libnl  3.6.0
ae.c
1 /* SPDX-License-Identifier: LGPL-2.1-only */
2 /*
3  * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4  *
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * Redistributions of source code must retain the above copyright
11  * notice, this list of conditions and the following disclaimer.
12  *
13  * Redistributions in binary form must reproduce the above copyright
14  * notice, this list of conditions and the following disclaimer in the
15  * documentation and/or other materials provided with the
16  * distribution.
17  *
18  * Neither the name of Texas Instruments Incorporated nor the names of
19  * its contributors may be used to endorse or promote products derived
20  * from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 /**
37  * @ingroup xfrmnl
38  * @defgroup ae Attribute Element
39  * @brief
40  *
41  * The AE interface allows a user to retrieve and update various
42  * Security Association (SA) attributes such as lifetime, replay state etc.
43  *
44  * @par AE Flags
45  * @code
46  * XFRM_AE_UNSPEC
47  * XFRM_AE_RTHR=1
48  * XFRM_AE_RVAL=2
49  * XFRM_AE_LVAL=4
50  * XFRM_AE_ETHR=8
51  * XFRM_AE_CR=16
52  * XFRM_AE_CE=32
53  * XFRM_AE_CU=64
54  * @endcode
55  *
56  * @par AE Identification
57  * An AE is uniquely identified by the attributes listed below, whenever
58  * you refer to an existing AE all of the attributes must be set. There is
59  * no cache support for AE since you can retrieve the AE for any given combination
60  * of attributes mentioned below, but not all at once since they just characterize
61  * an SA.
62  * - destination address (xfrmnl_ae_set_daddr())
63  * - SPI (xfrmnl_ae_set_spi)
64  * - protocol (xfrmnl_ae_set_proto)
65  * - mark (xfrmnl_ae_set_mark)
66  *
67  * @par Changeable Attributes
68  * \anchor ae_changeable
69  * - current lifetime (xfrmnl_ae_set_curlifetime())
70  * - replay properties (xfrmnl_ae_set_replay_maxage(), xfrmnl_ae_set_replay_maxdiff())
71  * - replay state (xfrmnl_ae_set_replay_state(), xfrmnl_ae_set_replay_state_esn))
72  *
73  * @par Required Caches for Dumping
74  * None
75  *
76  * @par TODO
77  * None
78  *
79  * @par 1) Retrieving AE information for a given SA tuple
80  * @code
81  * // Create a netlink socket and connect it to XFRM subsystem in
82  * the kernel to be able to send/receive info from userspace.
83  * struct nl_sock* sk = nl_socket_alloc ();
84  * nl_connect (sk, NETLINK_XFRM);
85  *
86  * // AEs can then be looked up by the SA tuple, destination address,
87  * SPI, protocol, mark:
88  * struct xfrmnl_ae *ae;
89  * xfrmnl_ae_get_kernel(sk, dst_addr, spi, proto,mark_mask, mark_value, &ae);
90  *
91  * // After successful usage, the object must be freed
92  * xfrmnl_ae_put(ae);
93  * @endcode
94  *
95  * @par 2) Updating AE
96  * @code
97  * // Allocate an empty AE handle to be filled out with the attributes
98  * // of the new AE.
99  * struct xfrmnl_ae *ae = xfrmnl_ae_alloc();
100  *
101  * // Fill out the attributes of the new AE
102  * xfrmnl_ae_set_daddr(ae, dst_addr);
103  * xfrmnl_ae_set_spi(ae, 0xDEADBEEF);
104  * xfrmnl_ae_set_proto(ae, 50);
105  * xfrmnl_ae_set_mark(ae, 0x0);
106  * xfrmnl_ae_set_saddr(ae, src_addr);
107  * xfrmnl_ae_set_curlifetime(ae, 540, 10, 0xAABB1122, 0x0);
108  *
109  * // Build the netlink message and send it to the kernel, the operation will
110  * // block until the operation has been completed. Alternatively, a netlink message
111  * // can be built using xfrmnl_ae_build_get_request () API and be sent using
112  * // nl_send_auto(). Further the result from the kernel can be parsed using
113  * // xfrmnl_ae_parse() API.
