libnl 3.12.0
sa.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36/**
37 * @ingroup xfrmnl
38 * @defgroup sa Security Association
39 * @brief
40 */
41
42#include "nl-default.h"
43
44#include <time.h>
45
46#include <netlink/netlink.h>
47#include <netlink/cache.h>
48#include <netlink/object.h>
49#include <netlink/xfrm/sa.h>
50#include <netlink/xfrm/selector.h>
51#include <netlink/xfrm/lifetime.h>
52
53#include "nl-xfrm.h"
54#include "nl-priv-dynamic-core/object-api.h"
55#include "nl-priv-dynamic-core/nl-core.h"
56#include "nl-priv-dynamic-core/cache-api.h"
57#include "nl-aux-core/nl-core.h"
58#include "nl-aux-xfrm/nl-xfrm.h"
59
60/** @cond SKIP */
61
62struct xfrmnl_stats {
63 uint32_t replay_window;
64 uint32_t replay;
65 uint32_t integrity_failed;
66};
67
68struct xfrmnl_algo_aead {
69 char alg_name[64];
70 uint32_t alg_key_len; /* in bits */
71 uint32_t alg_icv_len; /* in bits */
72 char alg_key[0];
73};
74
75struct xfrmnl_algo_auth {
76 char alg_name[64];
77 uint32_t alg_key_len; /* in bits */
78 uint32_t alg_trunc_len; /* in bits */
79 char alg_key[0];
80};
81
82struct xfrmnl_algo {
83 char alg_name[64];
84 uint32_t alg_key_len; /* in bits */
85 char alg_key[0];
86};
87
88struct xfrmnl_encap_tmpl {
89 uint16_t encap_type;
90 uint16_t encap_sport;
91 uint16_t encap_dport;
92 struct nl_addr* encap_oa;
93};
94
95struct xfrmnl_user_offload {
96 int ifindex;
97 uint8_t flags;
98};
99
100struct xfrmnl_sa {
101 NLHDR_COMMON
102
103 struct xfrmnl_sel* sel;
104 struct xfrmnl_id id;
105 struct nl_addr* saddr;
106 struct xfrmnl_ltime_cfg* lft;
107 struct xfrmnl_lifetime_cur curlft;
108 struct xfrmnl_stats stats;
109 uint32_t seq;
110 uint32_t reqid;
111 uint16_t family;
112 uint32_t if_id;
113 uint8_t mode; /* XFRM_MODE_xxx */
114 uint8_t replay_window;
115 uint8_t flags;
116 struct xfrmnl_algo_aead* aead;
117 struct xfrmnl_algo_auth* auth;
118 struct xfrmnl_algo* crypt;
119 struct xfrmnl_algo* comp;
120 struct xfrmnl_encap_tmpl* encap;
121 uint32_t tfcpad;
122 struct nl_addr* coaddr;
123 struct xfrmnl_mark mark;
124 struct xfrmnl_user_sec_ctx* sec_ctx;
125 uint32_t replay_maxage;
126 uint32_t replay_maxdiff;
127 struct xfrmnl_replay_state replay_state;
128 struct xfrmnl_replay_state_esn* replay_state_esn;
129 uint8_t hard;
130 struct xfrmnl_user_offload* user_offload;
131};
132
133#define XFRM_SA_ATTR_SEL 0x01
134#define XFRM_SA_ATTR_DADDR 0x02
135#define XFRM_SA_ATTR_SPI 0x04
136#define XFRM_SA_ATTR_PROTO 0x08
137#define XFRM_SA_ATTR_SADDR 0x10
138#define XFRM_SA_ATTR_LTIME_CFG 0x20
139#define XFRM_SA_ATTR_LTIME_CUR 0x40
140#define XFRM_SA_ATTR_STATS 0x80
141#define XFRM_SA_ATTR_SEQ 0x100
142#define XFRM_SA_ATTR_REQID 0x200
143#define XFRM_SA_ATTR_FAMILY 0x400
144#define XFRM_SA_ATTR_MODE 0x800
145#define XFRM_SA_ATTR_REPLAY_WIN 0x1000
146#define XFRM_SA_ATTR_FLAGS 0x2000
147#define XFRM_SA_ATTR_ALG_AEAD 0x4000
148#define XFRM_SA_ATTR_ALG_AUTH 0x8000
149#define XFRM_SA_ATTR_ALG_CRYPT 0x10000
150#define XFRM_SA_ATTR_ALG_COMP 0x20000
151#define XFRM_SA_ATTR_ENCAP 0x40000
152#define XFRM_SA_ATTR_TFCPAD 0x80000
153#define XFRM_SA_ATTR_COADDR 0x100000
154#define XFRM_SA_ATTR_MARK 0x200000
155#define XFRM_SA_ATTR_SECCTX 0x400000
156#define XFRM_SA_ATTR_REPLAY_MAXAGE 0x800000
157#define XFRM_SA_ATTR_REPLAY_MAXDIFF 0x1000000
158#define XFRM_SA_ATTR_REPLAY_STATE 0x2000000
159#define XFRM_SA_ATTR_EXPIRE 0x4000000
160#define XFRM_SA_ATTR_OFFLOAD_DEV 0x8000000
161#define XFRM_SA_ATTR_IF_ID 0x10000000
162
163static struct nl_cache_ops xfrmnl_sa_ops;
164static struct nl_object_ops xfrm_sa_obj_ops;
165/** @endcond */
166
167static void xfrm_sa_alloc_data(struct nl_object *c)
168{
169 struct xfrmnl_sa* sa = nl_object_priv (c);
170
171 if ((sa->sel = xfrmnl_sel_alloc ()) == NULL)
172 return;
173
174 if ((sa->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
175 return;
176}
177
178static void xfrm_sa_free_data(struct nl_object *c)
179{
180 struct xfrmnl_sa* sa = nl_object_priv (c);
181
182 if (sa == NULL)
183 return;
184
185 xfrmnl_sel_put (sa->sel);
186 xfrmnl_ltime_cfg_put (sa->lft);
187 nl_addr_put (sa->id.daddr);
188 nl_addr_put (sa->saddr);
189
190 if (sa->aead)
191 free (sa->aead);
192 if (sa->auth)
193 free (sa->auth);
194 if (sa->crypt)
195 free (sa->crypt);
196 if (sa->comp)
197 free (sa->comp);
198 if (sa->encap) {
199 if (sa->encap->encap_oa)
200 nl_addr_put(sa->encap->encap_oa);
201 free(sa->encap);
202 }
203 if (sa->coaddr)
204 nl_addr_put (sa->coaddr);
205 if (sa->sec_ctx)
206 free (sa->sec_ctx);
207 if (sa->replay_state_esn)
208 free (sa->replay_state_esn);
209 if (sa->user_offload)
210 free(sa->user_offload);
211}
212
213static int xfrm_sa_clone(struct nl_object *_dst, struct nl_object *_src)
214{
215 struct xfrmnl_sa* dst = nl_object_priv(_dst);
216 struct xfrmnl_sa* src = nl_object_priv(_src);
217 uint32_t len = 0;
218
219 dst->sel = NULL;
220 dst->id.daddr = NULL;
221 dst->saddr = NULL;
222 dst->lft = NULL;
223 dst->aead = NULL;
224 dst->auth = NULL;
225 dst->crypt = NULL;
226 dst->comp = NULL;
227 dst->encap = NULL;
228 dst->coaddr = NULL;
229 dst->sec_ctx = NULL;
230 dst->replay_state_esn = NULL;
231 dst->user_offload = NULL;
232
233 if (src->sel)
234 if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
235 return -NLE_NOMEM;
236
237 if (src->lft)
238 if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
239 return -NLE_NOMEM;
240
241 if (src->id.daddr)
242 if ((dst->id.daddr = nl_addr_clone (src->id.daddr)) == NULL)
243 return -NLE_NOMEM;
244
245 if (src->saddr)
246 if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
247 return -NLE_NOMEM;
248
249 if (src->aead) {
250 len = sizeof (struct xfrmnl_algo_aead) + ((src->aead->alg_key_len + 7) / 8);
251 if ((dst->aead = calloc (1, len)) == NULL)
252 return -NLE_NOMEM;
253 memcpy ((void *)dst->aead, (void *)src->aead, len);
254 }
255
256 if (src->auth) {
257 len = sizeof (struct xfrmnl_algo_auth) + ((src->auth->alg_key_len + 7) / 8);
258 if ((dst->auth = calloc (1, len)) == NULL)
259 return -NLE_NOMEM;
260 memcpy ((void *)dst->auth, (void *)src->auth, len);
261 }
262
263 if (src->crypt) {
264 len = sizeof (struct xfrmnl_algo) + ((src->crypt->alg_key_len + 7) / 8);
265 if ((dst->crypt = calloc (1, len)) == NULL)
266 return -NLE_NOMEM;
267 memcpy ((void *)dst->crypt, (void *)src->crypt, len);
268 }
269
270 if (src->comp) {
271 len = sizeof (struct xfrmnl_algo) + ((src->comp->alg_key_len + 7) / 8);
272 if ((dst->comp = calloc (1, len)) == NULL)
273 return -NLE_NOMEM;
274 memcpy ((void *)dst->comp, (void *)src->comp, len);
275 }
276
277 if (src->encap) {
278 len = sizeof (struct xfrmnl_encap_tmpl);
279 if ((dst->encap = calloc (1, len)) == NULL)
280 return -NLE_NOMEM;
281 memcpy ((void *)dst->encap, (void *)src->encap, len);
282 }
283
284 if (src->coaddr)
285 if ((dst->coaddr = nl_addr_clone (src->coaddr)) == NULL)
286 return -NLE_NOMEM;
287
288 if (src->sec_ctx) {
289 len = sizeof (*src->sec_ctx) + src->sec_ctx->ctx_len;
290 if ((dst->sec_ctx = calloc (1, len)) == NULL)
291 return -NLE_NOMEM;
292 memcpy ((void *)dst->sec_ctx, (void *)src->sec_ctx, len);
293 }
294
295 if (src->replay_state_esn) {
296 len = sizeof (struct xfrmnl_replay_state_esn) + (src->replay_state_esn->bmp_len * sizeof (uint32_t));
297 if ((dst->replay_state_esn = calloc (1, len)) == NULL)
298 return -NLE_NOMEM;
299 memcpy ((void *)dst->replay_state_esn, (void *)src->replay_state_esn, len);
300 }
301
302 if (src->user_offload) {
303 dst->user_offload = _nl_memdup_ptr(src->user_offload);
304 if (!dst->user_offload)
305 return -NLE_NOMEM;
306 }
307
308 return 0;
309}
310
311static uint64_t xfrm_sa_compare(struct nl_object *_a, struct nl_object *_b,
312 uint64_t attrs, int flags)
313{
314 struct xfrmnl_sa* a = (struct xfrmnl_sa *) _a;
315 struct xfrmnl_sa* b = (struct xfrmnl_sa *) _b;
316 uint64_t diff = 0;
317 int found = 0;
318
319#define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
320 diff |= _DIFF(XFRM_SA_ATTR_SEL, xfrmnl_sel_cmp(a->sel, b->sel));
321 diff |= _DIFF(XFRM_SA_ATTR_DADDR,
322 nl_addr_cmp(a->id.daddr, b->id.daddr));
323 diff |= _DIFF(XFRM_SA_ATTR_SPI, a->id.spi != b->id.spi);
324 diff |= _DIFF(XFRM_SA_ATTR_PROTO, a->id.proto != b->id.proto);
325 diff |= _DIFF(XFRM_SA_ATTR_SADDR, nl_addr_cmp(a->saddr, b->saddr));
326 diff |= _DIFF(XFRM_SA_ATTR_LTIME_CFG,
327 xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
328 diff |= _DIFF(XFRM_SA_ATTR_REQID, a->reqid != b->reqid);
329 diff |= _DIFF(XFRM_SA_ATTR_FAMILY, a->family != b->family);
330 diff |= _DIFF(XFRM_SA_ATTR_MODE, a->mode != b->mode);
331 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_WIN,
332 a->replay_window != b->replay_window);
333 diff |= _DIFF(XFRM_SA_ATTR_FLAGS, a->flags != b->flags);
