Skip to content

Commit c39596f

Browse files
klassertklassert
committed
Merge branch 'xfrm: add netlink extack to all the ->init_stat'
Sabrina Dubroca says: ============ This series completes extack support for state creation. ============ Signed-off-by: Steffen Klassert <[email protected]>
2 parents 48ff45d + 28b5dbd commit c39596f

File tree

13 files changed

+140
-87
lines changed

13 files changed

+140
-87
lines changed

‎include/net/ipcomp.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ struct xfrm_state;
2222
int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb);
2323
int ipcomp_output(struct xfrm_state *x, struct sk_buff *skb);
2424
void ipcomp_destroy(struct xfrm_state *x);
25-
int ipcomp_init_state(struct xfrm_state *x);
25+
int ipcomp_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack);
2626

2727
static inline struct ip_comp_hdr *ip_comp_hdr(const struct sk_buff *skb)
2828
{

‎include/net/xfrm.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -405,7 +405,8 @@ struct xfrm_type {
405405
#define XFRM_TYPE_LOCAL_COADDR 4
406406
#define XFRM_TYPE_REMOTE_COADDR 8
407407

408-
int (*init_state)(struct xfrm_state *x);
408+
int (*init_state)(struct xfrm_state *x,
409+
struct netlink_ext_ack *extack);
409410
void (*destructor)(struct xfrm_state *);
410411
int (*input)(struct xfrm_state *, struct sk_buff *skb);
411412
int (*output)(struct xfrm_state *, struct sk_buff *pskb);

‎net/ipv4/ah4.c‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -471,30 +471,38 @@ static int ah4_err(struct sk_buff *skb, u32 info)
471471
return 0;
472472
}
473473

474-
static int ah_init_state(struct xfrm_state *x)
474+
static int ah_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack)
475475
{
476476
struct ah_data *ahp = NULL;
477477
struct xfrm_algo_desc *aalg_desc;
478478
struct crypto_ahash *ahash;
479479

480-
if (!x->aalg)
480+
if (!x->aalg) {
481+
NL_SET_ERR_MSG(extack, "AH requires a state with an AUTH algorithm");
481482
goto error;
483+
}
482484

483-
if (x->encap)
485+
if (x->encap) {
486+
NL_SET_ERR_MSG(extack, "AH is not compatible with encapsulation");
484487
goto error;
488+
}
485489

486490
ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
487491
if (!ahp)
488492
return -ENOMEM;
489493

490494
ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
491-
if (IS_ERR(ahash))
495+
if (IS_ERR(ahash)) {
496+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
492497
goto error;
498+
}
493499

494500
ahp->ahash = ahash;
495501
if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
496-
(x->aalg->alg_key_len + 7) / 8))
502+
(x->aalg->alg_key_len + 7) / 8)) {
503+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
497504
goto error;
505+
}
498506

499507
/*
500508
* Lookup the algorithm description maintained by xfrm_algo,
@@ -507,10 +515,7 @@ static int ah_init_state(struct xfrm_state *x)
507515

508516
if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
509517
crypto_ahash_digestsize(ahash)) {
510-
pr_info("%s: %s digestsize %u != %u\n",
511-
__func__, x->aalg->alg_name,
512-
crypto_ahash_digestsize(ahash),
513-
aalg_desc->uinfo.auth.icv_fullbits / 8);
518+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
514519
goto error;
515520
}
516521

‎net/ipv4/esp4.c‎

Lines changed: 33 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1007,16 +1007,17 @@ static void esp_destroy(struct xfrm_state *x)
10071007
crypto_free_aead(aead);
10081008
}
10091009

1010-
static int esp_init_aead(struct xfrm_state *x)
1010+
static int esp_init_aead(struct xfrm_state *x, struct netlink_ext_ack *extack)
10111011
{
10121012
char aead_name[CRYPTO_MAX_ALG_NAME];
10131013
struct crypto_aead *aead;
10141014
int err;
10151015

1016-
err = -ENAMETOOLONG;
10171016
if (snprintf(aead_name, CRYPTO_MAX_ALG_NAME, "%s(%s)",
1018-
x->geniv, x->aead->alg_name) >= CRYPTO_MAX_ALG_NAME)
1019-
goto error;
1017+
x->geniv, x->aead->alg_name) >= CRYPTO_MAX_ALG_NAME) {
1018+
NL_SET_ERR_MSG(extack, "Algorithm name is too long");
1019+
return -ENAMETOOLONG;
1020+
}
10201021

