1 /* $USAGI: $ */
2
3 /*
4 * Copyright (C)2004 USAGI/WIDE Project
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses>.
18 */
19 /*
20 * based on iproute.c
21 */
22 /*
23 * Authors:
24 * Masahide NAKAMURA @USAGI
25 */
26
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <netdb.h>
31 #include "utils.h"
32 #include "xfrm.h"
33 #include "ip_common.h"
34
35 /* #define NLMSG_DELETEALL_BUF_SIZE (4096-512) */
36 #define NLMSG_DELETEALL_BUF_SIZE 8192
37
38 /*
39 * Receiving buffer defines:
40 * nlmsg
41 * data = struct xfrm_usersa_info
42 * rtattr
43 * rtattr
44 * ... (max count of rtattr is XFRM_MAX+1
45 *
46 * each rtattr data = struct xfrm_algo(dynamic size) or xfrm_address_t
47 */
48 #define NLMSG_BUF_SIZE 4096
49 #define RTA_BUF_SIZE 2048
50 #define XFRM_ALGO_KEY_BUF_SIZE 512
51 #define CTX_BUF_SIZE 256
52
53 static void usage(void) __attribute__((noreturn));
54
usage(void)55 static void usage(void)
56 {
57 fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ]\n");
58 fprintf(stderr, " [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ]\n");
59 fprintf(stderr, " [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ]\n");
60 fprintf(stderr, " [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]\n");
61 fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n");
62 fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n");
63 fprintf(stderr, " [ offload [dev DEV] dir DIR ]\n");
64 fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n");
65 fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n");
66 fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
67 fprintf(stderr, "Usage: ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ]\n");
68 fprintf(stderr, " [ flag FLAG-LIST ]\n");
69 fprintf(stderr, "Usage: ip xfrm state flush [ proto XFRM-PROTO ]\n");
70 fprintf(stderr, "Usage: ip xfrm state count\n");
71 fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]\n");
72 fprintf(stderr, "XFRM-PROTO := ");
73 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
74 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
75 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
76 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
77 fprintf(stderr, "%s\n", strxf_xfrmproto(IPPROTO_DSTOPTS));
78 fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] ALGO\n");
79 fprintf(stderr, "ALGO := { ");
80 fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT));
81 fprintf(stderr, "%s", strxf_algotype(XFRMA_ALG_AUTH));
82 fprintf(stderr, " } ALGO-NAME ALGO-KEYMAT |\n");
83 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AUTH_TRUNC));
84 fprintf(stderr, " ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |\n");
85 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AEAD));
86 fprintf(stderr, " ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |\n");
87 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_COMP));
88 fprintf(stderr, " ALGO-NAME\n");
89 fprintf(stderr, "MODE := transport | tunnel | beet | ro | in_trigger\n");
90 fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
91 fprintf(stderr, "FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn\n");
92 fprintf(stderr, "EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG\n");
93 fprintf(stderr, "EXTRA-FLAG := dont-encap-dscp\n");
94 fprintf(stderr, "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n");
95 fprintf(stderr, "UPSPEC := proto { { ");
96 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_TCP));
97 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_UDP));
98 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_SCTP));
99 fprintf(stderr, "%s", strxf_proto(IPPROTO_DCCP));
100 fprintf(stderr, " } [ sport PORT ] [ dport PORT ] |\n");
101 fprintf(stderr, " { ");
102 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMP));
103 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMPV6));
104 fprintf(stderr, "%s", strxf_proto(IPPROTO_MH));
105 fprintf(stderr, " } [ type NUMBER ] [ code NUMBER ] |\n");
106 fprintf(stderr, " %s", strxf_proto(IPPROTO_GRE));
107 fprintf(stderr, " [ key { DOTTED-QUAD | NUMBER } ] | PROTO }\n");
108 fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT\n");
109 fprintf(stderr, "LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |\n");
110 fprintf(stderr, " { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT\n");
111 fprintf(stderr, "ENCAP := { espinudp | espinudp-nonike } SPORT DPORT OADDR\n");
112 fprintf(stderr, "DIR := in | out\n");
113
114 exit(-1);
115 }
116
xfrm_algo_parse(struct xfrm_algo * alg,enum xfrm_attr_type_t type,char * name,char * key,char * buf,int max)117 static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
118 char *name, char *key, char *buf, int max)
119 {
120 int len;
121 int slen = strlen(key);
122
123 #if 0
124 /* XXX: verifying both name and key is required! */
125 fprintf(stderr, "warning: ALGO-NAME/ALGO-KEYMAT values will be sent to the kernel promiscuously! (verifying them isn't implemented yet)\n");
126 #endif
127
128 strlcpy(alg->alg_name, name, sizeof(alg->alg_name));
129
130 if (slen > 2 && strncmp(key, "0x", 2) == 0) {
131 /* split two chars "0x" from the top */
132 char *p = key + 2;
133 int plen = slen - 2;
134 int i;
135 int j;
136
137 /* Converting hexadecimal numbered string into real key;
138 * Convert each two chars into one char(value). If number
139 * of the length is odd, add zero on the top for rounding.
