ip/xfrm_policy.c

   1 /* $USAGI: $ */
   2
   3 /*
   4  * Copyright (C)2004 USAGI/WIDE Project
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 /*
  21  * based on iproute.c
  22  */
  23 /*
  24  * Authors:
  25  *      Masahide NAKAMURA @USAGI
  26  */
  27
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <netdb.h>
  32 #include <linux/netlink.h>
  33 #include <linux/xfrm.h>
  34 #include "utils.h"
  35 #include "xfrm.h"
  36 #include "ip_common.h"
  37
  38 //#define NLMSG_DELETEALL_BUF_SIZE (4096-512)
  39 #define NLMSG_DELETEALL_BUF_SIZE 8192
  40
  41 /*
  42  * Receiving buffer defines:
  43  * nlmsg
  44  *   data = struct xfrm_userpolicy_info
  45  *   rtattr
  46  *     data = struct xfrm_user_tmpl[]
  47  */
  48 #define NLMSG_BUF_SIZE 4096
  49 #define RTA_BUF_SIZE 2048
  50 #define XFRM_TMPLS_BUF_SIZE 1024
  51 #define CTX_BUF_SIZE 256
  52
  53 static void usage(void) __attribute__((noreturn));
  54
  55 static void usage(void)
  56 {
  57         fprintf(stderr, "Usage: ip xfrm policy { add | update } dir DIR SELECTOR [ ctx SEC_CTX ][ index INDEX ] [ ptype PTYPE ]\n");
  58         fprintf(stderr, "        [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ] [ LIMIT-LIST ] [ TMPL-LIST ] [mark MARK [mask MASK]]\n");
  59         fprintf(stderr, "Usage: ip xfrm policy { delete | get } dir DIR [ SELECTOR | index INDEX ] [ ctx SEC_CTX ][ ptype PTYPE ] [mark MARK [mask MASK]]\n");
  60         fprintf(stderr, "Usage: ip xfrm policy { deleteall | list } [ dir DIR ] [ SELECTOR ]\n");
  61         fprintf(stderr, "        [ index INDEX ] [ action ACTION ] [ priority PRIORITY ]  [ flag FLAG-LIST ]\n");
  62         fprintf(stderr, "Usage: ip xfrm policy flush [ ptype PTYPE ]\n");
  63         fprintf(stderr, "Usage: ip xfrm count\n");
  64         fprintf(stderr, "PTYPE := [ main | sub ](default=main)\n");
  65         fprintf(stderr, "DIR := [ in | out | fwd ]\n");
  66
  67         fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC ] [ dev DEV ]\n");
  68
  69         fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n");
  70         fprintf(stderr, "                        [ type NUMBER ] [ code NUMBER ] |\n");
  71         fprintf(stderr, "                        [ key { DOTTED_QUAD | NUMBER } ] ]\n");
  72
  73         //fprintf(stderr, "DEV - device name(default=none)\n");
  74
  75         fprintf(stderr, "ACTION := [ allow | block ](default=allow)\n");
  76
  77         //fprintf(stderr, "PRIORITY - priority value(default=0)\n");
  78
  79         fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
  80         fprintf(stderr, "FLAG := [ localok ]\n");
  81
  82         fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] | [ limit LIMIT ]\n");
  83         fprintf(stderr, "LIMIT := [ [time-soft|time-hard|time-use-soft|time-use-hard] SECONDS ] |\n");
  84         fprintf(stderr, "         [ [byte-soft|byte-hard] SIZE ] | [ [packet-soft|packet-hard] NUMBER ]\n");
  85
  86         fprintf(stderr, "TMPL-LIST := [ TMPL-LIST ] | [ tmpl TMPL ]\n");
  87         fprintf(stderr, "TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]\n");
  88         fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM_PROTO ] [ spi SPI ]\n");
  89
  90         fprintf(stderr, "XFRM_PROTO := [ ");
  91         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
  92         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
  93         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
  94         fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
  95         fprintf(stderr, "%s ", strxf_xfrmproto(IPPROTO_DSTOPTS));
  96         fprintf(stderr, "]\n");
  97
  98         fprintf(stderr, "MODE := [ transport | tunnel | beet ](default=transport)\n");
  99         //fprintf(stderr, "REQID - number(default=0)\n");
 100         fprintf(stderr, "LEVEL := [ required | use ](default=required)\n");
 101
 102         exit(-1);
 103 }
 104
 105 static int xfrm_policy_dir_parse(__u8 *dir, int *argcp, char ***argvp)
 106 {
 107         int argc = *argcp;
 108         char **argv = *argvp;
 109
 110         if (strcmp(*argv, "in") == 0)
 111                 *dir = XFRM_POLICY_IN;
 112         else if (strcmp(*argv, "out") == 0)
 113                 *dir = XFRM_POLICY_OUT;
 114         else if (strcmp(*argv, "fwd") == 0)
 115                 *dir = XFRM_POLICY_FWD;
 116         else
 117                 invarg("\"DIR\" is invalid", *argv);
 118
 119         *argcp = argc;
 120         *argvp = argv;
 121
 122         return 0;
 123 }
 124
 125 static int xfrm_policy_ptype_parse(__u8 *ptype, int *argcp, char ***argvp)
 126 {
 127         int argc = *argcp;
 128         char **argv = *argvp;
 129
 130         if (strcmp(*argv, "main") == 0)
 131                 *ptype = XFRM_POLICY_TYPE_MAIN;
 132         else if (strcmp(*argv, "sub") == 0)
 133                 *ptype = XFRM_POLICY_TYPE_SUB;
 134         else
 135                 invarg("\"PTYPE\" is invalid", *argv);
 136
 137         *argcp = argc;
 138         *argvp = argv;
 139
 140         return 0;
 141 }
 142
 143 static int xfrm_policy_flag_parse(__u8 *flags, int *argcp, char ***argvp)
 144 {
 145         int argc = *argcp;
 146         char **argv = *argvp;
 147         int len = strlen(*argv);
 148
 149         if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
 150                 __u8 val = 0;
 151
 152                 if (get_u8(&val, *argv, 16))
