libnl  3.7.0
sp.c
1 /* SPDX-License-Identifier: LGPL-2.1-only */
2 /*
3  * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
4  *
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * Redistributions of source code must retain the above copyright
11  * notice, this list of conditions and the following disclaimer.
12  *
13  * Redistributions in binary form must reproduce the above copyright
14  * notice, this list of conditions and the following disclaimer in the
15  * documentation and/or other materials provided with the
16  * distribution.
17  *
18  * Neither the name of Texas Instruments Incorporated nor the names of
19  * its contributors may be used to endorse or promote products derived
20  * from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 /**
37  * @ingroup xfrmnl
38  * @defgroup sp Security Policy
39  * @brief
40  */
41 
42 #include <netlink-private/netlink.h>
43 #include <netlink/netlink.h>
44 #include <netlink/cache.h>
45 #include <netlink/object.h>
46 #include <netlink/xfrm/selector.h>
47 #include <netlink/xfrm/lifetime.h>
48 #include <netlink/xfrm/template.h>
49 #include <netlink/xfrm/sp.h>
50 
51 /** @cond SKIP */
52 #define XFRM_SP_ATTR_SEL 0x01
53 #define XFRM_SP_ATTR_LTIME_CFG 0x02
54 #define XFRM_SP_ATTR_LTIME_CUR 0x04
55 #define XFRM_SP_ATTR_PRIO 0x08
56 #define XFRM_SP_ATTR_INDEX 0x10
57 #define XFRM_SP_ATTR_DIR 0x20
58 #define XFRM_SP_ATTR_ACTION 0x40
59 #define XFRM_SP_ATTR_FLAGS 0x80
60 #define XFRM_SP_ATTR_SHARE 0x100
61 #define XFRM_SP_ATTR_POLTYPE 0x200
62 #define XFRM_SP_ATTR_SECCTX 0x400
63 #define XFRM_SP_ATTR_TMPL 0x800
64 #define XFRM_SP_ATTR_MARK 0x1000
65 
66 static struct nl_cache_ops xfrmnl_sp_ops;
67 static struct nl_object_ops xfrm_sp_obj_ops;
68 /** @endcond */
69 
70 static void xfrm_sp_alloc_data(struct nl_object *c)
71 {
72  struct xfrmnl_sp* sp = nl_object_priv (c);
73 
74  if ((sp->sel = xfrmnl_sel_alloc ()) == NULL)
75  return;
76 
77  if ((sp->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
78  return;
79 
80  nl_init_list_head(&sp->usertmpl_list);
81 
82  return;
83 }
84 
85 static void xfrm_sp_free_data(struct nl_object *c)
86 {
87  struct xfrmnl_sp* sp = nl_object_priv (c);
88  struct xfrmnl_user_tmpl *utmpl, *tmp;
89 
90  if (sp == NULL)
91  return;
92 
93  xfrmnl_sel_put (sp->sel);
94  xfrmnl_ltime_cfg_put (sp->lft);
95 
96  if (sp->sec_ctx) {
97  free(sp->sec_ctx);
98  }
99 
100  nl_list_for_each_entry_safe(utmpl, tmp, &sp->usertmpl_list, utmpl_list) {
101  xfrmnl_sp_remove_usertemplate (sp, utmpl);
102  xfrmnl_user_tmpl_free (utmpl);
103  }
104 }
105 
106 static int xfrm_sp_clone(struct nl_object *_dst, struct nl_object *_src)
107 {
108  struct xfrmnl_sp* dst = nl_object_priv(_dst);
109  struct xfrmnl_sp* src = nl_object_priv(_src);
110  struct xfrmnl_user_tmpl *utmpl;
111  struct xfrmnl_user_tmpl *new;
112 
113  dst->sel = NULL;
114  dst->lft = NULL;
115  dst->sec_ctx = NULL;
116  nl_init_list_head(&dst->usertmpl_list);
117 
118  if (src->sel) {
119  if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
120  return -NLE_NOMEM;
121  }
122 
123  if (src->lft) {
124  if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
125  return -NLE_NOMEM;
126  }
127 
128  if (src->sec_ctx) {
129  uint32_t len = sizeof (struct xfrmnl_user_sec_ctx) + src->sec_ctx->ctx_len;
130 
131  if ((dst->sec_ctx = malloc (len)) == NULL)
132  return -NLE_NOMEM;
133  memcpy(dst->sec_ctx, src->sec_ctx, len);
134  }
135 
136  nl_list_for_each_entry(utmpl, &src->usertmpl_list, utmpl_list) {
137  new = xfrmnl_user_tmpl_clone (utmpl);
138  if (!new)
139  return -NLE_NOMEM;
140  xfrmnl_sp_add_usertemplate(dst, new);
141  }
142 
143  return 0;
144 }
145 
146 static uint64_t xfrm_sp_compare(struct nl_object *_a, struct nl_object *_b,
147  uint64_t attrs, int flags)
148 {
149  struct xfrmnl_sp* a = (struct xfrmnl_sp *) _a;
150  struct xfrmnl_sp* b = (struct xfrmnl_sp *) _b;
151  struct xfrmnl_user_tmpl *tmpl_a, *tmpl_b;
152  uint64_t diff = 0;
153 
154 #define XFRM_SP_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_SP_ATTR_##ATTR, a, b, EXPR)
155  diff |= XFRM_SP_DIFF(SEL, xfrmnl_sel_cmp(a->sel, b->sel));
156  diff |= XFRM_SP_DIFF(LTIME_CFG, xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
157  diff |= XFRM_SP_DIFF(PRIO, a->priority != b->priority);
158  diff |= XFRM_SP_DIFF(INDEX, a->index != b->index);
159  diff |= XFRM_SP_DIFF(DIR, a->dir != b->dir);
160  diff |= XFRM_SP_DIFF(ACTION, a->action != b->action);
161  diff |= XFRM_SP_DIFF(FLAGS, a->flags != b->flags);
162  diff |= XFRM_SP_DIFF(SHARE, a->share != b->share);
163  diff |= XFRM_SP_DIFF(SECCTX,((a->sec_ctx->len != b->sec_ctx->len) ||
164  (a->sec_ctx->exttype != b->sec_ctx->exttype) ||
165  (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
166  (a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
167  (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
168  strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
169  diff |= XFRM_SP_DIFF(POLTYPE,(a->uptype.type != b->uptype.type));
