- proposal setup implementation begun
[strongswan.git] / Source / charon / threads / kernel_interface.c
1 /**
2 * @file kernel_interface.c
3 *
4 * @brief Implementation of kernel_interface_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 * Copyright (C) 2003 Herbert Xu.
12 *
13 * Contains modified parts from pluto.
14 *
15 * This program is free software; you can redistribute it and/or modify it
16 * under the terms of the GNU General Public License as published by the
17 * Free Software Foundation; either version 2 of the License, or (at your
18 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
19 *
20 * This program is distributed in the hope that it will be useful, but
21 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
22 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
23 * for more details.
24 */
25
26 #include <sys/types.h>
27 #include <sys/socket.h>
28 #include <linux/netlink.h>
29 #include <pthread.h>
30 #include <unistd.h>
31 #include <fcntl.h>
32 #include <errno.h>
33 #include <string.h>
34
35 #include "kernel_interface.h"
36
37 #include <daemon.h>
38 #include <utils/allocator.h>
39 #include <utils/linked_list.h>
40
41
42 #define KERNEL_ESP 50
43 #define KERNEL_AH 51
44
45 #define SPD_PRIORITY 1024
46
47
48 typedef struct xfrm_data_t xfrm_data_t;
49
50 /**
51 * Lenght/Type/data struct for userdata in xfrm
52 */
53 struct xfrm_data_t {
54 /**
55 * length of the data
56 */
57 u_int16_t length;
58 /**
59 * type of data
60 */
61 u_int16_t type;
62 /**
63 * and the data itself, for different purposes
64 */
65 union {
66 /* algorithm */
67 struct xfrm_algo algo;
68 /* policy tmpl */
69 struct xfrm_user_tmpl tmpl[2];
70 };
71 };
72
73
74 typedef struct netlink_message_t netlink_message_t;
75
76 /**
77 * Representation of ANY netlink message used
78 */
79 struct netlink_message_t {
80
81 /**
82 * header of the netlink message
83 */
84 struct nlmsghdr hdr;
85
86 union {
87 /* error message */
88 struct nlmsgerr e;
89 /* message for spi allocation */
90 struct xfrm_userspi_info spi;
91 /* message for SA installation */
92 struct {
93 struct xfrm_usersa_info sa;
94 };
95 /* message for policy manipulation */
96 struct xfrm_userpolicy_id id;
97 /* message for policy installation */
98 struct {
99 struct xfrm_userpolicy_info policy;
100 };
101 };
102 u_int8_t data[512];
103 };
104
105
106 typedef struct private_kernel_interface_t private_kernel_interface_t;
107
108 /**
109 * @brief Private Variables and Functions of kernel_interface class.
110 *
111 */
112 struct private_kernel_interface_t {
113 /**
114 * Public part of the kernel_interface_t object.
115 */
116 kernel_interface_t public;
117
118 /**
119 * Netlink communication socket.
120 */
121 int socket;
122
123 pid_t pid;
124 /**
125 * Sequence number for messages.
126 */
127 u_int32_t seq;
128
129 /**
130 * List of responded messages.
131 */
132 linked_list_t *responses;
133
134 /**
135 * Thread which receives messages.
136 */
137 pthread_t thread;
138
139 /**
140 * Mutex locks access to replies list.
141 */
142 pthread_mutex_t mutex;
143
144 /**
145 * Condvar allows signaling of threads waiting for a reply.
146 */
147 pthread_cond_t condvar;
148
149 /**
150 * Function for the thread, receives messages.
151 */
152 void (*receive_messages) (private_kernel_interface_t *this);
153
154 /**
155 * Sends a netlink_message_t down to the kernel and wait for reply.
156 */
157 status_t (*send_message) (private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response);
158 };
159
160 mapping_t kernel_encryption_algs_m[] = {
161 {ENCR_DES_IV64, ""},
162 {ENCR_DES, "des"},
163 {ENCR_3DES, "des3_ede"},
164 {ENCR_RC5, ""},
165 {ENCR_IDEA, "idea"},
166 {ENCR_CAST, "cast128"},
167 {ENCR_BLOWFISH, "blowfish"},
168 {ENCR_3IDEA, ""},
169 {ENCR_DES_IV32, ""},
170 {ENCR_NULL, ""},
171 {ENCR_AES_CBC, "aes"},
172 {ENCR_AES_CTR, ""},
173 {MAPPING_END, NULL}
174 };
175
176 mapping_t kernel_integrity_algs_m[] = {
177 {AUTH_HMAC_MD5_96, "md5"},
178 {AUTH_HMAC_SHA1_96, "sha1"},
179 {AUTH_DES_MAC, ""},
180 {AUTH_KPDK_MD5, ""},
181 {AUTH_AES_XCBC_96, ""},
182 {MAPPING_END, NULL}
183 };
184
185
186 static status_t get_spi(private_kernel_interface_t *this,
187 host_t *src, host_t *dest,
188 protocol_id_t protocol, u_int32_t reqid,
189 u_int32_t *spi)
190 {
191 netlink_message_t request, *response;
192 status_t status = SUCCESS;
193
194 memset(&request, 0, sizeof(request));
195 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.spi)));
196 request.hdr.nlmsg_flags = NLM_F_REQUEST;
197 request.hdr.nlmsg_type = XFRM_MSG_ALLOCSPI;
198 request.spi.info.saddr = src->get_xfrm_addr(src);
199 request.spi.info.id.daddr = dest->get_xfrm_addr(dest);
200 request.spi.info.mode = TRUE; /* tunnel mode */
201 request.spi.info.reqid = reqid;
202 request.spi.info.id.proto = (protocol == ESP) ? KERNEL_ESP : KERNEL_AH;
203 request.spi.info.family = PF_INET;
204 request.spi.min = 100;
205 request.spi.max = 200;
206
207 if (this->send_message(this, &request, &response) != SUCCESS)
208 {
209 status = FAILED;
210 }
211 else if (response->hdr.nlmsg_type == NLMSG_ERROR)
212 {
213 status = FAILED;
214 }
215 else if (response->hdr.nlmsg_type != XFRM_MSG_NEWSA)
216 {
217 status = FAILED;
218 }
219 else if (response->hdr.nlmsg_len < NLMSG_LENGTH(sizeof(response->sa)))
220 {
221 status = FAILED;
222 }
223
224 *spi = response->sa.id.spi;
225 allocator_free(response);
226
227 return status;
228 }
229
230 static status_t add_sa( private_kernel_interface_t *this,
231 host_t *me,
232 host_t *other,
233 u_int32_t spi,
234 int protocol,
235 u_int32_t reqid,
236 encryption_algorithm_t enc_alg,
237 chunk_t encryption_key,
238 integrity_algorithm_t int_alg,
239 chunk_t integrity_key,
240 bool replace)
241 {
242 netlink_message_t request, *response;
243 memset(&request, 0, sizeof(request));
244 status_t status;
245
246 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
247 request.hdr.nlmsg_type = replace ? XFRM_MSG_UPDSA : XFRM_MSG_NEWSA;
248
249 request.sa.saddr = me->get_xfrm_addr(me);
250 request.sa.id.daddr = other->get_xfrm_addr(other);
251
252 request.sa.id.spi = spi;
253 request.sa.id.proto = (protocol == ESP) ? KERNEL_ESP : KERNEL_AH;
254 request.sa.family = me->get_family(me);
255 request.sa.mode = TRUE; /* tunnel mode */
256 request.sa.replay_window = 0; //sa->replay_window; ???
257 request.sa.reqid = reqid;
258 request.sa.lft.soft_byte_limit = XFRM_INF;
259 request.sa.lft.soft_packet_limit = XFRM_INF;
260 request.sa.lft.hard_byte_limit = XFRM_INF;
261 request.sa.lft.hard_packet_limit = XFRM_INF;
262
263 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.sa)));
264
265 if (enc_alg != ENCR_UNDEFINED)
266 {
267 xfrm_data_t *data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
268
269 data->type = XFRMA_ALG_CRYPT;
270 data->length = 4 + sizeof(data->algo) + encryption_key.len;
271 data->algo.alg_key_len = encryption_key.len * 8;
272
273 strcpy(data->algo.alg_name, mapping_find(kernel_encryption_algs_m, enc_alg));
274 memcpy(data->algo.alg_key, encryption_key.ptr, encryption_key.len);
275
276 request.hdr.nlmsg_len += data->length;
277 }
278
279 if (int_alg != AUTH_UNDEFINED)
280 {
281 xfrm_data_t *data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
282
283 data->type = XFRMA_ALG_AUTH;
284 data->length = 4 + sizeof(data->algo) + integrity_key.len;
285 data->algo.alg_key_len = integrity_key.len * 8;
286 strcpy(data->algo.alg_name, mapping_find(kernel_integrity_algs_m, int_alg));
287 memcpy(data->algo.alg_key, integrity_key.ptr, integrity_key.len);
