fd144ca7096fedad9fb31a70370da19538fd92ce
[strongswan.git] / src / charon / sa / child_sa.c
1 /**
2 * @file child_sa.c
3 *
4 * @brief Implementation of child_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005 Jan Hutter, Martin Willi
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #include <netdb.h>
25
26 #include "child_sa.h"
27
28 #include <daemon.h>
29
30
31 typedef struct sa_policy_t sa_policy_t;
32
33 /**
34 * Struct used to store information for a policy. This
35 * is needed since we must provide all this information
36 * for deleting a policy...
37 */
38 struct sa_policy_t {
39
40 struct {
41 /** subnet address behind peer peer */
42 host_t *net;
43 /** netmask used for net */
44 u_int8_t net_mask;
45 } me, other;
46
47 /**
48 * Protocol for this policy, such as TCP/UDP/ICMP...
49 */
50 int upper_proto;
51 };
52
53 typedef struct private_child_sa_t private_child_sa_t;
54
55 /**
56 * Private data of a child_sa_t object.
57 */
58 struct private_child_sa_t {
59 /**
60 * Public interface of child_sa_t.
61 */
62 child_sa_t public;
63
64 struct {
65 /** address of peer */
66 host_t *addr;
67 /** actual used SPI, 0 if unused */
68 u_int32_t spi;
69 } me, other;
70
71 /**
72 * Allocated SPI for a ESP proposal candidates
73 */
74 u_int32_t alloc_esp_spi;
75
76 /**
77 * Allocated SPI for a AH proposal candidates
78 */
79 u_int32_t alloc_ah_spi;
80
81 /**
82 * Protocol used to protect this SA, ESP|AH
83 */
84 protocol_id_t protocol;
85
86 /**
87 * List containing sa_policy_t objects
88 */
89 linked_list_t *policies;
90
91 /**
92 * reqid used for this child_sa
93 */
94 u_int32_t reqid;
95
96 /**
97 * time, on which SA was installed
98 */
99 time_t install_time;
100
101 /**
102 * Lifetime before rekeying
103 */
104 u_int32_t soft_lifetime;
105
106 /**
107 * Lifetime before delete
108 */
109 u_int32_t hard_lifetime;
110
111 /**
112 * has this CHILD_SA been rekeyed?
113 */
114 bool rekeyed;
115
116 /**
117 * Specifies if NAT traversal is used
118 */
119 bool use_natt;
120
121 /**
122 * CHILD_SAs own logger
123 */
124 logger_t *logger;
125 };
126
127 /**
128 * Implements child_sa_t.get_reqid
129 */
130 static u_int32_t get_reqid(private_child_sa_t *this)
131 {
132 return this->reqid;
133 }
134
135 /**
136 * Implements child_sa_t.get_spi
137 */
138 u_int32_t get_spi(private_child_sa_t *this, bool inbound)
139 {
140 if (inbound)
141 {
142 return this->me.spi;
143 }
144 return this->other.spi;
145 }
146
147 /**
148 * Implements child_sa_t.get_protocol
149 */
150 protocol_id_t get_protocol(private_child_sa_t *this)
151 {
152 return this->protocol;
153 }
154
155 /**
156 * Allocate SPI for a single proposal
157 */
158 static status_t alloc_proposal(private_child_sa_t *this, proposal_t *proposal)
159 {
160 protocol_id_t protocol = proposal->get_protocol(proposal);
161
162 if (protocol == PROTO_AH)
163 {
164 /* get a new spi for AH, if not already done */
165 if (this->alloc_ah_spi == 0)
166 {
167 if (charon->kernel_interface->get_spi(
168 charon->kernel_interface,
169 this->other.addr, this->me.addr,
170 PROTO_AH, this->reqid,
171 &this->alloc_ah_spi) != SUCCESS)
172 {
173 return FAILED;
174 }
175 }
176 proposal->set_spi(proposal, this->alloc_ah_spi);
177 }
178 if (protocol == PROTO_ESP)
179 {
180 /* get a new spi for ESP, if not already done */
181 if (this->alloc_esp_spi == 0)
182 {
183 if (charon->kernel_interface->get_spi(
184 charon->kernel_interface,
185 this->other.addr, this->me.addr,
186 PROTO_ESP, this->reqid,
187 &this->alloc_esp_spi) != SUCCESS)
188 {
189 return FAILED;
190 }
191 }
192 proposal->set_spi(proposal, this->alloc_esp_spi);
193 }
194 return SUCCESS;
