2 * @file kernel_interface.c
4 * @brief Implementation of kernel_interface_t.
9 * Copyright (C) 2005-2007 Martin Willi
10 * Copyright (C) 2006-2007 Tobias Brunner
11 * Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
12 * Copyright (C) 2006 Daniel Roethlisberger
13 * Copyright (C) 2005 Jan Hutter
14 * Hochschule fuer Technik Rapperswil
15 * Copyright (C) 2003 Herbert Xu.
17 * Based on xfrm code from pluto.
19 * This program is free software; you can redistribute it and/or modify it
20 * under the terms of the GNU General Public License as published by the
21 * Free Software Foundation; either version 2 of the License, or (at your
22 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
24 * This program is distributed in the hope that it will be useful, but
25 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
26 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
30 #include <sys/types.h>
31 #include <sys/socket.h>
32 #include <linux/netlink.h>
33 #include <linux/rtnetlink.h>
34 #include <linux/xfrm.h>
35 #include <linux/udp.h>
42 #include <sys/ioctl.h>
44 #include "kernel_interface.h"
47 #include <utils/linked_list.h>
48 #include <processing/jobs/delete_child_sa_job.h>
49 #include <processing/jobs/rekey_child_sa_job.h>
50 #include <processing/jobs/acquire_job.h>
51 #include <processing/jobs/callback_job.h>
52 #include <processing/jobs/roam_job.h>
54 /** routing table for routes installed by us */
55 #ifndef IPSEC_ROUTING_TABLE
56 #define IPSEC_ROUTING_TABLE 100
58 #ifndef IPSEC_ROUTING_TABLE_PRIO
59 #define IPSEC_ROUTING_TABLE_PRIO 100
62 /** kernel level protocol identifiers */
66 /** default priority of installed policies */
68 #define PRIO_HIGH 2000
70 #define BUFFER_SIZE 1024
73 * returns a pointer to the first rtattr following the nlmsghdr *nlh and the
74 * 'usual' netlink data x like 'struct xfrm_usersa_info'
76 #define XFRM_RTA(nlh, x) ((struct rtattr*)(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(x))))
78 * returns a pointer to the next rtattr following rta.
79 * !!! do not use this to parse messages. use RTA_NEXT and RTA_OK instead !!!
81 #define XFRM_RTA_NEXT(rta) ((struct rtattr*)(((char*)(rta)) + RTA_ALIGN((rta)->rta_len)))
83 * returns the total size of attached rta data
84 * (after 'usual' netlink data x like 'struct xfrm_usersa_info')
86 #define XFRM_PAYLOAD(nlh, x) NLMSG_PAYLOAD(nlh, sizeof(x))
88 typedef struct kernel_algorithm_t kernel_algorithm_t
;
91 * Mapping from the algorithms defined in IKEv2 to
92 * kernel level algorithm names and their key length
94 struct kernel_algorithm_t
{
96 * Identifier specified in IKEv2
101 * Name of the algorithm, as used as kernel identifier
106 * Key length in bits, if fixed size
110 #define END_OF_LIST -1
113 * Algorithms for encryption
115 kernel_algorithm_t encryption_algs
[] = {
116 /* {ENCR_DES_IV64, "***", 0}, */
117 {ENCR_DES
, "des", 64},
118 {ENCR_3DES
, "des3_ede", 192},
119 /* {ENCR_RC5, "***", 0}, */
120 /* {ENCR_IDEA, "***", 0}, */
121 {ENCR_CAST
, "cast128", 0},
122 {ENCR_BLOWFISH
, "blowfish", 0},
123 /* {ENCR_3IDEA, "***", 0}, */
124 /* {ENCR_DES_IV32, "***", 0}, */
125 {ENCR_NULL
, "cipher_null", 0},
126 {ENCR_AES_CBC
, "aes", 0},
127 /* {ENCR_AES_CTR, "***", 0}, */
128 {END_OF_LIST
, NULL
, 0},
132 * Algorithms for integrity protection
134 kernel_algorithm_t integrity_algs
[] = {
135 {AUTH_HMAC_MD5_96
, "md5", 128},
136 {AUTH_HMAC_SHA1_96
, "sha1", 160},
137 {AUTH_HMAC_SHA2_256_128
, "sha256", 256},
138 {AUTH_HMAC_SHA2_384_192
, "sha384", 384},
139 {AUTH_HMAC_SHA2_512_256
, "sha512", 512},
140 /* {AUTH_DES_MAC, "***", 0}, */
141 /* {AUTH_KPDK_MD5, "***", 0}, */
142 {AUTH_AES_XCBC_96
, "xcbc(aes)", 128},
143 {END_OF_LIST
, NULL
, 0},
147 * Look up a kernel algorithm name and its key size
149 char* lookup_algorithm(kernel_algorithm_t
*kernel_algo
,
150 algorithm_t
*ikev2_algo
, u_int
*key_size
)
152 while (kernel_algo
->ikev2_id
!= END_OF_LIST
)
154 if (ikev2_algo
->algorithm
== kernel_algo
->ikev2_id
)
156 /* match, evaluate key length */
157 if (ikev2_algo
->key_size
)
158 { /* variable length */
159 *key_size
= ikev2_algo
->key_size
;
163 *key_size
= kernel_algo
->key_size
;
165 return kernel_algo
->name
;
172 typedef struct route_entry_t route_entry_t
;
175 * installed routing entry
177 struct route_entry_t
{
179 /** Index of the interface the route is bound to */
182 /** Source ip of the route */
185 /** gateway for this route */
188 /** Destination net */
191 /** Destination net prefixlen */
196 * destroy an route_entry_t object
198 static void route_entry_destroy(route_entry_t
*this)
200 this->src_ip
->destroy(this->src_ip
);
201 this->gateway
->destroy(this->gateway
);
202 chunk_free(&this->dst_net
);
206 typedef struct policy_entry_t policy_entry_t
;
209 * installed kernel policy.
211 struct policy_entry_t
{
213 /** direction of this policy: in, out, forward */
216 /** reqid of the policy */
219 /** parameters of installed policy */
220 struct xfrm_selector sel
;
222 /** associated route installed for this policy */
223 route_entry_t
*route
;
225 /** by how many CHILD_SA's this policy is used */
229 typedef struct addr_entry_t addr_entry_t
;
232 * IP address in an inface_entry_t
234 struct addr_entry_t
{
236 /** The ip address */
239 /** virtual IP managed by us */
242 /** scope of the address */
245 /** Number of times this IP is used, if virtual */
250 * destroy a addr_entry_t object
252 static void addr_entry_destroy(addr_entry_t
*this)
254 this->ip
->destroy(this->ip
);
258 typedef struct iface_entry_t iface_entry_t
;
261 * A network interface on this system, containing addr_entry_t's
263 struct iface_entry_t
{
265 /** interface index */
268 /** name of the interface */
269 char ifname
[IFNAMSIZ
];
271 /** interface flags, as in netdevice(7) SIOCGIFFLAGS */
274 /** list of addresses as host_t */
275 linked_list_t
*addrs
;
279 * destroy an interface entry
281 static void iface_entry_destroy(iface_entry_t
*this)
283 this->addrs
->destroy_function(this->addrs
, (void*)addr_entry_destroy
);
287 typedef struct private_kernel_interface_t private_kernel_interface_t
;
290 * Private variables and functions of kernel_interface class.
292 struct private_kernel_interface_t
{
294 * Public part of the kernel_interface_t object.
296 kernel_interface_t
public;
299 * mutex to lock access to the various lists
301 pthread_mutex_t mutex
;
304 * List of installed policies (policy_entry_t)
306 linked_list_t
*policies
;
309 * Cached list of interfaces and its adresses (iface_entry_t)
311 linked_list_t
*ifaces
;
314 * iterator used in hook()
319 * job receiving netlink events
324 * current sequence number for netlink request
329 * Netlink xfrm socket (IPsec)
334 * netlink xfrm socket to receive acquire and expire events
336 int socket_xfrm_events
;
339 * Netlink rt socket (routing)
344 * Netlink rt socket to receive address change events
346 int socket_rt_events
;
350 * convert a host_t to a struct xfrm_address
352 static void host2xfrm(host_t
*host
, xfrm_address_t
*xfrm
)
354 chunk_t chunk
= host
->get_address(host
);
355 memcpy(xfrm
, chunk
.ptr
, min(chunk
.len
, sizeof(xfrm_address_t
)));
359 * convert a traffic selector address range to subnet and its mask.
361 static void ts2subnet(traffic_selector_t
* ts
,
362 xfrm_address_t
*net
, u_int8_t
*mask
)
364 /* there is no way to do this cleanly, as the address range may
365 * be anything else but a subnet. We use from_addr as subnet
366 * and try to calculate a usable subnet mask.
371 size_t size
= (ts
->get_type(ts
) == TS_IPV4_ADDR_RANGE
) ?
4 : 16;
373 from
= ts
->get_from_address(ts
);
374 to
= ts
->get_to_address(ts
);
377 /* go trough all bits of the addresses, beginning in the front.
378 * as long as they are equal, the subnet gets larger
380 for (byte
= 0; byte
< size
; byte
++)
382 for (bit
= 7; bit
>= 0; bit
--)
384 if ((1<<bit
& from
.ptr
[byte
]) != (1<<bit
& to
.ptr
[byte
]))
386 *mask
= ((7 - bit
) + (byte
* 8));
396 memcpy(net
, from
.ptr
, from
.len
);
402 * convert a traffic selector port range to port/portmask
404 static void ts2ports(traffic_selector_t
* ts
,
405 u_int16_t
*port
, u_int16_t
*mask
)
407 /* linux does not seem to accept complex portmasks. Only
408 * any or a specific port is allowed. We set to any, if we have
409 * a port range, or to a specific, if we have one port only.