334 diff |= _DIFF(XFRM_SA_ATTR_ALG_AEAD,
335 (strcmp(a->aead->alg_name, b->aead->alg_name) ||
336 (a->aead->alg_key_len != b->aead->alg_key_len) ||
337 (a->aead->alg_icv_len != b->aead->alg_icv_len) ||
338 memcmp(a->aead->alg_key, b->aead->alg_key,
339 ((a->aead->alg_key_len + 7) / 8))));
340 diff |= _DIFF(XFRM_SA_ATTR_ALG_AUTH,
341 (strcmp(a->auth->alg_name, b->auth->alg_name) ||
342 (a->auth->alg_key_len != b->auth->alg_key_len) ||
343 (a->auth->alg_trunc_len != b->auth->alg_trunc_len) ||
344 memcmp(a->auth->alg_key, b->auth->alg_key,
345 ((a->auth->alg_key_len + 7) / 8))));
346 diff |= _DIFF(XFRM_SA_ATTR_ALG_CRYPT,
347 (strcmp(a->crypt->alg_name, b->crypt->alg_name) ||
348 (a->crypt->alg_key_len != b->crypt->alg_key_len) ||
349 memcmp(a->crypt->alg_key, b->crypt->alg_key,
350 ((a->crypt->alg_key_len + 7) / 8))));
351 diff |= _DIFF(XFRM_SA_ATTR_ALG_COMP,
352 (strcmp(a->comp->alg_name, b->comp->alg_name) ||
353 (a->comp->alg_key_len != b->comp->alg_key_len) ||
354 memcmp(a->comp->alg_key, b->comp->alg_key,
355 ((a->comp->alg_key_len + 7) / 8))));
356 diff |= _DIFF(XFRM_SA_ATTR_ENCAP,
357 ((a->encap->encap_type != b->encap->encap_type) ||
358 (a->encap->encap_sport != b->encap->encap_sport) ||
359 (a->encap->encap_dport != b->encap->encap_dport) ||
360 nl_addr_cmp(a->encap->encap_oa, b->encap->encap_oa)));
361 diff |= _DIFF(XFRM_SA_ATTR_TFCPAD, a->tfcpad != b->tfcpad);
362 diff |= _DIFF(XFRM_SA_ATTR_COADDR, nl_addr_cmp(a->coaddr, b->coaddr));
363 diff |= _DIFF(XFRM_SA_ATTR_MARK,
364 (a->mark.m != b->mark.m) || (a->mark.v != b->mark.v));
365 diff |= _DIFF(XFRM_SA_ATTR_IF_ID, a->if_id != b->if_id);
366 diff |= _DIFF(XFRM_SA_ATTR_SECCTX,
367 ((a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
368 (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
369 (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
370 strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
371 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_MAXAGE,
372 a->replay_maxage != b->replay_maxage);
373 diff |= _DIFF(XFRM_SA_ATTR_REPLAY_MAXDIFF,
374 a->replay_maxdiff != b->replay_maxdiff);
375 diff |= _DIFF(XFRM_SA_ATTR_EXPIRE, a->hard != b->hard);
376
377 /* Compare replay states */
378 found = AVAILABLE_MISMATCH (a, b, XFRM_SA_ATTR_REPLAY_STATE);
379 if (found == 0) // attribute exists in both objects
380 {
381 if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
382 ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
383 found |= 1;
384
385 if (found == 0) // same replay type. compare actual values
386 {
387 if (a->replay_state_esn)
388 {
389 if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
390 diff |= 1;
391 else
392 {
393 uint32_t len = sizeof (struct xfrmnl_replay_state_esn) +
394 (a->replay_state_esn->bmp_len * sizeof (uint32_t));
395 diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
396 }
397 }
398 else
399 {
400 if ((a->replay_state.oseq != b->replay_state.oseq) ||
401 (a->replay_state.seq != b->replay_state.seq) ||
402 (a->replay_state.bitmap != b->replay_state.bitmap))
403 diff |= 1;
404 }
405 }
406 }
407#undef _DIFF
408
409 return diff;
410}
411
412/**
413 * @name XFRM SA Attribute Translations
414 * @{
415 */
416static const struct trans_tbl sa_attrs[] = {
417 __ADD(XFRM_SA_ATTR_SEL, selector),
418 __ADD(XFRM_SA_ATTR_DADDR, daddr),
419 __ADD(XFRM_SA_ATTR_SPI, spi),
420 __ADD(XFRM_SA_ATTR_PROTO, proto),
421 __ADD(XFRM_SA_ATTR_SADDR, saddr),
422 __ADD(XFRM_SA_ATTR_LTIME_CFG, lifetime_cfg),
423 __ADD(XFRM_SA_ATTR_LTIME_CUR, lifetime_cur),
424 __ADD(XFRM_SA_ATTR_STATS, stats),
425 __ADD(XFRM_SA_ATTR_SEQ, seqnum),
426 __ADD(XFRM_SA_ATTR_REQID, reqid),
427 __ADD(XFRM_SA_ATTR_FAMILY, family),
428 __ADD(XFRM_SA_ATTR_MODE, mode),
429 __ADD(XFRM_SA_ATTR_REPLAY_WIN, replay_window),
430 __ADD(XFRM_SA_ATTR_FLAGS, flags),
431 __ADD(XFRM_SA_ATTR_ALG_AEAD, alg_aead),
432 __ADD(XFRM_SA_ATTR_ALG_AUTH, alg_auth),
433 __ADD(XFRM_SA_ATTR_ALG_CRYPT, alg_crypto),
434 __ADD(XFRM_SA_ATTR_ALG_COMP, alg_comp),
435 __ADD(XFRM_SA_ATTR_ENCAP, encap),
436 __ADD(XFRM_SA_ATTR_TFCPAD, tfcpad),
437 __ADD(XFRM_SA_ATTR_COADDR, coaddr),
438 __ADD(XFRM_SA_ATTR_MARK, mark),
439 __ADD(XFRM_SA_ATTR_SECCTX, sec_ctx),
440 __ADD(XFRM_SA_ATTR_REPLAY_MAXAGE, replay_maxage),
441 __ADD(XFRM_SA_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
442 __ADD(XFRM_SA_ATTR_REPLAY_STATE, replay_state),
443 __ADD(XFRM_SA_ATTR_EXPIRE, expire),
444 __ADD(XFRM_SA_ATTR_OFFLOAD_DEV, user_offload),
445 __ADD(XFRM_SA_ATTR_IF_ID, if_id),
446};
447
448static char* xfrm_sa_attrs2str(int attrs, char *buf, size_t len)
449{
450 return __flags2str (attrs, buf, len, sa_attrs, ARRAY_SIZE(sa_attrs));
451}
452/** @} */
453
454/**
455 * @name XFRM SA Flags Translations
456 * @{
457 */
458static const struct trans_tbl sa_flags[] = {
459 __ADD(XFRM_STATE_NOECN, no ecn),
460 __ADD(XFRM_STATE_DECAP_DSCP, decap dscp),
461 __ADD(XFRM_STATE_NOPMTUDISC, no pmtu discovery),
462 __ADD(XFRM_STATE_WILDRECV, wild receive),
463 __ADD(XFRM_STATE_ICMP, icmp),
464 __ADD(XFRM_STATE_AF_UNSPEC, unspecified),
465 __ADD(XFRM_STATE_ALIGN4, align4),
466 __ADD(XFRM_STATE_ESN, esn),
467};
468
469char* xfrmnl_sa_flags2str(int flags, char *buf, size_t len)
470{
471 return __flags2str (flags, buf, len, sa_flags, ARRAY_SIZE(sa_flags));
472}
473
474int xfrmnl_sa_str2flag(const char *name)
475{
476 return __str2flags (name, sa_flags, ARRAY_SIZE(sa_flags));
477}
478/** @} */
479
480/**
481 * @name XFRM SA Mode Translations
482 * @{
483 */
484static const struct trans_tbl sa_modes[] = {
485 __ADD(XFRM_MODE_TRANSPORT, transport),
486 __ADD(XFRM_MODE_TUNNEL, tunnel),
487 __ADD(XFRM_MODE_ROUTEOPTIMIZATION, route optimization),
488 __ADD(XFRM_MODE_IN_TRIGGER, in trigger),
489 __ADD(XFRM_MODE_BEET, beet),
490};
491
492char* xfrmnl_sa_mode2str(int mode, char *buf, size_t len)
493{
494 return __type2str (mode, buf, len, sa_modes, ARRAY_SIZE(sa_modes));
495}
496
497int xfrmnl_sa_str2mode(const char *name)
498{
499 return __str2type (name, sa_modes, ARRAY_SIZE(sa_modes));
500}
501/** @} */
502
503
504static void xfrm_sa_dump_line(struct nl_object *a, struct nl_dump_params *p)
505{
506 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
507 struct xfrmnl_sa* sa = (struct xfrmnl_sa *) a;
508 char flags[128], mode[128];
509 time_t add_time, use_time;
510 struct tm *add_time_tm, *use_time_tm;
511 struct tm tm_buf;
512
513 nl_dump_line(p, "src %s dst %s family: %s\n", nl_addr2str(sa->saddr, src, sizeof(src)),
514 nl_addr2str(sa->id.daddr, dst, sizeof(dst)),
515 nl_af2str (sa->family, flags, sizeof (flags)));
516
517 nl_dump_line(p, "\tproto %s spi 0x%x reqid %u\n",
518 nl_ip_proto2str (sa->id.proto, flags, sizeof(flags)),
519 sa->id.spi, sa->reqid);
520
521 xfrmnl_sa_flags2str(sa->flags, flags, sizeof (flags));
522 xfrmnl_sa_mode2str(sa->mode, mode, sizeof (mode));
523 nl_dump_line(p, "\tmode: %s flags: %s (0x%x) seq: %u replay window: %u\n",
524 mode, flags, sa->flags, sa->seq, sa->replay_window);
525
526 nl_dump_line(p, "\tlifetime configuration: \n");
527 if (sa->lft->soft_byte_limit == XFRM_INF)
528 sprintf (flags, "INF");
529 else
530 sprintf (flags, "%" PRIu64, sa->lft->soft_byte_limit);
531 if (sa->lft->soft_packet_limit == XFRM_INF)
532 sprintf (mode, "INF");
533 else
534 sprintf (mode, "%" PRIu64, sa->lft->soft_packet_limit);
535 nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets)\n", flags, mode);
536 if (sa->lft->hard_byte_limit == XFRM_INF)
537 sprintf (flags, "INF");
538 else
539 sprintf (flags, "%" PRIu64, sa->lft->hard_byte_limit);
540 if (sa->lft->hard_packet_limit == XFRM_INF)
541 sprintf (mode, "INF");
542 else
543 sprintf (mode, "%" PRIu64, sa->lft->hard_packet_limit);
544 nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets)\n", flags,
545 mode);
546 nl_dump_line(
547 p,
548 "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
549 (long long unsigned)sa->lft->soft_add_expires_seconds,
550 (long long unsigned)sa->lft->soft_use_expires_seconds);
551 nl_dump_line(
552 p,
553 "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
554 (long long unsigned)sa->lft->hard_add_expires_seconds,
555 (long long unsigned)sa->lft->hard_use_expires_seconds);
556
557 nl_dump_line(p, "\tlifetime current: \n");
558 nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
559 (long long unsigned)sa->curlft.bytes,
560 (long long unsigned)sa->curlft.packets);
561 if (sa->curlft.add_time != 0)
562 {
563 add_time = sa->curlft.add_time;
564 add_time_tm = gmtime_r (&add_time, &tm_buf);
565 strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
566 }
567 else
568 {
569 sprintf (flags, "%s", "-");
570 }
571
572 if (sa->curlft.use_time != 0)
573 {
574 use_time = sa->curlft.use_time;
575 use_time_tm = gmtime_r (&use_time, &tm_buf);
576 strftime (mode, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
577 }
578 else
579 {
580 sprintf (mode, "%s", "-");
581 }
582 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, mode);
583
584 if (sa->aead)
585 {
586 nl_dump_line(p, "\tAEAD Algo: \n");
587 nl_dump_line(p, "\t\tName: %s Key len(bits): %u ICV Len(bits): %u\n",
588 sa->aead->alg_name, sa->aead->alg_key_len, sa->aead->alg_icv_len);
589 }
590
591 if (sa->auth)
592 {
593 nl_dump_line(p, "\tAuth Algo: \n");
594 nl_dump_line(p, "\t\tName: %s Key len(bits): %u Trunc len(bits): %u\n",
595 sa->auth->alg_name, sa->auth->alg_key_len, sa->auth->alg_trunc_len);
596 }
597
598 if (sa->crypt)
599 {
600 nl_dump_line(p, "\tEncryption Algo: \n");
601 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
602 sa->crypt->alg_name, sa->crypt->alg_key_len);
603 }
604
605 if (sa->comp)
606 {
607 nl_dump_line(p, "\tCompression Algo: \n");
608 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
609 sa->comp->alg_name, sa->comp->alg_key_len);
610 }
611
612 if (sa->encap)
613 {
614 nl_dump_line(p, "\tEncapsulation template: \n");
615 nl_dump_line(p, "\t\tType: %d Src port: %d Dst port: %d Encap addr: %s\n",
616 sa->encap->encap_type, sa->encap->encap_sport, sa->encap->encap_dport,
617 nl_addr2str (sa->encap->encap_oa, dst, sizeof (dst)));
618 }
619
620 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
621 nl_dump_line(p, "\tTFC Pad: %u\n", sa->tfcpad);
622
623 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
624 nl_dump_line(p, "\tCO Address: %s\n", nl_addr2str (sa->coaddr, dst, sizeof (dst)));
625
626 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
627 nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sa->mark.m, sa->mark.v);
628
629 if (sa->ce_mask & XFRM_SA_ATTR_IF_ID)
630 nl_dump_line(p, "\tXFRM interface ID: 0x%x\n", sa->if_id);
631
632 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
633 nl_dump_line(p, "\tDOI: %d Algo: %d Len: %u ctx: %s\n", sa->sec_ctx->ctx_doi,
634 sa->sec_ctx->ctx_alg, sa->sec_ctx->ctx_len, sa->sec_ctx->ctx);
635
636 nl_dump_line(p, "\treplay info: \n");
637 nl_dump_line(p, "\t\tmax age %u max diff %u \n", sa->replay_maxage, sa->replay_maxdiff);
638
639 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
640 {
641 nl_dump_line(p, "\treplay state info: \n");
642 if (sa->replay_state_esn)
643 {
644 nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
645 sa->replay_state_esn->oseq, sa->replay_state_esn->seq,
646 sa->replay_state_esn->oseq_hi, sa->replay_state_esn->seq_hi,
647 sa->replay_state_esn->replay_window);
648 }
649 else
650 {
651 nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", sa->replay_state.oseq,
652 sa->replay_state.seq, sa->replay_state.bitmap);
653 }
654 }
655
656 nl_dump_line(p, "\tselector info: \n");
657 xfrmnl_sel_dump (sa->sel, p);
658
659 nl_dump_line(p, "\tHard: %d\n", sa->hard);
660
661 nl_dump(p, "\n");
662}
663
664static void xfrm_sa_dump_stats(struct nl_object *a, struct nl_dump_params *p)
665{
666 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)a;
667
668 nl_dump_line(p, "\tstats: \n");
669 nl_dump_line(p, "\t\treplay window: %u replay: %u integrity failed: %u \n",
670 sa->stats.replay_window, sa->stats.replay, sa->stats.integrity_failed);
671
672 return;
673}
674
675static void xfrm_sa_dump_details(struct nl_object *a, struct nl_dump_params *p)
676{
677 xfrm_sa_dump_line(a, p);
678 xfrm_sa_dump_stats (a, p);
679}
680
681/**
682 * @name XFRM SA Object Allocation/Freeage
683 * @{
684 */
685
686struct xfrmnl_sa* xfrmnl_sa_alloc(void)
687{
688 return (struct xfrmnl_sa*) nl_object_alloc(&xfrm_sa_obj_ops);
689}
690
691void xfrmnl_sa_put(struct xfrmnl_sa* sa)
692{
693 nl_object_put((struct nl_object *) sa);
694}
695
696/** @} */
697
698/**
699 * @name SA Cache Managament
700 * @{
701 */
702
703/**
704 * Build a SA cache including all SAs currently configured in the kernel.
705 * @arg sock Netlink socket.
706 * @arg result Pointer to store resulting cache.
707 *
708 * Allocates a new SA cache, initializes it properly and updates it
709 * to include all SAs currently configured in the kernel.
710 *
711 * @return 0 on success or a negative error code.
712 */
713int xfrmnl_sa_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
714{
715 return nl_cache_alloc_and_fill(&xfrmnl_sa_ops, sock, result);
716}
717
718/**
719 * Look up a SA by destination address, SPI, protocol
720 * @arg cache SA cache
721 * @arg daddr destination address of the SA
722 * @arg spi SPI
723 * @arg proto protocol
724 * @return sa handle or NULL if no match was found.
725 */
726struct xfrmnl_sa* xfrmnl_sa_get(struct nl_cache* cache, struct nl_addr* daddr,
727 unsigned int spi, unsigned int proto)
728{
729 struct xfrmnl_sa *sa;
730
731 //nl_list_for_each_entry(sa, &cache->c_items, ce_list) {
732 for (sa = (struct xfrmnl_sa*)nl_cache_get_first (cache);
733 sa != NULL;
734 sa = (struct xfrmnl_sa*)nl_cache_get_next ((struct nl_object*)sa))
735 {
736 if (sa->id.proto == proto &&
737 sa->id.spi == spi &&
738 !nl_addr_cmp(sa->id.daddr, daddr))
739 {
740 nl_object_get((struct nl_object *) sa);
741 return sa;
742 }
743
744 }
745
746 return NULL;
747}
748
749
750/** @} */
751
752
753static struct nla_policy xfrm_sa_policy[XFRMA_MAX+1] = {
754 [XFRMA_SA] = { .minlen = sizeof(struct xfrm_usersa_info)},
755 [XFRMA_ALG_AUTH_TRUNC] = { .minlen = sizeof(struct xfrm_algo_auth)},
756 [XFRMA_ALG_AEAD] = { .minlen = sizeof(struct xfrm_algo_aead) },
757 [XFRMA_ALG_AUTH] = { .minlen = sizeof(struct xfrm_algo) },
758 [XFRMA_ALG_CRYPT] = { .minlen = sizeof(struct xfrm_algo) },
759 [XFRMA_ALG_COMP] = { .minlen = sizeof(struct xfrm_algo) },
760 [XFRMA_ENCAP] = { .minlen = sizeof(struct xfrm_encap_tmpl) },
761 [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
762 [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
763 [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
764 [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
765 [XFRMA_OFFLOAD_DEV] = { .minlen = sizeof(struct xfrm_user_offload) },
766 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
767 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
768 [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
769 [XFRMA_COADDR] = { .minlen = sizeof(xfrm_address_t) },
770 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
771 [XFRMA_TFCPAD] = { .type = NLA_U32 },
772 [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
773 [XFRMA_IF_ID] = { .type = NLA_U32 },
774};
775
776static int xfrm_sa_request_update(struct nl_cache *c, struct nl_sock *h)
777{
778 return nl_send_simple (h, XFRM_MSG_GETSA, NLM_F_DUMP, NULL, 0);
779}
780
781int xfrmnl_sa_parse(struct nlmsghdr *n, struct xfrmnl_sa **result)
782{
783 _nl_auto_nl_addr struct nl_addr *addr1 = NULL;
784 _nl_auto_nl_addr struct nl_addr *addr2 = NULL;
785 _nl_auto_xfrmnl_sa struct xfrmnl_sa *sa = NULL;
786 struct nlattr *tb[XFRMA_MAX + 1];
787 struct xfrm_usersa_info* sa_info;
788 struct xfrm_user_expire* ue;
789 int len, err;
790
791 sa = xfrmnl_sa_alloc();
792 if (!sa)
793 return -NLE_NOMEM;
794
795 sa->ce_msgtype = n->nlmsg_type;
796 if (n->nlmsg_type == XFRM_MSG_EXPIRE)
797 {
798 ue = nlmsg_data(n);
799 sa_info = &ue->state;
800 sa->hard = ue->hard;
801 sa->ce_mask |= XFRM_SA_ATTR_EXPIRE;
802 }
803 else if (n->nlmsg_type == XFRM_MSG_DELSA)
804 {
805 sa_info = (struct xfrm_usersa_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_usersa_id) + NLA_HDRLEN);
806 }
807 else
808 {
809 sa_info = nlmsg_data(n);
810 }
811
812 err = nlmsg_parse(n, sizeof(struct xfrm_usersa_info), tb, XFRMA_MAX, xfrm_sa_policy);
813 if (err < 0)
814 return err;
815
816 if (!(addr1 = _nl_addr_build(sa_info->sel.family, &sa_info->sel.daddr)))
817 return -NLE_NOMEM;
818 nl_addr_set_prefixlen (addr1, sa_info->sel.prefixlen_d);
819 xfrmnl_sel_set_daddr (sa->sel, addr1);
820 xfrmnl_sel_set_prefixlen_d (sa->sel, sa_info->sel.prefixlen_d);
821
822 if (!(addr2 = _nl_addr_build(sa_info->sel.family, &sa_info->sel.saddr)))
823 return -NLE_NOMEM;
824 nl_addr_set_prefixlen (addr2, sa_info->sel.prefixlen_s);
825 xfrmnl_sel_set_saddr (sa->sel, addr2);
826 xfrmnl_sel_set_prefixlen_s (sa->sel, sa_info->sel.prefixlen_s);
827
828 xfrmnl_sel_set_dport (sa->sel, ntohs(sa_info->sel.dport));
829 xfrmnl_sel_set_dportmask (sa->sel, ntohs(sa_info->sel.dport_mask));
830 xfrmnl_sel_set_sport (sa->sel, ntohs(sa_info->sel.sport));
831 xfrmnl_sel_set_sportmask (sa->sel, ntohs(sa_info->sel.sport_mask));
832 xfrmnl_sel_set_family (sa->sel, sa_info->sel.family);
833 xfrmnl_sel_set_proto (sa->sel, sa_info->sel.proto);
834 xfrmnl_sel_set_ifindex (sa->sel, sa_info->sel.ifindex);
835 xfrmnl_sel_set_userid (sa->sel, sa_info->sel.user);
836 sa->ce_mask |= XFRM_SA_ATTR_SEL;
837
