libnl 3.8.0
sp.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36/**
37 * @ingroup xfrmnl
38 * @defgroup sp Security Policy
39 * @brief
40 */
41
42#include "nl-default.h"
43
44#include <netlink/netlink.h>
45#include <netlink/cache.h>
46#include <netlink/object.h>
47#include <netlink/xfrm/selector.h>
48#include <netlink/xfrm/lifetime.h>
49#include <netlink/xfrm/template.h>
50#include <netlink/xfrm/sp.h>
51
52#include "nl-xfrm.h"
53#include "nl-priv-dynamic-core/object-api.h"
54#include "nl-priv-dynamic-core/nl-core.h"
55#include "nl-priv-dynamic-core/cache-api.h"
56
58 uint8_t type;
59 uint16_t reserved1;
60 uint16_t reserved2;
61};
62
63struct xfrmnl_sp {
64 NLHDR_COMMON
65
66 struct xfrmnl_sel* sel;
67 struct xfrmnl_ltime_cfg* lft;
68 struct xfrmnl_lifetime_cur curlft;
69 uint32_t priority;
70 uint32_t index;
71 uint8_t dir;
72 uint8_t action;
73 uint8_t flags;
74 uint8_t share;
75 struct xfrmnl_user_sec_ctx* sec_ctx;
76 struct xfrmnl_userpolicy_type uptype;
77 uint32_t nr_user_tmpl;
78 struct nl_list_head usertmpl_list;
79 struct xfrmnl_mark mark;
80};
81
82/** @cond SKIP */
83#define XFRM_SP_ATTR_SEL 0x01
84#define XFRM_SP_ATTR_LTIME_CFG 0x02
85#define XFRM_SP_ATTR_LTIME_CUR 0x04
86#define XFRM_SP_ATTR_PRIO 0x08
87#define XFRM_SP_ATTR_INDEX 0x10
88#define XFRM_SP_ATTR_DIR 0x20
89#define XFRM_SP_ATTR_ACTION 0x40
90#define XFRM_SP_ATTR_FLAGS 0x80
91#define XFRM_SP_ATTR_SHARE 0x100
92#define XFRM_SP_ATTR_POLTYPE 0x200
93#define XFRM_SP_ATTR_SECCTX 0x400
94#define XFRM_SP_ATTR_TMPL 0x800
95#define XFRM_SP_ATTR_MARK 0x1000
96
97static struct nl_cache_ops xfrmnl_sp_ops;
98static struct nl_object_ops xfrm_sp_obj_ops;
99/** @endcond */
100
101static void xfrm_sp_alloc_data(struct nl_object *c)
102{
103 struct xfrmnl_sp* sp = nl_object_priv (c);
104
105 if ((sp->sel = xfrmnl_sel_alloc ()) == NULL)
106 return;
107
108 if ((sp->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
109 return;
110
111 nl_init_list_head(&sp->usertmpl_list);
112
113 return;
114}
115
116static void xfrm_sp_free_data(struct nl_object *c)
117{
118 struct xfrmnl_sp* sp = nl_object_priv (c);
119 struct xfrmnl_user_tmpl *utmpl, *tmp;
120
121 if (sp == NULL)
122 return;
123
124 xfrmnl_sel_put (sp->sel);
125 xfrmnl_ltime_cfg_put (sp->lft);
126
127 if (sp->sec_ctx) {
128 free(sp->sec_ctx);
129 }
130
131 nl_list_for_each_entry_safe(utmpl, tmp, &sp->usertmpl_list, utmpl_list) {
132 xfrmnl_sp_remove_usertemplate (sp, utmpl);
133 xfrmnl_user_tmpl_free (utmpl);
134 }
135}
136
137static int xfrm_sp_clone(struct nl_object *_dst, struct nl_object *_src)
138{
139 struct xfrmnl_sp* dst = nl_object_priv(_dst);
140 struct xfrmnl_sp* src = nl_object_priv(_src);
141 struct xfrmnl_user_tmpl *utmpl;
142 struct xfrmnl_user_tmpl *new;
143
144 dst->sel = NULL;
145 dst->lft = NULL;
146 dst->sec_ctx = NULL;
147 nl_init_list_head(&dst->usertmpl_list);
148
149 if (src->sel) {
150 if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
151 return -NLE_NOMEM;
152 }
153
154 if (src->lft) {
155 if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
156 return -NLE_NOMEM;
157 }
158
159 if (src->sec_ctx) {
160 uint32_t len = sizeof (struct xfrmnl_user_sec_ctx) + src->sec_ctx->ctx_len;
161
162 if ((dst->sec_ctx = malloc (len)) == NULL)
163 return -NLE_NOMEM;
164 memcpy(dst->sec_ctx, src->sec_ctx, len);
165 }
166
167 nl_list_for_each_entry(utmpl, &src->usertmpl_list, utmpl_list) {
168 new = xfrmnl_user_tmpl_clone (utmpl);
169 if (!new)
170 return -NLE_NOMEM;
171 xfrmnl_sp_add_usertemplate(dst, new);
172 }
173
174 return 0;
175}
176
177static uint64_t xfrm_sp_compare(struct nl_object *_a, struct nl_object *_b,
178 uint64_t attrs, int flags)
179{
180 struct xfrmnl_sp* a = (struct xfrmnl_sp *) _a;
181 struct xfrmnl_sp* b = (struct xfrmnl_sp *) _b;
182 struct xfrmnl_user_tmpl *tmpl_a, *tmpl_b;
183 uint64_t diff = 0;
184
185#define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
186 diff |= _DIFF(XFRM_SP_ATTR_SEL, xfrmnl_sel_cmp(a->sel, b->sel));
187 diff |= _DIFF(XFRM_SP_ATTR_LTIME_CFG,
188 xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
189 diff |= _DIFF(XFRM_SP_ATTR_PRIO, a->priority != b->priority);
190 diff |= _DIFF(XFRM_SP_ATTR_INDEX, a->index != b->index);
191 diff |= _DIFF(XFRM_SP_ATTR_DIR, a->dir != b->dir);
192 diff |= _DIFF(XFRM_SP_ATTR_ACTION, a->action != b->action);
193 diff |= _DIFF(XFRM_SP_ATTR_FLAGS, a->flags != b->flags);
194 diff |= _DIFF(XFRM_SP_ATTR_SHARE, a->share != b->share);
195 diff |= _DIFF(XFRM_SP_ATTR_SECCTX,
196 ((a->sec_ctx->len != b->sec_ctx->len) ||
197 (a->sec_ctx->exttype != b->sec_ctx->exttype) ||
198 (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
199 (a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
200 (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
201 strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
202 diff |= _DIFF(XFRM_SP_ATTR_POLTYPE, (a->uptype.type != b->uptype.type));
