1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * XFRM compat layer
4 * Author: Dmitry Safonov <dima@arista.com>
5 * Based on code and translator idea by: Florian Westphal <fw@strlen.de>
6 */
7 #include <linux/compat.h>
8 #include <linux/nospec.h>
9 #include <linux/xfrm.h>
10 #include <net/xfrm.h>
11
12 struct compat_xfrm_lifetime_cfg {
13 compat_u64 soft_byte_limit, hard_byte_limit;
14 compat_u64 soft_packet_limit, hard_packet_limit;
15 compat_u64 soft_add_expires_seconds, hard_add_expires_seconds;
16 compat_u64 soft_use_expires_seconds, hard_use_expires_seconds;
17 }; /* same size on 32bit, but only 4 byte alignment required */
18
19 struct compat_xfrm_lifetime_cur {
20 compat_u64 bytes, packets, add_time, use_time;
21 }; /* same size on 32bit, but only 4 byte alignment required */
22
23 struct compat_xfrm_userpolicy_info {
24 struct xfrm_selector sel;
25 struct compat_xfrm_lifetime_cfg lft;
26 struct compat_xfrm_lifetime_cur curlft;
27 __u32 priority, index;
28 u8 dir, action, flags, share;
29 /* 4 bytes additional padding on 64bit */
30 };
31
32 struct compat_xfrm_usersa_info {
33 struct xfrm_selector sel;
34 struct xfrm_id id;
35 xfrm_address_t saddr;
36 struct compat_xfrm_lifetime_cfg lft;
37 struct compat_xfrm_lifetime_cur curlft;
38 struct xfrm_stats stats;
39 __u32 seq, reqid;
40 u16 family;
41 u8 mode, replay_window, flags;
42 /* 4 bytes additional padding on 64bit */
43 };
44
45 struct compat_xfrm_user_acquire {
46 struct xfrm_id id;
47 xfrm_address_t saddr;
48 struct xfrm_selector sel;
49 struct compat_xfrm_userpolicy_info policy;
50 /* 4 bytes additional padding on 64bit */
51 __u32 aalgos, ealgos, calgos, seq;
52 };
53
54 struct compat_xfrm_userspi_info {
55 struct compat_xfrm_usersa_info info;
56 /* 4 bytes additional padding on 64bit */
57 __u32 min, max;
58 };
59
60 struct compat_xfrm_user_expire {
61 struct compat_xfrm_usersa_info state;
62 /* 8 bytes additional padding on 64bit */
63 u8 hard;
64 };
65
66 struct compat_xfrm_user_polexpire {
67 struct compat_xfrm_userpolicy_info pol;
68 /* 8 bytes additional padding on 64bit */
69 u8 hard;
70 };
71
72 #define XMSGSIZE(type) sizeof(struct type)
73
74 static const int compat_msg_min[XFRM_NR_MSGTYPES] = {
75 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
76 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
77 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
78 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
79 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
80 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
81 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userspi_info),
82 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_acquire),
83 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_expire),
84 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
85 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
86 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_polexpire),
87 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
88 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
89 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
90 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
91 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
92 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
93 [XFRM_MSG_NEWSADINFO - XFRM_MSG_BASE] = sizeof(u32),
