SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/key/af_key.c

   1 /*
   2  * net/key/af_key.c     An implementation of PF_KEYv2 sockets.
   3  *
   4  *              This program is free software; you can redistribute it and/or
   5  *              modify it under the terms of the GNU General Public License
   6  *              as published by the Free Software Foundation; either version
   7  *              2 of the License, or (at your option) any later version.
   8  *
   9  * Authors:     Maxim Giryaev   <gem@asplinux.ru>
  10  *              David S. Miller <davem@redhat.com>
  11  *              Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
  12  *              Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  13  *              Kazunori MIYAZAWA / USAGI Project <miyazawa@linux-ipv6.org>
  14  *              Derek Atkins <derek@ihtfp.com>
  15  */
  16
  17 #include <linux/capability.h>
  18 #include <linux/module.h>
  19 #include <linux/kernel.h>
  20 #include <linux/socket.h>
  21 #include <linux/pfkeyv2.h>
  22 #include <linux/ipsec.h>
  23 #include <linux/skbuff.h>
  24 #include <linux/rtnetlink.h>
  25 #include <linux/in.h>
  26 #include <linux/in6.h>
  27 #include <linux/proc_fs.h>
  28 #include <linux/init.h>
  29 #include <net/xfrm.h>
  30
  31 #include <net/sock.h>
  32
  33 #define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x))
  34 #define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x))
  35
  36
  37 /* List of all pfkey sockets. */
  38 static HLIST_HEAD(pfkey_table);
  39 static DECLARE_WAIT_QUEUE_HEAD(pfkey_table_wait);
  40 static DEFINE_RWLOCK(pfkey_table_lock);
  41 static atomic_t pfkey_table_users = ATOMIC_INIT(0);
  42
  43 static atomic_t pfkey_socks_nr = ATOMIC_INIT(0);
  44
  45 struct pfkey_sock {
  46         /* struct sock must be the first member of struct pfkey_sock */
  47         struct sock     sk;
  48         int             registered;
  49         int             promisc;
  50 };
  51
  52 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
  53 {
  54         return (struct pfkey_sock *)sk;
  55 }
  56
  57 static void pfkey_sock_destruct(struct sock *sk)
  58 {
  59         skb_queue_purge(&sk->sk_receive_queue);
  60
  61         if (!sock_flag(sk, SOCK_DEAD)) {
  62                 printk("Attempt to release alive pfkey socket: %p\n", sk);
  63                 return;
  64         }
  65
  66         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
  67         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
  68
  69         atomic_dec(&pfkey_socks_nr);
  70 }
  71
  72 static void pfkey_table_grab(void)
  73 {
  74         write_lock_bh(&pfkey_table_lock);
  75
  76         if (atomic_read(&pfkey_table_users)) {
  77                 DECLARE_WAITQUEUE(wait, current);
  78
  79                 add_wait_queue_exclusive(&pfkey_table_wait, &wait);
  80                 for(;;) {
  81                         set_current_state(TASK_UNINTERRUPTIBLE);
  82                         if (atomic_read(&pfkey_table_users) == 0)
  83                                 break;
  84                         write_unlock_bh(&pfkey_table_lock);
  85                         schedule();
  86                         write_lock_bh(&pfkey_table_lock);
  87                 }
  88
  89                 __set_current_state(TASK_RUNNING);
  90                 remove_wait_queue(&pfkey_table_wait, &wait);
  91         }
  92 }
  93
  94 static __inline__ void pfkey_table_ungrab(void)
  95 {
  96         write_unlock_bh(&pfkey_table_lock);
  97         wake_up(&pfkey_table_wait);
  98 }
  99
 100 static __inline__ void pfkey_lock_table(void)
 101 {
 102         /* read_lock() synchronizes us to pfkey_table_grab */
 103
 104         read_lock(&pfkey_table_lock);
 105         atomic_inc(&pfkey_table_users);
 106         read_unlock(&pfkey_table_lock);
 107 }
 108
 109 static __inline__ void pfkey_unlock_table(void)
 110 {
 111         if (atomic_dec_and_test(&pfkey_table_users))
 112                 wake_up(&pfkey_table_wait);
 113 }
 114
 115
 116 static const struct proto_ops pfkey_ops;
 117
 118 static void pfkey_insert(struct sock *sk)
 119 {
 120         pfkey_table_grab();
 121         sk_add_node(sk, &pfkey_table);
 122         pfkey_table_ungrab();
 123 }
 124
 125 static void pfkey_remove(struct sock *sk)
 126 {
 127         pfkey_table_grab();
 128         sk_del_node_init(sk);
 129         pfkey_table_ungrab();
 130 }
 131
 132 static struct proto key_proto = {
 133         .name     = "KEY",
 134         .owner    = THIS_MODULE,
 135         .obj_size = sizeof(struct pfkey_sock),
 136 };
 137
 138 static int pfkey_create(struct socket *sock, int protocol)
 139 {
 140         struct sock *sk;
 141         int err;
 142
 143         if (!capable(CAP_NET_ADMIN))
 144                 return -EPERM;
 145         if (sock->type != SOCK_RAW)
 146                 return -ESOCKTNOSUPPORT;
 147         if (protocol != PF_KEY_V2)
 148                 return -EPROTONOSUPPORT;
 149
 150         err = -ENOMEM;
 151         sk = sk_alloc(PF_KEY, GFP_KERNEL, &key_proto, 1);
 152         if (sk == NULL)
 153                 goto out;
 154
 155         sock->ops = &pfkey_ops;
 156         sock_init_data(sock, sk);
 157
 158         sk->sk_family = PF_KEY;
 159         sk->sk_destruct = pfkey_sock_destruct;
 160
 161         atomic_inc(&pfkey_socks_nr);
 162
 163         pfkey_insert(sk);
 164
 165         return 0;
 166 out:
 167         return err;
 168 }
 169
 170 static int pfkey_release(struct socket *sock)
 171 {
 172         struct sock *sk = sock->sk;
 173
 174         if (!sk)
 175                 return 0;
 176
 177         pfkey_remove(sk);
 178
 179         sock_orphan(sk);
 180         sock->sk = NULL;
 181         skb_queue_purge(&sk->sk_write_queue);
 182         sock_put(sk);
 183
 184         return 0;
 185 }
 186
 187 static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
 188                                gfp_t allocation, struct sock *sk)
 189 {
 190         int err = -ENOBUFS;
 191
 192         sock_hold(sk);
 193         if (*skb2 == NULL) {
 194                 if (atomic_read(&skb->users) != 1) {
 195                         *skb2 = skb_clone(skb, allocation);
 196                 } else {
 197                         *skb2 = skb;
 198                         atomic_inc(&skb->users);
 199                 }
 200         }
 201         if (*skb2 != NULL) {
 202                 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
 203                         skb_orphan(*skb2);
 204                         skb_set_owner_r(*skb2, sk);
 205                         skb_queue_tail(&sk->sk_receive_queue, *skb2);
 206                         sk->sk_data_ready(sk, (*skb2)->len);
 207                         *skb2 = NULL;
 208                         err = 0;
 209                 }
 210         }
 211         sock_put(sk);
 212         return err;
 213 }
 214
 215 /* Send SKB to all pfkey sockets matching selected criteria.  */
 216 #define BROADCAST_ALL           0
 217 #define BROADCAST_ONE           1
 218 #define BROADCAST_REGISTERED    2
 219 #define BROADCAST_PROMISC_ONLY  4
 220 static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
 221                            int broadcast_flags, struct sock *one_sk)
 222 {
 223         struct sock *sk;
 224         struct hlist_node *node;
 225         struct sk_buff *skb2 = NULL;
 226         int err = -ESRCH;
 227
 228         /* XXX Do we need something like netlink_overrun?  I think
 229          * XXX PF_KEY socket apps will not mind current behavior.
 230          */
 231         if (!skb)
 232                 return -ENOMEM;
 233
 234         pfkey_lock_table();
 235         sk_for_each(sk, node, &pfkey_table) {
 236                 struct pfkey_sock *pfk = pfkey_sk(sk);
 237                 int err2;
 238
 239                 /* Yes, it means that if you are meant to receive this
 240                  * pfkey message you receive it twice as promiscuous
 241                  * socket.
 242                  */
 243                 if (pfk->promisc)
 244                         pfkey_broadcast_one(skb, &skb2, allocation, sk);
 245
 246                 /* the exact target will be processed later */
 247                 if (sk == one_sk)
 248                         continue;
 249                 if (broadcast_flags != BROADCAST_ALL) {
 250                         if (broadcast_flags & BROADCAST_PROMISC_ONLY)
 251                                 continue;
 252                         if ((broadcast_flags & BROADCAST_REGISTERED) &&
 253                             !pfk->registered)
 254                                 continue;
 255                         if (broadcast_flags & BROADCAST_ONE)
 256                                 continue;
 257                 }
 258
 259                 err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk);
 260
 261                 /* Error is cleare after succecful sending to at least one
 262                  * registered KM */
 263                 if ((broadcast_flags & BROADCAST_REGISTERED) && err)
 264                         err = err2;
 265         }
 266         pfkey_unlock_table();
 267
 268         if (one_sk != NULL)
 269                 err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
 270
 271         if (skb2)
 272                 kfree_skb(skb2);
 273         kfree_skb(skb);
 274         return err;
 275 }
 276
 277 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)
 278 {
 279         *new = *orig;
 280 }
 281
 282 static int pfkey_error(struct sadb_msg *orig, int err, struct sock *sk)
 283 {
 284         struct sk_buff *skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_KERNEL);
 285         struct sadb_msg *hdr;
 286
 287         if (!skb)
 288                 return -ENOBUFS;
 289
 290         /* Woe be to the platform trying to support PFKEY yet
 291          * having normal errnos outside the 1-255 range, inclusive.
 292          */
 293         err = -err;
 294         if (err == ERESTARTSYS ||
 295             err == ERESTARTNOHAND ||
 296             err == ERESTARTNOINTR)
 297                 err = EINTR;
 298         if (err >= 512)
 299                 err = EINVAL;
 300         BUG_ON(err <= 0 || err >= 256);
 301
 302         hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
 303         pfkey_hdr_dup(hdr, orig);
 304         hdr->sadb_msg_errno = (uint8_t) err;
 305         hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
 306                              sizeof(uint64_t));
 307
 308         pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk);
 309
 310         return 0;
 311 }
 312
 313 static u8 sadb_ext_min_len[] = {
 314         [SADB_EXT_RESERVED]             = (u8) 0,
 315         [SADB_EXT_SA]                   = (u8) sizeof(struct sadb_sa),
 316         [SADB_EXT_LIFETIME_CURRENT]     = (u8) sizeof(struct sadb_lifetime),
 317         [SADB_EXT_LIFETIME_HARD]        = (u8) sizeof(struct sadb_lifetime),
 318         [SADB_EXT_LIFETIME_SOFT]        = (u8) sizeof(struct sadb_lifetime),
 319         [SADB_EXT_ADDRESS_SRC]          = (u8) sizeof(struct sadb_address),
 320         [SADB_EXT_ADDRESS_DST]          = (u8) sizeof(struct sadb_address),
 321         [SADB_EXT_ADDRESS_PROXY]        = (u8) sizeof(struct sadb_address),
 322         [SADB_EXT_KEY_AUTH]             = (u8) sizeof(struct sadb_key),
 323         [SADB_EXT_KEY_ENCRYPT]          = (u8) sizeof(struct sadb_key),
 324         [SADB_EXT_IDENTITY_SRC]         = (u8) sizeof(struct sadb_ident),
 325         [SADB_EXT_IDENTITY_DST]         = (u8) sizeof(struct sadb_ident),
 326         [SADB_EXT_SENSITIVITY]          = (u8) sizeof(struct sadb_sens),
 327         [SADB_EXT_PROPOSAL]             = (u8) sizeof(struct sadb_prop),
 328         [SADB_EXT_SUPPORTED_AUTH]       = (u8) sizeof(struct sadb_supported),
 329         [SADB_EXT_SUPPORTED_ENCRYPT]    = (u8) sizeof(struct sadb_supported),
 330         [SADB_EXT_SPIRANGE]             = (u8) sizeof(struct sadb_spirange),
 331         [SADB_X_EXT_KMPRIVATE]          = (u8) sizeof(struct sadb_x_kmprivate),
 332         [SADB_X_EXT_POLICY]             = (u8) sizeof(struct sadb_x_policy),
 333         [SADB_X_EXT_SA2]                = (u8) sizeof(struct sadb_x_sa2),
 334         [SADB_X_EXT_NAT_T_TYPE]         = (u8) sizeof(struct sadb_x_nat_t_type),
 335         [SADB_X_EXT_NAT_T_SPORT]        = (u8) sizeof(struct sadb_x_nat_t_port),
 336         [SADB_X_EXT_NAT_T_DPORT]        = (u8) sizeof(struct sadb_x_nat_t_port),
 337         [SADB_X_EXT_NAT_T_OA]           = (u8) sizeof(struct sadb_address),
 338         [SADB_X_EXT_SEC_CTX]            = (u8) sizeof(struct sadb_x_sec_ctx),
 339 };
 340
 341 /* Verify sadb_address_{len,prefixlen} against sa_family.  */
 342 static int verify_address_len(void *p)
 343 {
 344         struct sadb_address *sp = p;
 345         struct sockaddr *addr = (struct sockaddr *)(sp + 1);
 346         struct sockaddr_in *sin;
 347 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 348         struct sockaddr_in6 *sin6;
 349 #endif
 350         int len;
 351
 352         switch (addr->sa_family) {
 353         case AF_INET:
 354                 len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin), sizeof(uint64_t));
 355                 if (sp->sadb_address_len != len ||
 356                     sp->sadb_address_prefixlen > 32)
 357                         return -EINVAL;
 358                 break;
 359 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 360         case AF_INET6:
 361                 len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin6), sizeof(uint64_t));
 362                 if (sp->sadb_address_len != len ||
 363                     sp->sadb_address_prefixlen > 128)
 364                         return -EINVAL;
 365                 break;
 366 #endif
 367         default:
 368                 /* It is user using kernel to keep track of security
 369                  * associations for another protocol, such as
 370                  * OSPF/RSVP/RIPV2/MIP.  It is user's job to verify
 371                  * lengths.
 372                  *
 373                  * XXX Actually, association/policy database is not yet
 374                  * XXX able to cope with arbitrary sockaddr families.
 375                  * XXX When it can, remove this -EINVAL.  -DaveM
 376                  */
 377                 return -EINVAL;
 378                 break;
 379         }
 380
 381         return 0;
 382 }
 383
 384 static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx)
 385 {
 386         return DIV_ROUND_UP(sizeof(struct sadb_x_sec_ctx) +
 387                             sec_ctx->sadb_x_ctx_len,
 388                             sizeof(uint64_t));
 389 }
 390
 391 static inline int verify_sec_ctx_len(void *p)
 392 {
 393         struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p;
 394         int len;
 395
 396         if (sec_ctx->sadb_x_ctx_len > PAGE_SIZE)
 397                 return -EINVAL;
 398
 399         len = pfkey_sec_ctx_len(sec_ctx);
 400
 401         if (sec_ctx->sadb_x_sec_len != len)
 402                 return -EINVAL;
 403
 404         return 0;
 405 }
 406
 407 static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(struct sadb_x_sec_ctx *sec_ctx)
 408 {
 409         struct xfrm_user_sec_ctx *uctx = NULL;
 410         int ctx_size = sec_ctx->sadb_x_ctx_len;
 411
 412         uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL);
 413
 414         if (!uctx)
 415                 return NULL;
 416
 417         uctx->len = pfkey_sec_ctx_len(sec_ctx);
 418         uctx->exttype = sec_ctx->sadb_x_sec_exttype;
 419         uctx->ctx_doi = sec_ctx->sadb_x_ctx_doi;
 420         uctx->ctx_alg = sec_ctx->sadb_x_ctx_alg;
 421         uctx->ctx_len = sec_ctx->sadb_x_ctx_len;
 422         memcpy(uctx + 1, sec_ctx + 1,
 423                uctx->ctx_len);
 424
 425         return uctx;
 426 }
 427
 428 static int present_and_same_family(struct sadb_address *src,
 429                                    struct sadb_address *dst)
 430 {
 431         struct sockaddr *s_addr, *d_addr;
 432
 433         if (!src || !dst)
 434                 return 0;
 435
 436         s_addr = (struct sockaddr *)(src + 1);
 437         d_addr = (struct sockaddr *)(dst + 1);
 438         if (s_addr->sa_family != d_addr->sa_family)
 439                 return 0;
 440         if (s_addr->sa_family != AF_INET
 441 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 442             && s_addr->sa_family != AF_INET6
 443 #endif
 444                 )
 445                 return 0;
 446
 447         return 1;
 448 }
 449
 450 static int parse_exthdrs(struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 451 {
 452         char *p = (char *) hdr;
 453         int len = skb->len;
 454
 455         len -= sizeof(*hdr);
 456         p += sizeof(*hdr);
 457         while (len > 0) {
 458                 struct sadb_ext *ehdr = (struct sadb_ext *) p;
 459                 uint16_t ext_type;
 460                 int ext_len;
 461
 462                 ext_len  = ehdr->sadb_ext_len;
 463                 ext_len *= sizeof(uint64_t);
 464                 ext_type = ehdr->sadb_ext_type;
 465                 if (ext_len < sizeof(uint64_t) ||
 466                     ext_len > len ||
 467                     ext_type == SADB_EXT_RESERVED)
 468                         return -EINVAL;
 469
 470                 if (ext_type <= SADB_EXT_MAX) {
 471                         int min = (int) sadb_ext_min_len[ext_type];
 472                         if (ext_len < min)
 473                                 return -EINVAL;
 474                         if (ext_hdrs[ext_type-1] != NULL)
 475                                 return -EINVAL;
 476                         if (ext_type == SADB_EXT_ADDRESS_SRC ||
 477                             ext_type == SADB_EXT_ADDRESS_DST ||
 478                             ext_type == SADB_EXT_ADDRESS_PROXY ||
 479                             ext_type == SADB_X_EXT_NAT_T_OA) {
 480                                 if (verify_address_len(p))
 481                                         return -EINVAL;
 482                         }
 483                         if (ext_type == SADB_X_EXT_SEC_CTX) {
 484                                 if (verify_sec_ctx_len(p))
 485                                         return -EINVAL;
 486                         }
 487                         ext_hdrs[ext_type-1] = p;
 488                 }
 489                 p   += ext_len;
 490                 len -= ext_len;
 491         }
 492
 493         return 0;
 494 }
 495
 496 static uint16_t
 497 pfkey_satype2proto(uint8_t satype)
 498 {
 499         switch (satype) {
 500         case SADB_SATYPE_UNSPEC:
 501                 return IPSEC_PROTO_ANY;
 502         case SADB_SATYPE_AH:
 503                 return IPPROTO_AH;
 504         case SADB_SATYPE_ESP:
 505                 return IPPROTO_ESP;
 506         case SADB_X_SATYPE_IPCOMP:
 507                 return IPPROTO_COMP;
 508                 break;
 509         default:
 510                 return 0;
 511         }
 512         /* NOTREACHED */
 513 }
 514
 515 static uint8_t
 516 pfkey_proto2satype(uint16_t proto)
 517 {
 518         switch (proto) {
 519         case IPPROTO_AH:
 520                 return SADB_SATYPE_AH;
 521         case IPPROTO_ESP:
 522                 return SADB_SATYPE_ESP;
 523         case IPPROTO_COMP:
 524                 return SADB_X_SATYPE_IPCOMP;
 525                 break;
 526         default:
 527                 return 0;
 528         }
 529         /* NOTREACHED */
 530 }
 531
 532 /* BTW, this scheme means that there is no way with PFKEY2 sockets to
 533  * say specifically 'just raw sockets' as we encode them as 255.
