xref: /openbmc/linux/net/xfrm/xfrm_user.c (revision 5497b23e)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /* xfrm_user.c: User interface to configure xfrm engine.
3  *
4  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
5  *
6  * Changes:
7  *	Mitsuru KANDA @USAGI
8  * 	Kazunori MIYAZAWA @USAGI
9  * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
10  * 		IPv6 support
11  *
12  */
13 
14 #include <linux/crypto.h>
15 #include <linux/module.h>
16 #include <linux/kernel.h>
17 #include <linux/types.h>
18 #include <linux/slab.h>
19 #include <linux/socket.h>
20 #include <linux/string.h>
21 #include <linux/net.h>
22 #include <linux/skbuff.h>
23 #include <linux/pfkeyv2.h>
24 #include <linux/ipsec.h>
25 #include <linux/init.h>
26 #include <linux/security.h>
27 #include <net/sock.h>
28 #include <net/xfrm.h>
29 #include <net/netlink.h>
30 #include <net/ah.h>
31 #include <linux/uaccess.h>
32 #if IS_ENABLED(CONFIG_IPV6)
33 #include <linux/in6.h>
34 #endif
35 #include <asm/unaligned.h>
36 
37 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
38 {
39 	struct nlattr *rt = attrs[type];
40 	struct xfrm_algo *algp;
41 
42 	if (!rt)
43 		return 0;
44 
45 	algp = nla_data(rt);
46 	if (nla_len(rt) < (int)xfrm_alg_len(algp))
47 		return -EINVAL;
48 
49 	switch (type) {
50 	case XFRMA_ALG_AUTH:
51 	case XFRMA_ALG_CRYPT:
52 	case XFRMA_ALG_COMP:
53 		break;
54 
55 	default:
56 		return -EINVAL;
57 	}
58 
59 	algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
60 	return 0;
61 }
62 
63 static int verify_auth_trunc(struct nlattr **attrs)
64 {
65 	struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
66 	struct xfrm_algo_auth *algp;
67 
68 	if (!rt)
69 		return 0;
70 
71 	algp = nla_data(rt);
72 	if (nla_len(rt) < (int)xfrm_alg_auth_len(algp))
73 		return -EINVAL;
74 
75 	algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
76 	return 0;
77 }
78 
79 static int verify_aead(struct nlattr **attrs)
80 {
81 	struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
82 	struct xfrm_algo_aead *algp;
83 
84 	if (!rt)
85 		return 0;
86 
87 	algp = nla_data(rt);
88 	if (nla_len(rt) < (int)aead_len(algp))
89 		return -EINVAL;
90 
91 	algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
92 	return 0;
93 }
94 
95 static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
96 			   xfrm_address_t **addrp)
97 {
98 	struct nlattr *rt = attrs[type];
99 
100 	if (rt && addrp)
101 		*addrp = nla_data(rt);
102 }
103 
104 static inline int verify_sec_ctx_len(struct nlattr **attrs)
105 {
106 	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
107 	struct xfrm_user_sec_ctx *uctx;
108 
109 	if (!rt)
110 		return 0;
111 
112 	uctx = nla_data(rt);
113 	if (uctx->len > nla_len(rt) ||
114 	    uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
115 		return -EINVAL;
116 
117 	return 0;
118 }
119 
120 static inline int verify_replay(struct xfrm_usersa_info *p,
121 				struct nlattr **attrs)
122 {
123 	struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
124 	struct xfrm_replay_state_esn *rs;
125 
126 	if (!rt)
127 		return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
128 
129 	rs = nla_data(rt);
130 
131 	if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
132 		return -EINVAL;
133 
134 	if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
135 	    nla_len(rt) != sizeof(*rs))
136 		return -EINVAL;
137 
138 	/* As only ESP and AH support ESN feature. */
139 	if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))
140 		return -EINVAL;
141 
142 	if (p->replay_window != 0)
143 		return -EINVAL;
144 
145 	return 0;
146 }
147 
148 static int verify_newsa_info(struct xfrm_usersa_info *p,
149 			     struct nlattr **attrs)
150 {
151 	int err;
152 
153 	err = -EINVAL;
154 	switch (p->family) {
155 	case AF_INET:
156 		break;
157 
158 	case AF_INET6:
159 #if IS_ENABLED(CONFIG_IPV6)
160 		break;
161 #else
162 		err = -EAFNOSUPPORT;
163 		goto out;
164 #endif
165 
166 	default:
167 		goto out;
168 	}
169 
170 	switch (p->sel.family) {
171 	case AF_UNSPEC:
172 		break;
173 
174 	case AF_INET:
175 		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
176 			goto out;
177 
178 		break;
179 
180 	case AF_INET6:
181 #if IS_ENABLED(CONFIG_IPV6)
182 		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
183 			goto out;
184 
185 		break;
186 #else
187 		err = -EAFNOSUPPORT;
188 		goto out;
189 #endif
190 
191 	default:
192 		goto out;
193 	}
194 
195 	err = -EINVAL;
196 	switch (p->id.proto) {
197 	case IPPROTO_AH:
198 		if ((!attrs[XFRMA_ALG_AUTH]	&&
199 		     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
200 		    attrs[XFRMA_ALG_AEAD]	||
201 		    attrs[XFRMA_ALG_CRYPT]	||
202 		    attrs[XFRMA_ALG_COMP]	||
203 		    attrs[XFRMA_TFCPAD])
204 			goto out;
205 		break;
206 
207 	case IPPROTO_ESP:
208 		if (attrs[XFRMA_ALG_COMP])
209 			goto out;
210 		if (!attrs[XFRMA_ALG_AUTH] &&
211 		    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
212 		    !attrs[XFRMA_ALG_CRYPT] &&
213 		    !attrs[XFRMA_ALG_AEAD])
214 			goto out;
215 		if ((attrs[XFRMA_ALG_AUTH] ||
216 		     attrs[XFRMA_ALG_AUTH_TRUNC] ||
217 		     attrs[XFRMA_ALG_CRYPT]) &&
218 		    attrs[XFRMA_ALG_AEAD])
219 			goto out;
220 		if (attrs[XFRMA_TFCPAD] &&
221 		    p->mode != XFRM_MODE_TUNNEL)
222 			goto out;
223 		break;
224 
225 	case IPPROTO_COMP:
226 		if (!attrs[XFRMA_ALG_COMP]	||
227 		    attrs[XFRMA_ALG_AEAD]	||
228 		    attrs[XFRMA_ALG_AUTH]	||
229 		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
230 		    attrs[XFRMA_ALG_CRYPT]	||
231 		    attrs[XFRMA_TFCPAD]		||
232 		    (ntohl(p->id.spi) >= 0x10000))
233 			goto out;
234 		break;
235 
236 #if IS_ENABLED(CONFIG_IPV6)
237 	case IPPROTO_DSTOPTS:
238 	case IPPROTO_ROUTING:
239 		if (attrs[XFRMA_ALG_COMP]	||
240 		    attrs[XFRMA_ALG_AUTH]	||
241 		    attrs[XFRMA_ALG_AUTH_TRUNC]	||
242 		    attrs[XFRMA_ALG_AEAD]	||
243 		    attrs[XFRMA_ALG_CRYPT]	||
244 		    attrs[XFRMA_ENCAP]		||
245 		    attrs[XFRMA_SEC_CTX]	||
246 		    attrs[XFRMA_TFCPAD]		||
247 		    !attrs[XFRMA_COADDR])
248 			goto out;
249 		break;
250 #endif
251 
252 	default:
253 		goto out;
254 	}
255 
256 	if ((err = verify_aead(attrs)))
257 		goto out;
258 	if ((err = verify_auth_trunc(attrs)))
259 		goto out;
260 	if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
261 		goto out;
262 	if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
263 		goto out;
264 	if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
265 		goto out;
266 	if ((err = verify_sec_ctx_len(attrs)))
267 		goto out;
268 	if ((err = verify_replay(p, attrs)))
269 		goto out;
270 
271 	err = -EINVAL;
272 	switch (p->mode) {
273 	case XFRM_MODE_TRANSPORT:
274 	case XFRM_MODE_TUNNEL:
275 	case XFRM_MODE_ROUTEOPTIMIZATION:
276 	case XFRM_MODE_BEET:
277 		break;
278 
279 	default:
280 		goto out;
281 	}
282 
283 	err = 0;
284 
285 out:
286 	return err;
287 }
288 
289 static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
290 			   struct xfrm_algo_desc *(*get_byname)(const char *, int),
291 			   struct nlattr *rta)
292 {
293 	struct xfrm_algo *p, *ualg;
294 	struct xfrm_algo_desc *algo;
295 
296 	if (!rta)
297 		return 0;
298 
299 	ualg = nla_data(rta);
300 
301 	algo = get_byname(ualg->alg_name, 1);
302 	if (!algo)
303 		return -ENOSYS;
304 	*props = algo->desc.sadb_alg_id;
305 
306 	p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
307 	if (!p)
308 		return -ENOMEM;
309 
310 	strcpy(p->alg_name, algo->name);
311 	*algpp = p;
312 	return 0;
313 }
314 
315 static int attach_crypt(struct xfrm_state *x, struct nlattr *rta)
316 {
317 	struct xfrm_algo *p, *ualg;
318 	struct xfrm_algo_desc *algo;
319 
320 	if (!rta)
321 		return 0;
322 
323 	ualg = nla_data(rta);
324 
325 	algo = xfrm_ealg_get_byname(ualg->alg_name, 1);
326 	if (!algo)
327 		return -ENOSYS;
328 	x->props.ealgo = algo->desc.sadb_alg_id;
329 
330 	p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
331 	if (!p)
332 		return -ENOMEM;
333 
334 	strcpy(p->alg_name, algo->name);
335 	x->ealg = p;
336 	x->geniv = algo->uinfo.encr.geniv;
337 	return 0;
338 }
339 
340 static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
341 		       struct nlattr *rta)
342 {
343 	struct xfrm_algo *ualg;
344 	struct xfrm_algo_auth *p;
345 	struct xfrm_algo_desc *algo;
346 
347 	if (!rta)
348 		return 0;
349 
350 	ualg = nla_data(rta);
351 
352 	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
353 	if (!algo)
354 		return -ENOSYS;
355 	*props = algo->desc.sadb_alg_id;
356 
357 	p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
358 	if (!p)
359 		return -ENOMEM;
360 
361 	strcpy(p->alg_name, algo->name);
362 	p->alg_key_len = ualg->alg_key_len;
363 	p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
364 	memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
365 
366 	*algpp = p;
367 	return 0;
368 }
369 
370 static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
371 			     struct nlattr *rta)
372 {
373 	struct xfrm_algo_auth *p, *ualg;
374 	struct xfrm_algo_desc *algo;
375 
376 	if (!rta)
377 		return 0;
378 
379 	ualg = nla_data(rta);
380 
381 	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
382 	if (!algo)
383 		return -ENOSYS;
384 	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
385 		return -EINVAL;
386 	*props = algo->desc.sadb_alg_id;
387 
388 	p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
389 	if (!p)
390 		return -ENOMEM;
391 
392 	strcpy(p->alg_name, algo->name);
393 	if (!p->alg_trunc_len)
394 		p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
395 
396 	*algpp = p;
397 	return 0;
398 }
399 
400 static int attach_aead(struct xfrm_state *x, struct nlattr *rta)
401 {
402 	struct xfrm_algo_aead *p, *ualg;
403 	struct xfrm_algo_desc *algo;
404 
405 	if (!rta)
406 		return 0;
407 
408 	ualg = nla_data(rta);
409 
410 	algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
411 	if (!algo)
412 		return -ENOSYS;
413 	x->props.ealgo = algo->desc.sadb_alg_id;
414 
415 	p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
416 	if (!p)
417 		return -ENOMEM;
418 
419 	strcpy(p->alg_name, algo->name);
420 	x->aead = p;
421 	x->geniv = algo->uinfo.aead.geniv;
422 	return 0;
423 }
424 
425 static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
426 					 struct nlattr *rp)
427 {
428 	struct xfrm_replay_state_esn *up;
429 	unsigned int ulen;
430 
431 	if (!replay_esn || !rp)
432 		return 0;
433 
434 	up = nla_data(rp);
435 	ulen = xfrm_replay_state_esn_len(up);
436 
437 	/* Check the overall length and the internal bitmap length to avoid
438 	 * potential overflow. */
439 	if (nla_len(rp) < (int)ulen ||
440 	    xfrm_replay_state_esn_len(replay_esn) != ulen ||
441 	    replay_esn->bmp_len != up->bmp_len)
442 		return -EINVAL;
443 
444 	if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
445 		return -EINVAL;
446 
447 	return 0;
448 }
449 
450 static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
451 				       struct xfrm_replay_state_esn **preplay_esn,
452 				       struct nlattr *rta)
453 {
454 	struct xfrm_replay_state_esn *p, *pp, *up;
455 	unsigned int klen, ulen;
456 
457 	if (!rta)
458 		return 0;
459 
460 	up = nla_data(rta);
461 	klen = xfrm_replay_state_esn_len(up);
462 	ulen = nla_len(rta) >= (int)klen ? klen : sizeof(*up);
463 
464 	p = kzalloc(klen, GFP_KERNEL);
465 	if (!p)
466 		return -ENOMEM;
467 
468 	pp = kzalloc(klen, GFP_KERNEL);
469 	if (!pp) {
470 		kfree(p);
471 		return -ENOMEM;
472 	}
473 
474 	memcpy(p, up, ulen);
475 	memcpy(pp, up, ulen);
476 
