kernel-pfroute: Ignore IP address changes if address is %any
[strongswan.git] / src / libhydra / plugins / kernel_pfroute / kernel_pfroute_net.c
1 /*
2 * Copyright (C) 2009-2013 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <sys/types.h>
17 #include <sys/socket.h>
18 #include <net/if.h>
19 #include <net/if_dl.h>
20 #include <ifaddrs.h>
21 #include <net/route.h>
22 #include <unistd.h>
23 #include <errno.h>
24
25 #include "kernel_pfroute_net.h"
26
27 #include <hydra.h>
28 #include <utils/debug.h>
29 #include <networking/host.h>
30 #include <networking/tun_device.h>
31 #include <threading/thread.h>
32 #include <threading/mutex.h>
33 #include <threading/condvar.h>
34 #include <threading/rwlock.h>
35 #include <collections/hashtable.h>
36 #include <collections/linked_list.h>
37 #include <processing/jobs/callback_job.h>
38
39 #ifndef HAVE_STRUCT_SOCKADDR_SA_LEN
40 #error Cannot compile this plugin on systems where 'struct sockaddr' has no sa_len member.
41 #endif
42
43 /** properly align sockaddrs */
44 #ifdef __APPLE__
45 /* Apple always uses 4 bytes */
46 #define SA_ALIGN 4
47 #else
48 /* while on other platforms like FreeBSD it depends on the architecture */
49 #define SA_ALIGN sizeof(long)
50 #endif
51 #define SA_LEN(len) ((len) > 0 ? (((len)+SA_ALIGN-1) & ~(SA_ALIGN-1)) : SA_ALIGN)
52
53 /** delay before firing roam events (ms) */
54 #define ROAM_DELAY 100
55
56 /** delay before reinstalling routes (ms) */
57 #define ROUTE_DELAY 100
58
59 typedef struct addr_entry_t addr_entry_t;
60
61 /**
62 * IP address in an inface_entry_t
63 */
64 struct addr_entry_t {
65
66 /** The ip address */
67 host_t *ip;
68
69 /** virtual IP managed by us */
70 bool virtual;
71 };
72
73 /**
74 * destroy a addr_entry_t object
75 */
76 static void addr_entry_destroy(addr_entry_t *this)
77 {
78 this->ip->destroy(this->ip);
79 free(this);
80 }
81
82 typedef struct iface_entry_t iface_entry_t;
83
84 /**
85 * A network interface on this system, containing addr_entry_t's
86 */
87 struct iface_entry_t {
88
89 /** interface index */
90 int ifindex;
91
92 /** name of the interface */
93 char ifname[IFNAMSIZ];
94
95 /** interface flags, as in netdevice(7) SIOCGIFFLAGS */
96 u_int flags;
97
98 /** list of addresses as host_t */
99 linked_list_t *addrs;
100
101 /** TRUE if usable by config */
102 bool usable;
103 };
104
105 /**
106 * destroy an interface entry
107 */
108 static void iface_entry_destroy(iface_entry_t *this)
109 {
110 this->addrs->destroy_function(this->addrs, (void*)addr_entry_destroy);
111 free(this);
112 }
113
114 /**
115 * check if an interface is up
116 */
117 static inline bool iface_entry_up(iface_entry_t *iface)
118 {
119 return (iface->flags & IFF_UP) == IFF_UP;
120 }
121
122 /**
123 * check if an interface is up and usable
124 */
125 static inline bool iface_entry_up_and_usable(iface_entry_t *iface)
126 {
127 return iface->usable && iface_entry_up(iface);
128 }
129
130 typedef struct addr_map_entry_t addr_map_entry_t;
131
132 /**
133 * Entry that maps an IP address to an interface entry
134 */
135 struct addr_map_entry_t {
136 /** The IP address */
137 host_t *ip;
138
139 /** The address entry for this IP address */
140 addr_entry_t *addr;
141
142 /** The interface this address is installed on */
143 iface_entry_t *iface;
144 };
145
146 /**
147 * Hash a addr_map_entry_t object, all entries with the same IP address
148 * are stored in the same bucket
149 */
150 static u_int addr_map_entry_hash(addr_map_entry_t *this)
151 {
152 return chunk_hash(this->ip->get_address(this->ip));
153 }
154
155 /**
156 * Compare two addr_map_entry_t objects, two entries are equal if they are
157 * installed on the same interface
158 */
159 static bool addr_map_entry_equals(addr_map_entry_t *a, addr_map_entry_t *b)
160 {
161 return a->iface->ifindex == b->iface->ifindex &&
162 a->ip->ip_equals(a->ip, b->ip);
163 }
164
165 /**
166 * Used with get_match this finds an address entry if it is installed on
167 * an up and usable interface
168 */
169 static bool addr_map_entry_match_up_and_usable(addr_map_entry_t *a,
170 addr_map_entry_t *b)
171 {
172 return !b->addr->virtual && iface_entry_up_and_usable(b->iface) &&
173 a->ip->ip_equals(a->ip, b->ip);
174 }
175
176 /**
177 * Used with get_match this finds an address entry if it is installed as virtual
178 * IP address
179 */
180 static bool addr_map_entry_match_virtual(addr_map_entry_t *a, addr_map_entry_t *b)
181 {
182 return b->addr->virtual && a->ip->ip_equals(a->ip, b->ip);
183 }
184
185 /**
186 * Used with get_match this finds an address entry if it is installed on
187 * any active local interface
188 */
189 static bool addr_map_entry_match_up(addr_map_entry_t *a, addr_map_entry_t *b)
190 {
191 return !b->addr->virtual && iface_entry_up(b->iface) &&
192 a->ip->ip_equals(a->ip, b->ip);
193 }
194
195 typedef struct route_entry_t route_entry_t;
196
197 /**
198 * Installed routing entry
199 */
200 struct route_entry_t {
201 /** Name of the interface the route is bound to */
202 char *if_name;
203
204 /** Gateway for this route */
205 host_t *gateway;
206
207 /** Destination net */
208 chunk_t dst_net;
209
210 /** Destination net prefixlen */
211 u_int8_t prefixlen;
212 };
213
214 /**
215 * Clone a route_entry_t object.
