libnl 3.7.0
sa.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36/**
37 * @ingroup xfrmnl
38 * @defgroup sa Security Association
39 * @brief
40 */
41
42#include <netlink-private/netlink.h>
43#include <netlink/netlink.h>
44#include <netlink/cache.h>
45#include <netlink/object.h>
46#include <netlink/xfrm/sa.h>
47#include <netlink/xfrm/selector.h>
48#include <netlink/xfrm/lifetime.h>
49#include <time.h>
50
51#include "netlink-private/utils.h"
52
53/** @cond SKIP */
54#define XFRM_SA_ATTR_SEL 0x01
55#define XFRM_SA_ATTR_DADDR 0x02
56#define XFRM_SA_ATTR_SPI 0x04
57#define XFRM_SA_ATTR_PROTO 0x08
58#define XFRM_SA_ATTR_SADDR 0x10
59#define XFRM_SA_ATTR_LTIME_CFG 0x20
60#define XFRM_SA_ATTR_LTIME_CUR 0x40
61#define XFRM_SA_ATTR_STATS 0x80
62#define XFRM_SA_ATTR_SEQ 0x100
63#define XFRM_SA_ATTR_REQID 0x200
64#define XFRM_SA_ATTR_FAMILY 0x400
65#define XFRM_SA_ATTR_MODE 0x800
66#define XFRM_SA_ATTR_REPLAY_WIN 0x1000
67#define XFRM_SA_ATTR_FLAGS 0x2000
68#define XFRM_SA_ATTR_ALG_AEAD 0x4000
69#define XFRM_SA_ATTR_ALG_AUTH 0x8000
70#define XFRM_SA_ATTR_ALG_CRYPT 0x10000
71#define XFRM_SA_ATTR_ALG_COMP 0x20000
72#define XFRM_SA_ATTR_ENCAP 0x40000
73#define XFRM_SA_ATTR_TFCPAD 0x80000
74#define XFRM_SA_ATTR_COADDR 0x100000
75#define XFRM_SA_ATTR_MARK 0x200000
76#define XFRM_SA_ATTR_SECCTX 0x400000
77#define XFRM_SA_ATTR_REPLAY_MAXAGE 0x800000
78#define XFRM_SA_ATTR_REPLAY_MAXDIFF 0x1000000
79#define XFRM_SA_ATTR_REPLAY_STATE 0x2000000
80#define XFRM_SA_ATTR_EXPIRE 0x4000000
81#define XFRM_SA_ATTR_OFFLOAD_DEV 0x8000000
82
83static struct nl_cache_ops xfrmnl_sa_ops;
84static struct nl_object_ops xfrm_sa_obj_ops;
85/** @endcond */
86
87static void xfrm_sa_alloc_data(struct nl_object *c)
88{
89 struct xfrmnl_sa* sa = nl_object_priv (c);
90
91 if ((sa->sel = xfrmnl_sel_alloc ()) == NULL)
92 return;
93
94 if ((sa->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
95 return;
96}
97
98static void xfrm_sa_free_data(struct nl_object *c)
99{
100 struct xfrmnl_sa* sa = nl_object_priv (c);
101
102 if (sa == NULL)
103 return;
104
105 xfrmnl_sel_put (sa->sel);
106 xfrmnl_ltime_cfg_put (sa->lft);
107 nl_addr_put (sa->id.daddr);
108 nl_addr_put (sa->saddr);
109
110 if (sa->aead)
111 free (sa->aead);
112 if (sa->auth)
113 free (sa->auth);
114 if (sa->crypt)
115 free (sa->crypt);
116 if (sa->comp)
117 free (sa->comp);
118 if (sa->encap) {
119 if (sa->encap->encap_oa)
120 nl_addr_put(sa->encap->encap_oa);
121 free(sa->encap);
122 }
123 if (sa->coaddr)
124 nl_addr_put (sa->coaddr);
125 if (sa->sec_ctx)
126 free (sa->sec_ctx);
127 if (sa->replay_state_esn)
128 free (sa->replay_state_esn);
129 if (sa->user_offload)
130 free(sa->user_offload);
131}
132
133static int xfrm_sa_clone(struct nl_object *_dst, struct nl_object *_src)
134{
135 struct xfrmnl_sa* dst = nl_object_priv(_dst);
136 struct xfrmnl_sa* src = nl_object_priv(_src);
137 uint32_t len = 0;
138
139 dst->sel = NULL;
140 dst->id.daddr = NULL;
141 dst->saddr = NULL;
142 dst->lft = NULL;
143 dst->aead = NULL;
144 dst->auth = NULL;
145 dst->crypt = NULL;
146 dst->comp = NULL;
147 dst->encap = NULL;
148 dst->coaddr = NULL;
149 dst->sec_ctx = NULL;
150 dst->replay_state_esn = NULL;
151 dst->user_offload = NULL;
152
153 if (src->sel)
154 if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
155 return -NLE_NOMEM;
156
157 if (src->lft)
158 if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
159 return -NLE_NOMEM;
160
161 if (src->id.daddr)
162 if ((dst->id.daddr = nl_addr_clone (src->id.daddr)) == NULL)
163 return -NLE_NOMEM;
164
165 if (src->saddr)
166 if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
167 return -NLE_NOMEM;
168
169 if (src->aead) {
170 len = sizeof (struct xfrmnl_algo_aead) + ((src->aead->alg_key_len + 7) / 8);
171 if ((dst->aead = calloc (1, len)) == NULL)
172 return -NLE_NOMEM;
173 memcpy ((void *)dst->aead, (void *)src->aead, len);
174 }
175
176 if (src->auth) {
177 len = sizeof (struct xfrmnl_algo_auth) + ((src->auth->alg_key_len + 7) / 8);
178 if ((dst->auth = calloc (1, len)) == NULL)
179 return -NLE_NOMEM;
180 memcpy ((void *)dst->auth, (void *)src->auth, len);
181 }
182
183 if (src->crypt) {
184 len = sizeof (struct xfrmnl_algo) + ((src->crypt->alg_key_len + 7) / 8);
185 if ((dst->crypt = calloc (1, len)) == NULL)
186 return -NLE_NOMEM;
187 memcpy ((void *)dst->crypt, (void *)src->crypt, len);
188 }
189
190 if (src->comp) {
191 len = sizeof (struct xfrmnl_algo) + ((src->comp->alg_key_len + 7) / 8);
192 if ((dst->comp = calloc (1, len)) == NULL)
193 return -NLE_NOMEM;
194 memcpy ((void *)dst->comp, (void *)src->comp, len);
195 }
196
197 if (src->encap) {
198 len = sizeof (struct xfrmnl_encap_tmpl);
199 if ((dst->encap = calloc (1, len)) == NULL)
200 return -NLE_NOMEM;
201 memcpy ((void *)dst->encap, (void *)src->encap, len);
202 }
203
204 if (src->coaddr)
205 if ((dst->coaddr = nl_addr_clone (src->coaddr)) == NULL)
206 return -NLE_NOMEM;
207
208 if (src->sec_ctx) {
209 len = sizeof (*src->sec_ctx) + src->sec_ctx->ctx_len;
210 if ((dst->sec_ctx = calloc (1, len)) == NULL)
211 return -NLE_NOMEM;
212 memcpy ((void *)dst->sec_ctx, (void *)src->sec_ctx, len);
213 }
214
215 if (src->replay_state_esn) {
216 len = sizeof (struct xfrmnl_replay_state_esn) + (src->replay_state_esn->bmp_len * sizeof (uint32_t));
217 if ((dst->replay_state_esn = calloc (1, len)) == NULL)
218 return -NLE_NOMEM;
219 memcpy ((void *)dst->replay_state_esn, (void *)src->replay_state_esn, len);
220 }
221
222 if (src->user_offload) {
223 dst->user_offload = _nl_memdup_ptr(src->user_offload);
224 if (!dst->user_offload)
225 return -NLE_NOMEM;
226 }
227
228 return 0;
229}
230
231static uint64_t xfrm_sa_compare(struct nl_object *_a, struct nl_object *_b,
232 uint64_t attrs, int flags)
233{
234 struct xfrmnl_sa* a = (struct xfrmnl_sa *) _a;
235 struct xfrmnl_sa* b = (struct xfrmnl_sa *) _b;
236 uint64_t diff = 0;
237 int found = 0;
238
239#define XFRM_SA_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_SA_ATTR_##ATTR, a, b, EXPR)
240 diff |= XFRM_SA_DIFF(SEL, xfrmnl_sel_cmp(a->sel, b->sel));
241 diff |= XFRM_SA_DIFF(DADDR, nl_addr_cmp(a->id.daddr, b->id.daddr));
242 diff |= XFRM_SA_DIFF(SPI, a->id.spi != b->id.spi);
243 diff |= XFRM_SA_DIFF(PROTO, a->id.proto != b->id.proto);
244 diff |= XFRM_SA_DIFF(SADDR, nl_addr_cmp(a->saddr, b->saddr));
245 diff |= XFRM_SA_DIFF(LTIME_CFG, xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
246 diff |= XFRM_SA_DIFF(REQID, a->reqid != b->reqid);
247 diff |= XFRM_SA_DIFF(FAMILY,a->family != b->family);
248 diff |= XFRM_SA_DIFF(MODE,a->mode != b->mode);
249 diff |= XFRM_SA_DIFF(REPLAY_WIN,a->replay_window != b->replay_window);
250 diff |= XFRM_SA_DIFF(FLAGS,a->flags != b->flags);
251 diff |= XFRM_SA_DIFF(ALG_AEAD,(strcmp(a->aead->alg_name, b->aead->alg_name) ||
252 (a->aead->alg_key_len != b->aead->alg_key_len) ||
253 (a->aead->alg_icv_len != b->aead->alg_icv_len) ||
254 memcmp(a->aead->alg_key, b->aead->alg_key,
255 ((a->aead->alg_key_len + 7)/8))));
256 diff |= XFRM_SA_DIFF(ALG_AUTH,(strcmp(a->auth->alg_name, b->auth->alg_name) ||
257 (a->auth->alg_key_len != b->auth->alg_key_len) ||
258 (a->auth->alg_trunc_len != b->auth->alg_trunc_len) ||
259 memcmp(a->auth->alg_key, b->auth->alg_key,
260 ((a->auth->alg_key_len + 7)/8))));
261 diff |= XFRM_SA_DIFF(ALG_CRYPT,(strcmp(a->crypt->alg_name, b->crypt->alg_name) ||
262 (a->crypt->alg_key_len != b->crypt->alg_key_len) ||
263 memcmp(a->crypt->alg_key, b->crypt->alg_key,
264 ((a->crypt->alg_key_len + 7)/8))));
265 diff |= XFRM_SA_DIFF(ALG_COMP,(strcmp(a->comp->alg_name, b->comp->alg_name) ||
266 (a->comp->alg_key_len != b->comp->alg_key_len) ||
267 memcmp(a->comp->alg_key, b->comp->alg_key,
268 ((a->comp->alg_key_len + 7)/8))));
269 diff |= XFRM_SA_DIFF(ENCAP,((a->encap->encap_type != b->encap->encap_type) ||
270 (a->encap->encap_sport != b->encap->encap_sport) ||
271 (a->encap->encap_dport != b->encap->encap_dport) ||
272 nl_addr_cmp(a->encap->encap_oa, b->encap->encap_oa)));
273 diff |= XFRM_SA_DIFF(TFCPAD,a->tfcpad != b->tfcpad);
274 diff |= XFRM_SA_DIFF(COADDR,nl_addr_cmp(a->coaddr, b->coaddr));
275 diff |= XFRM_SA_DIFF(MARK,(a->mark.m != b->mark.m) ||
276 (a->mark.v != b->mark.v));
277 diff |= XFRM_SA_DIFF(SECCTX,((a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
278 (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
279 (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
280 strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
281 diff |= XFRM_SA_DIFF(REPLAY_MAXAGE,a->replay_maxage != b->replay_maxage);
282 diff |= XFRM_SA_DIFF(REPLAY_MAXDIFF,a->replay_maxdiff != b->replay_maxdiff);
283 diff |= XFRM_SA_DIFF(EXPIRE,a->hard != b->hard);
284
285 /* Compare replay states */
286 found = AVAILABLE_MISMATCH (a, b, XFRM_SA_ATTR_REPLAY_STATE);
287 if (found == 0) // attribute exists in both objects
288 {
289 if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
290 ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
291 found |= 1;
292
293 if (found == 0) // same replay type. compare actual values
294 {
295 if (a->replay_state_esn)
296 {
297 if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
298 diff |= 1;
299 else
300 {
301 uint32_t len = sizeof (struct xfrmnl_replay_state_esn) +
302 (a->replay_state_esn->bmp_len * sizeof (uint32_t));
303 diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
304 }
305 }
306 else
307 {
308 if ((a->replay_state.oseq != b->replay_state.oseq) ||
309 (a->replay_state.seq != b->replay_state.seq) ||
