ip/xfrm_state.c

   1 /* $USAGI: $ */
   2
   3 /*
   4  * Copyright (C)2004 USAGI/WIDE Project
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 /*
  21  * based on iproute.c
  22  */
  23 /*
  24  * Authors:
  25  *      Masahide NAKAMURA @USAGI
  26  */
  27
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <netdb.h>
  32 #include <linux/xfrm.h>
  33 #include "utils.h"
  34 #include "xfrm.h"
  35 #include "ip_common.h"
  36
  37 //#define NLMSG_FLUSH_BUF_SIZE (4096-512)
  38 #define NLMSG_FLUSH_BUF_SIZE 8192
  39
  40 /*
  41  * Receiving buffer defines:
  42  * nlmsg
  43  *   data = struct xfrm_usersa_info
  44  *   rtattr
  45  *   rtattr
  46  *   ... (max count of rtattr is XFRM_MAX_DEPTH)
  47  *
  48  *  each rtattr data = struct xfrm_algo(dynamic size) or xfrm_address_t
  49  */
  50 #define NLMSG_BUF_SIZE 4096
  51 #define RTA_BUF_SIZE 2048
  52 #define XFRM_ALGO_KEY_BUF_SIZE 512
  53
  54 static void usage(void) __attribute__((noreturn));
  55
  56 static void usage(void)
  57 {
  58         fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ]\n");
  59         fprintf(stderr, "        [ reqid REQID ] [ replay-window SIZE ] [ flag FLAG-LIST ]\n");
  60         fprintf(stderr, "        [ sel SELECTOR ] [ LIMIT-LIST ]\n");
  61
  62         fprintf(stderr, "Usage: ip xfrm state { delete | get } ID\n");
  63         fprintf(stderr, "Usage: ip xfrm state { flush | list } [ ID ] [ mode MODE ] [ reqid REQID ]\n");
  64         fprintf(stderr, "        [ flag FLAG_LIST ]\n");
  65
  66         fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM_PROTO ] [ spi SPI ]\n");
  67         //fprintf(stderr, "XFRM_PROTO := [ esp | ah | comp ]\n");
  68         fprintf(stderr, "XFRM_PROTO := [ ");
  69         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
  70         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
  71         fprintf(stderr, "%s ", strxf_xfrmproto(IPPROTO_COMP));
  72         fprintf(stderr, "]\n");
  73
  74         //fprintf(stderr, "SPI - security parameter index(default=0)\n");
  75
  76         fprintf(stderr, "MODE := [ transport | tunnel ](default=transport)\n");
  77         //fprintf(stderr, "REQID - number(default=0)\n");
  78
  79         fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
  80         fprintf(stderr, "FLAG := [ noecn | decap-dscp ]\n");
  81
  82         fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] | [ ALGO ]\n");
  83         fprintf(stderr, "ALGO := ALGO_TYPE ALGO_NAME ALGO_KEY\n");
  84         fprintf(stderr, "ALGO_TYPE := [ ");
  85         fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT));
  86         fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AUTH));
  87         fprintf(stderr, "%s ", strxf_algotype(XFRMA_ALG_COMP));
  88         fprintf(stderr, "]\n");
  89
  90         //fprintf(stderr, "ALGO_NAME - algorithm name\n");
  91         //fprintf(stderr, "ALGO_KEY - algorithm key\n");
  92
  93         fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC ] [ dev DEV ]\n");
  94
  95         fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n");
  96         fprintf(stderr, "                        [ type NUMBER ] [ code NUMBER ] ]\n");
  97
  98
  99         //fprintf(stderr, "DEV - device name(default=none)\n");
 100         fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] | [ limit LIMIT ]\n");
 101         fprintf(stderr, "LIMIT := [ [time-soft|time-hard|time-use-soft|time-use-hard] SECONDS ] |\n");
 102         fprintf(stderr, "         [ [byte-soft|byte-hard] SIZE ] | [ [packet-soft|packet-hard] COUNT ]\n");
 103         exit(-1);
 104 }
 105
 106 static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
 107                            char *name, char *key, int max)
 108 {
 109         int len;
 110         int slen = strlen(key);
 111
 112 #if 0
 113         /* XXX: verifying both name and key is required! */
 114         fprintf(stderr, "warning: ALGONAME/ALGOKEY will send to kernel promiscuously!(verifying them isn't implemented yet)\n");
 115 #endif
 116
 117         strncpy(alg->alg_name, name, sizeof(alg->alg_name));
 118
 119         if (slen > 2 && strncmp(key, "0x", 2) == 0) {
 120                 /* split two chars "0x" from the top */
 121                 char *p = key + 2;
 122                 int plen = slen - 2;
 123                 int i;
 124                 int j;
 125
 126                 /* Converting hexadecimal numbered string into real key;
 127                  * Convert each two chars into one char(value). If number
 128                  * of the length is odd, add zero on the top for rounding.
