first merge of NATT code
[strongswan.git] / src / charon / network / socket.c
1 /**
2 * @file socket.c
3 *
4 * @brief Implementation of socket_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005 Jan Hutter, Martin Willi
11 * Hochschule fuer Technik Rapperswil
12 * Copyright (C) 1998-2002 D. Hugh Redelmeier.
13 * Copyright (C) 1997 Angelos D. Keromytis.
14 *
15 * Some parts of interface lookup code from pluto.
16 *
17 * This program is free software; you can redistribute it and/or modify it
18 * under the terms of the GNU General Public License as published by the
19 * Free Software Foundation; either version 2 of the License, or (at your
20 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
21 *
22 * This program is distributed in the hope that it will be useful, but
23 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
24 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
25 * for more details.
26 */
27
28 #include <pthread.h>
29 #include <sys/types.h>
30 #include <sys/socket.h>
31 #include <string.h>
32 #include <errno.h>
33 #include <unistd.h>
34 #include <stdlib.h>
35 #include <fcntl.h>
36 #include <sys/ioctl.h>
37 #include <netinet/in.h>
38 #include <netinet/ip.h>
39 #include <netinet/udp.h>
40 #include <linux/ipsec.h>
41 #include <linux/filter.h>
42
43 #include "socket.h"
44
45 #include <daemon.h>
46 #include <utils/logger_manager.h>
47
48 /* constants for packet handling */
49 #define IP_LEN sizeof(struct iphdr)
50 #define UDP_LEN sizeof(struct udphdr)
51 #define MARKER_LEN sizeof(u_int32_t)
52
53 /* offsets for packet handling */
54 #define IP 0
55 #define UDP IP + IP_LEN
56 #define IKE UDP + UDP_LEN
57
58 /* from linux/in.h */
59 #ifndef IP_IPSEC_POLICY
60 #define IP_IPSEC_POLICY 16
61 #endif /*IP_IPSEC_POLICY*/
62
63 typedef struct private_socket_t private_socket_t;
64
65 /**
66 * Private data of an socket_t object
67 */
68 struct private_socket_t{
69 /**
70 * public functions
71 */
72 socket_t public;
73
74 /**
75 * regular port
76 */
77 int port;
78
79 /**
80 * port used for nat-t
81 */
82 int natt_port;
83
84 /**
85 * raw socket (receiver)
86 */
87 int raw_fd;
88
89 /**
90 * send socket on regular port
91 */
92 int send_fd;
93
94 /**
95 * send socket on nat-t port
96 */
97 int natt_fd;
98
99 /**
100 * logger for this socket
101 */
102 logger_t *logger;
103
104 /**
105 * Setup a send socket
106 *
107 * @param this calling object
108 * @param port the port
109 * @param send_fd returns the file descriptor of this new socket
110 */
111 status_t (*setup_send_socket) (private_socket_t *this, u_int16_t port, int *send_fd);
112
113 /**
114 * Initialize
115 *
116 * @param this calling object
117 */
118 status_t (*initialize) (private_socket_t *this);
119 };
120
121 /**
122 * implementation of socket_t.receive
123 */
124 static status_t receiver(private_socket_t *this, packet_t **packet)
125 {
126 char buffer[MAX_PACKET];
127 chunk_t data;
128 packet_t *pkt;
129 struct iphdr *ip;
130 struct udphdr *udp;
131 host_t *source, *dest;
132 int bytes_read = 0;
133 int data_offset, oldstate;
134
135 this->logger->log(this->logger, CONTROL|LEVEL1, "receive from raw socket");
136 /* allow cancellation while blocking on recv() */
137 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
138 bytes_read = recv(this->raw_fd, buffer, MAX_PACKET, 0);
139 pthread_setcancelstate(oldstate, NULL);
140
141 if (bytes_read < 0)
142 {
143 this->logger->log(this->logger, ERROR, "error reading from socket: %s", strerror(errno));
144 return FAILED;
145 }
146
147 /* read source/dest from raw IP/UDP header */
148 ip = (struct iphdr*) buffer;
149 udp = (struct udphdr*) (buffer + IP_LEN);
150
151 source = host_create_from_hdr(ip->saddr, udp->source);
152 dest = host_create_from_hdr(ip->daddr, udp->dest);
153
154 pkt = packet_create();
155 pkt->set_source(pkt, source);
156 pkt->set_destination(pkt, dest);
157
158 this->logger->log(this->logger, CONTROL, "received packet: from %s:%d to %s:%d",
159 source->get_address(source), source->get_port(source),
160 dest->get_address(dest), dest->get_port(dest));
161
162 data_offset = IP_LEN + UDP_LEN;
163
164 /* remove non esp marker */
165 if (dest->get_port(dest) == this->natt_port)
166 {
167 data_offset += MARKER_LEN;