413 from
= ts
->get_from_port(ts
);
414 to
= ts
->get_to_port(ts
);
429 * convert a pair of traffic_selectors to a xfrm_selector
431 static struct xfrm_selector
ts2selector(traffic_selector_t
*src
,
432 traffic_selector_t
*dst
)
434 struct xfrm_selector sel
;
436 memset(&sel
, 0, sizeof(sel
));
437 sel
.family
= src
->get_type(src
) == TS_IPV4_ADDR_RANGE ? AF_INET
: AF_INET6
;
438 /* src or dest proto may be "any" (0), use more restrictive one */
439 sel
.proto
= max(src
->get_protocol(src
), dst
->get_protocol(dst
));
440 ts2subnet(dst
, &sel
.daddr
, &sel
.prefixlen_d
);
441 ts2subnet(src
, &sel
.saddr
, &sel
.prefixlen_s
);
442 ts2ports(dst
, &sel
.dport
, &sel
.dport_mask
);
443 ts2ports(src
, &sel
.sport
, &sel
.sport_mask
);
451 * Creates an rtattr and adds it to the netlink message
453 static void add_attribute(struct nlmsghdr
*hdr
, int rta_type
, chunk_t data
,
458 if (NLMSG_ALIGN(hdr
->nlmsg_len
) + RTA_ALIGN(data
.len
) > buflen
)
460 DBG1(DBG_KNL
, "unable to add attribute, buffer too small");
464 rta
= (struct rtattr
*)(((char*)hdr
) + NLMSG_ALIGN(hdr
->nlmsg_len
));
465 rta
->rta_type
= rta_type
;
466 rta
->rta_len
= RTA_LENGTH(data
.len
);
467 memcpy(RTA_DATA(rta
), data
.ptr
, data
.len
);
468 hdr
->nlmsg_len
= NLMSG_ALIGN(hdr
->nlmsg_len
) + rta
->rta_len
;
472 * process a XFRM_MSG_ACQUIRE from kernel
474 static void process_acquire(private_kernel_interface_t
*this, struct nlmsghdr
*hdr
)
478 struct rtattr
*rtattr
= XFRM_RTA(hdr
, struct xfrm_user_acquire
);
479 size_t rtsize
= XFRM_PAYLOAD(hdr
, struct xfrm_user_tmpl
);
481 if (RTA_OK(rtattr
, rtsize
))
483 if (rtattr
->rta_type
== XFRMA_TMPL
)
485 struct xfrm_user_tmpl
* tmpl
= (struct xfrm_user_tmpl
*)RTA_DATA(rtattr
);
491 DBG1(DBG_KNL
, "received a XFRM_MSG_ACQUIRE, but no reqid found");
494 DBG2(DBG_KNL
, "received a XFRM_MSG_ACQUIRE");
495 DBG1(DBG_KNL
, "creating acquire job for CHILD_SA with reqid %d", reqid
);
496 job
= (job_t
*)acquire_job_create(reqid
);
497 charon
->processor
->queue_job(charon
->processor
, job
);
501 * process a XFRM_MSG_EXPIRE from kernel
503 static void process_expire(private_kernel_interface_t
*this, struct nlmsghdr
*hdr
)
506 protocol_id_t protocol
;
507 u_int32_t spi
, reqid
;
508 struct xfrm_user_expire
*expire
;
510 expire
= (struct xfrm_user_expire
*)NLMSG_DATA(hdr
);
511 protocol
= expire
->state
.id
.proto
== KERNEL_ESP ? PROTO_ESP
: PROTO_AH
;
512 spi
= expire
->state
.id
.spi
;
513 reqid
= expire
->state
.reqid
;
515 DBG2(DBG_KNL
, "received a XFRM_MSG_EXPIRE");
516 DBG1(DBG_KNL
, "creating %s job for %N CHILD_SA 0x%x (reqid %d)",
517 expire
->hard ?
"delete" : "rekey", protocol_id_names
,
518 protocol
, ntohl(spi
), reqid
);
521 job
= (job_t
*)delete_child_sa_job_create(reqid
, protocol
, spi
);
525 job
= (job_t
*)rekey_child_sa_job_create(reqid
, protocol
, spi
);
527 charon
->processor
->queue_job(charon
->processor
, job
);
531 * process RTM_NEWLINK/RTM_DELLINK from kernel
533 static void process_link(private_kernel_interface_t
*this,
534 struct nlmsghdr
*hdr
, bool event
)
536 struct ifinfomsg
* msg
= (struct ifinfomsg
*)(NLMSG_DATA(hdr
));
537 struct rtattr
*rta
= IFLA_RTA(msg
);
538 size_t rtasize
= IFLA_PAYLOAD (hdr
);
539 iterator_t
*iterator
;
540 iface_entry_t
*current
, *entry
= NULL
;
544 while(RTA_OK(rta
, rtasize
))
546 switch (rta
->rta_type
)
549 name
= RTA_DATA(rta
);
552 rta
= RTA_NEXT(rta
, rtasize
);
559 switch (hdr
->nlmsg_type
)
563 if (msg
->ifi_flags
& IFF_LOOPBACK
)
564 { /* ignore loopback interfaces */
567 iterator
= this->ifaces
->create_iterator_locked(this->ifaces
,
569 while (iterator
->iterate(iterator
, (void**)¤t
))
571 if (current
->ifindex
== msg
->ifi_index
)
579 entry
= malloc_thing(iface_entry_t
);
580 entry
->ifindex
= msg
->ifi_index
;
582 entry
->addrs
= linked_list_create();
583 this->ifaces
->insert_last(this->ifaces
, entry
);
585 memcpy(entry
->ifname
, name
, IFNAMSIZ
);
586 entry
->ifname
[IFNAMSIZ
-1] = '\0';
589 if (!(entry
->flags
& IFF_UP
) && (msg
->ifi_flags
& IFF_UP
))
592 DBG1(DBG_KNL
, "interface %s activated", name
);
594 if ((entry
->flags
& IFF_UP
) && !(msg
->ifi_flags
& IFF_UP
))
597 DBG1(DBG_KNL
, "interface %s deactivated", name
);
600 entry
->flags
= msg
->ifi_flags
;
601 iterator
->destroy(iterator
);
606 iterator
= this->ifaces
->create_iterator_locked(this->ifaces
,
608 while (iterator
->iterate(iterator
, (void**)¤t
))
610 if (current
->ifindex
== msg
->ifi_index
)
612 /* we do not remove it, as an address may be added to a
613 * "down" interface and we wan't to know that. */
614 current
->flags
= msg
->ifi_flags
;
618 iterator
->destroy(iterator
);
623 /* send an update to all IKE_SAs */
626 charon
->processor
->queue_job(charon
->processor
,
627 (job_t
*)roam_job_create(TRUE
));
632 * process RTM_NEWADDR/RTM_DELADDR from kernel
634 static void process_addr(private_kernel_interface_t
*this,
635 struct nlmsghdr
*hdr
, bool event
)
637 struct ifaddrmsg
* msg
= (struct ifaddrmsg
*)(NLMSG_DATA(hdr
));
638 struct rtattr
*rta
= IFA_RTA(msg
);
639 size_t rtasize
= IFA_PAYLOAD (hdr
);
641 iterator_t
*ifaces
, *addrs
;
642 iface_entry_t
*iface
;
644 chunk_t local
= chunk_empty
, address
= chunk_empty
;
645 bool update
= FALSE
, found
= FALSE
, changed
= FALSE
;
647 while(RTA_OK(rta
, rtasize
))
649 switch (rta
->rta_type
)
652 local
.ptr
= RTA_DATA(rta
);
653 local
.len
= RTA_PAYLOAD(rta
);
656 address
.ptr
= RTA_DATA(rta
);
657 address
.len
= RTA_PAYLOAD(rta
);
660 rta
= RTA_NEXT(rta
, rtasize
);
663 /* For PPP interfaces, we need the IFA_LOCAL address,
664 * IFA_ADDRESS is the peers address. But IFA_LOCAL is
665 * not included in all cases (IPv6?), so fallback to IFA_ADDRESS. */
668 host
= host_create_from_chunk(msg
->ifa_family
, local
, 0);
670 else if (address
.ptr
)
672 host
= host_create_from_chunk(msg
->ifa_family
, address
, 0);
680 ifaces
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
681 while (ifaces
->iterate(ifaces
, (void**)&iface
))
683 if (iface
->ifindex
== msg
->ifa_index
)
685 addrs
= iface
->addrs
->create_iterator(iface
->addrs
, TRUE
);
686 while (addrs
->iterate(addrs
, (void**)&addr
))
688 if (host
->ip_equals(host
, addr
->ip
))
691 if (hdr
->nlmsg_type
== RTM_DELADDR
)
694 addrs
->remove(addrs
);
695 addr_entry_destroy(addr
);
696 DBG1(DBG_KNL
, "%H disappeared from %s", host
, iface
->ifname
);
700 addrs
->destroy(addrs
);
702 if (hdr
->nlmsg_type
== RTM_NEWADDR
)
708 addr
= malloc_thing(addr_entry_t
);
709 addr
->ip
= host
->clone(host
);
710 addr
->virtual = FALSE
;
712 addr
->scope
= msg
->ifa_scope
;
714 iface
->addrs
->insert_last(iface
->addrs
, addr
);
717 DBG1(DBG_KNL
, "%H appeared on %s", host
, iface
->ifname
);
721 if (found
&& (iface
->flags
& IFF_UP
))
728 ifaces
->destroy(ifaces
);
731 /* send an update to all IKE_SAs */
732 if (update
&& event
&& changed
)
734 charon
->processor
->queue_job(charon
->processor
,
735 (job_t
*)roam_job_create(TRUE
));
740 * Receives events from kernel
742 static job_requeue_t
receive_events(private_kernel_interface_t
*this)
745 struct nlmsghdr
*hdr
= (struct nlmsghdr
*)response
;
746 struct sockaddr_nl addr
;
747 socklen_t addr_len
= sizeof(addr
);
748 int len
, oldstate
, maxfd
, selected
;
752 FD_SET(this->socket_xfrm_events
, &rfds
);
753 FD_SET(this->socket_rt_events
, &rfds
);
754 maxfd
= max(this->socket_xfrm_events
, this->socket_rt_events
);
756 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE
, &oldstate
);
757 selected
= select(maxfd
+ 1, &rfds
, NULL
, NULL
, NULL
);
758 pthread_setcancelstate(oldstate
, NULL
);
761 DBG1(DBG_KNL
, "selecting on sockets failed: %s", strerror(errno
));
762 return JOB_REQUEUE_FAIR
;
764 if (FD_ISSET(this->socket_xfrm_events
, &rfds
))
766 selected
= this->socket_xfrm_events
;
768 else if (FD_ISSET(this->socket_rt_events
, &rfds
))
770 selected