 153                         invarg("\"FLAG\" is invalid", *argv);
 154                 *flags = val;
 155         } else {
 156                 while (1) {
 157                         if (strcmp(*argv, "localok") == 0)
 158                                 *flags |= XFRM_POLICY_LOCALOK;
 159                         else {
 160                                 PREV_ARG(); /* back track */
 161                                 break;
 162                         }
 163
 164                         if (!NEXT_ARG_OK())
 165                                 break;
 166                         NEXT_ARG();
 167                 }
 168         }
 169
 170         *argcp = argc;
 171         *argvp = argv;
 172
 173         return 0;
 174 }
 175
 176 static int xfrm_tmpl_parse(struct xfrm_user_tmpl *tmpl,
 177                            int *argcp, char ***argvp)
 178 {
 179         int argc = *argcp;
 180         char **argv = *argvp;
 181         char *idp = NULL;
 182
 183         while (1) {
 184                 if (strcmp(*argv, "mode") == 0) {
 185                         NEXT_ARG();
 186                         xfrm_mode_parse(&tmpl->mode,  &argc, &argv);
 187                 } else if (strcmp(*argv, "reqid") == 0) {
 188                         NEXT_ARG();
 189                         xfrm_reqid_parse(&tmpl->reqid, &argc, &argv);
 190                 } else if (strcmp(*argv, "level") == 0) {
 191                         NEXT_ARG();
 192
 193                         if (strcmp(*argv, "required") == 0)
 194                                 tmpl->optional = 0;
 195                         else if (strcmp(*argv, "use") == 0)
 196                                 tmpl->optional = 1;
 197                         else
 198                                 invarg("\"LEVEL\" is invalid\n", *argv);
 199
 200                 } else {
 201                         if (idp) {
 202                                 PREV_ARG(); /* back track */
 203                                 break;
 204                         }
 205                         idp = *argv;
 206                         preferred_family = AF_UNSPEC;
 207                         xfrm_id_parse(&tmpl->saddr, &tmpl->id, &tmpl->family,
 208                                       0, &argc, &argv);
 209                         preferred_family = tmpl->family;
 210                 }
 211
 212                 if (!NEXT_ARG_OK())
 213                         break;
 214
 215                 NEXT_ARG();
 216         }
 217         if (argc == *argcp)
 218                 missarg("TMPL");
 219
 220         *argcp = argc;
 221         *argvp = argv;
 222
 223         return 0;
 224 }
 225
 226 int xfrm_sctx_parse(char *ctxstr, char *s,
 227                            struct xfrm_user_sec_ctx *sctx)
 228 {
 229         int slen;
 230
 231         slen = strlen(s) + 1;
 232
 233         sctx->exttype = XFRMA_SEC_CTX;
 234         sctx->ctx_doi = 1;
 235         sctx->ctx_alg = 1;
 236         sctx->ctx_len = slen;
 237         sctx->len = sizeof(struct xfrm_user_sec_ctx) + slen;
 238         memcpy(ctxstr, s, slen);
 239
 240         return 0;
 241 }
 242
 243 static int xfrm_policy_modify(int cmd, unsigned flags, int argc, char **argv)
 244 {
 245         struct rtnl_handle rth;
 246         struct {
 247                 struct nlmsghdr                 n;
 248                 struct xfrm_userpolicy_info     xpinfo;
 249                 char                            buf[RTA_BUF_SIZE];
 250         } req;
 251         char *dirp = NULL;
 252         char *selp = NULL;
 253         char *ptypep = NULL;
 254         char *sctxp = NULL;
 255         struct xfrm_userpolicy_type upt;
 256         char tmpls_buf[XFRM_TMPLS_BUF_SIZE];
 257         int tmpls_len = 0;
 258         struct xfrm_mark mark = {0, 0};
 259         struct {
 260                 struct xfrm_user_sec_ctx sctx;
 261                 char    str[CTX_BUF_SIZE];
 262         } ctx;
 263
 264         memset(&req, 0, sizeof(req));
 265         memset(&upt, 0, sizeof(upt));
 266         memset(&tmpls_buf, 0, sizeof(tmpls_buf));
 267         memset(&ctx, 0, sizeof(ctx));
 268
 269         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xpinfo));
 270         req.n.nlmsg_flags = NLM_F_REQUEST|flags;
 271         req.n.nlmsg_type = cmd;
 272         req.xpinfo.sel.family = preferred_family;
 273
 274         req.xpinfo.lft.soft_byte_limit = XFRM_INF;
 275         req.xpinfo.lft.hard_byte_limit = XFRM_INF;
 276         req.xpinfo.lft.soft_packet_limit = XFRM_INF;
 277         req.xpinfo.lft.hard_packet_limit = XFRM_INF;
 278
 279         while (argc > 0) {
 280                 if (strcmp(*argv, "dir") == 0) {
 281                         if (dirp)
 282                                 duparg("dir", *argv);
 283                         dirp = *argv;
 284
 285                         NEXT_ARG();
 286                         xfrm_policy_dir_parse(&req.xpinfo.dir, &argc, &argv);
 287                 } else if (strcmp(*argv, "ctx") == 0) {
 288                         char *context;
 289
 290                         if (sctxp)
 291                                 duparg("ctx", *argv);
 292                         sctxp = *argv;
 293                         NEXT_ARG();
 294                         context = *argv;
 295                         xfrm_sctx_parse((char *)&ctx.str, context, &ctx.sctx);
 296                 } else if (strcmp(*argv, "mark") == 0) {
