libnl  3.2.29
sa.c
1 /*
2  * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
3  *
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * Redistributions of source code must retain the above copyright
10  * notice, this list of conditions and the following disclaimer.
11  *
12  * Redistributions in binary form must reproduce the above copyright
13  * notice, this list of conditions and the following disclaimer in the
14  * documentation and/or other materials provided with the
15  * distribution.
16  *
17  * Neither the name of Texas Instruments Incorporated nor the names of
18  * its contributors may be used to endorse or promote products derived
19  * from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  *
33  */
34 
35 /**
36  * @ingroup xfrmnl
37  * @defgroup sa Security Association
38  * @brief
39  */
40 
41 #include <netlink-private/netlink.h>
42 #include <netlink/netlink.h>
43 #include <netlink/cache.h>
44 #include <netlink/object.h>
45 #include <netlink/xfrm/selector.h>
46 #include <netlink/xfrm/lifetime.h>
47 #include <time.h>
48 
49 /** @cond SKIP */
50 #define XFRM_SA_ATTR_SEL 0x01
51 #define XFRM_SA_ATTR_DADDR 0x02
52 #define XFRM_SA_ATTR_SPI 0x04
53 #define XFRM_SA_ATTR_PROTO 0x08
54 #define XFRM_SA_ATTR_SADDR 0x10
55 #define XFRM_SA_ATTR_LTIME_CFG 0x20
56 #define XFRM_SA_ATTR_LTIME_CUR 0x40
57 #define XFRM_SA_ATTR_STATS 0x80
58 #define XFRM_SA_ATTR_SEQ 0x100
59 #define XFRM_SA_ATTR_REQID 0x200
60 #define XFRM_SA_ATTR_FAMILY 0x400
61 #define XFRM_SA_ATTR_MODE 0x800
62 #define XFRM_SA_ATTR_REPLAY_WIN 0x1000
63 #define XFRM_SA_ATTR_FLAGS 0x2000
64 #define XFRM_SA_ATTR_ALG_AEAD 0x4000
65 #define XFRM_SA_ATTR_ALG_AUTH 0x8000
66 #define XFRM_SA_ATTR_ALG_CRYPT 0x10000
67 #define XFRM_SA_ATTR_ALG_COMP 0x20000
68 #define XFRM_SA_ATTR_ENCAP 0x40000
69 #define XFRM_SA_ATTR_TFCPAD 0x80000
70 #define XFRM_SA_ATTR_COADDR 0x100000
71 #define XFRM_SA_ATTR_MARK 0x200000
72 #define XFRM_SA_ATTR_SECCTX 0x400000
73 #define XFRM_SA_ATTR_REPLAY_MAXAGE 0x800000
74 #define XFRM_SA_ATTR_REPLAY_MAXDIFF 0x1000000
75 #define XFRM_SA_ATTR_REPLAY_STATE 0x2000000
76 #define XFRM_SA_ATTR_EXPIRE 0x4000000
77 
78 static struct nl_cache_ops xfrmnl_sa_ops;
79 static struct nl_object_ops xfrm_sa_obj_ops;
80 /** @endcond */
81 
82 static void xfrm_sa_alloc_data(struct nl_object *c)
83 {
84  struct xfrmnl_sa* sa = nl_object_priv (c);
85 
86  if ((sa->sel = xfrmnl_sel_alloc ()) == NULL)
87  return;
88 
89  if ((sa->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
90  return;
91 }
92 
93 static void xfrm_sa_free_data(struct nl_object *c)
94 {
95  struct xfrmnl_sa* sa = nl_object_priv (c);
96 
97  if (sa == NULL)
98  return;
99 
100  xfrmnl_sel_put (sa->sel);
101  xfrmnl_ltime_cfg_put (sa->lft);
102  nl_addr_put (sa->id.daddr);
103  nl_addr_put (sa->saddr);
104 
105  if (sa->aead)
106  free (sa->aead);
107  if (sa->auth)
108  free (sa->auth);
109  if (sa->crypt)
110  free (sa->crypt);
111  if (sa->comp)
112  free (sa->comp);
113  if (sa->encap) {
114  if (sa->encap->encap_oa)
115  nl_addr_put(sa->encap->encap_oa);
116  free(sa->encap);
117  }
118  if (sa->coaddr)
119  nl_addr_put (sa->coaddr);
120  if (sa->sec_ctx)
121  free (sa->sec_ctx);
122  if (sa->replay_state_esn)
123  free (sa->replay_state_esn);
124 }
125 
126 static int xfrm_sa_clone(struct nl_object *_dst, struct nl_object *_src)
127 {
128  struct xfrmnl_sa* dst = nl_object_priv(_dst);
129  struct xfrmnl_sa* src = nl_object_priv(_src);
130  uint32_t len = 0;
131 
132  if (src->sel)
133  if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
134  return -NLE_NOMEM;
135 
136  if (src->lft)
137  if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
138  return -NLE_NOMEM;
139 
140  if (src->id.daddr)
141  if ((dst->id.daddr = nl_addr_clone (src->id.daddr)) == NULL)
142  return -NLE_NOMEM;
143 
144  if (src->saddr)
145  if ((dst->saddr = nl_addr_clone (src->saddr)) == NULL)
146  return -NLE_NOMEM;
147 
148  if (src->aead)
149  {
150  len = sizeof (struct xfrmnl_algo_aead) + ((src->aead->alg_key_len + 7) / 8);
151  if ((dst->aead = calloc (1, len)) == NULL)
152  return -NLE_NOMEM;
153  memcpy ((void *)dst->aead, (void *)src->aead, len);
154  }
155 
156  if (src->auth)
157  {
158  len = sizeof (struct xfrmnl_algo_auth) + ((src->auth->alg_key_len + 7) / 8);
159  if ((dst->auth = calloc (1, len)) == NULL)
160  return -NLE_NOMEM;
161  memcpy ((void *)dst->auth, (void *)src->auth, len);
162  }
163 
164  if (src->crypt)
165  {
166  len = sizeof (struct xfrmnl_algo) + ((src->crypt->alg_key_len + 7) / 8);
167  if ((dst->crypt = calloc (1, len)) == NULL)
168  return -NLE_NOMEM;
169  memcpy ((void *)dst->crypt, (void *)src->crypt, len);
170  }
171 
172  if (src->comp)
173  {
174  len = sizeof (struct xfrmnl_algo) + ((src->comp->alg_key_len + 7) / 8);
175  if ((dst->comp = calloc (1, len)) == NULL)
176  return -NLE_NOMEM;
177  memcpy ((void *)dst->comp, (void *)src->comp, len);
178  }
179 
180  if (src->encap)
181  {
182  len = sizeof (struct xfrmnl_encap_tmpl);
183  if ((dst->encap = calloc (1, len)) == NULL)
184  return -NLE_NOMEM;
185  memcpy ((void *)dst->encap, (void *)src->encap, len);
186  }
187 
188  if (src->coaddr)
189  if ((dst->coaddr = nl_addr_clone (src->coaddr)) == NULL)
190  return -NLE_NOMEM;
191 
192  if (src->sec_ctx)
193  {
194  len = sizeof (*src->sec_ctx) + src->sec_ctx->ctx_len;
195  if ((dst->sec_ctx = calloc (1, len)) == NULL)
196  return -NLE_NOMEM;
197  memcpy ((void *)dst->sec_ctx, (void *)src->sec_ctx, len);
198  }
199 
200  if (src->replay_state_esn)
201  {
202  len = sizeof (struct xfrmnl_replay_state_esn) + (src->replay_state_esn->bmp_len * sizeof (uint32_t));
203  if ((dst->replay_state_esn = calloc (1, len)) == NULL)
204  return -NLE_NOMEM;
205  memcpy ((void *)dst->replay_state_esn, (void *)src->replay_state_esn, len);
206  }
207 
208  return 0;
209 }
210 
211 static uint64_t xfrm_sa_compare(struct nl_object *_a, struct nl_object *_b,
212  uint64_t attrs, int flags)
213 {
214  struct xfrmnl_sa* a = (struct xfrmnl_sa *) _a;
215  struct xfrmnl_sa* b = (struct xfrmnl_sa *) _b;
216  uint64_t diff = 0;
217  int found = 0;
218 
219 #define XFRM_SA_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_SA_ATTR_##ATTR, a, b, EXPR)
220  diff |= XFRM_SA_DIFF(SEL, xfrmnl_sel_cmp(a->sel, b->sel));
221  diff |= XFRM_SA_DIFF(DADDR, nl_addr_cmp(a->id.daddr, b->id.daddr));
222  diff |= XFRM_SA_DIFF(SPI, a->id.spi != b->id.spi);
223  diff |= XFRM_SA_DIFF(PROTO, a->id.proto != b->id.proto);
224  diff |= XFRM_SA_DIFF(SADDR, nl_addr_cmp(a->saddr, b->saddr));
225  diff |= XFRM_SA_DIFF(LTIME_CFG, xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
226  diff |= XFRM_SA_DIFF(REQID, a->reqid != b->reqid);
227  diff |= XFRM_SA_DIFF(FAMILY,a->family != b->family);
228  diff |= XFRM_SA_DIFF(MODE,a->mode != b->mode);
229  diff |= XFRM_SA_DIFF(REPLAY_WIN,a->replay_window != b->replay_window);
230  diff |= XFRM_SA_DIFF(FLAGS,a->flags != b->flags);
231  diff |= XFRM_SA_DIFF(ALG_AEAD,(strcmp(a->aead->alg_name, b->aead->alg_name) ||
232  (a->aead->alg_key_len != b->aead->alg_key_len) ||
233  (a->aead->alg_icv_len != b->aead->alg_icv_len) ||
234  memcmp(a->aead->alg_key, b->aead->alg_key,
235  ((a->aead->alg_key_len + 7)/8))));
236  diff |= XFRM_SA_DIFF(ALG_AUTH,(strcmp(a->auth->alg_name, b->auth->alg_name) ||
237  (a->auth->alg_key_len != b->auth->alg_key_len) ||
238  (a->auth->alg_trunc_len != b->auth->alg_trunc_len) ||
239  memcmp(a->auth->alg_key, b->auth->alg_key,
240  ((a->auth->alg_key_len + 7)/8))));
241  diff |= XFRM_SA_DIFF(ALG_CRYPT,(strcmp(a->crypt->alg_name, b->crypt->alg_name) ||
242  (a->crypt->alg_key_len != b->crypt->alg_key_len) ||
243  memcmp(a->crypt->alg_key, b->crypt->alg_key,
244  ((a->crypt->alg_key_len + 7)/8))));
245  diff |= XFRM_SA_DIFF(ALG_COMP,(strcmp(a->comp->alg_name, b->comp->alg_name) ||
246  (a->comp->alg_key_len != b->comp->alg_key_len) ||
247  memcmp(a->comp->alg_key, b->comp->alg_key,
248  ((a->comp->alg_key_len + 7)/8))));
249  diff |= XFRM_SA_DIFF(ENCAP,((a->encap->encap_type != b->encap->encap_type) ||
250  (a->encap->encap_sport != b->encap->encap_sport) ||
251  (a->encap->encap_dport != b->encap->encap_dport) ||
252  nl_addr_cmp(a->encap->encap_oa, b->encap->encap_oa)));
253  diff |= XFRM_SA_DIFF(TFCPAD,a->tfcpad != b->tfcpad);
254  diff |= XFRM_SA_DIFF(COADDR,nl_addr_cmp(a->coaddr, b->coaddr));
255  diff |= XFRM_SA_DIFF(MARK,(a->mark.m != b->mark.m) ||
256  (a->mark.v != b->mark.v));
257  diff |= XFRM_SA_DIFF(SECCTX,((a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
258  (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
259  (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
260  strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
261  diff |= XFRM_SA_DIFF(REPLAY_MAXAGE,a->replay_maxage != b->replay_maxage);
262  diff |= XFRM_SA_DIFF(REPLAY_MAXDIFF,a->replay_maxdiff != b->replay_maxdiff);
263  diff |= XFRM_SA_DIFF(EXPIRE,a->hard != b->hard);
264 
265  /* Compare replay states */
266  found = AVAILABLE_MISMATCH (a, b, XFRM_SA_ATTR_REPLAY_STATE);
267  if (found == 0) // attribute exists in both objects
268  {
269  if (((a->replay_state_esn != NULL) && (b->replay_state_esn == NULL)) ||
270  ((a->replay_state_esn == NULL) && (b->replay_state_esn != NULL)))
271  found |= 1;
272 
273  if (found == 0) // same replay type. compare actual values
274  {
275  if (a->replay_state_esn)
276  {
277  if (a->replay_state_esn->bmp_len != b->replay_state_esn->bmp_len)
278  diff |= 1;
279  else
280  {
281  uint32_t len = sizeof (struct xfrmnl_replay_state_esn) +
282  (a->replay_state_esn->bmp_len * sizeof (uint32_t));
283  diff |= memcmp (a->replay_state_esn, b->replay_state_esn, len);
