strongswan/src/libcharon/plugins/forecast/forecast_listener.c

/*
 * Copyright (C) 2015 Tobias Brunner
 * HSR Hochschule fuer Technik Rapperswil
 *
 * Copyright (C) 2010-2014 Martin Willi
 * Copyright (C) 2010-2014 revosec AG
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */

#include "forecast_listener.h"

#include <errno.h>
#include <libiptc/libiptc.h>
#include <linux/netfilter/xt_MARK.h>
#include <linux/netfilter/xt_esp.h>

#include <daemon.h>
#include <collections/array.h>
#include <collections/hashtable.h>
#include <threading/rwlock.h>

/**
 * Add a struct at the current position in the buffer
 */
#define ADD_STRUCT(pos, st, ...) ({\
	typeof(pos) _cur = pos; pos += XT_ALIGN(sizeof(st));\
	*(st*)_cur = (st){ __VA_ARGS__ };\
	(st*)_cur;\
})

typedef struct private_forecast_listener_t private_forecast_listener_t;

/**
 * Private data of an forecast_listener_t object.
 */
struct private_forecast_listener_t {

	/**
	 * Public forecast_listener_t interface.
	 */
	forecast_listener_t public;

	/**
	 * List of entries
	 */
	linked_list_t *entries;

	/**
	 * RWlock for IP list
	 */
	rwlock_t *lock;

	/**
	 * Configs we do reinjection
	 */
	char *reinject_configs;

	/**
	 * Broadcast address on LAN interface, network order
	 */
	uint32_t broadcast;
};

/**
 * Hashtable entry
 */
typedef struct {
	/** local traffic selectors */
	array_t *lts;
	/** remote traffic selectors */
	array_t *rts;
	/** firewall mark used by CHILD_SA */
	u_int mark;
	/** local IKE_SA endpoint */
	host_t *lhost;
	/** remote IKE_SA endpoint */
	host_t *rhost;
	/** inbound SPI */
	uint32_t spi;
	/** use UDP encapsulation */
	bool encap;
	/** whether we should allow reencapsulation of IPsec received forecasts */
	bool reinject;
	/** broadcast address used for that entry */
	uint32_t broadcast;
} entry_t;

/**
 * Destroy an entry
 */
static void entry_destroy(entry_t *entry)
{
	if (entry)
	{
		entry->lhost->destroy(entry->lhost);
		entry->rhost->destroy(entry->rhost);
		array_destroy_offset(entry->lts, offsetof(traffic_selector_t, destroy));
		array_destroy_offset(entry->rts, offsetof(traffic_selector_t, destroy));
		free(entry);
	}
}

/**
 * Convert an (IPv4) traffic selector to an address and mask
 */
static bool ts2in(traffic_selector_t *ts,
				  struct in_addr *addr, struct in_addr *mask)
{
	uint8_t bits;
	host_t *net;

	if (ts->get_type(ts) == TS_IPV4_ADDR_RANGE &&
		ts->to_subnet(ts, &net, &bits))
	{
		memcpy(&addr->s_addr, net->get_address(net).ptr, 4);
		net->destroy(net);
		mask->s_addr = htonl(0xffffffffU << (32 - bits));
		return TRUE;
	}
	return FALSE;
}

/**
 * Convert an (IPv4) host to an address with mask
 */
static bool host2in(host_t *host, struct in_addr *addr, struct in_addr *mask)
{
	if (host->get_family(host) == AF_INET)
	{
		memcpy(&addr->s_addr, host->get_address(host).ptr, 4);
		mask->s_addr = ~0;
		return TRUE;
	}
	return FALSE;
}