203 diff |= _DIFF(XFRM_SP_ATTR_TMPL, (a->nr_user_tmpl != b->nr_user_tmpl));
204 diff |= _DIFF(XFRM_SP_ATTR_MARK,
205 (a->mark.m != b->mark.m) || (a->mark.v != b->mark.v));
206
207 /* Compare the templates */
208 nl_list_for_each_entry(tmpl_b, &b->usertmpl_list, utmpl_list)
209 nl_list_for_each_entry(tmpl_a, &a->usertmpl_list, utmpl_list)
210 diff |= xfrmnl_user_tmpl_cmp (tmpl_a, tmpl_b);
211#undef _DIFF
212
213 return diff;
214}
215
216/**
217 * @name XFRM SP Attribute Translations
218 * @{
219 */
220static const struct trans_tbl sp_attrs[] = {
221 __ADD(XFRM_SP_ATTR_SEL, selector),
222 __ADD(XFRM_SP_ATTR_LTIME_CFG, lifetime_cfg),
223 __ADD(XFRM_SP_ATTR_LTIME_CUR, lifetime_cur),
224 __ADD(XFRM_SP_ATTR_PRIO, priority),
225 __ADD(XFRM_SP_ATTR_INDEX, index),
226 __ADD(XFRM_SP_ATTR_DIR, direction),
227 __ADD(XFRM_SP_ATTR_ACTION, action),
228 __ADD(XFRM_SP_ATTR_FLAGS, flags),
229 __ADD(XFRM_SP_ATTR_SHARE, share),
230 __ADD(XFRM_SP_ATTR_POLTYPE, policy_type),
231 __ADD(XFRM_SP_ATTR_SECCTX, security_context),
232 __ADD(XFRM_SP_ATTR_TMPL, user_template),
233 __ADD(XFRM_SP_ATTR_MARK, mark),
234};
235
236static char* xfrm_sp_attrs2str(int attrs, char *buf, size_t len)
237{
238 return __flags2str (attrs, buf, len, sp_attrs, ARRAY_SIZE(sp_attrs));
239}
240/** @} */
241
242/**
243 * @name XFRM SP Action Translations
244 * @{
245 */
246static const struct trans_tbl sa_actions[] = {
247 __ADD(XFRM_POLICY_ALLOW, allow),
248 __ADD(XFRM_POLICY_BLOCK, block),
249};
250
251char* xfrmnl_sp_action2str(int action, char *buf, size_t len)
252{
253 return __type2str (action, buf, len, sa_actions, ARRAY_SIZE(sa_actions));
254}
255
256int xfrmnl_sp_str2action(const char *name)
257{
258 return __str2type (name, sa_actions, ARRAY_SIZE(sa_actions));
259}
260/** @} */
261
262/**
263 * @name XFRM SP Flags Translations
264 * @{
265 */
266static const struct trans_tbl sp_flags[] = {
267 __ADD(XFRM_POLICY_LOCALOK, allow policy override by user),
268 __ADD(XFRM_POLICY_ICMP, auto include ICMP in policy),
269};
270
271char* xfrmnl_sp_flags2str(int flags, char *buf, size_t len)
272{
273 return __flags2str (flags, buf, len, sp_flags, ARRAY_SIZE(sp_flags));
274}
275
276int xfrmnl_sp_str2flag(const char *name)
277{
278 return __str2flags(name, sp_flags, ARRAY_SIZE(sp_flags));
279}
280/** @} */
281
282/**
283 * @name XFRM SP Type Translations
284 * @{
285 */
286static const struct trans_tbl sp_types[] = {
287 __ADD(XFRM_POLICY_TYPE_MAIN, main),
288 __ADD(XFRM_POLICY_TYPE_SUB, sub),
289 __ADD(XFRM_POLICY_TYPE_MAX, max),
290 __ADD(XFRM_POLICY_TYPE_ANY, any),
291};
292
293char* xfrmnl_sp_type2str(int type, char *buf, size_t len)
294{
295 return __type2str(type, buf, len, sp_types, ARRAY_SIZE(sp_types));
296}
297
298int xfrmnl_sp_str2type(const char *name)
299{
300 return __str2type(name, sp_types, ARRAY_SIZE(sp_types));
301}
302/** @} */
303
304/**
305 * @name XFRM SP Direction Translations
306 * @{
307 */
308static const struct trans_tbl sp_dir[] = {
309 __ADD(XFRM_POLICY_IN, in),
310 __ADD(XFRM_POLICY_OUT, out),
311 __ADD(XFRM_POLICY_FWD, fwd),
312 __ADD(XFRM_POLICY_MASK, mask),
313};
314
315char* xfrmnl_sp_dir2str(int dir, char *buf, size_t len)
316{
317 return __type2str (dir, buf, len, sp_dir, ARRAY_SIZE(sp_dir));
318}
319
320int xfrmnl_sp_str2dir(const char *name)
321{
322 return __str2type (name, sp_dir, ARRAY_SIZE(sp_dir));
323}
324
325int xfrmnl_sp_index2dir (unsigned int index)
326{
327 return index & 0x7;
328}
329/** @} */
330
331/**
332 * @name XFRM SP Share Translations
333 * @{
334 */
335static const struct trans_tbl sp_share[] = {
336 __ADD(XFRM_SHARE_ANY, any),
337 __ADD(XFRM_SHARE_SESSION, session),
338 __ADD(XFRM_SHARE_USER, user),
339 __ADD(XFRM_SHARE_UNIQUE, unique),
340};
341
342char* xfrmnl_sp_share2str(int share, char *buf, size_t len)
343{
344 return __type2str (share, buf, len, sp_share, ARRAY_SIZE(sp_share));
345}
346
347int xfrmnl_sp_str2share(const char *name)
348{
349 return __str2type (name, sp_share, ARRAY_SIZE(sp_share));
350}
351/** @} */
352
353static void xfrm_sp_dump_line(struct nl_object *a, struct nl_dump_params *p)
354{
355 struct xfrmnl_sp* sp = (struct xfrmnl_sp *) a;
356 char dir[32], action[32], share[32], flags[32];
357 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
358 time_t add_time, use_time;
359 struct tm *add_time_tm, *use_time_tm;
360 struct tm tm_buf;
361
362 nl_addr2str(xfrmnl_sel_get_saddr (sp->sel), src, sizeof(src));
363 nl_addr2str (xfrmnl_sel_get_daddr (sp->sel), dst, sizeof (dst));
364 nl_af2str (xfrmnl_sel_get_family (sp->sel), dir, 32);
365 nl_dump_line(p, "src %s dst %s family: %s\n", src, dst, dir);
366 nl_dump_line (p, "src port/mask: %d/%d dst port/mask: %d/%d\n",
367 xfrmnl_sel_get_dport (sp->sel), xfrmnl_sel_get_dportmask (sp->sel),
368 xfrmnl_sel_get_sport (sp->sel), xfrmnl_sel_get_sportmask (sp->sel));
369 nl_dump_line (p, "protocol: %s ifindex: %u uid: %u\n",
