src/connectivity/libipsecims/setkey_fileio.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
#include <errno.h>
#include <netdb.h>
#include <fcntl.h>
#include <dirent.h>
#include <time.h>
#include <linux/capability.h>
#include <sys/capability.h>
#include <cutils/properties.h>
#include "setkey_fileio.h"
#if 0
#include "../setkey/log_setky.h"
#endif
#define LOG_TAG "setkey"
#include <log/log.h>
#include <cutils/log.h>

#if 0
extern void plog_android(int level, char *format, ...);
extern int setkey_main(int argc, char ** argv);

#define POLICY_LEN 640
#define POLICY_MODE 320
#define FILE_MODE (S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)
#define BUFF_SIZE 128
#define RM_FILE_LEN 64

char setkey_conf[]="/data/misc/setkey/setkey.conf";
char setkey_conf_bak[]="/data/misc/setkey/setkey_bak.conf";
char setkey_conf_latest[]="/data/misc/setkey/setkey_latest.conf";


static int RemoveString(char * src,char * dst,char * ipsec_type,char * spi_src)
{
	FILE *fpSrc = NULL;
	FILE *fpDst = NULL;

	char achBuf[POLICY_LEN] = {0};
	fpSrc = fopen(setkey_conf, "rt");
	if (NULL == fpSrc)
	{
		plog_android(LLV_WARNING, "RemoveString:can't open %s,errno:%d",setkey_conf,errno);
		return -1;
	}
	chown(setkey_conf,0,1000);
	fpDst = fopen(setkey_conf_bak, "wt");
	if (NULL== fpDst)
	{
		plog_android(LLV_WARNING,"RemoveString:Create source file: %s failed,errno:%d\n", setkey_conf_bak,errno);
		fclose(fpSrc);
		return -1;
	}
	chown(setkey_conf_bak,0,1000);
	while (!feof(fpSrc))
	{
		memset(achBuf, 0, sizeof(achBuf));
		fgets(achBuf, sizeof(achBuf), fpSrc);
	/* include below parameter is right*/
		if ((strstr(achBuf, "add")!=NULL)&&(strstr(achBuf, "spdadd")==NULL)&&(strstr(achBuf, dst)!=NULL)&&(strstr(achBuf,ipsec_type)!=NULL)&&(strstr(achBuf, spi_src)!=NULL))
		{
			/*to make sure sequence,first src,then dst*/
			if(strstr(achBuf, src)<strstr(achBuf, dst))
				plog_android(LLV_WARNING,"Has found SA,%s,remove it\n",achBuf);
			else
				fputs(achBuf, fpDst);
		} else {
			fputs(achBuf, fpDst);
		}

	}
	fclose(fpSrc);
	fclose(fpDst);

	return 0;
}


static int RemoveString_SP(char * src,char * dst,int protocol,char * src_port,char * dst_port,char * direction)
{
	FILE *fpSrc = NULL;
	FILE *fpDst = NULL;

        char protocol_str[16]={0};
	char achBuf[POLICY_LEN] = {0};
        sprintf(protocol_str,"%d",protocol);

	fpSrc = fopen(setkey_conf, "rt");
	if (NULL == fpSrc)
	{
		plog_android(LLV_WARNING, "RemoveString_SP:can't open %s,errno:%d",setkey_conf,errno);
		return -1;
	}
	chown(setkey_conf,0,1000);
	fpDst = fopen(setkey_conf_bak, "wt");
	if (NULL== fpDst)
	{
		plog_android(LLV_WARNING,"RemoveString_SP:Create source file: %s failed,errno:%d\n", setkey_conf_bak,errno);
		fclose(fpSrc);
		return -1;
	}
	chown(setkey_conf_bak,0,1000);
	while (!feof(fpSrc))
	{
		memset(achBuf, 0, sizeof(achBuf));
		fgets(achBuf, sizeof(achBuf), fpSrc);
		if ((strstr(achBuf, "spdadd")!=NULL)&&(strstr(achBuf, dst)!=NULL)&&(strstr(achBuf, src)!=NULL)&&(strstr(achBuf, src_port)!=NULL)
                   &&(strstr(achBuf, dst_port)!=NULL)&&(strstr(achBuf, protocol_str)!=NULL)&&(strstr(achBuf, direction)!=NULL))
		{
            if((strstr(achBuf, src)<strstr(achBuf, dst))&&(strstr(achBuf, src_port)<strstr(achBuf, dst_port)))
		        plog_android(LLV_WARNING,"Has found SP policy,%s,remove it\n",achBuf);
            else
                fputs(achBuf, fpDst);
		}
		else
		{
			fputs(achBuf, fpDst);
		}
	}
	fclose(fpSrc);
	fclose(fpDst);