170  diff |= XFRM_SP_DIFF(TMPL,(a->nr_user_tmpl != b->nr_user_tmpl));
171  diff |= XFRM_SP_DIFF(MARK,(a->mark.m != b->mark.m) ||
172  (a->mark.v != b->mark.v));
173 
174  /* Compare the templates */
175  nl_list_for_each_entry(tmpl_b, &b->usertmpl_list, utmpl_list)
176  nl_list_for_each_entry(tmpl_a, &a->usertmpl_list, utmpl_list)
177  diff |= xfrmnl_user_tmpl_cmp (tmpl_a, tmpl_b);
178 #undef XFRM_SP_DIFF
179 
180  return diff;
181 }
182 
183 /**
184  * @name XFRM SP Attribute Translations
185  * @{
186  */
187 static const struct trans_tbl sp_attrs[] = {
188  __ADD(XFRM_SP_ATTR_SEL, selector),
189  __ADD(XFRM_SP_ATTR_LTIME_CFG, lifetime_cfg),
190  __ADD(XFRM_SP_ATTR_LTIME_CUR, lifetime_cur),
191  __ADD(XFRM_SP_ATTR_PRIO, priority),
192  __ADD(XFRM_SP_ATTR_INDEX, index),
193  __ADD(XFRM_SP_ATTR_DIR, direction),
194  __ADD(XFRM_SP_ATTR_ACTION, action),
195  __ADD(XFRM_SP_ATTR_FLAGS, flags),
196  __ADD(XFRM_SP_ATTR_SHARE, share),
197  __ADD(XFRM_SP_ATTR_POLTYPE, policy_type),
198  __ADD(XFRM_SP_ATTR_SECCTX, security_context),
199  __ADD(XFRM_SP_ATTR_TMPL, user_template),
200  __ADD(XFRM_SP_ATTR_MARK, mark),
201 };
202 
203 static char* xfrm_sp_attrs2str(int attrs, char *buf, size_t len)
204 {
205  return __flags2str (attrs, buf, len, sp_attrs, ARRAY_SIZE(sp_attrs));
206 }
207 /** @} */
208 
209 /**
210  * @name XFRM SP Action Translations
211  * @{
212  */
213 static const struct trans_tbl sa_actions[] = {
214  __ADD(XFRM_POLICY_ALLOW, allow),
215  __ADD(XFRM_POLICY_BLOCK, block),
216 };
217 
218 char* xfrmnl_sp_action2str(int action, char *buf, size_t len)
219 {
220  return __type2str (action, buf, len, sa_actions, ARRAY_SIZE(sa_actions));
221 }
222 
223 int xfrmnl_sp_str2action(const char *name)
224 {
225  return __str2type (name, sa_actions, ARRAY_SIZE(sa_actions));
226 }
227 /** @} */
228 
229 /**
230  * @name XFRM SP Flags Translations
231  * @{
232  */
233 static const struct trans_tbl sp_flags[] = {
234  __ADD(XFRM_POLICY_LOCALOK, allow policy override by user),
235  __ADD(XFRM_POLICY_ICMP, auto include ICMP in policy),
236 };
237 
238 char* xfrmnl_sp_flags2str(int flags, char *buf, size_t len)
239 {
240  return __flags2str (flags, buf, len, sp_flags, ARRAY_SIZE(sp_flags));
241 }
242 
243 int xfrmnl_sp_str2flag(const char *name)
244 {
245  return __str2flags(name, sp_flags, ARRAY_SIZE(sp_flags));
246 }
247 /** @} */
248 
249 /**
250  * @name XFRM SP Type Translations
251  * @{
252  */
253 static const struct trans_tbl sp_types[] = {
254  __ADD(XFRM_POLICY_TYPE_MAIN, main),
255  __ADD(XFRM_POLICY_TYPE_SUB, sub),
256  __ADD(XFRM_POLICY_TYPE_MAX, max),
257  __ADD(XFRM_POLICY_TYPE_ANY, any),
258 };
259 
260 char* xfrmnl_sp_type2str(int type, char *buf, size_t len)
261 {
262  return __type2str(type, buf, len, sp_types, ARRAY_SIZE(sp_types));
263 }
264 
265 int xfrmnl_sp_str2type(const char *name)
266 {
267  return __str2type(name, sp_types, ARRAY_SIZE(sp_types));
268 }
269 /** @} */
270 
271 /**
272  * @name XFRM SP Direction Translations
273  * @{
274  */
275 static const struct trans_tbl sp_dir[] = {
276  __ADD(XFRM_POLICY_IN, in),
277  __ADD(XFRM_POLICY_OUT, out),
278  __ADD(XFRM_POLICY_FWD, fwd),
279  __ADD(XFRM_POLICY_MASK, mask),
280 };
281 
282 char* xfrmnl_sp_dir2str(int dir, char *buf, size_t len)
283 {
284  return __type2str (dir, buf, len, sp_dir, ARRAY_SIZE(sp_dir));
285 }
286 
287 int xfrmnl_sp_str2dir(const char *name)
288 {
289  return __str2type (name, sp_dir, ARRAY_SIZE(sp_dir));
290 }
291 
292 int xfrmnl_sp_index2dir (unsigned int index)
293 {
294  return index & 0x7;
295 }
296 /** @} */
297 
298 /**
299  * @name XFRM SP Share Translations
300  * @{
301  */
302 static const struct trans_tbl sp_share[] = {
303  __ADD(XFRM_SHARE_ANY, any),
304  __ADD(XFRM_SHARE_SESSION, session),
305  __ADD(XFRM_SHARE_USER, user),
306  __ADD(XFRM_SHARE_UNIQUE, unique),
307 };
308 
309 char* xfrmnl_sp_share2str(int share, char *buf, size_t len)
310 {
311  return __type2str (share, buf, len, sp_share, ARRAY_SIZE(sp_share));
312 }
313 
314 int xfrmnl_sp_str2share(const char *name)
315 {
316  return __str2type (name, sp_share, ARRAY_SIZE(sp_share));
317 }
318 /** @} */
319 
320 static void xfrm_sp_dump_line(struct nl_object *a, struct nl_dump_params *p)
321 {
322  struct xfrmnl_sp* sp = (struct xfrmnl_sp *) a;
323  char dir[32], action[32], share[32], flags[32];
324  char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
325  time_t add_time, use_time;
326  struct tm *add_time_tm, *use_time_tm;
327 
328  nl_addr2str(xfrmnl_sel_get_saddr (sp->sel), src, sizeof(src));
329  nl_addr2str (xfrmnl_sel_get_daddr (sp->sel), dst, sizeof (dst));
330  nl_af2str (xfrmnl_sel_get_family (sp->sel), dir, 32);
331  nl_dump_line(p, "src %s dst %s family: %s\n", src, dst, dir);
332  nl_dump_line (p, "src port/mask: %d/%d dst port/mask: %d/%d\n",
333  xfrmnl_sel_get_dport (sp->sel), xfrmnl_sel_get_dportmask (sp->sel),
334  xfrmnl_sel_get_sport (sp->sel), xfrmnl_sel_get_sportmask (sp->sel));
335  nl_dump_line (p, "protocol: %s ifindex: %u uid: %u\n",
