Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec...

Steffen Klassert says:

====================
ipsec-next 2022-11-26

1) Remove redundant variable in esp6.
   From Colin Ian King.

2) Update x->lastused for every packet. It was used only for
   outgoing mobile IPv6 packets, but showed to be usefull
   to check if the a SA is still in use in general.
   From Antony Antony.

3) Remove unused variable in xfrm_byidx_resize.
   From Leon Romanovsky.

4) Finalize extack support for xfrm.
   From Sabrina Dubroca.

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next:
  xfrm: add extack to xfrm_set_spdinfo
  xfrm: add extack to xfrm_alloc_userspi
  xfrm: add extack to xfrm_do_migrate
  xfrm: add extack to xfrm_new_ae and xfrm_replay_verify_len
  xfrm: add extack to xfrm_del_sa
  xfrm: add extack to xfrm_add_sa_expire
  xfrm: a few coding style clean ups
  xfrm: Remove not-used total variable
  xfrm: update x->lastused for every packet
  esp6: remove redundant variable err
====================

Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

diff --combined net/ipv6/esp6_offload.c
index 242f4295940e62fd504593dfa566f39a6170368a,97edf461bc725e952afd60cf020997f844fee146..75c02992c520f94e1f53de89ea6463acc842c331
--- 1/net/ipv6/esp6_offload.c
--- 2/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@@ -56,12 -56,11 +56,11 @@@ static struct sk_buff *esp6_gro_receive
        __be32 seq;
        __be32 spi;
        int nhoff;
-       int err;
  
        if (!pskb_pull(skb, offset))
                return NULL;
  
-       if ((err = xfrm_parse_spi(skb, IPPROTO_ESP, &spi, &seq)) != 0)
+       if (xfrm_parse_spi(skb, IPPROTO_ESP, &spi, &seq) != 0)
                goto out;
  
        xo = xfrm_offload(skb);
@@@ -346,9 -345,6 +345,9 @@@ static int esp6_xmit(struct xfrm_state 
                        xo->seq.low += skb_shinfo(skb)->gso_segs;
        }
  
 +      if (xo->seq.low < seq)
 +              xo->seq.hi++;
 +
        esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32));
  
        len = skb->len - sizeof(struct ipv6hdr);

diff --combined net/key/af_key.c
index 95edcbedf6ef28a000503c389361796c68f6bd47,e1d2155605aa0d7865274d879ff13681b4c65efb..2bdbcec781cdb7abf44138092d9119aee7dabcec
--- 1/net/key/af_key.c
--- 2/net/key/af_key.c
+++ b/net/key/af_key.c
@@@ -1377,13 -1377,13 +1377,13 @@@ static int pfkey_getspi(struct sock *sk
                max_spi = range->sadb_spirange_max;
        }
  
-       err = verify_spi_info(x->id.proto, min_spi, max_spi);
+       err = verify_spi_info(x->id.proto, min_spi, max_spi, NULL);
        if (err) {
                xfrm_state_put(x);
                return err;
        }
  
-       err = xfrm_alloc_spi(x, min_spi, max_spi);
+       err = xfrm_alloc_spi(x, min_spi, max_spi, NULL);
        resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x);
  
        if (IS_ERR(resp_skb)) {
@@@ -2626,7 -2626,7 +2626,7 @@@ static int pfkey_migrate(struct sock *s
        }
  
        return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i,
-                           kma ? &k : NULL, net, NULL, 0);
+                           kma ? &k : NULL, net, NULL, 0, NULL);
  
   out:
        return err;
@@@ -2905,7 -2905,7 +2905,7 @@@ static int count_ah_combs(const struct 
                        break;
                if (!aalg->pfkey_supported)
                        continue;
 -              if (aalg_tmpl_set(t, aalg) && aalg->available)
 +              if (aalg_tmpl_set(t, aalg))
                        sz += sizeof(struct sadb_comb);
        }
        return sz + sizeof(struct sadb_prop);
@@@ -2923,7 -2923,7 +2923,7 @@@ static int count_esp_combs(const struc
                if (!ealg->pfkey_supported)
                        continue;
  
 -              if (!(ealg_tmpl_set(t, ealg) && ealg->available))
 +              if (!(ealg_tmpl_set(t, ealg)))
                        continue;
  
                for (k = 1; ; k++) {
@@@ -2934,17 -2934,16 +2934,17 @@@
                        if (!aalg->pfkey_supported)
                                continue;
  
 -                      if (aalg_tmpl_set(t, aalg) && aalg->available)
 +                      if (aalg_tmpl_set(t, aalg))
                                sz += sizeof(struct sadb_comb);
                }
        }
        return sz + sizeof(struct sadb_prop);
  }
  
 -static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
 +static int dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
  {
        struct sadb_prop *p;
 +      int sz = 0;
        int i;
  
        p = skb_put(skb, sizeof(struct sadb_prop));
@@@ -2972,17 -2971,13 +2972,17 @@@
                        c->sadb_comb_soft_addtime = 20*60*60;
                        c->sadb_comb_hard_usetime = 8*60*60;
                        c->sadb_comb_soft_usetime = 7*60*60;
 +                      sz += sizeof(*c);
                }
        }
 +
 +      return sz + sizeof(*p);
  }
  