310 (a->replay_state.bitmap != b->replay_state.bitmap))
311 diff |= 1;
312 }
313 }
314 }
315#undef XFRM_SA_DIFF
316
317 return diff;
318}
319
320/**
321 * @name XFRM SA Attribute Translations
322 * @{
323 */
324static const struct trans_tbl sa_attrs[] = {
325 __ADD(XFRM_SA_ATTR_SEL, selector),
326 __ADD(XFRM_SA_ATTR_DADDR, daddr),
327 __ADD(XFRM_SA_ATTR_SPI, spi),
328 __ADD(XFRM_SA_ATTR_PROTO, proto),
329 __ADD(XFRM_SA_ATTR_SADDR, saddr),
330 __ADD(XFRM_SA_ATTR_LTIME_CFG, lifetime_cfg),
331 __ADD(XFRM_SA_ATTR_LTIME_CUR, lifetime_cur),
332 __ADD(XFRM_SA_ATTR_STATS, stats),
333 __ADD(XFRM_SA_ATTR_SEQ, seqnum),
334 __ADD(XFRM_SA_ATTR_REQID, reqid),
335 __ADD(XFRM_SA_ATTR_FAMILY, family),
336 __ADD(XFRM_SA_ATTR_MODE, mode),
337 __ADD(XFRM_SA_ATTR_REPLAY_WIN, replay_window),
338 __ADD(XFRM_SA_ATTR_FLAGS, flags),
339 __ADD(XFRM_SA_ATTR_ALG_AEAD, alg_aead),
340 __ADD(XFRM_SA_ATTR_ALG_AUTH, alg_auth),
341 __ADD(XFRM_SA_ATTR_ALG_CRYPT, alg_crypto),
342 __ADD(XFRM_SA_ATTR_ALG_COMP, alg_comp),
343 __ADD(XFRM_SA_ATTR_ENCAP, encap),
344 __ADD(XFRM_SA_ATTR_TFCPAD, tfcpad),
345 __ADD(XFRM_SA_ATTR_COADDR, coaddr),
346 __ADD(XFRM_SA_ATTR_MARK, mark),
347 __ADD(XFRM_SA_ATTR_SECCTX, sec_ctx),
348 __ADD(XFRM_SA_ATTR_REPLAY_MAXAGE, replay_maxage),
349 __ADD(XFRM_SA_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
350 __ADD(XFRM_SA_ATTR_REPLAY_STATE, replay_state),
351 __ADD(XFRM_SA_ATTR_EXPIRE, expire),
352 __ADD(XFRM_SA_ATTR_OFFLOAD_DEV, user_offload),
353};
354
355static char* xfrm_sa_attrs2str(int attrs, char *buf, size_t len)
356{
357 return __flags2str (attrs, buf, len, sa_attrs, ARRAY_SIZE(sa_attrs));
358}
359/** @} */
360
361/**
362 * @name XFRM SA Flags Translations
363 * @{
364 */
365static const struct trans_tbl sa_flags[] = {
366 __ADD(XFRM_STATE_NOECN, no ecn),
367 __ADD(XFRM_STATE_DECAP_DSCP, decap dscp),
368 __ADD(XFRM_STATE_NOPMTUDISC, no pmtu discovery),
369 __ADD(XFRM_STATE_WILDRECV, wild receive),
370 __ADD(XFRM_STATE_ICMP, icmp),
371 __ADD(XFRM_STATE_AF_UNSPEC, unspecified),
372 __ADD(XFRM_STATE_ALIGN4, align4),
373 __ADD(XFRM_STATE_ESN, esn),
374};
375
376char* xfrmnl_sa_flags2str(int flags, char *buf, size_t len)
377{
378 return __flags2str (flags, buf, len, sa_flags, ARRAY_SIZE(sa_flags));
379}
380
381int xfrmnl_sa_str2flag(const char *name)
382{
383 return __str2flags (name, sa_flags, ARRAY_SIZE(sa_flags));
384}
385/** @} */
386
387/**
388 * @name XFRM SA Mode Translations
389 * @{
390 */
391static const struct trans_tbl sa_modes[] = {
392 __ADD(XFRM_MODE_TRANSPORT, transport),
393 __ADD(XFRM_MODE_TUNNEL, tunnel),
394 __ADD(XFRM_MODE_ROUTEOPTIMIZATION, route optimization),
395 __ADD(XFRM_MODE_IN_TRIGGER, in trigger),
396 __ADD(XFRM_MODE_BEET, beet),
397};
398
399char* xfrmnl_sa_mode2str(int mode, char *buf, size_t len)
400{
401 return __type2str (mode, buf, len, sa_modes, ARRAY_SIZE(sa_modes));
402}
403
404int xfrmnl_sa_str2mode(const char *name)
405{
406 return __str2type (name, sa_modes, ARRAY_SIZE(sa_modes));
407}
408/** @} */
409
410
411static void xfrm_sa_dump_line(struct nl_object *a, struct nl_dump_params *p)
412{
413 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
414 struct xfrmnl_sa* sa = (struct xfrmnl_sa *) a;
415 char flags[128], mode[128];
416 time_t add_time, use_time;
417 struct tm *add_time_tm, *use_time_tm;
418
419 nl_dump_line(p, "src %s dst %s family: %s\n", nl_addr2str(sa->saddr, src, sizeof(src)),
420 nl_addr2str(sa->id.daddr, dst, sizeof(dst)),
421 nl_af2str (sa->family, flags, sizeof (flags)));
422
423 nl_dump_line(p, "\tproto %s spi 0x%x reqid %u\n",
424 nl_ip_proto2str (sa->id.proto, flags, sizeof(flags)),
425 sa->id.spi, sa->reqid);
426
427 xfrmnl_sa_flags2str(sa->flags, flags, sizeof (flags));
428 xfrmnl_sa_mode2str(sa->mode, mode, sizeof (mode));
429 nl_dump_line(p, "\tmode: %s flags: %s (0x%x) seq: %u replay window: %u\n",
430 mode, flags, sa->flags, sa->seq, sa->replay_window);
431
432 nl_dump_line(p, "\tlifetime configuration: \n");
433 if (sa->lft->soft_byte_limit == XFRM_INF)
434 sprintf (flags, "INF");
435 else
436 sprintf (flags, "%" PRIu64, sa->lft->soft_byte_limit);
437 if (sa->lft->soft_packet_limit == XFRM_INF)
438 sprintf (mode, "INF");
439 else
440 sprintf (mode, "%" PRIu64, sa->lft->soft_packet_limit);
441 nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets)\n", flags, mode);
442 if (sa->lft->hard_byte_limit == XFRM_INF)
443 sprintf (flags, "INF");
444 else
445 sprintf (flags, "%" PRIu64, sa->lft->hard_byte_limit);
446 if (sa->lft->hard_packet_limit == XFRM_INF)
447 sprintf (mode, "INF");
448 else
449 sprintf (mode, "%" PRIu64, sa->lft->hard_packet_limit);
450 nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets)\n", flags,
451 mode);
452 nl_dump_line(
453 p,
454 "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
455 (long long unsigned)sa->lft->soft_add_expires_seconds,
456 (long long unsigned)sa->lft->soft_use_expires_seconds);
457 nl_dump_line(
458 p,
459 "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
460 (long long unsigned)sa->lft->hard_add_expires_seconds,
461 (long long unsigned)sa->lft->hard_use_expires_seconds);
462
463 nl_dump_line(p, "\tlifetime current: \n");
464 nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
465 (long long unsigned)sa->curlft.bytes,
466 (long long unsigned)sa->curlft.packets);
467 if (sa->curlft.add_time != 0)
468 {
469 add_time = sa->curlft.add_time;
470 add_time_tm = gmtime (&add_time);
471 strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
472 }
473 else
474 {
475 sprintf (flags, "%s", "-");
476 }
477
478 if (sa->curlft.use_time != 0)
479 {
480 use_time = sa->curlft.use_time;
481 use_time_tm = gmtime (&use_time);
482 strftime (mode, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
483 }
484 else
485 {
486 sprintf (mode, "%s", "-");
487 }
488 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, mode);
489
490 if (sa->aead)
491 {
492 nl_dump_line(p, "\tAEAD Algo: \n");
493 nl_dump_line(p, "\t\tName: %s Key len(bits): %u ICV Len(bits): %u\n",
494 sa->aead->alg_name, sa->aead->alg_key_len, sa->aead->alg_icv_len);
495 }
496
497 if (sa->auth)
498 {
499 nl_dump_line(p, "\tAuth Algo: \n");
500 nl_dump_line(p, "\t\tName: %s Key len(bits): %u Trunc len(bits): %u\n",
501 sa->auth->alg_name, sa->auth->alg_key_len, sa->auth->alg_trunc_len);
502 }
503
504 if (sa->crypt)
505 {
506 nl_dump_line(p, "\tEncryption Algo: \n");
507 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
508 sa->crypt->alg_name, sa->crypt->alg_key_len);
509 }
510
511 if (sa->comp)
512 {
513 nl_dump_line(p, "\tCompression Algo: \n");
514 nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
515 sa->comp->alg_name, sa->comp->alg_key_len);
516 }
517
518 if (sa->encap)
519 {
520 nl_dump_line(p, "\tEncapsulation template: \n");
521 nl_dump_line(p, "\t\tType: %d Src port: %d Dst port: %d Encap addr: %s\n",
522 sa->encap->encap_type, sa->encap->encap_sport, sa->encap->encap_dport,
523 nl_addr2str (sa->encap->encap_oa, dst, sizeof (dst)));
524 }
525
526 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
527 nl_dump_line(p, "\tTFC Pad: %u\n", sa->tfcpad);
528
529 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
530 nl_dump_line(p, "\tCO Address: %s\n", nl_addr2str (sa->coaddr, dst, sizeof (dst)));
531
532 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
533 nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sa->mark.m, sa->mark.v);
534
535 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
536 nl_dump_line(p, "\tDOI: %d Algo: %d Len: %u ctx: %s\n", sa->sec_ctx->ctx_doi,
537 sa->sec_ctx->ctx_alg, sa->sec_ctx->ctx_len, sa->sec_ctx->ctx);
538
539 nl_dump_line(p, "\treplay info: \n");
540 nl_dump_line(p, "\t\tmax age %u max diff %u \n", sa->replay_maxage, sa->replay_maxdiff);
541
542 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
543 {
544 nl_dump_line(p, "\treplay state info: \n");
545 if (sa->replay_state_esn)
546 {
547 nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
548 sa->replay_state_esn->oseq, sa->replay_state_esn->seq,
549 sa->replay_state_esn->oseq_hi, sa->replay_state_esn->seq_hi,
550 sa->replay_state_esn->replay_window);
551 }
552 else
553 {
554 nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", sa->replay_state.oseq,
555 sa->replay_state.seq, sa->replay_state.bitmap);
556 }
557 }
558
559 nl_dump_line(p, "\tselector info: \n");
560 xfrmnl_sel_dump (sa->sel, p);
561
562 nl_dump_line(p, "\tHard: %d\n", sa->hard);
563
564 nl_dump(p, "\n");
565}
566
567static void xfrm_sa_dump_stats(struct nl_object *a, struct nl_dump_params *p)
568{
569 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)a;
570
571 nl_dump_line(p, "\tstats: \n");
572 nl_dump_line(p, "\t\treplay window: %u replay: %u integrity failed: %u \n",
573 sa->stats.replay_window, sa->stats.replay, sa->stats.integrity_failed);
574
575 return;
576}
577
578static void xfrm_sa_dump_details(struct nl_object *a, struct nl_dump_params *p)
579{
580 xfrm_sa_dump_line(a, p);
581 xfrm_sa_dump_stats (a, p);
582}
583
584/**
585 * @name XFRM SA Object Allocation/Freeage
586 * @{
587 */
588
589struct xfrmnl_sa* xfrmnl_sa_alloc(void)
590{
591 return (struct xfrmnl_sa*) nl_object_alloc(&xfrm_sa_obj_ops);
592}
593
594void xfrmnl_sa_put(struct xfrmnl_sa* sa)
595{
596 nl_object_put((struct nl_object *) sa);
597}
598
599/** @} */
600
601/**
602 * @name SA Cache Managament
603 * @{
604 */
605
606/**
607 * Build a SA cache including all SAs currently configured in the kernel.