195 }
196
197
198 /**
199 * Implements child_sa_t.alloc
200 */
201 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
202 {
203 iterator_t *iterator;
204 proposal_t *proposal;
205
206 /* iterator through proposals to update spis */
207 iterator = proposals->create_iterator(proposals, TRUE);
208 while(iterator->has_next(iterator))
209 {
210 iterator->current(iterator, (void**)&proposal);
211 if (alloc_proposal(this, proposal) != SUCCESS)
212 {
213 iterator->destroy(iterator);
214 return FAILED;
215 }
216 }
217 iterator->destroy(iterator);
218 return SUCCESS;
219 }
220
221 static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
222 {
223 u_int32_t spi;
224 algorithm_t *enc_algo, *int_algo;
225 algorithm_t enc_algo_none = {ENCR_UNDEFINED, 0};
226 algorithm_t int_algo_none = {AUTH_UNDEFINED, 0};
227 host_t *src;
228 host_t *dst;
229 natt_conf_t *natt;
230 status_t status;
231
232 this->protocol = proposal->get_protocol(proposal);
233
234 /* now we have to decide which spi to use. Use self allocated, if "mine",
235 * or the one in the proposal, if not "mine" (others). Additionally,
236 * source and dest host switch depending on the role */
237 if (mine)
238 {
239 /* if we have allocated SPIs for AH and ESP, we must delete the unused
240 * one. */
241 if (this->protocol == PROTO_ESP)
242 {
243 this->me.spi = this->alloc_esp_spi;
244 if (this->alloc_ah_spi)
245 {
246 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
247 this->alloc_ah_spi, PROTO_AH);
248 }
249 }
250 else
251 {
252 this->me.spi = this->alloc_ah_spi;
253 if (this->alloc_esp_spi)
254 {
255 charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr,
256 this->alloc_esp_spi, PROTO_ESP);
257 }
258 }
259 spi = this->me.spi;
260 dst = this->me.addr;
261 src = this->other.addr;
262 }
263 else
264 {
265 this->other.spi = proposal->get_spi(proposal);
266 spi = this->other.spi;
267 src = this->me.addr;
268 dst = this->other.addr;
269 }
270
271 this->logger->log(this->logger, CONTROL|LEVEL1, "adding %s %s SA",
272 mine ? "inbound" : "outbound",
273 mapping_find(protocol_id_m, this->protocol));
274
275 /* select encryption algo */
276 if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
277 {
278 this->logger->log(this->logger, CONTROL|LEVEL2, " using %s for encryption",
279 mapping_find(encryption_algorithm_m, enc_algo->algorithm));
280 }
281 else
282 {
283 enc_algo = &enc_algo_none;
284 }
285
286 /* select integrity algo */
287 if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
288 {
289 this->logger->log(this->logger, CONTROL|LEVEL2, " using %s for integrity",
290 mapping_find(integrity_algorithm_m, int_algo->algorithm));
291 }
292 else
293 {
294 int_algo = &int_algo_none;
295 }
296
297 /* setup nat-t */
298 if (this->use_natt)
299 {
300 natt = alloca(sizeof(natt_conf_t));
301 natt->sport = src->get_port(src);
302 natt->dport = dst->get_port(dst);
303 }
304 else
305 {
306 natt = NULL;
307 }
308
309
310 /* send SA down to the kernel */
311 this->logger->log(this->logger, CONTROL|LEVEL2,
312 " SPI 0x%.8x, src %s dst %s",
313 ntohl(spi), src->get_address(src), dst->get_address(dst));
314 status = charon->kernel_interface->add_sa(charon->kernel_interface,
315 src, dst,
316 spi, this->protocol,
317 this->reqid,
318 mine ? 0 : this->soft_lifetime,
319 this->hard_lifetime,
320 enc_algo, int_algo,
321 prf_plus, natt, mine);
322
323 this->install_time = time(NULL);
324
325 return status;
326 }
327
328 static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
329 {
330 u_int32_t outbound_spi, inbound_spi;
331
332 /* backup outbound spi, as alloc overwrites it */
333 outbound_spi = proposal->get_spi(proposal);
