libnl  3.4.0
ae.c
1 /*
2  * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
3  *
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * Redistributions of source code must retain the above copyright
10  * notice, this list of conditions and the following disclaimer.
11  *
12  * Redistributions in binary form must reproduce the above copyright
13  * notice, this list of conditions and the following disclaimer in the
14  * documentation and/or other materials provided with the
15  * distribution.
16  *
17  * Neither the name of Texas Instruments Incorporated nor the names of
18  * its contributors may be used to endorse or promote products derived
19  * from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  *
33  */
34 
35 /**
36  * @ingroup xfrmnl
37  * @defgroup ae Attribute Element
38  * @brief
39  *
40  * The AE interface allows a user to retrieve and update various
41  * Security Association (SA) attributes such as lifetime, replay state etc.
42  *
43  * @par AE Flags
44  * @code
45  * XFRM_AE_UNSPEC
46  * XFRM_AE_RTHR=1
47  * XFRM_AE_RVAL=2
48  * XFRM_AE_LVAL=4
49  * XFRM_AE_ETHR=8
50  * XFRM_AE_CR=16
51  * XFRM_AE_CE=32
52  * XFRM_AE_CU=64
53  * @endcode
54  *
55  * @par AE Identification
56  * An AE is uniquely identified by the attributes listed below, whenever
57  * you refer to an existing AE all of the attributes must be set. There is
58  * no cache support for AE since you can retrieve the AE for any given combination
59  * of attributes mentioned below, but not all at once since they just characterize
60  * an SA.
61  * - destination address (xfrmnl_ae_set_daddr())
62  * - SPI (xfrmnl_ae_set_spi)
63  * - protocol (xfrmnl_ae_set_proto)
64  * - mark (xfrmnl_ae_set_mark)
65  *
66  * @par Changeable Attributes
67  * \anchor ae_changeable
68  * - current lifetime (xfrmnl_ae_set_curlifetime())
69  * - replay properties (xfrmnl_ae_set_replay_maxage(), xfrmnl_ae_set_replay_maxdiff())
70  * - replay state (xfrmnl_ae_set_replay_state(), xfrmnl_ae_set_replay_state_esn))
71  *
72  * @par Required Caches for Dumping
73  * None
74  *
75  * @par TODO
76  * None
77  *
78  * @par 1) Retrieving AE information for a given SA tuple
79  * @code
80  * // Create a netlink socket and connect it to XFRM subsystem in
81  * the kernel to be able to send/receive info from userspace.
82  * struct nl_sock* sk = nl_socket_alloc ();
83  * nl_connect (sk, NETLINK_XFRM);
84  *
85  * // AEs can then be looked up by the SA tuple, destination address,
86  * SPI, protocol, mark:
87  * struct xfrmnl_ae *ae;
88  * xfrmnl_ae_get_kernel(sk, dst_addr, spi, proto,mark_mask, mark_value, &ae);
89  *
90  * // After successful usage, the object must be freed
91  * xfrmnl_ae_put(ae);
92  * @endcode
93  *
94  * @par 2) Updating AE
95  * @code
96  * // Allocate an empty AE handle to be filled out with the attributes
97  * // of the new AE.
98  * struct xfrmnl_ae *ae = xfrmnl_ae_alloc();
99  *
100  * // Fill out the attributes of the new AE
101  * xfrmnl_ae_set_daddr(ae, dst_addr);
102  * xfrmnl_ae_set_spi(ae, 0xDEADBEEF);
103  * xfrmnl_ae_set_proto(ae, 50);
104  * xfrmnl_ae_set_mark(ae, 0x0);
105  * xfrmnl_ae_set_saddr(ae, src_addr);
106  * xfrmnl_ae_set_curlifetime(ae, 540, 10, 0xAABB1122, 0x0);
107  *
108  * // Build the netlink message and send it to the kernel, the operation will
109  * // block until the operation has been completed. Alternatively, a netlink message
110  * // can be built using xfrmnl_ae_build_get_request () API and be sent using
111  * // nl_send_auto(). Further the result from the kernel can be parsed using
112  * // xfrmnl_ae_parse() API.
