1 /* SPDX-License-Identifier: LGPL-2.1-only */
2 /*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36 /**
37 * @ingroup xfrmnl
38 * @defgroup sa Security Association
39 * @brief
40 */
41
42 #include "nl-default.h"
43
44 #include <time.h>
45
46 #include <netlink/netlink.h>
47 #include <netlink/cache.h>
48 #include <netlink/object.h>
49 #include <netlink/xfrm/sa.h>
50 #include <netlink/xfrm/selector.h>
51 #include <netlink/xfrm/lifetime.h>
52
53 #include "nl-xfrm.h"
54 #include "nl-priv-dynamic-core/object-api.h"
55 #include "nl-priv-dynamic-core/nl-core.h"
56 #include "nl-priv-dynamic-core/cache-api.h"
57 #include "nl-aux-core/nl-core.h"
58 #include "nl-aux-xfrm/nl-xfrm.h"
59
60 /** @cond SKIP */
61
62 struct xfrmnl_stats {
63 uint32_t replay_window;
64 uint32_t replay;
65 uint32_t integrity_failed;
66 };
67
68 struct xfrmnl_algo_aead {
69 char alg_name[64];
70 uint32_t alg_key_len; /* in bits */
71 uint32_t alg_icv_len; /* in bits */
72 char alg_key[0];
73 };
74
75 struct xfrmnl_algo_auth {
76 char alg_name[64];
77 uint32_t alg_key_len; /* in bits */
78 uint32_t alg_trunc_len; /* in bits */
79 char alg_key[0];
80 };
81
82 struct xfrmnl_algo {
83 char alg_name[64];
84 uint32_t alg_key_len; /* in bits */
85 char alg_key[0];
86 };
87
88 struct xfrmnl_encap_tmpl {
89 uint16_t encap_type;
90 uint16_t encap_sport;
91 uint16_t encap_dport;
92 struct nl_addr* encap_oa;
93 };
94
95 struct xfrmnl_user_offload {
96 int ifindex;
97 uint8_t flags;
98 };
99
100 struct xfrmnl_sa {
101 NLHDR_COMMON
102
103 struct xfrmnl_sel* sel;
104 struct xfrmnl_id id;
105 struct nl_addr* saddr;
106 struct xfrmnl_ltime_cfg* lft;
107 struct xfrmnl_lifetime_cur curlft;
108 struct xfrmnl_stats stats;
109 uint32_t seq;
110 uint32_t reqid;
111 uint16_t family;
112 uint8_t mode; /* XFRM_MODE_xxx */
113 uint8_t replay_window;
114 uint8_t flags;
115 struct xfrmnl_algo_aead* aead;
116 struct xfrmnl_algo_auth* auth;
117 struct xfrmnl_algo* crypt;
118 struct xfrmnl_algo* comp;
119 struct xfrmnl_encap_tmpl* encap;
120 uint32_t tfcpad;
121 struct nl_addr* coaddr;
122 struct xfrmnl_mark mark;
123 struct xfrmnl_user_sec_ctx* sec_ctx;
124 uint32_t replay_maxage;
125 uint32_t replay_maxdiff;
126 struct xfrmnl_replay_state replay_state;
127 struct xfrmnl_replay_state_esn* replay_state_esn;
128 uint8_t hard;
129 struct xfrmnl_user_offload* user_offload;
130 };
131
132 #define XFRM_SA_ATTR_SEL 0x01
133 #define XFRM_SA_ATTR_DADDR 0x02
134 #define XFRM_SA_ATTR_SPI 0x04
135 #define XFRM_SA_ATTR_PROTO 0x08
136 #define XFRM_SA_ATTR_SADDR 0x10
137 #define XFRM_SA_ATTR_LTIME_CFG 0x20
138 #define XFRM_SA_ATTR_LTIME_CUR 0x40
139 #define XFRM_SA_ATTR_STATS 0x80
140 #define XFRM_SA_ATTR_SEQ 0x100
141 #define XFRM_SA_ATTR_REQID 0x200
142 #define XFRM_SA_ATTR_FAMILY 0x400
143 #define XFRM_SA_ATTR_MODE 0x800
144 #define XFRM_SA_ATTR_REPLAY_WIN 0x1000
145 #define XFRM_SA_ATTR_FLAGS 0x2000
146 #define XFRM_SA_ATTR_ALG_AEAD 0x4000
147 #define XFRM_SA_ATTR_ALG_AUTH 0x8000
148 #define XFRM_SA_ATTR_ALG_CRYPT 0x10000
149 #define XFRM_SA_ATTR_ALG_COMP 0x20000
150 #define XFRM_SA_ATTR_ENCAP 0x40000
151 #define XFRM_SA_ATTR_TFCPAD 0x80000
152 #define XFRM_SA_ATTR_COADDR 0x100000
153 #define XFRM_SA_ATTR_MARK 0x200000
154 #define XFRM_SA_ATTR_SECCTX 0x400000
155 #define XFRM_SA_ATTR_REPLAY_MAXAGE 0x800000
156 #define XFRM_SA_ATTR_REPLAY_MAXDIFF 0x1000000
157 #define XFRM_SA_ATTR_REPLAY_STATE 0x2000000
158 #define XFRM_SA_ATTR_EXPIRE 0x4000000
159 #define XFRM_SA_ATTR_OFFLOAD_DEV 0x8000000
160
161 static struct nl_cache_ops xfrmnl_sa_ops;
162 static struct nl_object_ops xfrm_sa_obj_ops;
163 /** @endcond */
164
xfrm_sa_alloc_data(struct nl_object * c)165 static void xfrm_sa_alloc_data(struct nl_object *c)
166 {
167 struct xfrmnl_sa* sa = nl_object_priv (c);
168
169 if ((sa->sel = xfrmnl_sel_alloc ()) == NULL)
170 return;
171
172 if ((sa->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
173 return;
174 }
175
xfrm_sa_free_data(struct nl_object * c)176 static void xfrm_sa_free_data(struct nl_object *c)
177 {
178 struct xfrmnl_sa* sa = nl_object_priv (c);
179
180 if (sa == NULL)
181 return;
182
183 xfrmnl_sel_put (sa->sel);
184 xfrmnl_ltime_cfg_put (sa->lft);
185 nl_addr_put (sa->id.daddr);
186 nl_addr_put (sa->saddr);
187
188 if (sa->aead)
189 free (sa->aead);
190 if (sa->auth)
191 free (sa->auth);
192 if (sa->crypt)
193 free (sa->crypt);
194 if (sa->comp)
195 free (sa->comp);
196 if (sa->encap) {
197 if (sa->encap->encap_oa)
198 nl_addr_put(sa->encap->encap_oa);
199 free(sa->encap);
200 }
201 if (sa->coaddr)
202 nl_addr_put (sa->coaddr);
203 if (sa->sec_ctx)
204 free (sa->sec_ctx);
205 if (sa->replay_state_esn)
206 free (sa->replay_state_esn);
207 if (sa->user_offload)
208 free(sa->user_offload);
209 }
210
xfrm_sa_clone(struct nl_object * _dst,struct nl_object * _src)211 static int xfrm_sa_clone(struct nl_object *_dst, struct nl_object *_src)
212 {
213 struct xfrmnl_sa* dst = nl_object_priv(_dst);
214 struct xfrmnl_sa* src = nl_object_priv(_src);
215 uint32_t len = 0;
216
217 dst->sel = NULL;
218 dst->id.daddr = NULL;
219 dst->saddr = NULL;
220 dst->lft = NULL;
221 dst->aead = NULL;
222 dst->auth = NULL;
223 dst->crypt = NULL;
224 dst->comp = NULL;
225 dst->encap = NULL;
226 dst->coaddr = NULL;
227 dst->sec_ctx = NULL;
228 dst->replay_state_esn = NULL;
229 dst->user_offload = NULL;
230
231 if (src->sel)
232 if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
233 return -NLE_NOMEM;
234
235 if (src->lft)
236 if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
237 return -NLE_NOMEM;
238
239 if (src->id.daddr)
240 if ((dst->id.daddr = nl_addr_clone (src->id.daddr)) == NULL)
241 return -NLE_NOMEM;
242
243 if (src->saddr)
244 if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
245 return -NLE_NOMEM;
246
247 if (src->aead) {
248 len = sizeof (struct xfrmnl_algo_aead) + ((src->aead->alg_key_len + 7) / 8);
249 if ((dst->aead = calloc (1, len)) == NULL)
250 return -NLE_NOMEM;
251 memcpy ((void *)dst->aead, (void *)src->aead, len);
252 }
253
254 if (src->auth) {
255 len = sizeof (struct xfrmnl_algo_auth) + ((src->auth->alg_key_len + 7) / 8);
256 if ((dst->auth = calloc (1, len)) == NULL)
257 return -NLE_NOMEM;
258 memcpy ((void *)dst->auth, (void *)src->auth, len);
259 }
260
261 if (src->crypt) {
262 len = sizeof (struct xfrmnl_algo) + ((src->crypt->alg_key_len + 7) / 8);
263 if ((dst->crypt = calloc (1, len)) == NULL)
264 return -NLE_NOMEM;
265 memcpy ((void *)dst->crypt, (void *)src->crypt, len);
266 }
267
268 if (src->comp) {
269 len = sizeof (struct xfrmnl_algo) + ((src->comp->alg_key_len + 7) / 8);
270 if ((dst->comp = calloc (1, len)) == NULL)
271 return -NLE_NOMEM;
272 memcpy ((void *)dst->comp, (void *)src->comp, len);
273 }
274
275 if (src->encap) {
276 len = sizeof (struct xfrmnl_encap_tmpl);
277 if ((dst->encap = calloc (1, len)) == NULL)
278 return -NLE_NOMEM;
279 memcpy ((void *)dst->encap, (void *)src->encap, len);
280 }
281
282 if (src->coaddr)
283 if ((dst->coaddr = nl_addr_clone (src->coaddr)) == NULL)
284 return -NLE_NOMEM;
285
286 if (src->sec_ctx) {
287 len = sizeof (*src->sec_ctx) + src->sec_ctx->ctx_len;
288 if ((dst->sec_ctx = calloc (1, len)) == NULL)
289 return -NLE_NOMEM;
290 memcpy ((void *)dst->sec_ctx, (void *)src->sec_ctx, len);
291 }
292
293 if (src->replay_state_esn) {
294 len = sizeof (struct xfrmnl_replay_state_esn) + (src->replay_state_esn->bmp_len * sizeof (uint32_t));
295 if ((dst->replay_state_esn = calloc (1, len)) == NULL)
296 return -NLE_NOMEM;
297 memcpy ((void *)dst->replay_state_esn, (void *)src->replay_state_esn, len);
298 }
299
300 if (src->user_offload) {
301 dst->user_offload = _nl_memdup_ptr(src->user_offload);
302 if (!dst->user_offload)
303 return -NLE_NOMEM;
304 }
305
306 return 0;
307 }
308
xfrm_sa_compare(struct nl_object * _a,struct nl_object * _b,uint64_t attrs,int flags)309 static uint64_t xfrm_sa_compare(struct nl_object *_a, struct nl_object *_b,
310 uint64_t attrs, int flags)
311 {
312 struct xfrmnl_sa* a = (struct xfrmnl_sa *) _a;
313 struct xfrmnl_sa* b = (struct xfrmnl_sa *) _b;
314 uint64_t diff = 0;
315 int found = 0;
316
317 #define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
318 diff |= _DIFF(XFRM_SA_ATTR_SEL, xfrmnl_sel_cmp(a->sel, b->sel));
319 diff |= _DIFF(XFRM_SA_ATTR_DADDR,
320 nl_addr_cmp(a->id.daddr, b->id.daddr));
321 diff |= _DIFF(XFRM_SA_ATTR_SPI, a->id.spi != b->id.spi);
322 diff |= _DIFF(XFRM_SA_ATTR_PROTO, a->id.proto != b->id.proto);
323 diff |= _DIFF(XFRM_SA_ATTR_SADDR, nl_addr_cmp(a->saddr, b->saddr));
324 diff |= _DIFF(XFRM_SA_ATTR_LTIME_CFG,
325 xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
326 diff |= _DIFF(XFRM_SA_ATTR_REQID, a->reqid != b->reqid);
327 diff |= _DIFF(XFRM_SA_ATTR_FAMILY, a->family != b->family);
328 diff |= _DIFF(XFRM_SA_ATTR_MODE, a->mode != b->mode);
329 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_WIN,
330 a->replay_window != b->replay_window);