334
335 /* get SPIs inbound SAs */
336 if (alloc_proposal(this, proposal) != SUCCESS)
337 {
338 return FAILED;
339 }
340 inbound_spi = proposal->get_spi(proposal);
341
342 /* install inbound SAs */
343 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
344 {
345 return FAILED;
346 }
347
348 /* install outbound SAs, restore spi*/
349 proposal->set_spi(proposal, outbound_spi);
350 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
351 {
352 return FAILED;
353 }
354 proposal->set_spi(proposal, inbound_spi);
355
356 return SUCCESS;
357 }
358
359 static status_t update(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
360 {
361 u_int32_t inbound_spi;
362
363 /* backup received spi, as install() overwrites it */
364 inbound_spi = proposal->get_spi(proposal);
365
366 /* install outbound SAs */
367 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
368 {
369 return FAILED;
370 }
371
372 /* restore spi */
373 proposal->set_spi(proposal, inbound_spi);
374 /* install inbound SAs */
375 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
376 {
377 return FAILED;
378 }
379
380 return SUCCESS;
381 }
382
383 static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list, linked_list_t *other_ts_list)
384 {
385 iterator_t *my_iter, *other_iter;
386 traffic_selector_t *my_ts, *other_ts;
387
388 /* iterate over both lists */
389 my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
390 other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
391 while (my_iter->has_next(my_iter))
392 {
393 my_iter->current(my_iter, (void**)&my_ts);
394 other_iter->reset(other_iter);
395 while (other_iter->has_next(other_iter))
396 {
397 /* set up policies for every entry in my_ts_list to every entry in other_ts_list */
398 int family;
399 chunk_t from_addr;
400 u_int16_t from_port, to_port;
401 sa_policy_t *policy;
402 status_t status;
403
404 other_iter->current(other_iter, (void**)&other_ts);
405
406 /* only set up policies if protocol matches, or if one is zero (any) */
407 if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
408 my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
409 {
410 this->logger->log(this->logger, ERROR,
411 "CHILD_SA policy uses two different protocols, ignored");
412 continue;
413 }
414 policy = malloc_thing(sa_policy_t);
415 policy->upper_proto = max(my_ts->get_protocol(my_ts), other_ts->get_protocol(other_ts));
416
417 /* calculate net and ports for local side */
418 family = my_ts->get_type(my_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
419 from_addr = my_ts->get_from_address(my_ts);
420 from_port = my_ts->get_from_port(my_ts);
421 to_port = my_ts->get_to_port(my_ts);
422 from_port = (from_port != to_port) ? 0 : from_port;
423 policy->me.net = host_create_from_chunk(family, from_addr, from_port);
424 policy->me.net_mask = my_ts->get_netmask(my_ts);
425 chunk_free(&from_addr);
426
427 /* calculate net and ports for remote side */
428 family = other_ts->get_type(other_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
429 from_addr = other_ts->get_from_address(other_ts);
430 from_port = other_ts->get_from_port(other_ts);
431 to_port = other_ts->get_to_port(other_ts);
432 from_port = (from_port != to_port) ? 0 : from_port;
433 policy->other.net = host_create_from_chunk(family, from_addr, from_port);
434 policy->other.net_mask = other_ts->get_netmask(other_ts);
435 chunk_free(&from_addr);
436
437 /* install 3 policies: out, in and forward */
438 status = charon->kernel_interface->add_policy(charon->kernel_interface,
439 this->me.addr, this->other.addr,
440 policy->me.net, policy->other.net,
441 policy->me.net_mask, policy->other.net_mask,
