src/libstrongswan/selectors/traffic_selector.c

   1 /*
   2  * Copyright (C) 2007-2009 Tobias Brunner
   3  * Copyright (C) 2005-2007 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 #include <arpa/inet.h>
  19 #include <string.h>
  20 #include <netdb.h>
  21 #include <stdio.h>
  22
  23 #include "traffic_selector.h"
  24 #include "debug.h"
  25 #include <utils/linked_list.h>
  26 #include <utils/identification.h>
  27
  28 #define NON_SUBNET_ADDRESS_RANGE        255
  29
  30 ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_IPV6_ADDR_RANGE,
  31         "TS_IPV4_ADDR_RANGE",
  32         "TS_IPV6_ADDR_RANGE",
  33 );
  34
  35 typedef struct private_traffic_selector_t private_traffic_selector_t;
  36
  37 /**
  38  * Private data of an traffic_selector_t object
  39  */
  40 struct private_traffic_selector_t {
  41
  42         /**
  43          * Public part
  44          */
  45         traffic_selector_t public;
  46
  47         /**
  48          * Type of address
  49          */
  50         ts_type_t type;
  51
  52         /**
  53          * IP protocol (UDP, TCP, ICMP, ...)
  54          */
  55         u_int8_t protocol;
  56
  57         /**
  58          * narrow this traffic selector to hosts external ip
  59          * if set, from and to have no meaning until set_address() is called
  60          */
  61         bool dynamic;
  62
  63         /**
  64          * subnet size in CIDR notation, 255 means a non-subnet address range
  65          */
  66         u_int8_t netbits;
  67
  68         /**
  69          * begin of address range, network order
  70          */
  71         union {
  72                 /** dummy char for common address manipulation */
  73                 char from[0];
  74                 /** IPv4 address */
  75                 u_int32_t from4[1];
  76                 /** IPv6 address */
  77                 u_int32_t from6[4];
  78         };
  79
  80         /**
  81          * end of address range, network order
  82          */
  83         union {
  84                 /** dummy char for common address manipulation */
  85                 char to[0];
  86                 /** IPv4 address */
  87                 u_int32_t to4[1];
  88                 /** IPv6 address */
  89                 u_int32_t to6[4];
  90         };
  91
  92         /**
  93          * begin of port range
  94          */
  95         u_int16_t from_port;
  96
  97         /**
  98          * end of port range
  99          */
 100         u_int16_t to_port;
 101 };
 102
 103 /**
 104  * calculate the "to"-address for the "from" address and a subnet size
 105  */
 106 static void calc_range(private_traffic_selector_t *this, u_int8_t netbits)
 107 {
 108         size_t len;
 109         int bytes, bits;
 110         u_int8_t mask;
 111
 112         this->netbits = netbits;
 113
 114         len   = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 115         bytes = (netbits + 7)/8;
 116         bits  = (bytes * 8) - netbits;
 117         mask  = bits ? (1 << bits) - 1 : 0;
 118
 119         memcpy(this->to, this->from, bytes);
 120         memset(this->from + bytes, 0x00, len - bytes);
 121         memset(this->to   + bytes, 0xff, len - bytes);
 122         this->from[bytes-1] &= ~mask;
 123         this->to[bytes-1]   |=  mask;
 124 }
 125
 126 /**
 127  * calculate the subnet size from the "to" and "from" addresses
 128  */
 129 static u_int8_t calc_netbits(private_traffic_selector_t *this)
 130 {
 131         int byte, bit;
 132         u_int8_t netbits;
 133         size_t size = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 134         bool prefix = TRUE;
 135
 136         /* a perfect match results in a single address with a /32 or /128 netmask */
 137         netbits = (size * 8);
 138         this->netbits = netbits;
 139
 140         /* go through all bits of the addresses, beginning in the front.
