- rewrite of logger_manager, uses now one instance per context
[strongswan.git] / Source / charon / threads / kernel_interface.c
1 /**
2 * @file kernel_interface.c
3 *
4 * @brief Implementation of kernel_interface_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 * Copyright (C) 2003 Herbert Xu.
12 *
13 * Contains modified parts from pluto.
14 *
15 * This program is free software; you can redistribute it and/or modify it
16 * under the terms of the GNU General Public License as published by the
17 * Free Software Foundation; either version 2 of the License, or (at your
18 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
19 *
20 * This program is distributed in the hope that it will be useful, but
21 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
22 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
23 * for more details.
24 */
25
26 #include <sys/types.h>
27 #include <sys/socket.h>
28 #include <linux/netlink.h>
29 #include <pthread.h>
30 #include <unistd.h>
31 #include <fcntl.h>
32 #include <errno.h>
33 #include <string.h>
34
35 #include "kernel_interface.h"
36
37 #include <daemon.h>
38 #include <utils/allocator.h>
39 #include <utils/linked_list.h>
40
41
42 #define KERNEL_ESP 50
43 #define KERNEL_AH 51
44
45 #define SPD_PRIORITY 1024
46
47 #define XFRM_DATA_LENGTH 512
48
49
50 typedef struct xfrm_data_t xfrm_data_t;
51
52 /**
53 * Lenght/Type/data struct for userdata in xfrm
54 * We dont use the "I-don't-know-where-they-come-from"-structs
55 * used in the kernel.
56 */
57 struct xfrm_data_t {
58 /**
59 * length of the data
60 */
61 u_int16_t length;
62
63 /**
64 * type of data
65 */
66 u_int16_t type;
67
68 /**
69 * and the data itself, for different purposes
70 */
71 union {
72 /** algorithm */
73 struct xfrm_algo algo;
74 /** policy tmpl */
75 struct xfrm_user_tmpl tmpl[2];
76 };
77 };
78
79
80 typedef struct netlink_message_t netlink_message_t;
81
82 /**
83 * Representation of ANY netlink message used
84 */
85 struct netlink_message_t {
86
87 /**
88 * header of the netlink message
89 */
90 struct nlmsghdr hdr;
91
92 union {
93 /** error message */
94 struct nlmsgerr e;
95 /** message for spi allocation */
96 struct xfrm_userspi_info spi;
97 /** message for SA manipulation */
98 struct xfrm_usersa_id sa_id;
99 /** message for SA installation */
100 struct xfrm_usersa_info sa;
101 /** message for policy manipulation */
102 struct xfrm_userpolicy_id policy_id;
103 /** message for policy installation */
104 struct xfrm_userpolicy_info policy;
105 };
106 u_int8_t data[XFRM_DATA_LENGTH];
107 };
108
109
110 typedef struct private_kernel_interface_t private_kernel_interface_t;
111
112 /**
113 * @brief Private Variables and Functions of kernel_interface class.
114 *
115 */
116 struct private_kernel_interface_t {
117 /**
118 * Public part of the kernel_interface_t object.
119 */
120 kernel_interface_t public;
121
122 /**
123 * Netlink communication socket.
124 */
125 int socket;
126
127 pid_t pid;
128 /**
129 * Sequence number for messages.
130 */
131 u_int32_t seq;
132
133 /**
134 * List of responded messages.
135 */
136 linked_list_t *responses;
137
138 /**
139 * Thread which receives messages.
140 */
141 pthread_t thread;
142
143 /**
144 * Mutex locks access to replies list.
145 */
146 pthread_mutex_t mutex;
147
148 /**
149 * Condvar allows signaling of threads waiting for a reply.
150 */
151 pthread_cond_t condvar;
152
153 /**
154 * Function for the thread, receives messages.
155 */
156 void (*receive_messages) (private_kernel_interface_t *this);
157
158 /**
159 * Sends a netlink_message_t down to the kernel and wait for reply.
160 */
161 status_t (*send_message) (private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response);
162 };
163
164 /**
165 * In the kernel, algorithms are identified as strings, we use our
166 * mapping functions...
167 * Algorithms for encryption.