331 diff |= _DIFF(XFRM_SA_ATTR_FLAGS, a->flags != b->flags);
332 diff |= _DIFF(XFRM_SA_ATTR_ALG_AEAD,
333 (strcmp(a->aead->alg_name, b->aead->alg_name) ||
334 (a->aead->alg_key_len != b->aead->alg_key_len) ||
335 (a->aead->alg_icv_len != b->aead->alg_icv_len) ||
336 memcmp(a->aead->alg_key, b->aead->alg_key,
337 ((a->aead->alg_key_len + 7) / 8))));
338 diff |= _DIFF(XFRM_SA_ATTR_ALG_AUTH,
339 (strcmp(a->auth->alg_name, b->auth->alg_name) ||
340 (a->auth->alg_key_len != b->auth->alg_key_len) ||
341 (a->auth->alg_trunc_len != b->auth->alg_trunc_len) ||
342 memcmp(a->auth->alg_key, b->auth->alg_key,
343 ((a->auth->alg_key_len + 7) / 8))));
344 diff |= _DIFF(XFRM_SA_ATTR_ALG_CRYPT,
345 (strcmp(a->crypt->alg_name, b->crypt->alg_name) ||
346 (a->crypt->alg_key_len != b->crypt->alg_key_len) ||
347 memcmp(a->crypt->alg_key, b->crypt->alg_key,
348 ((a->crypt->alg_key_len + 7) / 8))));
349 diff |= _DIFF(XFRM_SA_ATTR_ALG_COMP,
350 (strcmp(a->comp->alg_name, b->comp->alg_name) ||
351 (a->comp->alg_key_len != b->comp->alg_key_len) ||
352 memcmp(a->comp->alg_key, b->comp->alg_key,
353 ((a->comp->alg_key_len + 7) / 8))));
354 diff |= _DIFF(XFRM_SA_ATTR_ENCAP,
355 ((a->encap->encap_type != b->encap->encap_type) ||
356 (a->encap->encap_sport != b->encap->encap_sport) ||
357 (a->encap->encap_dport != b->encap->encap_dport) ||
358 nl_addr_cmp(a->encap->encap_oa, b->encap->encap_oa)));
359 diff |= _DIFF(XFRM_SA_ATTR_TFCPAD, a->tfcpad != b->tfcpad);
360 diff |= _DIFF(XFRM_SA_ATTR_COADDR, nl_addr_cmp(a->coaddr, b->coaddr));
361 diff |= _DIFF(XFRM_SA_ATTR_MARK,
362 (a->mark.m != b->mark.m) || (a->mark.v != b->mark.v));
363 diff |= _DIFF(XFRM_SA_ATTR_SECCTX,
364 ((a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
365 (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
366 (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
367 strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
368 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_MAXAGE,
369 a->replay_maxage != b->replay_maxage);
370 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_MAXDIFF,
371 a->replay_maxdiff != b->replay_maxdiff);
372 diff |= _DIFF(XFRM_SA_ATTR_EXPIRE, a->hard != b->hard);
373
374 /* Compare replay states */
375 found = AVAILABLE_MISMATCH (a, b, XFRM_SA_ATTR_REPLAY_STATE);
376 if (found == 0) // attribute exists in both objects
377 {
378 if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
379 ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
380 found |= 1;
381
382 if (found == 0) // same replay type. compare actual values
383 {
384 if (a->replay_state_esn)
385 {
386 if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
387 diff |= 1;
388 else
389 {
390 uint32_t len = sizeof (struct xfrmnl_replay_state_esn) +
391 (a->replay_state_esn->bmp_len * sizeof (uint32_t));
392 diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
393 }
394 }
395 else
396 {
397 if ((a->replay_state.oseq != b->replay_state.oseq) ||
398 (a->replay_state.seq != b->replay_state.seq) ||
399 (a->replay_state.bitmap != b->replay_state.bitmap))
400 diff |= 1;
401 }
402 }
403 }
404 #undef _DIFF
405
406 return diff;
407 }
408
409 /**
410 * @name XFRM SA Attribute Translations
411 * @{
412 */
413 static const struct trans_tbl sa_attrs[] = {
414 __ADD(XFRM_SA_ATTR_SEL, selector),
415 __ADD(XFRM_SA_ATTR_DADDR, daddr),
416 __ADD(XFRM_SA_ATTR_SPI, spi),
417 __ADD(XFRM_SA_ATTR_PROTO, proto),
418 __ADD(XFRM_SA_ATTR_SADDR, saddr),
419 __ADD(XFRM_SA_ATTR_LTIME_CFG, lifetime_cfg),
420 __ADD(XFRM_SA_ATTR_LTIME_CUR, lifetime_cur),
421 __ADD(XFRM_SA_ATTR_STATS, stats),
422 __ADD(XFRM_SA_ATTR_SEQ, seqnum),
423 __ADD(XFRM_SA_ATTR_REQID, reqid),
424 __ADD(XFRM_SA_ATTR_FAMILY, family),
425 __ADD(XFRM_SA_ATTR_MODE, mode),
426 __ADD(XFRM_SA_ATTR_REPLAY_WIN, replay_window),
427 __ADD(XFRM_SA_ATTR_FLAGS, flags),
428 __ADD(XFRM_SA_ATTR_ALG_AEAD, alg_aead),
429 __ADD(XFRM_SA_ATTR_ALG_AUTH, alg_auth),
430 __ADD(XFRM_SA_ATTR_ALG_CRYPT, alg_crypto),
431 __ADD(XFRM_SA_ATTR_ALG_COMP, alg_comp),
432 __ADD(XFRM_SA_ATTR_ENCAP, encap),
433 __ADD(XFRM_SA_ATTR_TFCPAD, tfcpad),
434 __ADD(XFRM_SA_ATTR_COADDR, coaddr),
435 __ADD(XFRM_SA_ATTR_MARK, mark),
436 __ADD(XFRM_SA_ATTR_SECCTX, sec_ctx),
437 __ADD(XFRM_SA_ATTR_REPLAY_MAXAGE, replay_maxage),
438 __ADD(XFRM_SA_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
439 __ADD(XFRM_SA_ATTR_REPLAY_STATE, replay_state),
440 __ADD(XFRM_SA_ATTR_EXPIRE, expire),
441 __ADD(XFRM_SA_ATTR_OFFLOAD_DEV, user_offload),
442 };
443
xfrm_sa_attrs2str(int attrs,char * buf,size_t len)444 static char* xfrm_sa_attrs2str(int attrs, char *buf, size_t len)
445 {
446 return __flags2str (attrs, buf, len, sa_attrs, ARRAY_SIZE(sa_attrs));
447 }
448 /** @} */
449
450 /**
451 * @name XFRM SA Flags Translations
452 * @{
453 */
454 static const struct trans_tbl sa_flags[] = {
455 __ADD(XFRM_STATE_NOECN, no ecn),
456 __ADD(XFRM_STATE_DECAP_DSCP, decap dscp),
457 __ADD(XFRM_STATE_NOPMTUDISC, no pmtu discovery),
458 __ADD(XFRM_STATE_WILDRECV, wild receive),
459 __ADD(XFRM_STATE_ICMP, icmp),
460 __ADD(XFRM_STATE_AF_UNSPEC, unspecified),
461 __ADD(XFRM_STATE_ALIGN4, align4),
462 __ADD(XFRM_STATE_ESN, esn),
463 };
464
xfrmnl_sa_flags2str(int flags,char * buf,size_t len)465 char* xfrmnl_sa_flags2str(int flags, char *buf, size_t len)
466 {
467 return __flags2str (flags, buf, len, sa_flags, ARRAY_SIZE(sa_flags));
468 }
469
xfrmnl_sa_str2flag(const char * name)470 int xfrmnl_sa_str2flag(const char *name)
471 {
472 return __str2flags (name, sa_flags, ARRAY_SIZE(sa_flags));
473 }
474 /** @} */
475
476 /**
477 * @name XFRM SA Mode Translations
478 * @{
479 */
480 static const struct trans_tbl sa_modes[] = {
481 __ADD(XFRM_MODE_TRANSPORT, transport),
482 __ADD(XFRM_MODE_TUNNEL, tunnel),
483 __ADD(XFRM_MODE_ROUTEOPTIMIZATION, route optimization),
484 __ADD(XFRM_MODE_IN_TRIGGER, in trigger),
485 __ADD(XFRM_MODE_BEET, beet),
486 };
487
xfrmnl_sa_mode2str(int mode,char * buf,size_t len)488 char* xfrmnl_sa_mode2str(int mode, char *buf, size_t len)
489 {
490 return __type2str (mode, buf, len, sa_modes, ARRAY_SIZE(sa_modes));
491 }
492
xfrmnl_sa_str2mode(const char * name)493 int xfrmnl_sa_str2mode(const char *name)
494 {
495 return __str2type (name, sa_modes, ARRAY_SIZE(sa_modes));
496 }
497 /** @} */
498
499
xfrm_sa_dump_line(struct nl_object * a,struct nl_dump_params * p)500 static void xfrm_sa_dump_line(struct nl_object *a, struct nl_dump_params *p)
501 {
502 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
503 struct xfrmnl_sa* sa = (struct xfrmnl_sa *) a;
504 char flags[128], mode[128];
505 time_t add_time, use_time;
506 struct tm *add_time_tm, *use_time_tm;
507 struct tm tm_buf;
508
509 nl_dump_line(p, "src %s dst %s family: %s\n", nl_addr2str(sa->saddr, src, sizeof(src)),
510 nl_addr2str(sa->id.daddr, dst, sizeof(dst)),
511 nl_af2str (sa->family, flags, sizeof (flags)));
512
513 nl_dump_line(p, "\tproto %s spi 0x%x reqid %u\n",
514 nl_ip_proto2str (sa->id.proto, flags, sizeof(flags)),
515 sa->id.spi, sa->reqid);
516
517 xfrmnl_sa_flags2str(sa->flags, flags, sizeof (flags));
518 xfrmnl_sa_mode2str(sa->mode, mode, sizeof (mode));
519 nl_dump_line(p, "\tmode: %s flags: %s (0x%x) seq: %u replay window: %u\n",
520 mode, flags, sa->flags, sa->seq, sa->replay_window);
521
522 nl_dump_line(p, "\tlifetime configuration: \n");
523 if (sa->lft->soft_byte_limit == XFRM_INF)
524 sprintf (flags, "INF");
525 else
526 sprintf (flags, "%" PRIu64, sa->lft->soft_byte_limit);
527 if (sa->lft->soft_packet_limit == XFRM_INF)
528 sprintf (mode, "INF");
529 else
530 sprintf (mode, "%" PRIu64, sa->lft->soft_packet_limit);
531 nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets)\n", flags, mode);
532 if (sa->lft->hard_byte_limit == XFRM_INF)
533 sprintf (flags, "INF");
534 else
535 sprintf (flags, "%" PRIu64, sa->lft->hard_byte_limit);
536 if (sa->lft->hard_packet_limit == XFRM_INF)
537 sprintf (mode, "INF");
538 else
539 sprintf (mode, "%" PRIu64, sa->lft->hard_packet_limit);
540 nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets)\n", flags,
541 mode);
542 nl_dump_line(
543 p,
544 "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
545 (long long unsigned)sa->lft->soft_add_expires_seconds,
546 (long long unsigned)sa->lft->soft_use_expires_seconds);
547 nl_dump_line(
548 p,
549 "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
550 (long long unsigned)sa->lft->hard_add_expires_seconds,
551 (long long unsigned)sa->lft->hard_use_expires_seconds);
552
553 nl_dump_line(p, "\tlifetime current: \n");
554 nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
555 (long long unsigned)sa->curlft.bytes,
556 (long long unsigned)sa->curlft.packets);
557 if (sa->curlft.add_time != 0)
558 {
559 add_time = sa->curlft.add_time;
560 add_time_tm = gmtime_r (&add_time, &tm_buf);
561 strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
562 }
563 else
564 {
565 sprintf (flags, "%s", "-");
566 }
567
568 if (sa->curlft.use_time != 0)
569 {