442 XFRM_POLICY_OUT, policy->upper_proto,
443 this->protocol, this->reqid);
444
445 status |= charon->kernel_interface->add_policy(charon->kernel_interface,
446 this->other.addr, this->me.addr,
447 policy->other.net, policy->me.net,
448 policy->other.net_mask, policy->me.net_mask,
449 XFRM_POLICY_IN, policy->upper_proto,
450 this->protocol, this->reqid);
451
452 status |= charon->kernel_interface->add_policy(charon->kernel_interface,
453 this->other.addr, this->me.addr,
454 policy->other.net, policy->me.net,
455 policy->other.net_mask, policy->me.net_mask,
456 XFRM_POLICY_FWD, policy->upper_proto,
457 this->protocol, this->reqid);
458
459 if (status != SUCCESS)
460 {
461 my_iter->destroy(my_iter);
462 other_iter->destroy(other_iter);
463 policy->me.net->destroy(policy->me.net);
464 policy->other.net->destroy(policy->other.net);
465 free(policy);
466 return status;
467 }
468
469 /* add it to the policy list, since we want to know which policies we own */
470 this->policies->insert_last(this->policies, policy);
471 }
472 }
473 my_iter->destroy(my_iter);
474 other_iter->destroy(other_iter);
475 return SUCCESS;
476 }
477
478 /**
479 * Implementation of child_sa_t.set_rekeyed.
480 */
481 static void set_rekeyed(private_child_sa_t *this)
482 {
483 this->rekeyed = TRUE;
484 }
485
486 /**
487 * Implementation of child_sa_t.get_use_time
488 */
489 static status_t get_use_time(private_child_sa_t *this, bool inbound, time_t *use_time)
490 {
491 iterator_t *iterator;
492 sa_policy_t *policy;
493 struct protoent *proto;
494 char proto_buf[8] = "";
495 char *proto_name = proto_buf;
496 status_t status;
497
498 *use_time = UNDEFINED_TIME;
499
500 iterator = this->policies->create_iterator(this->policies, TRUE);
501 while (iterator->iterate(iterator, (void**)&policy))
502 {
503 time_t ut;
504
505 if (policy->upper_proto)
506 {
507 proto = getprotobynumber(policy->upper_proto);
508 if (proto)
509 {
510 proto_name = proto->p_name;
511 }
512 else
513 {
514 snprintf(proto_buf, sizeof(proto_buf), "<%d>", policy->upper_proto);
515 }
516 }
517
518 this->logger->log(this->logger, CONTROL|LEVEL1,
519 "querying policy: %s/%d==%s==%s/%d",
520 policy->me.net->get_address(policy->me.net), policy->me.net_mask,
521 proto_name,
522 policy->other.net->get_address(policy->other.net), policy->other.net_mask);
523
524 if (inbound)
525 {
526 status = charon->kernel_interface->query_policy(charon->kernel_interface,
527 this->other.addr, this->me.addr,
528 policy->other.net, policy->me.net,
529 policy->other.net_mask, policy->me.net_mask,
530 XFRM_POLICY_IN, policy->upper_proto,
531 &ut);
532
533 /* also check forward policy in tunnel mode */
534 if (status == SUCCESS /*&& mode == TUNNEL XXX */)
535 {
536 time_t fwd;
537
538 status = charon->kernel_interface->query_policy(charon->kernel_interface,
539 this->other.addr, this->me.addr,
540 policy->other.net, policy->me.net,
541 policy->other.net_mask, policy->me.net_mask,
542 XFRM_POLICY_FWD, policy->upper_proto,
543 &fwd);
544
545 if (status == SUCCESS)
546 {
547 ut = max(ut, fwd);
548 }
549 }
550 }
551 else
552 {
553 status = charon->kernel_interface->query_policy(charon->kernel_interface,
554 this->me.addr, this->other.addr,
555 policy->me.net, policy->other.net,
556 policy->me.net_mask, policy->other.net_mask,
557 XFRM_POLICY_OUT, policy->upper_proto,
558 &ut);
559 }
560
561 if (status != SUCCESS)
562 {
563 iterator->destroy(iterator);
564 return FAILED;
565 }
566
567 *use_time = max(*use_time, ut);
568 }
569 iterator->destroy(iterator);
570
571 return SUCCESS;
572 }
573
574 /**
575 * Implementation of child_sa_t.log_status.
