime = (struct sadb_lifetime *)  skb_put(skb,
2022 						     sizeof(struct sadb_lifetime));
2023 	lifetime->sadb_lifetime_len =
2024 		sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2025 	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
2026 	lifetime->sadb_lifetime_allocations =  _X2KEY(xp->lft.soft_packet_limit);
2027 	lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.soft_byte_limit);
2028 	lifetime->sadb_lifetime_addtime = xp->lft.soft_add_expires_seconds;
2029 	lifetime->sadb_lifetime_usetime = xp->lft.soft_use_expires_seconds;
2030 	/* current time */
2031 	lifetime = (struct sadb_lifetime *)  skb_put(skb,
2032 						     sizeof(struct sadb_lifetime));
2033 	lifetime->sadb_lifetime_len =
2034 		sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2035 	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
2036 	lifetime->sadb_lifetime_allocations = xp->curlft.packets;
2037 	lifetime->sadb_lifetime_bytes = xp->curlft.bytes;
2038 	lifetime->sadb_lifetime_addtime = xp->curlft.add_time;
2039 	lifetime->sadb_lifetime_usetime = xp->curlft.use_time;
2040 
2041 	pol = (struct sadb_x_policy *)  skb_put(skb, sizeof(struct sadb_x_policy));
2042 	pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t);
2043 	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
2044 	pol->sadb_x_policy_type = IPSEC_POLICY_DISCARD;
2045 	if (xp->action == XFRM_POLICY_ALLOW) {
2046 		if (xp->xfrm_nr)
2047 			pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
2048 		else
2049 			pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
2050 	}
2051 	pol->sadb_x_policy_dir = dir+1;
2052 	pol->sadb_x_policy_id = xp->index;
2053 	pol->sadb_x_policy_priority = xp->priority;
2054 
2055 	for (i=0; i<xp->xfrm_nr; i++) {
2056 		struct sadb_x_ipsecrequest *rq;
2057 		struct xfrm_tmpl *t = xp->xfrm_vec + i;
2058 		int req_size;
2059 		int mode;
2060 
2061 		req_size = sizeof(struct sadb_x_ipsecrequest);
2062 		if (t->mode == XFRM_MODE_TUNNEL)
2063 			req_size += ((t->encap_family == AF_INET ?
2064 				     sizeof(struct sockaddr_in) :
2065 				     sizeof(struct sockaddr_in6)) * 2);
2066 		else
2067 			size -= 2*socklen;
2068 		rq = (void*)skb_put(skb, req_size);
2069 		pol->sadb_x_policy_len += req_size/8;
2070 		memset(rq, 0, sizeof(*rq));
2071 		rq->sadb_x_ipsecrequest_len = req_size;
2072 		rq->sadb_x_ipsecrequest_proto = t->id.proto;
2073 		if ((mode = pfkey_mode_from_xfrm(t->mode)) < 0)
2074 			return -EINVAL;
2075 		rq->sadb_x_ipsecrequest_mode = mode;
2076 		rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE;
2077 		if (t->reqid)
2078 			rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE;
2079 		if (t->optional)
2080 			rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE;
2081 		rq->sadb_x_ipsecrequest_reqid = t->reqid;
2082 		if (t->mode == XFRM_MODE_TUNNEL) {
2083 			switch (t->encap_family) {
2084 			case AF_INET:
2085 				sin = (void*)(rq+1);
2086 				sin->sin_family = AF_INET;
2087 				sin->sin_addr.s_addr = t->saddr.a4;
2088 				sin->sin_port = 0;
2089 				memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
2090 				sin++;
2091 				sin->sin_family = AF_INET;
2092 				sin->sin_addr.s_addr = t->id.daddr.a4;
2093 				sin->sin_port = 0;
2094 				memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
2095 				break;
2096 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2097 			case AF_INET6:
2098 				sin6 = (void*)(rq+1);
2099 				sin6->sin6_family = AF_INET6;
2100 				sin6->sin6_port = 0;
2101 				sin6->sin6_flowinfo = 0;
2102 				memcpy(&sin6->sin6_addr, t->saddr.a6,
2103 				       sizeof(struct in6_addr));
2104 				sin6->sin6_scope_id = 0;
2105 
2106 				sin6++;
2107 				sin6->sin6_family = AF_INET6;
2108 				sin6->sin6_port = 0;
2109 				sin6->sin6_flowinfo = 0;
2110 				memcpy(&sin6->sin6_addr, t->id.daddr.a6,
2111 				       sizeof(struct in6_addr));
2112 				sin6->sin6_scope_id = 0;
2113 				break;
2114 #endif
2115 			default:
2116 				break;
2117 			}
2118 		}
2119 	}
2120 
2121 	/* security context */
2122 	if ((xfrm_ctx = xp->security)) {
2123 		int ctx_size = pfkey_xfrm_policy2sec_ctx_size(xp);
2124 
2125 		sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, ctx_size);
2126 		sec_ctx->sadb_x_sec_len = ctx_size / sizeof(uint64_t);
2127 		sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
2128 		sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
2129 		sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
2130 		sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
2131 		memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
2132 		       xfrm_ctx->ctx_len);
2133 	}
2134 
2135 	hdr->sadb_msg_len = size / sizeof(uint64_t);
2136 	hdr->sadb_msg_reserved = atomic_read(&xp->refcnt);
2137 
2138 	return 0;
2139 }
2140 
2141 static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
2142 {
2143 	struct sk_buff *out_skb;
2144 	struct sadb_msg *out_hdr;
2145 	int err;
2146 
2147 	out_skb = pfkey_xfrm_policy2msg_prep(xp);
2148 	if (IS_ERR(out_skb)) {
2149 		err = PTR_ERR(out_skb);
2150 		goto out;
2151 	}
2152 	err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
2153 	if (err < 0)
2154 		return err;
2155 
2156 	out_hdr = (struct sadb_msg *) out_skb->data;
2157 	out_hdr->sadb_msg_version = PF_KEY_V2;
2158 
2159 	if (c->data.byid && c->event == XFRM_MSG_DELPOLICY)
2160 		out_hdr->sadb_msg_type = SADB_X_SPDDELETE2;
2161 	else
2162 		out_hdr->sadb_msg_type = event2poltype(c->event);
2163 	out_hdr->sadb_msg_errno = 0;
2164 	out_hdr->sadb_msg_seq = c->seq;
2165 	out_hdr->sadb_msg_pid = c->pid;
2166 	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
2167 out:
2168 	return 0;
2169 
2170 }
2171 
2172 static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2173 {
2174 	int err = 0;
2175 	struct sadb_lifetime *lifetime;
2176 	struct sadb_address *sa;
2177 	struct sadb_x_policy *pol;
2178 	struct xfrm_policy *xp;
2179 	struct km_event c;
2180 	struct sadb_x_sec_ctx *sec_ctx;
2181 
2182 	if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2183 				     ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
2184 	    !ext_hdrs[SADB_X_EXT_POLICY-1])
2185 		return -EINVAL;
2186 
2187 	pol = ext_hdrs[SADB_X_EXT_POLICY-1];
2188 	if (pol->sadb_x_policy_type > IPSEC_POLICY_IPSEC)
2189 		return -EINVAL;
2190 	if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX)
2191 		return -EINVAL;
2192 
2193 	xp = xfrm_policy_alloc(GFP_KERNEL);
2194 	if (xp == NULL)
2195 		return -ENOBUFS;
2196 
2197 	xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ?
2198 		      XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);
2199 	xp->priority = pol->sadb_x_policy_priority;
2200 
2201 	sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2202 	xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr);
2203 	if (!xp->family) {
2204 		err = -EINVAL;
2205 		goto out;
2206 	}
2207 	xp->selector.family = xp->family;
2208 	xp->selector.prefixlen_s = sa->sadb_address_prefixlen;
2209 	xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2210 	xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
2211 	if (xp->selector.sport)
2212 		xp->selector.sport_mask = htons(0xffff);
2213 
2214 	sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1],
2215 	pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr);
2216 	xp->selector.prefixlen_d = sa->sadb_address_prefixlen;
2217 
2218 	/* Amusing, we set this twice.  KAME apps appear to set same value
2219 	 * in both addresses.