113  * xfrmnl_ae_set(sk, ae, NLM_F_REPLACE);
114  *
115  * // Free the memory
116  * xfrmnl_ae_put(ae);
117  * @endcode
118  *
119  * @{
120  */
121 
122 #include <netlink-private/netlink.h>
123 #include <netlink/netlink.h>
124 #include <netlink/cache.h>
125 #include <netlink/object.h>
126 #include <netlink/xfrm/ae.h>
127 #include <linux/xfrm.h>
128 
129 /** @cond SKIP */
130 #define XFRM_AE_ATTR_DADDR 0x01
131 #define XFRM_AE_ATTR_SPI 0x02
132 #define XFRM_AE_ATTR_PROTO 0x04
133 #define XFRM_AE_ATTR_SADDR 0x08
134 #define XFRM_AE_ATTR_FLAGS 0x10
135 #define XFRM_AE_ATTR_REQID 0x20
136 #define XFRM_AE_ATTR_MARK 0x40
137 #define XFRM_AE_ATTR_LIFETIME 0x80
138 #define XFRM_AE_ATTR_REPLAY_MAXAGE 0x100
139 #define XFRM_AE_ATTR_REPLAY_MAXDIFF 0x200
140 #define XFRM_AE_ATTR_REPLAY_STATE 0x400
141 #define XFRM_AE_ATTR_FAMILY 0x800
142 
143 static struct nl_object_ops xfrm_ae_obj_ops;
144 /** @endcond */
145 
146 
147 static void xfrm_ae_free_data(struct nl_object *c)
148 {
149  struct xfrmnl_ae* ae = nl_object_priv (c);
150 
151  if (ae == NULL)
152  return;
153 
154  nl_addr_put (ae->sa_id.daddr);
155  nl_addr_put (ae->saddr);
156 
157  if (ae->replay_state_esn)
158  free (ae->replay_state_esn);
159 }
160 
161 static int xfrm_ae_clone(struct nl_object *_dst, struct nl_object *_src)
162 {
163  struct xfrmnl_ae* dst = nl_object_priv(_dst);
164  struct xfrmnl_ae* src = nl_object_priv(_src);
165 
166  if (src->sa_id.daddr)
167  if ((dst->sa_id.daddr = nl_addr_clone (src->sa_id.daddr)) == NULL)
168  return -NLE_NOMEM;
169 
170  if (src->saddr)
171  if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
172  return -NLE_NOMEM;
173 
174  if (src->replay_state_esn)
175  {
176  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * src->replay_state_esn->bmp_len);
177  if ((dst->replay_state_esn = malloc (len)) == NULL)
178  return -NLE_NOMEM;
179  memcpy (dst->replay_state_esn, src->replay_state_esn, len);
180  }
181 
182  return 0;
183 }
184 
185 static uint64_t xfrm_ae_compare(struct nl_object *_a, struct nl_object *_b,
186  uint64_t attrs, int flags)
187 {
188  struct xfrmnl_ae* a = (struct xfrmnl_ae *) _a;
189  struct xfrmnl_ae* b = (struct xfrmnl_ae *) _b;
190  uint64_t diff = 0;
191  int found = 0;
192 
193 #define XFRM_AE_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_AE_ATTR_##ATTR, a, b, EXPR)
194  diff |= XFRM_AE_DIFF(DADDR, nl_addr_cmp(a->sa_id.daddr, b->sa_id.daddr));
195  diff |= XFRM_AE_DIFF(SPI, a->sa_id.spi != b->sa_id.spi);
196  diff |= XFRM_AE_DIFF(PROTO, a->sa_id.proto != b->sa_id.proto);
197  diff |= XFRM_AE_DIFF(SADDR, nl_addr_cmp(a->saddr, b->saddr));
198  diff |= XFRM_AE_DIFF(FLAGS, a->flags != b->flags);
199  diff |= XFRM_AE_DIFF(REQID, a->reqid != b->reqid);
200  diff |= XFRM_AE_DIFF(MARK, (a->mark.v & a->mark.m) != (b->mark.v & b->mark.m));
201  diff |= XFRM_AE_DIFF(REPLAY_MAXAGE, a->replay_maxage != b->replay_maxage);
202  diff |= XFRM_AE_DIFF(REPLAY_MAXDIFF, a->replay_maxdiff != b->replay_maxdiff);
203 
204  /* Compare replay states */
205  found = AVAILABLE_MISMATCH (a, b, XFRM_AE_ATTR_REPLAY_STATE);
206  if (found == 0) // attribute exists in both objects
207  {
208  if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
209  ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
210  found |= 1;
211 
212  if (found == 0) // same replay type. compare actual values
213  {
214  if (a->replay_state_esn)
215  {
216  if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
217  diff |= 1;
218  else
219  {
220  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * a->replay_state_esn->bmp_len);
221  diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
222  }
223  }
224  else
225  {
226  if ((a->replay_state.oseq != b->replay_state.oseq) ||
227  (a->replay_state.seq != b->replay_state.seq) ||
228  (a->replay_state.bitmap != b->replay_state.bitmap))
229  diff |= 1;
230  }
231  }
232  }
233 #undef XFRM_AE_DIFF
234 