140 */
141
142 /* calculate length of the converted values(real key) */
143 len = (plen + 1) / 2;
144 if (len > max)
145 invarg("ALGO-KEYMAT value makes buffer overflow\n", key);
146
147 for (i = -(plen % 2), j = 0; j < len; i += 2, j++) {
148 char vbuf[3];
149 __u8 val;
150
151 vbuf[0] = i >= 0 ? p[i] : '0';
152 vbuf[1] = p[i + 1];
153 vbuf[2] = '\0';
154
155 if (get_u8(&val, vbuf, 16))
156 invarg("ALGO-KEYMAT value is invalid", key);
157
158 buf[j] = val;
159 }
160 } else {
161 len = slen;
162 if (len > 0) {
163 if (len > max)
164 invarg("ALGO-KEYMAT value makes buffer overflow\n", key);
165
166 memcpy(buf, key, len);
167 }
168 }
169
170 alg->alg_key_len = len * 8;
171
172 return 0;
173 }
174
xfrm_seq_parse(__u32 * seq,int * argcp,char *** argvp)175 static int xfrm_seq_parse(__u32 *seq, int *argcp, char ***argvp)
176 {
177 int argc = *argcp;
178 char **argv = *argvp;
179
180 if (get_be32(seq, *argv, 0))
181 invarg("SEQ value is invalid", *argv);
182
183 *argcp = argc;
184 *argvp = argv;
185
186 return 0;
187 }
188
xfrm_state_flag_parse(__u8 * flags,int * argcp,char *** argvp)189 static int xfrm_state_flag_parse(__u8 *flags, int *argcp, char ***argvp)
190 {
191 int argc = *argcp;
192 char **argv = *argvp;
193 int len = strlen(*argv);
194
195 if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
196 __u8 val = 0;
197
198 if (get_u8(&val, *argv, 16))
199 invarg("FLAG value is invalid", *argv);
200 *flags = val;
201 } else {
202 while (1) {
203 if (strcmp(*argv, "noecn") == 0)
204 *flags |= XFRM_STATE_NOECN;
205 else if (strcmp(*argv, "decap-dscp") == 0)
206 *flags |= XFRM_STATE_DECAP_DSCP;
207 else if (strcmp(*argv, "nopmtudisc") == 0)
208 *flags |= XFRM_STATE_NOPMTUDISC;
209 else if (strcmp(*argv, "wildrecv") == 0)
210 *flags |= XFRM_STATE_WILDRECV;
211 else if (strcmp(*argv, "icmp") == 0)
212 *flags |= XFRM_STATE_ICMP;
213 else if (strcmp(*argv, "af-unspec") == 0)
214 *flags |= XFRM_STATE_AF_UNSPEC;
215 else if (strcmp(*argv, "align4") == 0)
216 *flags |= XFRM_STATE_ALIGN4;
217 else if (strcmp(*argv, "esn") == 0)
218 *flags |= XFRM_STATE_ESN;
219 else {
220 PREV_ARG(); /* back track */
221 break;
222 }
223
224 if (!NEXT_ARG_OK())
225 break;
226 NEXT_ARG();
227 }
228 }
229
230 *argcp = argc;
231 *argvp = argv;
232
233 return 0;
234 }
235
xfrm_state_extra_flag_parse(__u32 * extra_flags,int * argcp,char *** argvp)236 static int xfrm_state_extra_flag_parse(__u32 *extra_flags, int *argcp, char ***argvp)
237 {
238 int argc = *argcp;
239 char **argv = *argvp;
240 int len = strlen(*argv);
241
242 if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
243 __u32 val = 0;
244
245 if (get_u32(&val, *argv, 16))
246 invarg("\"EXTRA-FLAG\" is invalid", *argv);
247 *extra_flags = val;
248 } else {
249 while (1) {
250 if (strcmp(*argv, "dont-encap-dscp") == 0)
251 *extra_flags |= XFRM_SA_XFLAG_DONT_ENCAP_DSCP;
252 else {
253 PREV_ARG(); /* back track */
254 break;
255 }
256
257 if (!NEXT_ARG_OK())
258 break;
259 NEXT_ARG();
260 }
261 }
262
263 *argcp = argc;
264 *argvp = argv;
265
266 return 0;
267 }
268
xfrm_offload_dir_parse(__u8 * dir,int * argcp,char *** argvp)269 static int xfrm_offload_dir_parse(__u8 *dir, int *argcp, char ***argvp)
270 {
271 int argc = *argcp;
272 char **argv = *argvp;
273
274 if (strcmp(*argv, "in") == 0)
275 *dir = XFRM_OFFLOAD_INBOUND;
276 else if (strcmp(*argv, "out") == 0)
277 *dir = 0;
278 else
279 invarg("DIR value is invalid", *argv);
280
281 *argcp = argc;
282 *argvp = argv;
283
284 return 0;
285 }
286
xfrm_state_modify(int cmd,unsigned int flags,int argc,char ** argv)287 static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
288 {
289 struct rtnl_handle rth;
290 struct {
291 struct nlmsghdr n;
292 struct xfrm_usersa_info xsinfo;
293 char buf[RTA_BUF_SIZE];
294 } req = {
295 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo)),
296 .n.nlmsg_flags = NLM_F_REQUEST | flags,
297 .n.nlmsg_type = cmd,
298 .xsinfo.family = preferred_family,
299 .xsinfo.lft.soft_byte_limit = XFRM_INF,
300 .xsinfo.lft.hard_byte_limit = XFRM_INF,
301 .xsinfo.lft.soft_packet_limit = XFRM_INF,
302 .xsinfo.lft.hard_packet_limit = XFRM_INF,
303 };
304 struct xfrm_replay_state replay = {};
305 struct xfrm_replay_state_esn replay_esn = {};
306 struct xfrm_user_offload xuo = {};
307 unsigned int ifindex = 0;
308 __u8 dir = 0;
309 bool is_offload = false;
310 __u32 replay_window = 0;
311 __u32 seq = 0, oseq = 0, seq_hi = 0, oseq_hi = 0;
312 char *idp = NULL;
313 char *aeadop = NULL;
314 char *ealgop = NULL;
315 char *aalgop = NULL;
316 char *calgop = NULL;
317 char *coap = NULL;
318 char *sctxp = NULL;
319 __u32 extra_flags = 0;
320 struct xfrm_mark mark = {0, 0};
321 struct {
322 struct xfrm_user_sec_ctx sctx;
323 char str[CTX_BUF_SIZE];
324 } ctx = {};
325
326 while (argc > 0) {
327 if (strcmp(*argv, "mode") == 0) {
328 NEXT_ARG();
329 xfrm_mode_parse(&req.xsinfo.mode, &argc, &argv);
330 } else if (strcmp(*argv, "mark") == 0) {
331 xfrm_parse_mark(&mark, &argc, &argv);
332 } else if (strcmp(*argv, "reqid") == 0) {
333 NEXT_ARG();
334 xfrm_reqid_parse(&req.xsinfo.reqid, &argc, &argv);
