2 * Copyright (C) 2006-2012 Tobias Brunner
3 * Copyright (C) 2005-2009 Martin Willi
4 * Copyright (C) 2008 Andreas Steffen
5 * Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
6 * Copyright (C) 2006 Daniel Roethlisberger
7 * Copyright (C) 2005 Jan Hutter
8 * Hochschule fuer Technik Rapperswil
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms of the GNU General Public License as published by the
12 * Free Software Foundation; either version 2 of the License, or (at your
13 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
17 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 #include <sys/types.h>
22 #include <sys/socket.h>
24 #include <linux/ipsec.h>
25 #include <linux/netlink.h>
26 #include <linux/rtnetlink.h>
27 #include <linux/xfrm.h>
28 #include <linux/udp.h>
35 #include "kernel_netlink_ipsec.h"
36 #include "kernel_netlink_shared.h"
39 #include <utils/debug.h>
40 #include <threading/thread.h>
41 #include <threading/mutex.h>
42 #include <collections/hashtable.h>
43 #include <collections/linked_list.h>
44 #include <processing/jobs/callback_job.h>
46 /** Required for Linux 2.6.26 kernel and later */
47 #ifndef XFRM_STATE_AF_UNSPEC
48 #define XFRM_STATE_AF_UNSPEC 32
51 /** From linux/in.h */
52 #ifndef IP_XFRM_POLICY
53 #define IP_XFRM_POLICY 17
56 /** Missing on uclibc */
57 #ifndef IPV6_XFRM_POLICY
58 #define IPV6_XFRM_POLICY 34
59 #endif /*IPV6_XFRM_POLICY*/
61 /* from linux/udp.h */
66 #ifndef UDP_ENCAP_ESPINUDP
67 #define UDP_ENCAP_ESPINUDP 2
70 /* this is not defined on some platforms */
72 #define SOL_UDP IPPROTO_UDP
75 /** Default priority of installed policies */
78 /** Default replay window size, if not set using charon.replay_window */
79 #define DEFAULT_REPLAY_WINDOW 32
82 * Map the limit for bytes and packets to XFRM_INF by default
84 #define XFRM_LIMIT(x) ((x) == 0 ? XFRM_INF : (x))
87 * Create ORable bitfield of XFRM NL groups
89 #define XFRMNLGRP(x) (1<<(XFRMNLGRP_##x-1))
92 * Returns a pointer to the first rtattr following the nlmsghdr *nlh and the
93 * 'usual' netlink data x like 'struct xfrm_usersa_info'
95 #define XFRM_RTA(nlh, x) ((struct rtattr*)(NLMSG_DATA(nlh) + \
96 NLMSG_ALIGN(sizeof(x))))
98 * Returns a pointer to the next rtattr following rta.
99 * !!! Do not use this to parse messages. Use RTA_NEXT and RTA_OK instead !!!
101 #define XFRM_RTA_NEXT(rta) ((struct rtattr*)(((char*)(rta)) + \
102 RTA_ALIGN((rta)->rta_len)))
104 * Returns the total size of attached rta data
105 * (after 'usual' netlink data x like 'struct xfrm_usersa_info')
107 #define XFRM_PAYLOAD(nlh, x) NLMSG_PAYLOAD(nlh, sizeof(x))
109 typedef struct kernel_algorithm_t kernel_algorithm_t
;
112 * Mapping of IKEv2 kernel identifier to linux crypto API names
114 struct kernel_algorithm_t
{
116 * Identifier specified in IKEv2
121 * Name of the algorithm in linux crypto API
126 ENUM(xfrm_msg_names
, XFRM_MSG_NEWSA
, XFRM_MSG_MAPPING
,
130 "XFRM_MSG_NEWPOLICY",
131 "XFRM_MSG_DELPOLICY",
132 "XFRM_MSG_GETPOLICY",
136 "XFRM_MSG_UPDPOLICY",
138 "XFRM_MSG_POLEXPIRE",
140 "XFRM_MSG_FLUSHPOLICY",
145 "XFRM_MSG_NEWSADINFO",
146 "XFRM_MSG_GETSADINFO",
147 "XFRM_MSG_NEWSPDINFO",
148 "XFRM_MSG_GETSPDINFO",
152 ENUM(xfrm_attr_type_names
, XFRMA_UNSPEC
, XFRMA_REPLAY_ESN_VAL
,
164 "XFRMA_REPLAY_THRESH",
165 "XFRMA_ETIMER_THRESH",
173 "XFRMA_ALG_AUTH_TRUNC",
176 "XFRMA_REPLAY_ESN_VAL",
179 #define END_OF_LIST -1
182 * Algorithms for encryption
184 static kernel_algorithm_t encryption_algs
[] = {
185 /* {ENCR_DES_IV64, "***" }, */
187 {ENCR_3DES
, "des3_ede" },
188 /* {ENCR_RC5, "***" }, */
189 /* {ENCR_IDEA, "***" }, */
190 {ENCR_CAST
, "cast128" },
191 {ENCR_BLOWFISH
, "blowfish" },
192 /* {ENCR_3IDEA, "***" }, */
193 /* {ENCR_DES_IV32, "***" }, */
194 {ENCR_NULL
, "cipher_null" },
195 {ENCR_AES_CBC
, "aes" },
196 {ENCR_AES_CTR
, "rfc3686(ctr(aes))" },
197 {ENCR_AES_CCM_ICV8
, "rfc4309(ccm(aes))" },
198 {ENCR_AES_CCM_ICV12
, "rfc4309(ccm(aes))" },
199 {ENCR_AES_CCM_ICV16
, "rfc4309(ccm(aes))" },
200 {ENCR_AES_GCM_ICV8
, "rfc4106(gcm(aes))" },
201 {ENCR_AES_GCM_ICV12
, "rfc4106(gcm(aes))" },
202 {ENCR_AES_GCM_ICV16
, "rfc4106(gcm(aes))" },
203 {ENCR_NULL_AUTH_AES_GMAC
, "rfc4543(gcm(aes))" },
204 {ENCR_CAMELLIA_CBC
, "cbc(camellia)" },
205 /* {ENCR_CAMELLIA_CTR, "***" }, */
206 /* {ENCR_CAMELLIA_CCM_ICV8, "***" }, */
207 /* {ENCR_CAMELLIA_CCM_ICV12, "***" }, */
208 /* {ENCR_CAMELLIA_CCM_ICV16, "***" }, */
209 {ENCR_SERPENT_CBC
, "serpent" },
210 {ENCR_TWOFISH_CBC
, "twofish" },
215 * Algorithms for integrity protection
217 static kernel_algorithm_t integrity_algs
[] = {
218 {AUTH_HMAC_MD5_96
, "md5" },
219 {AUTH_HMAC_MD5_128
, "hmac(md5)" },
220 {AUTH_HMAC_SHA1_96
, "sha1" },
221 {AUTH_HMAC_SHA1_160
, "hmac(sha1)" },
222 {AUTH_HMAC_SHA2_256_96
, "sha256" },
223 {AUTH_HMAC_SHA2_256_128
, "hmac(sha256)" },
224 {AUTH_HMAC_SHA2_384_192
, "hmac(sha384)" },
225 {AUTH_HMAC_SHA2_512_256
, "hmac(sha512)" },
226 /* {AUTH_DES_MAC, "***" }, */
227 /* {AUTH_KPDK_MD5, "***" }, */
228 {AUTH_AES_XCBC_96
, "xcbc(aes)" },
233 * Algorithms for IPComp
235 static kernel_algorithm_t compression_algs
[] = {
236 /* {IPCOMP_OUI, "***" }, */
237 {IPCOMP_DEFLATE
, "deflate" },
238 {IPCOMP_LZS
, "lzs" },
239 {IPCOMP_LZJH
, "lzjh" },
244 * Look up a kernel algorithm name and its key size
246 static char* lookup_algorithm(transform_type_t type
, int ikev2
)
248 kernel_algorithm_t
*list
;
253 case ENCRYPTION_ALGORITHM
:
254 list
= encryption_algs
;
256 case INTEGRITY_ALGORITHM
:
257 list
= integrity_algs
;
259 case COMPRESSION_ALGORITHM
:
260 list
= compression_algs
;
265 while (list
->ikev2
!= END_OF_LIST
)
267 if (list
->ikev2
== ikev2
)
273 hydra
->kernel_interface
->lookup_algorithm(hydra
->kernel_interface
, ikev2
,
278 typedef struct private_kernel_netlink_ipsec_t private_kernel_netlink_ipsec_t
;
281 * Private variables and functions of kernel_netlink class.
283 struct private_kernel_netlink_ipsec_t
{
285 * Public part of the kernel_netlink_t object
287 kernel_netlink_ipsec_t
public;
290 * Mutex to lock access to installed policies
295 * Hash table of installed policies (policy_entry_t)
297 hashtable_t
*policies
;
300 * Hash table of IPsec SAs using policies (ipsec_sa_t)
305 * Netlink xfrm socket (IPsec)
307 netlink_socket_t
*socket_xfrm
;
310 * Netlink xfrm socket to receive acquire and expire events
312 int socket_xfrm_events
;
315 * Whether to install routes along policies
320 * Whether to track the history of a policy
325 * Size of the replay window, in packets (= bits)
327 u_int32_t replay_window
;
330 * Size of the replay window bitmap, in number of __u32 blocks
332 u_int32_t replay_bmp
;
335 typedef struct route_entry_t route_entry_t
;
338 * Installed routing entry
340 struct route_entry_t
{
341 /** Name of the interface the route is bound to */
344 /** Source ip of the route */
347 /** Gateway for this route */
350 /** Destination net */
353 /** Destination net prefixlen */
358 * Destroy a route_entry_t object
360 static void route_entry_destroy(route_entry_t
*this)
363 this->src_ip
->destroy(this->src_ip
);
364 DESTROY_IF(this->gateway
);
365 chunk_free(&this->dst_net
);
370 * Compare two route_entry_t objects
372 static bool route_entry_equals(route_entry_t
*a
, route_entry_t
*b
)
374 return a
->if_name
&& b
->if_name
&& streq(a
->if_name
, b
->if_name
) &&
375 a
->src_ip
->ip_equals(a
->src_ip
, b
->src_ip
) &&
376 a
->gateway
->ip_equals(a
->gateway
, b
->gateway
) &&
377 chunk_equals(a
->dst_net
, b
->dst_net
) && a
->prefixlen
== b
->prefixlen
;
380 typedef struct ipsec_sa_t ipsec_sa_t
;
383 * IPsec SA assigned to a policy.
