src/libstrongswan/selectors/traffic_selector.c

   1 /*
   2  * Copyright (C) 2007-2009 Tobias Brunner
   3  * Copyright (C) 2005-2007 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 #include <arpa/inet.h>
  19 #include <string.h>
  20 #include <netdb.h>
  21 #include <stdio.h>
  22
  23 #include "traffic_selector.h"
  24
  25 #include <utils/linked_list.h>
  26 #include <utils/identification.h>
  27 #include <debug.h>
  28
  29 #define NON_SUBNET_ADDRESS_RANGE        255
  30
  31 ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_IPV6_ADDR_RANGE,
  32         "TS_IPV4_ADDR_RANGE",
  33         "TS_IPV6_ADDR_RANGE",
  34 );
  35
  36 typedef struct private_traffic_selector_t private_traffic_selector_t;
  37
  38 /**
  39  * Private data of an traffic_selector_t object
  40  */
  41 struct private_traffic_selector_t {
  42
  43         /**
  44          * Public part
  45          */
  46         traffic_selector_t public;
  47
  48         /**
  49          * Type of address
  50          */
  51         ts_type_t type;
  52
  53         /**
  54          * IP protocol (UDP, TCP, ICMP, ...)
  55          */
  56         u_int8_t protocol;
  57
  58         /**
  59          * narrow this traffic selector to hosts external ip
  60          * if set, from and to have no meaning until set_address() is called
  61          */
  62         bool dynamic;
  63
  64         /**
  65          * subnet size in CIDR notation, 255 means a non-subnet address range
  66          */
  67         u_int8_t netbits;
  68
  69         /**
  70          * begin of address range, network order
  71          */
  72         union {
  73                 /** dummy char for common address manipulation */
  74                 char from[0];
  75                 /** IPv4 address */
  76                 u_int32_t from4[1];
  77                 /** IPv6 address */
  78                 u_int32_t from6[4];
  79         };
  80
  81         /**
  82          * end of address range, network order
  83          */
  84         union {
  85                 /** dummy char for common address manipulation */
  86                 char to[0];
  87                 /** IPv4 address */
  88                 u_int32_t to4[1];
  89                 /** IPv6 address */
  90                 u_int32_t to6[4];
  91         };
  92
  93         /**
  94          * begin of port range
  95          */
  96         u_int16_t from_port;
  97
  98         /**
  99          * end of port range
 100          */
 101         u_int16_t to_port;
 102 };
 103
 104 /**
 105  * calculate the "to"-address for the "from" address and a subnet size
 106  */
 107 static void calc_range(private_traffic_selector_t *this, u_int8_t netbits)
 108 {
 109         size_t len;
 110         int bytes, bits;
 111         u_int8_t mask;
 112
 113         this->netbits = netbits;
 114
 115         len   = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 116         bytes = (netbits + 7)/8;
 117         bits  = (bytes * 8) - netbits;
 118         mask  = bits ? (1 << bits) - 1 : 0;
 119
 120         memcpy(this->to, this->from, bytes);
 121         memset(this->from + bytes, 0x00, len - bytes);
 122         memset(this->to   + bytes, 0xff, len - bytes);
 123         this->from[bytes-1] &= ~mask;
 124         this->to[bytes-1]   |=  mask;
 125 }
 126
 127 /**
 128  * calculate the subnet size from the "to" and "from" addresses
 129  */
 130 static u_int8_t calc_netbits(private_traffic_selector_t *this)
 131 {
 132         int byte, bit;
 133         u_int8_t netbits;
 134         size_t size = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 135         bool prefix = TRUE;
 136
 137         /* a perfect match results in a single address with a /32 or /128 netmask */
 138         netbits = (size * 8);
 139         this->netbits = netbits;
 140
 141         /* go through all bits of the addresses, beginning in the front.
