2005-04-16 15:20:36 -07:00
|
|
|
/* xfrm_user.c: User interface to configure xfrm engine.
|
|
|
|
*
|
|
|
|
* Copyright (C) 2002 David S. Miller (davem@redhat.com)
|
|
|
|
*
|
|
|
|
* Changes:
|
|
|
|
* Mitsuru KANDA @USAGI
|
|
|
|
* Kazunori MIYAZAWA @USAGI
|
|
|
|
* Kunihiro Ishiguro <kunihiro@ipinfusion.com>
|
|
|
|
* IPv6 support
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
*
|
2005-04-16 15:20:36 -07:00
|
|
|
*/
|
|
|
|
|
2006-08-06 02:49:12 -07:00
|
|
|
#include <linux/crypto.h>
|
2005-04-16 15:20:36 -07:00
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/socket.h>
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/net.h>
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
#include <linux/pfkeyv2.h>
|
|
|
|
#include <linux/ipsec.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/security.h>
|
|
|
|
#include <net/sock.h>
|
|
|
|
#include <net/xfrm.h>
|
2005-11-09 18:25:54 -07:00
|
|
|
#include <net/netlink.h>
|
2011-01-11 01:04:12 -07:00
|
|
|
#include <net/ah.h>
|
2005-04-16 15:20:36 -07:00
|
|
|
#include <asm/uaccess.h>
|
2006-08-23 20:33:28 -07:00
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
#include <linux/in6.h>
|
|
|
|
#endif
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2008-01-28 20:37:29 -07:00
|
|
|
static inline int aead_len(struct xfrm_algo_aead *alg)
|
|
|
|
{
|
|
|
|
return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
|
|
|
|
}
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[type];
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_algo *algp;
|
|
|
|
|
|
|
|
if (!rt)
|
|
|
|
return 0;
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
algp = nla_data(rt);
|
2008-01-09 00:39:06 -07:00
|
|
|
if (nla_len(rt) < xfrm_alg_len(algp))
|
2005-05-19 12:39:49 -07:00
|
|
|
return -EINVAL;
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
switch (type) {
|
|
|
|
case XFRMA_ALG_AUTH:
|
|
|
|
case XFRMA_ALG_CRYPT:
|
|
|
|
case XFRMA_ALG_COMP:
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-11-24 17:29:52 -07:00
|
|
|
static int verify_auth_trunc(struct nlattr **attrs)
|
|
|
|
{
|
|
|
|
struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
|
|
|
|
struct xfrm_algo_auth *algp;
|
|
|
|
|
|
|
|
if (!rt)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
algp = nla_data(rt);
|
|
|
|
if (nla_len(rt) < xfrm_alg_auth_len(algp))
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-01-28 20:37:29 -07:00
|
|
|
static int verify_aead(struct nlattr **attrs)
|
|
|
|
{
|
|
|
|
struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
|
|
|
|
struct xfrm_algo_aead *algp;
|
|
|
|
|
|
|
|
if (!rt)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
algp = nla_data(rt);
|
|
|
|
if (nla_len(rt) < aead_len(algp))
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
|
2006-08-23 17:56:04 -07:00
|
|
|
xfrm_address_t **addrp)
|
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[type];
|
2006-08-23 17:56:04 -07:00
|
|
|
|
2007-08-22 13:59:04 -07:00
|
|
|
if (rt && addrp)
|
2007-08-22 14:01:33 -07:00
|
|
|
*addrp = nla_data(rt);
|
2006-08-23 17:56:04 -07:00
|
|
|
}
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
static inline int verify_sec_ctx_len(struct nlattr **attrs)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_SEC_CTX];
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
struct xfrm_user_sec_ctx *uctx;
|
|
|
|
|
|
|
|
if (!rt)
|
|
|
|
return 0;
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
uctx = nla_data(rt);
|
2007-08-22 13:59:04 -07:00
|
|
|
if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
static inline int verify_replay(struct xfrm_usersa_info *p,
|
|
|
|
struct nlattr **attrs)
|
|
|
|
{
|
|
|
|
struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
|
|
|
|
|
2011-04-25 12:41:21 -07:00
|
|
|
if ((p->flags & XFRM_STATE_ESN) && !rt)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
if (!rt)
|
|
|
|
return 0;
|
|
|
|
|
2011-03-28 12:48:09 -07:00
|
|
|
if (p->id.proto != IPPROTO_ESP)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
if (p->replay_window != 0)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static int verify_newsa_info(struct xfrm_usersa_info *p,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
|
|
|
int err;
|
|
|
|
|
|
|
|
err = -EINVAL;
|
|
|
|
switch (p->family) {
|
|
|
|
case AF_INET:
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AF_INET6:
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
break;
|
|
|
|
#else
|
|
|
|
err = -EAFNOSUPPORT;
|
|
|
|
goto out;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
default:
|
|
|
|
goto out;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
err = -EINVAL;
|
|
|
|
switch (p->id.proto) {
|
|
|
|
case IPPROTO_AH:
|
2009-11-24 17:29:52 -07:00
|
|
|
if ((!attrs[XFRMA_ALG_AUTH] &&
|
|
|
|
!attrs[XFRMA_ALG_AUTH_TRUNC]) ||
|
2008-01-28 20:37:29 -07:00
|
|
|
attrs[XFRMA_ALG_AEAD] ||
|
2007-08-22 14:00:40 -07:00
|
|
|
attrs[XFRMA_ALG_CRYPT] ||
|
2010-12-07 21:37:49 -07:00
|
|
|
attrs[XFRMA_ALG_COMP] ||
|
|
|
|
attrs[XFRMA_TFCPAD])
|
2005-04-16 15:20:36 -07:00
|
|
|
goto out;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_ESP:
|
2008-01-28 20:37:29 -07:00
|
|
|
if (attrs[XFRMA_ALG_COMP])
|
|
|
|
goto out;
|
|
|
|
if (!attrs[XFRMA_ALG_AUTH] &&
|
2009-11-24 17:29:52 -07:00
|
|
|
!attrs[XFRMA_ALG_AUTH_TRUNC] &&
|
2008-01-28 20:37:29 -07:00
|
|
|
!attrs[XFRMA_ALG_CRYPT] &&
|
|
|
|
!attrs[XFRMA_ALG_AEAD])
|
|
|
|
goto out;
|
|
|
|
if ((attrs[XFRMA_ALG_AUTH] ||
|
2009-11-24 17:29:52 -07:00
|
|
|
attrs[XFRMA_ALG_AUTH_TRUNC] ||
|
2008-01-28 20:37:29 -07:00
|
|
|
attrs[XFRMA_ALG_CRYPT]) &&
|
|
|
|
attrs[XFRMA_ALG_AEAD])
|
2005-04-16 15:20:36 -07:00
|
|
|
goto out;
|
2010-12-07 21:37:49 -07:00
|
|
|
if (attrs[XFRMA_TFCPAD] &&
|
|
|
|
p->mode != XFRM_MODE_TUNNEL)
|
|
|
|
goto out;
|
2005-04-16 15:20:36 -07:00
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_COMP:
|
2007-08-22 14:00:40 -07:00
|
|
|
if (!attrs[XFRMA_ALG_COMP] ||
|
2008-01-28 20:37:29 -07:00
|
|
|
attrs[XFRMA_ALG_AEAD] ||
|
2007-08-22 14:00:40 -07:00
|
|
|
attrs[XFRMA_ALG_AUTH] ||
|
2009-11-24 17:29:52 -07:00
|
|
|
attrs[XFRMA_ALG_AUTH_TRUNC] ||
|
2010-12-07 21:37:49 -07:00
|
|
|
attrs[XFRMA_ALG_CRYPT] ||
|
|
|
|
attrs[XFRMA_TFCPAD])
|
2005-04-16 15:20:36 -07:00
|
|
|
goto out;
|
|
|
|
break;
|
|
|
|
|
2006-08-23 20:33:28 -07:00
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
case IPPROTO_DSTOPTS:
|
|
|
|
case IPPROTO_ROUTING:
|
2007-08-22 14:00:40 -07:00
|
|
|
if (attrs[XFRMA_ALG_COMP] ||
|
|
|
|
attrs[XFRMA_ALG_AUTH] ||
|
2009-11-24 17:29:52 -07:00
|
|
|
attrs[XFRMA_ALG_AUTH_TRUNC] ||
|
2008-01-28 20:37:29 -07:00
|
|
|
attrs[XFRMA_ALG_AEAD] ||
|
2007-08-22 14:00:40 -07:00
|
|
|
attrs[XFRMA_ALG_CRYPT] ||
|
|
|
|
attrs[XFRMA_ENCAP] ||
|
|
|
|
attrs[XFRMA_SEC_CTX] ||
|
2010-12-07 21:37:49 -07:00
|
|
|
attrs[XFRMA_TFCPAD] ||
|
2007-08-22 14:00:40 -07:00
|
|
|
!attrs[XFRMA_COADDR])
|
2006-08-23 20:33:28 -07:00
|
|
|
goto out;
|
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
default:
|
|
|
|
goto out;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2008-01-28 20:37:29 -07:00
|
|
|
if ((err = verify_aead(attrs)))
|
|
|
|
goto out;
|
2009-11-24 17:29:52 -07:00
|
|
|
if ((err = verify_auth_trunc(attrs)))
|
|
|
|
goto out;
|
2007-08-22 14:00:40 -07:00
|
|
|
if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
|
2005-04-16 15:20:36 -07:00
|
|
|
goto out;
|
2007-08-22 14:00:40 -07:00
|
|
|
if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
|
2005-04-16 15:20:36 -07:00
|
|
|
goto out;
|
2007-08-22 14:00:40 -07:00
|
|
|
if ((err = verify_one_alg(attrs, XFRMA_ALG_COMP)))
|
2005-04-16 15:20:36 -07:00
|
|
|
goto out;
|
2007-08-22 14:00:40 -07:00
|
|
|
if ((err = verify_sec_ctx_len(attrs)))
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
goto out;
|
2011-03-07 17:10:27 -07:00
|
|
|
if ((err = verify_replay(p, attrs)))
|
|
|
|
goto out;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
err = -EINVAL;
|
|
|
|
switch (p->mode) {
|
2006-09-22 15:05:15 -07:00
|
|
|
case XFRM_MODE_TRANSPORT:
|
|
|
|
case XFRM_MODE_TUNNEL:
|
2006-08-23 18:18:55 -07:00
|
|
|
case XFRM_MODE_ROUTEOPTIMIZATION:
|
2006-10-03 23:47:05 -07:00
|
|
|
case XFRM_MODE_BEET:
|
2005-04-16 15:20:36 -07:00
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
goto out;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
err = 0;
|
|
|
|
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
|
2011-02-28 00:04:45 -07:00
|
|
|
struct xfrm_algo_desc *(*get_byname)(const char *, int),
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rta)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
|
|
|
struct xfrm_algo *p, *ualg;
|
|
|
|
struct xfrm_algo_desc *algo;
|
|
|
|
|
|
|
|
if (!rta)
|
|
|
|
return 0;
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
ualg = nla_data(rta);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
algo = get_byname(ualg->alg_name, 1);
|
|
|
|
if (!algo)
|
|
|
|
return -ENOSYS;
|
|
|
|
*props = algo->desc.sadb_alg_id;
|
|
|
|
|
2008-01-09 00:39:06 -07:00
|
|
|
p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (!p)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2006-08-12 15:50:00 -07:00
|
|
|
strcpy(p->alg_name, algo->name);
|
2005-04-16 15:20:36 -07:00
|
|
|
*algpp = p;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-11-24 17:29:52 -07:00
|
|
|
static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
|
|
|
|
struct nlattr *rta)
|
|
|
|
{
|
|
|
|
struct xfrm_algo *ualg;
|
|
|
|
struct xfrm_algo_auth *p;
|
|
|
|
struct xfrm_algo_desc *algo;
|
|
|
|
|
|
|
|
if (!rta)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ualg = nla_data(rta);
|
|
|
|
|
|
|
|
algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
|
|
|
|
if (!algo)
|
|
|
|
return -ENOSYS;
|
|
|
|
*props = algo->desc.sadb_alg_id;
|
|
|
|
|
|
|
|
p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
|
|
|
|
if (!p)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
strcpy(p->alg_name, algo->name);
|
|
|
|
p->alg_key_len = ualg->alg_key_len;
|
|
|
|
p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
|
|
|
|
memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
|
|
|
|
|
|
|
|
*algpp = p;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
|
|
|
|
struct nlattr *rta)
|
|
|
|
{
|
|
|
|
struct xfrm_algo_auth *p, *ualg;
|
|
|
|
struct xfrm_algo_desc *algo;
|
|
|
|
|
|
|
|
if (!rta)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ualg = nla_data(rta);
|
|
|
|
|
|
|
|
algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
|
|
|
|
if (!algo)
|
|
|
|
return -ENOSYS;
|
2011-01-11 01:04:12 -07:00
|
|
|
if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
|
|
|
|
ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
|
2009-11-24 17:29:52 -07:00
|
|
|
return -EINVAL;
|
|
|
|
*props = algo->desc.sadb_alg_id;
|
|
|
|
|
|
|
|
p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
|
|
|
|
if (!p)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
strcpy(p->alg_name, algo->name);
|
|
|
|
if (!p->alg_trunc_len)
|
|
|
|
p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
|
|
|
|
|
|
|
|
*algpp = p;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-01-28 20:37:29 -07:00
|
|
|
static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
|
|
|
|
struct nlattr *rta)
|
|
|
|
{
|
|
|
|
struct xfrm_algo_aead *p, *ualg;
|
|
|
|
struct xfrm_algo_desc *algo;
|
|
|
|
|
|
|
|
if (!rta)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ualg = nla_data(rta);
|
|
|
|
|
|
|
|
algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
|
|
|
|
if (!algo)
|
|
|
|
return -ENOSYS;
|
|
|
|
*props = algo->desc.sadb_alg_id;
|
|
|
|
|
|
|
|
p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
|
|
|
|
if (!p)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
strcpy(p->alg_name, algo->name);
|
|
|
|
*algpp = p;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2011-03-28 12:47:30 -07:00
|
|
|
static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
|
|
|
|
struct nlattr *rp)
|
|
|
|
{
|
|
|
|
struct xfrm_replay_state_esn *up;
|
|
|
|
|
|
|
|
if (!replay_esn || !rp)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
up = nla_data(rp);
|
|
|
|
|
|
|
|
if (xfrm_replay_state_esn_len(replay_esn) !=
|
|
|
|
xfrm_replay_state_esn_len(up))
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
|
|
|
|
struct xfrm_replay_state_esn **preplay_esn,
|
|
|
|
struct nlattr *rta)
|
|
|
|
{
|
|
|
|
struct xfrm_replay_state_esn *p, *pp, *up;
|
|
|
|
|
|
|
|
if (!rta)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
up = nla_data(rta);
|
|
|
|
|
|
|
|
p = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
|
|
|
|
if (!p)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
pp = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
|
|
|
|
if (!pp) {
|
|
|
|
kfree(p);
|
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
|
|
|
|
*replay_esn = p;
|
|
|
|
*preplay_esn = pp;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-04-13 16:14:35 -07:00
|
|
|
static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
|
|
|
int len = 0;
|
|
|
|
|
|
|
|
if (xfrm_ctx) {
|
|
|
|
len += sizeof(struct xfrm_user_sec_ctx);
|
|
|
|
len += xfrm_ctx->ctx_len;
|
|
|
|
}
|
|
|
|
return len;
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
|
|
|
|
{
|
|
|
|
memcpy(&x->id, &p->id, sizeof(x->id));
|
|
|
|
memcpy(&x->sel, &p->sel, sizeof(x->sel));
|
|
|
|
memcpy(&x->lft, &p->lft, sizeof(x->lft));
|
|
|
|
x->props.mode = p->mode;
|
|
|
|
x->props.replay_window = p->replay_window;
|
|
|
|