576 */
577 static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
578 {
579 iterator_t *iterator;
580 char use_in_str[12] = "unused";
581 char use_out_str[12] = "unused";
582 char rekey_str[12] = "disabled";
583 time_t use_in, use_out, now, rekeying;
584
585 if (logger == NULL)
586 {
587 logger = this->logger;
588 }
589 now = time(NULL);
590 get_use_time(this, TRUE, &use_in);
591 if (use_in)
592 {
593 snprintf(use_in_str, sizeof(use_in_str), "%ds", (int)(now - use_in));
594 }
595 get_use_time(this, FALSE, &use_out);
596 if (use_out)
597 {
598 snprintf(use_out_str, sizeof(use_out_str), "%ds", (int)(now - use_out));
599 }
600 if (this->soft_lifetime)
601 {
602 rekeying = this->soft_lifetime - (now - this->install_time);
603 snprintf(rekey_str, sizeof(rekey_str), "%ds", (int)rekeying);
604 }
605
606 logger->log(logger, CONTROL|LEVEL1,
607 " \"%s\": using %s, SPIs (in/out): 0x%x/0x%x, reqid: %d",
608 name,
609 this->protocol == PROTO_ESP ? "ESP" : "AH",
610 htonl(this->me.spi), htonl(this->other.spi),
611 this->reqid);
612
613 logger->log(logger, CONTROL|LEVEL1,
614 " \"%s\": rekeying: %s, last traffic (in/out): %s/%s",
615 name, rekey_str, use_in_str, use_out_str);
616
617 iterator = this->policies->create_iterator(this->policies, TRUE);
618 while (iterator->has_next(iterator))
619 {
620 sa_policy_t *policy;
621 struct protoent *proto;
622 char proto_str[8] = "";
623 char *proto_name = proto_str;
624 char my_net_str[8] = "";
625 char other_net_str[8] = "";
626 char my_port_str[8] = "";
627 char other_port_str[8] = "";
628 u_int16_t my_port, other_port;
629
630 iterator->current(iterator, (void**)&policy);
631
632 if (policy->upper_proto)
633 {
634 proto = getprotobynumber(policy->upper_proto);
635 if (proto)
636 {
637 proto_name = proto->p_name;
638 }
639 else
640 {
641 snprintf(proto_str, sizeof(proto_str), "%d", policy->upper_proto);
642 }
643 }
644 if (policy->me.net_mask != 32)
645 {
646 snprintf(my_net_str, sizeof(my_net_str), "/%d", policy->me.net_mask);
647 }
648 if (policy->other.net_mask != 32)
649 {
650 snprintf(other_net_str, sizeof(other_net_str), "/%d", policy->other.net_mask);
651 }
652 my_port = policy->me.net->get_port(policy->me.net);
653 other_port = policy->other.net->get_port(policy->other.net);
654 if (my_port)
655 {
656 snprintf(my_port_str, sizeof(my_port_str), ":%d", my_port);
657 }
658 if (other_port)
659 {
660 snprintf(other_port_str, sizeof(other_port_str), ":%d", other_port);
661 }
662
663 logger->log(logger, CONTROL, " \"%s\": %s%s%s==%s==%s%s%s",
664 name,
665 policy->me.net->get_address(policy->me.net),
666 my_port_str, my_net_str,
667 proto_name,
668 policy->other.net->get_address(policy->other.net),
669 other_port_str, other_net_str);
670 }
671 iterator->destroy(iterator);
672 }
673
674 /**
675 * Update the host adress/port of a SA
676 */
677 static status_t update_sa_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other,
678 int my_changes, int other_changes, bool mine)
679 {
680 host_t *src, *dst, *new_src, *new_dst;
681 int src_changes, dst_changes;
682 status_t status;
683 u_int32_t spi;
684
685 if (mine)
686 {
687 src = this->me.addr;
688 dst = this->other.addr;
689 new_src = new_me;
690 new_dst = new_other;
691 src_changes = my_changes;
692 dst_changes = other_changes;
693 spi = this->me.spi;
694 }
695 else
696 {
697 src = this->other.addr;
698 dst = this->me.addr;
699 new_src = new_other;
700 new_dst = new_me;
701 src_changes = other_changes;