370 nl_ip_proto2str (xfrmnl_sel_get_proto (sp->sel), dir, sizeof(dir)),
371 xfrmnl_sel_get_ifindex (sp->sel),
372 xfrmnl_sel_get_userid (sp->sel));
373
374 xfrmnl_sp_dir2str (sp->dir, dir, 32);
375 xfrmnl_sp_action2str (sp->action, action, 32);
376 xfrmnl_sp_share2str (sp->share, share, 32);
377 xfrmnl_sp_flags2str (sp->flags, flags, 32);
378 nl_dump_line(p, "\tdir: %s action: %s index: %u priority: %u share: %s flags: %s(0x%x) \n",
379 dir, action, sp->index, sp->priority, share, flags, sp->flags);
380
381 nl_dump_line(p, "\tlifetime configuration: \n");
382 if (sp->lft->soft_byte_limit == XFRM_INF)
383 sprintf (dir, "INF");
384 else
385 sprintf (dir, "%" PRIu64, sp->lft->soft_byte_limit);
386 if (sp->lft->soft_packet_limit == XFRM_INF)
387 sprintf (action, "INF");
388 else
389 sprintf (action, "%" PRIu64, sp->lft->soft_packet_limit);
390 if (sp->lft->hard_byte_limit == XFRM_INF)
391 sprintf (flags, "INF");
392 else
393 sprintf (flags, "%" PRIu64, sp->lft->hard_byte_limit);
394 if (sp->lft->hard_packet_limit == XFRM_INF)
395 sprintf (share, "INF");
396 else
397 sprintf (share, "%" PRIu64, sp->lft->hard_packet_limit);
398 nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets) \n", dir,
399 action);
400 nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets) \n", flags,
401 share);
402 nl_dump_line(
403 p,
404 "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
405 (long long unsigned)sp->lft->soft_add_expires_seconds,
406 (long long unsigned)sp->lft->soft_use_expires_seconds);
407 nl_dump_line(
408 p,
409 "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
410 (long long unsigned)sp->lft->hard_add_expires_seconds,
411 (long long unsigned)sp->lft->hard_use_expires_seconds);
412
413 nl_dump_line(p, "\tlifetime current: \n");
414 nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
415 (long long unsigned)sp->curlft.bytes,
416 (long long unsigned)sp->curlft.packets);
417
418 if (sp->curlft.add_time != 0)
419 {
420 add_time = sp->curlft.add_time;
421 add_time_tm = gmtime_r (&add_time, &tm_buf);
422 strftime (dst, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", add_time_tm);
423 }
424 else
425 {
426 sprintf (dst, "%s", "-");
427 }
428
429 if (sp->curlft.use_time != 0)
430 {
431 use_time = sp->curlft.use_time;
432 use_time_tm = gmtime_r (&use_time, &tm_buf);
433 strftime (src, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", use_time_tm);
434 }
435 else
436 {
437 sprintf (src, "%s", "-");
438 }
439 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", dst, src);
440
441 if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
442 {
443 nl_dump_line(p, "\tUser security context: \n");
444 nl_dump_line(p, "\t\tlen: %d exttype: %d Algo: %d DOI: %d ctxlen: %d\n",
445 sp->sec_ctx->len, sp->sec_ctx->exttype,
446 sp->sec_ctx->ctx_alg, sp->sec_ctx->ctx_doi, sp->sec_ctx->ctx_len);
447 nl_dump_line (p, "\t\tctx: %s \n", sp->sec_ctx->ctx);
448 }
449
450 xfrmnl_sp_type2str (sp->uptype.type, flags, 32);
451 if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
452 nl_dump_line(p, "\tUser policy type: %s\n", flags);
453
454 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
455 {
456 struct xfrmnl_user_tmpl* utmpl;
457
458 nl_dump_line(p, "\tUser template: \n");
459
460 nl_list_for_each_entry(utmpl, &sp->usertmpl_list, utmpl_list)
461 xfrmnl_user_tmpl_dump (utmpl, p);
462 }
463
464 if (sp->ce_mask & XFRM_SP_ATTR_MARK)
465 nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sp->mark.m, sp->mark.v);
466
467 nl_dump(p, "\n");
468}
469
470static void xfrm_sp_dump_details(struct nl_object *a, struct nl_dump_params *p)
471{
472 xfrm_sp_dump_line(a, p);
473}
474
475static void xfrm_sp_dump_stats(struct nl_object *a, struct nl_dump_params *p)
476{
477 xfrm_sp_dump_details(a, p);
478
479 return;
480}
481
482/**
483 * @name XFRM SP Object Allocation/Freeage
484 * @{
485 */
486
487struct xfrmnl_sp* xfrmnl_sp_alloc(void)
488{
489 return (struct xfrmnl_sp*) nl_object_alloc(&xfrm_sp_obj_ops);
490}
491
492void xfrmnl_sp_put(struct xfrmnl_sp* sp)
493{
494 nl_object_put((struct nl_object *) sp);
495}
496
497/** @} */
498
499/**
500 * @name SP Cache Managament
501 * @{
502 */
503
504/**
505 * Build a SP cache including all SPs currently configured in the kernel.
506 * @arg sock Netlink socket.
507 * @arg result Pointer to store resulting cache.
508 *
509 * Allocates a new SP cache, initializes it properly and updates it
510 * to include all SPs currently configured in the kernel.
511 *
512 * @return 0 on success or a negative error code.
513 */
514int xfrmnl_sp_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
515{
516 return nl_cache_alloc_and_fill(&xfrmnl_sp_ops, sock, result);
517}
518
519/**
520 * Look up a SP by policy id and direction
521 * @arg cache SP cache
522 * @arg index Policy Id
523 * @arg dir direction
524 * @return sp handle or NULL if no match was found.
