From: Masahide Nakamura <nakam@linux-ipv6.org>
To: Stephen Hemminger <shemminger@osdl.org>
Cc: netdev@oss.sgi.com, linux-net@vger.kernel.org, nakam@linux-ipv6.org
Subject: [PATCH] [iproute2] XFRM: support ICMP/ICMPv6's type and code
Date: Mon, 6 Sep 2004 16:47:42 +0900 [thread overview]
Message-ID: <20040906164742.54795bf4@localhost> (raw)
This patch supports ICMP/ICMPv6's type and code in IPsec
selector. Kernel has supported this feature from 2.6.9-rc1.
The ChangeSet is also available at:
<bk://bk.skbuff.net:38000/iproute2-icmp/>
# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
# 2004/09/01 14:45:04+09:00 nakam@linux-ipv6.org
# support ICMP and ICMPv6's type/code for IPsec.
#
# ip/xfrm_state.c
# 2004/09/01 14:44:59+09:00 nakam@linux-ipv6.org +3 -1
# fix usage.
#
# ip/xfrm_policy.c
# 2004/09/01 14:44:59+09:00 nakam@linux-ipv6.org +2 -1
# fix usage.
#
# ip/ipxfrm.c
# 2004/09/01 14:44:59+09:00 nakam@linux-ipv6.org +75 -4
# ICMP and ICMPv6's type/code can be specified in selector.
# fix to show sport/dport values when mask is specified.
#
diff -Nru a/ip/ipxfrm.c b/ip/ipxfrm.c
--- a/ip/ipxfrm.c 2004-09-02 23:08:19 +09:00
+++ b/ip/ipxfrm.c 2004-09-02 23:08:19 +09:00
@@ -352,10 +352,25 @@
if (sel->proto)
fprintf(fp, "proto %s ", strxf_proto(sel->proto));
- if (sel->sport)
- fprintf(fp, "sport %u ", ntohs(sel->sport));
- if (sel->dport)
- fprintf(fp, "dport %u ", ntohs(sel->dport));
+ switch (sel->proto) {
+ case IPPROTO_TCP:
+ case IPPROTO_UDP:
+ case IPPROTO_SCTP:
+ default: /* XXX */
+ if (sel->sport_mask)
+ fprintf(fp, "sport %u ", ntohs(sel->sport));
+ if (sel->dport_mask)
+ fprintf(fp, "dport %u ", ntohs(sel->dport));
+ break;
+ case IPPROTO_ICMP:
+ case IPPROTO_ICMPV6:
+ /* type/code is stored at sport/dport in selector */
+ if (sel->sport_mask)
+ fprintf(fp, "type %u ", ntohs(sel->sport));
+ if (sel->dport_mask)
+ fprintf(fp, "code %u ", ntohs(sel->dport));
+ break;
+ }
if (sel->ifindex > 0) {
char buf[IF_NAMESIZE];
@@ -653,6 +668,10 @@
{
int argc = *argcp;
char **argv = *argvp;
+ char *sportp = NULL;
+ char *dportp = NULL;
+ char *typep = NULL;
+ char *codep = NULL;
while (1) {
if (strcmp(*argv, "proto") == 0) {
@@ -677,6 +696,8 @@
filter.upspec_proto_mask = XFRM_FILTER_MASK_FULL;
} else if (strcmp(*argv, "sport") == 0) {
+ sportp = *argv;
+
NEXT_ARG();
if (get_u16(&sel->sport, *argv, 0))
@@ -688,6 +709,8 @@
filter.upspec_sport_mask = XFRM_FILTER_MASK_FULL;
} else if (strcmp(*argv, "dport") == 0) {
+ dportp = *argv;
+
NEXT_ARG();
if (get_u16(&sel->dport, *argv, 0))
@@ -698,6 +721,33 @@
filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL;
+ } else if (strcmp(*argv, "type") == 0) {
+ typep = *argv;
+
+ NEXT_ARG();
+
+ if (get_u16(&sel->sport, *argv, 0) ||
+ (sel->sport & ~((__u16)0xff)))
+ invarg("\"type\" value is invalid", *argv);
+ sel->sport = htons(sel->sport);
+ sel->sport_mask = ~((__u16)0);
+
+ filter.upspec_sport_mask = XFRM_FILTER_MASK_FULL;
+
+
+ } else if (strcmp(*argv, "code") == 0) {
+ codep = *argv;
+
+ NEXT_ARG();
+
+ if (get_u16(&sel->dport, *argv, 0) ||
+ (sel->dport & ~((__u16)0xff)))
+ invarg("\"code\" value is invalid", *argv);
+ sel->dport = htons(sel->dport);
+ sel->dport_mask = ~((__u16)0);
+
+ filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL;
+
} else {
PREV_ARG(); /* back track */
break;
@@ -709,6 +759,27 @@
}
if (argc == *argcp)
missarg("UPSPEC");
+ if (sportp || dportp) {
+ switch (sel->proto) {
+ case IPPROTO_TCP:
+ case IPPROTO_UDP:
+ case IPPROTO_SCTP:
+ break;
+ default:
+ fprintf(stderr, "\"sport\" and \"dport\" are invalid with proto=%s\n", strxf_proto(sel->proto));
+ exit(1);
+ }
+ }
+ if (typep || codep) {
+ switch (sel->proto) {
+ case IPPROTO_ICMP:
+ case IPPROTO_ICMPV6:
+ break;
+ default:
+ fprintf(stderr, "\"type\" and \"code\" are invalid with proto=%s\n", strxf_proto(sel->proto));
+ exit(1);
+ }
+ }
*argcp = argc;
*argvp = argv;
diff -Nru a/ip/xfrm_policy.c b/ip/xfrm_policy.c
--- a/ip/xfrm_policy.c 2004-09-02 23:08:19 +09:00
+++ b/ip/xfrm_policy.c 2004-09-02 23:08:19 +09:00
@@ -62,7 +62,8 @@
fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC ] [ dev DEV ]\n");
- fprintf(stderr, "UPSPEC := proto PROTO [ sport PORT ] [ dport PORT ]\n");
+ fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n");
+ fprintf(stderr, " [ type NUMBER ] [ code NUMBER ] ]\n");
//fprintf(stderr, "DEV - device name(default=none)\n");
diff -Nru a/ip/xfrm_state.c b/ip/xfrm_state.c
--- a/ip/xfrm_state.c 2004-09-02 23:08:19 +09:00
+++ b/ip/xfrm_state.c 2004-09-02 23:08:19 +09:00
@@ -91,7 +91,9 @@
fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ upspec UPSPEC ] [ dev DEV ]\n");
- fprintf(stderr, "UPSPEC := proto PROTO [ sport PORT ] [ dport PORT ]\n");
+ fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n");
+ fprintf(stderr, " [ type NUMBER ] [ code NUMBER ] ]\n");
+
//fprintf(stderr, "DEV - device name(default=none)\n");
fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] | [ limit LIMIT ]\n");
--
Masahide NAKAMURA
next reply other threads:[~2004-09-06 7:47 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-06 7:47 Masahide Nakamura [this message]
2004-09-28 18:46 ` [PATCH] [iproute2] XFRM: support ICMP/ICMPv6's type and code Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20040906164742.54795bf4@localhost \
--to=nakam@linux-ipv6.org \
--cc=linux-net@vger.kernel.org \
--cc=netdev@oss.sgi.com \
--cc=shemminger@osdl.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).