libnl 3.9.0
sp.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36/**
37 * @ingroup xfrmnl
38 * @defgroup sp Security Policy
39 * @brief
40 */
41
42#include "nl-default.h"
43
44#include <netlink/netlink.h>
45#include <netlink/cache.h>
46#include <netlink/object.h>
47#include <netlink/xfrm/selector.h>
48#include <netlink/xfrm/lifetime.h>
49#include <netlink/xfrm/template.h>
50#include <netlink/xfrm/sp.h>
51
52#include "nl-xfrm.h"
53#include "nl-priv-dynamic-core/object-api.h"
54#include "nl-priv-dynamic-core/nl-core.h"
55#include "nl-priv-dynamic-core/cache-api.h"
56#include "nl-aux-core/nl-core.h"
57#include "nl-aux-xfrm/nl-xfrm.h"
58
60 uint8_t type;
61 uint16_t reserved1;
62 uint16_t reserved2;
63};
64
65struct xfrmnl_sp {
66 NLHDR_COMMON
67
68 struct xfrmnl_sel* sel;
69 struct xfrmnl_ltime_cfg* lft;
70 struct xfrmnl_lifetime_cur curlft;
71 uint32_t priority;
72 uint32_t index;
73 uint8_t dir;
74 uint8_t action;
75 uint8_t flags;
76 uint8_t share;
77 struct xfrmnl_user_sec_ctx* sec_ctx;
78 struct xfrmnl_userpolicy_type uptype;
79 uint32_t nr_user_tmpl;
80 struct nl_list_head usertmpl_list;
81 struct xfrmnl_mark mark;
82};
83
84/** @cond SKIP */
85#define XFRM_SP_ATTR_SEL 0x01
86#define XFRM_SP_ATTR_LTIME_CFG 0x02
87#define XFRM_SP_ATTR_LTIME_CUR 0x04
88#define XFRM_SP_ATTR_PRIO 0x08
89#define XFRM_SP_ATTR_INDEX 0x10
90#define XFRM_SP_ATTR_DIR 0x20
91#define XFRM_SP_ATTR_ACTION 0x40
92#define XFRM_SP_ATTR_FLAGS 0x80
93#define XFRM_SP_ATTR_SHARE 0x100
94#define XFRM_SP_ATTR_POLTYPE 0x200
95#define XFRM_SP_ATTR_SECCTX 0x400
96#define XFRM_SP_ATTR_TMPL 0x800
97#define XFRM_SP_ATTR_MARK 0x1000
98
99static struct nl_cache_ops xfrmnl_sp_ops;
100static struct nl_object_ops xfrm_sp_obj_ops;
101/** @endcond */
102
103static void xfrm_sp_alloc_data(struct nl_object *c)
104{
105 struct xfrmnl_sp* sp = nl_object_priv (c);
106
107 if ((sp->sel = xfrmnl_sel_alloc ()) == NULL)
108 return;
109
110 if ((sp->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
111 return;
112
113 nl_init_list_head(&sp->usertmpl_list);
114
115 return;
116}
117
118static void xfrm_sp_free_data(struct nl_object *c)
119{
120 struct xfrmnl_sp* sp = nl_object_priv (c);
121 struct xfrmnl_user_tmpl *utmpl, *tmp;
122
123 if (sp == NULL)
124 return;
125
126 xfrmnl_sel_put (sp->sel);
127 xfrmnl_ltime_cfg_put (sp->lft);
128
129 if (sp->sec_ctx) {
130 free(sp->sec_ctx);
131 }
132
133 nl_list_for_each_entry_safe(utmpl, tmp, &sp->usertmpl_list, utmpl_list) {
134 xfrmnl_sp_remove_usertemplate (sp, utmpl);
135 xfrmnl_user_tmpl_free (utmpl);
136 }
137}
138
139static int xfrm_sp_clone(struct nl_object *_dst, struct nl_object *_src)
140{
141 struct xfrmnl_sp* dst = nl_object_priv(_dst);
142 struct xfrmnl_sp* src = nl_object_priv(_src);
143 struct xfrmnl_user_tmpl *utmpl;
144 struct xfrmnl_user_tmpl *new;
145
146 dst->sel = NULL;
147 dst->lft = NULL;
148 dst->sec_ctx = NULL;
149 nl_init_list_head(&dst->usertmpl_list);
150
151 if (src->sel) {
152 if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
153 return -NLE_NOMEM;
154 }
155
156 if (src->lft) {
157 if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
158 return -NLE_NOMEM;
159 }
160
161 if (src->sec_ctx) {
162 uint32_t len = sizeof (struct xfrmnl_user_sec_ctx) + src->sec_ctx->ctx_len;
163
164 if ((dst->sec_ctx = malloc (len)) == NULL)
165 return -NLE_NOMEM;
166 memcpy(dst->sec_ctx, src->sec_ctx, len);
167 }
168
169 nl_list_for_each_entry(utmpl, &src->usertmpl_list, utmpl_list) {
170 new = xfrmnl_user_tmpl_clone (utmpl);
171 if (!new)
172 return -NLE_NOMEM;
173 xfrmnl_sp_add_usertemplate(dst, new);
174 }
175
176 return 0;
177}
178
179static uint64_t xfrm_sp_compare(struct nl_object *_a, struct nl_object *_b,
180 uint64_t attrs, int flags)
181{
182 struct xfrmnl_sp* a = (struct xfrmnl_sp *) _a;
183 struct xfrmnl_sp* b = (struct xfrmnl_sp *) _b;
184 struct xfrmnl_user_tmpl *tmpl_a, *tmpl_b;
185 uint64_t diff = 0;
186
187#define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
188 diff |= _DIFF(XFRM_SP_ATTR_SEL, xfrmnl_sel_cmp(a->sel, b->sel));
189 diff |= _DIFF(XFRM_SP_ATTR_LTIME_CFG,
190 xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
191 diff |= _DIFF(XFRM_SP_ATTR_PRIO, a->priority != b->priority);
192 diff |= _DIFF(XFRM_SP_ATTR_INDEX, a->index != b->index);
193 diff |= _DIFF(XFRM_SP_ATTR_DIR, a->dir != b->dir);
194 diff |= _DIFF(XFRM_SP_ATTR_ACTION, a->action != b->action);
195 diff |= _DIFF(XFRM_SP_ATTR_FLAGS, a->flags != b->flags);
196 diff |= _DIFF(XFRM_SP_ATTR_SHARE, a->share != b->share);
197 diff |= _DIFF(XFRM_SP_ATTR_SECCTX,
198 ((a->sec_ctx->len != b->sec_ctx->len) ||
199 (a->sec_ctx->exttype != b->sec_ctx->exttype) ||
200 (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
201 (a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
202 (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
203 strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