216 */
217 static route_entry_t *route_entry_clone(route_entry_t *this)
218 {
219 route_entry_t *route;
220
221 INIT(route,
222 .if_name = strdup(this->if_name),
223 .gateway = this->gateway ? this->gateway->clone(this->gateway) : NULL,
224 .dst_net = chunk_clone(this->dst_net),
225 .prefixlen = this->prefixlen,
226 );
227 return route;
228 }
229
230 /**
231 * Destroy a route_entry_t object
232 */
233 static void route_entry_destroy(route_entry_t *this)
234 {
235 free(this->if_name);
236 DESTROY_IF(this->gateway);
237 chunk_free(&this->dst_net);
238 free(this);
239 }
240
241 /**
242 * Hash a route_entry_t object
243 */
244 static u_int route_entry_hash(route_entry_t *this)
245 {
246 return chunk_hash_inc(chunk_from_thing(this->prefixlen),
247 chunk_hash(this->dst_net));
248 }
249
250 /**
251 * Compare two route_entry_t objects
252 */
253 static bool route_entry_equals(route_entry_t *a, route_entry_t *b)
254 {
255 if (a->if_name && b->if_name && streq(a->if_name, b->if_name) &&
256 chunk_equals(a->dst_net, b->dst_net) && a->prefixlen == b->prefixlen)
257 {
258 return (!a->gateway && !b->gateway) || (a->gateway && b->gateway &&
259 a->gateway->ip_equals(a->gateway, b->gateway));
260 }
261 return FALSE;
262 }
263
264 typedef struct net_change_t net_change_t;
265
266 /**
267 * Queued network changes
268 */
269 struct net_change_t {
270 /** Name of the interface that got activated (or an IP appeared on) */
271 char *if_name;
272 };
273
274 /**
275 * Destroy a net_change_t object
276 */
277 static void net_change_destroy(net_change_t *this)
278 {
279 free(this->if_name);
280 free(this);
281 }
282
283 /**
284 * Hash a net_change_t object
285 */
286 static u_int net_change_hash(net_change_t *this)
287 {
288 return chunk_hash(chunk_create(this->if_name, strlen(this->if_name)));
289 }
290
291 /**
292 * Compare two net_change_t objects
293 */
294 static bool net_change_equals(net_change_t *a, net_change_t *b)
295 {
296 return streq(a->if_name, b->if_name);
297 }
298
299 typedef struct private_kernel_pfroute_net_t private_kernel_pfroute_net_t;
300
301 /**
302 * Private variables and functions of kernel_pfroute class.
303 */
304 struct private_kernel_pfroute_net_t
305 {
306 /**
307 * Public part of the kernel_pfroute_t object.
308 */
309 kernel_pfroute_net_t public;
310
311 /**
312 * lock to access lists and maps
313 */
314 rwlock_t *lock;
315
316 /**
317 * Cached list of interfaces and their addresses (iface_entry_t)
318 */
319 linked_list_t *ifaces;
320
321 /**
322 * Map for IP addresses to iface_entry_t objects (addr_map_entry_t)
323 */
324 hashtable_t *addrs;
325
326 /**
327 * List of tun devices we installed for virtual IPs
328 */
329 linked_list_t *tuns;
330
331 /**
332 * mutex to communicate exclusively with PF_KEY
333 */
334 mutex_t *mutex;
335
336 /**
337 * condvar to signal if PF_KEY query got a response
338 */
339 condvar_t *condvar;
340
341 /**
342 * installed routes
343 */
344 hashtable_t *routes;
345
346 /**
347 * mutex for routes
348 */
349 mutex_t *routes_lock;
350
351 /**
352 * interface changes which may trigger route reinstallation
353 */
354 hashtable_t *net_changes;
355
356 /**
357 * mutex for route reinstallation triggers
358 */
359 mutex_t *net_changes_lock;
360
361 /**
362 * time of last route reinstallation
363 */
364 timeval_t last_route_reinstall;
365
366 /**
367 * pid to send PF_ROUTE messages with
368 */
369 pid_t pid;
370
371 /**
372 * PF_ROUTE socket to communicate with the kernel
373 */
374 int socket;
375
376 /**
377 * sequence number for messages sent to the kernel
378 */
379 int seq;
380
381 /**
382 * Sequence number a query is waiting for
383 */
384 int waiting_seq;
385
386 /**
387 * Allocated reply message from kernel
388 */
389 struct rt_msghdr *reply;
390
391 /**
392 * time of last roam event
393 */
394 timeval_t last_roam;
395
396 /**
397 * Time in ms to wait for IP addresses to appear/disappear
398 */
399 int vip_wait;
400 };
401
402
403 /**
404 * Forward declaration
405 */
406 static status_t manage_route(private_kernel_pfroute_net_t *this, int op,
407 chunk_t dst_net, u_int8_t prefixlen,
408 host_t *gateway, char *if_name);
409
410 /**
411 * Clear the queued network changes.
412 */
413 static void net_changes_clear(private_kernel_pfroute_net_t *this)
414 {
415 enumerator_t *enumerator;
416 net_change_t *change;
417
418 enumerator = this->net_changes->create_enumerator(this->net_changes);
419 while (enumerator->enumerate(enumerator, NULL, (void**)&change))
420 {
421 this->net_changes->remove_at(this->net_changes, enumerator);
422 net_change_destroy(change);
423 }
424 enumerator->destroy(enumerator);
425 }
426
427 /**
428 * Act upon queued network changes.
429 */
430 static job_requeue_t reinstall_routes(private_kernel_pfroute_net_t *this)
431 {
432 enumerator_t *enumerator;
433 route_entry_t *route;
434
435 this->net_changes_lock->lock(this->net_changes_lock);
436 this->routes_lock->lock(this->routes_lock);
437
438 enumerator = this->routes->create_enumerator(this->routes);
439 while (enumerator->enumerate(enumerator, NULL, (void**)&route))
440 {
441 net_change_t *change, lookup = {
442 .if_name = route->if_name,
443 };
444 /* check if a change for the outgoing interface is queued */
445 change = this->net_changes->get(this->net_changes, &lookup);
446 if (change)
447 {
448 manage_route(this, RTM_ADD, route->dst_net, route->prefixlen,
449 route->gateway, route->if_name);
450 }
451 }
452 enumerator->destroy(enumerator);
453 this->routes_lock->unlock(this->routes_lock);
454
455 net_changes_clear(this);
456 this->net_changes_lock->unlock(this->net_changes_lock);
457 return JOB_REQUEUE_NONE;
458 }
459
460 /**
461 * Queue route reinstallation caused by network changes for a given interface.
462 *
463 * The route reinstallation is delayed for a while and only done once for
464 * several calls during this delay, in order to avoid doing it too often.
465 * The interface name is freed.
466 */
467 static void queue_route_reinstall(private_kernel_pfroute_net_t *this,
468 char *if_name)
469 {
470 net_change_t *update, *found;
471 timeval_t now;
472 job_t *job;
473
474 INIT(update,
475 .if_name = if_name
476 );
477
478 this->net_changes_lock->lock(this->net_changes_lock);
479 found = this->net_changes->put(this->net_changes, update, update);
480 if (found)
481 {
482 net_change_destroy(found);
483 }
484 time_monotonic(&now);
485 if (timercmp(&now, &this->last_route_reinstall, >))
486 {
487 timeval_add_ms(&now, ROUTE_DELAY);
488 this->last_route_reinstall = now;
489
490 job = (job_t*)callback_job_create((callback_job_cb_t)reinstall_routes,
491 this, NULL, NULL);
492 lib->scheduler->schedule_job_ms(lib->scheduler, job, ROUTE_DELAY);
493 }
494 this->net_changes_lock->unlock(this->net_changes_lock);
495 }
496
497 /**
498 * Add an address map entry
499 */
500 static void addr_map_entry_add(private_kernel_pfroute_net_t *this,
501 addr_entry_t *addr, iface_entry_t *iface)
502 {
503 addr_map_entry_t *entry;
504
505 INIT(entry,
506 .ip = addr->ip,
507 .addr = addr,
508 .iface = iface,
509 );
510 entry = this->addrs->put(this->addrs, entry, entry);
511 free(entry);
512 }
513
514 /**
515 * Remove an address map entry (the argument order is a bit strange because
516 * it is also used with linked_list_t.invoke_function)
517 */
518 static void addr_map_entry_remove(addr_entry_t *addr, iface_entry_t *iface,
519 private_kernel_pfroute_net_t *this)
520 {
521 addr_map_entry_t *entry, lookup = {
522 .ip = addr->ip,
523 .addr = addr,
524 .iface = iface,
525 };
526
527 entry = this->addrs->remove(this->addrs, &lookup);
528 free(entry);
529 }
530
531 /**
532 * callback function that raises the delayed roam event
533 */
534 static job_requeue_t roam_event(uintptr_t address)
535 {
536 hydra->kernel_interface->roam(hydra->kernel_interface, address != 0);
537 return JOB_REQUEUE_NONE;
538 }
539
540 /**
541 * fire a roaming event. we delay it for a bit and fire only one event
542 * for multiple calls. otherwise we would create too many events.
