- kernel interface hacks, works partially
[strongswan.git] / Source / charon / threads / kernel_interface.c
1 /**
2 * @file kernel_interface.c
3 *
4 * @brief Implementation of kernel_interface_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <sys/types.h>
24 #include <sys/socket.h>
25 #include <linux/netlink.h>
26 #include <linux/xfrm.h>
27 #include <pthread.h>
28 #include <unistd.h>
29 #include <fcntl.h>
30 #include <errno.h>
31 #include <string.h>
32
33 #include "kernel_interface.h"
34
35 #include <daemon.h>
36 #include <utils/allocator.h>
37 #include <utils/linked_list.h>
38
39
40 typedef struct netlink_message_t netlink_message_t;
41
42 struct netlink_message_t {
43
44 /**
45 * header of the netlink message
46 */
47 struct nlmsghdr hdr;
48
49 union {
50 struct nlmsgerr e;
51 struct xfrm_userspi_info spi;
52 struct {
53 struct xfrm_usersa_info sa;
54 u_int8_t data[512];
55 };
56 };
57 };
58
59 typedef struct netlink_algo_t netlink_algo_t;
60
61 struct netlink_algo_t {
62 u_int16_t length;
63 u_int16_t type;
64 struct xfrm_algo algo;
65 };
66
67 typedef struct private_kernel_interface_t private_kernel_interface_t;
68
69 /**
70 * @brief Private Variables and Functions of kernel_interface class
71 *
72 */
73 struct private_kernel_interface_t {
74 /**
75 * Public part of the kernel_interface_t object
76 */
77 kernel_interface_t public;
78
79 /**
80 * netlink communication socket
81 */
82 int socket;
83 int bc_socket;
84
85 pid_t pid;
86 /**
87 * sequence number for messages
88 */
89 u_int32_t seq;
90
91 /**
92 * list of responded messages
93 */
94 linked_list_t *responses;
95
96 /**
97 * thread which receives messages
98 */
99 pthread_t thread;
100
101 /**
102 * mutex locks access to replies list
103 */
104 pthread_mutex_t mutex;
105
106 /**
107 * Condvar allows signaling of threads waiting for a reply
108 */
109 pthread_cond_t condvar;
110 logger_t *logger;
111
112 /**
113 * Function for the thread, receives messages
114 */
115 void (*receive_messages) (private_kernel_interface_t *this);
116
117 /**
118 * Sends a netlink_message_t down to the kernel
119 */
120 status_t (*send_message) (private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response);
121 };
122
123 mapping_t kernel_encryption_algs_m[] = {
124 {ENCR_DES_IV64, ""},
125 {ENCR_DES, "des"},
126 {ENCR_3DES, "3des"},
127 {ENCR_RC5, ""},
128 {ENCR_IDEA, ""},
129 {ENCR_CAST, ""},
130 {ENCR_BLOWFISH, ""},
131 {ENCR_3IDEA, ""},
132 {ENCR_DES_IV32, ""},
133 {ENCR_NULL, ""},
134 {ENCR_AES_CBC, "aes"},
135 {ENCR_AES_CTR, ""},
136 {MAPPING_END, NULL}
137 };
138
139 mapping_t kernel_integrity_algs_m[] = {
140 {AUTH_HMAC_MD5_96, "md5"},
141 {AUTH_HMAC_SHA1_96, "sha1"},
142 {AUTH_DES_MAC, ""},
143 {AUTH_KPDK_MD5, ""},
144 {AUTH_AES_XCBC_96, ""},
145 {MAPPING_END, NULL}
146 };
147
148
149 static status_t get_spi(private_kernel_interface_t *this, host_t *src, host_t *dest, protocol_id_t protocol, bool tunnel_mode, u_int32_t *spi)
150 {
151 netlink_message_t request, *response;
152
153 memset(&request, 0, sizeof(request));
154 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.spi)));
155 request.hdr.nlmsg_flags = NLM_F_REQUEST;
156 request.hdr.nlmsg_type = XFRM_MSG_ALLOCSPI;
157 request.spi.info.saddr = src->get_xfrm_addr(src);
158 request.spi.info.id.daddr = dest->get_xfrm_addr(dest);
159 request.spi.info.mode = tunnel_mode;
160 request.spi.info.id.proto = protocol;
161 request.spi.info.family = PF_INET;
162 request.spi.min = 100;
163 request.spi.max = 200;
164
165 if (this->send_message(this, &request, &response) != SUCCESS)
166 {
167 return FAILED;
168 }
169
170 if (response->hdr.nlmsg_type == NLMSG_ERROR)
171 {
172 return FAILED;
173 }
174
175 if (response->hdr.nlmsg_type != XFRM_MSG_NEWSA)
176 {
177 return FAILED;