204 diff |= _DIFF(XFRM_SP_ATTR_POLTYPE, (a->uptype.type != b->uptype.type));
205 diff |= _DIFF(XFRM_SP_ATTR_TMPL, (a->nr_user_tmpl != b->nr_user_tmpl));
206 diff |= _DIFF(XFRM_SP_ATTR_MARK,
207 (a->mark.m != b->mark.m) || (a->mark.v != b->mark.v));
208
209 /* Compare the templates */
210 nl_list_for_each_entry(tmpl_b, &b->usertmpl_list, utmpl_list)
211 nl_list_for_each_entry(tmpl_a, &a->usertmpl_list, utmpl_list)
212 diff |= xfrmnl_user_tmpl_cmp (tmpl_a, tmpl_b);
213#undef _DIFF
214
215 return diff;
216}
217
218/**
219 * @name XFRM SP Attribute Translations
220 * @{
221 */
222static const struct trans_tbl sp_attrs[] = {
223 __ADD(XFRM_SP_ATTR_SEL, selector),
224 __ADD(XFRM_SP_ATTR_LTIME_CFG, lifetime_cfg),
225 __ADD(XFRM_SP_ATTR_LTIME_CUR, lifetime_cur),
226 __ADD(XFRM_SP_ATTR_PRIO, priority),
227 __ADD(XFRM_SP_ATTR_INDEX, index),
228 __ADD(XFRM_SP_ATTR_DIR, direction),
229 __ADD(XFRM_SP_ATTR_ACTION, action),
230 __ADD(XFRM_SP_ATTR_FLAGS, flags),
231 __ADD(XFRM_SP_ATTR_SHARE, share),
232 __ADD(XFRM_SP_ATTR_POLTYPE, policy_type),
233 __ADD(XFRM_SP_ATTR_SECCTX, security_context),
234 __ADD(XFRM_SP_ATTR_TMPL, user_template),
235 __ADD(XFRM_SP_ATTR_MARK, mark),
236};
237
238static char* xfrm_sp_attrs2str(int attrs, char *buf, size_t len)
239{
240 return __flags2str (attrs, buf, len, sp_attrs, ARRAY_SIZE(sp_attrs));
241}
242/** @} */
243
244/**
245 * @name XFRM SP Action Translations
246 * @{
247 */
248static const struct trans_tbl sa_actions[] = {
249 __ADD(XFRM_POLICY_ALLOW, allow),
250 __ADD(XFRM_POLICY_BLOCK, block),
251};
252
253char* xfrmnl_sp_action2str(int action, char *buf, size_t len)
254{
255 return __type2str (action, buf, len, sa_actions, ARRAY_SIZE(sa_actions));
256}
257
258int xfrmnl_sp_str2action(const char *name)
259{
260 return __str2type (name, sa_actions, ARRAY_SIZE(sa_actions));
261}
262/** @} */
263
264/**
265 * @name XFRM SP Flags Translations
266 * @{
267 */
268static const struct trans_tbl sp_flags[] = {
269 __ADD(XFRM_POLICY_LOCALOK, allow policy override by user),
270 __ADD(XFRM_POLICY_ICMP, auto include ICMP in policy),
271};
272
273char* xfrmnl_sp_flags2str(int flags, char *buf, size_t len)
274{
275 return __flags2str (flags, buf, len, sp_flags, ARRAY_SIZE(sp_flags));
276}
277
278int xfrmnl_sp_str2flag(const char *name)
279{
280 return __str2flags(name, sp_flags, ARRAY_SIZE(sp_flags));
281}
282/** @} */
283
284/**
285 * @name XFRM SP Type Translations
286 * @{
287 */
288static const struct trans_tbl sp_types[] = {
289 __ADD(XFRM_POLICY_TYPE_MAIN, main),
290 __ADD(XFRM_POLICY_TYPE_SUB, sub),
291 __ADD(XFRM_POLICY_TYPE_MAX, max),
292 __ADD(XFRM_POLICY_TYPE_ANY, any),
293};
294
295char* xfrmnl_sp_type2str(int type, char *buf, size_t len)
296{
297 return __type2str(type, buf, len, sp_types, ARRAY_SIZE(sp_types));
298}
299
300int xfrmnl_sp_str2type(const char *name)
301{
302 return __str2type(name, sp_types, ARRAY_SIZE(sp_types));
303}
304/** @} */
305
306/**
307 * @name XFRM SP Direction Translations
308 * @{
309 */
310static const struct trans_tbl sp_dir[] = {
311 __ADD(XFRM_POLICY_IN, in),
312 __ADD(XFRM_POLICY_OUT, out),
313 __ADD(XFRM_POLICY_FWD, fwd),
314 __ADD(XFRM_POLICY_MASK, mask),
315};
316
317char* xfrmnl_sp_dir2str(int dir, char *buf, size_t len)
318{
319 return __type2str (dir, buf, len, sp_dir, ARRAY_SIZE(sp_dir));
320}
321
322int xfrmnl_sp_str2dir(const char *name)
323{
324 return __str2type (name, sp_dir, ARRAY_SIZE(sp_dir));
325}
326
327int xfrmnl_sp_index2dir (unsigned int index)
328{
329 return index & 0x7;
330}
331/** @} */
332
333/**
334 * @name XFRM SP Share Translations
335 * @{
336 */
337static const struct trans_tbl sp_share[] = {
338 __ADD(XFRM_SHARE_ANY, any),
339 __ADD(XFRM_SHARE_SESSION, session),
340 __ADD(XFRM_SHARE_USER, user),
341 __ADD(XFRM_SHARE_UNIQUE, unique),
342};
343
344char* xfrmnl_sp_share2str(int share, char *buf, size_t len)
345{
346 return __type2str (share, buf, len, sp_share, ARRAY_SIZE(sp_share));
347}
348
349int xfrmnl_sp_str2share(const char *name)
350{
351 return __str2type (name, sp_share, ARRAY_SIZE(sp_share));
352}
353/** @} */
354
355static void xfrm_sp_dump_line(struct nl_object *a, struct nl_dump_params *p)
356{
357 struct xfrmnl_sp* sp = (struct xfrmnl_sp *) a;
358 char dir[32], action[32], share[32], flags[32];
359 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
360 time_t add_time, use_time;
361 struct tm *add_time_tm, *use_time_tm;
362 struct tm tm_buf;
363
364 nl_addr2str(xfrmnl_sel_get_saddr (sp->sel), src, sizeof(src));
365 nl_addr2str (xfrmnl_sel_get_daddr (sp->sel), dst, sizeof (dst));
366 nl_af2str (xfrmnl_sel_get_family (sp->sel), dir, 32);
367 nl_dump_line(p, "src %s dst %s family: %s\n", src, dst, dir);
368 nl_dump_line (p, "src port/mask: %d/%d dst port/mask: %d/%d\n",
369 xfrmnl_sel_get_dport (sp->sel), xfrmnl_sel_get_dportmask (sp->sel),
370 xfrmnl_sel_get_sport (sp->sel), xfrmnl_sel_get_sportmask (sp->sel));