543 */
544 static void fire_roam_event(private_kernel_pfroute_net_t *this, bool address)
545 {
546 timeval_t now;
547 job_t *job;
548
549 time_monotonic(&now);
550 if (timercmp(&now, &this->last_roam, >))
551 {
552 timeval_add_ms(&now, ROAM_DELAY);
553 this->last_roam = now;
554
555 job = (job_t*)callback_job_create((callback_job_cb_t)roam_event,
556 (void*)(uintptr_t)(address ? 1 : 0),
557 NULL, NULL);
558 lib->scheduler->schedule_job_ms(lib->scheduler, job, ROAM_DELAY);
559 }
560 }
561
562 /**
563 * Data for enumerator over rtmsg sockaddrs
564 */
565 typedef struct {
566 /** implements enumerator */
567 enumerator_t public;
568 /** copy of attribute bitfield */
569 int types;
570 /** bytes remaining in buffer */
571 int remaining;
572 /** next sockaddr to enumerate */
573 struct sockaddr *addr;
574 } rt_enumerator_t;
575
576 METHOD(enumerator_t, rt_enumerate, bool,
577 rt_enumerator_t *this, int *xtype, struct sockaddr **addr)
578 {
579 int i, type;
580
581 if (this->remaining < sizeof(this->addr->sa_len) ||
582 this->remaining < this->addr->sa_len)
583 {
584 return FALSE;
585 }
586 for (i = 0; i < RTAX_MAX; i++)
587 {
588 type = (1 << i);
589 if (this->types & type)
590 {
591 this->types &= ~type;
592 *addr = this->addr;
593 *xtype = i;
594 this->remaining -= SA_LEN(this->addr->sa_len);
595 this->addr = (struct sockaddr*)((char*)this->addr +
596 SA_LEN(this->addr->sa_len));
597 return TRUE;
598 }
599 }
600 return FALSE;
601 }
602
603 /**
604 * Create an enumerator over sockaddrs in rt/if messages
605 */
606 static enumerator_t *create_rt_enumerator(int types, int remaining,
607 struct sockaddr *addr)
608 {
609 rt_enumerator_t *this;
610
611 INIT(this,
612 .public = {
613 .enumerate = (void*)_rt_enumerate,
614 .destroy = (void*)free,
615 },
616 .types = types,
617 .remaining = remaining,
618 .addr = addr,
619 );
620 return &this->public;
621 }
622
623 /**
624 * Create a safe enumerator over sockaddrs in rt_msghdr
625 */
626 static enumerator_t *create_rtmsg_enumerator(struct rt_msghdr *hdr)
627 {
628 return create_rt_enumerator(hdr->rtm_addrs, hdr->rtm_msglen - sizeof(*hdr),
629 (struct sockaddr *)(hdr + 1));
630 }
631
632 /**
633 * Create a safe enumerator over sockaddrs in ifa_msghdr
634 */
635 static enumerator_t *create_ifamsg_enumerator(struct ifa_msghdr *hdr)
636 {
637 return create_rt_enumerator(hdr->ifam_addrs, hdr->ifam_msglen - sizeof(*hdr),
638 (struct sockaddr *)(hdr + 1));
639 }
640
641 /**
642 * Process an RTM_*ADDR message from the kernel
643 */
644 static void process_addr(private_kernel_pfroute_net_t *this,
645 struct ifa_msghdr *ifa)
646 {
647 struct sockaddr *sockaddr;
648 host_t *host = NULL;
649 enumerator_t *ifaces, *addrs;
650 iface_entry_t *iface;
651 addr_entry_t *addr;
652 bool found = FALSE, changed = FALSE, roam = FALSE;
653 enumerator_t *enumerator;
654 char *ifname = NULL;
655 int type;
656
657 enumerator = create_ifamsg_enumerator(ifa);
658 while (enumerator->enumerate(enumerator, &type, &sockaddr))
659 {
660 if (type == RTAX_IFA)
661 {
662 host = host_create_from_sockaddr(sockaddr);
663 break;
664 }
665 }
666 enumerator->destroy(enumerator);
667
668 if (!host || host->is_anyaddr(host))
669 {
670 DESTROY_IF(host);
671 return;
672 }
673
674 this->lock->write_lock(this->lock);
675 ifaces = this->ifaces->create_enumerator(this->ifaces);
676 while (ifaces->enumerate(ifaces, &iface))
677 {
678 if (iface->ifindex == ifa->ifam_index)
679 {
680 addrs = iface->addrs->create_enumerator(iface->addrs);
681 while (addrs->enumerate(addrs, &addr))
682 {
683 if (host->ip_equals(host, addr->ip))
684 {
685 found = TRUE;
686 if (ifa->ifam_type == RTM_DELADDR)
687 {
688 iface->addrs->remove_at(iface->addrs, addrs);
689 if (!addr->virtual && iface->usable)
690 {
691 changed = TRUE;
692 DBG1(DBG_KNL, "%H disappeared from %s",
693 host, iface->ifname);
694 }
695 addr_map_entry_remove(addr, iface, this);
696 addr_entry_destroy(addr);
697 }
698 }
699 }
700 addrs->destroy(addrs);
701
702 if (!found && ifa->ifam_type == RTM_NEWADDR)
703 {
704 INIT(addr,
705 .ip = host->clone(host),
706 );
707 changed = TRUE;
708 ifname = strdup(iface->ifname);
709 iface->addrs->insert_last(iface->addrs, addr);
710 addr_map_entry_add(this, addr, iface);
711 if (iface->usable)
712 {
713 DBG1(DBG_KNL, "%H appeared on %s", host, iface->ifname);
714 }
715 }
716
717 if (changed && iface_entry_up_and_usable(iface))
718 {
719 roam = TRUE;
720 }
721 break;
722 }
723 }
724 ifaces->destroy(ifaces);
725 this->lock->unlock(this->lock);
726 host->destroy(host);
727
728 if (roam && ifname)
729 {
730 queue_route_reinstall(this, ifname);
731 }
732 else
733 {
734 free(ifname);
735 }
736
737 if (roam)
738 {
739 fire_roam_event(this, TRUE);
740 }
741 }
742
743 /**
744 * Re-initialize address list of an interface if it changes state
745 */
746 static void repopulate_iface(private_kernel_pfroute_net_t *this,
747 iface_entry_t *iface)
748 {
749 struct ifaddrs *ifap, *ifa;
750 addr_entry_t *addr;
751
752 while (iface->addrs->remove_last(iface->addrs, (void**)&addr) == SUCCESS)
753 {
754 addr_map_entry_remove(addr, iface, this);
755 addr_entry_destroy(addr);
756 }
757
758 if (getifaddrs(&ifap) == 0)
759 {
760 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
761 {
762 if (ifa->ifa_addr && streq(ifa->ifa_name, iface->ifname))
763 {
764 switch (ifa->ifa_addr->sa_family)
765 {
766 case AF_INET:
767 case AF_INET6:
768 INIT(addr,
769 .ip = host_create_from_sockaddr(ifa->ifa_addr),
770 );
771 iface->addrs->insert_last(iface->addrs, addr);
772 addr_map_entry_add(this, addr, iface);
773 break;
774 default:
775 break;
776 }
777 }
778 }
779 freeifaddrs(ifap);
780 }
781 }
782
783 /**
784 * Process an RTM_IFINFO message from the kernel
785 */
786 static void process_link(private_kernel_pfroute_net_t *this,
