8627ca76d20937531f99667b67f6da352b9c5fb4
[strongswan.git] / src / charon / network / socket.c
1 /*
2 * Copyright (C) 2006-2009 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2007 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /* for struct in6_pktinfo */
20 #define _GNU_SOURCE
21
22 #include <pthread.h>
23 #include <sys/types.h>
24 #include <sys/socket.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <unistd.h>
28 #include <stdlib.h>
29 #include <fcntl.h>
30 #include <sys/ioctl.h>
31 #include <netinet/in_systm.h>
32 #include <netinet/in.h>
33 #include <netinet/ip.h>
34 #include <netinet/ip6.h>
35 #include <netinet/udp.h>
36 #include <net/if.h>
37
38 #include "socket.h"
39
40 #include <daemon.h>
41
42 /* length of non-esp marker */
43 #define MARKER_LEN sizeof(u_int32_t)
44
45 /* from linux/udp.h */
46 #ifndef UDP_ENCAP
47 #define UDP_ENCAP 100
48 #endif /*UDP_ENCAP*/
49
50 #ifndef UDP_ENCAP_ESPINUDP
51 #define UDP_ENCAP_ESPINUDP 2
52 #endif /*UDP_ENCAP_ESPINUDP*/
53
54 /* these are not defined on some platforms */
55 #ifndef SOL_IP
56 #define SOL_IP IPPROTO_IP
57 #endif
58 #ifndef SOL_IPV6
59 #define SOL_IPV6 IPPROTO_IPV6
60 #endif
61 #ifndef SOL_UDP
62 #define SOL_UDP IPPROTO_UDP
63 #endif
64
65 /* IPV6_RECVPKTINFO is defined in RFC 3542 which obsoletes RFC 2292 that
66 * previously defined IPV6_PKTINFO */
67 #ifndef IPV6_RECVPKTINFO
68 #define IPV6_RECVPKTINFO IPV6_PKTINFO;
69 #endif
70
71
72 typedef struct private_socket_t private_socket_t;
73
74 /**
75 * Private data of an socket_t object
76 */
77 struct private_socket_t {
78 /**
79 * public functions
80 */
81 socket_t public;
82
83 /**
84 * IPv4 socket (500)
85 */
86 int ipv4;
87
88 /**
89 * IPv4 socket for NATT (4500)
90 */
91 int ipv4_natt;
92
93 /**
94 * IPv6 socket (500)
95 */
96 int ipv6;
97
98 /**
99 * IPv6 socket for NATT (4500)
100 */
101 int ipv6_natt;
102 };
103
104 /**
105 * implementation of socket_t.receive
106 */
107 static status_t receiver(private_socket_t *this, packet_t **packet)
108 {
109 char buffer[MAX_PACKET];
110 chunk_t data;
111 packet_t *pkt;
112 host_t *source = NULL, *dest = NULL;
113 int bytes_read = 0;
114 int data_offset, oldstate;
115 fd_set rfds;
116 int max_fd = 0, selected = 0;
117 u_int16_t port = 0;
118
119 FD_ZERO(&rfds);
120
121 if (this->ipv4)
122 {
123 FD_SET(this->ipv4, &rfds);
124 }
125 if (this->ipv4_natt)
126 {
127 FD_SET(this->ipv4_natt, &rfds);
128 }
129 if (this->ipv6)
130 {
131 FD_SET(this->ipv6, &rfds);
132 }
133 if (this->ipv6_natt)
134 {
135 FD_SET(this->ipv6_natt, &rfds);
136 }
137 max_fd = max(max(this->ipv4, this->ipv4_natt), max(this->ipv6, this->ipv6_natt));
138
139 DBG2(DBG_NET, "waiting for data on sockets");
140 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
141 if (select(max_fd + 1, &rfds, NULL, NULL, NULL) <= 0)
142 {
143 pthread_setcancelstate(oldstate, NULL);
144 return FAILED;
145 }
146 pthread_setcancelstate(oldstate, NULL);
147
148 if (FD_ISSET(this->ipv4, &rfds))
149 {
150 port = IKEV2_UDP_PORT;
151 selected = this->ipv4;
152 }
153 if (FD_ISSET(this->ipv4_natt, &rfds))
154 {
155 port = IKEV2_NATT_PORT;
156 selected = this->ipv4_natt;
157 }
158 if (FD_ISSET(this->ipv6, &rfds))
159 {
160 port = IKEV2_UDP_PORT;
