libnl 3.8.0
ae.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the
16 * distribution.
17 *
18 * Neither the name of Texas Instruments Incorporated nor the names of
19 * its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36/**
37 * @ingroup xfrmnl
38 * @defgroup ae Attribute Element
39 * @brief
40 *
41 * The AE interface allows a user to retrieve and update various
42 * Security Association (SA) attributes such as lifetime, replay state etc.
43 *
44 * @par AE Flags
45 * @code
46 * XFRM_AE_UNSPEC
47 * XFRM_AE_RTHR=1
48 * XFRM_AE_RVAL=2
49 * XFRM_AE_LVAL=4
50 * XFRM_AE_ETHR=8
51 * XFRM_AE_CR=16
52 * XFRM_AE_CE=32
53 * XFRM_AE_CU=64
54 * @endcode
55 *
56 * @par AE Identification
57 * An AE is uniquely identified by the attributes listed below, whenever
58 * you refer to an existing AE all of the attributes must be set. There is
59 * no cache support for AE since you can retrieve the AE for any given combination
60 * of attributes mentioned below, but not all at once since they just characterize
61 * an SA.
62 * - destination address (xfrmnl_ae_set_daddr())
63 * - SPI (xfrmnl_ae_set_spi)
64 * - protocol (xfrmnl_ae_set_proto)
65 * - mark (xfrmnl_ae_set_mark)
66 *
67 * @par Changeable Attributes
68 * \anchor ae_changeable
69 * - current lifetime (xfrmnl_ae_set_curlifetime())
70 * - replay properties (xfrmnl_ae_set_replay_maxage(), xfrmnl_ae_set_replay_maxdiff())
71 * - replay state (xfrmnl_ae_set_replay_state(), xfrmnl_ae_set_replay_state_esn))
72 *
73 * @par Required Caches for Dumping
74 * None
75 *
76 * @par TODO
77 * None
78 *
79 * @par 1) Retrieving AE information for a given SA tuple
80 * @code
81 * // Create a netlink socket and connect it to XFRM subsystem in
82 * the kernel to be able to send/receive info from userspace.
83 * struct nl_sock* sk = nl_socket_alloc ();
84 * nl_connect (sk, NETLINK_XFRM);
85 *
86 * // AEs can then be looked up by the SA tuple, destination address,
87 * SPI, protocol, mark:
88 * struct xfrmnl_ae *ae;
89 * xfrmnl_ae_get_kernel(sk, dst_addr, spi, proto,mark_mask, mark_value, &ae);
90 *
91 * // After successful usage, the object must be freed
92 * xfrmnl_ae_put(ae);
93 * @endcode
94 *
95 * @par 2) Updating AE
96 * @code
97 * // Allocate an empty AE handle to be filled out with the attributes
98 * // of the new AE.
99 * struct xfrmnl_ae *ae = xfrmnl_ae_alloc();
100 *
101 * // Fill out the attributes of the new AE
102 * xfrmnl_ae_set_daddr(ae, dst_addr);
103 * xfrmnl_ae_set_spi(ae, 0xDEADBEEF);
104 * xfrmnl_ae_set_proto(ae, 50);
105 * xfrmnl_ae_set_mark(ae, 0x0);
106 * xfrmnl_ae_set_saddr(ae, src_addr);
107 * xfrmnl_ae_set_curlifetime(ae, 540, 10, 0xAABB1122, 0x0);
108 *
109 * // Build the netlink message and send it to the kernel, the operation will
110 * // block until the operation has been completed. Alternatively, a netlink message
111 * // can be built using xfrmnl_ae_build_get_request () API and be sent using
112 * // nl_send_auto(). Further the result from the kernel can be parsed using
113 * // xfrmnl_ae_parse() API.
114 * xfrmnl_ae_set(sk, ae, NLM_F_REPLACE);
115 *
116 * // Free the memory
117 * xfrmnl_ae_put(ae);
118 * @endcode
119 *
120 * @{
121 */
122
123#include "nl-default.h"
124
125#include <linux/xfrm.h>
126
127#include <netlink/netlink.h>
128#include <netlink/cache.h>
129#include <netlink/object.h>
130#include <netlink/xfrm/ae.h>
131
132#include "nl-xfrm.h"
133#include "nl-priv-dynamic-core/object-api.h"
134#include "nl-priv-dynamic-core/nl-core.h"
135#include "nl-priv-dynamic-core/cache-api.h"
136
137/** @cond SKIP */
138
139struct xfrmnl_sa_id {
140 struct nl_addr* daddr;
141 uint32_t spi;
142 uint16_t family;
143 uint8_t proto;
144};
145
146struct xfrmnl_ae {
147 NLHDR_COMMON
148
149 struct xfrmnl_sa_id sa_id;
150 struct nl_addr* saddr;
151 uint32_t flags;
152 uint32_t reqid;
153 struct xfrmnl_mark mark;
154 struct xfrmnl_lifetime_cur lifetime_cur;
155 uint32_t replay_maxage;
156 uint32_t replay_maxdiff;
157 struct xfrmnl_replay_state replay_state;
158 struct xfrmnl_replay_state_esn* replay_state_esn;
159};
160
161#define XFRM_AE_ATTR_DADDR 0x01
162#define XFRM_AE_ATTR_SPI 0x02
163#define XFRM_AE_ATTR_PROTO 0x04
164#define XFRM_AE_ATTR_SADDR 0x08
165#define XFRM_AE_ATTR_FLAGS 0x10
166#define XFRM_AE_ATTR_REQID 0x20
167#define XFRM_AE_ATTR_MARK 0x40
168#define XFRM_AE_ATTR_LIFETIME 0x80
169#define XFRM_AE_ATTR_REPLAY_MAXAGE 0x100
170#define XFRM_AE_ATTR_REPLAY_MAXDIFF 0x200
171#define XFRM_AE_ATTR_REPLAY_STATE 0x400
172#define XFRM_AE_ATTR_FAMILY 0x800
173
174static struct nl_object_ops xfrm_ae_obj_ops;
175/** @endcond */
176
177
178static void xfrm_ae_free_data(struct nl_object *c)
179{
180 struct xfrmnl_ae* ae = nl_object_priv (c);
181
182 if (ae == NULL)
183 return;
184
185 nl_addr_put (ae->sa_id.daddr);
186 nl_addr_put (ae->saddr);
187
188 if (ae->replay_state_esn)
189 free (ae->replay_state_esn);
190}
191
192static int xfrm_ae_clone(struct nl_object *_dst, struct nl_object *_src)
193{
194 struct xfrmnl_ae* dst = nl_object_priv(_dst);
195 struct xfrmnl_ae* src = nl_object_priv(_src);
196
197 dst->sa_id.daddr = NULL;
198 dst->saddr = NULL;
199 dst->replay_state_esn = NULL;
200
201 if (src->sa_id.daddr) {
202 if ((dst->sa_id.daddr = nl_addr_clone (src->sa_id.daddr)) == NULL)
203 return -NLE_NOMEM;
204 }
205
206 if (src->saddr) {
207 if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
208 return -NLE_NOMEM;
209 }
210
211 if (src->replay_state_esn) {
212 uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * src->replay_state_esn->bmp_len);
213
214 if ((dst->replay_state_esn = malloc (len)) == NULL)
215 return -NLE_NOMEM;
216 memcpy (dst->replay_state_esn, src->replay_state_esn, len);
217 }
218
219 return 0;
220}
221
222static uint64_t xfrm_ae_compare(struct nl_object *_a, struct nl_object *_b,
223 uint64_t attrs, int flags)
224{
225 struct xfrmnl_ae* a = (struct xfrmnl_ae *) _a;
226 struct xfrmnl_ae* b = (struct xfrmnl_ae *) _b;
227 uint64_t diff = 0;
228 int found = 0;
229
230#define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
231 diff |= _DIFF(XFRM_AE_ATTR_DADDR,
232 nl_addr_cmp(a->sa_id.daddr, b->sa_id.daddr));
233 diff |= _DIFF(XFRM_AE_ATTR_SPI, a->sa_id.spi != b->sa_id.spi);
234 diff |= _DIFF(XFRM_AE_ATTR_PROTO, a->sa_id.proto != b->sa_id.proto);
235 diff |= _DIFF(XFRM_AE_ATTR_SADDR, nl_addr_cmp(a->saddr, b->saddr));
236 diff |= _DIFF(XFRM_AE_ATTR_FLAGS, a->flags != b->flags);
237 diff |= _DIFF(XFRM_AE_ATTR_REQID, a->reqid != b->reqid);
238 diff |= _DIFF(XFRM_AE_ATTR_MARK,
239 (a->mark.v & a->mark.m) != (b->mark.v & b->mark.m));
240 diff |= _DIFF(XFRM_AE_ATTR_REPLAY_MAXAGE,
241 a->replay_maxage != b->replay_maxage);
242 diff |= _DIFF(XFRM_AE_ATTR_REPLAY_MAXDIFF,
243 a->replay_maxdiff != b->replay_maxdiff);
244
245 /* Compare replay states */
246 found = AVAILABLE_MISMATCH (a, b, XFRM_AE_ATTR_REPLAY_STATE);
247 if (found == 0) // attribute exists in both objects
248 {
249 if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
250 ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
251 found |= 1;
252
253 if (found == 0) // same replay type. compare actual values
254 {
255 if (a->replay_state_esn)
256 {
257 if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
258 diff |= 1;
259 else
260 {
261 uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * a->replay_state_esn->bmp_len);
262 diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
263 }
264 }
265 else
266 {
267 if ((a->replay_state.oseq != b->replay_state.oseq) ||
268 (a->replay_state.seq != b->replay_state.seq) ||
269 (a->replay_state.bitmap != b->replay_state.bitmap))
270 diff |= 1;
271 }
272 }
273 }
274#undef _DIFF
275
276 return diff;
277}
278
279/**
280 * @name XFRM AE Attribute Translations
281 * @{
282 */
283static const struct trans_tbl ae_attrs[] =
284{
285 __ADD(XFRM_AE_ATTR_DADDR, daddr),
286 __ADD(XFRM_AE_ATTR_SPI, spi),
287 __ADD(XFRM_AE_ATTR_PROTO, protocol),
288 __ADD(XFRM_AE_ATTR_SADDR, saddr),
289 __ADD(XFRM_AE_ATTR_FLAGS, flags),
290 __ADD(XFRM_AE_ATTR_REQID, reqid),
291 __ADD(XFRM_AE_ATTR_MARK, mark),
292 __ADD(XFRM_AE_ATTR_LIFETIME, cur_lifetime),
293 __ADD(XFRM_AE_ATTR_REPLAY_MAXAGE, replay_maxage),
294 __ADD(XFRM_AE_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
295 __ADD(XFRM_AE_ATTR_REPLAY_STATE, replay_state),
296};
297
298static char* xfrm_ae_attrs2str (int attrs, char *buf, size_t len)
299{
300 return __flags2str(attrs, buf, len, ae_attrs, ARRAY_SIZE(ae_attrs));
301}
302/** @} */
303
304/**
305 * @name XFRM AE Flags Translations
306 * @{
307 */
308
309static const struct trans_tbl ae_flags[] = {
310 __ADD(XFRM_AE_UNSPEC, unspecified),
311 __ADD(XFRM_AE_RTHR, replay threshold),
312 __ADD(XFRM_AE_RVAL, replay value),
313 __ADD(XFRM_AE_LVAL, lifetime value),
314 __ADD(XFRM_AE_ETHR, expiry time threshold),
315 __ADD(XFRM_AE_CR, replay update event),
316 __ADD(XFRM_AE_CE, timer expiry event),
317 __ADD(XFRM_AE_CU, policy update event),
318};
319
320char* xfrmnl_ae_flags2str(int flags, char *buf, size_t len)
321{
322 return __flags2str (flags, buf, len, ae_flags, ARRAY_SIZE(ae_flags));
323}
324
325int xfrmnl_ae_str2flag(const char *name)
326{
327 return __str2flags(name, ae_flags, ARRAY_SIZE(ae_flags));
328}
329/** @} */
330
331static void xfrm_ae_dump_line(struct nl_object *a, struct nl_dump_params *p)
332{
333 char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
334 struct xfrmnl_ae* ae = (struct xfrmnl_ae *) a;
335 char flags[128], buf[128];
336 time_t add_time, use_time;
337 struct tm *add_time_tm, *use_time_tm;
338 struct tm tm_buf;
339
340 nl_dump_line(p, "src %s dst %s \n", nl_addr2str(ae->saddr, src, sizeof(src)),
341 nl_addr2str(ae->sa_id.daddr, dst, sizeof(dst)));
342
343 nl_dump_line(p, "\tproto %s spi 0x%x reqid %u ",
344 nl_ip_proto2str (ae->sa_id.proto, buf, sizeof (buf)),
345 ae->sa_id.spi, ae->reqid);
346
347 xfrmnl_ae_flags2str(ae->flags, flags, sizeof (flags));
348 nl_dump_line(p, "flags %s(0x%x) mark mask/value 0x%x/0x%x \n", flags,
349 ae->flags, ae->mark.m, ae->mark.v);
350
351 nl_dump_line(p, "\tlifetime current: \n");
352 nl_dump_line(p, "\t\tbytes %llu packets %llu \n",
353 (long long unsigned)ae->lifetime_cur.bytes,
354 (long long unsigned)ae->lifetime_cur.packets);
355 if (ae->lifetime_cur.add_time != 0)
356 {
357 add_time = ae->lifetime_cur.add_time;
358 add_time_tm = gmtime_r (&add_time, &tm_buf);
359 strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
360 }
361 else
362 {
363 sprintf (flags, "%s", "-");
364 }
365
366 if (ae->lifetime_cur.use_time != 0)
367 {
368 use_time = ae->lifetime_cur.use_time;
369 use_time_tm = gmtime_r (&use_time, &tm_buf);
370 strftime (buf, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
371 }
372 else
373 {
374 sprintf (buf, "%s", "-");
375 }
376 nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, buf);
377
378 nl_dump_line(p, "\treplay info: \n");
379 nl_dump_line(p, "\t\tmax age %u max diff %u \n", ae->replay_maxage, ae->replay_maxdiff);