608 * @arg sock Netlink socket.
609 * @arg result Pointer to store resulting cache.
610 *
611 * Allocates a new SA cache, initializes it properly and updates it
612 * to include all SAs currently configured in the kernel.
613 *
614 * @return 0 on success or a negative error code.
615 */
616int xfrmnl_sa_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
617{
618 return nl_cache_alloc_and_fill(&xfrmnl_sa_ops, sock, result);
619}
620
621/**
622 * Look up a SA by destination address, SPI, protocol
623 * @arg cache SA cache
624 * @arg daddr destination address of the SA
625 * @arg spi SPI
626 * @arg proto protocol
627 * @return sa handle or NULL if no match was found.
628 */
629struct xfrmnl_sa* xfrmnl_sa_get(struct nl_cache* cache, struct nl_addr* daddr,
630 unsigned int spi, unsigned int proto)
631{
632 struct xfrmnl_sa *sa;
633
634 //nl_list_for_each_entry(sa, &cache->c_items, ce_list) {
635 for (sa = (struct xfrmnl_sa*)nl_cache_get_first (cache);
636 sa != NULL;
637 sa = (struct xfrmnl_sa*)nl_cache_get_next ((struct nl_object*)sa))
638 {
639 if (sa->id.proto == proto &&
640 sa->id.spi == spi &&
641 !nl_addr_cmp(sa->id.daddr, daddr))
642 {
643 nl_object_get((struct nl_object *) sa);
644 return sa;
645 }
646
647 }
648
649 return NULL;
650}
651
652
653/** @} */
654
655
656static struct nla_policy xfrm_sa_policy[XFRMA_MAX+1] = {
657 [XFRMA_SA] = { .minlen = sizeof(struct xfrm_usersa_info)},
658 [XFRMA_ALG_AUTH_TRUNC] = { .minlen = sizeof(struct xfrm_algo_auth)},
659 [XFRMA_ALG_AEAD] = { .minlen = sizeof(struct xfrm_algo_aead) },
660 [XFRMA_ALG_AUTH] = { .minlen = sizeof(struct xfrm_algo) },
661 [XFRMA_ALG_CRYPT] = { .minlen = sizeof(struct xfrm_algo) },
662 [XFRMA_ALG_COMP] = { .minlen = sizeof(struct xfrm_algo) },
663 [XFRMA_ENCAP] = { .minlen = sizeof(struct xfrm_encap_tmpl) },
664 [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
665 [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
666 [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
667 [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
668 [XFRMA_OFFLOAD_DEV] = { .minlen = sizeof(struct xfrm_user_offload) },
669 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
670 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
671 [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
672 [XFRMA_COADDR] = { .minlen = sizeof(xfrm_address_t) },
673 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
674 [XFRMA_TFCPAD] = { .type = NLA_U32 },
675 [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
676};
677
678static int xfrm_sa_request_update(struct nl_cache *c, struct nl_sock *h)
679{
680 return nl_send_simple (h, XFRM_MSG_GETSA, NLM_F_DUMP, NULL, 0);
681}
682
683int xfrmnl_sa_parse(struct nlmsghdr *n, struct xfrmnl_sa **result)
684{
685 struct xfrmnl_sa* sa;
686 struct nlattr *tb[XFRMA_MAX + 1];
687 struct xfrm_usersa_info* sa_info;
688 struct xfrm_user_expire* ue;
689 int len, err;
690 struct nl_addr* addr;
691
692 sa = xfrmnl_sa_alloc();
693 if (!sa) {
694 err = -NLE_NOMEM;
695 goto errout;
696 }
697
698 sa->ce_msgtype = n->nlmsg_type;
699 if (n->nlmsg_type == XFRM_MSG_EXPIRE)
700 {
701 ue = nlmsg_data(n);
702 sa_info = &ue->state;
703 sa->hard = ue->hard;
704 sa->ce_mask |= XFRM_SA_ATTR_EXPIRE;
705 }
706 else if (n->nlmsg_type == XFRM_MSG_DELSA)
707 {
708 sa_info = (struct xfrm_usersa_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_usersa_id) + NLA_HDRLEN);
709 }
710 else
711 {
712 sa_info = nlmsg_data(n);
713 }
714
715 err = nlmsg_parse(n, sizeof(struct xfrm_usersa_info), tb, XFRMA_MAX, xfrm_sa_policy);
716 if (err < 0)
717 goto errout;
718
719 if (sa_info->sel.family == AF_INET)
720 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a4, sizeof (sa_info->sel.daddr.a4));
721 else
722 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a6, sizeof (sa_info->sel.daddr.a6));
723 nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_d);
724 xfrmnl_sel_set_daddr (sa->sel, addr);
725 /* Drop the reference count from the above set operation */
726 nl_addr_put(addr);
727 xfrmnl_sel_set_prefixlen_d (sa->sel, sa_info->sel.prefixlen_d);
728
729 if (sa_info->sel.family == AF_INET)
730 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a4, sizeof (sa_info->sel.saddr.a4));
731 else
732 addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a6, sizeof (sa_info->sel.saddr.a6));
733 nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_s);
734 xfrmnl_sel_set_saddr (sa->sel, addr);
735 /* Drop the reference count from the above set operation */
736 nl_addr_put(addr);
737 xfrmnl_sel_set_prefixlen_s (sa->sel, sa_info->sel.prefixlen_s);
738
739 xfrmnl_sel_set_dport (sa->sel, ntohs(sa_info->sel.dport));
740 xfrmnl_sel_set_dportmask (sa->sel, ntohs(sa_info->sel.dport_mask));
741 xfrmnl_sel_set_sport (sa->sel, ntohs(sa_info->sel.sport));
742 xfrmnl_sel_set_sportmask (sa->sel, ntohs(sa_info->sel.sport_mask));
743 xfrmnl_sel_set_family (sa->sel, sa_info->sel.family);
744 xfrmnl_sel_set_proto (sa->sel, sa_info->sel.proto);
745 xfrmnl_sel_set_ifindex (sa->sel, sa_info->sel.ifindex);
746 xfrmnl_sel_set_userid (sa->sel, sa_info->sel.user);
747 sa->ce_mask |= XFRM_SA_ATTR_SEL;
748
749 if (sa_info->family == AF_INET)
750 sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a4, sizeof (sa_info->id.daddr.a4));
751 else
752 sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a6, sizeof (sa_info->id.daddr.a6));
753 sa->id.spi = ntohl(sa_info->id.spi);
754 sa->id.proto = sa_info->id.proto;
755 sa->ce_mask |= (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO);
756
757 if (sa_info->family == AF_INET)
758 sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a4, sizeof (sa_info->saddr.a4));
759 else
760 sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a6, sizeof (sa_info->saddr.a6));
761 sa->ce_mask |= XFRM_SA_ATTR_SADDR;
762
763 sa->lft->soft_byte_limit = sa_info->lft.soft_byte_limit;
764 sa->lft->hard_byte_limit = sa_info->lft.hard_byte_limit;
765 sa->lft->soft_packet_limit = sa_info->lft.soft_packet_limit;
766 sa->lft->hard_packet_limit = sa_info->lft.hard_packet_limit;
767 sa->lft->soft_add_expires_seconds = sa_info->lft.soft_add_expires_seconds;
768 sa->lft->hard_add_expires_seconds = sa_info->lft.hard_add_expires_seconds;
769 sa->lft->soft_use_expires_seconds = sa_info->lft.soft_use_expires_seconds;
770 sa->lft->hard_use_expires_seconds = sa_info->lft.hard_use_expires_seconds;
771 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
772
773 sa->curlft.bytes = sa_info->curlft.bytes;
774 sa->curlft.packets = sa_info->curlft.packets;
775 sa->curlft.add_time = sa_info->curlft.add_time;
776 sa->curlft.use_time = sa_info->curlft.use_time;
777 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CUR;
778
779 sa->stats.replay_window = sa_info->stats.replay_window;
780 sa->stats.replay = sa_info->stats.replay;
781 sa->stats.integrity_failed = sa_info->stats.integrity_failed;
782 sa->ce_mask |= XFRM_SA_ATTR_STATS;
783
784 sa->seq = sa_info->seq;
785 sa->reqid = sa_info->reqid;
786 sa->family = sa_info->family;
787 sa->mode = sa_info->mode;
788 sa->replay_window = sa_info->replay_window;
789 sa->flags = sa_info->flags;
790 sa->ce_mask |= (XFRM_SA_ATTR_SEQ | XFRM_SA_ATTR_REQID |