386 /** Source address of this SA */
389 /** Destination address of this SA */
395 /** Description of this SA */
398 /** Reference count for this SA */
403 * Hash function for ipsec_sa_t objects
405 static u_int
ipsec_sa_hash(ipsec_sa_t
*sa
)
407 return chunk_hash_inc(sa
->src
->get_address(sa
->src
),
408 chunk_hash_inc(sa
->dst
->get_address(sa
->dst
),
409 chunk_hash_inc(chunk_from_thing(sa
->mark
),
410 chunk_hash(chunk_from_thing(sa
->cfg
)))));
414 * Equality function for ipsec_sa_t objects
416 static bool ipsec_sa_equals(ipsec_sa_t
*sa
, ipsec_sa_t
*other_sa
)
418 return sa
->src
->ip_equals(sa
->src
, other_sa
->src
) &&
419 sa
->dst
->ip_equals(sa
->dst
, other_sa
->dst
) &&
420 memeq(&sa
->mark
, &other_sa
->mark
, sizeof(mark_t
)) &&
421 memeq(&sa
->cfg
, &other_sa
->cfg
, sizeof(ipsec_sa_cfg_t
));
425 * Allocate or reference an IPsec SA object
427 static ipsec_sa_t
*ipsec_sa_create(private_kernel_netlink_ipsec_t
*this,
428 host_t
*src
, host_t
*dst
, mark_t mark
,
431 ipsec_sa_t
*sa
, *found
;
438 found
= this->sas
->get(this->sas
, sa
);
441 sa
->src
= src
->clone(src
);
442 sa
->dst
= dst
->clone(dst
);
443 this->sas
->put(this->sas
, sa
, sa
);
450 ref_get(&sa
->refcount
);
455 * Release and destroy an IPsec SA object
457 static void ipsec_sa_destroy(private_kernel_netlink_ipsec_t
*this,
460 if (ref_put(&sa
->refcount
))
462 this->sas
->remove(this->sas
, sa
);
469 typedef struct policy_sa_t policy_sa_t
;
470 typedef struct policy_sa_fwd_t policy_sa_fwd_t
;
473 * Mapping between a policy and an IPsec SA.
476 /** Priority assigned to the policy when installed with this SA */
479 /** Type of the policy */
487 * For forward policies we also cache the traffic selectors in order to install
490 struct policy_sa_fwd_t
{
491 /** Generic interface */
494 /** Source traffic selector of this policy */
495 traffic_selector_t
*src_ts
;
497 /** Destination traffic selector of this policy */
498 traffic_selector_t
*dst_ts
;
502 * Create a policy_sa(_fwd)_t object
504 static policy_sa_t
*policy_sa_create(private_kernel_netlink_ipsec_t
*this,
505 policy_dir_t dir
, policy_type_t type
, host_t
*src
, host_t
*dst
,
506 traffic_selector_t
*src_ts
, traffic_selector_t
*dst_ts
, mark_t mark
,
511 if (dir
== POLICY_FWD
)
513 policy_sa_fwd_t
*fwd
;
515 .src_ts
= src_ts
->clone(src_ts
),
516 .dst_ts
= dst_ts
->clone(dst_ts
),
518 policy
= &fwd
->generic
;
522 INIT(policy
, .priority
= 0);
525 policy
->sa
= ipsec_sa_create(this, src
, dst
, mark
, cfg
);
530 * Destroy a policy_sa(_fwd)_t object
532 static void policy_sa_destroy(policy_sa_t
*policy
, policy_dir_t
*dir
,
533 private_kernel_netlink_ipsec_t
*this)
535 if (*dir
== POLICY_FWD
)
537 policy_sa_fwd_t
*fwd
= (policy_sa_fwd_t
*)policy
;
538 fwd
->src_ts
->destroy(fwd
->src_ts
);
539 fwd
->dst_ts
->destroy(fwd
->dst_ts
);
541 ipsec_sa_destroy(this, policy
->sa
);
545 typedef struct policy_entry_t policy_entry_t
;
548 * Installed kernel policy.
550 struct policy_entry_t
{
552 /** Direction of this policy: in, out, forward */
555 /** Parameters of installed policy */
556 struct xfrm_selector sel
;
561 /** Associated route installed for this policy */
562 route_entry_t
*route
;
564 /** List of SAs this policy is used by, ordered by priority */
565 linked_list_t
*used_by
;
569 * Destroy a policy_entry_t object
571 static void policy_entry_destroy(private_kernel_netlink_ipsec_t
*this,
572 policy_entry_t
*policy
)
576 route_entry_destroy(policy
->route
);
580 policy
->used_by
->invoke_function(policy
->used_by
,
581 (linked_list_invoke_t
)policy_sa_destroy
,
582 &policy
->direction
, this);
583 policy
->used_by
->destroy(policy
->used_by
);
589 * Hash function for policy_entry_t objects
591 static u_int
policy_hash(policy_entry_t
*key
)
593 chunk_t chunk
= chunk_from_thing(key
->sel
);
594 return chunk_hash_inc(chunk
, chunk_hash(chunk_from_thing(key
->mark
)));
598 * Equality function for policy_entry_t objects
600 static bool policy_equals(policy_entry_t
*key
, policy_entry_t
*other_key
)
602 return memeq(&key
->sel
, &other_key
->sel
, sizeof(struct xfrm_selector
)) &&
603 key
->mark
== other_key
->mark
&&
604 key
->direction
== other_key
->direction
;
608 * Calculate the priority of a policy
610 static inline u_int32_t
get_priority(policy_entry_t
*policy
,
611 policy_priority_t prio
)
613 u_int32_t priority
= PRIO_BASE
;
616 case POLICY_PRIORITY_FALLBACK
:
619 case POLICY_PRIORITY_ROUTED
:
622 case POLICY_PRIORITY_DEFAULT
:
625 /* calculate priority based on selector size, small size = high prio */
626 priority
-= policy
->sel
.prefixlen_s
;
627 priority
-= policy
->sel
.prefixlen_d
;
628 priority
<<= 2; /* make some room for the two flags */
629 priority
+= policy
->sel
.sport_mask
|| policy
->sel
.dport_mask
? 0 : 2;
630 priority
+= policy
->sel
.proto
? 0 : 1;
635 * Convert the general ipsec mode to the one defined in xfrm.h
637 static u_int8_t
mode2kernel(ipsec_mode_t mode
)
642 return XFRM_MODE_TRANSPORT
;
644 return XFRM_MODE_TUNNEL
;
646 return XFRM_MODE_BEET
;
653 * Convert a host_t to a struct xfrm_address
655 static void host2xfrm(host_t
*host
, xfrm_address_t
*xfrm
)
657 chunk_t chunk
= host
->get_address(host
);
658 memcpy(xfrm
, chunk
.ptr
, min(chunk
.len
, sizeof(xfrm_address_t
)));
662 * Convert a struct xfrm_address to a host_t
664 static host_t
* xfrm2host(int family
, xfrm_address_t
*xfrm
, u_int16_t port
)
671 chunk
= chunk_create((u_char
*)&xfrm
->a4
, sizeof(xfrm
->a4
));
674 chunk
= chunk_create((u_char
*)&xfrm
->a6
, sizeof(xfrm
->a6
));
679 return host_create_from_chunk(family
, chunk
, ntohs(port
));
683 * Convert a traffic selector address range to subnet and its mask.
685 static void ts2subnet(traffic_selector_t
* ts
,
686 xfrm_address_t
*net
, u_int8_t
*mask
)
691 ts
->to_subnet(ts
, &net_host
, mask
);
692 net_chunk
= net_host
->get_address(net_host
);
693 memcpy(net
, net_chunk
.ptr
, net_chunk
.len
);
694 net_host
->destroy(net_host
);
698 * Convert a traffic selector port range to port/portmask
700 static void ts2ports(traffic_selector_t
* ts
,
701 u_int16_t
*port
, u_int16_t
*mask
)
703 /* Linux does not seem to accept complex portmasks. Only
704 * any or a specific port is allowed. We set to any, if we have
705 * a port range, or to a specific, if we have one port only.
709 from
= ts
->get_from_port(ts
);
710 to
= ts
->get_to_port(ts
);
725 * Convert a pair of traffic_selectors to an xfrm_selector
727 static struct xfrm_selector
ts2selector(traffic_selector_t
*src
,
728 traffic_selector_t
*dst
)
730 struct xfrm_selector sel
;
732 memset(&sel
, 0, sizeof(sel
));
733 sel
.family
= (src
->get_type(src
) == TS_IPV4_ADDR_RANGE
) ? AF_INET
: AF_INET6
;
734 /* src or dest proto may be "any" (0), use more restrictive one */
735 sel
.proto
= max(src
->get_protocol(src
), dst
->get_protocol(dst
));
736 ts2subnet(dst
, &sel
.daddr
, &sel
.prefixlen_d
);
737 ts2subnet(src
, &sel
.saddr
, &sel
.prefixlen_s
);
738 ts2ports(dst
, &sel
.dport
, &sel
.dport_mask
);
739 ts2ports(src
, &sel
.sport
, &sel
.sport_mask
);
747 * Convert an xfrm_selector to a src|dst traffic_selector
749 static traffic_selector_t
* selector2ts(struct xfrm_selector
*sel
, bool src
)
758 addr
= (u_char
*)&sel
->saddr
;
759 prefixlen
= sel
->prefixlen_s
;
762 port
= htons(sel
->sport
);
767 addr
= (u_char
*)&sel
->daddr
;
768 prefixlen
= sel
->prefixlen_d
;
771 port
= htons(sel
->dport
);
775 /* The Linux 2.6 kernel does not set the selector's family field,
776 * so as a kludge we additionally test the prefix length.
