1 /* $USAGI: $ */
2
3 /*
4 * Copyright (C)2004 USAGI/WIDE Project
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19 */
20 /*
21 * based on iproute.c
22 */
23 /*
24 * Authors:
25 * Masahide NAKAMURA @USAGI
26 */
27
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <netdb.h>
32 #include <endian.h>
33 #include <linux/xfrm.h>
34 #include <linux/in.h>
35 #include <linux/in6.h>
36
37 #include "utils.h"
38 #include "xfrm.h"
39 #include "ip_common.h"
40
41 //#define NLMSG_DELETEALL_BUF_SIZE (4096-512)
42 #define NLMSG_DELETEALL_BUF_SIZE 8192
43
44 /*
45 * Receiving buffer defines:
46 * nlmsg
47 * data = struct xfrm_usersa_info
48 * rtattr
49 * rtattr
50 * ... (max count of rtattr is XFRM_MAX+1
51 *
52 * each rtattr data = struct xfrm_algo(dynamic size) or xfrm_address_t
53 */
54 #define NLMSG_BUF_SIZE 4096
55 #define RTA_BUF_SIZE 2048
56 #define XFRM_ALGO_KEY_BUF_SIZE 512
57 #define CTX_BUF_SIZE 256
58
59 static void usage(void) __attribute__((noreturn));
60
usage(void)61 static void usage(void)
62 {
63 fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ]\n");
64 fprintf(stderr, " [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ]\n");
65 fprintf(stderr, " [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ]\n");
66 fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n");
67 fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ]\n");
68 fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n");
69 fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n");
70 fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
71 fprintf(stderr, "Usage: ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ]\n");
72 fprintf(stderr, " [ flag FLAG-LIST ]\n");
73 fprintf(stderr, "Usage: ip xfrm state flush [ proto XFRM-PROTO ]\n");
74 fprintf(stderr, "Usage: ip xfrm state count\n");
75 fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]\n");
76 fprintf(stderr, "XFRM-PROTO := ");
77 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
78 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
79 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
80 fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
81 fprintf(stderr, "%s\n", strxf_xfrmproto(IPPROTO_DSTOPTS));
82 fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] ALGO\n");
83 fprintf(stderr, "ALGO := { ");
84 fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT));
85 fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AUTH));
86 fprintf(stderr, "%s", strxf_algotype(XFRMA_ALG_COMP));
87 fprintf(stderr, " } ALGO-NAME ALGO-KEY |\n");
88 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AEAD));
89 fprintf(stderr, " ALGO-NAME ALGO-KEY ALGO-ICV-LEN |\n");
90 fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AUTH_TRUNC));
91 fprintf(stderr, " ALGO-NAME ALGO-KEY ALGO-TRUNC-LEN\n");
92 fprintf(stderr, "MODE := transport | tunnel | ro | in_trigger | beet\n");
93 fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
94 fprintf(stderr, "FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4\n");
95 fprintf(stderr, "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n");
96 fprintf(stderr, "UPSPEC := proto { { ");
97 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_TCP));
98 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_UDP));
99 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_SCTP));
100 fprintf(stderr, "%s", strxf_proto(IPPROTO_DCCP));
101 fprintf(stderr, " } [ sport PORT ] [ dport PORT ] |\n");
102 fprintf(stderr, " { ");
103 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMP));
104 fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMPV6));
105 fprintf(stderr, "%s", strxf_proto(IPPROTO_MH));
106 fprintf(stderr, " } [ type NUMBER ] [ code NUMBER ] |\n");
107 fprintf(stderr, " %s", strxf_proto(IPPROTO_GRE));
108 fprintf(stderr, " [ key { DOTTED-QUAD | NUMBER } ] | PROTO }\n");
109 fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT\n");
110 fprintf(stderr, "LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |\n");
111 fprintf(stderr, " { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT\n");
112 fprintf(stderr, "ENCAP := { espinudp | espinudp-nonike } SPORT DPORT OADDR\n");
113
114 exit(-1);
115 }
116
xfrm_algo_parse(struct xfrm_algo * alg,enum xfrm_attr_type_t type,char * name,char * key,char * buf,int max)117 static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
118 char *name, char *key, char *buf, int max)
119 {
120 int len;
121 int slen = strlen(key);
122
123 #if 0
124 /* XXX: verifying both name and key is required! */
125 fprintf(stderr, "warning: ALGO-NAME/ALGO-KEY will send to kernel promiscuously! (verifying them isn't implemented yet)\n");
126 #endif
127
128 strncpy(alg->alg_name, name, sizeof(alg->alg_name));
129
130 if (slen > 2 && strncmp(key, "0x", 2) == 0) {
131 /* split two chars "0x" from the top */
132 char *p = key + 2;
133 int plen = slen - 2;
134 int i;
135 int j;
136
137 /* Converting hexadecimal numbered string into real key;
138 * Convert each two chars into one char(value). If number
139 * of the length is odd, add zero on the top for rounding.