838 if (!(sa->id.daddr = _nl_addr_build(sa_info->family, &sa_info->id.daddr)))
839 return -NLE_NOMEM;
840 sa->id.spi = ntohl(sa_info->id.spi);
841 sa->id.proto = sa_info->id.proto;
842 sa->ce_mask |= (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO);
843
844 if (!(sa->saddr = _nl_addr_build(sa_info->family, &sa_info->saddr)))
845 return -NLE_NOMEM;
846 sa->ce_mask |= XFRM_SA_ATTR_SADDR;
847
848 sa->lft->soft_byte_limit = sa_info->lft.soft_byte_limit;
849 sa->lft->hard_byte_limit = sa_info->lft.hard_byte_limit;
850 sa->lft->soft_packet_limit = sa_info->lft.soft_packet_limit;
851 sa->lft->hard_packet_limit = sa_info->lft.hard_packet_limit;
852 sa->lft->soft_add_expires_seconds = sa_info->lft.soft_add_expires_seconds;
853 sa->lft->hard_add_expires_seconds = sa_info->lft.hard_add_expires_seconds;
854 sa->lft->soft_use_expires_seconds = sa_info->lft.soft_use_expires_seconds;
855 sa->lft->hard_use_expires_seconds = sa_info->lft.hard_use_expires_seconds;
856 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
857
858 sa->curlft.bytes = sa_info->curlft.bytes;
859 sa->curlft.packets = sa_info->curlft.packets;
860 sa->curlft.add_time = sa_info->curlft.add_time;
861 sa->curlft.use_time = sa_info->curlft.use_time;
862 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CUR;
863
864 sa->stats.replay_window = sa_info->stats.replay_window;
865 sa->stats.replay = sa_info->stats.replay;
866 sa->stats.integrity_failed = sa_info->stats.integrity_failed;
867 sa->ce_mask |= XFRM_SA_ATTR_STATS;
868
869 sa->seq = sa_info->seq;
870 sa->reqid = sa_info->reqid;
871 sa->family = sa_info->family;
872 sa->mode = sa_info->mode;
873 sa->replay_window = sa_info->replay_window;
874 sa->flags = sa_info->flags;
875 sa->ce_mask |= (XFRM_SA_ATTR_SEQ | XFRM_SA_ATTR_REQID |
876 XFRM_SA_ATTR_FAMILY | XFRM_SA_ATTR_MODE |
877 XFRM_SA_ATTR_REPLAY_WIN | XFRM_SA_ATTR_FLAGS);
878
879 if (tb[XFRMA_ALG_AEAD]) {
880 struct xfrm_algo_aead* aead = nla_data(tb[XFRMA_ALG_AEAD]);
881
882 len = sizeof (struct xfrmnl_algo_aead) + ((aead->alg_key_len + 7) / 8);
883 if ((sa->aead = calloc (1, len)) == NULL)
884 return -NLE_NOMEM;
885 memcpy ((void *)sa->aead, (void *)aead, len);
886 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
887 }
888
889 if (tb[XFRMA_ALG_AUTH_TRUNC]) {
890 struct xfrm_algo_auth* auth = nla_data(tb[XFRMA_ALG_AUTH_TRUNC]);
891
892 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
893 if ((sa->auth = calloc (1, len)) == NULL)
894 return -NLE_NOMEM;
895 memcpy ((void *)sa->auth, (void *)auth, len);
896 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
897 }
898
899 if (tb[XFRMA_ALG_AUTH] && !sa->auth) {
900 struct xfrm_algo* auth = nla_data(tb[XFRMA_ALG_AUTH]);
901
902 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
903 if ((sa->auth = calloc (1, len)) == NULL)
904 return -NLE_NOMEM;
905 strcpy(sa->auth->alg_name, auth->alg_name);
906 memcpy(sa->auth->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
907 sa->auth->alg_key_len = auth->alg_key_len;
908 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
909 }
910
911 if (tb[XFRMA_ALG_CRYPT]) {
912 struct xfrm_algo* crypt = nla_data(tb[XFRMA_ALG_CRYPT]);
913
914 len = sizeof (struct xfrmnl_algo) + ((crypt->alg_key_len + 7) / 8);
915 if ((sa->crypt = calloc (1, len)) == NULL)
916 return -NLE_NOMEM;
917 memcpy ((void *)sa->crypt, (void *)crypt, len);
918 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
919 }
920
921 if (tb[XFRMA_ALG_COMP]) {
922 struct xfrm_algo* comp = nla_data(tb[XFRMA_ALG_COMP]);
923
924 len = sizeof (struct xfrmnl_algo) + ((comp->alg_key_len + 7) / 8);
925 if ((sa->comp = calloc (1, len)) == NULL)
926 return -NLE_NOMEM;
927 memcpy ((void *)sa->comp, (void *)comp, len);
928 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
929 }
930
931 if (tb[XFRMA_ENCAP]) {
932 struct xfrm_encap_tmpl* encap = nla_data(tb[XFRMA_ENCAP]);
933
934 len = sizeof (struct xfrmnl_encap_tmpl);
935 if ((sa->encap = calloc (1, len)) == NULL)
936 return -NLE_NOMEM;
937 sa->encap->encap_type = encap->encap_type;
938 sa->encap->encap_sport = ntohs(encap->encap_sport);
939 sa->encap->encap_dport = ntohs(encap->encap_dport);
940 if (!(sa->encap->encap_oa = _nl_addr_build(sa_info->family,
941 &encap->encap_oa)))
942 return -NLE_NOMEM;
943 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
944 }
945
946 if (tb[XFRMA_TFCPAD]) {
947 sa->tfcpad = *(uint32_t*)nla_data(tb[XFRMA_TFCPAD]);
948 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
949 }
950
951 if (tb[XFRMA_COADDR]) {
952 if (!(sa->coaddr = _nl_addr_build(
953 sa_info->family, nla_data(tb[XFRMA_COADDR]))))
954 return -NLE_NOMEM;
955 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
956 }
957
958 if (tb[XFRMA_MARK]) {
959 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
960
961 sa->mark.m = m->m;
962 sa->mark.v = m->v;
963 sa->ce_mask |= XFRM_SA_ATTR_MARK;
964 }
965
966 if (tb[XFRMA_SEC_CTX]) {
967 struct xfrm_user_sec_ctx* sec_ctx = nla_data(tb[XFRMA_SEC_CTX]);
968
969 len = sizeof (struct xfrmnl_user_sec_ctx) + sec_ctx->ctx_len;
970 if ((sa->sec_ctx = calloc (1, len)) == NULL)
971 return -NLE_NOMEM;
972 memcpy (sa->sec_ctx, sec_ctx, len);
973 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
974 }
975
976 if (tb[XFRMA_ETIMER_THRESH]) {
977 sa->replay_maxage = *(uint32_t*)nla_data(tb[XFRMA_ETIMER_THRESH]);
978 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
979 }
980
981 if (tb[XFRMA_REPLAY_THRESH]) {
982 sa->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRMA_REPLAY_THRESH]);
983 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
984 }
985
986 if (tb[XFRMA_REPLAY_ESN_VAL]) {
987 struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
988
989 len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
990 if ((sa->replay_state_esn = calloc (1, len)) == NULL)
991 return -NLE_NOMEM;
992 memcpy ((void *)sa->replay_state_esn, (void *)esn, len);
993 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
994 }
995 else if (tb[XFRMA_REPLAY_VAL])
996 {
997 struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
998 sa->replay_state.oseq = replay_state->oseq;
999 sa->replay_state.seq = replay_state->seq;
1000 sa->replay_state.bitmap = replay_state->bitmap;
1001 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
1002 sa->replay_state_esn = NULL;
1003 }
1004
1005 if (tb[XFRMA_OFFLOAD_DEV]) {
1006 struct xfrm_user_offload *offload;
1007
1008 len = sizeof(struct xfrmnl_user_offload);
1009 if ((sa->user_offload = calloc(1, len)) == NULL)
1010 return -NLE_NOMEM;
1011 offload = nla_data(tb[XFRMA_OFFLOAD_DEV]);
1012 sa->user_offload->ifindex = offload->ifindex;
1013 sa->user_offload->flags = offload->flags;
1014 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
1015 }
1016
1017 if (tb[XFRMA_IF_ID]) {
1018 sa->if_id = nla_get_u32(tb[XFRMA_IF_ID]);
1019 sa->ce_mask |= XFRM_SA_ATTR_IF_ID;
1020 }
1021
1022 *result = _nl_steal_pointer(&sa);
1023 return 0;
1024}
1025
1026static int xfrm_sa_update_cache (struct nl_cache *cache, struct nl_object *obj,
1027 change_func_t change_cb, change_func_v2_t change_cb_v2,
1028 void *data)
1029{
1030 _nl_auto_nl_object struct nl_object* old_sa = NULL;
1031 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)obj;
1032
1033 if (nl_object_get_msgtype (obj) == XFRM_MSG_EXPIRE)
1034 {
1035 /* On hard expiry, the SA gets deleted too from the kernel state without any
1036 * further delete event. On Expire message, we are only updating the cache with
1037 * the SA object's new state. In absence of the explicit delete event, the cache will
1038 * be out of sync with the kernel state. To get around this, expiry messages cache
1039 * operations are handled here (installed with NL_ACT_UNSPEC action) instead of
1040 * in Libnl Cache module. */
1041
1042 /* Do we already have this object in the cache? */
1043 old_sa = nl_cache_search(cache, obj);
1044 if (old_sa)
1045 {
1046 /* Found corresponding SA object in cache. Delete it */
1047 nl_cache_remove (old_sa);
1048 }
1049
1050 /* Handle the expiry event now */
1051 if (sa->hard == 0)
1052 {
1053 /* Soft expiry event: Save the new object to the
1054 * cache and notify application of the expiry event. */
1055 nl_cache_move (cache, obj);
1056
1057 if (old_sa == NULL)
1058 {
1059 /* Application CB present, no previous instance of SA object present.
1060 * Notify application CB as a NEW event */
1061 if (change_cb_v2)
1062 change_cb_v2(cache, NULL, obj, 0, NL_ACT_NEW, data);
1063 else if (change_cb)
1064 change_cb(cache, obj, NL_ACT_NEW, data);
1065 }
1066 else
1067 {
1068 uint64_t diff = 0;
1069 if (change_cb || change_cb_v2)
1070 diff = nl_object_diff64(old_sa, obj);
1071
1072 /* Application CB present, a previous instance of SA object present.