94 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
95 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
96 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
97 [XFRM_MSG_MAPPING - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_mapping)
98 };
99
100 static const struct nla_policy compat_policy[XFRMA_MAX+1] = {
101 [XFRMA_UNSPEC] = { .strict_start_type = XFRMA_SA_DIR },
102 [XFRMA_SA] = { .len = XMSGSIZE(compat_xfrm_usersa_info)},
103 [XFRMA_POLICY] = { .len = XMSGSIZE(compat_xfrm_userpolicy_info)},
104 [XFRMA_LASTUSED] = { .type = NLA_U64},
105 [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)},
106 [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) },
107 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
108 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
109 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
110 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
111 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
112 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) },
113 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
114 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
115 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
116 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
117 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
118 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
119 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
120 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
121 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
122 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
123 [XFRMA_TFCPAD] = { .type = NLA_U32 },
124 [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
125 [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 },
126 [XFRMA_PROTO] = { .type = NLA_U8 },
127 [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) },
128 [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) },
129 [XFRMA_SET_MARK] = { .type = NLA_U32 },
130 [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
131 [XFRMA_IF_ID] = { .type = NLA_U32 },
132 [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 },
133 [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT),
134 };
135
xfrm_nlmsg_put_compat(struct sk_buff * skb,const struct nlmsghdr * nlh_src,u16 type)136 static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
137 const struct nlmsghdr *nlh_src, u16 type)
138 {
139 int payload = compat_msg_min[type];
140 int src_len = xfrm_msg_min[type];
141 struct nlmsghdr *nlh_dst;
142
143 /* Compat messages are shorter or equal to native (+padding) */
144 if (WARN_ON_ONCE(src_len < payload))
145 return ERR_PTR(-EMSGSIZE);
146
147 nlh_dst = nlmsg_put(skb, nlh_src->nlmsg_pid, nlh_src->nlmsg_seq,
148 nlh_src->nlmsg_type, payload, nlh_src->nlmsg_flags);
149 if (!nlh_dst)
150 return ERR_PTR(-EMSGSIZE);
151
152 memset(nlmsg_data(nlh_dst), 0, payload);
153
154 switch (nlh_src->nlmsg_type) {
155 /* Compat message has the same layout as native */
156 case XFRM_MSG_DELSA:
157 case XFRM_MSG_DELPOLICY:
158 case XFRM_MSG_FLUSHSA:
159 case XFRM_MSG_FLUSHPOLICY:
160 case XFRM_MSG_NEWAE:
161 case XFRM_MSG_REPORT:
162 case XFRM_MSG_MIGRATE:
163 case XFRM_MSG_NEWSADINFO:
164 case XFRM_MSG_NEWSPDINFO:
165 case XFRM_MSG_MAPPING:
166 WARN_ON_ONCE(src_len != payload);
167 memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), src_len);