140 */
141
142 /* calculate length of the converted values(real key) */
143 len = (plen + 1) / 2;
144 if (len > max)
145 invarg("\"ALGO-KEY\" makes buffer overflow\n", key);
146
147 for (i = - (plen % 2), j = 0; j < len; i += 2, j++) {
148 char vbuf[3];
149 __u8 val;
150
151 vbuf[0] = i >= 0 ? p[i] : '0';
152 vbuf[1] = p[i + 1];
153 vbuf[2] = '\0';
154
155 if (get_u8(&val, vbuf, 16))
156 invarg("\"ALGO-KEY\" is invalid", key);
157
158 buf[j] = val;
159 }
160 } else {
161 len = slen;
162 if (len > 0) {
163 if (len > max)
164 invarg("\"ALGO-KEY\" makes buffer overflow\n", key);
165
166 strncpy(buf, key, len);
167 }
168 }
169
170 alg->alg_key_len = len * 8;
171
172 return 0;
173 }
174
xfrm_seq_parse(__u32 * seq,int * argcp,char *** argvp)175 static int xfrm_seq_parse(__u32 *seq, int *argcp, char ***argvp)
176 {
177 int argc = *argcp;
178 char **argv = *argvp;
179
180 if (get_u32(seq, *argv, 0))
181 invarg("\"SEQ\" is invalid", *argv);
182
183 *seq = htonl(*seq);
184
185 *argcp = argc;
186 *argvp = argv;
187
188 return 0;
189 }
190
xfrm_state_flag_parse(__u8 * flags,int * argcp,char *** argvp)191 static int xfrm_state_flag_parse(__u8 *flags, int *argcp, char ***argvp)
192 {
193 int argc = *argcp;
194 char **argv = *argvp;
195 int len = strlen(*argv);
196
197 if (len > 2 && strncmp(*argv, "0x", 2) == 0) {
198 __u8 val = 0;
199
200 if (get_u8(&val, *argv, 16))
201 invarg("\"FLAG\" is invalid", *argv);
202 *flags = val;
203 } else {
204 while (1) {
205 if (strcmp(*argv, "noecn") == 0)
206 *flags |= XFRM_STATE_NOECN;
207 else if (strcmp(*argv, "decap-dscp") == 0)
208 *flags |= XFRM_STATE_DECAP_DSCP;
209 else if (strcmp(*argv, "nopmtudisc") == 0)
210 *flags |= XFRM_STATE_NOPMTUDISC;
211 else if (strcmp(*argv, "wildrecv") == 0)
212 *flags |= XFRM_STATE_WILDRECV;
213 else if (strcmp(*argv, "icmp") == 0)
214 *flags |= XFRM_STATE_ICMP;
215 else if (strcmp(*argv, "af-unspec") == 0)
216 *flags |= XFRM_STATE_AF_UNSPEC;
217 else if (strcmp(*argv, "align4") == 0)
218 *flags |= XFRM_STATE_ALIGN4;
219 else {
220 PREV_ARG(); /* back track */
221 break;
222 }
223
224 if (!NEXT_ARG_OK())
225 break;
226 NEXT_ARG();
227 }
228 }
229
230 *argcp = argc;
231 *argvp = argv;
232
233 return 0;
234 }
235
xfrm_state_modify(int cmd,unsigned flags,int argc,char ** argv)236 static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
237 {
238 struct rtnl_handle rth;
239 struct {
240 struct nlmsghdr n;
241 struct xfrm_usersa_info xsinfo;
242 char buf[RTA_BUF_SIZE];
243 } req;
244 struct xfrm_replay_state replay;
245 char *idp = NULL;
246 char *aeadop = NULL;
247 char *ealgop = NULL;
248 char *aalgop = NULL;
249 char *calgop = NULL;
250 char *coap = NULL;
251 char *sctxp = NULL;
252 struct xfrm_mark mark = {0, 0};
253 struct {
254 struct xfrm_user_sec_ctx sctx;
255 char str[CTX_BUF_SIZE];
256 } ctx;
257
258 memset(&req, 0, sizeof(req));
259 memset(&replay, 0, sizeof(replay));
260 memset(&ctx, 0, sizeof(ctx));
261
262 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo));
263 req.n.nlmsg_flags = NLM_F_REQUEST|flags;
264 req.n.nlmsg_type = cmd;
265 req.xsinfo.family = preferred_family;
266
267 req.xsinfo.lft.soft_byte_limit = XFRM_INF;
268 req.xsinfo.lft.hard_byte_limit = XFRM_INF;
269 req.xsinfo.lft.soft_packet_limit = XFRM_INF;
270 req.xsinfo.lft.hard_packet_limit = XFRM_INF;
271
272 while (argc > 0) {
273 if (strcmp(*argv, "mode") == 0) {
274 NEXT_ARG();
275 xfrm_mode_parse(&req.xsinfo.mode, &argc, &argv);
276 } else if (strcmp(*argv, "mark") == 0) {
277 xfrm_parse_mark(&mark, &argc, &argv);
278 } else if (strcmp(*argv, "reqid") == 0) {
279 NEXT_ARG();
280 xfrm_reqid_parse(&req.xsinfo.reqid, &argc, &argv);
281 } else if (strcmp(*argv, "seq") == 0) {
282 NEXT_ARG();
283 xfrm_seq_parse(&req.xsinfo.seq, &argc, &argv);
284 } else if (strcmp(*argv, "replay-window") == 0) {
285 NEXT_ARG();
286 if (get_u8(&req.xsinfo.replay_window, *argv, 0))
287 invarg("\"replay-window\" value is invalid", *argv);
288 } else if (strcmp(*argv, "replay-seq") == 0) {
289 NEXT_ARG();
290 if (get_u32(&replay.seq, *argv, 0))