178 }
179 else if (response->hdr.nlmsg_len < NLMSG_LENGTH(sizeof(response->sa)))
180 {
181 return FAILED;
182 }
183
184 *spi = response->sa.id.spi;
185 allocator_free(response);
186
187 return SUCCESS;
188 }
189
190 static status_t add_sa( private_kernel_interface_t *this,
191 host_t *me,
192 host_t *other,
193 u_int32_t spi,
194 int protocol,
195 bool tunnel_mode,
196 encryption_algorithm_t enc_alg,
197 size_t enc_size,
198 chunk_t enc_key,
199 integrity_algorithm_t int_alg,
200 size_t int_size,
201 chunk_t int_key,
202 bool replace)
203 {
204 netlink_message_t request, *response;
205
206 memset(&request, 0, sizeof(request));
207
208 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
209 request.hdr.nlmsg_type = replace ? XFRM_MSG_UPDSA : XFRM_MSG_NEWSA;
210
211 request.sa.saddr = me->get_xfrm_addr(me);
212 request.sa.id.daddr = other->get_xfrm_addr(other);
213
214 request.sa.id.spi = spi;
215 request.sa.id.proto = protocol;
216 request.sa.family = me->get_family(me);
217 request.sa.mode = tunnel_mode;
218 request.sa.replay_window = 0; //sa->replay_window; ???
219 request.sa.reqid = 0; //sa->reqid; ???
220 request.sa.lft.soft_byte_limit = XFRM_INF;
221 request.sa.lft.soft_packet_limit = XFRM_INF;
222 request.sa.lft.hard_byte_limit = XFRM_INF;
223 request.sa.lft.hard_packet_limit = XFRM_INF;
224
225 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.sa)));
226
227 if (enc_alg != ENCR_UNDEFINED)
228 {
229 netlink_algo_t *nla = (netlink_algo_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
230
231 nla->type = XFRMA_ALG_CRYPT;
232 nla->length = sizeof(netlink_algo_t) + enc_size;
233 nla->algo.alg_key_len = enc_size * 8;
234
235 strcpy(nla->algo.alg_name, mapping_find(kernel_encryption_algs_m, enc_alg));
236 memcpy(nla->algo.alg_key, enc_key.ptr, enc_key.len);
237
238 request.hdr.nlmsg_len += nla->length;
239 }
240
241 if (int_alg != AUTH_UNDEFINED)
242 {
243 netlink_algo_t *nla = (netlink_algo_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
244
245 nla->type = XFRMA_ALG_AUTH;
246 nla->length = sizeof(netlink_algo_t) + int_size;
247 nla->algo.alg_key_len = int_size * 8;
248 strcpy(nla->algo.alg_name, mapping_find(kernel_integrity_algs_m, int_alg));
249 memcpy(nla->algo.alg_key, int_key.ptr, int_key.len);
250
251 request.hdr.nlmsg_len += nla->length;
252 }
253
254 /* add IPComp */
255
256 if (this->send_message(this, &request, &response) != SUCCESS)
257 {
258 allocator_free(response);
259 return FAILED;
260 }
261
262 printf("received message type: %d\n", response->hdr.nlmsg_type);
263
264 if (response->hdr.nlmsg_type == NLMSG_ERROR)
265 {
266 printf("received error: %s\n", strerror(-response->e.error));
267 }
268
269 allocator_free(response);
270 return SUCCESS;
271 }
272
273
274
275 static status_t send_message(private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response)
276 {
277 size_t length;
278 struct sockaddr_nl addr;
279
280 request->hdr.nlmsg_seq = ++this->seq;
281 request->hdr.nlmsg_pid = this->pid;
282
283 memset(&addr, 0, sizeof(struct sockaddr_nl));
284 addr.nl_family = AF_NETLINK;
285 addr.nl_pid = 0;
286 addr.nl_groups = 0;
287
288 length = sendto(this->socket,(void *)request, request->hdr.nlmsg_len, 0, (struct sockaddr *)&addr, sizeof(addr));
289
290 if (length < 0)
291 {
292 return FAILED;
293 }
294 else if (length != request->hdr.nlmsg_len)
295 {
296 return FAILED;
297 }
298
299 pthread_mutex_lock(&(this->mutex));
300
301 while (TRUE)
302 {
303 iterator_t *iterator;
304 bool found = FALSE;
305 /* search list, break if found */
306 iterator = this->responses->create_iterator(this->responses, TRUE);
307 while (iterator->has_next(iterator))
308 {
309 netlink_message_t *listed_response;
310 iterator->current(iterator, (void**)&listed_response);
