libnl 3.8.0
sa.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36/**
37 * @ingroup xfrmnl
38 * @defgroup sa Security Association
39 * @brief
40 */
41
42#include "nl-default.h"
43
44#include <time.h>
45
46#include <netlink/netlink.h>
47#include <netlink/cache.h>
48#include <netlink/object.h>
49#include <netlink/xfrm/sa.h>
50#include <netlink/xfrm/selector.h>
51#include <netlink/xfrm/lifetime.h>
52
53#include "nl-xfrm.h"
54#include "nl-priv-dynamic-core/object-api.h"
55#include "nl-priv-dynamic-core/nl-core.h"
56#include "nl-priv-dynamic-core/cache-api.h"
57
58/** @cond SKIP */
59
60struct xfrmnl_stats {
61 uint32_t replay_window;
62 uint32_t replay;
63 uint32_t integrity_failed;
64};
65
66struct xfrmnl_algo_aead {
67 char alg_name[64];
68 uint32_t alg_key_len; /* in bits */
69 uint32_t alg_icv_len; /* in bits */
70 char alg_key[0];
71};
72
73struct xfrmnl_algo_auth {
74 char alg_name[64];
75 uint32_t alg_key_len; /* in bits */
76 uint32_t alg_trunc_len; /* in bits */
77 char alg_key[0];
78};
79
80struct xfrmnl_algo {
81 char alg_name[64];
82 uint32_t alg_key_len; /* in bits */
83 char alg_key[0];
84};
85
86struct xfrmnl_encap_tmpl {
87 uint16_t encap_type;
88 uint16_t encap_sport;
89 uint16_t encap_dport;
90 struct nl_addr* encap_oa;
91};
92
93struct xfrmnl_user_offload {
94 int ifindex;
95 uint8_t flags;
96};
97
98struct xfrmnl_sa {
99 NLHDR_COMMON
100
101 struct xfrmnl_sel* sel;
102 struct xfrmnl_id id;
103 struct nl_addr* saddr;
104 struct xfrmnl_ltime_cfg* lft;
105 struct xfrmnl_lifetime_cur curlft;
106 struct xfrmnl_stats stats;
107 uint32_t seq;
108 uint32_t reqid;
109 uint16_t family;
110 uint8_t mode; /* XFRM_MODE_xxx */
111 uint8_t replay_window;
112 uint8_t flags;
113 struct xfrmnl_algo_aead* aead;
114 struct xfrmnl_algo_auth* auth;
115 struct xfrmnl_algo* crypt;
116 struct xfrmnl_algo* comp;
117 struct xfrmnl_encap_tmpl* encap;
118 uint32_t tfcpad;
119 struct nl_addr* coaddr;
120 struct xfrmnl_mark mark;
121 struct xfrmnl_user_sec_ctx* sec_ctx;
122 uint32_t replay_maxage;
123 uint32_t replay_maxdiff;
124 struct xfrmnl_replay_state replay_state;
125 struct xfrmnl_replay_state_esn* replay_state_esn;
126 uint8_t hard;
127 struct xfrmnl_user_offload* user_offload;
128};
129
130#define XFRM_SA_ATTR_SEL 0x01
131#define XFRM_SA_ATTR_DADDR 0x02
132#define XFRM_SA_ATTR_SPI 0x04
133#define XFRM_SA_ATTR_PROTO 0x08
134#define XFRM_SA_ATTR_SADDR 0x10
135#define XFRM_SA_ATTR_LTIME_CFG 0x20
136#define XFRM_SA_ATTR_LTIME_CUR 0x40
137#define XFRM_SA_ATTR_STATS 0x80
138#define XFRM_SA_ATTR_SEQ 0x100
139#define XFRM_SA_ATTR_REQID 0x200
140#define XFRM_SA_ATTR_FAMILY 0x400
141#define XFRM_SA_ATTR_MODE 0x800
142#define XFRM_SA_ATTR_REPLAY_WIN 0x1000
143#define XFRM_SA_ATTR_FLAGS 0x2000
144#define XFRM_SA_ATTR_ALG_AEAD 0x4000
145#define XFRM_SA_ATTR_ALG_AUTH 0x8000
146#define XFRM_SA_ATTR_ALG_CRYPT 0x10000
147#define XFRM_SA_ATTR_ALG_COMP 0x20000
148#define XFRM_SA_ATTR_ENCAP 0x40000
149#define XFRM_SA_ATTR_TFCPAD 0x80000
150#define XFRM_SA_ATTR_COADDR 0x100000
151#define XFRM_SA_ATTR_MARK 0x200000
152#define XFRM_SA_ATTR_SECCTX 0x400000
153#define XFRM_SA_ATTR_REPLAY_MAXAGE 0x800000
154#define XFRM_SA_ATTR_REPLAY_MAXDIFF 0x1000000
155#define XFRM_SA_ATTR_REPLAY_STATE 0x2000000
156#define XFRM_SA_ATTR_EXPIRE 0x4000000
157#define XFRM_SA_ATTR_OFFLOAD_DEV 0x8000000
158
159static struct nl_cache_ops xfrmnl_sa_ops;
160static struct nl_object_ops xfrm_sa_obj_ops;
161/** @endcond */
162
163static void xfrm_sa_alloc_data(struct nl_object *c)
164{
165 struct xfrmnl_sa* sa = nl_object_priv (c);
166
167 if ((sa->sel = xfrmnl_sel_alloc ()) == NULL)
168 return;
169
170 if ((sa->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
171 return;
172}
173
174static void xfrm_sa_free_data(struct nl_object *c)
175{
176 struct xfrmnl_sa* sa = nl_object_priv (c);
177
178 if (sa == NULL)
179 return;
180
181 xfrmnl_sel_put (sa->sel);
182 xfrmnl_ltime_cfg_put (sa->lft);
183 nl_addr_put (sa->id.daddr);
184 nl_addr_put (sa->saddr);
185
186 if (sa->aead)
187 free (sa->aead);
188 if (sa->auth)
189 free (sa->auth);
190 if (sa->crypt)
191 free (sa->crypt);
192 if (sa->comp)
193 free (sa->comp);
194 if (sa->encap) {
195 if (sa->encap->encap_oa)
196 nl_addr_put(sa->encap->encap_oa);
197 free(sa->encap);
198 }
199 if (sa->coaddr)
200 nl_addr_put (sa->coaddr);
201 if (sa->sec_ctx)
202 free (sa->sec_ctx);
203 if (sa->replay_state_esn)
204 free (sa->replay_state_esn);
205 if (sa->user_offload)
206 free(sa->user_offload);
207}
208
209static int xfrm_sa_clone(struct nl_object *_dst, struct nl_object *_src)
210{
211 struct xfrmnl_sa* dst = nl_object_priv(_dst);
212 struct xfrmnl_sa* src = nl_object_priv(_src);
213 uint32_t len = 0;
214
215 dst->sel = NULL;
216 dst->id.daddr = NULL;
217 dst->saddr = NULL;
218 dst->lft = NULL;
219 dst->aead = NULL;
220 dst->auth = NULL;
221 dst->crypt = NULL;
222 dst->comp = NULL;
223 dst->encap = NULL;
224 dst->coaddr = NULL;
225 dst->sec_ctx = NULL;
226 dst->replay_state_esn = NULL;
227 dst->user_offload = NULL;
228
229 if (src->sel)
230 if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
231 return -NLE_NOMEM;
232
233 if (src->lft)
234 if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
235 return -NLE_NOMEM;
236
237 if (src->id.daddr)
238 if ((dst->id.daddr = nl_addr_clone (src->id.daddr)) == NULL)
239 return -NLE_NOMEM;
240
241 if (src->saddr)
242 if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
243 return -NLE_NOMEM;
244
245 if (src->aead) {
246 len = sizeof (struct xfrmnl_algo_aead) + ((src->aead->alg_key_len + 7) / 8);
247 if ((dst->aead = calloc (1, len)) == NULL)
248 return -NLE_NOMEM;
249 memcpy ((void *)dst->aead, (void *)src->aead, len);
250 }
251
252 if (src->auth) {
253 len = sizeof (struct xfrmnl_algo_auth) + ((src->auth->alg_key_len + 7) / 8);
254 if ((dst->auth = calloc (1, len)) == NULL)
255 return -NLE_NOMEM;
256 memcpy ((void *)dst->auth, (void *)src->auth, len);
257 }
258
259 if (src->crypt) {
260 len = sizeof (struct xfrmnl_algo) + ((src->crypt->alg_key_len + 7) / 8);
261 if ((dst->crypt = calloc (1, len)) == NULL)
262 return -NLE_NOMEM;
263 memcpy ((void *)dst->crypt, (void *)src->crypt, len);
264 }
265
266 if (src->comp) {
267 len = sizeof (struct xfrmnl_algo) + ((src->comp->alg_key_len + 7) / 8);
268 if ((dst->comp = calloc (1, len)) == NULL)
269 return -NLE_NOMEM;
270 memcpy ((void *)dst->comp, (void *)src->comp, len);
271 }
272
273 if (src->encap) {
274 len = sizeof (struct xfrmnl_encap_tmpl);
275 if ((dst->encap = calloc (1, len)) == NULL)
276 return -NLE_NOMEM;
277 memcpy ((void *)dst->encap, (void *)src->encap, len);
278 }
279
280 if (src->coaddr)
281 if ((dst->coaddr = nl_addr_clone (src->coaddr)) == NULL)
282 return -NLE_NOMEM;
283
284 if (src->sec_ctx) {
285 len = sizeof (*src->sec_ctx) + src->sec_ctx->ctx_len;
286 if ((dst->sec_ctx = calloc (1, len)) == NULL)
287 return -NLE_NOMEM;
288 memcpy ((void *)dst->sec_ctx, (void *)src->sec_ctx, len);
289 }
290
291 if (src->replay_state_esn) {
292 len = sizeof (struct xfrmnl_replay_state_esn) + (src->replay_state_esn->bmp_len * sizeof (uint32_t));
293 if ((dst->replay_state_esn = calloc (1, len)) == NULL)
294 return -NLE_NOMEM;
295 memcpy ((void *)dst->replay_state_esn, (void *)src->replay_state_esn, len);
296 }
297
298 if (src->user_offload) {
299 dst->user_offload = _nl_memdup_ptr(src->user_offload);
300 if (!dst->user_offload)
301 return -NLE_NOMEM;
302 }
303
304 return 0;
305}
306
307static uint64_t xfrm_sa_compare(struct nl_object *_a, struct nl_object *_b,
308 uint64_t attrs, int flags)
309{
310 struct xfrmnl_sa* a = (struct xfrmnl_sa *) _a;
311 struct xfrmnl_sa* b = (struct xfrmnl_sa *) _b;
312 uint64_t diff = 0;
313 int found = 0;
314
315#define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
316 diff |= _DIFF(XFRM_SA_ATTR_SEL, xfrmnl_sel_cmp(a->sel, b->sel));
317 diff |= _DIFF(XFRM_SA_ATTR_DADDR,
318 nl_addr_cmp(a->id.daddr, b->id.daddr));
319 diff |= _DIFF(XFRM_SA_ATTR_SPI, a->id.spi != b->id.spi);
320 diff |= _DIFF(XFRM_SA_ATTR_PROTO, a->id.proto != b->id.proto);
321 diff |= _DIFF(XFRM_SA_ATTR_SADDR, nl_addr_cmp(a->saddr, b->saddr));
322 diff |= _DIFF(XFRM_SA_ATTR_LTIME_CFG,
323 xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
324 diff |= _DIFF(XFRM_SA_ATTR_REQID, a->reqid != b->reqid);
325 diff |= _DIFF(XFRM_SA_ATTR_FAMILY, a->family != b->family);
326 diff |= _DIFF(XFRM_SA_ATTR_MODE, a->mode != b->mode);
327 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_WIN,
328 a->replay_window != b->replay_window);
329 diff |= _DIFF(XFRM_SA_ATTR_FLAGS, a->flags != b->flags);
330 diff |= _DIFF(XFRM_SA_ATTR_ALG_AEAD,
331 (strcmp(a->aead->alg_name, b->aead->alg_name) ||
332 (a->aead->alg_key_len != b->aead->alg_key_len) ||
333 (a->aead->alg_icv_len != b->aead->alg_icv_len) ||
334 memcmp(a->aead->alg_key, b->aead->alg_key,
335 ((a->aead->alg_key_len + 7) / 8))));
336 diff |= _DIFF(XFRM_SA_ATTR_ALG_AUTH,
