1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* net/key/af_key.c An implementation of PF_KEYv2 sockets.
4	*
5	* Authors: Maxim Giryaev <gem@asplinux.ru>
6	* David S. Miller <davem@redhat.com>
7	* Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
8	* Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9	* Kazunori MIYAZAWA / USAGI Project <miyazawa@linux-ipv6.org>
10	* Derek Atkins <derek@ihtfp.com>
11	*/
12
13	#include <linux/capability.h>
14	#include <linux/module.h>
15	#include <linux/kernel.h>
16	#include <linux/socket.h>
17	#include <linux/pfkeyv2.h>
18	#include <linux/ipsec.h>
19	#include <linux/skbuff.h>
20	#include <linux/rtnetlink.h>
21	#include <linux/in.h>
22	#include <linux/in6.h>
23	#include <linux/proc_fs.h>
24	#include <linux/init.h>
25	#include <linux/slab.h>
26	#include <net/net_namespace.h>
27	#include <net/netns/generic.h>
28	#include <net/xfrm.h>
29
30	#include <net/sock.h>
31
32	#define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x))
33	#define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x))
34
35	static unsigned int pfkey_net_id __read_mostly;
36	struct netns_pfkey {
37	/* List of all pfkey sockets. */
38	struct hlist_head table;
39	atomic_t socks_nr;
40	};
41	static DEFINE_MUTEX(pfkey_mutex);
42
43	#define DUMMY_MARK 0
44	static const struct xfrm_mark dummy_mark = {0, 0};
45	struct pfkey_sock {
46	/* struct sock must be the first member of struct pfkey_sock */
47	struct sock sk;
48	int registered;
49	int promisc;
50
51	struct {
52	uint8_t msg_version;
53	uint32_t msg_portid;
54	int (*dump)(struct pfkey_sock *sk);
55	void (*done)(struct pfkey_sock *sk);
56	union {
57	struct xfrm_policy_walk policy;
58	struct xfrm_state_walk state;
59	} u;
60	struct sk_buff *skb;
61	} dump;
62	struct mutex dump_lock;
63	};
64
65	static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
66	xfrm_address_t *saddr, xfrm_address_t *daddr,
67	u16 *family);
68
69	static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
70	{
71	return (struct pfkey_sock *)sk;
72	}
73
74	static int pfkey_can_dump(const struct sock *sk)
75	{
76	if (3 * atomic_read(v: &sk->sk_rmem_alloc) <= 2 * sk->sk_rcvbuf)
77	return 1;
78	return 0;
79	}
80
81	static void pfkey_terminate_dump(struct pfkey_sock *pfk)
82	{
83	if (pfk->dump.dump) {
84	if (pfk->dump.skb) {
85	kfree_skb(skb: pfk->dump.skb);
86	pfk->dump.skb = NULL;
87	}
88	pfk->dump.done(pfk);
89	pfk->dump.dump = NULL;
90	pfk->dump.done = NULL;
91	}
92	}
93
94	static void pfkey_sock_destruct(struct sock *sk)
95	{
96	struct net *net = sock_net(sk);
97	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
98
99	pfkey_terminate_dump(pfk: pfkey_sk(sk));
100	skb_queue_purge(list: &sk->sk_receive_queue);
101
102	if (!sock_flag(sk, flag: SOCK_DEAD)) {
103	pr_err("Attempt to release alive pfkey socket: %p\n", sk);
104	return;
105	}
106
107	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
108	WARN_ON(refcount_read(&sk->sk_wmem_alloc));
109
110	atomic_dec(v: &net_pfkey->socks_nr);
111	}
112
113	static const struct proto_ops pfkey_ops;
114
115	static void pfkey_insert(struct sock *sk)
116	{
117	struct net *net = sock_net(sk);
118	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
119
120	mutex_lock(&pfkey_mutex);
121	sk_add_node_rcu(sk, list: &net_pfkey->table);
122	mutex_unlock(lock: &pfkey_mutex);
123	}
124
125	static void pfkey_remove(struct sock *sk)
126	{
127	mutex_lock(&pfkey_mutex);
128	sk_del_node_init_rcu(sk);
129	mutex_unlock(lock: &pfkey_mutex);
130	}
131
132	static struct proto key_proto = {
133	.name = "KEY",
134	.owner = THIS_MODULE,
135	.obj_size = sizeof(struct pfkey_sock),
136	};
137
138	static int pfkey_create(struct net *net, struct socket *sock, int protocol,
139	int kern)
140	{
141	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
142	struct sock *sk;
143	struct pfkey_sock *pfk;
144
145	if (!ns_capable(ns: net->user_ns, CAP_NET_ADMIN))
146	return -EPERM;
147	if (sock->type != SOCK_RAW)
148	return -ESOCKTNOSUPPORT;
149	if (protocol != PF_KEY_V2)
150	return -EPROTONOSUPPORT;
151
152	sk = sk_alloc(net, PF_KEY, GFP_KERNEL, prot: &key_proto, kern);
153	if (sk == NULL)
154	return -ENOMEM;
155
156	pfk = pfkey_sk(sk);
157	mutex_init(&pfk->dump_lock);
158
159	sock->ops = &pfkey_ops;
160	sock_init_data(sock, sk);
161
162	sk->sk_family = PF_KEY;
163	sk->sk_destruct = pfkey_sock_destruct;
164
165	atomic_inc(v: &net_pfkey->socks_nr);
166
167	pfkey_insert(sk);
168
169	return 0;
170	}
171
172	static int pfkey_release(struct socket *sock)
173	{
174	struct sock *sk = sock->sk;
175
176	if (!sk)
177	return 0;
178
179	pfkey_remove(sk);
180
181	sock_orphan(sk);
182	sock->sk = NULL;
183	skb_queue_purge(list: &sk->sk_write_queue);
184
185	synchronize_rcu();
186	sock_put(sk);
187
188	return 0;
189	}
190
191	static int pfkey_broadcast_one(struct sk_buff *skb, gfp_t allocation,
192	struct sock *sk)
193	{
194	int err = -ENOBUFS;
195
196	if (atomic_read(v: &sk->sk_rmem_alloc) > sk->sk_rcvbuf)
197	return err;
198
199	skb = skb_clone(skb, priority: allocation);
200
201	if (skb) {
202	skb_set_owner_r(skb, sk);
203	skb_queue_tail(list: &sk->sk_receive_queue, newsk: skb);
204	sk->sk_data_ready(sk);
205	err = 0;
206	}
207	return err;
208	}
209
210	/* Send SKB to all pfkey sockets matching selected criteria. */
211	#define BROADCAST_ALL 0
212	#define BROADCAST_ONE 1
213	#define BROADCAST_REGISTERED 2
214	#define BROADCAST_PROMISC_ONLY 4
215	static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
216	int broadcast_flags, struct sock *one_sk,
217	struct net *net)
218	{
219	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
220	struct sock *sk;
221	int err = -ESRCH;
222
223	/* XXX Do we need something like netlink_overrun? I think
224	* XXX PF_KEY socket apps will not mind current behavior.
225	*/
226	if (!skb)
227	return -ENOMEM;
228
229	rcu_read_lock();
230	sk_for_each_rcu(sk, &net_pfkey->table) {
231	struct pfkey_sock *pfk = pfkey_sk(sk);
232	int err2;
233
234	/* Yes, it means that if you are meant to receive this
235	* pfkey message you receive it twice as promiscuous
236	* socket.
237	*/
238	if (pfk->promisc)
239	pfkey_broadcast_one(skb, GFP_ATOMIC, sk);
240
241	/* the exact target will be processed later */
242	if (sk == one_sk)
243	continue;
244	if (broadcast_flags != BROADCAST_ALL) {
245	if (broadcast_flags & BROADCAST_PROMISC_ONLY)
246	continue;
247	if ((broadcast_flags & BROADCAST_REGISTERED) &&
248	!pfk->registered)
249	continue;
250	if (broadcast_flags & BROADCAST_ONE)
251	continue;
252	}
253
254	err2 = pfkey_broadcast_one(skb, GFP_ATOMIC, sk);
255
256	/* Error is cleared after successful sending to at least one
257	* registered KM */
258	if ((broadcast_flags & BROADCAST_REGISTERED) && err)
259	err = err2;
260	}
261	rcu_read_unlock();
262
263	if (one_sk != NULL)
264	err = pfkey_broadcast_one(skb, allocation, sk: one_sk);
265
266	kfree_skb(skb);
267	return err;
268	}
269
270	static int pfkey_do_dump(struct pfkey_sock *pfk)
271	{
272	struct sadb_msg *hdr;
273	int rc;
274
275	mutex_lock(&pfk->dump_lock);
276	if (!pfk->dump.dump) {
277	rc = 0;
278	goto out;
279	}
280
281	rc = pfk->dump.dump(pfk);
282	if (rc == -ENOBUFS) {
283	rc = 0;
284	goto out;
285	}
286
287	if (pfk->dump.skb) {
288	if (!pfkey_can_dump(sk: &pfk->sk)) {
289	rc = 0;
290	goto out;
291	}
292
293	hdr = (struct sadb_msg *) pfk->dump.skb->data;
294	hdr->sadb_msg_seq = 0;
295	hdr->sadb_msg_errno = rc;
296	pfkey_broadcast(skb: pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
297	one_sk: &pfk->sk, net: sock_net(sk: &pfk->sk));
298	pfk->dump.skb = NULL;
299	}
300
301	pfkey_terminate_dump(pfk);
302
303	out:
304	mutex_unlock(lock: &pfk->dump_lock);
305	return rc;
306	}
307
308	static inline void pfkey_hdr_dup(struct sadb_msg *new,
309	const struct sadb_msg *orig)
310	{
311	*new = *orig;
312	}
313
314	static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
315	{
316	struct sk_buff *skb = alloc_skb(size: sizeof(struct sadb_msg) + 16, GFP_KERNEL);
317	struct sadb_msg *hdr;
318
319	if (!skb)
320	return -ENOBUFS;
321
322	/* Woe be to the platform trying to support PFKEY yet
323	* having normal errnos outside the 1-255 range, inclusive.
324	*/
325	err = -err;
326	if (err == ERESTARTSYS ||
327	err == ERESTARTNOHAND ||
328	err == ERESTARTNOINTR)
329	err = EINTR;
330	if (err >= 512)
331	err = EINVAL;
332	BUG_ON(err <= 0 || err >= 256);
333
334	hdr = skb_put(skb, len: sizeof(struct sadb_msg));
335	pfkey_hdr_dup(new: hdr, orig);
336	hdr->sadb_msg_errno = (uint8_t) err;
337	hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
338	sizeof(uint64_t));
339
340	pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, one_sk: sk, net: sock_net(sk));
341
342	return 0;
343	}
344
345	static const u8 sadb_ext_min_len[] = {
346	[SADB_EXT_RESERVED] = (u8) 0,
347	[SADB_EXT_SA] = (u8) sizeof(struct sadb_sa),
348	[SADB_EXT_LIFETIME_CURRENT] = (u8) sizeof(struct sadb_lifetime),
349	[SADB_EXT_LIFETIME_HARD] = (u8) sizeof(struct sadb_lifetime),
350	[SADB_EXT_LIFETIME_SOFT] = (u8) sizeof(struct sadb_lifetime),
351	[SADB_EXT_ADDRESS_SRC] = (u8) sizeof(struct sadb_address),
352	[SADB_EXT_ADDRESS_DST] = (u8) sizeof(struct sadb_address),
353	[SADB_EXT_ADDRESS_PROXY] = (u8) sizeof(struct sadb_address),
354	[SADB_EXT_KEY_AUTH] = (u8) sizeof(struct sadb_key),
355	[SADB_EXT_KEY_ENCRYPT] = (u8) sizeof(struct sadb_key),
356	[SADB_EXT_IDENTITY_SRC] = (u8) sizeof(struct sadb_ident),
357	[SADB_EXT_IDENTITY_DST] = (u8) sizeof(struct sadb_ident),
358	[SADB_EXT_SENSITIVITY] = (u8) sizeof(struct sadb_sens),
359	[SADB_EXT_PROPOSAL] = (u8) sizeof(struct sadb_prop),
360	[SADB_EXT_SUPPORTED_AUTH] = (u8) sizeof(struct sadb_supported),
361	[SADB_EXT_SUPPORTED_ENCRYPT] = (u8) sizeof(struct sadb_supported),
362	[SADB_EXT_SPIRANGE] = (u8) sizeof(struct sadb_spirange),
363	[SADB_X_EXT_KMPRIVATE] = (u8) sizeof(struct sadb_x_kmprivate),
364	[SADB_X_EXT_POLICY] = (u8) sizeof(struct sadb_x_policy),
365	[SADB_X_EXT_SA2] = (u8) sizeof(struct sadb_x_sa2),
366	[SADB_X_EXT_NAT_T_TYPE] = (u8) sizeof(struct sadb_x_nat_t_type),
367	[SADB_X_EXT_NAT_T_SPORT] = (u8) sizeof(struct sadb_x_nat_t_port),
368	[SADB_X_EXT_NAT_T_DPORT] = (u8) sizeof(struct sadb_x_nat_t_port),
369	[SADB_X_EXT_NAT_T_OA] = (u8) sizeof(struct sadb_address),
370	[SADB_X_EXT_SEC_CTX] = (u8) sizeof(struct sadb_x_sec_ctx),
371	[SADB_X_EXT_KMADDRESS] = (u8) sizeof(struct sadb_x_kmaddress),
372	[SADB_X_EXT_FILTER] = (u8) sizeof(struct sadb_x_filter),
373	};
374
375	/* Verify sadb_address_{len,prefixlen} against sa_family. */
376	static int verify_address_len(const void *p)
377	{
378	const struct sadb_address *sp = p;
379	const struct sockaddr *addr = (const struct sockaddr *)(sp + 1);
380	const struct sockaddr_in *sin;
381	#if IS_ENABLED(CONFIG_IPV6)
382	const struct sockaddr_in6 *sin6;
383	#endif
384	int len;
385
386	if (sp->sadb_address_len <
387	DIV_ROUND_UP(sizeof(*sp) + offsetofend(typeof(*addr), sa_family),
388	sizeof(uint64_t)))
389	return -EINVAL;
390
391	switch (addr->sa_family) {
392	case AF_INET:
393	len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin), sizeof(uint64_t));
394	if (sp->sadb_address_len != len ||
395	sp->sadb_address_prefixlen > 32)
396	return -EINVAL;
397	break;
398	#if IS_ENABLED(CONFIG_IPV6)
399	case AF_INET6:
400	len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin6), sizeof(uint64_t));
401	if (sp->sadb_address_len != len ||
402	sp->sadb_address_prefixlen > 128)
403	return -EINVAL;
404	break;
405	#endif
406	default:
407	/* It is user using kernel to keep track of security
408	* associations for another protocol, such as
409	* OSPF/RSVP/RIPV2/MIP. It is user's job to verify
410	* lengths.
411	*
412	* XXX Actually, association/policy database is not yet
413	* XXX able to cope with arbitrary sockaddr families.
414	* XXX When it can, remove this -EINVAL. -DaveM
415	*/
416	return -EINVAL;
417	}
418
419	return 0;
420	}
421
422	static inline int sadb_key_len(const struct sadb_key *key)
423	{
424	int key_bytes = DIV_ROUND_UP(key->sadb_key_bits, 8);
425
426	return DIV_ROUND_UP(sizeof(struct sadb_key) + key_bytes,
427	sizeof(uint64_t));
428	}
429
430	static int verify_key_len(const void *p)
431	{
432	const struct sadb_key *key = p;
433
434	if (sadb_key_len(key) > key->sadb_key_len)
435	return -EINVAL;
436
437	return 0;
438	}
439
440	static inline int pfkey_sec_ctx_len(const struct sadb_x_sec_ctx *sec_ctx)
441	{
442	return DIV_ROUND_UP(sizeof(struct sadb_x_sec_ctx) +
443	sec_ctx->sadb_x_ctx_len,
444	sizeof(uint64_t));
445	}
446
447	static inline int verify_sec_ctx_len(const void *p)
448	{
449	const struct sadb_x_sec_ctx *sec_ctx = p;
450	int len = sec_ctx->sadb_x_ctx_len;
451
452	if (len > PAGE_SIZE)
453	return -EINVAL;
454
455	len = pfkey_sec_ctx_len(sec_ctx);
456
457	if (sec_ctx->sadb_x_sec_len != len)
458	return -EINVAL;
459
460	return 0;
461	}
462
463	static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx,
464	gfp_t gfp)
465	{
466	struct xfrm_user_sec_ctx *uctx = NULL;
467	int ctx_size = sec_ctx->sadb_x_ctx_len;
468
469	uctx = kmalloc((sizeof(*uctx)+ctx_size), gfp);
470
471	if (!uctx)
472	return NULL;
473
474	uctx->len = pfkey_sec_ctx_len(sec_ctx);
475	uctx->exttype = sec_ctx->sadb_x_sec_exttype;
476	uctx->ctx_doi = sec_ctx->sadb_x_ctx_doi;
477	uctx->ctx_alg = sec_ctx->sadb_x_ctx_alg;
478	uctx->ctx_len = sec_ctx->sadb_x_ctx_len;
479	memcpy(uctx + 1, sec_ctx + 1,
480	uctx->ctx_len);
481
482	return uctx;
483	}
484
485	static int present_and_same_family(const struct sadb_address *src,
486	const struct sadb_address *dst)
487	{
488	const struct sockaddr *s_addr, *d_addr;
489
490	if (!src || !dst)
491	return 0;
492
493	s_addr = (const struct sockaddr *)(src + 1);
494	d_addr = (const struct sockaddr *)(dst + 1);
495	if (s_addr->sa_family != d_addr->sa_family)
496	return 0;
497	if (s_addr->sa_family != AF_INET
498	#if IS_ENABLED(CONFIG_IPV6)
499	&& s_addr->sa_family != AF_INET6
500	#endif
501	)
502	return 0;
503
504	return 1;
505	}
506
507	static int parse_exthdrs(struct sk_buff *skb, const struct sadb_msg *hdr, void **ext_hdrs)
508	{
509	const char *p = (char *) hdr;
510	int len = skb->len;
511
512	len -= sizeof(*hdr);
513	p += sizeof(*hdr);
514	while (len > 0) {
515	const struct sadb_ext *ehdr = (const struct sadb_ext *) p;
516	uint16_t ext_type;
517	int ext_len;
518
519	if (len < sizeof(*ehdr))
520	return -EINVAL;
521
522	ext_len = ehdr->sadb_ext_len;
523	ext_len *= sizeof(uint64_t);
524	ext_type = ehdr->sadb_ext_type;
525	if (ext_len < sizeof(uint64_t) ||
526	ext_len > len ||
527	ext_type == SADB_EXT_RESERVED)
528	return -EINVAL;
529
530	if (ext_type <= SADB_EXT_MAX) {
531	int min = (int) sadb_ext_min_len[ext_type];
532	if (ext_len < min)
533	return -EINVAL;
534	if (ext_hdrs[ext_type-1] != NULL)
535	return -EINVAL;
536	switch (ext_type) {
537	case SADB_EXT_ADDRESS_SRC:
538	case SADB_EXT_ADDRESS_DST:
539	case SADB_EXT_ADDRESS_PROXY:
540	case SADB_X_EXT_NAT_T_OA:
541	if (verify_address_len(p))
542	return -EINVAL;
543	break;
544	case SADB_X_EXT_SEC_CTX:
545	if (verify_sec_ctx_len(p))
546	return -EINVAL;
547	break;
548	case SADB_EXT_KEY_AUTH:
549	case SADB_EXT_KEY_ENCRYPT:
550	if (verify_key_len(p))
551	return -EINVAL;
552	break;
553	default:
554	break;
555	}
556	ext_hdrs[ext_type-1] = (void *) p;
557	}
558	p += ext_len;
559	len -= ext_len;
560	}
561
562	return 0;
563	}
564
565	static uint16_t
566	pfkey_satype2proto(uint8_t satype)
567	{
568	switch (satype) {
569	case SADB_SATYPE_UNSPEC:
570	return IPSEC_PROTO_ANY;
571	case SADB_SATYPE_AH:
572	return IPPROTO_AH;
573	case SADB_SATYPE_ESP:
574	return IPPROTO_ESP;
575	case SADB_X_SATYPE_IPCOMP:
576	return IPPROTO_COMP;
577	default:
578	return 0;
579	}
580	/* NOTREACHED */
581	}
582
583	static uint8_t
584	pfkey_proto2satype(uint16_t proto)
585	{
586	switch (proto) {
587	case IPPROTO_AH:
588	return SADB_SATYPE_AH;
589	case IPPROTO_ESP:
590	return SADB_SATYPE_ESP;
591	case IPPROTO_COMP:
592	return SADB_X_SATYPE_IPCOMP;
593	default:
594	return 0;
595	}
596	/* NOTREACHED */
597	}
598
599	/* BTW, this scheme means that there is no way with PFKEY2 sockets to
600	* say specifically 'just raw sockets' as we encode them as 255.