791 XFRM_SA_ATTR_FAMILY | XFRM_SA_ATTR_MODE |
792 XFRM_SA_ATTR_REPLAY_WIN | XFRM_SA_ATTR_FLAGS);
793
794 if (tb[XFRMA_ALG_AEAD]) {
795 struct xfrm_algo_aead* aead = nla_data(tb[XFRMA_ALG_AEAD]);
796 len = sizeof (struct xfrmnl_algo_aead) + ((aead->alg_key_len + 7) / 8);
797 if ((sa->aead = calloc (1, len)) == NULL)
798 {
799 err = -NLE_NOMEM;
800 goto errout;
801 }
802 memcpy ((void *)sa->aead, (void *)aead, len);
803 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
804 }
805
806 if (tb[XFRMA_ALG_AUTH_TRUNC]) {
807 struct xfrm_algo_auth* auth = nla_data(tb[XFRMA_ALG_AUTH_TRUNC]);
808 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
809 if ((sa->auth = calloc (1, len)) == NULL)
810 {
811 err = -NLE_NOMEM;
812 goto errout;
813 }
814 memcpy ((void *)sa->auth, (void *)auth, len);
815 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
816 }
817
818 if (tb[XFRMA_ALG_AUTH] && !sa->auth) {
819 struct xfrm_algo* auth = nla_data(tb[XFRMA_ALG_AUTH]);
820 len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
821 if ((sa->auth = calloc (1, len)) == NULL)
822 {
823 err = -NLE_NOMEM;
824 goto errout;
825 }
826 strcpy(sa->auth->alg_name, auth->alg_name);
827 memcpy(sa->auth->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
828 sa->auth->alg_key_len = auth->alg_key_len;
829 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
830 }
831
832 if (tb[XFRMA_ALG_CRYPT]) {
833 struct xfrm_algo* crypt = nla_data(tb[XFRMA_ALG_CRYPT]);
834 len = sizeof (struct xfrmnl_algo) + ((crypt->alg_key_len + 7) / 8);
835 if ((sa->crypt = calloc (1, len)) == NULL)
836 {
837 err = -NLE_NOMEM;
838 goto errout;
839 }
840 memcpy ((void *)sa->crypt, (void *)crypt, len);
841 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
842 }
843
844 if (tb[XFRMA_ALG_COMP]) {
845 struct xfrm_algo* comp = nla_data(tb[XFRMA_ALG_COMP]);
846 len = sizeof (struct xfrmnl_algo) + ((comp->alg_key_len + 7) / 8);
847 if ((sa->comp = calloc (1, len)) == NULL)
848 {
849 err = -NLE_NOMEM;
850 goto errout;
851 }
852 memcpy ((void *)sa->comp, (void *)comp, len);
853 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
854 }
855
856 if (tb[XFRMA_ENCAP]) {
857 struct xfrm_encap_tmpl* encap = nla_data(tb[XFRMA_ENCAP]);
858 len = sizeof (struct xfrmnl_encap_tmpl);
859 if ((sa->encap = calloc (1, len)) == NULL)
860 {
861 err = -NLE_NOMEM;
862 goto errout;
863 }
864 sa->encap->encap_type = encap->encap_type;
865 sa->encap->encap_sport = ntohs(encap->encap_sport);
866 sa->encap->encap_dport = ntohs(encap->encap_dport);
867 if (sa_info->family == AF_INET)
868 sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a4, sizeof (encap->encap_oa.a4));
869 else
870 sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a6, sizeof (encap->encap_oa.a6));
871 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
872 }
873
874 if (tb[XFRMA_TFCPAD]) {
875 sa->tfcpad = *(uint32_t*)nla_data(tb[XFRMA_TFCPAD]);
876 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
877 }
878
879 if (tb[XFRMA_COADDR]) {
880 if (sa_info->family == AF_INET)
881 {
882 sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
883 sizeof (uint32_t));
884 }
885 else
886 {
887 sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
888 sizeof (uint32_t) * 4);
889 }
890 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
891 }
892
893 if (tb[XFRMA_MARK]) {
894 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
895 sa->mark.m = m->m;
896 sa->mark.v = m->v;
897 sa->ce_mask |= XFRM_SA_ATTR_MARK;
898 }
899
900 if (tb[XFRMA_SEC_CTX]) {
901 struct xfrm_user_sec_ctx* sec_ctx = nla_data(tb[XFRMA_SEC_CTX]);
902 len = sizeof (struct xfrmnl_user_sec_ctx) + sec_ctx->ctx_len;
903 if ((sa->sec_ctx = calloc (1, len)) == NULL)
904 {
905 err = -NLE_NOMEM;
906 goto errout;
907 }
908 memcpy (sa->sec_ctx, sec_ctx, len);
909 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
910 }
911
912 if (tb[XFRMA_ETIMER_THRESH]) {
913 sa->replay_maxage = *(uint32_t*)nla_data(tb[XFRMA_ETIMER_THRESH]);
914 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
915 }
916
917 if (tb[XFRMA_REPLAY_THRESH]) {
918 sa->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRMA_REPLAY_THRESH]);
919 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
920 }
921
922 if (tb[XFRMA_REPLAY_ESN_VAL]) {
923 struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
924 len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
925 if ((sa->replay_state_esn = calloc (1, len)) == NULL)
926 {
927 err = -NLE_NOMEM;
928 goto errout;
929 }
930 memcpy ((void *)sa->replay_state_esn, (void *)esn, len);
931 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
932 }
933 else if (tb[XFRMA_REPLAY_VAL])
934 {
935 struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
936 sa->replay_state.oseq = replay_state->oseq;
937 sa->replay_state.seq = replay_state->seq;
938 sa->replay_state.bitmap = replay_state->bitmap;
939 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
940 sa->replay_state_esn = NULL;
941 }
942
943 if (tb[XFRMA_OFFLOAD_DEV]) {
944 struct xfrm_user_offload *offload;
945
946 len = sizeof(struct xfrmnl_user_offload);
947
948 if ((sa->user_offload = calloc(1, len)) == NULL) {
949 err = -NLE_NOMEM;
950 goto errout;
951 }
952
953 offload = nla_data(tb[XFRMA_OFFLOAD_DEV]);
954 sa->user_offload->ifindex = offload->ifindex;
955 sa->user_offload->flags = offload->flags;
956 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
957 }
958
959 *result = sa;
960 return 0;
961
962errout:
963 xfrmnl_sa_put(sa);
964 return err;
965}
966
967static int xfrm_sa_update_cache (struct nl_cache *cache, struct nl_object *obj,
968 change_func_t change_cb, change_func_v2_t change_cb_v2,
969 void *data)
970{
971 struct nl_object* old_sa;
972 struct xfrmnl_sa* sa = (struct xfrmnl_sa*)obj;
973
974 if (nl_object_get_msgtype (obj) == XFRM_MSG_EXPIRE)
975 {
976 /* On hard expiry, the SA gets deleted too from the kernel state without any
977 * further delete event. On Expire message, we are only updating the cache with
978 * the SA object's new state. In absence of the explicit delete event, the cache will
979 * be out of sync with the kernel state. To get around this, expiry messages cache
980 * operations are handled here (installed with NL_ACT_UNSPEC action) instead of
981 * in Libnl Cache module. */
982
983 /* Do we already have this object in the cache? */
984 old_sa = nl_cache_search(cache, obj);
985 if (old_sa)
986 {
987 /* Found corresponding SA object in cache. Delete it */
988 nl_cache_remove (old_sa);
989 }
990
991 /* Handle the expiry event now */
992 if (sa->hard == 0)
993 {
994 /* Soft expiry event: Save the new object to the
995 * cache and notify application of the expiry event. */
996 nl_cache_move (cache, obj);
997
998 if (old_sa == NULL)
999 {
1000 /* Application CB present, no previous instance of SA object present.
1001 * Notify application CB as a NEW event */
1002 if (change_cb_v2)
1003 change_cb_v2(cache, NULL, obj, 0, NL_ACT_NEW, data);
1004 else if (change_cb)
1005 change_cb(cache, obj, NL_ACT_NEW, data);
1006 }
1007 else if (old_sa)
1008 {
1009 uint64_t diff = 0;
1010 if (change_cb || change_cb_v2)
1011 diff = nl_object_diff64(old_sa, obj);
1012
1013 /* Application CB present, a previous instance of SA object present.
