merging kernel_klips plugin back into trunk
[strongswan.git] / src / charon / network / socket.c
1 /*
2 * Copyright (C) 2006-2008 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2007 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 *
18 * $Id$
19 */
20
21 /* for struct in6_pktinfo */
22 #define _GNU_SOURCE
23
24 #include <pthread.h>
25 #include <sys/types.h>
26 #include <sys/socket.h>
27 #include <string.h>
28 #include <errno.h>
29 #include <unistd.h>
30 #include <stdlib.h>
31 #include <fcntl.h>
32 #include <sys/ioctl.h>
33 #include <netinet/in.h>
34 #include <netinet/ip.h>
35 #include <netinet/ip6.h>
36 #include <netinet/udp.h>
37 #include <linux/types.h>
38 #include <linux/filter.h>
39 #include <net/if.h>
40
41 #include "socket.h"
42
43 #include <daemon.h>
44
45 /* length of non-esp marker */
46 #define MARKER_LEN sizeof(u_int32_t)
47
48 /* from linux/udp.h */
49 #ifndef UDP_ENCAP
50 #define UDP_ENCAP 100
51 #endif /*UDP_ENCAP*/
52
53 #ifndef UDP_ENCAP_ESPINUDP
54 #define UDP_ENCAP_ESPINUDP 2
55 #endif /*UDP_ENCAP_ESPINUDP*/
56
57 /* needed for older kernel headers */
58 #ifndef IPV6_2292PKTINFO
59 #define IPV6_2292PKTINFO 2
60 #endif /*IPV6_2292PKTINFO*/
61
62 /* missing on uclibc */
63 #ifndef IPV6_IPSEC_POLICY
64 #define IPV6_IPSEC_POLICY 34
65 #endif /*IPV6_IPSEC_POLICY*/
66
67 typedef struct private_socket_t private_socket_t;
68
69 /**
70 * Private data of an socket_t object
71 */
72 struct private_socket_t {
73 /**
74 * public functions
75 */
76 socket_t public;
77
78 /**
79 * IPv4 socket (500)
80 */
81 int ipv4;
82
83 /**
84 * IPv4 socket for NATT (4500)
85 */
86 int ipv4_natt;
87
88 /**
89 * IPv6 socket (500)
90 */
91 int ipv6;
92
93 /**
94 * IPv6 socket for NATT (4500)
95 */
96 int ipv6_natt;
97 };
98
99 /**
100 * enumerator for underlying sockets
101 */
102 typedef struct {
103 /** implements enumerator_t */
104 enumerator_t public;
105 /** sockets we enumerate */
106 private_socket_t *socket;
107 /** counter */
108 u_int8_t index;
109 } socket_enumerator_t;
110
111 /**
112 * implementation of socket_t.receive
113 */
114 static status_t receiver(private_socket_t *this, packet_t **packet)
115 {
116 char buffer[MAX_PACKET];
117 chunk_t data;
118 packet_t *pkt;
119 host_t *source = NULL, *dest = NULL;
120 int bytes_read = 0;
121 int data_offset, oldstate;
122 fd_set rfds;
123 int max_fd = 0, selected = 0;
124 u_int16_t port;
125
126 FD_ZERO(&rfds);
127
128 if (this->ipv4)
129 {
130 FD_SET(this->ipv4, &rfds);
131 }
132 if (this->ipv4_natt)
133 {
134 FD_SET(this->ipv4_natt, &rfds);
135 }
136 if (this->ipv6)
137 {
138 FD_SET(this->ipv6, &rfds);
139 }
140 if (this->ipv6_natt)
141 {
142 FD_SET(this->ipv6_natt, &rfds);
143 }
144 max_fd = max(max(this->ipv4, this->ipv4_natt), max(this->ipv6, this->ipv6_natt));
145
146 DBG2(DBG_NET, "waiting for data on sockets");
147 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
148 if (select(max_fd + 1, &rfds, NULL, NULL, NULL) <= 0)
149 {
150 pthread_setcancelstate(oldstate, NULL);
