ip/xfrm_policy.c

   1 /* $USAGI: $ */
   2
   3 /*
   4  * Copyright (C)2004 USAGI/WIDE Project
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 /*
  21  * based on iproute.c
  22  */
  23 /*
  24  * Authors:
  25  *      Masahide NAKAMURA @USAGI
  26  */
  27
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <netdb.h>
  32 #include <linux/netlink.h>
  33 #include <linux/xfrm.h>
  34 #include "utils.h"
  35 #include "xfrm.h"
  36 #include "ip_common.h"
  37
  38 //#define NLMSG_DELETEALL_BUF_SIZE (4096-512)
  39 #define NLMSG_DELETEALL_BUF_SIZE 8192
  40
  41 /*
  42  * Receiving buffer defines:
  43  * nlmsg
  44  *   data = struct xfrm_userpolicy_info
  45  *   rtattr
  46  *     data = struct xfrm_user_tmpl[]
  47  */
  48 #define NLMSG_BUF_SIZE 4096
  49 #define RTA_BUF_SIZE 2048
  50 #define XFRM_TMPLS_BUF_SIZE 1024
  51
  52 static void usage(void) __attribute__((noreturn));
  53
  54 static void usage(void)
  55 {
  56         fprintf(stderr, "Usage: ip xfrm policy { add | update } dir DIR SELECTOR [ index INDEX ] [ ptype PTYPE ]\n");
  57         fprintf(stderr, "        [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ] [ LIMIT-LIST ] [ TMPL-LIST ] [mark MARK [mask MASK]]\n");
  58         fprintf(stderr, "Usage: ip xfrm policy { delete | get } dir DIR [ SELECTOR | index INDEX ] [ ptype PTYPE ] [mark MARK [mask MASK]]\n");
  59         fprintf(stderr, "Usage: ip xfrm policy { deleteall | list } [ dir DIR ] [ SELECTOR ]\n");
  60         fprintf(stderr, "        [ index INDEX ] [ action ACTION ] [ priority PRIORITY ]  [ flag FLAG-LIST ]\n");
  61         fprintf(stderr, "Usage: ip xfrm policy flush [ ptype PTYPE ]\n");
  62         fprintf(stderr, "Usage: ip xfrm count\n");
  63         fprintf(stderr, "PTYPE := [ main | sub ](default=main)\n");
  64         fprintf(stderr, "DIR := [ in | out | fwd ]\n");
  65
  66         fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC ] [ dev DEV ]\n");
  67
  68         fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n");
  69         fprintf(stderr, "                        [ type NUMBER ] [ code NUMBER ] |\n");
  70         fprintf(stderr, "                        [ key { DOTTED_QUAD | NUMBER } ] ]\n");
  71
  72         //fprintf(stderr, "DEV - device name(default=none)\n");
  73
  74         fprintf(stderr, "ACTION := [ allow | block ](default=allow)\n");
  75
  76         //fprintf(stderr, "PRIORITY - priority value(default=0)\n");
  77
  78         fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
  79         fprintf(stderr, "FLAG := [ localok ]\n");
  80
  81         fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] | [ limit LIMIT ]\n");
  82         fprintf(stderr, "LIMIT := [ [time-soft|time-hard|time-use-soft|time-use-hard] SECONDS ] |\n");
  83         fprintf(stderr, "         [ [byte-soft|byte-hard] SIZE ] | [ [packet-soft|packet-hard] NUMBER ]\n");
  84
  85         fprintf(stderr, "TMPL-LIST := [ TMPL-LIST ] | [ tmpl TMPL ]\n");
  86         fprintf(stderr, "TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]\n");
  87         fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM_PROTO ] [ spi SPI ]\n");
  88
  89         fprintf(stderr, "XFRM_PROTO := [ ");
  90         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
  91         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
  92         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
  93         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
  94         fprintf(stderr, "%s ", strxf_xfrmproto(IPPROTO_DSTOPTS));
  95         fprintf(stderr, "]\n");
  96
  97         fprintf(stderr, "MODE := [ transport | tunnel | beet ](default=transport)\n");
  98         //fprintf(stderr, "REQID - number(default=0)\n");
  99         fprintf(stderr, "LEVEL := [ required | use ](default=required)\n");
 100
 101         exit(-1);
 102 }
 103
 104 static int xfrm_policy_dir_parse(__u8 *dir, int *argcp, char ***argvp)
 105 {
 106         int argc = *argcp;
 107         char **argv = *argvp;
 108
 109         if (strcmp(*argv, "in") == 0)
 110                 *dir = XFRM_POLICY_IN;
 111         else if (strcmp(*argv, "out") == 0)
 112                 *dir = XFRM_POLICY_OUT;
 113         else if (strcmp(*argv, "fwd") == 0)
 114                 *dir = XFRM_POLICY_FWD;
 115         else
 116                 invarg("\"DIR\" is invalid", *argv);
 117
 118         *argcp = argc;
 119         *argvp = argv;
 120
 121         return 0;
 122 }
 123
 124 static int xfrm_policy_ptype_parse(__u8 *ptype, int *argcp, char ***argvp)
 125 {
 126         int argc = *argcp;
 127         char **argv = *argvp;
 128
 129         if (strcmp(*argv, "main") == 0)
 130                 *ptype = XFRM_POLICY_TYPE_MAIN;
 131         else if (strcmp(*argv, "sub") == 0)
 132                 *ptype = XFRM_POLICY_TYPE_SUB;
 133         else
 134                 invarg("\"PTYPE\" is invalid", *argv);
 135
 136         *argcp = argc;
 137         *argvp = argv;
 138
 139         return 0;