	return 0;
}


/* 1: some error; 0: process successfully */
int shell(char * cmd)
{
	FILE * fp = NULL,* fp_exit_code =NULL;
	int    bufflen;
	char * buffer = (char *)malloc((BUFF_SIZE));
	if(buffer == NULL)
    {
       plog_android(LLV_WARNING, "run shell command buffer is null");
       return -1;
    }
    char * buffer_retcode =  NULL;
    char * cmd_exit_code = (char *)malloc((BUFF_SIZE));
    int    ret_code = 0;
	if(cmd_exit_code == NULL)
    {
       plog_android(LLV_WARNING, "alloc cmd_exit_code failed ");
       goto ret_sec;
    }
	if(cmd == NULL)
    {
       plog_android(LLV_WARNING, "run shell command is null");
       goto ret_fir;
    }
	buffer[0] = 0;
    strcpy(cmd_exit_code,cmd);
    strcat(cmd_exit_code,";echo ret_code:$?");
	fp = popen(cmd_exit_code,"r");
	if(fp == NULL)
    {
        plog_android(LLV_WARNING, "can't run shell command");
        goto ret_fir;
    }
    //plog_android(LLV_WARNING, "run shell command:%s ...",cmd);
    while(fgets(buffer,BUFF_SIZE,fp)!=NULL)
    {
        plog_android(LLV_WARNING, "%s",buffer);
    }
    buffer_retcode = strstr(buffer,"ret_code:");
    if(buffer_retcode)
    {
        ret_code = atoi(buffer_retcode+strlen("ret_code:"));
        plog_android(LLV_WARNING, "processing cmd:%s return code:%d",cmd,ret_code);
    }
    pclose(fp);


ret_fir:
    if(cmd_exit_code)
        free(cmd_exit_code);
ret_sec:
    if(buffer)
        free(buffer);
    return ret_code;
}

/*rm setkey.conf file*/
int shell_rm(void)
{
    char rm_file[RM_FILE_LEN];
    int ret = 1;
    memset(rm_file,0,RM_FILE_LEN);
    snprintf(rm_file,sizeof(rm_file),"rm %s",setkey_conf);
    if(access(setkey_conf,0) == 0)
    {
        ret = shell(rm_file);
        if(ret != 0)
        {
            plog_android(LLV_WARNING,"shell %s failed,errno:%d",rm_file,errno);
	    return -1;
        }
    }
    return 0;

}

/*setkey -f setkey.conf */
int function_setkey(char * file_conf)
{
    char * argv[4];

    argv[0] = "setkey";
    argv[1] = "-f";
    argv[2] = file_conf;
    argv[3] = NULL;
    int ret = setkey_main(3,(char **)argv);
    if(ret != 0)
    {
        plog_android(LLV_WARNING," setkey -f  %s failed,errno:%d",file_conf,errno);
        return ret;
    }
    return 0;

}
#endif
/*flush all SA*/
int setkey_flushSAD(void)
{
#if 0
    char * argv[3];

    argv[0] = "setkey";
    argv[1] = "-F";
    argv[2] = NULL;
    if(shell_rm() == -1)
    {
	return -1;
    }

    int ret = setkey_main(2,(char **)argv);
    if(ret != 0)
    {
        plog_android(LLV_WARNING,"setkey -F failed,errno:%d",errno);
	return ret;
    }
    return 0;
#endif
    int ret = setkey_flushSAD_xfrm("esp");
    return ret;
}

/*flush all SP*/
int setkey_flushSPD(void)
{
#if 0
    char * argv[4];

    argv[0] = "setkey";
    argv[1] = "-F";
    argv[2] = "-P";
    argv[3] = NULL;
    if(shell_rm() == -1)
    {
	return -1;
    }
    int ret = setkey_main(3,(char **)argv);
    if(ret != 0)
    {
        plog_android(LLV_WARNING,"setkey -FP failed,errno:%d",errno);
	return ret;
    }
    return 0;
#endif
    int ret = setkey_flushSPD_xfrm();
    return ret;
}

/*delete one SA entry*/
int setkey_deleteSA(char * src,char * dst,char * ipsec_type,char * spi_src)
{
#if 0
    char delSA[POLICY_LEN];
    FILE * fd_config = NULL;



    memset(delSA,0,sizeof(delSA));

    snprintf(delSA,sizeof(delSA),"delete %s %s %s %s;\n",src,dst,ipsec_type,spi_src);
    fd_config = fopen(setkey_conf_latest, "w+");
    if(fd_config == NULL)
    {
	    plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	    return -1;

    }
    chown(setkey_conf_latest,0,1000);
    fwrite(  delSA, strlen(delSA),1,fd_config);
    plog_android(LLV_WARNING,"setkey_deleteSA:%s",delSA);
    fclose(fd_config);
    if(function_setkey(setkey_conf_latest)== -1)
        return -1;
    else
    {
    	/*update setkey.conf to record how many pairs of SA have been established*/

        if(RemoveString(src,dst,ipsec_type,spi_src)  == 0)
        {
    	    if(shell_rm() == -1)
            {
	            return -1;
            }
            if(rename(setkey_conf_bak,setkey_conf)<0)
            {
                plog_android(LLV_WARNING,"rename setkey.conf failed,errno:%d",errno);
        	    return -1;
            }
        }
        else
        {
            plog_android(LLV_WARNING,"RemoveString failed");
            return -1;
        }
    }
    return 0;
#endif
    int ret = setkey_deleteSA_xfrm(src,dst,ipsec_type,spi_src);
    return ret;
}

/*delete one SP entry*/
int setkey_deleteSP(char * src,char * dst,enum PROTOCOL_TYPE protocol,char * src_port,char * dst_port,char * direction)
{
#if 0
    char delSP[POLICY_LEN];

    FILE * fd_config = NULL;



    memset(delSP,0,sizeof(delSP));

    snprintf(delSP,sizeof(delSP),"spddelete %s[%s] %s[%s] %d -P %s;\n",src,src_port,dst,dst_port,protocol,direction);
    fd_config = fopen(setkey_conf_latest, "w+");
    if(fd_config == NULL)
    {
	    plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	    return -1;

