]> git.proxmox.com Git - mirror_iproute2.git/blame - ip/ipxfrm.c
projects / mirror_iproute2.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'master' into net-next
[mirror_iproute2.git] / ip / ipxfrm.c
CommitLineData
c7699875 1/* $USAGI: $ */
2
3/*
4 * Copyright (C)2004 USAGI/WIDE Project
ae665a52 5 *
c7699875 6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
ae665a52 10 *
c7699875 11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
ae665a52 15 *
c7699875 16 * You should have received a copy of the GNU General Public License
4d98ab00 17 * along with this program; if not, see <http://www.gnu.org/licenses>.
c7699875 18 */
19/*
20 * based on ip.c, iproute.c
21 */
22/*
23 * Authors:
24 * Masahide NAKAMURA @USAGI
25 */
26
048bff6e 27#include <alloca.h>
c7699875 28#include <stdio.h>
29#include <stdlib.h>
30#include <string.h>
31#include <sys/types.h>
32#include <sys/socket.h>
33#include <time.h>
34#include <netdb.h>
c7699875 35#include <linux/netlink.h>
36#include <linux/rtnetlink.h>
c7699875 37
38#include "utils.h"
39#include "xfrm.h"
d1f28cf1 40#include "ip_common.h"
c7699875 41
15ac4cdc 42#define STRBUF_SIZE (128)
43#define STRBUF_CAT(buf, str) \
44 do { \
45 int rest = sizeof(buf) - 1 - strlen(buf); \
46 if (rest > 0) { \
47 int len = strlen(str); \
48 if (len > rest) \
49 len = rest; \
50 strncat(buf, str, len); \
51 buf[sizeof(buf) - 1] = '\0'; \
52 } \
56f5daac 53 } while (0);
15ac4cdc 54
c7699875 55struct xfrm_filter filter;
56
57static void usage(void) __attribute__((noreturn));
58
59static void usage(void)
60{
ae665a52 61 fprintf(stderr,
cbec0219
DW		 62 "Usage: ip xfrm XFRM-OBJECT { COMMAND | help }\n"
63 "where XFRM-OBJECT := state | policy | monitor\n");
c7699875 64 exit(-1);
65}
66
eaa34ee3 67/* This is based on utils.c(inet_addr_match) */
68int xfrm_addr_match(xfrm_address_t *x1, xfrm_address_t *x2, int bits)
69{
70 __u32 *a1 = (__u32 *)x1;
71 __u32 *a2 = (__u32 *)x2;
72 int words = bits >> 0x05;
73
74 bits &= 0x1f;
75
76 if (words)
77 if (memcmp(a1, a2, words << 2))
78 return -1;
79
80 if (bits) {
81 __u32 w1, w2;
82 __u32 mask;
83
84 w1 = a1[words];
85 w2 = a2[words];
86
87 mask = htonl((0xffffffff) << (0x20 - bits));
88
89 if ((w1 ^ w2) & mask)
90 return 1;
91 }
92
93 return 0;
94}
95
7ea4f5d3
MN		 96int xfrm_xfrmproto_is_ipsec(__u8 proto)
97{
98 return (proto == IPPROTO_ESP ||
99 proto == IPPROTO_AH ||
100 proto == IPPROTO_COMP);
101}
102
103int xfrm_xfrmproto_is_ro(__u8 proto)
104{
105 return (proto == IPPROTO_ROUTING ||
106 proto == IPPROTO_DSTOPTS);
107}
108
7809c616 109struct typeent {
110 const char *t_name;
111 int t_type;
112};
113
56f5daac 114static const struct typeent xfrmproto_types[] = {
eaa34ee3 115 { "esp", IPPROTO_ESP }, { "ah", IPPROTO_AH }, { "comp", IPPROTO_COMP },
7ea4f5d3 116 { "route2", IPPROTO_ROUTING }, { "hao", IPPROTO_DSTOPTS },
efe69c1b 117 { "ipsec-any", IPSEC_PROTO_ANY },
eaa34ee3 118 { NULL, -1 }
29aa4dd7 119};
120
121int xfrm_xfrmproto_getbyname(char *name)
122{
123 int i;
124
125 for (i = 0; ; i++) {
126 const struct typeent *t = &xfrmproto_types[i];
56f5daac 127
29aa4dd7 128 if (!t->t_name || t->t_type == -1)
129 break;
130
131 if (strcmp(t->t_name, name) == 0)
132 return t->t_type;
133 }
134
135 return -1;
136}
137
138const char *strxf_xfrmproto(__u8 proto)
139{
efe69c1b 140 static char str[16];
29aa4dd7 141 int i;
142
143 for (i = 0; ; i++) {
144 const struct typeent *t = &xfrmproto_types[i];
56f5daac 145
29aa4dd7 146 if (!t->t_name || t->t_type == -1)
147 break;
148
149 if (t->t_type == proto)
150 return t->t_name;
151 }
152
efe69c1b
MN		 153 sprintf(str, "%u", proto);
154 return str;
29aa4dd7 155}
156
56f5daac 157static const struct typeent algo_types[] = {
7809c616 158 { "enc", XFRMA_ALG_CRYPT }, { "auth", XFRMA_ALG_AUTH },
1758a81f 159 { "comp", XFRMA_ALG_COMP }, { "aead", XFRMA_ALG_AEAD },
f323f2a3 160 { "auth-trunc", XFRMA_ALG_AUTH_TRUNC },
1758a81f 161 { NULL, -1 }
7809c616 162};
163
164int xfrm_algotype_getbyname(char *name)
165{
166 int i;
167
168 for (i = 0; ; i++) {
169 const struct typeent *t = &algo_types[i];
56f5daac 170
7809c616 171 if (!t->t_name || t->t_type == -1)
172 break;
173
174 if (strcmp(t->t_name, name) == 0)
175 return t->t_type;
176 }
177
178 return -1;
179}
180
181const char *strxf_algotype(int type)
182{
efe69c1b 183 static char str[32];
7809c616 184 int i;
185
186 for (i = 0; ; i++) {
187 const struct typeent *t = &algo_types[i];
56f5daac 188
7809c616 189 if (!t->t_name || t->t_type == -1)
190 break;
191
192 if (t->t_type == type)
193 return t->t_name;
194 }
195
efe69c1b
MN		 196 sprintf(str, "%d", type);
197 return str;
7809c616 198}
199
eaa34ee3 200const char *strxf_mask8(__u8 mask)
c7699875 201{
202 static char str[16];
eaa34ee3 203 const int sn = sizeof(mask) * 8 - 1;
c7699875 204 __u8 b;
205 int i = 0;
206
207 for (b = (1 << sn); b > 0; b >>= 1)
eaa34ee3 208 str[i++] = ((b & mask) ? '1' : '0');
c7699875 209 str[i] = '\0';
210
211 return str;
212}
213
eaa34ee3 214const char *strxf_mask32(__u32 mask)
215{
216 static char str[16];
217
218 sprintf(str, "%.8x", mask);
219
220 return str;
221}
222
c7699875 223const char *strxf_share(__u8 share)
224{
225 static char str[32];
226
