4 files changed, 261 insertions, 62 deletions

diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 2f4531fcac..6ed3302312 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -540,8 +540,7 @@ void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
                         start = end;
                 }
         }
-        if (len)
-                BUG();
+        BUG_ON(len);
 }
 EXPORT_SYMBOL_GPL(skb_icv_walk);
 
@@ -610,8 +609,7 @@ skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
                         start = end;
                 }
         }
-        if (len)
-                BUG();
+        BUG_ON(len);
         return elt;
 }
 EXPORT_SYMBOL_GPL(skb_to_sgvec);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0db9e57013..077bbf9fb9 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -10,7 +10,7 @@
  *      YOSHIFUJI Hideaki
  *              Split up af-specific portion
  *      Derek Atkins <derek@ihtfp.com>          Add the post_input processor
- *      
+ *
  */
 
 #include <asm/bug.h>
@@ -22,6 +22,7 @@
 #include <linux/workqueue.h>
 #include <linux/notifier.h>
 #include <linux/netdevice.h>
+#include <linux/netfilter.h>
 #include <linux/module.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
@@ -247,15 +248,14 @@ EXPORT_SYMBOL(xfrm_policy_alloc);
 
 void __xfrm_policy_destroy(struct xfrm_policy *policy)
 {
-        if (!policy->dead)
-                BUG();
+        BUG_ON(!policy->dead);
 
-        if (policy->bundles)
-                BUG();
+        BUG_ON(policy->bundles);
 
         if (del_timer(&policy->timer))
                 BUG();
 
+        security_xfrm_policy_free(policy);
         kfree(policy);
 }
 EXPORT_SYMBOL(__xfrm_policy_destroy);
@@ -346,10 +346,12 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct xfrm_policy *pol, **p;
         struct xfrm_policy *delpol = NULL;
         struct xfrm_policy **newpos = NULL;
+        struct dst_entry *gc_list;
 
         write_lock_bh(&xfrm_policy_lock);
         for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL;) {
-                if (!delpol && memcmp(&policy->selector, &pol->selector, sizeof(pol->selector)) == 0) {
+                if (!delpol && memcmp(&policy->selector, &pol->selector, sizeof(pol->selector)) == 0 &&
+                    xfrm_sec_ctx_match(pol->security, policy->security)) {
                         if (excl) {
                                 write_unlock_bh(&xfrm_policy_lock);
                                 return -EEXIST;
@@ -381,21 +383,49 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                 xfrm_pol_hold(policy);
         write_unlock_bh(&xfrm_policy_lock);
 
-        if (delpol) {
+        if (delpol)
                 xfrm_policy_kill(delpol);
+
+        read_lock_bh(&xfrm_policy_lock);
+        gc_list = NULL;
+        for (policy = policy->next; policy; policy = policy->next) {
+                struct dst_entry *dst;
+
+                write_lock(&policy->lock);
+                dst = policy->bundles;
+                if (dst) {
+                        struct dst_entry *tail = dst;
+                        while (tail->next)
+                                tail = tail->next;
+                        tail->next = gc_list;
+                        gc_list = dst;
+
+                        policy->bundles = NULL;
+                }
+                write_unlock(&policy->lock);
+        }
+        read_unlock_bh(&xfrm_policy_lock);
+
+        while (gc_list) {
+                struct dst_entry *dst = gc_list;
+
+                gc_list = dst->next;
+                dst_free(dst);
         }
+
         return 0;
 }
 EXPORT_SYMBOL(xfrm_policy_insert);
 
-struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
-                                      int delete)
+struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel,
+                                          struct xfrm_sec_ctx *ctx, int delete)
 {
         struct xfrm_policy *pol, **p;
 
         write_lock_bh(&xfrm_policy_lock);
         for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL; p = &pol->next) {
-                if (memcmp(sel, &pol->selector, sizeof(*sel)) == 0) {
+                if ((memcmp(sel, &pol->selector, sizeof(*sel)) == 0) &&
+                    (xfrm_sec_ctx_match(ctx, pol->security))) {
                         xfrm_pol_hold(pol);
                         if (delete)
                                 *p = pol->next;
@@ -410,7 +440,7 @@ struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
         }
         return pol;
 }
-EXPORT_SYMBOL(xfrm_policy_bysel);
+EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
 
 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete)
 {
@@ -491,7 +521,7 @@ EXPORT_SYMBOL(xfrm_policy_walk);
 
 /* Find policy to apply to this flow. */
 
-static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
+static void xfrm_policy_lookup(struct flowi *fl, u32 sk_sid, u16 family, u8 dir,
                                void **objp, atomic_t **obj_refp)
 {
         struct xfrm_policy *pol;
@@ -505,9 +535,12 @@ static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
                         continue;
 
                 match = xfrm_selector_match(sel, fl, family);
+
                 if (match) {
-                        xfrm_pol_hold(pol);
-                        break;
+                        if (!security_xfrm_policy_lookup(pol, sk_sid, dir)) {
+                                xfrm_pol_hold(pol);
+                                break;
+                        }
                 }
         }
         read_unlock_bh(&xfrm_policy_lock);
@@ -515,15 +548,37 @@ static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
                 *obj_refp = &pol->refcnt;
 }
 
-static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl)
+static inline int policy_to_flow_dir(int dir)
+{
+        if (XFRM_POLICY_IN == FLOW_DIR_IN &&
+            XFRM_POLICY_OUT == FLOW_DIR_OUT &&
+            XFRM_POLICY_FWD == FLOW_DIR_FWD)
+                return dir;
+        switch (dir) {
+        default:
+        case XFRM_POLICY_IN:
+                return FLOW_DIR_IN;
+        case XFRM_POLICY_OUT:
+                return FLOW_DIR_OUT;
+        case XFRM_POLICY_FWD:
+                return FLOW_DIR_FWD;
+        };
+}
+
+static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl, u32 sk_sid)
 {
         struct xfrm_policy *pol;
 
         read_lock_bh(&xfrm_policy_lock);
         if ((pol = sk->sk_policy[dir]) != NULL) {
-                int match = xfrm_selector_match(&pol->selector, fl,
+                int match = xfrm_selector_match(&pol->selector, fl,
                                                 sk->sk_family);
+                int err = 0;
+
                 if (match)
+                  err = security_xfrm_policy_lookup(pol, sk_sid, policy_to_flow_dir(dir));
+
+                if (match && !err)
                         xfrm_pol_hold(pol);
                 else
                         pol = NULL;
@@ -596,6 +651,10 @@ static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
 
         if (newp) {
                 newp->selector = old->selector;
+                if (security_xfrm_policy_clone(old, newp)) {
+                        kfree(newp);
+                        return NULL;  /* ENOMEM */
+                }
                 newp->lft = old->lft;
                 newp->curlft = old->curlft;
                 newp->action = old->action;
@@ -707,22 +766,6 @@ xfrm_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
         return err;
 }
 
-static inline int policy_to_flow_dir(int dir)
-{
-        if (XFRM_POLICY_IN == FLOW_DIR_IN &&
-            XFRM_POLICY_OUT == FLOW_DIR_OUT &&
-            XFRM_POLICY_FWD == FLOW_DIR_FWD)
-                return dir;
-        switch (dir) {
-        default:
-        case XFRM_POLICY_IN:
-                return FLOW_DIR_IN;
-        case XFRM_POLICY_OUT:
-                return FLOW_DIR_OUT;
-        case XFRM_POLICY_FWD:
-                return FLOW_DIR_FWD;
-        };
-}
 
 static int stale_bundle(struct dst_entry *dst);
 
@@ -741,19 +784,20 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
         int err;
         u32 genid;
         u16 family = dst_orig->ops->family;
+        u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
+        u32 sk_sid = security_sk_sid(sk, fl, dir);
 restart:
         genid = atomic_read(&flow_cache_genid);
         policy = NULL;
         if (sk && sk->sk_policy[1])
-                policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, sk_sid);
 
         if (!policy) {
                 /* To accelerate a bit...  */
                 if ((dst_orig->flags & DST_NOXFRM) || !xfrm_policy_list[XFRM_POLICY_OUT])
                         return 0;
 
-                policy = flow_cache_lookup(fl, family,
-                                           policy_to_flow_dir(XFRM_POLICY_OUT),
+                policy = flow_cache_lookup(fl, sk_sid, family, dir,
                                            xfrm_policy_lookup);
         }
 
@@ -906,8 +950,8 @@ xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
         return start;
 }
 
-static int
-_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family)
+int
+xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family)
 {
         struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
 