477 	*replay_esn = p;
478 	*preplay_esn = pp;
479 
480 	return 0;
481 }
482 
483 static inline unsigned int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
484 {
485 	unsigned int len = 0;
486 
487 	if (xfrm_ctx) {
488 		len += sizeof(struct xfrm_user_sec_ctx);
489 		len += xfrm_ctx->ctx_len;
490 	}
491 	return len;
492 }
493 
494 static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
495 {
496 	memcpy(&x->id, &p->id, sizeof(x->id));
497 	memcpy(&x->sel, &p->sel, sizeof(x->sel));
498 	memcpy(&x->lft, &p->lft, sizeof(x->lft));
499 	x->props.mode = p->mode;
500 	x->props.replay_window = min_t(unsigned int, p->replay_window,
501 					sizeof(x->replay.bitmap) * 8);
502 	x->props.reqid = p->reqid;
503 	x->props.family = p->family;
504 	memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
505 	x->props.flags = p->flags;
506 
507 	if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
508 		x->sel.family = p->family;
509 }
510 
511 /*
512  * someday when pfkey also has support, we could have the code
513  * somehow made shareable and move it to xfrm_state.c - JHS
514  *
515 */
516 static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
517 				  int update_esn)
518 {
519 	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
520 	struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
521 	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
522 	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
523 	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
524 
525 	if (re) {
526 		struct xfrm_replay_state_esn *replay_esn;
527 		replay_esn = nla_data(re);
528 		memcpy(x->replay_esn, replay_esn,
529 		       xfrm_replay_state_esn_len(replay_esn));
530 		memcpy(x->preplay_esn, replay_esn,
531 		       xfrm_replay_state_esn_len(replay_esn));
532 	}
533 
534 	if (rp) {
535 		struct xfrm_replay_state *replay;
536 		replay = nla_data(rp);
537 		memcpy(&x->replay, replay, sizeof(*replay));
538 		memcpy(&x->preplay, replay, sizeof(*replay));
539 	}
540 
541 	if (lt) {
542 		struct xfrm_lifetime_cur *ltime;
543 		ltime = nla_data(lt);
544 		x->curlft.bytes = ltime->bytes;
545 		x->curlft.packets = ltime->packets;
546 		x->curlft.add_time = ltime->add_time;
547 		x->curlft.use_time = ltime->use_time;
548 	}
549 
550 	if (et)
551 		x->replay_maxage = nla_get_u32(et);
552 
553 	if (rt)
554 		x->replay_maxdiff = nla_get_u32(rt);
555 }
556 
557 static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
558 {
559 	if (attrs[XFRMA_SET_MARK]) {
560 		m->v = nla_get_u32(attrs[XFRMA_SET_MARK]);
561 		if (attrs[XFRMA_SET_MARK_MASK])
562 			m->m = nla_get_u32(attrs[XFRMA_SET_MARK_MASK]);
563 		else
564 			m->m = 0xffffffff;
565 	} else {
566 		m->v = m->m = 0;
567 	}
568 }
569 
570 static struct xfrm_state *xfrm_state_construct(struct net *net,
571 					       struct xfrm_usersa_info *p,
572 					       struct nlattr **attrs,
573 					       int *errp)
574 {
575 	struct xfrm_state *x = xfrm_state_alloc(net);
576 	int err = -ENOMEM;
577 
578 	if (!x)
579 		goto error_no_put;
580 
581 	copy_from_user_state(x, p);
582 
583 	if (attrs[XFRMA_SA_EXTRA_FLAGS])
584 		x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
585 
586 	if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD])))
587 		goto error;
588 	if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
589 				     attrs[XFRMA_ALG_AUTH_TRUNC])))
590 		goto error;
591 	if (!x->props.aalgo) {
592 		if ((err = attach_auth(&x->aalg, &x->props.aalgo,
593 				       attrs[XFRMA_ALG_AUTH])))
594 			goto error;
595 	}
596 	if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT])))
597 		goto error;
598 	if ((err = attach_one_algo(&x->calg, &x->props.calgo,
599 				   xfrm_calg_get_byname,
600 				   attrs[XFRMA_ALG_COMP])))
601 		goto error;
602 
603 	if (attrs[XFRMA_ENCAP]) {
604 		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
605 				   sizeof(*x->encap), GFP_KERNEL);
606 		if (x->encap == NULL)
607 			goto error;
608 	}
609 
610 	if (attrs[XFRMA_TFCPAD])
611 		x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
612 
613 	if (attrs[XFRMA_COADDR]) {
614 		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
615 				    sizeof(*x->coaddr), GFP_KERNEL);
616 		if (x->coaddr == NULL)
617 			goto error;
618 	}
619 
620 	xfrm_mark_get(attrs, &x->mark);
621 
622 	xfrm_smark_init(attrs, &x->props.smark);
623 
624 	if (attrs[XFRMA_IF_ID])
625 		x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
626 
627 	err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]);
628 	if (err)
629 		goto error;
630 
631 	if (attrs[XFRMA_SEC_CTX]) {
632 		err = security_xfrm_state_alloc(x,
633 						nla_data(attrs[XFRMA_SEC_CTX]));
634 		if (err)
635 			goto error;
636 	}
637 
638 	if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
639 					       attrs[XFRMA_REPLAY_ESN_VAL])))
640 		goto error;
641 
642 	x->km.seq = p->seq;
643 	x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
644 	/* sysctl_xfrm_aevent_etime is in 100ms units */
645 	x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
646 
647 	if ((err = xfrm_init_replay(x)))
648 		goto error;
649 
650 	/* override default values from above */
651 	xfrm_update_ae_params(x, attrs, 0);
652 
653 	/* configure the hardware if offload is requested */
654 	if (attrs[XFRMA_OFFLOAD_DEV]) {
655 		err = xfrm_dev_state_add(net, x,
656 					 nla_data(attrs[XFRMA_OFFLOAD_DEV]));
657 		if (err)
658 			goto error;
659 	}
660 
661 	return x;
662 
663 error:
664 	x->km.state = XFRM_STATE_DEAD;
665 	xfrm_state_put(x);
666 error_no_put:
667 	*errp = err;
668 	return NULL;
669 }
670 
671 static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
672 		struct nlattr **attrs)
673 {
674 	struct net *net = sock_net(skb->sk);
675 	struct xfrm_usersa_info *p = nlmsg_data(nlh);
676 	struct xfrm_state *x;
677 	int err;
678 	struct km_event c;
679 
680 	err = verify_newsa_info(p, attrs);
681 	if (err)
682 		return err;
683 
684 	x = xfrm_state_construct(net, p, attrs, &err);
685 	if (!x)
686 		return err;
687 
688 	xfrm_state_hold(x);
689 	if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
690 		err = xfrm_state_add(x);
691 	else
692 		err = xfrm_state_update(x);
693 
694 	xfrm_audit_state_add(x, err ? 0 : 1, true);
695 
696 	if (err < 0) {
697 		x->km.state = XFRM_STATE_DEAD;
698 		xfrm_dev_state_delete(x);
699 		__xfrm_state_put(x);
700 		goto out;
701 	}
702 
703 	if (x->km.state == XFRM_STATE_VOID)
704 		x->km.state = XFRM_STATE_VALID;
705 
706 	c.seq = nlh->nlmsg_seq;
707 	c.portid = nlh->nlmsg_pid;
708 	c.event = nlh->nlmsg_type;
709 
710 	km_state_notify(x, &c);
711 out:
712 	xfrm_state_put(x);
713 	return err;
714 }
715 
716 static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
717 						 struct xfrm_usersa_id *p,
718 						 struct nlattr **attrs,
719 						 int *errp)
720 {
721 	struct xfrm_state *x = NULL;
722 	struct xfrm_mark m;
723 	int err;
724 	u32 mark = xfrm_mark_get(attrs, &m);
725 
726 	if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
727 		err = -ESRCH;
728 		x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
729 	} else {
730 		xfrm_address_t *saddr = NULL;
731 
732 		verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
733 		if (!saddr) {
734 			err = -EINVAL;
735 			goto out;
736 		}
737 
738 		err = -ESRCH;
739 		x = xfrm_state_lookup_byaddr(net, mark,
740 					     &p->daddr, saddr,
741 					     p->proto, p->family);
742 	}
743 
744  out:
745 	if (!x && errp)
746 		*errp = err;
747 	return x;
748 }
749 
750 static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
751 		struct nlattr **attrs)
752 {
753 	struct net *net = sock_net(skb->sk);
754 	struct xfrm_state *x;
755 	int err = -ESRCH;
756 	struct km_event c;
757 	struct xfrm_usersa_id *p = nlmsg_data(nlh);
758 
759 	x = xfrm_user_state_lookup(net, p, attrs, &err);
760 	if (x == NULL)
761 		return err;
762 
763 	if ((err = security_xfrm_state_delete(x)) != 0)
764 		goto out;
765 
766 	if (xfrm_state_kern(x)) {
767 		err = -EPERM;
768 		goto out;
769 	}
770 
771 	err = xfrm_state_delete(x);
772 
773 	if (err < 0)
774 		goto out;
775 
776 	c.seq = nlh->nlmsg_seq;
777 	c.portid = nlh->nlmsg_pid;
778 	c.event = nlh->nlmsg_type;
779 	km_state_notify(x, &c);
780 
781 out:
782 	xfrm_audit_state_delete(x, err ? 0 : 1, true);
783 	xfrm_state_put(x);
784 	return err;
785 }
786 
787 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
788 {
789 	memset(p, 0, sizeof(*p));
790 	memcpy(&p->id, &x->id, sizeof(p->id));
791 	memcpy(&p->sel, &x->sel, sizeof(p->sel));
792 	memcpy(&p->lft, &x->lft, sizeof(p->lft));
793 	memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
794 	put_unaligned(x->stats.replay_window, &p->stats.replay_window);
795 	put_unaligned(x->stats.replay, &p->stats.replay);
796 	put_unaligned(x->stats.integrity_failed, &p->stats.integrity_failed);
797 	memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
798 	p->mode = x->props.mode;
799 	p->replay_window = x->props.replay_window;
800 	p->reqid = x->props.reqid;
801 	p->family = x->props.family;
802 	p->flags = x->props.flags;
803 	p->seq = x->km.seq;
804 }
805 
806 struct xfrm_dump_info {
807 	struct sk_buff *in_skb;
808 	struct sk_buff *out_skb;
809 	u32 nlmsg_seq;
810 	u16 nlmsg_flags;
811 };
812 
813 static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
814 {
815 	struct xfrm_user_sec_ctx *uctx;
816 	struct nlattr *attr;
817 	int ctx_size = sizeof(*uctx) + s->ctx_len;
818 
819 	attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
820 	if (attr == NULL)
821 		return -EMSGSIZE;
822 
823 	uctx = nla_data(attr);
824 	uctx->exttype = XFRMA_SEC_CTX;
825 	uctx->len = ctx_size;
826 	uctx->ctx_doi = s->ctx_doi;
827 	uctx->ctx_alg = s->ctx_alg;
828 	uctx->ctx_len = s->ctx_len;
829 	memcpy(uctx + 1, s->ctx_str, s->ctx_len);
830 
831 	return 0;
832 }
833 
834 static int copy_user_offload(struct xfrm_state_offload *xso, struct sk_buff *skb)
835 {
836 	struct xfrm_user_offload *xuo;
837 	struct nlattr *attr;
838 
839 	attr = nla_reserve(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo));
840 	if (attr == NULL)
841 		return -EMSGSIZE;
842 
843 	xuo = nla_data(attr);
844 	memset(xuo, 0, sizeof(*xuo));
845 	xuo->ifindex = xso->dev->ifindex;
846 	xuo->flags = xso->flags;
847 
848 	return 0;
849 }
850 
851 static bool xfrm_redact(void)
852 {
853 	return IS_ENABLED(CONFIG_SECURITY) &&
854 		security_locked_down(LOCKDOWN_XFRM_SECRET);
855 }
856 
857 static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
858 {
859 	struct xfrm_algo *algo;
860 	struct xfrm_algo_auth *ap;
861 	struct nlattr *nla;
862 	bool redact_secret = xfrm_redact();
863 
864 	nla = nla_reserve(skb, XFRMA_ALG_AUTH,
865 			  sizeof(*algo) + (auth->alg_key_len + 7) / 8);
866 	if (!nla)
867 		return -EMSGSIZE;
868 	algo = nla_data(nla);
869 	strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
870 
871 	if (redact_secret && auth->alg_key_len)
872 		memset(algo->alg_key, 0, (auth->alg_key_len + 7) / 8);
873 	else
874 		memcpy(algo->alg_key, auth->alg_key,
875 		       (auth->alg_key_len + 7) / 8);
876 	algo->alg_key_len = auth->alg_key_len;
877 
878 	nla = nla_reserve(skb, XFRMA_ALG_AUTH_TRUNC, xfrm_alg_auth_len(auth));
879 	if (!nla)
880 		return -EMSGSIZE;
881 	ap = nla_data(nla);
882 	memcpy(ap, auth, sizeof(struct xfrm_algo_auth));
883 	if (redact_secret && auth->alg_key_len)
884 		memset(ap->alg_key, 0, (auth->alg_key_len + 7) / 8);
885 	else
886 		memcpy(ap->alg_key, auth->alg_key,
887 		       (auth->alg_key_len + 7) / 8);
888 	return 0;
889 }
890 