= this->socket_rt_events
;
774 return JOB_REQUEUE_DIRECT
;
777 len
= recvfrom(selected
, response
, sizeof(response
), MSG_DONTWAIT
,
778 (struct sockaddr
*)&addr
, &addr_len
);
784 /* interrupted, try again */
785 return JOB_REQUEUE_DIRECT
;
787 /* no data ready, select again */
788 return JOB_REQUEUE_DIRECT
;
790 DBG1(DBG_KNL
, "unable to receive from xfrm event socket");
792 return JOB_REQUEUE_FAIR
;
795 if (addr
.nl_pid
!= 0)
796 { /* not from kernel. not interested, try another one */
797 return JOB_REQUEUE_DIRECT
;
800 while (NLMSG_OK(hdr
, len
))
802 /* looks good so far, dispatch netlink message */
803 if (selected
== this->socket_xfrm_events
)
805 switch (hdr
->nlmsg_type
)
807 case XFRM_MSG_ACQUIRE
:
808 process_acquire(this, hdr
);
810 case XFRM_MSG_EXPIRE
:
811 process_expire(this, hdr
);
817 else if (selected
== this->socket_rt_events
)
819 switch (hdr
->nlmsg_type
)
823 process_addr(this, hdr
, TRUE
);
827 process_link(this, hdr
, TRUE
);
831 charon
->processor
->queue_job(charon
->processor
,
832 (job_t
*)roam_job_create(FALSE
));
838 hdr
= NLMSG_NEXT(hdr
, len
);
840 return JOB_REQUEUE_DIRECT
;
844 * send a netlink message and wait for a reply
846 static status_t
netlink_send(private_kernel_interface_t
*this,
847 int socket
, struct nlmsghdr
*in
,
848 struct nlmsghdr
**out
, size_t *out_len
)
851 struct sockaddr_nl addr
;
852 chunk_t result
= chunk_empty
, tmp
;
853 struct nlmsghdr
*msg
, peek
;
855 pthread_mutex_lock(&this->mutex
);
857 in
->nlmsg_seq
= ++this->seq
;
858 in
->nlmsg_pid
= getpid();
860 memset(&addr
, 0, sizeof(addr
));
861 addr
.nl_family
= AF_NETLINK
;
867 len
= sendto(socket
, in
, in
->nlmsg_len
, 0,
868 (struct sockaddr
*)&addr
, sizeof(addr
));
870 if (len
!= in
->nlmsg_len
)
874 /* interrupted, try again */
877 pthread_mutex_unlock(&this->mutex
);
878 DBG1(DBG_KNL
, "error sending to netlink socket: %s", strerror(errno
));
887 tmp
.len
= sizeof(buf
);
889 msg
= (struct nlmsghdr
*)tmp
.ptr
;
891 memset(&addr
, 0, sizeof(addr
));
892 addr
.nl_family
= AF_NETLINK
;
893 addr
.nl_pid
= getpid();
895 addr_len
= sizeof(addr
);
897 len
= recvfrom(socket
, tmp
.ptr
, tmp
.len
, 0,
898 (struct sockaddr
*)&addr
, &addr_len
);
904 DBG1(DBG_KNL
, "got interrupted");
905 /* interrupted, try again */
908 DBG1(DBG_KNL
, "error reading from netlink socket: %s", strerror(errno
));
909 pthread_mutex_unlock(&this->mutex
);
912 if (!NLMSG_OK(msg
, len
))
914 DBG1(DBG_KNL
, "received corrupted netlink message");
915 pthread_mutex_unlock(&this->mutex
);
918 if (msg
->nlmsg_seq
!= this->seq
)
920 DBG1(DBG_KNL
, "received invalid netlink sequence number");
921 if (msg
->nlmsg_seq
< this->seq
)
925 pthread_mutex_unlock(&this->mutex
);
930 result
= chunk_cata("cc", result
, tmp
);
932 /* NLM_F_MULTI flag does not seem to be set correctly, we use sequence
933 * numbers to detect multi header messages */
934 len
= recvfrom(socket
, &peek
, sizeof(peek
), MSG_PEEK
| MSG_DONTWAIT
,
935 (struct sockaddr
*)&addr
, &addr_len
);
937 if (len
== sizeof(peek
) && peek
.nlmsg_seq
== this->seq
)
939 /* seems to be multipart */
945 *out_len
= result
.len
;
946 *out
= (struct nlmsghdr
*)clalloc(result
.ptr
, result
.len
);
948 pthread_mutex_unlock(&this->mutex
);
954 * send a netlink message and wait for its acknowlegde
956 static status_t
netlink_send_ack(private_kernel_interface_t
*this,
957 int socket
, struct nlmsghdr
*in
)
959 struct nlmsghdr
*out
, *hdr
;
962 if (netlink_send(this, socket
, in
, &out
, &len
) != SUCCESS
)
967 while (NLMSG_OK(hdr
, len
))
969 switch (hdr
->nlmsg_type
)
973 struct nlmsgerr
* err
= (struct nlmsgerr
*)NLMSG_DATA(hdr
);
977 DBG1(DBG_KNL
, "received netlink error: %s (%d)",
978 strerror(-err
->error
), -err
->error
);
986 hdr
= NLMSG_NEXT(hdr
, len
);
993 DBG1(DBG_KNL
, "netlink request not acknowlegded");
999 * Initialize a list of local addresses.
1001 static status_t
init_address_list(private_kernel_interface_t
*this)
1003 char request
[BUFFER_SIZE
];
1004 struct nlmsghdr
*out
, *current
, *in
;
1005 struct rtgenmsg
*msg
;
1007 iterator_t
*ifaces
, *addrs
;
1008 iface_entry_t
*iface
;
1011 DBG1(DBG_KNL
, "listening on interfaces:");
1013 memset(&request
, 0, sizeof(request
));
1015 in
= (struct nlmsghdr
*)&request
;
1016 in
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct rtgenmsg
));
1017 in
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_MATCH
| NLM_F_ROOT
;
1018 msg
= (struct rtgenmsg
*)NLMSG_DATA(in
);
1019 msg
->rtgen_family
= AF_UNSPEC
;
1022 in
->nlmsg_type
= RTM_GETLINK
;
1023 if (netlink_send(this, this->socket_rt
, in
, &out
, &len
) != SUCCESS
)
1028 while (NLMSG_OK(current
, len
))
1030 switch (current
->nlmsg_type
)
1035 process_link(this, current
, FALSE
);
1038 current
= NLMSG_NEXT(current
, len
);
1045 /* get all interface addresses */
1046 in
->nlmsg_type
= RTM_GETADDR
;
1047 if (netlink_send(this, this->socket_rt
, in
, &out
, &len
) != SUCCESS
)
1052 while (NLMSG_OK(current
, len
))
1054 switch (current
->nlmsg_type
)
1059 process_addr(this, current
, FALSE
);
1062 current
= NLMSG_NEXT(current
, len
);
1069 ifaces
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
1070 while (ifaces
->iterate(ifaces
, (void**)&iface
))
1072 if (iface
->flags
& IFF_UP
)
1074 DBG1(DBG_KNL
, " %s", iface
->ifname
);
1075 addrs
= iface
->addrs
->create_iterator(iface
->addrs
, TRUE
);
1076 while (addrs
->iterate(addrs
, (void**)&addr
))
1078 DBG1(DBG_KNL
, " %H", addr
->ip
);
1080 addrs
->destroy(addrs
);
1083 ifaces
->destroy(ifaces
);
1088 * iterator hook to iterate over addrs
1090 static hook_result_t
addr_hook(private_kernel_interface_t
*this,
1091 addr_entry_t
*in
, host_t
**out
)
1094 { /* skip virtual interfaces added by us */
1097 if (in
->scope
>= RT_SCOPE_LINK
)
1098 { /* skip addresses with a unusable scope */
1106 * iterator hook to iterate over ifaces
1108 static hook_result_t
iface_hook(private_kernel_interface_t
*this,
1109 iface_entry_t
*in
, host_t
**out
)
1111 if (!(in
->flags
& IFF_UP
))
1112 { /* skip interfaces not up */
1116 if (this->hiter
== NULL
)
1118 this->hiter
= in
->addrs
->create_iterator(in
->addrs
, TRUE
);
1119 this->hiter
->set_iterator_hook(this->hiter
,
1120 (iterator_hook_t
*)addr_hook
, this);
1122 while (this->hiter
->iterate(this->hiter
, (void**)out
))
1126 this->hiter
->destroy(this->hiter
);
1132 * Implements kernel_interface_t.create_address_iterator.
1134 static iterator_t
*create_address_iterator(private_kernel_interface_t
*this)
1136 iterator_t
*iterator
;
1138 /* This iterator is not only hooked, is is double-hooked. As we have stored
1139 * our addresses in iface_entry->addr_entry->ip, we need to iterate the
1140 * entries in each interface we iterate. This does the iface_hook. The
1141 * addr_hook returns the ip instead of the addr_entry. */
1143 iterator
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
1144 iterator
->set_iterator_hook(iterator
, (iterator_hook_t
*)iface_hook
, this);
1149 * implementation of kernel_interface_t.get_interface_name
1151 static char *get_interface_name(private_kernel_interface_t
*this, host_t
* ip
)
1153 iterator_t
*ifaces
, *addrs
;
1154 iface_entry_t
*iface
;
1158 DBG2(DBG_KNL
, "getting interface name for %H", ip
);
1160 ifaces
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
1161 while (ifaces
->iterate(ifaces
, (void**)&iface
))
1163 addrs
= iface
->addrs
->create_iterator(iface
->addrs
, TRUE
);
1164 while (addrs
->iterate(addrs
, (void**)&addr
))
1166 if (ip
->ip_equals(ip
, addr
->ip
))
1168 name
= strdup(iface
->ifname
);
1172 addrs
->destroy(addrs
);
1178 ifaces
->destroy(ifaces
);
1182 DBG2(DBG_KNL
, "%H is on interface %s", ip
, name
);
1186 DBG2(DBG_KNL
, "%H is not a local address", ip
);
1192 * Tries to find an ip address of a local interface that is included in the
1193 * supplied traffic selector.
