• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* $USAGI: $ */
2 
3 /*
4  * Copyright (C)2004 USAGI/WIDE Project
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses>.
18  */
19 /*
20  * based on iproute.c
21  */
22 /*
23  * Authors:
24  *	Masahide NAKAMURA @USAGI
25  */
26 
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <netdb.h>
31 #include "utils.h"
32 #include "xfrm.h"
33 #include "ip_common.h"
34 
35 /* #define NLMSG_DELETEALL_BUF_SIZE (4096-512) */
36 #define NLMSG_DELETEALL_BUF_SIZE 8192
37 
38 /*
39  * Receiving buffer defines:
40  * nlmsg
41  *   data = struct xfrm_usersa_info
42  *   rtattr
43  *   rtattr
44  *   ... (max count of rtattr is XFRM_MAX+1
45  *
46  *  each rtattr data = struct xfrm_algo(dynamic size) or xfrm_address_t
47  */
48 #define NLMSG_BUF_SIZE 4096
49 #define RTA_BUF_SIZE 2048
50 #define XFRM_ALGO_KEY_BUF_SIZE 512
51 #define CTX_BUF_SIZE 256
52 
53 static void usage(void) __attribute__((noreturn));
54 
usage(void)55 static void usage(void)
56 {
57 	fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ]\n");
58 	fprintf(stderr, "        [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ]\n");
59 	fprintf(stderr, "        [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ]\n");
60 	fprintf(stderr, "        [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]\n");
61 	fprintf(stderr, "        [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n");
62 	fprintf(stderr, "        [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n");
63 	fprintf(stderr, "        [ offload [dev DEV] dir DIR ]\n");
64 	fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n");
65 	fprintf(stderr, "        [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n");
66 	fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
67 	fprintf(stderr, "Usage: ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ]\n");
68 	fprintf(stderr, "        [ flag FLAG-LIST ]\n");
69 	fprintf(stderr, "Usage: ip xfrm state flush [ proto XFRM-PROTO ]\n");
70 	fprintf(stderr, "Usage: ip xfrm state count\n");
71 	fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]\n");
72 	fprintf(stderr, "XFRM-PROTO := ");
73 	fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
74 	fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
75 	fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
76 	fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
77 	fprintf(stderr, "%s\n", strxf_xfrmproto(IPPROTO_DSTOPTS));
78 	fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] ALGO\n");
79 	fprintf(stderr, "ALGO := { ");
80 	fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT));
81 	fprintf(stderr, "%s", strxf_algotype(XFRMA_ALG_AUTH));
82 	fprintf(stderr, " } ALGO-NAME ALGO-KEYMAT |\n");
83 	fprintf(stderr, "        %s", strxf_algotype(XFRMA_ALG_AUTH_TRUNC));
84 	fprintf(stderr, " ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |\n");
85 	fprintf(stderr, "        %s", strxf_algotype(XFRMA_ALG_AEAD));
86 	fprintf(stderr, " ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |\n");
87 	fprintf(stderr, "        %s", strxf_algotype(XFRMA_ALG_COMP));
88 	fprintf(stderr, " ALGO-NAME\n");
89 	fprintf(stderr, "MODE := transport | tunnel | beet | ro | in_trigger\n");
90 	fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
91 	fprintf(stderr, "FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn\n");
92 	fprintf(stderr, "EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG\n");
93 	fprintf(stderr, "EXTRA-FLAG := dont-encap-dscp\n");
94 	fprintf(stderr, "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n");
95 	fprintf(stderr, "UPSPEC := proto { { ");
96 	fprintf(stderr, "%s | ", strxf_proto(IPPROTO_TCP));
97 	fprintf(stderr, "%s | ", strxf_proto(IPPROTO_UDP));
98 	fprintf(stderr, "%s | ", strxf_proto(IPPROTO_SCTP));
99 	fprintf(stderr, "%s", strxf_proto(IPPROTO_DCCP));
100 	fprintf(stderr, " } [ sport PORT ] [ dport PORT ] |\n");
101 	fprintf(stderr, "                  { ");
102 	fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMP));
103 	fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMPV6));
104 	fprintf(stderr, "%s", strxf_proto(IPPROTO_MH));
105 	fprintf(stderr, " } [ type NUMBER ] [ code NUMBER ] |\n");
106 	fprintf(stderr, "                  %s", strxf_proto(IPPROTO_GRE));
107 	fprintf(stderr, " [ key { DOTTED-QUAD | NUMBER } ] | PROTO }\n");
108 	fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT\n");
109 	fprintf(stderr, "LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |\n");
110 	fprintf(stderr, "         { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT\n");
111 	fprintf(stderr, "ENCAP := { espinudp | espinudp-nonike } SPORT DPORT OADDR\n");
112 	fprintf(stderr, "DIR := in | out\n");
113 
114 	exit(-1);
115 }
116 
xfrm_algo_parse(struct xfrm_algo * alg,enum xfrm_attr_type_t type,char * name,char * key,char * buf,int max)117 static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
118 			   char *name, char *key, char *buf, int max)
119 {
120 	int len;
121 	int slen = strlen(key);
122 
123 #if 0
124 	/* XXX: verifying both name and key is required! */
125 	fprintf(stderr, "warning: ALGO-NAME/ALGO-KEYMAT values will be sent to the kernel promiscuously! (verifying them isn't implemented yet)\n");
126 #endif
127 
128 	strlcpy(alg->alg_name, name, sizeof(alg->alg_name));
129 
130 	if (slen > 2 && strncmp(key, "0x", 2) == 0) {
131 		/* split two chars "0x" from the top */
132 		char *p = key + 2;
133 		int plen = slen - 2;
134 		int i;
135 		int j;
136 
137 		/* Converting hexadecimal numbered string into real key;
138 		 * Convert each two chars into one char(value). If number
139 		 * of the length is odd, add zero on the top for rounding.