/**
 * Add or remove a rule to/from the specified chain
 */
static bool manage_rule(struct iptc_handle *ipth, const char *chain,
						bool add, struct ipt_entry *e)
{
	if (add)
	{
		if (!iptc_insert_entry(chain, e, 0, ipth))
		{
			DBG1(DBG_CFG, "appending %s rule failed: %s",
				 chain, iptc_strerror(errno));
			return FALSE;
		}
	}
	else
	{
		u_char matchmask[e->next_offset];

		memset(matchmask, 255, sizeof(matchmask));
		if (!iptc_delete_entry(chain, e, matchmask, ipth))
		{
			DBG1(DBG_CFG, "deleting %s rule failed: %s",
				 chain, iptc_strerror(errno));
			return FALSE;
		}
	}
	return TRUE;
}

/**
 * Add rule marking UDP-encapsulated ESP packets to match the correct policy
 */
static bool manage_pre_esp_in_udp(struct iptc_handle *ipth,
								  entry_t *entry, bool add)
{
	uint16_t match_size	= XT_ALIGN(sizeof(struct ipt_entry_match)) +
							  XT_ALIGN(sizeof(struct xt_udp));
	uint16_t target_offset = XT_ALIGN(sizeof(struct ipt_entry)) + match_size;
	uint16_t target_size	= XT_ALIGN(sizeof(struct ipt_entry_target)) +
							  XT_ALIGN(sizeof(struct xt_mark_tginfo2));
	uint16_t entry_size	= target_offset + target_size;
	u_char ipt[entry_size], *pos = ipt;
	struct ipt_entry *e;

	memset(ipt, 0, sizeof(ipt));
	e = ADD_STRUCT(pos, struct ipt_entry,
		.target_offset = target_offset,
		.next_offset = entry_size,
		.ip = {
			.proto = IPPROTO_UDP,
		},
	);
	if (!host2in(entry->lhost, &e->ip.dst, &e->ip.dmsk) ||
		!host2in(entry->rhost, &e->ip.src, &e->ip.smsk))
	{
		return FALSE;
	}
	ADD_STRUCT(pos, struct ipt_entry_match,
		.u = {
			.user = {
				.match_size = match_size,
				.name = "udp",
			},
		},
	);
	ADD_STRUCT(pos, struct xt_udp,
		.spts = {
			entry->rhost->get_port(entry->rhost),
			entry->rhost->get_port(entry->rhost)
		},
		.dpts = {
			entry->lhost->get_port(entry->lhost),
			entry->lhost->get_port(entry->lhost)
		},
	);
	ADD_STRUCT(pos, struct ipt_entry_target,
		.u = {
			.user = {
				.target_size = target_size,
				.name = "MARK",
				.revision = 2,
			},
		},
	);
	ADD_STRUCT(pos, struct xt_mark_tginfo2,
		.mark = entry->mark,
		.mask = ~0,
	);
	return manage_rule(ipth, "PREROUTING", add, e);
}

/**
 * Add rule marking non-encapsulated ESP packets to match the correct policy
 */
static bool manage_pre_esp(struct iptc_handle *ipth, entry_t *entry, bool add)
{
	uint16_t match_size	= XT_ALIGN(sizeof(struct ipt_entry_match)) +
							  XT_ALIGN(sizeof(struct xt_esp));
	uint16_t target_offset = XT_ALIGN(sizeof(struct ipt_entry)) + match_size;
	uint16_t target_size	= XT_ALIGN(sizeof(struct ipt_entry_target)) +
							  XT_ALIGN(sizeof(struct xt_mark_tginfo2));
	uint16_t entry_size	= target_offset + target_size;
	u_char ipt[entry_size], *pos = ipt;
	struct ipt_entry *e;

	memset(ipt, 0, sizeof(ipt));
	e = ADD_STRUCT(pos, struct ipt_entry,
		.target_offset = target_offset,
		.next_offset = entry_size,
		.ip = {
			.proto = IPPROTO_ESP,
		},
	);
	if (!host2in(entry->lhost, &e->ip.dst, &e->ip.dmsk) ||
		!host2in(entry->rhost, &e->ip.src, &e->ip.smsk))
	{
		return FALSE;
	}
	ADD_STRUCT(pos, struct ipt_entry_match,
		.u = {
			.user = {
				.match_size = match_size,
				.name = "esp",
			},
		},
	);
	ADD_STRUCT(pos, struct xt_esp,
		.spis = { htonl(entry->spi), htonl(entry->spi) },
	);
	ADD_STRUCT(pos, struct ipt_entry_target,
		.u = {
			.user = {
				.target_size = target_size,
				.name = "MARK",
				.revision = 2,
			},
		},
	);
	ADD_STRUCT(pos, struct xt_mark_tginfo2,
		.mark = entry->mark,
		.mask = ~0,
	);
	return manage_rule(ipth, "PREROUTING", add, e);
}

/**
 * Add rule marking ESP packets to match the correct policy
 */
static bool manage_pre(struct iptc_handle *ipth, entry_t *entry, bool add)
{
	if (entry->encap)
	{
		return manage_pre_esp_in_udp(ipth, entry, add);
	}
	return manage_pre_esp(ipth, entry, add);
}

/**
 * Add rule handling outbound traffic to use correct mark
 */
static bool manage_out(struct iptc_handle *ipth, entry_t *entry, bool add)
{
	uint16_t target_offset = XT_ALIGN(sizeof(struct ipt_entry));
	uint16_t target_size	= XT_ALIGN(sizeof(struct ipt_entry_target)) +
							  XT_ALIGN(sizeof(struct xt_mark_tginfo2));
	uint16_t entry_size	= target_offset + target_size;
	u_char ipt[entry_size], *pos = ipt;
	struct ipt_entry *e;

	memset(ipt, 0, sizeof(ipt));
	e = ADD_STRUCT(pos, struct ipt_entry,
		.target_offset = target_offset,
		.next_offset = entry_size,
	);
	ADD_STRUCT(pos, struct ipt_entry_target,
		.u = {
			.user = {
				.target_size = target_size,
				.name = "MARK",
				.revision = 2,
			},
		},
	);
	ADD_STRUCT(pos, struct xt_mark_tginfo2,
		.mark = entry->mark,
		.mask = ~0,
	);

	enumerator_t *enumerator;
	traffic_selector_t *ts;

	enumerator = array_create_enumerator(entry->rts);
	while (enumerator->enumerate(enumerator, &ts))
	{
		if (!ts2in(ts, &e->ip.dst, &e->ip.dmsk))
		{
			continue;
		}
		if (e->ip.dst.s_addr == 0xffffffff ||
			e->ip.dst.s_addr == entry->broadcast ||
			memeq(&e->ip.dst.s_addr, "\xe0", 1))
		{
			/* skip broadcast/multicast selectors, they are shared and the mark
			 * is set by the socket we use for reinjection */
			continue;
		}
		if (!manage_rule(ipth, "PREROUTING", add, e) ||
			!manage_rule(ipth, "OUTPUT", add, e))
		{
			enumerator->destroy(enumerator);
			return FALSE;
		}
	}
	enumerator->destroy(enumerator);

	return TRUE;
}

/**
 * Check if config is whitelisted to reinject traffic
 */
static bool is_reinject_config(private_forecast_listener_t *this, char *name)
{
	enumerator_t *enumerator;
	bool reinject = FALSE;
	char *token;

	enumerator = enumerator_create_token(this->reinject_configs, ",", " ");
	while (enumerator->enumerate(enumerator, &token))
	{
		if (streq(token, name))
		{
			reinject = TRUE;
			break;
		}
	}
	enumerator->destroy(enumerator);

	return reinject;
}

/**
 * Add rules and entry for given CHILD_SA
 */
static bool add_entry(private_forecast_listener_t *this,
					  struct iptc_handle *ipth, host_t *lhost, host_t *rhost,
					  child_sa_t *child_sa, bool encap)
{
	enumerator_t *enumerator;
	traffic_selector_t *ts;
	entry_t *entry;

	INIT(entry,
		.lts = array_create(0, 0),
		.rts = array_create(0, 0),
		.lhost = lhost->clone(lhost),
		.rhost = rhost->clone(rhost),
		.spi = child_sa->get_spi(child_sa, TRUE),
		.encap = encap,
		.mark = child_sa->get_mark(child_sa, TRUE).value,
		.reinject = is_reinject_config(this, child_sa->get_name(child_sa)),
		.broadcast = this->broadcast,
	);

	enumerator = child_sa->create_ts_enumerator(child_sa, TRUE);
	while (enumerator->enumerate(enumerator, &ts))
	{
		array_insert(entry->lts, ARRAY_TAIL, ts->clone(ts));
	}
	enumerator->destroy(enumerator);

	enumerator = child_sa->create_ts_enumerator(child_sa, FALSE);
	while (enumerator->enumerate(enumerator, &ts))
	{
		array_insert(entry->rts, ARRAY_TAIL, ts->clone(ts));
	}
	enumerator->destroy(enumerator);

	if (manage_pre(ipth, entry, TRUE) &&
		manage_out(ipth, entry, TRUE))
	{
		this->lock->write_lock(this->lock);
		this->entries->insert_last(this->entries, entry);
		this->lock->unlock(this->lock);
		return TRUE;
	}
	entry_destroy(entry);
	return FALSE;
}

/**
 * Remove an entry and rules for a given mark
 */
static bool remove_entry(private_forecast_listener_t *this,
						 struct iptc_handle *ipth, child_sa_t *child_sa)
{
	enumerator_t *enumerator;
	entry_t *entry;
	bool done = FALSE;

	this->lock->write_lock(this->lock);
	enumerator = this->entries->create_enumerator(this->entries);
	while (enumerator->enumerate(enumerator, &entry))
	{
		if (entry->mark == child_sa->get_mark(child_sa, TRUE).value)
		{
			this->entries->remove_at(this->entries, enumerator);
			if (manage_pre(ipth, entry, FALSE) &&
				manage_out(ipth, entry, FALSE))
			{
				done = TRUE;
			}
			entry_destroy(entry);
			break;
		}
	}
	enumerator->destroy(enumerator);
	this->lock->unlock(this->lock);

	return done;
}

/**
 * Initialize iptables handle, log error
 */
static struct iptc_handle* init_handle()
{
	struct iptc_handle *ipth;

	ipth = iptc_init("mangle");
	if (ipth)
	{
		return ipth;
	}
	DBG1(DBG_CFG, "initializing iptables failed: %s", iptc_strerror(errno));
	return NULL;
}

/**
 * Commit iptables rules, log error
 */
static bool commit_handle(struct iptc_handle *ipth)
{
	if (iptc_commit(ipth))
	{
		return TRUE;
	}
	DBG1(DBG_CFG, "forecast iptables commit failed: %s", iptc_strerror(errno));
	return FALSE;
}

/**
 * Check if we should handle the given CHILD_SA
 */
static bool handle_sa(child_sa_t *child_sa)
{
	return child_sa->get_mark(child_sa, TRUE).value &&
		   child_sa->get_mark(child_sa, FALSE).value;
}

METHOD(listener_t, child_updown, bool,
	private_forecast_listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
	bool up)
{
	struct iptc_handle *ipth;
	host_t *lhost, *rhost;
	bool encap;

	lhost = ike_sa->get_my_host(ike_sa);
	rhost = ike_sa->get_other_host(ike_sa);
	encap = child_sa->has_encap(child_sa);

	if (handle_sa(child_sa))
	{
		ipth = init_handle();
		if (ipth)
		{
			if (up)
			{
				if (add_entry(this, ipth, lhost, rhost, child_sa, encap))
				{
					commit_handle(ipth);
				}
			}
			else
			{
				if (remove_entry(this, ipth, child_sa))
				{
					commit_handle(ipth);
				}
			}
			iptc_free(ipth);
		}
	}
	return TRUE;
}

METHOD(listener_t, child_rekey, bool,
	private_forecast_listener_t *this, ike_sa_t *ike_sa,
	child_sa_t *old, child_sa_t *new)
{
	struct iptc_handle *ipth;;
	host_t *lhost, *rhost;

	lhost = ike_sa->get_my_host(ike_sa);
	rhost = ike_sa->get_other_host(ike_sa);

	if (handle_sa(old))
	{
		ipth = init_handle();
		if (ipth)
		{
			if (remove_entry(this, ipth, old) &&
				add_entry(this, ipth, lhost, rhost, new, new->has_encap(new)))
			{
				commit_handle(ipth);
			}
			iptc_free(ipth);
		}
	}
	return TRUE;
}

METHOD(listener_t, ike_update, bool,
	private_forecast_listener_t *this, ike_sa_t *ike_sa,
	host_t *local, host_t *remote)
{
	struct iptc_handle *ipth;
	enumerator_t *enumerator;
	child_sa_t *child_sa;
	bool encap;

	/* during ike_update(), has_encap() on the CHILD_SA has not yet been
	 * updated, but shows the old state. */
	encap = ike_sa->has_condition(ike_sa, COND_NAT_ANY);

	enumerator = ike_sa->create_child_sa_enumerator(ike_sa);
	while (enumerator->enumerate(enumerator, &child_sa))
	{
		if (handle_sa(child_sa))
		{
			ipth = init_handle();
			if (ipth)
			{
				if (remove_entry(this, ipth, child_sa) &&
					add_entry(this, ipth, local, remote, child_sa, encap))
				{
					commit_handle(ipth);
				}
				iptc_free(ipth);
			}
		}
	}
	enumerator->destroy(enumerator);

	return TRUE;
}

CALLBACK(ts_filter, bool,
	entry_t *entry, enumerator_t *orig, va_list args)
{
	traffic_selector_t *ts, **out;
	uint32_t *mark;
	bool *reinject;

	VA_ARGS_VGET(args, out, mark, reinject);

	if (orig->enumerate(orig, &ts))
	{
		*out = ts;
		*mark = entry->mark;
		*reinject = entry->reinject;
		return TRUE;
	}
	return FALSE;
}

/**
 * Create inner enumerator over local traffic selectors
 */
static enumerator_t* create_inner_local(entry_t *entry, rwlock_t *lock)
{
	return enumerator_create_filter(array_create_enumerator(entry->lts),
									ts_filter, entry, NULL);
}

/**
 * Create inner enumerator over remote traffic selectors
 */
static enumerator_t* create_inner_remote(entry_t *entry, rwlock_t *lock)
{
	return enumerator_create_filter(array_create_enumerator(entry->rts),
									ts_filter, entry, NULL);
}

METHOD(forecast_listener_t, create_enumerator, enumerator_t*,
	private_forecast_listener_t *this, bool local)
{
	this->lock->read_lock(this->lock);
	return enumerator_create_nested(
					this->entries->create_enumerator(this->entries),
					(void*)(local ? create_inner_local : create_inner_remote),
					this->lock, (void*)this->lock->unlock);
}

METHOD(forecast_listener_t, set_broadcast, void,
	private_forecast_listener_t *this, host_t *bcast)
{
	if (bcast->get_family(bcast) == AF_INET)
	{
		struct sockaddr_in *in;

		in = (struct sockaddr_in*)bcast->get_sockaddr(bcast);
		this->broadcast = in->sin_addr.s_addr;
	}
}

METHOD(forecast_listener_t, destroy, void,
	private_forecast_listener_t *this)
{
	this->entries->destroy(this->entries);
	this->lock->destroy(this->lock);
	free(this);
}

/**
 * See header
 */
forecast_listener_t *forecast_listener_create()
{
	private_forecast_listener_t *this;

	INIT(this,
		.public = {
			.listener = {
				.ike_update = _ike_update,
				.child_updown = _child_updown,
				.child_rekey = _child_rekey,
			},
			.create_enumerator = _create_enumerator,
			.set_broadcast = _set_broadcast,
			.destroy = _destroy,
		},
		.entries = linked_list_create(),
		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
		.reinject_configs = lib->settings->get_str(lib->settings,
								"%s.plugins.forecast.reinject", "", lib->ns),
	);

	return &this->public;
}