1073 * Notify application CB as a CHANGE1 event */
1074 if (diff) {
1075 if (change_cb_v2) {
1076 change_cb_v2(cache, old_sa, obj, diff, NL_ACT_CHANGE, data);
1077 } else if (change_cb)
1078 change_cb(cache, obj, NL_ACT_CHANGE, data);
1079 }
1080 }
1081 }
1082 else
1083 {
1084 /* Hard expiry event: Delete the object from the
1085 * cache and notify application of the expiry event. */
1086 if (change_cb_v2)
1087 change_cb_v2(cache, obj, NULL, 0, NL_ACT_DEL, data);
1088 else if (change_cb)
1089 change_cb (cache, obj, NL_ACT_DEL, data);
1090 }
1091
1092 /* Done handling expire message */
1093 return 0;
1094 }
1095 else
1096 {
1097 /* All other messages other than Expire, let the standard Libnl cache
1098 * module handle it. */
1099 if (change_cb_v2)
1100 return nl_cache_include_v2(cache, obj, change_cb_v2, data);
1101 else
1102 return nl_cache_include (cache, obj, change_cb, data);
1103 }
1104}
1105
1106static int xfrm_sa_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
1107 struct nlmsghdr *n, struct nl_parser_param *pp)
1108{
1109 struct xfrmnl_sa* sa;
1110 int err;
1111
1112 if ((err = xfrmnl_sa_parse(n, &sa)) < 0)
1113 return err;
1114
1115 err = pp->pp_cb((struct nl_object *) sa, pp);
1116
1117 xfrmnl_sa_put(sa);
1118 return err;
1119}
1120
1121/**
1122 * @name XFRM SA Get
1123 * @{
1124 */
1125
1126int xfrmnl_sa_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
1127{
1128 struct nl_msg *msg;
1129 struct xfrm_usersa_id sa_id;
1130 struct xfrm_mark mark;
1131
1132 if (!daddr || !spi)
1133 {
1134 fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
1135 __FILE__, __LINE__, __func__);
1136 assert(0);
1137 return -NLE_MISSING_ATTR;
1138 }
1139
1140 memset(&sa_id, 0, sizeof(sa_id));
1141 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
1142 sa_id.family = nl_addr_get_family (daddr);
1143 sa_id.spi = htonl(spi);
1144 sa_id.proto = protocol;
1145
1146 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETSA, 0)))
1147 return -NLE_NOMEM;
1148
1149 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1150 goto nla_put_failure;
1151
1152 if ((mark_m & mark_v) != 0)
1153 {
1154 memset(&mark, 0, sizeof(struct xfrm_mark));
1155 mark.m = mark_m;
1156 mark.v = mark_v;
1157
1158 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
1159 }
1160
1161 *result = msg;
1162 return 0;
1163
1164nla_put_failure:
1165 nlmsg_free(msg);
1166 return -NLE_MSGSIZE;
1167}
1168
1169int xfrmnl_sa_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sa** result)
1170{
1171 struct nl_msg *msg = NULL;
1172 struct nl_object *obj;
1173 int err;
1174
1175 if ((err = xfrmnl_sa_build_get_request(daddr, spi, protocol, mark_m, mark_v, &msg)) < 0)
1176 return err;
1177
1178 err = nl_send_auto(sock, msg);
1179 nlmsg_free(msg);
1180 if (err < 0)
1181 return err;
1182
1183 if ((err = nl_pickup(sock, &xfrm_sa_msg_parser, &obj)) < 0)
1184 return err;
1185
1186 /* We have used xfrm_sa_msg_parser(), object is definitely a xfrm sa */
1187 *result = (struct xfrmnl_sa *) obj;
1188
1189 /* If an object has been returned, we also need to wait for the ACK */
1190 if (err == 0 && obj)
1191 nl_wait_for_ack(sock);
1192
1193 return 0;
1194}
1195
1196/** @} */
1197
1198static int build_xfrm_sa_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1199{
1200 struct nl_msg* msg;
1201 struct xfrm_usersa_info sa_info;
1202 uint32_t len;
1203 struct nl_addr* addr;
1204
1205 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1206 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1207 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1208 return -NLE_MISSING_ATTR;
1209
1210 memset ((void*)&sa_info, 0, sizeof (sa_info));
1211 if (tmpl->ce_mask & XFRM_SA_ATTR_SEL)
1212 {
1213 addr = xfrmnl_sel_get_daddr (tmpl->sel);
1214 memcpy ((void*)&sa_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1215 addr = xfrmnl_sel_get_saddr (tmpl->sel);
1216 memcpy ((void*)&sa_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1217 sa_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1218 sa_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1219 sa_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1220 sa_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1221 sa_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1222 sa_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1223 sa_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1224 sa_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1225 sa_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1226 sa_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1227 }
1228
1229 memcpy (&sa_info.id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1230 sa_info.id.spi = htonl(tmpl->id.spi);
1231 sa_info.id.proto = tmpl->id.proto;
1232
1233 if (tmpl->ce_mask & XFRM_SA_ATTR_SADDR)
1234 memcpy (&sa_info.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
1235
1236 if (tmpl->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1237 {
1238 sa_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
1239 sa_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
1240 sa_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
1241 sa_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
1242 sa_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
1243 sa_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
1244 sa_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
1245 sa_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
1246 }
1247
1248 //Skip current lifetime: cur lifetime can be updated only via AE
1249 //Skip stats: stats cant be updated
1250 //Skip seq: seq cant be updated
1251
1252 if (tmpl->ce_mask & XFRM_SA_ATTR_REQID)
1253 sa_info.reqid = tmpl->reqid;
1254
1255 if (tmpl->ce_mask & XFRM_SA_ATTR_FAMILY)
1256 sa_info.family = tmpl->family;
1257
1258 if (tmpl->ce_mask & XFRM_SA_ATTR_MODE)
1259 sa_info.mode = tmpl->mode;
1260
1261 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1262 sa_info.replay_window = tmpl->replay_window;
1263
1264 if (tmpl->ce_mask & XFRM_SA_ATTR_FLAGS)
1265 sa_info.flags = tmpl->flags;
1266
1267 msg = nlmsg_alloc_simple(cmd, flags);
1268 if (!msg)
1269 return -NLE_NOMEM;
1270
1271 if (nlmsg_append(msg, &sa_info, sizeof(sa_info), NLMSG_ALIGNTO) < 0)
1272 goto nla_put_failure;
1273
1274 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AEAD) {
1275 len = sizeof (struct xfrm_algo_aead) + ((tmpl->aead->alg_key_len + 7) / 8);
1276 NLA_PUT (msg, XFRMA_ALG_AEAD, len, tmpl->aead);
1277 }
1278
1279 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AUTH) {
1280 /* kernel prefers XFRMA_ALG_AUTH_TRUNC over XFRMA_ALG_AUTH, so only
1281 * one of the attributes needs to be present */
1282 if (tmpl->auth->alg_trunc_len) {
1283 len = sizeof (struct xfrm_algo_auth) + ((tmpl->auth->alg_key_len + 7) / 8);
1284 NLA_PUT (msg, XFRMA_ALG_AUTH_TRUNC, len, tmpl->auth);
1285 } else {
1286 struct xfrm_algo *auth;
1287
1288 len = sizeof (struct xfrm_algo) + ((tmpl->auth->alg_key_len + 7) / 8);
1289 auth = malloc(len);
1290 if (!auth) {
1291 nlmsg_free(msg);
1292 return -NLE_NOMEM;
1293 }
1294
1295 _nl_strncpy_assert(auth->alg_name, tmpl->auth->alg_name, sizeof(auth->alg_name));
1296 auth->alg_key_len = tmpl->auth->alg_key_len;
1297 memcpy(auth->alg_key, tmpl->auth->alg_key, (tmpl->auth->alg_key_len + 7) / 8);
1298 if (nla_put(msg, XFRMA_ALG_AUTH, len, auth) < 0) {
1299 free(auth);
1300 goto nla_put_failure;
1301 }
1302 free(auth);
1303 }
1304 }
1305
1306 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_CRYPT) {
1307 len = sizeof (struct xfrm_algo) + ((tmpl->crypt->alg_key_len + 7) / 8);
1308 NLA_PUT (msg, XFRMA_ALG_CRYPT, len, tmpl->crypt);
1309 }
1310
1311 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_COMP) {
1312 len = sizeof (struct xfrm_algo) + ((tmpl->comp->alg_key_len + 7) / 8);
1313 NLA_PUT (msg, XFRMA_ALG_COMP, len, tmpl->comp);
1314 }
1315
1316 if (tmpl->ce_mask & XFRM_SA_ATTR_ENCAP) {
1317 struct xfrm_encap_tmpl* encap_tmpl;
1318 struct nlattr* encap_attr;
1319
1320 len = sizeof (struct xfrm_encap_tmpl);
1321 encap_attr = nla_reserve(msg, XFRMA_ENCAP, len);
1322 if (!encap_attr)
1323 goto nla_put_failure;
1324 encap_tmpl = nla_data (encap_attr);
1325 encap_tmpl->encap_type = tmpl->encap->encap_type;
1326 encap_tmpl->encap_sport = htons (tmpl->encap->encap_sport);
1327 encap_tmpl->encap_dport = htons (tmpl->encap->encap_dport);
1328 memcpy (&encap_tmpl->encap_oa, nl_addr_get_binary_addr (tmpl->encap->encap_oa), sizeof (uint8_t) * nl_addr_get_len (tmpl->encap->encap_oa));
1329 }
1330
1331 if (tmpl->ce_mask & XFRM_SA_ATTR_TFCPAD) {
1332 NLA_PUT_U32 (msg, XFRMA_TFCPAD, tmpl->tfcpad);
1333 }
1334
1335 if (tmpl->ce_mask & XFRM_SA_ATTR_COADDR) {
1336 NLA_PUT (msg, XFRMA_COADDR, sizeof (xfrm_address_t), tmpl->coaddr);
1337 }
1338
1339 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1340 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1341 }
1342
1343 if (tmpl->ce_mask & XFRM_SA_ATTR_SECCTX) {
1344 len = sizeof (struct xfrm_sec_ctx) + tmpl->sec_ctx->ctx_len;
1345 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1346 }
1347
1348 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE) {
1349 NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
1350 }
1351
1352 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF) {
1353 NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
1354 }
1355
1356 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_STATE) {
1357 if (tmpl->replay_state_esn) {
1358 len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
1359 NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
1360 }
1361 else {
1362 NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrm_replay_state), &tmpl->replay_state);
1363 }
1364 }
1365
1366 if (tmpl->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV) {
1367 struct xfrm_user_offload *offload;
1368 struct nlattr *attr;
1369
1370 len = sizeof(struct xfrm_user_offload);
1371 attr = nla_reserve(msg, XFRMA_OFFLOAD_DEV, len);
1372
1373 if (!attr)
1374 goto nla_put_failure;
1375
1376 offload = nla_data(attr);
1377 offload->ifindex = tmpl->user_offload->ifindex;
1378 offload->flags = tmpl->user_offload->flags;
1379 }
1380
1381 if (tmpl->ce_mask & XFRM_SA_ATTR_IF_ID) {
1382 NLA_PUT_U32 (msg, XFRMA_IF_ID, tmpl->if_id);
1383 }
1384
1385 *result = msg;
1386 return 0;
1387
1388nla_put_failure:
1389 nlmsg_free(msg);
1390 return -NLE_MSGSIZE;
1391}
1392
1393/**
1394 * @name XFRM SA Add
1395 * @{
1396 */
1397
1398int xfrmnl_sa_build_add_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1399{
1400 return build_xfrm_sa_message (tmpl, XFRM_MSG_NEWSA, flags, result);
1401}
1402
1403int xfrmnl_sa_add(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1404{
1405 int err;
1406 struct nl_msg *msg;
1407
1408 if ((err = xfrmnl_sa_build_add_request(tmpl, flags, &msg)) < 0)
1409 return err;
1410
1411 err = nl_send_auto_complete(sk, msg);
1412 nlmsg_free(msg);
1413 if (err < 0)
1414 return err;
1415
1416 return nl_wait_for_ack(sk);
1417}
1418
1419/**
1420 * @name XFRM SA Update
1421 * @{
1422 */
1423
