src/libstrongswan/selectors/traffic_selector.c

   1 /*
   2  * Copyright (C) 2007-2017 Tobias Brunner
   3  * Copyright (C) 2005-2007 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 #include <string.h>
  19 #include <stdio.h>
  20
  21 #include "traffic_selector.h"
  22
  23 #include <utils/debug.h>
  24 #include <utils/utils.h>
  25 #include <utils/identification.h>
  26 #include <collections/linked_list.h>
  27
  28 #define IPV4_LEN        4
  29 #define IPV6_LEN        16
  30 #define TS_IP_LEN(this) ({ ((this)->type == TS_IPV4_ADDR_RANGE) ? IPV4_LEN : IPV6_LEN; })
  31
  32 #define NON_SUBNET_ADDRESS_RANGE        255
  33
  34 ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_IPV6_ADDR_RANGE,
  35         "TS_IPV4_ADDR_RANGE",
  36         "TS_IPV6_ADDR_RANGE",
  37 );
  38
  39 typedef struct private_traffic_selector_t private_traffic_selector_t;
  40
  41 /**
  42  * Private data of an traffic_selector_t object
  43  */
  44 struct private_traffic_selector_t {
  45
  46         /**
  47          * Public part
  48          */
  49         traffic_selector_t public;
  50
  51         /**
  52          * Type of address
  53          */
  54         ts_type_t type;
  55
  56         /**
  57          * IP protocol (UDP, TCP, ICMP, ...)
  58          */
  59         uint8_t protocol;
  60
  61         /**
  62          * narrow this traffic selector to hosts external ip
  63          * if set, from and to have no meaning until set_address() is called
  64          */
  65         bool dynamic;
  66
  67         /**
  68          * subnet size in CIDR notation, 255 means a non-subnet address range
  69          */
  70         uint8_t netbits;
  71
  72         /**
  73          * begin of address range, network order
  74          */
  75         char from[IPV6_LEN];
  76
  77         /**
  78          * end of address range, network order
  79          */
  80         char to[IPV6_LEN];
  81
  82         /**
  83          * begin of port range
  84          */
  85         uint16_t from_port;
  86
  87         /**
  88          * end of port range
  89          */
  90         uint16_t to_port;
  91 };
  92
  93 /**
  94  * calculate the "to"-address for the "from" address and a subnet size
  95  */
  96 static void calc_range(private_traffic_selector_t *this, uint8_t netbits)
  97 {
  98         size_t len;
  99         int bytes, bits;
 100         uint8_t mask;
 101
 102         this->netbits = netbits;
 103
 104         len   = TS_IP_LEN(this);
 105         bytes = (netbits + 7)/8;
 106         bits  = (bytes * 8) - netbits;
 107         mask  = bits ? (1 << bits) - 1 : 0;
 108
 109         memcpy(this->to, this->from, bytes);
 110         memset(this->from + bytes, 0x00, len - bytes);
 111         memset(this->to   + bytes, 0xff, len - bytes);
 112         this->from[bytes-1] &= ~mask;
 113         this->to[bytes-1]   |=  mask;
 114 }
 115
 116 /**
 117  * calculate the subnet size from the "to" and "from" addresses
 118  */
 119 static uint8_t calc_netbits(private_traffic_selector_t *this)
 120 {
 121         int byte, bit;
 122         uint8_t netbits;
 123         size_t size = TS_IP_LEN(this);
 124         bool prefix = TRUE;
 125
 126         /* a perfect match results in a single address with a /32 or /128 netmask */
 127         netbits = (size * 8);
 128         this->netbits = netbits;
 129
 130         /* go through all bits of the addresses, beginning in the front.