140 		 */
141 
142 		/* calculate length of the converted values(real key) */
143 		len = (plen + 1) / 2;
144 		if (len > max)
145 			invarg("ALGO-KEYMAT value makes buffer overflow\n", key);
146 
147 		for (i = -(plen % 2), j = 0; j < len; i += 2, j++) {
148 			char vbuf[3];
149 			__u8 val;
150 
151 			vbuf[0] = i >= 0 ? p[i] : '0';
152 			vbuf[1] = p[i + 1];
153 			vbuf[2] = '\0';
154 
155 			if (get_u8(&val, vbuf, 16))
156 				invarg("ALGO-KEYMAT value is invalid", key);
157 
158 			buf[j] = val;
159 		}
160 	} else {
161 		len = slen;
162 		if (len > 0) {
163 			if (len > max)
164 				invarg("ALGO-KEYMAT value makes buffer overflow\n", key);
165 
166 			memcpy(buf, key, len);
167 		}
168 	}
169 
170 	alg->alg_key_len = len * 8;
171 
172 	return 0;
173 }
174 
xfrm_seq_parse(__u32 * seq,int * argcp,char *** argvp)175 static int xfrm_seq_parse(__u32 *seq, int *argcp, char ***argvp)
176 {
177 	int argc = *argcp;
178 	char **argv = *argvp;
179 
180 	if (get_be32(seq, *argv, 0))
181 		invarg("SEQ value is invalid", *argv);
182 
183 	*argcp = argc;
184 	*argvp = argv;
185 
186 	return 0;
187 }
188 
xfrm_state_flag_parse(__u8 * flags,int * argcp,char *** argvp)189 static int xfrm_state_flag_parse(__u8 *flags, int *argcp, char ***argvp)
190 {
191 	int argc = *argcp;
192 	char **argv = *argvp;
193 	int len = strlen(*argv);
194 
195 	if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
196 		__u8 val = 0;
197 
198 		if (get_u8(&val, *argv, 16))
199 			invarg("FLAG value is invalid", *argv);
200 		*flags = val;
201 	} else {
202 		while (1) {
203 			if (strcmp(*argv, "noecn") == 0)
204 				*flags |= XFRM_STATE_NOECN;
205 			else if (strcmp(*argv, "decap-dscp") == 0)
206 				*flags |= XFRM_STATE_DECAP_DSCP;
207 			else if (strcmp(*argv, "nopmtudisc") == 0)
208 				*flags |= XFRM_STATE_NOPMTUDISC;
209 			else if (strcmp(*argv, "wildrecv") == 0)
210 				*flags |= XFRM_STATE_WILDRECV;
211 			else if (strcmp(*argv, "icmp") == 0)
212 				*flags |= XFRM_STATE_ICMP;
213 			else if (strcmp(*argv, "af-unspec") == 0)
214 				*flags |= XFRM_STATE_AF_UNSPEC;
215 			else if (strcmp(*argv, "align4") == 0)
216 				*flags |= XFRM_STATE_ALIGN4;
217 			else if (strcmp(*argv, "esn") == 0)
218 				*flags |= XFRM_STATE_ESN;
219 			else {
220 				PREV_ARG(); /* back track */
221 				break;
222 			}
223 
224 			if (!NEXT_ARG_OK())
225 				break;
226 			NEXT_ARG();
227 		}
228 	}
229 
230 	*argcp = argc;
231 	*argvp = argv;
232 
233 	return 0;
234 }
235 
xfrm_state_extra_flag_parse(__u32 * extra_flags,int * argcp,char *** argvp)236 static int xfrm_state_extra_flag_parse(__u32 *extra_flags, int *argcp, char ***argvp)
237 {
238 	int argc = *argcp;
239 	char **argv = *argvp;
240 	int len = strlen(*argv);
241 
242 	if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
243 		__u32 val = 0;
244 
245 		if (get_u32(&val, *argv, 16))
246 			invarg("\"EXTRA-FLAG\" is invalid", *argv);
247 		*extra_flags = val;
248 	} else {
249 		while (1) {
250 			if (strcmp(*argv, "dont-encap-dscp") == 0)
251 				*extra_flags |= XFRM_SA_XFLAG_DONT_ENCAP_DSCP;
252 			else {
253 				PREV_ARG(); /* back track */
254 				break;
255 			}
256 
257 			if (!NEXT_ARG_OK())
258 				break;
259 			NEXT_ARG();
260 		}
261 	}
262 
263 	*argcp = argc;
264 	*argvp = argv;
265 
266 	return 0;
267 }
268 
xfrm_offload_dir_parse(__u8 * dir,int * argcp,char *** argvp)269 static int xfrm_offload_dir_parse(__u8 *dir, int *argcp, char ***argvp)
270 {
271 	int argc = *argcp;
272 	char **argv = *argvp;
273 
274 	if (strcmp(*argv, "in") == 0)
275 		*dir = XFRM_OFFLOAD_INBOUND;
276 	else if (strcmp(*argv, "out") == 0)
277 		*dir = 0;
278 	else
279 		invarg("DIR value is invalid", *argv);
280 
281 	*argcp = argc;
282 	*argvp = argv;
283 
284 	return 0;
285 }
286 
xfrm_state_modify(int cmd,unsigned int flags,int argc,char ** argv)287 static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
288 {
289 	struct rtnl_handle rth;
290 	struct {
291 		struct nlmsghdr	n;
292 		struct xfrm_usersa_info xsinfo;
293 		char			buf[RTA_BUF_SIZE];
294 	} req = {
295 		.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo)),
296 		.n.nlmsg_flags = NLM_F_REQUEST | flags,
297 		.n.nlmsg_type = cmd,
298 		.xsinfo.family = preferred_family,
299 		.xsinfo.lft.soft_byte_limit = XFRM_INF,
300 		.xsinfo.lft.hard_byte_limit = XFRM_INF,
301 		.xsinfo.lft.soft_packet_limit = XFRM_INF,
302 		.xsinfo.lft.hard_packet_limit = XFRM_INF,
303 	};
304 	struct xfrm_replay_state replay = {};
305 	struct xfrm_replay_state_esn replay_esn = {};
306 	struct xfrm_user_offload xuo = {};
307 	unsigned int ifindex = 0;
308 	__u8 dir = 0;
309 	bool is_offload = false;
310 	__u32 replay_window = 0;
311 	__u32 seq = 0, oseq = 0, seq_hi = 0, oseq_hi = 0;
312 	char *idp = NULL;
313 	char *aeadop = NULL;
314 	char *ealgop = NULL;
315 	char *aalgop = NULL;
316 	char *calgop = NULL;
317 	char *coap = NULL;
318 	char *sctxp = NULL;
319 	__u32 extra_flags = 0;
320 	struct xfrm_mark mark = {0, 0};
321 	struct {
322 		struct xfrm_user_sec_ctx sctx;
323 		char    str[CTX_BUF_SIZE];
324 	} ctx = {};
325 
326 	while (argc > 0) {
327 		if (strcmp(*argv, "mode") == 0) {
328 			NEXT_ARG();
329 			xfrm_mode_parse(&req.xsinfo.mode, &argc, &argv);
330 		} else if (strcmp(*argv, "mark") == 0) {
