libnl  3.2.26
sp.c
1 /*
2  * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/
3  *
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * Redistributions of source code must retain the above copyright
10  * notice, this list of conditions and the following disclaimer.
11  *
12  * Redistributions in binary form must reproduce the above copyright
13  * notice, this list of conditions and the following disclaimer in the
14  * documentation and/or other materials provided with the
15  * distribution.
16  *
17  * Neither the name of Texas Instruments Incorporated nor the names of
18  * its contributors may be used to endorse or promote products derived
19  * from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  *
33  */
34 
35 /**
36  * @ingroup xfrmnl
37  * @defgroup sp Security Policy
38  * @brief
39  */
40 
41 #include <netlink-private/netlink.h>
42 #include <netlink/netlink.h>
43 #include <netlink/cache.h>
44 #include <netlink/object.h>
45 #include <netlink/xfrm/selector.h>
46 #include <netlink/xfrm/lifetime.h>
47 #include <netlink/xfrm/template.h>
48 #include <netlink/xfrm/sp.h>
49 
50 /** @cond SKIP */
51 #define XFRM_SP_ATTR_SEL 0x01
52 #define XFRM_SP_ATTR_LTIME_CFG 0x02
53 #define XFRM_SP_ATTR_LTIME_CUR 0x04
54 #define XFRM_SP_ATTR_PRIO 0x08
55 #define XFRM_SP_ATTR_INDEX 0x10
56 #define XFRM_SP_ATTR_DIR 0x20
57 #define XFRM_SP_ATTR_ACTION 0x40
58 #define XFRM_SP_ATTR_FLAGS 0x80
59 #define XFRM_SP_ATTR_SHARE 0x100
60 #define XFRM_SP_ATTR_POLTYPE 0x200
61 #define XFRM_SP_ATTR_SECCTX 0x400
62 #define XFRM_SP_ATTR_TMPL 0x800
63 #define XFRM_SP_ATTR_MARK 0x1000
64 
65 static struct nl_cache_ops xfrmnl_sp_ops;
66 static struct nl_object_ops xfrm_sp_obj_ops;
67 /** @endcond */
68 
69 static void xfrm_sp_alloc_data(struct nl_object *c)
70 {
71  struct xfrmnl_sp* sp = nl_object_priv (c);
72 
73  if ((sp->sel = xfrmnl_sel_alloc ()) == NULL)
74  return;
75 
76  if ((sp->lft = xfrmnl_ltime_cfg_alloc ()) == NULL)
77  return;
78 
79  nl_init_list_head(&sp->usertmpl_list);
80 
81  return;
82 }
83 
84 static void xfrm_sp_free_data(struct nl_object *c)
85 {
86  struct xfrmnl_sp* sp = nl_object_priv (c);
87  struct xfrmnl_user_tmpl *utmpl, *tmp;
88 
89  if (sp == NULL)
90  return;
91 
92  xfrmnl_sel_put (sp->sel);
93  xfrmnl_ltime_cfg_put (sp->lft);
94 
95  if(sp->sec_ctx)
96  {
97  free (sp->sec_ctx);
98  }
99 
100  nl_list_for_each_entry_safe(utmpl, tmp, &sp->usertmpl_list, utmpl_list) {
101  xfrmnl_sp_remove_usertemplate (sp, utmpl);
102  xfrmnl_user_tmpl_free (utmpl);
103  }
104 }
105 
106 static int xfrm_sp_clone(struct nl_object *_dst, struct nl_object *_src)
107 {
108  struct xfrmnl_sp* dst = nl_object_priv(_dst);
109  struct xfrmnl_sp* src = nl_object_priv(_src);
110  uint32_t len = 0;
111  struct xfrmnl_user_tmpl *utmpl, *new;
112 
113  if (src->sel)
114  if ((dst->sel = xfrmnl_sel_clone (src->sel)) == NULL)
115  return -NLE_NOMEM;
116 
117  if (src->lft)
118  if ((dst->lft = xfrmnl_ltime_cfg_clone (src->lft)) == NULL)
119  return -NLE_NOMEM;
120 
121  if(src->sec_ctx)
122  {
123  len = sizeof (struct xfrmnl_user_sec_ctx) + src->sec_ctx->ctx_len;
124  if ((dst->sec_ctx = calloc (1, len)) == NULL)
125  return -NLE_NOMEM;
126  memcpy ((void *)dst->sec_ctx, (void *)src->sec_ctx, len);
127  }
128 
129  nl_init_list_head(&dst->usertmpl_list);
130  nl_list_for_each_entry(utmpl, &src->usertmpl_list, utmpl_list) {
131  new = xfrmnl_user_tmpl_clone (utmpl);
132  if (!new)
133  return -NLE_NOMEM;
134 
135  xfrmnl_sp_add_usertemplate(dst, new);
136  }
137 
138  return 0;
139 }
140 
141 static int xfrm_sp_compare(struct nl_object *_a, struct nl_object *_b, uint32_t attrs, int flags)
142 {
143  struct xfrmnl_sp* a = (struct xfrmnl_sp *) _a;
144  struct xfrmnl_sp* b = (struct xfrmnl_sp *) _b;
145  struct xfrmnl_user_tmpl *tmpl_a, *tmpl_b;
146  int diff = 0;
147 
148 #define XFRM_SP_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, XFRM_SP_ATTR_##ATTR, a, b, EXPR)
149  diff |= XFRM_SP_DIFF(SEL, xfrmnl_sel_cmp(a->sel, b->sel));
150  diff |= XFRM_SP_DIFF(LTIME_CFG, xfrmnl_ltime_cfg_cmp(a->lft, b->lft));
151  diff |= XFRM_SP_DIFF(PRIO, a->priority != b->priority);
152  diff |= XFRM_SP_DIFF(INDEX, a->index != b->index);
153  diff |= XFRM_SP_DIFF(DIR, a->dir != b->dir);
154  diff |= XFRM_SP_DIFF(ACTION, a->action != b->action);
155  diff |= XFRM_SP_DIFF(FLAGS, a->flags != b->flags);
156  diff |= XFRM_SP_DIFF(SHARE, a->share != b->share);
157  diff |= XFRM_SP_DIFF(SECCTX,((a->sec_ctx->len != b->sec_ctx->len) ||
158  (a->sec_ctx->exttype != b->sec_ctx->exttype) ||
159  (a->sec_ctx->ctx_alg != b->sec_ctx->ctx_alg) ||
160  (a->sec_ctx->ctx_doi != b->sec_ctx->ctx_doi) ||
161  (a->sec_ctx->ctx_len != b->sec_ctx->ctx_len) ||
162  strcmp(a->sec_ctx->ctx, b->sec_ctx->ctx)));
163  diff |= XFRM_SP_DIFF(POLTYPE,(a->uptype.type != b->uptype.type));
164  diff |= XFRM_SP_DIFF(TMPL,(a->nr_user_tmpl != b->nr_user_tmpl));
165  diff |= XFRM_SP_DIFF(MARK,(a->mark.m != b->mark.m) ||
166  (a->mark.v != b->mark.v));
167 
168  /* Compare the templates */
169  nl_list_for_each_entry(tmpl_b, &b->usertmpl_list, utmpl_list)
170  nl_list_for_each_entry(tmpl_a, &a->usertmpl_list, utmpl_list)
171  diff |= xfrmnl_user_tmpl_cmp (tmpl_a, tmpl_b);
172 #undef XFRM_SP_DIFF
173 
174  return diff;
175 }
176 
177 /**
178  * @name XFRM SP Attribute Translations
179  * @{
180  */
181 static const struct trans_tbl sp_attrs[] = {
182  __ADD(XFRM_SP_ATTR_SEL, selector),
183  __ADD(XFRM_SP_ATTR_LTIME_CFG, lifetime_cfg),
184  __ADD(XFRM_SP_ATTR_LTIME_CUR, lifetime_cur),
185  __ADD(XFRM_SP_ATTR_PRIO, priority),
186  __ADD(XFRM_SP_ATTR_INDEX, index),
187  __ADD(XFRM_SP_ATTR_DIR, direction),
188  __ADD(XFRM_SP_ATTR_ACTION, action),
189  __ADD(XFRM_SP_ATTR_FLAGS, flags),
190  __ADD(XFRM_SP_ATTR_SHARE, share),
191  __ADD(XFRM_SP_ATTR_POLTYPE, policy_type),