 141          * as long as they are equal, the subnet gets larger
 142          */
 143         for (byte = 0; byte < size; byte++)
 144         {
 145                 for (bit = 7; bit >= 0; bit--)
 146                 {
 147                         u_int8_t bitmask = 1 << bit;
 148
 149                         if (prefix)
 150                         {
 151                                 if ((bitmask & this->from[byte]) != (bitmask & this->to[byte]))
 152                                 {
 153                                         /* store the common prefix which might be a true subnet */
 154                                         netbits = (7 - bit) + (byte * 8);
 155                                         this->netbits = netbits;
 156                                         prefix = FALSE;
 157                                 }
 158                         }
 159                         else
 160                         {
 161                                 if ((bitmask & this->from[byte]) || !(bitmask & this->to[byte]))
 162                                 {
 163                                         this->netbits = NON_SUBNET_ADDRESS_RANGE;
 164                                         return netbits;  /* return a pseudo subnet */
 165
 166                                 }
 167                         }
 168                 }
 169         }
 170         return netbits;  /* return a true subnet */
 171 }
 172
 173 /**
 174  * internal generic constructor
 175  */
 176 static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol, ts_type_t type, u_int16_t from_port, u_int16_t to_port);
 177
 178 /**
 179  * Described in header.
 180  */
 181 int traffic_selector_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
 182                                                                  const void *const *args)
 183 {
 184         private_traffic_selector_t *this = *((private_traffic_selector_t**)(args[0]));
 185         linked_list_t *list = *((linked_list_t**)(args[0]));
 186         iterator_t *iterator;
 187         char from_str[INET6_ADDRSTRLEN] = "";
 188         char to_str[INET6_ADDRSTRLEN] = "";
 189         char *serv_proto = NULL;
 190         bool has_proto;
 191         bool has_ports;
 192         size_t written = 0;
 193         u_int32_t from[4], to[4];
 194
 195         if (this == NULL)
 196         {
 197                 return print_in_hook(dst, len, "(null)");
 198         }
 199
 200         if (spec->hash)
 201         {
 202                 iterator = list->create_iterator(list, TRUE);
 203                 while (iterator->iterate(iterator, (void**)&this))
 204                 {
 205                         /* call recursivly */
 206                         written += print_in_hook(dst, len, "%R ", this);
 207                 }
 208                 iterator->destroy(iterator);
 209                 return written;
 210         }
 211
 212         memset(from, 0, sizeof(from));
 213         memset(to, 0xFF, sizeof(to));
 214         if (this->dynamic &&
 215                 memeq(this->from, from, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16) &&
 216                 memeq(this->to, to, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16))
 217         {
 218                 written += print_in_hook(dst, len, "dynamic");
 219         }
 220         else
 221         {
 222                 if (this->type == TS_IPV4_ADDR_RANGE)
 223                 {
 224                         inet_ntop(AF_INET, &this->from4, from_str, sizeof(from_str));
 225                 }
 226                 else
 227                 {
 228                         inet_ntop(AF_INET6, &this->from6, from_str, sizeof(from_str));
 229                 }
 230                 if (this->netbits == NON_SUBNET_ADDRESS_RANGE)
 231                 {
 232                         if (this->type == TS_IPV4_ADDR_RANGE)
 233                         {
 234                                 inet_ntop(AF_INET, &this->to4, to_str, sizeof(to_str));
 235                         }
 236                         else
 237                         {
 238                                 inet_ntop(AF_INET6, &this->to6, to_str, sizeof(to_str));
 239                         }
 240                         written += print_in_hook(dst, len, "%s..%s", from_str, to_str);
 241                 }
 242                 else
 243                 {
 244                         written += print_in_hook(dst, len, "%s/%d", from_str, this->netbits);
 245                 }
 246         }
 247
 248         /* check if we have protocol and/or port selectors */
 249         has_proto = this->protocol != 0;
 250         has_ports = !(this->from_port == 0 && this->to_port == 0xFFFF);
 251
 252         if (!has_proto && !has_ports)
 253         {
 254                 return written;
 255         }
 256
 257         written += print_in_hook(dst, len, "[");
 258
 259         /* build protocol string */
 260         if (has_proto)
 261         {
 262                 struct protoent *proto = getprotobynumber(this->protocol);
 263
 264                 if (proto)
 265                 {
 266                         written += print_in_hook(dst, len, "%s", proto->p_name);
 267                         serv_proto = proto->p_name;
 268                 }
 269                 else
 270                 {
 271                         written += print_in_hook(dst, len, "%d", this->protocol);
