2 * @file kernel_interface.c
4 * @brief Implementation of kernel_interface_t.
9 * Copyright (C) 2005-2007 Martin Willi
10 * Copyright (C) 2006-2007 Tobias Brunner
11 * Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
12 * Copyright (C) 2006 Daniel Roethlisberger
13 * Copyright (C) 2005 Jan Hutter
14 * Hochschule fuer Technik Rapperswil
15 * Copyright (C) 2003 Herbert Xu.
17 * Based on xfrm code from pluto.
19 * This program is free software; you can redistribute it and/or modify it
20 * under the terms of the GNU General Public License as published by the
21 * Free Software Foundation; either version 2 of the License, or (at your
22 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
24 * This program is distributed in the hope that it will be useful, but
25 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
26 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
30 #include <sys/types.h>
31 #include <sys/socket.h>
32 #include <linux/netlink.h>
33 #include <linux/rtnetlink.h>
34 #include <linux/xfrm.h>
35 #include <linux/udp.h>
42 #include <sys/ioctl.h>
44 #include "kernel_interface.h"
47 #include <utils/linked_list.h>
48 #include <processing/jobs/delete_child_sa_job.h>
49 #include <processing/jobs/rekey_child_sa_job.h>
50 #include <processing/jobs/acquire_job.h>
52 /** kernel level protocol identifiers */
56 /** default priority of installed policies */
58 #define PRIO_HIGH 2000
60 #define BUFFER_SIZE 1024
63 * returns a pointer to the first rtattr following the nlmsghdr *nlh and the
64 * 'usual' netlink data x like 'struct xfrm_usersa_info'
66 #define XFRM_RTA(nlh, x) ((struct rtattr*)(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(x))))
68 * returns a pointer to the next rtattr following rta.
69 * !!! do not use this to parse messages. use RTA_NEXT and RTA_OK instead !!!
71 #define XFRM_RTA_NEXT(rta) ((struct rtattr*)(((char*)(rta)) + RTA_ALIGN((rta)->rta_len)))
73 * returns the total size of attached rta data
74 * (after 'usual' netlink data x like 'struct xfrm_usersa_info')
76 #define XFRM_PAYLOAD(nlh, x) NLMSG_PAYLOAD(nlh, sizeof(x))
78 typedef struct kernel_algorithm_t kernel_algorithm_t
;
81 * Mapping from the algorithms defined in IKEv2 to
82 * kernel level algorithm names and their key length
84 struct kernel_algorithm_t
{
86 * Identifier specified in IKEv2
91 * Name of the algorithm, as used as kernel identifier
96 * Key length in bits, if fixed size
100 #define END_OF_LIST -1
103 * Algorithms for encryption
105 kernel_algorithm_t encryption_algs
[] = {
106 /* {ENCR_DES_IV64, "***", 0}, */
107 {ENCR_DES
, "des", 64},
108 {ENCR_3DES
, "des3_ede", 192},
109 /* {ENCR_RC5, "***", 0}, */
110 /* {ENCR_IDEA, "***", 0}, */
111 {ENCR_CAST
, "cast128", 0},
112 {ENCR_BLOWFISH
, "blowfish", 0},
113 /* {ENCR_3IDEA, "***", 0}, */
114 /* {ENCR_DES_IV32, "***", 0}, */
115 {ENCR_NULL
, "cipher_null", 0},
116 {ENCR_AES_CBC
, "aes", 0},
117 /* {ENCR_AES_CTR, "***", 0}, */
118 {END_OF_LIST
, NULL
, 0},
122 * Algorithms for integrity protection
124 kernel_algorithm_t integrity_algs
[] = {
125 {AUTH_HMAC_MD5_96
, "md5", 128},
126 {AUTH_HMAC_SHA1_96
, "sha1", 160},
127 {AUTH_HMAC_SHA2_256_128
, "sha256", 256},
128 {AUTH_HMAC_SHA2_384_192
, "sha384", 384},
129 {AUTH_HMAC_SHA2_512_256
, "sha512", 512},
130 /* {AUTH_DES_MAC, "***", 0}, */
131 /* {AUTH_KPDK_MD5, "***", 0}, */
132 {AUTH_AES_XCBC_96
, "xcbc(aes)", 128},
133 {END_OF_LIST
, NULL
, 0},
137 * Look up a kernel algorithm name and its key size
139 char* lookup_algorithm(kernel_algorithm_t
*kernel_algo
,
140 algorithm_t
*ikev2_algo
, u_int
*key_size
)
142 while (kernel_algo
->ikev2_id
!= END_OF_LIST
)
144 if (ikev2_algo
->algorithm
== kernel_algo
->ikev2_id
)
146 /* match, evaluate key length */
147 if (ikev2_algo
->key_size
)
148 { /* variable length */
149 *key_size
= ikev2_algo
->key_size
;
153 *key_size
= kernel_algo
->key_size
;
155 return kernel_algo
->name
;
162 typedef struct route_entry_t route_entry_t
;
165 * installed routing entry
167 struct route_entry_t
{
169 /** Index of the interface the route is bound to */
172 /** Source ip of the route */
175 /** gateway for this route */
178 /** Destination net */
181 /** Destination net prefixlen */
186 * destroy an route_entry_t object
188 static void route_entry_destroy(route_entry_t
*this)
190 this->src_ip
->destroy(this->src_ip
);
191 this->gateway
->destroy(this->gateway
);
192 chunk_free(&this->dst_net
);
196 typedef struct policy_entry_t policy_entry_t
;
199 * installed kernel policy.
201 struct policy_entry_t
{
203 /** direction of this policy: in, out, forward */
206 /** reqid of the policy */
209 /** parameters of installed policy */
210 struct xfrm_selector sel
;
212 /** associated route installed for this policy */
213 route_entry_t
*route
;
215 /** by how many CHILD_SA's this policy is used */
219 typedef struct vip_entry_t vip_entry_t
;
222 * Installed virtual ip
225 /** Index of the interface the ip is bound to */
228 /** The ip address */
231 /** Number of times this IP is used */
236 * destroy a vip_entry_t object
238 static void vip_entry_destroy(vip_entry_t
*this)
240 this->ip
->destroy(this->ip
);
244 typedef struct address_entry_t address_entry_t
;
247 * an address found on the system, containg address and interface info
249 struct address_entry_t
{
251 /** address of this entry */
254 /** interface index */
257 /** name of the index */
258 char ifname
[IFNAMSIZ
];
262 * destroy an address entry
264 static void address_entry_destroy(address_entry_t
*this)
266 this->host
->destroy(this->host
);
270 typedef struct private_kernel_interface_t private_kernel_interface_t
;
273 * Private variables and functions of kernel_interface class.
275 struct private_kernel_interface_t
{
277 * Public part of the kernel_interface_t object.
279 kernel_interface_t
public;
282 * List of installed policies (kernel_entry_t)
284 linked_list_t
*policies
;
287 * Mutex locks access to policies
289 pthread_mutex_t policies_mutex
;
292 * List of installed virtual IPs. (vip_entry_t)
297 * Mutex to lock access to vips.
299 pthread_mutex_t vips_mutex
;
302 * netlink xfrm socket to receive acquire and expire events
304 int socket_xfrm_events
;
307 * Netlink xfrm socket (IPsec)
312 * Netlink rt socket (routing)
317 * Thread receiving events from kernel
319 pthread_t event_thread
;
323 * convert a host_t to a struct xfrm_address
325 static void host2xfrm(host_t
*host
, xfrm_address_t
*xfrm
)
327 chunk_t chunk
= host
->get_address(host
);
328 memcpy(xfrm
, chunk
.ptr
, min(chunk
.len
, sizeof(xfrm_address_t
)));
332 * convert a traffic selector address range to subnet and its mask.
334 static void ts2subnet(traffic_selector_t
* ts
,
335 xfrm_address_t
*net
, u_int8_t
*mask
)
337 /* there is no way to do this cleanly, as the address range may
338 * be anything else but a subnet. We use from_addr as subnet
339 * and try to calculate a usable subnet mask.
344 size_t size
= (ts
->get_type(ts
) == TS_IPV4_ADDR_RANGE
) ?
4 : 16;
346 from
= ts
->get_from_address(ts
);
347 to
= ts
->get_to_address(ts
);
350 /* go trough all bits of the addresses, beginning in the front.
351 * as long as they are equal, the subnet gets larger
353 for (byte
= 0; byte
< size
; byte
++)
355 for (bit
= 7; bit
>= 0; bit
--)
357 if ((1<<bit
& from
.ptr
[byte
]) != (1<<bit
& to
.ptr
[byte
]))
359 *mask
= ((7 - bit
) + (byte
* 8));
369 memcpy(net
, from
.ptr
, from
.len
);
375 * convert a traffic selector port range to port/portmask
377 static void ts2ports(traffic_selector_t
* ts
,
378 u_int16_t
*port
, u_int16_t
*mask
)
380 /* linux does not seem to accept complex portmasks. Only
381 * any or a specific port is allowed. We set to any, if we have
382 * a port range, or to a specific, if we have one port only.
386 from
= ts
->get_from_port(ts
);
387 to
= ts
->get_to_port(ts
);
402 * convert a pair of traffic_selectors to a xfrm_selector
404 static struct xfrm_selector
ts2selector(traffic_selector_t
*src
,
405 traffic_selector_t
*dst
)
407 struct xfrm_selector sel
;
409 memset(&sel
, 0, sizeof(sel
));
410 sel
.family
= src
->get_type(src
) == TS_IPV4_ADDR_RANGE ? AF_INET
: AF_INET6
;
411 /* src or dest proto may be "any" (0), use more restrictive one */
412 sel
.proto
= max(src
->get_protocol(src
), dst
->get_protocol(dst
));
413 ts2subnet(dst
, &sel
.daddr
, &sel
.prefixlen_d
);
414 ts2subnet(src
, &sel
.saddr
, &sel
.prefixlen_s
);
415 ts2ports(dst
, &sel
.dport
, &sel
.dport_mask
);
416 ts2ports(src
, &sel
.sport
, &sel
.sport_mask
);
424 * Creates an rtattr and adds it to the netlink message
426 static void add_attribute(struct nlmsghdr
*hdr
, int rta_type
, chunk_t data
,
431 if (NLMSG_ALIGN(hdr
->nlmsg_len
) + RTA_ALIGN(data
.len
) > buflen
)
433 DBG1(DBG_KNL
, "unable to add attribute, buffer too small");
437 rta
= (struct rtattr
*)(((char*)hdr
) + NLMSG_ALIGN(hdr
->nlmsg_len
));
438 rta
->rta_type
= rta_type
;
439 rta
->rta_len
= RTA_LENGTH(data
.len
);
440 memcpy(RTA_DATA(rta
), data
.ptr
, data
.len
);
441 hdr
->nlmsg_len
= NLMSG_ALIGN(hdr
->nlmsg_len
) + rta
->rta_len
;
445 * Receives events from kernel
447 static void receive_events(private_kernel_interface_t
*this)
449 charon
->drop_capabilities(charon
, TRUE
);
453 unsigned char response
[512];
454 struct nlmsghdr
*hdr
;
455 struct sockaddr_nl addr
;
456 socklen_t addr_len
= sizeof(addr
);
459 hdr
= (struct nlmsghdr
*)response
;
460 len
= recvfrom(this->socket_xfrm_events
, response
, sizeof(response
),
461 0, (struct sockaddr
*)&addr
, &addr_len
);
466 /* interrupted, try again */
469 charon
->kill(charon
, "unable to receive netlink events");
472 if (!NLMSG_OK(hdr
, len
))
474 /* bad netlink message */
478 if (addr
.nl_pid
!= 0)
480 /* not from kernel. not interested, try another one */
484 /* we handle ACQUIRE and EXPIRE messages directly */
485 if (hdr
->nlmsg_type
== XFRM_MSG_ACQUIRE
)
489 struct rtattr
*rtattr
= XFRM_RTA(hdr
, struct xfrm_user_acquire
);
490 size_t rtsize
= XFRM_PAYLOAD(hdr
, struct xfrm_user_tmpl
);
491 if (RTA_OK(rtattr
, rtsize
))
493 if (rtattr
->rta_type
== XFRMA_TMPL
)
495 struct xfrm_user_tmpl
* tmpl
= (struct xfrm_user_tmpl
*)RTA_DATA(rtattr
);
501 DBG1(DBG_KNL
, "received a XFRM_MSG_ACQUIRE, but no reqid found");
505 DBG2(DBG_KNL
, "received a XFRM_MSG_ACQUIRE");
506 DBG1(DBG_KNL
, "creating acquire job for CHILD_SA with reqid %d",
508 job
= (job_t
*)acquire_job_create(reqid
);
509 charon
->job_queue
->add(charon
->job_queue
, job
);
512 else if (hdr
->nlmsg_type
== XFRM_MSG_EXPIRE
)
515 protocol_id_t protocol
;
516 u_int32_t spi
, reqid
;
517 struct xfrm_user_expire
*expire
;
519 expire
= (struct xfrm_user_expire
*)NLMSG_DATA(hdr
);
520 protocol
= expire
->state
.id
.proto
== KERNEL_ESP ?
521 PROTO_ESP
: PROTO_AH
;
522 spi
= expire
->state
.id
.spi
;
523 reqid
= expire
->state
.reqid
;
525 DBG2(DBG_KNL
, "received a XFRM_MSG_EXPIRE");
526 DBG1(DBG_KNL
, "creating %s job for %N CHILD_SA 0x%x (reqid %d)",
527 expire
->hard ?