1424int xfrmnl_sa_build_update_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1425{
1426 return build_xfrm_sa_message (tmpl, XFRM_MSG_UPDSA, flags, result);
1427}
1428
1429int xfrmnl_sa_update(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1430{
1431 int err;
1432 struct nl_msg *msg;
1433
1434 if ((err = xfrmnl_sa_build_update_request(tmpl, flags, &msg)) < 0)
1435 return err;
1436
1437 err = nl_send_auto_complete(sk, msg);
1438 nlmsg_free(msg);
1439 if (err < 0)
1440 return err;
1441
1442 return nl_wait_for_ack(sk);
1443}
1444
1445/** @} */
1446
1447static int build_xfrm_sa_delete_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1448{
1449 struct nl_msg* msg;
1450 struct xfrm_usersa_id sa_id;
1451
1452 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1453 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1454 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1455 return -NLE_MISSING_ATTR;
1456
1457 memset(&sa_id, 0, sizeof(struct xfrm_usersa_id));
1458 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr),
1459 sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1460 sa_id.family = nl_addr_get_family (tmpl->id.daddr);
1461 sa_id.spi = htonl(tmpl->id.spi);
1462 sa_id.proto = tmpl->id.proto;
1463
1464 msg = nlmsg_alloc_simple(cmd, flags);
1465 if (!msg)
1466 return -NLE_NOMEM;
1467
1468 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1469 goto nla_put_failure;
1470
1471 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1472 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1473 }
1474
1475 *result = msg;
1476 return 0;
1477
1478nla_put_failure:
1479 nlmsg_free(msg);
1480 return -NLE_MSGSIZE;
1481}
1482
1483/**
1484 * @name XFRM SA Delete
1485 * @{
1486 */
1487
1488int xfrmnl_sa_build_delete_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1489{
1490 return build_xfrm_sa_delete_message (tmpl, XFRM_MSG_DELSA, flags, result);
1491}
1492
1493int xfrmnl_sa_delete(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1494{
1495 int err;
1496 struct nl_msg *msg;
1497
1498 if ((err = xfrmnl_sa_build_delete_request(tmpl, flags, &msg)) < 0)
1499 return err;
1500
1501 err = nl_send_auto_complete(sk, msg);
1502 nlmsg_free(msg);
1503 if (err < 0)
1504 return err;
1505
1506 return nl_wait_for_ack(sk);
1507}
1508
1509/** @} */
1510
1511
1512/**
1513 * @name Attributes
1514 * @{
1515 */
1516
1517struct xfrmnl_sel* xfrmnl_sa_get_sel (struct xfrmnl_sa* sa)
1518{
1519 if (sa->ce_mask & XFRM_SA_ATTR_SEL)
1520 return sa->sel;
1521 else
1522 return NULL;
1523}
1524
1525int xfrmnl_sa_set_sel (struct xfrmnl_sa* sa, struct xfrmnl_sel* sel)
1526{
1527 /* Release any previously held selector object from the SA */
1528 if (sa->sel)
1529 xfrmnl_sel_put (sa->sel);
1530
1531 /* Increment ref count on new selector and save it in the SA */
1532 xfrmnl_sel_get (sel);
1533 sa->sel = sel;
1534 sa->ce_mask |= XFRM_SA_ATTR_SEL;
1535
1536 return 0;
1537}
1538
1539static inline int __assign_addr(struct xfrmnl_sa* sa, struct nl_addr **pos,
1540 struct nl_addr *new, int flag, int nocheck)
1541{
1542 if (!nocheck)
1543 {
1544 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1545 {
1546 if (nl_addr_get_family (new) != sa->family)
1547 return -NLE_AF_MISMATCH;
1548 }
1549 }
1550
1551 if (*pos)
1552 nl_addr_put(*pos);
1553
1554 nl_addr_get(new);
1555 *pos = new;
1556
1557 sa->ce_mask |= flag;
1558
1559 return 0;
1560}
1561
1562
1563struct nl_addr* xfrmnl_sa_get_daddr (struct xfrmnl_sa* sa)
1564{
1565 if (sa->ce_mask & XFRM_SA_ATTR_DADDR)
1566 return sa->id.daddr;
1567 else
1568 return NULL;
1569}
1570
1571int xfrmnl_sa_set_daddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1572{
1573 return __assign_addr(sa, &sa->id.daddr, addr, XFRM_SA_ATTR_DADDR, 0);
1574}
1575
1576int xfrmnl_sa_get_spi (struct xfrmnl_sa* sa)
1577{
1578 if (sa->ce_mask & XFRM_SA_ATTR_SPI)
1579 return sa->id.spi;
1580 else
1581 return -1;
1582}
1583
1584int xfrmnl_sa_set_spi (struct xfrmnl_sa* sa, unsigned int spi)
1585{
1586 sa->id.spi = spi;
1587 sa->ce_mask |= XFRM_SA_ATTR_SPI;
1588
1589 return 0;
1590}
1591
1592int xfrmnl_sa_get_proto (struct xfrmnl_sa* sa)
1593{
1594 if (sa->ce_mask & XFRM_SA_ATTR_PROTO)
1595 return sa->id.proto;
1596 else
1597 return -1;
1598}
1599
1600int xfrmnl_sa_set_proto (struct xfrmnl_sa* sa, unsigned int protocol)
1601{
1602 sa->id.proto = protocol;
1603 sa->ce_mask |= XFRM_SA_ATTR_PROTO;
1604
1605 return 0;
1606}
1607
1608struct nl_addr* xfrmnl_sa_get_saddr (struct xfrmnl_sa* sa)
1609{
1610 if (sa->ce_mask & XFRM_SA_ATTR_SADDR)
1611 return sa->saddr;
1612 else
1613 return NULL;
1614}
1615
1616int xfrmnl_sa_set_saddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1617{
1618 return __assign_addr(sa, &sa->saddr, addr, XFRM_SA_ATTR_SADDR, 1);
1619}
1620
1621struct xfrmnl_ltime_cfg* xfrmnl_sa_get_lifetime_cfg (struct xfrmnl_sa* sa)
1622{
1623 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1624 return sa->lft;
1625 else
1626 return NULL;
1627}
1628
1629int xfrmnl_sa_set_lifetime_cfg (struct xfrmnl_sa* sa, struct xfrmnl_ltime_cfg* ltime)
1630{
1631 /* Release any previously held lifetime cfg object from the SA */
1632 if (sa->lft)
1633 xfrmnl_ltime_cfg_put (sa->lft);
1634
1635 /* Increment ref count on new lifetime object and save it in the SA */
1636 xfrmnl_ltime_cfg_get (ltime);
1637 sa->lft = ltime;
1638 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
1639
1640 return 0;
1641}
1642
1643int xfrmnl_sa_get_curlifetime (struct xfrmnl_sa* sa, unsigned long long int* curr_bytes,
1644 unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1645{
1646 if (sa == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1647 return -1;
1648
1649 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CUR)
1650 {
1651 *curr_bytes = sa->curlft.bytes;
1652 *curr_packets = sa->curlft.packets;
1653 *curr_add_time = sa->curlft.add_time;
1654 *curr_use_time = sa->curlft.use_time;
1655 }
1656 else
1657 return -1;
1658
1659 return 0;
1660}
1661
1662int xfrmnl_sa_get_stats (struct xfrmnl_sa* sa, unsigned long long int* replay_window,
1663 unsigned long long int* replay, unsigned long long int* integrity_failed)
1664{
1665 if (sa == NULL || replay_window == NULL || replay == NULL || integrity_failed == NULL)
1666 return -1;
1667
1668 if (sa->ce_mask & XFRM_SA_ATTR_STATS)
1669 {
1670 *replay_window = sa->stats.replay_window;
1671 *replay = sa->stats.replay;
1672 *integrity_failed = sa->stats.integrity_failed;
1673 }
1674 else
1675 return -1;
1676
1677 return 0;
1678}
1679
1680int xfrmnl_sa_get_seq (struct xfrmnl_sa* sa)
1681{
1682 if (sa->ce_mask & XFRM_SA_ATTR_SEQ)
1683 return sa->seq;
1684 else
1685 return -1;
1686}
1687
1688int xfrmnl_sa_get_reqid (struct xfrmnl_sa* sa)
1689{
1690 if (sa->ce_mask & XFRM_SA_ATTR_REQID)
1691 return sa->reqid;
1692 else
1693 return -1;
1694}
1695
1696int xfrmnl_sa_set_reqid (struct xfrmnl_sa* sa, unsigned int reqid)
1697{
1698 sa->reqid = reqid;
1699 sa->ce_mask |= XFRM_SA_ATTR_REQID;
1700
1701 return 0;
1702}
1703
1704int xfrmnl_sa_get_family (struct xfrmnl_sa* sa)
1705{
1706 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1707 return sa->family;
1708 else
1709 return -1;
1710}
1711
1712int xfrmnl_sa_set_family (struct xfrmnl_sa* sa, unsigned int family)
1713{
1714 sa->family = family;
1715 sa->ce_mask |= XFRM_SA_ATTR_FAMILY;
1716
1717 return 0;
1718}
1719
1720int xfrmnl_sa_get_if_id (struct xfrmnl_sa* sa, uint32_t* if_id)
1721{
1722 if (if_id == NULL)
1723 return -NLE_INVAL;
1724
1725 if (!(sa->ce_mask & XFRM_SA_ATTR_IF_ID))
1726 return -NLE_NOATTR;
1727
1728 *if_id = sa->if_id;
1729
1730 return 0;
1731}
1732
1733int xfrmnl_sa_set_if_id (struct xfrmnl_sa* sa, uint32_t if_id)
1734{
1735 sa->if_id = if_id;
1736 sa->ce_mask |= XFRM_SA_ATTR_IF_ID;
1737
1738 return 0;
1739}
1740
1741int xfrmnl_sa_get_mode (struct xfrmnl_sa* sa)
1742{
1743 if (sa->ce_mask & XFRM_SA_ATTR_MODE)
1744 return sa->mode;
1745 else
1746 return -1;
1747}
1748
1749int xfrmnl_sa_set_mode (struct xfrmnl_sa* sa, unsigned int mode)
1750{
1751 sa->mode = mode;
1752 sa->ce_mask |= XFRM_SA_ATTR_MODE;
1753
1754 return 0;
1755}
1756
1757int xfrmnl_sa_get_replay_window (struct xfrmnl_sa* sa)
1758{
1759 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1760 return sa->replay_window;
1761 else
1762 return -1;
1763}
1764
1765int xfrmnl_sa_set_replay_window (struct xfrmnl_sa* sa, unsigned int replay_window)
1766{
1767 sa->replay_window = replay_window;
1768 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_WIN;
1769
1770 return 0;
1771}
1772
1773int xfrmnl_sa_get_flags (struct xfrmnl_sa* sa)
1774{
1775 if (sa->ce_mask & XFRM_SA_ATTR_FLAGS)
1776 return sa->flags;
1777 else
1778 return -1;
1779}
1780
1781int xfrmnl_sa_set_flags (struct xfrmnl_sa* sa, unsigned int flags)
1782{
1783 sa->flags = flags;
1784 sa->ce_mask |= XFRM_SA_ATTR_FLAGS;
1785
1786 return 0;
1787}
1788
1789/**
1790 * Get the aead-params
1791 * @arg sa the xfrmnl_sa object
1792 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1793 * @arg key_len an optional output value for the key length in bits.
1794 * @arg icv_len an optional output value for the alt-icv-len.
1795 * @arg key an optional buffer large enough for the key. It must contain at least
1796 * ((@key_len + 7) / 8) bytes.
1797 *
1798 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1799 * call xfrmnl_sa_get_aead_params() without @key argument to query only the required buffer size.
1800 * This modified API is available in all versions of libnl3 that support the capability
1801 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1802 *
1803 * @return 0 on success or a negative error code.
1804 */
1805int xfrmnl_sa_get_aead_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* icv_len, char* key)
1806{
1807 if (sa->ce_mask & XFRM_SA_ATTR_ALG_AEAD)
1808 {
1809 if (alg_name)
1810 strcpy (alg_name, sa->aead->alg_name);
1811 if (key_len)
1812 *key_len = sa->aead->alg_key_len;
1813 if (icv_len)
1814 *icv_len = sa->aead->alg_icv_len;
1815 if (key)
1816 memcpy (key, sa->aead->alg_key, ((sa->aead->alg_key_len + 7)/8));
1817 }
1818 else
1819 return -1;
1820
1821 return 0;
1822}
1823
1824int xfrmnl_sa_set_aead_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int icv_len, const char* key)
1825{
1826 _nl_auto_free struct xfrmnl_algo_aead *b = NULL;
1827 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1828 uint32_t newlen = sizeof (struct xfrmnl_algo_aead) + keysize;
1829
1830 /* Free up the old key and allocate memory to hold new key */
1831 if (strlen (alg_name) >= sizeof (sa->aead->alg_name))
1832 return -1;
1833 if (!(b = calloc (1, newlen)))
1834 return -1;
1835
1836 strcpy (b->alg_name, alg_name);
1837 b->alg_key_len = key_len;
1838 b->alg_icv_len = icv_len;
1839 memcpy (b->alg_key, key, keysize);
1840
1841 free (sa->aead);
1842 sa->aead = _nl_steal_pointer (&b);
1843 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
1844 return 0;
1845}
1846
1847/**
1848 * Get the auth-params
1849 * @arg sa the xfrmnl_sa object
1850 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1851 * @arg key_len an optional output value for the key length in bits.