168 * TODO: Add missing algorithm strings
169 */
170 mapping_t kernel_encryption_algs_m[] = {
171 {ENCR_DES_IV64, ""},
172 {ENCR_DES, "des"},
173 {ENCR_3DES, "des3_ede"},
174 {ENCR_RC5, ""},
175 {ENCR_IDEA, "idea"},
176 {ENCR_CAST, "cast128"},
177 {ENCR_BLOWFISH, "blowfish"},
178 {ENCR_3IDEA, ""},
179 {ENCR_DES_IV32, ""},
180 {ENCR_NULL, ""},
181 {ENCR_AES_CBC, "aes"},
182 {ENCR_AES_CTR, ""},
183 {MAPPING_END, NULL}
184 };
185 /**
186 * In the kernel, algorithms are identified as strings, we use our
187 * mapping functions...
188 * Algorithms for integrity protection.
189 * TODO: Add missing algorithm strings
190 */
191 mapping_t kernel_integrity_algs_m[] = {
192 {AUTH_HMAC_MD5_96, "md5"},
193 {AUTH_HMAC_SHA1_96, "sha1"},
194 {AUTH_DES_MAC, ""},
195 {AUTH_KPDK_MD5, ""},
196 {AUTH_AES_XCBC_96, ""},
197 {MAPPING_END, NULL}
198 };
199
200 /**
201 * Implementation of kernel_interface_t.get_spi.
202 */
203 static status_t get_spi(private_kernel_interface_t *this,
204 host_t *src, host_t *dest,
205 protocol_id_t protocol, u_int32_t reqid,
206 u_int32_t *spi)
207 {
208 netlink_message_t request, *response;
209 status_t status = SUCCESS;
210
211 memset(&request, 0, sizeof(request));
212 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.spi)));
213 request.hdr.nlmsg_flags = NLM_F_REQUEST;
214 request.hdr.nlmsg_type = XFRM_MSG_ALLOCSPI;
215 request.spi.info.saddr = src->get_xfrm_addr(src);
216 request.spi.info.id.daddr = dest->get_xfrm_addr(dest);
217 request.spi.info.mode = TRUE; /* tunnel mode */
218 request.spi.info.reqid = reqid;
219 request.spi.info.id.proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
220 request.spi.info.family = PF_INET;
221 request.spi.min = 0xc0000000;
222 request.spi.max = 0xcFFFFFFF;
223
224 if (this->send_message(this, &request, &response) != SUCCESS)
225 {
226 status = FAILED;
227 }
228 else if (response->hdr.nlmsg_type == NLMSG_ERROR)
229 {
230 status = FAILED;
231 }
232 else if (response->hdr.nlmsg_type != XFRM_MSG_NEWSA)
233 {
234 status = FAILED;
235 }
236 else if (response->hdr.nlmsg_len < NLMSG_LENGTH(sizeof(response->sa)))
237 {
238 status = FAILED;
239 }
240
241 *spi = response->sa.id.spi;
242 allocator_free(response);
243
244 return status;
245 }
246
247 /**
248 * Implementation of kernel_interface_t.add_sa.
249 */
250 static status_t add_sa( private_kernel_interface_t *this,
251 host_t *me,
252 host_t *other,
253 u_int32_t spi,
254 int protocol,
255 u_int32_t reqid,
256 encryption_algorithm_t enc_alg,
257 chunk_t encryption_key,
258 integrity_algorithm_t int_alg,
259 chunk_t integrity_key,
260 bool replace)
261 {
262 netlink_message_t request, *response;
263 memset(&request, 0, sizeof(request));
264 status_t status;
265
266 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
267 request.hdr.nlmsg_type = replace ? XFRM_MSG_UPDSA : XFRM_MSG_NEWSA;
268
269 request.sa.saddr = me->get_xfrm_addr(me);
270 request.sa.id.daddr = other->get_xfrm_addr(other);
271
272 request.sa.id.spi = spi;
273 request.sa.id.proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
274 request.sa.family = me->get_family(me);
275 request.sa.mode = TRUE; /* tunnel mode */
276 request.sa.replay_window = 32;
277 request.sa.reqid = reqid;
278 request.sa.lft.soft_byte_limit = XFRM_INF;
279 request.sa.lft.soft_packet_limit = XFRM_INF;
280 request.sa.lft.hard_byte_limit = XFRM_INF;
281 request.sa.lft.hard_packet_limit = XFRM_INF;
282
283 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.sa)));
284
285 if (enc_alg != ENCR_UNDEFINED)
286 {
287 xfrm_data_t *data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
288
289 data->type = XFRMA_ALG_CRYPT;
290 data->length = 4 + sizeof(data->algo) + encryption_key.len;
291 data->algo.alg_key_len = encryption_key.len * 8;
292 request.hdr.nlmsg_len += data->length;
293 if (request.hdr.nlmsg_len > sizeof(request))
294 {
295 return FAILED;
296 }
297 strcpy(data->algo.alg_name, mapping_find(kernel_encryption_algs_m, enc_alg));
298 memcpy(data->algo.alg_key, encryption_key.ptr, encryption_key.len);
299 }
300
