netdev - [PATCH v2 iproute2 -next 2/2] ipxfrm: allow to setup filter when dumping SA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1395247928-9954-2-git-send-email-nicolas.dichtel@6wind.com>
Date:	Wed, 19 Mar 2014 17:52:08 +0100
From:	Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:	shemminger@...tta.com
Cc:	netdev@...r.kernel.org, Nicolas Dichtel <nicolas.dichtel@...nd.com>
Subject: [PATCH v2 iproute2 -next 2/2] ipxfrm: allow to setup filter when dumping SA

It's now possible to filter SA directly into the kernel by specifying
XFRMA_PROTO and/or XFRMA_ADDRESS_FILTER.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>
---

Note that this patch is intended to work with net-next.

 ip/xfrm_state.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index 140a4503b799..8295223f8118 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -1136,7 +1136,35 @@ static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall)
 		}
 
 	} else {
-		if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETSA) < 0) {
+		struct xfrm_address_filter addrfilter;
+		struct {
+			struct nlmsghdr n;
+			char buf[NLMSG_BUF_SIZE];
+		} req;
+
+		memset(&addrfilter, 0, sizeof(addrfilter));
+		addrfilter.family = filter.xsinfo.family;
+		memcpy(&addrfilter.saddr, &filter.xsinfo.saddr,
+		       sizeof(xfrm_address_t));
+		addrfilter.splen = filter.id_src_mask;
+		memcpy(&addrfilter.daddr, &filter.xsinfo.id.daddr,
+		       sizeof(xfrm_address_t));
+		addrfilter.dplen = filter.id_dst_mask;
+
+		memset(&req, 0, sizeof(req));
+		req.n.nlmsg_len = NLMSG_HDRLEN;
+		req.n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST;
+		req.n.nlmsg_type = XFRM_MSG_GETSA;
+		req.n.nlmsg_pid = 0;
+		req.n.nlmsg_seq = rth.dump = ++rth.seq;
+
+		if (filter.xsinfo.id.proto)
+			addattr8(&req.n, sizeof(req), XFRMA_PROTO,
+				 filter.xsinfo.id.proto);
+		addattr_l(&req.n, sizeof(req), XFRMA_ADDRESS_FILTER,
+			  &addrfilter, sizeof(addrfilter));
+
+		if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
 			perror("Cannot send dump request");
 			exit(1);
 		}
-- 
1.8.5.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html