1195 static status_t
get_address_by_ts(private_kernel_interface_t
*this,
1196 traffic_selector_t
*ts
, host_t
**ip
)
1198 iterator_t
*ifaces
, *addrs
;
1199 iface_entry_t
*iface
;
1205 DBG2(DBG_KNL
, "getting a local address in traffic selector %R", ts
);
1207 /* if we have a family which includes localhost, we do not
1208 * search for an IP, we use the default */
1209 family
= ts
->get_type(ts
) == TS_IPV4_ADDR_RANGE ? AF_INET
: AF_INET6
;
1211 if (family
== AF_INET
)
1213 host
= host_create_from_string("127.0.0.1", 0);
1217 host
= host_create_from_string("::1", 0);
1220 if (ts
->includes(ts
, host
))
1222 *ip
= host_create_any(family
);
1223 host
->destroy(host
);
1224 DBG2(DBG_KNL
, "using host %H", *ip
);
1227 host
->destroy(host
);
1229 ifaces
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
1230 while (ifaces
->iterate(ifaces
, (void**)&iface
))
1232 addrs
= iface
->addrs
->create_iterator(iface
->addrs
, TRUE
);
1233 while (addrs
->iterate(addrs
, (void**)&addr
))
1235 if (ts
->includes(ts
, addr
->ip
))
1238 *ip
= addr
->ip
->clone(addr
->ip
);
1242 addrs
->destroy(addrs
);
1248 ifaces
->destroy(ifaces
);
1252 DBG1(DBG_KNL
, "no local address found in traffic selector %R", ts
);
1255 DBG2(DBG_KNL
, "using host %H", *ip
);
1260 * get the interface of a local address
1262 static int get_interface_index(private_kernel_interface_t
*this, host_t
* ip
)
1264 iterator_t
*ifaces
, *addrs
;
1265 iface_entry_t
*iface
;
1269 DBG2(DBG_KNL
, "getting iface for %H", ip
);
1271 ifaces
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
1272 while (ifaces
->iterate(ifaces
, (void**)&iface
))
1274 addrs
= iface
->addrs
->create_iterator(iface
->addrs
, TRUE
);
1275 while (addrs
->iterate(addrs
, (void**)&addr
))
1277 if (ip
->ip_equals(ip
, addr
->ip
))
1279 ifindex
= iface
->ifindex
;
1283 addrs
->destroy(addrs
);
1289 ifaces
->destroy(ifaces
);
1293 DBG1(DBG_KNL
, "unable to get interface for %H", ip
);
1299 * Manages the creation and deletion of ip addresses on an interface.
1300 * By setting the appropriate nlmsg_type, the ip will be set or unset.
1302 static status_t
manage_ipaddr(private_kernel_interface_t
*this, int nlmsg_type
,
1303 int flags
, int if_index
, host_t
*ip
)
1305 unsigned char request
[BUFFER_SIZE
];
1306 struct nlmsghdr
*hdr
;
1307 struct ifaddrmsg
*msg
;
1310 memset(&request
, 0, sizeof(request
));
1312 chunk
= ip
->get_address(ip
);
1314 hdr
= (struct nlmsghdr
*)request
;
1315 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
| flags
;
1316 hdr
->nlmsg_type
= nlmsg_type
;
1317 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct ifaddrmsg
));
1319 msg
= (struct ifaddrmsg
*)NLMSG_DATA(hdr
);
1320 msg
->ifa_family
= ip
->get_family(ip
);
1322 msg
->ifa_prefixlen
= 8 * chunk
.len
;
1323 msg
->ifa_scope
= RT_SCOPE_UNIVERSE
;
1324 msg
->ifa_index
= if_index
;
1326 add_attribute(hdr
, IFA_LOCAL
, chunk
, sizeof(request
));
1328 return netlink_send_ack(this, this->socket_rt
, hdr
);
1332 * Manages source routes in the routing table.
1333 * By setting the appropriate nlmsg_type, the route added or r.
1335 static status_t
manage_srcroute(private_kernel_interface_t
*this, int nlmsg_type
,
1336 int flags
, route_entry_t
*route
)
1338 unsigned char request
[BUFFER_SIZE
];
1339 struct nlmsghdr
*hdr
;
1343 /* if route is 0.0.0.0/0, we can't install it, as it would
1344 * overwrite the default route. Instead, we add two routes:
1345 * 0.0.0.0/1 and 128.0.0.0/1
1346 * TODO: use metrics instead */
1347 if (route
->prefixlen
== 0)
1352 half
.dst_net
= chunk_alloca(route
->dst_net
.len
);
1353 memset(half
.dst_net
.ptr
, 0, half
.dst_net
.len
);
1354 half
.src_ip
= route
->src_ip
;
1355 half
.gateway
= route
->gateway
;
1356 half
.if_index
= route
->if_index
;
1359 status
= manage_srcroute(this, nlmsg_type
, flags
, &half
);
1360 half
.dst_net
.ptr
[0] |= 0x80;
1361 status
= manage_srcroute(this, nlmsg_type
, flags
, &half
);
1365 memset(&request
, 0, sizeof(request
));
1367 hdr
= (struct nlmsghdr
*)request
;
1368 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
| flags
;
1369 hdr
->nlmsg_type
= nlmsg_type
;
1370 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct rtmsg
));
1372 msg
= (struct rtmsg
*)NLMSG_DATA(hdr
);
1373 msg
->rtm_family
= route
->src_ip
->get_family(route
->src_ip
);
1374 msg
->rtm_dst_len
= route
->prefixlen
;
1375 msg
->rtm_table
= IPSEC_ROUTING_TABLE
;
1376 msg
->rtm_protocol
= RTPROT_STATIC
;
1377 msg
->rtm_type
= RTN_UNICAST
;
1378 msg
->rtm_scope
= RT_SCOPE_UNIVERSE
;
1380 add_attribute(hdr
, RTA_DST
, route
->dst_net
, sizeof(request
));
1381 chunk
= route
->src_ip
->get_address(route
->src_ip
);
1382 add_attribute(hdr
, RTA_PREFSRC
, chunk
, sizeof(request
));
1383 chunk
= route
->gateway
->get_address(route
->gateway
);
1384 add_attribute(hdr
, RTA_GATEWAY
, chunk
, sizeof(request
));
1385 chunk
.ptr
= (char*)&route
->if_index
;
1386 chunk
.len
= sizeof(route
->if_index
);
1387 add_attribute(hdr
, RTA_OIF
, chunk
, sizeof(request
));
1389 return netlink_send_ack(this, this->socket_rt
, hdr
);
1393 * create or delete an rule to use our routing table
1395 static status_t
manage_rule(private_kernel_interface_t
*this, int nlmsg_type
,
1396 u_int32_t table
, u_int32_t prio
)
1398 unsigned char request
[BUFFER_SIZE
];
1399 struct nlmsghdr
*hdr
;
1403 memset(&request
, 0, sizeof(request
));
1404 hdr
= (struct nlmsghdr
*)request
;
1405 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1406 hdr
->nlmsg_type
= nlmsg_type
;
1407 if (nlmsg_type
== RTM_NEWRULE
)
1409 hdr
->nlmsg_flags
|= NLM_F_CREATE
| NLM_F_EXCL
;
1411 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct rtmsg
));
1413 msg
= (struct rtmsg
*)NLMSG_DATA(hdr
);
1414 msg
->rtm_table
= table
;
1415 msg
->rtm_family
= AF_INET
;
1416 msg
->rtm_protocol
= RTPROT_BOOT
;
1417 msg
->rtm_scope
= RT_SCOPE_UNIVERSE
;
1418 msg
->rtm_type
= RTN_UNICAST
;
1420 chunk
= chunk_from_thing(prio
);
1421 add_attribute(hdr
, RTA_PRIORITY
, chunk
, sizeof(request
));
1423 return netlink_send_ack(this, this->socket_rt
, hdr
);
1427 * check if an address (chunk) addr is in subnet (net with net_len net bits)
1429 static bool addr_in_subnet(chunk_t addr
, chunk_t net
, int net_len
)
1433 if (addr
.len
!= net
.len
)
1437 /* scan through all bits, beginning in the front */
1438 for (byte
= 0; byte
< addr
.len
; byte
++)
1440 for (bit
= 7; bit
>= 0; bit
--)
1442 /* check if bits are equal (or we reached the end of the net) */
1443 if (bit
+ byte
* 8 > net_len
)
1447 if (((1<<bit
) & addr
.ptr
[byte
]) != ((1<<bit
) & net
.ptr
[byte
]))
1457 * Get a route: If "nexthop", the nexthop is returned. source addr otherwise.
