src/charon/config/traffic_selector.c

   1 /*
   2  * Copyright (C) 2007 Tobias Brunner
   3  * Copyright (C) 2005-2007 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  *
  17  * $Id$
  18  */
  19
  20 #include <arpa/inet.h>
  21 #include <string.h>
  22 #include <netdb.h>
  23 #include <stdio.h>
  24 #include <printf.h>
  25
  26 #include "traffic_selector.h"
  27
  28 #include <daemon.h>
  29 #include <utils/linked_list.h>
  30 #include <utils/identification.h>
  31
  32 ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_IPV6_ADDR_RANGE,
  33         "TS_IPV4_ADDR_RANGE",
  34         "TS_IPV6_ADDR_RANGE",
  35 );
  36
  37 typedef struct private_traffic_selector_t private_traffic_selector_t;
  38
  39 /**
  40  * Private data of an traffic_selector_t object
  41  */
  42 struct private_traffic_selector_t {
  43
  44         /**
  45          * Public part
  46          */
  47         traffic_selector_t public;
  48
  49         /**
  50          * Type of address
  51          */
  52         ts_type_t type;
  53
  54         /**
  55          * IP protocol (UDP, TCP, ICMP, ...)
  56          */
  57         u_int8_t protocol;
  58
  59         /**
  60          * narrow this traffic selector to hosts external ip
  61          * if set, from and to have no meaning until set_address() is called
  62          */
  63         bool dynamic;
  64
  65         /**
  66          * begin of address range, network order
  67          */
  68         union {
  69                 /** dummy char for common address manipulation */
  70                 char from[0];
  71                 /** IPv4 address */
  72                 u_int32_t from4[1];
  73                 /** IPv6 address */
  74                 u_int32_t from6[4];
  75         };
  76
  77         /**
  78          * end of address range, network order
  79          */
  80         union {
  81                 /** dummy char for common address manipulation */
  82                 char to[0];
  83                 /** IPv4 address */
  84                 u_int32_t to4[1];
  85                 /** IPv6 address */
  86                 u_int32_t to6[4];
  87         };
  88
  89         /**
  90          * begin of port range
  91          */
  92         u_int16_t from_port;
  93
  94         /**
  95          * end of port range
  96          */
  97         u_int16_t to_port;
  98 };
  99
 100 /**
 101  * calculate to "to"-address for the "from" address and a subnet size
 102  */
 103 static void calc_range(private_traffic_selector_t *this, u_int8_t netbits)
 104 {
 105         int byte;
 106         size_t size = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 107
 108         /* go through the from address, starting at the tail. While we
 109          * have not processed the bits belonging to the host, set them to 1 on
 110          * the to address. If we reach the bits for the net, copy them from "from". */
 111         for (byte = size - 1; byte >=0; byte--)
 112         {
 113                 u_char mask = 0x00;
 114                 int shift;
 115
 116                 shift = (byte+1) * 8 - netbits;
 117                 if (shift > 0)
 118                 {
 119                         mask = 1 << shift;
 120                         if (mask != 0xFF)
 121                         {
 122                                 mask--;
 123                         }
 124                 }
 125                 this->to[byte] = this->from[byte] | mask;
 126         }
 127 }
 128
 129 /**
 130  * calculate to subnet size from "to"- and "from"-address
 131  */
 132 static u_int8_t calc_netbits(private_traffic_selector_t *this)
 133 {
 134         int byte, bit;
 135         size_t size = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 136
 137         /* go trough all bits of the addresses, begging in the front.
