src/charon/sa/child_sa.c

   1 /**
   2  * @file child_sa.c
   3  *
   4  * @brief Implementation of child_sa_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2007 Martin Willi
  10  * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
  11  * Copyright (C) 2005 Jan Hutter
  12  * Hochschule fuer Technik Rapperswil
  13  *
  14  * This program is free software; you can redistribute it and/or modify it
  15  * under the terms of the GNU General Public License as published by the
  16  * Free Software Foundation; either version 2 of the License, or (at your
  17  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  18  *
  19  * This program is distributed in the hope that it will be useful, but
  20  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  21  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  22  * for more details.
  23  */
  24
  25 #define _GNU_SOURCE
  26 #include "child_sa.h"
  27
  28 #include <stdio.h>
  29 #include <string.h>
  30
  31 #include <daemon.h>
  32
  33 ENUM(child_sa_state_names, CHILD_CREATED, CHILD_DELETING,
  34         "CREATED",
  35         "ROUTED",
  36         "INSTALLED",
  37         "REKEYING",
  38         "DELETING",
  39 );
  40
  41 typedef struct sa_policy_t sa_policy_t;
  42
  43 /**
  44  * Struct used to store information for a policy. This
  45  * is needed since we must provide all this information
  46  * for deleting a policy...
  47  */
  48 struct sa_policy_t {
  49         /**
  50          * Traffic selector for us
  51          */
  52         traffic_selector_t *my_ts;
  53
  54         /**
  55          * Traffic selector for other
  56          */
  57         traffic_selector_t *other_ts;
  58 };
  59
  60 typedef struct private_child_sa_t private_child_sa_t;
  61
  62 /**
  63  * Private data of a child_sa_t \ 1bject.
  64  */
  65 struct private_child_sa_t {
  66         /**
  67          * Public interface of child_sa_t.
  68          */
  69         child_sa_t public;
  70
  71         struct {
  72                 /** address of peer */
  73                 host_t *addr;
  74                 /** id of peer */
  75                 identification_t *id;
  76                 /** actual used SPI, 0 if unused */
  77                 u_int32_t spi;
  78         } me, other;
  79
  80         /**
  81          * Allocated SPI for a ESP proposal candidates
  82          */
  83         u_int32_t alloc_esp_spi;
  84
  85         /**
  86          * Allocated SPI for a AH proposal candidates
  87          */
  88         u_int32_t alloc_ah_spi;
  89
  90         /**
  91          * Protocol used to protect this SA, ESP|AH
  92          */
  93         protocol_id_t protocol;
  94
  95         /**
  96          * List containing sa_policy_t objects
  97          */
  98         linked_list_t *policies;
  99
 100         /**
 101          * Seperate list for local traffic selectors
 102          */
 103         linked_list_t *my_ts;
 104
 105         /**
 106          * Seperate list for remote traffic selectors
 107          */
 108         linked_list_t *other_ts;
 109
 110         /**
 111          * reqid used for this child_sa
 112          */
 113         u_int32_t reqid;
 114
 115         /**
 116          * encryption algorithm used for this SA
 117          */
 118         algorithm_t encryption;
 119
 120         /**
 121          * integrity protection algorithm used for this SA
 122          */
 123         algorithm_t integrity;
 124
 125         /**
 126          * time, on which SA was installed
 127          */
 128         time_t install_time;
 129
 130         /**
 131          * absolute time when rekeying is sceduled
 132          */
 133         time_t rekey_time;
 134
 135         /**
 136          * state of the CHILD_SA
 137          */
 138         child_sa_state_t state;
 139
 140         /**
 141          * Specifies if NAT traversal is used
 142          */
 143         bool use_natt;
 144
 145         /**
 146          * mode this SA uses, tunnel/transport
 147          */
 148         mode_t mode;
 149
 150         /**
 151          * virtual IP assinged to local host
 152          */
 153         host_t *virtual_ip;
 154
 155         /**
 156          * config used to create this child
 157          */
 158         child_cfg_t *config;
 159 };
 160
 161 /**
 162  * Implementation of child_sa_t.get_name.