192  __ADD(XFRM_SP_ATTR_SECCTX, security_context),
193  __ADD(XFRM_SP_ATTR_TMPL, user_template),
194  __ADD(XFRM_SP_ATTR_MARK, mark),
195 };
196 
197 static char* xfrm_sp_attrs2str(int attrs, char *buf, size_t len)
198 {
199  return __flags2str (attrs, buf, len, sp_attrs, ARRAY_SIZE(sp_attrs));
200 }
201 /** @} */
202 
203 /**
204  * @name XFRM SP Action Translations
205  * @{
206  */
207 static const struct trans_tbl sa_actions[] = {
208  __ADD(XFRM_POLICY_ALLOW, allow),
209  __ADD(XFRM_POLICY_BLOCK, block),
210 };
211 
212 char* xfrmnl_sp_action2str(int action, char *buf, size_t len)
213 {
214  return __type2str (action, buf, len, sa_actions, ARRAY_SIZE(sa_actions));
215 }
216 
217 int xfrmnl_sp_str2action(const char *name)
218 {
219  return __str2type (name, sa_actions, ARRAY_SIZE(sa_actions));
220 }
221 /** @} */
222 
223 /**
224  * @name XFRM SP Flags Translations
225  * @{
226  */
227 static const struct trans_tbl sp_flags[] = {
228  __ADD(XFRM_POLICY_LOCALOK, allow policy override by user),
229  __ADD(XFRM_POLICY_ICMP, auto include ICMP in policy),
230 };
231 
232 char* xfrmnl_sp_flags2str(int flags, char *buf, size_t len)
233 {
234  return __flags2str (flags, buf, len, sp_flags, ARRAY_SIZE(sp_flags));
235 }
236 
237 int xfrmnl_sp_str2flag(const char *name)
238 {
239  return __str2flags(name, sp_flags, ARRAY_SIZE(sp_flags));
240 }
241 /** @} */
242 
243 /**
244  * @name XFRM SP Type Translations
245  * @{
246  */
247 static const struct trans_tbl sp_types[] = {
248  __ADD(XFRM_POLICY_TYPE_MAIN, main),
249  __ADD(XFRM_POLICY_TYPE_SUB, sub),
250  __ADD(XFRM_POLICY_TYPE_MAX, max),
251  __ADD(XFRM_POLICY_TYPE_ANY, any),
252 };
253 
254 char* xfrmnl_sp_type2str(int type, char *buf, size_t len)
255 {
256  return __type2str(type, buf, len, sp_types, ARRAY_SIZE(sp_types));
257 }
258 
259 int xfrmnl_sp_str2type(const char *name)
260 {
261  return __str2type(name, sp_types, ARRAY_SIZE(sp_types));
262 }
263 /** @} */
264 
265 /**
266  * @name XFRM SP Direction Translations
267  * @{
268  */
269 static const struct trans_tbl sp_dir[] = {
270  __ADD(XFRM_POLICY_IN, in),
271  __ADD(XFRM_POLICY_OUT, out),
272  __ADD(XFRM_POLICY_FWD, fwd),
273  __ADD(XFRM_POLICY_MASK, mask),
274 };
275 
276 char* xfrmnl_sp_dir2str(int dir, char *buf, size_t len)
277 {
278  return __type2str (dir, buf, len, sp_dir, ARRAY_SIZE(sp_dir));
279 }
280 
281 int xfrmnl_sp_str2dir(const char *name)
282 {
283  return __str2type (name, sp_dir, ARRAY_SIZE(sp_dir));
284 }
285 
286 int xfrmnl_sp_index2dir (unsigned int index)
287 {
288  return index & 0x7;
289 }
290 /** @} */
291 
292 /**
293  * @name XFRM SP Share Translations
294  * @{
295  */
296 static const struct trans_tbl sp_share[] = {
297  __ADD(XFRM_SHARE_ANY, any),
298  __ADD(XFRM_SHARE_SESSION, session),
299  __ADD(XFRM_SHARE_USER, user),
300  __ADD(XFRM_SHARE_UNIQUE, unique),
301 };
302 
303 char* xfrmnl_sp_share2str(int share, char *buf, size_t len)
304 {
305  return __type2str (share, buf, len, sp_share, ARRAY_SIZE(sp_share));
306 }
307 
308 int xfrmnl_sp_str2share(const char *name)
309 {
310  return __str2type (name, sp_share, ARRAY_SIZE(sp_share));
311 }
312 /** @} */
313 
314 static void xfrm_sp_dump_line(struct nl_object *a, struct nl_dump_params *p)
315 {
316  struct xfrmnl_sp* sp = (struct xfrmnl_sp *) a;
317  char dir[32], action[32], share[32], flags[32];
318  char dst[INET6_ADDRSTRLEN+5], src[INET6_ADDRSTRLEN+5];
319  time_t add_time, use_time;
320  struct tm *add_time_tm, *use_time_tm;
321 
322  nl_addr2str(xfrmnl_sel_get_saddr (sp->sel), src, sizeof(src));
323  nl_addr2str (xfrmnl_sel_get_daddr (sp->sel), dst, sizeof (dst));
324  nl_af2str (xfrmnl_sel_get_family (sp->sel), dir, 32);
325  nl_dump_line(p, "src %s dst %s family: %s\n", src, dst, dir);
326  nl_dump_line (p, "src port/mask: %d/%d dst port/mask: %d/%d\n",
327  xfrmnl_sel_get_dport (sp->sel), xfrmnl_sel_get_dportmask (sp->sel),
328  xfrmnl_sel_get_sport (sp->sel), xfrmnl_sel_get_sportmask (sp->sel));
329  nl_dump_line (p, "protocol: %s ifindex: %u uid: %u\n",
330  nl_ip_proto2str (xfrmnl_sel_get_proto (sp->sel), dir, sizeof(dir)),
331  xfrmnl_sel_get_ifindex (sp->sel),
332  xfrmnl_sel_get_userid (sp->sel));
333 
334  xfrmnl_sp_dir2str (sp->dir, dir, 32);
335  xfrmnl_sp_action2str (sp->action, action, 32);
336  xfrmnl_sp_share2str (sp->share, share, 32);
337  xfrmnl_sp_flags2str (sp->flags, flags, 32);
338  nl_dump_line(p, "\tdir: %s action: %s index: %u priority: %u share: %s flags: %s(0x%x) \n",
339  dir, action, sp->index, sp->priority, share, flags, sp->flags);
340 
341  nl_dump_line(p, "\tlifetime configuration: \n");
342  if (sp->lft->soft_byte_limit == XFRM_INF)
343  sprintf (dir, "INF");
344  else
345  sprintf (dir, "%" PRIu64, sp->lft->soft_byte_limit);
346  if (sp->lft->soft_packet_limit == XFRM_INF)
347  sprintf (action, "INF");
348  else
349  sprintf (action, "%" PRIu64, sp->lft->soft_packet_limit);
350  if (sp->lft->hard_byte_limit == XFRM_INF)
351  sprintf (flags, "INF");
352  else
353  sprintf (flags, "%" PRIu64, sp->lft->hard_byte_limit);
354  if (sp->lft->hard_packet_limit == XFRM_INF)
355  sprintf (share, "INF");
356  else
357  sprintf (share, "%" PRIu64, sp->lft->hard_packet_limit);
358  nl_dump_line(p, "\t\tsoft limit: %s (bytes), %s (packets) \n", dir, action);
359  nl_dump_line(p, "\t\thard limit: %s (bytes), %s (packets) \n", flags, share);
360  nl_dump_line(p, "\t\tsoft add_time: %llu (seconds), soft use_time: %llu (seconds) \n",
361  sp->lft->soft_add_expires_seconds, sp->lft->soft_use_expires_seconds);
362  nl_dump_line(p, "\t\thard add_time: %llu (seconds), hard use_time: %llu (seconds) \n",
363  sp->lft->hard_add_expires_seconds, sp->lft->hard_use_expires_seconds);
364 
365  nl_dump_line(p, "\tlifetime current: \n");
366  nl_dump_line(p, "\t\t%llu bytes, %llu packets\n", sp->curlft.bytes, sp->curlft.packets);