 138          * As longer as they equal, the subnet gets larger */
 139         for (byte = 0; byte < size; byte++)
 140         {
 141                 for (bit = 7; bit >= 0; bit--)
 142                 {
 143                         if ((1<<bit & this->from[byte]) != (1<<bit & this->to[byte]))
 144                         {
 145                                 return ((7 - bit) + (byte * 8));
 146                         }
 147                 }
 148         }
 149         /* single host, netmask is 32/128 */
 150         return (size * 8);
 151 }
 152
 153 /**
 154  * internal generic constructor
 155  */
 156 static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol, ts_type_t type, u_int16_t from_port, u_int16_t to_port);
 157
 158 /**
 159  * output handler in printf()
 160  */
 161 static int print(FILE *stream, const struct printf_info *info,
 162                                  const void *const *args)
 163 {
 164         private_traffic_selector_t *this = *((private_traffic_selector_t**)(args[0]));
 165         linked_list_t *list = *((linked_list_t**)(args[0]));
 166         iterator_t *iterator;
 167         char addr_str[INET6_ADDRSTRLEN] = "";
 168         char *serv_proto = NULL;
 169         u_int8_t mask;
 170         bool has_proto;
 171         bool has_ports;
 172         size_t written = 0;
 173         u_int32_t from[4], to[4];
 174
 175         if (this == NULL)
 176         {
 177                 return fprintf(stream, "(null)");
 178         }
 179
 180         if (info->alt)
 181         {
 182                 iterator = list->create_iterator(list, TRUE);
 183                 while (iterator->iterate(iterator, (void**)&this))
 184                 {
 185                         /* call recursivly */
 186                         written += fprintf(stream, "%R ", this);
 187                 }
 188                 iterator->destroy(iterator);
 189                 return written;
 190         }
 191
 192         memset(from, 0, sizeof(from));
 193         memset(to, 0xFF, sizeof(to));
 194         if (this->dynamic &&
 195                 memeq(this->from, from, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16) &&
 196                 memeq(this->to, to, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16))
 197         {
 198                 written += fprintf(stream, "dynamic/%d",
 199                                                    this->type == TS_IPV4_ADDR_RANGE ? 32 : 128);
 200         }
 201         else
 202         {
 203                 if (this->type == TS_IPV4_ADDR_RANGE)
 204                 {
 205                         inet_ntop(AF_INET, &this->from4, addr_str, sizeof(addr_str));
 206                 }
 207                 else
 208                 {
 209                         inet_ntop(AF_INET6, &this->from6, addr_str, sizeof(addr_str));
 210                 }
 211                 mask = calc_netbits(this);
 212                 written += fprintf(stream, "%s/%d", addr_str, mask);
 213         }
 214
 215         /* check if we have protocol and/or port selectors */
 216         has_proto = this->protocol != 0;
 217         has_ports = !(this->from_port == 0 && this->to_port == 0xFFFF);
 218
 219         if (!has_proto && !has_ports)
 220         {
 221                 return written;
 222         }
 223
 224         written += fprintf(stream, "[");
 225
 226         /* build protocol string */
 227         if (has_proto)
 228         {
 229                 struct protoent *proto = getprotobynumber(this->protocol);
 230
 231                 if (proto)
 232                 {
 233                         written += fprintf(stream, "%s", proto->p_name);
 234                         serv_proto = proto->p_name;
 235                 }
 236                 else
 237                 {
 238                         written += fprintf(stream, "%d", this->protocol);
 239                 }
 240         }
 241
 242         if (has_proto && has_ports)
 243         {
 244                 written += fprintf(stream, "/");
 245         }
 246
 247         /* build port string */
 248         if (has_ports)
 249         {
 250                 if (this->from_port == this->to_port)
 251                 {
 252                         struct servent *serv = getservbyport(htons(this->from_port), serv_proto);
 253
 254                         if (serv)
 255                         {
 256                                 written += fprintf(stream, "%s", serv->s_name);
 257                         }
 258                         else
 259                         {
 260                                 written += fprintf(stream, "%d", this->from_port);
 261                         }
 262                 }
 263                 else
 264                 {
 265                         written += fprintf(stream, "%d-%d", this->from_port, this->to_port);
 266                 }
 267         }
 268
 269         written += fprintf(stream, "]");
 270
 271         return written;
 272 }
 273
 274 /**
 275  * arginfo handler for printf() traffic selector
 276  */
 277 static int arginfo(const struct printf_info *info, size_t n, int *argtypes)
 278 {
 279         if (n > 0)
 280         {
 281                 argtypes[0] = PA_POINTER;
 282         }
 283         return 1;
 284 }
 285
 286 /**
 287  * return printf hook functions for a chunk
 288  */