778 if (sel
->family
== AF_INET
|| sel
->prefixlen_s
== 32)
780 host
= host_create_from_chunk(AF_INET
, chunk_create(addr
, 4), 0);
782 else if (sel
->family
== AF_INET6
|| sel
->prefixlen_s
== 128)
784 host
= host_create_from_chunk(AF_INET6
, chunk_create(addr
, 16), 0);
789 return traffic_selector_create_from_subnet(host
, prefixlen
,
790 sel
->proto
, port
, port
?: 65535);
796 * Process a XFRM_MSG_ACQUIRE from kernel
798 static void process_acquire(private_kernel_netlink_ipsec_t
*this,
799 struct nlmsghdr
*hdr
)
801 struct xfrm_user_acquire
*acquire
;
804 traffic_selector_t
*src_ts
, *dst_ts
;
808 acquire
= (struct xfrm_user_acquire
*)NLMSG_DATA(hdr
);
809 rta
= XFRM_RTA(hdr
, struct xfrm_user_acquire
);
810 rtasize
= XFRM_PAYLOAD(hdr
, struct xfrm_user_acquire
);
812 DBG2(DBG_KNL
, "received a XFRM_MSG_ACQUIRE");
814 while (RTA_OK(rta
, rtasize
))
816 DBG2(DBG_KNL
, " %N", xfrm_attr_type_names
, rta
->rta_type
);
818 if (rta
->rta_type
== XFRMA_TMPL
)
820 struct xfrm_user_tmpl
* tmpl
;
821 tmpl
= (struct xfrm_user_tmpl
*)RTA_DATA(rta
);
823 proto
= tmpl
->id
.proto
;
825 rta
= RTA_NEXT(rta
, rtasize
);
834 /* acquire for AH/ESP only, not for IPCOMP */
837 src_ts
= selector2ts(&acquire
->sel
, TRUE
);
838 dst_ts
= selector2ts(&acquire
->sel
, FALSE
);
840 hydra
->kernel_interface
->acquire(hydra
->kernel_interface
, reqid
, src_ts
,
845 * Process a XFRM_MSG_EXPIRE from kernel
847 static void process_expire(private_kernel_netlink_ipsec_t
*this,
848 struct nlmsghdr
*hdr
)
850 struct xfrm_user_expire
*expire
;
851 u_int32_t spi
, reqid
;
854 expire
= (struct xfrm_user_expire
*)NLMSG_DATA(hdr
);
855 protocol
= expire
->state
.id
.proto
;
856 spi
= expire
->state
.id
.spi
;
857 reqid
= expire
->state
.reqid
;
859 DBG2(DBG_KNL
, "received a XFRM_MSG_EXPIRE");
861 if (protocol
!= IPPROTO_ESP
&& protocol
!= IPPROTO_AH
)
863 DBG2(DBG_KNL
, "ignoring XFRM_MSG_EXPIRE for SA with SPI %.8x and "
864 "reqid {%u} which is not a CHILD_SA", ntohl(spi
), reqid
);
868 hydra
->kernel_interface
->expire(hydra
->kernel_interface
, reqid
, protocol
,
869 spi
, expire
->hard
!= 0);
873 * Process a XFRM_MSG_MIGRATE from kernel
875 static void process_migrate(private_kernel_netlink_ipsec_t
*this,
876 struct nlmsghdr
*hdr
)
878 struct xfrm_userpolicy_id
*policy_id
;
881 traffic_selector_t
*src_ts
, *dst_ts
;
882 host_t
*local
= NULL
, *remote
= NULL
;
883 host_t
*old_src
= NULL
, *old_dst
= NULL
;
884 host_t
*new_src
= NULL
, *new_dst
= NULL
;
888 policy_id
= (struct xfrm_userpolicy_id
*)NLMSG_DATA(hdr
);
889 rta
= XFRM_RTA(hdr
, struct xfrm_userpolicy_id
);
890 rtasize
= XFRM_PAYLOAD(hdr
, struct xfrm_userpolicy_id
);
892 DBG2(DBG_KNL
, "received a XFRM_MSG_MIGRATE");
894 src_ts
= selector2ts(&policy_id
->sel
, TRUE
);
895 dst_ts
= selector2ts(&policy_id
->sel
, FALSE
);
896 dir
= (policy_dir_t
)policy_id
->dir
;
898 DBG2(DBG_KNL
, " policy: %R === %R %N", src_ts
, dst_ts
, policy_dir_names
);
900 while (RTA_OK(rta
, rtasize
))
902 DBG2(DBG_KNL
, " %N", xfrm_attr_type_names
, rta
->rta_type
);
903 if (rta
->rta_type
== XFRMA_KMADDRESS
)
905 struct xfrm_user_kmaddress
*kmaddress
;
907 kmaddress
= (struct xfrm_user_kmaddress
*)RTA_DATA(rta
);
908 local
= xfrm2host(kmaddress
->family
, &kmaddress
->local
, 0);
909 remote
= xfrm2host(kmaddress
->family
, &kmaddress
->remote
, 0);
910 DBG2(DBG_KNL
, " kmaddress: %H...%H", local
, remote
);
912 else if (rta
->rta_type
== XFRMA_MIGRATE
)
914 struct xfrm_user_migrate
*migrate
;
916 migrate
= (struct xfrm_user_migrate
*)RTA_DATA(rta
);
917 old_src
= xfrm2host(migrate
->old_family
, &migrate
->old_saddr
, 0);
918 old_dst
= xfrm2host(migrate
->old_family
, &migrate
->old_daddr
, 0);
919 new_src
= xfrm2host(migrate
->new_family
, &migrate
->new_saddr
, 0);
920 new_dst
= xfrm2host(migrate
->new_family
, &migrate
->new_daddr
, 0);
921 reqid
= migrate
->reqid
;
922 DBG2(DBG_KNL
, " migrate %H...%H to %H...%H, reqid {%u}",
923 old_src
, old_dst
, new_src
, new_dst
, reqid
);
929 rta
= RTA_NEXT(rta
, rtasize
);
932 if (src_ts
&& dst_ts
&& local
&& remote
)
934 hydra
->kernel_interface
->migrate(hydra
->kernel_interface
, reqid
,
935 src_ts
, dst_ts
, dir
, local
, remote
);
947 * Process a XFRM_MSG_MAPPING from kernel
949 static void process_mapping(private_kernel_netlink_ipsec_t
*this,
950 struct nlmsghdr
*hdr
)
952 struct xfrm_user_mapping
*mapping
;
953 u_int32_t spi
, reqid
;
955 mapping
= (struct xfrm_user_mapping
*)NLMSG_DATA(hdr
);
956 spi
= mapping
->id
.spi
;
957 reqid
= mapping
->reqid
;
959 DBG2(DBG_KNL
, "received a XFRM_MSG_MAPPING");
961 if (mapping
->id
.proto
== IPPROTO_ESP
)
964 host
= xfrm2host(mapping
->id
.family
, &mapping
->new_saddr
,
968 hydra
->kernel_interface
->mapping(hydra
->kernel_interface
, reqid
,
975 * Receives events from kernel
977 static job_requeue_t
receive_events(private_kernel_netlink_ipsec_t
*this)
980 struct nlmsghdr
*hdr
= (struct nlmsghdr
*)response
;
981 struct sockaddr_nl addr
;
982 socklen_t addr_len
= sizeof(addr
);
986 oldstate
= thread_cancelability(TRUE
);
987 len
= recvfrom(this->socket_xfrm_events
, response
, sizeof(response
), 0,
988 (struct sockaddr
*)&addr
, &addr_len
);
989 thread_cancelability(oldstate
);
996 /* interrupted, try again */
997 return JOB_REQUEUE_DIRECT
;
999 /* no data ready, select again */
1000 return JOB_REQUEUE_DIRECT
;
1002 DBG1(DBG_KNL
, "unable to receive from xfrm event socket");
1004 return JOB_REQUEUE_FAIR
;
1008 if (addr
.nl_pid
!= 0)
1009 { /* not from kernel. not interested, try another one */
1010 return JOB_REQUEUE_DIRECT
;
1013 while (NLMSG_OK(hdr
, len
))
1015 switch (hdr
->nlmsg_type
)
1017 case XFRM_MSG_ACQUIRE
:
1018 process_acquire(this, hdr
);
1020 case XFRM_MSG_EXPIRE
:
1021 process_expire(this, hdr
);
1023 case XFRM_MSG_MIGRATE
:
1024 process_migrate(this, hdr
);
1026 case XFRM_MSG_MAPPING
:
1027 process_mapping(this, hdr
);
1030 DBG1(DBG_KNL
, "received unknown event from xfrm event "
1031 "socket: %d", hdr
->nlmsg_type
);
1034 hdr
= NLMSG_NEXT(hdr
, len
);
1036 return JOB_REQUEUE_DIRECT
;
1039 METHOD(kernel_ipsec_t
, get_features
, kernel_feature_t
,
1040 private_kernel_netlink_ipsec_t
*this)
1042 return KERNEL_ESP_V3_TFC
;
1046 * Get an SPI for a specific protocol from the kernel.
1048 static status_t
get_spi_internal(private_kernel_netlink_ipsec_t
*this,
1049 host_t
*src
, host_t
*dst
, u_int8_t proto
, u_int32_t min
, u_int32_t max
,
1050 u_int32_t reqid
, u_int32_t
*spi
)
1052 netlink_buf_t request
;
1053 struct nlmsghdr
*hdr
, *out
;
1054 struct xfrm_userspi_info
*userspi
;
1055 u_int32_t received_spi
= 0;
1058 memset(&request
, 0, sizeof(request
));
1060 hdr
= (struct nlmsghdr
*)request
;
1061 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1062 hdr
->nlmsg_type
= XFRM_MSG_ALLOCSPI
;
1063 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userspi_info
));
1065 userspi
= (struct xfrm_userspi_info
*)NLMSG_DATA(hdr
);
1066 host2xfrm(src
, &userspi
->info
.saddr
);
1067 host2xfrm(dst
, &userspi
->info
.id
.daddr
);
1068 userspi
->info
.id
.proto
= proto
;
1069 userspi
->info
.mode
= XFRM_MODE_TUNNEL
;
1070 userspi
->info
.reqid
= reqid
;
1071 userspi
->info
.family
= src
->get_family(src
);
1075 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1078 while (NLMSG_OK(hdr
, len
))
1080 switch (hdr
->nlmsg_type
)
1082 case XFRM_MSG_NEWSA
:
1084 struct xfrm_usersa_info
* usersa
= NLMSG_DATA(hdr
);
1085 received_spi
= usersa
->id
.spi
;
1090 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1091 DBG1(DBG_KNL
, "allocating SPI failed: %s (%d)",
1092 strerror(-err
->error
), -err
->error
);
1096 hdr
= NLMSG_NEXT(hdr
, len
);
1106 if (received_spi
== 0)
1111 *spi
= received_spi
;
1115 METHOD(kernel_ipsec_t
, get_spi
, status_t
,
1116 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
1117 u_int8_t protocol
, u_int32_t reqid
, u_int32_t
*spi
)
1119 DBG2(DBG_KNL
, "getting SPI for reqid {%u}", reqid
);
1121 if (get_spi_internal(this, src
, dst
, protocol
,
1122 0xc0000000, 0xcFFFFFFF, reqid
, spi
) != SUCCESS
)
1124 DBG1(DBG_KNL
, "unable to get SPI for reqid {%u}", reqid
);
1128 DBG2(DBG_KNL
, "got SPI %.8x for reqid {%u}", ntohl(*spi
), reqid
);
1132 METHOD(kernel_ipsec_t
, get_cpi
, status_t
,
1133 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
1134 u_int32_t reqid
, u_int16_t
*cpi
)
1136 u_int32_t received_spi
= 0;
1138 DBG2(DBG_KNL
, "getting CPI for reqid {%u}", reqid
);
1140 if (get_spi_internal(this, src
, dst
, IPPROTO_COMP
,
1141 0x100, 0xEFFF, reqid
, &received_spi
) != SUCCESS
)
