src/charon/sa/child_sa.c

   1 /*
   2  * Copyright (C) 2006-2008 Tobias Brunner
   3  * Copyright (C) 2005-2008 Martin Willi
   4  * Copyright (C) 2006 Daniel Roethlisberger
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  *
  18  * $Id$
  19  */
  20
  21 #define _GNU_SOURCE
  22 #include "child_sa.h"
  23
  24 #include <stdio.h>
  25 #include <string.h>
  26
  27 #include <daemon.h>
  28
  29 ENUM(child_sa_state_names, CHILD_CREATED, CHILD_DESTROYING,
  30         "CREATED",
  31         "ROUTED",
  32         "INSTALLED",
  33         "REKEYING",
  34         "DELETING",
  35         "DESTROYING",
  36 );
  37
  38 typedef struct sa_policy_t sa_policy_t;
  39
  40 /**
  41  * Struct used to store information for a policy. This
  42  * is needed since we must provide all this information
  43  * for deleting a policy...
  44  */
  45 struct sa_policy_t {
  46         /**
  47          * Traffic selector for us
  48          */
  49         traffic_selector_t *my_ts;
  50
  51         /**
  52          * Traffic selector for other
  53          */
  54         traffic_selector_t *other_ts;
  55 };
  56
  57 typedef struct private_child_sa_t private_child_sa_t;
  58
  59 /**
  60  * Private data of a child_sa_t object.
  61  */
  62 struct private_child_sa_t {
  63         /**
  64          * Public interface of child_sa_t.
  65          */
  66         child_sa_t public;
  67
  68         struct {
  69                 /** address of peer */
  70                 host_t *addr;
  71                 /** id of peer */
  72                 identification_t *id;
  73                 /** actual used SPI, 0 if unused */
  74                 u_int32_t spi;
  75                 /** Compression Parameter Index (CPI) used, 0 if unused */
  76                 u_int16_t cpi;
  77         } me, other;
  78
  79         /**
  80          * Allocated SPI for a ESP proposal candidates
  81          */
  82         u_int32_t alloc_esp_spi;
  83
  84         /**
  85          * Allocated SPI for a AH proposal candidates
  86          */
  87         u_int32_t alloc_ah_spi;
  88
  89         /**
  90          * Protocol used to protect this SA, ESP|AH
  91          */
  92         protocol_id_t protocol;
  93
  94         /**
  95          * List containing sa_policy_t objects
  96          */
  97         linked_list_t *policies;
  98
  99         /**
 100          * Separate list for local traffic selectors
 101          */
 102         linked_list_t *my_ts;
 103
 104         /**
 105          * Separate list for remote traffic selectors
 106          */
 107         linked_list_t *other_ts;
 108
 109         /**
 110          * reqid used for this child_sa
 111          */
 112         u_int32_t reqid;
 113
 114         /**
 115          * encryption algorithm used for this SA
 116          */
 117         u_int16_t enc_alg;
 118
 119         /**
 120          * key size of enc_alg
 121          */
 122         u_int16_t enc_size;
 123
 124         /**
 125          * integrity protection algorithm used for this SA
 126          */
 127         u_int16_t int_alg;
 128
 129         /**
 130          * key size of int_alg
 131          */
 132         u_int16_t int_size;
 133
 134         /**
 135          * time, on which SA was installed
 136          */
 137         time_t install_time;
 138
 139         /**
 140          * absolute time when rekeying is scheduled
 141          */
 142         time_t rekey_time;
 143
 144         /**
 145          * state of the CHILD_SA
 146          */
 147         child_sa_state_t state;
 148
 149         /**
 150          * Specifies if UDP encapsulation is enabled (NAT traversal)
 151          */
 152         bool encap;
 153
 154         /**
 155          * Specifies the IPComp transform used (IPCOMP_NONE if disabled)
 156          */
 157         ipcomp_transform_t ipcomp;
 158
 159         /**
 160          * TRUE if we allocated (or tried to allocate) a CPI
 161          */
 162         bool cpi_allocated;
 163
 164         /**
 165          * mode this SA uses, tunnel/transport
 166          */
 167         ipsec_mode_t mode;
 168
 169         /**
 170          * virtual IP assigned to local host
 171          */
 172         host_t *virtual_ip;
 173
 174         /**
 175          * config used to create this child
 176          */
 177         child_cfg_t *config;
 178
 179         /**
 180          * cached interface name for iptables
 181          */
 182         char *iface;
 183 };
 184
 185 /**
 186  * Implementation of child_sa_t.get_name.