x->props.reqid = p->reqid;
|
|
|
|
x->props.family = p->family;
|
2006-10-27 15:29:47 -07:00
|
|
|
memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
|
2005-04-16 15:20:36 -07:00
|
|
|
x->props.flags = p->flags;
|
2007-07-31 02:04:32 -07:00
|
|
|
|
2008-07-10 16:55:37 -07:00
|
|
|
if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
|
2007-07-31 02:04:32 -07:00
|
|
|
x->sel.family = p->family;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2006-03-20 20:16:12 -07:00
|
|
|
/*
|
|
|
|
* someday when pfkey also has support, we could have the code
|
|
|
|
* somehow made shareable and move it to xfrm_state.c - JHS
|
|
|
|
*
|
|
|
|
*/
|
2007-08-22 14:01:33 -07:00
|
|
|
static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
|
2006-03-20 20:16:12 -07:00
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
|
2011-03-07 17:10:27 -07:00
|
|
|
struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
|
|
|
|
struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
|
|
|
|
struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
if (re) {
|
|
|
|
struct xfrm_replay_state_esn *replay_esn;
|
|
|
|
replay_esn = nla_data(re);
|
|
|
|
memcpy(x->replay_esn, replay_esn,
|
|
|
|
xfrm_replay_state_esn_len(replay_esn));
|
|
|
|
memcpy(x->preplay_esn, replay_esn,
|
|
|
|
xfrm_replay_state_esn_len(replay_esn));
|
|
|
|
}
|
|
|
|
|
2006-03-20 20:16:12 -07:00
|
|
|
if (rp) {
|
|
|
|
struct xfrm_replay_state *replay;
|
2007-08-22 14:01:33 -07:00
|
|
|
replay = nla_data(rp);
|
2006-03-20 20:16:12 -07:00
|
|
|
memcpy(&x->replay, replay, sizeof(*replay));
|
|
|
|
memcpy(&x->preplay, replay, sizeof(*replay));
|
|
|
|
}
|
|
|
|
|
|
|
|
if (lt) {
|
|
|
|
struct xfrm_lifetime_cur *ltime;
|
2007-08-22 14:01:33 -07:00
|
|
|
ltime = nla_data(lt);
|
2006-03-20 20:16:12 -07:00
|
|
|
x->curlft.bytes = ltime->bytes;
|
|
|
|
x->curlft.packets = ltime->packets;
|
|
|
|
x->curlft.add_time = ltime->add_time;
|
|
|
|
x->curlft.use_time = ltime->use_time;
|
|
|
|
}
|
|
|
|
|
2007-08-22 13:59:04 -07:00
|
|
|
if (et)
|
2007-08-22 14:01:33 -07:00
|
|
|
x->replay_maxage = nla_get_u32(et);
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2007-08-22 13:59:04 -07:00
|
|
|
if (rt)
|
2007-08-22 14:01:33 -07:00
|
|
|
x->replay_maxdiff = nla_get_u32(rt);
|
2006-03-20 20:16:12 -07:00
|
|
|
}
|
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
static struct xfrm_state *xfrm_state_construct(struct net *net,
|
|
|
|
struct xfrm_usersa_info *p,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs,
|
2005-04-16 15:20:36 -07:00
|
|
|
int *errp)
|
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct xfrm_state *x = xfrm_state_alloc(net);
|
2005-04-16 15:20:36 -07:00
|
|
|
int err = -ENOMEM;
|
|
|
|
|
|
|
|
if (!x)
|
|
|
|
goto error_no_put;
|
|
|
|
|
|
|
|
copy_from_user_state(x, p);
|
|
|
|
|
2008-01-28 20:37:29 -07:00
|
|
|
if ((err = attach_aead(&x->aead, &x->props.ealgo,
|
|
|
|
attrs[XFRMA_ALG_AEAD])))
|
|
|
|
goto error;
|
2009-11-24 17:29:52 -07:00
|
|
|
if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
|
|
|
|
attrs[XFRMA_ALG_AUTH_TRUNC])))
|
2005-04-16 15:20:36 -07:00
|
|
|
goto error;
|
2009-11-24 17:29:52 -07:00
|
|
|
if (!x->props.aalgo) {
|
|
|
|
if ((err = attach_auth(&x->aalg, &x->props.aalgo,
|
|
|
|
attrs[XFRMA_ALG_AUTH])))
|
|
|
|
goto error;
|
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
|
|
|
|
xfrm_ealg_get_byname,
|
2007-08-22 14:00:40 -07:00
|
|
|
attrs[XFRMA_ALG_CRYPT])))
|
2005-04-16 15:20:36 -07:00
|
|
|
goto error;
|
|
|
|
if ((err = attach_one_algo(&x->calg, &x->props.calgo,
|
|
|
|
xfrm_calg_get_byname,
|
2007-08-22 14:00:40 -07:00
|
|
|
attrs[XFRMA_ALG_COMP])))
|
2005-04-16 15:20:36 -07:00
|
|
|
goto error;
|
2007-09-06 03:28:08 -07:00
|
|
|
|
|
|
|
if (attrs[XFRMA_ENCAP]) {
|
|
|
|
x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
|
|
|
|
sizeof(*x->encap), GFP_KERNEL);
|
|
|
|
if (x->encap == NULL)
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
2010-12-07 21:37:49 -07:00
|
|
|
if (attrs[XFRMA_TFCPAD])
|
|
|
|
x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
|
|
|
|
|
2007-09-06 03:28:08 -07:00
|
|
|
if (attrs[XFRMA_COADDR]) {
|
|
|
|
x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
|
|
|
|
sizeof(*x->coaddr), GFP_KERNEL);
|
|
|
|
if (x->coaddr == NULL)
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
xfrm_mark_get(attrs, &x->mark);
|
|
|
|
|
2011-03-21 18:08:28 -07:00
|
|
|
err = __xfrm_init_state(x, false);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (err)
|
|
|
|
goto error;
|
|
|
|
|
2007-09-06 03:28:08 -07:00
|
|
|
if (attrs[XFRMA_SEC_CTX] &&
|
|
|
|
security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
goto error;
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
|
|
|
|
attrs[XFRMA_REPLAY_ESN_VAL])))
|
|
|
|
goto error;
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
x->km.seq = p->seq;
|
2008-11-25 19:00:48 -07:00
|
|
|
x->replay_maxdiff = net->xfrm.sysctl_aevent_rseqth;
|
2006-03-20 20:16:12 -07:00
|
|
|
/* sysctl_xfrm_aevent_etime is in 100ms units */
|
2008-11-25 19:00:48 -07:00
|
|
|
x->replay_maxage = (net->xfrm.sysctl_aevent_etime*HZ)/XFRM_AE_ETH_M;
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2011-03-07 17:08:32 -07:00
|
|
|
if ((err = xfrm_init_replay(x)))
|
|
|
|
goto error;
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2011-03-07 17:08:32 -07:00
|
|
|
/* override default values from above */
|
2007-08-22 14:01:33 -07:00
|
|
|
xfrm_update_ae_params(x, attrs);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
return x;
|
|
|
|
|
|
|
|
error:
|
|
|
|
x->km.state = XFRM_STATE_DEAD;
|
|
|
|
xfrm_state_put(x);
|
|
|
|
error_no_put:
|
|
|
|
*errp = err;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_usersa_info *p = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_state *x;
|
|
|
|
int err;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct km_event c;
|
2011-03-03 11:55:40 -07:00
|
|
|
uid_t loginuid = audit_get_loginuid(current);
|
|
|
|
u32 sessionid = audit_get_sessionid(current);
|
|
|
|
u32 sid;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = verify_newsa_info(p, attrs);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
x = xfrm_state_construct(net, p, attrs, &err);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (!x)
|
|
|
|
return err;
|
|
|
|
|
2005-06-18 22:42:13 -07:00
|
|
|
xfrm_state_hold(x);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
|
|
|
|
err = xfrm_state_add(x);
|
|
|
|
else
|
|
|
|
err = xfrm_state_update(x);
|
|
|
|
|
2011-03-03 11:55:40 -07:00
|
|
|
security_task_getsecid(current, &sid);
|
2008-04-18 07:09:25 -07:00
|
|
|
xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
|
2006-11-27 12:11:54 -07:00
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
if (err < 0) {
|
|
|
|
x->km.state = XFRM_STATE_DEAD;
|
2006-02-22 15:47:13 -07:00
|
|
|
__xfrm_state_put(x);
|
2005-06-18 22:45:31 -07:00
|
|
|
goto out;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2005-06-18 22:42:13 -07:00
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
2005-06-18 22:44:37 -07:00
|
|
|
c.event = nlh->nlmsg_type;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
|
|
|
km_state_notify(x, &c);
|
2005-06-18 22:45:31 -07:00
|
|
|
out:
|
2005-06-18 22:42:13 -07:00
|
|
|
xfrm_state_put(x);
|
2005-04-16 15:20:36 -07:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
|
|
|
|
struct xfrm_usersa_id *p,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs,
|
2006-08-23 17:56:04 -07:00
|
|
|
int *errp)
|
|
|
|
{
|
|
|
|
struct xfrm_state *x = NULL;
|
2010-02-22 04:32:59 -07:00
|
|
|
struct xfrm_mark m;
|
2006-08-23 17:56:04 -07:00
|
|
|
int err;
|
2010-02-22 04:32:59 -07:00
|
|
|
u32 mark = xfrm_mark_get(attrs, &m);
|
2006-08-23 17:56:04 -07:00
|
|
|
|
|
|
|
if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
|
|
|
|
err = -ESRCH;
|
2010-02-22 04:32:59 -07:00
|
|
|
x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
|
2006-08-23 17:56:04 -07:00
|
|
|
} else {
|
|
|
|
xfrm_address_t *saddr = NULL;
|
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
verify_one_addr(attrs, XFRMA_SRCADDR, &saddr);
|
2006-08-23 17:56:04 -07:00
|
|
|
if (!saddr) {
|
|
|
|
err = -EINVAL;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
2006-11-24 21:34:51 -07:00
|
|
|
err = -ESRCH;
|
2010-02-22 04:32:59 -07:00
|
|
|
x = xfrm_state_lookup_byaddr(net, mark,
|
|
|
|
&p->daddr, saddr,
|
2008-11-25 18:30:50 -07:00
|
|
|
p->proto, p->family);
|
2006-08-23 17:56:04 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
out:
|
|
|
|
if (!x && errp)
|
|
|
|
*errp = err;
|
|
|
|
return x;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_state *x;
|
2006-08-23 17:56:04 -07:00
|
|
|
int err = -ESRCH;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct km_event c;
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_usersa_id *p = nlmsg_data(nlh);
|
2011-03-03 11:55:40 -07:00
|
|
|
uid_t loginuid = audit_get_loginuid(current);
|
|
|
|
u32 sessionid = audit_get_sessionid(current);
|
|
|
|
u32 sid;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
x = xfrm_user_state_lookup(net, p, attrs, &err);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (x == NULL)
|
2006-08-23 17:56:04 -07:00
|
|
|
return err;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2006-06-08 23:58:52 -07:00
|
|
|
if ((err = security_xfrm_state_delete(x)) != 0)
|
2006-06-08 23:39:49 -07:00
|
|
|
goto out;
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
if (xfrm_state_kern(x)) {
|
2006-06-08 23:39:49 -07:00
|
|
|
err = -EPERM;
|
|
|
|
goto out;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2005-06-18 22:42:13 -07:00
|
|
|
err = xfrm_state_delete(x);
|
2006-11-27 12:11:54 -07:00
|
|
|
|
2006-06-08 23:39:49 -07:00
|
|
|
if (err < 0)
|
|
|
|
goto out;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
2005-06-18 22:44:37 -07:00
|
|
|
c.event = nlh->nlmsg_type;
|
2005-06-18 22:42:13 -07:00
|
|
|
km_state_notify(x, &c);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2006-06-08 23:39:49 -07:00
|
|
|
out:
|
2011-03-03 11:55:40 -07:00
|
|
|
security_task_getsecid(current, &sid);
|
2008-04-18 07:09:25 -07:00
|
|
|
xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
|
2006-06-08 23:39:49 -07:00
|
|
|
xfrm_state_put(x);
|
2005-06-18 22:42:13 -07:00
|
|
|
return err;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
|
|
|
|
{
|
|
|
|
memcpy(&p->id, &x->id, sizeof(p->id));
|
|
|
|
memcpy(&p->sel, &x->sel, sizeof(p->sel));
|
|
|
|
memcpy(&p->lft, &x->lft, sizeof(p->lft));
|
|
|
|
memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
|
|
|
|
memcpy(&p->stats, &x->stats, sizeof(p->stats));
|
2006-10-27 15:29:47 -07:00
|
|
|
memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
|
2005-04-16 15:20:36 -07:00
|
|
|
p->mode = x->props.mode;
|
|
|
|
p->replay_window = x->props.replay_window;
|
|
|
|
p->reqid = x->props.reqid;
|
|
|
|
p->family = x->props.family;
|
|
|
|
p->flags = x->props.flags;
|
|
|
|
p->seq = x->km.seq;
|
|
|
|
}
|
|
|
|
|
|
|
|
struct xfrm_dump_info {
|
|
|
|
struct sk_buff *in_skb;
|
|
|
|
struct sk_buff *out_skb;
|
|
|
|
u32 nlmsg_seq;
|
|
|
|
u16 nlmsg_flags;
|
|
|
|
};
|
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
struct xfrm_user_sec_ctx *uctx;
|
|
|
|
struct nlattr *attr;
|
2007-10-09 13:30:57 -07:00
|
|
|
int ctx_size = sizeof(*uctx) + s->ctx_len;
|
2007-08-22 13:55:43 -07:00
|
|
|
|
|
|
|
attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
|
|
|
|
if (attr == NULL)
|
|
|
|
return -EMSGSIZE;
|
|
|
|
|
|
|
|
uctx = nla_data(attr);
|
|
|
|
uctx->exttype = XFRMA_SEC_CTX;
|
|
|
|
uctx->len = ctx_size;
|
|
|
|
uctx->ctx_doi = s->ctx_doi;
|
|
|
|
uctx->ctx_alg = s->ctx_alg;
|
|
|
|
uctx->ctx_len = s->ctx_len;
|
|
|
|
memcpy(uctx + 1, s->ctx_str, s->ctx_len);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-11-24 17:29:52 -07:00
|
|
|
static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
struct xfrm_algo *algo;
|
|
|
|
struct nlattr *nla;
|
|
|
|
|
|
|
|
nla = nla_reserve(skb, XFRMA_ALG_AUTH,
|
|
|
|
sizeof(*algo) + (auth->alg_key_len + 7) / 8);
|
|
|
|
if (!nla)
|
|
|
|
return -EMSGSIZE;
|
|
|
|
|
|
|
|
algo = nla_data(nla);
|
|
|
|
strcpy(algo->alg_name, auth->alg_name);
|
|
|
|
memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
|
|
|
|
algo->alg_key_len = auth->alg_key_len;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-10-09 13:30:57 -07:00
|
|
|
/* Don't change this without updating xfrm_sa_len! */
|
|
|
|
static int copy_to_user_state_extra(struct xfrm_state *x,
|
|
|
|
struct xfrm_usersa_info *p,
|
|
|
|
struct sk_buff *skb)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
|
|
|
copy_to_user_state(x, p);
|
|
|
|
|
2007-10-09 13:31:47 -07:00
|
|
|
if (x->coaddr)
|
|
|
|
NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
|
|
|
|
|
|
|
|
if (x->lastused)
|
|
|
|
NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
|
|
|
|
|
2008-01-28 20:37:29 -07:00
|
|
|
if (x->aead)
|
|
|
|
NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
|
2009-11-24 17:29:52 -07:00
|
|
|
if (x->aalg) {
|
|
|
|
if (copy_to_user_auth(x->aalg, skb))
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
NLA_PUT(skb, XFRMA_ALG_AUTH_TRUNC,
|
|
|
|
xfrm_alg_auth_len(x->aalg), x->aalg);
|
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
if (x->ealg)
|
2008-01-09 00:39:06 -07:00
|
|
|
NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (x->calg)
|
2007-08-22 13:55:43 -07:00
|
|
|
NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
if (x->encap)
|
