2 * Copyright (C) 2006-2018 Tobias Brunner
3 * Copyright (C) 2005-2009 Martin Willi
4 * Copyright (C) 2008-2016 Andreas Steffen
5 * Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
6 * Copyright (C) 2006 Daniel Roethlisberger
7 * Copyright (C) 2005 Jan Hutter
8 * HSR Hochschule fuer Technik Rapperswil
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms of the GNU General Public License as published by the
12 * Free Software Foundation; either version 2 of the License, or (at your
13 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
17 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * Copyright (C) 2018 Mellanox Technologies.
23 * Permission is hereby granted, free of charge, to any person obtaining a copy
24 * of this software and associated documentation files (the "Software"), to deal
25 * in the Software without restriction, including without limitation the rights
26 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
27 * copies of the Software, and to permit persons to whom the Software is
28 * furnished to do so, subject to the following conditions:
30 * The above copyright notice and this permission notice shall be included in
31 * all copies or substantial portions of the Software.
33 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
34 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
35 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
36 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
37 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
38 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
43 #include <sys/types.h>
44 #include <sys/socket.h>
45 #include <sys/ioctl.h>
47 #include <linux/ipsec.h>
48 #include <linux/netlink.h>
49 #include <linux/rtnetlink.h>
50 #include <linux/xfrm.h>
51 #include <linux/udp.h>
52 #include <linux/ethtool.h>
53 #include <linux/sockios.h>
62 #include "kernel_netlink_ipsec.h"
63 #include "kernel_netlink_shared.h"
66 #include <utils/debug.h>
67 #include <threading/mutex.h>
68 #include <threading/condvar.h>
69 #include <collections/array.h>
70 #include <collections/hashtable.h>
71 #include <collections/linked_list.h>
73 /** Required for Linux 2.6.26 kernel and later */
74 #ifndef XFRM_STATE_AF_UNSPEC
75 #define XFRM_STATE_AF_UNSPEC 32
78 /** From linux/in.h */
79 #ifndef IP_XFRM_POLICY
80 #define IP_XFRM_POLICY 17
83 /** Missing on uclibc */
84 #ifndef IPV6_XFRM_POLICY
85 #define IPV6_XFRM_POLICY 34
86 #endif /*IPV6_XFRM_POLICY*/
88 /* from linux/udp.h */
93 #ifndef UDP_ENCAP_ESPINUDP
94 #define UDP_ENCAP_ESPINUDP 2
97 /* this is not defined on some platforms */
99 #define SOL_UDP IPPROTO_UDP
102 /** Base priority for installed policies */
103 #define PRIO_BASE 200000
106 * Map the limit for bytes and packets to XFRM_INF by default
108 #define XFRM_LIMIT(x) ((x) == 0 ? XFRM_INF : (x))
111 * Create ORable bitfield of XFRM NL groups
113 #define XFRMNLGRP(x) (1<<(XFRMNLGRP_##x-1))
116 * Returns a pointer to the first rtattr following the nlmsghdr *nlh and the
117 * 'usual' netlink data x like 'struct xfrm_usersa_info'
119 #define XFRM_RTA(nlh, x) ((struct rtattr*)(NLMSG_DATA(nlh) + \
120 NLMSG_ALIGN(sizeof(x))))
122 * Returns the total size of attached rta data
123 * (after 'usual' netlink data x like 'struct xfrm_usersa_info')
125 #define XFRM_PAYLOAD(nlh, x) NLMSG_PAYLOAD(nlh, sizeof(x))
127 typedef struct kernel_algorithm_t kernel_algorithm_t
;
130 * Mapping of IKEv2 kernel identifier to linux crypto API names
132 struct kernel_algorithm_t
{
134 * Identifier specified in IKEv2
139 * Name of the algorithm in linux crypto API
144 ENUM(xfrm_msg_names
, XFRM_MSG_NEWSA
, XFRM_MSG_MAPPING
,
148 "XFRM_MSG_NEWPOLICY",
149 "XFRM_MSG_DELPOLICY",
150 "XFRM_MSG_GETPOLICY",
154 "XFRM_MSG_UPDPOLICY",
156 "XFRM_MSG_POLEXPIRE",
158 "XFRM_MSG_FLUSHPOLICY",
163 "XFRM_MSG_NEWSADINFO",
164 "XFRM_MSG_GETSADINFO",
165 "XFRM_MSG_NEWSPDINFO",
166 "XFRM_MSG_GETSPDINFO",
170 ENUM(xfrm_attr_type_names
, XFRMA_UNSPEC
, XFRMA_OFFLOAD_DEV
,
182 "XFRMA_REPLAY_THRESH",
183 "XFRMA_ETIMER_THRESH",
191 "XFRMA_ALG_AUTH_TRUNC",
194 "XFRMA_REPLAY_ESN_VAL",
195 "XFRMA_SA_EXTRA_FLAGS",
197 "XFRMA_ADDRESS_FILTER",
203 * Algorithms for encryption
205 static kernel_algorithm_t encryption_algs
[] = {
206 /* {ENCR_DES_IV64, "***" }, */
208 {ENCR_3DES
, "des3_ede" },
209 /* {ENCR_RC5, "***" }, */
210 /* {ENCR_IDEA, "***" }, */
211 {ENCR_CAST
, "cast5" },
212 {ENCR_BLOWFISH
, "blowfish" },
213 /* {ENCR_3IDEA, "***" }, */
214 /* {ENCR_DES_IV32, "***" }, */
215 {ENCR_NULL
, "cipher_null" },
216 {ENCR_AES_CBC
, "aes" },
217 {ENCR_AES_CTR
, "rfc3686(ctr(aes))" },
218 {ENCR_AES_CCM_ICV8
, "rfc4309(ccm(aes))" },
219 {ENCR_AES_CCM_ICV12
, "rfc4309(ccm(aes))" },
220 {ENCR_AES_CCM_ICV16
, "rfc4309(ccm(aes))" },
221 {ENCR_AES_GCM_ICV8
, "rfc4106(gcm(aes))" },
222 {ENCR_AES_GCM_ICV12
, "rfc4106(gcm(aes))" },
223 {ENCR_AES_GCM_ICV16
, "rfc4106(gcm(aes))" },
224 {ENCR_NULL_AUTH_AES_GMAC
, "rfc4543(gcm(aes))" },
225 {ENCR_CAMELLIA_CBC
, "cbc(camellia)" },
226 /* {ENCR_CAMELLIA_CTR, "***" }, */
227 /* {ENCR_CAMELLIA_CCM_ICV8, "***" }, */
228 /* {ENCR_CAMELLIA_CCM_ICV12, "***" }, */
229 /* {ENCR_CAMELLIA_CCM_ICV16, "***" }, */
230 {ENCR_SERPENT_CBC
, "serpent" },
231 {ENCR_TWOFISH_CBC
, "twofish" },
232 {ENCR_CHACHA20_POLY1305
, "rfc7539esp(chacha20,poly1305)"},
236 * Algorithms for integrity protection
238 static kernel_algorithm_t integrity_algs
[] = {
239 {AUTH_HMAC_MD5_96
, "md5" },
240 {AUTH_HMAC_MD5_128
, "hmac(md5)" },
241 {AUTH_HMAC_SHA1_96
, "sha1" },
242 {AUTH_HMAC_SHA1_160
, "hmac(sha1)" },
243 {AUTH_HMAC_SHA2_256_96
, "sha256" },
244 {AUTH_HMAC_SHA2_256_128
, "hmac(sha256)" },
245 {AUTH_HMAC_SHA2_384_192
, "hmac(sha384)" },
246 {AUTH_HMAC_SHA2_512_256
, "hmac(sha512)" },
247 /* {AUTH_DES_MAC, "***" }, */
248 /* {AUTH_KPDK_MD5, "***" }, */
249 {AUTH_AES_XCBC_96
, "xcbc(aes)" },
250 {AUTH_AES_CMAC_96
, "cmac(aes)" },
254 * Algorithms for IPComp
256 static kernel_algorithm_t compression_algs
[] = {
257 /* {IPCOMP_OUI, "***" }, */
258 {IPCOMP_DEFLATE
, "deflate" },
259 {IPCOMP_LZS
, "lzs" },
260 {IPCOMP_LZJH
, "lzjh" },
264 * IPsec HW offload state in kernel
268 NL_OFFLOAD_UNSUPPORTED
,
270 } nl_offload_state_t
;
273 * Global metadata used for IPsec HW offload
276 /** bit in feature set */
278 /** total number of device feature blocks */
280 /** determined HW offload state */
281 nl_offload_state_t state
;
282 } netlink_hw_offload
;
285 * Look up a kernel algorithm name and its key size
287 static const char* lookup_algorithm(transform_type_t type
, int ikev2
)
289 kernel_algorithm_t
*list
;
295 case ENCRYPTION_ALGORITHM
:
296 list
= encryption_algs
;
297 count
= countof(encryption_algs
);
299 case INTEGRITY_ALGORITHM
:
300 list
= integrity_algs
;
301 count
= countof(integrity_algs
);
303 case COMPRESSION_ALGORITHM
:
304 list
= compression_algs
;
305 count
= countof(compression_algs
);
310 for (i
= 0; i
< count
; i
++)
312 if (list
[i
].ikev2
== ikev2
)
317 if (charon
->kernel
->lookup_algorithm(charon
->kernel
, ikev2
, type
, NULL
,
325 typedef struct private_kernel_netlink_ipsec_t private_kernel_netlink_ipsec_t
;
328 * Private variables and functions of kernel_netlink class.
330 struct private_kernel_netlink_ipsec_t
{
332 * Public part of the kernel_netlink_t object
334 kernel_netlink_ipsec_t
public;
337 * Mutex to lock access to installed policies
342 * Condvar to synchronize access to individual policies
347 * Hash table of installed policies (policy_entry_t)
349 hashtable_t
*policies
;
352 * Hash table of IPsec SAs using policies (ipsec_sa_t)
357 * Netlink xfrm socket (IPsec)
359 netlink_socket_t
*socket_xfrm
;
362 * Netlink xfrm socket to receive acquire and expire events
364 int socket_xfrm_events
;
367 * Whether to install routes along policies
372 * Whether to set protocol and ports on selector installed with transport
375 bool proto_port_transport
;
378 * Whether to always use UPDATE to install policies
383 * Installed port based IKE bypass policies, as bypass_t
388 * Custom priority calculation function
390 uint32_t (*get_priority
)(kernel_ipsec_policy_id_t
*id
,
391 kernel_ipsec_manage_policy_t
*data
);
394 typedef struct route_entry_t route_entry_t
;
397 * Installed routing entry
399 struct route_entry_t
{
400 /** Name of the interface the route is bound to */
403 /** Source ip of the route */
406 /** Gateway for this route */
409 /** Destination net */
412 /** Destination net prefixlen */
417 * Destroy a route_entry_t object
419 static void route_entry_destroy(route_entry_t
*this)
422 this->src_ip
->destroy(this->src_ip
);
423 DESTROY_IF(this->gateway
);
424 chunk_free(&this->dst_net
);
429 * Compare two route_entry_t objects
431 static bool route_entry_equals(route_entry_t
*a
, route_entry_t
*b
)
433 return a
->if_name
&& b
->if_name
&& streq(a
->if_name
, b
->if_name
) &&
434 a
->src_ip
->ip_equals(a
->src_ip
, b
->src_ip
) &&
435 a
->gateway
->ip_equals(a
->gateway
, b
->gateway
) &&
436 chunk_equals(a
->dst_net
, b
->dst_net
) && a
->prefixlen
== b
->prefixlen
;
439 typedef struct ipsec_sa_t ipsec_sa_t
;
442 * IPsec SA assigned to a policy.
445 /** Source address of this SA */
448 /** Destination address of this SA */
454 /** Description of this SA */
457 /** Reference count for this SA */
462 * Hash function for ipsec_sa_t objects
464 static u_int
ipsec_sa_hash(ipsec_sa_t
*sa
)
466 return chunk_hash_inc(sa
->src
->get_address(sa
->src
),
467 chunk_hash_inc(sa
->dst
->get_address(sa
->dst
),
468 chunk_hash_inc(chunk_from_thing(sa
->mark
),
469 chunk_hash(chunk_from_thing(sa
->cfg
)))));
473 * Equality function for ipsec_sa_t objects
475 static bool ipsec_sa_equals(ipsec_sa_t
*sa
, ipsec_sa_t
*other_sa
)
477 return sa
->src
->ip_equals(sa
->src
, other_sa
->src
) &&
478 sa
->dst
->ip_equals(sa
->dst
, other_sa
->dst
) &&
479 sa
->mark
.value
== other_sa
->mark
.value
&&
480 sa
->mark
.mask
== other_sa
->mark
.mask
&&
481 ipsec_sa_cfg_equals(&sa
->cfg
, &other_sa
->cfg
);
485 * Allocate or reference an IPsec SA object
487 static ipsec_sa_t
*ipsec_sa_create(private_kernel_netlink_ipsec_t
*this,
488 host_t
*src
, host_t
*dst
, mark_t mark
,
491 ipsec_sa_t
*sa
, *found
;
498 found
= this->sas
->get(this->sas
, sa
);
501 sa
->src
= src
->clone(src
);
502 sa
->dst
= dst
->clone(dst
);
503 this->sas
->put(this->sas
, sa
, sa
);
510 ref_get(&sa
->refcount
);
515 * Release and destroy an IPsec SA object
517 static void ipsec_sa_destroy(private_kernel_netlink_ipsec_t
*this,
520 if (ref_put(&sa
->refcount
))
522 this->sas
->remove(this->sas
, sa
);
529 typedef struct policy_sa_t policy_sa_t
;
530 typedef struct policy_sa_out_t policy_sa_out_t
;
533 * Mapping between a policy and an IPsec SA.
