fixed UDP decapsulation by adding inbound bypass policy for send socket
[strongswan.git] / src / charon / network / socket.c
1 /**
2 * @file socket.c
3 *
4 * @brief Implementation of socket_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005-2006 Martin Willi
11 * Copyright (C) 2005 Jan Hutter
12 * Hochschule fuer Technik Rapperswil
13 *
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the
16 * Free Software Foundation; either version 2 of the License, or (at your
17 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 *
19 * This program is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
21 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
22 * for more details.
23 */
24
25 #include <pthread.h>
26 #include <sys/types.h>
27 #include <sys/socket.h>
28 #include <string.h>
29 #include <errno.h>
30 #include <unistd.h>
31 #include <stdlib.h>
32 #include <fcntl.h>
33 #include <sys/ioctl.h>
34 #include <netinet/in.h>
35 #include <netinet/ip.h>
36 #include <netinet/udp.h>
37 #include <linux/ipsec.h>
38 #include <linux/filter.h>
39
40 #include "socket.h"
41
42 #include <daemon.h>
43 #include <utils/logger_manager.h>
44
45 /* constants for packet handling */
46 #define IP_LEN sizeof(struct iphdr)
47 #define UDP_LEN sizeof(struct udphdr)
48 #define MARKER_LEN sizeof(u_int32_t)
49
50 /* offsets for packet handling */
51 #define IP 0
52 #define UDP IP + IP_LEN
53 #define IKE UDP + UDP_LEN
54
55 /* from linux/in.h */
56 #ifndef IP_IPSEC_POLICY
57 #define IP_IPSEC_POLICY 16
58 #endif /*IP_IPSEC_POLICY*/
59
60 /* from linux/udp.h */
61 #ifndef UDP_ENCAP
62 #define UDP_ENCAP 100
63 #endif /*UDP_ENCAP*/
64
65 #ifndef UDP_ENCAP_ESPINUDP
66 #define UDP_ENCAP_ESPINUDP 2
67 #endif /*UDP_ENCAP_ESPINUDP*/
68
69 typedef struct private_socket_t private_socket_t;
70
71 /**
72 * Private data of an socket_t object
73 */
74 struct private_socket_t{
75 /**
76 * public functions
77 */
78 socket_t public;
79
80 /**
81 * regular port
82 */
83 int port;
84
85 /**
86 * port used for nat-t
87 */
88 int natt_port;
89
90 /**
91 * raw socket (receiver)
92 */
93 int raw_fd;
94
95 /**
96 * send socket on regular port
97 */
98 int send_fd;
99
100 /**
101 * send socket on nat-t port
102 */
103 int natt_fd;
104
105 /**
106 * logger for this socket
107 */
108 logger_t *logger;
109
110 /**
111 * Setup a send socket
112 *
113 * @param this calling object
114 * @param port the port
115 * @param send_fd returns the file descriptor of this new socket
116 */
117 status_t (*setup_send_socket) (private_socket_t *this, u_int16_t port, int *send_fd);
118
119 /**
120 * Initialize
121 *
122 * @param this calling object
123 */
124 status_t (*initialize) (private_socket_t *this);
125 };
126
127 /**
128 * implementation of socket_t.receive
129 */
130 static status_t receiver(private_socket_t *this, packet_t **packet)
131 {
132 char buffer[MAX_PACKET];
133 chunk_t data;
134 packet_t *pkt;
135 struct iphdr *ip;
136 struct udphdr *udp;
137 host_t *source, *dest;
138 int bytes_read = 0;
139 int data_offset, oldstate;
140
141 this->logger->log(this->logger, CONTROL|LEVEL1, "receive from raw socket");
142 /* allow cancellation while blocking on recv() */
143 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
144 bytes_read = recv(this->raw_fd, buffer, MAX_PACKET, 0);
145 pthread_setcancelstate(oldstate, NULL);
146
147 if (bytes_read < 0)
148 {
149 this->logger->log(this->logger, ERROR, "error reading from socket: %s", strerror(errno));
150 return FAILED;
151 }
152
153 /* read source/dest from raw IP/UDP header */
154 ip = (struct iphdr*) buffer;
155 udp = (struct udphdr*) (buffer + IP_LEN);
156
157 source = host_create_from_hdr(ip->saddr, udp->source);
158 dest = host_create_from_hdr(ip->daddr, udp->dest);
159
160 pkt = packet_create();
161 pkt->set_source(pkt, source);
162 pkt->set_destination(pkt, dest);
163
164 this->logger->log(this->logger, CONTROL|LEVEL1, "received packet: from %s:%d to %s:%d",
165 source->get_address(source), source->get_port(source),
166 dest->get_address(dest), dest->get_port(dest));
167
168 data_offset = IP_LEN + UDP_LEN;
169
170 /* remove non esp marker */
171 if (dest->get_port(dest) == this->natt_port)
172 {
173 data_offset += MARKER_LEN;
174 }
175
176 /* fill in packet */
177 data.len = bytes_read - data_offset;
178 data.ptr = malloc(data.len);
