moved force_encap to ike_config, enables responder to enforce udp encapsulation
[strongswan.git] / src / charon / config / peer_cfg.c
1 /**
2 * @file peer_cfg.c
3 *
4 * @brief Implementation of peer_cfg_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005-2007 Martin Willi
10 * Copyright (C) 2005 Jan Hutter
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #include <string.h>
25 #include <pthread.h>
26
27 #include "peer_cfg.h"
28
29 #include <utils/linked_list.h>
30 #include <utils/identification.h>
31 #include <crypto/ietf_attr_list.h>
32
33 ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
34 "CERT_ALWAYS_SEND",
35 "CERT_SEND_IF_ASKED",
36 "CERT_NEVER_SEND"
37 );
38
39 ENUM(dpd_action_names, DPD_NONE, DPD_RESTART,
40 "DPD_NONE",
41 "DPD_CLEAR",
42 "DPD_ROUTE",
43 "DPD_RESTART"
44 );
45
46 typedef struct private_peer_cfg_t private_peer_cfg_t;
47
48 /**
49 * Private data of an peer_cfg_t object
50 */
51 struct private_peer_cfg_t {
52
53 /**
54 * Public part
55 */
56 peer_cfg_t public;
57
58 /**
59 * Number of references hold by others to this peer_cfg
60 */
61 refcount_t refcount;
62
63 /**
64 * Name of the peer_cfg, used to query it
65 */
66 char *name;
67
68 /**
69 * IKE version to use for initiation
70 */
71 u_int ike_version;
72
73 /**
74 * IKE config associated to this peer config
75 */
76 ike_cfg_t *ike_cfg;
77
78 /**
79 * list of child configs associated to this peer config
80 */
81 linked_list_t *child_cfgs;
82
83 /**
84 * mutex to lock access to list of child_cfgs
85 */
86 pthread_mutex_t mutex;
87
88 /**
89 * id to use to identify us
90 */
91 identification_t *my_id;
92
93 /**
94 * allowed id for other
95 */
96 identification_t *other_id;
97
98 /**
99 * we have a cert issued by this CA
100 */
101 identification_t *my_ca;
102
103 /**
104 * we require the other end to have a cert issued by this CA
105 */
106 identification_t *other_ca;
107
108 /**
109 * we require the other end to belong to at least one group
110 */
111 linked_list_t *groups;
112
113 /**
114 * should we send a certificate
115 */
116 cert_policy_t cert_policy;
117
118 /**
119 * Method to use for own authentication data
120 */
121 auth_method_t auth_method;
122
123 /**
124 * EAP type to use for peer authentication
125 */
126 eap_type_t eap_type;
127
128 /**
129 * number of tries after giving up if peer does not respond
130 */
131 u_int32_t keyingtries;
132
133 /**
134 * user reauthentication instead of rekeying
135 */
136 bool use_reauth;
137
138 /**
139 * enable support for MOBIKE
140 */
141 bool use_mobike;
142
143 /**
144 * Time before an SA gets invalid
145 */
146 u_int32_t lifetime;
147
148 /**
149 * Time before an SA gets rekeyed
150 */
151 u_int32_t rekeytime;
152
153 /**
154 * Time, which specifies the range of a random value
155 * substracted from lifetime.
156 */
157 u_int32_t jitter;
158
159 /**
160 * What to do with an SA when other peer seams to be dead?
161 */
162 bool dpd_delay;
163
164 /**
165 * What to do with CHILDren when other peer seams to be dead?
