/** sends a list of all available anchor elements in the BEX store
* to the hipd
*
* @param hcstore the BEX store
* @param use_hash_trees indicates whether hash chains or hash trees are stored
* @return 0 on success, -1 on error
*/
int send_bex_store_update_to_hipd(struct hchain_store *hcstore,
const int use_hash_trees)
{
struct hip_common *msg = NULL;
int err = 0;
HIP_ASSERT(hcstore != NULL);
HIP_DEBUG("sending bex-store update to hipd...\n");
HIP_IFEL(!(msg = create_bex_store_update_msg(hcstore, use_hash_trees)),
-1, "failed to create bex store anchors update message\n");
HIP_DUMP_MSG(msg);
/* send msg to hipd and receive corresponding reply */
HIP_IFEL(hip_send_recv_daemon_info(msg, 1, hip_fw_sock), -1, "send_recv msg failed\n");
/* check error value */
HIP_IFEL(hip_get_msg_err(msg), -1, "hipd returned error message!\n");
HIP_DEBUG("send_recv msg succeeded\n");
out_err:
free(msg);
return err;
}
/**
* Send the ip of a peer to hipd, so that it can:
* - unblock the packets that are sent to a particular peer.
* - add it to the blacklist database.
*
* @param peer_ip peer ip.
* @return nothing
*/
int hip_fw_unblock_and_blacklist(const struct in6_addr *peer_ip){
struct hip_common *msg = NULL;
int err = 0;
HIP_DEBUG("\n");
HIP_IFE(!(msg = hip_msg_alloc()), -1);
HIP_IFEL(hip_build_param_contents(msg, (void *)(peer_ip),
HIP_PARAM_IPV6_ADDR,
sizeof(struct in6_addr)),
-1, "build param HIP_PARAM_IPV6_ADDR failed\n");
/* build the message header */
HIP_IFEL(hip_build_user_hdr(msg, SO_HIP_OPPTCP_UNBLOCK_AND_BLACKLIST, 0),
-1, "build hdr failed\n");
HIP_DUMP_MSG(msg);
/* send and receive msg to/from hipd */
HIP_IFEL(hip_send_recv_daemon_info(msg, 1, hip_fw_async_sock), -1, "send_recv msg failed\n");
_HIP_DEBUG("send_recv msg succeed\n");
/* check error value */
HIP_IFEL(hip_get_msg_err(msg), -1, "Got erroneous message!\n");
out_err:
return err;
}
hip_lsi_t *hip_fw_get_default_lsi() {
int err = 0;
struct hip_common *msg = NULL;
struct hip_tlv_common *param;
/* Use cached LSI if possible */
if (local_lsi.s_addr != 0) {
//memcpy(lsi, &local_lsi, sizeof(*lsi));
return &local_lsi;
goto out_err;
}
/* Query hipd for the LSI */
HIP_IFE(!(msg = hip_msg_alloc()), -1);
HIP_IFEL(hip_build_user_hdr(msg, SO_HIP_DEFAULT_HIT, 0),
-1, "build hdr failed\n");
/* send and receive msg to/from hipd */
HIP_IFEL(hip_send_recv_daemon_info(msg, 0, hip_fw_sock), -1, "send_recv msg failed\n");
HIP_DEBUG("send_recv msg succeed\n");
/* check error value */
HIP_IFEL(hip_get_msg_err(msg), -1, "Got erroneous message!\n");
HIP_IFEL(!(param = hip_get_param(msg, HIP_PARAM_LSI)), -1,
"Did not find LSI\n");
memcpy(&local_lsi, hip_get_param_contents_direct(param),
sizeof(local_lsi));
//memcpy(lsi, &local_lsi, sizeof(*lsi));
out_err:
if(msg)
HIP_FREE(msg);
if (err)
return NULL;
else
return &local_lsi;
}
/**
* Notifies the hipd about an anchor change in the hipfw
*
* @param entry the sadb entry for the outbound direction
* @return 0 on success, -1 on error, 1 for inbound sadb entry
*/
int send_anchor_change_to_hipd(const struct hip_sa_entry *entry)
{
int err = 0;
int hash_length = 0;
long i = 0;
unsigned char *anchor = NULL;
struct hip_common *msg = NULL;