371 nl_dump_line (p, "protocol: %s ifindex: %u uid: %u\n",
372 nl_ip_proto2str (xfrmnl_sel_get_proto (sp->sel), dir, sizeof(dir)),
373 xfrmnl_sel_get_ifindex (sp->sel),
374 xfrmnl_sel_get_userid (sp->sel));
375
376 xfrmnl_sp_dir2str (sp->dir, dir, 32);
377 xfrmnl_sp_action2str (sp->action, action, 32);
378 xfrmnl_sp_share2str (sp->share, share, 32);
379 xfrmnl_sp_flags2str (sp->flags, flags, 32);
380 nl_dump_line(p, "\tdir: %s action: %s index: %u priority: %u share: %s flags: %s(0x%x) \n",
381 dir, action, sp->index, sp->priority, share, flags, sp->flags);
382
383 nl_dump_line(p, "\tlifetime configuration: \n");
384 if (sp->lft->soft_byte_limit == XFRM_INF)
385 sprintf (dir, "INF");
386 else
387 sprintf (dir, "%" PRIu64, sp->lft->soft_byte_limit);
388 if (sp->lft->soft_packet_limit == XFRM_INF)
389 sprintf (action, "INF");
390 else
391 sprintf (action, "%" PRIu64, sp->lft->soft_packet_limit);
392 if (sp->lft->hard_byte_limit == XFRM_INF)
393 sprintf (flags, "INF");
394 else
395 sprintf (flags, "%" PRIu64, sp->lft->hard_byte_limit);
396 if (sp->lft->hard_packet_limit == XFRM_INF)
397 sprintf (share, "INF");
398 else
399 sprintf (share, "%" PRIu64, sp->lft->hard_packet_limit);
400 nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets) \n", dir,
401 action);
402 nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets) \n", flags,
403 share);
404 nl_dump_line(
405 p,
406 "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
407 (long long unsigned)sp->lft->soft_add_expires_seconds,
408 (long long unsigned)sp->lft->soft_use_expires_seconds);
409 nl_dump_line(
410 p,
411 "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
412 (long long unsigned)sp->lft->hard_add_expires_seconds,
413 (long long unsigned)sp->lft->hard_use_expires_seconds);
414
415 nl_dump_line(p, "\tlifetime current: \n");
416 nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
417 (long long unsigned)sp->curlft.bytes,
418 (long long unsigned)sp->curlft.packets);
419
420 if (sp->curlft.add_time != 0)
421 {
422 add_time = sp->curlft.add_time;
423 add_time_tm = gmtime_r (&add_time, &tm_buf);
424 strftime (dst, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", add_time_tm);
425 }
426 else
427 {
428 sprintf (dst, "%s", "-");
429 }
430
431 if (sp->curlft.use_time != 0)
432 {
433 use_time = sp->curlft.use_time;
434 use_time_tm = gmtime_r (&use_time, &tm_buf);
435 strftime (src, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", use_time_tm);
436 }
437 else
438 {
439 sprintf (src, "%s", "-");
440 }
441 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", dst, src);
442
443 if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
444 {
445 nl_dump_line(p, "\tUser security context: \n");
446 nl_dump_line(p, "\t\tlen: %d exttype: %d Algo: %d DOI: %d ctxlen: %d\n",
447 sp->sec_ctx->len, sp->sec_ctx->exttype,
448 sp->sec_ctx->ctx_alg, sp->sec_ctx->ctx_doi, sp->sec_ctx->ctx_len);
449 nl_dump_line (p, "\t\tctx: %s \n", sp->sec_ctx->ctx);
450 }
451
452 xfrmnl_sp_type2str (sp->uptype.type, flags, 32);
453 if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
454 nl_dump_line(p, "\tUser policy type: %s\n", flags);
455
456 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
457 {
458 struct xfrmnl_user_tmpl* utmpl;
459
460 nl_dump_line(p, "\tUser template: \n");
461
462 nl_list_for_each_entry(utmpl, &sp->usertmpl_list, utmpl_list)
463 xfrmnl_user_tmpl_dump (utmpl, p);
464 }
465
466 if (sp->ce_mask & XFRM_SP_ATTR_MARK)
467 nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sp->mark.m, sp->mark.v);
468
469 nl_dump(p, "\n");
470}
471
472static void xfrm_sp_dump_details(struct nl_object *a, struct nl_dump_params *p)
473{
474 xfrm_sp_dump_line(a, p);
475}
476
477static void xfrm_sp_dump_stats(struct nl_object *a, struct nl_dump_params *p)
478{
479 xfrm_sp_dump_details(a, p);
480
481 return;
482}
483
484/**
485 * @name XFRM SP Object Allocation/Freeage
486 * @{
487 */
488
489struct xfrmnl_sp* xfrmnl_sp_alloc(void)
490{
491 return (struct xfrmnl_sp*) nl_object_alloc(&xfrm_sp_obj_ops);
492}
493
494void xfrmnl_sp_put(struct xfrmnl_sp* sp)
495{
496 nl_object_put((struct nl_object *) sp);
497}
498
499/** @} */
500
501/**
502 * @name SP Cache Managament
503 * @{
504 */
505
506/**
507 * Build a SP cache including all SPs currently configured in the kernel.
508 * @arg sock Netlink socket.
509 * @arg result Pointer to store resulting cache.
510 *
511 * Allocates a new SP cache, initializes it properly and updates it
512 * to include all SPs currently configured in the kernel.
513 *
514 * @return 0 on success or a negative error code.
515 */
516int xfrmnl_sp_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
517{
518 return nl_cache_alloc_and_fill(&xfrmnl_sp_ops, sock, result);
519}
520
521/**
522 * Look up a SP by policy id and direction
523 * @arg cache SP cache
524 * @arg index Policy Id
525 * @arg dir direction
526 * @return sp handle or NULL if no match was found.
