@@ -904,6 +904,18 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family, FILE *fp,
fprintf(fp, "tfcpad %u", tfcpad);
fprintf(fp, "%s", _SL_);
}
+ if (tb[XFRMA_SA_DIR]) {
+ __u8 dir = rta_getattr_u8(tb[XFRMA_SA_DIR]);
+
+ fprintf(fp, "\tdir ");
+ if (dir == XFRM_SA_DIR_IN)
+ fprintf(fp, "in");
+ else if (dir == XFRM_SA_DIR_OUT)
+ fprintf(fp, "out");
+ else
+ fprintf(fp, " %d", dir);
+ fprintf(fp, "%s", _SL_);
+ }
}
static int xfrm_selector_iszero(struct xfrm_selector *s)
@@ -47,9 +47,9 @@ static void usage(void)
" [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"
" [ offload [ crypto | packet ] dev DEV dir DIR ]\n"
" [ output-mark OUTPUT-MARK [ mask MASK ] ]\n"
- " [ if_id IF_ID ] [ tfcpad LENGTH ]\n"
+ " [ if_id IF_ID ] [ tfcpad LENGTH ] [dir DIR]\n"
"Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"
- " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n"
+ " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ] [dir DIR]\n"
"Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n"
"Usage: ip xfrm state deleteall [ ID ] [ mode MODE ] [ reqid REQID ]\n"
" [ flag FLAG-LIST ]\n"
@@ -290,7 +290,9 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
struct xfrm_replay_state_esn replay_esn = {};
struct xfrm_user_offload xuo = {};
unsigned int ifindex = 0;
- __u8 dir = 0;
+ __u8 dir = 0; /* only used with xuo XFRMA_OFFLOAD */
+ __u8 sa_dir = 0; /* state direction. Should match the above when offload */
+
bool is_offload = false, is_packet_offload = false;
__u32 replay_window = 0;
__u32 seq = 0, oseq = 0, seq_hi = 0, oseq_hi = 0;
@@ -462,6 +464,14 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
NEXT_ARG();
if (get_u32(&tfcpad, *argv, 0))
invarg("value after \"tfcpad\" is invalid", *argv);
+ } else if (strcmp(*argv, "dir") == 0) {
+ NEXT_ARG();
+ if (strcmp(*argv, "in") == 0)
+ sa_dir = XFRM_SA_DIR_IN;
+ else if (strcmp(*argv, "out") == 0)
+ sa_dir = XFRM_SA_DIR_OUT;
+ else
+ invarg("value after \"dir\" is invalid", *argv);
} else {
/* try to assume ALGO */
int type = xfrm_algotype_getbyname(*argv);
@@ -587,7 +597,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
if (req.xsinfo.flags & XFRM_STATE_ESN &&
- replay_window == 0) {
+ replay_window == 0 && sa_dir != XFRM_SA_DIR_OUT ) {
fprintf(stderr, "Error: esn flag set without replay-window.\n");
exit(-1);
}
@@ -760,6 +770,14 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
if (output_mark.m)
addattr32(&req.n, sizeof(req.buf), XFRMA_SET_MARK_MASK, output_mark.m);
+ if (sa_dir) {
+ int r = addattr8(&req.n, sizeof(req.buf), XFRMA_SA_DIR, sa_dir);
+ if (r < 0) {
+ fprintf(stderr, "XFRMA_SA_DIR failed\n");
+ exit(1);
+ }
+ }
+
if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
exit(1);
@@ -792,6 +810,7 @@ static int xfrm_state_allocspi(int argc, char **argv)
char *maxp = NULL;
struct xfrm_mark mark = {0, 0};
struct nlmsghdr *answer;
+ __u8 sa_dir = 0;
while (argc > 0) {
if (strcmp(*argv, "mode") == 0) {
@@ -823,6 +842,14 @@ static int xfrm_state_allocspi(int argc, char **argv)
if (get_u32(&req.xspi.max, *argv, 0))
invarg("value after \"max\" is invalid", *argv);
+ } else if (strcmp(*argv, "dir") == 0) {
+ NEXT_ARG();
+ if (strcmp(*argv, "in") == 0)
+ sa_dir = XFRM_SA_DIR_IN;
+ else if (strcmp(*argv, "out") == 0)
+ sa_dir = XFRM_SA_DIR_OUT;
+ else
+ invarg("value after \"dir\" is invalid", *argv);
} else {
/* try to assume ID */
if (idp)
@@ -875,6 +902,15 @@ static int xfrm_state_allocspi(int argc, char **argv)
req.xspi.max = 0xffff;
}
+ if (sa_dir) {
+ int r = addattr8(&req.n, sizeof(req.buf), XFRMA_SA_DIR, sa_dir);
+
+ if (r < 0) {
+ fprintf(stderr, "XFRMA_SA_DIR failed\n");
+ exit(1);
+ }
+ }
+
if (mark.m & mark.v) {
int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
(void *)&mark, sizeof(mark));
- Add parsing "ip xfrm state add .. dir [ in|out ] - Add printing XFRMA_SA_DIR. - allow replay-window 0 on output state with esn Previously: ip xfrm state add src 192.1.3.33 dst 192.1.2.23 proto esp spi 1 \ reqid 1 mode tunnel aead 'rfc4106(gcm(aes))' \ 0x1111111111111111111111111111111111111111 96 sel src 192.0.3.0/25 dst 192.0.2.0/25 dir out flag esn Error: esn flag set without replay-window. When the SA direction is set, kernel only allows oputput SA, with ESN and replay-window zero. This change would not affect any existing use cases; configuring SA. Signed-off-by: Antony Antony <antony.antony@secunet.com> --- ip/ipxfrm.c | 12 ++++++++++++ ip/xfrm_state.c | 44 ++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 52 insertions(+), 4 deletions(-)