 297                         xfrm_parse_mark(&mark, &argc, &argv);
 298                 } else if (strcmp(*argv, "index") == 0) {
 299                         NEXT_ARG();
 300                         if (get_u32(&req.xpinfo.index, *argv, 0))
 301                                 invarg("\"INDEX\" is invalid", *argv);
 302                 } else if (strcmp(*argv, "ptype") == 0) {
 303                         if (ptypep)
 304                                 duparg("ptype", *argv);
 305                         ptypep = *argv;
 306
 307                         NEXT_ARG();
 308                         xfrm_policy_ptype_parse(&upt.type, &argc, &argv);
 309                 } else if (strcmp(*argv, "action") == 0) {
 310                         NEXT_ARG();
 311                         if (strcmp(*argv, "allow") == 0)
 312                                 req.xpinfo.action = XFRM_POLICY_ALLOW;
 313                         else if (strcmp(*argv, "block") == 0)
 314                                 req.xpinfo.action = XFRM_POLICY_BLOCK;
 315                         else
 316                                 invarg("\"action\" value is invalid\n", *argv);
 317                 } else if (strcmp(*argv, "priority") == 0) {
 318                         NEXT_ARG();
 319                         if (get_u32(&req.xpinfo.priority, *argv, 0))
 320                                 invarg("\"PRIORITY\" is invalid", *argv);
 321                 } else if (strcmp(*argv, "flag") == 0) {
 322                         NEXT_ARG();
 323                         xfrm_policy_flag_parse(&req.xpinfo.flags, &argc,
 324                                                &argv);
 325                 } else if (strcmp(*argv, "limit") == 0) {
 326                         NEXT_ARG();
 327                         xfrm_lifetime_cfg_parse(&req.xpinfo.lft, &argc, &argv);
 328                 } else if (strcmp(*argv, "tmpl") == 0) {
 329                         struct xfrm_user_tmpl *tmpl;
 330
 331                         if (tmpls_len + sizeof(*tmpl) > sizeof(tmpls_buf)) {
 332                                 fprintf(stderr, "Too many tmpls: buffer overflow\n");
 333                                 exit(1);
 334                         }
 335                         tmpl = (struct xfrm_user_tmpl *)((char *)tmpls_buf + tmpls_len);
 336
 337                         tmpl->family = preferred_family;
 338                         tmpl->aalgos = (~(__u32)0);
 339                         tmpl->ealgos = (~(__u32)0);
 340                         tmpl->calgos = (~(__u32)0);
 341
 342                         NEXT_ARG();
 343                         xfrm_tmpl_parse(tmpl, &argc, &argv);
 344
 345                         tmpls_len += sizeof(*tmpl);
 346                 } else {
 347                         if (selp)
 348                                 duparg("unknown", *argv);
 349                         selp = *argv;
 350
 351                         xfrm_selector_parse(&req.xpinfo.sel, &argc, &argv);
 352                         if (preferred_family == AF_UNSPEC)
 353                                 preferred_family = req.xpinfo.sel.family;
 354                 }
 355
 356                 argc--; argv++;
 357         }
 358
 359         if (!dirp) {
 360                 fprintf(stderr, "Not enough information: \"DIR\" is required.\n");
 361                 exit(1);
 362         }
 363
 364         if (ptypep) {
 365                 addattr_l(&req.n, sizeof(req), XFRMA_POLICY_TYPE,
 366                           (void *)&upt, sizeof(upt));
 367         }
 368
 369         if (tmpls_len > 0) {
 370                 addattr_l(&req.n, sizeof(req), XFRMA_TMPL,
 371                           (void *)tmpls_buf, tmpls_len);
 372         }
 373
 374         if (mark.m & mark.v) {
 375                 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
 376                                   (void *)&mark, sizeof(mark));
 377                 if (r < 0) {
 378                         fprintf(stderr, "%s: XFRMA_MARK failed\n",__func__);
 379                         exit(1);
 380                 }
 381         }
 382
 383         if (sctxp) {
 384                 addattr_l(&req.n, sizeof(req), XFRMA_SEC_CTX,
 385                           (void *)&ctx, ctx.sctx.len);
 386         }
 387
 388         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 389                 exit(1);
 390
 391         if (req.xpinfo.sel.family == AF_UNSPEC)
 392                 req.xpinfo.sel.family = AF_INET;
 393
 394         if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
 395                 exit(2);
 396
 397         rtnl_close(&rth);
 398
 399         return 0;
 400 }
 401
 402 static int xfrm_policy_filter_match(struct xfrm_userpolicy_info *xpinfo,
 403                                     __u8 ptype)
 404 {
 405         if (!filter.use)
 406                 return 1;
 407
 408         if ((xpinfo->dir^filter.xpinfo.dir)&filter.dir_mask)
 409                 return 0;
 410
 411         if ((ptype^filter.ptype)&filter.ptype_mask)
 412                 return 0;
 413
 414         if (filter.sel_src_mask) {
 415                 if (xfrm_addr_match(&xpinfo->sel.saddr, &filter.xpinfo.sel.saddr,
 416                                     filter.sel_src_mask))
 417                         return 0;
 418         }
 419
 420         if (filter.sel_dst_mask) {
 421                 if (xfrm_addr_match(&xpinfo->sel.daddr, &filter.xpinfo.sel.daddr,