291 invarg("\"replay-seq\" value is invalid", *argv);
292 } else if (strcmp(*argv, "replay-oseq") == 0) {
293 NEXT_ARG();
294 if (get_u32(&replay.oseq, *argv, 0))
295 invarg("\"replay-oseq\" value is invalid", *argv);
296 } else if (strcmp(*argv, "flag") == 0) {
297 NEXT_ARG();
298 xfrm_state_flag_parse(&req.xsinfo.flags, &argc, &argv);
299 } else if (strcmp(*argv, "sel") == 0) {
300 NEXT_ARG();
301 xfrm_selector_parse(&req.xsinfo.sel, &argc, &argv);
302 } else if (strcmp(*argv, "limit") == 0) {
303 NEXT_ARG();
304 xfrm_lifetime_cfg_parse(&req.xsinfo.lft, &argc, &argv);
305 } else if (strcmp(*argv, "encap") == 0) {
306 struct xfrm_encap_tmpl encap;
307 inet_prefix oa;
308 NEXT_ARG();
309 xfrm_encap_type_parse(&encap.encap_type, &argc, &argv);
310 NEXT_ARG();
311 if (get_u16(&encap.encap_sport, *argv, 0))
312 invarg("\"encap\" sport value is invalid", *argv);
313 encap.encap_sport = htons(encap.encap_sport);
314 NEXT_ARG();
315 if (get_u16(&encap.encap_dport, *argv, 0))
316 invarg("\"encap\" dport value is invalid", *argv);
317 encap.encap_dport = htons(encap.encap_dport);
318 NEXT_ARG();
319 get_addr(&oa, *argv, AF_UNSPEC);
320 memcpy(&encap.encap_oa, &oa.data, sizeof(encap.encap_oa));
321 addattr_l(&req.n, sizeof(req.buf), XFRMA_ENCAP,
322 (void *)&encap, sizeof(encap));
323 } else if (strcmp(*argv, "coa") == 0) {
324 inet_prefix coa;
325 xfrm_address_t xcoa;
326
327 if (coap)
328 duparg("coa", *argv);
329 coap = *argv;
330
331 NEXT_ARG();
332
333 get_prefix(&coa, *argv, preferred_family);
334 if (coa.family == AF_UNSPEC)
335 invarg("\"coa\" address family is AF_UNSPEC", *argv);
336 if (coa.bytelen > sizeof(xcoa))
337 invarg("\"coa\" address length is too large", *argv);
338
339 memset(&xcoa, 0, sizeof(xcoa));
340 memcpy(&xcoa, &coa.data, coa.bytelen);
341
342 addattr_l(&req.n, sizeof(req.buf), XFRMA_COADDR,
343 (void *)&xcoa, sizeof(xcoa));
344 } else if (strcmp(*argv, "ctx") == 0) {
345 char *context;
346
347 if (sctxp)
348 duparg("ctx", *argv);
349 sctxp = *argv;
350
351 NEXT_ARG();
352 context = *argv;
353
354 xfrm_sctx_parse((char *)&ctx.str, context, &ctx.sctx);
355 addattr_l(&req.n, sizeof(req.buf), XFRMA_SEC_CTX,
356 (void *)&ctx, ctx.sctx.len);
357 } else {
358 /* try to assume ALGO */
359 int type = xfrm_algotype_getbyname(*argv);
360 switch (type) {
361 case XFRMA_ALG_AEAD:
362 case XFRMA_ALG_CRYPT:
363 case XFRMA_ALG_AUTH:
364 case XFRMA_ALG_AUTH_TRUNC:
365 case XFRMA_ALG_COMP:
366 {
367 /* ALGO */
368 struct {
369 union {
370 struct xfrm_algo alg;
371 struct xfrm_algo_aead aead;
372 struct xfrm_algo_auth auth;
373 } u;
374 char buf[XFRM_ALGO_KEY_BUF_SIZE];
375 } alg = {};
376 int len;
377 __u32 icvlen, trunclen;
378 char *name;
379 char *key;
380 char *buf;
381
382 switch (type) {
383 case XFRMA_ALG_AEAD:
384 if (aeadop)
385 duparg("ALGO-TYPE", *argv);
386 aeadop = *argv;
387 break;
388 case XFRMA_ALG_CRYPT:
389 if (ealgop)
390 duparg("ALGO-TYPE", *argv);
391 ealgop = *argv;
392 break;
393 case XFRMA_ALG_AUTH:
394 case XFRMA_ALG_AUTH_TRUNC:
395 if (aalgop)
396 duparg("ALGO-TYPE", *argv);
397 aalgop = *argv;
398 break;
399 case XFRMA_ALG_COMP:
400 if (calgop)
401 duparg("ALGO-TYPE", *argv);
402 calgop = *argv;
403 break;
404 default:
405 /* not reached */
406 invarg("\"ALGO-TYPE\" is invalid\n", *argv);
407 }
408
409 if (!NEXT_ARG_OK())
410 missarg("ALGO-NAME");
411 NEXT_ARG();
412 name = *argv;
413
414 if (!NEXT_ARG_OK())
415 missarg("ALGO-KEY");
416 NEXT_ARG();
417 key = *argv;
418
419 buf = alg.u.alg.alg_key;
420 len = sizeof(alg.u.alg);
421
422 switch (type) {
423 case XFRMA_ALG_AEAD:
424 if (!NEXT_ARG_OK())
425 missarg("ALGO-ICV-LEN");
426 NEXT_ARG();
427 if (get_u32(&icvlen, *argv, 0))
428 invarg("\"aead\" ICV length is invalid",
429 *argv);
430 alg.u.aead.alg_icv_len = icvlen;
431
432 buf = alg.u.aead.alg_key;
433 len = sizeof(alg.u.aead);
434 break;
435 case XFRMA_ALG_AUTH_TRUNC:
436 if (!NEXT_ARG_OK())
437 missarg("ALGO-TRUNC-LEN");
438 NEXT_ARG();
439 if (get_u32(&trunclen, *argv, 0))
440 invarg("\"auth\" trunc length is invalid",
441 *argv);
