src/charon/sa/child_sa.c

   1 /**
   2  * @file child_sa.c
   3  *
   4  * @brief Implementation of child_sa_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include <netdb.h>
  24
  25 #include "child_sa.h"
  26
  27 #include <daemon.h>
  28
  29
  30 typedef struct sa_policy_t sa_policy_t;
  31
  32 /**
  33  * Struct used to store information for a policy. This
  34  * is needed since we must provide all this information
  35  * for deleting a policy...
  36  */
  37 struct sa_policy_t {
  38
  39         struct {
  40                 /** subnet address behind peer peer */
  41                 host_t *net;
  42                 /** netmask used for net */
  43                 u_int8_t net_mask;
  44         } me, other;
  45
  46         /**
  47          * Protocol for this policy, such as TCP/UDP/ICMP...
  48          */
  49         int upper_proto;
  50 };
  51
  52 typedef struct private_child_sa_t private_child_sa_t;
  53
  54 /**
  55  * Private data of a child_sa_t object.
  56  */
  57 struct private_child_sa_t {
  58         /**
  59          * Public interface of child_sa_t.
  60          */
  61         child_sa_t public;
  62
  63         struct {
  64                 /** address of peer */
  65                 host_t *addr;
  66                 /** actual used SPI, 0 if unused */
  67                 u_int32_t spi;
  68         } me, other;
  69
  70         /**
  71          * Protocol used to protect this SA, ESP|AH
  72          */
  73         protocol_id_t protocol;
  74
  75         /**
  76          * List containing sa_policy_t objects
  77          */
  78         linked_list_t *policies;
  79
  80         /**
  81          * reqid used for this child_sa
  82          */
  83         u_int32_t reqid;
  84
  85         /**
  86          * Lifetime before rekeying
  87          */
  88         u_int32_t soft_lifetime;
  89
  90         /**
  91          * Lifetime before delete
  92          */
  93         u_int32_t hard_lifetime;
  94
  95         /**
  96          * CHILD_SAs own logger
  97          */
  98         logger_t *logger;
  99 };
 100
 101 /**
 102  * Implements child_sa_t.get_reqid
 103  */
 104 static u_int32_t get_reqid(private_child_sa_t *this)
 105 {
 106         return this->reqid;
 107 }
 108
 109 /**
 110  * Implements child_sa_t.get_spi
 111  */
 112 u_int32_t get_spi(private_child_sa_t *this, bool inbound)
 113 {
 114         if (inbound)
 115         {
 116                 return this->me.spi;
 117         }
 118         return this->other.spi;
 119 }
 120
 121 /**
 122  * Implements child_sa_t.get_protocol
 123  */
 124 protocol_id_t get_protocol(private_child_sa_t *this)
 125 {
 126         return this->protocol;
 127 }
 128
 129 /**
 130  * Implements child_sa_t.alloc
 131  */
 132 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
 133 {
 134         protocol_id_t protocol;
 135         iterator_t *iterator;
 136         proposal_t *proposal;
 137         status_t status;
 138         u_int i;
 139
 140         /* iterator through proposals */
 141         iterator = proposals->create_iterator(proposals, TRUE);
 142         while(iterator->has_next(iterator))
 143         {
 144                 iterator->current(iterator, (void**)&proposal);
 145                 protocol = proposal->get_protocol(proposal);
 146
 147                 status = charon->kernel_interface->get_spi(
 148                                         charon->kernel_interface,
 149                                         this->me.addr, this->other.addr,
 150                                         protocol, FALSE,
 151                                         &(this->me.spi));
 152
 153                 if (status != SUCCESS)
 154                 {
 155                         iterator->destroy(iterator);
 156                         return FAILED;
 157                 }
 158                 /* update proposal */
 159                 proposal->set_spi(proposal, (u_int64_t)this->me.spi);
 160         }
 161         iterator->destroy(iterator);
 162         return SUCCESS;
 163 }
 164
 165 static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
 166 {
 167         u_int32_t spi;
 168         encryption_algorithm_t enc_algo;
 169         integrity_algorithm_t int_algo;
 170         chunk_t enc_key, int_key;
 171         algorithm_t *algo;
 172         crypter_t *crypter;
 173         signer_t *signer;
 174         size_t key_size;
 175         host_t *src;
 176         host_t *dst;
 177         status_t status;
 178
 179         /* we must assign the roles to correctly set up the SAs */
 180         if (mine)
 181         {
 182                 src = this->me.addr;
 183                 dst = this->other.addr;
 184         }
 185         else
 186         {
 187                 dst = this->me.addr;
 188                 src = this->other.addr;
 189         }
 190
 191         this->protocol = proposal->get_protocol(proposal);
 192
 193         /* now we have to decide which spi to use. Use self allocated, if "mine",
 194          * or the one in the proposal, if not "mine" (others). */
 195         if (mine)
 196         {
 197                 spi = this->me.spi;
 198         }
 199         else
 200         {
 201                 spi = proposal->get_spi(proposal);
 202                 this->other.spi = spi;
 203         }
 204
 205         /* derive encryption key first */
 206         if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
 207         {
 208                 enc_algo = algo->algorithm;
 209                 this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s, ",
 210                                                         mapping_find(protocol_id_m, this->protocol),
 211                                                         mine ? "me" : "other",
 212                                                         mapping_find(transform_type_m, ENCRYPTION_ALGORITHM),
 213                                                         mapping_find(encryption_algorithm_m, enc_algo));
 214
 215                 /* we must create a (unused) crypter, since its the only way to get the size
 216                  * of the key. This is not so nice, since charon must support all algorithms
 217                  * the kernel supports...
 218                  * TODO: build something of a encryption algorithm lookup function
 219                  */
 220                 crypter = crypter_create(enc_algo, algo->key_size);
 221                 key_size = crypter->get_key_size(crypter);
 222                 crypter->destroy(crypter);
 223                 prf_plus->allocate_bytes(prf_plus, key_size, &enc_key);
 224                 this->logger->log_chunk(this->logger, PRIVATE, "key:", enc_key);
 225         }
 226         else
 227         {
 228                 enc_algo = ENCR_UNDEFINED;
 229         }
 230
 231         /* derive integrity key */
 232         if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
 233         {
 234                 int_algo = algo->algorithm;
 235                 this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s,",
 236                                                         mapping_find(protocol_id_m, this->protocol),
 237                                                         mine ? "me" : "other",
 238                                                         mapping_find(transform_type_m, INTEGRITY_ALGORITHM),
 239                                                         mapping_find(integrity_algorithm_m, algo->algorithm));
 240
 241                 signer = signer_create(int_algo);
 242                 key_size = signer->get_key_size(signer);
 243                 signer->destroy(signer);
 244                 prf_plus->allocate_bytes(prf_plus, key_size, &int_key);
 245                 this->logger->log_chunk(this->logger, PRIVATE, "key:", int_key);
 246         }
 247         else
 248         {
 249                 int_algo = AUTH_UNDEFINED;
 250         }
 251
 252         /* send keys down to kernel */
 253         this->logger->log(this->logger, CONTROL|LEVEL1,
 254                                                 "installing 0x%.8x for %s, src %s dst %s",
 255                                                 ntohl(spi), mapping_find(protocol_id_m, this->protocol),
 256                                                 src->get_address(src), dst->get_address(dst));
 257         status = charon->kernel_interface->add_sa(charon->kernel_interface,
 258                                                                                                 src, dst,
 259                                                                                                 spi, this->protocol,
 260                                                                                                 this->reqid,
 261                                                                                                 mine ? 0 : this->soft_lifetime,
 262                                                                                                 this->hard_lifetime,
 263                                                                                                 enc_algo, enc_key,
 264                                                                                                 int_algo, int_key, mine);
 265         /* clean up */
 266         if (enc_algo != ENCR_UNDEFINED)
 267         {
 268                 chunk_free(&enc_key);
 269         }
 270         if (int_algo != AUTH_UNDEFINED)
 271         {
 272                 chunk_free(&int_key);
 273         }
 274         return status;
 275 }
 276
 277 static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
 278 {
 279         linked_list_t *list;
 280
 281         /* install others (initiators) SAs*/
 282         if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
 283         {
 284                 return FAILED;
 285         }
 286
 287         /* get SPIs for our SAs */
 288         list = linked_list_create();
 289         list->insert_last(list, proposal);
 290         if (alloc(this, list) != SUCCESS)
 291         {
 292                 list->destroy(list);
 293                 return FAILED;
 294         }
 295         list->destroy(list);
 296
 297         /* install our (responders) SAs */
 298         if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
 299         {
 300                 return FAILED;
 301         }
 302
 303         return SUCCESS;
 304 }
 305
 306 static status_t update(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
 307 {
 308         /* install our (initator) SAs */
 309         if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
 310         {
 311                 return FAILED;
 312         }
 313         /* install his (responder) SAs */
 314         if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
 315         {
 316                 return FAILED;
 317         }
 318
 319         return SUCCESS;
 320 }
 321
 322 static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list, linked_list_t *other_ts_list)
 323 {
 324         iterator_t *my_iter, *other_iter;
 325         traffic_selector_t *my_ts, *other_ts;
 326
 327         /* iterate over both lists */
 328         my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
 329         other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
 330         while (my_iter->has_next(my_iter))
 331         {
 332                 my_iter->current(my_iter, (void**)&my_ts);
 333                 other_iter->reset(other_iter);