284  }
285  }
286  else
287  {
288  if ((a->replay_state.oseq != b->replay_state.oseq) ||
289  (a->replay_state.seq != b->replay_state.seq) ||
290  (a->replay_state.bitmap != b->replay_state.bitmap))
291  diff |= 1;
292  }
293  }
294  }
295 #undef XFRM_SA_DIFF
296 
297  return diff;
298 }
299 
300 /**
301  * @name XFRM SA Attribute Translations
302  * @{
303  */
304 static const struct trans_tbl sa_attrs[] = {
305  __ADD(XFRM_SA_ATTR_SEL, selector),
306  __ADD(XFRM_SA_ATTR_DADDR, daddr),
307  __ADD(XFRM_SA_ATTR_SPI, spi),
308  __ADD(XFRM_SA_ATTR_PROTO, proto),
309  __ADD(XFRM_SA_ATTR_SADDR, saddr),
310  __ADD(XFRM_SA_ATTR_LTIME_CFG, lifetime_cfg),
311  __ADD(XFRM_SA_ATTR_LTIME_CUR, lifetime_cur),
312  __ADD(XFRM_SA_ATTR_STATS, stats),
313  __ADD(XFRM_SA_ATTR_SEQ, seqnum),
314  __ADD(XFRM_SA_ATTR_REQID, reqid),
315  __ADD(XFRM_SA_ATTR_FAMILY, family),
316  __ADD(XFRM_SA_ATTR_MODE, mode),
317  __ADD(XFRM_SA_ATTR_REPLAY_WIN, replay_window),
318  __ADD(XFRM_SA_ATTR_FLAGS, flags),
319  __ADD(XFRM_SA_ATTR_ALG_AEAD, alg_aead),
320  __ADD(XFRM_SA_ATTR_ALG_AUTH, alg_auth),
321  __ADD(XFRM_SA_ATTR_ALG_CRYPT, alg_crypto),
322  __ADD(XFRM_SA_ATTR_ALG_COMP, alg_comp),
323  __ADD(XFRM_SA_ATTR_ENCAP, encap),
324  __ADD(XFRM_SA_ATTR_TFCPAD, tfcpad),
325  __ADD(XFRM_SA_ATTR_COADDR, coaddr),
326  __ADD(XFRM_SA_ATTR_MARK, mark),
327  __ADD(XFRM_SA_ATTR_SECCTX, sec_ctx),
328  __ADD(XFRM_SA_ATTR_REPLAY_MAXAGE, replay_maxage),
329  __ADD(XFRM_SA_ATTR_REPLAY_MAXDIFF, replay_maxdiff),
330  __ADD(XFRM_SA_ATTR_REPLAY_STATE, replay_state),
331  __ADD(XFRM_SA_ATTR_EXPIRE, expire),
332 };
333 
334 static char* xfrm_sa_attrs2str(int attrs, char *buf, size_t len)
335 {
336  return __flags2str (attrs, buf, len, sa_attrs, ARRAY_SIZE(sa_attrs));
337 }
338 /** @} */
339 
340 /**
341  * @name XFRM SA Flags Translations
342  * @{
343  */
344 static const struct trans_tbl sa_flags[] = {
345  __ADD(XFRM_STATE_NOECN, no ecn),
346  __ADD(XFRM_STATE_DECAP_DSCP, decap dscp),
347  __ADD(XFRM_STATE_NOPMTUDISC, no pmtu discovery),
348  __ADD(XFRM_STATE_WILDRECV, wild receive),
349  __ADD(XFRM_STATE_ICMP, icmp),
350  __ADD(XFRM_STATE_AF_UNSPEC, unspecified),
351  __ADD(XFRM_STATE_ALIGN4, align4),
352  __ADD(XFRM_STATE_ESN, esn),
353 };
354 
355 char* xfrmnl_sa_flags2str(int flags, char *buf, size_t len)
356 {
357  return __flags2str (flags, buf, len, sa_flags, ARRAY_SIZE(sa_flags));
358 }
359 
360 int xfrmnl_sa_str2flag(const char *name)
361 {
362  return __str2flags (name, sa_flags, ARRAY_SIZE(sa_flags));
363 }
364 /** @} */
365 
366 /**
367  * @name XFRM SA Mode Translations
368  * @{
369  */
370 static const struct trans_tbl sa_modes[] = {
371  __ADD(XFRM_MODE_TRANSPORT, transport),
372  __ADD(XFRM_MODE_TUNNEL, tunnel),
373  __ADD(XFRM_MODE_ROUTEOPTIMIZATION, route optimization),
374  __ADD(XFRM_MODE_IN_TRIGGER, in trigger),
375  __ADD(XFRM_MODE_BEET, beet),
376 };
377 
378 char* xfrmnl_sa_mode2str(int mode, char *buf, size_t len)
379 {
380  return __type2str (mode, buf, len, sa_modes, ARRAY_SIZE(sa_modes));
381 }
382 
383 int xfrmnl_sa_str2mode(const char *name)
384 {
385  return __str2type (name, sa_modes, ARRAY_SIZE(sa_modes));
386 }
387 /** @} */
388 
389 
390 static void xfrm_sa_dump_line(struct nl_object *a, struct nl_dump_params *p)
391 {
392  char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
393  struct xfrmnl_sa* sa = (struct xfrmnl_sa *) a;
394  char flags[128], mode[128];
395  time_t add_time, use_time;
396  struct tm *add_time_tm, *use_time_tm;
397 
398  nl_dump_line(p, "src %s dst %s family: %s\n", nl_addr2str(sa->saddr, src, sizeof(src)),
399  nl_addr2str(sa->id.daddr, dst, sizeof(dst)),
400  nl_af2str (sa->family, flags, sizeof (flags)));
401 
402  nl_dump_line(p, "\tproto %s spi 0x%x reqid %u\n",
403  nl_ip_proto2str (sa->id.proto, flags, sizeof(flags)),
404  sa->id.spi, sa->reqid);
405 
406  xfrmnl_sa_flags2str(sa->flags, flags, sizeof (flags));
407  xfrmnl_sa_mode2str(sa->mode, mode, sizeof (mode));
408  nl_dump_line(p, "\tmode: %s flags: %s (0x%x) seq: %u replay window: %u\n",
409  mode, flags, sa->flags, sa->seq, sa->replay_window);
410 
411  nl_dump_line(p, "\tlifetime configuration: \n");
412  if (sa->lft->soft_byte_limit == XFRM_INF)
413  sprintf (flags, "INF");
414  else
415  sprintf (flags, "%" PRIu64, sa->lft->soft_byte_limit);
416  if (sa->lft->soft_packet_limit == XFRM_INF)
417  sprintf (mode, "INF");
418  else
419  sprintf (mode, "%" PRIu64, sa->lft->soft_packet_limit);
420  nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets)\n", flags, mode);
421  if (sa->lft->hard_byte_limit == XFRM_INF)
422  sprintf (flags, "INF");
423  else
424  sprintf (flags, "%" PRIu64, sa->lft->hard_byte_limit);
425  if (sa->lft->hard_packet_limit == XFRM_INF)
426  sprintf (mode, "INF");
427  else
428  sprintf (mode, "%" PRIu64, sa->lft->hard_packet_limit);
429  nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets)\n", flags, mode);
430  nl_dump_line(p, "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
431  sa->lft->soft_add_expires_seconds, sa->lft->soft_use_expires_seconds);
432  nl_dump_line(p, "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
433  sa->lft->hard_add_expires_seconds, sa->lft->hard_use_expires_seconds);
434 
435  nl_dump_line(p, "\tlifetime current: \n");
436  nl_dump_line(p, "\t\t%llu bytes, %llu packets\n", sa->curlft.bytes, sa->curlft.packets);
437  if (sa->curlft.add_time != 0)
438  {
439  add_time = sa->curlft.add_time;
440  add_time_tm = gmtime (&add_time);
441  strftime (flags, 128, "%Y-%m-%d %H-%M-%S", add_time_tm);
442  }
443  else
444  {
445  sprintf (flags, "%s", "-");
446  }
447 
448  if (sa->curlft.use_time != 0)
449  {
450  use_time = sa->curlft.use_time;
451  use_time_tm = gmtime (&use_time);
452  strftime (mode, 128, "%Y-%m-%d %H-%M-%S", use_time_tm);
453  }
454  else
455  {
456  sprintf (mode, "%s", "-");
457  }
458  nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", flags, mode);
459 
460  if (sa->aead)
461  {
462  nl_dump_line(p, "\tAEAD Algo: \n");
463  nl_dump_line(p, "\t\tName: %s Key len(bits): %u ICV Len(bits): %u\n",
464  sa->aead->alg_name, sa->aead->alg_key_len, sa->aead->alg_icv_len);
465  }
466 
467  if (sa->auth)
468  {
469  nl_dump_line(p, "\tAuth Algo: \n");
470  nl_dump_line(p, "\t\tName: %s Key len(bits): %u Trunc len(bits): %u\n",
471  sa->auth->alg_name, sa->auth->alg_key_len, sa->auth->alg_trunc_len);
472  }
473 
474  if (sa->crypt)
475  {
476  nl_dump_line(p, "\tEncryption Algo: \n");
477  nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
478  sa->crypt->alg_name, sa->crypt->alg_key_len);
479  }
480 
481  if (sa->comp)
482  {
483  nl_dump_line(p, "\tCompression Algo: \n");
484  nl_dump_line(p, "\t\tName: %s Key len(bits): %u\n",
485  sa->comp->alg_name, sa->comp->alg_key_len);
486  }
487 
488  if (sa->encap)
489  {
490  nl_dump_line(p, "\tEncapsulation template: \n");
491  nl_dump_line(p, "\t\tType: %d Src port: %d Dst port: %d Encap addr: %s\n",
492  sa->encap->encap_type, sa->encap->encap_sport, sa->encap->encap_dport,
493  nl_addr2str (sa->encap->encap_oa, dst, sizeof (dst)));
494  }
495 
496  if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
497  nl_dump_line(p, "\tTFC Pad: %u\n", sa->tfcpad);
498 
499  if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
500  nl_dump_line(p, "\tCO Address: %s\n", nl_addr2str (sa->coaddr, dst, sizeof (dst)));
501 
502  if (sa->ce_mask & XFRM_SA_ATTR_MARK)
503  nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sa->mark.m, sa->mark.v);
504 
505  if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
506  nl_dump_line(p, "\tDOI: %d Algo: %d Len: %u ctx: %s\n", sa->sec_ctx->ctx_doi,
507  sa->sec_ctx->ctx_alg, sa->sec_ctx->ctx_len, sa->sec_ctx->ctx);
508 
509  nl_dump_line(p, "\treplay info: \n");
510  nl_dump_line(p, "\t\tmax age %u max diff %u \n", sa->replay_maxage, sa->replay_maxdiff);
511 
512  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
513  {
514  nl_dump_line(p, "\treplay state info: \n");
515  if (sa->replay_state_esn)
516  {
517  nl_dump_line(p, "\t\toseq %u seq %u oseq_hi %u seq_hi %u replay window: %u \n",
518  sa->replay_state_esn->oseq, sa->replay_state_esn->seq,
519  sa->replay_state_esn->oseq_hi, sa->replay_state_esn->seq_hi,
520  sa->replay_state_esn->replay_window);
521  }
522  else
523  {
524  nl_dump_line(p, "\t\toseq %u seq %u bitmap: %u \n", sa->replay_state.oseq,
525  sa->replay_state.seq, sa->replay_state.bitmap);
526  }
527  }
528 
529  nl_dump_line(p, "\tselector info: \n");
530  xfrmnl_sel_dump (sa->sel, p);
531 
532  nl_dump_line(p, "\tHard: %d\n", sa->hard);
533 
534  nl_dump(p, "\n");
535 }
536 
537 static void xfrm_sa_dump_stats(struct nl_object *a, struct nl_dump_params *p)
538 {
539  struct xfrmnl_sa* sa = (struct xfrmnl_sa*)a;
540 
541  nl_dump_line(p, "\tstats: \n");
542  nl_dump_line(p, "\t\treplay window: %u replay: %u integrity failed: %u \n",
543  sa->stats.replay_window, sa->stats.replay, sa->stats.integrity_failed);
544 
545  return;
546 }
547 
548 static void xfrm_sa_dump_details(struct nl_object *a, struct nl_dump_params *p)
549 {
550  xfrm_sa_dump_line(a, p);
551  xfrm_sa_dump_stats (a, p);
552 }
553 
554 /**
555  * @name XFRM SA Object Allocation/Freeage
556  * @{
557  */
558 
559 struct xfrmnl_sa* xfrmnl_sa_alloc(void)
560 {
561  return (struct xfrmnl_sa*) nl_object_alloc(&xfrm_sa_obj_ops);
562 }
563 
564 void xfrmnl_sa_put(struct xfrmnl_sa* sa)
565 {
566  nl_object_put((struct nl_object *) sa);
567 }
568 
569 /** @} */
570 
571 /**
572  * @name SA Cache Managament
573  * @{
574  */
575 
576 /**
577  * Build a SA cache including all SAs currently configured in the kernel.