891 static int copy_to_user_aead(struct xfrm_algo_aead *aead, struct sk_buff *skb)
892 {
893 	struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_AEAD, aead_len(aead));
894 	struct xfrm_algo_aead *ap;
895 	bool redact_secret = xfrm_redact();
896 
897 	if (!nla)
898 		return -EMSGSIZE;
899 
900 	ap = nla_data(nla);
901 	memcpy(ap, aead, sizeof(*aead));
902 
903 	if (redact_secret && aead->alg_key_len)
904 		memset(ap->alg_key, 0, (aead->alg_key_len + 7) / 8);
905 	else
906 		memcpy(ap->alg_key, aead->alg_key,
907 		       (aead->alg_key_len + 7) / 8);
908 	return 0;
909 }
910 
911 static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb)
912 {
913 	struct xfrm_algo *ap;
914 	bool redact_secret = xfrm_redact();
915 	struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_CRYPT,
916 					 xfrm_alg_len(ealg));
917 	if (!nla)
918 		return -EMSGSIZE;
919 
920 	ap = nla_data(nla);
921 	memcpy(ap, ealg, sizeof(*ealg));
922 
923 	if (redact_secret && ealg->alg_key_len)
924 		memset(ap->alg_key, 0, (ealg->alg_key_len + 7) / 8);
925 	else
926 		memcpy(ap->alg_key, ealg->alg_key,
927 		       (ealg->alg_key_len + 7) / 8);
928 
929 	return 0;
930 }
931 
932 static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m)
933 {
934 	int ret = 0;
935 
936 	if (m->v | m->m) {
937 		ret = nla_put_u32(skb, XFRMA_SET_MARK, m->v);
938 		if (!ret)
939 			ret = nla_put_u32(skb, XFRMA_SET_MARK_MASK, m->m);
940 	}
941 	return ret;
942 }
943 
944 /* Don't change this without updating xfrm_sa_len! */
945 static int copy_to_user_state_extra(struct xfrm_state *x,
946 				    struct xfrm_usersa_info *p,
947 				    struct sk_buff *skb)
948 {
949 	int ret = 0;
950 
951 	copy_to_user_state(x, p);
952 
953 	if (x->props.extra_flags) {
954 		ret = nla_put_u32(skb, XFRMA_SA_EXTRA_FLAGS,
955 				  x->props.extra_flags);
956 		if (ret)
957 			goto out;
958 	}
959 
960 	if (x->coaddr) {
961 		ret = nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
962 		if (ret)
963 			goto out;
964 	}
965 	if (x->lastused) {
966 		ret = nla_put_u64_64bit(skb, XFRMA_LASTUSED, x->lastused,
967 					XFRMA_PAD);
968 		if (ret)
969 			goto out;
970 	}
971 	if (x->aead) {
972 		ret = copy_to_user_aead(x->aead, skb);
973 		if (ret)
974 			goto out;
975 	}
976 	if (x->aalg) {
977 		ret = copy_to_user_auth(x->aalg, skb);
978 		if (ret)
979 			goto out;
980 	}
981 	if (x->ealg) {
982 		ret = copy_to_user_ealg(x->ealg, skb);
983 		if (ret)
984 			goto out;
985 	}
986 	if (x->calg) {
987 		ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
988 		if (ret)
989 			goto out;
990 	}
991 	if (x->encap) {
992 		ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
993 		if (ret)
994 			goto out;
995 	}
996 	if (x->tfcpad) {
997 		ret = nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad);
998 		if (ret)
999 			goto out;
1000 	}
1001 	ret = xfrm_mark_put(skb, &x->mark);
1002 	if (ret)
1003 		goto out;
1004 
1005 	ret = xfrm_smark_put(skb, &x->props.smark);
1006 	if (ret)
1007 		goto out;
1008 
1009 	if (x->replay_esn)
1010 		ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
1011 			      xfrm_replay_state_esn_len(x->replay_esn),
1012 			      x->replay_esn);
1013 	else
1014 		ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
1015 			      &x->replay);
1016 	if (ret)
1017 		goto out;
1018 	if(x->xso.dev)
1019 		ret = copy_user_offload(&x->xso, skb);
1020 	if (ret)
1021 		goto out;
1022 	if (x->if_id) {
1023 		ret = nla_put_u32(skb, XFRMA_IF_ID, x->if_id);
1024 		if (ret)
1025 			goto out;
1026 	}
1027 	if (x->security)
1028 		ret = copy_sec_ctx(x->security, skb);
1029 out:
1030 	return ret;
1031 }
1032 
1033 static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
1034 {
1035 	struct xfrm_dump_info *sp = ptr;
1036 	struct sk_buff *in_skb = sp->in_skb;
1037 	struct sk_buff *skb = sp->out_skb;
1038 	struct xfrm_translator *xtr;
1039 	struct xfrm_usersa_info *p;
1040 	struct nlmsghdr *nlh;
1041 	int err;
1042 
1043 	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
1044 			XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
1045 	if (nlh == NULL)
1046 		return -EMSGSIZE;
1047 
1048 	p = nlmsg_data(nlh);
1049 
1050 	err = copy_to_user_state_extra(x, p, skb);
1051 	if (err) {
1052 		nlmsg_cancel(skb, nlh);
1053 		return err;
1054 	}
1055 	nlmsg_end(skb, nlh);
1056 
1057 	xtr = xfrm_get_translator();
1058 	if (xtr) {
1059 		err = xtr->alloc_compat(skb, nlh);
1060 
1061 		xfrm_put_translator(xtr);
1062 		if (err) {
1063 			nlmsg_cancel(skb, nlh);
1064 			return err;
1065 		}
1066 	}
1067 
1068 	return 0;
1069 }
1070 
1071 static int xfrm_dump_sa_done(struct netlink_callback *cb)
1072 {
1073 	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
1074 	struct sock *sk = cb->skb->sk;
1075 	struct net *net = sock_net(sk);
1076 
1077 	if (cb->args[0])
1078 		xfrm_state_walk_done(walk, net);
1079 	return 0;
1080 }
1081 
1082 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
1083 {
1084 	struct net *net = sock_net(skb->sk);
1085 	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
1086 	struct xfrm_dump_info info;
1087 
1088 	BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
1089 		     sizeof(cb->args) - sizeof(cb->args[0]));
1090 
1091 	info.in_skb = cb->skb;
1092 	info.out_skb = skb;
1093 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
1094 	info.nlmsg_flags = NLM_F_MULTI;
1095 
1096 	if (!cb->args[0]) {
1097 		struct nlattr *attrs[XFRMA_MAX+1];
1098 		struct xfrm_address_filter *filter = NULL;
1099 		u8 proto = 0;
1100 		int err;
1101 
1102 		err = nlmsg_parse_deprecated(cb->nlh, 0, attrs, XFRMA_MAX,
1103 					     xfrma_policy, cb->extack);
1104 		if (err < 0)
1105 			return err;
1106 
1107 		if (attrs[XFRMA_ADDRESS_FILTER]) {
1108 			filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
1109 					 sizeof(*filter), GFP_KERNEL);
1110 			if (filter == NULL)
1111 				return -ENOMEM;
1112 		}
1113 
1114 		if (attrs[XFRMA_PROTO])
1115 			proto = nla_get_u8(attrs[XFRMA_PROTO]);
1116 
1117 		xfrm_state_walk_init(walk, proto, filter);
1118 		cb->args[0] = 1;
1119 	}
1120 
1121 	(void) xfrm_state_walk(net, walk, dump_one_state, &info);
1122 
1123 	return skb->len;
1124 }
1125 
1126 static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
1127 					  struct xfrm_state *x, u32 seq)
1128 {
1129 	struct xfrm_dump_info info;
1130 	struct sk_buff *skb;
1131 	int err;
1132 
1133 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1134 	if (!skb)
1135 		return ERR_PTR(-ENOMEM);
1136 
1137 	info.in_skb = in_skb;
1138 	info.out_skb = skb;
1139 	info.nlmsg_seq = seq;
1140 	info.nlmsg_flags = 0;
1141 
1142 	err = dump_one_state(x, 0, &info);
1143 	if (err) {
1144 		kfree_skb(skb);
1145 		return ERR_PTR(err);
1146 	}
1147 
1148 	return skb;
1149 }
1150 
1151 /* A wrapper for nlmsg_multicast() checking that nlsk is still available.
1152  * Must be called with RCU read lock.
1153  */
1154 static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
1155 				       u32 pid, unsigned int group)
1156 {
1157 	struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
1158 	struct xfrm_translator *xtr;
1159 
1160 	if (!nlsk) {
1161 		kfree_skb(skb);
1162 		return -EPIPE;
1163 	}
1164 
1165 	xtr = xfrm_get_translator();
1166 	if (xtr) {
1167 		int err = xtr->alloc_compat(skb, nlmsg_hdr(skb));
1168 
1169 		xfrm_put_translator(xtr);
1170 		if (err) {
1171 			kfree_skb(skb);
1172 			return err;
1173 		}
1174 	}
1175 
1176 	return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
1177 }
1178 
1179 static inline unsigned int xfrm_spdinfo_msgsize(void)
1180 {
1181 	return NLMSG_ALIGN(4)
1182 	       + nla_total_size(sizeof(struct xfrmu_spdinfo))
1183 	       + nla_total_size(sizeof(struct xfrmu_spdhinfo))
1184 	       + nla_total_size(sizeof(struct xfrmu_spdhthresh))
1185 	       + nla_total_size(sizeof(struct xfrmu_spdhthresh));
1186 }
1187 
1188 static int build_spdinfo(struct sk_buff *skb, struct net *net,
1189 			 u32 portid, u32 seq, u32 flags)
1190 {
1191 	struct xfrmk_spdinfo si;
1192 	struct xfrmu_spdinfo spc;
1193 	struct xfrmu_spdhinfo sph;
1194 	struct xfrmu_spdhthresh spt4, spt6;
1195 	struct nlmsghdr *nlh;
1196 	int err;
1197 	u32 *f;
1198 	unsigned lseq;
1199 
1200 	nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
1201 	if (nlh == NULL) /* shouldn't really happen ... */
1202 		return -EMSGSIZE;
1203 
1204 	f = nlmsg_data(nlh);
1205 	*f = flags;
1206 	xfrm_spd_getinfo(net, &si);
1207 	spc.incnt = si.incnt;
1208 	spc.outcnt = si.outcnt;
1209 	spc.fwdcnt = si.fwdcnt;
1210 	spc.inscnt = si.inscnt;
1211 	spc.outscnt = si.outscnt;
1212 	spc.fwdscnt = si.fwdscnt;
1213 	sph.spdhcnt = si.spdhcnt;
1214 	sph.spdhmcnt = si.spdhmcnt;
1215 
1216 	do {
1217 		lseq = read_seqbegin(&net->xfrm.policy_hthresh.lock);
1218 
1219 		spt4.lbits = net->xfrm.policy_hthresh.lbits4;
1220 		spt4.rbits = net->xfrm.policy_hthresh.rbits4;
1221 		spt6.lbits = net->xfrm.policy_hthresh.lbits6;
1222 		spt6.rbits = net->xfrm.policy_hthresh.rbits6;
1223 	} while (read_seqretry(&net->xfrm.policy_hthresh.lock, lseq));
1224 
1225 	err = nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
1226 	if (!err)
1227 		err = nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
1228 	if (!err)
1229 		err = nla_put(skb, XFRMA_SPD_IPV4_HTHRESH, sizeof(spt4), &spt4);
1230 	if (!err)
1231 		err = nla_put(skb, XFRMA_SPD_IPV6_HTHRESH, sizeof(spt6), &spt6);
1232 	if (err) {
1233 		nlmsg_cancel(skb, nlh);
1234 		return err;
1235 	}
1236 
1237 	nlmsg_end(skb, nlh);
1238 	return 0;
1239 }
1240 
1241 static int xfrm_set_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
1242 			    struct nlattr **attrs)
1243 {
1244 	struct net *net = sock_net(skb->sk);
1245 	struct xfrmu_spdhthresh *thresh4 = NULL;
1246 	struct xfrmu_spdhthresh *thresh6 = NULL;
1247 
1248 	/* selector prefixlen thresholds to hash policies */
1249 	if (attrs[XFRMA_SPD_IPV4_HTHRESH]) {
1250 		struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH];
1251 
1252 		if (nla_len(rta) < sizeof(*thresh4))
1253 			return -EINVAL;
1254 		thresh4 = nla_data(rta);
1255 		if (thresh4->lbits > 32 || thresh4->rbits > 32)
1256 			return -EINVAL;
1257 	}
1258 	if (attrs[XFRMA_SPD_IPV6_HTHRESH]) {
1259 		struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH];
1260 
1261 		if (nla_len(rta) < sizeof(*thresh6))
1262 			return -EINVAL;
1263 		thresh6 = nla_data(rta);
1264 		if (thresh6->lbits > 128 || thresh6->rbits > 128)
1265 			return -EINVAL;
1266 	}
1267 
1268 	if (thresh4 || thresh6) {
1269 		write_seqlock(&net->xfrm.policy_hthresh.lock);
1270 		if (thresh4) {
1271 			net->xfrm.policy_hthresh.lbits4 = thresh4->lbits;
1272 			net->xfrm.policy_hthresh.rbits4 = thresh4->rbits;
1273 		}
1274 		if (thresh6) {
1275 			net->xfrm.policy_hthresh.lbits6 = thresh6->lbits;
1276 			net->xfrm.policy_hthresh.rbits6 = thresh6->rbits;
1277 		}
1278 		write_sequnlock(&net->xfrm.policy_hthresh.lock);
1279 
1280 		xfrm_policy_hash_rebuild(net);
1281 	}
1282 
1283 	return 0;
1284 }
1285 
1286 static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
1287 		struct nlattr **attrs)
1288 {
1289 	struct net *net = sock_net(skb->sk);
1290 	struct sk_buff *r_skb;
1291 	u32 *flags = nlmsg_data(nlh);
1292 	u32 sportid = NETLINK_CB(skb).portid;
1293 	u32 seq = nlh->nlmsg_seq;
1294 	int err;
1295 
1296 	r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
1297 	if (r_skb == NULL)
1298 		return -ENOMEM;
1299 
1300 	err = build_spdinfo(r_skb, net, sportid, seq, *flags);
1301 	BUG_ON(err < 0);
1302 
1303 	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