 131          * as long as they are equal, the subnet gets larger
 132          */
 133         for (byte = 0; byte < size; byte++)
 134         {
 135                 for (bit = 7; bit >= 0; bit--)
 136                 {
 137                         uint8_t bitmask = 1 << bit;
 138
 139                         if (prefix)
 140                         {
 141                                 if ((bitmask & this->from[byte]) != (bitmask & this->to[byte]))
 142                                 {
 143                                         /* store the common prefix which might be a true subnet */
 144                                         netbits = (7 - bit) + (byte * 8);
 145                                         this->netbits = netbits;
 146                                         prefix = FALSE;
 147                                 }
 148                         }
 149                         else
 150                         {
 151                                 if ((bitmask & this->from[byte]) || !(bitmask & this->to[byte]))
 152                                 {
 153                                         this->netbits = NON_SUBNET_ADDRESS_RANGE;
 154                                         return netbits;  /* return a pseudo subnet */
 155
 156                                 }
 157                         }
 158                 }
 159         }
 160         return netbits;  /* return a true subnet */
 161 }
 162
 163 /**
 164  * internal generic constructor
 165  */
 166 static private_traffic_selector_t *traffic_selector_create(uint8_t protocol,
 167                                                 ts_type_t type, uint16_t from_port, uint16_t to_port);
 168
 169 /**
 170  * Check if TS contains "opaque" ports
 171  */
 172 static bool is_opaque(private_traffic_selector_t *this)
 173 {
 174         return this->from_port == 0xffff && this->to_port == 0;
 175 }
 176
 177 /**
 178  * Check if TS contains "any" ports
 179  */
 180 static bool is_any(private_traffic_selector_t *this)
 181 {
 182         return this->from_port == 0 && this->to_port == 0xffff;
 183 }
 184
 185 /**
 186  * Print ICMP/ICMPv6 type and code
 187  */
 188 static int print_icmp(printf_hook_data_t *data, uint16_t port)
 189 {
 190         uint8_t type, code;
 191
 192         type = traffic_selector_icmp_type(port);
 193         code = traffic_selector_icmp_code(port);
 194         if (code)
 195         {
 196                 return print_in_hook(data, "%d(%d)", type, code);
 197         }
 198         return print_in_hook(data, "%d", type);
 199 }
 200
 201 /**
 202  * Described in header.
 203  */
 204 int traffic_selector_printf_hook(printf_hook_data_t *data,
 205                                                         printf_hook_spec_t *spec, const void *const *args)
 206 {
 207         private_traffic_selector_t *this = *((private_traffic_selector_t**)(args[0]));
 208         linked_list_t *list = *((linked_list_t**)(args[0]));
 209         enumerator_t *enumerator;
 210         char from_str[INET6_ADDRSTRLEN] = "";
 211         char to_str[INET6_ADDRSTRLEN] = "";
 212         char *serv_proto = NULL, *sep = "";
 213         bool has_proto, has_ports;
 214         size_t written = 0, len;
 215         char from[IPV6_LEN], to[IPV6_LEN];
 216
 217         if (this == NULL)
 218         {
 219                 return print_in_hook(data, "(null)");
 220         }
 221
 222         if (spec->hash)
 223         {
 224                 enumerator = list->create_enumerator(list);
 225                 while (enumerator->enumerate(enumerator, (void**)&this))
 226                 {
 227                         written += print_in_hook(data, "%s%R", sep, this);
 228                         sep = " ";
 229                 }
 230                 enumerator->destroy(enumerator);
 231                 return written;
 232         }
 233
 234         len = TS_IP_LEN(this);
 235         memset(from, 0, len);
 236         memset(to, 0xFF, len);
 237         if (this->dynamic &&
 238                 memeq(this->from, from, len) && memeq(this->to, to, len))
 239         {
 240                 written += print_in_hook(data, "dynamic");
 241         }
 242         else
 243         {
 244                 if (this->type == TS_IPV4_ADDR_RANGE)
 245                 {
 246                         inet_ntop(AF_INET, &this->from, from_str, sizeof(from_str));
 247                 }
 248                 else
 249                 {
 250                         inet_ntop(AF_INET6, &this->from, from_str, sizeof(from_str));
 251                 }
 252                 if (this->netbits == NON_SUBNET_ADDRESS_RANGE)
 253                 {
 254                         if (this->type == TS_IPV4_ADDR_RANGE)
 255                         {
 256                                 inet_ntop(AF_INET, &this->to, to_str, sizeof(to_str));
 257                         }
 258                         else
 259                         {
 260                                 inet_ntop(AF_INET6, &this->to, to_str, sizeof(to_str));
 261                         }
 262                         written += print_in_hook(data, "%s..%s", from_str, to_str);
 263                 }
 264                 else
 265                 {
 266                         written += print_in_hook(data, "%s/%d", from_str, this->netbits);
 267                 }
 268         }
 269
 270         /* check if we have protocol and/or port selectors */
