13bf3e775ed49d487df41439b2d3fd530cd8f33a
[strongswan.git] / src / libcharon / plugins / socket_default / socket_default_socket.c
1 /*
2 * Copyright (C) 2006-2013 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2010 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /* for struct in6_pktinfo */
20 #define _GNU_SOURCE
21 #ifdef __sun
22 #define _XPG4_2
23 #define __EXTENSIONS__
24 #endif
25 /* make sure to use the proper defs on Mac OS X */
26 #define __APPLE_USE_RFC_3542
27
28 #include "socket_default_socket.h"
29
30 #include <sys/types.h>
31 #include <sys/socket.h>
32 #include <string.h>
33 #include <errno.h>
34 #include <unistd.h>
35 #include <stdlib.h>
36 #include <fcntl.h>
37 #include <sys/ioctl.h>
38 #include <netinet/in_systm.h>
39 #include <netinet/in.h>
40 #include <netinet/ip.h>
41 #include <netinet/udp.h>
42 #include <net/if.h>
43
44 #include <hydra.h>
45 #include <daemon.h>
46 #include <threading/thread.h>
47
48 /* these are not defined on some platforms */
49 #ifndef SOL_IP
50 #define SOL_IP IPPROTO_IP
51 #endif
52 #ifndef SOL_IPV6
53 #define SOL_IPV6 IPPROTO_IPV6
54 #endif
55 #ifndef IPV6_TCLASS
56 #define IPV6_TCLASS 67
57 #endif
58
59 /* IPV6_RECVPKTINFO is defined in RFC 3542 which obsoletes RFC 2292 that
60 * previously defined IPV6_PKTINFO */
61 #ifndef IPV6_RECVPKTINFO
62 #define IPV6_RECVPKTINFO IPV6_PKTINFO
63 #endif
64
65 #ifndef IN6ADDR_ANY_INIT
66 #define IN6ADDR_ANY_INIT {{{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}}}
67 #endif
68
69 #ifndef HAVE_IN6ADDR_ANY
70 static const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
71 #endif
72
73 typedef struct private_socket_default_socket_t private_socket_default_socket_t;
74
75 /**
76 * Private data of an socket_t object
77 */
78 struct private_socket_default_socket_t {
79
80 /**
81 * public functions
82 */
83 socket_default_socket_t public;
84
85 /**
86 * Configured port (or random, if initially 0)
87 */
88 u_int16_t port;
89
90 /**
91 * Configured port for NAT-T (or random, if initially 0)
92 */
93 u_int16_t natt;
94
95 /**
96 * IPv4 socket (500 or port)
97 */
98 int ipv4;
99
100 /**
101 * IPv4 socket for NAT-T (4500 or natt)
102 */
103 int ipv4_natt;
104
105 /**
106 * IPv6 socket (500 or port)
107 */
108 int ipv6;
109
110 /**
111 * IPv6 socket for NAT-T (4500 or natt)
112 */
113 int ipv6_natt;
114
115 /**
116 * DSCP value set on IPv4 socket
117 */
118 u_int8_t dscp4;
119
120 /**
121 * DSCP value set on IPv4 socket for NAT-T (4500 or natt)
122 */
123 u_int8_t dscp4_natt;
124
125 /**
126 * DSCP value set on IPv6 socket (500 or port)
127 */
128 u_int8_t dscp6;
129
130 /**
131 * DSCP value set on IPv6 socket for NAT-T (4500 or natt)
132 */
133 u_int8_t dscp6_natt;
134
135 /**
136 * Maximum packet size to receive
137 */
138 int max_packet;
139
140 /**
141 * TRUE if the source address should be set on outbound packets
142 */
143 bool set_source;
144
145 /**
146 * A counter to implement round-robin selection of read sockets
147 */
148 u_int rr_counter;
149 };
150
151 /**
152 * Get the destination IPv4 address of a received packet, depending on the
153 * available mechanism.