 289 printf_hook_functions_t traffic_selector_get_printf_hooks()
 290 {
 291         printf_hook_functions_t hooks = {print, arginfo};
 292
 293         return hooks;
 294 }
 295
 296 /**
 297  * implements traffic_selector_t.get_subset
 298  */
 299 static traffic_selector_t *get_subset(private_traffic_selector_t *this, private_traffic_selector_t *other)
 300 {
 301         if (this->type == other->type && (this->protocol == other->protocol ||
 302                                                                 this->protocol == 0 || other->protocol == 0))
 303         {
 304                 u_int16_t from_port, to_port;
 305                 u_char *from, *to;
 306                 u_int8_t protocol;
 307                 size_t size;
 308                 private_traffic_selector_t *new_ts;
 309
 310                 /* calculate the maximum port range allowed for both */
 311                 from_port = max(this->from_port, other->from_port);
 312                 to_port = min(this->to_port, other->to_port);
 313                 if (from_port > to_port)
 314                 {
 315                         return NULL;
 316                 }
 317                 /* select protocol, which is not zero */
 318                 protocol = max(this->protocol, other->protocol);
 319
 320                 switch (this->type)
 321                 {
 322                         case TS_IPV4_ADDR_RANGE:
 323                                 size = sizeof(this->from4);
 324                                 break;
 325                         case TS_IPV6_ADDR_RANGE:
 326                                 size = sizeof(this->from6);
 327                                 break;
 328                         default:
 329                                 return NULL;
 330                 }
 331
 332                 /* get higher from-address */
 333                 if (memcmp(this->from, other->from, size) > 0)
 334                 {
 335                         from = this->from;
 336                 }
 337                 else
 338                 {
 339                         from = other->from;
 340                 }
 341                 /* get lower to-address */
 342                 if (memcmp(this->to, other->to, size) > 0)
 343                 {
 344                         to = other->to;
 345                 }
 346                 else
 347                 {
 348                         to = this->to;
 349                 }
 350                 /* if "from" > "to", we don't have a match */
 351                 if (memcmp(from, to, size) > 0)
 352                 {
 353                         return NULL;
 354                 }
 355
 356                 /* we have a match in protocol, port, and address: return it... */
 357                 new_ts = traffic_selector_create(protocol, this->type, from_port, to_port);
 358                 new_ts->type = this->type;
 359                 new_ts->dynamic = this->dynamic || other->dynamic;
 360                 memcpy(new_ts->from, from, size);
 361                 memcpy(new_ts->to, to, size);
 362
 363                 return &new_ts->public;
 364         }
 365         return NULL;
 366 }
 367
 368 /**
 369  * implements traffic_selector_t.equals
 370  */
 371 static bool equals(private_traffic_selector_t *this, private_traffic_selector_t *other)
 372 {
 373         if (this->type != other->type)
 374         {
 375                 return FALSE;
 376         }
 377         if (!(this->from_port == other->from_port &&
 378                   this->to_port == other->to_port &&
 379                   this->protocol == other->protocol))
 380         {
 381                 return FALSE;
 382         }
 383         switch (this->type)
 384         {
 385                 case TS_IPV4_ADDR_RANGE:
 386                         if (memeq(this->from4, other->from4, sizeof(this->from4)))
 387                         {
 388                                 return TRUE;
 389                         }
 390                         break;
 391                 case TS_IPV6_ADDR_RANGE:
 392                         if (memeq(this->from6, other->from6, sizeof(this->from6)))
 393                         {
 394                                 return TRUE;
 395                         }
 396                         break;
 397                 default:
 398                         break;
 399         }
 400         return FALSE;
 401 }
 402
 403 /**
 404  * Implements traffic_selector_t.get_from_address.
 405  */
 406 static chunk_t get_from_address(private_traffic_selector_t *this)
 407 {
 408         chunk_t from = chunk_empty;
 409
 410         switch (this->type)
 411         {
 412                 case TS_IPV4_ADDR_RANGE:
 413                 {
 414                         from.len = sizeof(this->from4);
 415                         from.ptr = malloc(from.len);
 416                         memcpy(from.ptr, this->from4, from.len);
 417                         break;
 418                 }
 419                 case TS_IPV6_ADDR_RANGE:
 420                 {
 421                         from.len = sizeof(this->from6);
 422                         from.ptr = malloc(from.len);
 423                         memcpy(from.ptr, this->from6, from.len);
 424                         break;
 425                 }
 426         }
 427         return from;
 428 }
 429
 430 /**
 431  * Implements traffic_selector_t.get_to_address.