336  nl_ip_proto2str (xfrmnl_sel_get_proto (sp->sel), dir, sizeof(dir)),
337  xfrmnl_sel_get_ifindex (sp->sel),
338  xfrmnl_sel_get_userid (sp->sel));
339 
340  xfrmnl_sp_dir2str (sp->dir, dir, 32);
341  xfrmnl_sp_action2str (sp->action, action, 32);
342  xfrmnl_sp_share2str (sp->share, share, 32);
343  xfrmnl_sp_flags2str (sp->flags, flags, 32);
344  nl_dump_line(p, "\tdir: %s action: %s index: %u priority: %u share: %s flags: %s(0x%x) \n",
345  dir, action, sp->index, sp->priority, share, flags, sp->flags);
346 
347  nl_dump_line(p, "\tlifetime configuration: \n");
348  if (sp->lft->soft_byte_limit == XFRM_INF)
349  sprintf (dir, "INF");
350  else
351  sprintf (dir, "%" PRIu64, sp->lft->soft_byte_limit);
352  if (sp->lft->soft_packet_limit == XFRM_INF)
353  sprintf (action, "INF");
354  else
355  sprintf (action, "%" PRIu64, sp->lft->soft_packet_limit);
356  if (sp->lft->hard_byte_limit == XFRM_INF)
357  sprintf (flags, "INF");
358  else
359  sprintf (flags, "%" PRIu64, sp->lft->hard_byte_limit);
360  if (sp->lft->hard_packet_limit == XFRM_INF)
361  sprintf (share, "INF");
362  else
363  sprintf (share, "%" PRIu64, sp->lft->hard_packet_limit);
364  nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets) \n", dir,
365  action);
366  nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets) \n", flags,
367  share);
368  nl_dump_line(
369  p,
370  "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
371  (long long unsigned)sp->lft->soft_add_expires_seconds,
372  (long long unsigned)sp->lft->soft_use_expires_seconds);
373  nl_dump_line(
374  p,
375  "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
376  (long long unsigned)sp->lft->hard_add_expires_seconds,
377  (long long unsigned)sp->lft->hard_use_expires_seconds);
378 
379  nl_dump_line(p, "\tlifetime current: \n");
380  nl_dump_line(p, "\t\t%llu bytes, %llu packets\n",
381  (long long unsigned)sp->curlft.bytes,
382  (long long unsigned)sp->curlft.packets);
383 
384  if (sp->curlft.add_time != 0)
385  {
386  add_time = sp->curlft.add_time;
387  add_time_tm = gmtime (&add_time);
388  strftime (dst, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", add_time_tm);
389  }
390  else
391  {
392  sprintf (dst, "%s", "-");
393  }
394 
395  if (sp->curlft.use_time != 0)
396  {
397  use_time = sp->curlft.use_time;
398  use_time_tm = gmtime (&use_time);
399  strftime (src, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", use_time_tm);
400  }
401  else
402  {
403  sprintf (src, "%s", "-");
404  }
405  nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", dst, src);
406 
407  if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
408  {
409  nl_dump_line(p, "\tUser security context: \n");
410  nl_dump_line(p, "\t\tlen: %d exttype: %d Algo: %d DOI: %d ctxlen: %d\n",
411  sp->sec_ctx->len, sp->sec_ctx->exttype,
412  sp->sec_ctx->ctx_alg, sp->sec_ctx->ctx_doi, sp->sec_ctx->ctx_len);
413  nl_dump_line (p, "\t\tctx: %s \n", sp->sec_ctx->ctx);
414  }
415 
416  xfrmnl_sp_type2str (sp->uptype.type, flags, 32);
417  if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
418  nl_dump_line(p, "\tUser policy type: %s\n", flags);
419 
420  if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
421  {
422  struct xfrmnl_user_tmpl* utmpl;
423 
424  nl_dump_line(p, "\tUser template: \n");
425 
426  nl_list_for_each_entry(utmpl, &sp->usertmpl_list, utmpl_list)
427  xfrmnl_user_tmpl_dump (utmpl, p);
428  }
429 
430  if (sp->ce_mask & XFRM_SP_ATTR_MARK)
431  nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sp->mark.m, sp->mark.v);
432 
433  nl_dump(p, "\n");
434 }
435 
436 static void xfrm_sp_dump_details(struct nl_object *a, struct nl_dump_params *p)
437 {
438  xfrm_sp_dump_line(a, p);
439 }
440 
441 static void xfrm_sp_dump_stats(struct nl_object *a, struct nl_dump_params *p)
442 {
443  xfrm_sp_dump_details(a, p);
444 
445  return;
446 }
447 
448 /**
449  * @name XFRM SP Object Allocation/Freeage
450  * @{
451  */
452 
453 struct xfrmnl_sp* xfrmnl_sp_alloc(void)
454 {
455  return (struct xfrmnl_sp*) nl_object_alloc(&xfrm_sp_obj_ops);
456 }
457 
458 void xfrmnl_sp_put(struct xfrmnl_sp* sp)
459 {
460  nl_object_put((struct nl_object *) sp);
461 }
462 
463 /** @} */
464 
465 /**
466  * @name SP Cache Managament
467  * @{
468  */
469 
470 /**
471  * Build a SP cache including all SPs currently configured in the kernel.
472  * @arg sock Netlink socket.
473  * @arg result Pointer to store resulting cache.
474  *
475  * Allocates a new SP cache, initializes it properly and updates it
476  * to include all SPs currently configured in the kernel.
477  *
478  * @return 0 on success or a negative error code.
479  */
480 int xfrmnl_sp_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
481 {
482  return nl_cache_alloc_and_fill(&xfrmnl_sp_ops, sock, result);
483 }
484 
485 /**
486  * Look up a SP by policy id and direction
487  * @arg cache SP cache
488  * @arg index Policy Id
489  * @arg dir direction
490  * @return sp handle or NULL if no match was found.