2220 	 */
2221 	xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2222 
2223 	xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
2224 	if (xp->selector.dport)
2225 		xp->selector.dport_mask = htons(0xffff);
2226 
2227 	sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
2228 	if (sec_ctx != NULL) {
2229 		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
2230 
2231 		if (!uctx) {
2232 			err = -ENOBUFS;
2233 			goto out;
2234 		}
2235 
2236 		err = security_xfrm_policy_alloc(xp, uctx);
2237 		kfree(uctx);
2238 
2239 		if (err)
2240 			goto out;
2241 	}
2242 
2243 	xp->lft.soft_byte_limit = XFRM_INF;
2244 	xp->lft.hard_byte_limit = XFRM_INF;
2245 	xp->lft.soft_packet_limit = XFRM_INF;
2246 	xp->lft.hard_packet_limit = XFRM_INF;
2247 	if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD-1]) != NULL) {
2248 		xp->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
2249 		xp->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
2250 		xp->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime;
2251 		xp->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime;
2252 	}
2253 	if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) != NULL) {
2254 		xp->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
2255 		xp->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
2256 		xp->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;
2257 		xp->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;
2258 	}
2259 	xp->xfrm_nr = 0;
2260 	if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
2261 	    (err = parse_ipsecrequests(xp, pol)) < 0)
2262 		goto out;
2263 
2264 	err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
2265 				 hdr->sadb_msg_type != SADB_X_SPDUPDATE);
2266 
2267 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
2268 		       AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL);
2269 
2270 	if (err)
2271 		goto out;
2272 
2273 	if (hdr->sadb_msg_type == SADB_X_SPDUPDATE)
2274 		c.event = XFRM_MSG_UPDPOLICY;
2275 	else
2276 		c.event = XFRM_MSG_NEWPOLICY;
2277 
2278 	c.seq = hdr->sadb_msg_seq;
2279 	c.pid = hdr->sadb_msg_pid;
2280 
2281 	km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c);
2282 	xfrm_pol_put(xp);
2283 	return 0;
2284 
2285 out:
2286 	security_xfrm_policy_free(xp);
2287 	kfree(xp);
2288 	return err;
2289 }
2290 
2291 static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2292 {
2293 	int err;
2294 	struct sadb_address *sa;
2295 	struct sadb_x_policy *pol;
2296 	struct xfrm_policy *xp, tmp;
2297 	struct xfrm_selector sel;
2298 	struct km_event c;
2299 	struct sadb_x_sec_ctx *sec_ctx;
2300 
2301 	if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2302 				     ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
2303 	    !ext_hdrs[SADB_X_EXT_POLICY-1])
2304 		return -EINVAL;
2305 
2306 	pol = ext_hdrs[SADB_X_EXT_POLICY-1];
2307 	if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX)
2308 		return -EINVAL;
2309 
2310 	memset(&sel, 0, sizeof(sel));
2311 
2312 	sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2313 	sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr);
2314 	sel.prefixlen_s = sa->sadb_address_prefixlen;
2315 	sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2316 	sel.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
2317 	if (sel.sport)
2318 		sel.sport_mask = htons(0xffff);
2319 
2320 	sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1],
2321 	pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr);
2322 	sel.prefixlen_d = sa->sadb_address_prefixlen;
2323 	sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2324 	sel.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
2325 	if (sel.dport)
2326 		sel.dport_mask = htons(0xffff);
2327 
2328 	sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
2329 	memset(&tmp, 0, sizeof(struct xfrm_policy));
2330 
2331 	if (sec_ctx != NULL) {
2332 		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
2333 
2334 		if (!uctx)
2335 			return -ENOMEM;
2336 
2337 		err = security_xfrm_policy_alloc(&tmp, uctx);
2338 		kfree(uctx);
2339 
2340 		if (err)
2341 			return err;
2342 	}
2343 
2344 	xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1,
2345 				   &sel, tmp.security, 1, &err);
2346 	security_xfrm_policy_free(&tmp);
2347 
2348 	if (xp == NULL)
2349 		return -ENOENT;
2350 
2351 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
2352 		       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
2353 
2354 	if (err)
2355 		goto out;
2356 
2357 	c.seq = hdr->sadb_msg_seq;
2358 	c.pid = hdr->sadb_msg_pid;
2359 	c.event = XFRM_MSG_DELPOLICY;
2360 	km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c);
2361 
2362 out:
2363 	xfrm_pol_put(xp);
2364 	return err;
2365 }
2366 
2367 static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, struct sadb_msg *hdr, int dir)
2368 {
2369 	int err;
2370 	struct sk_buff *out_skb;
2371 	struct sadb_msg *out_hdr;
2372 	err = 0;
2373 
2374 	out_skb = pfkey_xfrm_policy2msg_prep(xp);
2375 	if (IS_ERR(out_skb)) {
2376 		err =  PTR_ERR(out_skb);
2377 		goto out;
2378 	}
2379 	err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
2380 	if (err < 0)
2381 		goto out;
2382 
2383 	out_hdr = (struct sadb_msg *) out_skb->data;
2384 	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
2385 	out_hdr->sadb_msg_type = hdr->sadb_msg_type;
2386 	out_hdr->sadb_msg_satype = 0;
2387 	out_hdr->sadb_msg_errno = 0;
2388 	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
2389 	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
2390 	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk);
2391 	err = 0;
2392 
2393 out:
2394 	return err;
2395 }
2396 
2397 #ifdef CONFIG_NET_KEY_MIGRATE
2398 static int pfkey_sockaddr_pair_size(sa_family_t family)
2399 {
2400 	switch (family) {
2401 	case AF_INET:
2402 		return PFKEY_ALIGN8(sizeof(struct sockaddr_in) * 2);
2403 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2404 	case AF_INET6:
2405 		return PFKEY_ALIGN8(sizeof(struct sockaddr_in6) * 2);
2406 #endif
2407 	default:
2408 		return 0;
2409 	}
2410 	/* NOTREACHED */
2411 }
2412 
2413 static int parse_sockaddr_pair(struct sadb_x_ipsecrequest *rq,
2414 			       xfrm_address_t *saddr, xfrm_address_t *daddr,
2415 			       u16 *family)
2416 {
2417 	struct sockaddr *sa = (struct sockaddr *)(rq + 1);
2418 	if (rq->sadb_x_ipsecrequest_len <
2419 	    pfkey_sockaddr_pair_size(sa->sa_family))
2420 		return -EINVAL;
2421 
2422 	switch (sa->sa_family) {
2423 	case AF_INET:
2424 		{
2425 			struct sockaddr_in *sin;
2426 			sin = (struct sockaddr_in *)sa;
2427 			if ((sin+1)->sin_family != AF_INET)
2428 				return -EINVAL;
2429 			memcpy(&saddr->a4, &sin->sin_addr, sizeof(saddr->a4));
2430 			sin++;
2431 			memcpy(&daddr->a4, &sin->sin_addr, sizeof(daddr->a4));
2432 			*family = AF_INET;
2433 			break;
2434 		}
2435 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2436 	case AF_INET6:
2437 		{
2438 			struct sockaddr_in6 *sin6;
2439 			sin6 = (struct sockaddr_in6 *)sa;
2440 			if ((sin6+1)->sin6_family != AF_INET6)
2441 				return -EINVAL;
2442 			memcpy(&saddr->a6, &sin6->sin6_addr,
2443 			       sizeof(saddr->a6));
2444 			sin6++;
2445 			memcpy(&daddr->a6, &sin6->sin6_addr,
2446 			       sizeof(daddr->a6));
2447 			*family = AF_INET6;
2448 			break;
2449 		}
2450 #endif
2451 	default:
2452 		return -EINVAL;
2453 	}
2454 
2455 	return 0;
2456 }
2457 
2458 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
2459 				    struct xfrm_migrate *m)