151 return FAILED;
152 }
153 pthread_setcancelstate(oldstate, NULL);
154
155 if (FD_ISSET(this->ipv4, &rfds))
156 {
157 port = IKEV2_UDP_PORT;
158 selected = this->ipv4;
159 }
160 if (FD_ISSET(this->ipv4_natt, &rfds))
161 {
162 port = IKEV2_NATT_PORT;
163 selected = this->ipv4_natt;
164 }
165 if (FD_ISSET(this->ipv6, &rfds))
166 {
167 port = IKEV2_UDP_PORT;
168 selected = this->ipv6;
169 }
170 if (FD_ISSET(this->ipv6_natt, &rfds))
171 {
172 port = IKEV2_NATT_PORT;
173 selected = this->ipv6_natt;
174 }
175 if (selected)
176 {
177 struct msghdr msg;
178 struct cmsghdr *cmsgptr;
179 struct iovec iov;
180 char ancillary[64];
181 union {
182 struct sockaddr_in in4;
183 struct sockaddr_in6 in6;
184 } src;
185
186 msg.msg_name = &src;
187 msg.msg_namelen = sizeof(src);
188 iov.iov_base = buffer;
189 iov.iov_len = sizeof(buffer);
190 msg.msg_iov = &iov;
191 msg.msg_iovlen = 1;
192 msg.msg_control = ancillary;
193 msg.msg_controllen = sizeof(ancillary);
194 msg.msg_flags = 0;
195 bytes_read = recvmsg(selected, &msg, 0);
196 if (bytes_read < 0)
197 {
198 DBG1(DBG_NET, "error reading socket: %s", strerror(errno));
199 return FAILED;
200 }
201 DBG3(DBG_NET, "received packet %b", buffer, bytes_read);
202
203 if (bytes_read < MARKER_LEN)
204 {
205 DBG3(DBG_NET, "received packet too short (%d bytes)",
206 bytes_read);
207 return FAILED;
208 }
209
210 /* read ancillary data to get destination address */
211 for (cmsgptr = CMSG_FIRSTHDR(&msg); cmsgptr != NULL;
212 cmsgptr = CMSG_NXTHDR(&msg, cmsgptr))
213 {
214 if (cmsgptr->cmsg_len == 0)
215 {
216 DBG1(DBG_NET, "error reading ancillary data");
217 return FAILED;
218 }
219
220 if (cmsgptr->cmsg_level == SOL_IPV6 &&
221 cmsgptr->cmsg_type == IPV6_2292PKTINFO)
222 {
223 struct in6_pktinfo *pktinfo;
224 pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsgptr);
225 struct sockaddr_in6 dst;
226
227 memset(&dst, 0, sizeof(dst));
228 memcpy(&dst.sin6_addr, &pktinfo->ipi6_addr, sizeof(dst.sin6_addr));
229 dst.sin6_family = AF_INET6;
230 dst.sin6_port = htons(port);
231 dest = host_create_from_sockaddr((sockaddr_t*)&dst);
232 }
233 if (cmsgptr->cmsg_level == SOL_IP &&
234 cmsgptr->cmsg_type == IP_PKTINFO)
235 {
236 struct in_pktinfo *pktinfo;
237 pktinfo = (struct in_pktinfo*)CMSG_DATA(cmsgptr);
238 struct sockaddr_in dst;
239
240 memset(&dst, 0, sizeof(dst));
241 memcpy(&dst.sin_addr, &pktinfo->ipi_addr, sizeof(dst.sin_addr));
242 dst.sin_family = AF_INET;
243 dst.sin_port = htons(port);
244 dest = host_create_from_sockaddr((sockaddr_t*)&dst);
245 }
246 if (dest)
247 {
248 break;
249 }
250 }
251 if (dest == NULL)
252 {
253 DBG1(DBG_NET, "error reading IP header");
254 return FAILED;
255 }
256 source = host_create_from_sockaddr((sockaddr_t*)&src);
257
258 pkt = packet_create();
259 pkt->set_source(pkt, source);
260 pkt->set_destination(pkt, dest);
261 DBG2(DBG_NET, "received packet: from %#H to %#H", source, dest);
262 data_offset = 0;
263 /* remove non esp marker */
