1 /* 2 * net/key/af_key.c An implementation of PF_KEYv2 sockets. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Maxim Giryaev <gem@asplinux.ru> 10 * David S. Miller <davem@redhat.com> 11 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 12 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 13 * Kazunori MIYAZAWA / USAGI Project <miyazawa@linux-ipv6.org> 14 * Derek Atkins <derek@ihtfp.com> 15 */ 16 17 #include <linux/capability.h> 18 #include <linux/module.h> 19 #include <linux/kernel.h> 20 #include <linux/socket.h> 21 #include <linux/pfkeyv2.h> 22 #include <linux/ipsec.h> 23 #include <linux/skbuff.h> 24 #include <linux/rtnetlink.h> 25 #include <linux/in.h> 26 #include <linux/in6.h> 27 #include <linux/proc_fs.h> 28 #include <linux/init.h> 29 #include <net/xfrm.h> 30 #include <linux/audit.h> 31 32 #include <net/sock.h> 33 34 #define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x)) 35 #define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x)) 36 37 38 /* List of all pfkey sockets. */ 39 static HLIST_HEAD(pfkey_table); 40 static DECLARE_WAIT_QUEUE_HEAD(pfkey_table_wait); 41 static DEFINE_RWLOCK(pfkey_table_lock); 42 static atomic_t pfkey_table_users = ATOMIC_INIT(0); 43 44 static atomic_t pfkey_socks_nr = ATOMIC_INIT(0); 45 46 struct pfkey_sock { 47 /* struct sock must be the first member of struct pfkey_sock */ 48 struct sock sk; 49 int registered; 50 int promisc; 51 }; 52 53 static inline struct pfkey_sock *pfkey_sk(struct sock *sk) 54 { 55 return (struct pfkey_sock *)sk; 56 } 57 58 static void pfkey_sock_destruct(struct sock *sk) 59 { 60 skb_queue_purge(&sk->sk_receive_queue); 61 62 if (!sock_flag(sk, SOCK_DEAD)) { 63 printk("Attempt to release alive pfkey socket: %p\n", sk); 64 return; 65 } 66 67 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc)); 68 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc)); 69 70 atomic_dec(&pfkey_socks_nr); 71 } 72 73 static void pfkey_table_grab(void) 74 { 75 write_lock_bh(&pfkey_table_lock); 76 77 if (atomic_read(&pfkey_table_users)) { 78 DECLARE_WAITQUEUE(wait, current); 79 80 add_wait_queue_exclusive(&pfkey_table_wait, &wait); 81 for(;;) { 82 set_current_state(TASK_UNINTERRUPTIBLE); 83 if (atomic_read(&pfkey_table_users) == 0) 84 break; 85 write_unlock_bh(&pfkey_table_lock); 86 schedule(); 87 write_lock_bh(&pfkey_table_lock); 88 } 89 90 __set_current_state(TASK_RUNNING); 91 remove_wait_queue(&pfkey_table_wait, &wait); 92 } 93 } 94 95 static __inline__ void pfkey_table_ungrab(void) 96 { 97 write_unlock_bh(&pfkey_table_lock); 98 wake_up(&pfkey_table_wait); 99 } 100 101 static __inline__ void pfkey_lock_table(void) 102 { 103 /* read_lock() synchronizes us to pfkey_table_grab */ 104 105 read_lock(&pfkey_table_lock); 106 atomic_inc(&pfkey_table_users); 107 read_unlock(&pfkey_table_lock); 108 } 109 110 static __inline__ void pfkey_unlock_table(void) 111 { 112 if (atomic_dec_and_test(&pfkey_table_users)) 113 wake_up(&pfkey_table_wait); 114 } 115 116 117 static const struct proto_ops pfkey_ops; 118 119 static void pfkey_insert(struct sock *sk) 120 { 121 pfkey_table_grab(); 122 sk_add_node(sk, &pfkey_table); 123 pfkey_table_ungrab(); 124 } 125 126 static void pfkey_remove(struct sock *sk) 127 { 128 pfkey_table_grab(); 129 sk_del_node_init(sk); 130 pfkey_table_ungrab(); 131 } 132 133 static struct proto key_proto = { 134 .name = "KEY", 135 .owner = THIS_MODULE, 136 .obj_size = sizeof(struct pfkey_sock), 137 }; 138 139 static int pfkey_create(struct socket *sock, int protocol) 140 { 141 struct sock *sk; 142 int err; 143 144 if (!capable(CAP_NET_ADMIN)) 145 return -EPERM; 146 if (sock->type != SOCK_RAW) 147 return -ESOCKTNOSUPPORT; 148 if (protocol != PF_KEY_V2) 149 return -EPROTONOSUPPORT; 150 151 err = -ENOMEM; 152 sk = sk_alloc(PF_KEY, GFP_KERNEL, &key_proto, 1); 153 if (sk == NULL) 154 goto out; 155 156 sock->ops = &pfkey_ops; 157 sock_init_data(sock, sk); 158 159 sk->sk_family = PF_KEY; 160 sk->sk_destruct = pfkey_sock_destruct; 161 162 atomic_inc(&pfkey_socks_nr); 163 164 pfkey_insert(sk); 165 166 return 0; 167 out: 168 return err; 169 } 170 171 static int pfkey_release(struct socket *sock) 172 { 173 struct sock *sk = sock->sk; 174 175 if (!sk) 176 return 0; 177 178 pfkey_remove(sk); 179 180 sock_orphan(sk); 181 sock->sk = NULL; 182 skb_queue_purge(&sk->sk_write_queue); 183 sock_put(sk); 184 185 return 0; 186 } 187 188 static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, 189 gfp_t allocation, struct sock *sk) 190 { 191 int err = -ENOBUFS; 192 193 sock_hold(sk); 194 if (*skb2 == NULL) { 195 if (atomic_read(&skb->users) != 1) { 196 *skb2 = skb_clone(skb, allocation); 197 } else { 198 *skb2 = skb; 199 atomic_inc(&skb->users); 200 } 201 } 202 if (*skb2 != NULL) { 203 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) { 204 skb_orphan(*skb2); 205 skb_set_owner_r(*skb2, sk); 206 skb_queue_tail(&sk->sk_receive_queue, *skb2); 207 sk->sk_data_ready(sk, (*skb2)->len); 208 *skb2 = NULL; 209 err = 0; 210 } 211 } 212 sock_put(sk); 213 return err; 214 } 215 216 /* Send SKB to all pfkey sockets matching selected criteria. */ 217 #define BROADCAST_ALL 0 218 #define BROADCAST_ONE 1 219 #define BROADCAST_REGISTERED 2 220 #define BROADCAST_PROMISC_ONLY 4 221 static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, 222 int broadcast_flags, struct sock *one_sk) 223 { 224 struct sock *sk; 225 struct hlist_node *node; 226 struct sk_buff *skb2 = NULL; 227 int err = -ESRCH; 228 229 /* XXX Do we need something like netlink_overrun? I think 230 * XXX PF_KEY socket apps will not mind current behavior. 231 */ 232 if (!skb) 233 return -ENOMEM; 234 235 pfkey_lock_table(); 236 sk_for_each(sk, node, &pfkey_table) { 237 struct pfkey_sock *pfk = pfkey_sk(sk); 238 int err2; 239 240 /* Yes, it means that if you are meant to receive this 241 * pfkey message you receive it twice as promiscuous 242 * socket. 243 */ 244 if (pfk->promisc) 245 pfkey_broadcast_one(skb, &skb2, allocation, sk); 246 247 /* the exact target will be processed later */ 248 if (sk == one_sk) 249 continue; 250 if (broadcast_flags != BROADCAST_ALL) { 251 if (broadcast_flags & BROADCAST_PROMISC_ONLY) 252 continue; 253 if ((broadcast_flags & BROADCAST_REGISTERED) && 254 !pfk->registered) 255 continue; 256 if (broadcast_flags & BROADCAST_ONE) 257 continue; 258 } 259 260 err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk); 261 262 /* Error is cleare after succecful sending to at least one 263 * registered KM */ 264 if ((broadcast_flags & BROADCAST_REGISTERED) && err) 265 err = err2; 266 } 267 pfkey_unlock_table(); 268 269 if (one_sk != NULL) 270 err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk); 271 272 if (skb2) 273 kfree_skb(skb2); 274 kfree_skb(skb); 275 return err; 276 } 277 278 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig) 279 { 280 *new = *orig; 281 } 282 283 static int pfkey_error(struct sadb_msg *orig, int err, struct sock *sk) 284 { 285 struct sk_buff *skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_KERNEL); 286 struct sadb_msg *hdr; 287 288 if (!skb) 289 return -ENOBUFS; 290 291 /* Woe be to the platform trying to support PFKEY yet 292 * having normal errnos outside the 1-255 range, inclusive. 293 */ 294 err = -err; 295 if (err == ERESTARTSYS || 296 err == ERESTARTNOHAND || 297 err == ERESTARTNOINTR) 298 err = EINTR; 299 if (err >= 512) 300 err = EINVAL; 301 BUG_ON(err <= 0 || err >= 256); 302 303 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 304 pfkey_hdr_dup(hdr, orig); 305 hdr->sadb_msg_errno = (uint8_t) err; 306 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / 307 sizeof(uint64_t)); 308 309 pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk); 310 311 return 0; 312 } 313 314 static u8 sadb_ext_min_len[] = { 315 [SADB_EXT_RESERVED] = (u8) 0, 316 [SADB_EXT_SA] = (u8) sizeof(struct sadb_sa), 317 [SADB_EXT_LIFETIME_CURRENT] = (u8) sizeof(struct sadb_lifetime), 318 [SADB_EXT_LIFETIME_HARD] = (u8) sizeof(struct sadb_lifetime), 319 [SADB_EXT_LIFETIME_SOFT] = (u8) sizeof(struct sadb_lifetime), 320 [SADB_EXT_ADDRESS_SRC] = (u8) sizeof(struct sadb_address), 321 [SADB_EXT_ADDRESS_DST] = (u8) sizeof(struct sadb_address), 322 [SADB_EXT_ADDRESS_PROXY] = (u8) sizeof(struct sadb_address), 323 [SADB_EXT_KEY_AUTH] = (u8) sizeof(struct sadb_key), 324 [SADB_EXT_KEY_ENCRYPT] = (u8) sizeof(struct sadb_key), 325 [SADB_EXT_IDENTITY_SRC] = (u8) sizeof(struct sadb_ident), 326 [SADB_EXT_IDENTITY_DST] = (u8) sizeof(struct sadb_ident), 327 [SADB_EXT_SENSITIVITY] = (u8) sizeof(struct sadb_sens), 328 [SADB_EXT_PROPOSAL] = (u8) sizeof(struct sadb_prop), 329 [SADB_EXT_SUPPORTED_AUTH] = (u8) sizeof(struct sadb_supported), 330 [SADB_EXT_SUPPORTED_ENCRYPT] = (u8) sizeof(struct sadb_supported), 331 [SADB_EXT_SPIRANGE] = (u8) sizeof(struct sadb_spirange), 332 [SADB_X_EXT_KMPRIVATE] = (u8) sizeof(struct sadb_x_kmprivate), 333 [SADB_X_EXT_POLICY] = (u8) sizeof(struct sadb_x_policy), 334 [SADB_X_EXT_SA2] = (u8) sizeof(struct sadb_x_sa2), 335 [SADB_X_EXT_NAT_T_TYPE] = (u8) sizeof(struct sadb_x_nat_t_type), 336 [SADB_X_EXT_NAT_T_SPORT] = (u8) sizeof(struct sadb_x_nat_t_port), 337 [SADB_X_EXT_NAT_T_DPORT] = (u8) sizeof(struct sadb_x_nat_t_port), 338 [SADB_X_EXT_NAT_T_OA] = (u8) sizeof(struct sadb_address), 339 [SADB_X_EXT_SEC_CTX] = (u8) sizeof(struct sadb_x_sec_ctx), 340 }; 341 342 /* Verify sadb_address_{len,prefixlen} against sa_family. */ 343 static int verify_address_len(void *p) 344 { 345 struct sadb_address *sp = p; 346 struct sockaddr *addr = (struct sockaddr *)(sp + 1); 347 struct sockaddr_in *sin; 348 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 349 struct sockaddr_in6 *sin6; 350 #endif 351 int len; 352 353 switch (addr->sa_family) { 354 case AF_INET: 355 len = sizeof(*sp) + sizeof(*sin) + (sizeof(uint64_t) - 1); 356 len /= sizeof(uint64_t); 357 if (sp->sadb_address_len != len || 358 sp->sadb_address_prefixlen > 32) 359 return -EINVAL; 360 break; 361 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 362 case AF_INET6: 363 len = sizeof(*sp) + sizeof(*sin6) + (sizeof(uint64_t) - 1); 364 len /= sizeof(uint64_t); 365 if (sp->sadb_address_len != len || 366 sp->sadb_address_prefixlen > 128) 367 return -EINVAL; 368 break; 369 #endif 370 default: 371 /* It is user using kernel to keep track of security 372 * associations for another protocol, such as 373 * OSPF/RSVP/RIPV2/MIP. It is user's job to verify 374 * lengths. 375 * 376 * XXX Actually, association/policy database is not yet 377 * XXX able to cope with arbitrary sockaddr families. 378 * XXX When it can, remove this -EINVAL. -DaveM 379 */ 380 return -EINVAL; 381 break; 382 } 383 384 return 0; 385 } 386 387 static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx) 388 { 389 int len = 0; 390 391 len += sizeof(struct sadb_x_sec_ctx); 392 len += sec_ctx->sadb_x_ctx_len; 393 len += sizeof(uint64_t) - 1; 394 len /= sizeof(uint64_t); 395 396 return len; 397 } 398 399 static inline int verify_sec_ctx_len(void *p) 400 { 401 struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p; 402 int len; 403 404 if (sec_ctx->sadb_x_ctx_len > PAGE_SIZE) 405 return -EINVAL; 406 407 len = pfkey_sec_ctx_len(sec_ctx); 408 409 if (sec_ctx->sadb_x_sec_len != len) 410 return -EINVAL; 411 412 return 0; 413 } 414 415 static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(struct sadb_x_sec_ctx *sec_ctx) 416 { 417 struct xfrm_user_sec_ctx *uctx = NULL; 418 int ctx_size = sec_ctx->sadb_x_ctx_len; 419 420 uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL); 421 422 if (!uctx) 423 return NULL; 424 425 uctx->len = pfkey_sec_ctx_len(sec_ctx); 426 uctx->exttype = sec_ctx->sadb_x_sec_exttype; 427 uctx->ctx_doi = sec_ctx->sadb_x_ctx_doi; 428 uctx->ctx_alg = sec_ctx->sadb_x_ctx_alg; 429 uctx->ctx_len = sec_ctx->sadb_x_ctx_len; 430 memcpy(uctx + 1, sec_ctx + 1, 431 uctx->ctx_len); 432 433 return uctx; 434 } 435 436 static int present_and_same_family(struct sadb_address *src, 437 struct sadb_address *dst) 438 { 439 struct sockaddr *s_addr, *d_addr; 440 441 if (!src || !dst) 442 return 0; 443 444 s_addr = (struct sockaddr *)(src + 1); 445 d_addr = (struct sockaddr *)(dst + 1); 446 if (s_addr->sa_family != d_addr->sa_family) 447 return 0; 448 if (s_addr->sa_family != AF_INET 449 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 450 && s_addr->sa_family != AF_INET6 451 #endif 452 ) 453 return 0; 454 455 return 1; 456 } 457 458 static int parse_exthdrs(struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 459 { 460 char *p = (char *) hdr; 461 int len = skb->len; 462 463 len -= sizeof(*hdr); 464 p += sizeof(*hdr); 465 while (len > 0) { 466 struct sadb_ext *ehdr = (struct sadb_ext *) p; 467 uint16_t ext_type; 468 int ext_len; 469 470 ext_len = ehdr->sadb_ext_len; 471 ext_len *= sizeof(uint64_t); 472 ext_type = ehdr->sadb_ext_type; 473 if (ext_len < sizeof(uint64_t) || 474 ext_len > len || 475 ext_type == SADB_EXT_RESERVED) 476 return -EINVAL; 477 478 if (ext_type <= SADB_EXT_MAX) { 479 int min = (int) sadb_ext_min_len[ext_type]; 480 if (ext_len < min) 481 return -EINVAL; 482 if (ext_hdrs[ext_type-1] != NULL) 483 return -EINVAL; 484 if (ext_type == SADB_EXT_ADDRESS_SRC || 485 ext_type == SADB_EXT_ADDRESS_DST || 486 ext_type == SADB_EXT_ADDRESS_PROXY || 487 ext_type == SADB_X_EXT_NAT_T_OA) { 488 if (verify_address_len(p)) 489 return -EINVAL; 490 } 491 if (ext_type == SADB_X_EXT_SEC_CTX) { 492 if (verify_sec_ctx_len(p)) 493 return -EINVAL; 494 } 495 ext_hdrs[ext_type-1] = p; 496 } 497 p += ext_len; 498 len -= ext_len; 499 } 500 501 return 0; 502 } 503 504 static uint16_t 505 pfkey_satype2proto(uint8_t satype) 506 { 507 switch (satype) { 508 case SADB_SATYPE_UNSPEC: 509 return IPSEC_PROTO_ANY; 510 case SADB_SATYPE_AH: 511 return IPPROTO_AH; 512 case SADB_SATYPE_ESP: 513 return IPPROTO_ESP; 514 case SADB_X_SATYPE_IPCOMP: 515 return IPPROTO_COMP; 516 break; 517 default: 518 return 0; 519 } 520 /* NOTREACHED */ 521 } 522 523 static uint8_t 524 pfkey_proto2satype(uint16_t proto) 525 { 526 switch (proto) { 527 case IPPROTO_AH: 528 return SADB_SATYPE_AH; 529 case IPPROTO_ESP: 530 return SADB_SATYPE_ESP; 531 case IPPROTO_COMP: 532 return SADB_X_SATYPE_IPCOMP; 533 break; 534 default: 535 return 0; 536 } 537 /* NOTREACHED */ 538 } 539 540 /* BTW, this scheme means that there is no way with PFKEY2 sockets to 541 * say specifically 'just raw sockets' as we encode them as 255. 