 272                 }
 273         }
 274
 275         if (has_proto && has_ports)
 276         {
 277                 written += print_in_hook(dst, len, "/");
 278         }
 279
 280         /* build port string */
 281         if (has_ports)
 282         {
 283                 if (this->from_port == this->to_port)
 284                 {
 285                         struct servent *serv = getservbyport(htons(this->from_port), serv_proto);
 286
 287                         if (serv)
 288                         {
 289                                 written += print_in_hook(dst, len, "%s", serv->s_name);
 290                         }
 291                         else
 292                         {
 293                                 written += print_in_hook(dst, len, "%d", this->from_port);
 294                         }
 295                 }
 296                 else
 297                 {
 298                         written += print_in_hook(dst, len, "%d-%d", this->from_port, this->to_port);
 299                 }
 300         }
 301
 302         written += print_in_hook(dst, len, "]");
 303
 304         return written;
 305 }
 306
 307 /**
 308  * implements traffic_selector_t.get_subset
 309  */
 310 static traffic_selector_t *get_subset(private_traffic_selector_t *this, private_traffic_selector_t *other)
 311 {
 312         if (this->type == other->type && (this->protocol == other->protocol ||
 313                                                                 this->protocol == 0 || other->protocol == 0))
 314         {
 315                 u_int16_t from_port, to_port;
 316                 u_char *from, *to;
 317                 u_int8_t protocol;
 318                 size_t size;
 319                 private_traffic_selector_t *new_ts;
 320
 321                 /* calculate the maximum port range allowed for both */
 322                 from_port = max(this->from_port, other->from_port);
 323                 to_port = min(this->to_port, other->to_port);
 324                 if (from_port > to_port)
 325                 {
 326                         return NULL;
 327                 }
 328                 /* select protocol, which is not zero */
 329                 protocol = max(this->protocol, other->protocol);
 330
 331                 switch (this->type)
 332                 {
 333                         case TS_IPV4_ADDR_RANGE:
 334                                 size = sizeof(this->from4);
 335                                 break;
 336                         case TS_IPV6_ADDR_RANGE:
 337                                 size = sizeof(this->from6);
 338                                 break;
 339                         default:
 340                                 return NULL;
 341                 }
 342
 343                 /* get higher from-address */
 344                 if (memcmp(this->from, other->from, size) > 0)
 345                 {
 346                         from = this->from;
 347                 }
 348                 else
 349                 {
 350                         from = other->from;
 351                 }
 352                 /* get lower to-address */
 353                 if (memcmp(this->to, other->to, size) > 0)
 354                 {
 355                         to = other->to;
 356                 }
 357                 else
 358                 {
 359                         to = this->to;
 360                 }
 361                 /* if "from" > "to", we don't have a match */
 362                 if (memcmp(from, to, size) > 0)
 363                 {
 364                         return NULL;
 365                 }
 366
 367                 /* we have a match in protocol, port, and address: return it... */
 368                 new_ts = traffic_selector_create(protocol, this->type, from_port, to_port);
 369                 new_ts->dynamic = this->dynamic || other->dynamic;
 370                 memcpy(new_ts->from, from, size);
 371                 memcpy(new_ts->to, to, size);
 372                 calc_netbits(new_ts);
 373                 return &new_ts->public;
 374         }
 375         return NULL;
 376 }
 377
 378 /**
 379  * implements traffic_selector_t.equals
 380  */
 381 static bool equals(private_traffic_selector_t *this, private_traffic_selector_t *other)
 382 {
 383         if (this->type != other->type)
 384         {
 385                 return FALSE;
 386         }
 387         if (!(this->from_port == other->from_port &&
 388                   this->to_port == other->to_port &&
 389                   this->protocol == other->protocol))
 390         {
 391                 return FALSE;
 392         }
 393         switch (this->type)
 394         {
 395                 case TS_IPV4_ADDR_RANGE:
 396                         if (memeq(this->from4, other->from4, sizeof(this->from4)))
 397                         {
 398                                 return TRUE;
 399                         }
 400                         break;
 401                 case TS_IPV6_ADDR_RANGE:
 402                         if (memeq(this->from6, other->from6, sizeof(this->from6)))
 403                         {
 404                                 return TRUE;
 405                         }
 406                         break;
 407                 default:
 408                         break;
 409         }
 410         return FALSE;
 411 }
 412
 413 /**
 414  * Implements traffic_selector_t.get_from_address.