264 if (dest->get_port(dest) == IKEV2_NATT_PORT)
265 {
266 data_offset += MARKER_LEN;
267 }
268 /* fill in packet */
269 data.len = bytes_read - data_offset;
270 data.ptr = malloc(data.len);
271 memcpy(data.ptr, buffer + data_offset, data.len);
272 pkt->set_data(pkt, data);
273 }
274 else
275 {
276 /* oops, shouldn't happen */
277 return FAILED;
278 }
279 /* return packet */
280 *packet = pkt;
281 return SUCCESS;
282 }
283
284 /**
285 * implementation of socket_t.send
286 */
287 status_t sender(private_socket_t *this, packet_t *packet)
288 {
289 int sport, skt, family;
290 ssize_t bytes_sent;
291 chunk_t data, marked;
292 host_t *src, *dst;
293 struct msghdr msg;
294 struct cmsghdr *cmsg;
295 struct iovec iov;
296
297 src = packet->get_source(packet);
298 dst = packet->get_destination(packet);
299 data = packet->get_data(packet);
300
301 DBG2(DBG_NET, "sending packet: from %#H to %#H", src, dst);
302
303 /* send data */
304 sport = src->get_port(src);
305 family = dst->get_family(dst);
306 if (sport == IKEV2_UDP_PORT)
307 {
308 if (family == AF_INET)
309 {
310 skt = this->ipv4;
311 }
312 else
313 {
314 skt = this->ipv6;
315 }
316 }
317 else if (sport == IKEV2_NATT_PORT)
318 {
319 if (family == AF_INET)
320 {
321 skt = this->ipv4_natt;
322 }
323 else
324 {
325 skt = this->ipv6_natt;
326 }
327 /* NAT keepalives without marker */
328 if (data.len != 1 || data.ptr[0] != 0xFF)
329 {
330 /* add non esp marker to packet */
331 if (data.len > MAX_PACKET - MARKER_LEN)
332 {
333 DBG1(DBG_NET, "unable to send packet: it's too big (%d bytes)",
334 data.len);
335 return FAILED;
336 }
337 marked = chunk_alloc(data.len + MARKER_LEN);
338 memset(marked.ptr, 0, MARKER_LEN);
339 memcpy(marked.ptr + MARKER_LEN, data.ptr, data.len);
340 /* let the packet do the clean up for us */
341 packet->set_data(packet, marked);
342 data = marked;
343 }
344 }
345 else
346 {
347 DBG1(DBG_NET, "unable to locate a send socket for port %d", sport);
348 return FAILED;
349 }
350
351 memset(&msg, 0, sizeof(struct msghdr));
352 msg.msg_name = dst->get_sockaddr(dst);;
353 msg.msg_namelen = *dst->get_sockaddr_len(dst);
354 iov.iov_base = data.ptr;
355 iov.iov_len = data.len;
356 msg.msg_iov = &iov;
357 msg.msg_iovlen = 1;
358 msg.msg_flags = 0;
359
360 if (!dst->is_anyaddr(dst))
361 {
362 if (family == AF_INET)
363 {
364 char buf[CMSG_SPACE(sizeof(struct in_pktinfo))];
365 struct in_pktinfo *pktinfo;
366 struct sockaddr_in *sin;
367
368 msg.msg_control = buf;
369 msg.msg_controllen = sizeof(buf);
370 cmsg = CMSG_FIRSTHDR(&msg);
371 cmsg->cmsg_level = SOL_IP;
372 cmsg->cmsg_type = IP_PKTINFO;
373 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
374 pktinfo = (struct in_pktinfo*)CMSG_DATA(cmsg);
375 memset(pktinfo, 0, sizeof(struct in_pktinfo));
376 sin = (struct sockaddr_in*)src->get_sockaddr(src);
377 memcpy(&pktinfo->ipi_spec_dst, &sin->sin_addr, sizeof(struct in_addr));
378 }
379 else
380 {
381 char buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