2460 {
2461 	int err;
2462 	struct sadb_x_ipsecrequest *rq2;
2463 	int mode;
2464 
2465 	if (len <= sizeof(struct sadb_x_ipsecrequest) ||
2466 	    len < rq1->sadb_x_ipsecrequest_len)
2467 		return -EINVAL;
2468 
2469 	/* old endoints */
2470 	err = parse_sockaddr_pair(rq1, &m->old_saddr, &m->old_daddr,
2471 				  &m->old_family);
2472 	if (err)
2473 		return err;
2474 
2475 	rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
2476 	len -= rq1->sadb_x_ipsecrequest_len;
2477 
2478 	if (len <= sizeof(struct sadb_x_ipsecrequest) ||
2479 	    len < rq2->sadb_x_ipsecrequest_len)
2480 		return -EINVAL;
2481 
2482 	/* new endpoints */
2483 	err = parse_sockaddr_pair(rq2, &m->new_saddr, &m->new_daddr,
2484 				  &m->new_family);
2485 	if (err)
2486 		return err;
2487 
2488 	if (rq1->sadb_x_ipsecrequest_proto != rq2->sadb_x_ipsecrequest_proto ||
2489 	    rq1->sadb_x_ipsecrequest_mode != rq2->sadb_x_ipsecrequest_mode ||
2490 	    rq1->sadb_x_ipsecrequest_reqid != rq2->sadb_x_ipsecrequest_reqid)
2491 		return -EINVAL;
2492 
2493 	m->proto = rq1->sadb_x_ipsecrequest_proto;
2494 	if ((mode = pfkey_mode_to_xfrm(rq1->sadb_x_ipsecrequest_mode)) < 0)
2495 		return -EINVAL;
2496 	m->mode = mode;
2497 	m->reqid = rq1->sadb_x_ipsecrequest_reqid;
2498 
2499 	return ((int)(rq1->sadb_x_ipsecrequest_len +
2500 		      rq2->sadb_x_ipsecrequest_len));
2501 }
2502 
2503 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
2504 			 struct sadb_msg *hdr, void **ext_hdrs)
2505 {
2506 	int i, len, ret, err = -EINVAL;
2507 	u8 dir;
2508 	struct sadb_address *sa;
2509 	struct sadb_x_policy *pol;
2510 	struct sadb_x_ipsecrequest *rq;
2511 	struct xfrm_selector sel;
2512 	struct xfrm_migrate m[XFRM_MAX_DEPTH];
2513 
2514 	if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
2515 	    ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
2516 	    !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
2517 		err = -EINVAL;
2518 		goto out;
2519 	}
2520 
2521 	pol = ext_hdrs[SADB_X_EXT_POLICY - 1];
2522 	if (!pol) {
2523 		err = -EINVAL;
2524 		goto out;
2525 	}
2526 
2527 	if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) {
2528 		err = -EINVAL;
2529 		goto out;
2530 	}
2531 
2532 	dir = pol->sadb_x_policy_dir - 1;
2533 	memset(&sel, 0, sizeof(sel));
2534 
2535 	/* set source address info of selector */
2536 	sa = ext_hdrs[SADB_EXT_ADDRESS_SRC - 1];
2537 	sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr);
2538 	sel.prefixlen_s = sa->sadb_address_prefixlen;
2539 	sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2540 	sel.sport = ((struct sockaddr_in *)(sa + 1))->sin_port;
2541 	if (sel.sport)
2542 		sel.sport_mask = ~0;
2543 
2544 	/* set destination address info of selector */
2545 	sa = ext_hdrs[SADB_EXT_ADDRESS_DST - 1],
2546 	pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr);
2547 	sel.prefixlen_d = sa->sadb_address_prefixlen;
2548 	sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2549 	sel.dport = ((struct sockaddr_in *)(sa + 1))->sin_port;
2550 	if (sel.dport)
2551 		sel.dport_mask = ~0;
2552 
2553 	rq = (struct sadb_x_ipsecrequest *)(pol + 1);
2554 
2555 	/* extract ipsecrequests */
2556 	i = 0;
2557 	len = pol->sadb_x_policy_len * 8 - sizeof(struct sadb_x_policy);
2558 
2559 	while (len > 0 && i < XFRM_MAX_DEPTH) {
2560 		ret = ipsecrequests_to_migrate(rq, len, &m[i]);
2561 		if (ret < 0) {
2562 			err = ret;
2563 			goto out;
2564 		} else {
2565 			rq = (struct sadb_x_ipsecrequest *)((u8 *)rq + ret);
2566 			len -= ret;
2567 			i++;
2568 		}
2569 	}
2570 
2571 	if (!i || len > 0) {
2572 		err = -EINVAL;
2573 		goto out;
2574 	}
2575 
2576 	return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i);
2577 
2578  out:
2579 	return err;
2580 }
2581 #else
2582 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
2583 			 struct sadb_msg *hdr, void **ext_hdrs)
2584 {
2585 	return -ENOPROTOOPT;
2586 }
2587 #endif
2588 
2589 
2590 static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2591 {
2592 	unsigned int dir;
2593 	int err = 0, delete;
2594 	struct sadb_x_policy *pol;
2595 	struct xfrm_policy *xp;
2596 	struct km_event c;
2597 
2598 	if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL)
2599 		return -EINVAL;
2600 
2601 	dir = xfrm_policy_id2dir(pol->sadb_x_policy_id);
2602 	if (dir >= XFRM_POLICY_MAX)
2603 		return -EINVAL;
2604 
2605 	delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
2606 	xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id,
2607 			      delete, &err);
2608 	if (xp == NULL)
2609 		return -ENOENT;
2610 
2611 	if (delete) {
2612 		xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
2613 			       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
2614 
2615 		if (err)
2616 			goto out;
2617 		c.seq = hdr->sadb_msg_seq;
2618 		c.pid = hdr->sadb_msg_pid;
2619 		c.data.byid = 1;
2620 		c.event = XFRM_MSG_DELPOLICY;
2621 		km_policy_notify(xp, dir, &c);
2622 	} else {
2623 		err = key_pol_get_resp(sk, xp, hdr, dir);
2624 	}
2625 
2626 out:
2627 	xfrm_pol_put(xp);
2628 	return err;
2629 }
2630 
2631 static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
2632 {
2633 	struct pfkey_dump_data *data = ptr;
2634 	struct sk_buff *out_skb;
2635 	struct sadb_msg *out_hdr;
2636 	int err;
2637 
2638 	out_skb = pfkey_xfrm_policy2msg_prep(xp);
2639 	if (IS_ERR(out_skb))
2640 		return PTR_ERR(out_skb);
2641 
2642 	err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
2643 	if (err < 0)
2644 		return err;
2645 
2646 	out_hdr = (struct sadb_msg *) out_skb->data;
2647 	out_hdr->sadb_msg_version = data->hdr->sadb_msg_version;
2648 	out_hdr->sadb_msg_type = SADB_X_SPDDUMP;
2649 	out_hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
2650 	out_hdr->sadb_msg_errno = 0;
2651 	out_hdr->sadb_msg_seq = count;
2652 	out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid;
2653 	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk);
2654 	return 0;
2655 }
2656 
2657 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2658 {
2659 	struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk };
2660 
2661 	return xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_sp, &data);
2662 }
2663 
2664 static int key_notify_policy_flush(struct km_event *c)
2665 {
2666 	struct sk_buff *skb_out;
2667 	struct sadb_msg *hdr;
2668 
2669 	skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
2670 	if (!skb_out)
2671 		return -ENOBUFS;
2672 	hdr = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg));
2673 	hdr->sadb_msg_type = SADB_X_SPDFLUSH;
2674 	hdr->sadb_msg_seq = c->seq;
2675 	hdr->sadb_msg_pid = c->pid;
2676 	hdr->sadb_msg_version = PF_KEY_V2;
2677 	hdr->sadb_msg_errno = (uint8_t) 0;
2678 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
2679 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL);
2680 	return 0;
2681 
2682 }
2683 
2684 static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2685 {
2686 	struct km_event c;
2687 	struct xfrm_audit audit_info;
2688 
2689 	audit_info.loginuid = audit_get_loginuid(current->audit_context);
2690 	audit_info.secid = 0;
2691 	xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info);
2692 	c.data.type = XFRM_POLICY_TYPE_MAIN;
2693 	c.event = XFRM_MSG_FLUSHPOLICY;
2694 	c.pid = hdr->sadb_msg_pid;
2695 	c.seq = hdr->sadb_msg_seq;
2696 	km_policy_notify(NULL, 0, &c);
2697 
2698 	return 0;
2699 }
2700 
2701 typedef int (*pfkey_handler)(struct sock *sk, struct sk_buff *skb,
2702 			     struct sadb_msg *hdr, void **ext_hdrs);