235  return diff;
236 }
237 
238 /**
239  * @name XFRM AE Attribute Translations
240  * @{
241  */
242 static const struct trans_tbl ae_attrs[] =
243 {
244  __ADD(XFRM_AE_ATTR_DADDR, daddr),
245  __ADD(XFRM_AE_ATTR_SPI, spi),
246  __ADD(XFRM_AE_ATTR_PROTO, protocol),
247  __ADD(XFRM_AE_ATTR_SADDR, saddr),
248  __ADD(XFRM_AE_ATTR_FLAGS, flags),
249  __ADD(XFRM_AE_ATTR_REQID, reqid),
250  __ADD(XFRM_AE_ATTR_MARK, mark),
251  __ADD(XFRM_AE_ATTR_LIFETIME, cur_lifetime),
252  __ADD(XFRM_AE_ATTR_REPLAY_MAXAGE, replay_maxage),
253  __ADD(XFRM_AE_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
254  __ADD(XFRM_AE_ATTR_REPLAY_STATE, replay_state),
255 };
256 
257 static char* xfrm_ae_attrs2str (int attrs, char *buf, size_t len)
258 {
259  return __flags2str(attrs, buf, len, ae_attrs, ARRAY_SIZE(ae_attrs));
260 }
261 /** @} */
262 
263 /**
264  * @name XFRM AE Flags Translations
265  * @{
266  */
267 
268 static const struct trans_tbl ae_flags[] = {
269  __ADD(XFRM_AE_UNSPEC, unspecified),
270  __ADD(XFRM_AE_RTHR, replay threshold),
271  __ADD(XFRM_AE_RVAL, replay value),
272  __ADD(XFRM_AE_LVAL, lifetime value),
273  __ADD(XFRM_AE_ETHR, expiry time threshold),
274  __ADD(XFRM_AE_CR, replay update event),
275  __ADD(XFRM_AE_CE, timer expiry event),
276  __ADD(XFRM_AE_CU, policy update event),
277 };
278 
279 char* xfrmnl_ae_flags2str(int flags, char *buf, size_t len)
280 {
281  return __flags2str (flags, buf, len, ae_flags, ARRAY_SIZE(ae_flags));
282 }
283 
284 int xfrmnl_ae_str2flag(const char *name)
285 {
286  return __str2flags(name, ae_flags, ARRAY_SIZE(ae_flags));
287 }
288 /** @} */
289 
290 static void xfrm_ae_dump_line(struct nl_object *a, struct nl_dump_params *p)
291 {
292  char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
293  struct xfrmnl_ae* ae = (struct xfrmnl_ae *) a;
294  char flags[128], buf[128];
295  time_t add_time, use_time;
296  struct tm *add_time_tm, *use_time_tm;
297 
298  nl_dump_line(p, "src %s dst %s \n", nl_addr2str(ae->saddr, src, sizeof(src)),
299  nl_addr2str(ae->sa_id.daddr, dst, sizeof(dst)));
300 
301  nl_dump_line(p, "\tproto %s spi 0x%x reqid %u ",
302  nl_ip_proto2str (ae->sa_id.proto, buf, sizeof (buf)),
303  ae->sa_id.spi, ae->reqid);
304 
305  xfrmnl_ae_flags2str(ae->flags, flags, sizeof (flags));
306  nl_dump_line(p, "flags %s(0x%x) mark mask/value 0x%x/0x%x \n", flags,
307  ae->flags, ae->mark.m, ae->mark.v);
308 
309  nl_dump_line(p, "\tlifetime current: \n");
310  nl_dump_line(p, "\t\tbytes %llu packets %llu \n", ae->lifetime_cur.bytes,
311  ae->lifetime_cur.packets);
312  if (ae->lifetime_cur.add_time != 0)
313  {
314  add_time = ae->lifetime_cur.add_time;
315  add_time_tm = gmtime (&add_time);
316  strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
317  }
318  else
319  {
320  sprintf (flags, "%s", "-");
321  }
322 
323  if (ae->lifetime_cur.use_time != 0)
324  {
325  use_time = ae->lifetime_cur.use_time;
326  use_time_tm = gmtime (&use_time);
327  strftime (buf, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
328  }
329  else
330  {
331  sprintf (buf, "%s", "-");
332  }
333  nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, buf);
334 
335  nl_dump_line(p, "\treplay info: \n");
336  nl_dump_line(p, "\t\tmax age %u max diff %u \n", ae->replay_maxage, ae->replay_maxdiff);
337 
338  nl_dump_line(p, "\treplay state info: \n");
339  if (ae->replay_state_esn)
340  {
341  nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
342  ae->replay_state_esn->oseq, ae->replay_state_esn->seq,
343  ae->replay_state_esn->oseq_hi, ae->replay_state_esn->seq_hi,
344  ae->replay_state_esn->replay_window);
345  }
346  else
347  {
348  nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", ae->replay_state.oseq,
349  ae->replay_state.seq, ae->replay_state.bitmap);
350  }
351 
352  nl_dump(p, "\n");
353 }
354 
355 static void xfrm_ae_dump_details(struct nl_object *a, struct nl_dump_params *p)