380
381 nl_dump_line(p, "\treplay state info: \n");
382 if (ae->replay_state_esn)
383 {
384 nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
385 ae->replay_state_esn->oseq, ae->replay_state_esn->seq,
386 ae->replay_state_esn->oseq_hi, ae->replay_state_esn->seq_hi,
387 ae->replay_state_esn->replay_window);
388 }
389 else
390 {
391 nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", ae->replay_state.oseq,
392 ae->replay_state.seq, ae->replay_state.bitmap);
393 }
394
395 nl_dump(p, "\n");
396}
397
398static void xfrm_ae_dump_details(struct nl_object *a, struct nl_dump_params *p)
399{
400 xfrm_ae_dump_line(a, p);
401}
402
403static void xfrm_ae_dump_stats(struct nl_object *a, struct nl_dump_params *p)
404{
405 xfrm_ae_dump_details(a, p);
406}
407
408
409static int build_xfrm_ae_message(struct xfrmnl_ae *tmpl, int cmd, int flags,
410 struct nl_msg **result)
411{
412 struct nl_msg* msg;
413 struct xfrm_aevent_id ae_id;
414
415 if (!(tmpl->ce_mask & XFRM_AE_ATTR_DADDR) ||
416 !(tmpl->ce_mask & XFRM_AE_ATTR_SPI) ||
417 !(tmpl->ce_mask & XFRM_AE_ATTR_PROTO))
418 return -NLE_MISSING_ATTR;
419
420 memset(&ae_id, 0, sizeof(ae_id));
421
422 memcpy (&ae_id.sa_id.daddr, nl_addr_get_binary_addr (tmpl->sa_id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->sa_id.daddr));
423 ae_id.sa_id.spi = htonl(tmpl->sa_id.spi);
424 ae_id.sa_id.family = tmpl->sa_id.family;
425 ae_id.sa_id.proto = tmpl->sa_id.proto;
426
427 if (tmpl->ce_mask & XFRM_AE_ATTR_SADDR)
428 memcpy (&ae_id.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
429
430 if (tmpl->ce_mask & XFRM_AE_ATTR_FLAGS)
431 ae_id.flags = tmpl->flags;
432
433 if (tmpl->ce_mask & XFRM_AE_ATTR_REQID)
434 ae_id.reqid = tmpl->reqid;
435
436 msg = nlmsg_alloc_simple(cmd, flags);
437 if (!msg)
438 return -NLE_NOMEM;
439
440 if (nlmsg_append(msg, &ae_id, sizeof(ae_id), NLMSG_ALIGNTO) < 0)
441 goto nla_put_failure;
442
443 if (tmpl->ce_mask & XFRM_AE_ATTR_MARK)
444 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrmnl_mark), &tmpl->mark);
445
446 if (tmpl->ce_mask & XFRM_AE_ATTR_LIFETIME)
447 NLA_PUT (msg, XFRMA_LTIME_VAL, sizeof (struct xfrmnl_lifetime_cur), &tmpl->lifetime_cur);
448
449 if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_MAXAGE)
450 NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
451
452 if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_MAXDIFF)
453 NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
454
455 if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_STATE) {
456 if (tmpl->replay_state_esn) {
457 uint32_t len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
458 NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
459 }
460 else {
461 NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrmnl_replay_state), &tmpl->replay_state);
462 }
463 }
464
465 *result = msg;
466 return 0;
467
468nla_put_failure:
469 nlmsg_free(msg);
470 return -NLE_MSGSIZE;
471}
472
473/**
474 * @name XFRM AE Update
475 * @{
476 */
477
478int xfrmnl_ae_set(struct nl_sock* sk, struct xfrmnl_ae* ae, int flags)
479{
480 int err;
481 struct nl_msg *msg;
482
483 if ((err = build_xfrm_ae_message(ae, XFRM_MSG_NEWAE, flags|NLM_F_REPLACE, &msg)) < 0)
484 return err;
485
486 err = nl_send_auto_complete(sk, msg);
487 nlmsg_free(msg);
488 if (err < 0)
489 return err;
490
491 return nl_wait_for_ack(sk);
492}
493
494/** @} */
495
496/**
497 * @name XFRM AE Object Allocation/Freeage
498 * @{
499 */
500
501struct xfrmnl_ae* xfrmnl_ae_alloc(void)
502{
503 return (struct xfrmnl_ae*) nl_object_alloc(&xfrm_ae_obj_ops);
504}
505
506void xfrmnl_ae_put(struct xfrmnl_ae* ae)
507{
508 nl_object_put((struct nl_object *) ae);
509}
510
511/** @} */
512
513static struct nla_policy xfrm_ae_policy[XFRMA_MAX+1] = {
514 [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
515 [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
516 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
517 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
518 [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
519 [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
520 [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
521};
522
523int xfrmnl_ae_parse(struct nlmsghdr *n, struct xfrmnl_ae **result)
524{
525 struct xfrmnl_ae* ae;
526 struct nlattr *tb[XFRMA_MAX + 1];
527 struct xfrm_aevent_id* ae_id;
528 int err;
529
530 ae = xfrmnl_ae_alloc();
531 if (!ae) {
532 err = -NLE_NOMEM;
533 goto errout;
534 }
535
536 ae->ce_msgtype = n->nlmsg_type;
537 ae_id = nlmsg_data(n);
538
539 err = nlmsg_parse(n, sizeof(struct xfrm_aevent_id), tb, XFRMA_MAX, xfrm_ae_policy);
540 if (err < 0)
541 goto errout;
542
543 ae->sa_id.daddr = nl_addr_build(ae_id->sa_id.family, &ae_id->sa_id.daddr, sizeof (ae_id->sa_id.daddr));
544 ae->sa_id.family= ae_id->sa_id.family;
545 ae->sa_id.spi = ntohl(ae_id->sa_id.spi);
546 ae->sa_id.proto = ae_id->sa_id.proto;
547 ae->saddr = nl_addr_build(ae_id->sa_id.family, &ae_id->saddr, sizeof (ae_id->saddr));
548 ae->reqid = ae_id->reqid;
549 ae->flags = ae_id->flags;
550 ae->ce_mask |= (XFRM_AE_ATTR_DADDR | XFRM_AE_ATTR_FAMILY | XFRM_AE_ATTR_SPI |
551 XFRM_AE_ATTR_PROTO | XFRM_AE_ATTR_SADDR | XFRM_AE_ATTR_REQID |
552 XFRM_AE_ATTR_FLAGS);
553
554 if (tb[XFRMA_MARK]) {
555 struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
556 ae->mark.m = m->m;
557 ae->mark.v = m->v;
558 ae->ce_mask |= XFRM_AE_ATTR_MARK;
559 }
560
561 if (tb[XFRMA_LTIME_VAL]) {
562 struct xfrm_lifetime_cur* cur = nla_data(tb[XFRMA_LTIME_VAL]);
563 ae->lifetime_cur.bytes = cur->bytes;
564 ae->lifetime_cur.packets = cur->packets;
565 ae->lifetime_cur.add_time = cur->add_time;
566 ae->lifetime_cur.use_time = cur->use_time;
567 ae->ce_mask |= XFRM_AE_ATTR_LIFETIME;
568 }
569
570 if (tb[XFRM_AE_ETHR]) {
571 ae->replay_maxage = *(uint32_t*)nla_data(tb[XFRM_AE_ETHR]);
572 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXAGE;
573 }
574
575 if (tb[XFRM_AE_RTHR]) {
576 ae->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRM_AE_RTHR]);
577 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXDIFF;
578 }
579
580 if (tb[XFRMA_REPLAY_ESN_VAL]) {
581 struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
582 uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
583
584 if ((ae->replay_state_esn = calloc (1, len)) == NULL) {
585 err = -ENOMEM;
586 goto errout;
587 }
588 ae->replay_state_esn->oseq = esn->oseq;
589 ae->replay_state_esn->seq = esn->seq;
590 ae->replay_state_esn->oseq_hi = esn->oseq_hi;
591 ae->replay_state_esn->seq_hi = esn->seq_hi;
592 ae->replay_state_esn->replay_window = esn->replay_window;
593 ae->replay_state_esn->bmp_len = esn->bmp_len;
594 memcpy (ae->replay_state_esn->bmp, esn->bmp, sizeof (uint32_t) * esn->bmp_len);
595 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
596 }
597 else
598 {
599 struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
600 ae->replay_state.oseq = replay_state->oseq;
601 ae->replay_state.seq = replay_state->seq;
602 ae->replay_state.bitmap = replay_state->bitmap;
603 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
604
605 ae->replay_state_esn = NULL;
606 }
607
608 *result = ae;
609 return 0;
610
611errout:
612 xfrmnl_ae_put(ae);
613 return err;
614}
615
616static int xfrm_ae_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
617 struct nlmsghdr *n, struct nl_parser_param *pp)
618{
619 struct xfrmnl_ae* ae;
620 int err;
621
622 if ((err = xfrmnl_ae_parse(n, &ae)) < 0)
623 return err;
624
625 err = pp->pp_cb((struct nl_object *) ae, pp);
626
627 xfrmnl_ae_put(ae);
628 return err;
629}
630
631/**
632 * @name XFRM AE Get
633 * @{
634 */
635
636int xfrmnl_ae_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol,
637 unsigned int mark_mask, unsigned int mark_value, struct nl_msg **result)
638{
639 struct nl_msg *msg;
640 struct xfrm_aevent_id ae_id;
641 struct xfrmnl_mark mark;
642
643 if (!daddr || !spi)
644 {
645 fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
646 __FILE__, __LINE__, __func__);
647 assert(0);
648 return -NLE_MISSING_ATTR;
649 }
650
651 memset(&ae_id, 0, sizeof(ae_id));
652 memcpy (&ae_id.sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
653 ae_id.sa_id.spi = htonl(spi);
654 ae_id.sa_id.family = nl_addr_get_family (daddr);
655 ae_id.sa_id.proto = protocol;
656
657 if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETAE, 0)))
658 return -NLE_NOMEM;
659
660 if (nlmsg_append(msg, &ae_id, sizeof(ae_id), NLMSG_ALIGNTO) < 0)
661 goto nla_put_failure;
662
663 mark.m = mark_mask;
664 mark.v = mark_value;
665 NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrmnl_mark), &mark);
666
667 *result = msg;
668 return 0;
669
670nla_put_failure:
671 nlmsg_free(msg);
672 return -NLE_MSGSIZE;
673}
674
675int xfrmnl_ae_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol,
676 unsigned int mark_mask, unsigned int mark_value, struct xfrmnl_ae** result)
677{
678 struct nl_msg *msg = NULL;
679 struct nl_object *obj;
680 int err;
681
682 if ((err = xfrmnl_ae_build_get_request(daddr, spi, protocol, mark_mask, mark_value, &msg)) < 0)
683 return err;
684
685 err = nl_send_auto(sock, msg);
686 nlmsg_free(msg);
687 if (err < 0)
688 return err;
689
690 if ((err = nl_pickup(sock, &xfrm_ae_msg_parser, &obj)) < 0)
691 return err;
692
693 /* We have used xfrm_ae_msg_parser(), object is definitely a xfrm ae */
694 *result = (struct xfrmnl_ae *) obj;
695
696 /* If an object has been returned, we also need to wait for the ACK */
697 if (err == 0 && obj)
698 nl_wait_for_ack(sock);
699
700 return 0;
701}
702
703/** @} */
704
705/**
706 * @name Attributes
707 * @{
708 */
709
710static inline int __assign_addr(struct xfrmnl_ae* ae, struct nl_addr **pos,
711 struct nl_addr *new, int flag, int nocheck)
712{
713 if (!nocheck) {
714 if (ae->ce_mask & XFRM_AE_ATTR_FAMILY) {
715 if (nl_addr_get_family (new) != ae->sa_id.family)
716 return -NLE_AF_MISMATCH;
717 } else {
718 ae->sa_id.family = nl_addr_get_family (new);
719 ae->ce_mask |= XFRM_AE_ATTR_FAMILY;
720 }
721 }
722
723 if (*pos)
724 nl_addr_put(*pos);
725
726 nl_addr_get(new);
727 *pos = new;
728
729 ae->ce_mask |= flag;
730
731 return 0;
732}
733
734
735struct nl_addr* xfrmnl_ae_get_daddr (struct xfrmnl_ae* ae)
736{
737 if (ae->ce_mask & XFRM_AE_ATTR_DADDR)
738 return ae->sa_id.daddr;
739 else
740 return NULL;
741}
742
743int xfrmnl_ae_set_daddr (struct xfrmnl_ae* ae, struct nl_addr* addr)
744{
745 return __assign_addr(ae, &ae->sa_id.daddr, addr, XFRM_AE_ATTR_DADDR, 0);
746}
747
748int xfrmnl_ae_get_spi (struct xfrmnl_ae* ae)
749{
750 if (ae->ce_mask & XFRM_AE_ATTR_SPI)
751 return ae->sa_id.spi;
752 else
753 return -1;
754}
755
756int xfrmnl_ae_set_spi (struct xfrmnl_ae* ae, unsigned int spi)
757{
758 ae->sa_id.spi = spi;
759 ae->ce_mask |= XFRM_AE_ATTR_SPI;
760
761 return 0;
762}
763
764int xfrmnl_ae_get_family (struct xfrmnl_ae* ae)
765{
766 if (ae->ce_mask & XFRM_AE_ATTR_FAMILY)
767 return ae->sa_id.family;
768 else
769 return -1;
770}
771
772int xfrmnl_ae_set_family (struct xfrmnl_ae* ae, unsigned int family)
773{
774 ae->sa_id.family = family;
775 ae->ce_mask |= XFRM_AE_ATTR_FAMILY;
776
777 return 0;
778}
779
780int xfrmnl_ae_get_proto (struct xfrmnl_ae* ae)
781{
782 if (ae->ce_mask & XFRM_AE_ATTR_PROTO)
783 return ae->sa_id.proto;
784 else
785 return -1;
786}
787
788int xfrmnl_ae_set_proto (struct xfrmnl_ae* ae, unsigned int protocol)
789{
790 ae->sa_id.proto = protocol;
791 ae->ce_mask |= XFRM_AE_ATTR_PROTO;
792
793 return 0;
794}
795
796struct nl_addr* xfrmnl_ae_get_saddr (struct xfrmnl_ae* ae)
797{
798 if (ae->ce_mask & XFRM_AE_ATTR_SADDR)
799 return ae->saddr;
800 else
801 return NULL;
802}
803
804int xfrmnl_ae_set_saddr (struct xfrmnl_ae* ae, struct nl_addr* addr)
805{
806 return __assign_addr(ae, &ae->saddr, addr, XFRM_AE_ATTR_SADDR, 1);
807}
808
809int xfrmnl_ae_get_flags (struct xfrmnl_ae* ae)
810{
811 if (ae->ce_mask & XFRM_AE_ATTR_FLAGS)
812 return ae->flags;
813 else
814 return -1;
815}
816
817int xfrmnl_ae_set_flags (struct xfrmnl_ae* ae, unsigned int flags)
818{
819 ae->flags = flags;
820 ae->ce_mask |= XFRM_AE_ATTR_FLAGS;
821
822 return 0;
823}
824
825int xfrmnl_ae_get_reqid (struct xfrmnl_ae* ae)
826{
827 if (ae->ce_mask & XFRM_AE_ATTR_REQID)
828 return ae->reqid;
829 else
830 return -1;
831}
832
833int xfrmnl_ae_set_reqid (struct xfrmnl_ae* ae, unsigned int reqid)
834{
835 ae->reqid = reqid;
836 ae->ce_mask |= XFRM_AE_ATTR_REQID;
837
838 return 0;
839}
840
841int xfrmnl_ae_get_mark (struct xfrmnl_ae* ae, unsigned int* mark_mask, unsigned int* mark_value)
842{
843 if (mark_mask == NULL || mark_value == NULL)
844 return -1;
845
846 if (ae->ce_mask & XFRM_AE_ATTR_MARK)
847 {
848 *mark_mask = ae->mark.m;
849 *mark_value = ae->mark.v;
850
851 return 0;
852 }
853 else
854 return -1;
855}
856
857int xfrmnl_ae_set_mark (struct xfrmnl_ae* ae, unsigned int value, unsigned int mask)
858{
859 ae->mark.v = value;
860 ae->mark.m = mask;
861 ae->ce_mask |= XFRM_AE_ATTR_MARK;
862
863 return 0;
864}
865
866int xfrmnl_ae_get_curlifetime (struct xfrmnl_ae* ae, unsigned long long int* curr_bytes,
867 unsigned long long int* curr_packets, unsigned long long int* curr_add_time,
868 unsigned long long int* curr_use_time)
869{
870 if (curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
871 return -1;
872
873 if (ae->ce_mask & XFRM_AE_ATTR_LIFETIME)
874 {
875 *curr_bytes = ae->lifetime_cur.bytes;
876 *curr_packets = ae->lifetime_cur.packets;
877 *curr_add_time = ae->lifetime_cur.add_time;
878 *curr_use_time = ae->lifetime_cur.use_time;
879
880 return 0;
881 }
882 else
883 return -1;
884}
885
886int xfrmnl_ae_set_curlifetime (struct xfrmnl_ae* ae, unsigned long long int curr_bytes,
887 unsigned long long int curr_packets, unsigned long long int curr_add_time,
888 unsigned long long int curr_use_time)
889{
890 ae->lifetime_cur.bytes = curr_bytes;
891 ae->lifetime_cur.packets = curr_packets;
892 ae->lifetime_cur.add_time = curr_add_time;
893 ae->lifetime_cur.use_time = curr_use_time;
894 ae->ce_mask |= XFRM_AE_ATTR_LIFETIME;
895
896 return 0;
897}
898
899int xfrmnl_ae_get_replay_maxage (struct xfrmnl_ae* ae)
900{
901 if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_MAXAGE)
902 return ae->replay_maxage;
903 else
904 return -1;
905}
906
907int xfrmnl_ae_set_replay_maxage (struct xfrmnl_ae* ae, unsigned int replay_maxage)
908{
909 ae->replay_maxage = replay_maxage;
910 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXAGE;
911
912 return 0;
913}
914
915int xfrmnl_ae_get_replay_maxdiff (struct xfrmnl_ae* ae)
916{
917 if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_MAXDIFF)
918 return ae->replay_maxdiff;
919 else
920 return -1;
921}
922
923int xfrmnl_ae_set_replay_maxdiff (struct xfrmnl_ae* ae, unsigned int replay_maxdiff)
924{
925 ae->replay_maxdiff = replay_maxdiff;
926 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXDIFF;
927
928 return 0;
929}
930
931int xfrmnl_ae_get_replay_state (struct xfrmnl_ae* ae, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
932{
933 if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_STATE)
934 {
935 if (ae->replay_state_esn == NULL)
936 {
937 *oseq = ae->replay_state.oseq;
938 *seq = ae->replay_state.seq;
939 *bmp = ae->replay_state.bitmap;
940
941 return 0;
942 }
943 else
944 {
945 return -1;
946 }
947 }
948 else
949 return -1;
950}
951
952int xfrmnl_ae_set_replay_state (struct xfrmnl_ae* ae, unsigned int oseq, unsigned int seq, unsigned int bitmap)
953{
954 ae->replay_state.oseq = oseq;
955 ae->replay_state.seq = seq;
956 ae->replay_state.bitmap = bitmap;
957 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
958
959 return 0;
960}
961
962int xfrmnl_ae_get_replay_state_esn(struct xfrmnl_ae* ae, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
963 unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
964{
965 if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_STATE)
966 {
967 if (ae->replay_state_esn)
968 {
969 *oseq = ae->replay_state_esn->oseq;
970 *seq = ae->replay_state_esn->seq;
971 *oseq_hi= ae->replay_state_esn->oseq_hi;
972 *seq_hi = ae->replay_state_esn->seq_hi;
973 *replay_window = ae->replay_state_esn->replay_window;
974 *bmp_len = ae->replay_state_esn->bmp_len; // In number of 32 bit words
975 memcpy (bmp, ae->replay_state_esn->bmp, ae->replay_state_esn->bmp_len * sizeof (uint32_t));
976
977 return 0;
978 }
979 else
980 {
981 return -1;
982 }
983 }
984 else
985 return -1;
986}
987
988int xfrmnl_ae_set_replay_state_esn(struct xfrmnl_ae* ae, unsigned int oseq, unsigned int seq,
989 unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
990 unsigned int bmp_len, unsigned int* bmp)
991{
992 /* Free the old replay ESN state and allocate new one */
993 if (ae->replay_state_esn)
994 free (ae->replay_state_esn);
995
996 if ((ae->replay_state_esn = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + sizeof (uint32_t) * bmp_len)) == NULL)
997 return -1;
998
999 ae->replay_state_esn->oseq = oseq;
1000 ae->replay_state_esn->seq = seq;
1001 ae->replay_state_esn->oseq_hi = oseq_hi;
1002 ae->replay_state_esn->seq_hi = seq_hi;
1003 ae->replay_state_esn->replay_window = replay_window;
1004 ae->replay_state_esn->bmp_len = bmp_len; // In number of 32 bit words
1005 memcpy (ae->replay_state_esn->bmp, bmp, bmp_len * sizeof (uint32_t));
1006 ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
1007
1008 return 0;
1009}
1010
1011/** @} */
1012
1013static struct nl_object_ops xfrm_ae_obj_ops = {
1014 .oo_name = "xfrm/ae",
1015 .oo_size = sizeof(struct xfrmnl_ae),
1016 .oo_free_data = xfrm_ae_free_data,
1017 .oo_clone = xfrm_ae_clone,
1018 .oo_dump = {
1019 [NL_DUMP_LINE] = xfrm_ae_dump_line,
1020 [NL_DUMP_DETAILS] = xfrm_ae_dump_details,
1021 [NL_DUMP_STATS] = xfrm_ae_dump_stats,
1022 },
1023 .oo_compare = xfrm_ae_compare,
1024 .oo_attrs2str = xfrm_ae_attrs2str,
1025 .oo_id_attrs = (XFRM_AE_ATTR_DADDR | XFRM_AE_ATTR_SPI | XFRM_AE_ATTR_PROTO),
1026};
1027
1028/** @} */
1029
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:527
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:216
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:945
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:589
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:497
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition: addr.c:897
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:1003
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:957
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:543
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:119
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition: attr.h:230
@ NLA_U32
32 bit integer
Definition: attr.h:37
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:349
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:108
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:566
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:216
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:450
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:221
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:55
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:515
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1246
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1177
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1111
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:1017
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:22
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:20
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:21
Dumping parameters.
Definition: types.h:32
Attribute validation policy.
Definition: attr.h:63
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68