 140 }
 141
 142 static int xfrm_policy_flag_parse(__u8 *flags, int *argcp, char ***argvp)
 143 {
 144         int argc = *argcp;
 145         char **argv = *argvp;
 146         int len = strlen(*argv);
 147
 148         if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
 149                 __u8 val = 0;
 150
 151                 if (get_u8(&val, *argv, 16))
 152                         invarg("\"FLAG\" is invalid", *argv);
 153                 *flags = val;
 154         } else {
 155                 while (1) {
 156                         if (strcmp(*argv, "localok") == 0)
 157                                 *flags |= XFRM_POLICY_LOCALOK;
 158                         else {
 159                                 PREV_ARG(); /* back track */
 160                                 break;
 161                         }
 162
 163                         if (!NEXT_ARG_OK())
 164                                 break;
 165                         NEXT_ARG();
 166                 }
 167         }
 168
 169         *argcp = argc;
 170         *argvp = argv;
 171
 172         return 0;
 173 }
 174
 175 static int xfrm_tmpl_parse(struct xfrm_user_tmpl *tmpl,
 176                            int *argcp, char ***argvp)
 177 {
 178         int argc = *argcp;
 179         char **argv = *argvp;
 180         char *idp = NULL;
 181
 182         while (1) {
 183                 if (strcmp(*argv, "mode") == 0) {
 184                         NEXT_ARG();
 185                         xfrm_mode_parse(&tmpl->mode,  &argc, &argv);
 186                 } else if (strcmp(*argv, "reqid") == 0) {
 187                         NEXT_ARG();
 188                         xfrm_reqid_parse(&tmpl->reqid, &argc, &argv);
 189                 } else if (strcmp(*argv, "level") == 0) {
 190                         NEXT_ARG();
 191
 192                         if (strcmp(*argv, "required") == 0)
 193                                 tmpl->optional = 0;
 194                         else if (strcmp(*argv, "use") == 0)
 195                                 tmpl->optional = 1;
 196                         else
 197                                 invarg("\"LEVEL\" is invalid\n", *argv);
 198
 199                 } else {
 200                         if (idp) {
 201                                 PREV_ARG(); /* back track */
 202                                 break;
 203                         }
 204                         idp = *argv;
 205                         preferred_family = AF_UNSPEC;
 206                         xfrm_id_parse(&tmpl->saddr, &tmpl->id, &tmpl->family,
 207                                       0, &argc, &argv);
 208                         preferred_family = tmpl->family;
 209                 }
 210
 211                 if (!NEXT_ARG_OK())
 212                         break;
 213
 214                 NEXT_ARG();
 215         }
 216         if (argc == *argcp)
 217                 missarg("TMPL");
 218
 219         *argcp = argc;
 220         *argvp = argv;
 221
 222         return 0;
 223 }
 224
 225 static int xfrm_policy_modify(int cmd, unsigned flags, int argc, char **argv)
 226 {
 227         struct rtnl_handle rth;
 228         struct {
 229                 struct nlmsghdr                 n;
 230                 struct xfrm_userpolicy_info     xpinfo;
 231                 char                            buf[RTA_BUF_SIZE];
 232         } req;
 233         char *dirp = NULL;
 234         char *selp = NULL;
 235         char *ptypep = NULL;
 236         struct xfrm_userpolicy_type upt;
 237         char tmpls_buf[XFRM_TMPLS_BUF_SIZE];
 238         int tmpls_len = 0;
 239         struct xfrm_mark mark = {0, 0};
 240
 241         memset(&req, 0, sizeof(req));
 242         memset(&upt, 0, sizeof(upt));
 243         memset(&tmpls_buf, 0, sizeof(tmpls_buf));
 244
 245         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xpinfo));
 246         req.n.nlmsg_flags = NLM_F_REQUEST|flags;
 247         req.n.nlmsg_type = cmd;
 248         req.xpinfo.sel.family = preferred_family;
 249
 250         req.xpinfo.lft.soft_byte_limit = XFRM_INF;
 251         req.xpinfo.lft.hard_byte_limit = XFRM_INF;
 252         req.xpinfo.lft.soft_packet_limit = XFRM_INF;
 253         req.xpinfo.lft.hard_packet_limit = XFRM_INF;
 254
 255         while (argc > 0) {
 256                 if (strcmp(*argv, "dir") == 0) {
 257                         if (dirp)
 258                                 duparg("dir", *argv);
 259                         dirp = *argv;
 260
 261                         NEXT_ARG();
 262                         xfrm_policy_dir_parse(&req.xpinfo.dir, &argc, &argv);
 263                 } else if (strcmp(*argv, "mark") == 0) {
 264                         xfrm_parse_mark(&mark, &argc, &argv);
 265                 } else if (strcmp(*argv, "index") == 0) {
 266                         NEXT_ARG();
 267                         if (get_u32(&req.xpinfo.index, *argv, 0))
 268                                 invarg("\"INDEX\" is invalid", *argv);
