libnl 3.7.0
sp.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36/**
37 * @ingroup xfrmnl
38 * @defgroup sp Security Policy
39 * @brief
40 */
41
42#include <netlink-private/netlink.h>
43#include <netlink/netlink.h>
44#include <netlink/cache.h>
45#include <netlink/object.h>
46#include <netlink/xfrm/selector.h>
47#include <netlink/xfrm/lifetime.h>
48#include <netlink/xfrm/template.h>
49#include <netlink/xfrm/sp.h>
50
51/** @cond SKIP */
52#define XFRM_SP_ATTR_SEL 0x01
53#define XFRM_SP_ATTR_LTIME_CFG 0x02
54#define XFRM_SP_ATTR_LTIME_CUR 0x04
55#define XFRM_SP_ATTR_PRIO 0x08
56#define XFRM_SP_ATTR_INDEX 0x10
57#define XFRM_SP_ATTR_DIR 0x20
58#define XFRM_SP_ATTR_ACTION 0x40
59#define XFRM_SP_ATTR_FLAGS 0x80
60#define XFRM_SP_ATTR_SHARE 0x100
61#define XFRM_SP_ATTR_POLTYPE 0x200
62#define XFRM_SP_ATTR_SECCTX 0x400
63#define XFRM_SP_ATTR_TMPL 0x800
64#define XFRM_SP_ATTR_MARK 0x1000
65
66static struct nl_cache_ops xfrmnl_sp_ops;
67static struct nl_object_ops xfrm_sp_obj_ops;
68/** @endcond */
69
70static void xfrm_sp_alloc_data(struct nl_object *c)
71{
72 struct xfrmnl_sp* sp = nl_object_priv (c);
73
74 if ((sp->sel = xfrmnl_sel_alloc ()) == NULL)
75 return;
76
77 if ((sp->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
78 return;
79
80 nl_init_list_head(&sp->usertmpl_list);
81
82 return;
83}
84
85static void xfrm_sp_free_data(struct nl_object *c)
86{
87 struct xfrmnl_sp* sp = nl_object_priv (c);
88 struct xfrmnl_user_tmpl *utmpl, *tmp;
89
90 if (sp == NULL)
91 return;
92
93 xfrmnl_sel_put (sp->sel);
94 xfrmnl_ltime_cfg_put (sp->lft);
95
96 if (sp->sec_ctx) {
97 free(sp->sec_ctx);
98 }
99
100 nl_list_for_each_entry_safe(utmpl, tmp, &sp->usertmpl_list, utmpl_list) {
101 xfrmnl_sp_remove_usertemplate (sp, utmpl);
102 xfrmnl_user_tmpl_free (utmpl);
103 }
104}
105
106static int xfrm_sp_clone(struct nl_object *_dst, struct nl_object *_src)
107{
108 struct xfrmnl_sp* dst = nl_object_priv(_dst);
109 struct xfrmnl_sp* src = nl_object_priv(_src);
110 struct xfrmnl_user_tmpl *utmpl;
111 struct xfrmnl_user_tmpl *new;
112
113 dst->sel = NULL;
114 dst->lft = NULL;
115 dst->sec_ctx = NULL;
116 nl_init_list_head(&dst->usertmpl_list);
117
118 if (src->sel) {
119 if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
120 return -NLE_NOMEM;
121 }
122
123 if (src->lft) {
124 if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
125 return -NLE_NOMEM;
126 }
127
128 if (src->sec_ctx) {
129 uint32_t len = sizeof (struct xfrmnl_user_sec_ctx) + src->sec_ctx->ctx_len;
130
131 if ((dst->sec_ctx = malloc (len)) == NULL)
132 return -NLE_NOMEM;
133 memcpy(dst->sec_ctx, src->sec_ctx, len);
134 }
135
136 nl_list_for_each_entry(utmpl, &src->usertmpl_list, utmpl_list) {
137 new = xfrmnl_user_tmpl_clone (utmpl);
138 if (!new)
139 return -NLE_NOMEM;
140 xfrmnl_sp_add_usertemplate(dst, new);
141 }
142
143 return 0;
144}
145
146static uint64_t xfrm_sp_compare(struct nl_object *_a, struct nl_object *_b,
147 uint64_t attrs, int flags)
148{
149 struct xfrmnl_sp* a = (struct xfrmnl_sp *) _a;
150 struct xfrmnl_sp* b = (struct xfrmnl_sp *) _b;
151 struct xfrmnl_user_tmpl *tmpl_a, *tmpl_b;
152 uint64_t diff = 0;
153
154#define XFRM_SP_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_SP_ATTR_##ATTR, a, b, EXPR)
155 diff |= XFRM_SP_DIFF(SEL, xfrmnl_sel_cmp(a->sel, b->sel));
156 diff |= XFRM_SP_DIFF(LTIME_CFG, xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
157 diff |= XFRM_SP_DIFF(PRIO, a->priority != b->priority);
158 diff |= XFRM_SP_DIFF(INDEX, a->index != b->index);
159 diff |= XFRM_SP_DIFF(DIR, a->dir != b->dir);
160 diff |= XFRM_SP_DIFF(ACTION, a->action != b->action);
161 diff |= XFRM_SP_DIFF(FLAGS, a->flags != b->flags);
162 diff |= XFRM_SP_DIFF(SHARE, a->share != b->share);
163 diff |= XFRM_SP_DIFF(SECCTX,((a->sec_ctx->len != b->sec_ctx->len) ||
164 (a->sec_ctx->exttype != b->sec_ctx->exttype) ||
165 (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
166 (a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
167 (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
168 strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
169 diff |= XFRM_SP_DIFF(POLTYPE,(a->uptype.type != b->uptype.type));
170 diff |= XFRM_SP_DIFF(TMPL,(a->nr_user_tmpl != b->nr_user_tmpl));
171 diff |= XFRM_SP_DIFF(MARK,(a->mark.m != b->mark.m) ||
172 (a->mark.v != b->mark.v));
173
174 /* Compare the templates */
175 nl_list_for_each_entry(tmpl_b, &b->usertmpl_list, utmpl_list)
176 nl_list_for_each_entry(tmpl_a, &a->usertmpl_list, utmpl_list)
177 diff |= xfrmnl_user_tmpl_cmp (tmpl_a, tmpl_b);
178#undef XFRM_SP_DIFF
179
180 return diff;
181}
182
183/**
184 * @name XFRM SP Attribute Translations
185 * @{
186 */
187static const struct trans_tbl sp_attrs[] = {
188 __ADD(XFRM_SP_ATTR_SEL, selector),
189 __ADD(XFRM_SP_ATTR_LTIME_CFG, lifetime_cfg),
190 __ADD(XFRM_SP_ATTR_LTIME_CUR, lifetime_cur),
191 __ADD(XFRM_SP_ATTR_PRIO, priority),
192 __ADD(XFRM_SP_ATTR_INDEX, index),
193 __ADD(XFRM_SP_ATTR_DIR, direction),
194 __ADD(XFRM_SP_ATTR_ACTION, action),
195 __ADD(XFRM_SP_ATTR_FLAGS, flags),
196 __ADD(XFRM_SP_ATTR_SHARE, share),
197 __ADD(XFRM_SP_ATTR_POLTYPE, policy_type),
198 __ADD(XFRM_SP_ATTR_SECCTX, security_context),
199 __ADD(XFRM_SP_ATTR_TMPL, user_template),
200 __ADD(XFRM_SP_ATTR_MARK, mark),
201};
202
203static char* xfrm_sp_attrs2str(int attrs, char *buf, size_t len)
204{
205 return __flags2str (attrs, buf, len, sp_attrs, ARRAY_SIZE(sp_attrs));
206}
207/** @} */
208
209/**
210 * @name XFRM SP Action Translations
211 * @{
212 */
213static const struct trans_tbl sa_actions[] = {
214 __ADD(XFRM_POLICY_ALLOW, allow),
215 __ADD(XFRM_POLICY_BLOCK, block),
216};
217
218char* xfrmnl_sp_action2str(int action, char *buf, size_t len)
219{
220 return __type2str (action, buf, len, sa_actions, ARRAY_SIZE(sa_actions));