 -static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
 +static int dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
  {
        struct sadb_prop *p;
 +      int sz = 0;
        int i, k;
  
        p = skb_put(skb, sizeof(struct sadb_prop));
@@@ -3024,11 -3019,8 +3024,11 @@@
                        c->sadb_comb_soft_addtime = 20*60*60;
                        c->sadb_comb_hard_usetime = 8*60*60;
                        c->sadb_comb_soft_usetime = 7*60*60;
 +                      sz += sizeof(*c);
                }
        }
 +
 +      return sz + sizeof(*p);
  }
  
  static int key_notify_policy_expire(struct xfrm_policy *xp, const struct km_event *c)
@@@ -3158,7 -3150,6 +3158,7 @@@ static int pfkey_send_acquire(struct xf
        struct sadb_x_sec_ctx *sec_ctx;
        struct xfrm_sec_ctx *xfrm_ctx;
        int ctx_size = 0;
 +      int alg_size = 0;
  
        sockaddr_size = pfkey_sockaddr_size(x->props.family);
        if (!sockaddr_size)
@@@ -3170,16 -3161,16 +3170,16 @@@
                sizeof(struct sadb_x_policy);
  
        if (x->id.proto == IPPROTO_AH)
 -              size += count_ah_combs(t);
 +              alg_size = count_ah_combs(t);
        else if (x->id.proto == IPPROTO_ESP)
 -              size += count_esp_combs(t);
 +              alg_size = count_esp_combs(t);
  
        if ((xfrm_ctx = x->security)) {
                ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
                size +=  sizeof(struct sadb_x_sec_ctx) + ctx_size;
        }
  
 -      skb =  alloc_skb(size + 16, GFP_ATOMIC);
 +      skb =  alloc_skb(size + alg_size + 16, GFP_ATOMIC);
        if (skb == NULL)
                return -ENOMEM;
  
@@@ -3233,13 -3224,10 +3233,13 @@@
        pol->sadb_x_policy_priority = xp->priority;
  
        /* Set sadb_comb's. */
 +      alg_size = 0;
        if (x->id.proto == IPPROTO_AH)
 -              dump_ah_combs(skb, t);
 +              alg_size = dump_ah_combs(skb, t);
        else if (x->id.proto == IPPROTO_ESP)
 -              dump_esp_combs(skb, t);
 +              alg_size = dump_esp_combs(skb, t);
 +
 +      hdr->sadb_msg_len += alg_size / 8;
  
        /* security context */
        if (xfrm_ctx) {
@@@ -3394,7 -3382,7 +3394,7 @@@ static int pfkey_send_new_mapping(struc
        hdr->sadb_msg_len = size / sizeof(uint64_t);
        hdr->sadb_msg_errno = 0;
        hdr->sadb_msg_reserved = 0;
 -      hdr->sadb_msg_seq = x->km.seq = get_acqseq();
 +      hdr->sadb_msg_seq = x->km.seq;
        hdr->sadb_msg_pid = 0;
  
        /* SA */

diff --combined net/xfrm/xfrm_state.c
index 3d2fe7712ac5b4191830d9eb272f55b4e035b949,d0ae17e3bb38c64216e916bb51943c5df0ab7bde..9ec481fbfb632e83fcc35a013138ee481f3ab670
--- 1/net/xfrm/xfrm_state.c
--- 2/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@@ -2017,7 -2017,7 +2017,7 @@@ u32 xfrm_get_acqseq(void
  }
  EXPORT_SYMBOL(xfrm_get_acqseq);
  
- int verify_spi_info(u8 proto, u32 min, u32 max)
+ int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack)
  {
        switch (proto) {
        case IPPROTO_AH:
@@@ -2026,22 -2026,28 +2026,28 @@@
  
        case IPPROTO_COMP:
                /* IPCOMP spi is 16-bits. */
-               if (max >= 0x10000)
+               if (max >= 0x10000) {
+                       NL_SET_ERR_MSG(extack, "IPCOMP SPI must be <= 65535");
                        return -EINVAL;
+               }
                break;
  
        default:
+               NL_SET_ERR_MSG(extack, "Invalid protocol, must be one of AH, ESP, IPCOMP");
                return -EINVAL;
        }
  
-       if (min > max)
+       if (min > max) {
+               NL_SET_ERR_MSG(extack, "Invalid SPI range: min > max");
                return -EINVAL;
+       }
  
        return 0;
  }
  EXPORT_SYMBOL(verify_spi_info);
  
- int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
+ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high,
+                  struct netlink_ext_ack *extack)
  {
        struct net *net = xs_net(x);
        unsigned int h;
@@@ -2053,8 -2059,10 +2059,10 @@@
        u32 mark = x->mark.v & x->mark.m;
  
        spin_lock_bh(&x->lock);
-       if (x->km.state == XFRM_STATE_DEAD)
+       if (x->km.state == XFRM_STATE_DEAD) {
+               NL_SET_ERR_MSG(extack, "Target ACQUIRE is in DEAD state");
                goto unlock;
+       }
  
        err = 0;
        if (x->id.spi)
@@@ -2065,6 -2073,7 +2073,7 @@@
        if (minspi == maxspi) {
                x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
                if (x0) {
+                       NL_SET_ERR_MSG(extack, "Requested SPI is already in use");
                        xfrm_state_put(x0);
                        goto unlock;
                }
@@@ -2072,7 -2081,7 +2081,7 @@@
        } else {
                u32 spi = 0;
                for (h = 0; h < high-low+1; h++) {
 -                      spi = low + prandom_u32()%(high-low+1);
 +                      spi = low + prandom_u32_max(high - low + 1);
                        x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
                        if (x0 == NULL) {
                                newspi = htonl(spi);
@@@ -2089,6 -2098,8 +2098,8 @@@
                spin_unlock_bh(&net->xfrm.xfrm_state_lock);
  
                err = 0;
+       } else {
+               NL_SET_ERR_MSG(extack, "No SPI available in the requested range");
        }
  
  unlock: