XFRM: Mobile IPv6 route optimization support.
Subsystems (2)
PATCH 5/7 XFRM: Mobile IPv6 route optimization support.
To support Mobile IPv6 RO, the following extension is included:
o Use XFRM_MODE_XXX macro instead of magic number
o New attribute option for all state: source address for deleting or getting message
o New attribute options for RO: care-of address, last-used timestamp and wild-receive flag
Note:
Flush command like ip xfrm state flush is to remove all XFRM state. It has been effected for IPsec SAD but with this patch it flushes both IPsec SAD and Mobile IPv6 RO states.
To make only IPsec SA flush, it is recommanded to specify each XFRM protocol like below:
ip x s f proto esp ; ip x s f proto ah ; ip x s f proto comp
Signed-off-by Masahide NAKAMURA <[email protected]>
--- ip/ipxfrm.c | 84 ++++++++++++++++++++++++++++++++++++++---- ip/xfrm.h | 2 + ip/xfrm_policy.c | 7 ++-- ip/xfrm_state.c | 107 ++++++++++++++++++++++++++++++++++++++++++++---------- 4 files changed, 169 insertions(+), 31 deletions(-)
ip/ipxfrm.c +76 -8
@@ -94,6 +94,19 @@ int xfrm_addr_match(xfrm_address_t *x1,return 0 ; } +int xfrm_xfrmproto_is_ipsec (__u8 proto) +{ +return (proto ==IPPROTO_ESP || + proto ==IPPROTO_AH || + proto ==IPPROTO_COMP ); +} + +int xfrm_xfrmproto_is_ro (__u8 proto) +{ +return (proto ==IPPROTO_ROUTING || + proto ==IPPROTO_DSTOPTS ); +} +struct typeent {const char *t_name;int t_type;
@@ -101,6 +114,7 @@ struct typeent {static const struct typeent xfrmproto_types[]= { {"esp" ,IPPROTO_ESP }, {"ah" ,IPPROTO_AH }, {"comp" ,IPPROTO_COMP }, + {"route2" ,IPPROTO_ROUTING }, {"hao" ,IPPROTO_DSTOPTS }, {NULL ,-1 } };
@@ -276,13 +290,19 @@ void xfrm_id_info_print(xfrm_address_t *fprintf (fp,"mode " );switch (mode) { -case 0 : +case XFRM_MODE_TRANSPORT :fprintf (fp,"transport" );break ; -case 1 : +case XFRM_MODE_TUNNEL :fprintf (fp,"tunnel" );break ; -case 4 : +case XFRM_MODE_ROUTEOPTIMIZATION : +fprintf (fp,"ro" ); +break ; +case XFRM_MODE_IN_TRIGGER : +fprintf (fp,"in_trigger" ); +break ; +case XFRM_MODE_BEET :fprintf (fp,"beet" );break ;default :
@@ -643,6 +663,48 @@ void xfrm_xfrma_print(struct rtattr *tb[xfrm_tmpl_print ((struct xfrm_user_tmpl *)RTA_DATA (rta),RTA_PAYLOAD (rta), family, fp, prefix); } + +if (tb[XFRMA_COADDR ]) { +char abuf[256 ]; +xfrm_address_t *coa; + +if (prefix) +fprintf (fp, prefix); +fprintf (fp,"coa " ); + + coa = (xfrm_address_t *)RTA_DATA (tb[XFRMA_COADDR ]); + +if (RTA_PAYLOAD (tb[XFRMA_COADDR ]) <sizeof (*coa)) { +fprintf (fp,"(ERROR truncated)" ); +fprintf (fp,"%s" , _SL_); +return ; + } + +memset (abuf,'\0' ,sizeof (abuf)); +fprintf (fp,"%s" , +rt_addr_n2a (family,sizeof (*coa), coa, + abuf,sizeof (abuf))); +fprintf (fp,"%s" , _SL_); + } + +if (tb[XFRMA_LASTUSED ]) { +__u64 lastused; + +if (prefix) +fprintf (fp, prefix); +fprintf (fp,"lastused " ); + +if (RTA_PAYLOAD (tb[XFRMA_LASTUSED ]) <sizeof (lastused)) { +fprintf (fp,"(ERROR truncated)" ); +fprintf (fp,"%s" , _SL_); +return ; + } + + lastused = *(__u64 *)RTA_DATA (tb[XFRMA_LASTUSED ]); + +fprintf (fp,"%s" ,strxf_time (lastused)); +fprintf (fp,"%s" , _SL_); + } }static int xfrm_selector_iszero (struct xfrm_selector *s)