442 alg.u.auth.alg_trunc_len = trunclen;
443
444 buf = alg.u.auth.alg_key;
445 len = sizeof(alg.u.auth);
446 break;
447 }
448
449 xfrm_algo_parse((void *)&alg, type, name, key,
450 buf, sizeof(alg.buf));
451 len += alg.u.alg.alg_key_len;
452
453 addattr_l(&req.n, sizeof(req.buf), type,
454 (void *)&alg, len);
455 break;
456 }
457 default:
458 /* try to assume ID */
459 if (idp)
460 invarg("unknown", *argv);
461 idp = *argv;
462
463 /* ID */
464 xfrm_id_parse(&req.xsinfo.saddr, &req.xsinfo.id,
465 &req.xsinfo.family, 0, &argc, &argv);
466 if (preferred_family == AF_UNSPEC)
467 preferred_family = req.xsinfo.family;
468 }
469 }
470 argc--; argv++;
471 }
472
473 if (replay.seq || replay.oseq)
474 addattr_l(&req.n, sizeof(req.buf), XFRMA_REPLAY_VAL,
475 (void *)&replay, sizeof(replay));
476
477 if (!idp) {
478 fprintf(stderr, "Not enough information: \"ID\" is required\n");
479 exit(1);
480 }
481
482 if (mark.m & mark.v) {
483 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
484 (void *)&mark, sizeof(mark));
485 if (r < 0) {
486 fprintf(stderr, "XFRMA_MARK failed\n");
487 exit(1);
488 }
489 }
490
491 switch (req.xsinfo.mode) {
492 case XFRM_MODE_TRANSPORT:
493 case XFRM_MODE_TUNNEL:
494 if (!xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) {
495 fprintf(stderr, "\"mode\" is invalid with proto=%s\n",
496 strxf_xfrmproto(req.xsinfo.id.proto));
497 exit(1);
498 }
499 break;
500 case XFRM_MODE_ROUTEOPTIMIZATION:
501 case XFRM_MODE_IN_TRIGGER:
502 if (!xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
503 fprintf(stderr, "\"mode\" is invalid with proto=%s\n",
504 strxf_xfrmproto(req.xsinfo.id.proto));
505 exit(1);
506 }
507 if (req.xsinfo.id.spi != 0) {
508 fprintf(stderr, "\"spi\" must be 0 with proto=%s\n",
509 strxf_xfrmproto(req.xsinfo.id.proto));
510 exit(1);
511 }
512 break;
513 default:
514 break;
515 }
516
517 if (aeadop || ealgop || aalgop || calgop) {
518 if (!xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) {
519 fprintf(stderr, "\"ALGO\" is invalid with proto=%s\n",
520 strxf_xfrmproto(req.xsinfo.id.proto));
521 exit(1);
522 }
523 } else {
524 if (xfrm_xfrmproto_is_ipsec(req.xsinfo.id.proto)) {
525 fprintf(stderr, "\"ALGO\" is required with proto=%s\n",
526 strxf_xfrmproto(req.xsinfo.id.proto));
527 exit (1);
528 }
529 }
530
531 if (coap) {
532 if (!xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
533 fprintf(stderr, "\"coa\" is invalid with proto=%s\n",
534 strxf_xfrmproto(req.xsinfo.id.proto));
535 exit(1);
536 }
537 } else {
538 if (xfrm_xfrmproto_is_ro(req.xsinfo.id.proto)) {
539 fprintf(stderr, "\"coa\" is required with proto=%s\n",
540 strxf_xfrmproto(req.xsinfo.id.proto));
541 exit (1);
542 }
543 }
544
545 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
546 exit(1);
547
548 if (req.xsinfo.family == AF_UNSPEC)
549 req.xsinfo.family = AF_INET;
550
551 if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0)
552 exit(2);
553
554 rtnl_close(&rth);
555
556 return 0;
557 }
558
xfrm_state_allocspi(int argc,char ** argv)559 static int xfrm_state_allocspi(int argc, char **argv)
560 {
561 struct rtnl_handle rth;
562 struct {
563 struct nlmsghdr n;
564 struct xfrm_userspi_info xspi;
565 char buf[RTA_BUF_SIZE];
566 } req;
567 char *idp = NULL;
568 char *minp = NULL;
569 char *maxp = NULL;
570 struct xfrm_mark mark = {0, 0};
571 char res_buf[NLMSG_BUF_SIZE];
572 struct nlmsghdr *res_n = (struct nlmsghdr *)res_buf;
573
574 memset(res_buf, 0, sizeof(res_buf));
575
576 memset(&req, 0, sizeof(req));
577
578 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xspi));
579 req.n.nlmsg_flags = NLM_F_REQUEST;
580 req.n.nlmsg_type = XFRM_MSG_ALLOCSPI;
581 req.xspi.info.family = preferred_family;
582
583 #if 0
584 req.xsinfo.lft.soft_byte_limit = XFRM_INF;
585 req.xsinfo.lft.hard_byte_limit = XFRM_INF;
586 req.xsinfo.lft.soft_packet_limit = XFRM_INF;
587 req.xsinfo.lft.hard_packet_limit = XFRM_INF;
588 #endif
589
590 while (argc > 0) {
591 if (strcmp(*argv, "mode") == 0) {
592 NEXT_ARG();
593 xfrm_mode_parse(&req.xspi.info.mode, &argc, &argv);
594 } else if (strcmp(*argv, "mark") == 0) {