578  * @arg sock Netlink socket.
579  * @arg result Pointer to store resulting cache.
580  *
581  * Allocates a new SA cache, initializes it properly and updates it
582  * to include all SAs currently configured in the kernel.
583  *
584  * @return 0 on success or a negative error code.
585  */
586 int xfrmnl_sa_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
587 {
588  return nl_cache_alloc_and_fill(&xfrmnl_sa_ops, sock, result);
589 }
590 
591 /**
592  * Look up a SA by destination address, SPI, protocol
593  * @arg cache SA cache
594  * @arg daddr destination address of the SA
595  * @arg spi SPI
596  * @arg proto protocol
597  * @return sa handle or NULL if no match was found.
598  */
599 struct xfrmnl_sa* xfrmnl_sa_get(struct nl_cache* cache, struct nl_addr* daddr,
600  unsigned int spi, unsigned int proto)
601 {
602  struct xfrmnl_sa *sa;
603 
604  //nl_list_for_each_entry(sa, &cache->c_items, ce_list) {
605  for (sa = (struct xfrmnl_sa*)nl_cache_get_first (cache);
606  sa != NULL;
607  sa = (struct xfrmnl_sa*)nl_cache_get_next ((struct nl_object*)sa))
608  {
609  if (sa->id.proto == proto &&
610  sa->id.spi == spi &&
611  !nl_addr_cmp(sa->id.daddr, daddr))
612  {
613  nl_object_get((struct nl_object *) sa);
614  return sa;
615  }
616 
617  }
618 
619  return NULL;
620 }
621 
622 
623 /** @} */
624 
625 
626 static struct nla_policy xfrm_sa_policy[XFRMA_MAX+1] = {
627  [XFRMA_SA] = { .minlen = sizeof(struct xfrm_usersa_info)},
628  [XFRMA_ALG_AUTH_TRUNC] = { .minlen = sizeof(struct xfrm_algo_auth)},
629  [XFRMA_ALG_AEAD] = { .minlen = sizeof(struct xfrm_algo_aead) },
630  [XFRMA_ALG_AUTH] = { .minlen = sizeof(struct xfrm_algo) },
631  [XFRMA_ALG_CRYPT] = { .minlen = sizeof(struct xfrm_algo) },
632  [XFRMA_ALG_COMP] = { .minlen = sizeof(struct xfrm_algo) },
633  [XFRMA_ENCAP] = { .minlen = sizeof(struct xfrm_encap_tmpl) },
634  [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
635  [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
636  [XFRMA_LTIME_VAL] = { .minlen = sizeof(struct xfrm_lifetime_cur) },
637  [XFRMA_REPLAY_VAL] = { .minlen = sizeof(struct xfrm_replay_state) },
638  [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
639  [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
640  [XFRMA_SRCADDR] = { .minlen = sizeof(xfrm_address_t) },
641  [XFRMA_COADDR] = { .minlen = sizeof(xfrm_address_t) },
642  [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
643  [XFRMA_TFCPAD] = { .type = NLA_U32 },
644  [XFRMA_REPLAY_ESN_VAL] = { .minlen = sizeof(struct xfrm_replay_state_esn) },
645 };
646 
647 static int xfrm_sa_request_update(struct nl_cache *c, struct nl_sock *h)
648 {
649  struct xfrm_id sa_id;
650 
651  memset (&sa_id, 0, sizeof (sa_id));
652  return nl_send_simple (h, XFRM_MSG_GETSA, NLM_F_DUMP,
653  &sa_id, sizeof (sa_id));
654 }
655 
656 int xfrmnl_sa_parse(struct nlmsghdr *n, struct xfrmnl_sa **result)
657 {
658  struct xfrmnl_sa* sa;
659  struct nlattr *tb[XFRMA_MAX + 1];
660  struct xfrm_usersa_info* sa_info;
661  struct xfrm_user_expire* ue;
662  int len, err;
663  struct nl_addr* addr;
664 
665  sa = xfrmnl_sa_alloc();
666  if (!sa) {
667  err = -NLE_NOMEM;
668  goto errout;
669  }
670 
671  sa->ce_msgtype = n->nlmsg_type;
672  if (n->nlmsg_type == XFRM_MSG_EXPIRE)
673  {
674  ue = nlmsg_data(n);
675  sa_info = &ue->state;
676  sa->hard = ue->hard;
677  sa->ce_mask |= XFRM_SA_ATTR_EXPIRE;
678  }
679  else if (n->nlmsg_type == XFRM_MSG_DELSA)
680  {
681  sa_info = (struct xfrm_usersa_info*)(nlmsg_data(n) + sizeof (struct xfrm_usersa_id) + NLA_HDRLEN);
682  }
683  else
684  {
685  sa_info = nlmsg_data(n);
686  }
687 
688  err = nlmsg_parse(n, sizeof(struct xfrm_usersa_info), tb, XFRMA_MAX, xfrm_sa_policy);
689  if (err < 0)
690  goto errout;
691 
692  if (sa_info->sel.family == AF_INET)
693  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a4, sizeof (sa_info->sel.daddr.a4));
694  else
695  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.daddr.a6, sizeof (sa_info->sel.daddr.a6));
696  nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_d);
697  xfrmnl_sel_set_daddr (sa->sel, addr);
698  xfrmnl_sel_set_prefixlen_d (sa->sel, sa_info->sel.prefixlen_d);
699 
700  if (sa_info->sel.family == AF_INET)
701  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a4, sizeof (sa_info->sel.saddr.a4));
702  else
703  addr = nl_addr_build (sa_info->sel.family, &sa_info->sel.saddr.a6, sizeof (sa_info->sel.saddr.a6));
704  nl_addr_set_prefixlen (addr, sa_info->sel.prefixlen_s);
705  xfrmnl_sel_set_saddr (sa->sel, addr);
706  xfrmnl_sel_set_prefixlen_s (sa->sel, sa_info->sel.prefixlen_s);
707 
708  xfrmnl_sel_set_dport (sa->sel, ntohs(sa_info->sel.dport));
709  xfrmnl_sel_set_dportmask (sa->sel, ntohs(sa_info->sel.dport_mask));
710  xfrmnl_sel_set_sport (sa->sel, ntohs(sa_info->sel.sport));
711  xfrmnl_sel_set_sportmask (sa->sel, ntohs(sa_info->sel.sport_mask));
712  xfrmnl_sel_set_family (sa->sel, sa_info->sel.family);
713  xfrmnl_sel_set_proto (sa->sel, sa_info->sel.proto);
714  xfrmnl_sel_set_ifindex (sa->sel, sa_info->sel.ifindex);
715  xfrmnl_sel_set_userid (sa->sel, sa_info->sel.user);
716  sa->ce_mask |= XFRM_SA_ATTR_SEL;
717 
718  if (sa_info->family == AF_INET)
719  sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a4, sizeof (sa_info->id.daddr.a4));
720  else
721  sa->id.daddr = nl_addr_build (sa_info->family, &sa_info->id.daddr.a6, sizeof (sa_info->id.daddr.a6));
722  sa->id.spi = ntohl(sa_info->id.spi);
723  sa->id.proto = sa_info->id.proto;
724  sa->ce_mask |= (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO);
725 
726  if (sa_info->family == AF_INET)
727  sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a4, sizeof (sa_info->saddr.a4));
728  else
729  sa->saddr = nl_addr_build (sa_info->family, &sa_info->saddr.a6, sizeof (sa_info->saddr.a6));
730  sa->ce_mask |= XFRM_SA_ATTR_SADDR;
731 
732  sa->lft->soft_byte_limit = sa_info->lft.soft_byte_limit;
733  sa->lft->hard_byte_limit = sa_info->lft.hard_byte_limit;
734  sa->lft->soft_packet_limit = sa_info->lft.soft_packet_limit;
735  sa->lft->hard_packet_limit = sa_info->lft.hard_packet_limit;
736  sa->lft->soft_add_expires_seconds = sa_info->lft.soft_add_expires_seconds;
737  sa->lft->hard_add_expires_seconds = sa_info->lft.hard_add_expires_seconds;
738  sa->lft->soft_use_expires_seconds = sa_info->lft.soft_use_expires_seconds;
739  sa->lft->hard_use_expires_seconds = sa_info->lft.hard_use_expires_seconds;
740  sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
741 
742  sa->curlft.bytes = sa_info->curlft.bytes;
743  sa->curlft.packets = sa_info->curlft.packets;
744  sa->curlft.add_time = sa_info->curlft.add_time;
745  sa->curlft.use_time = sa_info->curlft.use_time;
746  sa->ce_mask |= XFRM_SA_ATTR_LTIME_CUR;
747 
748  sa->stats.replay_window = sa_info->stats.replay_window;
749  sa->stats.replay = sa_info->stats.replay;
750  sa->stats.integrity_failed = sa_info->stats.integrity_failed;
751  sa->ce_mask |= XFRM_SA_ATTR_STATS;
752 
753  sa->seq = sa_info->seq;
754  sa->reqid = sa_info->reqid;
755  sa->family = sa_info->family;
756  sa->mode = sa_info->mode;
757  sa->replay_window = sa_info->replay_window;