337 (strcmp(a->auth->alg_name, b->auth->alg_name) ||
338 (a->auth->alg_key_len != b->auth->alg_key_len) ||
339 (a->auth->alg_trunc_len != b->auth->alg_trunc_len) ||
340 memcmp(a->auth->alg_key, b->auth->alg_key,
341 ((a->auth->alg_key_len + 7) / 8))));
342 diff |= _DIFF(XFRM_SA_ATTR_ALG_CRYPT,
343 (strcmp(a->crypt->alg_name, b->crypt->alg_name) ||
344 (a->crypt->alg_key_len != b->crypt->alg_key_len) ||
345 memcmp(a->crypt->alg_key, b->crypt->alg_key,
346 ((a->crypt->alg_key_len + 7) / 8))));
347 diff |= _DIFF(XFRM_SA_ATTR_ALG_COMP,
348 (strcmp(a->comp->alg_name, b->comp->alg_name) ||
349 (a->comp->alg_key_len != b->comp->alg_key_len) ||
350 memcmp(a->comp->alg_key, b->comp->alg_key,
351 ((a->comp->alg_key_len + 7) / 8))));
352 diff |= _DIFF(XFRM_SA_ATTR_ENCAP,
353 ((a->encap->encap_type != b->encap->encap_type) ||
354 (a->encap->encap_sport != b->encap->encap_sport) ||
355 (a->encap->encap_dport != b->encap->encap_dport) ||
356 nl_addr_cmp(a->encap->encap_oa, b->encap->encap_oa)));
357 diff |= _DIFF(XFRM_SA_ATTR_TFCPAD, a->tfcpad != b->tfcpad);
358 diff |= _DIFF(XFRM_SA_ATTR_COADDR, nl_addr_cmp(a->coaddr, b->coaddr));
359 diff |= _DIFF(XFRM_SA_ATTR_MARK,
360 (a->mark.m != b->mark.m) || (a->mark.v != b->mark.v));
361 diff |= _DIFF(XFRM_SA_ATTR_SECCTX,
362 ((a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
363 (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
364 (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
365 strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
366 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_MAXAGE,
367 a->replay_maxage != b->replay_maxage);
368 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_MAXDIFF,
369 a->replay_maxdiff != b->replay_maxdiff);
370 diff |= _DIFF(XFRM_SA_ATTR_EXPIRE, a->hard != b->hard);
371
372 /* Compare replay states */
373 found = AVAILABLE_MISMATCH (a, b, XFRM_SA_ATTR_REPLAY_STATE);
374 if (found == 0) // attribute exists in both objects
375 {
376 if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
377 ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
378 found |= 1;
379
380 if (found == 0) // same replay type. compare actual values
381 {
382 if (a->replay_state_esn)
383 {
384 if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
385 diff |= 1;
386 else
387 {
388 uint32_t len = sizeof (struct xfrmnl_replay_state_esn) +
389 (a->replay_state_esn->bmp_len * sizeof (uint32_t));
390 diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
391 }
392 }
393 else
394 {
395 if ((a->replay_state.oseq != b->replay_state.oseq) ||
396 (a->replay_state.seq != b->replay_state.seq) ||
397 (a->replay_state.bitmap != b->replay_state.bitmap))
398 diff |= 1;
399 }
400 }
401 }
402#undef _DIFF
403
404 return diff;
405}
406
407/**
408 * @name XFRM SA Attribute Translations
409 * @{
410 */
411static const struct trans_tbl sa_attrs[] = {
412 __ADD(XFRM_SA_ATTR_SEL, selector),
413 __ADD(XFRM_SA_ATTR_DADDR, daddr),
414 __ADD(XFRM_SA_ATTR_SPI, spi),
415 __ADD(XFRM_SA_ATTR_PROTO, proto),
416 __ADD(XFRM_SA_ATTR_SADDR, saddr),
417 __ADD(XFRM_SA_ATTR_LTIME_CFG, lifetime_cfg),
418 __ADD(XFRM_SA_ATTR_LTIME_CUR, lifetime_cur),
419 __ADD(XFRM_SA_ATTR_STATS, stats),
420 __ADD(XFRM_SA_ATTR_SEQ, seqnum),
421 __ADD(XFRM_SA_ATTR_REQID, reqid),
422 __ADD(XFRM_SA_ATTR_FAMILY, family),
423 __ADD(XFRM_SA_ATTR_MODE, mode),
424 __ADD(XFRM_SA_ATTR_REPLAY_WIN, replay_window),
425 __ADD(XFRM_SA_ATTR_FLAGS, flags),
426 __ADD(XFRM_SA_ATTR_ALG_AEAD, alg_aead),
427 __ADD(XFRM_SA_ATTR_ALG_AUTH, alg_auth),
428 __ADD(XFRM_SA_ATTR_ALG_CRYPT, alg_crypto),
429 __ADD(XFRM_SA_ATTR_ALG_COMP, alg_comp),
430 __ADD(XFRM_SA_ATTR_ENCAP, encap),
431 __ADD(XFRM_SA_ATTR_TFCPAD, tfcpad),
432 __ADD(XFRM_SA_ATTR_COADDR, coaddr),
433 __ADD(XFRM_SA_ATTR_MARK, mark),
434 __ADD(XFRM_SA_ATTR_SECCTX, sec_ctx),
435 __ADD(XFRM_SA_ATTR_REPLAY_MAXAGE, replay_maxage),
436 __ADD(XFRM_SA_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
437 __ADD(XFRM_SA_ATTR_REPLAY_STATE, replay_state),
438 __ADD(XFRM_SA_ATTR_EXPIRE, expire),
439 __ADD(XFRM_SA_ATTR_OFFLOAD_DEV, user_offload),
440};
441
442static char* xfrm_sa_attrs2str(int attrs, char *buf, size_t len)
443{
444 return __flags2str (attrs, buf, len, sa_attrs, ARRAY_SIZE(sa_attrs));
445}
446/** @} */
447
448/**
449 * @name XFRM SA Flags Translations
450 * @{
451 */
452static const struct trans_tbl sa_flags[] = {
453 __ADD(XFRM_STATE_NOECN, no ecn),
454 __ADD(XFRM_STATE_DECAP_DSCP, decap dscp),
455 __ADD(XFRM_STATE_NOPMTUDISC, no pmtu discovery),
456 __ADD(XFRM_STATE_WILDRECV, wild receive),
457 __ADD(XFRM_STATE_ICMP, icmp),
458 __ADD(XFRM_STATE_AF_UNSPEC, unspecified),
459 __ADD(XFRM_STATE_ALIGN4, align4),
460 __ADD(XFRM_STATE_ESN, esn),
461};
462
463char* xfrmnl_sa_flags2str(int flags, char *buf, size_t len)
464{
465 return __flags2str (flags, buf, len, sa_flags, ARRAY_SIZE(sa_flags));
466}
467
468int xfrmnl_sa_str2flag(const char *name)
469{
470 return __str2flags (name, sa_flags, ARRAY_SIZE(sa_flags));
471}
472/** @} */
473
474/**
475 * @name XFRM SA Mode Translations
476 * @{
477 */
478static const struct trans_tbl sa_modes[] = {
479 __ADD(XFRM_MODE_TRANSPORT, transport),
480 __ADD(XFRM_MODE_TUNNEL, tunnel),
481 __ADD(XFRM_MODE_ROUTEOPTIMIZATION, route optimization),
482 __ADD(XFRM_MODE_IN_TRIGGER, in trigger),
483 __ADD(XFRM_MODE_BEET, beet),
484};
485
486char* xfrmnl_sa_mode2str(int mode, char *buf, size_t len)
487{
488 return __type2str (mode, buf, len, sa_modes, ARRAY_SIZE(sa_modes));
489}
490
491int xfrmnl_sa_str2mode(const char *name)
492{
493 return __str2type (name, sa_modes, ARRAY_SIZE(sa_modes));
494}
495/** @} */
496
497
498static void xfrm_sa_dump_line(struct nl_object *a, struct nl_dump_params *p)
499{
500 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
501 struct xfrmnl_sa* sa = (struct xfrmnl_sa *) a;
502 char flags[128], mode[128];
503 time_t add_time, use_time;
504 struct tm *add_time_tm, *use_time_tm;
505 struct tm tm_buf;
506
507 nl_dump_line(p, "src %s dst %s family: %s\n", nl_addr2str(sa->saddr, src, sizeof(src)),
508 nl_addr2str(sa->id.daddr, dst, sizeof(dst)),
509 nl_af2str (sa->family, flags, sizeof (flags)));
510
511 nl_dump_line(p, "\tproto %s spi 0x%x reqid %u\n",
512 nl_ip_proto2str (sa->id.proto, flags, sizeof(flags)),
513 sa->id.spi, sa->reqid);
514
515 xfrmnl_sa_flags2str(sa->flags, flags, sizeof (flags));
516 xfrmnl_sa_mode2str(sa->mode, mode, sizeof (mode));
517 nl_dump_line(p, "\tmode: %s flags: %s (0x%x) seq: %u replay window: %u\n",
518 mode, flags, sa->flags, sa->seq, sa->replay_window);
519
520 nl_dump_line(p, "\tlifetime configuration: \n");
521 if (sa->lft->soft_byte_limit == XFRM_INF)
522 sprintf (flags, "INF");
523 else
524 sprintf (flags, "%" PRIu64, sa->lft->soft_byte_limit);
525 if (sa->lft->soft_packet_limit == XFRM_INF)
526 sprintf (mode, "INF");
527 else
528 sprintf (mode, "%" PRIu64, sa->lft->soft_packet_limit);
529 nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets)\n", flags, mode);
530 if (sa->lft->hard_byte_limit == XFRM_INF)
531 sprintf (flags, "INF");
532 else
533 sprintf (flags, "%" PRIu64, sa->lft->hard_byte_limit);
534 if (sa->lft->hard_packet_limit == XFRM_INF)
535 sprintf (mode, "INF");
536 else
537 sprintf (mode, "%" PRIu64, sa->lft->hard_packet_limit);
538 nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets)\n", flags,
539 mode);
540 nl_dump_line(
541 p,
542 "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
543 (long long unsigned)sa->lft->soft_add_expires_seconds,
544 (long long unsigned)sa->lft->soft_use_expires_seconds);
545 nl_dump_line(
546 p,
547 "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
548 (long long unsigned)sa->lft->hard_add_expires_seconds,
549 (long long unsigned)sa->lft->hard_use_expires_seconds);
550
551 nl_dump_line(p, "\tlifetime current: \n");
552 nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
553 (long long unsigned)sa->curlft.bytes,
554 (long long unsigned)sa->curlft.packets);
555 if (sa->curlft.add_time != 0)
556 {
557 add_time = sa->curlft.add_time;
558 add_time_tm = gmtime_r (&add_time, &tm_buf);
559 strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
560 }
561 else
562 {
563 sprintf (flags, "%s", "-");
564 }
565
566 if (sa->curlft.use_time != 0)
567 {
568 use_time = sa->curlft.use_time;
569 use_time_tm = gmtime_r (&use_time, &tm_buf);
570 strftime (mode, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
571 }
572 else
573 {
574 sprintf (mode, "%s", "-");
575 }
576 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, mode);
577
578 if (sa->aead)
579 {
580 nl_dump_line(p, "\tAEAD Algo: \n");
581 nl_dump_line(p, "\t\tName: %s Key len(bits): %u ICV Len(bits): %u\n",
582 sa->aead->alg_name, sa->aead->alg_key_len, sa->aead->alg_icv_len);
583 }
584
585 if (sa->auth)
586 {
587 nl_dump_line(p, "\tAuth Algo: \n");
588 nl_dump_line(p, "\t\tName: %s Key len(bits): %u Trunc len(bits): %u\n",