1304 }
1305 
1306 static inline unsigned int xfrm_sadinfo_msgsize(void)
1307 {
1308 	return NLMSG_ALIGN(4)
1309 	       + nla_total_size(sizeof(struct xfrmu_sadhinfo))
1310 	       + nla_total_size(4); /* XFRMA_SAD_CNT */
1311 }
1312 
1313 static int build_sadinfo(struct sk_buff *skb, struct net *net,
1314 			 u32 portid, u32 seq, u32 flags)
1315 {
1316 	struct xfrmk_sadinfo si;
1317 	struct xfrmu_sadhinfo sh;
1318 	struct nlmsghdr *nlh;
1319 	int err;
1320 	u32 *f;
1321 
1322 	nlh = nlmsg_put(skb, portid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
1323 	if (nlh == NULL) /* shouldn't really happen ... */
1324 		return -EMSGSIZE;
1325 
1326 	f = nlmsg_data(nlh);
1327 	*f = flags;
1328 	xfrm_sad_getinfo(net, &si);
1329 
1330 	sh.sadhmcnt = si.sadhmcnt;
1331 	sh.sadhcnt = si.sadhcnt;
1332 
1333 	err = nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt);
1334 	if (!err)
1335 		err = nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
1336 	if (err) {
1337 		nlmsg_cancel(skb, nlh);
1338 		return err;
1339 	}
1340 
1341 	nlmsg_end(skb, nlh);
1342 	return 0;
1343 }
1344 
1345 static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
1346 		struct nlattr **attrs)
1347 {
1348 	struct net *net = sock_net(skb->sk);
1349 	struct sk_buff *r_skb;
1350 	u32 *flags = nlmsg_data(nlh);
1351 	u32 sportid = NETLINK_CB(skb).portid;
1352 	u32 seq = nlh->nlmsg_seq;
1353 	int err;
1354 
1355 	r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
1356 	if (r_skb == NULL)
1357 		return -ENOMEM;
1358 
1359 	err = build_sadinfo(r_skb, net, sportid, seq, *flags);
1360 	BUG_ON(err < 0);
1361 
1362 	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
1363 }
1364 
1365 static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
1366 		struct nlattr **attrs)
1367 {
1368 	struct net *net = sock_net(skb->sk);
1369 	struct xfrm_usersa_id *p = nlmsg_data(nlh);
1370 	struct xfrm_state *x;
1371 	struct sk_buff *resp_skb;
1372 	int err = -ESRCH;
1373 
1374 	x = xfrm_user_state_lookup(net, p, attrs, &err);
1375 	if (x == NULL)
1376 		goto out_noput;
1377 
1378 	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
1379 	if (IS_ERR(resp_skb)) {
1380 		err = PTR_ERR(resp_skb);
1381 	} else {
1382 		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
1383 	}
1384 	xfrm_state_put(x);
1385 out_noput:
1386 	return err;
1387 }
1388 
1389 static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
1390 		struct nlattr **attrs)
1391 {
1392 	struct net *net = sock_net(skb->sk);
1393 	struct xfrm_state *x;
1394 	struct xfrm_userspi_info *p;
1395 	struct xfrm_translator *xtr;
1396 	struct sk_buff *resp_skb;
1397 	xfrm_address_t *daddr;
1398 	int family;
1399 	int err;
1400 	u32 mark;
1401 	struct xfrm_mark m;
1402 	u32 if_id = 0;
1403 
1404 	p = nlmsg_data(nlh);
1405 	err = verify_spi_info(p->info.id.proto, p->min, p->max);
1406 	if (err)
1407 		goto out_noput;
1408 
1409 	family = p->info.family;
1410 	daddr = &p->info.id.daddr;
1411 
1412 	x = NULL;
1413 
1414 	mark = xfrm_mark_get(attrs, &m);
1415 
1416 	if (attrs[XFRMA_IF_ID])
1417 		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
1418 
1419 	if (p->info.seq) {
1420 		x = xfrm_find_acq_byseq(net, mark, p->info.seq);
1421 		if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) {
1422 			xfrm_state_put(x);
1423 			x = NULL;
1424 		}
1425 	}
1426 
1427 	if (!x)
1428 		x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
1429 				  if_id, p->info.id.proto, daddr,
1430 				  &p->info.saddr, 1,
1431 				  family);
1432 	err = -ENOENT;
1433 	if (x == NULL)
1434 		goto out_noput;
1435 
1436 	err = xfrm_alloc_spi(x, p->min, p->max);
1437 	if (err)
1438 		goto out;
1439 
1440 	resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
1441 	if (IS_ERR(resp_skb)) {
1442 		err = PTR_ERR(resp_skb);
1443 		goto out;
1444 	}
1445 
1446 	xtr = xfrm_get_translator();
1447 	if (xtr) {
1448 		err = xtr->alloc_compat(skb, nlmsg_hdr(skb));
1449 
1450 		xfrm_put_translator(xtr);
1451 		if (err) {
1452 			kfree_skb(resp_skb);
1453 			goto out;
1454 		}
1455 	}
1456 
1457 	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
1458 
1459 out:
1460 	xfrm_state_put(x);
1461 out_noput:
1462 	return err;
1463 }
1464 
1465 static int verify_policy_dir(u8 dir)
1466 {
1467 	switch (dir) {
1468 	case XFRM_POLICY_IN:
1469 	case XFRM_POLICY_OUT:
1470 	case XFRM_POLICY_FWD:
1471 		break;
1472 
1473 	default:
1474 		return -EINVAL;
1475 	}
1476 
1477 	return 0;
1478 }
1479 
1480 static int verify_policy_type(u8 type)
1481 {
1482 	switch (type) {
1483 	case XFRM_POLICY_TYPE_MAIN:
1484 #ifdef CONFIG_XFRM_SUB_POLICY
1485 	case XFRM_POLICY_TYPE_SUB:
1486 #endif
1487 		break;
1488 
1489 	default:
1490 		return -EINVAL;
1491 	}
1492 
1493 	return 0;
1494 }
1495 
1496 static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
1497 {
1498 	int ret;
1499 
1500 	switch (p->share) {
1501 	case XFRM_SHARE_ANY:
1502 	case XFRM_SHARE_SESSION:
1503 	case XFRM_SHARE_USER:
1504 	case XFRM_SHARE_UNIQUE:
1505 		break;
1506 
1507 	default:
1508 		return -EINVAL;
1509 	}
1510 
1511 	switch (p->action) {
1512 	case XFRM_POLICY_ALLOW:
1513 	case XFRM_POLICY_BLOCK:
1514 		break;
1515 
1516 	default:
1517 		return -EINVAL;
1518 	}
1519 
1520 	switch (p->sel.family) {
1521 	case AF_INET:
1522 		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
1523 			return -EINVAL;
1524 
1525 		break;
1526 
1527 	case AF_INET6:
1528 #if IS_ENABLED(CONFIG_IPV6)
1529 		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
1530 			return -EINVAL;
1531 
1532 		break;
1533 #else
1534 		return  -EAFNOSUPPORT;
1535 #endif
1536 
1537 	default:
1538 		return -EINVAL;
1539 	}
1540 
1541 	ret = verify_policy_dir(p->dir);
1542 	if (ret)
1543 		return ret;
1544 	if (p->index && (xfrm_policy_id2dir(p->index) != p->dir))
1545 		return -EINVAL;
1546 
1547 	return 0;
1548 }
1549 
1550 static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
1551 {
1552 	struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1553 	struct xfrm_user_sec_ctx *uctx;
1554 
1555 	if (!rt)
1556 		return 0;
1557 
1558 	uctx = nla_data(rt);
1559 	return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL);
1560 }
1561 
1562 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
1563 			   int nr)
1564 {
1565 	int i;
1566 
1567 	xp->xfrm_nr = nr;
1568 	for (i = 0; i < nr; i++, ut++) {
1569 		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
1570 
1571 		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
1572 		memcpy(&t->saddr, &ut->saddr,
1573 		       sizeof(xfrm_address_t));
1574 		t->reqid = ut->reqid;
1575 		t->mode = ut->mode;
1576 		t->share = ut->share;
1577 		t->optional = ut->optional;
1578 		t->aalgos = ut->aalgos;
1579 		t->ealgos = ut->ealgos;
1580 		t->calgos = ut->calgos;
1581 		/* If all masks are ~0, then we allow all algorithms. */
1582 		t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1583 		t->encap_family = ut->family;
1584 	}
1585 }
1586 
1587 static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
1588 {
1589 	u16 prev_family;
1590 	int i;
1591 
1592 	if (nr > XFRM_MAX_DEPTH)
1593 		return -EINVAL;
1594 
1595 	prev_family = family;
1596 
1597 	for (i = 0; i < nr; i++) {
1598 		/* We never validated the ut->family value, so many
1599 		 * applications simply leave it at zero.  The check was
1600 		 * never made and ut->family was ignored because all
1601 		 * templates could be assumed to have the same family as
1602 		 * the policy itself.  Now that we will have ipv4-in-ipv6
1603 		 * and ipv6-in-ipv4 tunnels, this is no longer true.
1604 		 */
1605 		if (!ut[i].family)
1606 			ut[i].family = family;
1607 
1608 		switch (ut[i].mode) {
1609 		case XFRM_MODE_TUNNEL:
1610 		case XFRM_MODE_BEET:
1611 			break;
1612 		default:
1613 			if (ut[i].family != prev_family)
1614 				return -EINVAL;
1615 			break;
1616 		}
1617 		if (ut[i].mode >= XFRM_MODE_MAX)
1618 			return -EINVAL;
1619 
1620 		prev_family = ut[i].family;
1621 
1622 		switch (ut[i].family) {
1623 		case AF_INET:
1624 			break;
1625 #if IS_ENABLED(CONFIG_IPV6)
1626 		case AF_INET6:
1627 			break;
1628 #endif
1629 		default:
1630 			return -EINVAL;
1631 		}
1632 
1633 		if (!xfrm_id_proto_valid(ut[i].id.proto))
1634 			return -EINVAL;
1635 	}
1636 
1637 	return 0;
1638 }
1639 
1640 static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
1641 {
1642 	struct nlattr *rt = attrs[XFRMA_TMPL];
1643 
1644 	if (!rt) {
1645 		pol->xfrm_nr = 0;
1646 	} else {
1647 		struct xfrm_user_tmpl *utmpl = nla_data(rt);
1648 		int nr = nla_len(rt) / sizeof(*utmpl);
1649 		int err;
1650 
1651 		err = validate_tmpl(nr, utmpl, pol->family);
1652 		if (err)
1653 			return err;
1654 
1655 		copy_templates(pol, utmpl, nr);
1656 	}
1657 	return 0;
1658 }
1659 
1660 static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
1661 {
1662 	struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
1663 	struct xfrm_userpolicy_type *upt;
1664 	u8 type = XFRM_POLICY_TYPE_MAIN;
1665 	int err;
1666 
1667 	if (rt) {
1668 		upt = nla_data(rt);
1669 		type = upt->type;
1670 	}
1671 
1672 	err = verify_policy_type(type);
1673 	if (err)
1674 		return err;
1675 
1676 	*tp = type;
1677 	return 0;
1678 }
1679 
1680 static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
1681 {
1682 	xp->priority = p->priority;
1683 	xp->index = p->index;
1684 	memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
1685 	memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
1686 	xp->action = p->action;
1687 	xp->flags = p->flags;
1688 	xp->family = p->sel.family;
1689 	/* XXX xp->share = p->share; */
1690 }
1691 
1692 static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
1693 {
1694 	memset(p, 0, sizeof(*p));
1695 	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
1696 	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
1697 	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
1698 	p->priority = xp->priority;
1699 	p->index = xp->index;
1700 	p->sel.family = xp->family;
1701 	p->dir = dir;
1702 	p->action = xp->action;
1703 	p->flags = xp->flags;
1704 	p->share = XFRM_SHARE_ANY; /* XXX xp->share */
1705 }
1706 
1707 static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
1708 {
1709 	struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
1710 	int err;
1711 
1712 	if (!xp) {
1713 		*errp = -ENOMEM;
1714 		return NULL;
1715 	}
1716 
1717 	copy_from_user_policy(xp, p);
1718 
1719 	err = copy_from_user_policy_type(&xp->type, attrs);
1720 	if (err)
1721 		goto error;
1722 
1723 	if (!(err = copy_from_user_tmpl(xp, attrs)))
1724 		err = copy_from_user_sec_ctx(xp, attrs);
1725 	if (err)
1726 		goto error;
1727 
1728 	xfrm_mark_get(attrs, &xp->mark);
1729 
1730 	if (attrs[XFRMA_IF_ID])
1731 		xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
1732 
1733 	return xp;
1734  error:
1735 	*errp = err;
1736 	xp->walk.dead = 1;
1737 	xfrm_policy_destroy(xp);
1738 	return NULL;
1739 }
1740 
1741 static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1742 		struct nlattr **attrs)
1743 {
1744 	struct net *net = sock_net(skb->sk);
1745 	struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
1746 	struct xfrm_policy *xp;
1747 	struct km_event c;
1748 	int err;
1749 	int excl;
1750 
1751 	err = verify_newpolicy_info(p);
1752 	if (err)
1753 		return err;
1754 	err = verify_sec_ctx_len(attrs);
1755 	if (err)
1756 		return err;
1757 
1758 	xp = xfrm_policy_construct(net, p, attrs, &err);
1759 	if (!xp)
1760 		return err;
1761 
1762 	/* shouldn't excl be based on nlh flags??