601	*/
602
603	static uint8_t pfkey_proto_to_xfrm(uint8_t proto)
604	{
605	return proto == IPSEC_PROTO_ANY ? 0 : proto;
606	}
607
608	static uint8_t pfkey_proto_from_xfrm(uint8_t proto)
609	{
610	return proto ? proto : IPSEC_PROTO_ANY;
611	}
612
613	static inline int pfkey_sockaddr_len(sa_family_t family)
614	{
615	switch (family) {
616	case AF_INET:
617	return sizeof(struct sockaddr_in);
618	#if IS_ENABLED(CONFIG_IPV6)
619	case AF_INET6:
620	return sizeof(struct sockaddr_in6);
621	#endif
622	}
623	return 0;
624	}
625
626	static
627	int pfkey_sockaddr_extract(const struct sockaddr *sa, xfrm_address_t *xaddr)
628	{
629	switch (sa->sa_family) {
630	case AF_INET:
631	xaddr->a4 =
632	((struct sockaddr_in *)sa)->sin_addr.s_addr;
633	return AF_INET;
634	#if IS_ENABLED(CONFIG_IPV6)
635	case AF_INET6:
636	memcpy(xaddr->a6,
637	&((struct sockaddr_in6 *)sa)->sin6_addr,
638	sizeof(struct in6_addr));
639	return AF_INET6;
640	#endif
641	}
642	return 0;
643	}
644
645	static
646	int pfkey_sadb_addr2xfrm_addr(const struct sadb_address *addr, xfrm_address_t *xaddr)
647	{
648	return pfkey_sockaddr_extract(sa: (struct sockaddr *)(addr + 1),
649	xaddr);
650	}
651
652	static struct xfrm_state *pfkey_xfrm_state_lookup(struct net *net, const struct sadb_msg *hdr, void * const *ext_hdrs)
653	{
654	const struct sadb_sa *sa;
655	const struct sadb_address *addr;
656	uint16_t proto;
657	unsigned short family;
658	xfrm_address_t *xaddr;
659
660	sa = ext_hdrs[SADB_EXT_SA - 1];
661	if (sa == NULL)
662	return NULL;
663
664	proto = pfkey_satype2proto(satype: hdr->sadb_msg_satype);
665	if (proto == 0)
666	return NULL;
667
668	/* sadb_address_len should be checked by caller */
669	addr = ext_hdrs[SADB_EXT_ADDRESS_DST - 1];
670	if (addr == NULL)
671	return NULL;
672
673	family = ((const struct sockaddr *)(addr + 1))->sa_family;
674	switch (family) {
675	case AF_INET:
676	xaddr = (xfrm_address_t *)&((const struct sockaddr_in *)(addr + 1))->sin_addr;
677	break;
678	#if IS_ENABLED(CONFIG_IPV6)
679	case AF_INET6:
680	xaddr = (xfrm_address_t *)&((const struct sockaddr_in6 *)(addr + 1))->sin6_addr;
681	break;
682	#endif
683	default:
684	xaddr = NULL;
685	}
686
687	if (!xaddr)
688	return NULL;
689
690	return xfrm_state_lookup(net, DUMMY_MARK, daddr: xaddr, spi: sa->sadb_sa_spi, proto, family);
691	}
692
693	#define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1)))
694
695	static int
696	pfkey_sockaddr_size(sa_family_t family)
697	{
698	return PFKEY_ALIGN8(pfkey_sockaddr_len(family));
699	}
700
701	static inline int pfkey_mode_from_xfrm(int mode)
702	{
703	switch(mode) {
704	case XFRM_MODE_TRANSPORT:
705	return IPSEC_MODE_TRANSPORT;
706	case XFRM_MODE_TUNNEL:
707	return IPSEC_MODE_TUNNEL;
708	case XFRM_MODE_BEET:
709	return IPSEC_MODE_BEET;
710	default:
711	return -1;
712	}
713	}
714
715	static inline int pfkey_mode_to_xfrm(int mode)
716	{
717	switch(mode) {
718	case IPSEC_MODE_ANY: /*XXX*/
719	case IPSEC_MODE_TRANSPORT:
720	return XFRM_MODE_TRANSPORT;
721	case IPSEC_MODE_TUNNEL:
722	return XFRM_MODE_TUNNEL;
723	case IPSEC_MODE_BEET:
724	return XFRM_MODE_BEET;
725	default:
726	return -1;
727	}
728	}
729
730	static unsigned int pfkey_sockaddr_fill(const xfrm_address_t *xaddr, __be16 port,
731	struct sockaddr *sa,
732	unsigned short family)
733	{
734	switch (family) {
735	case AF_INET:
736	{
737	struct sockaddr_in *sin = (struct sockaddr_in *)sa;
738	sin->sin_family = AF_INET;
739	sin->sin_port = port;
740	sin->sin_addr.s_addr = xaddr->a4;
741	memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
742	return 32;
743	}
744	#if IS_ENABLED(CONFIG_IPV6)
745	case AF_INET6:
746	{
747	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
748	sin6->sin6_family = AF_INET6;
749	sin6->sin6_port = port;
750	sin6->sin6_flowinfo = 0;
751	sin6->sin6_addr = xaddr->in6;
752	sin6->sin6_scope_id = 0;
753	return 128;
754	}
755	#endif
756	}
757	return 0;
758	}
759
760	static struct sk_buff *__pfkey_xfrm_state2msg(const struct xfrm_state *x,
761	int add_keys, int hsc)
762	{
763	struct sk_buff *skb;
764	struct sadb_msg *hdr;
765	struct sadb_sa *sa;
766	struct sadb_lifetime *lifetime;
767	struct sadb_address *addr;
768	struct sadb_key *key;
769	struct sadb_x_sa2 *sa2;
770	struct sadb_x_sec_ctx *sec_ctx;
771	struct xfrm_sec_ctx *xfrm_ctx;
772	int ctx_size = 0;
773	int size;
774	int auth_key_size = 0;
775	int encrypt_key_size = 0;
776	int sockaddr_size;
777	struct xfrm_encap_tmpl *natt = NULL;
778	int mode;
779
780	/* address family check */
781	sockaddr_size = pfkey_sockaddr_size(family: x->props.family);
782	if (!sockaddr_size)
783	return ERR_PTR(error: -EINVAL);
784
785	/* base, SA, (lifetime (HSC),) address(SD), (address(P),)
786	key(AE), (identity(SD),) (sensitivity)> */
787	size = sizeof(struct sadb_msg) +sizeof(struct sadb_sa) +
788	sizeof(struct sadb_lifetime) +
789	((hsc & 1) ? sizeof(struct sadb_lifetime) : 0) +
790	((hsc & 2) ? sizeof(struct sadb_lifetime) : 0) +
791	sizeof(struct sadb_address)*2 +
792	sockaddr_size*2 +
793	sizeof(struct sadb_x_sa2);
794
795	if ((xfrm_ctx = x->security)) {
796	ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
797	size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
798	}
799
800	/* identity & sensitivity */
801	if (!xfrm_addr_equal(a: &x->sel.saddr, b: &x->props.saddr, family: x->props.family))
802	size += sizeof(struct sadb_address) + sockaddr_size;
803
804	if (add_keys) {
805	if (x->aalg && x->aalg->alg_key_len) {
806	auth_key_size =
807	PFKEY_ALIGN8((x->aalg->alg_key_len + 7) / 8);
808	size += sizeof(struct sadb_key) + auth_key_size;
809	}
810	if (x->ealg && x->ealg->alg_key_len) {
811	encrypt_key_size =
812	PFKEY_ALIGN8((x->ealg->alg_key_len+7) / 8);
813	size += sizeof(struct sadb_key) + encrypt_key_size;
814	}
815	}
816	if (x->encap)
817	natt = x->encap;
818
819	if (natt && natt->encap_type) {
820	size += sizeof(struct sadb_x_nat_t_type);
821	size += sizeof(struct sadb_x_nat_t_port);
822	size += sizeof(struct sadb_x_nat_t_port);
823	}
824
825	skb = alloc_skb(size: size + 16, GFP_ATOMIC);
826	if (skb == NULL)
827	return ERR_PTR(error: -ENOBUFS);
828
829	/* call should fill header later */
830	hdr = skb_put(skb, len: sizeof(struct sadb_msg));
831	memset(hdr, 0, size); /* XXX do we need this ? */
832	hdr->sadb_msg_len = size / sizeof(uint64_t);
833
834	/* sa */
835	sa = skb_put(skb, len: sizeof(struct sadb_sa));
836	sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t);
837	sa->sadb_sa_exttype = SADB_EXT_SA;
838	sa->sadb_sa_spi = x->id.spi;
839	sa->sadb_sa_replay = x->props.replay_window;
840	switch (x->km.state) {
841	case XFRM_STATE_VALID:
842	sa->sadb_sa_state = x->km.dying ?
843	SADB_SASTATE_DYING : SADB_SASTATE_MATURE;
844	break;
845	case XFRM_STATE_ACQ:
846	sa->sadb_sa_state = SADB_SASTATE_LARVAL;
847	break;
848	default:
849	sa->sadb_sa_state = SADB_SASTATE_DEAD;
850	break;
851	}
852	sa->sadb_sa_auth = 0;
853	if (x->aalg) {
854	struct xfrm_algo_desc *a = xfrm_aalg_get_byname(name: x->aalg->alg_name, probe: 0);
855	sa->sadb_sa_auth = (a && a->pfkey_supported) ?
856	a->desc.sadb_alg_id : 0;
857	}
858	sa->sadb_sa_encrypt = 0;
859	BUG_ON(x->ealg && x->calg);
860	if (x->ealg) {
861	struct xfrm_algo_desc *a = xfrm_ealg_get_byname(name: x->ealg->alg_name, probe: 0);
862	sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
863	a->desc.sadb_alg_id : 0;
864	}
865	/* KAME compatible: sadb_sa_encrypt is overloaded with calg id */
866	if (x->calg) {
867	struct xfrm_algo_desc *a = xfrm_calg_get_byname(name: x->calg->alg_name, probe: 0);
868	sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
869	a->desc.sadb_alg_id : 0;
870	}
871
872	sa->sadb_sa_flags = 0;
873	if (x->props.flags & XFRM_STATE_NOECN)
874	sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN;
875	if (x->props.flags & XFRM_STATE_DECAP_DSCP)
876	sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP;
877	if (x->props.flags & XFRM_STATE_NOPMTUDISC)
878	sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC;
879
880	/* hard time */
881	if (hsc & 2) {
882	lifetime = skb_put(skb, len: sizeof(struct sadb_lifetime));
883	lifetime->sadb_lifetime_len =
884	sizeof(struct sadb_lifetime)/sizeof(uint64_t);
885	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
886	lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.hard_packet_limit);
887	lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.hard_byte_limit);
888	lifetime->sadb_lifetime_addtime = x->lft.hard_add_expires_seconds;
889	lifetime->sadb_lifetime_usetime = x->lft.hard_use_expires_seconds;
890	}
891	/* soft time */
892	if (hsc & 1) {
893	lifetime = skb_put(skb, len: sizeof(struct sadb_lifetime));
894	lifetime->sadb_lifetime_len =
895	sizeof(struct sadb_lifetime)/sizeof(uint64_t);
896	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
897	lifetime->sadb_lifetime_allocations = _X2KEY(x->lft.soft_packet_limit);
898	lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.soft_byte_limit);
899	lifetime->sadb_lifetime_addtime = x->lft.soft_add_expires_seconds;
900	lifetime->sadb_lifetime_usetime = x->lft.soft_use_expires_seconds;
901	}
902	/* current time */
903	lifetime = skb_put(skb, len: sizeof(struct sadb_lifetime));
904	lifetime->sadb_lifetime_len =
905	sizeof(struct sadb_lifetime)/sizeof(uint64_t);
906	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
907	lifetime->sadb_lifetime_allocations = x->curlft.packets;
908	lifetime->sadb_lifetime_bytes = x->curlft.bytes;
909	lifetime->sadb_lifetime_addtime = x->curlft.add_time;
910	lifetime->sadb_lifetime_usetime = x->curlft.use_time;
911	/* src address */
912	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
913	addr->sadb_address_len =
914	(sizeof(struct sadb_address)+sockaddr_size)/
915	sizeof(uint64_t);
916	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
917	/* "if the ports are non-zero, then the sadb_address_proto field,
918	normally zero, MUST be filled in with the transport
919	protocol's number." - RFC2367 */
920	addr->sadb_address_proto = 0;
921	addr->sadb_address_reserved = 0;
922
923	addr->sadb_address_prefixlen =
924	pfkey_sockaddr_fill(xaddr: &x->props.saddr, port: 0,
925	sa: (struct sockaddr *) (addr + 1),
926	family: x->props.family);
927	BUG_ON(!addr->sadb_address_prefixlen);
928
929	/* dst address */
930	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
931	addr->sadb_address_len =
932	(sizeof(struct sadb_address)+sockaddr_size)/
933	sizeof(uint64_t);
934	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
935	addr->sadb_address_proto = 0;
936	addr->sadb_address_reserved = 0;
937
938	addr->sadb_address_prefixlen =
939	pfkey_sockaddr_fill(xaddr: &x->id.daddr, port: 0,
940	sa: (struct sockaddr *) (addr + 1),
941	family: x->props.family);
942	BUG_ON(!addr->sadb_address_prefixlen);
943
944	if (!xfrm_addr_equal(a: &x->sel.saddr, b: &x->props.saddr,
945	family: x->props.family)) {
946	addr = skb_put(skb,
947	len: sizeof(struct sadb_address) + sockaddr_size);
948	addr->sadb_address_len =
949	(sizeof(struct sadb_address)+sockaddr_size)/
950	sizeof(uint64_t);
951	addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
952	addr->sadb_address_proto =
953	pfkey_proto_from_xfrm(proto: x->sel.proto);
954	addr->sadb_address_prefixlen = x->sel.prefixlen_s;
955	addr->sadb_address_reserved = 0;
956
957	pfkey_sockaddr_fill(xaddr: &x->sel.saddr, port: x->sel.sport,
958	sa: (struct sockaddr *) (addr + 1),
959	family: x->props.family);
960	}
961
962	/* auth key */
963	if (add_keys && auth_key_size) {
964	key = skb_put(skb, len: sizeof(struct sadb_key) + auth_key_size);
965	key->sadb_key_len = (sizeof(struct sadb_key) + auth_key_size) /
966	sizeof(uint64_t);
967	key->sadb_key_exttype = SADB_EXT_KEY_AUTH;
968	key->sadb_key_bits = x->aalg->alg_key_len;
969	key->sadb_key_reserved = 0;
970	memcpy(key + 1, x->aalg->alg_key, (x->aalg->alg_key_len+7)/8);
971	}
972	/* encrypt key */
973	if (add_keys && encrypt_key_size) {
974	key = skb_put(skb, len: sizeof(struct sadb_key) + encrypt_key_size);
975	key->sadb_key_len = (sizeof(struct sadb_key) +
976	encrypt_key_size) / sizeof(uint64_t);
977	key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
978	key->sadb_key_bits = x->ealg->alg_key_len;
979	key->sadb_key_reserved = 0;
980	memcpy(key + 1, x->ealg->alg_key,
981	(x->ealg->alg_key_len+7)/8);
982	}
983
984	/* sa */
985	sa2 = skb_put(skb, len: sizeof(struct sadb_x_sa2));
986	sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t);
987	sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
988	if ((mode = pfkey_mode_from_xfrm(mode: x->props.mode)) < 0) {
989	kfree_skb(skb);
990	return ERR_PTR(error: -EINVAL);
991	}
992	sa2->sadb_x_sa2_mode = mode;
993	sa2->sadb_x_sa2_reserved1 = 0;
994	sa2->sadb_x_sa2_reserved2 = 0;
995	sa2->sadb_x_sa2_sequence = 0;
996	sa2->sadb_x_sa2_reqid = x->props.reqid;
997
998	if (natt && natt->encap_type) {
999	struct sadb_x_nat_t_type *n_type;
1000	struct sadb_x_nat_t_port *n_port;
1001
1002	/* type */
1003	n_type = skb_put(skb, len: sizeof(*n_type));
1004	n_type->sadb_x_nat_t_type_len = sizeof(*n_type)/sizeof(uint64_t);
1005	n_type->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
1006	n_type->sadb_x_nat_t_type_type = natt->encap_type;
1007	n_type->sadb_x_nat_t_type_reserved[0] = 0;
1008	n_type->sadb_x_nat_t_type_reserved[1] = 0;
1009	n_type->sadb_x_nat_t_type_reserved[2] = 0;
1010
1011	/* source port */
1012	n_port = skb_put(skb, len: sizeof(*n_port));
1013	n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
1014	n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
1015	n_port->sadb_x_nat_t_port_port = natt->encap_sport;
1016	n_port->sadb_x_nat_t_port_reserved = 0;
1017
1018	/* dest port */
1019	n_port = skb_put(skb, len: sizeof(*n_port));
1020	n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
1021	n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
1022	n_port->sadb_x_nat_t_port_port = natt->encap_dport;
1023	n_port->sadb_x_nat_t_port_reserved = 0;
1024	}
1025
1026	/* security context */
1027	if (xfrm_ctx) {
1028	sec_ctx = skb_put(skb,
1029	len: sizeof(struct sadb_x_sec_ctx) + ctx_size);
1030	sec_ctx->sadb_x_sec_len =
1031	(sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
1032	sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
1033	sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
1034	sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
1035	sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
1036	memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
1037	xfrm_ctx->ctx_len);
1038	}
1039
1040	return skb;
1041	}
1042
1043
1044	static inline struct sk_buff *pfkey_xfrm_state2msg(const struct xfrm_state *x)
1045	{
1046	struct sk_buff *skb;
1047
1048	skb = __pfkey_xfrm_state2msg(x, add_keys: 1, hsc: 3);
1049
1050	return skb;
1051	}
1052
1053	static inline struct sk_buff *pfkey_xfrm_state2msg_expire(const struct xfrm_state *x,
1054	int hsc)
1055	{
1056	return __pfkey_xfrm_state2msg(x, add_keys: 0, hsc);
1057	}
1058
1059	static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
1060	const struct sadb_msg *hdr,
1061	void * const *ext_hdrs)
1062	{
1063	struct xfrm_state *x;
1064	const struct sadb_lifetime *lifetime;
1065	const struct sadb_sa *sa;
1066	const struct sadb_key *key;
1067	const struct sadb_x_sec_ctx *sec_ctx;
1068	uint16_t proto;
1069	int err;
1070
1071
1072	sa = ext_hdrs[SADB_EXT_SA - 1];
1073	if (!sa ||
1074	!present_and_same_family(src: ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1075	dst: ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1076	return ERR_PTR(error: -EINVAL);
1077	if (hdr->sadb_msg_satype == SADB_SATYPE_ESP &&
1078	!ext_hdrs[SADB_EXT_KEY_ENCRYPT-1])
1079	return ERR_PTR(error: -EINVAL);
1080	if (hdr->sadb_msg_satype == SADB_SATYPE_AH &&
1081	!ext_hdrs[SADB_EXT_KEY_AUTH-1])
1082	return ERR_PTR(error: -EINVAL);
1083	if (!!ext_hdrs[SADB_EXT_LIFETIME_HARD-1] !=
1084	!!ext_hdrs[SADB_EXT_LIFETIME_SOFT-1])
1085	return ERR_PTR(error: -EINVAL);
1086
1087	proto = pfkey_satype2proto(satype: hdr->sadb_msg_satype);
1088	if (proto == 0)
1089	return ERR_PTR(error: -EINVAL);
1090
1091	/* default error is no buffer space */
1092	err = -ENOBUFS;
1093
1094	/* RFC2367:
1095
1096	Only SADB_SASTATE_MATURE SAs may be submitted in an SADB_ADD message.
1097	SADB_SASTATE_LARVAL SAs are created by SADB_GETSPI and it is not
1098	sensible to add a new SA in the DYING or SADB_SASTATE_DEAD state.
1099	Therefore, the sadb_sa_state field of all submitted SAs MUST be
1100	SADB_SASTATE_MATURE and the kernel MUST return an error if this is
1101	not true.
1102
1103	However, KAME setkey always uses SADB_SASTATE_LARVAL.
1104	Hence, we have to _ignore_ sadb_sa_state, which is also reasonable.
1105	*/
1106	if (sa->sadb_sa_auth > SADB_AALG_MAX ||
1107	(hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP &&
1108	sa->sadb_sa_encrypt > SADB_X_CALG_MAX) ||
1109	sa->sadb_sa_encrypt > SADB_EALG_MAX)
1110	return ERR_PTR(error: -EINVAL);
1111	key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
1112	if (key != NULL &&
1113	sa->sadb_sa_auth != SADB_X_AALG_NULL &&
1114	key->sadb_key_bits == 0)
1115	return ERR_PTR(error: -EINVAL);
1116	key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
1117	if (key != NULL &&
1118	sa->sadb_sa_encrypt != SADB_EALG_NULL &&
1119	key->sadb_key_bits == 0)
1120	return ERR_PTR(error: -EINVAL);
1121
1122	x = xfrm_state_alloc(net);
1123	if (x == NULL)
1124	return ERR_PTR(error: -ENOBUFS);
1125
1126	x->id.proto = proto;
1127	x->id.spi = sa->sadb_sa_spi;
1128	x->props.replay_window = min_t(unsigned int, sa->sadb_sa_replay,
1129	(sizeof(x->replay.bitmap) * 8));
1130	if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN)
1131	x->props.flags |= XFRM_STATE_NOECN;
1132	if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
1133	x->props.flags |= XFRM_STATE_DECAP_DSCP;
1134	if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC)
1135	x->props.flags |= XFRM_STATE_NOPMTUDISC;
1136
1137	lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD - 1];
1138	if (lifetime != NULL) {
1139	x->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
1140	x->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
1141	x->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime;
1142	x->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime;
1143	}
1144	lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT - 1];
1145	if (lifetime != NULL) {
1146	x->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
1147	x->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
1148	x->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;
1149	x->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;
1150	}
1151
1152	sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
1153	if (sec_ctx != NULL) {
1154	struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
1155
1156	if (!uctx)
1157	goto out;
1158
1159	err = security_xfrm_state_alloc(x, sec_ctx: uctx);
1160	kfree(objp: uctx);
1161
1162	if (err)
1163	goto out;
1164	}
1165
1166	err = -ENOBUFS;
1167	key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
1168	if (sa->sadb_sa_auth) {
1169	int keysize = 0;
1170	struct xfrm_algo_desc *a = xfrm_aalg_get_byid(alg_id: sa->sadb_sa_auth);
1171	if (!a || !a->pfkey_supported) {
1172	err = -ENOSYS;
1173	goto out;
1174	}
1175	if (key)
1176	keysize = (key->sadb_key_bits + 7) / 8;
1177	x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
1178	if (!x->aalg) {
1179	err = -ENOMEM;
1180	goto out;
1181	}
1182	strcpy(p: x->aalg->alg_name, q: a->name);
1183	x->aalg->alg_key_len = 0;
1184	if (key) {
1185	x->aalg->alg_key_len = key->sadb_key_bits;
1186	memcpy(x->aalg->alg_key, key+1, keysize);
1187	}
1188	x->aalg->alg_trunc_len = a->uinfo.auth.icv_truncbits;
1189	x->props.aalgo = sa->sadb_sa_auth;
1190	/* x->algo.flags = sa->sadb_sa_flags; */
1191	}
1192	if (sa->sadb_sa_encrypt) {
1193	if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
1194	struct xfrm_algo_desc *a = xfrm_calg_get_byid(alg_id: sa->sadb_sa_encrypt);
1195	if (!a || !a->pfkey_supported) {
1196	err = -ENOSYS;
1197	goto out;
1198	}
1199	x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
1200	if (!x->calg) {
1201	err = -ENOMEM;
1202	goto out;
1203	}
1204	strcpy(p: x->calg->alg_name, q: a->name);
1205	x->props.calgo = sa->sadb_sa_encrypt;
1206	} else {
1207	int keysize = 0;
1208	struct xfrm_algo_desc *a = xfrm_ealg_get_byid(alg_id: sa->sadb_sa_encrypt);
1209	if (!a || !a->pfkey_supported) {
1210	err = -ENOSYS;
1211	goto out;
1212	}
1213	key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
1214	if (key)
1215	keysize = (key->sadb_key_bits + 7) / 8;
1216	x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
1217	if (!x->ealg) {
1218	err = -ENOMEM;
1219	goto out;
1220	}
1221	strcpy(p: x->ealg->alg_name, q: a->name);
1222	x->ealg->alg_key_len = 0;
1223	if (key) {
1224	x->ealg->alg_key_len = key->sadb_key_bits;
1225	memcpy(x->ealg->alg_key, key+1, keysize);
1226	}
1227	x->props.ealgo = sa->sadb_sa_encrypt;
1228	x->geniv = a->uinfo.encr.geniv;
1229	}
1230	}
1231	/* x->algo.flags = sa->sadb_sa_flags; */
1232
1233	x->props.family = pfkey_sadb_addr2xfrm_addr(addr: (struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1234	xaddr: &x->props.saddr);
1235	pfkey_sadb_addr2xfrm_addr(addr: (struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1],
1236	xaddr: &x->id.daddr);
1237
1238	if (ext_hdrs[SADB_X_EXT_SA2-1]) {
1239	const struct sadb_x_sa2 *sa2 = ext_hdrs[SADB_X_EXT_SA2-1];
1240	int mode = pfkey_mode_to_xfrm(mode: sa2->sadb_x_sa2_mode);
1241	if (mode < 0) {
1242	err = -EINVAL;
1243	goto out;
1244	}
1245	x->props.mode = mode;
1246	x->props.reqid = sa2->sadb_x_sa2_reqid;
1247	}
1248
1249	if (ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]) {
1250	const struct sadb_address *addr = ext_hdrs[SADB_EXT_ADDRESS_PROXY-1];
1251
1252	/* Nobody uses this, but we try. */
1253	x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, xaddr: &x->sel.saddr);
1254	x->sel.prefixlen_s = addr->sadb_address_prefixlen;
1255	}
1256
1257	if (!x->sel.family)
1258	x->sel.family = x->props.family;
1259
1260	if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
1261	const struct sadb_x_nat_t_type* n_type;
1262	struct xfrm_encap_tmpl *natt;
1263
1264	x->encap = kzalloc(sizeof(*x->encap), GFP_KERNEL);
1265	if (!x->encap) {
1266	err = -ENOMEM;
1267	goto out;
1268	}
1269
1270	natt = x->encap;
1271	n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
1272	natt->encap_type = n_type->sadb_x_nat_t_type_type;
1273
1274	if (ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]) {
1275	const struct sadb_x_nat_t_port *n_port =
1276	ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1];
1277	natt->encap_sport = n_port->sadb_x_nat_t_port_port;
1278	}
1279	if (ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]) {
1280	const struct sadb_x_nat_t_port *n_port =
1281	ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1];
1282	natt->encap_dport = n_port->sadb_x_nat_t_port_port;
1283	}
1284	}
1285
1286	err = xfrm_init_state(x);
1287	if (err)
1288	goto out;
1289
1290	x->km.seq = hdr->sadb_msg_seq;
1291	return x;
1292
1293	out:
1294	x->km.state = XFRM_STATE_DEAD;
1295	xfrm_state_put(x);
1296	return ERR_PTR(error: err);
1297	}
1298
1299	static int pfkey_reserved(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1300	{
1301	return -EOPNOTSUPP;
1302	}
1303
1304	static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1305	{
1306	struct net *net = sock_net(sk);
1307	struct sk_buff *resp_skb;
1308	struct sadb_x_sa2 *sa2;
1309	struct sadb_address *saddr, *daddr;
1310	struct sadb_msg *out_hdr;
1311	struct sadb_spirange *range;
1312	struct xfrm_state *x = NULL;
1313	int mode;
1314	int err;
1315	u32 min_spi, max_spi;
1316	u32 reqid;
1317	u8 proto;
1318	unsigned short family;
1319	xfrm_address_t *xsaddr = NULL, *xdaddr = NULL;
1320
1321	if (!present_and_same_family(src: ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1322	dst: ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1323	return -EINVAL;
1324
1325	proto = pfkey_satype2proto(satype: hdr->sadb_msg_satype);
1326	if (proto == 0)
1327	return -EINVAL;
1328
1329	if ((sa2 = ext_hdrs[SADB_X_EXT_SA2-1]) != NULL) {
1330	mode = pfkey_mode_to_xfrm(mode: sa2->sadb_x_sa2_mode);
1331	if (mode < 0)
1332	return -EINVAL;
1333	reqid = sa2->sadb_x_sa2_reqid;
1334	} else {
1335	mode = 0;
1336	reqid = 0;
1337	}
1338
1339	saddr = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
1340	daddr = ext_hdrs[SADB_EXT_ADDRESS_DST-1];
1341
1342	family = ((struct sockaddr *)(saddr + 1))->sa_family;
1343	switch (family) {
1344	case AF_INET:
1345	xdaddr = (xfrm_address_t *)&((struct sockaddr_in *)(daddr + 1))->sin_addr.s_addr;
1346	xsaddr = (xfrm_address_t *)&((struct sockaddr_in *)(saddr + 1))->sin_addr.s_addr;
1347	break;
1348	#if IS_ENABLED(CONFIG_IPV6)
1349	case AF_INET6:
1350	xdaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(daddr + 1))->sin6_addr;
1351	xsaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(saddr + 1))->sin6_addr;
1352	break;
1353	#endif
1354	}
1355
1356	if (hdr->sadb_msg_seq) {
1357	x = xfrm_find_acq_byseq(net, DUMMY_MARK, seq: hdr->sadb_msg_seq, UINT_MAX);
1358	if (x && !xfrm_addr_equal(a: &x->id.daddr, b: xdaddr, family)) {
1359	xfrm_state_put(x);
1360	x = NULL;
1361	}
1362	}
1363
1364	if (!x)
1365	x = xfrm_find_acq(net, mark: &dummy_mark, mode, reqid, if_id: 0, UINT_MAX,
1366	proto, daddr: xdaddr, saddr: xsaddr, create: 1, family);
1367
1368	if (x == NULL)
1369	return -ENOENT;
1370
1371	min_spi = 0x100;
1372	max_spi = 0x0fffffff;
1373
1374	range = ext_hdrs[SADB_EXT_SPIRANGE-1];
1375	if (range) {
1376	min_spi = range->sadb_spirange_min;
1377	max_spi = range->sadb_spirange_max;
1378	}
1379
1380	err = verify_spi_info(proto: x->id.proto, min: min_spi, max: max_spi, NULL);
1381	if (err) {
1382	xfrm_state_put(x);
1383	return err;
1384	}
1385
1386	err = xfrm_alloc_spi(x, minspi: min_spi, maxspi: max_spi, NULL);
1387	resp_skb = err ? ERR_PTR(error: err) : pfkey_xfrm_state2msg(x);
1388
1389	if (IS_ERR(ptr: resp_skb)) {
1390	xfrm_state_put(x);
1391	return PTR_ERR(ptr: resp_skb);
1392	}
1393
1394	out_hdr = (struct sadb_msg *) resp_skb->data;
1395	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
1396	out_hdr->sadb_msg_type = SADB_GETSPI;
1397	out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
1398	out_hdr->sadb_msg_errno = 0;
1399	out_hdr->sadb_msg_reserved = 0;
1400	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
1401	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
1402
1403	xfrm_state_put(x);
1404
1405	pfkey_broadcast(skb: resp_skb, GFP_KERNEL, BROADCAST_ONE, one_sk: sk, net);
1406
1407	return 0;
1408	}
1409
1410	static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1411	{
1412	struct net *net = sock_net(sk);
1413	struct xfrm_state *x;
1414
1415	if (hdr->sadb_msg_len != sizeof(struct sadb_msg)/8)
1416	return -EOPNOTSUPP;
1417
1418	if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0)
1419	return 0;
1420
1421	x = xfrm_find_acq_byseq(net, DUMMY_MARK, seq: hdr->sadb_msg_seq, UINT_MAX);
1422	if (x == NULL)
1423	return 0;
1424
1425	spin_lock_bh(lock: &x->lock);
1426	if (x->km.state == XFRM_STATE_ACQ)
1427	x->km.state = XFRM_STATE_ERROR;
1428
1429	spin_unlock_bh(lock: &x->lock);
1430	xfrm_state_put(x);
1431	return 0;
1432	}
1433
1434	static inline int event2poltype(int event)
1435	{
1436	switch (event) {
1437	case XFRM_MSG_DELPOLICY:
1438	return SADB_X_SPDDELETE;
1439	case XFRM_MSG_NEWPOLICY:
1440	return SADB_X_SPDADD;
1441	case XFRM_MSG_UPDPOLICY:
1442	return SADB_X_SPDUPDATE;
1443	case XFRM_MSG_POLEXPIRE:
1444	// return SADB_X_SPDEXPIRE;
1445	default:
1446	pr_err("pfkey: Unknown policy event %d\n", event);
1447	break;
1448	}
1449
1450	return 0;
1451	}
1452
1453	static inline int event2keytype(int event)
1454	{
1455	switch (event) {
1456	case XFRM_MSG_DELSA:
1457	return SADB_DELETE;
1458	case XFRM_MSG_NEWSA:
1459	return SADB_ADD;
1460	case XFRM_MSG_UPDSA:
1461	return SADB_UPDATE;
1462	case XFRM_MSG_EXPIRE:
1463	return SADB_EXPIRE;
1464	default:
1465	pr_err("pfkey: Unknown SA event %d\n", event);
1466	break;
1467	}
1468
1469	return 0;
1470	}
1471
1472	/* ADD/UPD/DEL */
1473	static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
1474	{
1475	struct sk_buff *skb;
1476	struct sadb_msg *hdr;
1477
1478	skb = pfkey_xfrm_state2msg(x);
1479
1480	if (IS_ERR(ptr: skb))
1481	return PTR_ERR(ptr: skb);
1482
1483	hdr = (struct sadb_msg *) skb->data;
1484	hdr->sadb_msg_version = PF_KEY_V2;
1485	hdr->sadb_msg_type = event2keytype(event: c->event);
1486	hdr->sadb_msg_satype = pfkey_proto2satype(proto: x->id.proto);
1487	hdr->sadb_msg_errno = 0;
1488	hdr->sadb_msg_reserved = 0;
1489	hdr->sadb_msg_seq = c->seq;
1490	hdr->sadb_msg_pid = c->portid;
1491
1492	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, net: xs_net(x));
1493
1494	return 0;
1495	}
1496
1497	static int pfkey_add(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1498	{
1499	struct net *net = sock_net(sk);
1500	struct xfrm_state *x;
1501	int err;
1502	struct km_event c;
1503
1504	x = pfkey_msg2xfrm_state(net, hdr, ext_hdrs);
1505	if (IS_ERR(ptr: x))
1506	return PTR_ERR(ptr: x);
1507
1508	xfrm_state_hold(x);
1509	if (hdr->sadb_msg_type == SADB_ADD)
1510	err = xfrm_state_add(x);
1511	else
1512	err = xfrm_state_update(x);
1513
1514	xfrm_audit_state_add(x, result: err ? 0 : 1, task_valid: true);
1515
1516	if (err < 0) {
1517	x->km.state = XFRM_STATE_DEAD;
1518	__xfrm_state_put(x);
1519	goto out;
1520	}
1521
1522	if (hdr->sadb_msg_type == SADB_ADD)
1523	c.event = XFRM_MSG_NEWSA;
1524	else
1525	c.event = XFRM_MSG_UPDSA;
1526	c.seq = hdr->sadb_msg_seq;
1527	c.portid = hdr->sadb_msg_pid;
1528	km_state_notify(x, c: &c);
1529	out:
1530	xfrm_state_put(x);
1531	return err;
1532	}
1533
1534	static int pfkey_delete(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1535	{
1536	struct net *net = sock_net(sk);
1537	struct xfrm_state *x;
1538	struct km_event c;
1539	int err;
1540
1541	if (!ext_hdrs[SADB_EXT_SA-1] ||