 271         has_proto = this->protocol != 0;
 272         has_ports = !is_any(this);
 273
 274         if (!has_proto && !has_ports)
 275         {
 276                 return written;
 277         }
 278
 279         written += print_in_hook(data, "[");
 280
 281         /* build protocol string */
 282         if (has_proto)
 283         {
 284                 struct protoent *proto = getprotobynumber(this->protocol);
 285
 286                 if (proto)
 287                 {
 288                         written += print_in_hook(data, "%s", proto->p_name);
 289                         serv_proto = proto->p_name;
 290                 }
 291                 else
 292                 {
 293                         written += print_in_hook(data, "%d", this->protocol);
 294                 }
 295         }
 296
 297         if (has_proto && has_ports)
 298         {
 299                 written += print_in_hook(data, "/");
 300         }
 301
 302         /* build port string */
 303         if (has_ports)
 304         {
 305                 if (this->from_port == this->to_port)
 306                 {
 307                         struct servent *serv;
 308
 309                         if (this->protocol == IPPROTO_ICMP ||
 310                                 this->protocol == IPPROTO_ICMPV6)
 311                         {
 312                                 written += print_icmp(data, this->from_port);
 313                         }
 314                         else
 315                         {
 316                                 serv = getservbyport(htons(this->from_port), serv_proto);
 317                                 if (serv)
 318                                 {
 319                                         written += print_in_hook(data, "%s", serv->s_name);
 320                                 }
 321                                 else
 322                                 {
 323                                         written += print_in_hook(data, "%d", this->from_port);
 324                                 }
 325                         }
 326                 }
 327                 else if (is_opaque(this))
 328                 {
 329                         written += print_in_hook(data, "OPAQUE");
 330                 }
 331                 else if (this->protocol == IPPROTO_ICMP ||
 332                                  this->protocol == IPPROTO_ICMPV6)
 333                 {
 334                         written += print_icmp(data, this->from_port);
 335                         written += print_in_hook(data, "-");
 336                         written += print_icmp(data, this->to_port);
 337                 }
 338                 else
 339                 {
 340                         written += print_in_hook(data, "%d-%d",
 341                                                                          this->from_port, this->to_port);
 342                 }
 343         }
 344
 345         written += print_in_hook(data, "]");
 346
 347         return written;
 348 }
 349
 350 METHOD(traffic_selector_t, get_subset, traffic_selector_t*,
 351         private_traffic_selector_t *this, traffic_selector_t *other_public)
 352 {
 353         private_traffic_selector_t *other, *subset;
 354         uint16_t from_port, to_port;
 355         u_char *from, *to;
 356         uint8_t protocol;
 357         size_t size;
 358
 359         other = (private_traffic_selector_t*)other_public;
 360
 361         if (this->dynamic || other->dynamic)
 362         {       /* no set_address() applied, TS has no subset */
 363                 return NULL;
 364         }
 365
 366         if (this->type != other->type)
 367         {
 368                 return NULL;
 369         }
 370
 371         if (this->protocol != other->protocol &&
 372                 this->protocol != 0 && other->protocol != 0)
 373         {
 374                 return NULL;
 375         }
 376         /* select protocol, which is not zero */
 377         protocol = max(this->protocol, other->protocol);
 378
 379         if ((is_opaque(this) && is_opaque(other)) ||
 380                 (is_opaque(this) && is_any(other)) ||
 381                 (is_opaque(other) && is_any(this)))
 382         {
 383                 from_port = 0xffff;
 384                 to_port = 0;
 385         }
 386         else
 387         {
 388                 /* calculate the maximum port range allowed for both */
 389                 from_port = max(this->from_port, other->from_port);
 390                 to_port = min(this->to_port, other->to_port);
 391                 if (from_port > to_port)
 392                 {
 393                         return NULL;
 394                 }
 395         }
 396         size = TS_IP_LEN(this);
 397         /* get higher from-address */
 398         if (memcmp(this->from, other->from, size) > 0)
 399         {
 400                 from = this->from;
 401         }
 402         else
 403         {
 404                 from = other->from;
 405         }
 406         /* get lower to-address */
 407         if (memcmp(this->to, other->to, size) > 0)
 408         {
 409                 to = other->to;
 410         }
 411         else
 412         {
 413                 to = this->to;
 414         }
 415         /* if "from" > "to", we don't have a match */
 416         if (memcmp(from, to, size) > 0)
 417         {
 418                 return NULL;