758  sa->flags = sa_info->flags;
759  sa->ce_mask |= (XFRM_SA_ATTR_SEQ | XFRM_SA_ATTR_REQID |
760  XFRM_SA_ATTR_FAMILY | XFRM_SA_ATTR_MODE |
761  XFRM_SA_ATTR_REPLAY_WIN | XFRM_SA_ATTR_FLAGS);
762 
763  if (tb[XFRMA_ALG_AEAD]) {
764  struct xfrm_algo_aead* aead = nla_data(tb[XFRMA_ALG_AEAD]);
765  len = sizeof (struct xfrmnl_algo_aead) + ((aead->alg_key_len + 7) / 8);
766  if ((sa->aead = calloc (1, len)) == NULL)
767  {
768  err = -NLE_NOMEM;
769  goto errout;
770  }
771  memcpy ((void *)sa->aead, (void *)aead, len);
772  sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
773  }
774 
775  if (tb[XFRMA_ALG_AUTH_TRUNC]) {
776  struct xfrm_algo_auth* auth = nla_data(tb[XFRMA_ALG_AUTH_TRUNC]);
777  len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
778  if ((sa->auth = calloc (1, len)) == NULL)
779  {
780  err = -NLE_NOMEM;
781  goto errout;
782  }
783  memcpy ((void *)sa->auth, (void *)auth, len);
784  sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
785  }
786 
787  if (tb[XFRMA_ALG_AUTH] && !sa->auth) {
788  struct xfrm_algo* auth = nla_data(tb[XFRMA_ALG_AUTH]);
789  len = sizeof (struct xfrmnl_algo_auth) + ((auth->alg_key_len + 7) / 8);
790  if ((sa->auth = calloc (1, len)) == NULL)
791  {
792  err = -NLE_NOMEM;
793  goto errout;
794  }
795  strcpy(sa->auth->alg_name, auth->alg_name);
796  memcpy(sa->auth->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
797  sa->auth->alg_key_len = auth->alg_key_len;
798  sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
799  }
800 
801  if (tb[XFRMA_ALG_CRYPT]) {
802  struct xfrm_algo* crypt = nla_data(tb[XFRMA_ALG_CRYPT]);
803  len = sizeof (struct xfrmnl_algo) + ((crypt->alg_key_len + 7) / 8);
804  if ((sa->crypt = calloc (1, len)) == NULL)
805  {
806  err = -NLE_NOMEM;
807  goto errout;
808  }
809  memcpy ((void *)sa->crypt, (void *)crypt, len);
810  sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
811  }
812 
813  if (tb[XFRMA_ALG_COMP]) {
814  struct xfrm_algo* comp = nla_data(tb[XFRMA_ALG_COMP]);
815  len = sizeof (struct xfrmnl_algo) + ((comp->alg_key_len + 7) / 8);
816  if ((sa->comp = calloc (1, len)) == NULL)
817  {
818  err = -NLE_NOMEM;
819  goto errout;
820  }
821  memcpy ((void *)sa->comp, (void *)comp, len);
822  sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
823  }
824 
825  if (tb[XFRMA_ENCAP]) {
826  struct xfrm_encap_tmpl* encap = nla_data(tb[XFRMA_ENCAP]);
827  len = sizeof (struct xfrmnl_encap_tmpl);
828  if ((sa->encap = calloc (1, len)) == NULL)
829  {
830  err = -NLE_NOMEM;
831  goto errout;
832  }
833  sa->encap->encap_type = encap->encap_type;
834  sa->encap->encap_sport = ntohs(encap->encap_sport);
835  sa->encap->encap_dport = ntohs(encap->encap_dport);
836  if (sa_info->family == AF_INET)
837  sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a4, sizeof (encap->encap_oa.a4));
838  else
839  sa->encap->encap_oa = nl_addr_build (sa_info->family, &encap->encap_oa.a6, sizeof (encap->encap_oa.a6));
840  sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
841  }
842 
843  if (tb[XFRMA_TFCPAD]) {
844  sa->tfcpad = *(uint32_t*)nla_data(tb[XFRMA_TFCPAD]);
845  sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
846  }
847 
848  if (tb[XFRMA_COADDR]) {
849  if (sa_info->family == AF_INET)
850  {
851  sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
852  sizeof (uint32_t));
853  }
854  else
855  {
856  sa->coaddr = nl_addr_build(sa_info->family, nla_data(tb[XFRMA_COADDR]),
857  sizeof (uint32_t) * 4);
858  }
859  sa->ce_mask |= XFRM_SA_ATTR_COADDR;
860  }
861 
862  if (tb[XFRMA_MARK]) {
863  struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
864  sa->mark.m = m->m;
865  sa->mark.v = m->v;
866  sa->ce_mask |= XFRM_SA_ATTR_MARK;
867  }
868 
869  if (tb[XFRMA_SEC_CTX]) {
870  struct xfrm_user_sec_ctx* sec_ctx = nla_data(tb[XFRMA_SEC_CTX]);
871  len = sizeof (struct xfrmnl_user_sec_ctx) + sec_ctx->ctx_len;
872  if ((sa->sec_ctx = calloc (1, len)) == NULL)
873  {
874  err = -NLE_NOMEM;
875  goto errout;
876  }
877  memcpy (sa->sec_ctx, sec_ctx, len);
878  sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
879  }
880 
881  if (tb[XFRMA_ETIMER_THRESH]) {
882  sa->replay_maxage = *(uint32_t*)nla_data(tb[XFRMA_ETIMER_THRESH]);
883  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
884  }
885 
886  if (tb[XFRMA_REPLAY_THRESH]) {
887  sa->replay_maxdiff = *(uint32_t*)nla_data(tb[XFRMA_REPLAY_THRESH]);
888  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
889  }
890 
891  if (tb[XFRMA_REPLAY_ESN_VAL]) {
892  struct xfrm_replay_state_esn* esn = nla_data (tb[XFRMA_REPLAY_ESN_VAL]);
893  len = sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * esn->bmp_len);
894  if ((sa->replay_state_esn = calloc (1, len)) == NULL)
895  {
896  err = -NLE_NOMEM;
897  goto errout;
898  }
899  memcpy ((void *)sa->replay_state_esn, (void *)esn, len);
900  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
901  }
902  else if (tb[XFRMA_REPLAY_VAL])
903  {
904  struct xfrm_replay_state* replay_state = nla_data (tb[XFRMA_REPLAY_VAL]);
905  sa->replay_state.oseq = replay_state->oseq;
906  sa->replay_state.seq = replay_state->seq;
907  sa->replay_state.bitmap = replay_state->bitmap;
908  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
909  sa->replay_state_esn = NULL;
910  }
911 
912  *result = sa;
913  return 0;
914 
915 errout:
916  xfrmnl_sa_put(sa);
917  return err;
918 }
919 
920 static int xfrm_sa_update_cache (struct nl_cache *cache, struct nl_object *obj,
921  change_func_t change_cb, change_func_v2_t change_cb_v2,
922  void *data)
923 {
924  struct nl_object* old_sa;
925  struct xfrmnl_sa* sa = (struct xfrmnl_sa*)obj;
926 
927  if (nl_object_get_msgtype (obj) == XFRM_MSG_EXPIRE)
928  {
929  /* On hard expiry, the SA gets deleted too from the kernel state without any
930  * further delete event. On Expire message, we are only updating the cache with
931  * the SA object's new state. In absence of the explicit delete event, the cache will
932  * be out of sync with the kernel state. To get around this, expiry messages cache
933  * operations are handled here (installed with NL_ACT_UNSPEC action) instead of
934  * in Libnl Cache module. */
935 
936  /* Do we already have this object in the cache? */
937  old_sa = nl_cache_search(cache, obj);
938  if (old_sa)
939  {
940  /* Found corresponding SA object in cache. Delete it */
941  nl_cache_remove (old_sa);
942  }
943 
944  /* Handle the expiry event now */
945  if (sa->hard == 0)
946  {
947  /* Soft expiry event: Save the new object to the
948  * cache and notify application of the expiry event. */
949  nl_cache_move (cache, obj);
950 
951  if (old_sa == NULL)
952  {
953  /* Application CB present, no previous instance of SA object present.
954  * Notify application CB as a NEW event */
955  if (change_cb_v2)
956  change_cb_v2(cache, NULL, obj, 0, NL_ACT_NEW, data);
957  else if (change_cb)
958  change_cb(cache, obj, NL_ACT_NEW, data);
959  }
960  else if (old_sa)
961  {
962  uint64_t diff = 0;
963  if (change_cb || change_cb_v2)
964  diff = nl_object_diff64(old_sa, obj);
965 
966  /* Application CB present, a previous instance of SA object present.
