xfrm_state_linux.go 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448
  1. package netlink
  2. import (
  3. "fmt"
  4. "unsafe"
  5. "github.com/vishvananda/netlink/nl"
  6. "golang.org/x/sys/unix"
  7. )
  8. func writeStateAlgo(a *XfrmStateAlgo) []byte {
  9. algo := nl.XfrmAlgo{
  10. AlgKeyLen: uint32(len(a.Key) * 8),
  11. AlgKey: a.Key,
  12. }
  13. end := len(a.Name)
  14. if end > 64 {
  15. end = 64
  16. }
  17. copy(algo.AlgName[:end], a.Name)
  18. return algo.Serialize()
  19. }
  20. func writeStateAlgoAuth(a *XfrmStateAlgo) []byte {
  21. algo := nl.XfrmAlgoAuth{
  22. AlgKeyLen: uint32(len(a.Key) * 8),
  23. AlgTruncLen: uint32(a.TruncateLen),
  24. AlgKey: a.Key,
  25. }
  26. end := len(a.Name)
  27. if end > 64 {
  28. end = 64
  29. }
  30. copy(algo.AlgName[:end], a.Name)
  31. return algo.Serialize()
  32. }
  33. func writeStateAlgoAead(a *XfrmStateAlgo) []byte {
  34. algo := nl.XfrmAlgoAEAD{
  35. AlgKeyLen: uint32(len(a.Key) * 8),
  36. AlgICVLen: uint32(a.ICVLen),
  37. AlgKey: a.Key,
  38. }
  39. end := len(a.Name)
  40. if end > 64 {
  41. end = 64
  42. }
  43. copy(algo.AlgName[:end], a.Name)
  44. return algo.Serialize()
  45. }
  46. func writeMark(m *XfrmMark) []byte {
  47. mark := &nl.XfrmMark{
  48. Value: m.Value,
  49. Mask: m.Mask,
  50. }
  51. if mark.Mask == 0 {
  52. mark.Mask = ^uint32(0)
  53. }
  54. return mark.Serialize()
  55. }
  56. func writeReplayEsn(replayWindow int) []byte {
  57. replayEsn := &nl.XfrmReplayStateEsn{
  58. OSeq: 0,
  59. Seq: 0,
  60. OSeqHi: 0,
  61. SeqHi: 0,
  62. ReplayWindow: uint32(replayWindow),
  63. }
  64. // Linux stores the bitmap to identify the already received sequence packets in blocks of uint32 elements.
  65. // Therefore bitmap length is the minimum number of uint32 elements needed. The following is a ceiling operation.
  66. bytesPerElem := int(unsafe.Sizeof(replayEsn.BmpLen)) // Any uint32 variable is good for this
  67. replayEsn.BmpLen = uint32((replayWindow + (bytesPerElem * 8) - 1) / (bytesPerElem * 8))
  68. return replayEsn.Serialize()
  69. }
  70. // XfrmStateAdd will add an xfrm state to the system.
  71. // Equivalent to: `ip xfrm state add $state`
  72. func XfrmStateAdd(state *XfrmState) error {
  73. return pkgHandle.XfrmStateAdd(state)
  74. }
  75. // XfrmStateAdd will add an xfrm state to the system.
  76. // Equivalent to: `ip xfrm state add $state`
  77. func (h *Handle) XfrmStateAdd(state *XfrmState) error {
  78. return h.xfrmStateAddOrUpdate(state, nl.XFRM_MSG_NEWSA)
  79. }
  80. // XfrmStateAllocSpi will allocate an xfrm state in the system.
  81. // Equivalent to: `ip xfrm state allocspi`
  82. func XfrmStateAllocSpi(state *XfrmState) (*XfrmState, error) {
  83. return pkgHandle.xfrmStateAllocSpi(state)
  84. }
  85. // XfrmStateUpdate will update an xfrm state to the system.
  86. // Equivalent to: `ip xfrm state update $state`
  87. func XfrmStateUpdate(state *XfrmState) error {
  88. return pkgHandle.XfrmStateUpdate(state)
  89. }
  90. // XfrmStateUpdate will update an xfrm state to the system.