527 */
528struct xfrmnl_sp* xfrmnl_sp_get(struct nl_cache* cache, unsigned int index, unsigned int dir)
529{
530 struct xfrmnl_sp *sp;
531
532 //nl_list_for_each_entry(sp, &cache->c_items, ce_list) {
533 for (sp = (struct xfrmnl_sp*)nl_cache_get_first (cache);
534 sp != NULL;
535 sp = (struct xfrmnl_sp*)nl_cache_get_next ((struct nl_object*)sp))
536 {
537 if (sp->index == index && sp->dir == dir)
538 {
539 nl_object_get((struct nl_object *) sp);
540 return sp;
541 }
542 }
543
544 return NULL;
545}
546
547
548/** @} */
549
550
551static struct nla_policy xfrm_sp_policy[XFRMA_MAX+1] = {
552 [XFRMA_POLICY] = { .minlen = sizeof(struct xfrm_userpolicy_info)},
553 [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
554 [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
555 [XFRMA_POLICY_TYPE] = { .minlen = sizeof(struct xfrm_userpolicy_type)},
556 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
557};
558
559static int xfrm_sp_request_update(struct nl_cache *c, struct nl_sock *h)
560{
561 return nl_send_simple (h, XFRM_MSG_GETPOLICY, NLM_F_DUMP, NULL, 0);
562}
563
564int xfrmnl_sp_parse(struct nlmsghdr *n, struct xfrmnl_sp **result)
565{
566 _nl_auto_nl_addr struct nl_addr *addr1 = NULL;
567 _nl_auto_nl_addr struct nl_addr *addr2 = NULL;
568 _nl_auto_xfrmnl_sp struct xfrmnl_sp *sp = NULL;
569 struct nlattr *tb[XFRMA_MAX + 1];
570 struct xfrm_userpolicy_info *sp_info;
571 int len, err;
572
573 sp = xfrmnl_sp_alloc();
574 if (!sp)
575 return -NLE_NOMEM;
576
577 sp->ce_msgtype = n->nlmsg_type;
578 if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
579 sp_info = (struct xfrm_userpolicy_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_userpolicy_id) + NLA_HDRLEN);
580 else
581 sp_info = nlmsg_data(n);
582
583 err = nlmsg_parse(n, sizeof(struct xfrm_userpolicy_info), tb, XFRMA_MAX, xfrm_sp_policy);
584 if (err < 0)
585 return err;
586
587 if (!(addr1 = _nl_addr_build(sp_info->sel.family, &sp_info->sel.daddr)))
588 return -NLE_NOMEM;
589 nl_addr_set_prefixlen (addr1, sp_info->sel.prefixlen_d);
590 xfrmnl_sel_set_daddr (sp->sel, addr1);
591 xfrmnl_sel_set_prefixlen_d (sp->sel, sp_info->sel.prefixlen_d);
592
593 if (!(addr2 = _nl_addr_build(sp_info->sel.family, &sp_info->sel.saddr)))
594 return -NLE_NOMEM;
595 nl_addr_set_prefixlen (addr2, sp_info->sel.prefixlen_s);
596 xfrmnl_sel_set_saddr (sp->sel, addr2);
597 xfrmnl_sel_set_prefixlen_s (sp->sel, sp_info->sel.prefixlen_s);
598
599 xfrmnl_sel_set_dport (sp->sel, ntohs (sp_info->sel.dport));
600 xfrmnl_sel_set_dportmask (sp->sel, ntohs (sp_info->sel.dport_mask));
601 xfrmnl_sel_set_sport (sp->sel, ntohs (sp_info->sel.sport));
602 xfrmnl_sel_set_sportmask (sp->sel, ntohs (sp_info->sel.sport_mask));
603 xfrmnl_sel_set_family (sp->sel, sp_info->sel.family);
604 xfrmnl_sel_set_proto (sp->sel, sp_info->sel.proto);
605 xfrmnl_sel_set_ifindex (sp->sel, sp_info->sel.ifindex);
606 xfrmnl_sel_set_userid (sp->sel, sp_info->sel.user);
607 sp->ce_mask |= XFRM_SP_ATTR_SEL;
608
609 sp->lft->soft_byte_limit = sp_info->lft.soft_byte_limit;
610 sp->lft->hard_byte_limit = sp_info->lft.hard_byte_limit;
611 sp->lft->soft_packet_limit = sp_info->lft.soft_packet_limit;
612 sp->lft->hard_packet_limit = sp_info->lft.hard_packet_limit;
613 sp->lft->soft_add_expires_seconds = sp_info->lft.soft_add_expires_seconds;
614 sp->lft->hard_add_expires_seconds = sp_info->lft.hard_add_expires_seconds;
615 sp->lft->soft_use_expires_seconds = sp_info->lft.soft_use_expires_seconds;
616 sp->lft->hard_use_expires_seconds = sp_info->lft.hard_use_expires_seconds;
617 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
618
619 sp->curlft.bytes = sp_info->curlft.bytes;
620 sp->curlft.packets = sp_info->curlft.packets;
621 sp->curlft.add_time = sp_info->curlft.add_time;
622 sp->curlft.use_time = sp_info->curlft.use_time;
623 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CUR;
624
625 sp->priority = sp_info->priority;
626 sp->index = sp_info->index;
627 sp->dir = sp_info->dir;
628 sp->action = sp_info->action;
629 sp->flags = sp_info->flags;
630 sp->share = sp_info->share;
631 sp->ce_mask |= (XFRM_SP_ATTR_PRIO | XFRM_SP_ATTR_INDEX |
632 XFRM_SP_ATTR_DIR | XFRM_SP_ATTR_ACTION |
633 XFRM_SP_ATTR_FLAGS | XFRM_SP_ATTR_SHARE);
634
635 if (tb[XFRMA_SEC_CTX]) {
636 struct xfrm_user_sec_ctx* ctx = nla_data(tb[XFRMA_SEC_CTX]);
637
638 len = sizeof (struct xfrmnl_user_sec_ctx) + ctx->ctx_len;
639 if ((sp->sec_ctx = calloc (1, len)) == NULL)
640 return -NLE_NOMEM;
641 memcpy ((void *)sp->sec_ctx, (void *)ctx, len);
642 sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
643 }
644
645 if (tb[XFRMA_POLICY_TYPE]) {
646 struct xfrm_userpolicy_type* up = nla_data(tb[XFRMA_POLICY_TYPE]);
647
648 memcpy ((void *)&sp->uptype, (void *)up, sizeof (struct xfrm_userpolicy_type));
649 sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
650 }
651