2007-08-22 13:55:43 -07:00
|
|
|
NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2010-12-07 21:37:49 -07:00
|
|
|
if (x->tfcpad)
|
|
|
|
NLA_PUT_U32(skb, XFRMA_TFCPAD, x->tfcpad);
|
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
if (xfrm_mark_put(skb, &x->mark))
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
if (x->replay_esn)
|
|
|
|
NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
|
|
|
|
xfrm_replay_state_esn_len(x->replay_esn), x->replay_esn);
|
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
if (x->security && copy_sec_ctx(x->security, skb) < 0)
|
|
|
|
goto nla_put_failure;
|
2006-08-23 18:18:55 -07:00
|
|
|
|
2007-10-09 13:30:57 -07:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
nla_put_failure:
|
|
|
|
return -EMSGSIZE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
|
|
|
|
{
|
|
|
|
struct xfrm_dump_info *sp = ptr;
|
|
|
|
struct sk_buff *in_skb = sp->in_skb;
|
|
|
|
struct sk_buff *skb = sp->out_skb;
|
|
|
|
struct xfrm_usersa_info *p;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
|
|
|
|
XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
|
|
|
|
|
|
|
p = nlmsg_data(nlh);
|
|
|
|
|
|
|
|
err = copy_to_user_state_extra(x, p, skb);
|
|
|
|
if (err)
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_end(skb, nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
return 0;
|
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
nla_put_failure:
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_cancel(skb, nlh);
|
2007-10-09 13:30:57 -07:00
|
|
|
return err;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2008-02-28 22:31:08 -07:00
|
|
|
static int xfrm_dump_sa_done(struct netlink_callback *cb)
|
|
|
|
{
|
|
|
|
struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
|
|
|
|
xfrm_state_walk_done(walk);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
|
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2008-02-28 22:31:08 -07:00
|
|
|
struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_dump_info info;
|
|
|
|
|
2008-02-28 22:31:08 -07:00
|
|
|
BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
|
|
|
|
sizeof(cb->args) - sizeof(cb->args[0]));
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
info.in_skb = cb->skb;
|
|
|
|
info.out_skb = skb;
|
|
|
|
info.nlmsg_seq = cb->nlh->nlmsg_seq;
|
|
|
|
info.nlmsg_flags = NLM_F_MULTI;
|
2008-02-28 22:31:08 -07:00
|
|
|
|
|
|
|
if (!cb->args[0]) {
|
|
|
|
cb->args[0] = 1;
|
|
|
|
xfrm_state_walk_init(walk, 0);
|
|
|
|
}
|
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
(void) xfrm_state_walk(net, walk, dump_one_state, &info);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
return skb->len;
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
|
|
|
|
struct xfrm_state *x, u32 seq)
|
|
|
|
{
|
|
|
|
struct xfrm_dump_info info;
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (!skb)
|
|
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
|
|
|
|
info.in_skb = in_skb;
|
|
|
|
info.out_skb = skb;
|
|
|
|
info.nlmsg_seq = seq;
|
|
|
|
info.nlmsg_flags = 0;
|
|
|
|
|
|
|
|
if (dump_one_state(x, 0, &info)) {
|
|
|
|
kfree_skb(skb);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
}
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
static inline size_t xfrm_spdinfo_msgsize(void)
|
|
|
|
{
|
|
|
|
return NLMSG_ALIGN(4)
|
|
|
|
+ nla_total_size(sizeof(struct xfrmu_spdinfo))
|
|
|
|
+ nla_total_size(sizeof(struct xfrmu_spdhinfo));
|
|
|
|
}
|
|
|
|
|
2010-01-23 06:37:10 -07:00
|
|
|
static int build_spdinfo(struct sk_buff *skb, struct net *net,
|
|
|
|
u32 pid, u32 seq, u32 flags)
|
2007-04-28 21:20:32 -07:00
|
|
|
{
|
2007-05-04 12:55:39 -07:00
|
|
|
struct xfrmk_spdinfo si;
|
|
|
|
struct xfrmu_spdinfo spc;
|
|
|
|
struct xfrmu_spdhinfo sph;
|
2007-04-28 21:20:32 -07:00
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
u32 *f;
|
|
|
|
|
|
|
|
nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
|
2011-03-30 18:57:33 -07:00
|
|
|
if (nlh == NULL) /* shouldn't really happen ... */
|
2007-04-28 21:20:32 -07:00
|
|
|
return -EMSGSIZE;
|
|
|
|
|
|
|
|
f = nlmsg_data(nlh);
|
|
|
|
*f = flags;
|
2010-01-23 06:37:10 -07:00
|
|
|
xfrm_spd_getinfo(net, &si);
|
2007-05-04 12:55:39 -07:00
|
|
|
spc.incnt = si.incnt;
|
|
|
|
spc.outcnt = si.outcnt;
|
|
|
|
spc.fwdcnt = si.fwdcnt;
|
|
|
|
spc.inscnt = si.inscnt;
|
|
|
|
spc.outscnt = si.outscnt;
|
|
|
|
spc.fwdscnt = si.fwdscnt;
|
|
|
|
sph.spdhcnt = si.spdhcnt;
|
|
|
|
sph.spdhmcnt = si.spdhmcnt;
|
|
|
|
|
|
|
|
NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
|
|
|
|
NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
|
2007-04-28 21:20:32 -07:00
|
|
|
|
|
|
|
return nlmsg_end(skb, nlh);
|
|
|
|
|
|
|
|
nla_put_failure:
|
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2007-04-28 21:20:32 -07:00
|
|
|
{
|
2008-11-25 18:38:20 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2007-04-28 21:20:32 -07:00
|
|
|
struct sk_buff *r_skb;
|
2007-08-22 13:53:52 -07:00
|
|
|
u32 *flags = nlmsg_data(nlh);
|
2007-04-28 21:20:32 -07:00
|
|
|
u32 spid = NETLINK_CB(skb).pid;
|
|
|
|
u32 seq = nlh->nlmsg_seq;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
|
2007-04-28 21:20:32 -07:00
|
|
|
if (r_skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2010-01-23 06:37:10 -07:00
|
|
|
if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
|
2007-04-28 21:20:32 -07:00
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
|
2007-04-28 21:20:32 -07:00
|
|
|
}
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
static inline size_t xfrm_sadinfo_msgsize(void)
|
|
|
|
{
|
|
|
|
return NLMSG_ALIGN(4)
|
|
|
|
+ nla_total_size(sizeof(struct xfrmu_sadhinfo))
|
|
|
|
+ nla_total_size(4); /* XFRMA_SAD_CNT */
|
|
|
|
}
|
|
|
|
|
2010-01-23 06:37:10 -07:00
|
|
|
static int build_sadinfo(struct sk_buff *skb, struct net *net,
|
|
|
|
u32 pid, u32 seq, u32 flags)
|
2007-04-26 00:10:29 -07:00
|
|
|
{
|
2007-05-04 12:55:13 -07:00
|
|
|
struct xfrmk_sadinfo si;
|
|
|
|
struct xfrmu_sadhinfo sh;
|
2007-04-26 00:10:29 -07:00
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
u32 *f;
|
|
|
|
|
|
|
|
nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
|
2011-03-30 18:57:33 -07:00
|
|
|
if (nlh == NULL) /* shouldn't really happen ... */
|
2007-04-26 00:10:29 -07:00
|
|
|
return -EMSGSIZE;
|
|
|
|
|
|
|
|
f = nlmsg_data(nlh);
|
|
|
|
*f = flags;
|
2010-01-23 06:37:10 -07:00
|
|
|
xfrm_sad_getinfo(net, &si);
|
2007-04-26 00:10:29 -07:00
|
|
|
|
2007-05-04 12:55:13 -07:00
|
|
|
sh.sadhmcnt = si.sadhmcnt;
|
|
|
|
sh.sadhcnt = si.sadhcnt;
|
|
|
|
|
|
|
|
NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
|
|
|
|
NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
|
2007-04-26 00:10:29 -07:00
|
|
|
|
|
|
|
return nlmsg_end(skb, nlh);
|
|
|
|
|
|
|
|
nla_put_failure:
|
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2007-04-26 00:10:29 -07:00
|
|
|
{
|
2008-11-25 18:38:20 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2007-04-26 00:10:29 -07:00
|
|
|
struct sk_buff *r_skb;
|
2007-08-22 13:53:52 -07:00
|
|
|
u32 *flags = nlmsg_data(nlh);
|
2007-04-26 00:10:29 -07:00
|
|
|
u32 spid = NETLINK_CB(skb).pid;
|
|
|
|
u32 seq = nlh->nlmsg_seq;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
|
2007-04-26 00:10:29 -07:00
|
|
|
if (r_skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2010-01-23 06:37:10 -07:00
|
|
|
if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
|
2007-04-26 00:10:29 -07:00
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
|
2007-04-26 00:10:29 -07:00
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_usersa_id *p = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_state *x;
|
|
|
|
struct sk_buff *resp_skb;
|
2006-08-23 17:56:04 -07:00
|
|
|
int err = -ESRCH;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
x = xfrm_user_state_lookup(net, p, attrs, &err);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (x == NULL)
|
|
|
|
goto out_noput;
|
|
|
|
|
|
|
|
resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
|
|
|
|
if (IS_ERR(resp_skb)) {
|
|
|
|
err = PTR_ERR(resp_skb);
|
|
|
|
} else {
|
2008-11-25 18:38:20 -07:00
|
|
|
err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
xfrm_state_put(x);
|
|
|
|
out_noput:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int verify_userspi_info(struct xfrm_userspi_info *p)
|
|
|
|
{
|
|
|
|
switch (p->info.id.proto) {
|
|
|
|
case IPPROTO_AH:
|
|
|
|
case IPPROTO_ESP:
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_COMP:
|
|
|
|
/* IPCOMP spi is 16-bits. */
|
|
|
|
if (p->max >= 0x10000)
|
|
|
|
return -EINVAL;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
if (p->min > p->max)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_state *x;
|
|
|
|
struct xfrm_userspi_info *p;
|
|
|
|
struct sk_buff *resp_skb;
|
|
|
|
xfrm_address_t *daddr;
|
|
|
|
int family;
|
|
|
|
int err;
|
2010-02-22 04:32:59 -07:00
|
|
|
u32 mark;
|
|
|
|
struct xfrm_mark m;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
p = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
err = verify_userspi_info(p);
|
|
|
|
if (err)
|
|
|
|
goto out_noput;
|
|
|
|
|
|
|
|
family = p->info.family;
|
|
|
|
daddr = &p->info.id.daddr;
|
|
|
|
|
|
|
|
x = NULL;
|
2010-02-22 04:32:59 -07:00
|
|
|
|
|
|
|
mark = xfrm_mark_get(attrs, &m);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (p->info.seq) {
|
2010-02-22 04:32:59 -07:00
|
|
|
x = xfrm_find_acq_byseq(net, mark, p->info.seq);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
|
|
|
|
xfrm_state_put(x);
|
|
|
|
x = NULL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!x)
|
2010-02-22 04:32:59 -07:00
|
|
|
x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
|
2005-04-16 15:20:36 -07:00
|
|
|
p->info.id.proto, daddr,
|
|
|
|
&p->info.saddr, 1,
|
|
|
|
family);
|
|
|
|
err = -ENOENT;
|
|
|
|
if (x == NULL)
|
|
|
|
goto out_noput;
|
|
|
|
|
2007-10-09 13:29:52 -07:00
|
|
|
err = xfrm_alloc_spi(x, p->min, p->max);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-10-09 13:29:52 -07:00
|
|
|
resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (IS_ERR(resp_skb)) {
|
|
|
|
err = PTR_ERR(resp_skb);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).pid);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
out:
|
|
|
|
xfrm_state_put(x);
|
|
|
|
out_noput:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2006-11-27 13:59:30 -07:00
|
|
|
static int verify_policy_dir(u8 dir)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
|
|
|
switch (dir) {
|
|
|
|
case XFRM_POLICY_IN:
|
|
|
|
case XFRM_POLICY_OUT:
|
|
|
|
case XFRM_POLICY_FWD:
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-11-27 13:59:30 -07:00
|
|
|
static int verify_policy_type(u8 type)
|
2006-08-23 22:49:28 -07:00
|
|
|
{
|
|
|
|
switch (type) {
|
|
|
|
case XFRM_POLICY_TYPE_MAIN:
|
|
|
|
#ifdef CONFIG_XFRM_SUB_POLICY
|
|
|
|
case XFRM_POLICY_TYPE_SUB:
|
|
|
|
#endif
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2006-08-23 22:49:28 -07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
|
|
|
|
{
|
|
|
|
switch (p->share) {
|
|
|
|
case XFRM_SHARE_ANY:
|
|
|
|
case XFRM_SHARE_SESSION:
|
|
|
|
case XFRM_SHARE_USER:
|
|
|
|
case XFRM_SHARE_UNIQUE:
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
switch (p->action) {
|
|
|
|
case XFRM_POLICY_ALLOW:
|
|
|
|
case XFRM_POLICY_BLOCK:
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
switch (p->sel.family) {
|
|
|
|
case AF_INET:
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AF_INET6:
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
break;
|
|
|
|
#else
|
|
|
|
return -EAFNOSUPPORT;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
return verify_policy_dir(p->dir);
|
|
|
|
}
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_SEC_CTX];
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
struct xfrm_user_sec_ctx *uctx;
|
|
|
|
|
|
|
|
if (!rt)
|
|
|
|
return 0;
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
uctx = nla_data(rt);
|
2008-04-12 19:07:52 -07:00
|
|
|
return security_xfrm_policy_alloc(&pol->security, uctx);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
|
|
|
|
int nr)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
xp->xfrm_nr = nr;
|
|
|
|
for (i = 0; i < nr; i++, ut++) {
|
|
|
|
struct xfrm_tmpl *t = &xp->xfrm_vec[i];
|
|
|
|
|
|
|
|
memcpy(&t->id, &ut->id, sizeof(struct xfrm_id));
|
|
|
|
memcpy(&t->saddr, &ut->saddr,
|
|
|
|
sizeof(xfrm_address_t));
|
|
|
|
t->reqid = ut->reqid;
|
|
|
|
t->mode = ut->mode;
|
|
|
|
t->share = ut->share;
|
|
|
|
t->optional = ut->optional;
|
|
|
|
t->aalgos = ut->aalgos;
|
|
|
|
t->ealgos = ut->ealgos;
|
|
|
|
t->calgos = ut->calgos;
|
2008-04-22 00:46:42 -07:00
|
|
|
/* If all masks are ~0, then we allow all algorithms. */
|
|
|
|
t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
|
2006-11-30 17:40:51 -07:00
|
|
|
t->encap_family = ut->family;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2006-12-03 20:19:26 -07:00
|
|
|
static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if (nr > XFRM_MAX_DEPTH)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
for (i = 0; i < nr; i++) {
|
|
|
|
/* We never validated the ut->family value, so many
|
|
|
|
* applications simply leave it at zero. The check was
|
|
|
|
* never made and ut->family was ignored because all
|
|
|
|
* templates could be assumed to have the same family as
|
|
|
|
* the policy itself. Now that we will have ipv4-in-ipv6
|
|
|
|
* and ipv6-in-ipv4 tunnels, this is no longer true.