 187  */
 188 static char *get_name(private_child_sa_t *this)
 189 {
 190         return this->config->get_name(this->config);
 191 }
 192
 193 /**
 194  * Implements child_sa_t.get_reqid
 195  */
 196 static u_int32_t get_reqid(private_child_sa_t *this)
 197 {
 198         return this->reqid;
 199 }
 200
 201 /**
 202  * Implements child_sa_t.get_spi
 203  */
 204 u_int32_t get_spi(private_child_sa_t *this, bool inbound)
 205 {
 206         if (inbound)
 207         {
 208                 return this->me.spi;
 209         }
 210         return this->other.spi;
 211 }
 212
 213 /**
 214  * Implements child_sa_t.get_cpi
 215  */
 216 u_int16_t get_cpi(private_child_sa_t *this, bool inbound)
 217 {
 218         if (inbound)
 219         {
 220                 return this->me.cpi;
 221         }
 222         return this->other.cpi;
 223 }
 224
 225 /**
 226  * Implements child_sa_t.get_protocol
 227  */
 228 protocol_id_t get_protocol(private_child_sa_t *this)
 229 {
 230         return this->protocol;
 231 }
 232
 233 /**
 234  * Implements child_sa_t.get_state
 235  */
 236 static child_sa_state_t get_state(private_child_sa_t *this)
 237 {
 238         return this->state;
 239 }
 240
 241 /**
 242  * Implements child_sa_t.get_config
 243  */
 244 static child_cfg_t* get_config(private_child_sa_t *this)
 245 {
 246         return this->config;
 247 }
 248
 249 /**
 250  * Implementation of child_sa_t.get_stats.
 251  */
 252 static void get_stats(private_child_sa_t *this, ipsec_mode_t *mode,
 253                                           encryption_algorithm_t *encr_algo, size_t *encr_len,
 254                                           integrity_algorithm_t *int_algo, size_t *int_len,
 255                                           u_int32_t *rekey, u_int32_t *use_in, u_int32_t *use_out,
 256                                           u_int32_t *use_fwd)
 257 {
 258         sa_policy_t *policy;
 259         iterator_t *iterator;
 260         u_int32_t in = 0, out = 0, fwd = 0, time;
 261
 262         iterator = this->policies->create_iterator(this->policies, TRUE);
 263         while (iterator->iterate(iterator, (void**)&policy))
 264         {
 265
 266                 if (charon->kernel_interface->query_policy(charon->kernel_interface,
 267                                 policy->other_ts, policy->my_ts, POLICY_IN, &time) == SUCCESS)
 268                 {
 269                         in = max(in, time);
 270                 }
 271                 if (charon->kernel_interface->query_policy(charon->kernel_interface,
 272                                 policy->my_ts, policy->other_ts, POLICY_OUT, &time) == SUCCESS)
 273                 {
 274                         out = max(out, time);
 275                 }
 276                 if (charon->kernel_interface->query_policy(charon->kernel_interface,
 277                                 policy->other_ts, policy->my_ts, POLICY_FWD, &time) == SUCCESS)
 278                 {
 279                         fwd = max(fwd, time);
 280                 }
 281         }
 282         iterator->destroy(iterator);
 283
 284         *mode = this->mode;
 285         *encr_algo = this->enc_alg;
 286         *encr_len = this->enc_size;
 287         *int_algo = this->int_alg;
 288         *int_len = this->int_size;
 289         *rekey = this->rekey_time;
 290         *use_in = in;
 291         *use_out = out;
 292         *use_fwd = fwd;
 293 }
 294
 295 /**
 296  * Run the up/down script
 297  */
 298 static void updown(private_child_sa_t *this, bool up)
 299 {
 300         sa_policy_t *policy;
 301         iterator_t *iterator;
 302         char *script;
 303
 304         script = this->config->get_updown(this->config);
 305
 306         if (script == NULL)
 307         {
 308                 return;
 309         }
 310
 311         iterator = this->policies->create_iterator(this->policies, TRUE);
 312         while (iterator->iterate(iterator, (void**)&policy))
 313         {
 314                 char command[1024];
 315                 char *my_client, *other_client, *my_client_mask, *other_client_mask;
 316                 char *pos, *virtual_ip;
 317                 FILE *shell;
 318
 319                 /* get subnet/bits from string */
 320                 asprintf(&my_client, "%R", policy->my_ts);
 321                 pos = strchr(my_client, '/');
 322                 *pos = '\0';
 323                 my_client_mask = pos + 1;
 324                 pos = strchr(my_client_mask, '[');
 325                 if (pos)
 326                 {
 327                         *pos = '\0';
 328                 }
 329                 asprintf(&other_client, "%R", policy->other_ts);
 330                 pos = strchr(other_client, '/');
 331                 *pos = '\0';
 332                 other_client_mask = pos + 1;
 333                 pos = strchr(other_client_mask, '[');
 334                 if (pos)
 335                 {
 336                         *pos = '\0';
 337                 }
 338
 339                 if (this->virtual_ip)
 340                 {
 341                         asprintf(&virtual_ip, "PLUTO_MY_SOURCEIP='%H' ",
 342                                          this->virtual_ip);
 343                 }
 344                 else
 345                 {
 346                         asprintf(&virtual_ip, "");
 347                 }
 348
 349                 /* we cache the iface name, as it may not be available when
 350                  * the SA gets deleted */
 351                 if (up)
 352                 {
 353                         free(this->iface);
 354                         this->iface = charon->kernel_interface->get_interface(
 355                                                                 charon->kernel_interface, this->me.addr);
 356                 }
 357
 358                 /* build the command with all env variables.
