Skip to content

Commit d3c0a2c

Browse files
hujun-openaboch
hujun-open
authored and
aboch
committed
- fixes #815
- changes: 1. set userTmpl.Family to correct family 2. add Selector to XfrmState which is corresponding to XfrmUsersaInfo.Sel - update *XfrmAddress.ToIPNet method to support 0.0.0.0/0 and ::/0 correctly - update xfrmStateFromXfrmUsersaInfo to get XfrmState.Selector - extend TestXfrmStateAddGetDel for v6ov4 and v4ov6 cases
1 parent d3b7a6f commit d3c0a2c

File tree

5 files changed

+111
-11
lines changed

5 files changed

+111
-11
lines changed

‎nl/xfrm_linux.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,15 @@ func (x *XfrmAddress) ToIP() net.IP {
131131
return ip
132132
}
133133

134-
func (x *XfrmAddress) ToIPNet(prefixlen uint8) *net.IPNet {
134+
// family is only used when x and prefixlen are both 0
135+
func (x *XfrmAddress) ToIPNet(prefixlen uint8, family uint16) *net.IPNet {
136+
empty := [SizeofXfrmAddress]byte{}
137+
if bytes.Equal(x[:], empty[:]) && prefixlen == 0 {
138+
if family == FAMILY_V6 {
139+
return &net.IPNet{IP: net.ParseIP("::"), Mask: net.CIDRMask(int(prefixlen), 128)}
140+
}
141+
return &net.IPNet{IP: net.ParseIP("0.0.0.0"), Mask: net.CIDRMask(int(prefixlen), 32)}
142+
}
135143
ip := x.ToIP()
136144
if GetIPFamily(ip) == FAMILY_V4 {
137145
return &net.IPNet{IP: ip, Mask: net.CIDRMask(int(prefixlen), 32)}

‎xfrm_policy_linux.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ func (h *Handle) xfrmPolicyAddOrUpdate(policy *XfrmPolicy, nlProto int) error {
7575
userTmpl := nl.DeserializeXfrmUserTmpl(tmplData[start : start+nl.SizeofXfrmUserTmpl])
7676
userTmpl.XfrmId.Daddr.FromIP(tmpl.Dst)
7777
userTmpl.Saddr.FromIP(tmpl.Src)
78+
userTmpl.Family = uint16(nl.GetIPFamily(tmpl.Dst))
7879
userTmpl.XfrmId.Proto = uint8(tmpl.Proto)
7980
userTmpl.XfrmId.Spi = nl.Swap32(uint32(tmpl.Spi))
8081
userTmpl.Mode = uint8(tmpl.Mode)
@@ -223,8 +224,8 @@ func parseXfrmPolicy(m []byte, family int) (*XfrmPolicy, error) {
223224

224225
var policy XfrmPolicy
225226

226-
policy.Dst = msg.Sel.Daddr.ToIPNet(msg.Sel.PrefixlenD)
227-
policy.Src = msg.Sel.Saddr.ToIPNet(msg.Sel.PrefixlenS)
227+
policy.Dst = msg.Sel.Daddr.ToIPNet(msg.Sel.PrefixlenD, uint16(family))
228+
policy.Src = msg.Sel.Saddr.ToIPNet(msg.Sel.PrefixlenS, uint16(family))
228229
policy.Proto = Proto(msg.Sel.Proto)
229230
policy.DstPort = int(nl.Swap16(msg.Sel.Dport))
230231
policy.SrcPort = int(nl.Swap16(msg.Sel.Sport))

‎xfrm_state.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ type XfrmState struct {
117117
DontEncapDSCP bool
118118
OSeqMayWrap bool
119119
Replay *XfrmReplayState
120+
Selector *XfrmPolicy
120121
}
121122

122123
func (sa XfrmState) String() string {

‎xfrm_state_linux.go‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,6 @@ func (h *Handle) xfrmStateAllocSpi(state *XfrmState) (*XfrmState, error) {
209209
msg.Min = 0x100
210210
msg.Max = 0xffffffff
211211
req.AddData(msg)
212-
213212
if state.Mark != nil {
214213
out := nl.NewRtAttr(nl.XFRMA_MARK, writeMark(state.Mark))
215214
req.AddData(out)
@@ -337,7 +336,6 @@ var familyError = fmt.Errorf("family error")
337336