288
289 request.hdr.nlmsg_len += data->length;
290 }
291
292 /* add IPComp here*/
293
294 if (this->send_message(this, &request, &response) != SUCCESS)
295 {
296 status = FAILED;
297 }
298 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
299 {
300 status = FAILED;
301 }
302 else if (response->e.error)
303 {
304 status = FAILED;
305 }
306
307 allocator_free(response);
308 return SUCCESS;
309 }
310
311 static status_t add_policy(private_kernel_interface_t *this,
312 host_t *me, host_t *other,
313 host_t *src, host_t *dst,
314 u_int8_t src_hostbits, u_int8_t dst_hostbits,
315 int direction, int upper_proto,
316 bool ah, bool esp,
317 u_int32_t reqid)
318 {
319 netlink_message_t request, *response;
320 status_t status = SUCCESS;
321
322 memset(&request, 0, sizeof(request));
323 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
324
325 request.policy.sel.sport = htons(src->get_port(src));
326 request.policy.sel.dport = htons(dst->get_port(dst));
327 request.policy.sel.sport_mask = (request.policy.sel.sport) ? ~0 : 0;
328 request.policy.sel.dport_mask = (request.policy.sel.dport) ? ~0 : 0;
329 request.policy.sel.saddr = src->get_xfrm_addr(src);
330 request.policy.sel.daddr = dst->get_xfrm_addr(dst);
331 request.policy.sel.prefixlen_s = src_hostbits;
332 request.policy.sel.prefixlen_d = dst_hostbits;
333 request.policy.sel.proto = upper_proto;
334 request.policy.sel.family = src->get_family(src);
335
336 request.policy.dir = direction;
337 request.policy.priority = SPD_PRIORITY;
338 request.policy.action = XFRM_POLICY_ALLOW;
339 request.policy.share = XFRM_SHARE_ANY;
340
341 request.policy.lft.soft_byte_limit = XFRM_INF;
342 request.policy.lft.soft_packet_limit = XFRM_INF;
343 request.policy.lft.hard_byte_limit = XFRM_INF;
344 request.policy.lft.hard_packet_limit = XFRM_INF;
345
346 request.hdr.nlmsg_type = XFRM_MSG_NEWPOLICY;
347 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.policy)));
348
349 if (esp || ah)
350 {
351 xfrm_data_t *data;
352 int tmpl_pos = 0;
353 data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
354 data->type = XFRMA_TMPL;
355 if (esp)
356 {
357 data->tmpl[tmpl_pos].reqid = reqid;
358 data->tmpl[tmpl_pos].id.proto = KERNEL_ESP;
359 data->tmpl[tmpl_pos].aalgos = data->tmpl[tmpl_pos].ealgos = data->tmpl[tmpl_pos].calgos = ~0;
360 data->tmpl[tmpl_pos].mode = TRUE;
361
362 data->tmpl[tmpl_pos].saddr = me->get_xfrm_addr(me);
363 data->tmpl[tmpl_pos].id.daddr = me->get_xfrm_addr(other);
364
365 tmpl_pos++;
366 }
367 if (ah)
368 {
369 data->tmpl[tmpl_pos].reqid = reqid;
370 data->tmpl[tmpl_pos].id.proto = KERNEL_AH;
371 data->tmpl[tmpl_pos].aalgos = data->tmpl[tmpl_pos].ealgos = data->tmpl[tmpl_pos].calgos = ~0;
372 data->tmpl[tmpl_pos].mode = TRUE;
373
374 data->tmpl[tmpl_pos].saddr = me->get_xfrm_addr(me);
375 data->tmpl[tmpl_pos].id.daddr = other->get_xfrm_addr(other);
376
377 tmpl_pos++;
378 }
379 data->length = 4 + sizeof(struct xfrm_user_tmpl) * tmpl_pos;
380 request.hdr.nlmsg_len += data->length;
381 }
382
383 if (this->send_message(this, &request, &response) != SUCCESS)
384 {
385 status = FAILED;
386 }
387 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
388 {
389 status = FAILED;
390 }
391 else if (response->e.error)
392 {
393 status = FAILED;
394 }
395
396 allocator_free(response);
397 return status;
398 }
399
400
401 static status_t send_message(private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response)
402 {
403 size_t length;
404 struct sockaddr_nl addr;
405
406 request->hdr.nlmsg_seq = ++this->seq;
407 request->hdr.nlmsg_pid = this->pid;
408
409 memset(&addr, 0, sizeof(struct sockaddr_nl));
410 addr.nl_family = AF_NETLINK;
411 addr.nl_pid = 0;
412 addr.nl_groups = 0;
413
414 length = sendto(this->socket,(void *)request, request->hdr.nlmsg_len, 0, (struct sockaddr *)&addr, sizeof(addr));
415
416 if (length < 0)
417 {
418 return FAILED;
419 }
420 else if (length != request->hdr.nlmsg_len)
421 {
422 return FAILED;
423 }
424
425 pthread_mutex_lock(&(this->mutex));
426
427 while (TRUE)
428 {
429 iterator_t *iterator;
430 bool found = FALSE;
431 /* search list, break if found */