491  */
492 struct xfrmnl_sp* xfrmnl_sp_get(struct nl_cache* cache, unsigned int index, unsigned int dir)
493 {
494  struct xfrmnl_sp *sp;
495 
496  //nl_list_for_each_entry(sp, &cache->c_items, ce_list) {
497  for (sp = (struct xfrmnl_sp*)nl_cache_get_first (cache);
498  sp != NULL;
499  sp = (struct xfrmnl_sp*)nl_cache_get_next ((struct nl_object*)sp))
500  {
501  if (sp->index == index && sp->dir == dir)
502  {
503  nl_object_get((struct nl_object *) sp);
504  return sp;
505  }
506  }
507 
508  return NULL;
509 }
510 
511 
512 /** @} */
513 
514 
515 static struct nla_policy xfrm_sp_policy[XFRMA_MAX+1] = {
516  [XFRMA_POLICY] = { .minlen = sizeof(struct xfrm_userpolicy_info)},
517  [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
518  [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
519  [XFRMA_POLICY_TYPE] = { .minlen = sizeof(struct xfrm_userpolicy_type)},
520  [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
521 };
522 
523 static int xfrm_sp_request_update(struct nl_cache *c, struct nl_sock *h)
524 {
525  return nl_send_simple (h, XFRM_MSG_GETPOLICY, NLM_F_DUMP, NULL, 0);
526 }
527 
528 int xfrmnl_sp_parse(struct nlmsghdr *n, struct xfrmnl_sp **result)
529 {
530  struct xfrmnl_sp *sp;
531  struct nlattr *tb[XFRMA_MAX + 1];
532  struct xfrm_userpolicy_info *sp_info;
533  int len, err;
534  struct nl_addr* addr;
535 
536  sp = xfrmnl_sp_alloc();
537  if (!sp) {
538  err = -NLE_NOMEM;
539  goto errout;
540  }
541 
542  sp->ce_msgtype = n->nlmsg_type;
543  if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
544  {
545  sp_info = (struct xfrm_userpolicy_info*)((char *)nlmsg_data(n) + sizeof (struct xfrm_userpolicy_id) + NLA_HDRLEN);
546  }
547  else
548  {
549  sp_info = nlmsg_data(n);
550  }
551 
552  err = nlmsg_parse(n, sizeof(struct xfrm_userpolicy_info), tb, XFRMA_MAX, xfrm_sp_policy);
553  if (err < 0)
554  {
555  printf ("parse error: %d \n", err);
556  goto errout;
557  }
558 
559  if (sp_info->sel.family == AF_INET)
560  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a4, sizeof (sp_info->sel.daddr.a4));
561  else
562  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a6, sizeof (sp_info->sel.daddr.a6));
563  nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_d);
564  xfrmnl_sel_set_daddr (sp->sel, addr);
565  xfrmnl_sel_set_prefixlen_d (sp->sel, sp_info->sel.prefixlen_d);
566 
567  if (sp_info->sel.family == AF_INET)
568  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a4, sizeof (sp_info->sel.saddr.a4));
569  else
570  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a6, sizeof (sp_info->sel.saddr.a6));
571  nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_s);
572  xfrmnl_sel_set_saddr (sp->sel, addr);
573  xfrmnl_sel_set_prefixlen_s (sp->sel, sp_info->sel.prefixlen_s);
574 
575  xfrmnl_sel_set_dport (sp->sel, ntohs (sp_info->sel.dport));
576  xfrmnl_sel_set_dportmask (sp->sel, ntohs (sp_info->sel.dport_mask));
577  xfrmnl_sel_set_sport (sp->sel, ntohs (sp_info->sel.sport));
578  xfrmnl_sel_set_sportmask (sp->sel, ntohs (sp_info->sel.sport_mask));
579  xfrmnl_sel_set_family (sp->sel, sp_info->sel.family);
580  xfrmnl_sel_set_proto (sp->sel, sp_info->sel.proto);
581  xfrmnl_sel_set_ifindex (sp->sel, sp_info->sel.ifindex);
582  xfrmnl_sel_set_userid (sp->sel, sp_info->sel.user);
583  sp->ce_mask |= XFRM_SP_ATTR_SEL;
584 
585  sp->lft->soft_byte_limit = sp_info->lft.soft_byte_limit;
586  sp->lft->hard_byte_limit = sp_info->lft.hard_byte_limit;
587  sp->lft->soft_packet_limit = sp_info->lft.soft_packet_limit;
588  sp->lft->hard_packet_limit = sp_info->lft.hard_packet_limit;
589  sp->lft->soft_add_expires_seconds = sp_info->lft.soft_add_expires_seconds;
590  sp->lft->hard_add_expires_seconds = sp_info->lft.hard_add_expires_seconds;
591  sp->lft->soft_use_expires_seconds = sp_info->lft.soft_use_expires_seconds;
592  sp->lft->hard_use_expires_seconds = sp_info->lft.hard_use_expires_seconds;
593  sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
594 
595  sp->curlft.bytes = sp_info->curlft.bytes;
596  sp->curlft.packets = sp_info->curlft.packets;
597  sp->curlft.add_time = sp_info->curlft.add_time;
598  sp->curlft.use_time = sp_info->curlft.use_time;
599  sp->ce_mask |= XFRM_SP_ATTR_LTIME_CUR;
600 
601  sp->priority = sp_info->priority;
602  sp->index = sp_info->index;
603  sp->dir = sp_info->dir;
604  sp->action = sp_info->action;
605  sp->flags = sp_info->flags;
606  sp->share = sp_info->share;
607  sp->ce_mask |= (XFRM_SP_ATTR_PRIO | XFRM_SP_ATTR_INDEX |
608  XFRM_SP_ATTR_DIR | XFRM_SP_ATTR_ACTION |
609  XFRM_SP_ATTR_FLAGS | XFRM_SP_ATTR_SHARE);
610 
611  if (tb[XFRMA_SEC_CTX]) {
612  struct xfrm_user_sec_ctx* ctx = nla_data(tb[XFRMA_SEC_CTX]);
613  len = sizeof (struct xfrmnl_user_sec_ctx) + ctx->ctx_len;
614  if ((sp->sec_ctx = calloc (1, len)) == NULL)
615  {
616  err = -NLE_NOMEM;
617  goto errout;
618  }
619  memcpy ((void *)sp->sec_ctx, (void *)ctx, len);
620  sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
621  }
622 
623  if (tb[XFRMA_POLICY_TYPE]) {
624  struct xfrm_userpolicy_type* up = nla_data(tb[XFRMA_POLICY_TYPE]);
625  memcpy ((void *)&sp->uptype, (void *)up, sizeof (struct xfrm_userpolicy_type));