525 */
526struct xfrmnl_sp* xfrmnl_sp_get(struct nl_cache* cache, unsigned int index, unsigned int dir)
527{
528 struct xfrmnl_sp *sp;
529
530 //nl_list_for_each_entry(sp, &cache->c_items, ce_list) {
531 for (sp = (struct xfrmnl_sp*)nl_cache_get_first (cache);
532 sp != NULL;
533 sp = (struct xfrmnl_sp*)nl_cache_get_next ((struct nl_object*)sp))
534 {
535 if (sp->index == index && sp->dir == dir)
536 {
537 nl_object_get((struct nl_object *) sp);
538 return sp;
539 }
540 }
541
542 return NULL;
543}
544
545
546/** @} */
547
548
549static struct nla_policy xfrm_sp_policy[XFRMA_MAX+1] = {
550 [XFRMA_POLICY] = { .minlen = sizeof(struct xfrm_userpolicy_info)},
551 [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
552 [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
553 [XFRMA_POLICY_TYPE] = { .minlen = sizeof(struct xfrm_userpolicy_type)},
554 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
555};
556
557static int xfrm_sp_request_update(struct nl_cache *c, struct nl_sock *h)
558{
559 return nl_send_simple (h, XFRM_MSG_GETPOLICY, NLM_F_DUMP, NULL, 0);
560}
561
562int xfrmnl_sp_parse(struct nlmsghdr *n, struct xfrmnl_sp **result)
563{
564 struct xfrmnl_sp *sp;
565 struct nlattr *tb[XFRMA_MAX + 1];
566 struct xfrm_userpolicy_info *sp_info;
567 int len, err;
568 struct nl_addr* addr;
569
570 sp = xfrmnl_sp_alloc();
571 if (!sp) {
572 err = -NLE_NOMEM;
573 goto errout;
574 }
575
576 sp->ce_msgtype = n->nlmsg_type;
577 if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
578 {
579 sp_info = (struct xfrm_userpolicy_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_userpolicy_id) + NLA_HDRLEN);
580 }
581 else
582 {
583 sp_info = nlmsg_data(n);
584 }
585
586 err = nlmsg_parse(n, sizeof(struct xfrm_userpolicy_info), tb, XFRMA_MAX, xfrm_sp_policy);
587 if (err < 0)
588 {
589 printf ("parse error: %d \n", err);
590 goto errout;
591 }
592
593 if (sp_info->sel.family == AF_INET)
594 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a4, sizeof (sp_info->sel.daddr.a4));
595 else
596 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a6, sizeof (sp_info->sel.daddr.a6));
597 nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_d);
598 xfrmnl_sel_set_daddr (sp->sel, addr);
599 xfrmnl_sel_set_prefixlen_d (sp->sel, sp_info->sel.prefixlen_d);
600
601 if (sp_info->sel.family == AF_INET)
602 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a4, sizeof (sp_info->sel.saddr.a4));
603 else
604 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a6, sizeof (sp_info->sel.saddr.a6));
605 nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_s);
606 xfrmnl_sel_set_saddr (sp->sel, addr);
607 xfrmnl_sel_set_prefixlen_s (sp->sel, sp_info->sel.prefixlen_s);
608
609 xfrmnl_sel_set_dport (sp->sel, ntohs (sp_info->sel.dport));
610 xfrmnl_sel_set_dportmask (sp->sel, ntohs (sp_info->sel.dport_mask));
611 xfrmnl_sel_set_sport (sp->sel, ntohs (sp_info->sel.sport));
612 xfrmnl_sel_set_sportmask (sp->sel, ntohs (sp_info->sel.sport_mask));
613 xfrmnl_sel_set_family (sp->sel, sp_info->sel.family);
614 xfrmnl_sel_set_proto (sp->sel, sp_info->sel.proto);
615 xfrmnl_sel_set_ifindex (sp->sel, sp_info->sel.ifindex);
616 xfrmnl_sel_set_userid (sp->sel, sp_info->sel.user);
617 sp->ce_mask |= XFRM_SP_ATTR_SEL;
618
619 sp->lft->soft_byte_limit = sp_info->lft.soft_byte_limit;
620 sp->lft->hard_byte_limit = sp_info->lft.hard_byte_limit;
621 sp->lft->soft_packet_limit = sp_info->lft.soft_packet_limit;
622 sp->lft->hard_packet_limit = sp_info->lft.hard_packet_limit;
623 sp->lft->soft_add_expires_seconds = sp_info->lft.soft_add_expires_seconds;
624 sp->lft->hard_add_expires_seconds = sp_info->lft.hard_add_expires_seconds;
625 sp->lft->soft_use_expires_seconds = sp_info->lft.soft_use_expires_seconds;
626 sp->lft->hard_use_expires_seconds = sp_info->lft.hard_use_expires_seconds;
627 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
628
629 sp->curlft.bytes = sp_info->curlft.bytes;
630 sp->curlft.packets = sp_info->curlft.packets;
631 sp->curlft.add_time = sp_info->curlft.add_time;
632 sp->curlft.use_time = sp_info->curlft.use_time;
633 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CUR;
634
635 sp->priority = sp_info->priority;
636 sp->index = sp_info->index;
637 sp->dir = sp_info->dir;
638 sp->action = sp_info->action;
639 sp->flags = sp_info->flags;
640 sp->share = sp_info->share;
641 sp->ce_mask |= (XFRM_SP_ATTR_PRIO | XFRM_SP_ATTR_INDEX |
642 XFRM_SP_ATTR_DIR | XFRM_SP_ATTR_ACTION |
643 XFRM_SP_ATTR_FLAGS | XFRM_SP_ATTR_SHARE);
644
645 if (tb[XFRMA_SEC_CTX]) {
646 struct xfrm_user_sec_ctx* ctx = nla_data(tb[XFRMA_SEC_CTX]);
647 len = sizeof (struct xfrmnl_user_sec_ctx) + ctx->ctx_len;
648 if ((sp->sec_ctx = calloc (1, len)) == NULL)
649 {
650 err = -NLE_NOMEM;
651 goto errout;
652 }
653 memcpy ((void *)sp->sec_ctx, (void *)ctx, len);
654 sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
655 }
656
657 if (tb[XFRMA_POLICY_TYPE]) {
658 struct xfrm_userpolicy_type* up = nla_data(tb[XFRMA_POLICY_TYPE]);
659 memcpy ((void *)&sp->uptype, (void *)up, sizeof (struct xfrm_userpolicy_type));
660 sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
661 }
662
663 if (tb[XFRMA_TMPL]) {
664 struct xfrm_user_tmpl* tmpl = nla_data(tb[XFRMA_TMPL]);
665 struct xfrmnl_user_tmpl* sputmpl;
666 uint32_t i;
667 uint32_t num_tmpls = nla_len(tb[XFRMA_TMPL]) / sizeof (*tmpl);
668 struct nl_addr* addr;
669
670 for (i = 0; (i < num_tmpls) && (tmpl); i ++, tmpl++)
671 {
672 if ((sputmpl = xfrmnl_user_tmpl_alloc ()) == NULL)
673 {
674 err = -NLE_NOMEM;
675 goto errout;
676 }
677
678 if (tmpl->family == AF_INET)
679 addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a4, sizeof (tmpl->id.daddr.a4));
680 else
681 addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a6, sizeof (tmpl->id.daddr.a6));
682 xfrmnl_user_tmpl_set_daddr (sputmpl, addr);
683 xfrmnl_user_tmpl_set_spi (sputmpl, ntohl(tmpl->id.spi));
684 xfrmnl_user_tmpl_set_proto (sputmpl, tmpl->id.proto);
685 xfrmnl_user_tmpl_set_family (sputmpl, tmpl->family);
686
687 if (tmpl->family == AF_INET)