"delete" : "rekey", protocol_id_names
,
528 protocol
, ntohl(spi
), reqid
);
531 job
= (job_t
*)delete_child_sa_job_create(reqid
, protocol
, spi
);
535 job
= (job_t
*)rekey_child_sa_job_create(reqid
, protocol
, spi
);
537 charon
->job_queue
->add(charon
->job_queue
, job
);
543 * send a netlink message and wait for a reply
545 static status_t
netlink_send(int socket
, struct nlmsghdr
*in
,
546 struct nlmsghdr
**out
, size_t *out_len
)
549 struct sockaddr_nl addr
;
550 chunk_t result
= chunk_empty
, tmp
;
551 struct nlmsghdr
*msg
, peek
;
553 static int seq
= 200;
554 static pthread_mutex_t mutex
= PTHREAD_MUTEX_INITIALIZER
;
557 pthread_mutex_lock(&mutex
);
559 in
->nlmsg_seq
= ++seq
;
560 in
->nlmsg_pid
= getpid();
562 memset(&addr
, 0, sizeof(addr
));
563 addr
.nl_family
= AF_NETLINK
;
569 len
= sendto(socket
, in
, in
->nlmsg_len
, 0,
570 (struct sockaddr
*)&addr
, sizeof(addr
));
572 if (len
!= in
->nlmsg_len
)
576 /* interrupted, try again */
579 pthread_mutex_unlock(&mutex
);
580 DBG1(DBG_KNL
, "error sending to netlink socket: %s", strerror(errno
));
589 tmp
.len
= sizeof(buf
);
591 msg
= (struct nlmsghdr
*)tmp
.ptr
;
593 memset(&addr
, 0, sizeof(addr
));
594 addr
.nl_family
= AF_NETLINK
;
595 addr
.nl_pid
= getpid();
597 addr_len
= sizeof(addr
);
599 len
= recvfrom(socket
, tmp
.ptr
, tmp
.len
, 0,
600 (struct sockaddr
*)&addr
, &addr_len
);
606 DBG1(DBG_IKE
, "got interrupted");
607 /* interrupted, try again */
610 DBG1(DBG_IKE
, "error reading from netlink socket: %s", strerror(errno
));
611 pthread_mutex_unlock(&mutex
);
614 if (!NLMSG_OK(msg
, len
))
616 DBG1(DBG_IKE
, "received corrupted netlink message");
617 pthread_mutex_unlock(&mutex
);
620 if (msg
->nlmsg_seq
!= seq
)
622 DBG1(DBG_IKE
, "received invalid netlink sequence number");
623 if (msg
->nlmsg_seq
< seq
)
627 pthread_mutex_unlock(&mutex
);
632 result
= chunk_cata("cc", result
, tmp
);
634 /* NLM_F_MULTI flag does not seem to be set correctly, we use sequence
635 * numbers to detect multi header messages */
636 len
= recvfrom(socket
, &peek
, sizeof(peek
), MSG_PEEK
| MSG_DONTWAIT
,
637 (struct sockaddr
*)&addr
, &addr_len
);
639 if (len
== sizeof(peek
) && peek
.nlmsg_seq
== seq
)
641 /* seems to be multipart */
647 *out_len
= result
.len
;
648 *out
= (struct nlmsghdr
*)clalloc(result
.ptr
, result
.len
);
650 pthread_mutex_unlock(&mutex
);
656 * send a netlink message and wait for its acknowlegde
658 static status_t
netlink_send_ack(int socket
, struct nlmsghdr
*in
)
660 struct nlmsghdr
*out
, *hdr
;
663 if (netlink_send(socket
, in
, &out
, &len
) != SUCCESS
)
668 while (NLMSG_OK(hdr
, len
))
670 switch (hdr
->nlmsg_type
)
674 struct nlmsgerr
* err
= (struct nlmsgerr
*)NLMSG_DATA(hdr
);
678 DBG1(DBG_KNL
, "received netlink error: %s (%d)",
679 strerror(-err
->error
), -err
->error
);
687 hdr
= NLMSG_NEXT(hdr
, len
);
694 DBG1(DBG_KNL
, "netlink request not acknowlegded");
700 * Create a list of local addresses.
702 static linked_list_t
*create_address_list(private_kernel_interface_t
*this)
704 char request
[BUFFER_SIZE
];
705 struct nlmsghdr
*out
, *hdr
;
706 struct rtgenmsg
*msg
;
710 DBG2(DBG_IKE
, "getting local address list");
712 list
= linked_list_create();
714 memset(&request
, 0, sizeof(request
));
716 hdr
= (struct nlmsghdr
*)&request
;
717 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct rtgenmsg
));
718 hdr
->nlmsg_type
= RTM_GETADDR
;
719 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_MATCH
| NLM_F_ROOT
;
720 msg
= (struct rtgenmsg
*)NLMSG_DATA(hdr
);
721 msg
->rtgen_family
= AF_UNSPEC
;
723 if (netlink_send(this->socket_rt
, hdr
, &out
, &len
) == SUCCESS
)
726 while (NLMSG_OK(hdr
, len
))
728 switch (hdr
->nlmsg_type
)
732 struct ifaddrmsg
* msg
= (struct ifaddrmsg
*)(NLMSG_DATA(hdr
));
733 struct rtattr
*rta
= IFA_RTA(msg
);
734 size_t rtasize
= IFA_PAYLOAD (hdr
);
737 chunk_t local
= chunk_empty
, address
= chunk_empty
;
739 while(RTA_OK(rta
, rtasize
))
741 switch (rta
->rta_type
)
744 local
.ptr
= RTA_DATA(rta
);
745 local
.len
= RTA_PAYLOAD(rta
);
748 address
.ptr
= RTA_DATA(rta
);
749 address
.len
= RTA_PAYLOAD(rta
);
752 name
= RTA_DATA(rta
);
755 rta
= RTA_NEXT(rta
, rtasize
);
758 /* For PPP interfaces, we need the IFA_LOCAL address,
759 * IFA_ADDRESS is the peers address. But IFA_LOCAL is
760 * not included in all cases, so fallback to IFA_ADDRESS. */
763 host
= host_create_from_chunk(msg
->ifa_family
, local
, 0);
765 else if (address
.ptr
)
767 host
= host_create_from_chunk(msg
->ifa_family
, address
, 0);
772 address_entry_t
*entry
;
774 entry
= malloc_thing(address_entry_t
);
776 entry
->ifindex
= msg
->ifa_index
;
779 memcpy(entry
->ifname
, name
, IFNAMSIZ
);
783 strcpy(entry
->ifname
, "(unknown)");
785 list
->insert_last(list
, entry
);
787 hdr
= NLMSG_NEXT(hdr
, len
);
791 hdr
= NLMSG_NEXT(hdr
, len
);
802 DBG1(DBG_IKE
, "unable to get local address list");
809 * Implements kernel_interface_t.create_address_list.
811 static linked_list_t
*create_address_list_public(private_kernel_interface_t
*this)
813 linked_list_t
*result
, *list
;
814 address_entry_t
*entry
;
816 result
= linked_list_create();
817 list
= create_address_list(this);
818 while (list
->remove_last(list
, (void**)&entry
) == SUCCESS
)
820 result
->insert_last(result
, entry
->host
);
829 * implementation of kernel_interface_t.get_interface_name
831 static char *get_interface_name(private_kernel_interface_t
*this, host_t
* ip
)
834 address_entry_t
*entry
;
837 DBG2(DBG_IKE
, "getting interface name for %H", ip
);
839 list
= create_address_list(this);
840 while (!name
&& list
->remove_last(list
, (void**)&entry
) == SUCCESS
)
842 if (ip
->ip_equals(ip
, entry
->host
))
844 name
= strdup(entry
->ifname
);
846 address_entry_destroy(entry
);
848 list
->destroy_function(list
, (void*)address_entry_destroy
);
852 DBG2(DBG_IKE
, "%H is on interface %s", ip
, name
);
856 DBG2(DBG_IKE
, "%H is not a local address", ip
);
862 * Tries to find an ip address of a local interface that is included in the
863 * supplied traffic selector.
865 static status_t
get_address_by_ts(private_kernel_interface_t
*this,
866 traffic_selector_t
*ts
, host_t
**ip
)
868 address_entry_t
*entry
;
874 DBG2(DBG_IKE
, "getting a local address in traffic selector %R", ts
);
876 /* if we have a family which includes localhost, we do not
877 * search for an IP, we use the default */
878 family
= ts
->get_type(ts
) == TS_IPV4_ADDR_RANGE ? AF_INET
: AF_INET6
;
880 if (family
== AF_INET
)
882 host
= host_create_from_string("127.0.0.1", 0);
886 host
= host_create_from_string("::1", 0);
889 if (ts
->includes(ts
, host
))
891 *ip
= host_create_any(family
);
893 DBG2(DBG_IKE
, "using host %H", *ip
);
898 list
= create_address_list(this);
899 while (!found
&& list
->remove_last(list
, (void**)&entry
) == SUCCESS
)
901 if (ts
->includes(ts
, entry
->host
))
904 *ip
= entry
->host
->clone(entry
->host
);
906 address_entry_destroy(entry
);
908 list
->destroy_function(list
, (void*)address_entry_destroy
);
912 DBG1(DBG_IKE
, "no local address found in traffic selector %R", ts
);
915 DBG2(DBG_IKE
, "using host %H", *ip
);
920 * get the interface of a local address
922 static int get_interface_index(private_kernel_interface_t
*this, host_t
* ip
)
925 address_entry_t
*entry
;
928 DBG2(DBG_IKE
, "getting iface for %H", ip
);
930 list
= create_address_list(this);
931 while (!ifindex
&& list
->remove_last(list
, (void**)&entry
) == SUCCESS
)
933 if (ip
->ip_equals(ip
, entry
->host
))
935 ifindex
= entry
->ifindex
;
937 address_entry_destroy(entry
);
939 list
->destroy_function(list
, (void*)address_entry_destroy
);
943 DBG1(DBG_IKE
, "unable to get interface for %H", ip
);
949 * Manages the creation and deletion of ip addresses on an interface.