542 */ 543 544 static uint8_t pfkey_proto_to_xfrm(uint8_t proto) 545 { 546 return (proto == IPSEC_PROTO_ANY ? 0 : proto); 547 } 548 549 static uint8_t pfkey_proto_from_xfrm(uint8_t proto) 550 { 551 return (proto ? proto : IPSEC_PROTO_ANY); 552 } 553 554 static int pfkey_sadb_addr2xfrm_addr(struct sadb_address *addr, 555 xfrm_address_t *xaddr) 556 { 557 switch (((struct sockaddr*)(addr + 1))->sa_family) { 558 case AF_INET: 559 xaddr->a4 = 560 ((struct sockaddr_in *)(addr + 1))->sin_addr.s_addr; 561 return AF_INET; 562 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 563 case AF_INET6: 564 memcpy(xaddr->a6, 565 &((struct sockaddr_in6 *)(addr + 1))->sin6_addr, 566 sizeof(struct in6_addr)); 567 return AF_INET6; 568 #endif 569 default: 570 return 0; 571 } 572 /* NOTREACHED */ 573 } 574 575 static struct xfrm_state *pfkey_xfrm_state_lookup(struct sadb_msg *hdr, void **ext_hdrs) 576 { 577 struct sadb_sa *sa; 578 struct sadb_address *addr; 579 uint16_t proto; 580 unsigned short family; 581 xfrm_address_t *xaddr; 582 583 sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1]; 584 if (sa == NULL) 585 return NULL; 586 587 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 588 if (proto == 0) 589 return NULL; 590 591 /* sadb_address_len should be checked by caller */ 592 addr = (struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1]; 593 if (addr == NULL) 594 return NULL; 595 596 family = ((struct sockaddr *)(addr + 1))->sa_family; 597 switch (family) { 598 case AF_INET: 599 xaddr = (xfrm_address_t *)&((struct sockaddr_in *)(addr + 1))->sin_addr; 600 break; 601 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 602 case AF_INET6: 603 xaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(addr + 1))->sin6_addr; 604 break; 605 #endif 606 default: 607 xaddr = NULL; 608 } 609 610 if (!xaddr) 611 return NULL; 612 613 return xfrm_state_lookup(xaddr, sa->sadb_sa_spi, proto, family); 614 } 615 616 #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1))) 617 static int 618 pfkey_sockaddr_size(sa_family_t family) 619 { 620 switch (family) { 621 case AF_INET: 622 return PFKEY_ALIGN8(sizeof(struct sockaddr_in)); 623 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 624 case AF_INET6: 625 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6)); 626 #endif 627 default: 628 return 0; 629 } 630 /* NOTREACHED */ 631 } 632 633 static inline int pfkey_mode_from_xfrm(int mode) 634 { 635 switch(mode) { 636 case XFRM_MODE_TRANSPORT: 637 return IPSEC_MODE_TRANSPORT; 638 case XFRM_MODE_TUNNEL: 639 return IPSEC_MODE_TUNNEL; 640 case XFRM_MODE_BEET: 641 return IPSEC_MODE_BEET; 642 default: 643 return -1; 644 } 645 } 646 647 static inline int pfkey_mode_to_xfrm(int mode) 648 { 649 switch(mode) { 650 case IPSEC_MODE_ANY: /*XXX*/ 651 case IPSEC_MODE_TRANSPORT: 652 return XFRM_MODE_TRANSPORT; 653 case IPSEC_MODE_TUNNEL: 654 return XFRM_MODE_TUNNEL; 655 case IPSEC_MODE_BEET: 656 return XFRM_MODE_BEET; 657 default: 658 return -1; 659 } 660 } 661 662 static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys, int hsc) 663 { 664 struct sk_buff *skb; 665 struct sadb_msg *hdr; 666 struct sadb_sa *sa; 667 struct sadb_lifetime *lifetime; 668 struct sadb_address *addr; 669 struct sadb_key *key; 670 struct sadb_x_sa2 *sa2; 671 struct sockaddr_in *sin; 672 struct sadb_x_sec_ctx *sec_ctx; 673 struct xfrm_sec_ctx *xfrm_ctx; 674 int ctx_size = 0; 675 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 676 struct sockaddr_in6 *sin6; 677 #endif 678 int size; 679 int auth_key_size = 0; 680 int encrypt_key_size = 0; 681 int sockaddr_size; 682 struct xfrm_encap_tmpl *natt = NULL; 683 int mode; 684 685 /* address family check */ 686 sockaddr_size = pfkey_sockaddr_size(x->props.family); 687 if (!sockaddr_size) 688 return ERR_PTR(-EINVAL); 689 690 /* base, SA, (lifetime (HSC),) address(SD), (address(P),) 691 key(AE), (identity(SD),) (sensitivity)> */ 692 size = sizeof(struct sadb_msg) +sizeof(struct sadb_sa) + 693 sizeof(struct sadb_lifetime) + 694 ((hsc & 1) ? sizeof(struct sadb_lifetime) : 0) + 695 ((hsc & 2) ? sizeof(struct sadb_lifetime) : 0) + 696 sizeof(struct sadb_address)*2 + 697 sockaddr_size*2 + 698 sizeof(struct sadb_x_sa2); 699 700 if ((xfrm_ctx = x->security)) { 701 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len); 702 size += sizeof(struct sadb_x_sec_ctx) + ctx_size; 703 } 704 705 /* identity & sensitivity */ 706 707 if ((x->props.family == AF_INET && 708 x->sel.saddr.a4 != x->props.saddr.a4) 709 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 710 || (x->props.family == AF_INET6 && 711 memcmp (x->sel.saddr.a6, x->props.saddr.a6, sizeof (struct in6_addr))) 712 #endif 713 ) 714 size += sizeof(struct sadb_address) + sockaddr_size; 715 716 if (add_keys) { 717 if (x->aalg && x->aalg->alg_key_len) { 718 auth_key_size = 719 PFKEY_ALIGN8((x->aalg->alg_key_len + 7) / 8); 720 size += sizeof(struct sadb_key) + auth_key_size; 721 } 722 if (x->ealg && x->ealg->alg_key_len) { 723 encrypt_key_size = 724 PFKEY_ALIGN8((x->ealg->alg_key_len+7) / 8); 725 size += sizeof(struct sadb_key) + encrypt_key_size; 726 } 727 } 728 if (x->encap) 729 natt = x->encap; 730 731 if (natt && natt->encap_type) { 732 size += sizeof(struct sadb_x_nat_t_type); 733 size += sizeof(struct sadb_x_nat_t_port); 734 size += sizeof(struct sadb_x_nat_t_port); 735 } 736 737 skb = alloc_skb(size + 16, GFP_ATOMIC); 738 if (skb == NULL) 739 return ERR_PTR(-ENOBUFS); 740 741 /* call should fill header later */ 742 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 743 memset(hdr, 0, size); /* XXX do we need this ? */ 744 hdr->sadb_msg_len = size / sizeof(uint64_t); 745 746 /* sa */ 747 sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa)); 748 sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t); 749 sa->sadb_sa_exttype = SADB_EXT_SA; 750 sa->sadb_sa_spi = x->id.spi; 751 sa->sadb_sa_replay = x->props.replay_window; 752 switch (x->km.state) { 753 case XFRM_STATE_VALID: 754 sa->sadb_sa_state = x->km.dying ? 755 SADB_SASTATE_DYING : SADB_SASTATE_MATURE; 756 break; 757 case XFRM_STATE_ACQ: 758 sa->sadb_sa_state = SADB_SASTATE_LARVAL; 759 break; 760 default: 761 sa->sadb_sa_state = SADB_SASTATE_DEAD; 762 break; 763 } 764 sa->sadb_sa_auth = 0; 765 if (x->aalg) { 766 struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0); 767 sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0; 768 } 769 sa->sadb_sa_encrypt = 0; 770 BUG_ON(x->ealg && x->calg); 771 if (x->ealg) { 772 struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0); 773 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; 774 } 775 /* KAME compatible: sadb_sa_encrypt is overloaded with calg id */ 776 if (x->calg) { 777 struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0); 778 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; 779 } 780 781 sa->sadb_sa_flags = 0; 782 if (x->props.flags & XFRM_STATE_NOECN) 783 sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN; 784 if (x->props.flags & XFRM_STATE_DECAP_DSCP) 785 sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP; 786 if (x->props.flags & XFRM_STATE_NOPMTUDISC) 787 sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC; 788 789 /* hard time */ 790 if (hsc & 2) { 791 lifetime = (struct sadb_lifetime *) skb_put(skb, 792 sizeof(struct sadb_lifetime)); 793 lifetime->sadb_lifetime_len = 794 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 795 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 796 lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.hard_packet_limit); 797 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.hard_byte_limit); 798 lifetime->sadb_lifetime_addtime = x->lft.hard_add_expires_seconds; 799 lifetime->sadb_lifetime_usetime = x->lft.hard_use_expires_seconds; 800 } 801 /* soft time */ 802 if (hsc & 1) { 803 lifetime = (struct sadb_lifetime *) skb_put(skb, 804 sizeof(struct sadb_lifetime)); 805 lifetime->sadb_lifetime_len = 806 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 807 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 808 lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.soft_packet_limit); 809 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.soft_byte_limit); 810 lifetime->sadb_lifetime_addtime = x->lft.soft_add_expires_seconds; 811 lifetime->sadb_lifetime_usetime = x->lft.soft_use_expires_seconds; 812 } 813 /* current time */ 814 lifetime = (struct sadb_lifetime *) skb_put(skb, 815 sizeof(struct sadb_lifetime)); 816 lifetime->sadb_lifetime_len = 817 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 818 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 819 lifetime->sadb_lifetime_allocations = x->curlft.packets; 820 lifetime->sadb_lifetime_bytes = x->curlft.bytes; 821 lifetime->sadb_lifetime_addtime = x->curlft.add_time; 822 lifetime->sadb_lifetime_usetime = x->curlft.use_time; 823 /* src address */ 824 addr = (struct sadb_address*) skb_put(skb, 825 sizeof(struct sadb_address)+sockaddr_size); 826 addr->sadb_address_len = 827 (sizeof(struct sadb_address)+sockaddr_size)/ 828 sizeof(uint64_t); 829 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 830 /* "if the ports are non-zero, then the sadb_address_proto field, 831 normally zero, MUST be filled in with the transport 832 protocol's number." - RFC2367 */ 833 addr->sadb_address_proto = 0; 834 addr->sadb_address_reserved = 0; 835 if (x->props.family == AF_INET) { 836 addr->sadb_address_prefixlen = 32; 837 838 sin = (struct sockaddr_in *) (addr + 1); 839 sin->sin_family = AF_INET; 840 sin->sin_addr.s_addr = x->props.saddr.a4; 841 sin->sin_port = 0; 842 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 843 } 844 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 845 else if (x->props.family == AF_INET6) { 846 addr->sadb_address_prefixlen = 128; 847 848 sin6 = (struct sockaddr_in6 *) (addr + 1); 849 sin6->sin6_family = AF_INET6; 850 sin6->sin6_port = 0; 851 sin6->sin6_flowinfo = 0; 852 memcpy(&sin6->sin6_addr, x->props.saddr.a6, 853 sizeof(struct in6_addr)); 854 sin6->sin6_scope_id = 0; 855 } 856 #endif 857 else 858 BUG(); 859 860 /* dst address */ 861 addr = (struct sadb_address*) skb_put(skb, 862 sizeof(struct sadb_address)+sockaddr_size); 863 addr->sadb_address_len = 864 (sizeof(struct sadb_address)+sockaddr_size)/ 865 sizeof(uint64_t); 866 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 867 addr->sadb_address_proto = 0; 868 addr->sadb_address_prefixlen = 32; /* XXX */ 869 addr->sadb_address_reserved = 0; 870 if (x->props.family == AF_INET) { 871 sin = (struct sockaddr_in *) (addr + 1); 872 sin->sin_family = AF_INET; 873 sin->sin_addr.s_addr = x->id.daddr.a4; 874 sin->sin_port = 0; 875 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 876 877 if (x->sel.saddr.a4 != x->props.saddr.a4) { 878 addr = (struct sadb_address*) skb_put(skb, 879 sizeof(struct sadb_address)+sockaddr_size); 880 addr->sadb_address_len = 881 (sizeof(struct sadb_address)+sockaddr_size)/ 882 sizeof(uint64_t); 883 addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 884 addr->sadb_address_proto = 885 pfkey_proto_from_xfrm(x->sel.proto); 886 addr->sadb_address_prefixlen = x->sel.prefixlen_s; 887 addr->sadb_address_reserved = 0; 888 889 sin = (struct sockaddr_in *) (addr + 1); 890 sin->sin_family = AF_INET; 891 sin->sin_addr.s_addr = x->sel.saddr.a4; 892 sin->sin_port = x->sel.sport; 893 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 894 } 895 } 896 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 897 else if (x->props.family == AF_INET6) { 898 addr->sadb_address_prefixlen = 128; 899 900 sin6 = (struct sockaddr_in6 *) (addr + 1); 901 sin6->sin6_family = AF_INET6; 902 sin6->sin6_port = 0; 903 sin6->sin6_flowinfo = 0; 904 memcpy(&sin6->sin6_addr, x->id.daddr.a6, sizeof(struct in6_addr)); 905 sin6->sin6_scope_id = 0; 906 907 if (memcmp (x->sel.saddr.a6, x->props.saddr.a6, 908 sizeof(struct in6_addr))) { 909 addr = (struct sadb_address *) skb_put(skb, 910 sizeof(struct sadb_address)+sockaddr_size); 911 addr->sadb_address_len = 912 (sizeof(struct sadb_address)+sockaddr_size)/ 913 sizeof(uint64_t); 914 addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 915 addr->sadb_address_proto = 916 pfkey_proto_from_xfrm(x->sel.proto); 917 addr->sadb_address_prefixlen = x->sel.prefixlen_s; 918 addr->sadb_address_reserved = 0; 919 920 sin6 = (struct sockaddr_in6 *) (addr + 1); 921 sin6->sin6_family = AF_INET6; 922 sin6->sin6_port = x->sel.sport; 923 sin6->sin6_flowinfo = 0; 924 memcpy(&sin6->sin6_addr, x->sel.saddr.a6, 925 sizeof(struct in6_addr)); 926 sin6->sin6_scope_id = 0; 927 } 928 } 929 #endif 930 else 931 BUG(); 932 933 /* auth key */ 934 if (add_keys && auth_key_size) { 935 key = (struct sadb_key *) skb_put(skb, 936 sizeof(struct sadb_key)+auth_key_size); 937 key->sadb_key_len = (sizeof(struct sadb_key) + auth_key_size) / 938 sizeof(uint64_t); 939 key->sadb_key_exttype = SADB_EXT_KEY_AUTH; 940 key->sadb_key_bits = x->aalg->alg_key_len; 941 key->sadb_key_reserved = 0; 942 memcpy(key + 1, x->aalg->alg_key, (x->aalg->alg_key_len+7)/8); 943 } 944 /* encrypt key */ 945 if (add_keys && encrypt_key_size) { 946 key = (struct sadb_key *) skb_put(skb, 947 sizeof(struct sadb_key)+encrypt_key_size); 948 key->sadb_key_len = (sizeof(struct sadb_key) + 949 encrypt_key_size) / sizeof(uint64_t); 950 key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 951 key->sadb_key_bits = x->ealg->alg_key_len; 952 key->sadb_key_reserved = 0; 953 memcpy(key + 1, x->ealg->alg_key, 954 (x->ealg->alg_key_len+7)/8); 955 } 956 957 /* sa */ 958 sa2 = (struct sadb_x_sa2 *) skb_put(skb, sizeof(struct sadb_x_sa2)); 959 sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t); 960 sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2; 961 if ((mode = pfkey_mode_from_xfrm(x->props.mode)) < 0) { 962 kfree_skb(skb); 963 return ERR_PTR(-EINVAL); 964 } 965 sa2->sadb_x_sa2_mode = mode; 966 sa2->sadb_x_sa2_reserved1 = 0; 967 sa2->sadb_x_sa2_reserved2 = 0; 968 sa2->sadb_x_sa2_sequence = 0; 969 sa2->sadb_x_sa2_reqid = x->props.reqid; 970 971 if (natt && natt->encap_type) { 972 struct sadb_x_nat_t_type *n_type; 973 struct sadb_x_nat_t_port *n_port; 974 975 /* type */ 976 n_type = (struct sadb_x_nat_t_type*) skb_put(skb, sizeof(*n_type)); 977 n_type->sadb_x_nat_t_type_len = sizeof(*n_type)/sizeof(uint64_t); 978 n_type->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; 979 n_type->sadb_x_nat_t_type_type = natt->encap_type; 980 n_type->sadb_x_nat_t_type_reserved[0] = 0; 981 n_type->sadb_x_nat_t_type_reserved[1] = 0; 982 n_type->sadb_x_nat_t_type_reserved[2] = 0; 983 984 /* source port */ 985 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 986 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 987 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT; 988 n_port->sadb_x_nat_t_port_port = natt->encap_sport; 989 n_port->sadb_x_nat_t_port_reserved = 0; 990 991 /* dest port */ 992 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 993 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 994 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT; 995 n_port->sadb_x_nat_t_port_port = natt->encap_dport; 996 n_port->sadb_x_nat_t_port_reserved = 0; 997 } 998 999 /* security context */ 1000 if (xfrm_ctx) { 1001 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, 1002 sizeof(struct sadb_x_sec_ctx) + ctx_size); 1003 sec_ctx->sadb_x_sec_len = 1004 (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t); 1005 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 1006 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 1007 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 1008 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 1009 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 1010 xfrm_ctx->ctx_len); 1011 } 1012 1013 return skb; 1014 } 1015 1016 static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr, 1017 void **ext_hdrs) 1018 { 1019 struct xfrm_state *x; 1020 struct sadb_lifetime *lifetime; 1021 struct sadb_sa *sa; 1022 struct sadb_key *key; 1023 struct sadb_x_sec_ctx *sec_ctx; 1024 uint16_t proto; 1025 int err; 1026 1027 1028 sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1]; 1029 if (!sa || 1030 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1031 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1032 return ERR_PTR(-EINVAL); 1033 if (hdr->sadb_msg_satype == SADB_SATYPE_ESP && 1034 !ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]) 1035 return ERR_PTR(-EINVAL); 1036 if (hdr->sadb_msg_satype == SADB_SATYPE_AH && 1037 !ext_hdrs[SADB_EXT_KEY_AUTH-1]) 1038 return ERR_PTR(-EINVAL); 1039 if (!!ext_hdrs[SADB_EXT_LIFETIME_HARD-1] != 1040 !!ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) 1041 return ERR_PTR(-EINVAL); 1042 1043 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1044 if (proto == 0) 1045 return ERR_PTR(-EINVAL); 1046 1047 /* default error is no buffer space */ 1048 err = -ENOBUFS; 1049 1050 /* RFC2367: 1051 1052 Only SADB_SASTATE_MATURE SAs may be submitted in an SADB_ADD message. 1053 SADB_SASTATE_LARVAL SAs are created by SADB_GETSPI and it is not 1054 sensible to add a new SA in the DYING or SADB_SASTATE_DEAD state. 1055 Therefore, the sadb_sa_state field of all submitted SAs MUST be 1056 SADB_SASTATE_MATURE and the kernel MUST return an error if this is 1057 not true. 1058 1059 However, KAME setkey always uses SADB_SASTATE_LARVAL. 1060 Hence, we have to _ignore_ sadb_sa_state, which is also reasonable. 1061 */ 1062 if (sa->sadb_sa_auth > SADB_AALG_MAX || 1063 (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP && 1064 sa->sadb_sa_encrypt > SADB_X_CALG_MAX) || 1065 sa->sadb_sa_encrypt > SADB_EALG_MAX) 1066 return ERR_PTR(-EINVAL); 1067 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1]; 1068 if (key != NULL && 1069 sa->sadb_sa_auth != SADB_X_AALG_NULL && 1070 ((key->sadb_key_bits+7) / 8 == 0 || 1071 (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1072 return ERR_PTR(-EINVAL); 1073 key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; 1074 if (key != NULL && 1075 sa->sadb_sa_encrypt != SADB_EALG_NULL && 1076 ((key->sadb_key_bits+7) / 8 == 0 || 1077 (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1078 return ERR_PTR(-EINVAL); 1079 1080 x = xfrm_state_alloc(); 1081 if (x == NULL) 1082 return ERR_PTR(-ENOBUFS); 1083 1084 x->id.proto = proto; 1085 x->id.spi = sa->sadb_sa_spi; 1086 x->props.replay_window = sa->sadb_sa_replay; 1087 if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN) 1088 x->props.flags |= XFRM_STATE_NOECN; 1089 if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP) 1090 x->props.flags |= XFRM_STATE_DECAP_DSCP; 1091 if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC) 1092 x->props.flags |= XFRM_STATE_NOPMTUDISC; 1093 1094 lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_HARD-1]; 1095 if (lifetime != NULL) { 1096 x->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 1097 x->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 1098 x->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime; 1099 x->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime; 1100 } 1101 lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]; 1102 if (lifetime != NULL) { 1103 x->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 1104 x->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 1105 x->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime; 1106 x->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime; 1107 } 1108 1109 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 1110 if (sec_ctx != NULL) { 1111 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 1112 1113 if (!uctx) 1114 goto out; 1115 1116 err = security_xfrm_state_alloc(x, uctx); 1117 kfree(uctx); 1118 1119 if (err) 1120 goto out; 1121 } 1122 1123 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1]; 1124 if (sa->sadb_sa_auth) { 1125 int keysize = 0; 1126 struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth); 1127 if (!a) { 1128 err = -ENOSYS; 1129 goto out; 1130 } 1131 if (key) 1132 keysize = (key->sadb_key_bits + 7) / 8; 1133 x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL); 1134 if (!x->aalg) 1135 goto out; 1136 strcpy(x->aalg->alg_name, a->name); 1137 x->aalg->alg_key_len = 0; 1138 if (key) { 1139 x->aalg->alg_key_len = key->sadb_key_bits; 1140 memcpy(x->aalg->alg_key, key+1, keysize); 1141 } 1142 x->props.aalgo = sa->sadb_sa_auth; 1143 /* x->algo.flags = sa->sadb_sa_flags; */ 1144 } 1145 if (sa->sadb_sa_encrypt) { 1146 if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) { 1147 struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt); 1148 if (!a) { 1149 err = -ENOSYS; 1150 goto out; 1151 } 1152 x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL); 1153 if (!x->calg) 1154 goto out; 1155 strcpy(x->calg->alg_name, a->name); 1156 x->props.calgo = sa->sadb_sa_encrypt; 1157 } else { 1158 int keysize = 0; 1159 struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt); 1160 if (!a) { 1161 err = -ENOSYS; 1162 goto out; 1163 } 1164 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; 1165 if (key) 1166 keysize = (key->sadb_key_bits + 7) / 8; 1167 x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL); 1168 if (!x->ealg) 1169 goto out; 1170 strcpy(x->ealg->alg_name, a->name); 1171 x->ealg->alg_key_len = 0; 1172 if (key) { 1173 x->ealg->alg_key_len = key->sadb_key_bits; 1174 memcpy(x->ealg->alg_key, key+1, keysize); 1175 } 1176 x->props.ealgo = sa->sadb_sa_encrypt; 1177 } 1178 } 1179 /* x->algo.flags = sa->sadb_sa_flags; */ 1180 1181 x->props.family = pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1182 &x->props.saddr); 1183 if (!x->props.family) { 1184 err = -EAFNOSUPPORT; 1185 goto out; 1186 } 1187 pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1], 1188 &x->id.daddr); 1189 1190 if (ext_hdrs[SADB_X_EXT_SA2-1]) { 1191 struct sadb_x_sa2 *sa2 = (void*)ext_hdrs[SADB_X_EXT_SA2-1]; 1192 int mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode); 1193 if (mode < 0) { 1194 err = -EINVAL; 1195 goto out; 1196 } 1197 x->props.mode = mode; 1198 x->props.reqid = sa2->sadb_x_sa2_reqid; 1199 } 1200 1201 if (ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]) { 1202 struct sadb_address *addr = ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]; 1203 1204 /* Nobody uses this, but we try. */ 1205 x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, &x->sel.saddr); 1206 x->sel.prefixlen_s = addr->sadb_address_prefixlen; 1207 } 1208 1209 if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) { 1210 struct sadb_x_nat_t_type* n_type; 1211 struct xfrm_encap_tmpl *natt; 1212 1213 x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL); 1214 if (!x->encap) 1215 goto out; 1216 1217 natt = x->encap; 1218 n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]; 1219 natt->encap_type = n_type->sadb_x_nat_t_type_type; 1220 1221 if (ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]) { 1222 struct sadb_x_nat_t_port* n_port = 1223 ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]; 1224 natt->encap_sport = n_port->sadb_x_nat_t_port_port; 1225 } 1226 if (ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]) { 1227 struct sadb_x_nat_t_port* n_port = 1228 ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]; 1229 natt->encap_dport = n_port->sadb_x_nat_t_port_port; 1230 } 1231 } 1232 1233 err = xfrm_init_state(x); 1234 if (err) 1235 goto out; 1236 1237 x->km.seq = hdr->sadb_msg_seq; 1238 return x; 1239 1240 out: 1241 x->km.state = XFRM_STATE_DEAD; 1242 xfrm_state_put(x); 1243 return ERR_PTR(err); 1244 } 1245 1246 static int pfkey_reserved(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1247 { 1248 return -EOPNOTSUPP; 1249 } 1250 1251 static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1252 { 1253 struct sk_buff *resp_skb; 1254 struct sadb_x_sa2 *sa2; 1255 struct sadb_address *saddr, *daddr; 1256 struct sadb_msg *out_hdr; 1257 struct xfrm_state *x = NULL; 1258 int mode; 1259 u32 reqid; 1260 u8 proto; 1261 unsigned short family; 1262 xfrm_address_t *xsaddr = NULL, *xdaddr = NULL; 1263 1264 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1265 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1266 return -EINVAL; 1267 1268 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1269 if (proto == 0) 1270 return -EINVAL; 1271 1272 if ((sa2 = ext_hdrs[SADB_X_EXT_SA2-1]) != NULL) { 1273 mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode); 1274 if (mode < 0) 1275 return -EINVAL; 1276 reqid = sa2->sadb_x_sa2_reqid; 1277 } else { 1278 mode = 0; 1279 reqid = 0; 1280 } 1281 1282 saddr = ext_hdrs[SADB_EXT_ADDRESS_SRC-1]; 1283 daddr = ext_hdrs[SADB_EXT_ADDRESS_DST-1]; 1284 1285 family = ((struct sockaddr *)(saddr + 1))->sa_family; 1286 switch (family) { 1287 case AF_INET: 1288 xdaddr = (xfrm_address_t *)&((struct sockaddr_in *)(daddr + 1))->sin_addr.s_addr; 1289 xsaddr = (xfrm_address_t *)&((struct sockaddr_in *)(saddr + 1))->sin_addr.s_addr; 1290 break; 1291 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1292 case AF_INET6: 1293 xdaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(daddr + 1))->sin6_addr; 1294 xsaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(saddr + 1))->sin6_addr; 1295 break; 1296 #endif 1297 } 1298 1299 if (hdr->sadb_msg_seq) { 1300 x = xfrm_find_acq_byseq(hdr->sadb_msg_seq); 1301 if (x && xfrm_addr_cmp(&x->id.daddr, xdaddr, family)) { 1302 xfrm_state_put(x); 1303 x = NULL; 1304 } 1305 } 1306 1307 if (!x) 1308 x = xfrm_find_acq(mode, reqid, proto, xdaddr, xsaddr, 1, family); 1309 1310 if (x == NULL) 1311 return -ENOENT; 1312 1313 resp_skb = ERR_PTR(-ENOENT); 1314 1315 spin_lock_bh(&x->lock); 1316 if (x->km.state != XFRM_STATE_DEAD) { 1317 struct sadb_spirange *range = ext_hdrs[SADB_EXT_SPIRANGE-1]; 1318 u32 min_spi, max_spi; 1319 1320 if (range != NULL) { 1321 min_spi = range->sadb_spirange_min; 1322 max_spi = range->sadb_spirange_max; 1323 } else { 1324 min_spi = 0x100; 1325 max_spi = 0x0fffffff; 1326 } 1327 xfrm_alloc_spi(x, htonl(min_spi), htonl(max_spi)); 1328 if (x->id.spi) 1329 resp_skb = pfkey_xfrm_state2msg(x, 0, 3); 1330 } 1331 spin_unlock_bh(&x->lock); 1332 1333 if (IS_ERR(resp_skb)) { 1334 xfrm_state_put(x); 1335 return PTR_ERR(resp_skb); 1336 } 1337 1338 out_hdr = (struct sadb_msg *) resp_skb->data; 1339 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 1340 out_hdr->sadb_msg_type = SADB_GETSPI; 1341 out_hdr->sadb_msg_satype = pfkey_proto2satype(proto); 1342 out_hdr->sadb_msg_errno = 0; 1343 out_hdr->sadb_msg_reserved = 0; 1344 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 1345 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 1346 1347 xfrm_state_put(x); 1348 1349 pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk); 1350 1351 return 0; 1352 } 1353 1354 static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1355 { 1356 struct xfrm_state *x; 1357 1358 if (hdr->sadb_msg_len != sizeof(struct sadb_msg)/8) 1359 return -EOPNOTSUPP; 1360 1361 if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0) 1362 return 0; 1363 1364 x = xfrm_find_acq_byseq(hdr->sadb_msg_seq); 1365 if (x == NULL) 1366 return 0; 1367 1368 spin_lock_bh(&x->lock); 1369 if (x->km.state == XFRM_STATE_ACQ) { 1370 x->km.state = XFRM_STATE_ERROR; 1371 wake_up(&km_waitq); 1372 } 1373 spin_unlock_bh(&x->lock); 1374 xfrm_state_put(x); 1375 return 0; 1376 } 1377 1378 static inline int event2poltype(int event) 1379 { 1380 switch (event) { 1381 case XFRM_MSG_DELPOLICY: 1382 return SADB_X_SPDDELETE; 1383 case XFRM_MSG_NEWPOLICY: 1384 return SADB_X_SPDADD; 1385 case XFRM_MSG_UPDPOLICY: 1386 return SADB_X_SPDUPDATE; 1387 case XFRM_MSG_POLEXPIRE: 1388 // return SADB_X_SPDEXPIRE; 1389 default: 1390 printk("pfkey: Unknown policy event %d\n", event); 1391 break; 1392 } 1393 1394 return 0; 1395 } 1396 1397 static inline int event2keytype(int event) 1398 { 1399 switch (event) { 1400 case XFRM_MSG_DELSA: 1401 return SADB_DELETE; 1402 case XFRM_MSG_NEWSA: 1403 return SADB_ADD; 1404 case XFRM_MSG_UPDSA: 1405 return SADB_UPDATE; 1406 case XFRM_MSG_EXPIRE: 1407 return SADB_EXPIRE; 1408 default: 1409 printk("pfkey: Unknown SA event %d\n", event); 1410 break; 1411 } 1412 1413 return 0; 1414 } 1415 1416 /* ADD/UPD/DEL */ 1417 static int key_notify_sa(struct xfrm_state *x, struct km_event *c) 1418 { 1419 struct sk_buff *skb; 1420 struct sadb_msg *hdr; 1421 int hsc = 3; 1422 1423 if (c->event == XFRM_MSG_DELSA) 1424 hsc = 0; 1425 1426 skb = pfkey_xfrm_state2msg(x, 0, hsc); 1427 1428 if (IS_ERR(skb)) 1429 return PTR_ERR(skb); 1430 1431 hdr = (struct sadb_msg *) skb->data; 1432 