589 sa->auth->alg_name, sa->auth->alg_key_len, sa->auth->alg_trunc_len);
590 }
591
592 if (sa->crypt)
593 {
594 nl_dump_line(p, "\tEncryption Algo: \n");
595 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
596 sa->crypt->alg_name, sa->crypt->alg_key_len);
597 }
598
599 if (sa->comp)
600 {
601 nl_dump_line(p, "\tCompression Algo: \n");
602 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
603 sa->comp->alg_name, sa->comp->alg_key_len);
604 }
605
606 if (sa->encap)
607 {
608 nl_dump_line(p, "\tEncapsulation template: \n");
609 nl_dump_line(p, "\t\tType: %d Src port: %d Dst port: %d Encap addr: %s\n",
610 sa->encap->encap_type, sa->encap->encap_sport, sa->encap->encap_dport,
611 nl_addr2str (sa->encap->encap_oa, dst, sizeof (dst)));
612 }
613
614 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
615 nl_dump_line(p, "\tTFC Pad: %u\n", sa->tfcpad);
616
617 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
618 nl_dump_line(p, "\tCO Address: %s\n", nl_addr2str (sa->coaddr, dst, sizeof (dst)));
619
620 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
621 nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sa->mark.m, sa->mark.v);
622
623 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
624 nl_dump_line(p, "\tDOI: %d Algo: %d Len: %u ctx: %s\n", sa->sec_ctx->ctx_doi,
625 sa->sec_ctx->ctx_alg, sa->sec_ctx->ctx_len, sa->sec_ctx->ctx);
626
627 nl_dump_line(p, "\treplay info: \n");
628 nl_dump_line(p, "\t\tmax age %u max diff %u \n", sa->replay_maxage, sa->replay_maxdiff);
629
630 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
631 {
632 nl_dump_line(p, "\treplay state info: \n");
633 if (sa->replay_state_esn)
634 {
635 nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
636 sa->replay_state_esn->oseq, sa->replay_state_esn->seq,
637 sa->replay_state_esn->oseq_hi, sa->replay_state_esn->seq_hi,
638 sa->replay_state_esn->replay_window);
639 }
640 else
641 {
642 nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", sa->replay_state.oseq,
643 sa->replay_state.seq, sa->replay_state.bitmap);
644 }
645 }
646
647 nl_dump_line(p, "\tselector info: \n");
648 xfrmnl_sel_dump (sa->sel, p);
649
650 nl_dump_line(p, "\tHard: %d\n", sa->hard);
651
652 nl_dump(p, "\n");
653}
654
655static void xfrm_sa_dump_stats(struct nl_object *a, struct nl_dump_params *p)
656{
657 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)a;
658
659 nl_dump_line(p, "\tstats: \n");
660 nl_dump_line(p, "\t\treplay window: %u replay: %u integrity failed: %u \n",
661 sa->stats.replay_window, sa->stats.replay, sa->stats.integrity_failed);
662
663 return;
664}
665
666static void xfrm_sa_dump_details(struct nl_object *a, struct nl_dump_params *p)
667{
668 xfrm_sa_dump_line(a, p);
669 xfrm_sa_dump_stats (a, p);
670}
671
672/**
673 * @name XFRM SA Object Allocation/Freeage
674 * @{
675 */
676
677struct xfrmnl_sa* xfrmnl_sa_alloc(void)
678{
679 return (struct xfrmnl_sa*) nl_object_alloc(&xfrm_sa_obj_ops);
680}
681
682void xfrmnl_sa_put(struct xfrmnl_sa* sa)
683{
684 nl_object_put((struct nl_object *) sa);
685}
686
687/** @} */
688
689/**
690 * @name SA Cache Managament
691 * @{
692 */
693
694/**
695 * Build a SA cache including all SAs currently configured in the kernel.
696 * @arg sock Netlink socket.
697 * @arg result Pointer to store resulting cache.
698 *
699 * Allocates a new SA cache, initializes it properly and updates it
700 * to include all SAs currently configured in the kernel.
701 *
702 * @return 0 on success or a negative error code.
703 */
704int xfrmnl_sa_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
705{
706 return nl_cache_alloc_and_fill(&xfrmnl_sa_ops, sock, result);
707}
708
709/**
710 * Look up a SA by destination address, SPI, protocol
711 * @arg cache SA cache
712 * @arg daddr destination address of the SA
713 * @arg spi SPI
714 * @arg proto protocol
715 * @return sa handle or NULL if no match was found.
716 */
717struct xfrmnl_sa* xfrmnl_sa_get(struct nl_cache* cache, struct nl_addr* daddr,
718 unsigned int spi, unsigned int proto)
719{
720 struct xfrmnl_sa *sa;
721
722 //nl_list_for_each_entry(sa, &cache->c_items, ce_list) {
723 for (sa = (struct xfrmnl_sa*)nl_cache_get_first (cache);
724 sa != NULL;
725 sa = (struct xfrmnl_sa*)nl_cache_get_next ((struct nl_object*)sa))
726 {
727 if (sa->id.proto == proto &&
728 sa->id.spi == spi &&
729 !nl_addr_cmp(sa->id.daddr, daddr))
730 {
731 nl_object_get((struct nl_object *) sa);
732 return sa;
733 }
734
735 }
736
737 return NULL;
738}
739
740
741/** @} */
742
743
744static struct nla_policy xfrm_sa_policy[XFRMA_MAX+1] = {
745 [XFRMA_SA] = { .minlen = sizeof(struct xfrm_usersa_info)},
746 [XFRMA_ALG_AUTH_TRUNC] = { .minlen = sizeof(struct xfrm_algo_auth)},
747 [XFRMA_ALG_AEAD] = { .minlen = sizeof(struct xfrm_algo_aead) },
748 [XFRMA_ALG_AUTH] = { .minlen = sizeof(struct xfrm_algo) },
749 [XFRMA_ALG_CRYPT] = { .minlen = sizeof(struct xfrm_algo) },
750 [XFRMA_ALG_COMP] = { .minlen = sizeof(struct xfrm_algo) },
751 [XFRMA_ENCAP] = { .minlen = sizeof(struct xfrm_encap_tmpl) },
752 [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
753 [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
754 [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
755 [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
756 [XFRMA_OFFLOAD_DEV] = { .minlen = sizeof(struct xfrm_user_offload) },
757 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
758 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
759 [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
760 [XFRMA_COADDR] = { .minlen = sizeof(xfrm_address_t) },
761 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
762 [XFRMA_TFCPAD] = { .type = NLA_U32 },
763 [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
764};
765
766static int xfrm_sa_request_update(struct nl_cache *c, struct nl_sock *h)
767{
768 return nl_send_simple (h, XFRM_MSG_GETSA, NLM_F_DUMP, NULL, 0);
769}
770
771int xfrmnl_sa_parse(struct nlmsghdr *n, struct xfrmnl_sa **result)
772{
773 struct xfrmnl_sa* sa;
774 struct nlattr *tb[XFRMA_MAX + 1];
775 struct xfrm_usersa_info* sa_info;
776 struct xfrm_user_expire* ue;
777 int len, err;
778 struct nl_addr* addr;
779
780 sa = xfrmnl_sa_alloc();
781 if (!sa) {
782 err = -NLE_NOMEM;
783 goto errout;
784 }
785
786 sa->ce_msgtype = n->nlmsg_type;
787 if (n->nlmsg_type == XFRM_MSG_EXPIRE)
788 {
789 ue = nlmsg_data(n);
790 sa_info = &ue->state;
791 sa->hard = ue->hard;
792 sa->ce_mask |= XFRM_SA_ATTR_EXPIRE;
793 }
794 else if (n->nlmsg_type == XFRM_MSG_DELSA)
795 {
796 sa_info = (struct xfrm_usersa_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_usersa_id) + NLA_HDRLEN);
797 }
798 else
799 {
800 sa_info = nlmsg_data(n);
801 }
802
803 err = nlmsg_parse(n, sizeof(struct xfrm_usersa_info), tb, XFRMA_MAX, xfrm_sa_policy);
804 if (err < 0)
805 goto errout;
806
807 if (sa_info->sel.family == AF_INET)
808 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a4, sizeof (sa_info->sel.daddr.a4));
809 else
810 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a6, sizeof (sa_info->sel.daddr.a6));
811 nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_d);
812 xfrmnl_sel_set_daddr (sa->sel, addr);
813 /* Drop the reference count from the above set operation */
814 nl_addr_put(addr);
815 xfrmnl_sel_set_prefixlen_d (sa->sel, sa_info->sel.prefixlen_d);
816
817 if (sa_info->sel.family == AF_INET)
818 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a4, sizeof (sa_info->sel.saddr.a4));
819 else
820 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a6, sizeof (sa_info->sel.saddr.a6));
821 nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_s);
822 xfrmnl_sel_set_saddr (sa->sel, addr);
823 /* Drop the reference count from the above set operation */
824 nl_addr_put(addr);
825 xfrmnl_sel_set_prefixlen_s (sa->sel, sa_info->sel.prefixlen_s);
826
827 xfrmnl_sel_set_dport (sa->sel, ntohs(sa_info->sel.dport));
828 xfrmnl_sel_set_dportmask (sa->sel, ntohs(sa_info->sel.dport_mask));
829 xfrmnl_sel_set_sport (sa->sel, ntohs(sa_info->sel.sport));
830 xfrmnl_sel_set_sportmask (sa->sel, ntohs(sa_info->sel.sport_mask));
831 xfrmnl_sel_set_family (sa->sel, sa_info->sel.family);
832 xfrmnl_sel_set_proto (sa->sel, sa_info->sel.proto);
833 xfrmnl_sel_set_ifindex (sa->sel, sa_info->sel.ifindex);
834 xfrmnl_sel_set_userid (sa->sel, sa_info->sel.user);
835 sa->ce_mask |= XFRM_SA_ATTR_SEL;
836
837 if (sa_info->family == AF_INET)
838 sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a4, sizeof (sa_info->id.daddr.a4));
839 else
840 sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a6, sizeof (sa_info->id.daddr.a6));
841 sa->id.spi = ntohl(sa_info->id.spi);
842 sa->id.proto = sa_info->id.proto;
843 sa->ce_mask |= (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO);
844
845 if (sa_info->family == AF_INET)
846 sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a4, sizeof (sa_info->saddr.a4));
