6754e8022f06bb2e4fac12a4b49e7be1f3edbb29
[strongswan.git] / Source / charon / sa / child_sa.c
1 /**
2 * @file child_sa.c
3 *
4 * @brief Implementation of child_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "child_sa.h"
24
25
26 #include <utils/allocator.h>
27 #include <daemon.h>
28
29
30 typedef struct private_child_sa_t private_child_sa_t;
31
32 /**
33 * Private data of a child_sa_t object.
34 */
35 struct private_child_sa_t {
36 /**
37 * Public interface of child_sa_t.
38 */
39 child_sa_t public;
40
41 /**
42 * IP of this peer
43 */
44 host_t *me;
45
46 /**
47 * IP of other peer
48 */
49 host_t *other;
50
51 /**
52 * Security parameter index for AH protocol, 0 if not used
53 */
54 u_int32_t ah_spi;
55
56 /**
57 * Security parameter index for ESP protocol, 0 if not used
58 */
59 u_int32_t esp_spi;
60
61 /**
62 * CHILD_SAs own logger
63 */
64 logger_t *logger;
65 };
66
67
68 /**
69 * Implementation of child_sa_t.get_spi.
70 */
71 static u_int32_t get_spi(private_child_sa_t *this)
72 {
73 return 0;
74 }
75
76 /**
77 * Implements child_sa_t.alloc
78 */
79 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
80 {
81 protocol_id_t protocols[2];
82 iterator_t *iterator;
83 proposal_t *proposal;
84 status_t status;
85 u_int i;
86
87 /* iterator through proposals */
88 iterator = proposals->create_iterator(proposals, TRUE);
89 while(iterator->has_next(iterator))
90 {
91 iterator->current(iterator, (void**)&proposal);
92 proposal->get_protocols(proposal, protocols);
93
94 /* check all protocols */
95 for (i = 0; i<2; i++)
96 {
97 switch (protocols[i])
98 {
99 case AH:
100 /* do we already have an spi for AH?*/
101 if (this->ah_spi == 0)
102 {
103 /* nope, get one */
104 status = charon->kernel_interface->get_spi(
105 charon->kernel_interface,
106 this->me, this->other,
107 AH, FALSE,
108 &(this->ah_spi));
109 }
110 /* update proposal */
111 proposal->set_spi(proposal, AH, (u_int64_t)this->ah_spi);
112 break;
113 case ESP:
114 /* do we already have an spi for ESP?*/
115 if (this->esp_spi == 0)
116 {
117 /* nope, get one */
118 status = charon->kernel_interface->get_spi(
119 charon->kernel_interface,
120 this->me, this->other,
121 ESP, FALSE,
122 &(this->esp_spi));
123 }
124 /* update proposal */
125 proposal->set_spi(proposal, ESP, (u_int64_t)this->esp_spi);
126 break;
127 default:
128 break;
129 }
130 if (status != SUCCESS)
131 {
132 iterator->destroy(iterator);
133 return FAILED;
134 }
135 }
136 }
137 iterator->destroy(iterator);
138 return SUCCESS;
139 }
140
141 static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
142 {
143 protocol_id_t protocols[2];
144 u_int32_t spi;
145 encryption_algorithm_t enc_algo;
146 integrity_algorithm_t int_algo;
147 chunk_t enc_key, int_key;
148 algorithm_t *algo;
149 crypter_t *crypter;
150 signer_t *signer;
151 size_t key_size;
152 host_t *src;
153 host_t *dst;
154 status_t status;
155 u_int i;
156
157 /* we must assign the roles to correctly set up the SAs */
158 if (mine)
159 {
160 src = this->me;
161 dst = this->other;
162 }
163 else
164 {
165 dst = this->me;
166 src = this->other;
167 }
168
169 proposal->get_protocols(proposal, protocols);
170 /* derive keys in order as protocols appear */
171 for (i = 0; i<2; i++)
172 {
173 if (protocols[i] != UNDEFINED_PROTOCOL_ID)
174 {
175
176 /* now we have to decide which spi to use. Use self allocated, if "mine",
177 * or the one in the proposal, if not "mine" (others). */
178 if (mine)
179 {
180 if (protocols[i] == AH)
181 {
182 spi = this->ah_spi;
183 }
184 else
185 {
186 spi = this->esp_spi;
187 }
188 }
189 else /* use proposals spi */
190 {
191 spi = proposal->get_spi(proposal, protocols[i]);
192 }
193
194 /* derive encryption key first */
195 if (proposal->get_algorithm(proposal, protocols[i], ENCRYPTION_ALGORITHM, &algo))
196 {
197 enc_algo = algo->algorithm;
198 this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s, ",
199 mapping_find(protocol_id_m, protocols[i]),
200 mine ? "me" : "other",
201 mapping_find(transform_type_m, ENCRYPTION_ALGORITHM),
202 mapping_find(encryption_algorithm_m, enc_algo));
203
204 /* we must create a (unused) crypter, since its the only way to get the size
205 * of the key. This is not so nice, since charon must support all algorithms
206 * the kernel supports...
207 * TODO: build something of a encryption algorithm lookup function
208 */
209 crypter = crypter_create(enc_algo, algo->key_size);
210 key_size = crypter->get_key_size(crypter);
211 crypter->destroy(crypter);
212 prf_plus->allocate_bytes(prf_plus, key_size, &enc_key);
213 this->logger->log_chunk(this->logger, PRIVATE, "key:", &enc_key);
214 }
215 else
216 {
217 enc_algo = ENCR_UNDEFINED;
218 }
219
220 /* derive integrity key */
221 if (proposal->get_algorithm(proposal, protocols[i], INTEGRITY_ALGORITHM, &algo))
222 {
223 int_algo = algo->algorithm;
224 this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s,",
225 mapping_find(protocol_id_m, protocols[i]),
226 mine ? "me" : "other",
227 mapping_find(transform_type_m, INTEGRITY_ALGORITHM),
228 mapping_find(integrity_algorithm_m, algo->algorithm));
229
230 signer = signer_create(int_algo);
231 key_size = signer->get_key_size(signer);
232 signer->destroy(signer);
233 prf_plus->allocate_bytes(prf_plus, key_size, &int_key);
234 this->logger->log_chunk(this->logger, PRIVATE, "key:", &int_key);
235 }
236 else
237 {
238 int_algo = AUTH_UNDEFINED;
239 }
240 /* send keys down to kernel */
241 this->logger->log(this->logger, CONTROL|LEVEL1,
242 "installing 0x%.8x for %s, src %s dst %s",
243 ntohl(spi), mapping_find(protocol_id_m, protocols[i]),
244 src->get_address(src), dst->get_address(dst));
245 status = charon->kernel_interface->add_sa(charon->kernel_interface,
246 src, dst,
247 spi, protocols[i], FALSE,
248 enc_algo, enc_key,
249 int_algo, int_key, mine);
250 /* clean up for next round */
251 if (enc_algo != ENCR_UNDEFINED)
252 {
253 allocator_free_chunk(&enc_key);
254 }
255 if (int_algo != AUTH_UNDEFINED)
256 {
257 allocator_free_chunk(&int_key);
258 }
259
260 if (status != SUCCESS)
261 {
262 return FAILED;
263 }
264
265 }
266 }
267 return SUCCESS;
268 }
269
270 static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
271 {
272 linked_list_t *list;
273
274 /* install others (initiators) SAs*/
275 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
276 {
277 return FAILED;
278 }
279
280 /* get SPIs for our SAs */
281 list = linked_list_create();
282 list->insert_last(list, proposal);
283 if (alloc(this, list) != SUCCESS)
284 {
285 list->destroy(list);
286 return FAILED;
287 }
288 list->destroy(list);
289
290 /* install our (responders) SAs */
291 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
292 {
293 return FAILED;
294 }
295 return SUCCESS;
296 }
297
298 static status_t update(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
299 {
300 /* install our (initator) SAs */
301 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
302 {
303 return FAILED;
304 }
305 /* install his (responder) SAs */
306 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
307 {
308 return FAILED;
309 }
310 return SUCCESS;
311 }
312
313 /**
314 * Implementation of child_sa_t.destroy.
315 */
316 static void destroy(private_child_sa_t *this)
317 {
318 charon->logger_manager->destroy_logger(charon->logger_manager, this->logger);
319 allocator_free(this);
320 }
321
322 /*
323 * Described in header.
324 */
325 child_sa_t * child_sa_create(host_t *me, host_t* other)
326 {
327 private_child_sa_t *this = allocator_alloc_thing(private_child_sa_t);
328
329 /* public functions */
330 this->public.get_spi = (u_int32_t(*)(child_sa_t*))get_spi;
331 this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
332 this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
333 this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
334 this->public.destroy = (void(*)(child_sa_t*))destroy;
335
336 /* private data */
337 this->logger = charon->logger_manager->create_logger(charon->logger_manager, CHILD_SA, NULL);
338 this->me = me;
339 this->other = other;
340 this->ah_spi = 0;
341 this->esp_spi = 0;
342
343 return (&this->public);
344 }