 359                  * TODO: PLUTO_PEER_CA and PLUTO_NEXT_HOP are currently missing
 360                  */
 361                 snprintf(command, sizeof(command),
 362                                  "2>&1 "
 363                                 "PLUTO_VERSION='1.1' "
 364                                 "PLUTO_VERB='%s%s%s' "
 365                                 "PLUTO_CONNECTION='%s' "
 366                                 "PLUTO_INTERFACE='%s' "
 367                                 "PLUTO_REQID='%u' "
 368                                 "PLUTO_ME='%H' "
 369                                 "PLUTO_MY_ID='%D' "
 370                                 "PLUTO_MY_CLIENT='%s/%s' "
 371                                 "PLUTO_MY_CLIENT_NET='%s' "
 372                                 "PLUTO_MY_CLIENT_MASK='%s' "
 373                                 "PLUTO_MY_PORT='%u' "
 374                                 "PLUTO_MY_PROTOCOL='%u' "
 375                                 "PLUTO_PEER='%H' "
 376                                 "PLUTO_PEER_ID='%D' "
 377                                 "PLUTO_PEER_CLIENT='%s/%s' "
 378                                 "PLUTO_PEER_CLIENT_NET='%s' "
 379                                 "PLUTO_PEER_CLIENT_MASK='%s' "
 380                                 "PLUTO_PEER_PORT='%u' "
 381                                 "PLUTO_PEER_PROTOCOL='%u' "
 382                                 "%s"
 383                                 "%s"
 384                                 "%s",
 385                                  up ? "up" : "down",
 386                                  policy->my_ts->is_host(policy->my_ts,
 387                                                         this->me.addr) ? "-host" : "-client",
 388                                  this->me.addr->get_family(this->me.addr) == AF_INET ? "" : "-v6",
 389                                  this->config->get_name(this->config),
 390                                  this->iface ? this->iface : "unknown",
 391                                  this->reqid,
 392                                  this->me.addr,
 393                                  this->me.id,
 394                                  my_client, my_client_mask,
 395                                  my_client, my_client_mask,
 396                                  policy->my_ts->get_from_port(policy->my_ts),
 397                                  policy->my_ts->get_protocol(policy->my_ts),
 398                                  this->other.addr,
 399                                  this->other.id,
 400                                  other_client, other_client_mask,
 401                                  other_client, other_client_mask,
 402                                  policy->other_ts->get_from_port(policy->other_ts),
 403                                  policy->other_ts->get_protocol(policy->other_ts),
 404                                  virtual_ip,
 405                                  this->config->get_hostaccess(this->config) ?
 406                                         "PLUTO_HOST_ACCESS='1' " : "",
 407                                  script);
 408                 free(my_client);
 409                 free(other_client);
 410                 free(virtual_ip);
 411
 412                 DBG3(DBG_CHD, "running updown script: %s", command);
 413                 shell = popen(command, "r");
 414
 415                 if (shell == NULL)
 416                 {
 417                         DBG1(DBG_CHD, "could not execute updown script '%s'", script);
 418                         return;
 419                 }
 420
 421                 while (TRUE)
 422                 {
 423                         char resp[128];
 424
 425                         if (fgets(resp, sizeof(resp), shell) == NULL)
 426                         {
 427                                 if (ferror(shell))
 428                                 {
 429                                         DBG1(DBG_CHD, "error reading output from updown script");
 430                                         return;
 431                                 }
 432                                 else
 433                                 {
 434                                         break;
 435                                 }
 436                         }
 437                         else
 438                         {
 439                                 char *e = resp + strlen(resp);
 440                                 if (e > resp && e[-1] == '\n')
 441                                 {       /* trim trailing '\n' */
 442                                         e[-1] = '\0';
 443                                 }
 444                                 DBG1(DBG_CHD, "updown: %s", resp);
 445                         }
 446                 }
 447                 pclose(shell);
 448         }
 449         iterator->destroy(iterator);
 450 }
 451
 452 /**
 453  * Implements child_sa_t.set_state
 454  */
 455 static void set_state(private_child_sa_t *this, child_sa_state_t state)
 456 {
 457         if (state == CHILD_INSTALLED)
 458         {
 459                 updown(this, TRUE);
 460         }
 461         charon->bus->child_state_change(charon->bus, &this->public, state);
 462         this->state = state;
 463 }
 464
 465 /**
 466  * Allocate SPI for a single proposal
 467  */
 468 static status_t alloc_proposal(private_child_sa_t *this, proposal_t *proposal)
 469 {
 470         protocol_id_t protocol = proposal->get_protocol(proposal);
 471
 472         if (protocol == PROTO_AH)
 473         {
 474                 /* get a new spi for AH, if not already done */
 475                 if (this->alloc_ah_spi == 0)
 476                 {
 477                         if (charon->kernel_interface->get_spi(
 478                                                  charon->kernel_interface,
 479                                                  this->other.addr, this->me.addr,
 480                                                  PROTO_AH, this->reqid,
 481                                                  &this->alloc_ah_spi) != SUCCESS)
 482                         {
 483                                 return FAILED;
 484                         }
 485                 }