|
|
|
|
*/
|
|
|
|
if (!ut[i].family)
|
|
|
|
ut[i].family = family;
|
|
|
|
|
|
|
|
switch (ut[i].family) {
|
|
|
|
case AF_INET:
|
|
|
|
break;
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
case AF_INET6:
|
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2006-12-03 20:19:26 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_TMPL];
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
if (!rt) {
|
|
|
|
pol->xfrm_nr = 0;
|
|
|
|
} else {
|
2007-08-22 14:01:33 -07:00
|
|
|
struct xfrm_user_tmpl *utmpl = nla_data(rt);
|
|
|
|
int nr = nla_len(rt) / sizeof(*utmpl);
|
2006-12-03 20:19:26 -07:00
|
|
|
int err;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2006-12-03 20:19:26 -07:00
|
|
|
err = validate_tmpl(nr, utmpl, pol->family);
|
|
|
|
if (err)
|
|
|
|
return err;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
copy_templates(pol, utmpl, nr);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
static int copy_from_user_policy_type(u8 *tp, struct nlattr **attrs)
|
2006-08-23 22:49:28 -07:00
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_POLICY_TYPE];
|
2006-08-23 22:49:28 -07:00
|
|
|
struct xfrm_userpolicy_type *upt;
|
2006-11-27 13:59:30 -07:00
|
|
|
u8 type = XFRM_POLICY_TYPE_MAIN;
|
2006-08-23 22:49:28 -07:00
|
|
|
int err;
|
|
|
|
|
|
|
|
if (rt) {
|
2007-08-22 14:01:33 -07:00
|
|
|
upt = nla_data(rt);
|
2006-08-23 22:49:28 -07:00
|
|
|
type = upt->type;
|
|
|
|
}
|
|
|
|
|
|
|
|
err = verify_policy_type(type);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
*tp = type;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p)
|
|
|
|
{
|
|
|
|
xp->priority = p->priority;
|
|
|
|
xp->index = p->index;
|
|
|
|
memcpy(&xp->selector, &p->sel, sizeof(xp->selector));
|
|
|
|
memcpy(&xp->lft, &p->lft, sizeof(xp->lft));
|
|
|
|
xp->action = p->action;
|
|
|
|
xp->flags = p->flags;
|
|
|
|
xp->family = p->sel.family;
|
|
|
|
/* XXX xp->share = p->share; */
|
|
|
|
}
|
|
|
|
|
|
|
|
static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
|
|
|
|
{
|
|
|
|
memcpy(&p->sel, &xp->selector, sizeof(p->sel));
|
|
|
|
memcpy(&p->lft, &xp->lft, sizeof(p->lft));
|
|
|
|
memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
|
|
|
|
p->priority = xp->priority;
|
|
|
|
p->index = xp->index;
|
|
|
|
p->sel.family = xp->family;
|
|
|
|
p->dir = dir;
|
|
|
|
p->action = xp->action;
|
|
|
|
p->flags = xp->flags;
|
|
|
|
p->share = XFRM_SHARE_ANY; /* XXX xp->share */
|
|
|
|
}
|
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_userpolicy_info *p, struct nlattr **attrs, int *errp)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct xfrm_policy *xp = xfrm_policy_alloc(net, GFP_KERNEL);
|
2005-04-16 15:20:36 -07:00
|
|
|
int err;
|
|
|
|
|
|
|
|
if (!xp) {
|
|
|
|
*errp = -ENOMEM;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
copy_from_user_policy(xp, p);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = copy_from_user_policy_type(&xp->type, attrs);
|
2006-08-23 22:49:28 -07:00
|
|
|
if (err)
|
|
|
|
goto error;
|
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
if (!(err = copy_from_user_tmpl(xp, attrs)))
|
|
|
|
err = copy_from_user_sec_ctx(xp, attrs);
|
2006-08-23 22:49:28 -07:00
|
|
|
if (err)
|
|
|
|
goto error;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2010-02-22 04:33:00 -07:00
|
|
|
xfrm_mark_get(attrs, &xp->mark);
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
return xp;
|
2006-08-23 22:49:28 -07:00
|
|
|
error:
|
|
|
|
*errp = err;
|
2008-10-01 07:03:24 -07:00
|
|
|
xp->walk.dead = 1;
|
2008-01-07 23:34:29 -07:00
|
|
|
xfrm_policy_destroy(xp);
|
2006-08-23 22:49:28 -07:00
|
|
|
return NULL;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_userpolicy_info *p = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_policy *xp;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct km_event c;
|
2005-04-16 15:20:36 -07:00
|
|
|
int err;
|
|
|
|
int excl;
|
2011-03-03 11:55:40 -07:00
|
|
|
uid_t loginuid = audit_get_loginuid(current);
|
|
|
|
u32 sessionid = audit_get_sessionid(current);
|
|
|
|
u32 sid;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
err = verify_newpolicy_info(p);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
2007-08-22 14:00:40 -07:00
|
|
|
err = verify_sec_ctx_len(attrs);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
xp = xfrm_policy_construct(net, p, attrs, &err);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (!xp)
|
|
|
|
return err;
|
|
|
|
|
2011-03-30 18:57:33 -07:00
|
|
|
/* shouldn't excl be based on nlh flags??
|
2005-06-18 22:42:13 -07:00
|
|
|
* Aha! this is anti-netlink really i.e more pfkey derived
|
|
|
|
* in netlink excl is a flag and you wouldnt need
|
|
|
|
* a type XFRM_MSG_UPDPOLICY - JHS */
|
2005-04-16 15:20:36 -07:00
|
|
|
excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
|
|
|
|
err = xfrm_policy_insert(p->dir, xp, excl);
|
2011-03-03 11:55:40 -07:00
|
|
|
security_task_getsecid(current, &sid);
|
2008-04-18 07:09:25 -07:00
|
|
|
xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
|
2006-11-27 12:11:54 -07:00
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
if (err) {
|
2008-04-12 19:07:52 -07:00
|
|
|
security_xfrm_policy_free(xp->security);
|
2005-04-16 15:20:36 -07:00
|
|
|
kfree(xp);
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2005-06-18 22:44:37 -07:00
|
|
|
c.event = nlh->nlmsg_type;
|
2005-06-18 22:42:13 -07:00
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
|
|
|
km_policy_notify(xp, p->dir, &c);
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
xfrm_pol_put(xp);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if (xp->xfrm_nr == 0)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
for (i = 0; i < xp->xfrm_nr; i++) {
|
|
|
|
struct xfrm_user_tmpl *up = &vec[i];
|
|
|
|
struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
|
|
|
|
|
|
|
|
memcpy(&up->id, &kp->id, sizeof(up->id));
|
2006-11-30 17:40:51 -07:00
|
|
|
up->family = kp->encap_family;
|
2005-04-16 15:20:36 -07:00
|
|
|
memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
|
|
|
|
up->reqid = kp->reqid;
|
|
|
|
up->mode = kp->mode;
|
|
|
|
up->share = kp->share;
|
|
|
|
up->optional = kp->optional;
|
|
|
|
up->aalgos = kp->aalgos;
|
|
|
|
up->ealgos = kp->ealgos;
|
|
|
|
up->calgos = kp->calgos;
|
|
|
|
}
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
return nla_put(skb, XFRMA_TMPL,
|
|
|
|
sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr, vec);
|
2006-07-24 23:30:44 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
if (x->security) {
|
|
|
|
return copy_sec_ctx(x->security, skb);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
}
|
|
|
|
return 0;
|
2006-07-24 23:30:44 -07:00
|
|
|
}
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2006-07-24 23:30:44 -07:00
|
|
|
static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
if (xp->security) {
|
|
|
|
return copy_sec_ctx(xp->security, skb);
|
|
|
|
}
|
|
|
|
return 0;
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
}
|
2007-08-22 13:57:04 -07:00
|
|
|
static inline size_t userpolicy_type_attrsize(void)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_XFRM_SUB_POLICY
|
|
|
|
return nla_total_size(sizeof(struct xfrm_userpolicy_type));
|
|
|
|
#else
|
|
|
|
return 0;
|
|
|
|
#endif
|
|
|
|
}
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2006-08-23 22:49:28 -07:00
|
|
|
#ifdef CONFIG_XFRM_SUB_POLICY
|
2006-11-27 13:59:30 -07:00
|
|
|
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
|
2006-08-23 22:49:28 -07:00
|
|
|
{
|
2007-08-22 13:55:43 -07:00
|
|
|
struct xfrm_userpolicy_type upt = {
|
|
|
|
.type = type,
|
|
|
|
};
|
2006-08-23 22:49:28 -07:00
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
|
2006-08-23 22:49:28 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
#else
|
2006-11-27 13:59:30 -07:00
|
|
|
static inline int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
|
2006-08-23 22:49:28 -07:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
|
|
|
|
{
|
|
|
|
struct xfrm_dump_info *sp = ptr;
|
|
|
|
struct xfrm_userpolicy_info *p;
|
|
|
|
struct sk_buff *in_skb = sp->in_skb;
|
|
|
|
struct sk_buff *skb = sp->out_skb;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
|
|
|
|
XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
p = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
copy_to_user_policy(xp, p, dir);
|
|
|
|
if (copy_to_user_tmpl(xp, skb) < 0)
|
|
|
|
goto nlmsg_failure;
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
if (copy_to_user_sec_ctx(xp, skb))
|
|
|
|
goto nlmsg_failure;
|
2006-11-20 17:51:22 -07:00
|
|
|
if (copy_to_user_policy_type(xp->type, skb) < 0)
|
2006-08-23 22:49:28 -07:00
|
|
|
goto nlmsg_failure;
|
2010-02-22 04:33:00 -07:00
|
|
|
if (xfrm_mark_put(skb, &xp->mark))
|
|
|
|
goto nla_put_failure;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_end(skb, nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
return 0;
|
|
|
|
|
2010-02-22 04:33:00 -07:00
|
|
|
nla_put_failure:
|
2005-04-16 15:20:36 -07:00
|
|
|
nlmsg_failure:
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2008-02-28 22:31:08 -07:00
|
|
|
static int xfrm_dump_policy_done(struct netlink_callback *cb)
|
|
|
|
{
|
|
|
|
struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
|
|
|
|
|
|
|
|
xfrm_policy_walk_done(walk);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
|
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2008-02-28 22:31:08 -07:00
|
|
|
struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_dump_info info;
|
|
|
|
|
2008-02-28 22:31:08 -07:00
|
|
|
BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
|
|
|
|
sizeof(cb->args) - sizeof(cb->args[0]));
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
info.in_skb = cb->skb;
|
|
|
|
info.out_skb = skb;
|
|
|
|
info.nlmsg_seq = cb->nlh->nlmsg_seq;
|
|
|
|
info.nlmsg_flags = NLM_F_MULTI;
|
2008-02-28 22:31:08 -07:00
|
|
|
|
|
|
|
if (!cb->args[0]) {
|
|
|
|
cb->args[0] = 1;
|
|
|
|
xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
|
|
|
|
}
|
|
|
|
|
2008-11-25 18:50:08 -07:00
|
|
|
(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
return skb->len;
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
|
|
|
|
struct xfrm_policy *xp,
|
|
|
|
int dir, u32 seq)
|
|
|
|
{
|
|
|
|
struct xfrm_dump_info info;
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (!skb)
|
|
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
|
|
|
|
info.in_skb = in_skb;
|
|
|
|
info.out_skb = skb;
|
|
|
|
info.nlmsg_seq = seq;
|
|
|
|
info.nlmsg_flags = 0;
|
|
|
|
|
|
|
|
if (dump_one_policy(xp, dir, 0, &info) < 0) {
|
|
|
|
kfree_skb(skb);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_policy *xp;
|
|
|
|
struct xfrm_userpolicy_id *p;
|
2006-11-27 13:59:30 -07:00
|
|
|
u8 type = XFRM_POLICY_TYPE_MAIN;
|
2005-04-16 15:20:36 -07:00
|
|
|
int err;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct km_event c;
|
2005-04-16 15:20:36 -07:00
|
|
|
int delete;
|
2010-02-22 04:33:00 -07:00
|
|
|
struct xfrm_mark m;
|
|
|
|
u32 mark = xfrm_mark_get(attrs, &m);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
p = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
|
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = copy_from_user_policy_type(&type, attrs);
|
2006-08-23 22:49:28 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
err = verify_policy_dir(p->dir);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
if (p->index)
|
2010-02-22 04:33:00 -07:00
|
|
|
xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
else {
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_SEC_CTX];
|
2008-04-12 19:07:52 -07:00
|
|
|
struct xfrm_sec_ctx *ctx;
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = verify_sec_ctx_len(attrs);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2008-04-14 14:47:48 -07:00
|
|
|
ctx = NULL;
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
if (rt) {
|
2007-08-22 14:01:33 -07:00
|
|
|
struct xfrm_user_sec_ctx *uctx = nla_data(rt);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2008-04-12 19:07:52 -07:00
|
|
|
err = security_xfrm_policy_alloc(&ctx, uctx);
|
|
|
|
if (err)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
return err;
|
2008-04-14 14:47:48 -07:00
|
|
|
}
|
2010-02-22 04:33:00 -07:00
|
|
|
xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
|
2010-02-22 04:32:59 -07:00
|
|
|
ctx, delete, &err);
|
2008-04-12 19:07:52 -07:00
|
|
|
security_xfrm_policy_free(ctx);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
if (xp == NULL)
|
|
|
|
return -ENOENT;
|
|
|
|
|
|
|
|
if (!delete) {
|
|
|
|
struct sk_buff *resp_skb;
|
|
|
|
|
|
|
|
resp_skb = xfrm_policy_netlink(skb, xp, p->dir, nlh->nlmsg_seq);
|
|
|
|
if (IS_ERR(resp_skb)) {
|
|
|
|
err = PTR_ERR(resp_skb);
|
|
|
|
} else {
|
2008-11-25 18:38:20 -07:00
|
|
|
err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
|
2007-08-22 13:54:36 -07:00
|
|
|
NETLINK_CB(skb).pid);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
2005-06-18 22:42:13 -07:00
|
|
|
} else {
|
2011-03-03 11:55:40 -07:00
|
|
|
uid_t loginuid = audit_get_loginuid(current);
|
|
|
|
u32 sessionid = audit_get_sessionid(current);
|
|
|
|
u32 sid;
|
2008-04-18 07:09:25 -07:00
|
|
|
|
2011-03-03 11:55:40 -07:00
|
|
|
security_task_getsecid(current, &sid);
|
2008-04-18 07:09:25 -07:00
|
|
|
xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
|
|
|
|
sid);
|
2007-02-12 14:53:54 -07:00
|
|
|
|
|
|
|
if (err != 0)
|
2006-06-08 23:39:49 -07:00
|
|
|
goto out;
|
2007-02-12 14:53:54 -07:00
|
|
|
|
2005-06-18 22:44:18 -07:00
|
|
|
c.data.byid = p->index;
|
2005-06-18 22:44:37 -07:00
|
|
|
c.event = nlh->nlmsg_type;
|
2005-06-18 22:42:13 -07:00
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
|
|
|
km_policy_notify(xp, p->dir, &c);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2006-06-08 23:39:49 -07:00
|
|
|
out:
|
2007-03-07 16:37:58 -07:00
|
|
|
xfrm_pol_put(xp);
|
2005-04-16 15:20:36 -07:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2005-06-18 22:42:13 -07:00
|
|
|
struct km_event c;
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_usersa_flush *p = nlmsg_data(nlh);
|
2006-11-27 12:11:54 -07:00
|
|
|
struct xfrm_audit audit_info;
|
2007-06-04 16:05:57 -07:00
|
|
|
int err;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2011-03-03 11:55:40 -07:00
|
|
|
audit_info.loginuid = audit_get_loginuid(current);
|
|
|
|
audit_info.sessionid = audit_get_sessionid(current);
|
|
|
|
security_task_getsecid(current, &audit_info.secid);
|
2008-11-25 18:50:08 -07:00
|
|
|
err = xfrm_state_flush(net, p->proto, &audit_info);
|
2010-02-18 19:00:41 -07:00
|
|
|
if (err) {
|
|
|
|
if (err == -ESRCH) /* empty table */
|
|
|
|
return 0;
|
2010-02-17 14:41:40 -07:00
|
|
|
return err;
|
2010-02-18 19:00:41 -07:00
|
|
|
}
|
2005-06-18 22:44:00 -07:00
|
|
|
c.data.proto = p->proto;
|
2005-06-18 22:44:37 -07:00
|
|
|
c.event = nlh->nlmsg_type;
|
2005-06-18 22:42:13 -07:00
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
2008-11-25 18:50:36 -07:00
|
|
|
c.net = net;
|
2005-06-18 22:42:13 -07:00
|
|
|
km_state_notify(NULL, &c);
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x)
|
2007-08-22 13:57:39 -07:00
|
|
|
{
|
2011-03-07 17:10:27 -07:00
|
|
|
size_t replay_size = x->replay_esn ?