168 break;
169 /* 4 byte alignment for trailing u64 on native, but not on compat */
170 case XFRM_MSG_NEWSA:
171 case XFRM_MSG_NEWPOLICY:
172 case XFRM_MSG_UPDSA:
173 case XFRM_MSG_UPDPOLICY:
174 WARN_ON_ONCE(src_len != payload + 4);
175 memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), payload);
176 break;
177 case XFRM_MSG_EXPIRE: {
178 const struct xfrm_user_expire *src_ue = nlmsg_data(nlh_src);
179 struct compat_xfrm_user_expire *dst_ue = nlmsg_data(nlh_dst);
180
181 /* compat_xfrm_user_expire has 4-byte smaller state */
182 memcpy(dst_ue, src_ue, sizeof(dst_ue->state));
183 dst_ue->hard = src_ue->hard;
184 break;
185 }
186 case XFRM_MSG_ACQUIRE: {
187 const struct xfrm_user_acquire *src_ua = nlmsg_data(nlh_src);
188 struct compat_xfrm_user_acquire *dst_ua = nlmsg_data(nlh_dst);
189
190 memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
191 dst_ua->aalgos = src_ua->aalgos;
192 dst_ua->ealgos = src_ua->ealgos;
193 dst_ua->calgos = src_ua->calgos;
194 dst_ua->seq = src_ua->seq;
195 break;
196 }
197 case XFRM_MSG_POLEXPIRE: {
198 const struct xfrm_user_polexpire *src_upe = nlmsg_data(nlh_src);
199 struct compat_xfrm_user_polexpire *dst_upe = nlmsg_data(nlh_dst);
200
201 /* compat_xfrm_user_polexpire has 4-byte smaller state */
202 memcpy(dst_upe, src_upe, sizeof(dst_upe->pol));
203 dst_upe->hard = src_upe->hard;
204 break;
205 }
206 case XFRM_MSG_ALLOCSPI: {
207 const struct xfrm_userspi_info *src_usi = nlmsg_data(nlh_src);
208 struct compat_xfrm_userspi_info *dst_usi = nlmsg_data(nlh_dst);
209
210 /* compat_xfrm_user_polexpire has 4-byte smaller state */
211 memcpy(dst_usi, src_usi, sizeof(src_usi->info));
212 dst_usi->min = src_usi->min;
213 dst_usi->max = src_usi->max;
214 break;
215 }
216 /* Not being sent by kernel */
217 case XFRM_MSG_GETSA:
218 case XFRM_MSG_GETPOLICY:
219 case XFRM_MSG_GETAE:
220 case XFRM_MSG_GETSADINFO:
221 case XFRM_MSG_GETSPDINFO:
222 default:
223 pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
224 return ERR_PTR(-EOPNOTSUPP);
225 }
226
227 return nlh_dst;
228 }
229
xfrm_nla_cpy(struct sk_buff * dst,const struct nlattr * src,int len)230 static int xfrm_nla_cpy(struct sk_buff *dst, const struct nlattr *src, int len)
231 {
232 return nla_put(dst, src->nla_type, len, nla_data(src));
233 }
234
xfrm_xlate64_attr(struct sk_buff * dst,const struct nlattr * src)235 static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)
236 {
237 switch (src->nla_type) {
238 case XFRMA_PAD:
239 /* Ignore */
240 return 0;
241 case XFRMA_UNSPEC:
242 case XFRMA_ALG_AUTH:
243 case XFRMA_ALG_CRYPT:
244 case XFRMA_ALG_COMP:
245 case XFRMA_ENCAP:
246 case XFRMA_TMPL:
247 return xfrm_nla_cpy(dst, src, nla_len(src));
248 case XFRMA_SA:
249 return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_usersa_info));
250 case XFRMA_POLICY:
251 return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_userpolicy_info));
252 case XFRMA_SEC_CTX:
253 return xfrm_nla_cpy(dst, src, nla_len(src));
254 case XFRMA_LTIME_VAL:
255 return nla_put_64bit(dst, src->nla_type, nla_len(src),
256 nla_data(src), XFRMA_PAD);
257 case XFRMA_REPLAY_VAL:
258 case XFRMA_REPLAY_THRESH:
259 case XFRMA_ETIMER_THRESH:
260 case XFRMA_SRCADDR:
261 case XFRMA_COADDR:
262 return xfrm_nla_cpy(dst, src, nla_len(src));
263 case XFRMA_LASTUSED:
264 return nla_put_64bit(dst, src->nla_type, nla_len(src),
265 nla_data(src), XFRMA_PAD);