 269                 } else if (strcmp(*argv, "ptype") == 0) {
 270                         if (ptypep)
 271                                 duparg("ptype", *argv);
 272                         ptypep = *argv;
 273
 274                         NEXT_ARG();
 275                         xfrm_policy_ptype_parse(&upt.type, &argc, &argv);
 276                 } else if (strcmp(*argv, "action") == 0) {
 277                         NEXT_ARG();
 278                         if (strcmp(*argv, "allow") == 0)
 279                                 req.xpinfo.action = XFRM_POLICY_ALLOW;
 280                         else if (strcmp(*argv, "block") == 0)
 281                                 req.xpinfo.action = XFRM_POLICY_BLOCK;
 282                         else
 283                                 invarg("\"action\" value is invalid\n", *argv);
 284                 } else if (strcmp(*argv, "priority") == 0) {
 285                         NEXT_ARG();
 286                         if (get_u32(&req.xpinfo.priority, *argv, 0))
 287                                 invarg("\"PRIORITY\" is invalid", *argv);
 288                 } else if (strcmp(*argv, "flag") == 0) {
 289                         NEXT_ARG();
 290                         xfrm_policy_flag_parse(&req.xpinfo.flags, &argc,
 291                                                &argv);
 292                 } else if (strcmp(*argv, "limit") == 0) {
 293                         NEXT_ARG();
 294                         xfrm_lifetime_cfg_parse(&req.xpinfo.lft, &argc, &argv);
 295                 } else if (strcmp(*argv, "tmpl") == 0) {
 296                         struct xfrm_user_tmpl *tmpl;
 297
 298                         if (tmpls_len + sizeof(*tmpl) > sizeof(tmpls_buf)) {
 299                                 fprintf(stderr, "Too many tmpls: buffer overflow\n");
 300                                 exit(1);
 301                         }
 302                         tmpl = (struct xfrm_user_tmpl *)((char *)tmpls_buf + tmpls_len);
 303
 304                         tmpl->family = preferred_family;
 305                         tmpl->aalgos = (~(__u32)0);
 306                         tmpl->ealgos = (~(__u32)0);
 307                         tmpl->calgos = (~(__u32)0);
 308
 309                         NEXT_ARG();
 310                         xfrm_tmpl_parse(tmpl, &argc, &argv);
 311
 312                         tmpls_len += sizeof(*tmpl);
 313                 } else {
 314                         if (selp)
 315                                 duparg("unknown", *argv);
 316                         selp = *argv;
 317
 318                         xfrm_selector_parse(&req.xpinfo.sel, &argc, &argv);
 319                         if (preferred_family == AF_UNSPEC)
 320                                 preferred_family = req.xpinfo.sel.family;
 321                 }
 322
 323                 argc--; argv++;
 324         }
 325
 326         if (!dirp) {
 327                 fprintf(stderr, "Not enough information: \"DIR\" is required.\n");
 328                 exit(1);
 329         }
 330
 331         if (ptypep) {
 332                 addattr_l(&req.n, sizeof(req), XFRMA_POLICY_TYPE,
 333                           (void *)&upt, sizeof(upt));
 334         }
 335
 336         if (tmpls_len > 0) {
 337                 addattr_l(&req.n, sizeof(req), XFRMA_TMPL,
 338                           (void *)tmpls_buf, tmpls_len);
 339         }
 340
 341         if (mark.m & mark.v) {
 342                 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
 343                                   (void *)&mark, sizeof(mark));
 344                 if (r < 0) {
 345                         fprintf(stderr, "%s: XFRMA_MARK failed\n",__func__);
 346                         exit(1);
 347                 }
 348         }
 349
 350
 351         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 352                 exit(1);
 353
 354         if (req.xpinfo.sel.family == AF_UNSPEC)
 355                 req.xpinfo.sel.family = AF_INET;
 356
 357         if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
 358                 exit(2);
 359
 360         rtnl_close(&rth);
 361
 362         return 0;
 363 }
 364
 365 static int xfrm_policy_filter_match(struct xfrm_userpolicy_info *xpinfo,
 366                                     __u8 ptype)
 367 {
 368         if (!filter.use)
 369                 return 1;
 370
 371         if ((xpinfo->dir^filter.xpinfo.dir)&filter.dir_mask)
 372                 return 0;
 373
 374         if ((ptype^filter.ptype)&filter.ptype_mask)
 375                 return 0;
 376
 377         if (filter.sel_src_mask) {
 378                 if (xfrm_addr_match(&xpinfo->sel.saddr, &filter.xpinfo.sel.saddr,
 379                                     filter.sel_src_mask))
 380                         return 0;
 381         }
 382
 383         if (filter.sel_dst_mask) {
 384                 if (xfrm_addr_match(&xpinfo->sel.daddr, &filter.xpinfo.sel.daddr,
 385                                     filter.sel_dst_mask))