382 struct in6_pktinfo *pktinfo;
383 struct sockaddr_in6 *sin;
384
385 msg.msg_control = buf;
386 msg.msg_controllen = sizeof(buf);
387 cmsg = CMSG_FIRSTHDR(&msg);
388 cmsg->cmsg_level = SOL_IPV6;
389 cmsg->cmsg_type = IPV6_2292PKTINFO;
390 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
391 pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsg);
392 memset(pktinfo, 0, sizeof(struct in6_pktinfo));
393 sin = (struct sockaddr_in6*)src->get_sockaddr(src);
394 memcpy(&pktinfo->ipi6_addr, &sin->sin6_addr, sizeof(struct in6_addr));
395 }
396 }
397
398 bytes_sent = sendmsg(skt, &msg, 0);
399
400 if (bytes_sent != data.len)
401 {
402 DBG1(DBG_NET, "error writing to socket: %s", strerror(errno));
403 return FAILED;
404 }
405 return SUCCESS;
406 }
407
408 /**
409 * open a socket to send packets
410 */
411 static int open_socket(private_socket_t *this, int family, u_int16_t port)
412 {
413 int on = TRUE;
414 int type = UDP_ENCAP_ESPINUDP;
415 struct sockaddr_storage addr;
416 u_int sol, pktinfo;
417 int skt;
418
419 memset(&addr, 0, sizeof(addr));
420 /* precalculate constants depending on address family */
421 switch (family)
422 {
423 case AF_INET:
424 {
425 struct sockaddr_in *sin = (struct sockaddr_in *)&addr;
426 sin->sin_family = AF_INET;
427 sin->sin_addr.s_addr = INADDR_ANY;
428 sin->sin_port = htons(port);
429 sol = SOL_IP;
430 pktinfo = IP_PKTINFO;
431 break;
432 }
433 case AF_INET6:
434 {
435 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&addr;
436 sin6->sin6_family = AF_INET6;
437 memcpy(&sin6->sin6_addr, &in6addr_any, sizeof(in6addr_any));
438 sin6->sin6_port = htons(port);
439 sol = SOL_IPV6;
440 pktinfo = IPV6_2292PKTINFO;
441 break;
442 }
443 default:
444 return 0;
445 }
446
447 skt = socket(family, SOCK_DGRAM, IPPROTO_UDP);
448 if (skt < 0)
449 {
450 DBG1(DBG_NET, "could not open socket: %s", strerror(errno));
451 return 0;
452 }
453 if (setsockopt(skt, SOL_SOCKET, SO_REUSEADDR, (void*)&on, sizeof(on)) < 0)
454 {
455 DBG1(DBG_NET, "unable to set SO_REUSEADDR on socket: %s", strerror(errno));
456 close(skt);
457 return 0;
458 }
459
460 /* bind the send socket */
461 if (bind(skt, (struct sockaddr *)&addr, sizeof(addr)) < 0)
462 {
463 DBG1(DBG_NET, "unable to bind socket: %s", strerror(errno));
464 close(skt);
465 return 0;
466 }
467
468 /* get additional packet info on receive */
469 if (setsockopt(skt, sol, pktinfo, &on, sizeof(on)) < 0)
470 {
471 DBG1(DBG_NET, "unable to set IP_PKTINFO on socket: %s", strerror(errno));
472 close(skt);
473 return 0;
474 }
475
476 /* enable UDP decapsulation globally, only for one socket needed */
477 if (family == AF_INET && port == IKEV2_NATT_PORT &&
478 setsockopt(skt, SOL_UDP, UDP_ENCAP, &type, sizeof(type)) < 0)
479 {
480 DBG1(DBG_NET, "unable to set UDP_ENCAP: %s", strerror(errno));
481 }
482 return skt;
483 }
484
485 /**
486 * enumerate function for socket_enumerator_t
487 */
488 static bool enumerate(socket_enumerator_t *this, int *fd, int *family, int *port)
489 {