2703 static pfkey_handler pfkey_funcs[SADB_MAX + 1] = {
2704 	[SADB_RESERVED]		= pfkey_reserved,
2705 	[SADB_GETSPI]		= pfkey_getspi,
2706 	[SADB_UPDATE]		= pfkey_add,
2707 	[SADB_ADD]		= pfkey_add,
2708 	[SADB_DELETE]		= pfkey_delete,
2709 	[SADB_GET]		= pfkey_get,
2710 	[SADB_ACQUIRE]		= pfkey_acquire,
2711 	[SADB_REGISTER]		= pfkey_register,
2712 	[SADB_EXPIRE]		= NULL,
2713 	[SADB_FLUSH]		= pfkey_flush,
2714 	[SADB_DUMP]		= pfkey_dump,
2715 	[SADB_X_PROMISC]	= pfkey_promisc,
2716 	[SADB_X_PCHANGE]	= NULL,
2717 	[SADB_X_SPDUPDATE]	= pfkey_spdadd,
2718 	[SADB_X_SPDADD]		= pfkey_spdadd,
2719 	[SADB_X_SPDDELETE]	= pfkey_spddelete,
2720 	[SADB_X_SPDGET]		= pfkey_spdget,
2721 	[SADB_X_SPDACQUIRE]	= NULL,
2722 	[SADB_X_SPDDUMP]	= pfkey_spddump,
2723 	[SADB_X_SPDFLUSH]	= pfkey_spdflush,
2724 	[SADB_X_SPDSETIDX]	= pfkey_spdadd,
2725 	[SADB_X_SPDDELETE2]	= pfkey_spdget,
2726 	[SADB_X_MIGRATE]	= pfkey_migrate,
2727 };
2728 
2729 static int pfkey_process(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr)
2730 {
2731 	void *ext_hdrs[SADB_EXT_MAX];
2732 	int err;
2733 
2734 	pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
2735 			BROADCAST_PROMISC_ONLY, NULL);
2736 
2737 	memset(ext_hdrs, 0, sizeof(ext_hdrs));
2738 	err = parse_exthdrs(skb, hdr, ext_hdrs);
2739 	if (!err) {
2740 		err = -EOPNOTSUPP;
2741 		if (pfkey_funcs[hdr->sadb_msg_type])
2742 			err = pfkey_funcs[hdr->sadb_msg_type](sk, skb, hdr, ext_hdrs);
2743 	}
2744 	return err;
2745 }
2746 
2747 static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp)
2748 {
2749 	struct sadb_msg *hdr = NULL;
2750 
2751 	if (skb->len < sizeof(*hdr)) {
2752 		*errp = -EMSGSIZE;
2753 	} else {
2754 		hdr = (struct sadb_msg *) skb->data;
2755 		if (hdr->sadb_msg_version != PF_KEY_V2 ||
2756 		    hdr->sadb_msg_reserved != 0 ||
2757 		    (hdr->sadb_msg_type <= SADB_RESERVED ||
2758 		     hdr->sadb_msg_type > SADB_MAX)) {
2759 			hdr = NULL;
2760 			*errp = -EINVAL;
2761 		} else if (hdr->sadb_msg_len != (skb->len /
2762 						 sizeof(uint64_t)) ||
2763 			   hdr->sadb_msg_len < (sizeof(struct sadb_msg) /
2764 						sizeof(uint64_t))) {
2765 			hdr = NULL;
2766 			*errp = -EMSGSIZE;
2767 		} else {
2768 			*errp = 0;
2769 		}
2770 	}
2771 	return hdr;
2772 }
2773 
2774 static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
2775 {
2776 	return t->aalgos & (1 << d->desc.sadb_alg_id);
2777 }
2778 
2779 static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
2780 {
2781 	return t->ealgos & (1 << d->desc.sadb_alg_id);
2782 }
2783 
2784 static int count_ah_combs(struct xfrm_tmpl *t)
2785 {
2786 	int i, sz = 0;
2787 
2788 	for (i = 0; ; i++) {
2789 		struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
2790 		if (!aalg)
2791 			break;
2792 		if (aalg_tmpl_set(t, aalg) && aalg->available)
2793 			sz += sizeof(struct sadb_comb);
2794 	}
2795 	return sz + sizeof(struct sadb_prop);
2796 }
2797 
2798 static int count_esp_combs(struct xfrm_tmpl *t)
2799 {
2800 	int i, k, sz = 0;
2801 
2802 	for (i = 0; ; i++) {
2803 		struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
2804 		if (!ealg)
2805 			break;
2806 
2807 		if (!(ealg_tmpl_set(t, ealg) && ealg->available))
2808 			continue;
2809 
2810 		for (k = 1; ; k++) {
2811 			struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k);
2812 			if (!aalg)
2813 				break;
2814 
2815 			if (aalg_tmpl_set(t, aalg) && aalg->available)
2816 				sz += sizeof(struct sadb_comb);
2817 		}
2818 	}
2819 	return sz + sizeof(struct sadb_prop);
2820 }
2821 
2822 static void dump_ah_combs(struct sk_buff *skb, struct xfrm_tmpl *t)
2823 {
2824 	struct sadb_prop *p;
2825 	int i;
2826 
2827 	p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop));
2828 	p->sadb_prop_len = sizeof(struct sadb_prop)/8;
2829 	p->sadb_prop_exttype = SADB_EXT_PROPOSAL;
2830 	p->sadb_prop_replay = 32;
2831 	memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved));
2832 
2833 	for (i = 0; ; i++) {
2834 		struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
2835 		if (!aalg)
2836 			break;
2837 
2838 		if (aalg_tmpl_set(t, aalg) && aalg->available) {
2839 			struct sadb_comb *c;
2840 			c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
2841 			memset(c, 0, sizeof(*c));
2842 			p->sadb_prop_len += sizeof(struct sadb_comb)/8;
2843 			c->sadb_comb_auth = aalg->desc.sadb_alg_id;
2844 			c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits;
2845 			c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits;
2846 			c->sadb_comb_hard_addtime = 24*60*60;
2847 			c->sadb_comb_soft_addtime = 20*60*60;
2848 			c->sadb_comb_hard_usetime = 8*60*60;
2849 			c->sadb_comb_soft_usetime = 7*60*60;
2850 		}
2851 	}
2852 }
2853 
2854 static void dump_esp_combs(struct sk_buff *skb, struct xfrm_tmpl *t)
2855 {
2856 	struct sadb_prop *p;
2857 	int i, k;
2858 
2859 	p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop));
2860 	p->sadb_prop_len = sizeof(struct sadb_prop)/8;
2861 	p->sadb_prop_exttype = SADB_EXT_PROPOSAL;
2862 	p->sadb_prop_replay = 32;
2863 	memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved));
2864 
2865 	for (i=0; ; i++) {
2866 		struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
2867 		if (!ealg)
2868 			break;
2869 
2870 		if (!(ealg_tmpl_set(t, ealg) && ealg->available))
2871 			continue;
2872 
2873 		for (k = 1; ; k++) {
2874 			struct sadb_comb *c;
2875 			struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k);
2876 			if (!aalg)
2877 				break;
2878 			if (!(aalg_tmpl_set(t, aalg) && aalg->available))
2879 				continue;
2880 			c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
2881 			memset(c, 0, sizeof(*c));
2882 			p->sadb_prop_len += sizeof(struct sadb_comb)/8;
2883 			c->sadb_comb_auth = aalg->desc.sadb_alg_id;
2884 			c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits;
2885 			c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits;
2886 			c->sadb_comb_encrypt = ealg->desc.sadb_alg_id;
2887 			c->sadb_comb_encrypt_minbits = ealg->desc.sadb_alg_minbits;
2888 			c->sadb_comb_encrypt_maxbits = ealg->desc.sadb_alg_maxbits;
2889 			c->sadb_comb_hard_addtime = 24*60*60;
2890 			c->sadb_comb_soft_addtime = 20*60*60;
2891 			c->sadb_comb_hard_usetime = 8*60*60;
2892 			c->sadb_comb_soft_usetime = 7*60*60;
2893 		}
2894 	}
2895 }
2896 
2897 static int key_notify_policy_expire(struct xfrm_policy *xp, struct km_event *c)
2898 {
2899 	return 0;
2900 }
2901 
2902 static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
2903 {
2904 	struct sk_buff *out_skb;
2905 	struct sadb_msg *out_hdr;
2906 	int hard;
2907 	int hsc;
2908 
2909 	hard = c->data.hard;
2910 	if (hard)
2911 		hsc = 2;
2912 	else
2913 		hsc = 1;
2914 
2915 	out_skb = pfkey_xfrm_state2msg(x, 0, hsc);
2916 	if (IS_ERR(out_skb))
2917 		return PTR_ERR(out_skb);
2918 
2919 	out_hdr = (struct sadb_msg *) out_skb->data;
2920 	out_hdr->sadb_msg_version = PF_KEY_V2;
2921 	out_hdr->sadb_msg_type = SADB_EXPIRE;
2922 	out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
2923 	out_hdr->sadb_msg_errno = 0;
2924 	out_hdr->sadb_msg_reserved = 0;
2925 	out_hdr->sadb_msg_seq = 0;
2926 	out_hdr->sadb_msg_pid = 0;
2927 
2928 	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
2929 	return 0;
2930 }
2931 
2932 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c)
2933 {
2934 	switch (c->event) {
2935 	case XFRM_MSG_EXPIRE:
2936 		return key_notify_sa_expire(x, c);
2937 	case XFRM_MSG_DELSA:
2938 	case XFRM_MSG_NEWSA:
2939 	case XFRM_MSG_UPDSA:
2940 		return key_notify_sa(x, c);