 422                                     filter.sel_dst_mask))
 423                         return 0;
 424         }
 425
 426         if ((xpinfo->sel.ifindex^filter.xpinfo.sel.ifindex)&filter.sel_dev_mask)
 427                 return 0;
 428
 429         if ((xpinfo->sel.proto^filter.xpinfo.sel.proto)&filter.upspec_proto_mask)
 430                 return 0;
 431
 432         if (filter.upspec_sport_mask) {
 433                 if ((xpinfo->sel.sport^filter.xpinfo.sel.sport)&filter.upspec_sport_mask)
 434                         return 0;
 435         }
 436
 437         if (filter.upspec_dport_mask) {
 438                 if ((xpinfo->sel.dport^filter.xpinfo.sel.dport)&filter.upspec_dport_mask)
 439                         return 0;
 440         }
 441
 442         if ((xpinfo->index^filter.xpinfo.index)&filter.index_mask)
 443                 return 0;
 444
 445         if ((xpinfo->action^filter.xpinfo.action)&filter.action_mask)
 446                 return 0;
 447
 448         if ((xpinfo->priority^filter.xpinfo.priority)&filter.priority_mask)
 449                 return 0;
 450
 451         if (filter.policy_flags_mask)
 452                 if ((xpinfo->flags & filter.xpinfo.flags) == 0)
 453                         return 0;
 454
 455         return 1;
 456 }
 457
 458 int xfrm_policy_print(const struct sockaddr_nl *who, struct nlmsghdr *n,
 459                       void *arg)
 460 {
 461         struct rtattr * tb[XFRMA_MAX+1];
 462         struct rtattr * rta;
 463         struct xfrm_userpolicy_info *xpinfo = NULL;
 464         struct xfrm_user_polexpire *xpexp = NULL;
 465         struct xfrm_userpolicy_id *xpid = NULL;
 466         __u8 ptype = XFRM_POLICY_TYPE_MAIN;
 467         FILE *fp = (FILE*)arg;
 468         int len = n->nlmsg_len;
 469
 470         if (n->nlmsg_type != XFRM_MSG_NEWPOLICY &&
 471             n->nlmsg_type != XFRM_MSG_DELPOLICY &&
 472             n->nlmsg_type != XFRM_MSG_UPDPOLICY &&
 473             n->nlmsg_type != XFRM_MSG_POLEXPIRE) {
 474                 fprintf(stderr, "Not a policy: %08x %08x %08x\n",
 475                         n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
 476                 return 0;
 477         }
 478
 479         if (n->nlmsg_type == XFRM_MSG_DELPOLICY)  {
 480                 xpid = NLMSG_DATA(n);
 481                 len -= NLMSG_SPACE(sizeof(*xpid));
 482         } else if (n->nlmsg_type == XFRM_MSG_POLEXPIRE) {
 483                 xpexp = NLMSG_DATA(n);
 484                 xpinfo = &xpexp->pol;
 485                 len -= NLMSG_SPACE(sizeof(*xpexp));
 486         } else {
 487                 xpexp = NULL;
 488                 xpinfo = NLMSG_DATA(n);
 489                 len -= NLMSG_SPACE(sizeof(*xpinfo));
 490         }
 491
 492         if (len < 0) {
 493                 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
 494                 return -1;
 495         }
 496
 497         if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
 498                 rta = XFRMPID_RTA(xpid);
 499         else if (n->nlmsg_type == XFRM_MSG_POLEXPIRE)
 500                 rta = XFRMPEXP_RTA(xpexp);
 501         else
 502                 rta = XFRMP_RTA(xpinfo);
 503
 504         parse_rtattr(tb, XFRMA_MAX, rta, len);
 505
 506         if (tb[XFRMA_POLICY_TYPE]) {
 507                 struct xfrm_userpolicy_type *upt;
 508
 509                 if (RTA_PAYLOAD(tb[XFRMA_POLICY_TYPE]) < sizeof(*upt)) {
 510                         fprintf(stderr, "too short XFRMA_POLICY_TYPE len\n");
 511                         return -1;
 512                 }
 513                 upt = (struct xfrm_userpolicy_type *)RTA_DATA(tb[XFRMA_POLICY_TYPE]);
 514                 ptype = upt->type;
 515         }
 516
 517         if (xpinfo && !xfrm_policy_filter_match(xpinfo, ptype))
 518                 return 0;
 519
 520         if (n->nlmsg_type == XFRM_MSG_DELPOLICY)
 521                 fprintf(fp, "Deleted ");
 522         else if (n->nlmsg_type == XFRM_MSG_UPDPOLICY)
 523                 fprintf(fp, "Updated ");
 524         else if (n->nlmsg_type == XFRM_MSG_POLEXPIRE)
 525                 fprintf(fp, "Expired ");
 526
 527         if (n->nlmsg_type == XFRM_MSG_DELPOLICY) {
 528                 //xfrm_policy_id_print();
 529                 if (!tb[XFRMA_POLICY]) {
 530                         fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: no XFRMA_POLICY\n");
 531                         return -1;
 532                 }
 533                 if (RTA_PAYLOAD(tb[XFRMA_POLICY]) < sizeof(*xpinfo)) {
 534                         fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: too short XFRMA_POLICY len\n");
 535                         return -1;
 536                 }
 537                 xpinfo = (struct xfrm_userpolicy_info *)RTA_DATA(tb[XFRMA_POLICY]);
 538         }
 539
 540         xfrm_policy_info_print(xpinfo, tb, fp, NULL, NULL);
 541
 542         if (n->nlmsg_type == XFRM_MSG_POLEXPIRE) {
 543                 fprintf(fp, "\t");
 544                 fprintf(fp, "hard %u", xpexp->hard);
 545                 fprintf(fp, "%s", _SL_);
 546         }
 547
 548         if (oneline)
 549                 fprintf(fp, "\n");
 550         fflush(fp);
 551
 552         return 0;
 553 }
 554
 555 static int xfrm_policy_get_or_delete(int argc, char **argv, int delete,
 556                                      void *res_nlbuf)
 557 {
 558         struct rtnl_handle rth;