331 			xfrm_parse_mark(&mark, &argc, &argv);
332 		} else if (strcmp(*argv, "reqid") == 0) {
333 			NEXT_ARG();
334 			xfrm_reqid_parse(&req.xsinfo.reqid, &argc, &argv);
335 		} else if (strcmp(*argv, "seq") == 0) {
336 			NEXT_ARG();
337 			xfrm_seq_parse(&req.xsinfo.seq, &argc, &argv);
338 		} else if (strcmp(*argv, "replay-window") == 0) {
339 			NEXT_ARG();
340 			if (get_u32(&replay_window, *argv, 0))
341 				invarg("value after \"replay-window\" is invalid", *argv);
342 		} else if (strcmp(*argv, "replay-seq") == 0) {
343 			NEXT_ARG();
344 			if (get_u32(&seq, *argv, 0))
345 				invarg("value after \"replay-seq\" is invalid", *argv);
346 		} else if (strcmp(*argv, "replay-seq-hi") == 0) {
347 			NEXT_ARG();
348 			if (get_u32(&seq_hi, *argv, 0))
349 				invarg("value after \"replay-seq-hi\" is invalid", *argv);
350 		} else if (strcmp(*argv, "replay-oseq") == 0) {
351 			NEXT_ARG();
352 			if (get_u32(&oseq, *argv, 0))
353 				invarg("value after \"replay-oseq\" is invalid", *argv);
354 		} else if (strcmp(*argv, "replay-oseq-hi") == 0) {
355 			NEXT_ARG();
356 			if (get_u32(&oseq_hi, *argv, 0))
357 				invarg("value after \"replay-oseq-hi\" is invalid", *argv);
358 		} else if (strcmp(*argv, "flag") == 0) {
359 			NEXT_ARG();
360 			xfrm_state_flag_parse(&req.xsinfo.flags, &argc, &argv);
361 		} else if (strcmp(*argv, "extra-flag") == 0) {
362 			NEXT_ARG();
363 			xfrm_state_extra_flag_parse(&extra_flags, &argc, &argv);
364 		} else if (strcmp(*argv, "sel") == 0) {
365 			NEXT_ARG();
366 			preferred_family = AF_UNSPEC;
367 			xfrm_selector_parse(&req.xsinfo.sel, &argc, &argv);
368 			preferred_family = req.xsinfo.sel.family;
369 		} else if (strcmp(*argv, "limit") == 0) {
370 			NEXT_ARG();
371 			xfrm_lifetime_cfg_parse(&req.xsinfo.lft, &argc, &argv);
372 		} else if (strcmp(*argv, "encap") == 0) {
373 			struct xfrm_encap_tmpl encap;
374 			inet_prefix oa;
375 			NEXT_ARG();
376 			xfrm_encap_type_parse(&encap.encap_type, &argc, &argv);
377 			NEXT_ARG();
378 			if (get_be16(&encap.encap_sport, *argv, 0))
379 				invarg("SPORT value after \"encap\" is invalid", *argv);
380 			NEXT_ARG();
381 			if (get_be16(&encap.encap_dport, *argv, 0))
382 				invarg("DPORT value after \"encap\" is invalid", *argv);
383 			NEXT_ARG();
384 			get_addr(&oa, *argv, AF_UNSPEC);
385 			memcpy(&encap.encap_oa, &oa.data, sizeof(encap.encap_oa));
386 			addattr_l(&req.n, sizeof(req.buf), XFRMA_ENCAP,
387 				  (void *)&encap, sizeof(encap));
388 		} else if (strcmp(*argv, "coa") == 0) {
389 			inet_prefix coa;
390 			xfrm_address_t xcoa = {};
391 
392 			if (coap)
393 				duparg("coa", *argv);
394 			coap = *argv;
395 
396 			NEXT_ARG();
397 
398 			get_prefix(&coa, *argv, preferred_family);
399 			if (coa.family == AF_UNSPEC)
400 				invarg("value after \"coa\" has an unrecognized address family", *argv);
401 			if (coa.bytelen > sizeof(xcoa))
402 				invarg("value after \"coa\" is too large", *argv);
403 
404 			memcpy(&xcoa, &coa.data, coa.bytelen);
405 
406 			addattr_l(&req.n, sizeof(req.buf), XFRMA_COADDR,
407 				  (void *)&xcoa, sizeof(xcoa));
408 		} else if (strcmp(*argv, "ctx") == 0) {
409 			char *context;
410 
411 			if (sctxp)
412 				duparg("ctx", *argv);
413 			sctxp = *argv;
414 
415 			NEXT_ARG();
416 			context = *argv;
417 
418 			xfrm_sctx_parse((char *)&ctx.str, context, &ctx.sctx);
419 			addattr_l(&req.n, sizeof(req.buf), XFRMA_SEC_CTX,
420 				  (void *)&ctx, ctx.sctx.len);
421 		} else if (strcmp(*argv, "offload") == 0) {
422 			is_offload = true;
423 			NEXT_ARG();
424 			if (strcmp(*argv, "dev") == 0) {
425 				NEXT_ARG();
426 				ifindex = ll_name_to_index(*argv);
427 				if (!ifindex) {
428 					invarg("value after \"offload dev\" is invalid", *argv);
429 					is_offload = false;
430 				}
431 				NEXT_ARG();
432 			}
433 			if (strcmp(*argv, "dir") == 0) {
434 				NEXT_ARG();
435 				xfrm_offload_dir_parse(&dir, &argc, &argv);
436 			} else {
437 				invarg("value after \"offload dir\" is invalid", *argv);
438 				is_offload = false;
439 			}
440 		} else {
441 			/* try to assume ALGO */
442 			int type = xfrm_algotype_getbyname(*argv);
443 
444 			switch (type) {
445 			case XFRMA_ALG_AEAD:
446 			case XFRMA_ALG_CRYPT:
447 			case XFRMA_ALG_AUTH:
448 			case XFRMA_ALG_AUTH_TRUNC:
449 			case XFRMA_ALG_COMP:
450 			{
451 				/* ALGO */
452 				struct {
453 					union {
454 						struct xfrm_algo alg;
455 						struct xfrm_algo_aead aead;
456 						struct xfrm_algo_auth auth;
457 					} u;
458 					char buf[XFRM_ALGO_KEY_BUF_SIZE];
459 				} alg = {};
460 				int len;
461 				__u32 icvlen, trunclen;
462 				char *name;
463 				char *key = "";
464 				char *buf;
465 
466 				switch (type) {
467 				case XFRMA_ALG_AEAD:
468 					if (ealgop || aalgop || aeadop)
469 						duparg("ALGO-TYPE", *argv);
470 					aeadop = *argv;
471 					break;
472 				case XFRMA_ALG_CRYPT:
473 					if (ealgop || aeadop)
474 						duparg("ALGO-TYPE", *argv);
475 					ealgop = *argv;
476 					break;
477 				case XFRMA_ALG_AUTH:
478 				case XFRMA_ALG_AUTH_TRUNC:
479 					if (aalgop || aeadop)
480 						duparg("ALGO-TYPE", *argv);
481 					aalgop = *argv;
482 					break;
483 				case XFRMA_ALG_COMP:
484 					if (calgop)
485 						duparg("ALGO-TYPE", *argv);
486 					calgop = *argv;
487 					break;
