- working policy installation and removal
[strongswan.git] / Source / charon / threads / kernel_interface.c
1 /**
2 * @file kernel_interface.c
3 *
4 * @brief Implementation of kernel_interface_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 * Copyright (C) 2003 Herbert Xu.
12 *
13 * Contains modified parts from pluto.
14 *
15 * This program is free software; you can redistribute it and/or modify it
16 * under the terms of the GNU General Public License as published by the
17 * Free Software Foundation; either version 2 of the License, or (at your
18 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
19 *
20 * This program is distributed in the hope that it will be useful, but
21 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
22 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
23 * for more details.
24 */
25
26 #include <sys/types.h>
27 #include <sys/socket.h>
28 #include <linux/netlink.h>
29 #include <pthread.h>
30 #include <unistd.h>
31 #include <fcntl.h>
32 #include <errno.h>
33 #include <string.h>
34
35 #include "kernel_interface.h"
36
37 #include <daemon.h>
38 #include <utils/allocator.h>
39 #include <utils/linked_list.h>
40
41
42 #define KERNEL_ESP 50
43 #define KERNEL_AH 51
44
45 #define SPD_PRIORITY 1024
46
47
48 typedef struct xfrm_data_t xfrm_data_t;
49
50 /**
51 * Lenght/Type/data struct for userdata in xfrm
52 */
53 struct xfrm_data_t {
54 /**
55 * length of the data
56 */
57 u_int16_t length;
58 /**
59 * type of data
60 */
61 u_int16_t type;
62 /**
63 * and the data itself, for different purposes
64 */
65 union {
66 /* algorithm */
67 struct xfrm_algo algo;
68 /* policy tmpl */
69 struct xfrm_user_tmpl tmpl[2];
70 };
71 };
72
73
74 typedef struct netlink_message_t netlink_message_t;
75
76 /**
77 * Representation of ANY netlink message used
78 */
79 struct netlink_message_t {
80
81 /**
82 * header of the netlink message
83 */
84 struct nlmsghdr hdr;
85
86 union {
87 /* error message */
88 struct nlmsgerr e;
89 /* message for spi allocation */
90 struct xfrm_userspi_info spi;
91 /* message for SA manipulation */
92 struct xfrm_usersa_id sa_id;
93 /* message for SA installation */
94 struct xfrm_usersa_info sa;
95 /* message for policy manipulation */
96 struct xfrm_userpolicy_id policy_id;
97 /* message for policy installation */
98 struct xfrm_userpolicy_info policy;
99 };
100 u_int8_t data[512];
101 };
102
103
104 typedef struct private_kernel_interface_t private_kernel_interface_t;
105
106 /**
107 * @brief Private Variables and Functions of kernel_interface class.
108 *
109 */
110 struct private_kernel_interface_t {
111 /**
112 * Public part of the kernel_interface_t object.
113 */
114 kernel_interface_t public;
115
116 /**
117 * Netlink communication socket.
118 */
119 int socket;
120
121 pid_t pid;
122 /**
123 * Sequence number for messages.
124 */
125 u_int32_t seq;
126
127 /**
128 * List of responded messages.
129 */
130 linked_list_t *responses;
131
132 /**
133 * Thread which receives messages.
134 */
135 pthread_t thread;
136
137 /**
138 * Mutex locks access to replies list.
139 */
140 pthread_mutex_t mutex;
141
142 /**
143 * Condvar allows signaling of threads waiting for a reply.
144 */
145 pthread_cond_t condvar;
146
147 /**
148 * Function for the thread, receives messages.
149 */
150 void (*receive_messages) (private_kernel_interface_t *this);
151
152 /**
153 * Sends a netlink_message_t down to the kernel and wait for reply.