570 use_time = sa->curlft.use_time;
571 use_time_tm = gmtime_r (&use_time, &tm_buf);
572 strftime (mode, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
573 }
574 else
575 {
576 sprintf (mode, "%s", "-");
577 }
578 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, mode);
579
580 if (sa->aead)
581 {
582 nl_dump_line(p, "\tAEAD Algo: \n");
583 nl_dump_line(p, "\t\tName: %s Key len(bits): %u ICV Len(bits): %u\n",
584 sa->aead->alg_name, sa->aead->alg_key_len, sa->aead->alg_icv_len);
585 }
586
587 if (sa->auth)
588 {
589 nl_dump_line(p, "\tAuth Algo: \n");
590 nl_dump_line(p, "\t\tName: %s Key len(bits): %u Trunc len(bits): %u\n",
591 sa->auth->alg_name, sa->auth->alg_key_len, sa->auth->alg_trunc_len);
592 }
593
594 if (sa->crypt)
595 {
596 nl_dump_line(p, "\tEncryption Algo: \n");
597 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
598 sa->crypt->alg_name, sa->crypt->alg_key_len);
599 }
600
601 if (sa->comp)
602 {
603 nl_dump_line(p, "\tCompression Algo: \n");
604 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
605 sa->comp->alg_name, sa->comp->alg_key_len);
606 }
607
608 if (sa->encap)
609 {
610 nl_dump_line(p, "\tEncapsulation template: \n");
611 nl_dump_line(p, "\t\tType: %d Src port: %d Dst port: %d Encap addr: %s\n",
612 sa->encap->encap_type, sa->encap->encap_sport, sa->encap->encap_dport,
613 nl_addr2str (sa->encap->encap_oa, dst, sizeof (dst)));
614 }
615
616 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
617 nl_dump_line(p, "\tTFC Pad: %u\n", sa->tfcpad);
618
619 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
620 nl_dump_line(p, "\tCO Address: %s\n", nl_addr2str (sa->coaddr, dst, sizeof (dst)));
621
622 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
623 nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sa->mark.m, sa->mark.v);
624
625 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
626 nl_dump_line(p, "\tDOI: %d Algo: %d Len: %u ctx: %s\n", sa->sec_ctx->ctx_doi,
627 sa->sec_ctx->ctx_alg, sa->sec_ctx->ctx_len, sa->sec_ctx->ctx);
628
629 nl_dump_line(p, "\treplay info: \n");
630 nl_dump_line(p, "\t\tmax age %u max diff %u \n", sa->replay_maxage, sa->replay_maxdiff);
631
632 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
633 {
634 nl_dump_line(p, "\treplay state info: \n");
635 if (sa->replay_state_esn)
636 {
637 nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
638 sa->replay_state_esn->oseq, sa->replay_state_esn->seq,
639 sa->replay_state_esn->oseq_hi, sa->replay_state_esn->seq_hi,
640 sa->replay_state_esn->replay_window);
641 }
642 else
643 {
644 nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", sa->replay_state.oseq,
645 sa->replay_state.seq, sa->replay_state.bitmap);
646 }
647 }
648
649 nl_dump_line(p, "\tselector info: \n");
650 xfrmnl_sel_dump (sa->sel, p);
651
652 nl_dump_line(p, "\tHard: %d\n", sa->hard);
653
654 nl_dump(p, "\n");
655 }
656
xfrm_sa_dump_stats(struct nl_object * a,struct nl_dump_params * p)657 static void xfrm_sa_dump_stats(struct nl_object *a, struct nl_dump_params *p)
658 {
659 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)a;
660
661 nl_dump_line(p, "\tstats: \n");
662 nl_dump_line(p, "\t\treplay window: %u replay: %u integrity failed: %u \n",
663 sa->stats.replay_window, sa->stats.replay, sa->stats.integrity_failed);
664
665 return;
666 }
667
xfrm_sa_dump_details(struct nl_object * a,struct nl_dump_params * p)668 static void xfrm_sa_dump_details(struct nl_object *a, struct nl_dump_params *p)
669 {
670 xfrm_sa_dump_line(a, p);
671 xfrm_sa_dump_stats (a, p);
672 }
673
674 /**
675 * @name XFRM SA Object Allocation/Freeage
676 * @{
677 */
678
xfrmnl_sa_alloc(void)679 struct xfrmnl_sa* xfrmnl_sa_alloc(void)
680 {
681 return (struct xfrmnl_sa*) nl_object_alloc(&xfrm_sa_obj_ops);
682 }
683
xfrmnl_sa_put(struct xfrmnl_sa * sa)684 void xfrmnl_sa_put(struct xfrmnl_sa* sa)
685 {
686 nl_object_put((struct nl_object *) sa);
687 }
688
689 /** @} */
690
691 /**
692 * @name SA Cache Managament
693 * @{
694 */
695
696 /**
697 * Build a SA cache including all SAs currently configured in the kernel.
698 * @arg sock Netlink socket.
699 * @arg result Pointer to store resulting cache.
700 *
701 * Allocates a new SA cache, initializes it properly and updates it
702 * to include all SAs currently configured in the kernel.
703 *
704 * @return 0 on success or a negative error code.
705 */
xfrmnl_sa_alloc_cache(struct nl_sock * sock,struct nl_cache ** result)706 int xfrmnl_sa_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
707 {
708 return nl_cache_alloc_and_fill(&xfrmnl_sa_ops, sock, result);
709 }
710
711 /**
712 * Look up a SA by destination address, SPI, protocol
713 * @arg cache SA cache
714 * @arg daddr destination address of the SA
715 * @arg spi SPI
716 * @arg proto protocol
717 * @return sa handle or NULL if no match was found.
718 */
xfrmnl_sa_get(struct nl_cache * cache,struct nl_addr * daddr,unsigned int spi,unsigned int proto)719 struct xfrmnl_sa* xfrmnl_sa_get(struct nl_cache* cache, struct nl_addr* daddr,
720 unsigned int spi, unsigned int proto)
721 {
722 struct xfrmnl_sa *sa;
723
724 //nl_list_for_each_entry(sa, &cache->c_items, ce_list) {
725 for (sa = (struct xfrmnl_sa*)nl_cache_get_first (cache);
726 sa != NULL;
727 sa = (struct xfrmnl_sa*)nl_cache_get_next ((struct nl_object*)sa))
728 {
729 if (sa->id.proto == proto &&
730 sa->id.spi == spi &&
731 !nl_addr_cmp(sa->id.daddr, daddr))
732 {
733 nl_object_get((struct nl_object *) sa);
734 return sa;
735 }
736
737 }
738
739 return NULL;
740 }
741
742
743 /** @} */
744
745
746 static struct nla_policy xfrm_sa_policy[XFRMA_MAX+1] = {
747 [XFRMA_SA] = { .minlen = sizeof(struct xfrm_usersa_info)},
748 [XFRMA_ALG_AUTH_TRUNC] = { .minlen = sizeof(struct xfrm_algo_auth)},
749 [XFRMA_ALG_AEAD] = { .minlen = sizeof(struct xfrm_algo_aead) },
750 [XFRMA_ALG_AUTH] = { .minlen = sizeof(struct xfrm_algo) },
751 [XFRMA_ALG_CRYPT] = { .minlen = sizeof(struct xfrm_algo) },
752 [XFRMA_ALG_COMP] = { .minlen = sizeof(struct xfrm_algo) },
753 [XFRMA_ENCAP] = { .minlen = sizeof(struct xfrm_encap_tmpl) },
754 [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
755 [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
756 [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
757 [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
758 [XFRMA_OFFLOAD_DEV] = { .minlen = sizeof(struct xfrm_user_offload) },
759 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
760 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
761 [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
762 [XFRMA_COADDR] = { .minlen = sizeof(xfrm_address_t) },
763 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
764 [XFRMA_TFCPAD] = { .type = NLA_U32 },
765 [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
766 };
767
xfrm_sa_request_update(struct nl_cache * c,struct nl_sock * h)768 static int xfrm_sa_request_update(struct nl_cache *c, struct nl_sock *h)
769 {
770 return nl_send_simple (h, XFRM_MSG_GETSA, NLM_F_DUMP, NULL, 0);
771 }
772
xfrmnl_sa_parse(struct nlmsghdr * n,struct xfrmnl_sa ** result)773 int xfrmnl_sa_parse(struct nlmsghdr *n, struct xfrmnl_sa **result)
774 {
775 _nl_auto_nl_addr struct nl_addr *addr1 = NULL;
776 _nl_auto_nl_addr struct nl_addr *addr2 = NULL;
777 _nl_auto_xfrmnl_sa struct xfrmnl_sa *sa = NULL;
778 struct nlattr *tb[XFRMA_MAX + 1];
779 struct xfrm_usersa_info* sa_info;
780 struct xfrm_user_expire* ue;
781 int len, err;
782
783 sa = xfrmnl_sa_alloc();
784 if (!sa)
785 return -NLE_NOMEM;
786
787 sa->ce_msgtype = n->nlmsg_type;
788 if (n->nlmsg_type == XFRM_MSG_EXPIRE)
789 {
790 ue = nlmsg_data(n);
791 sa_info = &ue->state;
792 sa->hard = ue->hard;
793 sa->ce_mask |= XFRM_SA_ATTR_EXPIRE;
794 }
795 else if (n->nlmsg_type == XFRM_MSG_DELSA)
796 {
797 sa_info = (struct xfrm_usersa_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_usersa_id) + NLA_HDRLEN);
798 }
799 else
800 {
801 sa_info = nlmsg_data(n);
802 }
803
804 err = nlmsg_parse(n, sizeof(struct xfrm_usersa_info), tb, XFRMA_MAX, xfrm_sa_policy);
805 if (err < 0)
806 return err;
807
808 if (!(addr1 = _nl_addr_build(sa_info->sel.family, &sa_info->sel.daddr)))
809 return -NLE_NOMEM;
810 nl_addr_set_prefixlen (addr1, sa_info->sel.prefixlen_d);
811 xfrmnl_sel_set_daddr (sa->sel, addr1);
812 xfrmnl_sel_set_prefixlen_d (sa->sel, sa_info->sel.prefixlen_d);
813
814 if (!(addr2 = _nl_addr_build(sa_info->sel.family, &sa_info->sel.saddr)))
815 return -NLE_NOMEM;
816 nl_addr_set_prefixlen (addr2, sa_info->sel.prefixlen_s);
817 xfrmnl_sel_set_saddr (sa->sel, addr2);
818 xfrmnl_sel_set_prefixlen_s (sa->sel, sa_info->sel.prefixlen_s);
819
820 xfrmnl_sel_set_dport (sa->sel, ntohs(sa_info->sel.dport));
821 xfrmnl_sel_set_dportmask (sa->sel, ntohs(sa_info->sel.dport_mask));
822 xfrmnl_sel_set_sport (sa->sel, ntohs(sa_info->sel.sport));
823 xfrmnl_sel_set_sportmask (sa->sel, ntohs(sa_info->sel.sport_mask));
824 xfrmnl_sel_set_family (sa->sel, sa_info->sel.family);