847 else
848 sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a6, sizeof (sa_info->saddr.a6));
849 sa->ce_mask |= XFRM_SA_ATTR_SADDR;
850
851 sa->lft->soft_byte_limit = sa_info->lft.soft_byte_limit;
852 sa->lft->hard_byte_limit = sa_info->lft.hard_byte_limit;
853 sa->lft->soft_packet_limit = sa_info->lft.soft_packet_limit;
854 sa->lft->hard_packet_limit = sa_info->lft.hard_packet_limit;
855 sa->lft->soft_add_expires_seconds = sa_info->lft.soft_add_expires_seconds;
856 sa->lft->hard_add_expires_seconds = sa_info->lft.hard_add_expires_seconds;
857 sa->lft->soft_use_expires_seconds = sa_info->lft.soft_use_expires_seconds;
858 sa->lft->hard_use_expires_seconds = sa_info->lft.hard_use_expires_seconds;
859 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
860
861 sa->curlft.bytes = sa_info->curlft.bytes;
862 sa->curlft.packets = sa_info->curlft.packets;
863 sa->curlft.add_time = sa_info->curlft.add_time;
864 sa->curlft.use_time = sa_info->curlft.use_time;
865 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CUR;
866
867 sa->stats.replay_window = sa_info->stats.replay_window;
868 sa->stats.replay = sa_info->stats.replay;
869 sa->stats.integrity_failed = sa_info->stats.integrity_failed;
870 sa->ce_mask |= XFRM_SA_ATTR_STATS;
871
872 sa->seq = sa_info->seq;
873 sa->reqid = sa_info->reqid;
874 sa->family = sa_info->family;
875 sa->mode = sa_info->mode;
876 sa->replay_window = sa_info->replay_window;
877 sa->flags = sa_info->flags;
878 sa->ce_mask |= (XFRM_SA_ATTR_SEQ | XFRM_SA_ATTR_REQID |
879 XFRM_SA_ATTR_FAMILY | XFRM_SA_ATTR_MODE |
880 XFRM_SA_ATTR_REPLAY_WIN | XFRM_SA_ATTR_FLAGS);
881
882 if (tb[XFRMA_ALG_AEAD]) {
883 struct xfrm_algo_aead* aead = nla_data(tb[XFRMA_ALG_AEAD]);
884 len = sizeof (struct xfrmnl_algo_aead) + ((aead->alg_key_len + 7) / 8);
885 if ((sa->aead = calloc (1, len)) == NULL)
886 {
887 err = -NLE_NOMEM;
888 goto errout;
889 }
890 memcpy ((void *)sa->aead, (void *)aead, len);
891 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
892 }
893
894 if (tb[XFRMA_ALG_AUTH_TRUNC]) {
895 struct xfrm_algo_auth* auth = nla_data(tb[XFRMA_ALG_AUTH_TRUNC]);
896 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
897 if ((sa->auth = calloc (1, len)) == NULL)
898 {
899 err = -NLE_NOMEM;
900 goto errout;
901 }
902 memcpy ((void *)sa->auth, (void *)auth, len);
903 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
904 }
905
906 if (tb[XFRMA_ALG_AUTH] && !sa->auth) {
907 struct xfrm_algo* auth = nla_data(tb[XFRMA_ALG_AUTH]);
908 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
909 if ((sa->auth = calloc (1, len)) == NULL)
910 {
911 err = -NLE_NOMEM;
912 goto errout;
913 }
914 strcpy(sa->auth->alg_name, auth->alg_name);
915 memcpy(sa->auth->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
916 sa->auth->alg_key_len = auth->alg_key_len;
917 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
918 }
919
920 if (tb[XFRMA_ALG_CRYPT]) {
921 struct xfrm_algo* crypt = nla_data(tb[XFRMA_ALG_CRYPT]);
922 len = sizeof (struct xfrmnl_algo) + ((crypt->alg_key_len + 7) / 8);
923 if ((sa->crypt = calloc (1, len)) == NULL)
924 {
925 err = -NLE_NOMEM;
926 goto errout;
927 }
928 memcpy ((void *)sa->crypt, (void *)crypt, len);
929 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
930 }
931
932 if (tb[XFRMA_ALG_COMP]) {
933 struct xfrm_algo* comp = nla_data(tb[XFRMA_ALG_COMP]);
934 len = sizeof (struct xfrmnl_algo) + ((comp->alg_key_len + 7) / 8);
935 if ((sa->comp = calloc (1, len)) == NULL)
936 {
937 err = -NLE_NOMEM;
938 goto errout;
939 }
940 memcpy ((void *)sa->comp, (void *)comp, len);
941 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
942 }
943
944 if (tb[XFRMA_ENCAP]) {
945 struct xfrm_encap_tmpl* encap = nla_data(tb[XFRMA_ENCAP]);
946 len = sizeof (struct xfrmnl_encap_tmpl);
947 if ((sa->encap = calloc (1, len)) == NULL)
948 {
949 err = -NLE_NOMEM;
950 goto errout;
951 }
952 sa->encap->encap_type = encap->encap_type;
953 sa->encap->encap_sport = ntohs(encap->encap_sport);
954 sa->encap->encap_dport = ntohs(encap->encap_dport);
955 if (sa_info->family == AF_INET)
956 sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a4, sizeof (encap->encap_oa.a4));
957 else
958 sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a6, sizeof (encap->encap_oa.a6));
959 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
960 }
961
962 if (tb[XFRMA_TFCPAD]) {
963 sa->tfcpad = *(uint32_t*)nla_data(tb[XFRMA_TFCPAD]);
964 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
965 }
966
967 if (tb[XFRMA_COADDR]) {
968 if (sa_info->family == AF_INET)
969 {
970 sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
971 sizeof (uint32_t));
972 }
973 else
974 {
975 sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
976 sizeof (uint32_t) * 4);
977 }
978 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
979 }
980
981 if (tb[XFRMA_MARK]) {
982 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
983 sa->mark.m = m->m;
984 sa->mark.v = m->v;
985 sa->ce_mask |= XFRM_SA_ATTR_MARK;
986 }
987
988 if (tb[XFRMA_SEC_CTX]) {
989 struct xfrm_user_sec_ctx* sec_ctx = nla_data(tb[XFRMA_SEC_CTX]);
990 len = sizeof (struct xfrmnl_user_sec_ctx) + sec_ctx->ctx_len;
991 if ((sa->sec_ctx = calloc (1, len)) == NULL)
992 {
993 err = -NLE_NOMEM;
994 goto errout;
995 }
996 memcpy (sa->sec_ctx, sec_ctx, len);
997 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
998 }
999
1000 if (tb[XFRMA_ETIMER_THRESH]) {
1001 sa->replay_maxage = *(uint32_t*)nla_data(tb[XFRMA_ETIMER_THRESH]);
1002 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
1003 }
1004
1005 if (tb[XFRMA_REPLAY_THRESH]) {
1006 sa->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRMA_REPLAY_THRESH]);
1007 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
1008 }
1009
1010 if (tb[XFRMA_REPLAY_ESN_VAL]) {
1011 struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
1012 len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
1013 if ((sa->replay_state_esn = calloc (1, len)) == NULL)
1014 {
1015 err = -NLE_NOMEM;
1016 goto errout;
1017 }
1018 memcpy ((void *)sa->replay_state_esn, (void *)esn, len);
1019 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
1020 }
1021 else if (tb[XFRMA_REPLAY_VAL])
1022 {
1023 struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
1024 sa->replay_state.oseq = replay_state->oseq;
1025 sa->replay_state.seq = replay_state->seq;
1026 sa->replay_state.bitmap = replay_state->bitmap;
1027 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
1028 sa->replay_state_esn = NULL;
1029 }
1030
1031 if (tb[XFRMA_OFFLOAD_DEV]) {
1032 struct xfrm_user_offload *offload;
1033
1034 len = sizeof(struct xfrmnl_user_offload);
1035
1036 if ((sa->user_offload = calloc(1, len)) == NULL) {
1037 err = -NLE_NOMEM;
1038 goto errout;
1039 }
1040
1041 offload = nla_data(tb[XFRMA_OFFLOAD_DEV]);
1042 sa->user_offload->ifindex = offload->ifindex;
1043 sa->user_offload->flags = offload->flags;
1044 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
1045 }
1046
1047 *result = sa;
1048 return 0;
1049
1050errout:
1051 xfrmnl_sa_put(sa);
1052 return err;
1053}
1054
1055static int xfrm_sa_update_cache (struct nl_cache *cache, struct nl_object *obj,
1056 change_func_t change_cb, change_func_v2_t change_cb_v2,
1057 void *data)
1058{
1059 struct nl_object* old_sa;
1060 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)obj;
1061
1062 if (nl_object_get_msgtype (obj) == XFRM_MSG_EXPIRE)
1063 {
1064 /* On hard expiry, the SA gets deleted too from the kernel state without any
1065 * further delete event. On Expire message, we are only updating the cache with
1066 * the SA object's new state. In absence of the explicit delete event, the cache will
1067 * be out of sync with the kernel state. To get around this, expiry messages cache
1068 * operations are handled here (installed with NL_ACT_UNSPEC action) instead of
1069 * in Libnl Cache module. */
1070
1071 /* Do we already have this object in the cache? */
1072 old_sa = nl_cache_search(cache, obj);
1073 if (old_sa)
1074 {
1075 /* Found corresponding SA object in cache. Delete it */
1076 nl_cache_remove (old_sa);
1077 }
1078
1079 /* Handle the expiry event now */
1080 if (sa->hard == 0)
1081 {
1082 /* Soft expiry event: Save the new object to the
1083 * cache and notify application of the expiry event. */
1084 nl_cache_move (cache, obj);
1085
1086 if (old_sa == NULL)
1087 {
1088 /* Application CB present, no previous instance of SA object present.
1089 * Notify application CB as a NEW event */
1090 if (change_cb_v2)
1091 change_cb_v2(cache, NULL, obj, 0, NL_ACT_NEW, data);
1092 else if (change_cb)
1093 change_cb(cache, obj, NL_ACT_NEW, data);
1094 }
1095 else if (old_sa)
1096 {
1097 uint64_t diff = 0;
1098 if (change_cb || change_cb_v2)
1099 diff = nl_object_diff64(old_sa, obj);
1100
1101 /* Application CB present, a previous instance of SA object present.