114  * xfrmnl_ae_set(sk, ae, NLM_F_REPLACE);
115  *
116  * // Free the memory
117  * xfrmnl_ae_put(ae);
118  * @endcode
119  *
120  * @{
121  */
122 
123 #include <netlink-private/netlink.h>
124 #include <netlink/netlink.h>
125 #include <netlink/cache.h>
126 #include <netlink/object.h>
127 #include <netlink/xfrm/ae.h>
128 #include <linux/xfrm.h>
129 
130 /** @cond SKIP */
131 #define XFRM_AE_ATTR_DADDR 0x01
132 #define XFRM_AE_ATTR_SPI 0x02
133 #define XFRM_AE_ATTR_PROTO 0x04
134 #define XFRM_AE_ATTR_SADDR 0x08
135 #define XFRM_AE_ATTR_FLAGS 0x10
136 #define XFRM_AE_ATTR_REQID 0x20
137 #define XFRM_AE_ATTR_MARK 0x40
138 #define XFRM_AE_ATTR_LIFETIME 0x80
139 #define XFRM_AE_ATTR_REPLAY_MAXAGE 0x100
140 #define XFRM_AE_ATTR_REPLAY_MAXDIFF 0x200
141 #define XFRM_AE_ATTR_REPLAY_STATE 0x400
142 #define XFRM_AE_ATTR_FAMILY 0x800
143 
144 static struct nl_object_ops xfrm_ae_obj_ops;
145 /** @endcond */
146 
147 
148 static void xfrm_ae_free_data(struct nl_object *c)
149 {
150  struct xfrmnl_ae* ae = nl_object_priv (c);
151 
152  if (ae == NULL)
153  return;
154 
155  nl_addr_put (ae->sa_id.daddr);
156  nl_addr_put (ae->saddr);
157 
158  if (ae->replay_state_esn)
159  free (ae->replay_state_esn);
160 }
161 
162 static int xfrm_ae_clone(struct nl_object *_dst, struct nl_object *_src)
163 {
164  struct xfrmnl_ae* dst = nl_object_priv(_dst);
165  struct xfrmnl_ae* src = nl_object_priv(_src);
166 
167  dst->sa_id.daddr = NULL;
168  dst->saddr = NULL;
169  dst->replay_state_esn = NULL;
170 
171  if (src->sa_id.daddr) {
172  if ((dst->sa_id.daddr = nl_addr_clone (src->sa_id.daddr)) == NULL)
173  return -NLE_NOMEM;
174  }
175 
176  if (src->saddr) {
177  if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
178  return -NLE_NOMEM;
179  }
180 
181  if (src->replay_state_esn) {
182  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * src->replay_state_esn->bmp_len);
183 
184  if ((dst->replay_state_esn = malloc (len)) == NULL)
185  return -NLE_NOMEM;
186  memcpy (dst->replay_state_esn, src->replay_state_esn, len);
187  }
188 
189  return 0;
190 }
191 
192 static uint64_t xfrm_ae_compare(struct nl_object *_a, struct nl_object *_b,
193  uint64_t attrs, int flags)
194 {
195  struct xfrmnl_ae* a = (struct xfrmnl_ae *) _a;
196  struct xfrmnl_ae* b = (struct xfrmnl_ae *) _b;
197  uint64_t diff = 0;
198  int found = 0;
199 
200 #define XFRM_AE_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_AE_ATTR_##ATTR, a, b, EXPR)
201  diff |= XFRM_AE_DIFF(DADDR, nl_addr_cmp(a->sa_id.daddr, b->sa_id.daddr));
202  diff |= XFRM_AE_DIFF(SPI, a->sa_id.spi != b->sa_id.spi);
203  diff |= XFRM_AE_DIFF(PROTO, a->sa_id.proto != b->sa_id.proto);
204  diff |= XFRM_AE_DIFF(SADDR, nl_addr_cmp(a->saddr, b->saddr));
205  diff |= XFRM_AE_DIFF(FLAGS, a->flags != b->flags);
206  diff |= XFRM_AE_DIFF(REQID, a->reqid != b->reqid);
207  diff |= XFRM_AE_DIFF(MARK, (a->mark.v & a->mark.m) != (b->mark.v & b->mark.m));
208  diff |= XFRM_AE_DIFF(REPLAY_MAXAGE, a->replay_maxage != b->replay_maxage);
209  diff |= XFRM_AE_DIFF(REPLAY_MAXDIFF, a->replay_maxdiff != b->replay_maxdiff);
210 
211  /* Compare replay states */
212  found = AVAILABLE_MISMATCH (a, b, XFRM_AE_ATTR_REPLAY_STATE);
213  if (found == 0) // attribute exists in both objects
214  {
215  if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
216  ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
217  found |= 1;
218 
219  if (found == 0) // same replay type. compare actual values
220  {
221  if (a->replay_state_esn)
222  {
223  if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
224  diff |= 1;
225  else
226  {
227  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * a->replay_state_esn->bmp_len);
228  diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
229  }
230  }
231  else
232  {
233  if ((a->replay_state.oseq != b->replay_state.oseq) ||
234  (a->replay_state.seq != b->replay_state.seq) ||