  91. // Equivalent to: `ip xfrm state update $state`
  92. func (h *Handle) XfrmStateUpdate(state *XfrmState) error {
  93. return h.xfrmStateAddOrUpdate(state, nl.XFRM_MSG_UPDSA)
  94. }
  95. func (h *Handle) xfrmStateAddOrUpdate(state *XfrmState, nlProto int) error {
  96. // A state with spi 0 can't be deleted so don't allow it to be set
  97. if state.Spi == 0 {
  98. return fmt.Errorf("Spi must be set when adding xfrm state.")
  99. }
  100. req := h.newNetlinkRequest(nlProto, unix.NLM_F_CREATE|unix.NLM_F_EXCL|unix.NLM_F_ACK)
  101. msg := xfrmUsersaInfoFromXfrmState(state)
  102. if state.ESN {
  103. if state.ReplayWindow == 0 {
  104. return fmt.Errorf("ESN flag set without ReplayWindow")
  105. }
  106. msg.Flags |= nl.XFRM_STATE_ESN
  107. msg.ReplayWindow = 0
  108. }
  109. limitsToLft(state.Limits, &msg.Lft)
  110. req.AddData(msg)
  111. if state.Auth != nil {
  112. out := nl.NewRtAttr(nl.XFRMA_ALG_AUTH_TRUNC, writeStateAlgoAuth(state.Auth))
  113. req.AddData(out)
  114. }
  115. if state.Crypt != nil {
  116. out := nl.NewRtAttr(nl.XFRMA_ALG_CRYPT, writeStateAlgo(state.Crypt))
  117. req.AddData(out)
  118. }
  119. if state.Aead != nil {
  120. out := nl.NewRtAttr(nl.XFRMA_ALG_AEAD, writeStateAlgoAead(state.Aead))
  121. req.AddData(out)
  122. }
  123. if state.Encap != nil {
  124. encapData := make([]byte, nl.SizeofXfrmEncapTmpl)
  125. encap := nl.DeserializeXfrmEncapTmpl(encapData)
  126. encap.EncapType = uint16(state.Encap.Type)
  127. encap.EncapSport = nl.Swap16(uint16(state.Encap.SrcPort))
  128. encap.EncapDport = nl.Swap16(uint16(state.Encap.DstPort))
  129. encap.EncapOa.FromIP(state.Encap.OriginalAddress)
  130. out := nl.NewRtAttr(nl.XFRMA_ENCAP, encapData)
  131. req.AddData(out)
  132. }
  133. if state.Mark != nil {
  134. out := nl.NewRtAttr(nl.XFRMA_MARK, writeMark(state.Mark))
  135. req.AddData(out)
  136. }
  137. if state.ESN {
  138. out := nl.NewRtAttr(nl.XFRMA_REPLAY_ESN_VAL, writeReplayEsn(state.ReplayWindow))
  139. req.AddData(out)
  140. }
  141. _, err := req.Execute(unix.NETLINK_XFRM, 0)
  142. return err
  143. }
  144. func (h *Handle) xfrmStateAllocSpi(state *XfrmState) (*XfrmState, error) {
  145. req := h.newNetlinkRequest(nl.XFRM_MSG_ALLOCSPI,
  146. unix.NLM_F_CREATE|unix.NLM_F_EXCL|unix.NLM_F_ACK)
  147. msg := &nl.XfrmUserSpiInfo{}
  148. msg.XfrmUsersaInfo = *(xfrmUsersaInfoFromXfrmState(state))
  149. // 1-255 is reserved by IANA for future use
  150. msg.Min = 0x100
  151. msg.Max = 0xffffffff
  152. req.AddData(msg)
  153. if state.Mark != nil {
  154. out := nl.NewRtAttr(nl.XFRMA_MARK, writeMark(state.Mark))
  155. req.AddData(out)
  156. }
  157. msgs, err := req.Execute(unix.NETLINK_XFRM, 0)
  158. if err != nil {
  159. return nil, err
  160. }
  161. return parseXfrmState(msgs[0], FAMILY_ALL)
  162. }
  163. // XfrmStateDel will delete an xfrm state from the system. Note that
  164. // the Algos are ignored when matching the state to delete.