hdr->sadb_msg_version = PF_KEY_V2; 1433 hdr->sadb_msg_type = event2keytype(c->event); 1434 hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 1435 hdr->sadb_msg_errno = 0; 1436 hdr->sadb_msg_reserved = 0; 1437 hdr->sadb_msg_seq = c->seq; 1438 hdr->sadb_msg_pid = c->pid; 1439 1440 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 1441 1442 return 0; 1443 } 1444 1445 static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1446 { 1447 struct xfrm_state *x; 1448 int err; 1449 struct km_event c; 1450 1451 xfrm_probe_algs(); 1452 1453 x = pfkey_msg2xfrm_state(hdr, ext_hdrs); 1454 if (IS_ERR(x)) 1455 return PTR_ERR(x); 1456 1457 xfrm_state_hold(x); 1458 if (hdr->sadb_msg_type == SADB_ADD) 1459 err = xfrm_state_add(x); 1460 else 1461 err = xfrm_state_update(x); 1462 1463 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 1464 AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x); 1465 1466 if (err < 0) { 1467 x->km.state = XFRM_STATE_DEAD; 1468 __xfrm_state_put(x); 1469 goto out; 1470 } 1471 1472 if (hdr->sadb_msg_type == SADB_ADD) 1473 c.event = XFRM_MSG_NEWSA; 1474 else 1475 c.event = XFRM_MSG_UPDSA; 1476 c.seq = hdr->sadb_msg_seq; 1477 c.pid = hdr->sadb_msg_pid; 1478 km_state_notify(x, &c); 1479 out: 1480 xfrm_state_put(x); 1481 return err; 1482 } 1483 1484 static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1485 { 1486 struct xfrm_state *x; 1487 struct km_event c; 1488 int err; 1489 1490 if (!ext_hdrs[SADB_EXT_SA-1] || 1491 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1492 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1493 return -EINVAL; 1494 1495 x = pfkey_xfrm_state_lookup(hdr, ext_hdrs); 1496 if (x == NULL) 1497 return -ESRCH; 1498 1499 if ((err = security_xfrm_state_delete(x))) 1500 goto out; 1501 1502 if (xfrm_state_kern(x)) { 1503 err = -EPERM; 1504 goto out; 1505 } 1506 1507 err = xfrm_state_delete(x); 1508 1509 if (err < 0) 1510 goto out; 1511 1512 c.seq = hdr->sadb_msg_seq; 1513 c.pid = hdr->sadb_msg_pid; 1514 c.event = XFRM_MSG_DELSA; 1515 km_state_notify(x, &c); 1516 out: 1517 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 1518 AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x); 1519 xfrm_state_put(x); 1520 1521 return err; 1522 } 1523 1524 static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1525 { 1526 __u8 proto; 1527 struct sk_buff *out_skb; 1528 struct sadb_msg *out_hdr; 1529 struct xfrm_state *x; 1530 1531 if (!ext_hdrs[SADB_EXT_SA-1] || 1532 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1533 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1534 return -EINVAL; 1535 1536 x = pfkey_xfrm_state_lookup(hdr, ext_hdrs); 1537 if (x == NULL) 1538 return -ESRCH; 1539 1540 out_skb = pfkey_xfrm_state2msg(x, 1, 3); 1541 proto = x->id.proto; 1542 xfrm_state_put(x); 1543 if (IS_ERR(out_skb)) 1544 return PTR_ERR(out_skb); 1545 1546 out_hdr = (struct sadb_msg *) out_skb->data; 1547 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 1548 out_hdr->sadb_msg_type = SADB_DUMP; 1549 out_hdr->sadb_msg_satype = pfkey_proto2satype(proto); 1550 out_hdr->sadb_msg_errno = 0; 1551 out_hdr->sadb_msg_reserved = 0; 1552 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 1553 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 1554 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk); 1555 1556 return 0; 1557 } 1558 1559 static struct sk_buff *compose_sadb_supported(struct sadb_msg *orig, 1560 gfp_t allocation) 1561 { 1562 struct sk_buff *skb; 1563 struct sadb_msg *hdr; 1564 int len, auth_len, enc_len, i; 1565 1566 auth_len = xfrm_count_auth_supported(); 1567 if (auth_len) { 1568 auth_len *= sizeof(struct sadb_alg); 1569 auth_len += sizeof(struct sadb_supported); 1570 } 1571 1572 enc_len = xfrm_count_enc_supported(); 1573 if (enc_len) { 1574 enc_len *= sizeof(struct sadb_alg); 1575 enc_len += sizeof(struct sadb_supported); 1576 } 1577 1578 len = enc_len + auth_len + sizeof(struct sadb_msg); 1579 1580 skb = alloc_skb(len + 16, allocation); 1581 if (!skb) 1582 goto out_put_algs; 1583 1584 hdr = (struct sadb_msg *) skb_put(skb, sizeof(*hdr)); 1585 pfkey_hdr_dup(hdr, orig); 1586 hdr->sadb_msg_errno = 0; 1587 hdr->sadb_msg_len = len / sizeof(uint64_t); 1588 1589 if (auth_len) { 1590 struct sadb_supported *sp; 1591 struct sadb_alg *ap; 1592 1593 sp = (struct sadb_supported *) skb_put(skb, auth_len); 1594 ap = (struct sadb_alg *) (sp + 1); 1595 1596 sp->sadb_supported_len = auth_len / sizeof(uint64_t); 1597 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH; 1598 1599 for (i = 0; ; i++) { 1600 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 1601 if (!aalg) 1602 break; 1603 if (aalg->available) 1604 *ap++ = aalg->desc; 1605 } 1606 } 1607 1608 if (enc_len) { 1609 struct sadb_supported *sp; 1610 struct sadb_alg *ap; 1611 1612 sp = (struct sadb_supported *) skb_put(skb, enc_len); 1613 ap = (struct sadb_alg *) (sp + 1); 1614 1615 sp->sadb_supported_len = enc_len / sizeof(uint64_t); 1616 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT; 1617 1618 for (i = 0; ; i++) { 1619 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 1620 if (!ealg) 1621 break; 1622 if (ealg->available) 1623 *ap++ = ealg->desc; 1624 } 1625 } 1626 1627 out_put_algs: 1628 return skb; 1629 } 1630 1631 static int pfkey_register(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1632 { 1633 struct pfkey_sock *pfk = pfkey_sk(sk); 1634 struct sk_buff *supp_skb; 1635 1636 if (hdr->sadb_msg_satype > SADB_SATYPE_MAX) 1637 return -EINVAL; 1638 1639 if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) { 1640 if (pfk->registered&(1<<hdr->sadb_msg_satype)) 1641 return -EEXIST; 1642 pfk->registered |= (1<<hdr->sadb_msg_satype); 1643 } 1644 1645 xfrm_probe_algs(); 1646 1647 supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); 1648 if (!supp_skb) { 1649 if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) 1650 pfk->registered &= ~(1<<hdr->sadb_msg_satype); 1651 1652 return -ENOBUFS; 1653 } 1654 1655 pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk); 1656 1657 return 0; 1658 } 1659 1660 static int key_notify_sa_flush(struct km_event *c) 1661 { 1662 struct sk_buff *skb; 1663 struct sadb_msg *hdr; 1664 1665 skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC); 1666 if (!skb) 1667 return -ENOBUFS; 1668 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 1669 hdr->sadb_msg_satype = pfkey_proto2satype(c->data.proto); 1670 hdr->sadb_msg_type = SADB_FLUSH; 1671 hdr->sadb_msg_seq = c->seq; 1672 hdr->sadb_msg_pid = c->pid; 1673 hdr->sadb_msg_version = PF_KEY_V2; 1674 hdr->sadb_msg_errno = (uint8_t) 0; 1675 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 1676 1677 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 1678 1679 return 0; 1680 } 1681 1682 static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1683 { 1684 unsigned proto; 1685 struct km_event c; 1686 struct xfrm_audit audit_info; 1687 1688 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1689 if (proto == 0) 1690 return -EINVAL; 1691 1692 audit_info.loginuid = audit_get_loginuid(current->audit_context); 1693 audit_info.secid = 0; 1694 xfrm_state_flush(proto, &audit_info); 1695 c.data.proto = proto; 1696 c.seq = hdr->sadb_msg_seq; 1697 c.pid = hdr->sadb_msg_pid; 1698 c.event = XFRM_MSG_FLUSHSA; 1699 km_state_notify(NULL, &c); 1700 1701 return 0; 1702 } 1703 1704 struct pfkey_dump_data 1705 { 1706 struct sk_buff *skb; 1707 struct sadb_msg *hdr; 1708 struct sock *sk; 1709 }; 1710 1711 static int dump_sa(struct xfrm_state *x, int count, void *ptr) 1712 { 1713 struct pfkey_dump_data *data = ptr; 1714 struct sk_buff *out_skb; 1715 struct sadb_msg *out_hdr; 1716 1717 out_skb = pfkey_xfrm_state2msg(x, 1, 3); 1718 if (IS_ERR(out_skb)) 1719 return PTR_ERR(out_skb); 1720 1721 out_hdr = (struct sadb_msg *) out_skb->data; 1722 out_hdr->sadb_msg_version = data->hdr->sadb_msg_version; 1723 out_hdr->sadb_msg_type = SADB_DUMP; 1724 out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 1725 out_hdr->sadb_msg_errno = 0; 1726 out_hdr->sadb_msg_reserved = 0; 1727 out_hdr->sadb_msg_seq = count; 1728 out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid; 1729 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk); 1730 return 0; 1731 } 1732 1733 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1734 { 1735 u8 proto; 1736 struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk }; 1737 1738 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1739 if (proto == 0) 1740 return -EINVAL; 1741 1742 return xfrm_state_walk(proto, dump_sa, &data); 1743 } 1744 1745 static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1746 { 1747 struct pfkey_sock *pfk = pfkey_sk(sk); 1748 int satype = hdr->sadb_msg_satype; 1749 1750 if (hdr->sadb_msg_len == (sizeof(*hdr) / sizeof(uint64_t))) { 1751 /* XXX we mangle packet... */ 1752 hdr->sadb_msg_errno = 0; 1753 if (satype != 0 && satype != 1) 1754 return -EINVAL; 1755 pfk->promisc = satype; 1756 } 1757 pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, BROADCAST_ALL, NULL); 1758 return 0; 1759 } 1760 1761 static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr) 1762 { 1763 int i; 1764 u32 reqid = *(u32*)ptr; 1765 1766 for (i=0; i<xp->xfrm_nr; i++) { 1767 if (xp->xfrm_vec[i].reqid == reqid) 1768 return -EEXIST; 1769 } 1770 return 0; 1771 } 1772 1773 static u32 gen_reqid(void) 1774 { 1775 u32 start; 1776 static u32 reqid = IPSEC_MANUAL_REQID_MAX; 1777 1778 start = reqid; 1779 do { 1780 ++reqid; 1781 if (reqid == 0) 1782 reqid = IPSEC_MANUAL_REQID_MAX+1; 1783 if (xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, check_reqid, 1784 (void*)&reqid) != -EEXIST) 1785 return reqid; 1786 } while (reqid != start); 1787 return 0; 1788 } 1789 1790 static int 1791 parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) 1792 { 1793 struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr; 1794 struct sockaddr_in *sin; 1795 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1796 struct sockaddr_in6 *sin6; 1797 #endif 1798 int mode; 1799 1800 if (xp->xfrm_nr >= XFRM_MAX_DEPTH) 1801 return -ELOOP; 1802 1803 if (rq->sadb_x_ipsecrequest_mode == 0) 1804 return -EINVAL; 1805 1806 t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */ 1807 if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0) 1808 return -EINVAL; 1809 t->mode = mode; 1810 if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) 1811 t->optional = 1; 1812 else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) { 1813 t->reqid = rq->sadb_x_ipsecrequest_reqid; 1814 if (t->reqid > IPSEC_MANUAL_REQID_MAX) 1815 t->reqid = 0; 1816 if (!t->reqid && !(t->reqid = gen_reqid())) 1817 return -ENOBUFS; 1818 } 1819 1820 /* addresses present only in tunnel mode */ 1821 if (t->mode == XFRM_MODE_TUNNEL) { 1822 struct sockaddr *sa; 1823 sa = (struct sockaddr *)(rq+1); 1824 switch(sa->sa_family) { 1825 case AF_INET: 1826 sin = (struct sockaddr_in*)sa; 1827 t->saddr.a4 = sin->sin_addr.s_addr; 1828 sin++; 1829 if (sin->sin_family != AF_INET) 1830 return -EINVAL; 1831 t->id.daddr.a4 = sin->sin_addr.s_addr; 1832 break; 1833 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1834 case AF_INET6: 1835 sin6 = (struct sockaddr_in6*)sa; 1836 memcpy(t->saddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); 1837 sin6++; 1838 if (sin6->sin6_family != AF_INET6) 1839 return -EINVAL; 1840 memcpy(t->id.daddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); 1841 break; 1842 #endif 1843 default: 1844 return -EINVAL; 1845 } 1846 t->encap_family = sa->sa_family; 1847 } else 1848 t->encap_family = xp->family; 1849 1850 /* No way to set this via kame pfkey */ 1851 t->aalgos = t->ealgos = t->calgos = ~0; 1852 xp->xfrm_nr++; 1853 return 0; 1854 } 1855 1856 static int 1857 parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol) 1858 { 1859 int err; 1860 int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy); 1861 struct sadb_x_ipsecrequest *rq = (void*)(pol+1); 1862 1863 while (len >= sizeof(struct sadb_x_ipsecrequest)) { 1864 if ((err = parse_ipsecrequest(xp, rq)) < 0) 1865 return err; 1866 len -= rq->sadb_x_ipsecrequest_len; 1867 rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len); 1868 } 1869 return 0; 1870 } 1871 1872 static inline int pfkey_xfrm_policy2sec_ctx_size(struct xfrm_policy *xp) 1873 { 1874 struct xfrm_sec_ctx *xfrm_ctx = xp->security; 1875 1876 if (xfrm_ctx) { 1877 int len = sizeof(struct sadb_x_sec_ctx); 1878 len += xfrm_ctx->ctx_len; 1879 return PFKEY_ALIGN8(len); 1880 } 1881 return 0; 1882 } 1883 1884 static int pfkey_xfrm_policy2msg_size(struct xfrm_policy *xp) 1885 { 1886 struct xfrm_tmpl *t; 1887 int sockaddr_size = pfkey_sockaddr_size(xp->family); 1888 int socklen = 0; 1889 int i; 1890 1891 for (i=0; i<xp->xfrm_nr; i++) { 1892 t = xp->xfrm_vec + i; 1893 socklen += (t->encap_family == AF_INET ? 1894 sizeof(struct sockaddr_in) : 1895 sizeof(struct sockaddr_in6)); 1896 } 1897 1898 return sizeof(struct sadb_msg) + 1899 (sizeof(struct sadb_lifetime) * 3) + 1900 (sizeof(struct sadb_address) * 2) + 1901 (sockaddr_size * 2) + 1902 sizeof(struct sadb_x_policy) + 1903 (xp->xfrm_nr * sizeof(struct sadb_x_ipsecrequest)) + 1904 (socklen * 2) + 1905 pfkey_xfrm_policy2sec_ctx_size(xp); 1906 } 1907 1908 static struct sk_buff * pfkey_xfrm_policy2msg_prep(struct xfrm_policy *xp) 1909 { 1910 struct sk_buff *skb; 1911 int size; 1912 1913 size = pfkey_xfrm_policy2msg_size(xp); 1914 1915 skb = alloc_skb(size + 16, GFP_ATOMIC); 1916 if (skb == NULL) 1917 return ERR_PTR(-ENOBUFS); 1918 1919 return skb; 1920 } 1921 1922 static int pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, int dir) 1923 { 1924 struct sadb_msg *hdr; 1925 struct sadb_address *addr; 1926 struct sadb_lifetime *lifetime; 1927 struct sadb_x_policy *pol; 1928 struct sockaddr_in *sin; 1929 struct sadb_x_sec_ctx *sec_ctx; 1930 struct xfrm_sec_ctx *xfrm_ctx; 1931 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1932 struct sockaddr_in6 *sin6; 1933 #endif 1934 int i; 1935 int size; 1936 int sockaddr_size = pfkey_sockaddr_size(xp->family); 1937 int socklen = (xp->family == AF_INET ? 