221}
222
223int xfrmnl_sp_str2action(const char *name)
224{
225 return __str2type (name, sa_actions, ARRAY_SIZE(sa_actions));
226}
227/** @} */
228
229/**
230 * @name XFRM SP Flags Translations
231 * @{
232 */
233static const struct trans_tbl sp_flags[] = {
234 __ADD(XFRM_POLICY_LOCALOK, allow policy override by user),
235 __ADD(XFRM_POLICY_ICMP, auto include ICMP in policy),
236};
237
238char* xfrmnl_sp_flags2str(int flags, char *buf, size_t len)
239{
240 return __flags2str (flags, buf, len, sp_flags, ARRAY_SIZE(sp_flags));
241}
242
243int xfrmnl_sp_str2flag(const char *name)
244{
245 return __str2flags(name, sp_flags, ARRAY_SIZE(sp_flags));
246}
247/** @} */
248
249/**
250 * @name XFRM SP Type Translations
251 * @{
252 */
253static const struct trans_tbl sp_types[] = {
254 __ADD(XFRM_POLICY_TYPE_MAIN, main),
255 __ADD(XFRM_POLICY_TYPE_SUB, sub),
256 __ADD(XFRM_POLICY_TYPE_MAX, max),
257 __ADD(XFRM_POLICY_TYPE_ANY, any),
258};
259
260char* xfrmnl_sp_type2str(int type, char *buf, size_t len)
261{
262 return __type2str(type, buf, len, sp_types, ARRAY_SIZE(sp_types));
263}
264
265int xfrmnl_sp_str2type(const char *name)
266{
267 return __str2type(name, sp_types, ARRAY_SIZE(sp_types));
268}
269/** @} */
270
271/**
272 * @name XFRM SP Direction Translations
273 * @{
274 */
275static const struct trans_tbl sp_dir[] = {
276 __ADD(XFRM_POLICY_IN, in),
277 __ADD(XFRM_POLICY_OUT, out),
278 __ADD(XFRM_POLICY_FWD, fwd),
279 __ADD(XFRM_POLICY_MASK, mask),
280};
281
282char* xfrmnl_sp_dir2str(int dir, char *buf, size_t len)
283{
284 return __type2str (dir, buf, len, sp_dir, ARRAY_SIZE(sp_dir));
285}
286
287int xfrmnl_sp_str2dir(const char *name)
288{
289 return __str2type (name, sp_dir, ARRAY_SIZE(sp_dir));
290}
291
292int xfrmnl_sp_index2dir (unsigned int index)
293{
294 return index & 0x7;
295}
296/** @} */
297
298/**
299 * @name XFRM SP Share Translations
300 * @{
301 */
302static const struct trans_tbl sp_share[] = {
303 __ADD(XFRM_SHARE_ANY, any),
304 __ADD(XFRM_SHARE_SESSION, session),
305 __ADD(XFRM_SHARE_USER, user),
306 __ADD(XFRM_SHARE_UNIQUE, unique),
307};
308
309char* xfrmnl_sp_share2str(int share, char *buf, size_t len)
310{
311 return __type2str (share, buf, len, sp_share, ARRAY_SIZE(sp_share));
312}
313
314int xfrmnl_sp_str2share(const char *name)
315{
316 return __str2type (name, sp_share, ARRAY_SIZE(sp_share));
317}
318/** @} */
319
320static void xfrm_sp_dump_line(struct nl_object *a, struct nl_dump_params *p)
321{
322 struct xfrmnl_sp* sp = (struct xfrmnl_sp *) a;
323 char dir[32], action[32], share[32], flags[32];
324 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
325 time_t add_time, use_time;
326 struct tm *add_time_tm, *use_time_tm;
327
328 nl_addr2str(xfrmnl_sel_get_saddr (sp->sel), src, sizeof(src));
329 nl_addr2str (xfrmnl_sel_get_daddr (sp->sel), dst, sizeof (dst));
330 nl_af2str (xfrmnl_sel_get_family (sp->sel), dir, 32);
331 nl_dump_line(p, "src %s dst %s family: %s\n", src, dst, dir);
332 nl_dump_line (p, "src port/mask: %d/%d dst port/mask: %d/%d\n",
333 xfrmnl_sel_get_dport (sp->sel), xfrmnl_sel_get_dportmask (sp->sel),
334 xfrmnl_sel_get_sport (sp->sel), xfrmnl_sel_get_sportmask (sp->sel));
335 nl_dump_line (p, "protocol: %s ifindex: %u uid: %u\n",
336 nl_ip_proto2str (xfrmnl_sel_get_proto (sp->sel), dir, sizeof(dir)),
337 xfrmnl_sel_get_ifindex (sp->sel),
338 xfrmnl_sel_get_userid (sp->sel));
339
340 xfrmnl_sp_dir2str (sp->dir, dir, 32);
341 xfrmnl_sp_action2str (sp->action, action, 32);
342 xfrmnl_sp_share2str (sp->share, share, 32);
343 xfrmnl_sp_flags2str (sp->flags, flags, 32);
344 nl_dump_line(p, "\tdir: %s action: %s index: %u priority: %u share: %s flags: %s(0x%x) \n",
345 dir, action, sp->index, sp->priority, share, flags, sp->flags);
346
347 nl_dump_line(p, "\tlifetime configuration: \n");
348 if (sp->lft->soft_byte_limit == XFRM_INF)
349 sprintf (dir, "INF");
350 else
351 sprintf (dir, "%" PRIu64, sp->lft->soft_byte_limit);
352 if (sp->lft->soft_packet_limit == XFRM_INF)
353 sprintf (action, "INF");
354 else
355 sprintf (action, "%" PRIu64, sp->lft->soft_packet_limit);
356 if (sp->lft->hard_byte_limit == XFRM_INF)
357 sprintf (flags, "INF");
358 else
359 sprintf (flags, "%" PRIu64, sp->lft->hard_byte_limit);
360 if (sp->lft->hard_packet_limit == XFRM_INF)
361 sprintf (share, "INF");
362 else
363 sprintf (share, "%" PRIu64, sp->lft->hard_packet_limit);
364 nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets) \n", dir,
365 action);
366 nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets) \n", flags,
367 share);
368 nl_dump_line(
369 p,
370 "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
371 (long long unsigned)sp->lft->soft_add_expires_seconds,
372 (long long unsigned)sp->lft->soft_use_expires_seconds);
373 nl_dump_line(
374 p,
375 "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
376 (long long unsigned)sp->lft->hard_add_expires_seconds,
377 (long long unsigned)sp->lft->hard_use_expires_seconds);
378
379 nl_dump_line(p, "\tlifetime current: \n");
380 nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
381 (long long unsigned)sp->curlft.bytes,
382 (long long unsigned)sp->curlft.packets);
383
384 if (sp->curlft.add_time != 0)
385 {
386 add_time = sp->curlft.add_time;
387 add_time_tm = gmtime (&add_time);
388 strftime (dst, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", add_time_tm);
389 }
390 else
391 {
392 sprintf (dst, "%s", "-");
393 }
394
395 if (sp->curlft.use_time != 0)
396 {
397 use_time = sp->curlft.use_time;
398 use_time_tm = gmtime (&use_time);
399 strftime (src, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", use_time_tm);
400 }
401 else
402 {
403 sprintf (src, "%s", "-");
404 }
405 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", dst, src);
406