1542	!present_and_same_family(src: ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1543	dst: ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1544	return -EINVAL;
1545
1546	x = pfkey_xfrm_state_lookup(net, hdr, ext_hdrs);
1547	if (x == NULL)
1548	return -ESRCH;
1549
1550	if ((err = security_xfrm_state_delete(x)))
1551	goto out;
1552
1553	if (xfrm_state_kern(x)) {
1554	err = -EPERM;
1555	goto out;
1556	}
1557
1558	err = xfrm_state_delete(x);
1559
1560	if (err < 0)
1561	goto out;
1562
1563	c.seq = hdr->sadb_msg_seq;
1564	c.portid = hdr->sadb_msg_pid;
1565	c.event = XFRM_MSG_DELSA;
1566	km_state_notify(x, c: &c);
1567	out:
1568	xfrm_audit_state_delete(x, result: err ? 0 : 1, task_valid: true);
1569	xfrm_state_put(x);
1570
1571	return err;
1572	}
1573
1574	static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1575	{
1576	struct net *net = sock_net(sk);
1577	__u8 proto;
1578	struct sk_buff *out_skb;
1579	struct sadb_msg *out_hdr;
1580	struct xfrm_state *x;
1581
1582	if (!ext_hdrs[SADB_EXT_SA-1] ||
1583	!present_and_same_family(src: ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1584	dst: ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1585	return -EINVAL;
1586
1587	x = pfkey_xfrm_state_lookup(net, hdr, ext_hdrs);
1588	if (x == NULL)
1589	return -ESRCH;
1590
1591	out_skb = pfkey_xfrm_state2msg(x);
1592	proto = x->id.proto;
1593	xfrm_state_put(x);
1594	if (IS_ERR(ptr: out_skb))
1595	return PTR_ERR(ptr: out_skb);
1596
1597	out_hdr = (struct sadb_msg *) out_skb->data;
1598	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
1599	out_hdr->sadb_msg_type = SADB_GET;
1600	out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
1601	out_hdr->sadb_msg_errno = 0;
1602	out_hdr->sadb_msg_reserved = 0;
1603	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
1604	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
1605	pfkey_broadcast(skb: out_skb, GFP_ATOMIC, BROADCAST_ONE, one_sk: sk, net: sock_net(sk));
1606
1607	return 0;
1608	}
1609
1610	static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
1611	gfp_t allocation)
1612	{
1613	struct sk_buff *skb;
1614	struct sadb_msg *hdr;
1615	int len, auth_len, enc_len, i;
1616
1617	auth_len = xfrm_count_pfkey_auth_supported();
1618	if (auth_len) {
1619	auth_len *= sizeof(struct sadb_alg);
1620	auth_len += sizeof(struct sadb_supported);
1621	}
1622
1623	enc_len = xfrm_count_pfkey_enc_supported();
1624	if (enc_len) {
1625	enc_len *= sizeof(struct sadb_alg);
1626	enc_len += sizeof(struct sadb_supported);
1627	}
1628
1629	len = enc_len + auth_len + sizeof(struct sadb_msg);
1630
1631	skb = alloc_skb(size: len + 16, priority: allocation);
1632	if (!skb)
1633	goto out_put_algs;
1634
1635	hdr = skb_put(skb, len: sizeof(*hdr));
1636	pfkey_hdr_dup(new: hdr, orig);
1637	hdr->sadb_msg_errno = 0;
1638	hdr->sadb_msg_len = len / sizeof(uint64_t);
1639
1640	if (auth_len) {
1641	struct sadb_supported *sp;
1642	struct sadb_alg *ap;
1643
1644	sp = skb_put(skb, len: auth_len);
1645	ap = (struct sadb_alg *) (sp + 1);
1646
1647	sp->sadb_supported_len = auth_len / sizeof(uint64_t);
1648	sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
1649
1650	for (i = 0; ; i++) {
1651	struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(idx: i);
1652	if (!aalg)
1653	break;
1654	if (!aalg->pfkey_supported)
1655	continue;
1656	if (aalg->available)
1657	*ap++ = aalg->desc;
1658	}
1659	}
1660
1661	if (enc_len) {
1662	struct sadb_supported *sp;
1663	struct sadb_alg *ap;
1664
1665	sp = skb_put(skb, len: enc_len);
1666	ap = (struct sadb_alg *) (sp + 1);
1667
1668	sp->sadb_supported_len = enc_len / sizeof(uint64_t);
1669	sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT;
1670
1671	for (i = 0; ; i++) {
1672	struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(idx: i);
1673	if (!ealg)
1674	break;
1675	if (!ealg->pfkey_supported)
1676	continue;
1677	if (ealg->available)
1678	*ap++ = ealg->desc;
1679	}
1680	}
1681
1682	out_put_algs:
1683	return skb;
1684	}
1685
1686	static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1687	{
1688	struct pfkey_sock *pfk = pfkey_sk(sk);
1689	struct sk_buff *supp_skb;
1690
1691	if (hdr->sadb_msg_satype > SADB_SATYPE_MAX)
1692	return -EINVAL;
1693
1694	if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) {
1695	if (pfk->registered&(1<<hdr->sadb_msg_satype))
1696	return -EEXIST;
1697	pfk->registered |= (1<<hdr->sadb_msg_satype);
1698	}
1699
1700	mutex_lock(&pfkey_mutex);
1701	xfrm_probe_algs();
1702
1703	supp_skb = compose_sadb_supported(orig: hdr, GFP_KERNEL | __GFP_ZERO);
1704	mutex_unlock(lock: &pfkey_mutex);
1705
1706	if (!supp_skb) {
1707	if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC)
1708	pfk->registered &= ~(1<<hdr->sadb_msg_satype);
1709
1710	return -ENOBUFS;
1711	}
1712
1713	pfkey_broadcast(skb: supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, one_sk: sk,
1714	net: sock_net(sk));
1715	return 0;
1716	}
1717
1718	static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
1719	{
1720	struct sk_buff *skb;
1721	struct sadb_msg *hdr;
1722
1723	skb = alloc_skb(size: sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
1724	if (!skb)
1725	return -ENOBUFS;
1726
1727	hdr = skb_put_data(skb, data: ihdr, len: sizeof(struct sadb_msg));
1728	hdr->sadb_msg_errno = (uint8_t) 0;
1729	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
1730
1731	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, one_sk: sk,
1732	net: sock_net(sk));
1733	}
1734
1735	static int key_notify_sa_flush(const struct km_event *c)
1736	{
1737	struct sk_buff *skb;
1738	struct sadb_msg *hdr;
1739
1740	skb = alloc_skb(size: sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
1741	if (!skb)
1742	return -ENOBUFS;
1743	hdr = skb_put(skb, len: sizeof(struct sadb_msg));
1744	hdr->sadb_msg_satype = pfkey_proto2satype(proto: c->data.proto);
1745	hdr->sadb_msg_type = SADB_FLUSH;
1746	hdr->sadb_msg_seq = c->seq;
1747	hdr->sadb_msg_pid = c->portid;
1748	hdr->sadb_msg_version = PF_KEY_V2;
1749	hdr->sadb_msg_errno = (uint8_t) 0;
1750	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
1751	hdr->sadb_msg_reserved = 0;
1752
1753	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, net: c->net);
1754
1755	return 0;
1756	}
1757
1758	static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1759	{
1760	struct net *net = sock_net(sk);
1761	unsigned int proto;
1762	struct km_event c;
1763	int err, err2;
1764
1765	proto = pfkey_satype2proto(satype: hdr->sadb_msg_satype);
1766	if (proto == 0)
1767	return -EINVAL;
1768
1769	err = xfrm_state_flush(net, proto, task_valid: true);
1770	err2 = unicast_flush_resp(sk, ihdr: hdr);
1771	if (err || err2) {
1772	if (err == -ESRCH) /* empty table - go quietly */
1773	err = 0;
1774	return err ? err : err2;
1775	}
1776
1777	c.data.proto = proto;
1778	c.seq = hdr->sadb_msg_seq;
1779	c.portid = hdr->sadb_msg_pid;
1780	c.event = XFRM_MSG_FLUSHSA;
1781	c.net = net;
1782	km_state_notify(NULL, c: &c);
1783
1784	return 0;
1785	}
1786
1787	static int dump_sa(struct xfrm_state *x, int count, void *ptr)
1788	{
1789	struct pfkey_sock *pfk = ptr;
1790	struct sk_buff *out_skb;
1791	struct sadb_msg *out_hdr;
1792
1793	if (!pfkey_can_dump(sk: &pfk->sk))
1794	return -ENOBUFS;
1795
1796	out_skb = pfkey_xfrm_state2msg(x);
1797	if (IS_ERR(ptr: out_skb))
1798	return PTR_ERR(ptr: out_skb);
1799
1800	out_hdr = (struct sadb_msg *) out_skb->data;
1801	out_hdr->sadb_msg_version = pfk->dump.msg_version;
1802	out_hdr->sadb_msg_type = SADB_DUMP;
1803	out_hdr->sadb_msg_satype = pfkey_proto2satype(proto: x->id.proto);
1804	out_hdr->sadb_msg_errno = 0;
1805	out_hdr->sadb_msg_reserved = 0;
1806	out_hdr->sadb_msg_seq = count + 1;
1807	out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
1808
1809	if (pfk->dump.skb)
1810	pfkey_broadcast(skb: pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
1811	one_sk: &pfk->sk, net: sock_net(sk: &pfk->sk));
1812	pfk->dump.skb = out_skb;
1813
1814	return 0;
1815	}
1816
1817	static int pfkey_dump_sa(struct pfkey_sock *pfk)
1818	{
1819	struct net *net = sock_net(sk: &pfk->sk);
1820	return xfrm_state_walk(net, walk: &pfk->dump.u.state, func: dump_sa, (void *) pfk);
1821	}
1822
1823	static void pfkey_dump_sa_done(struct pfkey_sock *pfk)
1824	{
1825	struct net *net = sock_net(sk: &pfk->sk);
1826
1827	xfrm_state_walk_done(walk: &pfk->dump.u.state, net);
1828	}
1829
1830	static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1831	{
1832	u8 proto;
1833	struct xfrm_address_filter *filter = NULL;
1834	struct pfkey_sock *pfk = pfkey_sk(sk);
1835
1836	mutex_lock(&pfk->dump_lock);
1837	if (pfk->dump.dump != NULL) {
1838	mutex_unlock(lock: &pfk->dump_lock);
1839	return -EBUSY;
1840	}
1841
1842	proto = pfkey_satype2proto(satype: hdr->sadb_msg_satype);
1843	if (proto == 0) {
1844	mutex_unlock(lock: &pfk->dump_lock);
1845	return -EINVAL;
1846	}
1847
1848	if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
1849	struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
1850
1851	if ((xfilter->sadb_x_filter_splen >
1852	(sizeof(xfrm_address_t) << 3)) ||
1853	(xfilter->sadb_x_filter_dplen >
1854	(sizeof(xfrm_address_t) << 3))) {
1855	mutex_unlock(lock: &pfk->dump_lock);
1856	return -EINVAL;
1857	}
1858	filter = kmalloc(sizeof(*filter), GFP_KERNEL);
1859	if (filter == NULL) {
1860	mutex_unlock(lock: &pfk->dump_lock);
1861	return -ENOMEM;
1862	}
1863
1864	memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
1865	sizeof(xfrm_address_t));
1866	memcpy(&filter->daddr, &xfilter->sadb_x_filter_daddr,
1867	sizeof(xfrm_address_t));
1868	filter->family = xfilter->sadb_x_filter_family;
1869	filter->splen = xfilter->sadb_x_filter_splen;
1870	filter->dplen = xfilter->sadb_x_filter_dplen;
1871	}
1872
1873	pfk->dump.msg_version = hdr->sadb_msg_version;
1874	pfk->dump.msg_portid = hdr->sadb_msg_pid;
1875	pfk->dump.dump = pfkey_dump_sa;
1876	pfk->dump.done = pfkey_dump_sa_done;
1877	xfrm_state_walk_init(walk: &pfk->dump.u.state, proto, filter);
1878	mutex_unlock(lock: &pfk->dump_lock);
1879
1880	return pfkey_do_dump(pfk);
1881	}
1882
1883	static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
1884	{
1885	struct pfkey_sock *pfk = pfkey_sk(sk);
1886	int satype = hdr->sadb_msg_satype;
1887	bool reset_errno = false;
1888
1889	if (hdr->sadb_msg_len == (sizeof(*hdr) / sizeof(uint64_t))) {
1890	reset_errno = true;
1891	if (satype != 0 && satype != 1)
1892	return -EINVAL;
1893	pfk->promisc = satype;
1894	}
1895	if (reset_errno && skb_cloned(skb))
1896	skb = skb_copy(skb, GFP_KERNEL);
1897	else
1898	skb = skb_clone(skb, GFP_KERNEL);
1899
1900	if (reset_errno && skb) {
1901	struct sadb_msg *new_hdr = (struct sadb_msg *) skb->data;
1902	new_hdr->sadb_msg_errno = 0;
1903	}
1904
1905	pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, net: sock_net(sk));
1906	return 0;
1907	}
1908
1909	static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr)
1910	{
1911	int i;
1912	u32 reqid = *(u32*)ptr;
1913
1914	for (i=0; i<xp->xfrm_nr; i++) {
1915	if (xp->xfrm_vec[i].reqid == reqid)
1916	return -EEXIST;
1917	}
1918	return 0;
1919	}
1920
1921	static u32 gen_reqid(struct net *net)
1922	{
1923	struct xfrm_policy_walk walk;
1924	u32 start;
1925	int rc;
1926	static u32 reqid = IPSEC_MANUAL_REQID_MAX;
1927
1928	start = reqid;
1929	do {
1930	++reqid;
1931	if (reqid == 0)
1932	reqid = IPSEC_MANUAL_REQID_MAX+1;
1933	xfrm_policy_walk_init(walk: &walk, type: XFRM_POLICY_TYPE_MAIN);
1934	rc = xfrm_policy_walk(net, walk: &walk, func: check_reqid, (void*)&reqid);
1935	xfrm_policy_walk_done(walk: &walk, net);
1936	if (rc != -EEXIST)
1937	return reqid;
1938	} while (reqid != start);
1939	return 0;
1940	}
1941
1942	static int
1943	parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_policy *pol,
1944	struct sadb_x_ipsecrequest *rq)
1945	{
1946	struct net *net = xp_net(xp);
1947	struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr;
1948	int mode;
1949
1950	if (xp->xfrm_nr >= XFRM_MAX_DEPTH)
1951	return -ELOOP;
1952
1953	if (rq->sadb_x_ipsecrequest_mode == 0)
1954	return -EINVAL;
1955	if (!xfrm_id_proto_valid(proto: rq->sadb_x_ipsecrequest_proto))
1956	return -EINVAL;
1957
1958	t->id.proto = rq->sadb_x_ipsecrequest_proto;
1959	if ((mode = pfkey_mode_to_xfrm(mode: rq->sadb_x_ipsecrequest_mode)) < 0)
1960	return -EINVAL;
1961	t->mode = mode;
1962	if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) {
1963	if ((mode == XFRM_MODE_TUNNEL || mode == XFRM_MODE_BEET) &&
1964	pol->sadb_x_policy_dir == IPSEC_DIR_OUTBOUND)
1965	return -EINVAL;
1966	t->optional = 1;
1967	} else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
1968	t->reqid = rq->sadb_x_ipsecrequest_reqid;
1969	if (t->reqid > IPSEC_MANUAL_REQID_MAX)
1970	t->reqid = 0;
1971	if (!t->reqid && !(t->reqid = gen_reqid(net)))
1972	return -ENOBUFS;
1973	}
1974
1975	/* addresses present only in tunnel mode */
1976	if (t->mode == XFRM_MODE_TUNNEL) {
1977	int err;
1978
1979	err = parse_sockaddr_pair(
1980	sa: (struct sockaddr *)(rq + 1),
1981	ext_len: rq->sadb_x_ipsecrequest_len - sizeof(*rq),
1982	saddr: &t->saddr, daddr: &t->id.daddr, family: &t->encap_family);
1983	if (err)
1984	return err;
1985	} else
1986	t->encap_family = xp->family;
1987
1988	/* No way to set this via kame pfkey */
1989	t->allalgs = 1;
1990	xp->xfrm_nr++;
1991	return 0;
1992	}
1993
1994	static int
1995	parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
1996	{
1997	int err;
1998	int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy);
1999	struct sadb_x_ipsecrequest *rq = (void*)(pol+1);
2000
2001	if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
2002	return -EINVAL;
2003
2004	while (len >= sizeof(*rq)) {
2005	if (len < rq->sadb_x_ipsecrequest_len ||
2006	rq->sadb_x_ipsecrequest_len < sizeof(*rq))
2007	return -EINVAL;
2008
2009	if ((err = parse_ipsecrequest(xp, pol, rq)) < 0)
2010	return err;
2011	len -= rq->sadb_x_ipsecrequest_len;