652 if (tb[XFRMA_TMPL]) {
653 struct xfrm_user_tmpl* tmpl = nla_data(tb[XFRMA_TMPL]);
654 uint32_t i;
655 uint32_t num_tmpls = nla_len(tb[XFRMA_TMPL]) / sizeof (*tmpl);
656
657 for (i = 0; (i < num_tmpls) && (tmpl); i ++, tmpl++)
658 {
659 _nl_auto_xfrmnl_user_tmpl struct xfrmnl_user_tmpl *sputmpl = NULL;
660 _nl_auto_nl_addr struct nl_addr *addr1 = NULL;
661 _nl_auto_nl_addr struct nl_addr *addr2 = NULL;
662
663 if ((sputmpl = xfrmnl_user_tmpl_alloc ()) == NULL)
664 return -NLE_NOMEM;
665
666 if (!(addr1 = _nl_addr_build(tmpl->family, &tmpl->id.daddr)))
667 return -NLE_NOMEM;
668 xfrmnl_user_tmpl_set_daddr (sputmpl, addr1);
669 xfrmnl_user_tmpl_set_spi (sputmpl, ntohl(tmpl->id.spi));
670 xfrmnl_user_tmpl_set_proto (sputmpl, tmpl->id.proto);
671 xfrmnl_user_tmpl_set_family (sputmpl, tmpl->family);
672
673 if (!(addr2 = _nl_addr_build(tmpl->family, &tmpl->saddr)))
674 return -NLE_NOMEM;
675 xfrmnl_user_tmpl_set_saddr (sputmpl, addr2);
676
677 xfrmnl_user_tmpl_set_reqid (sputmpl, tmpl->reqid);
678 xfrmnl_user_tmpl_set_mode (sputmpl, tmpl->mode);
679 xfrmnl_user_tmpl_set_share (sputmpl, tmpl->share);
680 xfrmnl_user_tmpl_set_optional (sputmpl, tmpl->optional);
681 xfrmnl_user_tmpl_set_aalgos (sputmpl, tmpl->aalgos);
682 xfrmnl_user_tmpl_set_ealgos (sputmpl, tmpl->ealgos);
683 xfrmnl_user_tmpl_set_calgos (sputmpl, tmpl->calgos);
684 xfrmnl_sp_add_usertemplate (sp, _nl_steal_pointer(&sputmpl));
685
686 sp->ce_mask |= XFRM_SP_ATTR_TMPL;
687 }
688 }
689
690 if (tb[XFRMA_MARK]) {
691 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
692 sp->mark.m = m->m;
693 sp->mark.v = m->v;
694 sp->ce_mask |= XFRM_SP_ATTR_MARK;
695 }
696
697 *result = _nl_steal_pointer(&sp);
698 return 0;
699}
700
701static int xfrm_sp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
702 struct nlmsghdr *n, struct nl_parser_param *pp)
703{
704 struct xfrmnl_sp* sp;
705 int err;
706
707 if ((err = xfrmnl_sp_parse(n, &sp)) < 0)
708 {
709 printf ("received error: %d \n", err);
710 return err;
711 }
712
713 err = pp->pp_cb((struct nl_object *) sp, pp);
714
715 xfrmnl_sp_put(sp);
716 return err;
717}
718
719/**
720 * @name XFRM SP Get
721 * @{
722 */
723
724int xfrmnl_sp_build_get_request(unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
725{
726 struct nl_msg *msg;
727 struct xfrm_userpolicy_id spid;
728 struct xfrm_mark mark;
729
730 memset(&spid, 0, sizeof(spid));
731 spid.index = index;
732 spid.dir = dir;
733
734 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETPOLICY, 0)))
735 return -NLE_NOMEM;
736
737 if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
738 goto nla_put_failure;
739
740 if ((mark_m & mark_v) != 0)
741 {
742 memset(&mark, 0, sizeof(struct xfrm_mark));
743 mark.m = mark_m;
744 mark.v = mark_v;
745
746 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
747 }
748
749 *result = msg;
750 return 0;
751
752nla_put_failure:
753 nlmsg_free(msg);
754 return -NLE_MSGSIZE;
755}
756
757int xfrmnl_sp_get_kernel(struct nl_sock* sock, unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sp** result)
758{
759 struct nl_msg *msg = NULL;
760 struct nl_object *obj;
761 int err;
762
763 if ((err = xfrmnl_sp_build_get_request(index, dir, mark_m, mark_v, &msg)) < 0)
764 return err;
765
766 err = nl_send_auto(sock, msg);
767 nlmsg_free(msg);
768 if (err < 0)
769 return err;
770
771 if ((err = nl_pickup(sock, &xfrm_sp_msg_parser, &obj)) < 0)
772 return err;
773
774 /* We have used xfrm_sp_msg_parser(), object is definitely a xfrm ae */
775 *result = (struct xfrmnl_sp *) obj;
776
777 /* If an object has been returned, we also need to wait for the ACK */
778 if (err == 0 && obj)
779 nl_wait_for_ack(sock);
780
781 return 0;
782}
783
784/** @} */
785
786static int build_xfrm_sp_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
787{
788 struct nl_msg* msg;
789 struct xfrm_userpolicy_info sp_info;
790 uint32_t len;
791 struct nl_addr* addr;
792
793 if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
794 (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
795 !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
796 return -NLE_MISSING_ATTR;
797
798 memset ((void*)&sp_info, 0, sizeof (sp_info));
799 if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
800 {
801 addr = xfrmnl_sel_get_daddr (tmpl->sel);
802 memcpy ((void*)&sp_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
803 addr = xfrmnl_sel_get_saddr (tmpl->sel);
804 memcpy ((void*)&sp_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
805 sp_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
806 sp_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
807 sp_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
808 sp_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
809 sp_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
810 sp_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
