Skip to contentSkip to conversation

POLICY: Support netlink socket interface for sub policy.

PATCH In review Masahide NAKAMURA 2 participants 3 messages Jul 29, 2006 – Aug 2, 2006

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Masahide NAKAMURA

author
#0 lore raw

PATCH 22/23 POLICY: Support netlink socket interface for sub policy.

Sub policy can be used through netlink socket. (PF_KEY uses main only and it is TODO to support sub.)

---
 include/linux/xfrm.h |    6 +++++
 include/net/xfrm.h   |    1 +
 net/key/af_key.c     |   13 +++++++----
 net/xfrm/xfrm_user.c |   60 +++++++++++++++++++++++++++++++++++++++++++-------
 4 files changed, 66 insertions(+), 14 deletions(-)
include/linux/xfrm.h +6 -0
index 901bb65..68d3443 100644
@@ -303,12 +303,14 @@ #define XFRM_POLICY_BLOCK	1
 	__u8				flags;
 #define XFRM_POLICY_LOCALOK	1	/* Allow user to override global policy */
 	__u8				share;
+	__u8				type;
 };
 
 struct xfrm_userpolicy_id {
 	struct xfrm_selector		sel;
 	__u32				index;
 	__u8				dir;
+	__u8				type;
 };
 
 struct xfrm_user_acquire {

@@ -336,6 +338,10 @@ struct xfrm_usersa_flush {
 	__u8				proto;
 };
 
+struct xfrm_userpolicy_flush {
+	__u8			        type;
+};
+
 /*
  * This notifies flow information to the user space with carrying XFRMA_ADDR.
  */
include/net/xfrm.h +1 -0
index c1cc2f5..0d14b1f 100644
@@ -202,6 +202,7 @@ struct km_event
 		u32 proto;
 		u32 byid;
 		u32 aevent;
+		u32 type;
 	} data;
 
 	u32	seq;
net/key/af_key.c +8 -5
index ed2d712..2bc9665 100644
@@ -1730,7 +1730,8 @@ static u32 gen_reqid(void)
 		++reqid;
 		if (reqid == 0)
 			reqid = IPSEC_MANUAL_REQID_MAX+1;
-		if (xfrm_policy_walk(check_reqid, (void*)&reqid) != -EEXIST)
+		if (xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, check_reqid,
+				     (void*)&reqid) != -EEXIST)
 			return reqid;
 	} while (reqid != start);
 	return 0;

@@ -2267,7 +2268,8 @@ static int pfkey_spddelete(struct sock *
 			return err;
 	}
 
-	xp = xfrm_policy_bysel_ctx(pol->sadb_x_policy_dir-1, &sel, tmp.security, 1);
+	xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1,
+				   &sel, tmp.security, 1);
 	security_xfrm_policy_free(&tmp);
 	if (xp == NULL)
 		return -ENOENT;

@@ -2326,7 +2328,7 @@ static int pfkey_spdget(struct sock *sk,
 	if (dir >= XFRM_POLICY_MAX)
 		return -EINVAL;
 
-	xp = xfrm_policy_byid(dir, pol->sadb_x_policy_id,
+	xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id,
 			      hdr->sadb_msg_type == SADB_X_SPDDELETE2);
 	if (xp == NULL)
 		return -ENOENT;

@@ -2374,7 +2376,7 @@ static int pfkey_spddump(struct sock *sk
 {
 	struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk };
 
-	return xfrm_policy_walk(dump_sp, &data);
+	return xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_sp, &data);
 }
 
 static int key_notify_policy_flush(struct km_event *c)

@@ -2401,7 +2403,8 @@ static int pfkey_spdflush(struct sock *s
 {
 	struct km_event c;
 
-	xfrm_policy_flush();
+	xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN);
+	c.data.type = XFRM_POLICY_TYPE_MAIN;
 	c.event = XFRM_MSG_FLUSHPOLICY;
 	c.pid = hdr->sadb_msg_pid;
 	c.seq = hdr->sadb_msg_seq;
net/xfrm/xfrm_user.c +51 -9

146 lines not on this page · raw message

Signature · 1 line
1.4.1
maintainer
#1 lore raw

From: Masahide NAKAMURA <[email protected]>
Date: Sat, 29 Jul 2006 18:30:55 +0900

Quoted 9 lines
include/linux/xfrm.h +1 -0
index 901bb65..68d3443 100644
@@ -303,12 +303,14 @@ #define XFRM_POLICY_BLOCK	1
 	__u8				flags;
 #define XFRM_POLICY_LOCALOK	1	/* Allow user to override global policy */
 	__u8				share;
+	__u8				type;

include/linux/xfrm.h #define XFRM_POLICY_BLOCK 1 · line 316

Quoted 10 lines
include/linux/xfrm.h +1 -0
 };
 
 struct xfrm_userpolicy_id {
 	struct xfrm_selector		sel;
 	__u32				index;
 	__u8				dir;
+	__u8				type;
 };
 
 struct xfrm_user_acquire {

Again, these are user visible data structures which cannot be modified without changing the API. Please use another xfrm netlink attribute or similar to pass this information.

author
#2 lore raw
Quoted 21 lines · David Miller

From: Masahide NAKAMURA <[email protected]>
Date: Sat, 29 Jul 2006 18:30:55 +0900

Quoted 18 lines
include/linux/xfrm.h +2 -0
index 901bb65..68d3443 100644
@@ -303,12 +303,14 @@ #define XFRM_POLICY_BLOCK	1
 	__u8				flags;
 #define XFRM_POLICY_LOCALOK	1	/* Allow user to override global policy */
 	__u8				share;
+	__u8				type;
 };
 
 struct xfrm_userpolicy_id {
 	struct xfrm_selector		sel;
 	__u32				index;
 	__u8				dir;
+	__u8				type;
 };
Quoted 5 lines

include/linux/xfrm.h #define XFRM_POLICY_BLOCK 1 · line 316

Quoted 1 line
include/linux/xfrm.h +0 -0
 struct xfrm_user_acquire {

Again, these are user visible data structures which cannot be modified without changing the API. Please use another xfrm netlink attribute or similar to pass this information.

I'll try to add XFRMA_POLICY_TYPE for this case.
Thanks,

Signature · 1 line
Masahide NAKAMURA