1102 * Notify application CB as a CHANGE1 event */
1103 if (diff) {
1104 if (change_cb_v2) {
1105 change_cb_v2(cache, old_sa, obj, diff, NL_ACT_CHANGE, data);
1106 } else if (change_cb)
1107 change_cb(cache, obj, NL_ACT_CHANGE, data);
1108 }
1109 nl_object_put (old_sa);
1110 }
1111 }
1112 else
1113 {
1114 /* Hard expiry event: Delete the object from the
1115 * cache and notify application of the expiry event. */
1116 if (change_cb_v2)
1117 change_cb_v2(cache, obj, NULL, 0, NL_ACT_DEL, data);
1118 else if (change_cb)
1119 change_cb (cache, obj, NL_ACT_DEL, data);
1120 nl_object_put (old_sa);
1121 }
1122
1123 /* Done handling expire message */
1124 return 0;
1125 }
1126 else
1127 {
1128 /* All other messages other than Expire, let the standard Libnl cache
1129 * module handle it. */
1130 if (change_cb_v2)
1131 return nl_cache_include_v2(cache, obj, change_cb_v2, data);
1132 else
1133 return nl_cache_include (cache, obj, change_cb, data);
1134 }
1135}
1136
1137static int xfrm_sa_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
1138 struct nlmsghdr *n, struct nl_parser_param *pp)
1139{
1140 struct xfrmnl_sa* sa;
1141 int err;
1142
1143 if ((err = xfrmnl_sa_parse(n, &sa)) < 0)
1144 return err;
1145
1146 err = pp->pp_cb((struct nl_object *) sa, pp);
1147
1148 xfrmnl_sa_put(sa);
1149 return err;
1150}
1151
1152/**
1153 * @name XFRM SA Get
1154 * @{
1155 */
1156
1157int xfrmnl_sa_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
1158{
1159 struct nl_msg *msg;
1160 struct xfrm_usersa_id sa_id;
1161 struct xfrm_mark mark;
1162
1163 if (!daddr || !spi)
1164 {
1165 fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
1166 __FILE__, __LINE__, __func__);
1167 assert(0);
1168 return -NLE_MISSING_ATTR;
1169 }
1170
1171 memset(&sa_id, 0, sizeof(sa_id));
1172 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
1173 sa_id.family = nl_addr_get_family (daddr);
1174 sa_id.spi = htonl(spi);
1175 sa_id.proto = protocol;
1176
1177 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETSA, 0)))
1178 return -NLE_NOMEM;
1179
1180 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1181 goto nla_put_failure;
1182
1183 if ((mark_m & mark_v) != 0)
1184 {
1185 memset(&mark, 0, sizeof(struct xfrm_mark));
1186 mark.m = mark_m;
1187 mark.v = mark_v;
1188
1189 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
1190 }
1191
1192 *result = msg;
1193 return 0;
1194
1195nla_put_failure:
1196 nlmsg_free(msg);
1197 return -NLE_MSGSIZE;
1198}
1199
1200int xfrmnl_sa_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sa** result)
1201{
1202 struct nl_msg *msg = NULL;
1203 struct nl_object *obj;
1204 int err;
1205
1206 if ((err = xfrmnl_sa_build_get_request(daddr, spi, protocol, mark_m, mark_v, &msg)) < 0)
1207 return err;
1208
1209 err = nl_send_auto(sock, msg);
1210 nlmsg_free(msg);
1211 if (err < 0)
1212 return err;
1213
1214 if ((err = nl_pickup(sock, &xfrm_sa_msg_parser, &obj)) < 0)
1215 return err;
1216
1217 /* We have used xfrm_sa_msg_parser(), object is definitely a xfrm sa */
1218 *result = (struct xfrmnl_sa *) obj;
1219
1220 /* If an object has been returned, we also need to wait for the ACK */
1221 if (err == 0 && obj)
1222 nl_wait_for_ack(sock);
1223
1224 return 0;
1225}
1226
1227/** @} */
1228
1229static int build_xfrm_sa_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1230{
1231 struct nl_msg* msg;
1232 struct xfrm_usersa_info sa_info;
1233 uint32_t len;
1234 struct nl_addr* addr;
1235
1236 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1237 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1238 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1239 return -NLE_MISSING_ATTR;
1240
1241 memset ((void*)&sa_info, 0, sizeof (sa_info));
1242 if (tmpl->ce_mask & XFRM_SA_ATTR_SEL)
1243 {
1244 addr = xfrmnl_sel_get_daddr (tmpl->sel);
1245 memcpy ((void*)&sa_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1246 addr = xfrmnl_sel_get_saddr (tmpl->sel);
1247 memcpy ((void*)&sa_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1248 sa_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1249 sa_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1250 sa_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1251 sa_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1252 sa_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1253 sa_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1254 sa_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1255 sa_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1256 sa_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1257 sa_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1258 }
1259
1260 memcpy (&sa_info.id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1261 sa_info.id.spi = htonl(tmpl->id.spi);
1262 sa_info.id.proto = tmpl->id.proto;
1263
1264 if (tmpl->ce_mask & XFRM_SA_ATTR_SADDR)
1265 memcpy (&sa_info.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
1266
1267 if (tmpl->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1268 {
1269 sa_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
1270 sa_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
1271 sa_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
1272 sa_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
1273 sa_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
1274 sa_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
1275 sa_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
1276 sa_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
1277 }
1278
1279 //Skip current lifetime: cur lifetime can be updated only via AE
1280 //Skip stats: stats cant be updated
1281 //Skip seq: seq cant be updated
1282
1283 if (tmpl->ce_mask & XFRM_SA_ATTR_REQID)
1284 sa_info.reqid = tmpl->reqid;
1285
1286 if (tmpl->ce_mask & XFRM_SA_ATTR_FAMILY)
1287 sa_info.family = tmpl->family;
1288
1289 if (tmpl->ce_mask & XFRM_SA_ATTR_MODE)
1290 sa_info.mode = tmpl->mode;
1291
1292 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1293 sa_info.replay_window = tmpl->replay_window;
1294
1295 if (tmpl->ce_mask & XFRM_SA_ATTR_FLAGS)
1296 sa_info.flags = tmpl->flags;
1297
1298 msg = nlmsg_alloc_simple(cmd, flags);
1299 if (!msg)
1300 return -NLE_NOMEM;
1301
1302 if (nlmsg_append(msg, &sa_info, sizeof(sa_info), NLMSG_ALIGNTO) < 0)
1303 goto nla_put_failure;
1304
1305 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AEAD) {
1306 len = sizeof (struct xfrm_algo_aead) + ((tmpl->aead->alg_key_len + 7) / 8);
1307 NLA_PUT (msg, XFRMA_ALG_AEAD, len, tmpl->aead);
1308 }
1309
1310 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AUTH) {
1311 /* kernel prefers XFRMA_ALG_AUTH_TRUNC over XFRMA_ALG_AUTH, so only
1312 * one of the attributes needs to be present */
1313 if (tmpl->auth->alg_trunc_len) {
1314 len = sizeof (struct xfrm_algo_auth) + ((tmpl->auth->alg_key_len + 7) / 8);
1315 NLA_PUT (msg, XFRMA_ALG_AUTH_TRUNC, len, tmpl->auth);
1316 } else {
1317 struct xfrm_algo *auth;
1318
1319 len = sizeof (struct xfrm_algo) + ((tmpl->auth->alg_key_len + 7) / 8);
1320 auth = malloc(len);
1321 if (!auth) {
1322 nlmsg_free(msg);
1323 return -NLE_NOMEM;
1324 }
1325
1326 _nl_strncpy_assert(auth->alg_name, tmpl->auth->alg_name, sizeof(auth->alg_name));
1327 auth->alg_key_len = tmpl->auth->alg_key_len;
1328 memcpy(auth->alg_key, tmpl->auth->alg_key, (tmpl->auth->alg_key_len + 7) / 8);
1329 if (nla_put(msg, XFRMA_ALG_AUTH, len, auth) < 0) {
1330 free(auth);
1331 goto nla_put_failure;
1332 }
1333 free(auth);
1334 }
1335 }
1336
1337 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_CRYPT) {
1338 len = sizeof (struct xfrm_algo) + ((tmpl->crypt->alg_key_len + 7) / 8);
1339 NLA_PUT (msg, XFRMA_ALG_CRYPT, len, tmpl->crypt);
1340 }
1341
1342 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_COMP) {
1343 len = sizeof (struct xfrm_algo) + ((tmpl->comp->alg_key_len + 7) / 8);
1344 NLA_PUT (msg, XFRMA_ALG_COMP, len, tmpl->comp);
1345 }
1346
1347 if (tmpl->ce_mask & XFRM_SA_ATTR_ENCAP) {
1348 struct xfrm_encap_tmpl* encap_tmpl;
1349 struct nlattr* encap_attr;
1350
1351 len = sizeof (struct xfrm_encap_tmpl);
1352 encap_attr = nla_reserve(msg, XFRMA_ENCAP, len);
1353 if (!encap_attr)
1354 goto nla_put_failure;
1355 encap_tmpl = nla_data (encap_attr);
1356 encap_tmpl->encap_type = tmpl->encap->encap_type;
1357 encap_tmpl->encap_sport = htons (tmpl->encap->encap_sport);
1358 encap_tmpl->encap_dport = htons (tmpl->encap->encap_dport);
1359 memcpy (&encap_tmpl->encap_oa, nl_addr_get_binary_addr (tmpl->encap->encap_oa), sizeof (uint8_t) * nl_addr_get_len (tmpl->encap->encap_oa));
1360 }
1361
1362 if (tmpl->ce_mask & XFRM_SA_ATTR_TFCPAD) {
1363 NLA_PUT_U32 (msg, XFRMA_TFCPAD, tmpl->tfcpad);
1364 }
1365
1366 if (tmpl->ce_mask & XFRM_SA_ATTR_COADDR) {
1367 NLA_PUT (msg, XFRMA_COADDR, sizeof (xfrm_address_t), tmpl->coaddr);
1368 }
1369
1370 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1371 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1372 }
1373
1374 if (tmpl->ce_mask & XFRM_SA_ATTR_SECCTX) {
1375 len = sizeof (struct xfrm_sec_ctx) + tmpl->sec_ctx->ctx_len;
1376 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1377 }
1378
1379 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE) {
1380 NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
1381 }
1382
1383 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF) {
1384 NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
1385 }
1386
1387 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_STATE) {
1388 if (tmpl->replay_state_esn) {
1389 len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
1390 NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
1391 }
1392 else {
1393 NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrm_replay_state), &tmpl->replay_state);
1394 }
1395 }
1396
1397 if (tmpl->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV) {
1398 struct xfrm_user_offload *offload;
1399 struct nlattr *attr;
1400
1401 len = sizeof(struct xfrm_user_offload);
1402 attr = nla_reserve(msg, XFRMA_OFFLOAD_DEV, len);
1403
1404 if (!attr)
1405 goto nla_put_failure;
1406
1407 offload = nla_data(attr);