950 * By setting the appropriate nlmsg_type, the ip will be set or unset.
952 static status_t
manage_ipaddr(private_kernel_interface_t
*this, int nlmsg_type
,
953 int flags
, int if_index
, host_t
*ip
)
955 unsigned char request
[BUFFER_SIZE
];
956 struct nlmsghdr
*hdr
;
957 struct ifaddrmsg
*msg
;
960 memset(&request
, 0, sizeof(request
));
962 chunk
= ip
->get_address(ip
);
964 hdr
= (struct nlmsghdr
*)request
;
965 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
| flags
;
966 hdr
->nlmsg_type
= nlmsg_type
;
967 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct ifaddrmsg
));
969 msg
= (struct ifaddrmsg
*)NLMSG_DATA(hdr
);
970 msg
->ifa_family
= ip
->get_family(ip
);
972 msg
->ifa_prefixlen
= 8 * chunk
.len
;
973 msg
->ifa_scope
= RT_SCOPE_UNIVERSE
;
974 msg
->ifa_index
= if_index
;
976 add_attribute(hdr
, IFA_LOCAL
, chunk
, sizeof(request
));
978 return netlink_send_ack(this->socket_rt
, hdr
);
982 * Manages source routes in the routing table.
983 * By setting the appropriate nlmsg_type, the route added or r.
985 static status_t
manage_srcroute(private_kernel_interface_t
*this, int nlmsg_type
,
986 int flags
, route_entry_t
*route
)
988 unsigned char request
[BUFFER_SIZE
];
989 struct nlmsghdr
*hdr
;
993 /* if route is 0.0.0.0/0, we can't install it, as it would
994 * overwrite the default route. Instead, we add two routes:
995 * 0.0.0.0/1 and 128.0.0.0/1
996 * TODO: use metrics instead */
997 if (route
->prefixlen
== 0)
1002 half
.dst_net
= chunk_alloca(route
->dst_net
.len
);
1003 memset(half
.dst_net
.ptr
, 0, half
.dst_net
.len
);
1004 half
.src_ip
= route
->src_ip
;
1005 half
.gateway
= route
->gateway
;
1006 half
.if_index
= route
->if_index
;
1009 status
= manage_srcroute(this, nlmsg_type
, flags
, &half
);
1010 half
.dst_net
.ptr
[0] |= 0x80;
1011 status
= manage_srcroute(this, nlmsg_type
, flags
, &half
);
1015 memset(&request
, 0, sizeof(request
));
1017 hdr
= (struct nlmsghdr
*)request
;
1018 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
| flags
;
1019 hdr
->nlmsg_type
= nlmsg_type
;
1020 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct rtmsg
));
1022 msg
= (struct rtmsg
*)NLMSG_DATA(hdr
);
1023 msg
->rtm_family
= route
->src_ip
->get_family(route
->src_ip
);
1024 msg
->rtm_dst_len
= route
->prefixlen
;
1025 msg
->rtm_table
= RT_TABLE_MAIN
;
1026 msg
->rtm_protocol
= RTPROT_STATIC
;
1027 msg
->rtm_type
= RTN_UNICAST
;
1028 msg
->rtm_scope
= RT_SCOPE_UNIVERSE
;
1030 add_attribute(hdr
, RTA_DST
, route
->dst_net
, sizeof(request
));
1031 chunk
= route
->src_ip
->get_address(route
->src_ip
);
1032 add_attribute(hdr
, RTA_PREFSRC
, chunk
, sizeof(request
));
1033 chunk
= route
->gateway
->get_address(route
->gateway
);
1034 add_attribute(hdr
, RTA_GATEWAY
, chunk
, sizeof(request
));
1035 chunk
.ptr
= (char*)&route
->if_index
;
1036 chunk
.len
= sizeof(route
->if_index
);
1037 add_attribute(hdr
, RTA_OIF
, chunk
, sizeof(request
));
1039 return netlink_send_ack(this->socket_rt
, hdr
);
1044 * Implementation of kernel_interface_t.add_ip.
1046 static status_t
add_ip(private_kernel_interface_t
*this,
1047 host_t
*virtual_ip
, host_t
*iface_ip
)
1050 vip_entry_t
*listed
;
1051 iterator_t
*iterator
;
1053 DBG2(DBG_KNL
, "adding virtual IP %H", virtual_ip
);
1055 targetif
= get_interface_index(this, iface_ip
);
1058 DBG1(DBG_KNL
, "unable to add virtual IP %H, no iface found for %H",
1059 virtual_ip
, iface_ip
);
1063 /* beware of deadlocks (e.g. send/receive packets while holding the lock) */
1064 iterator
= this->vips
->create_iterator_locked(this->vips
, &(this->vips_mutex
));
1065 while (iterator
->iterate(iterator
, (void**)&listed
))
1067 if (listed
->if_index
== targetif
&&
1068 virtual_ip
->ip_equals(virtual_ip
, listed
->ip
))
1071 iterator
->destroy(iterator
);
1072 DBG2(DBG_KNL
, "virtual IP %H already added to iface %d reusing it",
1073 virtual_ip
, targetif
);
1077 iterator
->destroy(iterator
);
1079 if (manage_ipaddr(this, RTM_NEWADDR
, NLM_F_CREATE
| NLM_F_EXCL
,
1080 targetif
, virtual_ip
) == SUCCESS
)
1082 listed
= malloc_thing(vip_entry_t
);
1083 listed
->ip
= virtual_ip
->clone(virtual_ip
);
1084 listed
->if_index
= targetif
;
1085 listed
->refcount
= 1;
1086 this->vips
->insert_last(this->vips
, listed
);
1087 DBG2(DBG_KNL
, "virtual IP %H added to iface %d",
1088 virtual_ip
, targetif
);
1092 DBG2(DBG_KNL
, "unable to add virtual IP %H to iface %d",
1093 virtual_ip
, targetif
);
1098 * Implementation of kernel_interface_t.del_ip.
1100 static status_t
del_ip(private_kernel_interface_t
*this,
1101 host_t
*virtual_ip
, host_t
*iface_ip
)
1104 vip_entry_t
*listed
;
1105 iterator_t
*iterator
;
1107 DBG2(DBG_KNL
, "deleting virtual IP %H", virtual_ip
);
1109 targetif
= get_interface_index(this, iface_ip
);
1112 DBG1(DBG_KNL
, "unable to delete virtual IP %H, no iface found for %H",
1113 virtual_ip
, iface_ip
);
1117 /* beware of deadlocks (e.g. send/receive packets while holding the lock) */
1118 iterator
= this->vips
->create_iterator_locked(this->vips
, &(this->vips_mutex
));
1119 while (iterator
->iterate(iterator
, (void**)&listed
))
1121 if (listed
->if_index
== targetif
&&
1122 virtual_ip
->ip_equals(virtual_ip
, listed
->ip
))
1125 if (listed
->refcount
== 0)
1127 iterator
->remove(iterator
);
1128 vip_entry_destroy(listed
);
1129 iterator
->destroy(iterator
);
1130 return manage_ipaddr(this, RTM_DELADDR
, 0, targetif
, virtual_ip
);
1132 iterator
->destroy(iterator
);
1133 DBG2(DBG_KNL
, "virtual IP %H used by other SAs, not deleting",
1138 iterator
->destroy(iterator
);
1140 DBG2(DBG_KNL
, "virtual IP %H not cached, unable to delete", virtual_ip
);
1145 * Implementation of kernel_interface_t.get_spi.