161 selected = this->ipv6;
162 }
163 if (FD_ISSET(this->ipv6_natt, &rfds))
164 {
165 port = IKEV2_NATT_PORT;
166 selected = this->ipv6_natt;
167 }
168 if (selected)
169 {
170 struct msghdr msg;
171 struct cmsghdr *cmsgptr;
172 struct iovec iov;
173 char ancillary[64];
174 union {
175 struct sockaddr_in in4;
176 struct sockaddr_in6 in6;
177 } src;
178
179 msg.msg_name = &src;
180 msg.msg_namelen = sizeof(src);
181 iov.iov_base = buffer;
182 iov.iov_len = sizeof(buffer);
183 msg.msg_iov = &iov;
184 msg.msg_iovlen = 1;
185 msg.msg_control = ancillary;
186 msg.msg_controllen = sizeof(ancillary);
187 msg.msg_flags = 0;
188 bytes_read = recvmsg(selected, &msg, 0);
189 if (bytes_read < 0)
190 {
191 DBG1(DBG_NET, "error reading socket: %s", strerror(errno));
192 return FAILED;
193 }
194 DBG3(DBG_NET, "received packet %b", buffer, bytes_read);
195
196 if (bytes_read < MARKER_LEN)
197 {
198 DBG3(DBG_NET, "received packet too short (%d bytes)",
199 bytes_read);
200 return FAILED;
201 }
202
203 /* read ancillary data to get destination address */
204 for (cmsgptr = CMSG_FIRSTHDR(&msg); cmsgptr != NULL;
205 cmsgptr = CMSG_NXTHDR(&msg, cmsgptr))
206 {
207 if (cmsgptr->cmsg_len == 0)
208 {
209 DBG1(DBG_NET, "error reading ancillary data");
210 return FAILED;
211 }
212
213 if (cmsgptr->cmsg_level == SOL_IPV6 &&
214 cmsgptr->cmsg_type == IPV6_PKTINFO)
215 {
216 struct in6_pktinfo *pktinfo;
217 pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsgptr);
218 struct sockaddr_in6 dst;
219
220 memset(&dst, 0, sizeof(dst));
221 memcpy(&dst.sin6_addr, &pktinfo->ipi6_addr, sizeof(dst.sin6_addr));
222 dst.sin6_family = AF_INET6;
223 dst.sin6_port = htons(port);
224 dest = host_create_from_sockaddr((sockaddr_t*)&dst);
225 }
226 if (cmsgptr->cmsg_level == SOL_IP &&
227 #ifdef IP_PKTINFO
228 cmsgptr->cmsg_type == IP_PKTINFO
229 #elif defined(IP_RECVDSTADDR)
230 cmsgptr->cmsg_type == IP_RECVDSTADDR
231 #else
232 FALSE
233 #endif
234 )
235 {
236 struct in_addr *addr;
237 struct sockaddr_in dst;
238
239 #ifdef IP_PKTINFO
240 struct in_pktinfo *pktinfo;
241 pktinfo = (struct in_pktinfo*)CMSG_DATA(cmsgptr);
242 addr = &pktinfo->ipi_addr;
243 #elif defined(IP_RECVDSTADDR)
244 addr = (struct in_addr*)CMSG_DATA(cmsgptr);
245 #endif
246 memset(&dst, 0, sizeof(dst));
247 memcpy(&dst.sin_addr, addr, sizeof(dst.sin_addr));
248
249 dst.sin_family = AF_INET;
250 dst.sin_port = htons(port);
251 dest = host_create_from_sockaddr((sockaddr_t*)&dst);
252 }
253 if (dest)
254 {
255 break;
256 }
257 }
258 if (dest == NULL)
259 {
260 DBG1(DBG_NET, "error reading IP header");
261 return FAILED;
262 }
263 source = host_create_from_sockaddr((sockaddr_t*)&src);
264
265 pkt = packet_create();
266 pkt->set_source(pkt, source);
267 pkt->set_destination(pkt, dest);
268 DBG2(DBG_NET, "received packet: from %#H to %#H", source, dest);
269 data_offset = 0;
270 /* remove non esp marker */
271 if (dest->get_port(dest) == IKEV2_NATT_PORT)
272 {
273 data_offset += MARKER_LEN;
274 }
275 /* fill in packet */
276 data.len = bytes_read - data_offset;
277 data.ptr = malloc(data.len);
278 memcpy(data.ptr, buffer + data_offset, data.len);
279 pkt->set_data(pkt, data);
280 }
281 else
282 {