 142          * as long as they are equal, the subnet gets larger
 143          */
 144         for (byte = 0; byte < size; byte++)
 145         {
 146                 for (bit = 7; bit >= 0; bit--)
 147                 {
 148                         u_int8_t bitmask = 1 << bit;
 149
 150                         if (prefix)
 151                         {
 152                                 if ((bitmask & this->from[byte]) != (bitmask & this->to[byte]))
 153                                 {
 154                                         /* store the common prefix which might be a true subnet */
 155                                         netbits = (7 - bit) + (byte * 8);
 156                                         this->netbits = netbits;
 157                                         prefix = FALSE;
 158                                 }
 159                         }
 160                         else
 161                         {
 162                                 if ((bitmask & this->from[byte]) || !(bitmask & this->to[byte]))
 163                                 {
 164                                         this->netbits = NON_SUBNET_ADDRESS_RANGE;
 165                                         return netbits;  /* return a pseudo subnet */
 166
 167                                 }
 168                         }
 169                 }
 170         }
 171         return netbits;  /* return a true subnet */
 172 }
 173
 174 /**
 175  * internal generic constructor
 176  */
 177 static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol, ts_type_t type, u_int16_t from_port, u_int16_t to_port);
 178
 179 /**
 180  * Described in header.
 181  */
 182 int traffic_selector_printf_hook(printf_hook_data_t *data,
 183                                                         printf_hook_spec_t *spec, const void *const *args)
 184 {
 185         private_traffic_selector_t *this = *((private_traffic_selector_t**)(args[0]));
 186         linked_list_t *list = *((linked_list_t**)(args[0]));
 187         enumerator_t *enumerator;
 188         char from_str[INET6_ADDRSTRLEN] = "";
 189         char to_str[INET6_ADDRSTRLEN] = "";
 190         char *serv_proto = NULL;
 191         bool has_proto;
 192         bool has_ports;
 193         size_t written = 0;
 194         u_int32_t from[4], to[4];
 195
 196         if (this == NULL)
 197         {
 198                 return print_in_hook(data, "(null)");
 199         }
 200
 201         if (spec->hash)
 202         {
 203                 enumerator = list->create_enumerator(list);
 204                 while (enumerator->enumerate(enumerator, (void**)&this))
 205                 {
 206                         /* call recursivly */
 207                         written += print_in_hook(data, "%R ", this);
 208                 }
 209                 enumerator->destroy(enumerator);
 210                 return written;
 211         }
 212
 213         memset(from, 0, sizeof(from));
 214         memset(to, 0xFF, sizeof(to));
 215         if (this->dynamic &&
 216                 memeq(this->from, from, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16) &&
 217                 memeq(this->to, to, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16))
 218         {
 219                 written += print_in_hook(data, "dynamic");
 220         }
 221         else
 222         {
 223                 if (this->type == TS_IPV4_ADDR_RANGE)
 224                 {
 225                         inet_ntop(AF_INET, &this->from4, from_str, sizeof(from_str));
 226                 }
 227                 else
 228                 {
 229                         inet_ntop(AF_INET6, &this->from6, from_str, sizeof(from_str));
 230                 }
 231                 if (this->netbits == NON_SUBNET_ADDRESS_RANGE)
 232                 {
 233                         if (this->type == TS_IPV4_ADDR_RANGE)
 234                         {
 235                                 inet_ntop(AF_INET, &this->to4, to_str, sizeof(to_str));
 236                         }
 237                         else
 238                         {
 239                                 inet_ntop(AF_INET6, &this->to6, to_str, sizeof(to_str));
 240                         }
 241                         written += print_in_hook(data, "%s..%s", from_str, to_str);
 242                 }
 243                 else
 244                 {
 245                         written += print_in_hook(data, "%s/%d", from_str, this->netbits);
 246                 }
 247         }
 248
 249         /* check if we have protocol and/or port selectors */
 250         has_proto = this->protocol != 0;
 251         has_ports = !(this->from_port == 0 && this->to_port == 0xFFFF);
 252
 253         if (!has_proto && !has_ports)
 254         {