1147 static status_t
get_spi(private_kernel_interface_t
*this,
1148 host_t
*src
, host_t
*dst
,
1149 protocol_id_t protocol
, u_int32_t reqid
,
1152 unsigned char request
[BUFFER_SIZE
];
1153 struct nlmsghdr
*hdr
, *out
;
1154 struct xfrm_userspi_info
*userspi
;
1155 u_int32_t received_spi
= 0;
1158 memset(&request
, 0, sizeof(request
));
1160 DBG2(DBG_KNL
, "getting SPI for reqid %d", reqid
);
1162 hdr
= (struct nlmsghdr
*)request
;
1163 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1164 hdr
->nlmsg_type
= XFRM_MSG_ALLOCSPI
;
1165 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userspi_info
));
1167 userspi
= (struct xfrm_userspi_info
*)NLMSG_DATA(hdr
);
1168 host2xfrm(src
, &userspi
->info
.saddr
);
1169 host2xfrm(dst
, &userspi
->info
.id
.daddr
);
1170 userspi
->info
.id
.proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1171 userspi
->info
.mode
= TRUE
; /* tunnel mode */
1172 userspi
->info
.reqid
= reqid
;
1173 userspi
->info
.family
= src
->get_family(src
);
1174 userspi
->min
= 0xc0000000;
1175 userspi
->max
= 0xcFFFFFFF;
1177 if (netlink_send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1180 while (NLMSG_OK(hdr
, len
))
1182 switch (hdr
->nlmsg_type
)
1184 case XFRM_MSG_NEWSA
:
1186 struct xfrm_usersa_info
* usersa
= NLMSG_DATA(hdr
);
1187 received_spi
= usersa
->id
.spi
;
1192 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1194 DBG1(DBG_KNL
, "allocating SPI failed: %s (%d)",
1195 strerror(-err
->error
), -err
->error
);
1199 hdr
= NLMSG_NEXT(hdr
, len
);
1209 if (received_spi
== 0)
1211 DBG1(DBG_KNL
, "unable to get SPI for reqid %d", reqid
);
1215 DBG2(DBG_KNL
, "got SPI 0x%x for reqid %d", received_spi
, reqid
);
1217 *spi
= received_spi
;
1222 * Implementation of kernel_interface_t.add_sa.
1224 static status_t
add_sa(private_kernel_interface_t
*this,
1225 host_t
*src
, host_t
*dst
, u_int32_t spi
,
1226 protocol_id_t protocol
, u_int32_t reqid
,
1227 u_int64_t expire_soft
, u_int64_t expire_hard
,
1228 algorithm_t
*enc_alg
, algorithm_t
*int_alg
,
1229 prf_plus_t
*prf_plus
, natt_conf_t
*natt
, mode_t mode
,
1232 unsigned char request
[BUFFER_SIZE
];
1235 struct nlmsghdr
*hdr
;
1236 struct xfrm_usersa_info
*sa
;
1238 memset(&request
, 0, sizeof(request
));
1240 DBG2(DBG_KNL
, "adding SAD entry with SPI 0x%x", spi
);
1242 hdr
= (struct nlmsghdr
*)request
;
1243 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1244 hdr
->nlmsg_type
= replace ? XFRM_MSG_UPDSA
: XFRM_MSG_NEWSA
;
1245 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
1247 sa
= (struct xfrm_usersa_info
*)NLMSG_DATA(hdr
);
1248 host2xfrm(src
, &sa
->saddr
);
1249 host2xfrm(dst
, &sa
->id
.daddr
);
1251 sa
->id
.proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1252 sa
->family
= src
->get_family(src
);
1254 sa
->replay_window
= 32;
1256 /* we currently do not expire SAs by volume/packet count */
1257 sa
->lft
.soft_byte_limit
= XFRM_INF
;
1258 sa
->lft
.hard_byte_limit
= XFRM_INF
;
1259 sa
->lft
.soft_packet_limit
= XFRM_INF
;
1260 sa
->lft
.hard_packet_limit
= XFRM_INF
;
1261 /* we use lifetimes since added, not since used */
1262 sa
->lft
.soft_add_expires_seconds
= expire_soft
;
1263 sa
->lft
.hard_add_expires_seconds
= expire_hard
;
1264 sa
->lft
.soft_use_expires_seconds
= 0;
1265 sa
->lft
.hard_use_expires_seconds
= 0;
1267 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_usersa_info
);
1269 if (enc_alg
->algorithm
!= ENCR_UNDEFINED
)
1271 rthdr
->rta_type
= XFRMA_ALG_CRYPT
;
1272 alg_name
= lookup_algorithm(encryption_algs
, enc_alg
, &key_size
);
1273 if (alg_name
== NULL
)
1275 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1276 encryption_algorithm_names
, enc_alg
->algorithm
);
1279 DBG2(DBG_KNL
, " using encryption algorithm %N with key size %d",
1280 encryption_algorithm_names
, enc_alg
->algorithm
, key_size
);
1282 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo
) + key_size
);
1283 hdr
->nlmsg_len
+= rthdr
->rta_len
;
1284 if (hdr
->nlmsg_len
> sizeof(request
))
1289 struct xfrm_algo
* algo
= (struct xfrm_algo
*)RTA_DATA(rthdr
);
1290 algo
->alg_key_len
= key_size
;
1291 strcpy(algo
->alg_name
, alg_name
);
1292 prf_plus
->get_bytes(prf_plus
, key_size
/ 8, algo
->alg_key
);
1294 rthdr
= XFRM_RTA_NEXT(rthdr
);
1297 if (int_alg
->algorithm
!= AUTH_UNDEFINED
)
1299 rthdr
->rta_type
= XFRMA_ALG_AUTH
;
1300 alg_name
= lookup_algorithm(integrity_algs
, int_alg
, &key_size
);
1301 if (alg_name
== NULL
)
1303 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1304 integrity_algorithm_names
, int_alg
->algorithm
);
1307 DBG2(DBG_KNL
, " using integrity algorithm %N with key size %d",
1308 integrity_algorithm_names
, int_alg
->algorithm
, key_size
);
1310 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo
) + key_size
);
1311 hdr
->nlmsg_len
+= rthdr
->rta_len
;
1312 if (hdr
->nlmsg_len
> sizeof(request
))
1317 struct xfrm_algo
* algo
= (struct xfrm_algo
*)RTA_DATA(rthdr
);
1318 algo
->alg_key_len
= key_size
;
1319 strcpy(algo
->alg_name
, alg_name
);
1320 prf_plus
->get_bytes(prf_plus
, key_size
/ 8, algo
->alg_key
);
1322 rthdr
= XFRM_RTA_NEXT(rthdr
);
1325 /* TODO: add IPComp here */
1329 rthdr
->rta_type
= XFRMA_ENCAP
;
1330 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_encap_tmpl
));
1332 hdr
->nlmsg_len
+= rthdr
->rta_len
;
1333 if (hdr
->nlmsg_len
> sizeof(request
))
1338 struct xfrm_encap_tmpl
* encap
= (struct xfrm_encap_tmpl
*)RTA_DATA(rthdr
);
1339 encap
->encap_type
= UDP_ENCAP_ESPINUDP
;
1340 encap
->encap_sport
= htons(natt
->sport
);
1341 encap
->encap_dport
= htons(natt
->dport
);
1342 memset(&encap
->encap_oa
, 0, sizeof (xfrm_address_t
));
1343 /* encap_oa could probably be derived from the
1344 * traffic selectors [rfc4306, p39]. In the netlink kernel implementation
1345 * pluto does the same as we do here but it uses encap_oa in the
1346 * pfkey implementation. BUT as /usr/src/linux/net/key/af_key.c indicates
1347 * the kernel ignores it anyway
1348 * -> does that mean that NAT-T encap doesn't work in transport mode?