154 */
155 #ifdef IP_PKTINFO
156
157 static host_t *get_dst_v4(struct cmsghdr *cmsgptr, u_int16_t port)
158 {
159 struct sockaddr_in dst = {
160 .sin_family = AF_INET,
161 .sin_port = htons(port),
162 };
163 struct in_pktinfo *pktinfo;
164 struct in_addr *addr;
165
166 if (cmsgptr->cmsg_type == IP_PKTINFO)
167 {
168 pktinfo = (struct in_pktinfo*)CMSG_DATA(cmsgptr);
169 addr = &pktinfo->ipi_addr;
170 memcpy(&dst.sin_addr, addr, sizeof(dst.sin_addr));
171 return host_create_from_sockaddr((sockaddr_t*)&dst);
172 }
173 return NULL;
174 }
175
176 #elif defined(IP_RECVDSTADDR)
177
178 static host_t *get_dst_v4(struct cmsghdr *cmsgptr, u_int16_t port)
179 {
180 struct sockaddr_in dst = {
181 .sin_family = AF_INET,
182 .sin_port = htons(port),
183 };
184 struct in_addr *addr;
185
186 if (cmsgptr->cmsg_type == IP_RECVDSTADDR)
187 {
188 addr = (struct in_addr*)CMSG_DATA(cmsgptr);
189 memcpy(&dst.sin_addr, addr, sizeof(dst.sin_addr));
190 return host_create_from_sockaddr((sockaddr_t*)&dst);
191 }
192 return NULL;
193 }
194
195 #else /* IP_PKTINFO || IP_RECVDSTADDR */
196
197 static host_t *get_dst_v4(struct cmsghdr *cmsgptr, u_int16_t port)
198 {
199 return NULL;
200 }
201
202 #endif /* IP_PKTINFO || IP_RECVDSTADDR */
203
204 /**
205 * Get the destination IPv6 address of a received packet, depending on the
206 * available mechanism.
207 */
208 #ifdef HAVE_IN6_PKTINFO
209
210 static host_t *get_dst_v6(struct cmsghdr *cmsgptr, u_int16_t port)
211 {
212 struct in6_pktinfo *pktinfo;
213 struct sockaddr_in6 dst = {
214 .sin6_family = AF_INET6,
215 .sin6_port = htons(port),
216 };
217
218 if (cmsgptr->cmsg_type == IPV6_PKTINFO)
219 {
220 pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsgptr);
221 memcpy(&dst.sin6_addr, &pktinfo->ipi6_addr, sizeof(dst.sin6_addr));
222 return host_create_from_sockaddr((sockaddr_t*)&dst);
223 }
224 return NULL;
225 }
226
227 #else /* HAVE_IN6_PKTINFO */
228
229 static host_t *get_dst_v6(struct cmsghdr *cmsgptr, u_int16_t port)
230 {
231 return NULL;
232 }
233
234 #endif /* HAVE_IN6_PKTINFO */
235
236 METHOD(socket_t, receiver, status_t,
237 private_socket_default_socket_t *this, packet_t **packet)
238 {
239 char buffer[this->max_packet];
240 chunk_t data;
241 packet_t *pkt;
242 host_t *source = NULL, *dest = NULL;
243 int i, rr, index, bytes_read = 0, selected = -1;
244 bool oldstate;
245 u_int16_t port = 0;
246 struct pollfd pfd[] = {
247 { .fd = this->ipv4, .events = POLLIN },
248 { .fd = this->ipv4_natt, .events = POLLIN },
249 { .fd = this->ipv6, .events = POLLIN },
250 { .fd = this->ipv6_natt, .events = POLLIN },
251 };
252 int ports[] = {
253 /* port numbers associated to pollfds */
254 this->port, this->natt, this->port, this->natt,
255 };
256