335 } else if (strcmp(*argv, "seq") == 0) {
336 NEXT_ARG();
337 xfrm_seq_parse(&req.xsinfo.seq, &argc, &argv);
338 } else if (strcmp(*argv, "replay-window") == 0) {
339 NEXT_ARG();
340 if (get_u32(&replay_window, *argv, 0))
341 invarg("value after \"replay-window\" is invalid", *argv);
342 } else if (strcmp(*argv, "replay-seq") == 0) {
343 NEXT_ARG();
344 if (get_u32(&seq, *argv, 0))
345 invarg("value after \"replay-seq\" is invalid", *argv);
346 } else if (strcmp(*argv, "replay-seq-hi") == 0) {
347 NEXT_ARG();
348 if (get_u32(&seq_hi, *argv, 0))
349 invarg("value after \"replay-seq-hi\" is invalid", *argv);
350 } else if (strcmp(*argv, "replay-oseq") == 0) {
351 NEXT_ARG();
352 if (get_u32(&oseq, *argv, 0))
353 invarg("value after \"replay-oseq\" is invalid", *argv);
354 } else if (strcmp(*argv, "replay-oseq-hi") == 0) {
355 NEXT_ARG();
356 if (get_u32(&oseq_hi, *argv, 0))
357 invarg("value after \"replay-oseq-hi\" is invalid", *argv);
358 } else if (strcmp(*argv, "flag") == 0) {
359 NEXT_ARG();
360 xfrm_state_flag_parse(&req.xsinfo.flags, &argc, &argv);
361 } else if (strcmp(*argv, "extra-flag") == 0) {
362 NEXT_ARG();
363 xfrm_state_extra_flag_parse(&extra_flags, &argc, &argv);
364 } else if (strcmp(*argv, "sel") == 0) {
365 NEXT_ARG();
366 preferred_family = AF_UNSPEC;
367 xfrm_selector_parse(&req.xsinfo.sel, &argc, &argv);
368 preferred_family = req.xsinfo.sel.family;
369 } else if (strcmp(*argv, "limit") == 0) {
370 NEXT_ARG();
371 xfrm_lifetime_cfg_parse(&req.xsinfo.lft, &argc, &argv);
372 } else if (strcmp(*argv, "encap") == 0) {
373 struct xfrm_encap_tmpl encap;
374 inet_prefix oa;
375 NEXT_ARG();
376 xfrm_encap_type_parse(&encap.encap_type, &argc, &argv);
377 NEXT_ARG();
378 if (get_be16(&encap.encap_sport, *argv, 0))
379 invarg("SPORT value after \"encap\" is invalid", *argv);
380 NEXT_ARG();
381 if (get_be16(&encap.encap_dport, *argv, 0))
382 invarg("DPORT value after \"encap\" is invalid", *argv);
383 NEXT_ARG();
384 get_addr(&oa, *argv, AF_UNSPEC);
385 memcpy(&encap.encap_oa, &oa.data, sizeof(encap.encap_oa));
386 addattr_l(&req.n, sizeof(req.buf), XFRMA_ENCAP,
387 (void *)&encap, sizeof(encap));
388 } else if (strcmp(*argv, "coa") == 0) {
389 inet_prefix coa;
390 xfrm_address_t xcoa = {};
391
392 if (coap)
393 duparg("coa", *argv);
394 coap = *argv;
395
396 NEXT_ARG();
397
398 get_prefix(&coa, *argv, preferred_family);
399 if (coa.family == AF_UNSPEC)
400 invarg("value after \"coa\" has an unrecognized address family", *argv);
401 if (coa.bytelen > sizeof(xcoa))
402 invarg("value after \"coa\" is too large", *argv);
403
404 memcpy(&xcoa, &coa.data, coa.bytelen);
405
406 addattr_l(&req.n, sizeof(req.buf), XFRMA_COADDR,
407 (void *)&xcoa, sizeof(xcoa));
408 } else if (strcmp(*argv, "ctx") == 0) {
409 char *context;
410
411 if (sctxp)
412 duparg("ctx", *argv);
413 sctxp = *argv;
414
415 NEXT_ARG();
416 context = *argv;
417
418 xfrm_sctx_parse((char *)&ctx.str, context, &ctx.sctx);
419 addattr_l(&req.n, sizeof(req.buf), XFRMA_SEC_CTX,
420 (void *)&ctx, ctx.sctx.len);
421 } else if (strcmp(*argv, "offload") == 0) {
422 is_offload = true;
423 NEXT_ARG();
424 if (strcmp(*argv, "dev") == 0) {
425 NEXT_ARG();
426 ifindex = ll_name_to_index(*argv);
427 if (!ifindex) {
428 invarg("value after \"offload dev\" is invalid", *argv);
429 is_offload = false;
430 }
431 NEXT_ARG();
432 }
433 if (strcmp(*argv, "dir") == 0) {
434 NEXT_ARG();
435 xfrm_offload_dir_parse(&dir, &argc, &argv);
436 } else {
437 invarg("value after \"offload dir\" is invalid", *argv);
438 is_offload = false;
439 }
440 } else {
441 /* try to assume ALGO */
442 int type = xfrm_algotype_getbyname(*argv);
443
444 switch (type) {
445 case XFRMA_ALG_AEAD:
446 case XFRMA_ALG_CRYPT:
447 case XFRMA_ALG_AUTH:
448 case XFRMA_ALG_AUTH_TRUNC:
449 case XFRMA_ALG_COMP:
450 {
451 /* ALGO */
452 struct {
453 union {
454 struct xfrm_algo alg;
455 struct xfrm_algo_aead aead;
456 struct xfrm_algo_auth auth;
457 } u;
458 char buf[XFRM_ALGO_KEY_BUF_SIZE];
459 } alg = {};
460 int len;
461 __u32 icvlen, trunclen;
462 char *name;
463 char *key = "";
464 char *buf;
465
466 switch (type) {
467 case XFRMA_ALG_AEAD:
468 if (ealgop || aalgop || aeadop)
469 duparg("ALGO-TYPE", *argv);
470 aeadop = *argv;
471 break;
472 case XFRMA_ALG_CRYPT:
473 if (ealgop || aeadop)
474 duparg("ALGO-TYPE", *argv);
475 ealgop = *argv;
476 break;
477 case XFRMA_ALG_AUTH:
478 case XFRMA_ALG_AUTH_TRUNC:
479 if (aalgop || aeadop)
480 duparg("ALGO-TYPE", *argv);
481 aalgop = *argv;
482 break;
483 case XFRMA_ALG_COMP:
484 if (calgop)
485 duparg("ALGO-TYPE", *argv);
486 calgop = *argv;
487 break;
488 default:
489 /* not reached */
490 invarg("ALGO-TYPE value is invalid\n", *argv);
491 }
492
493 if (!NEXT_ARG_OK())
494 missarg("ALGO-NAME");
495 NEXT_ARG();
496 name = *argv;
497
498 switch (type) {
499 case XFRMA_ALG_AEAD:
500 case XFRMA_ALG_CRYPT:
501 case XFRMA_ALG_AUTH:
502 case XFRMA_ALG_AUTH_TRUNC:
503 if (!NEXT_ARG_OK())
504 missarg("ALGO-KEYMAT");
505 NEXT_ARG();
506 key = *argv;
507 break;
508 }
509
510 buf = alg.u.alg.alg_key;
511 len = sizeof(alg.u.alg);
512
