[MLSXFRM]: Add security context to acquire messages using netlink

This includes the security context of a security association created
for use by IKE in the acquire messages sent to IKE daemons using
netlink/xfrm_user. This would allow the daemons to include the
security context in the negotiation, so that the resultant association
is unique to that security context.

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index fa79ddc4239e071c2d524c76285631c26005e65e..dac8db1088bcd44aa404c0f30be2821a699c5dce 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -911,25 +911,38 @@ rtattr_failure:
        return -1;
 }
 
-static int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
+static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
 {
-       if (xp->security) {
-               int ctx_size = sizeof(struct xfrm_sec_ctx) +
-                               xp->security->ctx_len;
-               struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
-               struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+       int ctx_size = sizeof(struct xfrm_sec_ctx) + s->ctx_len;
+       struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
+       struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+       uctx->exttype = XFRMA_SEC_CTX;
+       uctx->len = ctx_size;
+       uctx->ctx_doi = s->ctx_doi;
+       uctx->ctx_alg = s->ctx_alg;
+       uctx->ctx_len = s->ctx_len;
+       memcpy(uctx + 1, s->ctx_str, s->ctx_len);
+       return 0;
 
-               uctx->exttype = XFRMA_SEC_CTX;
-               uctx->len = ctx_size;
-               uctx->ctx_doi = xp->security->ctx_doi;
-               uctx->ctx_alg = xp->security->ctx_alg;
-               uctx->ctx_len = xp->security->ctx_len;
-               memcpy(uctx + 1, xp->security->ctx_str, xp->security->ctx_len);
+ rtattr_failure:
+       return -1;
+}
+
+static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
+{
+       if (x->security) {
+               return copy_sec_ctx(x->security, skb);
        }
        return 0;
+}
 
- rtattr_failure:
-       return -1;
+static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
+{
+       if (xp->security) {
+               return copy_sec_ctx(xp->security, skb);
+       }
+       return 0;
 }
 
 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
@@ -1710,7 +1723,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
 
        if (copy_to_user_tmpl(xp, skb) < 0)
                goto nlmsg_failure;
-       if (copy_to_user_sec_ctx(xp, skb))
+       if (copy_to_user_state_sec_ctx(x, skb))
                goto nlmsg_failure;
 
        nlh->nlmsg_len = skb->tail - b;