  165. // Equivalent to: `ip xfrm state del $state`
  166. func XfrmStateDel(state *XfrmState) error {
  167. return pkgHandle.XfrmStateDel(state)
  168. }
  169. // XfrmStateDel will delete an xfrm state from the system. Note that
  170. // the Algos are ignored when matching the state to delete.
  171. // Equivalent to: `ip xfrm state del $state`
  172. func (h *Handle) XfrmStateDel(state *XfrmState) error {
  173. _, err := h.xfrmStateGetOrDelete(state, nl.XFRM_MSG_DELSA)
  174. return err
  175. }
  176. // XfrmStateList gets a list of xfrm states in the system.
  177. // Equivalent to: `ip [-4|-6] xfrm state show`.
  178. // The list can be filtered by ip family.
  179. func XfrmStateList(family int) ([]XfrmState, error) {
  180. return pkgHandle.XfrmStateList(family)
  181. }
  182. // XfrmStateList gets a list of xfrm states in the system.
  183. // Equivalent to: `ip xfrm state show`.
  184. // The list can be filtered by ip family.
  185. func (h *Handle) XfrmStateList(family int) ([]XfrmState, error) {
  186. req := h.newNetlinkRequest(nl.XFRM_MSG_GETSA, unix.NLM_F_DUMP)
  187. msgs, err := req.Execute(unix.NETLINK_XFRM, nl.XFRM_MSG_NEWSA)
  188. if err != nil {
  189. return nil, err
  190. }
  191. var res []XfrmState
  192. for _, m := range msgs {
  193. if state, err := parseXfrmState(m, family); err == nil {
  194. res = append(res, *state)
  195. } else if err == familyError {
  196. continue
  197. } else {
  198. return nil, err
  199. }
  200. }
  201. return res, nil
  202. }
  203. // XfrmStateGet gets the xfrm state described by the ID, if found.
  204. // Equivalent to: `ip xfrm state get ID [ mark MARK [ mask MASK ] ]`.
  205. // Only the fields which constitue the SA ID must be filled in:
  206. // ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]
  207. // mark is optional
  208. func XfrmStateGet(state *XfrmState) (*XfrmState, error) {
  209. return pkgHandle.XfrmStateGet(state)
  210. }
  211. // XfrmStateGet gets the xfrm state described by the ID, if found.
  212. // Equivalent to: `ip xfrm state get ID [ mark MARK [ mask MASK ] ]`.
  213. // Only the fields which constitue the SA ID must be filled in:
  214. // ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]
  215. // mark is optional
  216. func (h *Handle) XfrmStateGet(state *XfrmState) (*XfrmState, error) {
  217. return h.xfrmStateGetOrDelete(state, nl.XFRM_MSG_GETSA)
  218. }
  219. func (h *Handle) xfrmStateGetOrDelete(state *XfrmState, nlProto int) (*XfrmState, error) {
  220. req := h.newNetlinkRequest(nlProto, unix.NLM_F_ACK)
  221. msg := &nl.XfrmUsersaId{}
  222. msg.Family = uint16(nl.GetIPFamily(state.Dst))
  223. msg.Daddr.FromIP(state.Dst)
  224. msg.Proto = uint8(state.Proto)
  225. msg.Spi = nl.Swap32(uint32(state.Spi))
  226. req.AddData(msg)
  227. if state.Mark != nil {
  228. out := nl.NewRtAttr(nl.XFRMA_MARK, writeMark(state.Mark))
  229. req.AddData(out)
  230. }
  231. if state.Src != nil {
  232. out := nl.NewRtAttr(nl.XFRMA_SRCADDR, state.Src.To16())
  233. req.AddData(out)
  234. }
  235. resType := nl.XFRM_MSG_NEWSA
  236. if nlProto == nl.XFRM_MSG_DELSA {
  237. resType = 0