1763 	 * Aha! this is anti-netlink really i.e  more pfkey derived
1764 	 * in netlink excl is a flag and you wouldnt need
1765 	 * a type XFRM_MSG_UPDPOLICY - JHS */
1766 	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
1767 	err = xfrm_policy_insert(p->dir, xp, excl);
1768 	xfrm_audit_policy_add(xp, err ? 0 : 1, true);
1769 
1770 	if (err) {
1771 		security_xfrm_policy_free(xp->security);
1772 		kfree(xp);
1773 		return err;
1774 	}
1775 
1776 	c.event = nlh->nlmsg_type;
1777 	c.seq = nlh->nlmsg_seq;
1778 	c.portid = nlh->nlmsg_pid;
1779 	km_policy_notify(xp, p->dir, &c);
1780 
1781 	xfrm_pol_put(xp);
1782 
1783 	return 0;
1784 }
1785 
1786 static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
1787 {
1788 	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
1789 	int i;
1790 
1791 	if (xp->xfrm_nr == 0)
1792 		return 0;
1793 
1794 	for (i = 0; i < xp->xfrm_nr; i++) {
1795 		struct xfrm_user_tmpl *up = &vec[i];
1796 		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
1797 
1798 		memset(up, 0, sizeof(*up));
1799 		memcpy(&up->id, &kp->id, sizeof(up->id));
1800 		up->family = kp->encap_family;
1801 		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
1802 		up->reqid = kp->reqid;
1803 		up->mode = kp->mode;
1804 		up->share = kp->share;
1805 		up->optional = kp->optional;
1806 		up->aalgos = kp->aalgos;
1807 		up->ealgos = kp->ealgos;
1808 		up->calgos = kp->calgos;
1809 	}
1810 
1811 	return nla_put(skb, XFRMA_TMPL,
1812 		       sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
1813 }
1814 
1815 static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
1816 {
1817 	if (x->security) {
1818 		return copy_sec_ctx(x->security, skb);
1819 	}
1820 	return 0;
1821 }
1822 
1823 static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
1824 {
1825 	if (xp->security)
1826 		return copy_sec_ctx(xp->security, skb);
1827 	return 0;
1828 }
1829 static inline unsigned int userpolicy_type_attrsize(void)
1830 {
1831 #ifdef CONFIG_XFRM_SUB_POLICY
1832 	return nla_total_size(sizeof(struct xfrm_userpolicy_type));
1833 #else
1834 	return 0;
1835 #endif
1836 }
1837 
1838 #ifdef CONFIG_XFRM_SUB_POLICY
1839 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1840 {
1841 	struct xfrm_userpolicy_type upt;
1842 
1843 	/* Sadly there are two holes in struct xfrm_userpolicy_type */
1844 	memset(&upt, 0, sizeof(upt));
1845 	upt.type = type;
1846 
1847 	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
1848 }
1849 
1850 #else
1851 static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
1852 {
1853 	return 0;
1854 }
1855 #endif
1856 
1857 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
1858 {
1859 	struct xfrm_dump_info *sp = ptr;
1860 	struct xfrm_userpolicy_info *p;
1861 	struct sk_buff *in_skb = sp->in_skb;
1862 	struct sk_buff *skb = sp->out_skb;
1863 	struct xfrm_translator *xtr;
1864 	struct nlmsghdr *nlh;
1865 	int err;
1866 
1867 	nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, sp->nlmsg_seq,
1868 			XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
1869 	if (nlh == NULL)
1870 		return -EMSGSIZE;
1871 
1872 	p = nlmsg_data(nlh);
1873 	copy_to_user_policy(xp, p, dir);
1874 	err = copy_to_user_tmpl(xp, skb);
1875 	if (!err)
1876 		err = copy_to_user_sec_ctx(xp, skb);
1877 	if (!err)
1878 		err = copy_to_user_policy_type(xp->type, skb);
1879 	if (!err)
1880 		err = xfrm_mark_put(skb, &xp->mark);
1881 	if (!err)
1882 		err = xfrm_if_id_put(skb, xp->if_id);
1883 	if (err) {
1884 		nlmsg_cancel(skb, nlh);
1885 		return err;
1886 	}
1887 	nlmsg_end(skb, nlh);
1888 
1889 	xtr = xfrm_get_translator();
1890 	if (xtr) {
1891 		err = xtr->alloc_compat(skb, nlh);
1892 
1893 		xfrm_put_translator(xtr);
1894 		if (err) {
1895 			nlmsg_cancel(skb, nlh);
1896 			return err;
1897 		}
1898 	}
1899 
1900 	return 0;
1901 }
1902 
1903 static int xfrm_dump_policy_done(struct netlink_callback *cb)
1904 {
1905 	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
1906 	struct net *net = sock_net(cb->skb->sk);
1907 
1908 	xfrm_policy_walk_done(walk, net);
1909 	return 0;
1910 }
1911 
1912 static int xfrm_dump_policy_start(struct netlink_callback *cb)
1913 {
1914 	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
1915 
1916 	BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
1917 
1918 	xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
1919 	return 0;
1920 }
1921 
1922 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
1923 {
1924 	struct net *net = sock_net(skb->sk);
1925 	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
1926 	struct xfrm_dump_info info;
1927 
1928 	info.in_skb = cb->skb;
1929 	info.out_skb = skb;
1930 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
1931 	info.nlmsg_flags = NLM_F_MULTI;
1932 
1933 	(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
1934 
1935 	return skb->len;
1936 }
1937 
1938 static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
1939 					  struct xfrm_policy *xp,
1940 					  int dir, u32 seq)
1941 {
1942 	struct xfrm_dump_info info;
1943 	struct sk_buff *skb;
1944 	int err;
1945 
1946 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1947 	if (!skb)
1948 		return ERR_PTR(-ENOMEM);
1949 
1950 	info.in_skb = in_skb;
1951 	info.out_skb = skb;
1952 	info.nlmsg_seq = seq;
1953 	info.nlmsg_flags = 0;
1954 
1955 	err = dump_one_policy(xp, dir, 0, &info);
1956 	if (err) {
1957 		kfree_skb(skb);
1958 		return ERR_PTR(err);
1959 	}
1960 
1961 	return skb;
1962 }
1963 
1964 static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
1965 		struct nlattr **attrs)
1966 {
1967 	struct net *net = sock_net(skb->sk);
1968 	struct xfrm_policy *xp;
1969 	struct xfrm_userpolicy_id *p;
1970 	u8 type = XFRM_POLICY_TYPE_MAIN;
1971 	int err;
1972 	struct km_event c;
1973 	int delete;
1974 	struct xfrm_mark m;
1975 	u32 if_id = 0;
1976 
1977 	p = nlmsg_data(nlh);
1978 	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
1979 
1980 	err = copy_from_user_policy_type(&type, attrs);
1981 	if (err)
1982 		return err;
1983 
1984 	err = verify_policy_dir(p->dir);
1985 	if (err)
1986 		return err;
1987 
1988 	if (attrs[XFRMA_IF_ID])
1989 		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
1990 
1991 	xfrm_mark_get(attrs, &m);
1992 
1993 	if (p->index)
1994 		xp = xfrm_policy_byid(net, &m, if_id, type, p->dir,
1995 				      p->index, delete, &err);
1996 	else {
1997 		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
1998 		struct xfrm_sec_ctx *ctx;
1999 
2000 		err = verify_sec_ctx_len(attrs);
2001 		if (err)
2002 			return err;
2003 
2004 		ctx = NULL;
2005 		if (rt) {
2006 			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
2007 
2008 			err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
2009 			if (err)
2010 				return err;
2011 		}
2012 		xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
2013 					   &p->sel, ctx, delete, &err);
2014 		security_xfrm_policy_free(ctx);
2015 	}
2016 	if (xp == NULL)
2017 		return -ENOENT;
2018 
2019 	if (!delete) {
2020 		struct sk_buff *resp_skb;
2021 
2022 		resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
2023 		if (IS_ERR(resp_skb)) {
2024 			err = PTR_ERR(resp_skb);
2025 		} else {
2026 			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
2027 					    NETLINK_CB(skb).portid);
2028 		}
2029 	} else {
2030 		xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
2031 
2032 		if (err != 0)
2033 			goto out;
2034 
2035 		c.data.byid = p->index;
2036 		c.event = nlh->nlmsg_type;
2037 		c.seq = nlh->nlmsg_seq;
2038 		c.portid = nlh->nlmsg_pid;
2039 		km_policy_notify(xp, p->dir, &c);
2040 	}
2041 
2042 out:
2043 	xfrm_pol_put(xp);
2044 	return err;
2045 }
2046 
2047 static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
2048 		struct nlattr **attrs)
2049 {
2050 	struct net *net = sock_net(skb->sk);
2051 	struct km_event c;
2052 	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
2053 	int err;
2054 
2055 	err = xfrm_state_flush(net, p->proto, true, false);
2056 	if (err) {
2057 		if (err == -ESRCH) /* empty table */
2058 			return 0;
2059 		return err;
2060 	}
2061 	c.data.proto = p->proto;
2062 	c.event = nlh->nlmsg_type;
2063 	c.seq = nlh->nlmsg_seq;
2064 	c.portid = nlh->nlmsg_pid;
2065 	c.net = net;
2066 	km_state_notify(NULL, &c);
2067 
2068 	return 0;
2069 }
2070 
2071 static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x)
2072 {
2073 	unsigned int replay_size = x->replay_esn ?
2074 			      xfrm_replay_state_esn_len(x->replay_esn) :
2075 			      sizeof(struct xfrm_replay_state);
2076 
2077 	return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
2078 	       + nla_total_size(replay_size)
2079 	       + nla_total_size_64bit(sizeof(struct xfrm_lifetime_cur))
2080 	       + nla_total_size(sizeof(struct xfrm_mark))
2081 	       + nla_total_size(4) /* XFRM_AE_RTHR */
2082 	       + nla_total_size(4); /* XFRM_AE_ETHR */
2083 }
2084 
2085 static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
2086 {
2087 	struct xfrm_aevent_id *id;
2088 	struct nlmsghdr *nlh;
2089 	int err;
2090 
2091 	nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
2092 	if (nlh == NULL)
2093 		return -EMSGSIZE;
2094 
2095 	id = nlmsg_data(nlh);
2096 	memset(&id->sa_id, 0, sizeof(id->sa_id));
2097 	memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr));
2098 	id->sa_id.spi = x->id.spi;
2099 	id->sa_id.family = x->props.family;
2100 	id->sa_id.proto = x->id.proto;
2101 	memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr));
2102 	id->reqid = x->props.reqid;
2103 	id->flags = c->data.aevent;
2104 
2105 	if (x->replay_esn) {
2106 		err = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
2107 			      xfrm_replay_state_esn_len(x->replay_esn),
2108 			      x->replay_esn);
2109 	} else {
2110 		err = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
2111 			      &x->replay);
2112 	}
2113 	if (err)
2114 		goto out_cancel;
2115 	err = nla_put_64bit(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft,
2116 			    XFRMA_PAD);
2117 	if (err)
2118 		goto out_cancel;
2119 
2120 	if (id->flags & XFRM_AE_RTHR) {
2121 		err = nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
2122 		if (err)
2123 			goto out_cancel;
2124 	}
2125 	if (id->flags & XFRM_AE_ETHR) {
2126 		err = nla_put_u32(skb, XFRMA_ETIMER_THRESH,
2127 				  x->replay_maxage * 10 / HZ);
2128 		if (err)
2129 			goto out_cancel;
2130 	}
2131 	err = xfrm_mark_put(skb, &x->mark);
2132 	if (err)
2133 		goto out_cancel;
2134 
2135 	err = xfrm_if_id_put(skb, x->if_id);
2136 	if (err)
2137 		goto out_cancel;
2138 
2139 	nlmsg_end(skb, nlh);
2140 	return 0;
2141 
2142 out_cancel:
2143 	nlmsg_cancel(skb, nlh);
2144 	return err;
2145 }
2146 
2147 static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
2148 		struct nlattr **attrs)
2149 {
2150 	struct net *net = sock_net(skb->sk);
2151 	struct xfrm_state *x;
2152 	struct sk_buff *r_skb;
2153 	int err;
2154 	struct km_event c;
2155 	u32 mark;
2156 	struct xfrm_mark m;
2157 	struct xfrm_aevent_id *p = nlmsg_data(nlh);
2158 	struct xfrm_usersa_id *id = &p->sa_id;
2159 
2160 	mark = xfrm_mark_get(attrs, &m);
2161 
2162 	x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
2163 	if (x == NULL)
2164 		return -ESRCH;
2165 
2166 	r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
2167 	if (r_skb == NULL) {
2168 		xfrm_state_put(x);
2169 		return -ENOMEM;
2170 	}
2171 
2172 	/*
2173 	 * XXX: is this lock really needed - none of the other
2174 	 * gets lock (the concern is things getting updated
2175 	 * while we are still reading) - jhs
2176 	*/
2177 	spin_lock_bh(&x->lock);
2178 	c.data.aevent = p->flags;
2179 	c.seq = nlh->nlmsg_seq;
2180 	c.portid = nlh->nlmsg_pid;
2181 
2182 	err = build_aevent(r_skb, x, &c);
2183 	BUG_ON(err < 0);
2184 
2185 	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
2186 	spin_unlock_bh(&x->lock);
2187 	xfrm_state_put(x);
2188 	return err;
2189 }
2190 
2191 static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
2192 		struct nlattr **attrs)
2193 {
2194 	struct net *net = sock_net(skb->sk);
2195 	struct xfrm_state *x;
2196 	struct km_event c;
2197 	int err = -EINVAL;
2198 	u32 mark = 0;
2199 	struct xfrm_mark m;
2200 	struct xfrm_aevent_id *p = nlmsg_data(nlh);
2201 	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
2202 	struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
2203 	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
2204 	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
2205 	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
2206 
2207 	if (!lt && !rp && !re && !et && !rt)
2208 		return err;
2209 
2210 	/* pedantic mode - thou shalt sayeth replaceth */
2211 	if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
2212 		return err;
2213 
2214 	mark = xfrm_mark_get(attrs, &m);
2215 
2216 	x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
2217 	if (x == NULL)
2218 		return -ESRCH;
2219 
2220 	if (x->km.state != XFRM_STATE_VALID)
2221 		goto out;
2222 
2223 	err = xfrm_replay_verify_len(x->replay_esn, re);
2224 	if (err)
2225 		goto out;
2226 
2227 	spin_lock_bh(&x->lock);
2228 	xfrm_update_ae_params(x, attrs, 1);
2229 	spin_unlock_bh(&x->lock);
2230 
2231 	c.event = nlh->nlmsg_type;
2232 	c.seq = nlh->nlmsg_seq;
2233 	c.portid = nlh->nlmsg_pid;
2234 	c.data.aevent = XFRM_AE_CU;
2235 	km_state_notify(x, &c);
2236 	err = 0;
2237 out:
2238 	xfrm_state_put(x);
2239 	return err;
2240 }
2241 
2242 static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
2243 		struct nlattr **attrs)
2244 {
2245 	struct net *net = sock_net(skb->sk);
2246 	struct km_event c;
2247 	u8 type = XFRM_POLICY_TYPE_MAIN;
2248 	int err;
2249 