967  * Notify application CB as a CHANGE1 event */
968  if (diff) {
969  if (change_cb_v2) {
970  change_cb_v2(cache, old_sa, obj, diff, NL_ACT_CHANGE, data);
971  } else if (change_cb)
972  change_cb(cache, obj, NL_ACT_CHANGE, data);
973  }
974  nl_object_put (old_sa);
975  }
976  }
977  else
978  {
979  /* Hard expiry event: Delete the object from the
980  * cache and notify application of the expiry event. */
981  if (change_cb_v2)
982  change_cb_v2(cache, obj, NULL, 0, NL_ACT_DEL, data);
983  else if (change_cb)
984  change_cb (cache, obj, NL_ACT_DEL, data);
985  nl_object_put (old_sa);
986  }
987 
988  /* Done handling expire message */
989  return 0;
990  }
991  else
992  {
993  /* All other messages other than Expire, let the standard Libnl cache
994  * module handle it. */
995  if (change_cb_v2)
996  return nl_cache_include_v2(cache, obj, change_cb_v2, data);
997  else
998  return nl_cache_include (cache, obj, change_cb, data);
999  }
1000 }
1001 
1002 static int xfrm_sa_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
1003  struct nlmsghdr *n, struct nl_parser_param *pp)
1004 {
1005  struct xfrmnl_sa* sa;
1006  int err;
1007 
1008  if ((err = xfrmnl_sa_parse(n, &sa)) < 0)
1009  return err;
1010 
1011  err = pp->pp_cb((struct nl_object *) sa, pp);
1012 
1013  xfrmnl_sa_put(sa);
1014  return err;
1015 }
1016 
1017 /**
1018  * @name XFRM SA Get
1019  * @{
1020  */
1021 
1022 int xfrmnl_sa_build_get_request(struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
1023 {
1024  struct nl_msg *msg;
1025  struct xfrm_usersa_id sa_id;
1026  struct xfrm_mark mark;
1027 
1028  if (!daddr || !spi)
1029  {
1030  fprintf(stderr, "APPLICATION BUG: %s:%d:%s: A valid destination address, spi must be specified\n",
1031  __FILE__, __LINE__, __PRETTY_FUNCTION__);
1032  assert(0);
1033  return -NLE_MISSING_ATTR;
1034  }
1035 
1036  memset(&sa_id, 0, sizeof(sa_id));
1037  memcpy (&sa_id.daddr, nl_addr_get_binary_addr (daddr), sizeof (uint8_t) * nl_addr_get_len (daddr));
1038  sa_id.family = nl_addr_get_family (daddr);
1039  sa_id.spi = htonl(spi);
1040  sa_id.proto = protocol;
1041 
1042  if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETSA, 0)))
1043  return -NLE_NOMEM;
1044 
1045  if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1046  goto nla_put_failure;
1047 
1048  if ((mark_m & mark_v) != 0)
1049  {
1050  memset(&mark, 0, sizeof(struct xfrm_mark));
1051  mark.m = mark_m;
1052  mark.v = mark_v;
1053 
1054  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
1055  }
1056 
1057  *result = msg;
1058  return 0;
1059 
1060 nla_put_failure:
1061  nlmsg_free(msg);
1062  return -NLE_MSGSIZE;
1063 }
1064 
1065 int xfrmnl_sa_get_kernel(struct nl_sock* sock, struct nl_addr* daddr, unsigned int spi, unsigned int protocol, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sa** result)
1066 {
1067  struct nl_msg *msg = NULL;
1068  struct nl_object *obj;
1069  int err;
1070 
1071  if ((err = xfrmnl_sa_build_get_request(daddr, spi, protocol, mark_m, mark_v, &msg)) < 0)
1072  return err;
1073 
1074  err = nl_send_auto(sock, msg);
1075  nlmsg_free(msg);
1076  if (err < 0)
1077  return err;
1078 
1079  if ((err = nl_pickup(sock, &xfrm_sa_msg_parser, &obj)) < 0)
1080  return err;
1081 
1082  /* We have used xfrm_sa_msg_parser(), object is definitely a xfrm sa */
1083  *result = (struct xfrmnl_sa *) obj;
1084 
1085  /* If an object has been returned, we also need to wait for the ACK */
1086  if (err == 0 && obj)
1087  nl_wait_for_ack(sock);
1088 
1089  return 0;
1090 }
1091 
1092 /** @} */
1093 
1094 static int build_xfrm_sa_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1095 {
1096  struct nl_msg* msg;
1097  struct xfrm_usersa_info sa_info;
1098  uint32_t len;
1099  struct nl_addr* addr;
1100 
1101  if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1102  !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1103  !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1104  return -NLE_MISSING_ATTR;
1105 
1106  memset ((void*)&sa_info, 0, sizeof (sa_info));
1107  if (tmpl->ce_mask & XFRM_SA_ATTR_SEL)
1108  {
1109  addr = xfrmnl_sel_get_daddr (tmpl->sel);
1110  memcpy ((void*)&sa_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1111  addr = xfrmnl_sel_get_saddr (tmpl->sel);
1112  memcpy ((void*)&sa_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
1113  sa_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
1114  sa_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
1115  sa_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
1116  sa_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
1117  sa_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
1118  sa_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
1119  sa_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
1120  sa_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
1121  sa_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
1122  sa_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
1123  }
1124 
1125  memcpy (&sa_info.id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1126  sa_info.id.spi = htonl(tmpl->id.spi);
1127  sa_info.id.proto = tmpl->id.proto;
1128 
1129  if (tmpl->ce_mask & XFRM_SA_ATTR_SADDR)
1130  memcpy (&sa_info.saddr, nl_addr_get_binary_addr (tmpl->saddr), sizeof (uint8_t) * nl_addr_get_len (tmpl->saddr));
1131 
1132  if (tmpl->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1133  {
1134  sa_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
1135  sa_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
1136  sa_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
1137  sa_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
1138  sa_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
1139  sa_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
1140  sa_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
1141  sa_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
1142  }
1143 
1144  //Skip current lifetime: cur lifetime can be updated only via AE
1145  //Skip stats: stats cant be updated
1146  //Skip seq: seq cant be updated
1147 
1148  if (tmpl->ce_mask & XFRM_SA_ATTR_REQID)
1149  sa_info.reqid = tmpl->reqid;
1150 
1151  if (tmpl->ce_mask & XFRM_SA_ATTR_FAMILY)
1152  sa_info.family = tmpl->family;
1153 
1154  if (tmpl->ce_mask & XFRM_SA_ATTR_MODE)
1155  sa_info.mode = tmpl->mode;
1156 
1157  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1158  sa_info.replay_window = tmpl->replay_window;
1159 
1160  if (tmpl->ce_mask & XFRM_SA_ATTR_FLAGS)
1161  sa_info.flags = tmpl->flags;
1162 
1163  msg = nlmsg_alloc_simple(cmd, flags);
1164  if (!msg)
1165  return -NLE_NOMEM;
1166 
1167  if (nlmsg_append(msg, &sa_info, sizeof(sa_info), NLMSG_ALIGNTO) < 0)
1168  goto nla_put_failure;
1169 
1170  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AEAD) {
1171  len = sizeof (struct xfrm_algo_aead) + ((tmpl->aead->alg_key_len + 7) / 8);
1172  NLA_PUT (msg, XFRMA_ALG_AEAD, len, tmpl->aead);
1173  }
1174 
1175  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_AUTH) {
1176  /* kernel prefers XFRMA_ALG_AUTH_TRUNC over XFRMA_ALG_AUTH, so only
1177  * one of the attributes needs to be present */
1178  if (tmpl->auth->alg_trunc_len) {
1179  len = sizeof (struct xfrm_algo_auth) + ((tmpl->auth->alg_key_len + 7) / 8);
1180  NLA_PUT (msg, XFRMA_ALG_AUTH_TRUNC, len, tmpl->auth);
1181  } else {
1182  struct xfrm_algo *auth;
1183 
1184  len = sizeof (struct xfrm_algo) + ((tmpl->auth->alg_key_len + 7) / 8);
1185  auth = malloc(len);
1186  if (!auth) {
1187  nlmsg_free(msg);
1188  return -NLE_NOMEM;
1189  }
1190 
1191  strncpy(auth->alg_name, tmpl->auth->alg_name, sizeof(auth->alg_name));
1192  auth->alg_key_len = tmpl->auth->alg_key_len;
1193  memcpy(auth->alg_key, tmpl->auth->alg_key, (tmpl->auth->alg_key_len + 7) / 8);
1194  if (nla_put(msg, XFRMA_ALG_AUTH, len, auth) < 0) {
1195  free(auth);
1196  goto nla_put_failure;
1197  }
1198  free(auth);
1199  }
1200  }
1201 
1202  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_CRYPT) {
1203  len = sizeof (struct xfrm_algo) + ((tmpl->crypt->alg_key_len + 7) / 8);
1204  NLA_PUT (msg, XFRMA_ALG_CRYPT, len, tmpl->crypt);
1205  }
1206 
1207  if (tmpl->ce_mask & XFRM_SA_ATTR_ALG_COMP) {
1208  len = sizeof (struct xfrm_algo) + ((tmpl->comp->alg_key_len + 7) / 8);
1209  NLA_PUT (msg, XFRMA_ALG_COMP, len, tmpl->comp);
1210  }
1211 
1212  if (tmpl->ce_mask & XFRM_SA_ATTR_ENCAP) {
1213  struct xfrm_encap_tmpl* encap_tmpl;
1214  struct nlattr* encap_attr;
1215 
1216  len = sizeof (struct xfrm_encap_tmpl);
1217  encap_attr = nla_reserve(msg, XFRMA_ENCAP, len);
1218  if (!encap_attr)
1219  goto nla_put_failure;
1220  encap_tmpl = nla_data (encap_attr);
1221  encap_tmpl->encap_type = tmpl->encap->encap_type;
1222  encap_tmpl->encap_sport = htons (tmpl->encap->encap_sport);
1223  encap_tmpl->encap_dport = htons (tmpl->encap->encap_dport);
1224  memcpy (&encap_tmpl->encap_oa, nl_addr_get_binary_addr (tmpl->encap->encap_oa), sizeof (uint8_t) * nl_addr_get_len (tmpl->encap->encap_oa));
1225  }
1226 
1227  if (tmpl->ce_mask & XFRM_SA_ATTR_TFCPAD) {
1228  NLA_PUT_U32 (msg, XFRMA_TFCPAD, tmpl->tfcpad);
1229  }
1230 
1231  if (tmpl->ce_mask & XFRM_SA_ATTR_COADDR) {
1232  NLA_PUT (msg, XFRMA_COADDR, sizeof (xfrm_address_t), tmpl->coaddr);
1233  }
1234 
1235  if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1236  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1237  }
1238 
1239  if (tmpl->ce_mask & XFRM_SA_ATTR_SECCTX) {
1240  len = sizeof (struct xfrm_sec_ctx) + tmpl->sec_ctx->ctx_len;
1241  NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1242  }
1243 
1244  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE) {
1245  NLA_PUT_U32 (msg, XFRMA_ETIMER_THRESH, tmpl->replay_maxage);
1246  }
1247 
1248  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF) {
1249  NLA_PUT_U32 (msg, XFRMA_REPLAY_THRESH, tmpl->replay_maxdiff);
1250  }
1251 
1252  if (tmpl->ce_mask & XFRM_SA_ATTR_REPLAY_STATE) {
1253  if (tmpl->replay_state_esn) {
1254  len = sizeof (struct xfrm_replay_state_esn) + (sizeof (uint32_t) * tmpl->replay_state_esn->bmp_len);
1255  NLA_PUT (msg, XFRMA_REPLAY_ESN_VAL, len, tmpl->replay_state_esn);
1256  }
1257  else {
1258  NLA_PUT (msg, XFRMA_REPLAY_VAL, sizeof (struct xfrm_replay_state), &tmpl->replay_state);
1259  }
1260  }
1261 
1262  *result = msg;
1263  return 0;
1264 
1265 nla_put_failure:
1266  nlmsg_free(msg);
1267  return -NLE_MSGSIZE;
1268 }
1269 
1270 /**
1271  * @name XFRM SA Add
1272  * @{
1273  */
1274 
1275 int xfrmnl_sa_build_add_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1276 {
1277  return build_xfrm_sa_message (tmpl, XFRM_MSG_NEWSA, flags, result);
1278 }
1279 
1280 int xfrmnl_sa_add(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1281 {
1282  int err;
1283  struct nl_msg *msg;
1284 
1285  if ((err = xfrmnl_sa_build_add_request(tmpl, flags, &msg)) < 0)
1286  return err;
1287 
1288  err = nl_send_auto_complete(sk, msg);
1289  nlmsg_free(msg);
1290  if (err < 0)
1291  return err;
1292 
1293  return nl_wait_for_ack(sk);
