diff options
| -rw-r--r-- | configure.in | 8 | ||||
| -rw-r--r-- | src/libcharon/Makefile.am | 7 | ||||
| -rw-r--r-- | src/libcharon/plugins/kernel_libipsec/Makefile.am | 21 | ||||
| -rw-r--r-- | src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c | 189 | ||||
| -rw-r--r-- | src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.h | 47 | ||||
| -rw-r--r-- | src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c | 84 | ||||
| -rw-r--r-- | src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.h | 44 |
7 files changed, 400 insertions, 0 deletions
diff --git a/configure.in b/configure.in index 6a7f9ffb5..a89edb879 100644 --- a/configure.in +++ b/configure.in @@ -192,6 +192,7 @@ ARG_DISBL_SET([kernel-netlink], [disable the netlink kernel interface.]) ARG_ENABL_SET([kernel-pfkey], [enable the PF_KEY kernel interface.]) ARG_ENABL_SET([kernel-pfroute], [enable the PF_ROUTE kernel interface.]) ARG_ENABL_SET([kernel-klips], [enable the KLIPS kernel interface.]) +ARG_ENABL_SET([kernel-libipsec],[enable the libipsec kernel interface.]) ARG_ENABL_SET([libipsec], [enable user space IPsec implementation.]) ARG_DISBL_SET([socket-default], [disable default socket implementation for charon.]) ARG_ENABL_SET([socket-dynamic], [enable dynamic socket implementation for charon]) @@ -306,6 +307,10 @@ if test x$xauth_generic_given = xfalse -a x$ikev1 = xfalse; then xauth_generic=false; fi +if test x$kernel_libipsec = xtrue; then + libipsec=true; +fi + if test x$eap_aka_3gpp2 = xtrue; then gmp=true; fi @@ -1015,6 +1020,7 @@ ADD_PLUGIN([gcm], [s charon scripts nm cmd]) ADD_PLUGIN([attr], [h charon]) ADD_PLUGIN([attr-sql], [h charon]) ADD_PLUGIN([load-tester], [c charon]) +ADD_PLUGIN([kernel-libipsec], [c charon cmd]) ADD_PLUGIN([kernel-pfkey], [h charon starter nm cmd]) ADD_PLUGIN([kernel-pfroute], [h charon starter nm cmd]) ADD_PLUGIN([kernel-klips], [h charon starter]) @@ -1163,6 +1169,7 @@ AM_CONDITIONAL(USE_DHCP, test x$dhcp = xtrue) AM_CONDITIONAL(USE_UNIT_TESTS, test x$unit_tester = xtrue) AM_CONDITIONAL(USE_LOAD_TESTER, test x$load_tester = xtrue) AM_CONDITIONAL(USE_HA, test x$ha = xtrue) +AM_CONDITIONAL(USE_KERNEL_LIBIPSEC, test x$kernel_libipsec = xtrue) AM_CONDITIONAL(USE_WHITELIST, test x$whitelist = xtrue) AM_CONDITIONAL(USE_LOOKIP, test x$lookip = xtrue) AM_CONDITIONAL(USE_ERROR_NOTIFY, test x$error_notify = xtrue) @@ -1418,6 +1425,7 @@ AC_CONFIG_FILES([ src/libcharon/plugins/unity/Makefile src/libcharon/plugins/uci/Makefile src/libcharon/plugins/ha/Makefile + src/libcharon/plugins/kernel_libipsec/Makefile src/libcharon/plugins/whitelist/Makefile src/libcharon/plugins/lookip/Makefile src/libcharon/plugins/error_notify/Makefile diff --git a/src/libcharon/Makefile.am b/src/libcharon/Makefile.am index f0736c5ca..ae7867f35 100644 --- a/src/libcharon/Makefile.am +++ b/src/libcharon/Makefile.am @@ -485,6 +485,13 @@ if MONOLITHIC endif endif +if USE_KERNEL_LIBIPSEC + SUBDIRS += plugins/kernel_libipsec +if MONOLITHIC + libcharon_la_LIBADD += plugins/kernel_libipsec/libstrongswan-kernel-libipsec.la +endif +endif + if USE_WHITELIST SUBDIRS += plugins/whitelist if MONOLITHIC diff --git a/src/libcharon/plugins/kernel_libipsec/Makefile.am b/src/libcharon/plugins/kernel_libipsec/Makefile.am new file mode 100644 index 000000000..6337eb2f6 --- /dev/null +++ b/src/libcharon/plugins/kernel_libipsec/Makefile.am @@ -0,0 +1,21 @@ + +INCLUDES = -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libhydra \ + -I$(top_srcdir)/src/libcharon \ + -I$(top_srcdir)/src/libipsec + +AM_CFLAGS = -rdynamic + +if MONOLITHIC +noinst_LTLIBRARIES = libstrongswan-kernel-libipsec.la +else +plugin_LTLIBRARIES = libstrongswan-kernel-libipsec.la +endif + +libstrongswan_kernel_libipsec_la_SOURCES = \ + kernel_libipsec_plugin.h kernel_libipsec_plugin.c \ + kernel_libipsec_ipsec.h kernel_libipsec_ipsec.c + +libstrongswan_kernel_libipsec_la_LIBADD = $(top_builddir)/src/libipsec/libipsec.la + +libstrongswan_kernel_libipsec_la_LDFLAGS = -module -avoid-version diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c new file mode 100644 index 000000000..fdcbace51 --- /dev/null +++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c @@ -0,0 +1,189 @@ +/* + * Copyright (C) 2012-2013 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "kernel_libipsec_ipsec.h" + +#include <library.h> +#include <ipsec.h> +#include <hydra.h> +#include <utils/debug.h> + +typedef struct private_kernel_libipsec_ipsec_t private_kernel_libipsec_ipsec_t; + +struct private_kernel_libipsec_ipsec_t { + + /** + * Public libipsec_ipsec interface + */ + kernel_libipsec_ipsec_t public; + + /** + * Listener for lifetime expire events + */ + ipsec_event_listener_t ipsec_listener; +}; + +/** + * Expiration callback + */ +static void expire(u_int32_t reqid, u_int8_t protocol, u_int32_t spi, bool hard) +{ + hydra->kernel_interface->expire(hydra->kernel_interface, reqid, protocol, + spi, hard); +} + +METHOD(kernel_ipsec_t, get_spi, status_t, + private_kernel_libipsec_ipsec_t *this, host_t *src, host_t *dst, + u_int8_t protocol, u_int32_t reqid, u_int32_t *spi) +{ + return ipsec->sas->get_spi(ipsec->sas, src, dst, protocol, reqid, spi); +} + +METHOD(kernel_ipsec_t, get_cpi, status_t, + private_kernel_libipsec_ipsec_t *this, host_t *src, host_t *dst, + u_int32_t reqid, u_int16_t *cpi) +{ + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, add_sa, status_t, + private_kernel_libipsec_ipsec_t *this, host_t *src, host_t *dst, + u_int32_t spi, u_int8_t protocol, u_int32_t reqid, mark_t mark, + u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key, + u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode, u_int16_t ipcomp, + u_int16_t cpi, bool initiator, bool encap, bool esn, bool inbound, + traffic_selector_t *src_ts, traffic_selector_t *dst_ts) +{ + return ipsec->sas->add_sa(ipsec->sas, src, dst, spi, protocol, reqid, mark, + tfc, lifetime, enc_alg, enc_key, int_alg, int_key, + mode, ipcomp, cpi, initiator, encap, esn, inbound, + src_ts, dst_ts); +} + +METHOD(kernel_ipsec_t, update_sa, status_t, + private_kernel_libipsec_ipsec_t *this, u_int32_t spi, u_int8_t protocol, + u_int16_t cpi, host_t *src, host_t *dst, host_t *new_src, host_t *new_dst, + bool encap, bool new_encap, mark_t mark) +{ + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, query_sa, status_t, + private_kernel_libipsec_ipsec_t *this, host_t *src, host_t *dst, + u_int32_t spi, u_int8_t protocol, mark_t mark, u_int64_t *bytes, + u_int64_t *packets, u_int32_t *time) +{ + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, del_sa, status_t, + private_kernel_libipsec_ipsec_t *this, host_t *src, host_t *dst, + u_int32_t spi, u_int8_t protocol, u_int16_t cpi, mark_t mark) +{ + return ipsec->sas->del_sa(ipsec->sas, src, dst, spi, protocol, cpi, mark); +} + +METHOD(kernel_ipsec_t, flush_sas, status_t, + private_kernel_libipsec_ipsec_t *this) +{ + return ipsec->sas->flush_sas(ipsec->sas); +} + +METHOD(kernel_ipsec_t, add_policy, status_t, + private_kernel_libipsec_ipsec_t *this, host_t *src, host_t *dst, + traffic_selector_t *src_ts, traffic_selector_t *dst_ts, + policy_dir_t direction, policy_type_t type, ipsec_sa_cfg_t *sa, mark_t mark, + policy_priority_t priority) +{ + return ipsec->policies->add_policy(ipsec->policies, src, dst, src_ts, + dst_ts, direction, type, sa, mark, priority); +} + +METHOD(kernel_ipsec_t, query_policy, status_t, + private_kernel_libipsec_ipsec_t *this, traffic_selector_t *src_ts, + traffic_selector_t *dst_ts, policy_dir_t direction, mark_t mark, + u_int32_t *use_time) +{ + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, del_policy, status_t, + private_kernel_libipsec_ipsec_t *this, traffic_selector_t *src_ts, + traffic_selector_t *dst_ts, policy_dir_t direction, u_int32_t reqid, + mark_t mark, policy_priority_t priority) +{ + return ipsec->policies->del_policy(ipsec->policies, src_ts, dst_ts, + direction, reqid, mark, priority); +} + +METHOD(kernel_ipsec_t, flush_policies, status_t, + private_kernel_libipsec_ipsec_t *this) +{ + return ipsec->policies->flush_policies(ipsec->policies); +} + +METHOD(kernel_ipsec_t, bypass_socket, bool, + private_kernel_libipsec_ipsec_t *this, int fd, int family) +{ + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, enable_udp_decap, bool, + private_kernel_libipsec_ipsec_t *this, int fd, int family, u_int16_t port) +{ + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, destroy, void, + private_kernel_libipsec_ipsec_t *this) +{ + ipsec->events->unregister_listener(ipsec->events, &this->ipsec_listener); + free(this); +} + +/* + * Described in header. + */ +kernel_libipsec_ipsec_t *kernel_libipsec_ipsec_create() +{ + private_kernel_libipsec_ipsec_t *this; + + INIT(this, + .public = { + .interface = { + .get_spi = _get_spi, + .get_cpi = _get_cpi, + .add_sa = _add_sa, + .update_sa = _update_sa, + .query_sa = _query_sa, + .del_sa = _del_sa, + .flush_sas = _flush_sas, + .add_policy = _add_policy, + .query_policy = _query_policy, + .del_policy = _del_policy, + .flush_policies = _flush_policies, + .bypass_socket = _bypass_socket, + .enable_udp_decap = _enable_udp_decap, + .destroy = _destroy, + }, + }, + .ipsec_listener = { + .expire = expire, + }, + ); + + ipsec->events->register_listener(ipsec->events, &this->ipsec_listener); + + return &this->public; +}; diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.h b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.h new file mode 100644 index 000000000..0a4936706 --- /dev/null +++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.h @@ -0,0 +1,47 @@ +/* + * Copyright (C) 2012-2013 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup kernel_libipsec_ipsec kernel_libipsec_ipsec + * @{ @ingroup kernel_libipsec + */ + +#ifndef KERNEL_LIBIPSEC_IPSEC_H_ +#define KERNEL_LIBIPSEC_IPSEC_H_ + +#include <library.h> +#include <kernel/kernel_ipsec.h> + +typedef struct kernel_libipsec_ipsec_t kernel_libipsec_ipsec_t; + +/** + * Implementation of the ipsec interface using libipsec + */ +struct kernel_libipsec_ipsec_t { + + /** + * Implements kernel_ipsec_t interface + */ + kernel_ipsec_t interface; +}; + +/** + * Create a libipsec ipsec interface instance. + * + * @return kernel_libipsec_ipsec_t instance + */ +kernel_libipsec_ipsec_t *kernel_libipsec_ipsec_create(); + +#endif /** KERNEL_LIBIPSEC_IPSEC_H_ @}*/ diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c new file mode 100644 index 000000000..a20ee7b4b --- /dev/null +++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c @@ -0,0 +1,84 @@ +/* + * Copyright (C) 2012-2013 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "kernel_libipsec_plugin.h" +#include "kernel_libipsec_ipsec.h" + +#include <ipsec.h> +#include <utils/debug.h> + +typedef struct private_kernel_libipsec_plugin_t private_kernel_libipsec_plugin_t; + +/** + * private data of "kernel" libipsec plugin + */ +struct private_kernel_libipsec_plugin_t { + + /** + * implements plugin interface + */ + kernel_libipsec_plugin_t public; +}; + +METHOD(plugin_t, get_name, char*, + private_kernel_libipsec_plugin_t *this) +{ + return "kernel-libipsec"; +} + +METHOD(plugin_t, get_features, int, + private_kernel_libipsec_plugin_t *this, plugin_feature_t *features[]) +{ + static plugin_feature_t f[] = { + PLUGIN_CALLBACK(kernel_ipsec_register, kernel_libipsec_ipsec_create), + PLUGIN_PROVIDE(CUSTOM, "kernel-ipsec"), + }; + *features = f; + return countof(f); +} + +METHOD(plugin_t, destroy, void, + private_kernel_libipsec_plugin_t *this) +{ + libipsec_deinit(); + free(this); +} + +/* + * see header file + */ +plugin_t *kernel_libipsec_plugin_create() +{ + private_kernel_libipsec_plugin_t *this; + + INIT(this, + .public = { + .plugin = { + .get_name = _get_name, + .get_features = _get_features, + .destroy = _destroy, + }, + }, + ); + + if (!libipsec_init()) + { + DBG1(DBG_LIB, "initialization of libipsec failed"); + destroy(this); + return NULL; + } + + return &this->public.plugin; +} diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.h b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.h new file mode 100644 index 000000000..a14426b4e --- /dev/null +++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.h @@ -0,0 +1,44 @@ +/* + * Copyright (C) 2012-2013 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup kernel_libipsec kernel_libipsec + * @ingroup cplugins + * + * @defgroup kernel_libipsec_plugin kernel_libipsec_plugin + * @{ @ingroup kernel_libipsec + */ + +#ifndef KERNEL_LIBIPSEC_PLUGIN_H_ +#define KERNEL_LIBIPSEC_PLUGIN_H_ + +#include <library.h> +#include <plugins/plugin.h> + +typedef struct kernel_libipsec_plugin_t kernel_libipsec_plugin_t; + +/** + * libipsec "kernel" interface plugin + */ +struct kernel_libipsec_plugin_t { + + /** + * implements plugin interface + */ + plugin_t plugin; + +}; + +#endif /** KERNEL_LIBIPSEC_PLUGIN_H_ @}*/ |