    }
    chown(setkey_conf_latest,0,1000);
    fwrite(  delSP, strlen(delSP),1,fd_config);
    plog_android(LLV_WARNING,"setkey_deleteSP:%s",delSP);
    fclose(fd_config);
    if(function_setkey(setkey_conf_latest)==-1)
    	return -1;
    else
    {
    	/*update setkey.conf to record how many pairs of SP policy have been established*/

        if(RemoveString_SP( src, dst, protocol, src_port, dst_port, direction) == 0)
        {
    	    if(shell_rm() == -1)
            {
	            return -1;
            }
            if(rename(setkey_conf_bak,setkey_conf)<0)
            {
                plog_android(LLV_WARNING,"rename setkey.conf failed,errno:%d",errno);
        	    return -1;
            }
        }
        else
        {
            plog_android(LLV_WARNING,"RemoveString---%s failed",delSP);
            return -1;
        }
    }
    return 0;
#endif
	int ret = setkey_deleteSP_xfrm(src,dst,protocol,src_port,dst_port,direction);
	return ret;
}

/*dump SA */
int dump_setkeySA(void)
{
/*To do*/
#if 0
    char * argv[3];

    argv[0] = "setkey";
    argv[1] = "-D";
    argv[2] = NULL;
    int ret = setkey_main(2,(char **)argv);
    if(ret != 0)
    {
        plog_android(LLV_WARNING," setkey -D failed,errno:%d",errno);
        return -1;
    }
#endif
    return 0;

}

/*dump SP */
int dump_setkeySP(void)
{
/*To do*/
#if 0
   char * argv[4];

    argv[0] = "setkey";
    argv[1] = "-D";
    argv[2] = "-P";
    argv[3] = NULL;
    int ret = setkey_main(3,(char **)argv);
    if(ret != 0)
    {
        plog_android(LLV_WARNING,"setkey -DP failed,errno:%d",errno);
        return ret;
    }
#endif
    return 0;

}
#if 0
void setkey_get_aid_and_cap() {

        plog_android(LLV_WARNING,"Warning: gid:%d,uid:%d,pid:%d !\n",getgid(),getuid(),getpid());
	struct __user_cap_header_struct header;
	struct __user_cap_data_struct cap;
	header.version = _LINUX_CAPABILITY_VERSION;
	header.pid = getpid();
	capget(&header, &cap);
        plog_android(LLV_WARNING, "Warning: permitted:%x,cap.effective:%x !\n",cap.permitted,cap.effective);
}
#endif
/*set one SA*/
/*ipsec_type:ah esp
  mode:transport tunnel
  encrp_algo_src:encryption algorithm,des-cbc,3des-cbc...
  encrp_algo_src:key of encryption algorithm
  intergrity_algo_src:authentication algorithm ,hmac-md5,hmac-sha1
  intergrity_key_src:key of authentication algorithm
*/
int setkey_setSA(char * ip_src,char * ip_dst,char * ipsec_type,char * spi_src,char * mode,
                 char * encrp_algo_src,char * encrp_key_src,char * intergrity_algo_src,char * intergrity_key_src,int u_id)
{
#if 0
    char sad_policy[POLICY_LEN];

    FILE * fd_config = NULL;
    FILE * fd_config_tmp = NULL;

    memset(sad_policy,0,sizeof(sad_policy));

    setkey_get_aid_and_cap();

    fd_config_tmp = fopen(setkey_conf_latest, "w+" );
    if(fd_config_tmp == NULL)
    {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf_latest,errno);
	      return -1;
    }
    chown(setkey_conf_latest,0,1000);
   if(strcmp(encrp_algo_src,"null")==0)
    {
        if(u_id ==0 )
            snprintf(sad_policy,sizeof(sad_policy),"add %s %s %s %s  -m %s -E null  -A %s %s;\n",ip_src,ip_dst,ipsec_type,spi_src,mode,
                       intergrity_algo_src,intergrity_key_src);
        else
            snprintf(sad_policy,sizeof(sad_policy),"add %s %s %s %s  -u %d -m %s -E null  -A %s %s;\n",ip_src,ip_dst,ipsec_type,spi_src,u_id,mode,
                       intergrity_algo_src,intergrity_key_src);
    }
    else
    {
        if(u_id ==0 )
            snprintf(sad_policy,sizeof(sad_policy),"add %s %s %s %s  -m %s -E %s %s  -A %s %s;\n",ip_src,ip_dst,ipsec_type,spi_src,mode,
                       encrp_algo_src,encrp_key_src,intergrity_algo_src,intergrity_key_src);
        else
            snprintf(sad_policy,sizeof(sad_policy),"add %s %s %s %s -u %d -m %s -E %s %s  -A %s %s;\n",ip_src,ip_dst,ipsec_type,spi_src,u_id,mode,
                       encrp_algo_src,encrp_key_src,intergrity_algo_src,intergrity_key_src);
    }
    fwrite( sad_policy, strlen(sad_policy),1,fd_config_tmp );
    plog_android(LLV_WARNING,"setkey_SA:%s",sad_policy);
    fclose(fd_config_tmp);