407 if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
408 {
409 nl_dump_line(p, "\tUser security context: \n");
410 nl_dump_line(p, "\t\tlen: %d exttype: %d Algo: %d DOI: %d ctxlen: %d\n",
411 sp->sec_ctx->len, sp->sec_ctx->exttype,
412 sp->sec_ctx->ctx_alg, sp->sec_ctx->ctx_doi, sp->sec_ctx->ctx_len);
413 nl_dump_line (p, "\t\tctx: %s \n", sp->sec_ctx->ctx);
414 }
415
416 xfrmnl_sp_type2str (sp->uptype.type, flags, 32);
417 if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
418 nl_dump_line(p, "\tUser policy type: %s\n", flags);
419
420 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
421 {
422 struct xfrmnl_user_tmpl* utmpl;
423
424 nl_dump_line(p, "\tUser template: \n");
425
426 nl_list_for_each_entry(utmpl, &sp->usertmpl_list, utmpl_list)
427 xfrmnl_user_tmpl_dump (utmpl, p);
428 }
429
430 if (sp->ce_mask & XFRM_SP_ATTR_MARK)
431 nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sp->mark.m, sp->mark.v);
432
433 nl_dump(p, "\n");
434}
435
436static void xfrm_sp_dump_details(struct nl_object *a, struct nl_dump_params *p)
437{
438 xfrm_sp_dump_line(a, p);
439}
440
441static void xfrm_sp_dump_stats(struct nl_object *a, struct nl_dump_params *p)
442{
443 xfrm_sp_dump_details(a, p);
444
445 return;
446}
447
448/**
449 * @name XFRM SP Object Allocation/Freeage
450 * @{
451 */
452
453struct xfrmnl_sp* xfrmnl_sp_alloc(void)
454{
455 return (struct xfrmnl_sp*) nl_object_alloc(&xfrm_sp_obj_ops);
456}
457
458void xfrmnl_sp_put(struct xfrmnl_sp* sp)
459{
460 nl_object_put((struct nl_object *) sp);
461}
462
463/** @} */
464
465/**
466 * @name SP Cache Managament
467 * @{
468 */
469
470/**
471 * Build a SP cache including all SPs currently configured in the kernel.
472 * @arg sock Netlink socket.
473 * @arg result Pointer to store resulting cache.
474 *
475 * Allocates a new SP cache, initializes it properly and updates it
476 * to include all SPs currently configured in the kernel.
477 *
478 * @return 0 on success or a negative error code.
479 */
480int xfrmnl_sp_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
481{
482 return nl_cache_alloc_and_fill(&xfrmnl_sp_ops, sock, result);
483}
484
485/**
486 * Look up a SP by policy id and direction
487 * @arg cache SP cache
488 * @arg index Policy Id
489 * @arg dir direction
490 * @return sp handle or NULL if no match was found.
491 */
492struct xfrmnl_sp* xfrmnl_sp_get(struct nl_cache* cache, unsigned int index, unsigned int dir)
493{
494 struct xfrmnl_sp *sp;
495
496 //nl_list_for_each_entry(sp, &cache->c_items, ce_list) {
497 for (sp = (struct xfrmnl_sp*)nl_cache_get_first (cache);
498 sp != NULL;
499 sp = (struct xfrmnl_sp*)nl_cache_get_next ((struct nl_object*)sp))
500 {
501 if (sp->index == index && sp->dir == dir)
502 {
503 nl_object_get((struct nl_object *) sp);
504 return sp;
505 }
506 }
507
508 return NULL;
509}
510
511
512/** @} */
513
514
515static struct nla_policy xfrm_sp_policy[XFRMA_MAX+1] = {
516 [XFRMA_POLICY] = { .minlen = sizeof(struct xfrm_userpolicy_info)},
517 [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
518 [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
519 [XFRMA_POLICY_TYPE] = { .minlen = sizeof(struct xfrm_userpolicy_type)},
520 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
521};
522
523static int xfrm_sp_request_update(struct nl_cache *c, struct nl_sock *h)
524{
525 return nl_send_simple (h, XFRM_MSG_GETPOLICY, NLM_F_DUMP, NULL, 0);
526}
527
528int xfrmnl_sp_parse(struct nlmsghdr *n, struct xfrmnl_sp **result)
529{
530 struct xfrmnl_sp *sp;
531 struct nlattr *tb[XFRMA_MAX + 1];
532 struct xfrm_userpolicy_info *sp_info;
533 int len, err;
534 struct nl_addr* addr;
535
536 sp = xfrmnl_sp_alloc();
537 if (!sp) {
538 err = -NLE_NOMEM;
539 goto errout;
540 }
541
542 sp->ce_msgtype = n->nlmsg_type;
543 if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
544 {
545 sp_info = (struct xfrm_userpolicy_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_userpolicy_id) + NLA_HDRLEN);
546 }
547 else
548 {
549 sp_info = nlmsg_data(n);
550 }
551
552 err = nlmsg_parse(n, sizeof(struct xfrm_userpolicy_info), tb, XFRMA_MAX, xfrm_sp_policy);
553 if (err < 0)
554 {
555 printf ("parse error: %d \n", err);
556 goto errout;
557 }
558
559 if (sp_info->sel.family == AF_INET)
560 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a4, sizeof (sp_info->sel.daddr.a4));
561 else
562 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a6, sizeof (sp_info->sel.daddr.a6));
563 nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_d);
564 xfrmnl_sel_set_daddr (sp->sel, addr);
565 xfrmnl_sel_set_prefixlen_d (sp->sel, sp_info->sel.prefixlen_d);
566
567 if (sp_info->sel.family == AF_INET)
568 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a4, sizeof (sp_info->sel.saddr.a4));
569 else
570 addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a6, sizeof (sp_info->sel.saddr.a6));
571 nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_s);
572 xfrmnl_sel_set_saddr (sp->sel, addr);
573 xfrmnl_sel_set_prefixlen_s (sp->sel, sp_info->sel.prefixlen_s);
574
575 xfrmnl_sel_set_dport (sp->sel, ntohs (sp_info->sel.dport));
576 xfrmnl_sel_set_dportmask (sp->sel, ntohs (sp_info->sel.dport_mask));
577 xfrmnl_sel_set_sport (sp->sel, ntohs (sp_info->sel.sport));
578 xfrmnl_sel_set_sportmask (sp->sel, ntohs (sp_info->sel.sport_mask));
579 xfrmnl_sel_set_family (sp->sel, sp_info->sel.family);
580 xfrmnl_sel_set_proto (sp->sel, sp_info->sel.proto);
581 xfrmnl_sel_set_ifindex (sp->sel, sp_info->sel.ifindex);
582 xfrmnl_sel_set_userid (sp->sel, sp_info->sel.user);
583 sp->ce_mask |= XFRM_SP_ATTR_SEL;
584
585 sp->lft->soft_byte_limit = sp_info->lft.soft_byte_limit;
586 sp->lft->hard_byte_limit = sp_info->lft.hard_byte_limit;
587 sp->lft->soft_packet_limit = sp_info->lft.soft_packet_limit;
588 sp->lft->hard_packet_limit = sp_info->lft.hard_packet_limit;
