@@ -1136,7 +1136,32 @@ static int xfrm_state_list_or_deleteall(int argc, char **argv, int deleteall)
}
} else {
- if (rtnl_wilddump_request(&rth, preferred_family, XFRM_MSG_GETSA) < 0) {
+ struct xfrm_address_filter addrfilter = {
+ .saddr = filter.xsinfo.saddr,
+ .daddr = filter.xsinfo.id.daddr,
+ .family = filter.xsinfo.family,
+ .splen = filter.id_src_mask,
+ .dplen = filter.id_dst_mask,
+ };
+ struct {
+ struct nlmsghdr n;
+ char buf[NLMSG_BUF_SIZE];
+ } req;
+
+ memset(&req, 0, sizeof(req));
+ req.n.nlmsg_len = NLMSG_HDRLEN;
+ req.n.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST;
+ req.n.nlmsg_type = XFRM_MSG_GETSA;
+ req.n.nlmsg_pid = 0;
+ req.n.nlmsg_seq = rth.dump = ++rth.seq;
+
+ if (filter.xsinfo.id.proto)
+ addattr8(&req.n, sizeof(req), XFRMA_PROTO,
+ filter.xsinfo.id.proto);
+ addattr_l(&req.n, sizeof(req), XFRMA_ADDRESS_FILTER,
+ &addrfilter, sizeof(addrfilter));
+
+ if (rtnl_send(&rth, (void *)&req, req.n.nlmsg_len) < 0) {
perror("Cannot send dump request");
exit(1);
}
It's now possible to filter SA directly into the kernel by specifying XFRMA_PROTO and/or XFRMA_ADDRESS_FILTER. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> --- Note that this patch is intended to work with net-next. v3: use C99 initializers ip/xfrm_state.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-)