denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- configuration_manager replaced by configuration_t interface

Browse Source 
- current configuration_manager is now static_configuration (testing)
- first draft of starter_configuration, which should once interact with ipsec starter (via whack?)
- some cleanups
- socket_t uses RAW socket, which allows parallel service of pluto/charon
This commit is contained in:
Martin Willi
2006-03-07 09:42:15 +00:00
parent aa5a35a005
commit 8a49112907
43 changed files with 1289 additions and 225 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/network/socket.c
+75 -24
View File
@@ -34,6 +34,8 @@
#include <fcntl.h>
#include <net/if.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <linux/filter.h>
#include "socket.h"
@@ -42,6 +44,43 @@
#include <utils/logger_manager.h>
#define IP_HEADER_LENGTH 20
#define UDP_HEADER_LENGTH 8
/**
* This filter code filters out all non-IKEv2 traffic on
* a SOCK_RAW IP_PROTP_UDP socket. Handling of other
* IKE versions is done in pluto.
*/
struct sock_filter ikev2_filter_code[] =
{
/* Protocol must be UDP */
BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 9),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_UDP, 0, 7),
/* Destination Port must be 500 */
BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 22),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 500, 0, 5),
/* IKE version must be 2.0 */
BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 45),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x20, 0, 3),
/* packet length is length in IKEv2 header + ip header + udp header */
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 52),
BPF_STMT(BPF_ALU+BPF_ADD+BPF_K, IP_HEADER_LENGTH + UDP_HEADER_LENGTH),
BPF_STMT(BPF_RET+BPF_A, 0),
/* packet doesn't match IKEv2, ignore */
BPF_STMT(BPF_RET+BPF_K, 0),
};
/**
* Filter struct to use with setsockopt
*/
struct sock_fprog ikev2_filter = {
sizeof(ikev2_filter_code) / sizeof(struct sock_filter),
ikev2_filter_code
};
typedef struct interface_t interface_t;
/**
@@ -52,7 +91,7 @@ struct interface_t {
/**
* Name of the interface
*/
char name[IFNAMSIZ+1];
char name[IFNAMSIZ];
/**
* Associated socket
@@ -98,10 +137,6 @@ status_t receiver(private_socket_t *this, packet_t **packet)
host_t *source, *dest;
int bytes_read = 0;
source = host_create(AF_INET, "0.0.0.0", 0);
dest = host_create(AF_INET, "0.0.0.0", 0);
pkt->set_source(pkt, source);
pkt->set_destination(pkt, dest);
while (bytes_read >= 0)
{
@@ -124,7 +159,7 @@ status_t receiver(private_socket_t *this, packet_t **packet)
}
}
iterator->destroy(iterator);
/* add packet destroy handler for cancellation, enable cancellation */
pthread_cleanup_push((void(*)(void*))pkt->destroy, (void*)pkt);
pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
@@ -136,12 +171,6 @@ status_t receiver(private_socket_t *this, packet_t **packet)
pthread_setcancelstate(oldstate, NULL);
pthread_cleanup_pop(0);
if (bytes_read < 0)
{
this->logger->log(this->logger, ERROR, "error reading from socket: %s", strerror(errno));
continue;
}
/* read on the first nonblocking socket */
bytes_read = 0;
iterator = this->interfaces->create_iterator(this->interfaces, TRUE);
@@ -151,28 +180,41 @@ status_t receiver(private_socket_t *this, packet_t **packet)
if (FD_ISSET(interface->socket_fd, &readfds))
{
/* do the read */
bytes_read = recvfrom(interface->socket_fd, buffer, MAX_PACKET, 0,
source->get_sockaddr(source),
source->get_sockaddr_len(source));
getsockname(interface->socket_fd, dest->get_sockaddr(dest), dest->get_sockaddr_len(dest));
bytes_read = recv(interface->socket_fd, buffer, MAX_PACKET, 0);
break;
}
}
iterator->destroy(iterator);
if (bytes_read > 0)
if (bytes_read < 0)
{
this->logger->log(this->logger, ERROR, "error reading from socket: %s", strerror(errno));
continue;
}
if (bytes_read > IP_HEADER_LENGTH + UDP_HEADER_LENGTH)
{
/* read source/dest from raw IP/UDP header */
chunk_t source_chunk = {buffer + 12, 4};
chunk_t dest_chunk = {buffer + 16, 4};
u_int16_t source_port = ntohs(*(u_int16_t*)(buffer + 20));
u_int16_t dest_port = ntohs(*(u_int16_t*)(buffer + 22));
source = host_create_from_chunk(AF_INET, source_chunk, source_port);
dest = host_create_from_chunk(AF_INET, dest_chunk, dest_port);
pkt->set_source(pkt, source);
pkt->set_destination(pkt, dest);
break;
}
this->logger->log(this->logger, ERROR|LEVEL1, "too short packet received");
}
this->logger->log(this->logger, CONTROL, "received packet from %s:%d",
source->get_address(source),
source->get_port(source));
this->logger->log(this->logger, CONTROL, "received packet: from %s:%d to %s:%d",
source->get_address(source), source->get_port(source),
dest->get_address(dest), dest->get_port(dest));
/* fill in packet */
data.len = bytes_read;
data.len = bytes_read - IP_HEADER_LENGTH - UDP_HEADER_LENGTH;
data.ptr = allocator_alloc(data.len);
memcpy(data.ptr, buffer, data.len);
memcpy(data.ptr, buffer + IP_HEADER_LENGTH + UDP_HEADER_LENGTH, data.len);
pkt->set_data(pkt, data);
/* return packet */
@@ -291,7 +333,7 @@ static status_t build_interface_list(private_socket_t *this, u_int16_t port)
}
/* set up interface socket */
skt = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
skt = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
if (socket < 0)
{
this->logger->log(this->logger, ERROR, "unable to open interface socket!");
@@ -311,12 +353,21 @@ static status_t build_interface_list(private_socket_t *this, u_int16_t port)
close(skt);
continue;
}
if (setsockopt(skt, SOL_SOCKET, SO_ATTACH_FILTER, &ikev2_filter, sizeof(ikev2_filter)) < 0)
{
this->logger->log(this->logger, ERROR, "unable to attack IKEv2 filter to interface socket!");
close(skt);
continue;
}
/* add socket with interface name to list */
interface = allocator_alloc_thing(interface_t);
memcpy(interface->name, buf[i].ifr_name, IFNAMSIZ);
interface->name[IFNAMSIZ] = '\0';
interface->name[IFNAMSIZ-1] = '\0';
interface->socket_fd = skt;
this->logger->log(this->logger, CONTROL, "listening on %s (%s)",
interface->name, inet_ntoa(current->sin_addr));
this->interfaces->insert_last(this->interfaces, (void*)interface);
}
Source/charon/network/socket.h
+19 -11
View File
@@ -31,7 +31,7 @@
/**
* @brief Maximum size of a packet.
*
* 3000 Bytes should be sufficient, see IKEv2 draft.
* 3000 Bytes should be sufficient, see IKEv2 RFC.
*
* @ingroup network
*/
@@ -41,16 +41,24 @@
typedef struct socket_t socket_t;
/**
* @brief Abstraction of one (ipv4), or in future, of multiple sockets.
* @brief Abstraction all sockets (currently IPv4 only).
*
* Receiver reads from here, sender writes to here.
* All available IPv4 sockets are bound and the receive function
* reads from them. To allow binding of other daemons (pluto) to
* UDP/500, this implementation uses RAW sockets. An installed
* "Linux socket filter" filters out all non-IKEv2 traffic and handles
* just IKEv2 messages. An other daemon (pluto) must handle all traffic
* seperatly, e.g. ignore IKEv2 traffic, since charon handles that.
*
* @b Constructors:
* - socket_create()
*
* @todo add IPv6 support
*
* @todo allow listening/sending to multiple sockets, depending on address
* @todo We currently use multiple sockets for historic reasons. With the
* new RAW socket mechanism, we could use just one socket and filter
* addresses in userspace (or via linux socket filter). This would allow
* realtime interface/address management in a easy way...
*
* @ingroup network
*/
@@ -58,9 +66,8 @@ struct socket_t {
/**
* @brief Receive a packet.
*
* reads a packet from one of the sockets.
* source will be set, dest not implemented
*
* Reads a packet from the socket and sets source/dest
* appropriately.
*
* @param sock socket_t object to work on
* @param packet pinter gets address from allocated packet_t
@@ -73,8 +80,9 @@ struct socket_t {
/**
* @brief Send a packet.
*
* sends a packet via desired socket.
* uses source and dest in packet.
* Sends a packet to the net using destination from the packet.
* Packet is sent using default routing mechanisms, thus the
* source address in packet is ignored.
*
* @param sock socket_t object to work on
* @param packet[out] packet_t to send
@@ -95,10 +103,10 @@ struct socket_t {
};
/**
* @brief socket_t constructor.
* @brief Create a socket_t, wich binds multiple sockets.
*
* currently creates one socket, listening on all addresses
* on port.
* on "port".
*
* @param port port to bind socket to
* @return socket_t object