1 /* $NetBSD: sockmisc.c,v 1.8.6.1 2007/08/01 11:52:22 vanhu Exp $ */
2
3 /* Id: sockmisc.c,v 1.24 2006/05/07 21:32:59 manubsd Exp */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35
36 #include <sys/types.h>
37 #include <sys/param.h>
38 #include <sys/socket.h>
39 #include <sys/uio.h>
40
41 #include <netinet/in.h>
42 #include PATH_IPSEC_H
43
44 #if defined(INET6) && !defined(INET6_ADVAPI) && \
45 defined(IP_RECVDSTADDR) && !defined(IPV6_RECVDSTADDR)
46 #define IPV6_RECVDSTADDR IP_RECVDSTADDR
47 #endif
48
49 #include <stdlib.h>
50 #include <stdio.h>
51 #include <string.h>
52 #include <errno.h>
53 #ifdef HAVE_UNISTD_H
54 #include <unistd.h>
55 #endif
56
57 #include "var.h"
58 #include "misc.h"
59 #include "plog.h"
60 #include "sockmisc.h"
61 #include "debug.h"
62 #include "gcmalloc.h"
63 #include "debugrm.h"
64 #include "libpfkey.h"
65
66 #ifdef ANDROID_CHANGES
67 #include "NetdClient.h"
68 #endif
69
70 #ifndef IP_IPSEC_POLICY
71 #define IP_IPSEC_POLICY 16 /* XXX: from linux/in.h */
72 #endif
73
74 #ifndef IPV6_IPSEC_POLICY
75 #define IPV6_IPSEC_POLICY 34 /* XXX: from linux/???.h per
76 "Tom Lendacky" <toml@us.ibm.com> */
77 #endif
78
79 const int niflags = 0;
80
81 /*
82 * compare two sockaddr without port number.
83 * OUT: 0: equal.
84 * 1: not equal.
85 */
86 int
cmpsaddrwop(addr1,addr2)87 cmpsaddrwop(addr1, addr2)
88 const struct sockaddr *addr1;
89 const struct sockaddr *addr2;
90 {
91 caddr_t sa1, sa2;
92
93 if (addr1 == 0 && addr2 == 0)
94 return 0;
95 if (addr1 == 0 || addr2 == 0)
96 return 1;
97
98 #ifdef __linux__
99 if (addr1->sa_family != addr2->sa_family)
100 return 1;
101 #else
102 if (addr1->sa_len != addr2->sa_len
103 || addr1->sa_family != addr2->sa_family)
104 return 1;
105
106 #endif /* __linux__ */
107
108 switch (addr1->sa_family) {
109 case AF_INET:
110 sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
111 sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
112 if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
113 return 1;
114 break;
115 #ifdef INET6
116 case AF_INET6:
117 sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
118 sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
119 if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
120 return 1;
121 if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
122 ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
123 return 1;
124 break;
125 #endif
126 default:
127 return 1;
128 }
129
130 return 0;
131 }
132
133 /*
134 * compare two sockaddr with port, taking care wildcard.
135 * addr1 is a subject address, addr2 is in a database entry.
136 * OUT: 0: equal.
137 * 1: not equal.
138 */
139 int
cmpsaddrwild(addr1,addr2)140 cmpsaddrwild(addr1, addr2)
141 const struct sockaddr *addr1;
142 const struct sockaddr *addr2;
143 {
144 caddr_t sa1, sa2;
145 u_short port1, port2;
146
147 if (addr1 == 0 && addr2 == 0)
148 return 0;
149 if (addr1 == 0 || addr2 == 0)
150 return 1;
151
152 #ifdef __linux__
153 if (addr1->sa_family != addr2->sa_family)
154 return 1;
155 #else
156 if (addr1->sa_len != addr2->sa_len
157 || addr1->sa_family != addr2->sa_family)
158 return 1;
159
160 #endif /* __linux__ */
161
162 switch (addr1->sa_family) {
163 case AF_INET:
164 sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
165 sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
166 port1 = ((struct sockaddr_in *)addr1)->sin_port;
167 port2 = ((struct sockaddr_in *)addr2)->sin_port;
168 if (!(port1 == IPSEC_PORT_ANY ||
169 port2 == IPSEC_PORT_ANY ||
170 port1 == port2))
171 return 1;
172 if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
173 return 1;
174 break;
175 #ifdef INET6
176 case AF_INET6:
177 sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
178 sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
179 port1 = ((struct sockaddr_in6 *)addr1)->sin6_port;
180 port2 = ((struct sockaddr_in6 *)addr2)->sin6_port;
181 if (!(port1 == IPSEC_PORT_ANY ||
182 port2 == IPSEC_PORT_ANY ||
183 port1 == port2))
184 return 1;
185 if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
186 return 1;
187 if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
188 ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
189 return 1;
190 break;
191 #endif
192 default:
193 return 1;
194 }
195
196 return 0;
197 }
198
199 /*
200 * compare two sockaddr with strict match on port.
201 * OUT: 0: equal.
202 * 1: not equal.
203 */
204 int
cmpsaddrstrict(addr1,addr2)205 cmpsaddrstrict(addr1, addr2)
206 const struct sockaddr *addr1;
207 const struct sockaddr *addr2;
208 {
209 caddr_t sa1, sa2;
210 u_short port1, port2;
211
212 if (addr1 == 0 && addr2 == 0)
213 return 0;
214 if (addr1 == 0 || addr2 == 0)
215 return 1;
216
217 #ifdef __linux__
218 if (addr1->sa_family != addr2->sa_family)
219 return 1;
220 #else
221 if (addr1->sa_len != addr2->sa_len
222 || addr1->sa_family != addr2->sa_family)
223 return 1;
224
225 #endif /* __linux__ */
226
227 switch (addr1->sa_family) {
228 case AF_INET:
229 sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
230 sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
231 port1 = ((struct sockaddr_in *)addr1)->sin_port;
232 port2 = ((struct sockaddr_in *)addr2)->sin_port;
233 if (port1 != port2)
234 return 1;
235 if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
236 return 1;
237 break;
238 #ifdef INET6
239 case AF_INET6:
240 sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
241 sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
242 port1 = ((struct sockaddr_in6 *)addr1)->sin6_port;
243 port2 = ((struct sockaddr_in6 *)addr2)->sin6_port;
244 if (port1 != port2)
245 return 1;
246 if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
247 return 1;
248 if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
249 ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
250 return 1;
251 break;
252 #endif
253 default:
254 return 1;
255 }
256
257 return 0;
258 }
259
260 #ifdef ANDROID_PATCHED
261
getlocaladdr(struct sockaddr * remote)262 struct sockaddr *getlocaladdr(struct sockaddr *remote)
263 {
264 struct sockaddr_storage local;
265 socklen_t len = sysdep_sa_len(remote);
266 int s = socket(remote->sa_family, SOCK_DGRAM, 0);
267 #ifdef ANDROID_CHANGES
268 protectFromVpn(s);
269 #endif
270
271 if (s == -1 || connect(s, remote, len) == -1 ||
272 getsockname(s, (struct sockaddr *)&local, &len) == -1) {
273 close(s);
274 return NULL;
275 }
276 close(s);
277 return dupsaddr((struct sockaddr *)&local);
278 }
279
recvfromto(int s,void * buf,size_t len,int flags,struct sockaddr * from,socklen_t * fromlen,struct sockaddr * to,unsigned int * tolen)280 int recvfromto(int s, void *buf, size_t len, int flags, struct sockaddr *from,
281 socklen_t *fromlen, struct sockaddr *to, unsigned int *tolen)
282 {
283 if (getsockname(s, to, (socklen_t *)tolen) == -1) {
284 return -1;
285 }
286 return recvfrom(s, buf, len, flags, from, fromlen);
287 }
288
sendfromto(int s,const void * buf,size_t len,struct sockaddr * from,struct sockaddr * to,int count)289 int sendfromto(int s, const void *buf, size_t len, struct sockaddr *from,
290 struct sockaddr *to, int count)
291 {
292 int i;
293 for (i = 0; i < count; ++i) {
294 if (sendto(s, buf, len, 0, to, sysdep_sa_len(to)) == -1) {
295 return -1;
296 }
297 }
298 return len;
299 }
300
setsockopt_bypass(int s,int family)301 int setsockopt_bypass(int s, int family)
302 {
303 struct sadb_x_policy p = {
304 .sadb_x_policy_len = PFKEY_UNIT64(sizeof(struct sadb_x_policy)),
305 .sadb_x_policy_exttype = SADB_X_EXT_POLICY,
306 .sadb_x_policy_type = IPSEC_POLICY_BYPASS,
307 .sadb_x_policy_dir = IPSEC_DIR_INBOUND,
308 #ifdef HAVE_PFKEY_POLICY_PRIORITY
309 .sadb_x_policy_priority = PRIORITY_DEFAULT,
310 #endif
311 };
312 int level = (family == AF_INET) ? IPPROTO_IP : IPPROTO_IPV6;
313 int option = (family == AF_INET) ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY;
314 int len = PFKEY_EXTLEN(&p);
315 if (setsockopt(s, level, option, &p, len) == -1) {
316 plog(LLV_WARNING, LOCATION, NULL, "setsockopt in bypass: %s\n",
317 strerror(errno));
318 }
319 p.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
320 if (setsockopt(s, level, option, &p, len) == -1) {
321 plog(LLV_WARNING, LOCATION, NULL, "setsockopt out bypass: %s\n",
322 strerror(errno));
323 }
324 return 0;
325 }
326
327 #else
328
329 /* get local address against the destination. */
330 struct sockaddr *
getlocaladdr(remote)331 getlocaladdr(remote)
332 struct sockaddr *remote;
333 {
334 struct sockaddr *local;
335 u_int local_len = sizeof(struct sockaddr_storage);
336 int s; /* for dummy connection */
337
338 /* allocate buffer */
339 if ((local = racoon_calloc(1, local_len)) == NULL) {
340 plog(LLV_ERROR, LOCATION, NULL,
341 "failed to get address buffer.\n");
342 goto err;
343 }
344
345 /* get real interface received packet */
346 if ((s = socket(remote->sa_family, SOCK_DGRAM, 0)) < 0) {
347 plog(LLV_ERROR, LOCATION, NULL,
348 "socket (%s)\n", strerror(errno));
349 goto err;
350 }
351 #ifdef ANDROID_CHANGES
352 protectFromVpn(s);
353 #endif
354
355 setsockopt_bypass(s, remote->sa_family);
356
357 if (connect(s, remote, sysdep_sa_len(remote)) < 0) {
358 plog(LLV_ERROR, LOCATION, NULL,
359 "connect (%s)\n", strerror(errno));
360 close(s);
361 goto err;
362 }
363
364 if (getsockname(s, local, &local_len) < 0) {
365 plog(LLV_ERROR, LOCATION, NULL,
366 "getsockname (%s)\n", strerror(errno));
367 close(s);
368 return NULL;
369 }
370
371 close(s);
372 return local;
373
374 err:
375 if (local != NULL)
376 racoon_free(local);
377 return NULL;
378 }
379
380 /*
381 * Receive packet, with src/dst information. It is assumed that necessary
382 * setsockopt() have already performed on socket.
383 */
384 int
recvfromto(s,buf,buflen,flags,from,fromlen,to,tolen)385 recvfromto(s, buf, buflen, flags, from, fromlen, to, tolen)
386 int s;
387 void *buf;
388 size_t buflen;
389 int flags;
390 struct sockaddr *from;
391 socklen_t *fromlen;
392 struct sockaddr *to;
393 u_int *tolen;
394 {
395 int otolen;
396 u_int len;
397 struct sockaddr_storage ss;
398 struct msghdr m;
399 struct cmsghdr *cm;
400 struct iovec iov[2];
401 u_char cmsgbuf[256];
402 #if defined(INET6) && defined(INET6_ADVAPI)
403 struct in6_pktinfo *pi;
404 #endif /*INET6_ADVAPI*/
405 struct sockaddr_in *sin;
406 #ifdef INET6
407 struct sockaddr_in6 *sin6;
408 #endif
409
410 len = sizeof(ss);
411 if (getsockname(s, (struct sockaddr *)&ss, &len) < 0) {
412 plog(LLV_ERROR, LOCATION, NULL,
413 "getsockname (%s)\n", strerror(errno));
414 return -1;
415 }
416
417 m.msg_name = (caddr_t)from;
418 m.msg_namelen = *fromlen;
419 iov[0].iov_base = (caddr_t)buf;
420 iov[0].iov_len = buflen;
421 m.msg_iov = iov;
422 m.msg_iovlen = 1;
423 memset(cmsgbuf, 0, sizeof(cmsgbuf));
424 cm = (struct cmsghdr *)cmsgbuf;
425 m.msg_control = (caddr_t)cm;
426 m.msg_controllen = sizeof(cmsgbuf);
427 if ((len = recvmsg(s, &m, flags)) < 0) {
428 plog(LLV_ERROR, LOCATION, NULL,
429 "recvmsg (%s)\n", strerror(errno));
430 return -1;
431 }
432 *fromlen = m.msg_namelen;
433
434 otolen = *tolen;
435 *tolen = 0;
436 for (cm = (struct cmsghdr *)CMSG_FIRSTHDR(&m);
437 m.msg_controllen != 0 && cm;
438 cm = (struct cmsghdr *)CMSG_NXTHDR(&m, cm)) {
439 #if 0
440 plog(LLV_ERROR, LOCATION, NULL,
441 "cmsg %d %d\n", cm->cmsg_level, cm->cmsg_type);)
442 #endif
443 #if defined(INET6) && defined(INET6_ADVAPI)
444 if (ss.ss_family == AF_INET6
445 && cm->cmsg_level == IPPROTO_IPV6
446 && cm->cmsg_type == IPV6_PKTINFO
447 && otolen >= sizeof(*sin6)) {
448 pi = (struct in6_pktinfo *)(CMSG_DATA(cm));
449 *tolen = sizeof(*sin6);
450 sin6 = (struct sockaddr_in6 *)to;
451 memset(sin6, 0, sizeof(*sin6));
452 sin6->sin6_family = AF_INET6;
453 #ifndef __linux__
454 sin6->sin6_len = sizeof(*sin6);
455 #endif
456 memcpy(&sin6->sin6_addr, &pi->ipi6_addr,
457 sizeof(sin6->sin6_addr));
458 /* XXX other cases, such as site-local? */
459 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
460 sin6->sin6_scope_id = pi->ipi6_ifindex;
461 else
462 sin6->sin6_scope_id = 0;
463 sin6->sin6_port =
464 ((struct sockaddr_in6 *)&ss)->sin6_port;
465 otolen = -1; /* "to" already set */
466 continue;
467 }
468 #endif
469 #ifdef __linux__
470 if (ss.ss_family == AF_INET
471 && cm->cmsg_level == IPPROTO_IP
472 && cm->cmsg_type == IP_PKTINFO
473 && otolen >= sizeof(sin)) {
474 struct in_pktinfo *pi = (struct in_pktinfo *)(CMSG_DATA(cm));
475 *tolen = sizeof(*sin);
476 sin = (struct sockaddr_in *)to;
477 memset(sin, 0, sizeof(*sin));
478 sin->sin_family = AF_INET;
479 memcpy(&sin->sin_addr, &pi->ipi_addr,
480 sizeof(sin->sin_addr));
481 sin->sin_port =
482 ((struct sockaddr_in *)&ss)->sin_port;
483 otolen = -1; /* "to" already set */
484 continue;
485 }
486 #endif
487 #if defined(INET6) && defined(IPV6_RECVDSTADDR)
488 if (ss.ss_family == AF_INET6
489 && cm->cmsg_level == IPPROTO_IPV6
490 && cm->cmsg_type == IPV6_RECVDSTADDR
491 && otolen >= sizeof(*sin6)) {
492 *tolen = sizeof(*sin6);
493 sin6 = (struct sockaddr_in6 *)to;
494 memset(sin6, 0, sizeof(*sin6));
495 sin6->sin6_family = AF_INET6;
496 sin6->sin6_len = sizeof(*sin6);
497 memcpy(&sin6->sin6_addr, CMSG_DATA(cm),
498 sizeof(sin6->sin6_addr));
499 sin6->sin6_port =
500 ((struct sockaddr_in6 *)&ss)->sin6_port;
501 otolen = -1; /* "to" already set */
502 continue;
503 }
504 #endif
505 #ifndef __linux__
506 if (ss.ss_family == AF_INET
507 && cm->cmsg_level == IPPROTO_IP
508 && cm->cmsg_type == IP_RECVDSTADDR
509 && otolen >= sizeof(*sin)) {
510 *tolen = sizeof(*sin);
511 sin = (struct sockaddr_in *)to;
512 memset(sin, 0, sizeof(*sin));
513 sin->sin_family = AF_INET;
514 sin->sin_len = sizeof(*sin);
515 memcpy(&sin->sin_addr, CMSG_DATA(cm),
516 sizeof(sin->sin_addr));
517 sin->sin_port = ((struct sockaddr_in *)&ss)->sin_port;
518 otolen = -1; /* "to" already set */
519 continue;
520 }
521 #endif
522 }
523
524 return len;
525 }
526
527 /* send packet, with fixing src/dst address pair. */
528 int
sendfromto(s,buf,buflen,src,dst,cnt)529 sendfromto(s, buf, buflen, src, dst, cnt)
530 int s, cnt;
531 const void *buf;
532 size_t buflen;
533 struct sockaddr *src;
534 struct sockaddr *dst;
535 {
536 struct sockaddr_storage ss;
537 u_int len;
538 int i;
539
540 if (src->sa_family != dst->sa_family) {
541 plog(LLV_ERROR, LOCATION, NULL,
542 "address family mismatch\n");
543 return -1;
544 }
545
546 len = sizeof(ss);
547 if (getsockname(s, (struct sockaddr *)&ss, &len) < 0) {
548 plog(LLV_ERROR, LOCATION, NULL,
549 "getsockname (%s)\n", strerror(errno));
550 return -1;
551 }
552
553 plog(LLV_DEBUG, LOCATION, NULL,
554 "sockname %s\n", saddr2str((struct sockaddr *)&ss));
555 plog(LLV_DEBUG, LOCATION, NULL,
556 "send packet from %s\n", saddr2str(src));
557 plog(LLV_DEBUG, LOCATION, NULL,
558 "send packet to %s\n", saddr2str(dst));
559
560 if (src->sa_family != ss.ss_family) {
561 plog(LLV_ERROR, LOCATION, NULL,
562 "address family mismatch\n");
563 return -1;
564 }
565
566 switch (src->sa_family) {
567 #if defined(INET6) && defined(INET6_ADVAPI)
568 // XXX: This block wasn't compiled on Linux - does it work?
569 case AF_INET6:
570 {
571 struct msghdr m;
572 struct cmsghdr *cm;
573 struct iovec iov[2];
574 u_char cmsgbuf[256];
575 struct in6_pktinfo *pi;
576 int ifindex;
577 struct sockaddr_in6 src6, dst6;
578
579 memcpy(&src6, src, sizeof(src6));
580 memcpy(&dst6, dst, sizeof(dst6));
581
582 /* XXX take care of other cases, such as site-local */
583 ifindex = 0;
584 if (IN6_IS_ADDR_LINKLOCAL(&src6.sin6_addr)
585 || IN6_IS_ADDR_MULTICAST(&src6.sin6_addr)) {
586 ifindex = src6.sin6_scope_id; /*???*/
587 }
588
589 /* XXX some sanity check on dst6.sin6_scope_id */
590
591 /* flowinfo for IKE? mmm, maybe useful but for now make it 0 */
592 src6.sin6_flowinfo = dst6.sin6_flowinfo = 0;
593
594 memset(&m, 0, sizeof(m));
595 m.msg_name = (caddr_t)&dst6;
596 m.msg_namelen = sizeof(dst6);
597 iov[0].iov_base = (char *)buf;
598 iov[0].iov_len = buflen;
599 m.msg_iov = iov;
600 m.msg_iovlen = 1;
601
602 memset(cmsgbuf, 0, sizeof(cmsgbuf));
603 cm = (struct cmsghdr *)cmsgbuf;
604 m.msg_control = (caddr_t)cm;
605 m.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
606
607 cm->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
608 cm->cmsg_level = IPPROTO_IPV6;
609 cm->cmsg_type = IPV6_PKTINFO;
610 pi = (struct in6_pktinfo *)CMSG_DATA(cm);
611 memcpy(&pi->ipi6_addr, &src6.sin6_addr, sizeof(src6.sin6_addr));
612 pi->ipi6_ifindex = ifindex;
613
614 plog(LLV_DEBUG, LOCATION, NULL,
615 "src6 %s %d\n",
616 saddr2str((struct sockaddr *)&src6),
617 src6.sin6_scope_id);
618 plog(LLV_DEBUG, LOCATION, NULL,
619 "dst6 %s %d\n",
620 saddr2str((struct sockaddr *)&dst6),
621 dst6.sin6_scope_id);
622
623 for (i = 0; i < cnt; i++) {
624 len = sendmsg(s, &m, 0 /*MSG_DONTROUTE*/);
625 if (len < 0) {
626 plog(LLV_ERROR, LOCATION, NULL,
627 "sendmsg (%s)\n", strerror(errno));
628 return -1;
629 }
630 plog(LLV_DEBUG, LOCATION, NULL,
631 "%d times of %d bytes message will be sent "
632 "to %s\n",
633 i + 1, len, saddr2str(dst));
634 }
635 plogdump(LLV_DEBUG, (char *)buf, buflen);
636
637 return len;
638 }
639 #endif
640 #ifdef __linux__
641 case AF_INET:
642 {
643 struct msghdr m;
644 struct cmsghdr *cm;
645 struct iovec iov[2];
646 u_char cmsgbuf[256];
647 struct in_pktinfo *pi;
648 int ifindex = 0;
649 struct sockaddr_in src6, dst6;
650
651 memcpy(&src6, src, sizeof(src6));
652 memcpy(&dst6, dst, sizeof(dst6));
653
654 memset(&m, 0, sizeof(m));
655 m.msg_name = (caddr_t)&dst6;
656 m.msg_namelen = sizeof(dst6);
657 iov[0].iov_base = (char *)buf;
658 iov[0].iov_len = buflen;
659 m.msg_iov = iov;
660 m.msg_iovlen = 1;
661
662 memset(cmsgbuf, 0, sizeof(cmsgbuf));
663 cm = (struct cmsghdr *)cmsgbuf;
664 m.msg_control = (caddr_t)cm;
665 m.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
666
667 cm->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
668 cm->cmsg_level = IPPROTO_IP;
669 cm->cmsg_type = IP_PKTINFO;
670 pi = (struct in_pktinfo *)CMSG_DATA(cm);
671 memcpy(&pi->ipi_spec_dst, &src6.sin_addr, sizeof(src6.sin_addr));
672 pi->ipi_ifindex = ifindex;
673
674 plog(LLV_DEBUG, LOCATION, NULL,
675 "src4 %s\n",
676 saddr2str((struct sockaddr *)&src6));
677 plog(LLV_DEBUG, LOCATION, NULL,
678 "dst4 %s\n",
679 saddr2str((struct sockaddr *)&dst6));
680
681 for (i = 0; i < cnt; i++) {
682 len = sendmsg(s, &m, 0 /*MSG_DONTROUTE*/);
683 if (len < 0) {
684 plog(LLV_ERROR, LOCATION, NULL,
685 "sendmsg (%s)\n", strerror(errno));
686 return -1;
687 }
688 plog(LLV_DEBUG, LOCATION, NULL,
689 "%d times of %d bytes message will be sent "
690 "to %s\n",
691 i + 1, len, saddr2str(dst));
692 }
693 plogdump(LLV_DEBUG, (char *)buf, buflen);
694
695 return len;
696 }
697 #endif /* __linux__ */
698 default:
699 {
700 int needclose = 0;
701 int sendsock;
702
703 if (ss.ss_family == src->sa_family && memcmp(&ss, src, sysdep_sa_len(src)) == 0) {
704 sendsock = s;
705 needclose = 0;
706 } else {
707 int yes = 1;
708 /*
709 * Use newly opened socket for sending packets.
710 * NOTE: this is unsafe, because if the peer is quick enough
711 * the packet from the peer may be queued into sendsock.
712 * Better approach is to prepare bind'ed udp sockets for
713 * each of the interface addresses.
714 */
715 sendsock = socket(src->sa_family, SOCK_DGRAM, 0);
716 if (sendsock < 0) {
717 plog(LLV_ERROR, LOCATION, NULL,
718 "socket (%s)\n", strerror(errno));
719 return -1;
720 }
721 #ifdef ANDROID_CHANGES
722 protectFromVpn(sendsock);
723 #endif
724
725 if (setsockopt(sendsock, SOL_SOCKET,
726 #ifdef __linux__
727 SO_REUSEADDR,
728 #else
729 SO_REUSEPORT,
730 #endif
731 (void *)&yes, sizeof(yes)) < 0) {
732 plog(LLV_ERROR, LOCATION, NULL,
733 "setsockopt SO_REUSEPORT (%s)\n",
734 strerror(errno));
735 close(sendsock);
736 return -1;
737 }
738 #ifdef IPV6_USE_MIN_MTU
739 if (src->sa_family == AF_INET6 &&
740 setsockopt(sendsock, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
741 (void *)&yes, sizeof(yes)) < 0) {
742 plog(LLV_ERROR, LOCATION, NULL,
743 "setsockopt IPV6_USE_MIN_MTU (%s)\n",
744 strerror(errno));
745 close(sendsock);
746 return -1;
747 }
748 #endif
749 if (setsockopt_bypass(sendsock, src->sa_family) < 0) {
750 close(sendsock);
751 return -1;
752 }
753
754 if (bind(sendsock, (struct sockaddr *)src, sysdep_sa_len(src)) < 0) {
755 plog(LLV_ERROR, LOCATION, NULL,
756 "bind 1 (%s)\n", strerror(errno));
757 close(sendsock);
758 return -1;
759 }
760 needclose = 1;
761 }
762
763 for (i = 0; i < cnt; i++) {
764 len = sendto(sendsock, buf, buflen, 0, dst, sysdep_sa_len(dst));
765 if (len < 0) {
766 plog(LLV_ERROR, LOCATION, NULL,
767 "sendto (%s)\n", strerror(errno));
768 if (needclose)
769 close(sendsock);
770 return len;
771 }
772 plog(LLV_DEBUG, LOCATION, NULL,
773 "%d times of %d bytes message will be sent "
774 "to %s\n",
775 i + 1, len, saddr2str(dst));
776 }
777 plogdump(LLV_DEBUG, (char *)buf, buflen);
778
779 if (needclose)
780 close(sendsock);
781
782 return len;
783 }
784 }
785 }
786
787 int
setsockopt_bypass(so,family)788 setsockopt_bypass(so, family)
789 int so, family;
790 {
791 int level;
792 char *buf;
793 char *policy;
794
795 switch (family) {
796 case AF_INET:
797 level = IPPROTO_IP;
798 break;
799 #ifdef INET6
800 case AF_INET6:
801 level = IPPROTO_IPV6;
802 break;
803 #endif
804 default:
805 plog(LLV_ERROR, LOCATION, NULL,
806 "unsupported address family %d\n", family);
807 return -1;
808 }
809
810 policy = "in bypass";
811 buf = ipsec_set_policy(policy, strlen(policy));
812 if (buf == NULL) {
813 plog(LLV_ERROR, LOCATION, NULL,
814 "ipsec_set_policy (%s)\n",
815 ipsec_strerror());
816 return -1;
817 }
818 if (setsockopt(so, level,
819 (level == IPPROTO_IP ?
820 IP_IPSEC_POLICY : IPV6_IPSEC_POLICY),
821 buf, ipsec_get_policylen(buf)) < 0) {
822 plog(LLV_ERROR, LOCATION, NULL,
823 "setsockopt IP_IPSEC_POLICY (%s)\n",
824 strerror(errno));
825 return -1;
826 }
827 racoon_free(buf);
828
829 policy = "out bypass";
830 buf = ipsec_set_policy(policy, strlen(policy));
831 if (buf == NULL) {
832 plog(LLV_ERROR, LOCATION, NULL,
833 "ipsec_set_policy (%s)\n",
834 ipsec_strerror());
835 return -1;
836 }
837 if (setsockopt(so, level,
838 (level == IPPROTO_IP ?
839 IP_IPSEC_POLICY : IPV6_IPSEC_POLICY),
840 buf, ipsec_get_policylen(buf)) < 0) {
841 plog(LLV_ERROR, LOCATION, NULL,
842 "setsockopt IP_IPSEC_POLICY (%s)\n",
843 strerror(errno));
844 return -1;
845 }
846 racoon_free(buf);
847
848 return 0;
849 }
850
851 struct sockaddr *
newsaddr(len)852 newsaddr(len)
853 int len;
854 {
855 struct sockaddr *new;
856
857 if ((new = racoon_calloc(1, len)) == NULL) {
858 plog(LLV_ERROR, LOCATION, NULL,
859 "%s\n", strerror(errno));
860 goto out;
861 }
862
863 #ifdef __linux__
864 if (len == sizeof (struct sockaddr_in6))
865 new->sa_family = AF_INET6;
866 else
867 new->sa_family = AF_INET;
868 #else
869 /* initial */
870 new->sa_len = len;
871 #endif
872 out:
873 return new;
874 }
875
876 #endif
877
878 struct sockaddr *
dupsaddr(src)879 dupsaddr(src)
880 struct sockaddr *src;
881 {
882 struct sockaddr *dst;
883
884 dst = racoon_calloc(1, sysdep_sa_len(src));
885 if (dst == NULL) {
886 plog(LLV_ERROR, LOCATION, NULL,
887 "%s\n", strerror(errno));
888 return NULL;
889 }
890
891 memcpy(dst, src, sysdep_sa_len(src));
892
893 return dst;
894 }
895
896 char *
saddr2str(saddr)897 saddr2str(saddr)
898 const struct sockaddr *saddr;
899 {
900 static char buf[NI_MAXHOST + NI_MAXSERV + 10];
901 char addr[NI_MAXHOST], port[NI_MAXSERV];
902
903 if (saddr == NULL)
904 return NULL;
905
906 if (saddr->sa_family == AF_UNSPEC)
907 snprintf (buf, sizeof(buf), "%s", "anonymous");
908 else {
909 GETNAMEINFO(saddr, addr, port);
910 snprintf(buf, sizeof(buf), "%s[%s]", addr, port);
911 }
912
913 return buf;
914 }
915
916 char *
saddrwop2str(saddr)917 saddrwop2str(saddr)
918 const struct sockaddr *saddr;
919 {
920 static char buf[NI_MAXHOST + NI_MAXSERV + 10];
921 char addr[NI_MAXHOST];
922
923 if (saddr == NULL)
924 return NULL;
925
926 GETNAMEINFO_NULL(saddr, addr);
927 snprintf(buf, sizeof(buf), "%s", addr);
928
929 return buf;
930 }
931
932 char *
naddrwop2str(const struct netaddr * naddr)933 naddrwop2str(const struct netaddr *naddr)
934 {
935 static char buf[NI_MAXHOST + 10];
936 static const struct sockaddr sa_any; /* this is initialized to all zeros */
937
938 if (naddr == NULL)
939 return NULL;
940
941 if (memcmp(&naddr->sa, &sa_any, sizeof(sa_any)) == 0)
942 snprintf(buf, sizeof(buf), "%s", "any");
943 else {
944 snprintf(buf, sizeof(buf), "%s", saddrwop2str(&naddr->sa.sa));
945 snprintf(&buf[strlen(buf)], sizeof(buf) - strlen(buf), "/%ld", naddr->prefix);
946 }
947 return buf;
948 }
949
950 char *
naddrwop2str_fromto(const char * format,const struct netaddr * saddr,const struct netaddr * daddr)951 naddrwop2str_fromto(const char *format, const struct netaddr *saddr,
952 const struct netaddr *daddr)
953 {
954 static char buf[2*(NI_MAXHOST + NI_MAXSERV + 10) + 100];
955 char *src, *dst;
956
957 src = racoon_strdup(naddrwop2str(saddr));
958 dst = racoon_strdup(naddrwop2str(daddr));
959 STRDUP_FATAL(src);
960 STRDUP_FATAL(dst);
961 /* WARNING: Be careful about the format string! Don't
962 ever pass in something that a user can modify!!! */
963 snprintf (buf, sizeof(buf), format, src, dst);
964 racoon_free (src);
965 racoon_free (dst);
966
967 return buf;
968 }
969
970 char *
saddr2str_fromto(format,saddr,daddr)971 saddr2str_fromto(format, saddr, daddr)
972 const char *format;
973 const struct sockaddr *saddr;
974 const struct sockaddr *daddr;
975 {
976 static char buf[2*(NI_MAXHOST + NI_MAXSERV + 10) + 100];
977 char *src, *dst;
978
979 src = racoon_strdup(saddr2str(saddr));
980 dst = racoon_strdup(saddr2str(daddr));
981 STRDUP_FATAL(src);
982 STRDUP_FATAL(dst);
983 /* WARNING: Be careful about the format string! Don't
984 ever pass in something that a user can modify!!! */
985 snprintf (buf, sizeof(buf), format, src, dst);
986 racoon_free (src);
987 racoon_free (dst);
988
989 return buf;
990 }
991
992 struct sockaddr *
str2saddr(host,port)993 str2saddr(host, port)
994 char *host;
995 char *port;
996 {
997 struct addrinfo hints, *res;
998 struct sockaddr *saddr;
999 int error;
1000
1001 memset(&hints, 0, sizeof(hints));
1002 hints.ai_family = PF_UNSPEC;
1003 hints.ai_socktype = SOCK_DGRAM;
1004 hints.ai_flags = AI_NUMERICHOST;
1005 error = getaddrinfo(host, port, &hints, &res);
1006 if (error != 0) {
1007 plog(LLV_ERROR, LOCATION, NULL,
1008 "getaddrinfo(%s%s%s): %s\n",
1009 host, port ? "," : "", port ? port : "",
1010 gai_strerror(error));
1011 return NULL;
1012 }
1013 if (res->ai_next != NULL) {
1014 plog(LLV_WARNING, LOCATION, NULL,
1015 "getaddrinfo(%s%s%s): "
1016 "resolved to multiple address, "
1017 "taking the first one\n",
1018 host, port ? "," : "", port ? port : "");
1019 }
1020 saddr = racoon_malloc(res->ai_addrlen);
1021 if (saddr == NULL) {
1022 plog(LLV_ERROR, LOCATION, NULL,
1023 "failed to allocate buffer.\n");
1024 freeaddrinfo(res);
1025 return NULL;
1026 }
1027 memcpy(saddr, res->ai_addr, res->ai_addrlen);
1028 freeaddrinfo(res);
1029
1030 return saddr;
1031 }
1032
1033 void
mask_sockaddr(a,b,l)1034 mask_sockaddr(a, b, l)
1035 struct sockaddr *a;
1036 const struct sockaddr *b;
1037 size_t l;
1038 {
1039 size_t i;
1040 u_int8_t *p, alen;
1041
1042 switch (b->sa_family) {
1043 case AF_INET:
1044 alen = sizeof(struct in_addr);
1045 p = (u_int8_t *)&((struct sockaddr_in *)a)->sin_addr;
1046 break;
1047 #ifdef INET6
1048 case AF_INET6:
1049 alen = sizeof(struct in6_addr);
1050 p = (u_int8_t *)&((struct sockaddr_in6 *)a)->sin6_addr;
1051 break;
1052 #endif
1053 default:
1054 plog(LLV_ERROR, LOCATION, NULL,
1055 "invalid family: %d\n", b->sa_family);
1056 exit(1);
1057 }
1058
1059 if ((alen << 3) < l) {
1060 plog(LLV_ERROR, LOCATION, NULL,
1061 "unexpected inconsistency: %d %zu\n", b->sa_family, l);
1062 exit(1);
1063 }
1064
1065 memcpy(a, b, sysdep_sa_len(b));
1066 p[l / 8] &= (0xff00 >> (l % 8)) & 0xff;
1067 for (i = l / 8 + 1; i < alen; i++)
1068 p[i] = 0x00;
1069 }
1070
1071 /* Compute a score describing how "accurate" a netaddr is for a given sockaddr.
1072 * Examples:
1073 * Return values for address 10.20.30.40 [port 500] and given netaddresses...
1074 * 10.10.0.0/16 => -1 ... doesn't match
1075 * 0.0.0.0/0 => 0 ... matches, but only 0 bits.
1076 * 10.20.0.0/16 => 16 ... 16 bits match
1077 * 10.20.30.0/24 => 24 ... guess what ;-)
1078 * 10.20.30.40/32 => 32 ... whole address match
1079 * 10.20.30.40:500 => 33 ... both address and port match
1080 * 10.20.30.40:501 => -1 ... port doesn't match and isn't 0 (=any)
1081 */
1082 int
naddr_score(const struct netaddr * naddr,const struct sockaddr * saddr)1083 naddr_score(const struct netaddr *naddr, const struct sockaddr *saddr)
1084 {
1085 static const struct netaddr naddr_any; /* initialized to all-zeros */
1086 struct sockaddr sa;
1087 u_int16_t naddr_port, saddr_port;
1088 int port_score;
1089
1090 if (!naddr || !saddr) {
1091 plog(LLV_ERROR, LOCATION, NULL,
1092 "Call with null args: naddr=%p, saddr=%p\n",
1093 naddr, saddr);
1094 return -1;
1095 }
1096
1097 /* Wildcard address matches, but only 0 bits. */
1098 if (memcmp(naddr, &naddr_any, sizeof(naddr_any)) == 0)
1099 return 0;
1100
1101 /* If families don't match we really can't do much... */
1102 if (naddr->sa.sa.sa_family != saddr->sa_family)
1103 return -1;
1104
1105 /* If port check fail don't bother to check addresses. */
1106 naddr_port = extract_port(&naddr->sa.sa);
1107 saddr_port = extract_port(saddr);
1108 if (naddr_port == 0 || saddr_port == 0) /* wildcard match */
1109 port_score = 0;
1110 else if (naddr_port == saddr_port) /* exact match */
1111 port_score = 1;
1112 else /* mismatch :-) */
1113 return -1;
1114
1115 /* Here it comes - compare network addresses. */
1116 mask_sockaddr(&sa, saddr, naddr->prefix);
1117 if (loglevel >= LLV_DEBUG) { /* debug only */
1118 char *a1, *a2, *a3;
1119 a1 = racoon_strdup(naddrwop2str(naddr));
1120 a2 = racoon_strdup(saddrwop2str(saddr));
1121 a3 = racoon_strdup(saddrwop2str(&sa));
1122 STRDUP_FATAL(a1);
1123 STRDUP_FATAL(a2);
1124 STRDUP_FATAL(a3);
1125 plog(LLV_DEBUG, LOCATION, NULL,
1126 "naddr=%s, saddr=%s (masked=%s)\n",
1127 a1, a2, a3);
1128 free(a1);
1129 free(a2);
1130 free(a3);
1131 }
1132 if (cmpsaddrwop(&sa, &naddr->sa.sa) == 0)
1133 return naddr->prefix + port_score;
1134
1135 return -1;
1136 }
1137
1138 /* Some usefull functions for sockaddr port manipulations. */
1139 u_int16_t
extract_port(const struct sockaddr * addr)1140 extract_port (const struct sockaddr *addr)
1141 {
1142 u_int16_t port = 0;
1143
1144 if (!addr)
1145 return port;
1146
1147 switch (addr->sa_family) {
1148 case AF_INET:
1149 port = ((struct sockaddr_in *)addr)->sin_port;
1150 break;
1151 case AF_INET6:
1152 port = ((struct sockaddr_in6 *)addr)->sin6_port;
1153 break;
1154 default:
1155 plog(LLV_ERROR, LOCATION, NULL, "unknown AF: %u\n", addr->sa_family);
1156 break;
1157 }
1158
1159 return ntohs(port);
1160 }
1161
1162 u_int16_t *
get_port_ptr(struct sockaddr * addr)1163 get_port_ptr (struct sockaddr *addr)
1164 {
1165 u_int16_t *port_ptr;
1166
1167 if (!addr)
1168 return NULL;
1169
1170 switch (addr->sa_family) {
1171 case AF_INET:
1172 port_ptr = &(((struct sockaddr_in *)addr)->sin_port);
1173 break;
1174 case AF_INET6:
1175 port_ptr = &(((struct sockaddr_in6 *)addr)->sin6_port);
1176 break;
1177 default:
1178 plog(LLV_ERROR, LOCATION, NULL, "unknown AF: %u\n", addr->sa_family);
1179 return NULL;
1180 break;
1181 }
1182
1183 return port_ptr;
1184 }
1185
1186 u_int16_t *
set_port(struct sockaddr * addr,u_int16_t new_port)1187 set_port (struct sockaddr *addr, u_int16_t new_port)
1188 {
1189 u_int16_t *port_ptr;
1190
1191 port_ptr = get_port_ptr (addr);
1192
1193 if (port_ptr)
1194 *port_ptr = htons(new_port);
1195
1196 return port_ptr;
1197 }
1198