227 switch (share) {
228 case XFRM_SHARE_ANY:
229 strcpy(str, "any");
230 break;
231 case XFRM_SHARE_SESSION:
232 strcpy(str, "session");
233 break;
234 case XFRM_SHARE_USER:
235 strcpy(str, "user");
236 break;
237 case XFRM_SHARE_UNIQUE:
238 strcpy(str, "unique");
239 break;
240 default:
eaa34ee3 241 sprintf(str, "%u", share);
c7699875 242 break;
243 }
244
245 return str;
246}
247
ad273962 248const char *strxf_proto(__u8 proto)
249{
250 static char buf[32];
251 struct protoent *pp;
252 const char *p;
253
254 pp = getprotobynumber(proto);
255 if (pp)
256 p = pp->p_name;
257 else {
eaa34ee3 258 sprintf(buf, "%u", proto);
ad273962 259 p = buf;
260 }
261
262 return p;
263}
264
efe69c1b
MN		 265const char *strxf_ptype(__u8 ptype)
266{
267 static char str[16];
268
269 switch (ptype) {
270 case XFRM_POLICY_TYPE_MAIN:
271 strcpy(str, "main");
272 break;
273 case XFRM_POLICY_TYPE_SUB:
274 strcpy(str, "sub");
275 break;
276 default:
277 sprintf(str, "%u", ptype);
278 break;
279 }
280
281 return str;
282}
283
c7699875 284void xfrm_id_info_print(xfrm_address_t *saddr, struct xfrm_id *id,
eaa34ee3 285 __u8 mode, __u32 reqid, __u16 family, int force_spi,
15ac4cdc 286 FILE *fp, const char *prefix, const char *title)
c7699875 287{
15ac4cdc 288 if (title)
9a73e17d 289 fputs(title, fp);
c7699875 290
2e96d2cc
PS		 291 fprintf(fp, "src %s ", rt_addr_n2a(family, sizeof(*saddr), saddr));
292 fprintf(fp, "dst %s", rt_addr_n2a(family, sizeof(id->daddr), &id->daddr));
7809c616 293 fprintf(fp, "%s", _SL_);
c7699875 294
295 if (prefix)
9a73e17d 296 fputs(prefix, fp);
c7699875 297 fprintf(fp, "\t");
298
29aa4dd7 299 fprintf(fp, "proto %s ", strxf_xfrmproto(id->proto));
c7699875 300
eaa34ee3 301 if (show_stats > 0 || force_spi || id->spi) {
302 __u32 spi = ntohl(id->spi);
56f5daac 303
eaa34ee3 304 fprintf(fp, "spi 0x%08x", spi);
305 if (show_stats > 0)
306 fprintf(fp, "(%u)", spi);
307 fprintf(fp, " ");
308 }
c7699875 309
ad273962 310 fprintf(fp, "reqid %u", reqid);
311 if (show_stats > 0)
312 fprintf(fp, "(0x%08x)", reqid);
313 fprintf(fp, " ");
c7699875 314
7809c616 315 fprintf(fp, "mode ");
316 switch (mode) {
7ea4f5d3 317 case XFRM_MODE_TRANSPORT:
7809c616 318 fprintf(fp, "transport");
319 break;
7ea4f5d3 320 case XFRM_MODE_TUNNEL:
7809c616 321 fprintf(fp, "tunnel");
322 break;
7ea4f5d3
MN		 323 case XFRM_MODE_ROUTEOPTIMIZATION:
324 fprintf(fp, "ro");
325 break;
326 case XFRM_MODE_IN_TRIGGER:
327 fprintf(fp, "in_trigger");
328 break;
329 case XFRM_MODE_BEET:
34e099e2
SH		 330 fprintf(fp, "beet");
331 break;
7809c616 332 default:
333 fprintf(fp, "%u", mode);
334 break;
335 }
336 fprintf(fp, "%s", _SL_);
c7699875 337}
338
339static const char *strxf_limit(__u64 limit)
340{
341 static char str[32];
56f5daac 342
c7699875 343 if (limit == XFRM_INF)
344 strcpy(str, "(INF)");
345 else
b906243b 346 sprintf(str, "%llu", (unsigned long long) limit);
c7699875 347
348 return str;
349}
350
351void xfrm_stats_print(struct xfrm_stats *s, FILE *fp, const char *prefix)
352{
353 if (prefix)
9a73e17d 354 fputs(prefix, fp);
8a1c7fcb 355 fprintf(fp, "stats:%s", _SL_);
c7699875 356
357 if (prefix)
9a73e17d 358 fputs(prefix, fp);
0612519e 359 fprintf(fp, " replay-window %u replay %u failed %u%s",
8a1c7fcb 360 s->replay_window, s->replay, s->integrity_failed, _SL_);
c7699875 361}
362
363static const char *strxf_time(__u64 time)
364{
365 static char str[32];
c7699875 366
7809c616 367 if (time == 0)
368 strcpy(str, "-");
369 else {
370 time_t t;
371 struct tm *tp;
372
ae665a52 373 /* XXX: treat time in the same manner of kernel's
7809c616 374 * net/xfrm/xfrm_{user,state}.c
375 */
c7699875 376 t = (long)time;
377 tp = localtime(&t);
378
44d3eb25 379 strftime(str, sizeof(str), "%Y-%m-%d %T", tp);
c7699875 380 }
381
382 return str;
383}
384
385void xfrm_lifetime_print(struct xfrm_lifetime_cfg *cfg,
386 struct xfrm_lifetime_cur *cur,
387 FILE *fp, const char *prefix)
388{
389 if (cfg) {
390 if (prefix)
9a73e17d 391 fputs(prefix, fp);
56f5daac 392 fprintf(fp, "lifetime config:%s", _SL_);
c7699875 393
394 if (prefix)
9a73e17d 395 fputs(prefix, fp);
8a1c7fcb
SH		 396 fprintf(fp, " limit: soft %s(bytes),",
397 strxf_limit(cfg->soft_byte_limit));
398 fprintf(fp, " hard %s(bytes)%s",
399 strxf_limit(cfg->hard_byte_limit), _SL_);
c7699875 400
401 if (prefix)
9a73e17d 402 fputs(prefix, fp);
8a1c7fcb
SH		 403 fprintf(fp, " limit: soft %s(packets),",
404 strxf_limit(cfg->soft_packet_limit));
405 fprintf(fp, " hard %s(packets)%s",
406 strxf_limit(cfg->hard_packet_limit), _SL_);
c7699875 407
408 if (prefix)
9a73e17d 409 fputs(prefix, fp);
0612519e 410 fprintf(fp, " expire add: soft %llu(sec), hard %llu(sec)%s",
8a1c7fcb
SH		 411 (unsigned long long) cfg->soft_add_expires_seconds,
412 (unsigned long long) cfg->hard_add_expires_seconds,
413 _SL_);
c7699875 414
415 if (prefix)
9a73e17d 416 fputs(prefix, fp);
8a1c7fcb
SH		 417 fprintf(fp, " expire use: soft %llu(sec), hard %llu(sec)%s",
418 (unsigned long long) cfg->soft_use_expires_seconds,
419 (unsigned long long) cfg->hard_use_expires_seconds,
420 _SL_);
c7699875 421 }
422 if (cur) {
423 if (prefix)
9a73e17d 424 fputs(prefix, fp);
8a1c7fcb 425 fprintf(fp, "lifetime current:%s", _SL_);