825 xfrmnl_sel_set_proto (sa->sel, sa_info->sel.proto);
826 xfrmnl_sel_set_ifindex (sa->sel, sa_info->sel.ifindex);
827 xfrmnl_sel_set_userid (sa->sel, sa_info->sel.user);
828 sa->ce_mask |= XFRM_SA_ATTR_SEL;
829
830 if (!(sa->id.daddr = _nl_addr_build(sa_info->family, &sa_info->id.daddr)))
831 return -NLE_NOMEM;
832 sa->id.spi = ntohl(sa_info->id.spi);
833 sa->id.proto = sa_info->id.proto;
834 sa->ce_mask |= (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO);
835
836 if (!(sa->saddr = _nl_addr_build(sa_info->family, &sa_info->saddr)))
837 return -NLE_NOMEM;
838 sa->ce_mask |= XFRM_SA_ATTR_SADDR;
839
840 sa->lft->soft_byte_limit = sa_info->lft.soft_byte_limit;
841 sa->lft->hard_byte_limit = sa_info->lft.hard_byte_limit;
842 sa->lft->soft_packet_limit = sa_info->lft.soft_packet_limit;
843 sa->lft->hard_packet_limit = sa_info->lft.hard_packet_limit;
844 sa->lft->soft_add_expires_seconds = sa_info->lft.soft_add_expires_seconds;
845 sa->lft->hard_add_expires_seconds = sa_info->lft.hard_add_expires_seconds;
846 sa->lft->soft_use_expires_seconds = sa_info->lft.soft_use_expires_seconds;
847 sa->lft->hard_use_expires_seconds = sa_info->lft.hard_use_expires_seconds;
848 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
849
850 sa->curlft.bytes = sa_info->curlft.bytes;
851 sa->curlft.packets = sa_info->curlft.packets;
852 sa->curlft.add_time = sa_info->curlft.add_time;
853 sa->curlft.use_time = sa_info->curlft.use_time;
854 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CUR;
855
856 sa->stats.replay_window = sa_info->stats.replay_window;
857 sa->stats.replay = sa_info->stats.replay;
858 sa->stats.integrity_failed = sa_info->stats.integrity_failed;
859 sa->ce_mask |= XFRM_SA_ATTR_STATS;
860
861 sa->seq = sa_info->seq;
862 sa->reqid = sa_info->reqid;
863 sa->family = sa_info->family;
864 sa->mode = sa_info->mode;
865 sa->replay_window = sa_info->replay_window;
866 sa->flags = sa_info->flags;
867 sa->ce_mask |= (XFRM_SA_ATTR_SEQ | XFRM_SA_ATTR_REQID |
868 XFRM_SA_ATTR_FAMILY | XFRM_SA_ATTR_MODE |
869 XFRM_SA_ATTR_REPLAY_WIN | XFRM_SA_ATTR_FLAGS);
870
871 if (tb[XFRMA_ALG_AEAD]) {
872 struct xfrm_algo_aead* aead = nla_data(tb[XFRMA_ALG_AEAD]);
873
874 len = sizeof (struct xfrmnl_algo_aead) + ((aead->alg_key_len + 7) / 8);
875 if ((sa->aead = calloc (1, len)) == NULL)
876 return -NLE_NOMEM;
877 memcpy ((void *)sa->aead, (void *)aead, len);
878 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
879 }
880
881 if (tb[XFRMA_ALG_AUTH_TRUNC]) {
882 struct xfrm_algo_auth* auth = nla_data(tb[XFRMA_ALG_AUTH_TRUNC]);
883
884 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
885 if ((sa->auth = calloc (1, len)) == NULL)
886 return -NLE_NOMEM;
887 memcpy ((void *)sa->auth, (void *)auth, len);
888 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
889 }
890
891 if (tb[XFRMA_ALG_AUTH] && !sa->auth) {
892 struct xfrm_algo* auth = nla_data(tb[XFRMA_ALG_AUTH]);
893
894 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
895 if ((sa->auth = calloc (1, len)) == NULL)
896 return -NLE_NOMEM;
897 strcpy(sa->auth->alg_name, auth->alg_name);
898 memcpy(sa->auth->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
899 sa->auth->alg_key_len = auth->alg_key_len;
900 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
901 }
902
903 if (tb[XFRMA_ALG_CRYPT]) {
904 struct xfrm_algo* crypt = nla_data(tb[XFRMA_ALG_CRYPT]);
905
906 len = sizeof (struct xfrmnl_algo) + ((crypt->alg_key_len + 7) / 8);
907 if ((sa->crypt = calloc (1, len)) == NULL)
908 return -NLE_NOMEM;
909 memcpy ((void *)sa->crypt, (void *)crypt, len);
910 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
911 }
912
913 if (tb[XFRMA_ALG_COMP]) {
914 struct xfrm_algo* comp = nla_data(tb[XFRMA_ALG_COMP]);
915
916 len = sizeof (struct xfrmnl_algo) + ((comp->alg_key_len + 7) / 8);
917 if ((sa->comp = calloc (1, len)) == NULL)
918 return -NLE_NOMEM;
919 memcpy ((void *)sa->comp, (void *)comp, len);
920 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
921 }
922
923 if (tb[XFRMA_ENCAP]) {
924 struct xfrm_encap_tmpl* encap = nla_data(tb[XFRMA_ENCAP]);
925
926 len = sizeof (struct xfrmnl_encap_tmpl);
927 if ((sa->encap = calloc (1, len)) == NULL)
928 return -NLE_NOMEM;
929 sa->encap->encap_type = encap->encap_type;
930 sa->encap->encap_sport = ntohs(encap->encap_sport);
931 sa->encap->encap_dport = ntohs(encap->encap_dport);
932 if (!(sa->encap->encap_oa = _nl_addr_build(sa_info->family,
933 &encap->encap_oa)))
934 return -NLE_NOMEM;
935 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
936 }
937
938 if (tb[XFRMA_TFCPAD]) {
939 sa->tfcpad = *(uint32_t*)nla_data(tb[XFRMA_TFCPAD]);
940 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
941 }
942
943 if (tb[XFRMA_COADDR]) {
944 if (!(sa->coaddr = _nl_addr_build(
945 sa_info->family, nla_data(tb[XFRMA_COADDR]))))
946 return -NLE_NOMEM;
947 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
948 }
949
950 if (tb[XFRMA_MARK]) {
951 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
952
953 sa->mark.m = m->m;
954 sa->mark.v = m->v;
955 sa->ce_mask |= XFRM_SA_ATTR_MARK;
956 }
957
958 if (tb[XFRMA_SEC_CTX]) {
959 struct xfrm_user_sec_ctx* sec_ctx = nla_data(tb[XFRMA_SEC_CTX]);
960
961 len = sizeof (struct xfrmnl_user_sec_ctx) + sec_ctx->ctx_len;
962 if ((sa->sec_ctx = calloc (1, len)) == NULL)
963 return -NLE_NOMEM;
964 memcpy (sa->sec_ctx, sec_ctx, len);
965 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
966 }
967
968 if (tb[XFRMA_ETIMER_THRESH]) {
969 sa->replay_maxage = *(uint32_t*)nla_data(tb[XFRMA_ETIMER_THRESH]);
970 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
971 }
972
973 if (tb[XFRMA_REPLAY_THRESH]) {
974 sa->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRMA_REPLAY_THRESH]);
975 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
976 }
977
978 if (tb[XFRMA_REPLAY_ESN_VAL]) {
979 struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
980
981 len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
982 if ((sa->replay_state_esn = calloc (1, len)) == NULL)
983 return -NLE_NOMEM;
984 memcpy ((void *)sa->replay_state_esn, (void *)esn, len);
985 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
986 }
987 else if (tb[XFRMA_REPLAY_VAL])
988 {
989 struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
990 sa->replay_state.oseq = replay_state->oseq;
991 sa->replay_state.seq = replay_state->seq;
992 sa->replay_state.bitmap = replay_state->bitmap;
993 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
994 sa->replay_state_esn = NULL;
995 }
996
997 if (tb[XFRMA_OFFLOAD_DEV]) {
998 struct xfrm_user_offload *offload;
999
1000 len = sizeof(struct xfrmnl_user_offload);
1001 if ((sa->user_offload = calloc(1, len)) == NULL)
1002 return -NLE_NOMEM;
1003 offload = nla_data(tb[XFRMA_OFFLOAD_DEV]);
1004 sa->user_offload->ifindex = offload->ifindex;
1005 sa->user_offload->flags = offload->flags;
1006 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
1007 }
1008
1009 *result = _nl_steal_pointer(&sa);
1010 return 0;
1011 }
1012
xfrm_sa_update_cache(struct nl_cache * cache,struct nl_object * obj,change_func_t change_cb,change_func_v2_t change_cb_v2,void * data)1013 static int xfrm_sa_update_cache (struct nl_cache *cache, struct nl_object *obj,
1014 change_func_t change_cb, change_func_v2_t change_cb_v2,
1015 void *data)
1016 {
1017 struct nl_object* old_sa;
1018 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)obj;
1019
1020 if (nl_object_get_msgtype (obj) == XFRM_MSG_EXPIRE)
1021 {
1022 /* On hard expiry, the SA gets deleted too from the kernel state without any
1023 * further delete event. On Expire message, we are only updating the cache with
1024 * the SA object's new state. In absence of the explicit delete event, the cache will
1025 * be out of sync with the kernel state. To get around this, expiry messages cache
1026 * operations are handled here (installed with NL_ACT_UNSPEC action) instead of
1027 * in Libnl Cache module. */
1028
1029 /* Do we already have this object in the cache? */
1030 old_sa = nl_cache_search(cache, obj);
1031 if (old_sa)
1032 {
1033 /* Found corresponding SA object in cache. Delete it */
1034 nl_cache_remove (old_sa);
1035 }
1036
1037 /* Handle the expiry event now */
1038 if (sa->hard == 0)
1039 {
1040 /* Soft expiry event: Save the new object to the
1041 * cache and notify application of the expiry event. */
1042 nl_cache_move (cache, obj);
1043
1044 if (old_sa == NULL)
1045 {
1046 /* Application CB present, no previous instance of SA object present.
1047 * Notify application CB as a NEW event */
1048 if (change_cb_v2)
1049 change_cb_v2(cache, NULL, obj, 0, NL_ACT_NEW, data);
1050 else if (change_cb)
1051 change_cb(cache, obj, NL_ACT_NEW, data);
1052 }
1053 else if (old_sa)
1054 {
1055 uint64_t diff = 0;
1056 if (change_cb || change_cb_v2)
1057 diff = nl_object_diff64(old_sa, obj);
1058
1059 /* Application CB present, a previous instance of SA object present.
