38 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type,  in verify_one_alg()  argument
41 	struct nlattr *rt = attrs[type];  in verify_one_alg()
68 static int verify_auth_trunc(struct nlattr **attrs,  in verify_auth_trunc()  argument
71 	struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];  in verify_auth_trunc()
87 static int verify_aead(struct nlattr **attrs, struct netlink_ext_ack *extack)  in verify_aead()  argument
89 	struct nlattr *rt = attrs[XFRMA_ALG_AEAD];  in verify_aead()
105 static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,  in verify_one_addr()  argument
108 	struct nlattr *rt = attrs[type];  in verify_one_addr()
114 static inline int verify_sec_ctx_len(struct nlattr **attrs, struct netlink_ext_ack *extack)  in verify_sec_ctx_len()  argument
116 	struct nlattr *rt = attrs[XFRMA_SEC_CTX];  in verify_sec_ctx_len()
133 				struct nlattr **attrs,  in verify_replay()  argument
136 	struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];  in verify_replay()
161 	if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) {  in verify_replay()
175 			     struct nlattr **attrs,  in verify_newsa_info()  argument
231 	switch (p->id.proto) {  in verify_newsa_info()
233 		if (!attrs[XFRMA_ALG_AUTH]	&&  in verify_newsa_info()
234 		    !attrs[XFRMA_ALG_AUTH_TRUNC]) {  in verify_newsa_info()
239 		if (attrs[XFRMA_ALG_AEAD]	||  in verify_newsa_info()
240 		    attrs[XFRMA_ALG_CRYPT]	||  in verify_newsa_info()
241 		    attrs[XFRMA_ALG_COMP]	||  in verify_newsa_info()
242 		    attrs[XFRMA_TFCPAD]) {  in verify_newsa_info()
249 		if (attrs[XFRMA_ALG_COMP]) {  in verify_newsa_info()
254 		if (!attrs[XFRMA_ALG_AUTH] &&  in verify_newsa_info()
255 		    !attrs[XFRMA_ALG_AUTH_TRUNC] &&  in verify_newsa_info()
256 		    !attrs[XFRMA_ALG_CRYPT] &&  in verify_newsa_info()
257 		    !attrs[XFRMA_ALG_AEAD]) {  in verify_newsa_info()
262 		if ((attrs[XFRMA_ALG_AUTH] ||  in verify_newsa_info()
263 		     attrs[XFRMA_ALG_AUTH_TRUNC] ||  in verify_newsa_info()
264 		     attrs[XFRMA_ALG_CRYPT]) &&  in verify_newsa_info()
265 		    attrs[XFRMA_ALG_AEAD]) {  in verify_newsa_info()
270 		if (attrs[XFRMA_TFCPAD] &&  in verify_newsa_info()
278 		if (!attrs[XFRMA_ALG_COMP]) {  in verify_newsa_info()
283 		if (attrs[XFRMA_ALG_AEAD]	||  in verify_newsa_info()
284 		    attrs[XFRMA_ALG_AUTH]	||  in verify_newsa_info()
285 		    attrs[XFRMA_ALG_AUTH_TRUNC]	||  in verify_newsa_info()
286 		    attrs[XFRMA_ALG_CRYPT]	||  in verify_newsa_info()
287 		    attrs[XFRMA_TFCPAD]) {  in verify_newsa_info()
292 		if (ntohl(p->id.spi) >= 0x10000) {  in verify_newsa_info()
301 		if (attrs[XFRMA_ALG_COMP]	||  in verify_newsa_info()
302 		    attrs[XFRMA_ALG_AUTH]	||  in verify_newsa_info()
303 		    attrs[XFRMA_ALG_AUTH_TRUNC]	||  in verify_newsa_info()
304 		    attrs[XFRMA_ALG_AEAD]	||  in verify_newsa_info()
305 		    attrs[XFRMA_ALG_CRYPT]	||  in verify_newsa_info()
306 		    attrs[XFRMA_ENCAP]		||  in verify_newsa_info()
307 		    attrs[XFRMA_SEC_CTX]	||  in verify_newsa_info()
308 		    attrs[XFRMA_TFCPAD]) {  in verify_newsa_info()
313 		if (!attrs[XFRMA_COADDR]) {  in verify_newsa_info()
325 	if ((err = verify_aead(attrs, extack)))  in verify_newsa_info()
327 	if ((err = verify_auth_trunc(attrs, extack)))  in verify_newsa_info()
329 	if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH, extack)))  in verify_newsa_info()
331 	if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT, extack)))  in verify_newsa_info()
333 	if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP, extack)))  in verify_newsa_info()
