From 438595db1cfbb23a85f68d2a573a9f35083bc3ee Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 27 Mar 2017 13:11:34 +0200 Subject: [PATCH] xfrm: add support of ESN and anti-replay window Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1425059 Upstream Status: iproute2.git commit 0151b56d10296 commit 0151b56d102961c1418aea3ee53428d4ca2669c9 Author: dingzhi Date: Mon Oct 20 11:23:04 2014 +0200 xfrm: add support of ESN and anti-replay window This patch allows to configure ESN and anti-replay window. Signed-off-by: dingzhi Signed-off-by: Adrien Mazarguil Signed-off-by: Nicolas Dichtel --- ip/ipxfrm.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ip/xfrm_state.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++------- 2 files changed, 109 insertions(+), 7 deletions(-) diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 899ec9d..fd3e645 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -795,6 +795,62 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family, fprintf(fp, "%s", _SL_); } + if (tb[XFRMA_REPLAY_VAL]) { + struct xfrm_replay_state *replay; + + if (prefix) + fputs(prefix, fp); + fprintf(fp, "anti-replay context: "); + + if (RTA_PAYLOAD(tb[XFRMA_REPLAY_VAL]) < sizeof(*replay)) { + fprintf(fp, "(ERROR truncated)"); + fprintf(fp, "%s", _SL_); + return; + } + + replay = (struct xfrm_replay_state *)RTA_DATA(tb[XFRMA_REPLAY_VAL]); + fprintf(fp, "seq 0x%x, oseq 0x%x, bitmap 0x%08x", + replay->seq, replay->oseq, replay->bitmap); + fprintf(fp, "%s", _SL_); + } + + if (tb[XFRMA_REPLAY_ESN_VAL]) { + struct xfrm_replay_state_esn *replay; + unsigned int i, j; + + if (prefix) + fputs(prefix, fp); + fprintf(fp, "anti-replay esn context:"); + + if (RTA_PAYLOAD(tb[XFRMA_REPLAY_ESN_VAL]) < sizeof(*replay)) { + fprintf(fp, "(ERROR truncated)"); + fprintf(fp, "%s", _SL_); + return; + } + fprintf(fp, "%s", _SL_); + + replay = (struct xfrm_replay_state_esn *)RTA_DATA(tb[XFRMA_REPLAY_ESN_VAL]); + if (prefix) + fputs(prefix, fp); + fprintf(fp, " seq-hi 0x%x, seq 0x%x, oseq-hi 0x%0x, oseq 0x%0x", + replay->seq_hi, replay->seq, replay->oseq_hi, + replay->oseq); + fprintf(fp, "%s", _SL_); + if (prefix) + fputs(prefix, fp); + fprintf(fp, " replay_window %u, bitmap-length %u", + replay->replay_window, replay->bmp_len); + for (i = replay->bmp_len, j = 0; i; i--) { + if (j++ % 8 == 0) { + fprintf(fp, "%s", _SL_); + if (prefix) + fputs(prefix, fp); + fprintf(fp, " "); + } + fprintf(fp, "%08x ", replay->bmp[i - 1]); + } + fprintf(fp, "%s", _SL_); + } } static int xfrm_selector_iszero(struct xfrm_selector *s) @@ -838,6 +894,7 @@ void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo, XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ICMP, "icmp"); XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_AF_UNSPEC, "af-unspec"); XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ALIGN4, "align4"); + XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ESN, "esn"); if (flags) fprintf(fp, "%x", flags); } diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index 4dfddbc..d01f8ad 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -59,6 +59,7 @@ static void usage(void) fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ]\n"); fprintf(stderr, " [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ]\n"); fprintf(stderr, " [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ]\n"); + fprintf(stderr, " [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]\n"); fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"); fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"); fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"); @@ -88,7 +89,7 @@ static void usage(void) fprintf(stderr, " ALGO-NAME\n"); fprintf(stderr, "MODE := transport | tunnel | beet | ro | in_trigger\n"); fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n"); - fprintf(stderr, "FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4\n"); + fprintf(stderr, "FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn\n"); fprintf(stderr, "EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG\n"); fprintf(stderr, "EXTRA-FLAG := dont-encap-dscp\n"); fprintf(stderr, "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n"); @@ -213,6 +214,8 @@ static int xfrm_state_flag_parse(__u8 *flags, int *argcp, char ***argvp) *flags |= XFRM_STATE_AF_UNSPEC; else if (strcmp(*argv, "align4") == 0) *flags |= XFRM_STATE_ALIGN4; + else if (strcmp(*argv, "esn") == 0) + *flags |= XFRM_STATE_ESN; else { PREV_ARG(); /* back track */ break; @@ -272,6 +275,9 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) char buf[RTA_BUF_SIZE]; } req; struct xfrm_replay_state replay; + struct xfrm_replay_state_esn replay_esn; + __u32 replay_window = 0; + __u32 seq = 0, oseq = 0, seq_hi = 0, oseq_hi = 0; char *idp = NULL; char *aeadop = NULL; char *ealgop = NULL; @@ -288,6 +294,7 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) memset(&req, 0, sizeof(req)); memset(&replay, 0, sizeof(replay)); + memset(&replay_esn, 0, sizeof(replay_esn)); memset(&ctx, 0, sizeof(ctx)); req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo)); @@ -314,16 +321,24 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) xfrm_seq_parse(&req.xsinfo.seq, &argc, &argv); } else if (strcmp(*argv, "replay-window") == 0) { NEXT_ARG(); - if (get_u8(&req.xsinfo.replay_window, *argv, 0)) + if (get_u32(&replay_window, *argv, 0)) invarg("value after \"replay-window\" is invalid", *argv); } else if (strcmp(*argv, "replay-seq") == 0) { NEXT_ARG(); - if (get_u32(&replay.seq, *argv, 0)) + if (get_u32(&seq, *argv, 0)) invarg("value after \"replay-seq\" is invalid", *argv); + } else if (strcmp(*argv, "replay-seq-hi") == 0) { + NEXT_ARG(); + if (get_u32(&seq_hi, *argv, 0)) + invarg("value after \"replay-seq-hi\" is invalid", *argv); } else if (strcmp(*argv, "replay-oseq") == 0) { NEXT_ARG(); - if (get_u32(&replay.oseq, *argv, 0)) + if (get_u32(&oseq, *argv, 0)) invarg("value after \"replay-oseq\" is invalid", *argv); + } else if (strcmp(*argv, "replay-oseq-hi") == 0) { + NEXT_ARG(); + if (get_u32(&oseq_hi, *argv, 0)) + invarg("value after \"replay-oseq-hi\" is invalid", *argv); } else if (strcmp(*argv, "flag") == 0) { NEXT_ARG(); xfrm_state_flag_parse(&req.xsinfo.flags, &argc, &argv); @@ -511,9 +526,39 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) argc--; argv++; } - if (replay.seq || replay.oseq) - addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_VAL, - (void *)&replay, sizeof(replay)); + if (req.xsinfo.flags & XFRM_STATE_ESN && + replay_window == 0) { + fprintf(stderr, "Error: esn flag set without replay-window.\n"); + exit(-1); + } + + if (replay_window > XFRMA_REPLAY_ESN_MAX) { + fprintf(stderr, + "Error: replay-window (%u) > XFRMA_REPLAY_ESN_MAX (%u).\n", + replay_window, XFRMA_REPLAY_ESN_MAX); + exit(-1); + } + + if (req.xsinfo.flags & XFRM_STATE_ESN || + replay_window > (sizeof(replay.bitmap) * 8)) { + replay_esn.seq = seq; + replay_esn.oseq = oseq; + replay_esn.seq_hi = seq_hi; + replay_esn.oseq_hi = oseq_hi; + replay_esn.replay_window = replay_window; + replay_esn.bmp_len = (replay_window + sizeof(__u32) * 8 - 1) / + (sizeof(__u32) * 8); + addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_ESN_VAL, + &replay_esn, sizeof(replay_esn)); + } else { + if (seq || oseq) { + replay.seq = seq; + replay.oseq = oseq; + addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_VAL, + &replay, sizeof(replay)); + } + req.xsinfo.replay_window = replay_window; + } if (extra_flags) addattr32(&req.n, sizeof(req.buf), XFRMA_SA_EXTRA_FLAGS, -- 1.8.3.1