matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

xfrm security context support 

Adds security context support to ip xfrm state.

Signed-off-by: Joy Latten <latten@austin.ibm.com>
This commit is contained in:
Joy Latten 2011-02-02 17:32:59 -06:00 committed by Stephen Hemminger
parent e5055b591b
commit 4bb75da2d0
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
ip/xfrm_state.c
View File

@ -50,12 +50,13 @@
#define NLMSG_BUF_SIZE 4096 #define NLMSG_BUF_SIZE 4096
#define RTA_BUF_SIZE 2048 #define RTA_BUF_SIZE 2048
#define XFRM_ALGO_KEY_BUF_SIZE 512 #define XFRM_ALGO_KEY_BUF_SIZE 512
#define CTX_BUF_SIZE 256
static void usage(void) __attribute__((noreturn)); static void usage(void) __attribute__((noreturn));
static void usage(void) static void usage(void)
{ {
fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ XFRM_OPT ] [ mode MODE ]\n"); fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ XFRM_OPT ] [ ctx SEC_CTX ] [ mode MODE ]\n");
fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ replay-window SIZE ] [ flag FLAG-LIST ]\n"); fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ replay-window SIZE ] [ flag FLAG-LIST ]\n");
fprintf(stderr, " [ encap ENCAP ] [ sel SELECTOR ] [ replay-seq SEQ ]\n"); fprintf(stderr, " [ encap ENCAP ] [ sel SELECTOR ] [ replay-seq SEQ ]\n");
fprintf(stderr, " [ replay-oseq SEQ ] [ LIMIT-LIST ]\n"); fprintf(stderr, " [ replay-oseq SEQ ] [ LIMIT-LIST ]\n");
@ -246,10 +247,16 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
char *aalgop = NULL; char *aalgop = NULL;
char *calgop = NULL; char *calgop = NULL;
char *coap = NULL; char *coap = NULL;
char *sctxp = NULL;
struct xfrm_mark mark = {0, 0}; struct xfrm_mark mark = {0, 0};
struct {
struct xfrm_user_sec_ctx sctx;
char str[CTX_BUF_SIZE];
} ctx;
memset(&req, 0, sizeof(req)); memset(&req, 0, sizeof(req));
memset(&replay, 0, sizeof(replay)); memset(&replay, 0, sizeof(replay));
memset(&ctx, 0, sizeof(ctx));
req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo)); req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.xsinfo));
req.n.nlmsg_flags = NLM_F_REQUEST|flags; req.n.nlmsg_flags = NLM_F_REQUEST|flags;
@ -333,6 +340,19 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
addattr_l(&req.n, sizeof(req.buf), XFRMA_COADDR, addattr_l(&req.n, sizeof(req.buf), XFRMA_COADDR,
(void *)&xcoa, sizeof(xcoa)); (void *)&xcoa, sizeof(xcoa));
} else if (strcmp(*argv, "ctx") == 0) {
char *context;
if (sctxp)
duparg("ctx", *argv);
sctxp = *argv;
NEXT_ARG();
context = *argv;
xfrm_sctx_parse((char *)&ctx.str, context, &ctx.sctx);
addattr_l(&req.n, sizeof(req.buf), XFRMA_SEC_CTX,
(void *)&ctx, ctx.sctx.len);
} else { } else {
/* try to assume ALGO */ /* try to assume ALGO */
int type = xfrm_algotype_getbyname(*argv); int type = xfrm_algotype_getbyname(*argv);