589 sp->lft->soft_add_expires_seconds = sp_info->lft.soft_add_expires_seconds;
590 sp->lft->hard_add_expires_seconds = sp_info->lft.hard_add_expires_seconds;
591 sp->lft->soft_use_expires_seconds = sp_info->lft.soft_use_expires_seconds;
592 sp->lft->hard_use_expires_seconds = sp_info->lft.hard_use_expires_seconds;
593 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
594
595 sp->curlft.bytes = sp_info->curlft.bytes;
596 sp->curlft.packets = sp_info->curlft.packets;
597 sp->curlft.add_time = sp_info->curlft.add_time;
598 sp->curlft.use_time = sp_info->curlft.use_time;
599 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CUR;
600
601 sp->priority = sp_info->priority;
602 sp->index = sp_info->index;
603 sp->dir = sp_info->dir;
604 sp->action = sp_info->action;
605 sp->flags = sp_info->flags;
606 sp->share = sp_info->share;
607 sp->ce_mask |= (XFRM_SP_ATTR_PRIO | XFRM_SP_ATTR_INDEX |
608 XFRM_SP_ATTR_DIR | XFRM_SP_ATTR_ACTION |
609 XFRM_SP_ATTR_FLAGS | XFRM_SP_ATTR_SHARE);
610
611 if (tb[XFRMA_SEC_CTX]) {
612 struct xfrm_user_sec_ctx* ctx = nla_data(tb[XFRMA_SEC_CTX]);
613 len = sizeof (struct xfrmnl_user_sec_ctx) + ctx->ctx_len;
614 if ((sp->sec_ctx = calloc (1, len)) == NULL)
615 {
616 err = -NLE_NOMEM;
617 goto errout;
618 }
619 memcpy ((void *)sp->sec_ctx, (void *)ctx, len);
620 sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
621 }
622
623 if (tb[XFRMA_POLICY_TYPE]) {
624 struct xfrm_userpolicy_type* up = nla_data(tb[XFRMA_POLICY_TYPE]);
625 memcpy ((void *)&sp->uptype, (void *)up, sizeof (struct xfrm_userpolicy_type));
626 sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
627 }
628
629 if (tb[XFRMA_TMPL]) {
630 struct xfrm_user_tmpl* tmpl = nla_data(tb[XFRMA_TMPL]);
631 struct xfrmnl_user_tmpl* sputmpl;
632 uint32_t i;
633 uint32_t num_tmpls = nla_len(tb[XFRMA_TMPL]) / sizeof (*tmpl);
634 struct nl_addr* addr;
635
636 for (i = 0; (i < num_tmpls) && (tmpl); i ++, tmpl++)
637 {
638 if ((sputmpl = xfrmnl_user_tmpl_alloc ()) == NULL)
639 {
640 err = -NLE_NOMEM;
641 goto errout;
642 }
643
644 if (tmpl->family == AF_INET)
645 addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a4, sizeof (tmpl->id.daddr.a4));
646 else
647 addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a6, sizeof (tmpl->id.daddr.a6));
648 xfrmnl_user_tmpl_set_daddr (sputmpl, addr);
649 xfrmnl_user_tmpl_set_spi (sputmpl, ntohl(tmpl->id.spi));
650 xfrmnl_user_tmpl_set_proto (sputmpl, tmpl->id.proto);
651 xfrmnl_user_tmpl_set_family (sputmpl, tmpl->family);
652
653 if (tmpl->family == AF_INET)
654 addr = nl_addr_build(tmpl->family, &tmpl->saddr.a4, sizeof (tmpl->saddr.a4));
655 else
656 addr = nl_addr_build(tmpl->family, &tmpl->saddr.a6, sizeof (tmpl->saddr.a6));
657 xfrmnl_user_tmpl_set_saddr (sputmpl, addr);
658
659 xfrmnl_user_tmpl_set_reqid (sputmpl, tmpl->reqid);
660 xfrmnl_user_tmpl_set_mode (sputmpl, tmpl->mode);
661 xfrmnl_user_tmpl_set_share (sputmpl, tmpl->share);
662 xfrmnl_user_tmpl_set_optional (sputmpl, tmpl->optional);
663 xfrmnl_user_tmpl_set_aalgos (sputmpl, tmpl->aalgos);
664 xfrmnl_user_tmpl_set_ealgos (sputmpl, tmpl->ealgos);
665 xfrmnl_user_tmpl_set_calgos (sputmpl, tmpl->calgos);
666 xfrmnl_sp_add_usertemplate (sp, sputmpl);
667
668 sp->ce_mask |= XFRM_SP_ATTR_TMPL;
669 }
670 }
671
672 if (tb[XFRMA_MARK]) {
673 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
674 sp->mark.m = m->m;
675 sp->mark.v = m->v;
676 sp->ce_mask |= XFRM_SP_ATTR_MARK;
677 }
678
679 *result = sp;
680 return 0;
681
682errout:
683 xfrmnl_sp_put(sp);
684 return err;
685}
686
687static int xfrm_sp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
688 struct nlmsghdr *n, struct nl_parser_param *pp)
689{
690 struct xfrmnl_sp* sp;
691 int err;
692
693 if ((err = xfrmnl_sp_parse(n, &sp)) < 0)
694 {
695 printf ("received error: %d \n", err);
696 return err;
697 }
698
699 err = pp->pp_cb((struct nl_object *) sp, pp);
700
701 xfrmnl_sp_put(sp);
702 return err;
703}
704
705/**
706 * @name XFRM SP Get
707 * @{
708 */
709
710int xfrmnl_sp_build_get_request(unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
711{
712 struct nl_msg *msg;
713 struct xfrm_userpolicy_id spid;
714 struct xfrm_mark mark;
715
716 memset(&spid, 0, sizeof(spid));
717 spid.index = index;
718 spid.dir = dir;
719
720 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETPOLICY, 0)))
721 return -NLE_NOMEM;
722
723 if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
724 goto nla_put_failure;
725
726 if ((mark_m & mark_v) != 0)
727 {
728 memset(&mark, 0, sizeof(struct xfrm_mark));
729 mark.m = mark_m;
730 mark.v = mark_v;
731
732 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
733 }
734
735 *result = msg;
736 return 0;
737
738nla_put_failure:
739 nlmsg_free(msg);
740 return -NLE_MSGSIZE;
741}
742
743int xfrmnl_sp_get_kernel(struct nl_sock* sock, unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sp** result)
744{
745 struct nl_msg *msg = NULL;
746 struct nl_object *obj;
747 int err;
748
749 if ((err = xfrmnl_sp_build_get_request(index, dir, mark_m, mark_v, &msg)) < 0)
750 return err;
751
752 err = nl_send_auto(sock, msg);
753 nlmsg_free(msg);
754 if (err < 0)
755 return err;
756
757 if ((err = nl_pickup(sock, &xfrm_sp_msg_parser, &obj)) < 0)
758 return err;
759
760 /* We have used xfrm_sp_msg_parser(), object is definitely a xfrm ae */
761 *result = (struct xfrmnl_sp *) obj;
762
763 /* If an object has been returned, we also need to wait for the ACK */
764 if (err == 0 && obj)
765 nl_wait_for_ack(sock);
766
767 return 0;
768}
769
770/** @} */
771
772static int build_xfrm_sp_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
773{
774 struct nl_msg* msg;
775 struct xfrm_userpolicy_info sp_info;
776 uint32_t len;
777 struct nl_addr* addr;
778
779 if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