@@ -918,6 +962,7 @@ _decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family)
         xfrm_policy_put_afinfo(afinfo);
         return 0;
 }
+EXPORT_SYMBOL(xfrm_decode_session);
 
 static inline int secpath_has_tunnel(struct sec_path *sp, int k)
 {
@@ -934,16 +979,21 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
 {
         struct xfrm_policy *pol;
         struct flowi fl;
+        u8 fl_dir = policy_to_flow_dir(dir);
+        u32 sk_sid;
 
-        if (_decode_session(skb, &fl, family) < 0)
+        if (xfrm_decode_session(skb, &fl, family) < 0)
                 return 0;
+        nf_nat_decode_session(skb, &fl, family);
+
+        sk_sid = security_sk_sid(sk, &fl, fl_dir);
 
         /* First, check used SA against their selectors. */
         if (skb->sp) {
                 int i;
 
                 for (i=skb->sp->len-1; i>=0; i--) {
-                  struct sec_decap_state *xvec = &(skb->sp->x[i]);
+                        struct sec_decap_state *xvec = &(skb->sp->x[i]);
                         if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
                                 return 0;
 
@@ -958,11 +1008,10 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
 
         pol = NULL;
         if (sk && sk->sk_policy[dir])
-                pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                pol = xfrm_sk_policy_lookup(sk, dir, &fl, sk_sid);
 
         if (!pol)
-                pol = flow_cache_lookup(&fl, family,
-                                        policy_to_flow_dir(dir),
+                pol = flow_cache_lookup(&fl, sk_sid, family, fl_dir,
                                         xfrm_policy_lookup);
 
         if (!pol)
@@ -1007,20 +1056,19 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 {
         struct flowi fl;
 
-        if (_decode_session(skb, &fl, family) < 0)
+        if (xfrm_decode_session(skb, &fl, family) < 0)
                 return 0;
 
         return xfrm_lookup(&skb->dst, &fl, NULL, 0) == 0;
 }
 EXPORT_SYMBOL(__xfrm_route_forward);
 
-/* Optimize later using cookies and generation ids. */
-
 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        if (!stale_bundle(dst))
-                return dst;
-
+        /* If it is marked obsolete, which is how we even get here,
+         * then we have purged it from the policy bundle list and we
+         * did that for a good reason.
+         */
         return NULL;
 }
 
@@ -1104,6 +1152,16 @@ int xfrm_flush_bundles(void)
         return 0;
 }
 
+static int always_true(struct dst_entry *dst)
+{
+        return 1;
+}
+
+void xfrm_flush_all_bundles(void)
+{
+        xfrm_prune_bundles(always_true);
+}
+
 void xfrm_init_pmtu(struct dst_entry *dst)
 {
         do {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 7cf48aa6c9..e12d0be5f9 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -10,7 +10,7 @@
  *              Split up af-specific functions
  *      Derek Atkins <derek@ihtfp.com>
  *              Add UDP Encapsulation
- *      
+ *
  */
 
 #include <linux/workqueue.h>
@@ -70,6 +70,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
                 x->type->destructor(x);
                 xfrm_put_type(x->type);
         }
+        security_xfrm_state_free(x);
         kfree(x);
 }
 
@@ -343,7 +344,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                               selector.
                          */
                         if (x->km.state == XFRM_STATE_VALID) {
-                                if (!xfrm_selector_match(&x->sel, fl, family))
+                                if (!xfrm_selector_match(&x->sel, fl, family) ||
+                                    !xfrm_sec_ctx_match(pol->security, x->security))
                                         continue;
                                 if (!best ||
                                     best->km.dying > x->km.dying ||
@@ -354,7 +356,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                                 acquire_in_progress = 1;
                         } else if (x->km.state == XFRM_STATE_ERROR ||
                                    x->km.state == XFRM_STATE_EXPIRED) {
-                                if (xfrm_selector_match(&x->sel, fl, family))
+                                if (xfrm_selector_match(&x->sel, fl, family) &&
+                                    xfrm_sec_ctx_match(pol->security, x->security))
                                         error = -ESRCH;
                         }
                 }
@@ -431,6 +434,8 @@ void xfrm_state_insert(struct xfrm_state *x)
         spin_lock_bh(&xfrm_state_lock);
         __xfrm_state_insert(x);
         spin_unlock_bh(&xfrm_state_lock);
+
+        xfrm_flush_all_bundles();
 }
 EXPORT_SYMBOL(xfrm_state_insert);
 