595 xfrm_parse_mark(&mark, &argc, &argv);
596 } else if (strcmp(*argv, "reqid") == 0) {
597 NEXT_ARG();
598 xfrm_reqid_parse(&req.xspi.info.reqid, &argc, &argv);
599 } else if (strcmp(*argv, "seq") == 0) {
600 NEXT_ARG();
601 xfrm_seq_parse(&req.xspi.info.seq, &argc, &argv);
602 } else if (strcmp(*argv, "min") == 0) {
603 if (minp)
604 duparg("min", *argv);
605 minp = *argv;
606
607 NEXT_ARG();
608
609 if (get_u32(&req.xspi.min, *argv, 0))
610 invarg("\"min\" value is invalid", *argv);
611 } else if (strcmp(*argv, "max") == 0) {
612 if (maxp)
613 duparg("max", *argv);
614 maxp = *argv;
615
616 NEXT_ARG();
617
618 if (get_u32(&req.xspi.max, *argv, 0))
619 invarg("\"max\" value is invalid", *argv);
620 } else {
621 /* try to assume ID */
622 if (idp)
623 invarg("unknown", *argv);
624 idp = *argv;
625
626 /* ID */
627 xfrm_id_parse(&req.xspi.info.saddr, &req.xspi.info.id,
628 &req.xspi.info.family, 0, &argc, &argv);
629 if (req.xspi.info.id.spi) {
630 fprintf(stderr, "\"SPI\" must be zero\n");
631 exit(1);
632 }
633 if (preferred_family == AF_UNSPEC)
634 preferred_family = req.xspi.info.family;
635 }
636 argc--; argv++;
637 }
638
639 if (!idp) {
640 fprintf(stderr, "Not enough information: \"ID\" is required\n");
641 exit(1);
642 }
643
644 if (minp) {
645 if (!maxp) {
646 fprintf(stderr, "\"max\" is missing\n");
647 exit(1);
648 }
649 if (req.xspi.min > req.xspi.max) {
650 fprintf(stderr, "\"min\" value is larger than \"max\" value\n");
651 exit(1);
652 }
653 } else {
654 if (maxp) {
655 fprintf(stderr, "\"min\" is missing\n");
656 exit(1);
657 }
658
659 /* XXX: Default value defined in PF_KEY;
660 * See kernel's net/key/af_key.c(pfkey_getspi).
661 */
662 req.xspi.min = 0x100;
663 req.xspi.max = 0x0fffffff;
664
665 /* XXX: IPCOMP spi is 16-bits;
666 * See kernel's net/xfrm/xfrm_user(verify_userspi_info).
667 */
668 if (req.xspi.info.id.proto == IPPROTO_COMP)
669 req.xspi.max = 0xffff;
670 }
671
672 if (mark.m & mark.v) {
673 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
674 (void *)&mark, sizeof(mark));
675 if (r < 0) {
676 fprintf(stderr, "XFRMA_MARK failed\n");
677 exit(1);
678 }
679 }
680
681 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
682 exit(1);
683
684 if (req.xspi.info.family == AF_UNSPEC)
685 req.xspi.info.family = AF_INET;
686
687
688 if (rtnl_talk(&rth, &req.n, 0, 0, res_n) < 0)
689 exit(2);
690
691 if (xfrm_state_print(NULL, res_n, (void*)stdout) < 0) {
692 fprintf(stderr, "An error :-)\n");
693 exit(1);
694 }
695
696 rtnl_close(&rth);
697
698 return 0;
699 }
700
xfrm_state_filter_match(struct xfrm_usersa_info * xsinfo)701 static int xfrm_state_filter_match(struct xfrm_usersa_info *xsinfo)
702 {
703 if (!filter.use)
704 return 1;
705
706 if (filter.id_src_mask)
707 if (xfrm_addr_match(&xsinfo->saddr, &filter.xsinfo.saddr,
708 filter.id_src_mask))
709 return 0;
710 if (filter.id_dst_mask)
711 if (xfrm_addr_match(&xsinfo->id.daddr, &filter.xsinfo.id.daddr,
712 filter.id_dst_mask))
713 return 0;
714 if ((xsinfo->id.proto^filter.xsinfo.id.proto)&filter.id_proto_mask)
715 return 0;
716 if ((xsinfo->id.spi^filter.xsinfo.id.spi)&filter.id_spi_mask)
717 return 0;
718 if ((xsinfo->mode^filter.xsinfo.mode)&filter.mode_mask)
719 return 0;
720 if ((xsinfo->reqid^filter.xsinfo.reqid)&filter.reqid_mask)
721 return 0;
722 if (filter.state_flags_mask)
723 if ((xsinfo->flags & filter.xsinfo.flags) == 0)
724 return 0;
725
726 return 1;
727 }
728
xfrm_state_print(const struct sockaddr_nl * who,struct nlmsghdr * n,void * arg)729 int xfrm_state_print(const struct sockaddr_nl *who, struct nlmsghdr *n,
730 void *arg)
731 {
732 FILE *fp = (FILE*)arg;
733 struct rtattr * tb[XFRMA_MAX+1];
734 struct rtattr * rta;
735 struct xfrm_usersa_info *xsinfo = NULL;
736 struct xfrm_user_expire *xexp = NULL;
737 struct xfrm_usersa_id *xsid = NULL;
738 int len = n->nlmsg_len;
739
740 if (n->nlmsg_type != XFRM_MSG_NEWSA &&
741 n->nlmsg_type != XFRM_MSG_DELSA &&
742 n->nlmsg_type != XFRM_MSG_UPDSA &&
743 n->nlmsg_type != XFRM_MSG_EXPIRE) {