 486                 proposal->set_spi(proposal, this->alloc_ah_spi);
 487         }
 488         if (protocol == PROTO_ESP)
 489         {
 490                 /* get a new spi for ESP, if not already done */
 491                 if (this->alloc_esp_spi == 0)
 492                 {
 493                         if (charon->kernel_interface->get_spi(
 494                                                  charon->kernel_interface,
 495                                                  this->other.addr, this->me.addr,
 496                                                  PROTO_ESP, this->reqid,
 497                                                  &this->alloc_esp_spi) != SUCCESS)
 498                         {
 499                                 return FAILED;
 500                         }
 501                 }
 502                 proposal->set_spi(proposal, this->alloc_esp_spi);
 503         }
 504         return SUCCESS;
 505 }
 506
 507
 508 /**
 509  * Implements child_sa_t.alloc
 510  */
 511 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
 512 {
 513         iterator_t *iterator;
 514         proposal_t *proposal;
 515
 516         /* iterator through proposals to update spis */
 517         iterator = proposals->create_iterator(proposals, TRUE);
 518         while(iterator->iterate(iterator, (void**)&proposal))
 519         {
 520                 if (alloc_proposal(this, proposal) != SUCCESS)
 521                 {
 522                         iterator->destroy(iterator);
 523                         return FAILED;
 524                 }
 525         }
 526         iterator->destroy(iterator);
 527         return SUCCESS;
 528 }
 529
 530 static status_t install(private_child_sa_t *this, proposal_t *proposal,
 531                                                 ipsec_mode_t mode, prf_plus_t *prf_plus, bool mine)
 532 {
 533         u_int32_t spi, soft, hard;
 534         host_t *src;
 535         host_t *dst;
 536         status_t status;
 537
 538         this->protocol = proposal->get_protocol(proposal);
 539
 540         /* now we have to decide which spi to use. Use self allocated, if "mine",
 541          * or the one in the proposal, if not "mine" (others). Additionally,
 542          * source and dest host switch depending on the role */
 543         if (mine)
 544         {
 545                 /* if we have allocated SPIs for AH and ESP, we must delete the unused
 546                  * one. */
 547                 if (this->protocol == PROTO_ESP)
 548                 {
 549                         this->me.spi = this->alloc_esp_spi;
 550                         if (this->alloc_ah_spi)
 551                         {
 552                                 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
 553                                                 this->alloc_ah_spi, PROTO_AH);
 554                         }
 555                 }
 556                 else
 557                 {
 558                         this->me.spi = this->alloc_ah_spi;
 559                         if (this->alloc_esp_spi)
 560                         {
 561                                 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
 562                                                 this->alloc_esp_spi, PROTO_ESP);
 563                         }
 564                 }
 565                 spi = this->me.spi;
 566                 dst = this->me.addr;
 567                 src = this->other.addr;
 568         }
 569         else
 570         {
 571                 this->other.spi = proposal->get_spi(proposal);
 572                 spi = this->other.spi;
 573                 src = this->me.addr;
 574                 dst = this->other.addr;
 575         }
 576
 577         DBG2(DBG_CHD, "adding %s %N SA", mine ? "inbound" : "outbound",
 578                  protocol_id_names, this->protocol);
 579
 580         /* select encryption algo */
 581         if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
 582                                                                 &this->enc_alg, &this->enc_size))
 583         {
 584                 DBG2(DBG_CHD, "  using %N for encryption",
 585                          encryption_algorithm_names, this->enc_alg);
 586         }
 587
 588         /* select integrity algo */
 589         if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
 590                                                                 &this->int_alg, &this->int_size))
 591         {
 592                 DBG2(DBG_CHD, "  using %N for integrity",
 593                          integrity_algorithm_names, this->int_alg);
 594         }
 595         soft = this->config->get_lifetime(this->config, TRUE);
 596         hard = this->config->get_lifetime(this->config, FALSE);
 597
 598         /* send SA down to the kernel */
 599         DBG2(DBG_CHD, "  SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
 600
 601         if (this->ipcomp != IPCOMP_NONE)
 602         {
 603                 /* we install an additional IPComp SA */
 604                 u_int32_t cpi = htonl(ntohs(mine ? this->me.cpi : this->other.cpi));
 605                 status = charon->kernel_interface->add_sa(charon->kernel_interface,
 606                                 src, dst, cpi, IPPROTO_COMP, this->reqid, 0, 0,
 607                                 ENCR_UNDEFINED, 0, AUTH_UNDEFINED, 0, NULL, mode,
 608                                 this->ipcomp, FALSE, mine);
 609         }
 610
 611         status = charon->kernel_interface->add_sa(charon->kernel_interface,
 612                                 src, dst, spi, this->protocol, this->reqid, mine ? soft : 0, hard,
 613                                 this->enc_alg, this->enc_size, this->int_alg, this->int_size,
 614                                 prf_plus, mode, IPCOMP_NONE, this->encap, mine);
 615
 616         this->install_time = time(NULL);
 617         this->rekey_time = this->install_time + soft;
 618         return status;
 619 }
 620
 621 static status_t add(private_child_sa_t *this, proposal_t *proposal,
 622                                         ipsec_mode_t mode, prf_plus_t *prf_plus)
 623 {
 624         u_int32_t outbound_spi, inbound_spi;
 625
 626         /* backup outbound spi, as alloc overwrites it */