c7699875 426
427 if (prefix)
9a73e17d 428 fputs(prefix, fp);
8a1c7fcb
SH		 429 fprintf(fp, " %llu(bytes), %llu(packets)%s",
430 (unsigned long long) cur->bytes,
431 (unsigned long long) cur->packets,
432 _SL_);
7809c616 433
c7699875 434 if (prefix)
9a73e17d 435 fputs(prefix, fp);
8a1c7fcb
SH		 436 fprintf(fp, " add %s ", strxf_time(cur->add_time));
437 fprintf(fp, "use %s%s", strxf_time(cur->use_time), _SL_);
c7699875 438 }
439}
440
441void xfrm_selector_print(struct xfrm_selector *sel, __u16 family,
442 FILE *fp, const char *prefix)
443{
c7699875 444 __u16 f;
445
446 f = sel->family;
447 if (f == AF_UNSPEC)
448 f = family;
449 if (f == AF_UNSPEC)
450 f = preferred_family;
451
452 if (prefix)
9a73e17d 453 fputs(prefix, fp);
c7699875 454
26dcdf3a 455 fprintf(fp, "src %s/%u ",
2e96d2cc 456 rt_addr_n2a(f, sizeof(sel->saddr), &sel->saddr),
ad273962 457 sel->prefixlen_s);
c7699875 458
26dcdf3a 459 fprintf(fp, "dst %s/%u ",
2e96d2cc 460 rt_addr_n2a(f, sizeof(sel->daddr), &sel->daddr),
ad273962 461 sel->prefixlen_d);
c7699875 462
7809c616 463 if (sel->proto)
464 fprintf(fp, "proto %s ", strxf_proto(sel->proto));
c70b36d2 465 switch (sel->proto) {
466 case IPPROTO_TCP:
467 case IPPROTO_UDP:
468 case IPPROTO_SCTP:
27356a5e 469 case IPPROTO_DCCP:
c70b36d2 470 default: /* XXX */
471 if (sel->sport_mask)
472 fprintf(fp, "sport %u ", ntohs(sel->sport));
473 if (sel->dport_mask)
474 fprintf(fp, "dport %u ", ntohs(sel->dport));
475 break;
476 case IPPROTO_ICMP:
477 case IPPROTO_ICMPV6:
478 /* type/code is stored at sport/dport in selector */
479 if (sel->sport_mask)
480 fprintf(fp, "type %u ", ntohs(sel->sport));
481 if (sel->dport_mask)
482 fprintf(fp, "code %u ", ntohs(sel->dport));
483 break;
4a9608e6
TT		 484 case IPPROTO_GRE:
485 if (sel->sport_mask || sel->dport_mask)
486 fprintf(fp, "key %u ",
487 (((__u32)ntohs(sel->sport)) << 16) +
488 ntohs(sel->dport));
489 break;
0bf0fbc4
MN		 490 case IPPROTO_MH:
491 if (sel->sport_mask)
492 fprintf(fp, "type %u ", ntohs(sel->sport));
493 if (sel->dport_mask) {
494 if (show_stats > 0)
495 fprintf(fp, "(dport) 0x%.4x ", sel->dport);
496 }
497 break;
c70b36d2 498 }
c7699875 499
dcb283c3
TG		 500 if (sel->ifindex > 0)
501 fprintf(fp, "dev %s ", ll_index_to_name(sel->ifindex));
c7699875 502
ad273962 503 if (show_stats > 0)
504 fprintf(fp, "uid %u", sel->user);
7809c616 505
506 fprintf(fp, "%s", _SL_);
c7699875 507}
508
1758a81f
HX		 509static void __xfrm_algo_print(struct xfrm_algo *algo, int type, int len,
510 FILE *fp, const char *prefix, int newline)
c7699875 511{
eaa34ee3 512 int keylen;
c7699875 513 int i;
514
515 if (prefix)
9a73e17d 516 fputs(prefix, fp);
c7699875 517
7809c616 518 fprintf(fp, "%s ", strxf_algotype(type));
eaa34ee3 519
520 if (len < sizeof(*algo)) {
521 fprintf(fp, "(ERROR truncated)");
522 goto fin;
523 }
524 len -= sizeof(*algo);
525
7809c616 526 fprintf(fp, "%s ", algo->alg_name);
c7699875 527
eaa34ee3 528 keylen = algo->alg_key_len / 8;
529 if (len < keylen) {
530 fprintf(fp, "(ERROR truncated)");
531 goto fin;
532 }
533
8dbe67d2
DW		 534 if (keylen > 0) {
535 fprintf(fp, "0x");
56f5daac 536 for (i = 0; i < keylen; i++)
8dbe67d2 537 fprintf(fp, "%.2x", (unsigned char)algo->alg_key[i]);
c7699875 538
8dbe67d2
DW		 539 if (show_stats > 0)
540 fprintf(fp, " (%d bits)", algo->alg_key_len);
541 }
7809c616 542
eaa34ee3 543 fin:
1758a81f
HX		 544 if (newline)
545 fprintf(fp, "%s", _SL_);
546}
547
548static inline void xfrm_algo_print(struct xfrm_algo *algo, int type, int len,
549 FILE *fp, const char *prefix)
550{
551 return __xfrm_algo_print(algo, type, len, fp, prefix, 1);
552}
553
554static void xfrm_aead_print(struct xfrm_algo_aead *algo, int len,
555 FILE *fp, const char *prefix)
556{
048bff6e 557 struct xfrm_algo *base_algo = alloca(sizeof(*base_algo) + algo->alg_key_len / 8);
1758a81f 558
048bff6e
MF		 559 memcpy(base_algo->alg_name, algo->alg_name, sizeof(base_algo->alg_name));
560 base_algo->alg_key_len = algo->alg_key_len;
561 memcpy(base_algo->alg_key, algo->alg_key, algo->alg_key_len / 8);
1758a81f 562
048bff6e 563 __xfrm_algo_print(base_algo, XFRMA_ALG_AEAD, len, fp, prefix, 0);
1758a81f
HX		 564
565 fprintf(fp, " %d", algo->alg_icv_len);
566
7809c616 567 fprintf(fp, "%s", _SL_);
c7699875 568}
569
f323f2a3
ND		 570static void xfrm_auth_trunc_print(struct xfrm_algo_auth *algo, int len,
571 FILE *fp, const char *prefix)
572{
048bff6e 573 struct xfrm_algo *base_algo = alloca(sizeof(*base_algo) + algo->alg_key_len / 8);
f323f2a3 574
048bff6e
MF		 575 memcpy(base_algo->alg_name, algo->alg_name, sizeof(base_algo->alg_name));
576 base_algo->alg_key_len = algo->alg_key_len;
577 memcpy(base_algo->alg_key, algo->alg_key, algo->alg_key_len / 8);
f323f2a3 578
048bff6e 579 __xfrm_algo_print(base_algo, XFRMA_ALG_AUTH_TRUNC, len, fp, prefix, 0);
f323f2a3
ND		 580
581 fprintf(fp, " %d", algo->alg_trunc_len);
582
583 fprintf(fp, "%s", _SL_);
584}
585
eaa34ee3 586static void xfrm_tmpl_print(struct xfrm_user_tmpl *tmpls, int len,
656111b2 587 FILE *fp, const char *prefix)
c7699875 588{
eaa34ee3 589 int ntmpls = len / sizeof(struct xfrm_user_tmpl);
c7699875 590 int i;
591
eaa34ee3 592 if (ntmpls <= 0) {
593 if (prefix)
9a73e17d 594 fputs(prefix, fp);
eaa34ee3 595 fprintf(fp, "(ERROR \"tmpl\" truncated)");
596 fprintf(fp, "%s", _SL_);
597 return;
598 }
599
c7699875 600 for (i = 0; i < ntmpls; i++) {
601 struct xfrm_user_tmpl *tmpl = &tmpls[i];
602
603 if (prefix)
9a73e17d 604 fputs(prefix, fp);
ad273962 605
c7699875 606 xfrm_id_info_print(&tmpl->saddr, &tmpl->id, tmpl->mode,
b9ab720e 607 tmpl->reqid, tmpl->family, 0, fp, prefix, "tmpl ");
eaa34ee3 608
609 if (show_stats > 0 || tmpl->optional) {
610 if (prefix)
9a73e17d 611 fputs(prefix, fp);
eaa34ee3 612 fprintf(fp, "\t");
613 switch (tmpl->optional) {
614 case 0:
615 if (show_stats > 0)
616 fprintf(fp, "level required ");
617 break;
618 case 1:
619 fprintf(fp, "level use ");
620 break;
621 default:
622 fprintf(fp, "level %u ", tmpl->optional);
623 break;
624 }
c7699875 625
7809c616 626 if (show_stats > 0)
eaa34ee3 627 fprintf(fp, "share %s ", strxf_share(tmpl->share));
628
629 fprintf(fp, "%s", _SL_);
ad273962 630 }
ad273962 631
632 if (show_stats > 0) {
eaa34ee3 633 if (prefix)
9a73e17d 634 fputs(prefix, fp);
eaa34ee3 635 fprintf(fp, "\t");
636 fprintf(fp, "%s-mask %s ",
7809c616 637 strxf_algotype(XFRMA_ALG_CRYPT),
eaa34ee3 638 strxf_mask32(tmpl->ealgos));
639 fprintf(fp, "%s-mask %s ",
7809c616 640 strxf_algotype(XFRMA_ALG_AUTH),
eaa34ee3 641 strxf_mask32(tmpl->aalgos));
642 fprintf(fp, "%s-mask %s",
7809c616 643 strxf_algotype(XFRMA_ALG_COMP),
eaa34ee3 644 strxf_mask32(tmpl->calgos));
645
646 fprintf(fp, "%s", _SL_);
ad273962 647 }
c7699875 648 }
649}
650
f6fd52e6
JHS		 651int xfrm_parse_mark(struct xfrm_mark *mark, int *argcp, char ***argvp)
652{
653 int argc = *argcp;
654 char **argv = *argvp;
655
656 NEXT_ARG();
657 if (get_u32(&mark->v, *argv, 0)) {
e8740e42 658 invarg("MARK value is invalid\n", *argv);
f6fd52e6
JHS		 659 }
660 if (argc > 1)
661 NEXT_ARG();
662 else { /* last entry on parse line */
663 mark->m = 0xffffffff;
664 goto done;
665 }
666
667 if (strcmp(*argv, "mask") == 0) {
668 NEXT_ARG();
669 if (get_u32(&mark->m, *argv, 0)) {
e8740e42 670 invarg("MASK value is invalid\n", *argv);
f6fd52e6
JHS		 671 }
672 } else {
673 mark->m = 0xffffffff;
674 PREV_ARG();
675 }
676
677done:
678 *argcp = argc;
679 *argvp = argv;
680
681 return 0;
682}
683
bcf32819 684void xfrm_xfrma_print(struct rtattr *tb[], __u16 family,
c7699875 685 FILE *fp, const char *prefix)
686{
f6fd52e6
JHS		 687 if (tb[XFRMA_MARK]) {
688 struct rtattr *rta = tb[XFRMA_MARK];
84da4099 689 struct xfrm_mark *m = RTA_DATA(rta);
56f5daac 690
6f4cad91 691 fprintf(fp, "\tmark %#x/%#x", m->v, m->m);
692 fprintf(fp, "%s", _SL_);
f6fd52e6
JHS		 693 }
694
f323f2a3 695 if (tb[XFRMA_ALG_AUTH] && !tb[XFRMA_ALG_AUTH_TRUNC]) {
bcf32819 696 struct rtattr *rta = tb[XFRMA_ALG_AUTH];
56f5daac 697
84da4099 698 xfrm_algo_print(RTA_DATA(rta),
5cf576d9 699 XFRMA_ALG_AUTH, RTA_PAYLOAD(rta), fp, prefix);
bcf32819 700 }
c7699875 701
f323f2a3
ND		 702 if (tb[XFRMA_ALG_AUTH_TRUNC]) {
703 struct rtattr *rta = tb[XFRMA_ALG_AUTH_TRUNC];
56f5daac 704
84da4099 705 xfrm_auth_trunc_print(RTA_DATA(rta),
f323f2a3
ND		 706 RTA_PAYLOAD(rta), fp, prefix);
707 }
708
1758a81f
HX		 709 if (tb[XFRMA_ALG_AEAD]) {
710 struct rtattr *rta = tb[XFRMA_ALG_AEAD];
56f5daac 711
9f1370c0 712 xfrm_aead_print(RTA_DATA(rta),
1758a81f
HX		 713 RTA_PAYLOAD(rta), fp, prefix);
714 }
715
bcf32819 716 if (tb[XFRMA_ALG_CRYPT]) {
717 struct rtattr *rta = tb[XFRMA_ALG_CRYPT];
56f5daac 718
84da4099 719 xfrm_algo_print(RTA_DATA(rta),
5cf576d9 720 XFRMA_ALG_CRYPT, RTA_PAYLOAD(rta), fp, prefix);
bcf32819 721 }
eaa34ee3 722
bcf32819 723 if (tb[XFRMA_ALG_COMP]) {
724 struct rtattr *rta = tb[XFRMA_ALG_COMP];
56f5daac 725
84da4099 726 xfrm_algo_print(RTA_DATA(rta),
5cf576d9 727 XFRMA_ALG_COMP, RTA_PAYLOAD(rta), fp, prefix);
bcf32819 728 }
eaa34ee3 729
bcf32819 730 if (tb[XFRMA_ENCAP]) {
731 struct xfrm_encap_tmpl *e;
eaa34ee3 732
bcf32819 733 if (prefix)
9a73e17d 734 fputs(prefix, fp);
bcf32819 735 fprintf(fp, "encap ");
eaa34ee3 736
bcf32819 737 if (RTA_PAYLOAD(tb[XFRMA_ENCAP]) < sizeof(*e)) {
738 fprintf(fp, "(ERROR truncated)");
7809c616 739 fprintf(fp, "%s", _SL_);
bcf32819 740 return;
c7699875 741 }
84da4099 742 e = RTA_DATA(tb[XFRMA_ENCAP]);
bcf32819 743
5cf576d9
SH		 744 fprintf(fp, "type ");
745 switch (e->encap_type) {
746 case 1:
747 fprintf(fp, "espinudp-nonike ");
748 break;
749 case 2:
750 fprintf(fp, "espinudp ");
751 break;
752 default:
753 fprintf(fp, "%u ", e->encap_type);
754 break;
755 }
bcf32819 756 fprintf(fp, "sport %u ", ntohs(e->encap_sport));
757 fprintf(fp, "dport %u ", ntohs(e->encap_dport));
758
bcf32819 759 fprintf(fp, "addr %s",
2e96d2cc 760 rt_addr_n2a(family, sizeof(e->encap_oa), &e->encap_oa));
bcf32819 761 fprintf(fp, "%s", _SL_);
762 }
763
764 if (tb[XFRMA_TMPL]) {
765 struct rtattr *rta = tb[XFRMA_TMPL];
56f5daac 766
84da4099 767 xfrm_tmpl_print(RTA_DATA(rta),
656111b2 768 RTA_PAYLOAD(rta), fp, prefix);
c7699875 769 }
7ea4f5d3
MN		 770
771 if (tb[XFRMA_COADDR]) {
9f1370c0 772 const xfrm_address_t *coa;
7ea4f5d3
MN		 773
774 if (prefix)
9a73e17d 775 fputs(prefix, fp);
7ea4f5d3
MN		 776 fprintf(fp, "coa ");
777
9f1370c0 778 coa = RTA_DATA(tb[XFRMA_COADDR]);
7ea4f5d3
MN		 779 if (RTA_PAYLOAD(tb[XFRMA_COADDR]) < sizeof(*coa)) {
780 fprintf(fp, "(ERROR truncated)");
781 fprintf(fp, "%s", _SL_);
782 return;
783 }
784
7ea4f5d3 785 fprintf(fp, "%s",
2e96d2cc 786 rt_addr_n2a(family, sizeof(*coa), coa));
7ea4f5d3
MN		 787 fprintf(fp, "%s", _SL_);
788 }
789
790 if (tb[XFRMA_LASTUSED]) {
791 __u64 lastused;
792
793 if (prefix)
9a73e17d 794 fputs(prefix, fp);
7ea4f5d3
MN		 795 fprintf(fp, "lastused ");
796
797 if (RTA_PAYLOAD(tb[XFRMA_LASTUSED]) < sizeof(lastused)) {
798 fprintf(fp, "(ERROR truncated)");
799 fprintf(fp, "%s", _SL_);
800 return;
801 }
802
ff24746c 803 lastused = rta_getattr_u64(tb[XFRMA_LASTUSED]);
7ea4f5d3
MN		 804
805 fprintf(fp, "%s", strxf_time(lastused));
806 fprintf(fp, "%s", _SL_);
807 }
f6fd52e6 808
0151b56d 809 if (tb[XFRMA_REPLAY_VAL]) {
810 struct xfrm_replay_state *replay;
811
812 if (prefix)
813 fputs(prefix, fp);
814 fprintf(fp, "anti-replay context: ");
815
816 if (RTA_PAYLOAD(tb[XFRMA_REPLAY_VAL]) < sizeof(*replay)) {
817 fprintf(fp, "(ERROR truncated)");
818 fprintf(fp, "%s", _SL_);
819 return;
820 }
821
9f1370c0 822 replay = RTA_DATA(tb[XFRMA_REPLAY_VAL]);
0151b56d 823 fprintf(fp, "seq 0x%x, oseq 0x%x, bitmap 0x%08x",
824 replay->seq, replay->oseq, replay->bitmap);
825 fprintf(fp, "%s", _SL_);
826 }
827
828 if (tb[XFRMA_REPLAY_ESN_VAL]) {
829 struct xfrm_replay_state_esn *replay;
830 unsigned int i, j;
831
832 if (prefix)
833 fputs(prefix, fp);
834 fprintf(fp, "anti-replay esn context:");
835
836 if (RTA_PAYLOAD(tb[XFRMA_REPLAY_ESN_VAL]) < sizeof(*replay)) {
837 fprintf(fp, "(ERROR truncated)");
838 fprintf(fp, "%s", _SL_);
839 return;
840 }
841 fprintf(fp, "%s", _SL_);
842
9f1370c0 843 replay = RTA_DATA(tb[XFRMA_REPLAY_ESN_VAL]);
0151b56d 844 if (prefix)
845 fputs(prefix, fp);
846 fprintf(fp, " seq-hi 0x%x, seq 0x%x, oseq-hi 0x%0x, oseq 0x%0x",
847 replay->seq_hi, replay->seq, replay->oseq_hi,
848 replay->oseq);
849 fprintf(fp, "%s", _SL_);
850 if (prefix)
851 fputs(prefix, fp);
852 fprintf(fp, " replay_window %u, bitmap-length %u",
853 replay->replay_window, replay->bmp_len);
854 for (i = replay->bmp_len, j = 0; i; i--) {
855 if (j++ % 8 == 0) {
856 fprintf(fp, "%s", _SL_);
857 if (prefix)
858 fputs(prefix, fp);
859 fprintf(fp, " ");
860 }
861 fprintf(fp, "%08x ", replay->bmp[i - 1]);
862 }
863 fprintf(fp, "%s", _SL_);
864 }
cfd2e727
BP		 865 if (tb[XFRMA_OFFLOAD_DEV]) {
866 struct xfrm_user_offload *xuo;
867
868 if (prefix)
869 fputs(prefix, fp);
870 fprintf(fp, "crypto offload parameters: ");
871
872 if (RTA_PAYLOAD(tb[XFRMA_OFFLOAD_DEV]) < sizeof(*xuo)) {
873 fprintf(fp, "(ERROR truncated)");
874 fprintf(fp, "%s", _SL_);
875 return;
876 }
877
878 xuo = (struct xfrm_user_offload *)
879 RTA_DATA(tb[XFRMA_OFFLOAD_DEV]);
880 fprintf(fp, "dev %s dir %s", ll_index_to_name(xuo->ifindex),
881 (xuo->flags & XFRM_OFFLOAD_INBOUND) ? "in" : "out");
882 fprintf(fp, "%s", _SL_);
883 }
c7699875 884}
885
15ac4cdc 886static int xfrm_selector_iszero(struct xfrm_selector *s)
887{
d17b136f 888 struct xfrm_selector s0 = {};
15ac4cdc 889
890 return (memcmp(&s0, s, sizeof(s0)) == 0);
891}
892
893void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo,
894 struct rtattr *tb[], FILE *fp, const char *prefix,
895 const char *title)
896{
d17b136f 897 char buf[STRBUF_SIZE] = {};
7ea4f5d3 898 int force_spi = xfrm_xfrmproto_is_ipsec(xsinfo->id.proto);
15ac4cdc 899
15ac4cdc 900 xfrm_id_info_print(&xsinfo->saddr, &xsinfo->id, xsinfo->mode,
7ea4f5d3
MN		 901 xsinfo->reqid, xsinfo->family, force_spi, fp,
902 prefix, title);
15ac4cdc 903
904 if (prefix)
905 STRBUF_CAT(buf, prefix);
906 STRBUF_CAT(buf, "\t");
907
9a73e17d 908 fputs(buf, fp);
15ac4cdc 909 fprintf(fp, "replay-window %u ", xsinfo->replay_window);
910 if (show_stats > 0)
911 fprintf(fp, "seq 0x%08u ", xsinfo->seq);
912 if (show_stats > 0 || xsinfo->flags) {
913 __u8 flags = xsinfo->flags;
914
915 fprintf(fp, "flag ");
916 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_NOECN, "noecn");
917 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_DECAP_DSCP, "decap-dscp");
c1fa2253 918 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_NOPMTUDISC, "nopmtudisc");
7ea4f5d3 919 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_WILDRECV, "wildrecv");
15bb82c6
AB		 920 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ICMP, "icmp");
921 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_AF_UNSPEC, "af-unspec");
98f5519c 922 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ALIGN4, "align4");
0151b56d 923 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ESN, "esn");
15ac4cdc 924 if (flags)
925 fprintf(fp, "%x", flags);
15ac4cdc 926 }
1ed509bb 927 if (show_stats > 0 && tb[XFRMA_SA_EXTRA_FLAGS]) {
9f1370c0 928 __u32 extra_flags = rta_getattr_u32(tb[XFRMA_SA_EXTRA_FLAGS]);
dc8867d0
ND		 929
930 fprintf(fp, "extra_flag ");
931 XFRM_FLAG_PRINT(fp, extra_flags,
932 XFRM_SA_XFLAG_DONT_ENCAP_DSCP,
933 "dont-encap-dscp");
934 if (extra_flags)
935 fprintf(fp, "%x", extra_flags);
936 }
c1fa2253
MN		 937 if (show_stats > 0)
938 fprintf(fp, " (0x%s)", strxf_mask8(xsinfo->flags));
15ac4cdc 939 fprintf(fp, "%s", _SL_);
940
941 xfrm_xfrma_print(tb, xsinfo->family, fp, buf);
942
943 if (!xfrm_selector_iszero(&xsinfo->sel)) {
944 char sbuf[STRBUF_SIZE];
945
946 memcpy(sbuf, buf, sizeof(sbuf));
947 STRBUF_CAT(sbuf, "sel ");
948
949 xfrm_selector_print(&xsinfo->sel, xsinfo->family, fp, sbuf);
950 }
951
952 if (show_stats > 0) {
953 xfrm_lifetime_print(&xsinfo->lft, &xsinfo->curlft, fp, buf);
954 xfrm_stats_print(&xsinfo->stats, fp, buf);
955 }
b2bb289a
JL		 956
957 if (tb[XFRMA_SEC_CTX]) {
958 struct xfrm_user_sec_ctx *sctx;
959
960 fprintf(fp, "\tsecurity context ");
961
962 if (RTA_PAYLOAD(tb[XFRMA_SEC_CTX]) < sizeof(*sctx))
963 fprintf(fp, "(ERROR truncated)");
964
9f1370c0 965 sctx = RTA_DATA(tb[XFRMA_SEC_CTX]);
b2bb289a
JL		 966
967 fprintf(fp, "%s %s", (char *)(sctx + 1), _SL_);
968 }
969
15ac4cdc 970}
971
972void xfrm_policy_info_print(struct xfrm_userpolicy_info *xpinfo,
973 struct rtattr *tb[], FILE *fp, const char *prefix,
974 const char *title)
975{
d17b136f 976 char buf[STRBUF_SIZE] = {};
15ac4cdc 977
978 xfrm_selector_print(&xpinfo->sel, preferred_family, fp, title);
979
b2bb289a
JL		 980 if (tb[XFRMA_SEC_CTX]) {
981 struct xfrm_user_sec_ctx *sctx;
982
983 fprintf(fp, "\tsecurity context ");
984
985 if (RTA_PAYLOAD(tb[XFRMA_SEC_CTX]) < sizeof(*sctx))
986 fprintf(fp, "(ERROR truncated)");
987
9f1370c0 988 sctx = RTA_DATA(tb[XFRMA_SEC_CTX]);
b2bb289a
JL		 989
990 fprintf(fp, "%s ", (char *)(sctx + 1));
991 fprintf(fp, "%s", _SL_);
992 }
993
15ac4cdc 994 if (prefix)
995 STRBUF_CAT(buf, prefix);
996 STRBUF_CAT(buf, "\t");
997
9a73e17d 998 fputs(buf, fp);
66abc090
UW		 999 if (xpinfo->dir >= XFRM_POLICY_MAX) {
1000 xpinfo->dir -= XFRM_POLICY_MAX;
1001 fprintf(fp, "socket ");
1002 } else
1003 fprintf(fp, "dir ");
1004
15ac4cdc 1005 switch (xpinfo->dir) {
1006 case XFRM_POLICY_IN:
1007 fprintf(fp, "in");
1008 break;
1009 case XFRM_POLICY_OUT:
1010 fprintf(fp, "out");
1011 break;
1012 case XFRM_POLICY_FWD:
1013 fprintf(fp, "fwd");
1014 break;
1015 default:
1016 fprintf(fp, "%u", xpinfo->dir);
1017 break;
1018 }
1019 fprintf(fp, " ");
1020
1021 switch (xpinfo->action) {
1022 case XFRM_POLICY_ALLOW:
1023 if (show_stats > 0)
1024 fprintf(fp, "action allow ");
1025 break;
1026 case XFRM_POLICY_BLOCK:
1027 fprintf(fp, "action block ");
1028 break;
1029 default:
1030 fprintf(fp, "action %u ", xpinfo->action);
1031 break;
1032 }
1033
1034 if (show_stats)
1035 fprintf(fp, "index %u ", xpinfo->index);
1036 fprintf(fp, "priority %u ", xpinfo->priority);
972938e9 1037
972938e9
MN		 1038 if (tb[XFRMA_POLICY_TYPE]) {
1039 struct xfrm_userpolicy_type *upt;
1040
efe69c1b
MN		 1041 fprintf(fp, "ptype ");
1042
972938e9
MN		 1043 if (RTA_PAYLOAD(tb[XFRMA_POLICY_TYPE]) < sizeof(*upt))
1044 fprintf(fp, "(ERROR truncated)");
1045
9f1370c0 1046 upt = RTA_DATA(tb[XFRMA_POLICY_TYPE]);
efe69c1b 1047 fprintf(fp, "%s ", strxf_ptype(upt->type));
972938e9
MN		 1048 }
1049
c1fa2253 1050 if (show_stats > 0)
15ac4cdc 1051 fprintf(fp, "share %s ", strxf_share(xpinfo->share));
c1fa2253
MN		 1052
1053 if (show_stats > 0 || xpinfo->flags) {
1054 __u8 flags = xpinfo->flags;
1055
1056 fprintf(fp, "flag ");
1057 XFRM_FLAG_PRINT(fp, flags, XFRM_POLICY_LOCALOK, "localok");
c0635644 1058 XFRM_FLAG_PRINT(fp, flags, XFRM_POLICY_ICMP, "icmp");
c1fa2253
MN		 1059 if (flags)
1060 fprintf(fp, "%x", flags);
15ac4cdc 1061 }
c1fa2253
MN		 1062 if (show_stats > 0)
1063 fprintf(fp, " (0x%s)", strxf_mask8(xpinfo->flags));
15ac4cdc 1064 fprintf(fp, "%s", _SL_);
1065
1066 if (show_stats > 0)
1067 xfrm_lifetime_print(&xpinfo->lft, &xpinfo->curlft, fp, buf);
1068
1069 xfrm_xfrma_print(tb, xpinfo->sel.family, fp, buf);
1070}
1071
c7699875 1072int xfrm_id_parse(xfrm_address_t *saddr, struct xfrm_id *id, __u16 *family,
7809c616 1073 int loose, int *argcp, char ***argvp)
c7699875 1074{
1075 int argc = *argcp;
1076 char **argv = *argvp;
d17b136f
PS		 1077 inet_prefix dst = {};
1078 inet_prefix src = {};
c7699875 1079
1080 while (1) {
1081 if (strcmp(*argv, "src") == 0) {
1082 NEXT_ARG();
1083
1084 get_prefix(&src, *argv, preferred_family);
1085 if (src.family == AF_UNSPEC)
e8740e42 1086 invarg("value after \"src\" has an unrecognized address family", *argv);
c7699875 1087 if (family)
1088 *family = src.family;
1089
1090 memcpy(saddr, &src.data, sizeof(*saddr));
1091
1092 filter.id_src_mask = src.bitlen;
1093
1094 } else if (strcmp(*argv, "dst") == 0) {
1095 NEXT_ARG();
1096
1097 get_prefix(&dst, *argv, preferred_family);
1098 if (dst.family == AF_UNSPEC)
e8740e42 1099 invarg("value after \"dst\" has an unrecognized address family", *argv);
c7699875 1100 if (family)
1101 *family = dst.family;
1102
1103 memcpy(&id->daddr, &dst.data, sizeof(id->daddr));
1104
1105 filter.id_dst_mask = dst.bitlen;
1106
1107 } else if (strcmp(*argv, "proto") == 0) {
29aa4dd7 1108 int ret;
c7699875 1109
1110 NEXT_ARG();
1111
29aa4dd7 1112 ret = xfrm_xfrmproto_getbyname(*argv);
1113 if (ret < 0)
e8740e42 1114 invarg("XFRM-PROTO value is invalid", *argv);
c7699875 1115
29aa4dd7 1116 id->proto = (__u8)ret;
c7699875 1117
1118 filter.id_proto_mask = XFRM_FILTER_MASK_FULL;
1119
1120 } else if (strcmp(*argv, "spi") == 0) {
c7699875 1121 NEXT_ARG();
9f7401fa 1122 if (get_be32(&id->spi, *argv, 0))
e8740e42 1123 invarg("SPI value is invalid", *argv);
c7699875 1124
c7699875 1125 filter.id_spi_mask = XFRM_FILTER_MASK_FULL;
1126
1127 } else {
1128 PREV_ARG(); /* back track */
1129 break;
1130 }
1131
1132 if (!NEXT_ARG_OK())
1133 break;
1134 NEXT_ARG();
1135 }
1136
1137 if (src.family && dst.family && (src.family != dst.family))
e8740e42 1138 invarg("the same address family is required between values after \"src\" and \"dst\"", *argv);
c7699875 1139
1d26e1fe
DW		 1140 if (id->spi && id->proto) {
1141 if (xfrm_xfrmproto_is_ro(id->proto)) {
1142 fprintf(stderr, "\"spi\" is invalid with XFRM-PROTO value \"%s\"\n",
56f5daac 1143 strxf_xfrmproto(id->proto));
1d26e1fe
DW		 1144 exit(1);
1145 } else if (id->proto == IPPROTO_COMP && ntohl(id->spi) >= 0x10000) {
1146 fprintf(stderr, "SPI value is too large with XFRM-PROTO value \"%s\"\n",
56f5daac 1147 strxf_xfrmproto(id->proto));
1d26e1fe
DW		 1148 exit(1);
1149 }
1150 }
1151
29aa4dd7 1152 if (loose == 0 && id->proto == 0)
cbec0219 1153 missarg("XFRM-PROTO");
c7699875 1154 if (argc == *argcp)
1155 missarg("ID");
1156
1157 *argcp = argc;
1158 *argvp = argv;
1159
1160 return 0;
1161}
1162
1163int xfrm_mode_parse(__u8 *mode, int *argcp, char ***argvp)
1164{
1165 int argc = *argcp;
1166 char **argv = *argvp;
1167
1168 if (matches(*argv, "transport") == 0)
7ea4f5d3 1169 *mode = XFRM_MODE_TRANSPORT;
c7699875 1170 else if (matches(*argv, "tunnel") == 0)
7ea4f5d3
MN		 1171 *mode = XFRM_MODE_TUNNEL;
1172 else if (matches(*argv, "ro") == 0)
1173 *mode = XFRM_MODE_ROUTEOPTIMIZATION;
1174 else if (matches(*argv, "in_trigger") == 0)
1175 *mode = XFRM_MODE_IN_TRIGGER;
34e099e2 1176 else if (matches(*argv, "beet") == 0)
7ea4f5d3 1177 *mode = XFRM_MODE_BEET;
c7699875 1178 else
e8740e42 1179 invarg("MODE value is invalid", *argv);
c7699875 1180
1181 *argcp = argc;
1182 *argvp = argv;
1183
1184 return 0;
1185}
1186
5cf576d9
SH		 1187int xfrm_encap_type_parse(__u16 *type, int *argcp, char ***argvp)
1188{
1189 int argc = *argcp;
1190 char **argv = *argvp;
1191
1192 if (strcmp(*argv, "espinudp-nonike") == 0)
1193 *type = 1;
1194 else if (strcmp(*argv, "espinudp") == 0)
1195 *type = 2;
1196 else
e8740e42 1197 invarg("ENCAP-TYPE value is invalid", *argv);
5cf576d9
SH		 1198
1199 *argcp = argc;
1200 *argvp = argv;
1201
1202 return 0;
1203}
1204
c7699875 1205/* NOTE: reqid is used by host-byte order */
1206int xfrm_reqid_parse(__u32 *reqid, int *argcp, char ***argvp)
1207{
1208 int argc = *argcp;
1209 char **argv = *argvp;
1210
1211 if (get_u32(reqid, *argv, 0))
e8740e42 1212 invarg("REQID value is invalid", *argv);
c7699875 1213
1214 *argcp = argc;
1215 *argvp = argv;
1216
1217 return 0;
1218}
1219
1220static int xfrm_selector_upspec_parse(struct xfrm_selector *sel,
1221 int *argcp, char ***argvp)
1222{
1223 int argc = *argcp;
1224 char **argv = *argvp;
c70b36d2 1225 char *sportp = NULL;
1226 char *dportp = NULL;
1227 char *typep = NULL;
1228 char *codep = NULL;
4a9608e6 1229 char *grekey = NULL;
c7699875 1230
1231 while (1) {
1232 if (strcmp(*argv, "proto") == 0) {
7809c616 1233 __u8 upspec;
1234
c7699875 1235 NEXT_ARG();
1236
1237 if (strcmp(*argv, "any") == 0)
1238 upspec = 0;
1239 else {
1240 struct protoent *pp;
56f5daac 1241
c7699875 1242 pp = getprotobyname(*argv);
1243 if (pp)
1244 upspec = pp->p_proto;
1245 else {
1246 if (get_u8(&upspec, *argv, 0))
e8740e42 1247 invarg("PROTO value is invalid", *argv);
c7699875 1248 }
1249 }
1250 sel->proto = upspec;
1251
1252 filter.upspec_proto_mask = XFRM_FILTER_MASK_FULL;
1253
1254 } else if (strcmp(*argv, "sport") == 0) {
c70b36d2 1255 sportp = *argv;
1256
c7699875 1257 NEXT_ARG();
1258
9f7401fa 1259 if (get_be16(&sel->sport, *argv, 0))
e8740e42 1260 invarg("value after \"sport\" is invalid", *argv);
c7699875 1261 if (sel->sport)
1262 sel->sport_mask = ~((__u16)0);
1263
1264 filter.upspec_sport_mask = XFRM_FILTER_MASK_FULL;
1265
1266 } else if (strcmp(*argv, "dport") == 0) {
c70b36d2 1267 dportp = *argv;
1268
c7699875 1269 NEXT_ARG();
1270
9f7401fa 1271 if (get_be16(&sel->dport, *argv, 0))
e8740e42 1272 invarg("value after \"dport\" is invalid", *argv);
c7699875 1273 if (sel->dport)
1274 sel->dport_mask = ~((__u16)0);
1275
1276 filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL;
1277
c70b36d2 1278 } else if (strcmp(*argv, "type") == 0) {
1279 typep = *argv;
1280
1281 NEXT_ARG();
1282
1283 if (get_u16(&sel->sport, *argv, 0) ||
1284 (sel->sport & ~((__u16)0xff)))
e8740e42 1285 invarg("value after \"type\" is invalid", *argv);
c70b36d2 1286 sel->sport = htons(sel->sport);
1287 sel->sport_mask = ~((__u16)0);
1288
1289 filter.upspec_sport_mask = XFRM_FILTER_MASK_FULL;
1290
1291
1292 } else if (strcmp(*argv, "code") == 0) {
1293 codep = *argv;
1294
1295 NEXT_ARG();
1296
1297 if (get_u16(&sel->dport, *argv, 0) ||
1298 (sel->dport & ~((__u16)0xff)))
e8740e42 1299 invarg("value after \"code\" is invalid", *argv);
c70b36d2 1300 sel->dport = htons(sel->dport);
1301 sel->dport_mask = ~((__u16)0);
1302
1303 filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL;
1304
4a9608e6 1305 } else if (strcmp(*argv, "key") == 0) {
56f5daac 1306 unsigned int uval;
4a9608e6
TT		 1307
1308 grekey = *argv;
1309
1310 NEXT_ARG();
1311
1312 if (strchr(*argv, '.'))