490 static const struct {
491 int fd_offset;
492 int family;
493 int port;
494 } sockets[] = {
495 { 0, 0, 0 },
496 { offsetof(private_socket_t, ipv4), AF_INET, IKEV2_UDP_PORT },
497 { offsetof(private_socket_t, ipv6), AF_INET6, IKEV2_UDP_PORT },
498 { offsetof(private_socket_t, ipv4_natt), AF_INET, IKEV2_NATT_PORT },
499 { offsetof(private_socket_t, ipv6_natt), AF_INET6, IKEV2_NATT_PORT }
500 };
501
502 while(++this->index <= 4)
503 {
504 int sock = *(int*)((char*)this->socket + sockets[this->index].fd_offset);
505 if (!sock)
506 {
507 continue;
508 }
509 *fd = sock;
510 *family = sockets[this->index].family;
511 *port = sockets[this->index].port;
512 return TRUE;
513 }
514 return FALSE;
515 }
516
517 /**
518 * implementation of socket_t.create_enumerator
519 */
520 static enumerator_t *create_enumerator(private_socket_t *this)
521 {
522 socket_enumerator_t *enumerator;
523
524 enumerator = malloc_thing(socket_enumerator_t);
525 enumerator->index = 0;
526 enumerator->socket = this;
527 enumerator->public.enumerate = (void*)enumerate;
528 enumerator->public.destroy = (void*)free;
529 return &enumerator->public;
530 }
531
532 /**
533 * implementation of socket_t.destroy
534 */
535 static void destroy(private_socket_t *this)
536 {
537 if (this->ipv4)
538 {
539 close(this->ipv4);
540 }
541 if (this->ipv4_natt)
542 {
543 close(this->ipv4_natt);
544 }
545 if (this->ipv6)
546 {
547 close(this->ipv6);
548 }
549 if (this->ipv6_natt)
550 {
551 close(this->ipv6_natt);
552 }
553 free(this);
554 }
555
556 /*
557 * See header for description
558 */
559 socket_t *socket_create()
560 {
561 private_socket_t *this = malloc_thing(private_socket_t);
562
563 /* public functions */
564 this->public.send = (status_t(*)(socket_t*, packet_t*))sender;
565 this->public.receive = (status_t(*)(socket_t*, packet_t**))receiver;
566 this->public.create_enumerator = (enumerator_t*(*)(socket_t*))create_enumerator;
567 this->public.destroy = (void(*)(socket_t*)) destroy;
568
569 this->ipv4 = 0;
570 this->ipv6 = 0;
571 this->ipv4_natt = 0;
572 this->ipv6_natt = 0;
573
574 this->ipv4 = open_socket(this, AF_INET, IKEV2_UDP_PORT);
575 if (this->ipv4 == 0)
576 {
577 DBG1(DBG_NET, "could not open IPv4 socket, IPv4 disabled");
578 }
579 else
580 {
581 this->ipv4_natt = open_socket(this, AF_INET, IKEV2_NATT_PORT);
582 if (this->ipv4_natt == 0)
583 {
584 DBG1(DBG_NET, "could not open IPv4 NAT-T socket");
585 }
586 }
587
588 this->ipv6 = open_socket(this, AF_INET6, IKEV2_UDP_PORT);
589 if (this->ipv6 == 0)
590 {
591 DBG1(DBG_NET, "could not open IPv6 socket, IPv6 disabled");
592 }
593 else
594 {
595 this->ipv6_natt = open_socket(this, AF_INET6, IKEV2_NATT_PORT);
596 if (this->ipv6_natt == 0)
597 {
598 DBG1(DBG_NET, "could not open IPv6 NAT-T socket");
599 }
600 }
601
602 if (!this->ipv4 && !this->ipv6)
603 {
604 DBG1(DBG_NET, "could not create any sockets");
605 destroy(this);
606 charon->kill(charon, "socket initialization failed");
607 }
608 return (socket_t*)this;
609 }
610