 255                 return written;
 256         }
 257
 258         written += print_in_hook(data, "[");
 259
 260         /* build protocol string */
 261         if (has_proto)
 262         {
 263                 struct protoent *proto = getprotobynumber(this->protocol);
 264
 265                 if (proto)
 266                 {
 267                         written += print_in_hook(data, "%s", proto->p_name);
 268                         serv_proto = proto->p_name;
 269                 }
 270                 else
 271                 {
 272                         written += print_in_hook(data, "%d", this->protocol);
 273                 }
 274         }
 275
 276         if (has_proto && has_ports)
 277         {
 278                 written += print_in_hook(data, "/");
 279         }
 280
 281         /* build port string */
 282         if (has_ports)
 283         {
 284                 if (this->from_port == this->to_port)
 285                 {
 286                         struct servent *serv = getservbyport(htons(this->from_port), serv_proto);
 287
 288                         if (serv)
 289                         {
 290                                 written += print_in_hook(data, "%s", serv->s_name);
 291                         }
 292                         else
 293                         {
 294                                 written += print_in_hook(data, "%d", this->from_port);
 295                         }
 296                 }
 297                 else
 298                 {
 299                         written += print_in_hook(data, "%d-%d", this->from_port, this->to_port);
 300                 }
 301         }
 302
 303         written += print_in_hook(data, "]");
 304
 305         return written;
 306 }
 307
 308 /**
 309  * Implements traffic_selector_t.get_subset
 310  */
 311 static traffic_selector_t *get_subset(private_traffic_selector_t *this, private_traffic_selector_t *other)
 312 {
 313         if (this->dynamic || other->dynamic)
 314         {       /* no set_address() applied, TS has no subset */
 315                 return NULL;
 316         }
 317         if (this->type == other->type && (this->protocol == other->protocol ||
 318                                                                 this->protocol == 0 || other->protocol == 0))
 319         {
 320                 u_int16_t from_port, to_port;
 321                 u_char *from, *to;
 322                 u_int8_t protocol;
 323                 size_t size;
 324                 private_traffic_selector_t *new_ts;
 325
 326                 /* calculate the maximum port range allowed for both */
 327                 from_port = max(this->from_port, other->from_port);
 328                 to_port = min(this->to_port, other->to_port);
 329                 if (from_port > to_port)
 330                 {
 331                         return NULL;
 332                 }
 333                 /* select protocol, which is not zero */
 334                 protocol = max(this->protocol, other->protocol);
 335
 336                 switch (this->type)
 337                 {
 338                         case TS_IPV4_ADDR_RANGE:
 339                                 size = sizeof(this->from4);
 340                                 break;
 341                         case TS_IPV6_ADDR_RANGE:
 342                                 size = sizeof(this->from6);
 343                                 break;
 344                         default:
 345                                 return NULL;
 346                 }
 347
 348                 /* get higher from-address */
 349                 if (memcmp(this->from, other->from, size) > 0)
 350                 {
 351                         from = this->from;
 352                 }
 353                 else
 354                 {
 355                         from = other->from;
 356                 }
 357                 /* get lower to-address */
 358                 if (memcmp(this->to, other->to, size) > 0)
 359                 {
 360                         to = other->to;
 361                 }
 362                 else
 363                 {
 364                         to = this->to;
 365                 }
 366                 /* if "from" > "to", we don't have a match */
 367                 if (memcmp(from, to, size) > 0)
 368                 {
 369                         return NULL;
 370                 }
 371
 372                 /* we have a match in protocol, port, and address: return it... */
 373                 new_ts = traffic_selector_create(protocol, this->type, from_port, to_port);
 374                 memcpy(new_ts->from, from, size);
 375                 memcpy(new_ts->to, to, size);
 376                 calc_netbits(new_ts);
 377                 return &new_ts->public;