 627         outbound_spi = proposal->get_spi(proposal);
 628
 629         /* get SPIs inbound SAs */
 630         if (alloc_proposal(this, proposal) != SUCCESS)
 631         {
 632                 return FAILED;
 633         }
 634         inbound_spi = proposal->get_spi(proposal);
 635
 636         /* install inbound SAs */
 637         if (install(this, proposal, mode, prf_plus, TRUE) != SUCCESS)
 638         {
 639                 return FAILED;
 640         }
 641
 642         /* install outbound SAs, restore spi*/
 643         proposal->set_spi(proposal, outbound_spi);
 644         if (install(this, proposal, mode, prf_plus, FALSE) != SUCCESS)
 645         {
 646                 return FAILED;
 647         }
 648         proposal->set_spi(proposal, inbound_spi);
 649
 650         return SUCCESS;
 651 }
 652
 653 static status_t update(private_child_sa_t *this, proposal_t *proposal,
 654                                            ipsec_mode_t mode, prf_plus_t *prf_plus)
 655 {
 656         u_int32_t inbound_spi;
 657
 658         /* backup received spi, as install() overwrites it */
 659         inbound_spi = proposal->get_spi(proposal);
 660
 661         /* install outbound SAs */
 662         if (install(this, proposal, mode, prf_plus, FALSE) != SUCCESS)
 663         {
 664                 return FAILED;
 665         }
 666
 667         /* restore spi */
 668         proposal->set_spi(proposal, inbound_spi);
 669         /* install inbound SAs */
 670         if (install(this, proposal, mode, prf_plus, TRUE) != SUCCESS)
 671         {
 672                 return FAILED;
 673         }
 674
 675         return SUCCESS;
 676 }
 677
 678 static status_t add_policies(private_child_sa_t *this,
 679                                         linked_list_t *my_ts_list, linked_list_t *other_ts_list,
 680                                         ipsec_mode_t mode, protocol_id_t proto)
 681 {
 682         iterator_t *my_iter, *other_iter;
 683         traffic_selector_t *my_ts, *other_ts;
 684         /* use low prio for ROUTED policies */
 685         bool high_prio = (this->state != CHILD_CREATED);
 686
 687         if (this->protocol == PROTO_NONE)
 688         {       /* update if not set yet */
 689                 this->protocol = proto;
 690         }
 691
 692         /* iterate over both lists */
 693         my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
 694         other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
 695         while (my_iter->iterate(my_iter, (void**)&my_ts))
 696         {
 697                 other_iter->reset(other_iter);
 698                 while (other_iter->iterate(other_iter, (void**)&other_ts))
 699                 {
 700                         /* set up policies for every entry in my_ts_list to every entry in other_ts_list */
 701                         status_t status;
 702                         sa_policy_t *policy;
 703
 704                         if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts))
 705                         {
 706                                 DBG2(DBG_CHD,
 707                                          "CHILD_SA policy uses two different IP families - ignored");
 708                                 continue;
 709                         }
 710
 711                         /* only set up policies if protocol matches, or if one is zero (any) */
 712                         if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
 713                                 my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
 714                         {
 715                                 DBG2(DBG_CHD,
 716                                          "CHILD_SA policy uses two different protocols - ignored");
 717                                 continue;
 718                         }
 719
 720                         /* install 3 policies: out, in and forward */
 721                         status = charon->kernel_interface->add_policy(charon->kernel_interface,
 722                                         this->me.addr, this->other.addr, my_ts, other_ts, POLICY_OUT,
 723                                         this->protocol, this->reqid, high_prio, mode, this->ipcomp);
 724
 725                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 726                                         this->other.addr, this->me.addr, other_ts, my_ts, POLICY_IN,
 727                                         this->protocol, this->reqid, high_prio, mode, this->ipcomp);
 728
 729                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 730                                         this->other.addr, this->me.addr, other_ts, my_ts, POLICY_FWD,
 731                                         this->protocol, this->reqid, high_prio, mode, this->ipcomp);
 732
 733                         if (status != SUCCESS)
 734                         {
 735                                 my_iter->destroy(my_iter);
 736                                 other_iter->destroy(other_iter);
 737                                 return status;
 738                         }
 739
 740                         /* store policy to delete/update them later */
 741                         policy = malloc_thing(sa_policy_t);
 742                         policy->my_ts = my_ts->clone(my_ts);
 743                         policy->other_ts = other_ts->clone(other_ts);
 744                         this->policies->insert_last(this->policies, policy);
 745                         /* add to separate list to query them via get_*_traffic_selectors() */
 746                         this->my_ts->insert_last(this->my_ts, policy->my_ts);
 747                         this->other_ts->insert_last(this->other_ts, policy->other_ts);
 748                 }
 749         }
 750         my_iter->destroy(my_iter);
 751         other_iter->destroy(other_iter);
 752
 753         /* switch to routed state if no SAD entry set up */
 754         if (this->state == CHILD_CREATED)
 755         {
 756                 set_state(this, CHILD_ROUTED);
 757         }
 758         /* needed to update hosts */
 759         this->mode = mode;
 760         return SUCCESS;
 761 }
 762
 763 /**
 764  * Implementation of child_sa_t.get_traffic_selectors.