2012	rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len);
2013	}
2014	return 0;
2015	}
2016
2017	static inline int pfkey_xfrm_policy2sec_ctx_size(const struct xfrm_policy *xp)
2018	{
2019	struct xfrm_sec_ctx *xfrm_ctx = xp->security;
2020
2021	if (xfrm_ctx) {
2022	int len = sizeof(struct sadb_x_sec_ctx);
2023	len += xfrm_ctx->ctx_len;
2024	return PFKEY_ALIGN8(len);
2025	}
2026	return 0;
2027	}
2028
2029	static int pfkey_xfrm_policy2msg_size(const struct xfrm_policy *xp)
2030	{
2031	const struct xfrm_tmpl *t;
2032	int sockaddr_size = pfkey_sockaddr_size(family: xp->family);
2033	int socklen = 0;
2034	int i;
2035
2036	for (i=0; i<xp->xfrm_nr; i++) {
2037	t = xp->xfrm_vec + i;
2038	socklen += pfkey_sockaddr_len(family: t->encap_family);
2039	}
2040
2041	return sizeof(struct sadb_msg) +
2042	(sizeof(struct sadb_lifetime) * 3) +
2043	(sizeof(struct sadb_address) * 2) +
2044	(sockaddr_size * 2) +
2045	sizeof(struct sadb_x_policy) +
2046	(xp->xfrm_nr * sizeof(struct sadb_x_ipsecrequest)) +
2047	(socklen * 2) +
2048	pfkey_xfrm_policy2sec_ctx_size(xp);
2049	}
2050
2051	static struct sk_buff * pfkey_xfrm_policy2msg_prep(const struct xfrm_policy *xp)
2052	{
2053	struct sk_buff *skb;
2054	int size;
2055
2056	size = pfkey_xfrm_policy2msg_size(xp);
2057
2058	skb = alloc_skb(size: size + 16, GFP_ATOMIC);
2059	if (skb == NULL)
2060	return ERR_PTR(error: -ENOBUFS);
2061
2062	return skb;
2063	}
2064
2065	static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *xp, int dir)
2066	{
2067	struct sadb_msg *hdr;
2068	struct sadb_address *addr;
2069	struct sadb_lifetime *lifetime;
2070	struct sadb_x_policy *pol;
2071	struct sadb_x_sec_ctx *sec_ctx;
2072	struct xfrm_sec_ctx *xfrm_ctx;
2073	int i;
2074	int size;
2075	int sockaddr_size = pfkey_sockaddr_size(family: xp->family);
2076	int socklen = pfkey_sockaddr_len(family: xp->family);
2077
2078	size = pfkey_xfrm_policy2msg_size(xp);
2079
2080	/* call should fill header later */
2081	hdr = skb_put(skb, len: sizeof(struct sadb_msg));
2082	memset(hdr, 0, size); /* XXX do we need this ? */
2083
2084	/* src address */
2085	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
2086	addr->sadb_address_len =
2087	(sizeof(struct sadb_address)+sockaddr_size)/
2088	sizeof(uint64_t);
2089	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
2090	addr->sadb_address_proto = pfkey_proto_from_xfrm(proto: xp->selector.proto);
2091	addr->sadb_address_prefixlen = xp->selector.prefixlen_s;
2092	addr->sadb_address_reserved = 0;
2093	if (!pfkey_sockaddr_fill(xaddr: &xp->selector.saddr,
2094	port: xp->selector.sport,
2095	sa: (struct sockaddr *) (addr + 1),
2096	family: xp->family))
2097	BUG();
2098
2099	/* dst address */
2100	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
2101	addr->sadb_address_len =
2102	(sizeof(struct sadb_address)+sockaddr_size)/
2103	sizeof(uint64_t);
2104	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
2105	addr->sadb_address_proto = pfkey_proto_from_xfrm(proto: xp->selector.proto);
2106	addr->sadb_address_prefixlen = xp->selector.prefixlen_d;
2107	addr->sadb_address_reserved = 0;
2108
2109	pfkey_sockaddr_fill(xaddr: &xp->selector.daddr, port: xp->selector.dport,
2110	sa: (struct sockaddr *) (addr + 1),
2111	family: xp->family);
2112
2113	/* hard time */
2114	lifetime = skb_put(skb, len: sizeof(struct sadb_lifetime));
2115	lifetime->sadb_lifetime_len =
2116	sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2117	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
2118	lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.hard_packet_limit);
2119	lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.hard_byte_limit);
2120	lifetime->sadb_lifetime_addtime = xp->lft.hard_add_expires_seconds;
2121	lifetime->sadb_lifetime_usetime = xp->lft.hard_use_expires_seconds;
2122	/* soft time */
2123	lifetime = skb_put(skb, len: sizeof(struct sadb_lifetime));
2124	lifetime->sadb_lifetime_len =
2125	sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2126	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
2127	lifetime->sadb_lifetime_allocations = _X2KEY(xp->lft.soft_packet_limit);
2128	lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.soft_byte_limit);
2129	lifetime->sadb_lifetime_addtime = xp->lft.soft_add_expires_seconds;
2130	lifetime->sadb_lifetime_usetime = xp->lft.soft_use_expires_seconds;
2131	/* current time */
2132	lifetime = skb_put(skb, len: sizeof(struct sadb_lifetime));
2133	lifetime->sadb_lifetime_len =
2134	sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2135	lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
2136	lifetime->sadb_lifetime_allocations = xp->curlft.packets;
2137	lifetime->sadb_lifetime_bytes = xp->curlft.bytes;
2138	lifetime->sadb_lifetime_addtime = xp->curlft.add_time;
2139	lifetime->sadb_lifetime_usetime = xp->curlft.use_time;
2140
2141	pol = skb_put(skb, len: sizeof(struct sadb_x_policy));
2142	pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t);
2143	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
2144	pol->sadb_x_policy_type = IPSEC_POLICY_DISCARD;
2145	if (xp->action == XFRM_POLICY_ALLOW) {
2146	if (xp->xfrm_nr)
2147	pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
2148	else
2149	pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
2150	}
2151	pol->sadb_x_policy_dir = dir+1;
2152	pol->sadb_x_policy_reserved = 0;
2153	pol->sadb_x_policy_id = xp->index;
2154	pol->sadb_x_policy_priority = xp->priority;
2155
2156	for (i=0; i<xp->xfrm_nr; i++) {
2157	const struct xfrm_tmpl *t = xp->xfrm_vec + i;
2158	struct sadb_x_ipsecrequest *rq;
2159	int req_size;
2160	int mode;
2161
2162	req_size = sizeof(struct sadb_x_ipsecrequest);
2163	if (t->mode == XFRM_MODE_TUNNEL) {
2164	socklen = pfkey_sockaddr_len(family: t->encap_family);
2165	req_size += socklen * 2;
2166	} else {
2167	size -= 2*socklen;
2168	}
2169	rq = skb_put(skb, len: req_size);
2170	pol->sadb_x_policy_len += req_size/8;
2171	memset(rq, 0, sizeof(*rq));
2172	rq->sadb_x_ipsecrequest_len = req_size;
2173	rq->sadb_x_ipsecrequest_proto = t->id.proto;
2174	if ((mode = pfkey_mode_from_xfrm(mode: t->mode)) < 0)
2175	return -EINVAL;
2176	rq->sadb_x_ipsecrequest_mode = mode;
2177	rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE;
2178	if (t->reqid)
2179	rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE;
2180	if (t->optional)
2181	rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE;
2182	rq->sadb_x_ipsecrequest_reqid = t->reqid;
2183
2184	if (t->mode == XFRM_MODE_TUNNEL) {
2185	u8 *sa = (void *)(rq + 1);
2186	pfkey_sockaddr_fill(xaddr: &t->saddr, port: 0,
2187	sa: (struct sockaddr *)sa,
2188	family: t->encap_family);
2189	pfkey_sockaddr_fill(xaddr: &t->id.daddr, port: 0,
2190	sa: (struct sockaddr *) (sa + socklen),
2191	family: t->encap_family);
2192	}
2193	}
2194
2195	/* security context */
2196	if ((xfrm_ctx = xp->security)) {
2197	int ctx_size = pfkey_xfrm_policy2sec_ctx_size(xp);
2198
2199	sec_ctx = skb_put(skb, len: ctx_size);
2200	sec_ctx->sadb_x_sec_len = ctx_size / sizeof(uint64_t);
2201	sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
2202	sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
2203	sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
2204	sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
2205	memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
2206	xfrm_ctx->ctx_len);
2207	}
2208
2209	hdr->sadb_msg_len = size / sizeof(uint64_t);
2210	hdr->sadb_msg_reserved = refcount_read(r: &xp->refcnt);
2211
2212	return 0;
2213	}
2214
2215	static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
2216	{
2217	struct sk_buff *out_skb;
2218	struct sadb_msg *out_hdr;
2219	int err;
2220
2221	out_skb = pfkey_xfrm_policy2msg_prep(xp);
2222	if (IS_ERR(ptr: out_skb))
2223	return PTR_ERR(ptr: out_skb);
2224
2225	err = pfkey_xfrm_policy2msg(skb: out_skb, xp, dir);
2226	if (err < 0) {
2227	kfree_skb(skb: out_skb);
2228	return err;
2229	}
2230
2231	out_hdr = (struct sadb_msg *) out_skb->data;
2232	out_hdr->sadb_msg_version = PF_KEY_V2;
2233
2234	if (c->data.byid && c->event == XFRM_MSG_DELPOLICY)
2235	out_hdr->sadb_msg_type = SADB_X_SPDDELETE2;
2236	else
2237	out_hdr->sadb_msg_type = event2poltype(event: c->event);
2238	out_hdr->sadb_msg_errno = 0;
2239	out_hdr->sadb_msg_seq = c->seq;
2240	out_hdr->sadb_msg_pid = c->portid;
2241	pfkey_broadcast(skb: out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, net: xp_net(xp));
2242	return 0;
2243
2244	}
2245
2246	static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
2247	{
2248	struct net *net = sock_net(sk);
2249	int err = 0;
2250	struct sadb_lifetime *lifetime;
2251	struct sadb_address *sa;
2252	struct sadb_x_policy *pol;
2253	struct xfrm_policy *xp;
2254	struct km_event c;
2255	struct sadb_x_sec_ctx *sec_ctx;
2256
2257	if (!present_and_same_family(src: ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2258	dst: ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
2259	!ext_hdrs[SADB_X_EXT_POLICY-1])
2260	return -EINVAL;
2261
2262	pol = ext_hdrs[SADB_X_EXT_POLICY-1];
2263	if (pol->sadb_x_policy_type > IPSEC_POLICY_IPSEC)
2264	return -EINVAL;
2265	if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX)
2266	return -EINVAL;
2267
2268	xp = xfrm_policy_alloc(net, GFP_KERNEL);
2269	if (xp == NULL)
2270	return -ENOBUFS;
2271
2272	xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ?
2273	XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);
2274	xp->priority = pol->sadb_x_policy_priority;
2275
2276	sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
2277	xp->family = pfkey_sadb_addr2xfrm_addr(addr: sa, xaddr: &xp->selector.saddr);
2278	xp->selector.family = xp->family;
2279	xp->selector.prefixlen_s = sa->sadb_address_prefixlen;
2280	xp->selector.proto = pfkey_proto_to_xfrm(proto: sa->sadb_address_proto);
2281	xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
2282	if (xp->selector.sport)
2283	xp->selector.sport_mask = htons(0xffff);
2284
2285	sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1];
2286	pfkey_sadb_addr2xfrm_addr(addr: sa, xaddr: &xp->selector.daddr);
2287	xp->selector.prefixlen_d = sa->sadb_address_prefixlen;
2288
2289	/* Amusing, we set this twice. KAME apps appear to set same value
2290	* in both addresses.
2291	*/
2292	xp->selector.proto = pfkey_proto_to_xfrm(proto: sa->sadb_address_proto);
2293
2294	xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
2295	if (xp->selector.dport)
2296	xp->selector.dport_mask = htons(0xffff);
2297
2298	sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
2299	if (sec_ctx != NULL) {
2300	struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
2301
2302	if (!uctx) {
2303	err = -ENOBUFS;
2304	goto out;
2305	}
2306
2307	err = security_xfrm_policy_alloc(ctxp: &xp->security, sec_ctx: uctx, GFP_KERNEL);
2308	kfree(objp: uctx);
2309
2310	if (err)
2311	goto out;
2312	}
2313
2314	xp->lft.soft_byte_limit = XFRM_INF;
2315	xp->lft.hard_byte_limit = XFRM_INF;
2316	xp->lft.soft_packet_limit = XFRM_INF;
2317	xp->lft.hard_packet_limit = XFRM_INF;
2318	if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD-1]) != NULL) {
2319	xp->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
2320	xp->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
2321	xp->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime;
2322	xp->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime;
2323	}
2324	if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) != NULL) {
2325	xp->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
2326	xp->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
2327	xp->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;
2328	xp->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;
2329	}
2330	xp->xfrm_nr = 0;
2331	if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
2332	(err = parse_ipsecrequests(xp, pol)) < 0)
2333	goto out;
2334
2335	err = xfrm_policy_insert(dir: pol->sadb_x_policy_dir-1, policy: xp,
2336	excl: hdr->sadb_msg_type != SADB_X_SPDUPDATE);
2337
2338	xfrm_audit_policy_add(xp, result: err ? 0 : 1, task_valid: true);
2339
2340	if (err)
2341	goto out;
2342
2343	if (hdr->sadb_msg_type == SADB_X_SPDUPDATE)
2344	c.event = XFRM_MSG_UPDPOLICY;
2345	else
2346	c.event = XFRM_MSG_NEWPOLICY;
2347
2348	c.seq = hdr->sadb_msg_seq;
2349	c.portid = hdr->sadb_msg_pid;
2350
2351	km_policy_notify(xp, dir: pol->sadb_x_policy_dir-1, c: &c);
2352	xfrm_pol_put(policy: xp);
2353	return 0;
2354
2355	out:
2356	xp->walk.dead = 1;
2357	xfrm_policy_destroy(policy: xp);
2358	return err;
2359	}
2360
2361	static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
2362	{
2363	struct net *net = sock_net(sk);
2364	int err;
2365	struct sadb_address *sa;
2366	struct sadb_x_policy *pol;
2367	struct xfrm_policy *xp;
2368	struct xfrm_selector sel;
2369	struct km_event c;
2370	struct sadb_x_sec_ctx *sec_ctx;
2371	struct xfrm_sec_ctx *pol_ctx = NULL;
2372
2373	if (!present_and_same_family(src: ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2374	dst: ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
2375	!ext_hdrs[SADB_X_EXT_POLICY-1])
2376	return -EINVAL;
2377
2378	pol = ext_hdrs[SADB_X_EXT_POLICY-1];
2379	if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX)
2380	return -EINVAL;
2381
2382	memset(&sel, 0, sizeof(sel));
2383
2384	sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
2385	sel.family = pfkey_sadb_addr2xfrm_addr(addr: sa, xaddr: &sel.saddr);
2386	sel.prefixlen_s = sa->sadb_address_prefixlen;
2387	sel.proto = pfkey_proto_to_xfrm(proto: sa->sadb_address_proto);
2388	sel.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
2389	if (sel.sport)
2390	sel.sport_mask = htons(0xffff);
2391
2392	sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1];
2393	pfkey_sadb_addr2xfrm_addr(addr: sa, xaddr: &sel.daddr);
2394	sel.prefixlen_d = sa->sadb_address_prefixlen;
2395	sel.proto = pfkey_proto_to_xfrm(proto: sa->sadb_address_proto);