 163  */
 164 static char *get_name(private_child_sa_t *this)
 165 {
 166         return this->config->get_name(this->config);
 167 }
 168
 169 /**
 170  * Implements child_sa_t.get_reqid
 171  */
 172 static u_int32_t get_reqid(private_child_sa_t *this)
 173 {
 174         return this->reqid;
 175 }
 176
 177 /**
 178  * Implements child_sa_t.get_spi
 179  */
 180 u_int32_t get_spi(private_child_sa_t *this, bool inbound)
 181 {
 182         if (inbound)
 183         {
 184                 return this->me.spi;
 185         }
 186         return this->other.spi;
 187 }
 188
 189 /**
 190  * Implements child_sa_t.get_protocol
 191  */
 192 protocol_id_t get_protocol(private_child_sa_t *this)
 193 {
 194         return this->protocol;
 195 }
 196
 197 /**
 198  * Implements child_sa_t.get_state
 199  */
 200 static child_sa_state_t get_state(private_child_sa_t *this)
 201 {
 202         return this->state;
 203 }
 204
 205 /**
 206  * Implements child_sa_t.get_config
 207  */
 208 static child_cfg_t* get_config(private_child_sa_t *this)
 209 {
 210         return this->config;
 211 }
 212
 213 /**
 214  * Implementation of child_sa_t.get_stats.
 215  */
 216 static void get_stats(private_child_sa_t *this, mode_t *mode,
 217                                           encryption_algorithm_t *encr_algo, size_t *encr_len,
 218                                           integrity_algorithm_t *int_algo, size_t *int_len,
 219                                           u_int32_t *rekey, u_int32_t *use_in, u_int32_t *use_out,
 220                                           u_int32_t *use_fwd)
 221 {
 222         sa_policy_t *policy;
 223         iterator_t *iterator;
 224         u_int32_t in = 0, out = 0, fwd = 0, time;
 225
 226         iterator = this->policies->create_iterator(this->policies, TRUE);
 227         while (iterator->iterate(iterator, (void**)&policy))
 228         {
 229
 230                 if (charon->kernel_interface->query_policy(charon->kernel_interface,
 231                                 policy->other_ts, policy->my_ts, POLICY_IN, &time) == SUCCESS)
 232                 {
 233                         in = max(in, time);
 234                 }
 235                 if (charon->kernel_interface->query_policy(charon->kernel_interface,
 236                                 policy->my_ts, policy->other_ts, POLICY_OUT, &time) == SUCCESS)
 237                 {
 238                         out = max(out, time);
 239                 }
 240                 if (charon->kernel_interface->query_policy(charon->kernel_interface,
 241                                 policy->other_ts, policy->my_ts, POLICY_FWD, &time) == SUCCESS)
 242                 {
 243                         fwd = max(fwd, time);
 244                 }
 245         }
 246         iterator->destroy(iterator);
 247
 248         *mode = this->mode;
 249         *encr_algo = this->encryption.algorithm;
 250         *encr_len = this->encryption.key_size;
 251         *int_algo = this->integrity.algorithm;
 252         *int_len = this->integrity.key_size;
 253         *rekey = this->rekey_time;
 254         *use_in = in;
 255         *use_out = out;
 256         *use_fwd = fwd;
 257 }
 258
 259 /**
 260  * Run the up/down script
 261  */
 262 static void updown(private_child_sa_t *this, bool up)
 263 {
 264         sa_policy_t *policy;
 265         iterator_t *iterator;
 266         char *script;
 267
 268         script = this->config->get_updown(this->config);
 269
 270         if (script == NULL)
 271         {
 272                 return;
 273         }
 274
 275         iterator = this->policies->create_iterator(this->policies, TRUE);
 276         while (iterator->iterate(iterator, (void**)&policy))
 277         {
 278                 char command[1024];
 279                 char *ifname = NULL;
 280                 char *my_client, *other_client, *my_client_mask, *other_client_mask;
 281                 char *pos, *virtual_ip;
 282                 FILE *shell;
 283
 284                 /* get subnet/bits from string */
 285                 asprintf(&my_client, "%R", policy->my_ts);
 286                 pos = strchr(my_client, '/');
 287                 *pos = '\0';
 288                 my_client_mask = pos + 1;
 289                 pos = strchr(my_client_mask, '[');
 290                 if (pos)
 291                 {
 292                         *pos = '\0';
 293                 }
 294                 asprintf(&other_client, "%R", policy->other_ts);
 295                 pos = strchr(other_client, '/');
 296                 *pos = '\0';
 297                 other_client_mask = pos + 1;
 298                 pos = strchr(other_client_mask, '[');
 299                 if (pos)
 300                 {
 301                         *pos = '\0';
 302                 }
 303
 304         if (this->virtual_ip)
 305         {
 306                 asprintf(&virtual_ip, "PLUTO_MY_SOURCEIP='%H' ",
 307                                  this->virtual_ip);
 308         }
 309         else
 310         {
 311                 asprintf(&virtual_ip, "");
 312         }
 313
 314                 ifname = charon->kernel_interface->get_interface(charon->kernel_interface,
 315                                                                                                                  this->me.addr);
 316
 317                 /* build the command with all env variables.
 318                  * TODO: PLUTO_PEER_CA and PLUTO_NEXT_HOP are currently missing
 319                  */
 320                 snprintf(command, sizeof(command),
 321                                  "2>&1 "
 322                                 "PLUTO_VERSION='1.1' "
 323                                 "PLUTO_VERB='%s%s%s' "
 324                                 "PLUTO_CONNECTION='%s' "
 325                                 "PLUTO_INTERFACE='%s' "
 326                                 "PLUTO_REQID='%u' "
 327                                 "PLUTO_ME='%H' "
 328                                 "PLUTO_MY_ID='%D' "
 329                                 "PLUTO_MY_CLIENT='%s/%s' "
 330                                 "PLUTO_MY_CLIENT_NET='%s' "
 331                                 "PLUTO_MY_CLIENT_MASK='%s' "
 332                                 "PLUTO_MY_PORT='%u' "
 333                                 "PLUTO_MY_PROTOCOL='%u' "
 334                                 "PLUTO_PEER='%H' "
 335                                 "PLUTO_PEER_ID='%D' "
 336                                 "PLUTO_PEER_CLIENT='%s/%s' "
 337                                 "PLUTO_PEER_CLIENT_NET='%s' "
 338                                 "PLUTO_PEER_CLIENT_MASK='%s' "
 339                                 "PLUTO_PEER_PORT='%u' "
 340                                 "PLUTO_PEER_PROTOCOL='%u' "
 341                                 "%s"
 342                                 "%s"
 343                                 "%s",
 344                                  up ? "up" : "down",
 345                                  policy->my_ts->is_host(policy->my_ts,
 346                                                         this->me.addr) ? "-host" : "-client",
 347                                  this->me.addr->get_family(this->me.addr) == AF_INET ? "" : "-ipv6",
 348                                  this->config->get_name(this->config),
 349                                  ifname ? ifname : "(unknown)",
 350                                  this->reqid,
 351                                  this->me.addr,
 352                                  this->me.id,
 353                                  my_client, my_client_mask,
 354                                  my_client, my_client_mask,
 355                                  policy->my_ts->get_from_port(policy->my_ts),
 356                                  policy->my_ts->get_protocol(policy->my_ts),
 357                                  this->other.addr,
 358                                  this->other.id,
 359                                  other_client, other_client_mask,
 360                                  other_client, other_client_mask,
 361                                  policy->other_ts->get_from_port(policy->other_ts),
 362                                  policy->other_ts->get_protocol(policy->other_ts),
 363                                  virtual_ip,
 364                                  this->config->get_hostaccess(this->config) ?
 365                                         "PLUTO_HOST_ACCESS='1' " : "",
 366                                  script);
 367                 free(ifname);
 368                 free(my_client);
 369                 free(other_client);
 370                 free(virtual_ip);
 371
 372                 shell = popen(command, "r");
 373
 374                 if (shell == NULL)
 375                 {
 376                         DBG1(DBG_CHD, "could not execute updown script '%s'", script);
 377                         return;
 378                 }
 379
 380                 while (TRUE)
 381                 {
 382                         char resp[128];
 383
 384                         if (fgets(resp, sizeof(resp), shell) == NULL)
 385                         {
 386                                 if (ferror(shell))
 387                                 {
 388                                         DBG1(DBG_CHD, "error reading output from updown script");
 389                                         return;
 390                                 }
 391                                 else
 392                                 {
 393                                         break;
 394                                 }
 395                         }
 396                         else
 397                         {
 398                                 char *e = resp + strlen(resp);
 399                                 if (e > resp && e[-1] == '\n')
 400                                 {       /* trim trailing '\n' */
 401                                         e[-1] = '\0';
 402                                 }
 403                                 DBG1(DBG_CHD, "updown: %s", resp);
 404                         }
 405                 }
 406                 pclose(shell);
 407         }
 408         iterator->destroy(iterator);
 409 }
 410
 411 /**
 412  * Implements child_sa_t.set_state
 413  */
 414 static void set_state(private_child_sa_t *this, child_sa_state_t state)
 415 {
 416         this->state = state;
 417         if (state == CHILD_INSTALLED)
 418         {
 419                 updown(this, TRUE);
 420         }
 421 }
 422
 423 /**
 424  * Allocate SPI for a single proposal
 425  */
 426 static status_t alloc_proposal(private_child_sa_t *this, proposal_t *proposal)
 427 {
 428         protocol_id_t protocol = proposal->get_protocol(proposal);
 429
 430         if (protocol == PROTO_AH)
 431         {
 432                 /* get a new spi for AH, if not already done */
 433                 if (this->alloc_ah_spi == 0)
 434                 {
 435                         if (charon->kernel_interface->get_spi(
 436                                                  charon->kernel_interface,
 437                                                  this->other.addr, this->me.addr,
 438                                                  PROTO_AH, this->reqid,
 439                                                  &this->alloc_ah_spi) != SUCCESS)
 440                         {
 441                                 return FAILED;
 442                         }
 443                 }
 444                 proposal->set_spi(proposal, this->alloc_ah_spi);
 445         }
 446         if (protocol == PROTO_ESP)
 447         {
 448                 /* get a new spi for ESP, if not already done */
 449                 if (this->alloc_esp_spi == 0)
 450                 {
 451                         if (charon->kernel_interface->get_spi(
 452                                                  charon->kernel_interface,
 453                                                  this->other.addr, this->me.addr,
 454                                                  PROTO_ESP, this->reqid,
 455                                                  &this->alloc_esp_spi) != SUCCESS)
 456                         {
 457                                 return FAILED;
 458                         }
 459                 }
 460                 proposal->set_spi(proposal, this->alloc_esp_spi);
 461         }
 462         return SUCCESS;
 463 }
 464
 465
 466 /**
 467  * Implements child_sa_t.alloc
 468  */
 469 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
 470 {
 471         iterator_t *iterator;
 472         proposal_t *proposal;
 473
 474         /* iterator through proposals to update spis */
 475         iterator = proposals->create_iterator(proposals, TRUE);
 476         while(iterator->iterate(iterator, (void**)&proposal))
 477         {
 478                 if (alloc_proposal(this, proposal) != SUCCESS)
 479                 {
 480                         iterator->destroy(iterator);
 481                         return FAILED;
 482                 }
 483         }
 484         iterator->destroy(iterator);
 485         return SUCCESS;
 486 }
 487
 488 static status_t install(private_child_sa_t *this, proposal_t *proposal,
 489                                                 mode_t mode, prf_plus_t *prf_plus, bool mine)
 490 {
 491         u_int32_t spi, soft, hard;;
 492         algorithm_t *enc_algo, *int_algo;
 493         algorithm_t enc_algo_none = {ENCR_UNDEFINED, 0};
 494         algorithm_t int_algo_none = {AUTH_UNDEFINED, 0};
 495         host_t *src;
 496         host_t *dst;
 497         natt_conf_t *natt;
 498         status_t status;
 499
 500         this->protocol = proposal->get_protocol(proposal);
 501
 502         /* now we have to decide which spi to use. Use self allocated, if "mine",
 503          * or the one in the proposal, if not "mine" (others). Additionally,
 504          * source and dest host switch depending on the role */
 505         if (mine)
 506         {
 507                 /* if we have allocated SPIs for AH and ESP, we must delete the unused
 508                  * one. */
 509                 if (this->protocol == PROTO_ESP)
 510                 {
 511                         this->me.spi = this->alloc_esp_spi;
 512                         if (this->alloc_ah_spi)
 513                         {
 514                                 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
 515                                                 this->alloc_ah_spi, PROTO_AH);
 516                         }
 517                 }
 518                 else
 519                 {
 520                         this->me.spi = this->alloc_ah_spi;
 521                         if (this->alloc_esp_spi)
 522                         {
 523                                 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
 524                                                 this->alloc_esp_spi, PROTO_ESP);
 525                         }
 526                 }
 527                 spi = this->me.spi;
 528                 dst = this->me.addr;
 529                 src = this->other.addr;
 530         }
 531         else
 532         {
 533                 this->other.spi = proposal->get_spi(proposal);
 534                 spi = this->other.spi;
 535                 src = this->me.addr;
 536                 dst = this->other.addr;
 537         }
 538
 539         DBG2(DBG_CHD, "adding %s %N SA", mine ? "inbound" : "outbound",
 540                  protocol_id_names, this->protocol);
 541
 542         /* select encryption algo */
 543         if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
 544         {
 545                 DBG2(DBG_CHD, "  using %N for encryption",
 546                          encryption_algorithm_names, enc_algo->algorithm);
 547         }
 548         else
 549         {
 550                 enc_algo = &enc_algo_none;
 551         }
 552
 553         /* select integrity algo */
 554         if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
 555         {
 556                 DBG2(DBG_CHD, "  using %N for integrity",
 557                          integrity_algorithm_names, int_algo->algorithm);
 558         }
 559         else
 560         {
 561                 int_algo = &int_algo_none;
 562         }
 563
 564         /* setup nat-t */
 565         if (this->use_natt)
 566         {
 567                 natt = alloca(sizeof(natt_conf_t));
 568                 natt->sport = src->get_port(src);
 569                 natt->dport = dst->get_port(dst);
 570         }
 571         else
 572         {
 573                 natt = NULL;
 574         }
 575
 576         soft = this->config->get_lifetime(this->config, TRUE);
 577         hard = this->config->get_lifetime(this->config, FALSE);
 578
 579         /* send SA down to the kernel */
 580         DBG2(DBG_CHD, "  SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
 581         status = charon->kernel_interface->add_sa(charon->kernel_interface,
 582                                                                                           src, dst, spi, this->protocol,
 583                                                                                           this->reqid, mine ? soft : 0,
 584                                                                                           hard, enc_algo, int_algo,
 585                                                                                           prf_plus, natt, mode, mine);
 586
 587         this->encryption = *enc_algo;
 588         this->integrity = *int_algo;
 589         this->install_time = time(NULL);
 590         this->rekey_time = this->install_time + soft;
 591
 592         return status;
 593 }
 594
 595 static status_t add(private_child_sa_t *this, proposal_t *proposal,
 596                                         mode_t mode, prf_plus_t *prf_plus)
 597 {
 598         u_int32_t outbound_spi, inbound_spi;
 599
 600         /* backup outbound spi, as alloc overwrites it */
 601         outbound_spi = proposal->get_spi(proposal);
 602
 603         /* get SPIs inbound SAs */
 604         if (alloc_proposal(this, proposal) != SUCCESS)
 605         {
 606                 return FAILED;
 607         }
 608         inbound_spi = proposal->get_spi(proposal);
 609
 610         /* install inbound SAs */
 611         if (install(this, proposal, mode, prf_plus, TRUE) != SUCCESS)
 612         {
 613                 return FAILED;
 614         }
 615
 616         /* install outbound SAs, restore spi*/
 617         proposal->set_spi(proposal, outbound_spi);
 618         if (install(this, proposal, mode, prf_plus, FALSE) != SUCCESS)
 619         {
 620                 return FAILED;
 621         }
 622         proposal->set_spi(proposal, inbound_spi);
 623
 624         return SUCCESS;
 625 }
 626
 627 static status_t update(private_child_sa_t *this, proposal_t *proposal,
 628                                            mode_t mode, prf_plus_t *prf_plus)
 629 {
 630         u_int32_t inbound_spi;
 631
 632         /* backup received spi, as install() overwrites it */
 633         inbound_spi = proposal->get_spi(proposal);
 634
 635         /* install outbound SAs */
 636         if (install(this, proposal, mode, prf_plus, FALSE) != SUCCESS)
 637         {
 638                 return FAILED;
 639         }
 640
 641         /* restore spi */
 642         proposal->set_spi(proposal, inbound_spi);
 643         /* install inbound SAs */
 644         if (install(this, proposal, mode, prf_plus, TRUE) != SUCCESS)
 645         {
 646                 return FAILED;
 647         }
 648
 649         return SUCCESS;
 650 }
 651
 652 static status_t add_policies(private_child_sa_t *this,
 653                                                          linked_list_t *my_ts_list,
 654                                                          linked_list_t *other_ts_list, mode_t mode)
 655 {
 656         iterator_t *my_iter, *other_iter;
 657         traffic_selector_t *my_ts, *other_ts;
 658         /* use low prio for ROUTED policies */
 659         bool high_prio = (this->state != CHILD_CREATED);
 660
 661         /* iterate over both lists */
 662         my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
 663         other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
 664         while (my_iter->iterate(my_iter, (void**)&my_ts))
 665         {
 666                 other_iter->reset(other_iter);
 667                 while (other_iter->iterate(other_iter, (void**)&other_ts))
 668                 {
 669                         /* set up policies for every entry in my_ts_list to every entry in other_ts_list */
 670                         status_t status;
 671                         sa_policy_t *policy;
 672
 673                         if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts))
 674                         {
 675                                 DBG2(DBG_CHD,
 676                                          "CHILD_SA policy uses two different IP families - ignored");
 677                                 continue;
 678                         }
 679
 680                         /* only set up policies if protocol matches, or if one is zero (any) */
 681                         if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
 682                                 my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
 683                         {
 684                                 DBG2(DBG_CHD,
 685                                          "CHILD_SA policy uses two different protocols - ignored");
 686                                 continue;
 687                         }
 688
 689                         /* install 3 policies: out, in and forward */
 690                         status = charon->kernel_interface->add_policy(charon->kernel_interface,
 691                                         this->me.addr, this->other.addr, my_ts, other_ts, POLICY_OUT,
 692                                         this->protocol, this->reqid, high_prio, mode, FALSE);
 693
 694                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 695                                         this->other.addr, this->me.addr, other_ts, my_ts, POLICY_IN,
 696                                         this->protocol, this->reqid, high_prio, mode, FALSE);
 697
 698                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 699                                         this->other.addr, this->me.addr, other_ts, my_ts, POLICY_FWD,
 700                                         this->protocol, this->reqid, high_prio, mode, FALSE);
 701
 702                         if (status != SUCCESS)
 703                         {
 704                                 my_iter->destroy(my_iter);
 705                                 other_iter->destroy(other_iter);
 706                                 return status;
 707                         }
 708
 709                         /* store policy to delete/update them later */
 710                         policy = malloc_thing(sa_policy_t);
 711                         policy->my_ts = my_ts->clone(my_ts);
 712                         policy->other_ts = other_ts->clone(other_ts);
 713                         this->policies->insert_last(this->policies, policy);
 714                         /* add to separate list to query them via get_*_traffic_selectors() */
 715                         this->my_ts->insert_last(this->my_ts, policy->my_ts);
 716                         this->other_ts->insert_last(this->other_ts, policy->other_ts);
 717                 }
 718         }
 719         my_iter->destroy(my_iter);
 720         other_iter->destroy(other_iter);
 721
 722         /* switch to routed state if no SAD entry set up */
 723         if (this->state == CHILD_CREATED)
 724         {
 725                 this->state = CHILD_ROUTED;
 726         }
 727         /* needed to update hosts */
 728         this->mode = mode;
 729         return SUCCESS;
 730 }
 731
 732 /**
 733  * Implementation of child_sa_t.get_traffic_selectors.
 734  */
 735 static linked_list_t *get_traffic_selectors(private_child_sa_t *this, bool local)
 736 {
 737         if (local)
 738         {
 739                 return this->my_ts;
 740         }
 741         return this->other_ts;
 742 }
 743
 744 /**
 745  * Implementation of child_sa_t.get_use_time
 746  */
 747 static status_t get_use_time(private_child_sa_t *this, bool inbound, time_t *use_time)
 748 {
 749         iterator_t *iterator;
 750         sa_policy_t *policy;
 751         status_t status = FAILED;
 752
 753         *use_time = UNDEFINED_TIME;
 754
 755         iterator = this->policies->create_iterator(this->policies, TRUE);
 756         while (iterator->iterate(iterator, (void**)&policy))
 757         {
 758                 if (inbound)
 759                 {
 760                         time_t in = UNDEFINED_TIME, fwd = UNDEFINED_TIME;
 761
 762                         status = charon->kernel_interface->query_policy(
 763                                                                         charon->kernel_interface,
 764                                                                         policy->other_ts, policy->my_ts,
 765                                                                         POLICY_IN, (u_int32_t*)&in);
 766                         status |= charon->kernel_interface->query_policy(
 767                                                                         charon->kernel_interface,
 768                                                                         policy->other_ts, policy->my_ts,
 769                                                                         POLICY_FWD, (u_int32_t*)&fwd);
 770                         *use_time = max(in, fwd);
 771                 }
 772                 else
 773                 {
 774                         status = charon->kernel_interface->query_policy(
 775                                                                         charon->kernel_interface,
 776                                                                         policy->my_ts, policy->other_ts,
 777                                                                         POLICY_OUT, (u_int32_t*)use_time);
 778                 }
 779         }
 780         iterator->destroy(iterator);
 781         return status;
 782 }
 783
 784 /**
 785  * Update the host adress/port of a SA
 786  */
 787 static status_t update_sa_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other,
 788                                                                 int my_changes, int other_changes, bool mine)
 789 {
 790         host_t *src, *dst, *new_src, *new_dst;
 791         int src_changes, dst_changes;
 792         status_t status;
 793         u_int32_t spi;
 794
 795         if (mine)
 796         {
 797                 src = this->other.addr;
 798                 dst = this->me.addr;
 799                 new_src = new_other;
 800                 new_dst = new_me;
 801                 src_changes = other_changes;
 802                 dst_changes = my_changes;
 803                 spi = this->other.spi;
 804         }
 805         else
 806         {
 807                 src = this->me.addr;
 808                 dst = this->other.addr;
 809                 new_src = new_me;
 810                 new_dst = new_other;
 811                 src_changes = my_changes;
 812                 dst_changes = other_changes;
 813                 spi = this->me.spi;
 814         }
 815
 816         DBG2(DBG_CHD, "updating %N SA 0x%x, from %#H..#H to %#H..%#H",
 817                  protocol_id_names, this->protocol, ntohl(spi), src, dst, new_src, new_dst);
 818
 819         status = charon->kernel_interface->update_sa(charon->kernel_interface,
 820                                                                                                  dst, spi, this->protocol,
 821                                                                                                  new_src, new_dst,
 822                                                                                                  src_changes, dst_changes);
 823
 824         if (status != SUCCESS)
 825         {
 826                 return FAILED;
 827         }
 828         return SUCCESS;
 829 }
 830
 831 /**
 832  * Update the host adress/port of a policy
 833  */
 834 static status_t update_policy_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other)
 835 {
 836         iterator_t *iterator;
 837         sa_policy_t *policy;
 838         status_t status;
 839         /* we always use high priorities, as hosts getting updated are INSTALLED */
 840
 841         iterator = this->policies->create_iterator(this->policies, TRUE);
 842         while (iterator->iterate(iterator, (void**)&policy))
 843         {
 844                 status = charon->kernel_interface->add_policy(
 845                                 charon->kernel_interface,
 846                                 new_me, new_other,
 847                                 policy->my_ts, policy->other_ts,
 848                                 POLICY_OUT, this->protocol, this->reqid, TRUE, this->mode, TRUE);
 849
 850                 status |= charon->kernel_interface->add_policy(
 851                                 charon->kernel_interface,
 852                                 new_other, new_me,
 853                                 policy->other_ts, policy->my_ts,
 854                                 POLICY_IN, this->protocol, this->reqid, TRUE, this->mode, TRUE);
 855
 856                 status |= charon->kernel_interface->add_policy(
 857                                 charon->kernel_interface,
 858                                 new_other, new_me,
 859                                 policy->other_ts, policy->my_ts,
 860                                 POLICY_FWD, this->protocol, this->reqid, TRUE, this->mode, TRUE);
 861
 862                 if (status != SUCCESS)
 863                 {
 864                         iterator->destroy(iterator);
 865                         return FAILED;
 866                 }
 867         }
 868         iterator->destroy(iterator);
 869
 870         return SUCCESS;
 871 }
 872
 873 /**
 874  * Implementation of child_sa_t.update_hosts.
 875  */
 876 static status_t update_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other,
 877                                                          host_diff_t my_changes, host_diff_t other_changes)
 878 {
 879         if (!my_changes && !other_changes)
 880         {
 881                 return SUCCESS;
 882         }
 883
 884         /* update our (initator) SAs */
 885         if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, TRUE) != SUCCESS)
 886         {
 887                 return FAILED;
 888         }
 889
 890         /* update his (responder) SAs */
 891         if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, FALSE) != SUCCESS)
 892         {
 893                 return FAILED;
 894         }
 895
 896         /* update policies */
 897         if (my_changes & HOST_DIFF_ADDR || other_changes & HOST_DIFF_ADDR)
 898         {
 899                 if (update_policy_hosts(this, new_me, new_other) != SUCCESS)
 900                 {
 901                         return FAILED;
 902                 }
 903         }
 904
 905         /* update hosts */
 906         if (my_changes)
 907         {
 908                 this->me.addr->destroy(this->me.addr);
 909                 this->me.addr = new_me->clone(new_me);
 910         }
 911
 912         if (other_changes)
 913         {
 914                 this->other.addr->destroy(this->other.addr);
 915                 this->other.addr = new_other->clone(new_other);
 916         }
 917
 918         return SUCCESS;
 919 }
 920
 921 /**
 922  * Implementation of child_sa_t.set_virtual_ip.
 923  */
 924 static void set_virtual_ip(private_child_sa_t *this, host_t *ip)
 925 {
 926         this->virtual_ip = ip->clone(ip);
 927 }
 928
 929 /**
 930  * Implementation of child_sa_t.destroy.
 931  */
 932 static void destroy(private_child_sa_t *this)
 933 {
 934         sa_policy_t *policy;
 935
 936         if (this->state == CHILD_DELETING || this->state == CHILD_INSTALLED)
 937         {
 938                 updown(this, FALSE);
 939         }
 940
 941         /* delete SAs in the kernel, if they are set up */
 942         if (this->me.spi)
 943         {
 944                 charon->kernel_interface->del_sa(charon->kernel_interface,
 945                                                                                  this->me.addr, this->me.spi, this->protocol);
 946         }
 947         if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi)
 948         {
 949                 charon->kernel_interface->del_sa(charon->kernel_interface,
 950                                                                                  this->me.addr, this->alloc_esp_spi, PROTO_ESP);
 951         }
 952         if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi)
 953         {
 954                 charon->kernel_interface->del_sa(charon->kernel_interface,
 955                                                                                  this->me.addr, this->alloc_ah_spi, PROTO_AH);
 956         }
 957         if (this->other.spi)
 958         {
 959                 charon->kernel_interface->del_sa(charon->kernel_interface,
 960                                                                                  this->other.addr, this->other.spi, this->protocol);
 961         }
 962
 963         /* delete all policies in the kernel */
 964         while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
 965         {
 966                 /* let rekeyed policies, as they are used by another child_sa */
 967                 charon->kernel_interface->del_policy(charon->kernel_interface,
 968                                                                                          policy->my_ts, policy->other_ts,
 969                                                                                          POLICY_OUT);
 970
 971                 charon->kernel_interface->del_policy(charon->kernel_interface,
 972                                                                                          policy->other_ts, policy->my_ts,
 973                                                                                          POLICY_IN);
 974
 975                 charon->kernel_interface->del_policy(charon->kernel_interface,
 976                                                                                          policy->other_ts, policy->my_ts,
 977                                                                                          POLICY_FWD);
 978                 policy->my_ts->destroy(policy->my_ts);
 979                 policy->other_ts->destroy(policy->other_ts);
 980                 free(policy);
 981         }
 982         this->policies->destroy(this->policies);
 983
 984         this->my_ts->destroy(this->my_ts);
 985         this->other_ts->destroy(this->other_ts);
 986         this->me.addr->destroy(this->me.addr);
 987         this->other.addr->destroy(this->other.addr);
 988         this->me.id->destroy(this->me.id);
 989         this->other.id->destroy(this->other.id);
 990         this->config->destroy(this->config);
 991         DESTROY_IF(this->virtual_ip);
 992         free(this);
 993 }
 994
 995 /*
 996  * Described in header.
 997  */
 998 child_sa_t * child_sa_create(host_t *me, host_t* other,
 999                                                          identification_t *my_id, identification_t *other_id,
1000                                                          child_cfg_t *config, u_int32_t rekey, bool use_natt)
1001 {
1002         static u_int32_t reqid = 0;
1003         private_child_sa_t *this = malloc_thing(private_child_sa_t);
1004
1005         /* public functions */
1006         this->public.get_name = (char*(*)(child_sa_t*))get_name;
1007         this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
1008         this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
1009         this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
1010         this->public.get_stats = (void(*)(child_sa_t*, mode_t*,encryption_algorithm_t*,size_t*,integrity_algorithm_t*,size_t*,u_int32_t*,u_int32_t*,u_int32_t*,u_int32_t*))get_stats;
1011         this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
1012         this->public.add = (status_t(*)(child_sa_t*,proposal_t*,mode_t,prf_plus_t*))add;
1013         this->public.update = (status_t(*)(child_sa_t*,proposal_t*,mode_t,prf_plus_t*))update;
1014         this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,host_diff_t,host_diff_t))update_hosts;
1015         this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*,mode_t))add_policies;
1016         this->public.get_traffic_selectors = (linked_list_t*(*)(child_sa_t*,bool))get_traffic_selectors;
1017         this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time;
1018         this->public.set_state = (void(*)(child_sa_t*,child_sa_state_t))set_state;
1019         this->public.get_state = (child_sa_state_t(*)(child_sa_t*))get_state;
1020         this->public.get_config = (child_cfg_t*(*)(child_sa_t*))get_config;
1021         this->public.set_virtual_ip = (void(*)(child_sa_t*,host_t*))set_virtual_ip;
1022         this->public.destroy = (void(*)(child_sa_t*))destroy;
1023
1024         /* private data */
1025         this->me.addr = me->clone(me);
1026         this->other.addr = other->clone(other);
1027         this->me.id = my_id->clone(my_id);
1028         this->other.id = other_id->clone(other_id);
1029         this->me.spi = 0;
1030         this->other.spi = 0;
1031         this->alloc_ah_spi = 0;
1032         this->alloc_esp_spi = 0;
1033         this->use_natt = use_natt;
1034         this->state = CHILD_CREATED;
1035         /* reuse old reqid if we are rekeying an existing CHILD_SA */
1036         this->reqid = rekey ? rekey : ++reqid;
1037         this->encryption.algorithm = ENCR_UNDEFINED;
1038         this->encryption.key_size = 0;
1039         this->integrity.algorithm = AUTH_UNDEFINED;
1040         this->encryption.key_size = 0;
1041         this->policies = linked_list_create();
1042         this->my_ts = linked_list_create();
1043         this->other_ts = linked_list_create();
1044         this->protocol = PROTO_NONE;
1045         this->mode = MODE_TUNNEL;
1046         this->virtual_ip = NULL;
1047         this->config = config;
1048         config->get_ref(config);
1049
1050         return &this->public;
1051 }