2941 	case XFRM_MSG_FLUSHSA:
2942 		return key_notify_sa_flush(c);
2943 	case XFRM_MSG_NEWAE: /* not yet supported */
2944 		break;
2945 	default:
2946 		printk("pfkey: Unknown SA event %d\n", c->event);
2947 		break;
2948 	}
2949 
2950 	return 0;
2951 }
2952 
2953 static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
2954 {
2955 	if (xp && xp->type != XFRM_POLICY_TYPE_MAIN)
2956 		return 0;
2957 
2958 	switch (c->event) {
2959 	case XFRM_MSG_POLEXPIRE:
2960 		return key_notify_policy_expire(xp, c);
2961 	case XFRM_MSG_DELPOLICY:
2962 	case XFRM_MSG_NEWPOLICY:
2963 	case XFRM_MSG_UPDPOLICY:
2964 		return key_notify_policy(xp, dir, c);
2965 	case XFRM_MSG_FLUSHPOLICY:
2966 		if (c->data.type != XFRM_POLICY_TYPE_MAIN)
2967 			break;
2968 		return key_notify_policy_flush(c);
2969 	default:
2970 		printk("pfkey: Unknown policy event %d\n", c->event);
2971 		break;
2972 	}
2973 
2974 	return 0;
2975 }
2976 
2977 static u32 get_acqseq(void)
2978 {
2979 	u32 res;
2980 	static u32 acqseq;
2981 	static DEFINE_SPINLOCK(acqseq_lock);
2982 
2983 	spin_lock_bh(&acqseq_lock);
2984 	res = (++acqseq ? : ++acqseq);
2985 	spin_unlock_bh(&acqseq_lock);
2986 	return res;
2987 }
2988 
2989 static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp, int dir)
2990 {
2991 	struct sk_buff *skb;
2992 	struct sadb_msg *hdr;
2993 	struct sadb_address *addr;
2994 	struct sadb_x_policy *pol;
2995 	struct sockaddr_in *sin;
2996 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2997 	struct sockaddr_in6 *sin6;
2998 #endif
2999 	int sockaddr_size;
3000 	int size;
3001 	struct sadb_x_sec_ctx *sec_ctx;
3002 	struct xfrm_sec_ctx *xfrm_ctx;
3003 	int ctx_size = 0;
3004 
3005 	sockaddr_size = pfkey_sockaddr_size(x->props.family);
3006 	if (!sockaddr_size)
3007 		return -EINVAL;
3008 
3009 	size = sizeof(struct sadb_msg) +
3010 		(sizeof(struct sadb_address) * 2) +
3011 		(sockaddr_size * 2) +
3012 		sizeof(struct sadb_x_policy);
3013 
3014 	if (x->id.proto == IPPROTO_AH)
3015 		size += count_ah_combs(t);
3016 	else if (x->id.proto == IPPROTO_ESP)
3017 		size += count_esp_combs(t);
3018 
3019 	if ((xfrm_ctx = x->security)) {
3020 		ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
3021 		size +=  sizeof(struct sadb_x_sec_ctx) + ctx_size;
3022 	}
3023 
3024 	skb =  alloc_skb(size + 16, GFP_ATOMIC);
3025 	if (skb == NULL)
3026 		return -ENOMEM;
3027 
3028 	hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
3029 	hdr->sadb_msg_version = PF_KEY_V2;
3030 	hdr->sadb_msg_type = SADB_ACQUIRE;
3031 	hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
3032 	hdr->sadb_msg_len = size / sizeof(uint64_t);
3033 	hdr->sadb_msg_errno = 0;
3034 	hdr->sadb_msg_reserved = 0;
3035 	hdr->sadb_msg_seq = x->km.seq = get_acqseq();
3036 	hdr->sadb_msg_pid = 0;
3037 
3038 	/* src address */
3039 	addr = (struct sadb_address*) skb_put(skb,
3040 					      sizeof(struct sadb_address)+sockaddr_size);
3041 	addr->sadb_address_len =
3042 		(sizeof(struct sadb_address)+sockaddr_size)/
3043 			sizeof(uint64_t);
3044 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
3045 	addr->sadb_address_proto = 0;
3046 	addr->sadb_address_reserved = 0;
3047 	if (x->props.family == AF_INET) {
3048 		addr->sadb_address_prefixlen = 32;
3049 
3050 		sin = (struct sockaddr_in *) (addr + 1);
3051 		sin->sin_family = AF_INET;
3052 		sin->sin_addr.s_addr = x->props.saddr.a4;
3053 		sin->sin_port = 0;
3054 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3055 	}
3056 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3057 	else if (x->props.family == AF_INET6) {
3058 		addr->sadb_address_prefixlen = 128;
3059 
3060 		sin6 = (struct sockaddr_in6 *) (addr + 1);
3061 		sin6->sin6_family = AF_INET6;
3062 		sin6->sin6_port = 0;
3063 		sin6->sin6_flowinfo = 0;
3064 		memcpy(&sin6->sin6_addr,
3065 		       x->props.saddr.a6, sizeof(struct in6_addr));
3066 		sin6->sin6_scope_id = 0;
3067 	}
3068 #endif
3069 	else
3070 		BUG();
3071 
3072 	/* dst address */
3073 	addr = (struct sadb_address*) skb_put(skb,
3074 					      sizeof(struct sadb_address)+sockaddr_size);
3075 	addr->sadb_address_len =
3076 		(sizeof(struct sadb_address)+sockaddr_size)/
3077 			sizeof(uint64_t);
3078 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
3079 	addr->sadb_address_proto = 0;
3080 	addr->sadb_address_reserved = 0;
3081 	if (x->props.family == AF_INET) {
3082 		addr->sadb_address_prefixlen = 32;
3083 
3084 		sin = (struct sockaddr_in *) (addr + 1);
3085 		sin->sin_family = AF_INET;
3086 		sin->sin_addr.s_addr = x->id.daddr.a4;
3087 		sin->sin_port = 0;
3088 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3089 	}
3090 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3091 	else if (x->props.family == AF_INET6) {
3092 		addr->sadb_address_prefixlen = 128;
3093 
3094 		sin6 = (struct sockaddr_in6 *) (addr + 1);
3095 		sin6->sin6_family = AF_INET6;
3096 		sin6->sin6_port = 0;
3097 		sin6->sin6_flowinfo = 0;
3098 		memcpy(&sin6->sin6_addr,
3099 		       x->id.daddr.a6, sizeof(struct in6_addr));
3100 		sin6->sin6_scope_id = 0;
3101 	}
3102 #endif
3103 	else
3104 		BUG();
3105 
3106 	pol = (struct sadb_x_policy *)  skb_put(skb, sizeof(struct sadb_x_policy));
3107 	pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t);
3108 	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
3109 	pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
3110 	pol->sadb_x_policy_dir = dir+1;
3111 	pol->sadb_x_policy_id = xp->index;
3112 
3113 	/* Set sadb_comb's. */
3114 	if (x->id.proto == IPPROTO_AH)
3115 		dump_ah_combs(skb, t);
3116 	else if (x->id.proto == IPPROTO_ESP)
3117 		dump_esp_combs(skb, t);
3118 
3119 	/* security context */
3120 	if (xfrm_ctx) {
3121 		sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
3122 				sizeof(struct sadb_x_sec_ctx) + ctx_size);
3123 		sec_ctx->sadb_x_sec_len =
3124 		  (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
3125 		sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
3126 		sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
3127 		sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
3128 		sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
3129 		memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
3130 		       xfrm_ctx->ctx_len);
3131 	}
3132 
3133 	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
3134 }
3135 
3136 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
3137 						u8 *data, int len, int *dir)
3138 {
3139 	struct xfrm_policy *xp;
3140 	struct sadb_x_policy *pol = (struct sadb_x_policy*)data;
3141 	struct sadb_x_sec_ctx *sec_ctx;
3142 
3143 	switch (sk->sk_family) {
3144 	case AF_INET:
3145 		if (opt != IP_IPSEC_POLICY) {
3146 			*dir = -EOPNOTSUPP;
3147 			return NULL;
3148 		}
3149 		break;
3150 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3151 	case AF_INET6:
3152 		if (opt != IPV6_IPSEC_POLICY) {
3153 			*dir = -EOPNOTSUPP;
3154 			return NULL;
3155 		}
3156 		break;
3157 #endif
3158 	default:
3159 		*dir = -EINVAL;
3160 		return NULL;
3161 	}
3162 
3163 	*dir = -EINVAL;
3164 
3165 	if (len < sizeof(struct sadb_x_policy) ||
3166 	    pol->sadb_x_policy_len*8 > len ||
3167 	    pol->sadb_x_policy_type > IPSEC_POLICY_BYPASS ||
3168 	    (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir > IPSEC_DIR_OUTBOUND))
3169 		return NULL;
3170 
3171 	xp = xfrm_policy_alloc(GFP_ATOMIC);
3172 	if (xp == NULL) {
3173 		*dir = -ENOBUFS;
3174 		return NULL;
3175 	}
3176 
3177 	xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ?