1349 * No. The reason the kernel ignores NAT-OA is that it recomputes
1350 * (or, rather, just ignores) the checksum. If packets pass
1351 * the IPsec checks it marks them "checksum ok" so OA isn't needed. */
1352 rthdr
= XFRM_RTA_NEXT(rthdr
);
1355 if (netlink_send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
1357 DBG1(DBG_KNL
, "unalbe to add SAD entry with SPI 0x%x", spi
);
1364 * Implementation of kernel_interface_t.update_sa.
1366 static status_t
update_sa(private_kernel_interface_t
*this,
1367 host_t
*src
, host_t
*dst
,
1368 host_t
*new_src
, host_t
*new_dst
,
1369 host_diff_t src_changes
, host_diff_t dst_changes
,
1370 u_int32_t spi
, protocol_id_t protocol
)
1372 unsigned char request
[BUFFER_SIZE
];
1373 struct nlmsghdr
*hdr
, *out
= NULL
;
1374 struct xfrm_usersa_id
*sa_id
;
1375 struct xfrm_usersa_info
*sa
= NULL
;
1378 memset(&request
, 0, sizeof(request
));
1380 DBG2(DBG_KNL
, "querying SAD entry with SPI 0x%x", spi
);
1382 hdr
= (struct nlmsghdr
*)request
;
1383 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1384 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
1385 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
1387 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
1388 host2xfrm(dst
, &sa_id
->daddr
);
1390 sa_id
->proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1391 sa_id
->family
= dst
->get_family(dst
);
1393 if (netlink_send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1396 while (NLMSG_OK(hdr
, len
))
1398 switch (hdr
->nlmsg_type
)
1400 case XFRM_MSG_NEWSA
:
1402 sa
= NLMSG_DATA(hdr
);
1407 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1408 DBG1(DBG_KNL
, "querying SAD entry failed: %s (%d)",
1409 strerror(-err
->error
), -err
->error
);
1413 hdr
= NLMSG_NEXT(hdr
, len
);
1423 DBG1(DBG_KNL
, "unable to update SAD entry with SPI 0x%x", spi
);
1428 DBG2(DBG_KNL
, "updating SAD entry with SPI 0x%x", spi
);
1431 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1432 hdr
->nlmsg_type
= XFRM_MSG_UPDSA
;
1434 if (src_changes
& HOST_DIFF_ADDR
)
1436 host2xfrm(new_src
, &sa
->saddr
);
1439 if (dst_changes
& HOST_DIFF_ADDR
)
1441 hdr
->nlmsg_type
= XFRM_MSG_NEWSA
;
1442 host2xfrm(new_dst
, &sa
->id
.daddr
);
1445 if (src_changes
& HOST_DIFF_PORT
|| dst_changes
& HOST_DIFF_PORT
)
1447 struct rtattr
*rtattr
= XFRM_RTA(hdr
, struct xfrm_usersa_info
);
1448 size_t rtsize
= XFRM_PAYLOAD(hdr
, struct xfrm_usersa_info
);
1449 while (RTA_OK(rtattr
, rtsize
))
1451 if (rtattr
->rta_type
== XFRMA_ENCAP
)
1453 struct xfrm_encap_tmpl
* encap
;
1454 encap
= (struct xfrm_encap_tmpl
*)RTA_DATA(rtattr
);
1455 encap
->encap_sport
= ntohs(new_src
->get_port(new_src
));
1456 encap
->encap_dport
= ntohs(new_dst
->get_port(new_dst
));
1459 rtattr
= RTA_NEXT(rtattr
, rtsize
);
1462 if (netlink_send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
1464 DBG1(DBG_KNL
, "unalbe to update SAD entry with SPI 0x%x", spi
);
1470 if (dst_changes
& HOST_DIFF_ADDR
)
1472 return this->public.del_sa(&this->public, dst
, spi
, protocol
);
1478 * Implementation of kernel_interface_t.query_sa.
1480 static status_t
query_sa(private_kernel_interface_t
*this, host_t
*dst
,
1481 u_int32_t spi
, protocol_id_t protocol
,
1482 u_int32_t
*use_time
)
1484 unsigned char request
[BUFFER_SIZE
];
1485 struct nlmsghdr
*out
= NULL
, *hdr
;
1486 struct xfrm_usersa_id
*sa_id
;
1487 struct xfrm_usersa_info
*sa
= NULL
;
1490 DBG2(DBG_KNL
, "querying SAD entry with SPI 0x%x", spi
);
1491 memset(&request
, 0, sizeof(request
));
1493 hdr
= (struct nlmsghdr
*)request
;
1494 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1495 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
1496 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
1498 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
1499 host2xfrm(dst
, &sa_id
->daddr
);
1501 sa_id
->proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1502 sa_id
->family
= dst
->get_family(dst
);
1504 if (netlink_send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1507 while (NLMSG_OK(hdr
, len
))
1509 switch (hdr
->nlmsg_type
)
1511 case XFRM_MSG_NEWSA
:
1513 sa
= NLMSG_DATA(hdr
);
1518 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1519 DBG1(DBG_KNL
, "querying SAD entry failed: %s (%d)",
1520 strerror(-err
->error
), -err
->error
);
1524 hdr
= NLMSG_NEXT(hdr
, len
);
1535 DBG1(DBG_KNL
, "unable to query SAD entry with SPI 0x%x", spi
);
1540 *use_time
= sa
->curlft
.use_time
;
1546 * Implementation of kernel_interface_t.del_sa.
1548 static status_t
del_sa(private_kernel_interface_t
*this, host_t
*dst
,
1549 u_int32_t spi
, protocol_id_t protocol
)
1551 unsigned char request
[BUFFER_SIZE
];
1552 struct nlmsghdr
*hdr
;
1553 struct xfrm_usersa_id
*sa_id
;
1555 memset(&request
, 0, sizeof(request
));
1557 DBG2(DBG_KNL
, "deleting SAD entry with SPI 0x%x", spi
);
1559 hdr
= (struct nlmsghdr
*)request
;
1560 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1561 hdr
->nlmsg_type
= XFRM_MSG_DELSA
;
1562 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
1564 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
1565 host2xfrm(dst
, &sa_id
->daddr
);
1567 sa_id
->proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1568 sa_id
->family
= dst
->get_family(dst
);
1570 if (netlink_send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
1572 DBG1(DBG_KNL
, "unalbe to delete SAD entry with SPI 0x%x", spi
);
1575 DBG2(DBG_KNL
, "deleted SAD entry with SPI 0x%x", spi
);
1580 * Implementation of kernel_interface_t.add_policy.