 378         }
 379         return NULL;
 380 }
 381
 382 /**
 383  * Implements traffic_selector_t.equals
 384  */
 385 static bool equals(private_traffic_selector_t *this, private_traffic_selector_t *other)
 386 {
 387         if (this->type != other->type)
 388         {
 389                 return FALSE;
 390         }
 391         if (!(this->from_port == other->from_port &&
 392                   this->to_port == other->to_port &&
 393                   this->protocol == other->protocol))
 394         {
 395                 return FALSE;
 396         }
 397         switch (this->type)
 398         {
 399                 case TS_IPV4_ADDR_RANGE:
 400                         if (memeq(this->from4, other->from4, sizeof(this->from4)) &&
 401                                 memeq(this->to4, other->to4, sizeof(this->to4)))
 402                         {
 403                                 return TRUE;
 404                         }
 405                         break;
 406                 case TS_IPV6_ADDR_RANGE:
 407                         if (memeq(this->from6, other->from6, sizeof(this->from6)) &&
 408                                 memeq(this->to6, other->to6, sizeof(this->to6)))
 409                         {
 410                                 return TRUE;
 411                         }
 412                         break;
 413                 default:
 414                         break;
 415         }
 416         return FALSE;
 417 }
 418
 419 METHOD(traffic_selector_t, get_from_address, chunk_t,
 420         private_traffic_selector_t *this)
 421 {
 422         switch (this->type)
 423         {
 424                 case TS_IPV4_ADDR_RANGE:
 425                         return chunk_create(this->from, sizeof(this->from4));
 426                 case TS_IPV6_ADDR_RANGE:
 427                         return chunk_create(this->from, sizeof(this->from6));
 428                 default:
 429                         return chunk_empty;
 430         }
 431 }
 432
 433 METHOD(traffic_selector_t, get_to_address, chunk_t,
 434         private_traffic_selector_t *this)
 435 {
 436         switch (this->type)
 437         {
 438                 case TS_IPV4_ADDR_RANGE:
 439                         return chunk_create(this->to, sizeof(this->to4));
 440                 case TS_IPV6_ADDR_RANGE:
 441                         return chunk_create(this->to, sizeof(this->to6));
 442                 default:
 443                         return chunk_empty;
 444         }
 445 }
 446
 447 METHOD(traffic_selector_t, get_from_port, u_int16_t,
 448         private_traffic_selector_t *this)
 449 {
 450         return this->from_port;
 451 }
 452
 453 METHOD(traffic_selector_t, get_to_port, u_int16_t,
 454         private_traffic_selector_t *this)
 455 {
 456         return this->to_port;
 457 }
 458
 459 METHOD(traffic_selector_t, get_type, ts_type_t,
 460         private_traffic_selector_t *this)
 461 {
 462         return this->type;
 463 }
 464
 465 METHOD(traffic_selector_t, get_protocol, u_int8_t,
 466         private_traffic_selector_t *this)
 467 {
 468         return this->protocol;
 469 }
 470
 471 METHOD(traffic_selector_t, is_host, bool,
 472         private_traffic_selector_t *this, host_t *host)
 473 {
 474         if (host)
 475         {
 476                 chunk_t addr;
 477                 int family = host->get_family(host);
 478
 479                 if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 480                         (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 481                 {
 482                         addr = host->get_address(host);
 483                         if (memeq(addr.ptr, this->from, addr.len) &&
 484                                 memeq(addr.ptr, this->to, addr.len))
 485                         {
 486                                 return TRUE;
 487                         }
 488                 }
 489         }
 490         else
 491         {
 492                 size_t length = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 493
 494                 if (this->dynamic)
 495                 {
 496                         return TRUE;
 497                 }
 498
 499                 if (memeq(this->from, this->to, length))
 500                 {
 501                         return TRUE;
 502                 }
 503         }
 504         return FALSE;
 505 }
 506
 507 METHOD(traffic_selector_t, is_dynamic, bool,
 508         private_traffic_selector_t *this)
 509 {
 510         return this->dynamic;
 511 }
 512
 513 METHOD(traffic_selector_t, set_address, void,
 514         private_traffic_selector_t *this, host_t *host)
 515 {
 516         if (this->dynamic)
 517         {
 518                 this->type = host->get_family(host) == AF_INET ?