1014 * Notify application CB as a CHANGE1 event */
1015 if (diff) {
1016 if (change_cb_v2) {
1017 change_cb_v2(cache, old_sa, obj, diff, NL_ACT_CHANGE, data);
1018 } else if (change_cb)
1019 change_cb(cache, obj, NL_ACT_CHANGE, data);
1020 }
1021 nl_object_put (old_sa);
1022 }
1023 }
1024 else
1025 {
1026 /* Hard expiry event: Delete the object from the
1027 * cache and notify application of the expiry event. */
1028 if (change_cb_v2)
1029 change_cb_v2(cache, obj, NULL, 0, NL_ACT_DEL, data);
1030 else if (change_cb)
1031 change_cb (cache, obj, NL_ACT_DEL, data);
1032 nl_object_put (old_sa);
1033 }
1034
1035 /* Done handling expire message */
1036 return 0;
1037 }
1038 else
1039 {
1040 /* All other messages other than Expire, let the standard Libnl cache
1041 * module handle it. */
1042 if (change_cb_v2)
1043 return nl_cache_include_v2(cache, obj, change_cb_v2, data);
1044 else
1045 return nl_cache_include (cache, obj, change_cb, data);
1046 }
1047}
1048
1049static int xfrm_sa_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
1050 struct nlmsghdr *n, struct nl_parser_param *pp)
1051{
1052 struct xfrmnl_sa* sa;
1053 int err;
1054
1055 if ((err = xfrmnl_sa_parse(n, &sa)) < 0)
1056 return err;
1057
1058 err = pp->pp_cb((struct nl_object *) sa, pp);
1059
1060 xfrmnl_sa_put(sa);
1061 return err;
1062}
1063
1064/**
1065 * @name XFRM SA Get
1066 * @{
1067 */
1068
1069int xfrmnl_sa_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
1070{
1071 struct nl_msg *msg;
1072 struct xfrm_usersa_id sa_id;
1073 struct xfrm_mark mark;
1074
1075 if (!daddr || !spi)
1076 {
1077 fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
1078 __FILE__, __LINE__, __func__);
1079 assert(0);
1080 return -NLE_MISSING_ATTR;
1081 }
1082
1083 memset(&sa_id, 0, sizeof(sa_id));
1084 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
1085 sa_id.family = nl_addr_get_family (daddr);
1086 sa_id.spi = htonl(spi);
1087 sa_id.proto = protocol;
1088
1089 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETSA, 0)))
1090 return -NLE_NOMEM;
1091
1092 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1093 goto nla_put_failure;
1094
1095 if ((mark_m & mark_v) != 0)
1096 {
1097 memset(&mark, 0, sizeof(struct xfrm_mark));
1098 mark.m = mark_m;
1099 mark.v = mark_v;
1100
1101 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
1102 }
1103
1104 *result = msg;
1105 return 0;
1106
1107nla_put_failure:
1108 nlmsg_free(msg);
1109 return -NLE_MSGSIZE;
1110}
1111
1112int xfrmnl_sa_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sa** result)
1113{
1114 struct nl_msg *msg = NULL;
1115 struct nl_object *obj;
1116 int err;
1117
1118 if ((err = xfrmnl_sa_build_get_request(daddr, spi, protocol, mark_m, mark_v, &msg)) < 0)
1119 return err;
1120
1121 err = nl_send_auto(sock, msg);
1122 nlmsg_free(msg);
1123 if (err < 0)
1124 return err;
1125
1126 if ((err = nl_pickup(sock, &xfrm_sa_msg_parser, &obj)) < 0)
1127 return err;
1128
1129 /* We have used xfrm_sa_msg_parser(), object is definitely a xfrm sa */
1130 *result = (struct xfrmnl_sa *) obj;
1131
1132 /* If an object has been returned, we also need to wait for the ACK */
1133 if (err == 0 && obj)
1134 nl_wait_for_ack(sock);
1135
1136 return 0;
1137}
1138
1139/** @} */
1140
1141static int build_xfrm_sa_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1142{
1143 struct nl_msg* msg;
1144 struct xfrm_usersa_info sa_info;
1145 uint32_t len;
1146 struct nl_addr* addr;
1147
1148 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1149 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1150 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1151 return -NLE_MISSING_ATTR;
1152
1153 memset ((void*)&sa_info, 0, sizeof (sa_info));
1154 if (tmpl->ce_mask & XFRM_SA_ATTR_SEL)
1155 {
1156 addr = xfrmnl_sel_get_daddr (tmpl->sel);
1157 memcpy ((void*)&sa_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1158 addr = xfrmnl_sel_get_saddr (tmpl->sel);
1159 memcpy ((void*)&sa_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1160 sa_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1161 sa_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1162 sa_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1163 sa_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1164 sa_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1165 sa_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1166 sa_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1167 sa_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1168 sa_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1169 sa_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1170 }
1171
1172 memcpy (&sa_info.id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1173 sa_info.id.spi = htonl(tmpl->id.spi);
1174 sa_info.id.proto = tmpl->id.proto;
1175
1176 if (tmpl->ce_mask & XFRM_SA_ATTR_SADDR)
1177 memcpy (&sa_info.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
1178
1179 if (tmpl->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1180 {
1181 sa_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
1182 sa_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
1183 sa_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
1184 sa_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
1185 sa_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
1186 sa_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
1187 sa_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
1188 sa_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
1189 }
1190
1191 //Skip current lifetime: cur lifetime can be updated only via AE
1192 //Skip stats: stats cant be updated
1193 //Skip seq: seq cant be updated
1194
1195 if (tmpl->ce_mask & XFRM_SA_ATTR_REQID)
1196 sa_info.reqid = tmpl->reqid;
1197
1198 if (tmpl->ce_mask & XFRM_SA_ATTR_FAMILY)
1199 sa_info.family = tmpl->family;
1200
1201 if (tmpl->ce_mask & XFRM_SA_ATTR_MODE)
1202 sa_info.mode = tmpl->mode;
1203
1204 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1205 sa_info.replay_window = tmpl->replay_window;
1206
1207 if (tmpl->ce_mask & XFRM_SA_ATTR_FLAGS)
1208 sa_info.flags = tmpl->flags;
1209
1210 msg = nlmsg_alloc_simple(cmd, flags);
1211 if (!msg)
1212 return -NLE_NOMEM;
1213
1214 if (nlmsg_append(msg, &sa_info, sizeof(sa_info), NLMSG_ALIGNTO) < 0)
1215 goto nla_put_failure;
1216
1217 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AEAD) {
1218 len = sizeof (struct xfrm_algo_aead) + ((tmpl->aead->alg_key_len + 7) / 8);
1219 NLA_PUT (msg, XFRMA_ALG_AEAD, len, tmpl->aead);
1220 }
1221
1222 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AUTH) {
1223 /* kernel prefers XFRMA_ALG_AUTH_TRUNC over XFRMA_ALG_AUTH, so only
1224 * one of the attributes needs to be present */
1225 if (tmpl->auth->alg_trunc_len) {
1226 len = sizeof (struct xfrm_algo_auth) + ((tmpl->auth->alg_key_len + 7) / 8);
1227 NLA_PUT (msg, XFRMA_ALG_AUTH_TRUNC, len, tmpl->auth);
1228 } else {
1229 struct xfrm_algo *auth;
1230
1231 len = sizeof (struct xfrm_algo) + ((tmpl->auth->alg_key_len + 7) / 8);
1232 auth = malloc(len);
1233 if (!auth) {
1234 nlmsg_free(msg);
1235 return -NLE_NOMEM;
1236 }
1237
1238 _nl_strncpy_assert(auth->alg_name, tmpl->auth->alg_name, sizeof(auth->alg_name));
1239 auth->alg_key_len = tmpl->auth->alg_key_len;
1240 memcpy(auth->alg_key, tmpl->auth->alg_key, (tmpl->auth->alg_key_len + 7) / 8);
1241 if (nla_put(msg, XFRMA_ALG_AUTH, len, auth) < 0) {
1242 free(auth);
1243 goto nla_put_failure;
1244 }
1245 free(auth);
1246 }
1247 }
1248
1249 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_CRYPT) {
1250 len = sizeof (struct xfrm_algo) + ((tmpl->crypt->alg_key_len + 7) / 8);
1251 NLA_PUT (msg, XFRMA_ALG_CRYPT, len, tmpl->crypt);
1252 }
1253
1254 if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_COMP) {
1255 len = sizeof (struct xfrm_algo) + ((tmpl->comp->alg_key_len + 7) / 8);
1256 NLA_PUT (msg, XFRMA_ALG_COMP, len, tmpl->comp);
1257 }
1258
1259 if (tmpl->ce_mask & XFRM_SA_ATTR_ENCAP) {
1260 struct xfrm_encap_tmpl* encap_tmpl;
1261 struct nlattr* encap_attr;
1262
1263 len = sizeof (struct xfrm_encap_tmpl);
1264 encap_attr = nla_reserve(msg, XFRMA_ENCAP, len);
1265 if (!encap_attr)
1266 goto nla_put_failure;
1267 encap_tmpl = nla_data (encap_attr);
1268 encap_tmpl->encap_type = tmpl->encap->encap_type;
1269 encap_tmpl->encap_sport = htons (tmpl->encap->encap_sport);
1270 encap_tmpl->encap_dport = htons (tmpl->encap->encap_dport);
1271 memcpy (&encap_tmpl->encap_oa, nl_addr_get_binary_addr (tmpl->encap->encap_oa), sizeof (uint8_t) * nl_addr_get_len (tmpl->encap->encap_oa));
1272 }
1273
1274 if (tmpl->ce_mask & XFRM_SA_ATTR_TFCPAD) {
1275 NLA_PUT_U32 (msg, XFRMA_TFCPAD, tmpl->tfcpad);
1276 }
1277
1278 if (tmpl->ce_mask & XFRM_SA_ATTR_COADDR) {
1279 NLA_PUT (msg, XFRMA_COADDR, sizeof (xfrm_address_t), tmpl->coaddr);
1280 }
1281
1282 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1283 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1284 }
1285
1286 if (tmpl->ce_mask & XFRM_SA_ATTR_SECCTX) {
1287 len = sizeof (struct xfrm_sec_ctx) + tmpl->sec_ctx->ctx_len;
1288 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1289 }
1290
1291 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE) {
1292 NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
1293 }
1294
1295 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF) {
1296 NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
1297 }
1298
1299 if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_STATE) {
1300 if (tmpl->replay_state_esn) {
1301 len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
1302 NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
1303 }
1304 else {
1305 NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrm_replay_state), &tmpl->replay_state);
1306 }
1307 }
1308
1309 if (tmpl->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV) {
1310 struct xfrm_user_offload *offload;
1311 struct nlattr *attr;
1312
1313 len = sizeof(struct xfrm_user_offload);
1314 attr = nla_reserve(msg, XFRMA_OFFLOAD_DEV, len);
1315
1316 if (!attr)
1317 goto nla_put_failure;
1318
1319 offload = nla_data(attr);
1320 offload->ifindex = tmpl->user_offload->ifindex;
1321 offload->flags = tmpl->user_offload->flags;
1322 }
1323
1324 *result = msg;
1325 return 0;
1326
1327nla_put_failure:
1328 nlmsg_free(msg);
1329 return -NLE_MSGSIZE;
1330}
1331
1332/**
1333 * @name XFRM SA Add
1334 * @{
1335 */
1336
1337int xfrmnl_sa_build_add_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1338{
1339 return build_xfrm_sa_message (tmpl, XFRM_MSG_NEWSA, flags, result);
1340}
1341
1342int xfrmnl_sa_add(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1343{
1344 int err;
1345 struct nl_msg *msg;
1346
1347 if ((err = xfrmnl_sa_build_add_request(tmpl, flags, &msg)) < 0)
1348 return err;
1349
1350 err = nl_send_auto_complete(sk, msg);
1351 nlmsg_free(msg);
1352 if (err < 0)
1353 return err;
1354
1355 return nl_wait_for_ack(sk);
1356}
1357
1358/**
1359 * @name XFRM SA Update
1360 * @{
1361 */
1362
1363int xfrmnl_sa_build_update_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1364{
1365 return build_xfrm_sa_message (tmpl, XFRM_MSG_UPDSA, flags, result);