257 DBG2(DBG_NET, "waiting for data on sockets");
258 oldstate = thread_cancelability(TRUE);
259 if (poll(pfd, countof(pfd), -1) <= 0)
260 {
261 thread_cancelability(oldstate);
262 return FAILED;
263 }
264 thread_cancelability(oldstate);
265
266 rr = this->rr_counter++;
267 for (i = 0; i < countof(pfd); i++)
268 {
269 /* To serve all ports with equal priority, we use a round-robin
270 * scheme to choose the one to process in this invocation */
271 index = (rr + i) % countof(pfd);
272 if (pfd[index].revents & POLLIN)
273 {
274 selected = pfd[index].fd;
275 port = ports[index];
276 break;
277 }
278 }
279 if (selected != -1)
280 {
281 struct msghdr msg;
282 struct cmsghdr *cmsgptr;
283 struct iovec iov;
284 char ancillary[64];
285 union {
286 struct sockaddr_in in4;
287 struct sockaddr_in6 in6;
288 } src;
289
290 msg.msg_name = &src;
291 msg.msg_namelen = sizeof(src);
292 iov.iov_base = buffer;
293 iov.iov_len = this->max_packet;
294 msg.msg_iov = &iov;
295 msg.msg_iovlen = 1;
296 msg.msg_control = ancillary;
297 msg.msg_controllen = sizeof(ancillary);
298 msg.msg_flags = 0;
299 bytes_read = recvmsg(selected, &msg, 0);
300 if (bytes_read < 0)
301 {
302 DBG1(DBG_NET, "error reading socket: %s", strerror(errno));
303 return FAILED;
304 }
305 if (msg.msg_flags & MSG_TRUNC)
306 {
307 DBG1(DBG_NET, "receive buffer too small, packet discarded");
308 return FAILED;
309 }
310 DBG3(DBG_NET, "received packet %b", buffer, bytes_read);
311
312 /* read ancillary data to get destination address */
313 for (cmsgptr = CMSG_FIRSTHDR(&msg); cmsgptr != NULL;
314 cmsgptr = CMSG_NXTHDR(&msg, cmsgptr))
315 {
316 if (cmsgptr->cmsg_len == 0)
317 {
318 DBG1(DBG_NET, "error reading ancillary data");
319 return FAILED;
320 }
321 if (cmsgptr->cmsg_level == SOL_IP)
322 {
323 dest = get_dst_v4(cmsgptr, port);
324 }
325 else if (cmsgptr->cmsg_level == SOL_IPV6)
326 {
327 dest = get_dst_v6(cmsgptr, port);
328 }
329 if (dest)
330 {
331 break;
332 }
333 }
334 if (dest == NULL)
335 {
336 DBG1(DBG_NET, "error reading IP header");
337 return FAILED;
338 }
339 source = host_create_from_sockaddr((sockaddr_t*)&src);
340
341 pkt = packet_create();
342 pkt->set_source(pkt, source);
343 pkt->set_destination(pkt, dest);
344 DBG2(DBG_NET, "received packet: from %#H to %#H", source, dest);
345 data = chunk_create(buffer, bytes_read);
346 pkt->set_data(pkt, chunk_clone(data));
347 }
348 else
349 {
350 /* oops, shouldn't happen */
351 return FAILED;
352 }
353 /* return packet */
354 *packet = pkt;
355 return SUCCESS;
356 }
357
358 /**
359 * Generic function to send a message.
360 */
361 static ssize_t send_msg_generic(int skt, struct msghdr *msg)
362 {
363 return sendmsg(skt, msg, 0);
364 }
365
366 /**
367 * Send a message with the IPv4 source address set, if possible.