1294 }
1295 
1296 /**
1297  * @name XFRM SA Update
1298  * @{
1299  */
1300 
1301 int xfrmnl_sa_build_update_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1302 {
1303  return build_xfrm_sa_message (tmpl, XFRM_MSG_UPDSA, flags, result);
1304 }
1305 
1306 int xfrmnl_sa_update(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1307 {
1308  int err;
1309  struct nl_msg *msg;
1310 
1311  if ((err = xfrmnl_sa_build_update_request(tmpl, flags, &msg)) < 0)
1312  return err;
1313 
1314  err = nl_send_auto_complete(sk, msg);
1315  nlmsg_free(msg);
1316  if (err < 0)
1317  return err;
1318 
1319  return nl_wait_for_ack(sk);
1320 }
1321 
1322 /** @} */
1323 
1324 static int build_xfrm_sa_delete_message(struct xfrmnl_sa *tmpl, int cmd, int flags, struct nl_msg **result)
1325 {
1326  struct nl_msg* msg;
1327  struct xfrm_usersa_id sa_id;
1328 
1329  if (!(tmpl->ce_mask & XFRM_SA_ATTR_DADDR) ||
1330  !(tmpl->ce_mask & XFRM_SA_ATTR_SPI) ||
1331  !(tmpl->ce_mask & XFRM_SA_ATTR_PROTO))
1332  return -NLE_MISSING_ATTR;
1333 
1334  memcpy (&sa_id.daddr, nl_addr_get_binary_addr (tmpl->id.daddr),
1335  sizeof (uint8_t) * nl_addr_get_len (tmpl->id.daddr));
1336  sa_id.family = nl_addr_get_family (tmpl->id.daddr);
1337  sa_id.spi = htonl(tmpl->id.spi);
1338  sa_id.proto = tmpl->id.proto;
1339 
1340  msg = nlmsg_alloc_simple(cmd, flags);
1341  if (!msg)
1342  return -NLE_NOMEM;
1343 
1344  if (nlmsg_append(msg, &sa_id, sizeof(sa_id), NLMSG_ALIGNTO) < 0)
1345  goto nla_put_failure;
1346 
1347  if (tmpl->ce_mask & XFRM_SA_ATTR_MARK) {
1348  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
1349  }
1350 
1351  *result = msg;
1352  return 0;
1353 
1354 nla_put_failure:
1355  nlmsg_free(msg);
1356  return -NLE_MSGSIZE;
1357 }
1358 
1359 /**
1360  * @name XFRM SA Delete
1361  * @{
1362  */
1363 
1364 int xfrmnl_sa_build_delete_request(struct xfrmnl_sa* tmpl, int flags, struct nl_msg **result)
1365 {
1366  return build_xfrm_sa_delete_message (tmpl, XFRM_MSG_DELSA, flags, result);
1367 }
1368 
1369 int xfrmnl_sa_delete(struct nl_sock* sk, struct xfrmnl_sa* tmpl, int flags)
1370 {
1371  int err;
1372  struct nl_msg *msg;
1373 
1374  if ((err = xfrmnl_sa_build_delete_request(tmpl, flags, &msg)) < 0)
1375  return err;
1376 
1377  err = nl_send_auto_complete(sk, msg);
1378  nlmsg_free(msg);
1379  if (err < 0)
1380  return err;
1381 
1382  return nl_wait_for_ack(sk);
1383 }
1384 
1385 /** @} */
1386 
1387 
1388 /**
1389  * @name Attributes
1390  * @{
1391  */
1392 
1393 struct xfrmnl_sel* xfrmnl_sa_get_sel (struct xfrmnl_sa* sa)
1394 {
1395  if (sa->ce_mask & XFRM_SA_ATTR_SEL)
1396  return sa->sel;
1397  else
1398  return NULL;
1399 }
1400 
1401 int xfrmnl_sa_set_sel (struct xfrmnl_sa* sa, struct xfrmnl_sel* sel)
1402 {
1403  /* Release any previously held selector object from the SA */
1404  if (sa->sel)
1405  xfrmnl_sel_put (sa->sel);
1406 
1407  /* Increment ref count on new selector and save it in the SA */
1408  xfrmnl_sel_get (sel);
1409  sa->sel = sel;
1410  sa->ce_mask |= XFRM_SA_ATTR_SEL;
1411 
1412  return 0;
1413 }
1414 
1415 static inline int __assign_addr(struct xfrmnl_sa* sa, struct nl_addr **pos,
1416  struct nl_addr *new, int flag, int nocheck)
1417 {
1418  if (!nocheck)
1419  {
1420  if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1421  {
1422  if (nl_addr_get_family (new) != sa->family)
1423  return -NLE_AF_MISMATCH;
1424  }
1425  }
1426 
1427  if (*pos)
1428  nl_addr_put(*pos);
1429 
1430  nl_addr_get(new);
1431  *pos = new;
1432 
1433  sa->ce_mask |= flag;
1434 
1435  return 0;
1436 }
1437 
1438 
1439 struct nl_addr* xfrmnl_sa_get_daddr (struct xfrmnl_sa* sa)
1440 {
1441  if (sa->ce_mask & XFRM_SA_ATTR_DADDR)
1442  return sa->id.daddr;
1443  else
1444  return NULL;
1445 }
1446 
1447 int xfrmnl_sa_set_daddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1448 {
1449  return __assign_addr(sa, &sa->id.daddr, addr, XFRM_SA_ATTR_DADDR, 0);
1450 }
1451 
1452 int xfrmnl_sa_get_spi (struct xfrmnl_sa* sa)
1453 {
1454  if (sa->ce_mask & XFRM_SA_ATTR_SPI)
1455  return sa->id.spi;
1456  else
1457  return -1;
1458 }
1459 
1460 int xfrmnl_sa_set_spi (struct xfrmnl_sa* sa, unsigned int spi)
1461 {
1462  sa->id.spi = spi;
1463  sa->ce_mask |= XFRM_SA_ATTR_SPI;
1464 
1465  return 0;
1466 }
1467 
1468 int xfrmnl_sa_get_proto (struct xfrmnl_sa* sa)
1469 {
1470  if (sa->ce_mask & XFRM_SA_ATTR_PROTO)
1471  return sa->id.proto;
1472  else
1473  return -1;
1474 }
1475 
1476 int xfrmnl_sa_set_proto (struct xfrmnl_sa* sa, unsigned int protocol)
1477 {
1478  sa->id.proto = protocol;
1479  sa->ce_mask |= XFRM_SA_ATTR_PROTO;
1480 
1481  return 0;
1482 }
1483 
1484 struct nl_addr* xfrmnl_sa_get_saddr (struct xfrmnl_sa* sa)
1485 {
1486  if (sa->ce_mask & XFRM_SA_ATTR_SADDR)
1487  return sa->saddr;
1488  else
1489  return NULL;
1490 }
1491 
1492 int xfrmnl_sa_set_saddr (struct xfrmnl_sa* sa, struct nl_addr* addr)
1493 {
1494  return __assign_addr(sa, &sa->saddr, addr, XFRM_SA_ATTR_SADDR, 1);
1495 }
1496 
1497 struct xfrmnl_ltime_cfg* xfrmnl_sa_get_lifetime_cfg (struct xfrmnl_sa* sa)
1498 {
1499  if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CFG)
1500  return sa->lft;
1501  else
1502  return NULL;
1503 }
1504 
1505 int xfrmnl_sa_set_lifetime_cfg (struct xfrmnl_sa* sa, struct xfrmnl_ltime_cfg* ltime)
1506 {
1507  /* Release any previously held lifetime cfg object from the SA */
1508  if (sa->lft)
1509  xfrmnl_ltime_cfg_put (sa->lft);
1510 
1511  /* Increment ref count on new lifetime object and save it in the SA */
1512  xfrmnl_ltime_cfg_get (ltime);
1513  sa->lft = ltime;
1514  sa->ce_mask |= XFRM_SA_ATTR_LTIME_CFG;
1515 
1516  return 0;
1517 }
1518 
1519 int xfrmnl_sa_get_curlifetime (struct xfrmnl_sa* sa, unsigned long long int* curr_bytes,
1520  unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1521 {
1522  if (sa == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1523  return -1;
1524 
1525  if (sa->ce_mask & XFRM_SA_ATTR_LTIME_CUR)
1526  {
1527  *curr_bytes = sa->curlft.bytes;
1528  *curr_packets = sa->curlft.packets;
1529  *curr_add_time = sa->curlft.add_time;
1530  *curr_use_time = sa->curlft.use_time;
1531  }
1532  else
1533  return -1;
1534 
1535  return 0;
1536 }
1537 
1538 int xfrmnl_sa_get_stats (struct xfrmnl_sa* sa, unsigned long long int* replay_window,
1539  unsigned long long int* replay, unsigned long long int* integrity_failed)
1540 {
1541  if (sa == NULL || replay_window == NULL || replay == NULL || integrity_failed == NULL)
1542  return -1;
1543 
1544  if (sa->ce_mask & XFRM_SA_ATTR_STATS)
1545  {
1546  *replay_window = sa->stats.replay_window;
1547  *replay = sa->stats.replay;
1548  *integrity_failed = sa->stats.integrity_failed;
1549  }
1550  else
1551  return -1;
1552 
1553  return 0;
1554 }
1555 
1556 int xfrmnl_sa_get_seq (struct xfrmnl_sa* sa)
1557 {
1558  if (sa->ce_mask & XFRM_SA_ATTR_SEQ)
1559  return sa->seq;
1560  else
1561  return -1;
1562 }
1563 
1564 int xfrmnl_sa_get_reqid (struct xfrmnl_sa* sa)
1565 {
1566  if (sa->ce_mask & XFRM_SA_ATTR_REQID)
1567  return sa->reqid;
1568  else
1569  return -1;
1570 }
1571 
1572 int xfrmnl_sa_set_reqid (struct xfrmnl_sa* sa, unsigned int reqid)
1573 {
1574  sa->reqid = reqid;
1575  sa->ce_mask |= XFRM_SA_ATTR_REQID;
1576 
1577  return 0;
1578 }
1579 
1580 int xfrmnl_sa_get_family (struct xfrmnl_sa* sa)
1581 {
1582  if (sa->ce_mask & XFRM_SA_ATTR_FAMILY)
1583  return sa->family;
1584  else
1585  return -1;
1586 }
1587 
1588 int xfrmnl_sa_set_family (struct xfrmnl_sa* sa, unsigned int family)
1589 {
1590  sa->family = family;
1591  sa->ce_mask |= XFRM_SA_ATTR_FAMILY;
1592 
1593  return 0;
1594 }
1595 
1596 int xfrmnl_sa_get_mode (struct xfrmnl_sa* sa)
1597 {
1598  if (sa->ce_mask & XFRM_SA_ATTR_MODE)
1599  return sa->mode;
1600  else
1601  return -1;
1602 }
1603 
1604 int xfrmnl_sa_set_mode (struct xfrmnl_sa* sa, unsigned int mode)
1605 {
1606  sa->mode = mode;
1607  sa->ce_mask |= XFRM_SA_ATTR_MODE;
1608 
1609  return 0;
1610 }
1611 
1612 int xfrmnl_sa_get_replay_window (struct xfrmnl_sa* sa)
1613 {
1614  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_WIN)
1615  return sa->replay_window;
1616  else
1617  return -1;
1618 }
1619 
1620 int xfrmnl_sa_set_replay_window (struct xfrmnl_sa* sa, unsigned int replay_window)
1621 {
1622  sa->replay_window = replay_window;
1623  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_WIN;
1624 
1625  return 0;
1626 }
1627 
1628 int xfrmnl_sa_get_flags (struct xfrmnl_sa* sa)
1629 {
1630  if (sa->ce_mask & XFRM_SA_ATTR_FLAGS)
1631  return sa->flags;
1632  else
1633  return -1;
1634 }
1635 
1636 int xfrmnl_sa_set_flags (struct xfrmnl_sa* sa, unsigned int flags)
1637 {
1638  sa->flags = flags;
1639  sa->ce_mask |= XFRM_SA_ATTR_FLAGS;
1640 
1641  return 0;
1642 }
1643 
1644 /**
1645  * Get the aead-params
1646  * @arg sa the xfrmnl_sa object
1647  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1648  * @arg key_len an optional output value for the key length in bits.
1649  * @arg icv_len an optional output value for the alt-icv-len.
1650  * @arg key an optional buffer large enough for the key. It must contain at least
1651  * ((@key_len + 7) / 8) bytes.
1652  *
1653  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1654  * call xfrmnl_sa_get_aead_params() without @key argument to query only the required buffer size.
1655  * This modified API is available in all versions of libnl3 that support the capability
1656  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1657  *
1658  * @return 0 on success or a negative error code.
1659  */
1660 int xfrmnl_sa_get_aead_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* icv_len, char* key)
1661 {
1662  if (sa->ce_mask & XFRM_SA_ATTR_ALG_AEAD)
1663  {
1664  if (alg_name)
1665  strcpy (alg_name, sa->aead->alg_name);
1666  if (key_len)
1667  *key_len = sa->aead->alg_key_len;
1668  if (icv_len)
1669  *icv_len = sa->aead->alg_icv_len;
1670  if (key)
1671  memcpy (key, sa->aead->alg_key, ((sa->aead->alg_key_len + 7)/8));
1672  }
1673  else
1674  return -1;
1675 
1676  return 0;
1677 }
1678 
1679 int xfrmnl_sa_set_aead_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int icv_len, const char* key)
1680 {
1681  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1682  uint32_t newlen = sizeof (struct xfrmnl_algo_aead) + keysize;
1683 
1684  /* Free up the old key and allocate memory to hold new key */
1685  if (sa->aead)
1686  free (sa->aead);
1687  if (strlen (alg_name) >= sizeof (sa->aead->alg_name) || (sa->aead = calloc (1, newlen)) == NULL)
1688  return -1;
1689 
1690  /* Save the new info */
1691  strcpy (sa->aead->alg_name, alg_name);
1692  sa->aead->alg_key_len = key_len;
1693  sa->aead->alg_icv_len = icv_len;
1694  memcpy (sa->aead->alg_key, key, keysize);
1695 
1696  sa->ce_mask |= XFRM_SA_ATTR_ALG_AEAD;
1697 
1698  return 0;
1699 }
1700 
1701 /**
1702  * Get the auth-params
1703  * @arg sa the xfrmnl_sa object
1704  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1705  * @arg key_len an optional output value for the key length in bits.