787 struct if_msghdr *msg)
788 {
789 enumerator_t *enumerator;
790 iface_entry_t *iface;
791 bool roam = FALSE, found = FALSE, update_routes = FALSE;
792
793 this->lock->write_lock(this->lock);
794 enumerator = this->ifaces->create_enumerator(this->ifaces);
795 while (enumerator->enumerate(enumerator, &iface))
796 {
797 if (iface->ifindex == msg->ifm_index)
798 {
799 if (iface->usable)
800 {
801 if (!(iface->flags & IFF_UP) && (msg->ifm_flags & IFF_UP))
802 {
803 roam = update_routes = TRUE;
804 DBG1(DBG_KNL, "interface %s activated", iface->ifname);
805 }
806 else if ((iface->flags & IFF_UP) && !(msg->ifm_flags & IFF_UP))
807 {
808 roam = TRUE;
809 DBG1(DBG_KNL, "interface %s deactivated", iface->ifname);
810 }
811 }
812 iface->flags = msg->ifm_flags;
813 repopulate_iface(this, iface);
814 found = TRUE;
815 break;
816 }
817 }
818 enumerator->destroy(enumerator);
819
820 if (!found)
821 {
822 INIT(iface,
823 .ifindex = msg->ifm_index,
824 .flags = msg->ifm_flags,
825 .addrs = linked_list_create(),
826 );
827 if (if_indextoname(iface->ifindex, iface->ifname))
828 {
829 DBG1(DBG_KNL, "interface %s appeared", iface->ifname);
830 iface->usable = hydra->kernel_interface->is_interface_usable(
831 hydra->kernel_interface, iface->ifname);
832 repopulate_iface(this, iface);
833 this->ifaces->insert_last(this->ifaces, iface);
834 if (iface->usable)
835 {
836 roam = update_routes = TRUE;
837 }
838 }
839 else
840 {
841 free(iface);
842 }
843 }
844 this->lock->unlock(this->lock);
845
846 if (update_routes)
847 {
848 queue_route_reinstall(this, strdup(iface->ifname));
849 }
850
851 if (roam)
852 {
853 fire_roam_event(this, TRUE);
854 }
855 }
856
857 /**
858 * Process an RTM_*ROUTE message from the kernel
859 */
860 static void process_route(private_kernel_pfroute_net_t *this,
861 struct rt_msghdr *msg)
862 {
863
864 }
865
866 /**
867 * Receives PF_ROUTE messages from kernel
868 */
869 static job_requeue_t receive_events(private_kernel_pfroute_net_t *this)
870 {
871 struct {
872 union {
873 struct rt_msghdr rtm;
874 struct if_msghdr ifm;
875 struct ifa_msghdr ifam;
876 };
877 char buf[sizeof(struct sockaddr_storage) * RTAX_MAX];
878 } msg;
879 int len, hdrlen;
880 bool oldstate;
881
882 oldstate = thread_cancelability(TRUE);
883 len = recv(this->socket, &msg, sizeof(msg), 0);
884 thread_cancelability(oldstate);
885
886 if (len < 0)
887 {
888 switch (errno)
889 {
890 case EINTR:
891 case EAGAIN:
892 return JOB_REQUEUE_DIRECT;
893 default:
894 DBG1(DBG_KNL, "unable to receive from PF_ROUTE event socket");
895 sleep(1);
896 return JOB_REQUEUE_FAIR;
897 }
898 }
899
900 if (len < offsetof(struct rt_msghdr, rtm_flags) || len < msg.rtm.rtm_msglen)
901 {
902 DBG1(DBG_KNL, "received invalid PF_ROUTE message");
903 return JOB_REQUEUE_DIRECT;
904 }
905 if (msg.rtm.rtm_version != RTM_VERSION)
906 {
907 DBG1(DBG_KNL, "received PF_ROUTE message with unsupported version: %d",
908 msg.rtm.rtm_version);
909 return JOB_REQUEUE_DIRECT;
910 }
911 switch (msg.rtm.rtm_type)
912 {
913 case RTM_NEWADDR:
914 case RTM_DELADDR:
915 hdrlen = sizeof(msg.ifam);
916 break;
917 case RTM_IFINFO:
918 hdrlen = sizeof(msg.ifm);
919 break;
920 case RTM_ADD:
921 case RTM_DELETE:
922 case RTM_GET:
923 hdrlen = sizeof(msg.rtm);
924 break;
925 default:
926 return JOB_REQUEUE_DIRECT;
927 }
928 if (msg.rtm.rtm_msglen < hdrlen)
929 {
930 DBG1(DBG_KNL, "ignoring short PF_ROUTE message");
931 return JOB_REQUEUE_DIRECT;
932 }
933 switch (msg.rtm.rtm_type)
934 {
935 case RTM_NEWADDR:
936 case RTM_DELADDR:
937 process_addr(this, &msg.ifam);
938 break;
939 case RTM_IFINFO:
940 process_link(this, &msg.ifm);
941 break;
942 case RTM_ADD:
943 case RTM_DELETE:
944 process_route(this, &msg.rtm);
945 break;
946 default:
947 break;
948 }
949
950 this->mutex->lock(this->mutex);
951 if (msg.rtm.rtm_pid == this->pid && msg.rtm.rtm_seq == this->waiting_seq)
952 {
953 /* seems like the message someone is waiting for, deliver */
954 this->reply = realloc(this->reply, msg.rtm.rtm_msglen);
955 memcpy(this->reply, &msg, msg.rtm.rtm_msglen);
956 }
957 /* signal on any event, add_ip()/del_ip() might wait for it */
958 this->condvar->broadcast(this->condvar);
959 this->mutex->unlock(this->mutex);
960
961 return JOB_REQUEUE_DIRECT;
962 }
963
964
965 /** enumerator over addresses */
966 typedef struct {
967 private_kernel_pfroute_net_t* this;
968 /** which addresses to enumerate */
969 kernel_address_type_t which;
970 } address_enumerator_t;
971
972 /**
973 * cleanup function for address enumerator
974 */
975 static void address_enumerator_destroy(address_enumerator_t *data)
976 {
977 data->this->lock->unlock(data->this->lock);
978 free(data);
979 }
980
981 /**
982 * filter for addresses
983 */
984 static bool filter_addresses(address_enumerator_t *data,
985 addr_entry_t** in, host_t** out)
986 {
987 host_t *ip;
988 if (!(data->which & ADDR_TYPE_VIRTUAL) && (*in)->virtual)
989 { /* skip virtual interfaces added by us */
990 return FALSE;
991 }
992 if (!(data->which & ADDR_TYPE_REGULAR) && !(*in)->virtual)
993 { /* address is regular, but not requested */
994 return FALSE;
995 }
996 ip = (*in)->ip;
997 if (ip->get_family(ip) == AF_INET6)
998 {
999 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)ip->get_sockaddr(ip);
1000 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
1001 { /* skip addresses with a unusable scope */
1002 return FALSE;
1003 }
1004 }
1005 *out = ip;
1006 return TRUE;
1007 }
1008
1009 /**
1010 * enumerator constructor for interfaces
1011 */
1012 static enumerator_t *create_iface_enumerator(iface_entry_t *iface,
1013 address_enumerator_t *data)
1014 {
1015 return enumerator_create_filter(iface->addrs->create_enumerator(iface->addrs),
1016 (void*)filter_addresses, data, NULL);