811 sp_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
812 sp_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
813 sp_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
814 sp_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
815 }
816
817 if (tmpl->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
818 {
819 sp_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
820 sp_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
821 sp_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
822 sp_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
823 sp_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
824 sp_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
825 sp_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
826 sp_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
827 }
828
829 //Skip current lifetime: cur lifetime can be updated only via AE
830
831 if (tmpl->ce_mask & XFRM_SP_ATTR_PRIO)
832 sp_info.priority = tmpl->priority;
833
834 if (tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
835 sp_info.index = tmpl->index;
836
837 if (tmpl->ce_mask & XFRM_SP_ATTR_DIR)
838 sp_info.dir = tmpl->dir;
839
840 if (tmpl->ce_mask & XFRM_SP_ATTR_ACTION)
841 sp_info.action = tmpl->action;
842
843 if (tmpl->ce_mask & XFRM_SP_ATTR_FLAGS)
844 sp_info.flags = tmpl->flags;
845
846 if (tmpl->ce_mask & XFRM_SP_ATTR_SHARE)
847 sp_info.share = tmpl->share;
848
849 msg = nlmsg_alloc_simple(cmd, flags);
850 if (!msg)
851 return -NLE_NOMEM;
852
853 if (nlmsg_append(msg, &sp_info, sizeof(sp_info), NLMSG_ALIGNTO) < 0)
854 goto nla_put_failure;
855
856 if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
857 len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
858 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
859 }
860
861 if (tmpl->ce_mask & XFRM_SP_ATTR_POLTYPE) {
862 len = sizeof (struct xfrm_userpolicy_type);
863 NLA_PUT (msg, XFRMA_POLICY_TYPE, len, &tmpl->uptype);
864 }
865
866 if (tmpl->ce_mask & XFRM_SP_ATTR_TMPL) {
867 struct nlattr* tmpls;
868 struct xfrmnl_user_tmpl* utmpl;
869 struct nl_addr* addr;
870
871 if (!(tmpls = nla_nest_start(msg, XFRMA_TMPL)))
872 goto nla_put_failure;
873
874 nl_list_for_each_entry(utmpl, &tmpl->usertmpl_list, utmpl_list) {
875 struct xfrm_user_tmpl* tmpl;
876
877 tmpl = nlmsg_reserve(msg, sizeof(*tmpl), NLMSG_ALIGNTO);
878 if (!tmpl)
879 goto nla_put_failure;
880 addr = xfrmnl_user_tmpl_get_daddr (utmpl);
881 memcpy ((void *)&tmpl->id.daddr, nl_addr_get_binary_addr (addr),
882 nl_addr_get_len (addr));
883 tmpl->id.spi = htonl(xfrmnl_user_tmpl_get_spi (utmpl));
884 tmpl->id.proto = xfrmnl_user_tmpl_get_proto (utmpl);
885 tmpl->family = xfrmnl_user_tmpl_get_family (utmpl);
886 addr = xfrmnl_user_tmpl_get_saddr (utmpl);
887 memcpy ((void *)&tmpl->saddr, nl_addr_get_binary_addr (addr),
888 nl_addr_get_len (addr));
889 tmpl->reqid = xfrmnl_user_tmpl_get_reqid (utmpl);
890 tmpl->mode = xfrmnl_user_tmpl_get_mode (utmpl);
891 tmpl->share = xfrmnl_user_tmpl_get_share (utmpl);
892 tmpl->optional = xfrmnl_user_tmpl_get_optional (utmpl);
893 tmpl->aalgos = xfrmnl_user_tmpl_get_aalgos (utmpl);
894 tmpl->ealgos = xfrmnl_user_tmpl_get_ealgos (utmpl);
895 tmpl->calgos = xfrmnl_user_tmpl_get_calgos (utmpl);
896 }
897 nla_nest_end(msg, tmpls);
898 }
899
900 if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
901 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
902 }
903
904 *result = msg;
905 return 0;
906
907nla_put_failure:
908 nlmsg_free(msg);
909 return -NLE_MSGSIZE;
910}
911
912/**
913 * @name XFRM SP Add
914 * @{
915 */
916
917int xfrmnl_sp_build_add_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
918{
919 return build_xfrm_sp_message (tmpl, XFRM_MSG_NEWPOLICY, flags, result);
920}
921
922int xfrmnl_sp_add(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
923{
924 int err;
925 struct nl_msg *msg;
926
927 if ((err = xfrmnl_sp_build_add_request(tmpl, flags, &msg)) < 0)
928 return err;
929
930 err = nl_send_auto_complete(sk, msg);
931 nlmsg_free(msg);
932 if (err < 0)
933 return err;
934
935 return nl_wait_for_ack(sk);
936}
937
938/**
939 * @name XFRM SP Update
940 * @{
941 */
942
943int xfrmnl_sp_build_update_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
944{
945 return build_xfrm_sp_message (tmpl, XFRM_MSG_UPDPOLICY, flags, result);
946}
947
948int xfrmnl_sp_update(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
949{
950 int err;
951 struct nl_msg *msg;
952
953 if ((err = xfrmnl_sp_build_update_request(tmpl, flags, &msg)) < 0)
954 return err;
955
956 err = nl_send_auto_complete(sk, msg);
957 nlmsg_free(msg);
958 if (err < 0)
959 return err;
960
961 return nl_wait_for_ack(sk);
962}
963
964/** @} */
965
966/**
967 * \brief Builds a xfrm_sp_delete_message. Uses either index and direction
968 * or security-context (not set is a valid value), selector and
969 * direction for identification.