 559         struct {
 560                 struct nlmsghdr                 n;
 561                 struct xfrm_userpolicy_id       xpid;
 562                 char                            buf[RTA_BUF_SIZE];
 563         } req;
 564         char *dirp = NULL;
 565         char *selp = NULL;
 566         char *indexp = NULL;
 567         char *ptypep = NULL;
 568         char *sctxp = NULL;
 569         struct xfrm_userpolicy_type upt;
 570         struct xfrm_mark mark = {0, 0};
 571         struct {
 572                 struct xfrm_user_sec_ctx sctx;
 573                 char    str[CTX_BUF_SIZE];
 574         } ctx;
 575
 576
 577         memset(&req, 0, sizeof(req));
 578         memset(&upt, 0, sizeof(upt));
 579         memset(&ctx, 0, sizeof(ctx));
 580
 581         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xpid));
 582         req.n.nlmsg_flags = NLM_F_REQUEST;
 583         req.n.nlmsg_type = delete ? XFRM_MSG_DELPOLICY : XFRM_MSG_GETPOLICY;
 584
 585         while (argc > 0) {
 586                 if (strcmp(*argv, "dir") == 0) {
 587                         if (dirp)
 588                                 duparg("dir", *argv);
 589                         dirp = *argv;
 590
 591                         NEXT_ARG();
 592                         xfrm_policy_dir_parse(&req.xpid.dir, &argc, &argv);
 593
 594                 } else if (strcmp(*argv, "ctx") == 0) {
 595                         char *context;
 596
 597                         if (sctxp)
 598                                 duparg("ctx", *argv);
 599                         sctxp = *argv;
 600                         NEXT_ARG();
 601                         context = *argv;
 602                         xfrm_sctx_parse((char *)&ctx.str, context, &ctx.sctx);
 603                 } else if (strcmp(*argv, "mark") == 0) {
 604                         xfrm_parse_mark(&mark, &argc, &argv);
 605                 } else if (strcmp(*argv, "index") == 0) {
 606                         if (indexp)
 607                                 duparg("index", *argv);
 608                         indexp = *argv;
 609
 610                         NEXT_ARG();
 611                         if (get_u32(&req.xpid.index, *argv, 0))
 612                                 invarg("\"INDEX\" is invalid", *argv);
 613
 614                 } else if (strcmp(*argv, "ptype") == 0) {
 615                         if (ptypep)
 616                                 duparg("ptype", *argv);
 617                         ptypep = *argv;
 618
 619                         NEXT_ARG();
 620                         xfrm_policy_ptype_parse(&upt.type, &argc, &argv);
 621
 622                 } else {
 623                         if (selp)
 624                                 invarg("unknown", *argv);
 625                         selp = *argv;
 626
 627                         xfrm_selector_parse(&req.xpid.sel, &argc, &argv);
 628                         if (preferred_family == AF_UNSPEC)
 629                                 preferred_family = req.xpid.sel.family;
 630
 631                 }
 632
 633                 argc--; argv++;
 634         }
 635
 636         if (!dirp) {
 637                 fprintf(stderr, "Not enough information: \"DIR\" is required.\n");
 638                 exit(1);
 639         }
 640         if (ptypep) {
 641                 addattr_l(&req.n, sizeof(req), XFRMA_POLICY_TYPE,
 642                           (void *)&upt, sizeof(upt));
 643         }
 644         if (!selp && !indexp) {
 645                 fprintf(stderr, "Not enough information: either \"SELECTOR\" or \"INDEX\" is required.\n");
 646                 exit(1);
 647         }
 648         if (selp && indexp)
 649                 duparg2("SELECTOR", "INDEX");
 650
 651         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 652                 exit(1);
 653
 654         if (req.xpid.sel.family == AF_UNSPEC)
 655                 req.xpid.sel.family = AF_INET;
 656
 657         if (mark.m & mark.v) {
 658                 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
 659                                   (void *)&mark, sizeof(mark));
 660                 if (r < 0) {
 661                         fprintf(stderr, "%s: XFRMA_MARK failed\n",__func__);
 662                         exit(1);
 663                 }
 664         }
 665
 666         if (sctxp) {
 667                 addattr_l(&req.n, sizeof(req), XFRMA_SEC_CTX,
 668                           (void *)&ctx, ctx.sctx.len);
 669         }
 670
 671         if (rtnl_talk(&rth, &req.n, 0, 0, res_nlbuf, NULL, NULL) < 0)
 672                 exit(2);
 673
 674         rtnl_close(&rth);
 675
 676         return 0;
 677 }
 678
 679 static int xfrm_policy_delete(int argc, char **argv)
 680 {
 681         return xfrm_policy_get_or_delete(argc, argv, 1, NULL);
 682 }
 683
 684 static int xfrm_policy_get(int argc, char **argv)
 685 {
 686         char buf[NLMSG_BUF_SIZE];
 687         struct nlmsghdr *n = (struct nlmsghdr *)buf;
 688
 689         memset(buf, 0, sizeof(buf));
 690
 691         xfrm_policy_get_or_delete(argc, argv, 0, n);
 692
 693         if (xfrm_policy_print(NULL, n, (void*)stdout) < 0) {
 694                 fprintf(stderr, "An error :-)\n");
 695                 exit(1);
 696         }
 697
 698         return 0;
 699 }
 700
 701 /*
 702  * With an existing policy of nlmsg, make new nlmsg for deleting the policy
 703  * and store it to buffer.
