kernel-pfroute: Delete interfaces on RTM_IFANNOUNCE/IFAN_DEPARTURE events
[strongswan.git] / src / libhydra / plugins / kernel_pfroute / kernel_pfroute_net.c
1 /*
2 * Copyright (C) 2009-2013 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <sys/types.h>
17 #include <sys/socket.h>
18 #include <net/if.h>
19 #include <net/if_dl.h>
20 #include <ifaddrs.h>
21 #include <net/route.h>
22 #include <unistd.h>
23 #include <errno.h>
24
25 #include "kernel_pfroute_net.h"
26
27 #include <hydra.h>
28 #include <utils/debug.h>
29 #include <networking/host.h>
30 #include <networking/tun_device.h>
31 #include <threading/thread.h>
32 #include <threading/mutex.h>
33 #include <threading/condvar.h>
34 #include <threading/rwlock.h>
35 #include <threading/spinlock.h>
36 #include <collections/hashtable.h>
37 #include <collections/linked_list.h>
38 #include <processing/jobs/callback_job.h>
39
40 #ifndef HAVE_STRUCT_SOCKADDR_SA_LEN
41 #error Cannot compile this plugin on systems where 'struct sockaddr' has no sa_len member.
42 #endif
43
44 /** properly align sockaddrs */
45 #ifdef __APPLE__
46 /* Apple always uses 4 bytes */
47 #define SA_ALIGN 4
48 #else
49 /* while on other platforms like FreeBSD it depends on the architecture */
50 #define SA_ALIGN sizeof(long)
51 #endif
52 #define SA_LEN(len) ((len) > 0 ? (((len)+SA_ALIGN-1) & ~(SA_ALIGN-1)) : SA_ALIGN)
53
54 /** delay before firing roam events (ms) */
55 #define ROAM_DELAY 100
56
57 /** delay before reinstalling routes (ms) */
58 #define ROUTE_DELAY 100
59
60 typedef struct addr_entry_t addr_entry_t;
61
62 /**
63 * IP address in an inface_entry_t
64 */
65 struct addr_entry_t {
66
67 /** The ip address */
68 host_t *ip;
69
70 /** virtual IP managed by us */
71 bool virtual;
72 };
73
74 /**
75 * destroy a addr_entry_t object
76 */
77 static void addr_entry_destroy(addr_entry_t *this)
78 {
79 this->ip->destroy(this->ip);
80 free(this);
81 }
82
83 typedef struct iface_entry_t iface_entry_t;
84
85 /**
86 * A network interface on this system, containing addr_entry_t's
87 */
88 struct iface_entry_t {
89
90 /** interface index */
91 int ifindex;
92
93 /** name of the interface */
94 char ifname[IFNAMSIZ];
95
96 /** interface flags, as in netdevice(7) SIOCGIFFLAGS */
97 u_int flags;
98
99 /** list of addresses as host_t */
100 linked_list_t *addrs;
101
102 /** TRUE if usable by config */
103 bool usable;
104 };
105
106 /**
107 * destroy an interface entry
108 */
109 static void iface_entry_destroy(iface_entry_t *this)
110 {
111 this->addrs->destroy_function(this->addrs, (void*)addr_entry_destroy);
112 free(this);
113 }
114
115 /**
116 * check if an interface is up
117 */
118 static inline bool iface_entry_up(iface_entry_t *iface)
119 {
120 return (iface->flags & IFF_UP) == IFF_UP;
121 }
122
123 /**
124 * check if an interface is up and usable
125 */
126 static inline bool iface_entry_up_and_usable(iface_entry_t *iface)
127 {
128 return iface->usable && iface_entry_up(iface);
129 }
130
131 typedef struct addr_map_entry_t addr_map_entry_t;
132
133 /**
134 * Entry that maps an IP address to an interface entry
135 */
136 struct addr_map_entry_t {
137 /** The IP address */
138 host_t *ip;
139
140 /** The address entry for this IP address */
141 addr_entry_t *addr;
142
143 /** The interface this address is installed on */
144 iface_entry_t *iface;
145 };
146
147 /**
148 * Hash a addr_map_entry_t object, all entries with the same IP address
149 * are stored in the same bucket
150 */
151 static u_int addr_map_entry_hash(addr_map_entry_t *this)
152 {
153 return chunk_hash(this->ip->get_address(this->ip));
154 }
155
156 /**
157 * Compare two addr_map_entry_t objects, two entries are equal if they are
158 * installed on the same interface
159 */
160 static bool addr_map_entry_equals(addr_map_entry_t *a, addr_map_entry_t *b)
161 {
162 return a->iface->ifindex == b->iface->ifindex &&
163 a->ip->ip_equals(a->ip, b->ip);
164 }
165
166 /**
167 * Used with get_match this finds an address entry if it is installed on
168 * an up and usable interface
169 */
170 static bool addr_map_entry_match_up_and_usable(addr_map_entry_t *a,
171 addr_map_entry_t *b)
172 {
173 return !b->addr->virtual && iface_entry_up_and_usable(b->iface) &&
174 a->ip->ip_equals(a->ip, b->ip);
175 }
176
177 /**
178 * Used with get_match this finds an address entry if it is installed as virtual
179 * IP address
180 */
181 static bool addr_map_entry_match_virtual(addr_map_entry_t *a, addr_map_entry_t *b)
182 {
183 return b->addr->virtual && a->ip->ip_equals(a->ip, b->ip);
184 }
185
186 /**
187 * Used with get_match this finds an address entry if it is installed on
188 * any active local interface
189 */
190 static bool addr_map_entry_match_up(addr_map_entry_t *a, addr_map_entry_t *b)
191 {
192 return !b->addr->virtual && iface_entry_up(b->iface) &&
193 a->ip->ip_equals(a->ip, b->ip);
194 }
195
196 typedef struct route_entry_t route_entry_t;
197
198 /**
199 * Installed routing entry
200 */
201 struct route_entry_t {
202 /** Name of the interface the route is bound to */
203 char *if_name;
204
205 /** Gateway for this route */
206 host_t *gateway;
207
208 /** Destination net */
209 chunk_t dst_net;
210
211 /** Destination net prefixlen */
212 u_int8_t prefixlen;
213 };
214
215 /**
216 * Clone a route_entry_t object.
217 */
218 static route_entry_t *route_entry_clone(route_entry_t *this)
219 {
220 route_entry_t *route;
221
222 INIT(route,
223 .if_name = strdup(this->if_name),
224 .gateway = this->gateway ? this->gateway->clone(this->gateway) : NULL,
225 .dst_net = chunk_clone(this->dst_net),
226 .prefixlen = this->prefixlen,
227 );
228 return route;
229 }
230
231 /**
232 * Destroy a route_entry_t object
233 */
234 static void route_entry_destroy(route_entry_t *this)
235 {
236 free(this->if_name);
237 DESTROY_IF(this->gateway);
238 chunk_free(&this->dst_net);
239 free(this);
240 }
241
242 /**
243 * Hash a route_entry_t object
244 */
245 static u_int route_entry_hash(route_entry_t *this)
246 {
247 return chunk_hash_inc(chunk_from_thing(this->prefixlen),
248 chunk_hash(this->dst_net));
249 }
250
251 /**
252 * Compare two route_entry_t objects
253 */
254 static bool route_entry_equals(route_entry_t *a, route_entry_t *b)
255 {
256 if (a->if_name && b->if_name && streq(a->if_name, b->if_name) &&
257 chunk_equals(a->dst_net, b->dst_net) && a->prefixlen == b->prefixlen)
258 {
259 return (!a->gateway && !b->gateway) || (a->gateway && b->gateway &&
260 a->gateway->ip_equals(a->gateway, b->gateway));
261 }
262 return FALSE;
263 }
264
265 typedef struct net_change_t net_change_t;
266
267 /**
268 * Queued network changes
269 */
270 struct net_change_t {
271 /** Name of the interface that got activated (or an IP appeared on) */
272 char *if_name;
273 };
274
275 /**
276 * Destroy a net_change_t object
277 */
278 static void net_change_destroy(net_change_t *this)
279 {
280 free(this->if_name);
281 free(this);
282 }
283
284 /**
285 * Hash a net_change_t object
286 */
287 static u_int net_change_hash(net_change_t *this)
288 {
289 return chunk_hash(chunk_create(this->if_name, strlen(this->if_name)));
290 }
291
292 /**
293 * Compare two net_change_t objects
294 */
295 static bool net_change_equals(net_change_t *a, net_change_t *b)
296 {
297 return streq(a->if_name, b->if_name);
298 }
299
300 typedef struct private_kernel_pfroute_net_t private_kernel_pfroute_net_t;
301
302 /**
303 * Private variables and functions of kernel_pfroute class.