3178 		      XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);
3179 
3180 	xp->lft.soft_byte_limit = XFRM_INF;
3181 	xp->lft.hard_byte_limit = XFRM_INF;
3182 	xp->lft.soft_packet_limit = XFRM_INF;
3183 	xp->lft.hard_packet_limit = XFRM_INF;
3184 	xp->family = sk->sk_family;
3185 
3186 	xp->xfrm_nr = 0;
3187 	if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
3188 	    (*dir = parse_ipsecrequests(xp, pol)) < 0)
3189 		goto out;
3190 
3191 	/* security context too */
3192 	if (len >= (pol->sadb_x_policy_len*8 +
3193 	    sizeof(struct sadb_x_sec_ctx))) {
3194 		char *p = (char *)pol;
3195 		struct xfrm_user_sec_ctx *uctx;
3196 
3197 		p += pol->sadb_x_policy_len*8;
3198 		sec_ctx = (struct sadb_x_sec_ctx *)p;
3199 		if (len < pol->sadb_x_policy_len*8 +
3200 		    sec_ctx->sadb_x_sec_len) {
3201 			*dir = -EINVAL;
3202 			goto out;
3203 		}
3204 		if ((*dir = verify_sec_ctx_len(p)))
3205 			goto out;
3206 		uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
3207 		*dir = security_xfrm_policy_alloc(xp, uctx);
3208 		kfree(uctx);
3209 
3210 		if (*dir)
3211 			goto out;
3212 	}
3213 
3214 	*dir = pol->sadb_x_policy_dir-1;
3215 	return xp;
3216 
3217 out:
3218 	security_xfrm_policy_free(xp);
3219 	kfree(xp);
3220 	return NULL;
3221 }
3222 
3223 static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
3224 {
3225 	struct sk_buff *skb;
3226 	struct sadb_msg *hdr;
3227 	struct sadb_sa *sa;
3228 	struct sadb_address *addr;
3229 	struct sadb_x_nat_t_port *n_port;
3230 	struct sockaddr_in *sin;
3231 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3232 	struct sockaddr_in6 *sin6;
3233 #endif
3234 	int sockaddr_size;
3235 	int size;
3236 	__u8 satype = (x->id.proto == IPPROTO_ESP ? SADB_SATYPE_ESP : 0);
3237 	struct xfrm_encap_tmpl *natt = NULL;
3238 
3239 	sockaddr_size = pfkey_sockaddr_size(x->props.family);
3240 	if (!sockaddr_size)
3241 		return -EINVAL;
3242 
3243 	if (!satype)
3244 		return -EINVAL;
3245 
3246 	if (!x->encap)
3247 		return -EINVAL;
3248 
3249 	natt = x->encap;
3250 
3251 	/* Build an SADB_X_NAT_T_NEW_MAPPING message:
3252 	 *
3253 	 * HDR | SA | ADDRESS_SRC (old addr) | NAT_T_SPORT (old port) |
3254 	 * ADDRESS_DST (new addr) | NAT_T_DPORT (new port)
3255 	 */
3256 
3257 	size = sizeof(struct sadb_msg) +
3258 		sizeof(struct sadb_sa) +
3259 		(sizeof(struct sadb_address) * 2) +
3260 		(sockaddr_size * 2) +
3261 		(sizeof(struct sadb_x_nat_t_port) * 2);
3262 
3263 	skb =  alloc_skb(size + 16, GFP_ATOMIC);
3264 	if (skb == NULL)
3265 		return -ENOMEM;
3266 
3267 	hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
3268 	hdr->sadb_msg_version = PF_KEY_V2;
3269 	hdr->sadb_msg_type = SADB_X_NAT_T_NEW_MAPPING;
3270 	hdr->sadb_msg_satype = satype;
3271 	hdr->sadb_msg_len = size / sizeof(uint64_t);
3272 	hdr->sadb_msg_errno = 0;
3273 	hdr->sadb_msg_reserved = 0;
3274 	hdr->sadb_msg_seq = x->km.seq = get_acqseq();
3275 	hdr->sadb_msg_pid = 0;
3276 
3277 	/* SA */
3278 	sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa));
3279 	sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t);
3280 	sa->sadb_sa_exttype = SADB_EXT_SA;
3281 	sa->sadb_sa_spi = x->id.spi;
3282 	sa->sadb_sa_replay = 0;
3283 	sa->sadb_sa_state = 0;
3284 	sa->sadb_sa_auth = 0;
3285 	sa->sadb_sa_encrypt = 0;
3286 	sa->sadb_sa_flags = 0;
3287 
3288 	/* ADDRESS_SRC (old addr) */
3289 	addr = (struct sadb_address*)
3290 		skb_put(skb, sizeof(struct sadb_address)+sockaddr_size);
3291 	addr->sadb_address_len =
3292 		(sizeof(struct sadb_address)+sockaddr_size)/
3293 			sizeof(uint64_t);
3294 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
3295 	addr->sadb_address_proto = 0;
3296 	addr->sadb_address_reserved = 0;
3297 	if (x->props.family == AF_INET) {
3298 		addr->sadb_address_prefixlen = 32;
3299 
3300 		sin = (struct sockaddr_in *) (addr + 1);
3301 		sin->sin_family = AF_INET;
3302 		sin->sin_addr.s_addr = x->props.saddr.a4;
3303 		sin->sin_port = 0;
3304 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3305 	}
3306 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3307 	else if (x->props.family == AF_INET6) {
3308 		addr->sadb_address_prefixlen = 128;
3309 
3310 		sin6 = (struct sockaddr_in6 *) (addr + 1);
3311 		sin6->sin6_family = AF_INET6;
3312 		sin6->sin6_port = 0;
3313 		sin6->sin6_flowinfo = 0;
3314 		memcpy(&sin6->sin6_addr,
3315 		       x->props.saddr.a6, sizeof(struct in6_addr));
3316 		sin6->sin6_scope_id = 0;
3317 	}
3318 #endif
3319 	else
3320 		BUG();
3321 
3322 	/* NAT_T_SPORT (old port) */
3323 	n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
3324 	n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
3325 	n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
3326 	n_port->sadb_x_nat_t_port_port = natt->encap_sport;
3327 	n_port->sadb_x_nat_t_port_reserved = 0;
3328 
3329 	/* ADDRESS_DST (new addr) */
3330 	addr = (struct sadb_address*)
3331 		skb_put(skb, sizeof(struct sadb_address)+sockaddr_size);
3332 	addr->sadb_address_len =
3333 		(sizeof(struct sadb_address)+sockaddr_size)/
3334 			sizeof(uint64_t);
3335 	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
3336 	addr->sadb_address_proto = 0;
3337 	addr->sadb_address_reserved = 0;
3338 	if (x->props.family == AF_INET) {
3339 		addr->sadb_address_prefixlen = 32;
3340 
3341 		sin = (struct sockaddr_in *) (addr + 1);
3342 		sin->sin_family = AF_INET;
3343 		sin->sin_addr.s_addr = ipaddr->a4;
3344 		sin->sin_port = 0;
3345 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3346 	}
3347 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3348 	else if (x->props.family == AF_INET6) {
3349 		addr->sadb_address_prefixlen = 128;
3350 
3351 		sin6 = (struct sockaddr_in6 *) (addr + 1);
3352 		sin6->sin6_family = AF_INET6;
3353 		sin6->sin6_port = 0;
3354 		sin6->sin6_flowinfo = 0;
3355 		memcpy(&sin6->sin6_addr, &ipaddr->a6, sizeof(struct in6_addr));
3356 		sin6->sin6_scope_id = 0;
3357 	}
3358 #endif
3359 	else
3360 		BUG();
3361 
3362 	/* NAT_T_DPORT (new port) */
3363 	n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
3364 	n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
3365 	n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
3366 	n_port->sadb_x_nat_t_port_port = sport;
3367 	n_port->sadb_x_nat_t_port_reserved = 0;
3368 
3369 	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
3370 }
3371 
3372 #ifdef CONFIG_NET_KEY_MIGRATE
3373 static int set_sadb_address(struct sk_buff *skb, int sasize, int type,
3374 			    struct xfrm_selector *sel)
3375 {
3376 	struct sadb_address *addr;
3377 	struct sockaddr_in *sin;