301 if (int_alg != AUTH_UNDEFINED)
302 {
303 xfrm_data_t *data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
304
305 data->type = XFRMA_ALG_AUTH;
306 data->length = 4 + sizeof(data->algo) + integrity_key.len;
307 data->algo.alg_key_len = integrity_key.len * 8;
308 request.hdr.nlmsg_len += data->length;
309 if (request.hdr.nlmsg_len > sizeof(request))
310 {
311 return FAILED;
312 }
313 strcpy(data->algo.alg_name, mapping_find(kernel_integrity_algs_m, int_alg));
314 memcpy(data->algo.alg_key, integrity_key.ptr, integrity_key.len);
315 }
316
317 /* TODO: add IPComp here*/
318
319 if (this->send_message(this, &request, &response) != SUCCESS)
320 {
321 status = FAILED;
322 }
323 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
324 {
325 status = FAILED;
326 }
327 else if (response->e.error)
328 {
329 status = FAILED;
330 }
331
332 allocator_free(response);
333 return SUCCESS;
334 }
335
336 static status_t del_sa( private_kernel_interface_t *this,
337 host_t *dst,
338 u_int32_t spi,
339 protocol_id_t protocol)
340 {
341 netlink_message_t request, *response;
342 memset(&request, 0, sizeof(request));
343 status_t status;
344
345 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
346 request.hdr.nlmsg_type = XFRM_MSG_DELSA;
347
348 request.sa_id.daddr = dst->get_xfrm_addr(dst);
349
350 request.sa_id.spi = spi;
351 request.sa_id.proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
352 request.sa_id.family = dst->get_family(dst);
353
354 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.sa_id)));
355
356 if (this->send_message(this, &request, &response) != SUCCESS)
357 {
358 status = FAILED;
359 }
360 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
361 {
362 status = FAILED;
363 }
364 else if (response->e.error)
365 {
366 status = FAILED;
367 }
368
369 allocator_free(response);
370 return SUCCESS;
371 }
372
373 /**
374 * Implementation of kernel_interface_t.add_policy.
375 */
376 static status_t add_policy(private_kernel_interface_t *this,
377 host_t *me, host_t *other,
378 host_t *src, host_t *dst,
379 u_int8_t src_hostbits, u_int8_t dst_hostbits,
380 int direction, int upper_proto,
381 bool ah, bool esp,
382 u_int32_t reqid)
383 {
384 netlink_message_t request, *response;
385 status_t status = SUCCESS;
386
387 memset(&request, 0, sizeof(request));
388 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
389
390 request.policy.sel.sport = htons(src->get_port(src));
391 request.policy.sel.dport = htons(dst->get_port(dst));
392 request.policy.sel.sport_mask = (request.policy.sel.sport) ? ~0 : 0;
393 request.policy.sel.dport_mask = (request.policy.sel.dport) ? ~0 : 0;
394 request.policy.sel.saddr = src->get_xfrm_addr(src);
395 request.policy.sel.daddr = dst->get_xfrm_addr(dst);
396 request.policy.sel.prefixlen_s = src_hostbits;
397 request.policy.sel.prefixlen_d = dst_hostbits;
398 request.policy.sel.proto = upper_proto;
399 request.policy.sel.family = src->get_family(src);
400
401 request.hdr.nlmsg_type = XFRM_MSG_NEWPOLICY;
402 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.policy)));
403
404 request.policy.dir = direction;
405 request.policy.priority = SPD_PRIORITY;
406 request.policy.action = XFRM_POLICY_ALLOW;
407 request.policy.share = XFRM_SHARE_ANY;
408
409 request.policy.lft.soft_byte_limit = XFRM_INF;
410 request.policy.lft.soft_packet_limit = XFRM_INF;
411 request.policy.lft.hard_byte_limit = XFRM_INF;
412 request.policy.lft.hard_packet_limit = XFRM_INF;
413
414 if (esp || ah)
415 {
416 xfrm_data_t *data;
417 int tmpl_pos = 0;
418 data = (xfrm_data_t*)(((u_int8_t*)&request) + request.hdr.nlmsg_len);
419 data->type = XFRMA_TMPL;
420 if (esp)
421 {
422 data->tmpl[tmpl_pos].reqid = reqid;
423 data->tmpl[tmpl_pos].id.proto = KERNEL_ESP;
424 data->tmpl[tmpl_pos].aalgos = data->tmpl[tmpl_pos].ealgos = data->tmpl[tmpl_pos].calgos = ~0;
425 data->tmpl[tmpl_pos].mode = TRUE;
426
427 data->tmpl[tmpl_pos].saddr = me->get_xfrm_addr(me);
428 data->tmpl[tmpl_pos].id.daddr = me->get_xfrm_addr(other);
429
430 tmpl_pos++;
431 }
432 if (ah)
433 {