2396	sel.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
2397	if (sel.dport)
2398	sel.dport_mask = htons(0xffff);
2399
2400	sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
2401	if (sec_ctx != NULL) {
2402	struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
2403
2404	if (!uctx)
2405	return -ENOMEM;
2406
2407	err = security_xfrm_policy_alloc(ctxp: &pol_ctx, sec_ctx: uctx, GFP_KERNEL);
2408	kfree(objp: uctx);
2409	if (err)
2410	return err;
2411	}
2412
2413	xp = xfrm_policy_bysel_ctx(net, mark: &dummy_mark, if_id: 0, type: XFRM_POLICY_TYPE_MAIN,
2414	dir: pol->sadb_x_policy_dir - 1, sel: &sel, ctx: pol_ctx,
2415	delete: 1, err: &err);
2416	security_xfrm_policy_free(ctx: pol_ctx);
2417	if (xp == NULL)
2418	return -ENOENT;
2419
2420	xfrm_audit_policy_delete(xp, result: err ? 0 : 1, task_valid: true);
2421
2422	if (err)
2423	goto out;
2424
2425	c.seq = hdr->sadb_msg_seq;
2426	c.portid = hdr->sadb_msg_pid;
2427	c.data.byid = 0;
2428	c.event = XFRM_MSG_DELPOLICY;
2429	km_policy_notify(xp, dir: pol->sadb_x_policy_dir-1, c: &c);
2430
2431	out:
2432	xfrm_pol_put(policy: xp);
2433	return err;
2434	}
2435
2436	static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struct sadb_msg *hdr, int dir)
2437	{
2438	int err;
2439	struct sk_buff *out_skb;
2440	struct sadb_msg *out_hdr;
2441	err = 0;
2442
2443	out_skb = pfkey_xfrm_policy2msg_prep(xp);
2444	if (IS_ERR(ptr: out_skb)) {
2445	err = PTR_ERR(ptr: out_skb);
2446	goto out;
2447	}
2448	err = pfkey_xfrm_policy2msg(skb: out_skb, xp, dir);
2449	if (err < 0) {
2450	kfree_skb(skb: out_skb);
2451	goto out;
2452	}
2453
2454	out_hdr = (struct sadb_msg *) out_skb->data;
2455	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
2456	out_hdr->sadb_msg_type = hdr->sadb_msg_type;
2457	out_hdr->sadb_msg_satype = 0;
2458	out_hdr->sadb_msg_errno = 0;
2459	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
2460	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
2461	pfkey_broadcast(skb: out_skb, GFP_ATOMIC, BROADCAST_ONE, one_sk: sk, net: xp_net(xp));
2462	err = 0;
2463
2464	out:
2465	return err;
2466	}
2467
2468	static int pfkey_sockaddr_pair_size(sa_family_t family)
2469	{
2470	return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
2471	}
2472
2473	static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
2474	xfrm_address_t *saddr, xfrm_address_t *daddr,
2475	u16 *family)
2476	{
2477	int af, socklen;
2478
2479	if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(family: sa->sa_family))
2480	return -EINVAL;
2481
2482	af = pfkey_sockaddr_extract(sa, xaddr: saddr);
2483	if (!af)
2484	return -EINVAL;
2485
2486	socklen = pfkey_sockaddr_len(family: af);
2487	if (pfkey_sockaddr_extract(sa: (struct sockaddr *) (((u8 *)sa) + socklen),
2488	xaddr: daddr) != af)
2489	return -EINVAL;
2490
2491	*family = af;
2492	return 0;
2493	}
2494
2495	#ifdef CONFIG_NET_KEY_MIGRATE
2496	static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
2497	struct xfrm_migrate *m)
2498	{
2499	int err;
2500	struct sadb_x_ipsecrequest *rq2;
2501	int mode;
2502
2503	if (len < sizeof(*rq1) ||
2504	len < rq1->sadb_x_ipsecrequest_len ||
2505	rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
2506	return -EINVAL;
2507
2508	/* old endoints */
2509	err = parse_sockaddr_pair(sa: (struct sockaddr *)(rq1 + 1),
2510	ext_len: rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
2511	saddr: &m->old_saddr, daddr: &m->old_daddr,
2512	family: &m->old_family);
2513	if (err)
2514	return err;
2515
2516	rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
2517	len -= rq1->sadb_x_ipsecrequest_len;
2518
2519	if (len <= sizeof(*rq2) ||
2520	len < rq2->sadb_x_ipsecrequest_len ||
2521	rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
2522	return -EINVAL;
2523
2524	/* new endpoints */
2525	err = parse_sockaddr_pair(sa: (struct sockaddr *)(rq2 + 1),
2526	ext_len: rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
2527	saddr: &m->new_saddr, daddr: &m->new_daddr,
2528	family: &m->new_family);
2529	if (err)
2530	return err;
2531
2532	if (rq1->sadb_x_ipsecrequest_proto != rq2->sadb_x_ipsecrequest_proto ||
2533	rq1->sadb_x_ipsecrequest_mode != rq2->sadb_x_ipsecrequest_mode ||
2534	rq1->sadb_x_ipsecrequest_reqid != rq2->sadb_x_ipsecrequest_reqid)
2535	return -EINVAL;
2536
2537	m->proto = rq1->sadb_x_ipsecrequest_proto;
2538	if ((mode = pfkey_mode_to_xfrm(mode: rq1->sadb_x_ipsecrequest_mode)) < 0)
2539	return -EINVAL;
2540	m->mode = mode;
2541	m->reqid = rq1->sadb_x_ipsecrequest_reqid;
2542
2543	return ((int)(rq1->sadb_x_ipsecrequest_len +
2544	rq2->sadb_x_ipsecrequest_len));
2545	}
2546
2547	static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
2548	const struct sadb_msg *hdr, void * const *ext_hdrs)
2549	{
2550	int i, len, ret, err = -EINVAL;
2551	u8 dir;
2552	struct sadb_address *sa;
2553	struct sadb_x_kmaddress *kma;
2554	struct sadb_x_policy *pol;
2555	struct sadb_x_ipsecrequest *rq;
2556	struct xfrm_selector sel;
2557	struct xfrm_migrate m[XFRM_MAX_DEPTH];
2558	struct xfrm_kmaddress k;
2559	struct net *net = sock_net(sk);
2560
2561	if (!present_and_same_family(src: ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
2562	dst: ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
2563	!ext_hdrs[SADB_X_EXT_POLICY - 1]) {
2564	err = -EINVAL;
2565	goto out;
2566	}
2567
2568	kma = ext_hdrs[SADB_X_EXT_KMADDRESS - 1];
2569	pol = ext_hdrs[SADB_X_EXT_POLICY - 1];
2570
2571	if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) {
2572	err = -EINVAL;
2573	goto out;
2574	}
2575
2576	if (kma) {
2577	/* convert sadb_x_kmaddress to xfrm_kmaddress */
2578	k.reserved = kma->sadb_x_kmaddress_reserved;
2579	ret = parse_sockaddr_pair(sa: (struct sockaddr *)(kma + 1),
2580	ext_len: 8*(kma->sadb_x_kmaddress_len) - sizeof(*kma),
2581	saddr: &k.local, daddr: &k.remote, family: &k.family);
2582	if (ret < 0) {
2583	err = ret;
2584	goto out;
2585	}
2586	}
2587
2588	dir = pol->sadb_x_policy_dir - 1;
2589	memset(&sel, 0, sizeof(sel));
2590
2591	/* set source address info of selector */
2592	sa = ext_hdrs[SADB_EXT_ADDRESS_SRC - 1];
2593	sel.family = pfkey_sadb_addr2xfrm_addr(addr: sa, xaddr: &sel.saddr);
2594	sel.prefixlen_s = sa->sadb_address_prefixlen;
2595	sel.proto = pfkey_proto_to_xfrm(proto: sa->sadb_address_proto);
2596	sel.sport = ((struct sockaddr_in *)(sa + 1))->sin_port;
2597	if (sel.sport)
2598	sel.sport_mask = htons(0xffff);
2599
2600	/* set destination address info of selector */
2601	sa = ext_hdrs[SADB_EXT_ADDRESS_DST - 1];
2602	pfkey_sadb_addr2xfrm_addr(addr: sa, xaddr: &sel.daddr);
2603	sel.prefixlen_d = sa->sadb_address_prefixlen;
2604	sel.proto = pfkey_proto_to_xfrm(proto: sa->sadb_address_proto);
2605	sel.dport = ((struct sockaddr_in *)(sa + 1))->sin_port;
2606	if (sel.dport)
2607	sel.dport_mask = htons(0xffff);
2608
2609	rq = (struct sadb_x_ipsecrequest *)(pol + 1);
2610
2611	/* extract ipsecrequests */
2612	i = 0;
2613	len = pol->sadb_x_policy_len * 8 - sizeof(struct sadb_x_policy);
2614
2615	while (len > 0 && i < XFRM_MAX_DEPTH) {
2616	ret = ipsecrequests_to_migrate(rq1: rq, len, m: &m[i]);
2617	if (ret < 0) {
2618	err = ret;
2619	goto out;
2620	} else {
2621	rq = (struct sadb_x_ipsecrequest *)((u8 *)rq + ret);
2622	len -= ret;
2623	i++;
2624	}
2625	}
2626
2627	if (!i || len > 0) {
2628	err = -EINVAL;
2629	goto out;
2630	}
2631
2632	return xfrm_migrate(sel: &sel, dir, type: XFRM_POLICY_TYPE_MAIN, m, num_bundles: i,
2633	k: kma ? &k : NULL, net, NULL, if_id: 0, NULL, NULL);
2634
2635	out:
2636	return err;
2637	}
2638	#else
2639	static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
2640	const struct sadb_msg *hdr, void * const *ext_hdrs)
2641	{
2642	return -ENOPROTOOPT;
2643	}
2644	#endif
2645
2646
2647	static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
2648	{
2649	struct net *net = sock_net(sk);
2650	unsigned int dir;
2651	int err = 0, delete;
2652	struct sadb_x_policy *pol;
2653	struct xfrm_policy *xp;
2654	struct km_event c;
2655
2656	if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL)
2657	return -EINVAL;
2658
2659	dir = xfrm_policy_id2dir(index: pol->sadb_x_policy_id);
2660	if (dir >= XFRM_POLICY_MAX)
2661	return -EINVAL;
2662
2663	delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
2664	xp = xfrm_policy_byid(net, mark: &dummy_mark, if_id: 0, type: XFRM_POLICY_TYPE_MAIN,
2665	dir, id: pol->sadb_x_policy_id, delete, err: &err);
2666	if (xp == NULL)
2667	return -ENOENT;
2668
2669	if (delete) {
2670	xfrm_audit_policy_delete(xp, result: err ? 0 : 1, task_valid: true);
2671
2672	if (err)
2673	goto out;
2674	c.seq = hdr->sadb_msg_seq;
2675	c.portid = hdr->sadb_msg_pid;
2676	c.data.byid = 1;
2677	c.event = XFRM_MSG_DELPOLICY;
2678	km_policy_notify(xp, dir, c: &c);
2679	} else {
2680	err = key_pol_get_resp(sk, xp, hdr, dir);
2681	}
2682
2683	out:
2684	xfrm_pol_put(policy: xp);
2685	return err;
2686	}
2687
2688	static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
2689	{
2690	struct pfkey_sock *pfk = ptr;
2691	struct sk_buff *out_skb;
2692	struct sadb_msg *out_hdr;
2693	int err;
2694
2695	if (!pfkey_can_dump(sk: &pfk->sk))
2696	return -ENOBUFS;
2697
2698	out_skb = pfkey_xfrm_policy2msg_prep(xp);
2699	if (IS_ERR(ptr: out_skb))
2700	return PTR_ERR(ptr: out_skb);
2701
2702	err = pfkey_xfrm_policy2msg(skb: out_skb, xp, dir);
2703	if (err < 0) {
2704	kfree_skb(skb: out_skb);
2705	return err;
2706	}
2707
2708	out_hdr = (struct sadb_msg *) out_skb->data;
2709	out_hdr->sadb_msg_version = pfk->dump.msg_version;
2710	out_hdr->sadb_msg_type = SADB_X_SPDDUMP;
2711	out_hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
2712	out_hdr->sadb_msg_errno = 0;
2713	out_hdr->sadb_msg_seq = count + 1;
2714	out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
2715
2716	if (pfk->dump.skb)
2717	pfkey_broadcast(skb: pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
2718	one_sk: &pfk->sk, net: sock_net(sk: &pfk->sk));
2719	pfk->dump.skb = out_skb;
2720
2721	return 0;
2722	}
2723
2724	static int pfkey_dump_sp(struct pfkey_sock *pfk)
2725	{
2726	struct net *net = sock_net(sk: &pfk->sk);
2727	return xfrm_policy_walk(net, walk: &pfk->dump.u.policy, func: dump_sp, (void *) pfk);
2728	}
2729
2730	static void pfkey_dump_sp_done(struct pfkey_sock *pfk)
2731	{
2732	struct net *net = sock_net(sk: (struct sock *)pfk);
2733
2734	xfrm_policy_walk_done(walk: &pfk->dump.u.policy, net);
2735	}
2736
2737	static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
2738	{
2739	struct pfkey_sock *pfk = pfkey_sk(sk);
2740
2741	mutex_lock(&pfk->dump_lock);
2742	if (pfk->dump.dump != NULL) {
2743	mutex_unlock(lock: &pfk->dump_lock);
2744	return -EBUSY;
2745	}
2746
2747	pfk->dump.msg_version = hdr->sadb_msg_version;
2748	pfk->dump.msg_portid = hdr->sadb_msg_pid;
2749	pfk->dump.dump = pfkey_dump_sp;
2750	pfk->dump.done = pfkey_dump_sp_done;
2751	xfrm_policy_walk_init(walk: &pfk->dump.u.policy, type: XFRM_POLICY_TYPE_MAIN);
2752	mutex_unlock(lock: &pfk->dump_lock);
2753
2754	return pfkey_do_dump(pfk);
2755	}
2756
2757	static int key_notify_policy_flush(const struct km_event *c)
2758	{
2759	struct sk_buff *skb_out;
2760	struct sadb_msg *hdr;
2761
2762	skb_out = alloc_skb(size: sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
2763	if (!skb_out)
2764	return -ENOBUFS;
2765	hdr = skb_put(skb: skb_out, len: sizeof(struct sadb_msg));
2766	hdr->sadb_msg_type = SADB_X_SPDFLUSH;
2767	hdr->sadb_msg_seq = c->seq;
2768	hdr->sadb_msg_pid = c->portid;
2769	hdr->sadb_msg_version = PF_KEY_V2;
2770	hdr->sadb_msg_errno = (uint8_t) 0;
2771	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
2772	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
2773	hdr->sadb_msg_reserved = 0;
2774	pfkey_broadcast(skb: skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, net: c->net);
2775	return 0;
2776
2777	}
2778
2779	static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
2780	{
2781	struct net *net = sock_net(sk);
2782	struct km_event c;
2783	int err, err2;
2784
2785	err = xfrm_policy_flush(net, type: XFRM_POLICY_TYPE_MAIN, task_valid: true);
2786	err2 = unicast_flush_resp(sk, ihdr: hdr);
2787	if (err || err2) {
2788	if (err == -ESRCH) /* empty table - old silent behavior */
2789	return 0;
2790	return err;
2791	}
2792
2793	c.data.type = XFRM_POLICY_TYPE_MAIN;
2794	c.event = XFRM_MSG_FLUSHPOLICY;
2795	c.portid = hdr->sadb_msg_pid;
2796	c.seq = hdr->sadb_msg_seq;
2797	c.net = net;
2798	km_policy_notify(NULL, dir: 0, c: &c);
2799
2800	return 0;
2801	}
2802
2803	typedef int (*pfkey_handler)(struct sock *sk, struct sk_buff *skb,
2804	const struct sadb_msg *hdr, void * const *ext_hdrs);
2805	static const pfkey_handler pfkey_funcs[SADB_MAX + 1] = {
2806	[SADB_RESERVED] = pfkey_reserved,
2807	[SADB_GETSPI] = pfkey_getspi,
2808	[SADB_UPDATE] = pfkey_add,
2809	[SADB_ADD] = pfkey_add,
2810	[SADB_DELETE] = pfkey_delete,
2811	[SADB_GET] = pfkey_get,
2812	[SADB_ACQUIRE] = pfkey_acquire,
2813	[SADB_REGISTER] = pfkey_register,
2814	[SADB_EXPIRE] = NULL,
2815	[SADB_FLUSH] = pfkey_flush,
2816	[SADB_DUMP] = pfkey_dump,
2817	[SADB_X_PROMISC] = pfkey_promisc,
2818	[SADB_X_PCHANGE] = NULL,
2819	[SADB_X_SPDUPDATE] = pfkey_spdadd,
2820	[SADB_X_SPDADD] = pfkey_spdadd,
2821	[SADB_X_SPDDELETE] = pfkey_spddelete,
2822	[SADB_X_SPDGET] = pfkey_spdget,
2823	[SADB_X_SPDACQUIRE] = NULL,
2824	[SADB_X_SPDDUMP] = pfkey_spddump,
2825	[SADB_X_SPDFLUSH] = pfkey_spdflush,
2826	[SADB_X_SPDSETIDX] = pfkey_spdadd,
2827	[SADB_X_SPDDELETE2] = pfkey_spdget,
2828	[SADB_X_MIGRATE] = pfkey_migrate,
2829	};
2830
2831	static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr)
2832	{
2833	void *ext_hdrs[SADB_EXT_MAX];
2834	int err;
2835
2836	/* Non-zero return value of pfkey_broadcast() does not always signal
2837	* an error and even on an actual error we may still want to process
2838	* the message so rather ignore the return value.