744 fprintf(stderr, "Not a state: %08x %08x %08x\n",
745 n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
746 return 0;
747 }
748
749 if (n->nlmsg_type == XFRM_MSG_DELSA) {
750 /* Dont blame me for this .. Herbert made me do it */
751 xsid = NLMSG_DATA(n);
752 len -= NLMSG_SPACE(sizeof(*xsid));
753 } else if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
754 xexp = NLMSG_DATA(n);
755 xsinfo = &xexp->state;
756 len -= NLMSG_SPACE(sizeof(*xexp));
757 } else {
758 xexp = NULL;
759 xsinfo = NLMSG_DATA(n);
760 len -= NLMSG_SPACE(sizeof(*xsinfo));
761 }
762
763 if (len < 0) {
764 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
765 return -1;
766 }
767
768 if (xsinfo && !xfrm_state_filter_match(xsinfo))
769 return 0;
770
771 if (n->nlmsg_type == XFRM_MSG_DELSA)
772 fprintf(fp, "Deleted ");
773 else if (n->nlmsg_type == XFRM_MSG_UPDSA)
774 fprintf(fp, "Updated ");
775 else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
776 fprintf(fp, "Expired ");
777
778 if (n->nlmsg_type == XFRM_MSG_DELSA)
779 rta = XFRMSID_RTA(xsid);
780 else if (n->nlmsg_type == XFRM_MSG_EXPIRE)
781 rta = XFRMEXP_RTA(xexp);
782 else
783 rta = XFRMS_RTA(xsinfo);
784
785 parse_rtattr(tb, XFRMA_MAX, rta, len);
786
787 if (n->nlmsg_type == XFRM_MSG_DELSA) {
788 //xfrm_policy_id_print();
789
790 if (!tb[XFRMA_SA]) {
791 fprintf(stderr, "Buggy XFRM_MSG_DELSA: no XFRMA_SA\n");
792 return -1;
793 }
794 if (RTA_PAYLOAD(tb[XFRMA_SA]) < sizeof(*xsinfo)) {
795 fprintf(stderr, "Buggy XFRM_MSG_DELPOLICY: too short XFRMA_POLICY len\n");
796 return -1;
797 }
798 xsinfo = RTA_DATA(tb[XFRMA_SA]);
799 }
800
801 xfrm_state_info_print(xsinfo, tb, fp, NULL, NULL);
802
803 if (n->nlmsg_type == XFRM_MSG_EXPIRE) {
804 fprintf(fp, "\t");
805 fprintf(fp, "hard %u", xexp->hard);
806 fprintf(fp, "%s", _SL_);
807 }
808
809 if (oneline)
810 fprintf(fp, "\n");
811 fflush(fp);
812
813 return 0;
814 }
815
xfrm_state_get_or_delete(int argc,char ** argv,int delete)816 static int xfrm_state_get_or_delete(int argc, char **argv, int delete)
817 {
818 struct rtnl_handle rth;
819 struct {
820 struct nlmsghdr n;
821 struct xfrm_usersa_id xsid;
822 char buf[RTA_BUF_SIZE];
823 } req;
824 struct xfrm_id id;
825 char *idp = NULL;
826 struct xfrm_mark mark = {0, 0};
827
828 memset(&req, 0, sizeof(req));
829
830 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsid));
831 req.n.nlmsg_flags = NLM_F_REQUEST;
832 req.n.nlmsg_type = delete ? XFRM_MSG_DELSA : XFRM_MSG_GETSA;
833 req.xsid.family = preferred_family;
834
835 while (argc > 0) {
836 xfrm_address_t saddr;
837
838 if (strcmp(*argv, "mark") == 0) {
839 xfrm_parse_mark(&mark, &argc, &argv);
840 } else {
841 if (idp)
842 invarg("unknown", *argv);
843 idp = *argv;
844
845 /* ID */
846 memset(&id, 0, sizeof(id));
847 memset(&saddr, 0, sizeof(saddr));
848 xfrm_id_parse(&saddr, &id, &req.xsid.family, 0,
849 &argc, &argv);
850
851 memcpy(&req.xsid.daddr, &id.daddr, sizeof(req.xsid.daddr));
852 req.xsid.spi = id.spi;
853 req.xsid.proto = id.proto;
854
855 addattr_l(&req.n, sizeof(req.buf), XFRMA_SRCADDR,
856 (void *)&saddr, sizeof(saddr));
857 }
858
859 argc--; argv++;
860 }
861
862 if (mark.m & mark.v) {
863 int r = addattr_l(&req.n, sizeof(req.buf), XFRMA_MARK,
864 (void *)&mark, sizeof(mark));
865 if (r < 0) {
866 fprintf(stderr, "XFRMA_MARK failed\n");
867 exit(1);
868 }
869 }
870
871 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
872 exit(1);
873
874 if (req.xsid.family == AF_UNSPEC)
875 req.xsid.family = AF_INET;
876
877 if (delete) {
878 if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0)
879 exit(2);
880 } else {
881 char buf[NLMSG_BUF_SIZE];
882 struct nlmsghdr *res_n = (struct nlmsghdr *)buf;
883
884 memset(buf, 0, sizeof(buf));
885
886 if (rtnl_talk(&rth, &req.n, 0, 0, res_n) < 0)
887 exit(2);
888
889 if (xfrm_state_print(NULL, res_n, (void*)stdout) < 0) {
890 fprintf(stderr, "An error :-)\n");
891 exit(1);
892 }
893 }
894
895 rtnl_close(&rth);
896
897 return 0;
898 }
899
900 /*
901 * With an existing state of nlmsg, make new nlmsg for deleting the state
902 * and store it to buffer.