304 */
305 struct private_kernel_pfroute_net_t
306 {
307 /**
308 * Public part of the kernel_pfroute_t object.
309 */
310 kernel_pfroute_net_t public;
311
312 /**
313 * lock to access lists and maps
314 */
315 rwlock_t *lock;
316
317 /**
318 * Cached list of interfaces and their addresses (iface_entry_t)
319 */
320 linked_list_t *ifaces;
321
322 /**
323 * Map for IP addresses to iface_entry_t objects (addr_map_entry_t)
324 */
325 hashtable_t *addrs;
326
327 /**
328 * List of tun devices we installed for virtual IPs
329 */
330 linked_list_t *tuns;
331
332 /**
333 * mutex to communicate exclusively with PF_KEY
334 */
335 mutex_t *mutex;
336
337 /**
338 * condvar to signal if PF_KEY query got a response
339 */
340 condvar_t *condvar;
341
342 /**
343 * installed routes
344 */
345 hashtable_t *routes;
346
347 /**
348 * mutex for routes
349 */
350 mutex_t *routes_lock;
351
352 /**
353 * interface changes which may trigger route reinstallation
354 */
355 hashtable_t *net_changes;
356
357 /**
358 * mutex for route reinstallation triggers
359 */
360 mutex_t *net_changes_lock;
361
362 /**
363 * time of last route reinstallation
364 */
365 timeval_t last_route_reinstall;
366
367 /**
368 * pid to send PF_ROUTE messages with
369 */
370 pid_t pid;
371
372 /**
373 * PF_ROUTE socket to communicate with the kernel
374 */
375 int socket;
376
377 /**
378 * sequence number for messages sent to the kernel
379 */
380 int seq;
381
382 /**
383 * Sequence number a query is waiting for
384 */
385 int waiting_seq;
386
387 /**
388 * Allocated reply message from kernel
389 */
390 struct rt_msghdr *reply;
391
392 /**
393 * earliest time of the next roam event
394 */
395 timeval_t next_roam;
396
397 /**
398 * roam event due to address change
399 */
400 bool roam_address;
401
402 /**
403 * lock to check and update roam event time
404 */
405 spinlock_t *roam_lock;
406
407 /**
408 * Time in ms to wait for IP addresses to appear/disappear
409 */
410 int vip_wait;
411 };
412
413
414 /**
415 * Forward declaration
416 */
417 static status_t manage_route(private_kernel_pfroute_net_t *this, int op,
418 chunk_t dst_net, u_int8_t prefixlen,
419 host_t *gateway, char *if_name);
420
421 /**
422 * Clear the queued network changes.
423 */
424 static void net_changes_clear(private_kernel_pfroute_net_t *this)
425 {
426 enumerator_t *enumerator;
427 net_change_t *change;
428
429 enumerator = this->net_changes->create_enumerator(this->net_changes);
430 while (enumerator->enumerate(enumerator, NULL, (void**)&change))
431 {
432 this->net_changes->remove_at(this->net_changes, enumerator);
433 net_change_destroy(change);
434 }
435 enumerator->destroy(enumerator);
436 }
437
438 /**
439 * Act upon queued network changes.
440 */
441 static job_requeue_t reinstall_routes(private_kernel_pfroute_net_t *this)
442 {
443 enumerator_t *enumerator;
444 route_entry_t *route;
445
446 this->net_changes_lock->lock(this->net_changes_lock);
447 this->routes_lock->lock(this->routes_lock);
448
449 enumerator = this->routes->create_enumerator(this->routes);
450 while (enumerator->enumerate(enumerator, NULL, (void**)&route))
451 {
452 net_change_t *change, lookup = {
453 .if_name = route->if_name,
454 };
455 /* check if a change for the outgoing interface is queued */
456 change = this->net_changes->get(this->net_changes, &lookup);
457 if (change)
458 {
459 manage_route(this, RTM_ADD, route->dst_net, route->prefixlen,
460 route->gateway, route->if_name);
461 }
462 }
463 enumerator->destroy(enumerator);
464 this->routes_lock->unlock(this->routes_lock);
465
466 net_changes_clear(this);
467 this->net_changes_lock->unlock(this->net_changes_lock);
468 return JOB_REQUEUE_NONE;
469 }
470
471 /**
472 * Queue route reinstallation caused by network changes for a given interface.
473 *
474 * The route reinstallation is delayed for a while and only done once for
475 * several calls during this delay, in order to avoid doing it too often.
476 * The interface name is freed.
477 */
478 static void queue_route_reinstall(private_kernel_pfroute_net_t *this,
479 char *if_name)
480 {
481 net_change_t *update, *found;
482 timeval_t now;
483 job_t *job;
484
485 INIT(update,
486 .if_name = if_name
487 );
488
489 this->net_changes_lock->lock(this->net_changes_lock);
490 found = this->net_changes->put(this->net_changes, update, update);
491 if (found)
492 {
493 net_change_destroy(found);
494 }
495 time_monotonic(&now);
496 if (timercmp(&now, &this->last_route_reinstall, >))
497 {
498 timeval_add_ms(&now, ROUTE_DELAY);
499 this->last_route_reinstall = now;
500
501 job = (job_t*)callback_job_create((callback_job_cb_t)reinstall_routes,
502 this, NULL, NULL);
503 lib->scheduler->schedule_job_ms(lib->scheduler, job, ROUTE_DELAY);
504 }
505 this->net_changes_lock->unlock(this->net_changes_lock);
506 }
507
508 /**
509 * Add an address map entry
510 */
511 static void addr_map_entry_add(private_kernel_pfroute_net_t *this,
512 addr_entry_t *addr, iface_entry_t *iface)
513 {
514 addr_map_entry_t *entry;
515
516 INIT(entry,
517 .ip = addr->ip,
518 .addr = addr,
519 .iface = iface,
520 );
521 entry = this->addrs->put(this->addrs, entry, entry);
522 free(entry);
523 }
524
525 /**
526 * Remove an address map entry (the argument order is a bit strange because
527 * it is also used with linked_list_t.invoke_function)
528 */
529 static void addr_map_entry_remove(addr_entry_t *addr, iface_entry_t *iface,
530 private_kernel_pfroute_net_t *this)
531 {
532 addr_map_entry_t *entry, lookup = {
533 .ip = addr->ip,
534 .addr = addr,
535 .iface = iface,
536 };
537
538 entry = this->addrs->remove(this->addrs, &lookup);
539 free(entry);
540 }
541
542 /**
543 * callback function that raises the delayed roam event
544 */
545 static job_requeue_t roam_event(private_kernel_pfroute_net_t *this)
546 {
547 bool address;
548
549 this->roam_lock->lock(this->roam_lock);
550 address = this->roam_address;
551 this->roam_address = FALSE;
552 this->roam_lock->unlock(this->roam_lock);
553 hydra->kernel_interface->roam(hydra->kernel_interface, address);
554 return JOB_REQUEUE_NONE;
555 }
556
557 /**
558 * fire a roaming event. we delay it for a bit and fire only one event
559 * for multiple calls. otherwise we would create too many events.