1582 static status_t
add_policy(private_kernel_interface_t
*this,
1583 host_t
*src
, host_t
*dst
,
1584 traffic_selector_t
*src_ts
,
1585 traffic_selector_t
*dst_ts
,
1586 policy_dir_t direction
, protocol_id_t protocol
,
1587 u_int32_t reqid
, bool high_prio
, mode_t mode
,
1590 iterator_t
*iterator
;
1591 policy_entry_t
*current
, *policy
;
1593 unsigned char request
[BUFFER_SIZE
];
1594 struct xfrm_userpolicy_info
*policy_info
;
1595 struct nlmsghdr
*hdr
;
1597 /* create a policy */
1598 policy
= malloc_thing(policy_entry_t
);
1599 memset(policy
, 0, sizeof(policy_entry_t
));
1600 policy
->sel
= ts2selector(src_ts
, dst_ts
);
1601 policy
->direction
= direction
;
1603 /* find the policy, which matches EXACTLY */
1604 pthread_mutex_lock(&this->policies_mutex
);
1605 iterator
= this->policies
->create_iterator(this->policies
, TRUE
);
1606 while (iterator
->iterate(iterator
, (void**)¤t
))
1608 if (memcmp(¤t
->sel
, &policy
->sel
, sizeof(struct xfrm_selector
)) == 0 &&
1609 policy
->direction
== current
->direction
)
1611 /* use existing policy */
1614 current
->refcount
++;
1615 DBG2(DBG_KNL
, "policy %R===%R already exists, increasing ",
1616 "refcount", src_ts
, dst_ts
);
1624 iterator
->destroy(iterator
);
1626 { /* apply the new one, if we have no such policy */
1627 this->policies
->insert_last(this->policies
, policy
);
1628 policy
->refcount
= 1;
1631 DBG2(DBG_KNL
, "adding policy %R===%R", src_ts
, dst_ts
);
1633 memset(&request
, 0, sizeof(request
));
1634 hdr
= (struct nlmsghdr
*)request
;
1635 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1636 hdr
->nlmsg_type
= XFRM_MSG_UPDPOLICY
;
1637 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info
));
1639 policy_info
= (struct xfrm_userpolicy_info
*)NLMSG_DATA(hdr
);
1640 policy_info
->sel
= policy
->sel
;
1641 policy_info
->dir
= policy
->direction
;
1642 /* calculate priority based on source selector size, small size = high prio */
1643 policy_info
->priority
= high_prio ? PRIO_HIGH
: PRIO_LOW
;
1644 policy_info
->priority
-= policy
->sel
.prefixlen_s
* 10;
1645 policy_info
->priority
-= policy
->sel
.proto ?
2 : 0;
1646 policy_info
->priority
-= policy
->sel
.sport_mask ?
1 : 0;
1647 policy_info
->action
= XFRM_POLICY_ALLOW
;
1648 policy_info
->share
= XFRM_SHARE_ANY
;
1649 pthread_mutex_unlock(&this->policies_mutex
);
1651 /* policies don't expire */
1652 policy_info
->lft
.soft_byte_limit
= XFRM_INF
;
1653 policy_info
->lft
.soft_packet_limit
= XFRM_INF
;
1654 policy_info
->lft
.hard_byte_limit
= XFRM_INF
;
1655 policy_info
->lft
.hard_packet_limit
= XFRM_INF
;
1656 policy_info
->lft
.soft_add_expires_seconds
= 0;
1657 policy_info
->lft
.hard_add_expires_seconds
= 0;
1658 policy_info
->lft
.soft_use_expires_seconds
= 0;
1659 policy_info
->lft
.hard_use_expires_seconds
= 0;
1661 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_userpolicy_info
);
1662 rthdr
->rta_type
= XFRMA_TMPL
;
1664 rthdr
->rta_len
= sizeof(struct xfrm_user_tmpl
);
1665 rthdr
->rta_len
= RTA_LENGTH(rthdr
->rta_len
);
1667 hdr
->nlmsg_len
+= rthdr
->rta_len
;
1668 if (hdr
->nlmsg_len
> sizeof(request
))
1673 struct xfrm_user_tmpl
*tmpl
= (struct xfrm_user_tmpl
*)RTA_DATA(rthdr
);
1674 tmpl
->reqid
= reqid
;
1675 tmpl
->id
.proto
= (protocol
== PROTO_AH
) ? KERNEL_AH
: KERNEL_ESP
;
1676 tmpl
->aalgos
= tmpl
->ealgos
= tmpl
->calgos
= ~0;
1678 tmpl
->family
= src
->get_family(src
);
1680 host2xfrm(src
, &tmpl
->saddr
);
1681 host2xfrm(dst
, &tmpl
->id
.daddr
);
1683 if (netlink_send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
1685 DBG1(DBG_KNL
, "unable to add policy %R===%R", src_ts
, dst_ts
);
1689 /* install a route, if:
1690 * - we are NOT updating a policy
1691 * - this is a forward policy (to just get one for each child)
1692 * - we are in tunnel mode
1693 * - we are not using IPv6 (does not work correctly yet!)
1695 if (policy
->route
== NULL
&& direction
== POLICY_FWD
&&
1696 mode
!= MODE_TRANSPORT
&& src
->get_family(src
) != AF_INET6
)
1698 policy
->route
= malloc_thing(route_entry_t
);
1699 if (get_address_by_ts(this, dst_ts
, &policy
->route
->src_ip
) == SUCCESS
)
1701 policy
->route
->gateway
= dst
->clone(dst
);
1702 policy
->route
->if_index
= get_interface_index(this, dst
);
1703 policy
->route
->dst_net
= chunk_alloc(policy
->sel
.family
== AF_INET ?
4 : 16);
1704 memcpy(policy
->route
->dst_net
.ptr
, &policy
->sel
.saddr
, policy
->route
->dst_net
.len
);
1705 policy
->route
->prefixlen
= policy
->sel
.prefixlen_s
;
1707 if (manage_srcroute(this, RTM_NEWROUTE
, NLM_F_CREATE
| NLM_F_EXCL
,
1708 policy
->route
) != SUCCESS
)
1710 DBG1(DBG_KNL
, "unable to install source route for %H",
1711 policy
->route
->src_ip
);
1712 route_entry_destroy(policy
->route
);
1713 policy
->route
= NULL
;
1718 free(policy
->route
);
1719 policy
->route
= NULL
;
1727 * Implementation of kernel_interface_t.query_policy.
1729 static status_t
query_policy(private_kernel_interface_t
*this,
1730 traffic_selector_t
*src_ts
,
1731 traffic_selector_t
*dst_ts
,
1732 policy_dir_t direction
, u_int32_t
*use_time
)
1734 unsigned char request
[BUFFER_SIZE
];
1735 struct nlmsghdr
*out
= NULL
, *hdr
;
1736 struct xfrm_userpolicy_id
*policy_id
;
1737 struct xfrm_userpolicy_info
*policy
= NULL
;
1740 memset(&request
, 0, sizeof(request
));
1742 DBG2(DBG_KNL
, "querying policy %R===%R", src_ts
, dst_ts
);
1744 hdr
= (struct nlmsghdr
*)request
;
1745 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1746 hdr
->nlmsg_type
= XFRM_MSG_GETPOLICY
;
1747 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
1749 policy_id
= (struct xfrm_userpolicy_id
*)NLMSG_DATA(hdr
);
1750 policy_id
->sel
= ts2selector(src_ts
, dst_ts
);
1751 policy_id
->dir
= direction
;
1753 if (netlink_send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1756 while (NLMSG_OK(hdr
, len
))
1758 switch (hdr
->nlmsg_type
)
1760 case XFRM_MSG_NEWPOLICY
:
1762 policy
= (struct xfrm_userpolicy_info
*)NLMSG_DATA(hdr
);
1767 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1768 DBG1(DBG_KNL
, "querying policy failed: %s (%d)",
1769 strerror(-err
->error
), -err
->error
);
1773 hdr
= NLMSG_NEXT(hdr
, len
);
1784 DBG2(DBG_KNL
, "unable to query policy %R===%R", src_ts
, dst_ts
);
1788 *use_time
= (time_t)policy
->curlft
.use_time
;
1795 * Implementation of kernel_interface_t.del_policy.
