223def9f9586f8ff5067e5ecdbe2e17ab9c426da
[strongswan.git] / src / charon / sa / child_sa.c
1 /**
2 * @file child_sa.c
3 *
4 * @brief Implementation of child_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005-2006 Martin Willi
11 * Copyright (C) 2005 Jan Hutter
12 * Hochschule fuer Technik Rapperswil
13 *
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the
16 * Free Software Foundation; either version 2 of the License, or (at your
17 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 *
19 * This program is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
21 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
22 * for more details.
23 */
24
25 #include <netdb.h>
26
27 #include "child_sa.h"
28
29 #include <daemon.h>
30
31
32 typedef struct sa_policy_t sa_policy_t;
33
34 /**
35 * Struct used to store information for a policy. This
36 * is needed since we must provide all this information
37 * for deleting a policy...
38 */
39 struct sa_policy_t {
40
41 struct {
42 /** subnet address behind peer peer */
43 host_t *net;
44 /** netmask used for net */
45 u_int8_t net_mask;
46 } me, other;
47
48 /**
49 * Protocol for this policy, such as TCP/UDP/ICMP...
50 */
51 int upper_proto;
52 };
53
54 typedef struct private_child_sa_t private_child_sa_t;
55
56 /**
57 * Private data of a child_sa_t object.
58 */
59 struct private_child_sa_t {
60 /**
61 * Public interface of child_sa_t.
62 */
63 child_sa_t public;
64
65 struct {
66 /** address of peer */
67 host_t *addr;
68 /** actual used SPI, 0 if unused */
69 u_int32_t spi;
70 } me, other;
71
72 /**
73 * Allocated SPI for a ESP proposal candidates
74 */
75 u_int32_t alloc_esp_spi;
76
77 /**
78 * Allocated SPI for a AH proposal candidates
79 */
80 u_int32_t alloc_ah_spi;
81
82 /**
83 * Protocol used to protect this SA, ESP|AH
84 */
85 protocol_id_t protocol;
86
87 /**
88 * List containing sa_policy_t objects
89 */
90 linked_list_t *policies;
91
92 /**
93 * reqid used for this child_sa
94 */
95 u_int32_t reqid;
96
97 /**
98 * time, on which SA was installed
99 */
100 time_t install_time;
101
102 /**
103 * Lifetime before rekeying
104 */
105 u_int32_t soft_lifetime;
106
107 /**
108 * Lifetime before delete
109 */
110 u_int32_t hard_lifetime;
111
112 /**
113 * has this CHILD_SA been rekeyed?
114 */
115 bool rekeyed;
116
117 /**
118 * Specifies if NAT traversal is used
119 */
120 bool use_natt;
121
122 /**
123 * CHILD_SAs own logger
124 */
125 logger_t *logger;
126 };
127
128 /**
129 * Implements child_sa_t.get_reqid
130 */
131 static u_int32_t get_reqid(private_child_sa_t *this)
132 {
133 return this->reqid;
134 }
135
136 /**
137 * Implements child_sa_t.get_spi
138 */
139 u_int32_t get_spi(private_child_sa_t *this, bool inbound)
140 {
141 if (inbound)
142 {
143 return this->me.spi;
144 }
145 return this->other.spi;
146 }
147
148 /**
149 * Implements child_sa_t.get_protocol
150 */
151 protocol_id_t get_protocol(private_child_sa_t *this)
152 {
153 return this->protocol;
154 }
155
156 /**
157 * Allocate SPI for a single proposal
158 */
159 static status_t alloc_proposal(private_child_sa_t *this, proposal_t *proposal)
160 {
161 protocol_id_t protocol = proposal->get_protocol(proposal);
162
163 if (protocol == PROTO_AH)
164 {
165 /* get a new spi for AH, if not already done */
166 if (this->alloc_ah_spi == 0)
167 {
168 if (charon->kernel_interface->get_spi(
169 charon->kernel_interface,
170 this->other.addr, this->me.addr,
171 PROTO_AH, this->reqid,
172 &this->alloc_ah_spi) != SUCCESS)
173 {
174 return FAILED;
175 }
176 }
177 proposal->set_spi(proposal, this->alloc_ah_spi);
178 }
179 if (protocol == PROTO_ESP)
180 {
181 /* get a new spi for ESP, if not already done */
182 if (this->alloc_esp_spi == 0)
183 {