513 switch (type) {
514 case XFRMA_ALG_AEAD:
515 if (!NEXT_ARG_OK())
516 missarg("ALGO-ICV-LEN");
517 NEXT_ARG();
518 if (get_u32(&icvlen, *argv, 0))
519 invarg("ALGO-ICV-LEN value is invalid",
520 *argv);
521 alg.u.aead.alg_icv_len = icvlen;
522
523 buf = alg.u.aead.alg_key;
524 len = sizeof(alg.u.aead);
525 break;
526 case XFRMA_ALG_AUTH_TRUNC:
527 if (!NEXT_ARG_OK())
528 missarg("ALGO-TRUNC-LEN");
529 NEXT_ARG();
530 if (get_u32(&trunclen, *argv, 0))
531 invarg("ALGO-TRUNC-LEN value is invalid",
532 *argv);
533 alg.u.auth.alg_trunc_len = trunclen;
534
535 buf = alg.u.auth.alg_key;
536 len = sizeof(alg.u.auth);
537 break;
538 }
539
540 xfrm_algo_parse((void *)&alg, type, name, key,
541 buf, sizeof(alg.buf));
542 len += alg.u.alg.alg_key_len / 8;
543
544 addattr_l(&req.n, sizeof(req.buf), type,
545 (void *)&alg, len);
546 break;
547 }
548 default:
549 /* try to assume ID */
550 if (idp)
551 invarg("unknown", *argv);
552 idp = *argv;
553
554 /* ID */
555 xfrm_id_parse(&req.xsinfo.saddr, &req.xsinfo.id,
556 &req.xsinfo.family, 0, &argc, &argv);
557 if (preferred_family == AF_UNSPEC)
558 preferred_family = req.xsinfo.family;
559 }
560 }
561 argc--; argv++;
562 }
563
564 if (req.xsinfo.flags & XFRM_STATE_ESN &&
565 replay_window == 0) {
566 fprintf(stderr, "Error: esn flag set without replay-window.\n");
567 exit(-1);
568 }
569
570 if (replay_window > XFRMA_REPLAY_ESN_MAX) {
571 fprintf(stderr,
572 "Error: replay-window (%u) > XFRMA_REPLAY_ESN_MAX (%u).\n",
573 replay_window, XFRMA_REPLAY_ESN_MAX);
574 exit(-1);
575 }
576
577 if (is_offload) {
578 xuo.ifindex = ifindex;
579 xuo.flags = dir;
580 addattr_l(&req.n, sizeof(req.buf), XFRMA_OFFLOAD_DEV, &xuo,
581 sizeof(xuo));
582 }
583 if (req.xsinfo.flags & XFRM_STATE_ESN ||
584 replay_window > (sizeof(replay.bitmap) * 8)) {
585 replay_esn.seq = seq;
586 replay_esn.oseq = oseq;
587 replay_esn.seq_hi = seq_hi;
588 replay_esn.oseq_hi = oseq_hi;
589 replay_esn.replay_window = replay_window;
590 replay_esn.bmp_len = (replay_window + sizeof(__u32) * 8 - 1) /
591 (sizeof(__u32) * 8);
592 addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_ESN_VAL,
593 &replay_esn, sizeof(replay_esn));
594 } else {
595 if (seq || oseq) {
596 replay.seq = seq;
597 replay.oseq = oseq;
598 addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_VAL,
599 &replay, sizeof(replay));
600 }
601 req.xsinfo.replay_window = replay_window;
602 }
603
604 if (extra_flags)
605 addattr32(&req.n, sizeof(req.buf), XFRMA_SA_EXTRA_FLAGS,
606 extra_flags);
607
608 if (!idp) {
609 fprintf(stderr, "Not enough information: ID is required\n");
610 exit(1);
611 }
612
613 if (mark.m) {
614 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
615 (void *)&mark, sizeof(mark));
616 if (r < 0) {
617 fprintf(stderr, "XFRMA_MARK failed\n");
618 exit(1);
619 }
620 }
621
622 if (xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) {
623 switch (req.xsinfo.mode) {
624 case XFRM_MODE_TRANSPORT:
625 case XFRM_MODE_TUNNEL:
626 break;
627 case XFRM_MODE_BEET:
628 if (req.xsinfo.id.proto == IPPROTO_ESP)
629 break;
630 default:
631 fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
632 strxf_xfrmproto(req.xsinfo.id.proto));
633 exit(1);
634 }
635
636 switch (req.xsinfo.id.proto) {
637 case IPPROTO_ESP:
638 if (calgop) {
639 fprintf(stderr, "ALGO-TYPE value \"%s\" is invalid with XFRM-PROTO value \"%s\"\n",
640 strxf_algotype(XFRMA_ALG_COMP),
641 strxf_xfrmproto(req.xsinfo.id.proto));
642 exit(1);
643 }
644 if (!ealgop && !aeadop) {
645 fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
646 strxf_algotype(XFRMA_ALG_CRYPT),
647 strxf_algotype(XFRMA_ALG_AEAD),
648 strxf_xfrmproto(req.xsinfo.id.proto));
649 exit(1);
650 }
651 break;
652 case IPPROTO_AH:
653 if (ealgop || aeadop || calgop) {
654 fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
655 strxf_algotype(XFRMA_ALG_CRYPT),
656 strxf_algotype(XFRMA_ALG_AEAD),
657 strxf_algotype(XFRMA_ALG_COMP),
658 strxf_xfrmproto(req.xsinfo.id.proto));
659 exit(1);
660 }
661 if (!aalgop) {
662 fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
663 strxf_algotype(XFRMA_ALG_AUTH),
664 strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
665 strxf_xfrmproto(req.xsinfo.id.proto));
666 exit(1);
667 }
668 break;
669 case IPPROTO_COMP:
670 if (ealgop || aalgop || aeadop) {
671 fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
672 strxf_algotype(XFRMA_ALG_CRYPT),
673 strxf_algotype(XFRMA_ALG_AUTH),
674 strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
675 strxf_algotype(XFRMA_ALG_AEAD),
676 strxf_xfrmproto(req.xsinfo.id.proto));
677 exit(1);
678 }
679 if (!calgop) {
680 fprintf(stderr, "ALGO-TYPE value \"%s\" is required with XFRM-PROTO value \"%s\"\n",
681 strxf_algotype(XFRMA_ALG_COMP),
682 strxf_xfrmproto(req.xsinfo.id.proto));
683 exit(1);
684 }
685 break;
686 }
687 } else {
688 if (ealgop || aalgop || aeadop || calgop) {
689 fprintf(stderr, "ALGO is invalid with XFRM-PROTO value \"%s\"\n",
690 strxf_xfrmproto(req.xsinfo.id.proto));
691 exit(1);
692 }
693 }
694
695 if (xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