 415  */
 416 static chunk_t get_from_address(private_traffic_selector_t *this)
 417 {
 418         switch (this->type)
 419         {
 420                 case TS_IPV4_ADDR_RANGE:
 421                         return chunk_create(this->from, sizeof(this->from4));
 422                 case TS_IPV6_ADDR_RANGE:
 423                         return chunk_create(this->from, sizeof(this->from6));
 424                 default:
 425                         return chunk_empty;
 426         }
 427 }
 428
 429 /**
 430  * Implements traffic_selector_t.get_to_address.
 431  */
 432 static chunk_t get_to_address(private_traffic_selector_t *this)
 433 {
 434         switch (this->type)
 435         {
 436                 case TS_IPV4_ADDR_RANGE:
 437                         return chunk_create(this->to, sizeof(this->to4));
 438                 case TS_IPV6_ADDR_RANGE:
 439                         return chunk_create(this->to, sizeof(this->to6));
 440                 default:
 441                         return chunk_empty;
 442         }
 443 }
 444
 445 /**
 446  * Implements traffic_selector_t.get_from_port.
 447  */
 448 static u_int16_t get_from_port(private_traffic_selector_t *this)
 449 {
 450         return this->from_port;
 451 }
 452
 453 /**
 454  * Implements traffic_selector_t.get_to_port.
 455  */
 456 static u_int16_t get_to_port(private_traffic_selector_t *this)
 457 {
 458         return this->to_port;
 459 }
 460
 461 /**
 462  * Implements traffic_selector_t.get_type.
 463  */
 464 static ts_type_t get_type(private_traffic_selector_t *this)
 465 {
 466         return this->type;
 467 }
 468
 469 /**
 470  * Implements traffic_selector_t.get_protocol.
 471  */
 472 static u_int8_t get_protocol(private_traffic_selector_t *this)
 473 {
 474         return this->protocol;
 475 }
 476
 477 /**
 478  * Implements traffic_selector_t.is_host.
 479  */
 480 static bool is_host(private_traffic_selector_t *this, host_t *host)
 481 {
 482         if (host)
 483         {
 484                 chunk_t addr;
 485                 int family = host->get_family(host);
 486
 487                 if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 488                         (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 489                 {
 490                         addr = host->get_address(host);
 491                         if (memeq(addr.ptr, this->from, addr.len) &&
 492                                 memeq(addr.ptr, this->to, addr.len))
 493                         {
 494                                 return TRUE;
 495                         }
 496                 }
 497         }
 498         else
 499         {
 500                 size_t length = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 501
 502                 if (this->dynamic)
 503                 {
 504                         return TRUE;
 505                 }
 506
 507                 if (memeq(this->from, this->to, length))
 508                 {
 509                         return TRUE;
 510                 }
 511         }
 512         return FALSE;
 513 }
 514
 515 /**
 516  * Implementation of traffic_selector_t.is_dynamic
 517  */
 518 static bool is_dynamic(private_traffic_selector_t *this)
 519 {
 520         return this->dynamic;
 521 }
 522
 523 /**
 524  * Implements traffic_selector_t.set_address.
 525  */
 526 static void set_address(private_traffic_selector_t *this, host_t *host)
 527 {
 528         if (this->dynamic)
 529         {
 530                 this->type = host->get_family(host) == AF_INET ?
 531                                 TS_IPV4_ADDR_RANGE : TS_IPV6_ADDR_RANGE;
 532
 533                 if (host->is_anyaddr(host))
 534                 {
 535                         memset(this->from6, 0x00, sizeof(this->from6));
 536                         memset(this->to6, 0xFF, sizeof(this->to6));
 537                 }
 538                 else
 539                 {
 540                         chunk_t from = host->get_address(host);
 541                         memcpy(this->from, from.ptr, from.len);
 542                         memcpy(this->to, from.ptr, from.len);
 543                 }
 544         }
 545 }
 546
 547 /**
 548  * Implements traffic_selector_t.is_contained_in.
 549  */
 550 static bool is_contained_in(private_traffic_selector_t *this,
 551                                                         private_traffic_selector_t *other)
 552 {
 553         private_traffic_selector_t *subset;
 554         bool contained_in = FALSE;
 555
 556         subset = (private_traffic_selector_t*)get_subset(this, other);
 557
 558         if (subset)
 559         {
 560                 if (equals(subset, this))
 561                 {
 562                         contained_in = TRUE;
 563                 }
 564                 free(subset);
 565         }
 566         return contained_in;
 567 }
 568
 569 /**
 570  * Implements traffic_selector_t.includes.
