proper thread cancellation when using the charon->interfaces
[strongswan.git] / src / charon / network / receiver.c
1 /**
2 * @file receiver.c
3 *
4 * @brief Implementation of receiver_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005-2006 Martin Willi
10 * Copyright (C) 2005 Jan Hutter
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #include <stdlib.h>
25 #include <unistd.h>
26 #include <pthread.h>
27
28 #include "receiver.h"
29
30 #include <daemon.h>
31 #include <network/socket.h>
32 #include <network/packet.h>
33 #include <processing/job_queue.h>
34 #include <processing/jobs/job.h>
35 #include <processing/jobs/process_message_job.h>
36
37 /** length of the full cookie, including time (u_int32_t + SHA1()) */
38 #define COOKIE_LENGTH 24
39 /** lifetime of a cookie, in seconds */
40 #define COOKIE_LIFETIME 10
41 /** how many times to reuse the secret */
42 #define COOKIE_REUSE 10000
43 /** require cookies after half open IKE_SAs */
44 #define COOKIE_TRESHOLD 10
45 /** how many half open IKE_SAs per peer before blocking */
46 #define BLOCK_TRESHOLD 5
47 /** length of the secret to use for cookie calculation */
48 #define SECRET_LENGTH 16
49
50 typedef struct private_receiver_t private_receiver_t;
51
52 /**
53 * Private data of a receiver_t object.
54 */
55 struct private_receiver_t {
56 /**
57 * Public part of a receiver_t object.
58 */
59 receiver_t public;
60
61 /**
62 * Assigned thread.
63 */
64 pthread_t assigned_thread;
65
66 /**
67 * current secret to use for cookie calculation
68 */
69 char secret[SECRET_LENGTH];
70
71 /**
72 * previous secret used to verify older cookies
73 */
74 char secret_old[SECRET_LENGTH];
75
76 /**
77 * how many times we have used "secret" so far
78 */
79 u_int32_t secret_used;
80
81 /**
82 * time we did the cookie switch
83 */
84 u_int32_t secret_switch;
85
86 /**
87 * time offset to use, hides our system time
88 */
89 u_int32_t secret_offset;
90
91 /**
92 * the randomizer to use for secret generation
93 */
94 randomizer_t *randomizer;
95
96 /**
97 * hasher to use for cookie calculation
98 */
99 hasher_t *hasher;
100 };
101
102 /**
103 * send a notify back to the sender
104 */
105 static void send_notify(message_t *request, notify_type_t type, chunk_t data)
106 {
107 if (request->get_request(request) &&
108 request->get_exchange_type(request) == IKE_SA_INIT)
109 {
110 message_t *response;
111 host_t *src, *dst;
112 packet_t *packet;
113 ike_sa_id_t *ike_sa_id;
114
115 response = message_create();
116 dst = request->get_source(request);
117 src = request->get_destination(request);
118 response->set_source(response, src->clone(src));
119 response->set_destination(response, dst->clone(dst));
120 response->set_exchange_type(response, request->get_exchange_type(request));
121 response->set_request(response, FALSE);
122 response->set_message_id(response, 0);
123 ike_sa_id = request->get_ike_sa_id(request);
124 ike_sa_id->switch_initiator(ike_sa_id);
125 response->set_ike_sa_id(response, ike_sa_id);
126 response->add_notify(response, FALSE, type, data);
127 if (response->generate(response, NULL, NULL, &packet) == SUCCESS)
128 {
129 charon->sender->send(charon->sender, packet);
130 response->destroy(response);
131 }
132 }
133 }
134
135 /**
136 * build a cookie
137 */
138 static chunk_t cookie_build(private_receiver_t *this, message_t *message,
139 u_int32_t t, chunk_t secret)
140 {
141 u_int64_t spi = message->get_initiator_spi(message);
142 host_t *ip = message->get_source(message);
143 chunk_t input, hash = chunk_alloca(this->hasher->get_hash_size(this->hasher));
144
145 /* COOKIE = t | sha1( IPi | SPIi | t | secret ) */
146 input = chunk_cata("cccc", ip->get_address(ip), chunk_from_thing(spi),
147 chunk_from_thing(t), secret);
148 this->hasher->get_hash(this->hasher, input, hash.ptr);
149 return chunk_cat("cc", chunk_from_thing(t), hash);
150 }
151
152 /**
153 * verify a received cookie
154 */
155 static bool cookie_verify(private_receiver_t *this, message_t *message,
156 chunk_t cookie)
157 {
158 u_int32_t t, now;
159 chunk_t reference;
160 chunk_t secret;
161
162 now = time(NULL);
163 t = *(u_int32_t*)cookie.ptr;
164
165 if (cookie.len != COOKIE_LENGTH ||
166 t < now - this->secret_offset - COOKIE_LIFETIME)
167 {
168 DBG2(DBG_NET, "received cookie lifetime expired, rejecting");
169 return FALSE;
170 }
171
172 /* check if cookie is derived from old_secret */
173 if (t + this->secret_offset > this->secret_switch)
174 {
175 secret = chunk_from_thing(this->secret);
176 }
177 else
178 {
179 secret = chunk_from_thing(this->secret_old);
180 }
181
182 /* compare own calculation against received */
183 reference = cookie_build(this, message, t, secret);
184 if (chunk_equals(reference, cookie))
185 {
186 chunk_free(&reference);
187 return TRUE;
188 }
189 chunk_free(&reference);
190 return FALSE;
191 }
192
193 /**
194 * check if cookies are required, and if so, a valid cookie is included
195 */
196 static bool cookie_required(private_receiver_t *this, message_t *message)
197 {
198 bool failed = FALSE;
199
200 if (charon->ike_sa_manager->get_half_open_count(charon->ike_sa_manager,
201 NULL) >= COOKIE_TRESHOLD)
202 {
203 /* check for a cookie. We don't use our parser here and do it
204 * quick and dirty for performance reasons.
205 * we assume to cookie is the first payload (which is a MUST), and
206 * the cookies SPI length is zero. */
207 packet_t *packet = message->get_packet(message);
208 chunk_t data = packet->get_data(packet);
209 if (data.len <
210 IKE_HEADER_LENGTH + NOTIFY_PAYLOAD_HEADER_LENGTH + COOKIE_LENGTH ||
211 *(data.ptr + 16) != NOTIFY ||
212 *(u_int16_t*)(data.ptr + IKE_HEADER_LENGTH + 6) != htons(COOKIE))
213 {
214 /* no cookie found */
215 failed = TRUE;
216 }
217 else
218 {
219 data.ptr += IKE_HEADER_LENGTH + NOTIFY_PAYLOAD_HEADER_LENGTH;
220 data.len = COOKIE_LENGTH;
221 if (!cookie_verify(this, message, data))
222 {
223 DBG2(DBG_NET, "found cookie, but content invalid");
224 failed = TRUE;
225 }
226 }
227 packet->destroy(packet);
228 }
229 return failed;
230 }
231
232 /**
233 * check if peer has to many half open IKE_SAs
234 */
235 static bool peer_to_aggressive(private_receiver_t *this, message_t *message)
236 {
237 if (charon->ike_sa_manager->get_half_open_count(charon->ike_sa_manager,
238 message->get_source(message)) >= BLOCK_TRESHOLD)
239 {
240 return TRUE;
241 }
242 return FALSE;
243 }
244
245 /**
246 * Implementation of receiver_t.receive_packets.
247 */
248 static void receive_packets(private_receiver_t *this)
249 {
250 packet_t *packet;
251 message_t *message;
252 job_t *job;
253
254 pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
255 DBG1(DBG_NET, "receiver thread running, thread_ID: %06u",
256 (int)pthread_self());
257
258 charon->drop_capabilities(charon, TRUE);
259
260 while (TRUE)
261 {
262 /* read in a packet */
263 if (charon->socket->receive(charon->socket, &packet) != SUCCESS)
264 {
265 DBG2(DBG_NET, "receiving from socket failed!");
266 /* try again after a delay */
267 sleep(1);
268 continue;
269 }
270
271 /* parse message header */
272 message = message_create_from_packet(packet);
273 if (message->parse_header(message) != SUCCESS)
274 {
275 DBG1(DBG_NET, "received invalid IKE header from %H - ignored",
276 packet->get_source(packet));
277 message->destroy(message);
278 continue;
279 }
280
281 /* check IKE major version */
282 if (message->get_major_version(message) != IKE_MAJOR_VERSION)
283 {
284 DBG1(DBG_NET, "received unsupported IKE version %d.%d from %H, "
285 "sending INVALID_MAJOR_VERSION", message->get_major_version(message),
286 message->get_minor_version(message), packet->get_source(packet));
287 send_notify(message, INVALID_MAJOR_VERSION, chunk_empty);
288 message->destroy(message);
289 continue;
290 }
291
292 if (message->get_request(message) &&
293 message->get_exchange_type(message) == IKE_SA_INIT)
294 {
295 /* check for cookies */
296 if (cookie_required(this, message))
297 {
298 u_int32_t now = time(NULL);
299 chunk_t cookie = cookie_build(this, message, now - this->secret_offset,
300 chunk_from_thing(this->secret));
301
302 DBG2(DBG_NET, "received packet from: %#H to %#H",
303 message->get_source(message),
304 message->get_destination(message));
305 DBG2(DBG_NET, "sending COOKIE notify to %H",
306 message->get_source(message));
307 send_notify(message, COOKIE, cookie);
308 chunk_free(&cookie);
309 if (++this->secret_used > COOKIE_REUSE)
310 {
311 /* create new cookie */
312 DBG1(DBG_NET, "generating new cookie secret after %d uses",
313 this->secret_used);
314 memcpy(this->secret_old, this->secret, SECRET_LENGTH);
315 this->randomizer->get_pseudo_random_bytes(this->randomizer,
316 SECRET_LENGTH, this->secret);
317 this->secret_switch = now;
318 this->secret_used = 0;
319 }
320 message->destroy(message);
321 continue;
322 }
323
324 /* check if peer has not too many IKE_SAs half open */
325 if (peer_to_aggressive(this, message))
326 {
327 DBG1(DBG_NET, "ignoring IKE_SA setup from %H, "
328 "peer to aggressive", message->get_source(message));
329 message->destroy(message);
330 continue;
331 }
332 }
333 job = (job_t *)process_message_job_create(message);
334 charon->job_queue->add(charon->job_queue, job);
335 }
336 }
337
338 /**
339 * Implementation of receiver_t.destroy.
340 */
341 static void destroy(private_receiver_t *this)
342 {
343 pthread_cancel(this->assigned_thread);
344 pthread_join(this->assigned_thread, NULL);
345 this->randomizer->destroy(this->randomizer);
346 this->hasher->destroy(this->hasher);
347 free(this);
348 }
349
350 /*
351 * Described in header.
352 */
353 receiver_t *receiver_create()
354 {
355 private_receiver_t *this = malloc_thing(private_receiver_t);
356 u_int32_t now = time(NULL);
357
358 this->public.destroy = (void(*)(receiver_t*)) destroy;
359
360 this->randomizer = randomizer_create();
361 this->hasher = hasher_create(HASH_SHA1);
362 this->secret_switch = now;
363 this->secret_offset = random() % now;
364 this->secret_used = 0;
365 this->randomizer->get_pseudo_random_bytes(this->randomizer, SECRET_LENGTH,
366 this->secret);
367 memcpy(this->secret_old, this->secret, SECRET_LENGTH);
368
369 if (pthread_create(&this->assigned_thread, NULL,
370 (void*)receive_packets, this) != 0)
371 {
372 free(this);
373 charon->kill(charon, "unable to create receiver thread");
374 }
375
376 return &this->public;
377 }