struct hash_chain *hchain = NULL;
struct hash_tree *htree = NULL;
HIP_ASSERT(entry != NULL);
HIP_ASSERT(entry->direction == HIP_SPI_DIRECTION_OUT);
HIP_IFEL((hash_length = esp_prot_get_hash_length(entry->esp_prot_transform)) <= 0,
-1, "error or tried to resolve UNUSED transform\n");
HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
"failed to allocate memory\n");
hip_msg_init(msg);
HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_ANCHOR_CHANGE, 0), -1,
"build hdr failed\n");
HIP_DEBUG_HIT("src_hit", &entry->inner_src_addr);
HIP_IFEL(hip_build_param_contents(msg, &entry->inner_src_addr,
HIP_PARAM_HIT, sizeof(struct in6_addr)),
-1, "build param contents failed\n");
HIP_DEBUG_HIT("dst_hit", &entry->inner_dst_addr);
HIP_IFEL(hip_build_param_contents(msg, &entry->inner_dst_addr,
HIP_PARAM_HIT, sizeof(struct in6_addr)),
-1, "build param contents failed\n");
HIP_DEBUG("direction: %i\n", entry->direction);
HIP_IFEL(hip_build_param_contents(msg, &entry->direction,
HIP_PARAM_INT, sizeof(int)), -1,
"build param contents failed\n");
HIP_DEBUG("esp_prot_transform: %u\n", entry->esp_prot_transform);
HIP_IFEL(hip_build_param_contents(msg, &entry->esp_prot_transform,
HIP_PARAM_ESP_PROT_TFM, sizeof(uint8_t)),
-1, "build param contents failed\n");
HIP_DEBUG("esp_prot_num_parallel_hchains: %i\n", num_parallel_hchains);
HIP_IFEL(hip_build_param_contents(msg, &num_parallel_hchains,
HIP_PARAM_INT, sizeof(int)), -1,
"build param contents failed\n");
for (i = 0; i < num_parallel_hchains; i++) {
// the anchor change has already occurred on fw-side
if (entry->esp_prot_transform == ESP_PROT_TFM_TREE) {
htree = entry->active_hash_items[i];
anchor = htree->root;
} else {
hchain = entry->active_hash_items[i];
anchor = hchain_get_anchor(hchain);
}
HIP_HEXDUMP("anchor: ", anchor, hash_length);
HIP_IFEL(hip_build_param_contents(msg, anchor,
HIP_PARAM_HCHAIN_ANCHOR, hash_length),
-1, "build param contents failed\n");
}
HIP_DUMP_MSG(msg);
/* send msg to hipd and receive corresponding reply */
HIP_IFEL(hip_send_recv_daemon_info(msg, 1, hip_fw_sock), -1,
"send_recv msg failed\n");
/* check error value */
HIP_IFEL(hip_get_msg_err(msg), -1, "hipd returned error message!\n");
HIP_DEBUG("send_recv msg succeeded\n");
out_err:
free(msg);
return err;
}
/**
* Invokes an UPDATE message containing an anchor element as a hook to
* next hash structure to be used when the active one depletes
*
* @param entry the sadb entry for the outbound direction
* @param anchors the anchor elements to be sent
* @param hash_item_length length of the respective hash item
* @param soft_update indicates if HHL-based updates should be used
* @param anchor_offset the offset of the anchor element in the link tree
* @param link_trees the link trees for the anchor elements, in case of HHL
* @return 0 on success, -1 on error
*/
int send_trigger_update_to_hipd(const struct hip_sa_entry *entry,
const unsigned char *anchors[MAX_NUM_PARALLEL_HCHAINS],
const int hash_item_length,
const int soft_update,
const int *anchor_offset,
struct hash_tree *link_trees[MAX_NUM_PARALLEL_HCHAINS])
{
int err = 0;
int i = 0;
struct hip_common *msg = NULL;
int hash_length = 0;
struct hash_chain *hchain = NULL;
struct hash_tree *htree = NULL;
struct hash_tree *link_tree = NULL;
int secret_length = 0;
int branch_length = 0;
int root_length = 0;
const unsigned char *secret = NULL;
unsigned char *branch_nodes = NULL;
const unsigned char *root = NULL;
HIP_ASSERT(entry != NULL);
HIP_IFEL((hash_length = esp_prot_get_hash_length(entry->esp_prot_transform)) <= 0,
-1, "error or tried to resolve UNUSED transform\n");
HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
"failed to allocate memory\n");
hip_msg_init(msg);
HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_TRIGGER_UPDATE, 0), -1,
"build hdr failed\n");
HIP_DEBUG_HIT("src_hit", &entry->inner_src_addr);
HIP_IFEL(hip_build_param_contents(msg, &entry->inner_src_addr,
HIP_PARAM_HIT, sizeof(struct in6_addr)),
-1, "build param contents failed\n");
HIP_DEBUG_HIT("dst_hit", &entry->inner_dst_addr);
HIP_IFEL(hip_build_param_contents(msg, &entry->inner_dst_addr,
HIP_PARAM_HIT, sizeof(struct in6_addr)),
-1, "build param contents failed\n");
HIP_DEBUG("esp_prot_transform: %u\n", entry->esp_prot_transform);
HIP_IFEL(hip_build_param_contents(msg, &entry->esp_prot_transform,
HIP_PARAM_ESP_PROT_TFM, sizeof(uint8_t)),
-1, "build param contents failed\n");
// also send the hchain/htree length for all update items
HIP_IFEL(hip_build_param_contents(msg, &hash_item_length, HIP_PARAM_INT,
sizeof(int)), -1, "build param contents failed\n");
HIP_DEBUG("added hash_item_length: %i\n", hash_item_length);
HIP_DEBUG("num_parallel_hchains: %u\n", num_parallel_hchains);
HIP_IFEL(hip_build_param_contents(msg, &num_parallel_hchains,
HIP_PARAM_INT, sizeof(long)), -1,
"build param contents failed\n");
// add update anchors
for (i = 0; i < num_parallel_hchains; i++) {
HIP_HEXDUMP("anchor: ", anchors[i], hash_length);
HIP_IFEL(hip_build_param_contents(msg, anchors[i],
HIP_PARAM_HCHAIN_ANCHOR,
hash_length), -1,
"build param contents failed\n");
}
// now transmit root for each next hash item for tree-based updates, if available
for (i = 0; i < num_parallel_hchains; i++) {
if (entry->esp_prot_transform == ESP_PROT_TFM_TREE) {
htree = entry->next_hash_items[i];
link_tree = htree->link_tree;
} else {
hchain = entry->next_hash_items[i];
link_tree = hchain->link_tree;
}
if (link_tree) {
/* if the next_hchain has got a link_tree, we need its root for
* the verification of the next_hchain's elements */
root = htree_get_root(link_tree, &root_length);
}
// only transmit root length once
if (i == 0) {
HIP_DEBUG("root_length: %i\n", root_length);
HIP_IFEL(hip_build_param_contents(msg, &root_length,
HIP_PARAM_INT,
sizeof(int)), -1,
"build param contents failed\n");
}
if (root) {
HIP_HEXDUMP("root: ", root, root_length);
HIP_IFEL(hip_build_param_contents(msg, root,
HIP_PARAM_ROOT, root_length), -1,
"build param contents failed\n");
}
}
HIP_DEBUG("soft_update: %i\n", soft_update);
HIP_IFEL(hip_build_param_contents(msg, &soft_update, HIP_PARAM_INT,
sizeof(int)), -1,
"build param contents failed\n");
if (soft_update) {
for (i = 0; i < num_parallel_hchains; i++) {
secret = htree_get_secret(link_trees[i],
anchor_offset[i], &secret_length);
HIP_IFEL(!(branch_nodes = htree_get_branch(link_trees[i],
anchor_offset[i], NULL,
&branch_length)), -1,
"failed to get branch nodes\n");
HIP_DEBUG("anchor_offset: %i\n", anchor_offset[i]);
HIP_IFEL(hip_build_param_contents(msg, &anchor_offset[i],
HIP_PARAM_INT,
sizeof(int)), -1,
"build param contents failed\n");
HIP_DEBUG("secret_length: %i\n", secret_length);
HIP_IFEL(hip_build_param_contents(msg, &secret_length,
HIP_PARAM_INT,
sizeof(int)), -1,
"build param contents failed\n");
HIP_DEBUG("branch_length: %i\n", branch_length);
HIP_IFEL(hip_build_param_contents(msg, &branch_length,
HIP_PARAM_INT,
sizeof(int)), -1,
"build param contents failed\n");
HIP_HEXDUMP("secret: ", secret, secret_length);
HIP_IFEL(hip_build_param_contents(msg, secret,
HIP_PARAM_SECRET,
secret_length), -1,
"build param contents failed\n");
HIP_HEXDUMP("branch_nodes: ", branch_nodes, branch_length);
HIP_IFEL(hip_build_param_contents(msg, branch_nodes,
HIP_PARAM_BRANCH_NODES,
branch_length), -1,
"build param contents failed\n");
}
}
HIP_DUMP_MSG(msg);
/* send msg to hipd and receive corresponding reply */
HIP_IFEL(hip_send_recv_daemon_info(msg, 1, hip_fw_sock), -1,
"send_recv msg failed\n");
/* check error value */
HIP_IFEL(hip_get_msg_err(msg), -1, "hipd returned error message!\n");
HIP_DEBUG("send_recv msg succeeded\n");
out_err:
free(msg);
free(branch_nodes);
return err;
}
/**
* Sends the preferred transform to hipd implicitely turning on
* the esp protection extension there
*
* @param activate 1 to activate, 0 to deactivate the extension in the hipd
* @return 0 on success, -1 on error
*/
int send_esp_prot_to_hipd(const int activate)
{
struct hip_common *msg = NULL;
int num_transforms = 0;
int err = 0, i;
uint8_t transform = 0;
HIP_ASSERT(activate >= 0);
HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
"failed to allocate memory\n");
hip_msg_init(msg);
HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_ESP_PROT_TFM, 0), -1,
"build hdr failed\n");
if (activate > 0) {
/*** activation case ***/
HIP_DEBUG("sending preferred esp prot transforms to hipd...\n");
// all "in use" transforms + UNUSED
num_transforms = NUM_TRANSFORMS + 1;
HIP_DEBUG("adding activate: %i\n", activate);
HIP_IFEL(hip_build_param_contents(msg, &activate,
HIP_PARAM_INT, sizeof(int)), -1,
"build param contents failed\n");
HIP_DEBUG("adding num_transforms: %i\n", num_transforms);
HIP_IFEL(hip_build_param_contents(msg, &num_transforms,
HIP_PARAM_INT, sizeof(int)), -1,
"build param contents failed\n");
HIP_DEBUG("adding num_parallel_hchains: %i\n", num_parallel_hchains);
HIP_IFEL(hip_build_param_contents(msg, &num_parallel_hchains,
HIP_PARAM_INT, sizeof(long)), -1,
"build param contents failed\n");
for (i = 0; i < num_transforms; i++) {
HIP_DEBUG("adding transform %i: %u\n", i + 1, token_transform);
HIP_IFEL(hip_build_param_contents(msg, &token_transform,
HIP_PARAM_ESP_PROT_TFM,
sizeof(uint8_t)), -1,
"build param contents failed\n");
}
} else {
/*** deactivation case ***/
HIP_DEBUG("sending esp prot transform ESP_PROT_TFM_UNUSED to hipd...\n");
// we are only sending ESP_PROT_TFM_UNUSED
num_transforms = 1;
transform = ESP_PROT_TFM_UNUSED;
HIP_DEBUG("adding activate: %i\n", activate);
HIP_IFEL(hip_build_param_contents(msg, &activate,
HIP_PARAM_INT, sizeof(int)), -1,
"build param contents failed\n");
HIP_DEBUG("adding num_transforms: %i\n", num_transforms);
HIP_IFEL(hip_build_param_contents(msg, &num_transforms,
HIP_PARAM_INT, sizeof(int)), -1,
"build param contents failed\n");
HIP_DEBUG("adding num_parallel_hchains: %i\n", num_parallel_hchains);
HIP_IFEL(hip_build_param_contents(msg, &num_parallel_hchains,
HIP_PARAM_INT, sizeof(long)), -1,
"build param contents failed\n");
HIP_DEBUG("adding transform ESP_PROT_TFM_UNUSED: %u\n", transform);
HIP_IFEL(hip_build_param_contents(msg, &transform,
HIP_PARAM_ESP_PROT_TFM, sizeof(uint8_t)), -1,
"build param contents failed\n");
}
HIP_DUMP_MSG(msg);
/* send msg to hipd and receive corresponding reply */
HIP_IFEL(hip_send_recv_daemon_info(msg, 1, hip_fw_sock), -1,
"send_recv msg failed\n");
/* check error value */
HIP_IFEL(hip_get_msg_err(msg), -1, "hipd returned error message!\n");
HIP_DEBUG("send_recv msg succeeded\n");
out_err:
free(msg);
return err;
}
/*
* Don't call this function directly. Use hip_send_recv_daemon_info instead
*/
int hip_send_recv_daemon_info_internal(struct hip_common *msg, int opt_socket) {
int hip_user_sock = 0, err = 0, n = 0, len = 0;
struct sockaddr_in6 addr;
uint8_t msg_type_old, msg_type_new;
msg_type_old = hip_get_msg_type(msg);
// We're using system call here and thus reseting errno.
errno = 0;
if (opt_socket) {
hip_user_sock = opt_socket;
} else {
HIP_IFE(((hip_user_sock = socket(AF_INET6, SOCK_DGRAM, 0)) < 0), EHIP);
memset(&addr, 0, sizeof(addr));
addr.sin6_family = AF_INET6;
addr.sin6_addr = in6addr_loopback;
HIP_IFEL(hip_daemon_bind_socket(hip_user_sock,
(struct sockaddr *) &addr), -1,
"bind failed\n");
/* Connect to hipd. Otherwise e.g. "hipconf get ha all"
blocks when hipd is not running. */
HIP_IFEL(hip_daemon_connect(hip_user_sock), -1,
"connect failed\n");
}
if ((len = hip_get_msg_total_len(msg)) < 0) {
err = -EBADMSG;
goto out_err;
}
/* Require a response from hipd */
hip_set_msg_response(msg, 1);
n = hip_sendto_hipd(hip_user_sock, msg, len);
if (n < len) {
HIP_ERROR("Could not send message to daemon.\n");
err = -ECOMM;
goto out_err;
}
HIP_DEBUG("Waiting to receive daemon info.\n");
if((len = hip_peek_recv_total_len(hip_user_sock, 0, HIP_DEFAULT_MSG_TIMEOUT)) < 0) {
err = len;
goto out_err;
}
n = recv(hip_user_sock, msg, len, 0);
/* You have a message synchronization problem if you see this error. */
msg_type_new = hip_get_msg_type(msg);
HIP_IFEL((msg_type_new != msg_type_old), -1,
"Message sync problem. Expected %d, got %d\n",
msg_type_old, msg_type_new);
HIP_DEBUG("%d bytes received from HIP daemon\n", n);
if (n == 0) {
HIP_INFO("The HIP daemon has performed an "\
"orderly shutdown.\n");
// Note. This is not an error condition, thus we return zero.
goto out_err;
} else if(n < sizeof(struct hip_common)) {
HIP_ERROR("Could not receive message from daemon.\n");
goto out_err;
}
if (hip_get_msg_err(msg)) {
HIP_ERROR("HIP message contained an error.\n");
err = -EHIP;
}
_HIP_DEBUG("Message received successfully\n");
out_err:
if (!opt_socket && hip_user_sock)
close(hip_user_sock);
return err;
}