335 	if ((err = verify_sec_ctx_len(attrs, extack)))  in verify_newsa_info()
337 	if ((err = verify_replay(p, attrs, extack)))  in verify_newsa_info()
355 	if (attrs[XFRMA_MTIMER_THRESH]) {  in verify_newsa_info()
356 		if (!attrs[XFRMA_ENCAP]) {  in verify_newsa_info()
601 	memcpy(&x->id, &p->id, sizeof(x->id));  in copy_from_user_state()
621 static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,  in xfrm_update_ae_params()  argument
624 	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];  in xfrm_update_ae_params()
625 	struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;  in xfrm_update_ae_params()
626 	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];  in xfrm_update_ae_params()
627 	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];  in xfrm_update_ae_params()
628 	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];  in xfrm_update_ae_params()
629 	struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];  in xfrm_update_ae_params()
666 static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)  in xfrm_smark_init()  argument
668 	if (attrs[XFRMA_SET_MARK]) {  in xfrm_smark_init()
669 		m->v = nla_get_u32(attrs[XFRMA_SET_MARK]);  in xfrm_smark_init()
670 		if (attrs[XFRMA_SET_MARK_MASK])  in xfrm_smark_init()
671 			m->m = nla_get_u32(attrs[XFRMA_SET_MARK_MASK]);  in xfrm_smark_init()
681 					       struct nlattr **attrs,  in xfrm_state_construct()  argument
693 	if (attrs[XFRMA_ENCAP]) {  in xfrm_state_construct()
694 		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),  in xfrm_state_construct()
700 	if (attrs[XFRMA_COADDR]) {  in xfrm_state_construct()
701 		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),  in xfrm_state_construct()
707 	if (attrs[XFRMA_SA_EXTRA_FLAGS])  in xfrm_state_construct()
708 		x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);  in xfrm_state_construct()
710 	if ((err = attach_aead(x, attrs[XFRMA_ALG_AEAD], extack)))  in xfrm_state_construct()
713 				     attrs[XFRMA_ALG_AUTH_TRUNC], extack)))  in xfrm_state_construct()
717 				       attrs[XFRMA_ALG_AUTH], extack)))  in xfrm_state_construct()
720 	if ((err = attach_crypt(x, attrs[XFRMA_ALG_CRYPT], extack)))  in xfrm_state_construct()
724 				   attrs[XFRMA_ALG_COMP], extack)))  in xfrm_state_construct()
727 	if (attrs[XFRMA_TFCPAD])  in xfrm_state_construct()
728 		x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);  in xfrm_state_construct()
730 	xfrm_mark_get(attrs, &x->mark);  in xfrm_state_construct()
732 	xfrm_smark_init(attrs, &x->props.smark);  in xfrm_state_construct()
734 	if (attrs[XFRMA_IF_ID])  in xfrm_state_construct()
735 		x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);  in xfrm_state_construct()
737 	err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV], extack);  in xfrm_state_construct()
741 	if (attrs[XFRMA_SEC_CTX]) {  in xfrm_state_construct()
743 						nla_data(attrs[XFRMA_SEC_CTX]));  in xfrm_state_construct()
749 					       attrs[XFRMA_REPLAY_ESN_VAL])))  in xfrm_state_construct()
761 	xfrm_update_ae_params(x, attrs, 0);  in xfrm_state_construct()
764 	if (attrs[XFRMA_OFFLOAD_DEV]) {  in xfrm_state_construct()
766 					 nla_data(attrs[XFRMA_OFFLOAD_DEV]),  in xfrm_state_construct()
783 		       struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_add_sa()  argument
791 	err = verify_newsa_info(p, attrs, extack);  in xfrm_add_sa()
795 	x = xfrm_state_construct(net, p, attrs, &err, extack);  in xfrm_add_sa()
829 						 struct nlattr **attrs,  in xfrm_user_state_lookup()  argument