368 */
369 #ifdef IP_PKTINFO
370
371 static ssize_t send_msg_v4(int skt, struct msghdr *msg, host_t *src)
372 {
373 char buf[CMSG_SPACE(sizeof(struct in_pktinfo))] = {};
374 struct cmsghdr *cmsg;
375 struct in_addr *addr;
376 struct in_pktinfo *pktinfo;
377 struct sockaddr_in *sin;
378
379 msg->msg_control = buf;
380 msg->msg_controllen = sizeof(buf);
381 cmsg = CMSG_FIRSTHDR(msg);
382 cmsg->cmsg_level = SOL_IP;
383 cmsg->cmsg_type = IP_PKTINFO;
384 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
385
386 pktinfo = (struct in_pktinfo*)CMSG_DATA(cmsg);
387 addr = &pktinfo->ipi_spec_dst;
388
389 sin = (struct sockaddr_in*)src->get_sockaddr(src);
390 memcpy(addr, &sin->sin_addr, sizeof(struct in_addr));
391 return send_msg_generic(skt, msg);
392 }
393
394 #elif defined(IP_SENDSRCADDR)
395
396 static ssize_t send_msg_v4(int skt, struct msghdr *msg, host_t *src)
397 {
398 char buf[CMSG_SPACE(sizeof(struct in_addr))] = {};
399 struct cmsghdr *cmsg;
400 struct in_addr *addr;
401 struct sockaddr_in *sin;
402
403 msg->msg_control = buf;
404 msg->msg_controllen = sizeof(buf);
405 cmsg = CMSG_FIRSTHDR(msg);
406 cmsg->cmsg_level = SOL_IP;
407 cmsg->cmsg_type = IP_SENDSRCADDR;
408 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
409
410 addr = (struct in_addr*)CMSG_DATA(cmsg);
411
412 sin = (struct sockaddr_in*)src->get_sockaddr(src);
413 memcpy(addr, &sin->sin_addr, sizeof(struct in_addr));
414 return send_msg_generic(skt, msg);
415 }
416
417 #else /* IP_PKTINFO || IP_RECVDSTADDR */
418
419 static ssize_t send_msg_v4(int skt, struct msghdr *msg, host_t *src)
420 {
421 return send_msg_generic(skt, msg);
422 }
423
424 #endif /* IP_PKTINFO || IP_RECVDSTADDR */
425
426 /**
427 * Send a message with the IPv6 source address set, if possible.
428 */
429 #ifdef HAVE_IN6_PKTINFO
430
431 static ssize_t send_msg_v6(int skt, struct msghdr *msg, host_t *src)
432 {
433 char buf[CMSG_SPACE(sizeof(struct in6_pktinfo))] = {};
434 struct cmsghdr *cmsg;
435 struct in6_pktinfo *pktinfo;
436 struct sockaddr_in6 *sin;
437
438 msg->msg_control = buf;
439 msg->msg_controllen = sizeof(buf);
440 cmsg = CMSG_FIRSTHDR(msg);
441 cmsg->cmsg_level = SOL_IPV6;
442 cmsg->cmsg_type = IPV6_PKTINFO;
443 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
444 pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsg);
445 sin = (struct sockaddr_in6*)src->get_sockaddr(src);
446 memcpy(&pktinfo->ipi6_addr, &sin->sin6_addr, sizeof(struct in6_addr));
447 return send_msg_generic(skt, msg);
448 }
449
450 #else /* HAVE_IN6_PKTINFO */
451
452 static ssize_t send_msg_v6(int skt, struct msghdr *msg, host_t *src)
453 {
454 return send_msg_generic(skt, msg);
455 }
456
457 #endif /* HAVE_IN6_PKTINFO */
458
459 METHOD(socket_t, sender, status_t,
460 private_socket_default_socket_t *this, packet_t *packet)
461 {
462 int sport, skt = -1, family;
463 ssize_t bytes_sent;
464 chunk_t data;
465 host_t *src, *dst;
466 struct msghdr msg;
467 struct iovec iov;
468 u_int8_t *dscp;
469
470 src = packet->get_source(packet);
471 dst = packet->get_destination(packet);
472 data = packet->get_data(packet);
473
474 DBG2(DBG_NET, "sending packet: from %#H to %#H", src, dst);
475
476 /* send data */
477 sport = src->get_port(src);
478 family = dst->get_family(dst);