626  sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
627  }
628 
629  if (tb[XFRMA_TMPL]) {
630  struct xfrm_user_tmpl* tmpl = nla_data(tb[XFRMA_TMPL]);
631  struct xfrmnl_user_tmpl* sputmpl;
632  uint32_t i;
633  uint32_t num_tmpls = nla_len(tb[XFRMA_TMPL]) / sizeof (*tmpl);
634  struct nl_addr* addr;
635 
636  for (i = 0; (i < num_tmpls) && (tmpl); i ++, tmpl++)
637  {
638  if ((sputmpl = xfrmnl_user_tmpl_alloc ()) == NULL)
639  {
640  err = -NLE_NOMEM;
641  goto errout;
642  }
643 
644  if (tmpl->family == AF_INET)
645  addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a4, sizeof (tmpl->id.daddr.a4));
646  else
647  addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a6, sizeof (tmpl->id.daddr.a6));
648  xfrmnl_user_tmpl_set_daddr (sputmpl, addr);
649  xfrmnl_user_tmpl_set_spi (sputmpl, ntohl(tmpl->id.spi));
650  xfrmnl_user_tmpl_set_proto (sputmpl, tmpl->id.proto);
651  xfrmnl_user_tmpl_set_family (sputmpl, tmpl->family);
652 
653  if (tmpl->family == AF_INET)
654  addr = nl_addr_build(tmpl->family, &tmpl->saddr.a4, sizeof (tmpl->saddr.a4));
655  else
656  addr = nl_addr_build(tmpl->family, &tmpl->saddr.a6, sizeof (tmpl->saddr.a6));
657  xfrmnl_user_tmpl_set_saddr (sputmpl, addr);
658 
659  xfrmnl_user_tmpl_set_reqid (sputmpl, tmpl->reqid);
660  xfrmnl_user_tmpl_set_mode (sputmpl, tmpl->mode);
661  xfrmnl_user_tmpl_set_share (sputmpl, tmpl->share);
662  xfrmnl_user_tmpl_set_optional (sputmpl, tmpl->optional);
663  xfrmnl_user_tmpl_set_aalgos (sputmpl, tmpl->aalgos);
664  xfrmnl_user_tmpl_set_ealgos (sputmpl, tmpl->ealgos);
665  xfrmnl_user_tmpl_set_calgos (sputmpl, tmpl->calgos);
666  xfrmnl_sp_add_usertemplate (sp, sputmpl);
667 
668  sp->ce_mask |= XFRM_SP_ATTR_TMPL;
669  }
670  }
671 
672  if (tb[XFRMA_MARK]) {
673  struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
674  sp->mark.m = m->m;
675  sp->mark.v = m->v;
676  sp->ce_mask |= XFRM_SP_ATTR_MARK;
677  }
678 
679  *result = sp;
680  return 0;
681 
682 errout:
683  xfrmnl_sp_put(sp);
684  return err;
685 }
686 
687 static int xfrm_sp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
688  struct nlmsghdr *n, struct nl_parser_param *pp)
689 {
690  struct xfrmnl_sp* sp;
691  int err;
692 
693  if ((err = xfrmnl_sp_parse(n, &sp)) < 0)
694  {
695  printf ("received error: %d \n", err);
696  return err;
697  }
698 
699  err = pp->pp_cb((struct nl_object *) sp, pp);
700 
701  xfrmnl_sp_put(sp);
702  return err;
703 }
704 
705 /**
706  * @name XFRM SP Get
707  * @{
708  */
709 
710 int xfrmnl_sp_build_get_request(unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
711 {
712  struct nl_msg *msg;
713  struct xfrm_userpolicy_id spid;
714  struct xfrm_mark mark;
715 
716  memset(&spid, 0, sizeof(spid));
717  spid.index = index;
718  spid.dir = dir;
719 
720  if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETPOLICY, 0)))
721  return -NLE_NOMEM;
722 
723  if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
724  goto nla_put_failure;
725 
726  if ((mark_m & mark_v) != 0)
727  {
728  memset(&mark, 0, sizeof(struct xfrm_mark));
729  mark.m = mark_m;
730  mark.v = mark_v;
731 
732  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
733  }
734 
735  *result = msg;
736  return 0;
737 
738 nla_put_failure:
739  nlmsg_free(msg);
740  return -NLE_MSGSIZE;
741 }
742 
743 int xfrmnl_sp_get_kernel(struct nl_sock* sock, unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sp** result)
744 {
745  struct nl_msg *msg = NULL;
746  struct nl_object *obj;
747  int err;
748 
749  if ((err = xfrmnl_sp_build_get_request(index, dir, mark_m, mark_v, &msg)) < 0)
750  return err;
751 
752  err = nl_send_auto(sock, msg);
753  nlmsg_free(msg);
754  if (err < 0)
755  return err;
756 
757  if ((err = nl_pickup(sock, &xfrm_sp_msg_parser, &obj)) < 0)
758  return err;
759 
760  /* We have used xfrm_sp_msg_parser(), object is definitely a xfrm ae */
761  *result = (struct xfrmnl_sp *) obj;
762 
763  /* If an object has been returned, we also need to wait for the ACK */
764  if (err == 0 && obj)
765  nl_wait_for_ack(sock);
766 
767  return 0;
768 }
769 
770 /** @} */
771 
772 static int build_xfrm_sp_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
773 {
774  struct nl_msg* msg;
775  struct xfrm_userpolicy_info sp_info;
776  uint32_t len;
777  struct nl_addr* addr;
778 
779  if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
780  (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
781  !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
782  return -NLE_MISSING_ATTR;
783 
784  memset ((void*)&sp_info, 0, sizeof (sp_info));
785  if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
786  {
787  addr = xfrmnl_sel_get_daddr (tmpl->sel);
788  memcpy ((void*)&sp_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
789  addr = xfrmnl_sel_get_saddr (tmpl->sel);
790  memcpy ((void*)&sp_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
791  sp_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
792  sp_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
793  sp_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
794  sp_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