 704  */
 705 static int xfrm_policy_keep(const struct sockaddr_nl *who,
 706                             struct nlmsghdr *n,
 707                             void *arg)
 708 {
 709         struct xfrm_buffer *xb = (struct xfrm_buffer *)arg;
 710         struct rtnl_handle *rth = xb->rth;
 711         struct xfrm_userpolicy_info *xpinfo = NLMSG_DATA(n);
 712         int len = n->nlmsg_len;
 713         struct rtattr *tb[XFRMA_MAX+1];
 714         __u8 ptype = XFRM_POLICY_TYPE_MAIN;
 715         struct nlmsghdr *new_n;
 716         struct xfrm_userpolicy_id *xpid;
 717
 718         if (n->nlmsg_type != XFRM_MSG_NEWPOLICY) {
 719                 fprintf(stderr, "Not a policy: %08x %08x %08x\n",
 720                         n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
 721                 return 0;
 722         }
 723
 724         len -= NLMSG_LENGTH(sizeof(*xpinfo));
 725         if (len < 0) {
 726                 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
 727                 return -1;
 728         }
 729
 730         parse_rtattr(tb, XFRMA_MAX, XFRMP_RTA(xpinfo), len);
 731
 732         if (tb[XFRMA_POLICY_TYPE]) {
 733                 struct xfrm_userpolicy_type *upt;
 734
 735                 if (RTA_PAYLOAD(tb[XFRMA_POLICY_TYPE]) < sizeof(*upt)) {
 736                         fprintf(stderr, "too short XFRMA_POLICY_TYPE len\n");
 737                         return -1;
 738                 }
 739                 upt = (struct xfrm_userpolicy_type *)RTA_DATA(tb[XFRMA_POLICY_TYPE]);
 740                 ptype = upt->type;
 741         }
 742
 743         if (!xfrm_policy_filter_match(xpinfo, ptype))
 744                 return 0;
 745
 746         if (xb->offset > xb->size) {
 747                 fprintf(stderr, "Policy buffer overflow\n");
 748                 return -1;
 749         }
 750
 751         new_n = (struct nlmsghdr *)(xb->buf + xb->offset);
 752         new_n->nlmsg_len = NLMSG_LENGTH(sizeof(*xpid));
 753         new_n->nlmsg_flags = NLM_F_REQUEST;
 754         new_n->nlmsg_type = XFRM_MSG_DELPOLICY;
 755         new_n->nlmsg_seq = ++rth->seq;
 756
 757         xpid = NLMSG_DATA(new_n);
 758         memcpy(&xpid->sel, &xpinfo->sel, sizeof(xpid->sel));
 759         xpid->dir = xpinfo->dir;
 760         xpid->index = xpinfo->index;
 761
 762         xb->offset += new_n->nlmsg_len;
 763         xb->nlmsg_count ++;
 764
 765         return 0;
 766 }
 767
 768 static int xfrm_policy_list_or_deleteall(int argc, char **argv, int deleteall)
 769 {
 770         char *selp = NULL;
 771         struct rtnl_handle rth;
 772
 773         if (argc > 0)
 774                 filter.use = 1;
 775         filter.xpinfo.sel.family = preferred_family;
 776
 777         while (argc > 0) {
 778                 if (strcmp(*argv, "dir") == 0) {
 779                         NEXT_ARG();
 780                         xfrm_policy_dir_parse(&filter.xpinfo.dir, &argc, &argv);
 781
 782                         filter.dir_mask = XFRM_FILTER_MASK_FULL;
 783
 784                 } else if (strcmp(*argv, "index") == 0) {
 785                         NEXT_ARG();
 786                         if (get_u32(&filter.xpinfo.index, *argv, 0))
 787                                 invarg("\"INDEX\" is invalid", *argv);
 788
 789                         filter.index_mask = XFRM_FILTER_MASK_FULL;
 790
 791                 } else if (strcmp(*argv, "ptype") == 0) {
 792                         NEXT_ARG();
 793                         xfrm_policy_ptype_parse(&filter.ptype, &argc, &argv);
 794
 795                         filter.ptype_mask = XFRM_FILTER_MASK_FULL;
 796
 797                 } else if (strcmp(*argv, "action") == 0) {
 798                         NEXT_ARG();
 799                         if (strcmp(*argv, "allow") == 0)
 800                                 filter.xpinfo.action = XFRM_POLICY_ALLOW;
 801                         else if (strcmp(*argv, "block") == 0)
 802                                 filter.xpinfo.action = XFRM_POLICY_BLOCK;
 803                         else
 804                                 invarg("\"ACTION\" is invalid\n", *argv);
 805
 806                         filter.action_mask = XFRM_FILTER_MASK_FULL;
 807
 808                 } else if (strcmp(*argv, "priority") == 0) {
 809                         NEXT_ARG();
 810                         if (get_u32(&filter.xpinfo.priority, *argv, 0))
 811                                 invarg("\"PRIORITY\" is invalid", *argv);
 812
 813                         filter.priority_mask = XFRM_FILTER_MASK_FULL;
 814
 815                 } else if (strcmp(*argv, "flag") == 0) {
 816                         NEXT_ARG();
 817                         xfrm_policy_flag_parse(&filter.xpinfo.flags, &argc,