432 iterator = this->responses->create_iterator(this->responses, TRUE);
433 while (iterator->has_next(iterator))
434 {
435 netlink_message_t *listed_response;
436 iterator->current(iterator, (void**)&listed_response);
437 if (listed_response->hdr.nlmsg_seq == request->hdr.nlmsg_seq)
438 {
439 /* matches our request, this is the reply */
440 *response = listed_response;
441 found = TRUE;
442 break;
443 }
444 }
445 iterator->destroy(iterator);
446
447 if (found)
448 {
449 break;
450 }
451 /* we should time out, if something goes wrong */
452 pthread_cond_wait(&(this->condvar), &(this->mutex));
453 }
454
455 pthread_mutex_unlock(&(this->mutex));
456
457 return SUCCESS;
458 }
459
460
461 static void receive_messages(private_kernel_interface_t *this)
462 {
463 while(TRUE)
464 {
465 netlink_message_t response, *listed_response;
466 while (TRUE)
467 {
468 struct sockaddr_nl addr;
469 socklen_t addr_length;
470 size_t length;
471
472 addr_length = sizeof(addr);
473
474 response.hdr.nlmsg_type = XFRM_MSG_NEWSA;
475 length = recvfrom(this->socket, &response, sizeof(response), 0, (struct sockaddr*)&addr, &addr_length);
476 if (length < 0)
477 {
478 if (errno == EINTR)
479 {
480 /* interrupted, try again */
481 continue;
482 }
483 charon->kill(charon, "receiving from netlink socket failed");
484 }
485 if (!NLMSG_OK(&response.hdr, length))
486 {
487 /* bad netlink message */
488 continue;
489 }
490 if (addr.nl_pid != 0)
491 {
492 /* not from kernel. not interested, try another one */
493 continue;
494 }
495 break;
496 }
497
498 /* got a valid message.
499 * requests are handled on our own,
500 * responses are listed for the requesters
501 */
502 if (response.hdr.nlmsg_flags & NLM_F_REQUEST)
503 {
504 /* handle request */
505 }
506 else
507 {
508 /* add response to queue */
509 listed_response = allocator_alloc(sizeof(response));
510 memcpy(listed_response, &response, sizeof(response));
511
512 pthread_mutex_lock(&(this->mutex));
513 this->responses->insert_last(this->responses, (void*)listed_response);
514 pthread_mutex_unlock(&(this->mutex));
515 /* signal ALL waiting threads */
516 pthread_cond_broadcast(&(this->condvar));
517 }
518 /* get the next one */
519 }
520 }
521
522
523
524 /**
525 * Implementation of kernel_interface_t.destroy.
526 */
527 static void destroy(private_kernel_interface_t *this)
528 {
529 pthread_cancel(this->thread);
530 pthread_join(this->thread, NULL);
531 close(this->socket);
532 this->responses->destroy(this->responses);
533 allocator_free(this);
534 }
535
536 /*
537 * Described in header.
538 */
539 kernel_interface_t *kernel_interface_create()
540 {
541 private_kernel_interface_t *this = allocator_alloc_thing(private_kernel_interface_t);
542
543 /* public functions */
544 this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
545 this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,encryption_algorithm_t,chunk_t,integrity_algorithm_t,chunk_t,bool))add_sa;
546 this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*, host_t*,host_t*,host_t*,u_int8_t,u_int8_t,int,int,bool,bool,u_int32_t))add_policy;
547 this->public.destroy = (void(*)(kernel_interface_t*)) destroy;
548
549 /* private members */
550 this->receive_messages = receive_messages;
551 this->send_message = send_message;
552 this->pid = getpid();
553 this->responses = linked_list_create();
554 pthread_mutex_init(&(this->mutex),NULL);
555 pthread_cond_init(&(this->condvar),NULL);
556 this->seq = 0;
557 this->socket = socket(PF_NETLINK, SOCK_RAW, NETLINK_XFRM);
558 if (this->socket <= 0)
559 {
560 allocator_free(this);
561 charon->kill(charon, "Unable to create netlink socket");
562 }
563
564 if (pthread_create(&(this->thread), NULL, (void*(*)(void*))this->receive_messages, this) != 0)
565 {
566 close(this->socket);
567 allocator_free(this);
568 charon->kill(charon, "Unable to create netlink thread");
569 }
570
571 //host_t *all = host_create(AF_INET, "0.0.0.0", 500);
572 //add_policy(this, all, all, all, all, 0, 0, XFRM_POLICY_OUT, 17, FALSE, FALSE, 0);
573
574
575 charon->logger_manager->enable_logger_level(charon->logger_manager, TESTER, FULL);
576 return (&this->public);
577 }