283 /* oops, shouldn't happen */
284 return FAILED;
285 }
286 /* return packet */
287 *packet = pkt;
288 return SUCCESS;
289 }
290
291 /**
292 * implementation of socket_t.send
293 */
294 status_t sender(private_socket_t *this, packet_t *packet)
295 {
296 int sport, skt, family;
297 ssize_t bytes_sent;
298 chunk_t data, marked;
299 host_t *src, *dst;
300 struct msghdr msg;
301 struct cmsghdr *cmsg;
302 struct iovec iov;
303
304 src = packet->get_source(packet);
305 dst = packet->get_destination(packet);
306 data = packet->get_data(packet);
307
308 DBG2(DBG_NET, "sending packet: from %#H to %#H", src, dst);
309
310 /* send data */
311 sport = src->get_port(src);
312 family = dst->get_family(dst);
313 if (sport == IKEV2_UDP_PORT)
314 {
315 if (family == AF_INET)
316 {
317 skt = this->ipv4;
318 }
319 else
320 {
321 skt = this->ipv6;
322 }
323 }
324 else if (sport == IKEV2_NATT_PORT)
325 {
326 if (family == AF_INET)
327 {
328 skt = this->ipv4_natt;
329 }
330 else
331 {
332 skt = this->ipv6_natt;
333 }
334 /* NAT keepalives without marker */
335 if (data.len != 1 || data.ptr[0] != 0xFF)
336 {
337 /* add non esp marker to packet */
338 if (data.len > MAX_PACKET - MARKER_LEN)
339 {
340 DBG1(DBG_NET, "unable to send packet: it's too big (%d bytes)",
341 data.len);
342 return FAILED;
343 }
344 marked = chunk_alloc(data.len + MARKER_LEN);
345 memset(marked.ptr, 0, MARKER_LEN);
346 memcpy(marked.ptr + MARKER_LEN, data.ptr, data.len);
347 /* let the packet do the clean up for us */
348 packet->set_data(packet, marked);
349 data = marked;
350 }
351 }
352 else
353 {
354 DBG1(DBG_NET, "unable to locate a send socket for port %d", sport);
355 return FAILED;
356 }
357
358 memset(&msg, 0, sizeof(struct msghdr));
359 msg.msg_name = dst->get_sockaddr(dst);;
360 msg.msg_namelen = *dst->get_sockaddr_len(dst);
361 iov.iov_base = data.ptr;
362 iov.iov_len = data.len;
363 msg.msg_iov = &iov;
364 msg.msg_iovlen = 1;
365 msg.msg_flags = 0;
366
367 if (!src->is_anyaddr(src))
368 {
369 if (family == AF_INET)
370 {
371 #if defined(IP_PKTINFO) || defined(IP_SENDSRCADDR)
372 struct in_addr *addr;
373 struct sockaddr_in *sin;
374 #ifdef IP_PKTINFO
375 char buf[CMSG_SPACE(sizeof(struct in_pktinfo))];
376 struct in_pktinfo *pktinfo;
377 #elif defined(IP_SENDSRCADDR)
378 char buf[CMSG_SPACE(sizeof(struct in_addr))];
379 #endif
380 msg.msg_control = buf;
381 msg.msg_controllen = sizeof(buf);
382 cmsg = CMSG_FIRSTHDR(&msg);
383 cmsg->cmsg_level = SOL_IP;
384 #ifdef IP_PKTINFO
385 cmsg->cmsg_type = IP_PKTINFO;
386 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
387 pktinfo = (struct in_pktinfo*)CMSG_DATA(cmsg);
388 memset(pktinfo, 0, sizeof(struct in_pktinfo));
389 addr = &pktinfo->ipi_spec_dst;
390 #elif defined(IP_SENDSRCADDR)
391 cmsg->cmsg_type = IP_SENDSRCADDR;
392 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
393 addr = (struct in_addr*)CMSG_DATA(cmsg);
394 #endif
395 sin = (struct sockaddr_in*)src->get_sockaddr(src);
396 memcpy(addr, &sin->sin_addr, sizeof(struct in_addr));
397 #endif /* IP_PKTINFO || IP_SENDSRCADDR */
398 }
399 else
400 {
401 char buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
402 struct in6_pktinfo *pktinfo;
403 struct sockaddr_in6 *sin;
404