@@ -659,12 +721,13 @@ void xfrm_state_info_print(struct xfrm_u const char *title) {char buf[STRBUF_SIZE ]; +int force_spi =xfrm_xfrmproto_is_ipsec (xsinfo->id.proto);memset (buf,'\0' ,sizeof (buf));xfrm_id_info_print (&xsinfo->saddr, &xsinfo->id, xsinfo->mode, - xsinfo->reqid, xsinfo->family,1 , fp, prefix, - title); + xsinfo->reqid, xsinfo->family, force_spi, fp, + prefix, title);if (prefix)STRBUF_CAT (buf, prefix);
@@ -680,6 +743,7 @@ void xfrm_state_info_print(struct xfrm_ufprintf (fp,"flag " );XFRM_FLAG_PRINT (fp, flags,XFRM_STATE_NOECN ,"noecn" );XFRM_FLAG_PRINT (fp, flags,XFRM_STATE_DECAP_DSCP ,"decap-dscp" ); +XFRM_FLAG_PRINT (fp, flags,XFRM_STATE_WILDRECV ,"wildrecv" );if (flags)fprintf (fp,"%x" , flags);if (show_stats >0 )
@@ -884,11 +948,15 @@ int xfrm_mode_parse(__u8 *mode, int *argchar **argv = *argvp;if (matches (*argv,"transport" ) ==0 ) - *mode =0 ; + *mode =XFRM_MODE_TRANSPORT ;else if (matches (*argv,"tunnel" ) ==0 ) - *mode =1 ; + *mode =XFRM_MODE_TUNNEL ; +else if (matches (*argv,"ro" ) ==0 ) + *mode =XFRM_MODE_ROUTEOPTIMIZATION ; +else if (matches (*argv,"in_trigger" ) ==0 ) + *mode =XFRM_MODE_IN_TRIGGER ;else if (matches (*argv,"beet" ) ==0 ) - *mode =4 ; + *mode =XFRM_MODE_BEET ;else invarg ("\"MODE\" is invalid" , *argv);
ip/xfrm.h +2 -0
@@ -110,6 +110,8 @@ int do_xfrm_policy(int argc, char **argvint do_xfrm_monitor (int argc,char **argv);int xfrm_addr_match (xfrm_address_t *x1,xfrm_address_t *x2,int bits); +int xfrm_xfrmproto_is_ipsec (__u8 proto); +int xfrm_xfrmproto_is_ro (__u8 proto);int xfrm_xfrmproto_getbyname (char *name);int xfrm_algotype_getbyname (char *name);const char *strxf_xfrmproto (__u8 proto);
ip/xfrm_policy.c +4 -3
@@ -82,12 +82,13 @@ static void usage(void)fprintf (stderr,"TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]\n" );fprintf (stderr,"ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM_PROTO ] [ spi SPI ]\n" ); -//fprintf(stderr, "XFRM_PROTO := [ esp | ah | comp ]\n"); fprintf (stderr,"XFRM_PROTO := [ " );fprintf (stderr,"%s | " ,strxf_xfrmproto (IPPROTO_ESP ));fprintf (stderr,"%s | " ,strxf_xfrmproto (IPPROTO_AH )); -fprintf (stderr,"%s" ,strxf_xfrmproto (IPPROTO_COMP )); -fprintf (stderr," ]\n" ); +fprintf (stderr,"%s | " ,strxf_xfrmproto (IPPROTO_COMP )); +fprintf (stderr,"%s | " ,strxf_xfrmproto (IPPROTO_ROUTING )); +fprintf (stderr,"%s " ,strxf_xfrmproto (IPPROTO_DSTOPTS )); +fprintf (stderr,"]\n" );fprintf (stderr,"MODE := [ transport | tunnel | beet ](default=transport)\n" );//fprintf(stderr, "REQID - number(default=0)\n");
ip/xfrm_state.c +87 -20
190 lines not on this page · raw message
Signature · 1 line
1.4.2