 386                         return 0;
 387         }
 388
 389         if ((xpinfo->sel.ifindex^filter.xpinfo.sel.ifindex)&filter.sel_dev_mask)
 390                 return 0;
 391
 392         if ((xpinfo->sel.proto^filter.xpinfo.sel.proto)&filter.upspec_proto_mask)
 393                 return 0;
 394
 395         if (filter.upspec_sport_mask) {
 396                 if ((xpinfo->sel.sport^filter.xpinfo.sel.sport)&filter.upspec_sport_mask)
 397                         return 0;
 398         }
 399
 400         if (filter.upspec_dport_mask) {
 401                 if ((xpinfo->sel.dport^filter.xpinfo.sel.dport)&filter.upspec_dport_mask)
 402                         return 0;
 403         }
 404
 405         if ((xpinfo->index^filter.xpinfo.index)&filter.index_mask)
 406                 return 0;
 407
 408         if ((xpinfo->action^filter.xpinfo.action)&filter.action_mask)
 409                 return 0;
 410
 411         if ((xpinfo->priority^filter.xpinfo.priority)&filter.priority_mask)
 412                 return 0;
 413
 414         if (filter.policy_flags_mask)
 415                 if ((xpinfo->flags & filter.xpinfo.flags) == 0)
 416                         return 0;
 417
 418         return 1;
 419 }
 420
 421 int xfrm_policy_print(const struct sockaddr_nl *who, struct nlmsghdr *n,
 422                       void *arg)
 423 {
 424         struct rtattr * tb[XFRMA_MAX+1];
 425         struct rtattr * rta;
 426         struct xfrm_userpolicy_info *xpinfo = NULL;
 427         struct xfrm_user_polexpire *xpexp = NULL;
 428         struct xfrm_userpolicy_id *xpid = NULL;
 429         __u8 ptype = XFRM_POLICY_TYPE_MAIN;
 430         FILE *fp = (FILE*)arg;
 431         int len = n->nlmsg_len;
 432
 433         if (n->nlmsg_type != XFRM_MSG_NEWPOLICY &&
 434             n->nlmsg_type != XFRM_MSG_DELPOLICY &&
 435             n->nlmsg_type != XFRM_MSG_UPDPOLICY &&
 436             n->nlmsg_type != XFRM_MSG_POLEXPIRE) {
 437                 fprintf(stderr, "Not a policy: %08x %08x %08x\n",
 438                         n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
 439                 return 0;
 440         }
 441
 442         if (n->nlmsg_type == XFRM_MSG_DELPOLICY)  {
 443                 xpid = NLMSG_DATA(n);
 444                 len -= NLMSG_SPACE(sizeof(*xpid));
 445         } else if (n->nlmsg_type == XFRM_MSG_POLEXPIRE) {
 446                 xpexp = NLMSG_DATA(n);
 447                 xpinfo = &xpexp->pol;
 448                 len -= NLMSG_SPACE(sizeof(*xpexp));
 449         } else {
 450                 xpexp = NULL;
 451                 xpinfo = NLMSG_DATA(n);
 452                 len -= NLMSG_SPACE(sizeof(*xpinfo));
 453         }
 454
 455         if (len < 0) {
 456                 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
 457                 return -1;
 458         }
 459
 460         if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
 461                 rta = XFRMPID_RTA(xpid);
 462         else if (n->nlmsg_type == XFRM_MSG_POLEXPIRE)
 463                 rta = XFRMPEXP_RTA(xpexp);
 464         else
 465                 rta = XFRMP_RTA(xpinfo);
 466
 467         parse_rtattr(tb, XFRMA_MAX, rta, len);
 468
 469         if (tb[XFRMA_POLICY_TYPE]) {
 470                 struct xfrm_userpolicy_type *upt;
 471
 472                 if (RTA_PAYLOAD(tb[XFRMA_POLICY_TYPE]) < sizeof(*upt)) {
 473                         fprintf(stderr, "too short XFRMA_POLICY_TYPE len\n");
 474                         return -1;
 475                 }
 476                 upt = (struct xfrm_userpolicy_type *)RTA_DATA(tb[XFRMA_POLICY_TYPE]);
 477                 ptype = upt->type;
 478         }
 479
 480         if (xpinfo && !xfrm_policy_filter_match(xpinfo, ptype))
 481                 return 0;
 482
 483         if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
 484                 fprintf(fp, "Deleted ");
 485         else if (n->nlmsg_type == XFRM_MSG_UPDPOLICY)
 486                 fprintf(fp, "Updated ");
 487         else if (n->nlmsg_type == XFRM_MSG_POLEXPIRE)
 488                 fprintf(fp, "Expired ");
 489
 490         if (n->nlmsg_type == XFRM_MSG_DELPOLICY) {
 491                 //xfrm_policy_id_print();
 492                 if (!tb[XFRMA_POLICY]) {
 493                         fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: no XFRMA_POLICY\n");
 494                         return -1;
 495                 }
 496                 if (RTA_PAYLOAD(tb[XFRMA_POLICY]) < sizeof(*xpinfo)) {
 497                         fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: too short XFRMA_POLICY len\n");
 498                         return -1;
 499                 }
 500                 xpinfo = (struct xfrm_userpolicy_info *)RTA_DATA(tb[XFRMA_POLICY]);
 501         }
 502
 503         xfrm_policy_info_print(xpinfo, tb, fp, NULL, NULL);
 504
 505         if (n->nlmsg_type == XFRM_MSG_POLEXPIRE) {
 506                 fprintf(fp, "\t");
 507                 fprintf(fp, "hard %u", xpexp->hard);