405 msg.msg_control = buf;
406 msg.msg_controllen = sizeof(buf);
407 cmsg = CMSG_FIRSTHDR(&msg);
408 cmsg->cmsg_level = SOL_IPV6;
409 cmsg->cmsg_type = IPV6_PKTINFO;
410 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
411 pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsg);
412 memset(pktinfo, 0, sizeof(struct in6_pktinfo));
413 sin = (struct sockaddr_in6*)src->get_sockaddr(src);
414 memcpy(&pktinfo->ipi6_addr, &sin->sin6_addr, sizeof(struct in6_addr));
415 }
416 }
417
418 bytes_sent = sendmsg(skt, &msg, 0);
419
420 if (bytes_sent != data.len)
421 {
422 DBG1(DBG_NET, "error writing to socket: %s", strerror(errno));
423 return FAILED;
424 }
425 return SUCCESS;
426 }
427
428 /**
429 * open a socket to send and receive packets
430 */
431 static int open_socket(private_socket_t *this, int family, u_int16_t port)
432 {
433 int on = TRUE;
434 int type = UDP_ENCAP_ESPINUDP;
435 struct sockaddr_storage addr;
436 socklen_t addrlen;
437 u_int sol, pktinfo = 0;
438 int skt;
439
440 memset(&addr, 0, sizeof(addr));
441 /* precalculate constants depending on address family */
442 switch (family)
443 {
444 case AF_INET:
445 {
446 struct sockaddr_in *sin = (struct sockaddr_in *)&addr;
447 sin->sin_family = AF_INET;
448 sin->sin_addr.s_addr = INADDR_ANY;
449 sin->sin_port = htons(port);
450 addrlen = sizeof(struct sockaddr_in);
451 sol = SOL_IP;
452 #ifdef IP_PKTINFO
453 pktinfo = IP_PKTINFO;
454 #elif defined(IP_RECVDSTADDR)
455 pktinfo = IP_RECVDSTADDR;
456 #endif
457 break;
458 }
459 case AF_INET6:
460 {
461 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&addr;
462 sin6->sin6_family = AF_INET6;
463 memcpy(&sin6->sin6_addr, &in6addr_any, sizeof(in6addr_any));
464 sin6->sin6_port = htons(port);
465 addrlen = sizeof(struct sockaddr_in6);
466 sol = SOL_IPV6;
467 pktinfo = IPV6_RECVPKTINFO;
468 break;
469 }
470 default:
471 return 0;
472 }
473
474 skt = socket(family, SOCK_DGRAM, IPPROTO_UDP);
475 if (skt < 0)
476 {
477 DBG1(DBG_NET, "could not open socket: %s", strerror(errno));
478 return 0;
479 }
480 if (setsockopt(skt, SOL_SOCKET, SO_REUSEADDR, (void*)&on, sizeof(on)) < 0)
481 {
482 DBG1(DBG_NET, "unable to set SO_REUSEADDR on socket: %s", strerror(errno));
483 close(skt);
484 return 0;
485 }
486
487 /* bind the socket */
488 if (bind(skt, (struct sockaddr *)&addr, addrlen) < 0)
489 {
490 DBG1(DBG_NET, "unable to bind socket: %s", strerror(errno));
491 close(skt);
492 return 0;
493 }
494
495 /* get additional packet info on receive */
496 if (pktinfo > 0)
497 {
498 if (setsockopt(skt, sol, pktinfo, &on, sizeof(on)) < 0)
499 {
500 DBG1(DBG_NET, "unable to set IP_PKTINFO on socket: %s", strerror(errno));
501 close(skt);
502 return 0;
503 }
504 }
505
506 /* enable UDP decapsulation globally, only for one socket needed */
507 if (family == AF_INET && port == IKEV2_NATT_PORT &&
508 setsockopt(skt, SOL_UDP, UDP_ENCAP, &type, sizeof(type)) < 0)
509 {
510 DBG1(DBG_NET, "unable to set UDP_ENCAP: %s", strerror(errno));
511 }
512 return skt;
513 }
514
515 /**
516 * enumerator for underlying sockets
517 */
518 typedef struct {
519 /** implements enumerator_t */
520 enumerator_t public;
521 /** sockets we enumerate */
522 private_socket_t *socket;