 129                  */
 130
 131                 /* calculate length of the converted values(real key) */
 132                 len = (plen + 1) / 2;
 133                 if (len > max)
 134                         invarg("\"ALGOKEY\" makes buffer overflow\n", key);
 135
 136                 for (i = - (plen % 2), j = 0; j < len; i += 2, j++) {
 137                         char vbuf[3];
 138                         char val;
 139
 140                         vbuf[0] = i >= 0 ? p[i] : '0';
 141                         vbuf[1] = p[i + 1];
 142                         vbuf[2] = '\0';
 143
 144                         if (get_u8(&val, vbuf, 16))
 145                                 invarg("\"ALGOKEY\" is invalid", key);
 146
 147                         alg->alg_key[j] = val;
 148                 }
 149         } else {
 150                 len = slen;
 151                 if (len > 0) {
 152                         if (len > max)
 153                                 invarg("\"ALGOKEY\" makes buffer overflow\n", key);
 154
 155                         strncpy(alg->alg_key, key, len);
 156                 }
 157         }
 158
 159         alg->alg_key_len = len * 8;
 160
 161         return 0;
 162 }
 163
 164 static int xfrm_state_flag_parse(__u8 *flags, int *argcp, char ***argvp)
 165 {
 166         int argc = *argcp;
 167         char **argv = *argvp;
 168         int len = strlen(*argv);
 169
 170         if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
 171                 __u8 val = 0;
 172
 173                 if (get_u8(&val, *argv, 16))
 174                         invarg("\"FLAG\" is invalid", *argv);
 175                 *flags = val;
 176         } else {
 177                 while (1) {
 178                         if (strcmp(*argv, "noecn") == 0)
 179                                 *flags |= XFRM_STATE_NOECN;
 180                         else if (strcmp(*argv, "decap-dscp") == 0)
 181                                 *flags |= XFRM_STATE_DECAP_DSCP;
 182                         else {
 183                                 PREV_ARG(); /* back track */
 184                                 break;
 185                         }
 186
 187                         if (!NEXT_ARG_OK())
 188                                 break;
 189                         NEXT_ARG();
 190                 }
 191         }
 192
 193         filter.state_flags_mask = XFRM_FILTER_MASK_FULL;
 194
 195         *argcp = argc;
 196         *argvp = argv;
 197
 198         return 0;
 199 }
 200
 201 static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
 202 {
 203         struct rtnl_handle rth;
 204         struct {
 205                 struct nlmsghdr         n;
 206                 struct xfrm_usersa_info xsinfo;
 207                 char                    buf[RTA_BUF_SIZE];
 208         } req;
 209         char *idp = NULL;
 210         char *ealgop = NULL;
 211         char *aalgop = NULL;
 212         char *calgop = NULL;
 213
 214         memset(&req, 0, sizeof(req));
 215
 216         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo));
 217         req.n.nlmsg_flags = NLM_F_REQUEST|flags;
 218         req.n.nlmsg_type = cmd;
 219         req.xsinfo.family = preferred_family;
 220
 221         req.xsinfo.lft.soft_byte_limit = XFRM_INF;
 222         req.xsinfo.lft.hard_byte_limit = XFRM_INF;
 223         req.xsinfo.lft.soft_packet_limit = XFRM_INF;
 224         req.xsinfo.lft.hard_packet_limit = XFRM_INF;
 225
 226         while (argc > 0) {
 227                 if (strcmp(*argv, "mode") == 0) {
 228                         NEXT_ARG();
 229                         xfrm_mode_parse(&req.xsinfo.mode, &argc, &argv);
 230                 } else if (strcmp(*argv, "reqid") == 0) {
 231                         NEXT_ARG();
 232                         xfrm_reqid_parse(&req.xsinfo.reqid, &argc, &argv);
 233                 } else if (strcmp(*argv, "replay-window") == 0) {
 234                         NEXT_ARG();
 235                         if (get_u8(&req.xsinfo.replay_window, *argv, 0))
 236                                 invarg("\"replay-window\" value is invalid", *argv);