3378 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3379 	struct sockaddr_in6 *sin6;
3380 #endif
3381 	addr = (struct sadb_address *)skb_put(skb, sizeof(struct sadb_address) + sasize);
3382 	addr->sadb_address_len = (sizeof(struct sadb_address) + sasize)/8;
3383 	addr->sadb_address_exttype = type;
3384 	addr->sadb_address_proto = sel->proto;
3385 	addr->sadb_address_reserved = 0;
3386 
3387 	switch (type) {
3388 	case SADB_EXT_ADDRESS_SRC:
3389 		if (sel->family == AF_INET) {
3390 			addr->sadb_address_prefixlen = sel->prefixlen_s;
3391 			sin = (struct sockaddr_in *)(addr + 1);
3392 			sin->sin_family = AF_INET;
3393 			memcpy(&sin->sin_addr.s_addr, &sel->saddr,
3394 			       sizeof(sin->sin_addr.s_addr));
3395 			sin->sin_port = 0;
3396 			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3397 		}
3398 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3399 		else if (sel->family == AF_INET6) {
3400 			addr->sadb_address_prefixlen = sel->prefixlen_s;
3401 			sin6 = (struct sockaddr_in6 *)(addr + 1);
3402 			sin6->sin6_family = AF_INET6;
3403 			sin6->sin6_port = 0;
3404 			sin6->sin6_flowinfo = 0;
3405 			sin6->sin6_scope_id = 0;
3406 			memcpy(&sin6->sin6_addr.s6_addr, &sel->saddr,
3407 			       sizeof(sin6->sin6_addr.s6_addr));
3408 		}
3409 #endif
3410 		break;
3411 	case SADB_EXT_ADDRESS_DST:
3412 		if (sel->family == AF_INET) {
3413 			addr->sadb_address_prefixlen = sel->prefixlen_d;
3414 			sin = (struct sockaddr_in *)(addr + 1);
3415 			sin->sin_family = AF_INET;
3416 			memcpy(&sin->sin_addr.s_addr, &sel->daddr,
3417 			       sizeof(sin->sin_addr.s_addr));
3418 			sin->sin_port = 0;
3419 			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3420 		}
3421 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3422 		else if (sel->family == AF_INET6) {
3423 			addr->sadb_address_prefixlen = sel->prefixlen_d;
3424 			sin6 = (struct sockaddr_in6 *)(addr + 1);
3425 			sin6->sin6_family = AF_INET6;
3426 			sin6->sin6_port = 0;
3427 			sin6->sin6_flowinfo = 0;
3428 			sin6->sin6_scope_id = 0;
3429 			memcpy(&sin6->sin6_addr.s6_addr, &sel->daddr,
3430 			       sizeof(sin6->sin6_addr.s6_addr));
3431 		}
3432 #endif
3433 		break;
3434 	default:
3435 		return -EINVAL;
3436 	}
3437 
3438 	return 0;
3439 }
3440 
3441 static int set_ipsecrequest(struct sk_buff *skb,
3442 			    uint8_t proto, uint8_t mode, int level,
3443 			    uint32_t reqid, uint8_t family,
3444 			    xfrm_address_t *src, xfrm_address_t *dst)
3445 {
3446 	struct sadb_x_ipsecrequest *rq;
3447 	struct sockaddr_in *sin;
3448 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3449 	struct sockaddr_in6 *sin6;
3450 #endif
3451 	int size_req;
3452 
3453 	size_req = sizeof(struct sadb_x_ipsecrequest) +
3454 		   pfkey_sockaddr_pair_size(family);
3455 
3456 	rq = (struct sadb_x_ipsecrequest *)skb_put(skb, size_req);
3457 	memset(rq, 0, size_req);
3458 	rq->sadb_x_ipsecrequest_len = size_req;
3459 	rq->sadb_x_ipsecrequest_proto = proto;
3460 	rq->sadb_x_ipsecrequest_mode = mode;
3461 	rq->sadb_x_ipsecrequest_level = level;
3462 	rq->sadb_x_ipsecrequest_reqid = reqid;
3463 
3464 	switch (family) {
3465 	case AF_INET:
3466 		sin = (struct sockaddr_in *)(rq + 1);
3467 		sin->sin_family = AF_INET;
3468 		memcpy(&sin->sin_addr.s_addr, src,
3469 		       sizeof(sin->sin_addr.s_addr));
3470 		sin++;
3471 		sin->sin_family = AF_INET;
3472 		memcpy(&sin->sin_addr.s_addr, dst,
3473 		       sizeof(sin->sin_addr.s_addr));
3474 		break;
3475 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3476 	case AF_INET6:
3477 		sin6 = (struct sockaddr_in6 *)(rq + 1);
3478 		sin6->sin6_family = AF_INET6;
3479 		sin6->sin6_port = 0;
3480 		sin6->sin6_flowinfo = 0;
3481 		sin6->sin6_scope_id = 0;
3482 		memcpy(&sin6->sin6_addr.s6_addr, src,
3483 		       sizeof(sin6->sin6_addr.s6_addr));
3484 		sin6++;
3485 		sin6->sin6_family = AF_INET6;
3486 		sin6->sin6_port = 0;
3487 		sin6->sin6_flowinfo = 0;
3488 		sin6->sin6_scope_id = 0;
3489 		memcpy(&sin6->sin6_addr.s6_addr, dst,
3490 		       sizeof(sin6->sin6_addr.s6_addr));
3491 		break;
3492 #endif
3493 	default:
3494 		return -EINVAL;
3495 	}
3496 
3497 	return 0;
3498 }
3499 #endif
3500 
3501 #ifdef CONFIG_NET_KEY_MIGRATE
3502 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
3503 			      struct xfrm_migrate *m, int num_bundles)
3504 {
3505 	int i;
3506 	int sasize_sel;
3507 	int size = 0;
3508 	int size_pol = 0;
3509 	struct sk_buff *skb;
3510 	struct sadb_msg *hdr;
3511 	struct sadb_x_policy *pol;
3512 	struct xfrm_migrate *mp;
3513 
3514 	if (type != XFRM_POLICY_TYPE_MAIN)
3515 		return 0;
3516 
3517 	if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH)
3518 		return -EINVAL;
3519 
3520 	/* selector */
3521 	sasize_sel = pfkey_sockaddr_size(sel->family);
3522 	if (!sasize_sel)
3523 		return -EINVAL;
3524 	size += (sizeof(struct sadb_address) + sasize_sel) * 2;
3525 
3526 	/* policy info */
3527 	size_pol += sizeof(struct sadb_x_policy);
3528 
3529 	/* ipsecrequests */
3530 	for (i = 0, mp = m; i < num_bundles; i++, mp++) {
3531 		/* old locator pair */
3532 		size_pol += sizeof(struct sadb_x_ipsecrequest) +
3533 			    pfkey_sockaddr_pair_size(mp->old_family);
3534 		/* new locator pair */
3535 		size_pol += sizeof(struct sadb_x_ipsecrequest) +
3536 			    pfkey_sockaddr_pair_size(mp->new_family);
3537 	}
3538 
3539 	size += sizeof(struct sadb_msg) + size_pol;
3540 
3541 	/* alloc buffer */
3542 	skb = alloc_skb(size, GFP_ATOMIC);
3543 	if (skb == NULL)
3544 		return -ENOMEM;
3545 
3546 	hdr = (struct sadb_msg *)skb_put(skb, sizeof(struct sadb_msg));
3547 	hdr->sadb_msg_version = PF_KEY_V2;
3548 	hdr->sadb_msg_type = SADB_X_MIGRATE;
3549 	hdr->sadb_msg_satype = pfkey_proto2satype(m->proto);
3550 	hdr->sadb_msg_len = size / 8;
3551 	hdr->sadb_msg_errno = 0;
3552 	hdr->sadb_msg_reserved = 0;
3553 	hdr->sadb_msg_seq = 0;
3554 	hdr->sadb_msg_pid = 0;
3555 
3556 	/* selector src */
3557 	set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel);
3558 
3559 	/* selector dst */
3560 	set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_DST, sel);
3561 
3562 	/* policy information */
3563 	pol = (struct sadb_x_policy *)skb_put(skb, sizeof(struct sadb_x_policy));
3564 	pol->sadb_x_policy_len = size_pol / 8;
3565 	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
3566 	pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
3567 	pol->sadb_x_policy_dir = dir + 1;
3568 	pol->sadb_x_policy_id = 0;
3569 	pol->sadb_x_policy_priority = 0;
3570 
3571 	for (i = 0, mp = m; i < num_bundles; i++, mp++) {
3572 		/* old ipsecrequest */