 419         }
 420
 421         /* we have a match in protocol, port, and address: return it... */
 422         subset = traffic_selector_create(protocol, this->type, from_port, to_port);
 423         memcpy(subset->from, from, size);
 424         memcpy(subset->to, to, size);
 425         calc_netbits(subset);
 426
 427         return &subset->public;
 428 }
 429
 430 METHOD(traffic_selector_t, equals, bool,
 431         private_traffic_selector_t *this, traffic_selector_t *other)
 432 {
 433         return traffic_selector_cmp(&this->public, other, NULL) == 0;
 434 }
 435
 436 METHOD(traffic_selector_t, get_from_address, chunk_t,
 437         private_traffic_selector_t *this)
 438 {
 439         return chunk_create(this->from, TS_IP_LEN(this));
 440 }
 441
 442 METHOD(traffic_selector_t, get_to_address, chunk_t,
 443         private_traffic_selector_t *this)
 444 {
 445         return chunk_create(this->to, TS_IP_LEN(this));
 446 }
 447
 448 METHOD(traffic_selector_t, get_from_port, uint16_t,
 449         private_traffic_selector_t *this)
 450 {
 451         return this->from_port;
 452 }
 453
 454 METHOD(traffic_selector_t, get_to_port, uint16_t,
 455         private_traffic_selector_t *this)
 456 {
 457         return this->to_port;
 458 }
 459
 460 METHOD(traffic_selector_t, get_type, ts_type_t,
 461         private_traffic_selector_t *this)
 462 {
 463         return this->type;
 464 }
 465
 466 METHOD(traffic_selector_t, get_protocol, uint8_t,
 467         private_traffic_selector_t *this)
 468 {
 469         return this->protocol;
 470 }
 471
 472 METHOD(traffic_selector_t, is_host, bool,
 473         private_traffic_selector_t *this, host_t *host)
 474 {
 475         if (host)
 476         {
 477                 chunk_t addr;
 478                 int family = host->get_family(host);
 479
 480                 if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 481                         (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 482                 {
 483                         addr = host->get_address(host);
 484                         if (memeq(addr.ptr, this->from, addr.len) &&
 485                                 memeq(addr.ptr, this->to, addr.len))
 486                         {
 487                                 return TRUE;
 488                         }
 489                 }
 490         }
 491         else
 492         {
 493                 size_t length = TS_IP_LEN(this);
 494
 495                 if (this->dynamic)
 496                 {
 497                         return TRUE;
 498                 }
 499
 500                 if (memeq(this->from, this->to, length))
 501                 {
 502                         return TRUE;
 503                 }
 504         }
 505         return FALSE;
 506 }
 507
 508 METHOD(traffic_selector_t, is_dynamic, bool,
 509         private_traffic_selector_t *this)
 510 {
 511         return this->dynamic;
 512 }
 513
 514 METHOD(traffic_selector_t, set_address, void,
 515         private_traffic_selector_t *this, host_t *host)
 516 {
 517         this->type = host->get_family(host) == AF_INET ? TS_IPV4_ADDR_RANGE
 518                                                                                                    : TS_IPV6_ADDR_RANGE;
 519
 520         if (host->is_anyaddr(host))
 521         {
 522                 memset(this->from, 0x00, sizeof(this->from));
 523                 memset(this->to, 0xFF, sizeof(this->to));
 524                 this->netbits = 0;
 525         }
 526         else
 527         {
 528                 chunk_t from = host->get_address(host);
 529                 memcpy(this->from, from.ptr, from.len);
 530                 memcpy(this->to, from.ptr, from.len);
 531                 this->netbits = from.len * 8;
 532         }
 533         this->dynamic = FALSE;
 534 }
 535
 536 METHOD(traffic_selector_t, is_contained_in, bool,
 537         private_traffic_selector_t *this, traffic_selector_t *other)
 538 {
 539         private_traffic_selector_t *subset;
 540         bool contained_in = FALSE;
 541
 542         subset = (private_traffic_selector_t*)get_subset(this, other);
 543
 544         if (subset)
 545         {
 546                 if (equals(subset, &this->public))
 547                 {
 548                         contained_in = TRUE;
 549                 }
 550                 free(subset);
 551         }
 552         return contained_in;
 553 }
 554
 555 METHOD(traffic_selector_t, includes, bool,
 556         private_traffic_selector_t *this, host_t *host)
 557 {
 558         chunk_t addr;
 559         int family = host->get_family(host);
 560
 561         if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 562                 (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 563         {
 564                 addr = host->get_address(host);
 565
 566                 return memcmp(this->from, addr.ptr, addr.len) <= 0 &&
 567                                 memcmp(this->to, addr.ptr, addr.len) >= 0;
 568         }
 569
 570         return FALSE;
 571 }
 572
 573 METHOD(traffic_selector_t, to_subnet, bool,
 574         private_traffic_selector_t *this, host_t **net, uint8_t *mask)
 575 {
 576         /* there is no way to do this cleanly, as the address range may
 577          * be anything else but a subnet. We use from_addr as subnet
 578          * and try to calculate a usable subnet mask.
