]> git.proxmox.com Git - mirror_iproute2.git/blob - ip/xfrm_state.c
projects / mirror_iproute2.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'master' into net-next
[mirror_iproute2.git] / ip / xfrm_state.c
1 /* $USAGI: $ */
2
3 /*
4 * Copyright (C)2004 USAGI/WIDE Project
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses>.
18 */
19 /*
20 * based on iproute.c
21 */
22 /*
23 * Authors:
24 * Masahide NAKAMURA @USAGI
25 */
26
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <netdb.h>
31 #include "utils.h"
32 #include "xfrm.h"
33 #include "ip_common.h"
34
35 /* #define NLMSG_DELETEALL_BUF_SIZE (4096-512) */
36 #define NLMSG_DELETEALL_BUF_SIZE 8192
37
38 /*
39 * Receiving buffer defines:
40 * nlmsg
41 * data = struct xfrm_usersa_info
42 * rtattr
43 * rtattr
44 * ... (max count of rtattr is XFRM_MAX+1
45 *
46 * each rtattr data = struct xfrm_algo(dynamic size) or xfrm_address_t
47 */
48 #define NLMSG_BUF_SIZE 4096
49 #define RTA_BUF_SIZE 2048
50 #define XFRM_ALGO_KEY_BUF_SIZE 512
51 #define CTX_BUF_SIZE 256
52
53 static void usage(void) __attribute__((noreturn));
54
55 static void usage(void)
56 {
57 fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ]\n");
58 fprintf(stderr, " [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ]\n");
59 fprintf(stderr, " [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ]\n");
60 fprintf(stderr, " [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]\n");
61 fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n");
62 fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n");
63 fprintf(stderr, " [ offload [dev DEV] dir DIR ]\n");
64 fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n");
65 fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n");
66 fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
67 fprintf(stderr, "Usage: ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ]\n");
68 fprintf(stderr, " [ flag FLAG-LIST ]\n");
69 fprintf(stderr, "Usage: ip xfrm state flush [ proto XFRM-PROTO ]\n");
70 fprintf(stderr, "Usage: ip xfrm state count\n");
71 fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]\n");
72 fprintf(stderr, "XFRM-PROTO := ");
73 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
74 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
75 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
76 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
77 fprintf(stderr, "%s\n", strxf_xfrmproto(IPPROTO_DSTOPTS));
78 fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] ALGO\n");
79 fprintf(stderr, "ALGO := { ");
80 fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT));
81 fprintf(stderr, "%s", strxf_algotype(XFRMA_ALG_AUTH));
82 fprintf(stderr, " } ALGO-NAME ALGO-KEYMAT |\n");
83 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AUTH_TRUNC));
84 fprintf(stderr, " ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |\n");
85 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AEAD));
86 fprintf(stderr, " ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |\n");
87 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_COMP));
88 fprintf(stderr, " ALGO-NAME\n");
89 fprintf(stderr, "MODE := transport | tunnel | beet | ro | in_trigger\n");
90 fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
91 fprintf(stderr, "FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn\n");
92 fprintf(stderr, "EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG\n");
93 fprintf(stderr, "EXTRA-FLAG := dont-encap-dscp\n");
94 fprintf(stderr, "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n");
95 fprintf(stderr, "UPSPEC := proto { { ");
96 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_TCP));
97 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_UDP));
98 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_SCTP));
99 fprintf(stderr, "%s", strxf_proto(IPPROTO_DCCP));
100 fprintf(stderr, " } [ sport PORT ] [ dport PORT ] |\n");
101 fprintf(stderr, " { ");
102 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMP));
103 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMPV6));
104 fprintf(stderr, "%s", strxf_proto(IPPROTO_MH));
105 fprintf(stderr, " } [ type NUMBER ] [ code NUMBER ] |\n");
106 fprintf(stderr, " %s", strxf_proto(IPPROTO_GRE));
107 fprintf(stderr, " [ key { DOTTED-QUAD | NUMBER } ] | PROTO }\n");
108 fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT\n");
109 fprintf(stderr, "LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |\n");
110 fprintf(stderr, " { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT\n");
111 fprintf(stderr, "ENCAP := { espinudp | espinudp-nonike } SPORT DPORT OADDR\n");
112 fprintf(stderr, "DIR := in | out\n");
113
114 exit(-1);
115 }
116
117 static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
118 char *name, char *key, char *buf, int max)
119 {
120 int len;
121 int slen = strlen(key);
122
123 #if 0
124 /* XXX: verifying both name and key is required! */
125 fprintf(stderr, "warning: ALGO-NAME/ALGO-KEYMAT values will be sent to the kernel promiscuously! (verifying them isn't implemented yet)\n");
126 #endif
127
128 strlcpy(alg->alg_name, name, sizeof(alg->alg_name));
129
130 if (slen > 2 && strncmp(key, "0x", 2) == 0) {
131 /* split two chars "0x" from the top */
132 char *p = key + 2;
133 int plen = slen - 2;
134 int i;
135 int j;
136
137 /* Converting hexadecimal numbered string into real key;
138 * Convert each two chars into one char(value). If number
139 * of the length is odd, add zero on the top for rounding.
140 */
141
142 /* calculate length of the converted values(real key) */
143 len = (plen + 1) / 2;
144 if (len > max)
145 invarg("ALGO-KEYMAT value makes buffer overflow\n", key);
146
147 for (i = -(plen % 2), j = 0; j < len; i += 2, j++) {
148 char vbuf[3];
149 __u8 val;
150
151 vbuf[0] = i >= 0 ? p[i] : '0';
152 vbuf[1] = p[i + 1];
153 vbuf[2] = '\0';
154
155 if (get_u8(&val, vbuf, 16))
156 invarg("ALGO-KEYMAT value is invalid", key);
157
158 buf[j] = val;
159 }
160 } else {
161 len = slen;
162 if (len > 0) {
163 if (len > max)
164 invarg("ALGO-KEYMAT value makes buffer overflow\n", key);
165
166 memcpy(buf, key, len);
167 }
168 }
169
170 alg->alg_key_len = len * 8;
171
172 return 0;
173 }
174
175 static int xfrm_seq_parse(__u32 *seq, int *argcp, char ***argvp)
176 {
177 int argc = *argcp;
178 char **argv = *argvp;
179
180 if (get_be32(seq, *argv, 0))
181 invarg("SEQ value is invalid", *argv);
182
183 *argcp = argc;
184 *argvp = argv;
185
186 return 0;
187 }
188
189 static int xfrm_state_flag_parse(__u8 *flags, int *argcp, char ***argvp)
190 {
191 int argc = *argcp;
192 char **argv = *argvp;
193 int len = strlen(*argv);
194
195 if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
196 __u8 val = 0;
197
198 if (get_u8(&val, *argv, 16))
199 invarg("FLAG value is invalid", *argv);
200 *flags = val;
201 } else {
202 while (1) {
203 if (strcmp(*argv, "noecn") == 0)
204 *flags |= XFRM_STATE_NOECN;
205 else if (strcmp(*argv, "decap-dscp") == 0)
206 *flags |= XFRM_STATE_DECAP_DSCP;
207 else if (strcmp(*argv, "nopmtudisc") == 0)
208 *flags |= XFRM_STATE_NOPMTUDISC;
209 else if (strcmp(*argv, "wildrecv") == 0)
210 *flags |= XFRM_STATE_WILDRECV;
211 else if (strcmp(*argv, "icmp") == 0)
212 *flags |= XFRM_STATE_ICMP;
213 else if (strcmp(*argv, "af-unspec") == 0)
214 *flags |= XFRM_STATE_AF_UNSPEC;
215 else if (strcmp(*argv, "align4") == 0)
216 *flags |= XFRM_STATE_ALIGN4;
217 else if (strcmp(*argv, "esn") == 0)
218 *flags |= XFRM_STATE_ESN;
219 else {
220 PREV_ARG(); /* back track */
221 break;
222 }
223
224 if (!NEXT_ARG_OK())
225 break;
226 NEXT_ARG();
227 }
228 }
229
230 *argcp = argc;
231 *argvp = argv;
232
233 return 0;
234 }
235
236 static int xfrm_state_extra_flag_parse(__u32 *extra_flags, int *argcp, char ***argvp)
237 {
238 int argc = *argcp;
239 char **argv = *argvp;
240 int len = strlen(*argv);
241
242 if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
243 __u32 val = 0;
244
245 if (get_u32(&val, *argv, 16))
246 invarg("\"EXTRA-FLAG\" is invalid", *argv);
247 *extra_flags = val;
248 } else {
249 while (1) {
250 if (strcmp(*argv, "dont-encap-dscp") == 0)
251 *extra_flags |= XFRM_SA_XFLAG_DONT_ENCAP_DSCP;
252 else {
253 PREV_ARG(); /* back track */
254 break;
255 }
256
257 if (!NEXT_ARG_OK())
258 break;
259 NEXT_ARG();
260 }
261 }
262
263 *argcp = argc;
264 *argvp = argv;
265
266 return 0;
267 }
268
269 static int xfrm_offload_dir_parse(__u8 *dir, int *argcp, char ***argvp)
270 {
271 int argc = *argcp;
272 char **argv = *argvp;
273
274 if (strcmp(*argv, "in") == 0)
275 *dir = XFRM_OFFLOAD_INBOUND;
276 else if (strcmp(*argv, "out") == 0)
277 *dir = 0;
278 else
279 invarg("DIR value is invalid", *argv);
280
281 *argcp = argc;
282 *argvp = argv;
283
284 return 0;
285 }
286
287 static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
288 {
289 struct rtnl_handle rth;
290 struct {
291 struct nlmsghdr n;
292 struct xfrm_usersa_info xsinfo;
293 char buf[RTA_BUF_SIZE];
294 } req = {
295 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo)),
296 .n.nlmsg_flags = NLM_F_REQUEST | flags,
297 .n.nlmsg_type = cmd,
298 .xsinfo.family = preferred_family,
299 .xsinfo.lft.soft_byte_limit = XFRM_INF,
300 .xsinfo.lft.hard_byte_limit = XFRM_INF,
301 .xsinfo.lft.soft_packet_limit = XFRM_INF,
302 .xsinfo.lft.hard_packet_limit = XFRM_INF,
303 };
304 struct xfrm_replay_state replay = {};
305 struct xfrm_replay_state_esn replay_esn = {};
306 struct xfrm_user_offload xuo = {};
307 unsigned int ifindex = 0;
308 __u8 dir = 0;
309 bool is_offload = false;
310 __u32 replay_window = 0;
311 __u32 seq = 0, oseq = 0, seq_hi = 0, oseq_hi = 0;
312 char *idp = NULL;
313 char *aeadop = NULL;
314 char *ealgop = NULL;
315 char *aalgop = NULL;
316 char *calgop = NULL;
317 char *coap = NULL;
318 char *sctxp = NULL;
319 __u32 extra_flags = 0;
320 struct xfrm_mark mark = {0, 0};
321 struct {
322 struct xfrm_user_sec_ctx sctx;
323 char str[CTX_BUF_SIZE];
324 } ctx = {};
325
326 while (argc > 0) {
327 if (strcmp(*argv, "mode") == 0) {
328 NEXT_ARG();
329 xfrm_mode_parse(&req.xsinfo.mode, &argc, &argv);
330 } else if (strcmp(*argv, "mark") == 0) {
331 xfrm_parse_mark(&mark, &argc, &argv);
332 } else if (strcmp(*argv, "reqid") == 0) {
333 NEXT_ARG();
334 xfrm_reqid_parse(&req.xsinfo.reqid, &argc, &argv);
335 } else if (strcmp(*argv, "seq") == 0) {
336 NEXT_ARG();
337 xfrm_seq_parse(&req.xsinfo.seq, &argc, &argv);
338 } else if (strcmp(*argv, "replay-window") == 0) {
339 NEXT_ARG();
340 if (get_u32(&replay_window, *argv, 0))
341 invarg("value after \"replay-window\" is invalid", *argv);
342 } else if (strcmp(*argv, "replay-seq") == 0) {
343 NEXT_ARG();
344 if (get_u32(&seq, *argv, 0))
345 invarg("value after \"replay-seq\" is invalid", *argv);
346 } else if (strcmp(*argv, "replay-seq-hi") == 0) {
347 NEXT_ARG();
348 if (get_u32(&seq_hi, *argv, 0))
349 invarg("value after \"replay-seq-hi\" is invalid", *argv);
350 } else if (strcmp(*argv, "replay-oseq") == 0) {
351 NEXT_ARG();
352 if (get_u32(&oseq, *argv, 0))
353 invarg("value after \"replay-oseq\" is invalid", *argv);
354 } else if (strcmp(*argv, "replay-oseq-hi") == 0) {
355 NEXT_ARG();
356 if (get_u32(&oseq_hi, *argv, 0))
357 invarg("value after \"replay-oseq-hi\" is invalid", *argv);
358 } else if (strcmp(*argv, "flag") == 0) {
359 NEXT_ARG();
360 xfrm_state_flag_parse(&req.xsinfo.flags, &argc, &argv);
361 } else if (strcmp(*argv, "extra-flag") == 0) {
362 NEXT_ARG();
363 xfrm_state_extra_flag_parse(&extra_flags, &argc, &argv);
364 } else if (strcmp(*argv, "sel") == 0) {
365 NEXT_ARG();
366 preferred_family = AF_UNSPEC;
367 xfrm_selector_parse(&req.xsinfo.sel, &argc, &argv);
368 preferred_family = req.xsinfo.sel.family;
369 } else if (strcmp(*argv, "limit") == 0) {
370 NEXT_ARG();
371 xfrm_lifetime_cfg_parse(&req.xsinfo.lft, &argc, &argv);
372 } else if (strcmp(*argv, "encap") == 0) {
373 struct xfrm_encap_tmpl encap;
374 inet_prefix oa;
375 NEXT_ARG();
376 xfrm_encap_type_parse(&encap.encap_type, &argc, &argv);
377 NEXT_ARG();
378 if (get_be16(&encap.encap_sport, *argv, 0))
379 invarg("SPORT value after \"encap\" is invalid", *argv);
380 NEXT_ARG();
381 if (get_be16(&encap.encap_dport, *argv, 0))
382 invarg("DPORT value after \"encap\" is invalid", *argv);
383 NEXT_ARG();
384 get_addr(&oa, *argv, AF_UNSPEC);
385 memcpy(&encap.encap_oa, &oa.data, sizeof(encap.encap_oa));
386 addattr_l(&req.n, sizeof(req.buf), XFRMA_ENCAP,
387 (void *)&encap, sizeof(encap));
388 } else if (strcmp(*argv, "coa") == 0) {
389 inet_prefix coa;
390 xfrm_address_t xcoa = {};
391
392 if (coap)
393 duparg("coa", *argv);
394 coap = *argv;
395
396 NEXT_ARG();
397
398 get_prefix(&coa, *argv, preferred_family);
399 if (coa.family == AF_UNSPEC)
400 invarg("value after \"coa\" has an unrecognized address family", *argv);
401 if (coa.bytelen > sizeof(xcoa))
402 invarg("value after \"coa\" is too large", *argv);
403
404 memcpy(&xcoa, &coa.data, coa.bytelen);
405
406 addattr_l(&req.n, sizeof(req.buf), XFRMA_COADDR,
407 (void *)&xcoa, sizeof(xcoa));
408 } else if (strcmp(*argv, "ctx") == 0) {
409 char *context;
410
411 if (sctxp)
412 duparg("ctx", *argv);
413 sctxp = *argv;
414
415 NEXT_ARG();
416 context = *argv;
417
418 xfrm_sctx_parse((char *)&ctx.str, context, &ctx.sctx);
419 addattr_l(&req.n, sizeof(req.buf), XFRMA_SEC_CTX,
420 (void *)&ctx, ctx.sctx.len);
421 } else if (strcmp(*argv, "offload") == 0) {
422 is_offload = true;
423 NEXT_ARG();
424 if (strcmp(*argv, "dev") == 0) {
425 NEXT_ARG();
426 ifindex = ll_name_to_index(*argv);
427 if (!ifindex) {
428 invarg("value after \"offload dev\" is invalid", *argv);
429 is_offload = false;
430 }
431 NEXT_ARG();
432 }
433 if (strcmp(*argv, "dir") == 0) {
434 NEXT_ARG();
435 xfrm_offload_dir_parse(&dir, &argc, &argv);
436 } else {
437 invarg("value after \"offload dir\" is invalid", *argv);
438 is_offload = false;
439 }
440 } else {
441 /* try to assume ALGO */
442 int type = xfrm_algotype_getbyname(*argv);
443
444 switch (type) {
445 case XFRMA_ALG_AEAD:
446 case XFRMA_ALG_CRYPT:
447 case XFRMA_ALG_AUTH:
448 case XFRMA_ALG_AUTH_TRUNC:
449 case XFRMA_ALG_COMP:
450 {
451 /* ALGO */
452 struct {
453 union {
454 struct xfrm_algo alg;
455 struct xfrm_algo_aead aead;
456 struct xfrm_algo_auth auth;
457 } u;
458 char buf[XFRM_ALGO_KEY_BUF_SIZE];
459 } alg = {};
460 int len;
461 __u32 icvlen, trunclen;
462 char *name;
463 char *key = "";
464 char *buf;
465
466 switch (type) {
467 case XFRMA_ALG_AEAD:
468 if (ealgop || aalgop || aeadop)
469 duparg("ALGO-TYPE", *argv);
470 aeadop = *argv;
471 break;
472 case XFRMA_ALG_CRYPT:
473 if (ealgop || aeadop)
474 duparg("ALGO-TYPE", *argv);
475 ealgop = *argv;
476 break;
477 case XFRMA_ALG_AUTH:
478 case XFRMA_ALG_AUTH_TRUNC:
479 if (aalgop || aeadop)
480 duparg("ALGO-TYPE", *argv);
481 aalgop = *argv;
482 break;
483 case XFRMA_ALG_COMP:
484 if (calgop)
485 duparg("ALGO-TYPE", *argv);
486 calgop = *argv;
487 break;
488 default:
489 /* not reached */
490 invarg("ALGO-TYPE value is invalid\n", *argv);
491 }
492
493 if (!NEXT_ARG_OK())
494 missarg("ALGO-NAME");
495 NEXT_ARG();
496 name = *argv;
497
498 switch (type) {
499 case XFRMA_ALG_AEAD:
500 case XFRMA_ALG_CRYPT:
501 case XFRMA_ALG_AUTH:
502 case XFRMA_ALG_AUTH_TRUNC:
503 if (!NEXT_ARG_OK())
504 missarg("ALGO-KEYMAT");
505 NEXT_ARG();
506 key = *argv;
507 break;
508 }
509
510 buf = alg.u.alg.alg_key;
511 len = sizeof(alg.u.alg);
512
513 switch (type) {
514 case XFRMA_ALG_AEAD:
515 if (!NEXT_ARG_OK())
516 missarg("ALGO-ICV-LEN");
517 NEXT_ARG();
518 if (get_u32(&icvlen, *argv, 0))
519 invarg("ALGO-ICV-LEN value is invalid",
520 *argv);
521 alg.u.aead.alg_icv_len = icvlen;
522
523 buf = alg.u.aead.alg_key;
524 len = sizeof(alg.u.aead);
525 break;
526 case XFRMA_ALG_AUTH_TRUNC:
527 if (!NEXT_ARG_OK())
528 missarg("ALGO-TRUNC-LEN");
529 NEXT_ARG();
530 if (get_u32(&trunclen, *argv, 0))
531 invarg("ALGO-TRUNC-LEN value is invalid",
532 *argv);
533 alg.u.auth.alg_trunc_len = trunclen;
534
535 buf = alg.u.auth.alg_key;
536 len = sizeof(alg.u.auth);
537 break;
538 }
539
540 xfrm_algo_parse((void *)&alg, type, name, key,
541 buf, sizeof(alg.buf));
542 len += alg.u.alg.alg_key_len / 8;
543
544 addattr_l(&req.n, sizeof(req.buf), type,
545 (void *)&alg, len);
546 break;
547 }
548 default:
549 /* try to assume ID */
550 if (idp)
551 invarg("unknown", *argv);
552 idp = *argv;
553
554 /* ID */
555 xfrm_id_parse(&req.xsinfo.saddr, &req.xsinfo.id,
556 &req.xsinfo.family, 0, &argc, &argv);
557 if (preferred_family == AF_UNSPEC)
558 preferred_family = req.xsinfo.family;
559 }
560 }
561 argc--; argv++;
562 }
563
564 if (req.xsinfo.flags & XFRM_STATE_ESN &&
565 replay_window == 0) {
566 fprintf(stderr, "Error: esn flag set without replay-window.\n");
567 exit(-1);
568 }
569
570 if (replay_window > XFRMA_REPLAY_ESN_MAX) {
571 fprintf(stderr,
572 "Error: replay-window (%u) > XFRMA_REPLAY_ESN_MAX (%u).\n",
573 replay_window, XFRMA_REPLAY_ESN_MAX);
574 exit(-1);
575 }
576
577 if (is_offload) {
578 xuo.ifindex = ifindex;
579 xuo.flags = dir;
580 addattr_l(&req.n, sizeof(req.buf), XFRMA_OFFLOAD_DEV, &xuo,
581 sizeof(xuo));
582 }
583 if (req.xsinfo.flags & XFRM_STATE_ESN ||
584 replay_window > (sizeof(replay.bitmap) * 8)) {
585 replay_esn.seq = seq;
586 replay_esn.oseq = oseq;
587 replay_esn.seq_hi = seq_hi;
588 replay_esn.oseq_hi = oseq_hi;
589 replay_esn.replay_window = replay_window;
590 replay_esn.bmp_len = (replay_window + sizeof(__u32) * 8 - 1) /
591 (sizeof(__u32) * 8);
592 addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_ESN_VAL,
593 &replay_esn, sizeof(replay_esn));
594 } else {
595 if (seq || oseq) {
596 replay.seq = seq;
597 replay.oseq = oseq;
598 addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_VAL,
599 &replay, sizeof(replay));
600 }
601 req.xsinfo.replay_window = replay_window;
602 }
603
604 if (extra_flags)
605 addattr32(&req.n, sizeof(req.buf), XFRMA_SA_EXTRA_FLAGS,
606 extra_flags);
607
608 if (!idp) {
609 fprintf(stderr, "Not enough information: ID is required\n");
610 exit(1);
611 }
612
613 if (mark.m) {
614 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
615 (void *)&mark, sizeof(mark));
616 if (r < 0) {
617 fprintf(stderr, "XFRMA_MARK failed\n");
618 exit(1);
619 }
620 }
621
622 if (xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) {
623 switch (req.xsinfo.mode) {
624 case XFRM_MODE_TRANSPORT:
625 case XFRM_MODE_TUNNEL:
626 break;
627 case XFRM_MODE_BEET:
628 if (req.xsinfo.id.proto == IPPROTO_ESP)
629 break;
630 default:
631 fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
632 strxf_xfrmproto(req.xsinfo.id.proto));
633 exit(1);
634 }
635
636 switch (req.xsinfo.id.proto) {
637 case IPPROTO_ESP:
638 if (calgop) {
639 fprintf(stderr, "ALGO-TYPE value \"%s\" is invalid with XFRM-PROTO value \"%s\"\n",
640 strxf_algotype(XFRMA_ALG_COMP),
641 strxf_xfrmproto(req.xsinfo.id.proto));
642 exit(1);
643 }
644 if (!ealgop && !aeadop) {
645 fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
646 strxf_algotype(XFRMA_ALG_CRYPT),
647 strxf_algotype(XFRMA_ALG_AEAD),
648 strxf_xfrmproto(req.xsinfo.id.proto));
649 exit(1);
650 }
651 break;
652 case IPPROTO_AH:
653 if (ealgop || aeadop || calgop) {
654 fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
655 strxf_algotype(XFRMA_ALG_CRYPT),
656 strxf_algotype(XFRMA_ALG_AEAD),
657 strxf_algotype(XFRMA_ALG_COMP),
658 strxf_xfrmproto(req.xsinfo.id.proto));
659 exit(1);
660 }
661 if (!aalgop) {
662 fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
663 strxf_algotype(XFRMA_ALG_AUTH),
664 strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
665 strxf_xfrmproto(req.xsinfo.id.proto));
666 exit(1);
667 }
668 break;
669 case IPPROTO_COMP:
670 if (ealgop || aalgop || aeadop) {
671 fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
672 strxf_algotype(XFRMA_ALG_CRYPT),
673 strxf_algotype(XFRMA_ALG_AUTH),
674 strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
675 strxf_algotype(XFRMA_ALG_AEAD),
676 strxf_xfrmproto(req.xsinfo.id.proto));
677 exit(1);
678 }
679 if (!calgop) {
680 fprintf(stderr, "ALGO-TYPE value \"%s\" is required with XFRM-PROTO value \"%s\"\n",
681 strxf_algotype(XFRMA_ALG_COMP),
682 strxf_xfrmproto(req.xsinfo.id.proto));
683 exit(1);
684 }
685 break;
686 }
687 } else {
688 if (ealgop || aalgop || aeadop || calgop) {
689 fprintf(stderr, "ALGO is invalid with XFRM-PROTO value \"%s\"\n",
690 strxf_xfrmproto(req.xsinfo.id.proto));
691 exit(1);
692 }
693 }
694
695 if (xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
696 switch (req.xsinfo.mode) {
697 case XFRM_MODE_ROUTEOPTIMIZATION:
698 case XFRM_MODE_IN_TRIGGER:
699 break;
700 case 0:
701 fprintf(stderr, "\"mode\" is required with XFRM-PROTO value \"%s\"\n",
702 strxf_xfrmproto(req.xsinfo.id.proto));
703 exit(1);
704 default:
705 fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
706 strxf_xfrmproto(req.xsinfo.id.proto));
707 exit(1);
708 }
709
710 if (!coap) {
711 fprintf(stderr, "\"coa\" is required with XFRM-PROTO value \"%s\"\n",
712 strxf_xfrmproto(req.xsinfo.id.proto));
713 exit(1);
714 }
715 } else {
716 if (coap) {
717 fprintf(stderr, "\"coa\" is invalid with XFRM-PROTO value \"%s\"\n",
718 strxf_xfrmproto(req.xsinfo.id.proto));
719 exit(1);
720 }
721 }
722
723 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
724 exit(1);
725
726 if (req.xsinfo.family == AF_UNSPEC)
727 req.xsinfo.family = AF_INET;
728
729 if (rtnl_talk(&rth, &req.n, NULL) < 0)
730 exit(2);
731
732 rtnl_close(&rth);
733
734 return 0;
735 }
736
737 static int xfrm_state_allocspi(int argc, char **argv)
738 {
739 struct rtnl_handle rth;
740 struct {
741 struct nlmsghdr n;
742 struct xfrm_userspi_info xspi;
743 char buf[RTA_BUF_SIZE];
744 } req = {
745 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xspi)),
746 .n.nlmsg_flags = NLM_F_REQUEST,
747 .n.nlmsg_type = XFRM_MSG_ALLOCSPI,
748 .xspi.info.family = preferred_family,
749 #if 0
750 .xspi.lft.soft_byte_limit = XFRM_INF,
751 .xspi.lft.hard_byte_limit = XFRM_INF,
752 .xspi.lft.soft_packet_limit = XFRM_INF,
753 .xspi.lft.hard_packet_limit = XFRM_INF,
754 #endif
755 };
756 char *idp = NULL;
757 char *minp = NULL;
758 char *maxp = NULL;
759 struct xfrm_mark mark = {0, 0};
760 struct nlmsghdr *answer;
761
762 while (argc > 0) {
763 if (strcmp(*argv, "mode") == 0) {
764 NEXT_ARG();
765 xfrm_mode_parse(&req.xspi.info.mode, &argc, &argv);
766 } else if (strcmp(*argv, "mark") == 0) {
767 xfrm_parse_mark(&mark, &argc, &argv);
768 } else if (strcmp(*argv, "reqid") == 0) {
769 NEXT_ARG();
770 xfrm_reqid_parse(&req.xspi.info.reqid, &argc, &argv);
771 } else if (strcmp(*argv, "seq") == 0) {
772 NEXT_ARG();
773 xfrm_seq_parse(&req.xspi.info.seq, &argc, &argv);
774 } else if (strcmp(*argv, "min") == 0) {
775 if (minp)
776 duparg("min", *argv);
777 minp = *argv;
778
779 NEXT_ARG();
780
781 if (get_u32(&req.xspi.min, *argv, 0))
782 invarg("value after \"min\" is invalid", *argv);
783 } else if (strcmp(*argv, "max") == 0) {
784 if (maxp)
785 duparg("max", *argv);
786 maxp = *argv;
787
788 NEXT_ARG();
789
790 if (get_u32(&req.xspi.max, *argv, 0))
791 invarg("value after \"max\" is invalid", *argv);
792 } else {
793 /* try to assume ID */
794 if (idp)
795 invarg("unknown", *argv);
796 idp = *argv;
797
798 /* ID */
799 xfrm_id_parse(&req.xspi.info.saddr, &req.xspi.info.id,
800 &req.xspi.info.family, 0, &argc, &argv);
801 if (req.xspi.info.id.spi) {
802 fprintf(stderr, "\"spi\" is invalid\n");
803 exit(1);
804 }
805 if (preferred_family == AF_UNSPEC)
806 preferred_family = req.xspi.info.family;
807 }
808 argc--; argv++;
809 }
810
811 if (!idp) {
812 fprintf(stderr, "Not enough information: ID is required\n");
813 exit(1);
814 }
815
816 if (minp) {
817 if (!maxp) {
818 fprintf(stderr, "\"max\" is missing\n");
819 exit(1);
820 }
821 if (req.xspi.min > req.xspi.max) {
822 fprintf(stderr, "value after \"min\" is larger than value after \"max\"\n");
823 exit(1);
824 }
825 } else {
826 if (maxp) {
827 fprintf(stderr, "\"min\" is missing\n");
828 exit(1);
829 }
830
831 /* XXX: Default value defined in PF_KEY;
832 * See kernel's net/key/af_key.c(pfkey_getspi).
833 */
834 req.xspi.min = 0x100;
835 req.xspi.max = 0x0fffffff;
836
837 /* XXX: IPCOMP spi is 16-bits;
838 * See kernel's net/xfrm/xfrm_user(verify_userspi_info).
839 */
840 if (req.xspi.info.id.proto == IPPROTO_COMP)
841 req.xspi.max = 0xffff;
842 }
843
844 if (mark.m & mark.v) {
845 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
846 (void *)&mark, sizeof(mark));
847 if (r < 0) {
848 fprintf(stderr, "XFRMA_MARK failed\n");
849 exit(1);
850 }
851 }
852
853 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
854 exit(1);
855
856 if (req.xspi.info.family == AF_UNSPEC)
857 req.xspi.info.family = AF_INET;
858
859
860 if (rtnl_talk(&rth, &req.n, &answer) < 0)
861 exit(2);
862
863 if (xfrm_state_print(NULL, answer, (void *)stdout) < 0) {
864 fprintf(stderr, "An error :-)\n");
865 exit(1);
866 }
867
868 free(answer);
869 rtnl_close(&rth);
870
871 return 0;
872 }
873
874 static int xfrm_state_filter_match(struct xfrm_usersa_info *xsinfo)
875 {
876 if (!filter.use)
877 return 1;
878
879 if (filter.id_src_mask)
880 if (xfrm_addr_match(&xsinfo->saddr, &filter.xsinfo.saddr,
881 filter.id_src_mask))
882 return 0;
883 if (filter.id_dst_mask)
884 if (xfrm_addr_match(&xsinfo->id.daddr, &filter.xsinfo.id.daddr,
885 filter.id_dst_mask))
886 return 0;
887 if ((xsinfo->id.proto^filter.xsinfo.id.proto)&filter.id_proto_mask)
888 return 0;
889 if ((xsinfo->id.spi^filter.xsinfo.id.spi)&filter.id_spi_mask)
890 return 0;
891 if ((xsinfo->mode^filter.xsinfo.mode)&filter.mode_mask)
892 return 0;
893 if ((xsinfo->reqid^filter.xsinfo.reqid)&filter.reqid_mask)
894 return 0;
895 if (filter.state_flags_mask)
896 if ((xsinfo->flags & filter.xsinfo.flags) == 0)
897 return 0;
898
899 return 1;
900 }
901
902 int xfrm_state_print(const struct sockaddr_nl *who, struct nlmsghdr *n,
903 void *arg)
904 {
905 FILE *fp = (FILE *)arg;
906 struct rtattr *tb[XFRMA_MAX+1];
907 struct rtattr *rta;
908 struct xfrm_usersa_info *xsinfo = NULL;
909 struct xfrm_user_expire *xexp = NULL;
910 struct xfrm_usersa_id *xsid = NULL;
911 int len = n->nlmsg_len;
912
913 if (n->nlmsg_type != XFRM_MSG_NEWSA &&
914 n->nlmsg_type != XFRM_MSG_DELSA &&
915 n->nlmsg_type != XFRM_MSG_UPDSA &&
916 n->nlmsg_type != XFRM_MSG_EXPIRE) {
917 fprintf(stderr, "Not a state: %08x %08x %08x\n",
918 n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
919 return 0;
920 }
921
922 if (n->nlmsg_type == XFRM_MSG_DELSA) {
923 /* Dont blame me for this .. Herbert made me do it */
924 xsid = NLMSG_DATA(n);
925 len -= NLMSG_SPACE(sizeof(*xsid));
926 } else if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
927 xexp = NLMSG_DATA(n);
928 xsinfo = &xexp->state;
929 len -= NLMSG_SPACE(sizeof(*xexp));
930 } else {
931 xexp = NULL;
932 xsinfo = NLMSG_DATA(n);
933 len -= NLMSG_SPACE(sizeof(*xsinfo));
934 }
935
936 if (len < 0) {
937 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
938 return -1;
939 }
940
941 if (xsinfo && !xfrm_state_filter_match(xsinfo))
942 return 0;
943
944 if (n->nlmsg_type == XFRM_MSG_DELSA)
945 fprintf(fp, "Deleted ");
946 else if (n->nlmsg_type == XFRM_MSG_UPDSA)
947 fprintf(fp, "Updated ");
948 else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
949 fprintf(fp, "Expired ");
950
951 if (n->nlmsg_type == XFRM_MSG_DELSA)
952 rta = XFRMSID_RTA(xsid);
953 else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
954 rta = XFRMEXP_RTA(xexp);
955 else
956 rta = XFRMS_RTA(xsinfo);
957
958 parse_rtattr(tb, XFRMA_MAX, rta, len);
959
960 if (n->nlmsg_type == XFRM_MSG_DELSA) {
961 /* xfrm_policy_id_print(); */
962
963 if (!tb[XFRMA_SA]) {
964 fprintf(stderr, "Buggy XFRM_MSG_DELSA: no XFRMA_SA\n");
965 return -1;
966 }
967 if (RTA_PAYLOAD(tb[XFRMA_SA]) < sizeof(*xsinfo)) {
968 fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: too short XFRMA_POLICY len\n");
969 return -1;
970 }
971 xsinfo = RTA_DATA(tb[XFRMA_SA]);
972 }
973
974 xfrm_state_info_print(xsinfo, tb, fp, NULL, NULL);
975
976 if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
977 fprintf(fp, "\t");
978 fprintf(fp, "hard %u", xexp->hard);
979 fprintf(fp, "%s", _SL_);
980 }
981
982 if (oneline)
983 fprintf(fp, "\n");
984 fflush(fp);
985
986 return 0;
987 }
988
989 static int xfrm_state_get_or_delete(int argc, char **argv, int delete)
990 {
991 struct rtnl_handle rth;
992 struct {
993 struct nlmsghdr n;
994 struct xfrm_usersa_id xsid;
995 char buf[RTA_BUF_SIZE];
996 } req = {
997 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsid)),
998 .n.nlmsg_flags = NLM_F_REQUEST,
999 .n.nlmsg_type = delete ? XFRM_MSG_DELSA : XFRM_MSG_GETSA,
1000 .xsid.family = preferred_family,
1001 };
1002 struct xfrm_id id;
1003 char *idp = NULL;
1004 struct xfrm_mark mark = {0, 0};
1005
1006 while (argc > 0) {
1007 xfrm_address_t saddr;
1008
1009 if (strcmp(*argv, "mark") == 0) {
1010 xfrm_parse_mark(&mark, &argc, &argv);
1011 } else {
1012 if (idp)
1013 invarg("unknown", *argv);
1014 idp = *argv;
1015
1016 /* ID */
1017 memset(&id, 0, sizeof(id));
1018 memset(&saddr, 0, sizeof(saddr));
1019 xfrm_id_parse(&saddr, &id, &req.xsid.family, 0,
1020 &argc, &argv);
1021
1022 memcpy(&req.xsid.daddr, &id.daddr, sizeof(req.xsid.daddr));
1023 req.xsid.spi = id.spi;
1024 req.xsid.proto = id.proto;
1025
1026 addattr_l(&req.n, sizeof(req.buf), XFRMA_SRCADDR,
1027 (void *)&saddr, sizeof(saddr));
1028 }
1029
1030 argc--; argv++;
1031 }
1032
1033 if (mark.m & mark.v) {
1034 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
1035 (void *)&mark, sizeof(mark));
1036 if (r < 0) {
1037 fprintf(stderr, "XFRMA_MARK failed\n");
1038 exit(1);
1039 }
1040 }
1041
1042 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1043 exit(1);
1044
1045 if (req.xsid.family == AF_UNSPEC)
1046 req.xsid.family = AF_INET;
1047
1048 if (delete) {
1049 if (rtnl_talk(&rth, &req.n, NULL) < 0)
1050 exit(2);
1051 } else {
1052 struct nlmsghdr *answer;
1053
1054 if (rtnl_talk(&rth, &req.n, &answer) < 0)
1055 exit(2);
1056
1057 if (xfrm_state_print(NULL, answer, (void *)stdout) < 0) {
1058 fprintf(stderr, "An error :-)\n");
1059 exit(1);
1060 }
1061
1062 free(answer);
1063 }
1064
1065 rtnl_close(&rth);
1066
1067 return 0;
1068 }
1069
1070 /*
1071 * With an existing state of nlmsg, make new nlmsg for deleting the state
1072 * and store it to buffer.
1073 */
1074 static int xfrm_state_keep(const struct sockaddr_nl *who,
1075 struct nlmsghdr *n,
1076 void *arg)
1077 {
1078 struct xfrm_buffer *xb = (struct xfrm_buffer *)arg;
1079 struct rtnl_handle *rth = xb->rth;
1080 struct xfrm_usersa_info *xsinfo = NLMSG_DATA(n);
1081 int len = n->nlmsg_len;
1082 struct nlmsghdr *new_n;
1083 struct xfrm_usersa_id *xsid;
1084
1085 if (n->nlmsg_type != XFRM_MSG_NEWSA) {
1086 fprintf(stderr, "Not a state: %08x %08x %08x\n",
1087 n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
1088 return 0;
1089 }
1090
1091 len -= NLMSG_LENGTH(sizeof(*xsinfo));
1092 if (len < 0) {
1093 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
1094 return -1;
1095 }
1096
1097 if (!xfrm_state_filter_match(xsinfo))
1098 return 0;
1099
1100 if (xb->offset > xb->size) {
1101 fprintf(stderr, "State buffer overflow\n");
1102 return -1;
1103 }
1104
1105 new_n = (struct nlmsghdr *)(xb->buf + xb->offset);
1106 new_n->nlmsg_len = NLMSG_LENGTH(sizeof(*xsid));
1107 new_n->nlmsg_flags = NLM_F_REQUEST;
1108 new_n->nlmsg_type = XFRM_MSG_DELSA;
1109 new_n->nlmsg_seq = ++rth->seq;
1110
1111 xsid = NLMSG_DATA(new_n);
1112 xsid->family = xsinfo->family;
1113 memcpy(&xsid->daddr, &xsinfo->id.daddr, sizeof(xsid->daddr));
1114 xsid->spi = xsinfo->id.spi;
1115 xsid->proto = xsinfo->id.proto;
1116
1117 addattr_l(new_n, xb->size, XFRMA_SRCADDR, &xsinfo->saddr,
1118 sizeof(xsid->daddr));
1119
1120 xb->offset += new_n->nlmsg_len;
1121 xb->nlmsg_count++;
1122
1123 return 0;
1124 }
1125
1126 static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall)
1127 {
1128 char *idp = NULL;
1129 struct rtnl_handle rth;
1130
1131 if (argc > 0)
1132 filter.use = 1;
1133 filter.xsinfo.family = preferred_family;
1134
1135 while (argc > 0) {
1136 if (strcmp(*argv, "mode") == 0) {
1137 NEXT_ARG();
1138 xfrm_mode_parse(&filter.xsinfo.mode, &argc, &argv);
1139
1140 filter.mode_mask = XFRM_FILTER_MASK_FULL;
1141
1142 } else if (strcmp(*argv, "reqid") == 0) {
1143 NEXT_ARG();
1144 xfrm_reqid_parse(&filter.xsinfo.reqid, &argc, &argv);
1145
1146 filter.reqid_mask = XFRM_FILTER_MASK_FULL;
1147
1148 } else if (strcmp(*argv, "flag") == 0) {
1149 NEXT_ARG();
1150 xfrm_state_flag_parse(&filter.xsinfo.flags, &argc, &argv);
1151
1152 filter.state_flags_mask = XFRM_FILTER_MASK_FULL;
1153
1154 } else {
1155 if (idp)
1156 invarg("unknown", *argv);
1157 idp = *argv;
1158
1159 /* ID */
1160 xfrm_id_parse(&filter.xsinfo.saddr, &filter.xsinfo.id,
1161 &filter.xsinfo.family, 1, &argc, &argv);
1162 if (preferred_family == AF_UNSPEC)
1163 preferred_family = filter.xsinfo.family;
1164 }
1165 argc--; argv++;
1166 }
1167
1168 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1169 exit(1);
1170
1171 if (deleteall) {
1172 struct xfrm_buffer xb;
1173 char buf[NLMSG_DELETEALL_BUF_SIZE];
1174 int i;
1175
1176 xb.buf = buf;
1177 xb.size = sizeof(buf);
1178 xb.rth = &rth;
1179
1180 for (i = 0; ; i++) {
1181 struct {
1182 struct nlmsghdr n;
1183 char buf[NLMSG_BUF_SIZE];
1184 } req = {
1185 .n.nlmsg_len = NLMSG_HDRLEN,
1186 .n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
1187 .n.nlmsg_type = XFRM_MSG_GETSA,
1188 .n.nlmsg_seq = rth.dump = ++rth.seq,
1189 };
1190
1191 xb.offset = 0;
1192 xb.nlmsg_count = 0;
1193
1194 if (show_stats > 1)
1195 fprintf(stderr, "Delete-all round = %d\n", i);
1196
1197 if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
1198 perror("Cannot send dump request");
1199 exit(1);
1200 }
1201
1202 if (rtnl_dump_filter(&rth, xfrm_state_keep, &xb) < 0) {
1203 fprintf(stderr, "Delete-all terminated\n");
1204 exit(1);
1205 }
1206 if (xb.nlmsg_count == 0) {
1207 if (show_stats > 1)
1208 fprintf(stderr, "Delete-all completed\n");
1209 break;
1210 }
1211
1212 if (rtnl_send_check(&rth, xb.buf, xb.offset) < 0) {
1213 perror("Failed to send delete-all request\n");
1214 exit(1);
1215 }
1216 if (show_stats > 1)
1217 fprintf(stderr, "Delete-all nlmsg count = %d\n", xb.nlmsg_count);
1218
1219 xb.offset = 0;
1220 xb.nlmsg_count = 0;
1221 }
1222
1223 } else {
1224 struct xfrm_address_filter addrfilter = {
1225 .saddr = filter.xsinfo.saddr,
1226 .daddr = filter.xsinfo.id.daddr,
1227 .family = filter.xsinfo.family,
1228 .splen = filter.id_src_mask,
1229 .dplen = filter.id_dst_mask,
1230 };
1231 struct {
1232 struct nlmsghdr n;
1233 char buf[NLMSG_BUF_SIZE];
1234 } req = {
1235 .n.nlmsg_len = NLMSG_HDRLEN,
1236 .n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
1237 .n.nlmsg_type = XFRM_MSG_GETSA,
1238 .n.nlmsg_seq = rth.dump = ++rth.seq,
1239 };
1240
1241 if (filter.xsinfo.id.proto)
1242 addattr8(&req.n, sizeof(req), XFRMA_PROTO,
1243 filter.xsinfo.id.proto);
1244 addattr_l(&req.n, sizeof(req), XFRMA_ADDRESS_FILTER,
1245 &addrfilter, sizeof(addrfilter));
1246
1247 if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
1248 perror("Cannot send dump request");
1249 exit(1);
1250 }
1251
1252 if (rtnl_dump_filter(&rth, xfrm_state_print, stdout) < 0) {
1253 fprintf(stderr, "Dump terminated\n");
1254 exit(1);
1255 }
1256 }
1257
1258 rtnl_close(&rth);
1259
1260 exit(0);
1261 }
1262
1263 static int print_sadinfo(struct nlmsghdr *n, void *arg)
1264 {
1265 FILE *fp = (FILE *)arg;
1266 __u32 *f = NLMSG_DATA(n);
1267 struct rtattr *tb[XFRMA_SAD_MAX+1];
1268 struct rtattr *rta;
1269 int len = n->nlmsg_len;
1270
1271 len -= NLMSG_LENGTH(sizeof(__u32));
1272 if (len < 0) {
1273 fprintf(stderr, "SADinfo: Wrong len %d\n", len);
1274 return -1;
1275 }
1276
1277 rta = XFRMSAPD_RTA(f);
1278 parse_rtattr(tb, XFRMA_SAD_MAX, rta, len);
1279
1280 if (tb[XFRMA_SAD_CNT]) {
1281 __u32 cnt;
1282
1283 fprintf(fp, "\t SAD");
1284 cnt = rta_getattr_u32(tb[XFRMA_SAD_CNT]);
1285 fprintf(fp, " count %u", cnt);
1286 } else {
1287 fprintf(fp, "BAD SAD info returned\n");
1288 return -1;
1289 }
1290
1291 if (show_stats) {
1292 if (tb[XFRMA_SAD_HINFO]) {
1293 struct xfrmu_sadhinfo *si;
1294
1295 if (RTA_PAYLOAD(tb[XFRMA_SAD_HINFO]) < sizeof(*si)) {
1296 fprintf(fp, "BAD SAD length returned\n");
1297 return -1;
1298 }
1299
1300 si = RTA_DATA(tb[XFRMA_SAD_HINFO]);
1301 fprintf(fp, " (buckets ");
1302 fprintf(fp, "count %d", si->sadhcnt);
1303 fprintf(fp, " Max %d", si->sadhmcnt);
1304 fprintf(fp, ")");
1305 }
1306 }
1307 fprintf(fp, "\n");
1308
1309 return 0;
1310 }
1311
1312 static int xfrm_sad_getinfo(int argc, char **argv)
1313 {
1314 struct rtnl_handle rth;
1315 struct {
1316 struct nlmsghdr n;
1317 __u32 flags;
1318 } req = {
1319 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.flags)),
1320 .n.nlmsg_flags = NLM_F_REQUEST,
1321 .n.nlmsg_type = XFRM_MSG_GETSADINFO,
1322 .flags = 0XFFFFFFFF,
1323 };
1324 struct nlmsghdr *answer;
1325
1326 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1327 exit(1);
1328
1329 if (rtnl_talk(&rth, &req.n, &answer) < 0)
1330 exit(2);
1331
1332 print_sadinfo(answer, (void *)stdout);
1333
1334 free(answer);
1335 rtnl_close(&rth);
1336
1337 return 0;
1338 }
1339
1340 static int xfrm_state_flush(int argc, char **argv)
1341 {
1342 struct rtnl_handle rth;
1343 struct {
1344 struct nlmsghdr n;
1345 struct xfrm_usersa_flush xsf;
1346 } req = {
1347 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsf)),
1348 .n.nlmsg_flags = NLM_F_REQUEST,
1349 .n.nlmsg_type = XFRM_MSG_FLUSHSA,
1350 };
1351 char *protop = NULL;
1352
1353 while (argc > 0) {
1354 if (strcmp(*argv, "proto") == 0) {
1355 int ret;
1356
1357 if (protop)
1358 duparg("proto", *argv);
1359 protop = *argv;
1360
1361 NEXT_ARG();
1362
1363 ret = xfrm_xfrmproto_getbyname(*argv);
1364 if (ret < 0)
1365 invarg("XFRM-PROTO value is invalid", *argv);
1366
1367 req.xsf.proto = (__u8)ret;
1368 } else
1369 invarg("unknown", *argv);
1370
1371 argc--; argv++;
1372 }
1373
1374 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1375 exit(1);
1376
1377 if (show_stats > 1)
1378 fprintf(stderr, "Flush state with XFRM-PROTO value \"%s\"\n",
1379 strxf_xfrmproto(req.xsf.proto));
1380
1381 if (rtnl_talk(&rth, &req.n, NULL) < 0)
1382 exit(2);
1383
1384 rtnl_close(&rth);
1385
1386 return 0;
1387 }
1388
1389 int do_xfrm_state(int argc, char **argv)
1390 {
1391 if (argc < 1)
1392 return xfrm_state_list_or_deleteall(0, NULL, 0);
1393
1394 if (matches(*argv, "add") == 0)
1395 return xfrm_state_modify(XFRM_MSG_NEWSA, 0,
1396 argc-1, argv+1);
1397 if (matches(*argv, "update") == 0)
1398 return xfrm_state_modify(XFRM_MSG_UPDSA, 0,
1399 argc-1, argv+1);
1400 if (matches(*argv, "allocspi") == 0)
1401 return xfrm_state_allocspi(argc-1, argv+1);
1402 if (matches(*argv, "delete") == 0)
1403 return xfrm_state_get_or_delete(argc-1, argv+1, 1);
1404 if (matches(*argv, "deleteall") == 0 || matches(*argv, "delall") == 0)
1405 return xfrm_state_list_or_deleteall(argc-1, argv+1, 1);
1406 if (matches(*argv, "list") == 0 || matches(*argv, "show") == 0
1407 || matches(*argv, "lst") == 0)
1408 return xfrm_state_list_or_deleteall(argc-1, argv+1, 0);
1409 if (matches(*argv, "get") == 0)
1410 return xfrm_state_get_or_delete(argc-1, argv+1, 0);
1411 if (matches(*argv, "flush") == 0)
1412 return xfrm_state_flush(argc-1, argv+1);
1413 if (matches(*argv, "count") == 0) {
1414 return xfrm_sad_getinfo(argc, argv);
1415 }
1416 if (matches(*argv, "help") == 0)
1417 usage();
1418 fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm state help\".\n", *argv);
1419 exit(-1);
1420 }
Upstream mirror of iproute2