235  (a->replay_state.bitmap != b->replay_state.bitmap))
236  diff |= 1;
237  }
238  }
239  }
240 #undef XFRM_AE_DIFF
241 
242  return diff;
243 }
244 
245 /**
246  * @name XFRM AE Attribute Translations
247  * @{
248  */
249 static const struct trans_tbl ae_attrs[] =
250 {
251  __ADD(XFRM_AE_ATTR_DADDR, daddr),
252  __ADD(XFRM_AE_ATTR_SPI, spi),
253  __ADD(XFRM_AE_ATTR_PROTO, protocol),
254  __ADD(XFRM_AE_ATTR_SADDR, saddr),
255  __ADD(XFRM_AE_ATTR_FLAGS, flags),
256  __ADD(XFRM_AE_ATTR_REQID, reqid),
257  __ADD(XFRM_AE_ATTR_MARK, mark),
258  __ADD(XFRM_AE_ATTR_LIFETIME, cur_lifetime),
259  __ADD(XFRM_AE_ATTR_REPLAY_MAXAGE, replay_maxage),
260  __ADD(XFRM_AE_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
261  __ADD(XFRM_AE_ATTR_REPLAY_STATE, replay_state),
262 };
263 
264 static char* xfrm_ae_attrs2str (int attrs, char *buf, size_t len)
265 {
266  return __flags2str(attrs, buf, len, ae_attrs, ARRAY_SIZE(ae_attrs));
267 }
268 /** @} */
269 
270 /**
271  * @name XFRM AE Flags Translations
272  * @{
273  */
274 
275 static const struct trans_tbl ae_flags[] = {
276  __ADD(XFRM_AE_UNSPEC, unspecified),
277  __ADD(XFRM_AE_RTHR, replay threshold),
278  __ADD(XFRM_AE_RVAL, replay value),
279  __ADD(XFRM_AE_LVAL, lifetime value),
280  __ADD(XFRM_AE_ETHR, expiry time threshold),
281  __ADD(XFRM_AE_CR, replay update event),
282  __ADD(XFRM_AE_CE, timer expiry event),
283  __ADD(XFRM_AE_CU, policy update event),
284 };
285 
286 char* xfrmnl_ae_flags2str(int flags, char *buf, size_t len)
287 {
288  return __flags2str (flags, buf, len, ae_flags, ARRAY_SIZE(ae_flags));
289 }
290 
291 int xfrmnl_ae_str2flag(const char *name)
292 {
293  return __str2flags(name, ae_flags, ARRAY_SIZE(ae_flags));
294 }
295 /** @} */
296 
297 static void xfrm_ae_dump_line(struct nl_object *a, struct nl_dump_params *p)
298 {
299  char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
300  struct xfrmnl_ae* ae = (struct xfrmnl_ae *) a;
301  char flags[128], buf[128];
302  time_t add_time, use_time;
303  struct tm *add_time_tm, *use_time_tm;
304 
305  nl_dump_line(p, "src %s dst %s \n", nl_addr2str(ae->saddr, src, sizeof(src)),
306  nl_addr2str(ae->sa_id.daddr, dst, sizeof(dst)));
307 
308  nl_dump_line(p, "\tproto %s spi 0x%x reqid %u ",
309  nl_ip_proto2str (ae->sa_id.proto, buf, sizeof (buf)),
310  ae->sa_id.spi, ae->reqid);
311 
312  xfrmnl_ae_flags2str(ae->flags, flags, sizeof (flags));
313  nl_dump_line(p, "flags %s(0x%x) mark mask/value 0x%x/0x%x \n", flags,
314  ae->flags, ae->mark.m, ae->mark.v);
315 
316  nl_dump_line(p, "\tlifetime current: \n");
317  nl_dump_line(p, "\t\tbytes %llu packets %llu \n", ae->lifetime_cur.bytes,
318  ae->lifetime_cur.packets);
319  if (ae->lifetime_cur.add_time != 0)
320  {
321  add_time = ae->lifetime_cur.add_time;
322  add_time_tm = gmtime (&add_time);
323  strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
324  }
325  else
326  {
327  sprintf (flags, "%s", "-");
328  }
329 
330  if (ae->lifetime_cur.use_time != 0)
331  {
332  use_time = ae->lifetime_cur.use_time;
333  use_time_tm = gmtime (&use_time);
334  strftime (buf, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
335  }
336  else
337  {
338  sprintf (buf, "%s", "-");
339  }
340  nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, buf);
341 
342  nl_dump_line(p, "\treplay info: \n");
343  nl_dump_line(p, "\t\tmax age %u max diff %u \n", ae->replay_maxage, ae->replay_maxdiff);
344 
345  nl_dump_line(p, "\treplay state info: \n");
346  if (ae->replay_state_esn)
347  {
348  nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
349  ae->replay_state_esn->oseq, ae->replay_state_esn->seq,
350  ae->replay_state_esn->oseq_hi, ae->replay_state_esn->seq_hi,
351  ae->replay_state_esn->replay_window);
352  }
353  else
354  {
355  nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", ae->replay_state.oseq,
356  ae->replay_state.seq, ae->replay_state.bitmap);
357  }
358 
359  nl_dump(p, "\n");