266 case XFRMA_POLICY_TYPE:
267 case XFRMA_MIGRATE:
268 case XFRMA_ALG_AEAD:
269 case XFRMA_KMADDRESS:
270 case XFRMA_ALG_AUTH_TRUNC:
271 case XFRMA_MARK:
272 case XFRMA_TFCPAD:
273 case XFRMA_REPLAY_ESN_VAL:
274 case XFRMA_SA_EXTRA_FLAGS:
275 case XFRMA_PROTO:
276 case XFRMA_ADDRESS_FILTER:
277 case XFRMA_OFFLOAD_DEV:
278 case XFRMA_SET_MARK:
279 case XFRMA_SET_MARK_MASK:
280 case XFRMA_IF_ID:
281 case XFRMA_MTIMER_THRESH:
282 case XFRMA_SA_DIR:
283 return xfrm_nla_cpy(dst, src, nla_len(src));
284 default:
285 BUILD_BUG_ON(XFRMA_MAX != XFRMA_SA_DIR);
286 pr_warn_once("unsupported nla_type %d\n", src->nla_type);
287 return -EOPNOTSUPP;
288 }
289 }
290
291 /* Take kernel-built (64bit layout) and create 32bit layout for userspace */
xfrm_xlate64(struct sk_buff * dst,const struct nlmsghdr * nlh_src)292 static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src)
293 {
294 u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
295 const struct nlattr *nla, *attrs;
296 struct nlmsghdr *nlh_dst;
297 int len, remaining;
298
299 nlh_dst = xfrm_nlmsg_put_compat(dst, nlh_src, type);
300 if (IS_ERR(nlh_dst))
301 return PTR_ERR(nlh_dst);
302
303 attrs = nlmsg_attrdata(nlh_src, xfrm_msg_min[type]);
304 len = nlmsg_attrlen(nlh_src, xfrm_msg_min[type]);
305
306 nla_for_each_attr(nla, attrs, len, remaining) {
307 int err;
308
309 switch (nlh_src->nlmsg_type) {
310 case XFRM_MSG_NEWSPDINFO:
311 err = xfrm_nla_cpy(dst, nla, nla_len(nla));
312 break;
313 default:
314 err = xfrm_xlate64_attr(dst, nla);
315 break;
316 }
317 if (err)
318 return err;
319 }
320
321 nlmsg_end(dst, nlh_dst);
322
323 return 0;
324 }
325
xfrm_alloc_compat(struct sk_buff * skb,const struct nlmsghdr * nlh_src)326 static int xfrm_alloc_compat(struct sk_buff *skb, const struct nlmsghdr *nlh_src)
327 {
328 u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
329 struct sk_buff *new = NULL;
330 int err;
331
332 if (type >= ARRAY_SIZE(xfrm_msg_min)) {
333 pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
334 return -EOPNOTSUPP;
335 }
336
337 if (skb_shinfo(skb)->frag_list == NULL) {
338 new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC);
339 if (!new)
340 return -ENOMEM;
341 skb_shinfo(skb)->frag_list = new;
342 }
343
344 err = xfrm_xlate64(skb_shinfo(skb)->frag_list, nlh_src);
345 if (err) {
346 if (new) {
347 kfree_skb(new);
348 skb_shinfo(skb)->frag_list = NULL;
349 }
350 return err;
351 }
352
353 return 0;
354 }
355
356 /* Calculates len of translated 64-bit message. */
xfrm_user_rcv_calculate_len64(const struct nlmsghdr * src,struct nlattr * attrs[XFRMA_MAX+1],int maxtype)357 static size_t xfrm_user_rcv_calculate_len64(const struct nlmsghdr *src,
358 struct nlattr *attrs[XFRMA_MAX + 1],
359 int maxtype)
360 {
361 size_t len = nlmsg_len(src);
362
363 switch (src->nlmsg_type) {
364 case XFRM_MSG_NEWSA:
365 case XFRM_MSG_NEWPOLICY:
366 case XFRM_MSG_ALLOCSPI:
367 case XFRM_MSG_ACQUIRE:
368 case XFRM_MSG_UPDPOLICY:
369 case XFRM_MSG_UPDSA:
370 len += 4;
371 break;
372 case XFRM_MSG_EXPIRE:
373 case XFRM_MSG_POLEXPIRE:
374 len += 8;
375 break;
376 case XFRM_MSG_NEWSPDINFO:
377 /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
378 return len;
379 default:
380 break;
381 }
382
383 /* Unexpected for anything, but XFRM_MSG_NEWSPDINFO, please
384 * correct both 64=>32-bit and 32=>64-bit translators to copy
385 * new attributes.