1706  * @arg trunc_len an optional output value for the alg-trunc-len.
1707  * @arg key an optional buffer large enough for the key. It must contain at least
1708  * ((@key_len + 7) / 8) bytes.
1709  *
1710  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1711  * call xfrmnl_sa_get_auth_params() without @key argument to query only the required buffer size.
1712  * This modified API is available in all versions of libnl3 that support the capability
1713  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1714  *
1715  * @return 0 on success or a negative error code.
1716  */
1717 int xfrmnl_sa_get_auth_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, unsigned int* trunc_len, char* key)
1718 {
1719  if (sa->ce_mask & XFRM_SA_ATTR_ALG_AUTH)
1720  {
1721  if (alg_name)
1722  strcpy (alg_name, sa->auth->alg_name);
1723  if (key_len)
1724  *key_len = sa->auth->alg_key_len;
1725  if (trunc_len)
1726  *trunc_len = sa->auth->alg_trunc_len;
1727  if (key)
1728  memcpy (key, sa->auth->alg_key, (sa->auth->alg_key_len + 7)/8);
1729  }
1730  else
1731  return -1;
1732 
1733  return 0;
1734 }
1735 
1736 int xfrmnl_sa_set_auth_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, unsigned int trunc_len, const char* key)
1737 {
1738  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1739  uint32_t newlen = sizeof (struct xfrmnl_algo_auth) + keysize;
1740 
1741  /* Free up the old auth data and allocate new one */
1742  if (sa->auth)
1743  free (sa->auth);
1744  if (strlen (alg_name) >= sizeof (sa->auth->alg_name) || (sa->auth = calloc (1, newlen)) == NULL)
1745  return -1;
1746 
1747  /* Save the new info */
1748  strcpy (sa->auth->alg_name, alg_name);
1749  sa->auth->alg_key_len = key_len;
1750  sa->auth->alg_trunc_len = trunc_len;
1751  memcpy (sa->auth->alg_key, key, keysize);
1752 
1753  sa->ce_mask |= XFRM_SA_ATTR_ALG_AUTH;
1754 
1755  return 0;
1756 }
1757 
1758 /**
1759  * Get the crypto-params
1760  * @arg sa the xfrmnl_sa object
1761  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1762  * @arg key_len an optional output value for the key length in bits.
1763  * @arg key an optional buffer large enough for the key. It must contain at least
1764  * ((@key_len + 7) / 8) bytes.
1765  *
1766  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1767  * call xfrmnl_sa_get_crypto_params() without @key argument to query only the required buffer size.
1768  * This modified API is available in all versions of libnl3 that support the capability
1769  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1770  *
1771  * @return 0 on success or a negative error code.
1772  */
1773 int xfrmnl_sa_get_crypto_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1774 {
1775  if (sa->ce_mask & XFRM_SA_ATTR_ALG_CRYPT)
1776  {
1777  if (alg_name)
1778  strcpy (alg_name, sa->crypt->alg_name);
1779  if (key_len)
1780  *key_len = sa->crypt->alg_key_len;
1781  if (key)
1782  memcpy (key, sa->crypt->alg_key, ((sa->crypt->alg_key_len + 7)/8));
1783  }
1784  else
1785  return -1;
1786 
1787  return 0;
1788 }
1789 
1790 int xfrmnl_sa_set_crypto_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1791 {
1792  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1793  uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1794 
1795  /* Free up the old crypto and allocate new one */
1796  if (sa->crypt)
1797  free (sa->crypt);
1798  if (strlen (alg_name) >= sizeof (sa->crypt->alg_name) || (sa->crypt = calloc (1, newlen)) == NULL)
1799  return -1;
1800 
1801  /* Save the new info */
1802  strcpy (sa->crypt->alg_name, alg_name);
1803  sa->crypt->alg_key_len = key_len;
1804  memcpy (sa->crypt->alg_key, key, keysize);
1805 
1806  sa->ce_mask |= XFRM_SA_ATTR_ALG_CRYPT;
1807 
1808  return 0;
1809 }
1810 
1811 /**
1812  * Get the comp-params
1813  * @arg sa the xfrmnl_sa object
1814  * @arg alg_name an optional output buffer for the algorithm name. Must be at least 64 bytes.
1815  * @arg key_len an optional output value for the key length in bits.
1816  * @arg key an optional buffer large enough for the key. It must contain at least
1817  * ((@key_len + 7) / 8) bytes.
1818  *
1819  * Warning: you must ensure that @key is large enough. If you don't know the key_len before-hand,
1820  * call xfrmnl_sa_get_comp_params() without @key argument to query only the required buffer size.
1821  * This modified API is available in all versions of libnl3 that support the capability
1822  * @def NL_CAPABILITY_XFRM_SA_KEY_SIZE (@see nl_has_capability for further information).
1823  *
1824  * @return 0 on success or a negative error code.
1825  */
1826 int xfrmnl_sa_get_comp_params (struct xfrmnl_sa* sa, char* alg_name, unsigned int* key_len, char* key)
1827 {
1828  if (sa->ce_mask & XFRM_SA_ATTR_ALG_COMP)
1829  {
1830  if (alg_name)
1831  strcpy (alg_name, sa->comp->alg_name);
1832  if (key_len)
1833  *key_len = sa->comp->alg_key_len;
1834  if (key)
1835  memcpy (key, sa->comp->alg_key, ((sa->comp->alg_key_len + 7)/8));
1836  }
1837  else
1838  return -1;
1839 
1840  return 0;
1841 }
1842 
1843 int xfrmnl_sa_set_comp_params (struct xfrmnl_sa* sa, const char* alg_name, unsigned int key_len, const char* key)
1844 {
1845  size_t keysize = sizeof (uint8_t) * ((key_len + 7)/8);
1846  uint32_t newlen = sizeof (struct xfrmnl_algo) + keysize;
1847 
1848  /* Free up the old compression algo params and allocate new one */
1849  if (sa->comp)
1850  free (sa->comp);
1851  if (strlen (alg_name) >= sizeof (sa->comp->alg_name) || (sa->comp = calloc (1, newlen)) == NULL)
1852  return -1;
1853 
1854  /* Save the new info */
1855  strcpy (sa->comp->alg_name, alg_name);
1856  sa->comp->alg_key_len = key_len;
1857  memcpy (sa->comp->alg_key, key, keysize);
1858 
1859  sa->ce_mask |= XFRM_SA_ATTR_ALG_COMP;
1860 
1861  return 0;
1862 }
1863 
1864 int xfrmnl_sa_get_encap_tmpl (struct xfrmnl_sa* sa, unsigned int* encap_type, unsigned int* encap_sport, unsigned int* encap_dport, struct nl_addr** encap_oa)
1865 {
1866  if (sa->ce_mask & XFRM_SA_ATTR_ENCAP)
1867  {
1868  *encap_type = sa->encap->encap_type;
1869  *encap_sport = sa->encap->encap_sport;
1870  *encap_dport = sa->encap->encap_dport;
1871  *encap_oa = nl_addr_clone (sa->encap->encap_oa);
1872  }
1873  else
1874  return -1;
1875 
1876  return 0;
1877 }
1878 
1879 int xfrmnl_sa_set_encap_tmpl (struct xfrmnl_sa* sa, unsigned int encap_type, unsigned int encap_sport, unsigned int encap_dport, struct nl_addr* encap_oa)
1880 {
1881  if (sa->encap) {
1882  /* Free up the old encap OA */
1883  if (sa->encap->encap_oa)
1884  nl_addr_put(sa->encap->encap_oa);
1885  memset(sa->encap, 0, sizeof (*sa->encap));
1886  } else if ((sa->encap = calloc(1, sizeof(*sa->encap))) == NULL)
1887  return -1;
1888 
1889  /* Save the new info */
1890  sa->encap->encap_type = encap_type;
1891  sa->encap->encap_sport = encap_sport;
1892  sa->encap->encap_dport = encap_dport;
1893  nl_addr_get (encap_oa);
1894  sa->encap->encap_oa = encap_oa;
1895 
1896  sa->ce_mask |= XFRM_SA_ATTR_ENCAP;
1897 
1898  return 0;
1899 }
1900 
1901 int xfrmnl_sa_get_tfcpad (struct xfrmnl_sa* sa)
1902 {
1903  if (sa->ce_mask & XFRM_SA_ATTR_TFCPAD)
1904  return sa->tfcpad;
1905  else
1906  return -1;
1907 }
1908 
1909 int xfrmnl_sa_set_tfcpad (struct xfrmnl_sa* sa, unsigned int tfcpad)
1910 {
1911  sa->tfcpad = tfcpad;
1912  sa->ce_mask |= XFRM_SA_ATTR_TFCPAD;
1913 
1914  return 0;
1915 }
1916 
1917 struct nl_addr* xfrmnl_sa_get_coaddr (struct xfrmnl_sa* sa)
1918 {
1919  if (sa->ce_mask & XFRM_SA_ATTR_COADDR)
1920  return sa->coaddr;
1921  else
1922  return NULL;
1923 }
1924 
1925 int xfrmnl_sa_set_coaddr (struct xfrmnl_sa* sa, struct nl_addr* coaddr)
1926 {
1927  /* Free up the old coaddr */
1928  if (sa->coaddr)
1929  nl_addr_put (sa->coaddr);
1930 
1931  /* Save the new info */
1932  nl_addr_get (coaddr);
1933  sa->coaddr = coaddr;
1934 
1935  sa->ce_mask |= XFRM_SA_ATTR_COADDR;
1936 
1937  return 0;
1938 }
1939 
1940 int xfrmnl_sa_get_mark (struct xfrmnl_sa* sa, unsigned int* mark_mask, unsigned int* mark_value)
1941 {
1942  if (mark_mask == NULL || mark_value == NULL)
1943  return -1;
1944 
1945  if (sa->ce_mask & XFRM_SA_ATTR_MARK)
1946  {
1947  *mark_mask = sa->mark.m;
1948  *mark_value = sa->mark.v;
1949 
1950  return 0;
1951  }
1952  else
1953  return -1;
1954 }
1955 
1956 int xfrmnl_sa_set_mark (struct xfrmnl_sa* sa, unsigned int value, unsigned int mask)
1957 {
1958  sa->mark.v = value;
1959  sa->mark.m = mask;
1960  sa->ce_mask |= XFRM_SA_ATTR_MARK;
1961 
1962  return 0;
1963 }
1964 
1965 /**
1966  * Get the security context.
1967  *
1968  * @arg sa The xfrmnl_sa object.
1969  * @arg doi An optional output value for the security context domain of interpretation.
1970  * @arg alg An optional output value for the security context algorithm.
1971  * @arg len An optional output value for the security context length, including the
1972  * terminating null byte ('\0').
1973  * @arg sid Unused parameter.
1974  * @arg ctx_str An optional buffer large enough for the security context string. It must
1975  * contain at least @len bytes.
1976  *
1977  * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
1978  * call xfrmnl_sa_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
1979  * This modified API is available in all versions of libnl3 that support the capability
1980  * @def NL_CAPABILITY_XFRM_SEC_CTX_LEN (@see nl_has_capability for further information).
1981  *
1982  * @return 0 on success or a negative error code.