536 /** Priority assigned to the policy when installed with this SA */
539 /** Automatic priority assigned to the policy when installed with this SA */
540 uint32_t auto_priority
;
542 /** Type of the policy */
550 * For outbound policies we also cache the traffic selectors in order to install
553 struct policy_sa_out_t
{
554 /** Generic interface */
557 /** Source traffic selector of this policy */
558 traffic_selector_t
*src_ts
;
560 /** Destination traffic selector of this policy */
561 traffic_selector_t
*dst_ts
;
565 * Create a policy_sa(_in)_t object
567 static policy_sa_t
*policy_sa_create(private_kernel_netlink_ipsec_t
*this,
568 policy_dir_t dir
, policy_type_t type
, host_t
*src
, host_t
*dst
,
569 traffic_selector_t
*src_ts
, traffic_selector_t
*dst_ts
, mark_t mark
,
574 if (dir
== POLICY_OUT
)
576 policy_sa_out_t
*out
;
578 .src_ts
= src_ts
->clone(src_ts
),
579 .dst_ts
= dst_ts
->clone(dst_ts
),
581 policy
= &out
->generic
;
585 INIT(policy
, .priority
= 0);
588 policy
->sa
= ipsec_sa_create(this, src
, dst
, mark
, cfg
);
593 * Destroy a policy_sa(_in)_t object
595 static void policy_sa_destroy(policy_sa_t
*policy
, policy_dir_t dir
,
596 private_kernel_netlink_ipsec_t
*this)
598 if (dir
== POLICY_OUT
)
600 policy_sa_out_t
*out
= (policy_sa_out_t
*)policy
;
601 out
->src_ts
->destroy(out
->src_ts
);
602 out
->dst_ts
->destroy(out
->dst_ts
);
604 ipsec_sa_destroy(this, policy
->sa
);
608 CALLBACK(policy_sa_destroy_cb
, void,
609 policy_sa_t
*policy
, va_list args
)
611 private_kernel_netlink_ipsec_t
*this;
614 VA_ARGS_VGET(args
, dir
, this);
615 policy_sa_destroy(policy
, dir
, this);
618 typedef struct policy_entry_t policy_entry_t
;
621 * Installed kernel policy.
623 struct policy_entry_t
{
625 /** Direction of this policy: in, out, forward */
628 /** Parameters of installed policy */
629 struct xfrm_selector sel
;
634 /** Associated route installed for this policy */
635 route_entry_t
*route
;
637 /** List of SAs this policy is used by, ordered by priority */
638 linked_list_t
*used_by
;
640 /** reqid for this policy */
643 /** Number of threads waiting to work on this policy */
646 /** TRUE if a thread is working on this policy */
651 * Destroy a policy_entry_t object
653 static void policy_entry_destroy(private_kernel_netlink_ipsec_t
*this,
654 policy_entry_t
*policy
)
658 route_entry_destroy(policy
->route
);
662 policy
->used_by
->invoke_function(policy
->used_by
, policy_sa_destroy_cb
,
663 policy
->direction
, this);
664 policy
->used_by
->destroy(policy
->used_by
);
670 * Hash function for policy_entry_t objects
672 static u_int
policy_hash(policy_entry_t
*key
)
674 chunk_t chunk
= chunk_from_thing(key
->sel
);
675 return chunk_hash_inc(chunk
, chunk_hash(chunk_from_thing(key
->mark
)));
679 * Equality function for policy_entry_t objects
681 static bool policy_equals(policy_entry_t
*key
, policy_entry_t
*other_key
)
683 return memeq(&key
->sel
, &other_key
->sel
, sizeof(struct xfrm_selector
)) &&
684 key
->mark
== other_key
->mark
&&
685 key
->direction
== other_key
->direction
;
689 * Determine number of set bits in 16 bit port mask
691 static inline uint32_t port_mask_bits(uint16_t port_mask
)
694 uint16_t bit_mask
= 0x8000;
696 port_mask
= ntohs(port_mask
);
698 for (bits
= 0; bits
< 16; bits
++)
700 if (!(port_mask
& bit_mask
))
710 * Calculate the priority of a policy
712 * bits 0-0: separate trap and regular policies (0..1) 1 bit
713 * bits 1-1: restriction to network interface (0..1) 1 bit
714 * bits 2-7: src + dst port mask bits (2 * 0..16) 6 bits
715 * bits 8-8: restriction to protocol (0..1) 1 bit
716 * bits 9-17: src + dst network mask bits (2 * 0..128) 9 bits
719 * smallest value: 000000000 0 000000 0 0: 0, lowest priority = 200'000
720 * largest value : 100000000 1 100000 1 1: 131'459, highst priority = 68'541
722 static uint32_t get_priority(policy_entry_t
*policy
, policy_priority_t prio
,
725 uint32_t priority
= PRIO_BASE
, sport_mask_bits
, dport_mask_bits
;
729 case POLICY_PRIORITY_FALLBACK
:
730 priority
+= PRIO_BASE
;
731 /* fall-through to next case */
732 case POLICY_PRIORITY_ROUTED
:
733 case POLICY_PRIORITY_DEFAULT
:
734 priority
+= PRIO_BASE
;
735 /* fall-through to next case */
736 case POLICY_PRIORITY_PASS
:
739 sport_mask_bits
= port_mask_bits(policy
->sel
.sport_mask
);
740 dport_mask_bits
= port_mask_bits(policy
->sel
.dport_mask
);
742 /* calculate priority */
743 priority
-= (policy
->sel
.prefixlen_s
+ policy
->sel
.prefixlen_d
) * 512;
744 priority
-= policy
->sel
.proto
? 256 : 0;
745 priority
-= (sport_mask_bits
+ dport_mask_bits
) * 4;
746 priority
-= (interface
!= NULL
) * 2;
747 priority
-= (prio
!= POLICY_PRIORITY_ROUTED
);
753 * Convert the general ipsec mode to the one defined in xfrm.h
755 static uint8_t mode2kernel(ipsec_mode_t mode
)
760 return XFRM_MODE_TRANSPORT
;
762 return XFRM_MODE_TUNNEL
;
764 return XFRM_MODE_BEET
;
771 * Convert a host_t to a struct xfrm_address
773 static void host2xfrm(host_t
*host
, xfrm_address_t
*xfrm
)
775 chunk_t chunk
= host
->get_address(host
);
776 memcpy(xfrm
, chunk
.ptr
, min(chunk
.len
, sizeof(xfrm_address_t
)));
780 * Convert a struct xfrm_address to a host_t
782 static host_t
* xfrm2host(int family
, xfrm_address_t
*xfrm
, uint16_t port
)
789 chunk
= chunk_create((u_char
*)&xfrm
->a4
, sizeof(xfrm
->a4
));
792 chunk
= chunk_create((u_char
*)&xfrm
->a6
, sizeof(xfrm
->a6
));
797 return host_create_from_chunk(family
, chunk
, ntohs(port
));
801 * Convert a traffic selector address range to subnet and its mask.
803 static void ts2subnet(traffic_selector_t
* ts
,
804 xfrm_address_t
*net
, uint8_t *mask
)
809 ts
->to_subnet(ts
, &net_host
, mask
);
810 net_chunk
= net_host
->get_address(net_host
);
811 memcpy(net
, net_chunk
.ptr
, net_chunk
.len
);
812 net_host
->destroy(net_host
);
816 * Convert a traffic selector port range to port/portmask
818 static void ts2ports(traffic_selector_t
* ts
,
819 uint16_t *port
, uint16_t *mask
)
821 uint16_t from
, to
, bitmask
;
824 from
= ts
->get_from_port(ts
);
825 to
= ts
->get_to_port(ts
);
827 /* Quick check for a single port */
835 /* Compute the port mask for port ranges */
838 for (bit
= 15; bit
>= 0; bit
--)
842 if ((bitmask
& from
) != (bitmask
& to
))
844 *port
= htons(from
& *mask
);
845 *mask
= htons(*mask
);
855 * Convert a pair of traffic_selectors to an xfrm_selector
857 static struct xfrm_selector
ts2selector(traffic_selector_t
*src
,
858 traffic_selector_t
*dst
,
861 struct xfrm_selector sel
;
864 memset(&sel
, 0, sizeof(sel
));
865 sel
.family
= (src
->get_type(src
) == TS_IPV4_ADDR_RANGE
) ? AF_INET
: AF_INET6
;
866 /* src or dest proto may be "any" (0), use more restrictive one */
867 sel
.proto
= max(src
->get_protocol(src
), dst
->get_protocol(dst
));
868 ts2subnet(dst
, &sel
.daddr
, &sel
.prefixlen_d
);
869 ts2subnet(src
, &sel
.saddr
, &sel
.prefixlen_s
);
870 ts2ports(dst
, &sel
.dport
, &sel
.dport_mask
);
871 ts2ports(src
, &sel
.sport
, &sel
.sport_mask
);
872 if ((sel
.proto
== IPPROTO_ICMP
|| sel
.proto
== IPPROTO_ICMPV6
) &&
873 (sel
.dport
|| sel
.sport
))
875 /* the kernel expects the ICMP type and code in the source and
876 * destination port fields, respectively. */
877 port
= ntohs(max(sel
.dport
, sel
.sport
));
878 sel
.sport
= htons(traffic_selector_icmp_type(port
));
879 sel
.sport_mask
= sel
.sport
? ~0 : 0;
880 sel
.dport
= htons(traffic_selector_icmp_code(port
));
881 sel
.dport_mask
= sel
.dport
? ~0 : 0;
883 sel
.ifindex
= interface
? if_nametoindex(interface
) : 0;
890 * Convert an xfrm_selector to a src|dst traffic_selector
892 static traffic_selector_t
* selector2ts(struct xfrm_selector
*sel
, bool src
)
901 addr
= (u_char
*)&sel
->saddr
;
902 prefixlen
= sel
->prefixlen_s
;
905 port
= ntohs(sel
->sport
);
910 addr
= (u_char
*)&sel
->daddr
;
911 prefixlen
= sel
->prefixlen_d
;
914 port
= ntohs(sel
->dport
);
917 if (sel
->proto
== IPPROTO_ICMP
|| sel
->proto
== IPPROTO_ICMPV6
)
918 { /* convert ICMP[v6] message type and code as supplied by the kernel in
919 * source and destination ports (both in network order) */
920 port
= (sel
->sport
>> 8) | (sel
->dport
& 0xff00);
923 /* The Linux 2.6 kernel does not set the selector's family field,
924 * so as a kludge we additionally test the prefix length.