479 if (sport == 0 || sport == this->port)
480 {
481 switch (family)
482 {
483 case AF_INET:
484 skt = this->ipv4;
485 dscp = &this->dscp4;
486 break;
487 case AF_INET6:
488 skt = this->ipv6;
489 dscp = &this->dscp6;
490 break;
491 default:
492 return FAILED;
493 }
494 }
495 else if (sport == this->natt)
496 {
497 switch (family)
498 {
499 case AF_INET:
500 skt = this->ipv4_natt;
501 dscp = &this->dscp4_natt;
502 break;
503 case AF_INET6:
504 skt = this->ipv6_natt;
505 dscp = &this->dscp6_natt;
506 break;
507 default:
508 return FAILED;
509 }
510 }
511 if (skt == -1)
512 {
513 DBG1(DBG_NET, "no socket found to send IPv%d packet from port %d",
514 family == AF_INET ? 4 : 6, sport);
515 return FAILED;
516 }
517
518 /* setting DSCP values per-packet in a cmsg seems not to be supported
519 * on Linux. We instead setsockopt() before sending it, this should be
520 * safe as only a single thread calls send(). */
521 if (*dscp != packet->get_dscp(packet))
522 {
523 if (family == AF_INET)
524 {
525 u_int8_t ds4;
526
527 ds4 = packet->get_dscp(packet) << 2;
528 if (setsockopt(skt, SOL_IP, IP_TOS, &ds4, sizeof(ds4)) == 0)
529 {
530 *dscp = packet->get_dscp(packet);
531 }
532 else
533 {
534 DBG1(DBG_NET, "unable to set IP_TOS on socket: %s",
535 strerror(errno));
536 }
537 }
538 else
539 {
540 u_int ds6;
541
542 ds6 = packet->get_dscp(packet) << 2;
543 if (setsockopt(skt, SOL_IPV6, IPV6_TCLASS, &ds6, sizeof(ds6)) == 0)
544 {
545 *dscp = packet->get_dscp(packet);
546 }
547 else
548 {
549 DBG1(DBG_NET, "unable to set IPV6_TCLASS on socket: %s",
550 strerror(errno));
551 }
552 }
553 }
554
555 memset(&msg, 0, sizeof(struct msghdr));
556 msg.msg_name = dst->get_sockaddr(dst);;
557 msg.msg_namelen = *dst->get_sockaddr_len(dst);
558 iov.iov_base = data.ptr;
559 iov.iov_len = data.len;
560 msg.msg_iov = &iov;
561 msg.msg_iovlen = 1;
562 msg.msg_flags = 0;
563
564 if (this->set_source && !src->is_anyaddr(src))
565 {
566 if (family == AF_INET)
567 {
568 bytes_sent = send_msg_v4(skt, &msg, src);
569 }
570 else
571 {
572 bytes_sent = send_msg_v6(skt, &msg, src);
573 }
574 }
575 else
576 {
577 bytes_sent = send_msg_generic(skt, &msg);
578 }
579
580 if (bytes_sent != data.len)
581 {
582 DBG1(DBG_NET, "error writing to socket: %s", strerror(errno));
583 return FAILED;
584 }
585 return SUCCESS;
586 }
587
588 METHOD(socket_t, get_port, u_int16_t,
589 private_socket_default_socket_t *this, bool nat_t)
590 {
591 return nat_t ? this->natt : this->port;
592 }
593
594 METHOD(socket_t, supported_families, socket_family_t,
595 private_socket_default_socket_t *this)
596 {
597 socket_family_t families = SOCKET_FAMILY_NONE;
598
599 if (this->ipv4 != -1 || this->ipv4_natt != -1)
600 {
601 families |= SOCKET_FAMILY_IPV4;
602 }
603 if (this->ipv6 != -1 || this->ipv6_natt != -1)
604 {
605 families |= SOCKET_FAMILY_IPV6;
606 }
607 return families;
608 }
609
610 /**
611 * open a socket to send and receive packets
612 */
613 static int open_socket(private_socket_default_socket_t *this,
614 int family, u_int16_t *port)
615 {
616 int on = TRUE;
617 union {
618 struct sockaddr sockaddr;
619 struct sockaddr_in sin;
620 struct sockaddr_in6 sin6;
621 } addr;
622 socklen_t addrlen;
623 u_int sol, pktinfo = 0;
624 int skt;
625