1060 * Notify application CB as a CHANGE1 event */
1061 if (diff) {
1062 if (change_cb_v2) {
1063 change_cb_v2(cache, old_sa, obj, diff, NL_ACT_CHANGE, data);
1064 } else if (change_cb)
1065 change_cb(cache, obj, NL_ACT_CHANGE, data);
1066 }
1067 nl_object_put (old_sa);
1068 }
1069 }
1070 else
1071 {
1072 /* Hard expiry event: Delete the object from the
1073 * cache and notify application of the expiry event. */
1074 if (change_cb_v2)
1075 change_cb_v2(cache, obj, NULL, 0, NL_ACT_DEL, data);
1076 else if (change_cb)
1077 change_cb (cache, obj, NL_ACT_DEL, data);
1078 nl_object_put (old_sa);
1079 }
1080
1081 /* Done handling expire message */
1082 return 0;
1083 }
1084 else
1085 {
1086 /* All other messages other than Expire, let the standard Libnl cache
1087 * module handle it. */
1088 if (change_cb_v2)
1089 return nl_cache_include_v2(cache, obj, change_cb_v2, data);
1090 else
1091 return nl_cache_include (cache, obj, change_cb, data);
1092 }
1093 }
1094
xfrm_sa_msg_parser(struct nl_cache_ops * ops,struct sockaddr_nl * who,struct nlmsghdr * n,struct nl_parser_param * pp)1095 static int xfrm_sa_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
1096 struct nlmsghdr *n, struct nl_parser_param *pp)
1097 {
1098 struct xfrmnl_sa* sa;
1099 int err;
1100
1101 if ((err = xfrmnl_sa_parse(n, &sa)) < 0)
1102 return err;
1103
1104 err = pp->pp_cb((struct nl_object *) sa, pp);
1105
1106 xfrmnl_sa_put(sa);
1107 return err;
1108 }
1109
1110 /**
1111 * @name XFRM SA Get
1112 * @{
1113 */
1114
xfrmnl_sa_build_get_request(struct nl_addr * daddr,unsigned int spi,unsigned int protocol,unsigned int mark_v,unsigned int mark_m,struct nl_msg ** result)1115 int xfrmnl_sa_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
1116 {
1117 struct nl_msg *msg;
1118 struct xfrm_usersa_id sa_id;
1119 struct xfrm_mark mark;
1120
1121 if (!daddr || !spi)
1122 {
1123 fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
1124 __FILE__, __LINE__, __func__);
1125 assert(0);
1126 return -NLE_MISSING_ATTR;
1127 }
1128
1129 memset(&sa_id, 0, sizeof(sa_id));
1130 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
1131 sa_id.family = nl_addr_get_family (daddr);
1132 sa_id.spi = htonl(spi);
1133 sa_id.proto = protocol;
1134
1135 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETSA, 0)))
1136 return -NLE_NOMEM;
1137
1138 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1139 goto nla_put_failure;
1140
1141 if ((mark_m & mark_v) != 0)
1142 {
1143 memset(&mark, 0, sizeof(struct xfrm_mark));
1144 mark.m = mark_m;
1145 mark.v = mark_v;
1146
1147 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
1148 }
1149
1150 *result = msg;
1151 return 0;
1152
1153 nla_put_failure:
1154 nlmsg_free(msg);
1155 return -NLE_MSGSIZE;
1156 }
1157
xfrmnl_sa_get_kernel(struct nl_sock * sock,struct nl_addr * daddr,unsigned int spi,unsigned int protocol,unsigned int mark_v,unsigned int mark_m,struct xfrmnl_sa ** result)1158 int xfrmnl_sa_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sa** result)
1159 {
1160 struct nl_msg *msg = NULL;
1161 struct nl_object *obj;
1162 int err;
1163
1164 if ((err = xfrmnl_sa_build_get_request(daddr, spi, protocol, mark_m, mark_v, &msg)) < 0)
1165 return err;
1166
1167 err = nl_send_auto(sock, msg);
1168 nlmsg_free(msg);
1169 if (err < 0)
1170 return err;
1171
1172 if ((err = nl_pickup(sock, &xfrm_sa_msg_parser, &obj)) < 0)
1173 return err;
1174
1175 /* We have used xfrm_sa_msg_parser(), object is definitely a xfrm sa */
1176 *result = (struct xfrmnl_sa *) obj;
1177
1178 /* If an object has been returned, we also need to wait for the ACK */
1179 if (err == 0 && obj)
1180 nl_wait_for_ack(sock);
1181
1182 return 0;
1183 }
1184
1185 /** @} */
1186
build_xfrm_sa_message(struct xfrmnl_sa * tmpl,int cmd,int flags,struct nl_msg ** result)1187 static int build_xfrm_sa_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1188 {
1189 struct nl_msg* msg;
1190 struct xfrm_usersa_info sa_info;
1191 uint32_t len;
1192 struct nl_addr* addr;
1193
1194 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1195 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1196 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1197 return -NLE_MISSING_ATTR;
1198
1199 memset ((void*)&sa_info, 0, sizeof (sa_info));
1200 if (tmpl->ce_mask & XFRM_SA_ATTR_SEL)
1201 {
1202 addr = xfrmnl_sel_get_daddr (tmpl->sel);
1203 memcpy ((void*)&sa_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1204 addr = xfrmnl_sel_get_saddr (tmpl->sel);
1205 memcpy ((void*)&sa_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1206 sa_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1207 sa_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1208 sa_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1209 sa_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1210 sa_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1211 sa_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1212 sa_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1213 sa_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1214 sa_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1215 sa_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1216 }
1217
1218 memcpy (&sa_info.id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1219 sa_info.id.spi = htonl(tmpl->id.spi);
1220 sa_info.id.proto = tmpl->id.proto;
1221
1222 if (tmpl->ce_mask & XFRM_SA_ATTR_SADDR)
1223 memcpy (&sa_info.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
1224
1225 if (tmpl->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1226 {
1227 sa_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
1228 sa_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
1229 sa_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
1230 sa_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
1231 sa_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
1232 sa_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
1233 sa_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
1234 sa_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
1235 }
1236
1237 //Skip current lifetime: cur lifetime can be updated only via AE
1238 //Skip stats: stats cant be updated
1239 //Skip seq: seq cant be updated
1240
1241 if (tmpl->ce_mask & XFRM_SA_ATTR_REQID)
1242 sa_info.reqid = tmpl->reqid;
1243
1244 if (tmpl->ce_mask & XFRM_SA_ATTR_FAMILY)
1245 sa_info.family = tmpl->family;
1246
1247 if (tmpl->ce_mask & XFRM_SA_ATTR_MODE)
1248 sa_info.mode = tmpl->mode;
1249
1250 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1251 sa_info.replay_window = tmpl->replay_window;
1252
1253 if (tmpl->ce_mask & XFRM_SA_ATTR_FLAGS)
1254 sa_info.flags = tmpl->flags;
1255
1256 msg = nlmsg_alloc_simple(cmd, flags);
1257 if (!msg)
1258 return -NLE_NOMEM;
1259
1260 if (nlmsg_append(msg, &sa_info, sizeof(sa_info), NLMSG_ALIGNTO) < 0)
1261 goto nla_put_failure;
1262
1263 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AEAD) {
1264 len = sizeof (struct xfrm_algo_aead) + ((tmpl->aead->alg_key_len + 7) / 8);
1265 NLA_PUT (msg, XFRMA_ALG_AEAD, len, tmpl->aead);
1266 }
1267
1268 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AUTH) {
1269 /* kernel prefers XFRMA_ALG_AUTH_TRUNC over XFRMA_ALG_AUTH, so only
1270 * one of the attributes needs to be present */
1271 if (tmpl->auth->alg_trunc_len) {
1272 len = sizeof (struct xfrm_algo_auth) + ((tmpl->auth->alg_key_len + 7) / 8);
1273 NLA_PUT (msg, XFRMA_ALG_AUTH_TRUNC, len, tmpl->auth);
1274 } else {
1275 struct xfrm_algo *auth;
1276
1277 len = sizeof (struct xfrm_algo) + ((tmpl->auth->alg_key_len + 7) / 8);
1278 auth = malloc(len);
1279 if (!auth) {
1280 nlmsg_free(msg);
1281 return -NLE_NOMEM;
1282 }
1283
1284 _nl_strncpy_assert(auth->alg_name, tmpl->auth->alg_name, sizeof(auth->alg_name));
1285 auth->alg_key_len = tmpl->auth->alg_key_len;
1286 memcpy(auth->alg_key, tmpl->auth->alg_key, (tmpl->auth->alg_key_len + 7) / 8);
1287 if (nla_put(msg, XFRMA_ALG_AUTH, len, auth) < 0) {
1288 free(auth);
1289 goto nla_put_failure;
1290 }
1291 free(auth);
1292 }
1293 }
1294
1295 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_CRYPT) {
1296 len = sizeof (struct xfrm_algo) + ((tmpl->crypt->alg_key_len + 7) / 8);
1297 NLA_PUT (msg, XFRMA_ALG_CRYPT, len, tmpl->crypt);
1298 }
1299
1300 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_COMP) {
1301 len = sizeof (struct xfrm_algo) + ((tmpl->comp->alg_key_len + 7) / 8);
1302 NLA_PUT (msg, XFRMA_ALG_COMP, len, tmpl->comp);
1303 }
1304
1305 if (tmpl->ce_mask & XFRM_SA_ATTR_ENCAP) {
1306 struct xfrm_encap_tmpl* encap_tmpl;
1307 struct nlattr* encap_attr;
1308
1309 len = sizeof (struct xfrm_encap_tmpl);
1310 encap_attr = nla_reserve(msg, XFRMA_ENCAP, len);
1311 if (!encap_attr)
1312 goto nla_put_failure;
1313 encap_tmpl = nla_data (encap_attr);
1314 encap_tmpl->encap_type = tmpl->encap->encap_type;
1315 encap_tmpl->encap_sport = htons (tmpl->encap->encap_sport);
1316 encap_tmpl->encap_dport = htons (tmpl->encap->encap_dport);
1317 memcpy (&encap_tmpl->encap_oa, nl_addr_get_binary_addr (tmpl->encap->encap_oa), sizeof (uint8_t) * nl_addr_get_len (tmpl->encap->encap_oa));
1318 }
1319
1320 if (tmpl->ce_mask & XFRM_SA_ATTR_TFCPAD) {
1321 NLA_PUT_U32 (msg, XFRMA_TFCPAD, tmpl->tfcpad);
1322 }
1323
1324 if (tmpl->ce_mask & XFRM_SA_ATTR_COADDR) {
1325 NLA_PUT (msg, XFRMA_COADDR, sizeof (xfrm_address_t), tmpl->coaddr);
1326 }
1327
1328 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1329 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1330 }
1331
1332 if (tmpl->ce_mask & XFRM_SA_ATTR_SECCTX) {
1333 len = sizeof (struct xfrm_sec_ctx) + tmpl->sec_ctx->ctx_len;
1334 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1335 }
1336
1337 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE) {
1338 NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
1339 }
1340
1341 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF) {
1342 NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
1343 }
1344
1345 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_STATE) {
1346 if (tmpl->replay_state_esn) {
1347 len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
1348 NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
1349 }
1350 else {
1351 NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrm_replay_state), &tmpl->replay_state);
1352 }
1353 }
1354
1355 if (tmpl->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV) {
1356 struct xfrm_user_offload *offload;
1357 struct nlattr *attr;
1358
1359 len = sizeof(struct xfrm_user_offload);
1360 attr = nla_reserve(msg, XFRMA_OFFLOAD_DEV, len);
1361
1362 if (!attr)
1363 goto nla_put_failure;
1364
1365 offload = nla_data(attr);
1366 offload->ifindex = tmpl->user_offload->ifindex;
1367 offload->flags = tmpl->user_offload->flags;
1368 }
1369
1370 *result = msg;
1371 return 0;
1372
1373 nla_put_failure:
1374 nlmsg_free(msg);
1375 return -NLE_MSGSIZE;
1376 }
1377
1378 /**
1379 * @name XFRM SA Add
1380 * @{
1381 */
1382
xfrmnl_sa_build_add_request(struct xfrmnl_sa * tmpl,int flags,struct nl_msg ** result)1383 int xfrmnl_sa_build_add_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1384 {
1385 return build_xfrm_sa_message (tmpl, XFRM_MSG_NEWSA, flags, result);
1386 }
1387
xfrmnl_sa_add(struct nl_sock * sk,struct xfrmnl_sa * tmpl,int flags)1388 int xfrmnl_sa_add(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1389 {
1390 int err;
1391 struct nl_msg *msg;
1392
1393 if ((err = xfrmnl_sa_build_add_request(tmpl, flags, &msg)) < 0)
1394 return err;
1395
1396 err = nl_send_auto_complete(sk, msg);
1397 nlmsg_free(msg);
1398 if (err < 0)
1399 return err;
1400
1401 return nl_wait_for_ack(sk);
1402 }
1403
1404 /**
1405 * @name XFRM SA Update
1406 * @{
1407 */
1408
xfrmnl_sa_build_update_request(struct xfrmnl_sa * tmpl,int flags,struct nl_msg ** result)1409 int xfrmnl_sa_build_update_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1410 {
1411 return build_xfrm_sa_message (tmpl, XFRM_MSG_UPDSA, flags, result);
1412 }
1413
xfrmnl_sa_update(struct nl_sock * sk,struct xfrmnl_sa * tmpl,int flags)1414 int xfrmnl_sa_update(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1415 {
1416 int err;
1417 struct nl_msg *msg;
1418
1419 if ((err = xfrmnl_sa_build_update_request(tmpl, flags, &msg)) < 0)
1420 return err;
1421
1422 err = nl_send_auto_complete(sk, msg);
1423 nlmsg_free(msg);
1424 if (err < 0)
1425 return err;
1426
1427 return nl_wait_for_ack(sk);
1428 }
1429
1430 /** @} */