1408 offload->ifindex = tmpl->user_offload->ifindex;
1409 offload->flags = tmpl->user_offload->flags;
1410 }
1411
1412 *result = msg;
1413 return 0;
1414
1415nla_put_failure:
1416 nlmsg_free(msg);
1417 return -NLE_MSGSIZE;
1418}
1419
1420/**
1421 * @name XFRM SA Add
1422 * @{
1423 */
1424
1425int xfrmnl_sa_build_add_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1426{
1427 return build_xfrm_sa_message (tmpl, XFRM_MSG_NEWSA, flags, result);
1428}
1429
1430int xfrmnl_sa_add(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1431{
1432 int err;
1433 struct nl_msg *msg;
1434
1435 if ((err = xfrmnl_sa_build_add_request(tmpl, flags, &msg)) < 0)
1436 return err;
1437
1438 err = nl_send_auto_complete(sk, msg);
1439 nlmsg_free(msg);
1440 if (err < 0)
1441 return err;
1442
1443 return nl_wait_for_ack(sk);
1444}
1445
1446/**
1447 * @name XFRM SA Update
1448 * @{
1449 */
1450
1451int xfrmnl_sa_build_update_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1452{
1453 return build_xfrm_sa_message (tmpl, XFRM_MSG_UPDSA, flags, result);
1454}
1455
1456int xfrmnl_sa_update(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1457{
1458 int err;
1459 struct nl_msg *msg;
1460
1461 if ((err = xfrmnl_sa_build_update_request(tmpl, flags, &msg)) < 0)
1462 return err;
1463
1464 err = nl_send_auto_complete(sk, msg);
1465 nlmsg_free(msg);
1466 if (err < 0)
1467 return err;
1468
1469 return nl_wait_for_ack(sk);
1470}
1471
1472/** @} */
1473
1474static int build_xfrm_sa_delete_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1475{
1476 struct nl_msg* msg;
1477 struct xfrm_usersa_id sa_id;
1478
1479 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1480 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1481 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1482 return -NLE_MISSING_ATTR;
1483
1484 memset(&sa_id, 0, sizeof(struct xfrm_usersa_id));
1485 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr),
1486 sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1487 sa_id.family = nl_addr_get_family (tmpl->id.daddr);
1488 sa_id.spi = htonl(tmpl->id.spi);
1489 sa_id.proto = tmpl->id.proto;
1490
1491 msg = nlmsg_alloc_simple(cmd, flags);
1492 if (!msg)
1493 return -NLE_NOMEM;
1494
1495 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1496 goto nla_put_failure;
1497
1498 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1499 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1500 }
1501
1502 *result = msg;
1503 return 0;
1504
1505nla_put_failure:
1506 nlmsg_free(msg);
1507 return -NLE_MSGSIZE;
1508}
1509
1510/**
1511 * @name XFRM SA Delete
1512 * @{
1513 */
1514
1515int xfrmnl_sa_build_delete_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1516{
1517 return build_xfrm_sa_delete_message (tmpl, XFRM_MSG_DELSA, flags, result);
1518}
1519
1520int xfrmnl_sa_delete(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1521{
1522 int err;
1523 struct nl_msg *msg;
1524
1525 if ((err = xfrmnl_sa_build_delete_request(tmpl, flags, &msg)) < 0)
1526 return err;
1527
1528 err = nl_send_auto_complete(sk, msg);
1529 nlmsg_free(msg);
1530 if (err < 0)
1531 return err;
1532
1533 return nl_wait_for_ack(sk);
1534}
1535
1536/** @} */
1537
1538
1539/**
1540 * @name Attributes
1541 * @{
1542 */
1543
1544struct xfrmnl_sel* xfrmnl_sa_get_sel (struct xfrmnl_sa* sa)
1545{
1546 if (sa->ce_mask & XFRM_SA_ATTR_SEL)
1547 return sa->sel;
1548 else
1549 return NULL;
1550}
1551
1552int xfrmnl_sa_set_sel (struct xfrmnl_sa* sa, struct xfrmnl_sel* sel)
1553{
1554 /* Release any previously held selector object from the SA */
1555 if (sa->sel)
1556 xfrmnl_sel_put (sa->sel);
1557
1558 /* Increment ref count on new selector and save it in the SA */
1559 xfrmnl_sel_get (sel);
1560 sa->sel = sel;
1561 sa->ce_mask |= XFRM_SA_ATTR_SEL;
1562
1563 return 0;
1564}
1565
1566static inline int __assign_addr(struct xfrmnl_sa* sa, struct nl_addr **pos,
1567 struct nl_addr *new, int flag, int nocheck)
1568{
1569 if (!nocheck)
1570 {
1571 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1572 {
1573 if (nl_addr_get_family (new) != sa->family)
1574 return -NLE_AF_MISMATCH;
1575 }
1576 }
1577
1578 if (*pos)
1579 nl_addr_put(*pos);
1580
1581 nl_addr_get(new);
1582 *pos = new;
1583
1584 sa->ce_mask |= flag;
1585
1586 return 0;
1587}
1588
1589
1590struct nl_addr* xfrmnl_sa_get_daddr (struct xfrmnl_sa* sa)
1591{
1592 if (sa->ce_mask & XFRM_SA_ATTR_DADDR)
1593 return sa->id.daddr;
1594 else
1595 return NULL;
1596}
1597
1598int xfrmnl_sa_set_daddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1599{
1600 return __assign_addr(sa, &sa->id.daddr, addr, XFRM_SA_ATTR_DADDR, 0);
1601}
1602
1603int xfrmnl_sa_get_spi (struct xfrmnl_sa* sa)
1604{
1605 if (sa->ce_mask & XFRM_SA_ATTR_SPI)
1606 return sa->id.spi;
1607 else
1608 return -1;
1609}
1610
1611int xfrmnl_sa_set_spi (struct xfrmnl_sa* sa, unsigned int spi)
1612{
1613 sa->id.spi = spi;
1614 sa->ce_mask |= XFRM_SA_ATTR_SPI;
1615
1616 return 0;
1617}
1618
1619int xfrmnl_sa_get_proto (struct xfrmnl_sa* sa)
1620{
1621 if (sa->ce_mask & XFRM_SA_ATTR_PROTO)
1622 return sa->id.proto;
1623 else
1624 return -1;
1625}
1626
1627int xfrmnl_sa_set_proto (struct xfrmnl_sa* sa, unsigned int protocol)
1628{
1629 sa->id.proto = protocol;
1630 sa->ce_mask |= XFRM_SA_ATTR_PROTO;
1631
1632 return 0;
1633}
1634
1635struct nl_addr* xfrmnl_sa_get_saddr (struct xfrmnl_sa* sa)
1636{
1637 if (sa->ce_mask & XFRM_SA_ATTR_SADDR)
1638 return sa->saddr;
1639 else
1640 return NULL;
1641}
1642
1643int xfrmnl_sa_set_saddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1644{
1645 return __assign_addr(sa, &sa->saddr, addr, XFRM_SA_ATTR_SADDR, 1);
1646}
1647
1648struct xfrmnl_ltime_cfg* xfrmnl_sa_get_lifetime_cfg (struct xfrmnl_sa* sa)
1649{
1650 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1651 return sa->lft;
1652 else
1653 return NULL;
1654}
1655
1656int xfrmnl_sa_set_lifetime_cfg (struct xfrmnl_sa* sa, struct xfrmnl_ltime_cfg* ltime)
1657{
1658 /* Release any previously held lifetime cfg object from the SA */
1659 if (sa->lft)
1660 xfrmnl_ltime_cfg_put (sa->lft);
1661
1662 /* Increment ref count on new lifetime object and save it in the SA */
1663 xfrmnl_ltime_cfg_get (ltime);
1664 sa->lft = ltime;
1665 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
1666
1667 return 0;
1668}
1669
1670int xfrmnl_sa_get_curlifetime (struct xfrmnl_sa* sa, unsigned long long int* curr_bytes,
1671 unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1672{
1673 if (sa == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1674 return -1;
1675
1676 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CUR)
1677 {
1678 *curr_bytes = sa->curlft.bytes;
1679 *curr_packets = sa->curlft.packets;
1680 *curr_add_time = sa->curlft.add_time;
1681 *curr_use_time = sa->curlft.use_time;
1682 }
1683 else
1684 return -1;
1685
1686 return 0;
1687}
1688
1689int xfrmnl_sa_get_stats (struct xfrmnl_sa* sa, unsigned long long int* replay_window,
1690 unsigned long long int* replay, unsigned long long int* integrity_failed)
1691{
1692 if (sa == NULL || replay_window == NULL || replay == NULL || integrity_failed == NULL)
1693 return -1;
1694
1695 if (sa->ce_mask & XFRM_SA_ATTR_STATS)
1696 {
1697 *replay_window = sa->stats.replay_window;
1698 *replay = sa->stats.replay;
1699 *integrity_failed = sa->stats.integrity_failed;
1700 }
1701 else
1702 return -1;
1703
1704 return 0;
1705}
1706
1707int xfrmnl_sa_get_seq (struct xfrmnl_sa* sa)
1708{
1709 if (sa->ce_mask & XFRM_SA_ATTR_SEQ)
1710 return sa->seq;
1711 else
1712 return -1;
1713}
1714
1715int xfrmnl_sa_get_reqid (struct xfrmnl_sa* sa)
1716{
1717 if (sa->ce_mask & XFRM_SA_ATTR_REQID)
1718 return sa->reqid;
1719 else
1720 return -1;
1721}
1722
1723int xfrmnl_sa_set_reqid (struct xfrmnl_sa* sa, unsigned int reqid)
1724{
1725 sa->reqid = reqid;
1726 sa->ce_mask |= XFRM_SA_ATTR_REQID;
1727
1728 return 0;
1729}
1730
1731int xfrmnl_sa_get_family (struct xfrmnl_sa* sa)
1732{
1733 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1734 return sa->family;
1735 else
1736 return -1;
1737}
1738
1739int xfrmnl_sa_set_family (struct xfrmnl_sa* sa, unsigned int family)
1740{
1741 sa->family = family;
1742 sa->ce_mask |= XFRM_SA_ATTR_FAMILY;
1743
1744 return 0;
1745}
1746
1747int xfrmnl_sa_get_mode (struct xfrmnl_sa* sa)
1748{
1749 if (sa->ce_mask & XFRM_SA_ATTR_MODE)
1750 return sa->mode;
1751 else
1752 return -1;
1753}
1754
1755int xfrmnl_sa_set_mode (struct xfrmnl_sa* sa, unsigned int mode)
1756{
1757 sa->mode = mode;
1758 sa->ce_mask |= XFRM_SA_ATTR_MODE;
1759
1760 return 0;
1761}
1762
1763int xfrmnl_sa_get_replay_window (struct xfrmnl_sa* sa)
1764{
1765 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1766 return sa->replay_window;
1767 else
1768 return -1;
1769}
1770
1771int xfrmnl_sa_set_replay_window (struct xfrmnl_sa* sa, unsigned int replay_window)
1772{
1773 sa->replay_window = replay_window;
1774 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_WIN;
1775
1776 return 0;
1777}
1778
1779int xfrmnl_sa_get_flags (struct xfrmnl_sa* sa)
1780{
1781 if (sa->ce_mask & XFRM_SA_ATTR_FLAGS)
1782 return sa->flags;
1783 else
1784 return -1;
1785}
1786
1787int xfrmnl_sa_set_flags (struct xfrmnl_sa* sa, unsigned int flags)
1788{
1789 sa->flags = flags;
1790 sa->ce_mask |= XFRM_SA_ATTR_FLAGS;
1791
1792 return 0;
1793}
1794
1795/**
1796 * Get the aead-params
1797 * @arg sa the xfrmnl_sa object
1798 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1799 * @arg key_len an optional output value for the key length in bits.
1800 * @arg icv_len an optional output value for the alt-icv-len.
1801 * @arg key an optional buffer large enough for the key. It must contain at least
1802 * ((@key_len + 7) / 8) bytes.
1803 *
1804 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1805 * call xfrmnl_sa_get_aead_params() without @key argument to query only the required buffer size.
1806 * This modified API is available in all versions of libnl3 that support the capability
1807 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1808 *
1809 * @return 0 on success or a negative error code.