696 switch (req.xsinfo.mode) {
697 case XFRM_MODE_ROUTEOPTIMIZATION:
698 case XFRM_MODE_IN_TRIGGER:
699 break;
700 case 0:
701 fprintf(stderr, "\"mode\" is required with XFRM-PROTO value \"%s\"\n",
702 strxf_xfrmproto(req.xsinfo.id.proto));
703 exit(1);
704 default:
705 fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
706 strxf_xfrmproto(req.xsinfo.id.proto));
707 exit(1);
708 }
709
710 if (!coap) {
711 fprintf(stderr, "\"coa\" is required with XFRM-PROTO value \"%s\"\n",
712 strxf_xfrmproto(req.xsinfo.id.proto));
713 exit(1);
714 }
715 } else {
716 if (coap) {
717 fprintf(stderr, "\"coa\" is invalid with XFRM-PROTO value \"%s\"\n",
718 strxf_xfrmproto(req.xsinfo.id.proto));
719 exit(1);
720 }
721 }
722
723 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
724 exit(1);
725
726 if (req.xsinfo.family == AF_UNSPEC)
727 req.xsinfo.family = AF_INET;
728
729 if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
730 exit(2);
731
732 rtnl_close(&rth);
733
734 return 0;
735 }
736
xfrm_state_allocspi(int argc,char ** argv)737 static int xfrm_state_allocspi(int argc, char **argv)
738 {
739 struct rtnl_handle rth;
740 struct {
741 struct nlmsghdr n;
742 struct xfrm_userspi_info xspi;
743 char buf[RTA_BUF_SIZE];
744 } req = {
745 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xspi)),
746 .n.nlmsg_flags = NLM_F_REQUEST,
747 .n.nlmsg_type = XFRM_MSG_ALLOCSPI,
748 .xspi.info.family = preferred_family,
749 #if 0
750 .xspi.lft.soft_byte_limit = XFRM_INF,
751 .xspi.lft.hard_byte_limit = XFRM_INF,
752 .xspi.lft.soft_packet_limit = XFRM_INF,
753 .xspi.lft.hard_packet_limit = XFRM_INF,
754 #endif
755 };
756 char *idp = NULL;
757 char *minp = NULL;
758 char *maxp = NULL;
759 struct xfrm_mark mark = {0, 0};
760 char res_buf[NLMSG_BUF_SIZE] = {};
761 struct nlmsghdr *res_n = (struct nlmsghdr *)res_buf;
762
763 while (argc > 0) {
764 if (strcmp(*argv, "mode") == 0) {
765 NEXT_ARG();
766 xfrm_mode_parse(&req.xspi.info.mode, &argc, &argv);
767 } else if (strcmp(*argv, "mark") == 0) {
768 xfrm_parse_mark(&mark, &argc, &argv);
769 } else if (strcmp(*argv, "reqid") == 0) {
770 NEXT_ARG();
771 xfrm_reqid_parse(&req.xspi.info.reqid, &argc, &argv);
772 } else if (strcmp(*argv, "seq") == 0) {
773 NEXT_ARG();
774 xfrm_seq_parse(&req.xspi.info.seq, &argc, &argv);
775 } else if (strcmp(*argv, "min") == 0) {
776 if (minp)
777 duparg("min", *argv);
778 minp = *argv;
779
780 NEXT_ARG();
781
782 if (get_u32(&req.xspi.min, *argv, 0))
783 invarg("value after \"min\" is invalid", *argv);
784 } else if (strcmp(*argv, "max") == 0) {
785 if (maxp)
786 duparg("max", *argv);
787 maxp = *argv;
788
789 NEXT_ARG();
790
791 if (get_u32(&req.xspi.max, *argv, 0))
792 invarg("value after \"max\" is invalid", *argv);
793 } else {
794 /* try to assume ID */
795 if (idp)
796 invarg("unknown", *argv);
797 idp = *argv;
798
799 /* ID */
800 xfrm_id_parse(&req.xspi.info.saddr, &req.xspi.info.id,
801 &req.xspi.info.family, 0, &argc, &argv);
802 if (req.xspi.info.id.spi) {
803 fprintf(stderr, "\"spi\" is invalid\n");
804 exit(1);
805 }
806 if (preferred_family == AF_UNSPEC)
807 preferred_family = req.xspi.info.family;
808 }
809 argc--; argv++;
810 }
811
812 if (!idp) {
813 fprintf(stderr, "Not enough information: ID is required\n");
814 exit(1);
815 }
816
817 if (minp) {
818 if (!maxp) {
819 fprintf(stderr, "\"max\" is missing\n");
820 exit(1);
821 }
822 if (req.xspi.min > req.xspi.max) {
823 fprintf(stderr, "value after \"min\" is larger than value after \"max\"\n");
824 exit(1);
825 }
826 } else {
827 if (maxp) {
828 fprintf(stderr, "\"min\" is missing\n");
829 exit(1);
830 }
831
832 /* XXX: Default value defined in PF_KEY;
833 * See kernel's net/key/af_key.c(pfkey_getspi).
834 */
835 req.xspi.min = 0x100;
836 req.xspi.max = 0x0fffffff;
837
838 /* XXX: IPCOMP spi is 16-bits;
839 * See kernel's net/xfrm/xfrm_user(verify_userspi_info).
840 */
841 if (req.xspi.info.id.proto == IPPROTO_COMP)
842 req.xspi.max = 0xffff;
843 }
844
845 if (mark.m & mark.v) {
846 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
847 (void *)&mark, sizeof(mark));
848 if (r < 0) {
849 fprintf(stderr, "XFRMA_MARK failed\n");
850 exit(1);
851 }
852 }
853
854 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
855 exit(1);
856
857 if (req.xspi.info.family == AF_UNSPEC)
858 req.xspi.info.family = AF_INET;
859
860
861 if (rtnl_talk(&rth, &req.n, res_n, sizeof(res_buf)) < 0)
862 exit(2);
863
864 if (xfrm_state_print(NULL, res_n, (void *)stdout) < 0) {
865 fprintf(stderr, "An error :-)\n");
866 exit(1);
867 }
868
869 rtnl_close(&rth);
870
871 return 0;
872 }
873
xfrm_state_filter_match(struct xfrm_usersa_info * xsinfo)874 static int xfrm_state_filter_match(struct xfrm_usersa_info *xsinfo)
875 {
876 if (!filter.use)
877 return 1;
878
879 if (filter.id_src_mask)
880 if (xfrm_addr_match(&xsinfo->saddr, &filter.xsinfo.saddr,
881 filter.id_src_mask))
882 return 0;
883 if (filter.id_dst_mask)
884 if (xfrm_addr_match(&xsinfo->id.daddr, &filter.xsinfo.id.daddr,
885 filter.id_dst_mask))
886 return 0;
887 if ((xsinfo->id.proto^filter.xsinfo.id.proto)&filter.id_proto_mask)
