Commit 13c1d189 authored by Arnaud Ebalard's avatar Arnaud Ebalard Committed by David S. Miller

xfrm: MIGRATE enhancements (draft-ebalard-mext-pfkey-enhanced-migrate)

Provides implementation of the enhancements of XFRM/PF_KEY MIGRATE mechanism
specified in draft-ebalard-mext-pfkey-enhanced-migrate-00. Defines associated
PF_KEY SADB_X_EXT_KMADDRESS extension and XFRM/netlink XFRMA_KMADDRESS
attribute.
Signed-off-by: default avatarArnaud Ebalard <arno@natisbad.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 95430c0b
...@@ -226,6 +226,15 @@ struct sadb_x_sec_ctx { ...@@ -226,6 +226,15 @@ struct sadb_x_sec_ctx {
} __attribute__((packed)); } __attribute__((packed));
/* sizeof(struct sadb_sec_ctx) = 8 */ /* sizeof(struct sadb_sec_ctx) = 8 */
/* Used by MIGRATE to pass addresses IKE will use to perform
* negotiation with the peer */
struct sadb_x_kmaddress {
uint16_t sadb_x_kmaddress_len;
uint16_t sadb_x_kmaddress_exttype;
uint32_t sadb_x_kmaddress_reserved;
} __attribute__((packed));
/* sizeof(struct sadb_x_kmaddress) == 8 */
/* Message types */ /* Message types */
#define SADB_RESERVED 0 #define SADB_RESERVED 0
#define SADB_GETSPI 1 #define SADB_GETSPI 1
...@@ -346,7 +355,9 @@ struct sadb_x_sec_ctx { ...@@ -346,7 +355,9 @@ struct sadb_x_sec_ctx {
#define SADB_X_EXT_NAT_T_DPORT 22 #define SADB_X_EXT_NAT_T_DPORT 22
#define SADB_X_EXT_NAT_T_OA 23 #define SADB_X_EXT_NAT_T_OA 23
#define SADB_X_EXT_SEC_CTX 24 #define SADB_X_EXT_SEC_CTX 24
#define SADB_EXT_MAX 24 /* Used with MIGRATE to pass @ to IKE for negotiation */
#define SADB_X_EXT_KMADDRESS 25
#define SADB_EXT_MAX 25
/* Identity Extension values */ /* Identity Extension values */
#define SADB_IDENTTYPE_RESERVED 0 #define SADB_IDENTTYPE_RESERVED 0
......
...@@ -279,6 +279,7 @@ enum xfrm_attr_type_t { ...@@ -279,6 +279,7 @@ enum xfrm_attr_type_t {
XFRMA_POLICY_TYPE, /* struct xfrm_userpolicy_type */ XFRMA_POLICY_TYPE, /* struct xfrm_userpolicy_type */
XFRMA_MIGRATE, XFRMA_MIGRATE,
XFRMA_ALG_AEAD, /* struct xfrm_algo_aead */ XFRMA_ALG_AEAD, /* struct xfrm_algo_aead */
XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */
__XFRMA_MAX __XFRMA_MAX
#define XFRMA_MAX (__XFRMA_MAX - 1) #define XFRMA_MAX (__XFRMA_MAX - 1)
...@@ -415,6 +416,15 @@ struct xfrm_user_report { ...@@ -415,6 +416,15 @@ struct xfrm_user_report {
struct xfrm_selector sel; struct xfrm_selector sel;
}; };
/* Used by MIGRATE to pass addresses IKE should use to perform
* SA negotiation with the peer */
struct xfrm_user_kmaddress {
xfrm_address_t local;
xfrm_address_t remote;
__u32 reserved;
__u16 family;
};
struct xfrm_user_migrate { struct xfrm_user_migrate {
xfrm_address_t old_daddr; xfrm_address_t old_daddr;
xfrm_address_t old_saddr; xfrm_address_t old_saddr;
......
