1 |
|
|
/* $OpenBSD: virtual.c,v 1.32 2015/08/20 22:02:21 deraadt Exp $ */ |
2 |
|
|
|
3 |
|
|
/* |
4 |
|
|
* Copyright (c) 2004 Håkan Olsson. All rights reserved. |
5 |
|
|
* |
6 |
|
|
* Redistribution and use in source and binary forms, with or without |
7 |
|
|
* modification, are permitted provided that the following conditions |
8 |
|
|
* are met: |
9 |
|
|
* 1. Redistributions of source code must retain the above copyright |
10 |
|
|
* notice, this list of conditions and the following disclaimer. |
11 |
|
|
* 2. Redistributions in binary form must reproduce the above copyright |
12 |
|
|
* notice, this list of conditions and the following disclaimer in the |
13 |
|
|
* documentation and/or other materials provided with the distribution. |
14 |
|
|
* |
15 |
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
16 |
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
17 |
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
18 |
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
19 |
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
20 |
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
21 |
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
22 |
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
23 |
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
24 |
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
25 |
|
|
*/ |
26 |
|
|
|
27 |
|
|
#include <sys/types.h> |
28 |
|
|
#include <sys/ioctl.h> |
29 |
|
|
#include <sys/socket.h> |
30 |
|
|
#include <sys/sockio.h> |
31 |
|
|
#include <net/if.h> |
32 |
|
|
#include <netinet/in.h> |
33 |
|
|
#include <netinet6/in6_var.h> |
34 |
|
|
#include <arpa/inet.h> |
35 |
|
|
#include <ctype.h> |
36 |
|
|
#include <limits.h> |
37 |
|
|
#include <netdb.h> |
38 |
|
|
#include <stdlib.h> |
39 |
|
|
#include <string.h> |
40 |
|
|
#include <unistd.h> |
41 |
|
|
|
42 |
|
|
#include "conf.h" |
43 |
|
|
#include "if.h" |
44 |
|
|
#include "exchange.h" |
45 |
|
|
#include "log.h" |
46 |
|
|
#include "message.h" |
47 |
|
|
#include "nat_traversal.h" |
48 |
|
|
#include "transport.h" |
49 |
|
|
#include "virtual.h" |
50 |
|
|
#include "udp.h" |
51 |
|
|
#include "util.h" |
52 |
|
|
|
53 |
|
|
#include "udp_encap.h" |
54 |
|
|
|
55 |
|
|
static struct transport *virtual_bind(const struct sockaddr *); |
56 |
|
|
static struct transport *virtual_bind_ADDR_ANY(sa_family_t); |
57 |
|
|
static int virtual_bind_if(char *, struct sockaddr *, void *); |
58 |
|
|
static struct transport *virtual_clone(struct transport *, struct sockaddr *); |
59 |
|
|
static struct transport *virtual_create(char *); |
60 |
|
|
static char *virtual_decode_ids (struct transport *); |
61 |
|
|
static void virtual_get_dst(struct transport *, |
62 |
|
|
struct sockaddr **); |
63 |
|
|
static struct msg_head *virtual_get_queue(struct message *); |
64 |
|
|
static void virtual_get_src(struct transport *, |
65 |
|
|
struct sockaddr **); |
66 |
|
|
static void virtual_handle_message(struct transport *); |
67 |
|
|
static void virtual_reinit(void); |
68 |
|
|
static void virtual_remove(struct transport *); |
69 |
|
|
static void virtual_report(struct transport *); |
70 |
|
|
static int virtual_send_message(struct message *, |
71 |
|
|
struct transport *); |
72 |
|
|
|
73 |
|
|
static struct transport_vtbl virtual_transport_vtbl = { |
74 |
|
|
{ 0 }, "udp", |
75 |
|
|
virtual_create, |
76 |
|
|
virtual_reinit, |
77 |
|
|
virtual_remove, |
78 |
|
|
virtual_report, |
79 |
|
|
0, |