 432  */
 433 static chunk_t get_to_address(private_traffic_selector_t *this)
 434 {
 435         chunk_t to = chunk_empty;
 436
 437         switch (this->type)
 438         {
 439                 case TS_IPV4_ADDR_RANGE:
 440                 {
 441                         to.len = sizeof(this->to4);
 442                         to.ptr = malloc(to.len);
 443                         memcpy(to.ptr, this->to4, to.len);
 444                         break;
 445                 }
 446                 case TS_IPV6_ADDR_RANGE:
 447                 {
 448                         to.len = sizeof(this->to6);
 449                         to.ptr = malloc(to.len);
 450                         memcpy(to.ptr, this->to6, to.len);
 451                         break;
 452                 }
 453         }
 454         return to;
 455 }
 456
 457 /**
 458  * Implements traffic_selector_t.get_from_port.
 459  */
 460 static u_int16_t get_from_port(private_traffic_selector_t *this)
 461 {
 462         return this->from_port;
 463 }
 464
 465 /**
 466  * Implements traffic_selector_t.get_to_port.
 467  */
 468 static u_int16_t get_to_port(private_traffic_selector_t *this)
 469 {
 470         return this->to_port;
 471 }
 472
 473 /**
 474  * Implements traffic_selector_t.get_type.
 475  */
 476 static ts_type_t get_type(private_traffic_selector_t *this)
 477 {
 478         return this->type;
 479 }
 480
 481 /**
 482  * Implements traffic_selector_t.get_protocol.
 483  */
 484 static u_int8_t get_protocol(private_traffic_selector_t *this)
 485 {
 486         return this->protocol;
 487 }
 488
 489 /**
 490  * Implements traffic_selector_t.is_host.
 491  */
 492 static bool is_host(private_traffic_selector_t *this, host_t *host)
 493 {
 494         if (host)
 495         {
 496                 chunk_t addr;
 497                 int family = host->get_family(host);
 498
 499                 if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 500                         (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 501                 {
 502                         addr = host->get_address(host);
 503                         if (memeq(addr.ptr, this->from, addr.len) &&
 504                                 memeq(addr.ptr, this->to, addr.len))
 505                         {
 506                                 return TRUE;
 507                         }
 508                 }
 509         }
 510         else
 511         {
 512                 size_t length = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 513
 514                 if (this->dynamic)
 515                 {
 516                         return TRUE;
 517                 }
 518
 519                 if (memeq(this->from, this->to, length))
 520                 {
 521                         return TRUE;
 522                 }
 523         }
 524         return FALSE;
 525 }
 526
 527 /**
 528  * Implements traffic_selector_t.set_address.
 529  */
 530 static void set_address(private_traffic_selector_t *this, host_t *host)
 531 {
 532         if (this->dynamic)
 533         {
 534                 this->type = host->get_family(host) == AF_INET ?
 535                                 TS_IPV4_ADDR_RANGE : TS_IPV6_ADDR_RANGE;
 536
 537                 chunk_t from = host->get_address(host);
 538                 memcpy(this->from, from.ptr, from.len);
 539                 memcpy(this->to, from.ptr, from.len);
 540         }
 541 }
 542
 543 /**
 544  * Implements traffic_selector_t.is_contained_in.
 545  */
 546 static bool is_contained_in(private_traffic_selector_t *this,
 547                                                         private_traffic_selector_t *other)
 548 {
 549         private_traffic_selector_t *subset;
 550         bool contained_in = FALSE;
 551
 552         subset = (private_traffic_selector_t*)get_subset(this, other);
 553
 554         if (subset)
 555         {
 556                 if (equals(subset, this))
 557                 {
 558                         contained_in = TRUE;
 559                 }
 560                 free(subset);
 561         }
 562         return contained_in;
 563 }
 564
 565 /**
 566  * Implements traffic_selector_t.includes.
 567  */
 568 static bool includes(private_traffic_selector_t *this, host_t *host)
 569 {
 570         chunk_t addr;
 571         int family = host->get_family(host);
 572
 573         if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 574                 (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 575         {
 576                 addr = host->get_address(host);
 577
 578                 return memcmp(this->from, addr.ptr, addr.len) <= 0 &&
 579                                 memcmp(this->to, addr.ptr, addr.len) >= 0;
 580         }
 581
 582         return FALSE;
 583 }
 584
 585 /**
 586  * Implements traffic_selector_t.clone.