 534  */
 535
 536 static uint8_t pfkey_proto_to_xfrm(uint8_t proto)
 537 {
 538         return (proto == IPSEC_PROTO_ANY ? 0 : proto);
 539 }
 540
 541 static uint8_t pfkey_proto_from_xfrm(uint8_t proto)
 542 {
 543         return (proto ? proto : IPSEC_PROTO_ANY);
 544 }
 545
 546 static int pfkey_sadb_addr2xfrm_addr(struct sadb_address *addr,
 547                                      xfrm_address_t *xaddr)
 548 {
 549         switch (((struct sockaddr*)(addr + 1))->sa_family) {
 550         case AF_INET:
 551                 xaddr->a4 =
 552                         ((struct sockaddr_in *)(addr + 1))->sin_addr.s_addr;
 553                 return AF_INET;
 554 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 555         case AF_INET6:
 556                 memcpy(xaddr->a6,
 557                        &((struct sockaddr_in6 *)(addr + 1))->sin6_addr,
 558                        sizeof(struct in6_addr));
 559                 return AF_INET6;
 560 #endif
 561         default:
 562                 return 0;
 563         }
 564         /* NOTREACHED */
 565 }
 566
 567 static struct  xfrm_state *pfkey_xfrm_state_lookup(struct sadb_msg *hdr, void **ext_hdrs)
 568 {
 569         struct sadb_sa *sa;
 570         struct sadb_address *addr;
 571         uint16_t proto;
 572         unsigned short family;
 573         xfrm_address_t *xaddr;
 574
 575         sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1];
 576         if (sa == NULL)
 577                 return NULL;
 578
 579         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
 580         if (proto == 0)
 581                 return NULL;
 582
 583         /* sadb_address_len should be checked by caller */
 584         addr = (struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1];
 585         if (addr == NULL)
 586                 return NULL;
 587
 588         family = ((struct sockaddr *)(addr + 1))->sa_family;
 589         switch (family) {
 590         case AF_INET:
 591                 xaddr = (xfrm_address_t *)&((struct sockaddr_in *)(addr + 1))->sin_addr;
 592                 break;
 593 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 594         case AF_INET6:
 595                 xaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(addr + 1))->sin6_addr;
 596                 break;
 597 #endif
 598         default:
 599                 xaddr = NULL;
 600         }
 601
 602         if (!xaddr)
 603                 return NULL;
 604
 605         return xfrm_state_lookup(xaddr, sa->sadb_sa_spi, proto, family);
 606 }
 607
 608 #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1)))
 609 static int
 610 pfkey_sockaddr_size(sa_family_t family)
 611 {
 612         switch (family) {
 613         case AF_INET:
 614                 return PFKEY_ALIGN8(sizeof(struct sockaddr_in));
 615 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 616         case AF_INET6:
 617                 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6));
 618 #endif
 619         default:
 620                 return 0;
 621         }
 622         /* NOTREACHED */
 623 }
 624
 625 static inline int pfkey_mode_from_xfrm(int mode)
 626 {
 627         switch(mode) {
 628         case XFRM_MODE_TRANSPORT:
 629                 return IPSEC_MODE_TRANSPORT;
 630         case XFRM_MODE_TUNNEL:
 631                 return IPSEC_MODE_TUNNEL;
 632         case XFRM_MODE_BEET:
 633                 return IPSEC_MODE_BEET;
 634         default:
 635                 return -1;
 636         }
 637 }
 638
 639 static inline int pfkey_mode_to_xfrm(int mode)
 640 {
 641         switch(mode) {
 642         case IPSEC_MODE_ANY:    /*XXX*/
 643         case IPSEC_MODE_TRANSPORT:
 644                 return XFRM_MODE_TRANSPORT;
 645         case IPSEC_MODE_TUNNEL:
 646                 return XFRM_MODE_TUNNEL;
 647         case IPSEC_MODE_BEET:
 648                 return XFRM_MODE_BEET;
 649         default:
 650                 return -1;
 651         }
 652 }
 653
 654 static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys, int hsc)
 655 {
 656         struct sk_buff *skb;
 657         struct sadb_msg *hdr;
 658         struct sadb_sa *sa;
 659         struct sadb_lifetime *lifetime;
 660         struct sadb_address *addr;
 661         struct sadb_key *key;
 662         struct sadb_x_sa2 *sa2;
 663         struct sockaddr_in *sin;
 664         struct sadb_x_sec_ctx *sec_ctx;
 665         struct xfrm_sec_ctx *xfrm_ctx;
 666         int ctx_size = 0;
 667 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 668         struct sockaddr_in6 *sin6;
 669 #endif
 670         int size;
 671         int auth_key_size = 0;
 672         int encrypt_key_size = 0;
 673         int sockaddr_size;
 674         struct xfrm_encap_tmpl *natt = NULL;
 675         int mode;
 676
 677         /* address family check */
 678         sockaddr_size = pfkey_sockaddr_size(x->props.family);
 679         if (!sockaddr_size)
 680                 return ERR_PTR(-EINVAL);
 681
 682         /* base, SA, (lifetime (HSC),) address(SD), (address(P),)
 683            key(AE), (identity(SD),) (sensitivity)> */
 684         size = sizeof(struct sadb_msg) +sizeof(struct sadb_sa) +
 685                 sizeof(struct sadb_lifetime) +
 686                 ((hsc & 1) ? sizeof(struct sadb_lifetime) : 0) +
 687                 ((hsc & 2) ? sizeof(struct sadb_lifetime) : 0) +
 688                         sizeof(struct sadb_address)*2 +
 689                                 sockaddr_size*2 +
 690                                         sizeof(struct sadb_x_sa2);
 691
 692         if ((xfrm_ctx = x->security)) {
 693                 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
 694                 size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
 695         }
 696
 697         /* identity & sensitivity */
 698
 699         if ((x->props.family == AF_INET &&
 700              x->sel.saddr.a4 != x->props.saddr.a4)
 701 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 702             || (x->props.family == AF_INET6 &&
 703                 memcmp (x->sel.saddr.a6, x->props.saddr.a6, sizeof (struct in6_addr)))
 704 #endif
 705                 )
 706                 size += sizeof(struct sadb_address) + sockaddr_size;
 707
 708         if (add_keys) {
 709                 if (x->aalg && x->aalg->alg_key_len) {
 710                         auth_key_size =
 711                                 PFKEY_ALIGN8((x->aalg->alg_key_len + 7) / 8);
 712                         size += sizeof(struct sadb_key) + auth_key_size;
 713                 }
 714                 if (x->ealg && x->ealg->alg_key_len) {
 715                         encrypt_key_size =
 716                                 PFKEY_ALIGN8((x->ealg->alg_key_len+7) / 8);
 717                         size += sizeof(struct sadb_key) + encrypt_key_size;
 718                 }
 719         }
 720         if (x->encap)
 721                 natt = x->encap;
 722
 723         if (natt && natt->encap_type) {
 724                 size += sizeof(struct sadb_x_nat_t_type);
 725                 size += sizeof(struct sadb_x_nat_t_port);
 726                 size += sizeof(struct sadb_x_nat_t_port);
 727         }
 728
 729         skb =  alloc_skb(size + 16, GFP_ATOMIC);
 730         if (skb == NULL)
 731                 return ERR_PTR(-ENOBUFS);
 732
 733         /* call should fill header later */
 734         hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
 735         memset(hdr, 0, size);   /* XXX do we need this ? */
 736         hdr->sadb_msg_len = size / sizeof(uint64_t);
 737
 738         /* sa */
 739         sa = (struct sadb_sa *)  skb_put(skb, sizeof(struct sadb_sa));
 740         sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t);
 741         sa->sadb_sa_exttype = SADB_EXT_SA;
 742         sa->sadb_sa_spi = x->id.spi;
 743         sa->sadb_sa_replay = x->props.replay_window;
 744         switch (x->km.state) {
 745         case XFRM_STATE_VALID:
 746                 sa->sadb_sa_state = x->km.dying ?
 747                         SADB_SASTATE_DYING : SADB_SASTATE_MATURE;
 748                 break;
 749         case XFRM_STATE_ACQ:
 750                 sa->sadb_sa_state = SADB_SASTATE_LARVAL;
 751                 break;
 752         default:
 753                 sa->sadb_sa_state = SADB_SASTATE_DEAD;
 754                 break;
 755         }
 756         sa->sadb_sa_auth = 0;
 757         if (x->aalg) {
 758                 struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
 759                 sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0;
 760         }
 761         sa->sadb_sa_encrypt = 0;
 762         BUG_ON(x->ealg && x->calg);
 763         if (x->ealg) {
 764                 struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0);
 765                 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
 766         }
 767         /* KAME compatible: sadb_sa_encrypt is overloaded with calg id */
 768         if (x->calg) {
 769                 struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0);
 770                 sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
 771         }
 772
 773         sa->sadb_sa_flags = 0;
 774         if (x->props.flags & XFRM_STATE_NOECN)
 775                 sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN;
 776         if (x->props.flags & XFRM_STATE_DECAP_DSCP)
 777                 sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP;
 778         if (x->props.flags & XFRM_STATE_NOPMTUDISC)
 779                 sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC;
 780
 781         /* hard time */
 782         if (hsc & 2) {
 783                 lifetime = (struct sadb_lifetime *)  skb_put(skb,
 784                                                              sizeof(struct sadb_lifetime));
 785                 lifetime->sadb_lifetime_len =
 786                         sizeof(struct sadb_lifetime)/sizeof(uint64_t);
 787                 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
 788                 lifetime->sadb_lifetime_allocations =  _X2KEY(x->lft.hard_packet_limit);
 789                 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.hard_byte_limit);
 790                 lifetime->sadb_lifetime_addtime = x->lft.hard_add_expires_seconds;
 791                 lifetime->sadb_lifetime_usetime = x->lft.hard_use_expires_seconds;
 792         }
 793         /* soft time */
 794         if (hsc & 1) {
 795                 lifetime = (struct sadb_lifetime *)  skb_put(skb,
 796                                                              sizeof(struct sadb_lifetime));
 797                 lifetime->sadb_lifetime_len =
 798                         sizeof(struct sadb_lifetime)/sizeof(uint64_t);
 799                 lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
 800                 lifetime->sadb_lifetime_allocations =  _X2KEY(x->lft.soft_packet_limit);
 801                 lifetime->sadb_lifetime_bytes = _X2KEY(x->lft.soft_byte_limit);
 802                 lifetime->sadb_lifetime_addtime = x->lft.soft_add_expires_seconds;
 803                 lifetime->sadb_lifetime_usetime = x->lft.soft_use_expires_seconds;
 804         }
 805         /* current time */
 806         lifetime = (struct sadb_lifetime *)  skb_put(skb,
 807                                                      sizeof(struct sadb_lifetime));
 808         lifetime->sadb_lifetime_len =
 809                 sizeof(struct sadb_lifetime)/sizeof(uint64_t);
 810         lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
 811         lifetime->sadb_lifetime_allocations = x->curlft.packets;
 812         lifetime->sadb_lifetime_bytes = x->curlft.bytes;
 813         lifetime->sadb_lifetime_addtime = x->curlft.add_time;
 814         lifetime->sadb_lifetime_usetime = x->curlft.use_time;
 815         /* src address */
 816         addr = (struct sadb_address*) skb_put(skb,
 817                                               sizeof(struct sadb_address)+sockaddr_size);
 818         addr->sadb_address_len =
 819                 (sizeof(struct sadb_address)+sockaddr_size)/
 820                         sizeof(uint64_t);
 821         addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
 822         /* "if the ports are non-zero, then the sadb_address_proto field,
 823            normally zero, MUST be filled in with the transport
 824            protocol's number." - RFC2367 */
 825         addr->sadb_address_proto = 0;
 826         addr->sadb_address_reserved = 0;
 827         if (x->props.family == AF_INET) {
 828                 addr->sadb_address_prefixlen = 32;
 829
 830                 sin = (struct sockaddr_in *) (addr + 1);
 831                 sin->sin_family = AF_INET;
 832                 sin->sin_addr.s_addr = x->props.saddr.a4;
 833                 sin->sin_port = 0;
 834                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
 835         }
 836 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 837         else if (x->props.family == AF_INET6) {
 838                 addr->sadb_address_prefixlen = 128;
 839
 840                 sin6 = (struct sockaddr_in6 *) (addr + 1);
 841                 sin6->sin6_family = AF_INET6;
 842                 sin6->sin6_port = 0;
 843                 sin6->sin6_flowinfo = 0;
 844                 memcpy(&sin6->sin6_addr, x->props.saddr.a6,
 845                        sizeof(struct in6_addr));
 846                 sin6->sin6_scope_id = 0;
 847         }
 848 #endif
 849         else
 850                 BUG();
 851
 852         /* dst address */
 853         addr = (struct sadb_address*) skb_put(skb,
 854                                               sizeof(struct sadb_address)+sockaddr_size);
 855         addr->sadb_address_len =
 856                 (sizeof(struct sadb_address)+sockaddr_size)/
 857                         sizeof(uint64_t);
 858         addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
 859         addr->sadb_address_proto = 0;
 860         addr->sadb_address_prefixlen = 32; /* XXX */
 861         addr->sadb_address_reserved = 0;
 862         if (x->props.family == AF_INET) {
 863                 sin = (struct sockaddr_in *) (addr + 1);
 864                 sin->sin_family = AF_INET;
 865                 sin->sin_addr.s_addr = x->id.daddr.a4;
 866                 sin->sin_port = 0;
 867                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
 868
 869                 if (x->sel.saddr.a4 != x->props.saddr.a4) {
 870                         addr = (struct sadb_address*) skb_put(skb,
 871                                 sizeof(struct sadb_address)+sockaddr_size);
 872                         addr->sadb_address_len =
 873                                 (sizeof(struct sadb_address)+sockaddr_size)/
 874                                 sizeof(uint64_t);
 875                         addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
 876                         addr->sadb_address_proto =
 877                                 pfkey_proto_from_xfrm(x->sel.proto);
 878                         addr->sadb_address_prefixlen = x->sel.prefixlen_s;
 879                         addr->sadb_address_reserved = 0;
 880
 881                         sin = (struct sockaddr_in *) (addr + 1);
 882                         sin->sin_family = AF_INET;
 883                         sin->sin_addr.s_addr = x->sel.saddr.a4;
 884                         sin->sin_port = x->sel.sport;
 885                         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
 886                 }
 887         }
 888 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 889         else if (x->props.family == AF_INET6) {
 890                 addr->sadb_address_prefixlen = 128;
 891
 892                 sin6 = (struct sockaddr_in6 *) (addr + 1);
 893                 sin6->sin6_family = AF_INET6;
 894                 sin6->sin6_port = 0;
 895                 sin6->sin6_flowinfo = 0;
 896                 memcpy(&sin6->sin6_addr, x->id.daddr.a6, sizeof(struct in6_addr));
 897                 sin6->sin6_scope_id = 0;
 898
 899                 if (memcmp (x->sel.saddr.a6, x->props.saddr.a6,
 900                             sizeof(struct in6_addr))) {
 901                         addr = (struct sadb_address *) skb_put(skb,
 902                                 sizeof(struct sadb_address)+sockaddr_size);
 903                         addr->sadb_address_len =
 904                                 (sizeof(struct sadb_address)+sockaddr_size)/
 905                                 sizeof(uint64_t);
 906                         addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
 907                         addr->sadb_address_proto =
 908                                 pfkey_proto_from_xfrm(x->sel.proto);
 909                         addr->sadb_address_prefixlen = x->sel.prefixlen_s;
 910                         addr->sadb_address_reserved = 0;
 911
 912                         sin6 = (struct sockaddr_in6 *) (addr + 1);
 913                         sin6->sin6_family = AF_INET6;
 914                         sin6->sin6_port = x->sel.sport;
 915                         sin6->sin6_flowinfo = 0;
 916                         memcpy(&sin6->sin6_addr, x->sel.saddr.a6,
 917                                sizeof(struct in6_addr));
 918                         sin6->sin6_scope_id = 0;
 919                 }
 920         }
 921 #endif
 922         else
 923                 BUG();
 924
 925         /* auth key */
 926         if (add_keys && auth_key_size) {
 927                 key = (struct sadb_key *) skb_put(skb,
 928                                                   sizeof(struct sadb_key)+auth_key_size);
 929                 key->sadb_key_len = (sizeof(struct sadb_key) + auth_key_size) /
 930                         sizeof(uint64_t);
 931                 key->sadb_key_exttype = SADB_EXT_KEY_AUTH;
 932                 key->sadb_key_bits = x->aalg->alg_key_len;
 933                 key->sadb_key_reserved = 0;
 934                 memcpy(key + 1, x->aalg->alg_key, (x->aalg->alg_key_len+7)/8);
 935         }
 936         /* encrypt key */
 937         if (add_keys && encrypt_key_size) {
 938                 key = (struct sadb_key *) skb_put(skb,
 939                                                   sizeof(struct sadb_key)+encrypt_key_size);
 940                 key->sadb_key_len = (sizeof(struct sadb_key) +
 941                                      encrypt_key_size) / sizeof(uint64_t);
 942                 key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
 943                 key->sadb_key_bits = x->ealg->alg_key_len;
 944                 key->sadb_key_reserved = 0;
 945                 memcpy(key + 1, x->ealg->alg_key,
 946                        (x->ealg->alg_key_len+7)/8);
 947         }
 948
 949         /* sa */
 950         sa2 = (struct sadb_x_sa2 *)  skb_put(skb, sizeof(struct sadb_x_sa2));
 951         sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t);
 952         sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
 953         if ((mode = pfkey_mode_from_xfrm(x->props.mode)) < 0) {