626 memset(&addr, 0, sizeof(addr));
627 addr.sockaddr.sa_family = family;
628 /* precalculate constants depending on address family */
629 switch (family)
630 {
631 case AF_INET:
632 addr.sin.sin_addr.s_addr = htonl(INADDR_ANY);
633 addr.sin.sin_port = htons(*port);
634 addrlen = sizeof(addr.sin);
635 sol = SOL_IP;
636 #ifdef IP_PKTINFO
637 pktinfo = IP_PKTINFO;
638 #elif defined(IP_RECVDSTADDR)
639 pktinfo = IP_RECVDSTADDR;
640 #endif
641 break;
642 case AF_INET6:
643 memcpy(&addr.sin6.sin6_addr, &in6addr_any, sizeof(in6addr_any));
644 addr.sin6.sin6_port = htons(*port);
645 addrlen = sizeof(addr.sin6);
646 sol = SOL_IPV6;
647 pktinfo = IPV6_RECVPKTINFO;
648 break;
649 default:
650 return -1;
651 }
652
653 skt = socket(family, SOCK_DGRAM, IPPROTO_UDP);
654 if (skt < 0)
655 {
656 DBG1(DBG_NET, "could not open socket: %s", strerror(errno));
657 return -1;
658 }
659 if (setsockopt(skt, SOL_SOCKET, SO_REUSEADDR, (void*)&on, sizeof(on)) < 0)
660 {
661 DBG1(DBG_NET, "unable to set SO_REUSEADDR on socket: %s", strerror(errno));
662 close(skt);
663 return -1;
664 }
665
666 /* bind the socket */
667 if (bind(skt, &addr.sockaddr, addrlen) < 0)
668 {
669 DBG1(DBG_NET, "unable to bind socket: %s", strerror(errno));
670 close(skt);
671 return -1;
672 }
673
674 /* retrieve randomly allocated port if needed */
675 if (*port == 0)
676 {
677 if (getsockname(skt, &addr.sockaddr, &addrlen) < 0)
678 {
679 DBG1(DBG_NET, "unable to determine port: %s", strerror(errno));
680 close(skt);
681 return -1;
682 }
683 switch (family)
684 {
685 case AF_INET:
686 *port = ntohs(addr.sin.sin_port);
687 break;
688 case AF_INET6:
689 *port = ntohs(addr.sin6.sin6_port);
690 break;
691 }
692 }
693
694 /* get additional packet info on receive */
695 if (pktinfo > 0)
696 {
697 if (setsockopt(skt, sol, pktinfo, &on, sizeof(on)) < 0)
698 {
699 DBG1(DBG_NET, "unable to set IP_PKTINFO on socket: %s", strerror(errno));
700 close(skt);
701 return -1;
702 }
703 }
704 #ifdef SO_MARK
705 { /* set optional MARK on socket (requires CAP_NET_ADMIN) */
706 char *fwmark;
707 mark_t mark;
708
709 fwmark = lib->settings->get_str(lib->settings,
710 "%s.plugins.socket-default.fwmark", NULL, lib->ns);
711 if (fwmark && mark_from_string(fwmark, &mark))
712 {
713 if (setsockopt(skt, SOL_SOCKET, SO_MARK, &mark.value,
714 sizeof(mark.value)) < 0)
715 {
716 DBG1(DBG_NET, "unable to set SO_MARK on socket: %s",
717 strerror(errno));
718 }
719 }
720 }
721 #endif
722
723 if (!hydra->kernel_interface->bypass_socket(hydra->kernel_interface,
724 skt, family))
725 {
726 DBG1(DBG_NET, "installing IKE bypass policy failed");
727 }
728
729 /* enable UDP decapsulation for NAT-T sockets */
730 if (port == &this->natt &&
731 !hydra->kernel_interface->enable_udp_decap(hydra->kernel_interface,
732 skt, family, this->natt))
733 {
734 DBG1(DBG_NET, "enabling UDP decapsulation for %s on port %d failed",
735 family == AF_INET ? "IPv4" : "IPv6", this->natt);
736 }
737
738 return skt;
739 }
740
741 /**
742 * Check if we should use the given family
743 */
744 static bool use_family(int family)
745 {
746 switch (family)
747 {
748 case AF_INET:
749 return lib->settings->get_bool(lib->settings,
750 "%s.plugins.socket-default.use_ipv4", TRUE, lib->ns);
751 case AF_INET6:
752 return lib->settings->get_bool(lib->settings,
753 "%s.plugins.socket-default.use_ipv6", TRUE, lib->ns);
754 default:
755 return FALSE;
756 }
757 }
758
759 /**
760 * Open a socket pair (normal and NAT traversal) for a given address family
761 */
762 static void open_socketpair(private_socket_default_socket_t *this, int family,
763 int *skt, int *skt_natt, char *label)
764 {
765 if (!use_family(family))
766 {
767 *skt = -1;
768 *skt_natt = -1;
769 return;
770 }
771
772 *skt = open_socket(this, family, &this->port);
773 if (*skt == -1)
774 {
775 *skt_natt = -1;
776 DBG1(DBG_NET, "could not open %s socket, %s disabled", label, label);
777 }
778 else
779 {
780 *skt_natt = open_socket(this, family, &this->natt);
781 if (*skt_natt == -1)
782 {
783 DBG1(DBG_NET, "could not open %s NAT-T socket", label);
784 }
785 }
786 }
787
788 METHOD(socket_t, destroy, void,
789 private_socket_default_socket_t *this)
790 {
791 if (this->ipv4 != -1)
792 {
793 close(this->ipv4);
794 }
795 if (this->ipv4_natt != -1)
796 {
797 close(this->ipv4_natt);
798 }
799 if (this->ipv6 != -1)
800 {
801 close(this->ipv6);
802 }
803 if (this->ipv6_natt != -1)
804 {
805 close(this->ipv6_natt);
806 }
807 free(this);
808 }
809
810 /*
811 * See header for description
812 */
813 socket_default_socket_t *socket_default_socket_create()
814 {
815 private_socket_default_socket_t *this;
816
817 INIT(this,
818 .public = {
819 .socket = {
820 .send = _sender,
821 .receive = _receiver,
822 .get_port = _get_port,
823 .supported_families = _supported_families,
824 .destroy = _destroy,
825 },
826 },
827 .port = lib->settings->get_int(lib->settings,
828 "%s.port", CHARON_UDP_PORT, lib->ns),
829 .natt = lib->settings->get_int(lib->settings,
830 "%s.port_nat_t", CHARON_NATT_PORT, lib->ns),
831 .max_packet = lib->settings->get_int(lib->settings,
832 "%s.max_packet", PACKET_MAX_DEFAULT, lib->ns),
833 .set_source = lib->settings->get_bool(lib->settings,
834 "%s.plugins.socket-default.set_source", TRUE,
835 lib->ns),
836 );
837
838 if (this->port && this->port == this->natt)
839 {
840 DBG1(DBG_NET, "IKE ports can't be equal, will allocate NAT-T "
841 "port randomly");
842 this->natt = 0;
843 }
844
845 if ((this->port && this->port < 1024) || (this->natt && this->natt < 1024))
846 {
847 if (!lib->caps->check(lib->caps, CAP_NET_BIND_SERVICE))
848 {
849 /* required to bind ports < 1024 */
850 DBG1(DBG_NET, "socket-default plugin requires CAP_NET_BIND_SERVICE "
851 "capability");
852 destroy(this);
853 return NULL;
854 }
855 }
856
857 /* we allocate IPv6 sockets first as that will reserve randomly allocated
858 * ports also for IPv4. On OS X, we have to do it the other way round
859 * for the same effect. */
860 #ifdef __APPLE__
861 open_socketpair(this, AF_INET, &this->ipv4, &this->ipv4_natt, "IPv4");
862 open_socketpair(this, AF_INET6, &this->ipv6, &this->ipv6_natt, "IPv6");
863 #else /* !__APPLE__ */
864 open_socketpair(this, AF_INET6, &this->ipv6, &this->ipv6_natt, "IPv6");
865 open_socketpair(this, AF_INET, &this->ipv4, &this->ipv4_natt, "IPv4");
866 #endif /* __APPLE__ */
867
868 if (this->ipv4 == -1 && this->ipv6 == -1)
869 {
870 DBG1(DBG_NET, "could not create any sockets");
871 destroy(this);
872 return NULL;
873 }
874
875 return &this->public;
876 }