903 */
xfrm_state_keep(const struct sockaddr_nl * who,struct nlmsghdr * n,void * arg)904 static int xfrm_state_keep(const struct sockaddr_nl *who,
905 struct nlmsghdr *n,
906 void *arg)
907 {
908 struct xfrm_buffer *xb = (struct xfrm_buffer *)arg;
909 struct rtnl_handle *rth = xb->rth;
910 struct xfrm_usersa_info *xsinfo = NLMSG_DATA(n);
911 int len = n->nlmsg_len;
912 struct nlmsghdr *new_n;
913 struct xfrm_usersa_id *xsid;
914
915 if (n->nlmsg_type != XFRM_MSG_NEWSA) {
916 fprintf(stderr, "Not a state: %08x %08x %08x\n",
917 n->nlmsg_len, n->nlmsg_type, n->nlmsg_flags);
918 return 0;
919 }
920
921 len -= NLMSG_LENGTH(sizeof(*xsinfo));
922 if (len < 0) {
923 fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
924 return -1;
925 }
926
927 if (!xfrm_state_filter_match(xsinfo))
928 return 0;
929
930 if (xb->offset > xb->size) {
931 fprintf(stderr, "State buffer overflow\n");
932 return -1;
933 }
934
935 new_n = (struct nlmsghdr *)(xb->buf + xb->offset);
936 new_n->nlmsg_len = NLMSG_LENGTH(sizeof(*xsid));
937 new_n->nlmsg_flags = NLM_F_REQUEST;
938 new_n->nlmsg_type = XFRM_MSG_DELSA;
939 new_n->nlmsg_seq = ++rth->seq;
940
941 xsid = NLMSG_DATA(new_n);
942 xsid->family = xsinfo->family;
943 memcpy(&xsid->daddr, &xsinfo->id.daddr, sizeof(xsid->daddr));
944 xsid->spi = xsinfo->id.spi;
945 xsid->proto = xsinfo->id.proto;
946
947 addattr_l(new_n, xb->size, XFRMA_SRCADDR, &xsinfo->saddr,
948 sizeof(xsid->daddr));
949
950 xb->offset += new_n->nlmsg_len;
951 xb->nlmsg_count ++;
952
953 return 0;
954 }
955
xfrm_state_list_or_deleteall(int argc,char ** argv,int deleteall)956 static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall)
957 {
958 char *idp = NULL;
959 struct rtnl_handle rth;
960
961 if(argc > 0)
962 filter.use = 1;
963 filter.xsinfo.family = preferred_family;
964
965 while (argc > 0) {
966 if (strcmp(*argv, "mode") == 0) {
967 NEXT_ARG();
968 xfrm_mode_parse(&filter.xsinfo.mode, &argc, &argv);
969
970 filter.mode_mask = XFRM_FILTER_MASK_FULL;
971
972 } else if (strcmp(*argv, "reqid") == 0) {
973 NEXT_ARG();
974 xfrm_reqid_parse(&filter.xsinfo.reqid, &argc, &argv);
975
976 filter.reqid_mask = XFRM_FILTER_MASK_FULL;
977
978 } else if (strcmp(*argv, "flag") == 0) {
979 NEXT_ARG();
980 xfrm_state_flag_parse(&filter.xsinfo.flags, &argc, &argv);
981
982 filter.state_flags_mask = XFRM_FILTER_MASK_FULL;
983
984 } else {
985 if (idp)
986 invarg("unknown", *argv);
987 idp = *argv;
988
989 /* ID */
990 xfrm_id_parse(&filter.xsinfo.saddr, &filter.xsinfo.id,
991 &filter.xsinfo.family, 1, &argc, &argv);
992 if (preferred_family == AF_UNSPEC)
993 preferred_family = filter.xsinfo.family;
994 }
995 argc--; argv++;
996 }
997
998 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
999 exit(1);
1000
1001 if (deleteall) {
1002 struct xfrm_buffer xb;
1003 char buf[NLMSG_DELETEALL_BUF_SIZE];
1004 int i;
1005
1006 xb.buf = buf;
1007 xb.size = sizeof(buf);
1008 xb.rth = &rth;
1009
1010 for (i = 0; ; i++) {
1011 xb.offset = 0;
1012 xb.nlmsg_count = 0;
1013
1014 if (show_stats > 1)
1015 fprintf(stderr, "Delete-all round = %d\n", i);
1016
1017 if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETSA) < 0) {
1018 perror("Cannot send dump request");
1019 exit(1);
1020 }
1021
1022 if (rtnl_dump_filter(&rth, xfrm_state_keep, &xb) < 0) {
1023 fprintf(stderr, "Delete-all terminated\n");
1024 exit(1);
1025 }
1026 if (xb.nlmsg_count == 0) {
1027 if (show_stats > 1)
1028 fprintf(stderr, "Delete-all completed\n");
1029 break;
1030 }
1031
1032 if (rtnl_send_check(&rth, xb.buf, xb.offset) < 0) {
1033 perror("Failed to send delete-all request\n");
1034 exit(1);
1035 }
1036 if (show_stats > 1)
1037 fprintf(stderr, "Delete-all nlmsg count = %d\n", xb.nlmsg_count);
1038
1039 xb.offset = 0;
1040 xb.nlmsg_count = 0;
1041 }
1042
1043 } else {
1044 if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETSA) < 0) {
1045 perror("Cannot send dump request");
1046 exit(1);
1047 }
1048
1049 if (rtnl_dump_filter(&rth, xfrm_state_print, stdout) < 0) {
1050 fprintf(stderr, "Dump terminated\n");
1051 exit(1);
1052 }
1053 }
1054
1055 rtnl_close(&rth);
1056
1057 exit(0);
1058 }
1059
print_sadinfo(struct nlmsghdr * n,void * arg)1060 int print_sadinfo(struct nlmsghdr *n, void *arg)
1061 {
1062 FILE *fp = (FILE*)arg;
1063 __u32 *f = NLMSG_DATA(n);