 954                 kfree_skb(skb);
 955                 return ERR_PTR(-EINVAL);
 956         }
 957         sa2->sadb_x_sa2_mode = mode;
 958         sa2->sadb_x_sa2_reserved1 = 0;
 959         sa2->sadb_x_sa2_reserved2 = 0;
 960         sa2->sadb_x_sa2_sequence = 0;
 961         sa2->sadb_x_sa2_reqid = x->props.reqid;
 962
 963         if (natt && natt->encap_type) {
 964                 struct sadb_x_nat_t_type *n_type;
 965                 struct sadb_x_nat_t_port *n_port;
 966
 967                 /* type */
 968                 n_type = (struct sadb_x_nat_t_type*) skb_put(skb, sizeof(*n_type));
 969                 n_type->sadb_x_nat_t_type_len = sizeof(*n_type)/sizeof(uint64_t);
 970                 n_type->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
 971                 n_type->sadb_x_nat_t_type_type = natt->encap_type;
 972                 n_type->sadb_x_nat_t_type_reserved[0] = 0;
 973                 n_type->sadb_x_nat_t_type_reserved[1] = 0;
 974                 n_type->sadb_x_nat_t_type_reserved[2] = 0;
 975
 976                 /* source port */
 977                 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
 978                 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
 979                 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
 980                 n_port->sadb_x_nat_t_port_port = natt->encap_sport;
 981                 n_port->sadb_x_nat_t_port_reserved = 0;
 982
 983                 /* dest port */
 984                 n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
 985                 n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
 986                 n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
 987                 n_port->sadb_x_nat_t_port_port = natt->encap_dport;
 988                 n_port->sadb_x_nat_t_port_reserved = 0;
 989         }
 990
 991         /* security context */
 992         if (xfrm_ctx) {
 993                 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
 994                                 sizeof(struct sadb_x_sec_ctx) + ctx_size);
 995                 sec_ctx->sadb_x_sec_len =
 996                   (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
 997                 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
 998                 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
 999                 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
1000                 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
1001                 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
1002                        xfrm_ctx->ctx_len);
1003         }
1004
1005         return skb;
1006 }
1007
1008 static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
1009                                                 void **ext_hdrs)
1010 {
1011         struct xfrm_state *x;
1012         struct sadb_lifetime *lifetime;
1013         struct sadb_sa *sa;
1014         struct sadb_key *key;
1015         struct sadb_x_sec_ctx *sec_ctx;
1016         uint16_t proto;
1017         int err;
1018
1019
1020         sa = (struct sadb_sa *) ext_hdrs[SADB_EXT_SA-1];
1021         if (!sa ||
1022             !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1023                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1024                 return ERR_PTR(-EINVAL);
1025         if (hdr->sadb_msg_satype == SADB_SATYPE_ESP &&
1026             !ext_hdrs[SADB_EXT_KEY_ENCRYPT-1])
1027                 return ERR_PTR(-EINVAL);
1028         if (hdr->sadb_msg_satype == SADB_SATYPE_AH &&
1029             !ext_hdrs[SADB_EXT_KEY_AUTH-1])
1030                 return ERR_PTR(-EINVAL);
1031         if (!!ext_hdrs[SADB_EXT_LIFETIME_HARD-1] !=
1032             !!ext_hdrs[SADB_EXT_LIFETIME_SOFT-1])
1033                 return ERR_PTR(-EINVAL);
1034
1035         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1036         if (proto == 0)
1037                 return ERR_PTR(-EINVAL);
1038
1039         /* default error is no buffer space */
1040         err = -ENOBUFS;
1041
1042         /* RFC2367:
1043
1044    Only SADB_SASTATE_MATURE SAs may be submitted in an SADB_ADD message.
1045    SADB_SASTATE_LARVAL SAs are created by SADB_GETSPI and it is not
1046    sensible to add a new SA in the DYING or SADB_SASTATE_DEAD state.
1047    Therefore, the sadb_sa_state field of all submitted SAs MUST be
1048    SADB_SASTATE_MATURE and the kernel MUST return an error if this is
1049    not true.
1050
1051            However, KAME setkey always uses SADB_SASTATE_LARVAL.
1052            Hence, we have to _ignore_ sadb_sa_state, which is also reasonable.
1053          */
1054         if (sa->sadb_sa_auth > SADB_AALG_MAX ||
1055             (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP &&
1056              sa->sadb_sa_encrypt > SADB_X_CALG_MAX) ||
1057             sa->sadb_sa_encrypt > SADB_EALG_MAX)
1058                 return ERR_PTR(-EINVAL);
1059         key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1];
1060         if (key != NULL &&
1061             sa->sadb_sa_auth != SADB_X_AALG_NULL &&
1062             ((key->sadb_key_bits+7) / 8 == 0 ||
1063              (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
1064                 return ERR_PTR(-EINVAL);
1065         key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
1066         if (key != NULL &&
1067             sa->sadb_sa_encrypt != SADB_EALG_NULL &&
1068             ((key->sadb_key_bits+7) / 8 == 0 ||
1069              (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
1070                 return ERR_PTR(-EINVAL);
1071
1072         x = xfrm_state_alloc();
1073         if (x == NULL)
1074                 return ERR_PTR(-ENOBUFS);
1075
1076         x->id.proto = proto;
1077         x->id.spi = sa->sadb_sa_spi;
1078         x->props.replay_window = sa->sadb_sa_replay;
1079         if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN)
1080                 x->props.flags |= XFRM_STATE_NOECN;
1081         if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
1082                 x->props.flags |= XFRM_STATE_DECAP_DSCP;
1083         if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC)
1084                 x->props.flags |= XFRM_STATE_NOPMTUDISC;
1085
1086         lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_HARD-1];
1087         if (lifetime != NULL) {
1088                 x->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
1089                 x->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
1090                 x->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime;
1091                 x->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime;
1092         }
1093         lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_SOFT-1];
1094         if (lifetime != NULL) {
1095                 x->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
1096                 x->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
1097                 x->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;
1098                 x->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;
1099         }
1100
1101         sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
1102         if (sec_ctx != NULL) {
1103                 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
1104
1105                 if (!uctx)
1106                         goto out;
1107
1108                 err = security_xfrm_state_alloc(x, uctx);
1109                 kfree(uctx);
1110
1111                 if (err)
1112                         goto out;
1113         }
1114
1115         key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1];
1116         if (sa->sadb_sa_auth) {
1117                 int keysize = 0;
1118                 struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth);
1119                 if (!a) {
1120                         err = -ENOSYS;
1121                         goto out;
1122                 }
1123                 if (key)
1124                         keysize = (key->sadb_key_bits + 7) / 8;
1125                 x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
1126                 if (!x->aalg)
1127                         goto out;
1128                 strcpy(x->aalg->alg_name, a->name);
1129                 x->aalg->alg_key_len = 0;
1130                 if (key) {
1131                         x->aalg->alg_key_len = key->sadb_key_bits;
1132                         memcpy(x->aalg->alg_key, key+1, keysize);
1133                 }
1134                 x->props.aalgo = sa->sadb_sa_auth;
1135                 /* x->algo.flags = sa->sadb_sa_flags; */
1136         }
1137         if (sa->sadb_sa_encrypt) {
1138                 if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
1139                         struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt);
1140                         if (!a) {
1141                                 err = -ENOSYS;
1142                                 goto out;
1143                         }
1144                         x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
1145                         if (!x->calg)
1146                                 goto out;
1147                         strcpy(x->calg->alg_name, a->name);
1148                         x->props.calgo = sa->sadb_sa_encrypt;
1149                 } else {
1150                         int keysize = 0;
1151                         struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt);
1152                         if (!a) {
1153                                 err = -ENOSYS;
1154                                 goto out;
1155                         }
1156                         key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
1157                         if (key)
1158                                 keysize = (key->sadb_key_bits + 7) / 8;
1159                         x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
1160                         if (!x->ealg)
1161                                 goto out;
1162                         strcpy(x->ealg->alg_name, a->name);
1163                         x->ealg->alg_key_len = 0;
1164                         if (key) {
1165                                 x->ealg->alg_key_len = key->sadb_key_bits;
1166                                 memcpy(x->ealg->alg_key, key+1, keysize);
1167                         }
1168                         x->props.ealgo = sa->sadb_sa_encrypt;
1169                 }
1170         }
1171         /* x->algo.flags = sa->sadb_sa_flags; */
1172
1173         x->props.family = pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1174                                                     &x->props.saddr);
1175         if (!x->props.family) {
1176                 err = -EAFNOSUPPORT;
1177                 goto out;
1178         }
1179         pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1],
1180                                   &x->id.daddr);
1181
1182         if (ext_hdrs[SADB_X_EXT_SA2-1]) {
1183                 struct sadb_x_sa2 *sa2 = (void*)ext_hdrs[SADB_X_EXT_SA2-1];
1184                 int mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode);
1185                 if (mode < 0) {
1186                         err = -EINVAL;
1187                         goto out;
1188                 }
1189                 x->props.mode = mode;
1190                 x->props.reqid = sa2->sadb_x_sa2_reqid;
1191         }
1192
1193         if (ext_hdrs[SADB_EXT_ADDRESS_PROXY-1]) {
1194                 struct sadb_address *addr = ext_hdrs[SADB_EXT_ADDRESS_PROXY-1];
1195
1196                 /* Nobody uses this, but we try. */
1197                 x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, &x->sel.saddr);
1198                 x->sel.prefixlen_s = addr->sadb_address_prefixlen;
1199         }
1200
1201         if (!x->sel.family)
1202                 x->sel.family = x->props.family;
1203
1204         if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
1205                 struct sadb_x_nat_t_type* n_type;
1206                 struct xfrm_encap_tmpl *natt;
1207
1208                 x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
1209                 if (!x->encap)
1210                         goto out;
1211
1212                 natt = x->encap;
1213                 n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
1214                 natt->encap_type = n_type->sadb_x_nat_t_type_type;
1215
1216                 if (ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1]) {
1217                         struct sadb_x_nat_t_port* n_port =
1218                                 ext_hdrs[SADB_X_EXT_NAT_T_SPORT-1];
1219                         natt->encap_sport = n_port->sadb_x_nat_t_port_port;
1220                 }
1221                 if (ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1]) {
1222                         struct sadb_x_nat_t_port* n_port =
1223                                 ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1];
1224                         natt->encap_dport = n_port->sadb_x_nat_t_port_port;
1225                 }
1226         }
1227
1228         err = xfrm_init_state(x);
1229         if (err)
1230                 goto out;
1231
1232         x->km.seq = hdr->sadb_msg_seq;
1233         return x;
1234
1235 out:
1236         x->km.state = XFRM_STATE_DEAD;
1237         xfrm_state_put(x);
1238         return ERR_PTR(err);
1239 }
1240
1241 static int pfkey_reserved(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1242 {
1243         return -EOPNOTSUPP;
1244 }
1245
1246 static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1247 {
1248         struct sk_buff *resp_skb;
1249         struct sadb_x_sa2 *sa2;
1250         struct sadb_address *saddr, *daddr;
1251         struct sadb_msg *out_hdr;
1252         struct xfrm_state *x = NULL;
1253         int mode;
1254         u32 reqid;
1255         u8 proto;
1256         unsigned short family;
1257         xfrm_address_t *xsaddr = NULL, *xdaddr = NULL;
1258
1259         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1260                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1261                 return -EINVAL;
1262
1263         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1264         if (proto == 0)
1265                 return -EINVAL;
1266
1267         if ((sa2 = ext_hdrs[SADB_X_EXT_SA2-1]) != NULL) {
1268                 mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode);
1269                 if (mode < 0)
1270                         return -EINVAL;
1271                 reqid = sa2->sadb_x_sa2_reqid;
1272         } else {
1273                 mode = 0;
1274                 reqid = 0;
1275         }
1276
1277         saddr = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
1278         daddr = ext_hdrs[SADB_EXT_ADDRESS_DST-1];
1279
1280         family = ((struct sockaddr *)(saddr + 1))->sa_family;
1281         switch (family) {
1282         case AF_INET:
1283                 xdaddr = (xfrm_address_t *)&((struct sockaddr_in *)(daddr + 1))->sin_addr.s_addr;
1284                 xsaddr = (xfrm_address_t *)&((struct sockaddr_in *)(saddr + 1))->sin_addr.s_addr;
1285                 break;
1286 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1287         case AF_INET6:
1288                 xdaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(daddr + 1))->sin6_addr;
1289                 xsaddr = (xfrm_address_t *)&((struct sockaddr_in6 *)(saddr + 1))->sin6_addr;
1290                 break;
1291 #endif
1292         }
1293
1294         if (hdr->sadb_msg_seq) {
1295                 x = xfrm_find_acq_byseq(hdr->sadb_msg_seq);
1296                 if (x && xfrm_addr_cmp(&x->id.daddr, xdaddr, family)) {
1297                         xfrm_state_put(x);
1298                         x = NULL;
1299                 }
1300         }
1301
1302         if (!x)
1303                 x = xfrm_find_acq(mode, reqid, proto, xdaddr, xsaddr, 1, family);
1304
1305         if (x == NULL)
1306                 return -ENOENT;
1307
1308         resp_skb = ERR_PTR(-ENOENT);
1309
1310         spin_lock_bh(&x->lock);
1311         if (x->km.state != XFRM_STATE_DEAD) {
1312                 struct sadb_spirange *range = ext_hdrs[SADB_EXT_SPIRANGE-1];
1313                 u32 min_spi, max_spi;
1314
1315                 if (range != NULL) {
1316                         min_spi = range->sadb_spirange_min;
1317                         max_spi = range->sadb_spirange_max;
1318                 } else {
1319                         min_spi = 0x100;
1320                         max_spi = 0x0fffffff;
1321                 }
1322                 xfrm_alloc_spi(x, htonl(min_spi), htonl(max_spi));
1323                 if (x->id.spi)
1324                         resp_skb = pfkey_xfrm_state2msg(x, 0, 3);
1325         }
1326         spin_unlock_bh(&x->lock);
1327
1328         if (IS_ERR(resp_skb)) {
1329                 xfrm_state_put(x);
1330                 return  PTR_ERR(resp_skb);
1331         }
1332
1333         out_hdr = (struct sadb_msg *) resp_skb->data;
1334         out_hdr->sadb_msg_version = hdr->sadb_msg_version;
1335         out_hdr->sadb_msg_type = SADB_GETSPI;
1336         out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
1337         out_hdr->sadb_msg_errno = 0;
1338         out_hdr->sadb_msg_reserved = 0;
1339         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
1340         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
1341
1342         xfrm_state_put(x);
1343
1344         pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk);
1345
1346         return 0;
1347 }
1348
1349 static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1350 {
1351         struct xfrm_state *x;
1352
1353         if (hdr->sadb_msg_len != sizeof(struct sadb_msg)/8)
1354                 return -EOPNOTSUPP;
1355
1356         if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0)
1357                 return 0;
1358
1359         x = xfrm_find_acq_byseq(hdr->sadb_msg_seq);
1360         if (x == NULL)
1361                 return 0;
1362
1363         spin_lock_bh(&x->lock);
1364         if (x->km.state == XFRM_STATE_ACQ) {
1365                 x->km.state = XFRM_STATE_ERROR;
1366                 wake_up(&km_waitq);
1367         }
1368         spin_unlock_bh(&x->lock);
1369         xfrm_state_put(x);
1370         return 0;
1371 }
1372
1373 static inline int event2poltype(int event)
1374 {
1375         switch (event) {
1376         case XFRM_MSG_DELPOLICY:
1377                 return SADB_X_SPDDELETE;
1378         case XFRM_MSG_NEWPOLICY:
1379                 return SADB_X_SPDADD;
1380         case XFRM_MSG_UPDPOLICY:
1381                 return SADB_X_SPDUPDATE;
1382         case XFRM_MSG_POLEXPIRE:
1383         //      return SADB_X_SPDEXPIRE;
1384         default:
1385                 printk("pfkey: Unknown policy event %d\n", event);
1386                 break;
1387         }
1388
1389         return 0;
1390 }
1391
1392 static inline int event2keytype(int event)
1393 {
1394         switch (event) {
1395         case XFRM_MSG_DELSA:
1396                 return SADB_DELETE;