1459 static host_t
*get_route(private_kernel_interface_t
*this, host_t
*dest
,
1462 unsigned char request
[BUFFER_SIZE
];
1463 struct nlmsghdr
*hdr
, *out
, *current
;
1468 host_t
*src
= NULL
, *gtw
= NULL
;
1470 DBG2(DBG_KNL
, "getting address to reach %H", dest
);
1472 memset(&request
, 0, sizeof(request
));
1474 hdr
= (struct nlmsghdr
*)request
;
1475 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_DUMP
| NLM_F_ROOT
;
1476 hdr
->nlmsg_type
= RTM_GETROUTE
;
1477 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct rtmsg
));
1479 msg
= (struct rtmsg
*)NLMSG_DATA(hdr
);
1480 msg
->rtm_family
= dest
->get_family(dest
);
1482 chunk
= dest
->get_address(dest
);
1483 add_attribute(hdr
, RTA_DST
, chunk
, sizeof(request
));
1485 if (netlink_send(this, this->socket_rt
, hdr
, &out
, &len
) != SUCCESS
)
1487 DBG1(DBG_KNL
, "getting address to %H failed", dest
);
1491 while (NLMSG_OK(current
, len
))
1493 switch (current
->nlmsg_type
)
1501 chunk_t rta_gtw
, rta_src
, rta_dst
;
1502 u_int32_t rta_oif
= 0;
1504 rta_gtw
= rta_src
= rta_dst
= chunk_empty
;
1505 msg
= (struct rtmsg
*)(NLMSG_DATA(current
));
1507 rtasize
= RTM_PAYLOAD(current
);
1508 while(RTA_OK(rta
, rtasize
))
1510 switch (rta
->rta_type
)
1513 rta_src
= chunk_create(RTA_DATA(rta
), RTA_PAYLOAD(rta
));
1516 rta_gtw
= chunk_create(RTA_DATA(rta
), RTA_PAYLOAD(rta
));
1519 rta_dst
= chunk_create(RTA_DATA(rta
), RTA_PAYLOAD(rta
));
1522 if (RTA_PAYLOAD(rta
) == sizeof(rta_oif
))
1524 rta_oif
= *(u_int32_t
*)RTA_DATA(rta
);
1528 rta
= RTA_NEXT(rta
, rtasize
);
1531 /* apply the route if:
1532 * - it is not from our own ipsec routing table
1533 * - its destination net contains our destination
1534 * - is better than a previous one
1536 if (msg
->rtm_table
!= IPSEC_ROUTING_TABLE
&& rta_dst
.ptr
&&
1537 addr_in_subnet(chunk
, rta_dst
, msg
->rtm_dst_len
) &&
1538 msg
->rtm_dst_len
> best
)
1540 iterator_t
*ifaces
, *addrs
;
1541 iface_entry_t
*iface
;
1544 best
= msg
->rtm_dst_len
;
1548 gtw
= host_create_from_chunk(msg
->rtm_family
, rta_gtw
, 0);
1550 else if (rta_src
.ptr
)
1553 src
= host_create_from_chunk(msg
->rtm_family
, rta_src
, 0);
1557 /* no source addr, get one from the interfaces */
1558 ifaces
= this->ifaces
->create_iterator_locked(
1559 this->ifaces
, &this->mutex
);
1560 while (ifaces
->iterate(ifaces
, (void**)&iface
))
1562 if (iface
->ifindex
== rta_oif
)
1564 addrs
= iface
->addrs
->create_iterator(
1565 iface
->addrs
, TRUE
);
1566 while (addrs
->iterate(addrs
, (void**)&addr
))
1568 chunk_t ip
= addr
->ip
->get_address(addr
->ip
);
1569 if (addr_in_subnet(ip
, rta_dst
,
1573 src
= addr
->ip
->clone(addr
->ip
);
1574 best
= msg
->rtm_dst_len
;
1578 addrs
->destroy(addrs
);
1581 ifaces
->destroy(ifaces
);
1587 current
= NLMSG_NEXT(current
, len
);
1600 return dest
->clone(dest
);
1606 * Implementation of kernel_interface_t.get_source_addr.
1608 static host_t
* get_source_addr(private_kernel_interface_t
*this, host_t
*dest
)
1610 return get_route(this, dest
, FALSE
);
1614 * Implementation of kernel_interface_t.add_ip.
1616 static status_t
add_ip(private_kernel_interface_t
*this,
1617 host_t
*virtual_ip
, host_t
*iface_ip
)
1619 iface_entry_t
*iface
;
1621 iterator_t
*addrs
, *ifaces
;
1623 DBG2(DBG_KNL
, "adding virtual IP %H", virtual_ip
);
1625 ifaces
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
1626 while (ifaces
->iterate(ifaces
, (void**)&iface
))
1628 bool iface_found
= FALSE
;
1630 addrs
= iface
->addrs
->create_iterator(iface
->addrs
, TRUE
);
1631 while (addrs
->iterate(addrs
, (void**)&addr
))
1633 if (iface_ip
->ip_equals(iface_ip
, addr
->ip
))
1637 else if (virtual_ip
->ip_equals(virtual_ip
, addr
->ip
))
1640 DBG2(DBG_KNL
, "virtual IP %H already installed on %s",
1641 virtual_ip
, iface
->ifname
);
1642 addrs
->destroy(addrs
);
1643 ifaces
->destroy(ifaces
);
1647 addrs
->destroy(addrs
);
1651 int ifindex
= iface
->ifindex
;
1652 ifaces
->destroy(ifaces
);
1653 if (manage_ipaddr(this, RTM_NEWADDR
, NLM_F_CREATE
| NLM_F_EXCL
,
1654 ifindex
, virtual_ip
) == SUCCESS
)
1656 addr
= malloc_thing(addr_entry_t
);
1657 addr
->ip
= virtual_ip
->clone(virtual_ip
);
1659 addr
->virtual = TRUE
;
1660 addr
->scope
= RT_SCOPE_UNIVERSE
;
1661 pthread_mutex_lock(&this->mutex
);
1662 iface
->addrs
->insert_last(iface
->addrs
, addr
);
1663 pthread_mutex_unlock(&this->mutex
);
1666 DBG2(DBG_KNL
, "adding virtual IP %H failed", virtual_ip
);
1672 ifaces
->destroy(ifaces
);
1674 DBG2(DBG_KNL
, "interface address %H not found, unable to install"
1675 "virtual IP %H", iface_ip
, virtual_ip
);
1680 * Implementation of kernel_interface_t.del_ip.
1682 static status_t
del_ip(private_kernel_interface_t
*this, host_t
*virtual_ip
)
1684 iface_entry_t
*iface
;
1686 iterator_t
*addrs
, *ifaces
;
1688 DBG2(DBG_KNL
, "deleting virtual IP %H", virtual_ip
);
1690 ifaces
= this->ifaces
->create_iterator_locked(this->ifaces
, &this->mutex
);
1691 while (ifaces
->iterate(ifaces
, (void**)&iface
))
1693 addrs
= iface
->addrs
->create_iterator(iface
->addrs
, TRUE
);
1694 while (addrs
->iterate(addrs
, (void**)&addr
))
1696 if (virtual_ip
->ip_equals(virtual_ip
, addr
->ip
))
1698 int ifindex
= iface
->ifindex
;
1700 if (addr
->refcount
== 0)
1702 addrs
->remove(addrs
);
1703 addrs
->destroy(addrs
);
1704 ifaces
->destroy(ifaces
);
1705 addr_entry_destroy(addr
);
1706 return manage_ipaddr(this, RTM_DELADDR
, 0,
1707 ifindex
, virtual_ip
);
1709 DBG2(DBG_KNL
, "virtual IP %H used by other SAs, not deleting",
1711 addrs
->destroy(addrs
);
1712 ifaces
->destroy(ifaces
);
1716 addrs
->destroy(addrs
);
1718 ifaces
->destroy(ifaces
);
1720 DBG2(DBG_KNL
, "virtual IP %H not cached, unable to delete", virtual_ip
);
1725 * Implementation of kernel_interface_t.get_spi.
1727 static status_t
get_spi(private_kernel_interface_t
*this,
1728 host_t
*src
, host_t
*dst
,
1729 protocol_id_t protocol
, u_int32_t reqid
,
1732 unsigned char request
[BUFFER_SIZE
];
1733 struct nlmsghdr
*hdr
, *out
;
1734 struct xfrm_userspi_info
*userspi
;
1735 u_int32_t received_spi
= 0;
1738 memset(&request
, 0, sizeof(request
));
1740 DBG2(DBG_KNL
, "getting SPI for reqid %d", reqid
);
1742 hdr
= (struct nlmsghdr
*)request
;
1743 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1744 hdr
->nlmsg_type
= XFRM_MSG_ALLOCSPI
;
1745 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userspi_info
));
1747 userspi
= (struct xfrm_userspi_info
*)NLMSG_DATA(hdr
);
1748 host2xfrm(src
, &userspi
->info
.saddr
);
1749 host2xfrm(dst
, &userspi
->info
.id
.daddr
);
1750 userspi
->info
.id
.proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1751 userspi
->info
.mode
= TRUE
; /* tunnel mode */
1752 userspi
->info
.reqid
= reqid
;
1753 userspi
->info
.family
= src
->get_family(src
);
1754 userspi
->min
= 0xc0000000;
1755 userspi
->max
= 0xcFFFFFFF;
1757 if (netlink_send(this, this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1760 while (NLMSG_OK(hdr
, len
))
1762 switch (hdr
->nlmsg_type
)
1764 case XFRM_MSG_NEWSA
:
1766 struct xfrm_usersa_info
* usersa
= NLMSG_DATA(hdr
);
1767 received_spi
= usersa
->id
.spi
;
1772 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1774 DBG1(DBG_KNL
, "allocating SPI failed: %s (%d)",
1775 strerror(-err
->error
), -err
->error
);
1779 hdr
= NLMSG_NEXT(hdr
, len
);
1789 if (received_spi
== 0)
1791 DBG1(DBG_KNL
, "unable to get SPI for reqid %d", reqid
);
1795 DBG2(DBG_KNL
, "got SPI 0x%x for reqid %d", received_spi
, reqid
);
1797 *spi
= received_spi
;
1802 * Implementation of kernel_interface_t.add_sa.
1804 static status_t
add_sa(private_kernel_interface_t
*this,
1805 host_t
*src
, host_t
*dst
, u_int32_t spi
,
1806 protocol_id_t protocol
, u_int32_t reqid
,
1807 u_int64_t expire_soft
, u_int64_t expire_hard
,
1808 algorithm_t
*enc_alg
, algorithm_t
*int_alg
,
1809 prf_plus_t
*prf_plus
, mode_t mode
, bool encap
,
1812 unsigned char request
[BUFFER_SIZE
];
1815 struct nlmsghdr
*hdr
;
1816 struct xfrm_usersa_info
*sa
;
1818 memset(&request
, 0, sizeof(request
));
1820 DBG2(DBG_KNL
, "adding SAD entry with SPI 0x%x", spi
);
1822 hdr
= (struct nlmsghdr
*)request
;
1823 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1824 hdr
->nlmsg_type
= replace ? XFRM_MSG_UPDSA
: XFRM_MSG_NEWSA
;
1825 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
1827 sa
= (struct xfrm_usersa_info
*)NLMSG_DATA(hdr
);
1828 host2xfrm(src
, &sa
->saddr
);
1829 host2xfrm(dst
, &sa
->id
.daddr
);
1831 sa
->id
.proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1832 sa
->family
= src
->get_family(src
);
1834 sa
->replay_window
= 32;
1836 /* we currently do not expire SAs by volume/packet count */
1837 sa
->lft
.soft_byte_limit
= XFRM_INF
;
1838 sa
->lft
.hard_byte_limit
= XFRM_INF
;
1839 sa
->lft
.soft_packet_limit
= XFRM_INF
;
1840 sa
->lft
.hard_packet_limit
= XFRM_INF
;
1841 /* we use lifetimes since added, not since used */
1842 sa
->lft
.soft_add_expires_seconds
= expire_soft
;
1843 sa
->lft
.hard_add_expires_seconds
= expire_hard
;
1844 sa
->lft
.soft_use_expires_seconds
= 0;
1845 sa
->lft
.hard_use_expires_seconds
= 0;
1847 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_usersa_info
);
1849 if (enc_alg
->algorithm
!= ENCR_UNDEFINED
)
1851 rthdr
->rta_type
= XFRMA_ALG_CRYPT
;
1852 alg_name
= lookup_algorithm(encryption_algs
, enc_alg
, &key_size
);
1853 if (alg_name
== NULL
)
1855 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1856 encryption_algorithm_names
, enc_alg
->algorithm
);
1859 DBG2(DBG_KNL
, " using encryption algorithm %N with key size %d",
1860 encryption_algorithm_names
, enc_alg
->algorithm
, key_size
);
1862 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo
) + key_size
);
1863 hdr
->nlmsg_len
+= rthdr
->rta_len
;
1864 if (hdr
->nlmsg_len
> sizeof(request
))
1869 struct xfrm_algo
* algo
= (struct xfrm_algo
*)RTA_DATA(rthdr
);
1870 algo
->alg_key_len
= key_size
;
1871 strcpy(algo
->alg_name
, alg_name
);
1872 prf_plus
->get_bytes(prf_plus
, key_size
/ 8, algo
->alg_key
);
1874 rthdr
= XFRM_RTA_NEXT(rthdr
);
1877 if (int_alg
->algorithm
!= AUTH_UNDEFINED
)
1879 rthdr
->rta_type
= XFRMA_ALG_AUTH
;
1880 alg_name
= lookup_algorithm(integrity_algs
, int_alg
, &key_size
);
1881 if (alg_name
== NULL
)
1883 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1884 integrity_algorithm_names
, int_alg
->algorithm
);
1887 DBG2(DBG_KNL
, " using integrity algorithm %N with key size %d",
1888 integrity_algorithm_names
, int_alg
->algorithm
, key_size
);
1890 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo
) + key_size
);
1891 hdr
->nlmsg_len
+= rthdr
->rta_len
;
1892 if (hdr
->nlmsg_len
> sizeof(request
))
1897 struct xfrm_algo
* algo
= (struct xfrm_algo
*)RTA_DATA(rthdr
);
1898 algo
->alg_key_len
= key_size
;
1899 strcpy(algo
->alg_name
, alg_name
);
1900 prf_plus
->get_bytes(prf_plus
, key_size
/ 8, algo
->alg_key
);
1902 rthdr
= XFRM_RTA_NEXT(rthdr
);
1905 /* TODO: add IPComp here */
1909 rthdr
->rta_type
= XFRMA_ENCAP
;
1910 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_encap_tmpl
));
1912 hdr
->nlmsg_len
+= rthdr
->rta_len
;
1913 if (hdr
->nlmsg_len
> sizeof(request
))
1918 struct xfrm_encap_tmpl
* tmpl
= (struct xfrm_encap_tmpl
*)RTA_DATA(rthdr
);
1919 tmpl
->encap_type
= UDP_ENCAP_ESPINUDP
;
1920 tmpl
->encap_sport
= htons(src
->get_port(src
));
1921 tmpl
->encap_dport
= htons(dst
->get_port(dst
));
1922 memset(&tmpl
->encap_oa
, 0, sizeof (xfrm_address_t
));
1923 /* encap_oa could probably be derived from the
1924 * traffic selectors [rfc4306, p39]. In the netlink kernel implementation
1925 * pluto does the same as we do here but it uses encap_oa in the
1926 * pfkey implementation. BUT as /usr/src/linux/net/key/af_key.c indicates
1927 * the kernel ignores it anyway
1928 * -> does that mean that NAT-T encap doesn't work in transport mode?
1929 * No. The reason the kernel ignores NAT-OA is that it recomputes
1930 * (or, rather, just ignores) the checksum. If packets pass
1931 * the IPsec checks it marks them "checksum ok" so OA isn't needed. */
1932 rthdr
= XFRM_RTA_NEXT(rthdr
);
1935 if (netlink_send_ack(this, this->socket_xfrm
, hdr
) != SUCCESS
)
1937 DBG1(DBG_KNL
, "unable to add SAD entry with SPI 0x%x", spi
);
1944 * Implementation of kernel_interface_t.update_sa.
1946 static status_t
update_sa(private_kernel_interface_t
*this,
1947 u_int32_t spi
, protocol_id_t protocol
,
1948 host_t
*src
, host_t
*dst
,
1949 host_t
*new_src
, host_t
*new_dst
, bool encap
)
1951 unsigned char request
[BUFFER_SIZE
], *pos
;
1952 struct nlmsghdr
*hdr
, *out
= NULL
;
1953 struct xfrm_usersa_id
*sa_id
;
1954 struct xfrm_usersa_info
*out_sa
= NULL
, *sa
;
1958 struct xfrm_encap_tmpl
* tmpl
= NULL
;
1960 memset(&request
, 0, sizeof(request
));
1962 DBG2(DBG_KNL
, "querying SAD entry with SPI 0x%x for update", spi
);
1964 /* query the exisiting SA first */
1965 hdr
= (struct nlmsghdr
*)request
;
1966 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1967 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
1968 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
1970 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
1971 host2xfrm(dst
, &sa_id
->daddr
);
1973 sa_id
->proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
1974 sa_id
->family
= dst
->get_family(dst
);
1976 if (netlink_send(this, this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1979 while (NLMSG_OK(hdr
, len
))
1981 switch (hdr
->nlmsg_type
)
1983 case XFRM_MSG_NEWSA
:
1985 out_sa
= NLMSG_DATA(hdr
);
1990 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1991 DBG1(DBG_KNL
, "querying SAD entry failed: %s (%d)",
1992 strerror(-err
->error
), -err
->error
);
1996 hdr
= NLMSG_NEXT(hdr
, len
);
2004 if (out_sa
== NULL
||
2005 this->public.del_sa(&this->public, dst
, spi
, protocol
) != SUCCESS
)
2007 DBG1(DBG_KNL
, "unable to update SAD entry with SPI 0x%x", spi
);
2012 DBG2(DBG_KNL
, "updating SAD entry with SPI 0x%x from %#H..%#H to %#H..%#H",
2013 spi
, src
, dst
, new_src
, new_dst
);
2015 /* copy over the SA from out to request */
2016 hdr
= (struct nlmsghdr
*)request
;
2017 memcpy(hdr
, out
, min(out
->nlmsg_len
, sizeof(request
)));
2018 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2019 hdr
->nlmsg_type
= XFRM_MSG_NEWSA
;
2020 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
2021 sa
= NLMSG_DATA(hdr
);
2022 sa
->family
= new_dst
->get_family(new_dst
);
2024 if (!src
->ip_equals(src
, new_src
))
2026 host2xfrm(new_src
, &sa
->saddr
);
2028 if (!dst
->ip_equals(dst
, new_dst
))
2030 host2xfrm(new_dst
, &sa
->id
.daddr
);
2033 rta
= XFRM_RTA(out
, struct xfrm_usersa_info
);
2034 rtasize
= XFRM_PAYLOAD(out
, struct xfrm_usersa_info
);
2035 pos
= (u_char
*)XFRM_RTA(hdr
, struct xfrm_usersa_info
);
2036 while(RTA_OK(rta
, rtasize
))
2038 /* copy all attributes, but not XFRMA_ENCAP if we are disabling it */
2039 if (rta
->rta_type
!= XFRMA_ENCAP
|| encap
)
2041 if (rta
->rta_type
== XFRMA_ENCAP
)
2042 { /* update encap tmpl */
2043 tmpl
= (struct xfrm_encap_tmpl
*)RTA_DATA(rta
);
2044 tmpl
->encap_sport
= ntohs(new_src
->get_port(new_src
));
2045 tmpl
->encap_dport
= ntohs(new_dst
->get_port(new_dst
));
2047 memcpy(pos
, rta
, rta
->rta_len
);
2048 pos
+= rta
->rta_len
;
2049 hdr
->nlmsg_len
+= rta
->rta_len
;
2051 rta
= RTA_NEXT(rta
, rtasize
);
2053 if (tmpl
== NULL
&& encap
)
2054 { /* add tmpl if we are enabling it */
2055 rta
= (struct rtattr
*)pos
;
2056 rta
->rta_type
= XFRMA_ENCAP
;
2057 rta
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_encap_tmpl
));
2058 hdr
->nlmsg_len
+= rta
->rta_len
;
2059 tmpl
= (struct xfrm_encap_tmpl
*)RTA_DATA(rta
);
2060 tmpl
->encap_type
= UDP_ENCAP_ESPINUDP
;
2061 tmpl
->encap_sport
= ntohs(new_src
->get_port(new_src
));
2062 tmpl
->encap_dport
= ntohs(new_dst
->get_port(new_dst
));
2063 memset(&tmpl
->encap_oa
, 0, sizeof (xfrm_address_t
));
2066 if (netlink_send_ack(this, this->socket_xfrm
, hdr
) != SUCCESS
)
2068 DBG1(DBG_KNL
, "unable to update SAD entry with SPI 0x%x", spi
);
2078 * Implementation of kernel_interface_t.query_sa.