 587  */
 588 static traffic_selector_t *clone_(private_traffic_selector_t *this)
 589 {
 590         private_traffic_selector_t *clone;
 591
 592         clone = traffic_selector_create(this->protocol, this->type,
 593                                                                         this->from_port, this->to_port);
 594
 595         clone->dynamic = this->dynamic;
 596         switch (clone->type)
 597         {
 598                 case TS_IPV4_ADDR_RANGE:
 599                 {
 600                         memcpy(clone->from4, this->from4, sizeof(this->from4));
 601                         memcpy(clone->to4, this->to4, sizeof(this->to4));
 602                         return &clone->public;
 603                 }
 604                 case TS_IPV6_ADDR_RANGE:
 605                 {
 606                         memcpy(clone->from6, this->from6, sizeof(this->from6));
 607                         memcpy(clone->to6, this->to6, sizeof(this->to6));
 608                         return &clone->public;
 609                 }
 610                 default:
 611                 {
 612                         /* unreachable */
 613                         return &clone->public;
 614                 }
 615         }
 616 }
 617
 618 /**
 619  * Implements traffic_selector_t.destroy.
 620  */
 621 static void destroy(private_traffic_selector_t *this)
 622 {
 623         free(this);
 624 }
 625
 626 /*
 627  * see header
 628  */
 629 traffic_selector_t *traffic_selector_create_from_bytes(u_int8_t protocol,
 630                                                                                                 ts_type_t type,
 631                                                                                                 chunk_t from, u_int16_t from_port,
 632                                                                                                 chunk_t to, u_int16_t to_port)
 633 {
 634         private_traffic_selector_t *this = traffic_selector_create(protocol, type,
 635                                                                                                                         from_port, to_port);
 636
 637         switch (type)
 638         {
 639                 case TS_IPV4_ADDR_RANGE:
 640                 {
 641                         if (from.len != 4 || to.len != 4)
 642                         {
 643                                 free(this);
 644                                 return NULL;
 645                         }
 646                         memcpy(this->from4, from.ptr, from.len);
 647                         memcpy(this->to4, to.ptr, to.len);
 648                         break;
 649                 }
 650                 case TS_IPV6_ADDR_RANGE:
 651                 {
 652                         if (from.len != 16 || to.len != 16)
 653                         {
 654                                 free(this);
 655                                 return NULL;
 656                         }
 657                         memcpy(this->from6, from.ptr, from.len);
 658                         memcpy(this->to6, to.ptr, to.len);
 659                         break;
 660                 }
 661                 default:
 662                 {
 663                         free(this);
 664                         return NULL;
 665                 }
 666         }
 667         return (&this->public);
 668 }
 669
 670 /*
 671  * see header
 672  */
 673 traffic_selector_t *traffic_selector_create_from_subnet(host_t *net,
 674                                                         u_int8_t netbits, u_int8_t protocol, u_int16_t port)
 675 {
 676         private_traffic_selector_t *this = traffic_selector_create(protocol, 0, 0, 65535);
 677
 678         switch (net->get_family(net))
 679         {
 680                 case AF_INET:
 681                 {
 682                         chunk_t from;
 683
 684                         this->type = TS_IPV4_ADDR_RANGE;
 685                         from = net->get_address(net);
 686                         memcpy(this->from4, from.ptr, from.len);
 687                         if (this->from4[0] == 0)
 688                         {
 689                                 /* use /0 for 0.0.0.0 */
 690                                 this->to4[0] = ~0;
 691                         }
 692                         else
 693                         {
 694                                 calc_range(this, netbits);
 695                         }
 696                         break;
 697                 }
 698                 case AF_INET6:
 699                 {
 700                         chunk_t from;
 701
 702                         this->type = TS_IPV6_ADDR_RANGE;
 703                         from = net->get_address(net);
 704                         memcpy(this->from6, from.ptr, from.len);
 705                         if (this->from6[0] == 0 && this->from6[1] == 0 &&
 706                                 this->from6[2] == 0 && this->from6[3] == 0)
 707                         {
 708                                 /* use /0 for ::0 */
 709                                 this->to6[0] = ~0;
 710                                 this->to6[1] = ~0;
 711                                 this->to6[2] = ~0;
 712                                 this->to6[3] = ~0;