 818                                                &argv);
 819
 820                         filter.policy_flags_mask = XFRM_FILTER_MASK_FULL;
 821
 822                 } else {
 823                         if (selp)
 824                                 invarg("unknown", *argv);
 825                         selp = *argv;
 826
 827                         xfrm_selector_parse(&filter.xpinfo.sel, &argc, &argv);
 828                         if (preferred_family == AF_UNSPEC)
 829                                 preferred_family = filter.xpinfo.sel.family;
 830
 831                 }
 832
 833                 argc--; argv++;
 834         }
 835
 836         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 837                 exit(1);
 838
 839         if (deleteall) {
 840                 struct xfrm_buffer xb;
 841                 char buf[NLMSG_DELETEALL_BUF_SIZE];
 842                 int i;
 843
 844                 xb.buf = buf;
 845                 xb.size = sizeof(buf);
 846                 xb.rth = &rth;
 847
 848                 for (i = 0; ; i++) {
 849                         xb.offset = 0;
 850                         xb.nlmsg_count = 0;
 851
 852                         if (show_stats > 1)
 853                                 fprintf(stderr, "Delete-all round = %d\n", i);
 854
 855                         if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETPOLICY) < 0) {
 856                                 perror("Cannot send dump request");
 857                                 exit(1);
 858                         }
 859
 860                         if (rtnl_dump_filter(&rth, xfrm_policy_keep, &xb, NULL, NULL) < 0) {
 861                                 fprintf(stderr, "Delete-all terminated\n");
 862                                 exit(1);
 863                         }
 864                         if (xb.nlmsg_count == 0) {
 865                                 if (show_stats > 1)
 866                                         fprintf(stderr, "Delete-all completed\n");
 867                                 break;
 868                         }
 869
 870                         if (rtnl_send_check(&rth, xb.buf, xb.offset) < 0) {
 871                                 perror("Failed to send delete-all request");
 872                                 exit(1);
 873                         }
 874                         if (show_stats > 1)
 875                                 fprintf(stderr, "Delete-all nlmsg count = %d\n", xb.nlmsg_count);
 876
 877                         xb.offset = 0;
 878                         xb.nlmsg_count = 0;
 879                 }
 880         } else {
 881                 if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETPOLICY) < 0) {
 882                         perror("Cannot send dump request");
 883                         exit(1);
 884                 }
 885
 886                 if (rtnl_dump_filter(&rth, xfrm_policy_print, stdout, NULL, NULL) < 0) {
 887                         fprintf(stderr, "Dump terminated\n");
 888                         exit(1);
 889                 }
 890         }
 891
 892         rtnl_close(&rth);
 893
 894         exit(0);
 895 }
 896
 897 int print_spdinfo( struct nlmsghdr *n, void *arg)
 898 {
 899         FILE *fp = (FILE*)arg;
 900         __u32 *f = NLMSG_DATA(n);
 901         struct rtattr * tb[XFRMA_SPD_MAX+1];
 902         struct rtattr * rta;
 903
 904         int len = n->nlmsg_len;
 905
 906         len -= NLMSG_LENGTH(sizeof(__u32));
 907         if (len < 0) {
 908                 fprintf(stderr, "SPDinfo: Wrong len %d\n", len);
 909                 return -1;
 910         }
 911
 912         rta = XFRMSAPD_RTA(f);
 913         parse_rtattr(tb, XFRMA_SPD_MAX, rta, len);
 914
 915         fprintf(fp,"\t SPD");
 916         if (tb[XFRMA_SPD_INFO]) {
 917                 struct xfrmu_spdinfo *si;
 918
 919                 if (RTA_PAYLOAD(tb[XFRMA_SPD_INFO]) < sizeof(*si)) {
 920                         fprintf(stderr, "SPDinfo: Wrong len %d\n", len);
 921                         return -1;
 922                 }
 923                 si = RTA_DATA(tb[XFRMA_SPD_INFO]);
 924                 fprintf(fp," IN  %d", si->incnt);
 925                 fprintf(fp," OUT %d", si->outcnt);
 926                 fprintf(fp," FWD %d", si->fwdcnt);
 927
 928                 if (show_stats) {
 929                         fprintf(fp," (Sock:");
 930                         fprintf(fp," IN %d", si->inscnt);
 931                         fprintf(fp," OUT %d", si->outscnt);
 932                         fprintf(fp," FWD %d", si->fwdscnt);
 933                         fprintf(fp,")");
 934                 }
 935
 936                 fprintf(fp,"\n");
 937         }
 938         if (show_stats > 1) {
 939                 struct xfrmu_spdhinfo *sh;