 237                 } else if (strcmp(*argv, "flag") == 0) {
 238                         NEXT_ARG();
 239                         xfrm_state_flag_parse(&req.xsinfo.flags, &argc, &argv);
 240                 } else if (strcmp(*argv, "sel") == 0) {
 241                         NEXT_ARG();
 242                         xfrm_selector_parse(&req.xsinfo.sel, &argc, &argv);
 243                 } else if (strcmp(*argv, "limit") == 0) {
 244                         NEXT_ARG();
 245                         xfrm_lifetime_cfg_parse(&req.xsinfo.lft, &argc, &argv);
 246                 } else {
 247                         /* try to assume ALGO */
 248                         int type = xfrm_algotype_getbyname(*argv);
 249                         switch (type) {
 250                         case XFRMA_ALG_CRYPT:
 251                         case XFRMA_ALG_AUTH:
 252                         case XFRMA_ALG_COMP:
 253                         {
 254                                 /* ALGO */
 255                                 struct {
 256                                         struct xfrm_algo alg;
 257                                         char buf[XFRM_ALGO_KEY_BUF_SIZE];
 258                                 } alg;
 259                                 int len;
 260                                 char *name;
 261                                 char *key;
 262
 263                                 switch (type) {
 264                                 case XFRMA_ALG_CRYPT:
 265                                         if (ealgop)
 266                                                 duparg("ALGOTYPE", *argv);
 267                                         ealgop = *argv;
 268                                         break;
 269                                 case XFRMA_ALG_AUTH:
 270                                         if (aalgop)
 271                                                 duparg("ALGOTYPE", *argv);
 272                                         aalgop = *argv;
 273                                         break;
 274                                 case XFRMA_ALG_COMP:
 275                                         if (calgop)
 276                                                 duparg("ALGOTYPE", *argv);
 277                                         calgop = *argv;
 278                                         break;
 279                                 default:
 280                                         /* not reached */
 281                                         invarg("\"ALGOTYPE\" is invalid\n", *argv);
 282                                 }
 283
 284                                 if (!NEXT_ARG_OK())
 285                                         missarg("ALGONAME");
 286                                 NEXT_ARG();
 287                                 name = *argv;
 288
 289                                 if (!NEXT_ARG_OK())
 290                                         missarg("ALGOKEY");
 291                                 NEXT_ARG();
 292                                 key = *argv;
 293
 294                                 memset(&alg, 0, sizeof(alg));
 295
 296                                 xfrm_algo_parse((void *)&alg, type, name, key,
 297                                                 sizeof(alg.buf));
 298                                 len = sizeof(struct xfrm_algo) + alg.alg.alg_key_len;
 299
 300                                 addattr_l(&req.n, sizeof(req.buf), type,
 301                                           (void *)&alg, len);
 302                                 break;
 303                         }
 304                         default:
 305                                 /* try to assume ID */
 306                                 if (idp)
 307                                         invarg("unknown", *argv);
 308                                 idp = *argv;
 309
 310                                 /* ID */
 311                                 xfrm_id_parse(&req.xsinfo.saddr, &req.xsinfo.id,
 312                                               &req.xsinfo.family, 0, &argc, &argv);
 313                                 if (preferred_family == AF_UNSPEC)