560 */
561 static void fire_roam_event(private_kernel_pfroute_net_t *this, bool address)
562 {
563 timeval_t now;
564 job_t *job;
565
566 time_monotonic(&now);
567 this->roam_lock->lock(this->roam_lock);
568 this->roam_address |= address;
569 if (!timercmp(&now, &this->next_roam, >))
570 {
571 this->roam_lock->unlock(this->roam_lock);
572 return;
573 }
574 timeval_add_ms(&now, ROAM_DELAY);
575 this->next_roam = now;
576 this->roam_lock->unlock(this->roam_lock);
577
578 job = (job_t*)callback_job_create((callback_job_cb_t)roam_event,
579 this, NULL, NULL);
580 lib->scheduler->schedule_job_ms(lib->scheduler, job, ROAM_DELAY);
581 }
582
583 /**
584 * Data for enumerator over rtmsg sockaddrs
585 */
586 typedef struct {
587 /** implements enumerator */
588 enumerator_t public;
589 /** copy of attribute bitfield */
590 int types;
591 /** bytes remaining in buffer */
592 int remaining;
593 /** next sockaddr to enumerate */
594 struct sockaddr *addr;
595 } rt_enumerator_t;
596
597 METHOD(enumerator_t, rt_enumerate, bool,
598 rt_enumerator_t *this, int *xtype, struct sockaddr **addr)
599 {
600 int i, type;
601
602 if (this->remaining < sizeof(this->addr->sa_len) ||
603 this->remaining < this->addr->sa_len)
604 {
605 return FALSE;
606 }
607 for (i = 0; i < RTAX_MAX; i++)
608 {
609 type = (1 << i);
610 if (this->types & type)
611 {
612 this->types &= ~type;
613 *addr = this->addr;
614 *xtype = i;
615 this->remaining -= SA_LEN(this->addr->sa_len);
616 this->addr = (struct sockaddr*)((char*)this->addr +
617 SA_LEN(this->addr->sa_len));
618 return TRUE;
619 }
620 }
621 return FALSE;
622 }
623
624 /**
625 * Create an enumerator over sockaddrs in rt/if messages
626 */
627 static enumerator_t *create_rt_enumerator(int types, int remaining,
628 struct sockaddr *addr)
629 {
630 rt_enumerator_t *this;
631
632 INIT(this,
633 .public = {
634 .enumerate = (void*)_rt_enumerate,
635 .destroy = (void*)free,
636 },
637 .types = types,
638 .remaining = remaining,
639 .addr = addr,
640 );
641 return &this->public;
642 }
643
644 /**
645 * Create a safe enumerator over sockaddrs in rt_msghdr
646 */
647 static enumerator_t *create_rtmsg_enumerator(struct rt_msghdr *hdr)
648 {
649 return create_rt_enumerator(hdr->rtm_addrs, hdr->rtm_msglen - sizeof(*hdr),
650 (struct sockaddr *)(hdr + 1));
651 }
652
653 /**
654 * Create a safe enumerator over sockaddrs in ifa_msghdr
655 */
656 static enumerator_t *create_ifamsg_enumerator(struct ifa_msghdr *hdr)
657 {
658 return create_rt_enumerator(hdr->ifam_addrs, hdr->ifam_msglen - sizeof(*hdr),
659 (struct sockaddr *)(hdr + 1));
660 }
661
662 /**
663 * Process an RTM_*ADDR message from the kernel
664 */
665 static void process_addr(private_kernel_pfroute_net_t *this,
666 struct ifa_msghdr *ifa)
667 {
668 struct sockaddr *sockaddr;
669 host_t *host = NULL;
670 enumerator_t *ifaces, *addrs;
671 iface_entry_t *iface;
672 addr_entry_t *addr;
673 bool found = FALSE, changed = FALSE, roam = FALSE;
674 enumerator_t *enumerator;
675 char *ifname = NULL;
676 int type;
677
678 enumerator = create_ifamsg_enumerator(ifa);
679 while (enumerator->enumerate(enumerator, &type, &sockaddr))
680 {
681 if (type == RTAX_IFA)
682 {
683 host = host_create_from_sockaddr(sockaddr);
684 break;
685 }
686 }
687 enumerator->destroy(enumerator);
688
689 if (!host || host->is_anyaddr(host))
690 {
691 DESTROY_IF(host);
692 return;
693 }
694
695 this->lock->write_lock(this->lock);
696 ifaces = this->ifaces->create_enumerator(this->ifaces);
697 while (ifaces->enumerate(ifaces, &iface))
698 {
699 if (iface->ifindex == ifa->ifam_index)
700 {
701 addrs = iface->addrs->create_enumerator(iface->addrs);
702 while (addrs->enumerate(addrs, &addr))
703 {
704 if (host->ip_equals(host, addr->ip))
705 {
706 found = TRUE;
707 if (ifa->ifam_type == RTM_DELADDR)
708 {
709 iface->addrs->remove_at(iface->addrs, addrs);
710 if (!addr->virtual && iface->usable)
711 {
712 changed = TRUE;
713 DBG1(DBG_KNL, "%H disappeared from %s",
714 host, iface->ifname);
715 }
716 addr_map_entry_remove(addr, iface, this);
717 addr_entry_destroy(addr);
718 }
719 }
720 }
721 addrs->destroy(addrs);
722
723 if (!found && ifa->ifam_type == RTM_NEWADDR)
724 {
725 INIT(addr,
726 .ip = host->clone(host),
727 );
728 changed = TRUE;
729 ifname = strdup(iface->ifname);
730 iface->addrs->insert_last(iface->addrs, addr);
731 addr_map_entry_add(this, addr, iface);
732 if (iface->usable)
733 {
734 DBG1(DBG_KNL, "%H appeared on %s", host, iface->ifname);
735 }
736 }
737
738 if (changed && iface_entry_up_and_usable(iface))
739 {
740 roam = TRUE;
741 }
742 break;
743 }
744 }
745 ifaces->destroy(ifaces);
746 this->lock->unlock(this->lock);
747 host->destroy(host);
748
749 if (roam && ifname)
750 {
751 queue_route_reinstall(this, ifname);
752 }
753 else
754 {
755 free(ifname);
756 }
757
758 if (roam)
759 {
760 fire_roam_event(this, TRUE);
761 }
762 }
763
764 /**
765 * Re-initialize address list of an interface if it changes state
766 */
767 static void repopulate_iface(private_kernel_pfroute_net_t *this,
768 iface_entry_t *iface)
769 {
770 struct ifaddrs *ifap, *ifa;
771 addr_entry_t *addr;
772
773 while (iface->addrs->remove_last(iface->addrs, (void**)&addr) == SUCCESS)
774 {
775 addr_map_entry_remove(addr, iface, this);
776 addr_entry_destroy(addr);
777 }
778
779 if (getifaddrs(&ifap) == 0)
780 {
781 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
782 {
783 if (ifa->ifa_addr && streq(ifa->ifa_name, iface->ifname))
784 {
785 switch (ifa->ifa_addr->sa_family)
786 {
787 case AF_INET:
788 case AF_INET6:
789 INIT(addr,
790 .ip = host_create_from_sockaddr(ifa->ifa_addr),
791 );
792 iface->addrs->insert_last(iface->addrs, addr);
793 addr_map_entry_add(this, addr, iface);
794 break;
795 default:
796 break;
797 }
798 }
799 }
800 freeifaddrs(ifap);
801 }
802 }
803
804 /**
805 * Process an RTM_IFINFO message from the kernel
806 */
807 static void process_link(private_kernel_pfroute_net_t *this,
808 struct if_msghdr *msg)
809 {
810 enumerator_t *enumerator;
811 iface_entry_t *iface;
812 bool roam = FALSE, found = FALSE, update_routes = FALSE;
813
814 this->lock->write_lock(this->lock);
815 enumerator = this->ifaces->create_enumerator(this->ifaces);
816 while (enumerator->enumerate(enumerator, &iface))
817 {
818 if (iface->ifindex == msg->ifm_index)
819 {
820 if (iface->usable)
821 {
822 if (!(iface->flags & IFF_UP) && (msg->ifm_flags & IFF_UP))
823 {
824 roam = update_routes = TRUE;
825 DBG1(DBG_KNL, "interface %s activated", iface->ifname);
826 }
827 else if ((iface->flags & IFF_UP) && !(msg->ifm_flags & IFF_UP))
828 {
829 roam = TRUE;
830 DBG1(DBG_KNL, "interface %s deactivated", iface->ifname);
831 }
832 }
833 iface->flags = msg->ifm_flags;
834 repopulate_iface(this, iface);
835 found = TRUE;
836 break;
837 }
838 }
839 enumerator->destroy(enumerator);
840
841 if (!found)
842 {
843 INIT(iface,
844 .ifindex = msg->ifm_index,
845 .flags = msg->ifm_flags,
846 .addrs = linked_list_create(),
847 );
848 if (if_indextoname(iface->ifindex, iface->ifname))
849 {
850 DBG1(DBG_KNL, "interface %s appeared", iface->ifname);
851 iface->usable = hydra->kernel_interface->is_interface_usable(
852 hydra->kernel_interface, iface->ifname);
853 repopulate_iface(this, iface);
854 this->ifaces->insert_last(this->ifaces, iface);
855 if (iface->usable)
856 {
857 roam = update_routes = TRUE;
858 }
859 }
860 else
861 {
862 free(iface);
863 }
864 }
865 this->lock->unlock(this->lock);
866
867 if (update_routes)
868 {
869 queue_route_reinstall(this, strdup(iface->ifname));
870 }
871
872 if (roam)
873 {
874 fire_roam_event(this, TRUE);
875 }
876 }
877
878 /**
879 * Process an RTM_IFANNOUNCE message from the kernel
880 */
881 static void process_announce(private_kernel_pfroute_net_t *this,
882 struct if_announcemsghdr *msg)
883 {
884 enumerator_t *enumerator;
885 iface_entry_t *iface;
886
887 if (msg->ifan_what != IFAN_DEPARTURE)
888 {
889 /* we handle new interfaces in process_link() */
890 return;
891 }
892
893 this->lock->write_lock(this->lock);
894 enumerator = this->ifaces->create_enumerator(this->ifaces);
895 while (enumerator->enumerate(enumerator, &iface))
896 {
897 if (iface->ifindex == msg->ifan_index)
898 {
899 DBG1(DBG_KNL, "interface %s disappeared", iface->ifname);
900 this->ifaces->remove_at(this->ifaces, enumerator);
901 iface_entry_destroy(iface);
902 break;
903 }
904 }
905 enumerator->destroy(enumerator);
906 this->lock->unlock(this->lock);
907 }
908
909 /**
910 * Process an RTM_*ROUTE message from the kernel
911 */
912 static void process_route(private_kernel_pfroute_net_t *this,
913 struct rt_msghdr *msg)
914 {
915
916 }
917
918 /**
919 * Receives PF_ROUTE messages from kernel
920 */
921 static bool receive_events(private_kernel_pfroute_net_t *this, int fd,
922 watcher_event_t event)
923 {
924 struct {
925 union {
926 struct rt_msghdr rtm;
927 struct if_msghdr ifm;
928 struct ifa_msghdr ifam;
929 struct if_announcemsghdr ifanm;
930 };
931 char buf[sizeof(struct sockaddr_storage) * RTAX_MAX];
932 } msg;
933 int len, hdrlen;
934
935 len = recv(this->socket, &msg, sizeof(msg), MSG_DONTWAIT);
936 if (len < 0)
937 {
938 switch (errno)
939 {
940 case EINTR:
941 case EAGAIN:
942 return TRUE;
943 default:
944 DBG1(DBG_KNL, "unable to receive from PF_ROUTE event socket");
945 sleep(1);
946 return TRUE;
947 }
948 }
949
950 if (len < offsetof(struct rt_msghdr, rtm_flags) || len < msg.rtm.rtm_msglen)
951 {
952 DBG1(DBG_KNL, "received invalid PF_ROUTE message");
953 return TRUE;
954 }
955 if (msg.rtm.rtm_version != RTM_VERSION)
956 {
957 DBG1(DBG_KNL, "received PF_ROUTE message with unsupported version: %d",
958 msg.rtm.rtm_version);
959 return TRUE;
960 }
961 switch (msg.rtm.rtm_type)
962 {
963 case RTM_NEWADDR:
964 case RTM_DELADDR:
965 hdrlen = sizeof(msg.ifam);
966 break;
967 case RTM_IFINFO:
968 hdrlen = sizeof(msg.ifm);
969 break;
970 case RTM_IFANNOUNCE:
971 hdrlen = sizeof(msg.ifanm);
972 break;
973 case RTM_ADD:
974 case RTM_DELETE:
975 case RTM_GET:
976 hdrlen = sizeof(msg.rtm);
977 break;
978 default:
979 return TRUE;
980 }
981 if (msg.rtm.rtm_msglen < hdrlen)
982 {
983 DBG1(DBG_KNL, "ignoring short PF_ROUTE message");
984 return TRUE;
985 }
986 switch (msg.rtm.rtm_type)
987 {
988 case RTM_NEWADDR:
989 case RTM_DELADDR:
990 process_addr(this, &msg.ifam);
991 break;
992 case RTM_IFINFO:
993 process_link(this, &msg.ifm);
994 break;
995 case RTM_IFANNOUNCE:
996 process_announce(this, &msg.ifanm);
997 break;
998 case RTM_ADD:
999 case RTM_DELETE:
1000 process_route(this, &msg.rtm);
1001 break;
1002 default:
1003 break;
1004 }
1005
1006 this->mutex->lock(this->mutex);
1007 if (msg.rtm.rtm_pid == this->pid && msg.rtm.rtm_seq == this->waiting_seq)
1008 {
1009 /* seems like the message someone is waiting for, deliver */
1010 this->reply = realloc(this->reply, msg.rtm.rtm_msglen);
1011 memcpy(this->reply, &msg, msg.rtm.rtm_msglen);
1012 }
1013 /* signal on any event, add_ip()/del_ip() might wait for it */
1014 this->condvar->broadcast(this->condvar);
1015 this->mutex->unlock(this->mutex);
1016
1017 return TRUE;
1018 }
1019
1020
1021 /** enumerator over addresses */
1022 typedef struct {
1023 private_kernel_pfroute_net_t* this;
1024 /** which addresses to enumerate */
1025 kernel_address_type_t which;
1026 } address_enumerator_t;
1027
1028 /**
1029 * cleanup function for address enumerator
1030 */
1031 static void address_enumerator_destroy(address_enumerator_t *data)
1032 {
1033 data->this->lock->unlock(data->this->lock);
1034 free(data);
1035 }
1036
1037 /**
1038 * filter for addresses
1039 */
1040 static bool filter_addresses(address_enumerator_t *data,
1041 addr_entry_t** in, host_t** out)
1042 {
1043 host_t *ip;
1044 if (!(data->which & ADDR_TYPE_VIRTUAL) && (*in)->virtual)
1045 { /* skip virtual interfaces added by us */
1046 return FALSE;
1047 }
1048 if (!(data->which & ADDR_TYPE_REGULAR) && !(*in)->virtual)
1049 { /* address is regular, but not requested */
1050 return FALSE;
1051 }
1052 ip = (*in)->ip;
1053 if (ip->get_family(ip) == AF_INET6)
1054 {
1055 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)ip->get_sockaddr(ip);