688 addr = nl_addr_build(tmpl->family, &tmpl->saddr.a4, sizeof (tmpl->saddr.a4));
689 else
690 addr = nl_addr_build(tmpl->family, &tmpl->saddr.a6, sizeof (tmpl->saddr.a6));
691 xfrmnl_user_tmpl_set_saddr (sputmpl, addr);
692
693 xfrmnl_user_tmpl_set_reqid (sputmpl, tmpl->reqid);
694 xfrmnl_user_tmpl_set_mode (sputmpl, tmpl->mode);
695 xfrmnl_user_tmpl_set_share (sputmpl, tmpl->share);
696 xfrmnl_user_tmpl_set_optional (sputmpl, tmpl->optional);
697 xfrmnl_user_tmpl_set_aalgos (sputmpl, tmpl->aalgos);
698 xfrmnl_user_tmpl_set_ealgos (sputmpl, tmpl->ealgos);
699 xfrmnl_user_tmpl_set_calgos (sputmpl, tmpl->calgos);
700 xfrmnl_sp_add_usertemplate (sp, sputmpl);
701
702 sp->ce_mask |= XFRM_SP_ATTR_TMPL;
703 }
704 }
705
706 if (tb[XFRMA_MARK]) {
707 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
708 sp->mark.m = m->m;
709 sp->mark.v = m->v;
710 sp->ce_mask |= XFRM_SP_ATTR_MARK;
711 }
712
713 *result = sp;
714 return 0;
715
716errout:
717 xfrmnl_sp_put(sp);
718 return err;
719}
720
721static int xfrm_sp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
722 struct nlmsghdr *n, struct nl_parser_param *pp)
723{
724 struct xfrmnl_sp* sp;
725 int err;
726
727 if ((err = xfrmnl_sp_parse(n, &sp)) < 0)
728 {
729 printf ("received error: %d \n", err);
730 return err;
731 }
732
733 err = pp->pp_cb((struct nl_object *) sp, pp);
734
735 xfrmnl_sp_put(sp);
736 return err;
737}
738
739/**
740 * @name XFRM SP Get
741 * @{
742 */
743
744int xfrmnl_sp_build_get_request(unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
745{
746 struct nl_msg *msg;
747 struct xfrm_userpolicy_id spid;
748 struct xfrm_mark mark;
749
750 memset(&spid, 0, sizeof(spid));
751 spid.index = index;
752 spid.dir = dir;
753
754 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETPOLICY, 0)))
755 return -NLE_NOMEM;
756
757 if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
758 goto nla_put_failure;
759
760 if ((mark_m & mark_v) != 0)
761 {
762 memset(&mark, 0, sizeof(struct xfrm_mark));
763 mark.m = mark_m;
764 mark.v = mark_v;
765
766 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
767 }
768
769 *result = msg;
770 return 0;
771
772nla_put_failure:
773 nlmsg_free(msg);
774 return -NLE_MSGSIZE;
775}
776
777int xfrmnl_sp_get_kernel(struct nl_sock* sock, unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sp** result)
778{
779 struct nl_msg *msg = NULL;
780 struct nl_object *obj;
781 int err;
782
783 if ((err = xfrmnl_sp_build_get_request(index, dir, mark_m, mark_v, &msg)) < 0)
784 return err;
785
786 err = nl_send_auto(sock, msg);
787 nlmsg_free(msg);
788 if (err < 0)
789 return err;
790
791 if ((err = nl_pickup(sock, &xfrm_sp_msg_parser, &obj)) < 0)
792 return err;
793
794 /* We have used xfrm_sp_msg_parser(), object is definitely a xfrm ae */
795 *result = (struct xfrmnl_sp *) obj;
796
797 /* If an object has been returned, we also need to wait for the ACK */
798 if (err == 0 && obj)
799 nl_wait_for_ack(sock);
800
801 return 0;
802}
803
804/** @} */
805
806static int build_xfrm_sp_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
807{
808 struct nl_msg* msg;
809 struct xfrm_userpolicy_info sp_info;
810 uint32_t len;
811 struct nl_addr* addr;
812
813 if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
814 (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
815 !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
816 return -NLE_MISSING_ATTR;
817
818 memset ((void*)&sp_info, 0, sizeof (sp_info));
819 if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
820 {
821 addr = xfrmnl_sel_get_daddr (tmpl->sel);
822 memcpy ((void*)&sp_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
823 addr = xfrmnl_sel_get_saddr (tmpl->sel);
824 memcpy ((void*)&sp_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
825 sp_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
826 sp_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
827 sp_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
828 sp_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
829 sp_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
830 sp_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
831 sp_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
832 sp_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
833 sp_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
834 sp_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
835 }
836
837 if (tmpl->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
838 {
839 sp_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
840 sp_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
841 sp_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
842 sp_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
843 sp_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
844 sp_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
845 sp_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
846 sp_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
847 }
848
849 //Skip current lifetime: cur lifetime can be updated only via AE
850
851 if (tmpl->ce_mask & XFRM_SP_ATTR_PRIO)
852 sp_info.priority = tmpl->priority;
853
854 if (tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
855 sp_info.index = tmpl->index;
856
857 if (tmpl->ce_mask & XFRM_SP_ATTR_DIR)
858 sp_info.dir = tmpl->dir;
859
860 if (tmpl->ce_mask & XFRM_SP_ATTR_ACTION)
861 sp_info.action = tmpl->action;
862
863 if (tmpl->ce_mask & XFRM_SP_ATTR_FLAGS)
864 sp_info.flags = tmpl->flags;
865
866 if (tmpl->ce_mask & XFRM_SP_ATTR_SHARE)
867 sp_info.share = tmpl->share;
868
869 msg = nlmsg_alloc_simple(cmd, flags);
870 if (!msg)
871 return -NLE_NOMEM;
872
873 if (nlmsg_append(msg, &sp_info, sizeof(sp_info), NLMSG_ALIGNTO) < 0)
874 goto nla_put_failure;
875
876 if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
877 len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
878 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
879 }
880
881 if (tmpl->ce_mask & XFRM_SP_ATTR_POLTYPE) {
882 len = sizeof (struct xfrm_userpolicy_type);
883 NLA_PUT (msg, XFRMA_POLICY_TYPE, len, &tmpl->uptype);