 765  */
 766 static linked_list_t *get_traffic_selectors(private_child_sa_t *this, bool local)
 767 {
 768         if (local)
 769         {
 770                 return this->my_ts;
 771         }
 772         return this->other_ts;
 773 }
 774
 775 /**
 776  * Implementation of child_sa_t.get_use_time
 777  */
 778 static status_t get_use_time(private_child_sa_t *this, bool inbound, time_t *use_time)
 779 {
 780         iterator_t *iterator;
 781         sa_policy_t *policy;
 782         status_t status = FAILED;
 783
 784         *use_time = UNDEFINED_TIME;
 785
 786         iterator = this->policies->create_iterator(this->policies, TRUE);
 787         while (iterator->iterate(iterator, (void**)&policy))
 788         {
 789                 if (inbound)
 790                 {
 791                         time_t in = UNDEFINED_TIME, fwd = UNDEFINED_TIME;
 792
 793                         status = charon->kernel_interface->query_policy(
 794                                                                         charon->kernel_interface,
 795                                                                         policy->other_ts, policy->my_ts,
 796                                                                         POLICY_IN, (u_int32_t*)&in);
 797                         status |= charon->kernel_interface->query_policy(
 798                                                                         charon->kernel_interface,
 799                                                                         policy->other_ts, policy->my_ts,
 800                                                                         POLICY_FWD, (u_int32_t*)&fwd);
 801                         *use_time = max(in, fwd);
 802                 }
 803                 else
 804                 {
 805                         status = charon->kernel_interface->query_policy(
 806                                                                         charon->kernel_interface,
 807                                                                         policy->my_ts, policy->other_ts,
 808                                                                         POLICY_OUT, (u_int32_t*)use_time);
 809                 }
 810         }
 811         iterator->destroy(iterator);
 812         return status;
 813 }
 814
 815 /**
 816  * Implementation of child_sa_t.update_hosts.
 817  */
 818 static status_t update_hosts(private_child_sa_t *this,
 819                                                          host_t *me, host_t *other, bool encap)
 820 {
 821         /* anything changed at all? */
 822         if (me->equals(me, this->me.addr) &&
 823                 other->equals(other, this->other.addr) && this->encap == encap)
 824         {
 825                 return SUCCESS;
 826         }
 827         /* run updown script to remove iptables rules */
 828         updown(this, FALSE);
 829
 830         this->encap = encap;
 831
 832         if (this->ipcomp != IPCOMP_NONE)
 833         {
 834                 /* update our (initator) IPComp SA */
 835                 charon->kernel_interface->update_sa(charon->kernel_interface, htonl(ntohs(this->me.cpi)),
 836                                 IPPROTO_COMP, this->other.addr, this->me.addr, other, me, FALSE);
 837                 /* update his (responder) IPComp SA */
 838                 charon->kernel_interface->update_sa(charon->kernel_interface, htonl(ntohs(this->other.cpi)),
 839                                 IPPROTO_COMP, this->me.addr, this->other.addr, me, other, FALSE);
 840         }
 841
 842         /* update our (initator) SA */
 843         charon->kernel_interface->update_sa(charon->kernel_interface, this->me.spi,
 844                         this->protocol, this->other.addr, this->me.addr, other, me, encap);
 845         /* update his (responder) SA */
 846         charon->kernel_interface->update_sa(charon->kernel_interface, this->other.spi,
 847                         this->protocol, this->me.addr, this->other.addr, me, other, encap);
 848
 849         /* update policies */
 850         if (!me->ip_equals(me, this->me.addr) ||
 851                 !other->ip_equals(other, this->other.addr))
 852         {
 853                 iterator_t *iterator;
 854                 sa_policy_t *policy;
 855
 856                 /* always use high priorities, as hosts getting updated are INSTALLED */
 857                 iterator = this->policies->create_iterator(this->policies, TRUE);
 858                 while (iterator->iterate(iterator, (void**)&policy))
 859                 {
 860                         /* remove old policies first */
 861                         charon->kernel_interface->del_policy(charon->kernel_interface,
 862                                                                 policy->my_ts, policy->other_ts, POLICY_OUT);
 863                         charon->kernel_interface->del_policy(charon->kernel_interface,
 864                                                                 policy->other_ts, policy->my_ts,  POLICY_IN);
 865                         charon->kernel_interface->del_policy(charon->kernel_interface,
 866                                                                 policy->other_ts, policy->my_ts, POLICY_FWD);
 867
 868                         /* check whether we have to update a "dynamic" traffic selector */
 869                         if (!me->ip_equals(me, this->me.addr) &&
 870                                 policy->my_ts->is_host(policy->my_ts, this->me.addr))
 871                         {
 872                                 policy->my_ts->set_address(policy->my_ts, me);
 873                         }
 874                         if (!other->ip_equals(other, this->other.addr) &&
 875                                 policy->other_ts->is_host(policy->other_ts, this->other.addr))
 876                         {
 877                                 policy->other_ts->set_address(policy->other_ts, other);
 878                         }
 879
 880                         /* we reinstall the virtual IP to handle interface roaming
 881                          * correctly */
 882                         if (this->virtual_ip)
 883                         {
 884                                 charon->kernel_interface->del_ip(charon->kernel_interface,
 885                                                                                                  this->virtual_ip);
 886                                 charon->kernel_interface->add_ip(charon->kernel_interface,
 887                                                                                                  this->virtual_ip, me);
 888                         }