367 
368  if (sp->curlft.add_time != 0)
369  {
370  add_time = sp->curlft.add_time;
371  add_time_tm = gmtime (&add_time);
372  strftime (dst, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", add_time_tm);
373  }
374  else
375  {
376  sprintf (dst, "%s", "-");
377  }
378 
379  if (sp->curlft.use_time != 0)
380  {
381  use_time = sp->curlft.use_time;
382  use_time_tm = gmtime (&use_time);
383  strftime (src, INET6_ADDRSTRLEN+5, "%Y-%m-%d %H-%M-%S", use_time_tm);
384  }
385  else
386  {
387  sprintf (src, "%s", "-");
388  }
389  nl_dump_line(p, "\t\tadd_time: %s, use_time: %s\n", dst, src);
390 
391  if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
392  {
393  nl_dump_line(p, "\tUser security context: \n");
394  nl_dump_line(p, "\t\tlen: %d exttype: %d Algo: %d DOI: %d ctxlen: %d\n",
395  sp->sec_ctx->len, sp->sec_ctx->exttype,
396  sp->sec_ctx->ctx_alg, sp->sec_ctx->ctx_doi, sp->sec_ctx->ctx_len);
397  nl_dump_line (p, "\t\tctx: %s \n", sp->sec_ctx->ctx);
398  }
399 
400  xfrmnl_sp_type2str (sp->uptype.type, flags, 32);
401  if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
402  nl_dump_line(p, "\tUser policy type: %s\n", flags);
403 
404  if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
405  {
406  struct xfrmnl_user_tmpl* utmpl;
407 
408  nl_dump_line(p, "\tUser template: \n");
409 
410  nl_list_for_each_entry(utmpl, &sp->usertmpl_list, utmpl_list)
411  xfrmnl_user_tmpl_dump (utmpl, p);
412  }
413 
414  if (sp->ce_mask & XFRM_SP_ATTR_MARK)
415  nl_dump_line(p, "\tMark mask: 0x%x Mark value: 0x%x\n", sp->mark.m, sp->mark.v);
416 
417  nl_dump(p, "\n");
418 }
419 
420 static void xfrm_sp_dump_details(struct nl_object *a, struct nl_dump_params *p)
421 {
422  xfrm_sp_dump_line(a, p);
423 }
424 
425 static void xfrm_sp_dump_stats(struct nl_object *a, struct nl_dump_params *p)
426 {
427  xfrm_sp_dump_details(a, p);
428 
429  return;
430 }
431 
432 /**
433  * @name XFRM SP Object Allocation/Freeage
434  * @{
435  */
436 
437 struct xfrmnl_sp* xfrmnl_sp_alloc(void)
438 {
439  return (struct xfrmnl_sp*) nl_object_alloc(&xfrm_sp_obj_ops);
440 }
441 
442 void xfrmnl_sp_put(struct xfrmnl_sp* sp)
443 {
444  nl_object_put((struct nl_object *) sp);
445 }
446 
447 /** @} */
448 
449 /**
450  * @name SP Cache Managament
451  * @{
452  */
453 
454 /**
455  * Build a SP cache including all SPs currently configured in the kernel.
456  * @arg sock Netlink socket.
457  * @arg result Pointer to store resulting cache.
458  *
459  * Allocates a new SP cache, initializes it properly and updates it
460  * to include all SPs currently configured in the kernel.
461  *
462  * @return 0 on success or a negative error code.
463  */
464 int xfrmnl_sp_alloc_cache(struct nl_sock *sock, struct nl_cache **result)
465 {
466  return nl_cache_alloc_and_fill(&xfrmnl_sp_ops, sock, result);
467 }
468 
469 /**
470  * Look up a SP by policy id and direction
471  * @arg cache SP cache
472  * @arg index Policy Id
473  * @arg dir direction
474  * @return sp handle or NULL if no match was found.
475  */
476 struct xfrmnl_sp* xfrmnl_sp_get(struct nl_cache* cache, unsigned int index, unsigned int dir)
477 {
478  struct xfrmnl_sp *sp;
479 
480  //nl_list_for_each_entry(sp, &cache->c_items, ce_list) {
481  for (sp = (struct xfrmnl_sp*)nl_cache_get_first (cache);
482  sp != NULL;
483  sp = (struct xfrmnl_sp*)nl_cache_get_next ((struct nl_object*)sp))
484  {
485  if (sp->index == index && sp->dir == dir)
486  {
487  nl_object_get((struct nl_object *) sp);
488  return sp;
489  }
490  }
491 
492  return NULL;
493 }
494 
495 
496 /** @} */
497 
498 
499 static struct nla_policy xfrm_sp_policy[XFRMA_MAX+1] = {
500  [XFRMA_POLICY] = { .minlen = sizeof(struct xfrm_userpolicy_info)},
501  [XFRMA_SEC_CTX] = { .minlen = sizeof(struct xfrm_sec_ctx) },
502  [XFRMA_TMPL] = { .minlen = sizeof(struct xfrm_user_tmpl) },
503  [XFRMA_POLICY_TYPE] = { .minlen = sizeof(struct xfrm_userpolicy_type)},
504  [XFRMA_MARK] = { .minlen = sizeof(struct xfrm_mark) },
505 };
506 
507 static int xfrm_sp_request_update(struct nl_cache *c, struct nl_sock *h)
508 {
509  struct xfrm_userpolicy_id sp_id;
510 
511  memset ((void *)&sp_id, 0, sizeof (struct xfrm_userpolicy_id));
512  return nl_send_simple (h, XFRM_MSG_GETPOLICY, NLM_F_DUMP,(void*)&sp_id, sizeof (struct xfrm_userpolicy_id));
513 }
514 
515 int xfrmnl_sp_parse(struct nlmsghdr *n, struct xfrmnl_sp **result)
516 {
517  struct xfrmnl_sp *sp;
518  struct nlattr *tb[XFRMA_MAX + 1];
519  struct xfrm_userpolicy_info *sp_info;
520  int len, err;
521  struct nl_addr* addr;
522 
523  sp = xfrmnl_sp_alloc();
524  if (!sp) {
525  err = -NLE_NOMEM;
526  goto errout;
527  }
528 
529  sp->ce_msgtype = n->nlmsg_type;
530  if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
531  {
532  sp_info = (struct xfrm_userpolicy_info*)(nlmsg_data(n) + sizeof (struct xfrm_userpolicy_id) + NLA_HDRLEN);
533  }
534  else
535  {
536  sp_info = nlmsg_data(n);
537  }
538 
539  err = nlmsg_parse(n, sizeof(struct xfrm_userpolicy_info), tb, XFRMA_MAX, xfrm_sp_policy);
540  if (err < 0)
541  {
542  printf ("parse error: %d \n", err);
543  goto errout;
544  }
545 
546  if (sp_info->sel.family == AF_INET)
547  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a4, sizeof (sp_info->sel.daddr.a4));
548  else
549  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.daddr.a6, sizeof (sp_info->sel.daddr.a6));
550  nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_d);
551  xfrmnl_sel_set_daddr (sp->sel, addr);
552  xfrmnl_sel_set_prefixlen_d (sp->sel, sp_info->sel.prefixlen_d);
553 
554  if (sp_info->sel.family == AF_INET)
555  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a4, sizeof (sp_info->sel.saddr.a4));
556  else
557  addr = nl_addr_build (sp_info->sel.family, &sp_info->sel.saddr.a6, sizeof (sp_info->sel.saddr.a6));