356 {
357  xfrm_ae_dump_line(a, p);
358 }
359 
360 static void xfrm_ae_dump_stats(struct nl_object *a, struct nl_dump_params *p)
361 {
362  xfrm_ae_dump_details(a, p);
363 }
364 
365 
366 static int build_xfrm_ae_message(struct xfrmnl_ae *tmpl, int cmd, int flags,
367  struct nl_msg **result)
368 {
369  struct nl_msg* msg;
370  struct xfrm_aevent_id ae_id;
371 
372  if (!(tmpl->ce_mask & XFRM_AE_ATTR_DADDR) ||
373  !(tmpl->ce_mask & XFRM_AE_ATTR_SPI) ||
374  !(tmpl->ce_mask & XFRM_AE_ATTR_PROTO))
375  return -NLE_MISSING_ATTR;
376 
377  memcpy (&ae_id.sa_id.daddr, nl_addr_get_binary_addr (tmpl->sa_id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->sa_id.daddr));
378  ae_id.sa_id.spi = htonl(tmpl->sa_id.spi);
379  ae_id.sa_id.family = tmpl->sa_id.family;
380  ae_id.sa_id.proto = tmpl->sa_id.proto;
381 
382  if (tmpl->ce_mask & XFRM_AE_ATTR_SADDR)
383  memcpy (&ae_id.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
384 
385  if (tmpl->ce_mask & XFRM_AE_ATTR_FLAGS)
386  ae_id.flags = tmpl->flags;
387 
388  if (tmpl->ce_mask & XFRM_AE_ATTR_REQID)
389  ae_id.reqid = tmpl->reqid;
390 
391  msg = nlmsg_alloc_simple(cmd, flags);
392  if (!msg)
393  return -NLE_NOMEM;
394 
395  if (nlmsg_append(msg, &ae_id, sizeof(ae_id), NLMSG_ALIGNTO) < 0)
396  goto nla_put_failure;
397 
398  if (tmpl->ce_mask & XFRM_AE_ATTR_MARK)
399  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrmnl_mark), &tmpl->mark);
400 
401  if (tmpl->ce_mask & XFRM_AE_ATTR_LIFETIME)
402  NLA_PUT (msg, XFRMA_LTIME_VAL, sizeof (struct xfrmnl_lifetime_cur), &tmpl->lifetime_cur);
403 
404  if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_MAXAGE)
405  NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
406 
407  if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_MAXDIFF)
408  NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
409 
410  if (tmpl->ce_mask & XFRM_AE_ATTR_REPLAY_STATE) {
411  if (tmpl->replay_state_esn) {
412  uint32_t len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
413  NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
414  }
415  else {
416  NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrmnl_replay_state), &tmpl->replay_state);
417  }
418  }
419 
420  *result = msg;
421  return 0;
422 
423 nla_put_failure:
424  nlmsg_free(msg);
425  return -NLE_MSGSIZE;
426 }
427 
428 /**
429  * @name XFRM AE Update
430  * @{
431  */
432 
433 int xfrmnl_ae_set(struct nl_sock* sk, struct xfrmnl_ae* ae, int flags)
434 {
435  int err;
436  struct nl_msg *msg;
437 
438  if ((err = build_xfrm_ae_message(ae, XFRM_MSG_NEWAE, flags|NLM_F_REPLACE, &msg)) < 0)
439  return err;
440 
441  err = nl_send_auto_complete(sk, msg);
442  nlmsg_free(msg);
443  if (err < 0)
444  return err;
445 
446  return nl_wait_for_ack(sk);
447 }
448 
449 /** @} */
450 
451 /**
452  * @name XFRM AE Object Allocation/Freeage
453  * @{
454  */
455 
456 struct xfrmnl_ae* xfrmnl_ae_alloc(void)
457 {
458  return (struct xfrmnl_ae*) nl_object_alloc(&xfrm_ae_obj_ops);
459 }
460 
461 void xfrmnl_ae_put(struct xfrmnl_ae* ae)
462 {
463  nl_object_put((struct nl_object *) ae);
464 }
465 
466 /** @} */
467 
468 static struct nla_policy xfrm_ae_policy[XFRMA_MAX+1] = {
469  [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
470  [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
471  [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
472  [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
473  [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
474  [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
475  [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
476 };
477 
478 int xfrmnl_ae_parse(struct nlmsghdr *n, struct xfrmnl_ae **result)
479 {
480  struct xfrmnl_ae* ae;
481  struct nlattr *tb[XFRMA_MAX + 1];
482  struct xfrm_aevent_id* ae_id;
483  int err;
484 
485  ae = xfrmnl_ae_alloc();
486  if (!ae) {
487  err = -NLE_NOMEM;
488  goto errout;
489  }