780 (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
781 !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
782 return -NLE_MISSING_ATTR;
783
784 memset ((void*)&sp_info, 0, sizeof (sp_info));
785 if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
786 {
787 addr = xfrmnl_sel_get_daddr (tmpl->sel);
788 memcpy ((void*)&sp_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
789 addr = xfrmnl_sel_get_saddr (tmpl->sel);
790 memcpy ((void*)&sp_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
791 sp_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
792 sp_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
793 sp_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
794 sp_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
795 sp_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
796 sp_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
797 sp_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
798 sp_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
799 sp_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
800 sp_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
801 }
802
803 if (tmpl->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
804 {
805 sp_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
806 sp_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
807 sp_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
808 sp_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
809 sp_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
810 sp_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
811 sp_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
812 sp_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
813 }
814
815 //Skip current lifetime: cur lifetime can be updated only via AE
816
817 if (tmpl->ce_mask & XFRM_SP_ATTR_PRIO)
818 sp_info.priority = tmpl->priority;
819
820 if (tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
821 sp_info.index = tmpl->index;
822
823 if (tmpl->ce_mask & XFRM_SP_ATTR_DIR)
824 sp_info.dir = tmpl->dir;
825
826 if (tmpl->ce_mask & XFRM_SP_ATTR_ACTION)
827 sp_info.action = tmpl->action;
828
829 if (tmpl->ce_mask & XFRM_SP_ATTR_FLAGS)
830 sp_info.flags = tmpl->flags;
831
832 if (tmpl->ce_mask & XFRM_SP_ATTR_SHARE)
833 sp_info.share = tmpl->share;
834
835 msg = nlmsg_alloc_simple(cmd, flags);
836 if (!msg)
837 return -NLE_NOMEM;
838
839 if (nlmsg_append(msg, &sp_info, sizeof(sp_info), NLMSG_ALIGNTO) < 0)
840 goto nla_put_failure;
841
842 if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
843 len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
844 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
845 }
846
847 if (tmpl->ce_mask & XFRM_SP_ATTR_POLTYPE) {
848 len = sizeof (struct xfrm_userpolicy_type);
849 NLA_PUT (msg, XFRMA_POLICY_TYPE, len, &tmpl->uptype);
850 }
851
852 if (tmpl->ce_mask & XFRM_SP_ATTR_TMPL) {
853 struct nlattr* tmpls;
854 struct xfrmnl_user_tmpl* utmpl;
855 struct nl_addr* addr;
856
857 if (!(tmpls = nla_nest_start(msg, XFRMA_TMPL)))
858 goto nla_put_failure;
859
860 nl_list_for_each_entry(utmpl, &tmpl->usertmpl_list, utmpl_list) {
861 struct xfrm_user_tmpl* tmpl;
862
863 tmpl = nlmsg_reserve(msg, sizeof(*tmpl), NLMSG_ALIGNTO);
864 if (!tmpl)
865 goto nla_put_failure;
866 addr = xfrmnl_user_tmpl_get_daddr (utmpl);
867 memcpy ((void *)&tmpl->id.daddr, nl_addr_get_binary_addr (addr),
868 nl_addr_get_len (addr));
869 tmpl->id.spi = htonl(xfrmnl_user_tmpl_get_spi (utmpl));
870 tmpl->id.proto = xfrmnl_user_tmpl_get_proto (utmpl);
871 tmpl->family = xfrmnl_user_tmpl_get_family (utmpl);
872 addr = xfrmnl_user_tmpl_get_saddr (utmpl);
873 memcpy ((void *)&tmpl->saddr, nl_addr_get_binary_addr (addr),
874 nl_addr_get_len (addr));
875 tmpl->reqid = xfrmnl_user_tmpl_get_reqid (utmpl);
876 tmpl->mode = xfrmnl_user_tmpl_get_mode (utmpl);
877 tmpl->share = xfrmnl_user_tmpl_get_share (utmpl);
878 tmpl->optional = xfrmnl_user_tmpl_get_optional (utmpl);
879 tmpl->aalgos = xfrmnl_user_tmpl_get_aalgos (utmpl);
880 tmpl->ealgos = xfrmnl_user_tmpl_get_ealgos (utmpl);
881 tmpl->calgos = xfrmnl_user_tmpl_get_calgos (utmpl);
882 }
883 nla_nest_end(msg, tmpls);
884 }
885
886 if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
887 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
888 }
889
890 *result = msg;
891 return 0;
892
893nla_put_failure:
894 nlmsg_free(msg);
895 return -NLE_MSGSIZE;
896}
897
898/**
899 * @name XFRM SP Add
900 * @{
901 */
902
903int xfrmnl_sp_build_add_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
904{
905 return build_xfrm_sp_message (tmpl, XFRM_MSG_NEWPOLICY, flags, result);
906}
907
908int xfrmnl_sp_add(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
909{
910 int err;
911 struct nl_msg *msg;
912
913 if ((err = xfrmnl_sp_build_add_request(tmpl, flags, &msg)) < 0)
914 return err;
915
916 err = nl_send_auto_complete(sk, msg);
917 nlmsg_free(msg);
918 if (err < 0)
919 return err;
920
921 return nl_wait_for_ack(sk);
922}
923
924/**
925 * @name XFRM SP Update
926 * @{
927 */
928
929int xfrmnl_sp_build_update_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
930{
931 return build_xfrm_sp_message (tmpl, XFRM_MSG_UPDPOLICY, flags, result);
932}
933
934int xfrmnl_sp_update(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
935{
936 int err;
937 struct nl_msg *msg;
938
939 if ((err = xfrmnl_sp_build_update_request(tmpl, flags, &msg)) < 0)
940 return err;
941
942 err = nl_send_auto_complete(sk, msg);
943 nlmsg_free(msg);
944 if (err < 0)
945 return err;
946
947 return nl_wait_for_ack(sk);
948}
949
950/** @} */
951
952/**
953 * \brief Builds a xfrm_sp_delete_message. Uses either index and direction
954 * or security-context (not set is a valid value), selector and
955 * direction for identification.