80 |
|
|
0, |
81 |
|
|
virtual_handle_message, |
82 |
|
|
virtual_send_message, |
83 |
|
|
virtual_get_dst, |
84 |
|
|
virtual_get_src, |
85 |
|
|
virtual_decode_ids, |
86 |
|
|
virtual_clone, |
87 |
|
|
virtual_get_queue |
88 |
|
|
}; |
89 |
|
|
|
90 |
|
|
static LIST_HEAD (virtual_listen_list, virtual_transport) virtual_listen_list; |
91 |
|
|
static struct transport *default_transport, *default_transport6; |
92 |
|
|
|
93 |
|
|
void |
94 |
|
|
virtual_init(void) |
95 |
|
|
{ |
96 |
|
|
struct conf_list *listen_on; |
97 |
|
|
|
98 |
|
|
LIST_INIT(&virtual_listen_list); |
99 |
|
|
|
100 |
|
|
transport_method_add(&virtual_transport_vtbl); |
101 |
|
|
|
102 |
|
|
/* Bind the ISAKMP port(s) on all network interfaces we have. */ |
103 |
|
|
if (if_map(virtual_bind_if, 0) == -1) |
104 |
|
|
log_fatal("virtual_init: " |
105 |
|
|
"could not bind the ISAKMP port(s) on all interfaces"); |
106 |
|
|
|
107 |
|
|
/* Only listen to the specified address if Listen-on is configured */ |
108 |
|
|
listen_on = conf_get_list("General", "Listen-on"); |
109 |
|
|
if (listen_on) { |
110 |
|
|
LOG_DBG((LOG_TRANSPORT, 50, |
111 |
|
|
"virtual_init: not binding ISAKMP port(s) to ADDR_ANY")); |
112 |
|
|
conf_free_list(listen_on); |
113 |
|
|
return; |
114 |
|
|
} |
115 |
|
|
|
116 |
|
|
/* |
117 |
|
|
* Bind to INADDR_ANY in case of new addresses popping up. |
118 |
|
|
* Packet reception on this transport is taken as a hint to reprobe the |
119 |
|
|
* interface list. |
120 |
|
|
*/ |
121 |
|
|
if (!bind_family || (bind_family & BIND_FAMILY_INET4)) { |
122 |
|
|
default_transport = virtual_bind_ADDR_ANY(AF_INET); |
123 |
|
|
if (!default_transport) |
124 |
|
|
return; |
125 |
|
|
LIST_INSERT_HEAD(&virtual_listen_list, |
126 |
|
|
(struct virtual_transport *)default_transport, link); |
127 |
|
|
transport_reference(default_transport); |
128 |
|
|
} |
129 |
|
|
|
130 |
|
|
if (!bind_family || (bind_family & BIND_FAMILY_INET6)) { |
131 |
|
|
default_transport6 = virtual_bind_ADDR_ANY(AF_INET6); |
132 |
|
|
if (!default_transport6) |
133 |
|
|
return; |
134 |
|
|
LIST_INSERT_HEAD(&virtual_listen_list, |
135 |
|
|
(struct virtual_transport *)default_transport6, link); |
136 |
|
|
transport_reference(default_transport6); |
137 |
|
|
} |
138 |
|
|
} |
139 |
|
|
|
140 |
|
|
struct virtual_transport * |
141 |
|
|
virtual_get_default(sa_family_t af) |
142 |
|
|
{ |
143 |
|
|
switch (af) { |
144 |
|
|
case AF_INET: |
145 |
|
|
return (struct virtual_transport *)default_transport; |
146 |
|
|
case AF_INET6: |
147 |
|
|
return (struct virtual_transport *)default_transport6; |
148 |
|
|
default: |
149 |
|
|
return 0; |
150 |
|
|
} |
151 |
|
|
} |
152 |
|
|
|
153 |
|
|
/* |
154 |
|
|
* Probe the interface list and determine what new interfaces have |
155 |
|
|
* appeared. |
156 |
|
|
* |
157 |
|
|
* At the same time, we try to determine whether existing interfaces have |
158 |
|
|
* been rendered invalid; we do this by marking all virtual transports before |
159 |
|
|
* we call virtual_bind_if() through if_map(), and then releasing those |
160 |
|
|
* transports that have not been unmarked. |
161 |
|
|
*/ |
162 |
|
|
void |
163 |
|
|
virtual_reinit(void) |
164 |
|
|
{ |
165 |
|
|
struct virtual_transport *v, *v2; |
166 |
|
|
|
167 |
|
|
/* Mark all UDP transports, except the default ones. */ |
168 |
|
|
for (v = LIST_FIRST(&virtual_listen_list); v; v = LIST_NEXT(v, link)) |
169 |
|
|
if (&v->transport != default_transport && |
170 |