1797 static status_t
del_policy(private_kernel_interface_t
*this,
1798 traffic_selector_t
*src_ts
,
1799 traffic_selector_t
*dst_ts
,
1800 policy_dir_t direction
)
1802 policy_entry_t
*current
, policy
, *to_delete
= NULL
;
1803 route_entry_t
*route
;
1804 unsigned char request
[BUFFER_SIZE
];
1805 struct nlmsghdr
*hdr
;
1806 struct xfrm_userpolicy_id
*policy_id
;
1807 iterator_t
*iterator
;
1809 DBG2(DBG_KNL
, "deleting policy %R===%R", src_ts
, dst_ts
);
1811 /* create a policy */
1812 memset(&policy
, 0, sizeof(policy_entry_t
));
1813 policy
.sel
= ts2selector(src_ts
, dst_ts
);
1814 policy
.direction
= direction
;
1816 /* find the policy */
1817 pthread_mutex_lock(&this->policies_mutex
);
1818 iterator
= this->policies
->create_iterator(this->policies
, TRUE
);
1819 while (iterator
->iterate(iterator
, (void**)¤t
))
1821 if (memcmp(¤t
->sel
, &policy
.sel
, sizeof(struct xfrm_selector
)) == 0 &&
1822 policy
.direction
== current
->direction
)
1824 to_delete
= current
;
1825 if (--to_delete
->refcount
> 0)
1827 /* is used by more SAs, keep in kernel */
1828 DBG2(DBG_KNL
, "policy still used by another CHILD_SA, not removed");
1829 iterator
->destroy(iterator
);
1830 pthread_mutex_unlock(&this->policies_mutex
);
1833 /* remove if last reference */
1834 iterator
->remove(iterator
);
1838 iterator
->destroy(iterator
);
1839 pthread_mutex_unlock(&this->policies_mutex
);
1842 DBG1(DBG_KNL
, "deleting policy %R===%R failed, not found", src_ts
, dst_ts
);
1846 memset(&request
, 0, sizeof(request
));
1848 hdr
= (struct nlmsghdr
*)request
;
1849 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1850 hdr
->nlmsg_type
= XFRM_MSG_DELPOLICY
;
1851 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
1853 policy_id
= (struct xfrm_userpolicy_id
*)NLMSG_DATA(hdr
);
1854 policy_id
->sel
= to_delete
->sel
;
1855 policy_id
->dir
= direction
;
1857 route
= to_delete
->route
;
1860 if (netlink_send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
1862 DBG1(DBG_KNL
, "unable to delete policy %R===%R", src_ts
, dst_ts
);
1868 if (manage_srcroute(this, RTM_DELROUTE
, 0, route
) != SUCCESS
)
1870 DBG1(DBG_KNL
, "error uninstalling route installed with "
1871 "policy %R===%R", src_ts
, dst_ts
);
1873 route_entry_destroy(route
);
1879 * Implementation of kernel_interface_t.destroy.
1881 static void destroy(private_kernel_interface_t
*this)
1883 pthread_cancel(this->event_thread
);
1884 pthread_join(this->event_thread
, NULL
);
1885 close(this->socket_xfrm_events
);
1886 close(this->socket_xfrm
);
1887 close(this->socket_rt
);
1888 this->vips
->destroy(this->vips
);
1889 this->policies
->destroy(this->policies
);
1894 * Described in header.
1896 kernel_interface_t
*kernel_interface_create()
1898 private_kernel_interface_t
*this = malloc_thing(private_kernel_interface_t
);
1899 struct sockaddr_nl addr
;
1901 /* public functions */
1902 this->public.get_spi
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*,protocol_id_t
,u_int32_t
,u_int32_t
*))get_spi
;
1903 this->public.add_sa
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*,u_int32_t
,protocol_id_t
,u_int32_t
,u_int64_t
,u_int64_t
,algorithm_t
*,algorithm_t
*,prf_plus_t
*,natt_conf_t
*,mode_t
,bool))add_sa
;
1904 this->public.update_sa
= (status_t(*)(kernel_interface_t
*,host_t
*,u_int32_t
,protocol_id_t
,host_t
*,host_t
*,host_diff_t
,host_diff_t
))update_sa
;
1905 this->public.query_sa
= (status_t(*)(kernel_interface_t
*,host_t
*,u_int32_t
,protocol_id_t
,u_int32_t
*))query_sa
;
1906 this->public.del_sa
= (status_t(*)(kernel_interface_t
*,host_t
*,u_int32_t
,protocol_id_t
))del_sa
;
1907 this->public.add_policy
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*,traffic_selector_t
*,traffic_selector_t
*,policy_dir_t
,protocol_id_t
,u_int32_t
,bool,mode_t
,bool))add_policy
;
1908 this->public.query_policy
= (status_t(*)(kernel_interface_t
*,traffic_selector_t
*,traffic_selector_t
*,policy_dir_t
,u_int32_t
*))query_policy
;
1909 this->public.del_policy
= (status_t(*)(kernel_interface_t
*,traffic_selector_t
*,traffic_selector_t
*,policy_dir_t
))del_policy
;
1911 this->public.get_interface
= (char*(*)(kernel_interface_t
*,host_t
*))get_interface_name
;
1912 this->public.create_address_list
= (linked_list_t
*(*)(kernel_interface_t
*))create_address_list_public
;
1913 this->public.add_ip
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*)) add_ip
;
1914 this->public.del_ip
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*)) del_ip
;
1915 this->public.destroy
= (void(*)(kernel_interface_t
*)) destroy
;
1917 /* private members */
1918 this->vips
= linked_list_create();
1919 this->policies
= linked_list_create();
1920 pthread_mutex_init(&this->policies_mutex
,NULL
);
1921 pthread_mutex_init(&this->vips_mutex
,NULL
);
1923 addr
.nl_family
= AF_NETLINK
;
1927 /* create and bind XFRM socket */
1928 this->socket_xfrm
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_XFRM
);
1929 if (this->socket_xfrm
<= 0)
1931 charon
->kill(charon
, "unable to create XFRM netlink socket");
1934 if (bind(this->socket_xfrm
, (struct sockaddr
*)&addr
, sizeof(addr
)))
1936 charon
->kill(charon
, "unable to bind XFRM netlink socket");
1939 /* create and bind RT socket */
1940 this->socket_rt
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_ROUTE
);
1941 if (this->socket_rt
<= 0)
1943 charon
->kill(charon
, "unable to create RT netlink socket");
1946 if (bind(this->socket_rt
, (struct sockaddr
*)&addr
, sizeof(addr
)))
1948 charon
->kill(charon
, "unable to bind RT netlink socket");
1951 /* create and bind XFRM socket for ACQUIRE & EXPIRE */
1952 addr
.nl_groups
= XFRMGRP_ACQUIRE
| XFRMGRP_EXPIRE
;
1953 this->socket_xfrm_events
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_XFRM
);
1954 if (this->socket_xfrm_events
<= 0)
1956 charon
->kill(charon
, "unable to create XFRM event socket");
1959 if (bind(this->socket_xfrm_events
, (struct sockaddr
*)&addr
, sizeof(addr
)))
1961 charon
->kill(charon
, "unable to bind XFRM event socket");
1964 /* create a thread receiving ACQUIRE & EXPIRE events */
1965 if (pthread_create(&this->event_thread
, NULL
,
1966 (void*(*)(void*))receive_events
, this))
1968 charon
->kill(charon
, "unable to create xfrm event dispatcher thread");
1971 return &this->public;
1974 /* vim: set ts=4 sw=4 noet: */