1366}
1367
1368int xfrmnl_sa_update(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1369{
1370 int err;
1371 struct nl_msg *msg;
1372
1373 if ((err = xfrmnl_sa_build_update_request(tmpl, flags, &msg)) < 0)
1374 return err;
1375
1376 err = nl_send_auto_complete(sk, msg);
1377 nlmsg_free(msg);
1378 if (err < 0)
1379 return err;
1380
1381 return nl_wait_for_ack(sk);
1382}
1383
1384/** @} */
1385
1386static int build_xfrm_sa_delete_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1387{
1388 struct nl_msg* msg;
1389 struct xfrm_usersa_id sa_id;
1390
1391 if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1392 !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1393 !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1394 return -NLE_MISSING_ATTR;
1395
1396 memset(&sa_id, 0, sizeof(struct xfrm_usersa_id));
1397 memcpy (&sa_id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr),
1398 sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1399 sa_id.family = nl_addr_get_family (tmpl->id.daddr);
1400 sa_id.spi = htonl(tmpl->id.spi);
1401 sa_id.proto = tmpl->id.proto;
1402
1403 msg = nlmsg_alloc_simple(cmd, flags);
1404 if (!msg)
1405 return -NLE_NOMEM;
1406
1407 if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1408 goto nla_put_failure;
1409
1410 if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1411 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1412 }
1413
1414 *result = msg;
1415 return 0;
1416
1417nla_put_failure:
1418 nlmsg_free(msg);
1419 return -NLE_MSGSIZE;
1420}
1421
1422/**
1423 * @name XFRM SA Delete
1424 * @{
1425 */
1426
1427int xfrmnl_sa_build_delete_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1428{
1429 return build_xfrm_sa_delete_message (tmpl, XFRM_MSG_DELSA, flags, result);
1430}
1431
1432int xfrmnl_sa_delete(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1433{
1434 int err;
1435 struct nl_msg *msg;
1436
1437 if ((err = xfrmnl_sa_build_delete_request(tmpl, flags, &msg)) < 0)
1438 return err;
1439
1440 err = nl_send_auto_complete(sk, msg);
1441 nlmsg_free(msg);
1442 if (err < 0)
1443 return err;
1444
1445 return nl_wait_for_ack(sk);
1446}
1447
1448/** @} */
1449
1450
1451/**
1452 * @name Attributes
1453 * @{
1454 */
1455
1456struct xfrmnl_sel* xfrmnl_sa_get_sel (struct xfrmnl_sa* sa)
1457{
1458 if (sa->ce_mask & XFRM_SA_ATTR_SEL)
1459 return sa->sel;
1460 else
1461 return NULL;
1462}
1463
1464int xfrmnl_sa_set_sel (struct xfrmnl_sa* sa, struct xfrmnl_sel* sel)
1465{
1466 /* Release any previously held selector object from the SA */
1467 if (sa->sel)
1468 xfrmnl_sel_put (sa->sel);
1469
1470 /* Increment ref count on new selector and save it in the SA */
1471 xfrmnl_sel_get (sel);
1472 sa->sel = sel;
1473 sa->ce_mask |= XFRM_SA_ATTR_SEL;
1474
1475 return 0;
1476}
1477
1478static inline int __assign_addr(struct xfrmnl_sa* sa, struct nl_addr **pos,
1479 struct nl_addr *new, int flag, int nocheck)
1480{
1481 if (!nocheck)
1482 {
1483 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1484 {
1485 if (nl_addr_get_family (new) != sa->family)
1486 return -NLE_AF_MISMATCH;
1487 }
1488 }
1489
1490 if (*pos)
1491 nl_addr_put(*pos);
1492
1493 nl_addr_get(new);
1494 *pos = new;
1495
1496 sa->ce_mask |= flag;
1497
1498 return 0;
1499}
1500
1501
1502struct nl_addr* xfrmnl_sa_get_daddr (struct xfrmnl_sa* sa)
1503{
1504 if (sa->ce_mask & XFRM_SA_ATTR_DADDR)
1505 return sa->id.daddr;
1506 else
1507 return NULL;
1508}
1509
1510int xfrmnl_sa_set_daddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1511{
1512 return __assign_addr(sa, &sa->id.daddr, addr, XFRM_SA_ATTR_DADDR, 0);
1513}
1514
1515int xfrmnl_sa_get_spi (struct xfrmnl_sa* sa)
1516{
1517 if (sa->ce_mask & XFRM_SA_ATTR_SPI)
1518 return sa->id.spi;
1519 else
1520 return -1;
1521}
1522
1523int xfrmnl_sa_set_spi (struct xfrmnl_sa* sa, unsigned int spi)
1524{
1525 sa->id.spi = spi;
1526 sa->ce_mask |= XFRM_SA_ATTR_SPI;
1527
1528 return 0;
1529}
1530
1531int xfrmnl_sa_get_proto (struct xfrmnl_sa* sa)
1532{
1533 if (sa->ce_mask & XFRM_SA_ATTR_PROTO)
1534 return sa->id.proto;
1535 else
1536 return -1;
1537}
1538
1539int xfrmnl_sa_set_proto (struct xfrmnl_sa* sa, unsigned int protocol)
1540{
1541 sa->id.proto = protocol;
1542 sa->ce_mask |= XFRM_SA_ATTR_PROTO;
1543
1544 return 0;
1545}
1546
1547struct nl_addr* xfrmnl_sa_get_saddr (struct xfrmnl_sa* sa)
1548{
1549 if (sa->ce_mask & XFRM_SA_ATTR_SADDR)
1550 return sa->saddr;
1551 else
1552 return NULL;
1553}
1554
1555int xfrmnl_sa_set_saddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1556{
1557 return __assign_addr(sa, &sa->saddr, addr, XFRM_SA_ATTR_SADDR, 1);
1558}
1559
1560struct xfrmnl_ltime_cfg* xfrmnl_sa_get_lifetime_cfg (struct xfrmnl_sa* sa)
1561{
1562 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1563 return sa->lft;
1564 else
1565 return NULL;
1566}
1567
1568int xfrmnl_sa_set_lifetime_cfg (struct xfrmnl_sa* sa, struct xfrmnl_ltime_cfg* ltime)
1569{
1570 /* Release any previously held lifetime cfg object from the SA */
1571 if (sa->lft)
1572 xfrmnl_ltime_cfg_put (sa->lft);
1573
1574 /* Increment ref count on new lifetime object and save it in the SA */
1575 xfrmnl_ltime_cfg_get (ltime);
1576 sa->lft = ltime;
1577 sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
1578
1579 return 0;
1580}
1581
1582int xfrmnl_sa_get_curlifetime (struct xfrmnl_sa* sa, unsigned long long int* curr_bytes,
1583 unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1584{
1585 if (sa == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1586 return -1;
1587
1588 if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CUR)
1589 {
1590 *curr_bytes = sa->curlft.bytes;
1591 *curr_packets = sa->curlft.packets;
1592 *curr_add_time = sa->curlft.add_time;
1593 *curr_use_time = sa->curlft.use_time;
1594 }
1595 else
1596 return -1;
1597
1598 return 0;
1599}
1600
1601int xfrmnl_sa_get_stats (struct xfrmnl_sa* sa, unsigned long long int* replay_window,
1602 unsigned long long int* replay, unsigned long long int* integrity_failed)
1603{
1604 if (sa == NULL || replay_window == NULL || replay == NULL || integrity_failed == NULL)
1605 return -1;
1606
1607 if (sa->ce_mask & XFRM_SA_ATTR_STATS)
1608 {
1609 *replay_window = sa->stats.replay_window;
1610 *replay = sa->stats.replay;
1611 *integrity_failed = sa->stats.integrity_failed;
1612 }
1613 else
1614 return -1;
1615
1616 return 0;
1617}
1618
1619int xfrmnl_sa_get_seq (struct xfrmnl_sa* sa)
1620{
1621 if (sa->ce_mask & XFRM_SA_ATTR_SEQ)
1622 return sa->seq;
1623 else
1624 return -1;
1625}
1626
1627int xfrmnl_sa_get_reqid (struct xfrmnl_sa* sa)
1628{
1629 if (sa->ce_mask & XFRM_SA_ATTR_REQID)
1630 return sa->reqid;
1631 else
1632 return -1;
1633}
1634
1635int xfrmnl_sa_set_reqid (struct xfrmnl_sa* sa, unsigned int reqid)
1636{
1637 sa->reqid = reqid;
1638 sa->ce_mask |= XFRM_SA_ATTR_REQID;
1639
1640 return 0;
1641}
1642
1643int xfrmnl_sa_get_family (struct xfrmnl_sa* sa)
1644{
1645 if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1646 return sa->family;
1647 else
1648 return -1;
1649}
1650
1651int xfrmnl_sa_set_family (struct xfrmnl_sa* sa, unsigned int family)
1652{
1653 sa->family = family;
1654 sa->ce_mask |= XFRM_SA_ATTR_FAMILY;
1655
1656 return 0;
1657}
1658
1659int xfrmnl_sa_get_mode (struct xfrmnl_sa* sa)
1660{
1661 if (sa->ce_mask & XFRM_SA_ATTR_MODE)
1662 return sa->mode;
1663 else
1664 return -1;
1665}
1666
1667int xfrmnl_sa_set_mode (struct xfrmnl_sa* sa, unsigned int mode)
1668{
1669 sa->mode = mode;
1670 sa->ce_mask |= XFRM_SA_ATTR_MODE;
1671
1672 return 0;
1673}
1674
1675int xfrmnl_sa_get_replay_window (struct xfrmnl_sa* sa)
1676{
1677 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1678 return sa->replay_window;
1679 else
1680 return -1;
1681}
1682
1683int xfrmnl_sa_set_replay_window (struct xfrmnl_sa* sa, unsigned int replay_window)
1684{
1685 sa->replay_window = replay_window;
1686 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_WIN;
1687
1688 return 0;
1689}
1690
1691int xfrmnl_sa_get_flags (struct xfrmnl_sa* sa)
1692{
1693 if (sa->ce_mask & XFRM_SA_ATTR_FLAGS)
1694 return sa->flags;
1695 else
1696 return -1;
1697}
1698
1699int xfrmnl_sa_set_flags (struct xfrmnl_sa* sa, unsigned int flags)
1700{
1701 sa->flags = flags;
1702 sa->ce_mask |= XFRM_SA_ATTR_FLAGS;
1703
1704 return 0;
1705}
1706
1707/**
1708 * Get the aead-params
1709 * @arg sa the xfrmnl_sa object
1710 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1711 * @arg key_len an optional output value for the key length in bits.
1712 * @arg icv_len an optional output value for the alt-icv-len.
1713 * @arg key an optional buffer large enough for the key. It must contain at least
1714 * ((@key_len + 7) / 8) bytes.
1715 *
1716 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1717 * call xfrmnl_sa_get_aead_params() without @key argument to query only the required buffer size.
1718 * This modified API is available in all versions of libnl3 that support the capability
1719 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1720 *
1721 * @return 0 on success or a negative error code.
1722 */
1723int xfrmnl_sa_get_aead_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* icv_len, char* key)
1724{
1725 if (sa->ce_mask & XFRM_SA_ATTR_ALG_AEAD)
1726 {
1727 if (alg_name)
1728 strcpy (alg_name, sa->aead->alg_name);
1729 if (key_len)
1730 *key_len = sa->aead->alg_key_len;
1731 if (icv_len)
1732 *icv_len = sa->aead->alg_icv_len;
1733 if (key)
1734 memcpy (key, sa->aead->alg_key, ((sa->aead->alg_key_len + 7)/8));
1735 }
1736 else
1737 return -1;
1738
1739 return 0;
1740}
1741
1742int xfrmnl_sa_set_aead_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int icv_len, const char* key)
1743{
1744 _nl_auto_free struct xfrmnl_algo_aead *b = NULL;
1745 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1746 uint32_t newlen = sizeof (struct xfrmnl_algo_aead) + keysize;
1747
1748 /* Free up the old key and allocate memory to hold new key */
1749 if (strlen (alg_name) >= sizeof (sa->aead->alg_name))
1750 return -1;
1751 if (!(b = calloc (1, newlen)))
1752 return -1;
1753
1754 strcpy (b->alg_name, alg_name);
1755 b->alg_key_len = key_len;
1756 b->alg_icv_len = icv_len;
1757 memcpy (b->alg_key, key, keysize);
1758
1759 free (sa->aead);
1760 sa->aead = _nl_steal_pointer (&b);
1761 sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
1762 return 0;
1763}
1764
1765/**
1766 * Get the auth-params
1767 * @arg sa the xfrmnl_sa object
1768 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1769 * @arg key_len an optional output value for the key length in bits.
1770 * @arg trunc_len an optional output value for the alg-trunc-len.
1771 * @arg key an optional buffer large enough for the key. It must contain at least
1772 * ((@key_len + 7) / 8) bytes.
1773 *
1774 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1775 * call xfrmnl_sa_get_auth_params() without @key argument to query only the required buffer size.
1776 * This modified API is available in all versions of libnl3 that support the capability
1777 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1778 *
1779 * @return 0 on success or a negative error code.