558  nl_addr_set_prefixlen (addr, sp_info->sel.prefixlen_s);
559  xfrmnl_sel_set_saddr (sp->sel, addr);
560  xfrmnl_sel_set_prefixlen_s (sp->sel, sp_info->sel.prefixlen_s);
561 
562  xfrmnl_sel_set_dport (sp->sel, ntohs (sp_info->sel.dport));
563  xfrmnl_sel_set_dportmask (sp->sel, ntohs (sp_info->sel.dport_mask));
564  xfrmnl_sel_set_sport (sp->sel, ntohs (sp_info->sel.sport));
565  xfrmnl_sel_set_sportmask (sp->sel, ntohs (sp_info->sel.sport_mask));
566  xfrmnl_sel_set_family (sp->sel, sp_info->sel.family);
567  xfrmnl_sel_set_proto (sp->sel, sp_info->sel.proto);
568  xfrmnl_sel_set_ifindex (sp->sel, sp_info->sel.ifindex);
569  xfrmnl_sel_set_userid (sp->sel, sp_info->sel.user);
570  sp->ce_mask |= XFRM_SP_ATTR_SEL;
571 
572  sp->lft->soft_byte_limit = sp_info->lft.soft_byte_limit;
573  sp->lft->hard_byte_limit = sp_info->lft.hard_byte_limit;
574  sp->lft->soft_packet_limit = sp_info->lft.soft_packet_limit;
575  sp->lft->hard_packet_limit = sp_info->lft.hard_packet_limit;
576  sp->lft->soft_add_expires_seconds = sp_info->lft.soft_add_expires_seconds;
577  sp->lft->hard_add_expires_seconds = sp_info->lft.hard_add_expires_seconds;
578  sp->lft->soft_use_expires_seconds = sp_info->lft.soft_use_expires_seconds;
579  sp->lft->hard_use_expires_seconds = sp_info->lft.hard_use_expires_seconds;
580  sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
581 
582  sp->curlft.bytes = sp_info->curlft.bytes;
583  sp->curlft.packets = sp_info->curlft.packets;
584  sp->curlft.add_time = sp_info->curlft.add_time;
585  sp->curlft.use_time = sp_info->curlft.use_time;
586  sp->ce_mask |= XFRM_SP_ATTR_LTIME_CUR;
587 
588  sp->priority = sp_info->priority;
589  sp->index = sp_info->index;
590  sp->dir = sp_info->dir;
591  sp->action = sp_info->action;
592  sp->flags = sp_info->flags;
593  sp->share = sp_info->share;
594  sp->ce_mask |= (XFRM_SP_ATTR_PRIO | XFRM_SP_ATTR_INDEX |
595  XFRM_SP_ATTR_DIR | XFRM_SP_ATTR_ACTION |
596  XFRM_SP_ATTR_FLAGS | XFRM_SP_ATTR_SHARE);
597 
598  if (tb[XFRMA_SEC_CTX]) {
599  struct xfrm_user_sec_ctx* ctx = nla_data(tb[XFRMA_SEC_CTX]);
600  len = sizeof (struct xfrmnl_user_sec_ctx) + ctx->ctx_len;
601  if ((sp->sec_ctx = calloc (1, len)) == NULL)
602  {
603  err = -NLE_NOMEM;
604  goto errout;
605  }
606  memcpy ((void *)sp->sec_ctx, (void *)ctx, len);
607  sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
608  }
609 
610  if (tb[XFRMA_POLICY_TYPE]) {
611  struct xfrm_userpolicy_type* up = nla_data(tb[XFRMA_POLICY_TYPE]);
612  memcpy ((void *)&sp->uptype, (void *)up, sizeof (struct xfrm_userpolicy_type));
613  sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
614  }
615 
616  if (tb[XFRMA_TMPL]) {
617  struct xfrm_user_tmpl* tmpl = nla_data(tb[XFRMA_TMPL]);
618  struct xfrmnl_user_tmpl* sputmpl;
619  uint32_t i;
620  uint32_t num_tmpls = nla_len(tb[XFRMA_TMPL]) / sizeof (*tmpl);
621  struct nl_addr* addr;
622 
623  for (i = 0; (i < num_tmpls) && (tmpl); i ++, tmpl++)
624  {
625  if ((sputmpl = xfrmnl_user_tmpl_alloc ()) == NULL)
626  {
627  err = -NLE_NOMEM;
628  goto errout;
629  }
630 
631  if (tmpl->family == AF_INET)
632  addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a4, sizeof (tmpl->id.daddr.a4));
633  else
634  addr = nl_addr_build(tmpl->family, &tmpl->id.daddr.a6, sizeof (tmpl->id.daddr.a6));
635  xfrmnl_user_tmpl_set_daddr (sputmpl, addr);
636  xfrmnl_user_tmpl_set_spi (sputmpl, ntohl(tmpl->id.spi));
637  xfrmnl_user_tmpl_set_proto (sputmpl, tmpl->id.proto);
638  xfrmnl_user_tmpl_set_family (sputmpl, tmpl->family);
639 
640  if (tmpl->family == AF_INET)
641  addr = nl_addr_build(tmpl->family, &tmpl->saddr.a4, sizeof (tmpl->saddr.a4));
642  else
643  addr = nl_addr_build(tmpl->family, &tmpl->saddr.a6, sizeof (tmpl->saddr.a6));
644  xfrmnl_user_tmpl_set_saddr (sputmpl, addr);
645 
646  xfrmnl_user_tmpl_set_reqid (sputmpl, tmpl->reqid);
647  xfrmnl_user_tmpl_set_mode (sputmpl, tmpl->mode);
648  xfrmnl_user_tmpl_set_share (sputmpl, tmpl->share);
649  xfrmnl_user_tmpl_set_optional (sputmpl, tmpl->optional);
650  xfrmnl_user_tmpl_set_aalgos (sputmpl, tmpl->aalgos);
651  xfrmnl_user_tmpl_set_ealgos (sputmpl, tmpl->ealgos);
652  xfrmnl_user_tmpl_set_calgos (sputmpl, tmpl->calgos);
653  xfrmnl_sp_add_usertemplate (sp, sputmpl);
654 
655  sp->ce_mask |= XFRM_SP_ATTR_TMPL;
656  }
657  }
658 
659  if (tb[XFRMA_MARK]) {
660  struct xfrm_mark* m = nla_data(tb[XFRMA_MARK]);
661  sp->mark.m = m->m;
662  sp->mark.v = m->v;
663  sp->ce_mask |= XFRM_SP_ATTR_MARK;
664  }
665 
666  *result = sp;
667  return 0;
668 
669 errout:
670  xfrmnl_sp_put(sp);
671  return err;
672 }
673 
674 static int xfrm_sp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
675  struct nlmsghdr *n, struct nl_parser_param *pp)
676 {
677  struct xfrmnl_sp* sp;
678  int err;
679 
680  if ((err = xfrmnl_sp_parse(n, &sp)) < 0)
681  {
682  printf ("received error: %d \n", err);
683  return err;
684  }
685 
686  err = pp->pp_cb((struct nl_object *) sp, pp);
687 
688  xfrmnl_sp_put(sp);
689  return err;
690 }
691 
692 /**
693  * @name XFRM SP Get
694  * @{
695  */
696 
697 int xfrmnl_sp_build_get_request(unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct nl_msg **result)
698 {
699  struct nl_msg *msg;
700  struct xfrm_userpolicy_id spid;
701  struct xfrm_mark mark;
702 
703  memset(&spid, 0, sizeof(spid));
704  spid.index = index;
705  spid.dir = dir;
706 
707  if (!(msg = nlmsg_alloc_simple(XFRM_MSG_GETPOLICY, 0)))
708  return -NLE_NOMEM;
709 
710  if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
711  goto nla_put_failure;
712 
713  if ((mark_m & mark_v) != 0)
714  {
715  memset(&mark, 0, sizeof(struct xfrm_mark));
716  mark.m = mark_m;
717  mark.v = mark_v;
718 
719  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &mark);
720  }
721 
