Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e2ba18e authored by Venkat Yekkirala's avatar Venkat Yekkirala Committed by David S. Miller
Browse files

[MLSXFRM]: Add security context to acquire messages using PF_KEY 



This includes the security context of a security association created
for use by IKE in the acquire messages sent to IKE daemons using
PF_KEY. This would allow the daemons to include the security context
in the negotiation, so that the resultant association is unique to
that security context.

Signed-off-by: default avatarVenkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0d681623

net/key/af_key.c

+22 −0
Original line number Original line Diff line number Diff line
@@ -2708,6 +2708,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct 
#endif

#endif

	int sockaddr_size;

	int sockaddr_size;

	int size;

	int size;

	struct sadb_x_sec_ctx *sec_ctx;

	struct xfrm_sec_ctx *xfrm_ctx;

	int ctx_size = 0;

	

	

	sockaddr_size = pfkey_sockaddr_size(x->props.family);

	sockaddr_size = pfkey_sockaddr_size(x->props.family);

	if (!sockaddr_size)

	if (!sockaddr_size)
@@ -2723,6 +2726,11 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct 
	else if (x->id.proto == IPPROTO_ESP)

	else if (x->id.proto == IPPROTO_ESP)

		size += count_esp_combs(t);

		size += count_esp_combs(t);





	if ((xfrm_ctx = x->security)) {

		ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);

		size +=  sizeof(struct sadb_x_sec_ctx) + ctx_size;

	}



	skb =  alloc_skb(size + 16, GFP_ATOMIC);

	skb =  alloc_skb(size + 16, GFP_ATOMIC);

	if (skb == NULL)

	if (skb == NULL)

		return -ENOMEM;

		return -ENOMEM;
@@ -2818,6 +2826,20 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct 
	else if (x->id.proto == IPPROTO_ESP)

	else if (x->id.proto == IPPROTO_ESP)

		dump_esp_combs(skb, t);

		dump_esp_combs(skb, t);





	/* security context */

	if (xfrm_ctx) {

		sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,

				sizeof(struct sadb_x_sec_ctx) + ctx_size);

		sec_ctx->sadb_x_sec_len =

		  (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);

		sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;

		sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;

		sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;

		sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;

		memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,

		       xfrm_ctx->ctx_len);

	}



	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);

	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);

}

}