 713                         }
 714                         else
 715                         {
 716                                 calc_range(this, netbits);
 717                         }
 718                         break;
 719                 }
 720                 default:
 721                 {
 722                         net->destroy(net);
 723                         free(this);
 724                         return NULL;
 725                 }
 726         }
 727         if (port)
 728         {
 729                 this->from_port = port;
 730                 this->to_port = port;
 731         }
 732         net->destroy(net);
 733         return (&this->public);
 734 }
 735
 736 /*
 737  * see header
 738  */
 739 traffic_selector_t *traffic_selector_create_from_string(
 740                                                                                 u_int8_t protocol, ts_type_t type,
 741                                                                                 char *from_addr, u_int16_t from_port,
 742                                                                                 char *to_addr, u_int16_t to_port)
 743 {
 744         private_traffic_selector_t *this = traffic_selector_create(protocol, type,
 745                                                                                                                         from_port, to_port);
 746
 747         this->type = type;
 748         switch (type)
 749         {
 750                 case TS_IPV4_ADDR_RANGE:
 751                 {
 752                         if (inet_pton(AF_INET, from_addr, (struct in_addr*)this->from4) < 0)
 753                         {
 754                                 free(this);
 755                                 return NULL;
 756                         }
 757                         if (inet_pton(AF_INET, to_addr, (struct in_addr*)this->to4) < 0)
 758                         {
 759                                 free(this);
 760                                 return NULL;
 761                         }
 762                         break;
 763                 }
 764                 case TS_IPV6_ADDR_RANGE:
 765                 {
 766                         if (inet_pton(AF_INET6, from_addr, (struct in6_addr*)this->from6) < 0)
 767                         {
 768                                 free(this);
 769                                 return NULL;
 770                         }
 771                         if (inet_pton(AF_INET6, to_addr, (struct in6_addr*)this->to6) < 0)
 772                         {
 773                                 free(this);
 774                                 return NULL;
 775                         }
 776                         break;
 777                 }
 778         }
 779         return (&this->public);
 780 }
 781
 782 /*
 783  * see header
 784  */
 785 traffic_selector_t *traffic_selector_create_dynamic(u_int8_t protocol,
 786                                                                         u_int16_t from_port, u_int16_t to_port)
 787 {
 788         private_traffic_selector_t *this = traffic_selector_create(
 789                                                         protocol, TS_IPV4_ADDR_RANGE, from_port, to_port);
 790
 791         memset(this->from6, 0, sizeof(this->from6));
 792         memset(this->to6, 0xFF, sizeof(this->to6));
 793
 794         this->dynamic = TRUE;
 795
 796         return &this->public;
 797 }
 798
 799 /*
 800  * see declaration
 801  */
 802 static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol,
 803                                                 ts_type_t type, u_int16_t from_port, u_int16_t to_port)
 804 {
 805         private_traffic_selector_t *this = malloc_thing(private_traffic_selector_t);
 806
 807         /* public functions */
 808         this->public.get_subset = (traffic_selector_t*(*)(traffic_selector_t*,traffic_selector_t*))get_subset;
 809         this->public.equals = (bool(*)(traffic_selector_t*,traffic_selector_t*))equals;
 810         this->public.get_from_address = (chunk_t(*)(traffic_selector_t*))get_from_address;
 811         this->public.get_to_address = (chunk_t(*)(traffic_selector_t*))get_to_address;
 812         this->public.get_from_port = (u_int16_t(*)(traffic_selector_t*))get_from_port;
 813         this->public.get_to_port = (u_int16_t(*)(traffic_selector_t*))get_to_port;
 814         this->public.get_type = (ts_type_t(*)(traffic_selector_t*))get_type;
 815         this->public.get_protocol = (u_int8_t(*)(traffic_selector_t*))get_protocol;
 816         this->public.is_host = (bool(*)(traffic_selector_t*,host_t*))is_host;
 817         this->public.is_contained_in = (bool(*)(traffic_selector_t*,traffic_selector_t*))is_contained_in;
 818         this->public.includes = (bool(*)(traffic_selector_t*,host_t*))includes;
 819         this->public.set_address = (void(*)(traffic_selector_t*,host_t*))set_address;
 820         this->public.clone = (traffic_selector_t*(*)(traffic_selector_t*))clone_;
 821         this->public.destroy = (void(*)(traffic_selector_t*))destroy;
 822
 823         this->from_port = from_port;
 824         this->to_port = to_port;
 825         this->protocol = protocol;
 826         this->type = type;
 827         this->dynamic = FALSE;
 828
 829         return this;
 830 }
 831