386 */
387 if (WARN_ON_ONCE(maxtype))
388 return len;
389
390 if (attrs[XFRMA_SA])
391 len += 4;
392 if (attrs[XFRMA_POLICY])
393 len += 4;
394
395 /* XXX: some attrs may need to be realigned
396 * if !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
397 */
398
399 return len;
400 }
401
xfrm_attr_cpy32(void * dst,size_t * pos,const struct nlattr * src,size_t size,int copy_len,int payload)402 static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src,
403 size_t size, int copy_len, int payload)
404 {
405 struct nlmsghdr *nlmsg = dst;
406 struct nlattr *nla;
407
408 /* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages
409 * have the same len or shorted than 64-bit ones.
410 * 32-bit translation that is bigger than 64-bit original is unexpected.
411 */
412 if (WARN_ON_ONCE(copy_len > payload))
413 copy_len = payload;
414
415 if (size - *pos < nla_attr_size(payload))
416 return -ENOBUFS;
417
418 nla = dst + *pos;
419
420 memcpy(nla, src, nla_attr_size(copy_len));
421 nla->nla_len = nla_attr_size(payload);
422 *pos += nla_attr_size(copy_len);
423 nlmsg->nlmsg_len += nla->nla_len;
424
425 memset(dst + *pos, 0, payload - copy_len);
426 *pos += payload - copy_len;
427
428 return 0;
429 }
430
xfrm_xlate32_attr(void * dst,const struct nlattr * nla,size_t * pos,size_t size,struct netlink_ext_ack * extack)431 static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
432 size_t *pos, size_t size,
433 struct netlink_ext_ack *extack)
434 {
435 int type = nla_type(nla);
436 u16 pol_len32, pol_len64;
437 int err;
438
439 if (type > XFRMA_MAX) {
440 BUILD_BUG_ON(XFRMA_MAX != XFRMA_SA_DIR);
441 NL_SET_ERR_MSG(extack, "Bad attribute");
442 return -EOPNOTSUPP;
443 }
444 type = array_index_nospec(type, XFRMA_MAX + 1);
445 if (nla_len(nla) < compat_policy[type].len) {
446 NL_SET_ERR_MSG(extack, "Attribute bad length");
447 return -EOPNOTSUPP;
448 }
449
450 pol_len32 = compat_policy[type].len;
451 pol_len64 = xfrma_policy[type].len;
452
453 /* XFRMA_SA and XFRMA_POLICY - need to know how-to translate */
454 if (pol_len32 != pol_len64) {
455 if (nla_len(nla) != compat_policy[type].len) {
456 NL_SET_ERR_MSG(extack, "Attribute bad length");
457 return -EOPNOTSUPP;
458 }
459 err = xfrm_attr_cpy32(dst, pos, nla, size, pol_len32, pol_len64);
460 if (err)
461 return err;
462 }
463
464 return xfrm_attr_cpy32(dst, pos, nla, size, nla_len(nla), nla_len(nla));
465 }
466
xfrm_xlate32(struct nlmsghdr * dst,const struct nlmsghdr * src,struct nlattr * attrs[XFRMA_MAX+1],size_t size,u8 type,int maxtype,struct netlink_ext_ack * extack)467 static int xfrm_xlate32(struct nlmsghdr *dst, const struct nlmsghdr *src,
468 struct nlattr *attrs[XFRMA_MAX+1],
469 size_t size, u8 type, int maxtype,
470 struct netlink_ext_ack *extack)
471 {
472 size_t pos;
473 int i;
474
475 memcpy(dst, src, NLMSG_HDRLEN);
476 dst->nlmsg_len = NLMSG_HDRLEN + xfrm_msg_min[type];
477 memset(nlmsg_data(dst), 0, xfrm_msg_min[type]);
478
479 switch (src->nlmsg_type) {