 889
 890                         /* reinstall updated policies */
 891                         charon->kernel_interface->add_policy(charon->kernel_interface,
 892                                         me, other, policy->my_ts, policy->other_ts, POLICY_OUT,
 893                                         this->protocol, this->reqid, TRUE, this->mode, this->ipcomp);
 894                         charon->kernel_interface->add_policy(charon->kernel_interface,
 895                                         other, me, policy->other_ts, policy->my_ts, POLICY_IN,
 896                                         this->protocol, this->reqid, TRUE, this->mode, this->ipcomp);
 897                         charon->kernel_interface->add_policy(charon->kernel_interface,
 898                                         other, me, policy->other_ts, policy->my_ts, POLICY_FWD,
 899                                         this->protocol, this->reqid, TRUE, this->mode, this->ipcomp);
 900                 }
 901                 iterator->destroy(iterator);
 902         }
 903
 904         /* apply hosts */
 905         if (!me->equals(me, this->me.addr))
 906         {
 907                 this->me.addr->destroy(this->me.addr);
 908                 this->me.addr = me->clone(me);
 909         }
 910         if (!other->equals(other, this->other.addr))
 911         {
 912                 this->other.addr->destroy(this->other.addr);
 913                 this->other.addr = other->clone(other);
 914         }
 915
 916         /* install new iptables rules */
 917         updown(this, TRUE);
 918
 919         return SUCCESS;
 920 }
 921
 922 /**
 923  * Implementation of child_sa_t.set_virtual_ip.
 924  */
 925 static void set_virtual_ip(private_child_sa_t *this, host_t *ip)
 926 {
 927         this->virtual_ip = ip->clone(ip);
 928 }
 929
 930 /**
 931  * Implementation of child_sa_t.activate_ipcomp.
 932  */
 933 static void activate_ipcomp(private_child_sa_t *this, ipcomp_transform_t ipcomp,
 934                 u_int16_t other_cpi)
 935 {
 936         this->ipcomp = ipcomp;
 937         this->other.cpi = other_cpi;
 938 }
 939
 940 /**
 941  * Implementation of child_sa_t.allocate_cpi.
 942  */
 943 static u_int16_t allocate_cpi(private_child_sa_t *this)
 944 {
 945         if (!this->cpi_allocated)
 946         {
 947                 charon->kernel_interface->get_cpi(charon->kernel_interface,
 948                         this->other.addr, this->me.addr, this->reqid, &this->me.cpi);
 949                 this->cpi_allocated = TRUE;
 950         }
 951         return this->me.cpi;
 952 }
 953
 954 /**
 955  * Implementation of child_sa_t.destroy.
 956  */
 957 static void destroy(private_child_sa_t *this)
 958 {
 959         sa_policy_t *policy;
 960
 961         if (this->state == CHILD_DELETING || this->state == CHILD_INSTALLED)
 962         {
 963                 updown(this, FALSE);
 964         }
 965
 966         set_state(this, CHILD_DESTROYING);
 967
 968         /* delete SAs in the kernel, if they are set up */
 969         if (this->me.spi)
 970         {
 971                 charon->kernel_interface->del_sa(charon->kernel_interface,
 972                                                                                  this->me.addr, this->me.spi, this->protocol);
 973         }
 974         if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi)
 975         {
 976                 charon->kernel_interface->del_sa(charon->kernel_interface,
 977                                                                                  this->me.addr, this->alloc_esp_spi, PROTO_ESP);
 978         }
 979         if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi)
 980         {
 981                 charon->kernel_interface->del_sa(charon->kernel_interface,
 982                                                                                  this->me.addr, this->alloc_ah_spi, PROTO_AH);
 983         }
 984         if (this->other.spi)
 985         {
 986                 charon->kernel_interface->del_sa(charon->kernel_interface,
 987                                                                                  this->other.addr, this->other.spi, this->protocol);
 988         }
 989         if (this->me.cpi)
 990         {
 991                 charon->kernel_interface->del_sa(charon->kernel_interface,
 992                                                         this->me.addr, htonl(ntohs(this->me.cpi)), IPPROTO_COMP);
 993         }
 994         if (this->other.cpi)
 995         {
 996                 charon->kernel_interface->del_sa(charon->kernel_interface,
 997                                                         this->other.addr, htonl(ntohs(this->other.cpi)), IPPROTO_COMP);
 998         }
 999
1000         /* delete all policies in the kernel */
1001         while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
1002         {
1003                 /* let rekeyed policies, as they are used by another child_sa */
1004                 charon->kernel_interface->del_policy(charon->kernel_interface,
1005                                                                                          policy->my_ts, policy->other_ts,
1006                                                                                          POLICY_OUT);
1007
1008                 charon->kernel_interface->del_policy(charon->kernel_interface,
1009                                                                                          policy->other_ts, policy->my_ts,
1010                                                                                          POLICY_IN);
1011
1012                 charon->kernel_interface->del_policy(charon->kernel_interface,
1013                                                                                          policy->other_ts, policy->my_ts,
1014                                                                                          POLICY_FWD);
1015                 policy->my_ts->destroy(policy->my_ts);
1016                 policy->other_ts->destroy(policy->other_ts);
1017                 free(policy);
1018         }
1019         this->policies->destroy(this->policies);
1020
1021         this->my_ts->destroy(this->my_ts);
1022         this->other_ts->destroy(this->other_ts);
1023         this->me.addr->destroy(this->me.addr);
1024         this->other.addr->destroy(this->other.addr);
1025         this->me.id->destroy(this->me.id);
1026         this->other.id->destroy(this->other.id);
1027         this->config->destroy(this->config);
1028         free(this->iface);
1029         DESTROY_IF(this->virtual_ip);
1030         free(this);
1031 }
1032
1033 /*
1034  * Described in header.