956 * Returns error if necessary values aren't set.
957 *
958 * \param tmpl The policy template.
959 * \param cmd The command. Should be XFRM_MSG_DELPOLICY.
960 * \param flags Additional flags
961 * \param result Resulting message.
962 *
963 * \return 0 if successful, else error value < 0
964 */
965static int build_xfrm_sp_delete_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
966{
967 struct nl_msg* msg;
968 struct xfrm_userpolicy_id spid;
969 struct nl_addr* addr;
970 uint32_t len;
971
972 if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
973 (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
974 !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
975 return -NLE_MISSING_ATTR;
976
977 memset(&spid, 0, sizeof(spid));
978 spid.dir = tmpl->dir;
979 if(tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
980 spid.index = tmpl->index;
981
982 if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
983 {
984 addr = xfrmnl_sel_get_daddr (tmpl->sel);
985 memcpy ((void*)&spid.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
986 addr = xfrmnl_sel_get_saddr (tmpl->sel);
987 memcpy ((void*)&spid.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
988 spid.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
989 spid.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
990 spid.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
991 spid.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
992 spid.sel.family = xfrmnl_sel_get_family (tmpl->sel);
993 spid.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
994 spid.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
995 spid.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
996 spid.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
997 spid.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
998 }
999
1000 msg = nlmsg_alloc_simple(cmd, flags);
1001 if (!msg)
1002 return -NLE_NOMEM;
1003
1004 if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
1005 goto nla_put_failure;
1006
1007 if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
1008 len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
1009 NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1010 }
1011
1012 if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
1013 len = sizeof (struct xfrm_mark);
1014 NLA_PUT (msg, XFRMA_MARK, len, &tmpl->mark);
1015 }
1016
1017 *result = msg;
1018 return 0;
1019
1020nla_put_failure:
1021 nlmsg_free(msg);
1022 return -NLE_MSGSIZE;
1023}
1024
1025/**
1026 * @name XFRM SA Delete
1027 * @{
1028 */
1029
1030int xfrmnl_sp_build_delete_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
1031{
1032 return build_xfrm_sp_delete_message (tmpl, XFRM_MSG_DELPOLICY, flags, result);
1033}
1034
1035int xfrmnl_sp_delete(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
1036{
1037 int err;
1038 struct nl_msg *msg;
1039
1040 if ((err = xfrmnl_sp_build_delete_request(tmpl, flags, &msg)) < 0)
1041 return err;
1042
1043 err = nl_send_auto_complete(sk, msg);
1044 nlmsg_free(msg);
1045 if (err < 0)
1046 return err;
1047
1048 return nl_wait_for_ack(sk);
1049}
1050
1051/** @} */
1052
1053
1054/**
1055 * @name Attributes
1056 * @{
1057 */
1058
1059struct xfrmnl_sel* xfrmnl_sp_get_sel (struct xfrmnl_sp* sp)
1060{
1061 if (sp->ce_mask & XFRM_SP_ATTR_SEL)
1062 return sp->sel;
1063 else
1064 return NULL;
1065}
1066
1067int xfrmnl_sp_set_sel (struct xfrmnl_sp* sp, struct xfrmnl_sel* sel)
1068{
1069 /* Release any previously held selector object from the SP */
1070 if (sp->sel)
1071 xfrmnl_sel_put (sp->sel);
1072
1073 /* Increment ref count on new selector and save it in the SP */
1074 xfrmnl_sel_get (sel);
1075 sp->sel = sel;
1076 sp->ce_mask |= XFRM_SP_ATTR_SEL;
1077
1078 return 0;
1079}
1080
1081struct xfrmnl_ltime_cfg* xfrmnl_sp_get_lifetime_cfg (struct xfrmnl_sp* sp)
1082{
1083 if (sp->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
1084 return sp->lft;
1085 else
1086 return NULL;
1087}
1088
1089int xfrmnl_sp_set_lifetime_cfg (struct xfrmnl_sp* sp, struct xfrmnl_ltime_cfg* ltime)
1090{
1091 /* Release any previously held lifetime cfg object from the SP */
1092 if (sp->lft)
1093 xfrmnl_ltime_cfg_put (sp->lft);
1094
1095 /* Increment ref count on new lifetime object and save it in the SP */
1096 xfrmnl_ltime_cfg_get (ltime);
1097 sp->lft = ltime;
1098 sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
1099
1100 return 0;
1101}
1102
1103int xfrmnl_sp_get_curlifetime (struct xfrmnl_sp* sp, unsigned long long int* curr_bytes,
1104 unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1105{
1106 if (sp == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1107 return -1;
1108
1109 *curr_bytes = sp->curlft.bytes;
1110 *curr_packets = sp->curlft.packets;
1111 *curr_add_time = sp->curlft.add_time;
1112 *curr_use_time = sp->curlft.use_time;
1113
1114 return 0;
1115}
1116
1117int xfrmnl_sp_get_priority (struct xfrmnl_sp* sp)
1118{
1119 if (sp->ce_mask & XFRM_SP_ATTR_PRIO)
1120 return sp->priority;
1121 else
1122 return -1;
1123}
1124
1125int xfrmnl_sp_set_priority (struct xfrmnl_sp* sp, unsigned int prio)
1126{
1127 sp->priority = prio;
1128 sp->ce_mask |= XFRM_SP_ATTR_PRIO;
1129
1130 return 0;
1131}
1132
1133int xfrmnl_sp_get_index (struct xfrmnl_sp* sp)
1134{
1135 if (sp->ce_mask & XFRM_SP_ATTR_INDEX)
1136 return sp->index;
1137 else
1138 return -1;
1139}
1140
1141int xfrmnl_sp_set_index (struct xfrmnl_sp* sp, unsigned int index)
1142{
1143 sp->index = index;
1144 sp->ce_mask |= XFRM_SP_ATTR_INDEX;
1145
1146 return 0;
1147}
1148
1149int xfrmnl_sp_get_dir (struct xfrmnl_sp* sp)
1150{
1151 if (sp->ce_mask & XFRM_SP_ATTR_DIR)
1152 return sp->dir;
1153 else
1154 return -1;
1155}
1156
1157int xfrmnl_sp_set_dir (struct xfrmnl_sp* sp, unsigned int dir)
1158{
1159 sp->dir = dir;
1160 sp->ce_mask |= XFRM_SP_ATTR_DIR;
1161
1162 return 0;
1163}
1164
1165int xfrmnl_sp_get_action (struct xfrmnl_sp* sp)
1166{
1167 if (sp->ce_mask & XFRM_SP_ATTR_ACTION)
1168 return sp->action;
1169 else
1170 return -1;
1171}
1172
1173int xfrmnl_sp_set_action (struct xfrmnl_sp* sp, unsigned int action)
1174{
1175 sp->action = action;
1176 sp->ce_mask |= XFRM_SP_ATTR_ACTION;
1177
1178 return 0;
1179}
1180
1181int xfrmnl_sp_get_flags (struct xfrmnl_sp* sp)
1182{
1183 if (sp->ce_mask & XFRM_SP_ATTR_FLAGS)
1184 return sp->flags;
1185 else
1186 return -1;
1187}
1188
1189int xfrmnl_sp_set_flags (struct xfrmnl_sp* sp, unsigned int flags)
1190{
1191 sp->flags = flags;
1192 sp->ce_mask |= XFRM_SP_ATTR_FLAGS;
1193
1194 return 0;
1195}
1196
1197int xfrmnl_sp_get_share (struct xfrmnl_sp* sp)
1198{
1199 if (sp->ce_mask & XFRM_SP_ATTR_SHARE)
1200 return sp->share;
1201 else
1202 return -1;
1203}
1204
1205int xfrmnl_sp_set_share (struct xfrmnl_sp* sp, unsigned int share)
1206{
1207 sp->share = share;
1208 sp->ce_mask |= XFRM_SP_ATTR_SHARE;
1209
1210 return 0;
1211}
1212
1213/**
1214 * Get the security context.
