| /* |
| * |
| * Copyright (C) 2017 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <random> |
| #include <string> |
| #include <vector> |
| |
| #include <ctype.h> |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <getopt.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #define __STDC_FORMAT_MACROS |
| #include <inttypes.h> |
| |
| #include <arpa/inet.h> |
| #include <netinet/in.h> |
| |
| #include <sys/socket.h> |
| #include <sys/stat.h> |
| #include <sys/types.h> |
| #include <sys/wait.h> |
| |
| #include <linux/in.h> |
| #include <linux/ipsec.h> |
| #include <linux/netlink.h> |
| #include <linux/xfrm.h> |
| |
| #define LOG_TAG "XfrmController" |
| #include "InterfaceController.h" |
| #include "NetdConstants.h" |
| #include "NetlinkCommands.h" |
| #include "ResponseCode.h" |
| #include "XfrmController.h" |
| #include "netdutils/Fd.h" |
| #include "netdutils/Slice.h" |
| #include "netdutils/Syscalls.h" |
| #include <android-base/properties.h> |
| #include <android-base/stringprintf.h> |
| #include <android-base/strings.h> |
| #include <android-base/unique_fd.h> |
| #include <android/net/INetd.h> |
| #include <cutils/log.h> |
| #include <cutils/properties.h> |
| #include <logwrap/logwrap.h> |
| |
| using android::net::INetd; |
| using android::netdutils::Fd; |
| using android::netdutils::Slice; |
| using android::netdutils::Status; |
| using android::netdutils::StatusOr; |
| using android::netdutils::Syscalls; |
| |
| namespace android { |
| namespace net { |
| |
| // Exposed for testing |
| constexpr uint32_t ALGO_MASK_AUTH_ALL = ~0; |
| // Exposed for testing |
| constexpr uint32_t ALGO_MASK_CRYPT_ALL = ~0; |
| // Exposed for testing |
| constexpr uint32_t ALGO_MASK_AEAD_ALL = ~0; |
| // Exposed for testing |
| constexpr uint8_t REPLAY_WINDOW_SIZE = 4; |
| |
| namespace { |
| |
| constexpr uint32_t RAND_SPI_MIN = 256; |
| constexpr uint32_t RAND_SPI_MAX = 0xFFFFFFFE; |
| |
| constexpr uint32_t INVALID_SPI = 0; |
| |
| static inline bool isEngBuild() { |
| static const std::string sBuildType = android::base::GetProperty("ro.build.type", "user"); |
| return sBuildType == "eng"; |
| } |
| |
| #define XFRM_MSG_TRANS(x) \ |
| case x: \ |
| return #x; |
| |
| const char* xfrmMsgTypeToString(uint16_t msg) { |
| switch (msg) { |
| XFRM_MSG_TRANS(XFRM_MSG_NEWSA) |
| XFRM_MSG_TRANS(XFRM_MSG_DELSA) |
| XFRM_MSG_TRANS(XFRM_MSG_GETSA) |
| XFRM_MSG_TRANS(XFRM_MSG_NEWPOLICY) |
| XFRM_MSG_TRANS(XFRM_MSG_DELPOLICY) |
| XFRM_MSG_TRANS(XFRM_MSG_GETPOLICY) |
| XFRM_MSG_TRANS(XFRM_MSG_ALLOCSPI) |
| XFRM_MSG_TRANS(XFRM_MSG_ACQUIRE) |
| XFRM_MSG_TRANS(XFRM_MSG_EXPIRE) |
| XFRM_MSG_TRANS(XFRM_MSG_UPDPOLICY) |
| XFRM_MSG_TRANS(XFRM_MSG_UPDSA) |
| XFRM_MSG_TRANS(XFRM_MSG_POLEXPIRE) |
| XFRM_MSG_TRANS(XFRM_MSG_FLUSHSA) |
| XFRM_MSG_TRANS(XFRM_MSG_FLUSHPOLICY) |
| XFRM_MSG_TRANS(XFRM_MSG_NEWAE) |
| XFRM_MSG_TRANS(XFRM_MSG_GETAE) |
| XFRM_MSG_TRANS(XFRM_MSG_REPORT) |
| XFRM_MSG_TRANS(XFRM_MSG_MIGRATE) |
| XFRM_MSG_TRANS(XFRM_MSG_NEWSADINFO) |
| XFRM_MSG_TRANS(XFRM_MSG_GETSADINFO) |
| XFRM_MSG_TRANS(XFRM_MSG_GETSPDINFO) |
| XFRM_MSG_TRANS(XFRM_MSG_NEWSPDINFO) |
| XFRM_MSG_TRANS(XFRM_MSG_MAPPING) |
| default: |
| return "XFRM_MSG UNKNOWN"; |
| } |
| } |
| |
| // actually const but cannot be declared as such for reasons |
| uint8_t kPadBytesArray[] = {0, 0, 0}; |
| void* kPadBytes = static_cast<void*>(kPadBytesArray); |
| |
| #define LOG_HEX(__desc16__, __buf__, __len__) \ |
| do { \ |
| if (isEngBuild()) { \ |
| logHex(__desc16__, __buf__, __len__); \ |
| } \ |
| } while (0) |
| |
| #define LOG_IOV(__iov__) \ |
| do { \ |
| if (isEngBuild()) { \ |
| logIov(__iov__); \ |
| } \ |
| } while (0) |
| |
| void logHex(const char* desc16, const char* buf, size_t len) { |
| char* printBuf = new char[len * 2 + 1 + 26]; // len->ascii, +newline, +prefix strlen |
| int offset = 0; |
| if (desc16) { |
| sprintf(printBuf, "{%-16s}", desc16); |
| offset += 18; // prefix string length |
| } |
| sprintf(printBuf + offset, "[%4.4u]: ", (len > 9999) ? 9999 : (unsigned)len); |
| offset += 8; |
| |
| for (uint32_t j = 0; j < (uint32_t)len; j++) { |
| sprintf(&printBuf[j * 2 + offset], "%0.2x", (unsigned char)buf[j]); |
| } |
| ALOGD("%s", printBuf); |
| delete[] printBuf; |
| } |
| |
| void logIov(const std::vector<iovec>& iov) { |
| for (const iovec& row : iov) { |
| logHex(0, reinterpret_cast<char*>(row.iov_base), row.iov_len); |
| } |
| } |
| |
| size_t fillNlAttr(__u16 nlaType, size_t valueSize, nlattr* nlAttr) { |
| size_t dataLen = valueSize; |
| int padLength = NLMSG_ALIGN(dataLen) - dataLen; |
| nlAttr->nla_len = (__u16)(dataLen + sizeof(nlattr)); |
| nlAttr->nla_type = nlaType; |
| return padLength; |
| } |
| |
| size_t fillNlAttrIpAddress(__u16 nlaType, int family, const std::string& value, nlattr* nlAttr, |
| Slice ipAddress) { |
| inet_pton(family, value.c_str(), ipAddress.base()); |
| return fillNlAttr(nlaType, (family == AF_INET) ? sizeof(in_addr) : sizeof(in6_addr), nlAttr); |
| } |
| |
| size_t fillNlAttrU32(__u16 nlaType, int32_t value, nlattr* nlAttr, uint32_t* u32Value) { |
| *u32Value = htonl(value); |
| return fillNlAttr(nlaType, sizeof((*u32Value)), nlAttr); |
| } |
| |
| // returns the address family, placing the string in the provided buffer |
| StatusOr<uint16_t> convertStringAddress(std::string addr, uint8_t* buffer) { |
| if (inet_pton(AF_INET, addr.c_str(), buffer) == 1) { |
| return AF_INET; |
| } else if (inet_pton(AF_INET6, addr.c_str(), buffer) == 1) { |
| return AF_INET6; |
| } else { |
| return Status(EAFNOSUPPORT); |
| } |
| } |
| |
| // TODO: Need to consider a way to refer to the sSycalls instance |
| inline Syscalls& getSyscallInstance() { return netdutils::sSyscalls.get(); } |
| |
| class XfrmSocketImpl : public XfrmSocket { |
| private: |
| static constexpr int NLMSG_DEFAULTSIZE = 8192; |
| |
| union NetlinkResponse { |
| nlmsghdr hdr; |
| struct _err_ { |
| nlmsghdr hdr; |
| nlmsgerr err; |
| } err; |
| |
| struct _buf_ { |
| nlmsghdr hdr; |
| char buf[NLMSG_DEFAULTSIZE]; |
| } buf; |
| }; |
| |
| public: |
| netdutils::Status open() override { |
| mSock = openNetlinkSocket(NETLINK_XFRM); |
| if (mSock < 0) { |
| ALOGW("Could not get a new socket, line=%d", __LINE__); |
| return netdutils::statusFromErrno(-mSock, "Could not open netlink socket"); |
| } |
| |
| return netdutils::status::ok; |
| } |
| |
| static netdutils::Status validateResponse(NetlinkResponse response, size_t len) { |
| if (len < sizeof(nlmsghdr)) { |
| ALOGW("Invalid response message received over netlink"); |
| return netdutils::statusFromErrno(EBADMSG, "Invalid message"); |
| } |
| |
| switch (response.hdr.nlmsg_type) { |
| case NLMSG_NOOP: |
| case NLMSG_DONE: |
| return netdutils::status::ok; |
| case NLMSG_OVERRUN: |
| ALOGD("Netlink request overran kernel buffer"); |
| return netdutils::statusFromErrno(EBADMSG, "Kernel buffer overrun"); |
| case NLMSG_ERROR: |
| if (len < sizeof(NetlinkResponse::_err_)) { |
| ALOGD("Netlink message received malformed error response"); |
| return netdutils::statusFromErrno(EBADMSG, "Malformed error response"); |
| } |
| return netdutils::statusFromErrno( |
| -response.err.err.error, |
| "Error netlink message"); // Netlink errors are negative errno. |
| case XFRM_MSG_NEWSA: |
| break; |
| } |
| |
| if (response.hdr.nlmsg_type < XFRM_MSG_BASE /*== NLMSG_MIN_TYPE*/ || |
| response.hdr.nlmsg_type > XFRM_MSG_MAX) { |
| ALOGD("Netlink message responded with an out-of-range message ID"); |
| return netdutils::statusFromErrno(EBADMSG, "Invalid message ID"); |
| } |
| |
| // TODO Add more message validation here |
| return netdutils::status::ok; |
| } |
| |
| netdutils::Status sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, uint16_t nlMsgSeqNum, |
| std::vector<iovec>* iovecs) const override { |
| nlmsghdr nlMsg = { |
| .nlmsg_type = nlMsgType, |
| .nlmsg_flags = nlMsgFlags, |
| .nlmsg_seq = nlMsgSeqNum, |
| }; |
| |
| (*iovecs)[0].iov_base = &nlMsg; |
| (*iovecs)[0].iov_len = NLMSG_HDRLEN; |
| for (const iovec& iov : *iovecs) { |
| nlMsg.nlmsg_len += iov.iov_len; |
| } |
| |
| ALOGD("Sending Netlink XFRM Message: %s", xfrmMsgTypeToString(nlMsgType)); |
| LOG_IOV(*iovecs); |
| |
| StatusOr<size_t> writeResult = getSyscallInstance().writev(mSock, *iovecs); |
| if (!isOk(writeResult)) { |
| ALOGE("netlink socket writev failed (%s)", toString(writeResult).c_str()); |
| return writeResult; |
| } |
| |
| if (nlMsg.nlmsg_len != writeResult.value()) { |
| ALOGE("Invalid netlink message length sent %d", static_cast<int>(writeResult.value())); |
| return netdutils::statusFromErrno(EBADMSG, "Invalid message length"); |
| } |
| |
| NetlinkResponse response = {}; |
| |
| StatusOr<Slice> readResult = |
| getSyscallInstance().read(Fd(mSock), netdutils::makeSlice(response)); |
| if (!isOk(readResult)) { |
| ALOGE("netlink response error (%s)", toString(readResult).c_str()); |
| return readResult; |
| } |
| |
| LOG_HEX("netlink msg resp", reinterpret_cast<char*>(readResult.value().base()), |
| readResult.value().size()); |
| |
| Status validateStatus = validateResponse(response, readResult.value().size()); |
| if (!isOk(validateStatus)) { |
| ALOGE("netlink response contains error (%s)", toString(validateStatus).c_str()); |
| } |
| |
| return validateStatus; |
| } |
| }; |
| |
| StatusOr<int> convertToXfrmAddr(const std::string& strAddr, xfrm_address_t* xfrmAddr) { |
| if (strAddr.length() == 0) { |
| memset(xfrmAddr, 0, sizeof(*xfrmAddr)); |
| return AF_UNSPEC; |
| } |
| |
| if (inet_pton(AF_INET6, strAddr.c_str(), reinterpret_cast<void*>(xfrmAddr))) { |
| return AF_INET6; |
| } else if (inet_pton(AF_INET, strAddr.c_str(), reinterpret_cast<void*>(xfrmAddr))) { |
| return AF_INET; |
| } else { |
| return netdutils::statusFromErrno(EAFNOSUPPORT, "Invalid address family"); |
| } |
| } |
| |
| void fillXfrmNlaHdr(nlattr* hdr, uint16_t type, uint16_t len) { |
| hdr->nla_type = type; |
| hdr->nla_len = len; |
| } |
| |
| void fillXfrmCurLifetimeDefaults(xfrm_lifetime_cur* cur) { |
| memset(reinterpret_cast<char*>(cur), 0, sizeof(*cur)); |
| } |
| void fillXfrmLifetimeDefaults(xfrm_lifetime_cfg* cfg) { |
| cfg->soft_byte_limit = XFRM_INF; |
| cfg->hard_byte_limit = XFRM_INF; |
| cfg->soft_packet_limit = XFRM_INF; |
| cfg->hard_packet_limit = XFRM_INF; |
| } |
| |
| /* |
| * Allocate SPIs within an (inclusive) range of min-max. |
| * returns 0 (INVALID_SPI) once the entire range has been parsed. |
| */ |
| class RandomSpi { |
| public: |
| RandomSpi(int min, int max) : mMin(min) { |
| // Re-seeding should be safe because the seed itself is |
| // sufficiently random and we don't need secure random |
| std::mt19937 rnd = std::mt19937(std::random_device()()); |
| mNext = std::uniform_int_distribution<>(1, INT_MAX)(rnd); |
| mSize = max - min + 1; |
| mCount = mSize; |
| } |
| |
| uint32_t next() { |
| if (!mCount) |
| return 0; |
| mCount--; |
| return (mNext++ % mSize) + mMin; |
| } |
| |
| private: |
| uint32_t mNext; |
| uint32_t mSize; |
| uint32_t mMin; |
| uint32_t mCount; |
| }; |
| |
| } // namespace |
| |
| // |
| // Begin XfrmController Impl |
| // |
| // |
| XfrmController::XfrmController(void) {} |
| |
| netdutils::Status XfrmController::Init() { |
| RETURN_IF_NOT_OK(flushInterfaces()); |
| XfrmSocketImpl sock; |
| RETURN_IF_NOT_OK(sock.open()); |
| RETURN_IF_NOT_OK(flushSaDb(sock)); |
| return flushPolicyDb(sock); |
| } |
| |
| netdutils::Status XfrmController::flushInterfaces() { |
| const auto& ifaces = InterfaceController::getIfaceNames(); |
| RETURN_IF_NOT_OK(ifaces); |
| const String8 ifPrefix8 = String8(INetd::IPSEC_INTERFACE_PREFIX().string()); |
| |
| for (const std::string& iface : ifaces.value()) { |
| int status = 0; |
| // Look for the reserved interface prefix, which must be in the name at position 0 |
| if (!iface.compare(0, ifPrefix8.length(), ifPrefix8.c_str()) && |
| (status = removeVirtualTunnelInterface(iface)) < 0) { |
| ALOGE("Failed to delete ipsec tunnel %s.", iface.c_str()); |
| return netdutils::statusFromErrno(status, "Failed to remove ipsec tunnel."); |
| } |
| } |
| return netdutils::status::ok; |
| } |
| |
| netdutils::Status XfrmController::flushSaDb(const XfrmSocket& s) { |
| struct xfrm_usersa_flush flushUserSa = {.proto = IPSEC_PROTO_ANY}; |
| |
| std::vector<iovec> iov = {{NULL, 0}, // reserved for the eventual addition of a NLMSG_HDR |
| {&flushUserSa, sizeof(flushUserSa)}, // xfrm_usersa_flush structure |
| {kPadBytes, NLMSG_ALIGN(sizeof(flushUserSa)) - sizeof(flushUserSa)}}; |
| |
| return s.sendMessage(XFRM_MSG_FLUSHSA, NETLINK_REQUEST_FLAGS, 0, &iov); |
| } |
| |
| netdutils::Status XfrmController::flushPolicyDb(const XfrmSocket& s) { |
| std::vector<iovec> iov = {{NULL, 0}}; // reserved for the eventual addition of a NLMSG_HDR |
| return s.sendMessage(XFRM_MSG_FLUSHPOLICY, NETLINK_REQUEST_FLAGS, 0, &iov); |
| } |
| |
| netdutils::Status XfrmController::ipSecSetEncapSocketOwner(const android::base::unique_fd& socket, |
| int newUid, uid_t callerUid) { |
| ALOGD("XfrmController:%s, line=%d", __FUNCTION__, __LINE__); |
| |
| const int fd = socket.get(); |
| struct stat info; |
| if (fstat(fd, &info)) { |
| return netdutils::statusFromErrno(errno, "Failed to stat socket file descriptor"); |
| } |
| if (info.st_uid != callerUid) { |
| return netdutils::statusFromErrno(EPERM, "fchown disabled for non-owner calls"); |
| } |
| if (S_ISSOCK(info.st_mode) == 0) { |
| return netdutils::statusFromErrno(EINVAL, "File descriptor was not a socket"); |
| } |
| |
| int optval; |
| socklen_t optlen = sizeof(optval); |
| netdutils::Status status = |
| getSyscallInstance().getsockopt(Fd(socket), IPPROTO_UDP, UDP_ENCAP, &optval, &optlen); |
| if (status != netdutils::status::ok) { |
| return status; |
| } |
| if (optval != UDP_ENCAP_ESPINUDP && optval != UDP_ENCAP_ESPINUDP_NON_IKE) { |
| return netdutils::statusFromErrno(EINVAL, "Socket did not have UDP-encap sockopt set"); |
| } |
| if (fchown(fd, newUid, -1)) { |
| return netdutils::statusFromErrno(errno, "Failed to fchown socket file descriptor"); |
| } |
| |
| return netdutils::status::ok; |
| } |
| |
| netdutils::Status XfrmController::ipSecAllocateSpi(int32_t transformId, |
| const std::string& sourceAddress, |
| const std::string& destinationAddress, |
| int32_t inSpi, int32_t* outSpi) { |
| ALOGD("XfrmController:%s, line=%d", __FUNCTION__, __LINE__); |
| ALOGD("transformId=%d", transformId); |
| ALOGD("sourceAddress=%s", sourceAddress.c_str()); |
| ALOGD("destinationAddress=%s", destinationAddress.c_str()); |
| ALOGD("inSpi=%0.8x", inSpi); |
| |
| XfrmSaInfo saInfo{}; |
| netdutils::Status ret = |
| fillXfrmId(sourceAddress, destinationAddress, INVALID_SPI, 0, 0, transformId, &saInfo); |
| if (!isOk(ret)) { |
| return ret; |
| } |
| |
| XfrmSocketImpl sock; |
| netdutils::Status socketStatus = sock.open(); |
| if (!isOk(socketStatus)) { |
| ALOGD("Sock open failed for XFRM, line=%d", __LINE__); |
| return socketStatus; |
| } |
| |
| int minSpi = RAND_SPI_MIN, maxSpi = RAND_SPI_MAX; |
| |
| if (inSpi) |
| minSpi = maxSpi = inSpi; |
| |
| ret = allocateSpi(saInfo, minSpi, maxSpi, reinterpret_cast<uint32_t*>(outSpi), sock); |
| if (!isOk(ret)) { |
| // TODO: May want to return a new Status with a modified status string |
| ALOGD("Failed to Allocate an SPI, line=%d", __LINE__); |
| *outSpi = INVALID_SPI; |
| } |
| |
| return ret; |
| } |
| |
| netdutils::Status XfrmController::ipSecAddSecurityAssociation( |
| int32_t transformId, int32_t mode, const std::string& sourceAddress, |
| const std::string& destinationAddress, int32_t underlyingNetId, int32_t spi, int32_t markValue, |
| int32_t markMask, const std::string& authAlgo, const std::vector<uint8_t>& authKey, |
| int32_t authTruncBits, const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, |
| int32_t cryptTruncBits, const std::string& aeadAlgo, const std::vector<uint8_t>& aeadKey, |
| int32_t aeadIcvBits, int32_t encapType, int32_t encapLocalPort, int32_t encapRemotePort) { |
| ALOGD("XfrmController::%s, line=%d", __FUNCTION__, __LINE__); |
| ALOGD("transformId=%d", transformId); |
| ALOGD("mode=%d", mode); |
| ALOGD("sourceAddress=%s", sourceAddress.c_str()); |
| ALOGD("destinationAddress=%s", destinationAddress.c_str()); |
| ALOGD("underlyingNetworkId=%d", underlyingNetId); |
| ALOGD("spi=%0.8x", spi); |
| ALOGD("markValue=%x", markValue); |
| ALOGD("markMask=%x", markMask); |
| ALOGD("authAlgo=%s", authAlgo.c_str()); |
| ALOGD("authTruncBits=%d", authTruncBits); |
| ALOGD("cryptAlgo=%s", cryptAlgo.c_str()); |
| ALOGD("cryptTruncBits=%d,", cryptTruncBits); |
| ALOGD("aeadAlgo=%s", aeadAlgo.c_str()); |
| ALOGD("aeadIcvBits=%d,", aeadIcvBits); |
| ALOGD("encapType=%d", encapType); |
| ALOGD("encapLocalPort=%d", encapLocalPort); |
| ALOGD("encapRemotePort=%d", encapRemotePort); |
| |
| XfrmSaInfo saInfo{}; |
| netdutils::Status ret = fillXfrmId(sourceAddress, destinationAddress, spi, markValue, markMask, |
| transformId, &saInfo); |
| if (!isOk(ret)) { |
| return ret; |
| } |
| |
| saInfo.auth = XfrmAlgo{ |
| .name = authAlgo, .key = authKey, .truncLenBits = static_cast<uint16_t>(authTruncBits)}; |
| |
| saInfo.crypt = XfrmAlgo{ |
| .name = cryptAlgo, .key = cryptKey, .truncLenBits = static_cast<uint16_t>(cryptTruncBits)}; |
| |
| saInfo.aead = XfrmAlgo{ |
| .name = aeadAlgo, .key = aeadKey, .truncLenBits = static_cast<uint16_t>(aeadIcvBits)}; |
| |
| switch (static_cast<XfrmMode>(mode)) { |
| case XfrmMode::TRANSPORT: |
| case XfrmMode::TUNNEL: |
| saInfo.mode = static_cast<XfrmMode>(mode); |
| break; |
| default: |
| return netdutils::statusFromErrno(EINVAL, "Invalid xfrm mode"); |
| } |
| |
| XfrmSocketImpl sock; |
| netdutils::Status socketStatus = sock.open(); |
| if (!isOk(socketStatus)) { |
| ALOGD("Sock open failed for XFRM, line=%d", __LINE__); |
| return socketStatus; |
| } |
| |
| switch (static_cast<XfrmEncapType>(encapType)) { |
| case XfrmEncapType::ESPINUDP: |
| case XfrmEncapType::ESPINUDP_NON_IKE: |
| if (saInfo.addrFamily != AF_INET) { |
| return netdutils::statusFromErrno(EAFNOSUPPORT, "IPv6 encap not supported"); |
| } |
| // The ports are not used on input SAs, so this is OK to be wrong when |
| // direction is ultimately input. |
| saInfo.encap.srcPort = encapLocalPort; |
| saInfo.encap.dstPort = encapRemotePort; |
| // fall through |
| case XfrmEncapType::NONE: |
| saInfo.encap.type = static_cast<XfrmEncapType>(encapType); |
| break; |
| default: |
| return netdutils::statusFromErrno(EINVAL, "Invalid encap type"); |
| } |
| |
| saInfo.netId = underlyingNetId; |
| |
| ret = updateSecurityAssociation(saInfo, sock); |
| if (!isOk(ret)) { |
| ALOGD("Failed updating a Security Association, line=%d", __LINE__); |
| } |
| |
| return ret; |
| } |
| |
| netdutils::Status XfrmController::ipSecDeleteSecurityAssociation( |
| int32_t transformId, const std::string& sourceAddress, const std::string& destinationAddress, |
| int32_t spi, int32_t markValue, int32_t markMask) { |
| ALOGD("XfrmController:%s, line=%d", __FUNCTION__, __LINE__); |
| ALOGD("transformId=%d", transformId); |
| ALOGD("sourceAddress=%s", sourceAddress.c_str()); |
| ALOGD("destinationAddress=%s", destinationAddress.c_str()); |
| ALOGD("spi=%0.8x", spi); |
| ALOGD("markValue=%x", markValue); |
| ALOGD("markMask=%x", markMask); |
| |
| XfrmId saId{}; |
| netdutils::Status ret = |
| fillXfrmId(sourceAddress, destinationAddress, spi, markValue, markMask, transformId, &saId); |
| if (!isOk(ret)) { |
| return ret; |
| } |
| |
| XfrmSocketImpl sock; |
| netdutils::Status socketStatus = sock.open(); |
| if (!isOk(socketStatus)) { |
| ALOGD("Sock open failed for XFRM, line=%d", __LINE__); |
| return socketStatus; |
| } |
| |
| ret = deleteSecurityAssociation(saId, sock); |
| if (!isOk(ret)) { |
| ALOGD("Failed to delete Security Association, line=%d", __LINE__); |
| } |
| |
| return ret; |
| } |
| |
| netdutils::Status XfrmController::fillXfrmId(const std::string& sourceAddress, |
| const std::string& destinationAddress, int32_t spi, |
| int32_t markValue, int32_t markMask, |
| int32_t transformId, XfrmId* xfrmId) { |
| // Fill the straightforward fields first |
| xfrmId->transformId = transformId; |
| xfrmId->spi = htonl(spi); |
| xfrmId->mark.v = markValue; |
| xfrmId->mark.m = markMask; |
| |
| // Use the addresses to determine the address family and do validation |
| xfrm_address_t sourceXfrmAddr{}, destXfrmAddr{}; |
| StatusOr<int> sourceFamily, destFamily; |
| sourceFamily = convertToXfrmAddr(sourceAddress, &sourceXfrmAddr); |
| destFamily = convertToXfrmAddr(destinationAddress, &destXfrmAddr); |
| if (!isOk(sourceFamily) || !isOk(destFamily)) { |
| return netdutils::statusFromErrno(EINVAL, "Invalid address " + sourceAddress + "/" + |
| destinationAddress); |
| } |
| |
| if (destFamily.value() == AF_UNSPEC || |
| (sourceFamily.value() != AF_UNSPEC && sourceFamily.value() != destFamily.value())) { |
| ALOGD("Invalid or Mismatched Address Families, %d != %d, line=%d", sourceFamily.value(), |
| destFamily.value(), __LINE__); |
| return netdutils::statusFromErrno(EINVAL, "Invalid or mismatched address families"); |
| } |
| |
| xfrmId->addrFamily = destFamily.value(); |
| |
| xfrmId->dstAddr = destXfrmAddr; |
| xfrmId->srcAddr = sourceXfrmAddr; |
| return netdutils::status::ok; |
| } |
| |
| netdutils::Status XfrmController::ipSecApplyTransportModeTransform( |
| const android::base::unique_fd& socket, int32_t transformId, int32_t direction, |
| const std::string& sourceAddress, const std::string& destinationAddress, int32_t spi) { |
| ALOGD("XfrmController::%s, line=%d", __FUNCTION__, __LINE__); |
| ALOGD("transformId=%d", transformId); |
| ALOGD("direction=%d", direction); |
| ALOGD("sourceAddress=%s", sourceAddress.c_str()); |
| ALOGD("destinationAddress=%s", destinationAddress.c_str()); |
| ALOGD("spi=%0.8x", spi); |
| |
| StatusOr<sockaddr_storage> ret = getSyscallInstance().getsockname<sockaddr_storage>(Fd(socket)); |
| if (!isOk(ret)) { |
| ALOGE("Failed to get socket info in %s", __FUNCTION__); |
| return ret; |
| } |
| struct sockaddr_storage saddr = ret.value(); |
| |
| XfrmSaInfo saInfo{}; |
| netdutils::Status status = |
| fillXfrmId(sourceAddress, destinationAddress, spi, 0, 0, transformId, &saInfo); |
| if (!isOk(status)) { |
| ALOGE("Couldn't build SA ID %s", __FUNCTION__); |
| return status; |
| } |
| |
| if (saddr.ss_family == AF_INET && saInfo.addrFamily != AF_INET) { |
| ALOGE("IPV4 socket address family(%d) should match IPV4 Transform " |
| "address family(%d)!", |
| saddr.ss_family, saInfo.addrFamily); |
| return netdutils::statusFromErrno(EINVAL, "Mismatched address family"); |
| } |
| |
| struct { |
| xfrm_userpolicy_info info; |
| xfrm_user_tmpl tmpl; |
| } policy{}; |
| |
| fillTransportModeUserSpInfo(saInfo, static_cast<XfrmDirection>(direction), &policy.info); |
| fillUserTemplate(saInfo, &policy.tmpl); |
| |
| LOG_HEX("XfrmUserPolicy", reinterpret_cast<char*>(&policy), sizeof(policy)); |
| |
| int sockOpt, sockLayer; |
| switch (saddr.ss_family) { |
| case AF_INET: |
| sockOpt = IP_XFRM_POLICY; |
| sockLayer = SOL_IP; |
| break; |
| case AF_INET6: |
| sockOpt = IPV6_XFRM_POLICY; |
| sockLayer = SOL_IPV6; |
| break; |
| default: |
| return netdutils::statusFromErrno(EAFNOSUPPORT, "Invalid address family"); |
| } |
| |
| status = getSyscallInstance().setsockopt(Fd(socket), sockLayer, sockOpt, policy); |
| if (!isOk(status)) { |
| ALOGE("Error setting socket option for XFRM! (%s)", toString(status).c_str()); |
| } |
| |
| return status; |
| } |
| |
| netdutils::Status |
| XfrmController::ipSecRemoveTransportModeTransform(const android::base::unique_fd& socket) { |
| ALOGD("XfrmController::%s, line=%d", __FUNCTION__, __LINE__); |
| |
| StatusOr<sockaddr_storage> ret = getSyscallInstance().getsockname<sockaddr_storage>(Fd(socket)); |
| if (!isOk(ret)) { |
| ALOGE("Failed to get socket info in %s! (%s)", __FUNCTION__, toString(ret).c_str()); |
| return ret; |
| } |
| |
| int sockOpt, sockLayer; |
| switch (ret.value().ss_family) { |
| case AF_INET: |
| sockOpt = IP_XFRM_POLICY; |
| sockLayer = SOL_IP; |
| break; |
| case AF_INET6: |
| sockOpt = IPV6_XFRM_POLICY; |
| sockLayer = SOL_IPV6; |
| break; |
| default: |
| return netdutils::statusFromErrno(EAFNOSUPPORT, "Invalid address family"); |
| } |
| |
| // Kernel will delete the security policy on this socket for both direction |
| // if optval is set to NULL and optlen is set to 0. |
| netdutils::Status status = |
| getSyscallInstance().setsockopt(Fd(socket), sockLayer, sockOpt, NULL, 0); |
| if (!isOk(status)) { |
| ALOGE("Error removing socket option for XFRM! (%s)", toString(status).c_str()); |
| } |
| |
| return status; |
| } |
| |
| netdutils::Status XfrmController::ipSecAddSecurityPolicy(int32_t transformId, int32_t direction, |
| const std::string& localAddress, |
| const std::string& remoteAddress, |
| int32_t spi, int32_t markValue, |
| int32_t markMask) { |
| return processSecurityPolicy(transformId, direction, localAddress, remoteAddress, spi, |
| markValue, markMask, XFRM_MSG_NEWPOLICY); |
| } |
| |
| netdutils::Status XfrmController::ipSecUpdateSecurityPolicy(int32_t transformId, int32_t direction, |
| const std::string& localAddress, |
| const std::string& remoteAddress, |
| int32_t spi, int32_t markValue, |
| int32_t markMask) { |
| return processSecurityPolicy(transformId, direction, localAddress, remoteAddress, spi, |
| markValue, markMask, XFRM_MSG_UPDPOLICY); |
| } |
| |
| netdutils::Status XfrmController::ipSecDeleteSecurityPolicy(int32_t transformId, int32_t direction, |
| const std::string& localAddress, |
| const std::string& remoteAddress, |
| int32_t markValue, int32_t markMask) { |
| return processSecurityPolicy(transformId, direction, localAddress, remoteAddress, 0, markValue, |
| markMask, XFRM_MSG_DELPOLICY); |
| } |
| |
| netdutils::Status XfrmController::processSecurityPolicy(int32_t transformId, int32_t direction, |
| const std::string& localAddress, |
| const std::string& remoteAddress, |
| int32_t spi, int32_t markValue, |
| int32_t markMask, int32_t msgType) { |
| ALOGD("XfrmController::%s, line=%d", __FUNCTION__, __LINE__); |
| ALOGD("transformId=%d", transformId); |
| ALOGD("direction=%d", direction); |
| ALOGD("localAddress=%s", localAddress.c_str()); |
| ALOGD("remoteAddress=%s", remoteAddress.c_str()); |
| ALOGD("spi=%0.8x", spi); |
| ALOGD("markValue=%d", markValue); |
| ALOGD("markMask=%d", markMask); |
| ALOGD("msgType=%d", msgType); |
| |
| XfrmSaInfo saInfo{}; |
| saInfo.mode = XfrmMode::TUNNEL; |
| |
| XfrmSocketImpl sock; |
| RETURN_IF_NOT_OK(sock.open()); |
| |
| RETURN_IF_NOT_OK( |
| fillXfrmId(localAddress, remoteAddress, spi, markValue, markMask, transformId, &saInfo)); |
| |
| if (msgType == XFRM_MSG_DELPOLICY) { |
| return deleteTunnelModeSecurityPolicy(saInfo, sock, static_cast<XfrmDirection>(direction)); |
| } else { |
| return updateTunnelModeSecurityPolicy(saInfo, sock, static_cast<XfrmDirection>(direction), |
| msgType); |
| } |
| } |
| |
| void XfrmController::fillXfrmSelector(const XfrmSaInfo& record, xfrm_selector* selector) { |
| selector->family = record.addrFamily; |
| selector->proto = AF_UNSPEC; // TODO: do we need to match the protocol? it's |
| // possible via the socket |
| } |
| |
| netdutils::Status XfrmController::updateSecurityAssociation(const XfrmSaInfo& record, |
| const XfrmSocket& sock) { |
| xfrm_usersa_info usersa{}; |
| nlattr_algo_crypt crypt{}; |
| nlattr_algo_auth auth{}; |
| nlattr_algo_aead aead{}; |
| nlattr_xfrm_mark xfrmmark{}; |
| nlattr_xfrm_output_mark xfrmoutputmark{}; |
| nlattr_encap_tmpl encap{}; |
| |
| enum { |
| NLMSG_HDR, |
| USERSA, |
| USERSA_PAD, |
| CRYPT, |
| CRYPT_PAD, |
| AUTH, |
| AUTH_PAD, |
| AEAD, |
| AEAD_PAD, |
| MARK, |
| MARK_PAD, |
| OUTPUT_MARK, |
| OUTPUT_MARK_PAD, |
| ENCAP, |
| ENCAP_PAD, |
| }; |
| |
| std::vector<iovec> iov = { |
| {NULL, 0}, // reserved for the eventual addition of a NLMSG_HDR |
| {&usersa, 0}, // main usersa_info struct |
| {kPadBytes, 0}, // up to NLMSG_ALIGNTO pad bytes of padding |
| {&crypt, 0}, // adjust size if crypt algo is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| {&auth, 0}, // adjust size if auth algo is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| {&aead, 0}, // adjust size if aead algo is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| {&xfrmmark, 0}, // adjust size if xfrm mark is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| {&xfrmoutputmark, 0}, // adjust size if xfrm output mark is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| {&encap, 0}, // adjust size if encapsulating |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| }; |
| |
| if (!record.aead.name.empty() && (!record.auth.name.empty() || !record.crypt.name.empty())) { |
| return netdutils::statusFromErrno(EINVAL, "Invalid xfrm algo selection; AEAD is mutually " |
| "exclusive with both Authentication and " |
| "Encryption"); |
| } |
| |
| if (record.aead.key.size() > MAX_KEY_LENGTH || record.auth.key.size() > MAX_KEY_LENGTH || |
| record.crypt.key.size() > MAX_KEY_LENGTH) { |
| return netdutils::statusFromErrno(EINVAL, "Key length invalid; exceeds MAX_KEY_LENGTH"); |
| } |
| |
| int len; |
| len = iov[USERSA].iov_len = fillUserSaInfo(record, &usersa); |
| iov[USERSA_PAD].iov_len = NLMSG_ALIGN(len) - len; |
| |
| len = iov[CRYPT].iov_len = fillNlAttrXfrmAlgoEnc(record.crypt, &crypt); |
| iov[CRYPT_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| len = iov[AUTH].iov_len = fillNlAttrXfrmAlgoAuth(record.auth, &auth); |
| iov[AUTH_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| len = iov[AEAD].iov_len = fillNlAttrXfrmAlgoAead(record.aead, &aead); |
| iov[AEAD_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| len = iov[MARK].iov_len = fillNlAttrXfrmMark(record, &xfrmmark); |
| iov[MARK_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| len = iov[OUTPUT_MARK].iov_len = fillNlAttrXfrmOutputMark(record.netId, &xfrmoutputmark); |
| iov[OUTPUT_MARK_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| len = iov[ENCAP].iov_len = fillNlAttrXfrmEncapTmpl(record, &encap); |
| iov[ENCAP_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| return sock.sendMessage(XFRM_MSG_UPDSA, NETLINK_REQUEST_FLAGS, 0, &iov); |
| } |
| |
| int XfrmController::fillNlAttrXfrmAlgoEnc(const XfrmAlgo& inAlgo, nlattr_algo_crypt* algo) { |
| if (inAlgo.name.empty()) { // Do not fill anything if algorithm not provided |
| return 0; |
| } |
| |
| int len = NLA_HDRLEN + sizeof(xfrm_algo); |
| // Kernel always changes last char to null terminator; no safety checks needed. |
| strncpy(algo->crypt.alg_name, inAlgo.name.c_str(), sizeof(algo->crypt.alg_name)); |
| algo->crypt.alg_key_len = inAlgo.key.size() * 8; // bits |
| memcpy(algo->key, &inAlgo.key[0], inAlgo.key.size()); |
| len += inAlgo.key.size(); |
| fillXfrmNlaHdr(&algo->hdr, XFRMA_ALG_CRYPT, len); |
| return len; |
| } |
| |
| int XfrmController::fillNlAttrXfrmAlgoAuth(const XfrmAlgo& inAlgo, nlattr_algo_auth* algo) { |
| if (inAlgo.name.empty()) { // Do not fill anything if algorithm not provided |
| return 0; |
| } |
| |
| int len = NLA_HDRLEN + sizeof(xfrm_algo_auth); |
| // Kernel always changes last char to null terminator; no safety checks needed. |
| strncpy(algo->auth.alg_name, inAlgo.name.c_str(), sizeof(algo->auth.alg_name)); |
| algo->auth.alg_key_len = inAlgo.key.size() * 8; // bits |
| |
| // This is the extra field for ALG_AUTH_TRUNC |
| algo->auth.alg_trunc_len = inAlgo.truncLenBits; |
| |
| memcpy(algo->key, &inAlgo.key[0], inAlgo.key.size()); |
| len += inAlgo.key.size(); |
| |
| fillXfrmNlaHdr(&algo->hdr, XFRMA_ALG_AUTH_TRUNC, len); |
| return len; |
| } |
| |
| int XfrmController::fillNlAttrXfrmAlgoAead(const XfrmAlgo& inAlgo, nlattr_algo_aead* algo) { |
| if (inAlgo.name.empty()) { // Do not fill anything if algorithm not provided |
| return 0; |
| } |
| |
| int len = NLA_HDRLEN + sizeof(xfrm_algo_aead); |
| // Kernel always changes last char to null terminator; no safety checks needed. |
| strncpy(algo->aead.alg_name, inAlgo.name.c_str(), sizeof(algo->aead.alg_name)); |
| algo->aead.alg_key_len = inAlgo.key.size() * 8; // bits |
| |
| // This is the extra field for ALG_AEAD. ICV length is the same as truncation length |
| // for any AEAD algorithm. |
| algo->aead.alg_icv_len = inAlgo.truncLenBits; |
| |
| memcpy(algo->key, &inAlgo.key[0], inAlgo.key.size()); |
| len += inAlgo.key.size(); |
| |
| fillXfrmNlaHdr(&algo->hdr, XFRMA_ALG_AEAD, len); |
| return len; |
| } |
| |
| int XfrmController::fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl) { |
| if (record.encap.type == XfrmEncapType::NONE) { |
| return 0; |
| } |
| |
| int len = NLA_HDRLEN + sizeof(xfrm_encap_tmpl); |
| tmpl->tmpl.encap_type = static_cast<uint16_t>(record.encap.type); |
| tmpl->tmpl.encap_sport = htons(record.encap.srcPort); |
| tmpl->tmpl.encap_dport = htons(record.encap.dstPort); |
| fillXfrmNlaHdr(&tmpl->hdr, XFRMA_ENCAP, len); |
| return len; |
| } |
| |
| int XfrmController::fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa) { |
| fillXfrmSelector(record, &usersa->sel); |
| |
| usersa->id.proto = IPPROTO_ESP; |
| usersa->id.spi = record.spi; |
| usersa->id.daddr = record.dstAddr; |
| |
| usersa->saddr = record.srcAddr; |
| |
| fillXfrmLifetimeDefaults(&usersa->lft); |
| fillXfrmCurLifetimeDefaults(&usersa->curlft); |
| memset(&usersa->stats, 0, sizeof(usersa->stats)); // leave stats zeroed out |
| usersa->reqid = record.transformId; |
| usersa->family = record.addrFamily; |
| usersa->mode = static_cast<uint8_t>(record.mode); |
| usersa->replay_window = REPLAY_WINDOW_SIZE; |
| |
| if (record.mode == XfrmMode::TRANSPORT) { |
| usersa->flags = 0; // TODO: should we actually set flags, XFRM_SA_XFLAG_DONT_ENCAP_DSCP? |
| } else { |
| usersa->flags = XFRM_STATE_AF_UNSPEC; |
| } |
| |
| return sizeof(*usersa); |
| } |
| |
| int XfrmController::fillUserSaId(const XfrmId& record, xfrm_usersa_id* said) { |
| said->daddr = record.dstAddr; |
| said->spi = record.spi; |
| said->family = record.addrFamily; |
| said->proto = IPPROTO_ESP; |
| |
| return sizeof(*said); |
| } |
| |
| netdutils::Status XfrmController::deleteSecurityAssociation(const XfrmId& record, |
| const XfrmSocket& sock) { |
| xfrm_usersa_id said{}; |
| nlattr_xfrm_mark xfrmmark{}; |
| |
| enum { NLMSG_HDR, USERSAID, USERSAID_PAD, MARK, MARK_PAD }; |
| |
| std::vector<iovec> iov = { |
| {NULL, 0}, // reserved for the eventual addition of a NLMSG_HDR |
| {&said, 0}, // main usersa_info struct |
| {kPadBytes, 0}, // up to NLMSG_ALIGNTO pad bytes of padding |
| {&xfrmmark, 0}, // adjust size if xfrm mark is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| }; |
| |
| int len; |
| len = iov[USERSAID].iov_len = fillUserSaId(record, &said); |
| iov[USERSAID_PAD].iov_len = NLMSG_ALIGN(len) - len; |
| |
| len = iov[MARK].iov_len = fillNlAttrXfrmMark(record, &xfrmmark); |
| iov[MARK_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| return sock.sendMessage(XFRM_MSG_DELSA, NETLINK_REQUEST_FLAGS, 0, &iov); |
| } |
| |
| netdutils::Status XfrmController::allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, |
| uint32_t maxSpi, uint32_t* outSpi, |
| const XfrmSocket& sock) { |
| xfrm_userspi_info spiInfo{}; |
| |
| enum { NLMSG_HDR, USERSAID, USERSAID_PAD }; |
| |
| std::vector<iovec> iov = { |
| {NULL, 0}, // reserved for the eventual addition of a NLMSG_HDR |
| {&spiInfo, 0}, // main userspi_info struct |
| {kPadBytes, 0}, // up to NLMSG_ALIGNTO pad bytes of padding |
| }; |
| |
| int len; |
| if (fillUserSaInfo(record, &spiInfo.info) == 0) { |
| ALOGE("Failed to fill transport SA Info"); |
| } |
| |
| len = iov[USERSAID].iov_len = sizeof(spiInfo); |
| iov[USERSAID_PAD].iov_len = NLMSG_ALIGN(len) - len; |
| |
| RandomSpi spiGen = RandomSpi(minSpi, maxSpi); |
| int spi; |
| netdutils::Status ret; |
| while ((spi = spiGen.next()) != INVALID_SPI) { |
| spiInfo.min = spi; |
| spiInfo.max = spi; |
| ret = sock.sendMessage(XFRM_MSG_ALLOCSPI, NETLINK_REQUEST_FLAGS, 0, &iov); |
| |
| /* If the SPI is in use, we'll get ENOENT */ |
| if (netdutils::equalToErrno(ret, ENOENT)) |
| continue; |
| |
| if (isOk(ret)) { |
| *outSpi = spi; |
| ALOGD("Allocated an SPI: %x", *outSpi); |
| } else { |
| *outSpi = INVALID_SPI; |
| ALOGE("SPI Allocation Failed with error %d", ret.code()); |
| } |
| |
| return ret; |
| } |
| |
| // Should always be -ENOENT if we get here |
| return ret; |
| } |
| |
| netdutils::Status XfrmController::updateTunnelModeSecurityPolicy(const XfrmSaInfo& record, |
| const XfrmSocket& sock, |
| XfrmDirection direction, |
| uint16_t msgType) { |
| xfrm_userpolicy_info userpolicy{}; |
| nlattr_user_tmpl usertmpl{}; |
| nlattr_xfrm_mark xfrmmark{}; |
| |
| enum { |
| NLMSG_HDR, |
| USERPOLICY, |
| USERPOLICY_PAD, |
| USERTMPL, |
| USERTMPL_PAD, |
| MARK, |
| MARK_PAD, |
| }; |
| |
| std::vector<iovec> iov = { |
| {NULL, 0}, // reserved for the eventual addition of a NLMSG_HDR |
| {&userpolicy, 0}, // main xfrm_userpolicy_info struct |
| {kPadBytes, 0}, // up to NLMSG_ALIGNTO pad bytes of padding |
| {&usertmpl, 0}, // adjust size if xfrm_user_tmpl struct is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| {&xfrmmark, 0}, // adjust size if xfrm mark is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| }; |
| |
| int len; |
| len = iov[USERPOLICY].iov_len = fillTransportModeUserSpInfo(record, direction, &userpolicy); |
| iov[USERPOLICY_PAD].iov_len = NLMSG_ALIGN(len) - len; |
| |
| len = iov[USERTMPL].iov_len = fillNlAttrUserTemplate(record, &usertmpl); |
| iov[USERTMPL_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| len = iov[MARK].iov_len = fillNlAttrXfrmMark(record, &xfrmmark); |
| iov[MARK_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| return sock.sendMessage(msgType, NETLINK_REQUEST_FLAGS, 0, &iov); |
| } |
| |
| netdutils::Status XfrmController::deleteTunnelModeSecurityPolicy(const XfrmSaInfo& record, |
| const XfrmSocket& sock, |
| XfrmDirection direction) { |
| xfrm_userpolicy_id policyid{}; |
| nlattr_xfrm_mark xfrmmark{}; |
| |
| enum { |
| NLMSG_HDR, |
| USERPOLICYID, |
| USERPOLICYID_PAD, |
| MARK, |
| MARK_PAD, |
| }; |
| |
| std::vector<iovec> iov = { |
| {NULL, 0}, // reserved for the eventual addition of a NLMSG_HDR |
| {&policyid, 0}, // main xfrm_userpolicy_id struct |
| {kPadBytes, 0}, // up to NLMSG_ALIGNTO pad bytes of padding |
| {&xfrmmark, 0}, // adjust size if xfrm mark is present |
| {kPadBytes, 0}, // up to NLATTR_ALIGNTO pad bytes |
| }; |
| |
| int len = iov[USERPOLICYID].iov_len = fillUserPolicyId(record, direction, &policyid); |
| iov[USERPOLICYID_PAD].iov_len = NLMSG_ALIGN(len) - len; |
| |
| len = iov[MARK].iov_len = fillNlAttrXfrmMark(record, &xfrmmark); |
| iov[MARK_PAD].iov_len = NLA_ALIGN(len) - len; |
| |
| return sock.sendMessage(XFRM_MSG_DELPOLICY, NETLINK_REQUEST_FLAGS, 0, &iov); |
| } |
| |
| int XfrmController::fillTransportModeUserSpInfo(const XfrmSaInfo& record, XfrmDirection direction, |
| xfrm_userpolicy_info* usersp) { |
| fillXfrmSelector(record, &usersp->sel); |
| fillXfrmLifetimeDefaults(&usersp->lft); |
| fillXfrmCurLifetimeDefaults(&usersp->curlft); |
| /* if (index) index & 0x3 == dir -- must be true |
| * xfrm_user.c:verify_newpolicy_info() */ |
| usersp->index = 0; |
| usersp->dir = static_cast<uint8_t>(direction); |
| usersp->action = XFRM_POLICY_ALLOW; |
| usersp->flags = XFRM_POLICY_LOCALOK; |
| usersp->share = XFRM_SHARE_UNIQUE; |
| return sizeof(*usersp); |
| } |
| |
| int XfrmController::fillUserTemplate(const XfrmSaInfo& record, xfrm_user_tmpl* tmpl) { |
| tmpl->id.daddr = record.dstAddr; |
| tmpl->id.spi = record.spi; |
| tmpl->id.proto = IPPROTO_ESP; |
| |
| tmpl->family = record.addrFamily; |
| tmpl->saddr = record.srcAddr; |
| tmpl->reqid = record.transformId; |
| tmpl->mode = static_cast<uint8_t>(record.mode); |
| tmpl->share = XFRM_SHARE_UNIQUE; |
| tmpl->optional = 0; // if this is true, then a failed state lookup will be considered OK: |
| // http://lxr.free-electrons.com/source/net/xfrm/xfrm_policy.c#L1492 |
| tmpl->aalgos = ALGO_MASK_AUTH_ALL; // TODO: if there's a bitmask somewhere of |
| // algos, we should find it and apply it. |
| // I can't find one. |
| tmpl->ealgos = ALGO_MASK_CRYPT_ALL; // TODO: if there's a bitmask somewhere... |
| return sizeof(xfrm_user_tmpl*); |
| } |
| |
| int XfrmController::fillNlAttrUserTemplate(const XfrmSaInfo& record, nlattr_user_tmpl* tmpl) { |
| fillUserTemplate(record, &tmpl->tmpl); |
| |
| int len = NLA_HDRLEN + sizeof(xfrm_user_tmpl); |
| fillXfrmNlaHdr(&tmpl->hdr, XFRMA_TMPL, len); |
| return len; |
| } |
| |
| int XfrmController::fillNlAttrXfrmMark(const XfrmId& record, nlattr_xfrm_mark* mark) { |
| mark->mark.v = record.mark.v; // set to 0 if it's not used |
| mark->mark.m = record.mark.m; // set to 0 if it's not used |
| int len = NLA_HDRLEN + sizeof(xfrm_mark); |
| fillXfrmNlaHdr(&mark->hdr, XFRMA_MARK, len); |
| return len; |
| } |
| |
| int XfrmController::fillNlAttrXfrmOutputMark(const __u32 output_mark_value, |
| nlattr_xfrm_output_mark* output_mark) { |
| // Do not set if we were not given an output mark |
| if (output_mark_value == 0) { |
| return 0; |
| } |
| |
| output_mark->outputMark = output_mark_value; |
| int len = NLA_HDRLEN + sizeof(__u32); |
| fillXfrmNlaHdr(&output_mark->hdr, XFRMA_OUTPUT_MARK, len); |
| return len; |
| } |
| |
| int XfrmController::fillUserPolicyId(const XfrmSaInfo& record, XfrmDirection direction, |
| xfrm_userpolicy_id* usersp) { |
| // For DELPOLICY, when index is absent, selector is needed to match the policy |
| fillXfrmSelector(record, &usersp->sel); |
| usersp->dir = static_cast<uint8_t>(direction); |
| return sizeof(*usersp); |
| } |
| |
| int XfrmController::addVirtualTunnelInterface(const std::string& deviceName, |
| const std::string& localAddress, |
| const std::string& remoteAddress, int32_t ikey, |
| int32_t okey, bool isUpdate) { |
| ALOGD("XfrmController::%s, line=%d", __FUNCTION__, __LINE__); |
| ALOGD("deviceName=%s", deviceName.c_str()); |
| ALOGD("localAddress=%s", localAddress.c_str()); |
| ALOGD("remoteAddress=%s", remoteAddress.c_str()); |
| ALOGD("ikey=%0.8x", ikey); |
| ALOGD("okey=%0.8x", okey); |
| ALOGD("isUpdate=%d", isUpdate); |
| |
| if (deviceName.empty() || localAddress.empty() || remoteAddress.empty()) { |
| return EINVAL; |
| } |
| |
| const char* INFO_KIND_VTI6 = "vti6"; |
| const char* INFO_KIND_VTI = "vti"; |
| uint8_t PADDING_BUFFER[] = {0, 0, 0, 0}; |
| |
| // Find address family. |
| uint8_t remAddr[sizeof(in6_addr)]; |
| |
| StatusOr<uint16_t> statusOrRemoteFam = convertStringAddress(remoteAddress, remAddr); |
| if (!isOk(statusOrRemoteFam)) { |
| return statusOrRemoteFam.status().code(); |
| } |
| |
| uint8_t locAddr[sizeof(in6_addr)]; |
| StatusOr<uint16_t> statusOrLocalFam = convertStringAddress(localAddress, locAddr); |
| if (!isOk(statusOrLocalFam)) { |
| return statusOrLocalFam.status().code(); |
| } |
| |
| if (statusOrLocalFam.value() != statusOrRemoteFam.value()) { |
| return EINVAL; |
| } |
| |
| uint16_t family = statusOrLocalFam.value(); |
| |
| ifinfomsg ifInfoMsg{}; |
| |
| // Construct IFLA_IFNAME |
| nlattr iflaIfName; |
| char iflaIfNameStrValue[deviceName.length() + 1]; |
| size_t iflaIfNameLength = |
| strlcpy(iflaIfNameStrValue, deviceName.c_str(), sizeof(iflaIfNameStrValue)); |
| size_t iflaIfNamePad = fillNlAttr(IFLA_IFNAME, iflaIfNameLength, &iflaIfName); |
| |
| // Construct IFLA_INFO_KIND |
| // Constants "vti6" and "vti" enable the kernel to call different code paths, |
| // (ip_tunnel.c, ip6_tunnel), based on the family. |
| const std::string infoKindValue = (family == AF_INET6) ? INFO_KIND_VTI6 : INFO_KIND_VTI; |
| nlattr iflaIfInfoKind; |
| char infoKindValueStrValue[infoKindValue.length() + 1]; |
| size_t iflaIfInfoKindLength = |
| strlcpy(infoKindValueStrValue, infoKindValue.c_str(), sizeof(infoKindValueStrValue)); |
| size_t iflaIfInfoKindPad = fillNlAttr(IFLA_INFO_KIND, iflaIfInfoKindLength, &iflaIfInfoKind); |
| |
| // Construct IFLA_VTI_LOCAL |
| nlattr iflaVtiLocal; |
| uint8_t binaryLocalAddress[sizeof(in6_addr)]; |
| size_t iflaVtiLocalPad = |
| fillNlAttrIpAddress(IFLA_VTI_LOCAL, family, localAddress, &iflaVtiLocal, |
| netdutils::makeSlice(binaryLocalAddress)); |
| |
| // Construct IFLA_VTI_REMOTE |
| nlattr iflaVtiRemote; |
| uint8_t binaryRemoteAddress[sizeof(in6_addr)]; |
| size_t iflaVtiRemotePad = |
| fillNlAttrIpAddress(IFLA_VTI_REMOTE, family, remoteAddress, &iflaVtiRemote, |
| netdutils::makeSlice(binaryRemoteAddress)); |
| |
| // Construct IFLA_VTI_OKEY |
| nlattr iflaVtiIKey; |
| uint32_t iKeyValue; |
| size_t iflaVtiIKeyPad = fillNlAttrU32(IFLA_VTI_IKEY, ikey, &iflaVtiIKey, &iKeyValue); |
| |
| // Construct IFLA_VTI_IKEY |
| nlattr iflaVtiOKey; |
| uint32_t oKeyValue; |
| size_t iflaVtiOKeyPad = fillNlAttrU32(IFLA_VTI_OKEY, okey, &iflaVtiOKey, &oKeyValue); |
| |
| int iflaInfoDataPayloadLength = iflaVtiLocal.nla_len + iflaVtiLocalPad + iflaVtiRemote.nla_len + |
| iflaVtiRemotePad + iflaVtiIKey.nla_len + iflaVtiIKeyPad + |
| iflaVtiOKey.nla_len + iflaVtiOKeyPad; |
| |
| // Construct IFLA_INFO_DATA |
| nlattr iflaInfoData; |
| size_t iflaInfoDataPad = fillNlAttr(IFLA_INFO_DATA, iflaInfoDataPayloadLength, &iflaInfoData); |
| |
| // Construct IFLA_LINKINFO |
| nlattr iflaLinkInfo; |
| size_t iflaLinkInfoPad = fillNlAttr(IFLA_LINKINFO, |
| iflaInfoData.nla_len + iflaInfoDataPad + |
| iflaIfInfoKind.nla_len + iflaIfInfoKindPad, |
| &iflaLinkInfo); |
| |
| iovec iov[] = { |
| {NULL, 0}, |
| {&ifInfoMsg, sizeof(ifInfoMsg)}, |
| |
| {&iflaIfName, sizeof(iflaIfName)}, |
| {iflaIfNameStrValue, iflaIfNameLength}, |
| {&PADDING_BUFFER, iflaIfNamePad}, |
| |
| {&iflaLinkInfo, sizeof(iflaLinkInfo)}, |
| |
| {&iflaIfInfoKind, sizeof(iflaIfInfoKind)}, |
| {infoKindValueStrValue, iflaIfInfoKindLength}, |
| {&PADDING_BUFFER, iflaIfInfoKindPad}, |
| |
| {&iflaInfoData, sizeof(iflaInfoData)}, |
| |
| {&iflaVtiLocal, sizeof(iflaVtiLocal)}, |
| {&binaryLocalAddress, (family == AF_INET) ? sizeof(in_addr) : sizeof(in6_addr)}, |
| {&PADDING_BUFFER, iflaVtiLocalPad}, |
| |
| {&iflaVtiRemote, sizeof(iflaVtiRemote)}, |
| {&binaryRemoteAddress, (family == AF_INET) ? sizeof(in_addr) : sizeof(in6_addr)}, |
| {&PADDING_BUFFER, iflaVtiRemotePad}, |
| |
| {&iflaVtiIKey, sizeof(iflaVtiIKey)}, |
| {&iKeyValue, sizeof(iKeyValue)}, |
| {&PADDING_BUFFER, iflaVtiIKeyPad}, |
| |
| {&iflaVtiOKey, sizeof(iflaVtiOKey)}, |
| {&oKeyValue, sizeof(oKeyValue)}, |
| {&PADDING_BUFFER, iflaVtiOKeyPad}, |
| |
| {&PADDING_BUFFER, iflaInfoDataPad}, |
| |
| {&PADDING_BUFFER, iflaLinkInfoPad}, |
| }; |
| |
| uint16_t action = RTM_NEWLINK; |
| uint16_t flags = NLM_F_REQUEST | NLM_F_ACK; |
| |
| if (!isUpdate) { |
| flags |= NLM_F_EXCL | NLM_F_CREATE; |
| } |
| |
| // sendNetlinkRequest returns -errno |
| int ret = -1 * sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov), nullptr); |
| if (ret) { |
| ALOGE("Error in %s virtual tunnel interface. Error Code: %d", |
| isUpdate ? "updating" : "adding", ret); |
| } |
| return ret; |
| } |
| |
| int XfrmController::removeVirtualTunnelInterface(const std::string& deviceName) { |
| ALOGD("XfrmController::%s, line=%d", __FUNCTION__, __LINE__); |
| ALOGD("deviceName=%s", deviceName.c_str()); |
| |
| if (deviceName.empty()) { |
| return EINVAL; |
| } |
| |
| uint8_t PADDING_BUFFER[] = {0, 0, 0, 0}; |
| |
| ifinfomsg ifInfoMsg{}; |
| nlattr iflaIfName; |
| char iflaIfNameStrValue[deviceName.length() + 1]; |
| size_t iflaIfNameLength = |
| strlcpy(iflaIfNameStrValue, deviceName.c_str(), sizeof(iflaIfNameStrValue)); |
| size_t iflaIfNamePad = fillNlAttr(IFLA_IFNAME, iflaIfNameLength, &iflaIfName); |
| |
| iovec iov[] = { |
| {NULL, 0}, |
| {&ifInfoMsg, sizeof(ifInfoMsg)}, |
| |
| {&iflaIfName, sizeof(iflaIfName)}, |
| {iflaIfNameStrValue, iflaIfNameLength}, |
| {&PADDING_BUFFER, iflaIfNamePad}, |
| }; |
| |
| uint16_t action = RTM_DELLINK; |
| uint16_t flags = NLM_F_REQUEST | NLM_F_ACK; |
| |
| // sendNetlinkRequest returns -errno |
| int ret = -1 * sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov), nullptr); |
| if (ret) { |
| ALOGE("Error in removing virtual tunnel interface %s. Error Code: %d", iflaIfNameStrValue, |
| ret); |
| } |
| return ret; |
| } |
| |
| } // namespace net |
| } // namespace android |