...@@ -492,6 +492,13 @@ struct xfrm_policy ...@@ -492,6 +492,13 @@ struct xfrm_policy
struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
}; };
struct xfrm_kmaddress {
xfrm_address_t local;
xfrm_address_t remote;
u32 reserved;
u16 family;
};
struct xfrm_migrate { struct xfrm_migrate {
xfrm_address_t old_daddr; xfrm_address_t old_daddr;
xfrm_address_t old_saddr; xfrm_address_t old_saddr;
...@@ -531,7 +538,7 @@ struct xfrm_mgr ...@@ -531,7 +538,7 @@ struct xfrm_mgr
int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c); int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
int (*report)(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); int (*report)(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles); int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
}; };
extern int xfrm_register_km(struct xfrm_mgr *km); extern int xfrm_register_km(struct xfrm_mgr *km);
...@@ -1432,12 +1439,14 @@ extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst, ...@@ -1432,12 +1439,14 @@ extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
#ifdef CONFIG_XFRM_MIGRATE #ifdef CONFIG_XFRM_MIGRATE
extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_bundles); struct xfrm_migrate *m, int num_bundles,
struct xfrm_kmaddress *k);
extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m); extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x, extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
struct xfrm_migrate *m); struct xfrm_migrate *m);
extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_bundles); struct xfrm_migrate *m, int num_bundles,
struct xfrm_kmaddress *k);
#endif #endif
extern wait_queue_head_t km_waitq; extern wait_queue_head_t km_waitq;
......
...@@ -398,6 +398,7 @@ static u8 sadb_ext_min_len[] = { ...@@ -398,6 +398,7 @@ static u8 sadb_ext_min_len[] = {
[SADB_X_EXT_NAT_T_DPORT] = (u8) sizeof(struct sadb_x_nat_t_port), [SADB_X_EXT_NAT_T_DPORT] = (u8) sizeof(struct sadb_x_nat_t_port),
[SADB_X_EXT_NAT_T_OA] = (u8) sizeof(struct sadb_address), [SADB_X_EXT_NAT_T_OA] = (u8) sizeof(struct sadb_address),
[SADB_X_EXT_SEC_CTX] = (u8) sizeof(struct sadb_x_sec_ctx), [SADB_X_EXT_SEC_CTX] = (u8) sizeof(struct sadb_x_sec_ctx),
[SADB_X_EXT_KMADDRESS] = (u8) sizeof(struct sadb_x_kmaddress),
}; };
/* Verify sadb_address_{len,prefixlen} against sa_family. */ /* Verify sadb_address_{len,prefixlen} against sa_family. */
...@@ -2384,24 +2385,21 @@ static int pfkey_sockaddr_pair_size(sa_family_t family) ...@@ -2384,24 +2385,21 @@ static int pfkey_sockaddr_pair_size(sa_family_t family)
return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2); return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
} }
static int parse_sockaddr_pair(struct sadb_x_ipsecrequest *rq, static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
xfrm_address_t *saddr, xfrm_address_t *daddr, xfrm_address_t *saddr, xfrm_address_t *daddr,
u16 *family) u16 *family)
{ {
u8 *sa = (u8 *) (rq + 1);
int af, socklen; int af, socklen;
if (rq->sadb_x_ipsecrequest_len < if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
pfkey_sockaddr_pair_size(((struct sockaddr *)sa)->sa_family))
return -EINVAL; return -EINVAL;
af = pfkey_sockaddr_extract((struct sockaddr *) sa, af = pfkey_sockaddr_extract(sa, saddr);
saddr);
if (!af) if (!af)
return -EINVAL; return -EINVAL;
socklen = pfkey_sockaddr_len(af); socklen = pfkey_sockaddr_len(af);
if (pfkey_sockaddr_extract((struct sockaddr *) (sa + socklen), if (pfkey_sockaddr_extract((struct sockaddr *) (((u8 *)sa) + socklen),
daddr) != af) daddr) != af)
return -EINVAL; return -EINVAL;
...@@ -2421,7 +2419,9 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, ...@@ -2421,7 +2419,9 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