795  sp_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
796  sp_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
797  sp_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
798  sp_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
799  sp_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
800  sp_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
801  }
802 
803  if (tmpl->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
804  {
805  sp_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
806  sp_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
807  sp_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
808  sp_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
809  sp_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
810  sp_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
811  sp_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
812  sp_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
813  }
814 
815  //Skip current lifetime: cur lifetime can be updated only via AE
816 
817  if (tmpl->ce_mask & XFRM_SP_ATTR_PRIO)
818  sp_info.priority = tmpl->priority;
819 
820  if (tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
821  sp_info.index = tmpl->index;
822 
823  if (tmpl->ce_mask & XFRM_SP_ATTR_DIR)
824  sp_info.dir = tmpl->dir;
825 
826  if (tmpl->ce_mask & XFRM_SP_ATTR_ACTION)
827  sp_info.action = tmpl->action;
828 
829  if (tmpl->ce_mask & XFRM_SP_ATTR_FLAGS)
830  sp_info.flags = tmpl->flags;
831 
832  if (tmpl->ce_mask & XFRM_SP_ATTR_SHARE)
833  sp_info.share = tmpl->share;
834 
835  msg = nlmsg_alloc_simple(cmd, flags);
836  if (!msg)
837  return -NLE_NOMEM;
838 
839  if (nlmsg_append(msg, &sp_info, sizeof(sp_info), NLMSG_ALIGNTO) < 0)
840  goto nla_put_failure;
841 
842  if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
843  len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
844  NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
845  }
846 
847  if (tmpl->ce_mask & XFRM_SP_ATTR_POLTYPE) {
848  len = sizeof (struct xfrm_userpolicy_type);
849  NLA_PUT (msg, XFRMA_POLICY_TYPE, len, &tmpl->uptype);
850  }
851 
852  if (tmpl->ce_mask & XFRM_SP_ATTR_TMPL) {
853  struct nlattr* tmpls;
854  struct xfrmnl_user_tmpl* utmpl;
855  struct nl_addr* addr;
856 
857  if (!(tmpls = nla_nest_start(msg, XFRMA_TMPL)))
858  goto nla_put_failure;
859 
860  nl_list_for_each_entry(utmpl, &tmpl->usertmpl_list, utmpl_list) {
861  struct xfrm_user_tmpl* tmpl;
862 
863  tmpl = nlmsg_reserve(msg, sizeof(*tmpl), NLMSG_ALIGNTO);
864  if (!tmpl)
865  goto nla_put_failure;
866  addr = xfrmnl_user_tmpl_get_daddr (utmpl);
867  memcpy ((void *)&tmpl->id.daddr, nl_addr_get_binary_addr (addr),
868  nl_addr_get_len (addr));
869  tmpl->id.spi = htonl(xfrmnl_user_tmpl_get_spi (utmpl));
870  tmpl->id.proto = xfrmnl_user_tmpl_get_proto (utmpl);
871  tmpl->family = xfrmnl_user_tmpl_get_family (utmpl);
872  addr = xfrmnl_user_tmpl_get_saddr (utmpl);
873  memcpy ((void *)&tmpl->saddr, nl_addr_get_binary_addr (addr),
874  nl_addr_get_len (addr));
875  tmpl->reqid = xfrmnl_user_tmpl_get_reqid (utmpl);
876  tmpl->mode = xfrmnl_user_tmpl_get_mode (utmpl);
877  tmpl->share = xfrmnl_user_tmpl_get_share (utmpl);
878  tmpl->optional = xfrmnl_user_tmpl_get_optional (utmpl);
879  tmpl->aalgos = xfrmnl_user_tmpl_get_aalgos (utmpl);
880  tmpl->ealgos = xfrmnl_user_tmpl_get_ealgos (utmpl);
881  tmpl->calgos = xfrmnl_user_tmpl_get_calgos (utmpl);
882  }
883  nla_nest_end(msg, tmpls);
884  }
885 
886  if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
887  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
888  }
889 
890  *result = msg;
891  return 0;
892 
893 nla_put_failure:
894  nlmsg_free(msg);
895  return -NLE_MSGSIZE;
896 }
897 
898 /**
899  * @name XFRM SP Add
900  * @{
901  */
902 
903 int xfrmnl_sp_build_add_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
904 {
905  return build_xfrm_sp_message (tmpl, XFRM_MSG_NEWPOLICY, flags, result);
906 }
907 
908 int xfrmnl_sp_add(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
909 {
910  int err;
911  struct nl_msg *msg;
912 
913  if ((err = xfrmnl_sp_build_add_request(tmpl, flags, &msg)) < 0)
914  return err;
915 
916  err = nl_send_auto_complete(sk, msg);
917  nlmsg_free(msg);
918  if (err < 0)
919  return err;
920 
921  return nl_wait_for_ack(sk);
922 }
923 
924 /**
925  * @name XFRM SP Update
926  * @{
927  */
928 
929 int xfrmnl_sp_build_update_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
930 {
931  return build_xfrm_sp_message (tmpl, XFRM_MSG_UPDPOLICY, flags, result);
932 }
933 
934 int xfrmnl_sp_update(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
935 {
936  int err;
937  struct nl_msg *msg;
938 
939  if ((err = xfrmnl_sp_build_update_request(tmpl, flags, &msg)) < 0)
940  return err;
941 
942  err = nl_send_auto_complete(sk, msg);
943  nlmsg_free(msg);
944  if (err < 0)
945  return err;
946 
947  return nl_wait_for_ack(sk);
948 }
949 
950 /** @} */
951 
952 /**
953  * \brief Builds a xfrm_sp_delete_message. Uses either index and direction
954  * or security-context (not set is a valid value), selector and
955  * direction for identification.