490 
491  ae->ce_msgtype = n->nlmsg_type;
492  ae_id = nlmsg_data(n);
493 
494  err = nlmsg_parse(n, sizeof(struct xfrm_aevent_id), tb, XFRMA_MAX, xfrm_ae_policy);
495  if (err < 0)
496  goto errout;
497 
498  ae->sa_id.daddr = nl_addr_build(ae_id->sa_id.family, &ae_id->sa_id.daddr, sizeof (ae_id->sa_id.daddr));
499  ae->sa_id.family= ae_id->sa_id.family;
500  ae->sa_id.spi = ntohl(ae_id->sa_id.spi);
501  ae->sa_id.proto = ae_id->sa_id.proto;
502  ae->saddr = nl_addr_build(ae_id->sa_id.family, &ae_id->saddr, sizeof (ae_id->saddr));
503  ae->reqid = ae_id->reqid;
504  ae->flags = ae_id->flags;
505  ae->ce_mask |= (XFRM_AE_ATTR_DADDR | XFRM_AE_ATTR_FAMILY | XFRM_AE_ATTR_SPI |
506  XFRM_AE_ATTR_PROTO | XFRM_AE_ATTR_SADDR | XFRM_AE_ATTR_REQID |
507  XFRM_AE_ATTR_FLAGS);
508 
509  if (tb[XFRMA_MARK]) {
510  struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
511  ae->mark.m = m->m;
512  ae->mark.v = m->v;
513  ae->ce_mask |= XFRM_AE_ATTR_MARK;
514  }
515 
516  if (tb[XFRMA_LTIME_VAL]) {
517  struct xfrm_lifetime_cur* cur = nla_data(tb[XFRMA_LTIME_VAL]);
518  ae->lifetime_cur.bytes = cur->bytes;
519  ae->lifetime_cur.packets = cur->packets;
520  ae->lifetime_cur.add_time = cur->add_time;
521  ae->lifetime_cur.use_time = cur->use_time;
522  ae->ce_mask |= XFRM_AE_ATTR_LIFETIME;
523  }
524 
525  if (tb[XFRM_AE_ETHR]) {
526  ae->replay_maxage = *(uint32_t*)nla_data(tb[XFRM_AE_ETHR]);
527  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXAGE;
528  }
529 
530  if (tb[XFRM_AE_RTHR]) {
531  ae->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRM_AE_RTHR]);
532  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXDIFF;
533  }
534 
535  if (tb[XFRMA_REPLAY_ESN_VAL]) {
536  struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
537  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
538 
539  if ((ae->replay_state_esn = calloc (1, len)) == NULL) {
540  err = -ENOMEM;
541  goto errout;
542  }
543  ae->replay_state_esn->oseq = esn->oseq;
544  ae->replay_state_esn->seq = esn->seq;
545  ae->replay_state_esn->oseq_hi = esn->oseq_hi;
546  ae->replay_state_esn->seq_hi = esn->seq_hi;
547  ae->replay_state_esn->replay_window = esn->replay_window;
548  ae->replay_state_esn->bmp_len = esn->bmp_len;
549  memcpy (ae->replay_state_esn->bmp, esn->bmp, sizeof (uint32_t) * esn->bmp_len);
550  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
551  }
552  else
553  {
554  struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
555  ae->replay_state.oseq = replay_state->oseq;
556  ae->replay_state.seq = replay_state->seq;
557  ae->replay_state.bitmap = replay_state->bitmap;
558  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
559 
560  ae->replay_state_esn = NULL;
561  }
562 
563  *result = ae;
564  return 0;
565 
566 errout:
567  xfrmnl_ae_put(ae);
568  return err;
569 }
570 
571 static int xfrm_ae_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
572  struct nlmsghdr *n, struct nl_parser_param *pp)
573 {
574  struct xfrmnl_ae* ae;
575  int err;
576 
577  if ((err = xfrmnl_ae_parse(n, &ae)) < 0)
578  return err;
579 
580  err = pp->pp_cb((struct nl_object *) ae, pp);
581 
582  xfrmnl_ae_put(ae);
583  return err;
584 }
585 
586 /**
587  * @name XFRM AE Get
588  * @{
589  */
590 
591 int xfrmnl_ae_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol,
592  unsigned int mark_mask, unsigned int mark_value, struct nl_msg **result)
593 {
594  struct nl_msg *msg;
595  struct xfrm_aevent_id ae_id;
596  struct xfrmnl_mark mark;
597 
598  if (!daddr || !spi)
599  {
600  fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
601  __FILE__, __LINE__, __PRETTY_FUNCTION__);
602  assert(0);
603  return -NLE_MISSING_ATTR;
604  }
605 
606  memset(&ae_id, 0, sizeof(ae_id));
607  memcpy (&ae_id.sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
608  ae_id.sa_id.spi = htonl(spi);
609  ae_id.sa_id.family = nl_addr_get_family (daddr);