    if(function_setkey(setkey_conf_latest)==0)
    {
        fd_config = fopen(setkey_conf, "a+" );
        if(fd_config == NULL)
        {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	      return -1;
        }
	chown(setkey_conf,0,1000);
        fwrite( sad_policy, strlen(sad_policy),1,fd_config );
        fclose(fd_config);
    }
    else
        return -1;

    return 0;
#endif
	int ret = setkey_setSA_xfrm(XFRM_MSG_NEWSA,ip_src,ip_dst,ipsec_type,spi_src,mode,
                 encrp_algo_src,encrp_key_src,intergrity_algo_src,intergrity_key_src,u_id);
	return ret;
}
int setkey_setSA_update(char * ip_src,char * ip_dst,char * ipsec_type,char * spi_src,char * mode,
                 char * encrp_algo_src,char * encrp_key_src,char * intergrity_algo_src,char * intergrity_key_src,int u_id)
{
	int ret = setkey_setSA_xfrm(XFRM_MSG_UPDSA,ip_src,ip_dst,ipsec_type,spi_src,mode,
                 encrp_algo_src,encrp_key_src,intergrity_algo_src,intergrity_key_src,u_id);
	return ret;
}
/*set one SP of one direction, just for transport mode*/
/*protocol:tcp icmp udp icmp6 ip4 gre
  direction:src->dst */
int setkey_SP(char * src_range,char * dst_range,enum PROTOCOL_TYPE protocol,char * port_src,char * port_dst,char * ipsec_type,char * mode, char * direction,int u_id)
{
#if 0
    char spd_policy[POLICY_LEN];
    FILE * fd_config = NULL;
    FILE * fd_config_tmp = NULL;
    memset(spd_policy,0,sizeof(spd_policy));


    fd_config_tmp = fopen(setkey_conf_latest, "w+" );
    if(fd_config_tmp == NULL)
    {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf_latest,errno);
	      return -1;
    }
    chown(setkey_conf_latest,0,1000);
    if(u_id ==0)
        snprintf(spd_policy,sizeof(spd_policy),"spdadd %s[%s] %s[%s] %d -P %s ipsec %s/%s//require;\n",src_range,port_src,dst_range,port_dst,protocol,direction,ipsec_type,mode);
    else
        snprintf(spd_policy,sizeof(spd_policy),"spdadd %s[%s] %s[%s] %d -P %s ipsec %s/%s//unique:%d;\n",src_range,port_src,dst_range,port_dst,protocol,direction,ipsec_type,mode,u_id);
    fwrite( spd_policy, strlen(spd_policy),1,fd_config_tmp );
    plog_android(LLV_WARNING,"setkey_SP:%s",spd_policy);
    fclose(fd_config_tmp);

    if(function_setkey(setkey_conf_latest) == 0)
    {
        fd_config = fopen(setkey_conf, "a+" );
        if(fd_config == NULL)
        {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	      return -1;
        }
	chown(setkey_conf,0,1000);
        fwrite( spd_policy, strlen(spd_policy),1,fd_config );
        fclose(fd_config);
    }
    else
        return -1;
    return 0;
#endif
	mode = "transport";
	int ret = setkey_SP_xfrm(XFRM_MSG_NEWPOLICY,src_range,dst_range,protocol,port_src,port_dst,NULL,NULL,ipsec_type,mode,direction,u_id);
	return ret;
}

/*set one SP of one direction, just for tunnel mode*/
/*protocol:tcp icmp udp icmp6 ip4 gre
  direction:src->dst
src_tunnel,dst_tunnel: tunnel src ip tunnel dst ip */
int setkey_SP_tunnel(char * src_range,char * dst_range,enum PROTOCOL_TYPE protocol,char * port_src,char * port_dst,char * src_tunnel,char * dst_tunnel,char * ipsec_type,char * mode, char * direction,int u_id)
{
#if 0
    char spd_policy[POLICY_LEN];
    FILE * fd_config = NULL;
    FILE * fd_config_tmp = NULL;
    memset(spd_policy,0,sizeof(spd_policy));


    fd_config_tmp = fopen(setkey_conf_latest, "w+" );
    if(fd_config_tmp == NULL)
    {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf_latest,errno);
	      return -1;
    }
    chown(setkey_conf_latest,0,1000);
    if(u_id ==0)
        snprintf(spd_policy,sizeof(spd_policy),"spdadd %s[%s] %s[%s] %d -P %s ipsec %s/%s/%s-%s/require;\n",src_range,port_src,dst_range,port_dst,protocol,direction,ipsec_type,mode,src_tunnel, dst_tunnel);
    else
        snprintf(spd_policy,sizeof(spd_policy),"spdadd %s[%s] %s[%s] %d -P %s ipsec %s/%s/%s-%s/unique:%d;\n",src_range,port_src,dst_range,port_dst,protocol,direction,ipsec_type,mode,src_tunnel, dst_tunnel,u_id);
    fwrite( spd_policy, strlen(spd_policy),1,fd_config_tmp );
    plog_android(LLV_WARNING,"setkey_SP_tunnel:%s",spd_policy);
    fclose(fd_config_tmp);

    if(function_setkey(setkey_conf_latest) == 0)
    {
        fd_config = fopen(setkey_conf, "a+" );
        if(fd_config == NULL)
        {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	      return -1;
        }
	chown(setkey_conf,0,1000);
        fwrite( spd_policy, strlen(spd_policy),1,fd_config );
        fclose(fd_config);
    }
    else
        return -1;
    return 0;
#endif
	mode = "tunnel";
	int ret = setkey_SP_xfrm(XFRM_MSG_NEWPOLICY,src_range,dst_range,protocol,port_src,port_dst,src_tunnel,dst_tunnel,ipsec_type,mode,direction,u_id);
	return ret;
}