1064 struct rtattr *tb[XFRMA_SAD_MAX+1];
1065 struct rtattr *rta;
1066 __u32 *cnt;
1067
1068 int len = n->nlmsg_len;
1069
1070 len -= NLMSG_LENGTH(sizeof(__u32));
1071 if (len < 0) {
1072 fprintf(stderr, "SADinfo: Wrong len %d\n", len);
1073 return -1;
1074 }
1075
1076 rta = XFRMSAPD_RTA(f);
1077 parse_rtattr(tb, XFRMA_SAD_MAX, rta, len);
1078
1079 if (tb[XFRMA_SAD_CNT]) {
1080 fprintf(fp,"\t SAD");
1081 cnt = (__u32 *)RTA_DATA(tb[XFRMA_SAD_CNT]);
1082 fprintf(fp," count %d", *cnt);
1083 } else {
1084 fprintf(fp,"BAD SAD info returned\n");
1085 return -1;
1086 }
1087
1088 if (show_stats) {
1089 if (tb[XFRMA_SAD_HINFO]) {
1090 struct xfrmu_sadhinfo *si;
1091
1092 if (RTA_PAYLOAD(tb[XFRMA_SAD_HINFO]) < sizeof(*si)) {
1093 fprintf(fp,"BAD SAD length returned\n");
1094 return -1;
1095 }
1096
1097 si = RTA_DATA(tb[XFRMA_SAD_HINFO]);
1098 fprintf(fp," (buckets ");
1099 fprintf(fp,"count %d", si->sadhcnt);
1100 fprintf(fp," Max %d", si->sadhmcnt);
1101 fprintf(fp,")");
1102 }
1103 }
1104 fprintf(fp,"\n");
1105
1106 return 0;
1107 }
1108
xfrm_sad_getinfo(int argc,char ** argv)1109 static int xfrm_sad_getinfo(int argc, char **argv)
1110 {
1111 struct rtnl_handle rth;
1112 struct {
1113 struct nlmsghdr n;
1114 __u32 flags;
1115 char ans[64];
1116 } req;
1117
1118 memset(&req, 0, sizeof(req));
1119 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.flags));
1120 req.n.nlmsg_flags = NLM_F_REQUEST;
1121 req.n.nlmsg_type = XFRM_MSG_GETSADINFO;
1122 req.flags = 0XFFFFFFFF;
1123
1124 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1125 exit(1);
1126
1127 if (rtnl_talk(&rth, &req.n, 0, 0, &req.n) < 0)
1128 exit(2);
1129
1130 print_sadinfo(&req.n, (void*)stdout);
1131
1132 rtnl_close(&rth);
1133
1134 return 0;
1135 }
1136
xfrm_state_flush(int argc,char ** argv)1137 static int xfrm_state_flush(int argc, char **argv)
1138 {
1139 struct rtnl_handle rth;
1140 struct {
1141 struct nlmsghdr n;
1142 struct xfrm_usersa_flush xsf;
1143 } req;
1144 char *protop = NULL;
1145
1146 memset(&req, 0, sizeof(req));
1147
1148 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsf));
1149 req.n.nlmsg_flags = NLM_F_REQUEST;
1150 req.n.nlmsg_type = XFRM_MSG_FLUSHSA;
1151 req.xsf.proto = 0;
1152
1153 while (argc > 0) {
1154 if (strcmp(*argv, "proto") == 0) {
1155 int ret;
1156
1157 if (protop)
1158 duparg("proto", *argv);
1159 protop = *argv;
1160
1161 NEXT_ARG();
1162
1163 ret = xfrm_xfrmproto_getbyname(*argv);
1164 if (ret < 0)
1165 invarg("\"XFRM-PROTO\" is invalid", *argv);
1166
1167 req.xsf.proto = (__u8)ret;
1168 } else
1169 invarg("unknown", *argv);
1170
1171 argc--; argv++;
1172 }
1173
1174 if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
1175 exit(1);
1176
1177 if (show_stats > 1)
1178 fprintf(stderr, "Flush state proto=%s\n",
1179 strxf_xfrmproto(req.xsf.proto));
1180
1181 if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0)
1182 exit(2);
1183
1184 rtnl_close(&rth);
1185
1186 return 0;
1187 }
1188
do_xfrm_state(int argc,char ** argv)1189 int do_xfrm_state(int argc, char **argv)
1190 {
1191 if (argc < 1)
1192 return xfrm_state_list_or_deleteall(0, NULL, 0);
1193
1194 if (matches(*argv, "add") == 0)
1195 return xfrm_state_modify(XFRM_MSG_NEWSA, 0,
1196 argc-1, argv+1);
1197 if (matches(*argv, "update") == 0)
1198 return xfrm_state_modify(XFRM_MSG_UPDSA, 0,
1199 argc-1, argv+1);
1200 if (matches(*argv, "allocspi") == 0)
1201 return xfrm_state_allocspi(argc-1, argv+1);
1202 if (matches(*argv, "delete") == 0)
1203 return xfrm_state_get_or_delete(argc-1, argv+1, 1);
1204 if (matches(*argv, "deleteall") == 0 || matches(*argv, "delall") == 0)
1205 return xfrm_state_list_or_deleteall(argc-1, argv+1, 1);
1206 if (matches(*argv, "list") == 0 || matches(*argv, "show") == 0
1207 || matches(*argv, "lst") == 0)
1208 return xfrm_state_list_or_deleteall(argc-1, argv+1, 0);
1209 if (matches(*argv, "get") == 0)
1210 return xfrm_state_get_or_delete(argc-1, argv+1, 0);
1211 if (matches(*argv, "flush") == 0)
1212 return xfrm_state_flush(argc-1, argv+1);
1213 if (matches(*argv, "count") == 0) {
1214 return xfrm_sad_getinfo(argc, argv);
1215 }
1216 if (matches(*argv, "help") == 0)
1217 usage();
1218 fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm state help\".\n", *argv);
1219 exit(-1);
1220 }
1221