154 */
155 status_t (*send_message) (private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response);
156 };
157
158 mapping_t kernel_encryption_algs_m[] = {
159 {ENCR_DES_IV64, ""},
160 {ENCR_DES, "des"},
161 {ENCR_3DES, "des3_ede"},
162 {ENCR_RC5, ""},
163 {ENCR_IDEA, "idea"},
164 {ENCR_CAST, "cast128"},
165 {ENCR_BLOWFISH, "blowfish"},
166 {ENCR_3IDEA, ""},
167 {ENCR_DES_IV32, ""},
168 {ENCR_NULL, ""},
169 {ENCR_AES_CBC, "aes"},
170 {ENCR_AES_CTR, ""},
171 {MAPPING_END, NULL}
172 };
173
174 mapping_t kernel_integrity_algs_m[] = {
175 {AUTH_HMAC_MD5_96, "md5"},
176 {AUTH_HMAC_SHA1_96, "sha1"},
177 {AUTH_DES_MAC, ""},
178 {AUTH_KPDK_MD5, ""},
179 {AUTH_AES_XCBC_96, ""},
180 {MAPPING_END, NULL}
181 };
182
183
184 static status_t get_spi(private_kernel_interface_t *this,
185 host_t *src, host_t *dest,
186 protocol_id_t protocol, u_int32_t reqid,
187 u_int32_t *spi)
188 {
189 netlink_message_t request, *response;
190 status_t status = SUCCESS;
191
192 memset(&request, 0, sizeof(request));
193 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.spi)));
194 request.hdr.nlmsg_flags = NLM_F_REQUEST;
195 request.hdr.nlmsg_type = XFRM_MSG_ALLOCSPI;
196 request.spi.info.saddr = src->get_xfrm_addr(src);
197 request.spi.info.id.daddr = dest->get_xfrm_addr(dest);
198 request.spi.info.mode = TRUE; /* tunnel mode */
199 request.spi.info.reqid = reqid;
200 request.spi.info.id.proto = (protocol == ESP) ? KERNEL_ESP : KERNEL_AH;
201 request.spi.info.family = PF_INET;
202 request.spi.min = 100;
203 request.spi.max = 200;
204
205 if (this->send_message(this, &request, &response) != SUCCESS)
206 {
207 status = FAILED;
208 }
209 else if (response->hdr.nlmsg_type == NLMSG_ERROR)
210 {
211 status = FAILED;
212 }
213 else if (response->hdr.nlmsg_type != XFRM_MSG_NEWSA)
214 {
215 status = FAILED;
216 }
217 else if (response->hdr.nlmsg_len < NLMSG_LENGTH(sizeof(response->sa)))
218 {
219 status = FAILED;
220 }
221
222 *spi = response->sa.id.spi;
223 allocator_free(response);
224
225 return status;
226 }
227
228 static status_t add_sa( private_kernel_interface_t *this,
229 host_t *me,
230 host_t *other,
231 u_int32_t spi,
232 int protocol,
233 u_int32_t reqid,
234 encryption_algorithm_t enc_alg,
235 chunk_t encryption_key,
236 integrity_algorithm_t int_alg,
237 chunk_t integrity_key,
238 bool replace)
239 {
240 netlink_message_t request, *response;
241 memset(&request, 0, sizeof(request));
242 status_t status;
243
244 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
245 request.hdr.nlmsg_type = replace ? XFRM_MSG_UPDSA : XFRM_MSG_NEWSA;
246
247 request.sa.saddr = me->get_xfrm_addr(me);
248 request.sa.id.daddr = other->get_xfrm_addr(other);
249
250 request.sa.id.spi = spi;
251 request.sa.id.proto = (protocol == ESP) ? KERNEL_ESP : KERNEL_AH;
252 request.sa.family = me->get_family(me);
253 request.sa.mode = TRUE; /* tunnel mode */
254 request.sa.replay_window = 0; //sa->replay_window; ???
