1 /* 2 * net/key/af_key.c An implementation of PF_KEYv2 sockets. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Maxim Giryaev <gem@asplinux.ru> 10 * David S. Miller <davem@redhat.com> 11 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 12 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 13 * Kazunori MIYAZAWA / USAGI Project <miyazawa@linux-ipv6.org> 14 * Derek Atkins <derek@ihtfp.com> 15 */ 16 17 #include <linux/capability.h> 18 #include <linux/module.h> 19 #include <linux/kernel.h> 20 #include <linux/socket.h> 21 #include <linux/pfkeyv2.h> 22 #include <linux/ipsec.h> 23 #include <linux/skbuff.h> 24 #include <linux/rtnetlink.h> 25 #include <linux/in.h> 26 #include <linux/in6.h> 27 #include <linux/proc_fs.h> 28 #include <linux/init.h> 29 #include <net/net_namespace.h> 30 #include <net/xfrm.h> 31 32 #include <net/sock.h> 33 34 #define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x)) 35 #define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x)) 36 37 38 /* List of all pfkey sockets. */ 39 static HLIST_HEAD(pfkey_table); 40 static DECLARE_WAIT_QUEUE_HEAD(pfkey_table_wait); 41 static DEFINE_RWLOCK(pfkey_table_lock); 42 static atomic_t pfkey_table_users = ATOMIC_INIT(0); 43 44 static atomic_t pfkey_socks_nr = ATOMIC_INIT(0); 45 46 struct pfkey_sock { 47 /* struct sock must be the first member of struct pfkey_sock */ 48 struct sock sk; 49 int registered; 50 int promisc; 51 52 struct { 53 uint8_t msg_version; 54 uint32_t msg_pid; 55 int (*dump)(struct pfkey_sock *sk); 56 void (*done)(struct pfkey_sock *sk); 57 union { 58 struct xfrm_policy_walk policy; 59 struct xfrm_state_walk state; 60 } u; 61 } dump; 62 }; 63 64 static inline struct pfkey_sock *pfkey_sk(struct sock *sk) 65 { 66 return (struct pfkey_sock *)sk; 67 } 68 69 static int pfkey_can_dump(struct sock *sk) 70 { 71 if (3 * atomic_read(&sk->sk_rmem_alloc) <= 2 * sk->sk_rcvbuf) 72 return 1; 73 return 0; 74 } 75 76 static int pfkey_do_dump(struct pfkey_sock *pfk) 77 { 78 int rc; 79 80 rc = pfk->dump.dump(pfk); 81 if (rc == -ENOBUFS) 82 return 0; 83 84 pfk->dump.done(pfk); 85 pfk->dump.dump = NULL; 86 pfk->dump.done = NULL; 87 return rc; 88 } 89 90 static void pfkey_sock_destruct(struct sock *sk) 91 { 92 skb_queue_purge(&sk->sk_receive_queue); 93 94 if (!sock_flag(sk, SOCK_DEAD)) { 95 printk("Attempt to release alive pfkey socket: %p\n", sk); 96 return; 97 } 98 99 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc)); 100 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc)); 101 102 atomic_dec(&pfkey_socks_nr); 103 } 104 105 static void pfkey_table_grab(void) 106 { 107 write_lock_bh(&pfkey_table_lock); 108 109 if (atomic_read(&pfkey_table_users)) { 110 DECLARE_WAITQUEUE(wait, current); 111 112 add_wait_queue_exclusive(&pfkey_table_wait, &wait); 113 for(;;) { 114 set_current_state(TASK_UNINTERRUPTIBLE); 115 if (atomic_read(&pfkey_table_users) == 0) 116 break; 117 write_unlock_bh(&pfkey_table_lock); 118 schedule(); 119 write_lock_bh(&pfkey_table_lock); 120 } 121 122 __set_current_state(TASK_RUNNING); 123 remove_wait_queue(&pfkey_table_wait, &wait); 124 } 125 } 126 127 static __inline__ void pfkey_table_ungrab(void) 128 { 129 write_unlock_bh(&pfkey_table_lock); 130 wake_up(&pfkey_table_wait); 131 } 132 133 static __inline__ void pfkey_lock_table(void) 134 { 135 /* read_lock() synchronizes us to pfkey_table_grab */ 136 137 read_lock(&pfkey_table_lock); 138 atomic_inc(&pfkey_table_users); 139 read_unlock(&pfkey_table_lock); 140 } 141 142 static __inline__ void pfkey_unlock_table(void) 143 { 144 if (atomic_dec_and_test(&pfkey_table_users)) 145 wake_up(&pfkey_table_wait); 146 } 147 148 149 static const struct proto_ops pfkey_ops; 150 151 static void pfkey_insert(struct sock *sk) 152 { 153 pfkey_table_grab(); 154 sk_add_node(sk, &pfkey_table); 155 pfkey_table_ungrab(); 156 } 157 158 static void pfkey_remove(struct sock *sk) 159 { 160 pfkey_table_grab(); 161 sk_del_node_init(sk); 162 pfkey_table_ungrab(); 163 } 164 165 static struct proto key_proto = { 166 .name = "KEY", 167 .owner = THIS_MODULE, 168 .obj_size = sizeof(struct pfkey_sock), 169 }; 170 171 static int pfkey_create(struct net *net, struct socket *sock, int protocol) 172 { 173 struct sock *sk; 174 int err; 175 176 if (net != &init_net) 177 return -EAFNOSUPPORT; 178 179 if (!capable(CAP_NET_ADMIN)) 180 return -EPERM; 181 if (sock->type != SOCK_RAW) 182 return -ESOCKTNOSUPPORT; 183 if (protocol != PF_KEY_V2) 184 return -EPROTONOSUPPORT; 185 186 err = -ENOMEM; 187 sk = sk_alloc(net, PF_KEY, GFP_KERNEL, &key_proto); 188 if (sk == NULL) 189 goto out; 190 191 sock->ops = &pfkey_ops; 192 sock_init_data(sock, sk); 193 194 sk->sk_family = PF_KEY; 195 sk->sk_destruct = pfkey_sock_destruct; 196 197 atomic_inc(&pfkey_socks_nr); 198 199 pfkey_insert(sk); 200 201 return 0; 202 out: 203 return err; 204 } 205 206 static int pfkey_release(struct socket *sock) 207 { 208 struct sock *sk = sock->sk; 209 210 if (!sk) 211 return 0; 212 213 pfkey_remove(sk); 214 215 sock_orphan(sk); 216 sock->sk = NULL; 217 skb_queue_purge(&sk->sk_write_queue); 218 sock_put(sk); 219 220 return 0; 221 } 222 223 static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, 224 gfp_t allocation, struct sock *sk) 225 { 226 int err = -ENOBUFS; 227 228 sock_hold(sk); 229 if (*skb2 == NULL) { 230 if (atomic_read(&skb->users) != 1) { 231 *skb2 = skb_clone(skb, allocation); 232 } else { 233 *skb2 = skb; 234 atomic_inc(&skb->users); 235 } 236 } 237 if (*skb2 != NULL) { 238 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) { 239 skb_orphan(*skb2); 240 skb_set_owner_r(*skb2, sk); 241 skb_queue_tail(&sk->sk_receive_queue, *skb2); 242 sk->sk_data_ready(sk, (*skb2)->len); 243 *skb2 = NULL; 244 err = 0; 245 } 246 } 247 sock_put(sk); 248 return err; 249 } 250 251 /* Send SKB to all pfkey sockets matching selected criteria. */ 252 #define BROADCAST_ALL 0 253 #define BROADCAST_ONE 1 254 #define BROADCAST_REGISTERED 2 255 #define BROADCAST_PROMISC_ONLY 4 256 static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, 257 int broadcast_flags, struct sock *one_sk) 258 { 259 struct sock *sk; 260 struct hlist_node *node; 261 struct sk_buff *skb2 = NULL; 262 int err = -ESRCH; 263 264 /* XXX Do we need something like netlink_overrun? I think 265 * XXX PF_KEY socket apps will not mind current behavior. 266 */ 267 if (!skb) 268 return -ENOMEM; 269 270 pfkey_lock_table(); 271 sk_for_each(sk, node, &pfkey_table) { 272 struct pfkey_sock *pfk = pfkey_sk(sk); 273 int err2; 274 275 /* Yes, it means that if you are meant to receive this 276 * pfkey message you receive it twice as promiscuous 277 * socket. 278 */ 279 if (pfk->promisc) 280 pfkey_broadcast_one(skb, &skb2, allocation, sk); 281 282 /* the exact target will be processed later */ 283 if (sk == one_sk) 284 continue; 285 if (broadcast_flags != BROADCAST_ALL) { 286 if (broadcast_flags & BROADCAST_PROMISC_ONLY) 287 continue; 288 if ((broadcast_flags & BROADCAST_REGISTERED) && 289 !pfk->registered) 290 continue; 291 if (broadcast_flags & BROADCAST_ONE) 292 continue; 293 } 294 295 err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk); 296 297 /* Error is cleare after succecful sending to at least one 298 * registered KM */ 299 if ((broadcast_flags & BROADCAST_REGISTERED) && err) 300 err = err2; 301 } 302 pfkey_unlock_table(); 303 304 if (one_sk != NULL) 305 err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk); 306 307 if (skb2) 308 kfree_skb(skb2); 309 kfree_skb(skb); 310 return err; 311 } 312 313 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig) 314 { 315 *new = *orig; 316 } 317 318 static int pfkey_error(struct sadb_msg *orig, int err, struct sock *sk) 319 { 320 struct sk_buff *skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_KERNEL); 321 struct sadb_msg *hdr; 322 323 if (!skb) 324 return -ENOBUFS; 325 326 /* Woe be to the platform trying to support PFKEY yet 327 * having normal errnos outside the 1-255 range, inclusive. 328 */ 329 err = -err; 330 if (err == ERESTARTSYS || 331 err == ERESTARTNOHAND || 332 err == ERESTARTNOINTR) 333 err = EINTR; 334 if (err >= 512) 335 err = EINVAL; 336 BUG_ON(err <= 0 || err >= 256); 337 338 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 339 pfkey_hdr_dup(hdr, orig); 340 hdr->sadb_msg_errno = (uint8_t) err; 341 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / 342 sizeof(uint64_t)); 343 344 pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk); 345 346 return 0; 347 } 348 349 static u8 sadb_ext_min_len[] = { 350 [SADB_EXT_RESERVED] = (u8) 0, 351 [SADB_EXT_SA] = (u8) sizeof(struct sadb_sa), 352 [SADB_EXT_LIFETIME_CURRENT] = (u8) sizeof(struct sadb_lifetime), 353 [SADB_EXT_LIFETIME_HARD] = (u8) sizeof(struct sadb_lifetime), 354 [SADB_EXT_LIFETIME_SOFT] = (u8) sizeof(struct sadb_lifetime), 355 [SADB_EXT_ADDRESS_SRC] = (u8) sizeof(struct sadb_address), 356 [SADB_EXT_ADDRESS_DST] = (u8) sizeof(struct sadb_address), 357 [SADB_EXT_ADDRESS_PROXY] = (u8) sizeof(struct sadb_address), 358 [SADB_EXT_KEY_AUTH] = (u8) sizeof(struct sadb_key), 359 [SADB_EXT_KEY_ENCRYPT] = (u8) sizeof(struct sadb_key), 360 [SADB_EXT_IDENTITY_SRC] = (u8) sizeof(struct sadb_ident), 361 [SADB_EXT_IDENTITY_DST] = (u8) sizeof(struct sadb_ident), 362 [SADB_EXT_SENSITIVITY] = (u8) sizeof(struct sadb_sens), 363 [SADB_EXT_PROPOSAL] = (u8) sizeof(struct sadb_prop), 364 [SADB_EXT_SUPPORTED_AUTH] = (u8) sizeof(struct sadb_supported), 365 [SADB_EXT_SUPPORTED_ENCRYPT] = (u8) sizeof(struct sadb_supported), 366 [SADB_EXT_SPIRANGE] = (u8) sizeof(struct sadb_spirange), 367 [SADB_X_EXT_KMPRIVATE] = (u8) sizeof(struct sadb_x_kmprivate), 368 [SADB_X_EXT_POLICY] = (u8) sizeof(struct sadb_x_policy), 369 [SADB_X_EXT_SA2] = (u8) sizeof(struct sadb_x_sa2), 370 [SADB_X_EXT_NAT_T_TYPE] = (u8) sizeof(struct sadb_x_nat_t_type), 371 [SADB_X_EXT_NAT_T_SPORT] = (u8) sizeof(struct sadb_x_nat_t_port), 372 [SADB_X_EXT_NAT_T_DPORT] = (u8) sizeof(struct sadb_x_nat_t_port), 373 [SADB_X_EXT_NAT_T_OA] = (u8) sizeof(struct sadb_address), 374 [SADB_X_EXT_SEC_CTX] = (u8) sizeof(struct sadb_x_sec_ctx), 375 }; 376 377 /* Verify sadb_address_{len,prefixlen} against sa_family. */ 378 static int verify_address_len(void *p) 379 { 380 struct sadb_address *sp = p; 381 struct sockaddr *addr = (struct sockaddr *)(sp + 1); 382 struct sockaddr_in *sin; 383 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 384 struct sockaddr_in6 *sin6; 385 #endif 386 int len; 387 388 switch (addr->sa_family) { 389 case AF_INET: 390 len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin), sizeof(uint64_t)); 391 if (sp->sadb_address_len != len || 392 sp->sadb_address_prefixlen > 32) 393 return -EINVAL; 394 break; 395 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 396 case AF_INET6: 397 len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin6), sizeof(uint64_t)); 398 if (sp->sadb_address_len != len || 399 sp->sadb_address_prefixlen > 128) 400 return -EINVAL; 401 break; 402 #endif 403 default: 404 /* It is user using kernel to keep track of security 405 * associations for another protocol, such as 406 * OSPF/RSVP/RIPV2/MIP. It is user's job to verify 407 * lengths. 408 * 409 * XXX Actually, association/policy database is not yet 410 * XXX able to cope with arbitrary sockaddr families. 411 * XXX When it can, remove this -EINVAL. -DaveM 412 */ 413 return -EINVAL; 414 break; 415 } 416 417 return 0; 418 } 419 420 static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx) 421 { 422 return DIV_ROUND_UP(sizeof(struct sadb_x_sec_ctx) + 423 sec_ctx->sadb_x_ctx_len, 424 sizeof(uint64_t)); 425 } 426 427 static inline int verify_sec_ctx_len(void *p) 428 { 429 struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p; 430 int len = sec_ctx->sadb_x_ctx_len; 431 432 if (len > PAGE_SIZE) 433 return -EINVAL; 434 435 len = pfkey_sec_ctx_len(sec_ctx); 436 437 if (sec_ctx->sadb_x_sec_len != len) 438 return -EINVAL; 439 440 return 0; 441 } 442 443 static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(struct sadb_x_sec_ctx *sec_ctx) 444 { 445 struct xfrm_user_sec_ctx *uctx = NULL; 446 int ctx_size = sec_ctx->sadb_x_ctx_len; 447 448 uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL); 449 450 if (!uctx) 451 return NULL; 452 453 uctx->len = pfkey_sec_ctx_len(sec_ctx); 454 uctx->exttype = sec_ctx->sadb_x_sec_exttype; 455 uctx->ctx_doi = sec_ctx->sadb_x_ctx_doi; 456 uctx->ctx_alg = sec_ctx->sadb_x_ctx_alg; 457 uctx->ctx_len = sec_ctx->sadb_x_ctx_len; 458 memcpy(uctx + 1, sec_ctx + 1, 459 uctx->ctx_len); 460 461 return uctx; 462 } 463 464 static int present_and_same_family(struct sadb_address *src, 465 struct sadb_address *dst) 466 { 467 struct sockaddr *s_addr, *d_addr; 468 469 if (!src || !dst) 470 return 0; 471 472 s_addr = (struct sockaddr *)(src + 1); 473 d_addr = (struct sockaddr *)(dst + 1); 474 if (s_addr->sa_family != d_addr->sa_family) 475 return 0; 476 if (s_addr->sa_family != AF_INET 477 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 478 && s_addr->sa_family != AF_INET6 479 #endif 480 ) 481 return 0; 482 483 return 1; 484 } 485 486 static int parse_exthdrs(struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 487 { 488 char *p = (char *) hdr; 489 int len = skb->len; 490 491 len -= sizeof(*hdr); 492 p += sizeof(*hdr); 493 while (len > 0) { 494 struct sadb_ext *ehdr = (struct sadb_ext *) p; 495 uint16_t ext_type; 496 int ext_len; 497 498 ext_len = ehdr->sadb_ext_len; 499 ext_len *= sizeof(uint64_t); 500 ext_type = ehdr->sadb_ext_type; 501 if (ext_len < sizeof(uint64_t) || 502 ext_len > len || 503 ext_type == SADB_EXT_RESERVED) 504 return -EINVAL; 505 506 if (ext_type <= SADB_EXT_MAX) { 507 int min = (int) sadb_ext_min_len[ext_type]; 508 if (ext_len < min) 509 return -EINVAL; 510 if (ext_hdrs[ext_type-1] != NULL) 511 return -EINVAL; 512 if (ext_type == SADB_EXT_ADDRESS_SRC || 513 ext_type == SADB_EXT_ADDRESS_DST || 514 ext_type == SADB_EXT_ADDRESS_PROXY || 515 ext_type == SADB_X_EXT_NAT_T_OA) { 516 if (verify_address_len(p)) 517 return -EINVAL; 518 } 519 if (ext_type == SADB_X_EXT_SEC_CTX) { 520 if (verify_sec_ctx_len(p)) 521 return -EINVAL; 522 } 523 ext_hdrs[ext_type-1] = p; 524 } 525 p += ext_len; 526 len -= ext_len; 527 } 528 529 return 0; 530 } 531 532 static uint16_t 533 pfkey_satype2proto(uint8_t satype) 534 { 535 switch (satype) { 536 case SADB_SATYPE_UNSPEC: 537 return IPSEC_PROTO_ANY; 538 case SADB_SATYPE_AH: 539 return IPPROTO_AH; 540 case SADB_SATYPE_ESP: 541 return IPPROTO_ESP; 542 case SADB_X_SATYPE_IPCOMP: 543 return IPPROTO_COMP; 544 break; 545 default: 546 return 0; 547 } 548 /* NOTREACHED */ 549 } 550 551 static uint8_t 552 pfkey_proto2satype(uint16_t proto) 553 { 554 switch (proto) { 555 case IPPROTO_AH: 556 return SADB_SATYPE_AH; 557 case IPPROTO_ESP: 558 return SADB_SATYPE_ESP; 559 case IPPROTO_COMP: 560 return SADB_X_SATYPE_IPCOMP; 561 break; 562 default: 563 return 0; 564 } 565 /* NOTREACHED */ 566 } 567 568 /* BTW, this scheme means that there is no way with PFKEY2 sockets to 569 * say specifically 'just raw sockets' as we encode them as 255. 