|
|
|
|
xfrm_replay_state_esn_len(x->replay_esn) :
|
|
|
|
sizeof(struct xfrm_replay_state);
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
|
2011-03-07 17:10:27 -07:00
|
|
|
+ nla_total_size(replay_size)
|
2007-08-22 13:57:39 -07:00
|
|
|
+ nla_total_size(sizeof(struct xfrm_lifetime_cur))
|
2010-02-22 04:32:59 -07:00
|
|
|
+ nla_total_size(sizeof(struct xfrm_mark))
|
2007-08-22 13:57:39 -07:00
|
|
|
+ nla_total_size(4) /* XFRM_AE_RTHR */
|
|
|
|
+ nla_total_size(4); /* XFRM_AE_ETHR */
|
|
|
|
}
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
|
2006-03-20 20:16:12 -07:00
|
|
|
{
|
|
|
|
struct xfrm_aevent_id *id;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id), 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
id = nlmsg_data(nlh);
|
2006-12-02 23:22:25 -07:00
|
|
|
memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
|
2006-03-20 20:16:12 -07:00
|
|
|
id->sa_id.spi = x->id.spi;
|
|
|
|
id->sa_id.family = x->props.family;
|
|
|
|
id->sa_id.proto = x->id.proto;
|
2006-12-02 23:22:25 -07:00
|
|
|
memcpy(&id->saddr, &x->props.saddr,sizeof(x->props.saddr));
|
|
|
|
id->reqid = x->props.reqid;
|
2006-03-20 20:16:12 -07:00
|
|
|
id->flags = c->data.aevent;
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
if (x->replay_esn)
|
|
|
|
NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
|
|
|
|
xfrm_replay_state_esn_len(x->replay_esn),
|
|
|
|
x->replay_esn);
|
|
|
|
else
|
|
|
|
NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
|
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
if (id->flags & XFRM_AE_RTHR)
|
|
|
|
NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
if (id->flags & XFRM_AE_ETHR)
|
|
|
|
NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
|
|
|
|
x->replay_maxage * 10 / HZ);
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
if (xfrm_mark_put(skb, &x->mark))
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
return nlmsg_end(skb, nlh);
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
nla_put_failure:
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
2006-03-20 20:16:12 -07:00
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2006-03-20 20:16:12 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2006-03-20 20:16:12 -07:00
|
|
|
struct xfrm_state *x;
|
|
|
|
struct sk_buff *r_skb;
|
|
|
|
int err;
|
|
|
|
struct km_event c;
|
2010-02-22 04:32:59 -07:00
|
|
|
u32 mark;
|
|
|
|
struct xfrm_mark m;
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_aevent_id *p = nlmsg_data(nlh);
|
2006-03-20 20:16:12 -07:00
|
|
|
struct xfrm_usersa_id *id = &p->sa_id;
|
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
mark = xfrm_mark_get(attrs, &m);
|
|
|
|
|
|
|
|
x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
|
2011-03-07 17:10:27 -07:00
|
|
|
if (x == NULL)
|
2006-03-20 20:16:12 -07:00
|
|
|
return -ESRCH;
|
2011-03-07 17:10:27 -07:00
|
|
|
|
|
|
|
r_skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
|
|
|
|
if (r_skb == NULL) {
|
|
|
|
xfrm_state_put(x);
|
|
|
|
return -ENOMEM;
|
2006-03-20 20:16:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* XXX: is this lock really needed - none of the other
|
|
|
|
* gets lock (the concern is things getting updated
|
|
|
|
* while we are still reading) - jhs
|
|
|
|
*/
|
|
|
|
spin_lock_bh(&x->lock);
|
|
|
|
c.data.aevent = p->flags;
|
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
|
|
|
|
|
|
|
if (build_aevent(r_skb, x, &c) < 0)
|
|
|
|
BUG();
|
2008-11-25 18:38:20 -07:00
|
|
|
err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).pid);
|
2006-03-20 20:16:12 -07:00
|
|
|
spin_unlock_bh(&x->lock);
|
|
|
|
xfrm_state_put(x);
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2006-03-20 20:16:12 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2006-03-20 20:16:12 -07:00
|
|
|
struct xfrm_state *x;
|
|
|
|
struct km_event c;
|
|
|
|
int err = - EINVAL;
|
2010-02-22 04:32:59 -07:00
|
|
|
u32 mark = 0;
|
|
|
|
struct xfrm_mark m;
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_aevent_id *p = nlmsg_data(nlh);
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
|
2011-03-07 17:10:27 -07:00
|
|
|
struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
if (!lt && !rp && !re)
|
2006-03-20 20:16:12 -07:00
|
|
|
return err;
|
|
|
|
|
|
|
|
/* pedantic mode - thou shalt sayeth replaceth */
|
|
|
|
if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
|
|
|
|
return err;
|
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
mark = xfrm_mark_get(attrs, &m);
|
|
|
|
|
|
|
|
x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
|
2006-03-20 20:16:12 -07:00
|
|
|
if (x == NULL)
|
|
|
|
return -ESRCH;
|
|
|
|
|
|
|
|
if (x->km.state != XFRM_STATE_VALID)
|
|
|
|
goto out;
|
|
|
|
|
2011-03-28 12:47:30 -07:00
|
|
|
err = xfrm_replay_verify_len(x->replay_esn, rp);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
2006-03-20 20:16:12 -07:00
|
|
|
spin_lock_bh(&x->lock);
|
2007-08-22 14:00:40 -07:00
|
|
|
xfrm_update_ae_params(x, attrs);
|
2006-03-20 20:16:12 -07:00
|
|
|
spin_unlock_bh(&x->lock);
|
|
|
|
|
|
|
|
c.event = nlh->nlmsg_type;
|
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
|
|
|
c.data.aevent = XFRM_AE_CU;
|
|
|
|
km_state_notify(x, &c);
|
|
|
|
err = 0;
|
|
|
|
out:
|
|
|
|
xfrm_state_put(x);
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2006-08-23 22:49:28 -07:00
|
|
|
struct km_event c;
|
2006-11-27 13:59:30 -07:00
|
|
|
u8 type = XFRM_POLICY_TYPE_MAIN;
|
2006-08-23 22:49:28 -07:00
|
|
|
int err;
|
2006-11-27 12:11:54 -07:00
|
|
|
struct xfrm_audit audit_info;
|
2006-08-23 22:49:28 -07:00
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = copy_from_user_policy_type(&type, attrs);
|
2006-08-23 22:49:28 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2011-03-03 11:55:40 -07:00
|
|
|
audit_info.loginuid = audit_get_loginuid(current);
|
|
|
|
audit_info.sessionid = audit_get_sessionid(current);
|
|
|
|
security_task_getsecid(current, &audit_info.secid);
|
2008-11-25 18:50:08 -07:00
|
|
|
err = xfrm_policy_flush(net, type, &audit_info);
|
2010-02-18 19:00:42 -07:00
|
|
|
if (err) {
|
|
|
|
if (err == -ESRCH) /* empty table */
|
|
|
|
return 0;
|
2010-02-17 14:41:40 -07:00
|
|
|
return err;
|
2010-02-18 19:00:42 -07:00
|
|
|
}
|
|
|
|
|
2006-08-23 22:49:28 -07:00
|
|
|
c.data.type = type;
|
2005-06-18 22:44:37 -07:00
|
|
|
c.event = nlh->nlmsg_type;
|
2005-06-18 22:42:13 -07:00
|
|
|
c.seq = nlh->nlmsg_seq;
|
|
|
|
c.pid = nlh->nlmsg_pid;
|
2008-11-25 18:50:36 -07:00
|
|
|
c.net = net;
|
2005-06-18 22:42:13 -07:00
|
|
|
km_policy_notify(NULL, 0, &c);
|
2005-04-16 15:20:36 -07:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2006-03-20 20:17:25 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2006-03-20 20:17:25 -07:00
|
|
|
struct xfrm_policy *xp;
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_user_polexpire *up = nlmsg_data(nlh);
|
2006-03-20 20:17:25 -07:00
|
|
|
struct xfrm_userpolicy_info *p = &up->pol;
|
2006-11-27 13:59:30 -07:00
|
|
|
u8 type = XFRM_POLICY_TYPE_MAIN;
|
2006-03-20 20:17:25 -07:00
|
|
|
int err = -ENOENT;
|
2010-02-22 04:33:00 -07:00
|
|
|
struct xfrm_mark m;
|
|
|
|
u32 mark = xfrm_mark_get(attrs, &m);
|
2006-03-20 20:17:25 -07:00
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = copy_from_user_policy_type(&type, attrs);
|
2006-08-23 22:49:28 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2010-03-30 17:17:04 -07:00
|
|
|
err = verify_policy_dir(p->dir);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2006-03-20 20:17:25 -07:00
|
|
|
if (p->index)
|
2010-02-22 04:33:00 -07:00
|
|
|
xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
|
2006-03-20 20:17:25 -07:00
|
|
|
else {
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_SEC_CTX];
|
2008-04-12 19:07:52 -07:00
|
|
|
struct xfrm_sec_ctx *ctx;
|
2006-03-20 20:17:25 -07:00
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = verify_sec_ctx_len(attrs);
|
2006-03-20 20:17:25 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2008-04-14 14:47:48 -07:00
|
|
|
ctx = NULL;
|
2006-03-20 20:17:25 -07:00
|
|
|
if (rt) {
|
2007-08-22 14:01:33 -07:00
|
|
|
struct xfrm_user_sec_ctx *uctx = nla_data(rt);
|
2006-03-20 20:17:25 -07:00
|
|
|
|
2008-04-12 19:07:52 -07:00
|
|
|
err = security_xfrm_policy_alloc(&ctx, uctx);
|
|
|
|
if (err)
|
2006-03-20 20:17:25 -07:00
|
|
|
return err;
|
2008-04-14 14:47:48 -07:00
|
|
|
}
|
2010-02-22 04:33:00 -07:00
|
|
|
xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
|
2010-02-22 04:32:59 -07:00
|
|
|
&p->sel, ctx, 0, &err);
|
2008-04-12 19:07:52 -07:00
|
|
|
security_xfrm_policy_free(ctx);
|
2006-03-20 20:17:25 -07:00
|
|
|
}
|
|
|
|
if (xp == NULL)
|
2007-03-07 16:37:58 -07:00
|
|
|
return -ENOENT;
|
2008-04-12 19:07:52 -07:00
|
|
|
|
2010-03-30 17:17:05 -07:00
|
|
|
if (unlikely(xp->walk.dead))
|
2006-03-20 20:17:25 -07:00
|
|
|
goto out;
|
|
|
|
|
|
|
|
err = 0;
|
|
|
|
if (up->hard) {
|
2011-03-03 11:55:40 -07:00
|
|
|
uid_t loginuid = audit_get_loginuid(current);
|
|
|
|
u32 sessionid = audit_get_sessionid(current);
|
|
|
|
u32 sid;
|
|
|
|
|
|
|
|
security_task_getsecid(current, &sid);
|
2006-03-20 20:17:25 -07:00
|
|
|
xfrm_policy_delete(xp, p->dir);
|
2008-04-18 07:09:25 -07:00
|
|
|
xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
|
2006-11-27 12:11:54 -07:00
|
|
|
|
2006-03-20 20:17:25 -07:00
|
|
|
} else {
|
|
|
|
// reset the timers here?