255 request.sa.reqid = reqid;
256 request.sa.lft.soft_byte_limit = XFRM_INF;
257 request.sa.lft.soft_packet_limit = XFRM_INF;
258 request.sa.lft.hard_byte_limit = XFRM_INF;
259 request.sa.lft.hard_packet_limit = XFRM_INF;
260
261 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.sa)));
262
263 if (enc_alg != ENCR_UNDEFINED)
264 {
265 xfrm_data_t *data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
266
267 data->type = XFRMA_ALG_CRYPT;
268 data->length = 4 + sizeof(data->algo) + encryption_key.len;
269 data->algo.alg_key_len = encryption_key.len * 8;
270
271 strcpy(data->algo.alg_name, mapping_find(kernel_encryption_algs_m, enc_alg));
272 memcpy(data->algo.alg_key, encryption_key.ptr, encryption_key.len);
273
274 request.hdr.nlmsg_len += data->length;
275 }
276
277 if (int_alg != AUTH_UNDEFINED)
278 {
279 xfrm_data_t *data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
280
281 data->type = XFRMA_ALG_AUTH;
282 data->length = 4 + sizeof(data->algo) + integrity_key.len;
283 data->algo.alg_key_len = integrity_key.len * 8;
284 strcpy(data->algo.alg_name, mapping_find(kernel_integrity_algs_m, int_alg));
285 memcpy(data->algo.alg_key, integrity_key.ptr, integrity_key.len);
286
287 request.hdr.nlmsg_len += data->length;
288 }
289
290 /* add IPComp here*/
291
292 if (this->send_message(this, &request, &response) != SUCCESS)
293 {
294 status = FAILED;
295 }
296 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
297 {
298 status = FAILED;
299 }
300 else if (response->e.error)
301 {
302 status = FAILED;
303 }
304
305 allocator_free(response);
306 return SUCCESS;
307 }
308
309 static status_t del_sa( private_kernel_interface_t *this,
310 host_t *dst,
311 u_int32_t spi,
312 protocol_id_t protocol)
313 {
314 netlink_message_t request, *response;
315 memset(&request, 0, sizeof(request));
316 status_t status;
317
318 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
319 request.hdr.nlmsg_type = XFRM_MSG_DELSA;
320
321 request.sa_id.daddr = dst->get_xfrm_addr(dst);
322
323 request.sa_id.spi = spi;
324 request.sa_id.proto = (protocol == ESP) ? KERNEL_ESP : KERNEL_AH;
325 request.sa_id.family = dst->get_family(dst);
326
327 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.sa_id)));
328
329 if (this->send_message(this, &request, &response) != SUCCESS)
330 {
331 status = FAILED;
332 }
333 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
334 {
335 status = FAILED;
336 }
337 else if (response->e.error)
338 {
339 status = FAILED;
340 }
341
342 allocator_free(response);
343 return SUCCESS;
344 }
345
346 static status_t add_policy(private_kernel_interface_t *this,
347 host_t *me, host_t *other,
348 host_t *src, host_t *dst,
349 u_int8_t src_hostbits, u_int8_t dst_hostbits,
350 int direction, int upper_proto,
351 bool ah, bool esp,
352 u_int32_t reqid)
353 {
354 netlink_message_t request, *response;
355 status_t status = SUCCESS;
356
357 memset(&request, 0, sizeof(request));
358 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
359
360 request.policy.sel.sport = htons(src->get_port(src));
361 request.policy.sel.dport = htons(dst->get_port(dst));
362 request.policy.sel.sport_mask = (request.policy.sel.sport) ? ~0 : 0;
363 request.policy.sel.dport_mask = (request.policy.sel.dport) ? ~0 : 0;
364 request.policy.sel.saddr = src->get_xfrm_addr(src);
365 request.policy.sel.daddr = dst->get_xfrm_addr(dst);
366 request.policy.sel.prefixlen_s = src_hostbits;
367 request.policy.sel.prefixlen_d = dst_hostbits;
368 request.policy.sel.proto = upper_proto;
369 request.policy.sel.family = src->get_family(src);
370
371 request.hdr.nlmsg_type = XFRM_MSG_NEWPOLICY;
372 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.policy)));
373
374 request.policy.dir = direction;
375 request.policy.priority = SPD_PRIORITY;
376 request.policy.action = XFRM_POLICY_ALLOW;
377 request.policy.share = XFRM_SHARE_ANY;
378
379 request.policy.lft.soft_byte_limit = XFRM_INF;
380 request.policy.lft.soft_packet_limit = XFRM_INF;
381 request.policy.lft.hard_byte_limit = XFRM_INF;