1017 }
1018
1019 /**
1020 * filter for interfaces
1021 */
1022 static bool filter_interfaces(address_enumerator_t *data, iface_entry_t** in,
1023 iface_entry_t** out)
1024 {
1025 if (!(data->which & ADDR_TYPE_IGNORED) && !(*in)->usable)
1026 { /* skip interfaces excluded by config */
1027 return FALSE;
1028 }
1029 if (!(data->which & ADDR_TYPE_LOOPBACK) && ((*in)->flags & IFF_LOOPBACK))
1030 { /* ignore loopback devices */
1031 return FALSE;
1032 }
1033 if (!(data->which & ADDR_TYPE_DOWN) && !((*in)->flags & IFF_UP))
1034 { /* skip interfaces not up */
1035 return FALSE;
1036 }
1037 *out = *in;
1038 return TRUE;
1039 }
1040
1041 METHOD(kernel_net_t, create_address_enumerator, enumerator_t*,
1042 private_kernel_pfroute_net_t *this, kernel_address_type_t which)
1043 {
1044 address_enumerator_t *data;
1045
1046 INIT(data,
1047 .this = this,
1048 .which = which,
1049 );
1050
1051 this->lock->read_lock(this->lock);
1052 return enumerator_create_nested(
1053 enumerator_create_filter(
1054 this->ifaces->create_enumerator(this->ifaces),
1055 (void*)filter_interfaces, data, NULL),
1056 (void*)create_iface_enumerator, data,
1057 (void*)address_enumerator_destroy);
1058 }
1059
1060 METHOD(kernel_net_t, get_features, kernel_feature_t,
1061 private_kernel_pfroute_net_t *this)
1062 {
1063 return KERNEL_REQUIRE_EXCLUDE_ROUTE;
1064 }
1065
1066 METHOD(kernel_net_t, get_interface_name, bool,
1067 private_kernel_pfroute_net_t *this, host_t* ip, char **name)
1068 {
1069 addr_map_entry_t *entry, lookup = {
1070 .ip = ip,
1071 };
1072
1073 if (ip->is_anyaddr(ip))
1074 {
1075 return FALSE;
1076 }
1077 this->lock->read_lock(this->lock);
1078 /* first try to find it on an up and usable interface */
1079 entry = this->addrs->get_match(this->addrs, &lookup,
1080 (void*)addr_map_entry_match_up_and_usable);
1081 if (entry)
1082 {
1083 if (name)
1084 {
1085 *name = strdup(entry->iface->ifname);
1086 DBG2(DBG_KNL, "%H is on interface %s", ip, *name);
1087 }
1088 this->lock->unlock(this->lock);
1089 return TRUE;
1090 }
1091 /* check if it is a virtual IP */
1092 entry = this->addrs->get_match(this->addrs, &lookup,
1093 (void*)addr_map_entry_match_virtual);
1094 if (entry)
1095 {
1096 if (name)
1097 {
1098 *name = strdup(entry->iface->ifname);
1099 DBG2(DBG_KNL, "virtual IP %H is on interface %s", ip, *name);
1100 }
1101 this->lock->unlock(this->lock);
1102 return TRUE;
1103 }
1104 /* maybe it is installed on an ignored interface */
1105 entry = this->addrs->get_match(this->addrs, &lookup,
1106 (void*)addr_map_entry_match_up);
1107 if (!entry)
1108 { /* the address does not exist, is on a down interface */
1109 DBG2(DBG_KNL, "%H is not a local address or the interface is down", ip);
1110 }
1111 this->lock->unlock(this->lock);
1112 return FALSE;
1113 }
1114
1115 METHOD(kernel_net_t, add_ip, status_t,
1116 private_kernel_pfroute_net_t *this, host_t *vip, int prefix,
1117 char *ifname)
1118 {
1119 enumerator_t *ifaces, *addrs;
1120 iface_entry_t *iface;
1121 addr_entry_t *addr;
1122 tun_device_t *tun;
1123 bool timeout = FALSE;
1124
1125 tun = tun_device_create(NULL);
1126 if (!tun)
1127 {
1128 return FAILED;
1129 }
1130 if (prefix == -1)
1131 {
1132 prefix = vip->get_address(vip).len * 8;
1133 }
1134 if (!tun->up(tun) || !tun->set_address(tun, vip, prefix))
1135 {
1136 tun->destroy(tun);
1137 return FAILED;
1138 }
1139
1140 /* wait until address appears */
1141 this->mutex->lock(this->mutex);
1142 while (!timeout && !get_interface_name(this, vip, NULL))
1143 {
1144 timeout = this->condvar->timed_wait(this->condvar, this->mutex,
1145 this->vip_wait);
1146 }
1147 this->mutex->unlock(this->mutex);
1148 if (timeout)
1149 {
1150 DBG1(DBG_KNL, "virtual IP %H did not appear on %s",
1151 vip, tun->get_name(tun));
1152 tun->destroy(tun);
1153 return FAILED;
1154 }
1155
1156 this->lock->write_lock(this->lock);
1157 this->tuns->insert_last(this->tuns, tun);
1158
1159 ifaces = this->ifaces->create_enumerator(this->ifaces);
1160 while (ifaces->enumerate(ifaces, &iface))
1161 {
1162 if (streq(iface->ifname, tun->get_name(tun)))
1163 {
1164 addrs = iface->addrs->create_enumerator(iface->addrs);
1165 while (addrs->enumerate(addrs, &addr))
1166 {
1167 if (addr->ip->ip_equals(addr->ip, vip))
1168 {
1169 addr->virtual = TRUE;
1170 }
1171 }
1172 addrs->destroy(addrs);
1173 /* during IKEv1 reauthentication, children get moved from
1174 * old the new SA before the virtual IP is available. This
1175 * kills the route for our virtual IP, reinstall. */
1176 queue_route_reinstall(this, strdup(iface->ifname));
1177 break;
1178 }
1179 }
1180 ifaces->destroy(ifaces);
1181 /* lets do this while holding the lock, thus preventing another thread
1182 * from deleting the TUN device concurrently, hopefully listeners are quick
1183 * and cause no deadlocks */
1184 hydra->kernel_interface->tun(hydra->kernel_interface, tun, TRUE);
1185 this->lock->unlock(this->lock);
1186
1187 return SUCCESS;
1188 }
1189
1190 METHOD(kernel_net_t, del_ip, status_t,
1191 private_kernel_pfroute_net_t *this, host_t *vip, int prefix,
1192 bool wait)
1193 {
1194 enumerator_t *enumerator;
1195 tun_device_t *tun;
1196 host_t *addr;
1197 bool timeout = FALSE, found = FALSE;
1198
1199 this->lock->write_lock(this->lock);
1200 enumerator = this->tuns->create_enumerator(this->tuns);
1201 while (enumerator->enumerate(enumerator, &tun))
1202 {
1203 addr = tun->get_address(tun, NULL);
1204 if (addr && addr->ip_equals(addr, vip))
1205 {
1206 this->tuns->remove_at(this->tuns, enumerator);
1207 hydra->kernel_interface->tun(hydra->kernel_interface, tun,
1208 FALSE);
1209 tun->destroy(tun);
1210 found = TRUE;
1211 break;
1212 }
1213 }
1214 enumerator->destroy(enumerator);
1215 this->lock->unlock(this->lock);
1216
1217 if (!found)
1218 {
1219 return NOT_FOUND;
