[XFRM]: Add XFRM_MODE_xxx for future use.

[linux-2.6.git] / net / xfrm / xfrm_user.c

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a3733d2db3ba675d138fe653ef9e957063f35a30..0d580ac1977158f71c2cc656f19183516ba6ff86 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -10,6 +10,7 @@
  *
  */
 
+#include <linux/crypto.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
@@ -173,8 +174,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 
        err = -EINVAL;
        switch (p->mode) {
-       case 0:
-       case 1:
+       case XFRM_MODE_TRANSPORT:
+       case XFRM_MODE_TUNNEL:
                break;
 
        default:
@@ -212,6 +213,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
                return -ENOMEM;
 
        memcpy(p, ualg, len);
+       strcpy(p->alg_name, algo->name);
        *algpp = p;
        return 0;
 }
@@ -427,7 +429,7 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
        if (x == NULL)
                return -ESRCH;
 
-       if (err = security_xfrm_state_delete(x))
+       if ((err = security_xfrm_state_delete(x)) != 0)
                goto out;
 
        if (xfrm_state_kern(x)) {
@@ -909,25 +911,38 @@ rtattr_failure:
        return -1;
 }
 
-static int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
+static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
 {
-       if (xp->security) {
-               int ctx_size = sizeof(struct xfrm_sec_ctx) +
-                               xp->security->ctx_len;
-               struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
-               struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+       int ctx_size = sizeof(struct xfrm_sec_ctx) + s->ctx_len;
+       struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
+       struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+       uctx->exttype = XFRMA_SEC_CTX;
+       uctx->len = ctx_size;
+       uctx->ctx_doi = s->ctx_doi;
+       uctx->ctx_alg = s->ctx_alg;
+       uctx->ctx_len = s->ctx_len;
+       memcpy(uctx + 1, s->ctx_str, s->ctx_len);
+       return 0;
 
-               uctx->exttype = XFRMA_SEC_CTX;
-               uctx->len = ctx_size;
-               uctx->ctx_doi = xp->security->ctx_doi;
-               uctx->ctx_alg = xp->security->ctx_alg;
-               uctx->ctx_len = xp->security->ctx_len;
-               memcpy(uctx + 1, xp->security->ctx_str, xp->security->ctx_len);
+ rtattr_failure:
+       return -1;
+}
+
+static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
+{
+       if (x->security) {
+               return copy_sec_ctx(x->security, skb);
        }
        return 0;
+}
 
- rtattr_failure:
-       return -1;
+static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
+{
+       if (xp->security) {
+               return copy_sec_ctx(xp->security, skb);
+       }
+       return 0;
 }
 
 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
@@ -1057,7 +1072,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
                                              MSG_DONTWAIT);
                }
        } else {
-               if (err = security_xfrm_policy_delete(xp))
+               if ((err = security_xfrm_policy_delete(xp)) != 0)
                        goto out;
                c.data.byid = p->index;
                c.event = nlh->nlmsg_type;
@@ -1435,7 +1450,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *err
        link = &xfrm_dispatch[type];
 
        /* All operations require privileges, even GET */
-       if (security_netlink_recv(skb)) {
+       if (security_netlink_recv(skb, CAP_NET_ADMIN)) {
                *errp = -EPERM;
                return -1;
        }
@@ -1708,7 +1723,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
 
        if (copy_to_user_tmpl(xp, skb) < 0)
                goto nlmsg_failure;
-       if (copy_to_user_sec_ctx(xp, skb))
+       if (copy_to_user_state_sec_ctx(x, skb))
                goto nlmsg_failure;
 
        nlh->nlmsg_len = skb->tail - b;
@@ -1742,7 +1757,7 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 /* User gives us xfrm_user_policy_info followed by an array of 0
  * or more templates.
  */
-static struct xfrm_policy *xfrm_compile_policy(u16 family, int opt,
+static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
                                               u8 *data, int len, int *dir)
 {
        struct xfrm_userpolicy_info *p = (struct xfrm_userpolicy_info *)data;
@@ -1750,7 +1765,7 @@ static struct xfrm_policy *xfrm_compile_policy(u16 family, int opt,
        struct xfrm_policy *xp;
        int nr;
 
-       switch (family) {
+       switch (sk->sk_family) {
        case AF_INET:
                if (opt != IP_XFRM_POLICY) {
                        *dir = -EOPNOTSUPP;
@@ -1792,6 +1807,15 @@ static struct xfrm_policy *xfrm_compile_policy(u16 family, int opt,
        copy_from_user_policy(xp, p);
        copy_templates(xp, ut, nr);
 
+       if (!xp->security) {
+               int err = security_xfrm_sock_policy_alloc(xp, sk);
+               if (err) {
+                       kfree(xp);
+                       *dir = err;
+                       return NULL;
+               }
+       }
+
        *dir = p->dir;
 
        return xp;