884 }
885
886 if (tmpl->ce_mask & XFRM_SP_ATTR_TMPL) {
887 struct nlattr* tmpls;
888 struct xfrmnl_user_tmpl* utmpl;
889 struct nl_addr* addr;
890
891 if (!(tmpls = nla_nest_start(msg, XFRMA_TMPL)))
892 goto nla_put_failure;
893
894 nl_list_for_each_entry(utmpl, &tmpl->usertmpl_list, utmpl_list) {
895 struct xfrm_user_tmpl* tmpl;
896
897 tmpl = nlmsg_reserve(msg, sizeof(*tmpl), NLMSG_ALIGNTO);
898 if (!tmpl)
899 goto nla_put_failure;
900 addr = xfrmnl_user_tmpl_get_daddr (utmpl);
901 memcpy ((void *)&tmpl->id.daddr, nl_addr_get_binary_addr (addr),
902 nl_addr_get_len (addr));
903 tmpl->id.spi = htonl(xfrmnl_user_tmpl_get_spi (utmpl));
904 tmpl->id.proto = xfrmnl_user_tmpl_get_proto (utmpl);
905 tmpl->family = xfrmnl_user_tmpl_get_family (utmpl);
906 addr = xfrmnl_user_tmpl_get_saddr (utmpl);
907 memcpy ((void *)&tmpl->saddr, nl_addr_get_binary_addr (addr),
908 nl_addr_get_len (addr));
909 tmpl->reqid = xfrmnl_user_tmpl_get_reqid (utmpl);
910 tmpl->mode = xfrmnl_user_tmpl_get_mode (utmpl);
911 tmpl->share = xfrmnl_user_tmpl_get_share (utmpl);
912 tmpl->optional = xfrmnl_user_tmpl_get_optional (utmpl);
913 tmpl->aalgos = xfrmnl_user_tmpl_get_aalgos (utmpl);
914 tmpl->ealgos = xfrmnl_user_tmpl_get_ealgos (utmpl);
915 tmpl->calgos = xfrmnl_user_tmpl_get_calgos (utmpl);
916 }
917 nla_nest_end(msg, tmpls);
918 }
919
920 if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
921 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
922 }
923
924 *result = msg;
925 return 0;
926
927nla_put_failure:
928 nlmsg_free(msg);
929 return -NLE_MSGSIZE;
930}
931
932/**
933 * @name XFRM SP Add
934 * @{
935 */
936
937int xfrmnl_sp_build_add_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
938{
939 return build_xfrm_sp_message (tmpl, XFRM_MSG_NEWPOLICY, flags, result);
940}
941
942int xfrmnl_sp_add(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
943{
944 int err;
945 struct nl_msg *msg;
946
947 if ((err = xfrmnl_sp_build_add_request(tmpl, flags, &msg)) < 0)
948 return err;
949
950 err = nl_send_auto_complete(sk, msg);
951 nlmsg_free(msg);
952 if (err < 0)
953 return err;
954
955 return nl_wait_for_ack(sk);
956}
957
958/**
959 * @name XFRM SP Update
960 * @{
961 */
962
963int xfrmnl_sp_build_update_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
964{
965 return build_xfrm_sp_message (tmpl, XFRM_MSG_UPDPOLICY, flags, result);
966}
967
968int xfrmnl_sp_update(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
969{
970 int err;
971 struct nl_msg *msg;
972
973 if ((err = xfrmnl_sp_build_update_request(tmpl, flags, &msg)) < 0)
974 return err;
975
976 err = nl_send_auto_complete(sk, msg);
977 nlmsg_free(msg);
978 if (err < 0)
979 return err;
980
981 return nl_wait_for_ack(sk);
982}
983
984/** @} */
985
986/**
987 * \brief Builds a xfrm_sp_delete_message. Uses either index and direction
988 * or security-context (not set is a valid value), selector and
989 * direction for identification.
990 * Returns error if necessary values aren't set.
991 *
992 * \param tmpl The policy template.
993 * \param cmd The command. Should be XFRM_MSG_DELPOLICY.
994 * \param flags Additional flags
995 * \param result Resulting message.
996 *
997 * \return 0 if successful, else error value < 0
998 */
999static int build_xfrm_sp_delete_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
1000{
1001 struct nl_msg* msg;
1002 struct xfrm_userpolicy_id spid;
1003 struct nl_addr* addr;
1004 uint32_t len;
1005
1006 if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
1007 (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
1008 !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
1009 return -NLE_MISSING_ATTR;
1010
1011 memset(&spid, 0, sizeof(spid));
1012 spid.dir = tmpl->dir;
1013 if(tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
1014 spid.index = tmpl->index;
1015
1016 if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
1017 {
1018 addr = xfrmnl_sel_get_daddr (tmpl->sel);
1019 memcpy ((void*)&spid.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1020 addr = xfrmnl_sel_get_saddr (tmpl->sel);
1021 memcpy ((void*)&spid.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1022 spid.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1023 spid.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1024 spid.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1025 spid.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1026 spid.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1027 spid.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1028 spid.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1029 spid.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1030 spid.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1031 spid.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1032 }
1033
1034 msg = nlmsg_alloc_simple(cmd, flags);
1035 if (!msg)
1036 return -NLE_NOMEM;
1037
1038 if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
1039 goto nla_put_failure;
1040
1041 if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
1042 len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
1043 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1044 }
1045
1046 if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
1047 len = sizeof (struct xfrm_mark);
1048 NLA_PUT (msg, XFRMA_MARK, len, &tmpl->mark);
1049 }
1050
1051 *result = msg;
1052 return 0;
1053
1054nla_put_failure:
1055 nlmsg_free(msg);
1056 return -NLE_MSGSIZE;
1057}
1058
1059/**
1060 * @name XFRM SA Delete
1061 * @{
1062 */
1063
1064int xfrmnl_sp_build_delete_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
1065{
1066 return build_xfrm_sp_delete_message (tmpl, XFRM_MSG_DELPOLICY, flags, result);
1067}
1068
1069int xfrmnl_sp_delete(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
1070{
1071 int err;
1072 struct nl_msg *msg;
1073
1074 if ((err = xfrmnl_sp_build_delete_request(tmpl, flags, &msg)) < 0)
1075 return err;
1076
1077 err = nl_send_auto_complete(sk, msg);
1078 nlmsg_free(msg);
1079 if (err < 0)
1080 return err;
1081
1082 return nl_wait_for_ack(sk);