1313 uval = htonl(get_addr32(*argv));
1314 else {
56f5daac 1315 if (get_unsigned(&uval, *argv, 0) < 0) {
e8740e42 1316 fprintf(stderr, "value after \"key\" is invalid\n");
4a9608e6
TT		 1317 exit(-1);
1318 }
1319 }
1320
1321 sel->sport = htons(uval >> 16);
1322 sel->dport = htons(uval & 0xffff);
1323 sel->sport_mask = ~((__u16)0);
1324 sel->dport_mask = ~((__u16)0);
1325
1326 filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL;
1327
c7699875 1328 } else {
1329 PREV_ARG(); /* back track */
1330 break;
1331 }
1332
1333 if (!NEXT_ARG_OK())
1334 break;
1335 NEXT_ARG();
1336 }
1337 if (argc == *argcp)
1338 missarg("UPSPEC");
c70b36d2 1339 if (sportp || dportp) {
1340 switch (sel->proto) {
1341 case IPPROTO_TCP:
1342 case IPPROTO_UDP:
1343 case IPPROTO_SCTP:
27356a5e 1344 case IPPROTO_DCCP:
11a3e5c4 1345 case IPPROTO_IP: /* to allow shared SA for different protocols */
c70b36d2 1346 break;
1347 default:
e8740e42 1348 fprintf(stderr, "\"sport\" and \"dport\" are invalid with PROTO value \"%s\"\n", strxf_proto(sel->proto));
c70b36d2 1349 exit(1);
1350 }
1351 }
1352 if (typep || codep) {
1353 switch (sel->proto) {
1354 case IPPROTO_ICMP:
1355 case IPPROTO_ICMPV6:
0bf0fbc4 1356 case IPPROTO_MH:
c70b36d2 1357 break;
1358 default:
e8740e42 1359 fprintf(stderr, "\"type\" and \"code\" are invalid with PROTO value \"%s\"\n", strxf_proto(sel->proto));
c70b36d2 1360 exit(1);
1361 }
1362 }
4a9608e6
TT		 1363 if (grekey) {
1364 switch (sel->proto) {
1365 case IPPROTO_GRE:
1366 break;
1367 default:
e8740e42 1368 fprintf(stderr, "\"key\" is invalid with PROTO value \"%s\"\n", strxf_proto(sel->proto));
4a9608e6
TT		 1369 exit(1);
1370 }
1371 }
c7699875 1372
1373 *argcp = argc;
1374 *argvp = argv;
1375
1376 return 0;
1377}
1378
1379int xfrm_selector_parse(struct xfrm_selector *sel, int *argcp, char ***argvp)
1380{
1381 int argc = *argcp;
1382 char **argv = *argvp;
d17b136f
PS		 1383 inet_prefix dst = {};
1384 inet_prefix src = {};
7809c616 1385 char *upspecp = NULL;
c7699875 1386
c7699875 1387 while (1) {
1388 if (strcmp(*argv, "src") == 0) {
1389 NEXT_ARG();
1390
1391 get_prefix(&src, *argv, preferred_family);
1392 if (src.family == AF_UNSPEC)
e8740e42 1393 invarg("value after \"src\" has an unrecognized address family", *argv);
c7699875 1394 sel->family = src.family;
1395
1396 memcpy(&sel->saddr, &src.data, sizeof(sel->saddr));
1397 sel->prefixlen_s = src.bitlen;
1398
1399 filter.sel_src_mask = src.bitlen;
1400
1401 } else if (strcmp(*argv, "dst") == 0) {
1402 NEXT_ARG();
1403
1404 get_prefix(&dst, *argv, preferred_family);
1405 if (dst.family == AF_UNSPEC)
e8740e42 1406 invarg("value after \"dst\" has an unrecognized address family", *argv);
c7699875 1407 sel->family = dst.family;
1408
1409 memcpy(&sel->daddr, &dst.data, sizeof(sel->daddr));
1410 sel->prefixlen_d = dst.bitlen;
1411
1412 filter.sel_dst_mask = dst.bitlen;
1413
c7699875 1414 } else if (strcmp(*argv, "dev") == 0) {
1415 int ifindex;
1416
1417 NEXT_ARG();
1418
1419 if (strcmp(*argv, "none") == 0)
1420 ifindex = 0;
1421 else {
dcb283c3 1422 ifindex = ll_name_to_index(*argv);
c7699875 1423 if (ifindex <= 0)
e8740e42 1424 invarg("DEV value is invalid", *argv);
c7699875 1425 }
1426 sel->ifindex = ifindex;
1427
1428 filter.sel_dev_mask = XFRM_FILTER_MASK_FULL;
1429
1430 } else {
7809c616 1431 if (upspecp) {
1432 PREV_ARG(); /* back track */
1433 break;
1434 } else {
1435 upspecp = *argv;
1436 xfrm_selector_upspec_parse(sel, &argc, &argv);
1437 }
c7699875 1438 }
1439
1440 if (!NEXT_ARG_OK())
1441 break;
1442
1443 NEXT_ARG();
1444 }
1445
1446 if (src.family && dst.family && (src.family != dst.family))
e8740e42 1447 invarg("the same address family is required between values after \"src\" and \"dst\"", *argv);
c7699875 1448
1449 if (argc == *argcp)
1450 missarg("SELECTOR");
1451
1452 *argcp = argc;
1453 *argvp = argv;
1454
1455 return 0;
1456}
1457
1458int xfrm_lifetime_cfg_parse(struct xfrm_lifetime_cfg *lft,
1459 int *argcp, char ***argvp)
1460{
1461 int argc = *argcp;
1462 char **argv = *argvp;
1463 int ret;
1464
1465 if (strcmp(*argv, "time-soft") == 0) {
1466 NEXT_ARG();
1467 ret = get_u64(&lft->soft_add_expires_seconds, *argv, 0);
1468 if (ret)
e8740e42 1469 invarg("value after \"time-soft\" is invalid", *argv);
c7699875 1470 } else if (strcmp(*argv, "time-hard") == 0) {
1471 NEXT_ARG();
1472 ret = get_u64(&lft->hard_add_expires_seconds, *argv, 0);
1473 if (ret)
e8740e42 1474 invarg("value after \"time-hard\" is invalid", *argv);
c7699875 1475 } else if (strcmp(*argv, "time-use-soft") == 0) {
1476 NEXT_ARG();
1477 ret = get_u64(&lft->soft_use_expires_seconds, *argv, 0);
1478 if (ret)
e8740e42 1479 invarg("value after \"time-use-soft\" is invalid", *argv);
c7699875 1480 } else if (strcmp(*argv, "time-use-hard") == 0) {
1481 NEXT_ARG();
1482 ret = get_u64(&lft->hard_use_expires_seconds, *argv, 0);
1483 if (ret)
e8740e42 1484 invarg("value after \"time-use-hard\" is invalid", *argv);
c7699875 1485 } else if (strcmp(*argv, "byte-soft") == 0) {
1486 NEXT_ARG();
1487 ret = get_u64(&lft->soft_byte_limit, *argv, 0);
1488 if (ret)
e8740e42 1489 invarg("value after \"byte-soft\" is invalid", *argv);
c7699875 1490 } else if (strcmp(*argv, "byte-hard") == 0) {
1491 NEXT_ARG();
1492 ret = get_u64(&lft->hard_byte_limit, *argv, 0);
1493 if (ret)
e8740e42 1494 invarg("value after \"byte-hard\" is invalid", *argv);
c7699875 1495 } else if (strcmp(*argv, "packet-soft") == 0) {
1496 NEXT_ARG();
1497 ret = get_u64(&lft->soft_packet_limit, *argv, 0);
1498 if (ret)
e8740e42 1499 invarg("value after \"packet-soft\" is invalid", *argv);
c7699875 1500 } else if (strcmp(*argv, "packet-hard") == 0) {
1501 NEXT_ARG();
1502 ret = get_u64(&lft->hard_packet_limit, *argv, 0);
1503 if (ret)
e8740e42 1504 invarg("value after \"packet-hard\" is invalid", *argv);
c7699875 1505 } else
e8740e42 1506 invarg("LIMIT value is invalid", *argv);
c7699875 1507
1508 *argcp = argc;
1509 *argvp = argv;
1510
1511 return 0;
1512}
1513
1514int do_xfrm(int argc, char **argv)
1515{
1516 memset(&filter, 0, sizeof(filter));
1517
1518 if (argc < 1)
1519 usage();
1520
ad273962 1521 if (matches(*argv, "state") == 0 ||
15ac4cdc 1522 matches(*argv, "sa") == 0)
c7699875 1523 return do_xfrm_state(argc-1, argv+1);
15ac4cdc 1524 else if (matches(*argv, "policy") == 0)
c7699875 1525 return do_xfrm_policy(argc-1, argv+1);
15ac4cdc 1526 else if (matches(*argv, "monitor") == 0)
1527 return do_xfrm_monitor(argc-1, argv+1);
ad273962 1528 else if (matches(*argv, "help") == 0) {
c7699875 1529 usage();
1530 fprintf(stderr, "xfrm Object \"%s\" is unknown.\n", *argv);
1531 exit(-1);
1532 }
1533 usage();
1534}
Upstream mirror of iproute2