/*set one SP of one direction, for 2 layers' ipsec--tunnel mode+transport mode or transport mode+tunnel mode*/
/*protocol:tcp icmp udp icmp6 ip4 gre
  direction:src->dst
src_tunnel,dst_tunnel: tunnel src ip tunnel dst ip */
int setkey_SP_tunnel_transport(char * src_range,char * dst_range,enum PROTOCOL_TYPE protocol,char * port_src,char * port_dst,char * src_tunnel,char * dst_tunnel,char * ipsec_type1,char * mode1, char * ipsec_type2,char * mode2,char * direction,int u_id1,int u_id2)
{

    char version[128] = {0};
    int ret_mapping = 0;
    property_get("net.ims.ipsec.version",version,"");
    //plog_android(LLV_WARNING,"getproperty-- net.ims.ipsec.version :%s\n",version);
    if(strcmp(version,"2.0")==0)
    {
	ret_mapping = setkey_SP(src_range,dst_range,protocol,port_src,port_dst,ipsec_type1,mode1, direction,u_id1);
	return ret_mapping;
    }

#if 0
    char spd_policy[POLICY_LEN]={0};
    char * spd_policy_mode1= (char *)malloc(POLICY_MODE);

    FILE * fd_config = NULL;
    FILE * fd_config_tmp = NULL;


    if(spd_policy_mode1==NULL)
    {
	      plog_android(LLV_WARNING,"malloc spd_policy_mode1 failed,errno:%d",errno);
	      return -1;
    }
    memset(spd_policy_mode1,0,POLICY_MODE);

    char * spd_policy_mode2= (char *)malloc(POLICY_MODE);
    if(spd_policy_mode2==NULL)
    {
	      plog_android(LLV_WARNING,"malloc spd_policy_mode2 failed,errno:%d",errno);
	      if(spd_policy_mode1)
			free(spd_policy_mode1);
	      return -1;
    }
    memset(spd_policy_mode2,0,POLICY_MODE);

    fd_config_tmp = fopen(setkey_conf_latest, "w+" );
    if(fd_config_tmp == NULL)
    {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf_latest,errno);
	      if(spd_policy_mode1)
			free(spd_policy_mode1);
	      if(spd_policy_mode2)
			free(spd_policy_mode2);
	      return -1;
    }
    chown(setkey_conf_latest,0,1000);
    if(u_id1 ==0)
        if(strcmp(mode1,"transport")==0)
        	snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s//require",ipsec_type1,mode1);
	else
		snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s/%s-%s/require",ipsec_type1,mode1,src_tunnel,dst_tunnel);
    else
        if(strcmp(mode1,"transport")==0)
        	snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s//unique:%d",ipsec_type1,mode1,u_id1);
	else
		snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s/%s-%s/unique:%d",ipsec_type1,mode1,src_tunnel,dst_tunnel,u_id1);
    if(u_id2 ==0)
        if(strcmp(mode2,"transport")==0)
        	snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s//require;\n",ipsec_type2,mode2);
	else
		snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s/%s-%s/require;\n",ipsec_type2,mode2,src_tunnel,dst_tunnel);
    else
        if(strcmp(mode2,"transport")==0)
        	snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s//unique:%d;\n",ipsec_type2,mode2,u_id2);
	else
		snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s/%s-%s/unique:%d;\n",ipsec_type2,mode2,src_tunnel,dst_tunnel,u_id2);

    snprintf(spd_policy,sizeof(spd_policy),"spdadd %s[%s] %s[%s] %d -P %s prio 2147482648 ipsec %s %s",src_range,port_src,dst_range,port_dst,protocol,direction,spd_policy_mode1,spd_policy_mode2);
    fwrite( spd_policy, strlen(spd_policy),1,fd_config_tmp );
    plog_android(LLV_WARNING,"setkey_SP_tunnel_transport:%s",spd_policy);
    fclose(fd_config_tmp);
    if(spd_policy_mode1)
	free(spd_policy_mode1);
    if(spd_policy_mode2)
	free(spd_policy_mode2);
    if(function_setkey(setkey_conf_latest) == 0)
    {
        fd_config = fopen(setkey_conf, "a+" );
        if(fd_config == NULL)
        {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	      return -1;
        }
	chown(setkey_conf,0,1000);
        fwrite( spd_policy, strlen(spd_policy),1,fd_config );
        fclose(fd_config);
    }
    else
        return -1;
    return 0;
#endif
	int ret = setkey_SP_2layer_xfrm(XFRM_MSG_UPDPOLICY,src_range,dst_range,protocol,port_src,port_dst,src_tunnel,dst_tunnel,ipsec_type1,mode1,ipsec_type2,mode2,direction,u_id1,u_id2);
	return ret;
}