|
2010-05-11 23:37:06 -07:00
|
|
|
WARN(1, "Dont know what to do with soft policy expire\n");
|
2006-03-20 20:17:25 -07:00
|
|
|
}
|
|
|
|
km_policy_expired(xp, p->dir, up->hard, current->pid);
|
|
|
|
|
|
|
|
out:
|
|
|
|
xfrm_pol_put(xp);
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2006-03-20 20:17:03 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2006-03-20 20:17:03 -07:00
|
|
|
struct xfrm_state *x;
|
|
|
|
int err;
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_user_expire *ue = nlmsg_data(nlh);
|
2006-03-20 20:17:03 -07:00
|
|
|
struct xfrm_usersa_info *p = &ue->state;
|
2010-02-22 04:32:59 -07:00
|
|
|
struct xfrm_mark m;
|
2010-08-30 22:54:00 -07:00
|
|
|
u32 mark = xfrm_mark_get(attrs, &m);
|
2006-03-20 20:17:03 -07:00
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
|
2006-03-20 20:17:03 -07:00
|
|
|
|
2007-02-26 15:52:21 -07:00
|
|
|
err = -ENOENT;
|
2006-03-20 20:17:03 -07:00
|
|
|
if (x == NULL)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
spin_lock_bh(&x->lock);
|
2007-02-26 15:52:21 -07:00
|
|
|
err = -EINVAL;
|
2006-03-20 20:17:03 -07:00
|
|
|
if (x->km.state != XFRM_STATE_VALID)
|
|
|
|
goto out;
|
|
|
|
km_state_expired(x, ue->hard, current->pid);
|
|
|
|
|
2006-11-27 12:11:54 -07:00
|
|
|
if (ue->hard) {
|
2011-03-03 11:55:40 -07:00
|
|
|
uid_t loginuid = audit_get_loginuid(current);
|
|
|
|
u32 sessionid = audit_get_sessionid(current);
|
|
|
|
u32 sid;
|
|
|
|
|
|
|
|
security_task_getsecid(current, &sid);
|
2006-03-20 20:17:03 -07:00
|
|
|
__xfrm_state_delete(x);
|
2008-04-18 07:09:25 -07:00
|
|
|
xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
|
2006-11-27 12:11:54 -07:00
|
|
|
}
|
2007-02-26 15:52:21 -07:00
|
|
|
err = 0;
|
2006-03-20 20:17:03 -07:00
|
|
|
out:
|
|
|
|
spin_unlock_bh(&x->lock);
|
|
|
|
xfrm_state_put(x);
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2007-01-02 16:22:30 -07:00
|
|
|
static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
struct xfrm_policy *xp;
|
|
|
|
struct xfrm_user_tmpl *ut;
|
|
|
|
int i;
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_TMPL];
|
2010-02-22 04:32:59 -07:00
|
|
|
struct xfrm_mark mark;
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_user_acquire *ua = nlmsg_data(nlh);
|
2008-11-25 18:50:08 -07:00
|
|
|
struct xfrm_state *x = xfrm_state_alloc(net);
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
int err = -ENOMEM;
|
|
|
|
|
|
|
|
if (!x)
|
2008-12-15 00:16:22 -07:00
|
|
|
goto nomem;
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
xfrm_mark_get(attrs, &mark);
|
|
|
|
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
err = verify_newpolicy_info(&ua->policy);
|
2008-12-15 00:16:22 -07:00
|
|
|
if (err)
|
|
|
|
goto bad_policy;
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
|
|
|
|
/* build an XP */
|
2008-11-25 18:50:08 -07:00
|
|
|
xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
|
2008-12-15 00:16:22 -07:00
|
|
|
if (!xp)
|
|
|
|
goto free_state;
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
|
|
|
|
memcpy(&x->id, &ua->id, sizeof(ua->id));
|
|
|
|
memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
|
|
|
|
memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
|
2010-02-22 04:32:59 -07:00
|
|
|
xp->mark.m = x->mark.m = mark.m;
|
|
|
|
xp->mark.v = x->mark.v = mark.v;
|
2007-08-22 14:01:33 -07:00
|
|
|
ut = nla_data(rt);
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
/* extract the templates and for each call km_key */
|
|
|
|
for (i = 0; i < xp->xfrm_nr; i++, ut++) {
|
|
|
|
struct xfrm_tmpl *t = &xp->xfrm_vec[i];
|
|
|
|
memcpy(&x->id, &t->id, sizeof(x->id));
|
|
|
|
x->props.mode = t->mode;
|
|
|
|
x->props.reqid = t->reqid;
|
|
|
|
x->props.family = ut->family;
|
|
|
|
t->aalgos = ua->aalgos;
|
|
|
|
t->ealgos = ua->ealgos;
|
|
|
|
t->calgos = ua->calgos;
|
|
|
|
err = km_query(x, t, xp);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
kfree(x);
|
|
|
|
kfree(xp);
|
|
|
|
|
|
|
|
return 0;
|
2008-12-15 00:16:22 -07:00
|
|
|
|
|
|
|
bad_policy:
|
2010-05-11 23:37:06 -07:00
|
|
|
WARN(1, "BAD policy passed\n");
|
2008-12-15 00:16:22 -07:00
|
|
|
free_state:
|
|
|
|
kfree(x);
|
|
|
|
nomem:
|
|
|
|
return err;
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
}
|
|
|
|
|
2007-02-08 14:12:32 -07:00
|
|
|
#ifdef CONFIG_XFRM_MIGRATE
|
|
|
|
static int copy_from_user_migrate(struct xfrm_migrate *ma,
|
2008-10-05 13:33:42 -07:00
|
|
|
struct xfrm_kmaddress *k,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs, int *num)
|
2007-02-08 14:12:32 -07:00
|
|
|
{
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr *rt = attrs[XFRMA_MIGRATE];
|
2007-02-08 14:12:32 -07:00
|
|
|
struct xfrm_user_migrate *um;
|
|
|
|
int i, num_migrate;
|
|
|
|
|
2008-10-05 13:33:42 -07:00
|
|
|
if (k != NULL) {
|
|
|
|
struct xfrm_user_kmaddress *uk;
|
|
|
|
|
|
|
|
uk = nla_data(attrs[XFRMA_KMADDRESS]);
|
|
|
|
memcpy(&k->local, &uk->local, sizeof(k->local));
|
|
|
|
memcpy(&k->remote, &uk->remote, sizeof(k->remote));
|
|
|
|
k->family = uk->family;
|
|
|
|
k->reserved = uk->reserved;
|
|
|
|
}
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
um = nla_data(rt);
|
|
|
|
num_migrate = nla_len(rt) / sizeof(*um);
|
2007-02-08 14:12:32 -07:00
|
|
|
|
|
|
|
if (num_migrate <= 0 || num_migrate > XFRM_MAX_DEPTH)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
for (i = 0; i < num_migrate; i++, um++, ma++) {
|
|
|
|
memcpy(&ma->old_daddr, &um->old_daddr, sizeof(ma->old_daddr));
|
|
|
|
memcpy(&ma->old_saddr, &um->old_saddr, sizeof(ma->old_saddr));
|
|
|
|
memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr));
|
|
|
|
memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr));
|
|
|
|
|
|
|
|
ma->proto = um->proto;
|
|
|
|
ma->mode = um->mode;
|
|
|
|
ma->reqid = um->reqid;
|
|
|
|
|
|
|
|
ma->old_family = um->old_family;
|
|
|
|
ma->new_family = um->new_family;
|
|
|
|
}
|
|
|
|
|
|
|
|
*num = i;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2007-02-08 14:12:32 -07:00
|
|
|
{
|
2007-08-22 13:53:52 -07:00
|
|
|
struct xfrm_userpolicy_id *pi = nlmsg_data(nlh);
|
2007-02-08 14:12:32 -07:00
|
|
|
struct xfrm_migrate m[XFRM_MAX_DEPTH];
|
2008-10-05 13:33:42 -07:00
|
|
|
struct xfrm_kmaddress km, *kmp;
|
2007-02-08 14:12:32 -07:00
|
|
|
u8 type;
|
|
|
|
int err;
|
|
|
|
int n = 0;
|
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
if (attrs[XFRMA_MIGRATE] == NULL)
|
2007-08-22 13:59:04 -07:00
|
|
|
return -EINVAL;
|
2007-02-08 14:12:32 -07:00
|
|
|
|
2008-10-05 13:33:42 -07:00
|
|
|
kmp = attrs[XFRMA_KMADDRESS] ? &km : NULL;
|
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
err = copy_from_user_policy_type(&type, attrs);
|
2007-02-08 14:12:32 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
2008-10-05 13:33:42 -07:00
|
|
|
err = copy_from_user_migrate((struct xfrm_migrate *)m, kmp, attrs, &n);
|
2007-02-08 14:12:32 -07:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
if (!n)
|
|
|
|
return 0;
|
|
|
|
|
2008-10-05 13:33:42 -07:00
|
|
|
xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
|
2007-02-08 14:12:32 -07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
|
2007-08-22 14:01:33 -07:00
|
|
|
struct nlattr **attrs)
|
2007-02-08 14:12:32 -07:00
|
|
|
{
|
|
|
|
return -ENOPROTOOPT;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef CONFIG_XFRM_MIGRATE
|
2011-02-23 22:28:01 -07:00
|
|
|
static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *skb)
|
2007-02-08 14:12:32 -07:00
|
|
|
{
|
|
|
|
struct xfrm_user_migrate um;
|
|
|
|
|
|
|
|
memset(&um, 0, sizeof(um));
|
|
|
|
um.proto = m->proto;
|
|
|
|
um.mode = m->mode;
|
|
|
|
um.reqid = m->reqid;
|
|
|
|
um.old_family = m->old_family;
|
|
|
|
memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr));
|
|
|
|
memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr));
|
|
|
|
um.new_family = m->new_family;
|
|
|
|
memcpy(&um.new_daddr, &m->new_daddr, sizeof(um.new_daddr));
|
|
|
|
memcpy(&um.new_saddr, &m->new_saddr, sizeof(um.new_saddr));
|
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
return nla_put(skb, XFRMA_MIGRATE, sizeof(um), &um);
|
2007-02-08 14:12:32 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:28:01 -07:00
|
|
|
static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff *skb)
|
2008-10-05 13:33:42 -07:00
|
|
|
{
|
|
|
|
struct xfrm_user_kmaddress uk;
|
|
|
|
|
|
|
|
memset(&uk, 0, sizeof(uk));
|
|
|
|
uk.family = k->family;
|
|
|
|
uk.reserved = k->reserved;
|
|
|
|
memcpy(&uk.local, &k->local, sizeof(uk.local));
|
2008-11-03 02:30:23 -07:00
|
|
|
memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
|
2008-10-05 13:33:42 -07:00
|
|
|
|
|
|
|
return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma)
|
2007-08-22 13:57:39 -07:00
|
|
|
{
|
|
|
|
return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
|
2008-10-05 13:33:42 -07:00
|
|
|
+ (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
|
|
|
|
+ nla_total_size(sizeof(struct xfrm_user_migrate) * num_migrate)
|
|
|
|
+ userpolicy_type_attrsize();
|
2007-08-22 13:57:39 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:28:01 -07:00
|
|
|
static int build_migrate(struct sk_buff *skb, const struct xfrm_migrate *m,
|
|
|
|
int num_migrate, const struct xfrm_kmaddress *k,
|
|
|
|
const struct xfrm_selector *sel, u8 dir, u8 type)
|
2007-02-08 14:12:32 -07:00
|
|
|
{
|
2011-02-23 22:28:01 -07:00
|
|
|
const struct xfrm_migrate *mp;
|
2007-02-08 14:12:32 -07:00
|
|
|
struct xfrm_userpolicy_id *pol_id;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
int i;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id), 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
2007-02-08 14:12:32 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
pol_id = nlmsg_data(nlh);
|
2007-02-08 14:12:32 -07:00
|
|
|
/* copy data from selector, dir, and type to the pol_id */
|
|
|
|
memset(pol_id, 0, sizeof(*pol_id));
|
|
|
|
memcpy(&pol_id->sel, sel, sizeof(pol_id->sel));
|
|
|
|
pol_id->dir = dir;
|
|
|
|
|
2008-10-05 13:33:42 -07:00
|
|
|
if (k != NULL && (copy_to_user_kmaddress(k, skb) < 0))
|
|
|
|
goto nlmsg_failure;
|
|
|
|
|
2007-02-08 14:12:32 -07:00
|
|
|
if (copy_to_user_policy_type(type, skb) < 0)
|
|
|
|
goto nlmsg_failure;
|
|
|
|
|
|
|
|
for (i = 0, mp = m ; i < num_migrate; i++, mp++) {
|
|
|
|
if (copy_to_user_migrate(mp, skb) < 0)
|
|
|
|
goto nlmsg_failure;
|
|
|
|
}
|
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
return nlmsg_end(skb, nlh);
|
2007-02-08 14:12:32 -07:00
|
|
|
nlmsg_failure:
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
2007-02-08 14:12:32 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:28:01 -07:00
|
|
|
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
|
|
|
|
const struct xfrm_migrate *m, int num_migrate,
|
|
|
|
const struct xfrm_kmaddress *k)
|
2007-02-08 14:12:32 -07:00
|
|
|
{
|
2008-11-25 18:38:20 -07:00
|
|
|
struct net *net = &init_net;
|
2007-02-08 14:12:32 -07:00
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2008-10-05 13:33:42 -07:00
|
|
|
skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k), GFP_ATOMIC);
|
2007-02-08 14:12:32 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
/* build migrate */
|
2008-10-05 13:33:42 -07:00
|
|
|
if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
|
2007-02-08 14:12:32 -07:00
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
|
2007-02-08 14:12:32 -07:00
|
|
|
}
|
|
|
|
#else
|
2011-02-23 22:28:01 -07:00
|
|
|
static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
|
|
|
|
const struct xfrm_migrate *m, int num_migrate,
|
|
|
|
const struct xfrm_kmaddress *k)
|
2007-02-08 14:12:32 -07:00
|
|
|
{
|
|
|
|
return -ENOPROTOOPT;
|
|
|
|
}
|
|
|
|
#endif
|
2006-03-20 20:16:12 -07:00
|
|
|
|
2007-08-22 13:58:18 -07:00
|
|
|
#define XMSGSIZE(type) sizeof(struct type)
|
2005-05-03 14:26:40 -07:00
|
|
|
|
|
|
|
static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
|
2009-01-20 10:49:51 -07:00
|
|
|
[XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
|
2005-05-03 14:26:40 -07:00
|
|
|
[XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
|
|
|
|
[XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
|
|
|
|
[XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
|
|
|
|
[XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
|
|
|
|
[XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
|
|
|
|
[XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
[XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
|
2006-03-20 20:17:03 -07:00
|
|
|
[XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
|
2005-05-03 14:26:40 -07:00
|
|
|
[XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
|
2009-01-20 10:49:51 -07:00
|
|
|
[XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
|
2006-03-20 20:17:25 -07:00
|
|
|
[XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
|
2005-05-03 14:26:40 -07:00
|
|
|
[XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
|
2007-08-22 13:58:18 -07:00
|
|
|
[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
|
2006-03-20 20:16:12 -07:00
|
|
|
[XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
|
|
|
|
[XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
|
2006-08-23 20:44:06 -07:00
|
|
|
[XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
|
2007-02-08 14:12:32 -07:00
|
|
|
[XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
|
2007-08-22 13:58:18 -07:00
|
|
|
[XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
|
|
|
|
[XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
|
2005-04-16 15:20:36 -07:00
|
|
|
};
|
|
|
|
|
2005-05-03 14:26:40 -07:00
|
|
|
#undef XMSGSIZE
|
|
|
|
|
2007-08-22 13:59:04 -07:00
|
|
|
static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
|
2010-02-08 20:59:38 -07:00
|
|
|
[XFRMA_SA] = { .len = sizeof(struct xfrm_usersa_info)},
|
|
|
|
[XFRMA_POLICY] = { .len = sizeof(struct xfrm_userpolicy_info)},
|
|
|
|
[XFRMA_LASTUSED] = { .type = NLA_U64},
|
|
|
|
[XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)},
|
2008-01-28 20:37:29 -07:00
|
|
|
[XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) },
|
2007-08-22 13:59:04 -07:00
|
|
|
[XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
|
|
|
|
[XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
|
|
|
|
[XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
|
|
|
|
[XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
|
|
|
|
[XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
|
|
|
|
[XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
|
|
|
|
[XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
|
|
|
|
[XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
|
|
|
|
[XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
|
|
|
|
[XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
|
|
|
|
[XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
|
|
|
|
[XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
|
|
|
|
[XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
|
|
|
|
[XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
|
2008-10-05 13:33:42 -07:00
|
|
|
[XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
|
2010-02-22 04:32:59 -07:00
|
|
|
[XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
|
2010-12-07 21:37:49 -07:00
|
|
|
[XFRMA_TFCPAD] = { .type = NLA_U32 },
|
2011-03-07 17:10:27 -07:00
|
|
|
[XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
|
2007-08-22 13:59:04 -07:00
|
|
|
};
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static struct xfrm_link {
|
2007-08-22 14:01:33 -07:00
|
|
|
int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
|
2005-04-16 15:20:36 -07:00
|
|
|
int (*dump)(struct sk_buff *, struct netlink_callback *);
|
2008-02-28 22:31:08 -07:00
|
|
|
int (*done)(struct netlink_callback *);
|
2005-05-03 14:26:40 -07:00
|
|
|
} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
|
|
|
|
[XFRM_MSG_NEWSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
|
|
|
|
[XFRM_MSG_DELSA - XFRM_MSG_BASE] = { .doit = xfrm_del_sa },
|
|
|
|
[XFRM_MSG_GETSA - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
|
2008-02-28 22:31:08 -07:00
|
|
|
.dump = xfrm_dump_sa,
|
|
|
|
.done = xfrm_dump_sa_done },
|
2005-05-03 14:26:40 -07:00
|
|
|
[XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
|
|
|
|
[XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
|
|
|
|
[XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
|
2008-02-28 22:31:08 -07:00
|
|
|
.dump = xfrm_dump_policy,
|
|
|
|
.done = xfrm_dump_policy_done },
|
2005-05-03 14:26:40 -07:00
|
|
|
[XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
|
[IPSEC]: Sync series - acquire insert
This introduces a feature similar to the one described in RFC 2367:
"
... the application needing an SA sends a PF_KEY
SADB_ACQUIRE message down to the Key Engine, which then either
returns an error or sends a similar SADB_ACQUIRE message up to one or
more key management applications capable of creating such SAs.
...
...
The third is where an application-layer consumer of security
associations (e.g. an OSPFv2 or RIPv2 daemon) needs a security
association.