1143 DBG1(DBG_KNL
, "unable to get CPI for reqid {%u}", reqid
);
1147 *cpi
= htons((u_int16_t
)ntohl(received_spi
));
1149 DBG2(DBG_KNL
, "got CPI %.4x for reqid {%u}", ntohs(*cpi
), reqid
);
1153 METHOD(kernel_ipsec_t
, add_sa
, status_t
,
1154 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
1155 u_int32_t spi
, u_int8_t protocol
, u_int32_t reqid
, mark_t mark
,
1156 u_int32_t tfc
, lifetime_cfg_t
*lifetime
, u_int16_t enc_alg
, chunk_t enc_key
,
1157 u_int16_t int_alg
, chunk_t int_key
, ipsec_mode_t mode
, u_int16_t ipcomp
,
1158 u_int16_t cpi
, bool encap
, bool esn
, bool inbound
,
1159 traffic_selector_t
* src_ts
, traffic_selector_t
* dst_ts
)
1161 netlink_buf_t request
;
1163 struct nlmsghdr
*hdr
;
1164 struct xfrm_usersa_info
*sa
;
1165 u_int16_t icv_size
= 64;
1166 status_t status
= FAILED
;
1168 /* if IPComp is used, we install an additional IPComp SA. if the cpi is 0
1169 * we are in the recursive call below */
1170 if (ipcomp
!= IPCOMP_NONE
&& cpi
!= 0)
1172 lifetime_cfg_t lft
= {{0,0,0},{0,0,0},{0,0,0}};
1173 add_sa(this, src
, dst
, htonl(ntohs(cpi
)), IPPROTO_COMP
, reqid
, mark
,
1174 tfc
, &lft
, ENCR_UNDEFINED
, chunk_empty
, AUTH_UNDEFINED
,
1175 chunk_empty
, mode
, ipcomp
, 0, FALSE
, FALSE
, inbound
, NULL
, NULL
);
1176 ipcomp
= IPCOMP_NONE
;
1177 /* use transport mode ESP SA, IPComp uses tunnel mode */
1178 mode
= MODE_TRANSPORT
;
1181 memset(&request
, 0, sizeof(request
));
1183 DBG2(DBG_KNL
, "adding SAD entry with SPI %.8x and reqid {%u} (mark "
1184 "%u/0x%08x)", ntohl(spi
), reqid
, mark
.value
, mark
.mask
);
1186 hdr
= (struct nlmsghdr
*)request
;
1187 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1188 hdr
->nlmsg_type
= inbound
? XFRM_MSG_UPDSA
: XFRM_MSG_NEWSA
;
1189 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
1191 sa
= (struct xfrm_usersa_info
*)NLMSG_DATA(hdr
);
1192 host2xfrm(src
, &sa
->saddr
);
1193 host2xfrm(dst
, &sa
->id
.daddr
);
1195 sa
->id
.proto
= protocol
;
1196 sa
->family
= src
->get_family(src
);
1197 sa
->mode
= mode2kernel(mode
);
1201 sa
->flags
|= XFRM_STATE_AF_UNSPEC
;
1204 case MODE_TRANSPORT
:
1205 if(src_ts
&& dst_ts
)
1207 sa
->sel
= ts2selector(src_ts
, dst_ts
);
1215 sa
->lft
.soft_byte_limit
= XFRM_LIMIT(lifetime
->bytes
.rekey
);
1216 sa
->lft
.hard_byte_limit
= XFRM_LIMIT(lifetime
->bytes
.life
);
1217 sa
->lft
.soft_packet_limit
= XFRM_LIMIT(lifetime
->packets
.rekey
);
1218 sa
->lft
.hard_packet_limit
= XFRM_LIMIT(lifetime
->packets
.life
);
1219 /* we use lifetimes since added, not since used */
1220 sa
->lft
.soft_add_expires_seconds
= lifetime
->time
.rekey
;
1221 sa
->lft
.hard_add_expires_seconds
= lifetime
->time
.life
;
1222 sa
->lft
.soft_use_expires_seconds
= 0;
1223 sa
->lft
.hard_use_expires_seconds
= 0;
1225 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_usersa_info
);
1229 case ENCR_UNDEFINED
:
1232 case ENCR_AES_CCM_ICV16
:
1233 case ENCR_AES_GCM_ICV16
:
1234 case ENCR_NULL_AUTH_AES_GMAC
:
1235 case ENCR_CAMELLIA_CCM_ICV16
:
1238 case ENCR_AES_CCM_ICV12
:
1239 case ENCR_AES_GCM_ICV12
:
1240 case ENCR_CAMELLIA_CCM_ICV12
:
1243 case ENCR_AES_CCM_ICV8
:
1244 case ENCR_AES_GCM_ICV8
:
1245 case ENCR_CAMELLIA_CCM_ICV8
:
1247 struct xfrm_algo_aead
*algo
;
1249 alg_name
= lookup_algorithm(ENCRYPTION_ALGORITHM
, enc_alg
);
1250 if (alg_name
== NULL
)
1252 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1253 encryption_algorithm_names
, enc_alg
);
1256 DBG2(DBG_KNL
, " using encryption algorithm %N with key size %d",
1257 encryption_algorithm_names
, enc_alg
, enc_key
.len
* 8);
1259 rthdr
->rta_type
= XFRMA_ALG_AEAD
;
1260 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo_aead
) +
1262 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1263 if (hdr
->nlmsg_len
> sizeof(request
))
1268 algo
= (struct xfrm_algo_aead
*)RTA_DATA(rthdr
);
1269 algo
->alg_key_len
= enc_key
.len
* 8;
1270 algo
->alg_icv_len
= icv_size
;
1271 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1272 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1273 memcpy(algo
->alg_key
, enc_key
.ptr
, enc_key
.len
);
1275 rthdr
= XFRM_RTA_NEXT(rthdr
);
1280 struct xfrm_algo
*algo
;
1282 alg_name
= lookup_algorithm(ENCRYPTION_ALGORITHM
, enc_alg
);
1283 if (alg_name
== NULL
)
1285 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1286 encryption_algorithm_names
, enc_alg
);
1289 DBG2(DBG_KNL
, " using encryption algorithm %N with key size %d",
1290 encryption_algorithm_names
, enc_alg
, enc_key
.len
* 8);
1292 rthdr
->rta_type
= XFRMA_ALG_CRYPT
;
1293 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo
) + enc_key
.len
);
1294 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1295 if (hdr
->nlmsg_len
> sizeof(request
))
1300 algo
= (struct xfrm_algo
*)RTA_DATA(rthdr
);
1301 algo
->alg_key_len
= enc_key
.len
* 8;
1302 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1303 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1304 memcpy(algo
->alg_key
, enc_key
.ptr
, enc_key
.len
);
1306 rthdr
= XFRM_RTA_NEXT(rthdr
);
1310 if (int_alg
!= AUTH_UNDEFINED
)
1312 u_int trunc_len
= 0;
1314 alg_name
= lookup_algorithm(INTEGRITY_ALGORITHM
, int_alg
);
1315 if (alg_name
== NULL
)
1317 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1318 integrity_algorithm_names
, int_alg
);
1321 DBG2(DBG_KNL
, " using integrity algorithm %N with key size %d",
1322 integrity_algorithm_names
, int_alg
, int_key
.len
* 8);
1326 case AUTH_HMAC_MD5_128
:
1327 case AUTH_HMAC_SHA2_256_128
:
1330 case AUTH_HMAC_SHA1_160
:
1339 struct xfrm_algo_auth
* algo
;
1341 /* the kernel uses SHA256 with 96 bit truncation by default,
1342 * use specified truncation size supported by newer kernels.
1343 * also use this for untruncated MD5 and SHA1. */
1344 rthdr
->rta_type
= XFRMA_ALG_AUTH_TRUNC
;
1345 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo_auth
) +
1348 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1349 if (hdr
->nlmsg_len
> sizeof(request
))
1354 algo
= (struct xfrm_algo_auth
*)RTA_DATA(rthdr
);
1355 algo
->alg_key_len
= int_key
.len
* 8;
1356 algo
->alg_trunc_len
= trunc_len
;
1357 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1358 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1359 memcpy(algo
->alg_key
, int_key
.ptr
, int_key
.len
);
1363 struct xfrm_algo
* algo
;
1365 rthdr
->rta_type
= XFRMA_ALG_AUTH
;
1366 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo
) + int_key
.len
);
1368 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1369 if (hdr
->nlmsg_len
> sizeof(request
))
1374 algo
= (struct xfrm_algo
*)RTA_DATA(rthdr
);
1375 algo
->alg_key_len
= int_key
.len
* 8;
1376 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1377 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1378 memcpy(algo
->alg_key
, int_key
.ptr
, int_key
.len
);
1380 rthdr
= XFRM_RTA_NEXT(rthdr
);
1383 if (ipcomp
!= IPCOMP_NONE
)
1385 rthdr
->rta_type
= XFRMA_ALG_COMP
;
1386 alg_name
= lookup_algorithm(COMPRESSION_ALGORITHM
, ipcomp
);
1387 if (alg_name
== NULL
)
1389 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1390 ipcomp_transform_names
, ipcomp
);
1393 DBG2(DBG_KNL
, " using compression algorithm %N",
1394 ipcomp_transform_names
, ipcomp
);
1396 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_algo
));
1397 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1398 if (hdr
->nlmsg_len
> sizeof(request
))
1403 struct xfrm_algo
* algo
= (struct xfrm_algo
*)RTA_DATA(rthdr
);
1404 algo
->alg_key_len
= 0;
1405 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1406 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1408 rthdr
= XFRM_RTA_NEXT(rthdr
);
1413 struct xfrm_encap_tmpl
*tmpl
;
1415 rthdr
->rta_type
= XFRMA_ENCAP
;
1416 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_encap_tmpl
));
1418 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1419 if (hdr
->nlmsg_len
> sizeof(request
))
1424 tmpl
= (struct xfrm_encap_tmpl
*)RTA_DATA(rthdr
);
1425 tmpl
->encap_type
= UDP_ENCAP_ESPINUDP
;
1426 tmpl
->encap_sport
= htons(src
->get_port(src
));
1427 tmpl
->encap_dport
= htons(dst
->get_port(dst
));
1428 memset(&tmpl
->encap_oa
, 0, sizeof (xfrm_address_t
));
1429 /* encap_oa could probably be derived from the
1430 * traffic selectors [rfc4306, p39]. In the netlink kernel
1431 * implementation pluto does the same as we do here but it uses
1432 * encap_oa in the pfkey implementation.
1433 * BUT as /usr/src/linux/net/key/af_key.c indicates the kernel ignores
1435 * -> does that mean that NAT-T encap doesn't work in transport mode?