956  * Returns error if necessary values aren't set.
957  *
958  * \param tmpl The policy template.
959  * \param cmd The command. Should be XFRM_MSG_DELPOLICY.
960  * \param flags Additional flags
961  * \param result Resulting message.
962  *
963  * \return 0 if successful, else error value < 0
964  */
965 static int build_xfrm_sp_delete_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
966 {
967  struct nl_msg* msg;
968  struct xfrm_userpolicy_id spid;
969  struct nl_addr* addr;
970  uint32_t len;
971 
972  if (!(tmpl->ce_mask & XFRM_SP_ATTR_DIR) ||
973  (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) &&
974  !(tmpl->ce_mask & XFRM_SP_ATTR_SEL)))
975  return -NLE_MISSING_ATTR;
976 
977  memset(&spid, 0, sizeof(spid));
978  spid.dir = tmpl->dir;
979  if(tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
980  spid.index = tmpl->index;
981 
982  if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
983  {
984  addr = xfrmnl_sel_get_daddr (tmpl->sel);
985  memcpy ((void*)&spid.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
986  addr = xfrmnl_sel_get_saddr (tmpl->sel);
987  memcpy ((void*)&spid.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
988  spid.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
989  spid.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
990  spid.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
991  spid.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
992  spid.sel.family = xfrmnl_sel_get_family (tmpl->sel);
993  spid.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
994  spid.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
995  spid.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
996  spid.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
997  spid.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
998  }
999 
1000  msg = nlmsg_alloc_simple(cmd, flags);
1001  if (!msg)
1002  return -NLE_NOMEM;
1003 
1004  if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
1005  goto nla_put_failure;
1006 
1007  if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
1008  len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
1009  NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
1010  }
1011 
1012  if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
1013  len = sizeof (struct xfrm_mark);
1014  NLA_PUT (msg, XFRMA_MARK, len, &tmpl->mark);
1015  }
1016 
1017  *result = msg;
1018  return 0;
1019 
1020 nla_put_failure:
1021  nlmsg_free(msg);
1022  return -NLE_MSGSIZE;
1023 }
1024 
1025 /**
1026  * @name XFRM SA Delete
1027  * @{
1028  */
1029 
1030 int xfrmnl_sp_build_delete_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
1031 {
1032  return build_xfrm_sp_delete_message (tmpl, XFRM_MSG_DELPOLICY, flags, result);
1033 }
1034 
1035 int xfrmnl_sp_delete(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
1036 {
1037  int err;
1038  struct nl_msg *msg;
1039 
1040  if ((err = xfrmnl_sp_build_delete_request(tmpl, flags, &msg)) < 0)
1041  return err;
1042 
1043  err = nl_send_auto_complete(sk, msg);
1044  nlmsg_free(msg);
1045  if (err < 0)
1046  return err;
1047 
1048  return nl_wait_for_ack(sk);
1049 }
1050 
1051 /** @} */
1052 
1053 
1054 /**
1055  * @name Attributes
1056  * @{
1057  */
1058 
1059 struct xfrmnl_sel* xfrmnl_sp_get_sel (struct xfrmnl_sp* sp)
1060 {
1061  if (sp->ce_mask & XFRM_SP_ATTR_SEL)
1062  return sp->sel;
1063  else
1064  return NULL;
1065 }
1066 
1067 int xfrmnl_sp_set_sel (struct xfrmnl_sp* sp, struct xfrmnl_sel* sel)
1068 {
1069  /* Release any previously held selector object from the SP */
1070  if (sp->sel)
1071  xfrmnl_sel_put (sp->sel);
1072 
1073  /* Increment ref count on new selector and save it in the SP */
1074  xfrmnl_sel_get (sel);
1075  sp->sel = sel;
1076  sp->ce_mask |= XFRM_SP_ATTR_SEL;
1077 
1078  return 0;
1079 }
1080 
1081 struct xfrmnl_ltime_cfg* xfrmnl_sp_get_lifetime_cfg (struct xfrmnl_sp* sp)
1082 {
1083  if (sp->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
1084  return sp->lft;
1085  else
1086  return NULL;
1087 }
1088 
1089 int xfrmnl_sp_set_lifetime_cfg (struct xfrmnl_sp* sp, struct xfrmnl_ltime_cfg* ltime)
1090 {
1091  /* Release any previously held lifetime cfg object from the SP */
1092  if (sp->lft)
1093  xfrmnl_ltime_cfg_put (sp->lft);
1094 
1095  /* Increment ref count on new lifetime object and save it in the SP */
1096  xfrmnl_ltime_cfg_get (ltime);
1097  sp->lft = ltime;
1098  sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
1099 
1100  return 0;
1101 }
1102 
1103 int xfrmnl_sp_get_curlifetime (struct xfrmnl_sp* sp, unsigned long long int* curr_bytes,
1104  unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1105 {
1106  if (sp == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1107  return -1;
1108 
1109  *curr_bytes = sp->curlft.bytes;
1110  *curr_packets = sp->curlft.packets;
1111  *curr_add_time = sp->curlft.add_time;
1112  *curr_use_time = sp->curlft.use_time;
1113 
1114  return 0;
1115 }
1116 
1117 int xfrmnl_sp_get_priority (struct xfrmnl_sp* sp)
1118 {
1119  if (sp->ce_mask & XFRM_SP_ATTR_PRIO)
1120  return sp->priority;
1121  else
1122  return -1;
1123 }
1124 
1125 int xfrmnl_sp_set_priority (struct xfrmnl_sp* sp, unsigned int prio)
1126 {
1127  sp->priority = prio;
1128  sp->ce_mask |= XFRM_SP_ATTR_PRIO;
1129 
1130  return 0;
1131 }
1132 
1133 int xfrmnl_sp_get_index (struct xfrmnl_sp* sp)
1134 {
1135  if (sp->ce_mask & XFRM_SP_ATTR_INDEX)
1136  return sp->index;
1137  else
1138  return -1;
1139 }
1140 
1141 int xfrmnl_sp_set_index (struct xfrmnl_sp* sp, unsigned int index)
1142 {
1143  sp->index = index;
1144  sp->ce_mask |= XFRM_SP_ATTR_INDEX;
1145 
1146  return 0;
1147 }
1148 
1149 int xfrmnl_sp_get_dir (struct xfrmnl_sp* sp)
1150 {
1151  if (sp->ce_mask & XFRM_SP_ATTR_DIR)
1152  return sp->dir;
1153  else
1154  return -1;
1155 }
1156 
1157 int xfrmnl_sp_set_dir (struct xfrmnl_sp* sp, unsigned int dir)
1158 {
1159  sp->dir = dir;
1160  sp->ce_mask |= XFRM_SP_ATTR_DIR;
1161 
1162  return 0;
1163 }
1164 
1165 int xfrmnl_sp_get_action (struct xfrmnl_sp* sp)
1166 {
1167  if (sp->ce_mask & XFRM_SP_ATTR_ACTION)
1168  return sp->action;
1169  else
1170  return -1;
1171 }
1172 
1173 int xfrmnl_sp_set_action (struct xfrmnl_sp* sp, unsigned int action)
1174 {
1175  sp->action = action;
1176  sp->ce_mask |= XFRM_SP_ATTR_ACTION;
1177 
1178  return 0;
1179 }
1180 
1181 int xfrmnl_sp_get_flags (struct xfrmnl_sp* sp)
1182 {
1183  if (sp->ce_mask & XFRM_SP_ATTR_FLAGS)
1184  return sp->flags;
1185  else
1186  return -1;
1187 }
1188 
1189 int xfrmnl_sp_set_flags (struct xfrmnl_sp* sp, unsigned int flags)
1190 {
1191  sp->flags = flags;
1192  sp->ce_mask |= XFRM_SP_ATTR_FLAGS;
1193 
1194  return 0;
1195 }
1196 
1197 int xfrmnl_sp_get_share (struct xfrmnl_sp* sp)
1198 {
1199  if (sp->ce_mask & XFRM_SP_ATTR_SHARE)
1200  return sp->share;
1201  else
1202  return -1;
1203 }
1204 
1205 int xfrmnl_sp_set_share (struct xfrmnl_sp* sp, unsigned int share)
1206 {
1207  sp->share = share;
1208  sp->ce_mask |= XFRM_SP_ATTR_SHARE;
1209 
1210  return 0;
1211 }
1212 
1213 /**
1214  * Get the security context.
1215  *
1216  * @arg sp The xfrmnl_sp object.
1217  * @arg len An optional output value for the ctx_str length including the xfrmnl_sp header.
1218  * @arg exttype An optional output value.
1219  * @arg alg An optional output value for the security context algorithm.
1220  * @arg doi An optional output value for the security context domain of interpretation.
1221  * @arg ctx_len An optional output value for the security context length, including the
1222  * terminating null byte ('\0').
1223  * @arg ctx_str An optional buffer large enough for the security context string. It must
1224  * contain at least @ctx_len bytes. You are advised to create the ctx_str
1225  * buffer one element larger and ensure NUL termination yourself.
1226  *
1227  * Warning: you must ensure that @ctx_str is large enough. If you don't know the length before-hand,
1228  * call xfrmnl_sp_get_sec_ctx() without @ctx_str argument to query only the required buffer size.
1229  * This modified API is available in all versions of libnl3 that support the capability
1230  * @def NL_CAPABILITY_XFRM_SP_SEC_CTX_LEN (@see nl_has_capability for further information).
1231  *
1232  * @return 0 on success or a negative error code.
1233  */
1234 int xfrmnl_sp_get_sec_ctx (struct xfrmnl_sp* sp, unsigned int* len, unsigned int* exttype, unsigned int* alg, unsigned int* doi, unsigned int* ctx_len, char* ctx_str)
1235 {
1236  if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
1237  {
1238  if (len)
1239  *len = sizeof (struct xfrmnl_user_sec_ctx) + sp->sec_ctx->ctx_len;
1240  if (exttype)
1241  *exttype = sp->sec_ctx->exttype;
1242  if (alg)
1243  *alg = sp->sec_ctx->ctx_alg;
1244  if (doi)
1245  *doi = sp->sec_ctx->ctx_doi;
1246  if (ctx_len)
1247  *ctx_len = sp->sec_ctx->ctx_len;
1248  if (ctx_str)
1249  memcpy ((void *)ctx_str, (void *)sp->sec_ctx->ctx, sp->sec_ctx->ctx_len);
1250  }
1251  else
1252  return -1;
1253 
1254  return 0;
1255 }
1256 /**
1257  * @brief Set security context (ctx_str) for XFRM Polixy.
1258  *
1259  * @param sp XFRM Policy
1260  * @param len !!! depricated unused parameter !!!
1261  * @param exttype netlink message attribute - probably XFRMA_SEC_CTX
1262  * @param alg security context algorithm
1263  * @param doi security context domain interpretation
1264  * @param ctx_len Length of the context string.
1265  * @param ctx_str The context string.