311 if (listed_response->hdr.nlmsg_seq == request->hdr.nlmsg_seq)
312 {
313 /* matches our request, this is the reply */
314 *response = listed_response;
315 found = TRUE;
316 break;
317 }
318 }
319 iterator->destroy(iterator);
320
321 if (found)
322 {
323 break;
324 }
325 /* we should time out, if something goes wrong */
326 pthread_cond_wait(&(this->condvar), &(this->mutex));
327 }
328
329 pthread_mutex_unlock(&(this->mutex));
330
331 return SUCCESS;
332 }
333
334
335 static void receive_messages(private_kernel_interface_t *this)
336 {
337 while(TRUE)
338 {
339 netlink_message_t response, *listed_response;
340 while (TRUE)
341 {
342 struct sockaddr_nl addr;
343 socklen_t addr_length;
344 size_t length;
345
346 addr_length = sizeof(addr);
347
348 response.hdr.nlmsg_type = XFRM_MSG_NEWSA;
349 length = recvfrom(this->socket, &response, sizeof(response), 0, (struct sockaddr*)&addr, &addr_length);
350 if (length < 0)
351 {
352 if (errno == EINTR)
353 {
354 /* interrupted, try again */
355 continue;
356 }
357 charon->kill(charon, "receiving from netlink socket failed");
358 }
359 if (!NLMSG_OK(&response.hdr, length))
360 {
361 /* bad netlink message */
362 continue;
363 }
364 if (addr.nl_pid != 0)
365 {
366 /* not interested, try another one */
367 continue;
368 }
369 break;
370 }
371
372 /* got a valid message.
373 * requests are handled on or own,
374 * responses are listed for the requesters
375 */
376 if (response.hdr.nlmsg_flags & NLM_F_REQUEST)
377 {
378 /* handle request */
379 }
380 else
381 {
382 /* add response to queue */
383 listed_response = allocator_alloc(sizeof(response));
384 memcpy(listed_response, &response, sizeof(response));
385
386 pthread_mutex_lock(&(this->mutex));
387 this->responses->insert_last(this->responses, (void*)listed_response);
388 pthread_mutex_unlock(&(this->mutex));
389 /* signal ALL waiting threads */
390 pthread_cond_broadcast(&(this->condvar));
391 }
392 /* get the next one */
393 }
394 }
395
396
397
398 /**
399 * implements kernel_interface_t.destroy
400 */
401 static void destroy(private_kernel_interface_t *this)
402 {
403 pthread_cancel(this->thread);
404 pthread_join(this->thread, NULL);
405 close(this->socket);
406 this->responses->destroy(this->responses);
407 allocator_free(this);
408 }
409
410 /*
411 * Documented in header
412 */
413 kernel_interface_t *kernel_interface_create()
414 {
415 private_kernel_interface_t *this = allocator_alloc_thing(private_kernel_interface_t);
416
417 /* public functions */
418 this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,bool,u_int32_t*))get_spi;
419
420 this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,int,bool,encryption_algorithm_t,size_t,chunk_t,integrity_algorithm_t,size_t,chunk_t,bool))add_sa;
421
422
423 this->public.destroy = (void(*)(kernel_interface_t*)) destroy;
424
425 /* private members */
426 this->receive_messages = receive_messages;
427 this->send_message = send_message;
428 this->pid = getpid();
429 this->responses = linked_list_create();
430 pthread_mutex_init(&(this->mutex),NULL);
431 pthread_cond_init(&(this->condvar),NULL);
432 this->seq = 0;
433 this->socket = socket(PF_NETLINK, SOCK_RAW, NETLINK_XFRM);
434 if (this->socket <= 0)
435 {
436 allocator_free(this);
437 charon->kill(charon, "Unable to create netlink socket");
438 }
439
440 if (pthread_create(&(this->thread), NULL, (void*(*)(void*))this->receive_messages, this) != 0)
441 {
442 close(this->socket);
443 allocator_free(this);
444 charon->kill(charon, "Unable to create netlink thread");
445 }
446
447 this->logger = charon->logger_manager->create_logger(charon->logger_manager, TESTER, NULL);
448 charon->logger_manager->enable_logger_level(charon->logger_manager, TESTER, FULL);
449 return (&this->public);
450 }