1220 }
1221 /* wait until address disappears */
1222 if (wait)
1223 {
1224 this->mutex->lock(this->mutex);
1225 while (!timeout && get_interface_name(this, vip, NULL))
1226 {
1227 timeout = this->condvar->timed_wait(this->condvar, this->mutex,
1228 this->vip_wait);
1229 }
1230 this->mutex->unlock(this->mutex);
1231 if (timeout)
1232 {
1233 DBG1(DBG_KNL, "virtual IP %H did not disappear from tun", vip);
1234 return FAILED;
1235 }
1236 }
1237 return SUCCESS;
1238 }
1239
1240 /**
1241 * Append a sockaddr_in/in6 of given type to routing message
1242 */
1243 static void add_rt_addr(struct rt_msghdr *hdr, int type, host_t *addr)
1244 {
1245 if (addr)
1246 {
1247 int len;
1248
1249 len = *addr->get_sockaddr_len(addr);
1250 memcpy((char*)hdr + hdr->rtm_msglen, addr->get_sockaddr(addr), len);
1251 hdr->rtm_msglen += SA_LEN(len);
1252 hdr->rtm_addrs |= type;
1253 }
1254 }
1255
1256 /**
1257 * Append a subnet mask sockaddr using the given prefix to routing message
1258 */
1259 static void add_rt_mask(struct rt_msghdr *hdr, int type, int family, int prefix)
1260 {
1261 host_t *mask;
1262
1263 mask = host_create_netmask(family, prefix);
1264 if (mask)
1265 {
1266 add_rt_addr(hdr, type, mask);
1267 mask->destroy(mask);
1268 }
1269 }
1270
1271 /**
1272 * Append an interface name sockaddr_dl to routing message
1273 */
1274 static void add_rt_ifname(struct rt_msghdr *hdr, int type, char *name)
1275 {
1276 struct sockaddr_dl sdl = {
1277 .sdl_len = sizeof(struct sockaddr_dl),
1278 .sdl_family = AF_LINK,
1279 .sdl_nlen = strlen(name),
1280 };
1281
1282 if (strlen(name) <= sizeof(sdl.sdl_data))
1283 {
1284 memcpy(sdl.sdl_data, name, sdl.sdl_nlen);
1285 memcpy((char*)hdr + hdr->rtm_msglen, &sdl, sdl.sdl_len);
1286 hdr->rtm_msglen += SA_LEN(sdl.sdl_len);
1287 hdr->rtm_addrs |= type;
1288 }
1289 }
1290
1291 /**
1292 * Add or remove a route
1293 */
1294 static status_t manage_route(private_kernel_pfroute_net_t *this, int op,
1295 chunk_t dst_net, u_int8_t prefixlen,
1296 host_t *gateway, char *if_name)
1297 {
1298 struct {
1299 struct rt_msghdr hdr;
1300 char buf[sizeof(struct sockaddr_storage) * RTAX_MAX];
1301 } msg = {
1302 .hdr = {
1303 .rtm_version = RTM_VERSION,
1304 .rtm_type = op,
1305 .rtm_flags = RTF_UP | RTF_STATIC,
1306 .rtm_pid = this->pid,
1307 .rtm_seq = ref_get(&this->seq),
1308 },
1309 };
1310 host_t *dst;
1311 int type;
1312
1313 if (prefixlen == 0 && dst_net.len)
1314 {
1315 status_t status;
1316 chunk_t half;
1317
1318 half = chunk_clonea(dst_net);
1319 half.ptr[0] |= 0x80;
1320 prefixlen = 1;
1321 status = manage_route(this, op, half, prefixlen, gateway, if_name);
1322 if (status != SUCCESS)
1323 {
1324 return status;
1325 }
1326 }
1327
1328 dst = host_create_from_chunk(AF_UNSPEC, dst_net, 0);
1329 if (!dst)
1330 {
1331 return FAILED;
1332 }
1333
1334 if ((dst->get_family(dst) == AF_INET && prefixlen == 32) ||
1335 (dst->get_family(dst) == AF_INET6 && prefixlen == 128))
1336 {
1337 msg.hdr.rtm_flags |= RTF_HOST | RTF_GATEWAY;
1338 }
1339
1340 msg.hdr.rtm_msglen = sizeof(struct rt_msghdr);
1341 for (type = 0; type < RTAX_MAX; type++)
1342 {
1343 switch (type)
1344 {
1345 case RTAX_DST:
1346 add_rt_addr(&msg.hdr, RTA_DST, dst);
1347 break;
1348 case RTAX_NETMASK:
1349 if (!(msg.hdr.rtm_flags & RTF_HOST))
1350 {
1351 add_rt_mask(&msg.hdr, RTA_NETMASK,
1352 dst->get_family(dst), prefixlen);
1353 }
1354 break;
1355 case RTAX_IFP:
1356 if (if_name)
1357 {
1358 add_rt_ifname(&msg.hdr, RTA_IFP, if_name);
1359 }
1360 break;
1361 case RTAX_GATEWAY:
1362 if (gateway)
1363 {
1364 add_rt_addr(&msg.hdr, RTA_GATEWAY, gateway);
1365 }
1366 break;
1367 default:
1368 break;
1369 }
1370 }
1371 dst->destroy(dst);
1372
1373 if (send(this->socket, &msg, msg.hdr.rtm_msglen, 0) != msg.hdr.rtm_msglen)
1374 {
1375 if (errno == EEXIST)
1376 {
1377 return ALREADY_DONE;
1378 }
1379 DBG1(DBG_KNL, "%s PF_ROUTE route failed: %s",
1380 op == RTM_ADD ? "adding" : "deleting", strerror(errno));
1381 return FAILED;
1382 }
1383 return SUCCESS;
1384 }
1385
1386 METHOD(kernel_net_t, add_route, status_t,
1387 private_kernel_pfroute_net_t *this, chunk_t dst_net, u_int8_t prefixlen,
1388 host_t *gateway, host_t *src_ip, char *if_name)
1389 {
1390 status_t status;
1391 route_entry_t *found, route = {
1392 .dst_net = dst_net,
1393 .prefixlen = prefixlen,
1394 .gateway = gateway,
1395 .if_name = if_name,
1396 };
1397
1398 this->routes_lock->lock(this->routes_lock);
1399 found = this->routes->get(this->routes, &route);
1400 if (found)
1401 {
1402 this->routes_lock->unlock(this->routes_lock);
1403 return ALREADY_DONE;
1404 }
1405 found = route_entry_clone(&route);
1406 this->routes->put(this->routes, found, found);
1407 status = manage_route(this, RTM_ADD, dst_net, prefixlen, gateway, if_name);
1408 this->routes_lock->unlock(this->routes_lock);
1409 return status;
1410 }
1411
1412 METHOD(kernel_net_t, del_route, status_t,
1413 private_kernel_pfroute_net_t *this, chunk_t dst_net, u_int8_t prefixlen,
1414 host_t *gateway, host_t *src_ip, char *if_name)
1415 {
1416 status_t status;
1417 route_entry_t *found, route = {
1418 .dst_net = dst_net,
1419 .prefixlen = prefixlen,
1420 .gateway = gateway,
1421 .if_name = if_name,
1422 };
1423
1424 this->routes_lock->lock(this->routes_lock);
1425 found = this->routes->get(this->routes, &route);
1426 if (!found)
1427 {
1428 this->routes_lock->unlock(this->routes_lock);
1429 return NOT_FOUND;
1430 }
1431 this->routes->remove(this->routes, found);
1432 route_entry_destroy(found);
1433 status = manage_route(this, RTM_DELETE, dst_net, prefixlen, gateway,
1434 if_name);
1435 this->routes_lock->unlock(this->routes_lock);
1436 return status;
1437 }
1438
1439 /**
1440 * Do a route lookup for dest and return either the nexthop or the source
1441 * address.