 571  */
 572 static bool includes(private_traffic_selector_t *this, host_t *host)
 573 {
 574         chunk_t addr;
 575         int family = host->get_family(host);
 576
 577         if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 578                 (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 579         {
 580                 addr = host->get_address(host);
 581
 582                 return memcmp(this->from, addr.ptr, addr.len) <= 0 &&
 583                                 memcmp(this->to, addr.ptr, addr.len) >= 0;
 584         }
 585
 586         return FALSE;
 587 }
 588
 589 /**
 590  * Implements traffic_selector_t.to_subnet.
 591  */
 592 static void to_subnet(private_traffic_selector_t *this, host_t **net, u_int8_t *mask)
 593 {
 594         /* there is no way to do this cleanly, as the address range may
 595          * be anything else but a subnet. We use from_addr as subnet
 596          * and try to calculate a usable subnet mask.
 597          */
 598         int family, byte;
 599         u_int16_t port = 0;
 600         chunk_t net_chunk;
 601
 602         *mask = calc_netbits(this);
 603
 604         switch (this->type)
 605         {
 606                 case TS_IPV4_ADDR_RANGE:
 607                         family = AF_INET;
 608                         net_chunk.len = sizeof(this->from4);
 609                         break;
 610                 case TS_IPV6_ADDR_RANGE:
 611                         family = AF_INET6;
 612                         net_chunk.len = sizeof(this->from6);
 613                         break;
 614                 default:
 615                         /* unreachable */
 616                         return;
 617         }
 618
 619         net_chunk.ptr = malloc(net_chunk.len);
 620         memcpy(net_chunk.ptr, this->from, net_chunk.len);
 621
 622         for (byte = net_chunk.len - 1; byte >= (*mask / 8); --byte)
 623         {
 624                 int shift = (byte + 1) * 8 - *mask;
 625                 net_chunk.ptr[byte] = net_chunk.ptr[byte] & (0xFF << shift);
 626         }
 627
 628         if (this->to_port == this->from_port)
 629         {
 630                 port = this->to_port;
 631         }
 632
 633         *net = host_create_from_chunk(family, net_chunk, port);
 634         chunk_free(&net_chunk);
 635 }
 636
 637 /**
 638  * Implements traffic_selector_t.clone.
 639  */
 640 static traffic_selector_t *clone_(private_traffic_selector_t *this)
 641 {
 642         private_traffic_selector_t *clone;
 643
 644         clone = traffic_selector_create(this->protocol, this->type,
 645                                                                         this->from_port, this->to_port);
 646         clone->netbits = this->netbits;
 647         clone->dynamic = this->dynamic;
 648
 649         switch (clone->type)
 650         {
 651                 case TS_IPV4_ADDR_RANGE:
 652                         memcpy(clone->from4, this->from4, sizeof(this->from4));
 653                         memcpy(clone->to4, this->to4, sizeof(this->to4));
 654                         return &clone->public;
 655                 case TS_IPV6_ADDR_RANGE:
 656                         memcpy(clone->from6, this->from6, sizeof(this->from6));
 657                         memcpy(clone->to6, this->to6, sizeof(this->to6));
 658                         return &clone->public;
 659                 default:
 660                         /* unreachable */
 661                         return &clone->public;
 662         }
 663 }
 664
 665 /**
 666  * Implements traffic_selector_t.destroy.