1266  *
1267  * @return 0 if sucessfull, else -1
1268  */
1269 int xfrmnl_sp_set_sec_ctx (struct xfrmnl_sp* sp, unsigned int len __attribute__((unused)), unsigned int exttype, unsigned int alg, unsigned int doi, unsigned int ctx_len, char* ctx_str)
1270 {
1271  /* Free up the old context string and allocate new one */
1272  if (sp->sec_ctx)
1273  free (sp->sec_ctx);
1274  if ((sp->sec_ctx = calloc (1, sizeof (struct xfrmnl_user_sec_ctx) + 1 + ctx_len)) == NULL)
1275  return -1;
1276 
1277  /* Save the new info */
1278  sp->sec_ctx->len = sizeof (struct xfrmnl_user_sec_ctx) + ctx_len;
1279  sp->sec_ctx->exttype = exttype;
1280  sp->sec_ctx->ctx_alg = alg;
1281  sp->sec_ctx->ctx_doi = doi;
1282  sp->sec_ctx->ctx_len = ctx_len;
1283  memcpy ((void *)sp->sec_ctx->ctx, (void *)ctx_str, ctx_len);
1284  sp->sec_ctx->ctx[ctx_len] = '\0';
1285 
1286  sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
1287 
1288  return 0;
1289 }
1290 
1291 int xfrmnl_sp_get_userpolicy_type (struct xfrmnl_sp* sp)
1292 {
1293  if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
1294  return sp->uptype.type;
1295  else
1296  return -1;
1297 }
1298 
1299 int xfrmnl_sp_set_userpolicy_type (struct xfrmnl_sp* sp, unsigned int type)
1300 {
1301  sp->uptype.type = type;
1302  sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
1303 
1304  return 0;
1305 }
1306 
1307 void xfrmnl_sp_add_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1308 {
1309  nl_list_add_tail(&utmpl->utmpl_list, &sp->usertmpl_list);
1310  sp->nr_user_tmpl++;
1311  sp->ce_mask |= XFRM_SP_ATTR_TMPL;
1312 }
1313 
1314 void xfrmnl_sp_remove_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1315 {
1316  if (sp->ce_mask & XFRM_SP_ATTR_TMPL) {
1317  sp->nr_user_tmpl--;
1318  nl_list_del(&utmpl->utmpl_list);
1319  }
1320 }
1321 
1322 struct nl_list_head *xfrmnl_sp_get_usertemplates(struct xfrmnl_sp *sp)
1323 {
1324  if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1325  return &sp->usertmpl_list;
1326 
1327  return NULL;
1328 }
1329 
1330 int xfrmnl_sp_get_nusertemplates(struct xfrmnl_sp *sp)
1331 {
1332  if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1333  return sp->nr_user_tmpl;
1334 
1335  return 0;
1336 }
1337 
1338 void xfrmnl_sp_foreach_usertemplate(struct xfrmnl_sp *r,
1339  void (*cb)(struct xfrmnl_user_tmpl *, void *),
1340  void *arg)
1341 {
1342  struct xfrmnl_user_tmpl *utmpl;
1343 
1344  if (r->ce_mask & XFRM_SP_ATTR_TMPL) {
1345  nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1346  cb(utmpl, arg);
1347  }
1348  }
1349 }
1350 
1351 struct xfrmnl_user_tmpl *xfrmnl_sp_usertemplate_n(struct xfrmnl_sp *r, int n)
1352 {
1353  struct xfrmnl_user_tmpl *utmpl;
1354  uint32_t i;
1355 
1356  if (r->ce_mask & XFRM_SP_ATTR_TMPL && r->nr_user_tmpl > n) {
1357  i = 0;
1358  nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1359  if (i == n) return utmpl;
1360  i++;
1361  }
1362  }
1363  return NULL;
1364 }
1365 
1366 int xfrmnl_sp_get_mark (struct xfrmnl_sp* sp, unsigned int* mark_mask, unsigned int* mark_value)
1367 {
1368  if (mark_mask == NULL || mark_value == NULL)
1369  return -1;
1370 
1371  if (sp->ce_mask & XFRM_SP_ATTR_MARK)
1372  {
1373  *mark_mask = sp->mark.m;
1374  *mark_value = sp->mark.v;
1375 
1376  return 0;
1377  }
1378  else
1379  return -1;
1380 }
1381 
1382 int xfrmnl_sp_set_mark (struct xfrmnl_sp* sp, unsigned int value, unsigned int mask)
1383 {
1384  sp->mark.v = value;
1385  sp->mark.m = mask;
1386  sp->ce_mask |= XFRM_SP_ATTR_MARK;
1387 
1388  return 0;
1389 }
1390 
1391 /** @} */
1392 
1393 static struct nl_object_ops xfrm_sp_obj_ops = {
1394  .oo_name = "xfrm/sp",
1395  .oo_size = sizeof(struct xfrmnl_sp),
1396  .oo_constructor = xfrm_sp_alloc_data,
1397  .oo_free_data = xfrm_sp_free_data,
1398  .oo_clone = xfrm_sp_clone,
1399  .oo_dump = {
1400  [NL_DUMP_LINE] = xfrm_sp_dump_line,
1401  [NL_DUMP_DETAILS] = xfrm_sp_dump_details,
1402  [NL_DUMP_STATS] = xfrm_sp_dump_stats,
1403  },
1404  .oo_compare = xfrm_sp_compare,
1405  .oo_attrs2str = xfrm_sp_attrs2str,
1406  .oo_id_attrs = (XFRM_SP_ATTR_SEL | XFRM_SP_ATTR_INDEX | XFRM_SP_ATTR_DIR),
1407 };
1408 
1409 static struct nl_af_group xfrm_sp_groups[] = {
1410  { AF_UNSPEC, XFRMNLGRP_POLICY },
1411  { END_OF_GROUP_LIST },
1412 };
1413 
1414 static struct nl_cache_ops xfrmnl_sp_ops = {
1415  .co_name = "xfrm/sp",
1416  .co_hdrsize = sizeof(struct xfrm_userpolicy_info),
1417  .co_msgtypes = {
1418  { XFRM_MSG_NEWPOLICY, NL_ACT_NEW, "new" },
1419  { XFRM_MSG_DELPOLICY, NL_ACT_DEL, "del" },
1420  { XFRM_MSG_GETPOLICY, NL_ACT_GET, "get" },
1421  { XFRM_MSG_UPDPOLICY, NL_ACT_NEW, "update" },
1422  END_OF_MSGTYPES_LIST,
1423  },
1424  .co_protocol = NETLINK_XFRM,
1425  .co_groups = xfrm_sp_groups,
1426  .co_request_update = xfrm_sp_request_update,
1427  .co_msg_parser = xfrm_sp_msg_parser,
1428  .co_obj_ops = &xfrm_sp_obj_ops,
1429 };
1430 
1431 /**
1432  * @name XFRM SA Cache Managament
1433  * @{
1434  */
1435 
1436 static void __attribute__ ((constructor)) xfrm_sp_init(void)
1437 {
1438  nl_cache_mngt_register(&xfrmnl_sp_ops);
1439 }
1440 
1441 static void __attribute__ ((destructor)) xfrm_sp_exit(void)
1442 {
1443  nl_cache_mngt_unregister(&xfrmnl_sp_ops);
1444 }
1445 
1446 /** @} */
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:76
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:162
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:156
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:78
int xfrmnl_user_tmpl_cmp(struct xfrmnl_user_tmpl *a, struct xfrmnl_user_tmpl *b)
Compares two user template objects.
Definition: template.c:144
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:97
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_clone(struct xfrmnl_user_tmpl *utmpl)
Clone existing user template object.
Definition: template.c:91
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_alloc()
Allocate new user template object.
Definition: template.c:72
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:95
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:935
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:993
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:959
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:211
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:947
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:159
struct nlattr * nla_nest_start(struct nl_msg *msg, int attrtype)
Start a new level of nested attributes.
Definition: attr.c:895
int nla_len(const struct nlattr *nla)
Return length of the payload .
Definition: attr.c:125
int nla_nest_end(struct nl_msg *msg, struct nlattr *start)
Finalize nesting of attributes.
Definition: attr.c:958
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:114
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:281
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:246
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:140
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:114
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:228
void * nlmsg_reserve(struct nl_msg *n, size_t len, int pad)
Reserve room for additional data in a netlink message.
Definition: msg.c:404
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:341
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:558
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, const struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:208
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:442
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:100
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:214
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:48
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:203
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:510
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1241
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1172
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1106
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:574
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:955
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition: types.h:18
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition: types.h:16
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition: types.h:17
Dumping parameters.
Definition: types.h:28
Attribute validation policy.
Definition: attr.h:63
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:68