1056 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
1057 { /* skip addresses with a unusable scope */
1058 return FALSE;
1059 }
1060 }
1061 *out = ip;
1062 return TRUE;
1063 }
1064
1065 /**
1066 * enumerator constructor for interfaces
1067 */
1068 static enumerator_t *create_iface_enumerator(iface_entry_t *iface,
1069 address_enumerator_t *data)
1070 {
1071 return enumerator_create_filter(iface->addrs->create_enumerator(iface->addrs),
1072 (void*)filter_addresses, data, NULL);
1073 }
1074
1075 /**
1076 * filter for interfaces
1077 */
1078 static bool filter_interfaces(address_enumerator_t *data, iface_entry_t** in,
1079 iface_entry_t** out)
1080 {
1081 if (!(data->which & ADDR_TYPE_IGNORED) && !(*in)->usable)
1082 { /* skip interfaces excluded by config */
1083 return FALSE;
1084 }
1085 if (!(data->which & ADDR_TYPE_LOOPBACK) && ((*in)->flags & IFF_LOOPBACK))
1086 { /* ignore loopback devices */
1087 return FALSE;
1088 }
1089 if (!(data->which & ADDR_TYPE_DOWN) && !((*in)->flags & IFF_UP))
1090 { /* skip interfaces not up */
1091 return FALSE;
1092 }
1093 *out = *in;
1094 return TRUE;
1095 }
1096
1097 METHOD(kernel_net_t, create_address_enumerator, enumerator_t*,
1098 private_kernel_pfroute_net_t *this, kernel_address_type_t which)
1099 {
1100 address_enumerator_t *data;
1101
1102 INIT(data,
1103 .this = this,
1104 .which = which,
1105 );
1106
1107 this->lock->read_lock(this->lock);
1108 return enumerator_create_nested(
1109 enumerator_create_filter(
1110 this->ifaces->create_enumerator(this->ifaces),
1111 (void*)filter_interfaces, data, NULL),
1112 (void*)create_iface_enumerator, data,
1113 (void*)address_enumerator_destroy);
1114 }
1115
1116 METHOD(kernel_net_t, get_features, kernel_feature_t,
1117 private_kernel_pfroute_net_t *this)
1118 {
1119 return KERNEL_REQUIRE_EXCLUDE_ROUTE;
1120 }
1121
1122 METHOD(kernel_net_t, get_interface_name, bool,
1123 private_kernel_pfroute_net_t *this, host_t* ip, char **name)
1124 {
1125 addr_map_entry_t *entry, lookup = {
1126 .ip = ip,
1127 };
1128
1129 if (ip->is_anyaddr(ip))
1130 {
1131 return FALSE;
1132 }
1133 this->lock->read_lock(this->lock);
1134 /* first try to find it on an up and usable interface */
1135 entry = this->addrs->get_match(this->addrs, &lookup,
1136 (void*)addr_map_entry_match_up_and_usable);
1137 if (entry)
1138 {
1139 if (name)
1140 {
1141 *name = strdup(entry->iface->ifname);
1142 DBG2(DBG_KNL, "%H is on interface %s", ip, *name);
1143 }
1144 this->lock->unlock(this->lock);
1145 return TRUE;
1146 }
1147 /* check if it is a virtual IP */
1148 entry = this->addrs->get_match(this->addrs, &lookup,
1149 (void*)addr_map_entry_match_virtual);
1150 if (entry)
1151 {
1152 if (name)
1153 {
1154 *name = strdup(entry->iface->ifname);
1155 DBG2(DBG_KNL, "virtual IP %H is on interface %s", ip, *name);
1156 }
1157 this->lock->unlock(this->lock);
1158 return TRUE;
1159 }
1160 /* maybe it is installed on an ignored interface */
1161 entry = this->addrs->get_match(this->addrs, &lookup,
1162 (void*)addr_map_entry_match_up);
1163 if (!entry)
1164 { /* the address does not exist, is on a down interface */
1165 DBG2(DBG_KNL, "%H is not a local address or the interface is down", ip);
1166 }
1167 this->lock->unlock(this->lock);
1168 return FALSE;
1169 }
1170
1171 METHOD(kernel_net_t, add_ip, status_t,
1172 private_kernel_pfroute_net_t *this, host_t *vip, int prefix,
1173 char *ifname)
1174 {
1175 enumerator_t *ifaces, *addrs;
1176 iface_entry_t *iface;
1177 addr_entry_t *addr;
1178 tun_device_t *tun;
1179 bool timeout = FALSE;
1180
1181 tun = tun_device_create(NULL);
1182 if (!tun)
1183 {
1184 return FAILED;
1185 }
1186 if (prefix == -1)
1187 {
1188 prefix = vip->get_address(vip).len * 8;
1189 }
1190 if (!tun->up(tun) || !tun->set_address(tun, vip, prefix))
1191 {
1192 tun->destroy(tun);
1193 return FAILED;
1194 }
1195
1196 /* wait until address appears */
1197 this->mutex->lock(this->mutex);
1198 while (!timeout && !get_interface_name(this, vip, NULL))
1199 {
1200 timeout = this->condvar->timed_wait(this->condvar, this->mutex,
1201 this->vip_wait);
1202 }
1203 this->mutex->unlock(this->mutex);
1204 if (timeout)
1205 {
1206 DBG1(DBG_KNL, "virtual IP %H did not appear on %s",
1207 vip, tun->get_name(tun));
1208 tun->destroy(tun);
1209 return FAILED;
1210 }
1211
1212 this->lock->write_lock(this->lock);
1213 this->tuns->insert_last(this->tuns, tun);
1214
1215 ifaces = this->ifaces->create_enumerator(this->ifaces);
1216 while (ifaces->enumerate(ifaces, &iface))
1217 {
1218 if (streq(iface->ifname, tun->get_name(tun)))
1219 {
1220 addrs = iface->addrs->create_enumerator(iface->addrs);
1221 while (addrs->enumerate(addrs, &addr))
1222 {
1223 if (addr->ip->ip_equals(addr->ip, vip))
1224 {
1225 addr->virtual = TRUE;
1226 }
1227 }
1228 addrs->destroy(addrs);
1229 /* during IKEv1 reauthentication, children get moved from
1230 * old the new SA before the virtual IP is available. This
1231 * kills the route for our virtual IP, reinstall. */
1232 queue_route_reinstall(this, strdup(iface->ifname));
1233 break;
1234 }
1235 }
1236 ifaces->destroy(ifaces);
1237 /* lets do this while holding the lock, thus preventing another thread
1238 * from deleting the TUN device concurrently, hopefully listeners are quick
1239 * and cause no deadlocks */
1240 hydra->kernel_interface->tun(hydra->kernel_interface, tun, TRUE);
1241 this->lock->unlock(this->lock);
1242
1243 return SUCCESS;
1244 }
1245
1246 METHOD(kernel_net_t, del_ip, status_t,
1247 private_kernel_pfroute_net_t *this, host_t *vip, int prefix,
1248 bool wait)
1249 {
1250 enumerator_t *enumerator;
1251 tun_device_t *tun;
1252 host_t *addr;
1253 bool timeout = FALSE, found = FALSE;
1254
1255 this->lock->write_lock(this->lock);
1256 enumerator = this->tuns->create_enumerator(this->tuns);
1257 while (enumerator->enumerate(enumerator, &tun))
1258 {
1259 addr = tun->get_address(tun, NULL);
1260 if (addr && addr->ip_equals(addr, vip))
1261 {
1262 this->tuns->remove_at(this->tuns, enumerator);
1263 hydra->kernel_interface->tun(hydra->kernel_interface, tun,