523 /** counter */
524 int index;
525 } socket_enumerator_t;
526
527 /**
528 * enumerate function for socket_enumerator_t
529 */
530 static bool enumerate(socket_enumerator_t *this, int *fd, int *family, int *port)
531 {
532 static const struct {
533 int fd_offset;
534 int family;
535 int port;
536 } sockets[] = {
537 { offsetof(private_socket_t, ipv4), AF_INET, IKEV2_UDP_PORT },
538 { offsetof(private_socket_t, ipv6), AF_INET6, IKEV2_UDP_PORT },
539 { offsetof(private_socket_t, ipv4_natt), AF_INET, IKEV2_NATT_PORT },
540 { offsetof(private_socket_t, ipv6_natt), AF_INET6, IKEV2_NATT_PORT }
541 };
542
543 while(++this->index < countof(sockets))
544 {
545 int sock = *(int*)((char*)this->socket + sockets[this->index].fd_offset);
546 if (!sock)
547 {
548 continue;
549 }
550 *fd = sock;
551 *family = sockets[this->index].family;
552 *port = sockets[this->index].port;
553 return TRUE;
554 }
555 return FALSE;
556 }
557
558 /**
559 * implementation of socket_t.create_enumerator
560 */
561 static enumerator_t *create_enumerator(private_socket_t *this)
562 {
563 socket_enumerator_t *enumerator;
564
565 enumerator = malloc_thing(socket_enumerator_t);
566 enumerator->index = -1;
567 enumerator->socket = this;
568 enumerator->public.enumerate = (void*)enumerate;
569 enumerator->public.destroy = (void*)free;
570 return &enumerator->public;
571 }
572
573 /**
574 * implementation of socket_t.destroy
575 */
576 static void destroy(private_socket_t *this)
577 {
578 if (this->ipv4)
579 {
580 close(this->ipv4);
581 }
582 if (this->ipv4_natt)
583 {
584 close(this->ipv4_natt);
585 }
586 if (this->ipv6)
587 {
588 close(this->ipv6);
589 }
590 if (this->ipv6_natt)
591 {
592 close(this->ipv6_natt);
593 }
594 free(this);
595 }
596
597 /*
598 * See header for description
599 */
600 socket_t *socket_create()
601 {
602 private_socket_t *this = malloc_thing(private_socket_t);
603
604 /* public functions */
605 this->public.send = (status_t(*)(socket_t*, packet_t*))sender;
606 this->public.receive = (status_t(*)(socket_t*, packet_t**))receiver;
607 this->public.create_enumerator = (enumerator_t*(*)(socket_t*))create_enumerator;
608 this->public.destroy = (void(*)(socket_t*)) destroy;
609
610 this->ipv4 = 0;
611 this->ipv6 = 0;
612 this->ipv4_natt = 0;
613 this->ipv6_natt = 0;
614
615 this->ipv4 = open_socket(this, AF_INET, IKEV2_UDP_PORT);
616 if (this->ipv4 == 0)
617 {
618 DBG1(DBG_NET, "could not open IPv4 socket, IPv4 disabled");
619 }
620 else
621 {
622 this->ipv4_natt = open_socket(this, AF_INET, IKEV2_NATT_PORT);
623 if (this->ipv4_natt == 0)
624 {
625 DBG1(DBG_NET, "could not open IPv4 NAT-T socket");
626 }
627 }
628
629 this->ipv6 = open_socket(this, AF_INET6, IKEV2_UDP_PORT);
630 if (this->ipv6 == 0)
631 {
632 DBG1(DBG_NET, "could not open IPv6 socket, IPv6 disabled");
633 }
634 else
635 {
636 this->ipv6_natt = open_socket(this, AF_INET6, IKEV2_NATT_PORT);
637 if (this->ipv6_natt == 0)
638 {
639 DBG1(DBG_NET, "could not open IPv6 NAT-T socket");
640 }
641 }
642
643 if (!this->ipv4 && !this->ipv6)
644 {
645 DBG1(DBG_NET, "could not create any sockets");
646 destroy(this);
647 charon->kill(charon, "socket initialization failed");
648 }
649 return (socket_t*)this;
650 }
651