1397         case XFRM_MSG_NEWSA:
1398                 return SADB_ADD;
1399         case XFRM_MSG_UPDSA:
1400                 return SADB_UPDATE;
1401         case XFRM_MSG_EXPIRE:
1402                 return SADB_EXPIRE;
1403         default:
1404                 printk("pfkey: Unknown SA event %d\n", event);
1405                 break;
1406         }
1407
1408         return 0;
1409 }
1410
1411 /* ADD/UPD/DEL */
1412 static int key_notify_sa(struct xfrm_state *x, struct km_event *c)
1413 {
1414         struct sk_buff *skb;
1415         struct sadb_msg *hdr;
1416         int hsc = 3;
1417
1418         if (c->event == XFRM_MSG_DELSA)
1419                 hsc = 0;
1420
1421         skb = pfkey_xfrm_state2msg(x, 0, hsc);
1422
1423         if (IS_ERR(skb))
1424                 return PTR_ERR(skb);
1425
1426         hdr = (struct sadb_msg *) skb->data;
1427         hdr->sadb_msg_version = PF_KEY_V2;
1428         hdr->sadb_msg_type = event2keytype(c->event);
1429         hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
1430         hdr->sadb_msg_errno = 0;
1431         hdr->sadb_msg_reserved = 0;
1432         hdr->sadb_msg_seq = c->seq;
1433         hdr->sadb_msg_pid = c->pid;
1434
1435         pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
1436
1437         return 0;
1438 }
1439
1440 static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1441 {
1442         struct xfrm_state *x;
1443         int err;
1444         struct km_event c;
1445
1446         x = pfkey_msg2xfrm_state(hdr, ext_hdrs);
1447         if (IS_ERR(x))
1448                 return PTR_ERR(x);
1449
1450         xfrm_state_hold(x);
1451         if (hdr->sadb_msg_type == SADB_ADD)
1452                 err = xfrm_state_add(x);
1453         else
1454                 err = xfrm_state_update(x);
1455
1456         xfrm_audit_state_add(x, err ? 0 : 1,
1457                              audit_get_loginuid(current->audit_context), 0);
1458
1459         if (err < 0) {
1460                 x->km.state = XFRM_STATE_DEAD;
1461                 __xfrm_state_put(x);
1462                 goto out;
1463         }
1464
1465         if (hdr->sadb_msg_type == SADB_ADD)
1466                 c.event = XFRM_MSG_NEWSA;
1467         else
1468                 c.event = XFRM_MSG_UPDSA;
1469         c.seq = hdr->sadb_msg_seq;
1470         c.pid = hdr->sadb_msg_pid;
1471         km_state_notify(x, &c);
1472 out:
1473         xfrm_state_put(x);
1474         return err;
1475 }
1476
1477 static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1478 {
1479         struct xfrm_state *x;
1480         struct km_event c;
1481         int err;
1482
1483         if (!ext_hdrs[SADB_EXT_SA-1] ||
1484             !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1485                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1486                 return -EINVAL;
1487
1488         x = pfkey_xfrm_state_lookup(hdr, ext_hdrs);
1489         if (x == NULL)
1490                 return -ESRCH;
1491
1492         if ((err = security_xfrm_state_delete(x)))
1493                 goto out;
1494
1495         if (xfrm_state_kern(x)) {
1496                 err = -EPERM;
1497                 goto out;
1498         }
1499
1500         err = xfrm_state_delete(x);
1501
1502         if (err < 0)
1503                 goto out;
1504
1505         c.seq = hdr->sadb_msg_seq;
1506         c.pid = hdr->sadb_msg_pid;
1507         c.event = XFRM_MSG_DELSA;
1508         km_state_notify(x, &c);
1509 out:
1510         xfrm_audit_state_delete(x, err ? 0 : 1,
1511                                audit_get_loginuid(current->audit_context), 0);
1512         xfrm_state_put(x);
1513
1514         return err;
1515 }
1516
1517 static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1518 {
1519         __u8 proto;
1520         struct sk_buff *out_skb;
1521         struct sadb_msg *out_hdr;
1522         struct xfrm_state *x;
1523
1524         if (!ext_hdrs[SADB_EXT_SA-1] ||
1525             !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
1526                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]))
1527                 return -EINVAL;
1528
1529         x = pfkey_xfrm_state_lookup(hdr, ext_hdrs);
1530         if (x == NULL)
1531                 return -ESRCH;
1532
1533         out_skb = pfkey_xfrm_state2msg(x, 1, 3);
1534         proto = x->id.proto;
1535         xfrm_state_put(x);
1536         if (IS_ERR(out_skb))
1537                 return  PTR_ERR(out_skb);
1538
1539         out_hdr = (struct sadb_msg *) out_skb->data;
1540         out_hdr->sadb_msg_version = hdr->sadb_msg_version;
1541         out_hdr->sadb_msg_type = SADB_DUMP;
1542         out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
1543         out_hdr->sadb_msg_errno = 0;
1544         out_hdr->sadb_msg_reserved = 0;
1545         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
1546         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
1547         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk);
1548
1549         return 0;
1550 }
1551
1552 static struct sk_buff *compose_sadb_supported(struct sadb_msg *orig,
1553                                               gfp_t allocation)
1554 {
1555         struct sk_buff *skb;
1556         struct sadb_msg *hdr;
1557         int len, auth_len, enc_len, i;
1558
1559         auth_len = xfrm_count_auth_supported();
1560         if (auth_len) {
1561                 auth_len *= sizeof(struct sadb_alg);
1562                 auth_len += sizeof(struct sadb_supported);
1563         }
1564
1565         enc_len = xfrm_count_enc_supported();
1566         if (enc_len) {
1567                 enc_len *= sizeof(struct sadb_alg);
1568                 enc_len += sizeof(struct sadb_supported);
1569         }
1570
1571         len = enc_len + auth_len + sizeof(struct sadb_msg);
1572
1573         skb = alloc_skb(len + 16, allocation);
1574         if (!skb)
1575                 goto out_put_algs;
1576
1577         hdr = (struct sadb_msg *) skb_put(skb, sizeof(*hdr));
1578         pfkey_hdr_dup(hdr, orig);
1579         hdr->sadb_msg_errno = 0;
1580         hdr->sadb_msg_len = len / sizeof(uint64_t);
1581
1582         if (auth_len) {
1583                 struct sadb_supported *sp;
1584                 struct sadb_alg *ap;
1585
1586                 sp = (struct sadb_supported *) skb_put(skb, auth_len);
1587                 ap = (struct sadb_alg *) (sp + 1);
1588
1589                 sp->sadb_supported_len = auth_len / sizeof(uint64_t);
1590                 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
1591
1592                 for (i = 0; ; i++) {
1593                         struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
1594                         if (!aalg)
1595                                 break;
1596                         if (aalg->available)
1597                                 *ap++ = aalg->desc;
1598                 }
1599         }
1600
1601         if (enc_len) {
1602                 struct sadb_supported *sp;
1603                 struct sadb_alg *ap;
1604
1605                 sp = (struct sadb_supported *) skb_put(skb, enc_len);
1606                 ap = (struct sadb_alg *) (sp + 1);
1607
1608                 sp->sadb_supported_len = enc_len / sizeof(uint64_t);
1609                 sp->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT;
1610
1611                 for (i = 0; ; i++) {
1612                         struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
1613                         if (!ealg)
1614                                 break;
1615                         if (ealg->available)
1616                                 *ap++ = ealg->desc;
1617                 }
1618         }
1619
1620 out_put_algs:
1621         return skb;
1622 }
1623
1624 static int pfkey_register(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1625 {
1626         struct pfkey_sock *pfk = pfkey_sk(sk);
1627         struct sk_buff *supp_skb;
1628
1629         if (hdr->sadb_msg_satype > SADB_SATYPE_MAX)
1630                 return -EINVAL;
1631
1632         if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) {
1633                 if (pfk->registered&(1<<hdr->sadb_msg_satype))
1634                         return -EEXIST;
1635                 pfk->registered |= (1<<hdr->sadb_msg_satype);
1636         }
1637
1638         xfrm_probe_algs();
1639
1640         supp_skb = compose_sadb_supported(hdr, GFP_KERNEL);
1641         if (!supp_skb) {
1642                 if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC)
1643                         pfk->registered &= ~(1<<hdr->sadb_msg_satype);
1644
1645                 return -ENOBUFS;
1646         }
1647
1648         pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk);
1649
1650         return 0;
1651 }
1652
1653 static int key_notify_sa_flush(struct km_event *c)
1654 {
1655         struct sk_buff *skb;
1656         struct sadb_msg *hdr;
1657
1658         skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
1659         if (!skb)
1660                 return -ENOBUFS;
1661         hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
1662         hdr->sadb_msg_satype = pfkey_proto2satype(c->data.proto);
1663         hdr->sadb_msg_type = SADB_FLUSH;
1664         hdr->sadb_msg_seq = c->seq;
1665         hdr->sadb_msg_pid = c->pid;
1666         hdr->sadb_msg_version = PF_KEY_V2;
1667         hdr->sadb_msg_errno = (uint8_t) 0;
1668         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
1669
1670         pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
1671
1672         return 0;
1673 }
1674
1675 static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1676 {
1677         unsigned proto;
1678         struct km_event c;
1679         struct xfrm_audit audit_info;
1680         int err;
1681
1682         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1683         if (proto == 0)
1684                 return -EINVAL;
1685
1686         audit_info.loginuid = audit_get_loginuid(current->audit_context);
1687         audit_info.secid = 0;
1688         err = xfrm_state_flush(proto, &audit_info);
1689         if (err)
1690                 return err;
1691         c.data.proto = proto;
1692         c.seq = hdr->sadb_msg_seq;
1693         c.pid = hdr->sadb_msg_pid;
1694         c.event = XFRM_MSG_FLUSHSA;
1695         km_state_notify(NULL, &c);
1696
1697         return 0;
1698 }
1699
1700 struct pfkey_dump_data
1701 {
1702         struct sk_buff *skb;
1703         struct sadb_msg *hdr;
1704         struct sock *sk;
1705 };
1706
1707 static int dump_sa(struct xfrm_state *x, int count, void *ptr)
1708 {
1709         struct pfkey_dump_data *data = ptr;
1710         struct sk_buff *out_skb;
1711         struct sadb_msg *out_hdr;
1712
1713         out_skb = pfkey_xfrm_state2msg(x, 1, 3);
1714         if (IS_ERR(out_skb))
1715                 return PTR_ERR(out_skb);
1716
1717         out_hdr = (struct sadb_msg *) out_skb->data;
1718         out_hdr->sadb_msg_version = data->hdr->sadb_msg_version;
1719         out_hdr->sadb_msg_type = SADB_DUMP;
1720         out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
1721         out_hdr->sadb_msg_errno = 0;
1722         out_hdr->sadb_msg_reserved = 0;
1723         out_hdr->sadb_msg_seq = count;
1724         out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid;
1725         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk);
1726         return 0;
1727 }
1728
1729 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1730 {
1731         u8 proto;
1732         struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk };
1733
1734         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
1735         if (proto == 0)
1736                 return -EINVAL;
1737
1738         return xfrm_state_walk(proto, dump_sa, &data);
1739 }
1740
1741 static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
1742 {
1743         struct pfkey_sock *pfk = pfkey_sk(sk);
1744         int satype = hdr->sadb_msg_satype;
1745
1746         if (hdr->sadb_msg_len == (sizeof(*hdr) / sizeof(uint64_t))) {
1747                 /* XXX we mangle packet... */
1748                 hdr->sadb_msg_errno = 0;
1749                 if (satype != 0 && satype != 1)
1750                         return -EINVAL;
1751                 pfk->promisc = satype;
1752         }
1753         pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, BROADCAST_ALL, NULL);
1754         return 0;
1755 }
1756
1757 static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr)
1758 {
1759         int i;
1760         u32 reqid = *(u32*)ptr;
1761
1762         for (i=0; i<xp->xfrm_nr; i++) {
1763                 if (xp->xfrm_vec[i].reqid == reqid)
1764                         return -EEXIST;
1765         }
1766         return 0;
1767 }
1768
1769 static u32 gen_reqid(void)
1770 {
1771         u32 start;
1772         static u32 reqid = IPSEC_MANUAL_REQID_MAX;
1773
1774         start = reqid;
1775         do {
1776                 ++reqid;
1777                 if (reqid == 0)
1778                         reqid = IPSEC_MANUAL_REQID_MAX+1;
1779                 if (xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, check_reqid,
1780                                      (void*)&reqid) != -EEXIST)
1781                         return reqid;
1782         } while (reqid != start);
1783         return 0;
1784 }
1785
1786 static int
1787 parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
1788 {
1789         struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr;
1790         struct sockaddr_in *sin;
1791 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1792         struct sockaddr_in6 *sin6;
1793 #endif
1794         int mode;
1795
1796         if (xp->xfrm_nr >= XFRM_MAX_DEPTH)
1797                 return -ELOOP;
1798
1799         if (rq->sadb_x_ipsecrequest_mode == 0)
1800                 return -EINVAL;
1801
1802         t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */
1803         if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
1804                 return -EINVAL;
1805         t->mode = mode;
1806         if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE)
1807                 t->optional = 1;
1808         else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
1809                 t->reqid = rq->sadb_x_ipsecrequest_reqid;
1810                 if (t->reqid > IPSEC_MANUAL_REQID_MAX)
1811                         t->reqid = 0;
1812                 if (!t->reqid && !(t->reqid = gen_reqid()))
1813                         return -ENOBUFS;
1814         }
1815
1816         /* addresses present only in tunnel mode */
1817         if (t->mode == XFRM_MODE_TUNNEL) {
1818                 struct sockaddr *sa;
1819                 sa = (struct sockaddr *)(rq+1);
1820                 switch(sa->sa_family) {
1821                 case AF_INET:
1822                         sin = (struct sockaddr_in*)sa;
1823                         t->saddr.a4 = sin->sin_addr.s_addr;
1824                         sin++;
1825                         if (sin->sin_family != AF_INET)
1826                                 return -EINVAL;
1827                         t->id.daddr.a4 = sin->sin_addr.s_addr;
1828                         break;
1829 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1830                 case AF_INET6:
1831                         sin6 = (struct sockaddr_in6*)sa;
1832                         memcpy(t->saddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr));
1833                         sin6++;
1834                         if (sin6->sin6_family != AF_INET6)
1835                                 return -EINVAL;
1836                         memcpy(t->id.daddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr));
1837                         break;
1838 #endif
1839                 default:
1840                         return -EINVAL;
1841                 }
1842                 t->encap_family = sa->sa_family;
1843         } else
1844                 t->encap_family = xp->family;
1845
1846         /* No way to set this via kame pfkey */
1847         t->aalgos = t->ealgos = t->calgos = ~0;
1848         xp->xfrm_nr++;
1849         return 0;
1850 }
1851
1852 static int
1853 parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
1854 {
1855         int err;
1856         int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy);
1857         struct sadb_x_ipsecrequest *rq = (void*)(pol+1);
1858
1859         while (len >= sizeof(struct sadb_x_ipsecrequest)) {
1860                 if ((err = parse_ipsecrequest(xp, rq)) < 0)
1861                         return err;
1862                 len -= rq->sadb_x_ipsecrequest_len;
1863                 rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len);
1864         }
1865         return 0;
1866 }
1867
1868 static inline int pfkey_xfrm_policy2sec_ctx_size(struct xfrm_policy *xp)
1869 {
1870   struct xfrm_sec_ctx *xfrm_ctx = xp->security;
1871
1872         if (xfrm_ctx) {
1873                 int len = sizeof(struct sadb_x_sec_ctx);
1874                 len += xfrm_ctx->ctx_len;
1875                 return PFKEY_ALIGN8(len);
1876         }
1877         return 0;
1878 }
1879
1880 static int pfkey_xfrm_policy2msg_size(struct xfrm_policy *xp)
1881 {
1882         struct xfrm_tmpl *t;
1883         int sockaddr_size = pfkey_sockaddr_size(xp->family);
1884         int socklen = 0;
1885         int i;
1886
1887         for (i=0; i<xp->xfrm_nr; i++) {
1888                 t = xp->xfrm_vec + i;
1889                 socklen += (t->encap_family == AF_INET ?
1890                             sizeof(struct sockaddr_in) :
1891                             sizeof(struct sockaddr_in6));
1892         }
1893
1894         return sizeof(struct sadb_msg) +
1895                 (sizeof(struct sadb_lifetime) * 3) +
1896                 (sizeof(struct sadb_address) * 2) +
1897                 (sockaddr_size * 2) +
1898                 sizeof(struct sadb_x_policy) +
1899                 (xp->xfrm_nr * sizeof(struct sadb_x_ipsecrequest)) +
1900                 (socklen * 2) +
1901                 pfkey_xfrm_policy2sec_ctx_size(xp);
1902 }
1903
1904 static struct sk_buff * pfkey_xfrm_policy2msg_prep(struct xfrm_policy *xp)
1905 {
1906         struct sk_buff *skb;
1907         int size;
1908
1909         size = pfkey_xfrm_policy2msg_size(xp);
1910
1911         skb =  alloc_skb(size + 16, GFP_ATOMIC);
1912         if (skb == NULL)
1913                 return ERR_PTR(-ENOBUFS);
1914
1915         return skb;
1916 }
1917
1918 static int pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, int dir)
1919 {
1920         struct sadb_msg *hdr;
1921         struct sadb_address *addr;
1922         struct sadb_lifetime *lifetime;
1923         struct sadb_x_policy *pol;
1924         struct sockaddr_in   *sin;
1925         struct sadb_x_sec_ctx *sec_ctx;
1926         struct xfrm_sec_ctx *xfrm_ctx;
1927 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1928         struct sockaddr_in6  *sin6;
1929 #endif
1930         int i;
1931         int size;
1932         int sockaddr_size = pfkey_sockaddr_size(xp->family);
1933         int socklen = (xp->family == AF_INET ?