1431
build_xfrm_sa_delete_message(struct xfrmnl_sa * tmpl,int cmd,int flags,struct nl_msg ** result)1432 static int build_xfrm_sa_delete_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1433 {
1434 struct nl_msg* msg;
1435 struct xfrm_usersa_id sa_id;
1436
1437 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1438 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1439 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1440 return -NLE_MISSING_ATTR;
1441
1442 memset(&sa_id, 0, sizeof(struct xfrm_usersa_id));
1443 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr),
1444 sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1445 sa_id.family = nl_addr_get_family (tmpl->id.daddr);
1446 sa_id.spi = htonl(tmpl->id.spi);
1447 sa_id.proto = tmpl->id.proto;
1448
1449 msg = nlmsg_alloc_simple(cmd, flags);
1450 if (!msg)
1451 return -NLE_NOMEM;
1452
1453 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1454 goto nla_put_failure;
1455
1456 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1457 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1458 }
1459
1460 *result = msg;
1461 return 0;
1462
1463 nla_put_failure:
1464 nlmsg_free(msg);
1465 return -NLE_MSGSIZE;
1466 }
1467
1468 /**
1469 * @name XFRM SA Delete
1470 * @{
1471 */
1472
xfrmnl_sa_build_delete_request(struct xfrmnl_sa * tmpl,int flags,struct nl_msg ** result)1473 int xfrmnl_sa_build_delete_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1474 {
1475 return build_xfrm_sa_delete_message (tmpl, XFRM_MSG_DELSA, flags, result);
1476 }
1477
xfrmnl_sa_delete(struct nl_sock * sk,struct xfrmnl_sa * tmpl,int flags)1478 int xfrmnl_sa_delete(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1479 {
1480 int err;
1481 struct nl_msg *msg;
1482
1483 if ((err = xfrmnl_sa_build_delete_request(tmpl, flags, &msg)) < 0)
1484 return err;
1485
1486 err = nl_send_auto_complete(sk, msg);
1487 nlmsg_free(msg);
1488 if (err < 0)
1489 return err;
1490
1491 return nl_wait_for_ack(sk);
1492 }
1493
1494 /** @} */
1495
1496
1497 /**
1498 * @name Attributes
1499 * @{
1500 */
1501
xfrmnl_sa_get_sel(struct xfrmnl_sa * sa)1502 struct xfrmnl_sel* xfrmnl_sa_get_sel (struct xfrmnl_sa* sa)
1503 {
1504 if (sa->ce_mask & XFRM_SA_ATTR_SEL)
1505 return sa->sel;
1506 else
1507 return NULL;
1508 }
1509
xfrmnl_sa_set_sel(struct xfrmnl_sa * sa,struct xfrmnl_sel * sel)1510 int xfrmnl_sa_set_sel (struct xfrmnl_sa* sa, struct xfrmnl_sel* sel)
1511 {
1512 /* Release any previously held selector object from the SA */
1513 if (sa->sel)
1514 xfrmnl_sel_put (sa->sel);
1515
1516 /* Increment ref count on new selector and save it in the SA */
1517 xfrmnl_sel_get (sel);
1518 sa->sel = sel;
1519 sa->ce_mask |= XFRM_SA_ATTR_SEL;
1520
1521 return 0;
1522 }
1523
__assign_addr(struct xfrmnl_sa * sa,struct nl_addr ** pos,struct nl_addr * new,int flag,int nocheck)1524 static inline int __assign_addr(struct xfrmnl_sa* sa, struct nl_addr **pos,
1525 struct nl_addr *new, int flag, int nocheck)
1526 {
1527 if (!nocheck)
1528 {
1529 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1530 {
1531 if (nl_addr_get_family (new) != sa->family)
1532 return -NLE_AF_MISMATCH;
1533 }
1534 }
1535
1536 if (*pos)
1537 nl_addr_put(*pos);
1538
1539 nl_addr_get(new);
1540 *pos = new;
1541
1542 sa->ce_mask |= flag;
1543
1544 return 0;
1545 }
1546
1547
xfrmnl_sa_get_daddr(struct xfrmnl_sa * sa)1548 struct nl_addr* xfrmnl_sa_get_daddr (struct xfrmnl_sa* sa)
1549 {
1550 if (sa->ce_mask & XFRM_SA_ATTR_DADDR)
1551 return sa->id.daddr;
1552 else
1553 return NULL;
1554 }
1555
xfrmnl_sa_set_daddr(struct xfrmnl_sa * sa,struct nl_addr * addr)1556 int xfrmnl_sa_set_daddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1557 {
1558 return __assign_addr(sa, &sa->id.daddr, addr, XFRM_SA_ATTR_DADDR, 0);
1559 }
1560
xfrmnl_sa_get_spi(struct xfrmnl_sa * sa)1561 int xfrmnl_sa_get_spi (struct xfrmnl_sa* sa)
1562 {
1563 if (sa->ce_mask & XFRM_SA_ATTR_SPI)
1564 return sa->id.spi;
1565 else
1566 return -1;
1567 }
1568
xfrmnl_sa_set_spi(struct xfrmnl_sa * sa,unsigned int spi)1569 int xfrmnl_sa_set_spi (struct xfrmnl_sa* sa, unsigned int spi)
1570 {
1571 sa->id.spi = spi;
1572 sa->ce_mask |= XFRM_SA_ATTR_SPI;
1573
1574 return 0;
1575 }
1576
xfrmnl_sa_get_proto(struct xfrmnl_sa * sa)1577 int xfrmnl_sa_get_proto (struct xfrmnl_sa* sa)
1578 {
1579 if (sa->ce_mask & XFRM_SA_ATTR_PROTO)
1580 return sa->id.proto;
1581 else
1582 return -1;
1583 }
1584
xfrmnl_sa_set_proto(struct xfrmnl_sa * sa,unsigned int protocol)1585 int xfrmnl_sa_set_proto (struct xfrmnl_sa* sa, unsigned int protocol)
1586 {
1587 sa->id.proto = protocol;
1588 sa->ce_mask |= XFRM_SA_ATTR_PROTO;
1589
1590 return 0;
1591 }
1592
xfrmnl_sa_get_saddr(struct xfrmnl_sa * sa)1593 struct nl_addr* xfrmnl_sa_get_saddr (struct xfrmnl_sa* sa)
1594 {
1595 if (sa->ce_mask & XFRM_SA_ATTR_SADDR)
1596 return sa->saddr;
1597 else
1598 return NULL;
1599 }
1600
xfrmnl_sa_set_saddr(struct xfrmnl_sa * sa,struct nl_addr * addr)1601 int xfrmnl_sa_set_saddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1602 {
1603 return __assign_addr(sa, &sa->saddr, addr, XFRM_SA_ATTR_SADDR, 1);
1604 }
1605
xfrmnl_sa_get_lifetime_cfg(struct xfrmnl_sa * sa)1606 struct xfrmnl_ltime_cfg* xfrmnl_sa_get_lifetime_cfg (struct xfrmnl_sa* sa)
1607 {
1608 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1609 return sa->lft;
1610 else
1611 return NULL;
1612 }
1613
xfrmnl_sa_set_lifetime_cfg(struct xfrmnl_sa * sa,struct xfrmnl_ltime_cfg * ltime)1614 int xfrmnl_sa_set_lifetime_cfg (struct xfrmnl_sa* sa, struct xfrmnl_ltime_cfg* ltime)
1615 {
1616 /* Release any previously held lifetime cfg object from the SA */
1617 if (sa->lft)
1618 xfrmnl_ltime_cfg_put (sa->lft);
1619
1620 /* Increment ref count on new lifetime object and save it in the SA */
1621 xfrmnl_ltime_cfg_get (ltime);
1622 sa->lft = ltime;
1623 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
1624
1625 return 0;
1626 }
1627
xfrmnl_sa_get_curlifetime(struct xfrmnl_sa * sa,unsigned long long int * curr_bytes,unsigned long long int * curr_packets,unsigned long long int * curr_add_time,unsigned long long int * curr_use_time)1628 int xfrmnl_sa_get_curlifetime (struct xfrmnl_sa* sa, unsigned long long int* curr_bytes,
1629 unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1630 {
1631 if (sa == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1632 return -1;
1633
1634 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CUR)
1635 {
1636 *curr_bytes = sa->curlft.bytes;
1637 *curr_packets = sa->curlft.packets;
1638 *curr_add_time = sa->curlft.add_time;
1639 *curr_use_time = sa->curlft.use_time;
1640 }
1641 else
1642 return -1;
1643
1644 return 0;
1645 }
1646
xfrmnl_sa_get_stats(struct xfrmnl_sa * sa,unsigned long long int * replay_window,unsigned long long int * replay,unsigned long long int * integrity_failed)1647 int xfrmnl_sa_get_stats (struct xfrmnl_sa* sa, unsigned long long int* replay_window,
1648 unsigned long long int* replay, unsigned long long int* integrity_failed)
1649 {
1650 if (sa == NULL || replay_window == NULL || replay == NULL || integrity_failed == NULL)
1651 return -1;
1652
1653 if (sa->ce_mask & XFRM_SA_ATTR_STATS)
1654 {
1655 *replay_window = sa->stats.replay_window;
1656 *replay = sa->stats.replay;
1657 *integrity_failed = sa->stats.integrity_failed;
1658 }
1659 else
1660 return -1;
1661
1662 return 0;
1663 }
1664
xfrmnl_sa_get_seq(struct xfrmnl_sa * sa)1665 int xfrmnl_sa_get_seq (struct xfrmnl_sa* sa)
1666 {
1667 if (sa->ce_mask & XFRM_SA_ATTR_SEQ)
1668 return sa->seq;
1669 else
1670 return -1;
1671 }
1672
xfrmnl_sa_get_reqid(struct xfrmnl_sa * sa)1673 int xfrmnl_sa_get_reqid (struct xfrmnl_sa* sa)
1674 {
1675 if (sa->ce_mask & XFRM_SA_ATTR_REQID)
1676 return sa->reqid;
1677 else
1678 return -1;
1679 }
1680
xfrmnl_sa_set_reqid(struct xfrmnl_sa * sa,unsigned int reqid)1681 int xfrmnl_sa_set_reqid (struct xfrmnl_sa* sa, unsigned int reqid)
1682 {
1683 sa->reqid = reqid;
1684 sa->ce_mask |= XFRM_SA_ATTR_REQID;
1685
1686 return 0;
1687 }
1688
xfrmnl_sa_get_family(struct xfrmnl_sa * sa)1689 int xfrmnl_sa_get_family (struct xfrmnl_sa* sa)
1690 {
1691 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1692 return sa->family;
1693 else
1694 return -1;
1695 }
1696
xfrmnl_sa_set_family(struct xfrmnl_sa * sa,unsigned int family)1697 int xfrmnl_sa_set_family (struct xfrmnl_sa* sa, unsigned int family)
1698 {
1699 sa->family = family;
1700 sa->ce_mask |= XFRM_SA_ATTR_FAMILY;
1701
1702 return 0;
1703 }
1704
xfrmnl_sa_get_mode(struct xfrmnl_sa * sa)1705 int xfrmnl_sa_get_mode (struct xfrmnl_sa* sa)
1706 {
1707 if (sa->ce_mask & XFRM_SA_ATTR_MODE)
1708 return sa->mode;
1709 else
1710 return -1;
1711 }
1712
xfrmnl_sa_set_mode(struct xfrmnl_sa * sa,unsigned int mode)1713 int xfrmnl_sa_set_mode (struct xfrmnl_sa* sa, unsigned int mode)
1714 {
1715 sa->mode = mode;
1716 sa->ce_mask |= XFRM_SA_ATTR_MODE;
1717
1718 return 0;
1719 }
1720
xfrmnl_sa_get_replay_window(struct xfrmnl_sa * sa)1721 int xfrmnl_sa_get_replay_window (struct xfrmnl_sa* sa)
1722 {
1723 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1724 return sa->replay_window;
1725 else
1726 return -1;
1727 }
1728
xfrmnl_sa_set_replay_window(struct xfrmnl_sa * sa,unsigned int replay_window)1729 int xfrmnl_sa_set_replay_window (struct xfrmnl_sa* sa, unsigned int replay_window)
1730 {
1731 sa->replay_window = replay_window;
1732 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_WIN;
1733
1734 return 0;
1735 }
1736
xfrmnl_sa_get_flags(struct xfrmnl_sa * sa)1737 int xfrmnl_sa_get_flags (struct xfrmnl_sa* sa)
1738 {
1739 if (sa->ce_mask & XFRM_SA_ATTR_FLAGS)
1740 return sa->flags;
1741 else
1742 return -1;
1743 }
1744
xfrmnl_sa_set_flags(struct xfrmnl_sa * sa,unsigned int flags)1745 int xfrmnl_sa_set_flags (struct xfrmnl_sa* sa, unsigned int flags)
1746 {
1747 sa->flags = flags;
1748 sa->ce_mask |= XFRM_SA_ATTR_FLAGS;
1749
1750 return 0;
1751 }
1752
1753 /**
1754 * Get the aead-params
1755 * @arg sa the xfrmnl_sa object
1756 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1757 * @arg key_len an optional output value for the key length in bits.
1758 * @arg icv_len an optional output value for the alt-icv-len.
1759 * @arg key an optional buffer large enough for the key. It must contain at least
1760 * ((@key_len + 7) / 8) bytes.
1761 *
1762 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1763 * call xfrmnl_sa_get_aead_params() without @key argument to query only the required buffer size.
1764 * This modified API is available in all versions of libnl3 that support the capability
1765 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1766 *
1767 * @return 0 on success or a negative error code.
1768 */
xfrmnl_sa_get_aead_params(struct xfrmnl_sa * sa,char * alg_name,unsigned int * key_len,unsigned int * icv_len,char * key)1769 int xfrmnl_sa_get_aead_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* icv_len, char* key)
1770 {
1771 if (sa->ce_mask & XFRM_SA_ATTR_ALG_AEAD)
1772 {
1773 if (alg_name)
1774 strcpy (alg_name, sa->aead->alg_name);
1775 if (key_len)
1776 *key_len = sa->aead->alg_key_len;
1777 if (icv_len)
1778 *icv_len = sa->aead->alg_icv_len;
1779 if (key)
1780 memcpy (key, sa->aead->alg_key, ((sa->aead->alg_key_len + 7)/8));
1781 }
1782 else
1783 return -1;
1784
1785 return 0;
1786 }
1787
xfrmnl_sa_set_aead_params(struct xfrmnl_sa * sa,const char * alg_name,unsigned int key_len,unsigned int icv_len,const char * key)1788 int xfrmnl_sa_set_aead_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int icv_len, const char* key)
1789 {
1790 _nl_auto_free struct xfrmnl_algo_aead *b = NULL;
1791 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1792 uint32_t newlen = sizeof (struct xfrmnl_algo_aead) + keysize;
1793
1794 /* Free up the old key and allocate memory to hold new key */
1795 if (strlen (alg_name) >= sizeof (sa->aead->alg_name))
1796 return -1;
1797 if (!(b = calloc (1, newlen)))
1798 return -1;
1799
1800 strcpy (b->alg_name, alg_name);
1801 b->alg_key_len = key_len;
1802 b->alg_icv_len = icv_len;
1803 memcpy (b->alg_key, key, keysize);
1804
1805 free (sa->aead);
1806 sa->aead = _nl_steal_pointer (&b);
1807 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
1808 return 0;
1809 }
1810
1811 /**
1812 * Get the auth-params
1813 * @arg sa the xfrmnl_sa object
1814 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1815 * @arg key_len an optional output value for the key length in bits.