179 memcpy(data.ptr, buffer + data_offset, data.len);
180 pkt->set_data(pkt, data);
181
182 /* return packet */
183 *packet = pkt;
184
185 return SUCCESS;
186 }
187
188 /**
189 * implementation of socket_t.send
190 */
191 status_t sender(private_socket_t *this, packet_t *packet)
192 {
193 int sport, fd;
194 ssize_t bytes_sent;
195 chunk_t data, marked;
196 host_t *src, *dst;
197
198 src = packet->get_source(packet);
199 dst = packet->get_destination(packet);
200 data = packet->get_data(packet);
201
202 this->logger->log(this->logger, CONTROL|LEVEL1, "sending packet: from %s:%d to %s:%d",
203 src->get_address(src), src->get_port(src),
204 dst->get_address(dst), dst->get_port(dst));
205
206 /* send data */
207 sport = src->get_port(src);
208 if (sport == this->port)
209 {
210 fd = this->send_fd;
211 }
212 else if (sport == this->natt_port)
213 {
214 fd = this->natt_fd;
215 /* NAT keepalives without marker */
216 if (data.len != 1 || data.ptr[0] != 0xFF)
217 {
218 /* add non esp marker to packet */
219 if (data.len > MAX_PACKET - MARKER_LEN)
220 {
221 this->logger->log(this->logger, ERROR, "unable to send packet: it's too big");
222 return FAILED;
223 }
224 marked = chunk_alloc(data.len + MARKER_LEN);
225 memset(marked.ptr, 0, MARKER_LEN);
226 memcpy(marked.ptr + MARKER_LEN, data.ptr, data.len);
227 packet->set_data(packet, marked); /* let the packet do the clean up for us */
228 data = marked;
229 }
230 }
231 else
232 {
233 this->logger->log(this->logger, ERROR, "unable to locate a send socket for port: %d", sport);
234 return FAILED;
235 }
236
237 bytes_sent = sendto(fd, data.ptr, data.len, 0,
238 dst->get_sockaddr(dst), *(dst->get_sockaddr_len(dst)));
239
240 if (bytes_sent != data.len)
241 {
242 this->logger->log(this->logger, ERROR, "error writing to socket: %s", strerror(errno));
243 return FAILED;
244 }
245
246 return SUCCESS;
247 }
248
249 /**
250 * setup a send socket on a specified port
251 */
252 static status_t setup_send_socket(private_socket_t *this, u_int16_t port, int *send_fd)
253 {
254 int on = TRUE;
255 struct sockaddr_in addr;
256 struct sadb_x_policy policy;
257 int fd;
258
259 fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
260 if (fd < 0)
261 {
262 this->logger->log(this->logger, ERROR, "could not open IPv4 send socket!");
263 return FAILED;
264 }
265
266 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (void*)&on, sizeof(on)) < 0)
267 {
268 this->logger->log(this->logger, ERROR, "unable to set SO_REUSEADDR on send socket!");
269 close(fd);
270 return FAILED;
271 }
272
273 /* bypass outgoung IKE traffic on send socket */
274 policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t);
275 policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
276 policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
277 policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
278 policy.sadb_x_policy_reserved = 0;
279 policy.sadb_x_policy_id = 0;
280 /* TODO: use IPPROTO_IPV6/IPV6_IPSEC_POLICY for IPv6 sockets */
281 if (setsockopt(fd, IPPROTO_IP, IP_IPSEC_POLICY, &policy, sizeof(policy)) < 0)
282 {
283 this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on send socket!");
284 close(fd);
285 return FAILED;
286 }
287 /* We don't receive packets on the send socket, but we need a INBOUND policy.
288 * Otherwise, UDP decapsulation does not work!!! */
289 policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
290 if (setsockopt(fd, IPPROTO_IP, IP_IPSEC_POLICY, &policy, sizeof(policy)) < 0)
291 {
292 this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on send socket!");
293 close(fd);
294 return FAILED;
295 }
296
297 /* bind the send socket */
298 addr.sin_family = AF_INET;
299 addr.sin_addr.s_addr = INADDR_ANY;
300 addr.sin_port = htons(port);
301 if (bind(fd, (struct sockaddr*)&addr, sizeof(addr)) < 0)
302 {
303 this->logger->log(this->logger, ERROR, "unable to bind send socket: %s!", strerror(errno));
304 return FAILED;
305 }
306
307 *send_fd = fd;
308 return SUCCESS;
309 }
310
311 /**
312 * Initialize all sub sockets
313 */
314 static status_t initialize(private_socket_t *this)
315 {
316 struct sadb_x_policy policy;
317 int type = UDP_ENCAP_ESPINUDP;
318
319 /* This filter code filters out all non-IKEv2 traffic on
320 * a SOCK_RAW IP_PROTP_UDP socket. Handling of other
321 * IKE versions is done in pluto.