722  *result = msg;
723  return 0;
724 
725 nla_put_failure:
726  nlmsg_free(msg);
727  return -NLE_MSGSIZE;
728 }
729 
730 int xfrmnl_sp_get_kernel(struct nl_sock* sock, unsigned int index, unsigned int dir, unsigned int mark_v, unsigned int mark_m, struct xfrmnl_sp** result)
731 {
732  struct nl_msg *msg = NULL;
733  struct nl_object *obj;
734  int err;
735 
736  if ((err = xfrmnl_sp_build_get_request(index, dir, mark_m, mark_v, &msg)) < 0)
737  return err;
738 
739  err = nl_send_auto(sock, msg);
740  nlmsg_free(msg);
741  if (err < 0)
742  return err;
743 
744  if ((err = nl_pickup(sock, &xfrm_sp_msg_parser, &obj)) < 0)
745  return err;
746 
747  /* We have used xfrm_sp_msg_parser(), object is definitely a xfrm ae */
748  *result = (struct xfrmnl_sp *) obj;
749 
750  /* If an object has been returned, we also need to wait for the ACK */
751  if (err == 0 && obj)
752  nl_wait_for_ack(sock);
753 
754  return 0;
755 }
756 
757 /** @} */
758 
759 static int build_xfrm_sp_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
760 {
761  struct nl_msg* msg;
762  struct xfrm_userpolicy_info sp_info;
763  uint32_t len;
764  struct nl_addr* addr;
765 
766  if (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) ||
767  !(tmpl->ce_mask & XFRM_SP_ATTR_DIR))
768  return -NLE_MISSING_ATTR;
769 
770  memset ((void*)&sp_info, 0, sizeof (sp_info));
771  if (tmpl->ce_mask & XFRM_SP_ATTR_SEL)
772  {
773  addr = xfrmnl_sel_get_daddr (tmpl->sel);
774  memcpy ((void*)&sp_info.sel.daddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
775  addr = xfrmnl_sel_get_saddr (tmpl->sel);
776  memcpy ((void*)&sp_info.sel.saddr, (void*)nl_addr_get_binary_addr (addr), sizeof (uint8_t) * nl_addr_get_len (addr));
777  sp_info.sel.dport = htons (xfrmnl_sel_get_dport (tmpl->sel));
778  sp_info.sel.dport_mask = htons (xfrmnl_sel_get_dportmask (tmpl->sel));
779  sp_info.sel.sport = htons (xfrmnl_sel_get_sport (tmpl->sel));
780  sp_info.sel.sport_mask = htons (xfrmnl_sel_get_sportmask (tmpl->sel));
781  sp_info.sel.family = xfrmnl_sel_get_family (tmpl->sel);
782  sp_info.sel.prefixlen_d = xfrmnl_sel_get_prefixlen_d (tmpl->sel);
783  sp_info.sel.prefixlen_s = xfrmnl_sel_get_prefixlen_s (tmpl->sel);
784  sp_info.sel.proto = xfrmnl_sel_get_proto (tmpl->sel);
785  sp_info.sel.ifindex = xfrmnl_sel_get_ifindex (tmpl->sel);
786  sp_info.sel.user = xfrmnl_sel_get_userid (tmpl->sel);
787  }
788 
789  if (tmpl->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
790  {
791  sp_info.lft.soft_byte_limit = xfrmnl_ltime_cfg_get_soft_bytelimit (tmpl->lft);
792  sp_info.lft.hard_byte_limit = xfrmnl_ltime_cfg_get_hard_bytelimit (tmpl->lft);
793  sp_info.lft.soft_packet_limit = xfrmnl_ltime_cfg_get_soft_packetlimit (tmpl->lft);
794  sp_info.lft.hard_packet_limit = xfrmnl_ltime_cfg_get_hard_packetlimit (tmpl->lft);
795  sp_info.lft.soft_add_expires_seconds = xfrmnl_ltime_cfg_get_soft_addexpires (tmpl->lft);
796  sp_info.lft.hard_add_expires_seconds = xfrmnl_ltime_cfg_get_hard_addexpires (tmpl->lft);
797  sp_info.lft.soft_use_expires_seconds = xfrmnl_ltime_cfg_get_soft_useexpires (tmpl->lft);
798  sp_info.lft.hard_use_expires_seconds = xfrmnl_ltime_cfg_get_hard_useexpires (tmpl->lft);
799  }
800 
801  //Skip current lifetime: cur lifetime can be updated only via AE
802 
803  if (tmpl->ce_mask & XFRM_SP_ATTR_PRIO)
804  sp_info.priority = tmpl->priority;
805 
806  if (tmpl->ce_mask & XFRM_SP_ATTR_INDEX)
807  sp_info.index = tmpl->index;
808 
809  if (tmpl->ce_mask & XFRM_SP_ATTR_DIR)
810  sp_info.dir = tmpl->dir;
811 
812  if (tmpl->ce_mask & XFRM_SP_ATTR_ACTION)
813  sp_info.action = tmpl->action;
814 
815  if (tmpl->ce_mask & XFRM_SP_ATTR_FLAGS)
816  sp_info.flags = tmpl->flags;
817 
818  if (tmpl->ce_mask & XFRM_SP_ATTR_SHARE)
819  sp_info.share = tmpl->share;
820 
821  msg = nlmsg_alloc_simple(cmd, flags);
822  if (!msg)
823  return -NLE_NOMEM;
824 
825  if (nlmsg_append(msg, &sp_info, sizeof(sp_info), NLMSG_ALIGNTO) < 0)
826  goto nla_put_failure;
827 
828  if (tmpl->ce_mask & XFRM_SP_ATTR_SECCTX) {
829  len = (sizeof (struct xfrm_user_sec_ctx)) + tmpl->sec_ctx->ctx_len;
830  NLA_PUT (msg, XFRMA_SEC_CTX, len, tmpl->sec_ctx);
831  }
832 
833  if (tmpl->ce_mask & XFRM_SP_ATTR_POLTYPE) {
834  len = sizeof (struct xfrm_userpolicy_type);
835  NLA_PUT (msg, XFRMA_POLICY_TYPE, len, &tmpl->uptype);
836  }
837 
838  if (tmpl->ce_mask & XFRM_SP_ATTR_TMPL) {
839  struct nlattr* tmpls;
840  struct xfrmnl_user_tmpl* utmpl;
841  struct nl_addr* addr;
842 
843  if (!(tmpls = nla_nest_start(msg, XFRMA_TMPL)))
844  goto nla_put_failure;
845 
846  nl_list_for_each_entry(utmpl, &tmpl->usertmpl_list, utmpl_list) {
847  struct xfrm_user_tmpl* tmpl;
848 
849  tmpl = nlmsg_reserve(msg, sizeof(*tmpl), NLMSG_ALIGNTO);
850  if (!tmpl)
851  goto nla_put_failure;
852  addr = xfrmnl_user_tmpl_get_daddr (utmpl);
853  memcpy ((void *)&tmpl->id.daddr, nl_addr_get_binary_addr (addr),
854  nl_addr_get_len (addr));
855  tmpl->id.spi = htonl(xfrmnl_user_tmpl_get_spi (utmpl));
856  tmpl->id.proto = xfrmnl_user_tmpl_get_proto (utmpl);
857  tmpl->family = xfrmnl_user_tmpl_get_family (utmpl);
858  addr = xfrmnl_user_tmpl_get_saddr (utmpl);
859  memcpy ((void *)&tmpl->saddr, nl_addr_get_binary_addr (addr),
860  nl_addr_get_len (addr));
861  tmpl->reqid = xfrmnl_user_tmpl_get_reqid (utmpl);
862  tmpl->mode = xfrmnl_user_tmpl_get_mode (utmpl);
863  tmpl->share = xfrmnl_user_tmpl_get_share (utmpl);
864  tmpl->optional = xfrmnl_user_tmpl_get_optional (utmpl);
865  tmpl->aalgos = xfrmnl_user_tmpl_get_aalgos (utmpl);
866  tmpl->ealgos = xfrmnl_user_tmpl_get_ealgos (utmpl);
867  tmpl->calgos = xfrmnl_user_tmpl_get_calgos (utmpl);
868  }
869  nla_nest_end(msg, tmpls);
870  }
871 
872  if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
873  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