1035  */
1036 child_sa_t * child_sa_create(host_t *me, host_t* other,
1037                                                          identification_t *my_id, identification_t *other_id,
1038                                                          child_cfg_t *config, u_int32_t rekey, bool encap)
1039 {
1040         static u_int32_t reqid = 0;
1041         private_child_sa_t *this = malloc_thing(private_child_sa_t);
1042
1043         /* public functions */
1044         this->public.get_name = (char*(*)(child_sa_t*))get_name;
1045         this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
1046         this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
1047         this->public.get_cpi = (u_int16_t(*)(child_sa_t*, bool))get_cpi;
1048         this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
1049         this->public.get_stats = (void(*)(child_sa_t*, ipsec_mode_t*,encryption_algorithm_t*,size_t*,integrity_algorithm_t*,size_t*,u_int32_t*,u_int32_t*,u_int32_t*,u_int32_t*))get_stats;
1050         this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
1051         this->public.add = (status_t(*)(child_sa_t*,proposal_t*,ipsec_mode_t,prf_plus_t*))add;
1052         this->public.update = (status_t(*)(child_sa_t*,proposal_t*,ipsec_mode_t,prf_plus_t*))update;
1053         this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,bool))update_hosts;
1054         this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*,ipsec_mode_t,protocol_id_t))add_policies;
1055         this->public.get_traffic_selectors = (linked_list_t*(*)(child_sa_t*,bool))get_traffic_selectors;
1056         this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time;
1057         this->public.set_state = (void(*)(child_sa_t*,child_sa_state_t))set_state;
1058         this->public.get_state = (child_sa_state_t(*)(child_sa_t*))get_state;
1059         this->public.get_config = (child_cfg_t*(*)(child_sa_t*))get_config;
1060         this->public.activate_ipcomp = (void(*)(child_sa_t*,ipcomp_transform_t,u_int16_t))activate_ipcomp;
1061         this->public.allocate_cpi = (u_int16_t(*)(child_sa_t*))allocate_cpi;
1062         this->public.set_virtual_ip = (void(*)(child_sa_t*,host_t*))set_virtual_ip;
1063         this->public.destroy = (void(*)(child_sa_t*))destroy;
1064
1065         /* private data */
1066         this->me.addr = me->clone(me);
1067         this->other.addr = other->clone(other);
1068         this->me.id = my_id->clone(my_id);
1069         this->other.id = other_id->clone(other_id);
1070         this->me.spi = 0;
1071         this->me.cpi = 0;
1072         this->other.spi = 0;
1073         this->other.cpi = 0;
1074         this->alloc_ah_spi = 0;
1075         this->alloc_esp_spi = 0;
1076         this->encap = encap;
1077         this->cpi_allocated = FALSE;
1078         this->ipcomp = IPCOMP_NONE;
1079         this->state = CHILD_CREATED;
1080         /* reuse old reqid if we are rekeying an existing CHILD_SA */
1081         this->reqid = rekey ? rekey : ++reqid;
1082         this->enc_alg = ENCR_UNDEFINED;
1083         this->enc_size = 0;
1084         this->int_alg = AUTH_UNDEFINED;
1085         this->int_size = 0;
1086         this->policies = linked_list_create();
1087         this->my_ts = linked_list_create();
1088         this->other_ts = linked_list_create();
1089         this->protocol = PROTO_NONE;
1090         this->mode = MODE_TUNNEL;
1091         this->virtual_ip = NULL;
1092         this->iface = NULL;
1093         this->config = config;
1094         config->get_ref(config);
1095
1096         return &this->public;
1097 }