ip/ipxfrm.c

   1 /* $USAGI: $ */
   2
   3 /*
   4  * Copyright (C)2004 USAGI/WIDE Project
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 /*
  21  * based on ip.c, iproute.c
  22  */
  23 /*
  24  * Authors:
  25  *      Masahide NAKAMURA @USAGI
  26  */
  27
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <sys/types.h>
  32 #include <sys/socket.h>
  33 #include <time.h>
  34 #include <netdb.h>
  35 #include <linux/netlink.h>
  36 #include <linux/rtnetlink.h>
  37 #include <linux/xfrm.h>
  38
  39 #include "utils.h"
  40 #include "xfrm.h"
  41
  42 #define STRBUF_SIZE     (128)
  43 #define STRBUF_CAT(buf, str) \
  44         do { \
  45                 int rest = sizeof(buf) - 1 - strlen(buf); \
  46                 if (rest > 0) { \
  47                         int len = strlen(str); \
  48                         if (len > rest) \
  49                                 len = rest; \
  50                         strncat(buf, str, len); \
  51                         buf[sizeof(buf) - 1] = '\0'; \
  52                 } \
  53         } while(0);
  54
  55 struct xfrm_filter filter;
  56
  57 static void usage(void) __attribute__((noreturn));
  58
  59 static void usage(void)
  60 {
  61         fprintf(stderr,
  62                 "Usage: ip xfrm XFRM_OBJECT { COMMAND | help }\n"
  63                 "where  XFRM_OBJECT := { state | policy | monitor }\n");
  64         exit(-1);
  65 }
  66
  67 /* This is based on utils.c(inet_addr_match) */
  68 int xfrm_addr_match(xfrm_address_t *x1, xfrm_address_t *x2, int bits)
  69 {
  70         __u32 *a1 = (__u32 *)x1;
  71         __u32 *a2 = (__u32 *)x2;
  72         int words = bits >> 0x05;
  73
  74         bits &= 0x1f;
  75
  76         if (words)
  77                 if (memcmp(a1, a2, words << 2))
  78                         return -1;
  79
  80         if (bits) {
  81                 __u32 w1, w2;
  82                 __u32 mask;
  83
  84                 w1 = a1[words];
  85                 w2 = a2[words];
  86
  87                 mask = htonl((0xffffffff) << (0x20 - bits));
  88
  89                 if ((w1 ^ w2) & mask)
  90                         return 1;
  91         }
  92
  93         return 0;
  94 }
  95
  96 int xfrm_xfrmproto_is_ipsec(__u8 proto)
  97 {
  98         return (proto ==  IPPROTO_ESP ||
  99                 proto ==  IPPROTO_AH  ||
 100                 proto ==  IPPROTO_COMP);
 101 }
 102
 103 int xfrm_xfrmproto_is_ro(__u8 proto)
 104 {
 105         return (proto ==  IPPROTO_ROUTING ||
 106                 proto ==  IPPROTO_DSTOPTS);
 107 }
 108
 109 struct typeent {
 110         const char *t_name;
 111         int t_type;
 112 };
 113
 114 static const struct typeent xfrmproto_types[]= {
 115         { "esp", IPPROTO_ESP }, { "ah", IPPROTO_AH }, { "comp", IPPROTO_COMP },
 116         { "route2", IPPROTO_ROUTING }, { "hao", IPPROTO_DSTOPTS },
 117         { "ipsec-any", IPSEC_PROTO_ANY },
 118         { NULL, -1 }
 119 };
 120
 121 int xfrm_xfrmproto_getbyname(char *name)
 122 {
 123         int i;
 124
 125         for (i = 0; ; i++) {
 126                 const struct typeent *t = &xfrmproto_types[i];
 127                 if (!t->t_name || t->t_type == -1)
 128                         break;
 129
 130                 if (strcmp(t->t_name, name) == 0)
 131                         return t->t_type;
 132         }
 133
 134         return -1;
 135 }
 136
 137 const char *strxf_xfrmproto(__u8 proto)
 138 {
 139         static char str[16];
 140         int i;
 141
 142         for (i = 0; ; i++) {
 143                 const struct typeent *t = &xfrmproto_types[i];
 144                 if (!t->t_name || t->t_type == -1)
 145                         break;
 146
 147                 if (t->t_type == proto)
 148                         return t->t_name;
 149         }
 150
 151         sprintf(str, "%u", proto);
 152         return str;
 153 }
 154
 155 static const struct typeent algo_types[]= {
 156         { "enc", XFRMA_ALG_CRYPT }, { "auth", XFRMA_ALG_AUTH },
 157         { "comp", XFRMA_ALG_COMP }, { NULL, -1 }
 158 };
 159
 160 int xfrm_algotype_getbyname(char *name)
 161 {
 162         int i;
 163
 164         for (i = 0; ; i++) {
 165                 const struct typeent *t = &algo_types[i];
 166                 if (!t->t_name || t->t_type == -1)
 167                         break;
 168
 169                 if (strcmp(t->t_name, name) == 0)
 170                         return t->t_type;
 171         }
 172
 173         return -1;
 174 }
 175
 176 const char *strxf_algotype(int type)
 177 {
 178         static char str[32];
 179         int i;
 180
 181         for (i = 0; ; i++) {
 182                 const struct typeent *t = &algo_types[i];
 183                 if (!t->t_name || t->t_type == -1)
 184                         break;
 185
 186                 if (t->t_type == type)
 187                         return t->t_name;
 188         }
 189
 190         sprintf(str, "%d", type);
 191         return str;
 192 }
 193
 194 const char *strxf_mask8(__u8 mask)
 195 {
 196         static char str[16];
 197         const int sn = sizeof(mask) * 8 - 1;
 198         __u8 b;
 199         int i = 0;
 200
 201         for (b = (1 << sn); b > 0; b >>= 1)
 202                 str[i++] = ((b & mask) ? '1' : '0');
 203         str[i] = '\0';
 204
 205         return str;
 206 }
 207
 208 const char *strxf_mask32(__u32 mask)
 209 {
 210         static char str[16];
 211
 212         sprintf(str, "%.8x", mask);
 213
 214         return str;
 215 }
 216
 217 const char *strxf_share(__u8 share)
 218 {
 219         static char str[32];
 220
 221         switch (share) {
 222         case XFRM_SHARE_ANY:
 223                 strcpy(str, "any");
 224                 break;
 225         case XFRM_SHARE_SESSION:
 226                 strcpy(str, "session");
 227                 break;
 228         case XFRM_SHARE_USER:
 229                 strcpy(str, "user");
 230                 break;
 231         case XFRM_SHARE_UNIQUE:
 232                 strcpy(str, "unique");
 233                 break;
 234         default:
 235                 sprintf(str, "%u", share);
 236                 break;
 237         }
 238
 239         return str;
 240 }
 241
 242 const char *strxf_proto(__u8 proto)
 243 {
 244         static char buf[32];
 245         struct protoent *pp;
 246         const char *p;
 247
 248         pp = getprotobynumber(proto);
 249         if (pp)
 250                 p = pp->p_name;
 251         else {
 252                 sprintf(buf, "%u", proto);
 253                 p = buf;
 254         }
 255
 256         return p;
 257 }
 258
 259 const char *strxf_ptype(__u8 ptype)
 260 {
 261         static char str[16];
 262
 263         switch (ptype) {
 264         case XFRM_POLICY_TYPE_MAIN:
 265                 strcpy(str, "main");
 266                 break;
 267         case XFRM_POLICY_TYPE_SUB:
 268                 strcpy(str, "sub");
 269                 break;
 270         default:
 271                 sprintf(str, "%u", ptype);
 272                 break;
 273         }
 274
 275         return str;
 276 }
 277
 278 void xfrm_id_info_print(xfrm_address_t *saddr, struct xfrm_id *id,
 279                         __u8 mode, __u32 reqid, __u16 family, int force_spi,
 280                         FILE *fp, const char *prefix, const char *title)
 281 {
 282         char abuf[256];
 283
 284         if (title)
 285                 fprintf(fp, title);
 286
 287         memset(abuf, '\0', sizeof(abuf));
 288         fprintf(fp, "src %s ", rt_addr_n2a(family, sizeof(*saddr),
 289                                            saddr, abuf, sizeof(abuf)));
 290         memset(abuf, '\0', sizeof(abuf));
 291         fprintf(fp, "dst %s", rt_addr_n2a(family, sizeof(id->daddr),
 292                                           &id->daddr, abuf, sizeof(abuf)));
 293         fprintf(fp, "%s", _SL_);
 294
 295         if (prefix)
 296                 fprintf(fp, prefix);
 297         fprintf(fp, "\t");
 298
 299         fprintf(fp, "proto %s ", strxf_xfrmproto(id->proto));
 300
 301         if (show_stats > 0 || force_spi || id->spi) {
 302                 __u32 spi = ntohl(id->spi);
 303                 fprintf(fp, "spi 0x%08x", spi);
 304                 if (show_stats > 0)
 305                         fprintf(fp, "(%u)", spi);
 306                 fprintf(fp, " ");
 307         }
 308
 309         fprintf(fp, "reqid %u", reqid);
 310         if (show_stats > 0)
 311                 fprintf(fp, "(0x%08x)", reqid);
 312         fprintf(fp, " ");
 313
 314         fprintf(fp, "mode ");
 315         switch (mode) {
 316         case XFRM_MODE_TRANSPORT:
 317                 fprintf(fp, "transport");
 318                 break;
 319         case XFRM_MODE_TUNNEL:
 320                 fprintf(fp, "tunnel");
 321                 break;
 322         case XFRM_MODE_ROUTEOPTIMIZATION:
 323                 fprintf(fp, "ro");
 324                 break;
 325         case XFRM_MODE_IN_TRIGGER:
 326                 fprintf(fp, "in_trigger");
 327                 break;
 328         case XFRM_MODE_BEET:
 329                 fprintf(fp, "beet");
 330                 break;
 331         default:
 332                 fprintf(fp, "%u", mode);
 333                 break;
 334         }
 335         fprintf(fp, "%s", _SL_);
 336 }
 337
 338 static const char *strxf_limit(__u64 limit)
 339 {
 340         static char str[32];
 341         if (limit == XFRM_INF)
 342                 strcpy(str, "(INF)");
 343         else
 344                 sprintf(str, "%llu", (unsigned long long) limit);
 345
 346         return str;
 347 }
 348
 349 void xfrm_stats_print(struct xfrm_stats *s, FILE *fp, const char *prefix)
 350 {
 351         if (prefix)
 352                 fprintf(fp, prefix);
 353         fprintf(fp, "stats:");
 354         fprintf(fp, "%s", _SL_);
 355
 356         if (prefix)
 357                 fprintf(fp, prefix);
 358         fprintf(fp, "  ");
 359         fprintf(fp, "replay-window %u ", s->replay_window);
 360         fprintf(fp, "replay %u ", s->replay);
 361         fprintf(fp, "failed %u", s->integrity_failed);
 362         fprintf(fp, "%s", _SL_);
 363 }
 364
 365 static const char *strxf_time(__u64 time)
 366 {
 367         static char str[32];
 368
 369         if (time == 0)
 370                 strcpy(str, "-");
 371         else {
 372                 time_t t;
 373                 struct tm *tp;
 374
 375                 /* XXX: treat time in the same manner of kernel's
 376                  * net/xfrm/xfrm_{user,state}.c
 377                  */
 378                 t = (long)time;
 379                 tp = localtime(&t);
 380
 381                 strftime(str, sizeof(str), "%Y-%m-%d %T", tp);
 382         }
 383
 384         return str;
 385 }
 386
 387 void xfrm_lifetime_print(struct xfrm_lifetime_cfg *cfg,
 388                          struct xfrm_lifetime_cur *cur,
 389                          FILE *fp, const char *prefix)
 390 {
 391         if (cfg) {
 392                 if (prefix)
 393                         fprintf(fp, prefix);
 394                 fprintf(fp, "lifetime config:");
 395                 fprintf(fp, "%s", _SL_);
 396
 397                 if (prefix)
 398                         fprintf(fp, prefix);
 399                 fprintf(fp, "  ");
 400                 fprintf(fp, "limit: ");
 401                 fprintf(fp, "soft ");
 402                 fprintf(fp, strxf_limit(cfg->soft_byte_limit));
 403                 fprintf(fp, "(bytes), hard ");
 404                 fprintf(fp, strxf_limit(cfg->hard_byte_limit));
 405                 fprintf(fp, "(bytes)");
 406                 fprintf(fp, "%s", _SL_);
 407
 408                 if (prefix)
 409                         fprintf(fp, prefix);
 410                 fprintf(fp, "  ");
 411                 fprintf(fp, "limit: ");
 412                 fprintf(fp, "soft ");
 413                 fprintf(fp, strxf_limit(cfg->soft_packet_limit));
 414                 fprintf(fp, "(packets), hard ");
 415                 fprintf(fp, strxf_limit(cfg->hard_packet_limit));
 416                 fprintf(fp, "(packets)");
 417                 fprintf(fp, "%s", _SL_);
 418
 419                 if (prefix)
 420                         fprintf(fp, prefix);
 421                 fprintf(fp, "  ");
 422                 fprintf(fp, "expire add: ");
 423                 fprintf(fp, "soft ");
 424                 fprintf(fp, "%llu", (unsigned long long) cfg->soft_add_expires_seconds);
 425                 fprintf(fp, "(sec), hard ");
 426                 fprintf(fp, "%llu", (unsigned long long) cfg->hard_add_expires_seconds);
 427                 fprintf(fp, "(sec)");
 428                 fprintf(fp, "%s", _SL_);
 429
 430                 if (prefix)
 431                         fprintf(fp, prefix);
 432                 fprintf(fp, "  ");
 433                 fprintf(fp, "expire use: ");
 434                 fprintf(fp, "soft ");
 435                 fprintf(fp, "%llu", (unsigned long long) cfg->soft_use_expires_seconds);
 436                 fprintf(fp, "(sec), hard ");
 437                 fprintf(fp, "%llu", (unsigned long long) cfg->hard_use_expires_seconds);
 438                 fprintf(fp, "(sec)");
 439                 fprintf(fp, "%s", _SL_);
 440         }
 441         if (cur) {
 442                 if (prefix)
 443                         fprintf(fp, prefix);
 444                 fprintf(fp, "lifetime current:");
 445                 fprintf(fp, "%s", _SL_);
 446
 447                 if (prefix)
 448                         fprintf(fp, prefix);
 449                 fprintf(fp, "  ");
 450                 fprintf(fp, "%llu(bytes), ", (unsigned long long) cur->bytes);
 451                 fprintf(fp, "%llu(packets)", (unsigned long long) cur->packets);
 452                 fprintf(fp, "%s", _SL_);
 453
 454                 if (prefix)
 455                         fprintf(fp, prefix);
 456                 fprintf(fp, "  ");
 457                 fprintf(fp, "add %s ", strxf_time(cur->add_time));
 458                 fprintf(fp, "use %s", strxf_time(cur->use_time));
 459                 fprintf(fp, "%s", _SL_);
 460         }
 461 }
 462
 463 void xfrm_selector_print(struct xfrm_selector *sel, __u16 family,
 464                          FILE *fp, const char *prefix)
 465 {
 466         char abuf[256];
 467         __u16 f;
 468
 469         f = sel->family;
 470         if (f == AF_UNSPEC)
 471                 f = family;
 472         if (f == AF_UNSPEC)
 473                 f = preferred_family;
 474
 475         if (prefix)
 476                 fprintf(fp, prefix);
 477
 478         memset(abuf, '\0', sizeof(abuf));
 479         fprintf(fp, "src %s/%u ", rt_addr_n2a(f, sizeof(sel->saddr),
 480                                               &sel->saddr, abuf, sizeof(abuf)),
 481                 sel->prefixlen_s);
 482
 483         memset(abuf, '\0', sizeof(abuf));
 484         fprintf(fp, "dst %s/%u ", rt_addr_n2a(f, sizeof(sel->daddr),
 485                                               &sel->daddr, abuf, sizeof(abuf)),
 486                 sel->prefixlen_d);
 487
 488         if (sel->proto)
 489                 fprintf(fp, "proto %s ", strxf_proto(sel->proto));
 490         switch (sel->proto) {
 491         case IPPROTO_TCP:
 492         case IPPROTO_UDP:
 493         case IPPROTO_SCTP:
 494         case IPPROTO_DCCP:
 495         default: /* XXX */
 496                 if (sel->sport_mask)
 497                         fprintf(fp, "sport %u ", ntohs(sel->sport));
 498                 if (sel->dport_mask)
 499                         fprintf(fp, "dport %u ", ntohs(sel->dport));
 500                 break;
 501         case IPPROTO_ICMP:
 502         case IPPROTO_ICMPV6:
 503                 /* type/code is stored at sport/dport in selector */
 504                 if (sel->sport_mask)
 505                         fprintf(fp, "type %u ", ntohs(sel->sport));
 506                 if (sel->dport_mask)
 507                         fprintf(fp, "code %u ", ntohs(sel->dport));
 508                 break;
 509         case IPPROTO_MH:
 510                 if (sel->sport_mask)
 511                         fprintf(fp, "type %u ", ntohs(sel->sport));
 512                 if (sel->dport_mask) {
 513                         if (show_stats > 0)
 514                                 fprintf(fp, "(dport) 0x%.4x ", sel->dport);
 515                 }
 516                 break;
 517         }
 518
 519         if (sel->ifindex > 0)
 520                 fprintf(fp, "dev %s ", ll_index_to_name(sel->ifindex));
 521
 522         if (show_stats > 0)
 523                 fprintf(fp, "uid %u", sel->user);
 524
 525         fprintf(fp, "%s", _SL_);
 526 }
 527
 528 static void xfrm_algo_print(struct xfrm_algo *algo, int type, int len,
 529                             FILE *fp, const char *prefix)
 530 {
 531         int keylen;
 532         int i;
 533
 534         if (prefix)
 535                 fprintf(fp, prefix);
 536
 537         fprintf(fp, "%s ", strxf_algotype(type));
 538
 539         if (len < sizeof(*algo)) {
 540                 fprintf(fp, "(ERROR truncated)");
 541                 goto fin;
 542         }
 543         len -= sizeof(*algo);
 544
 545         fprintf(fp, "%s ", algo->alg_name);
 546
 547         keylen = algo->alg_key_len / 8;
 548         if (len < keylen) {
 549                 fprintf(fp, "(ERROR truncated)");
 550                 goto fin;
 551         }
 552
 553         fprintf(fp, "0x");
 554         for (i = 0; i < keylen; i ++)
 555                 fprintf(fp, "%.2x", (unsigned char)algo->alg_key[i]);
 556
 557         if (show_stats > 0)
 558                 fprintf(fp, " (%d bits)", algo->alg_key_len);
 559
 560  fin:
 561         fprintf(fp, "%s", _SL_);
 562 }
 563
 564 static void xfrm_tmpl_print(struct xfrm_user_tmpl *tmpls, int len,
 565                             __u16 family, FILE *fp, const char *prefix)
 566 {
 567         int ntmpls = len / sizeof(struct xfrm_user_tmpl);
 568         int i;
 569
 570         if (ntmpls <= 0) {
 571                 if (prefix)
 572                         fprintf(fp, prefix);
 573                 fprintf(fp, "(ERROR \"tmpl\" truncated)");
 574                 fprintf(fp, "%s", _SL_);
 575                 return;
 576         }
 577
 578         for (i = 0; i < ntmpls; i++) {
 579                 struct xfrm_user_tmpl *tmpl = &tmpls[i];
 580
 581                 if (prefix)
 582                         fprintf(fp, prefix);
 583
 584                 xfrm_id_info_print(&tmpl->saddr, &tmpl->id, tmpl->mode,
 585                                    tmpl->reqid, family, 0, fp, prefix, "tmpl ");
 586
 587                 if (show_stats > 0 || tmpl->optional) {
 588                         if (prefix)
 589                                 fprintf(fp, prefix);
 590                         fprintf(fp, "\t");
 591                         switch (tmpl->optional) {
 592                         case 0:
 593                                 if (show_stats > 0)
 594                                         fprintf(fp, "level required ");
 595                                 break;
 596                         case 1:
 597                                 fprintf(fp, "level use ");
 598                                 break;
 599                         default:
 600                                 fprintf(fp, "level %u ", tmpl->optional);
 601                                 break;
 602                         }
 603
 604                         if (show_stats > 0)
 605                                 fprintf(fp, "share %s ", strxf_share(tmpl->share));
 606
 607                         fprintf(fp, "%s", _SL_);
 608                 }
 609
 610                 if (show_stats > 0) {
 611                         if (prefix)
 612                                 fprintf(fp, prefix);
 613                         fprintf(fp, "\t");
 614                         fprintf(fp, "%s-mask %s ",
 615                                 strxf_algotype(XFRMA_ALG_CRYPT),
 616                                 strxf_mask32(tmpl->ealgos));
 617                         fprintf(fp, "%s-mask %s ",
 618                                 strxf_algotype(XFRMA_ALG_AUTH),
 619                                 strxf_mask32(tmpl->aalgos));
 620                         fprintf(fp, "%s-mask %s",
 621                                 strxf_algotype(XFRMA_ALG_COMP),
 622                                 strxf_mask32(tmpl->calgos));
 623
 624                         fprintf(fp, "%s", _SL_);
 625                 }
 626         }
 627 }
 628
 629 void xfrm_xfrma_print(struct rtattr *tb[], __u16 family,
 630                       FILE *fp, const char *prefix)
 631 {
 632         if (tb[XFRMA_ALG_AUTH]) {
 633                 struct rtattr *rta = tb[XFRMA_ALG_AUTH];
 634                 xfrm_algo_print((struct xfrm_algo *) RTA_DATA(rta),
 635                                 XFRMA_ALG_AUTH, RTA_PAYLOAD(rta), fp, prefix);
 636         }
 637
 638         if (tb[XFRMA_ALG_CRYPT]) {
 639                 struct rtattr *rta = tb[XFRMA_ALG_CRYPT];
 640                 xfrm_algo_print((struct xfrm_algo *) RTA_DATA(rta),
 641                                 XFRMA_ALG_CRYPT, RTA_PAYLOAD(rta), fp, prefix);
 642         }
 643
 644         if (tb[XFRMA_ALG_COMP]) {
 645                 struct rtattr *rta = tb[XFRMA_ALG_COMP];
 646                 xfrm_algo_print((struct xfrm_algo *) RTA_DATA(rta),
 647                                 XFRMA_ALG_COMP, RTA_PAYLOAD(rta), fp, prefix);
 648         }
 649
 650         if (tb[XFRMA_ENCAP]) {
 651                 struct xfrm_encap_tmpl *e;
 652                 char abuf[256];
 653
 654                 if (prefix)
 655                         fprintf(fp, prefix);
 656                 fprintf(fp, "encap ");
 657
 658                 if (RTA_PAYLOAD(tb[XFRMA_ENCAP]) < sizeof(*e)) {
 659                         fprintf(fp, "(ERROR truncated)");
 660                         fprintf(fp, "%s", _SL_);
 661                         return;
 662                 }
 663                 e = (struct xfrm_encap_tmpl *) RTA_DATA(tb[XFRMA_ENCAP]);
 664
 665                 fprintf(fp, "type ");
 666                 switch (e->encap_type) {
 667                 case 1:
 668                         fprintf(fp, "espinudp-nonike ");
 669                         break;
 670                 case 2:
 671                         fprintf(fp, "espinudp ");
 672                         break;
 673                 default:
 674                         fprintf(fp, "%u ", e->encap_type);
 675                         break;
 676                 }
 677                 fprintf(fp, "sport %u ", ntohs(e->encap_sport));
 678                 fprintf(fp, "dport %u ", ntohs(e->encap_dport));
 679
 680                 memset(abuf, '\0', sizeof(abuf));
 681                 fprintf(fp, "addr %s",
 682                         rt_addr_n2a(family, sizeof(e->encap_oa),
 683                                     &e->encap_oa, abuf, sizeof(abuf)));
 684                 fprintf(fp, "%s", _SL_);
 685         }
 686
 687         if (tb[XFRMA_TMPL]) {
 688                 struct rtattr *rta = tb[XFRMA_TMPL];
 689                 xfrm_tmpl_print((struct xfrm_user_tmpl *) RTA_DATA(rta),
 690                                 RTA_PAYLOAD(rta), family, fp, prefix);
 691         }
 692
 693         if (tb[XFRMA_COADDR]) {
 694                 char abuf[256];
 695                 xfrm_address_t *coa;
 696
 697                 if (prefix)
 698                         fprintf(fp, prefix);
 699                 fprintf(fp, "coa ");
 700
 701                 coa = (xfrm_address_t *)RTA_DATA(tb[XFRMA_COADDR]);
 702
 703                 if (RTA_PAYLOAD(tb[XFRMA_COADDR]) < sizeof(*coa)) {
 704                         fprintf(fp, "(ERROR truncated)");
 705                         fprintf(fp, "%s", _SL_);
 706                         return;
 707                 }
 708
 709                 memset(abuf, '\0', sizeof(abuf));
 710                 fprintf(fp, "%s",
 711                         rt_addr_n2a(family, sizeof(*coa), coa,
 712                                     abuf, sizeof(abuf)));
 713                 fprintf(fp, "%s", _SL_);
 714         }
 715
 716         if (tb[XFRMA_LASTUSED]) {
 717                 __u64 lastused;
 718
 719                 if (prefix)
 720                         fprintf(fp, prefix);
 721                 fprintf(fp, "lastused ");
 722
 723                 if (RTA_PAYLOAD(tb[XFRMA_LASTUSED]) < sizeof(lastused)) {
 724                         fprintf(fp, "(ERROR truncated)");
 725                         fprintf(fp, "%s", _SL_);
 726                         return;
 727                 }
 728
 729                 lastused = *(__u64 *)RTA_DATA(tb[XFRMA_LASTUSED]);
 730
 731                 fprintf(fp, "%s", strxf_time(lastused));
 732                 fprintf(fp, "%s", _SL_);
 733         }
 734 }
 735
 736 static int xfrm_selector_iszero(struct xfrm_selector *s)
 737 {
 738         struct xfrm_selector s0;
 739
 740         memset(&s0, 0, sizeof(s0));
 741
 742         return (memcmp(&s0, s, sizeof(s0)) == 0);
 743 }
 744
 745 void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo,
 746                             struct rtattr *tb[], FILE *fp, const char *prefix,
 747                             const char *title)
 748 {
 749         char buf[STRBUF_SIZE];
 750         int force_spi = xfrm_xfrmproto_is_ipsec(xsinfo->id.proto);
 751
 752         memset(buf, '\0', sizeof(buf));
 753
 754         xfrm_id_info_print(&xsinfo->saddr, &xsinfo->id, xsinfo->mode,
 755                            xsinfo->reqid, xsinfo->family, force_spi, fp,
 756                            prefix, title);
 757
 758         if (prefix)
 759                 STRBUF_CAT(buf, prefix);
 760         STRBUF_CAT(buf, "\t");
 761
 762         fprintf(fp, buf);
 763         fprintf(fp, "replay-window %u ", xsinfo->replay_window);
 764         if (show_stats > 0)
 765                 fprintf(fp, "seq 0x%08u ", xsinfo->seq);
 766         if (show_stats > 0 || xsinfo->flags) {
 767                 __u8 flags = xsinfo->flags;
 768
 769                 fprintf(fp, "flag ");
 770                 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_NOECN, "noecn");
 771                 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_DECAP_DSCP, "decap-dscp");
 772                 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_NOPMTUDISC, "nopmtudisc");
 773                 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_WILDRECV, "wildrecv");
 774                 if (flags)
 775                         fprintf(fp, "%x", flags);
 776         }
 777         if (show_stats > 0)
 778                 fprintf(fp, " (0x%s)", strxf_mask8(xsinfo->flags));
 779         fprintf(fp, "%s", _SL_);
 780
 781         xfrm_xfrma_print(tb, xsinfo->family, fp, buf);
 782
 783         if (!xfrm_selector_iszero(&xsinfo->sel)) {
 784                 char sbuf[STRBUF_SIZE];
 785
 786                 memcpy(sbuf, buf, sizeof(sbuf));
 787                 STRBUF_CAT(sbuf, "sel ");
 788
 789                 xfrm_selector_print(&xsinfo->sel, xsinfo->family, fp, sbuf);
 790         }
 791
 792         if (show_stats > 0) {
 793                 xfrm_lifetime_print(&xsinfo->lft, &xsinfo->curlft, fp, buf);
 794                 xfrm_stats_print(&xsinfo->stats, fp, buf);
 795         }
 796 }
 797
 798 void xfrm_policy_info_print(struct xfrm_userpolicy_info *xpinfo,
 799                             struct rtattr *tb[], FILE *fp, const char *prefix,
 800                             const char *title)
 801 {
 802         char buf[STRBUF_SIZE];
 803
 804         memset(buf, '\0', sizeof(buf));
 805
 806         xfrm_selector_print(&xpinfo->sel, preferred_family, fp, title);
 807
 808         if (prefix)
 809                 STRBUF_CAT(buf, prefix);
 810         STRBUF_CAT(buf, "\t");
 811
 812         fprintf(fp, buf);
 813         fprintf(fp, "dir ");
 814         switch (xpinfo->dir) {
 815         case XFRM_POLICY_IN:
 816                 fprintf(fp, "in");
 817                 break;
 818         case XFRM_POLICY_OUT:
 819                 fprintf(fp, "out");
 820                 break;
 821         case XFRM_POLICY_FWD:
 822                 fprintf(fp, "fwd");
 823                 break;
 824         default:
 825                 fprintf(fp, "%u", xpinfo->dir);
 826                 break;
 827         }
 828         fprintf(fp, " ");
 829
 830         switch (xpinfo->action) {
 831         case XFRM_POLICY_ALLOW:
 832                 if (show_stats > 0)
 833                         fprintf(fp, "action allow ");
 834                 break;
 835         case XFRM_POLICY_BLOCK:
 836                 fprintf(fp, "action block ");
 837                 break;
 838         default:
 839                 fprintf(fp, "action %u ", xpinfo->action);
 840                 break;
 841         }
 842
 843         if (show_stats)
 844                 fprintf(fp, "index %u ", xpinfo->index);
 845         fprintf(fp, "priority %u ", xpinfo->priority);
 846
 847         if (tb[XFRMA_POLICY_TYPE]) {
 848                 struct xfrm_userpolicy_type *upt;
 849
 850                 fprintf(fp, "ptype ");
 851
 852                 if (RTA_PAYLOAD(tb[XFRMA_POLICY_TYPE]) < sizeof(*upt))
 853                         fprintf(fp, "(ERROR truncated)");
 854
 855                 upt = (struct xfrm_userpolicy_type *)RTA_DATA(tb[XFRMA_POLICY_TYPE]);
 856                 fprintf(fp, "%s ", strxf_ptype(upt->type));
 857         }
 858
 859         if (show_stats > 0)
 860                 fprintf(fp, "share %s ", strxf_share(xpinfo->share));
 861
 862         if (show_stats > 0 || xpinfo->flags) {
 863                 __u8 flags = xpinfo->flags;
 864
 865                 fprintf(fp, "flag ");
 866                 XFRM_FLAG_PRINT(fp, flags, XFRM_POLICY_LOCALOK, "localok");
 867                 if (flags)
 868                         fprintf(fp, "%x", flags);
 869         }
 870         if (show_stats > 0)
 871                 fprintf(fp, " (0x%s)", strxf_mask8(xpinfo->flags));
 872         fprintf(fp, "%s", _SL_);
 873
 874         if (show_stats > 0)
 875                 xfrm_lifetime_print(&xpinfo->lft, &xpinfo->curlft, fp, buf);
 876
 877         xfrm_xfrma_print(tb, xpinfo->sel.family, fp, buf);
 878 }
 879
 880 int xfrm_id_parse(xfrm_address_t *saddr, struct xfrm_id *id, __u16 *family,
 881                   int loose, int *argcp, char ***argvp)
 882 {
 883         int argc = *argcp;
 884         char **argv = *argvp;
 885         inet_prefix dst;
 886         inet_prefix src;
 887
 888         memset(&dst, 0, sizeof(dst));
 889         memset(&src, 0, sizeof(src));
 890
 891         while (1) {
 892                 if (strcmp(*argv, "src") == 0) {
 893                         NEXT_ARG();
 894
 895                         get_prefix(&src, *argv, preferred_family);
 896                         if (src.family == AF_UNSPEC)
 897                                 invarg("\"src\" address family is AF_UNSPEC", *argv);
 898                         if (family)
 899                                 *family = src.family;
 900
 901                         memcpy(saddr, &src.data, sizeof(*saddr));
 902
 903                         filter.id_src_mask = src.bitlen;
 904
 905                 } else if (strcmp(*argv, "dst") == 0) {
 906                         NEXT_ARG();
 907
 908                         get_prefix(&dst, *argv, preferred_family);
 909                         if (dst.family == AF_UNSPEC)
 910                                 invarg("\"dst\" address family is AF_UNSPEC", *argv);
 911                         if (family)
 912                                 *family = dst.family;
 913
 914                         memcpy(&id->daddr, &dst.data, sizeof(id->daddr));
 915
 916                         filter.id_dst_mask = dst.bitlen;
 917
 918                 } else if (strcmp(*argv, "proto") == 0) {
 919                         int ret;
 920
 921                         NEXT_ARG();
 922
 923                         ret = xfrm_xfrmproto_getbyname(*argv);
 924                         if (ret < 0)
 925                                 invarg("\"XFRM_PROTO\" is invalid", *argv);
 926
 927                         id->proto = (__u8)ret;
 928
 929                         filter.id_proto_mask = XFRM_FILTER_MASK_FULL;
 930
 931                 } else if (strcmp(*argv, "spi") == 0) {
 932                         __u32 spi;
 933
 934                         NEXT_ARG();
 935                         if (get_u32(&spi, *argv, 0))
 936                                 invarg("\"SPI\" is invalid", *argv);
 937
 938                         spi = htonl(spi);
 939                         id->spi = spi;
 940
 941                         filter.id_spi_mask = XFRM_FILTER_MASK_FULL;
 942
 943                 } else {
 944                         PREV_ARG(); /* back track */
 945                         break;
 946                 }
 947
 948                 if (!NEXT_ARG_OK())
 949                         break;
 950                 NEXT_ARG();
 951         }
 952
 953         if (src.family && dst.family && (src.family != dst.family))
 954                 invarg("the same address family is required between \"src\" and \"dst\"", *argv);
 955
 956         if (loose == 0 && id->proto == 0)
 957                 missarg("XFRM_PROTO");
 958         if (argc == *argcp)
 959                 missarg("ID");
 960
 961         *argcp = argc;
 962         *argvp = argv;
 963
 964         return 0;
 965 }
 966
 967 int xfrm_mode_parse(__u8 *mode, int *argcp, char ***argvp)
 968 {
 969         int argc = *argcp;
 970         char **argv = *argvp;
 971
 972         if (matches(*argv, "transport") == 0)
 973                 *mode = XFRM_MODE_TRANSPORT;
 974         else if (matches(*argv, "tunnel") == 0)
 975                 *mode = XFRM_MODE_TUNNEL;
 976         else if (matches(*argv, "ro") == 0)
 977                 *mode = XFRM_MODE_ROUTEOPTIMIZATION;
 978         else if (matches(*argv, "in_trigger") == 0)
 979                 *mode = XFRM_MODE_IN_TRIGGER;
 980         else if (matches(*argv, "beet") == 0)
 981                 *mode = XFRM_MODE_BEET;
 982         else
 983                 invarg("\"MODE\" is invalid", *argv);
 984
 985         *argcp = argc;
 986         *argvp = argv;
 987
 988         return 0;
 989 }
 990
 991 int xfrm_encap_type_parse(__u16 *type, int *argcp, char ***argvp)
 992 {
 993         int argc = *argcp;
 994         char **argv = *argvp;
 995
 996         if (strcmp(*argv, "espinudp-nonike") == 0)
 997                 *type = 1;
 998         else if (strcmp(*argv, "espinudp") == 0)
 999                 *type = 2;
1000         else
1001                 invarg("\"ENCAP-TYPE\" is invalid", *argv);
1002
1003         *argcp = argc;
1004         *argvp = argv;
1005
1006         return 0;
1007 }
1008
1009 /* NOTE: reqid is used by host-byte order */
1010 int xfrm_reqid_parse(__u32 *reqid, int *argcp, char ***argvp)
1011 {
1012         int argc = *argcp;
1013         char **argv = *argvp;
1014
1015         if (get_u32(reqid, *argv, 0))
1016                 invarg("\"REQID\" is invalid", *argv);
1017
1018         *argcp = argc;
1019         *argvp = argv;
1020
1021         return 0;
1022 }
1023
1024 static int xfrm_selector_upspec_parse(struct xfrm_selector *sel,
1025                                       int *argcp, char ***argvp)
1026 {
1027         int argc = *argcp;
1028         char **argv = *argvp;
1029         char *sportp = NULL;
1030         char *dportp = NULL;
1031         char *typep = NULL;
1032         char *codep = NULL;
1033
1034         while (1) {
1035                 if (strcmp(*argv, "proto") == 0) {
1036                         __u8 upspec;
1037
1038                         NEXT_ARG();
1039
1040                         if (strcmp(*argv, "any") == 0)
1041                                 upspec = 0;
1042                         else {
1043                                 struct protoent *pp;
1044                                 pp = getprotobyname(*argv);
1045                                 if (pp)
1046                                         upspec = pp->p_proto;
1047                                 else {
1048                                         if (get_u8(&upspec, *argv, 0))
1049                                                 invarg("\"PROTO\" is invalid", *argv);
1050                                 }
1051                         }
1052                         sel->proto = upspec;
1053
1054                         filter.upspec_proto_mask = XFRM_FILTER_MASK_FULL;
1055
1056                 } else if (strcmp(*argv, "sport") == 0) {
1057                         sportp = *argv;
1058
1059                         NEXT_ARG();
1060
1061                         if (get_u16(&sel->sport, *argv, 0))
1062                                 invarg("\"PORT\" is invalid", *argv);
1063                         sel->sport = htons(sel->sport);
1064                         if (sel->sport)
1065                                 sel->sport_mask = ~((__u16)0);
1066
1067                         filter.upspec_sport_mask = XFRM_FILTER_MASK_FULL;
1068
1069                 } else if (strcmp(*argv, "dport") == 0) {
1070                         dportp = *argv;
1071
1072                         NEXT_ARG();
1073
1074                         if (get_u16(&sel->dport, *argv, 0))
1075                                 invarg("\"PORT\" is invalid", *argv);
1076                         sel->dport = htons(sel->dport);
1077                         if (sel->dport)
1078                                 sel->dport_mask = ~((__u16)0);
1079
1080                         filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL;
1081
1082                 } else if (strcmp(*argv, "type") == 0) {
1083                         typep = *argv;
1084
1085                         NEXT_ARG();
1086
1087                         if (get_u16(&sel->sport, *argv, 0) ||
1088                             (sel->sport & ~((__u16)0xff)))
1089                                 invarg("\"type\" value is invalid", *argv);
1090                         sel->sport = htons(sel->sport);
1091                         sel->sport_mask = ~((__u16)0);
1092
1093                         filter.upspec_sport_mask = XFRM_FILTER_MASK_FULL;
1094
1095
1096                 } else if (strcmp(*argv, "code") == 0) {
1097                         codep = *argv;
1098
1099                         NEXT_ARG();
1100
1101                         if (get_u16(&sel->dport, *argv, 0) ||
1102                             (sel->dport & ~((__u16)0xff)))
1103                                 invarg("\"code\" value is invalid", *argv);
1104                         sel->dport = htons(sel->dport);
1105                         sel->dport_mask = ~((__u16)0);
1106
1107                         filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL;
1108
1109                 } else {
1110                         PREV_ARG(); /* back track */
1111                         break;
1112                 }
1113
1114                 if (!NEXT_ARG_OK())
1115                         break;
1116                 NEXT_ARG();
1117         }
1118         if (argc == *argcp)
1119                 missarg("UPSPEC");
1120         if (sportp || dportp) {
1121                 switch (sel->proto) {
1122                 case IPPROTO_TCP:
1123                 case IPPROTO_UDP:
1124                 case IPPROTO_SCTP:
1125                 case IPPROTO_DCCP:
1126                         break;
1127                 default:
1128                         fprintf(stderr, "\"sport\" and \"dport\" are invalid with proto=%s\n", strxf_proto(sel->proto));
1129                         exit(1);
1130                 }
1131         }
1132         if (typep || codep) {
1133                 switch (sel->proto) {
1134                 case IPPROTO_ICMP:
1135                 case IPPROTO_ICMPV6:
1136                 case IPPROTO_MH:
1137                         break;
1138                 default:
1139                         fprintf(stderr, "\"type\" and \"code\" are invalid with proto=%s\n", strxf_proto(sel->proto));
1140                         exit(1);
1141                 }
1142         }
1143
1144         *argcp = argc;
1145         *argvp = argv;
1146
1147         return 0;
1148 }
1149
1150 int xfrm_selector_parse(struct xfrm_selector *sel, int *argcp, char ***argvp)
1151 {
1152         int argc = *argcp;
1153         char **argv = *argvp;
1154         inet_prefix dst;
1155         inet_prefix src;
1156         char *upspecp = NULL;
1157
1158         memset(&dst, 0, sizeof(dst));
1159         memset(&src, 0, sizeof(src));
1160
1161         while (1) {
1162                 if (strcmp(*argv, "src") == 0) {
1163                         NEXT_ARG();
1164
1165                         get_prefix(&src, *argv, preferred_family);
1166                         if (src.family == AF_UNSPEC)
1167                                 invarg("\"src\" address family is AF_UNSPEC", *argv);
1168                         sel->family = src.family;
1169
1170                         memcpy(&sel->saddr, &src.data, sizeof(sel->saddr));
1171                         sel->prefixlen_s = src.bitlen;
1172
1173                         filter.sel_src_mask = src.bitlen;
1174
1175                 } else if (strcmp(*argv, "dst") == 0) {
1176                         NEXT_ARG();
1177
1178                         get_prefix(&dst, *argv, preferred_family);
1179                         if (dst.family == AF_UNSPEC)
1180                                 invarg("\"dst\" address family is AF_UNSPEC", *argv);
1181                         sel->family = dst.family;
1182
1183                         memcpy(&sel->daddr, &dst.data, sizeof(sel->daddr));
1184                         sel->prefixlen_d = dst.bitlen;
1185
1186                         filter.sel_dst_mask = dst.bitlen;
1187
1188                 } else if (strcmp(*argv, "dev") == 0) {
1189                         int ifindex;
1190
1191                         NEXT_ARG();
1192
1193                         if (strcmp(*argv, "none") == 0)
1194                                 ifindex = 0;
1195                         else {
1196                                 ifindex = ll_name_to_index(*argv);
1197                                 if (ifindex <= 0)
1198                                         invarg("\"DEV\" is invalid", *argv);
1199                         }
1200                         sel->ifindex = ifindex;
1201
1202                         filter.sel_dev_mask = XFRM_FILTER_MASK_FULL;
1203
1204                 } else {
1205                         if (upspecp) {
1206                                 PREV_ARG(); /* back track */
1207                                 break;
1208                         } else {
1209                                 upspecp = *argv;
1210                                 xfrm_selector_upspec_parse(sel, &argc, &argv);
1211                         }
1212                 }
1213
1214                 if (!NEXT_ARG_OK())
1215                         break;
1216
1217                 NEXT_ARG();
1218         }
1219
1220         if (src.family && dst.family && (src.family != dst.family))
1221                 invarg("the same address family is required between \"src\" and \"dst\"", *argv);
1222
1223         if (argc == *argcp)
1224                 missarg("SELECTOR");
1225
1226         *argcp = argc;
1227         *argvp = argv;
1228
1229         return 0;
1230 }
1231
1232 int xfrm_lifetime_cfg_parse(struct xfrm_lifetime_cfg *lft,
1233                             int *argcp, char ***argvp)
1234 {
1235         int argc = *argcp;
1236         char **argv = *argvp;
1237         int ret;
1238
1239         if (strcmp(*argv, "time-soft") == 0) {
1240                 NEXT_ARG();
1241                 ret = get_u64(&lft->soft_add_expires_seconds, *argv, 0);
1242                 if (ret)
1243                         invarg("\"time-soft\" value is invalid", *argv);
1244         } else if (strcmp(*argv, "time-hard") == 0) {
1245                 NEXT_ARG();
1246                 ret = get_u64(&lft->hard_add_expires_seconds, *argv, 0);
1247                 if (ret)
1248                         invarg("\"time-hard\" value is invalid", *argv);
1249         } else if (strcmp(*argv, "time-use-soft") == 0) {
1250                 NEXT_ARG();
1251                 ret = get_u64(&lft->soft_use_expires_seconds, *argv, 0);
1252                 if (ret)
1253                         invarg("\"time-use-soft\" value is invalid", *argv);
1254         } else if (strcmp(*argv, "time-use-hard") == 0) {
1255                 NEXT_ARG();
1256                 ret = get_u64(&lft->hard_use_expires_seconds, *argv, 0);
1257                 if (ret)
1258                         invarg("\"time-use-hard\" value is invalid", *argv);
1259         } else if (strcmp(*argv, "byte-soft") == 0) {
1260                 NEXT_ARG();
1261                 ret = get_u64(&lft->soft_byte_limit, *argv, 0);
1262                 if (ret)
1263                         invarg("\"byte-soft\" value is invalid", *argv);
1264         } else if (strcmp(*argv, "byte-hard") == 0) {
1265                 NEXT_ARG();
1266                 ret = get_u64(&lft->hard_byte_limit, *argv, 0);
1267                 if (ret)
1268                         invarg("\"byte-hard\" value is invalid", *argv);
1269         } else if (strcmp(*argv, "packet-soft") == 0) {
1270                 NEXT_ARG();
1271                 ret = get_u64(&lft->soft_packet_limit, *argv, 0);
1272                 if (ret)
1273                         invarg("\"packet-soft\" value is invalid", *argv);
1274         } else if (strcmp(*argv, "packet-hard") == 0) {
1275                 NEXT_ARG();
1276                 ret = get_u64(&lft->hard_packet_limit, *argv, 0);
1277                 if (ret)
1278                         invarg("\"packet-hard\" value is invalid", *argv);
1279         } else
1280                 invarg("\"LIMIT\" is invalid", *argv);
1281
1282         *argcp = argc;
1283         *argvp = argv;
1284
1285         return 0;
1286 }
1287
1288 int do_xfrm(int argc, char **argv)
1289 {
1290         memset(&filter, 0, sizeof(filter));
1291
1292         if (argc < 1)
1293                 usage();
1294
1295         if (matches(*argv, "state") == 0 ||
1296             matches(*argv, "sa") == 0)
1297                 return do_xfrm_state(argc-1, argv+1);
1298         else if (matches(*argv, "policy") == 0)
1299                 return do_xfrm_policy(argc-1, argv+1);
1300         else if (matches(*argv, "monitor") == 0)
1301                 return do_xfrm_monitor(argc-1, argv+1);
1302         else if (matches(*argv, "help") == 0) {
1303                 usage();
1304                 fprintf(stderr, "xfrm Object \"%s\" is unknown.\n", *argv);
1305                 exit(-1);
1306         }
1307         usage();
1308 }