702 dst_changes = my_changes;
703 spi = this->other.spi;
704 }
705
706 this->logger->log(this->logger, CONTROL|LEVEL1,
707 "updating %s SA 0x%x, from %s:%d..%s:%d to %s:%d..%s:%d",
708 mapping_find(protocol_id_m, this->protocol), ntohl(spi),
709 src->get_address(src), src->get_port(src),
710 dst->get_address(dst), dst->get_port(dst),
711 new_src->get_address(new_src), new_src->get_port(new_src),
712 new_dst->get_address(new_dst), new_dst->get_port(new_dst));
713
714 status = charon->kernel_interface->update_sa_hosts(
715 charon->kernel_interface,
716 src, dst, new_src, new_dst,
717 src_changes, dst_changes,
718 spi, this->protocol);
719
720 if (status != SUCCESS)
721 {
722 return FAILED;
723 }
724 return SUCCESS;
725 }
726
727 /**
728 * Update the host adress/port of a policy
729 */
730 static status_t update_policy_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other)
731 {
732 iterator_t *iterator;
733 sa_policy_t *policy;
734 status_t status;
735
736 iterator = this->policies->create_iterator(this->policies, TRUE);
737 while (iterator->iterate(iterator, (void**)&policy))
738 {
739 this->logger->log(this->logger, CONTROL|LEVEL1,
740 "updating policy: %s/%d====%s/%d",
741 policy->me.net->get_address(policy->me.net), policy->me.net_mask,
742 policy->other.net->get_address(policy->other.net), policy->other.net_mask);
743
744 status = charon->kernel_interface->add_policy(
745 charon->kernel_interface,
746 new_me, new_other,
747 policy->me.net, policy->other.net,
748 policy->me.net_mask, policy->other.net_mask,
749 XFRM_POLICY_OUT, policy->upper_proto,
750 this->protocol, this->reqid);
751
752 status |= charon->kernel_interface->add_policy(
753 charon->kernel_interface,
754 new_other, new_me,
755 policy->other.net, policy->me.net,
756 policy->other.net_mask, policy->me.net_mask,
757 XFRM_POLICY_IN, policy->upper_proto,
758 this->protocol, this->reqid);
759
760 status |= charon->kernel_interface->add_policy(
761 charon->kernel_interface,
762 new_other, new_me,
763 policy->other.net, policy->me.net,
764 policy->other.net_mask, policy->me.net_mask,
765 XFRM_POLICY_FWD, policy->upper_proto,
766 this->protocol, this->reqid);
767
768 if (status != SUCCESS)
769 {
770 iterator->destroy(iterator);
771 return FAILED;
772 }
773 }
774 iterator->destroy(iterator);
775
776 return SUCCESS;
777 }
778
779 /**
780 * Implementation of child_sa_t.update_hosts.
781 */
782 static status_t update_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other,
783 int my_changes, int other_changes)
784 {
785 if (!my_changes || !other_changes)
786 {
787 return SUCCESS;
788 }
789
790 /* update our (initator) SAs */
791 if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, TRUE) != SUCCESS)
792 {
793 return FAILED;
794 }
795
796 /* update his (responder) SAs */
797 if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, FALSE) != SUCCESS)
798 {
799 return FAILED;
800 }
801
802 /* update policies */
803 if (my_changes & HOST_DIFF_ADDR || other_changes & HOST_DIFF_ADDR)
804 {
805 if (update_policy_hosts(this, new_me, new_other) != SUCCESS)
806 {
807 return FAILED;
808 }
809 }
810
811 /* update hosts */
812 if (my_changes)
813 {
814 this->me.addr->destroy(this->me.addr);
815 this->me.addr = new_me->clone(new_me);
816 }
817
818 if (other_changes)
819 {
820 this->other.addr->destroy(this->other.addr);
821 this->other.addr = new_other->clone(new_other);
822 }
823
824 return SUCCESS;
825 }
826
827 /**
828 * Implementation of child_sa_t.destroy.