926 if (sel
->family
== AF_INET
|| sel
->prefixlen_s
== 32)
928 host
= host_create_from_chunk(AF_INET
, chunk_create(addr
, 4), 0);
930 else if (sel
->family
== AF_INET6
|| sel
->prefixlen_s
== 128)
932 host
= host_create_from_chunk(AF_INET6
, chunk_create(addr
, 16), 0);
937 return traffic_selector_create_from_subnet(host
, prefixlen
,
938 sel
->proto
, port
, port
?: 65535);
944 * Process a XFRM_MSG_ACQUIRE from kernel
946 static void process_acquire(private_kernel_netlink_ipsec_t
*this,
947 struct nlmsghdr
*hdr
)
949 struct xfrm_user_acquire
*acquire
;
952 traffic_selector_t
*src_ts
, *dst_ts
;
956 acquire
= NLMSG_DATA(hdr
);
957 rta
= XFRM_RTA(hdr
, struct xfrm_user_acquire
);
958 rtasize
= XFRM_PAYLOAD(hdr
, struct xfrm_user_acquire
);
960 DBG2(DBG_KNL
, "received a XFRM_MSG_ACQUIRE");
962 while (RTA_OK(rta
, rtasize
))
964 DBG2(DBG_KNL
, " %N", xfrm_attr_type_names
, rta
->rta_type
);
966 if (rta
->rta_type
== XFRMA_TMPL
)
968 struct xfrm_user_tmpl
* tmpl
;
969 tmpl
= (struct xfrm_user_tmpl
*)RTA_DATA(rta
);
971 proto
= tmpl
->id
.proto
;
973 rta
= RTA_NEXT(rta
, rtasize
);
982 /* acquire for AH/ESP only, not for IPCOMP */
985 src_ts
= selector2ts(&acquire
->sel
, TRUE
);
986 dst_ts
= selector2ts(&acquire
->sel
, FALSE
);
988 charon
->kernel
->acquire(charon
->kernel
, reqid
, src_ts
, dst_ts
);
992 * Process a XFRM_MSG_EXPIRE from kernel
994 static void process_expire(private_kernel_netlink_ipsec_t
*this,
995 struct nlmsghdr
*hdr
)
997 struct xfrm_user_expire
*expire
;
1002 expire
= NLMSG_DATA(hdr
);
1003 protocol
= expire
->state
.id
.proto
;
1004 spi
= expire
->state
.id
.spi
;
1006 DBG2(DBG_KNL
, "received a XFRM_MSG_EXPIRE");
1008 if (protocol
== IPPROTO_ESP
|| protocol
== IPPROTO_AH
)
1010 dst
= xfrm2host(expire
->state
.family
, &expire
->state
.id
.daddr
, 0);
1013 charon
->kernel
->expire(charon
->kernel
, protocol
, spi
, dst
,
1021 * Process a XFRM_MSG_MIGRATE from kernel
1023 static void process_migrate(private_kernel_netlink_ipsec_t
*this,
1024 struct nlmsghdr
*hdr
)
1026 struct xfrm_userpolicy_id
*policy_id
;
1029 traffic_selector_t
*src_ts
, *dst_ts
;
1030 host_t
*local
= NULL
, *remote
= NULL
;
1031 host_t
*old_src
= NULL
, *old_dst
= NULL
;
1032 host_t
*new_src
= NULL
, *new_dst
= NULL
;
1036 policy_id
= NLMSG_DATA(hdr
);
1037 rta
= XFRM_RTA(hdr
, struct xfrm_userpolicy_id
);
1038 rtasize
= XFRM_PAYLOAD(hdr
, struct xfrm_userpolicy_id
);
1040 DBG2(DBG_KNL
, "received a XFRM_MSG_MIGRATE");
1042 src_ts
= selector2ts(&policy_id
->sel
, TRUE
);
1043 dst_ts
= selector2ts(&policy_id
->sel
, FALSE
);
1044 dir
= (policy_dir_t
)policy_id
->dir
;
1046 DBG2(DBG_KNL
, " policy: %R === %R %N", src_ts
, dst_ts
, policy_dir_names
);
1048 while (RTA_OK(rta
, rtasize
))
1050 DBG2(DBG_KNL
, " %N", xfrm_attr_type_names
, rta
->rta_type
);
1051 if (rta
->rta_type
== XFRMA_KMADDRESS
)
1053 struct xfrm_user_kmaddress
*kmaddress
;
1055 kmaddress
= (struct xfrm_user_kmaddress
*)RTA_DATA(rta
);
1056 local
= xfrm2host(kmaddress
->family
, &kmaddress
->local
, 0);
1057 remote
= xfrm2host(kmaddress
->family
, &kmaddress
->remote
, 0);
1058 DBG2(DBG_KNL
, " kmaddress: %H...%H", local
, remote
);
1060 else if (rta
->rta_type
== XFRMA_MIGRATE
)
1062 struct xfrm_user_migrate
*migrate
;
1064 migrate
= (struct xfrm_user_migrate
*)RTA_DATA(rta
);
1065 old_src
= xfrm2host(migrate
->old_family
, &migrate
->old_saddr
, 0);
1066 old_dst
= xfrm2host(migrate
->old_family
, &migrate
->old_daddr
, 0);
1067 new_src
= xfrm2host(migrate
->new_family
, &migrate
->new_saddr
, 0);
1068 new_dst
= xfrm2host(migrate
->new_family
, &migrate
->new_daddr
, 0);
1069 reqid
= migrate
->reqid
;
1070 DBG2(DBG_KNL
, " migrate %H...%H to %H...%H, reqid {%u}",
1071 old_src
, old_dst
, new_src
, new_dst
, reqid
);
1072 DESTROY_IF(old_src
);
1073 DESTROY_IF(old_dst
);
1074 DESTROY_IF(new_src
);
1075 DESTROY_IF(new_dst
);
1077 rta
= RTA_NEXT(rta
, rtasize
);
1080 if (src_ts
&& dst_ts
&& local
&& remote
)
1082 charon
->kernel
->migrate(charon
->kernel
, reqid
, src_ts
, dst_ts
, dir
,
1095 * Process a XFRM_MSG_MAPPING from kernel
1097 static void process_mapping(private_kernel_netlink_ipsec_t
*this,
1098 struct nlmsghdr
*hdr
)
1100 struct xfrm_user_mapping
*mapping
;
1103 mapping
= NLMSG_DATA(hdr
);
1104 spi
= mapping
->id
.spi
;
1106 DBG2(DBG_KNL
, "received a XFRM_MSG_MAPPING");
1108 if (mapping
->id
.proto
== IPPROTO_ESP
)
1112 dst
= xfrm2host(mapping
->id
.family
, &mapping
->id
.daddr
, 0);
1115 new = xfrm2host(mapping
->id
.family
, &mapping
->new_saddr
,
1116 mapping
->new_sport
);
1119 charon
->kernel
->mapping(charon
->kernel
, IPPROTO_ESP
, spi
, dst
,
1129 * Receives events from kernel
1131 static bool receive_events(private_kernel_netlink_ipsec_t
*this, int fd
,
1132 watcher_event_t event
)
1134 char response
[netlink_get_buflen()];
1135 struct nlmsghdr
*hdr
= (struct nlmsghdr
*)response
;
1136 struct sockaddr_nl addr
;
1137 socklen_t addr_len
= sizeof(addr
);
1140 len
= recvfrom(this->socket_xfrm_events
, response
, sizeof(response
),
1141 MSG_DONTWAIT
, (struct sockaddr
*)&addr
, &addr_len
);
1147 /* interrupted, try again */
1150 /* no data ready, select again */
1153 DBG1(DBG_KNL
, "unable to receive from XFRM event socket: %s "
1154 "(%d)", strerror(errno
), errno
);
1160 if (addr
.nl_pid
!= 0)
1161 { /* not from kernel. not interested, try another one */
1165 while (NLMSG_OK(hdr
, len
))
1167 switch (hdr
->nlmsg_type
)
1169 case XFRM_MSG_ACQUIRE
:
1170 process_acquire(this, hdr
);
1172 case XFRM_MSG_EXPIRE
:
1173 process_expire(this, hdr
);
1175 case XFRM_MSG_MIGRATE
:
1176 process_migrate(this, hdr
);
1178 case XFRM_MSG_MAPPING
:
1179 process_mapping(this, hdr
);
1182 DBG1(DBG_KNL
, "received unknown event from XFRM event "
1183 "socket: %d", hdr
->nlmsg_type
);
1186 hdr
= NLMSG_NEXT(hdr
, len
);
1191 METHOD(kernel_ipsec_t
, get_features
, kernel_feature_t
,
1192 private_kernel_netlink_ipsec_t
*this)
1194 return KERNEL_ESP_V3_TFC
| KERNEL_POLICY_SPI
;
1198 * Get an SPI for a specific protocol from the kernel.
1200 static status_t
get_spi_internal(private_kernel_netlink_ipsec_t
*this,
1201 host_t
*src
, host_t
*dst
, uint8_t proto
, uint32_t min
, uint32_t max
,
1204 netlink_buf_t request
;
1205 struct nlmsghdr
*hdr
, *out
;
1206 struct xfrm_userspi_info
*userspi
;
1207 uint32_t received_spi
= 0;
1210 memset(&request
, 0, sizeof(request
));
1213 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1214 hdr
->nlmsg_type
= XFRM_MSG_ALLOCSPI
;
1215 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userspi_info
));
1217 userspi
= NLMSG_DATA(hdr
);
1218 host2xfrm(src
, &userspi
->info
.saddr
);
1219 host2xfrm(dst
, &userspi
->info
.id
.daddr
);
1220 userspi
->info
.id
.proto
= proto
;
1221 userspi
->info
.mode
= XFRM_MODE_TUNNEL
;
1222 userspi
->info
.family
= src
->get_family(src
);
1226 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
1229 while (NLMSG_OK(hdr
, len
))
1231 switch (hdr
->nlmsg_type
)
1233 case XFRM_MSG_NEWSA
:
1235 struct xfrm_usersa_info
* usersa
= NLMSG_DATA(hdr
);
1236 received_spi
= usersa
->id
.spi
;
1241 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
1242 DBG1(DBG_KNL
, "allocating SPI failed: %s (%d)",
1243 strerror(-err
->error
), -err
->error
);
1247 hdr
= NLMSG_NEXT(hdr
, len
);
1257 if (received_spi
== 0)
1262 *spi
= received_spi
;
1266 METHOD(kernel_ipsec_t
, get_spi
, status_t
,
1267 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
1268 uint8_t protocol
, uint32_t *spi
)
1270 uint32_t spi_min
, spi_max
;
1272 spi_min
= lib
->settings
->get_int(lib
->settings
, "%s.spi_min",
1273 KERNEL_SPI_MIN
, lib
->ns
);
1274 spi_max
= lib
->settings
->get_int(lib
->settings
, "%s.spi_max",
1275 KERNEL_SPI_MAX
, lib
->ns
);
1277 if (get_spi_internal(this, src
, dst
, protocol
, min(spi_min
, spi_max
),
1278 max(spi_min
, spi_max
), spi
) != SUCCESS
)
1280 DBG1(DBG_KNL
, "unable to get SPI");
1284 DBG2(DBG_KNL
, "got SPI %.8x", ntohl(*spi
));
1288 METHOD(kernel_ipsec_t
, get_cpi
, status_t
,
1289 private_kernel_netlink_ipsec_t
*this, host_t
*src
, host_t
*dst
,
1292 uint32_t received_spi
= 0;
1294 if (get_spi_internal(this, src
, dst
, IPPROTO_COMP
,
1295 0x100, 0xEFFF, &received_spi
) != SUCCESS
)
1297 DBG1(DBG_KNL
, "unable to get CPI");
1301 *cpi
= htons((uint16_t)ntohl(received_spi
));
1303 DBG2(DBG_KNL
, "got CPI %.4x", ntohs(*cpi
));
1308 * Format the mark for debug messages
1310 static void format_mark(char *buf
, int buflen
, mark_t mark
)
1312 if (mark
.value
| mark
.mask
)
1314 snprintf(buf
, buflen
, " (mark %u/0x%08x)", mark
.value
, mark
.mask
);
1319 * Add a XFRM mark to message if required
1321 static bool add_mark(struct nlmsghdr
*hdr
, int buflen
, mark_t mark
)
1323 if (mark
.value
| mark
.mask
)
1325 struct xfrm_mark
*xmrk
;
1327 xmrk
= netlink_reserve(hdr
, buflen
, XFRMA_MARK
, sizeof(*xmrk
));
1332 xmrk
->v
= mark
.value
;
1333 xmrk
->m
= mark
.mask
;
1339 * Check if kernel supports HW offload
1341 static void netlink_find_offload_feature(const char *ifname
, int query_socket
)
1343 struct ethtool_sset_info
*sset_info
;
1344 struct ethtool_gstrings
*cmd
= NULL
;
1346 uint32_t sset_len
, i
;
1350 netlink_hw_offload
.state
= NL_OFFLOAD_UNSUPPORTED
;
1352 /* determine number of device features */
1353 INIT_EXTRA(sset_info
, sizeof(uint32_t),
1354 .cmd
= ETHTOOL_GSSET_INFO
,
1355 .sset_mask
= 1ULL << ETH_SS_FEATURES
,
1357 strncpy(ifr
.ifr_name
, ifname
, IFNAMSIZ
);
1358 ifr
.ifr_name
[IFNAMSIZ
-1] = '\0';
1359 ifr
.ifr_data
= (void*)sset_info
;
1361 err
= ioctl(query_socket
, SIOCETHTOOL
, &ifr
);
1362 if (err
|| sset_info
->sset_mask
!= 1ULL << ETH_SS_FEATURES
)
1366 sset_len
= sset_info
->data
[0];
1368 /* retrieve names of device features */
1369 INIT_EXTRA(cmd
, ETH_GSTRING_LEN
* sset_len
,
1370 .cmd
= ETHTOOL_GSTRINGS
,
1371 .string_set
= ETH_SS_FEATURES
,
1373 strncpy(ifr
.ifr_name
, ifname
, IFNAMSIZ
);
1374 ifr
.ifr_name
[IFNAMSIZ
-1] = '\0';
1375 ifr
.ifr_data
= (void*)cmd
;
1377 err
= ioctl(query_socket
, SIOCETHTOOL
, &ifr
);
1383 /* look for the ESP_HW feature bit */
1384 str
= (char*)cmd
->data
;
1385 for (i
= 0; i
< cmd
->len
; i
++)
1387 if (strneq(str
, "esp-hw-offload", ETH_GSTRING_LEN
))
1389 netlink_hw_offload
.bit
= i
;
1390 netlink_hw_offload
.total_blocks
= (sset_len
+ 31) / 32;
1391 netlink_hw_offload
.state
= NL_OFFLOAD_SUPPORTED
;
1394 str
+= ETH_GSTRING_LEN
;
1403 * Check if interface supported HW offload
1405 static bool netlink_detect_offload(const char *ifname
)
1407 struct ethtool_gfeatures
*cmd
;
1408 uint32_t feature_bit
;
1414 query_socket
= socket(AF_NETLINK
, SOCK_DGRAM
, NETLINK_XFRM
);
1415 if (query_socket
< 0)
1420 /* kernel requires a real interface in order to query the kernel-wide
1421 * capability, so we do it here on first invocation.
1423 if (netlink_hw_offload
.state
== NL_OFFLOAD_UNKNOWN
)
1425 netlink_find_offload_feature(ifname
, query_socket
);
1427 if (netlink_hw_offload
.state
== NL_OFFLOAD_UNSUPPORTED
)
1429 DBG1(DBG_KNL
, "HW offload is not supported by kernel");
1433 /* feature is supported by kernel, query device features */
1434 INIT_EXTRA(cmd
, sizeof(cmd
->features
[0]) * netlink_hw_offload
.total_blocks
,
1435 .cmd
= ETHTOOL_GFEATURES
,
1436 .size
= netlink_hw_offload
.total_blocks
,
1438 strncpy(ifr
.ifr_name
, ifname
, IFNAMSIZ
);
1439 ifr
.ifr_name
[IFNAMSIZ
-1] = '\0';
1440 ifr
.ifr_data
= (void*)cmd
;
1442 if (ioctl(query_socket
, SIOCETHTOOL
, &ifr
))
1447 block
= netlink_hw_offload
.bit
/ 32;
1448 feature_bit
= 1U << (netlink_hw_offload
.bit
% 32);
1449 if (cmd
->features
[block
].active
& feature_bit
)
1458 DBG1(DBG_KNL
, "HW offload is not supported by device");
1461 close(query_socket
);
1466 * There are 3 HW offload configuration values:
1467 * 1. HW_OFFLOAD_NO : Do not configure HW offload.
1468 * 2. HW_OFFLOAD_YES : Configure HW offload.
1469 * Fail SA addition if offload is not supported.
1470 * 3. HW_OFFLOAD_AUTO : Configure HW offload if supported by the kernel
1472 * Do not fail SA addition otherwise.