1810 */
1811int xfrmnl_sa_get_aead_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* icv_len, char* key)
1812{
1813 if (sa->ce_mask & XFRM_SA_ATTR_ALG_AEAD)
1814 {
1815 if (alg_name)
1816 strcpy (alg_name, sa->aead->alg_name);
1817 if (key_len)
1818 *key_len = sa->aead->alg_key_len;
1819 if (icv_len)
1820 *icv_len = sa->aead->alg_icv_len;
1821 if (key)
1822 memcpy (key, sa->aead->alg_key, ((sa->aead->alg_key_len + 7)/8));
1823 }
1824 else
1825 return -1;
1826
1827 return 0;
1828}
1829
1830int xfrmnl_sa_set_aead_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int icv_len, const char* key)
1831{
1832 _nl_auto_free struct xfrmnl_algo_aead *b = NULL;
1833 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1834 uint32_t newlen = sizeof (struct xfrmnl_algo_aead) + keysize;
1835
1836 /* Free up the old key and allocate memory to hold new key */
1837 if (strlen (alg_name) >= sizeof (sa->aead->alg_name))
1838 return -1;
1839 if (!(b = calloc (1, newlen)))
1840 return -1;
1841
1842 strcpy (b->alg_name, alg_name);
1843 b->alg_key_len = key_len;
1844 b->alg_icv_len = icv_len;
1845 memcpy (b->alg_key, key, keysize);
1846
1847 free (sa->aead);
1848 sa->aead = _nl_steal_pointer (&b);
1849 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
1850 return 0;
1851}
1852
1853/**
1854 * Get the auth-params
1855 * @arg sa the xfrmnl_sa object
1856 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1857 * @arg key_len an optional output value for the key length in bits.
1858 * @arg trunc_len an optional output value for the alg-trunc-len.
1859 * @arg key an optional buffer large enough for the key. It must contain at least
1860 * ((@key_len + 7) / 8) bytes.
1861 *
1862 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1863 * call xfrmnl_sa_get_auth_params() without @key argument to query only the required buffer size.
1864 * This modified API is available in all versions of libnl3 that support the capability
1865 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1866 *
1867 * @return 0 on success or a negative error code.
1868 */
1869int xfrmnl_sa_get_auth_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* trunc_len, char* key)
1870{
1871 if (sa->ce_mask & XFRM_SA_ATTR_ALG_AUTH)
1872 {
1873 if (alg_name)
1874 strcpy (alg_name, sa->auth->alg_name);
1875 if (key_len)
1876 *key_len = sa->auth->alg_key_len;
1877 if (trunc_len)
1878 *trunc_len = sa->auth->alg_trunc_len;
1879 if (key)
1880 memcpy (key, sa->auth->alg_key, (sa->auth->alg_key_len + 7)/8);
1881 }
1882 else
1883 return -1;
1884
1885 return 0;
1886}
1887
1888int xfrmnl_sa_set_auth_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int trunc_len, const char* key)
1889{
1890 _nl_auto_free struct xfrmnl_algo_auth *b = NULL;
1891 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1892 uint32_t newlen = sizeof (struct xfrmnl_algo_auth) + keysize;
1893
1894 if (strlen (alg_name) >= sizeof (sa->auth->alg_name))
1895 return -1;
1896 if (!(b = calloc (1, newlen)))
1897 return -1;
1898
1899 strcpy (b->alg_name, alg_name);
1900 b->alg_key_len = key_len;
1901 b->alg_trunc_len = trunc_len;
1902 memcpy (b->alg_key, key, keysize);
1903
1904 free (sa->auth);
1905 sa->auth = _nl_steal_pointer (&b);
1906 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
1907 return 0;
1908}
1909
1910/**
1911 * Get the crypto-params
1912 * @arg sa the xfrmnl_sa object
1913 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1914 * @arg key_len an optional output value for the key length in bits.
1915 * @arg key an optional buffer large enough for the key. It must contain at least
1916 * ((@key_len + 7) / 8) bytes.
1917 *
1918 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1919 * call xfrmnl_sa_get_crypto_params() without @key argument to query only the required buffer size.
1920 * This modified API is available in all versions of libnl3 that support the capability
1921 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1922 *
1923 * @return 0 on success or a negative error code.
1924 */
1925int xfrmnl_sa_get_crypto_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1926{
1927 if (sa->ce_mask & XFRM_SA_ATTR_ALG_CRYPT)
1928 {
1929 if (alg_name)
1930 strcpy (alg_name, sa->crypt->alg_name);
1931 if (key_len)
1932 *key_len = sa->crypt->alg_key_len;
1933 if (key)
1934 memcpy (key, sa->crypt->alg_key, ((sa->crypt->alg_key_len + 7)/8));
1935 }
1936 else
1937 return -1;
1938
1939 return 0;
1940}
1941
1942int xfrmnl_sa_set_crypto_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1943{
1944 _nl_auto_free struct xfrmnl_algo *b = NULL;
1945 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1946 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1947
1948 if (strlen (alg_name) >= sizeof (sa->crypt->alg_name))
1949 return -1;
1950 if (!(b = calloc (1, newlen)))
1951 return -1;
1952
1953 strcpy (b->alg_name, alg_name);
1954 b->alg_key_len = key_len;
1955 memcpy (b->alg_key, key, keysize);
1956
1957 free(sa->crypt);
1958 sa->crypt = _nl_steal_pointer(&b);
1959 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
1960 return 0;
1961}
1962
1963/**
1964 * Get the comp-params
1965 * @arg sa the xfrmnl_sa object
1966 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1967 * @arg key_len an optional output value for the key length in bits.
1968 * @arg key an optional buffer large enough for the key. It must contain at least
1969 * ((@key_len + 7) / 8) bytes.
1970 *
1971 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1972 * call xfrmnl_sa_get_comp_params() without @key argument to query only the required buffer size.
1973 * This modified API is available in all versions of libnl3 that support the capability
1974 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1975 *
1976 * @return 0 on success or a negative error code.
1977 */
1978int xfrmnl_sa_get_comp_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1979{
1980 if (sa->ce_mask & XFRM_SA_ATTR_ALG_COMP)
1981 {
1982 if (alg_name)
1983 strcpy (alg_name, sa->comp->alg_name);
1984 if (key_len)
1985 *key_len = sa->comp->alg_key_len;
1986 if (key)
1987 memcpy (key, sa->comp->alg_key, ((sa->comp->alg_key_len + 7)/8));
1988 }
1989 else
1990 return -1;
1991
1992 return 0;
1993}
1994
1995int xfrmnl_sa_set_comp_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1996{
1997 _nl_auto_free struct xfrmnl_algo *b = NULL;
1998 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1999 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
2000
2001 if (strlen (alg_name) >= sizeof (sa->comp->alg_name))
2002 return -1;
2003 if (!(b = calloc (1, newlen)))
2004 return -1;
2005
2006 strcpy (b->alg_name, alg_name);
2007 b->alg_key_len = key_len;
2008 memcpy (b->alg_key, key, keysize);
2009
2010 free(sa->comp);
2011 sa->comp = _nl_steal_pointer(&b);
2012 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
2013 return 0;
2014}
2015
2016int xfrmnl_sa_get_encap_tmpl (struct xfrmnl_sa* sa, unsigned int* encap_type, unsigned int* encap_sport, unsigned int* encap_dport, struct nl_addr** encap_oa)
2017{
2018 if (sa->ce_mask & XFRM_SA_ATTR_ENCAP)
2019 {
2020 *encap_type = sa->encap->encap_type;
2021 *encap_sport = sa->encap->encap_sport;
2022 *encap_dport = sa->encap->encap_dport;
2023 *encap_oa = nl_addr_clone (sa->encap->encap_oa);
2024 }
2025 else
2026 return -1;
2027
2028 return 0;
2029}
2030
2031int xfrmnl_sa_set_encap_tmpl (struct xfrmnl_sa* sa, unsigned int encap_type, unsigned int encap_sport, unsigned int encap_dport, struct nl_addr* encap_oa)
2032{
2033 if (sa->encap) {
2034 /* Free up the old encap OA */
2035 if (sa->encap->encap_oa)
2036 nl_addr_put(sa->encap->encap_oa);
2037 memset(sa->encap, 0, sizeof (*sa->encap));
2038 } else if ((sa->encap = calloc(1, sizeof(*sa->encap))) == NULL)
2039 return -1;
2040
2041 /* Save the new info */
2042 sa->encap->encap_type = encap_type;
2043 sa->encap->encap_sport = encap_sport;
2044 sa->encap->encap_dport = encap_dport;
2045 nl_addr_get (encap_oa);
2046 sa->encap->encap_oa = encap_oa;
2047
2048 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
2049
2050 return 0;
2051}
2052
2053int xfrmnl_sa_get_tfcpad (struct xfrmnl_sa* sa)
2054{
2055 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
2056 return sa->tfcpad;
2057 else
2058 return -1;
2059}
2060
2061int xfrmnl_sa_set_tfcpad (struct xfrmnl_sa* sa, unsigned int tfcpad)
2062{
2063 sa->tfcpad = tfcpad;
2064 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
2065
2066 return 0;
2067}
2068
2069struct nl_addr* xfrmnl_sa_get_coaddr (struct xfrmnl_sa* sa)
2070{
2071 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
2072 return sa->coaddr;
2073 else
2074 return NULL;
2075}
2076
2077int xfrmnl_sa_set_coaddr (struct xfrmnl_sa* sa, struct nl_addr* coaddr)
2078{
2079 /* Free up the old coaddr */
2080 if (sa->coaddr)
2081 nl_addr_put (sa->coaddr);
2082
2083 /* Save the new info */
2084 nl_addr_get (coaddr);
2085 sa->coaddr = coaddr;
2086
2087 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
2088
2089 return 0;
2090}
2091
2092int xfrmnl_sa_get_mark (struct xfrmnl_sa* sa, unsigned int* mark_mask, unsigned int* mark_value)
2093{
2094 if (mark_mask == NULL || mark_value == NULL)
2095 return -1;
2096
2097 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
2098 {
2099 *mark_mask = sa->mark.m;
2100 *mark_value = sa->mark.v;
2101
2102 return 0;
2103 }
2104 else
2105 return -1;
2106}
2107
2108int xfrmnl_sa_set_mark (struct xfrmnl_sa* sa, unsigned int value, unsigned int mask)
2109{
2110 sa->mark.v = value;
2111 sa->mark.m = mask;
2112 sa->ce_mask |= XFRM_SA_ATTR_MARK;
2113
2114 return 0;
2115}
2116
2117/**
2118 * Get the security context.
2119 *
2120 * @arg sa The xfrmnl_sa object.
2121 * @arg doi An optional output value for the security context domain of interpretation.
2122 * @arg alg An optional output value for the security context algorithm.
2123 * @arg len An optional output value for the security context length, including the
2124 * terminating null byte ('\0').
2125 * @arg sid Unused parameter.
2126 * @arg ctx_str An optional buffer large enough for the security context string. It must
2127 * contain at least @len bytes.
2128 *
2129 * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
2130 * call xfrmnl_sa_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
2131 * This modified API is available in all versions of libnl3 that support the capability
2132 * @def NL_CAPABILITY_XFRM_SEC_CTX_LEN (@see nl_has_capability for further information).
2133 *
2134 * @return 0 on success or a negative error code.
2135 */
2136int xfrmnl_sa_get_sec_ctx (struct xfrmnl_sa* sa, unsigned int* doi, unsigned int* alg,
2137 unsigned int* len, unsigned int* sid, char* ctx_str)
2138{
2139 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
2140 {
2141 if (doi)
2142 *doi = sa->sec_ctx->ctx_doi;
2143 if (alg)
2144 *alg = sa->sec_ctx->ctx_alg;
2145 if (len)
2146 *len = sa->sec_ctx->ctx_len;
2147 if (ctx_str)
2148 memcpy (ctx_str, sa->sec_ctx->ctx, sa->sec_ctx->ctx_len);
2149 }
2150 else
2151 return -1;
2152
2153 return 0;
2154}
2155
2156/**
2157 * Set the security context.