874  }
875 
876  *result = msg;
877  return 0;
878 
879 nla_put_failure:
880  nlmsg_free(msg);
881  return -NLE_MSGSIZE;
882 }
883 
884 /**
885  * @name XFRM SP Add
886  * @{
887  */
888 
889 int xfrmnl_sp_build_add_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
890 {
891  return build_xfrm_sp_message (tmpl, XFRM_MSG_NEWPOLICY, flags, result);
892 }
893 
894 int xfrmnl_sp_add(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
895 {
896  int err;
897  struct nl_msg *msg;
898 
899  if ((err = xfrmnl_sp_build_add_request(tmpl, flags, &msg)) < 0)
900  return err;
901 
902  err = nl_send_auto_complete(sk, msg);
903  nlmsg_free(msg);
904  if (err < 0)
905  return err;
906 
907  return nl_wait_for_ack(sk);
908 }
909 
910 /**
911  * @name XFRM SP Update
912  * @{
913  */
914 
915 int xfrmnl_sp_build_update_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
916 {
917  return build_xfrm_sp_message (tmpl, XFRM_MSG_UPDPOLICY, flags, result);
918 }
919 
920 int xfrmnl_sp_update(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
921 {
922  int err;
923  struct nl_msg *msg;
924 
925  if ((err = xfrmnl_sp_build_update_request(tmpl, flags, &msg)) < 0)
926  return err;
927 
928  err = nl_send_auto_complete(sk, msg);
929  nlmsg_free(msg);
930  if (err < 0)
931  return err;
932 
933  return nl_wait_for_ack(sk);
934 }
935 
936 /** @} */
937 
938 static int build_xfrm_sp_delete_message(struct xfrmnl_sp *tmpl, int cmd, int flags, struct nl_msg **result)
939 {
940  struct nl_msg* msg;
941  struct xfrm_userpolicy_id spid;
942 
943  if (!(tmpl->ce_mask & XFRM_SP_ATTR_INDEX) ||
944  !(tmpl->ce_mask & XFRM_SP_ATTR_DIR))
945  return -NLE_MISSING_ATTR;
946 
947  memset(&spid, 0, sizeof(spid));
948  spid.index = tmpl->index;
949  spid.dir = tmpl->dir;
950 
951  msg = nlmsg_alloc_simple(cmd, flags);
952  if (!msg)
953  return -NLE_NOMEM;
954 
955  if (nlmsg_append(msg, &spid, sizeof(spid), NLMSG_ALIGNTO) < 0)
956  goto nla_put_failure;
957 
958  if (tmpl->ce_mask & XFRM_SP_ATTR_MARK) {
959  NLA_PUT (msg, XFRMA_MARK, sizeof (struct xfrm_mark), &tmpl->mark);
960  }
961 
962  *result = msg;
963  return 0;
964 
965 nla_put_failure:
966  nlmsg_free(msg);
967  return -NLE_MSGSIZE;
968 }
969 
970 /**
971  * @name XFRM SA Delete
972  * @{
973  */
974 
975 int xfrmnl_sp_build_delete_request(struct xfrmnl_sp* tmpl, int flags, struct nl_msg **result)
976 {
977  return build_xfrm_sp_delete_message (tmpl, XFRM_MSG_DELPOLICY, flags, result);
978 }
979 
980 int xfrmnl_sp_delete(struct nl_sock* sk, struct xfrmnl_sp* tmpl, int flags)
981 {
982  int err;
983  struct nl_msg *msg;
984 
985  if ((err = xfrmnl_sp_build_delete_request(tmpl, flags, &msg)) < 0)
986  return err;
987 
988  err = nl_send_auto_complete(sk, msg);
989  nlmsg_free(msg);
990  if (err < 0)
991  return err;
992 
993  return nl_wait_for_ack(sk);
994 }
995 
996 /** @} */
997 
998 
999 /**
1000  * @name Attributes
1001  * @{
1002  */
1003 
1004 struct xfrmnl_sel* xfrmnl_sp_get_sel (struct xfrmnl_sp* sp)
1005 {
1006  if (sp->ce_mask & XFRM_SP_ATTR_SEL)
1007  return sp->sel;
1008  else
1009  return NULL;
1010 }
1011 
1012 int xfrmnl_sp_set_sel (struct xfrmnl_sp* sp, struct xfrmnl_sel* sel)
1013 {
1014  /* Release any previously held selector object from the SP */
1015  if (sp->sel)
1016  xfrmnl_sel_put (sp->sel);
1017 
1018  /* Increment ref count on new selector and save it in the SP */
1019  xfrmnl_sel_get (sel);
1020  sp->sel = sel;
1021  sp->ce_mask |= XFRM_SP_ATTR_SEL;
1022 
1023  return 0;
1024 }
1025 
1026 struct xfrmnl_ltime_cfg* xfrmnl_sp_get_lifetime_cfg (struct xfrmnl_sp* sp)
1027 {
1028  if (sp->ce_mask & XFRM_SP_ATTR_LTIME_CFG)
1029  return sp->lft;
1030  else
1031  return NULL;
1032 }
1033 
1034 int xfrmnl_sp_set_lifetime_cfg (struct xfrmnl_sp* sp, struct xfrmnl_ltime_cfg* ltime)
1035 {
1036  /* Release any previously held lifetime cfg object from the SP */
1037  if (sp->lft)
1038  xfrmnl_ltime_cfg_put (sp->lft);
1039 
1040  /* Increment ref count on new lifetime object and save it in the SP */
1041  xfrmnl_ltime_cfg_get (ltime);
1042  sp->lft = ltime;
1043  sp->ce_mask |= XFRM_SP_ATTR_LTIME_CFG;
1044 
1045  return 0;
1046 }
1047 
1048 int xfrmnl_sp_get_curlifetime (struct xfrmnl_sp* sa, unsigned long long int* curr_bytes,
1049  unsigned long long int* curr_packets, unsigned long long int* curr_add_time, unsigned long long int* curr_use_time)
1050 {
1051  if (sa == NULL || curr_bytes == NULL || curr_packets == NULL || curr_add_time == NULL || curr_use_time == NULL)
1052  return -1;
1053 
1054  *curr_bytes = sa->curlft.bytes;
1055  *curr_packets = sa->curlft.packets;
1056  *curr_add_time = sa->curlft.add_time;
1057  *curr_use_time = sa->curlft.use_time;
1058 
1059  return 0;
1060 }
1061 
1062 int xfrmnl_sp_get_priority (struct xfrmnl_sp* sp)
1063 {
1064  if (sp->ce_mask & XFRM_SP_ATTR_PRIO)
1065  return sp->priority;
1066  else
1067  return -1;
1068 }
1069 
1070 int xfrmnl_sp_set_priority (struct xfrmnl_sp* sp, unsigned int prio)
1071 {
1072  sp->priority = prio;
1073  sp->ce_mask |= XFRM_SP_ATTR_PRIO;
1074 
1075  return 0;
1076 }
1077 
1078 int xfrmnl_sp_get_index (struct xfrmnl_sp* sp)
1079 {
1080  if (sp->ce_mask & XFRM_SP_ATTR_INDEX)
1081  return sp->index;
1082  else
1083  return -1;
1084 }
1085 
1086 int xfrmnl_sp_set_index (struct xfrmnl_sp* sp, unsigned int index)
1087 {
1088  sp->index = index;
1089  sp->ce_mask |= XFRM_SP_ATTR_INDEX;
1090 
1091  return 0;
1092 }
1093 
1094 int xfrmnl_sp_get_dir (struct xfrmnl_sp* sp)
1095 {
1096  if (sp->ce_mask & XFRM_SP_ATTR_DIR)
1097  return sp->dir;
1098  else
1099  return -1;
1100 }
1101 
1102 int xfrmnl_sp_set_dir (struct xfrmnl_sp* sp, unsigned int dir)
1103 {
1104  sp->dir = dir;
1105  sp->ce_mask |= XFRM_SP_ATTR_DIR;
1106 
1107  return 0;
1108 }
1109 
1110 int xfrmnl_sp_get_action (struct xfrmnl_sp* sp)