1934                        sizeof(struct sockaddr_in) :
1935                        sizeof(struct sockaddr_in6));
1936
1937         size = pfkey_xfrm_policy2msg_size(xp);
1938
1939         /* call should fill header later */
1940         hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
1941         memset(hdr, 0, size);   /* XXX do we need this ? */
1942
1943         /* src address */
1944         addr = (struct sadb_address*) skb_put(skb,
1945                                               sizeof(struct sadb_address)+sockaddr_size);
1946         addr->sadb_address_len =
1947                 (sizeof(struct sadb_address)+sockaddr_size)/
1948                         sizeof(uint64_t);
1949         addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
1950         addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto);
1951         addr->sadb_address_prefixlen = xp->selector.prefixlen_s;
1952         addr->sadb_address_reserved = 0;
1953         /* src address */
1954         if (xp->family == AF_INET) {
1955                 sin = (struct sockaddr_in *) (addr + 1);
1956                 sin->sin_family = AF_INET;
1957                 sin->sin_addr.s_addr = xp->selector.saddr.a4;
1958                 sin->sin_port = xp->selector.sport;
1959                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
1960         }
1961 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1962         else if (xp->family == AF_INET6) {
1963                 sin6 = (struct sockaddr_in6 *) (addr + 1);
1964                 sin6->sin6_family = AF_INET6;
1965                 sin6->sin6_port = xp->selector.sport;
1966                 sin6->sin6_flowinfo = 0;
1967                 memcpy(&sin6->sin6_addr, xp->selector.saddr.a6,
1968                        sizeof(struct in6_addr));
1969                 sin6->sin6_scope_id = 0;
1970         }
1971 #endif
1972         else
1973                 BUG();
1974
1975         /* dst address */
1976         addr = (struct sadb_address*) skb_put(skb,
1977                                               sizeof(struct sadb_address)+sockaddr_size);
1978         addr->sadb_address_len =
1979                 (sizeof(struct sadb_address)+sockaddr_size)/
1980                         sizeof(uint64_t);
1981         addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
1982         addr->sadb_address_proto = pfkey_proto_from_xfrm(xp->selector.proto);
1983         addr->sadb_address_prefixlen = xp->selector.prefixlen_d;
1984         addr->sadb_address_reserved = 0;
1985         if (xp->family == AF_INET) {
1986                 sin = (struct sockaddr_in *) (addr + 1);
1987                 sin->sin_family = AF_INET;
1988                 sin->sin_addr.s_addr = xp->selector.daddr.a4;
1989                 sin->sin_port = xp->selector.dport;
1990                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
1991         }
1992 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1993         else if (xp->family == AF_INET6) {
1994                 sin6 = (struct sockaddr_in6 *) (addr + 1);
1995                 sin6->sin6_family = AF_INET6;
1996                 sin6->sin6_port = xp->selector.dport;
1997                 sin6->sin6_flowinfo = 0;
1998                 memcpy(&sin6->sin6_addr, xp->selector.daddr.a6,
1999                        sizeof(struct in6_addr));
2000                 sin6->sin6_scope_id = 0;
2001         }
2002 #endif
2003         else
2004                 BUG();
2005
2006         /* hard time */
2007         lifetime = (struct sadb_lifetime *)  skb_put(skb,
2008                                                      sizeof(struct sadb_lifetime));
2009         lifetime->sadb_lifetime_len =
2010                 sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2011         lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
2012         lifetime->sadb_lifetime_allocations =  _X2KEY(xp->lft.hard_packet_limit);
2013         lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.hard_byte_limit);
2014         lifetime->sadb_lifetime_addtime = xp->lft.hard_add_expires_seconds;
2015         lifetime->sadb_lifetime_usetime = xp->lft.hard_use_expires_seconds;
2016         /* soft time */
2017         lifetime = (struct sadb_lifetime *)  skb_put(skb,
2018                                                      sizeof(struct sadb_lifetime));
2019         lifetime->sadb_lifetime_len =
2020                 sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2021         lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
2022         lifetime->sadb_lifetime_allocations =  _X2KEY(xp->lft.soft_packet_limit);
2023         lifetime->sadb_lifetime_bytes = _X2KEY(xp->lft.soft_byte_limit);
2024         lifetime->sadb_lifetime_addtime = xp->lft.soft_add_expires_seconds;
2025         lifetime->sadb_lifetime_usetime = xp->lft.soft_use_expires_seconds;
2026         /* current time */
2027         lifetime = (struct sadb_lifetime *)  skb_put(skb,
2028                                                      sizeof(struct sadb_lifetime));
2029         lifetime->sadb_lifetime_len =
2030                 sizeof(struct sadb_lifetime)/sizeof(uint64_t);
2031         lifetime->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
2032         lifetime->sadb_lifetime_allocations = xp->curlft.packets;
2033         lifetime->sadb_lifetime_bytes = xp->curlft.bytes;
2034         lifetime->sadb_lifetime_addtime = xp->curlft.add_time;
2035         lifetime->sadb_lifetime_usetime = xp->curlft.use_time;
2036
2037         pol = (struct sadb_x_policy *)  skb_put(skb, sizeof(struct sadb_x_policy));
2038         pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t);
2039         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
2040         pol->sadb_x_policy_type = IPSEC_POLICY_DISCARD;
2041         if (xp->action == XFRM_POLICY_ALLOW) {
2042                 if (xp->xfrm_nr)
2043                         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
2044                 else
2045                         pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
2046         }
2047         pol->sadb_x_policy_dir = dir+1;
2048         pol->sadb_x_policy_id = xp->index;
2049         pol->sadb_x_policy_priority = xp->priority;
2050
2051         for (i=0; i<xp->xfrm_nr; i++) {
2052                 struct sadb_x_ipsecrequest *rq;
2053                 struct xfrm_tmpl *t = xp->xfrm_vec + i;
2054                 int req_size;
2055                 int mode;
2056
2057                 req_size = sizeof(struct sadb_x_ipsecrequest);
2058                 if (t->mode == XFRM_MODE_TUNNEL)
2059                         req_size += ((t->encap_family == AF_INET ?
2060                                      sizeof(struct sockaddr_in) :
2061                                      sizeof(struct sockaddr_in6)) * 2);
2062                 else
2063                         size -= 2*socklen;
2064                 rq = (void*)skb_put(skb, req_size);
2065                 pol->sadb_x_policy_len += req_size/8;
2066                 memset(rq, 0, sizeof(*rq));
2067                 rq->sadb_x_ipsecrequest_len = req_size;
2068                 rq->sadb_x_ipsecrequest_proto = t->id.proto;
2069                 if ((mode = pfkey_mode_from_xfrm(t->mode)) < 0)
2070                         return -EINVAL;
2071                 rq->sadb_x_ipsecrequest_mode = mode;
2072                 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE;
2073                 if (t->reqid)
2074                         rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE;
2075                 if (t->optional)
2076                         rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE;
2077                 rq->sadb_x_ipsecrequest_reqid = t->reqid;
2078                 if (t->mode == XFRM_MODE_TUNNEL) {
2079                         switch (t->encap_family) {
2080                         case AF_INET:
2081                                 sin = (void*)(rq+1);
2082                                 sin->sin_family = AF_INET;
2083                                 sin->sin_addr.s_addr = t->saddr.a4;
2084                                 sin->sin_port = 0;
2085                                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
2086                                 sin++;
2087                                 sin->sin_family = AF_INET;
2088                                 sin->sin_addr.s_addr = t->id.daddr.a4;
2089                                 sin->sin_port = 0;
2090                                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
2091                                 break;
2092 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2093                         case AF_INET6:
2094                                 sin6 = (void*)(rq+1);
2095                                 sin6->sin6_family = AF_INET6;
2096                                 sin6->sin6_port = 0;
2097                                 sin6->sin6_flowinfo = 0;
2098                                 memcpy(&sin6->sin6_addr, t->saddr.a6,
2099                                        sizeof(struct in6_addr));
2100                                 sin6->sin6_scope_id = 0;
2101
2102                                 sin6++;
2103                                 sin6->sin6_family = AF_INET6;
2104                                 sin6->sin6_port = 0;
2105                                 sin6->sin6_flowinfo = 0;
2106                                 memcpy(&sin6->sin6_addr, t->id.daddr.a6,
2107                                        sizeof(struct in6_addr));
2108                                 sin6->sin6_scope_id = 0;
2109                                 break;
2110 #endif
2111                         default:
2112                                 break;
2113                         }
2114                 }
2115         }
2116
2117         /* security context */
2118         if ((xfrm_ctx = xp->security)) {
2119                 int ctx_size = pfkey_xfrm_policy2sec_ctx_size(xp);
2120
2121                 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, ctx_size);
2122                 sec_ctx->sadb_x_sec_len = ctx_size / sizeof(uint64_t);
2123                 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
2124                 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
2125                 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
2126                 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
2127                 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
2128                        xfrm_ctx->ctx_len);
2129         }
2130
2131         hdr->sadb_msg_len = size / sizeof(uint64_t);
2132         hdr->sadb_msg_reserved = atomic_read(&xp->refcnt);
2133
2134         return 0;
2135 }
2136
2137 static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
2138 {
2139         struct sk_buff *out_skb;
2140         struct sadb_msg *out_hdr;
2141         int err;
2142
2143         out_skb = pfkey_xfrm_policy2msg_prep(xp);
2144         if (IS_ERR(out_skb)) {
2145                 err = PTR_ERR(out_skb);
2146                 goto out;
2147         }
2148         err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
2149         if (err < 0)
2150                 return err;
2151
2152         out_hdr = (struct sadb_msg *) out_skb->data;
2153         out_hdr->sadb_msg_version = PF_KEY_V2;
2154
2155         if (c->data.byid && c->event == XFRM_MSG_DELPOLICY)
2156                 out_hdr->sadb_msg_type = SADB_X_SPDDELETE2;
2157         else
2158                 out_hdr->sadb_msg_type = event2poltype(c->event);
2159         out_hdr->sadb_msg_errno = 0;
2160         out_hdr->sadb_msg_seq = c->seq;
2161         out_hdr->sadb_msg_pid = c->pid;
2162         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
2163 out:
2164         return 0;
2165
2166 }
2167
2168 static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2169 {
2170         int err = 0;
2171         struct sadb_lifetime *lifetime;
2172         struct sadb_address *sa;
2173         struct sadb_x_policy *pol;
2174         struct xfrm_policy *xp;
2175         struct km_event c;
2176         struct sadb_x_sec_ctx *sec_ctx;
2177
2178         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2179                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
2180             !ext_hdrs[SADB_X_EXT_POLICY-1])
2181                 return -EINVAL;
2182
2183         pol = ext_hdrs[SADB_X_EXT_POLICY-1];
2184         if (pol->sadb_x_policy_type > IPSEC_POLICY_IPSEC)
2185                 return -EINVAL;
2186         if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX)
2187                 return -EINVAL;
2188
2189         xp = xfrm_policy_alloc(GFP_KERNEL);
2190         if (xp == NULL)
2191                 return -ENOBUFS;
2192
2193         xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ?
2194                       XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);
2195         xp->priority = pol->sadb_x_policy_priority;
2196
2197         sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2198         xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr);
2199         if (!xp->family) {
2200                 err = -EINVAL;
2201                 goto out;
2202         }
2203         xp->selector.family = xp->family;
2204         xp->selector.prefixlen_s = sa->sadb_address_prefixlen;
2205         xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2206         xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
2207         if (xp->selector.sport)
2208                 xp->selector.sport_mask = htons(0xffff);
2209
2210         sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1],
2211         pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr);
2212         xp->selector.prefixlen_d = sa->sadb_address_prefixlen;
2213
2214         /* Amusing, we set this twice.  KAME apps appear to set same value
2215          * in both addresses.
2216          */
2217         xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2218
2219         xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
2220         if (xp->selector.dport)
2221                 xp->selector.dport_mask = htons(0xffff);
2222
2223         sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
2224         if (sec_ctx != NULL) {
2225                 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
2226
2227                 if (!uctx) {
2228                         err = -ENOBUFS;
2229                         goto out;
2230                 }
2231
2232                 err = security_xfrm_policy_alloc(xp, uctx);
2233                 kfree(uctx);
2234
2235                 if (err)
2236                         goto out;
2237         }
2238
2239         xp->lft.soft_byte_limit = XFRM_INF;
2240         xp->lft.hard_byte_limit = XFRM_INF;
2241         xp->lft.soft_packet_limit = XFRM_INF;
2242         xp->lft.hard_packet_limit = XFRM_INF;
2243         if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD-1]) != NULL) {
2244                 xp->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
2245                 xp->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
2246                 xp->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime;
2247                 xp->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime;
2248         }
2249         if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) != NULL) {
2250                 xp->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);
2251                 xp->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);
2252                 xp->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;
2253                 xp->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;
2254         }
2255         xp->xfrm_nr = 0;
2256         if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
2257             (err = parse_ipsecrequests(xp, pol)) < 0)
2258                 goto out;
2259
2260         err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
2261                                  hdr->sadb_msg_type != SADB_X_SPDUPDATE);
2262
2263         xfrm_audit_policy_add(xp, err ? 0 : 1,
2264                              audit_get_loginuid(current->audit_context), 0);
2265
2266         if (err)
2267                 goto out;
2268
2269         if (hdr->sadb_msg_type == SADB_X_SPDUPDATE)
2270                 c.event = XFRM_MSG_UPDPOLICY;
2271         else
2272                 c.event = XFRM_MSG_NEWPOLICY;
2273
2274         c.seq = hdr->sadb_msg_seq;
2275         c.pid = hdr->sadb_msg_pid;
2276
2277         km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c);
2278         xfrm_pol_put(xp);
2279         return 0;
2280
2281 out:
2282         security_xfrm_policy_free(xp);
2283         kfree(xp);
2284         return err;
2285 }
2286
2287 static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2288 {
2289         int err;
2290         struct sadb_address *sa;
2291         struct sadb_x_policy *pol;
2292         struct xfrm_policy *xp, tmp;
2293         struct xfrm_selector sel;
2294         struct km_event c;
2295         struct sadb_x_sec_ctx *sec_ctx;
2296
2297         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2298                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
2299             !ext_hdrs[SADB_X_EXT_POLICY-1])
2300                 return -EINVAL;
2301
2302         pol = ext_hdrs[SADB_X_EXT_POLICY-1];
2303         if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX)
2304                 return -EINVAL;
2305
2306         memset(&sel, 0, sizeof(sel));
2307
2308         sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
2309         sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr);
2310         sel.prefixlen_s = sa->sadb_address_prefixlen;
2311         sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2312         sel.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
2313         if (sel.sport)
2314                 sel.sport_mask = htons(0xffff);
2315
2316         sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1],
2317         pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr);
2318         sel.prefixlen_d = sa->sadb_address_prefixlen;
2319         sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2320         sel.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
2321         if (sel.dport)
2322                 sel.dport_mask = htons(0xffff);
2323
2324         sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
2325         memset(&tmp, 0, sizeof(struct xfrm_policy));
2326
2327         if (sec_ctx != NULL) {
2328                 struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
2329
2330                 if (!uctx)
2331                         return -ENOMEM;
2332
2333                 err = security_xfrm_policy_alloc(&tmp, uctx);
2334                 kfree(uctx);
2335
2336                 if (err)
2337                         return err;
2338         }
2339
2340         xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1,
2341                                    &sel, tmp.security, 1, &err);
2342         security_xfrm_policy_free(&tmp);
2343
2344         if (xp == NULL)
2345                 return -ENOENT;
2346
2347         xfrm_audit_policy_delete(xp, err ? 0 : 1,