1264 FALSE);
1265 tun->destroy(tun);
1266 found = TRUE;
1267 break;
1268 }
1269 }
1270 enumerator->destroy(enumerator);
1271 this->lock->unlock(this->lock);
1272
1273 if (!found)
1274 {
1275 return NOT_FOUND;
1276 }
1277 /* wait until address disappears */
1278 if (wait)
1279 {
1280 this->mutex->lock(this->mutex);
1281 while (!timeout && get_interface_name(this, vip, NULL))
1282 {
1283 timeout = this->condvar->timed_wait(this->condvar, this->mutex,
1284 this->vip_wait);
1285 }
1286 this->mutex->unlock(this->mutex);
1287 if (timeout)
1288 {
1289 DBG1(DBG_KNL, "virtual IP %H did not disappear from tun", vip);
1290 return FAILED;
1291 }
1292 }
1293 return SUCCESS;
1294 }
1295
1296 /**
1297 * Append a sockaddr_in/in6 of given type to routing message
1298 */
1299 static void add_rt_addr(struct rt_msghdr *hdr, int type, host_t *addr)
1300 {
1301 if (addr)
1302 {
1303 int len;
1304
1305 len = *addr->get_sockaddr_len(addr);
1306 memcpy((char*)hdr + hdr->rtm_msglen, addr->get_sockaddr(addr), len);
1307 hdr->rtm_msglen += SA_LEN(len);
1308 hdr->rtm_addrs |= type;
1309 }
1310 }
1311
1312 /**
1313 * Append a subnet mask sockaddr using the given prefix to routing message
1314 */
1315 static void add_rt_mask(struct rt_msghdr *hdr, int type, int family, int prefix)
1316 {
1317 host_t *mask;
1318
1319 mask = host_create_netmask(family, prefix);
1320 if (mask)
1321 {
1322 add_rt_addr(hdr, type, mask);
1323 mask->destroy(mask);
1324 }
1325 }
1326
1327 /**
1328 * Append an interface name sockaddr_dl to routing message
1329 */
1330 static void add_rt_ifname(struct rt_msghdr *hdr, int type, char *name)
1331 {
1332 struct sockaddr_dl sdl = {
1333 .sdl_len = sizeof(struct sockaddr_dl),
1334 .sdl_family = AF_LINK,
1335 .sdl_nlen = strlen(name),
1336 };
1337
1338 if (strlen(name) <= sizeof(sdl.sdl_data))
1339 {
1340 memcpy(sdl.sdl_data, name, sdl.sdl_nlen);
1341 memcpy((char*)hdr + hdr->rtm_msglen, &sdl, sdl.sdl_len);
1342 hdr->rtm_msglen += SA_LEN(sdl.sdl_len);
1343 hdr->rtm_addrs |= type;
1344 }
1345 }
1346
1347 /**
1348 * Add or remove a route
1349 */
1350 static status_t manage_route(private_kernel_pfroute_net_t *this, int op,
1351 chunk_t dst_net, u_int8_t prefixlen,
1352 host_t *gateway, char *if_name)
1353 {
1354 struct {
1355 struct rt_msghdr hdr;
1356 char buf[sizeof(struct sockaddr_storage) * RTAX_MAX];
1357 } msg = {
1358 .hdr = {
1359 .rtm_version = RTM_VERSION,
1360 .rtm_type = op,
1361 .rtm_flags = RTF_UP | RTF_STATIC,
1362 .rtm_pid = this->pid,
1363 .rtm_seq = ref_get(&this->seq),
1364 },
1365 };
1366 host_t *dst;
1367 int type;
1368
1369 if (prefixlen == 0 && dst_net.len)
1370 {
1371 status_t status;
1372 chunk_t half;
1373
1374 half = chunk_clonea(dst_net);
1375 half.ptr[0] |= 0x80;
1376 prefixlen = 1;
1377 status = manage_route(this, op, half, prefixlen, gateway, if_name);
1378 if (status != SUCCESS)
1379 {
1380 return status;
1381 }
1382 }
1383
1384 dst = host_create_from_chunk(AF_UNSPEC, dst_net, 0);
1385 if (!dst)
1386 {
1387 return FAILED;
1388 }
1389
1390 if ((dst->get_family(dst) == AF_INET && prefixlen == 32) ||
1391 (dst->get_family(dst) == AF_INET6 && prefixlen == 128))
1392 {
1393 msg.hdr.rtm_flags |= RTF_HOST | RTF_GATEWAY;
1394 }
1395
1396 msg.hdr.rtm_msglen = sizeof(struct rt_msghdr);
1397 for (type = 0; type < RTAX_MAX; type++)
1398 {
1399 switch (type)
1400 {
1401 case RTAX_DST:
1402 add_rt_addr(&msg.hdr, RTA_DST, dst);
1403 break;
1404 case RTAX_NETMASK:
1405 if (!(msg.hdr.rtm_flags & RTF_HOST))
1406 {
1407 add_rt_mask(&msg.hdr, RTA_NETMASK,
1408 dst->get_family(dst), prefixlen);
1409 }
1410 break;
1411 case RTAX_IFP:
1412 if (if_name)
1413 {
1414 add_rt_ifname(&msg.hdr, RTA_IFP, if_name);
1415 }
1416 break;
1417 case RTAX_GATEWAY:
1418 if (gateway)
1419 {
1420 add_rt_addr(&msg.hdr, RTA_GATEWAY, gateway);
1421 }
1422 break;
1423 default:
1424 break;
1425 }
1426 }
1427 dst->destroy(dst);
1428
1429 if (send(this->socket, &msg, msg.hdr.rtm_msglen, 0) != msg.hdr.rtm_msglen)
1430 {
1431 if (errno == EEXIST)
1432 {
1433 return ALREADY_DONE;
1434 }
1435 DBG1(DBG_KNL, "%s PF_ROUTE route failed: %s",
1436 op == RTM_ADD ? "adding" : "deleting", strerror(errno));
1437 return FAILED;
1438 }
1439 return SUCCESS;
1440 }
1441
1442 METHOD(kernel_net_t, add_route, status_t,
1443 private_kernel_pfroute_net_t *this, chunk_t dst_net, u_int8_t prefixlen,
1444 host_t *gateway, host_t *src_ip, char *if_name)
1445 {
1446 status_t status;
1447 route_entry_t *found, route = {
1448 .dst_net = dst_net,
1449 .prefixlen = prefixlen,
1450 .gateway = gateway,
1451 .if_name = if_name,
1452 };
1453
1454 this->routes_lock->lock(this->routes_lock);
1455 found = this->routes->get(this->routes, &route);
1456 if (found)
1457 {
1458 this->routes_lock->unlock(this->routes_lock);
1459 return ALREADY_DONE;
1460 }
1461 status = manage_route(this, RTM_ADD, dst_net, prefixlen, gateway, if_name);
1462 if (status == SUCCESS)
1463 {
1464 found = route_entry_clone(&route);
1465 this->routes->put(this->routes, found, found);
1466 }
1467 this->routes_lock->unlock(this->routes_lock);
1468 return status;
1469 }
1470
1471 METHOD(kernel_net_t, del_route, status_t,
1472 private_kernel_pfroute_net_t *this, chunk_t dst_net, u_int8_t prefixlen,
1473 host_t *gateway, host_t *src_ip, char *if_name)
1474 {
1475 status_t status;
1476 route_entry_t *found, route = {
1477 .dst_net = dst_net,
1478 .prefixlen = prefixlen,
1479 .gateway = gateway,
1480 .if_name = if_name,
1481 };
1482
1483 this->routes_lock->lock(this->routes_lock);
1484 found = this->routes->get(this->routes, &route);
1485 if (!found)
1486 {
1487 this->routes_lock->unlock(this->routes_lock);
1488 return NOT_FOUND;
1489 }
1490 this->routes->remove(this->routes, found);
1491 route_entry_destroy(found);
1492 status = manage_route(this, RTM_DELETE, dst_net, prefixlen, gateway,
1493 if_name);
1494 this->routes_lock->unlock(this->routes_lock);
1495 return status;
1496 }
1497
1498 /**
1499 * Do a route lookup for dest and return either the nexthop or the source
1500 * address.