338337
func xfrmStateFromXfrmUsersaInfo(msg *nl.XfrmUsersaInfo) *XfrmState {
339338
var state XfrmState
340-
341339
state.Dst = msg.Id.Daddr.ToIP()
342340
state.Src = msg.Saddr.ToIP()
343341
state.Proto = Proto(msg.Id.Proto)
@@ -347,20 +345,25 @@ func xfrmStateFromXfrmUsersaInfo(msg *nl.XfrmUsersaInfo) *XfrmState {
347345
state.ReplayWindow = int(msg.ReplayWindow)
348346
lftToLimits(&msg.Lft, &state.Limits)
349347
curToStats(&msg.Curlft, &msg.Stats, &state.Statistics)
348+
state.Selector = &XfrmPolicy{
349+
Dst: msg.Sel.Daddr.ToIPNet(msg.Sel.PrefixlenD, msg.Sel.Family),
350+
Src: msg.Sel.Saddr.ToIPNet(msg.Sel.PrefixlenS, msg.Sel.Family),
351+
Proto: Proto(msg.Sel.Proto),
352+
DstPort: int(nl.Swap16(msg.Sel.Dport)),
353+
SrcPort: int(nl.Swap16(msg.Sel.Sport)),
354+
Ifindex: int(msg.Sel.Ifindex),
355+
}
350356

351357
return &state
352358
}
353359

354360
func parseXfrmState(m []byte, family int) (*XfrmState, error) {
355361
msg := nl.DeserializeXfrmUsersaInfo(m)
356-
357362
// This is mainly for the state dump
358363
if family != FAMILY_ALL && family != int(msg.Family) {
359364
return nil, familyError
360365
}
361-
362366
state := xfrmStateFromXfrmUsersaInfo(msg)
363-
364367
attrs, err := nl.ParseRouteAttr(m[nl.SizeofXfrmUsersaInfo:])
365368
if err != nil {
366369
return nil, err
@@ -515,6 +518,9 @@ func xfrmUsersaInfoFromXfrmState(state *XfrmState) *nl.XfrmUsersaInfo {
515518
msg.Id.Spi = nl.Swap32(uint32(state.Spi))
516519
msg.Reqid = uint32(state.Reqid)
517520
msg.ReplayWindow = uint8(state.ReplayWindow)
518-
521+
msg.Sel = nl.XfrmSelector{}
522+
if state.Selector != nil {
523+
selFromPolicy(&msg.Sel, state.Selector)
524+
}
519525
return msg
520526
}

‎xfrm_state_test.go‎

Lines changed: 86 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
//go:build linux
12
// +build linux
23

34
package netlink
@@ -11,7 +12,12 @@ import (
1112
)
1213

1314
func TestXfrmStateAddGetDel(t *testing.T) {
14-
for _, s := range []*XfrmState{getBaseState(), getAeadState()} {
15+
for _, s := range []*XfrmState{
16+
getBaseState(),
17+
getAeadState(),
18+
getBaseStateV6oV4(),
19+
getBaseStateV4oV6(),
20+
} {
1521
testXfrmStateAddGetDel(t, s)
1622
}
1723
}
@@ -26,7 +32,6 @@ func testXfrmStateAddGetDel(t *testing.T, state *XfrmState) {
2632
if err != nil {
2733
t.Fatal(err)
2834
}
29-
3035
if len(states) != 1 {
3136
t.Fatal("State not added properly")
3237
}
@@ -77,6 +82,7 @@ func TestXfrmStateAllocSpi(t *testing.T) {
7782
t.Fatalf("SPI is not allocated")
7883
}
7984
rstate.Spi = 0
85+
8086
if !compareStates(state, rstate) {
8187
t.Fatalf("State not properly allocated")
8288
}
@@ -268,6 +274,21 @@ func TestXfrmStateWithOutputMarkAndMask(t *testing.T) {
268274
t.Fatal(err)
269275
}
270276
}
277+
func genStateSelectorForV6Payload() *XfrmPolicy {
278+
_, wildcardV6Net, _ := net.ParseCIDR("::/0")
279+
return &XfrmPolicy{
280+
Src: wildcardV6Net,
281+
Dst: wildcardV6Net,
282+
}
283+
}
284+
285+
func genStateSelectorForV4Payload() *XfrmPolicy {
286+
_, wildcardV4Net, _ := net.ParseCIDR("0.0.0.0/0")
287+
return &XfrmPolicy{
288+
Src: wildcardV4Net,
289+
Dst: wildcardV4Net,
290+
}
291+
}
271292