360 }
361 
362 static void xfrm_ae_dump_details(struct nl_object *a, struct nl_dump_params *p)
363 {
364  xfrm_ae_dump_line(a, p);
365 }
366 
367 static void xfrm_ae_dump_stats(struct nl_object *a, struct nl_dump_params *p)
368 {
369  xfrm_ae_dump_details(a, p);
370 }
371 
372 
373 static int build_xfrm_ae_message(struct xfrmnl_ae *tmpl, int cmd, int flags,
374  struct nl_msg **result)
375 {
376  struct nl_msg* msg;
377  struct xfrm_aevent_id ae_id;
378 
379  if (!(tmpl->ce_mask & XFRM_AE_ATTR_DADDR) ||
380  !(tmpl->ce_mask & XFRM_AE_ATTR_SPI) ||
381  !(tmpl->ce_mask & XFRM_AE_ATTR_PROTO))
382  return -NLE_MISSING_ATTR;
383 
384  memcpy (&ae_id.sa_id.daddr, nl_addr_get_binary_addr (tmpl->sa_id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->sa_id.daddr));
385  ae_id.sa_id.spi = htonl(tmpl->sa_id.spi);
386  ae_id.sa_id.family = tmpl->sa_id.family;
387  ae_id.sa_id.proto = tmpl->sa_id.proto;
388 
389  if (tmpl->ce_mask & XFRM_AE_ATTR_SADDR)
390  memcpy (&ae_id.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
391 
392  if (tmpl->ce_mask & XFRM_AE_ATTR_FLAGS)
393  ae_id.flags = tmpl->flags;
394 
395  if (tmpl->ce_mask & XFRM_AE_ATTR_REQID)
396  ae_id.reqid = tmpl->reqid;
397 
398  msg = nlmsg_alloc_simple(cmd, flags);
399  if (!msg)
400  return -NLE_NOMEM;
401 
402  if (nlmsg_append(msg, &ae_id, sizeof(ae_id), NLMSG_ALIGNTO) < 0)
403  goto nla_put_failure;
404 
405  if (tmpl->ce_mask & XFRM_AE_ATTR_MARK)
406  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrmnl_mark), &tmpl->mark);
407 
408  if (tmpl->ce_mask & XFRM_AE_ATTR_LIFETIME)
409  NLA_PUT (msg, XFRMA_LTIME_VAL, sizeof (struct xfrmnl_lifetime_cur), &tmpl->lifetime_cur);
410 
411  if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_MAXAGE)
412  NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
413 
414  if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_MAXDIFF)
415  NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
416 
417  if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_STATE) {
418  if (tmpl->replay_state_esn) {
419  uint32_t len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
420  NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
421  }
422  else {
423  NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrmnl_replay_state), &tmpl->replay_state);
424  }
425  }
426 
427  *result = msg;
428  return 0;
429 
430 nla_put_failure:
431  nlmsg_free(msg);
432  return -NLE_MSGSIZE;
433 }
434 
435 /**
436  * @name XFRM AE Update
437  * @{
438  */
439 
440 int xfrmnl_ae_set(struct nl_sock* sk, struct xfrmnl_ae* ae, int flags)
441 {
442  int err;
443  struct nl_msg *msg;
444 
445  if ((err = build_xfrm_ae_message(ae, XFRM_MSG_NEWAE, flags|NLM_F_REPLACE, &msg)) < 0)
446  return err;
447 
448  err = nl_send_auto_complete(sk, msg);
449  nlmsg_free(msg);
450  if (err < 0)
451  return err;
452 
453  return nl_wait_for_ack(sk);
454 }
455 
456 /** @} */
457 
458 /**
459  * @name XFRM AE Object Allocation/Freeage
460  * @{
461  */
462 
463 struct xfrmnl_ae* xfrmnl_ae_alloc(void)
464 {
465  return (struct xfrmnl_ae*) nl_object_alloc(&xfrm_ae_obj_ops);
466 }
467 
468 void xfrmnl_ae_put(struct xfrmnl_ae* ae)
469 {
470  nl_object_put((struct nl_object *) ae);
471 }
472 
473 /** @} */
474 
475 static struct nla_policy xfrm_ae_policy[XFRMA_MAX+1] = {
476  [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
477  [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
478  [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
479  [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
480  [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
481  [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
482  [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
483 };
484 
485 int xfrmnl_ae_parse(struct nlmsghdr *n, struct xfrmnl_ae **result)
486 {
487  struct xfrmnl_ae* ae;
488  struct nlattr *tb[XFRMA_MAX + 1];
489  struct xfrm_aevent_id* ae_id;
490  int err;
