C代码示例：使用 XFRM_MSG_NEWSA 下发 SA

以下是使用 XFRM_MSG_NEWSA 下发 SA 的 C 代码示例：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <linux/xfrm.h>

int main() {
    // 创建 socket
    int sock_fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (sock_fd == -1) {
        perror("socket failed");
        exit(EXIT_FAILURE);
    }

    // 构造 SA
    struct xfrm_usersa_info sa_info;
    memset(&sa_info, 0, sizeof(sa_info));
    sa_info.family = AF_INET6;          // 协议族为IPv6
    sa_info.saddr.a6[0] = 0x2001;       // 源地址
    sa_info.saddr.a6[1] = 0xdb8;
    sa_info.saddr.a6[2] = 0;
    sa_info.saddr.a6[3] = 0;
    sa_info.saddr.a6[4] = 0;
    sa_info.saddr.a6[5] = 0;
    sa_info.saddr.a6[6] = 0;
    sa_info.saddr.a6[7] = 0x1;
    sa_info.daddr.a6[0] = 0x2001;       // 目的地址
    sa_info.daddr.a6[1] = 0xdb8;
    sa_info.daddr.a6[2] = 0;
    sa_info.daddr.a6[3] = 0;
    sa_info.daddr.a6[4] = 0;
    sa_info.daddr.a6[5] = 0;
    sa_info.daddr.a6[6] = 0;
    sa_info.daddr.a6[7] = 0x2;
    sa_info.id.proto = IPPROTO_ESP;     // SA的协议为ESP
    sa_info.id.spi = 0x1234;            // SA的SPI为0x1234

    // 发送XFRM_MSG_NEWSA消息
    struct sockaddr_nl nladdr;
    memset(&nladdr, 0, sizeof(nladdr));
    nladdr.nl_family = AF_NETLINK;
    struct msghdr msg;
    memset(&msg, 0, sizeof(msg));
    struct iovec iov;
    memset(&iov, 0, sizeof(iov));
    iov.iov_base = &sa_info;
    iov.iov_len = sizeof(sa_info);
    msg.msg_name = &nladdr;
    msg.msg_namelen = sizeof(nladdr);
    msg.msg_iov = &iov;
    msg.msg_iovlen = 1;
    struct nlmsghdr nlh;
    memset(&nlh, 0, sizeof(nlh));
    nlh.nlmsg_len = NLMSG_LENGTH(sizeof(sa_info));
    nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE;
    nlh.nlmsg_type = XFRM_MSG_NEWSA;
    nlh.nlmsg_pid = getpid();
    msg.msg_control = &nlh;
    msg.msg_controllen = sizeof(nlh);
    if (sendmsg(sock_fd, &msg, 0) == -1) {
        perror("sendmsg failed");
        exit(EXIT_FAILURE);
    }

    // 关闭socket
    close(sock_fd);

    return 0;
}

注意，该代码仅用于演示如何使用XFRM_MSG_NEWSA下发SA，实际使用时可能需要根据具体需求进行修改。另外，为了简化代码，省略了一些错误处理逻辑。实际使用时应该加上相应的错误处理。