/*update one SP of one direction, just for transport mode*/
/*protocol:tcp icmp udp icmp6 ip4 gre
  direction:src->dst*/
int setkey_SP_update_transport(char * src_range,char * dst_range,enum PROTOCOL_TYPE protocol,char * port_src,char * port_dst,char * ipsec_type, char * direction,int u_id)
{
#if 0
    char spd_policy[POLICY_LEN];
    FILE * fd_config = NULL;
    FILE * fd_config_tmp = NULL;
    memset(spd_policy,0,sizeof(spd_policy));


    fd_config_tmp = fopen(setkey_conf_latest, "w+" );
    if(fd_config_tmp == NULL)
    {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf_latest,errno);
	      return -1;
    }
    chown(setkey_conf_latest,0,1000);
    if(u_id ==0)
        snprintf(spd_policy,sizeof(spd_policy),"spdupdate %s[%s] %s[%s] %d -P %s ipsec %s/transport//require;\n",src_range,port_src,dst_range,port_dst,protocol,direction,ipsec_type);
    else
        snprintf(spd_policy,sizeof(spd_policy),"spdupdate %s[%s] %s[%s] %d -P %s ipsec %s/transport//unique:%d;\n",src_range,port_src,dst_range,port_dst,protocol,direction,ipsec_type,u_id);
    fwrite( spd_policy, strlen(spd_policy),1,fd_config_tmp );
    plog_android(LLV_WARNING,"setkey_SP_update_transport:%s",spd_policy);
    fclose(fd_config_tmp);

    if(function_setkey(setkey_conf_latest) == 0)
    {
        fd_config = fopen(setkey_conf, "a+" );
        if(fd_config == NULL)
        {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	      return -1;
        }
	chown(setkey_conf,0,1000);
        fwrite( spd_policy, strlen(spd_policy),1,fd_config );
        fclose(fd_config);
    }
    else
        return -1;
    return 0;
#endif
	int ret = setkey_SP_xfrm(XFRM_MSG_UPDPOLICY,src_range,dst_range,protocol,port_src,port_dst,NULL,NULL,ipsec_type,"transport",direction,u_id);
	return ret;
}

/*update one SP of one direction, for 2 layers' ipsec--tunnel mode+transport mode or transport mode+tunnel mode*/
/*protocol:tcp icmp udp icmp6 ip4 gre
  direction:src->dst
src_tunnel,dst_tunnel: tunnel src ip tunnel dst ip */
int setkey_SP_update_tunnel_transport(char * src_range,char * dst_range,enum PROTOCOL_TYPE protocol,char * port_src,char * port_dst,char * src_tunnel,char * dst_tunnel,char * ipsec_type1,char * mode1, char * ipsec_type2,char * mode2,char * direction,int u_id1,int u_id2)
{
#if 0
    char spd_policy[POLICY_LEN]={0};
    char * spd_policy_mode1= (char *)malloc(POLICY_MODE);
    FILE * fd_config = NULL;
    FILE * fd_config_tmp = NULL;


    if(spd_policy_mode1==NULL)
    {
	      plog_android(LLV_WARNING,"malloc spd_policy_mode1 failed,errno:%d",errno);
	      return -1;
    }
    memset(spd_policy_mode1,0,POLICY_MODE);
    char * spd_policy_mode2= (char *)malloc(POLICY_MODE);
    if(spd_policy_mode2==NULL)
    {
	      plog_android(LLV_WARNING,"malloc spd_policy_mode2 failed,errno:%d",errno);
	      if(spd_policy_mode1)
					free(spd_policy_mode1);
	      return -1;
    }
    memset(spd_policy_mode2,0,POLICY_MODE);

    fd_config_tmp = fopen(setkey_conf_latest, "w+" );
    if(fd_config_tmp == NULL)
    {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf_latest,errno);
	      if(spd_policy_mode1)
			free(spd_policy_mode1);
	      if(spd_policy_mode2)
			free(spd_policy_mode2);
	      return -1;
    }
    chown(setkey_conf_latest,0,1000);
    if(u_id1 ==0)
        if(strcmp(mode1,"transport")==0)
        	snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s//require",ipsec_type1,mode1);
	else
		snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s/%s-%s/require",ipsec_type1,mode1,src_tunnel,dst_tunnel);
    else
        if(strcmp(mode1,"transport")==0)
        	snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s//unique:%d",ipsec_type1,mode1,u_id1);
	else
		snprintf(spd_policy_mode1,POLICY_MODE,"%s/%s/%s-%s/unique:%d",ipsec_type1,mode1,src_tunnel,dst_tunnel,u_id1);
    if(u_id2 ==0)
        if(strcmp(mode2,"transport")==0)
        	snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s//require;\n",ipsec_type2,mode2);
	else
		snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s/%s-%s/require;\n",ipsec_type2,mode2,src_tunnel,dst_tunnel);
    else
        if(strcmp(mode2,"transport")==0)
        	snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s//unique:%d;\n",ipsec_type2,mode2,u_id2);
	else
		snprintf(spd_policy_mode2,POLICY_MODE,"%s/%s/%s-%s/unique:%d;\n",ipsec_type2,mode2,src_tunnel,dst_tunnel,u_id2);