2250 	err = copy_from_user_policy_type(&type, attrs);
2251 	if (err)
2252 		return err;
2253 
2254 	err = xfrm_policy_flush(net, type, true);
2255 	if (err) {
2256 		if (err == -ESRCH) /* empty table */
2257 			return 0;
2258 		return err;
2259 	}
2260 
2261 	c.data.type = type;
2262 	c.event = nlh->nlmsg_type;
2263 	c.seq = nlh->nlmsg_seq;
2264 	c.portid = nlh->nlmsg_pid;
2265 	c.net = net;
2266 	km_policy_notify(NULL, 0, &c);
2267 	return 0;
2268 }
2269 
2270 static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
2271 		struct nlattr **attrs)
2272 {
2273 	struct net *net = sock_net(skb->sk);
2274 	struct xfrm_policy *xp;
2275 	struct xfrm_user_polexpire *up = nlmsg_data(nlh);
2276 	struct xfrm_userpolicy_info *p = &up->pol;
2277 	u8 type = XFRM_POLICY_TYPE_MAIN;
2278 	int err = -ENOENT;
2279 	struct xfrm_mark m;
2280 	u32 if_id = 0;
2281 
2282 	err = copy_from_user_policy_type(&type, attrs);
2283 	if (err)
2284 		return err;
2285 
2286 	err = verify_policy_dir(p->dir);
2287 	if (err)
2288 		return err;
2289 
2290 	if (attrs[XFRMA_IF_ID])
2291 		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
2292 
2293 	xfrm_mark_get(attrs, &m);
2294 
2295 	if (p->index)
2296 		xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index,
2297 				      0, &err);
2298 	else {
2299 		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
2300 		struct xfrm_sec_ctx *ctx;
2301 
2302 		err = verify_sec_ctx_len(attrs);
2303 		if (err)
2304 			return err;
2305 
2306 		ctx = NULL;
2307 		if (rt) {
2308 			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
2309 
2310 			err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
2311 			if (err)
2312 				return err;
2313 		}
2314 		xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
2315 					   &p->sel, ctx, 0, &err);
2316 		security_xfrm_policy_free(ctx);
2317 	}
2318 	if (xp == NULL)
2319 		return -ENOENT;
2320 
2321 	if (unlikely(xp->walk.dead))
2322 		goto out;
2323 
2324 	err = 0;
2325 	if (up->hard) {
2326 		xfrm_policy_delete(xp, p->dir);
2327 		xfrm_audit_policy_delete(xp, 1, true);
2328 	}
2329 	km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
2330 
2331 out:
2332 	xfrm_pol_put(xp);
2333 	return err;
2334 }
2335 
2336 static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
2337 		struct nlattr **attrs)
2338 {
2339 	struct net *net = sock_net(skb->sk);
2340 	struct xfrm_state *x;
2341 	int err;
2342 	struct xfrm_user_expire *ue = nlmsg_data(nlh);
2343 	struct xfrm_usersa_info *p = &ue->state;
2344 	struct xfrm_mark m;
2345 	u32 mark = xfrm_mark_get(attrs, &m);
2346 
2347 	x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
2348 
2349 	err = -ENOENT;
2350 	if (x == NULL)
2351 		return err;
2352 
2353 	spin_lock_bh(&x->lock);
2354 	err = -EINVAL;
2355 	if (x->km.state != XFRM_STATE_VALID)
2356 		goto out;
2357 	km_state_expired(x, ue->hard, nlh->nlmsg_pid);
2358 
2359 	if (ue->hard) {
2360 		__xfrm_state_delete(x);
2361 		xfrm_audit_state_delete(x, 1, true);
2362 	}
2363 	err = 0;
2364 out:
2365 	spin_unlock_bh(&x->lock);
2366 	xfrm_state_put(x);
2367 	return err;
2368 }
2369 
2370 static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
2371 		struct nlattr **attrs)
2372 {
2373 	struct net *net = sock_net(skb->sk);
2374 	struct xfrm_policy *xp;
2375 	struct xfrm_user_tmpl *ut;
2376 	int i;
2377 	struct nlattr *rt = attrs[XFRMA_TMPL];
2378 	struct xfrm_mark mark;
2379 
2380 	struct xfrm_user_acquire *ua = nlmsg_data(nlh);
2381 	struct xfrm_state *x = xfrm_state_alloc(net);
2382 	int err = -ENOMEM;
2383 
2384 	if (!x)
2385 		goto nomem;
2386 
2387 	xfrm_mark_get(attrs, &mark);
2388 
2389 	err = verify_newpolicy_info(&ua->policy);
2390 	if (err)
2391 		goto free_state;
2392 	err = verify_sec_ctx_len(attrs);
2393 	if (err)
2394 		goto free_state;
2395 
2396 	/*   build an XP */
2397 	xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
2398 	if (!xp)
2399 		goto free_state;
2400 
2401 	memcpy(&x->id, &ua->id, sizeof(ua->id));
2402 	memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
2403 	memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
2404 	xp->mark.m = x->mark.m = mark.m;
2405 	xp->mark.v = x->mark.v = mark.v;
2406 	ut = nla_data(rt);
2407 	/* extract the templates and for each call km_key */
2408 	for (i = 0; i < xp->xfrm_nr; i++, ut++) {
2409 		struct xfrm_tmpl *t = &xp->xfrm_vec[i];
2410 		memcpy(&x->id, &t->id, sizeof(x->id));
2411 		x->props.mode = t->mode;
2412 		x->props.reqid = t->reqid;
2413 		x->props.family = ut->family;
2414 		t->aalgos = ua->aalgos;
2415 		t->ealgos = ua->ealgos;
2416 		t->calgos = ua->calgos;
2417 		err = km_query(x, t, xp);
2418 
2419 	}
2420 
2421 	xfrm_state_free(x);
2422 	kfree(xp);
2423 
2424 	return 0;
2425 
2426 free_state:
2427 	xfrm_state_free(x);
2428 nomem:
2429 	return err;
2430 }
2431 
2432 #ifdef CONFIG_XFRM_MIGRATE
2433 static int copy_from_user_migrate(struct xfrm_migrate *ma,
2434 				  struct xfrm_kmaddress *k,
2435 				  struct nlattr **attrs, int *num)
2436 {
2437 	struct nlattr *rt = attrs[XFRMA_MIGRATE];
2438 	struct xfrm_user_migrate *um;
2439 	int i, num_migrate;
2440 
2441 	if (k != NULL) {
2442 		struct xfrm_user_kmaddress *uk;
2443 
2444 		uk = nla_data(attrs[XFRMA_KMADDRESS]);
2445 		memcpy(&k->local, &uk->local, sizeof(k->local));
2446 		memcpy(&k->remote, &uk->remote, sizeof(k->remote));
2447 		k->family = uk->family;
2448 		k->reserved = uk->reserved;
2449 	}
2450 
2451 	um = nla_data(rt);
2452 	num_migrate = nla_len(rt) / sizeof(*um);
2453 
2454 	if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
2455 		return -EINVAL;
2456 
2457 	for (i = 0; i < num_migrate; i++, um++, ma++) {
2458 		memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
2459 		memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
2460 		memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
2461 		memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
2462 
2463 		ma->proto = um->proto;
2464 		ma->mode = um->mode;
2465 		ma->reqid = um->reqid;
2466 
2467 		ma->old_family = um->old_family;
2468 		ma->new_family = um->new_family;
2469 	}
2470 
2471 	*num = i;
2472 	return 0;
2473 }
2474 
2475 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2476 			   struct nlattr **attrs)
2477 {
2478 	struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
2479 	struct xfrm_migrate m[XFRM_MAX_DEPTH];
2480 	struct xfrm_kmaddress km, *kmp;
2481 	u8 type;
2482 	int err;
2483 	int n = 0;
2484 	struct net *net = sock_net(skb->sk);
2485 	struct xfrm_encap_tmpl  *encap = NULL;
2486 
2487 	if (attrs[XFRMA_MIGRATE] == NULL)
2488 		return -EINVAL;
2489 
2490 	kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;
2491 
2492 	err = copy_from_user_policy_type(&type, attrs);
2493 	if (err)
2494 		return err;
2495 
2496 	err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
2497 	if (err)
2498 		return err;
2499 
2500 	if (!n)
2501 		return 0;
2502 
2503 	if (attrs[XFRMA_ENCAP]) {
2504 		encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
2505 				sizeof(*encap), GFP_KERNEL);
2506 		if (!encap)
2507 			return -ENOMEM;
2508 	}
2509 
2510 	err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap);
2511 
2512 	kfree(encap);
2513 
2514 	return err;
2515 }
2516 #else
2517 static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
2518 			   struct nlattr **attrs)
2519 {
2520 	return -ENOPROTOOPT;
2521 }
2522 #endif
2523 
2524 #ifdef CONFIG_XFRM_MIGRATE
2525 static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
2526 {
2527 	struct xfrm_user_migrate um;
2528 
2529 	memset(&um, 0, sizeof(um));
2530 	um.proto = m->proto;
2531 	um.mode = m->mode;
2532 	um.reqid = m->reqid;
2533 	um.old_family = m->old_family;
2534 	memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
2535 	memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
2536 	um.new_family = m->new_family;
2537 	memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
2538 	memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
2539 
2540 	return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
2541 }
2542 
2543 static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
2544 {
2545 	struct xfrm_user_kmaddress uk;
2546 
2547 	memset(&uk, 0, sizeof(uk));
2548 	uk.family = k->family;
2549 	uk.reserved = k->reserved;
2550 	memcpy(&uk.local, &k->local, sizeof(uk.local));
2551 	memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
2552 
2553 	return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
2554 }
2555 
2556 static inline unsigned int xfrm_migrate_msgsize(int num_migrate, int with_kma,
2557 						int with_encp)
2558 {
2559 	return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
2560 	      + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
2561 	      + (with_encp ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0)
2562 	      + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
2563 	      + userpolicy_type_attrsize();
2564 }
2565 
2566 static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
2567 			 int num_migrate, const struct xfrm_kmaddress *k,
2568 			 const struct xfrm_selector *sel,
2569 			 const struct xfrm_encap_tmpl *encap, u8 dir, u8 type)
2570 {
2571 	const struct xfrm_migrate *mp;
2572 	struct xfrm_userpolicy_id *pol_id;
2573 	struct nlmsghdr *nlh;
2574 	int i, err;
2575 
2576 	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
2577 	if (nlh == NULL)
2578 		return -EMSGSIZE;
2579 
2580 	pol_id = nlmsg_data(nlh);
2581 	/* copy data from selector, dir, and type to the pol_id */
2582 	memset(pol_id, 0, sizeof(*pol_id));
2583 	memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
2584 	pol_id->dir = dir;
2585 
2586 	if (k != NULL) {
2587 		err = copy_to_user_kmaddress(k, skb);
2588 		if (err)
2589 			goto out_cancel;
2590 	}
2591 	if (encap) {
2592 		err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap);
2593 		if (err)
2594 			goto out_cancel;
2595 	}
2596 	err = copy_to_user_policy_type(type, skb);
2597 	if (err)
2598 		goto out_cancel;
2599 	for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
2600 		err = copy_to_user_migrate(mp, skb);
2601 		if (err)
2602 			goto out_cancel;
2603 	}
2604 
2605 	nlmsg_end(skb, nlh);
2606 	return 0;
2607 
2608 out_cancel:
2609 	nlmsg_cancel(skb, nlh);
2610 	return err;
2611 }
2612 
2613 static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2614 			     const struct xfrm_migrate *m, int num_migrate,
2615 			     const struct xfrm_kmaddress *k,
2616 			     const struct xfrm_encap_tmpl *encap)
2617 {
2618 	struct net *net = &init_net;
2619 	struct sk_buff *skb;
2620 	int err;
2621 
2622 	skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap),
2623 			GFP_ATOMIC);
2624 	if (skb == NULL)
2625 		return -ENOMEM;
2626 
2627 	/* build migrate */
2628 	err = build_migrate(skb, m, num_migrate, k, sel, encap, dir, type);
2629 	BUG_ON(err < 0);
2630 
2631 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
2632 }
2633 #else
2634 static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
2635 			     const struct xfrm_migrate *m, int num_migrate,
2636 			     const struct xfrm_kmaddress *k,
2637 			     const struct xfrm_encap_tmpl *encap)
2638 {
2639 	return -ENOPROTOOPT;
2640 }
2641 #endif
2642 
2643 #define XMSGSIZE(type) sizeof(struct type)
2644 
2645 const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
2646 	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2647 	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
2648 	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
2649 	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2650 	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2651 	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2652 	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
2653 	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
2654 	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
2655 	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
2656 	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
2657 	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
2658 	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
2659 	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
2660 	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2661 	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
2662 	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
2663 	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
2664 	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
2665 	[XFRM_MSG_NEWSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
2666 	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
2667 };
2668 EXPORT_SYMBOL_GPL(xfrm_msg_min);
2669 
2670 #undef XMSGSIZE
2671 
2672 const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
2673 	[XFRMA_SA]		= { .len = sizeof(struct xfrm_usersa_info)},
2674 	[XFRMA_POLICY]		= { .len = sizeof(struct xfrm_userpolicy_info)},
2675 	[XFRMA_LASTUSED]	= { .type = NLA_U64},
2676 	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
2677 	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
2678 	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
2679 	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
2680 	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
2681 	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
2682 	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
2683 	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_sec_ctx) },
2684 	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
2685 	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
2686 	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
2687 	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