|
|
&v->transport != default_transport6) |
171 |
|
|
v->transport.flags |= TRANSPORT_MARK; |
172 |
|
|
|
173 |
|
|
/* Re-probe interface list. */ |
174 |
|
|
if (if_map(virtual_bind_if, 0) == -1) |
175 |
|
|
log_print("virtual_init: " |
176 |
|
|
"could not bind the ISAKMP port(s) on all interfaces"); |
177 |
|
|
|
178 |
|
|
/* |
179 |
|
|
* Release listening transports for local addresses that no |
180 |
|
|
* longer exist. virtual_bind_if () will have left those still marked. |
181 |
|
|
*/ |
182 |
|
|
v = LIST_FIRST(&virtual_listen_list); |
183 |
|
|
while (v) { |
184 |
|
|
v2 = LIST_NEXT(v, link); |
185 |
|
|
if (v->transport.flags & TRANSPORT_MARK) { |
186 |
|
|
LIST_REMOVE(v, link); |
187 |
|
|
transport_release(&v->transport); |
188 |
|
|
} |
189 |
|
|
v = v2; |
190 |
|
|
} |
191 |
|
|
} |
192 |
|
|
|
193 |
|
|
struct virtual_transport * |
194 |
|
|
virtual_listen_lookup(struct sockaddr *addr) |
195 |
|
|
{ |
196 |
|
|
struct virtual_transport *v; |
197 |
|
|
struct udp_transport *u; |
198 |
|
|
|
199 |
|
|
for (v = LIST_FIRST(&virtual_listen_list); v; |
200 |
|
|
v = LIST_NEXT(v, link)) { |
201 |
|
|
if (!(u = (struct udp_transport *)v->main)) |
202 |
|
|
if (!(u = (struct udp_transport *)v->encap)) { |
203 |
|
|
log_print("virtual_listen_lookup: " |
204 |
|
|
"virtual %p has no low-level transports", |
205 |
|
|
v); |
206 |
|
|
continue; |
207 |
|
|
} |
208 |
|
|
|
209 |
|
|
if (u->src->sa_family == addr->sa_family && |
210 |
|
|
sockaddr_addrlen(u->src) == sockaddr_addrlen(addr) && |
211 |
|
|
memcmp(sockaddr_addrdata (u->src), sockaddr_addrdata(addr), |
212 |
|
|
sockaddr_addrlen(addr)) == 0) |
213 |
|
|
return v; |
214 |
|
|
} |
215 |
|
|
|
216 |
|
|
LOG_DBG((LOG_TRANSPORT, 40, "virtual_listen_lookup: no match")); |
217 |
|
|
return 0; |
218 |
|
|
} |
219 |
|
|
|
220 |
|
|
/* |
221 |
|
|
* Initialize an object of the VIRTUAL transport class. |
222 |
|
|
*/ |
223 |
|
|
static struct transport * |
224 |
|
|
virtual_bind(const struct sockaddr *addr) |
225 |
|
|
{ |
226 |
|
|
struct virtual_transport *v; |
227 |
|
|
struct sockaddr_storage tmp_sa; |
228 |
|
|
char *stport; |
229 |
|
|
in_port_t port; |
230 |
|
|
|
231 |
|
|
v = calloc(1, sizeof *v); |
232 |
|
|
if (!v) { |
233 |
|
|
log_error("virtual_bind: calloc(1, %lu) failed", |
234 |
|
|
(unsigned long)sizeof *v); |
235 |
|
|
return 0; |
236 |
|
|
} |
237 |
|
|
|
238 |
|
|
v->transport.vtbl = &virtual_transport_vtbl; |
239 |
|
|
|
240 |
|
|
memcpy(&tmp_sa, addr, SA_LEN(addr)); |
241 |
|
|
|
242 |
|
|
/* Get port. */ |
243 |
|
|
stport = udp_default_port ? udp_default_port : UDP_DEFAULT_PORT_STR; |
244 |
|
|
port = text2port(stport); |
245 |
|
|
if (port == 0) { |
246 |
|
|
log_print("virtual_bind: bad port \"%s\"", stport); |
247 |
|
|
free(v); |
248 |
|
|
return 0; |
249 |
|
|
} |
250 |
|
|
|
251 |
|
|
sockaddr_set_port((struct sockaddr *)&tmp_sa, port); |
252 |
|
|
v->main = udp_bind((struct sockaddr *)&tmp_sa); |
253 |
|
|
if (!v->main) { |
254 |
|
|
free(v); |
255 |
|
|
return 0; |
256 |
|
|
} |
257 |
|
|
v->main->virtual = (struct transport *)v; |
258 |
|
|
|
259 |
|
|
if (!disable_nat_t) { |
260 |
|
|
memcpy(&tmp_sa, addr, SA_LEN(addr)); |
261 |
|
|
|
262 |
|
|
/* Get port. */ |
263 |
|
|
stport = udp_encap_default_port |
264 |
|
|
? udp_encap_default_port : UDP_ENCAP_DEFAULT_PORT_STR; |
265 |
|
|
port = text2port(stport); |
266 |
|
|
if (port == 0) { |
267 |
|
|
log_print("virtual_bind: bad encap port \"%s\"", |
268 |
|
|
stport); |
269 |
|
|
v->main->vtbl->remove(v->main); |
270 |
|
|
free(v); |
271 |
|
|
return 0; |
272 |
|
|
} |
273 |
|
|
|
274 |
|
|
sockaddr_set_port((struct sockaddr *)&tmp_sa, port); |
275 |
|
|
v->encap = udp_encap_bind((struct sockaddr *)&tmp_sa); |
276 |
|
|
if (!v->encap) { |
277 |
|
|
v->main->vtbl->remove(v->main); |
278 |
|
|
free(v); |
279 |
|
|
return 0; |
280 |
|
|
} |
281 |
|
|
v->encap->virtual = (struct transport *)v; |
282 |
|
|
} |
283 |
|
|
v->encap_is_active = 0; |
284 |
|
|
|
285 |
|
|
transport_setup(&v->transport, 1); |
286 |
|
|
v->transport.flags |= TRANSPORT_LISTEN; |
287 |
|
|
|
288 |
|
|
return (struct transport *)v; |
289 |
|
|
} |
290 |
|
|
|
291 |
|
|
static struct transport * |
292 |
|
|
virtual_bind_ADDR_ANY(sa_family_t af) |
293 |
|
|
{ |
294 |
|
|
struct sockaddr_storage dflt_stor; |
295 |
|
|
struct sockaddr_in *d4 = (struct sockaddr_in *)&dflt_stor; |
296 |
|
|
struct sockaddr_in6 *d6 = (struct sockaddr_in6 *)&dflt_stor; |
297 |
|
|
struct transport *t; |
298 |
|
|
struct in6_addr in6addr_any = IN6ADDR_ANY_INIT; |
299 |
|
|
|
300 |
|
|
bzero(&dflt_stor, sizeof dflt_stor); |
301 |
|
|
switch (af) { |
302 |
|
|
case AF_INET: |
303 |
|
|
d4->sin_family = af; |
304 |
|
|
d4->sin_len = sizeof(struct sockaddr_in); |
305 |
|
|
d4->sin_addr.s_addr = INADDR_ANY; |
306 |
|
|
break; |
307 |
|
|
|
308 |
|
|
case AF_INET6: |
309 |
|
|
d6->sin6_family = af; |
310 |
|
|
d6->sin6_len = sizeof(struct sockaddr_in6); |
311 |
|
|
memcpy(&d6->sin6_addr.s6_addr, &in6addr_any, |
312 |
|
|
sizeof in6addr_any); |
313 |
|
|
break; |
314 |
|
|
} |
315 |
|
|
|
316 |
|
|
t = virtual_bind((struct sockaddr *)&dflt_stor); |
317 |
|
|
if (!t) |
318 |
|
|
log_error("virtual_bind_ADDR_ANY: " |
319 |
|
|
"could not allocate default IPv%s ISAKMP port(s)", |
320 |
|
|
af == AF_INET ? "4" : "6"); |
321 |
|
|
return t; |
322 |
|
|
} |
323 |
|
|
|
324 |
|
|
static int |
325 |
|
|
virtual_bind_if(char *ifname, struct sockaddr *if_addr, void *arg) |
326 |
|
|
{ |
327 |
|
|
struct conf_list *listen_on; |
328 |
|
|
struct virtual_transport *v; |
329 |
|
|
struct conf_list_node *address; |
330 |
|
|
struct sockaddr *addr; |
331 |
|
|
struct transport *t; |
332 |
|
|
struct ifreq flags_ifr; |
333 |
|
|
struct in6_ifreq flags_ifr6; |
334 |
|
|
char *addr_str; |
335 |
|
|
int s, error; |
336 |
|
|
|
337 |
|
|
if (sockaddr2text(if_addr, &addr_str, 0)) |
338 |
|
|
addr_str = 0; |
339 |
|
|
|
340 |
|
|
LOG_DBG((LOG_TRANSPORT, 90, |
341 |
|
|
"virtual_bind_if: interface %s family %s address %s", |
342 |
|
|
ifname ? ifname : "<unknown>", |
343 |
|
|
if_addr->sa_family == AF_INET ? "v4" : |
344 |
|
|
(if_addr->sa_family == AF_INET6 ? "v6" : "<unknown>"), |
345 |
|
|
addr_str ? addr_str : "<invalid>")); |
346 |
|
|
free(addr_str); |
347 |
|
|
|
348 |
|
|
/* |
349 |
|
|
* Drop non-Internet stuff. |
350 |
|
|
*/ |
351 |
|
|
if ((if_addr->sa_family != AF_INET || |
352 |
|
|
SA_LEN(if_addr) != sizeof (struct sockaddr_in)) && |
353 |
|
|
(if_addr->sa_family != AF_INET6 || |
354 |
|
|
SA_LEN(if_addr) != sizeof (struct sockaddr_in6))) |
355 |
|
|
return 0; |
356 |
|
|
|
357 |
|
|
/* |
358 |
|
|
* Only create sockets for families we should listen to. |
359 |
|
|
*/ |
360 |
|
|
if (bind_family) |
361 |
|
|
switch (if_addr->sa_family) { |
362 |
|
|
case AF_INET: |
363 |
|
|
if ((bind_family & BIND_FAMILY_INET4) == 0) |
364 |
|
|
return 0; |
365 |
|
|
break; |
366 |
|
|
case AF_INET6: |
367 |
|
|
if ((bind_family & BIND_FAMILY_INET6) == 0) |