829 */
830 static void destroy(private_child_sa_t *this)
831 {
832 sa_policy_t *policy;
833
834 /* delete SAs in the kernel, if they are set up */
835 if (this->me.spi)
836 {
837 charon->kernel_interface->del_sa(charon->kernel_interface,
838 this->me.addr, this->me.spi, this->protocol);
839 }
840 if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi)
841 {
842 charon->kernel_interface->del_sa(charon->kernel_interface,
843 this->me.addr, this->alloc_esp_spi, PROTO_ESP);
844 }
845 if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi)
846 {
847 charon->kernel_interface->del_sa(charon->kernel_interface,
848 this->me.addr, this->alloc_ah_spi, PROTO_AH);
849 }
850 if (this->other.spi)
851 {
852 charon->kernel_interface->del_sa(charon->kernel_interface,
853 this->other.addr, this->other.spi, this->protocol);
854 }
855
856 /* delete all policies in the kernel */
857 while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
858 {
859 if (!this->rekeyed)
860 {
861 /* let rekeyed policies, as they are used by another child_sa */
862 charon->kernel_interface->del_policy(charon->kernel_interface,
863 this->me.addr, this->other.addr,
864 policy->me.net, policy->other.net,
865 policy->me.net_mask, policy->other.net_mask,
866 XFRM_POLICY_OUT, policy->upper_proto);
867
868 charon->kernel_interface->del_policy(charon->kernel_interface,
869 this->other.addr, this->me.addr,
870 policy->other.net, policy->me.net,
871 policy->other.net_mask, policy->me.net_mask,
872 XFRM_POLICY_IN, policy->upper_proto);
873
874 charon->kernel_interface->del_policy(charon->kernel_interface,
875 this->other.addr, this->me.addr,
876 policy->other.net, policy->me.net,
877 policy->other.net_mask, policy->me.net_mask,
878 XFRM_POLICY_FWD, policy->upper_proto);
879 }
880 policy->me.net->destroy(policy->me.net);
881 policy->other.net->destroy(policy->other.net);
882 free(policy);
883 }
884 this->policies->destroy(this->policies);
885
886 free(this);
887 }
888
889 /*
890 * Described in header.
891 */
892 child_sa_t * child_sa_create(u_int32_t rekey, host_t *me, host_t* other,
893 u_int32_t soft_lifetime, u_int32_t hard_lifetime,
894 bool use_natt)
895 {
896 static u_int32_t reqid = REQID_START;
897 private_child_sa_t *this = malloc_thing(private_child_sa_t);
898
899 /* public functions */
900 this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
901 this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
902 this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
903 this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
904 this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
905 this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
906 this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,int,int))update_hosts;
907 this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
908 this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time;
909 this->public.set_rekeyed = (void (*)(child_sa_t*))set_rekeyed;
910 this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
911 this->public.destroy = (void(*)(child_sa_t*))destroy;
912
913 /* private data */
914 this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
915 this->me.addr = me;
916 this->other.addr = other;
917 this->me.spi = 0;
918 this->other.spi = 0;
919 this->alloc_ah_spi = 0;
920 this->alloc_esp_spi = 0;
921 this->use_natt = use_natt;
922 this->soft_lifetime = soft_lifetime;
923 this->hard_lifetime = hard_lifetime;
924 /* reuse old reqid if we are rekeying an existing CHILD_SA */
925 this->reqid = rekey ? rekey : ++reqid;
926 this->policies = linked_list_create();
927 this->protocol = PROTO_NONE;
928 this->rekeyed = FALSE;
929
930 return &this->public;
931 }