382 request.policy.lft.hard_packet_limit = XFRM_INF;
383
384 if (esp || ah)
385 {
386 xfrm_data_t *data;
387 int tmpl_pos = 0;
388 data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
389 data->type = XFRMA_TMPL;
390 if (esp)
391 {
392 data->tmpl[tmpl_pos].reqid = reqid;
393 data->tmpl[tmpl_pos].id.proto = KERNEL_ESP;
394 data->tmpl[tmpl_pos].aalgos = data->tmpl[tmpl_pos].ealgos = data->tmpl[tmpl_pos].calgos = ~0;
395 data->tmpl[tmpl_pos].mode = TRUE;
396
397 data->tmpl[tmpl_pos].saddr = me->get_xfrm_addr(me);
398 data->tmpl[tmpl_pos].id.daddr = me->get_xfrm_addr(other);
399
400 tmpl_pos++;
401 }
402 if (ah)
403 {
404 data->tmpl[tmpl_pos].reqid = reqid;
405 data->tmpl[tmpl_pos].id.proto = KERNEL_AH;
406 data->tmpl[tmpl_pos].aalgos = data->tmpl[tmpl_pos].ealgos = data->tmpl[tmpl_pos].calgos = ~0;
407 data->tmpl[tmpl_pos].mode = TRUE;
408
409 data->tmpl[tmpl_pos].saddr = me->get_xfrm_addr(me);
410 data->tmpl[tmpl_pos].id.daddr = other->get_xfrm_addr(other);
411
412 tmpl_pos++;
413 }
414 data->length = 4 + sizeof(struct xfrm_user_tmpl) * tmpl_pos;
415 request.hdr.nlmsg_len += data->length;
416 }
417
418 if (this->send_message(this, &request, &response) != SUCCESS)
419 {
420 status = FAILED;
421 }
422 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
423 {
424 status = FAILED;
425 }
426 else if (response->e.error)
427 {
428 status = FAILED;
429 }
430
431 allocator_free(response);
432 return status;
433 }
434
435 static status_t del_policy(private_kernel_interface_t *this,
436 host_t *me, host_t *other,
437 host_t *src, host_t *dst,
438 u_int8_t src_hostbits, u_int8_t dst_hostbits,
439 int direction, int upper_proto)
440 {
441 netlink_message_t request, *response;
442 status_t status = SUCCESS;
443
444 memset(&request, 0, sizeof(request));
445 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
446
447 request.policy_id.sel.sport = htons(src->get_port(src));
448 request.policy_id.sel.dport = htons(dst->get_port(dst));
449 request.policy_id.sel.sport_mask = (request.policy.sel.sport) ? ~0 : 0;
450 request.policy_id.sel.dport_mask = (request.policy.sel.dport) ? ~0 : 0;
451 request.policy_id.sel.saddr = src->get_xfrm_addr(src);
452 request.policy_id.sel.daddr = dst->get_xfrm_addr(dst);
453 request.policy_id.sel.prefixlen_s = src_hostbits;
454 request.policy_id.sel.prefixlen_d = dst_hostbits;
455 request.policy_id.sel.proto = upper_proto;
456 request.policy_id.sel.family = src->get_family(src);
457
458 request.policy_id.dir = direction;
459
460 request.hdr.nlmsg_type = XFRM_MSG_DELPOLICY;
461 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.policy_id)));
462
463 if (this->send_message(this, &request, &response) != SUCCESS)
464 {
465 status = FAILED;
466 }
467 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
468 {
469 status = FAILED;
470 }
471 else if (response->e.error)
472 {
473 status = FAILED;
474 }
475
476 allocator_free(response);
477 return status;
478 }
479
480
481 static status_t send_message(private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response)
482 {
483 size_t length;
484 struct sockaddr_nl addr;
485
486 request->hdr.nlmsg_seq = ++this->seq;
487 request->hdr.nlmsg_pid = this->pid;
488
489 memset(&addr, 0, sizeof(struct sockaddr_nl));
490 addr.nl_family = AF_NETLINK;
491 addr.nl_pid = 0;
492 addr.nl_groups = 0;
493
494 length = sendto(this->socket,(void *)request, request->hdr.nlmsg_len, 0, (struct sockaddr *)&addr, sizeof(addr));
495
496 if (length < 0)
497 {
498 return FAILED;
499 }
500 else if (length != request->hdr.nlmsg_len)
501 {
502 return FAILED;
503 }
504
505 pthread_mutex_lock(&(this->mutex));
506
507 while (TRUE)
508 {
509 iterator_t *iterator;
510 bool found = FALSE;
511 /* search list, break if found */
512 iterator = this->responses->create_iterator(this->responses, TRUE);
513 while (iterator->has_next(iterator))
514 {
515 netlink_message_t *listed_response;
516 iterator->current(iterator, (void**)&listed_response);
517 if (listed_response->hdr.nlmsg_seq == request->hdr.nlmsg_seq)