488 				default:
489 					/* not reached */
490 					invarg("ALGO-TYPE value is invalid\n", *argv);
491 				}
492 
493 				if (!NEXT_ARG_OK())
494 					missarg("ALGO-NAME");
495 				NEXT_ARG();
496 				name = *argv;
497 
498 				switch (type) {
499 				case XFRMA_ALG_AEAD:
500 				case XFRMA_ALG_CRYPT:
501 				case XFRMA_ALG_AUTH:
502 				case XFRMA_ALG_AUTH_TRUNC:
503 					if (!NEXT_ARG_OK())
504 						missarg("ALGO-KEYMAT");
505 					NEXT_ARG();
506 					key = *argv;
507 					break;
508 				}
509 
510 				buf = alg.u.alg.alg_key;
511 				len = sizeof(alg.u.alg);
512 
513 				switch (type) {
514 				case XFRMA_ALG_AEAD:
515 					if (!NEXT_ARG_OK())
516 						missarg("ALGO-ICV-LEN");
517 					NEXT_ARG();
518 					if (get_u32(&icvlen, *argv, 0))
519 						invarg("ALGO-ICV-LEN value is invalid",
520 						       *argv);
521 					alg.u.aead.alg_icv_len = icvlen;
522 
523 					buf = alg.u.aead.alg_key;
524 					len = sizeof(alg.u.aead);
525 					break;
526 				case XFRMA_ALG_AUTH_TRUNC:
527 					if (!NEXT_ARG_OK())
528 						missarg("ALGO-TRUNC-LEN");
529 					NEXT_ARG();
530 					if (get_u32(&trunclen, *argv, 0))
531 						invarg("ALGO-TRUNC-LEN value is invalid",
532 						       *argv);
533 					alg.u.auth.alg_trunc_len = trunclen;
534 
535 					buf = alg.u.auth.alg_key;
536 					len = sizeof(alg.u.auth);
537 					break;
538 				}
539 
540 				xfrm_algo_parse((void *)&alg, type, name, key,
541 						buf, sizeof(alg.buf));
542 				len += alg.u.alg.alg_key_len / 8;
543 
544 				addattr_l(&req.n, sizeof(req.buf), type,
545 					  (void *)&alg, len);
546 				break;
547 			}
548 			default:
549 				/* try to assume ID */
550 				if (idp)
551 					invarg("unknown", *argv);
552 				idp = *argv;
553 
554 				/* ID */
555 				xfrm_id_parse(&req.xsinfo.saddr, &req.xsinfo.id,
556 					      &req.xsinfo.family, 0, &argc, &argv);
557 				if (preferred_family == AF_UNSPEC)
558 					preferred_family = req.xsinfo.family;
559 			}
560 		}
561 		argc--; argv++;
562 	}
563 
564 	if (req.xsinfo.flags & XFRM_STATE_ESN &&
565 	    replay_window == 0) {
566 		fprintf(stderr, "Error: esn flag set without replay-window.\n");
567 		exit(-1);
568 	}
569 
570 	if (replay_window > XFRMA_REPLAY_ESN_MAX) {
571 		fprintf(stderr,
572 			"Error: replay-window (%u) > XFRMA_REPLAY_ESN_MAX (%u).\n",
573 			replay_window, XFRMA_REPLAY_ESN_MAX);
574 		exit(-1);
575 	}
576 
577 	if (is_offload) {
578 		xuo.ifindex = ifindex;
579 		xuo.flags = dir;
580 		addattr_l(&req.n, sizeof(req.buf), XFRMA_OFFLOAD_DEV, &xuo,
581 			  sizeof(xuo));
582 	}
583 	if (req.xsinfo.flags & XFRM_STATE_ESN ||
584 	    replay_window > (sizeof(replay.bitmap) * 8)) {
585 		replay_esn.seq = seq;
586 		replay_esn.oseq = oseq;
587 		replay_esn.seq_hi = seq_hi;
588 		replay_esn.oseq_hi = oseq_hi;
589 		replay_esn.replay_window = replay_window;
590 		replay_esn.bmp_len = (replay_window + sizeof(__u32) * 8 - 1) /
591 				     (sizeof(__u32) * 8);
592 		addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_ESN_VAL,
593 			  &replay_esn, sizeof(replay_esn));
594 	} else {
595 		if (seq || oseq) {
596 			replay.seq = seq;
597 			replay.oseq = oseq;
598 			addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_VAL,
599 				  &replay, sizeof(replay));
600 		}
601 		req.xsinfo.replay_window = replay_window;
602 	}
603 
604 	if (extra_flags)
605 		addattr32(&req.n, sizeof(req.buf), XFRMA_SA_EXTRA_FLAGS,
606 			  extra_flags);
607 
608 	if (!idp) {
609 		fprintf(stderr, "Not enough information: ID is required\n");
610 		exit(1);
611 	}
612 
613 	if (mark.m) {
614 		int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
615 				  (void *)&mark, sizeof(mark));
616 		if (r < 0) {
617 			fprintf(stderr, "XFRMA_MARK failed\n");
618 			exit(1);
619 		}
620 	}
621 
622 	if (xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) {
623 		switch (req.xsinfo.mode) {
624 		case XFRM_MODE_TRANSPORT:
625 		case XFRM_MODE_TUNNEL:
626 			break;
627 		case XFRM_MODE_BEET:
628 			if (req.xsinfo.id.proto == IPPROTO_ESP)
629 				break;
630 		default:
631 			fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
632 				strxf_xfrmproto(req.xsinfo.id.proto));
633 			exit(1);
634 		}
635 
636 		switch (req.xsinfo.id.proto) {
637 		case IPPROTO_ESP:
638 			if (calgop) {
639 				fprintf(stderr, "ALGO-TYPE value \"%s\" is invalid with XFRM-PROTO value \"%s\"\n",
640 					strxf_algotype(XFRMA_ALG_COMP),
641 					strxf_xfrmproto(req.xsinfo.id.proto));
642 				exit(1);
643 			}
644 			if (!ealgop && !aeadop) {
645 				fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
646 					strxf_algotype(XFRMA_ALG_CRYPT),
647 					strxf_algotype(XFRMA_ALG_AEAD),
648 					strxf_xfrmproto(req.xsinfo.id.proto));
649 				exit(1);
650 			}
651 			break;
652 		case IPPROTO_AH:
653 			if (ealgop || aeadop || calgop) {
654 				fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
655 					strxf_algotype(XFRMA_ALG_CRYPT),
656 					strxf_algotype(XFRMA_ALG_AEAD),
657 					strxf_algotype(XFRMA_ALG_COMP),
658 					strxf_xfrmproto(req.xsinfo.id.proto));
659 				exit(1);
660 			}
661 			if (!aalgop) {
662 				fprintf(stderr, "ALGO-TYPE value \"%s\" or \"%s\" is required with XFRM-PROTO value \"%s\"\n",
663 					strxf_algotype(XFRMA_ALG_AUTH),
664 					strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