1501 */
1502 static host_t *get_route(private_kernel_pfroute_net_t *this, bool nexthop,
1503 host_t *dest, host_t *src)
1504 {
1505 struct {
1506 struct rt_msghdr hdr;
1507 char buf[sizeof(struct sockaddr_storage) * RTAX_MAX];
1508 } msg = {
1509 .hdr = {
1510 .rtm_version = RTM_VERSION,
1511 .rtm_type = RTM_GET,
1512 .rtm_pid = this->pid,
1513 .rtm_seq = ref_get(&this->seq),
1514 },
1515 };
1516 host_t *host = NULL;
1517 enumerator_t *enumerator;
1518 struct sockaddr *addr;
1519 bool failed = FALSE;
1520 int type;
1521
1522 retry:
1523 msg.hdr.rtm_msglen = sizeof(struct rt_msghdr);
1524 for (type = 0; type < RTAX_MAX; type++)
1525 {
1526 switch (type)
1527 {
1528 case RTAX_DST:
1529 add_rt_addr(&msg.hdr, RTA_DST, dest);
1530 break;
1531 case RTAX_IFA:
1532 add_rt_addr(&msg.hdr, RTA_IFA, src);
1533 break;
1534 case RTAX_IFP:
1535 if (!nexthop)
1536 { /* add an empty IFP to ensure we get a source address */
1537 add_rt_ifname(&msg.hdr, RTA_IFP, "");
1538 }
1539 break;
1540 default:
1541 break;
1542 }
1543 }
1544 this->mutex->lock(this->mutex);
1545
1546 while (this->waiting_seq)
1547 {
1548 this->condvar->wait(this->condvar, this->mutex);
1549 }
1550 this->waiting_seq = msg.hdr.rtm_seq;
1551 if (send(this->socket, &msg, msg.hdr.rtm_msglen, 0) == msg.hdr.rtm_msglen)
1552 {
1553 while (TRUE)
1554 {
1555 if (this->condvar->timed_wait(this->condvar, this->mutex, 1000))
1556 { /* timed out? */
1557 break;
1558 }
1559 if (!this->reply)
1560 {
1561 continue;
1562 }
1563 enumerator = create_rtmsg_enumerator(this->reply);
1564 while (enumerator->enumerate(enumerator, &type, &addr))
1565 {
1566 if (nexthop)
1567 {
1568 if (type == RTAX_DST && this->reply->rtm_flags & RTF_HOST)
1569 { /* probably a cloned/cached direct route, only use that
1570 * as fallback if no gateway is found */
1571 host = host ?: host_create_from_sockaddr(addr);
1572 }
1573 if (type == RTAX_GATEWAY)
1574 { /* could actually be a MAC address */
1575 host_t *gtw = host_create_from_sockaddr(addr);
1576 if (gtw)
1577 {
1578 DESTROY_IF(host);
1579 host = gtw;
1580 }
1581 }
1582 }
1583 else
1584 {
1585 if (type == RTAX_IFA)
1586 {
1587 host = host_create_from_sockaddr(addr);
1588 }
1589 }
1590 }
1591 enumerator->destroy(enumerator);
1592 break;
1593 }
1594 }
1595 else
1596 {
1597 failed = TRUE;
1598 }
1599 free(this->reply);
1600 this->reply = NULL;
1601 /* signal completion of query to a waiting thread */
1602 this->waiting_seq = 0;
1603 this->condvar->signal(this->condvar);
1604 this->mutex->unlock(this->mutex);
1605
1606 if (failed)
1607 {
1608 if (src)
1609 { /* the given source address might be gone, try again without */
1610 src = NULL;
1611 msg.hdr.rtm_seq = ref_get(&this->seq);
1612 msg.hdr.rtm_addrs = 0;
1613 memset(msg.buf, 0, sizeof(msg.buf));
1614 goto retry;
1615 }
1616 DBG1(DBG_KNL, "PF_ROUTE lookup failed: %s", strerror(errno));
1617 }
1618 if (nexthop)
1619 {
1620 host = host ?: dest->clone(dest);
1621 }
1622 else
1623 { /* make sure the source address is not virtual and usable */
1624 addr_entry_t *entry, lookup = {
1625 .ip = host,
1626 };
1627
1628 if (!host)
1629 {
1630 return NULL;
1631 }
1632 this->lock->read_lock(this->lock);
1633 entry = this->addrs->get_match(this->addrs, &lookup,
1634 (void*)addr_map_entry_match_up_and_usable);
1635 this->lock->unlock(this->lock);
1636 if (!entry)
1637 {
1638 host->destroy(host);
1639 return NULL;
1640 }
1641 }
1642 DBG2(DBG_KNL, "using %H as %s to reach %H", host,
1643 nexthop ? "nexthop" : "address", dest);
1644 return host;
1645 }
1646
1647 METHOD(kernel_net_t, get_source_addr, host_t*,
1648 private_kernel_pfroute_net_t *this, host_t *dest, host_t *src)
1649 {
1650 return get_route(this, FALSE, dest, src);
1651 }
1652
1653 METHOD(kernel_net_t, get_nexthop, host_t*,
1654 private_kernel_pfroute_net_t *this, host_t *dest, int prefix, host_t *src)
1655 {
1656 return get_route(this, TRUE, dest, src);
1657 }
1658
1659 /**
1660 * Initialize a list of local addresses.