888 return 0;
889 if ((xsinfo->id.spi^filter.xsinfo.id.spi)&filter.id_spi_mask)
890 return 0;
891 if ((xsinfo->mode^filter.xsinfo.mode)&filter.mode_mask)
892 return 0;
893 if ((xsinfo->reqid^filter.xsinfo.reqid)&filter.reqid_mask)
894 return 0;
895 if (filter.state_flags_mask)
896 if ((xsinfo->flags & filter.xsinfo.flags) == 0)
897 return 0;
898
899 return 1;
900 }
901
xfrm_state_print(const struct sockaddr_nl * who,struct nlmsghdr * n,void * arg)902 int xfrm_state_print(const struct sockaddr_nl *who, struct nlmsghdr *n,
903 void *arg)
904 {
905 FILE *fp = (FILE *)arg;
906 struct rtattr *tb[XFRMA_MAX+1];
907 struct rtattr *rta;
908 struct xfrm_usersa_info *xsinfo = NULL;
909 struct xfrm_user_expire *xexp = NULL;
910 struct xfrm_usersa_id *xsid = NULL;
911 int len = n->nlmsg_len;
912
913 if (n->nlmsg_type != XFRM_MSG_NEWSA &&
914 n->nlmsg_type != XFRM_MSG_DELSA &&
915 n->nlmsg_type != XFRM_MSG_UPDSA &&
916 n->nlmsg_type != XFRM_MSG_EXPIRE) {
917 fprintf(stderr, "Not a state: %08x %08x %08x\n",
918 n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
919 return 0;
920 }
921
922 if (n->nlmsg_type == XFRM_MSG_DELSA) {
923 /* Dont blame me for this .. Herbert made me do it */
924 xsid = NLMSG_DATA(n);
925 len -= NLMSG_SPACE(sizeof(*xsid));
926 } else if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
927 xexp = NLMSG_DATA(n);
928 xsinfo = &xexp->state;
929 len -= NLMSG_SPACE(sizeof(*xexp));
930 } else {
931 xexp = NULL;
932 xsinfo = NLMSG_DATA(n);
933 len -= NLMSG_SPACE(sizeof(*xsinfo));
934 }
935
936 if (len < 0) {
937 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
938 return -1;
939 }
940
941 if (xsinfo && !xfrm_state_filter_match(xsinfo))
942 return 0;
943
944 if (n->nlmsg_type == XFRM_MSG_DELSA)
945 fprintf(fp, "Deleted ");
946 else if (n->nlmsg_type == XFRM_MSG_UPDSA)
947 fprintf(fp, "Updated ");
948 else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
949 fprintf(fp, "Expired ");
950
951 if (n->nlmsg_type == XFRM_MSG_DELSA)
952 rta = XFRMSID_RTA(xsid);
953 else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
954 rta = XFRMEXP_RTA(xexp);
955 else
956 rta = XFRMS_RTA(xsinfo);
957
958 parse_rtattr(tb, XFRMA_MAX, rta, len);
959
960 if (n->nlmsg_type == XFRM_MSG_DELSA) {
961 /* xfrm_policy_id_print(); */
962
963 if (!tb[XFRMA_SA]) {
964 fprintf(stderr, "Buggy XFRM_MSG_DELSA: no XFRMA_SA\n");
965 return -1;
966 }
967 if (RTA_PAYLOAD(tb[XFRMA_SA]) < sizeof(*xsinfo)) {
968 fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: too short XFRMA_POLICY len\n");
969 return -1;
970 }
971 xsinfo = RTA_DATA(tb[XFRMA_SA]);
972 }
973
974 xfrm_state_info_print(xsinfo, tb, fp, NULL, NULL);
975
976 if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
977 fprintf(fp, "\t");
978 fprintf(fp, "hard %u", xexp->hard);
979 fprintf(fp, "%s", _SL_);
980 }
981
982 if (oneline)
983 fprintf(fp, "\n");
984 fflush(fp);
985
986 return 0;
987 }
988
xfrm_state_get_or_delete(int argc,char ** argv,int delete)989 static int xfrm_state_get_or_delete(int argc, char **argv, int delete)
990 {
991 struct rtnl_handle rth;
992 struct {
993 struct nlmsghdr n;
994 struct xfrm_usersa_id xsid;
995 char buf[RTA_BUF_SIZE];
996 } req = {
997 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsid)),
998 .n.nlmsg_flags = NLM_F_REQUEST,
999 .n.nlmsg_type = delete ? XFRM_MSG_DELSA : XFRM_MSG_GETSA,
1000 .xsid.family = preferred_family,
1001 };
1002 struct xfrm_id id;
1003 char *idp = NULL;
1004 struct xfrm_mark mark = {0, 0};
1005
1006 while (argc > 0) {
1007 xfrm_address_t saddr;
1008
1009 if (strcmp(*argv, "mark") == 0) {
1010 xfrm_parse_mark(&mark, &argc, &argv);
1011 } else {
1012 if (idp)
1013 invarg("unknown", *argv);
1014 idp = *argv;
1015
1016 /* ID */
1017 memset(&id, 0, sizeof(id));
1018 memset(&saddr, 0, sizeof(saddr));
1019 xfrm_id_parse(&saddr, &id, &req.xsid.family, 0,
1020 &argc, &argv);
1021
1022 memcpy(&req.xsid.daddr, &id.daddr, sizeof(req.xsid.daddr));
1023 req.xsid.spi = id.spi;
1024 req.xsid.proto = id.proto;
1025
1026 addattr_l(&req.n, sizeof(req.buf), XFRMA_SRCADDR,
1027 (void *)&saddr, sizeof(saddr));
1028 }
1029
1030 argc--; argv++;
1031 }
1032
1033 if (mark.m & mark.v) {
1034 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
1035 (void *)&mark, sizeof(mark));
1036 if (r < 0) {
1037 fprintf(stderr, "XFRMA_MARK failed\n");
1038 exit(1);
1039 }
1040 }
1041
1042 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1043 exit(1);
1044
1045 if (req.xsid.family == AF_UNSPEC)
1046 req.xsid.family = AF_INET;
1047
1048 if (delete) {
1049 if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
1050 exit(2);
1051 } else {
1052 char buf[NLMSG_BUF_SIZE] = {};
1053 struct nlmsghdr *res_n = (struct nlmsghdr *)buf;
1054
1055 if (rtnl_talk(&rth, &req.n, res_n, sizeof(req)) < 0)
1056 exit(2);
1057
1058 if (xfrm_state_print(NULL, res_n, (void *)stdout) < 0) {
1059 fprintf(stderr, "An error :-)\n");
1060 exit(1);
1061 }
1062 }
1063
1064 rtnl_close(&rth);
1065
1066 return 0;
1067 }
1068
1069 /*
1070 * With an existing state of nlmsg, make new nlmsg for deleting the state
1071 * and store it to buffer.