@@ -478,6 +483,9 @@ out:
         spin_unlock_bh(&xfrm_state_lock);
         xfrm_state_put_afinfo(afinfo);
 
+        if (!err)
+                xfrm_flush_all_bundles();
+
         if (x1) {
                 xfrm_state_delete(x1);
                 xfrm_state_put(x1);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 0cdd9a07e0..ac87a09ba8 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -7,7 +7,7 @@
  *      Kazunori MIYAZAWA @USAGI
  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  *              IPv6 support
- *      
+ *
  */
 
 #include <linux/module.h>
@@ -88,6 +88,34 @@ static int verify_encap_tmpl(struct rtattr **xfrma)
         return 0;
 }
 
+
+static inline int verify_sec_ctx_len(struct rtattr **xfrma)
+{
+        struct rtattr *rt = xfrma[XFRMA_SEC_CTX - 1];
+        struct xfrm_user_sec_ctx *uctx;
+        int len = 0;
+
+        if (!rt)
+                return 0;
+
+        if (rt->rta_len < sizeof(*uctx))
+                return -EINVAL;
+
+        uctx = RTA_DATA(rt);
+
+        if (uctx->ctx_len > PAGE_SIZE)
+                return -EINVAL;
+
+        len += sizeof(struct xfrm_user_sec_ctx);
+        len += uctx->ctx_len;
+
+        if (uctx->len != len)
+                return -EINVAL;
+
+        return 0;
+}
+
+
 static int verify_newsa_info(struct xfrm_usersa_info *p,
                              struct rtattr **xfrma)
 {
@@ -145,6 +173,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                 goto out;
         if ((err = verify_encap_tmpl(xfrma)))
                 goto out;
+        if ((err = verify_sec_ctx_len(xfrma)))
+                goto out;
 
         err = -EINVAL;
         switch (p->mode) {
@@ -209,6 +239,30 @@ static int attach_encap_tmpl(struct xfrm_encap_tmpl **encapp, struct rtattr *u_a
         return 0;
 }
 
+
+static inline int xfrm_user_sec_ctx_size(struct xfrm_policy *xp)
+{
+        struct xfrm_sec_ctx *xfrm_ctx = xp->security;
+        int len = 0;
+
+        if (xfrm_ctx) {
+                len += sizeof(struct xfrm_user_sec_ctx);
+                len += xfrm_ctx->ctx_len;
+        }
+        return len;
+}
+
+static int attach_sec_ctx(struct xfrm_state *x, struct rtattr *u_arg)
+{
+        struct xfrm_user_sec_ctx *uctx;
+
+        if (!u_arg)
+                return 0;
+
+        uctx = RTA_DATA(u_arg);
+        return security_xfrm_state_alloc(x, uctx);
+}
+
 static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
 {
         memcpy(&x->id, &p->id, sizeof(x->id));
@@ -253,6 +307,9 @@ static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
         if (err)
                 goto error;
 
+        if ((err = attach_sec_ctx(x, xfrma[XFRMA_SEC_CTX-1])))
+                goto error;
+
         x->km.seq = p->seq;
 
         return x;
@@ -272,11 +329,11 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         int err;
         struct km_event c;
 
-        err = verify_newsa_info(p, (struct rtattr **) xfrma);
+        err = verify_newsa_info(p, (struct rtattr **)xfrma);
         if (err)
                 return err;
 
-        x = xfrm_state_construct(p, (struct rtattr **) xfrma, &err);
+        x = xfrm_state_construct(p, (struct rtattr **)xfrma, &err);
         if (!x)
                 return err;
 
@@ -390,6 +447,19 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
         if (x->encap)
                 RTA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
 
+        if (x->security) {
+                int ctx_size = sizeof(struct xfrm_sec_ctx) +
+                                x->security->ctx_len;
+                struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
+                struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+                uctx->exttype = XFRMA_SEC_CTX;
+                uctx->len = ctx_size;
+                uctx->ctx_doi = x->security->ctx_doi;
+                uctx->ctx_alg = x->security->ctx_alg;
+                uctx->ctx_len = x->security->ctx_len;
+                memcpy(uctx + 1, x->security->ctx_str, x->security->ctx_len);
+        }
         nlh->nlmsg_len = skb->tail - b;
 out:
         sp->this_idx++;
@@ -603,6 +673,18 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
         return verify_policy_dir(p->dir);
 }
 