 334                 while (other_iter->has_next(other_iter))
 335                 {
 336                         /* set up policies for every entry in my_ts_list to every entry in other_ts_list */
 337                         int family;
 338                         chunk_t from_addr;
 339                         u_int16_t from_port, to_port;
 340                         sa_policy_t *policy;
 341                         status_t status;
 342
 343                         other_iter->current(other_iter, (void**)&other_ts);
 344
 345                         /* only set up policies if protocol matches */
 346                         if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts))
 347                         {
 348                                 continue;
 349                         }
 350                         policy = malloc_thing(sa_policy_t);
 351                         policy->upper_proto = my_ts->get_protocol(my_ts);
 352
 353                         /* calculate net and ports for local side */
 354                         family = my_ts->get_type(my_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
 355                         from_addr = my_ts->get_from_address(my_ts);
 356                         from_port = my_ts->get_from_port(my_ts);
 357                         to_port = my_ts->get_to_port(my_ts);
 358                         from_port = (from_port != to_port) ? 0 : from_port;
 359                         policy->me.net = host_create_from_chunk(family, from_addr, from_port);
 360                         policy->me.net_mask = my_ts->get_netmask(my_ts);
 361                         chunk_free(&from_addr);
 362
 363                         /* calculate net and ports for remote side */
 364                         family = other_ts->get_type(other_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
 365                         from_addr = other_ts->get_from_address(other_ts);
 366                         from_port = other_ts->get_from_port(other_ts);
 367                         to_port = other_ts->get_to_port(other_ts);
 368                         from_port = (from_port != to_port) ? 0 : from_port;
 369                         policy->other.net = host_create_from_chunk(family, from_addr, from_port);
 370                         policy->other.net_mask = other_ts->get_netmask(other_ts);
 371                         chunk_free(&from_addr);
 372
 373                         /* install 3 policies: out, in and forward */
 374                         status = charon->kernel_interface->add_policy(charon->kernel_interface,
 375                                         this->me.addr, this->other.addr,
 376                                         policy->me.net, policy->other.net,
 377                                         policy->me.net_mask, policy->other.net_mask,
 378                                         XFRM_POLICY_OUT, policy->upper_proto,
 379                                         this->protocol == PROTO_AH,
 380                                         this->protocol == PROTO_ESP,
 381                                         this->reqid);
 382
 383                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 384                                         this->other.addr, this->me.addr,
 385                                         policy->other.net, policy->me.net,
 386                                         policy->other.net_mask, policy->me.net_mask,
 387                                         XFRM_POLICY_IN, policy->upper_proto,
 388                                         this->protocol == PROTO_AH,
 389                                         this->protocol == PROTO_ESP,
 390                                         this->reqid);
 391
 392                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 393                                         this->other.addr, this->me.addr,
 394                                         policy->other.net, policy->me.net,
 395                                         policy->other.net_mask, policy->me.net_mask,
 396                                         XFRM_POLICY_FWD, policy->upper_proto,
 397                                         this->protocol == PROTO_AH,
 398                                         this->protocol == PROTO_ESP,
 399                                         this->reqid);
 400
 401                         if (status != SUCCESS)
 402                         {
 403                                 my_iter->destroy(my_iter);
 404                                 other_iter->destroy(other_iter);
 405                                 policy->me.net->destroy(policy->me.net);
 406                                 policy->other.net->destroy(policy->other.net);
 407                                 free(policy);
 408                                 return status;
 409                         }
 410
 411                         /* add it to the policy list, since we want to know which policies we own */
 412                         this->policies->insert_last(this->policies, policy);
 413                 }
 414         }
 415         my_iter->destroy(my_iter);
 416         other_iter->destroy(other_iter);
 417         return SUCCESS;
 418 }
 419
 420 /**
 421  * Implementation of child_sa_t.log_status.