491 
492  ae = xfrmnl_ae_alloc();
493  if (!ae) {
494  err = -NLE_NOMEM;
495  goto errout;
496  }
497 
498  ae->ce_msgtype = n->nlmsg_type;
499  ae_id = nlmsg_data(n);
500 
501  err = nlmsg_parse(n, sizeof(struct xfrm_aevent_id), tb, XFRMA_MAX, xfrm_ae_policy);
502  if (err < 0)
503  goto errout;
504 
505  ae->sa_id.daddr = nl_addr_build(ae_id->sa_id.family, &ae_id->sa_id.daddr, sizeof (ae_id->sa_id.daddr));
506  ae->sa_id.family= ae_id->sa_id.family;
507  ae->sa_id.spi = ntohl(ae_id->sa_id.spi);
508  ae->sa_id.proto = ae_id->sa_id.proto;
509  ae->saddr = nl_addr_build(ae_id->sa_id.family, &ae_id->saddr, sizeof (ae_id->saddr));
510  ae->reqid = ae_id->reqid;
511  ae->flags = ae_id->flags;
512  ae->ce_mask |= (XFRM_AE_ATTR_DADDR | XFRM_AE_ATTR_FAMILY | XFRM_AE_ATTR_SPI |
513  XFRM_AE_ATTR_PROTO | XFRM_AE_ATTR_SADDR | XFRM_AE_ATTR_REQID |
514  XFRM_AE_ATTR_FLAGS);
515 
516  if (tb[XFRMA_MARK]) {
517  struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
518  ae->mark.m = m->m;
519  ae->mark.v = m->v;
520  ae->ce_mask |= XFRM_AE_ATTR_MARK;
521  }
522 
523  if (tb[XFRMA_LTIME_VAL]) {
524  struct xfrm_lifetime_cur* cur = nla_data(tb[XFRMA_LTIME_VAL]);
525  ae->lifetime_cur.bytes = cur->bytes;
526  ae->lifetime_cur.packets = cur->packets;
527  ae->lifetime_cur.add_time = cur->add_time;
528  ae->lifetime_cur.use_time = cur->use_time;
529  ae->ce_mask |= XFRM_AE_ATTR_LIFETIME;
530  }
531 
532  if (tb[XFRM_AE_ETHR]) {
533  ae->replay_maxage = *(uint32_t*)nla_data(tb[XFRM_AE_ETHR]);
534  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXAGE;
535  }
536 
537  if (tb[XFRM_AE_RTHR]) {
538  ae->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRM_AE_RTHR]);
539  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXDIFF;
540  }
541 
542  if (tb[XFRMA_REPLAY_ESN_VAL]) {
543  struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
544  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
545 
546  if ((ae->replay_state_esn = calloc (1, len)) == NULL) {
547  err = -ENOMEM;
548  goto errout;
549  }
550  ae->replay_state_esn->oseq = esn->oseq;
551  ae->replay_state_esn->seq = esn->seq;
552  ae->replay_state_esn->oseq_hi = esn->oseq_hi;
553  ae->replay_state_esn->seq_hi = esn->seq_hi;
554  ae->replay_state_esn->replay_window = esn->replay_window;
555  ae->replay_state_esn->bmp_len = esn->bmp_len;
556  memcpy (ae->replay_state_esn->bmp, esn->bmp, sizeof (uint32_t) * esn->bmp_len);
557  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
558  }
559  else
560  {
561  struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
562  ae->replay_state.oseq = replay_state->oseq;
563  ae->replay_state.seq = replay_state->seq;
564  ae->replay_state.bitmap = replay_state->bitmap;
565  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
566 
567  ae->replay_state_esn = NULL;
568  }
569 
570  *result = ae;
571  return 0;
572 
573 errout:
574  xfrmnl_ae_put(ae);
575  return err;
576 }
577 
578 static int xfrm_ae_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
579  struct nlmsghdr *n, struct nl_parser_param *pp)
580 {
581  struct xfrmnl_ae* ae;
582  int err;
583 
584  if ((err = xfrmnl_ae_parse(n, &ae)) < 0)
585  return err;
586 
587  err = pp->pp_cb((struct nl_object *) ae, pp);
588 
589  xfrmnl_ae_put(ae);
590  return err;
591 }
592 
593 /**
594  * @name XFRM AE Get
595  * @{
596  */
597 
598 int xfrmnl_ae_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol,
599  unsigned int mark_mask, unsigned int mark_value, struct nl_msg **result)
600 {
601  struct nl_msg *msg;
602  struct xfrm_aevent_id ae_id;
603  struct xfrmnl_mark mark;
604 
605  if (!daddr || !spi)
606  {
607  fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
608  __FILE__, __LINE__, __func__);
609  assert(0);
610  return -NLE_MISSING_ATTR;
611  }
612 
613  memset(&ae_id, 0, sizeof(ae_id));
614  memcpy (&ae_id.sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
615  ae_id.sa_id.spi = htonl(spi);
616  ae_id.sa_id.family = nl_addr_get_family (daddr);
617  ae_id.sa_id.proto = protocol;
618 
619  if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETAE, 0)))
620  return -NLE_NOMEM;
621 
622  if (nlmsg_append(msg, &ae_id, sizeof(ae_id), NLMSG_ALIGNTO) < 0)
623  goto nla_put_failure;
624 
625  mark.m = mark_mask;
626  mark.v = mark_value;
627  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrmnl_mark), &mark);
628 
629  *result = msg;
630  return 0;
631 
632 nla_put_failure:
633  nlmsg_free(msg);
634  return -NLE_MSGSIZE;
635 }
636 
637 int xfrmnl_ae_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol,
638  unsigned int mark_mask, unsigned int mark_value, struct xfrmnl_ae** result)
639 {
640  struct nl_msg *msg = NULL;
641  struct nl_object *obj;
642  int err;
643 
644  if ((err = xfrmnl_ae_build_get_request(daddr, spi, protocol, mark_mask, mark_value, &msg)) < 0)
645  return err;
646 
647  err = nl_send_auto(sock, msg);
648  nlmsg_free(msg);
649  if (err < 0)
650  return err;
651 
652  if ((err = nl_pickup(sock, &xfrm_ae_msg_parser, &obj)) < 0)
653  return err;
654 
655  /* We have used xfrm_ae_msg_parser(), object is definitely a xfrm ae */
656  *result = (struct xfrmnl_ae *) obj;
657 
658  /* If an object has been returned, we also need to wait for the ACK */
659  if (err == 0 && obj)
660  nl_wait_for_ack(sock);
661 
662  return 0;
663 }
664 
665 /** @} */
666 
667 /**
668  * @name Attributes
669  * @{
670  */
671 
672 static inline int __assign_addr(struct xfrmnl_ae* ae, struct nl_addr **pos,
673  struct nl_addr *new, int flag, int nocheck)
674 {
675  if (!nocheck) {
676  if (ae->ce_mask & XFRM_AE_ATTR_FAMILY) {
677  if (nl_addr_get_family (new) != ae->sa_id.family)
678  return -NLE_AF_MISMATCH;
679  } else {
680  ae->sa_id.family = nl_addr_get_family (new);
681  ae->ce_mask |= XFRM_AE_ATTR_FAMILY;
682  }
683  }
684 
685  if (*pos)
686  nl_addr_put(*pos);
687 
688  nl_addr_get(new);
689  *pos = new;
690 
691  ae->ce_mask |= flag;
692 
693  return 0;
694 }
695 
696 
697 struct nl_addr* xfrmnl_ae_get_daddr (struct xfrmnl_ae* ae)
698 {
699  if (ae->ce_mask & XFRM_AE_ATTR_DADDR)
700  return ae->sa_id.daddr;
701  else
702  return NULL;
703 }
704 
705 int xfrmnl_ae_set_daddr (struct xfrmnl_ae* ae, struct nl_addr* addr)
706 {
707  return __assign_addr(ae, &ae->sa_id.daddr, addr, XFRM_AE_ATTR_DADDR, 0);
708 }
709 
710 int xfrmnl_ae_get_spi (struct xfrmnl_ae* ae)
711 {
712  if (ae->ce_mask & XFRM_AE_ATTR_SPI)
713  return ae->sa_id.spi;
714  else
715  return -1;
716 }
717 
718 int xfrmnl_ae_set_spi (struct xfrmnl_ae* ae, unsigned int spi)
719 {
720  ae->sa_id.spi = spi;
721  ae->ce_mask |= XFRM_AE_ATTR_SPI;
722 
723  return 0;
724 }
725 
726 int xfrmnl_ae_get_family (struct xfrmnl_ae* ae)
727 {
728  if (ae->ce_mask & XFRM_AE_ATTR_FAMILY)
729  return ae->sa_id.family;
730  else
731  return -1;
732 }
733 
734 int xfrmnl_ae_set_family (struct xfrmnl_ae* ae, unsigned int family)
735 {
736  ae->sa_id.family = family;
737  ae->ce_mask |= XFRM_AE_ATTR_FAMILY;
738 
739  return 0;
740 }
741 
742 int xfrmnl_ae_get_proto (struct xfrmnl_ae* ae)
743 {
744  if (ae->ce_mask & XFRM_AE_ATTR_PROTO)
745  return ae->sa_id.proto;
746  else
747  return -1;
748 }
749 
750 int xfrmnl_ae_set_proto (struct xfrmnl_ae* ae, unsigned int protocol)
751 {
752  ae->sa_id.proto = protocol;
753  ae->ce_mask |= XFRM_AE_ATTR_PROTO;
754 
755  return 0;
756 }
757 
758 struct nl_addr* xfrmnl_ae_get_saddr (struct xfrmnl_ae* ae)
759 {
760  if (ae->ce_mask & XFRM_AE_ATTR_SADDR)
761  return ae->saddr;
762  else
763  return NULL;
764 }
765 
766 int xfrmnl_ae_set_saddr (struct xfrmnl_ae* ae, struct nl_addr* addr)
767 {
768  return __assign_addr(ae, &ae->saddr, addr, XFRM_AE_ATTR_SADDR, 1);
769 }
770 
771 int xfrmnl_ae_get_flags (struct xfrmnl_ae* ae)
772 {
773  if (ae->ce_mask & XFRM_AE_ATTR_FLAGS)
774  return ae->flags;
775  else
776  return -1;
777 }
778 
779 int xfrmnl_ae_set_flags (struct xfrmnl_ae* ae, unsigned int flags)
780 {
781  ae->flags = flags;
782  ae->ce_mask |= XFRM_AE_ATTR_FLAGS;
783 
784  return 0;
785 }
786 
787 int xfrmnl_ae_get_reqid (struct xfrmnl_ae* ae)
788 {
789  if (ae->ce_mask & XFRM_AE_ATTR_REQID)
790  return ae->reqid;
791  else
792  return -1;
793 }
794 
795 int xfrmnl_ae_set_reqid (struct xfrmnl_ae* ae, unsigned int reqid)
796 {
797  ae->reqid = reqid;
798  ae->ce_mask |= XFRM_AE_ATTR_REQID;
799 
800  return 0;
801 }
802 
803 int xfrmnl_ae_get_mark (struct xfrmnl_ae* ae, unsigned int* mark_mask, unsigned int* mark_value)
804 {
805  if (mark_mask == NULL || mark_value == NULL)
806  return -1;
807 
808  if (ae->ce_mask & XFRM_AE_ATTR_MARK)
809  {
810  *mark_mask = ae->mark.m;
811  *mark_value = ae->mark.v;
812 
813  return 0;
814  }
815  else
816  return -1;
817 }
818 
819 int xfrmnl_ae_set_mark (struct xfrmnl_ae* ae, unsigned int value, unsigned int mask)
820 {
821  ae->mark.v = value;
822  ae->mark.m = mask;
823  ae->ce_mask |= XFRM_AE_ATTR_MARK;
824 
825  return 0;
826 }
827 
828 int xfrmnl_ae_get_curlifetime (struct xfrmnl_ae* ae, unsigned long long int* curr_bytes,
829  unsigned long long int* curr_packets, unsigned long long int* curr_add_time,
830  unsigned long long int* curr_use_time)
831 {
832  if (curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
833  return -1;
834 
835  if (ae->ce_mask & XFRM_AE_ATTR_LIFETIME)
836  {
837  *curr_bytes = ae->lifetime_cur.bytes;
838  *curr_packets = ae->lifetime_cur.packets;
839  *curr_add_time = ae->lifetime_cur.add_time;
840  *curr_use_time = ae->lifetime_cur.use_time;
841 
842  return 0;
843  }
844  else
845  return -1;
846 }
847 
848 int xfrmnl_ae_set_curlifetime (struct xfrmnl_ae* ae, unsigned long long int curr_bytes,
849  unsigned long long int curr_packets, unsigned long long int curr_add_time,
850  unsigned long long int curr_use_time)
851 {
852  ae->lifetime_cur.bytes = curr_bytes;
853  ae->lifetime_cur.packets = curr_packets;
854  ae->lifetime_cur.add_time = curr_add_time;
855  ae->lifetime_cur.use_time = curr_use_time;
856  ae->ce_mask |= XFRM_AE_ATTR_LIFETIME;
857 
858  return 0;
859 }
860 
861 int xfrmnl_ae_get_replay_maxage (struct xfrmnl_ae* ae)
862 {
863  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_MAXAGE)
864  return ae->replay_maxage;
865  else
866  return -1;
867 }
868 
869 int xfrmnl_ae_set_replay_maxage (struct xfrmnl_ae* ae, unsigned int replay_maxage)
870 {
871  ae->replay_maxage = replay_maxage;
872  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXAGE;
873 
874  return 0;
875 }
876 
877 int xfrmnl_ae_get_replay_maxdiff (struct xfrmnl_ae* ae)
878 {
879  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_MAXDIFF)
880  return ae->replay_maxdiff;
881  else
882  return -1;
883 }
884 
885 int xfrmnl_ae_set_replay_maxdiff (struct xfrmnl_ae* ae, unsigned int replay_maxdiff)
886 {
887  ae->replay_maxdiff = replay_maxdiff;
888  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXDIFF;
889 
890  return 0;
891 }
892 
893 int xfrmnl_ae_get_replay_state (struct xfrmnl_ae* ae, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
894 {
895  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_STATE)
896  {
897  if (ae->replay_state_esn == NULL)
898  {
899  *oseq = ae->replay_state.oseq;
900  *seq = ae->replay_state.seq;
901  *bmp = ae->replay_state.bitmap;
902 
903  return 0;
904  }
905  else
906  {
907  return -1;
908  }
909  }
910  else
911  return -1;
912 }
913 
914 int xfrmnl_ae_set_replay_state (struct xfrmnl_ae* ae, unsigned int oseq, unsigned int seq, unsigned int bitmap)
915 {
916  ae->replay_state.oseq = oseq;
917  ae->replay_state.seq = seq;
918  ae->replay_state.bitmap = bitmap;
919  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
920 
921  return 0;
922 }
923 
924 int xfrmnl_ae_get_replay_state_esn(struct xfrmnl_ae* ae, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
925  unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
926 {
927  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_STATE)
928  {
929  if (ae->replay_state_esn)
930  {
931  *oseq = ae->replay_state_esn->oseq;
932  *seq = ae->replay_state_esn->seq;
933  *oseq_hi= ae->replay_state_esn->oseq_hi;
934  *seq_hi = ae->replay_state_esn->seq_hi;
935  *replay_window = ae->replay_state_esn->replay_window;
936  *bmp_len = ae->replay_state_esn->bmp_len; // In number of 32 bit words
937  memcpy (bmp, ae->replay_state_esn->bmp, ae->replay_state_esn->bmp_len * sizeof (uint32_t));
938 
939  return 0;
940  }
941  else
942  {
943  return -1;
944  }
945  }
946  else
947  return -1;
948 }
949 
950 int xfrmnl_ae_set_replay_state_esn(struct xfrmnl_ae* ae, unsigned int oseq, unsigned int seq,
951  unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
952  unsigned int bmp_len, unsigned int* bmp)
953 {
954  /* Free the old replay ESN state and allocate new one */
955  if (ae->replay_state_esn)
956  free (ae->replay_state_esn);
957 
958  if ((ae->replay_state_esn = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + sizeof (uint32_t) * bmp_len)) == NULL)
959  return -1;
960 
961  ae->replay_state_esn->oseq = oseq;
962  ae->replay_state_esn->seq = seq;
963  ae->replay_state_esn->oseq_hi = oseq_hi;
964  ae->replay_state_esn->seq_hi = seq_hi;
965  ae->replay_state_esn->replay_window = replay_window;
966  ae->replay_state_esn->bmp_len = bmp_len; // In number of 32 bit words
967  memcpy (ae->replay_state_esn->bmp, bmp, bmp_len * sizeof (uint32_t));
968  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
969 
970  return 0;
971 }
972 
973 /** @} */
974 
975 static struct nl_object_ops xfrm_ae_obj_ops = {
976  .oo_name = "xfrm/ae",
977  .oo_size = sizeof(struct xfrmnl_ae),
978  .oo_free_data = xfrm_ae_free_data,
979  .oo_clone = xfrm_ae_clone,
980  .oo_dump = {
981  [NL_DUMP_LINE] = xfrm_ae_dump_line,
982  [NL_DUMP_DETAILS] = xfrm_ae_dump_details,
983  [NL_DUMP_STATS] = xfrm_ae_dump_stats,
984  },
985  .oo_compare = xfrm_ae_compare,
986  .oo_attrs2str = xfrm_ae_attrs2str,
987  .oo_id_attrs = (XFRM_AE_ATTR_DADDR | XFRM_AE_ATTR_SPI | XFRM_AE_ATTR_PROTO),
988 };
989 
990 /** @} */
991 
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:935
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:993
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:579
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:211
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition: addr.c:887
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:487
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:517
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:947
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:533
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition: attr.h:230
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:114
@ NLA_U32
32 bit integer
Definition: attr.h:37
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:341
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:558
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:208
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:442
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:100
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:214
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:48
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:510
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1241
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1172
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1106
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:955
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:18
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:16
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:17
Dumping parameters.
Definition: types.h:28
Attribute validation policy.
Definition: attr.h:63
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68