 314                                         preferred_family = req.xsinfo.family;
 315                         }
 316                 }
 317                 argc--; argv++;
 318         }
 319
 320         if (!idp) {
 321                 fprintf(stderr, "Not enough information: \"ID\" is required\n");
 322                 exit(1);
 323         }
 324
 325         if (ealgop || aalgop || calgop) {
 326                 if (req.xsinfo.id.proto != IPPROTO_ESP &&
 327                     req.xsinfo.id.proto != IPPROTO_AH &&
 328                     req.xsinfo.id.proto != IPPROTO_COMP) {
 329                         fprintf(stderr, "\"ALGO\" is invalid with proto=%s\n", strxf_xfrmproto(req.xsinfo.id.proto));
 330                         exit(1);
 331                 }
 332         } else {
 333                 if (req.xsinfo.id.proto == IPPROTO_ESP ||
 334                     req.xsinfo.id.proto == IPPROTO_AH ||
 335                     req.xsinfo.id.proto == IPPROTO_COMP) {
 336                         fprintf(stderr, "\"ALGO\" is required with proto=%s\n", strxf_xfrmproto(req.xsinfo.id.proto));
 337                         exit (1);
 338                 }
 339         }
 340
 341         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 342                 exit(1);
 343
 344         if (req.xsinfo.family == AF_UNSPEC)
 345                 req.xsinfo.family = AF_INET;
 346
 347         if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
 348                 exit(2);
 349
 350         rtnl_close(&rth);
 351
 352         return 0;
 353 }
 354
 355 static int xfrm_state_filter_match(struct xfrm_usersa_info *xsinfo)
 356 {
 357         if (!filter.use)
 358                 return 1;
 359
 360         if (filter.id_src_mask)
 361                 if (xfrm_addr_match(&xsinfo->saddr, &filter.xsinfo.saddr,
 362                                     filter.id_src_mask))
 363                         return 0;
 364         if (filter.id_dst_mask)
 365                 if (xfrm_addr_match(&xsinfo->id.daddr, &filter.xsinfo.id.daddr,
 366                                     filter.id_dst_mask))
 367                         return 0;
 368         if ((xsinfo->id.proto^filter.xsinfo.id.proto)&filter.id_proto_mask)
 369                 return 0;
 370         if ((xsinfo->id.spi^filter.xsinfo.id.spi)&filter.id_spi_mask)
 371                 return 0;
 372         if ((xsinfo->mode^filter.xsinfo.mode)&filter.mode_mask)
 373                 return 0;
 374         if ((xsinfo->reqid^filter.xsinfo.reqid)&filter.reqid_mask)
 375                 return 0;
 376         if (filter.state_flags_mask)
 377                 if ((xsinfo->flags & filter.xsinfo.flags) == 0)
 378                         return 0;
 379
 380         return 1;
 381 }
 382
 383 static int xfrm_selector_iszero(struct xfrm_selector *s)
 384 {
 385         struct xfrm_selector s0;
 386
 387         memset(&s0, 0, sizeof(s0));
 388
 389         return (memcmp(&s0, s, sizeof(s0)) == 0);
 390 }
 391
 392 static int xfrm_state_print(const struct sockaddr_nl *who,
 393                             struct nlmsghdr *n,
 394                             void *arg)
 395 {
 396         FILE *fp = (FILE*)arg;
 397         struct xfrm_usersa_info *xsinfo = NLMSG_DATA(n);
 398         int len = n->nlmsg_len;
 399         struct rtattr * tb[XFRMA_MAX+1];
 400         int ntb;
 401
 402         if (n->nlmsg_type != XFRM_MSG_NEWSA &&
 403             n->nlmsg_type != XFRM_MSG_DELSA) {
 404                 fprintf(stderr, "Not a state: %08x %08x %08x\n",
 405                         n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
 406                 return 0;
 407         }
 408
 409         len -= NLMSG_LENGTH(sizeof(*xsinfo));
 410         if (len < 0) {
 411                 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
 412                 return -1;
 413         }
 414
 415         if (!xfrm_state_filter_match(xsinfo))
 416                 return 0;
 417
 418         memset(tb, 0, sizeof(tb));
 419         ntb = parse_rtattr_byindex(tb, XFRM_MAX_DEPTH, XFRMS_RTA(xsinfo), len);
 420
 421         if (n->nlmsg_type == XFRM_MSG_DELSA)