 508                 fprintf(fp, "%s", _SL_);
 509         }
 510
 511         if (oneline)
 512                 fprintf(fp, "\n");
 513         fflush(fp);
 514
 515         return 0;
 516 }
 517
 518 static int xfrm_policy_get_or_delete(int argc, char **argv, int delete,
 519                                      void *res_nlbuf)
 520 {
 521         struct rtnl_handle rth;
 522         struct {
 523                 struct nlmsghdr                 n;
 524                 struct xfrm_userpolicy_id       xpid;
 525                 char                            buf[RTA_BUF_SIZE];
 526         } req;
 527         char *dirp = NULL;
 528         char *selp = NULL;
 529         char *indexp = NULL;
 530         char *ptypep = NULL;
 531         struct xfrm_userpolicy_type upt;
 532         struct xfrm_mark mark = {0, 0};
 533
 534         memset(&req, 0, sizeof(req));
 535         memset(&upt, 0, sizeof(upt));
 536
 537         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xpid));
 538         req.n.nlmsg_flags = NLM_F_REQUEST;
 539         req.n.nlmsg_type = delete ? XFRM_MSG_DELPOLICY : XFRM_MSG_GETPOLICY;
 540
 541         while (argc > 0) {
 542                 if (strcmp(*argv, "dir") == 0) {
 543                         if (dirp)
 544                                 duparg("dir", *argv);
 545                         dirp = *argv;
 546
 547                         NEXT_ARG();
 548                         xfrm_policy_dir_parse(&req.xpid.dir, &argc, &argv);
 549
 550                 } else if (strcmp(*argv, "mark") == 0) {
 551                         xfrm_parse_mark(&mark, &argc, &argv);
 552                 } else if (strcmp(*argv, "index") == 0) {
 553                         if (indexp)
 554                                 duparg("index", *argv);
 555                         indexp = *argv;
 556
 557                         NEXT_ARG();
 558                         if (get_u32(&req.xpid.index, *argv, 0))
 559                                 invarg("\"INDEX\" is invalid", *argv);
 560
 561                 } else if (strcmp(*argv, "ptype") == 0) {
 562                         if (ptypep)
 563                                 duparg("ptype", *argv);
 564                         ptypep = *argv;
 565
 566                         NEXT_ARG();
 567                         xfrm_policy_ptype_parse(&upt.type, &argc, &argv);
 568
 569                 } else {
 570                         if (selp)
 571                                 invarg("unknown", *argv);
 572                         selp = *argv;
 573
 574                         xfrm_selector_parse(&req.xpid.sel, &argc, &argv);
 575                         if (preferred_family == AF_UNSPEC)
 576                                 preferred_family = req.xpid.sel.family;
 577
 578                 }
 579
 580                 argc--; argv++;
 581         }
 582
 583         if (!dirp) {
 584                 fprintf(stderr, "Not enough information: \"DIR\" is required.\n");
 585                 exit(1);
 586         }
 587         if (ptypep) {
 588                 addattr_l(&req.n, sizeof(req), XFRMA_POLICY_TYPE,
 589                           (void *)&upt, sizeof(upt));
 590         }
 591         if (!selp && !indexp) {
 592                 fprintf(stderr, "Not enough information: either \"SELECTOR\" or \"INDEX\" is required.\n");
 593                 exit(1);
 594         }
 595         if (selp && indexp)
 596                 duparg2("SELECTOR", "INDEX");
 597
 598         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 599                 exit(1);
 600
 601         if (req.xpid.sel.family == AF_UNSPEC)
 602                 req.xpid.sel.family = AF_INET;
 603
 604         if (mark.m & mark.v) {
 605                 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
 606                                   (void *)&mark, sizeof(mark));
 607                 if (r < 0) {
 608                         fprintf(stderr, "%s: XFRMA_MARK failed\n",__func__);
 609                         exit(1);
 610                 }
 611         }
 612
 613         if (rtnl_talk(&rth, &req.n, 0, 0, res_nlbuf, NULL, NULL) < 0)
 614                 exit(2);
 615
 616         rtnl_close(&rth);
 617
 618         return 0;
 619 }
 620
 621 static int xfrm_policy_delete(int argc, char **argv)
 622 {
 623         return xfrm_policy_get_or_delete(argc, argv, 1, NULL);
 624 }
 625
 626 static int xfrm_policy_get(int argc, char **argv)
 627 {
 628         char buf[NLMSG_BUF_SIZE];
 629         struct nlmsghdr *n = (struct nlmsghdr *)buf;
 630
 631         memset(buf, 0, sizeof(buf));
 632
 633         xfrm_policy_get_or_delete(argc, argv, 0, n);
 634
 635         if (xfrm_policy_print(NULL, n, (void*)stdout) < 0) {
 636                 fprintf(stderr, "An error :-)\n");
 637                 exit(1);
 638         }
 639
 640         return 0;
 641 }
 642
 643 /*
 644  * With an existing policy of nlmsg, make new nlmsg for deleting the policy
 645  * and store it to buffer.