518 {
519 /* matches our request, this is the reply */
520 *response = listed_response;
521 found = TRUE;
522 break;
523 }
524 }
525 iterator->destroy(iterator);
526
527 if (found)
528 {
529 break;
530 }
531 /* we should time out, if something goes wrong */
532 pthread_cond_wait(&(this->condvar), &(this->mutex));
533 }
534
535 pthread_mutex_unlock(&(this->mutex));
536
537 return SUCCESS;
538 }
539
540
541 static void receive_messages(private_kernel_interface_t *this)
542 {
543 while(TRUE)
544 {
545 netlink_message_t response, *listed_response;
546 while (TRUE)
547 {
548 struct sockaddr_nl addr;
549 socklen_t addr_length;
550 size_t length;
551
552 addr_length = sizeof(addr);
553
554 response.hdr.nlmsg_type = XFRM_MSG_NEWSA;
555 length = recvfrom(this->socket, &response, sizeof(response), 0, (struct sockaddr*)&addr, &addr_length);
556 if (length < 0)
557 {
558 if (errno == EINTR)
559 {
560 /* interrupted, try again */
561 continue;
562 }
563 charon->kill(charon, "receiving from netlink socket failed");
564 }
565 if (!NLMSG_OK(&response.hdr, length))
566 {
567 /* bad netlink message */
568 continue;
569 }
570 if (addr.nl_pid != 0)
571 {
572 /* not from kernel. not interested, try another one */
573 continue;
574 }
575 break;
576 }
577
578 /* got a valid message.
579 * requests are handled on our own,
580 * responses are listed for the requesters
581 */
582 if (response.hdr.nlmsg_flags & NLM_F_REQUEST)
583 {
584 /* handle request */
585 }
586 else
587 {
588 /* add response to queue */
589 listed_response = allocator_alloc(sizeof(response));
590 memcpy(listed_response, &response, sizeof(response));
591
592 pthread_mutex_lock(&(this->mutex));
593 this->responses->insert_last(this->responses, (void*)listed_response);
594 pthread_mutex_unlock(&(this->mutex));
595 /* signal ALL waiting threads */
596 pthread_cond_broadcast(&(this->condvar));
597 }
598 /* get the next one */
599 }
600 }
601
602
603
604 /**
605 * Implementation of kernel_interface_t.destroy.
606 */
607 static void destroy(private_kernel_interface_t *this)
608 {
609 pthread_cancel(this->thread);
610 pthread_join(this->thread, NULL);
611 close(this->socket);
612 this->responses->destroy(this->responses);
613 allocator_free(this);
614 }
615
616 #define ASSIGN(member, function) member = (void*)function
617
618 /*
619 * Described in header.
620 */
621 kernel_interface_t *kernel_interface_create()
622 {
623 private_kernel_interface_t *this = allocator_alloc_thing(private_kernel_interface_t);
624
625 /* public functions */
626 this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
627 this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,encryption_algorithm_t,chunk_t,integrity_algorithm_t,chunk_t,bool))add_sa;
628 this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*, host_t*,host_t*,host_t*,u_int8_t,u_int8_t,int,int,bool,bool,u_int32_t))add_policy;
629 ASSIGN(this->public.del_sa, del_sa);
630 ASSIGN(this->public.del_policy, del_policy);
631
632 this->public.destroy = (void(*)(kernel_interface_t*)) destroy;
633
634 /* private members */
635 this->receive_messages = receive_messages;
636 this->send_message = send_message;
637 this->pid = getpid();
638 this->responses = linked_list_create();
639 pthread_mutex_init(&(this->mutex),NULL);
640 pthread_cond_init(&(this->condvar),NULL);
641 this->seq = 0;
642 this->socket = socket(PF_NETLINK, SOCK_RAW, NETLINK_XFRM);
643 if (this->socket <= 0)
644 {
645 allocator_free(this);
646 charon->kill(charon, "Unable to create netlink socket");
647 }
648
649 if (pthread_create(&(this->thread), NULL, (void*(*)(void*))this->receive_messages, this) != 0)
650 {
651 close(this->socket);
652 allocator_free(this);
653 charon->kill(charon, "Unable to create netlink thread");
654 }
655
656 //host_t *all = host_create(AF_INET, "0.0.0.0", 500);
657 //add_policy(this, all, all, all, all, 0, 0, XFRM_POLICY_OUT, 17, FALSE, FALSE, 0);
658
659
660 charon->logger_manager->enable_logger_level(charon->logger_manager, TESTER, FULL);
661 return (&this->public);
662 }