 519                                 TS_IPV4_ADDR_RANGE : TS_IPV6_ADDR_RANGE;
 520
 521                 if (host->is_anyaddr(host))
 522                 {
 523                         memset(this->from6, 0x00, sizeof(this->from6));
 524                         memset(this->to6, 0xFF, sizeof(this->to6));
 525                         this->netbits = 0;
 526                 }
 527                 else
 528                 {
 529                         chunk_t from = host->get_address(host);
 530                         memcpy(this->from, from.ptr, from.len);
 531                         memcpy(this->to, from.ptr, from.len);
 532                         this->netbits = from.len * 8;
 533                 }
 534                 this->dynamic = FALSE;
 535         }
 536 }
 537
 538 /**
 539  * Implements traffic_selector_t.is_contained_in.
 540  */
 541 static bool is_contained_in(private_traffic_selector_t *this,
 542                                                         private_traffic_selector_t *other)
 543 {
 544         private_traffic_selector_t *subset;
 545         bool contained_in = FALSE;
 546
 547         subset = (private_traffic_selector_t*)get_subset(this, other);
 548
 549         if (subset)
 550         {
 551                 if (equals(subset, this))
 552                 {
 553                         contained_in = TRUE;
 554                 }
 555                 free(subset);
 556         }
 557         return contained_in;
 558 }
 559
 560 METHOD(traffic_selector_t, includes, bool,
 561         private_traffic_selector_t *this, host_t *host)
 562 {
 563         chunk_t addr;
 564         int family = host->get_family(host);
 565
 566         if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
 567                 (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
 568         {
 569                 addr = host->get_address(host);
 570
 571                 return memcmp(this->from, addr.ptr, addr.len) <= 0 &&
 572                                 memcmp(this->to, addr.ptr, addr.len) >= 0;
 573         }
 574
 575         return FALSE;
 576 }
 577
 578 METHOD(traffic_selector_t, to_subnet, bool,
 579         private_traffic_selector_t *this, host_t **net, u_int8_t *mask)
 580 {
 581         /* there is no way to do this cleanly, as the address range may
 582          * be anything else but a subnet. We use from_addr as subnet
 583          * and try to calculate a usable subnet mask.
 584          */
 585         int family, non_zero_bytes;
 586         u_int16_t port = 0;
 587         chunk_t net_chunk;
 588
 589         *mask = (this->netbits == NON_SUBNET_ADDRESS_RANGE) ? calc_netbits(this)
 590                                                                                                                 : this->netbits;
 591
 592         switch (this->type)
 593         {
 594                 case TS_IPV4_ADDR_RANGE:
 595                         family = AF_INET;
 596                         net_chunk.len = sizeof(this->from4);
 597                         break;
 598                 case TS_IPV6_ADDR_RANGE:
 599                         family = AF_INET6;
 600                         net_chunk.len = sizeof(this->from6);
 601                         break;
 602                 default:
 603                         /* unreachable */
 604                         return FALSE;
 605         }
 606
 607         net_chunk.ptr = malloc(net_chunk.len);
 608         memset(net_chunk.ptr, 0x00, net_chunk.len);
 609         if (*mask)
 610         {
 611                 non_zero_bytes = (*mask + 7) / 8;
 612                 memcpy(net_chunk.ptr, this->from, non_zero_bytes);
 613                 net_chunk.ptr[non_zero_bytes-1] &= 0xFF << (8 * non_zero_bytes - *mask);
 614         }
 615
 616         if (this->to_port == this->from_port)
 617         {
 618                 port = this->to_port;
 619         }
 620
 621         *net = host_create_from_chunk(family, net_chunk, port);
 622         chunk_free(&net_chunk);
 623
 624         return this->netbits != NON_SUBNET_ADDRESS_RANGE;
 625 }
 626
 627 METHOD(traffic_selector_t, clone_, traffic_selector_t*,
 628         private_traffic_selector_t *this)
 629 {
 630         private_traffic_selector_t *clone;
 631
 632         clone = traffic_selector_create(this->protocol, this->type,
 633                                                                         this->from_port, this->to_port);
 634         clone->netbits = this->netbits;
 635         clone->dynamic = this->dynamic;
 636
 637         switch (clone->type)
 638         {
 639                 case TS_IPV4_ADDR_RANGE:
 640                         memcpy(clone->from4, this->from4, sizeof(this->from4));
 641                         memcpy(clone->to4, this->to4, sizeof(this->to4));