1816 * @arg trunc_len an optional output value for the alg-trunc-len.
1817 * @arg key an optional buffer large enough for the key. It must contain at least
1818 * ((@key_len + 7) / 8) bytes.
1819 *
1820 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1821 * call xfrmnl_sa_get_auth_params() without @key argument to query only the required buffer size.
1822 * This modified API is available in all versions of libnl3 that support the capability
1823 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1824 *
1825 * @return 0 on success or a negative error code.
1826 */
xfrmnl_sa_get_auth_params(struct xfrmnl_sa * sa,char * alg_name,unsigned int * key_len,unsigned int * trunc_len,char * key)1827 int xfrmnl_sa_get_auth_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* trunc_len, char* key)
1828 {
1829 if (!(sa->ce_mask & XFRM_SA_ATTR_ALG_AUTH))
1830 return -NLE_MISSING_ATTR;
1831
1832 if (alg_name)
1833 strcpy(alg_name, sa->auth->alg_name);
1834 if (key_len)
1835 *key_len = sa->auth->alg_key_len;
1836 if (trunc_len)
1837 *trunc_len = sa->auth->alg_trunc_len;
1838 if (key)
1839 memcpy(key, sa->auth->alg_key, (sa->auth->alg_key_len + 7) / 8);
1840 return 0;
1841 }
1842
xfrmnl_sa_set_auth_params(struct xfrmnl_sa * sa,const char * alg_name,unsigned int key_len,unsigned int trunc_len,const char * key)1843 int xfrmnl_sa_set_auth_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int trunc_len, const char* key)
1844 {
1845 _nl_auto_free struct xfrmnl_algo_auth *b = NULL;
1846 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1847 uint32_t newlen = sizeof (struct xfrmnl_algo_auth) + keysize;
1848
1849 if (strlen (alg_name) >= sizeof (sa->auth->alg_name))
1850 return -1;
1851 if (!(b = calloc (1, newlen)))
1852 return -1;
1853
1854 strcpy (b->alg_name, alg_name);
1855 b->alg_key_len = key_len;
1856 b->alg_trunc_len = trunc_len;
1857 memcpy (b->alg_key, key, keysize);
1858
1859 free (sa->auth);
1860 sa->auth = _nl_steal_pointer (&b);
1861 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
1862 return 0;
1863 }
1864
1865 /**
1866 * Get the crypto-params
1867 * @arg sa the xfrmnl_sa object
1868 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1869 * @arg key_len an optional output value for the key length in bits.
1870 * @arg key an optional buffer large enough for the key. It must contain at least
1871 * ((@key_len + 7) / 8) bytes.
1872 *
1873 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1874 * call xfrmnl_sa_get_crypto_params() without @key argument to query only the required buffer size.
1875 * This modified API is available in all versions of libnl3 that support the capability
1876 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1877 *
1878 * @return 0 on success or a negative error code.
1879 */
xfrmnl_sa_get_crypto_params(struct xfrmnl_sa * sa,char * alg_name,unsigned int * key_len,char * key)1880 int xfrmnl_sa_get_crypto_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1881 {
1882 if (sa->ce_mask & XFRM_SA_ATTR_ALG_CRYPT)
1883 {
1884 if (alg_name)
1885 strcpy (alg_name, sa->crypt->alg_name);
1886 if (key_len)
1887 *key_len = sa->crypt->alg_key_len;
1888 if (key)
1889 memcpy (key, sa->crypt->alg_key, ((sa->crypt->alg_key_len + 7)/8));
1890 }
1891 else
1892 return -1;
1893
1894 return 0;
1895 }
1896
xfrmnl_sa_set_crypto_params(struct xfrmnl_sa * sa,const char * alg_name,unsigned int key_len,const char * key)1897 int xfrmnl_sa_set_crypto_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1898 {
1899 _nl_auto_free struct xfrmnl_algo *b = NULL;
1900 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1901 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1902
1903 if (strlen (alg_name) >= sizeof (sa->crypt->alg_name))
1904 return -1;
1905 if (!(b = calloc (1, newlen)))
1906 return -1;
1907
1908 strcpy (b->alg_name, alg_name);
1909 b->alg_key_len = key_len;
1910 memcpy (b->alg_key, key, keysize);
1911
1912 free(sa->crypt);
1913 sa->crypt = _nl_steal_pointer(&b);
1914 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
1915 return 0;
1916 }
1917
1918 /**
1919 * Get the comp-params
1920 * @arg sa the xfrmnl_sa object
1921 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1922 * @arg key_len an optional output value for the key length in bits.
1923 * @arg key an optional buffer large enough for the key. It must contain at least
1924 * ((@key_len + 7) / 8) bytes.
1925 *
1926 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1927 * call xfrmnl_sa_get_comp_params() without @key argument to query only the required buffer size.
1928 * This modified API is available in all versions of libnl3 that support the capability
1929 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1930 *
1931 * @return 0 on success or a negative error code.
1932 */
xfrmnl_sa_get_comp_params(struct xfrmnl_sa * sa,char * alg_name,unsigned int * key_len,char * key)1933 int xfrmnl_sa_get_comp_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1934 {
1935 if (sa->ce_mask & XFRM_SA_ATTR_ALG_COMP)
1936 {
1937 if (alg_name)
1938 strcpy (alg_name, sa->comp->alg_name);
1939 if (key_len)
1940 *key_len = sa->comp->alg_key_len;
1941 if (key)
1942 memcpy (key, sa->comp->alg_key, ((sa->comp->alg_key_len + 7)/8));
1943 }
1944 else
1945 return -1;
1946
1947 return 0;
1948 }
1949
xfrmnl_sa_set_comp_params(struct xfrmnl_sa * sa,const char * alg_name,unsigned int key_len,const char * key)1950 int xfrmnl_sa_set_comp_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1951 {
1952 _nl_auto_free struct xfrmnl_algo *b = NULL;
1953 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1954 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1955
1956 if (strlen (alg_name) >= sizeof (sa->comp->alg_name))
1957 return -1;
1958 if (!(b = calloc (1, newlen)))
1959 return -1;
1960
1961 strcpy (b->alg_name, alg_name);
1962 b->alg_key_len = key_len;
1963 memcpy (b->alg_key, key, keysize);
1964
1965 free(sa->comp);
1966 sa->comp = _nl_steal_pointer(&b);
1967 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
1968 return 0;
1969 }
1970
xfrmnl_sa_get_encap_tmpl(struct xfrmnl_sa * sa,unsigned int * encap_type,unsigned int * encap_sport,unsigned int * encap_dport,struct nl_addr ** encap_oa)1971 int xfrmnl_sa_get_encap_tmpl (struct xfrmnl_sa* sa, unsigned int* encap_type, unsigned int* encap_sport, unsigned int* encap_dport, struct nl_addr** encap_oa)
1972 {
1973 if (sa->ce_mask & XFRM_SA_ATTR_ENCAP)
1974 {
1975 *encap_type = sa->encap->encap_type;
1976 *encap_sport = sa->encap->encap_sport;
1977 *encap_dport = sa->encap->encap_dport;
1978 *encap_oa = nl_addr_clone (sa->encap->encap_oa);
1979 }
1980 else
1981 return -1;
1982
1983 return 0;
1984 }
1985
xfrmnl_sa_set_encap_tmpl(struct xfrmnl_sa * sa,unsigned int encap_type,unsigned int encap_sport,unsigned int encap_dport,struct nl_addr * encap_oa)1986 int xfrmnl_sa_set_encap_tmpl (struct xfrmnl_sa* sa, unsigned int encap_type, unsigned int encap_sport, unsigned int encap_dport, struct nl_addr* encap_oa)
1987 {
1988 if (sa->encap) {
1989 /* Free up the old encap OA */
1990 if (sa->encap->encap_oa)
1991 nl_addr_put(sa->encap->encap_oa);
1992 memset(sa->encap, 0, sizeof (*sa->encap));
1993 } else if ((sa->encap = calloc(1, sizeof(*sa->encap))) == NULL)
1994 return -1;
1995
1996 /* Save the new info */
1997 sa->encap->encap_type = encap_type;
1998 sa->encap->encap_sport = encap_sport;
1999 sa->encap->encap_dport = encap_dport;
2000 nl_addr_get (encap_oa);
2001 sa->encap->encap_oa = encap_oa;
2002
2003 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
2004
2005 return 0;
2006 }
2007
xfrmnl_sa_get_tfcpad(struct xfrmnl_sa * sa)2008 int xfrmnl_sa_get_tfcpad (struct xfrmnl_sa* sa)
2009 {
2010 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
2011 return sa->tfcpad;
2012 else
2013 return -1;
2014 }
2015
xfrmnl_sa_set_tfcpad(struct xfrmnl_sa * sa,unsigned int tfcpad)2016 int xfrmnl_sa_set_tfcpad (struct xfrmnl_sa* sa, unsigned int tfcpad)
2017 {
2018 sa->tfcpad = tfcpad;
2019 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
2020
2021 return 0;
2022 }
2023
xfrmnl_sa_get_coaddr(struct xfrmnl_sa * sa)2024 struct nl_addr* xfrmnl_sa_get_coaddr (struct xfrmnl_sa* sa)
2025 {
2026 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
2027 return sa->coaddr;
2028 else
2029 return NULL;
2030 }
2031
xfrmnl_sa_set_coaddr(struct xfrmnl_sa * sa,struct nl_addr * coaddr)2032 int xfrmnl_sa_set_coaddr (struct xfrmnl_sa* sa, struct nl_addr* coaddr)
2033 {
2034 /* Free up the old coaddr */
2035 if (sa->coaddr)
2036 nl_addr_put (sa->coaddr);
2037
2038 /* Save the new info */
2039 nl_addr_get (coaddr);
2040 sa->coaddr = coaddr;
2041
2042 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
2043
2044 return 0;
2045 }
2046
xfrmnl_sa_get_mark(struct xfrmnl_sa * sa,unsigned int * mark_mask,unsigned int * mark_value)2047 int xfrmnl_sa_get_mark (struct xfrmnl_sa* sa, unsigned int* mark_mask, unsigned int* mark_value)
2048 {
2049 if (mark_mask == NULL || mark_value == NULL)
2050 return -1;
2051
2052 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
2053 {
2054 *mark_mask = sa->mark.m;
2055 *mark_value = sa->mark.v;
2056
2057 return 0;
2058 }
2059 else
2060 return -1;
2061 }
2062
xfrmnl_sa_set_mark(struct xfrmnl_sa * sa,unsigned int value,unsigned int mask)2063 int xfrmnl_sa_set_mark (struct xfrmnl_sa* sa, unsigned int value, unsigned int mask)
2064 {
2065 sa->mark.v = value;
2066 sa->mark.m = mask;
2067 sa->ce_mask |= XFRM_SA_ATTR_MARK;
2068
2069 return 0;
2070 }
2071
2072 /**
2073 * Get the security context.
2074 *
2075 * @arg sa The xfrmnl_sa object.
2076 * @arg doi An optional output value for the security context domain of interpretation.
2077 * @arg alg An optional output value for the security context algorithm.
2078 * @arg len An optional output value for the security context length, including the
2079 * terminating null byte ('\0').
2080 * @arg sid Unused parameter.
2081 * @arg ctx_str An optional buffer large enough for the security context string. It must
2082 * contain at least @len bytes.
2083 *
2084 * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
2085 * call xfrmnl_sa_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
2086 * This modified API is available in all versions of libnl3 that support the capability
2087 * @def NL_CAPABILITY_XFRM_SEC_CTX_LEN (@see nl_has_capability for further information).
2088 *
2089 * @return 0 on success or a negative error code.