1983  */
1984 int xfrmnl_sa_get_sec_ctx (struct xfrmnl_sa* sa, unsigned int* doi, unsigned int* alg,
1985  unsigned int* len, unsigned int* sid, char* ctx_str)
1986 {
1987  if (sa->ce_mask & XFRM_SA_ATTR_SECCTX)
1988  {
1989  if (doi)
1990  *doi = sa->sec_ctx->ctx_doi;
1991  if (alg)
1992  *alg = sa->sec_ctx->ctx_alg;
1993  if (len)
1994  *len = sa->sec_ctx->ctx_len;
1995  if (ctx_str)
1996  memcpy (ctx_str, sa->sec_ctx->ctx, sa->sec_ctx->ctx_len);
1997  }
1998  else
1999  return -1;
2000 
2001  return 0;
2002 }
2003 
2004 /**
2005  * Set the security context.
2006  *
2007  * @arg sa The xfrmnl_sa object.
2008  * @arg doi Parameter for the security context domain of interpretation.
2009  * @arg alg Parameter for the security context algorithm.
2010  * @arg len Parameter for the length of the security context string containing
2011  * the terminating null byte ('\0').
2012  * @arg sid Unused parameter.
2013  * @arg ctx_str Buffer containing the security context string.
2014  *
2015  * @return 0 on success or a negative error code.
2016  */
2017 int xfrmnl_sa_set_sec_ctx (struct xfrmnl_sa* sa, unsigned int doi, unsigned int alg, unsigned int len,
2018  unsigned int sid, const char* ctx_str)
2019 {
2020  /* Free up the old context string and allocate new one */
2021  if (sa->sec_ctx)
2022  free (sa->sec_ctx);
2023  if ((sa->sec_ctx = calloc(1, sizeof (struct xfrmnl_user_sec_ctx) + len)) == NULL)
2024  return -1;
2025 
2026  /* Save the new info */
2027  sa->sec_ctx->len = sizeof(struct xfrmnl_user_sec_ctx) + len;
2028  sa->sec_ctx->exttype = XFRMA_SEC_CTX;
2029  sa->sec_ctx->ctx_alg = alg;
2030  sa->sec_ctx->ctx_doi = doi;
2031  sa->sec_ctx->ctx_len = len;
2032  memcpy (sa->sec_ctx->ctx, ctx_str, len);
2033 
2034  sa->ce_mask |= XFRM_SA_ATTR_SECCTX;
2035 
2036  return 0;
2037 }
2038 
2039 
2040 int xfrmnl_sa_get_replay_maxage (struct xfrmnl_sa* sa)
2041 {
2042  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXAGE)
2043  return sa->replay_maxage;
2044  else
2045  return -1;
2046 }
2047 
2048 int xfrmnl_sa_set_replay_maxage (struct xfrmnl_sa* sa, unsigned int replay_maxage)
2049 {
2050  sa->replay_maxage = replay_maxage;
2051  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXAGE;
2052 
2053  return 0;
2054 }
2055 
2056 int xfrmnl_sa_get_replay_maxdiff (struct xfrmnl_sa* sa)
2057 {
2058  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_MAXDIFF)
2059  return sa->replay_maxdiff;
2060  else
2061  return -1;
2062 }
2063 
2064 int xfrmnl_sa_set_replay_maxdiff (struct xfrmnl_sa* sa, unsigned int replay_maxdiff)
2065 {
2066  sa->replay_maxdiff = replay_maxdiff;
2067  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_MAXDIFF;
2068 
2069  return 0;
2070 }
2071 
2072 int xfrmnl_sa_get_replay_state (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* bmp)
2073 {
2074  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2075  {
2076  if (sa->replay_state_esn == NULL)
2077  {
2078  *oseq = sa->replay_state.oseq;
2079  *seq = sa->replay_state.seq;
2080  *bmp = sa->replay_state.bitmap;
2081 
2082  return 0;
2083  }
2084  else
2085  {
2086  return -1;
2087  }
2088  }
2089  else
2090  return -1;
2091 }
2092 
2093 int xfrmnl_sa_set_replay_state (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq, unsigned int bitmap)
2094 {
2095  sa->replay_state.oseq = oseq;
2096  sa->replay_state.seq = seq;
2097  sa->replay_state.bitmap = bitmap;
2098  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2099 
2100  return 0;
2101 }
2102 
2103 int xfrmnl_sa_get_replay_state_esn (struct xfrmnl_sa* sa, unsigned int* oseq, unsigned int* seq, unsigned int* oseq_hi,
2104  unsigned int* seq_hi, unsigned int* replay_window, unsigned int* bmp_len, unsigned int* bmp)
2105 {
2106  if (sa->ce_mask & XFRM_SA_ATTR_REPLAY_STATE)
2107  {
2108  if (sa->replay_state_esn)
2109  {
2110  *oseq = sa->replay_state_esn->oseq;
2111  *seq = sa->replay_state_esn->seq;
2112  *oseq_hi= sa->replay_state_esn->oseq_hi;
2113  *seq_hi = sa->replay_state_esn->seq_hi;
2114  *replay_window = sa->replay_state_esn->replay_window;
2115  *bmp_len = sa->replay_state_esn->bmp_len; // In number of 32 bit words
2116  memcpy (bmp, sa->replay_state_esn->bmp, sa->replay_state_esn->bmp_len * sizeof (uint32_t));
2117 
2118  return 0;
2119  }
2120  else
2121  {
2122  return -1;
2123  }
2124  }
2125  else
2126  return -1;
2127 }
2128 
2129 int xfrmnl_sa_set_replay_state_esn (struct xfrmnl_sa* sa, unsigned int oseq, unsigned int seq,
2130  unsigned int oseq_hi, unsigned int seq_hi, unsigned int replay_window,
2131  unsigned int bmp_len, unsigned int* bmp)
2132 {
2133  /* Free the old replay state and allocate space to hold new one */
2134  if (sa->replay_state_esn)
2135  free (sa->replay_state_esn);
2136 
2137  if ((sa->replay_state_esn = calloc (1, sizeof (struct xfrmnl_replay_state_esn) + (sizeof (uint32_t) * bmp_len))) == NULL)
2138  return -1;
2139  sa->replay_state_esn->oseq = oseq;
2140  sa->replay_state_esn->seq = seq;
2141  sa->replay_state_esn->oseq_hi = oseq_hi;
2142  sa->replay_state_esn->seq_hi = seq_hi;
2143  sa->replay_state_esn->replay_window = replay_window;
2144  sa->replay_state_esn->bmp_len = bmp_len; // In number of 32 bit words
2145  memcpy (sa->replay_state_esn->bmp, bmp, bmp_len * sizeof (uint32_t));
2146  sa->ce_mask |= XFRM_SA_ATTR_REPLAY_STATE;
2147 
2148  return 0;
2149 }
2150 
2151 
2152 int xfrmnl_sa_is_hardexpiry_reached (struct xfrmnl_sa* sa)
2153 {
2154  if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2155  return (sa->hard > 0 ? 1: 0);
2156  else
2157  return 0;
2158 }
2159 
2160 int xfrmnl_sa_is_expiry_reached (struct xfrmnl_sa* sa)
2161 {
2162  if (sa->ce_mask & XFRM_SA_ATTR_EXPIRE)
2163  return 1;
2164  else
2165  return 0;
2166 }
2167 
2168 /** @} */
2169 
2170 static struct nl_object_ops xfrm_sa_obj_ops = {
2171  .oo_name = "xfrm/sa",
2172  .oo_size = sizeof(struct xfrmnl_sa),
2173  .oo_constructor = xfrm_sa_alloc_data,
2174  .oo_free_data = xfrm_sa_free_data,
2175  .oo_clone = xfrm_sa_clone,
2176  .oo_dump = {
2177  [NL_DUMP_LINE] = xfrm_sa_dump_line,
2178  [NL_DUMP_DETAILS] = xfrm_sa_dump_details,
2179  [NL_DUMP_STATS] = xfrm_sa_dump_stats,
2180  },
2181  .oo_compare = xfrm_sa_compare,
2182  .oo_attrs2str = xfrm_sa_attrs2str,
2183  .oo_id_attrs = (XFRM_SA_ATTR_DADDR | XFRM_SA_ATTR_SPI | XFRM_SA_ATTR_PROTO),
2184 };
2185 
2186 static struct nl_af_group xfrm_sa_groups[] = {
2187  { AF_UNSPEC, XFRMNLGRP_SA },
2188  { AF_UNSPEC, XFRMNLGRP_EXPIRE },
2189  { END_OF_GROUP_LIST },
2190 };
2191 
2192 static struct nl_cache_ops xfrmnl_sa_ops = {
2193  .co_name = "xfrm/sa",
2194  .co_hdrsize = sizeof(struct xfrm_usersa_info),
2195  .co_msgtypes = {
2196  { XFRM_MSG_NEWSA, NL_ACT_NEW, "new" },
2197  { XFRM_MSG_DELSA, NL_ACT_DEL, "del" },
2198  { XFRM_MSG_GETSA, NL_ACT_GET, "get" },
2199  { XFRM_MSG_EXPIRE, NL_ACT_UNSPEC, "expire"},
2200  { XFRM_MSG_UPDSA, NL_ACT_NEW, "update"},
2201  END_OF_MSGTYPES_LIST,
2202  },
2203  .co_protocol = NETLINK_XFRM,
2204  .co_groups = xfrm_sa_groups,
2205  .co_request_update = xfrm_sa_request_update,
2206  .co_msg_parser = xfrm_sa_msg_parser,
2207  .co_obj_ops = &xfrm_sa_obj_ops,
2208  .co_include_event = &xfrm_sa_update_cache
2209 };
2210 
2211 /**
2212  * @name XFRM SA Cache Managament
2213  * @{
2214  */
2215 
2216 static void __attribute__ ((constructor)) xfrm_sa_init(void)
2217 {
2218  nl_cache_mngt_register(&xfrmnl_sa_ops);
2219 }
2220 
2221 static void __attribute__ ((destructor)) xfrm_sa_exit(void)
2222 {
2223  nl_cache_mngt_unregister(&xfrmnl_sa_ops);
2224 }
2225 
2226 /** @} */
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1245
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:471
Dump object briefly on one line.
Definition: types.h:22
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:929
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:559
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:563
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:106
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:54
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:287
Attribute validation policy.
Definition: attr.h:67
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:204
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:216
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1176
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:214
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:93
struct nlattr * nla_reserve(struct nl_msg *msg, int attrtype, int attrlen)
Reserve space for a attribute.
Definition: attr.c:456
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:501
Dump all attributes but no statistics.
Definition: types.h:23
uint64_t nl_object_diff64(struct nl_object *a, struct nl_object *b)
Compute bitmask representing difference in attribute values.
Definition: object.c:361
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:252
struct nl_object * nl_cache_search(struct nl_cache *cache, struct nl_object *needle)
Search object in cache.
Definition: cache.c:1113
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:162
int nl_object_get_msgtype(const struct nl_object *obj)
Return the netlink message type the object was derived from.
Definition: object.c:529
void nl_cache_remove(struct nl_object *obj)
Remove object from cache.
Definition: cache.c:551
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:120
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:160
#define NLA_PUT_U32(msg, attrtype, value)
Add 32 bit integer attribute to netlink message.
Definition: attr.h:233
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:72
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:580
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:145
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:443
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1110
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:215
int nl_cache_move(struct nl_cache *cache, struct nl_object *obj)
Move object from one cache to another.
Definition: cache.c:523
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:517
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:347
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:76
32 bit integer
Definition: attr.h:41
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:95
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:74
Dumping parameters.
Definition: types.h:33
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:154
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:938
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:516
int nla_put(struct nl_msg *msg, int attrtype, int datalen, const void *data)
Add a unspecific attribute to netlink message.
Definition: attr.c:497
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:917
Dump all attributes including statistics.
Definition: types.h:24
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:119
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:905
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:233
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:963
int nl_addr_get_family(const struct nl_addr *addr)
Return address family.
Definition: addr.c:857