xfrm: export verify_userspi_info for pkfey and netlink interface

In order to check against valid IPcomp spi range, export verify_userspi_info
for both pfkey and netlink interface.

Signed-off-by: Fan Du <fan.du@windriver.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 59f5d0a6c7f8529bcc2fcee079fce9234e5a9be0..b7635ef4d4364a16c6340234a69e969970ed689b 100644 (file)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1563,6 +1563,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
                                     u32 id, int delete, int *err);
 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
 u32 xfrm_get_acqseq(void);
+int verify_spi_info(u8 proto, u32 min, u32 max);
 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
                                 u8 mode, u32 reqid, u8 proto,

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 5beabd8ba77239da435ec6c60d7a0727e2630f50..1a04c13293628eb420088717dce841266328b09f 100644 (file)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1340,6 +1340,12 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
                max_spi = range->sadb_spirange_max;
        }
 
+       err = verify_spi_info(x->id.proto, min_spi, max_spi);
+       if (err) {
+               xfrm_state_put(x);
+               return err;
+       }
+
        err = xfrm_alloc_spi(x, min_spi, max_spi);
        resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x);
 

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e845066547c48de0b8a9efec0a3dcb4469a78bac..a62c25ea3631614963826df0b9184fb21b9cd0c0 100644 (file)
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1489,6 +1489,30 @@ u32 xfrm_get_acqseq(void)
 }
 EXPORT_SYMBOL(xfrm_get_acqseq);
 
+int verify_spi_info(u8 proto, u32 min, u32 max)
+{
+       switch (proto) {
+       case IPPROTO_AH:
+       case IPPROTO_ESP:
+               break;
+
+       case IPPROTO_COMP:
+               /* IPCOMP spi is 16-bits. */
+               if (max >= 0x10000)
+                       return -EINVAL;
+               break;
+
+       default:
+               return -EINVAL;
+       }
+
+       if (min > max)
+               return -EINVAL;
+
+       return 0;
+}
+EXPORT_SYMBOL(verify_spi_info);
+
 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
 {
        struct net *net = xs_net(x);

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 4027c4266a879b609a661fc6d53b6ad33a951dfd..97681a39040210556bfd70bb0a472a426490929b 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1079,29 +1079,6 @@ out_noput:
        return err;
 }
 
-static int verify_userspi_info(struct xfrm_userspi_info *p)
-{
-       switch (p->info.id.proto) {
-       case IPPROTO_AH:
-       case IPPROTO_ESP:
-               break;
-
-       case IPPROTO_COMP:
-               /* IPCOMP spi is 16-bits. */
-               if (p->max >= 0x10000)
-                       return -EINVAL;
-               break;
-
-       default:
-               return -EINVAL;
-       }
-
-       if (p->min > p->max)
-               return -EINVAL;
-
-       return 0;
-}
-
 static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
                struct nlattr **attrs)
 {
@@ -1116,7 +1093,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
        struct xfrm_mark m;
 
        p = nlmsg_data(nlh);
-       err = verify_userspi_info(p);
+       err = verify_spi_info(p->info.id.proto, p->min, p->max);
        if (err)
                goto out_noput;