1072 */
xfrm_state_keep(const struct sockaddr_nl * who,struct nlmsghdr * n,void * arg)1073 static int xfrm_state_keep(const struct sockaddr_nl *who,
1074 struct nlmsghdr *n,
1075 void *arg)
1076 {
1077 struct xfrm_buffer *xb = (struct xfrm_buffer *)arg;
1078 struct rtnl_handle *rth = xb->rth;
1079 struct xfrm_usersa_info *xsinfo = NLMSG_DATA(n);
1080 int len = n->nlmsg_len;
1081 struct nlmsghdr *new_n;
1082 struct xfrm_usersa_id *xsid;
1083 struct rtattr *tb[XFRMA_MAX+1];
1084
1085 if (n->nlmsg_type != XFRM_MSG_NEWSA) {
1086 fprintf(stderr, "Not a state: %08x %08x %08x\n",
1087 n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
1088 return 0;
1089 }
1090
1091 len -= NLMSG_LENGTH(sizeof(*xsinfo));
1092 if (len < 0) {
1093 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
1094 return -1;
1095 }
1096
1097 if (!xfrm_state_filter_match(xsinfo))
1098 return 0;
1099
1100 if (xb->offset > xb->size) {
1101 fprintf(stderr, "State buffer overflow\n");
1102 return -1;
1103 }
1104
1105 new_n = (struct nlmsghdr *)(xb->buf + xb->offset);
1106 new_n->nlmsg_len = NLMSG_LENGTH(sizeof(*xsid));
1107 new_n->nlmsg_flags = NLM_F_REQUEST;
1108 new_n->nlmsg_type = XFRM_MSG_DELSA;
1109 new_n->nlmsg_seq = ++rth->seq;
1110
1111 xsid = NLMSG_DATA(new_n);
1112 xsid->family = xsinfo->family;
1113 memcpy(&xsid->daddr, &xsinfo->id.daddr, sizeof(xsid->daddr));
1114 xsid->spi = xsinfo->id.spi;
1115 xsid->proto = xsinfo->id.proto;
1116
1117 addattr_l(new_n, xb->size, XFRMA_SRCADDR, &xsinfo->saddr,
1118 sizeof(xsid->daddr));
1119
1120 parse_rtattr(tb, XFRMA_MAX, XFRMS_RTA(xsinfo), len);
1121
1122 if (tb[XFRMA_MARK]) {
1123 int r = addattr_l(new_n, xb->size, XFRMA_MARK,
1124 (void *)RTA_DATA(tb[XFRMA_MARK]), tb[XFRMA_MARK]->rta_len);
1125 if (r < 0) {
1126 fprintf(stderr, "%s: XFRMA_MARK failed\n", __func__);
1127 exit(1);
1128 }
1129 }
1130
1131 xb->offset += new_n->nlmsg_len;
1132 xb->nlmsg_count++;
1133
1134 return 0;
1135 }
1136
xfrm_state_list_or_deleteall(int argc,char ** argv,int deleteall)1137 static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall)
1138 {
1139 char *idp = NULL;
1140 struct rtnl_handle rth;
1141
1142 if (argc > 0)
1143 filter.use = 1;
1144 filter.xsinfo.family = preferred_family;
1145
1146 while (argc > 0) {
1147 if (strcmp(*argv, "mode") == 0) {
1148 NEXT_ARG();
1149 xfrm_mode_parse(&filter.xsinfo.mode, &argc, &argv);
1150
1151 filter.mode_mask = XFRM_FILTER_MASK_FULL;
1152
1153 } else if (strcmp(*argv, "reqid") == 0) {
1154 NEXT_ARG();
1155 xfrm_reqid_parse(&filter.xsinfo.reqid, &argc, &argv);
1156
1157 filter.reqid_mask = XFRM_FILTER_MASK_FULL;
1158
1159 } else if (strcmp(*argv, "flag") == 0) {
1160 NEXT_ARG();
1161 xfrm_state_flag_parse(&filter.xsinfo.flags, &argc, &argv);
1162
1163 filter.state_flags_mask = XFRM_FILTER_MASK_FULL;
1164
1165 } else {
1166 if (idp)
1167 invarg("unknown", *argv);
1168 idp = *argv;
1169
1170 /* ID */
1171 xfrm_id_parse(&filter.xsinfo.saddr, &filter.xsinfo.id,
1172 &filter.xsinfo.family, 1, &argc, &argv);
1173 if (preferred_family == AF_UNSPEC)
1174 preferred_family = filter.xsinfo.family;
1175 }
1176 argc--; argv++;
1177 }
1178
1179 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1180 exit(1);
1181
1182 if (deleteall) {
1183 struct xfrm_buffer xb;
1184 char buf[NLMSG_DELETEALL_BUF_SIZE];
1185 int i;
1186
1187 xb.buf = buf;
1188 xb.size = sizeof(buf);
1189 xb.rth = &rth;
1190
1191 for (i = 0; ; i++) {
1192 struct {
1193 struct nlmsghdr n;
1194 char buf[NLMSG_BUF_SIZE];
1195 } req = {
1196 .n.nlmsg_len = NLMSG_HDRLEN,
1197 .n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
1198 .n.nlmsg_type = XFRM_MSG_GETSA,
1199 .n.nlmsg_seq = rth.dump = ++rth.seq,
1200 };
1201
1202 xb.offset = 0;
1203 xb.nlmsg_count = 0;
1204
1205 if (show_stats > 1)
1206 fprintf(stderr, "Delete-all round = %d\n", i);
1207
1208 if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
1209 perror("Cannot send dump request");
1210 exit(1);
1211 }
1212
1213 if (rtnl_dump_filter(&rth, xfrm_state_keep, &xb) < 0) {
1214 fprintf(stderr, "Delete-all terminated\n");
1215 exit(1);
1216 }
1217 if (xb.nlmsg_count == 0) {
1218 if (show_stats > 1)
1219 fprintf(stderr, "Delete-all completed\n");
1220 break;
1221 }
1222
1223 if (rtnl_send_check(&rth, xb.buf, xb.offset) < 0) {
1224 perror("Failed to send delete-all request\n");
1225 exit(1);
1226 }
1227 if (show_stats > 1)
1228 fprintf(stderr, "Delete-all nlmsg count = %d\n", xb.nlmsg_count);
1229
1230 xb.offset = 0;
1231 xb.nlmsg_count = 0;
1232 }
1233
1234 } else {
1235 struct xfrm_address_filter addrfilter = {
1236 .saddr = filter.xsinfo.saddr,
1237 .daddr = filter.xsinfo.id.daddr,
1238 .family = filter.xsinfo.family,
1239 .splen = filter.id_src_mask,
1240 .dplen = filter.id_dst_mask,
1241 };
1242 struct {
1243 struct nlmsghdr n;
1244 char buf[NLMSG_BUF_SIZE];
1245 } req = {
1246 .n.nlmsg_len = NLMSG_HDRLEN,
1247 .n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
1248 .n.nlmsg_type = XFRM_MSG_GETSA,