570 */ 571 572 static uint8_t pfkey_proto_to_xfrm(uint8_t proto) 573 { 574 return (proto == IPSEC_PROTO_ANY ? 0 : proto); 575 } 576 577 static uint8_t pfkey_proto_from_xfrm(uint8_t proto) 578 { 579 return (proto ? proto : IPSEC_PROTO_ANY); 580 } 581 582 static int pfkey_sadb_addr2xfrm_addr(struct sadb_address *addr, 583 xfrm_address_t *xaddr) 584 { 585 switch (((struct sockaddr*)(addr + 1))->sa_family) { 586 case AF_INET: 587 xaddr->a4 = 588 ((struct sockaddr_in *)(addr + 1))->sin_addr.s_addr; 589 return AF_INET; 590 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 591 case AF_INET6: 592 memcpy(xaddr->a6, 593 &((struct sockaddr_in6 *)(addr + 1))->sin6_addr, 594 sizeof(struct in6_addr)); 595 return AF_INET6; 596 #endif 597 default: 598 return 0; 599 } 600 /* NOTREACHED */ 601 } 602 603 static struct xfrm_state *pfkey_xfrm_state_lookup(struct sadb_msg *hdr, void **ext_hdrs) 604 { 605 struct sadb_sa *sa; 606 struct sadb_address *addr; 607 uint16_t proto; 608 unsigned short family; 609 xfrm_address_t *xaddr; 610 611 sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1]; 612 if (sa == NULL) 613 return NULL; 614 615 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 616 if (proto == 0) 617 return NULL; 618 619 /* sadb_address_len should be checked by caller */ 620 addr = (struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1]; 621 if (addr == NULL) 622 return NULL; 623 624 family = ((struct sockaddr *)(addr + 1))->sa_family; 625 switch (family) { 626 case AF_INET: 627 xaddr = (xfrm_address_t *)&((struct sockaddr_in *)(addr + 1))->sin_addr; 628 break; 629 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 630 case AF_INET6: 631 xaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(addr + 1))->sin6_addr; 632 break; 633 #endif 634 default: 635 xaddr = NULL; 636 } 637 638 if (!xaddr) 639 return NULL; 640 641 return xfrm_state_lookup(xaddr, sa->sadb_sa_spi, proto, family); 642 } 643 644 #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1))) 645 static int 646 pfkey_sockaddr_size(sa_family_t family) 647 { 648 switch (family) { 649 case AF_INET: 650 return PFKEY_ALIGN8(sizeof(struct sockaddr_in)); 651 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 652 case AF_INET6: 653 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6)); 654 #endif 655 default: 656 return 0; 657 } 658 /* NOTREACHED */ 659 } 660 661 static inline int pfkey_mode_from_xfrm(int mode) 662 { 663 switch(mode) { 664 case XFRM_MODE_TRANSPORT: 665 return IPSEC_MODE_TRANSPORT; 666 case XFRM_MODE_TUNNEL: 667 return IPSEC_MODE_TUNNEL; 668 case XFRM_MODE_BEET: 669 return IPSEC_MODE_BEET; 670 default: 671 return -1; 672 } 673 } 674 675 static inline int pfkey_mode_to_xfrm(int mode) 676 { 677 switch(mode) { 678 case IPSEC_MODE_ANY: /*XXX*/ 679 case IPSEC_MODE_TRANSPORT: 680 return XFRM_MODE_TRANSPORT; 681 case IPSEC_MODE_TUNNEL: 682 return XFRM_MODE_TUNNEL; 683 case IPSEC_MODE_BEET: 684 return XFRM_MODE_BEET; 685 default: 686 return -1; 687 } 688 } 689 690 static struct sk_buff *__pfkey_xfrm_state2msg(struct xfrm_state *x, 691 int add_keys, int hsc) 692 { 693 struct sk_buff *skb; 694 struct sadb_msg *hdr; 695 struct sadb_sa *sa; 696 struct sadb_lifetime *lifetime; 697 struct sadb_address *addr; 698 struct sadb_key *key; 699 struct sadb_x_sa2 *sa2; 700 struct sockaddr_in *sin; 701 struct sadb_x_sec_ctx *sec_ctx; 702 struct xfrm_sec_ctx *xfrm_ctx; 703 int ctx_size = 0; 704 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 705 struct sockaddr_in6 *sin6; 706 #endif 707 int size; 708 int auth_key_size = 0; 709 int encrypt_key_size = 0; 710 int sockaddr_size; 711 struct xfrm_encap_tmpl *natt = NULL; 712 int mode; 713 714 /* address family check */ 715 sockaddr_size = pfkey_sockaddr_size(x->props.family); 716 if (!sockaddr_size) 717 return ERR_PTR(-EINVAL); 718 719 /* base, SA, (lifetime (HSC),) address(SD), (address(P),) 720 key(AE), (identity(SD),) (sensitivity)> */ 721 size = sizeof(struct sadb_msg) +sizeof(struct sadb_sa) + 722 sizeof(struct sadb_lifetime) + 723 ((hsc & 1) ? sizeof(struct sadb_lifetime) : 0) + 724 ((hsc & 2) ? sizeof(struct sadb_lifetime) : 0) + 725 sizeof(struct sadb_address)*2 + 726 sockaddr_size*2 + 727 sizeof(struct sadb_x_sa2); 728 729 if ((xfrm_ctx = x->security)) { 730 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len); 731 size += sizeof(struct sadb_x_sec_ctx) + ctx_size; 732 } 733 734 /* identity & sensitivity */ 735 736 if ((x->props.family == AF_INET && 737 x->sel.saddr.a4 != x->props.saddr.a4) 738 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 739 || (x->props.family == AF_INET6 && 740 memcmp (x->sel.saddr.a6, x->props.saddr.a6, sizeof (struct in6_addr))) 741 #endif 742 ) 743 size += sizeof(struct sadb_address) + sockaddr_size; 744 745 if (add_keys) { 746 if (x->aalg && x->aalg->alg_key_len) { 747 auth_key_size = 748 PFKEY_ALIGN8((x->aalg->alg_key_len + 7) / 8); 749 size += sizeof(struct sadb_key) + auth_key_size; 750 } 751 if (x->ealg && x->ealg->alg_key_len) { 752 encrypt_key_size = 753 PFKEY_ALIGN8((x->ealg->alg_key_len+7) / 8); 754 size += sizeof(struct sadb_key) + encrypt_key_size; 755 } 756 } 757 if (x->encap) 758 natt = x->encap; 759 760 if (natt && natt->encap_type) { 761 size += sizeof(struct sadb_x_nat_t_type); 762 size += sizeof(struct sadb_x_nat_t_port); 763 size += sizeof(struct sadb_x_nat_t_port); 764 } 765 766 skb = alloc_skb(size + 16, GFP_ATOMIC); 767 if (skb == NULL) 768 return ERR_PTR(-ENOBUFS); 769 770 /* call should fill header later */ 771 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 772 memset(hdr, 0, size); /* XXX do we need this ? */ 773 hdr->sadb_msg_len = size / sizeof(uint64_t); 774 775 /* sa */ 776 sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa)); 777 sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t); 778 sa->sadb_sa_exttype = SADB_EXT_SA; 779 sa->sadb_sa_spi = x->id.spi; 780 sa->sadb_sa_replay = x->props.replay_window; 781 switch (x->km.state) { 782 case XFRM_STATE_VALID: 783 sa->sadb_sa_state = x->km.dying ? 784 SADB_SASTATE_DYING : SADB_SASTATE_MATURE; 785 break; 786 case XFRM_STATE_ACQ: 787 sa->sadb_sa_state = SADB_SASTATE_LARVAL; 788 break; 789 default: 790 sa->sadb_sa_state = SADB_SASTATE_DEAD; 791 break; 792 } 793 sa->sadb_sa_auth = 0; 794 if (x->aalg) { 795 struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0); 796 sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0; 797 } 798 sa->sadb_sa_encrypt = 0; 799 BUG_ON(x->ealg && x->calg); 800 if (x->ealg) { 801 struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0); 802 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; 803 } 804 /* KAME compatible: sadb_sa_encrypt is overloaded with calg id */ 805 if (x->calg) { 806 struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0); 807 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; 808 } 809 810 sa->sadb_sa_flags = 0; 811 if (x->props.flags & XFRM_STATE_NOECN) 812 sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN; 813 if (x->props.flags & XFRM_STATE_DECAP_DSCP) 814 sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP; 815 if (x->props.flags & XFRM_STATE_NOPMTUDISC) 816 sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC; 817 818 /* hard time */ 819 if (hsc & 2) { 820 lifetime = (struct sadb_lifetime *) skb_put(skb, 821 sizeof(struct sadb_lifetime)); 822 lifetime->sadb_lifetime_len = 823 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 824 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 825 lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.hard_packet_limit); 826 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.hard_byte_limit); 827 lifetime->sadb_lifetime_addtime = x->lft.hard_add_expires_seconds; 828 lifetime->sadb_lifetime_usetime = x->lft.hard_use_expires_seconds; 829 } 830 /* soft time */ 831 if (hsc & 1) { 832 lifetime = (struct sadb_lifetime *) skb_put(skb, 833 sizeof(struct sadb_lifetime)); 834 lifetime->sadb_lifetime_len = 835 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 836 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 837 lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.soft_packet_limit); 838 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.soft_byte_limit); 839 lifetime->sadb_lifetime_addtime = x->lft.soft_add_expires_seconds; 840 lifetime->sadb_lifetime_usetime = x->lft.soft_use_expires_seconds; 841 } 842 /* current time */ 843 lifetime = (struct sadb_lifetime *) skb_put(skb, 844 sizeof(struct sadb_lifetime)); 845 lifetime->sadb_lifetime_len = 846 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 847 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 848 lifetime->sadb_lifetime_allocations = x->curlft.packets; 849 lifetime->sadb_lifetime_bytes = x->curlft.bytes; 850 lifetime->sadb_lifetime_addtime = x->curlft.add_time; 851 lifetime->sadb_lifetime_usetime = x->curlft.use_time; 852 /* src address */ 853 addr = (struct sadb_address*) skb_put(skb, 854 sizeof(struct sadb_address)+sockaddr_size); 855 addr->sadb_address_len = 856 (sizeof(struct sadb_address)+sockaddr_size)/ 857 sizeof(uint64_t); 858 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 859 /* "if the ports are non-zero, then the sadb_address_proto field, 860 normally zero, MUST be filled in with the transport 861 protocol's number." - RFC2367 */ 862 addr->sadb_address_proto = 0; 863 addr->sadb_address_reserved = 0; 864 if (x->props.family == AF_INET) { 865 addr->sadb_address_prefixlen = 32; 866 867 sin = (struct sockaddr_in *) (addr + 1); 868 sin->sin_family = AF_INET; 869 sin->sin_addr.s_addr = x->props.saddr.a4; 870 sin->sin_port = 0; 871 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 872 } 873 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 874 else if (x->props.family == AF_INET6) { 875 addr->sadb_address_prefixlen = 128; 876 877 sin6 = (struct sockaddr_in6 *) (addr + 1); 878 sin6->sin6_family = AF_INET6; 879 sin6->sin6_port = 0; 880 sin6->sin6_flowinfo = 0; 881 memcpy(&sin6->sin6_addr, x->props.saddr.a6, 882 sizeof(struct in6_addr)); 883 sin6->sin6_scope_id = 0; 884 } 885 #endif 886 else 887 BUG(); 888 889 /* dst address */ 890 addr = (struct sadb_address*) skb_put(skb, 891 sizeof(struct sadb_address)+sockaddr_size); 892 addr->sadb_address_len = 893 (sizeof(struct sadb_address)+sockaddr_size)/ 894 sizeof(uint64_t); 895 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 896 addr->sadb_address_proto = 0; 897 addr->sadb_address_prefixlen = 32; /* XXX */ 898 addr->sadb_address_reserved = 0; 899 if (x->props.family == AF_INET) { 900 sin = (struct sockaddr_in *) (addr + 1); 901 sin->sin_family = AF_INET; 902 sin->sin_addr.s_addr = x->id.daddr.a4; 903 sin->sin_port = 0; 904 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 905 906 if (x->sel.saddr.a4 != x->props.saddr.a4) { 907 addr = (struct sadb_address*) skb_put(skb, 908 sizeof(struct sadb_address)+sockaddr_size); 909 addr->sadb_address_len = 910 (sizeof(struct sadb_address)+sockaddr_size)/ 911 sizeof(uint64_t); 912 addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 913 addr->sadb_address_proto = 914 pfkey_proto_from_xfrm(x->sel.proto); 915 addr->sadb_address_prefixlen = x->sel.prefixlen_s; 916 addr->sadb_address_reserved = 0; 917 918 sin = (struct sockaddr_in *) (addr + 1); 919 sin->sin_family = AF_INET; 920 sin->sin_addr.s_addr = x->sel.saddr.a4; 921 sin->sin_port = x->sel.sport; 922 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 923 } 924 } 925 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 926 else if (x->props.family == AF_INET6) { 927 addr->sadb_address_prefixlen = 128; 928 929 sin6 = (struct sockaddr_in6 *) (addr + 1); 930 sin6->sin6_family = AF_INET6; 931 sin6->sin6_port = 0; 932 sin6->sin6_flowinfo = 0; 933 memcpy(&sin6->sin6_addr, x->id.daddr.a6, sizeof(struct in6_addr)); 934 sin6->sin6_scope_id = 0; 935 936 if (memcmp (x->sel.saddr.a6, x->props.saddr.a6, 937 sizeof(struct in6_addr))) { 938 addr = (struct sadb_address *) skb_put(skb, 939 sizeof(struct sadb_address)+sockaddr_size); 940 addr->sadb_address_len = 941 (sizeof(struct sadb_address)+sockaddr_size)/ 942 sizeof(uint64_t); 943 addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 944 addr->sadb_address_proto = 945 pfkey_proto_from_xfrm(x->sel.proto); 946 addr->sadb_address_prefixlen = x->sel.prefixlen_s; 947 addr->sadb_address_reserved = 0; 948 949 sin6 = (struct sockaddr_in6 *) (addr + 1); 950 sin6->sin6_family = AF_INET6; 951 sin6->sin6_port = x->sel.sport; 952 sin6->sin6_flowinfo = 0; 953 memcpy(&sin6->sin6_addr, x->sel.saddr.a6, 954 sizeof(struct in6_addr)); 955 sin6->sin6_scope_id = 0; 956 } 957 } 958 #endif 959 else 960 BUG(); 961 962 /* auth key */ 963 if (add_keys && auth_key_size) { 964 key = (struct sadb_key *) skb_put(skb, 965 sizeof(struct sadb_key)+auth_key_size); 966 key->sadb_key_len = (sizeof(struct sadb_key) + auth_key_size) / 967 sizeof(uint64_t); 968 key->sadb_key_exttype = SADB_EXT_KEY_AUTH; 969 key->sadb_key_bits = x->aalg->alg_key_len; 970 key->sadb_key_reserved = 0; 971 memcpy(key + 1, x->aalg->alg_key, (x->aalg->alg_key_len+7)/8); 972 } 973 /* encrypt key */ 974 if (add_keys && encrypt_key_size) { 975 key = (struct sadb_key *) skb_put(skb, 976 sizeof(struct sadb_key)+encrypt_key_size); 977 key->sadb_key_len = (sizeof(struct sadb_key) + 978 encrypt_key_size) / sizeof(uint64_t); 979 key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 980 key->sadb_key_bits = x->ealg->alg_key_len; 981 key->sadb_key_reserved = 0; 982 memcpy(key + 1, x->ealg->alg_key, 983 (x->ealg->alg_key_len+7)/8); 984 } 985 986 /* sa */ 987 sa2 = (struct sadb_x_sa2 *) skb_put(skb, sizeof(struct sadb_x_sa2)); 988 sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t); 989 sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2; 990 if ((mode = pfkey_mode_from_xfrm(x->props.mode)) < 0) { 991 kfree_skb(skb); 992 return ERR_PTR(-EINVAL); 993 } 994 sa2->sadb_x_sa2_mode = mode; 995 sa2->sadb_x_sa2_reserved1 = 0; 996 sa2->sadb_x_sa2_reserved2 = 0; 997 sa2->sadb_x_sa2_sequence = 0; 998 sa2->sadb_x_sa2_reqid = x->props.reqid; 999 1000 if (natt && natt->encap_type) { 1001 struct sadb_x_nat_t_type *n_type; 1002 struct sadb_x_nat_t_port *n_port; 1003 1004 /* type */ 1005 n_type = (struct sadb_x_nat_t_type*) skb_put(skb, sizeof(*n_type)); 1006 n_type->sadb_x_nat_t_type_len = sizeof(*n_type)/sizeof(uint64_t); 1007 n_type->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; 1008 n_type->sadb_x_nat_t_type_type = natt->encap_type; 1009 