 422                 fprintf(fp, "Deleted ");
 423
 424         xfrm_id_info_print(&xsinfo->saddr, &xsinfo->id, xsinfo->mode,
 425                            xsinfo->reqid, xsinfo->family, 1, fp, NULL);
 426
 427         fprintf(fp, "\t");
 428         fprintf(fp, "replay-window %u ", xsinfo->replay_window);
 429         if (show_stats > 0)
 430                 fprintf(fp, "seq 0x%08u ", xsinfo->seq);
 431         if (show_stats > 0 || xsinfo->flags) {
 432                 __u8 flags = xsinfo->flags;
 433
 434                 fprintf(fp, "flag ");
 435                 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_NOECN, "noecn");
 436                 XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_DECAP_DSCP, "decap-dscp");
 437                 if (flags)
 438                         fprintf(fp, "%x", flags);
 439                 if (show_stats > 0)
 440                         fprintf(fp, " (0x%s)", strxf_mask8(flags));
 441         }
 442         fprintf(fp, "%s", _SL_);
 443
 444         xfrm_xfrma_print(tb, ntb, xsinfo->family, fp, "\t");
 445
 446         if (!xfrm_selector_iszero(&xsinfo->sel))
 447                 xfrm_selector_print(&xsinfo->sel, xsinfo->family, fp, "\tsel ");
 448
 449         if (show_stats > 0) {
 450                 xfrm_lifetime_print(&xsinfo->lft, &xsinfo->curlft, fp, "\t");
 451                 xfrm_stats_print(&xsinfo->stats, fp, "\t");
 452         }
 453
 454         if (oneline)
 455                 fprintf(fp, "\n");
 456
 457         return 0;
 458 }
 459
 460 static int xfrm_state_get_or_delete(int argc, char **argv, int delete)
 461 {
 462         struct rtnl_handle rth;
 463         struct {
 464                 struct nlmsghdr         n;
 465                 struct xfrm_usersa_id   xsid;
 466         } req;
 467         struct xfrm_id id;
 468         char *idp = NULL;
 469
 470         memset(&req, 0, sizeof(req));
 471
 472         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsid));
 473         req.n.nlmsg_flags = NLM_F_REQUEST;
 474         req.n.nlmsg_type = delete ? XFRM_MSG_DELSA : XFRM_MSG_GETSA;
 475         req.xsid.family = preferred_family;
 476
 477         while (argc > 0) {
 478                 /*
 479                  * XXX: Source address is not used and ignore it to follow
 480                  * XXX: a manner of setkey e.g. in the case of deleting/getting
 481                  * XXX: message of IPsec SA.
 482                  */
 483                 xfrm_address_t ignore_saddr;
 484
 485                 if (idp)
 486                         invarg("unknown", *argv);
 487                 idp = *argv;
 488
 489                 /* ID */
 490                 memset(&id, 0, sizeof(id));
 491                 xfrm_id_parse(&ignore_saddr, &id, &req.xsid.family, 0,
 492                               &argc, &argv);
 493
 494                 memcpy(&req.xsid.daddr, &id.daddr, sizeof(req.xsid.daddr));
 495                 req.xsid.spi = id.spi;
 496                 req.xsid.proto = id.proto;
 497
 498                 argc--; argv++;
 499         }
 500
 501         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 502                 exit(1);
 503
 504         if (req.xsid.family == AF_UNSPEC)
 505                 req.xsid.family = AF_INET;
 506
 507         if (delete) {
 508                 if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
 509                         exit(2);
 510         } else {
 511                 char buf[NLMSG_BUF_SIZE];
 512                 struct nlmsghdr *res_n = (struct nlmsghdr *)buf;
 513
 514                 memset(buf, 0, sizeof(buf));
 515
 516                 if (rtnl_talk(&rth, &req.n, 0, 0, res_n, NULL, NULL) < 0)
 517                         exit(2);
 518
 519                 if (xfrm_state_print(NULL, res_n, (void*)stdout) < 0) {
 520                         fprintf(stderr, "An error :-)\n");
 521                         exit(1);
 522                 }
 523         }
 524
 525         rtnl_close(&rth);
 526
 527         return 0;
 528 }
 529
 530 /*
 531  * With an existing state of nlmsg, make new nlmsg for deleting the state
 532  * and store it to buffer.