1436 * No. The reason the kernel ignores NAT-OA is that it recomputes
1437 * (or, rather, just ignores) the checksum. If packets pass the IPsec
1438 * checks it marks them "checksum ok" so OA isn't needed. */
1439 rthdr
= XFRM_RTA_NEXT(rthdr
);
1444 struct xfrm_mark
*mrk
;
1446 rthdr
->rta_type
= XFRMA_MARK
;
1447 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
1449 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1450 if (hdr
->nlmsg_len
> sizeof(request
))
1455 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
1456 mrk
->v
= mark
.value
;
1458 rthdr
= XFRM_RTA_NEXT(rthdr
);
1465 rthdr
->rta_type
= XFRMA_TFCPAD
;
1466 rthdr
->rta_len
= RTA_LENGTH(sizeof(u_int32_t
));
1468 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1469 if (hdr
->nlmsg_len
> sizeof(request
))
1474 tfcpad
= (u_int32_t
*)RTA_DATA(rthdr
);
1476 rthdr
= XFRM_RTA_NEXT(rthdr
);
1479 if (protocol
!= IPPROTO_COMP
)
1481 if (esn
|| this->replay_window
> DEFAULT_REPLAY_WINDOW
)
1483 /* for ESN or larger replay windows we need the new
1484 * XFRMA_REPLAY_ESN_VAL attribute to configure a bitmap */
1485 struct xfrm_replay_state_esn
*replay
;
1487 rthdr
->rta_type
= XFRMA_REPLAY_ESN_VAL
;
1488 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_replay_state_esn
) +
1489 (this->replay_window
+ 7) / 8);
1491 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1492 if (hdr
->nlmsg_len
> sizeof(request
))
1497 replay
= (struct xfrm_replay_state_esn
*)RTA_DATA(rthdr
);
1498 /* bmp_len contains number uf __u32's */
1499 replay
->bmp_len
= this->replay_bmp
;
1500 replay
->replay_window
= this->replay_window
;
1501 DBG2(DBG_KNL
, " using replay window of %u packets",
1502 this->replay_window
);
1504 rthdr
= XFRM_RTA_NEXT(rthdr
);
1507 DBG2(DBG_KNL
, " using extended sequence numbers (ESN)");
1508 sa
->flags
|= XFRM_STATE_ESN
;
1513 DBG2(DBG_KNL
, " using replay window of %u packets",
1514 this->replay_window
);
1515 sa
->replay_window
= this->replay_window
;
1519 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
1523 DBG1(DBG_KNL
, "unable to add SAD entry with SPI %.8x "
1524 "(mark %u/0x%08x)", ntohl(spi
), mark
.value
, mark
.mask
);
1528 DBG1(DBG_KNL
, "unable to add SAD entry with SPI %.8x", ntohl(spi
));
1536 memwipe(request
, sizeof(request
));
1541 * Get the ESN replay state (i.e. sequence numbers) of an SA.
1543 * Allocates into one the replay state structure we get from the kernel.
1545 static void get_replay_state(private_kernel_netlink_ipsec_t
*this,
1546 u_int32_t spi
, u_int8_t protocol
,
1547 host_t
*dst
, mark_t mark
,
1548 struct xfrm_replay_state_esn
**replay_esn
,
1549 struct xfrm_replay_state
**replay
)
1551 netlink_buf_t request
;
1552 struct nlmsghdr
*hdr
, *out
= NULL
;
1553 struct xfrm_aevent_id
*out_aevent
= NULL
, *aevent_id
;
1558 memset(&request
, 0, sizeof(request
));
1560 DBG2(DBG_KNL
, "querying replay state from SAD entry with SPI %.8x",
1563 hdr
= (struct nlmsghdr
*)request
;
1564 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1565 hdr
->nlmsg_type
= XFRM_MSG_GETAE
;
1566 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_aevent_id
));
1568 aevent_id
= (struct xfrm_aevent_id
*)NLMSG_DATA(hdr
);
1569 aevent_id
->flags
= XFRM_AE_RVAL
;
1571 host2xfrm(dst
, &aevent_id
->sa_id
.daddr
);
1572 aevent_id
->sa_id
.spi
= spi
;
1573 aevent_id
->sa_id
.proto
= protocol
;
1574 aevent_id
->sa_id
.family
= dst
->get_family(dst
);
1578 struct xfrm_mark
*mrk
;
1579 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_aevent_id
);
1581 rthdr
->rta_type
= XFRMA_MARK
;
1582 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
1583 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1584 if (hdr
->nlmsg_len
> sizeof(request
))
1589 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
1590 mrk
->v
= mark
.value
;
1594 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1597 while (NLMSG_OK(hdr
, len
))
1599 switch (hdr
->nlmsg_type
)
1601 case XFRM_MSG_NEWAE
:
1603 out_aevent
= NLMSG_DATA(hdr
);
1608 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1609 DBG1(DBG_KNL
, "querying replay state from SAD entry "
1610 "failed: %s (%d)", strerror(-err
->error
),
1615 hdr
= NLMSG_NEXT(hdr
, len
);
1626 rta
= XFRM_RTA(out
, struct xfrm_aevent_id
);
1627 rtasize
= XFRM_PAYLOAD(out
, struct xfrm_aevent_id
);
1628 while (RTA_OK(rta
, rtasize
))
1630 if (rta
->rta_type
== XFRMA_REPLAY_VAL
&&
1631 RTA_PAYLOAD(rta
) == sizeof(**replay
))
1633 *replay
= malloc(RTA_PAYLOAD(rta
));
1634 memcpy(*replay
, RTA_DATA(rta
), RTA_PAYLOAD(rta
));
1637 if (rta
->rta_type
== XFRMA_REPLAY_ESN_VAL
&&
1638 RTA_PAYLOAD(rta
) >= sizeof(**replay_esn
) + this->replay_bmp
)
1640 *replay_esn
= malloc(RTA_PAYLOAD(rta
));
1641 memcpy(*replay_esn
, RTA_DATA(rta
), RTA_PAYLOAD(rta
));
1644 rta
= RTA_NEXT(rta
, rtasize
);
1650 METHOD(kernel_ipsec_t
, query_sa
, status_t
,
1651 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
1652 u_int32_t spi
, u_int8_t protocol
, mark_t mark
, u_int64_t
*bytes
)
1654 netlink_buf_t request
;
1655 struct nlmsghdr
*out
= NULL
, *hdr
;
1656 struct xfrm_usersa_id
*sa_id
;
1657 struct xfrm_usersa_info
*sa
= NULL
;
1658 status_t status
= FAILED
;
1661 memset(&request
, 0, sizeof(request
));
1663 DBG2(DBG_KNL
, "querying SAD entry with SPI %.8x (mark %u/0x%08x)",
1664 ntohl(spi
), mark
.value
, mark
.mask
);
1666 hdr
= (struct nlmsghdr
*)request
;
1667 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1668 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
1669 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
1671 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
1672 host2xfrm(dst
, &sa_id
->daddr
);
1674 sa_id
->proto
= protocol
;
1675 sa_id
->family
= dst
->get_family(dst
);
1679 struct xfrm_mark
*mrk
;
1680 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_usersa_id
);
1682 rthdr
->rta_type
= XFRMA_MARK
;
1683 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
1684 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1685 if (hdr
->nlmsg_len
> sizeof(request
))
1690 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
1691 mrk
->v
= mark
.value
;
1695 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1698 while (NLMSG_OK(hdr
, len
))
1700 switch (hdr
->nlmsg_type
)
1702 case XFRM_MSG_NEWSA
:
1704 sa
= (struct xfrm_usersa_info
*)NLMSG_DATA(hdr
);
1709 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1713 DBG1(DBG_KNL
, "querying SAD entry with SPI %.8x "
1714 "(mark %u/0x%08x) failed: %s (%d)",
1715 ntohl(spi
), mark
.value
, mark
.mask
,
1716 strerror(-err
->error
), -err
->error
);
1720 DBG1(DBG_KNL
, "querying SAD entry with SPI %.8x "
1721 "failed: %s (%d)", ntohl(spi
),
1722 strerror(-err
->error
), -err
->error
);
1727 hdr
= NLMSG_NEXT(hdr
, len
);
1738 DBG2(DBG_KNL
, "unable to query SAD entry with SPI %.8x", ntohl(spi
));
1742 *bytes
= sa
->curlft
.bytes
;
1750 METHOD(kernel_ipsec_t
, del_sa
, status_t
,
1751 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
1752 u_int32_t spi
, u_int8_t protocol
, u_int16_t cpi
, mark_t mark
)
1754 netlink_buf_t request
;
1755 struct nlmsghdr
*hdr
;
1756 struct xfrm_usersa_id
*sa_id
;
1758 /* if IPComp was used, we first delete the additional IPComp SA */
1761 del_sa(this, src
, dst
, htonl(ntohs(cpi
)), IPPROTO_COMP
, 0, mark
);
1764 memset(&request
, 0, sizeof(request
));
1766 DBG2(DBG_KNL
, "deleting SAD entry with SPI %.8x (mark %u/0x%08x)",
1767 ntohl(spi
), mark
.value
, mark
.mask
);
1769 hdr
= (struct nlmsghdr
*)request
;
1770 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1771 hdr
->nlmsg_type
= XFRM_MSG_DELSA
;
1772 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
1774 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
1775 host2xfrm(dst
, &sa_id
->daddr
);
1777 sa_id
->proto
= protocol
;
1778 sa_id
->family
= dst
->get_family(dst
);
1782 struct xfrm_mark
*mrk
;
1783 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_usersa_id
);
1785 rthdr
->rta_type
= XFRMA_MARK
;
1786 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
1787 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1788 if (hdr
->nlmsg_len
> sizeof(request
))
1793 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
1794 mrk
->v
= mark
.value
;
1798 switch (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
))
1801 DBG2(DBG_KNL
, "deleted SAD entry with SPI %.8x (mark %u/0x%08x)",
1802 ntohl(spi
), mark
.value
, mark
.mask
);
1809 DBG1(DBG_KNL
, "unable to delete SAD entry with SPI %.8x "
1810 "(mark %u/0x%08x)", ntohl(spi
), mark
.value
, mark
.mask
);
1814 DBG1(DBG_KNL
, "unable to delete SAD entry with SPI %.8x",
1821 METHOD(kernel_ipsec_t
, update_sa
, status_t
,
1822 private_kernel_netlink_ipsec_t
*this, u_int32_t spi
, u_int8_t protocol
,
1823 u_int16_t cpi
, host_t
*src
, host_t
*dst
, host_t
*new_src
, host_t
*new_dst
,
1824 bool old_encap
, bool new_encap
, mark_t mark
)
1826 netlink_buf_t request