1938 sizeof(struct sockaddr_in) : 1939 sizeof(struct sockaddr_in6)); 1940 1941 size = pfkey_xfrm_policy2msg_size(xp); 1942 1943 /* call should fill header later */ 1944 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 1945 memset(hdr, 0, size); /* XXX do we need this ? */ 1946 1947 /* src address */ 1948 addr = (struct sadb_address*) skb_put(skb, 1949 sizeof(struct sadb_address)+sockaddr_size); 1950 addr->sadb_address_len = 1951 (sizeof(struct sadb_address)+sockaddr_size)/ 1952 sizeof(uint64_t); 1953 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 1954 addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto); 1955 addr->sadb_address_prefixlen = xp->selector.prefixlen_s; 1956 addr->sadb_address_reserved = 0; 1957 /* src address */ 1958 if (xp->family == AF_INET) { 1959 sin = (struct sockaddr_in *) (addr + 1); 1960 sin->sin_family = AF_INET; 1961 sin->sin_addr.s_addr = xp->selector.saddr.a4; 1962 sin->sin_port = xp->selector.sport; 1963 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 1964 } 1965 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1966 else if (xp->family == AF_INET6) { 1967 sin6 = (struct sockaddr_in6 *) (addr + 1); 1968 sin6->sin6_family = AF_INET6; 1969 sin6->sin6_port = xp->selector.sport; 1970 sin6->sin6_flowinfo = 0; 1971 memcpy(&sin6->sin6_addr, xp->selector.saddr.a6, 1972 sizeof(struct in6_addr)); 1973 sin6->sin6_scope_id = 0; 1974 } 1975 #endif 1976 else 1977 BUG(); 1978 1979 /* dst address */ 1980 addr = (struct sadb_address*) skb_put(skb, 1981 sizeof(struct sadb_address)+sockaddr_size); 1982 addr->sadb_address_len = 1983 (sizeof(struct sadb_address)+sockaddr_size)/ 1984 sizeof(uint64_t); 1985 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 1986 addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto); 1987 addr->sadb_address_prefixlen = xp->selector.prefixlen_d; 1988 addr->sadb_address_reserved = 0; 1989 if (xp->family == AF_INET) { 1990 sin = (struct sockaddr_in *) (addr + 1); 1991 sin->sin_family = AF_INET; 1992 sin->sin_addr.s_addr = xp->selector.daddr.a4; 1993 sin->sin_port = xp->selector.dport; 1994 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 1995 } 1996 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1997 else if (xp->family == AF_INET6) { 1998 sin6 = (struct sockaddr_in6 *) (addr + 1); 1999 sin6->sin6_family = AF_INET6; 2000 sin6->sin6_port = xp->selector.dport; 2001 sin6->sin6_flowinfo = 0; 2002 memcpy(&sin6->sin6_addr, xp->selector.daddr.a6, 2003 sizeof(struct in6_addr)); 2004 sin6->sin6_scope_id = 0; 2005 } 2006 #endif 2007 else 2008 BUG(); 2009 2010 /* hard time */ 2011 lifetime = (struct sadb_lifetime *) skb_put(skb, 2012 sizeof(struct sadb_lifetime)); 2013 lifetime->sadb_lifetime_len = 2014 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2015 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 2016 lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.hard_packet_limit); 2017 lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.hard_byte_limit); 2018 lifetime->sadb_lifetime_addtime = xp->lft.hard_add_expires_seconds; 2019 lifetime->sadb_lifetime_usetime = xp->lft.hard_use_expires_seconds; 2020 /* soft time */ 2021 lifetime = (struct sadb_lifetime *) skb_put(skb, 2022 sizeof(struct sadb_lifetime)); 2023 lifetime->sadb_lifetime_len = 2024 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2025 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 2026 lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.soft_packet_limit); 2027 lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.soft_byte_limit); 2028 lifetime->sadb_lifetime_addtime = xp->lft.soft_add_expires_seconds; 2029 lifetime->sadb_lifetime_usetime = xp->lft.soft_use_expires_seconds; 2030 /* current time */ 2031 lifetime = (struct sadb_lifetime *) skb_put(skb, 2032 sizeof(struct sadb_lifetime)); 2033 lifetime->sadb_lifetime_len = 2034 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2035 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 2036 lifetime->sadb_lifetime_allocations = xp->curlft.packets; 2037 lifetime->sadb_lifetime_bytes = xp->curlft.bytes; 2038 lifetime->sadb_lifetime_addtime = xp->curlft.add_time; 2039 lifetime->sadb_lifetime_usetime = xp->curlft.use_time; 2040 2041 pol = (struct sadb_x_policy *) skb_put(skb, sizeof(struct sadb_x_policy)); 2042 pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t); 2043 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 2044 pol->sadb_x_policy_type = IPSEC_POLICY_DISCARD; 2045 if (xp->action == XFRM_POLICY_ALLOW) { 2046 if (xp->xfrm_nr) 2047 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 2048 else 2049 pol->sadb_x_policy_type = IPSEC_POLICY_NONE; 2050 } 2051 pol->sadb_x_policy_dir = dir+1; 2052 pol->sadb_x_policy_id = xp->index; 2053 pol->sadb_x_policy_priority = xp->priority; 2054 2055 for (i=0; i<xp->xfrm_nr; i++) { 2056 struct sadb_x_ipsecrequest *rq; 2057 struct xfrm_tmpl *t = xp->xfrm_vec + i; 2058 int req_size; 2059 int mode; 2060 2061 req_size = sizeof(struct sadb_x_ipsecrequest); 2062 if (t->mode == XFRM_MODE_TUNNEL) 2063 req_size += ((t->encap_family == AF_INET ? 2064 sizeof(struct sockaddr_in) : 2065 sizeof(struct sockaddr_in6)) * 2); 2066 else 2067 size -= 2*socklen; 2068 rq = (void*)skb_put(skb, req_size); 2069 pol->sadb_x_policy_len += req_size/8; 2070 memset(rq, 0, sizeof(*rq)); 2071 rq->sadb_x_ipsecrequest_len = req_size; 2072 rq->sadb_x_ipsecrequest_proto = t->id.proto; 2073 if ((mode = pfkey_mode_from_xfrm(t->mode)) < 0) 2074 return -EINVAL; 2075 rq->sadb_x_ipsecrequest_mode = mode; 2076 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE; 2077 if (t->reqid) 2078 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE; 2079 if (t->optional) 2080 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE; 2081 rq->sadb_x_ipsecrequest_reqid = t->reqid; 2082 if (t->mode == XFRM_MODE_TUNNEL) { 2083 switch (t->encap_family) { 2084 case AF_INET: 2085 sin = (void*)(rq+1); 2086 sin->sin_family = AF_INET; 2087 sin->sin_addr.s_addr = t->saddr.a4; 2088 sin->sin_port = 0; 2089 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2090 sin++; 2091 sin->sin_family = AF_INET; 2092 sin->sin_addr.s_addr = t->id.daddr.a4; 2093 sin->sin_port = 0; 2094 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2095 break; 2096 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2097 case AF_INET6: 2098 sin6 = (void*)(rq+1); 2099 sin6->sin6_family = AF_INET6; 2100 sin6->sin6_port = 0; 2101 sin6->sin6_flowinfo = 0; 2102 memcpy(&sin6->sin6_addr, t->saddr.a6, 2103 sizeof(struct in6_addr)); 2104 sin6->sin6_scope_id = 0; 2105 2106 sin6++; 2107 sin6->sin6_family = AF_INET6; 2108 sin6->sin6_port = 0; 2109 sin6->sin6_flowinfo = 0; 2110 memcpy(&sin6->sin6_addr, t->id.daddr.a6, 2111 sizeof(struct in6_addr)); 2112 sin6->sin6_scope_id = 0; 2113 break; 2114 #endif 2115 default: 2116 break; 2117 } 2118 } 2119 } 2120 2121 /* security context */ 2122 if ((xfrm_ctx = xp->security)) { 2123 int ctx_size = pfkey_xfrm_policy2sec_ctx_size(xp); 2124 2125 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, ctx_size); 2126 sec_ctx->sadb_x_sec_len = ctx_size / sizeof(uint64_t); 2127 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 2128 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 2129 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 2130 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 2131 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 2132 xfrm_ctx->ctx_len); 2133 } 2134 2135 hdr->sadb_msg_len = size / sizeof(uint64_t); 2136 hdr->sadb_msg_reserved = atomic_read(&xp->refcnt); 2137 2138 return 0; 2139 } 2140 2141 static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c) 2142 { 2143 struct sk_buff *out_skb; 2144 struct sadb_msg *out_hdr; 2145 int err; 2146 2147 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2148 if (IS_ERR(out_skb)) { 2149 err = PTR_ERR(out_skb); 2150 goto out; 2151 } 2152 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2153 if (err < 0) 2154 return err; 2155 2156 out_hdr = (struct sadb_msg *) out_skb->data; 2157 out_hdr->sadb_msg_version = PF_KEY_V2; 2158 2159 if (c->data.byid && c->event == XFRM_MSG_DELPOLICY) 2160 out_hdr->sadb_msg_type = SADB_X_SPDDELETE2; 2161 else 2162 out_hdr->sadb_msg_type = event2poltype(c->event); 2163 out_hdr->sadb_msg_errno = 0; 2164 out_hdr->sadb_msg_seq = c->seq; 2165 out_hdr->sadb_msg_pid = c->pid; 2166 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 2167 out: 2168 return 0; 2169 2170 } 2171 2172 static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2173 { 2174 int err = 0; 2175 struct sadb_lifetime *lifetime; 2176 struct sadb_address *sa; 2177 struct sadb_x_policy *pol; 2178 struct xfrm_policy *xp; 2179 struct km_event c; 2180 struct sadb_x_sec_ctx *sec_ctx; 2181 2182 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2183 ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || 2184 !ext_hdrs[SADB_X_EXT_POLICY-1]) 2185 return -EINVAL; 2186 2187 pol = ext_hdrs[SADB_X_EXT_POLICY-1]; 2188 if (pol->sadb_x_policy_type > IPSEC_POLICY_IPSEC) 2189 return -EINVAL; 2190 if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) 2191 return -EINVAL; 2192 2193 xp = xfrm_policy_alloc(GFP_KERNEL); 2194 if (xp == NULL) 2195 return -ENOBUFS; 2196 2197 xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? 2198 XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); 2199 xp->priority = pol->sadb_x_policy_priority; 2200 2201 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2202 xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr); 2203 if (!xp->family) { 2204 err = -EINVAL; 2205 goto out; 2206 } 2207 xp->selector.family = xp->family; 2208 xp->selector.prefixlen_s = sa->sadb_address_prefixlen; 2209 xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2210 xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port; 2211 if (xp->selector.sport) 2212 xp->selector.sport_mask = htons(0xffff); 2213 2214 sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 2215 pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr); 2216 xp->selector.prefixlen_d = sa->sadb_address_prefixlen; 2217 2218 /* Amusing, we set this twice. KAME apps appear to set same value 2219 * in both addresses. 2220 */ 2221 xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2222 2223 xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port; 2224 if (xp->selector.dport) 2225 xp->selector.dport_mask = htons(0xffff); 2226 2227 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 2228 if (sec_ctx != NULL) { 2229 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 2230 2231 if (!uctx) { 2232 err = -ENOBUFS; 2233 goto out; 2234 } 2235 2236 err = security_xfrm_policy_alloc(xp, uctx); 2237 kfree(uctx); 2238 2239 if (err) 2240 goto out; 2241 } 2242 2243 xp->lft.soft_byte_limit = XFRM_INF; 2244 xp->lft.hard_byte_limit = XFRM_INF; 2245 xp->lft.soft_packet_limit = XFRM_INF; 2246 xp->lft.hard_packet_limit = XFRM_INF; 2247 if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD-1]) != NULL) { 2248 xp->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 2249 xp->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 2250 xp->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime; 2251 xp->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime; 2252 } 2253 if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) != NULL) { 2254 xp->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 2255 xp->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 2256 xp->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime; 2257 xp->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime; 2258 } 2259 xp->xfrm_nr = 0; 2260 if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 2261 (err = parse_ipsecrequests(xp, pol)) < 0) 2262 goto out; 2263 2264 err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp, 2265 hdr->sadb_msg_type != SADB_X_SPDUPDATE); 2266 2267 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 2268 AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL); 2269 2270 if (err) 2271 goto out; 2272 2273 if (hdr->sadb_msg_type == SADB_X_SPDUPDATE) 2274 c.event = XFRM_MSG_UPDPOLICY; 2275 else 2276 c.event = XFRM_MSG_NEWPOLICY; 2277 2278 c.seq = hdr->sadb_msg_seq; 2279 c.pid = hdr->sadb_msg_pid; 2280 2281 km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c); 2282 xfrm_pol_put(xp); 2283 return 0; 2284 2285 out: 2286 security_xfrm_policy_free(xp); 2287 kfree(xp); 2288 return err; 2289 } 2290 2291 static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2292 { 2293 int err; 2294 struct sadb_address *sa; 2295 struct sadb_x_policy *pol; 2296 struct xfrm_policy *xp, tmp; 2297 struct xfrm_selector sel; 2298 struct km_event c; 2299 struct sadb_x_sec_ctx *sec_ctx; 2300 2301 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2302 ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || 2303 !ext_hdrs[SADB_X_EXT_POLICY-1]) 2304 return -EINVAL; 2305 2306 pol = ext_hdrs[SADB_X_EXT_POLICY-1]; 2307 if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) 2308 return -EINVAL; 2309 2310 memset(&sel, 0, sizeof(sel)); 2311 2312 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2313 sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr); 2314 sel.prefixlen_s = sa->sadb_address_prefixlen; 2315 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2316 sel.sport = ((struct sockaddr_in *)(sa+1))->sin_port; 2317 if (sel.sport) 2318 sel.sport_mask = htons(0xffff); 2319 2320 sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 2321 pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr); 2322 sel.prefixlen_d = sa->sadb_address_prefixlen; 2323 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2324 sel.dport = ((struct sockaddr_in *)(sa+1))->sin_port; 2325 if (sel.dport) 2326 sel.dport_mask = htons(0xffff); 2327 2328 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 2329 memset(&tmp, 0, sizeof(struct xfrm_policy)); 2330 2331 if (sec_ctx != NULL) { 2332 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 2333 2334 if (!uctx) 2335 return -ENOMEM; 2336 2337 err = security_xfrm_policy_alloc(&tmp, uctx); 2338 kfree(uctx); 2339 2340 if (err) 2341 return err; 2342 } 2343 2344 xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1, 2345 &sel, tmp.security, 1, &err); 2346 security_xfrm_policy_free(&tmp); 2347 2348 if (xp == NULL) 2349 return -ENOENT; 2350 2351 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 2352 AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); 2353 2354 if (err) 2355 goto out; 2356 2357 c.seq = hdr->sadb_msg_seq; 2358 c.pid = hdr->sadb_msg_pid; 