 533  */
 534 static int xfrm_state_keep(const struct sockaddr_nl *who,
 535                            struct nlmsghdr *n,
 536                            void *arg)
 537 {
 538         struct xfrm_buffer *xb = (struct xfrm_buffer *)arg;
 539         struct rtnl_handle *rth = xb->rth;
 540         struct xfrm_usersa_info *xsinfo = NLMSG_DATA(n);
 541         int len = n->nlmsg_len;
 542         struct nlmsghdr *new_n;
 543         struct xfrm_usersa_id *xsid;
 544
 545         if (n->nlmsg_type != XFRM_MSG_NEWSA) {
 546                 fprintf(stderr, "Not a state: %08x %08x %08x\n",
 547                         n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
 548                 return 0;
 549         }
 550
 551         len -= NLMSG_LENGTH(sizeof(*xsinfo));
 552         if (len < 0) {
 553                 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
 554                 return -1;
 555         }
 556
 557         if (!xfrm_state_filter_match(xsinfo))
 558                 return 0;
 559
 560         if (xb->offset > xb->size) {
 561                 fprintf(stderr, "Flush buffer overflow\n");
 562                 return -1;
 563         }
 564
 565         new_n = (struct nlmsghdr *)(xb->buf + xb->offset);
 566         new_n->nlmsg_len = NLMSG_LENGTH(sizeof(*xsid));
 567         new_n->nlmsg_flags = NLM_F_REQUEST;
 568         new_n->nlmsg_type = XFRM_MSG_DELSA;
 569         new_n->nlmsg_seq = ++rth->seq;
 570
 571         xsid = NLMSG_DATA(new_n);
 572         xsid->family = xsinfo->family;
 573         memcpy(&xsid->daddr, &xsinfo->id.daddr, sizeof(xsid->daddr));
 574         xsid->spi = xsinfo->id.spi;
 575         xsid->proto = xsinfo->id.proto;
 576
 577         xb->offset += new_n->nlmsg_len;
 578         xb->nlmsg_count ++;
 579
 580         return 0;
 581 }
 582
 583 static int xfrm_state_list_or_flush(int argc, char **argv, int flush)
 584 {
 585         char *idp = NULL;
 586         struct rtnl_handle rth;
 587
 588         if(argc > 0)
 589                 filter.use = 1;
 590         filter.xsinfo.family = preferred_family;
 591
 592         while (argc > 0) {
 593                 if (strcmp(*argv, "mode") == 0) {
 594                         NEXT_ARG();
 595                         xfrm_mode_parse(&filter.xsinfo.mode, &argc, &argv);
 596
 597                         filter.mode_mask = XFRM_FILTER_MASK_FULL;
 598
 599                 } else if (strcmp(*argv, "reqid") == 0) {
 600                         NEXT_ARG();
 601                         xfrm_reqid_parse(&filter.xsinfo.reqid, &argc, &argv);
 602
 603                         filter.reqid_mask = XFRM_FILTER_MASK_FULL;
 604
 605                 } else if (strcmp(*argv, "flag") == 0) {
 606                         NEXT_ARG();
 607                         xfrm_state_flag_parse(&filter.xsinfo.flags, &argc, &argv);
 608
 609                         filter.state_flags_mask = XFRM_FILTER_MASK_FULL;
 610
 611                 } else {
 612                         if (idp)
 613                                 invarg("unknown", *argv);
 614                         idp = *argv;
 615
 616                         /* ID */
 617                         xfrm_id_parse(&filter.xsinfo.saddr, &filter.xsinfo.id,
 618                                       &filter.xsinfo.family, 1, &argc, &argv);
 619                         if (preferred_family == AF_UNSPEC)
 620                                 preferred_family = filter.xsinfo.family;
 621                 }
 622                 argc--; argv++;
 623         }
 624
 625         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 626                 exit(1);
 627
 628         if (flush) {
 629                 struct xfrm_buffer xb;
 630                 char buf[NLMSG_FLUSH_BUF_SIZE];
 631                 int i;
 632
 633                 xb.buf = buf;
 634                 xb.size = sizeof(buf);
 635                 xb.rth = &rth;
 636
 637                 for (i = 0; ; i++) {
 638                         xb.offset = 0;
 639                         xb.nlmsg_count = 0;
 640
 641                         if (show_stats > 1)
 642                                 fprintf(stderr, "Flush round = %d\n", i);