1852 * @arg trunc_len an optional output value for the alg-trunc-len.
1853 * @arg key an optional buffer large enough for the key. It must contain at least
1854 * ((@key_len + 7) / 8) bytes.
1855 *
1856 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1857 * call xfrmnl_sa_get_auth_params() without @key argument to query only the required buffer size.
1858 * This modified API is available in all versions of libnl3 that support the capability
1859 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1860 *
1861 * @return 0 on success or a negative error code.
1862 */
1863int xfrmnl_sa_get_auth_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* trunc_len, char* key)
1864{
1865 if (!(sa->ce_mask & XFRM_SA_ATTR_ALG_AUTH))
1866 return -NLE_MISSING_ATTR;
1867
1868 if (alg_name)
1869 strcpy(alg_name, sa->auth->alg_name);
1870 if (key_len)
1871 *key_len = sa->auth->alg_key_len;
1872 if (trunc_len)
1873 *trunc_len = sa->auth->alg_trunc_len;
1874 if (key)
1875 memcpy(key, sa->auth->alg_key, (sa->auth->alg_key_len + 7) / 8);
1876 return 0;
1877}
1878
1879int xfrmnl_sa_set_auth_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int trunc_len, const char* key)
1880{
1881 _nl_auto_free struct xfrmnl_algo_auth *b = NULL;
1882 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1883 uint32_t newlen = sizeof (struct xfrmnl_algo_auth) + keysize;
1884
1885 if (strlen (alg_name) >= sizeof (sa->auth->alg_name))
1886 return -1;
1887 if (!(b = calloc (1, newlen)))
1888 return -1;
1889
1890 strcpy (b->alg_name, alg_name);
1891 b->alg_key_len = key_len;
1892 b->alg_trunc_len = trunc_len;
1893 memcpy (b->alg_key, key, keysize);
1894
1895 free (sa->auth);
1896 sa->auth = _nl_steal_pointer (&b);
1897 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
1898 return 0;
1899}
1900
1901/**
1902 * Get the crypto-params
1903 * @arg sa the xfrmnl_sa object
1904 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1905 * @arg key_len an optional output value for the key length in bits.
1906 * @arg key an optional buffer large enough for the key. It must contain at least
1907 * ((@key_len + 7) / 8) bytes.
1908 *
1909 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1910 * call xfrmnl_sa_get_crypto_params() without @key argument to query only the required buffer size.
1911 * This modified API is available in all versions of libnl3 that support the capability
1912 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1913 *
1914 * @return 0 on success or a negative error code.
1915 */
1916int xfrmnl_sa_get_crypto_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1917{
1918 if (sa->ce_mask & XFRM_SA_ATTR_ALG_CRYPT)
1919 {
1920 if (alg_name)
1921 strcpy (alg_name, sa->crypt->alg_name);
1922 if (key_len)
1923 *key_len = sa->crypt->alg_key_len;
1924 if (key)
1925 memcpy (key, sa->crypt->alg_key, ((sa->crypt->alg_key_len + 7)/8));
1926 }
1927 else
1928 return -1;
1929
1930 return 0;
1931}
1932
1933int xfrmnl_sa_set_crypto_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1934{
1935 _nl_auto_free struct xfrmnl_algo *b = NULL;
1936 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1937 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1938
1939 if (strlen (alg_name) >= sizeof (sa->crypt->alg_name))
1940 return -1;
1941 if (!(b = calloc (1, newlen)))
1942 return -1;
1943
1944 strcpy (b->alg_name, alg_name);
1945 b->alg_key_len = key_len;
1946 memcpy (b->alg_key, key, keysize);
1947
1948 free(sa->crypt);
1949 sa->crypt = _nl_steal_pointer(&b);
1950 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
1951 return 0;
1952}
1953
1954/**
1955 * Get the comp-params
1956 * @arg sa the xfrmnl_sa object
1957 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1958 * @arg key_len an optional output value for the key length in bits.
1959 * @arg key an optional buffer large enough for the key. It must contain at least
1960 * ((@key_len + 7) / 8) bytes.
1961 *
1962 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1963 * call xfrmnl_sa_get_comp_params() without @key argument to query only the required buffer size.
1964 * This modified API is available in all versions of libnl3 that support the capability
1965 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1966 *
1967 * @return 0 on success or a negative error code.
1968 */
1969int xfrmnl_sa_get_comp_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1970{
1971 if (sa->ce_mask & XFRM_SA_ATTR_ALG_COMP)
1972 {
1973 if (alg_name)
1974 strcpy (alg_name, sa->comp->alg_name);
1975 if (key_len)
1976 *key_len = sa->comp->alg_key_len;
1977 if (key)
1978 memcpy (key, sa->comp->alg_key, ((sa->comp->alg_key_len + 7)/8));
1979 }
1980 else
1981 return -1;
1982
1983 return 0;
1984}
1985
1986int xfrmnl_sa_set_comp_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1987{
1988 _nl_auto_free struct xfrmnl_algo *b = NULL;
1989 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1990 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1991
1992 if (strlen (alg_name) >= sizeof (sa->comp->alg_name))
1993 return -1;
1994 if (!(b = calloc (1, newlen)))
1995 return -1;
1996
1997 strcpy (b->alg_name, alg_name);
1998 b->alg_key_len = key_len;
1999 memcpy (b->alg_key, key, keysize);
2000
2001 free(sa->comp);
2002 sa->comp = _nl_steal_pointer(&b);
2003 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
2004 return 0;
2005}
2006
2007int xfrmnl_sa_get_encap_tmpl (struct xfrmnl_sa* sa, unsigned int* encap_type, unsigned int* encap_sport, unsigned int* encap_dport, struct nl_addr** encap_oa)
2008{
2009 if (sa->ce_mask & XFRM_SA_ATTR_ENCAP)
2010 {
2011 *encap_type = sa->encap->encap_type;
2012 *encap_sport = sa->encap->encap_sport;
2013 *encap_dport = sa->encap->encap_dport;
2014 *encap_oa = nl_addr_clone (sa->encap->encap_oa);
2015 }
2016 else
2017 return -1;
2018
2019 return 0;
2020}
2021
2022int xfrmnl_sa_set_encap_tmpl (struct xfrmnl_sa* sa, unsigned int encap_type, unsigned int encap_sport, unsigned int encap_dport, struct nl_addr* encap_oa)
2023{
2024 if (sa->encap) {
2025 /* Free up the old encap OA */
2026 if (sa->encap->encap_oa)
2027 nl_addr_put(sa->encap->encap_oa);
2028 memset(sa->encap, 0, sizeof (*sa->encap));
2029 } else if ((sa->encap = calloc(1, sizeof(*sa->encap))) == NULL)
2030 return -1;
2031
2032 /* Save the new info */
2033 sa->encap->encap_type = encap_type;
2034 sa->encap->encap_sport = encap_sport;
2035 sa->encap->encap_dport = encap_dport;
2036 nl_addr_get (encap_oa);
2037 sa->encap->encap_oa = encap_oa;
2038
2039 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
2040
2041 return 0;
2042}
2043
2044int xfrmnl_sa_get_tfcpad (struct xfrmnl_sa* sa)
2045{
2046 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
2047 return sa->tfcpad;
2048 else
2049 return -1;
2050}
2051
2052int xfrmnl_sa_set_tfcpad (struct xfrmnl_sa* sa, unsigned int tfcpad)
2053{
2054 sa->tfcpad = tfcpad;
2055 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
2056
2057 return 0;
2058}
2059
2060struct nl_addr* xfrmnl_sa_get_coaddr (struct xfrmnl_sa* sa)
2061{
2062 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
2063 return sa->coaddr;
2064 else
2065 return NULL;
2066}
2067
2068int xfrmnl_sa_set_coaddr (struct xfrmnl_sa* sa, struct nl_addr* coaddr)
2069{
2070 /* Free up the old coaddr */
2071 if (sa->coaddr)
2072 nl_addr_put (sa->coaddr);
2073
2074 /* Save the new info */
2075 nl_addr_get (coaddr);
2076 sa->coaddr = coaddr;
2077
2078 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
2079
2080 return 0;
2081}
2082
2083int xfrmnl_sa_get_mark (struct xfrmnl_sa* sa, unsigned int* mark_mask, unsigned int* mark_value)
2084{
2085 if (mark_mask == NULL || mark_value == NULL)
2086 return -1;
2087
2088 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
2089 {
2090 *mark_mask = sa->mark.m;
2091 *mark_value = sa->mark.v;
2092
2093 return 0;
2094 }
2095 else
2096 return -1;
2097}
2098
2099int xfrmnl_sa_set_mark (struct xfrmnl_sa* sa, unsigned int value, unsigned int mask)
2100{
2101 sa->mark.v = value;
2102 sa->mark.m = mask;
2103 sa->ce_mask |= XFRM_SA_ATTR_MARK;
2104
2105 return 0;
2106}
2107
2108/**
2109 * Get the security context.
2110 *
2111 * @arg sa The xfrmnl_sa object.
2112 * @arg doi An optional output value for the security context domain of interpretation.
2113 * @arg alg An optional output value for the security context algorithm.
2114 * @arg len An optional output value for the security context length, including the
2115 * terminating null byte ('\0').
2116 * @arg sid Unused parameter.
2117 * @arg ctx_str An optional buffer large enough for the security context string. It must
2118 * contain at least @len bytes.
2119 *
2120 * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
2121 * call xfrmnl_sa_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
2122 * This modified API is available in all versions of libnl3 that support the capability
2123 * @def NL_CAPABILITY_XFRM_SEC_CTX_LEN (@see nl_has_capability for further information).
2124 *
2125 * @return 0 on success or a negative error code.
2126 */
2127int xfrmnl_sa_get_sec_ctx (struct xfrmnl_sa* sa, unsigned int* doi, unsigned int* alg,
2128 unsigned int* len, unsigned int* sid, char* ctx_str)
2129{
2130 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
2131 {
2132 if (doi)
2133 *doi = sa->sec_ctx->ctx_doi;
2134 if (alg)
2135 *alg = sa->sec_ctx->ctx_alg;
2136 if (len)
2137 *len = sa->sec_ctx->ctx_len;
2138 if (ctx_str)
2139 memcpy (ctx_str, sa->sec_ctx->ctx, sa->sec_ctx->ctx_len);
2140 }
2141 else
2142 return -1;
2143
2144 return 0;
2145}
2146
2147/**
2148 * Set the security context.
2149 *
2150 * @arg sa The xfrmnl_sa object.
2151 * @arg doi Parameter for the security context domain of interpretation.
2152 * @arg alg Parameter for the security context algorithm.
2153 * @arg len Parameter for the length of the security context string containing
2154 * the terminating null byte ('\0').
2155 * @arg sid Unused parameter.
2156 * @arg ctx_str Buffer containing the security context string.
2157 *
2158 * @return 0 on success or a negative error code.