1474 static bool config_hw_offload(kernel_ipsec_sa_id_t
*id
,
1475 kernel_ipsec_add_sa_t
*data
, struct nlmsghdr
*hdr
,
1478 host_t
*local
= data
->inbound
? id
->dst
: id
->src
;
1479 struct xfrm_user_offload
*offload
;
1480 bool hw_offload_yes
, ret
= FALSE
;
1483 /* do Ipsec configuration without offload */
1484 if (data
->hw_offload
== HW_OFFLOAD_NO
)
1489 hw_offload_yes
= (data
->hw_offload
== HW_OFFLOAD_YES
);
1491 if (!charon
->kernel
->get_interface(charon
->kernel
, local
, &ifname
))
1493 return !hw_offload_yes
;
1496 /* check if interface supports hw_offload */
1497 if (!netlink_detect_offload(ifname
))
1499 ret
= !hw_offload_yes
;
1503 /* activate HW offload */
1504 offload
= netlink_reserve(hdr
, buflen
,
1505 XFRMA_OFFLOAD_DEV
, sizeof(*offload
));
1508 ret
= !hw_offload_yes
;
1511 offload
->ifindex
= if_nametoindex(ifname
);
1512 if (local
->get_family(local
) == AF_INET6
)
1514 offload
->flags
|= XFRM_OFFLOAD_IPV6
;
1516 offload
->flags
|= data
->inbound
? XFRM_OFFLOAD_INBOUND
: 0;
1525 METHOD(kernel_ipsec_t
, add_sa
, status_t
,
1526 private_kernel_netlink_ipsec_t
*this, kernel_ipsec_sa_id_t
*id
,
1527 kernel_ipsec_add_sa_t
*data
)
1529 netlink_buf_t request
;
1530 const char *alg_name
;
1531 char markstr
[32] = "";
1532 struct nlmsghdr
*hdr
;
1533 struct xfrm_usersa_info
*sa
;
1534 uint16_t icv_size
= 64, ipcomp
= data
->ipcomp
;
1535 ipsec_mode_t mode
= data
->mode
, original_mode
= data
->mode
;
1536 traffic_selector_t
*first_src_ts
, *first_dst_ts
;
1537 status_t status
= FAILED
;
1539 /* if IPComp is used, we install an additional IPComp SA. if the cpi is 0
1540 * we are in the recursive call below */
1541 if (ipcomp
!= IPCOMP_NONE
&& data
->cpi
!= 0)
1543 lifetime_cfg_t lft
= {{0,0,0},{0,0,0},{0,0,0}};
1544 kernel_ipsec_sa_id_t ipcomp_id
= {
1547 .spi
= htonl(ntohs(data
->cpi
)),
1548 .proto
= IPPROTO_COMP
,
1551 kernel_ipsec_add_sa_t ipcomp_sa
= {
1552 .reqid
= data
->reqid
,
1554 .src_ts
= data
->src_ts
,
1555 .dst_ts
= data
->dst_ts
,
1557 .enc_alg
= ENCR_UNDEFINED
,
1558 .int_alg
= AUTH_UNDEFINED
,
1560 .ipcomp
= data
->ipcomp
,
1561 .initiator
= data
->initiator
,
1562 .inbound
= data
->inbound
,
1563 .update
= data
->update
,
1565 add_sa(this, &ipcomp_id
, &ipcomp_sa
);
1566 ipcomp
= IPCOMP_NONE
;
1567 /* use transport mode ESP SA, IPComp uses tunnel mode */
1568 mode
= MODE_TRANSPORT
;
1571 memset(&request
, 0, sizeof(request
));
1572 format_mark(markstr
, sizeof(markstr
), id
->mark
);
1574 DBG2(DBG_KNL
, "adding SAD entry with SPI %.8x and reqid {%u}%s",
1575 ntohl(id
->spi
), data
->reqid
, markstr
);
1578 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
1579 hdr
->nlmsg_type
= data
->update
? XFRM_MSG_UPDSA
: XFRM_MSG_NEWSA
;
1580 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
1582 sa
= NLMSG_DATA(hdr
);
1583 host2xfrm(id
->src
, &sa
->saddr
);
1584 host2xfrm(id
->dst
, &sa
->id
.daddr
);
1585 sa
->id
.spi
= id
->spi
;
1586 sa
->id
.proto
= id
->proto
;
1587 sa
->family
= id
->src
->get_family(id
->src
);
1588 sa
->mode
= mode2kernel(mode
);
1592 sa
->flags
|= XFRM_STATE_NOPMTUDISC
;
1595 if (!data
->copy_ecn
)
1597 sa
->flags
|= XFRM_STATE_NOECN
;
1602 switch (data
->copy_dscp
)
1605 case DSCP_COPY_IN_ONLY
:
1606 sa
->flags
|= XFRM_STATE_DECAP_DSCP
;
1614 switch (data
->copy_dscp
)
1616 case DSCP_COPY_IN_ONLY
:
1621 xflags
= netlink_reserve(hdr
, sizeof(request
),
1622 XFRMA_SA_EXTRA_FLAGS
, sizeof(*xflags
));
1627 /* currently the only extra flag */
1628 *xflags
|= XFRM_SA_XFLAG_DONT_ENCAP_DSCP
;
1639 sa
->flags
|= XFRM_STATE_AF_UNSPEC
;
1642 case MODE_TRANSPORT
:
1643 if (original_mode
== MODE_TUNNEL
)
1644 { /* don't install selectors for switched SAs. because only one
1645 * selector can be installed other traffic would get dropped */
1648 if (data
->src_ts
->get_first(data
->src_ts
,
1649 (void**)&first_src_ts
) == SUCCESS
&&
1650 data
->dst_ts
->get_first(data
->dst_ts
,
1651 (void**)&first_dst_ts
) == SUCCESS
)
1653 sa
->sel
= ts2selector(first_src_ts
, first_dst_ts
,
1655 if (!this->proto_port_transport
)
1657 /* don't install proto/port on SA. This would break
1658 * potential secondary SAs for the same address using a
1659 * different prot/port. */
1661 sa
->sel
.dport
= sa
->sel
.dport_mask
= 0;
1662 sa
->sel
.sport
= sa
->sel
.sport_mask
= 0;
1669 if (id
->proto
== IPPROTO_AH
&& sa
->family
== AF_INET
)
1670 { /* use alignment to 4 bytes for IPv4 instead of the incorrect 8 byte
1671 * alignment that's used by default but is only valid for IPv6 */
1672 sa
->flags
|= XFRM_STATE_ALIGN4
;
1675 sa
->reqid
= data
->reqid
;
1676 sa
->lft
.soft_byte_limit
= XFRM_LIMIT(data
->lifetime
->bytes
.rekey
);
1677 sa
->lft
.hard_byte_limit
= XFRM_LIMIT(data
->lifetime
->bytes
.life
);
1678 sa
->lft
.soft_packet_limit
= XFRM_LIMIT(data
->lifetime
->packets
.rekey
);
1679 sa
->lft
.hard_packet_limit
= XFRM_LIMIT(data
->lifetime
->packets
.life
);
1680 /* we use lifetimes since added, not since used */
1681 sa
->lft
.soft_add_expires_seconds
= data
->lifetime
->time
.rekey
;
1682 sa
->lft
.hard_add_expires_seconds
= data
->lifetime
->time
.life
;
1683 sa
->lft
.soft_use_expires_seconds
= 0;
1684 sa
->lft
.hard_use_expires_seconds
= 0;
1686 switch (data
->enc_alg
)
1688 case ENCR_UNDEFINED
:
1691 case ENCR_AES_CCM_ICV16
:
1692 case ENCR_AES_GCM_ICV16
:
1693 case ENCR_NULL_AUTH_AES_GMAC
:
1694 case ENCR_CAMELLIA_CCM_ICV16
:
1695 case ENCR_CHACHA20_POLY1305
:
1698 case ENCR_AES_CCM_ICV12
:
1699 case ENCR_AES_GCM_ICV12
:
1700 case ENCR_CAMELLIA_CCM_ICV12
:
1703 case ENCR_AES_CCM_ICV8
:
1704 case ENCR_AES_GCM_ICV8
:
1705 case ENCR_CAMELLIA_CCM_ICV8
:
1707 struct xfrm_algo_aead
*algo
;
1709 alg_name
= lookup_algorithm(ENCRYPTION_ALGORITHM
, data
->enc_alg
);
1710 if (alg_name
== NULL
)
1712 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1713 encryption_algorithm_names
, data
->enc_alg
);
1716 DBG2(DBG_KNL
, " using encryption algorithm %N with key size %d",
1717 encryption_algorithm_names
, data
->enc_alg
,
1718 data
->enc_key
.len
* 8);
1720 algo
= netlink_reserve(hdr
, sizeof(request
), XFRMA_ALG_AEAD
,
1721 sizeof(*algo
) + data
->enc_key
.len
);
1726 algo
->alg_key_len
= data
->enc_key
.len
* 8;
1727 algo
->alg_icv_len
= icv_size
;
1728 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1729 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1730 memcpy(algo
->alg_key
, data
->enc_key
.ptr
, data
->enc_key
.len
);
1735 struct xfrm_algo
*algo
;
1737 alg_name
= lookup_algorithm(ENCRYPTION_ALGORITHM
, data
->enc_alg
);
1738 if (alg_name
== NULL
)
1740 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1741 encryption_algorithm_names
, data
->enc_alg
);
1744 DBG2(DBG_KNL
, " using encryption algorithm %N with key size %d",
1745 encryption_algorithm_names
, data
->enc_alg
,
1746 data
->enc_key
.len
* 8);
1748 algo
= netlink_reserve(hdr
, sizeof(request
), XFRMA_ALG_CRYPT
,
1749 sizeof(*algo
) + data
->enc_key
.len
);
1754 algo
->alg_key_len
= data
->enc_key
.len
* 8;
1755 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1756 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1757 memcpy(algo
->alg_key
, data
->enc_key
.ptr
, data
->enc_key
.len
);
1761 if (data
->int_alg
!= AUTH_UNDEFINED
)
1763 u_int trunc_len
= 0;
1765 alg_name
= lookup_algorithm(INTEGRITY_ALGORITHM
, data
->int_alg
);
1766 if (alg_name
== NULL
)
1768 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1769 integrity_algorithm_names
, data
->int_alg
);
1772 DBG2(DBG_KNL
, " using integrity algorithm %N with key size %d",
1773 integrity_algorithm_names
, data
->int_alg
, data
->int_key
.len
* 8);
1775 switch (data
->int_alg
)
1777 case AUTH_HMAC_MD5_128
:
1778 case AUTH_HMAC_SHA2_256_128
:
1781 case AUTH_HMAC_SHA1_160
:
1790 struct xfrm_algo_auth
* algo
;
1792 /* the kernel uses SHA256 with 96 bit truncation by default,
1793 * use specified truncation size supported by newer kernels.
1794 * also use this for untruncated MD5 and SHA1. */
1795 algo
= netlink_reserve(hdr
, sizeof(request
), XFRMA_ALG_AUTH_TRUNC
,
1796 sizeof(*algo
) + data
->int_key
.len
);
1801 algo
->alg_key_len
= data
->int_key
.len
* 8;
1802 algo
->alg_trunc_len
= trunc_len
;
1803 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1804 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1805 memcpy(algo
->alg_key
, data
->int_key
.ptr
, data
->int_key
.len
);
1809 struct xfrm_algo
* algo
;
1811 algo
= netlink_reserve(hdr
, sizeof(request
), XFRMA_ALG_AUTH
,
1812 sizeof(*algo
) + data
->int_key
.len
);
1817 algo
->alg_key_len
= data
->int_key
.len
* 8;
1818 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1819 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1820 memcpy(algo
->alg_key
, data
->int_key
.ptr
, data
->int_key
.len
);
1824 if (ipcomp
!= IPCOMP_NONE
)
1826 struct xfrm_algo
* algo
;
1828 alg_name
= lookup_algorithm(COMPRESSION_ALGORITHM
, ipcomp
);
1829 if (alg_name
== NULL
)
1831 DBG1(DBG_KNL
, "algorithm %N not supported by kernel!",
1832 ipcomp_transform_names
, ipcomp
);
1835 DBG2(DBG_KNL
, " using compression algorithm %N",
1836 ipcomp_transform_names
, ipcomp
);
1838 algo
= netlink_reserve(hdr
, sizeof(request
), XFRMA_ALG_COMP
,
1844 algo
->alg_key_len
= 0;
1845 strncpy(algo
->alg_name
, alg_name
, sizeof(algo
->alg_name
));
1846 algo
->alg_name
[sizeof(algo
->alg_name
) - 1] = '\0';
1851 struct xfrm_encap_tmpl
*tmpl
;
1853 tmpl
= netlink_reserve(hdr
, sizeof(request
), XFRMA_ENCAP
, sizeof(*tmpl
));
1858 tmpl
->encap_type
= UDP_ENCAP_ESPINUDP
;
1859 tmpl
->encap_sport
= htons(id
->src
->get_port(id
->src
));
1860 tmpl
->encap_dport
= htons(id
->dst
->get_port(id
->dst
));
1861 memset(&tmpl
->encap_oa
, 0, sizeof (xfrm_address_t
));
1862 /* encap_oa could probably be derived from the
1863 * traffic selectors [rfc4306, p39]. In the netlink kernel
1864 * implementation pluto does the same as we do here but it uses
1865 * encap_oa in the pfkey implementation.
1866 * BUT as /usr/src/linux/net/key/af_key.c indicates the kernel ignores
1868 * -> does that mean that NAT-T encap doesn't work in transport mode?
1869 * No. The reason the kernel ignores NAT-OA is that it recomputes
1870 * (or, rather, just ignores) the checksum. If packets pass the IPsec
1871 * checks it marks them "checksum ok" so OA isn't needed. */
1874 if (!add_mark(hdr
, sizeof(request
), id
->mark
))
1879 if (data
->tfc
&& id
->proto
== IPPROTO_ESP
&& mode
== MODE_TUNNEL
)
1880 { /* the kernel supports TFC padding only for tunnel mode ESP SAs */
1883 tfcpad
= netlink_reserve(hdr
, sizeof(request
), XFRMA_TFCPAD
,
1889 *tfcpad
= data
->tfc
;
1892 if (id
->proto
!= IPPROTO_COMP
)
1894 /* generally, we don't need a replay window for outbound SAs, however,
1895 * when using ESN the kernel rejects the attribute if it is 0 */
1896 if (!data
->inbound
&& data
->replay_window
)
1898 data
->replay_window
= data
->esn
? 1 : 0;
1900 if (data
->replay_window
!= 0 && (data
->esn
|| data
->replay_window
> 32))
1902 /* for ESN or larger replay windows we need the new
1903 * XFRMA_REPLAY_ESN_VAL attribute to configure a bitmap */
1904 struct xfrm_replay_state_esn
*replay
;
1907 bmp_size
= round_up(data
->replay_window
, sizeof(uint32_t) * 8) / 8;
1908 replay
= netlink_reserve(hdr
, sizeof(request
), XFRMA_REPLAY_ESN_VAL
,
1909 sizeof(*replay
) + bmp_size
);
1914 /* bmp_len contains number uf __u32's */
1915 replay
->bmp_len
= bmp_size
/ sizeof(uint32_t);
1916 replay
->replay_window
= data
->replay_window
;
1917 DBG2(DBG_KNL
, " using replay window of %u packets",
1918 data
->replay_window
);
1922 DBG2(DBG_KNL
, " using extended sequence numbers (ESN)");
1923 sa
->flags
|= XFRM_STATE_ESN
;
1928 DBG2(DBG_KNL
, " using replay window of %u packets",
1929 data
->replay_window
);
1930 sa
->replay_window
= data
->replay_window
;
1933 DBG2(DBG_KNL
, " HW offload: %N", hw_offload_names
, data
->hw_offload
);
1934 if (!config_hw_offload(id
, data
, hdr
, sizeof(request
)))
1936 DBG1(DBG_KNL
, "failed to configure HW offload");
1941 status
= this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
);
1942 if (status
== NOT_FOUND
&& data
->update
)
1944 DBG1(DBG_KNL
, "allocated SPI not found anymore, try to add SAD entry");
1945 hdr
->nlmsg_type
= XFRM_MSG_NEWSA
;
1946 status
= this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
);
1949 if (status
!= SUCCESS
)
1951 DBG1(DBG_KNL
, "unable to add SAD entry with SPI %.8x%s (%N)", ntohl(id
->spi
),
1952 markstr
, status_names
, status
);
1960 memwipe(&request
, sizeof(request
));
1965 * Get the ESN replay state (i.e. sequence numbers) of an SA.
1967 * Allocates into one the replay state structure we get from the kernel.
1969 static void get_replay_state(private_kernel_netlink_ipsec_t
*this,
1970 kernel_ipsec_sa_id_t
*sa
,
1971 struct xfrm_replay_state_esn
**replay_esn
,
1972 uint32_t *replay_esn_len
,
1973 struct xfrm_replay_state
**replay
,
1974 struct xfrm_lifetime_cur
**lifetime
)
1976 netlink_buf_t request
;
1977 struct nlmsghdr
*hdr
, *out
= NULL
;
1978 struct xfrm_aevent_id
*out_aevent
= NULL
, *aevent_id
;
1983 memset(&request
, 0, sizeof(request
));
1985 DBG2(DBG_KNL
, "querying replay state from SAD entry with SPI %.8x",
1989 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
1990 hdr
->nlmsg_type
= XFRM_MSG_GETAE
;
1991 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_aevent_id
));
1993 aevent_id
= NLMSG_DATA(hdr
);
1994 aevent_id
->flags
= XFRM_AE_RVAL
;
1996 host2xfrm(sa
->dst
, &aevent_id
->sa_id
.daddr
);
1997 aevent_id
->sa_id
.spi
= sa
->spi
;
1998 aevent_id
->sa_id
.proto
= sa
->proto
;
1999 aevent_id
->sa_id
.family
= sa
->dst
->get_family(sa
->dst
);
2001 if (!add_mark(hdr
, sizeof(request
), sa
->mark
))
2006 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
2009 while (NLMSG_OK(hdr
, len
))
2011 switch (hdr
->nlmsg_type
)
2013 case XFRM_MSG_NEWAE
:
2015 out_aevent
= NLMSG_DATA(hdr
);
2020 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
2021 DBG1(DBG_KNL
, "querying replay state from SAD entry "
2022 "failed: %s (%d)", strerror(-err
->error
), -err
->error
);
2026 hdr
= NLMSG_NEXT(hdr
, len
);
2037 rta
= XFRM_RTA(out
, struct xfrm_aevent_id
);
2038 rtasize
= XFRM_PAYLOAD(out
, struct xfrm_aevent_id
);
2039 while (RTA_OK(rta
, rtasize
))
2041 if (rta
->rta_type
== XFRMA_LTIME_VAL
&&
2042 RTA_PAYLOAD(rta
) == sizeof(**lifetime
))
2045 *lifetime
= malloc(RTA_PAYLOAD(rta
));
2046 memcpy(*lifetime
, RTA_DATA(rta
), RTA_PAYLOAD(rta
));
2048 if (rta
->rta_type
== XFRMA_REPLAY_VAL
&&
2049 RTA_PAYLOAD(rta
) == sizeof(**replay
))
2052 *replay
= malloc(RTA_PAYLOAD(rta
));
2053 memcpy(*replay
, RTA_DATA(rta
), RTA_PAYLOAD(rta
));
2055 if (rta
->rta_type
== XFRMA_REPLAY_ESN_VAL
&&
2056 RTA_PAYLOAD(rta
) >= sizeof(**replay_esn
))
2059 *replay_esn
= malloc(RTA_PAYLOAD(rta
));
2060 *replay_esn_len
= RTA_PAYLOAD(rta
);
2061 memcpy(*replay_esn
, RTA_DATA(rta
), RTA_PAYLOAD(rta
));
2063 rta
= RTA_NEXT(rta
, rtasize
);
2069 METHOD(kernel_ipsec_t
, query_sa
, status_t
,
2070 private_kernel_netlink_ipsec_t
*this, kernel_ipsec_sa_id_t
*id
,
2071 kernel_ipsec_query_sa_t
*data
, uint64_t *bytes
, uint64_t *packets
,
2074 netlink_buf_t request
;
2075 struct nlmsghdr
*out
= NULL
, *hdr
;
2076 struct xfrm_usersa_id
*sa_id
;
2077 struct xfrm_usersa_info
*sa
= NULL
;
2078 status_t status
= FAILED
;
2080 char markstr
[32] = "";
2082 memset(&request
, 0, sizeof(request
));
2083 format_mark(markstr
, sizeof(markstr
), id
->mark
);
2085 DBG2(DBG_KNL
, "querying SAD entry with SPI %.8x%s", ntohl(id
->spi
),
2089 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
2090 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
2091 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
2093 sa_id
= NLMSG_DATA(hdr
);
2094 host2xfrm(id
->dst
, &sa_id
->daddr
);
2095 sa_id
->spi
= id
->spi
;
2096 sa_id
->proto
= id
->proto
;
2097 sa_id
->family
= id
->dst
->get_family(id
->dst
);
2099 if (!add_mark(hdr
, sizeof(request
), id
->mark
))
2104 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
2107 while (NLMSG_OK(hdr
, len
))
2109 switch (hdr
->nlmsg_type
)
2111 case XFRM_MSG_NEWSA
:
2113 sa
= NLMSG_DATA(hdr
);
2118 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
2120 DBG1(DBG_KNL
, "querying SAD entry with SPI %.8x%s failed: "
2121 "%s (%d)", ntohl(id
->spi
), markstr
,
2122 strerror(-err
->error
), -err
->error
);
2126 hdr
= NLMSG_NEXT(hdr
, len
);
2137 DBG2(DBG_KNL
, "unable to query SAD entry with SPI %.8x%s",
2138 ntohl(id
->spi
), markstr
);
2144 *bytes
= sa
->curlft
.bytes
;
2148 *packets
= sa
->curlft
.packets
;
2151 { /* curlft contains an "use" time, but that contains a timestamp
2152 * of the first use, not the last. Last use time must be queried
2153 * on the policy on Linux */
2163 METHOD(kernel_ipsec_t
, del_sa
, status_t
,
2164 private_kernel_netlink_ipsec_t
*this, kernel_ipsec_sa_id_t
*id
,
2165 kernel_ipsec_del_sa_t
*data
)
2167 netlink_buf_t request
;
2168 struct nlmsghdr
*hdr
;
2169 struct xfrm_usersa_id
*sa_id
;
2170 char markstr
[32] = "";
2172 /* if IPComp was used, we first delete the additional IPComp SA */
2175 kernel_ipsec_sa_id_t ipcomp_id
= {
2178 .spi
= htonl(ntohs(data
->cpi
)),
2179 .proto
= IPPROTO_COMP
,
2182 kernel_ipsec_del_sa_t ipcomp
= {};
2183 del_sa(this, &ipcomp_id
, &ipcomp
);
2186 memset(&request
, 0, sizeof(request
));
2187 format_mark(markstr
, sizeof(markstr
), id
->mark
);
2189 DBG2(DBG_KNL
, "deleting SAD entry with SPI %.8x%s", ntohl(id
->spi
),
2193 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2194 hdr
->nlmsg_type
= XFRM_MSG_DELSA
;
2195 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
2197 sa_id
= NLMSG_DATA(hdr
);
2198 host2xfrm(id
->dst
, &sa_id
->daddr
);
2199 sa_id
->spi
= id
->spi
;
2200 sa_id
->proto
= id
->proto
;
2201 sa_id
->family
= id
->dst
->get_family(id
->dst
);
2203 if (!add_mark(hdr
, sizeof(request
), id
->mark
))
2208 switch (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
))
2211 DBG2(DBG_KNL
, "deleted SAD entry with SPI %.8x%s",
2212 ntohl(id
->spi
), markstr
);
2217 DBG1(DBG_KNL
, "unable to delete SAD entry with SPI %.8x%s",
2218 ntohl(id
->spi
), markstr
);
2223 METHOD(kernel_ipsec_t
, update_sa
, status_t
,
2224 private_kernel_netlink_ipsec_t
*this, kernel_ipsec_sa_id_t
*id
,
2225 kernel_ipsec_update_sa_t
*data
)
2227 netlink_buf_t request
;
2228 struct nlmsghdr
*hdr
, *out_hdr
= NULL
, *out
= NULL
;
2229 struct xfrm_usersa_id
*sa_id
;
2230 struct xfrm_usersa_info
*sa
;
2234 struct xfrm_encap_tmpl
* encap
= NULL
;
2235 struct xfrm_replay_state
*replay
= NULL
;
2236 struct xfrm_replay_state_esn
*replay_esn
= NULL
;
2237 struct xfrm_lifetime_cur
*lifetime
= NULL
;
2238 uint32_t replay_esn_len
= 0;
2239 kernel_ipsec_del_sa_t del
= { 0 };
2240 status_t status
= FAILED
;
2241 char markstr
[32] = "";
2243 /* if IPComp is used, we first update the IPComp SA */
2246 kernel_ipsec_sa_id_t ipcomp_id
= {
2249 .spi
= htonl(ntohs(data
->cpi
)),
2250 .proto
= IPPROTO_COMP
,
2253 kernel_ipsec_update_sa_t ipcomp
= {
2254 .new_src
= data
->new_src
,
2255 .new_dst
= data
->new_dst
,
2257 update_sa(this, &ipcomp_id
, &ipcomp
);
2260 memset(&request
, 0, sizeof(request
));
2261 format_mark(markstr
, sizeof(markstr
), id
->mark
);
2263 DBG2(DBG_KNL
, "querying SAD entry with SPI %.8x%s for update",
2264 ntohl(id
->spi
), markstr
);
2266 /* query the existing SA first */
2268 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
2269 hdr
->nlmsg_type
= XFRM_MSG_GETSA
;
2270 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_id
));
2272 sa_id
= NLMSG_DATA(hdr
);
2273 host2xfrm(id
->dst
, &sa_id
->daddr
);
2274 sa_id
->spi
= id
->spi
;
2275 sa_id
->proto
= id
->proto
;
2276 sa_id
->family
= id
->dst
->get_family(id
->dst
);
2278 if (!add_mark(hdr
, sizeof(request
), id
->mark
))
2283 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
2286 while (NLMSG_OK(hdr
, len
))
2288 switch (hdr
->nlmsg_type
)
2290 case XFRM_MSG_NEWSA
:
2297 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
2298 DBG1(DBG_KNL
, "querying SAD entry failed: %s (%d)",
2299 strerror(-err
->error
), -err
->error
);
2303 hdr
= NLMSG_NEXT(hdr
, len
);
2313 DBG1(DBG_KNL
, "unable to update SAD entry with SPI %.8x%s",
2314 ntohl(id
->spi
), markstr
);
2318 get_replay_state(this, id
, &replay_esn
, &replay_esn_len
, &replay
,
2321 /* delete the old SA (without affecting the IPComp SA) */
2322 if (del_sa(this, id
, &del
) != SUCCESS
)
2324 DBG1(DBG_KNL
, "unable to delete old SAD entry with SPI %.8x%s",
2325 ntohl(id
->spi
), markstr
);
2329 DBG2(DBG_KNL
, "updating SAD entry with SPI %.8x%s from %#H..%#H to "
2330 "%#H..%#H", ntohl(id
->spi
), markstr
, id
->src
, id
->dst
, data
->new_src
,
2332 /* copy over the SA from out to request */
2334 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2335 hdr
->nlmsg_type
= XFRM_MSG_NEWSA
;
2336 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_info
));
2337 sa
= NLMSG_DATA(hdr
);
2338 memcpy(sa
, NLMSG_DATA(out_hdr
), sizeof(struct xfrm_usersa_info
));
2339 sa
->family
= data
->new_dst
->get_family(data
->new_dst
);
2341 if (!id
->src
->ip_equals(id
->src
, data
->new_src
))
2343 host2xfrm(data
->new_src
, &sa
->saddr
);
2345 if (!id
->dst
->ip_equals(id
->dst
, data
->new_dst
))
2347 host2xfrm(data
->new_dst
, &sa
->id
.daddr
);
2350 rta
= XFRM_RTA(out_hdr
, struct xfrm_usersa_info
);
2351 rtasize
= XFRM_PAYLOAD(out_hdr
, struct xfrm_usersa_info
);
2352 while (RTA_OK(rta
, rtasize
))
2354 /* copy all attributes, but not XFRMA_ENCAP if we are disabling it */
2355 if (rta
->rta_type
!= XFRMA_ENCAP
|| data
->new_encap
)
2357 if (rta
->rta_type
== XFRMA_ENCAP
)
2358 { /* update encap tmpl */
2359 encap
= RTA_DATA(rta
);
2360 encap
->encap_sport
= ntohs(data
->new_src
->get_port(data
->new_src
));
2361 encap
->encap_dport
= ntohs(data
->new_dst
->get_port(data
->new_dst
));
2363 if (rta
->rta_type
== XFRMA_OFFLOAD_DEV
)
2364 { /* update offload device */
2365 struct xfrm_user_offload
*offload
;
2369 offload
= RTA_DATA(rta
);
2370 local
= offload
->flags
& XFRM_OFFLOAD_INBOUND
? data
->new_dst
2373 if (charon
->kernel
->get_interface(charon
->kernel
, local
,
2376 offload
->ifindex
= if_nametoindex(ifname
);
2377 if (local
->get_family(local
) == AF_INET6
)
2379 offload
->flags
|= XFRM_OFFLOAD_IPV6
;
2383 offload
->flags
&= ~XFRM_OFFLOAD_IPV6
;
2388 netlink_add_attribute(hdr
, rta
->rta_type
,
2389 chunk_create(RTA_DATA(rta
), RTA_PAYLOAD(rta
)),
2392 rta
= RTA_NEXT(rta
, rtasize
);
2395 if (encap
== NULL
&& data
->new_encap
)
2396 { /* add tmpl if we are enabling it */
2397 encap
= netlink_reserve(hdr
, sizeof(request
), XFRMA_ENCAP
,
2403 encap
->encap_type
= UDP_ENCAP_ESPINUDP
;
2404 encap
->encap_sport
= ntohs(data
->new_src
->get_port(data
->new_src
));
2405 encap
->encap_dport
= ntohs(data
->new_dst
->get_port(data
->new_dst
));
2406 memset(&encap
->encap_oa
, 0, sizeof (xfrm_address_t
));
2411 struct xfrm_replay_state_esn
*state
;
2413 state
= netlink_reserve(hdr
, sizeof(request
), XFRMA_REPLAY_ESN_VAL
,
2419 memcpy(state
, replay_esn
, replay_esn_len
);
2423 struct xfrm_replay_state
*state
;
2425 state
= netlink_reserve(hdr
, sizeof(request
), XFRMA_REPLAY_VAL
,
2431 memcpy(state
, replay
, sizeof(*state
));
2435 DBG1(DBG_KNL
, "unable to copy replay state from old SAD entry with "
2436 "SPI %.8x%s", ntohl(id
->spi
), markstr
);
2440 struct xfrm_lifetime_cur
*state
;
2442 state
= netlink_reserve(hdr
, sizeof(request
), XFRMA_LTIME_VAL
,
2448 memcpy(state
, lifetime
, sizeof(*state
));
2452 DBG1(DBG_KNL
, "unable to copy usage stats from old SAD entry with "
2453 "SPI %.8x%s", ntohl(id
->spi
), markstr
);
2456 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
2458 DBG1(DBG_KNL
, "unable to update SAD entry with SPI %.8x%s",
2459 ntohl(id
->spi
), markstr
);
2469 memwipe(&request
, sizeof(request
));
2475 METHOD(kernel_ipsec_t
, flush_sas
, status_t
,
2476 private_kernel_netlink_ipsec_t
*this)
2478 netlink_buf_t request
;
2479 struct nlmsghdr
*hdr
;
2480 struct xfrm_usersa_flush
*flush
;
2485 { IPPROTO_AH
, "AH" },
2486 { IPPROTO_ESP
, "ESP" },
2487 { IPPROTO_COMP
, "IPComp" },
2491 memset(&request
, 0, sizeof(request
));
2494 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2495 hdr
->nlmsg_type
= XFRM_MSG_FLUSHSA
;
2496 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush
));
2498 flush
= NLMSG_DATA(hdr
);
2500 for (i
= 0; i
< countof(protos
); i
++)
2502 DBG2(DBG_KNL
, "flushing all %s SAD entries", protos
[i
].name
);
2504 flush
->proto
= protos
[i
].proto
;
2506 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
2508 DBG1(DBG_KNL
, "unable to flush %s SAD entries", protos
[i
].name
);
2516 * Unlock the mutex and signal waiting threads
2518 static void policy_change_done(private_kernel_netlink_ipsec_t
*this,
2519 policy_entry_t
*policy
)
2521 policy
->working
= FALSE
;
2522 if (policy
->waiting
)
2523 { /* don't need to wake threads waiting for other policies */
2524 this->condvar
->broadcast(this->condvar
);
2526 this->mutex
->unlock(this->mutex
);
2530 * Install a route for the given policy if enabled and required
2532 static void install_route(private_kernel_netlink_ipsec_t
*this,
2533 policy_entry_t
*policy
, policy_sa_t
*mapping
, ipsec_sa_t
*ipsec
)
2535 policy_sa_out_t
*out
= (policy_sa_out_t
*)mapping
;
2536 route_entry_t
*route
;
2540 .prefixlen
= policy
->sel
.prefixlen_d
,
2543 if (charon
->kernel
->get_address_by_ts(charon
->kernel
, out
->src_ts
,
2544 &route
->src_ip
, NULL
) == SUCCESS
)
2546 if (!ipsec
->dst
->is_anyaddr(ipsec
->dst
))
2548 route
->gateway
= charon
->kernel
->get_nexthop(charon
->kernel
,
2549 ipsec
->dst
, -1, ipsec
->src
,
2553 { /* for shunt policies */
2554 iface
= xfrm2host(policy
->sel
.family
, &policy
->sel
.daddr
, 0);
2555 route
->gateway
= charon
->kernel
->get_nexthop(charon
->kernel
,
2556 iface
, policy
->sel
.prefixlen_d
,
2557 route
->src_ip
, &route
->if_name
);
2558 iface
->destroy(iface
);
2560 route
->dst_net
= chunk_alloc(policy
->sel
.family
== AF_INET
? 4 : 16);
2561 memcpy(route
->dst_net
.ptr
, &policy
->sel
.daddr
, route
->dst_net
.len
);
2563 /* get the interface to install the route for, if we haven't one yet.
2564 * If we have a local address, use it. Otherwise (for shunt policies)
2565 * use the route's source address. */
2566 if (!route
->if_name
)
2569 if (iface
->is_anyaddr(iface
))
2571 iface
= route
->src_ip
;
2573 if (!charon
->kernel
->get_interface(charon
->kernel
, iface
,
2576 route_entry_destroy(route
);
2582 route_entry_t
*old
= policy
->route
;
2583 if (route_entry_equals(old
, route
))
2585 route_entry_destroy(route
);
2588 /* uninstall previously installed route */
2589 if (charon
->kernel
->del_route(charon
->kernel
, old
->dst_net
,
2590 old
->prefixlen
, old
->gateway
,
2591 old
->src_ip
, old
->if_name
) != SUCCESS
)
2593 DBG1(DBG_KNL
, "error uninstalling route installed with policy "
2594 "%R === %R %N", out
->src_ts
, out
->dst_ts
, policy_dir_names
,
2597 route_entry_destroy(old
);
2598 policy
->route
= NULL
;
2601 DBG2(DBG_KNL
, "installing route: %R via %H src %H dev %s", out
->dst_ts
,
2602 route
->gateway
, route
->src_ip
, route
->if_name
);
2603 switch (charon
->kernel
->add_route(charon
->kernel
, route
->dst_net
,
2604 route
->prefixlen
, route
->gateway
,
2605 route
->src_ip
, route
->if_name
))
2608 DBG1(DBG_KNL
, "unable to install source route for %H",
2612 /* route exists, do not uninstall */
2613 route_entry_destroy(route
);
2616 /* cache the installed route */
2617 policy
->route
= route
;
2628 * Add or update a policy in the kernel.
2630 * Note: The mutex has to be locked when entering this function
2631 * and is unlocked here in any case.
2633 static status_t
add_policy_internal(private_kernel_netlink_ipsec_t
*this,
2634 policy_entry_t
*policy
, policy_sa_t
*mapping
, bool update
)
2636 netlink_buf_t request
;
2637 policy_entry_t clone
;
2638 ipsec_sa_t
*ipsec
= mapping
->sa
;
2639 struct xfrm_userpolicy_info
*policy_info
;
2640 struct nlmsghdr
*hdr
;
2644 /* clone the policy so we are able to check it out again later */
2645 memcpy(&clone
, policy
, sizeof(policy_entry_t
));
2647 memset(&request
, 0, sizeof(request
));
2649 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
2650 hdr
->nlmsg_type
= update
? XFRM_MSG_UPDPOLICY
: XFRM_MSG_NEWPOLICY
;
2651 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info
));
2653 policy_info
= NLMSG_DATA(hdr
);
2654 policy_info
->sel
= policy
->sel
;
2655 policy_info
->dir
= policy
->direction
;
2657 /* calculate priority based on selector size, small size = high prio */
2658 policy_info
->priority
= mapping
->priority
;
2659 policy_info
->action
= mapping
->type
!= POLICY_DROP
? XFRM_POLICY_ALLOW
2660 : XFRM_POLICY_BLOCK
;
2661 policy_info
->share
= XFRM_SHARE_ANY
;
2663 /* policies don't expire */
2664 policy_info
->lft
.soft_byte_limit
= XFRM_INF
;
2665 policy_info
->lft
.soft_packet_limit
= XFRM_INF
;
2666 policy_info
->lft
.hard_byte_limit
= XFRM_INF
;
2667 policy_info
->lft
.hard_packet_limit
= XFRM_INF
;
2668 policy_info
->lft
.soft_add_expires_seconds
= 0;
2669 policy_info
->lft
.hard_add_expires_seconds
= 0;
2670 policy_info
->lft
.soft_use_expires_seconds
= 0;
2671 policy_info
->lft
.hard_use_expires_seconds
= 0;
2673 if (mapping
->type
== POLICY_IPSEC
&& ipsec
->cfg
.reqid
)
2675 struct xfrm_user_tmpl
*tmpl
;
2681 { IPPROTO_COMP
, htonl(ntohs(ipsec
->cfg
.ipcomp
.cpi
)),
2682 ipsec
->cfg
.ipcomp
.transform
!= IPCOMP_NONE
},
2683 { IPPROTO_ESP
, ipsec
->cfg
.esp
.spi
, ipsec
->cfg
.esp
.use
},
2684 { IPPROTO_AH
, ipsec
->cfg
.ah
.spi
, ipsec
->cfg
.ah
.use
},
2686 ipsec_mode_t proto_mode
= ipsec
->cfg
.mode
;
2689 for (i
= 0; i
< countof(protos
); i
++)
2696 tmpl
= netlink_reserve(hdr
, sizeof(request
), XFRMA_TMPL
,
2697 count
* sizeof(*tmpl
));
2700 policy_change_done(this, policy
);
2704 for (i
= 0; i
< countof(protos
); i
++)
2710 tmpl
->reqid
= ipsec
->cfg
.reqid
;
2711 tmpl
->id
.proto
= protos
[i
].proto
;
2712 if (policy
->direction
== POLICY_OUT
)
2714 tmpl
->id
.spi
= protos
[i
].spi
;
2716 tmpl
->aalgos
= tmpl
->ealgos
= tmpl
->calgos
= ~0;
2717 tmpl
->mode
= mode2kernel(proto_mode
);
2718 tmpl
->optional
= protos
[i
].proto
== IPPROTO_COMP
&&
2719 policy
->direction
!= POLICY_OUT
;
2720 tmpl
->family
= ipsec
->src
->get_family(ipsec
->src
);
2722 if (proto_mode
== MODE_TUNNEL
|| proto_mode
== MODE_BEET
)
2723 { /* only for tunnel mode */
2724 host2xfrm(ipsec
->src
, &tmpl
->saddr
);
2725 host2xfrm(ipsec
->dst
, &tmpl
->id
.daddr
);
2730 /* use transport mode for other SAs */
2731 proto_mode
= MODE_TRANSPORT
;
2735 if (!add_mark(hdr
, sizeof(request
), ipsec
->mark
))
2737 policy_change_done(this, policy
);
2740 this->mutex
->unlock(this->mutex
);
2742 status
= this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
);
2743 if (status
== ALREADY_DONE
&& !update
)
2745 DBG1(DBG_KNL
, "policy already exists, try to update it");
2746 hdr
->nlmsg_type
= XFRM_MSG_UPDPOLICY
;
2747 status
= this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
);
2750 this->mutex
->lock(this->mutex
);
2751 if (status
!= SUCCESS
)
2753 policy_change_done(this, policy
);
2756 /* install a route, if:
2757 * - this is an outbound policy (to just get one for each child)
2758 * - routing is not disabled via strongswan.conf
2759 * - the selector is not for a specific protocol/port
2760 * - we are in tunnel/BEET mode or install a bypass policy
2762 if (policy
->direction
== POLICY_OUT
&& this->install_routes
&&
2763 !policy
->sel
.proto
&& !policy
->sel
.dport
&& !policy
->sel
.sport
)
2765 if (mapping
->type