2080 static status_t
query_sa(private_kernel_interface_t
*this, host_t
*dst
,
2081 u_int32_t spi
, protocol_id_t protocol
,
2082 u_int32_t
*use_time
)
2084 unsigned char request
[BUFFER_SIZE
];
2085 struct nlmsghdr
*out
= NULL
, *hdr
;
2086 struct xfrm_usersa_id
*sa_id
;
2087 struct xfrm_usersa_info
*sa
= NULL
;
2090 DBG2(DBG_KNL
, "querying SAD entry with SPI 0x%x", spi
);
2091 memset(&request
, 0, sizeof(request
));
2093 hdr
= (struct nlmsghdr
*)request
;
2094 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
2095 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
2096 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
2098 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
2099 host2xfrm(dst
, &sa_id
->daddr
);
2101 sa_id
->proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
2102 sa_id
->family
= dst
->get_family(dst
);
2104 if (netlink_send(this, this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
2107 while (NLMSG_OK(hdr
, len
))
2109 switch (hdr
->nlmsg_type
)
2111 case XFRM_MSG_NEWSA
:
2113 sa
= NLMSG_DATA(hdr
);
2118 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
2119 DBG1(DBG_KNL
, "querying SAD entry failed: %s (%d)",
2120 strerror(-err
->error
), -err
->error
);
2124 hdr
= NLMSG_NEXT(hdr
, len
);
2135 DBG1(DBG_KNL
, "unable to query SAD entry with SPI 0x%x", spi
);
2140 *use_time
= sa
->curlft
.use_time
;
2146 * Implementation of kernel_interface_t.del_sa.
2148 static status_t
del_sa(private_kernel_interface_t
*this, host_t
*dst
,
2149 u_int32_t spi
, protocol_id_t protocol
)
2151 unsigned char request
[BUFFER_SIZE
];
2152 struct nlmsghdr
*hdr
;
2153 struct xfrm_usersa_id
*sa_id
;
2155 memset(&request
, 0, sizeof(request
));
2157 DBG2(DBG_KNL
, "deleting SAD entry with SPI 0x%x", spi
);
2159 hdr
= (struct nlmsghdr
*)request
;
2160 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2161 hdr
->nlmsg_type
= XFRM_MSG_DELSA
;
2162 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
2164 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
2165 host2xfrm(dst
, &sa_id
->daddr
);
2167 sa_id
->proto
= (protocol
== PROTO_ESP
) ? KERNEL_ESP
: KERNEL_AH
;
2168 sa_id
->family
= dst
->get_family(dst
);
2170 if (netlink_send_ack(this, this->socket_xfrm
, hdr
) != SUCCESS
)
2172 DBG1(DBG_KNL
, "unable to delete SAD entry with SPI 0x%x", spi
);
2175 DBG2(DBG_KNL
, "deleted SAD entry with SPI 0x%x", spi
);
2180 * Implementation of kernel_interface_t.add_policy.
2182 static status_t
add_policy(private_kernel_interface_t
*this,
2183 host_t
*src
, host_t
*dst
,
2184 traffic_selector_t
*src_ts
,
2185 traffic_selector_t
*dst_ts
,
2186 policy_dir_t direction
, protocol_id_t protocol
,
2187 u_int32_t reqid
, bool high_prio
, mode_t mode
)
2189 iterator_t
*iterator
;
2190 policy_entry_t
*current
, *policy
;
2192 unsigned char request
[BUFFER_SIZE
];
2193 struct xfrm_userpolicy_info
*policy_info
;
2194 struct nlmsghdr
*hdr
;
2196 /* create a policy */
2197 policy
= malloc_thing(policy_entry_t
);
2198 memset(policy
, 0, sizeof(policy_entry_t
));
2199 policy
->sel
= ts2selector(src_ts
, dst_ts
);
2200 policy
->direction
= direction
;
2202 /* find the policy, which matches EXACTLY */
2203 pthread_mutex_lock(&this->mutex
);
2204 iterator
= this->policies
->create_iterator(this->policies
, TRUE
);
2205 while (iterator
->iterate(iterator
, (void**)¤t
))
2207 if (memcmp(¤t
->sel
, &policy
->sel
, sizeof(struct xfrm_selector
)) == 0 &&
2208 policy
->direction
== current
->direction
)
2210 /* use existing policy */
2211 current
->refcount
++;
2212 DBG2(DBG_KNL
, "policy %R===%R already exists, increasing ",
2213 "refcount", src_ts
, dst_ts
);
2220 iterator
->destroy(iterator
);
2222 { /* apply the new one, if we have no such policy */
2223 this->policies
->insert_last(this->policies
, policy
);
2224 policy
->refcount
= 1;
2227 DBG2(DBG_KNL
, "adding policy %R===%R", src_ts
, dst_ts
);
2229 memset(&request
, 0, sizeof(request
));
2230 hdr
= (struct nlmsghdr
*)request
;
2231 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2232 hdr
->nlmsg_type
= XFRM_MSG_UPDPOLICY
;
2233 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info
));
2235 policy_info
= (struct xfrm_userpolicy_info
*)NLMSG_DATA(hdr
);
2236 policy_info
->sel
= policy
->sel
;
2237 policy_info
->dir
= policy
->direction
;
2238 /* calculate priority based on source selector size, small size = high prio */
2239 policy_info
->priority
= high_prio ? PRIO_HIGH
: PRIO_LOW
;
2240 policy_info
->priority
-= policy
->sel
.prefixlen_s
* 10;
2241 policy_info
->priority
-= policy
->sel
.proto ?
2 : 0;
2242 policy_info
->priority
-= policy
->sel
.sport_mask ?
1 : 0;
2243 policy_info
->action
= XFRM_POLICY_ALLOW
;
2244 policy_info
->share
= XFRM_SHARE_ANY
;
2245 pthread_mutex_unlock(&this->mutex
);
2247 /* policies don't expire */
2248 policy_info
->lft
.soft_byte_limit
= XFRM_INF
;
2249 policy_info
->lft
.soft_packet_limit
= XFRM_INF
;
2250 policy_info
->lft
.hard_byte_limit
= XFRM_INF
;
2251 policy_info
->lft
.hard_packet_limit
= XFRM_INF
;
2252 policy_info
->lft
.soft_add_expires_seconds
= 0;
2253 policy_info
->lft
.hard_add_expires_seconds
= 0;
2254 policy_info
->lft
.soft_use_expires_seconds
= 0;
2255 policy_info
->lft
.hard_use_expires_seconds
= 0;
2257 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_userpolicy_info
);
2258 rthdr
->rta_type
= XFRMA_TMPL
;
2260 rthdr
->rta_len
= sizeof(struct xfrm_user_tmpl
);
2261 rthdr
->rta_len
= RTA_LENGTH(rthdr
->rta_len
);
2263 hdr
->nlmsg_len
+= rthdr
->rta_len
;
2264 if (hdr
->nlmsg_len
> sizeof(request
))
2269 struct xfrm_user_tmpl
*tmpl
= (struct xfrm_user_tmpl
*)RTA_DATA(rthdr
);
2270 tmpl
->reqid
= reqid
;
2271 tmpl
->id
.proto
= (protocol
== PROTO_AH
) ? KERNEL_AH
: KERNEL_ESP
;
2272 tmpl
->aalgos
= tmpl
->ealgos
= tmpl
->calgos
= ~0;
2274 tmpl
->family
= src
->get_family(src
);
2276 host2xfrm(src
, &tmpl
->saddr
);
2277 host2xfrm(dst
, &tmpl
->id
.daddr
);
2279 if (netlink_send_ack(this, this->socket_xfrm
, hdr
) != SUCCESS
)
2281 DBG1(DBG_KNL
, "unable to add policy %R===%R", src_ts
, dst_ts
);
2285 /* install a route, if:
2286 * - we are NOT updating a policy
2287 * - this is a forward policy (to just get one for each child)
2288 * - we are in tunnel mode
2289 * - we are not using IPv6 (does not work correctly yet!)
2291 if (policy
->route
== NULL
&& direction
== POLICY_FWD
&&
2292 mode
!= MODE_TRANSPORT
&& src
->get_family(src
) != AF_INET6
)
2294 policy
->route
= malloc_thing(route_entry_t
);
2295 if (get_address_by_ts(this, dst_ts
, &policy
->route
->src_ip
) == SUCCESS
)
2297 /* get the nexthop to src (src as we are in POLICY_FWD).*/
2298 policy
->route
->gateway
= get_route(this, src
, TRUE
);
2299 policy
->route
->if_index
= get_interface_index(this, dst
);
2300 policy
->route
->dst_net
= chunk_alloc(policy
->sel
.family
== AF_INET ?
4 : 16);
2301 memcpy(policy
->route
->dst_net
.ptr
, &policy
->sel
.saddr
, policy
->route
->dst_net
.len
);
2302 policy
->route
->prefixlen
= policy
->sel
.prefixlen_s
;
2304 if (manage_srcroute(this, RTM_NEWROUTE
, NLM_F_CREATE
| NLM_F_EXCL
,
2305 policy
->route
) != SUCCESS
)
2307 DBG1(DBG_KNL
, "unable to install source route for %H",
2308 policy
->route
->src_ip
);
2309 route_entry_destroy(policy
->route
);
2310 policy
->route
= NULL
;
2315 free(policy
->route
);
2316 policy
->route
= NULL
;
2324 * Implementation of kernel_interface_t.query_policy.