 646  */
 647 static int xfrm_policy_keep(const struct sockaddr_nl *who,
 648                             struct nlmsghdr *n,
 649                             void *arg)
 650 {
 651         struct xfrm_buffer *xb = (struct xfrm_buffer *)arg;
 652         struct rtnl_handle *rth = xb->rth;
 653         struct xfrm_userpolicy_info *xpinfo = NLMSG_DATA(n);
 654         int len = n->nlmsg_len;
 655         struct rtattr *tb[XFRMA_MAX+1];
 656         __u8 ptype = XFRM_POLICY_TYPE_MAIN;
 657         struct nlmsghdr *new_n;
 658         struct xfrm_userpolicy_id *xpid;
 659
 660         if (n->nlmsg_type != XFRM_MSG_NEWPOLICY) {
 661                 fprintf(stderr, "Not a policy: %08x %08x %08x\n",
 662                         n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
 663                 return 0;
 664         }
 665
 666         len -= NLMSG_LENGTH(sizeof(*xpinfo));
 667         if (len < 0) {
 668                 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
 669                 return -1;
 670         }
 671
 672         parse_rtattr(tb, XFRMA_MAX, XFRMP_RTA(xpinfo), len);
 673
 674         if (tb[XFRMA_POLICY_TYPE]) {
 675                 struct xfrm_userpolicy_type *upt;
 676
 677                 if (RTA_PAYLOAD(tb[XFRMA_POLICY_TYPE]) < sizeof(*upt)) {
 678                         fprintf(stderr, "too short XFRMA_POLICY_TYPE len\n");
 679                         return -1;
 680                 }
 681                 upt = (struct xfrm_userpolicy_type *)RTA_DATA(tb[XFRMA_POLICY_TYPE]);
 682                 ptype = upt->type;
 683         }
 684
 685         if (!xfrm_policy_filter_match(xpinfo, ptype))
 686                 return 0;
 687
 688         if (xb->offset > xb->size) {
 689                 fprintf(stderr, "Policy buffer overflow\n");
 690                 return -1;
 691         }
 692
 693         new_n = (struct nlmsghdr *)(xb->buf + xb->offset);
 694         new_n->nlmsg_len = NLMSG_LENGTH(sizeof(*xpid));
 695         new_n->nlmsg_flags = NLM_F_REQUEST;
 696         new_n->nlmsg_type = XFRM_MSG_DELPOLICY;
 697         new_n->nlmsg_seq = ++rth->seq;
 698
 699         xpid = NLMSG_DATA(new_n);
 700         memcpy(&xpid->sel, &xpinfo->sel, sizeof(xpid->sel));
 701         xpid->dir = xpinfo->dir;
 702         xpid->index = xpinfo->index;
 703
 704         xb->offset += new_n->nlmsg_len;
 705         xb->nlmsg_count ++;
 706
 707         return 0;
 708 }
 709
 710 static int xfrm_policy_list_or_deleteall(int argc, char **argv, int deleteall)
 711 {
 712         char *selp = NULL;
 713         struct rtnl_handle rth;
 714
 715         if (argc > 0)
 716                 filter.use = 1;
 717         filter.xpinfo.sel.family = preferred_family;
 718
 719         while (argc > 0) {
 720                 if (strcmp(*argv, "dir") == 0) {
 721                         NEXT_ARG();
 722                         xfrm_policy_dir_parse(&filter.xpinfo.dir, &argc, &argv);
 723
 724                         filter.dir_mask = XFRM_FILTER_MASK_FULL;
 725
 726                 } else if (strcmp(*argv, "index") == 0) {
 727                         NEXT_ARG();
 728                         if (get_u32(&filter.xpinfo.index, *argv, 0))
 729                                 invarg("\"INDEX\" is invalid", *argv);
 730
 731                         filter.index_mask = XFRM_FILTER_MASK_FULL;
 732
 733                 } else if (strcmp(*argv, "ptype") == 0) {
 734                         NEXT_ARG();
 735                         xfrm_policy_ptype_parse(&filter.ptype, &argc, &argv);
 736
 737                         filter.ptype_mask = XFRM_FILTER_MASK_FULL;
 738
 739                 } else if (strcmp(*argv, "action") == 0) {
 740                         NEXT_ARG();
 741                         if (strcmp(*argv, "allow") == 0)
 742                                 filter.xpinfo.action = XFRM_POLICY_ALLOW;
 743                         else if (strcmp(*argv, "block") == 0)
 744                                 filter.xpinfo.action = XFRM_POLICY_BLOCK;
 745                         else
 746                                 invarg("\"ACTION\" is invalid\n", *argv);
 747
 748                         filter.action_mask = XFRM_FILTER_MASK_FULL;
 749
 750                 } else if (strcmp(*argv, "priority") == 0) {
 751                         NEXT_ARG();
 752                         if (get_u32(&filter.xpinfo.priority, *argv, 0))
 753                                 invarg("\"PRIORITY\" is invalid", *argv);
 754
 755                         filter.priority_mask = XFRM_FILTER_MASK_FULL;
 756
 757                 } else if (strcmp(*argv, "flag") == 0) {
 758                         NEXT_ARG();
 759                         xfrm_policy_flag_parse(&filter.xpinfo.flags, &argc,