480 /* Compat message has the same layout as native */
481 case XFRM_MSG_DELSA:
482 case XFRM_MSG_GETSA:
483 case XFRM_MSG_DELPOLICY:
484 case XFRM_MSG_GETPOLICY:
485 case XFRM_MSG_FLUSHSA:
486 case XFRM_MSG_FLUSHPOLICY:
487 case XFRM_MSG_NEWAE:
488 case XFRM_MSG_GETAE:
489 case XFRM_MSG_REPORT:
490 case XFRM_MSG_MIGRATE:
491 case XFRM_MSG_NEWSADINFO:
492 case XFRM_MSG_GETSADINFO:
493 case XFRM_MSG_NEWSPDINFO:
494 case XFRM_MSG_GETSPDINFO:
495 case XFRM_MSG_MAPPING:
496 memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
497 break;
498 /* 4 byte alignment for trailing u64 on native, but not on compat */
499 case XFRM_MSG_NEWSA:
500 case XFRM_MSG_NEWPOLICY:
501 case XFRM_MSG_UPDSA:
502 case XFRM_MSG_UPDPOLICY:
503 memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
504 break;
505 case XFRM_MSG_EXPIRE: {
506 const struct compat_xfrm_user_expire *src_ue = nlmsg_data(src);
507 struct xfrm_user_expire *dst_ue = nlmsg_data(dst);
508
509 /* compat_xfrm_user_expire has 4-byte smaller state */
510 memcpy(dst_ue, src_ue, sizeof(src_ue->state));
511 dst_ue->hard = src_ue->hard;
512 break;
513 }
514 case XFRM_MSG_ACQUIRE: {
515 const struct compat_xfrm_user_acquire *src_ua = nlmsg_data(src);
516 struct xfrm_user_acquire *dst_ua = nlmsg_data(dst);
517
518 memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
519 dst_ua->aalgos = src_ua->aalgos;
520 dst_ua->ealgos = src_ua->ealgos;
521 dst_ua->calgos = src_ua->calgos;
522 dst_ua->seq = src_ua->seq;
523 break;
524 }
525 case XFRM_MSG_POLEXPIRE: {
526 const struct compat_xfrm_user_polexpire *src_upe = nlmsg_data(src);
527 struct xfrm_user_polexpire *dst_upe = nlmsg_data(dst);
528
529 /* compat_xfrm_user_polexpire has 4-byte smaller state */
530 memcpy(dst_upe, src_upe, sizeof(src_upe->pol));
531 dst_upe->hard = src_upe->hard;
532 break;
533 }
534 case XFRM_MSG_ALLOCSPI: {
535 const struct compat_xfrm_userspi_info *src_usi = nlmsg_data(src);
536 struct xfrm_userspi_info *dst_usi = nlmsg_data(dst);
537
538 /* compat_xfrm_user_polexpire has 4-byte smaller state */
539 memcpy(dst_usi, src_usi, sizeof(src_usi->info));
540 dst_usi->min = src_usi->min;
541 dst_usi->max = src_usi->max;
542 break;
543 }
544 default:
545 NL_SET_ERR_MSG(extack, "Unsupported message type");
546 return -EOPNOTSUPP;
547 }
548 pos = dst->nlmsg_len;
549
550 if (maxtype) {
551 /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
552 WARN_ON_ONCE(src->nlmsg_type != XFRM_MSG_NEWSPDINFO);
553
554 for (i = 1; i <= maxtype; i++) {
555 int err;
556
557 if (!attrs[i])
558 continue;
559
560 /* just copy - no need for translation */
561 err = xfrm_attr_cpy32(dst, &pos, attrs[i], size,
562 nla_len(attrs[i]), nla_len(attrs[i]));
563 if (err)
564 return err;
565 }
566 return 0;
567 }
568
569 for (i = 1; i < XFRMA_MAX + 1; i++) {
570 int err;
571
572 if (i == XFRMA_PAD)
573 continue;
574
575 if (!attrs[i])
576 continue;
577
578 err = xfrm_xlate32_attr(dst, attrs[i], &pos, size, extack);
579 if (err)
580 return err;
