old child_sa gets deleted after rekeying
[strongswan.git] / src / charon / sa / child_sa.c
1 /**
2 * @file child_sa.c
3 *
4 * @brief Implementation of child_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <netdb.h>
24
25 #include "child_sa.h"
26
27 #include <daemon.h>
28
29
30 typedef struct sa_policy_t sa_policy_t;
31
32 /**
33 * Struct used to store information for a policy. This
34 * is needed since we must provide all this information
35 * for deleting a policy...
36 */
37 struct sa_policy_t {
38
39 struct {
40 /** subnet address behind peer peer */
41 host_t *net;
42 /** netmask used for net */
43 u_int8_t net_mask;
44 } me, other;
45
46 /**
47 * Protocol for this policy, such as TCP/UDP/ICMP...
48 */
49 int upper_proto;
50 };
51
52 typedef struct private_child_sa_t private_child_sa_t;
53
54 /**
55 * Private data of a child_sa_t object.
56 */
57 struct private_child_sa_t {
58 /**
59 * Public interface of child_sa_t.
60 */
61 child_sa_t public;
62
63 struct {
64 /** address of peer */
65 host_t *addr;
66 /** actual used SPI, 0 if unused */
67 u_int32_t spi;
68 } me, other;
69
70 /**
71 * Protocol used to protect this SA, ESP|AH
72 */
73 protocol_id_t protocol;
74
75 /**
76 * List containing sa_policy_t objects
77 */
78 linked_list_t *policies;
79
80 /**
81 * reqid used for this child_sa
82 */
83 u_int32_t reqid;
84
85 /**
86 * Lifetime before rekeying
87 */
88 u_int32_t soft_lifetime;
89
90 /**
91 * Lifetime before delete
92 */
93 u_int32_t hard_lifetime;
94
95 /**
96 * reqid of a CHILD_SA which rekeyed this one
97 */
98 u_int32_t rekeyed;
99
100 /**
101 * CHILD_SAs own logger
102 */
103 logger_t *logger;
104 };
105
106 /**
107 * Implements child_sa_t.get_reqid
108 */
109 static u_int32_t get_reqid(private_child_sa_t *this)
110 {
111 return this->reqid;
112 }
113
114 /**
115 * Implements child_sa_t.get_spi
116 */
117 u_int32_t get_spi(private_child_sa_t *this, bool inbound)
118 {
119 if (inbound)
120 {
121 return this->me.spi;
122 }
123 return this->other.spi;
124 }
125
126 /**
127 * Implements child_sa_t.get_protocol
128 */
129 protocol_id_t get_protocol(private_child_sa_t *this)
130 {
131 return this->protocol;
132 }
133
134 /**
135 * Implements child_sa_t.alloc
136 */
137 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
138 {
139 protocol_id_t protocol;
140 iterator_t *iterator;
141 proposal_t *proposal;
142 status_t status;
143
144 /* iterator through proposals */
145 iterator = proposals->create_iterator(proposals, TRUE);
146 while(iterator->has_next(iterator))
147 {
148 iterator->current(iterator, (void**)&proposal);
149 protocol = proposal->get_protocol(proposal);
150
151 status = charon->kernel_interface->get_spi(
152 charon->kernel_interface,
153 this->other.addr, this->me.addr,
154 protocol, this->reqid,
155 &this->me.spi);
156
157 if (status != SUCCESS)
158 {
159 iterator->destroy(iterator);
160 return FAILED;
161 }
162 /* update proposal */
163 proposal->set_spi(proposal, (u_int64_t)this->me.spi);
164 }
165 iterator->destroy(iterator);
166 return SUCCESS;
167 }
168
169 static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
170 {
171 u_int32_t spi;
172 algorithm_t *enc_algo, *int_algo;
173 algorithm_t enc_algo_none = {ENCR_UNDEFINED, 0};
174 algorithm_t int_algo_none = {AUTH_UNDEFINED, 0};
175 host_t *src;
176 host_t *dst;
177 status_t status;
178
179 /* we must assign the roles to correctly set up the SAs */
180 if (mine)
181 {
182 dst = this->me.addr;
183 src = this->other.addr;
184 }
185 else
186 {
187 src = this->me.addr;
188 dst = this->other.addr;
189 }
190
191 this->protocol = proposal->get_protocol(proposal);
192
193 /* now we have to decide which spi to use. Use self allocated, if "mine",
194 * or the one in the proposal, if not "mine" (others). */
195 if (mine)
196 {
197 spi = this->me.spi;
198 }
199 else
200 {
201 spi = proposal->get_spi(proposal);
202 this->other.spi = spi;
203 }
204
205 this->logger->log(this->logger, CONTROL|LEVEL1, "Adding %s %s SA",
206 mine ? "inbound" : "outbound",
207 mapping_find(protocol_id_m, this->protocol));
208
209 /* select encryption algo */
210 if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
211 {
212 this->logger->log(this->logger, CONTROL|LEVEL2, " using %s for encryption",
213 mapping_find(encryption_algorithm_m, enc_algo->algorithm));
214 }
215 else
216 {
217 enc_algo = &enc_algo_none;
218 }
219
220 /* select integrity algo */
221 if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
222 {
223 this->logger->log(this->logger, CONTROL|LEVEL2, " using %s for integrity",
224 mapping_find(integrity_algorithm_m, int_algo->algorithm));
225 }
226 else
227 {
228 int_algo = &int_algo_none;
229 }
230
231 /* send SA down to the kernel */
232 this->logger->log(this->logger, CONTROL|LEVEL2,
233 " SPI 0x%.8x, src %s dst %s",