 760                                                &argv);
 761
 762                         filter.policy_flags_mask = XFRM_FILTER_MASK_FULL;
 763
 764                 } else {
 765                         if (selp)
 766                                 invarg("unknown", *argv);
 767                         selp = *argv;
 768
 769                         xfrm_selector_parse(&filter.xpinfo.sel, &argc, &argv);
 770                         if (preferred_family == AF_UNSPEC)
 771                                 preferred_family = filter.xpinfo.sel.family;
 772
 773                 }
 774
 775                 argc--; argv++;
 776         }
 777
 778         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 779                 exit(1);
 780
 781         if (deleteall) {
 782                 struct xfrm_buffer xb;
 783                 char buf[NLMSG_DELETEALL_BUF_SIZE];
 784                 int i;
 785
 786                 xb.buf = buf;
 787                 xb.size = sizeof(buf);
 788                 xb.rth = &rth;
 789
 790                 for (i = 0; ; i++) {
 791                         xb.offset = 0;
 792                         xb.nlmsg_count = 0;
 793
 794                         if (show_stats > 1)
 795                                 fprintf(stderr, "Delete-all round = %d\n", i);
 796
 797                         if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETPOLICY) < 0) {
 798                                 perror("Cannot send dump request");
 799                                 exit(1);
 800                         }
 801
 802                         if (rtnl_dump_filter(&rth, xfrm_policy_keep, &xb, NULL, NULL) < 0) {
 803                                 fprintf(stderr, "Delete-all terminated\n");
 804                                 exit(1);
 805                         }
 806                         if (xb.nlmsg_count == 0) {
 807                                 if (show_stats > 1)
 808                                         fprintf(stderr, "Delete-all completed\n");
 809                                 break;
 810                         }
 811
 812                         if (rtnl_send_check(&rth, xb.buf, xb.offset) < 0) {
 813                                 perror("Failed to send delete-all request");
 814                                 exit(1);
 815                         }
 816                         if (show_stats > 1)
 817                                 fprintf(stderr, "Delete-all nlmsg count = %d\n", xb.nlmsg_count);
 818
 819                         xb.offset = 0;
 820                         xb.nlmsg_count = 0;
 821                 }
 822         } else {
 823                 if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETPOLICY) < 0) {
 824                         perror("Cannot send dump request");
 825                         exit(1);
 826                 }
 827
 828                 if (rtnl_dump_filter(&rth, xfrm_policy_print, stdout, NULL, NULL) < 0) {
 829                         fprintf(stderr, "Dump terminated\n");
 830                         exit(1);
 831                 }
 832         }
 833
 834         rtnl_close(&rth);
 835
 836         exit(0);
 837 }
 838
 839 int print_spdinfo( struct nlmsghdr *n, void *arg)
 840 {
 841         FILE *fp = (FILE*)arg;
 842         __u32 *f = NLMSG_DATA(n);
 843         struct rtattr * tb[XFRMA_SPD_MAX+1];
 844         struct rtattr * rta;
 845
 846         int len = n->nlmsg_len;
 847
 848         len -= NLMSG_LENGTH(sizeof(__u32));
 849         if (len < 0) {
 850                 fprintf(stderr, "SPDinfo: Wrong len %d\n", len);
 851                 return -1;
 852         }
 853
 854         rta = XFRMSAPD_RTA(f);
 855         parse_rtattr(tb, XFRMA_SPD_MAX, rta, len);
 856
 857         fprintf(fp,"\t SPD");
 858         if (tb[XFRMA_SPD_INFO]) {
 859                 struct xfrmu_spdinfo *si;
 860
 861                 if (RTA_PAYLOAD(tb[XFRMA_SPD_INFO]) < sizeof(*si)) {
 862                         fprintf(stderr, "SPDinfo: Wrong len %d\n", len);
 863                         return -1;
 864                 }
 865                 si = RTA_DATA(tb[XFRMA_SPD_INFO]);
 866                 fprintf(fp," IN  %d", si->incnt);
 867                 fprintf(fp," OUT %d", si->outcnt);
 868                 fprintf(fp," FWD %d", si->fwdcnt);
 869
 870                 if (show_stats) {
 871                         fprintf(fp," (Sock:");
 872                         fprintf(fp," IN %d", si->inscnt);
 873                         fprintf(fp," OUT %d", si->outscnt);
 874                         fprintf(fp," FWD %d", si->fwdscnt);
 875                         fprintf(fp,")");
 876                 }
 877
 878                 fprintf(fp,"\n");
 879         }
 880         if (show_stats > 1) {
 881                 struct xfrmu_spdhinfo *sh;