 667  */
 668 static void destroy(private_traffic_selector_t *this)
 669 {
 670         free(this);
 671 }
 672
 673 /*
 674  * see header
 675  */
 676 traffic_selector_t *traffic_selector_create_from_bytes(u_int8_t protocol,
 677                                                                                                 ts_type_t type,
 678                                                                                                 chunk_t from, u_int16_t from_port,
 679                                                                                                 chunk_t to, u_int16_t to_port)
 680 {
 681         private_traffic_selector_t *this = traffic_selector_create(protocol, type,
 682                                                                                                                         from_port, to_port);
 683
 684         switch (type)
 685         {
 686                 case TS_IPV4_ADDR_RANGE:
 687                         if (from.len != 4 || to.len != 4)
 688                         {
 689                                 free(this);
 690                                 return NULL;
 691                         }
 692                         memcpy(this->from4, from.ptr, from.len);
 693                         memcpy(this->to4, to.ptr, to.len);
 694                         break;
 695                 case TS_IPV6_ADDR_RANGE:
 696                         if (from.len != 16 || to.len != 16)
 697                         {
 698                                 free(this);
 699                                 return NULL;
 700                         }
 701                         memcpy(this->from6, from.ptr, from.len);
 702                         memcpy(this->to6, to.ptr, to.len);
 703                         break;
 704                 default:
 705                         free(this);
 706                         return NULL;
 707         }
 708         calc_netbits(this);
 709         return (&this->public);
 710 }
 711
 712 /*
 713  * see header
 714  */
 715 traffic_selector_t *traffic_selector_create_from_rfc3779_format(ts_type_t type,
 716                                                                                                 chunk_t from, chunk_t to)
 717 {
 718         size_t len;
 719         private_traffic_selector_t *this = traffic_selector_create(0, type, 0, 65535);
 720
 721         switch (type)
 722         {
 723                 case TS_IPV4_ADDR_RANGE:
 724                         len = 4;
 725                         break;
 726                 case TS_IPV6_ADDR_RANGE:
 727                         len = 16;
 728                         break;
 729                 default:
 730                         free(this);
 731                         return NULL;
 732         }
 733         memset(this->from, 0x00, len);
 734         memset(this->to  , 0xff, len);
 735
 736         if (from.len > 1)
 737         {
 738                 memcpy(this->from, from.ptr+1, from.len-1);
 739         }
 740         if (to.len > 1)
 741         {
 742                 memcpy(this->to, to.ptr+1, to.len-1);
 743                 this->to[to.len-2] |= to.ptr[0] ? (1 << to.ptr[0]) - 1 : 0;
 744         }
 745         this->netbits = chunk_equals(from, to) ? (from.len-1)*8 - from.ptr[0]
 746                                                                                    : NON_SUBNET_ADDRESS_RANGE;
 747         return (&this->public);
 748 }
 749
 750 /*
 751  * see header
 752  */
 753 traffic_selector_t *traffic_selector_create_from_subnet(host_t *net,
 754                                                         u_int8_t netbits, u_int8_t protocol, u_int16_t port)
 755 {
 756         private_traffic_selector_t *this = traffic_selector_create(protocol, 0, 0, 65535);
 757
 758         switch (net->get_family(net))
 759         {
 760                 case AF_INET:
 761                 {
 762                         chunk_t from;
 763
 764                         this->type = TS_IPV4_ADDR_RANGE;
 765                         from = net->get_address(net);
 766                         memcpy(this->from, from.ptr, from.len);
 767                         if (this->from4[0] == 0)
 768                         {
 769                                 /* use /0 for 0.0.0.0 */
 770                                 this->to4[0] = ~0;
 771                                 this->netbits = 0;
 772                         }
 773                         else
 774                         {
 775                                 calc_range(this, netbits);
 776                         }
 777                         break;
 778                 }
 779                 case AF_INET6:
 780                 {
 781                         chunk_t from;
 782
 783                         this->type = TS_IPV6_ADDR_RANGE;
 784                         from = net->get_address(net);
 785                         memcpy(this->from, from.ptr, from.len);
 786                         if (this->from6[0] == 0 && this->from6[1] == 0 &&
 787                                 this->from6[2] == 0 && this->from6[3] == 0)
 788                         {
 789                                 /* use /0 for ::0 */
 790                                 this->to6[0] = ~0;
 791                                 this->to6[1] = ~0;
 792                                 this->to6[2] = ~0;
 793                                 this->to6[3] = ~0;
 794                                 this->netbits = 0;