234 ntohl(spi), src->get_address(src), dst->get_address(dst));
235 status = charon->kernel_interface->add_sa(charon->kernel_interface,
236 src, dst,
237 spi, this->protocol,
238 this->reqid,
239 mine ? 0 : this->soft_lifetime,
240 this->hard_lifetime,
241 enc_algo, int_algo, prf_plus, mine);
242
243 return status;
244 }
245
246 static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
247 {
248 linked_list_t *list;
249
250 /* install others (initiators) SAs*/
251 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
252 {
253 return FAILED;
254 }
255
256 /* get SPIs for our SAs */
257 list = linked_list_create();
258 list->insert_last(list, proposal);
259 if (alloc(this, list) != SUCCESS)
260 {
261 list->destroy(list);
262 return FAILED;
263 }
264 list->destroy(list);
265
266 /* install our (responders) SAs */
267 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
268 {
269 return FAILED;
270 }
271
272 return SUCCESS;
273 }
274
275 static status_t update(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
276 {
277 /* install our (initator) SAs */
278 if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
279 {
280 return FAILED;
281 }
282 /* install his (responder) SAs */
283 if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
284 {
285 return FAILED;
286 }
287
288 return SUCCESS;
289 }
290
291 static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list, linked_list_t *other_ts_list)
292 {
293 iterator_t *my_iter, *other_iter;
294 traffic_selector_t *my_ts, *other_ts;
295
296 /* iterate over both lists */
297 my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
298 other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
299 while (my_iter->has_next(my_iter))
300 {
301 my_iter->current(my_iter, (void**)&my_ts);
302 other_iter->reset(other_iter);
303 while (other_iter->has_next(other_iter))
304 {
305 /* set up policies for every entry in my_ts_list to every entry in other_ts_list */
306 int family;
307 chunk_t from_addr;
308 u_int16_t from_port, to_port;
309 sa_policy_t *policy;
310 status_t status;
311
312 other_iter->current(other_iter, (void**)&other_ts);
313
314 /* only set up policies if protocol matches */
315 if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts))
316 {
317 continue;
318 }
319 policy = malloc_thing(sa_policy_t);
320 policy->upper_proto = my_ts->get_protocol(my_ts);
321
322 /* calculate net and ports for local side */
323 family = my_ts->get_type(my_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
324 from_addr = my_ts->get_from_address(my_ts);
325 from_port = my_ts->get_from_port(my_ts);
326 to_port = my_ts->get_to_port(my_ts);
327 from_port = (from_port != to_port) ? 0 : from_port;
328 policy->me.net = host_create_from_chunk(family, from_addr, from_port);
329 policy->me.net_mask = my_ts->get_netmask(my_ts);
330 chunk_free(&from_addr);
331
332 /* calculate net and ports for remote side */
333 family = other_ts->get_type(other_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
334 from_addr = other_ts->get_from_address(other_ts);
335 from_port = other_ts->get_from_port(other_ts);
336 to_port = other_ts->get_to_port(other_ts);
337 from_port = (from_port != to_port) ? 0 : from_port;
338 policy->other.net = host_create_from_chunk(family, from_addr, from_port);
339 policy->other.net_mask = other_ts->get_netmask(other_ts);
340 chunk_free(&from_addr);
341
342 /* install 3 policies: out, in and forward */
343 status = charon->kernel_interface->add_policy(charon->kernel_interface,
344 this->me.addr, this->other.addr,
345 policy->me.net, policy->other.net,
346 policy->me.net_mask, policy->other.net_mask,
347 XFRM_POLICY_OUT, policy->upper_proto,
348 this->protocol,
349 this->reqid);
350
351 status |= charon->kernel_interface->add_policy(charon->kernel_interface,
352 this->other.addr, this->me.addr,
353 policy->other.net, policy->me.net,
354 policy->other.net_mask, policy->me.net_mask,
355 XFRM_POLICY_IN, policy->upper_proto,
356 this->protocol,
357 this->reqid);
358
359 status |= charon->kernel_interface->add_policy(charon->kernel_interface,
360 this->other.addr, this->me.addr,
361 policy->other.net, policy->me.net,
362 policy->other.net_mask, policy->me.net_mask,
363 XFRM_POLICY_FWD, policy->upper_proto,
364 this->protocol,
365 this->reqid);
366
367 if (status != SUCCESS)
368 {
369 my_iter->destroy(my_iter);
370 other_iter->destroy(other_iter);
371 policy->me.net->destroy(policy->me.net);
372 policy->other.net->destroy(policy->other.net);
373 free(policy);
374 return status;
375 }
376
377 /* add it to the policy list, since we want to know which policies we own */
378 this->policies->insert_last(this->policies, policy);
379 }
380 }
381 my_iter->destroy(my_iter);
382 other_iter->destroy(other_iter);
383 return SUCCESS;
384 }
385
386 /**
387 * Implementation of child_sa_t.set_rekeyed.