610  ae_id.sa_id.proto = protocol;
611 
612  if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETAE, 0)))
613  return -NLE_NOMEM;
614 
615  if (nlmsg_append(msg, &ae_id, sizeof(ae_id), NLMSG_ALIGNTO) < 0)
616  goto nla_put_failure;
617 
618  mark.m = mark_mask;
619  mark.v = mark_value;
620  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrmnl_mark), &mark);
621 
622  *result = msg;
623  return 0;
624 
625 nla_put_failure:
626  nlmsg_free(msg);
627  return -NLE_MSGSIZE;
628 }
629 
630 int xfrmnl_ae_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol,
631  unsigned int mark_mask, unsigned int mark_value, struct xfrmnl_ae** result)
632 {
633  struct nl_msg *msg = NULL;
634  struct nl_object *obj;
635  int err;
636 
637  if ((err = xfrmnl_ae_build_get_request(daddr, spi, protocol, mark_mask, mark_value, &msg)) < 0)
638  return err;
639 
640  err = nl_send_auto(sock, msg);
641  nlmsg_free(msg);
642  if (err < 0)
643  return err;
644 
645  if ((err = nl_pickup(sock, &xfrm_ae_msg_parser, &obj)) < 0)
646  return err;
647 
648  /* We have used xfrm_ae_msg_parser(), object is definitely a xfrm ae */
649  *result = (struct xfrmnl_ae *) obj;
650 
651  /* If an object has been returned, we also need to wait for the ACK */
652  if (err == 0 && obj)
653  nl_wait_for_ack(sock);
654 
655  return 0;
656 }
657 
658 /** @} */
659 
660 /**
661  * @name Attributes
662  * @{
663  */
664 
665 static inline int __assign_addr(struct xfrmnl_ae* ae, struct nl_addr **pos,
666  struct nl_addr *new, int flag, int nocheck)
667 {
668  if (!nocheck) {
669  if (ae->ce_mask & XFRM_AE_ATTR_FAMILY) {
670  if (nl_addr_get_family (new) != ae->sa_id.family)
671  return -NLE_AF_MISMATCH;
672  } else {
673  ae->sa_id.family = nl_addr_get_family (new);
674  ae->ce_mask |= XFRM_AE_ATTR_FAMILY;
675  }
676  }
677 
678  if (*pos)
679  nl_addr_put(*pos);
680 
681  nl_addr_get(new);
682  *pos = new;
683 
684  ae->ce_mask |= flag;
685 
686  return 0;
687 }
688 
689 
690 struct nl_addr* xfrmnl_ae_get_daddr (struct xfrmnl_ae* ae)
691 {
692  if (ae->ce_mask & XFRM_AE_ATTR_DADDR)
693  return ae->sa_id.daddr;
694  else
695  return NULL;
696 }
697 
698 int xfrmnl_ae_set_daddr (struct xfrmnl_ae* ae, struct nl_addr* addr)
699 {
700  return __assign_addr(ae, &ae->sa_id.daddr, addr, XFRM_AE_ATTR_DADDR, 0);
701 }
702 
703 int xfrmnl_ae_get_spi (struct xfrmnl_ae* ae)
704 {
705  if (ae->ce_mask & XFRM_AE_ATTR_SPI)
706  return ae->sa_id.spi;
707  else
708  return -1;
709 }
710 
711 int xfrmnl_ae_set_spi (struct xfrmnl_ae* ae, unsigned int spi)
712 {
713  ae->sa_id.spi = spi;
714  ae->ce_mask |= XFRM_AE_ATTR_SPI;
715 
716  return 0;
717 }
718 
719 int xfrmnl_ae_get_family (struct xfrmnl_ae* ae)
720 {
721  if (ae->ce_mask & XFRM_AE_ATTR_FAMILY)
722  return ae->sa_id.family;
723  else
724  return -1;
725 }
726 
727 int xfrmnl_ae_set_family (struct xfrmnl_ae* ae, unsigned int family)
728 {
729  ae->sa_id.family = family;
730  ae->ce_mask |= XFRM_AE_ATTR_FAMILY;
731 
732  return 0;
733 }
734 
735 int xfrmnl_ae_get_proto (struct xfrmnl_ae* ae)
736 {
737  if (ae->ce_mask & XFRM_AE_ATTR_PROTO)
738  return ae->sa_id.proto;
739  else
740  return -1;
741 }
742 
743 int xfrmnl_ae_set_proto (struct xfrmnl_ae* ae, unsigned int protocol)
744 {
745  ae->sa_id.proto = protocol;
746  ae->ce_mask |= XFRM_AE_ATTR_PROTO;
747 
748  return 0;
749 }
750 
751 struct nl_addr* xfrmnl_ae_get_saddr (struct xfrmnl_ae* ae)
752 {
753  if (ae->ce_mask & XFRM_AE_ATTR_SADDR)
754  return ae->saddr;
755  else
756  return NULL;
757 }
758 
759 int xfrmnl_ae_set_saddr (struct xfrmnl_ae* ae, struct nl_addr* addr)
760 {
761  return __assign_addr(ae, &ae->saddr, addr, XFRM_AE_ATTR_SADDR, 1);
762 }
763 
764 int xfrmnl_ae_get_flags (struct xfrmnl_ae* ae)
765 {
766  if (ae->ce_mask & XFRM_AE_ATTR_FLAGS)
767  return ae->flags;
768  else
769  return -1;
770 }
771 
772 int xfrmnl_ae_set_flags (struct xfrmnl_ae* ae, unsigned int flags)