184 if (charon->kernel_interface->get_spi(
185 charon->kernel_interface,
186 this->other.addr, this->me.addr,
187 PROTO_ESP, this->reqid,
188 &this->alloc_esp_spi) != SUCCESS)
189 {
190 return FAILED;
191 }
192 }
193 proposal->set_spi(proposal, this->alloc_esp_spi);
194 }
195 return SUCCESS;
196 }
197
198
199 /**
200 * Implements child_sa_t.alloc
201 */
202 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
203 {
204 iterator_t *iterator;
205 proposal_t *proposal;
206
207 /* iterator through proposals to update spis */
208 iterator = proposals->create_iterator(proposals, TRUE);
209 while(iterator->has_next(iterator))
210 {
211 iterator->current(iterator, (void**)&proposal);
212 if (alloc_proposal(this, proposal) != SUCCESS)
213 {
214 iterator->destroy(iterator);
215 return FAILED;
216 }
217 }
218 iterator->destroy(iterator);
219 return SUCCESS;
220 }
221
222 static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
223 {
224 u_int32_t spi;
225 algorithm_t *enc_algo, *int_algo;
226 algorithm_t enc_algo_none = {ENCR_UNDEFINED, 0};
227 algorithm_t int_algo_none = {AUTH_UNDEFINED, 0};
228 host_t *src;
229 host_t *dst;
230 natt_conf_t *natt;
231 status_t status;
232
233 this->protocol = proposal->get_protocol(proposal);
234
235 /* now we have to decide which spi to use. Use self allocated, if "mine",
236 * or the one in the proposal, if not "mine" (others). Additionally,
237 * source and dest host switch depending on the role */
238 if (mine)
239 {
240 /* if we have allocated SPIs for AH and ESP, we must delete the unused
241 * one. */
242 if (this->protocol == PROTO_ESP)
243 {
244 this->me.spi = this->alloc_esp_spi;
245 if (this->alloc_ah_spi)
246 {
247 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
248 this->alloc_ah_spi, PROTO_AH);
249 }
250 }
251 else
252 {
253 this->me.spi = this->alloc_ah_spi;
254 if (this->alloc_esp_spi)
255 {
256 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
257 this->alloc_esp_spi, PROTO_ESP);
258 }
259 }
260 spi = this->me.spi;
261 dst = this->me.addr;
262 src = this->other.addr;
263 }
264 else
265 {
266 this->other.spi = proposal->get_spi(proposal);
267 spi = this->other.spi;
268 src = this->me.addr;
269 dst = this->other.addr;
270 }
271
272 this->logger->log(this->logger, CONTROL|LEVEL1, "adding %s %s SA",
273 mine ? "inbound" : "outbound",
274 mapping_find(protocol_id_m, this->protocol));
275
276 /* select encryption algo */
277 if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
278 {
279 this->logger->log(this->logger, CONTROL|LEVEL2, " using %s for encryption",
280 mapping_find(encryption_algorithm_m, enc_algo->algorithm));
281 }
282 else
283 {
284 enc_algo = &enc_algo_none;
285 }
286
287 /* select integrity algo */
288 if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
289 {
290 this->logger->log(this->logger, CONTROL|LEVEL2, " using %s for integrity",
291 mapping_find(integrity_algorithm_m, int_algo->algorithm));
292 }
293 else
294 {
295 int_algo = &int_algo_none;
296 }
297
298 /* setup nat-t */
299 if (this->use_natt)
300 {
301 natt = alloca(sizeof(natt_conf_t));
302 natt->sport = src->get_port(src);
303 natt->dport = dst->get_port(dst);
304 }
305 else
306 {
307 natt = NULL;
308 }
309
310
311 /* send SA down to the kernel */
312 this->logger->log(this->logger, CONTROL|LEVEL2,
313 " SPI 0x%.8x, src %s dst %s",
314 ntohl(spi), src->get_address(src), dst->get_address(dst));
315 status = charon->kernel_interface->add_sa(charon->kernel_interface,
316 src, dst,
317 spi, this->protocol,
318 this->reqid,
319 mine ? this->soft_lifetime : 0,
320 this->hard_lifetime,
321 enc_algo, int_algo,
322 prf_plus, natt, mine);
323
324 this->install_time = time(NULL);
325
326 return status;
327 }
328
329 static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
330 {
331 u_int32_t outbound_spi, inbound_spi;
332
333 /* backup outbound spi, as alloc overwrites it */
334 outbound_spi = proposal->get_spi(proposal);
335
336 /* get SPIs inbound SAs */
337 if (alloc_proposal(this, proposal) != SUCCESS)
338 {
339 return FAILED;
340 }
341 inbound_spi = proposal->get_spi(proposal);
342
343 /* install inbound SAs */
344 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
345 {
346 return FAILED;
347 }
348
349 /* install outbound SAs, restore spi*/
350 proposal->set_spi(proposal, outbound_spi);
351 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
352 {
353 return FAILED;
354 }
355 proposal->set_spi(proposal, inbound_spi);
356
357 return SUCCESS;
358 }
359
360 static status_t update(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
361 {
362 u_int32_t inbound_spi;
363
364 /* backup received spi, as install() overwrites it */
365 inbound_spi = proposal->get_spi(proposal);
366
367 /* install outbound SAs */
368 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
369 {
370 return FAILED;
371 }
372
373 /* restore spi */
374 proposal->set_spi(proposal, inbound_spi);
375 /* install inbound SAs */
376 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
377 {
378 return FAILED;
379 }
380
381 return SUCCESS;
382 }
383
384 static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list, linked_list_t *other_ts_list)
385 {
386 iterator_t *my_iter, *other_iter;
387 traffic_selector_t *my_ts, *other_ts;
388
389 /* iterate over both lists */
390 my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
391 other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
392 while (my_iter->has_next(my_iter))
393 {
394 my_iter->current(my_iter, (void**)&my_ts);
395 other_iter->reset(other_iter);
396 while (other_iter->has_next(other_iter))
397 {
398 /* set up policies for every entry in my_ts_list to every entry in other_ts_list */
399 int family;
400 chunk_t from_addr;
401 u_int16_t from_port, to_port;
402 sa_policy_t *policy;
403 status_t status;
404
405 other_iter->current(other_iter, (void**)&other_ts);
406
407 /* only set up policies if protocol matches, or if one is zero (any) */
408 if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
409 my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
410 {
411 this->logger->log(this->logger, ERROR,
412 "CHILD_SA policy uses two different protocols, ignored");
413 continue;
414 }
415 policy = malloc_thing(sa_policy_t);
416 policy->upper_proto = max(my_ts->get_protocol(my_ts), other_ts->get_protocol(other_ts));
417
418 /* calculate net and ports for local side */
419 family = my_ts->get_type(my_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
420 from_addr = my_ts->get_from_address(my_ts);
421 from_port = my_ts->get_from_port(my_ts);
422 to_port = my_ts->get_to_port(my_ts);
423 from_port = (from_port != to_port) ? 0 : from_port;
424 policy->me.net = host_create_from_chunk(family, from_addr, from_port);
425 policy->me.net_mask = my_ts->get_netmask(my_ts);
426 chunk_free(&from_addr);
427
428 /* calculate net and ports for remote side */
429 family = other_ts->get_type(other_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
430 from_addr = other_ts->get_from_address(other_ts);
431 from_port = other_ts->get_from_port(other_ts);
432 to_port = other_ts->get_to_port(other_ts);
433 from_port = (from_port != to_port) ? 0 : from_port;
434 policy->other.net = host_create_from_chunk(family, from_addr, from_port);
435 policy->other.net_mask = other_ts->get_netmask(other_ts);
436 chunk_free(&from_addr);
437
438 /* install 3 policies: out, in and forward */
439 status = charon->kernel_interface->add_policy(charon->kernel_interface,
440 this->me.addr, this->other.addr,
441 policy->me.net, policy->other.net,
442 policy->me.net_mask, policy->other.net_mask,
443 XFRM_POLICY_OUT, policy->upper_proto,
444 this->protocol, this->reqid);
445
446 status |= charon->kernel_interface->add_policy(charon->kernel_interface,
447 this->other.addr, this->me.addr,
448 policy->other.net, policy->me.net,
449 policy->other.net_mask, policy->me.net_mask,
450 XFRM_POLICY_IN, policy->upper_proto,
451 this->protocol, this->reqid);
452
453 status |= charon->kernel_interface->add_policy(charon->kernel_interface,
454 this->other.addr, this->me.addr,
455 policy->other.net, policy->me.net,
456 policy->other.net_mask, policy->me.net_mask,
457 XFRM_POLICY_FWD, policy->upper_proto,
458 this->protocol, this->reqid);
459
460 if (status != SUCCESS)
461 {
462 my_iter->destroy(my_iter);
463 other_iter->destroy(other_iter);
464 policy->me.net->destroy(policy->me.net);
465 policy->other.net->destroy(policy->other.net);
466 free(policy);
467 return status;
468 }
469
470 /* add it to the policy list, since we want to know which policies we own */
471 this->policies->insert_last(this->policies, policy);
472 }
473 }
474 my_iter->destroy(my_iter);
475 other_iter->destroy(other_iter);
476 return SUCCESS;
477 }
478
479 /**
480 * Implementation of child_sa_t.set_rekeyed.
481 */
482 static void set_rekeyed(private_child_sa_t *this)
483 {
484 this->rekeyed = TRUE;
485 }
486
487 /**
488 * Implementation of child_sa_t.get_use_time
489 */
490 static status_t get_use_time(private_child_sa_t *this, bool inbound, time_t *use_time)
491 {
492 iterator_t *iterator;
493 sa_policy_t *policy;
494 struct protoent *proto;
495 char proto_buf[8] = "";
496 char *proto_name = proto_buf;
497 status_t status;
498
499 *use_time = UNDEFINED_TIME;
500
501 iterator = this->policies->create_iterator(this->policies, TRUE);
502 while (iterator->iterate(iterator, (void**)&policy))
503 {
504 time_t ut;
505
506 if (policy->upper_proto)
507 {
508 proto = getprotobynumber(policy->upper_proto);
509 if (proto)
510 {
511 proto_name = proto->p_name;
512 }
513 else
514 {
515 snprintf(proto_buf, sizeof(proto_buf), "<%d>", policy->upper_proto);
516 }
517 }
518
519 this->logger->log(this->logger, CONTROL|LEVEL1,
520 "querying policy: %s/%d==%s==%s/%d",
521 policy->me.net->get_address(policy->me.net), policy->me.net_mask,
522 proto_name,
523 policy->other.net->get_address(policy->other.net), policy->other.net_mask);
524
525 if (inbound)
526 {
527 status = charon->kernel_interface->query_policy(charon->kernel_interface,
528 this->other.addr, this->me.addr,
529 policy->other.net, policy->me.net,
530 policy->other.net_mask, policy->me.net_mask,
531 XFRM_POLICY_IN, policy->upper_proto,
532 &ut);
533
534 /* also check forward policy in tunnel mode */
535 if (status == SUCCESS /*&& mode == TUNNEL XXX */)
536 {
537 time_t fwd;
538
539 status = charon->kernel_interface->query_policy(charon->kernel_interface,
540 this->other.addr, this->me.addr,
541 policy->other.net, policy->me.net,
542 policy->other.net_mask, policy->me.net_mask,
543 XFRM_POLICY_FWD, policy->upper_proto,
544 &fwd);
545
546 if (status == SUCCESS)
547 {
548 ut = max(ut, fwd);
549 }
550 }
551 }
552 else
553 {
554 status = charon->kernel_interface->query_policy(charon->kernel_interface,
555 this->me.addr, this->other.addr,
556 policy->me.net, policy->other.net,
557 policy->me.net_mask, policy->other.net_mask,
558 XFRM_POLICY_OUT, policy->upper_proto,
559 &ut);
560 }
561
562 if (status != SUCCESS)
563 {
564 iterator->destroy(iterator);
565 return FAILED;
566 }
567
568 *use_time = max(*use_time, ut);
569 }
570 iterator->destroy(iterator);
571
572 return SUCCESS;
573 }
574
575 /**
576 * Implementation of child_sa_t.log_status.
577 */
578 static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
579 {
580 iterator_t *iterator;
581 char use_in_str[12] = "unused";
582 char use_out_str[12] = "unused";
583 char rekey_str[12] = "disabled";
584 time_t use_in, use_out, now, rekeying;
585
586 if (logger == NULL)
587 {
588 logger = this->logger;
589 }
590 now = time(NULL);
591 get_use_time(this, TRUE, &use_in);
592 if (use_in)
593 {
594 snprintf(use_in_str, sizeof(use_in_str), "%ds", (int)(now - use_in));
595 }
596 get_use_time(this, FALSE, &use_out);
597 if (use_out)
598 {
599 snprintf(use_out_str, sizeof(use_out_str), "%ds", (int)(now - use_out));
600 }
601 if (this->soft_lifetime)
602 {
603 rekeying = this->soft_lifetime - (now - this->install_time);
604 snprintf(rekey_str, sizeof(rekey_str), "%ds", (int)rekeying);
605 }
606
607 logger->log(logger, CONTROL|LEVEL1,
608 " \"%s\": using %s, SPIs (in/out): 0x%x/0x%x, reqid: %d",
609 name,
610 this->protocol == PROTO_ESP ? "ESP" : "AH",
611 htonl(this->me.spi), htonl(this->other.spi),
612 this->reqid);
613
614 logger->log(logger, CONTROL|LEVEL1,
615 " \"%s\": rekeying: %s, last traffic (in/out): %s/%s",
616 name, rekey_str, use_in_str, use_out_str);
617
618 iterator = this->policies->create_iterator(this->policies, TRUE);
619 while (iterator->has_next(iterator))
620 {
621 sa_policy_t *policy;
622 struct protoent *proto;
623 char proto_str[8] = "";
624 char *proto_name = proto_str;
625 char my_net_str[8] = "";
626 char other_net_str[8] = "";
627 char my_port_str[8] = "";
628 char other_port_str[8] = "";
629 u_int16_t my_port, other_port;
630
631 iterator->current(iterator, (void**)&policy);
632
633 if (policy->upper_proto)
634 {
635 proto = getprotobynumber(policy->upper_proto);
636 if (proto)
637 {
638 proto_name = proto->p_name;
639 }
640 else
641 {
642 snprintf(proto_str, sizeof(proto_str), "%d", policy->upper_proto);
643 }
644 }
645 if (policy->me.net_mask != 32)
646 {
647 snprintf(my_net_str, sizeof(my_net_str), "/%d", policy->me.net_mask);
648 }
649 if (policy->other.net_mask != 32)
650 {
651 snprintf(other_net_str, sizeof(other_net_str), "/%d", policy->other.net_mask);
652 }
653 my_port = policy->me.net->get_port(policy->me.net);
654 other_port = policy->other.net->get_port(policy->other.net);
655 if (my_port)
656 {
657 snprintf(my_port_str, sizeof(my_port_str), ":%d", my_port);
658 }
659 if (other_port)
660 {
661 snprintf(other_port_str, sizeof(other_port_str), ":%d", other_port);
662 }
663
664 logger->log(logger, CONTROL, " \"%s\": %s%s%s==%s==%s%s%s",
665 name,
666 policy->me.net->get_address(policy->me.net),
667 my_port_str, my_net_str,
668 proto_name,
669 policy->other.net->get_address(policy->other.net),
670 other_port_str, other_net_str);
671 }
672 iterator->destroy(iterator);
673 }
674
675 /**
676 * Update the host adress/port of a SA
677 */
678 static status_t update_sa_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other,
679 int my_changes, int other_changes, bool mine)
680 {
681 host_t *src, *dst, *new_src, *new_dst;
682 int src_changes, dst_changes;
683 status_t status;
684 u_int32_t spi;
685
686 if (mine)
687 {
688 src = this->me.addr;
689 dst = this->other.addr;
690 new_src = new_me;
691 new_dst = new_other;
692 src_changes = my_changes;
693 dst_changes = other_changes;
694 spi = this->me.spi;
695 }
696 else
697 {
698 src = this->other.addr;
699 dst = this->me.addr;
700 new_src = new_other;
701 new_dst = new_me;
702 src_changes = other_changes;
703 dst_changes = my_changes;
704 spi = this->other.spi;
705 }
706
707 this->logger->log(this->logger, CONTROL|LEVEL1,
708 "updating %s SA 0x%x, from %s:%d..%s:%d to %s:%d..%s:%d",
709 mapping_find(protocol_id_m, this->protocol), ntohl(spi),
710 src->get_address(src), src->get_port(src),
711 dst->get_address(dst), dst->get_port(dst),
712 new_src->get_address(new_src), new_src->get_port(new_src),
713 new_dst->get_address(new_dst), new_dst->get_port(new_dst));
714
715 status = charon->kernel_interface->update_sa_hosts(
716 charon->kernel_interface,
717 src, dst, new_src, new_dst,
718 src_changes, dst_changes,
719 spi, this->protocol);
720
721 if (status != SUCCESS)
722 {
723 return FAILED;
724 }
725 return SUCCESS;
726 }
727
728 /**
729 * Update the host adress/port of a policy
730 */
731 static status_t update_policy_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other)
732 {
733 iterator_t *iterator;
734 sa_policy_t *policy;
735 status_t status;
736
737 iterator = this->policies->create_iterator(this->policies, TRUE);
738 while (iterator->iterate(iterator, (void**)&policy))
739 {
740 this->logger->log(this->logger, CONTROL|LEVEL1,
741 "updating policy: %s/%d====%s/%d",
742 policy->me.net->get_address(policy->me.net), policy->me.net_mask,
743 policy->other.net->get_address(policy->other.net), policy->other.net_mask);
744
745 status = charon->kernel_interface->add_policy(
746 charon->kernel_interface,
747 new_me, new_other,
748 policy->me.net, policy->other.net,
749 policy->me.net_mask, policy->other.net_mask,
750 XFRM_POLICY_OUT, policy->upper_proto,
751 this->protocol, this->reqid);
752
753 status |= charon->kernel_interface->add_policy(
754 charon->kernel_interface,
755 new_other, new_me,
756 policy->other.net, policy->me.net,
757 policy->other.net_mask, policy->me.net_mask,
758 XFRM_POLICY_IN, policy->upper_proto,
759 this->protocol, this->reqid);
760
761 status |= charon->kernel_interface->add_policy(
762 charon->kernel_interface,
763 new_other, new_me,
764 policy->other.net, policy->me.net,
765 policy->other.net_mask, policy->me.net_mask,
766 XFRM_POLICY_FWD, policy->upper_proto,
767 this->protocol, this->reqid);
768
769 if (status != SUCCESS)
770 {
771 iterator->destroy(iterator);
772 return FAILED;
773 }
774 }
775 iterator->destroy(iterator);
776
777 return SUCCESS;
778 }
779
780 /**
781 * Implementation of child_sa_t.update_hosts.
782 */
783 static status_t update_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other,
784 int my_changes, int other_changes)
785 {
786 if (!my_changes || !other_changes)
787 {
788 return SUCCESS;
789 }
790
791 /* update our (initator) SAs */
792 if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, TRUE) != SUCCESS)
793 {
794 return FAILED;
795 }
796
797 /* update his (responder) SAs */
798 if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, FALSE) != SUCCESS)
799 {
800 return FAILED;
801 }
802
803 /* update policies */
804 if (my_changes & HOST_DIFF_ADDR || other_changes & HOST_DIFF_ADDR)
805 {
806 if (update_policy_hosts(this, new_me, new_other) != SUCCESS)
807 {
808 return FAILED;
809 }
810 }
811
812 /* update hosts */
813 if (my_changes)
814 {
815 this->me.addr->destroy(this->me.addr);
816 this->me.addr = new_me->clone(new_me);
817 }
818
819 if (other_changes)
820 {
821 this->other.addr->destroy(this->other.addr);
822 this->other.addr = new_other->clone(new_other);
823 }
824
825 return SUCCESS;
826 }
827
828 /**
829 * Implementation of child_sa_t.destroy.
830 */
831 static void destroy(private_child_sa_t *this)
832 {
833 sa_policy_t *policy;
834
835 /* delete SAs in the kernel, if they are set up */
836 if (this->me.spi)
837 {
838 charon->kernel_interface->del_sa(charon->kernel_interface,
839 this->me.addr, this->me.spi, this->protocol);
840 }
841 if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi)
842 {
843 charon->kernel_interface->del_sa(charon->kernel_interface,
844 this->me.addr, this->alloc_esp_spi, PROTO_ESP);
845 }
846 if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi)
847 {
848 charon->kernel_interface->del_sa(charon->kernel_interface,
849 this->me.addr, this->alloc_ah_spi, PROTO_AH);
850 }
851 if (this->other.spi)
852 {
853 charon->kernel_interface->del_sa(charon->kernel_interface,
854 this->other.addr, this->other.spi, this->protocol);
855 }
856
857 /* delete all policies in the kernel */
858 while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
859 {
860 if (!this->rekeyed)
861 {
862 /* let rekeyed policies, as they are used by another child_sa */
863 charon->kernel_interface->del_policy(charon->kernel_interface,
864 this->me.addr, this->other.addr,
865 policy->me.net, policy->other.net,
866 policy->me.net_mask, policy->other.net_mask,
867 XFRM_POLICY_OUT, policy->upper_proto);
868
869 charon->kernel_interface->del_policy(charon->kernel_interface,
870 this->other.addr, this->me.addr,
871 policy->other.net, policy->me.net,
872 policy->other.net_mask, policy->me.net_mask,
873 XFRM_POLICY_IN, policy->upper_proto);
874
875 charon->kernel_interface->del_policy(charon->kernel_interface,
876 this->other.addr, this->me.addr,
877 policy->other.net, policy->me.net,
878 policy->other.net_mask, policy->me.net_mask,
879 XFRM_POLICY_FWD, policy->upper_proto);
880 }
881 policy->me.net->destroy(policy->me.net);
882 policy->other.net->destroy(policy->other.net);
883 free(policy);
884 }
885 this->policies->destroy(this->policies);
886
887 free(this);
888 }
889
890 /*
891 * Described in header.
892 */
893 child_sa_t * child_sa_create(u_int32_t rekey, host_t *me, host_t* other,
894 u_int32_t soft_lifetime, u_int32_t hard_lifetime,
895 bool use_natt)
896 {
897 static u_int32_t reqid = REQID_START;
898 private_child_sa_t *this = malloc_thing(private_child_sa_t);
899
900 /* public functions */
901 this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
902 this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
903 this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
904 this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
905 this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
906 this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
907 this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,int,int))update_hosts;
908 this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
909 this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time;
910 this->public.set_rekeyed = (void (*)(child_sa_t*))set_rekeyed;
911 this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
912 this->public.destroy = (void(*)(child_sa_t*))destroy;
913
914 /* private data */
915 this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
916 this->me.addr = me;
917 this->other.addr = other;
918 this->me.spi = 0;
919 this->other.spi = 0;
920 this->alloc_ah_spi = 0;
921 this->alloc_esp_spi = 0;
922 this->use_natt = use_natt;
923 this->soft_lifetime = soft_lifetime;
924 this->hard_lifetime = hard_lifetime;
925 /* reuse old reqid if we are rekeying an existing CHILD_SA */
926 this->reqid = rekey ? rekey : ++reqid;
927 this->policies = linked_list_create();
928 this->protocol = PROTO_NONE;
929 this->rekeyed = FALSE;
930
931 return &this->public;
932 }