return -EINVAL; return -EINVAL;
/* old endoints */ /* old endoints */
err = parse_sockaddr_pair(rq1, &m->old_saddr, &m->old_daddr, err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
rq1->sadb_x_ipsecrequest_len,
&m->old_saddr, &m->old_daddr,
&m->old_family); &m->old_family);
if (err) if (err)
return err; return err;
...@@ -2434,7 +2434,9 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, ...@@ -2434,7 +2434,9 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
return -EINVAL; return -EINVAL;
/* new endpoints */ /* new endpoints */
err = parse_sockaddr_pair(rq2, &m->new_saddr, &m->new_daddr, err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
rq2->sadb_x_ipsecrequest_len,
&m->new_saddr, &m->new_daddr,
&m->new_family); &m->new_family);
if (err) if (err)
return err; return err;
...@@ -2460,29 +2462,40 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, ...@@ -2460,29 +2462,40 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
int i, len, ret, err = -EINVAL; int i, len, ret, err = -EINVAL;
u8 dir; u8 dir;
struct sadb_address *sa; struct sadb_address *sa;
struct sadb_x_kmaddress *kma;
struct sadb_x_policy *pol; struct sadb_x_policy *pol;
struct sadb_x_ipsecrequest *rq; struct sadb_x_ipsecrequest *rq;
struct xfrm_selector sel; struct xfrm_selector sel;
struct xfrm_migrate m[XFRM_MAX_DEPTH]; struct xfrm_migrate m[XFRM_MAX_DEPTH];
struct xfrm_kmaddress k;
if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1], if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) || ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
!ext_hdrs[SADB_X_EXT_POLICY - 1]) { !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
err = -EINVAL; err = -EINVAL;
goto out; goto out;
} }
kma = ext_hdrs[SADB_X_EXT_KMADDRESS - 1];
pol = ext_hdrs[SADB_X_EXT_POLICY - 1]; pol = ext_hdrs[SADB_X_EXT_POLICY - 1];
if (!pol) {
err = -EINVAL;
goto out;
}
if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) { if (pol->sadb_x_policy_dir >= IPSEC_DIR_MAX) {
err = -EINVAL; err = -EINVAL;
goto out; goto out;
} }
if (kma) {
/* convert sadb_x_kmaddress to xfrm_kmaddress */
k.reserved = kma->sadb_x_kmaddress_reserved;
ret = parse_sockaddr_pair((struct sockaddr *)(kma + 1),
8*(kma->sadb_x_kmaddress_len) - sizeof(*kma),
&k.local, &k.remote, &k.family);
if (ret < 0) {
err = ret;
goto out;
}
}
dir = pol->sadb_x_policy_dir - 1; dir = pol->sadb_x_policy_dir - 1;
memset(&sel, 0, sizeof(sel)); memset(&sel, 0, sizeof(sel));
...@@ -2527,7 +2540,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, ...@@ -2527,7 +2540,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
goto out; goto out;
} }
return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i); return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i,
kma ? &k : NULL);
out: out:
return err; return err;
...@@ -3319,6 +3333,32 @@ static int set_sadb_address(struct sk_buff *skb, int sasize, int type, ...@@ -3319,6 +3333,32 @@ static int set_sadb_address(struct sk_buff *skb, int sasize, int type,
return 0; return 0;
} }
static int set_sadb_kmaddress(struct sk_buff *skb, struct xfrm_kmaddress *k)
{
struct sadb_x_kmaddress *kma;
u8 *sa;
int family = k->family;
int socklen = pfkey_sockaddr_len(family);
int size_req;
size_req = (sizeof(struct sadb_x_kmaddress) +
pfkey_sockaddr_pair_size(family));
kma = (struct sadb_x_kmaddress *)skb_put(skb, size_req);
memset(kma, 0, size_req);
kma->sadb_x_kmaddress_len = size_req / 8;
kma->sadb_x_kmaddress_exttype = SADB_X_EXT_KMADDRESS;
kma->sadb_x_kmaddress_reserved = k->reserved;
sa = (u8 *)(kma + 1);
if (!pfkey_sockaddr_fill(&k->local, 0, (struct sockaddr *)sa, family) ||
!pfkey_sockaddr_fill(&k->remote, 0, (struct sockaddr *)(sa+socklen), family))
return -EINVAL;
return 0;
}