3573 		int mode = pfkey_mode_from_xfrm(mp->mode);
3574 		if (mode < 0)
3575 			return -EINVAL;
3576 		if (set_ipsecrequest(skb, mp->proto, mode,
3577 				     (mp->reqid ?  IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
3578 				     mp->reqid, mp->old_family,
3579 				     &mp->old_saddr, &mp->old_daddr) < 0) {
3580 			return -EINVAL;
3581 		}
3582 
3583 		/* new ipsecrequest */
3584 		if (set_ipsecrequest(skb, mp->proto, mode,
3585 				     (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
3586 				     mp->reqid, mp->new_family,
3587 				     &mp->new_saddr, &mp->new_daddr) < 0) {
3588 			return -EINVAL;
3589 		}
3590 	}
3591 
3592 	/* broadcast migrate message to sockets */
3593 	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
3594 
3595 	return 0;
3596 }
3597 #else
3598 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
3599 			      struct xfrm_migrate *m, int num_bundles)
3600 {
3601 	return -ENOPROTOOPT;
3602 }
3603 #endif
3604 
3605 static int pfkey_sendmsg(struct kiocb *kiocb,
3606 			 struct socket *sock, struct msghdr *msg, size_t len)
3607 {
3608 	struct sock *sk = sock->sk;
3609 	struct sk_buff *skb = NULL;
3610 	struct sadb_msg *hdr = NULL;
3611 	int err;
3612 
3613 	err = -EOPNOTSUPP;
3614 	if (msg->msg_flags & MSG_OOB)
3615 		goto out;
3616 
3617 	err = -EMSGSIZE;
3618 	if ((unsigned)len > sk->sk_sndbuf - 32)
3619 		goto out;
3620 
3621 	err = -ENOBUFS;
3622 	skb = alloc_skb(len, GFP_KERNEL);
3623 	if (skb == NULL)
3624 		goto out;
3625 
3626 	err = -EFAULT;
3627 	if (memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len))
3628 		goto out;
3629 
3630 	hdr = pfkey_get_base_msg(skb, &err);
3631 	if (!hdr)
3632 		goto out;
3633 
3634 	mutex_lock(&xfrm_cfg_mutex);
3635 	err = pfkey_process(sk, skb, hdr);
3636 	mutex_unlock(&xfrm_cfg_mutex);
3637 
3638 out:
3639 	if (err && hdr && pfkey_error(hdr, err, sk) == 0)
3640 		err = 0;
3641 	if (skb)
3642 		kfree_skb(skb);
3643 
3644 	return err ? : len;
3645 }
3646 
3647 static int pfkey_recvmsg(struct kiocb *kiocb,
3648 			 struct socket *sock, struct msghdr *msg, size_t len,
3649 			 int flags)
3650 {
3651 	struct sock *sk = sock->sk;
3652 	struct sk_buff *skb;
3653 	int copied, err;
3654 
3655 	err = -EINVAL;
3656 	if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
3657 		goto out;
3658 
3659 	msg->msg_namelen = 0;
3660 	skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
3661 	if (skb == NULL)
3662 		goto out;
3663 
3664 	copied = skb->len;
3665 	if (copied > len) {
3666 		msg->msg_flags |= MSG_TRUNC;
3667 		copied = len;
3668 	}
3669 
3670 	skb_reset_transport_header(skb);
3671 	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
3672 	if (err)
3673 		goto out_free;
3674 
3675 	sock_recv_timestamp(msg, sk, skb);
3676 
3677 	err = (flags & MSG_TRUNC) ? skb->len : copied;
3678 
3679 out_free:
3680 	skb_free_datagram(sk, skb);
3681 out:
3682 	return err;
3683 }
3684 
3685 static const struct proto_ops pfkey_ops = {
3686 	.family		=	PF_KEY,
3687 	.owner		=	THIS_MODULE,
3688 	/* Operations that make no sense on pfkey sockets. */
3689 	.bind		=	sock_no_bind,
3690 	.connect	=	sock_no_connect,
3691 	.socketpair	=	sock_no_socketpair,
3692 	.accept		=	sock_no_accept,
3693 	.getname	=	sock_no_getname,
3694 	.ioctl		=	sock_no_ioctl,
3695 	.listen		=	sock_no_listen,
3696 	.shutdown	=	sock_no_shutdown,
3697 	.setsockopt	=	sock_no_setsockopt,
3698 	.getsockopt	=	sock_no_getsockopt,
3699 	.mmap		=	sock_no_mmap,
3700 	.sendpage	=	sock_no_sendpage,
3701 
3702 	/* Now the operations that really occur. */
3703 	.release	=	pfkey_release,
3704 	.poll		=	datagram_poll,
3705 	.sendmsg	=	pfkey_sendmsg,
3706 	.recvmsg	=	pfkey_recvmsg,
3707 };
3708 
3709 static struct net_proto_family pfkey_family_ops = {
3710 	.family	=	PF_KEY,
3711 	.create	=	pfkey_create,
3712 	.owner	=	THIS_MODULE,
3713 };
3714 
3715 #ifdef CONFIG_PROC_FS
3716 static int pfkey_read_proc(char *buffer, char **start, off_t offset,
3717 			   int length, int *eof, void *data)
3718 {
3719 	off_t pos = 0;
3720 	off_t begin = 0;
3721 	int len = 0;
3722 	struct sock *s;
3723 	struct hlist_node *node;
3724 
3725 	len += sprintf(buffer,"sk       RefCnt Rmem   Wmem   User   Inode\n");
3726 
3727 	read_lock(&pfkey_table_lock);
3728 
3729 	sk_for_each(s, node, &pfkey_table) {
3730 		len += sprintf(buffer+len,"%p %-6d %-6u %-6u %-6u %-6lu",
3731 			       s,
3732 			       atomic_read(&s->sk_refcnt),
3733 			       atomic_read(&s->sk_rmem_alloc),
3734 			       atomic_read(&s->sk_wmem_alloc),
3735 			       sock_i_uid(s),
3736 			       sock_i_ino(s)
3737 			       );
3738 
3739 		buffer[len++] = '\n';
3740 
3741 		pos = begin + len;
3742 		if (pos < offset) {
3743 			len = 0;
3744 			begin = pos;
3745 		}
3746 		if(pos > offset + length)
3747 			goto done;
3748 	}
3749 	*eof = 1;
3750 
3751 done:
3752 	read_unlock(&pfkey_table_lock);
3753 
3754 	*start = buffer + (offset - begin);
3755 	len -= (offset - begin);
3756 
3757 	if (len > length)
3758 		len = length;
3759 	if (len < 0)
3760 		len = 0;
3761 
3762 	return len;
3763 }
3764 #endif
3765 
3766 static struct xfrm_mgr pfkeyv2_mgr =
3767 {
3768 	.id		= "pfkeyv2",
3769 	.notify		= pfkey_send_notify,
3770 	.acquire	= pfkey_send_acquire,
3771 	.compile_policy	= pfkey_compile_policy,
3772 	.new_mapping	= pfkey_send_new_mapping,
3773 	.notify_policy	= pfkey_send_policy_notify,
3774 	.migrate	= pfkey_send_migrate,
3775 };
3776 
3777 static void __exit ipsec_pfkey_exit(void)
3778 {
3779 	xfrm_unregister_km(&pfkeyv2_mgr);
3780 	remove_proc_entry("net/pfkey", NULL);
3781 	sock_unregister(PF_KEY);
3782 	proto_unregister(&key_proto);
3783 }
3784 
3785 static int __init ipsec_pfkey_init(void)
3786 {
3787 	int err = proto_register(&key_proto, 0);
3788 
3789 	if (err != 0)
3790 		goto out;
3791 
3792 	err = sock_register(&pfkey_family_ops);
3793 	if (err != 0)
3794 		goto out_unregister_key_proto;
3795 #ifdef CONFIG_PROC_FS
3796 	err = -ENOMEM;
3797 	if (create_proc_read_entry("net/pfkey", 0, NULL, pfkey_read_proc, NULL) == NULL)
3798 		goto out_sock_unregister;
3799 #endif
3800 	err = xfrm_register_km(&pfkeyv2_mgr);
3801 	if (err != 0)
3802 		goto out_remove_proc_entry;
3803 out:
3804 	return err;
3805 out_remove_proc_entry:
3806 #ifdef CONFIG_PROC_FS
3807 	remove_proc_entry("net/pfkey", NULL);
3808 out_sock_unregister:
3809 #endif
3810 	sock_unregister(PF_KEY);
3811 out_unregister_key_proto:
3812 	proto_unregister(&key_proto);
3813 	goto out;
3814 }
3815 
3816 module_init(ipsec_pfkey_init);
3817 module_exit(ipsec_pfkey_exit);
3818 MODULE_LICENSE("GPL");
3819 MODULE_ALIAS_NETPROTO(PF_KEY);
3820