2348                                 audit_get_loginuid(current->audit_context), 0);
2349
2350         if (err)
2351                 goto out;
2352
2353         c.seq = hdr->sadb_msg_seq;
2354         c.pid = hdr->sadb_msg_pid;
2355         c.event = XFRM_MSG_DELPOLICY;
2356         km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c);
2357
2358 out:
2359         xfrm_pol_put(xp);
2360         return err;
2361 }
2362
2363 static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, struct sadb_msg *hdr, int dir)
2364 {
2365         int err;
2366         struct sk_buff *out_skb;
2367         struct sadb_msg *out_hdr;
2368         err = 0;
2369
2370         out_skb = pfkey_xfrm_policy2msg_prep(xp);
2371         if (IS_ERR(out_skb)) {
2372                 err =  PTR_ERR(out_skb);
2373                 goto out;
2374         }
2375         err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
2376         if (err < 0)
2377                 goto out;
2378
2379         out_hdr = (struct sadb_msg *) out_skb->data;
2380         out_hdr->sadb_msg_version = hdr->sadb_msg_version;
2381         out_hdr->sadb_msg_type = hdr->sadb_msg_type;
2382         out_hdr->sadb_msg_satype = 0;
2383         out_hdr->sadb_msg_errno = 0;
2384         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
2385         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
2386         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk);
2387         err = 0;
2388
2389 out:
2390         return err;
2391 }
2392
2393 #ifdef CONFIG_NET_KEY_MIGRATE
2394 static int pfkey_sockaddr_pair_size(sa_family_t family)
2395 {
2396         switch (family) {
2397         case AF_INET:
2398                 return PFKEY_ALIGN8(sizeof(struct sockaddr_in) * 2);
2399 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2400         case AF_INET6:
2401                 return PFKEY_ALIGN8(sizeof(struct sockaddr_in6) * 2);
2402 #endif
2403         default:
2404                 return 0;
2405         }
2406         /* NOTREACHED */
2407 }
2408
2409 static int parse_sockaddr_pair(struct sadb_x_ipsecrequest *rq,
2410                                xfrm_address_t *saddr, xfrm_address_t *daddr,
2411                                u16 *family)
2412 {
2413         struct sockaddr *sa = (struct sockaddr *)(rq + 1);
2414         if (rq->sadb_x_ipsecrequest_len <
2415             pfkey_sockaddr_pair_size(sa->sa_family))
2416                 return -EINVAL;
2417
2418         switch (sa->sa_family) {
2419         case AF_INET:
2420                 {
2421                         struct sockaddr_in *sin;
2422                         sin = (struct sockaddr_in *)sa;
2423                         if ((sin+1)->sin_family != AF_INET)
2424                                 return -EINVAL;
2425                         memcpy(&saddr->a4, &sin->sin_addr, sizeof(saddr->a4));
2426                         sin++;
2427                         memcpy(&daddr->a4, &sin->sin_addr, sizeof(daddr->a4));
2428                         *family = AF_INET;
2429                         break;
2430                 }
2431 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2432         case AF_INET6:
2433                 {
2434                         struct sockaddr_in6 *sin6;
2435                         sin6 = (struct sockaddr_in6 *)sa;
2436                         if ((sin6+1)->sin6_family != AF_INET6)
2437                                 return -EINVAL;
2438                         memcpy(&saddr->a6, &sin6->sin6_addr,
2439                                sizeof(saddr->a6));
2440                         sin6++;
2441                         memcpy(&daddr->a6, &sin6->sin6_addr,
2442                                sizeof(daddr->a6));
2443                         *family = AF_INET6;
2444                         break;
2445                 }
2446 #endif
2447         default:
2448                 return -EINVAL;
2449         }
2450
2451         return 0;
2452 }
2453
2454 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
2455                                     struct xfrm_migrate *m)
2456 {
2457         int err;
2458         struct sadb_x_ipsecrequest *rq2;
2459         int mode;
2460
2461         if (len <= sizeof(struct sadb_x_ipsecrequest) ||
2462             len < rq1->sadb_x_ipsecrequest_len)
2463                 return -EINVAL;
2464
2465         /* old endoints */
2466         err = parse_sockaddr_pair(rq1, &m->old_saddr, &m->old_daddr,
2467                                   &m->old_family);
2468         if (err)
2469                 return err;
2470
2471         rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
2472         len -= rq1->sadb_x_ipsecrequest_len;
2473
2474         if (len <= sizeof(struct sadb_x_ipsecrequest) ||
2475             len < rq2->sadb_x_ipsecrequest_len)
2476                 return -EINVAL;
2477
2478         /* new endpoints */
2479         err = parse_sockaddr_pair(rq2, &m->new_saddr, &m->new_daddr,
2480                                   &m->new_family);
2481         if (err)
2482                 return err;
2483
2484         if (rq1->sadb_x_ipsecrequest_proto != rq2->sadb_x_ipsecrequest_proto ||
2485             rq1->sadb_x_ipsecrequest_mode != rq2->sadb_x_ipsecrequest_mode ||
2486             rq1->sadb_x_ipsecrequest_reqid != rq2->sadb_x_ipsecrequest_reqid)
2487                 return -EINVAL;
2488
2489         m->proto = rq1->sadb_x_ipsecrequest_proto;
2490         if ((mode = pfkey_mode_to_xfrm(rq1->sadb_x_ipsecrequest_mode)) < 0)
2491                 return -EINVAL;
2492         m->mode = mode;
2493         m->reqid = rq1->sadb_x_ipsecrequest_reqid;
2494
2495         return ((int)(rq1->sadb_x_ipsecrequest_len +
2496                       rq2->sadb_x_ipsecrequest_len));
2497 }
2498
2499 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
2500                          struct sadb_msg *hdr, void **ext_hdrs)
2501 {
2502         int i, len, ret, err = -EINVAL;
2503         u8 dir;
2504         struct sadb_address *sa;
2505         struct sadb_x_policy *pol;
2506         struct sadb_x_ipsecrequest *rq;
2507         struct xfrm_selector sel;
2508         struct xfrm_migrate m[XFRM_MAX_DEPTH];
2509
2510         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
2511             ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
2512             !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
2513                 err = -EINVAL;
2514                 goto out;
2515         }
2516
2517         pol = ext_hdrs[SADB_X_EXT_POLICY - 1];
2518         if (!pol) {
2519                 err = -EINVAL;
2520                 goto out;
2521         }
2522
2523         if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) {
2524                 err = -EINVAL;
2525                 goto out;
2526         }
2527
2528         dir = pol->sadb_x_policy_dir - 1;
2529         memset(&sel, 0, sizeof(sel));
2530
2531         /* set source address info of selector */
2532         sa = ext_hdrs[SADB_EXT_ADDRESS_SRC - 1];
2533         sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr);
2534         sel.prefixlen_s = sa->sadb_address_prefixlen;
2535         sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2536         sel.sport = ((struct sockaddr_in *)(sa + 1))->sin_port;
2537         if (sel.sport)
2538                 sel.sport_mask = htons(0xffff);
2539
2540         /* set destination address info of selector */
2541         sa = ext_hdrs[SADB_EXT_ADDRESS_DST - 1],
2542         pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr);
2543         sel.prefixlen_d = sa->sadb_address_prefixlen;
2544         sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
2545         sel.dport = ((struct sockaddr_in *)(sa + 1))->sin_port;
2546         if (sel.dport)
2547                 sel.dport_mask = htons(0xffff);
2548
2549         rq = (struct sadb_x_ipsecrequest *)(pol + 1);
2550
2551         /* extract ipsecrequests */
2552         i = 0;
2553         len = pol->sadb_x_policy_len * 8 - sizeof(struct sadb_x_policy);
2554
2555         while (len > 0 && i < XFRM_MAX_DEPTH) {
2556                 ret = ipsecrequests_to_migrate(rq, len, &m[i]);
2557                 if (ret < 0) {
2558                         err = ret;
2559                         goto out;
2560                 } else {
2561                         rq = (struct sadb_x_ipsecrequest *)((u8 *)rq + ret);
2562                         len -= ret;
2563                         i++;
2564                 }
2565         }
2566
2567         if (!i || len > 0) {
2568                 err = -EINVAL;
2569                 goto out;
2570         }
2571
2572         return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i);
2573
2574  out:
2575         return err;
2576 }
2577 #else
2578 static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
2579                          struct sadb_msg *hdr, void **ext_hdrs)
2580 {
2581         return -ENOPROTOOPT;
2582 }
2583 #endif
2584
2585
2586 static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2587 {
2588         unsigned int dir;
2589         int err = 0, delete;
2590         struct sadb_x_policy *pol;
2591         struct xfrm_policy *xp;
2592         struct km_event c;
2593
2594         if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL)
2595                 return -EINVAL;
2596
2597         dir = xfrm_policy_id2dir(pol->sadb_x_policy_id);
2598         if (dir >= XFRM_POLICY_MAX)
2599                 return -EINVAL;
2600
2601         delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
2602         xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id,
2603                               delete, &err);
2604         if (xp == NULL)
2605                 return -ENOENT;
2606
2607         if (delete) {
2608                 xfrm_audit_policy_delete(xp, err ? 0 : 1,
2609                                 audit_get_loginuid(current->audit_context), 0);
2610
2611                 if (err)
2612                         goto out;
2613                 c.seq = hdr->sadb_msg_seq;
2614                 c.pid = hdr->sadb_msg_pid;
2615                 c.data.byid = 1;
2616                 c.event = XFRM_MSG_DELPOLICY;
2617                 km_policy_notify(xp, dir, &c);
2618         } else {
2619                 err = key_pol_get_resp(sk, xp, hdr, dir);
2620         }
2621
2622 out:
2623         xfrm_pol_put(xp);
2624         return err;
2625 }
2626
2627 static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
2628 {
2629         struct pfkey_dump_data *data = ptr;
2630         struct sk_buff *out_skb;
2631         struct sadb_msg *out_hdr;
2632         int err;
2633
2634         out_skb = pfkey_xfrm_policy2msg_prep(xp);
2635         if (IS_ERR(out_skb))
2636                 return PTR_ERR(out_skb);
2637
2638         err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
2639         if (err < 0)
2640                 return err;
2641
2642         out_hdr = (struct sadb_msg *) out_skb->data;
2643         out_hdr->sadb_msg_version = data->hdr->sadb_msg_version;
2644         out_hdr->sadb_msg_type = SADB_X_SPDDUMP;
2645         out_hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
2646         out_hdr->sadb_msg_errno = 0;
2647         out_hdr->sadb_msg_seq = count;
2648         out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid;
2649         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk);
2650         return 0;
2651 }
2652
2653 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2654 {
2655         struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk };
2656
2657         return xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_sp, &data);
2658 }
2659
2660 static int key_notify_policy_flush(struct km_event *c)
2661 {
2662         struct sk_buff *skb_out;
2663         struct sadb_msg *hdr;
2664
2665         skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
2666         if (!skb_out)
2667                 return -ENOBUFS;
2668         hdr = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg));
2669         hdr->sadb_msg_type = SADB_X_SPDFLUSH;
2670         hdr->sadb_msg_seq = c->seq;
2671         hdr->sadb_msg_pid = c->pid;
2672         hdr->sadb_msg_version = PF_KEY_V2;
2673         hdr->sadb_msg_errno = (uint8_t) 0;
2674         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
2675         pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL);
2676         return 0;
2677
2678 }
2679
2680 static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2681 {
2682         struct km_event c;
2683         struct xfrm_audit audit_info;
2684         int err;
2685
2686         audit_info.loginuid = audit_get_loginuid(current->audit_context);
2687         audit_info.secid = 0;
2688         err = xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info);
2689         if (err)
2690                 return err;
2691         c.data.type = XFRM_POLICY_TYPE_MAIN;
2692         c.event = XFRM_MSG_FLUSHPOLICY;
2693         c.pid = hdr->sadb_msg_pid;
2694         c.seq = hdr->sadb_msg_seq;
2695         km_policy_notify(NULL, 0, &c);
2696
2697         return 0;
2698 }
2699
2700 typedef int (*pfkey_handler)(struct sock *sk, struct sk_buff *skb,
2701                              struct sadb_msg *hdr, void **ext_hdrs);
2702 static pfkey_handler pfkey_funcs[SADB_MAX + 1] = {
2703         [SADB_RESERVED]         = pfkey_reserved,
2704         [SADB_GETSPI]           = pfkey_getspi,
2705         [SADB_UPDATE]           = pfkey_add,
2706         [SADB_ADD]              = pfkey_add,
2707         [SADB_DELETE]           = pfkey_delete,
2708         [SADB_GET]              = pfkey_get,
2709         [SADB_ACQUIRE]          = pfkey_acquire,
2710         [SADB_REGISTER]         = pfkey_register,
2711         [SADB_EXPIRE]           = NULL,
2712         [SADB_FLUSH]            = pfkey_flush,
2713         [SADB_DUMP]             = pfkey_dump,
2714         [SADB_X_PROMISC]        = pfkey_promisc,
2715         [SADB_X_PCHANGE]        = NULL,
2716         [SADB_X_SPDUPDATE]      = pfkey_spdadd,
2717         [SADB_X_SPDADD]         = pfkey_spdadd,
2718         [SADB_X_SPDDELETE]      = pfkey_spddelete,
2719         [SADB_X_SPDGET]         = pfkey_spdget,
2720         [SADB_X_SPDACQUIRE]     = NULL,
2721         [SADB_X_SPDDUMP]        = pfkey_spddump,
2722         [SADB_X_SPDFLUSH]       = pfkey_spdflush,
2723         [SADB_X_SPDSETIDX]      = pfkey_spdadd,
2724         [SADB_X_SPDDELETE2]     = pfkey_spdget,
2725         [SADB_X_MIGRATE]        = pfkey_migrate,
2726 };
2727
2728 static int pfkey_process(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr)
2729 {
2730         void *ext_hdrs[SADB_EXT_MAX];
2731         int err;
2732
2733         pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
2734                         BROADCAST_PROMISC_ONLY, NULL);
2735
2736         memset(ext_hdrs, 0, sizeof(ext_hdrs));
2737         err = parse_exthdrs(skb, hdr, ext_hdrs);
2738         if (!err) {
2739                 err = -EOPNOTSUPP;
2740                 if (pfkey_funcs[hdr->sadb_msg_type])
2741                         err = pfkey_funcs[hdr->sadb_msg_type](sk, skb, hdr, ext_hdrs);
2742         }
2743         return err;
2744 }
2745
2746 static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp)
2747 {
2748         struct sadb_msg *hdr = NULL;
2749
2750         if (skb->len < sizeof(*hdr)) {
2751                 *errp = -EMSGSIZE;
2752         } else {
2753                 hdr = (struct sadb_msg *) skb->data;
2754                 if (hdr->sadb_msg_version != PF_KEY_V2 ||
2755                     hdr->sadb_msg_reserved != 0 ||
2756                     (hdr->sadb_msg_type <= SADB_RESERVED ||
2757                      hdr->sadb_msg_type > SADB_MAX)) {
2758                         hdr = NULL;
2759                         *errp = -EINVAL;
2760                 } else if (hdr->sadb_msg_len != (skb->len /
2761                                                  sizeof(uint64_t)) ||
2762                            hdr->sadb_msg_len < (sizeof(struct sadb_msg) /
2763                                                 sizeof(uint64_t))) {
2764                         hdr = NULL;
2765                         *errp = -EMSGSIZE;
2766                 } else {
2767                         *errp = 0;
2768                 }
2769         }
2770         return hdr;
2771 }
2772
2773 static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
2774 {
2775         return t->aalgos & (1 << d->desc.sadb_alg_id);
2776 }
2777
2778 static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
2779 {
2780         return t->ealgos & (1 << d->desc.sadb_alg_id);
2781 }
2782
2783 static int count_ah_combs(struct xfrm_tmpl *t)
2784 {
2785         int i, sz = 0;
2786
2787         for (i = 0; ; i++) {
2788                 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
2789                 if (!aalg)
2790                         break;
2791                 if (aalg_tmpl_set(t, aalg) && aalg->available)
2792                         sz += sizeof(struct sadb_comb);
2793         }
2794         return sz + sizeof(struct sadb_prop);
2795 }
2796
2797 static int count_esp_combs(struct xfrm_tmpl *t)
2798 {
2799         int i, k, sz = 0;
2800
2801         for (i = 0; ; i++) {
2802                 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
2803                 if (!ealg)
2804                         break;
2805
2806                 if (!(ealg_tmpl_set(t, ealg) && ealg->available))
2807                         continue;
2808
2809                 for (k = 1; ; k++) {
2810                         struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k);
2811                         if (!aalg)
2812                                 break;
2813
2814                         if (aalg_tmpl_set(t, aalg) && aalg->available)
2815                                 sz += sizeof(struct sadb_comb);
2816                 }
2817         }
2818         return sz + sizeof(struct sadb_prop);
2819 }
2820
2821 static void dump_ah_combs(struct sk_buff *skb, struct xfrm_tmpl *t)
2822 {
2823         struct sadb_prop *p;
2824         int i;
2825
2826         p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop));
2827         p->sadb_prop_len = sizeof(struct sadb_prop)/8;
2828         p->sadb_prop_exttype = SADB_EXT_PROPOSAL;
2829         p->sadb_prop_replay = 32;
2830         memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved));
2831
2832         for (i = 0; ; i++) {
2833                 struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
2834                 if (!aalg)
2835                         break;
2836
2837                 if (aalg_tmpl_set(t, aalg) && aalg->available) {
2838                         struct sadb_comb *c;
2839                         c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
2840                         memset(c, 0, sizeof(*c));
2841                         p->sadb_prop_len += sizeof(struct sadb_comb)/8;
2842                         c->sadb_comb_auth = aalg->desc.sadb_alg_id;
2843                         c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits;
2844                         c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits;
2845                         c->sadb_comb_hard_addtime = 24*60*60;