434 data->tmpl[tmpl_pos].reqid = reqid;
435 data->tmpl[tmpl_pos].id.proto = KERNEL_AH;
436 data->tmpl[tmpl_pos].aalgos = data->tmpl[tmpl_pos].ealgos = data->tmpl[tmpl_pos].calgos = ~0;
437 data->tmpl[tmpl_pos].mode = TRUE;
438
439 data->tmpl[tmpl_pos].saddr = me->get_xfrm_addr(me);
440 data->tmpl[tmpl_pos].id.daddr = other->get_xfrm_addr(other);
441
442 tmpl_pos++;
443 }
444 data->length = 4 + sizeof(struct xfrm_user_tmpl) * tmpl_pos;
445 request.hdr.nlmsg_len += data->length;
446 }
447
448 if (this->send_message(this, &request, &response) != SUCCESS)
449 {
450 status = FAILED;
451 }
452 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
453 {
454 status = FAILED;
455 }
456 else if (response->e.error)
457 {
458 status = FAILED;
459 }
460
461 allocator_free(response);
462 return status;
463 }
464
465 /**
466 * Implementation of kernel_interface_t.del_policy.
467 */
468 static status_t del_policy(private_kernel_interface_t *this,
469 host_t *me, host_t *other,
470 host_t *src, host_t *dst,
471 u_int8_t src_hostbits, u_int8_t dst_hostbits,
472 int direction, int upper_proto)
473 {
474 netlink_message_t request, *response;
475 status_t status = SUCCESS;
476
477 memset(&request, 0, sizeof(request));
478 request.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
479
480 request.policy_id.sel.sport = htons(src->get_port(src));
481 request.policy_id.sel.dport = htons(dst->get_port(dst));
482 request.policy_id.sel.sport_mask = (request.policy.sel.sport) ? ~0 : 0;
483 request.policy_id.sel.dport_mask = (request.policy.sel.dport) ? ~0 : 0;
484 request.policy_id.sel.saddr = src->get_xfrm_addr(src);
485 request.policy_id.sel.daddr = dst->get_xfrm_addr(dst);
486 request.policy_id.sel.prefixlen_s = src_hostbits;
487 request.policy_id.sel.prefixlen_d = dst_hostbits;
488 request.policy_id.sel.proto = upper_proto;
489 request.policy_id.sel.family = src->get_family(src);
490
491 request.policy_id.dir = direction;
492
493 request.hdr.nlmsg_type = XFRM_MSG_DELPOLICY;
494 request.hdr.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(request.policy_id)));
495
496 if (this->send_message(this, &request, &response) != SUCCESS)
497 {
498 status = FAILED;
499 }
500 else if (response->hdr.nlmsg_type != NLMSG_ERROR)
501 {
502 status = FAILED;
503 }
504 else if (response->e.error)
505 {
506 status = FAILED;
507 }
508
509 allocator_free(response);
510 return status;
511 }
512
513 /**
514 * Implementation of private_kernel_interface_t.send_message.
515 */
516 static status_t send_message(private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response)
517 {
518 size_t length;
519 struct sockaddr_nl addr;
520
521 request->hdr.nlmsg_seq = ++this->seq;
522 request->hdr.nlmsg_pid = this->pid;
523
524 memset(&addr, 0, sizeof(struct sockaddr_nl));
525 addr.nl_family = AF_NETLINK;
526 addr.nl_pid = 0;
527 addr.nl_groups = 0;
528
529 length = sendto(this->socket,(void *)request, request->hdr.nlmsg_len, 0, (struct sockaddr *)&addr, sizeof(addr));
530
531 if (length < 0)
532 {
533 return FAILED;
534 }
535 else if (length != request->hdr.nlmsg_len)
536 {
537 return FAILED;
538 }
539
540 pthread_mutex_lock(&(this->mutex));
541
542 while (TRUE)
543 {
544 iterator_t *iterator;
545 bool found = FALSE;
546 /* search list, break if found */
547 iterator = this->responses->create_iterator(this->responses, TRUE);
548 while (iterator->has_next(iterator))
549 {
550 netlink_message_t *listed_response;
551 iterator->current(iterator, (void**)&listed_response);
552 if (listed_response->hdr.nlmsg_seq == request->hdr.nlmsg_seq)
553 {
554 /* matches our request, this is the reply */
555 *response = listed_response;
556 found = TRUE;
557 break;
558 }
559 }
560 iterator->destroy(iterator);
561
562 if (found)
563 {
564 break;
565 }
566 /* TODO: we should time out, if something goes wrong!??? */
567 pthread_cond_wait(&(this->condvar), &(this->mutex));
568 }
569
570 pthread_mutex_unlock(&(this->mutex));
571
572 return SUCCESS;
573 }
574
575 /**
576 * Implementation of private_kernel_interface_t.receive_messages.