168 }
169
170 /* fill in packet */
171 data.len = bytes_read - data_offset;
172 data.ptr = malloc(data.len);
173 memcpy(data.ptr, buffer + data_offset, data.len);
174 pkt->set_data(pkt, data);
175
176 /* return packet */
177 *packet = pkt;
178
179 return SUCCESS;
180 }
181
182 /**
183 * implementation of socket_t.send
184 */
185 status_t sender(private_socket_t *this, packet_t *packet)
186 {
187 int sport, fd;
188 ssize_t bytes_sent;
189 chunk_t data, marked;
190 host_t *src, *dst;
191
192 src = packet->get_source(packet);
193 dst = packet->get_destination(packet);
194 data = packet->get_data(packet);
195
196 this->logger->log(this->logger, CONTROL, "sending packet: from %s:%d to %s:%d",
197 src->get_address(src), src->get_port(src),
198 dst->get_address(dst), dst->get_port(dst));
199
200 /* send data */
201 sport = src->get_port(src);
202 if (sport == this->port)
203 {
204 fd = this->send_fd;
205 }
206 else if (sport == this->natt_port)
207 {
208 fd = this->natt_fd;
209 /* NAT keepalives without marker */
210 if (data.len != 1 || data.ptr[0] != 0xFF)
211 {
212 /* add non esp marker to packet */
213 if (data.len > MAX_PACKET - MARKER_LEN)
214 {
215 this->logger->log(this->logger, ERROR, "unable to send packet: it's too big");
216 return FAILED;
217 }
218 marked = chunk_alloc(data.len + MARKER_LEN);
219 memset(marked.ptr, 0, MARKER_LEN);
220 memcpy(marked.ptr + MARKER_LEN, data.ptr, data.len);
221 packet->set_data(packet, marked); /* let the packet do the clean up for us */
222 data = marked;
223 }
224 }
225 else
226 {
227 this->logger->log(this->logger, ERROR, "unable to locate a send socket for port: %d", sport);
228 return FAILED;
229 }
230
231 bytes_sent = sendto(fd, data.ptr, data.len, 0,
232 dst->get_sockaddr(dst), *(dst->get_sockaddr_len(dst)));
233
234 if (bytes_sent != data.len)
235 {
236 this->logger->log(this->logger, ERROR, "error writing to socket: %s", strerror(errno));
237 return FAILED;
238 }
239
240 return SUCCESS;
241 }
242
243 /**
244 * setup a send socket on a specified port
245 */
246 static status_t setup_send_socket(private_socket_t *this, u_int16_t port, int *send_fd) {
247 int on = TRUE;
248 struct sockaddr_in addr;
249 int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
250 if (fd < 0)
251 {
252 this->logger->log(this->logger, ERROR, "could not open IPv4 send socket!");
253 return FAILED;
254 }
255
256 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (void*)&on, sizeof(on)) < 0)
257 {
258 this->logger->log(this->logger, ERROR, "unable to set SO_REUSEADDR on send socket!");
259 close(fd);
260 return FAILED;
261 }
262
263 struct sadb_x_policy policy;
264 int level, opt;
265
266 policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t);
267 policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
268 policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
269 policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
270 policy.sadb_x_policy_reserved = 0;
271 policy.sadb_x_policy_id = 0;
272
273 /* ipv6
274 * level = IPPROTO_IPV6;
275 * opt = IPV6_IPSEC_POLICY;
276 */
277 level = IPPROTO_IP;
278 opt = IP_IPSEC_POLICY;
279
280 if (setsockopt(fd, level, opt, &policy, sizeof(policy)) < 0)
281 {
282 this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on send socket!");
283 close(fd);
284 return FAILED;
285 }
286
287 policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
288
289 if (setsockopt(fd, level, opt, &policy, sizeof(policy)) < 0)
290 {
291 this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on send socket!");
292 close(fd);
293 return FAILED;
294 }
295
296 /* bind the send socket */
297 addr.sin_family = AF_INET;
298 addr.sin_addr.s_addr = INADDR_ANY;
299 addr.sin_port = htons(port);
300 if (bind(fd, (struct sockaddr*)&addr, sizeof(addr)) < 0)
301 {
302 this->logger->log(this->logger, ERROR, "unable to bind send socket: %s!", strerror(errno));
303 return FAILED;
304 }
305
306 *send_fd = fd;
307 return SUCCESS;
308 }
309
310 /**
311 * Initialize all sub sockets
312 */
313 static status_t initialize(private_socket_t *this)
314 {
315 /* This filter code filters out all non-IKEv2 traffic on
316 * a SOCK_RAW IP_PROTP_UDP socket. Handling of other
317 * IKE versions is done in pluto.