166 */
167 bool dpd_action;
168
169 /**
170 * virtual IP to use locally
171 */
172 host_t *my_virtual_ip;
173
174 /**
175 * virtual IP to use remotly
176 */
177 host_t *other_virtual_ip;
178 };
179
180 /**
181 * Implementation of peer_cfg_t.get_name
182 */
183 static char *get_name(private_peer_cfg_t *this)
184 {
185 return this->name;
186 }
187
188 /**
189 * Implementation of peer_cfg_t.get_ike_version
190 */
191 static u_int get_ike_version(private_peer_cfg_t *this)
192 {
193 return this->ike_version;
194 }
195
196 /**
197 * Implementation of peer_cfg_t.get_ike_cfg
198 */
199 static ike_cfg_t* get_ike_cfg(private_peer_cfg_t *this)
200 {
201 return this->ike_cfg;
202 }
203
204 /**
205 * Implementation of peer_cfg_t.add_child_cfg.
206 */
207 static void add_child_cfg(private_peer_cfg_t *this, child_cfg_t *child_cfg)
208 {
209 pthread_mutex_lock(&this->mutex);
210 this->child_cfgs->insert_last(this->child_cfgs, child_cfg);
211 pthread_mutex_unlock(&this->mutex);
212 }
213
214 /**
215 * Implementation of peer_cfg_t.create_child_cfg_iterator.
216 */
217 static iterator_t* create_child_cfg_iterator(private_peer_cfg_t *this)
218 {
219 return this->child_cfgs->create_iterator_locked(this->child_cfgs,
220 &this->mutex);
221 }
222
223 /**
224 * Check if child_cfg contains traffic selectors
225 */
226 static bool contains_ts(child_cfg_t *child, bool mine, linked_list_t *ts,
227 host_t *host)
228 {
229 linked_list_t *selected;
230 bool contains = FALSE;
231
232 selected = child->get_traffic_selectors(child, mine, ts, host);
233 contains = selected->get_count(selected);
234 selected->destroy_offset(selected, offsetof(traffic_selector_t, destroy));
235 return contains;
236 }
237
238 /**
239 * Implementation of peer_cfg_t.select_child_cfg
240 */
241 static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
242 linked_list_t *my_ts,
243 linked_list_t *other_ts,
244 host_t *my_host, host_t *other_host)
245 {
246 child_cfg_t *current, *found = NULL;
247 iterator_t *iterator;
248
249 iterator = create_child_cfg_iterator(this);
250 while (iterator->iterate(iterator, (void**)&current))
251 {
252 if (contains_ts(current, TRUE, my_ts, my_host) &&
253 contains_ts(current, FALSE, other_ts, other_host))
254 {
255 found = current;
256 found->get_ref(found);
257 break;
258 }
259 }
260 iterator->destroy(iterator);
261 return found;
262 }
263
264 /**
265 * Implementation of peer_cfg_t.get_my_id
266 */
267 static identification_t *get_my_id(private_peer_cfg_t *this)
268 {
269 return this->my_id;
270 }
271
272 /**
273 * Implementation of peer_cfg_t.get_other_id
274 */
275 static identification_t *get_other_id(private_peer_cfg_t *this)
276 {
277 return this->other_id;
278 }
279
280 /**
281 * Implementation of peer_cfg_t.get_my_ca
282 */
283 static identification_t *get_my_ca(private_peer_cfg_t *this)
284 {
285 return this->my_ca;
286 }
287
288 /**
289 * Implementation of peer_cfg_t.get_other_ca
290 */
291 static identification_t *get_other_ca(private_peer_cfg_t *this)
292 {
293 return this->other_ca;
294 }
295
296 /**
297 * Implementation of peer_cfg_t.get_groups
298 */
299 static linked_list_t *get_groups(private_peer_cfg_t *this)
300 {
301 return this->groups;
302 }
303
304 /**
305 * Implementation of peer_cfg_t.get_cert_policy.
306 */
307 static cert_policy_t get_cert_policy(private_peer_cfg_t *this)
308 {
309 return this->cert_policy;
310 }
311
312 /**
313 * Implementation of connection_t.auth_method_t.
314 */
315 static auth_method_t get_auth_method(private_peer_cfg_t *this)
316 {
317 return this->auth_method;
318 }
319
320 /**
321 * Implementation of connection_t.get_eap_type.
322 */
323 static eap_type_t get_eap_type(private_peer_cfg_t *this)
324 {
325 return this->eap_type;
326 }
327
328 /**
329 * Implementation of connection_t.get_keyingtries.
330 */
331 static u_int32_t get_keyingtries(private_peer_cfg_t *this)
332 {
333 return this->keyingtries;
334 }
335
336 /**
337 * Implementation of peer_cfg_t.get_soft_lifetime
338 */
339 static u_int32_t get_lifetime(private_peer_cfg_t *this, bool rekey)
340 {
341 if (rekey)
342 {
343 if (this->jitter == 0)
344 {
345 return this->rekeytime;
346 }
347 return this->rekeytime - (random() % this->jitter);
348 }
349 return this->lifetime;
350 }
351
352 /**
353 * Implementation of peer_cfg_t.use_reauth.
354 */
355 static bool use_reauth(private_peer_cfg_t *this)
356 {
357 return this->use_reauth;
358 }
359
360 /**
361 * Implementation of peer_cfg_t.use_mobike.
362 */
363 static bool use_mobike(private_peer_cfg_t *this)
364 {
365 return this->use_mobike;
366 }
367
368 /**
369 * Implements peer_cfg_t.get_dpd_delay
370 */
371 static u_int32_t get_dpd_delay(private_peer_cfg_t *this)
372 {
373 return this->dpd_delay;
374 }
375
376 /**
377 * Implements peer_cfg_t.get_dpd_action
378 */
379 static dpd_action_t get_dpd_action(private_peer_cfg_t *this)
380 {
381 return this->dpd_action;
382 }
383
384 /**
385 * Implementation of peer_cfg_t.get_my_virtual_ip.
386 */
387 static host_t* get_my_virtual_ip(private_peer_cfg_t *this)
388 {
389 if (this->my_virtual_ip == NULL)
390 {
391 return NULL;
392 }
393 return this->my_virtual_ip->clone(this->my_virtual_ip);
394 }
395
396 /**
397 * Implementation of peer_cfg_t.get_other_virtual_ip.
398 */
399 static host_t* get_other_virtual_ip(private_peer_cfg_t *this, host_t *suggestion)
400 {
401 if (this->other_virtual_ip == NULL)
402 { /* disallow */
403 return NULL;
404 }
405 if (!this->other_virtual_ip->is_anyaddr(this->other_virtual_ip))
406 { /* force own configuration */
407 return this->other_virtual_ip->clone(this->other_virtual_ip);
408 }
409 if (suggestion == NULL || suggestion->is_anyaddr(suggestion))
410 {
411 return NULL;
412 }
413 return suggestion->clone(suggestion);
414 }
415
416 /**
417 * Implements peer_cfg_t.get_ref.
418 */
419 static void get_ref(private_peer_cfg_t *this)
420 {
421 ref_get(&this->refcount);
422 }
423
424 /**
425 * Implements peer_cfg_t.destroy.
426 */
427 static void destroy(private_peer_cfg_t *this)
428 {
429 if (ref_put(&this->refcount))
430 {
431 this->ike_cfg->destroy(this->ike_cfg);
432 this->child_cfgs->destroy_offset(this->child_cfgs, offsetof(child_cfg_t, destroy));
433 this->my_id->destroy(this->my_id);
434 this->other_id->destroy(this->other_id);
435 DESTROY_IF(this->my_ca);
436 DESTROY_IF(this->other_ca);
437 DESTROY_IF(this->my_virtual_ip);
438 DESTROY_IF(this->other_virtual_ip);
439 ietfAttr_list_destroy(this->groups);
440 free(this->name);
441 free(this);
442 }
443 }
444
445 /*
446 * Described in header-file
447 */
448 peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
449 identification_t *my_id, identification_t *other_id,
450 identification_t *my_ca, identification_t *other_ca,
451 linked_list_t *groups, cert_policy_t cert_policy,
452 auth_method_t auth_method, eap_type_t eap_type,
453 u_int32_t keyingtries, u_int32_t lifetime,
454 u_int32_t rekeytime, u_int32_t jitter,
455 bool reauth, bool mobike,
456 u_int32_t dpd_delay, dpd_action_t dpd_action,
457 host_t *my_virtual_ip, host_t *other_virtual_ip)
458 {
459 private_peer_cfg_t *this = malloc_thing(private_peer_cfg_t);
460
461 /* public functions */
462 this->public.get_name = (char* (*) (peer_cfg_t *))get_name;
463 this->public.get_ike_version = (u_int(*) (peer_cfg_t *))get_ike_version;
464 this->public.get_ike_cfg = (ike_cfg_t* (*) (peer_cfg_t *))get_ike_cfg;
465 this->public.add_child_cfg = (void (*) (peer_cfg_t *, child_cfg_t*))add_child_cfg;
466 this->public.create_child_cfg_iterator = (iterator_t* (*) (peer_cfg_t *))create_child_cfg_iterator;
467 this->public.select_child_cfg = (child_cfg_t* (*) (peer_cfg_t *,linked_list_t*,linked_list_t*,host_t*,host_t*))select_child_cfg;
468 this->public.get_my_id = (identification_t* (*)(peer_cfg_t*))get_my_id;
469 this->public.get_other_id = (identification_t* (*)(peer_cfg_t *))get_other_id;
470 this->public.get_my_ca = (identification_t* (*)(peer_cfg_t *))get_my_ca;
471 this->public.get_other_ca = (identification_t* (*)(peer_cfg_t *))get_other_ca;
472 this->public.get_groups = (linked_list_t* (*)(peer_cfg_t *))get_groups;
473 this->public.get_cert_policy = (cert_policy_t (*) (peer_cfg_t *))get_cert_policy;
474 this->public.get_auth_method = (auth_method_t (*) (peer_cfg_t *))get_auth_method;
475 this->public.get_eap_type = (eap_type_t (*) (peer_cfg_t *))get_eap_type;
476 this->public.get_keyingtries = (u_int32_t (*) (peer_cfg_t *))get_keyingtries;
477 this->public.get_lifetime = (u_int32_t (*) (peer_cfg_t *, bool rekey))get_lifetime;
478 this->public.use_reauth = (bool (*) (peer_cfg_t *))use_reauth;
479 this->public.use_mobike = (bool (*) (peer_cfg_t *))use_mobike;
480 this->public.get_dpd_delay = (u_int32_t (*) (peer_cfg_t *))get_dpd_delay;
481 this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
482 this->public.get_my_virtual_ip = (host_t* (*) (peer_cfg_t *))get_my_virtual_ip;
483 this->public.get_other_virtual_ip = (host_t* (*) (peer_cfg_t *, host_t *))get_other_virtual_ip;
484 this->public.get_ref = (void(*)(peer_cfg_t *))get_ref;
485 this->public.destroy = (void(*)(peer_cfg_t *))destroy;
486
487 /* apply init values */
488 this->name = strdup(name);
489 this->ike_version = ike_version;
490 this->ike_cfg = ike_cfg;
491 this->child_cfgs = linked_list_create();
492 pthread_mutex_init(&this->mutex, NULL);
493 this->my_id = my_id;
494 this->other_id = other_id;
495 this->my_ca = my_ca;
496 this->other_ca = other_ca;
497 this->groups = groups;
498 this->cert_policy = cert_policy;
499 this->auth_method = auth_method;
500 this->eap_type = eap_type;
501 this->keyingtries = keyingtries;
502 this->lifetime = lifetime;
503 this->rekeytime = rekeytime;
504 this->jitter = jitter;
505 this->use_reauth = reauth;
506 this->use_mobike = mobike;
507 this->dpd_delay = dpd_delay;
508 this->dpd_action = dpd_action;
509 this->my_virtual_ip = my_virtual_ip;
510 this->other_virtual_ip = other_virtual_ip;
511 this->refcount = 1;
512
513 return &this->public;
514 }