From f687d73c96b9fa2e20fcbb71faa75fb2f611e679 Mon Sep 17 00:00:00 2001 From: Nicolas Dichtel Date: Fri, 21 Mar 2014 11:02:43 +0100 Subject: [PATCH] ipxfrm: allow to setup filter when dumping SA It's now possible to filter SA directly into the kernel by specifying XFRMA_PROTO and/or XFRMA_ADDRESS_FILTER. Signed-off-by: Nicolas Dichtel --- ip/xfrm_state.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index 140a4503b..fe7708e53 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -1136,7 +1136,30 @@ static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall) } } else { - if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETSA) < 0) { + struct xfrm_address_filter addrfilter = { + .saddr = filter.xsinfo.saddr, + .daddr = filter.xsinfo.id.daddr, + .family = filter.xsinfo.family, + .splen = filter.id_src_mask, + .dplen = filter.id_dst_mask, + }; + struct { + struct nlmsghdr n; + char buf[NLMSG_BUF_SIZE]; + } req = { + .n.nlmsg_len = NLMSG_HDRLEN, + .n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST, + .n.nlmsg_type = XFRM_MSG_GETSA, + .n.nlmsg_seq = rth.dump = ++rth.seq, + }; + + if (filter.xsinfo.id.proto) + addattr8(&req.n, sizeof(req), XFRMA_PROTO, + filter.xsinfo.id.proto); + addattr_l(&req.n, sizeof(req), XFRMA_ADDRESS_FILTER, + &addrfilter, sizeof(addrfilter)); + + if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) { perror("Cannot send dump request"); exit(1); } -- 2.47.2