;
1828 struct nlmsghdr
*hdr
, *out
= NULL
;
1829 struct xfrm_usersa_id
*sa_id
;
1830 struct xfrm_usersa_info
*out_sa
= NULL
, *sa
;
1834 struct xfrm_encap_tmpl
* tmpl
= NULL
;
1835 struct xfrm_replay_state
*replay
= NULL
;
1836 struct xfrm_replay_state_esn
*replay_esn
= NULL
;
1837 status_t status
= FAILED
;
1839 /* if IPComp is used, we first update the IPComp SA */
1842 update_sa(this, htonl(ntohs(cpi
)), IPPROTO_COMP
, 0,
1843 src
, dst
, new_src
, new_dst
, FALSE
, FALSE
, mark
);
1846 memset(&request
, 0, sizeof(request
));
1848 DBG2(DBG_KNL
, "querying SAD entry with SPI %.8x for update", ntohl(spi
));
1850 /* query the existing SA first */
1851 hdr
= (struct nlmsghdr
*)request
;
1852 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1853 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
1854 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
1856 sa_id
= (struct xfrm_usersa_id
*)NLMSG_DATA(hdr
);
1857 host2xfrm(dst
, &sa_id
->daddr
);
1859 sa_id
->proto
= protocol
;
1860 sa_id
->family
= dst
->get_family(dst
);
1864 struct xfrm_mark
*mrk
;
1865 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_usersa_id
);
1867 rthdr
->rta_type
= XFRMA_MARK
;
1868 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
1869 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
1870 if (hdr
->nlmsg_len
> sizeof(request
))
1875 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
1876 mrk
->v
= mark
.value
;
1880 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1883 while (NLMSG_OK(hdr
, len
))
1885 switch (hdr
->nlmsg_type
)
1887 case XFRM_MSG_NEWSA
:
1889 out_sa
= NLMSG_DATA(hdr
);
1894 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1895 DBG1(DBG_KNL
, "querying SAD entry failed: %s (%d)",
1896 strerror(-err
->error
), -err
->error
);
1900 hdr
= NLMSG_NEXT(hdr
, len
);
1910 DBG1(DBG_KNL
, "unable to update SAD entry with SPI %.8x", ntohl(spi
));
1914 get_replay_state(this, spi
, protocol
, dst
, mark
, &replay_esn
, &replay
);
1916 /* delete the old SA (without affecting the IPComp SA) */
1917 if (del_sa(this, src
, dst
, spi
, protocol
, 0, mark
) != SUCCESS
)
1919 DBG1(DBG_KNL
, "unable to delete old SAD entry with SPI %.8x",
1924 DBG2(DBG_KNL
, "updating SAD entry with SPI %.8x from %#H..%#H to %#H..%#H",
1925 ntohl(spi
), src
, dst
, new_src
, new_dst
);
1926 /* copy over the SA from out to request */
1927 hdr
= (struct nlmsghdr
*)request
;
1928 memcpy(hdr
, out
, min(out
->nlmsg_len
, sizeof(request
)));
1929 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1930 hdr
->nlmsg_type
= XFRM_MSG_NEWSA
;
1931 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
1932 sa
= NLMSG_DATA(hdr
);
1933 sa
->family
= new_dst
->get_family(new_dst
);
1935 if (!src
->ip_equals(src
, new_src
))
1937 host2xfrm(new_src
, &sa
->saddr
);
1939 if (!dst
->ip_equals(dst
, new_dst
))
1941 host2xfrm(new_dst
, &sa
->id
.daddr
);
1944 rta
= XFRM_RTA(out
, struct xfrm_usersa_info
);
1945 rtasize
= XFRM_PAYLOAD(out
, struct xfrm_usersa_info
);
1946 pos
= (u_char
*)XFRM_RTA(hdr
, struct xfrm_usersa_info
);
1947 while(RTA_OK(rta
, rtasize
))
1949 /* copy all attributes, but not XFRMA_ENCAP if we are disabling it */
1950 if (rta
->rta_type
!= XFRMA_ENCAP
|| new_encap
)
1952 if (rta
->rta_type
== XFRMA_ENCAP
)
1953 { /* update encap tmpl */
1954 tmpl
= (struct xfrm_encap_tmpl
*)RTA_DATA(rta
);
1955 tmpl
->encap_sport
= ntohs(new_src
->get_port(new_src
));
1956 tmpl
->encap_dport
= ntohs(new_dst
->get_port(new_dst
));
1958 memcpy(pos
, rta
, rta
->rta_len
);
1959 pos
+= RTA_ALIGN(rta
->rta_len
);
1960 hdr
->nlmsg_len
+= RTA_ALIGN(rta
->rta_len
);
1962 rta
= RTA_NEXT(rta
, rtasize
);
1965 rta
= (struct rtattr
*)pos
;
1966 if (tmpl
== NULL
&& new_encap
)
1967 { /* add tmpl if we are enabling it */
1968 rta
->rta_type
= XFRMA_ENCAP
;
1969 rta
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_encap_tmpl
));
1971 hdr
->nlmsg_len
+= RTA_ALIGN(rta
->rta_len
);
1972 if (hdr
->nlmsg_len
> sizeof(request
))
1977 tmpl
= (struct xfrm_encap_tmpl
*)RTA_DATA(rta
);
1978 tmpl
->encap_type
= UDP_ENCAP_ESPINUDP
;
1979 tmpl
->encap_sport
= ntohs(new_src
->get_port(new_src
));
1980 tmpl
->encap_dport
= ntohs(new_dst
->get_port(new_dst
));
1981 memset(&tmpl
->encap_oa
, 0, sizeof (xfrm_address_t
));
1983 rta
= XFRM_RTA_NEXT(rta
);
1988 rta
->rta_type
= XFRMA_REPLAY_ESN_VAL
;
1989 rta
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_replay_state_esn
) +
1992 hdr
->nlmsg_len
+= RTA_ALIGN(rta
->rta_len
);
1993 if (hdr
->nlmsg_len
> sizeof(request
))
1997 memcpy(RTA_DATA(rta
), replay_esn
,
1998 sizeof(struct xfrm_replay_state_esn
) + this->replay_bmp
);
2000 rta
= XFRM_RTA_NEXT(rta
);
2004 rta
->rta_type
= XFRMA_REPLAY_VAL
;
2005 rta
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_replay_state
));
2007 hdr
->nlmsg_len
+= RTA_ALIGN(rta
->rta_len
);
2008 if (hdr
->nlmsg_len
> sizeof(request
))
2012 memcpy(RTA_DATA(rta
), replay
, sizeof(struct xfrm_replay_state
));
2014 rta
= XFRM_RTA_NEXT(rta
);
2018 DBG1(DBG_KNL
, "unable to copy replay state from old SAD entry "
2019 "with SPI %.8x", ntohl(spi
));
2022 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
2024 DBG1(DBG_KNL
, "unable to update SAD entry with SPI %.8x", ntohl(spi
));
2033 memwipe(request
, sizeof(request
));
2039 METHOD(kernel_ipsec_t
, flush_sas
, status_t
,
2040 private_kernel_netlink_ipsec_t
*this)
2042 netlink_buf_t request
;
2043 struct nlmsghdr
*hdr
;
2044 struct xfrm_usersa_flush
*flush
;
2046 memset(&request
, 0, sizeof(request
));
2048 DBG2(DBG_KNL
, "flushing all SAD entries");
2050 hdr
= (struct nlmsghdr
*)request
;
2051 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2052 hdr
->nlmsg_type
= XFRM_MSG_FLUSHSA
;
2053 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush
));
2055 flush
= (struct xfrm_usersa_flush
*)NLMSG_DATA(hdr
);
2056 flush
->proto
= IPSEC_PROTO_ANY
;
2058 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
2060 DBG1(DBG_KNL
, "unable to flush SAD entries");
2067 * Add or update a policy in the kernel.
2069 * Note: The mutex has to be locked when entering this function
2070 * and is unlocked here in any case.
2072 static status_t
add_policy_internal(private_kernel_netlink_ipsec_t
*this,
2073 policy_entry_t
*policy
, policy_sa_t
*mapping
, bool update
)
2075 netlink_buf_t request
;
2076 policy_entry_t clone
;
2077 ipsec_sa_t
*ipsec
= mapping
->sa
;
2078 struct xfrm_userpolicy_info
*policy_info
;
2079 struct nlmsghdr
*hdr
;
2082 /* clone the policy so we are able to check it out again later */
2083 memcpy(&clone
, policy
, sizeof(policy_entry_t
));
2085 memset(&request
, 0, sizeof(request
));
2086 hdr
= (struct nlmsghdr
*)request
;
2087 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2088 hdr
->nlmsg_type
= update
? XFRM_MSG_UPDPOLICY
: XFRM_MSG_NEWPOLICY
;
2089 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info
));
2091 policy_info
= (struct xfrm_userpolicy_info
*)NLMSG_DATA(hdr
);
2092 policy_info
->sel
= policy
->sel
;
2093 policy_info
->dir
= policy
->direction
;
2095 /* calculate priority based on selector size, small size = high prio */
2096 policy_info
->priority
= mapping
->priority
;
2097 policy_info
->action
= mapping
->type
!= POLICY_DROP
? XFRM_POLICY_ALLOW
2098 : XFRM_POLICY_BLOCK
;
2099 policy_info
->share
= XFRM_SHARE_ANY
;
2101 /* policies don't expire */
2102 policy_info
->lft
.soft_byte_limit
= XFRM_INF
;
2103 policy_info
->lft
.soft_packet_limit
= XFRM_INF
;
2104 policy_info
->lft
.hard_byte_limit
= XFRM_INF
;
2105 policy_info
->lft
.hard_packet_limit
= XFRM_INF
;
2106 policy_info
->lft
.soft_add_expires_seconds
= 0;
2107 policy_info
->lft
.hard_add_expires_seconds
= 0;
2108 policy_info
->lft
.soft_use_expires_seconds
= 0;
2109 policy_info
->lft
.hard_use_expires_seconds
= 0;
2111 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_userpolicy_info
);
2113 if (mapping
->type
== POLICY_IPSEC
)
2115 struct xfrm_user_tmpl
*tmpl
= (struct xfrm_user_tmpl
*)RTA_DATA(rthdr
);
2120 { IPPROTO_COMP
, ipsec
->cfg
.ipcomp
.transform
!= IPCOMP_NONE
},
2121 { IPPROTO_ESP
, ipsec
->cfg
.esp
.use
},
2122 { IPPROTO_AH
, ipsec
->cfg
.ah
.use
},
2124 ipsec_mode_t proto_mode
= ipsec
->cfg
.mode
;
2126 rthdr
->rta_type
= XFRMA_TMPL
;
2127 rthdr
->rta_len
= 0; /* actual length is set below */
2129 for (i
= 0; i
< countof(protos
); i
++)
2136 rthdr
->rta_len
+= RTA_LENGTH(sizeof(struct xfrm_user_tmpl
));
2137 hdr
->nlmsg_len
+= RTA_ALIGN(RTA_LENGTH(sizeof(struct xfrm_user_tmpl
)));
2138 if (hdr
->nlmsg_len
> sizeof(request
))
2140 this->mutex
->unlock(this->mutex
);
2144 tmpl
->reqid
= ipsec
->cfg
.reqid
;
2145 tmpl
->id
.proto
= protos
[i
].proto
;
2146 tmpl
->aalgos
= tmpl
->ealgos
= tmpl
->calgos
= ~0;
2147 tmpl
->mode
= mode2kernel(proto_mode
);
2148 tmpl
->optional
= protos
[i
].proto
== IPPROTO_COMP
&&
2149 policy
->direction
!= POLICY_OUT
;
2150 tmpl
->family
= ipsec
->src