368 |
|
|
return 0; |
369 |
|
|
break; |
370 |
|
|
default: |
371 |
|
|
return 0; |
372 |
|
|
} |
373 |
|
|
|
374 |
|
|
/* |
375 |
|
|
* These special addresses are not useable as they have special meaning |
376 |
|
|
* in the IP stack. |
377 |
|
|
*/ |
378 |
|
|
if (if_addr->sa_family == AF_INET && |
379 |
|
|
(((struct sockaddr_in *)if_addr)->sin_addr.s_addr == INADDR_ANY || |
380 |
|
|
(((struct sockaddr_in *)if_addr)->sin_addr.s_addr == INADDR_NONE))) |
381 |
|
|
return 0; |
382 |
|
|
|
383 |
|
|
/* |
384 |
|
|
* Go through the list of transports and see if we already have this |
385 |
|
|
* address bound. If so, unmark the transport and skip it; this allows |
386 |
|
|
* us to call this function when we suspect a new address has appeared. |
387 |
|
|
*/ |
388 |
|
|
if ((v = virtual_listen_lookup(if_addr)) != 0) { |
389 |
|
|
LOG_DBG ((LOG_TRANSPORT, 90, "virtual_bind_if: " |
390 |
|
|
"already bound")); |
391 |
|
|
v->transport.flags &= ~TRANSPORT_MARK; |
392 |
|
|
return 0; |
393 |
|
|
} |
394 |
|
|
|
395 |
|
|
/* |
396 |
|
|
* Don't bother with interfaces that are down. |
397 |
|
|
* Note: This socket is only used to collect the interface status, |
398 |
|
|
* rtables and inet6 addresses. |
399 |
|
|
*/ |
400 |
|
|
s = socket(if_addr->sa_family, SOCK_DGRAM, 0); |
401 |
|
|
if (s == -1) { |
402 |
|
|
log_error("virtual_bind_if: " |
403 |
|
|
"socket (%d, SOCK_DGRAM, 0) failed", if_addr->sa_family); |
404 |
|
|
return -1; |
405 |
|
|
} |
406 |
|
|
strlcpy(flags_ifr.ifr_name, ifname, sizeof flags_ifr.ifr_name); |
407 |
|
|
if (ioctl(s, SIOCGIFFLAGS, (caddr_t)&flags_ifr) == -1) { |
408 |
|
|
log_error("virtual_bind_if: " |
409 |
|
|
"ioctl (%d, SIOCGIFFLAGS, ...) failed", s); |
410 |
|
|
close(s); |
411 |
|
|
return -1; |
412 |
|
|
} |
413 |
|
|
if (!(flags_ifr.ifr_flags & IFF_UP)) { |
414 |
|
|
close(s); |
415 |
|
|
return 0; |
416 |
|
|
} |
417 |
|
|
/* Also skip tentative addresses during DAD since bind(2) would fail. */ |
418 |
|
|
if (if_addr->sa_family == AF_INET6) { |
419 |
|
|
memset(&flags_ifr6, 0, sizeof(flags_ifr6)); |
420 |
|
|
strlcpy(flags_ifr6.ifr_name, ifname, sizeof flags_ifr6.ifr_name); |
421 |
|
|
flags_ifr6.ifr_addr = *(struct sockaddr_in6 *)if_addr; |
422 |
|
|
if (ioctl(s, SIOCGIFAFLAG_IN6, (caddr_t)&flags_ifr6) < 0) { |
423 |
|
|
log_error("virtual_bind_if: " |
424 |
|
|
"ioctl (%d, SIOCGIFAFLAG_IN6, ...) failed", s); |
425 |
|
|
close(s); |
426 |
|
|
return 0; |
427 |
|
|
} |
428 |
|
|
if (flags_ifr6.ifr_ifru.ifru_flags6 & (IN6_IFF_ANYCAST| |
429 |
|
|
IN6_IFF_TENTATIVE|IN6_IFF_DUPLICATED|IN6_IFF_DETACHED)) { |
430 |
|
|
error = sockaddr2text(if_addr, &addr_str, 0); |
431 |
|
|
log_print("virtual_bind_if: " |
432 |
|
|
"IPv6 address %s not ready (flags 0x%x)", |
433 |
|
|
error ? "unknown" : addr_str, |
434 |
|
|
flags_ifr6.ifr_ifru.ifru_flags6); |
435 |
|
|
/* XXX schedule an interface rescan */ |
436 |
|
|
if (!error) |
437 |
|
|
free(addr_str); |
438 |
|
|
close(s); |
439 |
|
|
return 0; |
440 |
|
|
} |
441 |
|
|
} |
442 |
|
|
|
443 |
|
|
if (ioctl(s, SIOCGIFRDOMAIN, (caddr_t)&flags_ifr) == -1) { |
444 |
|
|
log_error("virtual_bind_if: " |
445 |
|
|
"ioctl (%d, SIOCGIFRDOMAIN, ...) failed", s); |
446 |
|
|
close(s); |
447 |
|
|
return -1; |
448 |
|
|
} |
449 |
|
|
|
450 |
|
|
/* |
451 |
|
|
* Ignore interfaces outside of our rtable |
452 |
|
|
*/ |
453 |
|
|
if (getrtable() != flags_ifr.ifr_rdomainid) { |
454 |
|
|
close(s); |
455 |
|
|
return 0; |
456 |
|
|
} |
457 |
|
|
|
458 |
|
|
close(s); |
459 |
|
|
|
460 |
|
|
/* Set the port number to zero. */ |
461 |
|
|
switch (if_addr->sa_family) { |
462 |
|
|
case AF_INET: |
463 |
|
|
((struct sockaddr_in *)if_addr)->sin_port = htons(0); |
464 |
|
|
break; |
465 |
|
|
case AF_INET6: |
466 |
|
|
((struct sockaddr_in6 *)if_addr)->sin6_port = htons(0); |
467 |
|
|
break; |
468 |
|
|
default: |
469 |
|
|
log_print("virtual_bind_if: unsupported protocol family %d", |
470 |
|
|
if_addr->sa_family); |
471 |
|
|
break; |
472 |
|
|
} |
473 |
|
|
|
474 |
|
|
/* |
475 |
|
|
* If we are explicit about what addresses we can listen to, be sure |
476 |
|
|
* to respect that option. |
477 |
|
|
* This is quite wasteful redoing the list-run for every interface, |
478 |
|
|
* but who cares? This is not an operation that needs to be fast. |
479 |
|
|
*/ |
480 |
|
|
listen_on = conf_get_list("General", "Listen-on"); |
481 |
|
|
if (listen_on) { |
482 |
|
|
for (address = TAILQ_FIRST(&listen_on->fields); address; |
483 |
|
|
address = TAILQ_NEXT(address, link)) { |
484 |
|
|
if (text2sockaddr(address->field, 0, &addr, 0, 0)) { |
485 |
|
|
log_print("virtual_bind_if: " |
486 |
|
|
"invalid address %s in \"Listen-on\"", |
487 |
|
|
address->field); |
488 |
|
|
continue; |
489 |
|
|
} |
490 |
|
|
|
491 |
|
|
/* If found, take the easy way out. */ |
492 |
|
|
if (memcmp(addr, if_addr, SA_LEN(addr)) == 0) { |
493 |
|
|
free(addr); |
494 |
|
|
break; |
495 |
|
|
} |
496 |
|
|
free(addr); |
497 |
|
|
} |
498 |
|
|
conf_free_list(listen_on); |
499 |
|
|
|
500 |
|
|
/* |
501 |
|
|
* If address is zero then we did not find the address among |
502 |
|
|
* the ones we should listen to. |
503 |
|
|
* XXX We do not discover if we do not find our listen |
504 |
|
|
* addresses. Maybe this should be the other way round. |
505 |
|
|
*/ |
506 |
|
|
if (!address) |
507 |
|
|
return 0; |
508 |
|
|
} |
509 |
|
|
|
510 |
|
|
t = virtual_bind(if_addr); |
511 |
|
|
if (!t) { |
512 |
|
|
error = sockaddr2text(if_addr, &addr_str, 0); |
513 |
|
|
log_print("virtual_bind_if: failed to create a socket on %s", |
514 |
|
|
error ? "unknown" : addr_str); |
515 |
|
|
if (!error) |
516 |
|
|
free(addr_str); |
517 |
|
|
return -1; |
518 |
|
|
} |
519 |
|
|
LIST_INSERT_HEAD(&virtual_listen_list, (struct virtual_transport *)t, |
520 |
|
|
link); |
521 |
|
|
transport_reference(t); |
522 |
|
|
return 0; |
523 |
|
|
} |
524 |
|
|
|
525 |
|
|
static struct transport * |
526 |
|
|
virtual_clone(struct transport *vt, struct sockaddr *raddr) |
527 |
|
|
{ |
528 |
|
|
struct virtual_transport *v = (struct virtual_transport *)vt; |
529 |
|
|
struct virtual_transport *v2; |
530 |
|
|
struct transport *t; |
531 |
|
|
char *stport; |
532 |
|
|
in_port_t port; |
533 |
|
|
|
534 |
|
|
t = malloc(sizeof *v); |
535 |
|
|
if (!t) { |
536 |
|
|
log_error("virtual_clone: malloc(%lu) failed", |
537 |
|
|
(unsigned long)sizeof *v); |
538 |
|
|
return 0; |
539 |
|
|
} |
540 |
|
|
v2 = (struct virtual_transport *)t; |
541 |
|
|
|
542 |
|
|
memcpy(v2, v, sizeof *v); |
543 |
|
|
/* Remove the copy's links into virtual_listen_list. */ |
544 |
|
|
memset(&v2->link, 0, sizeof v2->link); |
545 |
|
|
|
546 |
|
|
if (v->encap_is_active) |
547 |
|
|
v2->main = 0; /* No need to clone this. */ |
548 |
|
|
else { |
549 |
|
|
v2->main = v->main->vtbl->clone(v->main, raddr); |
550 |
|
|
v2->main->virtual = (struct transport *)v2; |
551 |
|
|
} |
552 |
|
|
if (!disable_nat_t) { |
553 |
|
|
stport = udp_encap_default_port ? udp_encap_default_port : |
554 |
|
|
UDP_ENCAP_DEFAULT_PORT_STR; |
555 |
|
|
port = text2port(stport); |
556 |
|
|
if (port == 0) { |
557 |
|
|
log_print("virtual_clone: port string \"%s\" not convertible " |
558 |
|
|
"to in_port_t", stport); |
559 |
|
|
free(t); |
560 |
|
|
return 0; |
561 |
|
|
} |
562 |
|
|
sockaddr_set_port(raddr, port); |
563 |
|
|
v2->encap = v->encap->vtbl->clone(v->encap, raddr); |
564 |
|
|
v2->encap->virtual = (struct transport *)v2; |
565 |
|
|
} |
566 |
|
|
LOG_DBG((LOG_TRANSPORT, 50, "virtual_clone: old %p new %p (%s is %p)", |
567 |
|
|
v, t, v->encap_is_active ? "encap" : "main", |
568 |
|
|
v->encap_is_active ? v2->encap : v2->main)); |
569 |
|
|
|
570 |
|
|
t->flags &= ~TRANSPORT_LISTEN; |
571 |
|
|
transport_setup(t, 1); |
572 |
|
|
return t; |
573 |
|
|
} |
574 |
|
|
|
575 |
|
|
static struct transport * |
576 |
|
|
virtual_create(char *name) |
577 |
|
|
{ |
578 |
|
|
struct virtual_transport *v; |
579 |
|
|
struct transport *t, *t2 = 0; |
580 |
|
|
|
581 |
|
|
t = transport_create("udp_physical", name); |
582 |
|
|
if (!t) |
583 |
|
|
return 0; |
584 |
|
|
|
585 |
|
|
if (!disable_nat_t) { |
586 |
|
|
t2 = transport_create("udp_encap", name); |
587 |
|
|
if (!t2) { |
588 |
|
|
t->vtbl->remove(t); |
589 |
|
|
return 0; |
590 |
|
|
} |
591 |
|
|
} |
592 |
|
|
|
593 |
|
|
v = calloc(1, sizeof *v); |
594 |
|
|
if (!v) { |
595 |
|
|
log_error("virtual_create: calloc(1, %lu) failed", |
596 |
|
|
(unsigned long)sizeof *v); |
597 |
|
|
t->vtbl->remove(t); |
598 |
|
|
if (t2) |
599 |
|
|
t2->vtbl->remove(t2); |
600 |
|
|
return 0; |
601 |
|
|
} |
602 |
|
|
|
603 |
|
|
memcpy(v, t, sizeof *t); |
604 |
|
|
v->transport.virtual = 0; |
605 |
|
|
v->main = t; |
606 |
|
|
v->encap = t2; |
607 |
|
|
v->transport.vtbl = &virtual_transport_vtbl; |
608 |
|
|
t->virtual = (struct transport *)v; |
609 |
|
|
if (t2) |
610 |
|
|
t2->virtual = (struct transport *)v; |
611 |
|
|
transport_setup(&v->transport, 1); |
612 |
|
|
return (struct transport *)v; |
613 |
|
|
} |
614 |
|
|
|
615 |
|
|
static void |
616 |
|
|
virtual_remove(struct transport *t) |
617 |
|
|
{ |
618 |
|
|
struct virtual_transport *p, *v = (struct virtual_transport *)t; |
619 |
|
|
|
620 |
|
|
if (v->encap) |
621 |
|
|
v->encap->vtbl->remove(v->encap); |
622 |
|
|
if (v->main) |
623 |
|
|
v->main->vtbl->remove(v->main); |
624 |
|
|
|
625 |
|
|
for (p = LIST_FIRST(&virtual_listen_list); p && p != v; p = |
626 |
|
|
LIST_NEXT(p, link)) |
627 |
|
|
; |
628 |
|
|
if (p == v) |
629 |
|
|
LIST_REMOVE(v, link); |
630 |
|
|
|
631 |
|
|
LOG_DBG((LOG_TRANSPORT, 90, "virtual_remove: removed %p", v)); |
632 |
|
|
free(t); |
633 |
|
|
} |
634 |
|
|
|
635 |
|
|
static void |
636 |
|
|
virtual_report(struct transport *t) |
637 |
|
|
{ |
638 |
|
|
} |
639 |
|
|
|
640 |
|
|
static void |
641 |
|
|
virtual_handle_message(struct transport *t) |
642 |
|
|
{ |
643 |
|
|
/* |
644 |
|
|
* As per the NAT-T draft, in case we have already switched ports, |
645 |
|
|
* any messages received on the old (500) port SHOULD be discarded. |
646 |
|
|
* (Actually, while phase 1 messages should be discarded, |
647 |
|
|
* informational exchanges MAY be processed normally. For now, we |
648 |
|
|
* discard them all.) |
649 |
|
|
*/ |
650 |
|
|
if (((struct virtual_transport *)t->virtual)->encap_is_active && |
651 |
|
|
((struct virtual_transport *)t->virtual)->main == t) { |
652 |
|
|
LOG_DBG((LOG_MESSAGE, 10, "virtual_handle_message: " |
653 |
|
|
"message on old port discarded")); |
654 |
|
|
return; |
655 |
|
|
} |
656 |
|
|
|
657 |
|
|
t->vtbl->handle_message(t); |
658 |
|
|
} |
659 |
|
|
|
660 |
|
|
static int |
661 |
|
|
virtual_send_message(struct message *msg, struct transport *t) |
662 |
|
|
{ |
663 |
|
|
struct virtual_transport *v = |
664 |
|
|
(struct virtual_transport *)msg->transport; |
665 |
|
|
struct sockaddr *dst; |
666 |
|
|
in_port_t port, default_port; |
667 |
|
|
|
668 |
|
|
/* |
669 |
|
|
* Activate NAT-T Encapsulation if |
670 |
|
|
* - the exchange says we can, and |
671 |
|
|
* - in ID_PROT, after step 4 (draft-ietf-ipsec-nat-t-ike-03), or |
672 |
|
|
* - in other exchange (Aggressive, ), asap |
673 |
|
|
* XXX ISAKMP_EXCH_BASE etc? |
674 |
|
|
*/ |
675 |
|
|
|
676 |
|
|
if (msg->flags & MSG_NATT) { |
677 |
|
|
msg->exchange->flags |= EXCHANGE_FLAG_NAT_T_ENABLE; |
678 |
|
|
msg->exchange->flags |= EXCHANGE_FLAG_NAT_T_CAP_PEER; |
679 |
|
|
} |
680 |
|
|
|
681 |
|
|
if ((v->encap_is_active == 0 && |
682 |
|
|
(msg->exchange->flags & EXCHANGE_FLAG_NAT_T_ENABLE) && |
683 |
|
|
(msg->exchange->type != ISAKMP_EXCH_ID_PROT || |
684 |
|
|
msg->exchange->step > 4)) || (msg->flags & MSG_NATT)) { |
685 |
|
|
LOG_DBG((LOG_MESSAGE, 10, "virtual_send_message: " |
686 |
|
|
"enabling NAT-T encapsulation for this exchange")); |
687 |
|
|
v->encap_is_active++; |
688 |
|
|
|
689 |
|
|
/* Copy destination port if it is translated (NAT). */ |
690 |
|
|
v->main->vtbl->get_dst(v->main, &dst); |
691 |
|
|
port = ntohs(sockaddr_port(dst)); |
692 |
|
|
|
693 |
|
|
if (udp_default_port) |
694 |
|
|
default_port = text2port(udp_default_port); |
695 |
|
|
else |
696 |
|
|
default_port = UDP_DEFAULT_PORT; |
697 |
|
|
if (port != default_port) { |
698 |
|
|
v->main->vtbl->get_dst(v->encap, &dst); |
699 |
|
|
sockaddr_set_port(dst, port); |
700 |
|
|
} |
701 |
|
|
} |
702 |
|
|
|
703 |
|
|
if (v->encap_is_active) |
704 |
|
|
return v->encap->vtbl->send_message(msg, v->encap); |
705 |
|
|
else |
706 |
|
|
return v->main->vtbl->send_message(msg, v->main); |
707 |
|
|
} |
708 |
|
|
|
709 |
|
|
static void |
710 |
|
|
virtual_get_src(struct transport *t, struct sockaddr **s) |
711 |
|
|
{ |
712 |
|
|
struct virtual_transport *v = (struct virtual_transport *)t; |
713 |
|
|
|
714 |
|
|
if (v->encap_is_active) |
715 |
|
|
v->encap->vtbl->get_src(v->encap, s); |
716 |
|
|
else |
717 |
|
|
v->main->vtbl->get_src(v->main, s); |
718 |
|
|
} |
719 |
|
|
|
720 |
|
|
static void |
721 |
|
|
virtual_get_dst(struct transport *t, struct sockaddr **s) |
722 |
|
|
{ |
723 |
|
|
struct virtual_transport *v = (struct virtual_transport *)t; |
724 |
|
|
|
725 |
|
|
if (v->encap_is_active) |
726 |
|
|
v->encap->vtbl->get_dst(v->encap, s); |
727 |
|
|
else |
728 |
|
|
v->main->vtbl->get_dst(v->main, s); |
729 |
|
|
} |
730 |
|
|
|
731 |
|
|
static char * |
732 |
|
|
virtual_decode_ids(struct transport *t) |
733 |
|
|
{ |
734 |
|
|
struct virtual_transport *v = (struct virtual_transport *)t; |
735 |
|
|
|
736 |
|
|
if (v->encap_is_active) |
737 |
|
|
return v->encap->vtbl->decode_ids(t); |
738 |
|
|
else |
739 |
|
|
return v->main->vtbl->decode_ids(t); |
740 |
|
|
} |
741 |
|
|
|
742 |
|
|
static struct msg_head * |
743 |
|
|
virtual_get_queue(struct message *msg) |
744 |
|
|
{ |
745 |
|
|
if (msg->flags & MSG_PRIORITIZED) |
746 |
|
|
return &msg->transport->prio_sendq; |
747 |
|
|
else |
748 |
|
|
return &msg->transport->sendq; |
749 |
|
|
} |