static int set_ipsecrequest(struct sk_buff *skb, static int set_ipsecrequest(struct sk_buff *skb,
uint8_t proto, uint8_t mode, int level, uint8_t proto, uint8_t mode, int level,
uint32_t reqid, uint8_t family, uint32_t reqid, uint8_t family,
...@@ -3351,7 +3391,8 @@ static int set_ipsecrequest(struct sk_buff *skb, ...@@ -3351,7 +3391,8 @@ static int set_ipsecrequest(struct sk_buff *skb,
#ifdef CONFIG_NET_KEY_MIGRATE #ifdef CONFIG_NET_KEY_MIGRATE
static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_bundles) struct xfrm_migrate *m, int num_bundles,
struct xfrm_kmaddress *k)
{ {
int i; int i;
int sasize_sel; int sasize_sel;
...@@ -3368,6 +3409,12 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, ...@@ -3368,6 +3409,12 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH) if (num_bundles <= 0 || num_bundles > XFRM_MAX_DEPTH)
return -EINVAL; return -EINVAL;
if (k != NULL) {
/* addresses for KM */
size += PFKEY_ALIGN8(sizeof(struct sadb_x_kmaddress) +
pfkey_sockaddr_pair_size(k->family));
}
/* selector */ /* selector */
sasize_sel = pfkey_sockaddr_size(sel->family); sasize_sel = pfkey_sockaddr_size(sel->family);
if (!sasize_sel) if (!sasize_sel)
...@@ -3404,6 +3451,10 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, ...@@ -3404,6 +3451,10 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
hdr->sadb_msg_seq = 0; hdr->sadb_msg_seq = 0;
hdr->sadb_msg_pid = 0; hdr->sadb_msg_pid = 0;
/* Addresses to be used by KM for negotiation, if ext is available */
if (k != NULL && (set_sadb_kmaddress(skb, k) < 0))
return -EINVAL;
/* selector src */ /* selector src */
set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel); set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel);
...@@ -3449,7 +3500,8 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, ...@@ -3449,7 +3500,8 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
} }
#else #else
static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_bundles) struct xfrm_migrate *m, int num_bundles,
struct xfrm_kmaddress *k)
{ {
return -ENOPROTOOPT; return -ENOPROTOOPT;
} }
......
...@@ -2679,7 +2679,8 @@ static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate) ...@@ -2679,7 +2679,8 @@ static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate)
} }
int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_migrate) struct xfrm_migrate *m, int num_migrate,
struct xfrm_kmaddress *k)
{ {
int i, err, nx_cur = 0, nx_new = 0; int i, err, nx_cur = 0, nx_new = 0;
struct xfrm_policy *pol = NULL; struct xfrm_policy *pol = NULL;
...@@ -2723,7 +2724,7 @@ int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, ...@@ -2723,7 +2724,7 @@ int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
} }
/* Stage 5 - announce */ /* Stage 5 - announce */
km_migrate(sel, dir, type, m, num_migrate); km_migrate(sel, dir, type, m, num_migrate, k);
xfrm_pol_put(pol); xfrm_pol_put(pol);
......
...@@ -1814,7 +1814,8 @@ EXPORT_SYMBOL(km_policy_expired); ...@@ -1814,7 +1814,8 @@ EXPORT_SYMBOL(km_policy_expired);
#ifdef CONFIG_XFRM_MIGRATE #ifdef CONFIG_XFRM_MIGRATE
int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_migrate) struct xfrm_migrate *m, int num_migrate,
struct xfrm_kmaddress *k)
{ {
int err = -EINVAL; int err = -EINVAL;
int ret; int ret;
...@@ -1823,7 +1824,7 @@ int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, ...@@ -1823,7 +1824,7 @@ int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
read_lock(&xfrm_km_lock); read_lock(&xfrm_km_lock);
list_for_each_entry(km, &xfrm_km_list, list) { list_for_each_entry(km, &xfrm_km_list, list) {
if (km->migrate) { if (km->migrate) {
ret = km->migrate(sel, dir, type, m, num_migrate); ret = km->migrate(sel, dir, type, m, num_migrate, k);
if (!ret) if (!ret)
err = ret; err = ret;
} }
......
