[SOLVED] how to add xfrm state add using c program

samiran.linux · 04-22-2014, 06:07 AM

Hi,
how to make a security association entry using xfrm c code?? http://www.croz.net/eng/xfrm-programming/ from this I get idea to add policy and same I am using for state.. The sample code is given below but it outputs "RTNETLINK answers: Invalid argument" .. Any Help??

int xfrm_state_add (struct in_addr *saddr, struct in_addr *daddr , int spi) {
int preferred_family = AF_INET;

struct rtnl_handle rth;
struct {
struct nlmsghdr n;
struct xfrm_usersa_info xsinfo;
char buf[ RTA_BUF_SIZE ];
} req;

char tmpls_buf[XFRM_TMPLS_BUF_SIZE];
int tmpls_len = 0;
int idx;

char auth_algo_buf[XFRM_TMPLS_BUF_SIZE];
char enc_algo_buf[XFRM_TMPLS_BUF_SIZE];
int auth_algobuf_len = 0;
int enc_algobuf_len = 0;

memset(&req, 0, sizeof(req));
memset(&auth_algo_buf, 0, sizeof(auth_algo_buf));
memset(&enc_algo_buf, 0, sizeof(enc_algo_buf));

req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo));
req.n.nlmsg_flags = NLM_F_REQUEST|NLM_F_CREATE|NLM_F_EXCL;
req.n.nlmsg_type = XFRM_MSG_NEWSA;
req.xsinfo.family = preferred_family;

req.xsinfo.lft.soft_byte_limit = XFRM_INF;
req.xsinfo.lft.hard_byte_limit = XFRM_INF;
req.xsinfo.lft.soft_packet_limit = XFRM_INF;
req.xsinfo.lft.hard_packet_limit = XFRM_INF;

req.xsinfo.saddr.a4 = saddr->s_addr;

req.xsinfo.id.daddr.a4 = daddr->s_addr;
req.xsinfo.id.spi = (__u32) spi;
req.xsinfo.id.proto = IPPROTO_ESP;

req.xsinfo.mode = 1;

struct xfrm_algo *AuthAlgo = NULL, *EncAlgo = NULL;

if( auth_algobuf_len + sizeof(struct xfrm_algo) > sizeof( auth_algo_buf ) )
{ fprintf( stderr, "buffer overflow\n" ); exit(1); }
AuthAlgo = (struct xfrm_algo *)((char *)auth_algo_buf + auth_algobuf_len);

strcpy(AuthAlgo->alg_name,"hmac(sha256)");
AuthAlgo->alg_key_len = 256;
strncpy(AuthAlgo->alg_key,"12345678901234567890123456789012",32);

auth_algobuf_len += sizeof( *AuthAlgo );

if (auth_algobuf_len > 0)
{ addattr_l(&req.n, sizeof(req), XFRMA_ALG_AUTH, (void *)auth_algo_buf, auth_algobuf_len); }

if( enc_algobuf_len + sizeof(struct xfrm_algo) > sizeof( enc_algo_buf ) )
{ fprintf( stderr, " ** ERROR Too many tmpls: buffer overflow\n" ); exit(1); }

EncAlgo = (struct xfrm_algo *)((char *)enc_algo_buf + enc_algobuf_len);

strcpy(EncAlgo->alg_name,"cbc(aes)");
EncAlgo->alg_key_len = 128;
strncpy(EncAlgo->alg_key,"1234567890123456",16);

enc_algobuf_len += sizeof( *EncAlgo );

if (enc_algobuf_len > 0)
{ addattr_l(&req.n, sizeof(req), XFRMA_ALG_CRYPT, (void *)enc_algo_buf, enc_algobuf_len); }

if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
{ printf( " ** ERROR xfrm_state_add::rtnl_open_byproto()\n" ); exit(1); }

if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0)
{ printf( " ** ERROR State add rtnl_talk()\n" ); exit(2); }

rtnl_close(&rth);

return 0;
}

samiran.linux · 04-22-2014, 10:09 AM

I have solved the problem ... Actually what I have done is that instead of allocating buffer for struct xfrm_algo using a character buffer, I have declared a structure like below
struct {
struct xfrm_algo algo
char Buff[512];
} EncAlgo = {};

This will alocate buffer for xfrm_key[0]...