From patchwork Tue Nov 23 15:02:39 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Timo Teras X-Patchwork-Id: 72681 X-Patchwork-Delegate: shemminger@vyatta.com Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 9E8CBB7384 for ; Wed, 24 Nov 2010 02:03:06 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754891Ab0KWPDB (ORCPT ); Tue, 23 Nov 2010 10:03:01 -0500 Received: from mail-ew0-f46.google.com ([209.85.215.46]:45460 "EHLO mail-ew0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754744Ab0KWPDA (ORCPT ); Tue, 23 Nov 2010 10:03:00 -0500 Received: by ewy5 with SMTP id 5so2473743ewy.19 for ; Tue, 23 Nov 2010 07:02:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:from:to:cc:subject :date:message-id:x-mailer:mime-version:content-type :content-transfer-encoding; bh=y3/nDbli0b8+h8mZDIvbFqH4BYpUaSFC6so6fAhRojQ=; b=TaMLjPajQQKmmrM4qzbhLXVhuyucu0Vw1qo8oBLQDkPFn4ZHRUl7QV2prmlJC8DzVq CjNDmwV9CFR5aqce91eMM5OmCRKHv4hvMe4bh7zz5HuDhsMF4xwFcX55i8qgY3T3h4N0 xsTSI9Ui/K3Sn6yK0rUQzXgdBWgM6CQUQEcFY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:from:to:cc:subject:date:message-id:x-mailer:mime-version :content-type:content-transfer-encoding; b=Fd1KgyaXp4oRMcKt14kwEXFAeurJJCqzYNauYS/t+3VyJAi7IoJxx3VWspj+21vsGF 2E3YBDGf+XOb7EqF2yesP5lbrx64V7XbQT1X3lh/OTmgMIPI/lJfeXA4mrqNfXeprnwb +MwhWVYGWn5rRBhRp7CVOI03SsM5mIPYaIXPc= Received: by 10.213.8.147 with SMTP id h19mr6808042ebh.85.1290524578440; Tue, 23 Nov 2010 07:02:58 -0800 (PST) Received: from vostro.ism.fin.wtbts.net (mail.fi.jw.org [83.145.235.193]) by mx.google.com with ESMTPS id x54sm5884371eeh.5.2010.11.23.07.02.57 (version=SSLv3 cipher=RC4-MD5); Tue, 23 Nov 2010 07:02:57 -0800 (PST) From: =?UTF-8?q?Timo=20Ter=C3=A4s?= To: shemminger@osdl.org, netdev@vger.kernel.org Cc: =?UTF-8?q?Timo=20Ter=C3=A4s?= Subject: [PATCH] iproute2: support xfrm upper protocol gre key Date: Tue, 23 Nov 2010 17:02:39 +0200 Message-Id: <1290524559-22086-1-git-send-email-timo.teras@iki.fi> X-Mailer: git-send-email 1.7.1 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The gre key handling is consistent with ip tunnel side: both dotted-quad and number are accepted, but dotted-quad is used for printing. Signed-off-by: Timo Teräs --- This is the userland part for: http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git;a=commitdiff;h=cc9ff19da9bf76a2f70bcb80225a1c587c162e52 However, that commit is flawed, and for this patch to work properly, the following patch is needed: http://patchwork.ozlabs.org/patch/72668/ ip/ipxfrm.c | 42 ++++++++++++++++++++++++++++++++++++++++++ ip/xfrm_policy.c | 3 ++- man/man8/ip.8 | 25 ++++++++++++++++--------- 3 files changed, 60 insertions(+), 10 deletions(-) diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 99a6756..cf4b7c7 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -35,6 +35,7 @@ #include #include #include +#include #include "utils.h" #include "xfrm.h" @@ -483,6 +484,14 @@ void xfrm_selector_print(struct xfrm_selector *sel, __u16 family, if (sel->dport_mask) fprintf(fp, "code %u ", ntohs(sel->dport)); break; + case IPPROTO_GRE: + if (sel->sport_mask || sel->dport_mask) { + struct in_addr key; + key.s_addr = htonl((ntohs(sel->sport) << 16) + ntohs(sel->dport)); + inet_ntop(AF_INET, &key, abuf, sizeof(abuf)); + fprintf(fp, "key %s ", abuf); + } + break; case IPPROTO_MH: if (sel->sport_mask) fprintf(fp, "type %u ", ntohs(sel->sport)); @@ -1086,6 +1095,7 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel, char *dportp = NULL; char *typep = NULL; char *codep = NULL; + char *grekey = NULL; while (1) { if (strcmp(*argv, "proto") == 0) { @@ -1162,6 +1172,29 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel, filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL; + } else if (strcmp(*argv, "key") == 0) { + unsigned key; + + grekey = *argv; + + NEXT_ARG(); + + if (strchr(*argv, '.')) + key = htonl(get_addr32(*argv)); + else { + if (get_unsigned(&key, *argv, 0)<0) { + fprintf(stderr, "invalid value of \"key\"\n"); + exit(-1); + } + } + + sel->sport = htons(key >> 16); + sel->dport = htons(key & 0xffff); + sel->sport_mask = ~((__u16)0); + sel->dport_mask = ~((__u16)0); + + filter.upspec_dport_mask = XFRM_FILTER_MASK_FULL; + } else { PREV_ARG(); /* back track */ break; @@ -1196,6 +1229,15 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel, exit(1); } } + if (grekey) { + switch (sel->proto) { + case IPPROTO_GRE: + break; + default: + fprintf(stderr, "\"key\" is invalid with proto=%s\n", strxf_proto(sel->proto)); + exit(1); + } + } *argcp = argc; *argvp = argv; diff --git a/ip/xfrm_policy.c b/ip/xfrm_policy.c index 121afa1..dcb3da4 100644 --- a/ip/xfrm_policy.c +++ b/ip/xfrm_policy.c @@ -66,7 +66,8 @@ static void usage(void) fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC ] [ dev DEV ]\n"); fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n"); - fprintf(stderr, " [ type NUMBER ] [ code NUMBER ] ]\n"); + fprintf(stderr, " [ type NUMBER ] [ code NUMBER ] |\n"); + fprintf(stderr, " [ key { DOTTED_QUAD | NUMBER } ] ]\n"); //fprintf(stderr, "DEV - device name(default=none)\n"); diff --git a/man/man8/ip.8 b/man/man8/ip.8 index 1a73efa..c1e03f3 100644 --- a/man/man8/ip.8 +++ b/man/man8/ip.8 @@ -547,7 +547,10 @@ throw " | " unreachable " | " prohibit " | " blackhole " | " nat " ]" .RB " [ " type .IR NUMBER " ] " .RB " [ " code -.IR NUMBER " ]] " +.IR NUMBER " ] | " +.br +.RB " [ " key +.IR KEY " ]] " .ti -8 .IR LIMIT-LIST " := [ " LIMIT-LIST " ] |" @@ -642,7 +645,10 @@ throw " | " unreachable " | " prohibit " | " blackhole " | " nat " ]" .RB " [ " type .IR NUMBER " ] " .RB " [ " code -.IR NUMBER " ] ] " +.IR NUMBER " ] | " +.br +.RB " [ " key +.IR KEY " ] ] " .ti -8 .IR ACTION " := " @@ -2487,9 +2493,11 @@ is defined by source port .BR sport ", " destination port .BR dport ", " type -as number and +as number, .B code -also number. +also number and +.BR key +as dotted-quad or number. .TP .BI dev " DEV " @@ -2556,11 +2564,10 @@ and the other choice is .TP .IR UPSPEC is specified by -.BR sport ", " -.BR dport ", " type -and -.B code -(NUMBER). +.BR sport " and " dport " (for UDP/TCP), " +.BR type " and " code " (for ICMP; as number) or " +.BR key " (for GRE; as dotted-quad or number)." +. .SS ip xfrm monitor - is used for listing all objects or defined group of them. The