1442 */
1443 static host_t *get_route(private_kernel_pfroute_net_t *this, bool nexthop,
1444 host_t *dest, host_t *src)
1445 {
1446 struct {
1447 struct rt_msghdr hdr;
1448 char buf[sizeof(struct sockaddr_storage) * RTAX_MAX];
1449 } msg = {
1450 .hdr = {
1451 .rtm_version = RTM_VERSION,
1452 .rtm_type = RTM_GET,
1453 .rtm_pid = this->pid,
1454 .rtm_seq = ref_get(&this->seq),
1455 },
1456 };
1457 host_t *host = NULL;
1458 enumerator_t *enumerator;
1459 struct sockaddr *addr;
1460 bool failed = FALSE;
1461 int type;
1462
1463 retry:
1464 msg.hdr.rtm_msglen = sizeof(struct rt_msghdr);
1465 for (type = 0; type < RTAX_MAX; type++)
1466 {
1467 switch (type)
1468 {
1469 case RTAX_DST:
1470 add_rt_addr(&msg.hdr, RTA_DST, dest);
1471 break;
1472 case RTAX_IFA:
1473 add_rt_addr(&msg.hdr, RTA_IFA, src);
1474 break;
1475 case RTAX_IFP:
1476 if (!nexthop)
1477 { /* add an empty IFP to ensure we get a source address */
1478 add_rt_ifname(&msg.hdr, RTA_IFP, "");
1479 }
1480 break;
1481 default:
1482 break;
1483 }
1484 }
1485 this->mutex->lock(this->mutex);
1486
1487 while (this->waiting_seq)
1488 {
1489 this->condvar->wait(this->condvar, this->mutex);
1490 }
1491 this->waiting_seq = msg.hdr.rtm_seq;
1492 if (send(this->socket, &msg, msg.hdr.rtm_msglen, 0) == msg.hdr.rtm_msglen)
1493 {
1494 while (TRUE)
1495 {
1496 if (this->condvar->timed_wait(this->condvar, this->mutex, 1000))
1497 { /* timed out? */
1498 break;
1499 }
1500 if (this->reply->rtm_msglen < sizeof(*this->reply) ||
1501 msg.hdr.rtm_seq != this->reply->rtm_seq)
1502 {
1503 continue;
1504 }
1505 enumerator = create_rtmsg_enumerator(this->reply);
1506 while (enumerator->enumerate(enumerator, &type, &addr))
1507 {
1508 if (nexthop)
1509 {
1510 if (type == RTAX_DST && this->reply->rtm_flags & RTF_HOST)
1511 { /* probably a cloned/cached direct route, only use that
1512 * as fallback if no gateway is found */
1513 host = host ?: host_create_from_sockaddr(addr);
1514 }
1515 if (type == RTAX_GATEWAY)
1516 { /* could actually be a MAC address */
1517 host_t *gtw = host_create_from_sockaddr(addr);
1518 if (gtw)
1519 {
1520 DESTROY_IF(host);
1521 host = gtw;
1522 }
1523 }
1524 }
1525 else
1526 {
1527 if (type == RTAX_IFA)
1528 {
1529 host = host_create_from_sockaddr(addr);
1530 }
1531 }
1532 }
1533 enumerator->destroy(enumerator);
1534 break;
1535 }
1536 }
1537 else
1538 {
1539 failed = TRUE;
1540 }
1541 /* signal completion of query to a waiting thread */
1542 this->waiting_seq = 0;
1543 this->condvar->signal(this->condvar);
1544 this->mutex->unlock(this->mutex);
1545
1546 if (failed)
1547 {
1548 if (src)
1549 { /* the given source address might be gone, try again without */
1550 src = NULL;
1551 msg.hdr.rtm_seq = ref_get(&this->seq);
1552 msg.hdr.rtm_addrs = 0;
1553 memset(msg.buf, sizeof(msg.buf), 0);
1554 goto retry;
1555 }
1556 DBG1(DBG_KNL, "PF_ROUTE lookup failed: %s", strerror(errno));
1557 }
1558 if (!host)
1559 {
1560 return NULL;
1561 }
1562 if (!nexthop)
1563 { /* make sure the source address is not virtual and usable */
1564 addr_entry_t *entry, lookup = {
1565 .ip = host,
1566 };
1567
1568 this->lock->read_lock(this->lock);
1569 entry = this->addrs->get_match(this->addrs, &lookup,
1570 (void*)addr_map_entry_match_up_and_usable);
1571 this->lock->unlock(this->lock);
1572 if (!entry)
1573 {
1574 host->destroy(host);
1575 return NULL;
1576 }
1577 }
1578 DBG2(DBG_KNL, "using %H as %s to reach %H", host,
1579 nexthop ? "nexthop" : "address", dest);
1580 return host;
1581 }
1582
1583 METHOD(kernel_net_t, get_source_addr, host_t*,
1584 private_kernel_pfroute_net_t *this, host_t *dest, host_t *src)
1585 {
1586 return get_route(this, FALSE, dest, src);
1587 }
1588
1589 METHOD(kernel_net_t, get_nexthop, host_t*,
1590 private_kernel_pfroute_net_t *this, host_t *dest, host_t *src)
1591 {
1592 return get_route(this, TRUE, dest, src);
1593 }
1594
1595 /**
1596 * Initialize a list of local addresses.
