ip-xfrm: Respect family in deleteall and list commands

Allow to limit 'ip xfrm {state|policy} list' output to a certain address
family and to delete all states/policies by family.

Although preferred_family was already set in filters, the filter
function ignored it. To enable filtering despite the lack of other
selectors, filter.use has to be set if family is not AF_UNSPEC.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

diff --git a/ip/xfrm_policy.c b/ip/xfrm_policy.c
index 4a63e9ab602d7a954a01f6cb64d55929d7f555c7..9898435055d6f95a1f0ed55fb03290b70dd581d0 100644 (file)
--- a/ip/xfrm_policy.c
+++ b/ip/xfrm_policy.c
@@ -410,6 +410,10 @@ static int xfrm_policy_filter_match(struct xfrm_userpolicy_info *xpinfo,
        if (!filter.use)
                return 1;
 
+       if (filter.xpinfo.sel.family != AF_UNSPEC &&
+           filter.xpinfo.sel.family != xpinfo->sel.family)
+               return 0;
+
        if ((xpinfo->dir^filter.xpinfo.dir)&filter.dir_mask)
                return 0;
 
@@ -780,7 +784,7 @@ static int xfrm_policy_list_or_deleteall(int argc, char **argv, int deleteall)
        char *selp = NULL;
        struct rtnl_handle rth;
 
-       if (argc > 0)
+       if (argc > 0 || preferred_family != AF_UNSPEC)
                filter.use = 1;
        filter.xpinfo.sel.family = preferred_family;
 

diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index 9360143756016ca2562797059234eb9b9bebf040..f27270709d2fb166222fc66c53339a467693e500 100644 (file)
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -898,6 +898,10 @@ static int xfrm_state_filter_match(struct xfrm_usersa_info *xsinfo)
        if (!filter.use)
                return 1;
 
+       if (filter.xsinfo.family != AF_UNSPEC &&
+           filter.xsinfo.family != xsinfo->family)
+               return 0;
+
        if (filter.id_src_mask)
                if (xfrm_addr_match(&xsinfo->saddr, &filter.xsinfo.saddr,
                                    filter.id_src_mask))
@@ -1170,7 +1174,7 @@ static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall)
        struct rtnl_handle rth;
        bool nokeys = false;
 
-       if (argc > 0)
+       if (argc > 0 || preferred_family != AF_UNSPEC)
                filter.use = 1;
        filter.xsinfo.family = preferred_family;
 

diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8
index 9547808539a08e85620a6d5795f2f5f66fdc61a0..cfce1e40b7f7dc3ae779013bd40d7f55d4390cd6 100644 (file)
--- a/man/man8/ip-xfrm.8
+++ b/man/man8/ip-xfrm.8
@@ -89,7 +89,7 @@ ip-xfrm \- transform configuration
 .IR MASK " ] ]"
 
 .ti -8
-.BR "ip xfrm state " deleteall " ["
+.BR ip " [ " -4 " | " -6 " ] " "xfrm state deleteall" " ["
 .IR ID " ]"
 .RB "[ " mode
 .IR MODE " ]"
@@ -99,7 +99,7 @@ ip-xfrm \- transform configuration
 .IR FLAG-LIST " ]"
 
 .ti -8
-.BR "ip xfrm state " list " ["
+.BR ip " [ " -4 " | " -6 " ] " "xfrm state list" " ["
 .IR ID " ]"
 .RB "[ " nokeys " ]"
 .RB "[ " mode
@@ -257,7 +257,7 @@ ip-xfrm \- transform configuration
 .IR PTYPE " ]"
 
 .ti -8
-.BR "ip xfrm policy" " { " deleteall " | " list " }"
+.BR ip " [ " -4 " | " -6 " ] " "xfrm policy" " { " deleteall " | " list " }"
 .RB "[ " nosock " ]"
 .RI "[ " SELECTOR " ]"
 .RB "[ " dir