1111 {
1112  if (sp->ce_mask & XFRM_SP_ATTR_ACTION)
1113  return sp->action;
1114  else
1115  return -1;
1116 }
1117 
1118 int xfrmnl_sp_set_action (struct xfrmnl_sp* sp, unsigned int action)
1119 {
1120  sp->action = action;
1121  sp->ce_mask |= XFRM_SP_ATTR_ACTION;
1122 
1123  return 0;
1124 }
1125 
1126 int xfrmnl_sp_get_flags (struct xfrmnl_sp* sp)
1127 {
1128  if (sp->ce_mask & XFRM_SP_ATTR_FLAGS)
1129  return sp->flags;
1130  else
1131  return -1;
1132 }
1133 
1134 int xfrmnl_sp_set_flags (struct xfrmnl_sp* sp, unsigned int flags)
1135 {
1136  sp->flags = flags;
1137  sp->ce_mask |= XFRM_SP_ATTR_FLAGS;
1138 
1139  return 0;
1140 }
1141 
1142 int xfrmnl_sp_get_share (struct xfrmnl_sp* sp)
1143 {
1144  if (sp->ce_mask & XFRM_SP_ATTR_SHARE)
1145  return sp->share;
1146  else
1147  return -1;
1148 }
1149 
1150 int xfrmnl_sp_set_share (struct xfrmnl_sp* sp, unsigned int share)
1151 {
1152  sp->share = share;
1153  sp->ce_mask |= XFRM_SP_ATTR_SHARE;
1154 
1155  return 0;
1156 }
1157 
1158 int xfrmnl_sp_get_sec_ctx (struct xfrmnl_sp* sp, unsigned int* len, unsigned int* exttype, unsigned int* alg, unsigned int* doi, unsigned int* ctx_len, char* ctx_str)
1159 {
1160  if (sp->ce_mask & XFRM_SP_ATTR_SECCTX)
1161  {
1162  *len = sp->sec_ctx->len;
1163  *exttype= sp->sec_ctx->exttype;
1164  *alg = sp->sec_ctx->ctx_alg;
1165  *doi = sp->sec_ctx->ctx_doi;
1166  *ctx_len= sp->sec_ctx->ctx_len;
1167  memcpy ((void *)ctx_str, (void *)sp->sec_ctx->ctx, sizeof (uint8_t) * sp->sec_ctx->ctx_len);
1168  }
1169  else
1170  return -1;
1171 
1172  return 0;
1173 }
1174 
1175 int xfrmnl_sp_set_sec_ctx (struct xfrmnl_sp* sp, unsigned int len, unsigned int exttype, unsigned int alg, unsigned int doi, unsigned int ctx_len, char* ctx_str)
1176 {
1177  /* Free up the old context string and allocate new one */
1178  if (sp->sec_ctx)
1179  free (sp->sec_ctx);
1180  if ((sp->sec_ctx = calloc (1, sizeof (struct xfrmnl_user_sec_ctx) + (sizeof (uint8_t) * ctx_len))) == NULL)
1181  return -1;
1182 
1183  /* Save the new info */
1184  sp->sec_ctx->len = len;
1185  sp->sec_ctx->exttype = exttype;
1186  sp->sec_ctx->ctx_alg = alg;
1187  sp->sec_ctx->ctx_doi = doi;
1188  sp->sec_ctx->ctx_len = len;
1189  memcpy ((void *)sp->sec_ctx->ctx, (void *)ctx_str, sizeof (uint8_t) * ctx_len);
1190 
1191  sp->ce_mask |= XFRM_SP_ATTR_SECCTX;
1192 
1193  return 0;
1194 }
1195 
1196 int xfrmnl_sp_get_userpolicy_type (struct xfrmnl_sp* sp)
1197 {
1198  if (sp->ce_mask & XFRM_SP_ATTR_POLTYPE)
1199  return sp->uptype.type;
1200  else
1201  return -1;
1202 }
1203 
1204 int xfrmnl_sp_set_userpolicy_type (struct xfrmnl_sp* sp, unsigned int type)
1205 {
1206  sp->uptype.type = type;
1207  sp->ce_mask |= XFRM_SP_ATTR_POLTYPE;
1208 
1209  return 0;
1210 }
1211 
1212 void xfrmnl_sp_add_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1213 {
1214  nl_list_add_tail(&utmpl->utmpl_list, &sp->usertmpl_list);
1215  sp->nr_user_tmpl++;
1216  sp->ce_mask |= XFRM_SP_ATTR_TMPL;
1217 }
1218 
1219 void xfrmnl_sp_remove_usertemplate(struct xfrmnl_sp *sp, struct xfrmnl_user_tmpl *utmpl)
1220 {
1221  if (sp->ce_mask & XFRM_SP_ATTR_TMPL) {
1222  sp->nr_user_tmpl--;
1223  nl_list_del(&utmpl->utmpl_list);
1224  }
1225 }
1226 
1227 struct nl_list_head *xfrmnl_sp_get_usertemplates(struct xfrmnl_sp *sp)
1228 {
1229  if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1230  return &sp->usertmpl_list;
1231 
1232  return NULL;
1233 }
1234 
1235 int xfrmnl_sp_get_nusertemplates(struct xfrmnl_sp *sp)
1236 {
1237  if (sp->ce_mask & XFRM_SP_ATTR_TMPL)
1238  return sp->nr_user_tmpl;
1239 
1240  return 0;
1241 }
1242 
1243 void xfrmnl_sp_foreach_usertemplate(struct xfrmnl_sp *r,
1244  void (*cb)(struct xfrmnl_user_tmpl *, void *),
1245  void *arg)
1246 {
1247  struct xfrmnl_user_tmpl *utmpl;
1248 
1249  if (r->ce_mask & XFRM_SP_ATTR_TMPL) {
1250  nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1251  cb(utmpl, arg);
1252  }
1253  }
1254 }
1255 
1256 struct xfrmnl_user_tmpl *xfrmnl_sp_usertemplate_n(struct xfrmnl_sp *r, int n)
1257 {
1258  struct xfrmnl_user_tmpl *utmpl;
1259  uint32_t i;
1260 
1261  if (r->ce_mask & XFRM_SP_ATTR_TMPL && r->nr_user_tmpl > n) {
1262  i = 0;
1263  nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
1264  if (i == n) return utmpl;
1265  i++;
1266  }
1267  }
1268  return NULL;
1269 }
1270 
1271 int xfrmnl_sp_get_mark (struct xfrmnl_sp* sp, unsigned int* mark_mask, unsigned int* mark_value)
1272 {
1273  if (mark_mask == NULL || mark_value == NULL)
1274  return -1;
1275 
1276  if (sp->ce_mask & XFRM_SP_ATTR_MARK)
1277  {
1278  *mark_mask = sp->mark.m;
1279  *mark_value = sp->mark.v;
1280 
1281  return 0;
1282  }
1283  else
1284  return -1;
1285 }
1286 
1287 int xfrmnl_sp_set_mark (struct xfrmnl_sp* sp, unsigned int value, unsigned int mask)
1288 {
1289  sp->mark.v = value;
1290  sp->mark.m = mask;
1291  sp->ce_mask |= XFRM_SP_ATTR_MARK;
1292 
1293  return 0;
1294 }
1295 
1296 /** @} */
1297 
1298 static struct nl_object_ops xfrm_sp_obj_ops = {
1299  .oo_name = "xfrm/sp",
1300  .oo_size = sizeof(struct xfrmnl_sp),
1301  .oo_constructor = xfrm_sp_alloc_data,
1302  .oo_free_data = xfrm_sp_free_data,
1303  .oo_clone = xfrm_sp_clone,
1304  .oo_dump = {
1305  [NL_DUMP_LINE] = xfrm_sp_dump_line,
1306  [NL_DUMP_DETAILS] = xfrm_sp_dump_details,
1307  [NL_DUMP_STATS] = xfrm_sp_dump_stats,
1308  },
1309  .oo_compare = xfrm_sp_compare,
1310  .oo_attrs2str = xfrm_sp_attrs2str,
1311  .oo_id_attrs = (XFRM_SP_ATTR_SEL | XFRM_SP_ATTR_INDEX | XFRM_SP_ATTR_DIR),
1312 };
1313 
1314 static struct nl_af_group xfrm_sp_groups[] = {
1315  { AF_UNSPEC, XFRMNLGRP_POLICY },
1316  { END_OF_GROUP_LIST },
1317 };
1318 
1319 static struct nl_cache_ops xfrmnl_sp_ops = {
1320  .co_name = "xfrm/sp",
1321  .co_hdrsize = sizeof(struct xfrm_userpolicy_info),