1083}
1084
1085/** @} */
1086
1087
1088/**
1089 * @name Attributes
1090 * @{
1091 */
1092
1093struct xfrmnl_sel* xfrmnl_sp_get_sel (struct xfrmnl_sp* sp)
1094{
1095 if (sp->ce_mask & XFRM_SP_ATTR_SEL)
1096 return sp->sel;
1097 else
1098 return NULL;
1099}
1100
1101int xfrmnl_sp_set_sel (struct xfrmnl_sp* sp, struct xfrmnl_sel* sel)
1102{
1103 /* Release any previously held selector object from the SP */
1104 if (sp->sel)
1105 xfrmnl_sel_put (sp->sel);
1106
1107 /* Increment ref count on new selector and save it in the SP */
1108 xfrmnl_sel_get (sel);
1109 sp->sel = sel;
1110 sp->ce_mask |= XFRM_SP_ATTR_SEL;
1111
1112 return 0;
1113}
1114
1115struct xfrmnl_ltime_cfg* xfrmnl_sp_get_lifetime_cfg (struct xfrmnl_sp* sp)
1116{
1117 if (sp->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
1118 return sp->lft;
1119 else
1120 return NULL;
1121}
1122
1123int xfrmnl_sp_set_lifetime_cfg (struct xfrmnl_sp* sp, struct xfrmnl_ltime_cfg* ltime)
1124{
1125 /* Release any previously held lifetime cfg object from the SP */
1126 if (sp->lft)
1127 xfrmnl_ltime_cfg_put (sp->lft);
1128
1129 /* Increment ref count on new lifetime object and save it in the SP */
1130 xfrmnl_ltime_cfg_get (ltime);
1131 sp->lft = ltime;
1132 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
1133
1134 return 0;
1135}
1136
1137int xfrmnl_sp_get_curlifetime (struct xfrmnl_sp* sp, unsigned long long int* curr_bytes,
1138 unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1139{
1140 if (sp == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1141 return -1;
1142
1143 *curr_bytes = sp->curlft.bytes;
1144 *curr_packets = sp->curlft.packets;
1145 *curr_add_time = sp->curlft.add_time;
1146 *curr_use_time = sp->curlft.use_time;
1147
1148 return 0;
1149}
1150
1151int xfrmnl_sp_get_priority (struct xfrmnl_sp* sp)
1152{
1153 if (sp->ce_mask & XFRM_SP_ATTR_PRIO)
1154 return sp->priority;
1155 else
1156 return -1;
1157}
1158
1159int xfrmnl_sp_set_priority (struct xfrmnl_sp* sp, unsigned int prio)
1160{
1161 sp->priority = prio;
1162 sp->ce_mask |= XFRM_SP_ATTR_PRIO;
1163
1164 return 0;
1165}
1166
1167int xfrmnl_sp_get_index (struct xfrmnl_sp* sp)
1168{
1169 if (sp->ce_mask & XFRM_SP_ATTR_INDEX)
1170 return sp->index;
1171 else
1172 return -1;
1173}
1174
1175int xfrmnl_sp_set_index (struct xfrmnl_sp* sp, unsigned int index)
1176{
1177 sp->index = index;
1178 sp->ce_mask |= XFRM_SP_ATTR_INDEX;
1179
1180 return 0;
1181}
1182
1183int xfrmnl_sp_get_dir (struct xfrmnl_sp* sp)
1184{
1185 if (sp->ce_mask & XFRM_SP_ATTR_DIR)
1186 return sp->dir;
1187 else
1188 return -1;
1189}
1190
1191int xfrmnl_sp_set_dir (struct xfrmnl_sp* sp, unsigned int dir)
1192{
1193 sp->dir = dir;
1194 sp->ce_mask |= XFRM_SP_ATTR_DIR;
1195
1196 return 0;
1197}
1198
1199int xfrmnl_sp_get_action (struct xfrmnl_sp* sp)
1200{
1201 if (sp->ce_mask & XFRM_SP_ATTR_ACTION)
1202 return sp->action;
1203 else
1204 return -1;
1205}
1206
1207int xfrmnl_sp_set_action (struct xfrmnl_sp* sp, unsigned int action)
1208{
1209 sp->action = action;
1210 sp->ce_mask |= XFRM_SP_ATTR_ACTION;
1211
1212 return 0;
1213}
1214
1215int xfrmnl_sp_get_flags (struct xfrmnl_sp* sp)
1216{
1217 if (sp->ce_mask & XFRM_SP_ATTR_FLAGS)
1218 return sp->flags;
1219 else
1220 return -1;
1221}
1222
1223int xfrmnl_sp_set_flags (struct xfrmnl_sp* sp, unsigned int flags)
1224{
1225 sp->flags = flags;
1226 sp->ce_mask |= XFRM_SP_ATTR_FLAGS;
1227
1228 return 0;
1229}
1230
1231int xfrmnl_sp_get_share (struct xfrmnl_sp* sp)
1232{
1233 if (sp->ce_mask & XFRM_SP_ATTR_SHARE)
1234 return sp->share;
1235 else
1236 return -1;
1237}
1238
1239int xfrmnl_sp_set_share (struct xfrmnl_sp* sp, unsigned int share)
1240{
1241 sp->share = share;
1242 sp->ce_mask |= XFRM_SP_ATTR_SHARE;
1243
1244 return 0;
1245}
1246
1247/**
1248 * Get the security context.
1249 *
1250 * @arg sp The xfrmnl_sp object.
1251 * @arg len An optional output value for the ctx_str length including the xfrmnl_sp header.
1252 * @arg exttype An optional output value.
1253 * @arg alg An optional output value for the security context algorithm.
1254 * @arg doi An optional output value for the security context domain of interpretation.
1255 * @arg ctx_len An optional output value for the security context length, including the
1256 * terminating null byte ('\0').
1257 * @arg ctx_str An optional buffer large enough for the security context string. It must
1258 * contain at least @ctx_len bytes. You are advised to create the ctx_str
1259 * buffer one element larger and ensure NUL termination yourself.
1260 *
1261 * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
1262 * call xfrmnl_sp_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
1263 * This modified API is available in all versions of libnl3 that support the capability
1264 * @def NL_CAPABILITY_XFRM_SP_SEC_CTX_LEN (@see nl_has_capability for further information).
1265 *
1266 * @return 0 on success or a negative error code.
1267 */
1268int xfrmnl_sp_get_sec_ctx (struct xfrmnl_sp* sp, unsigned int* len, unsigned int* exttype, unsigned int* alg, unsigned int* doi, unsigned int* ctx_len, char* ctx_str)
1269{
1270 if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
1271 {
1272 if (len)
1273 *len = sizeof (struct xfrmnl_user_sec_ctx) + sp->sec_ctx->ctx_len;
1274 if (exttype)
1275 *exttype = sp->sec_ctx->exttype;
1276 if (alg)
1277 *alg = sp->sec_ctx->ctx_alg;
1278 if (doi)
1279 *doi = sp->sec_ctx->ctx_doi;
1280 if (ctx_len)
1281 *ctx_len = sp->sec_ctx->ctx_len;
1282 if (ctx_str)
1283 memcpy ((void *)ctx_str, (void *)sp->sec_ctx->ctx, sp->sec_ctx->ctx_len);
1284 }
1285 else
1286 return -1;
1287
1288 return 0;
1289}
1290/**
1291 * @brief Set security context (ctx_str) for XFRM Polixy.
1292 *
1293 * @param sp XFRM Policy
1294 * @param len !!! depricated unused parameter !!!
1295 * @param exttype netlink message attribute - probably XFRMA_SEC_CTX
1296 * @param alg security context algorithm
1297 * @param doi security context domain interpretation
1298 * @param ctx_len Length of the context string.
1299 * @param ctx_str The context string.