2326 static status_t
query_policy(private_kernel_interface_t
*this,
2327 traffic_selector_t
*src_ts
,
2328 traffic_selector_t
*dst_ts
,
2329 policy_dir_t direction
, u_int32_t
*use_time
)
2331 unsigned char request
[BUFFER_SIZE
];
2332 struct nlmsghdr
*out
= NULL
, *hdr
;
2333 struct xfrm_userpolicy_id
*policy_id
;
2334 struct xfrm_userpolicy_info
*policy
= NULL
;
2337 memset(&request
, 0, sizeof(request
));
2339 DBG2(DBG_KNL
, "querying policy %R===%R", src_ts
, dst_ts
);
2341 hdr
= (struct nlmsghdr
*)request
;
2342 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
2343 hdr
->nlmsg_type
= XFRM_MSG_GETPOLICY
;
2344 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
2346 policy_id
= (struct xfrm_userpolicy_id
*)NLMSG_DATA(hdr
);
2347 policy_id
->sel
= ts2selector(src_ts
, dst_ts
);
2348 policy_id
->dir
= direction
;
2350 if (netlink_send(this, this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
2353 while (NLMSG_OK(hdr
, len
))
2355 switch (hdr
->nlmsg_type
)
2357 case XFRM_MSG_NEWPOLICY
:
2359 policy
= (struct xfrm_userpolicy_info
*)NLMSG_DATA(hdr
);
2364 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
2365 DBG1(DBG_KNL
, "querying policy failed: %s (%d)",
2366 strerror(-err
->error
), -err
->error
);
2370 hdr
= NLMSG_NEXT(hdr
, len
);
2381 DBG2(DBG_KNL
, "unable to query policy %R===%R", src_ts
, dst_ts
);
2385 *use_time
= (time_t)policy
->curlft
.use_time
;
2392 * Implementation of kernel_interface_t.del_policy.
2394 static status_t
del_policy(private_kernel_interface_t
*this,
2395 traffic_selector_t
*src_ts
,
2396 traffic_selector_t
*dst_ts
,
2397 policy_dir_t direction
)
2399 policy_entry_t
*current
, policy
, *to_delete
= NULL
;
2400 route_entry_t
*route
;
2401 unsigned char request
[BUFFER_SIZE
];
2402 struct nlmsghdr
*hdr
;
2403 struct xfrm_userpolicy_id
*policy_id
;
2404 iterator_t
*iterator
;
2406 DBG2(DBG_KNL
, "deleting policy %R===%R", src_ts
, dst_ts
);
2408 /* create a policy */
2409 memset(&policy
, 0, sizeof(policy_entry_t
));
2410 policy
.sel
= ts2selector(src_ts
, dst_ts
);
2411 policy
.direction
= direction
;
2413 /* find the policy */
2414 iterator
= this->policies
->create_iterator_locked(this->policies
, &this->mutex
);
2415 while (iterator
->iterate(iterator
, (void**)¤t
))
2417 if (memcmp(¤t
->sel
, &policy
.sel
, sizeof(struct xfrm_selector
)) == 0 &&
2418 policy
.direction
== current
->direction
)
2420 to_delete
= current
;
2421 if (--to_delete
->refcount
> 0)
2423 /* is used by more SAs, keep in kernel */
2424 DBG2(DBG_KNL
, "policy still used by another CHILD_SA, not removed");
2425 iterator
->destroy(iterator
);
2428 /* remove if last reference */
2429 iterator
->remove(iterator
);
2433 iterator
->destroy(iterator
);
2436 DBG1(DBG_KNL
, "deleting policy %R===%R failed, not found", src_ts
, dst_ts
);
2440 memset(&request
, 0, sizeof(request
));
2442 hdr
= (struct nlmsghdr
*)request
;
2443 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2444 hdr
->nlmsg_type
= XFRM_MSG_DELPOLICY
;
2445 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
2447 policy_id
= (struct xfrm_userpolicy_id
*)NLMSG_DATA(hdr
);
2448 policy_id
->sel
= to_delete
->sel
;
2449 policy_id
->dir
= direction
;
2451 route
= to_delete
->route
;
2454 if (netlink_send_ack(this, this->socket_xfrm
, hdr
) != SUCCESS
)
2456 DBG1(DBG_KNL
, "unable to delete policy %R===%R", src_ts
, dst_ts
);
2462 if (manage_srcroute(this, RTM_DELROUTE
, 0, route
) != SUCCESS
)
2464 DBG1(DBG_KNL
, "error uninstalling route installed with "
2465 "policy %R===%R", src_ts
, dst_ts
);
2467 route_entry_destroy(route
);
2473 * Implementation of kernel_interface_t.destroy.
2475 static void destroy(private_kernel_interface_t
*this)
2477 manage_rule(this, RTM_DELRULE
, IPSEC_ROUTING_TABLE
, IPSEC_ROUTING_TABLE_PRIO
);
2479 this->job
->cancel(this->job
);
2480 close(this->socket_xfrm_events
);
2481 close(this->socket_xfrm
);
2482 close(this->socket_rt_events
);
2483 close(this->socket_rt
);
2484 this->policies
->destroy(this->policies
);
2485 this->ifaces
->destroy_function(this->ifaces
, (void*)iface_entry_destroy
);
2490 * Described in header.
2492 kernel_interface_t
*kernel_interface_create()
2494 private_kernel_interface_t
*this = malloc_thing(private_kernel_interface_t
);
2495 struct sockaddr_nl addr
;
2497 /* public functions */
2498 this->public.get_spi
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*,protocol_id_t
,u_int32_t
,u_int32_t
*))get_spi
;
2499 this->public.add_sa
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*,u_int32_t
,protocol_id_t
,u_int32_t
,u_int64_t
,u_int64_t
,algorithm_t
*,algorithm_t
*,prf_plus_t
*,mode_t
,bool,bool))add_sa
;
2500 this->public.update_sa
= (status_t(*)(kernel_interface_t
*,u_int32_t
,protocol_id_t
,host_t
*,host_t
*,host_t
*,host_t
*,bool))update_sa
;
2501 this->public.query_sa
= (status_t(*)(kernel_interface_t
*,host_t
*,u_int32_t
,protocol_id_t
,u_int32_t
*))query_sa
;
2502 this->public.del_sa
= (status_t(*)(kernel_interface_t
*,host_t
*,u_int32_t
,protocol_id_t
))del_sa
;
2503 this->public.add_policy
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*,traffic_selector_t
*,traffic_selector_t
*,policy_dir_t
,protocol_id_t
,u_int32_t
,bool,mode_t
))add_policy
;
2504 this->public.query_policy
= (status_t(*)(kernel_interface_t
*,traffic_selector_t
*,traffic_selector_t
*,policy_dir_t
,u_int32_t
*))query_policy
;
2505 this->public.del_policy
= (status_t(*)(kernel_interface_t
*,traffic_selector_t
*,traffic_selector_t
*,policy_dir_t
))del_policy
;
2506 this->public.get_interface
= (char*(*)(kernel_interface_t
*,host_t
*))get_interface_name
;
2507 this->public.create_address_iterator
= (iterator_t
*(*)(kernel_interface_t
*))create_address_iterator
;
2508 this->public.get_source_addr
= (host_t
*(*)(kernel_interface_t
*, host_t
*dest
))get_source_addr
;
2509 this->public.add_ip
= (status_t(*)(kernel_interface_t
*,host_t
*,host_t
*)) add_ip
;
2510 this->public.del_ip
= (status_t(*)(kernel_interface_t
*,host_t
*)) del_ip
;
2511 this->public.destroy
= (void(*)(kernel_interface_t
*)) destroy
;
2513 /* private members */
2514 this->policies
= linked_list_create();
2515 this->ifaces
= linked_list_create();
2518 pthread_mutex_init(&this->mutex
,NULL
);
2520 memset(&addr
, 0, sizeof(addr
));
2521 addr
.nl_family
= AF_NETLINK
;
2523 /* create and bind RT socket */
2524 this->socket_rt
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_ROUTE
);
2525 if (this->socket_rt
<= 0)
2527 charon
->kill(charon
, "unable to create RT netlink socket");
2530 if (bind(this->socket_rt
, (struct sockaddr
*)&addr
, sizeof(addr
)))
2532 charon
->kill(charon
, "unable to bind RT netlink socket");
2535 /* create and bind RT socket for events (address/interface/route changes) */
2536 this->socket_rt_events
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_ROUTE
);
2537 if (this->socket_rt_events
<= 0)
2539 charon
->kill(charon
, "unable to create RT event socket");
2541 addr
.nl_groups
= RTMGRP_IPV4_IFADDR
| RTMGRP_IPV6_IFADDR
|
2542 RTMGRP_IPV4_ROUTE
| RTMGRP_IPV4_ROUTE
| RTMGRP_LINK
;
2543 if (bind(this->socket_rt_events
, (struct sockaddr
*)&addr
, sizeof(addr
)))
2545 charon
->kill(charon
, "unable to bind RT event socket");
2548 /* create and bind XFRM socket */
2549 this->socket_xfrm
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_XFRM
);
2550 if (this->socket_xfrm
<= 0)
2552 charon
->kill(charon
, "unable to create XFRM netlink socket");
2555 if (bind(this->socket_xfrm
, (struct sockaddr
*)&addr
, sizeof(addr
)))
2557 charon
->kill(charon
, "unable to bind XFRM netlink socket");
2560 /* create and bind XFRM socket for ACQUIRE & EXPIRE */
2561 this->socket_xfrm_events
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_XFRM
);
2562 if (this->socket_xfrm_events
<= 0)
2564 charon
->kill(charon
, "unable to create XFRM event socket");
2566 addr
.nl_groups
= XFRMGRP_ACQUIRE
| XFRMGRP_EXPIRE
;
2567 if (bind(this->socket_xfrm_events
, (struct sockaddr
*)&addr
, sizeof(addr
)))
2569 charon
->kill(charon
, "unable to bind XFRM event socket");
2572 this->job
= callback_job_create((callback_job_cb_t
)receive_events
,
2574 charon
->processor
->queue_job(charon
->processor
, (job_t
*)this->job
);
2576 if (init_address_list(this) != SUCCESS
)
2578 charon
->kill(charon
, "unable to get interface list");
2581 if (manage_rule(this, RTM_NEWRULE
, IPSEC_ROUTING_TABLE
,
2582 IPSEC_ROUTING_TABLE_PRIO
) != SUCCESS
)
2584 DBG1(DBG_KNL
, "unable to create routing table rule");
2587 return &this->public;