src/charon/config/peer_cfg.c

   1 /**
   2  * @file peer_cfg.c
   3  *
   4  * @brief Implementation of peer_cfg_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2007 Martin Willi
  10  * Copyright (C) 2005 Jan Hutter
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include <string.h>
  25 #include <pthread.h>
  26
  27 #include "peer_cfg.h"
  28
  29 #include <utils/linked_list.h>
  30 #include <utils/identification.h>
  31
  32 ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
  33         "CERT_ALWAYS_SEND",
  34         "CERT_SEND_IF_ASKED",
  35         "CERT_NEVER_SEND"
  36 );
  37
  38 ENUM(dpd_action_names, DPD_NONE, DPD_RESTART,
  39         "DPD_NONE",
  40         "DPD_CLEAR",
  41         "DPD_ROUTE",
  42         "DPD_RESTART"
  43 );
  44
  45 typedef struct private_peer_cfg_t private_peer_cfg_t;
  46
  47 /**
  48  * Private data of an peer_cfg_t object
  49  */
  50 struct private_peer_cfg_t {
  51
  52         /**
  53          * Public part
  54          */
  55         peer_cfg_t public;
  56
  57         /**
  58          * Number of references hold by others to this peer_cfg
  59          */
  60         refcount_t refcount;
  61
  62         /**
  63          * Name of the peer_cfg, used to query it
  64          */
  65         char *name;
  66
  67         /**
  68          * IKE version to use for initiation
  69          */
  70         u_int ike_version;
  71
  72         /**
  73          * IKE config associated to this peer config
  74          */
  75         ike_cfg_t *ike_cfg;
  76
  77         /**
  78          * list of child configs associated to this peer config
  79          */
  80         linked_list_t *child_cfgs;
  81
  82         /**
  83          * mutex to lock access to list of child_cfgs
  84          */
  85         pthread_mutex_t mutex;
  86
  87         /**
  88          * id to use to identify us
  89          */
  90         identification_t *my_id;
  91
  92         /**
  93          * allowed id for other
  94          */
  95         identification_t *other_id;
  96
  97         /**
  98          * we have a cert issued by this CA
  99          */
 100         identification_t *my_ca;
 101
 102         /**
 103          * we require the other end to have a cert issued by this CA
 104          */
 105         identification_t *other_ca;
 106
 107         /**
 108          * should we send a certificate
 109          */
 110         cert_policy_t cert_policy;
 111
 112         /**
 113          * Method to use for own authentication data
 114          */
 115         auth_method_t auth_method;
 116
 117         /**
 118          * EAP type to use for peer authentication
 119          */
 120         eap_type_t eap_type;
 121
 122         /**
 123          * number of tries after giving up if peer does not respond
 124          */
 125         u_int32_t keyingtries;
 126
 127         /**
 128          * user reauthentication instead of rekeying
 129          */
 130         bool use_reauth;
 131
 132         /**
 133          * Time before an SA gets invalid
 134          */
 135         u_int32_t lifetime;
 136
 137         /**
 138          * Time before an SA gets rekeyed
 139          */
 140         u_int32_t rekeytime;
 141
 142         /**
 143          * Time, which specifies the range of a random value
 144          * substracted from lifetime.
 145          */
 146         u_int32_t jitter;
 147
 148         /**
 149          * What to do with an SA when other peer seams to be dead?
 150          */
 151         bool dpd_delay;
 152
 153         /**
 154          * What to do with CHILDren when other peer seams to be dead?
 155          */
 156         bool dpd_action;
 157
 158         /**
 159          * virtual IP to use locally
 160          */
 161         host_t *my_virtual_ip;
 162
 163         /**
 164          * virtual IP to use remotly
 165          */
 166         host_t *other_virtual_ip;
 167 };
 168
 169 /**
 170  * Implementation of peer_cfg_t.get_name
 171  */
 172 static char *get_name(private_peer_cfg_t *this)
 173 {
 174         return this->name;
 175 }
 176
 177 /**
 178  * Implementation of peer_cfg_t.get_ike_version
 179  */
 180 static u_int get_ike_version(private_peer_cfg_t *this)
 181 {
 182         return this->ike_version;
 183 }
 184
 185 /**
 186  * Implementation of peer_cfg_t.get_ike_cfg
 187  */
 188 static ike_cfg_t* get_ike_cfg(private_peer_cfg_t *this)
 189 {
 190         return this->ike_cfg;
 191 }
 192
 193 /**
 194  * Implementation of peer_cfg_t.add_child_cfg.
 195  */
 196 static void add_child_cfg(private_peer_cfg_t *this, child_cfg_t *child_cfg)
 197 {
 198         pthread_mutex_lock(&this->mutex);
 199         this->child_cfgs->insert_last(this->child_cfgs, child_cfg);
 200         pthread_mutex_unlock(&this->mutex);
 201 }
 202
 203 /**
 204  * Implementation of peer_cfg_t.create_child_cfg_iterator.