1300 *
1301 * @return 0 if sucessfull, else -1
1302 */
1303int xfrmnl_sp_set_sec_ctx (struct xfrmnl_sp* sp, unsigned int len __attribute__((unused)), unsigned int exttype, unsigned int alg, unsigned int doi, unsigned int ctx_len, char* ctx_str)
1304{
1305 /* Free up the old context string and allocate new one */
1306 if (sp->sec_ctx)
1307 free (sp->sec_ctx);
1308 if ((sp->sec_ctx = calloc (1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + ctx_len)) == NULL)
1309 return -1;
1310
1311 /* Save the new info */
1312 sp->sec_ctx->len = sizeof (struct xfrmnl_user_sec_ctx) + ctx_len;
1313 sp->sec_ctx->exttype = exttype;
1314 sp->sec_ctx->ctx_alg = alg;
1315 sp->sec_ctx->ctx_doi = doi;
1316 sp->sec_ctx->ctx_len = ctx_len;
1317 memcpy ((void *)sp->sec_ctx->ctx, (void *)ctx_str, ctx_len);
1318 sp->sec_ctx->ctx[ctx_len] = '\0';
1319
1320 sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
1321
1322 return 0;
1323}
1324
1325int xfrmnl_sp_get_userpolicy_type (struct xfrmnl_sp* sp)
1326{
1327 if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
1328 return sp->uptype.type;
1329 else
1330 return -1;
1331}
1332
1333int xfrmnl_sp_set_userpolicy_type (struct xfrmnl_sp* sp, unsigned int type)
1334{
1335 sp->uptype.type = type;
1336 sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
1337
1338 return 0;
1339}
1340
1341void xfrmnl_sp_add_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1342{
1343 nl_list_add_tail(&utmpl->utmpl_list, &sp->usertmpl_list);
1344 sp->nr_user_tmpl++;
1345 sp->ce_mask |= XFRM_SP_ATTR_TMPL;
1346}
1347
1348void xfrmnl_sp_remove_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1349{
1350 if (sp->ce_mask & XFRM_SP_ATTR_TMPL) {
1351 sp->nr_user_tmpl--;
1352 nl_list_del(&utmpl->utmpl_list);
1353 }
1354}
1355
1356struct nl_list_head *xfrmnl_sp_get_usertemplates(struct xfrmnl_sp *sp)
1357{
1358 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1359 return &sp->usertmpl_list;
1360
1361 return NULL;
1362}
1363
1364int xfrmnl_sp_get_nusertemplates(struct xfrmnl_sp *sp)
1365{
1366 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1367 return sp->nr_user_tmpl;
1368
1369 return 0;
1370}
1371
1372void xfrmnl_sp_foreach_usertemplate(struct xfrmnl_sp *r,
1373 void (*cb)(struct xfrmnl_user_tmpl *, void *),
1374 void *arg)
1375{
1376 struct xfrmnl_user_tmpl *utmpl;
1377
1378 if (r->ce_mask & XFRM_SP_ATTR_TMPL) {
1379 nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1380 cb(utmpl, arg);
1381 }
1382 }
1383}
1384
1385struct xfrmnl_user_tmpl *xfrmnl_sp_usertemplate_n(struct xfrmnl_sp *r, int n)
1386{
1387 struct xfrmnl_user_tmpl *utmpl;
1388 uint32_t i;
1389
1390 if (r->ce_mask & XFRM_SP_ATTR_TMPL && r->nr_user_tmpl > n) {
1391 i = 0;
1392 nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1393 if (i == n) return utmpl;
1394 i++;
1395 }
1396 }
1397 return NULL;
1398}
1399
1400int xfrmnl_sp_get_mark (struct xfrmnl_sp* sp, unsigned int* mark_mask, unsigned int* mark_value)
1401{
1402 if (mark_mask == NULL || mark_value == NULL)
1403 return -1;
1404
1405 if (sp->ce_mask & XFRM_SP_ATTR_MARK)
1406 {
1407 *mark_mask = sp->mark.m;
1408 *mark_value = sp->mark.v;
1409
1410 return 0;
1411 }
1412 else
1413 return -1;
1414}
1415
1416int xfrmnl_sp_set_mark (struct xfrmnl_sp* sp, unsigned int value, unsigned int mask)
1417{
1418 sp->mark.v = value;
1419 sp->mark.m = mask;
1420 sp->ce_mask |= XFRM_SP_ATTR_MARK;
1421
1422 return 0;
1423}
1424
1425/** @} */
1426
1427static struct nl_object_ops xfrm_sp_obj_ops = {
1428 .oo_name = "xfrm/sp",
1429 .oo_size = sizeof(struct xfrmnl_sp),
1430 .oo_constructor = xfrm_sp_alloc_data,
1431 .oo_free_data = xfrm_sp_free_data,
1432 .oo_clone = xfrm_sp_clone,
1433 .oo_dump = {
1434 [NL_DUMP_LINE] = xfrm_sp_dump_line,
1435 [NL_DUMP_DETAILS] = xfrm_sp_dump_details,
1436 [NL_DUMP_STATS] = xfrm_sp_dump_stats,
1437 },
1438 .oo_compare = xfrm_sp_compare,
1439 .oo_attrs2str = xfrm_sp_attrs2str,
1440 .oo_id_attrs = (XFRM_SP_ATTR_SEL | XFRM_SP_ATTR_INDEX | XFRM_SP_ATTR_DIR),
1441};
1442
1443static struct nl_af_group xfrm_sp_groups[] = {
1444 { AF_UNSPEC, XFRMNLGRP_POLICY },
1445 { END_OF_GROUP_LIST },
1446};
1447
1448static struct nl_cache_ops xfrmnl_sp_ops = {
1449 .co_name = "xfrm/sp",
1450 .co_hdrsize = sizeof(struct xfrm_userpolicy_info),
1451 .co_msgtypes = {
1452 { XFRM_MSG_NEWPOLICY, NL_ACT_NEW, "new" },
1453 { XFRM_MSG_DELPOLICY, NL_ACT_DEL, "del" },
1454 { XFRM_MSG_GETPOLICY, NL_ACT_GET, "get" },
1455 { XFRM_MSG_UPDPOLICY, NL_ACT_NEW, "update" },
1456 END_OF_MSGTYPES_LIST,
1457 },
1458 .co_protocol = NETLINK_XFRM,
1459 .co_groups = xfrm_sp_groups,
1460 .co_request_update = xfrm_sp_request_update,
1461 .co_msg_parser = xfrm_sp_msg_parser,
1462 .co_obj_ops = &xfrm_sp_obj_ops,
1463};
1464
1465/**
1466 * @name XFRM SA Cache Managament
1467 * @{
1468 */
1469
1470static void __attribute__ ((constructor)) xfrm_sp_init(void)
1471{
1472 nl_cache_mngt_register(&xfrmnl_sp_ops);
1473}
1474
1475static void __attribute__ ((destructor)) xfrm_sp_exit(void)
1476{
1477 nl_cache_mngt_unregister(&xfrmnl_sp_ops);
1478}
1479
1480/** @} */
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_clone(struct xfrmnl_user_tmpl *utmpl)
Clone existing user template object.
Definition: template.c:95
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:180
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:79
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:159
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:98
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:96
int xfrmnl_user_tmpl_cmp(struct xfrmnl_user_tmpl *a, struct xfrmnl_user_tmpl *b)
Compares two user template objects.
Definition: template.c:148
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:115
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_alloc()
Allocate new user template object.
Definition: template.c:76
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:969
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:216
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:945
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:1003
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:957
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:119
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
struct nlattr * nla_nest_start(struct nl_msg *msg, int attrtype)
Start a new level of nested attributes.
Definition: attr.c:906
int nla_len(const struct nlattr *nla)
Return length of the payload .
Definition: attr.c:130
int nla_nest_end(struct nl_msg *msg, struct nlattr *start)
Finalize nesting of attributes.
Definition: attr.c:969
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:287
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:252
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:146
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:234
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:120
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:349
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:108
void * nlmsg_reserve(struct nl_msg *n, size_t len, int pad)
Reserve room for additional data in a netlink message.
Definition: msg.c:412
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:566
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:216
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:450
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:221
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:210
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:55
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:515
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1246
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1177
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1111
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:579
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:1017
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:22
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:20
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:21
Dumping parameters.
Definition: types.h:32
Attribute validation policy.
Definition: attr.h:63
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68
Definition: sp.c:63