n_type->sadb_x_nat_t_type_reserved[0] = 0; 1010 n_type->sadb_x_nat_t_type_reserved[1] = 0; 1011 n_type->sadb_x_nat_t_type_reserved[2] = 0; 1012 1013 /* source port */ 1014 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 1015 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 1016 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT; 1017 n_port->sadb_x_nat_t_port_port = natt->encap_sport; 1018 n_port->sadb_x_nat_t_port_reserved = 0; 1019 1020 /* dest port */ 1021 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 1022 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 1023 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT; 1024 n_port->sadb_x_nat_t_port_port = natt->encap_dport; 1025 n_port->sadb_x_nat_t_port_reserved = 0; 1026 } 1027 1028 /* security context */ 1029 if (xfrm_ctx) { 1030 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, 1031 sizeof(struct sadb_x_sec_ctx) + ctx_size); 1032 sec_ctx->sadb_x_sec_len = 1033 (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t); 1034 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 1035 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 1036 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 1037 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 1038 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 1039 xfrm_ctx->ctx_len); 1040 } 1041 1042 return skb; 1043 } 1044 1045 1046 static inline struct sk_buff *pfkey_xfrm_state2msg(struct xfrm_state *x) 1047 { 1048 struct sk_buff *skb; 1049 1050 skb = __pfkey_xfrm_state2msg(x, 1, 3); 1051 1052 return skb; 1053 } 1054 1055 static inline struct sk_buff *pfkey_xfrm_state2msg_expire(struct xfrm_state *x, 1056 int hsc) 1057 { 1058 return __pfkey_xfrm_state2msg(x, 0, hsc); 1059 } 1060 1061 static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr, 1062 void **ext_hdrs) 1063 { 1064 struct xfrm_state *x; 1065 struct sadb_lifetime *lifetime; 1066 struct sadb_sa *sa; 1067 struct sadb_key *key; 1068 struct sadb_x_sec_ctx *sec_ctx; 1069 uint16_t proto; 1070 int err; 1071 1072 1073 sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1]; 1074 if (!sa || 1075 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1076 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1077 return ERR_PTR(-EINVAL); 1078 if (hdr->sadb_msg_satype == SADB_SATYPE_ESP && 1079 !ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]) 1080 return ERR_PTR(-EINVAL); 1081 if (hdr->sadb_msg_satype == SADB_SATYPE_AH && 1082 !ext_hdrs[SADB_EXT_KEY_AUTH-1]) 1083 return ERR_PTR(-EINVAL); 1084 if (!!ext_hdrs[SADB_EXT_LIFETIME_HARD-1] != 1085 !!ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) 1086 return ERR_PTR(-EINVAL); 1087 1088 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1089 if (proto == 0) 1090 return ERR_PTR(-EINVAL); 1091 1092 /* default error is no buffer space */ 1093 err = -ENOBUFS; 1094 1095 /* RFC2367: 1096 1097 Only SADB_SASTATE_MATURE SAs may be submitted in an SADB_ADD message. 1098 SADB_SASTATE_LARVAL SAs are created by SADB_GETSPI and it is not 1099 sensible to add a new SA in the DYING or SADB_SASTATE_DEAD state. 1100 Therefore, the sadb_sa_state field of all submitted SAs MUST be 1101 SADB_SASTATE_MATURE and the kernel MUST return an error if this is 1102 not true. 1103 1104 However, KAME setkey always uses SADB_SASTATE_LARVAL. 1105 Hence, we have to _ignore_ sadb_sa_state, which is also reasonable. 1106 */ 1107 if (sa->sadb_sa_auth > SADB_AALG_MAX || 1108 (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP && 1109 sa->sadb_sa_encrypt > SADB_X_CALG_MAX) || 1110 sa->sadb_sa_encrypt > SADB_EALG_MAX) 1111 return ERR_PTR(-EINVAL); 1112 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1]; 1113 if (key != NULL && 1114 sa->sadb_sa_auth != SADB_X_AALG_NULL && 1115 ((key->sadb_key_bits+7) / 8 == 0 || 1116 (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1117 return ERR_PTR(-EINVAL); 1118 key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; 1119 if (key != NULL && 1120 sa->sadb_sa_encrypt != SADB_EALG_NULL && 1121 ((key->sadb_key_bits+7) / 8 == 0 || 1122 (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1123 return ERR_PTR(-EINVAL); 1124 1125 x = xfrm_state_alloc(); 1126 if (x == NULL) 1127 return ERR_PTR(-ENOBUFS); 1128 1129 x->id.proto = proto; 1130 x->id.spi = sa->sadb_sa_spi; 1131 x->props.replay_window = sa->sadb_sa_replay; 1132 if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN) 1133 x->props.flags |= XFRM_STATE_NOECN; 1134 if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP) 1135 x->props.flags |= XFRM_STATE_DECAP_DSCP; 1136 if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC) 1137 x->props.flags |= XFRM_STATE_NOPMTUDISC; 1138 1139 lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_HARD-1]; 1140 if (lifetime != NULL) { 1141 x->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 1142 x->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 1143 x->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime; 1144 x->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime; 1145 } 1146 lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]; 1147 if (lifetime != NULL) { 1148 x->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 1149 x->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 1150 x->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime; 1151 x->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime; 1152 } 1153 1154 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 1155 if (sec_ctx != NULL) { 1156 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 1157 1158 if (!uctx) 1159 goto out; 1160 1161 err = security_xfrm_state_alloc(x, uctx); 1162 kfree(uctx); 1163 1164 if (err) 1165 goto out; 1166 } 1167 1168 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1]; 1169 if (sa->sadb_sa_auth) { 1170 int keysize = 0; 1171 struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth); 1172 if (!a) { 1173 err = -ENOSYS; 1174 goto out; 1175 } 1176 if (key) 1177 keysize = (key->sadb_key_bits + 7) / 8; 1178 x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL); 1179 if (!x->aalg) 1180 goto out; 1181 strcpy(x->aalg->alg_name, a->name); 1182 x->aalg->alg_key_len = 0; 1183 if (key) { 1184 x->aalg->alg_key_len = key->sadb_key_bits; 1185 memcpy(x->aalg->alg_key, key+1, keysize); 1186 } 1187 x->props.aalgo = sa->sadb_sa_auth; 1188 /* x->algo.flags = sa->sadb_sa_flags; */ 1189 } 1190 if (sa->sadb_sa_encrypt) { 1191 if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) { 1192 struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt); 1193 if (!a) { 1194 err = -ENOSYS; 1195 goto out; 1196 } 1197 x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL); 1198 if (!x->calg) 1199 goto out; 1200 strcpy(x->calg->alg_name, a->name); 1201 x->props.calgo = sa->sadb_sa_encrypt; 1202 } else { 1203 int keysize = 0; 1204 struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt); 1205 if (!a) { 1206 err = -ENOSYS; 1207 goto out; 1208 } 1209 key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; 1210 if (key) 1211 keysize = (key->sadb_key_bits + 7) / 8; 1212 x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL); 1213 if (!x->ealg) 1214 goto out; 1215 strcpy(x->ealg->alg_name, a->name); 1216 x->ealg->alg_key_len = 0; 1217 if (key) { 1218 x->ealg->alg_key_len = key->sadb_key_bits; 1219 memcpy(x->ealg->alg_key, key+1, keysize); 1220 } 1221 x->props.ealgo = sa->sadb_sa_encrypt; 1222 } 1223 } 1224 /* x->algo.flags = sa->sadb_sa_flags; */ 1225 1226 x->props.family = pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1227 &x->props.saddr); 1228 if (!x->props.family) { 1229 err = -EAFNOSUPPORT; 1230 goto out; 1231 } 1232 pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1], 1233 &x->id.daddr); 1234 1235 if (ext_hdrs[SADB_X_EXT_SA2-1]) { 1236 struct sadb_x_sa2 *sa2 = (void*)ext_hdrs[SADB_X_EXT_SA2-1]; 1237 int mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode); 1238 if (mode < 0) { 1239 err = -EINVAL; 1240 goto out; 1241 } 1242 x->props.mode = mode; 1243 x->props.reqid = sa2->sadb_x_sa2_reqid; 1244 } 1245 1246 if (ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]) { 1247 struct sadb_address *addr = ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]; 1248 1249 /* Nobody uses this, but we try. */ 1250 x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, &x->sel.saddr); 1251 x->sel.prefixlen_s = addr->sadb_address_prefixlen; 1252 } 1253 1254 if (x->props.mode == XFRM_MODE_TRANSPORT) 1255 x->sel.family = x->props.family; 1256 1257 if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) { 1258 struct sadb_x_nat_t_type* n_type; 1259 struct xfrm_encap_tmpl *natt; 1260 1261 x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL); 1262 if (!x->encap) 1263 goto out; 1264 1265 natt = x->encap; 1266 n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]; 1267 natt->encap_type = n_type->sadb_x_nat_t_type_type; 1268 1269 if (ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]) { 1270 struct sadb_x_nat_t_port* n_port = 1271 ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]; 1272 natt->encap_sport = n_port->sadb_x_nat_t_port_port; 1273 } 1274 if (ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]) { 1275 struct sadb_x_nat_t_port* n_port = 1276 ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]; 1277 natt->encap_dport = n_port->sadb_x_nat_t_port_port; 1278 } 1279 } 1280 1281 err = xfrm_init_state(x); 1282 if (err) 1283 goto out; 1284 1285 x->km.seq = hdr->sadb_msg_seq; 1286 return x; 1287 1288 out: 1289 x->km.state = XFRM_STATE_DEAD; 1290 xfrm_state_put(x); 1291 return ERR_PTR(err); 1292 } 1293 1294 static int pfkey_reserved(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1295 { 1296 return -EOPNOTSUPP; 1297 } 1298 1299 static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1300 { 1301 struct sk_buff *resp_skb; 1302 struct sadb_x_sa2 *sa2; 1303 struct sadb_address *saddr, *daddr; 1304 struct sadb_msg *out_hdr; 1305 struct sadb_spirange *range; 1306 struct xfrm_state *x = NULL; 1307 int mode; 1308 int err; 1309 u32 min_spi, max_spi; 1310 u32 reqid; 1311 u8 proto; 1312 unsigned short family; 1313 xfrm_address_t *xsaddr = NULL, *xdaddr = NULL; 1314 1315 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1316 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1317 return -EINVAL; 1318 1319 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1320 if (proto == 0) 1321 return -EINVAL; 1322 1323 if ((sa2 = ext_hdrs[SADB_X_EXT_SA2-1]) != NULL) { 1324 mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode); 1325 if (mode < 0) 1326 return -EINVAL; 1327 reqid = sa2->sadb_x_sa2_reqid; 1328 } else { 1329 mode = 0; 1330 reqid = 0; 1331 } 1332 1333 saddr = ext_hdrs[SADB_EXT_ADDRESS_SRC-1]; 1334 daddr = ext_hdrs[SADB_EXT_ADDRESS_DST-1]; 1335 1336 family = ((struct sockaddr *)(saddr + 1))->sa_family; 1337 switch (family) { 1338 case AF_INET: 1339 xdaddr = (xfrm_address_t *)&((struct sockaddr_in *)(daddr + 1))->sin_addr.s_addr; 1340 xsaddr = (xfrm_address_t *)&((struct sockaddr_in *)(saddr + 1))->sin_addr.s_addr; 1341 break; 1342 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1343 case AF_INET6: 1344 xdaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(daddr + 1))->sin6_addr; 1345 xsaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(saddr + 1))->sin6_addr; 1346 break; 1347 #endif 1348 } 1349 1350 if (hdr->sadb_msg_seq) { 1351 x = xfrm_find_acq_byseq(hdr->sadb_msg_seq); 1352 if (x && xfrm_addr_cmp(&x->id.daddr, xdaddr, family)) { 1353 xfrm_state_put(x); 1354 x = NULL; 1355 } 1356 } 1357 1358 if (!x) 1359 x = xfrm_find_acq(mode, reqid, proto, xdaddr, xsaddr, 1, family); 1360 1361 if (x == NULL) 1362 return -ENOENT; 1363 1364 min_spi = 0x100; 1365 max_spi = 0x0fffffff; 1366 1367 range = ext_hdrs[SADB_EXT_SPIRANGE-1]; 1368 if (range) { 1369 min_spi = range->sadb_spirange_min; 1370 max_spi = range->sadb_spirange_max; 1371 } 1372 1373 err = xfrm_alloc_spi(x, min_spi, max_spi); 1374 resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x); 1375 1376 if (IS_ERR(resp_skb)) { 1377 xfrm_state_put(x); 1378 return PTR_ERR(resp_skb); 1379 } 1380 1381 out_hdr = (struct sadb_msg *) resp_skb->data; 1382 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 1383 out_hdr->sadb_msg_type = SADB_GETSPI; 1384 out_hdr->sadb_msg_satype = pfkey_proto2satype(proto); 1385 out_hdr->sadb_msg_errno = 0; 1386 out_hdr->sadb_msg_reserved = 0; 1387 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 1388 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 1389 1390 xfrm_state_put(x); 1391 1392 pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk); 1393 1394 return 0; 1395 } 1396 1397 static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1398 { 1399 struct xfrm_state *x; 1400 1401 if (hdr->sadb_msg_len != sizeof(struct sadb_msg)/8) 1402 return -EOPNOTSUPP; 1403 1404 if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0) 1405 return 0; 1406 1407 x = xfrm_find_acq_byseq(hdr->sadb_msg_seq); 1408 if (x == NULL) 1409 return 0; 1410 1411 spin_lock_bh(&x->lock); 1412 if (x->km.state == XFRM_STATE_ACQ) { 1413 x->km.state = XFRM_STATE_ERROR; 1414 wake_up(&km_waitq); 1415 } 1416 spin_unlock_bh(&x->lock); 1417 xfrm_state_put(x); 1418 return 0; 1419 } 1420 1421 static inline int event2poltype(int event) 1422 { 1423 switch (event) { 1424 case XFRM_MSG_DELPOLICY: 1425 return SADB_X_SPDDELETE; 1426 case XFRM_MSG_NEWPOLICY: 1427 return SADB_X_SPDADD; 1428 case XFRM_MSG_UPDPOLICY: 1429 return SADB_X_SPDUPDATE; 1430 case XFRM_MSG_POLEXPIRE: 1431 // return SADB_X_SPDEXPIRE; 1432 default: 1433 printk("pfkey: Unknown policy event %d\n", event); 1434 break; 1435 } 1436 1437 return 0; 1438 } 1439 1440 static inline int event2keytype(int event) 1441 { 1442 switch (event) { 1443 case XFRM_MSG_DELSA: 1444 return SADB_DELETE; 1445 case XFRM_MSG_NEWSA: 1446 return SADB_ADD; 1447 case XFRM_MSG_UPDSA: 1448 return SADB_UPDATE; 1449 case XFRM_MSG_EXPIRE: 1450 return SADB_EXPIRE; 1451 default: 1452 printk("pfkey: Unknown SA event %d\n", event); 1453 break; 1454 } 1455 1456 return 0; 1457 } 1458 1459 /* ADD/UPD/DEL */ 1460 static int key_notify_sa(struct xfrm_state *x, struct km_event *c) 1461 { 1462 struct sk_buff *skb; 1463 struct sadb_msg *hdr; 1464 1465 skb = pfkey_xfrm_state2msg(x); 1466 1467 if (IS_ERR(skb)) 1468 return PTR_ERR(skb); 1469 1470 hdr = (struct sadb_msg *) skb->data; 1471 hdr->sadb_msg_version = PF_KEY_V2; 1472 hdr->sadb_msg_type = event2keytype(c->event); 1473 hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 1474 hdr->sadb_msg_errno = 0; 1475 hdr->sadb_msg_reserved = 0; 1476 hdr->sadb_msg_seq = c->seq; 1477 hdr->sadb_msg_pid = c->pid; 1478 1479 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 1480 1481 return 0; 1482 } 1483 1484 static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1485 { 1486 struct xfrm_state *x; 1487 int err; 1488 struct km_event c; 1489 1490 x = pfkey_msg2xfrm_state(hdr, ext_hdrs); 1491 if (IS_ERR(x)) 1492 return PTR_ERR(x); 1493 1494 xfrm_state_hold(x); 1495 if (hdr->sadb_msg_type == SADB_ADD) 1496 err = xfrm_state_add(x); 1497 else 1498 err = xfrm_state_update(x); 1499 1500 xfrm_audit_state_add(x, err ? 