  238. }
  239. msgs, err := req.Execute(unix.NETLINK_XFRM, uint16(resType))
  240. if err != nil {
  241. return nil, err
  242. }
  243. if nlProto == nl.XFRM_MSG_DELSA {
  244. return nil, nil
  245. }
  246. s, err := parseXfrmState(msgs[0], FAMILY_ALL)
  247. if err != nil {
  248. return nil, err
  249. }
  250. return s, nil
  251. }
  252. var familyError = fmt.Errorf("family error")
  253. func xfrmStateFromXfrmUsersaInfo(msg *nl.XfrmUsersaInfo) *XfrmState {
  254. var state XfrmState
  255. state.Dst = msg.Id.Daddr.ToIP()
  256. state.Src = msg.Saddr.ToIP()
  257. state.Proto = Proto(msg.Id.Proto)
  258. state.Mode = Mode(msg.Mode)
  259. state.Spi = int(nl.Swap32(msg.Id.Spi))
  260. state.Reqid = int(msg.Reqid)
  261. state.ReplayWindow = int(msg.ReplayWindow)
  262. lftToLimits(&msg.Lft, &state.Limits)
  263. curToStats(&msg.Curlft, &msg.Stats, &state.Statistics)
  264. return &state
  265. }
  266. func parseXfrmState(m []byte, family int) (*XfrmState, error) {
  267. msg := nl.DeserializeXfrmUsersaInfo(m)
  268. // This is mainly for the state dump
  269. if family != FAMILY_ALL && family != int(msg.Family) {
  270. return nil, familyError
  271. }
  272. state := xfrmStateFromXfrmUsersaInfo(msg)
  273. attrs, err := nl.ParseRouteAttr(m[nl.SizeofXfrmUsersaInfo:])
  274. if err != nil {
  275. return nil, err
  276. }
  277. for _, attr := range attrs {
  278. switch attr.Attr.Type {
  279. case nl.XFRMA_ALG_AUTH, nl.XFRMA_ALG_CRYPT:
  280. var resAlgo *XfrmStateAlgo
  281. if attr.Attr.Type == nl.XFRMA_ALG_AUTH {
  282. if state.Auth == nil {
  283. state.Auth = new(XfrmStateAlgo)
  284. }
  285. resAlgo = state.Auth
  286. } else {
  287. state.Crypt = new(XfrmStateAlgo)
  288. resAlgo = state.Crypt
  289. }
  290. algo := nl.DeserializeXfrmAlgo(attr.Value[:])
  291. (*resAlgo).Name = nl.BytesToString(algo.AlgName[:])
  292. (*resAlgo).Key = algo.AlgKey
  293. case nl.XFRMA_ALG_AUTH_TRUNC:
  294. if state.Auth == nil {
  295. state.Auth = new(XfrmStateAlgo)
  296. }
  297. algo := nl.DeserializeXfrmAlgoAuth(attr.Value[:])
  298. state.Auth.Name = nl.BytesToString(algo.AlgName[:])
  299. state.Auth.Key = algo.AlgKey
  300. state.Auth.TruncateLen = int(algo.AlgTruncLen)
  301. case nl.XFRMA_ALG_AEAD:
  302. state.Aead = new(XfrmStateAlgo)
  303. algo := nl.DeserializeXfrmAlgoAEAD(attr.Value[:])
  304. state.Aead.Name = nl.BytesToString(algo.AlgName[:])
  305. state.Aead.Key = algo.AlgKey
  306. state.Aead.ICVLen = int(algo.AlgICVLen)
  307. case nl.XFRMA_ENCAP:
  308. encap := nl.DeserializeXfrmEncapTmpl(attr.Value[:])
  309. state.Encap = new(XfrmStateEncap)
  310. state.Encap.Type = EncapType(encap.EncapType)
  311. state.Encap.SrcPort = int(nl.Swap16(encap.EncapSport))
  312. state.Encap.DstPort = int(nl.Swap16(encap.EncapDport))
  313. state.Encap.OriginalAddress = encap.EncapOa.ToIP()
  314. case nl.XFRMA_MARK:
  315. mark := nl.DeserializeXfrmMark(attr.Value[:])
  316. state.Mark = new(XfrmMark)
  317. state.Mark.Value = mark.Value
  318. state.Mark.Mask = mark.Mask
  319. }
  320. }
  321. return state, nil
  322. }
  323. // XfrmStateFlush will flush the xfrm state on the system.