773 {
774  ae->flags = flags;
775  ae->ce_mask |= XFRM_AE_ATTR_FLAGS;
776 
777  return 0;
778 }
779 
780 int xfrmnl_ae_get_reqid (struct xfrmnl_ae* ae)
781 {
782  if (ae->ce_mask & XFRM_AE_ATTR_REQID)
783  return ae->reqid;
784  else
785  return -1;
786 }
787 
788 int xfrmnl_ae_set_reqid (struct xfrmnl_ae* ae, unsigned int reqid)
789 {
790  ae->reqid = reqid;
791  ae->ce_mask |= XFRM_AE_ATTR_REQID;
792 
793  return 0;
794 }
795 
796 int xfrmnl_ae_get_mark (struct xfrmnl_ae* ae, unsigned int* mark_mask, unsigned int* mark_value)
797 {
798  if (mark_mask == NULL || mark_value == NULL)
799  return -1;
800 
801  if (ae->ce_mask & XFRM_AE_ATTR_MARK)
802  {
803  *mark_mask = ae->mark.m;
804  *mark_value = ae->mark.v;
805 
806  return 0;
807  }
808  else
809  return -1;
810 }
811 
812 int xfrmnl_ae_set_mark (struct xfrmnl_ae* ae, unsigned int value, unsigned int mask)
813 {
814  ae->mark.v = value;
815  ae->mark.m = mask;
816  ae->ce_mask |= XFRM_AE_ATTR_MARK;
817 
818  return 0;
819 }
820 
821 int xfrmnl_ae_get_curlifetime (struct xfrmnl_ae* ae, unsigned long long int* curr_bytes,
822  unsigned long long int* curr_packets, unsigned long long int* curr_add_time,
823  unsigned long long int* curr_use_time)
824 {
825  if (curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
826  return -1;
827 
828  if (ae->ce_mask & XFRM_AE_ATTR_LIFETIME)
829  {
830  *curr_bytes = ae->lifetime_cur.bytes;
831  *curr_packets = ae->lifetime_cur.packets;
832  *curr_add_time = ae->lifetime_cur.add_time;
833  *curr_use_time = ae->lifetime_cur.use_time;
834 
835  return 0;
836  }
837  else
838  return -1;
839 }
840 
841 int xfrmnl_ae_set_curlifetime (struct xfrmnl_ae* ae, unsigned long long int curr_bytes,
842  unsigned long long int curr_packets, unsigned long long int curr_add_time,
843  unsigned long long int curr_use_time)
844 {
845  ae->lifetime_cur.bytes = curr_bytes;
846  ae->lifetime_cur.packets = curr_packets;
847  ae->lifetime_cur.add_time = curr_add_time;
848  ae->lifetime_cur.use_time = curr_use_time;
849  ae->ce_mask |= XFRM_AE_ATTR_LIFETIME;
850 
851  return 0;
852 }
853 
854 int xfrmnl_ae_get_replay_maxage (struct xfrmnl_ae* ae)
855 {
856  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_MAXAGE)
857  return ae->replay_maxage;
858  else
859  return -1;
860 }
861 
862 int xfrmnl_ae_set_replay_maxage (struct xfrmnl_ae* ae, unsigned int replay_maxage)
863 {
864  ae->replay_maxage = replay_maxage;
865  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXAGE;
866 
867  return 0;
868 }
869 
870 int xfrmnl_ae_get_replay_maxdiff (struct xfrmnl_ae* ae)
871 {
872  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_MAXDIFF)
873  return ae->replay_maxdiff;
874  else
875  return -1;
876 }
877 
878 int xfrmnl_ae_set_replay_maxdiff (struct xfrmnl_ae* ae, unsigned int replay_maxdiff)
879 {
880  ae->replay_maxdiff = replay_maxdiff;
881  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_MAXDIFF;
882 
883  return 0;
884 }
885 
886 int xfrmnl_ae_get_replay_state (struct xfrmnl_ae* ae, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
887 {
888  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_STATE)
889  {
890  if (ae->replay_state_esn == NULL)
891  {
892  *oseq = ae->replay_state.oseq;
893  *seq = ae->replay_state.seq;
894  *bmp = ae->replay_state.bitmap;
895 
896  return 0;
897  }
898  else
899  {
900  return -1;
901  }
902  }
903  else
904  return -1;
905 }
906 
907 int xfrmnl_ae_set_replay_state (struct xfrmnl_ae* ae, unsigned int oseq, unsigned int seq, unsigned int bitmap)
908 {
909  ae->replay_state.oseq = oseq;
910  ae->replay_state.seq = seq;
911  ae->replay_state.bitmap = bitmap;
912  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
913 
914  return 0;
915 }
916 
917 int xfrmnl_ae_get_replay_state_esn(struct xfrmnl_ae* ae, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
918  unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