2090 */
xfrmnl_sa_get_sec_ctx(struct xfrmnl_sa * sa,unsigned int * doi,unsigned int * alg,unsigned int * len,unsigned int * sid,char * ctx_str)2091 int xfrmnl_sa_get_sec_ctx (struct xfrmnl_sa* sa, unsigned int* doi, unsigned int* alg,
2092 unsigned int* len, unsigned int* sid, char* ctx_str)
2093 {
2094 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
2095 {
2096 if (doi)
2097 *doi = sa->sec_ctx->ctx_doi;
2098 if (alg)
2099 *alg = sa->sec_ctx->ctx_alg;
2100 if (len)
2101 *len = sa->sec_ctx->ctx_len;
2102 if (ctx_str)
2103 memcpy (ctx_str, sa->sec_ctx->ctx, sa->sec_ctx->ctx_len);
2104 }
2105 else
2106 return -1;
2107
2108 return 0;
2109 }
2110
2111 /**
2112 * Set the security context.
2113 *
2114 * @arg sa The xfrmnl_sa object.
2115 * @arg doi Parameter for the security context domain of interpretation.
2116 * @arg alg Parameter for the security context algorithm.
2117 * @arg len Parameter for the length of the security context string containing
2118 * the terminating null byte ('\0').
2119 * @arg sid Unused parameter.
2120 * @arg ctx_str Buffer containing the security context string.
2121 *
2122 * @return 0 on success or a negative error code.
2123 */
xfrmnl_sa_set_sec_ctx(struct xfrmnl_sa * sa,unsigned int doi,unsigned int alg,unsigned int len,unsigned int sid,const char * ctx_str)2124 int xfrmnl_sa_set_sec_ctx (struct xfrmnl_sa* sa, unsigned int doi, unsigned int alg, unsigned int len,
2125 unsigned int sid, const char* ctx_str)
2126 {
2127 _nl_auto_free struct xfrmnl_user_sec_ctx *b = NULL;
2128
2129 if (!(b = calloc(1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + len)))
2130 return -1;
2131
2132 b->len = sizeof(struct xfrmnl_user_sec_ctx) + len;
2133 b->exttype = XFRMA_SEC_CTX;
2134 b->ctx_alg = alg;
2135 b->ctx_doi = doi;
2136 b->ctx_len = len;
2137 memcpy (b->ctx, ctx_str, len);
2138 b->ctx[len] = '\0';
2139
2140 free(sa->sec_ctx);
2141 sa->sec_ctx = _nl_steal_pointer(&b);
2142 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
2143 return 0;
2144 }
2145
2146
xfrmnl_sa_get_replay_maxage(struct xfrmnl_sa * sa)2147 int xfrmnl_sa_get_replay_maxage (struct xfrmnl_sa* sa)
2148 {
2149 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE)
2150 return sa->replay_maxage;
2151 else
2152 return -1;
2153 }
2154
xfrmnl_sa_set_replay_maxage(struct xfrmnl_sa * sa,unsigned int replay_maxage)2155 int xfrmnl_sa_set_replay_maxage (struct xfrmnl_sa* sa, unsigned int replay_maxage)
2156 {
2157 sa->replay_maxage = replay_maxage;
2158 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
2159
2160 return 0;
2161 }
2162
xfrmnl_sa_get_replay_maxdiff(struct xfrmnl_sa * sa)2163 int xfrmnl_sa_get_replay_maxdiff (struct xfrmnl_sa* sa)
2164 {
2165 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF)
2166 return sa->replay_maxdiff;
2167 else
2168 return -1;
2169 }
2170
xfrmnl_sa_set_replay_maxdiff(struct xfrmnl_sa * sa,unsigned int replay_maxdiff)2171 int xfrmnl_sa_set_replay_maxdiff (struct xfrmnl_sa* sa, unsigned int replay_maxdiff)
2172 {
2173 sa->replay_maxdiff = replay_maxdiff;
2174 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
2175
2176 return 0;
2177 }
2178
xfrmnl_sa_get_replay_state(struct xfrmnl_sa * sa,unsigned int * oseq,unsigned int * seq,unsigned int * bmp)2179 int xfrmnl_sa_get_replay_state (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
2180 {
2181 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2182 {
2183 if (sa->replay_state_esn == NULL)
2184 {
2185 *oseq = sa->replay_state.oseq;
2186 *seq = sa->replay_state.seq;
2187 *bmp = sa->replay_state.bitmap;
2188
2189 return 0;
2190 }
2191 else
2192 {
2193 return -1;
2194 }
2195 }
2196 else
2197 return -1;
2198 }
2199
xfrmnl_sa_set_replay_state(struct xfrmnl_sa * sa,unsigned int oseq,unsigned int seq,unsigned int bitmap)2200 int xfrmnl_sa_set_replay_state (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq, unsigned int bitmap)
2201 {
2202 sa->replay_state.oseq = oseq;
2203 sa->replay_state.seq = seq;
2204 sa->replay_state.bitmap = bitmap;
2205 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2206
2207 return 0;
2208 }
2209
xfrmnl_sa_get_replay_state_esn(struct xfrmnl_sa * sa,unsigned int * oseq,unsigned int * seq,unsigned int * oseq_hi,unsigned int * seq_hi,unsigned int * replay_window,unsigned int * bmp_len,unsigned int * bmp)2210 int xfrmnl_sa_get_replay_state_esn (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
2211 unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
2212 {
2213 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2214 {
2215 if (sa->replay_state_esn)
2216 {
2217 *oseq = sa->replay_state_esn->oseq;
2218 *seq = sa->replay_state_esn->seq;
2219 *oseq_hi= sa->replay_state_esn->oseq_hi;
2220 *seq_hi = sa->replay_state_esn->seq_hi;
2221 *replay_window = sa->replay_state_esn->replay_window;
2222 *bmp_len = sa->replay_state_esn->bmp_len; // In number of 32 bit words
2223 memcpy (bmp, sa->replay_state_esn->bmp, sa->replay_state_esn->bmp_len * sizeof (uint32_t));
2224
2225 return 0;
2226 }
2227 else
2228 {
2229 return -1;
2230 }
2231 }
2232 else
2233 return -1;
2234 }
2235
xfrmnl_sa_set_replay_state_esn(struct xfrmnl_sa * sa,unsigned int oseq,unsigned int seq,unsigned int oseq_hi,unsigned int seq_hi,unsigned int replay_window,unsigned int bmp_len,unsigned int * bmp)2236 int xfrmnl_sa_set_replay_state_esn (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq,
2237 unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
2238 unsigned int bmp_len, unsigned int* bmp)
2239 {
2240 _nl_auto_free struct xfrmnl_replay_state_esn *b = NULL;
2241
2242 if (!(b = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * bmp_len))))
2243 return -1;
2244
2245 b->oseq = oseq;
2246 b->seq = seq;
2247 b->oseq_hi = oseq_hi;
2248 b->seq_hi = seq_hi;
2249 b->replay_window = replay_window;
2250 b->bmp_len = bmp_len; // In number of 32 bit words
2251 memcpy (b->bmp, bmp, bmp_len * sizeof (uint32_t));
2252
2253 free(sa->replay_state_esn);
2254 sa->replay_state_esn = _nl_steal_pointer(&b);
2255 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2256 return 0;
2257 }
2258
2259
2260 /**
2261 * Get interface id and flags from xfrm_user_offload.
2262 *
2263 * @arg sa The xfrmnl_sa object.
2264 * @arg ifindex An optional output value for the offload interface index.
2265 * @arg flags An optional output value for the offload flags.
2266 *
2267 * @return 0 on success or a negative error code.
2268 */
xfrmnl_sa_get_user_offload(struct xfrmnl_sa * sa,int * ifindex,uint8_t * flags)2269 int xfrmnl_sa_get_user_offload(struct xfrmnl_sa *sa, int *ifindex, uint8_t *flags)
2270 {
2271 int ret = -1;
2272
2273 if (sa->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV && sa->user_offload) {
2274 if (ifindex)
2275 *ifindex = sa->user_offload->ifindex;
2276 if (flags)
2277 *flags = sa->user_offload->flags;
2278 ret = 0;
2279 }
2280
2281 return ret;
2282 }
2283
2284
2285 /**
2286 * Set interface id and flags for xfrm_user_offload.
2287 *
2288 * @arg sa The xfrmnl_sa object.
2289 * @arg ifindex Id of the offload interface.
2290 * @arg flags Offload flags for the state.
2291 *
2292 * @return 0 on success or a negative error code.
2293 */
xfrmnl_sa_set_user_offload(struct xfrmnl_sa * sa,int ifindex,uint8_t flags)2294 int xfrmnl_sa_set_user_offload(struct xfrmnl_sa *sa, int ifindex, uint8_t flags)
2295 {
2296 _nl_auto_free struct xfrmnl_user_offload *b = NULL;
2297
2298 if (!(b = calloc(1, sizeof(*b))))
2299 return -1;
2300
2301 b->ifindex = ifindex;
2302 b->flags = flags;
2303
2304 free(sa->user_offload);
2305 sa->user_offload = _nl_steal_pointer(&b);
2306 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
2307
2308 return 0;
2309 }
2310
xfrmnl_sa_is_hardexpiry_reached(struct xfrmnl_sa * sa)2311 int xfrmnl_sa_is_hardexpiry_reached (struct xfrmnl_sa* sa)
2312 {
2313 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2314 return (sa->hard > 0 ? 1: 0);
2315 else
2316 return 0;
2317 }
2318
xfrmnl_sa_is_expiry_reached(struct xfrmnl_sa * sa)2319 int xfrmnl_sa_is_expiry_reached (struct xfrmnl_sa* sa)
2320 {
2321 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2322 return 1;
2323 else
2324 return 0;
2325 }
2326
2327 /** @} */
2328
2329 static struct nl_object_ops xfrm_sa_obj_ops = {
2330 .oo_name = "xfrm/sa",
2331 .oo_size = sizeof(struct xfrmnl_sa),
2332 .oo_constructor = xfrm_sa_alloc_data,
2333 .oo_free_data = xfrm_sa_free_data,
2334 .oo_clone = xfrm_sa_clone,
2335 .oo_dump = {
2336 [NL_DUMP_LINE] = xfrm_sa_dump_line,
2337 [NL_DUMP_DETAILS] = xfrm_sa_dump_details,
2338 [NL_DUMP_STATS] = xfrm_sa_dump_stats,
2339 },
2340 .oo_compare = xfrm_sa_compare,
2341 .oo_attrs2str = xfrm_sa_attrs2str,
2342 .oo_id_attrs = (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO),
2343 };
2344
2345 static struct nl_af_group xfrm_sa_groups[] = {
2346 { AF_UNSPEC, XFRMNLGRP_SA },
2347 { AF_UNSPEC, XFRMNLGRP_EXPIRE },
2348 { END_OF_GROUP_LIST },
2349 };
2350
2351 static struct nl_cache_ops xfrmnl_sa_ops = {
2352 .co_name = "xfrm/sa",
2353 .co_hdrsize = sizeof(struct xfrm_usersa_info),
2354 .co_msgtypes = {
2355 { XFRM_MSG_NEWSA, NL_ACT_NEW, "new" },
2356 { XFRM_MSG_DELSA, NL_ACT_DEL, "del" },
2357 { XFRM_MSG_GETSA, NL_ACT_GET, "get" },
2358 { XFRM_MSG_EXPIRE, NL_ACT_UNSPEC, "expire"},
2359 { XFRM_MSG_UPDSA, NL_ACT_NEW, "update"},
2360 END_OF_MSGTYPES_LIST,
2361 },
2362 .co_protocol = NETLINK_XFRM,
2363 .co_groups = xfrm_sa_groups,
2364 .co_request_update = xfrm_sa_request_update,
2365 .co_msg_parser = xfrm_sa_msg_parser,
2366 .co_obj_ops = &xfrm_sa_obj_ops,
2367 .co_include_event = &xfrm_sa_update_cache
2368 };
2369
2370 /**
2371 * @name XFRM SA Cache Managament
2372 * @{
2373 */
2374
xfrm_sa_init(void)2375 static void _nl_init xfrm_sa_init(void)
2376 {
2377 nl_cache_mngt_register(&xfrmnl_sa_ops);
2378 }
2379
xfrm_sa_exit(void)2380 static void _nl_exit xfrm_sa_exit(void)
2381 {
2382 nl_cache_mngt_unregister(&xfrmnl_sa_ops);
2383 }
2384
2385 /** @} */
2386