 579          */
 580         int family, non_zero_bytes;
 581         uint16_t port = 0;
 582         chunk_t net_chunk;
 583
 584         *mask = (this->netbits == NON_SUBNET_ADDRESS_RANGE) ? calc_netbits(this)
 585                                                                                                                 : this->netbits;
 586
 587         switch (this->type)
 588         {
 589                 case TS_IPV4_ADDR_RANGE:
 590                         family = AF_INET;
 591                         net_chunk.len = IPV4_LEN;
 592                         break;
 593                 case TS_IPV6_ADDR_RANGE:
 594                         family = AF_INET6;
 595                         net_chunk.len = IPV6_LEN;
 596                         break;
 597                 default:
 598                         /* unreachable */
 599                         return FALSE;
 600         }
 601
 602         net_chunk.ptr = malloc(net_chunk.len);
 603         memset(net_chunk.ptr, 0x00, net_chunk.len);
 604         if (*mask)
 605         {
 606                 non_zero_bytes = (*mask + 7) / 8;
 607                 memcpy(net_chunk.ptr, this->from, non_zero_bytes);
 608                 net_chunk.ptr[non_zero_bytes-1] &= 0xFF << (8 * non_zero_bytes - *mask);
 609         }
 610
 611         if (this->to_port == this->from_port)
 612         {
 613                 port = this->to_port;
 614         }
 615
 616         *net = host_create_from_chunk(family, net_chunk, port);
 617         chunk_free(&net_chunk);
 618
 619         return this->netbits != NON_SUBNET_ADDRESS_RANGE;
 620 }
 621
 622 METHOD(traffic_selector_t, clone_, traffic_selector_t*,
 623         private_traffic_selector_t *this)
 624 {
 625         private_traffic_selector_t *clone;
 626         size_t len = TS_IP_LEN(this);
 627
 628         clone = traffic_selector_create(this->protocol, this->type,
 629                                                                         this->from_port, this->to_port);
 630         clone->netbits = this->netbits;
 631         clone->dynamic = this->dynamic;
 632
 633         memcpy(clone->from, this->from, len);
 634         memcpy(clone->to, this->to, len);
 635         return &clone->public;
 636 }
 637
 638 METHOD(traffic_selector_t, hash, u_int,
 639         private_traffic_selector_t *this, u_int hash)
 640 {
 641         return chunk_hash_inc(get_from_address(this),
 642                         chunk_hash_inc(get_to_address(this),
 643                          chunk_hash_inc(chunk_from_thing(this->from_port),
 644                           chunk_hash_inc(chunk_from_thing(this->to_port),
 645                            chunk_hash_inc(chunk_from_thing(this->protocol),
 646                                 hash)))));
 647 }
 648
 649 METHOD(traffic_selector_t, destroy, void,
 650         private_traffic_selector_t *this)
 651 {
 652         free(this);
 653 }
 654
 655 /**
 656  * Compare two integers
 657  */
 658 static int compare_int(int a, int b)
 659 {
 660         return a - b;
 661 }
 662
 663 /*
 664  * See header
 665  */
 666 int traffic_selector_cmp(traffic_selector_t *a_pub, traffic_selector_t *b_pub,
 667                                                  void *opts)
 668 {
 669         private_traffic_selector_t *a, *b;
 670         size_t len;
 671         int res;
 672
 673         a = (private_traffic_selector_t*)a_pub;
 674         b = (private_traffic_selector_t*)b_pub;
 675
 676         /* IPv4 before IPv6 */
 677         res = compare_int(a->type, b->type);
 678         if (res)
 679         {
 680                 return res;
 681         }
 682         len = TS_IP_LEN(a);
 683         /* lower starting subnets first */
 684         res = memcmp(a->from, b->from, len);
 685         if (res)
 686         {
 687                 return res;
 688         }
 689         /* larger subnets first */
 690         res = memcmp(b->to, a->to, len);
 691         if (res)
 692         {
 693                 return res;
 694         }
 695         /* lower protocols first */
 696         res = compare_int(a->protocol, b->protocol);
 697         if (res)
 698         {
 699                 return res;
 700         }