919 {
920  if (ae->ce_mask & XFRM_AE_ATTR_REPLAY_STATE)
921  {
922  if (ae->replay_state_esn)
923  {
924  *oseq = ae->replay_state_esn->oseq;
925  *seq = ae->replay_state_esn->seq;
926  *oseq_hi= ae->replay_state_esn->oseq_hi;
927  *seq_hi = ae->replay_state_esn->seq_hi;
928  *replay_window = ae->replay_state_esn->replay_window;
929  *bmp_len = ae->replay_state_esn->bmp_len; // In number of 32 bit words
930  memcpy (bmp, ae->replay_state_esn->bmp, ae->replay_state_esn->bmp_len * sizeof (uint32_t));
931 
932  return 0;
933  }
934  else
935  {
936  return -1;
937  }
938  }
939  else
940  return -1;
941 }
942 
943 int xfrmnl_ae_set_replay_state_esn(struct xfrmnl_ae* ae, unsigned int oseq, unsigned int seq,
944  unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
945  unsigned int bmp_len, unsigned int* bmp)
946 {
947  /* Free the old replay ESN state and allocate new one */
948  if (ae->replay_state_esn)
949  free (ae->replay_state_esn);
950 
951  if ((ae->replay_state_esn = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + sizeof (uint32_t) * bmp_len)) == NULL)
952  return -1;
953 
954  ae->replay_state_esn->oseq = oseq;
955  ae->replay_state_esn->seq = seq;
956  ae->replay_state_esn->oseq_hi = oseq_hi;
957  ae->replay_state_esn->seq_hi = seq_hi;
958  ae->replay_state_esn->replay_window = replay_window;
959  ae->replay_state_esn->bmp_len = bmp_len; // In number of 32 bit words
960  memcpy (ae->replay_state_esn->bmp, bmp, bmp_len * sizeof (uint32_t));
961  ae->ce_mask |= XFRM_AE_ATTR_REPLAY_STATE;
962 
963  return 0;
964 }
965 
966 /** @} */
967 
968 static struct nl_object_ops xfrm_ae_obj_ops = {
969  .oo_name = "xfrm/ae",
970  .oo_size = sizeof(struct xfrmnl_ae),
971  .oo_free_data = xfrm_ae_free_data,
972  .oo_clone = xfrm_ae_clone,
973  .oo_dump = {
974  [NL_DUMP_LINE] = xfrm_ae_dump_line,
975  [NL_DUMP_DETAILS] = xfrm_ae_dump_details,
976  [NL_DUMP_STATS] = xfrm_ae_dump_stats,
977  },
978  .oo_compare = xfrm_ae_compare,
979  .oo_attrs2str = xfrm_ae_attrs2str,
980  .oo_id_attrs = (XFRM_AE_ATTR_DADDR | XFRM_AE_ATTR_SPI | XFRM_AE_ATTR_PROTO),
981 };
982 
983 /** @} */
984 
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1247
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:493
Dump object briefly on one line.
Definition: types.h:22
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:562
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:585
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:106
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:54
Attribute validation policy.
Definition: attr.h:69
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:217
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1178
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:214
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:523
Dump all attributes but no statistics.
Definition: types.h:23
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:164
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:120
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition: attr.h:235
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:74
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:446
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1112
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:215
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:539
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:347
32 bit integer
Definition: attr.h:43
Dumping parameters.
Definition: types.h:33
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:961
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:516
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:945
Dump all attributes including statistics.
Definition: types.h:24
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:933
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:991
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition: addr.c:885