2359 c.event = XFRM_MSG_DELPOLICY; 2360 km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c); 2361 2362 out: 2363 xfrm_pol_put(xp); 2364 return err; 2365 } 2366 2367 static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, struct sadb_msg *hdr, int dir) 2368 { 2369 int err; 2370 struct sk_buff *out_skb; 2371 struct sadb_msg *out_hdr; 2372 err = 0; 2373 2374 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2375 if (IS_ERR(out_skb)) { 2376 err = PTR_ERR(out_skb); 2377 goto out; 2378 } 2379 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2380 if (err < 0) 2381 goto out; 2382 2383 out_hdr = (struct sadb_msg *) out_skb->data; 2384 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 2385 out_hdr->sadb_msg_type = hdr->sadb_msg_type; 2386 out_hdr->sadb_msg_satype = 0; 2387 out_hdr->sadb_msg_errno = 0; 2388 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 2389 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 2390 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk); 2391 err = 0; 2392 2393 out: 2394 return err; 2395 } 2396 2397 #ifdef CONFIG_NET_KEY_MIGRATE 2398 static int pfkey_sockaddr_pair_size(sa_family_t family) 2399 { 2400 switch (family) { 2401 case AF_INET: 2402 return PFKEY_ALIGN8(sizeof(struct sockaddr_in) * 2); 2403 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2404 case AF_INET6: 2405 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6) * 2); 2406 #endif 2407 default: 2408 return 0; 2409 } 2410 /* NOTREACHED */ 2411 } 2412 2413 static int parse_sockaddr_pair(struct sadb_x_ipsecrequest *rq, 2414 xfrm_address_t *saddr, xfrm_address_t *daddr, 2415 u16 *family) 2416 { 2417 struct sockaddr *sa = (struct sockaddr *)(rq + 1); 2418 if (rq->sadb_x_ipsecrequest_len < 2419 pfkey_sockaddr_pair_size(sa->sa_family)) 2420 return -EINVAL; 2421 2422 switch (sa->sa_family) { 2423 case AF_INET: 2424 { 2425 struct sockaddr_in *sin; 2426 sin = (struct sockaddr_in *)sa; 2427 if ((sin+1)->sin_family != AF_INET) 2428 return -EINVAL; 2429 memcpy(&saddr->a4, &sin->sin_addr, sizeof(saddr->a4)); 2430 sin++; 2431 memcpy(&daddr->a4, &sin->sin_addr, sizeof(daddr->a4)); 2432 *family = AF_INET; 2433 break; 2434 } 2435 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2436 case AF_INET6: 2437 { 2438 struct sockaddr_in6 *sin6; 2439 sin6 = (struct sockaddr_in6 *)sa; 2440 if ((sin6+1)->sin6_family != AF_INET6) 2441 return -EINVAL; 2442 memcpy(&saddr->a6, &sin6->sin6_addr, 2443 sizeof(saddr->a6)); 2444 sin6++; 2445 memcpy(&daddr->a6, &sin6->sin6_addr, 2446 sizeof(daddr->a6)); 2447 *family = AF_INET6; 2448 break; 2449 } 2450 #endif 2451 default: 2452 return -EINVAL; 2453 } 2454 2455 return 0; 2456 } 2457 2458 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, 2459 struct xfrm_migrate *m) 2460 { 2461 int err; 2462 struct sadb_x_ipsecrequest *rq2; 2463 int mode; 2464 2465 if (len <= sizeof(struct sadb_x_ipsecrequest) || 2466 len < rq1->sadb_x_ipsecrequest_len) 2467 return -EINVAL; 2468 2469 /* old endoints */ 2470 err = parse_sockaddr_pair(rq1, &m->old_saddr, &m->old_daddr, 2471 &m->old_family); 2472 if (err) 2473 return err; 2474 2475 rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len); 2476 len -= rq1->sadb_x_ipsecrequest_len; 2477 2478 if (len <= sizeof(struct sadb_x_ipsecrequest) || 2479 len < rq2->sadb_x_ipsecrequest_len) 2480 return -EINVAL; 2481 2482 /* new endpoints */ 2483 err = parse_sockaddr_pair(rq2, &m->new_saddr, &m->new_daddr, 2484 &m->new_family); 2485 if (err) 2486 return err; 2487 2488 if (rq1->sadb_x_ipsecrequest_proto != rq2->sadb_x_ipsecrequest_proto || 2489 rq1->sadb_x_ipsecrequest_mode != rq2->sadb_x_ipsecrequest_mode || 2490 rq1->sadb_x_ipsecrequest_reqid != rq2->sadb_x_ipsecrequest_reqid) 2491 return -EINVAL; 2492 2493 m->proto = rq1->sadb_x_ipsecrequest_proto; 2494 if ((mode = pfkey_mode_to_xfrm(rq1->sadb_x_ipsecrequest_mode)) < 0) 2495 return -EINVAL; 2496 m->mode = mode; 2497 m->reqid = rq1->sadb_x_ipsecrequest_reqid; 2498 2499 return ((int)(rq1->sadb_x_ipsecrequest_len + 2500 rq2->sadb_x_ipsecrequest_len)); 2501 } 2502 2503 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, 2504 struct sadb_msg *hdr, void **ext_hdrs) 2505 { 2506 int i, len, ret, err = -EINVAL; 2507 u8 dir; 2508 struct sadb_address *sa; 2509 struct sadb_x_policy *pol; 2510 struct sadb_x_ipsecrequest *rq; 2511 struct xfrm_selector sel; 2512 struct xfrm_migrate m[XFRM_MAX_DEPTH]; 2513 2514 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1], 2515 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) || 2516 !ext_hdrs[SADB_X_EXT_POLICY - 1]) { 2517 err = -EINVAL; 2518 goto out; 2519 } 2520 2521 pol = ext_hdrs[SADB_X_EXT_POLICY - 1]; 2522 if (!pol) { 2523 err = -EINVAL; 2524 goto out; 2525 } 2526 2527 if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) { 2528 err = -EINVAL; 2529 goto out; 2530 } 2531 2532 dir = pol->sadb_x_policy_dir - 1; 2533 memset(&sel, 0, sizeof(sel)); 2534 2535 /* set source address info of selector */ 2536 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC - 1]; 2537 sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr); 2538 sel.prefixlen_s = sa->sadb_address_prefixlen; 2539 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2540 sel.sport = ((struct sockaddr_in *)(sa + 1))->sin_port; 2541 if (sel.sport) 2542 sel.sport_mask = ~0; 2543 2544 /* set destination address info of selector */ 2545 sa = ext_hdrs[SADB_EXT_ADDRESS_DST - 1], 2546 pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr); 2547 sel.prefixlen_d = sa->sadb_address_prefixlen; 2548 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2549 sel.dport = ((struct sockaddr_in *)(sa + 1))->sin_port; 2550 if (sel.dport) 2551 sel.dport_mask = ~0; 2552 2553 rq = (struct sadb_x_ipsecrequest *)(pol + 1); 2554 2555 /* extract ipsecrequests */ 2556 i = 0; 2557 len = pol->sadb_x_policy_len * 8 - sizeof(struct sadb_x_policy); 2558 2559 while (len > 0 && i < XFRM_MAX_DEPTH) { 2560 ret = ipsecrequests_to_migrate(rq, len, &m[i]); 2561 if (ret < 0) { 2562 err = ret; 2563 goto out; 2564 } else { 2565 rq = (struct sadb_x_ipsecrequest *)((u8 *)rq + ret); 2566 len -= ret; 2567 i++; 2568 } 2569 } 2570 2571 if (!i || len > 0) { 2572 err = -EINVAL; 2573 goto out; 2574 } 2575 2576 return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i); 2577 2578 out: 2579 return err; 2580 } 2581 #else 2582 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, 2583 struct sadb_msg *hdr, void **ext_hdrs) 2584 { 2585 return -ENOPROTOOPT; 2586 } 2587 #endif 2588 2589 2590 static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2591 { 2592 unsigned int dir; 2593 int err = 0, delete; 2594 struct sadb_x_policy *pol; 2595 struct xfrm_policy *xp; 2596 struct km_event c; 2597 2598 if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL) 2599 return -EINVAL; 2600 2601 dir = xfrm_policy_id2dir(pol->sadb_x_policy_id); 2602 if (dir >= XFRM_POLICY_MAX) 2603 return -EINVAL; 2604 2605 delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2); 2606 xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id, 2607 delete, &err); 2608 if (xp == NULL) 2609 return -ENOENT; 2610 2611 if (delete) { 2612 xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, 2613 AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); 2614 2615 if (err) 2616 goto out; 2617 c.seq = hdr->sadb_msg_seq; 2618 c.pid = hdr->sadb_msg_pid; 2619 c.data.byid = 1; 2620 c.event = XFRM_MSG_DELPOLICY; 2621 km_policy_notify(xp, dir, &c); 2622 } else { 2623 err = key_pol_get_resp(sk, xp, hdr, dir); 2624 } 2625 2626 out: 2627 xfrm_pol_put(xp); 2628 return err; 2629 } 2630 2631 static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr) 2632 { 2633 struct pfkey_dump_data *data = ptr; 2634 struct sk_buff *out_skb; 2635 struct sadb_msg *out_hdr; 2636 int err; 2637 2638 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2639 if (IS_ERR(out_skb)) 2640 return PTR_ERR(out_skb); 2641 2642 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2643 if (err < 0) 2644 return err; 2645 2646 out_hdr = (struct sadb_msg *) out_skb->data; 2647 out_hdr->sadb_msg_version = data->hdr->sadb_msg_version; 2648 out_hdr->sadb_msg_type = SADB_X_SPDDUMP; 2649 out_hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; 2650 out_hdr->sadb_msg_errno = 0; 2651 out_hdr->sadb_msg_seq = count; 2652 out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid; 2653 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk); 2654 return 0; 2655 } 2656 2657 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2658 { 2659 struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk }; 2660 2661 return xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_sp, &data); 2662 } 2663 2664 static int key_notify_policy_flush(struct km_event *c) 2665 { 2666 struct sk_buff *skb_out; 2667 struct sadb_msg *hdr; 2668 2669 skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC); 2670 if (!skb_out) 2671 return -ENOBUFS; 2672 hdr = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg)); 2673 hdr->sadb_msg_type = SADB_X_SPDFLUSH; 2674 hdr->sadb_msg_seq = c->seq; 2675 hdr->sadb_msg_pid = c->pid; 2676 hdr->sadb_msg_version = PF_KEY_V2; 2677 hdr->sadb_msg_errno = (uint8_t) 0; 2678 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 2679 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL); 2680 return 0; 2681 2682 } 2683 2684 static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2685 { 2686 struct km_event c; 2687 struct xfrm_audit audit_info; 2688 2689 audit_info.loginuid = audit_get_loginuid(current->audit_context); 2690 audit_info.secid = 0; 2691 xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info); 2692 c.data.type = XFRM_POLICY_TYPE_MAIN; 2693 c.event = XFRM_MSG_FLUSHPOLICY; 2694 c.pid = hdr->sadb_msg_pid; 2695 c.seq = hdr->sadb_msg_seq; 2696 km_policy_notify(NULL, 0, &c); 2697 2698 return 0; 2699 } 2700 2701 typedef int (*pfkey_handler)(struct sock *sk, struct sk_buff *skb, 2702 struct sadb_msg *hdr, void **ext_hdrs); 2703 static pfkey_handler pfkey_funcs[SADB_MAX + 1] = { 2704 [SADB_RESERVED] = pfkey_reserved, 2705 [SADB_GETSPI] = pfkey_getspi, 2706 [SADB_UPDATE] = pfkey_add, 2707 [SADB_ADD] = pfkey_add, 2708 [SADB_DELETE] = pfkey_delete, 2709 [SADB_GET] = pfkey_get, 2710 [SADB_ACQUIRE] = pfkey_acquire, 2711 [SADB_REGISTER] = pfkey_register, 2712 [SADB_EXPIRE] = NULL, 2713 [SADB_FLUSH] = pfkey_flush, 2714 [SADB_DUMP] = pfkey_dump, 2715 [SADB_X_PROMISC] = pfkey_promisc, 2716 [SADB_X_PCHANGE] = NULL, 2717 [SADB_X_SPDUPDATE] = pfkey_spdadd, 2718 [SADB_X_SPDADD] = pfkey_spdadd, 2719 [SADB_X_SPDDELETE] = pfkey_spddelete, 2720 [SADB_X_SPDGET] = pfkey_spdget, 2721 [SADB_X_SPDACQUIRE] = NULL, 2722 [SADB_X_SPDDUMP] = pfkey_spddump, 2723 [SADB_X_SPDFLUSH] = pfkey_spdflush, 2724 [SADB_X_SPDSETIDX] = pfkey_spdadd, 2725 [SADB_X_SPDDELETE2] = pfkey_spdget, 2726 [SADB_X_MIGRATE] = pfkey_migrate, 2727 }; 2728 2729 static int pfkey_process(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr) 2730 { 2731 void *ext_hdrs[SADB_EXT_MAX]; 2732 int err; 2733 2734 pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, 2735 BROADCAST_PROMISC_ONLY, NULL); 2736 2737 memset(ext_hdrs, 0, sizeof(ext_hdrs)); 2738 err = parse_exthdrs(skb, hdr, ext_hdrs); 2739 if (!err) { 2740 err = -EOPNOTSUPP; 2741 if (pfkey_funcs[hdr->sadb_msg_type]) 2742 err = pfkey_funcs[hdr->sadb_msg_type](sk, skb, hdr, ext_hdrs); 2743 } 2744 return err; 2745 } 2746 2747 static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp) 2748 { 2749 struct sadb_msg *hdr = NULL; 2750 2751 if (skb->len < sizeof(*hdr)) { 2752 *errp = -EMSGSIZE; 2753 } else { 2754 hdr = (struct sadb_msg *) skb->data; 2755 if (hdr->sadb_msg_version != PF_KEY_V2 || 2756 hdr->sadb_msg_reserved != 0 || 2757 (hdr->sadb_msg_type <= SADB_RESERVED || 2758 hdr->sadb_msg_type > SADB_MAX)) { 2759 hdr = NULL; 2760 *errp = -EINVAL; 2761 } else if (hdr->sadb_msg_len != (skb->len / 2762 sizeof(uint64_t)) || 2763 hdr->sadb_msg_len < (sizeof(struct sadb_msg) / 2764 sizeof(uint64_t))) { 2765 hdr = NULL; 2766 *errp = -EMSGSIZE; 2767 } else { 2768 *errp = 0; 2769 } 2770 } 2771 return hdr; 2772 } 2773 2774 static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2775 { 2776 return t->aalgos & (1 << d->desc.sadb_alg_id); 2777 } 2778 2779 static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2780 { 2781 return t->ealgos & (1 << d->desc.sadb_alg_id); 2782 } 2783 2784 static int count_ah_combs(struct xfrm_tmpl *t) 2785 { 2786 int i, sz = 0; 2787 2788 for (i = 0; ; i++) { 2789 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 2790 if (!aalg) 2791 break; 2792 if (aalg_tmpl_set(t, aalg) && aalg->available) 2793 sz += sizeof(struct sadb_comb); 2794 } 2795 return sz + sizeof(struct sadb_prop); 2796 } 2797 2798 static int count_esp_combs(struct xfrm_tmpl *t) 2799 { 2800 int i, k, sz = 0; 2801 2802 for (i = 0; ; i++) { 2803 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 2804 if (!ealg) 2805 break; 2806 2807 if (!(ealg_tmpl_set(t, ealg) && ealg->available)) 2808 continue; 2809 2810 for (k = 1; ; k++) { 2811 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k); 2812 if (!aalg) 2813 break; 2814 2815 if (aalg_tmpl_set(t, aalg) && aalg->available) 2816 sz += sizeof(struct sadb_comb); 2817 } 2818 } 2819 return sz + sizeof(struct sadb_prop); 2820 } 2821 2822 static void dump_ah_combs(struct sk_buff *skb, struct xfrm_tmpl *t) 2823 { 2824 struct sadb_prop *p; 2825 int i; 2826 2827 p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop)); 2828 p->sadb_prop_len = sizeof(struct sadb_prop)/8; 2829 p->sadb_prop_exttype = SADB_EXT_PROPOSAL; 2830 p->sadb_prop_replay = 32; 2831 memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved)); 2832 2833 for (i = 0; ; i++) { 2834 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 2835 if (!aalg) 2836 break; 2837 2838 if (aalg_tmpl_set(t, aalg) && aalg->available) { 2839 struct sadb_comb *c; 2840 c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); 2841 memset(c, 0, sizeof(*c)); 2842 p->sadb_prop_len += sizeof(struct sadb_comb)/8; 2843 c->sadb_comb_auth = aalg->desc.sadb_alg_id; 2844 c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits; 2845 c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits; 2846 c->sadb_comb_hard_addtime = 24*60*60; 2847 c->sadb_comb_soft_addtime = 20*60*60; 2848 c->sadb_comb_hard_usetime = 8*60*60; 2849 c->sadb_comb_soft_usetime = 7*60*60; 2850 } 2851 } 2852 } 2853 2854 static void dump_esp_combs(struct sk_buff *skb, struct xfrm_tmpl *t) 2855 { 2856 struct sadb_prop *p; 2857 int i, k; 2858 2859 p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop)); 2860 p->sadb_prop_len = sizeof(struct sadb_prop)/8; 2861 p->sadb_prop_exttype = SADB_EXT_PROPOSAL; 2862 p->sadb_prop_replay = 32; 2863 memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved)); 2864 2865 for (i=0; ; i++) { 2866 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 2867 if (!ealg) 2868 break; 2869 2870 if (!