835 	u32 mark = xfrm_mark_get(attrs, &m);  in xfrm_user_state_lookup()
843 		verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);  in xfrm_user_state_lookup()
862 		       struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_del_sa()  argument
870 	x = xfrm_user_state_lookup(net, p, attrs, &err);  in xfrm_del_sa()
901 	memcpy(&p->id, &x->id, sizeof(p->id));  in copy_to_user_state()
904 	if (x->xso.dev)  in copy_to_user_state()
958 	xuo->ifindex = xso->dev->ifindex;  in copy_user_offload()
1171 	if(x->xso.dev)  in copy_to_user_state_extra()
1255 		struct nlattr *attrs[XFRMA_MAX+1];  in xfrm_dump_sa()  local
1260 		err = nlmsg_parse_deprecated(cb->nlh, 0, attrs, XFRMA_MAX,  in xfrm_dump_sa()
1265 		if (attrs[XFRMA_ADDRESS_FILTER]) {  in xfrm_dump_sa()
1266 			filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),  in xfrm_dump_sa()
1281 		if (attrs[XFRMA_PROTO])  in xfrm_dump_sa()
1282 			proto = nla_get_u8(attrs[XFRMA_PROTO]);  in xfrm_dump_sa()
1409 			    struct nlattr **attrs,  in xfrm_set_spdinfo()  argument
1417 	if (attrs[XFRMA_SPD_IPV4_HTHRESH]) {  in xfrm_set_spdinfo()
1418 		struct nlattr *rta = attrs[XFRMA_SPD_IPV4_HTHRESH];  in xfrm_set_spdinfo()
1430 	if (attrs[XFRMA_SPD_IPV6_HTHRESH]) {  in xfrm_set_spdinfo()
1431 		struct nlattr *rta = attrs[XFRMA_SPD_IPV6_HTHRESH];  in xfrm_set_spdinfo()
1463 			    struct nlattr **attrs,  in xfrm_get_spdinfo()  argument
1523 			    struct nlattr **attrs,  in xfrm_get_sadinfo()  argument
1544 		       struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_get_sa()  argument
1552 	x = xfrm_user_state_lookup(net, p, attrs, &err);  in xfrm_get_sa()
1568 			      struct nlattr **attrs,  in xfrm_alloc_userspi()  argument
1584 	err = verify_spi_info(p->info.id.proto, p->min, p->max, extack);  in xfrm_alloc_userspi()
1589 	daddr = &p->info.id.daddr;  in xfrm_alloc_userspi()
1593 	mark = xfrm_mark_get(attrs, &m);  in xfrm_alloc_userspi()
1595 	if (attrs[XFRMA_IF_ID])  in xfrm_alloc_userspi()
1596 		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);  in xfrm_alloc_userspi()
1600 		if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) {  in xfrm_alloc_userspi()
1608 				  if_id, p->info.id.proto, daddr,  in xfrm_alloc_userspi()
1744 static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)  in copy_from_user_sec_ctx()  argument
1746 	struct nlattr *rt = attrs[XFRMA_SEC_CTX];  in copy_from_user_sec_ctx()
1765 		memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));  in copy_templates()
1839 		if (!xfrm_id_proto_valid(ut[i].id.proto)) {  in validate_tmpl()
1848 static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs,  in copy_from_user_tmpl()  argument
1851 	struct nlattr *rt = attrs[XFRMA_TMPL];  in copy_from_user_tmpl()
1869 static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs,  in copy_from_user_policy_type()  argument
1872 	struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];  in copy_from_user_policy_type()
1919 						 struct nlattr **attrs,  in xfrm_policy_construct()  argument
1933 	err = copy_from_user_policy_type(&xp->type, attrs, extack);  in xfrm_policy_construct()
1937 	if (!(err = copy_from_user_tmpl(xp, attrs, p->dir, extack)))  in xfrm_policy_construct()
1938 		err = copy_from_user_sec_ctx(xp, attrs);  in xfrm_policy_construct()
1942 	xfrm_mark_get(attrs, &xp->mark);  in xfrm_policy_construct()
1944 	if (attrs[XFRMA_IF_ID])  in xfrm_policy_construct()
1945 		xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);  in xfrm_policy_construct()