== POLICY_PASS
||
2766 (mapping
->type
== POLICY_IPSEC
&& ipsec
->cfg
.mode
!= MODE_TRANSPORT
))
2768 install_route(this, policy
, mapping
, ipsec
);
2771 policy_change_done(this, policy
);
2775 METHOD(kernel_ipsec_t
, add_policy
, status_t
,
2776 private_kernel_netlink_ipsec_t
*this, kernel_ipsec_policy_id_t
*id
,
2777 kernel_ipsec_manage_policy_t
*data
)
2779 policy_entry_t
*policy
, *current
;
2780 policy_sa_t
*assigned_sa
, *current_sa
;
2781 enumerator_t
*enumerator
;
2782 bool found
= FALSE
, update
= TRUE
;
2783 char markstr
[32] = "";
2784 uint32_t cur_priority
= 0;
2787 /* create a policy */
2789 .sel
= ts2selector(id
->src_ts
, id
->dst_ts
, id
->interface
),
2790 .mark
= id
->mark
.value
& id
->mark
.mask
,
2791 .direction
= id
->dir
,
2792 .reqid
= data
->sa
->reqid
,
2794 format_mark(markstr
, sizeof(markstr
), id
->mark
);
2796 /* find the policy, which matches EXACTLY */
2797 this->mutex
->lock(this->mutex
);
2798 current
= this->policies
->get(this->policies
, policy
);
2801 if (current
->reqid
&& data
->sa
->reqid
&&
2802 current
->reqid
!= data
->sa
->reqid
)
2804 DBG1(DBG_CFG
, "unable to install policy %R === %R %N%s for reqid "
2805 "%u, the same policy for reqid %u exists",
2806 id
->src_ts
, id
->dst_ts
, policy_dir_names
, id
->dir
, markstr
,
2807 data
->sa
->reqid
, current
->reqid
);
2808 policy_entry_destroy(this, policy
);
2809 this->mutex
->unlock(this->mutex
);
2810 return INVALID_STATE
;
2812 /* use existing policy */
2813 DBG2(DBG_KNL
, "policy %R === %R %N%s already exists, increasing "
2814 "refcount", id
->src_ts
, id
->dst_ts
, policy_dir_names
, id
->dir
,
2816 policy_entry_destroy(this, policy
);
2821 while (policy
->working
)
2823 this->condvar
->wait(this->condvar
, this->mutex
);
2826 policy
->working
= TRUE
;
2829 { /* use the new one, if we have no such policy */
2830 policy
->used_by
= linked_list_create();
2831 this->policies
->put(this->policies
, policy
, policy
);
2834 /* cache the assigned IPsec SA */
2835 assigned_sa
= policy_sa_create(this, id
->dir
, data
->type
, data
->src
,
2836 data
->dst
, id
->src_ts
, id
->dst_ts
, id
->mark
, data
->sa
);
2837 assigned_sa
->auto_priority
= get_priority(policy
, data
->prio
, id
->interface
);
2838 assigned_sa
->priority
= this->get_priority
? this->get_priority(id
, data
)
2839 : data
->manual_prio
;
2840 assigned_sa
->priority
= assigned_sa
->priority
?: assigned_sa
->auto_priority
;
2842 /* insert the SA according to its priority */
2843 enumerator
= policy
->used_by
->create_enumerator(policy
->used_by
);
2844 while (enumerator
->enumerate(enumerator
, (void**)¤t_sa
))
2846 if (current_sa
->priority
> assigned_sa
->priority
)
2850 if (current_sa
->priority
== assigned_sa
->priority
)
2852 /* in case of equal manual prios order SAs by automatic priority */
2853 if (current_sa
->auto_priority
> assigned_sa
->auto_priority
)
2857 /* prefer SAs with a reqid over those without */
2858 if (current_sa
->auto_priority
== assigned_sa
->auto_priority
&&
2859 (!current_sa
->sa
->cfg
.reqid
|| assigned_sa
->sa
->cfg
.reqid
))
2866 cur_priority
= current_sa
->priority
;
2870 policy
->used_by
->insert_before(policy
->used_by
, enumerator
, assigned_sa
);
2871 enumerator
->destroy(enumerator
);
2873 use_count
= policy
->used_by
->get_count(policy
->used_by
);
2875 { /* we don't update the policy if the priority is lower than that of
2876 * the currently installed one */
2877 policy_change_done(this, policy
);
2878 DBG2(DBG_KNL
, "not updating policy %R === %R %N%s [priority %u, "
2879 "refcount %d]", id
->src_ts
, id
->dst_ts
, policy_dir_names
,
2880 id
->dir
, markstr
, cur_priority
, use_count
);
2883 policy
->reqid
= assigned_sa
->sa
->cfg
.reqid
;
2885 if (this->policy_update
)
2890 DBG2(DBG_KNL
, "%s policy %R === %R %N%s [priority %u, refcount %d]",
2891 found
? "updating" : "adding", id
->src_ts
, id
->dst_ts
,
2892 policy_dir_names
, id
->dir
, markstr
, assigned_sa
->priority
, use_count
);
2894 if (add_policy_internal(this, policy
, assigned_sa
, found
) != SUCCESS
)
2896 DBG1(DBG_KNL
, "unable to %s policy %R === %R %N%s",
2897 found
? "update" : "add", id
->src_ts
, id
->dst_ts
,
2898 policy_dir_names
, id
->dir
, markstr
);
2904 METHOD(kernel_ipsec_t
, query_policy
, status_t
,
2905 private_kernel_netlink_ipsec_t
*this, kernel_ipsec_policy_id_t
*id
,
2906 kernel_ipsec_query_policy_t
*data
, time_t *use_time
)
2908 netlink_buf_t request
;
2909 struct nlmsghdr
*out
= NULL
, *hdr
;
2910 struct xfrm_userpolicy_id
*policy_id
;
2911 struct xfrm_userpolicy_info
*policy
= NULL
;
2913 char markstr
[32] = "";
2915 memset(&request
, 0, sizeof(request
));
2916 format_mark(markstr
, sizeof(markstr
), id
->mark
);
2918 DBG2(DBG_KNL
, "querying policy %R === %R %N%s", id
->src_ts
, id
->dst_ts
,
2919 policy_dir_names
, id
->dir
, markstr
);
2922 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
2923 hdr
->nlmsg_type
= XFRM_MSG_GETPOLICY
;
2924 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
2926 policy_id
= NLMSG_DATA(hdr
);
2927 policy_id
->sel
= ts2selector(id
->src_ts
, id
->dst_ts
, id
->interface
);
2928 policy_id
->dir
= id
->dir
;
2930 if (!add_mark(hdr
, sizeof(request
), id
->mark
))
2935 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
2938 while (NLMSG_OK(hdr
, len
))
2940 switch (hdr
->nlmsg_type
)
2942 case XFRM_MSG_NEWPOLICY
:
2944 policy
= NLMSG_DATA(hdr
);
2949 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
2950 DBG1(DBG_KNL
, "querying policy failed: %s (%d)",
2951 strerror(-err
->error
), -err
->error
);
2955 hdr
= NLMSG_NEXT(hdr
, len
);
2966 DBG2(DBG_KNL
, "unable to query policy %R === %R %N%s", id
->src_ts
,
2967 id
->dst_ts
, policy_dir_names
, id
->dir
, markstr
);
2972 if (policy
->curlft
.use_time
)
2974 /* we need the monotonic time, but the kernel returns system time. */
2975 *use_time
= time_monotonic(NULL
) - (time(NULL
) - policy
->curlft
.use_time
);
2986 METHOD(kernel_ipsec_t
, del_policy
, status_t
,
2987 private_kernel_netlink_ipsec_t
*this, kernel_ipsec_policy_id_t
*id
,
2988 kernel_ipsec_manage_policy_t
*data
)
2990 policy_entry_t
*current
, policy
;
2991 enumerator_t
*enumerator
;
2992 policy_sa_t
*mapping
;
2993 netlink_buf_t request
;
2994 struct nlmsghdr
*hdr
;
2995 struct xfrm_userpolicy_id
*policy_id
;
2996 bool is_installed
= TRUE
;
2997 uint32_t priority
, auto_priority
, cur_priority
;
2998 ipsec_sa_t assigned_sa
= {
3004 char markstr
[32] = "";
3006 status_t status
= SUCCESS
;
3008 format_mark(markstr
, sizeof(markstr
), id
->mark
);
3010 DBG2(DBG_KNL
, "deleting policy %R === %R %N%s", id
->src_ts
, id
->dst_ts
,
3011 policy_dir_names
, id
->dir
, markstr
);
3013 /* create a policy */
3014 memset(&policy
, 0, sizeof(policy_entry_t
));
3015 policy
.sel
= ts2selector(id
->src_ts
, id
->dst_ts
, id
->interface
);
3016 policy
.mark
= id
->mark
.value
& id
->mark
.mask
;
3017 policy
.direction
= id
->dir
;
3019 /* find the policy */
3020 this->mutex
->lock(this->mutex
);
3021 current
= this->policies
->get(this->policies
, &policy
);
3024 DBG1(DBG_KNL
, "deleting policy %R === %R %N%s failed, not found",
3025 id
->src_ts
, id
->dst_ts
, policy_dir_names
, id
->dir
, markstr
);
3026 this->mutex
->unlock(this->mutex
);
3030 while (current
->working
)
3032 this->condvar
->wait(this->condvar
, this->mutex
);
3034 current
->working
= TRUE
;
3037 /* remove mapping to SA by reqid and priority */
3038 auto_priority
= get_priority(current
, data
->prio
,id
->interface
);
3039 priority
= this->get_priority
? this->get_priority(id
, data
)
3040 : data
->manual_prio
;
3041 priority
= priority
?: auto_priority
;
3043 enumerator
= current
->used_by
->create_enumerator(current
->used_by
);
3044 while (enumerator
->enumerate(enumerator
, (void**)&mapping
))
3046 if (priority
== mapping
->priority
&&
3047 auto_priority
== mapping
->auto_priority
&&
3048 data
->type
== mapping
->type
&&
3049 ipsec_sa_equals(mapping
->sa
, &assigned_sa
))
3051 current
->used_by
->remove_at(current
->used_by
, enumerator
);
3052 policy_sa_destroy(mapping
, id
->dir
, this);
3057 cur_priority
= mapping
->priority
;
3058 is_installed
= FALSE
;
3061 enumerator
->destroy(enumerator
);
3063 use_count
= current
->used_by
->get_count(current
->used_by
);
3065 { /* policy is used by more SAs, keep in kernel */
3066 DBG2(DBG_KNL
, "policy still used by another CHILD_SA, not removed");
3068 { /* no need to update as the policy was not installed for this SA */
3069 policy_change_done(this, current
);
3070 DBG2(DBG_KNL
, "not updating policy %R === %R %N%s [priority %u, "
3071 "refcount %d]", id
->src_ts
, id
->dst_ts
, policy_dir_names
,
3072 id
->dir
, markstr
, cur_priority
, use_count
);
3075 current
->used_by
->get_first(current
->used_by
, (void**)&mapping
);
3076 current
->reqid
= mapping
->sa
->cfg
.reqid
;
3078 DBG2(DBG_KNL
, "updating policy %R === %R %N%s [priority %u, "
3079 "refcount %d]", id
->src_ts
, id
->dst_ts
, policy_dir_names
, id
->dir
,
3080 markstr
, mapping
->priority
, use_count
);
3082 if (add_policy_internal(this, current
, mapping
, TRUE
) != SUCCESS
)
3084 DBG1(DBG_KNL
, "unable to update policy %R === %R %N%s",
3085 id
->src_ts
, id
->dst_ts
, policy_dir_names
, id
->dir
, markstr
);
3091 memset(&request
, 0, sizeof(request
));
3094 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
3095 hdr
->nlmsg_type
= XFRM_MSG_DELPOLICY
;
3096 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
3098 policy_id
= NLMSG_DATA(hdr
);
3099 policy_id
->sel
= current
->sel
;
3100 policy_id
->dir
= id
->dir
;
3102 if (!add_mark(hdr
, sizeof(request
), id
->mark
))
3104 policy_change_done(this, current
);
3110 route_entry_t
*route
= current
->route
;
3111 if (charon
->kernel
->del_route(charon
->kernel
, route
->dst_net
,
3112 route
->prefixlen
, route
->gateway
,
3113 route
->src_ip
, route
->if_name
) != SUCCESS
)
3115 DBG1(DBG_KNL
, "error uninstalling route installed with policy "
3116 "%R === %R %N%s", id
->src_ts
, id
->dst_ts
, policy_dir_names
,
3120 this->mutex
->unlock(this->mutex
);
3122 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
3124 DBG1(DBG_KNL
, "unable to delete policy %R === %R %N%s", id
->src_ts
,
3125 id
->dst_ts
, policy_dir_names
, id
->dir
, markstr
);
3129 this->mutex
->lock(this->mutex
);
3130 if (!current
->waiting
)
3131 { /* only if no other thread still needs the policy */
3132 this->policies
->remove(this->policies
, current
);
3133 policy_entry_destroy(this, current
);
3134 this->mutex
->unlock(this->mutex
);
3138 policy_change_done(this, current
);
3143 METHOD(kernel_ipsec_t
, flush_policies
, status_t
,
3144 private_kernel_netlink_ipsec_t
*this)
3146 netlink_buf_t request
;
3147 struct nlmsghdr
*hdr
;
3149 memset(&request
, 0, sizeof(request
));
3151 DBG2(DBG_KNL
, "flushing all policies from SPD");
3154 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
3155 hdr
->nlmsg_type
= XFRM_MSG_FLUSHPOLICY
;
3156 hdr
->nlmsg_len
= NLMSG_LENGTH(0); /* no data associated */
3158 /* by adding an rtattr of type XFRMA_POLICY_TYPE we could restrict this
3159 * to main or sub policies (default is main) */
3161 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
3163 DBG1(DBG_KNL
, "unable to flush SPD entries");
3170 * Bypass socket using a per-socket policy
3172 static bool add_socket_bypass(private_kernel_netlink_ipsec_t
*this,
3175 struct xfrm_userpolicy_info policy
;
3176 u_int sol
, ipsec_policy
;
3182 ipsec_policy
= IP_XFRM_POLICY
;
3186 ipsec_policy
= IPV6_XFRM_POLICY
;
3192 memset(&policy
, 0, sizeof(policy
));
3193 policy
.action
= XFRM_POLICY_ALLOW
;
3194 policy
.sel
.family
= family
;
3196 policy
.dir
= XFRM_POLICY_OUT
;
3197 if (setsockopt(fd
, sol
, ipsec_policy
, &policy
, sizeof(policy
)) < 0)
3199 DBG1(DBG_KNL
, "unable to set IPSEC_POLICY on socket: %s (%d)",
3200 strerror(errno
), errno
);
3203 policy
.dir
= XFRM_POLICY_IN
;
3204 if (setsockopt(fd
, sol
, ipsec_policy
, &policy
, sizeof(policy
)) < 0)
3206 DBG1(DBG_KNL
, "unable to set IPSEC_POLICY on socket: %s (%d)",
3207 strerror(errno
), errno
);
3214 * Port based IKE bypass policy
3217 /** address family */
3219 /** layer 4 protocol */
3221 /** port number, network order */
3226 * Add or remove a bypass policy from/to kernel
3228 static bool manage_bypass(private_kernel_netlink_ipsec_t
*this,
3229 int type
, policy_dir_t dir
, bypass_t
*bypass
)
3231 netlink_buf_t request
;
3232 struct xfrm_selector
*sel
;
3233 struct nlmsghdr
*hdr
;
3235 memset(&request
, 0, sizeof(request
));
3237 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
3238 hdr
->nlmsg_type
= type
;
3240 if (type
== XFRM_MSG_NEWPOLICY
)
3242 struct xfrm_userpolicy_info
*policy
;
3244 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info
));
3246 policy
= NLMSG_DATA(hdr
);
3248 policy
->priority
= 32;
3249 policy
->action
= XFRM_POLICY_ALLOW
;
3250 policy
->share
= XFRM_SHARE_ANY
;
3252 policy
->lft
.soft_byte_limit
= XFRM_INF
;
3253 policy
->lft
.soft_packet_limit
= XFRM_INF
;
3254 policy
->lft
.hard_byte_limit
= XFRM_INF
;
3255 policy
->lft
.hard_packet_limit
= XFRM_INF
;
3259 else /* XFRM_MSG_DELPOLICY */
3261 struct xfrm_userpolicy_id
*policy
;
3263 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id
));
3265 policy
= NLMSG_DATA(hdr
);
3271 sel
->family
= bypass
->family
;
3272 sel
->proto
= bypass
->proto
;
3273 if (dir
== POLICY_IN
)
3275 sel
->dport
= bypass
->port
;
3276 sel
->dport_mask
= 0xffff;
3280 sel
->sport
= bypass
->port
;
3281 sel
->sport_mask
= 0xffff;
3283 return this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) == SUCCESS
;
3287 * Bypass socket using a port-based bypass policy
3289 static bool add_port_bypass(private_kernel_netlink_ipsec_t
*this,
3294 struct sockaddr_in in
;
3295 struct sockaddr_in6 in6
;
3302 len
= sizeof(saddr
);
3303 if (getsockname(fd
, &saddr
.sa
, &len
) != 0)
3307 #ifdef SO_PROTOCOL /* since 2.6.32 */
3308 len
= sizeof(bypass
.proto
);
3309 if (getsockopt(fd
, SOL_SOCKET
, SO_PROTOCOL
, &bypass
.proto
, &len
) != 0)
3311 { /* assume UDP if SO_PROTOCOL not supported */
3312 bypass
.proto
= IPPROTO_UDP
;
3317 bypass
.port
= saddr
.in
.sin_port
;
3320 bypass
.port
= saddr
.in6
.sin6_port
;
3326 if (!manage_bypass(this, XFRM_MSG_NEWPOLICY
, POLICY_IN
, &bypass
))
3330 if (!manage_bypass(this, XFRM_MSG_NEWPOLICY
, POLICY_OUT
, &bypass
))
3332 manage_bypass(this, XFRM_MSG_DELPOLICY
, POLICY_IN
, &bypass
);
3335 array_insert(this->bypass
, ARRAY_TAIL
, &bypass
);
3341 * Remove installed port based bypass policy
3343 static void remove_port_bypass(bypass_t
*bypass
, int idx
,
3344 private_kernel_netlink_ipsec_t
*this)
3346 manage_bypass(this, XFRM_MSG_DELPOLICY
, POLICY_OUT
, bypass
);
3347 manage_bypass(this, XFRM_MSG_DELPOLICY
, POLICY_IN
, bypass
);
3350 METHOD(kernel_ipsec_t
, bypass_socket
, bool,
3351 private_kernel_netlink_ipsec_t
*this, int fd
, int family
)
3353 if (lib
->settings
->get_bool(lib
->settings
,
3354 "%s.plugins.kernel-netlink.port_bypass", FALSE
, lib
->ns
))
3356 return add_port_bypass(this, fd
, family
);
3358 return add_socket_bypass(this, fd
, family
);
3361 METHOD(kernel_ipsec_t
, enable_udp_decap
, bool,
3362 private_kernel_netlink_ipsec_t
*this, int fd
, int family
, uint16_t port
)
3364 int type
= UDP_ENCAP_ESPINUDP
;
3366 if (setsockopt(fd
, SOL_UDP
, UDP_ENCAP
, &type
, sizeof(type
)) < 0)
3368 DBG1(DBG_KNL
, "unable to set UDP_ENCAP: %s", strerror(errno
));
3374 METHOD(kernel_ipsec_t
, destroy
, void,
3375 private_kernel_netlink_ipsec_t
*this)
3377 enumerator_t
*enumerator
;
3378 policy_entry_t
*policy
;
3380 array_destroy_function(this->bypass
,
3381 (array_callback_t
)remove_port_bypass
, this);
3382 if (this->socket_xfrm_events
> 0)
3384 lib
->watcher
->remove(lib
->watcher
, this->socket_xfrm_events
);
3385 close(this->socket_xfrm_events
);
3387 DESTROY_IF(this->socket_xfrm
);
3388 enumerator
= this->policies
->create_enumerator(this->policies
);
3389 while (enumerator
->enumerate(enumerator
, &policy
, &policy
))
3391 policy_entry_destroy(this, policy
);
3393 enumerator
->destroy(enumerator
);
3394 this->policies
->destroy(this->policies
);
3395 this->sas
->destroy(this->sas
);
3396 this->condvar
->destroy(this->condvar
);
3397 this->mutex
->destroy(this->mutex
);
3402 * Get the currently configured SPD hashing thresholds for an address family
3404 static bool get_spd_hash_thresh(private_kernel_netlink_ipsec_t
*this,
3405 int type
, uint8_t *lbits
, uint8_t *rbits
)
3407 netlink_buf_t request
;
3408 struct nlmsghdr
*hdr
, *out
;
3409 struct xfrmu_spdhthresh
*thresh
;
3411 size_t len
, rtasize
;
3412 bool success
= FALSE
;
3414 memset(&request
, 0, sizeof(request
));
3417 hdr
->nlmsg_flags
= NLM_F_REQUEST
;
3418 hdr
->nlmsg_type
= XFRM_MSG_GETSPDINFO
;
3419 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(uint32_t));
3421 if (this->socket_xfrm
->send(this->socket_xfrm
, hdr
, &out
, &len
) == SUCCESS
)
3424 while (NLMSG_OK(hdr
, len
))
3426 switch (hdr
->nlmsg_type
)
3428 case XFRM_MSG_NEWSPDINFO
:
3430 rta
= XFRM_RTA(hdr
, uint32_t);
3431 rtasize
= XFRM_PAYLOAD(hdr
, uint32_t);
3432 while (RTA_OK(rta
, rtasize
))
3434 if (rta
->rta_type
== type
&&
3435 RTA_PAYLOAD(rta
) == sizeof(*thresh
))
3437 thresh
= RTA_DATA(rta
);
3438 *lbits
= thresh
->lbits
;
3439 *rbits
= thresh
->rbits
;
3443 rta
= RTA_NEXT(rta
, rtasize
);
3449 struct nlmsgerr
*err
= NLMSG_DATA(hdr
);
3450 DBG1(DBG_KNL
, "getting SPD hash threshold failed: %s (%d)",
3451 strerror(-err
->error
), -err
->error
);
3455 hdr
= NLMSG_NEXT(hdr
, len
);
3468 * Configure SPD hashing threshold for an address family
3470 static void setup_spd_hash_thresh(private_kernel_netlink_ipsec_t
*this,
3471 char *key
, int type
, uint8_t def
)
3473 struct xfrmu_spdhthresh
*thresh
;
3474 struct nlmsghdr
*hdr
;
3475 netlink_buf_t request
;
3476 uint8_t lbits
, rbits
;
3478 if (!get_spd_hash_thresh(this, type
, &lbits
, &rbits
))
3482 memset(&request
, 0, sizeof(request
));
3485 hdr
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ACK
;
3486 hdr
->nlmsg_type
= XFRM_MSG_NEWSPDINFO
;
3487 hdr
->nlmsg_len
= NLMSG_LENGTH(sizeof(uint32_t));
3489 thresh
= netlink_reserve(hdr
, sizeof(request
), type
, sizeof(*thresh
));
3490 thresh
->lbits
= lib
->settings
->get_int(lib
->settings
,
3491 "%s.plugins.kernel-netlink.spdh_thresh.%s.lbits",
3493 thresh
->rbits
= lib
->settings
->get_int(lib
->settings
,
3494 "%s.plugins.kernel-netlink.spdh_thresh.%s.rbits",
3496 if (thresh
->lbits
!= lbits
|| thresh
->rbits
!= rbits
)
3498 if (this->socket_xfrm
->send_ack(this->socket_xfrm
, hdr
) != SUCCESS
)
3500 DBG1(DBG_KNL
, "setting SPD hash threshold failed");
3506 * Described in header.
3508 kernel_netlink_ipsec_t
*kernel_netlink_ipsec_create()
3510 private_kernel_netlink_ipsec_t
*this;
3511 bool register_for_events
= TRUE
;
3516 .get_features
= _get_features
,
3517 .get_spi
= _get_spi
,
3518 .get_cpi
= _get_cpi
,
3520 .update_sa
= _update_sa
,
3521 .query_sa
= _query_sa
,
3523 .flush_sas
= _flush_sas
,
3524 .add_policy
= _add_policy
,
3525 .query_policy
= _query_policy
,
3526 .del_policy
= _del_policy
,
3527 .flush_policies
= _flush_policies
,
3528 .bypass_socket
= _bypass_socket
,
3529 .enable_udp_decap
= _enable_udp_decap
,
3530 .destroy
= _destroy
,
3533 .policies
= hashtable_create((hashtable_hash_t
)policy_hash
,
3534 (hashtable_equals_t
)policy_equals
, 32),
3535 .sas
= hashtable_create((hashtable_hash_t
)ipsec_sa_hash
,
3536 (hashtable_equals_t
)ipsec_sa_equals
, 32),
3537 .bypass
= array_create(sizeof(bypass_t
), 0),
3538 .mutex
= mutex_create(MUTEX_TYPE_DEFAULT
),
3539 .condvar
= condvar_create(CONDVAR_TYPE_DEFAULT
),
3540 .get_priority
= dlsym(RTLD_DEFAULT
,
3541 "kernel_netlink_get_priority_custom"),
3542 .policy_update
= lib
->settings
->get_bool(lib
->settings
,
3543 "%s.plugins.kernel-netlink.policy_update", FALSE
, lib
->ns
),
3544 .install_routes
= lib
->settings
->get_bool(lib
->settings
,
3545 "%s.install_routes", TRUE
, lib
->ns
),
3546 .proto_port_transport
= lib
->settings
->get_bool(lib
->settings
,
3547 "%s.plugins.kernel-netlink.set_proto_port_transport_sa",
3551 if (streq(lib
->ns
, "starter"))
3552 { /* starter has no threads, so we do not register for kernel events */
3553 register_for_events
= FALSE
;
3556 this->socket_xfrm
= netlink_socket_create(NETLINK_XFRM
, xfrm_msg_names
,
3557 lib
->settings
->get_bool(lib
->settings
,
3558 "%s.plugins.kernel-netlink.parallel_xfrm", FALSE
, lib
->ns
));
3559 if (!this->socket_xfrm
)
3565 setup_spd_hash_thresh(this, "ipv4", XFRMA_SPD_IPV4_HTHRESH
, 32);
3566 setup_spd_hash_thresh(this, "ipv6", XFRMA_SPD_IPV6_HTHRESH
, 128);
3568 if (register_for_events
)
3570 struct sockaddr_nl addr
;
3572 memset(&addr
, 0, sizeof(addr
));
3573 addr
.nl_family
= AF_NETLINK
;
3575 /* create and bind XFRM socket for ACQUIRE, EXPIRE, MIGRATE & MAPPING */
3576 this->socket_xfrm_events
= socket(AF_NETLINK
, SOCK_RAW
, NETLINK_XFRM
);
3577 if (this->socket_xfrm_events
<= 0)
3579 DBG1(DBG_KNL
, "unable to create XFRM event socket: %s (%d)",
3580 strerror(errno
), errno
);
3584 addr
.nl_groups
= XFRMNLGRP(ACQUIRE
) | XFRMNLGRP(EXPIRE
) |
3585 XFRMNLGRP(MIGRATE
) | XFRMNLGRP(MAPPING
);
3586 if (bind(this->socket_xfrm_events
, (struct sockaddr
*)&addr
, sizeof(addr
)))
3588 DBG1(DBG_KNL
, "unable to bind XFRM event socket: %s (%d)",
3589 strerror(errno
), errno
);
3593 lib
->watcher
->add(lib
->watcher
, this->socket_xfrm_events
, WATCHER_READ
,
3594 (watcher_cb_t
)receive_events
, this);
3597 return &this->public;