(ealg_tmpl_set(t, ealg) && ealg->available)) 2871 continue; 2872 2873 for (k = 1; ; k++) { 2874 struct sadb_comb *c; 2875 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k); 2876 if (!aalg) 2877 break; 2878 if (!(aalg_tmpl_set(t, aalg) && aalg->available)) 2879 continue; 2880 c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); 2881 memset(c, 0, sizeof(*c)); 2882 p->sadb_prop_len += sizeof(struct sadb_comb)/8; 2883 c->sadb_comb_auth = aalg->desc.sadb_alg_id; 2884 c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits; 2885 c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits; 2886 c->sadb_comb_encrypt = ealg->desc.sadb_alg_id; 2887 c->sadb_comb_encrypt_minbits = ealg->desc.sadb_alg_minbits; 2888 c->sadb_comb_encrypt_maxbits = ealg->desc.sadb_alg_maxbits; 2889 c->sadb_comb_hard_addtime = 24*60*60; 2890 c->sadb_comb_soft_addtime = 20*60*60; 2891 c->sadb_comb_hard_usetime = 8*60*60; 2892 c->sadb_comb_soft_usetime = 7*60*60; 2893 } 2894 } 2895 } 2896 2897 static int key_notify_policy_expire(struct xfrm_policy *xp, struct km_event *c) 2898 { 2899 return 0; 2900 } 2901 2902 static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c) 2903 { 2904 struct sk_buff *out_skb; 2905 struct sadb_msg *out_hdr; 2906 int hard; 2907 int hsc; 2908 2909 hard = c->data.hard; 2910 if (hard) 2911 hsc = 2; 2912 else 2913 hsc = 1; 2914 2915 out_skb = pfkey_xfrm_state2msg(x, 0, hsc); 2916 if (IS_ERR(out_skb)) 2917 return PTR_ERR(out_skb); 2918 2919 out_hdr = (struct sadb_msg *) out_skb->data; 2920 out_hdr->sadb_msg_version = PF_KEY_V2; 2921 out_hdr->sadb_msg_type = SADB_EXPIRE; 2922 out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 2923 out_hdr->sadb_msg_errno = 0; 2924 out_hdr->sadb_msg_reserved = 0; 2925 out_hdr->sadb_msg_seq = 0; 2926 out_hdr->sadb_msg_pid = 0; 2927 2928 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 2929 return 0; 2930 } 2931 2932 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c) 2933 { 2934 switch (c->event) { 2935 case XFRM_MSG_EXPIRE: 2936 return key_notify_sa_expire(x, c); 2937 case XFRM_MSG_DELSA: 2938 case XFRM_MSG_NEWSA: 2939 case XFRM_MSG_UPDSA: 2940 return key_notify_sa(x, c); 2941 case XFRM_MSG_FLUSHSA: 2942 return key_notify_sa_flush(c); 2943 case XFRM_MSG_NEWAE: /* not yet supported */ 2944 break; 2945 default: 2946 printk("pfkey: Unknown SA event %d\n", c->event); 2947 break; 2948 } 2949 2950 return 0; 2951 } 2952 2953 static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 2954 { 2955 if (xp && xp->type != XFRM_POLICY_TYPE_MAIN) 2956 return 0; 2957 2958 switch (c->event) { 2959 case XFRM_MSG_POLEXPIRE: 2960 return key_notify_policy_expire(xp, c); 2961 case XFRM_MSG_DELPOLICY: 2962 case XFRM_MSG_NEWPOLICY: 2963 case XFRM_MSG_UPDPOLICY: 2964 return key_notify_policy(xp, dir, c); 2965 case XFRM_MSG_FLUSHPOLICY: 2966 if (c->data.type != XFRM_POLICY_TYPE_MAIN) 2967 break; 2968 return key_notify_policy_flush(c); 2969 default: 2970 printk("pfkey: Unknown policy event %d\n", c->event); 2971 break; 2972 } 2973 2974 return 0; 2975 } 2976 2977 static u32 get_acqseq(void) 2978 { 2979 u32 res; 2980 static u32 acqseq; 2981 static DEFINE_SPINLOCK(acqseq_lock); 2982 2983 spin_lock_bh(&acqseq_lock); 2984 res = (++acqseq ? : ++acqseq); 2985 spin_unlock_bh(&acqseq_lock); 2986 return res; 2987 } 2988 2989 static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp, int dir) 2990 { 2991 struct sk_buff *skb; 2992 struct sadb_msg *hdr; 2993 struct sadb_address *addr; 2994 struct sadb_x_policy *pol; 2995 struct sockaddr_in *sin; 2996 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2997 struct sockaddr_in6 *sin6; 2998 #endif 2999 int sockaddr_size; 3000 int size; 3001 struct sadb_x_sec_ctx *sec_ctx; 3002 struct xfrm_sec_ctx *xfrm_ctx; 3003 int ctx_size = 0; 3004 3005 sockaddr_size = pfkey_sockaddr_size(x->props.family); 3006 if (!sockaddr_size) 3007 return -EINVAL; 3008 3009 size = sizeof(struct sadb_msg) + 3010 (sizeof(struct sadb_address) * 2) + 3011 (sockaddr_size * 2) + 3012 sizeof(struct sadb_x_policy); 3013 3014 if (x->id.proto == IPPROTO_AH) 3015 size += count_ah_combs(t); 3016 else if (x->id.proto == IPPROTO_ESP) 3017 size += count_esp_combs(t); 3018 3019 if ((xfrm_ctx = x->security)) { 3020 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len); 3021 size += sizeof(struct sadb_x_sec_ctx) + ctx_size; 3022 } 3023 3024 skb = alloc_skb(size + 16, GFP_ATOMIC); 3025 if (skb == NULL) 3026 return -ENOMEM; 3027 3028 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 3029 hdr->sadb_msg_version = PF_KEY_V2; 3030 hdr->sadb_msg_type = SADB_ACQUIRE; 3031 hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 3032 hdr->sadb_msg_len = size / sizeof(uint64_t); 3033 hdr->sadb_msg_errno = 0; 3034 hdr->sadb_msg_reserved = 0; 3035 hdr->sadb_msg_seq = x->km.seq = get_acqseq(); 3036 hdr->sadb_msg_pid = 0; 3037 3038 /* src address */ 3039 addr = (struct sadb_address*) skb_put(skb, 3040 sizeof(struct sadb_address)+sockaddr_size); 3041 addr->sadb_address_len = 3042 (sizeof(struct sadb_address)+sockaddr_size)/ 3043 sizeof(uint64_t); 3044 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 3045 addr->sadb_address_proto = 0; 3046 addr->sadb_address_reserved = 0; 3047 if (x->props.family == AF_INET) { 3048 addr->sadb_address_prefixlen = 32; 3049 3050 sin = (struct sockaddr_in *) (addr + 1); 3051 sin->sin_family = AF_INET; 3052 sin->sin_addr.s_addr = x->props.saddr.a4; 3053 sin->sin_port = 0; 3054 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3055 } 3056 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3057 else if (x->props.family == AF_INET6) { 3058 addr->sadb_address_prefixlen = 128; 3059 3060 sin6 = (struct sockaddr_in6 *) (addr + 1); 3061 sin6->sin6_family = AF_INET6; 3062 sin6->sin6_port = 0; 3063 sin6->sin6_flowinfo = 0; 3064 memcpy(&sin6->sin6_addr, 3065 x->props.saddr.a6, sizeof(struct in6_addr)); 3066 sin6->sin6_scope_id = 0; 3067 } 3068 #endif 3069 else 3070 BUG(); 3071 3072 /* dst address */ 3073 addr = (struct sadb_address*) skb_put(skb, 3074 sizeof(struct sadb_address)+sockaddr_size); 3075 addr->sadb_address_len = 3076 (sizeof(struct sadb_address)+sockaddr_size)/ 3077 sizeof(uint64_t); 3078 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 3079 addr->sadb_address_proto = 0; 3080 addr->sadb_address_reserved = 0; 3081 if (x->props.family == AF_INET) { 3082 addr->sadb_address_prefixlen = 32; 3083 3084 sin = (struct sockaddr_in *) (addr + 1); 3085 sin->sin_family = AF_INET; 3086 sin->sin_addr.s_addr = x->id.daddr.a4; 3087 sin->sin_port = 0; 3088 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3089 } 3090 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3091 else if (x->props.family == AF_INET6) { 3092 addr->sadb_address_prefixlen = 128; 3093 3094 sin6 = (struct sockaddr_in6 *) (addr + 1); 3095 sin6->sin6_family = AF_INET6; 3096 sin6->sin6_port = 0; 3097 sin6->sin6_flowinfo = 0; 3098 memcpy(&sin6->sin6_addr, 3099 x->id.daddr.a6, sizeof(struct in6_addr)); 3100 sin6->sin6_scope_id = 0; 3101 } 3102 #endif 3103 else 3104 BUG(); 3105 3106 pol = (struct sadb_x_policy *) skb_put(skb, sizeof(struct sadb_x_policy)); 3107 pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t); 3108 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 3109 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 3110 pol->sadb_x_policy_dir = dir+1; 3111 pol->sadb_x_policy_id = xp->index; 3112 3113 /* Set sadb_comb's. */ 3114 if (x->id.proto == IPPROTO_AH) 3115 dump_ah_combs(skb, t); 3116 else if (x->id.proto == IPPROTO_ESP) 3117 dump_esp_combs(skb, t); 3118 3119 /* security context */ 3120 if (xfrm_ctx) { 3121 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, 3122 sizeof(struct sadb_x_sec_ctx) + ctx_size); 3123 sec_ctx->sadb_x_sec_len = 3124 (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t); 3125 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 3126 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 3127 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 3128 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 3129 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 3130 xfrm_ctx->ctx_len); 3131 } 3132 3133 return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 3134 } 3135 3136 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, 3137 u8 *data, int len, int *dir) 3138 { 3139 struct xfrm_policy *xp; 3140 struct sadb_x_policy *pol = (struct sadb_x_policy*)data; 3141 struct sadb_x_sec_ctx *sec_ctx; 3142 3143 switch (sk->sk_family) { 3144 case AF_INET: 3145 if (opt != IP_IPSEC_POLICY) { 3146 *dir = -EOPNOTSUPP; 3147 return NULL; 3148 } 3149 break; 3150 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3151 case AF_INET6: 3152 if (opt != IPV6_IPSEC_POLICY) { 3153 *dir = -EOPNOTSUPP; 3154 return NULL; 3155 } 3156 break; 3157 #endif 3158 default: 3159 *dir = -EINVAL; 3160 return NULL; 3161 } 3162 3163 *dir = -EINVAL; 3164 3165 if (len < sizeof(struct sadb_x_policy) || 3166 pol->sadb_x_policy_len*8 > len || 3167 pol->sadb_x_policy_type > IPSEC_POLICY_BYPASS || 3168 (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir > IPSEC_DIR_OUTBOUND)) 3169 return NULL; 3170 3171 xp = xfrm_policy_alloc(GFP_ATOMIC); 3172 if (xp == NULL) { 3173 *dir = -ENOBUFS; 3174 return NULL; 3175 } 3176 3177 xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? 3178 XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); 3179 3180 xp->lft.soft_byte_limit = XFRM_INF; 3181 xp->lft.hard_byte_limit = XFRM_INF; 3182 xp->lft.soft_packet_limit = XFRM_INF; 3183 xp->lft.hard_packet_limit = XFRM_INF; 3184 xp->family = sk->sk_family; 3185 3186 xp->xfrm_nr = 0; 3187 if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 3188 (*dir = parse_ipsecrequests(xp, pol)) < 0) 3189 goto out; 3190 3191 /* security context too */ 3192 if (len >= (pol->sadb_x_policy_len*8 + 3193 sizeof(struct sadb_x_sec_ctx))) { 3194 char *p = (char *)pol; 3195 struct xfrm_user_sec_ctx *uctx; 3196 3197 p += pol->sadb_x_policy_len*8; 3198 sec_ctx = (struct sadb_x_sec_ctx *)p; 3199 if (len < pol->sadb_x_policy_len*8 + 3200 sec_ctx->sadb_x_sec_len) { 3201 *dir = -EINVAL; 3202 goto out; 3203 } 3204 if ((*dir = verify_sec_ctx_len(p))) 3205 goto out; 3206 uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 3207 *dir = security_xfrm_policy_alloc(xp, uctx); 3208 kfree(uctx); 3209 3210 if (*dir) 3211 goto out; 3212 } 3213 3214 *dir = pol->sadb_x_policy_dir-1; 3215 return xp; 3216 3217 out: 3218 security_xfrm_policy_free(xp); 3219 kfree(xp); 3220 return NULL; 3221 } 3222 3223 static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 3224 { 3225 struct sk_buff *skb; 3226 struct sadb_msg *hdr; 3227 struct sadb_sa *sa; 3228 struct sadb_address *addr; 3229 struct sadb_x_nat_t_port *n_port; 3230 struct sockaddr_in *sin; 3231 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3232 struct sockaddr_in6 *sin6; 3233 #endif 3234 int sockaddr_size; 3235 int size; 3236 __u8 satype = (x->id.proto == IPPROTO_ESP ? SADB_SATYPE_ESP : 0); 3237 struct xfrm_encap_tmpl *natt = NULL; 3238 3239 sockaddr_size = pfkey_sockaddr_size(x->props.family); 3240 if (!sockaddr_size) 3241 return -EINVAL; 3242 3243 if (!satype) 3244 return -EINVAL; 3245 3246 if (!x->encap) 3247 return -EINVAL; 3248 3249 natt = x->encap; 3250 3251 /* Build an SADB_X_NAT_T_NEW_MAPPING message: 3252 * 3253 * HDR | SA | ADDRESS_SRC (old addr) | NAT_T_SPORT (old port) | 3254 * ADDRESS_DST (new addr) | NAT_T_DPORT (new port) 3255 */ 3256 3257 size = sizeof(struct sadb_msg) + 3258 sizeof(struct sadb_sa) + 3259 (sizeof(struct sadb_address) * 2) + 3260 (sockaddr_size * 2) + 3261 (sizeof(struct sadb_x_nat_t_port) * 2); 3262 3263 skb = alloc_skb(size + 16, GFP_ATOMIC); 3264 if (skb == NULL) 3265 return -ENOMEM; 3266 3267 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 3268 hdr->sadb_msg_version = PF_KEY_V2; 3269 hdr->sadb_msg_type = SADB_X_NAT_T_NEW_MAPPING; 3270 hdr->sadb_msg_satype = satype; 3271 hdr->sadb_msg_len = size / sizeof(uint64_t); 3272 hdr->sadb_msg_errno = 0; 3273 hdr->sadb_msg_reserved = 0; 3274 hdr->sadb_msg_seq = x->km.seq = get_acqseq(); 3275 hdr->sadb_msg_pid = 0; 3276 3277 /* SA */ 3278 sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa)); 3279 sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t); 3280 sa->sadb_sa_exttype = SADB_EXT_SA; 3281 sa->sadb_sa_spi = x->id.spi; 3282 sa->sadb_sa_replay = 0; 3283 sa->sadb_sa_state = 0; 3284 sa->sadb_sa_auth = 0; 3285 sa->sadb_sa_encrypt = 0; 3286 sa->sadb_sa_flags = 0; 3287 3288 /* ADDRESS_SRC (old addr) */ 3289 addr = (struct sadb_address*) 3290 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size); 3291 addr->sadb_address_len = 3292 (sizeof(struct sadb_address)+sockaddr_size)/ 3293 sizeof(uint64_t); 3294 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 3295 addr->sadb_address_proto = 0; 3296 addr->sadb_address_reserved = 0; 3297 if (x->props.family == AF_INET) { 3298 addr->sadb_address_prefixlen = 32; 3299 3300 sin = (struct sockaddr_in *) (addr + 1); 3301 sin->sin_family = AF_INET; 3302 sin->sin_addr.s_addr = x->props.saddr.a4; 3303 sin->sin_port = 0; 3304 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3305 } 3306 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3307 else if (x->props.family == AF_INET6) { 3308 addr->sadb_address_prefixlen = 128; 3309 3310 sin6 = (struct sockaddr_in6 *) (addr + 1); 3311 sin6->sin6_family = AF_INET6; 3312 sin6->sin6_port = 0; 3313 sin6->sin6_flowinfo = 0; 3314 memcpy(&sin6->sin6_addr, 3315 x->props.saddr.a6, sizeof(struct in6_addr)); 3316 sin6->sin6_scope_id = 0; 3317 } 3318 #endif 3319 else 3320 BUG(); 3321 3322 /* NAT_T_SPORT (old port) */ 3323 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 3324 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 3325 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT; 3326 n_port->sadb_x_nat_t_port_port = natt->encap_sport; 3327 n_port->sadb_x_nat_t_port_reserved = 0; 3328 3329 /* ADDRESS_DST (new addr) */ 3330 addr = (struct sadb_address*) 3331 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size); 3332 addr->sadb_address_len = 3333 (sizeof(struct sadb_address)+sockaddr_size)/ 3334 sizeof(uint64_t); 3335 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 3336 addr->sadb_address_proto = 0; 3337 addr->sadb_address_reserved = 0; 3338 if (x->props.family == AF_INET) { 3339 addr->sadb_address_prefixlen = 32; 3340 3341 sin = (struct sockaddr_in *) (addr + 1); 3342 sin->sin_family = AF_INET; 3343 sin->sin_addr.s_addr = ipaddr->a4; 3344 sin->sin_port = 0; 3345 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3346 } 3347 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3348 else if (x->props.family == AF_INET6) { 3349 addr->sadb_address_prefixlen = 128; 3350 3351 sin6 = (struct sockaddr_in6 *) (addr + 1); 3352 sin6->sin6_family = AF_INET6; 3353 sin6->sin6_port = 0; 3354 sin6->sin6_flowinfo = 0; 3355 memcpy(&sin6->sin6_addr, &ipaddr->a6, sizeof(struct in6_addr)); 3356 sin6->sin6_scope_id = 0; 3357 } 3358 #endif 3359 else 3360 BUG(); 3361 3362 /* NAT_T_DPORT (new port) */ 3363 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 3364 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 3365 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT; 3366 n_port->sadb_x_nat_t_port_port = sport; 3367 n_port->sadb_x_nat_t_port_reserved = 0; 3368 3369 return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 3370 } 3371 3372 #ifdef CONFIG_NET_KEY_MIGRATE 3373 static int set_sadb_address(struct sk_buff *skb, int sasize, int type, 3374 struct xfrm_selector *sel) 3375 { 3376 struct sadb_address *addr; 3377 struct sockaddr_in *sin; 3378 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3379 struct sockaddr_in6 *sin6; 3380 #endif 3381 addr = (struct sadb_address *)skb_put(skb, sizeof(struct sadb_address) + sasize); 3382 addr->sadb_address_len = (sizeof(struct sadb_address) + sasize)/8; 3383 addr->sadb_address_exttype = type; 3384 addr->sadb_address_proto = sel->proto; 3385 addr->sadb_address_reserved = 0; 3386 3387 switch (type) { 3388 case SADB_EXT_ADDRESS_SRC: 3389 if (sel->family == AF_INET) { 3390 addr->sadb_address_prefixlen = sel->prefixlen_s; 3391 sin = (struct sockaddr_in *)(addr + 1); 3392 sin->sin_family = AF_INET; 3393 memcpy(&sin->sin_addr.s_addr, &sel->saddr, 3394 sizeof(sin->sin_addr.s_addr)); 3395 sin->sin_port = 0; 3396 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3397 } 3398 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3399 else if (sel->family == AF_INET6) { 3400 addr->sadb_address_prefixlen = sel->prefixlen_s; 3401 sin6 = (struct sockaddr_in6 *)(addr + 1); 3402 sin6->sin6_family = AF_INET6; 3403 sin6->sin6_port = 0; 3404 sin6->sin6_flowinfo = 0; 3405 sin6->sin6_scope_id = 0; 3406 memcpy(&sin6->sin6_addr.s6_addr, &sel->saddr, 3407 sizeof(sin6->sin6_addr.s6_addr)); 3408 } 3409 #endif 3410 break; 3411 case SADB_EXT_ADDRESS_DST: 3412 if (sel->family == AF_INET) { 3413 addr->sadb_address_prefixlen = sel->prefixlen_d; 3414 sin = (struct sockaddr_in *)(addr + 1); 3415 sin->sin_family = AF_INET; 3416 memcpy(&sin->sin_addr.s_addr, &sel->daddr, 3417 sizeof(sin->sin_addr.s_addr)); 3418 sin->sin_port = 0; 3419 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3420 } 3421 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3422 else if (sel->family == AF_INET6) { 3423 addr->sadb_address_prefixlen = sel->prefixlen_d; 3424 sin6 = (struct sockaddr_in6 *)(addr + 1); 3425 sin6->sin6_family = AF_INET6; 3426 sin6->sin6_port = 0; 3427 sin6->sin6_flowinfo = 0; 3428 sin6->sin6_scope_id = 0; 3429 memcpy(&sin6->sin6_addr.s6_addr, &sel->daddr, 3430 sizeof(sin6->sin6_addr.s6_addr)); 3431 } 3432 #endif 3433 break; 3434 default: 3435 return -EINVAL; 3436 } 3437 3438 return 0; 3439 } 3440 3441 static int set_ipsecrequest(struct sk_buff *skb, 3442 uint8_t proto, uint8_t mode, int level, 3443 uint32_t reqid, uint8_t family, 3444 xfrm_address_t *src, xfrm_address_t *dst) 3445 { 3446 struct sadb_x_ipsecrequest *rq; 3447 struct sockaddr_in *sin; 3448 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3449 struct sockaddr_in6 *sin6; 3450 #endif 3451 int size_req; 3452 3453 size_req = sizeof(struct sadb_x_ipsecrequest) + 3454 pfkey_sockaddr_pair_size(family); 3455 3456 rq = (struct sadb_x_ipsecrequest *)skb_put(skb, size_req); 3457 memset(rq, 0, size_req); 3458 rq->sadb_x_ipsecrequest_len = size_req; 3459 rq->sadb_x_ipsecrequest_proto = proto; 3460 rq->sadb_x_ipsecrequest_mode = mode; 3461 rq->sadb_x_ipsecrequest_level = level; 3462 rq->sadb_x_ipsecrequest_reqid = reqid; 3463 3464 switch (family) { 3465 case AF_INET: 3466 sin = (struct sockaddr_in *)(rq + 1); 3467 sin->sin_family = AF_INET; 3468 memcpy(&sin->sin_addr.s_addr, src, 3469 sizeof(sin->sin_addr.s_addr)); 3470 sin++; 3471 sin->sin_family = AF_INET; 3472 memcpy(&sin->sin_addr.s_addr, dst, 3473 sizeof(sin->sin_addr.s_addr)); 3474 break; 3475 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3476 case AF_INET6: 3477 sin6 = (struct sockaddr_in6 *)(rq + 1); 3478 sin6->sin6_family = AF_INET6; 3479 sin6->sin6_port = 0; 3480 sin6->sin6_flowinfo = 0; 3481 sin6->sin6_scope_id = 0; 3482 memcpy(&sin6->sin6_addr.s6_addr, src, 3483 sizeof(sin6->sin6_addr.s6_addr)); 3484 sin6++; 3485 sin6->sin6_family = AF_INET6; 3486 sin6->sin6_port = 0; 3487 sin6->sin6_flowinfo = 0; 3488 sin6->sin6_scope_id = 0; 3489 memcpy(&sin6->sin6_addr.s6_addr, dst, 3490 sizeof(sin6->sin6_addr.s6_addr)); 3491 break; 3492 #endif 3493 default: 3494 return -EINVAL; 3495 } 3496 3497 return 0; 3498 } 3499 #endif 3500 3501 #ifdef CONFIG_NET_KEY_MIGRATE 3502 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 3503 struct xfrm_migrate *m, int num_bundles) 3504 { 3505 int i; 3506 int sasize_sel; 3507 int size = 0; 3508 int size_pol = 0; 3509 struct sk_buff *skb; 3510 struct sadb_msg *hdr; 3511 struct sadb_x_policy *pol; 3512 struct xfrm_migrate *mp; 3513 3514 if (type != XFRM_POLICY_TYPE_MAIN) 3515 return 0; 3516 3517 if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH) 3518 return -EINVAL; 3519 3520 /* selector */ 3521 sasize_sel = pfkey_sockaddr_size(sel->family); 3522 if (!sasize_sel) 3523 return -EINVAL; 3524 size += (sizeof(struct sadb_address) + sasize_sel) * 2; 3525 3526 /* policy info */ 3527 size_pol += sizeof(struct sadb_x_policy); 3528 3529 /* ipsecrequests */ 3530 for (i = 0, mp = m; i < num_bundles; i++, mp++) { 3531 /* old locator pair */ 3532 size_pol += sizeof(struct sadb_x_ipsecrequest) + 3533 pfkey_sockaddr_pair_size(mp->old_family); 3534 /* new locator pair */ 3535 size_pol += sizeof(struct sadb_x_ipsecrequest) + 3536 pfkey_sockaddr_pair_size(mp->new_family); 3537 } 3538 3539 size += sizeof(struct sadb_msg) + size_pol; 3540 3541 /* alloc buffer */ 3542 skb = alloc_skb(size, GFP_ATOMIC); 3543 if (skb == NULL) 3544 return -ENOMEM; 3545 3546 hdr = (struct sadb_msg *)skb_put(skb, sizeof(struct sadb_msg)); 3547 hdr->sadb_msg_version = PF_KEY_V2; 3548 hdr->sadb_msg_type = SADB_X_MIGRATE; 3549 hdr->sadb_msg_satype = pfkey_proto2satype(m->proto); 3550 hdr->sadb_msg_len = size / 8; 3551 hdr->sadb_msg_errno = 0; 3552 hdr->sadb_msg_reserved = 0; 3553 hdr->sadb_msg_seq = 0; 3554 hdr->sadb_msg_pid = 0; 3555 3556 /* selector src */ 3557 set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel); 3558 3559 /* selector dst */ 3560 set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_DST, sel); 3561 3562 /* policy information */ 3563 pol = (struct sadb_x_policy *)skb_put(skb, sizeof(struct sadb_x_policy)); 3564 pol->sadb_x_policy_len = size_pol / 8; 3565 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 3566 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 3567 pol->sadb_x_policy_dir = dir + 1; 3568 pol->sadb_x_policy_id = 0; 3569 pol->sadb_x_policy_priority = 0; 3570 3571 for (i = 0, mp = m; i < num_bundles; i++, mp++) { 3572 /* old ipsecrequest */ 3573 int mode = pfkey_mode_from_xfrm(mp->mode); 3574 if (mode < 0) 3575 return -EINVAL; 3576 if (set_ipsecrequest(skb, mp->proto, mode, 3577 (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), 3578 mp->reqid, mp->old_family, 3579 &mp->old_saddr, &mp->old_daddr) < 0) { 3580 return -EINVAL; 3581 } 3582 3583 /* new ipsecrequest */ 3584 if (set_ipsecrequest(skb, mp->proto, mode, 3585 (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), 3586 mp->reqid, mp->new_family, 3587 &mp->new_saddr, &mp->new_daddr) < 0) { 3588 return -EINVAL; 3589 } 3590 } 3591 3592 /* broadcast migrate message to sockets */ 3593 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 3594 3595 return 0; 3596 } 3597 #else 3598 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 3599 struct xfrm_migrate *m, int num_bundles) 3600 { 3601 return -ENOPROTOOPT; 3602 } 3603 #endif 3604 3605 static int pfkey_sendmsg(struct kiocb *kiocb, 3606 struct socket *sock, struct msghdr *msg, size_t len) 3607 { 3608 struct sock *sk = sock->sk; 3609 struct sk_buff *skb = NULL; 3610 struct sadb_msg *hdr = NULL; 3611 int err; 3612 3613 err = -EOPNOTSUPP; 3614 if (msg->msg_flags & MSG_OOB) 3615 goto out; 3616 3617 err = -EMSGSIZE; 3618 if ((unsigned)len > sk->sk_sndbuf - 32) 3619 goto out; 3620 3621 err = -ENOBUFS; 3622 skb = alloc_skb(len, GFP_KERNEL); 3623 if (skb == NULL) 3624 goto out; 3625 3626 err = -EFAULT; 3627 if (memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len)) 3628 goto out; 3629 3630 hdr = pfkey_get_base_msg(skb, &err); 3631 if (!hdr) 3632 goto out; 3633 3634 mutex_lock(&xfrm_cfg_mutex); 3635 err = pfkey_process(sk, skb, hdr); 3636 mutex_unlock(&xfrm_cfg_mutex); 3637 3638 out: 3639 if (err && hdr && pfkey_error(hdr, err, sk) == 0) 3640 err = 0; 3641 if (skb) 3642 kfree_skb(skb); 3643 3644 return err ? : len; 3645 } 3646 3647 static int pfkey_recvmsg(struct kiocb *kiocb, 3648 struct socket *sock, struct msghdr *msg, size_t len, 3649 int flags) 3650 { 3651 struct sock *sk = sock->sk; 3652 struct sk_buff *skb; 3653 int copied, err; 3654 3655 err = -EINVAL; 3656 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT)) 3657 goto out; 3658 3659 msg->msg_namelen = 0; 3660 skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err); 3661 if (skb == NULL) 3662 goto out; 3663 3664 copied = skb->len; 3665 if (copied > len) { 3666 msg->msg_flags |= MSG_TRUNC; 3667 copied = len; 3668 } 3669 3670 skb_reset_transport_header(skb); 3671 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 3672 if (err) 3673 goto out_free; 3674 3675 sock_recv_timestamp(msg, sk, skb); 3676 3677 err = (flags & MSG_TRUNC) ? skb->len : copied; 3678 3679 out_free: 3680 skb_free_datagram(sk, skb); 3681 out: 3682 return err; 3683 } 3684 3685 static const struct proto_ops pfkey_ops = { 3686 .family = PF_KEY, 3687 .owner = THIS_MODULE, 3688 /* Operations that make no sense on pfkey sockets. */ 3689 .bind = sock_no_bind, 3690 .connect = sock_no_connect, 3691 .socketpair = sock_no_socketpair, 3692 .accept = sock_no_accept, 3693 .getname = sock_no_getname, 3694 .ioctl = sock_no_ioctl, 3695 .listen = sock_no_listen, 3696 .shutdown = sock_no_shutdown, 3697 .setsockopt = sock_no_setsockopt, 3698 .getsockopt = sock_no_getsockopt, 3699 .mmap = sock_no_mmap, 3700 .sendpage = sock_no_sendpage, 3701 3702 /* Now the operations that really occur. */ 3703 .release = pfkey_release, 3704 .poll = datagram_poll, 3705 .sendmsg = pfkey_sendmsg, 3706 .recvmsg = pfkey_recvmsg, 3707 }; 3708 3709 static struct net_proto_family pfkey_family_ops = { 3710 .family = PF_KEY, 3711 .create = pfkey_create, 3712 .owner = THIS_MODULE, 3713 }; 3714 3715 #ifdef CONFIG_PROC_FS 3716 static int pfkey_read_proc(char *buffer, char **start, off_t offset, 3717 int length, int *eof, void *data) 3718 { 3719 off_t pos = 0; 3720 off_t begin = 0; 3721 int len = 0; 3722 struct sock *s; 3723 struct hlist_node *node; 3724 3725 len += sprintf(buffer,"sk RefCnt Rmem Wmem User Inode\n"); 3726 3727 read_lock(&pfkey_table_lock); 3728 3729 sk_for_each(s, node, &pfkey_table) { 3730 len += sprintf(buffer+len,"%p %-6d %-6u %-6u %-6u %-6lu", 3731 s, 3732 atomic_read(&s->sk_refcnt), 3733 atomic_read(&s->sk_rmem_alloc), 3734 atomic_read(&s->sk_wmem_alloc), 3735 sock_i_uid(s), 3736 sock_i_ino(s) 3737 ); 3738 3739 buffer[len++] = '\n'; 3740 3741 pos = begin + len; 3742 if (pos < offset) { 3743 len = 0; 3744 begin = pos; 3745 } 3746 if(pos > offset + length) 3747 goto done; 3748 } 3749 *eof = 1; 3750 3751 done: 3752 read_unlock(&pfkey_table_lock); 3753 3754 *start = buffer + (offset - begin); 3755 len -= (offset - begin); 3756 3757 if (len > length) 3758 len = length; 3759 if (len < 0) 3760 len = 0; 3761 3762 return len; 3763 } 3764 #endif 3765 3766 static struct xfrm_mgr pfkeyv2_mgr = 3767 { 3768 .id = "pfkeyv2", 3769 .notify = pfkey_send_notify, 3770 .acquire = pfkey_send_acquire, 3771 .compile_policy = pfkey_compile_policy, 3772 .new_mapping = pfkey_send_new_mapping, 3773 .notify_policy = pfkey_send_policy_notify, 3774 .migrate = pfkey_send_migrate, 3775 }; 3776 3777 static void __exit ipsec_pfkey_exit(void) 3778 { 3779 xfrm_unregister_km(&pfkeyv2_mgr); 3780 remove_proc_entry("net/pfkey", NULL); 3781 sock_unregister(PF_KEY); 3782 proto_unregister(&key_proto); 3783 } 3784 3785 static int __init ipsec_pfkey_init(void) 3786 { 3787 int err = proto_register(&key_proto, 0); 3788 3789 if (err != 0) 3790 goto out; 3791 3792 err = sock_register(&pfkey_family_ops); 3793 if (err != 0) 3794 goto out_unregister_key_proto; 3795 #ifdef CONFIG_PROC_FS 3796 err = -ENOMEM; 3797 if (create_proc_read_entry("net/pfkey", 0, NULL, pfkey_read_proc, NULL) == NULL) 3798 goto out_sock_unregister; 3799 #endif 3800 err = xfrm_register_km(&pfkeyv2_mgr); 3801 if (err != 0) 3802 goto out_remove_proc_entry; 3803 out: 3804 return err; 3805 out_remove_proc_entry: 3806 #ifdef CONFIG_PROC_FS 3807 remove_proc_entry("net/pfkey", NULL); 3808 out_sock_unregister: 3809 #endif 3810 sock_unregister(PF_KEY); 3811 out_unregister_key_proto: 3812 proto_unregister(&key_proto); 3813 goto out; 3814 } 3815 3816 module_init(ipsec_pfkey_init); 3817 module_exit(ipsec_pfkey_exit); 3818 MODULE_LICENSE("GPL"); 3819 MODULE_ALIAS_NETPROTO(PF_KEY); 3820