2839	*/
2840	pfkey_broadcast(skb: skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
2841	BROADCAST_PROMISC_ONLY, NULL, net: sock_net(sk));
2842
2843	memset(ext_hdrs, 0, sizeof(ext_hdrs));
2844	err = parse_exthdrs(skb, hdr, ext_hdrs);
2845	if (!err) {
2846	err = -EOPNOTSUPP;
2847	if (pfkey_funcs[hdr->sadb_msg_type])
2848	err = pfkey_funcs[hdr->sadb_msg_type](sk, skb, hdr, ext_hdrs);
2849	}
2850	return err;
2851	}
2852
2853	static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp)
2854	{
2855	struct sadb_msg *hdr = NULL;
2856
2857	if (skb->len < sizeof(*hdr)) {
2858	*errp = -EMSGSIZE;
2859	} else {
2860	hdr = (struct sadb_msg *) skb->data;
2861	if (hdr->sadb_msg_version != PF_KEY_V2 ||
2862	hdr->sadb_msg_reserved != 0 ||
2863	(hdr->sadb_msg_type <= SADB_RESERVED ||
2864	hdr->sadb_msg_type > SADB_MAX)) {
2865	hdr = NULL;
2866	*errp = -EINVAL;
2867	} else if (hdr->sadb_msg_len != (skb->len /
2868	sizeof(uint64_t)) ||
2869	hdr->sadb_msg_len < (sizeof(struct sadb_msg) /
2870	sizeof(uint64_t))) {
2871	hdr = NULL;
2872	*errp = -EMSGSIZE;
2873	} else {
2874	*errp = 0;
2875	}
2876	}
2877	return hdr;
2878	}
2879
2880	static inline int aalg_tmpl_set(const struct xfrm_tmpl *t,
2881	const struct xfrm_algo_desc *d)
2882	{
2883	unsigned int id = d->desc.sadb_alg_id;
2884
2885	if (id >= sizeof(t->aalgos) * 8)
2886	return 0;
2887
2888	return (t->aalgos >> id) & 1;
2889	}
2890
2891	static inline int ealg_tmpl_set(const struct xfrm_tmpl *t,
2892	const struct xfrm_algo_desc *d)
2893	{
2894	unsigned int id = d->desc.sadb_alg_id;
2895
2896	if (id >= sizeof(t->ealgos) * 8)
2897	return 0;
2898
2899	return (t->ealgos >> id) & 1;
2900	}
2901
2902	static int count_ah_combs(const struct xfrm_tmpl *t)
2903	{
2904	int i, sz = 0;
2905
2906	for (i = 0; ; i++) {
2907	const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(idx: i);
2908	if (!aalg)
2909	break;
2910	if (!aalg->pfkey_supported)
2911	continue;
2912	if (aalg_tmpl_set(t, d: aalg))
2913	sz += sizeof(struct sadb_comb);
2914	}
2915	return sz + sizeof(struct sadb_prop);
2916	}
2917
2918	static int count_esp_combs(const struct xfrm_tmpl *t)
2919	{
2920	int i, k, sz = 0;
2921
2922	for (i = 0; ; i++) {
2923	const struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(idx: i);
2924	if (!ealg)
2925	break;
2926
2927	if (!ealg->pfkey_supported)
2928	continue;
2929
2930	if (!(ealg_tmpl_set(t, d: ealg)))
2931	continue;
2932
2933	for (k = 1; ; k++) {
2934	const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(idx: k);
2935	if (!aalg)
2936	break;
2937
2938	if (!aalg->pfkey_supported)
2939	continue;
2940
2941	if (aalg_tmpl_set(t, d: aalg))
2942	sz += sizeof(struct sadb_comb);
2943	}
2944	}
2945	return sz + sizeof(struct sadb_prop);
2946	}
2947
2948	static int dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
2949	{
2950	struct sadb_prop *p;
2951	int sz = 0;
2952	int i;
2953
2954	p = skb_put(skb, len: sizeof(struct sadb_prop));
2955	p->sadb_prop_len = sizeof(struct sadb_prop)/8;
2956	p->sadb_prop_exttype = SADB_EXT_PROPOSAL;
2957	p->sadb_prop_replay = 32;
2958	memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved));
2959
2960	for (i = 0; ; i++) {
2961	const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(idx: i);
2962	if (!aalg)
2963	break;
2964
2965	if (!aalg->pfkey_supported)
2966	continue;
2967
2968	if (aalg_tmpl_set(t, d: aalg) && aalg->available) {
2969	struct sadb_comb *c;
2970	c = skb_put_zero(skb, len: sizeof(struct sadb_comb));
2971	p->sadb_prop_len += sizeof(struct sadb_comb)/8;
2972	c->sadb_comb_auth = aalg->desc.sadb_alg_id;
2973	c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits;
2974	c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits;
2975	c->sadb_comb_hard_addtime = 24*60*60;
2976	c->sadb_comb_soft_addtime = 20*60*60;
2977	c->sadb_comb_hard_usetime = 8*60*60;
2978	c->sadb_comb_soft_usetime = 7*60*60;
2979	sz += sizeof(*c);
2980	}
2981	}
2982
2983	return sz + sizeof(*p);
2984	}
2985
2986	static int dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
2987	{
2988	struct sadb_prop *p;
2989	int sz = 0;
2990	int i, k;
2991
2992	p = skb_put(skb, len: sizeof(struct sadb_prop));
2993	p->sadb_prop_len = sizeof(struct sadb_prop)/8;
2994	p->sadb_prop_exttype = SADB_EXT_PROPOSAL;
2995	p->sadb_prop_replay = 32;
2996	memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved));
2997
2998	for (i=0; ; i++) {
2999	const struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(idx: i);
3000	if (!ealg)
3001	break;
3002
3003	if (!ealg->pfkey_supported)
3004	continue;
3005
3006	if (!(ealg_tmpl_set(t, d: ealg) && ealg->available))
3007	continue;
3008
3009	for (k = 1; ; k++) {
3010	struct sadb_comb *c;
3011	const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(idx: k);
3012	if (!aalg)
3013	break;
3014	if (!aalg->pfkey_supported)
3015	continue;
3016	if (!(aalg_tmpl_set(t, d: aalg) && aalg->available))
3017	continue;
3018	c = skb_put(skb, len: sizeof(struct sadb_comb));
3019	memset(c, 0, sizeof(*c));
3020	p->sadb_prop_len += sizeof(struct sadb_comb)/8;
3021	c->sadb_comb_auth = aalg->desc.sadb_alg_id;
3022	c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits;
3023	c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits;
3024	c->sadb_comb_encrypt = ealg->desc.sadb_alg_id;
3025	c->sadb_comb_encrypt_minbits = ealg->desc.sadb_alg_minbits;
3026	c->sadb_comb_encrypt_maxbits = ealg->desc.sadb_alg_maxbits;
3027	c->sadb_comb_hard_addtime = 24*60*60;
3028	c->sadb_comb_soft_addtime = 20*60*60;
3029	c->sadb_comb_hard_usetime = 8*60*60;
3030	c->sadb_comb_soft_usetime = 7*60*60;
3031	sz += sizeof(*c);
3032	}
3033	}
3034
3035	return sz + sizeof(*p);
3036	}
3037
3038	static int key_notify_policy_expire(struct xfrm_policy *xp, const struct km_event *c)
3039	{
3040	return 0;
3041	}
3042
3043	static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
3044	{
3045	struct sk_buff *out_skb;
3046	struct sadb_msg *out_hdr;
3047	int hard;
3048	int hsc;
3049
3050	hard = c->data.hard;
3051	if (hard)
3052	hsc = 2;
3053	else
3054	hsc = 1;
3055
3056	out_skb = pfkey_xfrm_state2msg_expire(x, hsc);
3057	if (IS_ERR(ptr: out_skb))
3058	return PTR_ERR(ptr: out_skb);
3059
3060	out_hdr = (struct sadb_msg *) out_skb->data;
3061	out_hdr->sadb_msg_version = PF_KEY_V2;
3062	out_hdr->sadb_msg_type = SADB_EXPIRE;
3063	out_hdr->sadb_msg_satype = pfkey_proto2satype(proto: x->id.proto);
3064	out_hdr->sadb_msg_errno = 0;
3065	out_hdr->sadb_msg_reserved = 0;
3066	out_hdr->sadb_msg_seq = 0;
3067	out_hdr->sadb_msg_pid = 0;
3068
3069	pfkey_broadcast(skb: out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
3070	net: xs_net(x));
3071	return 0;
3072	}
3073
3074	static int pfkey_send_notify(struct xfrm_state *x, const struct km_event *c)
3075	{
3076	struct net *net = x ? xs_net(x) : c->net;
3077	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
3078
3079	if (atomic_read(v: &net_pfkey->socks_nr) == 0)
3080	return 0;
3081
3082	switch (c->event) {
3083	case XFRM_MSG_EXPIRE:
3084	return key_notify_sa_expire(x, c);
3085	case XFRM_MSG_DELSA:
3086	case XFRM_MSG_NEWSA:
3087	case XFRM_MSG_UPDSA:
3088	return key_notify_sa(x, c);
3089	case XFRM_MSG_FLUSHSA:
3090	return key_notify_sa_flush(c);
3091	case XFRM_MSG_NEWAE: /* not yet supported */
3092	break;
3093	default:
3094	pr_err("pfkey: Unknown SA event %d\n", c->event);
3095	break;
3096	}
3097
3098	return 0;
3099	}
3100
3101	static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
3102	{
3103	if (xp && xp->type != XFRM_POLICY_TYPE_MAIN)
3104	return 0;
3105
3106	switch (c->event) {
3107	case XFRM_MSG_POLEXPIRE:
3108	return key_notify_policy_expire(xp, c);
3109	case XFRM_MSG_DELPOLICY:
3110	case XFRM_MSG_NEWPOLICY:
3111	case XFRM_MSG_UPDPOLICY:
3112	return key_notify_policy(xp, dir, c);
3113	case XFRM_MSG_FLUSHPOLICY:
3114	if (c->data.type != XFRM_POLICY_TYPE_MAIN)
3115	break;
3116	return key_notify_policy_flush(c);
3117	default:
3118	pr_err("pfkey: Unknown policy event %d\n", c->event);
3119	break;
3120	}
3121
3122	return 0;
3123	}
3124
3125	static u32 get_acqseq(void)
3126	{
3127	u32 res;
3128	static atomic_t acqseq;
3129
3130	do {
3131	res = atomic_inc_return(v: &acqseq);
3132	} while (!res);
3133	return res;
3134	}
3135
3136	static bool pfkey_is_alive(const struct km_event *c)
3137	{
3138	struct netns_pfkey *net_pfkey = net_generic(net: c->net, id: pfkey_net_id);
3139	struct sock *sk;
3140	bool is_alive = false;
3141
3142	rcu_read_lock();
3143	sk_for_each_rcu(sk, &net_pfkey->table) {
3144	if (pfkey_sk(sk)->registered) {
3145	is_alive = true;
3146	break;
3147	}
3148	}
3149	rcu_read_unlock();
3150
3151	return is_alive;
3152	}
3153
3154	static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp)
3155	{
3156	struct sk_buff *skb;
3157	struct sadb_msg *hdr;
3158	struct sadb_address *addr;
3159	struct sadb_x_policy *pol;
3160	int sockaddr_size;
3161	int size;
3162	struct sadb_x_sec_ctx *sec_ctx;
3163	struct xfrm_sec_ctx *xfrm_ctx;
3164	int ctx_size = 0;
3165	int alg_size = 0;
3166
3167	sockaddr_size = pfkey_sockaddr_size(family: x->props.family);
3168	if (!sockaddr_size)
3169	return -EINVAL;
3170
3171	size = sizeof(struct sadb_msg) +
3172	(sizeof(struct sadb_address) * 2) +
3173	(sockaddr_size * 2) +
3174	sizeof(struct sadb_x_policy);
3175
3176	if (x->id.proto == IPPROTO_AH)
3177	alg_size = count_ah_combs(t);
3178	else if (x->id.proto == IPPROTO_ESP)
3179	alg_size = count_esp_combs(t);
3180
3181	if ((xfrm_ctx = x->security)) {
3182	ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
3183	size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
3184	}
3185
3186	skb = alloc_skb(size: size + alg_size + 16, GFP_ATOMIC);
3187	if (skb == NULL)
3188	return -ENOMEM;
3189
3190	hdr = skb_put(skb, len: sizeof(struct sadb_msg));
3191	hdr->sadb_msg_version = PF_KEY_V2;
3192	hdr->sadb_msg_type = SADB_ACQUIRE;
3193	hdr->sadb_msg_satype = pfkey_proto2satype(proto: x->id.proto);
3194	hdr->sadb_msg_len = size / sizeof(uint64_t);
3195	hdr->sadb_msg_errno = 0;
3196	hdr->sadb_msg_reserved = 0;
3197	hdr->sadb_msg_seq = x->km.seq = get_acqseq();
3198	hdr->sadb_msg_pid = 0;
3199
3200	/* src address */
3201	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
3202	addr->sadb_address_len =
3203	(sizeof(struct sadb_address)+sockaddr_size)/
3204	sizeof(uint64_t);
3205	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
3206	addr->sadb_address_proto = 0;
3207	addr->sadb_address_reserved = 0;
3208	addr->sadb_address_prefixlen =
3209	pfkey_sockaddr_fill(xaddr: &x->props.saddr, port: 0,
3210	sa: (struct sockaddr *) (addr + 1),
3211	family: x->props.family);
3212	if (!addr->sadb_address_prefixlen)
3213	BUG();
3214
3215	/* dst address */
3216	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
3217	addr->sadb_address_len =
3218	(sizeof(struct sadb_address)+sockaddr_size)/
3219	sizeof(uint64_t);
3220	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
3221	addr->sadb_address_proto = 0;
3222	addr->sadb_address_reserved = 0;
3223	addr->sadb_address_prefixlen =
3224	pfkey_sockaddr_fill(xaddr: &x->id.daddr, port: 0,
3225	sa: (struct sockaddr *) (addr + 1),
3226	family: x->props.family);
3227	if (!addr->sadb_address_prefixlen)
3228	BUG();
3229
3230	pol = skb_put(skb, len: sizeof(struct sadb_x_policy));
3231	pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t);
3232	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
3233	pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
3234	pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
3235	pol->sadb_x_policy_reserved = 0;
3236	pol->sadb_x_policy_id = xp->index;
3237	pol->sadb_x_policy_priority = xp->priority;
3238
3239	/* Set sadb_comb's. */
3240	alg_size = 0;
3241	if (x->id.proto == IPPROTO_AH)
3242	alg_size = dump_ah_combs(skb, t);
3243	else if (x->id.proto == IPPROTO_ESP)
3244	alg_size = dump_esp_combs(skb, t);
3245
3246	hdr->sadb_msg_len += alg_size / 8;
3247
3248	/* security context */
3249	if (xfrm_ctx) {
3250	sec_ctx = skb_put(skb,
3251	len: sizeof(struct sadb_x_sec_ctx) + ctx_size);
3252	sec_ctx->sadb_x_sec_len =
3253	(sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
3254	sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
3255	sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
3256	sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
3257	sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
3258	memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
3259	xfrm_ctx->ctx_len);
3260	}
3261
3262	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
3263	net: xs_net(x));
3264	}
3265
3266	static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
3267	u8 *data, int len, int *dir)
3268	{
3269	struct net *net = sock_net(sk);
3270	struct xfrm_policy *xp;
3271	struct sadb_x_policy *pol = (struct sadb_x_policy*)data;
3272	struct sadb_x_sec_ctx *sec_ctx;
3273
3274	switch (sk->sk_family) {
3275	case AF_INET:
3276	if (opt != IP_IPSEC_POLICY) {
3277	*dir = -EOPNOTSUPP;
3278	return NULL;
3279	}
3280	break;
3281	#if IS_ENABLED(CONFIG_IPV6)
3282	case AF_INET6:
3283	if (opt != IPV6_IPSEC_POLICY) {
3284	*dir = -EOPNOTSUPP;
3285	return NULL;
3286	}
3287	break;
3288	#endif
3289	default:
3290	*dir = -EINVAL;
3291	return NULL;
3292	}
3293
3294	*dir = -EINVAL;
3295
3296	if (len < sizeof(struct sadb_x_policy) ||
3297	pol->sadb_x_policy_len*8 > len ||
3298	pol->sadb_x_policy_type > IPSEC_POLICY_BYPASS ||
3299	(!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir > IPSEC_DIR_OUTBOUND))
3300	return NULL;
3301
3302	xp = xfrm_policy_alloc(net, GFP_ATOMIC);
3303	if (xp == NULL) {
3304	*dir = -ENOBUFS;
3305	return NULL;
3306	}
3307
3308	xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ?