 643
 644                         if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETSA) < 0) {
 645                                 perror("Cannot send dump request");
 646                                 exit(1);
 647                         }
 648
 649                         if (rtnl_dump_filter(&rth, xfrm_state_keep, &xb, NULL, NULL) < 0) {
 650                                 fprintf(stderr, "Flush terminated\n");
 651                                 exit(1);
 652                         }
 653                         if (xb.nlmsg_count == 0) {
 654                                 if (show_stats > 1)
 655                                         fprintf(stderr, "Flush completed\n");
 656                                 break;
 657                         }
 658
 659                         if (rtnl_send(&rth, xb.buf, xb.offset) < 0) {
 660                                 perror("Failed to send flush request\n");
 661                                 exit(1);
 662                         }
 663                         if (show_stats > 1)
 664                                 fprintf(stderr, "Flushed nlmsg count = %d\n", xb.nlmsg_count);
 665
 666                         xb.offset = 0;
 667                         xb.nlmsg_count = 0;
 668                 }
 669
 670         } else {
 671                 if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETSA) < 0) {
 672                         perror("Cannot send dump request");
 673                         exit(1);
 674                 }
 675
 676                 if (rtnl_dump_filter(&rth, xfrm_state_print, stdout, NULL, NULL) < 0) {
 677                         fprintf(stderr, "Dump terminated\n");
 678                         exit(1);
 679                 }
 680         }
 681
 682         rtnl_close(&rth);
 683
 684         exit(0);
 685 }
 686
 687 static int xfrm_state_flush_all(void)
 688 {
 689         struct rtnl_handle rth;
 690         struct {
 691                 struct nlmsghdr                 n;
 692                 struct xfrm_usersa_flush        xsf;
 693         } req;
 694
 695         memset(&req, 0, sizeof(req));
 696
 697         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsf));
 698         req.n.nlmsg_flags = NLM_F_REQUEST;
 699         req.n.nlmsg_type = XFRM_MSG_FLUSHSA;
 700         req.xsf.proto = IPSEC_PROTO_ANY;
 701
 702         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 703                 exit(1);
 704
 705         if (show_stats > 1)
 706                 fprintf(stderr, "Flush all\n");
 707
 708         if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
 709                 exit(2);
 710
 711         rtnl_close(&rth);
 712
 713         return 0;
 714 }
 715
 716 int do_xfrm_state(int argc, char **argv)
 717 {
 718         if (argc < 1)
 719                 return xfrm_state_list_or_flush(0, NULL, 0);
 720
 721         if (matches(*argv, "add") == 0)
 722                 return xfrm_state_modify(XFRM_MSG_NEWSA, 0,
 723                                          argc-1, argv+1);
 724         if (matches(*argv, "update") == 0)
 725                 return xfrm_state_modify(XFRM_MSG_UPDSA, 0,
 726                                          argc-1, argv+1);
 727         if (matches(*argv, "delete") == 0 || matches(*argv, "del") == 0)
 728                 return xfrm_state_get_or_delete(argc-1, argv+1, 1);
 729         if (matches(*argv, "list") == 0 || matches(*argv, "show") == 0
 730             || matches(*argv, "lst") == 0)
 731                 return xfrm_state_list_or_flush(argc-1, argv+1, 0);
 732         if (matches(*argv, "get") == 0)
 733                 return xfrm_state_get_or_delete(argc-1, argv+1, 0);
 734         if (matches(*argv, "flush") == 0) {
 735                 if (argc-1 < 1)
 736                         return xfrm_state_flush_all();
 737                 else
 738                         return xfrm_state_list_or_flush(argc-1, argv+1, 1);
 739         }
 740         if (matches(*argv, "help") == 0)
 741                 usage();
 742         fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm state help\".\n", *argv);
 743         exit(-1);
 744 }