0 : 1, 1501 audit_get_loginuid(current), 1502 audit_get_sessionid(current), 0); 1503 1504 if (err < 0) { 1505 x->km.state = XFRM_STATE_DEAD; 1506 __xfrm_state_put(x); 1507 goto out; 1508 } 1509 1510 if (hdr->sadb_msg_type == SADB_ADD) 1511 c.event = XFRM_MSG_NEWSA; 1512 else 1513 c.event = XFRM_MSG_UPDSA; 1514 c.seq = hdr->sadb_msg_seq; 1515 c.pid = hdr->sadb_msg_pid; 1516 km_state_notify(x, &c); 1517 out: 1518 xfrm_state_put(x); 1519 return err; 1520 } 1521 1522 static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1523 { 1524 struct xfrm_state *x; 1525 struct km_event c; 1526 int err; 1527 1528 if (!ext_hdrs[SADB_EXT_SA-1] || 1529 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1530 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1531 return -EINVAL; 1532 1533 x = pfkey_xfrm_state_lookup(hdr, ext_hdrs); 1534 if (x == NULL) 1535 return -ESRCH; 1536 1537 if ((err = security_xfrm_state_delete(x))) 1538 goto out; 1539 1540 if (xfrm_state_kern(x)) { 1541 err = -EPERM; 1542 goto out; 1543 } 1544 1545 err = xfrm_state_delete(x); 1546 1547 if (err < 0) 1548 goto out; 1549 1550 c.seq = hdr->sadb_msg_seq; 1551 c.pid = hdr->sadb_msg_pid; 1552 c.event = XFRM_MSG_DELSA; 1553 km_state_notify(x, &c); 1554 out: 1555 xfrm_audit_state_delete(x, err ? 0 : 1, 1556 audit_get_loginuid(current), 1557 audit_get_sessionid(current), 0); 1558 xfrm_state_put(x); 1559 1560 return err; 1561 } 1562 1563 static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1564 { 1565 __u8 proto; 1566 struct sk_buff *out_skb; 1567 struct sadb_msg *out_hdr; 1568 struct xfrm_state *x; 1569 1570 if (!ext_hdrs[SADB_EXT_SA-1] || 1571 !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 1572 ext_hdrs[SADB_EXT_ADDRESS_DST-1])) 1573 return -EINVAL; 1574 1575 x = pfkey_xfrm_state_lookup(hdr, ext_hdrs); 1576 if (x == NULL) 1577 return -ESRCH; 1578 1579 out_skb = pfkey_xfrm_state2msg(x); 1580 proto = x->id.proto; 1581 xfrm_state_put(x); 1582 if (IS_ERR(out_skb)) 1583 return PTR_ERR(out_skb); 1584 1585 out_hdr = (struct sadb_msg *) out_skb->data; 1586 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 1587 out_hdr->sadb_msg_type = SADB_GET; 1588 out_hdr->sadb_msg_satype = pfkey_proto2satype(proto); 1589 out_hdr->sadb_msg_errno = 0; 1590 out_hdr->sadb_msg_reserved = 0; 1591 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 1592 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 1593 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk); 1594 1595 return 0; 1596 } 1597 1598 static struct sk_buff *compose_sadb_supported(struct sadb_msg *orig, 1599 gfp_t allocation) 1600 { 1601 struct sk_buff *skb; 1602 struct sadb_msg *hdr; 1603 int len, auth_len, enc_len, i; 1604 1605 auth_len = xfrm_count_auth_supported(); 1606 if (auth_len) { 1607 auth_len *= sizeof(struct sadb_alg); 1608 auth_len += sizeof(struct sadb_supported); 1609 } 1610 1611 enc_len = xfrm_count_enc_supported(); 1612 if (enc_len) { 1613 enc_len *= sizeof(struct sadb_alg); 1614 enc_len += sizeof(struct sadb_supported); 1615 } 1616 1617 len = enc_len + auth_len + sizeof(struct sadb_msg); 1618 1619 skb = alloc_skb(len + 16, allocation); 1620 if (!skb) 1621 goto out_put_algs; 1622 1623 hdr = (struct sadb_msg *) skb_put(skb, sizeof(*hdr)); 1624 pfkey_hdr_dup(hdr, orig); 1625 hdr->sadb_msg_errno = 0; 1626 hdr->sadb_msg_len = len / sizeof(uint64_t); 1627 1628 if (auth_len) { 1629 struct sadb_supported *sp; 1630 struct sadb_alg *ap; 1631 1632 sp = (struct sadb_supported *) skb_put(skb, auth_len); 1633 ap = (struct sadb_alg *) (sp + 1); 1634 1635 sp->sadb_supported_len = auth_len / sizeof(uint64_t); 1636 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH; 1637 1638 for (i = 0; ; i++) { 1639 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 1640 if (!aalg) 1641 break; 1642 if (aalg->available) 1643 *ap++ = aalg->desc; 1644 } 1645 } 1646 1647 if (enc_len) { 1648 struct sadb_supported *sp; 1649 struct sadb_alg *ap; 1650 1651 sp = (struct sadb_supported *) skb_put(skb, enc_len); 1652 ap = (struct sadb_alg *) (sp + 1); 1653 1654 sp->sadb_supported_len = enc_len / sizeof(uint64_t); 1655 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT; 1656 1657 for (i = 0; ; i++) { 1658 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 1659 if (!ealg) 1660 break; 1661 if (ealg->available) 1662 *ap++ = ealg->desc; 1663 } 1664 } 1665 1666 out_put_algs: 1667 return skb; 1668 } 1669 1670 static int pfkey_register(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1671 { 1672 struct pfkey_sock *pfk = pfkey_sk(sk); 1673 struct sk_buff *supp_skb; 1674 1675 if (hdr->sadb_msg_satype > SADB_SATYPE_MAX) 1676 return -EINVAL; 1677 1678 if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) { 1679 if (pfk->registered&(1<<hdr->sadb_msg_satype)) 1680 return -EEXIST; 1681 pfk->registered |= (1<<hdr->sadb_msg_satype); 1682 } 1683 1684 xfrm_probe_algs(); 1685 1686 supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); 1687 if (!supp_skb) { 1688 if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) 1689 pfk->registered &= ~(1<<hdr->sadb_msg_satype); 1690 1691 return -ENOBUFS; 1692 } 1693 1694 pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk); 1695 1696 return 0; 1697 } 1698 1699 static int key_notify_sa_flush(struct km_event *c) 1700 { 1701 struct sk_buff *skb; 1702 struct sadb_msg *hdr; 1703 1704 skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC); 1705 if (!skb) 1706 return -ENOBUFS; 1707 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 1708 hdr->sadb_msg_satype = pfkey_proto2satype(c->data.proto); 1709 hdr->sadb_msg_type = SADB_FLUSH; 1710 hdr->sadb_msg_seq = c->seq; 1711 hdr->sadb_msg_pid = c->pid; 1712 hdr->sadb_msg_version = PF_KEY_V2; 1713 hdr->sadb_msg_errno = (uint8_t) 0; 1714 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 1715 1716 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 1717 1718 return 0; 1719 } 1720 1721 static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1722 { 1723 unsigned proto; 1724 struct km_event c; 1725 struct xfrm_audit audit_info; 1726 int err; 1727 1728 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1729 if (proto == 0) 1730 return -EINVAL; 1731 1732 audit_info.loginuid = audit_get_loginuid(current); 1733 audit_info.sessionid = audit_get_sessionid(current); 1734 audit_info.secid = 0; 1735 err = xfrm_state_flush(proto, &audit_info); 1736 if (err) 1737 return err; 1738 c.data.proto = proto; 1739 c.seq = hdr->sadb_msg_seq; 1740 c.pid = hdr->sadb_msg_pid; 1741 c.event = XFRM_MSG_FLUSHSA; 1742 km_state_notify(NULL, &c); 1743 1744 return 0; 1745 } 1746 1747 static int dump_sa(struct xfrm_state *x, int count, void *ptr) 1748 { 1749 struct pfkey_sock *pfk = ptr; 1750 struct sk_buff *out_skb; 1751 struct sadb_msg *out_hdr; 1752 1753 if (!pfkey_can_dump(&pfk->sk)) 1754 return -ENOBUFS; 1755 1756 out_skb = pfkey_xfrm_state2msg(x); 1757 if (IS_ERR(out_skb)) 1758 return PTR_ERR(out_skb); 1759 1760 out_hdr = (struct sadb_msg *) out_skb->data; 1761 out_hdr->sadb_msg_version = pfk->dump.msg_version; 1762 out_hdr->sadb_msg_type = SADB_DUMP; 1763 out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 1764 out_hdr->sadb_msg_errno = 0; 1765 out_hdr->sadb_msg_reserved = 0; 1766 out_hdr->sadb_msg_seq = count; 1767 out_hdr->sadb_msg_pid = pfk->dump.msg_pid; 1768 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, &pfk->sk); 1769 return 0; 1770 } 1771 1772 static int pfkey_dump_sa(struct pfkey_sock *pfk) 1773 { 1774 return xfrm_state_walk(&pfk->dump.u.state, dump_sa, (void *) pfk); 1775 } 1776 1777 static void pfkey_dump_sa_done(struct pfkey_sock *pfk) 1778 { 1779 xfrm_state_walk_done(&pfk->dump.u.state); 1780 } 1781 1782 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1783 { 1784 u8 proto; 1785 struct pfkey_sock *pfk = pfkey_sk(sk); 1786 1787 if (pfk->dump.dump != NULL) 1788 return -EBUSY; 1789 1790 proto = pfkey_satype2proto(hdr->sadb_msg_satype); 1791 if (proto == 0) 1792 return -EINVAL; 1793 1794 pfk->dump.msg_version = hdr->sadb_msg_version; 1795 pfk->dump.msg_pid = hdr->sadb_msg_pid; 1796 pfk->dump.dump = pfkey_dump_sa; 1797 pfk->dump.done = pfkey_dump_sa_done; 1798 xfrm_state_walk_init(&pfk->dump.u.state, proto); 1799 1800 return pfkey_do_dump(pfk); 1801 } 1802 1803 static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 1804 { 1805 struct pfkey_sock *pfk = pfkey_sk(sk); 1806 int satype = hdr->sadb_msg_satype; 1807 1808 if (hdr->sadb_msg_len == (sizeof(*hdr) / sizeof(uint64_t))) { 1809 /* XXX we mangle packet... */ 1810 hdr->sadb_msg_errno = 0; 1811 if (satype != 0 && satype != 1) 1812 return -EINVAL; 1813 pfk->promisc = satype; 1814 } 1815 pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, BROADCAST_ALL, NULL); 1816 return 0; 1817 } 1818 1819 static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr) 1820 { 1821 int i; 1822 u32 reqid = *(u32*)ptr; 1823 1824 for (i=0; i<xp->xfrm_nr; i++) { 1825 if (xp->xfrm_vec[i].reqid == reqid) 1826 return -EEXIST; 1827 } 1828 return 0; 1829 } 1830 1831 static u32 gen_reqid(void) 1832 { 1833 struct xfrm_policy_walk walk; 1834 u32 start; 1835 int rc; 1836 static u32 reqid = IPSEC_MANUAL_REQID_MAX; 1837 1838 start = reqid; 1839 do { 1840 ++reqid; 1841 if (reqid == 0) 1842 reqid = IPSEC_MANUAL_REQID_MAX+1; 1843 xfrm_policy_walk_init(&walk, XFRM_POLICY_TYPE_MAIN); 1844 rc = xfrm_policy_walk(&walk, check_reqid, (void*)&reqid); 1845 xfrm_policy_walk_done(&walk); 1846 if (rc != -EEXIST) 1847 return reqid; 1848 } while (reqid != start); 1849 return 0; 1850 } 1851 1852 static int 1853 parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) 1854 { 1855 struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr; 1856 struct sockaddr_in *sin; 1857 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1858 struct sockaddr_in6 *sin6; 1859 #endif 1860 int mode; 1861 1862 if (xp->xfrm_nr >= XFRM_MAX_DEPTH) 1863 return -ELOOP; 1864 1865 if (rq->sadb_x_ipsecrequest_mode == 0) 1866 return -EINVAL; 1867 1868 t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */ 1869 if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0) 1870 return -EINVAL; 1871 t->mode = mode; 1872 if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) 1873 t->optional = 1; 1874 else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) { 1875 t->reqid = rq->sadb_x_ipsecrequest_reqid; 1876 if (t->reqid > IPSEC_MANUAL_REQID_MAX) 1877 t->reqid = 0; 1878 if (!t->reqid && !(t->reqid = gen_reqid())) 1879 return -ENOBUFS; 1880 } 1881 1882 /* addresses present only in tunnel mode */ 1883 if (t->mode == XFRM_MODE_TUNNEL) { 1884 struct sockaddr *sa; 1885 sa = (struct sockaddr *)(rq+1); 1886 switch(sa->sa_family) { 1887 case AF_INET: 1888 sin = (struct sockaddr_in*)sa; 1889 t->saddr.a4 = sin->sin_addr.s_addr; 1890 sin++; 1891 if (sin->sin_family != AF_INET) 1892 return -EINVAL; 1893 t->id.daddr.a4 = sin->sin_addr.s_addr; 1894 break; 1895 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1896 case AF_INET6: 1897 sin6 = (struct sockaddr_in6*)sa; 1898 memcpy(t->saddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); 1899 sin6++; 1900 if (sin6->sin6_family != AF_INET6) 1901 return -EINVAL; 1902 memcpy(t->id.daddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); 1903 break; 1904 #endif 1905 default: 1906 return -EINVAL; 1907 } 1908 t->encap_family = sa->sa_family; 1909 } else 1910 t->encap_family = xp->family; 1911 1912 /* No way to set this via kame pfkey */ 1913 t->allalgs = 1; 1914 xp->xfrm_nr++; 1915 return 0; 1916 } 1917 1918 static int 1919 parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol) 1920 { 1921 int err; 1922 int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy); 1923 struct sadb_x_ipsecrequest *rq = (void*)(pol+1); 1924 1925 while (len >= sizeof(struct sadb_x_ipsecrequest)) { 1926 if ((err = parse_ipsecrequest(xp, rq)) < 0) 1927 return err; 1928 len -= rq->sadb_x_ipsecrequest_len; 1929 rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len); 1930 } 1931 return 0; 1932 } 1933 1934 static inline int pfkey_xfrm_policy2sec_ctx_size(struct xfrm_policy *xp) 1935 { 1936 struct xfrm_sec_ctx *xfrm_ctx = xp->security; 1937 1938 if (xfrm_ctx) { 1939 int len = sizeof(struct sadb_x_sec_ctx); 1940 len += xfrm_ctx->ctx_len; 1941 return PFKEY_ALIGN8(len); 1942 } 1943 return 0; 1944 } 1945 1946 static int pfkey_xfrm_policy2msg_size(struct xfrm_policy *xp) 1947 { 1948 struct xfrm_tmpl *t; 1949 int sockaddr_size = pfkey_sockaddr_size(xp->family); 1950 int socklen = 0; 1951 int i; 1952 1953 for (i=0; i<xp->xfrm_nr; i++) { 1954 t = xp->xfrm_vec + i; 1955 socklen += (t->encap_family == AF_INET ? 1956 sizeof(struct sockaddr_in) : 1957 sizeof(struct sockaddr_in6)); 1958 } 1959 1960 return sizeof(struct sadb_msg) + 1961 (sizeof(struct sadb_lifetime) * 3) + 1962 (sizeof(struct sadb_address) * 2) + 1963 (sockaddr_size * 2) + 1964 sizeof(struct sadb_x_policy) + 1965 (xp->xfrm_nr * sizeof(struct sadb_x_ipsecrequest)) + 1966 (socklen * 2) + 1967 pfkey_xfrm_policy2sec_ctx_size(xp); 1968 } 1969 1970 static struct sk_buff * pfkey_xfrm_policy2msg_prep(struct xfrm_policy *xp) 1971 { 1972 struct sk_buff *skb; 1973 int size; 1974 1975 size = pfkey_xfrm_policy2msg_size(xp); 1976 1977 skb = alloc_skb(size + 16, GFP_ATOMIC); 1978 if (skb == NULL) 1979 return ERR_PTR(-ENOBUFS); 1980 1981 return skb; 1982 } 1983 1984 static int pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, int dir) 1985 { 1986 struct sadb_msg *hdr; 1987 struct sadb_address *addr; 1988 struct sadb_lifetime *lifetime; 1989 struct sadb_x_policy *pol; 1990 struct sockaddr_in *sin; 1991 struct sadb_x_sec_ctx *sec_ctx; 1992 struct xfrm_sec_ctx *xfrm_ctx; 1993 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 1994 struct sockaddr_in6 *sin6; 1995 #endif 1996 int i; 1997 int size; 1998 int sockaddr_size = pfkey_sockaddr_size(xp->family); 1999 int socklen = (xp->family == AF_INET ? 