1249 .n.nlmsg_seq = rth.dump = ++rth.seq,
1250 };
1251
1252 if (filter.xsinfo.id.proto)
1253 addattr8(&req.n, sizeof(req), XFRMA_PROTO,
1254 filter.xsinfo.id.proto);
1255 addattr_l(&req.n, sizeof(req), XFRMA_ADDRESS_FILTER,
1256 &addrfilter, sizeof(addrfilter));
1257
1258 if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
1259 perror("Cannot send dump request");
1260 exit(1);
1261 }
1262
1263 if (rtnl_dump_filter(&rth, xfrm_state_print, stdout) < 0) {
1264 fprintf(stderr, "Dump terminated\n");
1265 exit(1);
1266 }
1267 }
1268
1269 rtnl_close(&rth);
1270
1271 exit(0);
1272 }
1273
print_sadinfo(struct nlmsghdr * n,void * arg)1274 static int print_sadinfo(struct nlmsghdr *n, void *arg)
1275 {
1276 FILE *fp = (FILE *)arg;
1277 __u32 *f = NLMSG_DATA(n);
1278 struct rtattr *tb[XFRMA_SAD_MAX+1];
1279 struct rtattr *rta;
1280 int len = n->nlmsg_len;
1281
1282 len -= NLMSG_LENGTH(sizeof(__u32));
1283 if (len < 0) {
1284 fprintf(stderr, "SADinfo: Wrong len %d\n", len);
1285 return -1;
1286 }
1287
1288 rta = XFRMSAPD_RTA(f);
1289 parse_rtattr(tb, XFRMA_SAD_MAX, rta, len);
1290
1291 if (tb[XFRMA_SAD_CNT]) {
1292 __u32 cnt;
1293
1294 fprintf(fp, "\t SAD");
1295 cnt = rta_getattr_u32(tb[XFRMA_SAD_CNT]);
1296 fprintf(fp, " count %u", cnt);
1297 } else {
1298 fprintf(fp, "BAD SAD info returned\n");
1299 return -1;
1300 }
1301
1302 if (show_stats) {
1303 if (tb[XFRMA_SAD_HINFO]) {
1304 struct xfrmu_sadhinfo *si;
1305
1306 if (RTA_PAYLOAD(tb[XFRMA_SAD_HINFO]) < sizeof(*si)) {
1307 fprintf(fp, "BAD SAD length returned\n");
1308 return -1;
1309 }
1310
1311 si = RTA_DATA(tb[XFRMA_SAD_HINFO]);
1312 fprintf(fp, " (buckets ");
1313 fprintf(fp, "count %d", si->sadhcnt);
1314 fprintf(fp, " Max %d", si->sadhmcnt);
1315 fprintf(fp, ")");
1316 }
1317 }
1318 fprintf(fp, "\n");
1319
1320 return 0;
1321 }
1322
xfrm_sad_getinfo(int argc,char ** argv)1323 static int xfrm_sad_getinfo(int argc, char **argv)
1324 {
1325 struct rtnl_handle rth;
1326 struct {
1327 struct nlmsghdr n;
1328 __u32 flags;
1329 char ans[64];
1330 } req = {
1331 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.flags)),
1332 .n.nlmsg_flags = NLM_F_REQUEST,
1333 .n.nlmsg_type = XFRM_MSG_GETSADINFO,
1334 .flags = 0XFFFFFFFF,
1335 };
1336
1337 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1338 exit(1);
1339
1340 if (rtnl_talk(&rth, &req.n, &req.n, sizeof(req)) < 0)
1341 exit(2);
1342
1343 print_sadinfo(&req.n, (void *)stdout);
1344
1345 rtnl_close(&rth);
1346
1347 return 0;
1348 }
1349
xfrm_state_flush(int argc,char ** argv)1350 static int xfrm_state_flush(int argc, char **argv)
1351 {
1352 struct rtnl_handle rth;
1353 struct {
1354 struct nlmsghdr n;
1355 struct xfrm_usersa_flush xsf;
1356 } req = {
1357 .n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsf)),
1358 .n.nlmsg_flags = NLM_F_REQUEST,
1359 .n.nlmsg_type = XFRM_MSG_FLUSHSA,
1360 };
1361 char *protop = NULL;
1362
1363 while (argc > 0) {
1364 if (strcmp(*argv, "proto") == 0) {
1365 int ret;
1366
1367 if (protop)
1368 duparg("proto", *argv);
1369 protop = *argv;
1370
1371 NEXT_ARG();
1372
1373 ret = xfrm_xfrmproto_getbyname(*argv);
1374 if (ret < 0)
1375 invarg("XFRM-PROTO value is invalid", *argv);
1376
1377 req.xsf.proto = (__u8)ret;
1378 } else
1379 invarg("unknown", *argv);
1380
1381 argc--; argv++;
1382 }
1383
1384 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1385 exit(1);
1386
1387 if (show_stats > 1)
1388 fprintf(stderr, "Flush state with XFRM-PROTO value \"%s\"\n",
1389 strxf_xfrmproto(req.xsf.proto));
1390
1391 if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
1392 exit(2);
1393
1394 rtnl_close(&rth);
1395
1396 return 0;
1397 }
1398
do_xfrm_state(int argc,char ** argv)1399 int do_xfrm_state(int argc, char **argv)
1400 {
1401 if (argc < 1)
1402 return xfrm_state_list_or_deleteall(0, NULL, 0);
1403
1404 if (matches(*argv, "add") == 0)
1405 return xfrm_state_modify(XFRM_MSG_NEWSA, 0,
1406 argc-1, argv+1);
1407 if (matches(*argv, "update") == 0)
1408 return xfrm_state_modify(XFRM_MSG_UPDSA, 0,
1409 argc-1, argv+1);
1410 if (matches(*argv, "allocspi") == 0)
1411 return xfrm_state_allocspi(argc-1, argv+1);
1412 if (matches(*argv, "delete") == 0)
1413 return xfrm_state_get_or_delete(argc-1, argv+1, 1);
1414 if (matches(*argv, "deleteall") == 0 || matches(*argv, "delall") == 0)
1415 return xfrm_state_list_or_deleteall(argc-1, argv+1, 1);
1416 if (matches(*argv, "list") == 0 || matches(*argv, "show") == 0
1417 || matches(*argv, "lst") == 0)
1418 return xfrm_state_list_or_deleteall(argc-1, argv+1, 0);
1419 if (matches(*argv, "get") == 0)
1420 return xfrm_state_get_or_delete(argc-1, argv+1, 0);
1421 if (matches(*argv, "flush") == 0)
1422 return xfrm_state_flush(argc-1, argv+1);
1423 if (matches(*argv, "count") == 0) {
1424 return xfrm_sad_getinfo(argc, argv);
1425 }
1426 if (matches(*argv, "help") == 0)
1427 usage();
1428 fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm state help\".\n", *argv);
1429 exit(-1);
1430 }
1431