[MLSXFRM]: Add security context to acquire messages using PF_KEY

This includes the security context of a security association created
for use by IKE in the acquire messages sent to IKE daemons using
PF_KEY. This would allow the daemons to include the security context
in the negotiation, so that the resultant association is unique to
that security context.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 22 insertions, 0 deletions

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 3a95b2ee4690..a065e1a67773 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2708,6 +2708,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
 #endif
         int sockaddr_size;
         int size;
+        struct sadb_x_sec_ctx *sec_ctx;
+        struct xfrm_sec_ctx *xfrm_ctx;
+        int ctx_size = 0;
         
         sockaddr_size = pfkey_sockaddr_size(x->props.family);
         if (!sockaddr_size)
@@ -2723,6 +2726,11 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
         else if (x->id.proto == IPPROTO_ESP)
                 size += count_esp_combs(t);
 
+        if ((xfrm_ctx = x->security)) {
+                ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
+                size +=  sizeof(struct sadb_x_sec_ctx) + ctx_size;
+        }
+
         skb =  alloc_skb(size + 16, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -2818,6 +2826,20 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
         else if (x->id.proto == IPPROTO_ESP)
                 dump_esp_combs(skb, t);
 
+        /* security context */
+        if (xfrm_ctx) {
+                sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
+                                sizeof(struct sadb_x_sec_ctx) + ctx_size);
+                sec_ctx->sadb_x_sec_len =
+                  (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
+                sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
+                sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
+                sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
+                sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
+                memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
+                       xfrm_ctx->ctx_len);
+        }
+
         return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
 }