665 					strxf_xfrmproto(req.xsinfo.id.proto));
666 				exit(1);
667 			}
668 			break;
669 		case IPPROTO_COMP:
670 			if (ealgop || aalgop || aeadop) {
671 				fprintf(stderr, "ALGO-TYPE values \"%s\", \"%s\", \"%s\", and \"%s\" are invalid with XFRM-PROTO value \"%s\"\n",
672 					strxf_algotype(XFRMA_ALG_CRYPT),
673 					strxf_algotype(XFRMA_ALG_AUTH),
674 					strxf_algotype(XFRMA_ALG_AUTH_TRUNC),
675 					strxf_algotype(XFRMA_ALG_AEAD),
676 					strxf_xfrmproto(req.xsinfo.id.proto));
677 				exit(1);
678 			}
679 			if (!calgop) {
680 				fprintf(stderr, "ALGO-TYPE value \"%s\" is required with XFRM-PROTO value \"%s\"\n",
681 					strxf_algotype(XFRMA_ALG_COMP),
682 					strxf_xfrmproto(req.xsinfo.id.proto));
683 				exit(1);
684 			}
685 			break;
686 		}
687 	} else {
688 		if (ealgop || aalgop || aeadop || calgop) {
689 			fprintf(stderr, "ALGO is invalid with XFRM-PROTO value \"%s\"\n",
690 				strxf_xfrmproto(req.xsinfo.id.proto));
691 			exit(1);
692 		}
693 	}
694 
695 	if (xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
696 		switch (req.xsinfo.mode) {
697 		case XFRM_MODE_ROUTEOPTIMIZATION:
698 		case XFRM_MODE_IN_TRIGGER:
699 			break;
700 		case 0:
701 			fprintf(stderr, "\"mode\" is required with XFRM-PROTO value \"%s\"\n",
702 				strxf_xfrmproto(req.xsinfo.id.proto));
703 			exit(1);
704 		default:
705 			fprintf(stderr, "MODE value is invalid with XFRM-PROTO value \"%s\"\n",
706 				strxf_xfrmproto(req.xsinfo.id.proto));
707 			exit(1);
708 		}
709 
710 		if (!coap) {
711 			fprintf(stderr, "\"coa\" is required with XFRM-PROTO value \"%s\"\n",
712 				strxf_xfrmproto(req.xsinfo.id.proto));
713 			exit(1);
714 		}
715 	} else {
716 		if (coap) {
717 			fprintf(stderr, "\"coa\" is invalid with XFRM-PROTO value \"%s\"\n",
718 				strxf_xfrmproto(req.xsinfo.id.proto));
719 			exit(1);
720 		}
721 	}
722 
723 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
724 		exit(1);
725 
726 	if (req.xsinfo.family == AF_UNSPEC)
727 		req.xsinfo.family = AF_INET;
728 
729 	if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
730 		exit(2);
731 
732 	rtnl_close(&rth);
733 
734 	return 0;
735 }
736 
xfrm_state_allocspi(int argc,char ** argv)737 static int xfrm_state_allocspi(int argc, char **argv)
738 {
739 	struct rtnl_handle rth;
740 	struct {
741 		struct nlmsghdr	n;
742 		struct xfrm_userspi_info xspi;
743 		char			buf[RTA_BUF_SIZE];
744 	} req = {
745 		.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xspi)),
746 		.n.nlmsg_flags = NLM_F_REQUEST,
747 		.n.nlmsg_type = XFRM_MSG_ALLOCSPI,
748 		.xspi.info.family = preferred_family,
749 #if 0
750 		.xspi.lft.soft_byte_limit = XFRM_INF,
751 		.xspi.lft.hard_byte_limit = XFRM_INF,
752 		.xspi.lft.soft_packet_limit = XFRM_INF,
753 		.xspi.lft.hard_packet_limit = XFRM_INF,
754 #endif
755 	};
756 	char *idp = NULL;
757 	char *minp = NULL;
758 	char *maxp = NULL;
759 	struct xfrm_mark mark = {0, 0};
760 	char res_buf[NLMSG_BUF_SIZE] = {};
761 	struct nlmsghdr *res_n = (struct nlmsghdr *)res_buf;
762 
763 	while (argc > 0) {
764 		if (strcmp(*argv, "mode") == 0) {
765 			NEXT_ARG();
766 			xfrm_mode_parse(&req.xspi.info.mode, &argc, &argv);
767 		} else if (strcmp(*argv, "mark") == 0) {
768 			xfrm_parse_mark(&mark, &argc, &argv);
769 		} else if (strcmp(*argv, "reqid") == 0) {
770 			NEXT_ARG();
771 			xfrm_reqid_parse(&req.xspi.info.reqid, &argc, &argv);
772 		} else if (strcmp(*argv, "seq") == 0) {
773 			NEXT_ARG();
774 			xfrm_seq_parse(&req.xspi.info.seq, &argc, &argv);
775 		} else if (strcmp(*argv, "min") == 0) {
776 			if (minp)
777 				duparg("min", *argv);
778 			minp = *argv;
779 
780 			NEXT_ARG();
781 
782 			if (get_u32(&req.xspi.min, *argv, 0))
783 				invarg("value after \"min\" is invalid", *argv);
784 		} else if (strcmp(*argv, "max") == 0) {
785 			if (maxp)
786 				duparg("max", *argv);
787 			maxp = *argv;
788 
789 			NEXT_ARG();
790 
791 			if (get_u32(&req.xspi.max, *argv, 0))
792 				invarg("value after \"max\" is invalid", *argv);
793 		} else {
794 			/* try to assume ID */
795 			if (idp)
796 				invarg("unknown", *argv);
797 			idp = *argv;
798 
799 			/* ID */
800 			xfrm_id_parse(&req.xspi.info.saddr, &req.xspi.info.id,
801 				      &req.xspi.info.family, 0, &argc, &argv);
802 			if (req.xspi.info.id.spi) {
803 				fprintf(stderr, "\"spi\" is invalid\n");
804 				exit(1);
805 			}
806 			if (preferred_family == AF_UNSPEC)
807 				preferred_family = req.xspi.info.family;
808 		}
809 		argc--; argv++;
810 	}
811 
812 	if (!idp) {
813 		fprintf(stderr, "Not enough information: ID is required\n");
814 		exit(1);
815 	}
816 
817 	if (minp) {
818 		if (!maxp) {
819 			fprintf(stderr, "\"max\" is missing\n");
820 			exit(1);
821 		}
822 		if (req.xspi.min > req.xspi.max) {
823 			fprintf(stderr, "value after \"min\" is larger than value after \"max\"\n");
824 			exit(1);
825 		}
826 	} else {
827 		if (maxp) {
828 			fprintf(stderr, "\"min\" is missing\n");
829 			exit(1);
830 		}
831 
832 		/* XXX: Default value defined in PF_KEY;
833 		 * See kernel's net/key/af_key.c(pfkey_getspi).
834 		 */
835 		req.xspi.min = 0x100;
836 		req.xspi.max = 0x0fffffff;
837 
838 		/* XXX: IPCOMP spi is 16-bits;
839 		 * See kernel's net/xfrm/xfrm_user(verify_userspi_info).