 642                         return &clone->public;
 643                 case TS_IPV6_ADDR_RANGE:
 644                         memcpy(clone->from6, this->from6, sizeof(this->from6));
 645                         memcpy(clone->to6, this->to6, sizeof(this->to6));
 646                         return &clone->public;
 647                 default:
 648                         /* unreachable */
 649                         return &clone->public;
 650         }
 651 }
 652
 653 METHOD(traffic_selector_t, destroy, void,
 654         private_traffic_selector_t *this)
 655 {
 656         free(this);
 657 }
 658
 659 /*
 660  * see header
 661  */
 662 traffic_selector_t *traffic_selector_create_from_bytes(u_int8_t protocol,
 663                                                                                                 ts_type_t type,
 664                                                                                                 chunk_t from, u_int16_t from_port,
 665                                                                                                 chunk_t to, u_int16_t to_port)
 666 {
 667         private_traffic_selector_t *this = traffic_selector_create(protocol, type,
 668                                                                                                                         from_port, to_port);
 669
 670         switch (type)
 671         {
 672                 case TS_IPV4_ADDR_RANGE:
 673                         if (from.len != 4 || to.len != 4)
 674                         {
 675                                 free(this);
 676                                 return NULL;
 677                         }
 678                         memcpy(this->from4, from.ptr, from.len);
 679                         memcpy(this->to4, to.ptr, to.len);
 680                         break;
 681                 case TS_IPV6_ADDR_RANGE:
 682                         if (from.len != 16 || to.len != 16)
 683                         {
 684                                 free(this);
 685                                 return NULL;
 686                         }
 687                         memcpy(this->from6, from.ptr, from.len);
 688                         memcpy(this->to6, to.ptr, to.len);
 689                         break;
 690                 default:
 691                         free(this);
 692                         return NULL;
 693         }
 694         calc_netbits(this);
 695         return (&this->public);
 696 }
 697
 698 /*
 699  * see header
 700  */
 701 traffic_selector_t *traffic_selector_create_from_rfc3779_format(ts_type_t type,
 702                                                                                                 chunk_t from, chunk_t to)
 703 {
 704         size_t len;
 705         private_traffic_selector_t *this = traffic_selector_create(0, type, 0, 65535);
 706
 707         switch (type)
 708         {
 709                 case TS_IPV4_ADDR_RANGE:
 710                         len = 4;
 711                         break;
 712                 case TS_IPV6_ADDR_RANGE:
 713                         len = 16;
 714                         break;
 715                 default:
 716                         free(this);
 717                         return NULL;
 718         }
 719         memset(this->from, 0x00, len);
 720         memset(this->to  , 0xff, len);
 721
 722         if (from.len > 1)
 723         {
 724                 memcpy(this->from, from.ptr+1, from.len-1);
 725         }
 726         if (to.len > 1)
 727         {
 728                 u_int8_t mask = to.ptr[0] ? (1 << to.ptr[0]) - 1 : 0;
 729
 730                 memcpy(this->to, to.ptr+1, to.len-1);
 731                 this->to[to.len-2] |= mask;
 732         }
 733         this->netbits = chunk_equals(from, to) ? (from.len-1)*8 - from.ptr[0]
 734                                                                                    : NON_SUBNET_ADDRESS_RANGE;
 735         return (&this->public);
 736 }
 737
 738 /*
 739  * see header
 740  */
 741 traffic_selector_t *traffic_selector_create_from_subnet(host_t *net,
 742                                                         u_int8_t netbits, u_int8_t protocol, u_int16_t port)
 743 {
 744         private_traffic_selector_t *this;
 745         chunk_t from;
 746
 747         this = traffic_selector_create(protocol, 0, 0, 65535);
 748
 749         switch (net->get_family(net))
 750         {
 751                 case AF_INET:
 752                         this->type = TS_IPV4_ADDR_RANGE;
 753                         break;
 754                 case AF_INET6:
 755                         this->type = TS_IPV6_ADDR_RANGE;
 756                         break;
 757                 default:
 758                         net->destroy(net);
 759                         free(this);
 760                         return NULL;