 701         /* lower starting ports first */
 702         res = compare_int(a->from_port, b->from_port);
 703         if (res)
 704         {
 705                 return res;
 706         }
 707         /* larger port ranges first */
 708         return compare_int(b->to_port, a->to_port);
 709 }
 710
 711 /*
 712  * see header
 713  */
 714 traffic_selector_t *traffic_selector_create_from_bytes(uint8_t protocol,
 715                                                                                                 ts_type_t type,
 716                                                                                                 chunk_t from, uint16_t from_port,
 717                                                                                                 chunk_t to, uint16_t to_port)
 718 {
 719         private_traffic_selector_t *this = traffic_selector_create(protocol, type,
 720                                                                                                                         from_port, to_port);
 721
 722         if (!this)
 723         {
 724                 return NULL;
 725         }
 726         if (from.len != to.len || from.len != TS_IP_LEN(this))
 727         {
 728                 free(this);
 729                 return NULL;
 730         }
 731         memcpy(this->from, from.ptr, from.len);
 732         memcpy(this->to, to.ptr, to.len);
 733         calc_netbits(this);
 734         return &this->public;
 735 }
 736
 737 /*
 738  * see header
 739  */
 740 traffic_selector_t *traffic_selector_create_from_rfc3779_format(ts_type_t type,
 741                                                                                                 chunk_t from, chunk_t to)
 742 {
 743         private_traffic_selector_t *this = traffic_selector_create(0, type, 0, 65535);
 744         size_t len;
 745
 746         if (!this)
 747         {
 748                 return NULL;
 749         }
 750         len = TS_IP_LEN(this);
 751
 752         memset(this->from, 0x00, len);
 753         memset(this->to  , 0xff, len);
 754
 755         if (from.len > 1)
 756         {
 757                 memcpy(this->from, from.ptr+1, from.len-1);
 758         }
 759         if (to.len > 1)
 760         {
 761                 uint8_t mask = to.ptr[0] ? (1 << to.ptr[0]) - 1 : 0;
 762
 763                 memcpy(this->to, to.ptr+1, to.len-1);
 764                 this->to[to.len-2] |= mask;
 765         }
 766         calc_netbits(this);
 767         return &this->public;
 768 }
 769
 770 /*
 771  * see header
 772  */
 773 traffic_selector_t *traffic_selector_create_from_subnet(host_t *net,
 774                                                         uint8_t netbits, uint8_t protocol,
 775                                                         uint16_t from_port, uint16_t to_port)
 776 {
 777         private_traffic_selector_t *this;
 778         ts_type_t type;
 779         chunk_t from;
 780
 781         switch (net->get_family(net))
 782         {
 783                 case AF_INET:
 784                         type = TS_IPV4_ADDR_RANGE;
 785                         break;
 786                 case AF_INET6:
 787                         type = TS_IPV6_ADDR_RANGE;
 788                         break;
 789                 default:
 790                         net->destroy(net);
 791                         return NULL;
 792         }
 793
 794         this = traffic_selector_create(protocol, type, from_port, to_port);
 795
 796         from = net->get_address(net);
 797         memcpy(this->from, from.ptr, from.len);
 798         netbits = min(netbits, TS_IP_LEN(this) * 8);
 799         calc_range(this, netbits);
 800         net->destroy(net);
 801         return &this->public;
 802 }
 803
 804 /*
 805  * see header
 806  */
 807 traffic_selector_t *traffic_selector_create_from_string(
 808                                                                                 uint8_t protocol, ts_type_t type,
 809                                                                                 char *from_addr, uint16_t from_port,
 810                                                                                 char *to_addr, uint16_t to_port)
 811 {