970 * Returns error if necessary values aren't set.
971 *
972 * \param tmpl The policy template.
973 * \param cmd The command. Should be XFRM_MSG_DELPOLICY.
974 * \param flags Additional flags
975 * \param result Resulting message.
976 *
977 * \return 0 if successful, else error value < 0
978 */
979static int build_xfrm_sp_delete_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
980{
981 struct nl_msg* msg;
982 struct xfrm_userpolicy_id spid;
983 struct nl_addr* addr;
984 uint32_t len;
985
986 if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
987 (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
988 !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
989 return -NLE_MISSING_ATTR;
990
991 memset(&spid, 0, sizeof(spid));
992 spid.dir = tmpl->dir;
993 if(tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
994 spid.index = tmpl->index;
995
996 if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
997 {
998 addr = xfrmnl_sel_get_daddr (tmpl->sel);
999 memcpy ((void*)&spid.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1000 addr = xfrmnl_sel_get_saddr (tmpl->sel);
1001 memcpy ((void*)&spid.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1002 spid.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1003 spid.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1004 spid.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1005 spid.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1006 spid.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1007 spid.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1008 spid.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1009 spid.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1010 spid.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1011 spid.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1012 }
1013
1014 msg = nlmsg_alloc_simple(cmd, flags);
1015 if (!msg)
1016 return -NLE_NOMEM;
1017
1018 if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
1019 goto nla_put_failure;
1020
1021 if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
1022 len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
1023 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1024 }
1025
1026 if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
1027 len = sizeof (struct xfrm_mark);
1028 NLA_PUT (msg, XFRMA_MARK, len, &tmpl->mark);
1029 }
1030
1031 *result = msg;
1032 return 0;
1033
1034nla_put_failure:
1035 nlmsg_free(msg);
1036 return -NLE_MSGSIZE;
1037}
1038
1039/**
1040 * @name XFRM SA Delete
1041 * @{
1042 */
1043
1044int xfrmnl_sp_build_delete_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
1045{
1046 return build_xfrm_sp_delete_message (tmpl, XFRM_MSG_DELPOLICY, flags, result);
1047}
1048
1049int xfrmnl_sp_delete(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
1050{
1051 int err;
1052 struct nl_msg *msg;
1053
1054 if ((err = xfrmnl_sp_build_delete_request(tmpl, flags, &msg)) < 0)
1055 return err;
1056
1057 err = nl_send_auto_complete(sk, msg);
1058 nlmsg_free(msg);
1059 if (err < 0)
1060 return err;
1061
1062 return nl_wait_for_ack(sk);
1063}
1064
1065/** @} */
1066
1067
1068/**
1069 * @name Attributes
1070 * @{
1071 */
1072
1073struct xfrmnl_sel* xfrmnl_sp_get_sel (struct xfrmnl_sp* sp)
1074{
1075 if (sp->ce_mask & XFRM_SP_ATTR_SEL)
1076 return sp->sel;
1077 else
1078 return NULL;
1079}
1080
1081int xfrmnl_sp_set_sel (struct xfrmnl_sp* sp, struct xfrmnl_sel* sel)
1082{
1083 /* Release any previously held selector object from the SP */
1084 if (sp->sel)
1085 xfrmnl_sel_put (sp->sel);
1086
1087 /* Increment ref count on new selector and save it in the SP */
1088 xfrmnl_sel_get (sel);
1089 sp->sel = sel;
1090 sp->ce_mask |= XFRM_SP_ATTR_SEL;
1091
1092 return 0;
1093}
1094
1095struct xfrmnl_ltime_cfg* xfrmnl_sp_get_lifetime_cfg (struct xfrmnl_sp* sp)
1096{
1097 if (sp->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
1098 return sp->lft;
1099 else
1100 return NULL;
1101}
1102
1103int xfrmnl_sp_set_lifetime_cfg (struct xfrmnl_sp* sp, struct xfrmnl_ltime_cfg* ltime)
1104{
1105 /* Release any previously held lifetime cfg object from the SP */
1106 if (sp->lft)
1107 xfrmnl_ltime_cfg_put (sp->lft);
1108
1109 /* Increment ref count on new lifetime object and save it in the SP */
1110 xfrmnl_ltime_cfg_get (ltime);
1111 sp->lft = ltime;
1112 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
1113
1114 return 0;
1115}
1116
1117int xfrmnl_sp_get_curlifetime (struct xfrmnl_sp* sp, unsigned long long int* curr_bytes,
1118 unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1119{
1120 if (sp == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1121 return -1;
1122
1123 *curr_bytes = sp->curlft.bytes;
1124 *curr_packets = sp->curlft.packets;
1125 *curr_add_time = sp->curlft.add_time;
1126 *curr_use_time = sp->curlft.use_time;
1127
1128 return 0;
1129}
1130
1131int xfrmnl_sp_get_priority (struct xfrmnl_sp* sp)
1132{
1133 if (sp->ce_mask & XFRM_SP_ATTR_PRIO)
1134 return sp->priority;
1135 else
1136 return -1;
1137}
1138
1139int xfrmnl_sp_set_priority (struct xfrmnl_sp* sp, unsigned int prio)
1140{
1141 sp->priority = prio;
1142 sp->ce_mask |= XFRM_SP_ATTR_PRIO;
1143
1144 return 0;
1145}
1146
1147int xfrmnl_sp_get_index (struct xfrmnl_sp* sp)
1148{
1149 if (sp->ce_mask & XFRM_SP_ATTR_INDEX)
1150 return sp->index;
1151 else
1152 return -1;
1153}
1154
1155int xfrmnl_sp_set_index (struct xfrmnl_sp* sp, unsigned int index)
1156{
1157 sp->index = index;
1158 sp->ce_mask |= XFRM_SP_ATTR_INDEX;
1159
1160 return 0;
1161}
1162
1163int xfrmnl_sp_get_dir (struct xfrmnl_sp* sp)
1164{
1165 if (sp->ce_mask & XFRM_SP_ATTR_DIR)
1166 return sp->dir;
1167 else
1168 return -1;
1169}
1170
1171int xfrmnl_sp_set_dir (struct xfrmnl_sp* sp, unsigned int dir)
1172{
1173 sp->dir = dir;
1174 sp->ce_mask |= XFRM_SP_ATTR_DIR;
1175
1176 return 0;
1177}
1178
1179int xfrmnl_sp_get_action (struct xfrmnl_sp* sp)
1180{
1181 if (sp->ce_mask & XFRM_SP_ATTR_ACTION)
1182 return sp->action;
1183 else
1184 return -1;
1185}
1186
1187int xfrmnl_sp_set_action (struct xfrmnl_sp* sp, unsigned int action)
1188{
1189 sp->action = action;
1190 sp->ce_mask |= XFRM_SP_ATTR_ACTION;
1191
1192 return 0;
1193}
1194
1195int xfrmnl_sp_get_flags (struct xfrmnl_sp* sp)
1196{
1197 if (sp->ce_mask & XFRM_SP_ATTR_FLAGS)
1198 return sp->flags;
1199 else
1200 return -1;
1201}
1202
1203int xfrmnl_sp_set_flags (struct xfrmnl_sp* sp, unsigned int flags)
1204{
1205 sp->flags = flags;
1206 sp->ce_mask |= XFRM_SP_ATTR_FLAGS;
1207
1208 return 0;
1209}
1210
1211int xfrmnl_sp_get_share (struct xfrmnl_sp* sp)
1212{
1213 if (sp->ce_mask & XFRM_SP_ATTR_SHARE)
1214 return sp->share;
1215 else
1216 return -1;
1217}
1218
1219int xfrmnl_sp_set_share (struct xfrmnl_sp* sp, unsigned int share)
1220{
1221 sp->share = share;
1222 sp->ce_mask |= XFRM_SP_ATTR_SHARE;
1223
1224 return 0;
1225}
1226
1227/**
1228 * Get the security context.
1229 *
1230 * @arg sp The xfrmnl_sp object.
1231 * @arg len An optional output value for the ctx_str length including the xfrmnl_sp header.
1232 * @arg exttype An optional output value.
1233 * @arg alg An optional output value for the security context algorithm.
1234 * @arg doi An optional output value for the security context domain of interpretation.
1235 * @arg ctx_len An optional output value for the security context length, including the
1236 * terminating null byte ('\0').
1237 * @arg ctx_str An optional buffer large enough for the security context string. It must
1238 * contain at least @ctx_len bytes. You are advised to create the ctx_str
1239 * buffer one element larger and ensure NUL termination yourself.
1240 *
1241 * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
1242 * call xfrmnl_sp_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
1243 * This modified API is available in all versions of libnl3 that support the capability
1244 * @def NL_CAPABILITY_XFRM_SP_SEC_CTX_LEN (@see nl_has_capability for further information).
1245 *
1246 * @return 0 on success or a negative error code.
1247 */
1248int xfrmnl_sp_get_sec_ctx (struct xfrmnl_sp* sp, unsigned int* len, unsigned int* exttype, unsigned int* alg, unsigned int* doi, unsigned int* ctx_len, char* ctx_str)
1249{
1250 if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
1251 {
1252 if (len)
1253 *len = sizeof (struct xfrmnl_user_sec_ctx) + sp->sec_ctx->ctx_len;
1254 if (exttype)
1255 *exttype = sp->sec_ctx->exttype;
1256 if (alg)
1257 *alg = sp->sec_ctx->ctx_alg;
1258 if (doi)
1259 *doi = sp->sec_ctx->ctx_doi;
1260 if (ctx_len)
1261 *ctx_len = sp->sec_ctx->ctx_len;
1262 if (ctx_str)
1263 memcpy ((void *)ctx_str, (void *)sp->sec_ctx->ctx, sp->sec_ctx->ctx_len);
1264 }
1265 else
1266 return -1;
1267
1268 return 0;
1269}
1270/**
1271 * @brief Set security context (ctx_str) for XFRM Polixy.
1272 *
1273 * @param sp XFRM Policy
1274 * @param len !!! depricated unused parameter !!!
1275 * @param exttype netlink message attribute - probably XFRMA_SEC_CTX
1276 * @param alg security context algorithm
1277 * @param doi security context domain interpretation
1278 * @param ctx_len Length of the context string.
1279 * @param ctx_str The context string.