1780 */
1781int xfrmnl_sa_get_auth_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* trunc_len, char* key)
1782{
1783 if (sa->ce_mask & XFRM_SA_ATTR_ALG_AUTH)
1784 {
1785 if (alg_name)
1786 strcpy (alg_name, sa->auth->alg_name);
1787 if (key_len)
1788 *key_len = sa->auth->alg_key_len;
1789 if (trunc_len)
1790 *trunc_len = sa->auth->alg_trunc_len;
1791 if (key)
1792 memcpy (key, sa->auth->alg_key, (sa->auth->alg_key_len + 7)/8);
1793 }
1794 else
1795 return -1;
1796
1797 return 0;
1798}
1799
1800int xfrmnl_sa_set_auth_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int trunc_len, const char* key)
1801{
1802 _nl_auto_free struct xfrmnl_algo_auth *b = NULL;
1803 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1804 uint32_t newlen = sizeof (struct xfrmnl_algo_auth) + keysize;
1805
1806 if (strlen (alg_name) >= sizeof (sa->auth->alg_name))
1807 return -1;
1808 if (!(b = calloc (1, newlen)))
1809 return -1;
1810
1811 strcpy (b->alg_name, alg_name);
1812 b->alg_key_len = key_len;
1813 b->alg_trunc_len = trunc_len;
1814 memcpy (b->alg_key, key, keysize);
1815
1816 free (sa->auth);
1817 sa->auth = _nl_steal_pointer (&b);
1818 sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
1819 return 0;
1820}
1821
1822/**
1823 * Get the crypto-params
1824 * @arg sa the xfrmnl_sa object
1825 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1826 * @arg key_len an optional output value for the key length in bits.
1827 * @arg key an optional buffer large enough for the key. It must contain at least
1828 * ((@key_len + 7) / 8) bytes.
1829 *
1830 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1831 * call xfrmnl_sa_get_crypto_params() without @key argument to query only the required buffer size.
1832 * This modified API is available in all versions of libnl3 that support the capability
1833 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1834 *
1835 * @return 0 on success or a negative error code.
1836 */
1837int xfrmnl_sa_get_crypto_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1838{
1839 if (sa->ce_mask & XFRM_SA_ATTR_ALG_CRYPT)
1840 {
1841 if (alg_name)
1842 strcpy (alg_name, sa->crypt->alg_name);
1843 if (key_len)
1844 *key_len = sa->crypt->alg_key_len;
1845 if (key)
1846 memcpy (key, sa->crypt->alg_key, ((sa->crypt->alg_key_len + 7)/8));
1847 }
1848 else
1849 return -1;
1850
1851 return 0;
1852}
1853
1854int xfrmnl_sa_set_crypto_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1855{
1856 _nl_auto_free struct xfrmnl_algo *b = NULL;
1857 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1858 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1859
1860 if (strlen (alg_name) >= sizeof (sa->crypt->alg_name))
1861 return -1;
1862 if (!(b = calloc (1, newlen)))
1863 return -1;
1864
1865 strcpy (b->alg_name, alg_name);
1866 b->alg_key_len = key_len;
1867 memcpy (b->alg_key, key, keysize);
1868
1869 free(sa->crypt);
1870 sa->crypt = _nl_steal_pointer(&b);
1871 sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
1872 return 0;
1873}
1874
1875/**
1876 * Get the comp-params
1877 * @arg sa the xfrmnl_sa object
1878 * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1879 * @arg key_len an optional output value for the key length in bits.
1880 * @arg key an optional buffer large enough for the key. It must contain at least
1881 * ((@key_len + 7) / 8) bytes.
1882 *
1883 * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1884 * call xfrmnl_sa_get_comp_params() without @key argument to query only the required buffer size.
1885 * This modified API is available in all versions of libnl3 that support the capability
1886 * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1887 *
1888 * @return 0 on success or a negative error code.
1889 */
1890int xfrmnl_sa_get_comp_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1891{
1892 if (sa->ce_mask & XFRM_SA_ATTR_ALG_COMP)
1893 {
1894 if (alg_name)
1895 strcpy (alg_name, sa->comp->alg_name);
1896 if (key_len)
1897 *key_len = sa->comp->alg_key_len;
1898 if (key)
1899 memcpy (key, sa->comp->alg_key, ((sa->comp->alg_key_len + 7)/8));
1900 }
1901 else
1902 return -1;
1903
1904 return 0;
1905}
1906
1907int xfrmnl_sa_set_comp_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1908{
1909 _nl_auto_free struct xfrmnl_algo *b = NULL;
1910 size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1911 uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1912
1913 if (strlen (alg_name) >= sizeof (sa->comp->alg_name))
1914 return -1;
1915 if (!(b = calloc (1, newlen)))
1916 return -1;
1917
1918 strcpy (b->alg_name, alg_name);
1919 b->alg_key_len = key_len;
1920 memcpy (b->alg_key, key, keysize);
1921
1922 free(sa->comp);
1923 sa->comp = _nl_steal_pointer(&b);
1924 sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
1925 return 0;
1926}
1927
1928int xfrmnl_sa_get_encap_tmpl (struct xfrmnl_sa* sa, unsigned int* encap_type, unsigned int* encap_sport, unsigned int* encap_dport, struct nl_addr** encap_oa)
1929{
1930 if (sa->ce_mask & XFRM_SA_ATTR_ENCAP)
1931 {
1932 *encap_type = sa->encap->encap_type;
1933 *encap_sport = sa->encap->encap_sport;
1934 *encap_dport = sa->encap->encap_dport;
1935 *encap_oa = nl_addr_clone (sa->encap->encap_oa);
1936 }
1937 else
1938 return -1;
1939
1940 return 0;
1941}
1942
1943int xfrmnl_sa_set_encap_tmpl (struct xfrmnl_sa* sa, unsigned int encap_type, unsigned int encap_sport, unsigned int encap_dport, struct nl_addr* encap_oa)
1944{
1945 if (sa->encap) {
1946 /* Free up the old encap OA */
1947 if (sa->encap->encap_oa)
1948 nl_addr_put(sa->encap->encap_oa);
1949 memset(sa->encap, 0, sizeof (*sa->encap));
1950 } else if ((sa->encap = calloc(1, sizeof(*sa->encap))) == NULL)
1951 return -1;
1952
1953 /* Save the new info */
1954 sa->encap->encap_type = encap_type;
1955 sa->encap->encap_sport = encap_sport;
1956 sa->encap->encap_dport = encap_dport;
1957 nl_addr_get (encap_oa);
1958 sa->encap->encap_oa = encap_oa;
1959
1960 sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
1961
1962 return 0;
1963}
1964
1965int xfrmnl_sa_get_tfcpad (struct xfrmnl_sa* sa)
1966{
1967 if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
1968 return sa->tfcpad;
1969 else
1970 return -1;
1971}
1972
1973int xfrmnl_sa_set_tfcpad (struct xfrmnl_sa* sa, unsigned int tfcpad)
1974{
1975 sa->tfcpad = tfcpad;
1976 sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
1977
1978 return 0;
1979}
1980
1981struct nl_addr* xfrmnl_sa_get_coaddr (struct xfrmnl_sa* sa)
1982{
1983 if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
1984 return sa->coaddr;
1985 else
1986 return NULL;
1987}
1988
1989int xfrmnl_sa_set_coaddr (struct xfrmnl_sa* sa, struct nl_addr* coaddr)
1990{
1991 /* Free up the old coaddr */
1992 if (sa->coaddr)
1993 nl_addr_put (sa->coaddr);
1994
1995 /* Save the new info */
1996 nl_addr_get (coaddr);
1997 sa->coaddr = coaddr;
1998
1999 sa->ce_mask |= XFRM_SA_ATTR_COADDR;
2000
2001 return 0;
2002}
2003
2004int xfrmnl_sa_get_mark (struct xfrmnl_sa* sa, unsigned int* mark_mask, unsigned int* mark_value)
2005{
2006 if (mark_mask == NULL || mark_value == NULL)
2007 return -1;
2008
2009 if (sa->ce_mask & XFRM_SA_ATTR_MARK)
2010 {
2011 *mark_mask = sa->mark.m;
2012 *mark_value = sa->mark.v;
2013
2014 return 0;
2015 }
2016 else
2017 return -1;
2018}
2019
2020int xfrmnl_sa_set_mark (struct xfrmnl_sa* sa, unsigned int value, unsigned int mask)
2021{
2022 sa->mark.v = value;
2023 sa->mark.m = mask;
2024 sa->ce_mask |= XFRM_SA_ATTR_MARK;
2025
2026 return 0;
2027}
2028
2029/**
2030 * Get the security context.
2031 *
2032 * @arg sa The xfrmnl_sa object.
2033 * @arg doi An optional output value for the security context domain of interpretation.
2034 * @arg alg An optional output value for the security context algorithm.
2035 * @arg len An optional output value for the security context length, including the
2036 * terminating null byte ('\0').
2037 * @arg sid Unused parameter.
2038 * @arg ctx_str An optional buffer large enough for the security context string. It must
2039 * contain at least @len bytes.
2040 *
2041 * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
2042 * call xfrmnl_sa_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
2043 * This modified API is available in all versions of libnl3 that support the capability
2044 * @def NL_CAPABILITY_XFRM_SEC_CTX_LEN (@see nl_has_capability for further information).
2045 *
2046 * @return 0 on success or a negative error code.
2047 */
2048int xfrmnl_sa_get_sec_ctx (struct xfrmnl_sa* sa, unsigned int* doi, unsigned int* alg,
2049 unsigned int* len, unsigned int* sid, char* ctx_str)
2050{
2051 if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
2052 {
2053 if (doi)
2054 *doi = sa->sec_ctx->ctx_doi;
2055 if (alg)
2056 *alg = sa->sec_ctx->ctx_alg;
2057 if (len)
2058 *len = sa->sec_ctx->ctx_len;
2059 if (ctx_str)
2060 memcpy (ctx_str, sa->sec_ctx->ctx, sa->sec_ctx->ctx_len);
2061 }
2062 else
2063 return -1;
2064
2065 return 0;
2066}
2067
2068/**
2069 * Set the security context.
2070 *
2071 * @arg sa The xfrmnl_sa object.
2072 * @arg doi Parameter for the security context domain of interpretation.
2073 * @arg alg Parameter for the security context algorithm.
2074 * @arg len Parameter for the length of the security context string containing
2075 * the terminating null byte ('\0').
2076 * @arg sid Unused parameter.
2077 * @arg ctx_str Buffer containing the security context string.
2078 *
2079 * @return 0 on success or a negative error code.