->get_family(ipsec
->src
);
2152 if (proto_mode
== MODE_TUNNEL
)
2153 { /* only for tunnel mode */
2154 host2xfrm(ipsec
->src
, &tmpl
->saddr
);
2155 host2xfrm(ipsec
->dst
, &tmpl
->id
.daddr
);
2160 /* use transport mode for other SAs */
2161 proto_mode
= MODE_TRANSPORT
;
2164 rthdr
= XFRM_RTA_NEXT(rthdr
);
2167 if (ipsec
->mark
.value
)
2169 struct xfrm_mark
*mrk
;
2171 rthdr
->rta_type
= XFRMA_MARK
;
2172 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
2174 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
2175 if (hdr
->nlmsg_len
> sizeof(request
))
2177 this->mutex
->unlock(this->mutex
);
2181 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
2182 mrk
->v
= ipsec
->mark
.value
;
2183 mrk
->m
= ipsec
->mark
.mask
;
2185 this->mutex
->unlock(this->mutex
);
2187 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
2192 /* find the policy again */
2193 this->mutex
->lock(this->mutex
);
2194 policy
= this->policies
->get(this->policies
, &clone
);
2196 policy
->used_by
->find_first(policy
->used_by
,
2197 NULL
, (void**)&mapping
) != SUCCESS
)
2198 { /* policy or mapping is already gone, ignore */
2199 this->mutex
->unlock(this->mutex
);
2203 /* install a route, if:
2204 * - this is a forward policy (to just get one for each child)
2205 * - we are in tunnel/BEET mode
2206 * - routing is not disabled via strongswan.conf
2208 if (policy
->direction
== POLICY_FWD
&&
2209 ipsec
->cfg
.mode
!= MODE_TRANSPORT
&& this->install_routes
)
2211 policy_sa_fwd_t
*fwd
= (policy_sa_fwd_t
*)mapping
;
2212 route_entry_t
*route
;
2215 .prefixlen
= policy
->sel
.prefixlen_s
,
2218 if (hydra
->kernel_interface
->get_address_by_ts(hydra
->kernel_interface
,
2219 fwd
->dst_ts
, &route
->src_ip
) == SUCCESS
)
2221 /* get the nexthop to src (src as we are in POLICY_FWD) */
2222 route
->gateway
= hydra
->kernel_interface
->get_nexthop(
2223 hydra
->kernel_interface
, ipsec
->src
,
2225 route
->dst_net
= chunk_alloc(policy
->sel
.family
== AF_INET
? 4 : 16);
2226 memcpy(route
->dst_net
.ptr
, &policy
->sel
.saddr
, route
->dst_net
.len
);
2228 /* install route via outgoing interface */
2229 if (!hydra
->kernel_interface
->get_interface(hydra
->kernel_interface
,
2230 ipsec
->dst
, &route
->if_name
))
2232 this->mutex
->unlock(this->mutex
);
2233 route_entry_destroy(route
);
2239 route_entry_t
*old
= policy
->route
;
2240 if (route_entry_equals(old
, route
))
2242 this->mutex
->unlock(this->mutex
);
2243 route_entry_destroy(route
);
2246 /* uninstall previously installed route */
2247 if (hydra
->kernel_interface
->del_route(hydra
->kernel_interface
,
2248 old
->dst_net
, old
->prefixlen
, old
->gateway
,
2249 old
->src_ip
, old
->if_name
) != SUCCESS
)
2251 DBG1(DBG_KNL
, "error uninstalling route installed with "
2252 "policy %R === %R %N", fwd
->src_ts
,
2253 fwd
->dst_ts
, policy_dir_names
,
2256 route_entry_destroy(old
);
2257 policy
->route
= NULL
;
2260 DBG2(DBG_KNL
, "installing route: %R via %H src %H dev %s",
2261 fwd
->src_ts
, route
->gateway
, route
->src_ip
, route
->if_name
);
2262 switch (hydra
->kernel_interface
->add_route(
2263 hydra
->kernel_interface
, route
->dst_net
,
2264 route
->prefixlen
, route
->gateway
,
2265 route
->src_ip
, route
->if_name
))
2268 DBG1(DBG_KNL
, "unable to install source route for %H",
2272 /* route exists, do not uninstall */
2273 route_entry_destroy(route
);
2276 /* cache the installed route */
2277 policy
->route
= route
;
2286 this->mutex
->unlock(this->mutex
);
2290 METHOD(kernel_ipsec_t
, add_policy
, status_t
,
2291 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
2292 traffic_selector_t
*src_ts
, traffic_selector_t
*dst_ts
,
2293 policy_dir_t direction
, policy_type_t type
, ipsec_sa_cfg_t
*sa
,
2294 mark_t mark
, policy_priority_t priority
)
2296 policy_entry_t
*policy
, *current
;
2297 policy_sa_t
*assigned_sa
, *current_sa
;
2298 enumerator_t
*enumerator
;
2299 bool found
= FALSE
, update
= TRUE
;
2301 /* create a policy */
2303 .sel
= ts2selector(src_ts
, dst_ts
),
2304 .mark
= mark
.value
& mark
.mask
,
2305 .direction
= direction
,
2308 /* find the policy, which matches EXACTLY */
2309 this->mutex
->lock(this->mutex
);
2310 current
= this->policies
->get(this->policies
, policy
);
2313 /* use existing policy */
2314 DBG2(DBG_KNL
, "policy %R === %R %N (mark %u/0x%08x) "
2315 "already exists, increasing refcount",
2316 src_ts
, dst_ts
, policy_dir_names
, direction
,
2317 mark
.value
, mark
.mask
);
2318 policy_entry_destroy(this, policy
);
2323 { /* use the new one, if we have no such policy */
2324 policy
->used_by
= linked_list_create();
2325 this->policies
->put(this->policies
, policy
, policy
);
2328 /* cache the assigned IPsec SA */
2329 assigned_sa
= policy_sa_create(this, direction
, type
, src
, dst
, src_ts
,
2331 assigned_sa
->priority
= get_priority(policy
, priority
);
2333 if (this->policy_history
)
2334 { /* insert the SA according to its priority */
2335 enumerator
= policy
->used_by
->create_enumerator(policy
->used_by
);
2336 while (enumerator
->enumerate(enumerator
, (void**)¤t_sa
))
2338 if (current_sa
->priority
>= assigned_sa
->priority
)
2344 policy
->used_by
->insert_before(policy
->used_by
, enumerator
,
2346 enumerator
->destroy(enumerator
);
2349 { /* simply insert it last and only update if it is not installed yet */
2350 policy
->used_by
->insert_last(policy
->used_by
, assigned_sa
);
2355 { /* we don't update the policy if the priority is lower than that of
2356 * the currently installed one */
2357 this->mutex
->unlock(this->mutex
);
2361 DBG2(DBG_KNL
, "%s policy %R === %R %N (mark %u/0x%08x)",
2362 found
? "updating" : "adding", src_ts
, dst_ts
,
2363 policy_dir_names
, direction
, mark
.value
, mark
.mask
);
2365 if (add_policy_internal(this, policy
, assigned_sa
, found
) != SUCCESS
)
2367 DBG1(DBG_KNL
, "unable to %s policy %R === %R %N",
2368 found
? "update" : "add", src_ts
, dst_ts
,
2369 policy_dir_names
, direction
);
2375 METHOD(kernel_ipsec_t
, query_policy
, status_t
,
2376 private_kernel_netlink_ipsec_t
*this, traffic_selector_t
*src_ts
,
2377 traffic_selector_t
*dst_ts
, policy_dir_t direction
, mark_t mark
,
2378 u_int32_t
*use_time
)
2380 netlink_buf_t request
;
2381 struct nlmsghdr
*out
= NULL
, *hdr
;
2382 struct xfrm_userpolicy_id
*policy_id
;
2383 struct xfrm_userpolicy_info
*policy
= NULL
;
2386 memset(&request
, 0, sizeof(request
));
2388 DBG2(DBG_KNL
, "querying policy %R === %R %N (mark %u/0x%08x)",
2389 src_ts
, dst_ts
, policy_dir_names
, direction
,
2390 mark
.value
, mark
.mask
);
2392 hdr
= (struct nlmsghdr
*)request
;
2393 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
2394 hdr
->nlmsg_type
= XFRM_MSG_GETPOLICY
;
2395 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
2397 policy_id
= (struct xfrm_userpolicy_id
*)NLMSG_DATA(hdr
);
2398 policy_id
->sel
= ts2selector(src_ts
, dst_ts
);
2399 policy_id
->dir
= direction
;
2403 struct xfrm_mark
*mrk
;
2404 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_userpolicy_id
);
2406 rthdr
->rta_type
= XFRMA_MARK
;
2407 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
2409 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
2410 if (hdr
->nlmsg_len
> sizeof(request
))
2415 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
2416 mrk
->v
= mark
.value
;
2420 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
2423 while (NLMSG_OK(hdr
, len
))
2425 switch (hdr
->nlmsg_type
)
2427 case XFRM_MSG_NEWPOLICY
:
2429 policy
= (struct xfrm_userpolicy_info
*)NLMSG_DATA(hdr
);
2434 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
2435 DBG1(DBG_KNL
, "querying policy failed: %s (%d)",
2436 strerror(-err
->error
), -err
->error
);
2440 hdr
= NLMSG_NEXT(hdr
, len
);
2451 DBG2(DBG_KNL
, "unable to query policy %R === %R %N", src_ts
, dst_ts
,
2452 policy_dir_names
, direction
);
2457 if (policy
->curlft
.use_time
)
2459 /* we need the monotonic time, but the kernel returns system time. */
2460 *use_time
= time_monotonic(NULL
) - (time(NULL
) - policy
->curlft
.use_time
);
2471 METHOD(kernel_ipsec_t
, del_policy
, status_t
,
2472 private_kernel_netlink_ipsec_t
*this, traffic_selector_t
*src_ts
,
2473 traffic_selector_t
*dst_ts
, policy_dir_t direction
, u_int32_t reqid
,
2474 mark_t mark
, policy_priority_t prio
)
2476 policy_entry_t
*current
, policy
;
2477 enumerator_t
*enumerator
;
2478 policy_sa_t
*mapping
;
2479 netlink_buf_t request
;
2480 struct nlmsghdr
*hdr
;
2481 struct xfrm_userpolicy_id
*policy_id
;
2482 bool is_installed
= TRUE
;
2485 DBG2(DBG_KNL
, "deleting policy %R === %R %N (mark %u/0x%08x)",
2486 src_ts
, dst_ts
, policy_dir_names
, direction
,
2487 mark
.value
, mark
.mask
);
2489 /* create a policy */
2490 memset(&policy
, 0, sizeof(policy_entry_t
));
2491 policy
.sel
= ts2selector(src_ts
, dst_ts
);
2492 policy
.mark
= mark
.value
& mark
.mask
;
2493 policy
.direction
= direction
;