  324. // proto = 0 means any transformation protocols
  325. // Equivalent to: `ip xfrm state flush [ proto XFRM-PROTO ]`
  326. func XfrmStateFlush(proto Proto) error {
  327. return pkgHandle.XfrmStateFlush(proto)
  328. }
  329. // XfrmStateFlush will flush the xfrm state on the system.
  330. // proto = 0 means any transformation protocols
  331. // Equivalent to: `ip xfrm state flush [ proto XFRM-PROTO ]`
  332. func (h *Handle) XfrmStateFlush(proto Proto) error {
  333. req := h.newNetlinkRequest(nl.XFRM_MSG_FLUSHSA, unix.NLM_F_ACK)
  334. req.AddData(&nl.XfrmUsersaFlush{Proto: uint8(proto)})
  335. _, err := req.Execute(unix.NETLINK_XFRM, 0)
  336. return err
  337. }
  338. func limitsToLft(lmts XfrmStateLimits, lft *nl.XfrmLifetimeCfg) {
  339. if lmts.ByteSoft != 0 {
  340. lft.SoftByteLimit = lmts.ByteSoft
  341. } else {
  342. lft.SoftByteLimit = nl.XFRM_INF
  343. }
  344. if lmts.ByteHard != 0 {
  345. lft.HardByteLimit = lmts.ByteHard
  346. } else {
  347. lft.HardByteLimit = nl.XFRM_INF
  348. }
  349. if lmts.PacketSoft != 0 {
  350. lft.SoftPacketLimit = lmts.PacketSoft
  351. } else {
  352. lft.SoftPacketLimit = nl.XFRM_INF
  353. }
  354. if lmts.PacketHard != 0 {
  355. lft.HardPacketLimit = lmts.PacketHard
  356. } else {
  357. lft.HardPacketLimit = nl.XFRM_INF
  358. }
  359. lft.SoftAddExpiresSeconds = lmts.TimeSoft
  360. lft.HardAddExpiresSeconds = lmts.TimeHard
  361. lft.SoftUseExpiresSeconds = lmts.TimeUseSoft
  362. lft.HardUseExpiresSeconds = lmts.TimeUseHard
  363. }
  364. func lftToLimits(lft *nl.XfrmLifetimeCfg, lmts *XfrmStateLimits) {
  365. *lmts = *(*XfrmStateLimits)(unsafe.Pointer(lft))
  366. }
  367. func curToStats(cur *nl.XfrmLifetimeCur, wstats *nl.XfrmStats, stats *XfrmStateStats) {
  368. stats.Bytes = cur.Bytes
  369. stats.Packets = cur.Packets
  370. stats.AddTime = cur.AddTime
  371. stats.UseTime = cur.UseTime
  372. stats.ReplayWindow = wstats.ReplayWindow
  373. stats.Replay = wstats.Replay
  374. stats.Failed = wstats.IntegrityFailed
  375. }
  376. func xfrmUsersaInfoFromXfrmState(state *XfrmState) *nl.XfrmUsersaInfo {
  377. msg := &nl.XfrmUsersaInfo{}
  378. msg.Family = uint16(nl.GetIPFamily(state.Dst))
  379. msg.Id.Daddr.FromIP(state.Dst)
  380. msg.Saddr.FromIP(state.Src)
  381. msg.Id.Proto = uint8(state.Proto)
  382. msg.Mode = uint8(state.Mode)
  383. msg.Id.Spi = nl.Swap32(uint32(state.Spi))
  384. msg.Reqid = uint32(state.Reqid)
  385. msg.ReplayWindow = uint8(state.ReplayWindow)
  386. return msg
  387. }