1215 *
1216 * @arg sp The xfrmnl_sp object.
1217 * @arg len An optional output value for the ctx_str length including the xfrmnl_sp header.
1218 * @arg exttype An optional output value.
1219 * @arg alg An optional output value for the security context algorithm.
1220 * @arg doi An optional output value for the security context domain of interpretation.
1221 * @arg ctx_len An optional output value for the security context length, including the
1222 * terminating null byte ('\0').
1223 * @arg ctx_str An optional buffer large enough for the security context string. It must
1224 * contain at least @ctx_len bytes. You are advised to create the ctx_str
1225 * buffer one element larger and ensure NUL termination yourself.
1226 *
1227 * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
1228 * call xfrmnl_sp_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
1229 * This modified API is available in all versions of libnl3 that support the capability
1230 * @def NL_CAPABILITY_XFRM_SP_SEC_CTX_LEN (@see nl_has_capability for further information).
1231 *
1232 * @return 0 on success or a negative error code.
1233 */
1234int xfrmnl_sp_get_sec_ctx (struct xfrmnl_sp* sp, unsigned int* len, unsigned int* exttype, unsigned int* alg, unsigned int* doi, unsigned int* ctx_len, char* ctx_str)
1235{
1236 if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
1237 {
1238 if (len)
1239 *len = sizeof (struct xfrmnl_user_sec_ctx) + sp->sec_ctx->ctx_len;
1240 if (exttype)
1241 *exttype = sp->sec_ctx->exttype;
1242 if (alg)
1243 *alg = sp->sec_ctx->ctx_alg;
1244 if (doi)
1245 *doi = sp->sec_ctx->ctx_doi;
1246 if (ctx_len)
1247 *ctx_len = sp->sec_ctx->ctx_len;
1248 if (ctx_str)
1249 memcpy ((void *)ctx_str, (void *)sp->sec_ctx->ctx, sp->sec_ctx->ctx_len);
1250 }
1251 else
1252 return -1;
1253
1254 return 0;
1255}
1256/**
1257 * @brief Set security context (ctx_str) for XFRM Polixy.
1258 *
1259 * @param sp XFRM Policy
1260 * @param len !!! depricated unused parameter !!!
1261 * @param exttype netlink message attribute - probably XFRMA_SEC_CTX
1262 * @param alg security context algorithm
1263 * @param doi security context domain interpretation
1264 * @param ctx_len Length of the context string.
1265 * @param ctx_str The context string.
1266 *
1267 * @return 0 if sucessfull, else -1
1268 */
1269int xfrmnl_sp_set_sec_ctx (struct xfrmnl_sp* sp, unsigned int len __attribute__((unused)), unsigned int exttype, unsigned int alg, unsigned int doi, unsigned int ctx_len, char* ctx_str)
1270{
1271 /* Free up the old context string and allocate new one */
1272 if (sp->sec_ctx)
1273 free (sp->sec_ctx);
1274 if ((sp->sec_ctx = calloc (1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + ctx_len)) == NULL)
1275 return -1;
1276
1277 /* Save the new info */
1278 sp->sec_ctx->len = sizeof (struct xfrmnl_user_sec_ctx) + ctx_len;
1279 sp->sec_ctx->exttype = exttype;
1280 sp->sec_ctx->ctx_alg = alg;
1281 sp->sec_ctx->ctx_doi = doi;
1282 sp->sec_ctx->ctx_len = ctx_len;
1283 memcpy ((void *)sp->sec_ctx->ctx, (void *)ctx_str, ctx_len);
1284 sp->sec_ctx->ctx[ctx_len] = '\0';
1285
1286 sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
1287
1288 return 0;
1289}
1290
1291int xfrmnl_sp_get_userpolicy_type (struct xfrmnl_sp* sp)
1292{
1293 if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
1294 return sp->uptype.type;
1295 else
1296 return -1;
1297}
1298
1299int xfrmnl_sp_set_userpolicy_type (struct xfrmnl_sp* sp, unsigned int type)
1300{
1301 sp->uptype.type = type;
1302 sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
1303
1304 return 0;
1305}
1306
1307void xfrmnl_sp_add_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1308{
1309 nl_list_add_tail(&utmpl->utmpl_list, &sp->usertmpl_list);
1310 sp->nr_user_tmpl++;
1311 sp->ce_mask |= XFRM_SP_ATTR_TMPL;
1312}
1313
1314void xfrmnl_sp_remove_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1315{
1316 if (sp->ce_mask & XFRM_SP_ATTR_TMPL) {
1317 sp->nr_user_tmpl--;
1318 nl_list_del(&utmpl->utmpl_list);
1319 }
1320}
1321
1322struct nl_list_head *xfrmnl_sp_get_usertemplates(struct xfrmnl_sp *sp)
1323{
1324 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1325 return &sp->usertmpl_list;
1326
1327 return NULL;
1328}
1329
1330int xfrmnl_sp_get_nusertemplates(struct xfrmnl_sp *sp)
1331{
1332 if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1333 return sp->nr_user_tmpl;
1334
1335 return 0;
1336}
1337
1338void xfrmnl_sp_foreach_usertemplate(struct xfrmnl_sp *r,
1339 void (*cb)(struct xfrmnl_user_tmpl *, void *),
1340 void *arg)
1341{
1342 struct xfrmnl_user_tmpl *utmpl;
1343
1344 if (r->ce_mask & XFRM_SP_ATTR_TMPL) {
1345 nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1346 cb(utmpl, arg);
1347 }
1348 }
1349}
1350
1351struct xfrmnl_user_tmpl *xfrmnl_sp_usertemplate_n(struct xfrmnl_sp *r, int n)
1352{
1353 struct xfrmnl_user_tmpl *utmpl;
1354 uint32_t i;
1355
1356 if (r->ce_mask & XFRM_SP_ATTR_TMPL && r->nr_user_tmpl > n) {
1357 i = 0;
1358 nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1359 if (i == n) return utmpl;
1360 i++;
1361 }
1362 }
1363 return NULL;
1364}
1365
1366int xfrmnl_sp_get_mark (struct xfrmnl_sp* sp, unsigned int* mark_mask, unsigned int* mark_value)
1367{
1368 if (mark_mask == NULL || mark_value == NULL)
1369 return -1;
1370
1371 if (sp->ce_mask & XFRM_SP_ATTR_MARK)
1372 {
1373 *mark_mask = sp->mark.m;
1374 *mark_value = sp->mark.v;
1375
1376 return 0;
1377 }
1378 else
1379 return -1;
1380}
1381
1382int xfrmnl_sp_set_mark (struct xfrmnl_sp* sp, unsigned int value, unsigned int mask)
1383{
1384 sp->mark.v = value;