272293
func getBaseState() *XfrmState {
273294
return &XfrmState{
@@ -292,6 +313,54 @@ func getBaseState() *XfrmState {
292313
}
293314
}
294315

316+
func getBaseStateV4oV6() *XfrmState {
317+
return &XfrmState{
318+
// Force 4 byte notation for the IPv4 addressesd
319+
Src: net.ParseIP("2001:dead::1").To16(),
320+
Dst: net.ParseIP("2001:beef::1").To16(),
321+
Proto: XFRM_PROTO_ESP,
322+
Mode: XFRM_MODE_TUNNEL,
323+
Spi: 1,
324+
Auth: &XfrmStateAlgo{
325+
Name: "hmac(sha256)",
326+
Key: []byte("abcdefghijklmnopqrstuvwzyzABCDEF"),
327+
},
328+
Crypt: &XfrmStateAlgo{
329+
Name: "cbc(aes)",
330+
Key: []byte("abcdefghijklmnopqrstuvwzyzABCDEF"),
331+
},
332+
Mark: &XfrmMark{
333+
Value: 0x12340000,
334+
Mask: 0xffff0000,
335+
},
336+
Selector: genStateSelectorForV4Payload(),
337+
}
338+
}
339+
340+
func getBaseStateV6oV4() *XfrmState {
341+
return &XfrmState{
342+
// Force 4 byte notation for the IPv4 addressesd
343+
Src: net.ParseIP("192.168.1.1").To4(),
344+
Dst: net.ParseIP("192.168.2.2").To4(),
345+
Proto: XFRM_PROTO_ESP,
346+
Mode: XFRM_MODE_TUNNEL,
347+
Spi: 1,
348+
Auth: &XfrmStateAlgo{
349+
Name: "hmac(sha256)",
350+
Key: []byte("abcdefghijklmnopqrstuvwzyzABCDEF"),
351+
},
352+
Crypt: &XfrmStateAlgo{
353+
Name: "cbc(aes)",
354+
Key: []byte("abcdefghijklmnopqrstuvwzyzABCDEF"),
355+
},
356+
Mark: &XfrmMark{
357+
Value: 0x12340000,
358+
Mask: 0xffff0000,
359+
},
360+
Selector: genStateSelectorForV6Payload(),
361+
}
362+
}
363+
295364
func getAeadState() *XfrmState {
296365
// 128 key bits + 32 salt bits
297366
k, _ := hex.DecodeString("d0562776bf0e75830ba3f7f8eb6c09b555aa1177")
@@ -309,6 +378,14 @@ func getAeadState() *XfrmState {
309378
},
310379
}
311380
}
381+
func compareSelector(a, b *XfrmPolicy) bool {
382+
return a.Src.String() == b.Src.String() &&
383+
a.Dst.String() == b.Dst.String() &&
384+
a.Proto == b.Proto &&
385+
a.DstPort == b.DstPort &&
386+
a.SrcPort == b.SrcPort &&
387+
a.Ifindex == b.Ifindex
388+
}
312389

313390
func compareStates(a, b *XfrmState) bool {
314391
if a == b {
@@ -317,6 +394,12 @@ func compareStates(a, b *XfrmState) bool {
317394
if a == nil || b == nil {
318395
return false
319396
}
397+
if a.Selector != nil && b.Selector != nil {
398+
if !compareSelector(a.Selector, b.Selector) {
399+
return false
400+
}
401+
}
402+
320403
return a.Src.Equal(b.Src) && a.Dst.Equal(b.Dst) &&
321404
a.Mode == b.Mode && a.Spi == b.Spi && a.Proto == b.Proto &&
322405
a.Ifid == b.Ifid &&
@@ -325,6 +408,7 @@ func compareStates(a, b *XfrmState) bool {
325408
compareAlgo(a.Aead, b.Aead) &&
326409
compareMarks(a.Mark, b.Mark) &&
327410
compareMarks(a.OutputMark, b.OutputMark)
411+
328412
}
329413

330414
func compareLimits(a, b *XfrmState) bool {

0 commit comments

Comments
 (0)