    snprintf(spd_policy,sizeof(spd_policy),"spdupdate %s[%s] %s[%s] %d -P %s prio 2147482648 ipsec %s %s",src_range,port_src,dst_range,port_dst,protocol,direction,spd_policy_mode1,spd_policy_mode2);
    fwrite( spd_policy, strlen(spd_policy),1,fd_config_tmp );
    plog_android(LLV_WARNING,"setkey_SP_update_tunnel_transport:%s",spd_policy);
    fclose(fd_config_tmp);
    if(spd_policy_mode1)
	free(spd_policy_mode1);
    if(spd_policy_mode2)
	free(spd_policy_mode2);
    if(function_setkey(setkey_conf_latest) == 0)
    {
        fd_config = fopen(setkey_conf, "a+" );
        if(fd_config == NULL)
        {
	      plog_android(LLV_WARNING,"open %s failed,errno:%d",setkey_conf,errno);
	      return -1;
        }
	chown(setkey_conf,0,1000);
        fwrite( spd_policy, strlen(spd_policy),1,fd_config );
        fclose(fd_config);
    }
    else
        return -1;
    return 0;
#endif
	int ret = setkey_SP_2layer_xfrm(XFRM_MSG_UPDPOLICY,src_range,dst_range,protocol,port_src,port_dst,src_tunnel,dst_tunnel,ipsec_type1,mode1,ipsec_type2,mode2,direction,u_id1,u_id2);
	return ret;
}


/*flush SA\SP from setkey.conf*/
int flush_SA_SP_exist()
{
#if 0
	FILE *fpSrc = NULL;
	FILE *fpDst = NULL;
    char * p_add = NULL;
    char * p_spdadd = NULL;
    char * p = NULL;
    char * sp = NULL;
    char * sp_ipsec = NULL;
    char * sp_prio = NULL;
#if 0
    char * sp_tmp = NULL;
    char * sp_src_tmp = NULL;
    char * sp_dst_tmp = NULL;
    char * sp_dst = NULL;
#endif
    if(access(setkey_conf,0) != 0)
    {
	    plog_android(LLV_WARNING,"There is no SA before\n");
	    return 0;
    }


	char  * achBuf = (char *)malloc(POLICY_LEN);
    if(achBuf == NULL)
	{
		plog_android(LLV_WARNING,"malloc achBuf failed\n");
		return -1;
	}
 	char * achBuf_deletmp = (char *)malloc(POLICY_LEN);
    if(achBuf_deletmp == NULL)
	{
		plog_android(LLV_WARNING,"malloc achBuf_deletmp failed\n");
		if(achBuf)
			free(achBuf);

		return -1;
	}
 	char * achBuf_delet = (char *)malloc(POLICY_LEN);
    if(achBuf_delet == NULL)
	{
		plog_android(LLV_WARNING,"malloc achBuf_delet failed\n");
		if(achBuf)
			free(achBuf);
		if(achBuf_deletmp)
			free(achBuf_deletmp);
		return -1;
	}


	fpSrc = fopen(setkey_conf, "rt");
	if (NULL == fpSrc)
	{
		plog_android(LLV_WARNING, "can't open %s,errno:%d",setkey_conf,errno);
		if(achBuf)
			free(achBuf);
		if(achBuf_deletmp)
			free(achBuf_deletmp);
		if(achBuf_delet)
			free(achBuf_delet);
		return -1;
	}
	chown(setkey_conf,0,1000);
	fpDst = fopen(setkey_conf_latest, "w+");
	if (NULL== fpDst)
	{
		if(achBuf)
			free(achBuf);
		if(achBuf_deletmp)
			free(achBuf_deletmp);
		if(achBuf_delet)
			free(achBuf_delet);
		plog_android(LLV_WARNING,"Create source file: %s failed,errno:%d\n", setkey_conf_bak,errno);
		if(fpSrc)
			fclose(fpSrc);
		return -1;
	}
	chown(setkey_conf_latest,0,1000);
    fseek(fpSrc,0L,SEEK_SET);
	while (!feof(fpSrc))
	{
		memset(achBuf, 0, POLICY_LEN);
		memset(achBuf_deletmp, 0, POLICY_LEN);
		memset(achBuf_delet, 0, POLICY_LEN);
		fgets(achBuf, POLICY_LEN, fpSrc);

 		if (((p_add = strstr(achBuf, "add")) != NULL)&&(strstr(achBuf, "spdadd") == NULL) )
		{

			p = strstr(p_add,"-m");
			if(p!= NULL)
			{
				memcpy(achBuf_deletmp,p_add + strlen("add"),p-p_add-strlen("add"));
				snprintf(achBuf_delet,POLICY_LEN-1,"delete %s;\n",achBuf_deletmp) ;
               			plog_android(LLV_WARNING,"delete SA:%s\n", achBuf_delet);
			    	fputs(achBuf_delet, fpDst);
			}
			else
			{
				plog_android(LLV_WARNING,"There are some cmd error in %s,then flush all SAs and SPs\n", setkey_conf);
                		setkey_flushSAD();
                		setkey_flushSPD();
				if(achBuf)
					free(achBuf);
				if(achBuf_deletmp)
					free(achBuf_deletmp);
				if(achBuf_delet)
					free(achBuf_delet);
				if(fpSrc)
					fclose(fpSrc);
				if(fpDst)
					fclose(fpDst);
				return -1;
			}
		}