2000 sizeof(struct sockaddr_in) : 2001 sizeof(struct sockaddr_in6)); 2002 2003 size = pfkey_xfrm_policy2msg_size(xp); 2004 2005 /* call should fill header later */ 2006 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 2007 memset(hdr, 0, size); /* XXX do we need this ? */ 2008 2009 /* src address */ 2010 addr = (struct sadb_address*) skb_put(skb, 2011 sizeof(struct sadb_address)+sockaddr_size); 2012 addr->sadb_address_len = 2013 (sizeof(struct sadb_address)+sockaddr_size)/ 2014 sizeof(uint64_t); 2015 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 2016 addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto); 2017 addr->sadb_address_prefixlen = xp->selector.prefixlen_s; 2018 addr->sadb_address_reserved = 0; 2019 /* src address */ 2020 if (xp->family == AF_INET) { 2021 sin = (struct sockaddr_in *) (addr + 1); 2022 sin->sin_family = AF_INET; 2023 sin->sin_addr.s_addr = xp->selector.saddr.a4; 2024 sin->sin_port = xp->selector.sport; 2025 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2026 } 2027 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2028 else if (xp->family == AF_INET6) { 2029 sin6 = (struct sockaddr_in6 *) (addr + 1); 2030 sin6->sin6_family = AF_INET6; 2031 sin6->sin6_port = xp->selector.sport; 2032 sin6->sin6_flowinfo = 0; 2033 memcpy(&sin6->sin6_addr, xp->selector.saddr.a6, 2034 sizeof(struct in6_addr)); 2035 sin6->sin6_scope_id = 0; 2036 } 2037 #endif 2038 else 2039 BUG(); 2040 2041 /* dst address */ 2042 addr = (struct sadb_address*) skb_put(skb, 2043 sizeof(struct sadb_address)+sockaddr_size); 2044 addr->sadb_address_len = 2045 (sizeof(struct sadb_address)+sockaddr_size)/ 2046 sizeof(uint64_t); 2047 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 2048 addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto); 2049 addr->sadb_address_prefixlen = xp->selector.prefixlen_d; 2050 addr->sadb_address_reserved = 0; 2051 if (xp->family == AF_INET) { 2052 sin = (struct sockaddr_in *) (addr + 1); 2053 sin->sin_family = AF_INET; 2054 sin->sin_addr.s_addr = xp->selector.daddr.a4; 2055 sin->sin_port = xp->selector.dport; 2056 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2057 } 2058 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2059 else if (xp->family == AF_INET6) { 2060 sin6 = (struct sockaddr_in6 *) (addr + 1); 2061 sin6->sin6_family = AF_INET6; 2062 sin6->sin6_port = xp->selector.dport; 2063 sin6->sin6_flowinfo = 0; 2064 memcpy(&sin6->sin6_addr, xp->selector.daddr.a6, 2065 sizeof(struct in6_addr)); 2066 sin6->sin6_scope_id = 0; 2067 } 2068 #endif 2069 else 2070 BUG(); 2071 2072 /* hard time */ 2073 lifetime = (struct sadb_lifetime *) skb_put(skb, 2074 sizeof(struct sadb_lifetime)); 2075 lifetime->sadb_lifetime_len = 2076 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2077 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 2078 lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.hard_packet_limit); 2079 lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.hard_byte_limit); 2080 lifetime->sadb_lifetime_addtime = xp->lft.hard_add_expires_seconds; 2081 lifetime->sadb_lifetime_usetime = xp->lft.hard_use_expires_seconds; 2082 /* soft time */ 2083 lifetime = (struct sadb_lifetime *) skb_put(skb, 2084 sizeof(struct sadb_lifetime)); 2085 lifetime->sadb_lifetime_len = 2086 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2087 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 2088 lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.soft_packet_limit); 2089 lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.soft_byte_limit); 2090 lifetime->sadb_lifetime_addtime = xp->lft.soft_add_expires_seconds; 2091 lifetime->sadb_lifetime_usetime = xp->lft.soft_use_expires_seconds; 2092 /* current time */ 2093 lifetime = (struct sadb_lifetime *) skb_put(skb, 2094 sizeof(struct sadb_lifetime)); 2095 lifetime->sadb_lifetime_len = 2096 sizeof(struct sadb_lifetime)/sizeof(uint64_t); 2097 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 2098 lifetime->sadb_lifetime_allocations = xp->curlft.packets; 2099 lifetime->sadb_lifetime_bytes = xp->curlft.bytes; 2100 lifetime->sadb_lifetime_addtime = xp->curlft.add_time; 2101 lifetime->sadb_lifetime_usetime = xp->curlft.use_time; 2102 2103 pol = (struct sadb_x_policy *) skb_put(skb, sizeof(struct sadb_x_policy)); 2104 pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t); 2105 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 2106 pol->sadb_x_policy_type = IPSEC_POLICY_DISCARD; 2107 if (xp->action == XFRM_POLICY_ALLOW) { 2108 if (xp->xfrm_nr) 2109 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 2110 else 2111 pol->sadb_x_policy_type = IPSEC_POLICY_NONE; 2112 } 2113 pol->sadb_x_policy_dir = dir+1; 2114 pol->sadb_x_policy_id = xp->index; 2115 pol->sadb_x_policy_priority = xp->priority; 2116 2117 for (i=0; i<xp->xfrm_nr; i++) { 2118 struct sadb_x_ipsecrequest *rq; 2119 struct xfrm_tmpl *t = xp->xfrm_vec + i; 2120 int req_size; 2121 int mode; 2122 2123 req_size = sizeof(struct sadb_x_ipsecrequest); 2124 if (t->mode == XFRM_MODE_TUNNEL) 2125 req_size += ((t->encap_family == AF_INET ? 2126 sizeof(struct sockaddr_in) : 2127 sizeof(struct sockaddr_in6)) * 2); 2128 else 2129 size -= 2*socklen; 2130 rq = (void*)skb_put(skb, req_size); 2131 pol->sadb_x_policy_len += req_size/8; 2132 memset(rq, 0, sizeof(*rq)); 2133 rq->sadb_x_ipsecrequest_len = req_size; 2134 rq->sadb_x_ipsecrequest_proto = t->id.proto; 2135 if ((mode = pfkey_mode_from_xfrm(t->mode)) < 0) 2136 return -EINVAL; 2137 rq->sadb_x_ipsecrequest_mode = mode; 2138 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE; 2139 if (t->reqid) 2140 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE; 2141 if (t->optional) 2142 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE; 2143 rq->sadb_x_ipsecrequest_reqid = t->reqid; 2144 if (t->mode == XFRM_MODE_TUNNEL) { 2145 switch (t->encap_family) { 2146 case AF_INET: 2147 sin = (void*)(rq+1); 2148 sin->sin_family = AF_INET; 2149 sin->sin_addr.s_addr = t->saddr.a4; 2150 sin->sin_port = 0; 2151 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2152 sin++; 2153 sin->sin_family = AF_INET; 2154 sin->sin_addr.s_addr = t->id.daddr.a4; 2155 sin->sin_port = 0; 2156 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 2157 break; 2158 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2159 case AF_INET6: 2160 sin6 = (void*)(rq+1); 2161 sin6->sin6_family = AF_INET6; 2162 sin6->sin6_port = 0; 2163 sin6->sin6_flowinfo = 0; 2164 memcpy(&sin6->sin6_addr, t->saddr.a6, 2165 sizeof(struct in6_addr)); 2166 sin6->sin6_scope_id = 0; 2167 2168 sin6++; 2169 sin6->sin6_family = AF_INET6; 2170 sin6->sin6_port = 0; 2171 sin6->sin6_flowinfo = 0; 2172 memcpy(&sin6->sin6_addr, t->id.daddr.a6, 2173 sizeof(struct in6_addr)); 2174 sin6->sin6_scope_id = 0; 2175 break; 2176 #endif 2177 default: 2178 break; 2179 } 2180 } 2181 } 2182 2183 /* security context */ 2184 if ((xfrm_ctx = xp->security)) { 2185 int ctx_size = pfkey_xfrm_policy2sec_ctx_size(xp); 2186 2187 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, ctx_size); 2188 sec_ctx->sadb_x_sec_len = ctx_size / sizeof(uint64_t); 2189 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 2190 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 2191 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 2192 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 2193 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 2194 xfrm_ctx->ctx_len); 2195 } 2196 2197 hdr->sadb_msg_len = size / sizeof(uint64_t); 2198 hdr->sadb_msg_reserved = atomic_read(&xp->refcnt); 2199 2200 return 0; 2201 } 2202 2203 static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c) 2204 { 2205 struct sk_buff *out_skb; 2206 struct sadb_msg *out_hdr; 2207 int err; 2208 2209 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2210 if (IS_ERR(out_skb)) { 2211 err = PTR_ERR(out_skb); 2212 goto out; 2213 } 2214 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2215 if (err < 0) 2216 return err; 2217 2218 out_hdr = (struct sadb_msg *) out_skb->data; 2219 out_hdr->sadb_msg_version = PF_KEY_V2; 2220 2221 if (c->data.byid && c->event == XFRM_MSG_DELPOLICY) 2222 out_hdr->sadb_msg_type = SADB_X_SPDDELETE2; 2223 else 2224 out_hdr->sadb_msg_type = event2poltype(c->event); 2225 out_hdr->sadb_msg_errno = 0; 2226 out_hdr->sadb_msg_seq = c->seq; 2227 out_hdr->sadb_msg_pid = c->pid; 2228 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 2229 out: 2230 return 0; 2231 2232 } 2233 2234 static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2235 { 2236 int err = 0; 2237 struct sadb_lifetime *lifetime; 2238 struct sadb_address *sa; 2239 struct sadb_x_policy *pol; 2240 struct xfrm_policy *xp; 2241 struct km_event c; 2242 struct sadb_x_sec_ctx *sec_ctx; 2243 2244 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2245 ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || 2246 !ext_hdrs[SADB_X_EXT_POLICY-1]) 2247 return -EINVAL; 2248 2249 pol = ext_hdrs[SADB_X_EXT_POLICY-1]; 2250 if (pol->sadb_x_policy_type > IPSEC_POLICY_IPSEC) 2251 return -EINVAL; 2252 if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) 2253 return -EINVAL; 2254 2255 xp = xfrm_policy_alloc(GFP_KERNEL); 2256 if (xp == NULL) 2257 return -ENOBUFS; 2258 2259 xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? 2260 XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); 2261 xp->priority = pol->sadb_x_policy_priority; 2262 2263 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2264 xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr); 2265 if (!xp->family) { 2266 err = -EINVAL; 2267 goto out; 2268 } 2269 xp->selector.family = xp->family; 2270 xp->selector.prefixlen_s = sa->sadb_address_prefixlen; 2271 xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2272 xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port; 2273 if (xp->selector.sport) 2274 xp->selector.sport_mask = htons(0xffff); 2275 2276 sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 2277 pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr); 2278 xp->selector.prefixlen_d = sa->sadb_address_prefixlen; 2279 2280 /* Amusing, we set this twice. KAME apps appear to set same value 2281 * in both addresses. 2282 */ 2283 xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2284 2285 xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port; 2286 if (xp->selector.dport) 2287 xp->selector.dport_mask = htons(0xffff); 2288 2289 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 2290 if (sec_ctx != NULL) { 2291 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 2292 2293 if (!uctx) { 2294 err = -ENOBUFS; 2295 goto out; 2296 } 2297 2298 err = security_xfrm_policy_alloc(&xp->security, uctx); 2299 kfree(uctx); 2300 2301 if (err) 2302 goto out; 2303 } 2304 2305 xp->lft.soft_byte_limit = XFRM_INF; 2306 xp->lft.hard_byte_limit = XFRM_INF; 2307 xp->lft.soft_packet_limit = XFRM_INF; 2308 xp->lft.hard_packet_limit = XFRM_INF; 2309 if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD-1]) != NULL) { 2310 xp->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 2311 xp->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 2312 xp->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime; 2313 xp->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime; 2314 } 2315 if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) != NULL) { 2316 xp->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations); 2317 xp->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes); 2318 xp->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime; 2319 xp->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime; 2320 } 2321 xp->xfrm_nr = 0; 2322 if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 2323 (err = parse_ipsecrequests(xp, pol)) < 0) 2324 goto out; 2325 2326 err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp, 2327 hdr->sadb_msg_type != SADB_X_SPDUPDATE); 2328 2329 xfrm_audit_policy_add(xp, err ? 0 : 1, 2330 audit_get_loginuid(current), 2331 audit_get_sessionid(current), 0); 2332 2333 if (err) 2334 goto out; 2335 2336 if (hdr->sadb_msg_type == SADB_X_SPDUPDATE) 2337 c.event = XFRM_MSG_UPDPOLICY; 2338 else 2339 c.event = XFRM_MSG_NEWPOLICY; 2340 2341 c.seq = hdr->sadb_msg_seq; 2342 c.pid = hdr->sadb_msg_pid; 2343 2344 km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c); 2345 xfrm_pol_put(xp); 2346 return 0; 2347 2348 out: 2349 xp->dead = 1; 2350 xfrm_policy_destroy(xp); 2351 return err; 2352 } 2353 2354 static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2355 { 2356 int err; 2357 struct sadb_address *sa; 2358 struct sadb_x_policy *pol; 2359 struct xfrm_policy *xp; 2360 struct xfrm_selector sel; 2361 struct km_event c; 2362 struct sadb_x_sec_ctx *sec_ctx; 2363 struct xfrm_sec_ctx *pol_ctx = NULL; 2364 2365 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2366 ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || 2367 !ext_hdrs[SADB_X_EXT_POLICY-1]) 2368 return -EINVAL; 2369 2370 pol = ext_hdrs[SADB_X_EXT_POLICY-1]; 2371 if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) 2372 return -EINVAL; 2373 2374 memset(&sel, 0, sizeof(sel)); 2375 2376 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 2377 sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr); 2378 sel.prefixlen_s = sa->sadb_address_prefixlen; 2379 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2380 sel.sport = ((struct sockaddr_in *)(sa+1))->sin_port; 2381 if (sel.sport) 2382 sel.sport_mask = htons(0xffff); 2383 2384 sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 2385 pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr); 2386 sel.prefixlen_d = sa->sadb_address_prefixlen; 2387 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2388 sel.dport = ((struct sockaddr_in *)(sa+1))->sin_port; 2389 if (sel.dport) 2390 sel.dport_mask = htons(0xffff); 2391 2392 sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1]; 2393 if (sec_ctx != NULL) { 2394 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 2395 2396 if (!uctx) 2397 return -ENOMEM; 2398 2399 err = security_xfrm_policy_alloc(&pol_ctx, uctx); 2400 kfree(uctx); 2401 if (err) 2402 return err; 2403 } 2404 2405 xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, 2406 pol->sadb_x_policy_dir - 1, &sel, pol_ctx, 2407 1, &err); 2408 security_xfrm_policy_free(pol_ctx); 2409 if (xp == NULL) 2410 return -ENOENT; 2411 2412 xfrm_audit_policy_delete(xp, err ? 