1948 	if (attrs[XFRMA_OFFLOAD_DEV]) {  in xfrm_policy_construct()
1950 					  nla_data(attrs[XFRMA_OFFLOAD_DEV]),  in xfrm_policy_construct()
1965 			   struct nlattr **attrs,  in xfrm_add_policy()  argument
1978 	err = verify_sec_ctx_len(attrs, extack);  in xfrm_add_policy()
1982 	xp = xfrm_policy_construct(net, p, attrs, &err, extack);  in xfrm_add_policy()
2025 		memcpy(&up->id, &kp->id, sizeof(up->id));  in copy_to_user_tmpl()
2109 	if (!err && xp->xdo.dev)  in dump_one_policy()
2231 			    struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_set_default()  argument
2252 			    struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_get_default()  argument
2282 			   struct nlattr **attrs,  in xfrm_get_policy()  argument
2298 	err = copy_from_user_policy_type(&type, attrs, extack);  in xfrm_get_policy()
2306 	if (attrs[XFRMA_IF_ID])  in xfrm_get_policy()
2307 		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);  in xfrm_get_policy()
2309 	xfrm_mark_get(attrs, &m);  in xfrm_get_policy()
2315 		struct nlattr *rt = attrs[XFRMA_SEC_CTX];  in xfrm_get_policy()
2318 		err = verify_sec_ctx_len(attrs, extack);  in xfrm_get_policy()
2367 			 struct nlattr **attrs,  in xfrm_flush_sa()  argument
2407 	struct xfrm_aevent_id *id;  in build_aevent()  local
2411 	nlh = nlmsg_put(skb, c->portid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);  in build_aevent()
2415 	id = nlmsg_data(nlh);  in build_aevent()
2416 	memset(&id->sa_id, 0, sizeof(id->sa_id));  in build_aevent()
2417 	memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr));  in build_aevent()
2418 	id->sa_id.spi = x->id.spi;  in build_aevent()
2419 	id->sa_id.family = x->props.family;  in build_aevent()
2420 	id->sa_id.proto = x->id.proto;  in build_aevent()
2421 	memcpy(&id->saddr, &x->props.saddr, sizeof(x->props.saddr));  in build_aevent()
2422 	id->reqid = x->props.reqid;  in build_aevent()
2423 	id->flags = c->data.aevent;  in build_aevent()
2440 	if (id->flags & XFRM_AE_RTHR) {  in build_aevent()
2445 	if (id->flags & XFRM_AE_ETHR) {  in build_aevent()
2468 		       struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_get_ae()  argument
2478 	struct xfrm_usersa_id *id = &p->sa_id;  in xfrm_get_ae()  local
2480 	mark = xfrm_mark_get(attrs, &m);  in xfrm_get_ae()
2482 	x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);  in xfrm_get_ae()
2512 		       struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_new_ae()  argument
2521 	struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];  in xfrm_new_ae()
2522 	struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];  in xfrm_new_ae()
2523 	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];  in xfrm_new_ae()
2524 	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];  in xfrm_new_ae()
2525 	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];  in xfrm_new_ae()
2538 	mark = xfrm_mark_get(attrs, &m);  in xfrm_new_ae()
2554 	xfrm_update_ae_params(x, attrs, 1);  in xfrm_new_ae()
2569 			     struct nlattr **attrs,  in xfrm_flush_policy()  argument
2577 	err = copy_from_user_policy_type(&type, attrs, extack);  in xfrm_flush_policy()
2598 			       struct nlattr **attrs,  in xfrm_add_pol_expire()  argument
2610 	err = copy_from_user_policy_type(&type, attrs, extack);  in xfrm_add_pol_expire()
2618 	if (attrs[XFRMA_IF_ID])  in xfrm_add_pol_expire()
2619 		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);  in xfrm_add_pol_expire()
2621 	xfrm_mark_get(attrs, &m);  in xfrm_add_pol_expire()
2627 		struct nlattr *rt = attrs[XFRMA_SEC_CTX];  in xfrm_add_pol_expire()