577 */
578 static void receive_messages(private_kernel_interface_t *this)
579 {
580 while(TRUE)
581 {
582 netlink_message_t response, *listed_response;
583 while (TRUE)
584 {
585 struct sockaddr_nl addr;
586 socklen_t addr_length;
587 size_t length;
588
589 addr_length = sizeof(addr);
590
591 response.hdr.nlmsg_type = XFRM_MSG_NEWSA;
592 length = recvfrom(this->socket, &response, sizeof(response), 0, (struct sockaddr*)&addr, &addr_length);
593 if (length < 0)
594 {
595 if (errno == EINTR)
596 {
597 /* interrupted, try again */
598 continue;
599 }
600 charon->kill(charon, "receiving from netlink socket failed");
601 }
602 if (!NLMSG_OK(&response.hdr, length))
603 {
604 /* bad netlink message */
605 continue;
606 }
607 if (addr.nl_pid != 0)
608 {
609 /* not from kernel. not interested, try another one */
610 continue;
611 }
612 break;
613 }
614
615 /* got a valid message.
616 * requests are handled on our own,
617 * responses are listed for the requesters
618 */
619 if (response.hdr.nlmsg_flags & NLM_F_REQUEST)
620 {
621 /* handle request */
622 }
623 else
624 {
625 /* add response to queue */
626 listed_response = allocator_alloc(sizeof(response));
627 memcpy(listed_response, &response, sizeof(response));
628
629 pthread_mutex_lock(&(this->mutex));
630 this->responses->insert_last(this->responses, (void*)listed_response);
631 pthread_mutex_unlock(&(this->mutex));
632 /* signal ALL waiting threads */
633 pthread_cond_broadcast(&(this->condvar));
634 }
635 /* get the next one */
636 }
637 }
638
639 /**
640 * Implementation of kernel_interface_t.destroy.
641 */
642 static void destroy(private_kernel_interface_t *this)
643 {
644 pthread_cancel(this->thread);
645 pthread_join(this->thread, NULL);
646 close(this->socket);
647 this->responses->destroy(this->responses);
648 allocator_free(this);
649 }
650
651 /*
652 * Described in header.
653 */
654 kernel_interface_t *kernel_interface_create()
655 {
656 private_kernel_interface_t *this = allocator_alloc_thing(private_kernel_interface_t);
657
658 /* public functions */
659 this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
660 this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,encryption_algorithm_t,chunk_t,integrity_algorithm_t,chunk_t,bool))add_sa;
661 this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*, host_t*,host_t*,host_t*,u_int8_t,u_int8_t,int,int,bool,bool,u_int32_t))add_policy;
662 this->public.del_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t))del_sa;
663 this->public.del_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,host_t*,host_t*,u_int8_t,u_int8_t,int,int))del_policy;
664
665 this->public.destroy = (void(*)(kernel_interface_t*)) destroy;
666
667 /* private members */
668 this->receive_messages = receive_messages;
669 this->send_message = send_message;
670 this->pid = getpid();
671 this->responses = linked_list_create();
672 pthread_mutex_init(&(this->mutex),NULL);
673 pthread_cond_init(&(this->condvar),NULL);
674 this->seq = 0;
675 this->socket = socket(PF_NETLINK, SOCK_RAW, NETLINK_XFRM);
676 if (this->socket <= 0)
677 {
678 allocator_free(this);
679 charon->kill(charon, "Unable to create netlink socket");
680 }
681
682 if (pthread_create(&(this->thread), NULL, (void*(*)(void*))this->receive_messages, this) != 0)
683 {
684 close(this->socket);
685 allocator_free(this);
686 charon->kill(charon, "Unable to create netlink thread");
687 }
688
689 charon->logger_manager->enable_log_level(charon->logger_manager, TESTER, FULL);
690 return (&this->public);
691 }