322 */
323 struct sock_filter ikev2_filter_code[] =
324 {
325 /* Protocol must be UDP */
326 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, IP + 9),
327 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_UDP, 0, 15),
328 /* Destination Port must be either port or natt_port */
329 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, UDP + 2),
330 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, this->port, 1, 0),
331 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, this->natt_port, 5, 12),
332 /* port */
333 /* IKE version must be 2.0 */
334 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, IKE + 17),
335 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x20, 0, 10),
336 /* packet length is length in IKEv2 header + ip header + udp header */
337 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, IKE + 24),
338 BPF_STMT(BPF_ALU+BPF_ADD+BPF_K, IP_LEN + UDP_LEN),
339 BPF_STMT(BPF_RET+BPF_A, 0),
340 /* natt_port */
341 /* nat-t: check for marker */
342 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, IKE),
343 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 0, 5),
344 /* nat-t: IKE version must be 2.0 */
345 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, IKE + MARKER_LEN + 17),
346 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x20, 0, 3),
347 /* nat-t: packet length is length in IKEv2 header + ip header + udp header + non esp marker */
348 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, IKE + MARKER_LEN + 24),
349 BPF_STMT(BPF_ALU+BPF_ADD+BPF_K, IP_LEN + UDP_LEN + MARKER_LEN),
350 BPF_STMT(BPF_RET+BPF_A, 0),
351 /* packet doesn't match, ignore */
352 BPF_STMT(BPF_RET+BPF_K, 0),
353 };
354
355 /* Filter struct to use with setsockopt */
356 struct sock_fprog ikev2_filter = {
357 sizeof(ikev2_filter_code) / sizeof(struct sock_filter),
358 ikev2_filter_code
359 };
360
361 /* set up raw socket */
362 this->raw_fd = socket(PF_INET, SOCK_RAW, IPPROTO_UDP);
363 if (this->raw_fd < 0)
364 {
365 this->logger->log(this->logger, ERROR, "unable to create raw socket!");
366 return FAILED;
367 }
368
369 if (setsockopt(this->raw_fd, SOL_SOCKET, SO_ATTACH_FILTER, &ikev2_filter, sizeof(ikev2_filter)) < 0)
370 {
371 this->logger->log(this->logger, ERROR, "unable to attach IKEv2 filter to raw socket!");
372 close(this->raw_fd);
373 return FAILED;
374 }
375
376 /* bypass incomining IKE traffic on this socket */
377 policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t);
378 policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
379 policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
380 policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
381 policy.sadb_x_policy_reserved = 0;
382 policy.sadb_x_policy_id = 0;
383 /* TODO: use IPPROTO_IPV6/IPV6_IPSEC_POLICY for IPv6 sockets */
384 if (setsockopt(this->raw_fd, IPPROTO_IP, IP_IPSEC_POLICY, &policy, sizeof(policy)) < 0)
385 {
386 this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on raw socket!");
387 close(this->raw_fd);
388 return FAILED;
389 }
390
391 /* setup the send sockets */
392 if (this->setup_send_socket(this, this->port, &this->send_fd) != SUCCESS)
393 {
394 this->logger->log(this->logger, ERROR, "unable to setup send socket on port %d!", this->port);
395 return FAILED;
396 }
397 if (this->setup_send_socket(this, this->natt_port, &this->natt_fd) != SUCCESS)
398 {
399 this->logger->log(this->logger, ERROR, "unable to setup send socket on port %d!", this->natt_port);
400 return FAILED;
401 }
402
403 /* enable UDP decapsulation globally */
404 if (setsockopt(this->natt_fd, SOL_UDP, UDP_ENCAP, &type, sizeof(type)) < 0)
405 {
406 this->logger->log(this->logger, ERROR,
407 "unable to set UDP_ENCAP on raw socket! NAT-T may fail! error: %s",
408 strerror(errno));
409 }
410
411 return SUCCESS;
412 }
413
414 /**
415 * implementation of socket_t.destroy
416 */
417 static void destroy(private_socket_t *this)
418 {
419 close(this->natt_fd);
420 close(this->send_fd);
421 close(this->raw_fd);
422 free(this);
423 }
424
425 /*
426 * See header for description
427 */
428 socket_t *socket_create(u_int16_t port, u_int16_t natt_port)
429 {
430 private_socket_t *this = malloc_thing(private_socket_t);
431
432 /* private functions */
433 this->initialize = (status_t(*)(private_socket_t*))initialize;
434 this->setup_send_socket = (status_t(*)(private_socket_t*,u_int16_t, int*))setup_send_socket;
435
436 /* public functions */
437 this->public.send = (status_t(*)(socket_t*, packet_t*))sender;
438 this->public.receive = (status_t(*)(socket_t*, packet_t**))receiver;
439 this->public.destroy = (void(*)(socket_t*)) destroy;
440
441 this->logger = logger_manager->get_logger(logger_manager, SOCKET);
442
443 this->port = port;
444 this->natt_port = natt_port;
445
446 if (this->initialize(this) != SUCCESS)
447 {
448 free(this);
449 charon->kill(charon, "could not init socket!");
450 }
451
452 return (socket_t*)this;
453 }