0 : 1, 2413 audit_get_loginuid(current), 2414 audit_get_sessionid(current), 0); 2415 2416 if (err) 2417 goto out; 2418 2419 c.seq = hdr->sadb_msg_seq; 2420 c.pid = hdr->sadb_msg_pid; 2421 c.event = XFRM_MSG_DELPOLICY; 2422 km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c); 2423 2424 out: 2425 xfrm_pol_put(xp); 2426 return err; 2427 } 2428 2429 static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, struct sadb_msg *hdr, int dir) 2430 { 2431 int err; 2432 struct sk_buff *out_skb; 2433 struct sadb_msg *out_hdr; 2434 err = 0; 2435 2436 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2437 if (IS_ERR(out_skb)) { 2438 err = PTR_ERR(out_skb); 2439 goto out; 2440 } 2441 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2442 if (err < 0) 2443 goto out; 2444 2445 out_hdr = (struct sadb_msg *) out_skb->data; 2446 out_hdr->sadb_msg_version = hdr->sadb_msg_version; 2447 out_hdr->sadb_msg_type = hdr->sadb_msg_type; 2448 out_hdr->sadb_msg_satype = 0; 2449 out_hdr->sadb_msg_errno = 0; 2450 out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; 2451 out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; 2452 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk); 2453 err = 0; 2454 2455 out: 2456 return err; 2457 } 2458 2459 #ifdef CONFIG_NET_KEY_MIGRATE 2460 static int pfkey_sockaddr_pair_size(sa_family_t family) 2461 { 2462 switch (family) { 2463 case AF_INET: 2464 return PFKEY_ALIGN8(sizeof(struct sockaddr_in) * 2); 2465 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2466 case AF_INET6: 2467 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6) * 2); 2468 #endif 2469 default: 2470 return 0; 2471 } 2472 /* NOTREACHED */ 2473 } 2474 2475 static int parse_sockaddr_pair(struct sadb_x_ipsecrequest *rq, 2476 xfrm_address_t *saddr, xfrm_address_t *daddr, 2477 u16 *family) 2478 { 2479 struct sockaddr *sa = (struct sockaddr *)(rq + 1); 2480 if (rq->sadb_x_ipsecrequest_len < 2481 pfkey_sockaddr_pair_size(sa->sa_family)) 2482 return -EINVAL; 2483 2484 switch (sa->sa_family) { 2485 case AF_INET: 2486 { 2487 struct sockaddr_in *sin; 2488 sin = (struct sockaddr_in *)sa; 2489 if ((sin+1)->sin_family != AF_INET) 2490 return -EINVAL; 2491 memcpy(&saddr->a4, &sin->sin_addr, sizeof(saddr->a4)); 2492 sin++; 2493 memcpy(&daddr->a4, &sin->sin_addr, sizeof(daddr->a4)); 2494 *family = AF_INET; 2495 break; 2496 } 2497 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 2498 case AF_INET6: 2499 { 2500 struct sockaddr_in6 *sin6; 2501 sin6 = (struct sockaddr_in6 *)sa; 2502 if ((sin6+1)->sin6_family != AF_INET6) 2503 return -EINVAL; 2504 memcpy(&saddr->a6, &sin6->sin6_addr, 2505 sizeof(saddr->a6)); 2506 sin6++; 2507 memcpy(&daddr->a6, &sin6->sin6_addr, 2508 sizeof(daddr->a6)); 2509 *family = AF_INET6; 2510 break; 2511 } 2512 #endif 2513 default: 2514 return -EINVAL; 2515 } 2516 2517 return 0; 2518 } 2519 2520 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, 2521 struct xfrm_migrate *m) 2522 { 2523 int err; 2524 struct sadb_x_ipsecrequest *rq2; 2525 int mode; 2526 2527 if (len <= sizeof(struct sadb_x_ipsecrequest) || 2528 len < rq1->sadb_x_ipsecrequest_len) 2529 return -EINVAL; 2530 2531 /* old endoints */ 2532 err = parse_sockaddr_pair(rq1, &m->old_saddr, &m->old_daddr, 2533 &m->old_family); 2534 if (err) 2535 return err; 2536 2537 rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len); 2538 len -= rq1->sadb_x_ipsecrequest_len; 2539 2540 if (len <= sizeof(struct sadb_x_ipsecrequest) || 2541 len < rq2->sadb_x_ipsecrequest_len) 2542 return -EINVAL; 2543 2544 /* new endpoints */ 2545 err = parse_sockaddr_pair(rq2, &m->new_saddr, &m->new_daddr, 2546 &m->new_family); 2547 if (err) 2548 return err; 2549 2550 if (rq1->sadb_x_ipsecrequest_proto != rq2->sadb_x_ipsecrequest_proto || 2551 rq1->sadb_x_ipsecrequest_mode != rq2->sadb_x_ipsecrequest_mode || 2552 rq1->sadb_x_ipsecrequest_reqid != rq2->sadb_x_ipsecrequest_reqid) 2553 return -EINVAL; 2554 2555 m->proto = rq1->sadb_x_ipsecrequest_proto; 2556 if ((mode = pfkey_mode_to_xfrm(rq1->sadb_x_ipsecrequest_mode)) < 0) 2557 return -EINVAL; 2558 m->mode = mode; 2559 m->reqid = rq1->sadb_x_ipsecrequest_reqid; 2560 2561 return ((int)(rq1->sadb_x_ipsecrequest_len + 2562 rq2->sadb_x_ipsecrequest_len)); 2563 } 2564 2565 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, 2566 struct sadb_msg *hdr, void **ext_hdrs) 2567 { 2568 int i, len, ret, err = -EINVAL; 2569 u8 dir; 2570 struct sadb_address *sa; 2571 struct sadb_x_policy *pol; 2572 struct sadb_x_ipsecrequest *rq; 2573 struct xfrm_selector sel; 2574 struct xfrm_migrate m[XFRM_MAX_DEPTH]; 2575 2576 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1], 2577 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) || 2578 !ext_hdrs[SADB_X_EXT_POLICY - 1]) { 2579 err = -EINVAL; 2580 goto out; 2581 } 2582 2583 pol = ext_hdrs[SADB_X_EXT_POLICY - 1]; 2584 if (!pol) { 2585 err = -EINVAL; 2586 goto out; 2587 } 2588 2589 if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) { 2590 err = -EINVAL; 2591 goto out; 2592 } 2593 2594 dir = pol->sadb_x_policy_dir - 1; 2595 memset(&sel, 0, sizeof(sel)); 2596 2597 /* set source address info of selector */ 2598 sa = ext_hdrs[SADB_EXT_ADDRESS_SRC - 1]; 2599 sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr); 2600 sel.prefixlen_s = sa->sadb_address_prefixlen; 2601 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2602 sel.sport = ((struct sockaddr_in *)(sa + 1))->sin_port; 2603 if (sel.sport) 2604 sel.sport_mask = htons(0xffff); 2605 2606 /* set destination address info of selector */ 2607 sa = ext_hdrs[SADB_EXT_ADDRESS_DST - 1], 2608 pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr); 2609 sel.prefixlen_d = sa->sadb_address_prefixlen; 2610 sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto); 2611 sel.dport = ((struct sockaddr_in *)(sa + 1))->sin_port; 2612 if (sel.dport) 2613 sel.dport_mask = htons(0xffff); 2614 2615 rq = (struct sadb_x_ipsecrequest *)(pol + 1); 2616 2617 /* extract ipsecrequests */ 2618 i = 0; 2619 len = pol->sadb_x_policy_len * 8 - sizeof(struct sadb_x_policy); 2620 2621 while (len > 0 && i < XFRM_MAX_DEPTH) { 2622 ret = ipsecrequests_to_migrate(rq, len, &m[i]); 2623 if (ret < 0) { 2624 err = ret; 2625 goto out; 2626 } else { 2627 rq = (struct sadb_x_ipsecrequest *)((u8 *)rq + ret); 2628 len -= ret; 2629 i++; 2630 } 2631 } 2632 2633 if (!i || len > 0) { 2634 err = -EINVAL; 2635 goto out; 2636 } 2637 2638 return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i); 2639 2640 out: 2641 return err; 2642 } 2643 #else 2644 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, 2645 struct sadb_msg *hdr, void **ext_hdrs) 2646 { 2647 return -ENOPROTOOPT; 2648 } 2649 #endif 2650 2651 2652 static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2653 { 2654 unsigned int dir; 2655 int err = 0, delete; 2656 struct sadb_x_policy *pol; 2657 struct xfrm_policy *xp; 2658 struct km_event c; 2659 2660 if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL) 2661 return -EINVAL; 2662 2663 dir = xfrm_policy_id2dir(pol->sadb_x_policy_id); 2664 if (dir >= XFRM_POLICY_MAX) 2665 return -EINVAL; 2666 2667 delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2); 2668 xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id, 2669 delete, &err); 2670 if (xp == NULL) 2671 return -ENOENT; 2672 2673 if (delete) { 2674 xfrm_audit_policy_delete(xp, err ? 0 : 1, 2675 audit_get_loginuid(current), 2676 audit_get_sessionid(current), 0); 2677 2678 if (err) 2679 goto out; 2680 c.seq = hdr->sadb_msg_seq; 2681 c.pid = hdr->sadb_msg_pid; 2682 c.data.byid = 1; 2683 c.event = XFRM_MSG_DELPOLICY; 2684 km_policy_notify(xp, dir, &c); 2685 } else { 2686 err = key_pol_get_resp(sk, xp, hdr, dir); 2687 } 2688 2689 out: 2690 xfrm_pol_put(xp); 2691 return err; 2692 } 2693 2694 static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr) 2695 { 2696 struct pfkey_sock *pfk = ptr; 2697 struct sk_buff *out_skb; 2698 struct sadb_msg *out_hdr; 2699 int err; 2700 2701 if (!pfkey_can_dump(&pfk->sk)) 2702 return -ENOBUFS; 2703 2704 out_skb = pfkey_xfrm_policy2msg_prep(xp); 2705 if (IS_ERR(out_skb)) 2706 return PTR_ERR(out_skb); 2707 2708 err = pfkey_xfrm_policy2msg(out_skb, xp, dir); 2709 if (err < 0) 2710 return err; 2711 2712 out_hdr = (struct sadb_msg *) out_skb->data; 2713 out_hdr->sadb_msg_version = pfk->dump.msg_version; 2714 out_hdr->sadb_msg_type = SADB_X_SPDDUMP; 2715 out_hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; 2716 out_hdr->sadb_msg_errno = 0; 2717 out_hdr->sadb_msg_seq = count; 2718 out_hdr->sadb_msg_pid = pfk->dump.msg_pid; 2719 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, &pfk->sk); 2720 return 0; 2721 } 2722 2723 static int pfkey_dump_sp(struct pfkey_sock *pfk) 2724 { 2725 return xfrm_policy_walk(&pfk->dump.u.policy, dump_sp, (void *) pfk); 2726 } 2727 2728 static void pfkey_dump_sp_done(struct pfkey_sock *pfk) 2729 { 2730 xfrm_policy_walk_done(&pfk->dump.u.policy); 2731 } 2732 2733 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2734 { 2735 struct pfkey_sock *pfk = pfkey_sk(sk); 2736 2737 if (pfk->dump.dump != NULL) 2738 return -EBUSY; 2739 2740 pfk->dump.msg_version = hdr->sadb_msg_version; 2741 pfk->dump.msg_pid = hdr->sadb_msg_pid; 2742 pfk->dump.dump = pfkey_dump_sp; 2743 pfk->dump.done = pfkey_dump_sp_done; 2744 xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN); 2745 2746 return pfkey_do_dump(pfk); 2747 } 2748 2749 static int key_notify_policy_flush(struct km_event *c) 2750 { 2751 struct sk_buff *skb_out; 2752 struct sadb_msg *hdr; 2753 2754 skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC); 2755 if (!skb_out) 2756 return -ENOBUFS; 2757 hdr = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg)); 2758 hdr->sadb_msg_type = SADB_X_SPDFLUSH; 2759 hdr->sadb_msg_seq = c->seq; 2760 hdr->sadb_msg_pid = c->pid; 2761 hdr->sadb_msg_version = PF_KEY_V2; 2762 hdr->sadb_msg_errno = (uint8_t) 0; 2763 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 2764 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL); 2765 return 0; 2766 2767 } 2768 2769 static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2770 { 2771 struct km_event c; 2772 struct xfrm_audit audit_info; 2773 int err; 2774 2775 audit_info.loginuid = audit_get_loginuid(current); 2776 audit_info.sessionid = audit_get_sessionid(current); 2777 audit_info.secid = 0; 2778 err = xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info); 2779 if (err) 2780 return err; 2781 c.data.type = XFRM_POLICY_TYPE_MAIN; 2782 c.event = XFRM_MSG_FLUSHPOLICY; 2783 c.pid = hdr->sadb_msg_pid; 2784 c.seq = hdr->sadb_msg_seq; 2785 km_policy_notify(NULL, 0, &c); 2786 2787 return 0; 2788 } 2789 2790 typedef int (*pfkey_handler)(struct sock *sk, struct sk_buff *skb, 2791 struct sadb_msg *hdr, void **ext_hdrs); 2792 static pfkey_handler pfkey_funcs[SADB_MAX + 1] = { 2793 [SADB_RESERVED] = pfkey_reserved, 2794 [SADB_GETSPI] = pfkey_getspi, 2795 [SADB_UPDATE] = pfkey_add, 2796 [SADB_ADD] = pfkey_add, 2797 [SADB_DELETE] = pfkey_delete, 2798 [SADB_GET] = pfkey_get, 2799 [SADB_ACQUIRE] = pfkey_acquire, 2800 [SADB_REGISTER] = pfkey_register, 2801 [SADB_EXPIRE] = NULL, 2802 [SADB_FLUSH] = pfkey_flush, 2803 [SADB_DUMP] = pfkey_dump, 2804 [SADB_X_PROMISC] = pfkey_promisc, 2805 [SADB_X_PCHANGE] = NULL, 2806 [SADB_X_SPDUPDATE] = pfkey_spdadd, 2807 [SADB_X_SPDADD] = pfkey_spdadd, 2808 [SADB_X_SPDDELETE] = pfkey_spddelete, 2809 [SADB_X_SPDGET] = pfkey_spdget, 2810 [SADB_X_SPDACQUIRE] = NULL, 2811 [SADB_X_SPDDUMP] = pfkey_spddump, 2812 [SADB_X_SPDFLUSH] = pfkey_spdflush, 2813 [SADB_X_SPDSETIDX] = pfkey_spdadd, 2814 [SADB_X_SPDDELETE2] = pfkey_spdget, 2815 [SADB_X_MIGRATE] = pfkey_migrate, 2816 }; 2817 2818 static int pfkey_process(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr) 2819 { 2820 void *ext_hdrs[SADB_EXT_MAX]; 2821 int err; 2822 2823 pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, 2824 BROADCAST_PROMISC_ONLY, NULL); 2825 2826 memset(ext_hdrs, 0, sizeof(ext_hdrs)); 2827 err = parse_exthdrs(skb, hdr, ext_hdrs); 2828 if (!err) { 2829 err = -EOPNOTSUPP; 2830 if (pfkey_funcs[hdr->sadb_msg_type]) 2831 err = pfkey_funcs[hdr->sadb_msg_type](sk, skb, hdr, ext_hdrs); 2832 } 2833 return err; 2834 } 2835 2836 static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp) 2837 { 2838 struct sadb_msg *hdr = NULL; 2839 2840 if (skb->len < sizeof(*hdr)) { 2841 *errp = -EMSGSIZE; 2842 } else { 2843 hdr = (struct sadb_msg *) skb->data; 2844 if (hdr->sadb_msg_version != PF_KEY_V2 || 2845 hdr->sadb_msg_reserved != 0 || 2846 (hdr->sadb_msg_type <= SADB_RESERVED || 2847 hdr->sadb_msg_type > SADB_MAX)) { 2848 hdr = NULL; 2849 *errp = -EINVAL; 2850 } else if (hdr->sadb_msg_len != (skb->len / 2851 sizeof(uint64_t)) || 2852 hdr->sadb_msg_len < (sizeof(struct sadb_msg) / 2853 sizeof(uint64_t))) { 2854 hdr = NULL; 2855 *errp = -EMSGSIZE; 2856 } else { 2857 *errp = 0; 2858 } 2859 } 2860 return hdr; 2861 } 2862 2863 static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2864 { 2865 unsigned int id = d->desc.sadb_alg_id; 2866 2867 if (id >= sizeof(t->aalgos) * 8) 2868 return 0; 2869 2870 return (t->aalgos >> id) & 1; 2871 } 2872 2873 static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2874 { 2875 unsigned int id = d->desc.sadb_alg_id; 2876 2877 if (id >= sizeof(t->ealgos) * 8) 2878 return 0; 2879 2880 return (t->ealgos >> id) & 1; 2881 } 2882 2883 static int count_ah_combs(struct xfrm_tmpl *t) 2884 { 2885 int i, sz = 0; 2886 2887 for (i = 0; ; i++) { 2888 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 2889 if (!aalg) 2890 break; 2891 if (aalg_tmpl_set(t, aalg) && aalg->available) 2892 sz += sizeof(struct sadb_comb); 2893 } 2894 return sz + sizeof(struct sadb_prop); 2895 } 2896 2897 static int count_esp_combs(struct xfrm_tmpl *t) 2898 { 2899 int i, k, sz = 0; 2900 2901 for (i = 0; ; i++) { 2902 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 2903 if (!ealg) 2904 break; 2905 2906 if (!(ealg_tmpl_set(t, ealg) && ealg->available)) 2907 continue; 2908 2909 for (k = 1; ; k++) { 2910 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k); 2911 if (!aalg) 2912 break; 2913 2914 if (aalg_tmpl_set(t, aalg) && aalg->available) 2915 sz += sizeof(struct sadb_comb); 2916 } 2917 } 2918 return sz + sizeof(struct sadb_prop); 2919 } 2920 2921 static void dump_ah_combs(struct sk_buff *skb, struct xfrm_tmpl *t) 2922 { 2923 struct sadb_prop *p; 2924 int i; 2925 2926 p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop)); 2927 p->sadb_prop_len = sizeof(struct sadb_prop)/8; 2928 p->sadb_prop_exttype = SADB_EXT_PROPOSAL; 2929 p->sadb_prop_replay = 32; 2930 memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved)); 2931 2932 for (i = 0; ; i++) { 2933 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); 2934 if (!aalg) 2935 break; 2936 2937 if (aalg_tmpl_set(t, aalg) && aalg->available) { 2938 struct sadb_comb *c; 2939 c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); 2940 memset(c, 0, sizeof(*c)); 2941 p->sadb_prop_len += sizeof(struct sadb_comb)/8; 2942 c->sadb_comb_auth = aalg->desc.sadb_alg_id; 2943 c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits; 2944 c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits; 2945 c->sadb_comb_hard_addtime = 24*60*60; 2946 c->sadb_comb_soft_addtime = 20*60*60; 2947 c->sadb_comb_hard_usetime = 8*60*60; 2948 c->sadb_comb_soft_usetime = 7*60*60; 2949 } 2950 } 2951 } 2952 2953 static void dump_esp_combs(struct sk_buff *skb, struct xfrm_tmpl *t) 2954 { 2955 struct sadb_prop *p; 2956 int i, k; 2957 2958 p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop)); 2959 p->sadb_prop_len = sizeof(struct sadb_prop)/8; 2960 p->sadb_prop_exttype = SADB_EXT_PROPOSAL; 2961 p->sadb_prop_replay = 32; 2962 memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved)); 2963 2964 for (i=0; ; i++) { 2965 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); 2966 if (!ealg) 2967 break; 2968 2969 if (!