1597 */
1598 static status_t init_address_list(private_kernel_pfroute_net_t *this)
1599 {
1600 struct ifaddrs *ifap, *ifa;
1601 iface_entry_t *iface, *current;
1602 addr_entry_t *addr;
1603 enumerator_t *ifaces, *addrs;
1604
1605 DBG2(DBG_KNL, "known interfaces and IP addresses:");
1606
1607 if (getifaddrs(&ifap) < 0)
1608 {
1609 DBG1(DBG_KNL, " failed to get interfaces!");
1610 return FAILED;
1611 }
1612
1613 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
1614 {
1615 if (ifa->ifa_addr == NULL)
1616 {
1617 continue;
1618 }
1619 switch(ifa->ifa_addr->sa_family)
1620 {
1621 case AF_LINK:
1622 case AF_INET:
1623 case AF_INET6:
1624 {
1625 iface = NULL;
1626 ifaces = this->ifaces->create_enumerator(this->ifaces);
1627 while (ifaces->enumerate(ifaces, &current))
1628 {
1629 if (streq(current->ifname, ifa->ifa_name))
1630 {
1631 iface = current;
1632 break;
1633 }
1634 }
1635 ifaces->destroy(ifaces);
1636
1637 if (!iface)
1638 {
1639 INIT(iface,
1640 .ifindex = if_nametoindex(ifa->ifa_name),
1641 .flags = ifa->ifa_flags,
1642 .addrs = linked_list_create(),
1643 .usable = hydra->kernel_interface->is_interface_usable(
1644 hydra->kernel_interface, ifa->ifa_name),
1645 );
1646 memcpy(iface->ifname, ifa->ifa_name, IFNAMSIZ);
1647 this->ifaces->insert_last(this->ifaces, iface);
1648 }
1649
1650 if (ifa->ifa_addr->sa_family != AF_LINK)
1651 {
1652 INIT(addr,
1653 .ip = host_create_from_sockaddr(ifa->ifa_addr),
1654 );
1655 iface->addrs->insert_last(iface->addrs, addr);
1656 addr_map_entry_add(this, addr, iface);
1657 }
1658 }
1659 }
1660 }
1661 freeifaddrs(ifap);
1662
1663 ifaces = this->ifaces->create_enumerator(this->ifaces);
1664 while (ifaces->enumerate(ifaces, &iface))
1665 {
1666 if (iface->usable && iface->flags & IFF_UP)
1667 {
1668 DBG2(DBG_KNL, " %s", iface->ifname);
1669 addrs = iface->addrs->create_enumerator(iface->addrs);
1670 while (addrs->enumerate(addrs, (void**)&addr))
1671 {
1672 DBG2(DBG_KNL, " %H", addr->ip);
1673 }
1674 addrs->destroy(addrs);
1675 }
1676 }
1677 ifaces->destroy(ifaces);
1678
1679 return SUCCESS;
1680 }
1681
1682 METHOD(kernel_net_t, destroy, void,
1683 private_kernel_pfroute_net_t *this)
1684 {
1685 enumerator_t *enumerator;
1686 route_entry_t *route;
1687 addr_entry_t *addr;
1688
1689 enumerator = this->routes->create_enumerator(this->routes);
1690 while (enumerator->enumerate(enumerator, NULL, (void**)&route))
1691 {
1692 manage_route(this, RTM_DELETE, route->dst_net, route->prefixlen,
1693 route->gateway, route->if_name);
1694 route_entry_destroy(route);
1695 }
1696 enumerator->destroy(enumerator);
1697 this->routes->destroy(this->routes);
1698 this->routes_lock->destroy(this->routes_lock);
1699
1700 if (this->socket != -1)
1701 {
1702 close(this->socket);
1703 }
1704
1705 net_changes_clear(this);
1706 this->net_changes->destroy(this->net_changes);
1707 this->net_changes_lock->destroy(this->net_changes_lock);
1708
1709 enumerator = this->addrs->create_enumerator(this->addrs);
1710 while (enumerator->enumerate(enumerator, NULL, (void**)&addr))
1711 {
1712 free(addr);
1713 }
1714 enumerator->destroy(enumerator);
1715 this->addrs->destroy(this->addrs);
1716 this->ifaces->destroy_function(this->ifaces, (void*)iface_entry_destroy);
1717 this->tuns->destroy(this->tuns);
1718 this->lock->destroy(this->lock);
1719 this->mutex->destroy(this->mutex);
1720 this->condvar->destroy(this->condvar);
1721 free(this->reply);
1722 free(this);
1723 }
1724
1725 /*
1726 * Described in header.
1727 */
1728 kernel_pfroute_net_t *kernel_pfroute_net_create()
1729 {
1730 private_kernel_pfroute_net_t *this;
1731
1732 INIT(this,
1733 .public = {
1734 .interface = {
1735 .get_features = _get_features,
1736 .get_interface = _get_interface_name,
1737 .create_address_enumerator = _create_address_enumerator,
1738 .get_source_addr = _get_source_addr,
1739 .get_nexthop = _get_nexthop,
1740 .add_ip = _add_ip,
1741 .del_ip = _del_ip,
1742 .add_route = _add_route,
1743 .del_route = _del_route,
1744 .destroy = _destroy,
1745 },
1746 },
1747 .pid = getpid(),
1748 .ifaces = linked_list_create(),
1749 .addrs = hashtable_create(
1750 (hashtable_hash_t)addr_map_entry_hash,
1751 (hashtable_equals_t)addr_map_entry_equals, 16),
1752 .routes = hashtable_create((hashtable_hash_t)route_entry_hash,
1753 (hashtable_equals_t)route_entry_equals, 16),
1754 .net_changes = hashtable_create(
1755 (hashtable_hash_t)net_change_hash,
1756 (hashtable_equals_t)net_change_equals, 16),
1757 .tuns = linked_list_create(),
1758 .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
1759 .mutex = mutex_create(MUTEX_TYPE_DEFAULT),
1760 .condvar = condvar_create(CONDVAR_TYPE_DEFAULT),
1761 .routes_lock = mutex_create(MUTEX_TYPE_DEFAULT),
1762 .net_changes_lock = mutex_create(MUTEX_TYPE_DEFAULT),
1763 .vip_wait = lib->settings->get_int(lib->settings,
1764 "%s.plugins.kernel-pfroute.vip_wait", 1000, hydra->daemon),
1765 );
1766 timerclear(&this->last_route_reinstall);
1767 timerclear(&this->last_roam);
1768
1769 /* create a PF_ROUTE socket to communicate with the kernel */
1770 this->socket = socket(PF_ROUTE, SOCK_RAW, AF_UNSPEC);
1771 if (this->socket == -1)
1772 {
1773 DBG1(DBG_KNL, "unable to create PF_ROUTE socket");
1774 destroy(this);
1775 return NULL;
1776 }
1777
1778 if (streq(hydra->daemon, "starter"))
1779 {
1780 /* starter has no threads, so we do not register for kernel events */
1781 if (shutdown(this->socket, SHUT_RD) != 0)
1782 {
1783 DBG1(DBG_KNL, "closing read end of PF_ROUTE socket failed: %s",
1784 strerror(errno));
1785 }
1786 }
1787 else
1788 {
1789 lib->processor->queue_job(lib->processor,
1790 (job_t*)callback_job_create_with_prio(
1791 (callback_job_cb_t)receive_events, this, NULL,
1792 (callback_job_cancel_t)return_false, JOB_PRIO_CRITICAL));
1793 }
1794 if (init_address_list(this) != SUCCESS)
1795 {
1796 DBG1(DBG_KNL, "unable to get interface list");
1797 destroy(this);
1798 return NULL;
1799 }
1800
1801 return &this->public;
1802 }