2688 	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
2689 	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
2690 	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
2691 	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
2692 	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
2693 	[XFRMA_MARK]		= { .len = sizeof(struct xfrm_mark) },
2694 	[XFRMA_TFCPAD]		= { .type = NLA_U32 },
2695 	[XFRMA_REPLAY_ESN_VAL]	= { .len = sizeof(struct xfrm_replay_state_esn) },
2696 	[XFRMA_SA_EXTRA_FLAGS]	= { .type = NLA_U32 },
2697 	[XFRMA_PROTO]		= { .type = NLA_U8 },
2698 	[XFRMA_ADDRESS_FILTER]	= { .len = sizeof(struct xfrm_address_filter) },
2699 	[XFRMA_OFFLOAD_DEV]	= { .len = sizeof(struct xfrm_user_offload) },
2700 	[XFRMA_SET_MARK]	= { .type = NLA_U32 },
2701 	[XFRMA_SET_MARK_MASK]	= { .type = NLA_U32 },
2702 	[XFRMA_IF_ID]		= { .type = NLA_U32 },
2703 };
2704 EXPORT_SYMBOL_GPL(xfrma_policy);
2705 
2706 static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
2707 	[XFRMA_SPD_IPV4_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
2708 	[XFRMA_SPD_IPV6_HTHRESH] = { .len = sizeof(struct xfrmu_spdhthresh) },
2709 };
2710 
2711 static const struct xfrm_link {
2712 	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
2713 	int (*start)(struct netlink_callback *);
2714 	int (*dump)(struct sk_buff *, struct netlink_callback *);
2715 	int (*done)(struct netlink_callback *);
2716 	const struct nla_policy *nla_pol;
2717 	int nla_max;
2718 } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
2719 	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
2720 	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
2721 	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
2722 						   .dump = xfrm_dump_sa,
2723 						   .done = xfrm_dump_sa_done  },
2724 	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
2725 	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
2726 	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
2727 						   .start = xfrm_dump_policy_start,
2728 						   .dump = xfrm_dump_policy,
2729 						   .done = xfrm_dump_policy_done },
2730 	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
2731 	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
2732 	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
2733 	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
2734 	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
2735 	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
2736 	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
2737 	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
2738 	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = { .doit = xfrm_new_ae  },
2739 	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = { .doit = xfrm_get_ae  },
2740 	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate    },
2741 	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo   },
2742 	[XFRM_MSG_NEWSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_set_spdinfo,
2743 						   .nla_pol = xfrma_spd_policy,
2744 						   .nla_max = XFRMA_SPD_MAX },
2745 	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo   },
2746 };
2747 
2748 static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
2749 			     struct netlink_ext_ack *extack)
2750 {
2751 	struct net *net = sock_net(skb->sk);
2752 	struct nlattr *attrs[XFRMA_MAX+1];
2753 	const struct xfrm_link *link;
2754 	struct nlmsghdr *nlh64 = NULL;
2755 	int type, err;
2756 
2757 	type = nlh->nlmsg_type;
2758 	if (type > XFRM_MSG_MAX)
2759 		return -EINVAL;
2760 
2761 	type -= XFRM_MSG_BASE;
2762 	link = &xfrm_dispatch[type];
2763 
2764 	/* All operations require privileges, even GET */
2765 	if (!netlink_net_capable(skb, CAP_NET_ADMIN))
2766 		return -EPERM;
2767 
2768 	if (in_compat_syscall()) {
2769 		struct xfrm_translator *xtr = xfrm_get_translator();
2770 
2771 		if (!xtr)
2772 			return -EOPNOTSUPP;
2773 
2774 		nlh64 = xtr->rcv_msg_compat(nlh, link->nla_max,
2775 					    link->nla_pol, extack);
2776 		xfrm_put_translator(xtr);
2777 		if (IS_ERR(nlh64))
2778 			return PTR_ERR(nlh64);
2779 		if (nlh64)
2780 			nlh = nlh64;
2781 	}
2782 
2783 	if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
2784 	     type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
2785 	    (nlh->nlmsg_flags & NLM_F_DUMP)) {
2786 		struct netlink_dump_control c = {
2787 			.start = link->start,
2788 			.dump = link->dump,
2789 			.done = link->done,
2790 		};
2791 
2792 		if (link->dump == NULL) {
2793 			err = -EINVAL;
2794 			goto err;
2795 		}
2796 
2797 		err = netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
2798 		goto err;
2799 	}
2800 
2801 	err = nlmsg_parse_deprecated(nlh, xfrm_msg_min[type], attrs,
2802 				     link->nla_max ? : XFRMA_MAX,
2803 				     link->nla_pol ? : xfrma_policy, extack);
2804 	if (err < 0)
2805 		goto err;
2806 
2807 	if (link->doit == NULL) {
2808 		err = -EINVAL;
2809 		goto err;
2810 	}
2811 
2812 	err = link->doit(skb, nlh, attrs);
2813 
2814 err:
2815 	kvfree(nlh64);
2816 	return err;
2817 }
2818 
2819 static void xfrm_netlink_rcv(struct sk_buff *skb)
2820 {
2821 	struct net *net = sock_net(skb->sk);
2822 
2823 	mutex_lock(&net->xfrm.xfrm_cfg_mutex);
2824 	netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
2825 	mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
2826 }
2827 
2828 static inline unsigned int xfrm_expire_msgsize(void)
2829 {
2830 	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
2831 	       + nla_total_size(sizeof(struct xfrm_mark));
2832 }
2833 
2834 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
2835 {
2836 	struct xfrm_user_expire *ue;
2837 	struct nlmsghdr *nlh;
2838 	int err;
2839 
2840 	nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
2841 	if (nlh == NULL)
2842 		return -EMSGSIZE;
2843 
2844 	ue = nlmsg_data(nlh);
2845 	copy_to_user_state(x, &ue->state);
2846 	ue->hard = (c->data.hard != 0) ? 1 : 0;
2847 	/* clear the padding bytes */
2848 	memset(&ue->hard + 1, 0, sizeof(*ue) - offsetofend(typeof(*ue), hard));
2849 
2850 	err = xfrm_mark_put(skb, &x->mark);
2851 	if (err)
2852 		return err;
2853 
2854 	err = xfrm_if_id_put(skb, x->if_id);
2855 	if (err)
2856 		return err;
2857 
2858 	nlmsg_end(skb, nlh);
2859 	return 0;
2860 }
2861 
2862 static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
2863 {
2864 	struct net *net = xs_net(x);
2865 	struct sk_buff *skb;
2866 
2867 	skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
2868 	if (skb == NULL)
2869 		return -ENOMEM;
2870 
2871 	if (build_expire(skb, x, c) < 0) {
2872 		kfree_skb(skb);
2873 		return -EMSGSIZE;
2874 	}
2875 
2876 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
2877 }
2878 
2879 static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
2880 {
2881 	struct net *net = xs_net(x);
2882 	struct sk_buff *skb;
2883 	int err;
2884 
2885 	skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
2886 	if (skb == NULL)
2887 		return -ENOMEM;
2888 
2889 	err = build_aevent(skb, x, c);
2890 	BUG_ON(err < 0);
2891 
2892 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS);
2893 }
2894 
2895 static int xfrm_notify_sa_flush(const struct km_event *c)
2896 {
2897 	struct net *net = c->net;
2898 	struct xfrm_usersa_flush *p;
2899 	struct nlmsghdr *nlh;
2900 	struct sk_buff *skb;
2901 	int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
2902 
2903 	skb = nlmsg_new(len, GFP_ATOMIC);
2904 	if (skb == NULL)
2905 		return -ENOMEM;
2906 
2907 	nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
2908 	if (nlh == NULL) {
2909 		kfree_skb(skb);
2910 		return -EMSGSIZE;
2911 	}
2912 
2913 	p = nlmsg_data(nlh);
2914 	p->proto = c->data.proto;
2915 
2916 	nlmsg_end(skb, nlh);
2917 
2918 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
2919 }
2920 
2921 static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
2922 {
2923 	unsigned int l = 0;
2924 	if (x->aead)
2925 		l += nla_total_size(aead_len(x->aead));
2926 	if (x->aalg) {
2927 		l += nla_total_size(sizeof(struct xfrm_algo) +
2928 				    (x->aalg->alg_key_len + 7) / 8);
2929 		l += nla_total_size(xfrm_alg_auth_len(x->aalg));
2930 	}
2931 	if (x->ealg)
2932 		l += nla_total_size(xfrm_alg_len(x->ealg));
2933 	if (x->calg)
2934 		l += nla_total_size(sizeof(*x->calg));
2935 	if (x->encap)
2936 		l += nla_total_size(sizeof(*x->encap));
2937 	if (x->tfcpad)
2938 		l += nla_total_size(sizeof(x->tfcpad));
2939 	if (x->replay_esn)
2940 		l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
2941 	else
2942 		l += nla_total_size(sizeof(struct xfrm_replay_state));
2943 	if (x->security)
2944 		l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
2945 				    x->security->ctx_len);
2946 	if (x->coaddr)
2947 		l += nla_total_size(sizeof(*x->coaddr));
2948 	if (x->props.extra_flags)
2949 		l += nla_total_size(sizeof(x->props.extra_flags));
2950 	if (x->xso.dev)
2951 		 l += nla_total_size(sizeof(x->xso));
2952 	if (x->props.smark.v | x->props.smark.m) {
2953 		l += nla_total_size(sizeof(x->props.smark.v));
2954 		l += nla_total_size(sizeof(x->props.smark.m));
2955 	}
2956 	if (x->if_id)
2957 		l += nla_total_size(sizeof(x->if_id));
2958 
2959 	/* Must count x->lastused as it may become non-zero behind our back. */
2960 	l += nla_total_size_64bit(sizeof(u64));
2961 
2962 	return l;
2963 }
2964 
2965 static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
2966 {
2967 	struct net *net = xs_net(x);
2968 	struct xfrm_usersa_info *p;
2969 	struct xfrm_usersa_id *id;
2970 	struct nlmsghdr *nlh;
2971 	struct sk_buff *skb;
2972 	unsigned int len = xfrm_sa_len(x);
2973 	unsigned int headlen;
2974 	int err;
2975 
2976 	headlen = sizeof(*p);
2977 	if (c->event == XFRM_MSG_DELSA) {
2978 		len += nla_total_size(headlen);
2979 		headlen = sizeof(*id);
2980 		len += nla_total_size(sizeof(struct xfrm_mark));
2981 	}
2982 	len += NLMSG_ALIGN(headlen);
2983 
2984 	skb = nlmsg_new(len, GFP_ATOMIC);
2985 	if (skb == NULL)
2986 		return -ENOMEM;
2987 
2988 	nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
2989 	err = -EMSGSIZE;
2990 	if (nlh == NULL)
2991 		goto out_free_skb;
2992 
2993 	p = nlmsg_data(nlh);
2994 	if (c->event == XFRM_MSG_DELSA) {
2995 		struct nlattr *attr;
2996 
2997 		id = nlmsg_data(nlh);
2998 		memset(id, 0, sizeof(*id));
2999 		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
3000 		id->spi = x->id.spi;
3001 		id->family = x->props.family;
3002 		id->proto = x->id.proto;
3003 
3004 		attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
3005 		err = -EMSGSIZE;
3006 		if (attr == NULL)
3007 			goto out_free_skb;
3008 
3009 		p = nla_data(attr);
3010 	}
3011 	err = copy_to_user_state_extra(x, p, skb);
3012 	if (err)
3013 		goto out_free_skb;
3014 
3015 	nlmsg_end(skb, nlh);
3016 
3017 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
3018 
3019 out_free_skb:
3020 	kfree_skb(skb);
3021 	return err;
3022 }
3023 
3024 static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
3025 {
3026 
3027 	switch (c->event) {
3028 	case XFRM_MSG_EXPIRE:
3029 		return xfrm_exp_state_notify(x, c);
3030 	case XFRM_MSG_NEWAE:
3031 		return xfrm_aevent_state_notify(x, c);
3032 	case XFRM_MSG_DELSA:
3033 	case XFRM_MSG_UPDSA:
3034 	case XFRM_MSG_NEWSA:
3035 		return xfrm_notify_sa(x, c);
3036 	case XFRM_MSG_FLUSHSA:
3037 		return xfrm_notify_sa_flush(c);
3038 	default:
3039 		printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
3040 		       c->event);
3041 		break;
3042 	}
3043 
3044 	return 0;
3045 
3046 }
3047 
3048 static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x,
3049 						struct xfrm_policy *xp)
3050 {
3051 	return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
3052 	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
3053 	       + nla_total_size(sizeof(struct xfrm_mark))
3054 	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
3055 	       + userpolicy_type_attrsize();
3056 }
3057 
3058 static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
3059 			 struct xfrm_tmpl *xt, struct xfrm_policy *xp)
3060 {
3061 	__u32 seq = xfrm_get_acqseq();
3062 	struct xfrm_user_acquire *ua;
3063 	struct nlmsghdr *nlh;
3064 	int err;
3065 
3066 	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
3067 	if (nlh == NULL)
3068 		return -EMSGSIZE;
3069 
3070 	ua = nlmsg_data(nlh);
3071 	memcpy(&ua->id, &x->id, sizeof(ua->id));
3072 	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
3073 	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
3074 	copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT);
3075 	ua->aalgos = xt->aalgos;
3076 	ua->ealgos = xt->ealgos;
3077 	ua->calgos = xt->calgos;
3078 	ua->seq = x->km.seq = seq;
3079 
3080 	err = copy_to_user_tmpl(xp, skb);
3081 	if (!err)
3082 		err = copy_to_user_state_sec_ctx(x, skb);
3083 	if (!err)
3084 		err = copy_to_user_policy_type(xp->type, skb);
3085 	if (!err)
3086 		err = xfrm_mark_put(skb, &xp->mark);
3087 	if (!err)
3088 		err = xfrm_if_id_put(skb, xp->if_id);
3089 	if (err) {
3090 		nlmsg_cancel(skb, nlh);
3091 		return err;
3092 	}
3093 
3094 	nlmsg_end(skb, nlh);
3095 	return 0;
3096 }
3097 
3098 static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
3099 			     struct xfrm_policy *xp)
3100 {
3101 	struct net *net = xs_net(x);
3102 	struct sk_buff *skb;
3103 	int err;
3104 
3105 	skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
3106 	if (skb == NULL)
3107 		return -ENOMEM;
3108 
3109 	err = build_acquire(skb, x, xt, xp);
3110 	BUG_ON(err < 0);
3111 
3112 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
3113 }
3114 
3115 /* User gives us xfrm_user_policy_info followed by an array of 0
3116  * or more templates.