840 		 */
841 		if (req.xspi.info.id.proto == IPPROTO_COMP)
842 			req.xspi.max = 0xffff;
843 	}
844 
845 	if (mark.m & mark.v) {
846 		int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
847 				  (void *)&mark, sizeof(mark));
848 		if (r < 0) {
849 			fprintf(stderr, "XFRMA_MARK failed\n");
850 			exit(1);
851 		}
852 	}
853 
854 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
855 		exit(1);
856 
857 	if (req.xspi.info.family == AF_UNSPEC)
858 		req.xspi.info.family = AF_INET;
859 
860 
861 	if (rtnl_talk(&rth, &req.n, res_n, sizeof(res_buf)) < 0)
862 		exit(2);
863 
864 	if (xfrm_state_print(NULL, res_n, (void *)stdout) < 0) {
865 		fprintf(stderr, "An error :-)\n");
866 		exit(1);
867 	}
868 
869 	rtnl_close(&rth);
870 
871 	return 0;
872 }
873 
xfrm_state_filter_match(struct xfrm_usersa_info * xsinfo)874 static int xfrm_state_filter_match(struct xfrm_usersa_info *xsinfo)
875 {
876 	if (!filter.use)
877 		return 1;
878 
879 	if (filter.id_src_mask)
880 		if (xfrm_addr_match(&xsinfo->saddr, &filter.xsinfo.saddr,
881 				    filter.id_src_mask))
882 			return 0;
883 	if (filter.id_dst_mask)
884 		if (xfrm_addr_match(&xsinfo->id.daddr, &filter.xsinfo.id.daddr,
885 				    filter.id_dst_mask))
886 			return 0;
887 	if ((xsinfo->id.proto^filter.xsinfo.id.proto)&filter.id_proto_mask)
888 		return 0;
889 	if ((xsinfo->id.spi^filter.xsinfo.id.spi)&filter.id_spi_mask)
890 		return 0;
891 	if ((xsinfo->mode^filter.xsinfo.mode)&filter.mode_mask)
892 		return 0;
893 	if ((xsinfo->reqid^filter.xsinfo.reqid)&filter.reqid_mask)
894 		return 0;
895 	if (filter.state_flags_mask)
896 		if ((xsinfo->flags & filter.xsinfo.flags) == 0)
897 			return 0;
898 
899 	return 1;
900 }
901 
xfrm_state_print(const struct sockaddr_nl * who,struct nlmsghdr * n,void * arg)902 int xfrm_state_print(const struct sockaddr_nl *who, struct nlmsghdr *n,
903 		     void *arg)
904 {
905 	FILE *fp = (FILE *)arg;
906 	struct rtattr *tb[XFRMA_MAX+1];
907 	struct rtattr *rta;
908 	struct xfrm_usersa_info *xsinfo = NULL;
909 	struct xfrm_user_expire *xexp = NULL;
910 	struct xfrm_usersa_id	*xsid = NULL;
911 	int len = n->nlmsg_len;
912 
913 	if (n->nlmsg_type != XFRM_MSG_NEWSA &&
914 	    n->nlmsg_type != XFRM_MSG_DELSA &&
915 	    n->nlmsg_type != XFRM_MSG_UPDSA &&
916 	    n->nlmsg_type != XFRM_MSG_EXPIRE) {
917 		fprintf(stderr, "Not a state: %08x %08x %08x\n",
918 			n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
919 		return 0;
920 	}
921 
922 	if (n->nlmsg_type == XFRM_MSG_DELSA) {
923 		/* Dont blame me for this .. Herbert made me do it */
924 		xsid = NLMSG_DATA(n);
925 		len -= NLMSG_SPACE(sizeof(*xsid));
926 	} else if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
927 		xexp = NLMSG_DATA(n);
928 		xsinfo = &xexp->state;
929 		len -= NLMSG_SPACE(sizeof(*xexp));
930 	} else {
931 		xexp = NULL;
932 		xsinfo = NLMSG_DATA(n);
933 		len -= NLMSG_SPACE(sizeof(*xsinfo));
934 	}
935 
936 	if (len < 0) {
937 		fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
938 		return -1;
939 	}
940 
941 	if (xsinfo && !xfrm_state_filter_match(xsinfo))
942 		return 0;
943 
944 	if (n->nlmsg_type == XFRM_MSG_DELSA)
945 		fprintf(fp, "Deleted ");
946 	else if (n->nlmsg_type == XFRM_MSG_UPDSA)
947 		fprintf(fp, "Updated ");
948 	else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
949 		fprintf(fp, "Expired ");
950 
951 	if (n->nlmsg_type == XFRM_MSG_DELSA)
952 		rta = XFRMSID_RTA(xsid);
953 	else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
954 		rta = XFRMEXP_RTA(xexp);
955 	else
956 		rta = XFRMS_RTA(xsinfo);
957 
958 	parse_rtattr(tb, XFRMA_MAX, rta, len);
959 
960 	if (n->nlmsg_type == XFRM_MSG_DELSA) {
961 		/* xfrm_policy_id_print(); */
962 
963 		if (!tb[XFRMA_SA]) {
964 			fprintf(stderr, "Buggy XFRM_MSG_DELSA: no XFRMA_SA\n");
965 			return -1;
966 		}
967 		if (RTA_PAYLOAD(tb[XFRMA_SA]) < sizeof(*xsinfo)) {
968 			fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: too short XFRMA_POLICY len\n");
969 			return -1;
970 		}
971 		xsinfo = RTA_DATA(tb[XFRMA_SA]);
972 	}
973 
974 	xfrm_state_info_print(xsinfo, tb, fp, NULL, NULL);
975 
976 	if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
977 		fprintf(fp, "\t");
978 		fprintf(fp, "hard %u", xexp->hard);
979 		fprintf(fp, "%s", _SL_);
980 	}
981 
982 	if (oneline)
983 		fprintf(fp, "\n");
984 	fflush(fp);
985 
986 	return 0;
987 }
988 
xfrm_state_get_or_delete(int argc,char ** argv,int delete)989 static int xfrm_state_get_or_delete(int argc, char **argv, int delete)
990 {
991 	struct rtnl_handle rth;
992 	struct {
993 		struct nlmsghdr	n;
994 		struct xfrm_usersa_id	xsid;
995 		char			buf[RTA_BUF_SIZE];
996 	} req = {
997 		.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsid)),
998 		.n.nlmsg_flags = NLM_F_REQUEST,
999 		.n.nlmsg_type = delete ? XFRM_MSG_DELSA : XFRM_MSG_GETSA,
1000 		.xsid.family = preferred_family,
1001 	};
1002 	struct xfrm_id id;
1003 	char *idp = NULL;
1004 	struct xfrm_mark mark = {0, 0};
1005 
1006 	while (argc > 0) {
1007 		xfrm_address_t saddr;
1008 
1009 		if (strcmp(*argv, "mark") == 0) {
1010 			xfrm_parse_mark(&mark, &argc, &argv);
1011 		} else {
1012 			if (idp)
1013 				invarg("unknown", *argv);
1014 			idp = *argv;
1015 
1016 			/* ID */
1017 			memset(&id, 0, sizeof(id));
1018 			memset(&saddr, 0, sizeof(saddr));
1019 			xfrm_id_parse(&saddr, &id, &req.xsid.family, 0,
1020 				      &argc, &argv);
1021 
1022 			memcpy(&req.xsid.daddr, &id.daddr, sizeof(req.xsid.daddr));
1023 			req.xsid.spi = id.spi;
1024 			req.xsid.proto = id.proto;
1025 
1026 			addattr_l(&req.n, sizeof(req.buf), XFRMA_SRCADDR,
1027 				  (void *)&saddr, sizeof(saddr));
1028 		}
1029 
1030 		argc--; argv++;
1031 	}
1032 
1033 	if (mark.m & mark.v) {
1034 		int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
1035 				  (void *)&mark, sizeof(mark));
1036 		if (r < 0) {
1037 			fprintf(stderr, "XFRMA_MARK failed\n");
1038 			exit(1);
1039 		}
1040 	}
1041 
1042 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1043 		exit(1);
1044 
1045 	if (req.xsid.family == AF_UNSPEC)
1046 		req.xsid.family = AF_INET;
1047 
1048 	if (delete) {
1049 		if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
1050 			exit(2);
1051 	} else {
1052 		char buf[NLMSG_BUF_SIZE] = {};
1053 		struct nlmsghdr *res_n = (struct nlmsghdr *)buf;
1054 
1055 		if (rtnl_talk(&rth, &req.n, res_n, sizeof(req)) < 0)
1056 			exit(2);
1057 
1058 		if (xfrm_state_print(NULL, res_n, (void *)stdout) < 0) {
1059 			fprintf(stderr, "An error :-)\n");
1060 			exit(1);
1061 		}
1062 	}
1063 
1064 	rtnl_close(&rth);
1065 
1066 	return 0;
1067 }
1068 
1069 /*
1070  * With an existing state of nlmsg, make new nlmsg for deleting the state
1071  * and store it to buffer.