2159 */
2160int xfrmnl_sa_set_sec_ctx (struct xfrmnl_sa* sa, unsigned int doi, unsigned int alg, unsigned int len,
2161 unsigned int sid, const char* ctx_str)
2162{
2163 _nl_auto_free struct xfrmnl_user_sec_ctx *b = NULL;
2164
2165 if (!(b = calloc(1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + len)))
2166 return -1;
2167
2168 b->len = sizeof(struct xfrmnl_user_sec_ctx) + len;
2169 b->exttype = XFRMA_SEC_CTX;
2170 b->ctx_alg = alg;
2171 b->ctx_doi = doi;
2172 b->ctx_len = len;
2173 memcpy (b->ctx, ctx_str, len);
2174 b->ctx[len] = '\0';
2175
2176 free(sa->sec_ctx);
2177 sa->sec_ctx = _nl_steal_pointer(&b);
2178 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
2179 return 0;
2180}
2181
2182
2183int xfrmnl_sa_get_replay_maxage (struct xfrmnl_sa* sa)
2184{
2185 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE)
2186 return sa->replay_maxage;
2187 else
2188 return -1;
2189}
2190
2191int xfrmnl_sa_set_replay_maxage (struct xfrmnl_sa* sa, unsigned int replay_maxage)
2192{
2193 sa->replay_maxage = replay_maxage;
2194 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
2195
2196 return 0;
2197}
2198
2199int xfrmnl_sa_get_replay_maxdiff (struct xfrmnl_sa* sa)
2200{
2201 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF)
2202 return sa->replay_maxdiff;
2203 else
2204 return -1;
2205}
2206
2207int xfrmnl_sa_set_replay_maxdiff (struct xfrmnl_sa* sa, unsigned int replay_maxdiff)
2208{
2209 sa->replay_maxdiff = replay_maxdiff;
2210 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
2211
2212 return 0;
2213}
2214
2215int xfrmnl_sa_get_replay_state (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
2216{
2217 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2218 {
2219 if (sa->replay_state_esn == NULL)
2220 {
2221 *oseq = sa->replay_state.oseq;
2222 *seq = sa->replay_state.seq;
2223 *bmp = sa->replay_state.bitmap;
2224
2225 return 0;
2226 }
2227 else
2228 {
2229 return -1;
2230 }
2231 }
2232 else
2233 return -1;
2234}
2235
2236int xfrmnl_sa_set_replay_state (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq, unsigned int bitmap)
2237{
2238 sa->replay_state.oseq = oseq;
2239 sa->replay_state.seq = seq;
2240 sa->replay_state.bitmap = bitmap;
2241 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2242
2243 return 0;
2244}
2245
2246int xfrmnl_sa_get_replay_state_esn (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
2247 unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
2248{
2249 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2250 {
2251 if (sa->replay_state_esn)
2252 {
2253 *oseq = sa->replay_state_esn->oseq;
2254 *seq = sa->replay_state_esn->seq;
2255 *oseq_hi= sa->replay_state_esn->oseq_hi;
2256 *seq_hi = sa->replay_state_esn->seq_hi;
2257 *replay_window = sa->replay_state_esn->replay_window;
2258 *bmp_len = sa->replay_state_esn->bmp_len; // In number of 32 bit words
2259 memcpy (bmp, sa->replay_state_esn->bmp, sa->replay_state_esn->bmp_len * sizeof (uint32_t));
2260
2261 return 0;
2262 }
2263 else
2264 {
2265 return -1;
2266 }
2267 }
2268 else
2269 return -1;
2270}
2271
2272int xfrmnl_sa_set_replay_state_esn (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq,
2273 unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
2274 unsigned int bmp_len, unsigned int* bmp)
2275{
2276 _nl_auto_free struct xfrmnl_replay_state_esn *b = NULL;
2277
2278 if (!(b = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * bmp_len))))
2279 return -1;
2280
2281 b->oseq = oseq;
2282 b->seq = seq;
2283 b->oseq_hi = oseq_hi;
2284 b->seq_hi = seq_hi;
2285 b->replay_window = replay_window;
2286 b->bmp_len = bmp_len; // In number of 32 bit words
2287 memcpy (b->bmp, bmp, bmp_len * sizeof (uint32_t));
2288
2289 free(sa->replay_state_esn);
2290 sa->replay_state_esn = _nl_steal_pointer(&b);
2291 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2292 return 0;
2293}
2294
2295
2296/**
2297 * Get interface id and flags from xfrm_user_offload.
2298 *
2299 * @arg sa The xfrmnl_sa object.
2300 * @arg ifindex An optional output value for the offload interface index.
2301 * @arg flags An optional output value for the offload flags.
2302 *
2303 * @return 0 on success or a negative error code.
2304 */
2305int xfrmnl_sa_get_user_offload(struct xfrmnl_sa *sa, int *ifindex, uint8_t *flags)
2306{
2307 int ret = -1;
2308
2309 if (sa->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV && sa->user_offload) {
2310 if (ifindex)
2311 *ifindex = sa->user_offload->ifindex;
2312 if (flags)
2313 *flags = sa->user_offload->flags;
2314 ret = 0;
2315 }
2316
2317 return ret;
2318}
2319
2320
2321/**
2322 * Set interface id and flags for xfrm_user_offload.
2323 *
2324 * @arg sa The xfrmnl_sa object.
2325 * @arg ifindex Id of the offload interface.
2326 * @arg flags Offload flags for the state.
2327 *
2328 * @return 0 on success or a negative error code.
2329 */
2330int xfrmnl_sa_set_user_offload(struct xfrmnl_sa *sa, int ifindex, uint8_t flags)
2331{
2332 _nl_auto_free struct xfrmnl_user_offload *b = NULL;
2333
2334 if (!(b = calloc(1, sizeof(*b))))
2335 return -1;
2336
2337 b->ifindex = ifindex;
2338 b->flags = flags;
2339
2340 free(sa->user_offload);
2341 sa->user_offload = _nl_steal_pointer(&b);
2342 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
2343
2344 return 0;
2345}
2346
2347int xfrmnl_sa_is_hardexpiry_reached (struct xfrmnl_sa* sa)
2348{
2349 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2350 return (sa->hard > 0 ? 1: 0);
2351 else
2352 return 0;
2353}
2354
2355int xfrmnl_sa_is_expiry_reached (struct xfrmnl_sa* sa)
2356{
2357 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2358 return 1;
2359 else
2360 return 0;
2361}
2362
2363/** @} */
2364
2365static struct nl_object_ops xfrm_sa_obj_ops = {
2366 .oo_name = "xfrm/sa",
2367 .oo_size = sizeof(struct xfrmnl_sa),
2368 .oo_constructor = xfrm_sa_alloc_data,
2369 .oo_free_data = xfrm_sa_free_data,
2370 .oo_clone = xfrm_sa_clone,
2371 .oo_dump = {
2372 [NL_DUMP_LINE] = xfrm_sa_dump_line,
2373 [NL_DUMP_DETAILS] = xfrm_sa_dump_details,
2374 [NL_DUMP_STATS] = xfrm_sa_dump_stats,
2375 },
2376 .oo_compare = xfrm_sa_compare,
2377 .oo_attrs2str = xfrm_sa_attrs2str,
2378 .oo_id_attrs = (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO),
2379};
2380
2381static struct nl_af_group xfrm_sa_groups[] = {
2382 { AF_UNSPEC, XFRMNLGRP_SA },
2383 { AF_UNSPEC, XFRMNLGRP_EXPIRE },
2384 { END_OF_GROUP_LIST },
2385};
2386
2387static struct nl_cache_ops xfrmnl_sa_ops = {
2388 .co_name = "xfrm/sa",
2389 .co_hdrsize = sizeof(struct xfrm_usersa_info),
2390 .co_msgtypes = {
2391 { XFRM_MSG_NEWSA, NL_ACT_NEW, "new" },
2392 { XFRM_MSG_DELSA, NL_ACT_DEL, "del" },
2393 { XFRM_MSG_GETSA, NL_ACT_GET, "get" },
2394 { XFRM_MSG_EXPIRE, NL_ACT_UNSPEC, "expire"},
2395 { XFRM_MSG_UPDSA, NL_ACT_NEW, "update"},
2396 END_OF_MSGTYPES_LIST,
2397 },
2398 .co_protocol = NETLINK_XFRM,
2399 .co_groups = xfrm_sa_groups,
2400 .co_request_update = xfrm_sa_request_update,
2401 .co_msg_parser = xfrm_sa_msg_parser,
2402 .co_obj_ops = &xfrm_sa_obj_ops,
2403 .co_include_event = &xfrm_sa_update_cache
2404};
2405
2406/**
2407 * @name XFRM SA Cache Managament
2408 * @{
2409 */
2410
2411static void _nl_init xfrm_sa_init(void)
2412{
2413 nl_cache_mngt_register(&xfrmnl_sa_ops);
2414}
2415
2416static void _nl_exit xfrm_sa_exit(void)
2417{
2418 nl_cache_mngt_unregister(&xfrmnl_sa_ops);
2419}
2420
2421/** @} */
xfrmnl_sel_cmp
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition selector.c:180
xfrmnl_ltime_cfg_alloc
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition lifetime.c:79
xfrmnl_ltime_cfg_cmp
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition lifetime.c:159
xfrmnl_ltime_cfg_clone
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition lifetime.c:98
xfrmnl_sel_alloc
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition selector.c:96
xfrmnl_sel_clone
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition selector.c:115
nl_addr_set_prefixlen
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition addr.c:967
nl_addr_get
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition addr.c:525
nl_addr_get_binary_addr
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition addr.c:943
nl_addr_cmp
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition addr.c:587
nl_addr_clone
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition addr.c:495
nl_addr_get_family
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition addr.c:895
nl_addr2str
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition addr.c:1001
nl_addr_get_len
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition addr.c:955
nl_addr_put
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition addr.c:541
nla_get_u32
uint32_t nla_get_u32(const struct nlattr *nla)
Return payload of 32 bit integer attribute.
Definition attr.c:714
nla_data
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition attr.c:119
NLA_PUT
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition attr.h:166
NLA_PUT_U32
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition attr.h:237
nla_put
int nla_put(struct nl_msg *msg, int attrtype, int datalen, const void *data)
Add a unspecific attribute to netlink message.
Definition attr.c:505
nla_reserve
struct nlattr * nla_reserve(struct nl_msg *msg, int attrtype, int attrlen)
Reserve space for a attribute.
Definition attr.c:461
NLA_U32
@ NLA_U32
32 bit integer
Definition attr.h:37
nl_cache_mngt_unregister
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition cache_mngt.c:287
nl_cache_mngt_register
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition cache_mngt.c:252
nl_cache_search
struct nl_object * nl_cache_search(struct nl_cache *cache, struct nl_object *needle)
Search object in cache.
Definition cache.c:1116
nl_cache_get_next
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition cache.c:147
nl_cache_remove
void nl_cache_remove(struct nl_object *obj)
Remove object from cache.
Definition cache.c:546
nl_cache_alloc_and_fill
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition cache.c:228
nl_cache_get_first
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition cache.c:121
nl_cache_move
int nl_cache_move(struct nl_cache *cache, struct nl_object *obj)
Move object from one cache to another.
Definition cache.c:518
nlmsg_alloc_simple
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition msg.c:352
nlmsg_data
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition msg.c:108
nlmsg_free
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition msg.c:572
nlmsg_parse
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition msg.c:219
nlmsg_append
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition msg.c:456
nl_object_get_msgtype
int nl_object_get_msgtype(const struct nl_object *obj)
Return the netlink message type the object was derived from.
Definition object.c:539
nl_object_diff64
uint64_t nl_object_diff64(struct nl_object *a, struct nl_object *b)
Compute bitmask representing difference in attribute values.
Definition object.c:371
nl_object_put
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition object.c:221
nl_object_get
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition object.c:210
nl_object_alloc
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition object.c:55
nl_send_auto
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition nl.c:515
nl_send_auto_complete
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition nl.c:1250
nl_pickup
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition nl.c:1181
nl_wait_for_ack
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition nl.c:1115
nl_send_simple
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition nl.c:579
nl_dump
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition utils.c:1015
NL_DUMP_STATS
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition types.h:22
NL_DUMP_LINE
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition types.h:20
NL_DUMP_DETAILS
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition types.h:21
nl_dump_params
Dumping parameters.
Definition types.h:32
nla_policy
Attribute validation policy.
Definition attr.h:66
xfrmnl_ltime_cfg
Definition nl-xfrm.h:11
xfrmnl_replay_state_esn
Definition nl-xfrm.h:37
xfrmnl_sel
Definition selector.c:55
xfrmnl_user_sec_ctx
Definition nl-xfrm.h:58