388 */
389 static void set_rekeyed(private_child_sa_t *this, u_int32_t reqid)
390 {
391 this->rekeyed = reqid;
392 }
393
394 /**
395 * Implementation of child_sa_t.log_status.
396 */
397 static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
398 {
399 iterator_t *iterator;
400 sa_policy_t *policy;
401 struct protoent *proto;
402 char proto_buf[8] = "";
403 char *proto_name = proto_buf;
404
405 if (logger == NULL)
406 {
407 logger = this->logger;
408 }
409 logger->log(logger, CONTROL|LEVEL1, " \"%s\": protected with %s (0x%x/0x%x), reqid %d:",
410 name,
411 this->protocol == PROTO_ESP ? "ESP" : "AH",
412 htonl(this->me.spi), htonl(this->other.spi),
413 this->reqid);
414 iterator = this->policies->create_iterator(this->policies, TRUE);
415 while (iterator->has_next(iterator))
416 {
417 iterator->current(iterator, (void**)&policy);
418 if (policy->upper_proto)
419 {
420 proto = getprotobynumber(policy->upper_proto);
421 if (proto)
422 {
423 proto_name = proto->p_name;
424 }
425 else
426 {
427 snprintf(proto_buf, sizeof(proto_buf), "<%d>", policy->upper_proto);
428 }
429 }
430 logger->log(logger, CONTROL, " \"%s\": %s/%d==%s==%s/%d",
431 name,
432 policy->me.net->get_address(policy->me.net), policy->me.net_mask,
433 proto_name,
434 policy->other.net->get_address(policy->other.net), policy->other.net_mask);
435 }
436 iterator->destroy(iterator);
437 }
438
439 /**
440 * Implementation of child_sa_t.destroy.
441 */
442 static void destroy(private_child_sa_t *this)
443 {
444 sa_policy_t *policy;
445
446 /* delete SAs in the kernel, if they are set up */
447 if (this->protocol != PROTO_NONE)
448 {
449 charon->kernel_interface->del_sa(charon->kernel_interface,
450 this->me.addr, this->me.spi, this->protocol);
451 charon->kernel_interface->del_sa(charon->kernel_interface,
452 this->other.addr, this->other.spi, this->protocol);
453 }
454
455 /* delete all policies in the kernel */
456 while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
457 {
458 if (!this->rekeyed)
459 {
460 /* let rekeyed policies, as they are used by another child_sa */
461 charon->kernel_interface->del_policy(charon->kernel_interface,
462 this->me.addr, this->other.addr,
463 policy->me.net, policy->other.net,
464 policy->me.net_mask, policy->other.net_mask,
465 XFRM_POLICY_OUT, policy->upper_proto);
466
467 charon->kernel_interface->del_policy(charon->kernel_interface,
468 this->other.addr, this->me.addr,
469 policy->other.net, policy->me.net,
470 policy->other.net_mask, policy->me.net_mask,
471 XFRM_POLICY_IN, policy->upper_proto);
472
473 charon->kernel_interface->del_policy(charon->kernel_interface,
474 this->other.addr, this->me.addr,
475 policy->other.net, policy->me.net,
476 policy->other.net_mask, policy->me.net_mask,
477 XFRM_POLICY_FWD, policy->upper_proto);
478 }
479 policy->me.net->destroy(policy->me.net);
480 policy->other.net->destroy(policy->other.net);
481 free(policy);
482 }
483 this->policies->destroy(this->policies);
484
485 free(this);
486 }
487
488 /*
489 * Described in header.
490 */
491 child_sa_t * child_sa_create(host_t *me, host_t* other, u_int32_t soft_lifetime, u_int32_t hard_lifetime)
492 {
493 static u_int32_t reqid = 2000000000;
494 private_child_sa_t *this = malloc_thing(private_child_sa_t);
495
496 /* public functions */
497 this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
498 this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
499 this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
500 this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
501 this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
502 this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
503 this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
504 this->public.set_rekeyed = (void (*)(child_sa_t*,u_int32_t))set_rekeyed;
505 this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
506 this->public.destroy = (void(*)(child_sa_t*))destroy;
507
508 /* private data */
509 this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
510 this->me.addr = me;
511 this->other.addr = other;
512 this->me.spi = 0;
513 this->other.spi = 0;
514 this->soft_lifetime = soft_lifetime;
515 this->hard_lifetime = hard_lifetime;
516 this->reqid = ++reqid;
517 this->policies = linked_list_create();
518 this->protocol = PROTO_NONE;
519 this->rekeyed = 0;
520
521 return (&this->public);
522 }