 882
 883                 if (tb[XFRMA_SPD_HINFO]) {
 884                         if (RTA_PAYLOAD(tb[XFRMA_SPD_HINFO]) < sizeof(*sh)) {
 885                                 fprintf(stderr, "SPDinfo: Wrong len %d\n", len);
 886                                 return -1;
 887                         }
 888                         sh = RTA_DATA(tb[XFRMA_SPD_HINFO]);
 889                         fprintf(fp,"\t SPD buckets:");
 890                         fprintf(fp," count %d", sh->spdhcnt);
 891                         fprintf(fp," Max %d", sh->spdhmcnt);
 892                 }
 893         }
 894         fprintf(fp,"\n");
 895
 896         return 0;
 897 }
 898
 899 static int xfrm_spd_getinfo(int argc, char **argv)
 900 {
 901         struct rtnl_handle rth;
 902         struct {
 903                 struct nlmsghdr                 n;
 904                 __u32                           flags;
 905                 char                            ans[128];
 906         } req;
 907
 908         memset(&req, 0, sizeof(req));
 909
 910         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(__u32));
 911         req.n.nlmsg_flags = NLM_F_REQUEST;
 912         req.n.nlmsg_type = XFRM_MSG_GETSPDINFO;
 913         req.flags = 0XFFFFFFFF;
 914
 915         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 916                 exit(1);
 917
 918         if (rtnl_talk(&rth, &req.n, 0, 0, &req.n, NULL, NULL) < 0)
 919                 exit(2);
 920
 921         print_spdinfo(&req.n, (void*)stdout);
 922
 923         rtnl_close(&rth);
 924
 925         return 0;
 926 }
 927
 928 static int xfrm_policy_flush(int argc, char **argv)
 929 {
 930         struct rtnl_handle rth;
 931         struct {
 932                 struct nlmsghdr n;
 933                 char            buf[RTA_BUF_SIZE];
 934         } req;
 935         char *ptypep = NULL;
 936         struct xfrm_userpolicy_type upt;
 937
 938         memset(&req, 0, sizeof(req));
 939         memset(&upt, 0, sizeof(upt));
 940
 941         req.n.nlmsg_len = NLMSG_LENGTH(0); /* nlmsg data is nothing */
 942         req.n.nlmsg_flags = NLM_F_REQUEST;
 943         req.n.nlmsg_type = XFRM_MSG_FLUSHPOLICY;
 944
 945         while (argc > 0) {
 946                 if (strcmp(*argv, "ptype") == 0) {
 947                         if (ptypep)
 948                                 duparg("ptype", *argv);
 949                         ptypep = *argv;
 950
 951                         NEXT_ARG();
 952                         xfrm_policy_ptype_parse(&upt.type, &argc, &argv);
 953                 } else
 954                         invarg("unknown", *argv);
 955
 956                 argc--; argv++;
 957         }
 958
 959         if (ptypep) {
 960                 addattr_l(&req.n, sizeof(req), XFRMA_POLICY_TYPE,
 961                           (void *)&upt, sizeof(upt));
 962         }
 963
 964         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 965                 exit(1);
 966
 967         if (show_stats > 1)
 968                 fprintf(stderr, "Flush policy\n");
 969
 970         if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
 971                 exit(2);
 972
 973         rtnl_close(&rth);
 974
 975         return 0;
 976 }
 977
 978 int do_xfrm_policy(int argc, char **argv)
 979 {
 980         if (argc < 1)
 981                 return xfrm_policy_list_or_deleteall(0, NULL, 0);
 982
 983         if (matches(*argv, "add") == 0)
 984                 return xfrm_policy_modify(XFRM_MSG_NEWPOLICY, 0,
 985                                           argc-1, argv+1);
 986         if (matches(*argv, "update") == 0)
 987                 return xfrm_policy_modify(XFRM_MSG_UPDPOLICY, 0,
 988                                           argc-1, argv+1);
 989         if (matches(*argv, "delete") == 0)
 990                 return xfrm_policy_delete(argc-1, argv+1);
 991         if (matches(*argv, "deleteall") == 0 || matches(*argv, "delall") == 0)
 992                 return xfrm_policy_list_or_deleteall(argc-1, argv+1, 1);
 993         if (matches(*argv, "list") == 0 || matches(*argv, "show") == 0
 994             || matches(*argv, "lst") == 0)
 995                 return xfrm_policy_list_or_deleteall(argc-1, argv+1, 0);
 996         if (matches(*argv, "get") == 0)
 997                 return xfrm_policy_get(argc-1, argv+1);
 998         if (matches(*argv, "flush") == 0)
 999                 return xfrm_policy_flush(argc-1, argv+1);
1000         if (matches(*argv, "count") == 0)
1001                 return xfrm_spd_getinfo(argc, argv);
1002         if (matches(*argv, "help") == 0)
1003                 usage();
1004         fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm policy help\".\n", *argv);
1005         exit(-1);
1006 }