3309	XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);
3310
3311	xp->lft.soft_byte_limit = XFRM_INF;
3312	xp->lft.hard_byte_limit = XFRM_INF;
3313	xp->lft.soft_packet_limit = XFRM_INF;
3314	xp->lft.hard_packet_limit = XFRM_INF;
3315	xp->family = sk->sk_family;
3316
3317	xp->xfrm_nr = 0;
3318	if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
3319	(*dir = parse_ipsecrequests(xp, pol)) < 0)
3320	goto out;
3321
3322	/* security context too */
3323	if (len >= (pol->sadb_x_policy_len*8 +
3324	sizeof(struct sadb_x_sec_ctx))) {
3325	char *p = (char *)pol;
3326	struct xfrm_user_sec_ctx *uctx;
3327
3328	p += pol->sadb_x_policy_len*8;
3329	sec_ctx = (struct sadb_x_sec_ctx *)p;
3330	if (len < pol->sadb_x_policy_len*8 +
3331	sec_ctx->sadb_x_sec_len*8) {
3332	*dir = -EINVAL;
3333	goto out;
3334	}
3335	if ((*dir = verify_sec_ctx_len(p)))
3336	goto out;
3337	uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_ATOMIC);
3338	*dir = security_xfrm_policy_alloc(ctxp: &xp->security, sec_ctx: uctx, GFP_ATOMIC);
3339	kfree(objp: uctx);
3340
3341	if (*dir)
3342	goto out;
3343	}
3344
3345	*dir = pol->sadb_x_policy_dir-1;
3346	return xp;
3347
3348	out:
3349	xp->walk.dead = 1;
3350	xfrm_policy_destroy(policy: xp);
3351	return NULL;
3352	}
3353
3354	static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
3355	{
3356	struct sk_buff *skb;
3357	struct sadb_msg *hdr;
3358	struct sadb_sa *sa;
3359	struct sadb_address *addr;
3360	struct sadb_x_nat_t_port *n_port;
3361	int sockaddr_size;
3362	int size;
3363	__u8 satype = (x->id.proto == IPPROTO_ESP ? SADB_SATYPE_ESP : 0);
3364	struct xfrm_encap_tmpl *natt = NULL;
3365
3366	sockaddr_size = pfkey_sockaddr_size(family: x->props.family);
3367	if (!sockaddr_size)
3368	return -EINVAL;
3369
3370	if (!satype)
3371	return -EINVAL;
3372
3373	if (!x->encap)
3374	return -EINVAL;
3375
3376	natt = x->encap;
3377
3378	/* Build an SADB_X_NAT_T_NEW_MAPPING message:
3379	*
3380	* HDR | SA | ADDRESS_SRC (old addr) | NAT_T_SPORT (old port) |
3381	* ADDRESS_DST (new addr) | NAT_T_DPORT (new port)
3382	*/
3383
3384	size = sizeof(struct sadb_msg) +
3385	sizeof(struct sadb_sa) +
3386	(sizeof(struct sadb_address) * 2) +
3387	(sockaddr_size * 2) +
3388	(sizeof(struct sadb_x_nat_t_port) * 2);
3389
3390	skb = alloc_skb(size: size + 16, GFP_ATOMIC);
3391	if (skb == NULL)
3392	return -ENOMEM;
3393
3394	hdr = skb_put(skb, len: sizeof(struct sadb_msg));
3395	hdr->sadb_msg_version = PF_KEY_V2;
3396	hdr->sadb_msg_type = SADB_X_NAT_T_NEW_MAPPING;
3397	hdr->sadb_msg_satype = satype;
3398	hdr->sadb_msg_len = size / sizeof(uint64_t);
3399	hdr->sadb_msg_errno = 0;
3400	hdr->sadb_msg_reserved = 0;
3401	hdr->sadb_msg_seq = x->km.seq;
3402	hdr->sadb_msg_pid = 0;
3403
3404	/* SA */
3405	sa = skb_put(skb, len: sizeof(struct sadb_sa));
3406	sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t);
3407	sa->sadb_sa_exttype = SADB_EXT_SA;
3408	sa->sadb_sa_spi = x->id.spi;
3409	sa->sadb_sa_replay = 0;
3410	sa->sadb_sa_state = 0;
3411	sa->sadb_sa_auth = 0;
3412	sa->sadb_sa_encrypt = 0;
3413	sa->sadb_sa_flags = 0;
3414
3415	/* ADDRESS_SRC (old addr) */
3416	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
3417	addr->sadb_address_len =
3418	(sizeof(struct sadb_address)+sockaddr_size)/
3419	sizeof(uint64_t);
3420	addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
3421	addr->sadb_address_proto = 0;
3422	addr->sadb_address_reserved = 0;
3423	addr->sadb_address_prefixlen =
3424	pfkey_sockaddr_fill(xaddr: &x->props.saddr, port: 0,
3425	sa: (struct sockaddr *) (addr + 1),
3426	family: x->props.family);
3427	if (!addr->sadb_address_prefixlen)
3428	BUG();
3429
3430	/* NAT_T_SPORT (old port) */
3431	n_port = skb_put(skb, len: sizeof(*n_port));
3432	n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
3433	n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
3434	n_port->sadb_x_nat_t_port_port = natt->encap_sport;
3435	n_port->sadb_x_nat_t_port_reserved = 0;
3436
3437	/* ADDRESS_DST (new addr) */
3438	addr = skb_put(skb, len: sizeof(struct sadb_address) + sockaddr_size);
3439	addr->sadb_address_len =
3440	(sizeof(struct sadb_address)+sockaddr_size)/
3441	sizeof(uint64_t);
3442	addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
3443	addr->sadb_address_proto = 0;
3444	addr->sadb_address_reserved = 0;
3445	addr->sadb_address_prefixlen =
3446	pfkey_sockaddr_fill(xaddr: ipaddr, port: 0,
3447	sa: (struct sockaddr *) (addr + 1),
3448	family: x->props.family);
3449	if (!addr->sadb_address_prefixlen)
3450	BUG();
3451
3452	/* NAT_T_DPORT (new port) */
3453	n_port = skb_put(skb, len: sizeof(*n_port));
3454	n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
3455	n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
3456	n_port->sadb_x_nat_t_port_port = sport;
3457	n_port->sadb_x_nat_t_port_reserved = 0;
3458
3459	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
3460	net: xs_net(x));
3461	}
3462
3463	#ifdef CONFIG_NET_KEY_MIGRATE
3464	static int set_sadb_address(struct sk_buff *skb, int sasize, int type,
3465	const struct xfrm_selector *sel)
3466	{
3467	struct sadb_address *addr;
3468	addr = skb_put(skb, len: sizeof(struct sadb_address) + sasize);
3469	addr->sadb_address_len = (sizeof(struct sadb_address) + sasize)/8;
3470	addr->sadb_address_exttype = type;
3471	addr->sadb_address_proto = sel->proto;
3472	addr->sadb_address_reserved = 0;
3473
3474	switch (type) {
3475	case SADB_EXT_ADDRESS_SRC:
3476	addr->sadb_address_prefixlen = sel->prefixlen_s;
3477	pfkey_sockaddr_fill(xaddr: &sel->saddr, port: 0,
3478	sa: (struct sockaddr *)(addr + 1),
3479	family: sel->family);
3480	break;
3481	case SADB_EXT_ADDRESS_DST:
3482	addr->sadb_address_prefixlen = sel->prefixlen_d;
3483	pfkey_sockaddr_fill(xaddr: &sel->daddr, port: 0,
3484	sa: (struct sockaddr *)(addr + 1),
3485	family: sel->family);
3486	break;
3487	default:
3488	return -EINVAL;
3489	}
3490
3491	return 0;
3492	}
3493
3494
3495	static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *k)
3496	{
3497	struct sadb_x_kmaddress *kma;
3498	u8 *sa;
3499	int family = k->family;
3500	int socklen = pfkey_sockaddr_len(family);
3501	int size_req;
3502
3503	size_req = (sizeof(struct sadb_x_kmaddress) +
3504	pfkey_sockaddr_pair_size(family));
3505
3506	kma = skb_put_zero(skb, len: size_req);
3507	kma->sadb_x_kmaddress_len = size_req / 8;
3508	kma->sadb_x_kmaddress_exttype = SADB_X_EXT_KMADDRESS;
3509	kma->sadb_x_kmaddress_reserved = k->reserved;
3510
3511	sa = (u8 *)(kma + 1);
3512	if (!pfkey_sockaddr_fill(xaddr: &k->local, port: 0, sa: (struct sockaddr *)sa, family) ||
3513	!pfkey_sockaddr_fill(xaddr: &k->remote, port: 0, sa: (struct sockaddr *)(sa+socklen), family))
3514	return -EINVAL;
3515
3516	return 0;
3517	}
3518
3519	static int set_ipsecrequest(struct sk_buff *skb,
3520	uint8_t proto, uint8_t mode, int level,
3521	uint32_t reqid, uint8_t family,
3522	const xfrm_address_t *src, const xfrm_address_t *dst)
3523	{
3524	struct sadb_x_ipsecrequest *rq;
3525	u8 *sa;
3526	int socklen = pfkey_sockaddr_len(family);
3527	int size_req;
3528
3529	size_req = sizeof(struct sadb_x_ipsecrequest) +
3530	pfkey_sockaddr_pair_size(family);
3531
3532	rq = skb_put_zero(skb, len: size_req);
3533	rq->sadb_x_ipsecrequest_len = size_req;
3534	rq->sadb_x_ipsecrequest_proto = proto;
3535	rq->sadb_x_ipsecrequest_mode = mode;
3536	rq->sadb_x_ipsecrequest_level = level;
3537	rq->sadb_x_ipsecrequest_reqid = reqid;
3538
3539	sa = (u8 *) (rq + 1);
3540	if (!pfkey_sockaddr_fill(xaddr: src, port: 0, sa: (struct sockaddr *)sa, family) ||
3541	!pfkey_sockaddr_fill(xaddr: dst, port: 0, sa: (struct sockaddr *)(sa + socklen), family))
3542	return -EINVAL;
3543
3544	return 0;
3545	}
3546	#endif
3547
3548	#ifdef CONFIG_NET_KEY_MIGRATE
3549	static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
3550	const struct xfrm_migrate *m, int num_bundles,
3551	const struct xfrm_kmaddress *k,
3552	const struct xfrm_encap_tmpl *encap)
3553	{
3554	int i;
3555	int sasize_sel;
3556	int size = 0;
3557	int size_pol = 0;
3558	struct sk_buff *skb;
3559	struct sadb_msg *hdr;
3560	struct sadb_x_policy *pol;
3561	const struct xfrm_migrate *mp;
3562
3563	if (type != XFRM_POLICY_TYPE_MAIN)
3564	return 0;
3565
3566	if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH)
3567	return -EINVAL;
3568
3569	if (k != NULL) {
3570	/* addresses for KM */
3571	size += PFKEY_ALIGN8(sizeof(struct sadb_x_kmaddress) +
3572	pfkey_sockaddr_pair_size(k->family));
3573	}
3574
3575	/* selector */
3576	sasize_sel = pfkey_sockaddr_size(family: sel->family);
3577	if (!sasize_sel)
3578	return -EINVAL;
3579	size += (sizeof(struct sadb_address) + sasize_sel) * 2;
3580
3581	/* policy info */
3582	size_pol += sizeof(struct sadb_x_policy);
3583
3584	/* ipsecrequests */
3585	for (i = 0, mp = m; i < num_bundles; i++, mp++) {
3586	/* old locator pair */
3587	size_pol += sizeof(struct sadb_x_ipsecrequest) +
3588	pfkey_sockaddr_pair_size(family: mp->old_family);
3589	/* new locator pair */
3590	size_pol += sizeof(struct sadb_x_ipsecrequest) +
3591	pfkey_sockaddr_pair_size(family: mp->new_family);
3592	}
3593
3594	size += sizeof(struct sadb_msg) + size_pol;
3595
3596	/* alloc buffer */
3597	skb = alloc_skb(size, GFP_ATOMIC);
3598	if (skb == NULL)
3599	return -ENOMEM;
3600
3601	hdr = skb_put(skb, len: sizeof(struct sadb_msg));
3602	hdr->sadb_msg_version = PF_KEY_V2;
3603	hdr->sadb_msg_type = SADB_X_MIGRATE;
3604	hdr->sadb_msg_satype = pfkey_proto2satype(proto: m->proto);
3605	hdr->sadb_msg_len = size / 8;
3606	hdr->sadb_msg_errno = 0;
3607	hdr->sadb_msg_reserved = 0;
3608	hdr->sadb_msg_seq = 0;
3609	hdr->sadb_msg_pid = 0;
3610
3611	/* Addresses to be used by KM for negotiation, if ext is available */
3612	if (k != NULL && (set_sadb_kmaddress(skb, k) < 0))
3613	goto err;
3614
3615	/* selector src */
3616	set_sadb_address(skb, sasize: sasize_sel, SADB_EXT_ADDRESS_SRC, sel);
3617
3618	/* selector dst */
3619	set_sadb_address(skb, sasize: sasize_sel, SADB_EXT_ADDRESS_DST, sel);
3620
3621	/* policy information */
3622	pol = skb_put(skb, len: sizeof(struct sadb_x_policy));
3623	pol->sadb_x_policy_len = size_pol / 8;
3624	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
3625	pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
3626	pol->sadb_x_policy_dir = dir + 1;
3627	pol->sadb_x_policy_reserved = 0;
3628	pol->sadb_x_policy_id = 0;
3629	pol->sadb_x_policy_priority = 0;
3630
3631	for (i = 0, mp = m; i < num_bundles; i++, mp++) {
3632	/* old ipsecrequest */
3633	int mode = pfkey_mode_from_xfrm(mode: mp->mode);
3634	if (mode < 0)
3635	goto err;
3636	if (set_ipsecrequest(skb, proto: mp->proto, mode,
3637	level: (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
3638	reqid: mp->reqid, family: mp->old_family,
3639	src: &mp->old_saddr, dst: &mp->old_daddr) < 0)
3640	goto err;
3641
3642	/* new ipsecrequest */
3643	if (set_ipsecrequest(skb, proto: mp->proto, mode,
3644	level: (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
3645	reqid: mp->reqid, family: mp->new_family,
3646	src: &mp->new_saddr, dst: &mp->new_daddr) < 0)
3647	goto err;
3648	}
3649
3650	/* broadcast migrate message to sockets */
3651	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, net: &init_net);
3652
3653	return 0;
3654
3655	err:
3656	kfree_skb(skb);
3657	return -EINVAL;
3658	}
3659	#else
3660	static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
3661	const struct xfrm_migrate *m, int num_bundles,
3662	const struct xfrm_kmaddress *k,
3663	const struct xfrm_encap_tmpl *encap)
3664	{
3665	return -ENOPROTOOPT;
3666	}
3667	#endif
3668
3669	static int pfkey_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
3670	{
3671	struct sock *sk = sock->sk;
3672	struct sk_buff *skb = NULL;
3673	struct sadb_msg *hdr = NULL;
3674	int err;
3675	struct net *net = sock_net(sk);
3676
3677	err = -EOPNOTSUPP;
3678	if (msg->msg_flags & MSG_OOB)
3679	goto out;
3680
3681	err = -EMSGSIZE;
3682	if ((unsigned int)len > sk->sk_sndbuf - 32)
3683	goto out;
3684
3685	err = -ENOBUFS;
3686	skb = alloc_skb(size: len, GFP_KERNEL);
3687	if (skb == NULL)
3688	goto out;
3689
3690	err = -EFAULT;
3691	if (memcpy_from_msg(data: skb_put(skb,len), msg, len))
3692	goto out;
3693
3694	hdr = pfkey_get_base_msg(skb, errp: &err);
3695	if (!hdr)
3696	goto out;
3697
3698	mutex_lock(&net->xfrm.xfrm_cfg_mutex);
3699	err = pfkey_process(sk, skb, hdr);
3700	mutex_unlock(lock: &net->xfrm.xfrm_cfg_mutex);
3701
3702	out:
3703	if (err && hdr && pfkey_error(orig: hdr, err, sk) == 0)
3704	err = 0;
3705	kfree_skb(skb);
3706
3707	return err ? : len;
3708	}
3709
3710	static int pfkey_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
3711	int flags)
3712	{
3713	struct sock *sk = sock->sk;
3714	struct pfkey_sock *pfk = pfkey_sk(sk);
3715	struct sk_buff *skb;
3716	int copied, err;
3717
3718	err = -EINVAL;
3719	if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
3720	goto out;
3721
3722	skb = skb_recv_datagram(sk, flags, err: &err);
3723	if (skb == NULL)
3724	goto out;
3725
3726	copied = skb->len;
3727	if (copied > len) {
3728	msg->msg_flags |= MSG_TRUNC;
3729	copied = len;
3730	}
3731
3732	skb_reset_transport_header(skb);
3733	err = skb_copy_datagram_msg(from: skb, offset: 0, msg, size: copied);
3734	if (err)
3735	goto out_free;
3736
3737	sock_recv_cmsgs(msg, sk, skb);
3738
3739	err = (flags & MSG_TRUNC) ? skb->len : copied;
3740
3741	if (pfk->dump.dump != NULL &&
3742	3 * atomic_read(v: &sk->sk_rmem_alloc) <= sk->sk_rcvbuf)
3743	pfkey_do_dump(pfk);
3744
3745	out_free:
3746	skb_free_datagram(sk, skb);
3747	out:
3748	return err;
3749	}
3750
3751	static const struct proto_ops pfkey_ops = {
3752	.family = PF_KEY,
3753	.owner = THIS_MODULE,
3754	/* Operations that make no sense on pfkey sockets. */
3755	.bind = sock_no_bind,
3756	.connect = sock_no_connect,
3757	.socketpair = sock_no_socketpair,
3758	.accept = sock_no_accept,
3759	.getname = sock_no_getname,
3760	.ioctl = sock_no_ioctl,
3761	.listen = sock_no_listen,
3762	.shutdown = sock_no_shutdown,
3763	.mmap = sock_no_mmap,
3764
3765	/* Now the operations that really occur. */
3766	.release = pfkey_release,
3767	.poll = datagram_poll,
3768	.sendmsg = pfkey_sendmsg,
3769	.recvmsg = pfkey_recvmsg,
3770	};
3771
3772	static const struct net_proto_family pfkey_family_ops = {
3773	.family = PF_KEY,
3774	.create = pfkey_create,
3775	.owner = THIS_MODULE,
3776	};
3777
3778	#ifdef CONFIG_PROC_FS
3779	static int pfkey_seq_show(struct seq_file *f, void *v)
3780	{
3781	struct sock *s = sk_entry(node: v);
3782
3783	if (v == SEQ_START_TOKEN)
3784	seq_printf(m: f ,fmt: "sk RefCnt Rmem Wmem User Inode\n");
3785	else
3786	seq_printf(m: f, fmt: "%pK %-6d %-6u %-6u %-6u %-6lu\n",
3787	s,
3788	refcount_read(r: &s->sk_refcnt),
3789	sk_rmem_alloc_get(sk: s),
3790	sk_wmem_alloc_get(sk: s),
3791	from_kuid_munged(to: seq_user_ns(seq: f), uid: sk_uid(sk: s)),
3792	sock_i_ino(sk: s)
3793	);
3794	return 0;
3795	}
3796
3797	static void *pfkey_seq_start(struct seq_file *f, loff_t *ppos)
3798	__acquires(rcu)
3799	{
3800	struct net *net = seq_file_net(seq: f);
3801	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
3802
3803	rcu_read_lock();
3804	return seq_hlist_start_head_rcu(head: &net_pfkey->table, pos: *ppos);
3805	}
3806
3807	static void *pfkey_seq_next(struct seq_file *f, void *v, loff_t *ppos)
3808	{
3809	struct net *net = seq_file_net(seq: f);
3810	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
3811
3812	return seq_hlist_next_rcu(v, head: &net_pfkey->table, ppos);
3813	}
3814
3815	static void pfkey_seq_stop(struct seq_file *f, void *v)
3816	__releases(rcu)
3817	{
3818	rcu_read_unlock();
3819	}
3820
3821	static const struct seq_operations pfkey_seq_ops = {
3822	.start = pfkey_seq_start,
3823	.next = pfkey_seq_next,
3824	.stop = pfkey_seq_stop,
3825	.show = pfkey_seq_show,
3826	};
3827
3828	static int __net_init pfkey_init_proc(struct net *net)
3829	{
3830	struct proc_dir_entry *e;
3831
3832	e = proc_create_net("pfkey", 0, net->proc_net, &pfkey_seq_ops,
3833	sizeof(struct seq_net_private));
3834	if (e == NULL)
3835	return -ENOMEM;
3836
3837	return 0;
3838	}
3839
3840	static void __net_exit pfkey_exit_proc(struct net *net)
3841	{
3842	remove_proc_entry("pfkey", net->proc_net);
3843	}
3844	#else
3845	static inline int pfkey_init_proc(struct net *net)
3846	{
3847	return 0;
3848	}
3849
3850	static inline void pfkey_exit_proc(struct net *net)
3851	{
3852	}
3853	#endif
3854
3855	static struct xfrm_mgr pfkeyv2_mgr =
3856	{
3857	.notify = pfkey_send_notify,
3858	.acquire = pfkey_send_acquire,
3859	.compile_policy = pfkey_compile_policy,
3860	.new_mapping = pfkey_send_new_mapping,
3861	.notify_policy = pfkey_send_policy_notify,
3862	.migrate = pfkey_send_migrate,
3863	.is_alive = pfkey_is_alive,
3864	};
3865
3866	static int __net_init pfkey_net_init(struct net *net)
3867	{
3868	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
3869	int rv;
3870
3871	INIT_HLIST_HEAD(&net_pfkey->table);
3872	atomic_set(v: &net_pfkey->socks_nr, i: 0);
3873
3874	rv = pfkey_init_proc(net);
3875
3876	return rv;
3877	}
3878
3879	static void __net_exit pfkey_net_exit(struct net *net)
3880	{
3881	struct netns_pfkey *net_pfkey = net_generic(net, id: pfkey_net_id);
3882
3883	pfkey_exit_proc(net);
3884	WARN_ON(!hlist_empty(&net_pfkey->table));
3885	}
3886
3887	static struct pernet_operations pfkey_net_ops = {
3888	.init = pfkey_net_init,
3889	.exit = pfkey_net_exit,
3890	.id = &pfkey_net_id,
3891	.size = sizeof(struct netns_pfkey),
3892	};
3893
3894	static void __exit ipsec_pfkey_exit(void)
3895	{
3896	xfrm_unregister_km(km: &pfkeyv2_mgr);
3897	sock_unregister(PF_KEY);
3898	unregister_pernet_subsys(&pfkey_net_ops);
3899	proto_unregister(prot: &key_proto);
3900	}
3901
3902	static int __init ipsec_pfkey_init(void)
3903	{
3904	int err = proto_register(prot: &key_proto, alloc_slab: 0);
3905
3906	pr_warn_once("PFKEY is deprecated and scheduled to be removed in 2027, "
3907	"please contact the netdev mailing list\n");
3908	if (err != 0)
3909	goto out;
3910
3911	err = register_pernet_subsys(&pfkey_net_ops);
3912	if (err != 0)
3913	goto out_unregister_key_proto;
3914	err = sock_register(fam: &pfkey_family_ops);
3915	if (err != 0)
3916	goto out_unregister_pernet;
3917	xfrm_register_km(km: &pfkeyv2_mgr);
3918	out:
3919	return err;
3920
3921	out_unregister_pernet:
3922	unregister_pernet_subsys(&pfkey_net_ops);
3923	out_unregister_key_proto:
3924	proto_unregister(prot: &key_proto);
3925	goto out;
3926	}
3927
3928	module_init(ipsec_pfkey_init);
3929	module_exit(ipsec_pfkey_exit);
3930	MODULE_DESCRIPTION("PF_KEY socket helpers");
3931	MODULE_LICENSE("GPL");
3932	MODULE_ALIAS_NETPROTO(PF_KEY);
3933