1385 sp->mark.m = mask;
1386 sp->ce_mask |= XFRM_SP_ATTR_MARK;
1387
1388 return 0;
1389}
1390
1391/** @} */
1392
1393static struct nl_object_ops xfrm_sp_obj_ops = {
1394 .oo_name = "xfrm/sp",
1395 .oo_size = sizeof(struct xfrmnl_sp),
1396 .oo_constructor = xfrm_sp_alloc_data,
1397 .oo_free_data = xfrm_sp_free_data,
1398 .oo_clone = xfrm_sp_clone,
1399 .oo_dump = {
1400 [NL_DUMP_LINE] = xfrm_sp_dump_line,
1401 [NL_DUMP_DETAILS] = xfrm_sp_dump_details,
1402 [NL_DUMP_STATS] = xfrm_sp_dump_stats,
1403 },
1404 .oo_compare = xfrm_sp_compare,
1405 .oo_attrs2str = xfrm_sp_attrs2str,
1406 .oo_id_attrs = (XFRM_SP_ATTR_SEL | XFRM_SP_ATTR_INDEX | XFRM_SP_ATTR_DIR),
1407};
1408
1409static struct nl_af_group xfrm_sp_groups[] = {
1410 { AF_UNSPEC, XFRMNLGRP_POLICY },
1411 { END_OF_GROUP_LIST },
1412};
1413
1414static struct nl_cache_ops xfrmnl_sp_ops = {
1415 .co_name = "xfrm/sp",
1416 .co_hdrsize = sizeof(struct xfrm_userpolicy_info),
1417 .co_msgtypes = {
1418 { XFRM_MSG_NEWPOLICY, NL_ACT_NEW, "new" },
1419 { XFRM_MSG_DELPOLICY, NL_ACT_DEL, "del" },
1420 { XFRM_MSG_GETPOLICY, NL_ACT_GET, "get" },
1421 { XFRM_MSG_UPDPOLICY, NL_ACT_NEW, "update" },
1422 END_OF_MSGTYPES_LIST,
1423 },
1424 .co_protocol = NETLINK_XFRM,
1425 .co_groups = xfrm_sp_groups,
1426 .co_request_update = xfrm_sp_request_update,
1427 .co_msg_parser = xfrm_sp_msg_parser,
1428 .co_obj_ops = &xfrm_sp_obj_ops,
1429};
1430
1431/**
1432 * @name XFRM SA Cache Managament
1433 * @{
1434 */
1435
1436static void __attribute__ ((constructor)) xfrm_sp_init(void)
1437{
1438 nl_cache_mngt_register(&xfrmnl_sp_ops);
1439}
1440
1441static void __attribute__ ((destructor)) xfrm_sp_exit(void)
1442{
1443 nl_cache_mngt_unregister(&xfrmnl_sp_ops);
1444}
1445
1446/** @} */
xfrmnl_user_tmpl_clone
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_clone(struct xfrmnl_user_tmpl *utmpl)
Clone existing user template object.
Definition: template.c:91
xfrmnl_sel_cmp
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:162
xfrmnl_ltime_cfg_alloc
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:76
xfrmnl_ltime_cfg_cmp
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:156
xfrmnl_ltime_cfg_clone
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:95
xfrmnl_sel_alloc
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:78
xfrmnl_user_tmpl_cmp
int xfrmnl_user_tmpl_cmp(struct xfrmnl_user_tmpl *a, struct xfrmnl_user_tmpl *b)
Compares two user template objects.
Definition: template.c:144
xfrmnl_sel_clone
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:97
xfrmnl_user_tmpl_alloc
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_alloc()
Allocate new user template object.
Definition: template.c:72
nl_addr_set_prefixlen
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:964
nl_addr_build
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:211
nl_addr_get_binary_addr
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:940
nl_addr2str
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:998
nl_addr_get_len
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:952
nla_data
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:114
NLA_PUT
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
nla_nest_start
struct nlattr * nla_nest_start(struct nl_msg *msg, int attrtype)
Start a new level of nested attributes.
Definition: attr.c:898
nla_len
int nla_len(const struct nlattr *nla)
Return length of the payload .
Definition: attr.c:125
nla_nest_end
int nla_nest_end(struct nl_msg *msg, struct nlattr *start)
Finalize nesting of attributes.
Definition: attr.c:961
nl_cache_mngt_unregister
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:281
nl_cache_mngt_register
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:246
nl_cache_get_next
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:140
nl_cache_alloc_and_fill
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:228
nl_cache_get_first
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:114
nlmsg_alloc_simple
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:341
nlmsg_data
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:100
nlmsg_reserve
void * nlmsg_reserve(struct nl_msg *n, size_t len, int pad)
Reserve room for additional data in a netlink message.
Definition: msg.c:404
nlmsg_free
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:558
nlmsg_parse
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:208
nlmsg_append
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:442
nl_object_put
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:214
nl_object_get
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:203
nl_object_alloc
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:48
nl_send_auto
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:510
nl_send_auto_complete
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1241
nl_pickup
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1172
nl_wait_for_ack
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1106
nl_send_simple
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:574
nl_dump
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:955
NL_DUMP_STATS
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:18
NL_DUMP_LINE
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:16
NL_DUMP_DETAILS
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:17
nl_dump_params
Dumping parameters.
Definition: types.h:28
nl_list_head
Definition: list.h:12
nla_policy
Attribute validation policy.
Definition: attr.h:63
nla_policy::minlen
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68