Send an SADB_ACQUIRE message from a user process to the kernel.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The kernel returns an SADB_ACQUIRE message to registered
sockets.
<base, address(SD), (address(P),) (identity(SD),) (sensitivity,)
proposal>
The user-level consumer waits for an SADB_UPDATE or SADB_ADD
message for its particular type, and then can use that
association by using SADB_GET messages.
"
An app such as OSPF could then use ipsec KM to get keys
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 20:16:40 -07:00
|
|
|
[XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire },
|
2006-03-20 20:17:03 -07:00
|
|
|
[XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
|
2005-05-03 14:26:40 -07:00
|
|
|
[XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
|
|
|
|
[XFRM_MSG_UPDSA - XFRM_MSG_BASE] = { .doit = xfrm_add_sa },
|
2006-03-20 20:17:25 -07:00
|
|
|
[XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = { .doit = xfrm_add_pol_expire},
|
2005-05-03 14:26:40 -07:00
|
|
|
[XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa },
|
|
|
|
[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy },
|
2006-03-20 20:16:12 -07:00
|
|
|
[XFRM_MSG_NEWAE - XFRM_MSG_BASE] = { .doit = xfrm_new_ae },
|
|
|
|
[XFRM_MSG_GETAE - XFRM_MSG_BASE] = { .doit = xfrm_get_ae },
|
2007-02-08 14:12:32 -07:00
|
|
|
[XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate },
|
2007-04-26 14:12:15 -07:00
|
|
|
[XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_sadinfo },
|
2007-04-28 21:20:32 -07:00
|
|
|
[XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo },
|
2005-04-16 15:20:36 -07:00
|
|
|
};
|
|
|
|
|
2007-03-22 23:30:12 -07:00
|
|
|
static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:38:20 -07:00
|
|
|
struct net *net = sock_net(skb->sk);
|
2007-08-22 14:00:40 -07:00
|
|
|
struct nlattr *attrs[XFRMA_MAX+1];
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_link *link;
|
2007-08-22 13:58:18 -07:00
|
|
|
int type, err;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
type = nlh->nlmsg_type;
|
|
|
|
if (type > XFRM_MSG_MAX)
|
2007-03-22 23:30:12 -07:00
|
|
|
return -EINVAL;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
type -= XFRM_MSG_BASE;
|
|
|
|
link = &xfrm_dispatch[type];
|
|
|
|
|
|
|
|
/* All operations require privileges, even GET */
|
2007-03-22 23:30:12 -07:00
|
|
|
if (security_netlink_recv(skb, CAP_NET_ADMIN))
|
|
|
|
return -EPERM;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2005-05-03 14:26:40 -07:00
|
|
|
if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
|
|
|
|
type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
|
2011-01-18 13:40:38 -07:00
|
|
|
(nlh->nlmsg_flags & NLM_F_DUMP)) {
|
2005-04-16 15:20:36 -07:00
|
|
|
if (link->dump == NULL)
|
2007-03-22 23:30:12 -07:00
|
|
|
return -EINVAL;
|
2005-11-09 18:25:54 -07:00
|
|
|
|
2011-06-09 18:27:09 -07:00
|
|
|
return netlink_dump_start(net->xfrm.nlsk, skb, nlh,
|
|
|
|
link->dump, link->done, 0);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2007-08-22 14:00:40 -07:00
|
|
|
err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
|
2007-08-22 13:59:04 -07:00
|
|
|
xfrma_policy);
|
2007-08-22 13:58:18 -07:00
|
|
|
if (err < 0)
|
|
|
|
return err;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
if (link->doit == NULL)
|
2007-03-22 23:30:12 -07:00
|
|
|
return -EINVAL;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 14:01:33 -07:00
|
|
|
return link->doit(skb, nlh, attrs);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2007-10-10 21:15:29 -07:00
|
|
|
static void xfrm_netlink_rcv(struct sk_buff *skb)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2007-10-10 21:15:29 -07:00
|
|
|
mutex_lock(&xfrm_cfg_mutex);
|
|
|
|
netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
|
|
|
|
mutex_unlock(&xfrm_cfg_mutex);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
static inline size_t xfrm_expire_msgsize(void)
|
|
|
|
{
|
2010-02-22 04:32:59 -07:00
|
|
|
return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
|
|
|
|
+ nla_total_size(sizeof(struct xfrm_mark));
|
2007-08-22 13:57:39 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
|
|
|
struct xfrm_user_expire *ue;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_EXPIRE, sizeof(*ue), 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
ue = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
copy_to_user_state(x, &ue->state);
|
2006-03-20 20:16:12 -07:00
|
|
|
ue->hard = (c->data.hard != 0) ? 1 : 0;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
if (xfrm_mark_put(skb, &x->mark))
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
return nlmsg_end(skb, nlh);
|
2010-02-22 04:32:59 -07:00
|
|
|
|
|
|
|
nla_put_failure:
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = xs_net(x);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(xfrm_expire_msgsize(), GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2010-02-22 04:32:59 -07:00
|
|
|
if (build_expire(skb, x, c) < 0) {
|
|
|
|
kfree_skb(skb);
|
|
|
|
return -EMSGSIZE;
|
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
|
2006-03-20 20:16:12 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = xs_net(x);
|
2006-03-20 20:16:12 -07:00
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2011-03-07 17:10:27 -07:00
|
|
|
skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
|
2006-03-20 20:16:12 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (build_aevent(skb, x, c) < 0)
|
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
|
2006-03-20 20:16:12 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_notify_sa_flush(const struct km_event *c)
|
2005-06-18 22:42:13 -07:00
|
|
|
{
|
2008-11-25 18:50:36 -07:00
|
|
|
struct net *net = c->net;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct xfrm_usersa_flush *p;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
struct sk_buff *skb;
|
2007-08-22 13:57:39 -07:00
|
|
|
int len = NLMSG_ALIGN(sizeof(struct xfrm_usersa_flush));
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(len, GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHSA, sizeof(*p), 0);
|
|
|
|
if (nlh == NULL) {
|
|
|
|
kfree_skb(skb);
|
|
|
|
return -EMSGSIZE;
|
|
|
|
}
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
p = nlmsg_data(nlh);
|
2005-06-18 22:44:00 -07:00
|
|
|
p->proto = c->data.proto;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_end(skb, nlh);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
}
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
static inline size_t xfrm_sa_len(struct xfrm_state *x)
|
2005-06-18 22:42:13 -07:00
|
|
|
{
|
2007-08-22 13:57:39 -07:00
|
|
|
size_t l = 0;
|
2008-01-28 20:37:29 -07:00
|
|
|
if (x->aead)
|
|
|
|
l += nla_total_size(aead_len(x->aead));
|
2009-11-24 17:29:52 -07:00
|
|
|
if (x->aalg) {
|
|
|
|
l += nla_total_size(sizeof(struct xfrm_algo) +
|
|
|
|
(x->aalg->alg_key_len + 7) / 8);
|
|
|
|
l += nla_total_size(xfrm_alg_auth_len(x->aalg));
|
|
|
|
}
|
2005-06-18 22:42:13 -07:00
|
|
|
if (x->ealg)
|
2008-01-09 00:39:06 -07:00
|
|
|
l += nla_total_size(xfrm_alg_len(x->ealg));
|
2005-06-18 22:42:13 -07:00
|
|
|
if (x->calg)
|
2007-08-22 13:57:39 -07:00
|
|
|
l += nla_total_size(sizeof(*x->calg));
|
2005-06-18 22:42:13 -07:00
|
|
|
if (x->encap)
|
2007-08-22 13:57:39 -07:00
|
|
|
l += nla_total_size(sizeof(*x->encap));
|
2010-12-07 21:37:49 -07:00
|
|
|
if (x->tfcpad)
|
|
|
|
l += nla_total_size(sizeof(x->tfcpad));
|
2011-03-07 17:10:27 -07:00
|
|
|
if (x->replay_esn)
|
|
|
|
l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
|
2007-10-09 13:30:57 -07:00
|
|
|
if (x->security)
|
|
|
|
l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
|
|
|
|
x->security->ctx_len);
|
|
|
|
if (x->coaddr)
|
|
|
|
l += nla_total_size(sizeof(*x->coaddr));
|
|
|
|
|
2007-11-13 22:47:08 -07:00
|
|
|
/* Must count x->lastused as it may become non-zero behind our back. */
|
|
|
|
l += nla_total_size(sizeof(u64));
|
2005-06-18 22:42:13 -07:00
|
|
|
|
|
|
|
return l;
|
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
|
2005-06-18 22:42:13 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = xs_net(x);
|
2005-06-18 22:42:13 -07:00
|
|
|
struct xfrm_usersa_info *p;
|
2005-06-18 22:54:36 -07:00
|
|
|
struct xfrm_usersa_id *id;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
struct sk_buff *skb;
|
|
|
|
int len = xfrm_sa_len(x);
|
2005-06-18 22:54:36 -07:00
|
|
|
int headlen;
|
|
|
|
|
|
|
|
headlen = sizeof(*p);
|
|
|
|
if (c->event == XFRM_MSG_DELSA) {
|
2007-08-22 13:57:39 -07:00
|
|
|
len += nla_total_size(headlen);
|
2005-06-18 22:54:36 -07:00
|
|
|
headlen = sizeof(*id);
|
2010-02-22 04:32:59 -07:00
|
|
|
len += nla_total_size(sizeof(struct xfrm_mark));
|
2005-06-18 22:54:36 -07:00
|
|
|
}
|
2007-08-22 13:57:39 -07:00
|
|
|
len += NLMSG_ALIGN(headlen);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(len, GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
|
|
|
|
if (nlh == NULL)
|
2007-08-22 13:55:43 -07:00
|
|
|
goto nla_put_failure;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
p = nlmsg_data(nlh);
|
2005-06-18 22:54:36 -07:00
|
|
|
if (c->event == XFRM_MSG_DELSA) {
|
2007-08-22 13:55:43 -07:00
|
|
|
struct nlattr *attr;
|
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
id = nlmsg_data(nlh);
|
2005-06-18 22:54:36 -07:00
|
|
|
memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
|
|
|
|
id->spi = x->id.spi;
|
|
|
|
id->family = x->props.family;
|
|
|
|
id->proto = x->id.proto;
|
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
attr = nla_reserve(skb, XFRMA_SA, sizeof(*p));
|
|
|
|
if (attr == NULL)
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
p = nla_data(attr);
|
2005-06-18 22:54:36 -07:00
|
|
|
}
|
|
|
|
|
2007-10-09 13:30:57 -07:00
|
|
|
if (copy_to_user_state_extra(x, p, skb))
|
|
|
|
goto nla_put_failure;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_end(skb, nlh);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
nla_put_failure:
|
2007-10-09 13:30:57 -07:00
|
|
|
/* Somebody screwed up with xfrm_sa_len! */
|
|
|
|
WARN_ON(1);
|
2005-06-18 22:42:13 -07:00
|
|
|
kfree_skb(skb);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c)
|
2005-06-18 22:42:13 -07:00
|
|
|
{
|
|
|
|
|
|
|
|
switch (c->event) {
|
2005-06-18 22:44:37 -07:00
|
|
|
case XFRM_MSG_EXPIRE:
|
2005-06-18 22:42:13 -07:00
|
|
|
return xfrm_exp_state_notify(x, c);
|
2006-03-20 20:16:12 -07:00
|
|
|
case XFRM_MSG_NEWAE:
|
|
|
|
return xfrm_aevent_state_notify(x, c);
|
2005-06-18 22:44:37 -07:00
|
|
|
case XFRM_MSG_DELSA:
|
|
|
|
case XFRM_MSG_UPDSA:
|
|
|
|
case XFRM_MSG_NEWSA:
|
2005-06-18 22:42:13 -07:00
|
|
|
return xfrm_notify_sa(x, c);
|
2005-06-18 22:44:37 -07:00
|
|
|
case XFRM_MSG_FLUSHSA:
|
2005-06-18 22:42:13 -07:00
|
|
|
return xfrm_notify_sa_flush(c);
|
|
|
|
default:
|
2010-05-11 23:37:06 -07:00
|
|
|
printk(KERN_NOTICE "xfrm_user: Unknown SA event %d\n",
|
|
|
|
c->event);
|
|
|
|
break;
|
2005-06-18 22:42:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
|
|
|
|
struct xfrm_policy *xp)
|
|
|
|
{
|
|
|
|
return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
|
|
|
|
+ nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
|
2010-02-22 04:32:59 -07:00
|
|
|
+ nla_total_size(sizeof(struct xfrm_mark))
|
2007-08-22 13:57:39 -07:00
|
|
|
+ nla_total_size(xfrm_user_sec_ctx_size(x->security))
|
|
|
|
+ userpolicy_type_attrsize();
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
|
|
|
|
struct xfrm_tmpl *xt, struct xfrm_policy *xp,
|
|
|
|
int dir)
|
|
|
|
{
|
|
|
|
struct xfrm_user_acquire *ua;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
__u32 seq = xfrm_get_acqseq();
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_ACQUIRE, sizeof(*ua), 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
ua = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
memcpy(&ua->id, &x->id, sizeof(ua->id));
|
|
|
|
memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
|
|
|
|
memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
|
|
|
|
copy_to_user_policy(xp, &ua->policy, dir);
|
|
|
|
ua->aalgos = xt->aalgos;
|
|
|
|
ua->ealgos = xt->ealgos;
|
|
|
|
ua->calgos = xt->calgos;
|
|
|
|
ua->seq = x->km.seq = seq;
|
|
|
|
|
|
|
|
if (copy_to_user_tmpl(xp, skb) < 0)
|
|
|
|
goto nlmsg_failure;
|
2006-07-24 23:30:44 -07:00
|
|
|
if (copy_to_user_state_sec_ctx(x, skb))
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
goto nlmsg_failure;
|
2006-11-20 17:51:22 -07:00
|
|
|
if (copy_to_user_policy_type(xp->type, skb) < 0)
|
2006-08-23 22:49:28 -07:00
|
|
|
goto nlmsg_failure;
|
2010-02-22 04:33:00 -07:00
|
|
|
if (xfrm_mark_put(skb, &xp->mark))
|
|
|
|
goto nla_put_failure;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
return nlmsg_end(skb, nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2010-02-22 04:33:00 -07:00
|
|
|
nla_put_failure:
|
2005-04-16 15:20:36 -07:00
|
|
|
nlmsg_failure:
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
|
|
|
|
struct xfrm_policy *xp, int dir)
|
|
|
|
{
|
2008-11-25 18:38:20 -07:00
|
|
|
struct net *net = xs_net(x);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (build_acquire(skb, x, xt, xp, dir) < 0)
|
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
/* User gives us xfrm_user_policy_info followed by an array of 0
|
|
|
|
* or more templates.
|
|
|
|
*/
|
2006-07-24 23:32:20 -07:00
|
|
|
static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
|
2005-04-16 15:20:36 -07:00
|
|
|
u8 *data, int len, int *dir)
|
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = sock_net(sk);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
|
|
|
|
struct xfrm_user_tmpl *ut = (struct xfrm_user_tmpl *) (p + 1);
|
|
|
|
struct xfrm_policy *xp;
|
|
|
|
int nr;
|
|
|
|
|
2006-07-24 23:32:20 -07:00
|
|
|
switch (sk->sk_family) {
|
2005-04-16 15:20:36 -07:00
|
|
|
case AF_INET:
|
|
|
|
if (opt != IP_XFRM_POLICY) {
|
|
|
|
*dir = -EOPNOTSUPP;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
case AF_INET6:
|
|
|
|
if (opt != IPV6_XFRM_POLICY) {
|
|
|
|
*dir = -EOPNOTSUPP;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
default:
|
|
|
|
*dir = -EINVAL;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
*dir = -EINVAL;
|
|
|
|
|
|
|
|
if (len < sizeof(*p) ||
|
|
|
|
verify_newpolicy_info(p))
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
nr = ((len - sizeof(*p)) / sizeof(*ut));
|
2006-12-03 20:19:26 -07:00
|
|
|
if (validate_tmpl(nr, ut, p->sel.family))
|
2005-04-16 15:20:36 -07:00
|
|
|
return NULL;
|
|
|
|
|
2005-07-26 15:43:17 -07:00
|
|
|
if (p->dir > XFRM_POLICY_OUT)
|
|
|
|
return NULL;
|
|
|
|
|
2010-08-14 22:38:09 -07:00
|
|
|
xp = xfrm_policy_alloc(net, GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (xp == NULL) {
|
|
|
|
*dir = -ENOBUFS;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
copy_from_user_policy(xp, p);
|
2006-08-23 22:49:28 -07:00
|
|
|
xp->type = XFRM_POLICY_TYPE_MAIN;
|
2005-04-16 15:20:36 -07:00
|
|
|
copy_templates(xp, ut, nr);
|
|
|
|
|
|
|
|
*dir = p->dir;
|
|
|
|
|
|
|
|
return xp;
|
|
|
|
}
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
|
|
|
|
{
|
|
|
|
return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
|
|
|
|
+ nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
|
|
|
|
+ nla_total_size(xfrm_user_sec_ctx_size(xp->security))
|
2010-02-22 04:33:00 -07:00
|
|
|
+ nla_total_size(sizeof(struct xfrm_mark))
|
2007-08-22 13:57:39 -07:00
|
|
|
+ userpolicy_type_attrsize();
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
|
2011-02-23 22:02:38 -07:00
|
|
|
int dir, const struct km_event *c)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
|
|
|
struct xfrm_user_polexpire *upe;
|
|
|
|
struct nlmsghdr *nlh;
|
2006-03-20 20:16:12 -07:00
|
|
|
int hard = c->data.hard;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe), 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
upe = nlmsg_data(nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
copy_to_user_policy(xp, &upe->pol, dir);
|
|
|
|
if (copy_to_user_tmpl(xp, skb) < 0)
|
|
|
|
goto nlmsg_failure;
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
if (copy_to_user_sec_ctx(xp, skb))
|
|
|
|
goto nlmsg_failure;
|
2006-11-20 17:51:22 -07:00
|
|
|
if (copy_to_user_policy_type(xp->type, skb) < 0)
|
2006-08-23 22:49:28 -07:00
|
|
|
goto nlmsg_failure;
|
2010-02-22 04:33:00 -07:00
|
|
|
if (xfrm_mark_put(skb, &xp->mark))
|
|
|
|
goto nla_put_failure;
|
2005-04-16 15:20:36 -07:00
|
|
|
upe->hard = !!hard;
|
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
return nlmsg_end(skb, nlh);
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2010-02-22 04:33:00 -07:00
|
|
|
nla_put_failure:
|
2005-04-16 15:20:36 -07:00
|
|
|
nlmsg_failure:
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = xp_net(xp);
|
2005-04-16 15:20:36 -07:00
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2006-03-20 20:16:12 -07:00
|
|
|
if (build_polexpire(skb, xp, dir, c) < 0)
|
2005-04-16 15:20:36 -07:00
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
|
2005-06-18 22:42:13 -07:00
|
|
|
{
|
2008-11-25 18:50:08 -07:00
|
|
|
struct net *net = xp_net(xp);
|
2005-06-18 22:42:13 -07:00
|
|
|
struct xfrm_userpolicy_info *p;
|
2005-06-18 22:54:36 -07:00
|
|
|
struct xfrm_userpolicy_id *id;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
struct sk_buff *skb;
|
2007-08-22 13:57:39 -07:00
|
|
|
int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
|
2005-06-18 22:54:36 -07:00
|
|
|
int headlen;
|
|
|
|
|
|
|
|
headlen = sizeof(*p);
|
|
|
|
if (c->event == XFRM_MSG_DELPOLICY) {
|
2007-08-22 13:57:39 -07:00
|
|
|
len += nla_total_size(headlen);
|
2005-06-18 22:54:36 -07:00
|
|
|
headlen = sizeof(*id);
|
|
|
|
}
|
2007-08-22 13:57:04 -07:00
|
|
|
len += userpolicy_type_attrsize();
|
2010-02-22 04:33:00 -07:00
|
|
|
len += nla_total_size(sizeof(struct xfrm_mark));
|
2007-08-22 13:57:39 -07:00
|
|
|
len += NLMSG_ALIGN(headlen);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(len, GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, c->pid, c->seq, c->event, headlen, 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
goto nlmsg_failure;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
p = nlmsg_data(nlh);
|
2005-06-18 22:54:36 -07:00
|
|
|
if (c->event == XFRM_MSG_DELPOLICY) {
|
2007-08-22 13:55:43 -07:00
|
|
|
struct nlattr *attr;
|
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
id = nlmsg_data(nlh);
|
2005-06-18 22:54:36 -07:00
|
|
|
memset(id, 0, sizeof(*id));
|
|
|
|
id->dir = dir;
|
|
|
|
if (c->data.byid)
|
|
|
|
id->index = xp->index;
|
|
|
|
else
|
|
|
|
memcpy(&id->sel, &xp->selector, sizeof(id->sel));
|
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
attr = nla_reserve(skb, XFRMA_POLICY, sizeof(*p));
|
|
|
|
if (attr == NULL)
|
|
|
|
goto nlmsg_failure;
|
|
|
|
|
|
|
|
p = nla_data(attr);
|
2005-06-18 22:54:36 -07:00
|
|
|
}
|
2005-06-18 22:42:13 -07:00
|
|
|
|
|
|
|
copy_to_user_policy(xp, p, dir);
|
|
|
|
if (copy_to_user_tmpl(xp, skb) < 0)
|
|
|
|
goto nlmsg_failure;
|
2006-11-20 17:51:22 -07:00
|
|
|
if (copy_to_user_policy_type(xp->type, skb) < 0)
|
2006-08-23 22:49:28 -07:00
|
|
|
goto nlmsg_failure;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2010-02-22 04:33:00 -07:00
|
|
|
if (xfrm_mark_put(skb, &xp->mark))
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_end(skb, nlh);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2010-02-22 04:33:00 -07:00
|
|
|
nla_put_failure:
|
2005-06-18 22:42:13 -07:00
|
|
|
nlmsg_failure:
|
|
|
|
kfree_skb(skb);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_notify_policy_flush(const struct km_event *c)
|
2005-06-18 22:42:13 -07:00
|
|
|
{
|
2008-11-25 18:50:36 -07:00
|
|
|
struct net *net = c->net;
|
2005-06-18 22:42:13 -07:00
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(userpolicy_type_attrsize(), GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0, 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
goto nlmsg_failure;
|
2006-11-27 13:58:20 -07:00
|
|
|
if (copy_to_user_policy_type(c->data.type, skb) < 0)
|
|
|
|
goto nlmsg_failure;
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_end(skb, nlh);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
|
2005-06-18 22:42:13 -07:00
|
|
|
|
|
|
|
nlmsg_failure:
|
|
|
|
kfree_skb(skb);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2011-02-23 22:02:38 -07:00
|
|
|
static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c)
|
2005-06-18 22:42:13 -07:00
|
|
|
{
|
|
|
|
|
|
|
|
switch (c->event) {
|
2005-06-18 22:44:37 -07:00
|
|
|
case XFRM_MSG_NEWPOLICY:
|
|
|
|
case XFRM_MSG_UPDPOLICY:
|
|
|
|
case XFRM_MSG_DELPOLICY:
|
2005-06-18 22:42:13 -07:00
|
|
|
return xfrm_notify_policy(xp, dir, c);
|
2005-06-18 22:44:37 -07:00
|
|
|
case XFRM_MSG_FLUSHPOLICY:
|
2005-06-18 22:42:13 -07:00
|
|
|
return xfrm_notify_policy_flush(c);
|
2005-06-18 22:44:37 -07:00
|
|
|
case XFRM_MSG_POLEXPIRE:
|
2005-06-18 22:42:13 -07:00
|
|
|
return xfrm_exp_policy_notify(xp, dir, c);
|
|
|
|
default:
|
2010-05-11 23:37:06 -07:00
|
|
|
printk(KERN_NOTICE "xfrm_user: Unknown Policy event %d\n",
|
|
|
|
c->event);
|
2005-06-18 22:42:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
static inline size_t xfrm_report_msgsize(void)
|
|
|
|
{
|
|
|
|
return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
|
|
|
|
}
|
|
|
|
|
2006-08-23 20:44:06 -07:00
|
|
|
static int build_report(struct sk_buff *skb, u8 proto,
|
|
|
|
struct xfrm_selector *sel, xfrm_address_t *addr)
|
|
|
|
{
|
|
|
|
struct xfrm_user_report *ur;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
|
2007-08-22 12:46:53 -07:00
|
|
|
nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur), 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
2006-08-23 20:44:06 -07:00
|
|
|
|
2007-08-22 13:53:52 -07:00
|
|
|
ur = nlmsg_data(nlh);
|
2006-08-23 20:44:06 -07:00
|
|
|
ur->proto = proto;
|
|
|
|
memcpy(&ur->sel, sel, sizeof(ur->sel));
|
|
|
|
|
|
|
|
if (addr)
|
2007-08-22 13:55:43 -07:00
|
|
|
NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
|
2006-08-23 20:44:06 -07:00
|
|
|
|
2007-08-22 12:47:26 -07:00
|
|
|
return nlmsg_end(skb, nlh);
|
2006-08-23 20:44:06 -07:00
|
|
|
|
2007-08-22 13:55:43 -07:00
|
|
|
nla_put_failure:
|
2007-08-22 12:47:26 -07:00
|
|
|
nlmsg_cancel(skb, nlh);
|
|
|
|
return -EMSGSIZE;
|
2006-08-23 20:44:06 -07:00
|
|
|
}
|
|
|
|
|
2008-11-25 18:51:01 -07:00
|
|
|
static int xfrm_send_report(struct net *net, u8 proto,
|
|
|
|
struct xfrm_selector *sel, xfrm_address_t *addr)
|
2006-08-23 20:44:06 -07:00
|
|
|
{
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
2007-08-22 13:57:39 -07:00
|
|
|
skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
|
2006-08-23 20:44:06 -07:00
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (build_report(skb, proto, sel, addr) < 0)
|
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
|
2006-08-23 20:44:06 -07:00
|
|
|
}
|
|
|
|
|
2008-10-28 16:01:07 -07:00
|
|
|
static inline size_t xfrm_mapping_msgsize(void)
|
|
|
|
{
|
|
|
|
return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
|
|
|
|
}
|
|
|
|
|
|
|
|
static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
|
|
|
|
xfrm_address_t *new_saddr, __be16 new_sport)
|
|
|
|
{
|
|
|
|
struct xfrm_user_mapping *um;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
|
|
|
|
nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
|
|
|
|
if (nlh == NULL)
|
|
|
|
return -EMSGSIZE;
|
|
|
|
|
|
|
|
um = nlmsg_data(nlh);
|
|
|
|
|
|
|
|
memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
|
|
|
|
um->id.spi = x->id.spi;
|
|
|
|
um->id.family = x->props.family;
|
|
|
|
um->id.proto = x->id.proto;
|
|
|
|
memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
|
|
|
|
memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
|
|
|
|
um->new_sport = new_sport;
|
|
|
|
um->old_sport = x->encap->encap_sport;
|
|
|
|
um->reqid = x->props.reqid;
|
|
|
|
|
|
|
|
return nlmsg_end(skb, nlh);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
|
|
|
|
__be16 sport)
|
|
|
|
{
|
2008-11-25 18:38:20 -07:00
|
|
|
struct net *net = xs_net(x);
|
2008-10-28 16:01:07 -07:00
|
|
|
struct sk_buff *skb;
|
|
|
|
|
|
|
|
if (x->id.proto != IPPROTO_ESP)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!x->encap)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
|
|
|
|
if (skb == NULL)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (build_mapping(skb, x, ipaddr, sport) < 0)
|
|
|
|
BUG();
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
|
2008-10-28 16:01:07 -07:00
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static struct xfrm_mgr netlink_mgr = {
|
|
|
|
.id = "netlink",
|
|
|
|
.notify = xfrm_send_state_notify,
|
|
|
|
.acquire = xfrm_send_acquire,
|
|
|
|
.compile_policy = xfrm_compile_policy,
|
|
|
|
.notify_policy = xfrm_send_policy_notify,
|
2006-08-23 20:44:06 -07:00
|
|
|
.report = xfrm_send_report,
|
2007-02-08 14:12:32 -07:00
|
|
|
.migrate = xfrm_send_migrate,
|
2008-10-28 16:01:07 -07:00
|
|
|
.new_mapping = xfrm_send_mapping,
|
2005-04-16 15:20:36 -07:00
|
|
|
};
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
static int __net_init xfrm_user_net_init(struct net *net)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2006-03-20 23:40:54 -07:00
|
|
|
struct sock *nlsk;
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
nlsk = netlink_kernel_create(net, NETLINK_XFRM, XFRMNLGRP_MAX,
|
2007-04-20 14:14:21 -07:00
|
|
|
xfrm_netlink_rcv, NULL, THIS_MODULE);
|
2006-03-20 23:40:54 -07:00
|
|
|
if (nlsk == NULL)
|
2005-04-16 15:20:36 -07:00
|
|
|
return -ENOMEM;
|
2009-12-02 19:29:05 -07:00
|
|
|
net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
|
2008-11-25 18:38:20 -07:00
|
|
|
rcu_assign_pointer(net->xfrm.nlsk, nlsk);
|
2005-04-16 15:20:36 -07:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-12-02 19:29:05 -07:00
|
|
|
static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2009-12-02 19:29:05 -07:00
|
|
|
struct net *net;
|
|
|
|
list_for_each_entry(net, net_exit_list, exit_list)
|
|
|
|
rcu_assign_pointer(net->xfrm.nlsk, NULL);
|
|
|
|
synchronize_net();
|
|
|
|
list_for_each_entry(net, net_exit_list, exit_list)
|
|
|
|
netlink_kernel_release(net->xfrm.nlsk_stash);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2008-11-25 18:38:20 -07:00
|
|
|
static struct pernet_operations xfrm_user_net_ops = {
|
2009-12-02 19:29:05 -07:00
|
|
|
.init = xfrm_user_net_init,
|
|
|
|
.exit_batch = xfrm_user_net_exit,
|
2008-11-25 18:38:20 -07:00
|
|
|
};
|
|
|
|
|
|
|
|
static int __init xfrm_user_init(void)
|
|
|
|
{
|
|
|
|
int rv;
|
|
|
|
|
|
|
|
printk(KERN_INFO "Initializing XFRM netlink socket\n");
|
|
|
|
|
|
|
|
rv = register_pernet_subsys(&xfrm_user_net_ops);
|
|
|
|
if (rv < 0)
|
|
|
|
return rv;
|
|
|
|
rv = xfrm_register_km(&netlink_mgr);
|
|
|
|
if (rv < 0)
|
|
|
|
unregister_pernet_subsys(&xfrm_user_net_ops);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit xfrm_user_exit(void)
|
|
|
|
{
|
|
|
|
xfrm_unregister_km(&netlink_mgr);
|
|
|
|
unregister_pernet_subsys(&xfrm_user_net_ops);
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
module_init(xfrm_user_init);
|
|
|
|
module_exit(xfrm_user_exit);
|
|
|
|
MODULE_LICENSE("GPL");
|
2005-08-09 19:40:55 -07:00
|
|
|
MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
|
2006-03-20 20:15:11 -07:00
|
|
|
|