2846                         c->sadb_comb_soft_addtime = 20*60*60;
2847                         c->sadb_comb_hard_usetime = 8*60*60;
2848                         c->sadb_comb_soft_usetime = 7*60*60;
2849                 }
2850         }
2851 }
2852
2853 static void dump_esp_combs(struct sk_buff *skb, struct xfrm_tmpl *t)
2854 {
2855         struct sadb_prop *p;
2856         int i, k;
2857
2858         p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop));
2859         p->sadb_prop_len = sizeof(struct sadb_prop)/8;
2860         p->sadb_prop_exttype = SADB_EXT_PROPOSAL;
2861         p->sadb_prop_replay = 32;
2862         memset(p->sadb_prop_reserved, 0, sizeof(p->sadb_prop_reserved));
2863
2864         for (i=0; ; i++) {
2865                 struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
2866                 if (!ealg)
2867                         break;
2868
2869                 if (!(ealg_tmpl_set(t, ealg) && ealg->available))
2870                         continue;
2871
2872                 for (k = 1; ; k++) {
2873                         struct sadb_comb *c;
2874                         struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k);
2875                         if (!aalg)
2876                                 break;
2877                         if (!(aalg_tmpl_set(t, aalg) && aalg->available))
2878                                 continue;
2879                         c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
2880                         memset(c, 0, sizeof(*c));
2881                         p->sadb_prop_len += sizeof(struct sadb_comb)/8;
2882                         c->sadb_comb_auth = aalg->desc.sadb_alg_id;
2883                         c->sadb_comb_auth_minbits = aalg->desc.sadb_alg_minbits;
2884                         c->sadb_comb_auth_maxbits = aalg->desc.sadb_alg_maxbits;
2885                         c->sadb_comb_encrypt = ealg->desc.sadb_alg_id;
2886                         c->sadb_comb_encrypt_minbits = ealg->desc.sadb_alg_minbits;
2887                         c->sadb_comb_encrypt_maxbits = ealg->desc.sadb_alg_maxbits;
2888                         c->sadb_comb_hard_addtime = 24*60*60;
2889                         c->sadb_comb_soft_addtime = 20*60*60;
2890                         c->sadb_comb_hard_usetime = 8*60*60;
2891                         c->sadb_comb_soft_usetime = 7*60*60;
2892                 }
2893         }
2894 }
2895
2896 static int key_notify_policy_expire(struct xfrm_policy *xp, struct km_event *c)
2897 {
2898         return 0;
2899 }
2900
2901 static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
2902 {
2903         struct sk_buff *out_skb;
2904         struct sadb_msg *out_hdr;
2905         int hard;
2906         int hsc;
2907
2908         hard = c->data.hard;
2909         if (hard)
2910                 hsc = 2;
2911         else
2912                 hsc = 1;
2913
2914         out_skb = pfkey_xfrm_state2msg(x, 0, hsc);
2915         if (IS_ERR(out_skb))
2916                 return PTR_ERR(out_skb);
2917
2918         out_hdr = (struct sadb_msg *) out_skb->data;
2919         out_hdr->sadb_msg_version = PF_KEY_V2;
2920         out_hdr->sadb_msg_type = SADB_EXPIRE;
2921         out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
2922         out_hdr->sadb_msg_errno = 0;
2923         out_hdr->sadb_msg_reserved = 0;
2924         out_hdr->sadb_msg_seq = 0;
2925         out_hdr->sadb_msg_pid = 0;
2926
2927         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
2928         return 0;
2929 }
2930
2931 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c)
2932 {
2933         switch (c->event) {
2934         case XFRM_MSG_EXPIRE:
2935                 return key_notify_sa_expire(x, c);
2936         case XFRM_MSG_DELSA:
2937         case XFRM_MSG_NEWSA:
2938         case XFRM_MSG_UPDSA:
2939                 return key_notify_sa(x, c);
2940         case XFRM_MSG_FLUSHSA:
2941                 return key_notify_sa_flush(c);
2942         case XFRM_MSG_NEWAE: /* not yet supported */
2943                 break;
2944         default:
2945                 printk("pfkey: Unknown SA event %d\n", c->event);
2946                 break;
2947         }
2948
2949         return 0;
2950 }
2951
2952 static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
2953 {
2954         if (xp && xp->type != XFRM_POLICY_TYPE_MAIN)
2955                 return 0;
2956
2957         switch (c->event) {
2958         case XFRM_MSG_POLEXPIRE:
2959                 return key_notify_policy_expire(xp, c);
2960         case XFRM_MSG_DELPOLICY:
2961         case XFRM_MSG_NEWPOLICY:
2962         case XFRM_MSG_UPDPOLICY:
2963                 return key_notify_policy(xp, dir, c);
2964         case XFRM_MSG_FLUSHPOLICY:
2965                 if (c->data.type != XFRM_POLICY_TYPE_MAIN)
2966                         break;
2967                 return key_notify_policy_flush(c);
2968         default:
2969                 printk("pfkey: Unknown policy event %d\n", c->event);
2970                 break;
2971         }
2972
2973         return 0;
2974 }
2975
2976 static u32 get_acqseq(void)
2977 {
2978         u32 res;
2979         static u32 acqseq;
2980         static DEFINE_SPINLOCK(acqseq_lock);
2981
2982         spin_lock_bh(&acqseq_lock);
2983         res = (++acqseq ? : ++acqseq);
2984         spin_unlock_bh(&acqseq_lock);
2985         return res;
2986 }
2987
2988 static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp, int dir)
2989 {
2990         struct sk_buff *skb;
2991         struct sadb_msg *hdr;
2992         struct sadb_address *addr;
2993         struct sadb_x_policy *pol;
2994         struct sockaddr_in *sin;
2995 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2996         struct sockaddr_in6 *sin6;
2997 #endif
2998         int sockaddr_size;
2999         int size;
3000         struct sadb_x_sec_ctx *sec_ctx;
3001         struct xfrm_sec_ctx *xfrm_ctx;
3002         int ctx_size = 0;
3003
3004         sockaddr_size = pfkey_sockaddr_size(x->props.family);
3005         if (!sockaddr_size)
3006                 return -EINVAL;
3007
3008         size = sizeof(struct sadb_msg) +
3009                 (sizeof(struct sadb_address) * 2) +
3010                 (sockaddr_size * 2) +
3011                 sizeof(struct sadb_x_policy);
3012
3013         if (x->id.proto == IPPROTO_AH)
3014                 size += count_ah_combs(t);
3015         else if (x->id.proto == IPPROTO_ESP)
3016                 size += count_esp_combs(t);
3017
3018         if ((xfrm_ctx = x->security)) {
3019                 ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
3020                 size +=  sizeof(struct sadb_x_sec_ctx) + ctx_size;
3021         }
3022
3023         skb =  alloc_skb(size + 16, GFP_ATOMIC);
3024         if (skb == NULL)
3025                 return -ENOMEM;
3026
3027         hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
3028         hdr->sadb_msg_version = PF_KEY_V2;
3029         hdr->sadb_msg_type = SADB_ACQUIRE;
3030         hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
3031         hdr->sadb_msg_len = size / sizeof(uint64_t);
3032         hdr->sadb_msg_errno = 0;
3033         hdr->sadb_msg_reserved = 0;
3034         hdr->sadb_msg_seq = x->km.seq = get_acqseq();
3035         hdr->sadb_msg_pid = 0;
3036
3037         /* src address */
3038         addr = (struct sadb_address*) skb_put(skb,
3039                                               sizeof(struct sadb_address)+sockaddr_size);
3040         addr->sadb_address_len =
3041                 (sizeof(struct sadb_address)+sockaddr_size)/
3042                         sizeof(uint64_t);
3043         addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
3044         addr->sadb_address_proto = 0;
3045         addr->sadb_address_reserved = 0;
3046         if (x->props.family == AF_INET) {
3047                 addr->sadb_address_prefixlen = 32;
3048
3049                 sin = (struct sockaddr_in *) (addr + 1);
3050                 sin->sin_family = AF_INET;
3051                 sin->sin_addr.s_addr = x->props.saddr.a4;
3052                 sin->sin_port = 0;
3053                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3054         }
3055 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3056         else if (x->props.family == AF_INET6) {
3057                 addr->sadb_address_prefixlen = 128;
3058
3059                 sin6 = (struct sockaddr_in6 *) (addr + 1);
3060                 sin6->sin6_family = AF_INET6;
3061                 sin6->sin6_port = 0;
3062                 sin6->sin6_flowinfo = 0;
3063                 memcpy(&sin6->sin6_addr,
3064                        x->props.saddr.a6, sizeof(struct in6_addr));
3065                 sin6->sin6_scope_id = 0;
3066         }
3067 #endif
3068         else
3069                 BUG();
3070
3071         /* dst address */
3072         addr = (struct sadb_address*) skb_put(skb,
3073                                               sizeof(struct sadb_address)+sockaddr_size);
3074         addr->sadb_address_len =
3075                 (sizeof(struct sadb_address)+sockaddr_size)/
3076                         sizeof(uint64_t);
3077         addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
3078         addr->sadb_address_proto = 0;
3079         addr->sadb_address_reserved = 0;
3080         if (x->props.family == AF_INET) {
3081                 addr->sadb_address_prefixlen = 32;
3082
3083                 sin = (struct sockaddr_in *) (addr + 1);
3084                 sin->sin_family = AF_INET;
3085                 sin->sin_addr.s_addr = x->id.daddr.a4;
3086                 sin->sin_port = 0;
3087                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3088         }
3089 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3090         else if (x->props.family == AF_INET6) {
3091                 addr->sadb_address_prefixlen = 128;
3092
3093                 sin6 = (struct sockaddr_in6 *) (addr + 1);
3094                 sin6->sin6_family = AF_INET6;
3095                 sin6->sin6_port = 0;
3096                 sin6->sin6_flowinfo = 0;
3097                 memcpy(&sin6->sin6_addr,
3098                        x->id.daddr.a6, sizeof(struct in6_addr));
3099                 sin6->sin6_scope_id = 0;
3100         }
3101 #endif
3102         else
3103                 BUG();
3104
3105         pol = (struct sadb_x_policy *)  skb_put(skb, sizeof(struct sadb_x_policy));
3106         pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t);
3107         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
3108         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
3109         pol->sadb_x_policy_dir = dir+1;
3110         pol->sadb_x_policy_id = xp->index;
3111
3112         /* Set sadb_comb's. */
3113         if (x->id.proto == IPPROTO_AH)
3114                 dump_ah_combs(skb, t);
3115         else if (x->id.proto == IPPROTO_ESP)
3116                 dump_esp_combs(skb, t);
3117
3118         /* security context */
3119         if (xfrm_ctx) {
3120                 sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
3121                                 sizeof(struct sadb_x_sec_ctx) + ctx_size);
3122                 sec_ctx->sadb_x_sec_len =
3123                   (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
3124                 sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
3125                 sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
3126                 sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
3127                 sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
3128                 memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
3129                        xfrm_ctx->ctx_len);
3130         }
3131
3132         return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
3133 }
3134
3135 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
3136                                                 u8 *data, int len, int *dir)
3137 {
3138         struct xfrm_policy *xp;
3139         struct sadb_x_policy *pol = (struct sadb_x_policy*)data;
3140         struct sadb_x_sec_ctx *sec_ctx;
3141
3142         switch (sk->sk_family) {
3143         case AF_INET:
3144                 if (opt != IP_IPSEC_POLICY) {
3145                         *dir = -EOPNOTSUPP;
3146                         return NULL;
3147                 }
3148                 break;
3149 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3150         case AF_INET6:
3151                 if (opt != IPV6_IPSEC_POLICY) {
3152                         *dir = -EOPNOTSUPP;
3153                         return NULL;
3154                 }
3155                 break;
3156 #endif
3157         default:
3158                 *dir = -EINVAL;
3159                 return NULL;
3160         }
3161
3162         *dir = -EINVAL;
3163
3164         if (len < sizeof(struct sadb_x_policy) ||
3165             pol->sadb_x_policy_len*8 > len ||
3166             pol->sadb_x_policy_type > IPSEC_POLICY_BYPASS ||
3167             (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir > IPSEC_DIR_OUTBOUND))
3168                 return NULL;
3169
3170         xp = xfrm_policy_alloc(GFP_ATOMIC);
3171         if (xp == NULL) {
3172                 *dir = -ENOBUFS;
3173                 return NULL;
3174         }
3175
3176         xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ?
3177                       XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);
3178
3179         xp->lft.soft_byte_limit = XFRM_INF;
3180         xp->lft.hard_byte_limit = XFRM_INF;
3181         xp->lft.soft_packet_limit = XFRM_INF;
3182         xp->lft.hard_packet_limit = XFRM_INF;
3183         xp->family = sk->sk_family;
3184
3185         xp->xfrm_nr = 0;
3186         if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
3187             (*dir = parse_ipsecrequests(xp, pol)) < 0)
3188                 goto out;
3189
3190         /* security context too */
3191         if (len >= (pol->sadb_x_policy_len*8 +
3192             sizeof(struct sadb_x_sec_ctx))) {
3193                 char *p = (char *)pol;
3194                 struct xfrm_user_sec_ctx *uctx;
3195
3196                 p += pol->sadb_x_policy_len*8;
3197                 sec_ctx = (struct sadb_x_sec_ctx *)p;
3198                 if (len < pol->sadb_x_policy_len*8 +
3199                     sec_ctx->sadb_x_sec_len) {
3200                         *dir = -EINVAL;
3201                         goto out;
3202                 }
3203                 if ((*dir = verify_sec_ctx_len(p)))
3204                         goto out;
3205                 uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
3206                 *dir = security_xfrm_policy_alloc(xp, uctx);
3207                 kfree(uctx);
3208
3209                 if (*dir)
3210                         goto out;
3211         }
3212
3213         *dir = pol->sadb_x_policy_dir-1;
3214         return xp;
3215
3216 out:
3217         security_xfrm_policy_free(xp);
3218         kfree(xp);
3219         return NULL;
3220 }
3221
3222 static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
3223 {
3224         struct sk_buff *skb;
3225         struct sadb_msg *hdr;
3226         struct sadb_sa *sa;
3227         struct sadb_address *addr;
3228         struct sadb_x_nat_t_port *n_port;
3229         struct sockaddr_in *sin;
3230 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3231         struct sockaddr_in6 *sin6;
3232 #endif
3233         int sockaddr_size;
3234         int size;
3235         __u8 satype = (x->id.proto == IPPROTO_ESP ? SADB_SATYPE_ESP : 0);
3236         struct xfrm_encap_tmpl *natt = NULL;
3237
3238         sockaddr_size = pfkey_sockaddr_size(x->props.family);
3239         if (!sockaddr_size)
3240                 return -EINVAL;
3241
3242         if (!satype)
3243                 return -EINVAL;
3244
3245         if (!x->encap)
3246                 return -EINVAL;
3247
3248         natt = x->encap;
3249
3250         /* Build an SADB_X_NAT_T_NEW_MAPPING message:
3251          *
3252          * HDR | SA | ADDRESS_SRC (old addr) | NAT_T_SPORT (old port) |
3253          * ADDRESS_DST (new addr) | NAT_T_DPORT (new port)
3254          */
3255
3256         size = sizeof(struct sadb_msg) +
3257                 sizeof(struct sadb_sa) +
3258                 (sizeof(struct sadb_address) * 2) +
3259                 (sockaddr_size * 2) +
3260                 (sizeof(struct sadb_x_nat_t_port) * 2);
3261
3262         skb =  alloc_skb(size + 16, GFP_ATOMIC);
3263         if (skb == NULL)
3264                 return -ENOMEM;
3265
3266         hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
3267         hdr->sadb_msg_version = PF_KEY_V2;
3268         hdr->sadb_msg_type = SADB_X_NAT_T_NEW_MAPPING;
3269         hdr->sadb_msg_satype = satype;
3270         hdr->sadb_msg_len = size / sizeof(uint64_t);
3271         hdr->sadb_msg_errno = 0;
3272         hdr->sadb_msg_reserved = 0;
3273         hdr->sadb_msg_seq = x->km.seq = get_acqseq();
3274         hdr->sadb_msg_pid = 0;
3275
3276         /* SA */
3277         sa = (struct sadb_sa *) skb_put(skb, sizeof(struct sadb_sa));
3278         sa->sadb_sa_len = sizeof(struct sadb_sa)/sizeof(uint64_t);
3279         sa->sadb_sa_exttype = SADB_EXT_SA;
3280         sa->sadb_sa_spi = x->id.spi;
3281         sa->sadb_sa_replay = 0;
3282         sa->sadb_sa_state = 0;
3283         sa->sadb_sa_auth = 0;
3284         sa->sadb_sa_encrypt = 0;
3285         sa->sadb_sa_flags = 0;
3286
3287         /* ADDRESS_SRC (old addr) */
3288         addr = (struct sadb_address*)
3289                 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size);
3290         addr->sadb_address_len =
3291                 (sizeof(struct sadb_address)+sockaddr_size)/
3292                         sizeof(uint64_t);
3293         addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
3294         addr->sadb_address_proto = 0;
3295         addr->sadb_address_reserved = 0;
3296         if (x->props.family == AF_INET) {
3297                 addr->sadb_address_prefixlen = 32;
3298
3299                 sin = (struct sockaddr_in *) (addr + 1);
3300                 sin->sin_family = AF_INET;
3301                 sin->sin_addr.s_addr = x->props.saddr.a4;
3302                 sin->sin_port = 0;
3303                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3304         }
3305 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3306         else if (x->props.family == AF_INET6) {
3307                 addr->sadb_address_prefixlen = 128;
3308
3309                 sin6 = (struct sockaddr_in6 *) (addr + 1);
3310                 sin6->sin6_family = AF_INET6;
3311                 sin6->sin6_port = 0;
3312                 sin6->sin6_flowinfo = 0;
3313                 memcpy(&sin6->sin6_addr,
3314                        x->props.saddr.a6, sizeof(struct in6_addr));
3315                 sin6->sin6_scope_id = 0;
3316         }
3317 #endif
3318         else
3319                 BUG();
3320
3321         /* NAT_T_SPORT (old port) */
3322         n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
3323         n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
3324         n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
3325         n_port->sadb_x_nat_t_port_port = natt->encap_sport;