2495 /* find the policy */
2496 this->mutex
->lock(this->mutex
);
2497 current
= this->policies
->get(this->policies
, &policy
);
2502 DBG1(DBG_KNL
, "deleting policy %R === %R %N (mark %u/0x%08x) "
2503 "failed, not found", src_ts
, dst_ts
, policy_dir_names
,
2504 direction
, mark
.value
, mark
.mask
);
2508 DBG1(DBG_KNL
, "deleting policy %R === %R %N failed, not found",
2509 src_ts
, dst_ts
, policy_dir_names
, direction
);
2511 this->mutex
->unlock(this->mutex
);
2515 if (this->policy_history
)
2516 { /* remove mapping to SA by reqid and priority */
2517 priority
= get_priority(current
, prio
);
2518 enumerator
= current
->used_by
->create_enumerator(current
->used_by
);
2519 while (enumerator
->enumerate(enumerator
, (void**)&mapping
))
2521 if (reqid
== mapping
->sa
->cfg
.reqid
&&
2522 priority
== mapping
->priority
)
2524 current
->used_by
->remove_at(current
->used_by
, enumerator
);
2525 policy_sa_destroy(mapping
, &direction
, this);
2528 is_installed
= FALSE
;
2530 enumerator
->destroy(enumerator
);
2533 { /* remove one of the SAs but don't update the policy */
2534 current
->used_by
->remove_last(current
->used_by
, (void**)&mapping
);
2535 policy_sa_destroy(mapping
, &direction
, this);
2536 is_installed
= FALSE
;
2539 if (current
->used_by
->get_count(current
->used_by
) > 0)
2540 { /* policy is used by more SAs, keep in kernel */
2541 DBG2(DBG_KNL
, "policy still used by another CHILD_SA, not removed");
2543 { /* no need to update as the policy was not installed for this SA */
2544 this->mutex
->unlock(this->mutex
);
2548 DBG2(DBG_KNL
, "updating policy %R === %R %N (mark %u/0x%08x)",
2549 src_ts
, dst_ts
, policy_dir_names
, direction
,
2550 mark
.value
, mark
.mask
);
2552 current
->used_by
->get_first(current
->used_by
, (void**)&mapping
);
2553 if (add_policy_internal(this, current
, mapping
, TRUE
) != SUCCESS
)
2555 DBG1(DBG_KNL
, "unable to update policy %R === %R %N",
2556 src_ts
, dst_ts
, policy_dir_names
, direction
);
2562 memset(&request
, 0, sizeof(request
));
2564 hdr
= (struct nlmsghdr
*)request
;
2565 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2566 hdr
->nlmsg_type
= XFRM_MSG_DELPOLICY
;
2567 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
2569 policy_id
= (struct xfrm_userpolicy_id
*)NLMSG_DATA(hdr
);
2570 policy_id
->sel
= current
->sel
;
2571 policy_id
->dir
= direction
;
2575 struct xfrm_mark
*mrk
;
2576 struct rtattr
*rthdr
= XFRM_RTA(hdr
, struct xfrm_userpolicy_id
);
2578 rthdr
->rta_type
= XFRMA_MARK
;
2579 rthdr
->rta_len
= RTA_LENGTH(sizeof(struct xfrm_mark
));
2580 hdr
->nlmsg_len
+= RTA_ALIGN(rthdr
->rta_len
);
2581 if (hdr
->nlmsg_len
> sizeof(request
))
2583 this->mutex
->unlock(this->mutex
);
2587 mrk
= (struct xfrm_mark
*)RTA_DATA(rthdr
);
2588 mrk
->v
= mark
.value
;
2594 route_entry_t
*route
= current
->route
;
2595 if (hydra
->kernel_interface
->del_route(hydra
->kernel_interface
,
2596 route
->dst_net
, route
->prefixlen
, route
->gateway
,
2597 route
->src_ip
, route
->if_name
) != SUCCESS
)
2599 DBG1(DBG_KNL
, "error uninstalling route installed with "
2600 "policy %R === %R %N", src_ts
, dst_ts
,
2601 policy_dir_names
, direction
);
2605 this->policies
->remove(this->policies
, current
);
2606 policy_entry_destroy(this, current
);
2607 this->mutex
->unlock(this->mutex
);
2609 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
2613 DBG1(DBG_KNL
, "unable to delete policy %R === %R %N "
2614 "(mark %u/0x%08x)", src_ts
, dst_ts
, policy_dir_names
,
2615 direction
, mark
.value
, mark
.mask
);
2619 DBG1(DBG_KNL
, "unable to delete policy %R === %R %N",
2620 src_ts
, dst_ts
, policy_dir_names
, direction
);
2627 METHOD(kernel_ipsec_t
, flush_policies
, status_t
,
2628 private_kernel_netlink_ipsec_t
*this)
2630 netlink_buf_t request
;
2631 struct nlmsghdr
*hdr
;
2633 memset(&request
, 0, sizeof(request
));
2635 DBG2(DBG_KNL
, "flushing all policies from SPD");
2637 hdr
= (struct nlmsghdr
*)request
;
2638 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2639 hdr
->nlmsg_type
= XFRM_MSG_FLUSHPOLICY
;
2640 hdr
->nlmsg_len
= NLMSG_LENGTH(0); /* no data associated */
2642 /* by adding an rtattr of type XFRMA_POLICY_TYPE we could restrict this
2643 * to main or sub policies (default is main) */
2645 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
2647 DBG1(DBG_KNL
, "unable to flush SPD entries");
2654 METHOD(kernel_ipsec_t
, bypass_socket
, bool,
2655 private_kernel_netlink_ipsec_t
*this, int fd
, int family
)
2657 struct xfrm_userpolicy_info policy
;
2658 u_int sol
, ipsec_policy
;
2664 ipsec_policy
= IP_XFRM_POLICY
;
2668 ipsec_policy
= IPV6_XFRM_POLICY
;
2674 memset(&policy
, 0, sizeof(policy
));
2675 policy
.action
= XFRM_POLICY_ALLOW
;
2676 policy
.sel
.family
= family
;
2678 policy
.dir
= XFRM_POLICY_OUT
;
2679 if (setsockopt(fd
, sol
, ipsec_policy
, &policy
, sizeof(policy
)) < 0)
2681 DBG1(DBG_KNL
, "unable to set IPSEC_POLICY on socket: %s",
2685 policy
.dir
= XFRM_POLICY_IN
;
2686 if (setsockopt(fd
, sol
, ipsec_policy
, &policy
, sizeof(policy
)) < 0)
2688 DBG1(DBG_KNL
, "unable to set IPSEC_POLICY on socket: %s",
2695 METHOD(kernel_ipsec_t
, enable_udp_decap
, bool,
2696 private_kernel_netlink_ipsec_t
*this, int fd
, int family
, u_int16_t port
)
2698 int type
= UDP_ENCAP_ESPINUDP
;
2700 if (setsockopt(fd
, SOL_UDP
, UDP_ENCAP
, &type
, sizeof(type
)) < 0)
2702 DBG1(DBG_KNL
, "unable to set UDP_ENCAP: %s", strerror(errno
));
2708 METHOD(kernel_ipsec_t
, destroy
, void,
2709 private_kernel_netlink_ipsec_t
*this)
2711 enumerator_t
*enumerator
;
2712 policy_entry_t
*policy
;
2714 if (this->socket_xfrm_events
> 0)
2716 close(this->socket_xfrm_events
);
2718 DESTROY_IF(this->socket_xfrm
);
2719 enumerator
= this->policies
->create_enumerator(this->policies
);
2720 while (enumerator
->enumerate(enumerator
, &policy
, &policy
))
2722 policy_entry_destroy(this, policy
);
2724 enumerator
->destroy(enumerator
);
2725 this->policies
->destroy(this->policies
);
2726 this->sas
->destroy(this->sas
);
2727 this->mutex
->destroy(this->mutex
);
2732 * Described in header.
2734 kernel_netlink_ipsec_t
*kernel_netlink_ipsec_create()
2736 private_kernel_netlink_ipsec_t
*this;
2737 bool register_for_events
= TRUE
;
2743 .get_features
= _get_features
,
2744 .get_spi
= _get_spi
,
2745 .get_cpi
= _get_cpi
,
2747 .update_sa
= _update_sa
,
2748 .query_sa
= _query_sa
,
2750 .flush_sas
= _flush_sas
,
2751 .add_policy
= _add_policy
,
2752 .query_policy
= _query_policy
,
2753 .del_policy
= _del_policy
,
2754 .flush_policies
= _flush_policies
,
2755 .bypass_socket
= _bypass_socket
,
2756 .enable_udp_decap
= _enable_udp_decap
,
2757 .destroy
= _destroy
,
2760 .policies
= hashtable_create((hashtable_hash_t
)policy_hash
,
2761 (hashtable_equals_t
)policy_equals
, 32),
2762 .sas
= hashtable_create((hashtable_hash_t
)ipsec_sa_hash
,
2763 (hashtable_equals_t
)ipsec_sa_equals
, 32),
2764 .mutex
= mutex_create(MUTEX_TYPE_DEFAULT
),
2765 .policy_history
= TRUE
,
2766 .install_routes
= lib
->settings
->get_bool(lib
->settings
,
2767 "%s.install_routes", TRUE
, hydra
->daemon
),
2768 .replay_window
= lib
->settings
->get_int(lib
->settings
,
2769 "%s.replay_window", DEFAULT_REPLAY_WINDOW
, hydra
->daemon
),
2772 this->replay_bmp
= (this->replay_window
+ sizeof(u_int32_t
) * 8 - 1) /
2773 (sizeof(u_int32_t
) * 8);
2775 if (streq(hydra
->daemon
, "pluto"))
2776 { /* no routes for pluto, they are installed via updown script */
2777 this->install_routes
= FALSE
;
2778 /* no policy history for pluto */
2779 this->policy_history
= FALSE
;
2781 else if (streq(hydra
->daemon
, "starter"))
2782 { /* starter has no threads, so we do not register for kernel events */
2783 register_for_events
= FALSE
;
2786 /* disable lifetimes for allocated SPIs in kernel */
2787 fd
= open("/proc/sys/net/core/xfrm_acq_expires", O_WRONLY
);
2790 ignore_result(write(fd
, "165", 3));
2794 this->socket_xfrm
= netlink_socket_create(NETLINK_XFRM
);
2795 if (!this->socket_xfrm
)
2801 if (register_for_events
)
2803 struct sockaddr_nl addr
;
2805 memset(&addr
, 0, sizeof(addr
));
2806 addr
.nl_family
= AF_NETLINK
;
2808 /* create and bind XFRM socket for ACQUIRE, EXPIRE, MIGRATE & MAPPING */
2809 this->socket_xfrm_events
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_XFRM
);
2810 if (this->socket_xfrm_events
<= 0)
2812 DBG1(DBG_KNL
, "unable to create XFRM event socket");
2816 addr
.nl_groups
= XFRMNLGRP(ACQUIRE
) | XFRMNLGRP(EXPIRE
) |
2817 XFRMNLGRP(MIGRATE
) | XFRMNLGRP(MAPPING
);
2818 if (bind(this->socket_xfrm_events
, (struct sockaddr
*)&addr
, sizeof(addr
)))
2820 DBG1(DBG_KNL
, "unable to bind XFRM event socket");
2824 lib
->processor
->queue_job(lib
->processor
,
2825 (job_t
*)callback_job_create_with_prio(
2826 (callback_job_cb_t
)receive_events
, this, NULL
,
2827 (callback_job_cancel_t
)return_false
, JOB_PRIO_CRITICAL
));
2830 return &this->public;