1322  .co_msgtypes = {
1323  { XFRM_MSG_NEWPOLICY, NL_ACT_NEW, "new" },
1324  { XFRM_MSG_DELPOLICY, NL_ACT_DEL, "del" },
1325  { XFRM_MSG_GETPOLICY, NL_ACT_GET, "get" },
1326  { XFRM_MSG_UPDPOLICY, NL_ACT_NEW, "update" },
1327  END_OF_MSGTYPES_LIST,
1328  },
1329  .co_protocol = NETLINK_XFRM,
1330  .co_groups = xfrm_sp_groups,
1331  .co_request_update = xfrm_sp_request_update,
1332  .co_msg_parser = xfrm_sp_msg_parser,
1333  .co_obj_ops = &xfrm_sp_obj_ops,
1334 };
1335 
1336 /**
1337  * @name XFRM SA Cache Managament
1338  * @{
1339  */
1340 
1341 static void __attribute__ ((constructor)) xfrm_sp_init(void)
1342 {
1343  nl_cache_mngt_register(&xfrmnl_sp_ops);
1344 }
1345 
1346 static void __attribute__ ((destructor)) xfrm_sp_exit(void)
1347 {
1348  nl_cache_mngt_unregister(&xfrmnl_sp_ops);
1349 }
1350 
1351 /** @} */
int nl_send_auto_complete(struct nl_sock *sk, struct nl_msg *msg)
Definition: nl.c:1230
Dump object briefly on one line.
Definition: types.h:22
void nl_addr_set_prefixlen(struct nl_addr *addr, int prefixlen)
Set the prefix length of an abstract address.
Definition: addr.c:917
void nlmsg_free(struct nl_msg *msg)
Release a reference from an netlink message.
Definition: msg.c:558
void * nlmsg_data(const struct nlmsghdr *nlh)
Return pointer to message payload.
Definition: msg.c:105
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:54
void * nlmsg_reserve(struct nl_msg *n, size_t len, int pad)
Reserve room for additional data in a netlink message.
Definition: msg.c:407
int nl_cache_mngt_unregister(struct nl_cache_ops *ops)
Unregister a set of cache operations.
Definition: cache_mngt.c:287
Attribute validation policy.
Definition: attr.h:60
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:204
struct nl_addr * nl_addr_build(int family, const void *buf, size_t size)
Allocate abstract address based on a binary address.
Definition: addr.c:216
int nl_pickup(struct nl_sock *sk, int(*parser)(struct nl_cache_ops *, struct sockaddr_nl *, struct nlmsghdr *, struct nl_parser_param *), struct nl_object **result)
Pickup netlink answer, parse is and return object.
Definition: nl.c:1161
int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen, struct nlattr *tb[], int maxtype, struct nla_policy *policy)
parse attributes of a netlink message
Definition: msg.c:213
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_clone(struct xfrmnl_ltime_cfg *ltime)
Clone existing lifetime config object.
Definition: lifetime.c:93
Dump all attributes but no statistics.
Definition: types.h:23
int nla_nest_end(struct nl_msg *msg, struct nlattr *start)
Finalize nesting of attributes.
Definition: attr.c:812
int nl_cache_mngt_register(struct nl_cache_ops *ops)
Register a set of cache operations.
Definition: cache_mngt.c:252
#define NLA_PUT(msg, attrtype, attrlen, data)
Add unspecific attribute to netlink message.
Definition: attr.h:147
void * nla_data(const struct nlattr *nla)
Return pointer to the payload section.
Definition: attr.c:120
int xfrmnl_sel_cmp(struct xfrmnl_sel *a, struct xfrmnl_sel *b)
Compares two selector objects.
Definition: selector.c:159
int nla_len(const struct nlattr *nla)
Return length of the payload .
Definition: attr.c:131
uint16_t minlen
Minimal length of payload required.
Definition: attr.h:65
int nl_send_simple(struct nl_sock *sk, int type, int flags, void *buf, size_t size)
Construct and transmit a Netlink message.
Definition: nl.c:576
struct nl_object * nl_cache_get_next(struct nl_object *obj)
Return the next element in the cache.
Definition: cache.c:145
int nlmsg_append(struct nl_msg *n, void *data, size_t len, int pad)
Append data to tail of a netlink message.
Definition: msg.c:442
int nl_wait_for_ack(struct nl_sock *sk)
Wait for ACK.
Definition: nl.c:1095
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:215
struct nl_msg * nlmsg_alloc_simple(int nlmsgtype, int flags)
Allocate a new netlink message.
Definition: msg.c:346
struct xfrmnl_sel * xfrmnl_sel_alloc()
Allocate new selector object.
Definition: selector.c:76
struct xfrmnl_sel * xfrmnl_sel_clone(struct xfrmnl_sel *sel)
Clone existing selector object.
Definition: selector.c:95
struct xfrmnl_ltime_cfg * xfrmnl_ltime_cfg_alloc()
Allocate new lifetime config object.
Definition: lifetime.c:74
Dumping parameters.
Definition: types.h:33
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_clone(struct xfrmnl_user_tmpl *utmpl)
Clone existing user template object.
Definition: template.c:89
struct xfrmnl_user_tmpl * xfrmnl_user_tmpl_alloc()
Allocate new user template object.
Definition: template.c:70
int xfrmnl_ltime_cfg_cmp(struct xfrmnl_ltime_cfg *a, struct xfrmnl_ltime_cfg *b)
Compares two lifetime config objects.
Definition: lifetime.c:154
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:915
int xfrmnl_user_tmpl_cmp(struct xfrmnl_user_tmpl *a, struct xfrmnl_user_tmpl *b)
Compares two user template objects.
Definition: template.c:141
int nl_send_auto(struct nl_sock *sk, struct nl_msg *msg)
Finalize and transmit Netlink message.
Definition: nl.c:512
unsigned int nl_addr_get_len(const struct nl_addr *addr)
Get length of binary address of abstract address object.
Definition: addr.c:905
Dump all attributes including statistics.
Definition: types.h:24
struct nl_object * nl_cache_get_first(struct nl_cache *cache)
Return the first element in the cache.
Definition: cache.c:119
void * nl_addr_get_binary_addr(const struct nl_addr *addr)
Get binary address of abstract address object.
Definition: addr.c:893
int nl_cache_alloc_and_fill(struct nl_cache_ops *ops, struct nl_sock *sock, struct nl_cache **result)
Allocate new cache and fill it.
Definition: cache.c:233
struct nlattr * nla_nest_start(struct nl_msg *msg, int attrtype)
Start a new level of nested attributes.
Definition: attr.c:790
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:951