581 }
582
583 return 0;
584 }
585
xfrm_user_rcv_msg_compat(const struct nlmsghdr * h32,int maxtype,const struct nla_policy * policy,struct netlink_ext_ack * extack)586 static struct nlmsghdr *xfrm_user_rcv_msg_compat(const struct nlmsghdr *h32,
587 int maxtype, const struct nla_policy *policy,
588 struct netlink_ext_ack *extack)
589 {
590 /* netlink_rcv_skb() checks if a message has full (struct nlmsghdr) */
591 u16 type = h32->nlmsg_type - XFRM_MSG_BASE;
592 struct nlattr *attrs[XFRMA_MAX+1];
593 struct nlmsghdr *h64;
594 size_t len;
595 int err;
596
597 BUILD_BUG_ON(ARRAY_SIZE(xfrm_msg_min) != ARRAY_SIZE(compat_msg_min));
598
599 if (type >= ARRAY_SIZE(xfrm_msg_min))
600 return ERR_PTR(-EINVAL);
601
602 /* Don't call parse: the message might have only nlmsg header */
603 if ((h32->nlmsg_type == XFRM_MSG_GETSA ||
604 h32->nlmsg_type == XFRM_MSG_GETPOLICY) &&
605 (h32->nlmsg_flags & NLM_F_DUMP))
606 return NULL;
607
608 err = nlmsg_parse_deprecated(h32, compat_msg_min[type], attrs,
609 maxtype ? : XFRMA_MAX, policy ? : compat_policy, extack);
610 if (err < 0)
611 return ERR_PTR(err);
612
613 len = xfrm_user_rcv_calculate_len64(h32, attrs, maxtype);
614 /* The message doesn't need translation */
615 if (len == nlmsg_len(h32))
616 return NULL;
617
618 len += NLMSG_HDRLEN;
619 h64 = kvmalloc(len, GFP_KERNEL);
620 if (!h64)
621 return ERR_PTR(-ENOMEM);
622
623 err = xfrm_xlate32(h64, h32, attrs, len, type, maxtype, extack);
624 if (err < 0) {
625 kvfree(h64);
626 return ERR_PTR(err);
627 }
628
629 return h64;
630 }
631
xfrm_user_policy_compat(u8 ** pdata32,int optlen)632 static int xfrm_user_policy_compat(u8 **pdata32, int optlen)
633 {
634 struct compat_xfrm_userpolicy_info *p = (void *)*pdata32;
635 u8 *src_templates, *dst_templates;
636 u8 *data64;
637
638 if (optlen < sizeof(*p))
639 return -EINVAL;
640
641 data64 = kmalloc_track_caller(optlen + 4, GFP_USER | __GFP_NOWARN);
642 if (!data64)
643 return -ENOMEM;
644
645 memcpy(data64, *pdata32, sizeof(*p));
646 memset(data64 + sizeof(*p), 0, 4);
647
648 src_templates = *pdata32 + sizeof(*p);
649 dst_templates = data64 + sizeof(*p) + 4;
650 memcpy(dst_templates, src_templates, optlen - sizeof(*p));
651
652 kfree(*pdata32);
653 *pdata32 = data64;
654 return 0;
655 }
656
657 static struct xfrm_translator xfrm_translator = {
658 .owner = THIS_MODULE,
659 .alloc_compat = xfrm_alloc_compat,
660 .rcv_msg_compat = xfrm_user_rcv_msg_compat,
661 .xlate_user_policy_sockptr = xfrm_user_policy_compat,
662 };
663
xfrm_compat_init(void)664 static int __init xfrm_compat_init(void)
665 {
666 return xfrm_register_translator(&xfrm_translator);
667 }
668
xfrm_compat_exit(void)669 static void __exit xfrm_compat_exit(void)
670 {
671 xfrm_unregister_translator(&xfrm_translator);
672 }
673
674 module_init(xfrm_compat_init);
675 module_exit(xfrm_compat_exit);
676 MODULE_LICENSE("GPL");
677 MODULE_AUTHOR("Dmitry Safonov");
678 MODULE_DESCRIPTION("XFRM 32-bit compatibility layer");
679