3326         n_port->sadb_x_nat_t_port_reserved = 0;
3327
3328         /* ADDRESS_DST (new addr) */
3329         addr = (struct sadb_address*)
3330                 skb_put(skb, sizeof(struct sadb_address)+sockaddr_size);
3331         addr->sadb_address_len =
3332                 (sizeof(struct sadb_address)+sockaddr_size)/
3333                         sizeof(uint64_t);
3334         addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
3335         addr->sadb_address_proto = 0;
3336         addr->sadb_address_reserved = 0;
3337         if (x->props.family == AF_INET) {
3338                 addr->sadb_address_prefixlen = 32;
3339
3340                 sin = (struct sockaddr_in *) (addr + 1);
3341                 sin->sin_family = AF_INET;
3342                 sin->sin_addr.s_addr = ipaddr->a4;
3343                 sin->sin_port = 0;
3344                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3345         }
3346 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3347         else if (x->props.family == AF_INET6) {
3348                 addr->sadb_address_prefixlen = 128;
3349
3350                 sin6 = (struct sockaddr_in6 *) (addr + 1);
3351                 sin6->sin6_family = AF_INET6;
3352                 sin6->sin6_port = 0;
3353                 sin6->sin6_flowinfo = 0;
3354                 memcpy(&sin6->sin6_addr, &ipaddr->a6, sizeof(struct in6_addr));
3355                 sin6->sin6_scope_id = 0;
3356         }
3357 #endif
3358         else
3359                 BUG();
3360
3361         /* NAT_T_DPORT (new port) */
3362         n_port = (struct sadb_x_nat_t_port*) skb_put(skb, sizeof (*n_port));
3363         n_port->sadb_x_nat_t_port_len = sizeof(*n_port)/sizeof(uint64_t);
3364         n_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
3365         n_port->sadb_x_nat_t_port_port = sport;
3366         n_port->sadb_x_nat_t_port_reserved = 0;
3367
3368         return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
3369 }
3370
3371 #ifdef CONFIG_NET_KEY_MIGRATE
3372 static int set_sadb_address(struct sk_buff *skb, int sasize, int type,
3373                             struct xfrm_selector *sel)
3374 {
3375         struct sadb_address *addr;
3376         struct sockaddr_in *sin;
3377 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3378         struct sockaddr_in6 *sin6;
3379 #endif
3380         addr = (struct sadb_address *)skb_put(skb, sizeof(struct sadb_address) + sasize);
3381         addr->sadb_address_len = (sizeof(struct sadb_address) + sasize)/8;
3382         addr->sadb_address_exttype = type;
3383         addr->sadb_address_proto = sel->proto;
3384         addr->sadb_address_reserved = 0;
3385
3386         switch (type) {
3387         case SADB_EXT_ADDRESS_SRC:
3388                 if (sel->family == AF_INET) {
3389                         addr->sadb_address_prefixlen = sel->prefixlen_s;
3390                         sin = (struct sockaddr_in *)(addr + 1);
3391                         sin->sin_family = AF_INET;
3392                         memcpy(&sin->sin_addr.s_addr, &sel->saddr,
3393                                sizeof(sin->sin_addr.s_addr));
3394                         sin->sin_port = 0;
3395                         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3396                 }
3397 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3398                 else if (sel->family == AF_INET6) {
3399                         addr->sadb_address_prefixlen = sel->prefixlen_s;
3400                         sin6 = (struct sockaddr_in6 *)(addr + 1);
3401                         sin6->sin6_family = AF_INET6;
3402                         sin6->sin6_port = 0;
3403                         sin6->sin6_flowinfo = 0;
3404                         sin6->sin6_scope_id = 0;
3405                         memcpy(&sin6->sin6_addr.s6_addr, &sel->saddr,
3406                                sizeof(sin6->sin6_addr.s6_addr));
3407                 }
3408 #endif
3409                 break;
3410         case SADB_EXT_ADDRESS_DST:
3411                 if (sel->family == AF_INET) {
3412                         addr->sadb_address_prefixlen = sel->prefixlen_d;
3413                         sin = (struct sockaddr_in *)(addr + 1);
3414                         sin->sin_family = AF_INET;
3415                         memcpy(&sin->sin_addr.s_addr, &sel->daddr,
3416                                sizeof(sin->sin_addr.s_addr));
3417                         sin->sin_port = 0;
3418                         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
3419                 }
3420 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3421                 else if (sel->family == AF_INET6) {
3422                         addr->sadb_address_prefixlen = sel->prefixlen_d;
3423                         sin6 = (struct sockaddr_in6 *)(addr + 1);
3424                         sin6->sin6_family = AF_INET6;
3425                         sin6->sin6_port = 0;
3426                         sin6->sin6_flowinfo = 0;
3427                         sin6->sin6_scope_id = 0;
3428                         memcpy(&sin6->sin6_addr.s6_addr, &sel->daddr,
3429                                sizeof(sin6->sin6_addr.s6_addr));
3430                 }
3431 #endif
3432                 break;
3433         default:
3434                 return -EINVAL;
3435         }
3436
3437         return 0;
3438 }
3439
3440 static int set_ipsecrequest(struct sk_buff *skb,
3441                             uint8_t proto, uint8_t mode, int level,
3442                             uint32_t reqid, uint8_t family,
3443                             xfrm_address_t *src, xfrm_address_t *dst)
3444 {
3445         struct sadb_x_ipsecrequest *rq;
3446         struct sockaddr_in *sin;
3447 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3448         struct sockaddr_in6 *sin6;
3449 #endif
3450         int size_req;
3451
3452         size_req = sizeof(struct sadb_x_ipsecrequest) +
3453                    pfkey_sockaddr_pair_size(family);
3454
3455         rq = (struct sadb_x_ipsecrequest *)skb_put(skb, size_req);
3456         memset(rq, 0, size_req);
3457         rq->sadb_x_ipsecrequest_len = size_req;
3458         rq->sadb_x_ipsecrequest_proto = proto;
3459         rq->sadb_x_ipsecrequest_mode = mode;
3460         rq->sadb_x_ipsecrequest_level = level;
3461         rq->sadb_x_ipsecrequest_reqid = reqid;
3462
3463         switch (family) {
3464         case AF_INET:
3465                 sin = (struct sockaddr_in *)(rq + 1);
3466                 sin->sin_family = AF_INET;
3467                 memcpy(&sin->sin_addr.s_addr, src,
3468                        sizeof(sin->sin_addr.s_addr));
3469                 sin++;
3470                 sin->sin_family = AF_INET;
3471                 memcpy(&sin->sin_addr.s_addr, dst,
3472                        sizeof(sin->sin_addr.s_addr));
3473                 break;
3474 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3475         case AF_INET6:
3476                 sin6 = (struct sockaddr_in6 *)(rq + 1);
3477                 sin6->sin6_family = AF_INET6;
3478                 sin6->sin6_port = 0;
3479                 sin6->sin6_flowinfo = 0;
3480                 sin6->sin6_scope_id = 0;
3481                 memcpy(&sin6->sin6_addr.s6_addr, src,
3482                        sizeof(sin6->sin6_addr.s6_addr));
3483                 sin6++;
3484                 sin6->sin6_family = AF_INET6;
3485                 sin6->sin6_port = 0;
3486                 sin6->sin6_flowinfo = 0;
3487                 sin6->sin6_scope_id = 0;
3488                 memcpy(&sin6->sin6_addr.s6_addr, dst,
3489                        sizeof(sin6->sin6_addr.s6_addr));
3490                 break;
3491 #endif
3492         default:
3493                 return -EINVAL;
3494         }
3495
3496         return 0;
3497 }
3498 #endif
3499
3500 #ifdef CONFIG_NET_KEY_MIGRATE
3501 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
3502                               struct xfrm_migrate *m, int num_bundles)
3503 {
3504         int i;
3505         int sasize_sel;
3506         int size = 0;
3507         int size_pol = 0;
3508         struct sk_buff *skb;
3509         struct sadb_msg *hdr;
3510         struct sadb_x_policy *pol;
3511         struct xfrm_migrate *mp;
3512
3513         if (type != XFRM_POLICY_TYPE_MAIN)
3514                 return 0;
3515
3516         if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH)
3517                 return -EINVAL;
3518
3519         /* selector */
3520         sasize_sel = pfkey_sockaddr_size(sel->family);
3521         if (!sasize_sel)
3522                 return -EINVAL;
3523         size += (sizeof(struct sadb_address) + sasize_sel) * 2;
3524
3525         /* policy info */
3526         size_pol += sizeof(struct sadb_x_policy);
3527
3528         /* ipsecrequests */
3529         for (i = 0, mp = m; i < num_bundles; i++, mp++) {
3530                 /* old locator pair */
3531                 size_pol += sizeof(struct sadb_x_ipsecrequest) +
3532                             pfkey_sockaddr_pair_size(mp->old_family);
3533                 /* new locator pair */
3534                 size_pol += sizeof(struct sadb_x_ipsecrequest) +
3535                             pfkey_sockaddr_pair_size(mp->new_family);
3536         }
3537
3538         size += sizeof(struct sadb_msg) + size_pol;
3539
3540         /* alloc buffer */
3541         skb = alloc_skb(size, GFP_ATOMIC);
3542         if (skb == NULL)
3543                 return -ENOMEM;
3544
3545         hdr = (struct sadb_msg *)skb_put(skb, sizeof(struct sadb_msg));
3546         hdr->sadb_msg_version = PF_KEY_V2;
3547         hdr->sadb_msg_type = SADB_X_MIGRATE;
3548         hdr->sadb_msg_satype = pfkey_proto2satype(m->proto);
3549         hdr->sadb_msg_len = size / 8;
3550         hdr->sadb_msg_errno = 0;
3551         hdr->sadb_msg_reserved = 0;
3552         hdr->sadb_msg_seq = 0;
3553         hdr->sadb_msg_pid = 0;
3554
3555         /* selector src */
3556         set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel);
3557
3558         /* selector dst */
3559         set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_DST, sel);
3560
3561         /* policy information */
3562         pol = (struct sadb_x_policy *)skb_put(skb, sizeof(struct sadb_x_policy));
3563         pol->sadb_x_policy_len = size_pol / 8;
3564         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
3565         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
3566         pol->sadb_x_policy_dir = dir + 1;
3567         pol->sadb_x_policy_id = 0;
3568         pol->sadb_x_policy_priority = 0;
3569
3570         for (i = 0, mp = m; i < num_bundles; i++, mp++) {
3571                 /* old ipsecrequest */
3572                 int mode = pfkey_mode_from_xfrm(mp->mode);
3573                 if (mode < 0)
3574                         return -EINVAL;
3575                 if (set_ipsecrequest(skb, mp->proto, mode,
3576                                      (mp->reqid ?  IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
3577                                      mp->reqid, mp->old_family,
3578                                      &mp->old_saddr, &mp->old_daddr) < 0) {
3579                         return -EINVAL;
3580                 }
3581
3582                 /* new ipsecrequest */
3583                 if (set_ipsecrequest(skb, mp->proto, mode,
3584                                      (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
3585                                      mp->reqid, mp->new_family,
3586                                      &mp->new_saddr, &mp->new_daddr) < 0) {
3587                         return -EINVAL;
3588                 }
3589         }
3590
3591         /* broadcast migrate message to sockets */
3592         pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
3593
3594         return 0;
3595 }
3596 #else
3597 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
3598                               struct xfrm_migrate *m, int num_bundles)
3599 {
3600         return -ENOPROTOOPT;
3601 }
3602 #endif
3603
3604 static int pfkey_sendmsg(struct kiocb *kiocb,
3605                          struct socket *sock, struct msghdr *msg, size_t len)
3606 {
3607         struct sock *sk = sock->sk;
3608         struct sk_buff *skb = NULL;
3609         struct sadb_msg *hdr = NULL;
3610         int err;
3611
3612         err = -EOPNOTSUPP;
3613         if (msg->msg_flags & MSG_OOB)
3614                 goto out;
3615
3616         err = -EMSGSIZE;
3617         if ((unsigned)len > sk->sk_sndbuf - 32)
3618                 goto out;
3619
3620         err = -ENOBUFS;
3621         skb = alloc_skb(len, GFP_KERNEL);
3622         if (skb == NULL)
3623                 goto out;
3624
3625         err = -EFAULT;
3626         if (memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len))
3627                 goto out;
3628
3629         hdr = pfkey_get_base_msg(skb, &err);
3630         if (!hdr)
3631                 goto out;
3632
3633         mutex_lock(&xfrm_cfg_mutex);
3634         err = pfkey_process(sk, skb, hdr);
3635         mutex_unlock(&xfrm_cfg_mutex);
3636
3637 out:
3638         if (err && hdr && pfkey_error(hdr, err, sk) == 0)
3639                 err = 0;
3640         if (skb)
3641                 kfree_skb(skb);
3642
3643         return err ? : len;
3644 }
3645
3646 static int pfkey_recvmsg(struct kiocb *kiocb,
3647                          struct socket *sock, struct msghdr *msg, size_t len,
3648                          int flags)
3649 {
3650         struct sock *sk = sock->sk;
3651         struct sk_buff *skb;
3652         int copied, err;
3653
3654         err = -EINVAL;
3655         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
3656                 goto out;
3657
3658         msg->msg_namelen = 0;
3659         skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
3660         if (skb == NULL)
3661                 goto out;
3662
3663         copied = skb->len;
3664         if (copied > len) {
3665                 msg->msg_flags |= MSG_TRUNC;
3666                 copied = len;
3667         }
3668
3669         skb_reset_transport_header(skb);
3670         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
3671         if (err)
3672                 goto out_free;
3673
3674         sock_recv_timestamp(msg, sk, skb);
3675
3676         err = (flags & MSG_TRUNC) ? skb->len : copied;
3677
3678 out_free:
3679         skb_free_datagram(sk, skb);
3680 out:
3681         return err;
3682 }
3683
3684 static const struct proto_ops pfkey_ops = {
3685         .family         =       PF_KEY,
3686         .owner          =       THIS_MODULE,
3687         /* Operations that make no sense on pfkey sockets. */
3688         .bind           =       sock_no_bind,
3689         .connect        =       sock_no_connect,
3690         .socketpair     =       sock_no_socketpair,
3691         .accept         =       sock_no_accept,
3692         .getname        =       sock_no_getname,
3693         .ioctl          =       sock_no_ioctl,
3694         .listen         =       sock_no_listen,
3695         .shutdown       =       sock_no_shutdown,
3696         .setsockopt     =       sock_no_setsockopt,
3697         .getsockopt     =       sock_no_getsockopt,
3698         .mmap           =       sock_no_mmap,
3699         .sendpage       =       sock_no_sendpage,
3700
3701         /* Now the operations that really occur. */
3702         .release        =       pfkey_release,
3703         .poll           =       datagram_poll,
3704         .sendmsg        =       pfkey_sendmsg,
3705         .recvmsg        =       pfkey_recvmsg,
3706 };
3707
3708 static struct net_proto_family pfkey_family_ops = {
3709         .family =       PF_KEY,
3710         .create =       pfkey_create,
3711         .owner  =       THIS_MODULE,
3712 };
3713
3714 #ifdef CONFIG_PROC_FS
3715 static int pfkey_read_proc(char *buffer, char **start, off_t offset,
3716                            int length, int *eof, void *data)
3717 {
3718         off_t pos = 0;
3719         off_t begin = 0;
3720         int len = 0;
3721         struct sock *s;
3722         struct hlist_node *node;
3723
3724         len += sprintf(buffer,"sk       RefCnt Rmem   Wmem   User   Inode\n");
3725
3726         read_lock(&pfkey_table_lock);
3727
3728         sk_for_each(s, node, &pfkey_table) {
3729                 len += sprintf(buffer+len,"%p %-6d %-6u %-6u %-6u %-6lu",
3730                                s,
3731                                atomic_read(&s->sk_refcnt),
3732                                atomic_read(&s->sk_rmem_alloc),
3733                                atomic_read(&s->sk_wmem_alloc),
3734                                sock_i_uid(s),
3735                                sock_i_ino(s)
3736                                );
3737
3738                 buffer[len++] = '\n';
3739
3740                 pos = begin + len;
3741                 if (pos < offset) {
3742                         len = 0;
3743                         begin = pos;
3744                 }
3745                 if(pos > offset + length)
3746                         goto done;
3747         }
3748         *eof = 1;
3749
3750 done:
3751         read_unlock(&pfkey_table_lock);
3752
3753         *start = buffer + (offset - begin);
3754         len -= (offset - begin);
3755
3756         if (len > length)
3757                 len = length;
3758         if (len < 0)
3759                 len = 0;
3760
3761         return len;
3762 }
3763 #endif
3764
3765 static struct xfrm_mgr pfkeyv2_mgr =
3766 {
3767         .id             = "pfkeyv2",
3768         .notify         = pfkey_send_notify,
3769         .acquire        = pfkey_send_acquire,
3770         .compile_policy = pfkey_compile_policy,
3771         .new_mapping    = pfkey_send_new_mapping,
3772         .notify_policy  = pfkey_send_policy_notify,
3773         .migrate        = pfkey_send_migrate,
3774 };
3775
3776 static void __exit ipsec_pfkey_exit(void)
3777 {
3778         xfrm_unregister_km(&pfkeyv2_mgr);
3779         remove_proc_entry("net/pfkey", NULL);
3780         sock_unregister(PF_KEY);
3781         proto_unregister(&key_proto);
3782 }
3783
3784 static int __init ipsec_pfkey_init(void)
3785 {
3786         int err = proto_register(&key_proto, 0);
3787
3788         if (err != 0)
3789                 goto out;
3790
3791         err = sock_register(&pfkey_family_ops);
3792         if (err != 0)
3793                 goto out_unregister_key_proto;
3794 #ifdef CONFIG_PROC_FS
3795         err = -ENOMEM;
3796         if (create_proc_read_entry("net/pfkey", 0, NULL, pfkey_read_proc, NULL) == NULL)
3797                 goto out_sock_unregister;
3798 #endif
3799         err = xfrm_register_km(&pfkeyv2_mgr);
3800         if (err != 0)
3801                 goto out_remove_proc_entry;
3802 out:
3803         return err;
3804 out_remove_proc_entry:
3805 #ifdef CONFIG_PROC_FS
3806         remove_proc_entry("net/pfkey", NULL);
3807 out_sock_unregister:
3808 #endif
3809         sock_unregister(PF_KEY);
3810 out_unregister_key_proto:
3811         proto_unregister(&key_proto);
3812         goto out;
3813 }
3814
3815 module_init(ipsec_pfkey_init);
3816 module_exit(ipsec_pfkey_exit);
3817 MODULE_LICENSE("GPL");
3818 MODULE_ALIAS_NETPROTO(PF_KEY);