...@@ -1710,12 +1710,23 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1710,12 +1710,23 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
#ifdef CONFIG_XFRM_MIGRATE #ifdef CONFIG_XFRM_MIGRATE
static int copy_from_user_migrate(struct xfrm_migrate *ma, static int copy_from_user_migrate(struct xfrm_migrate *ma,
struct xfrm_kmaddress *k,
struct nlattr **attrs, int *num) struct nlattr **attrs, int *num)
{ {
struct nlattr *rt = attrs[XFRMA_MIGRATE]; struct nlattr *rt = attrs[XFRMA_MIGRATE];
struct xfrm_user_migrate *um; struct xfrm_user_migrate *um;
int i, num_migrate; int i, num_migrate;
if (k != NULL) {
struct xfrm_user_kmaddress *uk;
uk = nla_data(attrs[XFRMA_KMADDRESS]);
memcpy(&k->local, &uk->local, sizeof(k->local));
memcpy(&k->remote, &uk->remote, sizeof(k->remote));
k->family = uk->family;
k->reserved = uk->reserved;
}
um = nla_data(rt); um = nla_data(rt);
num_migrate = nla_len(rt) / sizeof(*um); num_migrate = nla_len(rt) / sizeof(*um);
...@@ -1745,6 +1756,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1745,6 +1756,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
{ {
struct xfrm_userpolicy_id *pi = nlmsg_data(nlh); struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
struct xfrm_migrate m[XFRM_MAX_DEPTH]; struct xfrm_migrate m[XFRM_MAX_DEPTH];
struct xfrm_kmaddress km, *kmp;
u8 type; u8 type;
int err; int err;
int n = 0; int n = 0;
...@@ -1752,19 +1764,20 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1752,19 +1764,20 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
if (attrs[XFRMA_MIGRATE] == NULL) if (attrs[XFRMA_MIGRATE] == NULL)
return -EINVAL; return -EINVAL;
kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;
err = copy_from_user_policy_type(&type, attrs); err = copy_from_user_policy_type(&type, attrs);
if (err) if (err)
return err; return err;
err = copy_from_user_migrate((struct xfrm_migrate *)m, err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
attrs, &n);
if (err) if (err)
return err; return err;
if (!n) if (!n)
return 0; return 0;
xfrm_migrate(&pi->sel, pi->dir, type, m, n); xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
return 0; return 0;
} }
...@@ -1795,16 +1808,30 @@ static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb) ...@@ -1795,16 +1808,30 @@ static int copy_to_user_migrate(struct xfrm_migrate *m, struct sk_buff *skb)
return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um); return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
} }
static inline size_t xfrm_migrate_msgsize(int num_migrate) static int copy_to_user_kmaddress(struct xfrm_kmaddress *k, struct sk_buff *skb)
{
struct xfrm_user_kmaddress uk;
memset(&uk, 0, sizeof(uk));
uk.family = k->family;
uk.reserved = k->reserved;
memcpy(&uk.local, &k->local, sizeof(uk.local));
memcpy(&uk.remote, &k->local, sizeof(uk.remote));
return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
}
static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
{ {
return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id)) return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
+ nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate) + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
+ userpolicy_type_attrsize(); + nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
+ userpolicy_type_attrsize();
} }
static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m, static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
int num_migrate, struct xfrm_selector *sel, int num_migrate, struct xfrm_kmaddress *k,
u8 dir, u8 type) struct xfrm_selector *sel, u8 dir, u8 type)
{ {
struct xfrm_migrate *mp; struct xfrm_migrate *mp;
struct xfrm_userpolicy_id *pol_id; struct xfrm_userpolicy_id *pol_id;
...@@ -1821,6 +1848,9 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m, ...@@ -1821,6 +1848,9 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
memcpy(&pol_id->sel, sel, sizeof(pol_id->sel)); memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
pol_id->dir = dir; pol_id->dir = dir;
if (k != NULL && (copy_to_user_kmaddress(k, skb) < 0))
goto nlmsg_failure;
if (copy_to_user_policy_type(type, skb) < 0) if (copy_to_user_policy_type(type, skb) < 0)
goto nlmsg_failure; goto nlmsg_failure;
...@@ -1836,23 +1866,25 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m, ...@@ -1836,23 +1866,25 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
} }
static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_migrate) struct xfrm_migrate *m, int num_migrate,
struct xfrm_kmaddress *k)
{ {
struct sk_buff *skb; struct sk_buff *skb;
skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate), GFP_ATOMIC); skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
if (skb == NULL) if (skb == NULL)
return -ENOMEM; return -ENOMEM;
/* build migrate */ /* build migrate */
if (build_migrate(skb, m, num_migrate, sel, dir, type) < 0) if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
BUG(); BUG();
return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC); return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
} }
#else #else
static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
struct xfrm_migrate *m, int num_migrate) struct xfrm_migrate *m, int num_migrate,
struct xfrm_kmaddress *k)
{ {
return -ENOPROTOOPT; return -ENOPROTOOPT;
} }
...@@ -1901,6 +1933,7 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { ...@@ -1901,6 +1933,7 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
[XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) }, [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
[XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)}, [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
[XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
[XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
}; };
static struct xfrm_link { static struct xfrm_link {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment