libnl  3.7.0
sa.c
1 /* SPDX-License-Identifier: LGPL-2.1-only */
2 /*
3  * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4  *
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * Redistributions of source code must retain the above copyright
11  * notice, this list of conditions and the following disclaimer.
12  *
13  * Redistributions in binary form must reproduce the above copyright
14  * notice, this list of conditions and the following disclaimer in the
15  * documentation and/or other materials provided with the
16  * distribution.
17  *
18  * Neither the name of Texas Instruments Incorporated nor the names of
19  * its contributors may be used to endorse or promote products derived
20  * from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 /**
37  * @ingroup xfrmnl
38  * @defgroup sa Security Association
39  * @brief
40  */
41 
42 #include <netlink-private/netlink.h>
43 #include <netlink/netlink.h>
44 #include <netlink/cache.h>
45 #include <netlink/object.h>
46 #include <netlink/xfrm/sa.h>
47 #include <netlink/xfrm/selector.h>
48 #include <netlink/xfrm/lifetime.h>
49 #include <time.h>
50 
51 #include "netlink-private/utils.h"
52 
53 /** @cond SKIP */
54 #define XFRM_SA_ATTR_SEL 0x01
55 #define XFRM_SA_ATTR_DADDR 0x02
56 #define XFRM_SA_ATTR_SPI 0x04
57 #define XFRM_SA_ATTR_PROTO 0x08
58 #define XFRM_SA_ATTR_SADDR 0x10
59 #define XFRM_SA_ATTR_LTIME_CFG 0x20
60 #define XFRM_SA_ATTR_LTIME_CUR 0x40
61 #define XFRM_SA_ATTR_STATS 0x80
62 #define XFRM_SA_ATTR_SEQ 0x100
63 #define XFRM_SA_ATTR_REQID 0x200
64 #define XFRM_SA_ATTR_FAMILY 0x400
65 #define XFRM_SA_ATTR_MODE 0x800
66 #define XFRM_SA_ATTR_REPLAY_WIN 0x1000
67 #define XFRM_SA_ATTR_FLAGS 0x2000
68 #define XFRM_SA_ATTR_ALG_AEAD 0x4000
69 #define XFRM_SA_ATTR_ALG_AUTH 0x8000
70 #define XFRM_SA_ATTR_ALG_CRYPT 0x10000
71 #define XFRM_SA_ATTR_ALG_COMP 0x20000
72 #define XFRM_SA_ATTR_ENCAP 0x40000
73 #define XFRM_SA_ATTR_TFCPAD 0x80000
74 #define XFRM_SA_ATTR_COADDR 0x100000
75 #define XFRM_SA_ATTR_MARK 0x200000
76 #define XFRM_SA_ATTR_SECCTX 0x400000
77 #define XFRM_SA_ATTR_REPLAY_MAXAGE 0x800000
78 #define XFRM_SA_ATTR_REPLAY_MAXDIFF 0x1000000
79 #define XFRM_SA_ATTR_REPLAY_STATE 0x2000000
80 #define XFRM_SA_ATTR_EXPIRE 0x4000000
81 #define XFRM_SA_ATTR_OFFLOAD_DEV 0x8000000
82 
83 static struct nl_cache_ops xfrmnl_sa_ops;
84 static struct nl_object_ops xfrm_sa_obj_ops;
85 /** @endcond */
86 
87 static void xfrm_sa_alloc_data(struct nl_object *c)
88 {
89  struct xfrmnl_sa* sa = nl_object_priv (c);
90 
91  if ((sa->sel = xfrmnl_sel_alloc ()) == NULL)
92  return;
93 
94  if ((sa->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
95  return;
96 }
97 
98 static void xfrm_sa_free_data(struct nl_object *c)
99 {
100  struct xfrmnl_sa* sa = nl_object_priv (c);
101 
102  if (sa == NULL)
103  return;
104 
105  xfrmnl_sel_put (sa->sel);
106  xfrmnl_ltime_cfg_put (sa->lft);
107  nl_addr_put (sa->id.daddr);
108  nl_addr_put (sa->saddr);
109 
110  if (sa->aead)
111  free (sa->aead);
112  if (sa->auth)
113  free (sa->auth);
114  if (sa->crypt)
115  free (sa->crypt);
116  if (sa->comp)
117  free (sa->comp);
118  if (sa->encap) {
119  if (sa->encap->encap_oa)
120  nl_addr_put(sa->encap->encap_oa);
121  free(sa->encap);
122  }
123  if (sa->coaddr)
124  nl_addr_put (sa->coaddr);
125  if (sa->sec_ctx)
126  free (sa->sec_ctx);
127  if (sa->replay_state_esn)
128  free (sa->replay_state_esn);
129  if (sa->user_offload)
130  free(sa->user_offload);
131 }
132 
133 static int xfrm_sa_clone(struct nl_object *_dst, struct nl_object *_src)
134 {
135  struct xfrmnl_sa* dst = nl_object_priv(_dst);
136  struct xfrmnl_sa* src = nl_object_priv(_src);
137  uint32_t len = 0;
138 
139  dst->sel = NULL;
140  dst->id.daddr = NULL;
141  dst->saddr = NULL;
142  dst->lft = NULL;
143  dst->aead = NULL;
144  dst->auth = NULL;
145  dst->crypt = NULL;
146  dst->comp = NULL;
147  dst->encap = NULL;
148  dst->coaddr = NULL;
149  dst->sec_ctx = NULL;
150  dst->replay_state_esn = NULL;
151  dst->user_offload = NULL;
152 
153  if (src->sel)
154  if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
155  return -NLE_NOMEM;
156 
157  if (src->lft)
158  if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
159  return -NLE_NOMEM;
160 
161  if (src->id.daddr)
162  if ((dst->id.daddr = nl_addr_clone (src->id.daddr)) == NULL)
163  return -NLE_NOMEM;
164 
165  if (src->saddr)
166  if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
167  return -NLE_NOMEM;
168 
169  if (src->aead) {
170  len = sizeof (struct xfrmnl_algo_aead) + ((src->aead->alg_key_len + 7) / 8);
171  if ((dst->aead = calloc (1, len)) == NULL)
172  return -NLE_NOMEM;
173  memcpy ((void *)dst->aead, (void *)src->aead, len);
174  }
175 
176  if (src->auth) {
177  len = sizeof (struct xfrmnl_algo_auth) + ((src->auth->alg_key_len + 7) / 8);
178  if ((dst->auth = calloc (1, len)) == NULL)
179  return -NLE_NOMEM;
180  memcpy ((void *)dst->auth, (void *)src->auth, len);
181  }
182 
183  if (src->crypt) {
184  len = sizeof (struct xfrmnl_algo) + ((src->crypt->alg_key_len + 7) / 8);
185  if ((dst->crypt = calloc (1, len)) == NULL)
186  return -NLE_NOMEM;
187  memcpy ((void *)dst->crypt, (void *)src->crypt, len);
188  }
189 
190  if (src->comp) {
191  len = sizeof (struct xfrmnl_algo) + ((src->comp->alg_key_len + 7) / 8);
192  if ((dst->comp = calloc (1, len)) == NULL)
193  return -NLE_NOMEM;
194  memcpy ((void *)dst->comp, (void *)src->comp, len);
195  }
196 
197  if (src->encap) {
198  len = sizeof (struct xfrmnl_encap_tmpl);
199  if ((dst->encap = calloc (1, len)) == NULL)
200  return -NLE_NOMEM;
201  memcpy ((void *)dst->encap, (void *)src->encap, len);
202  }
203 
204  if (src->coaddr)
205  if ((dst->coaddr = nl_addr_clone (src->coaddr)) == NULL)
206  return -NLE_NOMEM;
207 
208  if (src->sec_ctx) {
209  len = sizeof (*src->sec_ctx) + src->sec_ctx->ctx_len;
210  if ((dst->sec_ctx = calloc (1, len)) == NULL)
211  return -NLE_NOMEM;
212  memcpy ((void *)dst->sec_ctx, (void *)src->sec_ctx, len);
213  }
214 
215  if (src->replay_state_esn) {
216  len = sizeof (struct xfrmnl_replay_state_esn) + (src->replay_state_esn->bmp_len * sizeof (uint32_t));
217  if ((dst->replay_state_esn = calloc (1, len)) == NULL)
218  return -NLE_NOMEM;
219  memcpy ((void *)dst->replay_state_esn, (void *)src->replay_state_esn, len);
220  }
221 
222  if (src->user_offload) {
223  dst->user_offload = _nl_memdup_ptr(src->user_offload);
224  if (!dst->user_offload)
225  return -NLE_NOMEM;
226  }
227 
228  return 0;
229 }
230 
231 static uint64_t xfrm_sa_compare(struct nl_object *_a, struct nl_object *_b,
232  uint64_t attrs, int flags)
233 {
234  struct xfrmnl_sa* a = (struct xfrmnl_sa *) _a;
235  struct xfrmnl_sa* b = (struct xfrmnl_sa *) _b;
236  uint64_t diff = 0;
237  int found = 0;
238 
239 #define XFRM_SA_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_SA_ATTR_##ATTR, a, b, EXPR)
240  diff |= XFRM_SA_DIFF(SEL, xfrmnl_sel_cmp(a->sel, b->sel));
241  diff |= XFRM_SA_DIFF(DADDR, nl_addr_cmp(a->id.daddr, b->id.daddr));
242  diff |= XFRM_SA_DIFF(SPI, a->id.spi != b->id.spi);
243  diff |= XFRM_SA_DIFF(PROTO, a->id.proto != b->id.proto);
244  diff |= XFRM_SA_DIFF(SADDR, nl_addr_cmp(a->saddr, b->saddr));
245  diff |= XFRM_SA_DIFF(LTIME_CFG, xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
246  diff |= XFRM_SA_DIFF(REQID, a->reqid != b->reqid);
247  diff |= XFRM_SA_DIFF(FAMILY,a->family != b->family);
248  diff |= XFRM_SA_DIFF(MODE,a->mode != b->mode);
249  diff |= XFRM_SA_DIFF(REPLAY_WIN,a->replay_window != b->replay_window);
250  diff |= XFRM_SA_DIFF(FLAGS,a->flags != b->flags);
251  diff |= XFRM_SA_DIFF(ALG_AEAD,(strcmp(a->aead->alg_name, b->aead->alg_name) ||
252  (a->aead->alg_key_len != b->aead->alg_key_len) ||
253  (a->aead->alg_icv_len != b->aead->alg_icv_len) ||
254  memcmp(a->aead->alg_key, b->aead->alg_key,
255  ((a->aead->alg_key_len + 7)/8))));
256  diff |= XFRM_SA_DIFF(ALG_AUTH,(strcmp(a->auth->alg_name, b->auth->alg_name) ||
257  (a->auth->alg_key_len != b->auth->alg_key_len) ||
258  (a->auth->alg_trunc_len != b->auth->alg_trunc_len) ||
259  memcmp(a->auth->alg_key, b->auth->alg_key,
260  ((a->auth->alg_key_len + 7)/8))));
261  diff |= XFRM_SA_DIFF(ALG_CRYPT,(strcmp(a->crypt->alg_name, b->crypt->alg_name) ||
262  (a->crypt->alg_key_len != b->crypt->alg_key_len) ||
263  memcmp(a->crypt->alg_key, b->crypt->alg_key,
264  ((a->crypt->alg_key_len + 7)/8))));
265  diff |= XFRM_SA_DIFF(ALG_COMP,(strcmp(a->comp->alg_name, b->comp->alg_name) ||
266  (a->comp->alg_key_len != b->comp->alg_key_len) ||
267  memcmp(a->comp->alg_key, b->comp->alg_key,
268  ((a->comp->alg_key_len + 7)/8))));
269  diff |= XFRM_SA_DIFF(ENCAP,((a->encap->encap_type != b->encap->encap_type) ||
270  (a->encap->encap_sport != b->encap->encap_sport) ||
271  (a->encap->encap_dport != b->encap->encap_dport) ||
272  nl_addr_cmp(a->encap->encap_oa, b->encap->encap_oa)));
273  diff |= XFRM_SA_DIFF(TFCPAD,a->tfcpad != b->tfcpad);
274  diff |= XFRM_SA_DIFF(COADDR,nl_addr_cmp(a->coaddr, b->coaddr));
275  diff |= XFRM_SA_DIFF(MARK,(a->mark.m != b->mark.m) ||
276  (a->mark.v != b->mark.v));
277  diff |= XFRM_SA_DIFF(SECCTX,((a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
278  (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
279  (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
280  strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
281  diff |= XFRM_SA_DIFF(REPLAY_MAXAGE,a->replay_maxage != b->replay_maxage);
282  diff |= XFRM_SA_DIFF(REPLAY_MAXDIFF,a->replay_maxdiff != b->replay_maxdiff);
283  diff |= XFRM_SA_DIFF(EXPIRE,a->hard != b->hard);
284 
285  /* Compare replay states */
286  found = AVAILABLE_MISMATCH (a, b, XFRM_SA_ATTR_REPLAY_STATE);
287  if (found == 0) // attribute exists in both objects
288  {
289  if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
290  ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
291  found |= 1;
292 
293  if (found == 0) // same replay type. compare actual values
294  {
295  if (a->replay_state_esn)
296  {
297  if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
298  diff |= 1;
299  else
300  {
301  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) +
302  (a->replay_state_esn->bmp_len * sizeof (uint32_t));
303  diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
304  }
305  }
306  else
307  {
308  if ((a->replay_state.oseq != b->replay_state.oseq) ||
309  (a->replay_state.seq != b->replay_state.seq) ||
310  (a->replay_state.bitmap != b->replay_state.bitmap))
311  diff |= 1;
312  }
313  }
314  }
315 #undef XFRM_SA_DIFF
316 
317  return diff;
318 }
319 
320 /**
321  * @name XFRM SA Attribute Translations
322  * @{
323  */
324 static const struct trans_tbl sa_attrs[] = {
325  __ADD(XFRM_SA_ATTR_SEL, selector),
326  __ADD(XFRM_SA_ATTR_DADDR, daddr),
327  __ADD(XFRM_SA_ATTR_SPI, spi),
328  __ADD(XFRM_SA_ATTR_PROTO, proto),
329  __ADD(XFRM_SA_ATTR_SADDR, saddr),
330  __ADD(XFRM_SA_ATTR_LTIME_CFG, lifetime_cfg),
331  __ADD(XFRM_SA_ATTR_LTIME_CUR, lifetime_cur),
332  __ADD(XFRM_SA_ATTR_STATS, stats),
333  __ADD(XFRM_SA_ATTR_SEQ, seqnum),
334  __ADD(XFRM_SA_ATTR_REQID, reqid),
335  __ADD(XFRM_SA_ATTR_FAMILY, family),
336  __ADD(XFRM_SA_ATTR_MODE, mode),
337  __ADD(XFRM_SA_ATTR_REPLAY_WIN, replay_window),
338  __ADD(XFRM_SA_ATTR_FLAGS, flags),
339  __ADD(XFRM_SA_ATTR_ALG_AEAD, alg_aead),
340  __ADD(XFRM_SA_ATTR_ALG_AUTH, alg_auth),
341  __ADD(XFRM_SA_ATTR_ALG_CRYPT, alg_crypto),
342  __ADD(XFRM_SA_ATTR_ALG_COMP, alg_comp),
343  __ADD(XFRM_SA_ATTR_ENCAP, encap),
344  __ADD(XFRM_SA_ATTR_TFCPAD, tfcpad),
345  __ADD(XFRM_SA_ATTR_COADDR, coaddr),
346  __ADD(XFRM_SA_ATTR_MARK, mark),
347  __ADD(XFRM_SA_ATTR_SECCTX, sec_ctx),
348  __ADD(XFRM_SA_ATTR_REPLAY_MAXAGE, replay_maxage),
349  __ADD(XFRM_SA_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
350  __ADD(XFRM_SA_ATTR_REPLAY_STATE, replay_state),
351  __ADD(XFRM_SA_ATTR_EXPIRE, expire),
352  __ADD(XFRM_SA_ATTR_OFFLOAD_DEV, user_offload),
353 };
354 
355 static char* xfrm_sa_attrs2str(int attrs, char *buf, size_t len)
356 {
357  return __flags2str (attrs, buf, len, sa_attrs, ARRAY_SIZE(sa_attrs));
358 }
359 /** @} */
360 
361 /**
362  * @name XFRM SA Flags Translations
363  * @{
364  */
365 static const struct trans_tbl sa_flags[] = {
366  __ADD(XFRM_STATE_NOECN, no ecn),
367  __ADD(XFRM_STATE_DECAP_DSCP, decap dscp),
368  __ADD(XFRM_STATE_NOPMTUDISC, no pmtu discovery),
369  __ADD(XFRM_STATE_WILDRECV, wild receive),
370  __ADD(XFRM_STATE_ICMP, icmp),
371  __ADD(XFRM_STATE_AF_UNSPEC, unspecified),
372  __ADD(XFRM_STATE_ALIGN4, align4),
373  __ADD(XFRM_STATE_ESN, esn),
374 };
375 
376 char* xfrmnl_sa_flags2str(int flags, char *buf, size_t len)
377 {
378  return __flags2str (flags, buf, len, sa_flags, ARRAY_SIZE(sa_flags));
379 }
380 
381 int xfrmnl_sa_str2flag(const char *name)
382 {
383  return __str2flags (name, sa_flags, ARRAY_SIZE(sa_flags));
384 }
385 /** @} */
386 
387 /**
388  * @name XFRM SA Mode Translations
389  * @{
390  */
391 static const struct trans_tbl sa_modes[] = {
392  __ADD(XFRM_MODE_TRANSPORT, transport),
393  __ADD(XFRM_MODE_TUNNEL, tunnel),
394  __ADD(XFRM_MODE_ROUTEOPTIMIZATION, route optimization),
395  __ADD(XFRM_MODE_IN_TRIGGER, in trigger),
396  __ADD(XFRM_MODE_BEET, beet),
397 };
398 
399 char* xfrmnl_sa_mode2str(int mode, char *buf, size_t len)
400 {
401  return __type2str (mode, buf, len, sa_modes, ARRAY_SIZE(sa_modes));
402 }
403 
404 int xfrmnl_sa_str2mode(const char *name)
405 {
406  return __str2type (name, sa_modes, ARRAY_SIZE(sa_modes));
407 }
408 /** @} */
409 
410 
411 static void xfrm_sa_dump_line(struct nl_object *a, struct nl_dump_params *p)
412 {
413  char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
414  struct xfrmnl_sa* sa = (struct xfrmnl_sa *) a;
415  char flags[128], mode[128];
416  time_t add_time, use_time;
417  struct tm *add_time_tm, *use_time_tm;
418 
419  nl_dump_line(p, "src %s dst %s family: %s\n", nl_addr2str(sa->saddr, src, sizeof(src)),
420  nl_addr2str(sa->id.daddr, dst, sizeof(dst)),
421  nl_af2str (sa->family, flags, sizeof (flags)));
422 
423  nl_dump_line(p, "\tproto %s spi 0x%x reqid %u\n",
424  nl_ip_proto2str (sa->id.proto, flags, sizeof(flags)),
425  sa->id.spi, sa->reqid);
426 
427  xfrmnl_sa_flags2str(sa->flags, flags, sizeof (flags));
428  xfrmnl_sa_mode2str(sa->mode, mode, sizeof (mode));
429  nl_dump_line(p, "\tmode: %s flags: %s (0x%x) seq: %u replay window: %u\n",
430  mode, flags, sa->flags, sa->seq, sa->replay_window);
431 
432  nl_dump_line(p, "\tlifetime configuration: \n");
433  if (sa->lft->soft_byte_limit == XFRM_INF)
434  sprintf (flags, "INF");
435  else
436  sprintf (flags, "%" PRIu64, sa->lft->soft_byte_limit);
437  if (sa->lft->soft_packet_limit == XFRM_INF)
438  sprintf (mode, "INF");
439  else
440  sprintf (mode, "%" PRIu64, sa->lft->soft_packet_limit);
441  nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets)\n", flags, mode);
442  if (sa->lft->hard_byte_limit == XFRM_INF)
443  sprintf (flags, "INF");
444  else
445  sprintf (flags, "%" PRIu64, sa->lft->hard_byte_limit);
446  if (sa->lft->hard_packet_limit == XFRM_INF)
447  sprintf (mode, "INF");
448  else
449  sprintf (mode, "%" PRIu64, sa->lft->hard_packet_limit);
450  nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets)\n", flags,
451  mode);
452  nl_dump_line(
453  p,
454  "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
455  (long long unsigned)sa->lft->soft_add_expires_seconds,
456  (long long unsigned)sa->lft->soft_use_expires_seconds);
457  nl_dump_line(
458  p,
459  "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
460  (long long unsigned)sa->lft->hard_add_expires_seconds,
461  (long long unsigned)sa->lft->hard_use_expires_seconds);
462 
463  nl_dump_line(p, "\tlifetime current: \n");
464  nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
465  (long long unsigned)sa->curlft.bytes,
466  (long long unsigned)sa->curlft.packets);
467  if (sa->curlft.add_time != 0)
468  {
469  add_time = sa->curlft.add_time;
470  add_time_tm = gmtime (&add_time);
471  strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
472  }
473  else
474  {
475  sprintf (flags, "%s", "-");
476  }
477 
478  if (sa->curlft.use_time != 0)
479  {
480  use_time = sa->curlft.use_time;
481  use_time_tm = gmtime (&use_time);
482  strftime (mode, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
483  }
484  else
485  {
486  sprintf (mode, "%s", "-");
487  }
488  nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, mode);
489 
490  if (sa->aead)
491  {
492  nl_dump_line(p, "\tAEAD Algo: \n");
493  nl_dump_line(p, "\t\tName: %s Key len(bits): %u ICV Len(bits): %u\n",
494  sa->aead->alg_name, sa->aead->alg_key_len, sa->aead->alg_icv_len);
495  }
496 
497  if (sa->auth)
498  {
499  nl_dump_line(p, "\tAuth Algo: \n");
500  nl_dump_line(p, "\t\tName: %s Key len(bits): %u Trunc len(bits): %u\n",
501  sa->auth->alg_name, sa->auth->alg_key_len, sa->auth->alg_trunc_len);
502  }
503 
504  if (sa->crypt)
505  {
506  nl_dump_line(p, "\tEncryption Algo: \n");
507  nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
508  sa->crypt->alg_name, sa->crypt->alg_key_len);
509  }
510 
511  if (sa->comp)
512  {
513  nl_dump_line(p, "\tCompression Algo: \n");
514  nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
515  sa->comp->alg_name, sa->comp->alg_key_len);
516  }
517 
518  if (sa->encap)
519  {
520  nl_dump_line(p, "\tEncapsulation template: \n");
521  nl_dump_line(p, "\t\tType: %d Src port: %d Dst port: %d Encap addr: %s\n",
522  sa->encap->encap_type, sa->encap->encap_sport, sa->encap->encap_dport,
523  nl_addr2str (sa->encap->encap_oa, dst, sizeof (dst)));
524  }
525 
526  if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
527  nl_dump_line(p, "\tTFC Pad: %u\n", sa->tfcpad);
528 
529  if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
530  nl_dump_line(p, "\tCO Address: %s\n", nl_addr2str (sa->coaddr, dst, sizeof (dst)));
531 
532  if (sa->ce_mask & XFRM_SA_ATTR_MARK)
533  nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sa->mark.m, sa->mark.v);
534 
535  if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
536  nl_dump_line(p, "\tDOI: %d Algo: %d Len: %u ctx: %s\n", sa->sec_ctx->ctx_doi,
537  sa->sec_ctx->ctx_alg, sa->sec_ctx->ctx_len, sa->sec_ctx->ctx);
538 
539  nl_dump_line(p, "\treplay info: \n");
540  nl_dump_line(p, "\t\tmax age %u max diff %u \n", sa->replay_maxage, sa->replay_maxdiff);
541 
542  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
543  {
544  nl_dump_line(p, "\treplay state info: \n");
545  if (sa->replay_state_esn)
546  {
547  nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
548  sa->replay_state_esn->oseq, sa->replay_state_esn->seq,
549  sa->replay_state_esn->oseq_hi, sa->replay_state_esn->seq_hi,
550  sa->replay_state_esn->replay_window);
551  }
552  else
553  {
554  nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", sa->replay_state.oseq,
555  sa->replay_state.seq, sa->replay_state.bitmap);
556  }
557  }
558 
559  nl_dump_line(p, "\tselector info: \n");
560  xfrmnl_sel_dump (sa->sel, p);
561 
562  nl_dump_line(p, "\tHard: %d\n", sa->hard);
563 
564  nl_dump(p, "\n");
565 }
566 
567 static void xfrm_sa_dump_stats(struct nl_object *a, struct nl_dump_params *p)
568 {
569  struct xfrmnl_sa* sa = (struct xfrmnl_sa*)a;
570 
571  nl_dump_line(p, "\tstats: \n");
572  nl_dump_line(p, "\t\treplay window: %u replay: %u integrity failed: %u \n",
573  sa->stats.replay_window, sa->stats.replay, sa->stats.integrity_failed);
574 
575  return;
576 }
577 
578 static void xfrm_sa_dump_details(struct nl_object *a, struct nl_dump_params *p)
579 {
580  xfrm_sa_dump_line(a, p);
581  xfrm_sa_dump_stats (a, p);
582 }
583 
584 /**
585  * @name XFRM SA Object Allocation/Freeage
586  * @{
587  */
588 
589 struct xfrmnl_sa* xfrmnl_sa_alloc(void)
590 {
591  return (struct xfrmnl_sa*) nl_object_alloc(&xfrm_sa_obj_ops);
592 }
593 
594 void xfrmnl_sa_put(struct xfrmnl_sa* sa)
595 {
596  nl_object_put((struct nl_object *) sa);
597 }
598 
599 /** @} */
600 
601 /**
602  * @name SA Cache Managament
603  * @{
604  */
605 
606 /**
607  * Build a SA cache including all SAs currently configured in the kernel.
608  * @arg sock Netlink socket.
609  * @arg result Pointer to store resulting cache.
610  *
611  * Allocates a new SA cache, initializes it properly and updates it
612  * to include all SAs currently configured in the kernel.
613  *
614  * @return 0 on success or a negative error code.
615  */
616 int xfrmnl_sa_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
617 {
618  return nl_cache_alloc_and_fill(&xfrmnl_sa_ops, sock, result);
619 }
620 
621 /**
622  * Look up a SA by destination address, SPI, protocol
623  * @arg cache SA cache
624  * @arg daddr destination address of the SA
625  * @arg spi SPI
626  * @arg proto protocol
627  * @return sa handle or NULL if no match was found.
628  */
629 struct xfrmnl_sa* xfrmnl_sa_get(struct nl_cache* cache, struct nl_addr* daddr,
630  unsigned int spi, unsigned int proto)
631 {
632  struct xfrmnl_sa *sa;
633 
634  //nl_list_for_each_entry(sa, &cache->c_items, ce_list) {
635  for (sa = (struct xfrmnl_sa*)nl_cache_get_first (cache);
636  sa != NULL;
637  sa = (struct xfrmnl_sa*)nl_cache_get_next ((struct nl_object*)sa))
638  {
639  if (sa->id.proto == proto &&
640  sa->id.spi == spi &&
641  !nl_addr_cmp(sa->id.daddr, daddr))
642  {
643  nl_object_get((struct nl_object *) sa);
644  return sa;
645  }
646 
647  }
648 
649  return NULL;
650 }
651 
652 
653 /** @} */
654 
655 
656 static struct nla_policy xfrm_sa_policy[XFRMA_MAX+1] = {
657  [XFRMA_SA] = { .minlen = sizeof(struct xfrm_usersa_info)},
658  [XFRMA_ALG_AUTH_TRUNC] = { .minlen = sizeof(struct xfrm_algo_auth)},
659  [XFRMA_ALG_AEAD] = { .minlen = sizeof(struct xfrm_algo_aead) },
660  [XFRMA_ALG_AUTH] = { .minlen = sizeof(struct xfrm_algo) },
661  [XFRMA_ALG_CRYPT] = { .minlen = sizeof(struct xfrm_algo) },
662  [XFRMA_ALG_COMP] = { .minlen = sizeof(struct xfrm_algo) },
663  [XFRMA_ENCAP] = { .minlen = sizeof(struct xfrm_encap_tmpl) },
664  [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
665  [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
666  [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
667  [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
668  [XFRMA_OFFLOAD_DEV] = { .minlen = sizeof(struct xfrm_user_offload) },
669  [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
670  [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
671  [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
672  [XFRMA_COADDR] = { .minlen = sizeof(xfrm_address_t) },
673  [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
674  [XFRMA_TFCPAD] = { .type = NLA_U32 },
675  [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
676 };
677 
678 static int xfrm_sa_request_update(struct nl_cache *c, struct nl_sock *h)
679 {
680  return nl_send_simple (h, XFRM_MSG_GETSA, NLM_F_DUMP, NULL, 0);
681 }
682 
683 int xfrmnl_sa_parse(struct nlmsghdr *n, struct xfrmnl_sa **result)
684 {
685  struct xfrmnl_sa* sa;
686  struct nlattr *tb[XFRMA_MAX + 1];
687  struct xfrm_usersa_info* sa_info;
688  struct xfrm_user_expire* ue;
689  int len, err;
690  struct nl_addr* addr;
691 
692  sa = xfrmnl_sa_alloc();
693  if (!sa) {
694  err = -NLE_NOMEM;
695  goto errout;
696  }
697 
698  sa->ce_msgtype = n->nlmsg_type;
699  if (n->nlmsg_type == XFRM_MSG_EXPIRE)
700  {
701  ue = nlmsg_data(n);
702  sa_info = &ue->state;
703  sa->hard = ue->hard;
704  sa->ce_mask |= XFRM_SA_ATTR_EXPIRE;
705  }
706  else if (n->nlmsg_type == XFRM_MSG_DELSA)
707  {
708  sa_info = (struct xfrm_usersa_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_usersa_id) + NLA_HDRLEN);
709  }
710  else
711  {
712  sa_info = nlmsg_data(n);
713  }
714 
715  err = nlmsg_parse(n, sizeof(struct xfrm_usersa_info), tb, XFRMA_MAX, xfrm_sa_policy);
716  if (err < 0)
717  goto errout;
718 
719  if (sa_info->sel.family == AF_INET)
720  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a4, sizeof (sa_info->sel.daddr.a4));
721  else
722  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a6, sizeof (sa_info->sel.daddr.a6));
723  nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_d);
724  xfrmnl_sel_set_daddr (sa->sel, addr);
725  /* Drop the reference count from the above set operation */
726  nl_addr_put(addr);
727  xfrmnl_sel_set_prefixlen_d (sa->sel, sa_info->sel.prefixlen_d);
728 
729  if (sa_info->sel.family == AF_INET)
730  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a4, sizeof (sa_info->sel.saddr.a4));
731  else
732  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a6, sizeof (sa_info->sel.saddr.a6));
733  nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_s);
734  xfrmnl_sel_set_saddr (sa->sel, addr);
735  /* Drop the reference count from the above set operation */
736  nl_addr_put(addr);
737  xfrmnl_sel_set_prefixlen_s (sa->sel, sa_info->sel.prefixlen_s);
738 
739  xfrmnl_sel_set_dport (sa->sel, ntohs(sa_info->sel.dport));
740  xfrmnl_sel_set_dportmask (sa->sel, ntohs(sa_info->sel.dport_mask));
741  xfrmnl_sel_set_sport (sa->sel, ntohs(sa_info->sel.sport));
742  xfrmnl_sel_set_sportmask (sa->sel, ntohs(sa_info->sel.sport_mask));
743  xfrmnl_sel_set_family (sa->sel, sa_info->sel.family);
744  xfrmnl_sel_set_proto (sa->sel, sa_info->sel.proto);
745  xfrmnl_sel_set_ifindex (sa->sel, sa_info->sel.ifindex);
746  xfrmnl_sel_set_userid (sa->sel, sa_info->sel.user);
747  sa->ce_mask |= XFRM_SA_ATTR_SEL;
748 
749  if (sa_info->family == AF_INET)
750  sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a4, sizeof (sa_info->id.daddr.a4));
751  else
752  sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a6, sizeof (sa_info->id.daddr.a6));
753  sa->id.spi = ntohl(sa_info->id.spi);
754  sa->id.proto = sa_info->id.proto;
755  sa->ce_mask |= (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO);
756 
757  if (sa_info->family == AF_INET)
758  sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a4, sizeof (sa_info->saddr.a4));
759  else
760  sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a6, sizeof (sa_info->saddr.a6));
761  sa->ce_mask |= XFRM_SA_ATTR_SADDR;
762 
763  sa->lft->soft_byte_limit = sa_info->lft.soft_byte_limit;
764  sa->lft->hard_byte_limit = sa_info->lft.hard_byte_limit;
765  sa->lft->soft_packet_limit = sa_info->lft.soft_packet_limit;
766  sa->lft->hard_packet_limit = sa_info->lft.hard_packet_limit;
767  sa->lft->soft_add_expires_seconds = sa_info->lft.soft_add_expires_seconds;
768  sa->lft->hard_add_expires_seconds = sa_info->lft.hard_add_expires_seconds;
769  sa->lft->soft_use_expires_seconds = sa_info->lft.soft_use_expires_seconds;
770  sa->lft->hard_use_expires_seconds = sa_info->lft.hard_use_expires_seconds;
771  sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
772 
773  sa->curlft.bytes = sa_info->curlft.bytes;
774  sa->curlft.packets = sa_info->curlft.packets;
775  sa->curlft.add_time = sa_info->curlft.add_time;
776  sa->curlft.use_time = sa_info->curlft.use_time;
777  sa->ce_mask |= XFRM_SA_ATTR_LTIME_CUR;
778 
779  sa->stats.replay_window = sa_info->stats.replay_window;
780  sa->stats.replay = sa_info->stats.replay;
781  sa->stats.integrity_failed = sa_info->stats.integrity_failed;
782  sa->ce_mask |= XFRM_SA_ATTR_STATS;
783 
784  sa->seq = sa_info->seq;
785  sa->reqid = sa_info->reqid;
786  sa->family = sa_info->family;
787  sa->mode = sa_info->mode;
788  sa->replay_window = sa_info->replay_window;
789  sa->flags = sa_info->flags;
790  sa->ce_mask |= (XFRM_SA_ATTR_SEQ | XFRM_SA_ATTR_REQID |
791  XFRM_SA_ATTR_FAMILY | XFRM_SA_ATTR_MODE |
792  XFRM_SA_ATTR_REPLAY_WIN | XFRM_SA_ATTR_FLAGS);
793 
794  if (tb[XFRMA_ALG_AEAD]) {
795  struct xfrm_algo_aead* aead = nla_data(tb[XFRMA_ALG_AEAD]);
796  len = sizeof (struct xfrmnl_algo_aead) + ((aead->alg_key_len + 7) / 8);
797  if ((sa->aead = calloc (1, len)) == NULL)
798  {
799  err = -NLE_NOMEM;
800  goto errout;
801  }
802  memcpy ((void *)sa->aead, (void *)aead, len);
803  sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
804  }
805 
806  if (tb[XFRMA_ALG_AUTH_TRUNC]) {
807  struct xfrm_algo_auth* auth = nla_data(tb[XFRMA_ALG_AUTH_TRUNC]);
808  len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
809  if ((sa->auth = calloc (1, len)) == NULL)
810  {
811  err = -NLE_NOMEM;
812  goto errout;
813  }
814  memcpy ((void *)sa->auth, (void *)auth, len);
815  sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
816  }
817 
818  if (tb[XFRMA_ALG_AUTH] && !sa->auth) {
819  struct xfrm_algo* auth = nla_data(tb[XFRMA_ALG_AUTH]);
820  len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
821  if ((sa->auth = calloc (1, len)) == NULL)
822  {
823  err = -NLE_NOMEM;
824  goto errout;
825  }
826  strcpy(sa->auth->alg_name, auth->alg_name);
827  memcpy(sa->auth->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
828  sa->auth->alg_key_len = auth->alg_key_len;
829  sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
830  }
831 
832  if (tb[XFRMA_ALG_CRYPT]) {
833  struct xfrm_algo* crypt = nla_data(tb[XFRMA_ALG_CRYPT]);
834  len = sizeof (struct xfrmnl_algo) + ((crypt->alg_key_len + 7) / 8);
835  if ((sa->crypt = calloc (1, len)) == NULL)
836  {
837  err = -NLE_NOMEM;
838  goto errout;
839  }
840  memcpy ((void *)sa->crypt, (void *)crypt, len);
841  sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
842  }
843 
844  if (tb[XFRMA_ALG_COMP]) {
845  struct xfrm_algo* comp = nla_data(tb[XFRMA_ALG_COMP]);
846  len = sizeof (struct xfrmnl_algo) + ((comp->alg_key_len + 7) / 8);
847  if ((sa->comp = calloc (1, len)) == NULL)
848  {
849  err = -NLE_NOMEM;
850  goto errout;
851  }
852  memcpy ((void *)sa->comp, (void *)comp, len);
853  sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
854  }
855 
856  if (tb[XFRMA_ENCAP]) {
857  struct xfrm_encap_tmpl* encap = nla_data(tb[XFRMA_ENCAP]);
858  len = sizeof (struct xfrmnl_encap_tmpl);
859  if ((sa->encap = calloc (1, len)) == NULL)
860  {
861  err = -NLE_NOMEM;
862  goto errout;
863  }
864  sa->encap->encap_type = encap->encap_type;
865  sa->encap->encap_sport = ntohs(encap->encap_sport);
866  sa->encap->encap_dport = ntohs(encap->encap_dport);
867  if (sa_info->family == AF_INET)
868  sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a4, sizeof (encap->encap_oa.a4));
869  else
870  sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a6, sizeof (encap->encap_oa.a6));
871  sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
872  }
873 
874  if (tb[XFRMA_TFCPAD]) {
875  sa->tfcpad = *(uint32_t*)nla_data(tb[XFRMA_TFCPAD]);
876  sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
877  }
878 
879  if (tb[XFRMA_COADDR]) {
880  if (sa_info->family == AF_INET)
881  {
882  sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
883  sizeof (uint32_t));
884  }
885  else
886  {
887  sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
888  sizeof (uint32_t) * 4);
889  }
890  sa->ce_mask |= XFRM_SA_ATTR_COADDR;
891  }
892 
893  if (tb[XFRMA_MARK]) {
894  struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
895  sa->mark.m = m->m;
896  sa->mark.v = m->v;
897  sa->ce_mask |= XFRM_SA_ATTR_MARK;
898  }
899 
900  if (tb[XFRMA_SEC_CTX]) {
901  struct xfrm_user_sec_ctx* sec_ctx = nla_data(tb[XFRMA_SEC_CTX]);
902  len = sizeof (struct xfrmnl_user_sec_ctx) + sec_ctx->ctx_len;
903  if ((sa->sec_ctx = calloc (1, len)) == NULL)
904  {
905  err = -NLE_NOMEM;
906  goto errout;
907  }
908  memcpy (sa->sec_ctx, sec_ctx, len);
909  sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
910  }
911 
912  if (tb[XFRMA_ETIMER_THRESH]) {
913  sa->replay_maxage = *(uint32_t*)nla_data(tb[XFRMA_ETIMER_THRESH]);
914  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
915  }
916 
917  if (tb[XFRMA_REPLAY_THRESH]) {
918  sa->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRMA_REPLAY_THRESH]);
919  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
920  }
921 
922  if (tb[XFRMA_REPLAY_ESN_VAL]) {
923  struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
924  len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
925  if ((sa->replay_state_esn = calloc (1, len)) == NULL)
926  {
927  err = -NLE_NOMEM;
928  goto errout;
929  }
930  memcpy ((void *)sa->replay_state_esn, (void *)esn, len);
931  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
932  }
933  else if (tb[XFRMA_REPLAY_VAL])
934  {
935  struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
936  sa->replay_state.oseq = replay_state->oseq;
937  sa->replay_state.seq = replay_state->seq;
938  sa->replay_state.bitmap = replay_state->bitmap;
939  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
940  sa->replay_state_esn = NULL;
941  }
942 
943  if (tb[XFRMA_OFFLOAD_DEV]) {
944  struct xfrm_user_offload *offload;
945 
946  len = sizeof(struct xfrmnl_user_offload);
947 
948  if ((sa->user_offload = calloc(1, len)) == NULL) {
949  err = -NLE_NOMEM;
950  goto errout;
951  }
952 
953  offload = nla_data(tb[XFRMA_OFFLOAD_DEV]);
954  sa->user_offload->ifindex = offload->ifindex;
955  sa->user_offload->flags = offload->flags;
956  sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
957  }
958 
959  *result = sa;
960  return 0;
961 
962 errout:
963  xfrmnl_sa_put(sa);
964  return err;
965 }
966 
967 static int xfrm_sa_update_cache (struct nl_cache *cache, struct nl_object *obj,
968  change_func_t change_cb, change_func_v2_t change_cb_v2,
969  void *data)
970 {
971  struct nl_object* old_sa;
972  struct xfrmnl_sa* sa = (struct xfrmnl_sa*)obj;
973 
974  if (nl_object_get_msgtype (obj) == XFRM_MSG_EXPIRE)
975  {
976  /* On hard expiry, the SA gets deleted too from the kernel state without any
977  * further delete event. On Expire message, we are only updating the cache with
978  * the SA object's new state. In absence of the explicit delete event, the cache will
979  * be out of sync with the kernel state. To get around this, expiry messages cache
980  * operations are handled here (installed with NL_ACT_UNSPEC action) instead of
981  * in Libnl Cache module. */
982 
983  /* Do we already have this object in the cache? */
984  old_sa = nl_cache_search(cache, obj);
985  if (old_sa)
986  {
987  /* Found corresponding SA object in cache. Delete it */
988  nl_cache_remove (old_sa);
989  }
990 
991  /* Handle the expiry event now */
992  if (sa->hard == 0)
993  {
994  /* Soft expiry event: Save the new object to the
995  * cache and notify application of the expiry event. */
996  nl_cache_move (cache, obj);
997 
998  if (old_sa == NULL)
999  {
1000  /* Application CB present, no previous instance of SA object present.
1001  * Notify application CB as a NEW event */
1002  if (change_cb_v2)
1003  change_cb_v2(cache, NULL, obj, 0, NL_ACT_NEW, data);
1004  else if (change_cb)
1005  change_cb(cache, obj, NL_ACT_NEW, data);
1006  }
1007  else if (old_sa)
1008  {
1009  uint64_t diff = 0;
1010  if (change_cb || change_cb_v2)
1011  diff = nl_object_diff64(old_sa, obj);
1012 
1013  /* Application CB present, a previous instance of SA object present.
1014  * Notify application CB as a CHANGE1 event */
1015  if (diff) {
1016  if (change_cb_v2) {
1017  change_cb_v2(cache, old_sa, obj, diff, NL_ACT_CHANGE, data);
1018  } else if (change_cb)
1019  change_cb(cache, obj, NL_ACT_CHANGE, data);
1020  }
1021  nl_object_put (old_sa);
1022  }
1023  }
1024  else
1025  {
1026  /* Hard expiry event: Delete the object from the
1027  * cache and notify application of the expiry event. */
1028  if (change_cb_v2)
1029  change_cb_v2(cache, obj, NULL, 0, NL_ACT_DEL, data);
1030  else if (change_cb)
1031  change_cb (cache, obj, NL_ACT_DEL, data);
1032  nl_object_put (old_sa);
1033  }
1034 
1035  /* Done handling expire message */
1036  return 0;
1037  }
1038  else
1039  {
1040  /* All other messages other than Expire, let the standard Libnl cache
1041  * module handle it. */
1042  if (change_cb_v2)
1043  return nl_cache_include_v2(cache, obj, change_cb_v2, data);
1044  else
1045  return nl_cache_include (cache, obj, change_cb, data);
1046  }
1047 }
1048 
1049 static int xfrm_sa_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
1050  struct nlmsghdr *n, struct nl_parser_param *pp)
1051 {
1052  struct xfrmnl_sa* sa;
1053  int err;
1054 
1055  if ((err = xfrmnl_sa_parse(n, &sa)) < 0)
1056  return err;
1057 
1058  err = pp->pp_cb((struct nl_object *) sa, pp);
1059 
1060  xfrmnl_sa_put(sa);
1061  return err;
1062 }
1063 
1064 /**
1065  * @name XFRM SA Get
1066  * @{
1067  */
1068 
1069 int xfrmnl_sa_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
1070 {
1071  struct nl_msg *msg;
1072  struct xfrm_usersa_id sa_id;
1073  struct xfrm_mark mark;
1074 
1075  if (!daddr || !spi)
1076  {
1077  fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
1078  __FILE__, __LINE__, __func__);
1079  assert(0);
1080  return -NLE_MISSING_ATTR;
1081  }
1082 
1083  memset(&sa_id, 0, sizeof(sa_id));
1084  memcpy (&sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
1085  sa_id.family = nl_addr_get_family (daddr);
1086  sa_id.spi = htonl(spi);
1087  sa_id.proto = protocol;
1088 
1089  if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETSA, 0)))
1090  return -NLE_NOMEM;
1091 
1092  if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1093  goto nla_put_failure;
1094 
1095  if ((mark_m & mark_v) != 0)
1096  {
1097  memset(&mark, 0, sizeof(struct xfrm_mark));
1098  mark.m = mark_m;
1099  mark.v = mark_v;
1100 
1101  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
1102  }
1103 
1104  *result = msg;
1105  return 0;
1106 
1107 nla_put_failure:
1108  nlmsg_free(msg);
1109  return -NLE_MSGSIZE;
1110 }
1111 
1112 int xfrmnl_sa_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sa** result)
1113 {
1114  struct nl_msg *msg = NULL;
1115  struct nl_object *obj;
1116  int err;
1117 
1118  if ((err = xfrmnl_sa_build_get_request(daddr, spi, protocol, mark_m, mark_v, &msg)) < 0)
1119  return err;
1120 
1121  err = nl_send_auto(sock, msg);
1122  nlmsg_free(msg);
1123  if (err < 0)
1124  return err;
1125 
1126  if ((err = nl_pickup(sock, &xfrm_sa_msg_parser, &obj)) < 0)
1127  return err;
1128 
1129  /* We have used xfrm_sa_msg_parser(), object is definitely a xfrm sa */
1130  *result = (struct xfrmnl_sa *) obj;
1131 
1132  /* If an object has been returned, we also need to wait for the ACK */
1133  if (err == 0 && obj)
1134  nl_wait_for_ack(sock);
1135 
1136  return 0;
1137 }
1138 
1139 /** @} */
1140 
1141 static int build_xfrm_sa_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1142 {
1143  struct nl_msg* msg;
1144  struct xfrm_usersa_info sa_info;
1145  uint32_t len;
1146  struct nl_addr* addr;
1147 
1148  if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1149  !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1150  !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1151  return -NLE_MISSING_ATTR;
1152 
1153  memset ((void*)&sa_info, 0, sizeof (sa_info));
1154  if (tmpl->ce_mask & XFRM_SA_ATTR_SEL)
1155  {
1156  addr = xfrmnl_sel_get_daddr (tmpl->sel);
1157  memcpy ((void*)&sa_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1158  addr = xfrmnl_sel_get_saddr (tmpl->sel);
1159  memcpy ((void*)&sa_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1160  sa_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1161  sa_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1162  sa_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1163  sa_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1164  sa_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1165  sa_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1166  sa_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1167  sa_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1168  sa_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1169  sa_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1170  }
1171 
1172  memcpy (&sa_info.id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1173  sa_info.id.spi = htonl(tmpl->id.spi);
1174  sa_info.id.proto = tmpl->id.proto;
1175 
1176  if (tmpl->ce_mask & XFRM_SA_ATTR_SADDR)
1177  memcpy (&sa_info.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
1178 
1179  if (tmpl->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1180  {
1181  sa_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
1182  sa_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
1183  sa_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
1184  sa_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
1185  sa_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
1186  sa_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
1187  sa_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
1188  sa_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
1189  }
1190 
1191  //Skip current lifetime: cur lifetime can be updated only via AE
1192  //Skip stats: stats cant be updated
1193  //Skip seq: seq cant be updated
1194 
1195  if (tmpl->ce_mask & XFRM_SA_ATTR_REQID)
1196  sa_info.reqid = tmpl->reqid;
1197 
1198  if (tmpl->ce_mask & XFRM_SA_ATTR_FAMILY)
1199  sa_info.family = tmpl->family;
1200 
1201  if (tmpl->ce_mask & XFRM_SA_ATTR_MODE)
1202  sa_info.mode = tmpl->mode;
1203 
1204  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1205  sa_info.replay_window = tmpl->replay_window;
1206 
1207  if (tmpl->ce_mask & XFRM_SA_ATTR_FLAGS)
1208  sa_info.flags = tmpl->flags;
1209 
1210  msg = nlmsg_alloc_simple(cmd, flags);
1211  if (!msg)
1212  return -NLE_NOMEM;
1213 
1214  if (nlmsg_append(msg, &sa_info, sizeof(sa_info), NLMSG_ALIGNTO) < 0)
1215  goto nla_put_failure;
1216 
1217  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AEAD) {
1218  len = sizeof (struct xfrm_algo_aead) + ((tmpl->aead->alg_key_len + 7) / 8);
1219  NLA_PUT (msg, XFRMA_ALG_AEAD, len, tmpl->aead);
1220  }
1221 
1222  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AUTH) {
1223  /* kernel prefers XFRMA_ALG_AUTH_TRUNC over XFRMA_ALG_AUTH, so only
1224  * one of the attributes needs to be present */
1225  if (tmpl->auth->alg_trunc_len) {
1226  len = sizeof (struct xfrm_algo_auth) + ((tmpl->auth->alg_key_len + 7) / 8);
1227  NLA_PUT (msg, XFRMA_ALG_AUTH_TRUNC, len, tmpl->auth);
1228  } else {
1229  struct xfrm_algo *auth;
1230 
1231  len = sizeof (struct xfrm_algo) + ((tmpl->auth->alg_key_len + 7) / 8);
1232  auth = malloc(len);
1233  if (!auth) {
1234  nlmsg_free(msg);
1235  return -NLE_NOMEM;
1236  }
1237 
1238  _nl_strncpy_assert(auth->alg_name, tmpl->auth->alg_name, sizeof(auth->alg_name));
1239  auth->alg_key_len = tmpl->auth->alg_key_len;
1240  memcpy(auth->alg_key, tmpl->auth->alg_key, (tmpl->auth->alg_key_len + 7) / 8);
1241  if (nla_put(msg, XFRMA_ALG_AUTH, len, auth) < 0) {
1242  free(auth);
1243  goto nla_put_failure;
1244  }
1245  free(auth);
1246  }
1247  }
1248 
1249  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_CRYPT) {
1250  len = sizeof (struct xfrm_algo) + ((tmpl->crypt->alg_key_len + 7) / 8);
1251  NLA_PUT (msg, XFRMA_ALG_CRYPT, len, tmpl->crypt);
1252  }
1253 
1254  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_COMP) {
1255  len = sizeof (struct xfrm_algo) + ((tmpl->comp->alg_key_len + 7) / 8);
1256  NLA_PUT (msg, XFRMA_ALG_COMP, len, tmpl->comp);
1257  }
1258 
1259  if (tmpl->ce_mask & XFRM_SA_ATTR_ENCAP) {
1260  struct xfrm_encap_tmpl* encap_tmpl;
1261  struct nlattr* encap_attr;
1262 
1263  len = sizeof (struct xfrm_encap_tmpl);
1264  encap_attr = nla_reserve(msg, XFRMA_ENCAP, len);
1265  if (!encap_attr)
1266  goto nla_put_failure;
1267  encap_tmpl = nla_data (encap_attr);
1268  encap_tmpl->encap_type = tmpl->encap->encap_type;
1269  encap_tmpl->encap_sport = htons (tmpl->encap->encap_sport);
1270  encap_tmpl->encap_dport = htons (tmpl->encap->encap_dport);
1271  memcpy (&encap_tmpl->encap_oa, nl_addr_get_binary_addr (tmpl->encap->encap_oa), sizeof (uint8_t) * nl_addr_get_len (tmpl->encap->encap_oa));
1272  }
1273 
1274  if (tmpl->ce_mask & XFRM_SA_ATTR_TFCPAD) {
1275  NLA_PUT_U32 (msg, XFRMA_TFCPAD, tmpl->tfcpad);
1276  }
1277 
1278  if (tmpl->ce_mask & XFRM_SA_ATTR_COADDR) {
1279  NLA_PUT (msg, XFRMA_COADDR, sizeof (xfrm_address_t), tmpl->coaddr);
1280  }
1281 
1282  if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1283  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1284  }
1285 
1286  if (tmpl->ce_mask & XFRM_SA_ATTR_SECCTX) {
1287  len = sizeof (struct xfrm_sec_ctx) + tmpl->sec_ctx->ctx_len;
1288  NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1289  }
1290 
1291  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE) {
1292  NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
1293  }
1294 
1295  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF) {
1296  NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
1297  }
1298 
1299  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_STATE) {
1300  if (tmpl->replay_state_esn) {
1301  len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
1302  NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
1303  }
1304  else {
1305  NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrm_replay_state), &tmpl->replay_state);
1306  }
1307  }
1308 
1309  if (tmpl->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV) {
1310  struct xfrm_user_offload *offload;
1311  struct nlattr *attr;
1312 
1313  len = sizeof(struct xfrm_user_offload);
1314  attr = nla_reserve(msg, XFRMA_OFFLOAD_DEV, len);
1315 
1316  if (!attr)
1317  goto nla_put_failure;
1318 
1319  offload = nla_data(attr);
1320  offload->ifindex = tmpl->user_offload->ifindex;
1321  offload->flags = tmpl->user_offload->flags;
1322  }
1323 
1324  *result = msg;
1325  return 0;
1326 
1327 nla_put_failure:
1328  nlmsg_free(msg);
1329  return -NLE_MSGSIZE;
1330 }
1331 
1332 /**
1333  * @name XFRM SA Add
1334  * @{
1335  */
1336 
1337 int xfrmnl_sa_build_add_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1338 {
1339  return build_xfrm_sa_message (tmpl, XFRM_MSG_NEWSA, flags, result);
1340 }
1341 
1342 int xfrmnl_sa_add(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1343 {
1344  int err;
1345  struct nl_msg *msg;
1346 
1347  if ((err = xfrmnl_sa_build_add_request(tmpl, flags, &msg)) < 0)
1348  return err;
1349 
1350  err = nl_send_auto_complete(sk, msg);
1351  nlmsg_free(msg);
1352  if (err < 0)
1353  return err;
1354 
1355  return nl_wait_for_ack(sk);
1356 }
1357 
1358 /**
1359  * @name XFRM SA Update
1360  * @{
1361  */
1362 
1363 int xfrmnl_sa_build_update_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1364 {
1365  return build_xfrm_sa_message (tmpl, XFRM_MSG_UPDSA, flags, result);
1366 }
1367 
1368 int xfrmnl_sa_update(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1369 {
1370  int err;
1371  struct nl_msg *msg;
1372 
1373  if ((err = xfrmnl_sa_build_update_request(tmpl, flags, &msg)) < 0)
1374  return err;
1375 
1376  err = nl_send_auto_complete(sk, msg);
1377  nlmsg_free(msg);
1378  if (err < 0)
1379  return err;
1380 
1381  return nl_wait_for_ack(sk);
1382 }
1383 
1384 /** @} */
1385 
1386 static int build_xfrm_sa_delete_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1387 {
1388  struct nl_msg* msg;
1389  struct xfrm_usersa_id sa_id;
1390 
1391  if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1392  !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1393  !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1394  return -NLE_MISSING_ATTR;
1395 
1396  memset(&sa_id, 0, sizeof(struct xfrm_usersa_id));
1397  memcpy (&sa_id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr),
1398  sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1399  sa_id.family = nl_addr_get_family (tmpl->id.daddr);
1400  sa_id.spi = htonl(tmpl->id.spi);
1401  sa_id.proto = tmpl->id.proto;
1402 
1403  msg = nlmsg_alloc_simple(cmd, flags);
1404  if (!msg)
1405  return -NLE_NOMEM;
1406 
1407  if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1408  goto nla_put_failure;
1409 
1410  if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1411  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1412  }
1413 
1414  *result = msg;
1415  return 0;
1416 
1417 nla_put_failure:
1418  nlmsg_free(msg);
1419  return -NLE_MSGSIZE;
1420 }
1421 
1422 /**
1423  * @name XFRM SA Delete
1424  * @{
1425  */
1426 
1427 int xfrmnl_sa_build_delete_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1428 {
1429  return build_xfrm_sa_delete_message (tmpl, XFRM_MSG_DELSA, flags, result);
1430 }
1431 
1432 int xfrmnl_sa_delete(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1433 {
1434  int err;
1435  struct nl_msg *msg;
1436 
1437  if ((err = xfrmnl_sa_build_delete_request(tmpl, flags, &msg)) < 0)
1438  return err;
1439 
1440  err = nl_send_auto_complete(sk, msg);
1441  nlmsg_free(msg);
1442  if (err < 0)
1443  return err;
1444 
1445  return nl_wait_for_ack(sk);
1446 }
1447 
1448 /** @} */
1449 
1450 
1451 /**
1452  * @name Attributes
1453  * @{
1454  */
1455 
1456 struct xfrmnl_sel* xfrmnl_sa_get_sel (struct xfrmnl_sa* sa)
1457 {
1458  if (sa->ce_mask & XFRM_SA_ATTR_SEL)
1459  return sa->sel;
1460  else
1461  return NULL;
1462 }
1463 
1464 int xfrmnl_sa_set_sel (struct xfrmnl_sa* sa, struct xfrmnl_sel* sel)
1465 {
1466  /* Release any previously held selector object from the SA */
1467  if (sa->sel)
1468  xfrmnl_sel_put (sa->sel);
1469 
1470  /* Increment ref count on new selector and save it in the SA */
1471  xfrmnl_sel_get (sel);
1472  sa->sel = sel;
1473  sa->ce_mask |= XFRM_SA_ATTR_SEL;
1474 
1475  return 0;
1476 }
1477 
1478 static inline int __assign_addr(struct xfrmnl_sa* sa, struct nl_addr **pos,
1479  struct nl_addr *new, int flag, int nocheck)
1480 {
1481  if (!nocheck)
1482  {
1483  if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1484  {
1485  if (nl_addr_get_family (new) != sa->family)
1486  return -NLE_AF_MISMATCH;
1487  }
1488  }
1489 
1490  if (*pos)
1491  nl_addr_put(*pos);
1492 
1493  nl_addr_get(new);
1494  *pos = new;
1495 
1496  sa->ce_mask |= flag;
1497 
1498  return 0;
1499 }
1500 
1501 
1502 struct nl_addr* xfrmnl_sa_get_daddr (struct xfrmnl_sa* sa)
1503 {
1504  if (sa->ce_mask & XFRM_SA_ATTR_DADDR)
1505  return sa->id.daddr;
1506  else
1507  return NULL;
1508 }
1509 
1510 int xfrmnl_sa_set_daddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1511 {
1512  return __assign_addr(sa, &sa->id.daddr, addr, XFRM_SA_ATTR_DADDR, 0);
1513 }
1514 
1515 int xfrmnl_sa_get_spi (struct xfrmnl_sa* sa)
1516 {
1517  if (sa->ce_mask & XFRM_SA_ATTR_SPI)
1518  return sa->id.spi;
1519  else
1520  return -1;
1521 }
1522 
1523 int xfrmnl_sa_set_spi (struct xfrmnl_sa* sa, unsigned int spi)
1524 {
1525  sa->id.spi = spi;
1526  sa->ce_mask |= XFRM_SA_ATTR_SPI;
1527 
1528  return 0;
1529 }
1530 
1531 int xfrmnl_sa_get_proto (struct xfrmnl_sa* sa)
1532 {
1533  if (sa->ce_mask & XFRM_SA_ATTR_PROTO)
1534  return sa->id.proto;
1535  else
1536  return -1;
1537 }
1538 
1539 int xfrmnl_sa_set_proto (struct xfrmnl_sa* sa, unsigned int protocol)
1540 {
1541  sa->id.proto = protocol;
1542  sa->ce_mask |= XFRM_SA_ATTR_PROTO;
1543 
1544  return 0;
1545 }
1546 
1547 struct nl_addr* xfrmnl_sa_get_saddr (struct xfrmnl_sa* sa)
1548 {
1549  if (sa->ce_mask & XFRM_SA_ATTR_SADDR)
1550  return sa->saddr;
1551  else
1552  return NULL;
1553 }
1554 
1555 int xfrmnl_sa_set_saddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1556 {
1557  return __assign_addr(sa, &sa->saddr, addr, XFRM_SA_ATTR_SADDR, 1);
1558 }
1559 
1560 struct xfrmnl_ltime_cfg* xfrmnl_sa_get_lifetime_cfg (struct xfrmnl_sa* sa)
1561 {
1562  if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1563  return sa->lft;
1564  else
1565  return NULL;
1566 }
1567 
1568 int xfrmnl_sa_set_lifetime_cfg (struct xfrmnl_sa* sa, struct xfrmnl_ltime_cfg* ltime)
1569 {
1570  /* Release any previously held lifetime cfg object from the SA */
1571  if (sa->lft)
1572  xfrmnl_ltime_cfg_put (sa->lft);
1573 
1574  /* Increment ref count on new lifetime object and save it in the SA */
1575  xfrmnl_ltime_cfg_get (ltime);
1576  sa->lft = ltime;
1577  sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
1578 
1579  return 0;
1580 }
1581 
1582 int xfrmnl_sa_get_curlifetime (struct xfrmnl_sa* sa, unsigned long long int* curr_bytes,
1583  unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1584 {
1585  if (sa == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1586  return -1;
1587 
1588  if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CUR)
1589  {
1590  *curr_bytes = sa->curlft.bytes;
1591  *curr_packets = sa->curlft.packets;
1592  *curr_add_time = sa->curlft.add_time;
1593  *curr_use_time = sa->curlft.use_time;
1594  }
1595  else
1596  return -1;
1597 
1598  return 0;
1599 }
1600 
1601 int xfrmnl_sa_get_stats (struct xfrmnl_sa* sa, unsigned long long int* replay_window,
1602  unsigned long long int* replay, unsigned long long int* integrity_failed)
1603 {
1604  if (sa == NULL || replay_window == NULL || replay == NULL || integrity_failed == NULL)
1605  return -1;
1606 
1607  if (sa->ce_mask & XFRM_SA_ATTR_STATS)
1608  {
1609  *replay_window = sa->stats.replay_window;
1610  *replay = sa->stats.replay;
1611  *integrity_failed = sa->stats.integrity_failed;
1612  }
1613  else
1614  return -1;
1615 
1616  return 0;
1617 }
1618 
1619 int xfrmnl_sa_get_seq (struct xfrmnl_sa* sa)
1620 {
1621  if (sa->ce_mask & XFRM_SA_ATTR_SEQ)
1622  return sa->seq;
1623  else
1624  return -1;
1625 }
1626 
1627 int xfrmnl_sa_get_reqid (struct xfrmnl_sa* sa)
1628 {
1629  if (sa->ce_mask & XFRM_SA_ATTR_REQID)
1630  return sa->reqid;
1631  else
1632  return -1;
1633 }
1634 
1635 int xfrmnl_sa_set_reqid (struct xfrmnl_sa* sa, unsigned int reqid)
1636 {
1637  sa->reqid = reqid;
1638  sa->ce_mask |= XFRM_SA_ATTR_REQID;
1639 
1640  return 0;
1641 }
1642 
1643 int xfrmnl_sa_get_family (struct xfrmnl_sa* sa)
1644 {
1645  if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1646  return sa->family;
1647  else
1648  return -1;
1649 }
1650 
1651 int xfrmnl_sa_set_family (struct xfrmnl_sa* sa, unsigned int family)
1652 {
1653  sa->family = family;
1654  sa->ce_mask |= XFRM_SA_ATTR_FAMILY;
1655 
1656  return 0;
1657 }
1658 
1659 int xfrmnl_sa_get_mode (struct xfrmnl_sa* sa)
1660 {
1661  if (sa->ce_mask & XFRM_SA_ATTR_MODE)
1662  return sa->mode;
1663  else
1664  return -1;
1665 }
1666 
1667 int xfrmnl_sa_set_mode (struct xfrmnl_sa* sa, unsigned int mode)
1668 {
1669  sa->mode = mode;
1670  sa->ce_mask |= XFRM_SA_ATTR_MODE;
1671 
1672  return 0;
1673 }
1674 
1675 int xfrmnl_sa_get_replay_window (struct xfrmnl_sa* sa)
1676 {
1677  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1678  return sa->replay_window;
1679  else
1680  return -1;
1681 }
1682 
1683 int xfrmnl_sa_set_replay_window (struct xfrmnl_sa* sa, unsigned int replay_window)
1684 {
1685  sa->replay_window = replay_window;
1686  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_WIN;
1687 
1688  return 0;
1689 }
1690 
1691 int xfrmnl_sa_get_flags (struct xfrmnl_sa* sa)
1692 {
1693  if (sa->ce_mask & XFRM_SA_ATTR_FLAGS)
1694  return sa->flags;
1695  else
1696  return -1;
1697 }
1698 
1699 int xfrmnl_sa_set_flags (struct xfrmnl_sa* sa, unsigned int flags)
1700 {
1701  sa->flags = flags;
1702  sa->ce_mask |= XFRM_SA_ATTR_FLAGS;
1703 
1704  return 0;
1705 }
1706 
1707 /**
1708  * Get the aead-params
1709  * @arg sa the xfrmnl_sa object
1710  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1711  * @arg key_len an optional output value for the key length in bits.
1712  * @arg icv_len an optional output value for the alt-icv-len.
1713  * @arg key an optional buffer large enough for the key. It must contain at least
1714  * ((@key_len + 7) / 8) bytes.
1715  *
1716  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1717  * call xfrmnl_sa_get_aead_params() without @key argument to query only the required buffer size.
1718  * This modified API is available in all versions of libnl3 that support the capability
1719  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1720  *
1721  * @return 0 on success or a negative error code.
1722  */
1723 int xfrmnl_sa_get_aead_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* icv_len, char* key)
1724 {
1725  if (sa->ce_mask & XFRM_SA_ATTR_ALG_AEAD)
1726  {
1727  if (alg_name)
1728  strcpy (alg_name, sa->aead->alg_name);
1729  if (key_len)
1730  *key_len = sa->aead->alg_key_len;
1731  if (icv_len)
1732  *icv_len = sa->aead->alg_icv_len;
1733  if (key)
1734  memcpy (key, sa->aead->alg_key, ((sa->aead->alg_key_len + 7)/8));
1735  }
1736  else
1737  return -1;
1738 
1739  return 0;
1740 }
1741 
1742 int xfrmnl_sa_set_aead_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int icv_len, const char* key)
1743 {
1744  _nl_auto_free struct xfrmnl_algo_aead *b = NULL;
1745  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1746  uint32_t newlen = sizeof (struct xfrmnl_algo_aead) + keysize;
1747 
1748  /* Free up the old key and allocate memory to hold new key */
1749  if (strlen (alg_name) >= sizeof (sa->aead->alg_name))
1750  return -1;
1751  if (!(b = calloc (1, newlen)))
1752  return -1;
1753 
1754  strcpy (b->alg_name, alg_name);
1755  b->alg_key_len = key_len;
1756  b->alg_icv_len = icv_len;
1757  memcpy (b->alg_key, key, keysize);
1758 
1759  free (sa->aead);
1760  sa->aead = _nl_steal_pointer (&b);
1761  sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
1762  return 0;
1763 }
1764 
1765 /**
1766  * Get the auth-params
1767  * @arg sa the xfrmnl_sa object
1768  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1769  * @arg key_len an optional output value for the key length in bits.
1770  * @arg trunc_len an optional output value for the alg-trunc-len.
1771  * @arg key an optional buffer large enough for the key. It must contain at least
1772  * ((@key_len + 7) / 8) bytes.
1773  *
1774  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1775  * call xfrmnl_sa_get_auth_params() without @key argument to query only the required buffer size.
1776  * This modified API is available in all versions of libnl3 that support the capability
1777  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1778  *
1779  * @return 0 on success or a negative error code.
1780  */
1781 int xfrmnl_sa_get_auth_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* trunc_len, char* key)
1782 {
1783  if (sa->ce_mask & XFRM_SA_ATTR_ALG_AUTH)
1784  {
1785  if (alg_name)
1786  strcpy (alg_name, sa->auth->alg_name);
1787  if (key_len)
1788  *key_len = sa->auth->alg_key_len;
1789  if (trunc_len)
1790  *trunc_len = sa->auth->alg_trunc_len;
1791  if (key)
1792  memcpy (key, sa->auth->alg_key, (sa->auth->alg_key_len + 7)/8);
1793  }
1794  else
1795  return -1;
1796 
1797  return 0;
1798 }
1799 
1800 int xfrmnl_sa_set_auth_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int trunc_len, const char* key)
1801 {
1802  _nl_auto_free struct xfrmnl_algo_auth *b = NULL;
1803  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1804  uint32_t newlen = sizeof (struct xfrmnl_algo_auth) + keysize;
1805 
1806  if (strlen (alg_name) >= sizeof (sa->auth->alg_name))
1807  return -1;
1808  if (!(b = calloc (1, newlen)))
1809  return -1;
1810 
1811  strcpy (b->alg_name, alg_name);
1812  b->alg_key_len = key_len;
1813  b->alg_trunc_len = trunc_len;
1814  memcpy (b->alg_key, key, keysize);
1815 
1816  free (sa->auth);
1817  sa->auth = _nl_steal_pointer (&b);
1818  sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
1819  return 0;
1820 }
1821 
1822 /**
1823  * Get the crypto-params
1824  * @arg sa the xfrmnl_sa object
1825  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1826  * @arg key_len an optional output value for the key length in bits.
1827  * @arg key an optional buffer large enough for the key. It must contain at least
1828  * ((@key_len + 7) / 8) bytes.
1829  *
1830  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1831  * call xfrmnl_sa_get_crypto_params() without @key argument to query only the required buffer size.
1832  * This modified API is available in all versions of libnl3 that support the capability
1833  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1834  *
1835  * @return 0 on success or a negative error code.
1836  */
1837 int xfrmnl_sa_get_crypto_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1838 {
1839  if (sa->ce_mask & XFRM_SA_ATTR_ALG_CRYPT)
1840  {
1841  if (alg_name)
1842  strcpy (alg_name, sa->crypt->alg_name);
1843  if (key_len)
1844  *key_len = sa->crypt->alg_key_len;
1845  if (key)
1846  memcpy (key, sa->crypt->alg_key, ((sa->crypt->alg_key_len + 7)/8));
1847  }
1848  else
1849  return -1;
1850 
1851  return 0;
1852 }
1853 
1854 int xfrmnl_sa_set_crypto_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1855 {
1856  _nl_auto_free struct xfrmnl_algo *b = NULL;
1857  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1858  uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1859 
1860  if (strlen (alg_name) >= sizeof (sa->crypt->alg_name))
1861  return -1;
1862  if (!(b = calloc (1, newlen)))
1863  return -1;
1864 
1865  strcpy (b->alg_name, alg_name);
1866  b->alg_key_len = key_len;
1867  memcpy (b->alg_key, key, keysize);
1868 
1869  free(sa->crypt);
1870  sa->crypt = _nl_steal_pointer(&b);
1871  sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
1872  return 0;
1873 }
1874 
1875 /**
1876  * Get the comp-params
1877  * @arg sa the xfrmnl_sa object
1878  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1879  * @arg key_len an optional output value for the key length in bits.
1880  * @arg key an optional buffer large enough for the key. It must contain at least
1881  * ((@key_len + 7) / 8) bytes.
1882  *
1883  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1884  * call xfrmnl_sa_get_comp_params() without @key argument to query only the required buffer size.
1885  * This modified API is available in all versions of libnl3 that support the capability
1886  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1887  *
1888  * @return 0 on success or a negative error code.
1889  */
1890 int xfrmnl_sa_get_comp_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1891 {
1892  if (sa->ce_mask & XFRM_SA_ATTR_ALG_COMP)
1893  {
1894  if (alg_name)
1895  strcpy (alg_name, sa->comp->alg_name);
1896  if (key_len)
1897  *key_len = sa->comp->alg_key_len;
1898  if (key)
1899  memcpy (key, sa->comp->alg_key, ((sa->comp->alg_key_len + 7)/8));
1900  }
1901  else
1902  return -1;
1903 
1904  return 0;
1905 }
1906 
1907 int xfrmnl_sa_set_comp_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1908 {
1909  _nl_auto_free struct xfrmnl_algo *b = NULL;
1910  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1911  uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1912 
1913  if (strlen (alg_name) >= sizeof (sa->comp->alg_name))
1914  return -1;
1915  if (!(b = calloc (1, newlen)))
1916  return -1;
1917 
1918  strcpy (b->alg_name, alg_name);
1919  b->alg_key_len = key_len;
1920  memcpy (b->alg_key, key, keysize);
1921 
1922  free(sa->comp);
1923  sa->comp = _nl_steal_pointer(&b);
1924  sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
1925  return 0;
1926 }
1927 
1928 int xfrmnl_sa_get_encap_tmpl (struct xfrmnl_sa* sa, unsigned int* encap_type, unsigned int* encap_sport, unsigned int* encap_dport, struct nl_addr** encap_oa)
1929 {
1930  if (sa->ce_mask & XFRM_SA_ATTR_ENCAP)
1931  {
1932  *encap_type = sa->encap->encap_type;
1933  *encap_sport = sa->encap->encap_sport;
1934  *encap_dport = sa->encap->encap_dport;
1935  *encap_oa = nl_addr_clone (sa->encap->encap_oa);
1936  }
1937  else
1938  return -1;
1939 
1940  return 0;
1941 }
1942 
1943 int xfrmnl_sa_set_encap_tmpl (struct xfrmnl_sa* sa, unsigned int encap_type, unsigned int encap_sport, unsigned int encap_dport, struct nl_addr* encap_oa)
1944 {
1945  if (sa->encap) {
1946  /* Free up the old encap OA */
1947  if (sa->encap->encap_oa)
1948  nl_addr_put(sa->encap->encap_oa);
1949  memset(sa->encap, 0, sizeof (*sa->encap));
1950  } else if ((sa->encap = calloc(1, sizeof(*sa->encap))) == NULL)
1951  return -1;
1952 
1953  /* Save the new info */
1954  sa->encap->encap_type = encap_type;
1955  sa->encap->encap_sport = encap_sport;
1956  sa->encap->encap_dport = encap_dport;
1957  nl_addr_get (encap_oa);
1958  sa->encap->encap_oa = encap_oa;
1959 
1960  sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
1961 
1962  return 0;
1963 }
1964 
1965 int xfrmnl_sa_get_tfcpad (struct xfrmnl_sa* sa)
1966 {
1967  if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
1968  return sa->tfcpad;
1969  else
1970  return -1;
1971 }
1972 
1973 int xfrmnl_sa_set_tfcpad (struct xfrmnl_sa* sa, unsigned int tfcpad)
1974 {
1975  sa->tfcpad = tfcpad;
1976  sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
1977 
1978  return 0;
1979 }
1980 
1981 struct nl_addr* xfrmnl_sa_get_coaddr (struct xfrmnl_sa* sa)
1982 {
1983  if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
1984  return sa->coaddr;
1985  else
1986  return NULL;
1987 }
1988 
1989 int xfrmnl_sa_set_coaddr (struct xfrmnl_sa* sa, struct nl_addr* coaddr)
1990 {
1991  /* Free up the old coaddr */
1992  if (sa->coaddr)
1993  nl_addr_put (sa->coaddr);
1994 
1995  /* Save the new info */
1996  nl_addr_get (coaddr);
1997  sa->coaddr = coaddr;
1998 
1999  sa->ce_mask |= XFRM_SA_ATTR_COADDR;
2000 
2001  return 0;
2002 }
2003 
2004 int xfrmnl_sa_get_mark (struct xfrmnl_sa* sa, unsigned int* mark_mask, unsigned int* mark_value)
2005 {
2006  if (mark_mask == NULL || mark_value == NULL)
2007  return -1;
2008 
2009  if (sa->ce_mask & XFRM_SA_ATTR_MARK)
2010  {
2011  *mark_mask = sa->mark.m;
2012  *mark_value = sa->mark.v;
2013 
2014  return 0;
2015  }
2016  else
2017  return -1;
2018 }
2019 
2020 int xfrmnl_sa_set_mark (struct xfrmnl_sa* sa, unsigned int value, unsigned int mask)
2021 {
2022  sa->mark.v = value;
2023  sa->mark.m = mask;
2024  sa->ce_mask |= XFRM_SA_ATTR_MARK;
2025 
2026  return 0;
2027 }
2028 
2029 /**
2030  * Get the security context.
2031  *
2032  * @arg sa The xfrmnl_sa object.
2033  * @arg doi An optional output value for the security context domain of interpretation.
2034  * @arg alg An optional output value for the security context algorithm.
2035  * @arg len An optional output value for the security context length, including the
2036  * terminating null byte ('\0').
2037  * @arg sid Unused parameter.
2038  * @arg ctx_str An optional buffer large enough for the security context string. It must
2039  * contain at least @len bytes.
2040  *
2041  * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
2042  * call xfrmnl_sa_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
2043  * This modified API is available in all versions of libnl3 that support the capability
2044  * @def NL_CAPABILITY_XFRM_SEC_CTX_LEN (@see nl_has_capability for further information).
2045  *
2046  * @return 0 on success or a negative error code.
2047  */
2048 int xfrmnl_sa_get_sec_ctx (struct xfrmnl_sa* sa, unsigned int* doi, unsigned int* alg,
2049  unsigned int* len, unsigned int* sid, char* ctx_str)
2050 {
2051  if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
2052  {
2053  if (doi)
2054  *doi = sa->sec_ctx->ctx_doi;
2055  if (alg)
2056  *alg = sa->sec_ctx->ctx_alg;
2057  if (len)
2058  *len = sa->sec_ctx->ctx_len;
2059  if (ctx_str)
2060  memcpy (ctx_str, sa->sec_ctx->ctx, sa->sec_ctx->ctx_len);
2061  }
2062  else
2063  return -1;
2064 
2065  return 0;
2066 }
2067 
2068 /**
2069  * Set the security context.
2070  *
2071  * @arg sa The xfrmnl_sa object.
2072  * @arg doi Parameter for the security context domain of interpretation.
2073  * @arg alg Parameter for the security context algorithm.
2074  * @arg len Parameter for the length of the security context string containing
2075  * the terminating null byte ('\0').
2076  * @arg sid Unused parameter.
2077  * @arg ctx_str Buffer containing the security context string.
2078  *
2079  * @return 0 on success or a negative error code.
2080  */
2081 int xfrmnl_sa_set_sec_ctx (struct xfrmnl_sa* sa, unsigned int doi, unsigned int alg, unsigned int len,
2082  unsigned int sid, const char* ctx_str)
2083 {
2084  _nl_auto_free struct xfrmnl_user_sec_ctx *b = NULL;
2085 
2086  if (!(b = calloc(1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + len)))
2087  return -1;
2088 
2089  b->len = sizeof(struct xfrmnl_user_sec_ctx) + len;
2090  b->exttype = XFRMA_SEC_CTX;
2091  b->ctx_alg = alg;
2092  b->ctx_doi = doi;
2093  b->ctx_len = len;
2094  memcpy (b->ctx, ctx_str, len);
2095  b->ctx[len] = '\0';
2096 
2097  free(sa->sec_ctx);
2098  sa->sec_ctx = _nl_steal_pointer(&b);
2099  sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
2100  return 0;
2101 }
2102 
2103 
2104 int xfrmnl_sa_get_replay_maxage (struct xfrmnl_sa* sa)
2105 {
2106  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE)
2107  return sa->replay_maxage;
2108  else
2109  return -1;
2110 }
2111 
2112 int xfrmnl_sa_set_replay_maxage (struct xfrmnl_sa* sa, unsigned int replay_maxage)
2113 {
2114  sa->replay_maxage = replay_maxage;
2115  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
2116 
2117  return 0;
2118 }
2119 
2120 int xfrmnl_sa_get_replay_maxdiff (struct xfrmnl_sa* sa)
2121 {
2122  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF)
2123  return sa->replay_maxdiff;
2124  else
2125  return -1;
2126 }
2127 
2128 int xfrmnl_sa_set_replay_maxdiff (struct xfrmnl_sa* sa, unsigned int replay_maxdiff)
2129 {
2130  sa->replay_maxdiff = replay_maxdiff;
2131  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
2132 
2133  return 0;
2134 }
2135 
2136 int xfrmnl_sa_get_replay_state (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
2137 {
2138  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2139  {
2140  if (sa->replay_state_esn == NULL)
2141  {
2142  *oseq = sa->replay_state.oseq;
2143  *seq = sa->replay_state.seq;
2144  *bmp = sa->replay_state.bitmap;
2145 
2146  return 0;
2147  }
2148  else
2149  {
2150  return -1;
2151  }
2152  }
2153  else
2154  return -1;
2155 }
2156 
2157 int xfrmnl_sa_set_replay_state (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq, unsigned int bitmap)
2158 {
2159  sa->replay_state.oseq = oseq;
2160  sa->replay_state.seq = seq;
2161  sa->replay_state.bitmap = bitmap;
2162  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2163 
2164  return 0;
2165 }
2166 
2167 int xfrmnl_sa_get_replay_state_esn (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
2168  unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
2169 {
2170  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2171  {
2172  if (sa->replay_state_esn)
2173  {
2174  *oseq = sa->replay_state_esn->oseq;
2175  *seq = sa->replay_state_esn->seq;
2176  *oseq_hi= sa->replay_state_esn->oseq_hi;
2177  *seq_hi = sa->replay_state_esn->seq_hi;
2178  *replay_window = sa->replay_state_esn->replay_window;
2179  *bmp_len = sa->replay_state_esn->bmp_len; // In number of 32 bit words
2180  memcpy (bmp, sa->replay_state_esn->bmp, sa->replay_state_esn->bmp_len * sizeof (uint32_t));
2181 
2182  return 0;
2183  }
2184  else
2185  {
2186  return -1;
2187  }
2188  }
2189  else
2190  return -1;
2191 }
2192 
2193 int xfrmnl_sa_set_replay_state_esn (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq,
2194  unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
2195  unsigned int bmp_len, unsigned int* bmp)
2196 {
2197  _nl_auto_free struct xfrmnl_replay_state_esn *b = NULL;
2198 
2199  if (!(b = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * bmp_len))))
2200  return -1;
2201 
2202  b->oseq = oseq;
2203  b->seq = seq;
2204  b->oseq_hi = oseq_hi;
2205  b->seq_hi = seq_hi;
2206  b->replay_window = replay_window;
2207  b->bmp_len = bmp_len; // In number of 32 bit words
2208  memcpy (b->bmp, bmp, bmp_len * sizeof (uint32_t));
2209 
2210  free(sa->replay_state_esn);
2211  sa->replay_state_esn = _nl_steal_pointer(&b);
2212  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2213  return 0;
2214 }
2215 
2216 
2217 /**
2218  * Get interface id and flags from xfrm_user_offload.
2219  *
2220  * @arg sa The xfrmnl_sa object.
2221  * @arg ifindex An optional output value for the offload interface index.
2222  * @arg flags An optional output value for the offload flags.
2223  *
2224  * @return 0 on success or a negative error code.
2225  */
2226 int xfrmnl_sa_get_user_offload(struct xfrmnl_sa *sa, int *ifindex, uint8_t *flags)
2227 {
2228  int ret = -1;
2229 
2230  if (sa->ce_mask & XFRM_SA_ATTR_OFFLOAD_DEV && sa->user_offload) {
2231  if (ifindex)
2232  *ifindex = sa->user_offload->ifindex;
2233  if (flags)
2234  *flags = sa->user_offload->flags;
2235  ret = 0;
2236  }
2237 
2238  return ret;
2239 }
2240 
2241 
2242 /**
2243  * Set interface id and flags for xfrm_user_offload.
2244  *
2245  * @arg sa The xfrmnl_sa object.
2246  * @arg ifindex Id of the offload interface.
2247  * @arg flags Offload flags for the state.
2248  *
2249  * @return 0 on success or a negative error code.
2250  */
2251 int xfrmnl_sa_set_user_offload(struct xfrmnl_sa *sa, int ifindex, uint8_t flags)
2252 {
2253  _nl_auto_free struct xfrmnl_user_offload *b = NULL;
2254 
2255  if (!(b = calloc(1, sizeof(*b))))
2256  return -1;
2257 
2258  b->ifindex = ifindex;
2259  b->flags = flags;
2260 
2261  free(sa->user_offload);
2262  sa->user_offload = _nl_steal_pointer(&b);
2263  sa->ce_mask |= XFRM_SA_ATTR_OFFLOAD_DEV;
2264 
2265  return 0;
2266 }
2267 
2268 int xfrmnl_sa_is_hardexpiry_reached (struct xfrmnl_sa* sa)
2269 {
2270  if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2271  return (sa->hard > 0 ? 1: 0);
2272  else
2273  return 0;
2274 }
2275 
2276 int xfrmnl_sa_is_expiry_reached (struct xfrmnl_sa* sa)
2277 {
2278  if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2279  return 1;
2280  else
2281  return 0;
2282 }
2283 
2284 /** @} */
2285 
2286 static struct nl_object_ops xfrm_sa_obj_ops = {
2287  .oo_name = "xfrm/sa",
2288  .oo_size = sizeof(struct xfrmnl_sa),
2289  .oo_constructor = xfrm_sa_alloc_data,
2290  .oo_free_data = xfrm_sa_free_data,
2291  .oo_clone = xfrm_sa_clone,
2292  .oo_dump = {
2293  [NL_DUMP_LINE] = xfrm_sa_dump_line,
2294  [NL_DUMP_DETAILS] = xfrm_sa_dump_details,
2295  [NL_DUMP_STATS] = xfrm_sa_dump_stats,
2296  },
2297  .oo_compare = xfrm_sa_compare,
2298  .oo_attrs2str = xfrm_sa_attrs2str,
2299  .oo_id_attrs = (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO),
2300 };
2301 
2302 static struct nl_af_group xfrm_sa_groups[] = {
2303  { AF_UNSPEC, XFRMNLGRP_SA },
2304  { AF_UNSPEC, XFRMNLGRP_EXPIRE },
2305  { END_OF_GROUP_LIST },
2306 };
2307 
2308 static struct nl_cache_ops xfrmnl_sa_ops = {
2309  .co_name = "xfrm/sa",
2310  .co_hdrsize = sizeof(struct xfrm_usersa_info),
2311  .co_msgtypes = {
2312  { XFRM_MSG_NEWSA, NL_ACT_NEW, "new" },
2313  { XFRM_MSG_DELSA, NL_ACT_DEL, "del" },
2314  { XFRM_MSG_GETSA, NL_ACT_GET, "get" },
2315  { XFRM_MSG_EXPIRE, NL_ACT_UNSPEC, "expire"},
2316  { XFRM_MSG_UPDSA, NL_ACT_NEW, "update"},
2317  END_OF_MSGTYPES_LIST,
2318  },
2319  .co_protocol = NETLINK_XFRM,
2320  .co_groups = xfrm_sa_groups,
2321  .co_request_update = xfrm_sa_request_update,
2322  .co_msg_parser = xfrm_sa_msg_parser,
2323  .co_obj_ops = &xfrm_sa_obj_ops,
2324  .co_include_event = &xfrm_sa_update_cache
2325 };
2326 
2327 /**
2328  * @name XFRM SA Cache Managament
2329  * @{
2330  */
2331 
2332 static void __attribute__ ((constructor)) xfrm_sa_init(void)
2333 {
2334  nl_cache_mngt_register(&xfrmnl_sa_ops);
2335 }
2336 
2337 static void __attribute__ ((destructor)) xfrm_sa_exit(void)
2338 {
2339  nl_cache_mngt_unregister(&xfrmnl_sa_ops);
2340 }
2341 
2342 /** @} */
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:76
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:162
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:156
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:78
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:97
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:95
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:935
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:993
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:959
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:579
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:211
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition: addr.c:887
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:487
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:517
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:947
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:533
struct nlattr * nla_reserve(struct nl_msg *msg, int attrtype, int attrlen)
Reserve space for a attribute.
Definition: attr.c:449
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition: attr.h:230
int nla_put(struct nl_msg *msg, int attrtype, int datalen, const void *data)
Add a unspecific attribute to netlink message.
Definition: attr.c:493
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:114
@ NLA_U32
32 bit integer
Definition: attr.h:37
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:281
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:246
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:140
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:114
struct nl_object * nl_cache_search(struct nl_cache *cache, struct nl_object *needle)
Search object in cache.
Definition: cache.c:1108
void nl_cache_remove(struct nl_object *obj)
Remove object from cache.
Definition: cache.c:546
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:228
int nl_cache_move(struct nl_cache *cache, struct nl_object *obj)
Move object from one cache to another.
Definition: cache.c:518
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:341
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:558
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:208
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:442
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:100
int nl_object_get_msgtype(const struct nl_object *obj)
Return the netlink message type the object was derived from.
Definition: object.c:532
uint64_t nl_object_diff64(struct nl_object *a, struct nl_object *b)
Compute bitmask representing difference in attribute values.
Definition: object.c:364
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:214
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:48
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:203
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:510
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1241
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1172
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1106
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:574
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:955
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:18
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:16
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:17
Dumping parameters.
Definition: types.h:28
Attribute validation policy.
Definition: attr.h:63
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68