 940
 941                 if (tb[XFRMA_SPD_HINFO]) {
 942                         if (RTA_PAYLOAD(tb[XFRMA_SPD_HINFO]) < sizeof(*sh)) {
 943                                 fprintf(stderr, "SPDinfo: Wrong len %d\n", len);
 944                                 return -1;
 945                         }
 946                         sh = RTA_DATA(tb[XFRMA_SPD_HINFO]);
 947                         fprintf(fp,"\t SPD buckets:");
 948                         fprintf(fp," count %d", sh->spdhcnt);
 949                         fprintf(fp," Max %d", sh->spdhmcnt);
 950                 }
 951         }
 952         fprintf(fp,"\n");
 953
 954         return 0;
 955 }
 956
 957 static int xfrm_spd_getinfo(int argc, char **argv)
 958 {
 959         struct rtnl_handle rth;
 960         struct {
 961                 struct nlmsghdr                 n;
 962                 __u32                           flags;
 963                 char                            ans[128];
 964         } req;
 965
 966         memset(&req, 0, sizeof(req));
 967
 968         req.n.nlmsg_len = NLMSG_LENGTH(sizeof(__u32));
 969         req.n.nlmsg_flags = NLM_F_REQUEST;
 970         req.n.nlmsg_type = XFRM_MSG_GETSPDINFO;
 971         req.flags = 0XFFFFFFFF;
 972
 973         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 974                 exit(1);
 975
 976         if (rtnl_talk(&rth, &req.n, 0, 0, &req.n, NULL, NULL) < 0)
 977                 exit(2);
 978
 979         print_spdinfo(&req.n, (void*)stdout);
 980
 981         rtnl_close(&rth);
 982
 983         return 0;
 984 }
 985
 986 static int xfrm_policy_flush(int argc, char **argv)
 987 {
 988         struct rtnl_handle rth;
 989         struct {
 990                 struct nlmsghdr n;
 991                 char            buf[RTA_BUF_SIZE];
 992         } req;
 993         char *ptypep = NULL;
 994         struct xfrm_userpolicy_type upt;
 995
 996         memset(&req, 0, sizeof(req));
 997         memset(&upt, 0, sizeof(upt));
 998
 999         req.n.nlmsg_len = NLMSG_LENGTH(0); /* nlmsg data is nothing */
1000         req.n.nlmsg_flags = NLM_F_REQUEST;
1001         req.n.nlmsg_type = XFRM_MSG_FLUSHPOLICY;
1002
1003         while (argc > 0) {
1004                 if (strcmp(*argv, "ptype") == 0) {
1005                         if (ptypep)
1006                                 duparg("ptype", *argv);
1007                         ptypep = *argv;
1008
1009                         NEXT_ARG();
1010                         xfrm_policy_ptype_parse(&upt.type, &argc, &argv);
1011                 } else
1012                         invarg("unknown", *argv);
1013
1014                 argc--; argv++;
1015         }
1016
1017         if (ptypep) {
1018                 addattr_l(&req.n, sizeof(req), XFRMA_POLICY_TYPE,
1019                           (void *)&upt, sizeof(upt));
1020         }
1021
1022         if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1023                 exit(1);
1024
1025         if (show_stats > 1)
1026                 fprintf(stderr, "Flush policy\n");
1027
1028         if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
1029                 exit(2);
1030
1031         rtnl_close(&rth);
1032
1033         return 0;
1034 }
1035
1036 int do_xfrm_policy(int argc, char **argv)
1037 {
1038         if (argc < 1)
1039                 return xfrm_policy_list_or_deleteall(0, NULL, 0);
1040
1041         if (matches(*argv, "add") == 0)
1042                 return xfrm_policy_modify(XFRM_MSG_NEWPOLICY, 0,
1043                                           argc-1, argv+1);
1044         if (matches(*argv, "update") == 0)
1045                 return xfrm_policy_modify(XFRM_MSG_UPDPOLICY, 0,
1046                                           argc-1, argv+1);
1047         if (matches(*argv, "delete") == 0)
1048                 return xfrm_policy_delete(argc-1, argv+1);
1049         if (matches(*argv, "deleteall") == 0 || matches(*argv, "delall") == 0)
1050                 return xfrm_policy_list_or_deleteall(argc-1, argv+1, 1);
1051         if (matches(*argv, "list") == 0 || matches(*argv, "show") == 0
1052             || matches(*argv, "lst") == 0)
1053                 return xfrm_policy_list_or_deleteall(argc-1, argv+1, 0);
1054         if (matches(*argv, "get") == 0)
1055                 return xfrm_policy_get(argc-1, argv+1);
1056         if (matches(*argv, "flush") == 0)
1057                 return xfrm_policy_flush(argc-1, argv+1);
1058         if (matches(*argv, "count") == 0)
1059                 return xfrm_spd_getinfo(argc, argv);
1060         if (matches(*argv, "help") == 0)
1061                 usage();
1062         fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm policy help\".\n", *argv);
1063         exit(-1);
1064 }