3117  */
3118 static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
3119 					       u8 *data, int len, int *dir)
3120 {
3121 	struct net *net = sock_net(sk);
3122 	struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
3123 	struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
3124 	struct xfrm_policy *xp;
3125 	int nr;
3126 
3127 	switch (sk->sk_family) {
3128 	case AF_INET:
3129 		if (opt != IP_XFRM_POLICY) {
3130 			*dir = -EOPNOTSUPP;
3131 			return NULL;
3132 		}
3133 		break;
3134 #if IS_ENABLED(CONFIG_IPV6)
3135 	case AF_INET6:
3136 		if (opt != IPV6_XFRM_POLICY) {
3137 			*dir = -EOPNOTSUPP;
3138 			return NULL;
3139 		}
3140 		break;
3141 #endif
3142 	default:
3143 		*dir = -EINVAL;
3144 		return NULL;
3145 	}
3146 
3147 	*dir = -EINVAL;
3148 
3149 	if (len < sizeof(*p) ||
3150 	    verify_newpolicy_info(p))
3151 		return NULL;
3152 
3153 	nr = ((len - sizeof(*p)) / sizeof(*ut));
3154 	if (validate_tmpl(nr, ut, p->sel.family))
3155 		return NULL;
3156 
3157 	if (p->dir > XFRM_POLICY_OUT)
3158 		return NULL;
3159 
3160 	xp = xfrm_policy_alloc(net, GFP_ATOMIC);
3161 	if (xp == NULL) {
3162 		*dir = -ENOBUFS;
3163 		return NULL;
3164 	}
3165 
3166 	copy_from_user_policy(xp, p);
3167 	xp->type = XFRM_POLICY_TYPE_MAIN;
3168 	copy_templates(xp, ut, nr);
3169 
3170 	*dir = p->dir;
3171 
3172 	return xp;
3173 }
3174 
3175 static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp)
3176 {
3177 	return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
3178 	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
3179 	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
3180 	       + nla_total_size(sizeof(struct xfrm_mark))
3181 	       + userpolicy_type_attrsize();
3182 }
3183 
3184 static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
3185 			   int dir, const struct km_event *c)
3186 {
3187 	struct xfrm_user_polexpire *upe;
3188 	int hard = c->data.hard;
3189 	struct nlmsghdr *nlh;
3190 	int err;
3191 
3192 	nlh = nlmsg_put(skb, c->portid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
3193 	if (nlh == NULL)
3194 		return -EMSGSIZE;
3195 
3196 	upe = nlmsg_data(nlh);
3197 	copy_to_user_policy(xp, &upe->pol, dir);
3198 	err = copy_to_user_tmpl(xp, skb);
3199 	if (!err)
3200 		err = copy_to_user_sec_ctx(xp, skb);
3201 	if (!err)
3202 		err = copy_to_user_policy_type(xp->type, skb);
3203 	if (!err)
3204 		err = xfrm_mark_put(skb, &xp->mark);
3205 	if (!err)
3206 		err = xfrm_if_id_put(skb, xp->if_id);
3207 	if (err) {
3208 		nlmsg_cancel(skb, nlh);
3209 		return err;
3210 	}
3211 	upe->hard = !!hard;
3212 
3213 	nlmsg_end(skb, nlh);
3214 	return 0;
3215 }
3216 
3217 static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
3218 {
3219 	struct net *net = xp_net(xp);
3220 	struct sk_buff *skb;
3221 	int err;
3222 
3223 	skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
3224 	if (skb == NULL)
3225 		return -ENOMEM;
3226 
3227 	err = build_polexpire(skb, xp, dir, c);
3228 	BUG_ON(err < 0);
3229 
3230 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
3231 }
3232 
3233 static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
3234 {
3235 	unsigned int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
3236 	struct net *net = xp_net(xp);
3237 	struct xfrm_userpolicy_info *p;
3238 	struct xfrm_userpolicy_id *id;
3239 	struct nlmsghdr *nlh;
3240 	struct sk_buff *skb;
3241 	unsigned int headlen;
3242 	int err;
3243 
3244 	headlen = sizeof(*p);
3245 	if (c->event == XFRM_MSG_DELPOLICY) {
3246 		len += nla_total_size(headlen);
3247 		headlen = sizeof(*id);
3248 	}
3249 	len += userpolicy_type_attrsize();
3250 	len += nla_total_size(sizeof(struct xfrm_mark));
3251 	len += NLMSG_ALIGN(headlen);
3252 
3253 	skb = nlmsg_new(len, GFP_ATOMIC);
3254 	if (skb == NULL)
3255 		return -ENOMEM;
3256 
3257 	nlh = nlmsg_put(skb, c->portid, c->seq, c->event, headlen, 0);
3258 	err = -EMSGSIZE;
3259 	if (nlh == NULL)
3260 		goto out_free_skb;
3261 
3262 	p = nlmsg_data(nlh);
3263 	if (c->event == XFRM_MSG_DELPOLICY) {
3264 		struct nlattr *attr;
3265 
3266 		id = nlmsg_data(nlh);
3267 		memset(id, 0, sizeof(*id));
3268 		id->dir = dir;
3269 		if (c->data.byid)
3270 			id->index = xp->index;
3271 		else
3272 			memcpy(&id->sel, &xp->selector, sizeof(id->sel));
3273 
3274 		attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
3275 		err = -EMSGSIZE;
3276 		if (attr == NULL)
3277 			goto out_free_skb;
3278 
3279 		p = nla_data(attr);
3280 	}
3281 
3282 	copy_to_user_policy(xp, p, dir);
3283 	err = copy_to_user_tmpl(xp, skb);
3284 	if (!err)
3285 		err = copy_to_user_policy_type(xp->type, skb);
3286 	if (!err)
3287 		err = xfrm_mark_put(skb, &xp->mark);
3288 	if (!err)
3289 		err = xfrm_if_id_put(skb, xp->if_id);
3290 	if (err)
3291 		goto out_free_skb;
3292 
3293 	nlmsg_end(skb, nlh);
3294 
3295 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
3296 
3297 out_free_skb:
3298 	kfree_skb(skb);
3299 	return err;
3300 }
3301 
3302 static int xfrm_notify_policy_flush(const struct km_event *c)
3303 {
3304 	struct net *net = c->net;
3305 	struct nlmsghdr *nlh;
3306 	struct sk_buff *skb;
3307 	int err;
3308 
3309 	skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
3310 	if (skb == NULL)
3311 		return -ENOMEM;
3312 
3313 	nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
3314 	err = -EMSGSIZE;
3315 	if (nlh == NULL)
3316 		goto out_free_skb;
3317 	err = copy_to_user_policy_type(c->data.type, skb);
3318 	if (err)
3319 		goto out_free_skb;
3320 
3321 	nlmsg_end(skb, nlh);
3322 
3323 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
3324 
3325 out_free_skb:
3326 	kfree_skb(skb);
3327 	return err;
3328 }
3329 
3330 static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
3331 {
3332 
3333 	switch (c->event) {
3334 	case XFRM_MSG_NEWPOLICY:
3335 	case XFRM_MSG_UPDPOLICY:
3336 	case XFRM_MSG_DELPOLICY:
3337 		return xfrm_notify_policy(xp, dir, c);
3338 	case XFRM_MSG_FLUSHPOLICY:
3339 		return xfrm_notify_policy_flush(c);
3340 	case XFRM_MSG_POLEXPIRE:
3341 		return xfrm_exp_policy_notify(xp, dir, c);
3342 	default:
3343 		printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
3344 		       c->event);
3345 	}
3346 
3347 	return 0;
3348 
3349 }
3350 
3351 static inline unsigned int xfrm_report_msgsize(void)
3352 {
3353 	return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
3354 }
3355 
3356 static int build_report(struct sk_buff *skb, u8 proto,
3357 			struct xfrm_selector *sel, xfrm_address_t *addr)
3358 {
3359 	struct xfrm_user_report *ur;
3360 	struct nlmsghdr *nlh;
3361 
3362 	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
3363 	if (nlh == NULL)
3364 		return -EMSGSIZE;
3365 
3366 	ur = nlmsg_data(nlh);
3367 	ur->proto = proto;
3368 	memcpy(&ur->sel, sel, sizeof(ur->sel));
3369 
3370 	if (addr) {
3371 		int err = nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr);
3372 		if (err) {
3373 			nlmsg_cancel(skb, nlh);
3374 			return err;
3375 		}
3376 	}
3377 	nlmsg_end(skb, nlh);
3378 	return 0;
3379 }
3380 
3381 static int xfrm_send_report(struct net *net, u8 proto,
3382 			    struct xfrm_selector *sel, xfrm_address_t *addr)
3383 {
3384 	struct sk_buff *skb;
3385 	int err;
3386 
3387 	skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
3388 	if (skb == NULL)
3389 		return -ENOMEM;
3390 
3391 	err = build_report(skb, proto, sel, addr);
3392 	BUG_ON(err < 0);
3393 
3394 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT);
3395 }
3396 
3397 static inline unsigned int xfrm_mapping_msgsize(void)
3398 {
3399 	return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
3400 }
3401 
3402 static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
3403 			 xfrm_address_t *new_saddr, __be16 new_sport)
3404 {
3405 	struct xfrm_user_mapping *um;
3406 	struct nlmsghdr *nlh;
3407 
3408 	nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
3409 	if (nlh == NULL)
3410 		return -EMSGSIZE;
3411 
3412 	um = nlmsg_data(nlh);
3413 
3414 	memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
3415 	um->id.spi = x->id.spi;
3416 	um->id.family = x->props.family;
3417 	um->id.proto = x->id.proto;
3418 	memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
3419 	memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
3420 	um->new_sport = new_sport;
3421 	um->old_sport = x->encap->encap_sport;
3422 	um->reqid = x->props.reqid;
3423 
3424 	nlmsg_end(skb, nlh);
3425 	return 0;
3426 }
3427 
3428 static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
3429 			     __be16 sport)
3430 {
3431 	struct net *net = xs_net(x);
3432 	struct sk_buff *skb;
3433 	int err;
3434 
3435 	if (x->id.proto != IPPROTO_ESP)
3436 		return -EINVAL;
3437 
3438 	if (!x->encap)
3439 		return -EINVAL;
3440 
3441 	skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
3442 	if (skb == NULL)
3443 		return -ENOMEM;
3444 
3445 	err = build_mapping(skb, x, ipaddr, sport);
3446 	BUG_ON(err < 0);
3447 
3448 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING);
3449 }
3450 
3451 static bool xfrm_is_alive(const struct km_event *c)
3452 {
3453 	return (bool)xfrm_acquire_is_on(c->net);
3454 }
3455 
3456 static struct xfrm_mgr netlink_mgr = {
3457 	.notify		= xfrm_send_state_notify,
3458 	.acquire	= xfrm_send_acquire,
3459 	.compile_policy	= xfrm_compile_policy,
3460 	.notify_policy	= xfrm_send_policy_notify,
3461 	.report		= xfrm_send_report,
3462 	.migrate	= xfrm_send_migrate,
3463 	.new_mapping	= xfrm_send_mapping,
3464 	.is_alive	= xfrm_is_alive,
3465 };
3466 
3467 static int __net_init xfrm_user_net_init(struct net *net)
3468 {
3469 	struct sock *nlsk;
3470 	struct netlink_kernel_cfg cfg = {
3471 		.groups	= XFRMNLGRP_MAX,
3472 		.input	= xfrm_netlink_rcv,
3473 	};
3474 
3475 	nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg);
3476 	if (nlsk == NULL)
3477 		return -ENOMEM;
3478 	net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
3479 	rcu_assign_pointer(net->xfrm.nlsk, nlsk);
3480 	return 0;
3481 }
3482 
3483 static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
3484 {
3485 	struct net *net;
3486 	list_for_each_entry(net, net_exit_list, exit_list)
3487 		RCU_INIT_POINTER(net->xfrm.nlsk, NULL);
3488 	synchronize_net();
3489 	list_for_each_entry(net, net_exit_list, exit_list)
3490 		netlink_kernel_release(net->xfrm.nlsk_stash);
3491 }
3492 
3493 static struct pernet_operations xfrm_user_net_ops = {
3494 	.init	    = xfrm_user_net_init,
3495 	.exit_batch = xfrm_user_net_exit,
3496 };
3497 
3498 static int __init xfrm_user_init(void)
3499 {
3500 	int rv;
3501 
3502 	printk(KERN_INFO "Initializing XFRM netlink socket\n");
3503 
3504 	rv = register_pernet_subsys(&xfrm_user_net_ops);
3505 	if (rv < 0)
3506 		return rv;
3507 	rv = xfrm_register_km(&netlink_mgr);
3508 	if (rv < 0)
3509 		unregister_pernet_subsys(&xfrm_user_net_ops);
3510 	return rv;
3511 }
3512 
3513 static void __exit xfrm_user_exit(void)
3514 {
3515 	xfrm_unregister_km(&netlink_mgr);
3516 	unregister_pernet_subsys(&xfrm_user_net_ops);
3517 }
3518 
3519 module_init(xfrm_user_init);
3520 module_exit(xfrm_user_exit);
3521 MODULE_LICENSE("GPL");
3522 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
3523