1661 */
1662 static status_t init_address_list(private_kernel_pfroute_net_t *this)
1663 {
1664 struct ifaddrs *ifap, *ifa;
1665 iface_entry_t *iface, *current;
1666 addr_entry_t *addr;
1667 enumerator_t *ifaces, *addrs;
1668
1669 DBG2(DBG_KNL, "known interfaces and IP addresses:");
1670
1671 if (getifaddrs(&ifap) < 0)
1672 {
1673 DBG1(DBG_KNL, " failed to get interfaces!");
1674 return FAILED;
1675 }
1676
1677 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
1678 {
1679 if (ifa->ifa_addr == NULL)
1680 {
1681 continue;
1682 }
1683 switch(ifa->ifa_addr->sa_family)
1684 {
1685 case AF_LINK:
1686 case AF_INET:
1687 case AF_INET6:
1688 {
1689 iface = NULL;
1690 ifaces = this->ifaces->create_enumerator(this->ifaces);
1691 while (ifaces->enumerate(ifaces, &current))
1692 {
1693 if (streq(current->ifname, ifa->ifa_name))
1694 {
1695 iface = current;
1696 break;
1697 }
1698 }
1699 ifaces->destroy(ifaces);
1700
1701 if (!iface)
1702 {
1703 INIT(iface,
1704 .ifindex = if_nametoindex(ifa->ifa_name),
1705 .flags = ifa->ifa_flags,
1706 .addrs = linked_list_create(),
1707 .usable = hydra->kernel_interface->is_interface_usable(
1708 hydra->kernel_interface, ifa->ifa_name),
1709 );
1710 memcpy(iface->ifname, ifa->ifa_name, IFNAMSIZ);
1711 this->ifaces->insert_last(this->ifaces, iface);
1712 }
1713
1714 if (ifa->ifa_addr->sa_family != AF_LINK)
1715 {
1716 INIT(addr,
1717 .ip = host_create_from_sockaddr(ifa->ifa_addr),
1718 );
1719 iface->addrs->insert_last(iface->addrs, addr);
1720 addr_map_entry_add(this, addr, iface);
1721 }
1722 }
1723 }
1724 }
1725 freeifaddrs(ifap);
1726
1727 ifaces = this->ifaces->create_enumerator(this->ifaces);
1728 while (ifaces->enumerate(ifaces, &iface))
1729 {
1730 if (iface->usable && iface->flags & IFF_UP)
1731 {
1732 DBG2(DBG_KNL, " %s", iface->ifname);
1733 addrs = iface->addrs->create_enumerator(iface->addrs);
1734 while (addrs->enumerate(addrs, (void**)&addr))
1735 {
1736 DBG2(DBG_KNL, " %H", addr->ip);
1737 }
1738 addrs->destroy(addrs);
1739 }
1740 }
1741 ifaces->destroy(ifaces);
1742
1743 return SUCCESS;
1744 }
1745
1746 METHOD(kernel_net_t, destroy, void,
1747 private_kernel_pfroute_net_t *this)
1748 {
1749 enumerator_t *enumerator;
1750 route_entry_t *route;
1751 addr_entry_t *addr;
1752
1753 enumerator = this->routes->create_enumerator(this->routes);
1754 while (enumerator->enumerate(enumerator, NULL, (void**)&route))
1755 {
1756 manage_route(this, RTM_DELETE, route->dst_net, route->prefixlen,
1757 route->gateway, route->if_name);
1758 route_entry_destroy(route);
1759 }
1760 enumerator->destroy(enumerator);
1761 this->routes->destroy(this->routes);
1762 this->routes_lock->destroy(this->routes_lock);
1763
1764 if (this->socket != -1)
1765 {
1766 lib->watcher->remove(lib->watcher, this->socket);
1767 close(this->socket);
1768 }
1769
1770 net_changes_clear(this);
1771 this->net_changes->destroy(this->net_changes);
1772 this->net_changes_lock->destroy(this->net_changes_lock);
1773
1774 enumerator = this->addrs->create_enumerator(this->addrs);
1775 while (enumerator->enumerate(enumerator, NULL, (void**)&addr))
1776 {
1777 free(addr);
1778 }
1779 enumerator->destroy(enumerator);
1780 this->addrs->destroy(this->addrs);
1781 this->ifaces->destroy_function(this->ifaces, (void*)iface_entry_destroy);
1782 this->tuns->destroy(this->tuns);
1783 this->lock->destroy(this->lock);
1784 this->mutex->destroy(this->mutex);
1785 this->condvar->destroy(this->condvar);
1786 this->roam_lock->destroy(this->roam_lock);
1787 free(this->reply);
1788 free(this);
1789 }
1790
1791 /*
1792 * Described in header.
1793 */
1794 kernel_pfroute_net_t *kernel_pfroute_net_create()
1795 {
1796 private_kernel_pfroute_net_t *this;
1797
1798 INIT(this,
1799 .public = {
1800 .interface = {
1801 .get_features = _get_features,
1802 .get_interface = _get_interface_name,
1803 .create_address_enumerator = _create_address_enumerator,
1804 .get_source_addr = _get_source_addr,
1805 .get_nexthop = _get_nexthop,
1806 .add_ip = _add_ip,
1807 .del_ip = _del_ip,
1808 .add_route = _add_route,
1809 .del_route = _del_route,
1810 .destroy = _destroy,
1811 },
1812 },
1813 .pid = getpid(),
1814 .ifaces = linked_list_create(),
1815 .addrs = hashtable_create(
1816 (hashtable_hash_t)addr_map_entry_hash,
1817 (hashtable_equals_t)addr_map_entry_equals, 16),
1818 .routes = hashtable_create((hashtable_hash_t)route_entry_hash,
1819 (hashtable_equals_t)route_entry_equals, 16),
1820 .net_changes = hashtable_create(
1821 (hashtable_hash_t)net_change_hash,
1822 (hashtable_equals_t)net_change_equals, 16),
1823 .tuns = linked_list_create(),
1824 .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
1825 .mutex = mutex_create(MUTEX_TYPE_DEFAULT),
1826 .condvar = condvar_create(CONDVAR_TYPE_DEFAULT),
1827 .routes_lock = mutex_create(MUTEX_TYPE_DEFAULT),
1828 .net_changes_lock = mutex_create(MUTEX_TYPE_DEFAULT),
1829 .roam_lock = spinlock_create(),
1830 .vip_wait = lib->settings->get_int(lib->settings,
1831 "%s.plugins.kernel-pfroute.vip_wait", 1000, lib->ns),
1832 );
1833 timerclear(&this->last_route_reinstall);
1834 timerclear(&this->next_roam);
1835
1836 /* create a PF_ROUTE socket to communicate with the kernel */
1837 this->socket = socket(PF_ROUTE, SOCK_RAW, AF_UNSPEC);
1838 if (this->socket == -1)
1839 {
1840 DBG1(DBG_KNL, "unable to create PF_ROUTE socket");
1841 destroy(this);
1842 return NULL;
1843 }
1844
1845 if (streq(lib->ns, "starter"))
1846 {
1847 /* starter has no threads, so we do not register for kernel events */
1848 if (shutdown(this->socket, SHUT_RD) != 0)
1849 {
1850 DBG1(DBG_KNL, "closing read end of PF_ROUTE socket failed: %s",
1851 strerror(errno));
1852 }
1853 }
1854 else
1855 {
1856 lib->watcher->add(lib->watcher, this->socket, WATCHER_READ,
1857 (watcher_cb_t)receive_events, this);
1858 }
1859 if (init_address_list(this) != SUCCESS)
1860 {
1861 DBG1(DBG_KNL, "unable to get interface list");
1862 destroy(this);
1863 return NULL;
1864 }
1865
1866 return &this->public;
1867 }