1072  */
xfrm_state_keep(const struct sockaddr_nl * who,struct nlmsghdr * n,void * arg)1073 static int xfrm_state_keep(const struct sockaddr_nl *who,
1074 			   struct nlmsghdr *n,
1075 			   void *arg)
1076 {
1077 	struct xfrm_buffer *xb = (struct xfrm_buffer *)arg;
1078 	struct rtnl_handle *rth = xb->rth;
1079 	struct xfrm_usersa_info *xsinfo = NLMSG_DATA(n);
1080 	int len = n->nlmsg_len;
1081 	struct nlmsghdr *new_n;
1082 	struct xfrm_usersa_id *xsid;
1083 	struct rtattr *tb[XFRMA_MAX+1];
1084 
1085 	if (n->nlmsg_type != XFRM_MSG_NEWSA) {
1086 		fprintf(stderr, "Not a state: %08x %08x %08x\n",
1087 			n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
1088 		return 0;
1089 	}
1090 
1091 	len -= NLMSG_LENGTH(sizeof(*xsinfo));
1092 	if (len < 0) {
1093 		fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
1094 		return -1;
1095 	}
1096 
1097 	if (!xfrm_state_filter_match(xsinfo))
1098 		return 0;
1099 
1100 	if (xb->offset > xb->size) {
1101 		fprintf(stderr, "State buffer overflow\n");
1102 		return -1;
1103 	}
1104 
1105 	new_n = (struct nlmsghdr *)(xb->buf + xb->offset);
1106 	new_n->nlmsg_len = NLMSG_LENGTH(sizeof(*xsid));
1107 	new_n->nlmsg_flags = NLM_F_REQUEST;
1108 	new_n->nlmsg_type = XFRM_MSG_DELSA;
1109 	new_n->nlmsg_seq = ++rth->seq;
1110 
1111 	xsid = NLMSG_DATA(new_n);
1112 	xsid->family = xsinfo->family;
1113 	memcpy(&xsid->daddr, &xsinfo->id.daddr, sizeof(xsid->daddr));
1114 	xsid->spi = xsinfo->id.spi;
1115 	xsid->proto = xsinfo->id.proto;
1116 
1117 	addattr_l(new_n, xb->size, XFRMA_SRCADDR, &xsinfo->saddr,
1118 		  sizeof(xsid->daddr));
1119 
1120 	parse_rtattr(tb, XFRMA_MAX, XFRMS_RTA(xsinfo), len);
1121 
1122 	if (tb[XFRMA_MARK]) {
1123 		int r = addattr_l(new_n, xb->size, XFRMA_MARK,
1124 				(void *)RTA_DATA(tb[XFRMA_MARK]), tb[XFRMA_MARK]->rta_len);
1125 		if (r < 0) {
1126 			fprintf(stderr, "%s: XFRMA_MARK failed\n", __func__);
1127 			exit(1);
1128 		}
1129 	}
1130 
1131 	xb->offset += new_n->nlmsg_len;
1132 	xb->nlmsg_count++;
1133 
1134 	return 0;
1135 }
1136 
xfrm_state_list_or_deleteall(int argc,char ** argv,int deleteall)1137 static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall)
1138 {
1139 	char *idp = NULL;
1140 	struct rtnl_handle rth;
1141 
1142 	if (argc > 0)
1143 		filter.use = 1;
1144 	filter.xsinfo.family = preferred_family;
1145 
1146 	while (argc > 0) {
1147 		if (strcmp(*argv, "mode") == 0) {
1148 			NEXT_ARG();
1149 			xfrm_mode_parse(&filter.xsinfo.mode, &argc, &argv);
1150 
1151 			filter.mode_mask = XFRM_FILTER_MASK_FULL;
1152 
1153 		} else if (strcmp(*argv, "reqid") == 0) {
1154 			NEXT_ARG();
1155 			xfrm_reqid_parse(&filter.xsinfo.reqid, &argc, &argv);
1156 
1157 			filter.reqid_mask = XFRM_FILTER_MASK_FULL;
1158 
1159 		} else if (strcmp(*argv, "flag") == 0) {
1160 			NEXT_ARG();
1161 			xfrm_state_flag_parse(&filter.xsinfo.flags, &argc, &argv);
1162 
1163 			filter.state_flags_mask = XFRM_FILTER_MASK_FULL;
1164 
1165 		} else {
1166 			if (idp)
1167 				invarg("unknown", *argv);
1168 			idp = *argv;
1169 
1170 			/* ID */
1171 			xfrm_id_parse(&filter.xsinfo.saddr, &filter.xsinfo.id,
1172 				      &filter.xsinfo.family, 1, &argc, &argv);
1173 			if (preferred_family == AF_UNSPEC)
1174 				preferred_family = filter.xsinfo.family;
1175 		}
1176 		argc--; argv++;
1177 	}
1178 
1179 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1180 		exit(1);
1181 
1182 	if (deleteall) {
1183 		struct xfrm_buffer xb;
1184 		char buf[NLMSG_DELETEALL_BUF_SIZE];
1185 		int i;
1186 
1187 		xb.buf = buf;
1188 		xb.size = sizeof(buf);
1189 		xb.rth = &rth;
1190 
1191 		for (i = 0; ; i++) {
1192 			struct {
1193 				struct nlmsghdr n;
1194 				char buf[NLMSG_BUF_SIZE];
1195 			} req = {
1196 				.n.nlmsg_len = NLMSG_HDRLEN,
1197 				.n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
1198 				.n.nlmsg_type = XFRM_MSG_GETSA,
1199 				.n.nlmsg_seq = rth.dump = ++rth.seq,
1200 			};
1201 
1202 			xb.offset = 0;
1203 			xb.nlmsg_count = 0;
1204 
1205 			if (show_stats > 1)
1206 				fprintf(stderr, "Delete-all round = %d\n", i);
1207 
1208 			if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
1209 				perror("Cannot send dump request");
1210 				exit(1);
1211 			}
1212 
1213 			if (rtnl_dump_filter(&rth, xfrm_state_keep, &xb) < 0) {
1214 				fprintf(stderr, "Delete-all terminated\n");
1215 				exit(1);
1216 			}
1217 			if (xb.nlmsg_count == 0) {
1218 				if (show_stats > 1)
1219 					fprintf(stderr, "Delete-all completed\n");
1220 				break;
1221 			}
1222 
1223 			if (rtnl_send_check(&rth, xb.buf, xb.offset) < 0) {
1224 				perror("Failed to send delete-all request\n");
1225 				exit(1);
1226 			}
1227 			if (show_stats > 1)
1228 				fprintf(stderr, "Delete-all nlmsg count = %d\n", xb.nlmsg_count);
1229 
1230 			xb.offset = 0;
1231 			xb.nlmsg_count = 0;
1232 		}
1233 
1234 	} else {
1235 		struct xfrm_address_filter addrfilter = {
1236 			.saddr = filter.xsinfo.saddr,
1237 			.daddr = filter.xsinfo.id.daddr,
1238 			.family = filter.xsinfo.family,
1239 			.splen = filter.id_src_mask,
1240 			.dplen = filter.id_dst_mask,
1241 		};
1242 		struct {
1243 			struct nlmsghdr n;
1244 			char buf[NLMSG_BUF_SIZE];
1245 		} req = {
1246 			.n.nlmsg_len = NLMSG_HDRLEN,
1247 			.n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