318 */
319 struct sock_filter ikev2_filter_code[] =
320 {
321 /* Protocol must be UDP */
322 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, IP + 9),
323 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_UDP, 0, 15),
324 /* Destination Port must be either port or natt_port */
325 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, UDP + 2),
326 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, this->port, 1, 0),
327 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, this->natt_port, 5, 12),
328 /* port */
329 /* IKE version must be 2.0 */
330 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, IKE + 17),
331 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x20, 0, 10),
332 /* packet length is length in IKEv2 header + ip header + udp header */
333 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, IKE + 24),
334 BPF_STMT(BPF_ALU+BPF_ADD+BPF_K, IP_LEN + UDP_LEN),
335 BPF_STMT(BPF_RET+BPF_A, 0),
336 /* natt_port */
337 /* nat-t: check for marker */
338 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, IKE),
339 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 0, 5),
340 /* nat-t: IKE version must be 2.0 */
341 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, IKE + MARKER_LEN + 17),
342 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x20, 0, 3),
343 /* nat-t: packet length is length in IKEv2 header + ip header + udp header + non esp marker */
344 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, IKE + MARKER_LEN + 24),
345 BPF_STMT(BPF_ALU+BPF_ADD+BPF_K, IP_LEN + UDP_LEN + MARKER_LEN),
346 BPF_STMT(BPF_RET+BPF_A, 0),
347 /* packet doesn't match, ignore */
348 BPF_STMT(BPF_RET+BPF_K, 0),
349 };
350
351 /* Filter struct to use with setsockopt */
352 struct sock_fprog ikev2_filter = {
353 sizeof(ikev2_filter_code) / sizeof(struct sock_filter),
354 ikev2_filter_code
355 };
356
357 /* set up raw socket */
358 this->raw_fd = socket(PF_INET, SOCK_RAW, IPPROTO_UDP);
359 if (this->raw_fd < 0)
360 {
361 this->logger->log(this->logger, ERROR, "unable to create raw socket!");
362 return FAILED;
363 }
364
365 if (setsockopt(this->raw_fd, SOL_SOCKET, SO_ATTACH_FILTER, &ikev2_filter, sizeof(ikev2_filter)) < 0)
366 {
367 this->logger->log(this->logger, ERROR, "unable to attach IKEv2 filter to raw socket!");
368 close(this->raw_fd);
369 return FAILED;
370 }
371
372 /* setup the send sockets */
373 if (this->setup_send_socket(this, this->port, &this->send_fd) != SUCCESS)
374 {
375 this->logger->log(this->logger, ERROR, "unable to setup send socket on port %d!", this->port);
376 return FAILED;
377 }
378
379 if (this->setup_send_socket(this, this->natt_port, &this->natt_fd) != SUCCESS)
380 {
381 this->logger->log(this->logger, ERROR, "unable to setup send socket on port %d!", this->natt_port);
382 return FAILED;
383 }
384
385 return SUCCESS;
386 }
387
388 /**
389 * implementation of socket_t.destroy
390 */
391 static void destroy(private_socket_t *this)
392 {
393 close(this->natt_fd);
394 close(this->send_fd);
395 close(this->raw_fd);
396 free(this);
397 }
398
399 /*
400 * See header for description
401 */
402 socket_t *socket_create(u_int16_t port, u_int16_t natt_port)
403 {
404 private_socket_t *this = malloc_thing(private_socket_t);
405
406 /* private functions */
407 this->initialize = (status_t(*)(private_socket_t*))initialize;
408 this->setup_send_socket = (status_t(*)(private_socket_t*,u_int16_t, int*))setup_send_socket;
409
410 /* public functions */
411 this->public.send = (status_t(*)(socket_t*, packet_t*))sender;
412 this->public.receive = (status_t(*)(socket_t*, packet_t**))receiver;
413 this->public.destroy = (void(*)(socket_t*)) destroy;
414
415 this->logger = logger_manager->get_logger(logger_manager, SOCKET);
416
417 this->port = port;
418 this->natt_port = natt_port;
419
420 if (this->initialize(this) != SUCCESS)
421 {
422 free(this);
423 charon->kill(charon, "could not init socket!");
424 }
425
426 return (socket_t*)this;
427 }