		if((p_spdadd = strstr(achBuf, "spdadd")) != NULL)
		{
			sp = p_spdadd+strlen("spdadd");
            		if((sp_prio =strstr(sp,"prio"))!=NULL)
            		{
		        memset(achBuf_deletmp, 0, POLICY_LEN);
		        memset(achBuf_delet, 0, POLICY_LEN);
		        strncpy(achBuf_deletmp,sp,sp_prio-sp);
			snprintf(achBuf_delet,POLICY_LEN-1,"spddelete %s",achBuf_deletmp);
                	strcat(achBuf_delet,";\n");
		        fputs(achBuf_delet, fpDst);
               		plog_android(LLV_WARNING,"delete policy: %s\n", achBuf_delet);
           	 	}
			else if((sp_ipsec =strstr(sp,"ipsec"))!=NULL)
            		{
		        memset(achBuf_deletmp, 0, POLICY_LEN);
		        memset(achBuf_delet, 0, POLICY_LEN);
		        strncpy(achBuf_deletmp,sp,sp_ipsec-sp);
			    snprintf(achBuf_delet,POLICY_LEN-1,"spddelete %s",achBuf_deletmp);
                strcat(achBuf_delet,";\n");
		        fputs(achBuf_delet, fpDst);
                plog_android(LLV_WARNING,"delete policy: %s\n", achBuf_delet);
            }
			else
			{
		        plog_android(LLV_WARNING,"There are some cmd error in %s,no ,then flush all SAs and SPs\n", setkey_conf);
                	setkey_flushSAD();
                	setkey_flushSPD();
			if(achBuf)
				free(achBuf);
			if(achBuf_deletmp)
				free(achBuf_deletmp);
			if(achBuf_delet)
				free(achBuf_delet);
			if(fpSrc)
				fclose(fpSrc);
			if(fpDst)
				fclose(fpDst);
		        return -1;
			}
#if 0
			if((sp_tmp =strchr(sp,'['))!=NULL)
			{
		        memset(achBuf_deletmp, 0, POLICY_LEN);
		        memset(achBuf_delet, 0, POLICY_LEN);
				strncpy(achBuf_deletmp,sp,sp_tmp-sp);
				snprintf(achBuf_delet,POLICY_LEN-1,"spddelete %s",achBuf_deletmp);
                plog_android(LLV_WARNING,"src[ achBuf_delet: %s,sp_tmp:%s\n", achBuf_deletmp,sp_tmp);
			    if((sp_src_tmp =strchr(sp_tmp,']'))!=NULL)
			    {

			    	if((sp_dst_tmp =strchr(sp_src_tmp,'['))!=NULL)
			    	{
			    		memset(achBuf_deletmp, 0, POLICY_LEN);
			    		strncpy(achBuf_deletmp,sp_src_tmp+strlen("]"),sp_dst_tmp-sp_src_tmp-strlen("]"));
				        strcat(achBuf_delet,achBuf_deletmp);
                        plog_android(LLV_WARNING,"src]_achBuf_delet: %s,achBuf:%s,sp_dst_tmp:%s\n", achBuf_deletmp,achBuf,sp_dst_tmp);
				        if((sp_dst =strchr(sp_dst_tmp,']'))!=NULL)
				        {
				        	if((sp_ipsec =strstr(sp_dst,"ipsec"))!=NULL)
				        	{
			    		        memset(achBuf_deletmp, 0, POLICY_LEN);
			    		        strncpy(achBuf_deletmp,sp_dst+strlen("]"),sp_ipsec-sp_dst-strlen("]"));
				                strcat(achBuf_delet,achBuf_deletmp);
                                strcat(achBuf_delet,";\n");
				                fputs(achBuf_delet, fpDst);
                                plog_android(LLV_WARNING,"spdadd :%s\n",achBuf_delet);
				            }
				            else
				            {
				            	plog_android(LLV_WARNING,"There are some cmd error in %s,before ipsec,then flush all SAs and SPs\n", setkey_conf);
                                setkey_flushSAD();
                                setkey_flushSPD();
				            	return -1;
				            }
				        }
				        else
			            {
				            plog_android(LLV_WARNING,"There are some cmd error in %s,no dst],then flush all SAs and SPs\n", setkey_conf);
                            setkey_flushSAD();
                            setkey_flushSPD();
				            return -1;
			            }
			    	}
			        else
			        {
				        plog_android(LLV_WARNING,"There are some cmd error in %s,no dst[,then flush all SAs and SPs\n", setkey_conf);
                                        setkey_flushSAD();
                                        setkey_flushSPD();
				        return -1;
			        }
			    }
			    else
			    {
				    plog_android(LLV_WARNING,"There are some cmd error in %s,no ],then flush all SAs and SPs\n", setkey_conf);
                    setkey_flushSAD();
                    setkey_flushSPD();
				    return -1;
			    }

			}
			else
			{
				plog_android(LLV_WARNING,"There are some cmd error in %s,no [,then flush all SAs and SPs\n", setkey_conf);
                setkey_flushSAD();
                setkey_flushSPD();
				return -1;
			}
#endif
		}


	}
	fclose(fpSrc);
	fclose(fpDst);
	if(achBuf)
		free(achBuf);
	if(achBuf_deletmp)
		free(achBuf_deletmp);
	if(achBuf_delet)
		free(achBuf_delet);
    if(function_setkey(setkey_conf_latest) == -1)
    {
        return -1;
    }
    else
    {
    	if(shell_rm() == -1)
        {
	        return -1;
        }
    }
	return 0;
#endif
	int ret = flush_SA_SP_exist_xfrm();
	return ret;
}