1280 *
1281 * @return 0 if sucessfull, else -1
1282 */
1283int xfrmnl_sp_set_sec_ctx (struct xfrmnl_sp* sp, unsigned int len __attribute__((unused)), unsigned int exttype, unsigned int alg, unsigned int doi, unsigned int ctx_len, char* ctx_str)
1284{
1285 /* Free up the old context string and allocate new one */
1286 if (sp->sec_ctx)
1287 free (sp->sec_ctx);
1288 if ((sp->sec_ctx = calloc (1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + ctx_len)) == NULL)
1289 return -1;
1290
1291 /* Save the new info */
1292 sp->sec_ctx->len = sizeof (struct xfrmnl_user_sec_ctx) + ctx_len;
1293 sp->sec_ctx->exttype = exttype;
1294 sp->sec_ctx->ctx_alg = alg;
1295 sp->sec_ctx->ctx_doi = doi;
1296 sp->sec_ctx->ctx_len = ctx_len;
1297 memcpy ((void *)sp->sec_ctx->ctx, (void *)ctx_str, ctx_len);
1298 sp->sec_ctx->ctx[ctx_len] = '\0';
1299
1300 sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
1301
1302 return 0;
1303}
1304
1305int xfrmnl_sp_get_userpolicy_type (struct xfrmnl_sp* sp)
1306{
1307 if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
1308 return sp->uptype.type;
1309 else
1310 return -1;
1311}
1312
1313int xfrmnl_sp_set_userpolicy_type (struct xfrmnl_sp* sp, unsigned int type)
1314{
1315 sp->uptype.type = type;
1316 sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
1317
1318 return 0;
1319}
1320
1321void xfrmnl_sp_add_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1322{
1323 nl_list_add_tail(&utmpl->utmpl_list, &sp->usertmpl_list);
1324 sp->nr_user_tmpl++;
1325 sp->ce_mask |= XFRM_SP_ATTR_TMPL;
1326}
1327
1328void xfrmnl_sp_remove_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1329{
1330 if (sp->ce_mask & XFRM_SP_ATTR_TMPL) {
1331 sp->nr_user_tmpl--;
1332 nl_list_del(&utmpl->utmpl_list);
1333 if (sp->nr_user_tmpl == 0)
1334 sp->ce_mask &= ~XFRM_SP_ATTR_TMPL;
1335 }
1336}
1337
1338struct nl_list_head *xfrmnl_sp_get_usertemplates(struct xfrmnl_sp *sp)
1339{
1340 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1341 return &sp->usertmpl_list;
1342
1343 return NULL;
1344}
1345
1346int xfrmnl_sp_get_nusertemplates(struct xfrmnl_sp *sp)
1347{
1348 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1349 return sp->nr_user_tmpl;
1350
1351 return 0;
1352}
1353
1354void xfrmnl_sp_foreach_usertemplate(struct xfrmnl_sp *r,
1355 void (*cb)(struct xfrmnl_user_tmpl *, void *),
1356 void *arg)
1357{
1358 struct xfrmnl_user_tmpl *utmpl;
1359
1360 if (r->ce_mask & XFRM_SP_ATTR_TMPL) {
1361 nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1362 cb(utmpl, arg);
1363 }
1364 }
1365}
1366
1367struct xfrmnl_user_tmpl *xfrmnl_sp_usertemplate_n(struct xfrmnl_sp *r, int n)
1368{
1369 struct xfrmnl_user_tmpl *utmpl;
1370 uint32_t i;
1371
1372 if (r->ce_mask & XFRM_SP_ATTR_TMPL && r->nr_user_tmpl > n) {
1373 i = 0;
1374 nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1375 if (i == n) return utmpl;
1376 i++;
1377 }
1378 }
1379 return NULL;
1380}
1381
1382int xfrmnl_sp_get_mark (struct xfrmnl_sp* sp, unsigned int* mark_mask, unsigned int* mark_value)
1383{
1384 if (mark_mask == NULL || mark_value == NULL)
1385 return -1;
1386
1387 if (sp->ce_mask & XFRM_SP_ATTR_MARK)
1388 {
1389 *mark_mask = sp->mark.m;
1390 *mark_value = sp->mark.v;
1391
1392 return 0;
1393 }
1394 else
1395 return -1;
1396}
1397
1398int xfrmnl_sp_set_mark (struct xfrmnl_sp* sp, unsigned int value, unsigned int mask)
1399{
1400 sp->mark.v = value;
1401 sp->mark.m = mask;
1402 sp->ce_mask |= XFRM_SP_ATTR_MARK;
1403
1404 return 0;
1405}
1406
1407/** @} */
1408
1409static struct nl_object_ops xfrm_sp_obj_ops = {
1410 .oo_name = "xfrm/sp",
1411 .oo_size = sizeof(struct xfrmnl_sp),
1412 .oo_constructor = xfrm_sp_alloc_data,
1413 .oo_free_data = xfrm_sp_free_data,
1414 .oo_clone = xfrm_sp_clone,
1415 .oo_dump = {
1416 [NL_DUMP_LINE] = xfrm_sp_dump_line,
1417 [NL_DUMP_DETAILS] = xfrm_sp_dump_details,
1418 [NL_DUMP_STATS] = xfrm_sp_dump_stats,
1419 },
1420 .oo_compare = xfrm_sp_compare,
1421 .oo_attrs2str = xfrm_sp_attrs2str,
1422 .oo_id_attrs = (XFRM_SP_ATTR_SEL | XFRM_SP_ATTR_INDEX | XFRM_SP_ATTR_DIR),
1423};
1424
1425static struct nl_af_group xfrm_sp_groups[] = {
1426 { AF_UNSPEC, XFRMNLGRP_POLICY },
1427 { END_OF_GROUP_LIST },
1428};
1429
1430static struct nl_cache_ops xfrmnl_sp_ops = {
1431 .co_name = "xfrm/sp",
1432 .co_hdrsize = sizeof(struct xfrm_userpolicy_info),
1433 .co_msgtypes = {
1434 { XFRM_MSG_NEWPOLICY, NL_ACT_NEW, "new" },
1435 { XFRM_MSG_DELPOLICY, NL_ACT_DEL, "del" },
1436 { XFRM_MSG_GETPOLICY, NL_ACT_GET, "get" },
1437 { XFRM_MSG_UPDPOLICY, NL_ACT_NEW, "update" },
1438 END_OF_MSGTYPES_LIST,
1439 },
1440 .co_protocol = NETLINK_XFRM,
1441 .co_groups = xfrm_sp_groups,
1442 .co_request_update = xfrm_sp_request_update,
1443 .co_msg_parser = xfrm_sp_msg_parser,
1444 .co_obj_ops = &xfrm_sp_obj_ops,
1445};
1446
1447/**
1448 * @name XFRM SA Cache Managament
1449 * @{
1450 */
1451
1452static void __attribute__ ((constructor)) xfrm_sp_init(void)
1453{
1454 nl_cache_mngt_register(&xfrmnl_sp_ops);
1455}
1456
1457static void __attribute__ ((destructor)) xfrm_sp_exit(void)
1458{
1459 nl_cache_mngt_unregister(&xfrmnl_sp_ops);
1460}
1461
1462/** @} */
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_clone(struct xfrmnl_user_tmpl *utmpl)
Clone existing user template object.
Definition template.c:95
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition selector.c:180
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition lifetime.c:79
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition lifetime.c:159
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition lifetime.c:98
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition selector.c:96
int xfrmnl_user_tmpl_cmp(struct xfrmnl_user_tmpl *a, struct xfrmnl_user_tmpl *b)
Compares two user template objects.
Definition template.c:148
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition selector.c:115
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_alloc()
Allocate new user template object.
Definition template.c:76
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition addr.c:967
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition addr.c:943
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition addr.c:1001
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition addr.c:955
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition attr.c:119
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition attr.h:159
struct nlattr * nla_nest_start(struct nl_msg *msg, int attrtype)
Start a new level of nested attributes.
Definition attr.c:906
int nla_len(const struct nlattr *nla)
Return length of the payload .
Definition attr.c:130
int nla_nest_end(struct nl_msg *msg, struct nlattr *start)
Finalize nesting of attributes.
Definition attr.c:969
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition cache_mngt.c:287
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition cache_mngt.c:252
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition cache.c:146
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition cache.c:234
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition cache.c:120
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition msg.c:349
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition msg.c:108
void * nlmsg_reserve(struct nl_msg *n, size_t len, int pad)
Reserve room for additional data in a netlink message.
Definition msg.c:412
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition msg.c:566
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition msg.c:216
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition msg.c:450
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition object.c:221
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition object.c:210
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition object.c:55
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition nl.c:515
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition nl.c:1246
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition nl.c:1177
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition nl.c:1111
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition nl.c:579
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition utils.c:1017
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition types.h:22
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition types.h:20
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition types.h:21
Dumping parameters.
Definition types.h:32
Attribute validation policy.
Definition attr.h:63
uint16_t minlen
Minimal length of payload required.
Definition attr.h:68
Definition sp.c:65