 422  */
 423 static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
 424 {
 425         iterator_t *iterator;
 426         sa_policy_t *policy;
 427         struct protoent *proto;
 428         char proto_buf[8] = "";
 429         char *proto_name = proto_buf;
 430
 431         if (logger == NULL)
 432         {
 433                 logger = this->logger;
 434         }
 435         logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   protected with %s (0x%x/0x%x), reqid %d:",
 436                                 name,
 437                                 this->protocol == PROTO_ESP ? "ESP" : "AH",
 438                                 htonl(this->me.spi), htonl(this->other.spi),
 439                                 this->reqid);
 440         iterator = this->policies->create_iterator(this->policies, TRUE);
 441         while (iterator->has_next(iterator))
 442         {
 443                 iterator->current(iterator, (void**)&policy);
 444                 if (policy->upper_proto)
 445                 {
 446                         proto = getprotobynumber(policy->upper_proto);
 447                         if (proto)
 448                         {
 449                                 proto_name = proto->p_name;
 450                         }
 451                         else
 452                         {
 453                                 snprintf(proto_buf, sizeof(proto_buf), "<%d>", policy->upper_proto);
 454                         }
 455                 }
 456                 logger->log(logger, CONTROL, "  \"%s\":     %s/%d==%s==%s/%d",
 457                                         name,
 458                                         policy->me.net->get_address(policy->me.net), policy->me.net_mask,
 459                                         proto_name,
 460                                         policy->other.net->get_address(policy->other.net), policy->other.net_mask);
 461         }
 462         iterator->destroy(iterator);
 463 }
 464
 465 /**
 466  * Implementation of child_sa_t.destroy.
 467  */
 468 static void destroy(private_child_sa_t *this)
 469 {
 470         /* delete all policies in the kernel */
 471         sa_policy_t *policy;
 472         while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
 473         {
 474                 charon->kernel_interface->del_policy(charon->kernel_interface,
 475                                                                                          this->me.addr, this->other.addr,
 476                                                                                          policy->me.net, policy->other.net,
 477                                                                                          policy->me.net_mask, policy->other.net_mask,
 478                                                                                          XFRM_POLICY_OUT, policy->upper_proto);
 479
 480                 charon->kernel_interface->del_policy(charon->kernel_interface,
 481                                                                                          this->other.addr, this->me.addr,
 482                                                                                          policy->other.net, policy->me.net,
 483                                                                                          policy->other.net_mask, policy->me.net_mask,
 484                                                                                          XFRM_POLICY_IN, policy->upper_proto);
 485
 486                 charon->kernel_interface->del_policy(charon->kernel_interface,
 487                                                                                          this->other.addr, this->me.addr,
 488                                                                                          policy->other.net, policy->me.net,
 489                                                                                          policy->other.net_mask, policy->me.net_mask,
 490                                                                                          XFRM_POLICY_FWD, policy->upper_proto);
 491
 492                 policy->me.net->destroy(policy->me.net);
 493                 policy->other.net->destroy(policy->other.net);
 494                 free(policy);
 495         }
 496         this->policies->destroy(this->policies);
 497
 498         /* delete SAs in the kernel, if they are set up */
 499         if (this->protocol != PROTO_NONE)
 500         {
 501                 charon->kernel_interface->del_sa(charon->kernel_interface,
 502                                                                                  this->other.addr, this->me.spi, this->protocol);
 503                 charon->kernel_interface->del_sa(charon->kernel_interface,
 504                                                                                  this->me.addr, this->other.spi, this->protocol);
 505         }
 506         free(this);
 507 }
 508
 509 /*
 510  * Described in header.
 511  */
 512 child_sa_t * child_sa_create(host_t *me, host_t* other, u_int32_t soft_lifetime, u_int32_t hard_lifetime)
 513 {
 514         static u_int32_t reqid = 2000000000;
 515         private_child_sa_t *this = malloc_thing(private_child_sa_t);
 516
 517         /* public functions */
 518         this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
 519         this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
 520         this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
 521         this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
 522         this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
 523         this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
 524         this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
 525         this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
 526         this->public.destroy = (void(*)(child_sa_t*))destroy;
 527
 528         /* private data */
 529         this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
 530         this->me.addr = me;
 531         this->other.addr = other;
 532         this->me.spi = 0;
 533         this->other.spi = 0;
 534         this->soft_lifetime = soft_lifetime;
 535         this->hard_lifetime = hard_lifetime;
 536         this->reqid = ++reqid;
 537         this->policies = linked_list_create();
 538         this->protocol = PROTO_NONE;
 539
 540         return (&this->public);
 541 }