2080 */
2081int xfrmnl_sa_set_sec_ctx (struct xfrmnl_sa* sa, unsigned int doi, unsigned int alg, unsigned int len,
2082 unsigned int sid, const char* ctx_str)
2083{
2084 _nl_auto_free struct xfrmnl_user_sec_ctx *b = NULL;
2085
2086 if (!(b = calloc(1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + len)))
2087 return -1;
2088
2089 b->len = sizeof(struct xfrmnl_user_sec_ctx) + len;
2090 b->exttype = XFRMA_SEC_CTX;
2091 b->ctx_alg = alg;
2092 b->ctx_doi = doi;
2093 b->ctx_len = len;
2094 memcpy (b->ctx, ctx_str, len);
2095 b->ctx[len] = '\0';
2096
2097 free(sa->sec_ctx);
2098 sa->sec_ctx = _nl_steal_pointer(&b);
2099 sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
2100 return 0;
2101}
2102
2103
2104int xfrmnl_sa_get_replay_maxage (struct xfrmnl_sa* sa)
2105{
2106 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE)
2107 return sa->replay_maxage;
2108 else
2109 return -1;
2110}
2111
2112int xfrmnl_sa_set_replay_maxage (struct xfrmnl_sa* sa, unsigned int replay_maxage)
2113{
2114 sa->replay_maxage = replay_maxage;
2115 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
2116
2117 return 0;
2118}
2119
2120int xfrmnl_sa_get_replay_maxdiff (struct xfrmnl_sa* sa)
2121{
2122 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF)
2123 return sa->replay_maxdiff;
2124 else
2125 return -1;
2126}
2127
2128int xfrmnl_sa_set_replay_maxdiff (struct xfrmnl_sa* sa, unsigned int replay_maxdiff)
2129{
2130 sa->replay_maxdiff = replay_maxdiff;
2131 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
2132
2133 return 0;
2134}
2135
2136int xfrmnl_sa_get_replay_state (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
2137{
2138 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2139 {
2140 if (sa->replay_state_esn == NULL)
2141 {
2142 *oseq = sa->replay_state.oseq;
2143 *seq = sa->replay_state.seq;
2144 *bmp = sa->replay_state.bitmap;
2145
2146 return 0;
2147 }
2148 else
2149 {
2150 return -1;
2151 }
2152 }
2153 else
2154 return -1;
2155}
2156
2157int xfrmnl_sa_set_replay_state (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq, unsigned int bitmap)
2158{
2159 sa->replay_state.oseq = oseq;
2160 sa->replay_state.seq = seq;
2161 sa->replay_state.bitmap = bitmap;
2162 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2163
2164 return 0;
2165}
2166
2167int xfrmnl_sa_get_replay_state_esn (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
2168 unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
2169{
2170 if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2171 {
2172 if (sa->replay_state_esn)
2173 {
2174 *oseq = sa->replay_state_esn->oseq;
2175 *seq = sa->replay_state_esn->seq;
2176 *oseq_hi= sa->replay_state_esn->oseq_hi;
2177 *seq_hi = sa->replay_state_esn->seq_hi;
2178 *replay_window = sa->replay_state_esn->replay_window;
2179 *bmp_len = sa->replay_state_esn->bmp_len; // In number of 32 bit words
2180 memcpy (bmp, sa->replay_state_esn->bmp, sa->replay_state_esn->bmp_len * sizeof (uint32_t));
2181
2182 return 0;
2183 }
2184 else
2185 {
2186 return -1;
2187 }
2188 }
2189 else
2190 return -1;
2191}
2192
2193int xfrmnl_sa_set_replay_state_esn (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq,
2194 unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
2195 unsigned int bmp_len, unsigned int* bmp)
2196{
2197 _nl_auto_free struct xfrmnl_replay_state_esn *b = NULL;
2198
2199 if (!(b = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * bmp_len))))
2200 return -1;
2201
2202 b->oseq = oseq;
2203 b->seq = seq;
2204 b->oseq_hi = oseq_hi;
2205 b->seq_hi = seq_hi;
2206 b->replay_window = replay_window;
2207 b->bmp_len = bmp_len; // In number of 32 bit words
2208 memcpy (b->bmp, bmp, bmp_len * sizeof (uint32_t));
2209
2210 free(sa->replay_state_esn);
2211 sa->replay_state_esn = _nl_steal_pointer(&b);
2212 sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2213 return 0;
2214}
2215
2216
2217/**
2218 * Get interface id and flags from xfrm_user_offload.
2219 *
2220 * @arg sa The xfrmnl_sa object.
2221 * @arg ifindex An optional output value for the offload interface index.
2222 * @arg flags An optional output value for the offload flags.
2223 *
2224 * @return 0 on success or a negative error code.
2225 */
2226int xfrmnl_sa_get_user_offload(struct xfrmnl_sa *sa, int *ifindex, uint8_t *flags)
2227{
2228 int ret = -1;
2229
2230 if (sa->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV && sa->user_offload) {
2231 if (ifindex)
2232 *ifindex = sa->user_offload->ifindex;
2233 if (flags)
2234 *flags = sa->user_offload->flags;
2235 ret = 0;
2236 }
2237
2238 return ret;
2239}
2240
2241
2242/**
2243 * Set interface id and flags for xfrm_user_offload.
2244 *
2245 * @arg sa The xfrmnl_sa object.
2246 * @arg ifindex Id of the offload interface.
2247 * @arg flags Offload flags for the state.
2248 *
2249 * @return 0 on success or a negative error code.
2250 */
2251int xfrmnl_sa_set_user_offload(struct xfrmnl_sa *sa, int ifindex, uint8_t flags)
2252{
2253 _nl_auto_free struct xfrmnl_user_offload *b = NULL;
2254
2255 if (!(b = calloc(1, sizeof(*b))))
2256 return -1;
2257
2258 b->ifindex = ifindex;
2259 b->flags = flags;
2260
2261 free(sa->user_offload);
2262 sa->user_offload = _nl_steal_pointer(&b);
2263 sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
2264
2265 return 0;
2266}
2267
2268int xfrmnl_sa_is_hardexpiry_reached (struct xfrmnl_sa* sa)
2269{
2270 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2271 return (sa->hard > 0 ? 1: 0);
2272 else
2273 return 0;
2274}
2275
2276int xfrmnl_sa_is_expiry_reached (struct xfrmnl_sa* sa)
2277{
2278 if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2279 return 1;
2280 else
2281 return 0;
2282}
2283
2284/** @} */
2285
2286static struct nl_object_ops xfrm_sa_obj_ops = {
2287 .oo_name = "xfrm/sa",
2288 .oo_size = sizeof(struct xfrmnl_sa),
2289 .oo_constructor = xfrm_sa_alloc_data,
2290 .oo_free_data = xfrm_sa_free_data,
2291 .oo_clone = xfrm_sa_clone,
2292 .oo_dump = {
2293 [NL_DUMP_LINE] = xfrm_sa_dump_line,
2294 [NL_DUMP_DETAILS] = xfrm_sa_dump_details,
2295 [NL_DUMP_STATS] = xfrm_sa_dump_stats,
2296 },
2297 .oo_compare = xfrm_sa_compare,
2298 .oo_attrs2str = xfrm_sa_attrs2str,
2299 .oo_id_attrs = (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO),
2300};
2301
2302static struct nl_af_group xfrm_sa_groups[] = {
2303 { AF_UNSPEC, XFRMNLGRP_SA },
2304 { AF_UNSPEC, XFRMNLGRP_EXPIRE },
2305 { END_OF_GROUP_LIST },
2306};
2307
2308static struct nl_cache_ops xfrmnl_sa_ops = {
2309 .co_name = "xfrm/sa",
2310 .co_hdrsize = sizeof(struct xfrm_usersa_info),
2311 .co_msgtypes = {
2312 { XFRM_MSG_NEWSA, NL_ACT_NEW, "new" },
2313 { XFRM_MSG_DELSA, NL_ACT_DEL, "del" },
2314 { XFRM_MSG_GETSA, NL_ACT_GET, "get" },
2315 { XFRM_MSG_EXPIRE, NL_ACT_UNSPEC, "expire"},
2316 { XFRM_MSG_UPDSA, NL_ACT_NEW, "update"},
2317 END_OF_MSGTYPES_LIST,
2318 },
2319 .co_protocol = NETLINK_XFRM,
2320 .co_groups = xfrm_sa_groups,
2321 .co_request_update = xfrm_sa_request_update,
2322 .co_msg_parser = xfrm_sa_msg_parser,
2323 .co_obj_ops = &xfrm_sa_obj_ops,
2324 .co_include_event = &xfrm_sa_update_cache
2325};
2326
2327/**
2328 * @name XFRM SA Cache Managament
2329 * @{
2330 */
2331
2332static void __attribute__ ((constructor)) xfrm_sa_init(void)
2333{
2334 nl_cache_mngt_register(&xfrmnl_sa_ops);
2335}
2336
2337static void __attribute__ ((destructor)) xfrm_sa_exit(void)
2338{
2339 nl_cache_mngt_unregister(&xfrmnl_sa_ops);
2340}
2341
2342/** @} */
xfrmnl_sel_cmp
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:162
xfrmnl_ltime_cfg_alloc
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:76
xfrmnl_ltime_cfg_cmp
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:156
xfrmnl_ltime_cfg_clone
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:95
xfrmnl_sel_alloc
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:78
xfrmnl_sel_clone
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:97
nl_addr_set_prefixlen
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:964
nl_addr_get
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:522
nl_addr_build
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:211
nl_addr_get_binary_addr
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:940
nl_addr_cmp
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:584
nl_addr_clone
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:492
nl_addr_get_family
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition: addr.c:892
nl_addr2str
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:998
nl_addr_get_len
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:952
nl_addr_put
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:538
nla_data
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:114
NLA_PUT
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
NLA_PUT_U32
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition: attr.h:230
nla_put
int nla_put(struct nl_msg *msg, int attrtype, int datalen, const void *data)
Add a unspecific attribute to netlink message.
Definition: attr.c:493
nla_reserve
struct nlattr * nla_reserve(struct nl_msg *msg, int attrtype, int attrlen)
Reserve space for a attribute.
Definition: attr.c:449
NLA_U32
@ NLA_U32
32 bit integer
Definition: attr.h:37
nl_cache_mngt_unregister
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:281
nl_cache_mngt_register
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:246
nl_cache_search
struct nl_object * nl_cache_search(struct nl_cache *cache, struct nl_object *needle)
Search object in cache.
Definition: cache.c:1108
nl_cache_get_next
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:140
nl_cache_remove
void nl_cache_remove(struct nl_object *obj)
Remove object from cache.
Definition: cache.c:546
nl_cache_alloc_and_fill
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:228
nl_cache_get_first
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:114
nl_cache_move
int nl_cache_move(struct nl_cache *cache, struct nl_object *obj)
Move object from one cache to another.
Definition: cache.c:518
nlmsg_alloc_simple
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:341
nlmsg_data
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:100
nlmsg_free
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:558
nlmsg_parse
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:208
nlmsg_append
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:442
nl_object_get_msgtype
int nl_object_get_msgtype(const struct nl_object *obj)
Return the netlink message type the object was derived from.
Definition: object.c:532
nl_object_diff64
uint64_t nl_object_diff64(struct nl_object *a, struct nl_object *b)
Compute bitmask representing difference in attribute values.
Definition: object.c:364
nl_object_put
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:214
nl_object_get
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:203
nl_object_alloc
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:48
nl_send_auto
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:510
nl_send_auto_complete
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1241
nl_pickup
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1172
nl_wait_for_ack
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1106
nl_send_simple
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:574
nl_dump
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:955
NL_DUMP_STATS
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:18
NL_DUMP_LINE
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:16
NL_DUMP_DETAILS
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:17
nl_dump_params
Dumping parameters.
Definition: types.h:28
nla_policy
Attribute validation policy.
Definition: attr.h:63
nla_policy::minlen
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68