 205  */
 206 static iterator_t* create_child_cfg_iterator(private_peer_cfg_t *this)
 207 {
 208         return this->child_cfgs->create_iterator_locked(this->child_cfgs,
 209                                                                                                         &this->mutex);
 210 }
 211
 212 /**
 213  * Check if child_cfg contains traffic selectors
 214  */
 215 static bool contains_ts(child_cfg_t *child, bool mine, linked_list_t *ts,
 216                                                 host_t *host)
 217 {
 218         linked_list_t *selected;
 219         bool contains = FALSE;
 220
 221         selected = child->get_traffic_selectors(child, mine, ts, host);
 222         contains = selected->get_count(selected);
 223         selected->destroy_offset(selected, offsetof(traffic_selector_t, destroy));
 224         return contains;
 225 }
 226
 227 /**
 228  * Implementation of peer_cfg_t.select_child_cfg
 229  */
 230 static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
 231                                                                          linked_list_t *my_ts,
 232                                                                          linked_list_t *other_ts,
 233                                                                          host_t *my_host, host_t *other_host)
 234 {
 235         child_cfg_t *current, *found = NULL;
 236         iterator_t *iterator;
 237
 238         iterator = create_child_cfg_iterator(this);
 239         while (iterator->iterate(iterator, (void**)&current))
 240         {
 241                 if (contains_ts(current, TRUE, my_ts, my_host) &&
 242                         contains_ts(current, FALSE, other_ts, other_host))
 243                 {
 244                         found = current;
 245                         found->get_ref(found);
 246                         break;
 247                 }
 248         }
 249         iterator->destroy(iterator);
 250         return found;
 251 }
 252
 253 /**
 254  * Implementation of peer_cfg_t.get_my_id
 255  */
 256 static identification_t *get_my_id(private_peer_cfg_t *this)
 257 {
 258         return this->my_id;
 259 }
 260
 261 /**
 262  * Implementation of peer_cfg_t.get_other_id
 263  */
 264 static identification_t *get_other_id(private_peer_cfg_t *this)
 265 {
 266         return this->other_id;
 267 }
 268
 269 /**
 270  * Implementation of peer_cfg_t.get_my_ca
 271  */
 272 static identification_t *get_my_ca(private_peer_cfg_t *this)
 273 {
 274         return this->my_ca;
 275 }
 276
 277 static identification_t *get_other_ca(private_peer_cfg_t *this)
 278 {
 279         return this->other_ca;
 280 }
 281
 282 /**
 283  * Implementation of peer_cfg_t.get_cert_policy.
 284  */
 285 static cert_policy_t get_cert_policy(private_peer_cfg_t *this)
 286 {
 287         return this->cert_policy;
 288 }
 289
 290 /**
 291  * Implementation of connection_t.auth_method_t.
 292  */
 293 static auth_method_t get_auth_method(private_peer_cfg_t *this)
 294 {
 295         return this->auth_method;
 296 }
 297
 298 /**
 299  * Implementation of connection_t.get_eap_type.
 300  */
 301 static eap_type_t get_eap_type(private_peer_cfg_t *this)
 302 {
 303         return this->eap_type;
 304 }
 305
 306 /**
 307  * Implementation of connection_t.get_keyingtries.
 308  */
 309 static u_int32_t get_keyingtries(private_peer_cfg_t *this)
 310 {
 311         return this->keyingtries;
 312 }
 313
 314 /**
 315  * Implementation of peer_cfg_t.get_soft_lifetime
 316  */
 317 static u_int32_t get_lifetime(private_peer_cfg_t *this, bool rekey)
 318 {
 319         if (rekey)
 320         {
 321                 if (this->jitter == 0)
 322                 {
 323                         return this->rekeytime;
 324                 }
 325                 return this->rekeytime - (random() % this->jitter);
 326         }
 327         return this->lifetime;
 328 }
 329
 330 /**
 331  * Implementation of peer_cfg_t.use_reauth.
 332  */
 333 static bool use_reauth(private_peer_cfg_t *this, bool rekey)
 334 {
 335         return this->use_reauth;
 336 }
 337
 338 /**
 339  * Implements peer_cfg_t.get_dpd_delay
 340  */
 341 static u_int32_t get_dpd_delay(private_peer_cfg_t *this)
 342 {
 343         return this->dpd_delay;
 344 }
 345
 346 /**
 347  * Implements peer_cfg_t.get_dpd_action
 348  */
 349 static dpd_action_t get_dpd_action(private_peer_cfg_t *this)
 350 {
 351         return this->dpd_action;
 352 }
 353
 354 /**
 355  * Implementation of peer_cfg_t.get_virtual_ip.
 356  */
 357 static host_t* get_virtual_ip(private_peer_cfg_t *this, host_t *suggestion)
 358 {
 359         if (suggestion == NULL)
 360         {
 361                 if (this->my_virtual_ip)
 362                 {
 363                         return this->my_virtual_ip->clone(this->my_virtual_ip);
 364                 }
 365                 return NULL;
 366         }
 367         if (this->other_virtual_ip)
 368         {
 369                 return this->other_virtual_ip->clone(this->other_virtual_ip);
 370         }
 371         if (suggestion->is_anyaddr(suggestion))
 372         {
 373                 return NULL;
 374         }
 375         return suggestion->clone(suggestion);
 376 }
 377
 378 /**
 379  * Implements peer_cfg_t.get_ref.
 380  */
 381 static void get_ref(private_peer_cfg_t *this)
 382 {
 383         ref_get(&this->refcount);
 384 }
 385
 386 /**
 387  * Implements peer_cfg_t.destroy.
 388  */
 389 static void destroy(private_peer_cfg_t *this)
 390 {
 391         if (ref_put(&this->refcount))
 392         {
 393                 this->ike_cfg->destroy(this->ike_cfg);
 394                 this->child_cfgs->destroy_offset(this->child_cfgs, offsetof(child_cfg_t, destroy));
 395                 this->my_id->destroy(this->my_id);
 396                 this->other_id->destroy(this->other_id);
 397                 DESTROY_IF(this->my_ca);
 398                 DESTROY_IF(this->other_ca);
 399
 400                 DESTROY_IF(this->my_virtual_ip);
 401                 DESTROY_IF(this->other_virtual_ip);
 402                 free(this->name);
 403                 free(this);
 404         }
 405 }
 406
 407 /*
 408  * Described in header-file
 409  */
 410 peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 411                                                         identification_t *my_id, identification_t *other_id,
 412                                                         identification_t *my_ca, identification_t *other_ca,
 413                                                         cert_policy_t cert_policy, auth_method_t auth_method,
 414                                                         eap_type_t eap_type, u_int32_t keyingtries,
 415                                                         u_int32_t lifetime, u_int32_t rekeytime,
 416                                                         u_int32_t jitter, bool reauth,
 417                                                         u_int32_t dpd_delay, dpd_action_t dpd_action,
 418                                                         host_t *my_virtual_ip, host_t *other_virtual_ip)
 419 {
 420         private_peer_cfg_t *this = malloc_thing(private_peer_cfg_t);
 421
 422         /* public functions */
 423         this->public.get_name = (char* (*) (peer_cfg_t *))get_name;
 424         this->public.get_ike_version = (u_int(*) (peer_cfg_t *))get_ike_version;
 425         this->public.get_ike_cfg = (ike_cfg_t* (*) (peer_cfg_t *))get_ike_cfg;
 426         this->public.add_child_cfg = (void (*) (peer_cfg_t *, child_cfg_t*))add_child_cfg;
 427         this->public.create_child_cfg_iterator = (iterator_t* (*) (peer_cfg_t *))create_child_cfg_iterator;
 428         this->public.select_child_cfg = (child_cfg_t* (*) (peer_cfg_t *,linked_list_t*,linked_list_t*,host_t*,host_t*))select_child_cfg;
 429         this->public.get_my_id = (identification_t* (*)(peer_cfg_t*))get_my_id;
 430         this->public.get_other_id = (identification_t* (*)(peer_cfg_t *))get_other_id;
 431         this->public.get_my_ca = (identification_t* (*)(peer_cfg_t *))get_my_ca;
 432         this->public.get_other_ca = (identification_t* (*)(peer_cfg_t *))get_other_ca;
 433         this->public.get_cert_policy = (cert_policy_t (*) (peer_cfg_t *))get_cert_policy;
 434         this->public.get_auth_method = (auth_method_t (*) (peer_cfg_t *))get_auth_method;
 435         this->public.get_eap_type = (eap_type_t (*) (peer_cfg_t *))get_eap_type;
 436         this->public.get_keyingtries = (u_int32_t (*) (peer_cfg_t *))get_keyingtries;
 437         this->public.get_lifetime = (u_int32_t (*) (peer_cfg_t *, bool rekey))get_lifetime;
 438         this->public.use_reauth = (bool (*) (peer_cfg_t *))use_reauth;
 439         this->public.get_dpd_delay = (u_int32_t (*) (peer_cfg_t *))get_dpd_delay;
 440         this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
 441         this->public.get_virtual_ip = (host_t* (*) (peer_cfg_t *, host_t *))get_virtual_ip;
 442         this->public.get_ref = (void(*)(peer_cfg_t *))get_ref;
 443         this->public.destroy = (void(*)(peer_cfg_t *))destroy;
 444
 445         /* apply init values */
 446         this->name = strdup(name);
 447         this->ike_version = ike_version;
 448         this->ike_cfg = ike_cfg;
 449         this->child_cfgs = linked_list_create();
 450         pthread_mutex_init(&this->mutex, NULL);
 451         this->my_id = my_id;
 452         this->other_id = other_id;
 453         this->my_ca = my_ca;
 454         this->other_ca = other_ca;
 455         this->cert_policy = cert_policy;
 456         this->auth_method = auth_method;
 457         this->eap_type = eap_type;
 458         this->keyingtries = keyingtries;
 459         this->lifetime = lifetime;
 460         this->rekeytime = rekeytime;
 461         this->jitter = jitter;
 462         this->use_reauth = reauth;
 463         this->dpd_delay = dpd_delay;
 464         this->dpd_action = dpd_action;
 465         this->my_virtual_ip = my_virtual_ip;
 466         this->other_virtual_ip = other_virtual_ip;
 467         this->refcount = 1;
 468
 469         return &this->public;
 470 }