1248 			.n.nlmsg_type = XFRM_MSG_GETSA,
1249 			.n.nlmsg_seq = rth.dump = ++rth.seq,
1250 		};
1251 
1252 		if (filter.xsinfo.id.proto)
1253 			addattr8(&req.n, sizeof(req), XFRMA_PROTO,
1254 				 filter.xsinfo.id.proto);
1255 		addattr_l(&req.n, sizeof(req), XFRMA_ADDRESS_FILTER,
1256 			  &addrfilter, sizeof(addrfilter));
1257 
1258 		if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
1259 			perror("Cannot send dump request");
1260 			exit(1);
1261 		}
1262 
1263 		if (rtnl_dump_filter(&rth, xfrm_state_print, stdout) < 0) {
1264 			fprintf(stderr, "Dump terminated\n");
1265 			exit(1);
1266 		}
1267 	}
1268 
1269 	rtnl_close(&rth);
1270 
1271 	exit(0);
1272 }
1273 
print_sadinfo(struct nlmsghdr * n,void * arg)1274 static int print_sadinfo(struct nlmsghdr *n, void *arg)
1275 {
1276 	FILE *fp = (FILE *)arg;
1277 	__u32 *f = NLMSG_DATA(n);
1278 	struct rtattr *tb[XFRMA_SAD_MAX+1];
1279 	struct rtattr *rta;
1280 	int len = n->nlmsg_len;
1281 
1282 	len -= NLMSG_LENGTH(sizeof(__u32));
1283 	if (len < 0) {
1284 		fprintf(stderr, "SADinfo: Wrong len %d\n", len);
1285 		return -1;
1286 	}
1287 
1288 	rta = XFRMSAPD_RTA(f);
1289 	parse_rtattr(tb, XFRMA_SAD_MAX, rta, len);
1290 
1291 	if (tb[XFRMA_SAD_CNT]) {
1292 		__u32 cnt;
1293 
1294 		fprintf(fp, "\t SAD");
1295 		cnt = rta_getattr_u32(tb[XFRMA_SAD_CNT]);
1296 		fprintf(fp, " count %u", cnt);
1297 	} else {
1298 		fprintf(fp, "BAD SAD info returned\n");
1299 		return -1;
1300 	}
1301 
1302 	if (show_stats) {
1303 		if (tb[XFRMA_SAD_HINFO]) {
1304 			struct xfrmu_sadhinfo *si;
1305 
1306 			if (RTA_PAYLOAD(tb[XFRMA_SAD_HINFO]) < sizeof(*si)) {
1307 				fprintf(fp, "BAD SAD length returned\n");
1308 				return -1;
1309 			}
1310 
1311 			si = RTA_DATA(tb[XFRMA_SAD_HINFO]);
1312 			fprintf(fp, " (buckets ");
1313 			fprintf(fp, "count %d", si->sadhcnt);
1314 			fprintf(fp, " Max %d", si->sadhmcnt);
1315 			fprintf(fp, ")");
1316 		}
1317 	}
1318 	fprintf(fp, "\n");
1319 
1320 	return 0;
1321 }
1322 
xfrm_sad_getinfo(int argc,char ** argv)1323 static int xfrm_sad_getinfo(int argc, char **argv)
1324 {
1325 	struct rtnl_handle rth;
1326 	struct {
1327 		struct nlmsghdr			n;
1328 		__u32				flags;
1329 		char				ans[64];
1330 	} req = {
1331 		.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.flags)),
1332 		.n.nlmsg_flags = NLM_F_REQUEST,
1333 		.n.nlmsg_type = XFRM_MSG_GETSADINFO,
1334 		.flags = 0XFFFFFFFF,
1335 	};
1336 
1337 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1338 		exit(1);
1339 
1340 	if (rtnl_talk(&rth, &req.n, &req.n, sizeof(req)) < 0)
1341 		exit(2);
1342 
1343 	print_sadinfo(&req.n, (void *)stdout);
1344 
1345 	rtnl_close(&rth);
1346 
1347 	return 0;
1348 }
1349 
xfrm_state_flush(int argc,char ** argv)1350 static int xfrm_state_flush(int argc, char **argv)
1351 {
1352 	struct rtnl_handle rth;
1353 	struct {
1354 		struct nlmsghdr			n;
1355 		struct xfrm_usersa_flush	xsf;
1356 	} req = {
1357 		.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsf)),
1358 		.n.nlmsg_flags = NLM_F_REQUEST,
1359 		.n.nlmsg_type = XFRM_MSG_FLUSHSA,
1360 	};
1361 	char *protop = NULL;
1362 
1363 	while (argc > 0) {
1364 		if (strcmp(*argv, "proto") == 0) {
1365 			int ret;
1366 
1367 			if (protop)
1368 				duparg("proto", *argv);
1369 			protop = *argv;
1370 
1371 			NEXT_ARG();
1372 
1373 			ret = xfrm_xfrmproto_getbyname(*argv);
1374 			if (ret < 0)
1375 				invarg("XFRM-PROTO value is invalid", *argv);
1376 
1377 			req.xsf.proto = (__u8)ret;
1378 		} else
1379 			invarg("unknown", *argv);
1380 
1381 		argc--; argv++;
1382 	}
1383 
1384 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1385 		exit(1);
1386 
1387 	if (show_stats > 1)
1388 		fprintf(stderr, "Flush state with XFRM-PROTO value \"%s\"\n",
1389 			strxf_xfrmproto(req.xsf.proto));
1390 
1391 	if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
1392 		exit(2);
1393 
1394 	rtnl_close(&rth);
1395 
1396 	return 0;
1397 }
1398 
do_xfrm_state(int argc,char ** argv)1399 int do_xfrm_state(int argc, char **argv)
1400 {
1401 	if (argc < 1)
1402 		return xfrm_state_list_or_deleteall(0, NULL, 0);
1403 
1404 	if (matches(*argv, "add") == 0)
1405 		return xfrm_state_modify(XFRM_MSG_NEWSA, 0,
1406 					 argc-1, argv+1);
1407 	if (matches(*argv, "update") == 0)
1408 		return xfrm_state_modify(XFRM_MSG_UPDSA, 0,
1409 					 argc-1, argv+1);
1410 	if (matches(*argv, "allocspi") == 0)
1411 		return xfrm_state_allocspi(argc-1, argv+1);
1412 	if (matches(*argv, "delete") == 0)
1413 		return xfrm_state_get_or_delete(argc-1, argv+1, 1);
1414 	if (matches(*argv, "deleteall") == 0 || matches(*argv, "delall") == 0)
1415 		return xfrm_state_list_or_deleteall(argc-1, argv+1, 1);
1416 	if (matches(*argv, "list") == 0 || matches(*argv, "show") == 0
1417 	    || matches(*argv, "lst") == 0)
1418 		return xfrm_state_list_or_deleteall(argc-1, argv+1, 0);
1419 	if (matches(*argv, "get") == 0)
1420 		return xfrm_state_get_or_delete(argc-1, argv+1, 0);
1421 	if (matches(*argv, "flush") == 0)
1422 		return xfrm_state_flush(argc-1, argv+1);
1423 	if (matches(*argv, "count") == 0) {
1424 		return xfrm_sad_getinfo(argc, argv);
1425 	}
1426 	if (matches(*argv, "help") == 0)
1427 		usage();
1428 	fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm state help\".\n", *argv);
1429 	exit(-1);
1430 }
1431