2158 *
2159 * @arg sa The xfrmnl_sa object.
2160 * @arg doi Parameter for the security context domain of interpretation.
2161 * @arg alg Parameter for the security context algorithm.
2162 * @arg len Parameter for the length of the security context string containing
2163 * the terminating null byte ('\0').
2164 * @arg sid Unused parameter.
2165 * @arg ctx_str Buffer containing the security context string.
2166 *
2167 * @return 0 on success or a negative error code.
2168 */
2169int xfrmnl_sa_set_sec_ctx (struct xfrmnl_sa* sa, unsigned int doi, unsigned int alg, unsigned int len,
2170 unsigned int sid, const char* ctx_str)
2171{
2172 _nl_auto_free struct xfrmnl_user_sec_ctx *b = NULL;
2173
2174 if (!(b = calloc(1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + len)))
2175 return -1;
2176
2177 b->len = sizeof(struct xfrmnl_user_sec_ctx) + len;
2178 b->exttype = XFRMA_SEC_CTX;
2179 b->ctx_alg = alg;
2180 b->ctx_doi = doi;
2181 b->ctx_len = len;
2182 memcpy (b->ctx, ctx_str, len);
2183 b->ctx[len] = '\0';
2184
2185 free(sa->sec_ctx);
2186 sa->sec_ctx = _nl_steal_pointer(&b);
2187 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
2188 return 0;
2189}
2190
2191
2192int xfrmnl_sa_get_replay_maxage (struct xfrmnl_sa* sa)
2193{
2194 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE)
2195 return sa->replay_maxage;
2196 else
2197 return -1;
2198}
2199
2200int xfrmnl_sa_set_replay_maxage (struct xfrmnl_sa* sa, unsigned int replay_maxage)
2201{
2202 sa->replay_maxage = replay_maxage;
2203 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
2204
2205 return 0;
2206}
2207
2208int xfrmnl_sa_get_replay_maxdiff (struct xfrmnl_sa* sa)
2209{
2210 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF)
2211 return sa->replay_maxdiff;
2212 else
2213 return -1;
2214}
2215
2216int xfrmnl_sa_set_replay_maxdiff (struct xfrmnl_sa* sa, unsigned int replay_maxdiff)
2217{
2218 sa->replay_maxdiff = replay_maxdiff;
2219 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
2220
2221 return 0;
2222}
2223
2224int xfrmnl_sa_get_replay_state (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
2225{
2226 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2227 {
2228 if (sa->replay_state_esn == NULL)
2229 {
2230 *oseq = sa->replay_state.oseq;
2231 *seq = sa->replay_state.seq;
2232 *bmp = sa->replay_state.bitmap;
2233
2234 return 0;
2235 }
2236 else
2237 {
2238 return -1;
2239 }
2240 }
2241 else
2242 return -1;
2243}
2244
2245int xfrmnl_sa_set_replay_state (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq, unsigned int bitmap)
2246{
2247 sa->replay_state.oseq = oseq;
2248 sa->replay_state.seq = seq;
2249 sa->replay_state.bitmap = bitmap;
2250 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2251
2252 return 0;
2253}
2254
2255int xfrmnl_sa_get_replay_state_esn (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
2256 unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
2257{
2258 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2259 {
2260 if (sa->replay_state_esn)
2261 {
2262 *oseq = sa->replay_state_esn->oseq;
2263 *seq = sa->replay_state_esn->seq;
2264 *oseq_hi= sa->replay_state_esn->oseq_hi;
2265 *seq_hi = sa->replay_state_esn->seq_hi;
2266 *replay_window = sa->replay_state_esn->replay_window;
2267 *bmp_len = sa->replay_state_esn->bmp_len; // In number of 32 bit words
2268 memcpy (bmp, sa->replay_state_esn->bmp, sa->replay_state_esn->bmp_len * sizeof (uint32_t));
2269
2270 return 0;
2271 }
2272 else
2273 {
2274 return -1;
2275 }
2276 }
2277 else
2278 return -1;
2279}
2280
2281int xfrmnl_sa_set_replay_state_esn (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq,
2282 unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
2283 unsigned int bmp_len, unsigned int* bmp)
2284{
2285 _nl_auto_free struct xfrmnl_replay_state_esn *b = NULL;
2286
2287 if (!(b = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * bmp_len))))
2288 return -1;
2289
2290 b->oseq = oseq;
2291 b->seq = seq;
2292 b->oseq_hi = oseq_hi;
2293 b->seq_hi = seq_hi;
2294 b->replay_window = replay_window;
2295 b->bmp_len = bmp_len; // In number of 32 bit words
2296 memcpy (b->bmp, bmp, bmp_len * sizeof (uint32_t));
2297
2298 free(sa->replay_state_esn);
2299 sa->replay_state_esn = _nl_steal_pointer(&b);
2300 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2301 return 0;
2302}
2303
2304
2305/**
2306 * Get interface id and flags from xfrm_user_offload.
2307 *
2308 * @arg sa The xfrmnl_sa object.
2309 * @arg ifindex An optional output value for the offload interface index.
2310 * @arg flags An optional output value for the offload flags.
2311 *
2312 * @return 0 on success or a negative error code.
2313 */
2314int xfrmnl_sa_get_user_offload(struct xfrmnl_sa *sa, int *ifindex, uint8_t *flags)
2315{
2316 int ret = -1;
2317
2318 if (sa->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV && sa->user_offload) {
2319 if (ifindex)
2320 *ifindex = sa->user_offload->ifindex;
2321 if (flags)
2322 *flags = sa->user_offload->flags;
2323 ret = 0;
2324 }
2325
2326 return ret;
2327}
2328
2329
2330/**
2331 * Set interface id and flags for xfrm_user_offload.
2332 *
2333 * @arg sa The xfrmnl_sa object.
2334 * @arg ifindex Id of the offload interface.
2335 * @arg flags Offload flags for the state.
2336 *
2337 * @return 0 on success or a negative error code.
2338 */
2339int xfrmnl_sa_set_user_offload(struct xfrmnl_sa *sa, int ifindex, uint8_t flags)
2340{
2341 _nl_auto_free struct xfrmnl_user_offload *b = NULL;
2342
2343 if (!(b = calloc(1, sizeof(*b))))
2344 return -1;
2345
2346 b->ifindex = ifindex;
2347 b->flags = flags;
2348
2349 free(sa->user_offload);
2350 sa->user_offload = _nl_steal_pointer(&b);
2351 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
2352
2353 return 0;
2354}
2355
2356int xfrmnl_sa_is_hardexpiry_reached (struct xfrmnl_sa* sa)
2357{
2358 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2359 return (sa->hard > 0 ? 1: 0);
2360 else
2361 return 0;
2362}
2363
2364int xfrmnl_sa_is_expiry_reached (struct xfrmnl_sa* sa)
2365{
2366 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2367 return 1;
2368 else
2369 return 0;
2370}
2371
2372/** @} */
2373
2374static struct nl_object_ops xfrm_sa_obj_ops = {
2375 .oo_name = "xfrm/sa",
2376 .oo_size = sizeof(struct xfrmnl_sa),
2377 .oo_constructor = xfrm_sa_alloc_data,
2378 .oo_free_data = xfrm_sa_free_data,
2379 .oo_clone = xfrm_sa_clone,
2380 .oo_dump = {
2381 [NL_DUMP_LINE] = xfrm_sa_dump_line,
2382 [NL_DUMP_DETAILS] = xfrm_sa_dump_details,
2383 [NL_DUMP_STATS] = xfrm_sa_dump_stats,
2384 },
2385 .oo_compare = xfrm_sa_compare,
2386 .oo_attrs2str = xfrm_sa_attrs2str,
2387 .oo_id_attrs = (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO),
2388};
2389
2390static struct nl_af_group xfrm_sa_groups[] = {
2391 { AF_UNSPEC, XFRMNLGRP_SA },
2392 { AF_UNSPEC, XFRMNLGRP_EXPIRE },
2393 { END_OF_GROUP_LIST },
2394};
2395
2396static struct nl_cache_ops xfrmnl_sa_ops = {
2397 .co_name = "xfrm/sa",
2398 .co_hdrsize = sizeof(struct xfrm_usersa_info),
2399 .co_msgtypes = {
2400 { XFRM_MSG_NEWSA, NL_ACT_NEW, "new" },
2401 { XFRM_MSG_DELSA, NL_ACT_DEL, "del" },
2402 { XFRM_MSG_GETSA, NL_ACT_GET, "get" },
2403 { XFRM_MSG_EXPIRE, NL_ACT_UNSPEC, "expire"},
2404 { XFRM_MSG_UPDSA, NL_ACT_NEW, "update"},
2405 END_OF_MSGTYPES_LIST,
2406 },
2407 .co_protocol = NETLINK_XFRM,
2408 .co_groups = xfrm_sa_groups,
2409 .co_request_update = xfrm_sa_request_update,
2410 .co_msg_parser = xfrm_sa_msg_parser,
2411 .co_obj_ops = &xfrm_sa_obj_ops,
2412 .co_include_event = &xfrm_sa_update_cache
2413};
2414
2415/**
2416 * @name XFRM SA Cache Managament
2417 * @{
2418 */
2419
2420static void __attribute__ ((constructor)) xfrm_sa_init(void)
2421{
2422 nl_cache_mngt_register(&xfrmnl_sa_ops);
2423}
2424
2425static void __attribute__ ((destructor)) xfrm_sa_exit(void)
2426{
2427 nl_cache_mngt_unregister(&xfrmnl_sa_ops);
2428}
2429
2430/** @} */
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:180
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:79
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:159
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:98
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:96
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:115
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:969
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:527
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:216
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:945
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:589
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:497
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition: addr.c:897
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:1003
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:957
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:543
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:119
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition: attr.h:230
int nla_put(struct nl_msg *msg, int attrtype, int datalen, const void *data)
Add a unspecific attribute to netlink message.
Definition: attr.c:501
struct nlattr * nla_reserve(struct nl_msg *msg, int attrtype, int attrlen)
Reserve space for a attribute.
Definition: attr.c:457
@ NLA_U32
32 bit integer
Definition: attr.h:37
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:287
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:252
struct nl_object * nl_cache_search(struct nl_cache *cache, struct nl_object *needle)
Search object in cache.
Definition: cache.c:1114
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:146
void nl_cache_remove(struct nl_object *obj)
Remove object from cache.
Definition: cache.c:552
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:234
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:120
int nl_cache_move(struct nl_cache *cache, struct nl_object *obj)
Move object from one cache to another.
Definition: cache.c:524
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:349
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:108
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:566
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:216
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:450
int nl_object_get_msgtype(const struct nl_object *obj)
Return the netlink message type the object was derived from.
Definition: object.c:539
uint64_t nl_object_diff64(struct nl_object *a, struct nl_object *b)
Compute bitmask representing difference in attribute values.
Definition: object.c:371
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:221
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:210
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:55
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:515
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1246
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1177
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1111
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:579
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:1017
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:22
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:20
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:21
Dumping parameters.
Definition: types.h:32
Attribute validation policy.
Definition: attr.h:63
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68