 761         }
 762         from = net->get_address(net);
 763         memcpy(this->from, from.ptr, from.len);
 764         netbits = min(netbits, this->type == TS_IPV4_ADDR_RANGE ? 32 : 128);
 765         calc_range(this, netbits);
 766         if (port)
 767         {
 768                 this->from_port = port;
 769                 this->to_port = port;
 770         }
 771         net->destroy(net);
 772
 773         return &this->public;
 774 }
 775
 776 /*
 777  * see header
 778  */
 779 traffic_selector_t *traffic_selector_create_from_string(
 780                                                                                 u_int8_t protocol, ts_type_t type,
 781                                                                                 char *from_addr, u_int16_t from_port,
 782                                                                                 char *to_addr, u_int16_t to_port)
 783 {
 784         private_traffic_selector_t *this = traffic_selector_create(protocol, type,
 785                                                                                                                         from_port, to_port);
 786
 787         switch (type)
 788         {
 789                 case TS_IPV4_ADDR_RANGE:
 790                         if (inet_pton(AF_INET, from_addr, (struct in_addr*)this->from4) < 0)
 791                         {
 792                                 free(this);
 793                                 return NULL;
 794                         }
 795                         if (inet_pton(AF_INET, to_addr, (struct in_addr*)this->to4) < 0)
 796                         {
 797                                 free(this);
 798                                 return NULL;
 799                         }
 800                         break;
 801                 case TS_IPV6_ADDR_RANGE:
 802                         if (inet_pton(AF_INET6, from_addr, (struct in6_addr*)this->from6) < 0)
 803                         {
 804                                 free(this);
 805                                 return NULL;
 806                         }
 807                         if (inet_pton(AF_INET6, to_addr, (struct in6_addr*)this->to6) < 0)
 808                         {
 809                                 free(this);
 810                                 return NULL;
 811                         }
 812                         break;
 813         }
 814         calc_netbits(this);
 815         return (&this->public);
 816 }
 817
 818 /*
 819  * see header
 820  */
 821 traffic_selector_t *traffic_selector_create_dynamic(u_int8_t protocol,
 822                                                                         u_int16_t from_port, u_int16_t to_port)
 823 {
 824         private_traffic_selector_t *this = traffic_selector_create(
 825                                                         protocol, TS_IPV4_ADDR_RANGE, from_port, to_port);
 826
 827         memset(this->from6, 0, sizeof(this->from6));
 828         memset(this->to6, 0xFF, sizeof(this->to6));
 829         this->netbits = 0;
 830         this->dynamic = TRUE;
 831
 832         return &this->public;
 833 }
 834
 835 /*
 836  * see declaration
 837  */
 838 static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol,
 839                                                 ts_type_t type, u_int16_t from_port, u_int16_t to_port)
 840 {
 841         private_traffic_selector_t *this;
 842
 843         INIT(this,
 844                 .public = {
 845                         .get_subset = (traffic_selector_t*(*)(traffic_selector_t*,traffic_selector_t*))get_subset,
 846                         .equals = (bool(*)(traffic_selector_t*,traffic_selector_t*))equals,
 847                         .get_from_address = _get_from_address,
 848                         .get_to_address = _get_to_address,
 849                         .get_from_port = _get_from_port,
 850                         .get_to_port = _get_to_port,
 851                         .get_type = _get_type,
 852                         .get_protocol = _get_protocol,
 853                         .is_host = _is_host,
 854                         .is_dynamic = _is_dynamic,
 855                         .is_contained_in = (bool(*)(traffic_selector_t*,traffic_selector_t*))is_contained_in,
 856                         .includes = _includes,
 857                         .set_address = _set_address,
 858                         .to_subnet = _to_subnet,
 859                         .clone = _clone_,
 860                         .destroy = _destroy,
 861                 },
 862                 .from_port = from_port,
 863                 .to_port = to_port,
 864                 .protocol = protocol,
 865                 .type = type,
 866         );
 867
 868         return this;
 869 }
 870