 812         private_traffic_selector_t *this;
 813         int family;
 814
 815         switch (type)
 816         {
 817                 case TS_IPV4_ADDR_RANGE:
 818                         family = AF_INET;
 819                         break;
 820                 case TS_IPV6_ADDR_RANGE:
 821                         family = AF_INET6;
 822                         break;
 823                 default:
 824                         return NULL;
 825         }
 826
 827         this = traffic_selector_create(protocol, type, from_port, to_port);
 828
 829         if (inet_pton(family, from_addr, this->from) != 1 ||
 830                 inet_pton(family, to_addr, this->to) != 1)
 831         {
 832                 free(this);
 833                 return NULL;
 834         }
 835         calc_netbits(this);
 836         return &this->public;
 837 }
 838
 839 /*
 840  * see header
 841  */
 842 traffic_selector_t *traffic_selector_create_from_cidr(
 843                                                                                 char *string, uint8_t protocol,
 844                                                                                 uint16_t from_port, uint16_t to_port)
 845 {
 846         host_t *net;
 847         int bits;
 848
 849         net = host_create_from_subnet(string, &bits);
 850         if (net)
 851         {
 852                 return traffic_selector_create_from_subnet(net, bits, protocol,
 853                                                                                                    from_port, to_port);
 854         }
 855         return NULL;
 856 }
 857
 858 /*
 859  * see header
 860  */
 861 traffic_selector_t *traffic_selector_create_dynamic(uint8_t protocol,
 862                                                                         uint16_t from_port, uint16_t to_port)
 863 {
 864         private_traffic_selector_t *this = traffic_selector_create(
 865                                                         protocol, TS_IPV4_ADDR_RANGE, from_port, to_port);
 866
 867         memset(this->from, 0, sizeof(this->from));
 868         memset(this->to, 0xFF, sizeof(this->to));
 869         this->netbits = 0;
 870         this->dynamic = TRUE;
 871
 872         return &this->public;
 873 }
 874
 875 /*
 876  * see declaration
 877  */
 878 static private_traffic_selector_t *traffic_selector_create(uint8_t protocol,
 879                                                 ts_type_t type, uint16_t from_port, uint16_t to_port)
 880 {
 881         private_traffic_selector_t *this;
 882
 883         /* sanity check */
 884         if (type != TS_IPV4_ADDR_RANGE && type != TS_IPV6_ADDR_RANGE)
 885         {
 886                 return NULL;
 887         }
 888
 889         INIT(this,
 890                 .public = {
 891                         .get_subset = _get_subset,
 892                         .equals = _equals,
 893                         .get_from_address = _get_from_address,
 894                         .get_to_address = _get_to_address,
 895                         .get_from_port = _get_from_port,
 896                         .get_to_port = _get_to_port,
 897                         .get_type = _get_type,
 898                         .get_protocol = _get_protocol,
 899                         .is_host = _is_host,
 900                         .is_dynamic = _is_dynamic,
 901                         .is_contained_in = _is_contained_in,
 902                         .includes = _includes,
 903                         .set_address = _set_address,
 904                         .to_subnet = _to_subnet,
 905                         .clone = _clone_,
 906                         .hash = _hash,
 907                         .destroy = _destroy,
 908                 },
 909                 .from_port = from_port,
 910                 .to_port = to_port,
 911                 .protocol = protocol,
 912                 .type = type,
 913         );
 914         if (protocol == IPPROTO_ICMP || protocol == IPPROTO_ICMPV6)
 915         {
 916                 this->from_port = from_port < 256 ? from_port << 8 : from_port;
 917                 this->to_port = to_port < 256 ? to_port << 8 : to_port;
 918         }
 919         return this;
 920 }