2630 		err = verify_sec_ctx_len(attrs, extack);  in xfrm_add_pol_expire()
2665 			      struct nlattr **attrs,  in xfrm_add_sa_expire()  argument
2674 	u32 mark = xfrm_mark_get(attrs, &m);  in xfrm_add_sa_expire()
2676 	x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);  in xfrm_add_sa_expire()
2703 			    struct nlattr **attrs,  in xfrm_add_acquire()  argument
2710 	struct nlattr *rt = attrs[XFRMA_TMPL];  in xfrm_add_acquire()
2720 	xfrm_mark_get(attrs, &mark);  in xfrm_add_acquire()
2725 	err = verify_sec_ctx_len(attrs, extack);  in xfrm_add_acquire()
2730 	xp = xfrm_policy_construct(net, &ua->policy, attrs, &err, extack);  in xfrm_add_acquire()
2734 	memcpy(&x->id, &ua->id, sizeof(ua->id));  in xfrm_add_acquire()
2743 		memcpy(&x->id, &t->id, sizeof(x->id));  in xfrm_add_acquire()
2768 				  struct nlattr **attrs, int *num,  in copy_from_user_migrate()  argument
2771 	struct nlattr *rt = attrs[XFRMA_MIGRATE];  in copy_from_user_migrate()
2778 		uk = nla_data(attrs[XFRMA_KMADDRESS]);  in copy_from_user_migrate()
2812 			   struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_do_migrate()  argument
2824 	if (!attrs[XFRMA_MIGRATE]) {  in xfrm_do_migrate()
2829 	kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;  in xfrm_do_migrate()
2831 	err = copy_from_user_policy_type(&type, attrs, extack);  in xfrm_do_migrate()
2835 	err = copy_from_user_migrate(m, kmp, attrs, &n, extack);  in xfrm_do_migrate()
2842 	if (attrs[XFRMA_ENCAP]) {  in xfrm_do_migrate()
2843 		encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),  in xfrm_do_migrate()
2849 	if (attrs[XFRMA_IF_ID])  in xfrm_do_migrate()
2850 		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);  in xfrm_do_migrate()
2861 			   struct nlattr **attrs, struct netlink_ext_ack *extack)  in xfrm_do_migrate()  argument
3101 	struct nlattr *attrs[XFRMA_MAX+1];  in xfrm_user_rcv_msg()  local
3150 	err = nlmsg_parse_deprecated(nlh, xfrm_msg_min[type], attrs,  in xfrm_user_rcv_msg()
3161 	err = link->doit(skb, nlh, attrs, extack);  in xfrm_user_rcv_msg()
3309 	if (x->xso.dev)  in xfrm_sa_len()
3331 	struct xfrm_usersa_id *id;  in xfrm_notify_sa()  local
3341 		headlen = sizeof(*id);  in xfrm_notify_sa()
3359 		id = nlmsg_data(nlh);  in xfrm_notify_sa()
3360 		memset(id, 0, sizeof(*id));  in xfrm_notify_sa()
3361 		memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));  in xfrm_notify_sa()
3362 		id->spi = x->id.spi;  in xfrm_notify_sa()
3363 		id->family = x->props.family;  in xfrm_notify_sa()
3364 		id->proto = x->id.proto;  in xfrm_notify_sa()
3433 	memcpy(&ua->id, &x->id, sizeof(ua->id));  in build_acquire()
3451 	if (!err && xp->xdo.dev)  in build_acquire()
3571 	if (!err && xp->xdo.dev)  in build_polexpire()
3604 	struct xfrm_userpolicy_id *id;  in xfrm_notify_policy()  local
3613 		headlen = sizeof(*id);  in xfrm_notify_policy()
3632 		id = nlmsg_data(nlh);  in xfrm_notify_policy()
3633 		memset(id, 0, sizeof(*id));  in xfrm_notify_policy()
3634 		id->dir = dir;  in xfrm_notify_policy()
3636 			id->index = xp->index;  in xfrm_notify_policy()
3638 			memcpy(&id->sel, &xp->selector, sizeof(id->sel));  in xfrm_notify_policy()
3656 	if (!err && xp->xdo.dev)  in xfrm_notify_policy()
3782 	memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));  in build_mapping()
3783 	um->id.spi = x->id.spi;  in build_mapping()
3784 	um->id.family = x->props.family;  in build_mapping()
3785 	um->id.proto = x->id.proto;  in build_mapping()
3803 	if (x->id.proto != IPPROTO_ESP)  in xfrm_send_mapping()