(ealg_tmpl_set(t, ealg) && ealg->available)) 2970 continue; 2971 2972 for (k = 1; ; k++) { 2973 struct sadb_comb *c; 2974 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k); 2975 if (!aalg) 2976 break; 2977 if (!(aalg_tmpl_set(t, aalg) && aalg->available)) 2978 continue; 2979 c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); 2980 memset(c, 0, sizeof(*c)); 2981 p->sadb_prop_len += sizeof(struct sadb_comb)/8; 2982 c->sadb_comb_auth = aalg->desc.sadb_alg_id; 2983 c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits; 2984 c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits; 2985 c->sadb_comb_encrypt = ealg->desc.sadb_alg_id; 2986 c->sadb_comb_encrypt_minbits = ealg->desc.sadb_alg_minbits; 2987 c->sadb_comb_encrypt_maxbits = ealg->desc.sadb_alg_maxbits; 2988 c->sadb_comb_hard_addtime = 24*60*60; 2989 c->sadb_comb_soft_addtime = 20*60*60; 2990 c->sadb_comb_hard_usetime = 8*60*60; 2991 c->sadb_comb_soft_usetime = 7*60*60; 2992 } 2993 } 2994 } 2995 2996 static int key_notify_policy_expire(struct xfrm_policy *xp, struct km_event *c) 2997 { 2998 return 0; 2999 } 3000 3001 static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c) 3002 { 3003 struct sk_buff *out_skb; 3004 struct sadb_msg *out_hdr; 3005 int hard; 3006 int hsc; 3007 3008 hard = c->data.hard; 3009 if (hard) 3010 hsc = 2; 3011 else 3012 hsc = 1; 3013 3014 out_skb = pfkey_xfrm_state2msg_expire(x, hsc); 3015 if (IS_ERR(out_skb)) 3016 return PTR_ERR(out_skb); 3017 3018 out_hdr = (struct sadb_msg *) out_skb->data; 3019 out_hdr->sadb_msg_version = PF_KEY_V2; 3020 out_hdr->sadb_msg_type = SADB_EXPIRE; 3021 out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 3022 out_hdr->sadb_msg_errno = 0; 3023 out_hdr->sadb_msg_reserved = 0; 3024 out_hdr->sadb_msg_seq = 0; 3025 out_hdr->sadb_msg_pid = 0; 3026 3027 pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 3028 return 0; 3029 } 3030 3031 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c) 3032 { 3033 switch (c->event) { 3034 case XFRM_MSG_EXPIRE: 3035 return key_notify_sa_expire(x, c); 3036 case XFRM_MSG_DELSA: 3037 case XFRM_MSG_NEWSA: 3038 case XFRM_MSG_UPDSA: 3039 return key_notify_sa(x, c); 3040 case XFRM_MSG_FLUSHSA: 3041 return key_notify_sa_flush(c); 3042 case XFRM_MSG_NEWAE: /* not yet supported */ 3043 break; 3044 default: 3045 printk("pfkey: Unknown SA event %d\n", c->event); 3046 break; 3047 } 3048 3049 return 0; 3050 } 3051 3052 static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c) 3053 { 3054 if (xp && xp->type != XFRM_POLICY_TYPE_MAIN) 3055 return 0; 3056 3057 switch (c->event) { 3058 case XFRM_MSG_POLEXPIRE: 3059 return key_notify_policy_expire(xp, c); 3060 case XFRM_MSG_DELPOLICY: 3061 case XFRM_MSG_NEWPOLICY: 3062 case XFRM_MSG_UPDPOLICY: 3063 return key_notify_policy(xp, dir, c); 3064 case XFRM_MSG_FLUSHPOLICY: 3065 if (c->data.type != XFRM_POLICY_TYPE_MAIN) 3066 break; 3067 return key_notify_policy_flush(c); 3068 default: 3069 printk("pfkey: Unknown policy event %d\n", c->event); 3070 break; 3071 } 3072 3073 return 0; 3074 } 3075 3076 static u32 get_acqseq(void) 3077 { 3078 u32 res; 3079 static u32 acqseq; 3080 static DEFINE_SPINLOCK(acqseq_lock); 3081 3082 spin_lock_bh(&acqseq_lock); 3083 res = (++acqseq ? : ++acqseq); 3084 spin_unlock_bh(&acqseq_lock); 3085 return res; 3086 } 3087 3088 static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp, int dir) 3089 { 3090 struct sk_buff *skb; 3091 struct sadb_msg *hdr; 3092 struct sadb_address *addr; 3093 struct sadb_x_policy *pol; 3094 struct sockaddr_in *sin; 3095 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3096 struct sockaddr_in6 *sin6; 3097 #endif 3098 int sockaddr_size; 3099 int size; 3100 struct sadb_x_sec_ctx *sec_ctx; 3101 struct xfrm_sec_ctx *xfrm_ctx; 3102 int ctx_size = 0; 3103 3104 sockaddr_size = pfkey_sockaddr_size(x->props.family); 3105 if (!sockaddr_size) 3106 return -EINVAL; 3107 3108 size = sizeof(struct sadb_msg) + 3109 (sizeof(struct sadb_address) * 2) + 3110 (sockaddr_size * 2) + 3111 sizeof(struct sadb_x_policy); 3112 3113 if (x->id.proto == IPPROTO_AH) 3114 size += count_ah_combs(t); 3115 else if (x->id.proto == IPPROTO_ESP) 3116 size += count_esp_combs(t); 3117 3118 if ((xfrm_ctx = x->security)) { 3119 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len); 3120 size += sizeof(struct sadb_x_sec_ctx) + ctx_size; 3121 } 3122 3123 skb = alloc_skb(size + 16, GFP_ATOMIC); 3124 if (skb == NULL) 3125 return -ENOMEM; 3126 3127 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 3128 hdr->sadb_msg_version = PF_KEY_V2; 3129 hdr->sadb_msg_type = SADB_ACQUIRE; 3130 hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto); 3131 hdr->sadb_msg_len = size / sizeof(uint64_t); 3132 hdr->sadb_msg_errno = 0; 3133 hdr->sadb_msg_reserved = 0; 3134 hdr->sadb_msg_seq = x->km.seq = get_acqseq(); 3135 hdr->sadb_msg_pid = 0; 3136 3137 /* src address */ 3138 addr = (struct sadb_address*) skb_put(skb, 3139 sizeof(struct sadb_address)+sockaddr_size); 3140 addr->sadb_address_len = 3141 (sizeof(struct sadb_address)+sockaddr_size)/ 3142 sizeof(uint64_t); 3143 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 3144 addr->sadb_address_proto = 0; 3145 addr->sadb_address_reserved = 0; 3146 if (x->props.family == AF_INET) { 3147 addr->sadb_address_prefixlen = 32; 3148 3149 sin = (struct sockaddr_in *) (addr + 1); 3150 sin->sin_family = AF_INET; 3151 sin->sin_addr.s_addr = x->props.saddr.a4; 3152 sin->sin_port = 0; 3153 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3154 } 3155 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3156 else if (x->props.family == AF_INET6) { 3157 addr->sadb_address_prefixlen = 128; 3158 3159 sin6 = (struct sockaddr_in6 *) (addr + 1); 3160 sin6->sin6_family = AF_INET6; 3161 sin6->sin6_port = 0; 3162 sin6->sin6_flowinfo = 0; 3163 memcpy(&sin6->sin6_addr, 3164 x->props.saddr.a6, sizeof(struct in6_addr)); 3165 sin6->sin6_scope_id = 0; 3166 } 3167 #endif 3168 else 3169 BUG(); 3170 3171 /* dst address */ 3172 addr = (struct sadb_address*) skb_put(skb, 3173 sizeof(struct sadb_address)+sockaddr_size); 3174 addr->sadb_address_len = 3175 (sizeof(struct sadb_address)+sockaddr_size)/ 3176 sizeof(uint64_t); 3177 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 3178 addr->sadb_address_proto = 0; 3179 addr->sadb_address_reserved = 0; 3180 if (x->props.family == AF_INET) { 3181 addr->sadb_address_prefixlen = 32; 3182 3183 sin = (struct sockaddr_in *) (addr + 1); 3184 sin->sin_family = AF_INET; 3185 sin->sin_addr.s_addr = x->id.daddr.a4; 3186 sin->sin_port = 0; 3187 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3188 } 3189 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3190 else if (x->props.family == AF_INET6) { 3191 addr->sadb_address_prefixlen = 128; 3192 3193 sin6 = (struct sockaddr_in6 *) (addr + 1); 3194 sin6->sin6_family = AF_INET6; 3195 sin6->sin6_port = 0; 3196 sin6->sin6_flowinfo = 0; 3197 memcpy(&sin6->sin6_addr, 3198 x->id.daddr.a6, sizeof(struct in6_addr)); 3199 sin6->sin6_scope_id = 0; 3200 } 3201 #endif 3202 else 3203 BUG(); 3204 3205 pol = (struct sadb_x_policy *) skb_put(skb, sizeof(struct sadb_x_policy)); 3206 pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t); 3207 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 3208 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 3209 pol->sadb_x_policy_dir = dir+1; 3210 pol->sadb_x_policy_id = xp->index; 3211 3212 /* Set sadb_comb's. */ 3213 if (x->id.proto == IPPROTO_AH) 3214 dump_ah_combs(skb, t); 3215 else if (x->id.proto == IPPROTO_ESP) 3216 dump_esp_combs(skb, t); 3217 3218 /* security context */ 3219 if (xfrm_ctx) { 3220 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, 3221 sizeof(struct sadb_x_sec_ctx) + ctx_size); 3222 sec_ctx->sadb_x_sec_len = 3223 (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t); 3224 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX; 3225 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi; 3226 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg; 3227 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len; 3228 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str, 3229 xfrm_ctx->ctx_len); 3230 } 3231 3232 return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 3233 } 3234 3235 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, 3236 u8 *data, int len, int *dir) 3237 { 3238 struct xfrm_policy *xp; 3239 struct sadb_x_policy *pol = (struct sadb_x_policy*)data; 3240 struct sadb_x_sec_ctx *sec_ctx; 3241 3242 switch (sk->sk_family) { 3243 case AF_INET: 3244 if (opt != IP_IPSEC_POLICY) { 3245 *dir = -EOPNOTSUPP; 3246 return NULL; 3247 } 3248 break; 3249 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3250 case AF_INET6: 3251 if (opt != IPV6_IPSEC_POLICY) { 3252 *dir = -EOPNOTSUPP; 3253 return NULL; 3254 } 3255 break; 3256 #endif 3257 default: 3258 *dir = -EINVAL; 3259 return NULL; 3260 } 3261 3262 *dir = -EINVAL; 3263 3264 if (len < sizeof(struct sadb_x_policy) || 3265 pol->sadb_x_policy_len*8 > len || 3266 pol->sadb_x_policy_type > IPSEC_POLICY_BYPASS || 3267 (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir > IPSEC_DIR_OUTBOUND)) 3268 return NULL; 3269 3270 xp = xfrm_policy_alloc(GFP_ATOMIC); 3271 if (xp == NULL) { 3272 *dir = -ENOBUFS; 3273 return NULL; 3274 } 3275 3276 xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? 3277 XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); 3278 3279 xp->lft.soft_byte_limit = XFRM_INF; 3280 xp->lft.hard_byte_limit = XFRM_INF; 3281 xp->lft.soft_packet_limit = XFRM_INF; 3282 xp->lft.hard_packet_limit = XFRM_INF; 3283 xp->family = sk->sk_family; 3284 3285 xp->xfrm_nr = 0; 3286 if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 3287 (*dir = parse_ipsecrequests(xp, pol)) < 0) 3288 goto out; 3289 3290 /* security context too */ 3291 if (len >= (pol->sadb_x_policy_len*8 + 3292 sizeof(struct sadb_x_sec_ctx))) { 3293 char *p = (char *)pol; 3294 struct xfrm_user_sec_ctx *uctx; 3295 3296 p += pol->sadb_x_policy_len*8; 3297 sec_ctx = (struct sadb_x_sec_ctx *)p; 3298 if (len < pol->sadb_x_policy_len*8 + 3299 sec_ctx->sadb_x_sec_len) { 3300 *dir = -EINVAL; 3301 goto out; 3302 } 3303 if ((*dir = verify_sec_ctx_len(p))) 3304 goto out; 3305 uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx); 3306 *dir = security_xfrm_policy_alloc(&xp->security, uctx); 3307 kfree(uctx); 3308 3309 if (*dir) 3310 goto out; 3311 } 3312 3313 *dir = pol->sadb_x_policy_dir-1; 3314 return xp; 3315 3316 out: 3317 xfrm_policy_destroy(xp); 3318 return NULL; 3319 } 3320 3321 static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 3322 { 3323 struct sk_buff *skb; 3324 struct sadb_msg *hdr; 3325 struct sadb_sa *sa; 3326 struct sadb_address *addr; 3327 struct sadb_x_nat_t_port *n_port; 3328 struct sockaddr_in *sin; 3329 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3330 struct sockaddr_in6 *sin6; 3331 #endif 3332 int sockaddr_size; 3333 int size; 3334 __u8 satype = (x->id.proto == IPPROTO_ESP ? SADB_SATYPE_ESP : 0); 3335 struct xfrm_encap_tmpl *natt = NULL; 3336 3337 sockaddr_size = pfkey_sockaddr_size(x->props.family); 3338 if (!sockaddr_size) 3339 return -EINVAL; 3340 3341 if (!satype) 3342 return -EINVAL; 3343 3344 if (!x->encap) 3345 return -EINVAL; 3346 3347 natt = x->encap; 3348 3349 /* Build an SADB_X_NAT_T_NEW_MAPPING message: 3350 * 3351 * HDR | SA | ADDRESS_SRC (old addr) | NAT_T_SPORT (old port) | 3352 * ADDRESS_DST (new addr) | NAT_T_DPORT (new port) 3353 */ 3354 3355 size = sizeof(struct sadb_msg) + 3356 sizeof(struct sadb_sa) + 3357 (sizeof(struct sadb_address) * 2) + 3358 (sockaddr_size * 2) + 3359 (sizeof(struct sadb_x_nat_t_port) * 2); 3360 3361 skb = alloc_skb(size + 16, GFP_ATOMIC); 3362 if (skb == NULL) 3363 return -ENOMEM; 3364 3365 hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg)); 3366 hdr->sadb_msg_version = PF_KEY_V2; 3367 hdr->sadb_msg_type = SADB_X_NAT_T_NEW_MAPPING; 3368 hdr->sadb_msg_satype = satype; 3369 hdr->sadb_msg_len = size / sizeof(uint64_t); 3370 hdr->sadb_msg_errno = 0; 3371 hdr->sadb_msg_reserved = 0; 3372 hdr->sadb_msg_seq = x->km.seq = get_acqseq(); 3373 hdr->sadb_msg_pid = 0; 3374 3375 /* SA */ 3376 sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa)); 3377 sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t); 3378 sa->sadb_sa_exttype = SADB_EXT_SA; 3379 sa->sadb_sa_spi = x->id.spi; 3380 sa->sadb_sa_replay = 0; 3381 sa->sadb_sa_state = 0; 3382 sa->sadb_sa_auth = 0; 3383 sa->sadb_sa_encrypt = 0; 3384 sa->sadb_sa_flags = 0; 3385 3386 /* ADDRESS_SRC (old addr) */ 3387 addr = (struct sadb_address*) 3388 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size); 3389 addr->sadb_address_len = 3390 (sizeof(struct sadb_address)+sockaddr_size)/ 3391 sizeof(uint64_t); 3392 addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 3393 addr->sadb_address_proto = 0; 3394 addr->sadb_address_reserved = 0; 3395 if (x->props.family == AF_INET) { 3396 addr->sadb_address_prefixlen = 32; 3397 3398 sin = (struct sockaddr_in *) (addr + 1); 3399 sin->sin_family = AF_INET; 3400 sin->sin_addr.s_addr = x->props.saddr.a4; 3401 sin->sin_port = 0; 3402 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3403 } 3404 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3405 else if (x->props.family == AF_INET6) { 3406 addr->sadb_address_prefixlen = 128; 3407 3408 sin6 = (struct sockaddr_in6 *) (addr + 1); 3409 sin6->sin6_family = AF_INET6; 3410 sin6->sin6_port = 0; 3411 sin6->sin6_flowinfo = 0; 3412 memcpy(&sin6->sin6_addr, 3413 x->props.saddr.a6, sizeof(struct in6_addr)); 3414 sin6->sin6_scope_id = 0; 3415 } 3416 #endif 3417 else 3418 BUG(); 3419 3420 /* NAT_T_SPORT (old port) */ 3421 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 3422 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 3423 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT; 3424 n_port->sadb_x_nat_t_port_port = natt->encap_sport; 3425 n_port->sadb_x_nat_t_port_reserved = 0; 3426 3427 /* ADDRESS_DST (new addr) */ 3428 addr = (struct sadb_address*) 3429 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size); 3430 addr->sadb_address_len = 3431 (sizeof(struct sadb_address)+sockaddr_size)/ 3432 sizeof(uint64_t); 3433 addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 3434 addr->sadb_address_proto = 0; 3435 addr->sadb_address_reserved = 0; 3436 if (x->props.family == AF_INET) { 3437 addr->sadb_address_prefixlen = 32; 3438 3439 sin = (struct sockaddr_in *) (addr + 1); 3440 sin->sin_family = AF_INET; 3441 sin->sin_addr.s_addr = ipaddr->a4; 3442 sin->sin_port = 0; 3443 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3444 } 3445 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3446 else if (x->props.family == AF_INET6) { 3447 addr->sadb_address_prefixlen = 128; 3448 3449 sin6 = (struct sockaddr_in6 *) (addr + 1); 3450 sin6->sin6_family = AF_INET6; 3451 sin6->sin6_port = 0; 3452 sin6->sin6_flowinfo = 0; 3453 memcpy(&sin6->sin6_addr, &ipaddr->a6, sizeof(struct in6_addr)); 3454 sin6->sin6_scope_id = 0; 3455 } 3456 #endif 3457 else 3458 BUG(); 3459 3460 /* NAT_T_DPORT (new port) */ 3461 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port)); 3462 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t); 3463 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT; 3464 n_port->sadb_x_nat_t_port_port = sport; 3465 n_port->sadb_x_nat_t_port_reserved = 0; 3466 3467 return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL); 3468 } 3469 3470 #ifdef CONFIG_NET_KEY_MIGRATE 3471 static int set_sadb_address(struct sk_buff *skb, int sasize, int type, 3472 struct xfrm_selector *sel) 3473 { 3474 struct sadb_address *addr; 3475 struct sockaddr_in *sin; 3476 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3477 struct sockaddr_in6 *sin6; 3478 #endif 3479 addr = (struct sadb_address *)skb_put(skb, sizeof(struct sadb_address) + sasize); 3480 addr->sadb_address_len = (sizeof(struct sadb_address) + sasize)/8; 3481 addr->sadb_address_exttype = type; 3482 addr->sadb_address_proto = sel->proto; 3483 addr->sadb_address_reserved = 0; 3484 3485 switch (type) { 3486 case SADB_EXT_ADDRESS_SRC: 3487 if (sel->family == AF_INET) { 3488 addr->sadb_address_prefixlen = sel->prefixlen_s; 3489 sin = (struct sockaddr_in *)(addr + 1); 3490 sin->sin_family = AF_INET; 3491 memcpy(&sin->sin_addr.s_addr, &sel->saddr, 3492 sizeof(sin->sin_addr.s_addr)); 3493 sin->sin_port = 0; 3494 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3495 } 3496 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3497 else if (sel->family == AF_INET6) { 3498 addr->sadb_address_prefixlen = sel->prefixlen_s; 3499 sin6 = (struct sockaddr_in6 *)(addr + 1); 3500 sin6->sin6_family = AF_INET6; 3501 sin6->sin6_port = 0; 3502 sin6->sin6_flowinfo = 0; 3503 sin6->sin6_scope_id = 0; 3504 memcpy(&sin6->sin6_addr.s6_addr, &sel->saddr, 3505 sizeof(sin6->sin6_addr.s6_addr)); 3506 } 3507 #endif 3508 break; 3509 case SADB_EXT_ADDRESS_DST: 3510 if (sel->family == AF_INET) { 3511 addr->sadb_address_prefixlen = sel->prefixlen_d; 3512 sin = (struct sockaddr_in *)(addr + 1); 3513 sin->sin_family = AF_INET; 3514 memcpy(&sin->sin_addr.s_addr, &sel->daddr, 3515 sizeof(sin->sin_addr.s_addr)); 3516 sin->sin_port = 0; 3517 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 3518 } 3519 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3520 else if (sel->family == AF_INET6) { 3521 addr->sadb_address_prefixlen = sel->prefixlen_d; 3522 sin6 = (struct sockaddr_in6 *)(addr + 1); 3523 sin6->sin6_family = AF_INET6; 3524 sin6->sin6_port = 0; 3525 sin6->sin6_flowinfo = 0; 3526 sin6->sin6_scope_id = 0; 3527 memcpy(&sin6->sin6_addr.s6_addr, &sel->daddr, 3528 sizeof(sin6->sin6_addr.s6_addr)); 3529 } 3530 #endif 3531 break; 3532 default: 3533 return -EINVAL; 3534 } 3535 3536 return 0; 3537 } 3538 3539 static int set_ipsecrequest(struct sk_buff *skb, 3540 uint8_t proto, uint8_t mode, int level, 3541 uint32_t reqid, uint8_t family, 3542 xfrm_address_t *src, xfrm_address_t *dst) 3543 { 3544 struct sadb_x_ipsecrequest *rq; 3545 struct sockaddr_in *sin; 3546 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3547 struct sockaddr_in6 *sin6; 3548 #endif 3549 int size_req; 3550 3551 size_req = sizeof(struct sadb_x_ipsecrequest) + 3552 pfkey_sockaddr_pair_size(family); 3553 3554 rq = (struct sadb_x_ipsecrequest *)skb_put(skb, size_req); 3555 memset(rq, 0, size_req); 3556 rq->sadb_x_ipsecrequest_len = size_req; 3557 rq->sadb_x_ipsecrequest_proto = proto; 3558 rq->sadb_x_ipsecrequest_mode = mode; 3559 rq->sadb_x_ipsecrequest_level = level; 3560 rq->sadb_x_ipsecrequest_reqid = reqid; 3561 3562 switch (family) { 3563 case AF_INET: 3564 sin = (struct sockaddr_in *)(rq + 1); 3565 sin->sin_family = AF_INET; 3566 memcpy(&sin->sin_addr.s_addr, src, 3567 sizeof(sin->sin_addr.s_addr)); 3568 sin++; 3569 sin->sin_family = AF_INET; 3570 memcpy(&sin->sin_addr.s_addr, dst, 3571 sizeof(sin->sin_addr.s_addr)); 3572 break; 3573 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 3574 case AF_INET6: 3575 sin6 = (struct sockaddr_in6 *)(rq + 1); 3576 sin6->sin6_family = AF_INET6; 3577 sin6->sin6_port = 0; 3578 sin6->sin6_flowinfo = 0; 3579 sin6->sin6_scope_id = 0; 3580 memcpy(&sin6->sin6_addr.s6_addr, src, 3581 sizeof(sin6->sin6_addr.s6_addr)); 3582 sin6++; 3583 sin6->sin6_family = AF_INET6; 3584 sin6->sin6_port = 0; 3585 sin6->sin6_flowinfo = 0; 3586 sin6->sin6_scope_id = 0; 3587 memcpy(&sin6->sin6_addr.s6_addr, dst, 3588 sizeof(sin6->sin6_addr.s6_addr)); 3589 break; 3590 #endif 3591 default: 3592 return -EINVAL; 3593 } 3594 3595 return 0; 3596 } 3597 #endif 3598 3599 #ifdef CONFIG_NET_KEY_MIGRATE 3600 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 3601 struct xfrm_migrate *m, int num_bundles) 3602 { 3603 int i; 3604 int sasize_sel; 3605 int size = 0; 3606 int size_pol = 0; 3607 struct sk_buff *skb; 3608 struct sadb_msg *hdr; 3609 struct sadb_x_policy *pol; 3610 struct xfrm_migrate *mp; 3611 3612 if (type != XFRM_POLICY_TYPE_MAIN) 3613 return 0; 3614 3615 if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH) 3616 return -EINVAL; 3617 3618 /* selector */ 3619 sasize_sel = pfkey_sockaddr_size(sel->family); 3620 if (!sasize_sel) 3621 return -EINVAL; 3622 size += (sizeof(struct sadb_address) + sasize_sel) * 2; 3623 3624 /* policy info */ 3625 size_pol += sizeof(struct sadb_x_policy); 3626 3627 /* ipsecrequests */ 3628 for (i = 0, mp = m; i < num_bundles; i++, mp++) { 3629 /* old locator pair */ 3630 size_pol += sizeof(struct sadb_x_ipsecrequest) + 3631 pfkey_sockaddr_pair_size(mp->old_family); 3632 /* new locator pair */ 3633 size_pol += sizeof(struct sadb_x_ipsecrequest) + 3634 pfkey_sockaddr_pair_size(mp->new_family); 3635 } 3636 3637 size += sizeof(struct sadb_msg) + size_pol; 3638 3639 /* alloc buffer */ 3640 skb = alloc_skb(size, GFP_ATOMIC); 3641 if (skb == NULL) 3642 return -ENOMEM; 3643 3644 hdr = (struct sadb_msg *)skb_put(skb, sizeof(struct sadb_msg)); 3645 hdr->sadb_msg_version = PF_KEY_V2; 3646 hdr->sadb_msg_type = SADB_X_MIGRATE; 3647 hdr->sadb_msg_satype = pfkey_proto2satype(m->proto); 3648 hdr->sadb_msg_len = size / 8; 3649 hdr->sadb_msg_errno = 0; 3650 hdr->sadb_msg_reserved = 0; 3651 hdr->sadb_msg_seq = 0; 3652 hdr->sadb_msg_pid = 0; 3653 3654 /* selector src */ 3655 set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel); 3656 3657 /* selector dst */ 3658 set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_DST, sel); 3659 3660 /* policy information */ 3661 pol = (struct sadb_x_policy *)skb_put(skb, sizeof(struct sadb_x_policy)); 3662 pol->sadb_x_policy_len = size_pol / 8; 3663 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 3664 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; 3665 pol->sadb_x_policy_dir = dir + 1; 3666 pol->sadb_x_policy_id = 0; 3667 pol->sadb_x_policy_priority = 0; 3668 3669 for (i = 0, mp = m; i < num_bundles; i++, mp++) { 3670 /* old ipsecrequest */ 3671 int mode = pfkey_mode_from_xfrm(mp->mode); 3672 if (mode < 0) 3673 goto err; 3674 if (set_ipsecrequest(skb, mp->proto, mode, 3675 (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), 3676 mp->reqid, mp->old_family, 3677 &mp->old_saddr, &mp->old_daddr) < 0) 3678 goto err; 3679 3680 /* new ipsecrequest */ 3681 if (set_ipsecrequest(skb, mp->proto, mode, 3682 (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), 3683 mp->reqid, mp->new_family, 3684 &mp->new_saddr, &mp->new_daddr) < 0) 3685 goto err; 3686 } 3687 3688 /* broadcast migrate message to sockets */ 3689 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); 3690 3691 return 0; 3692 3693 err: 3694 kfree_skb(skb); 3695 return -EINVAL; 3696 } 3697 #else 3698 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 3699 struct xfrm_migrate *m, int num_bundles) 3700 { 3701 return -ENOPROTOOPT; 3702 } 3703 #endif 3704 3705 static int pfkey_sendmsg(struct kiocb *kiocb, 3706 struct socket *sock, struct msghdr *msg, size_t len) 3707 { 3708 struct sock *sk = sock->sk; 3709 struct sk_buff *skb = NULL; 3710 struct sadb_msg *hdr = NULL; 3711 int err; 3712 3713 err = -EOPNOTSUPP; 3714 if (msg->msg_flags & MSG_OOB) 3715 goto out; 3716 3717 err = -EMSGSIZE; 3718 if ((unsigned)len > sk->sk_sndbuf - 32) 3719 goto out; 3720 3721 err = -ENOBUFS; 3722 skb = alloc_skb(len, GFP_KERNEL); 3723 if (skb == NULL) 3724 goto out; 3725 3726 err = -EFAULT; 3727 if (memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len)) 3728 goto out; 3729 3730 hdr = pfkey_get_base_msg(skb, &err); 3731 if (!hdr) 3732 goto out; 3733 3734 mutex_lock(&xfrm_cfg_mutex); 3735 err = pfkey_process(sk, skb, hdr); 3736 mutex_unlock(&xfrm_cfg_mutex); 3737 3738 out: 3739 if (err && hdr && pfkey_error(hdr, err, sk) == 0) 3740 err = 0; 3741 if (skb) 3742 kfree_skb(skb); 3743 3744 return err ? : len; 3745 } 3746 3747 static int pfkey_recvmsg(struct kiocb *kiocb, 3748 struct socket *sock, struct msghdr *msg, size_t len, 3749 int flags) 3750 { 3751 struct sock *sk = sock->sk; 3752 struct pfkey_sock *pfk = pfkey_sk(sk); 3753 struct sk_buff *skb; 3754 int copied, err; 3755 3756 err = -EINVAL; 3757 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT)) 3758 goto out; 3759 3760 msg->msg_namelen = 0; 3761 skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err); 3762 if (skb == NULL) 3763 goto out; 3764 3765 copied = skb->len; 3766 if (copied > len) { 3767 msg->msg_flags |= MSG_TRUNC; 3768 copied = len; 3769 } 3770 3771 skb_reset_transport_header(skb); 3772 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 3773 if (err) 3774 goto out_free; 3775 3776 sock_recv_timestamp(msg, sk, skb); 3777 3778 err = (flags & MSG_TRUNC) ? skb->len : copied; 3779 3780 if (pfk->dump.dump != NULL && 3781 3 * atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) 3782 pfkey_do_dump(pfk); 3783 3784 out_free: 3785 skb_free_datagram(sk, skb); 3786 out: 3787 return err; 3788 } 3789 3790 static const struct proto_ops pfkey_ops = { 3791 .family = PF_KEY, 3792 .owner = THIS_MODULE, 3793 /* Operations that make no sense on pfkey sockets. */ 3794 .bind = sock_no_bind, 3795 .connect = sock_no_connect, 3796 .socketpair = sock_no_socketpair, 3797 .accept = sock_no_accept, 3798 .getname = sock_no_getname, 3799 .ioctl = sock_no_ioctl, 3800 .listen = sock_no_listen, 3801 .shutdown = sock_no_shutdown, 3802 .setsockopt = sock_no_setsockopt, 3803 .getsockopt = sock_no_getsockopt, 3804 .mmap = sock_no_mmap, 3805 .sendpage = sock_no_sendpage, 3806 3807 /* Now the operations that really occur. */ 3808 .release = pfkey_release, 3809 .poll = datagram_poll, 3810 .sendmsg = pfkey_sendmsg, 3811 .recvmsg = pfkey_recvmsg, 3812 }; 3813 3814 static struct net_proto_family pfkey_family_ops = { 3815 .family = PF_KEY, 3816 .create = pfkey_create, 3817 .owner = THIS_MODULE, 3818 }; 3819 3820 #ifdef CONFIG_PROC_FS 3821 static int pfkey_seq_show(struct seq_file *f, void *v) 3822 { 3823 struct sock *s; 3824 3825 s = (struct sock *)v; 3826 if (v == SEQ_START_TOKEN) 3827 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n"); 3828 else 3829 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n", 3830 s, 3831 atomic_read(&s->sk_refcnt), 3832 atomic_read(&s->sk_rmem_alloc), 3833 atomic_read(&s->sk_wmem_alloc), 3834 sock_i_uid(s), 3835 sock_i_ino(s) 3836 ); 3837 return 0; 3838 } 3839 3840 static void *pfkey_seq_start(struct seq_file *f, loff_t *ppos) 3841 { 3842 struct sock *s; 3843 struct hlist_node *node; 3844 loff_t pos = *ppos; 3845 3846 read_lock(&pfkey_table_lock); 3847 if (pos == 0) 3848 return SEQ_START_TOKEN; 3849 3850 sk_for_each(s, node, &pfkey_table) 3851 if (pos-- == 1) 3852 return s; 3853 3854 return NULL; 3855 } 3856 3857 static void *pfkey_seq_next(struct seq_file *f, void *v, loff_t *ppos) 3858 { 3859 ++*ppos; 3860 return (v == SEQ_START_TOKEN) ? 3861 sk_head(&pfkey_table) : 3862 sk_next((struct sock *)v); 3863 } 3864 3865 static void pfkey_seq_stop(struct seq_file *f, void *v) 3866 { 3867 read_unlock(&pfkey_table_lock); 3868 } 3869 3870 static struct seq_operations pfkey_seq_ops = { 3871 .start = pfkey_seq_start, 3872 .next = pfkey_seq_next, 3873 .stop = pfkey_seq_stop, 3874 .show = pfkey_seq_show, 3875 }; 3876 3877 static int pfkey_seq_open(struct inode *inode, struct file *file) 3878 { 3879 return seq_open(file, &pfkey_seq_ops); 3880 } 3881 3882 static struct file_operations pfkey_proc_ops = { 3883 .open = pfkey_seq_open, 3884 .read = seq_read, 3885 .llseek = seq_lseek, 3886 .release = seq_release, 3887 }; 3888 3889 static int pfkey_init_proc(void) 3890 { 3891 struct proc_dir_entry *e; 3892 3893 e = proc_net_fops_create(&init_net, "pfkey", 0, &pfkey_proc_ops); 3894 if (e == NULL) 3895 return -ENOMEM; 3896 3897 return 0; 3898 } 3899 3900 static void pfkey_exit_proc(void) 3901 { 3902 proc_net_remove(&init_net, "pfkey"); 3903 } 3904 #else 3905 static inline int pfkey_init_proc(void) 3906 { 3907 return 0; 3908 } 3909 3910 static inline void pfkey_exit_proc(void) 3911 { 3912 } 3913 #endif 3914 3915 static struct xfrm_mgr pfkeyv2_mgr = 3916 { 3917 .id = "pfkeyv2", 3918 .notify = pfkey_send_notify, 3919 .acquire = pfkey_send_acquire, 3920 .compile_policy = pfkey_compile_policy, 3921 .new_mapping = pfkey_send_new_mapping, 3922 .notify_policy = pfkey_send_policy_notify, 3923 .migrate = pfkey_send_migrate, 3924 }; 3925 3926 static void __exit ipsec_pfkey_exit(void) 3927 { 3928 xfrm_unregister_km(&pfkeyv2_mgr); 3929 pfkey_exit_proc(); 3930 sock_unregister(PF_KEY); 3931 proto_unregister(&key_proto); 3932 } 3933 3934 static int __init ipsec_pfkey_init(void) 3935 { 3936 int err = proto_register(&key_proto, 0); 3937 3938 if (err != 0) 3939 goto out; 3940 3941 err = sock_register(&pfkey_family_ops); 3942 if (err != 0) 3943 goto out_unregister_key_proto; 3944 err = pfkey_init_proc(); 3945 if (err != 0) 3946 goto out_sock_unregister; 3947 err = xfrm_register_km(&pfkeyv2_mgr); 3948 if (err != 0) 3949 goto out_remove_proc_entry; 3950 out: 3951 return err; 3952 out_remove_proc_entry: 3953 pfkey_exit_proc(); 3954 out_sock_unregister: 3955 sock_unregister(PF_KEY); 3956 out_unregister_key_proto: 3957 proto_unregister(&key_proto); 3958 goto out; 3959 } 3960 3961 module_init(ipsec_pfkey_init); 3962 module_exit(ipsec_pfkey_exit); 3963 MODULE_LICENSE("GPL"); 3964 MODULE_ALIAS_NETPROTO(PF_KEY); 3965