+static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct rtattr **xfrma)
+{
+        struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
+        struct xfrm_user_sec_ctx *uctx;
+
+        if (!rt)
+                return 0;
+
+        uctx = RTA_DATA(rt);
+        return security_xfrm_policy_alloc(pol, uctx);
+}
+
 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
                            int nr)
 {
@@ -681,7 +763,10 @@ static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p,
         }
 
         copy_from_user_policy(xp, p);
-        err = copy_from_user_tmpl(xp, xfrma);
+
+        if (!(err = copy_from_user_tmpl(xp, xfrma)))
+                err = copy_from_user_sec_ctx(xp, xfrma);
+
         if (err) {
                 *errp = err;
                 kfree(xp);
@@ -702,8 +787,11 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         err = verify_newpolicy_info(p);
         if (err)
                 return err;
+        err = verify_sec_ctx_len((struct rtattr **)xfrma);
+        if (err)
+                return err;
 
-        xp = xfrm_policy_construct(p, (struct rtattr **) xfrma, &err);
+        xp = xfrm_policy_construct(p, (struct rtattr **)xfrma, &err);
         if (!xp)
                 return err;
 
@@ -714,6 +802,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
         err = xfrm_policy_insert(p->dir, xp, excl);
         if (err) {
+                security_xfrm_policy_free(xp);
                 kfree(xp);
                 return err;
         }
@@ -761,6 +850,27 @@ rtattr_failure:
         return -1;
 }
 
+static int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
+{
+        if (xp->security) {
+                int ctx_size = sizeof(struct xfrm_sec_ctx) +
+                                xp->security->ctx_len;
+                struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
+                struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+                uctx->exttype = XFRMA_SEC_CTX;
+                uctx->len = ctx_size;
+                uctx->ctx_doi = xp->security->ctx_doi;
+                uctx->ctx_alg = xp->security->ctx_alg;
+                uctx->ctx_len = xp->security->ctx_len;
+                memcpy(uctx + 1, xp->security->ctx_str, xp->security->ctx_len);
+        }
+        return 0;
+
+ rtattr_failure:
+        return -1;
+}
+
 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
 {
         struct xfrm_dump_info *sp = ptr;
@@ -782,6 +892,8 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
         copy_to_user_policy(xp, p, dir);
         if (copy_to_user_tmpl(xp, skb) < 0)
                 goto nlmsg_failure;
+        if (copy_to_user_sec_ctx(xp, skb))
+                goto nlmsg_failure;
 
         nlh->nlmsg_len = skb->tail - b;
 out:
@@ -852,8 +964,25 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
 
         if (p->index)
                 xp = xfrm_policy_byid(p->dir, p->index, delete);
-        else
-                xp = xfrm_policy_bysel(p->dir, &p->sel, delete);
+        else {
+                struct rtattr **rtattrs = (struct rtattr **)xfrma;
+                struct rtattr *rt = rtattrs[XFRMA_SEC_CTX-1];
+                struct xfrm_policy tmp;
+
+                err = verify_sec_ctx_len(rtattrs);
+                if (err)
+                        return err;
+
+                memset(&tmp, 0, sizeof(struct xfrm_policy));
+                if (rt) {
+                        struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+                        if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
+                                return err;
+                }
+                xp = xfrm_policy_bysel_ctx(p->dir, &p->sel, tmp.security, delete);
+                security_xfrm_policy_free(&tmp);
+        }
         if (xp == NULL)
                 return -ENOENT;
 
@@ -1224,6 +1353,8 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
 
         if (copy_to_user_tmpl(xp, skb) < 0)
                 goto nlmsg_failure;
+        if (copy_to_user_sec_ctx(xp, skb))
+                goto nlmsg_failure;
 
         nlh->nlmsg_len = skb->tail - b;
         return skb->len;
@@ -1241,6 +1372,7 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
+        len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -1324,6 +1456,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
         copy_to_user_policy(xp, &upe->pol, dir);
         if (copy_to_user_tmpl(xp, skb) < 0)
                 goto nlmsg_failure;
+        if (copy_to_user_sec_ctx(xp, skb))
+                goto nlmsg_failure;
         upe->hard = !!hard;
 
         nlh->nlmsg_len = skb->tail - b;
@@ -1341,6 +1475,7 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
 
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
+        len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;