10211022
aead = crypto_alloc_aead(aead_name, 0, 0);
10221023
err = PTR_ERR(aead);
@@ -1034,11 +1035,15 @@ static int esp_init_aead(struct xfrm_state *x)
10341035
if (err)
10351036
goto error;
10361037

1038+
return 0;
1039+
10371040
error:
1041+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
10381042
return err;
10391043
}
10401044

1041-
static int esp_init_authenc(struct xfrm_state *x)
1045+
static int esp_init_authenc(struct xfrm_state *x,
1046+
struct netlink_ext_ack *extack)
10421047
{
10431048
struct crypto_aead *aead;
10441049
struct crypto_authenc_key_param *param;
@@ -1049,10 +1054,6 @@ static int esp_init_authenc(struct xfrm_state *x)
10491054
unsigned int keylen;
10501055
int err;
10511056

1052-
err = -EINVAL;
1053-
if (!x->ealg)
1054-
goto error;
1055-
10561057
err = -ENAMETOOLONG;
10571058

10581059
if ((x->props.flags & XFRM_STATE_ESN)) {
@@ -1061,22 +1062,28 @@ static int esp_init_authenc(struct xfrm_state *x)
10611062
x->geniv ?: "", x->geniv ? "(" : "",
10621063
x->aalg ? x->aalg->alg_name : "digest_null",
10631064
x->ealg->alg_name,
1064-
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME)
1065+
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME) {
1066+
NL_SET_ERR_MSG(extack, "Algorithm name is too long");
10651067
goto error;
1068+
}
10661069
} else {
10671070
if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME,
10681071
"%s%sauthenc(%s,%s)%s",
10691072
x->geniv ?: "", x->geniv ? "(" : "",
10701073
x->aalg ? x->aalg->alg_name : "digest_null",
10711074
x->ealg->alg_name,
1072-
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME)
1075+
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME) {
1076+
NL_SET_ERR_MSG(extack, "Algorithm name is too long");
10731077
goto error;
1078+
}
10741079
}
10751080

10761081
aead = crypto_alloc_aead(authenc_name, 0, 0);
10771082
err = PTR_ERR(aead);
1078-
if (IS_ERR(aead))
1083+
if (IS_ERR(aead)) {
1084+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
10791085
goto error;
1086+
}
10801087

10811088
x->data = aead;
10821089

@@ -1106,17 +1113,16 @@ static int esp_init_authenc(struct xfrm_state *x)
11061113
err = -EINVAL;
11071114
if (aalg_desc->uinfo.auth.icv_fullbits / 8 !=
11081115
crypto_aead_authsize(aead)) {
1109-
pr_info("ESP: %s digestsize %u != %u\n",
1110-
x->aalg->alg_name,
1111-
crypto_aead_authsize(aead),
1112-
aalg_desc->uinfo.auth.icv_fullbits / 8);
1116+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
11131117
goto free_key;
11141118
}
11151119

11161120
err = crypto_aead_setauthsize(
11171121
aead, x->aalg->alg_trunc_len / 8);
1118-
if (err)
1122+
if (err) {
1123+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
11191124
goto free_key;
1125+
}
11201126
}
11211127

11221128
param->enckeylen = cpu_to_be32((x->ealg->alg_key_len + 7) / 8);
@@ -1131,18 +1137,22 @@ static int esp_init_authenc(struct xfrm_state *x)
11311137
return err;
11321138
}
11331139

1134-
static int esp_init_state(struct xfrm_state *x)
1140+
static int esp_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack)
11351141
{
11361142
struct crypto_aead *aead;
11371143
u32 align;
11381144
int err;
11391145

11401146
x->data = NULL;
11411147

1142-
if (x->aead)
1143-
err = esp_init_aead(x);
1144-
else
1145-
err = esp_init_authenc(x);
1148+
if (x->aead) {
1149+
err = esp_init_aead(x, extack);
1150+
} else if (x->ealg) {
1151+
err = esp_init_authenc(x, extack);
1152+
} else {
1153+
NL_SET_ERR_MSG(extack, "ESP: AEAD or CRYPT must be provided");
1154+
err = -EINVAL;
1155+
}
11461156

11471157
if (err)
11481158
goto error;
@@ -1160,6 +1170,7 @@ static int esp_init_state(struct xfrm_state *x)
11601170

11611171
switch (encap->encap_type) {
11621172
default:
1173+
NL_SET_ERR_MSG(extack, "Unsupported encapsulation type for ESP");
11631174
err = -EINVAL;
11641175
goto error;
11651176
case UDP_ENCAP_ESPINUDP:

‎net/ipv4/ipcomp.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,8 @@ static int ipcomp_tunnel_attach(struct xfrm_state *x)
117117
return err;
118118
}
119119

120-
static int ipcomp4_init_state(struct xfrm_state *x)
120+
static int ipcomp4_init_state(struct xfrm_state *x,
121+
struct netlink_ext_ack *extack)
121122
{
122123
int err = -EINVAL;
123124

@@ -129,17 +130,20 @@ static int ipcomp4_init_state(struct xfrm_state *x)
129130
x->props.header_len += sizeof(struct iphdr);
130131
break;
131132
default:
133+
NL_SET_ERR_MSG(extack, "Unsupported XFRM mode for IPcomp");
132134
goto out;
133135
}
134136

135-
err = ipcomp_init_state(x);
137+
err = ipcomp_init_state(x, extack);
136138
if (err)
137139
goto out;
138140

139141
if (x->props.mode == XFRM_MODE_TUNNEL) {
140142
err = ipcomp_tunnel_attach(x);
141-
if (err)
143+
if (err) {
144+
NL_SET_ERR_MSG(extack, "Kernel error: failed to initialize the associated state");
142145
goto out;
146+
}
143147
}
144148

145149
err = 0;

‎net/ipv4/xfrm4_tunnel.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,17 @@ static int ipip_xfrm_rcv(struct xfrm_state *x, struct sk_buff *skb)
2222
return ip_hdr(skb)->protocol;
2323
}
2424

25-
static int ipip_init_state(struct xfrm_state *x)
25+
static int ipip_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack)
2626
{
27-
if (x->props.mode != XFRM_MODE_TUNNEL)
27+
if (x->props.mode != XFRM_MODE_TUNNEL) {
28+
NL_SET_ERR_MSG(extack, "IPv4 tunnel can only be used with tunnel mode");
2829
return -EINVAL;
30+
}
2931

30-
if (x->encap)
32+
if (x->encap) {
33+
NL_SET_ERR_MSG(extack, "IPv4 tunnel is not compatible with encapsulation");
3134
return -EINVAL;
35+
}
3236

3337
x->props.header_len = sizeof(struct iphdr);
3438

‎net/ipv6/ah6.c‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -666,30 +666,38 @@ static int ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
666666
return 0;
667667
}
668668

669-
static int ah6_init_state(struct xfrm_state *x)
669+
static int ah6_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack)
670670
{
671671
struct ah_data *ahp = NULL;
672672
struct xfrm_algo_desc *aalg_desc;
673673
struct crypto_ahash *ahash;
674674

675-
if (!x->aalg)
675+
if (!x->aalg) {
676+
NL_SET_ERR_MSG(extack, "AH requires a state with an AUTH algorithm");
676677
goto error;
678+
}
677679

678-
if (x->encap)
680+
if (x->encap) {
681+
NL_SET_ERR_MSG(extack, "AH is not compatible with encapsulation");
679682
goto error;
683+
}
680684

681685
ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
682686
if (!ahp)
683687
return -ENOMEM;
684688

685689
ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
686-
if (IS_ERR(ahash))
690+
if (IS_ERR(ahash)) {
691+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
687692
goto error;
693+
}
688694

689695
ahp->ahash = ahash;
690696
if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
691-
(x->aalg->alg_key_len + 7) / 8))
697+
(x->aalg->alg_key_len + 7) / 8)) {
698+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
692699
goto error;
700+
}
693701

694702
/*
695703
* Lookup the algorithm description maintained by xfrm_algo,
@@ -702,9 +710,7 @@ static int ah6_init_state(struct xfrm_state *x)
702710

703711
if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
704712
crypto_ahash_digestsize(ahash)) {
705-
pr_info("AH: %s digestsize %u != %u\n",
706-
x->aalg->alg_name, crypto_ahash_digestsize(ahash),
707-
aalg_desc->uinfo.auth.icv_fullbits/8);
713+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
708714
goto error;
709715
}
710716

@@ -721,6 +727,7 @@ static int ah6_init_state(struct xfrm_state *x)
721727
x->props.header_len += sizeof(struct ipv6hdr);
722728
break;
723729
default:
730+
NL_SET_ERR_MSG(extack, "Invalid mode requested for AH, must be one of TRANSPORT, TUNNEL, BEET");
724731
goto error;
725732
}
726733
x->data = ahp;

0 commit comments

Comments
 (0)