 795                         }
 796                         else
 797                         {
 798                                 calc_range(this, netbits);
 799                         }
 800                         break;
 801                 }
 802                 default:
 803                 {
 804                         net->destroy(net);
 805                         free(this);
 806                         return NULL;
 807                 }
 808         }
 809         if (port)
 810         {
 811                 this->from_port = port;
 812                 this->to_port = port;
 813         }
 814         net->destroy(net);
 815         return (&this->public);
 816 }
 817
 818 /*
 819  * see header
 820  */
 821 traffic_selector_t *traffic_selector_create_from_string(
 822                                                                                 u_int8_t protocol, ts_type_t type,
 823                                                                                 char *from_addr, u_int16_t from_port,
 824                                                                                 char *to_addr, u_int16_t to_port)
 825 {
 826         private_traffic_selector_t *this = traffic_selector_create(protocol, type,
 827                                                                                                                         from_port, to_port);
 828
 829         switch (type)
 830         {
 831                 case TS_IPV4_ADDR_RANGE:
 832                         if (inet_pton(AF_INET, from_addr, (struct in_addr*)this->from4) < 0)
 833                         {
 834                                 free(this);
 835                                 return NULL;
 836                         }
 837                         if (inet_pton(AF_INET, to_addr, (struct in_addr*)this->to4) < 0)
 838                         {
 839                                 free(this);
 840                                 return NULL;
 841                         }
 842                         break;
 843                 case TS_IPV6_ADDR_RANGE:
 844                         if (inet_pton(AF_INET6, from_addr, (struct in6_addr*)this->from6) < 0)
 845                         {
 846                                 free(this);
 847                                 return NULL;
 848                         }
 849                         if (inet_pton(AF_INET6, to_addr, (struct in6_addr*)this->to6) < 0)
 850                         {
 851                                 free(this);
 852                                 return NULL;
 853                         }
 854                         break;
 855         }
 856         calc_netbits(this);
 857         return (&this->public);
 858 }
 859
 860 /*
 861  * see header
 862  */
 863 traffic_selector_t *traffic_selector_create_dynamic(u_int8_t protocol,
 864                                                                         u_int16_t from_port, u_int16_t to_port)
 865 {
 866         private_traffic_selector_t *this = traffic_selector_create(
 867                                                         protocol, TS_IPV4_ADDR_RANGE, from_port, to_port);
 868
 869         memset(this->from6, 0, sizeof(this->from6));
 870         memset(this->to6, 0xFF, sizeof(this->to6));
 871         this->netbits = 0;
 872         this->dynamic = TRUE;
 873
 874         return &this->public;
 875 }
 876
 877 /*
 878  * see declaration
 879  */
 880 static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol,
 881                                                 ts_type_t type, u_int16_t from_port, u_int16_t to_port)
 882 {
 883         private_traffic_selector_t *this = malloc_thing(private_traffic_selector_t);
 884
 885         /* public functions */
 886         this->public.get_subset = (traffic_selector_t*(*)(traffic_selector_t*,traffic_selector_t*))get_subset;
 887         this->public.equals = (bool(*)(traffic_selector_t*,traffic_selector_t*))equals;
 888         this->public.get_from_address = (chunk_t(*)(traffic_selector_t*))get_from_address;
 889         this->public.get_to_address = (chunk_t(*)(traffic_selector_t*))get_to_address;
 890         this->public.get_from_port = (u_int16_t(*)(traffic_selector_t*))get_from_port;
 891         this->public.get_to_port = (u_int16_t(*)(traffic_selector_t*))get_to_port;
 892         this->public.get_type = (ts_type_t(*)(traffic_selector_t*))get_type;
 893         this->public.get_protocol = (u_int8_t(*)(traffic_selector_t*))get_protocol;
 894         this->public.is_host = (bool(*)(traffic_selector_t*,host_t*))is_host;
 895         this->public.is_dynamic = (bool(*)(traffic_selector_t*))is_dynamic;
 896         this->public.is_contained_in = (bool(*)(traffic_selector_t*,traffic_selector_t*))is_contained_in;
 897         this->public.includes = (bool(*)(traffic_selector_t*,host_t*))includes;
 898         this->public.set_address = (void(*)(traffic_selector_t*,host_t*))set_address;
 899         this->public.to_subnet = (void(*)(traffic_selector_t*,host_t**,u_int8_t*))to_subnet;
 900         this->public.clone = (traffic_selector_t*(*)(traffic_selector_t*))clone_;
 901         this->public.destroy = (void(*)(traffic_selector_t*))destroy;
 902
 903         this->from_port = from_port;
 904         this->to_port = to_port;
 905         this->protocol = protocol;
 906         this->type = type;
 907         this->dynamic = FALSE;
 908
 909         return this;
 910 }
 911