Support multiple virtual IPs on peer_cfg and ike_sa classes
[strongswan.git] / src / frontends / android / jni / libandroidbridge / backend / android_service.c
1 /*
2 * Copyright (C) 2010-2012 Tobias Brunner
3 * Copyright (C) 2012 Giuliano Grassi
4 * Copyright (C) 2012 Ralf Sager
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include <errno.h>
19 #include <unistd.h>
20
21 #include "android_service.h"
22 #include "../charonservice.h"
23 #include "../vpnservice_builder.h"
24
25 #include <daemon.h>
26 #include <library.h>
27 #include <ipsec.h>
28 #include <processing/jobs/callback_job.h>
29 #include <threading/rwlock.h>
30 #include <threading/thread.h>
31
32 typedef struct private_android_service_t private_android_service_t;
33
34 #define TUN_DEFAULT_MTU 1400
35
36 /**
37 * private data of Android service
38 */
39 struct private_android_service_t {
40
41 /**
42 * public interface
43 */
44 android_service_t public;
45
46 /**
47 * current IKE_SA
48 */
49 ike_sa_t *ike_sa;
50
51 /**
52 * local ipv4 address
53 */
54 char *local_address;
55
56 /**
57 * gateway
58 */
59 char *gateway;
60
61 /**
62 * username
63 */
64 char *username;
65
66 /**
67 * lock to safely access the TUN device fd
68 */
69 rwlock_t *lock;
70
71 /**
72 * TUN device file descriptor
73 */
74 int tunfd;
75
76 };
77
78 /**
79 * Outbound callback
80 */
81 static void send_esp(void *data, esp_packet_t *packet)
82 {
83 charon->sender->send_no_marker(charon->sender, (packet_t*)packet);
84 }
85
86 /**
87 * Inbound callback
88 */
89 static void deliver_plain(private_android_service_t *this,
90 ip_packet_t *packet)
91 {
92 chunk_t encoding;
93 ssize_t len;
94
95 encoding = packet->get_encoding(packet);
96
97 this->lock->read_lock(this->lock);
98 if (this->tunfd < 0)
99 { /* the TUN device is already closed */
100 this->lock->unlock(this->lock);
101 packet->destroy(packet);
102 return;
103 }
104 len = write(this->tunfd, encoding.ptr, encoding.len);
105 this->lock->unlock(this->lock);
106
107 if (len < 0 || len != encoding.len)
108 {
109 DBG1(DBG_DMN, "failed to write packet to TUN device: %s",
110 strerror(errno));
111 }
112 packet->destroy(packet);
113 }
114
115 /**
116 * Receiver callback
117 */
118 static void receiver_esp_cb(void *data, packet_t *packet)
119 {
120 esp_packet_t *esp_packet;
121
122 esp_packet = esp_packet_create_from_packet(packet);
123 ipsec->processor->queue_inbound(ipsec->processor, esp_packet);
124 }
125
126 /**
127 * Job handling outbound plaintext packets
128 */
129 static job_requeue_t handle_plain(private_android_service_t *this)
130 {
131 ip_packet_t *packet;
132 chunk_t raw;
133 fd_set set;
134 ssize_t len;
135 int tunfd;
136 bool old;
137
138 FD_ZERO(&set);
139
140 this->lock->read_lock(this->lock);
141 if (this->tunfd < 0)
142 { /* the TUN device is already closed */
143 this->lock->unlock(this->lock);
144 return JOB_REQUEUE_NONE;
145 }
146 tunfd = this->tunfd;
147 FD_SET(tunfd, &set);
148 this->lock->unlock(this->lock);
149
150 old = thread_cancelability(TRUE);
151 len = select(tunfd + 1, &set, NULL, NULL, NULL);
152 thread_cancelability(old);
153
154 if (len < 0)
155 {
156 DBG1(DBG_DMN, "select on TUN device failed: %s", strerror(errno));
157 return JOB_REQUEUE_NONE;
158 }
159
160 raw = chunk_alloc(TUN_DEFAULT_MTU);
161 len = read(tunfd, raw.ptr, raw.len);
162 if (len < 0)
163 {
164 DBG1(DBG_DMN, "reading from TUN device failed: %s", strerror(errno));
165 chunk_free(&raw);
166 return JOB_REQUEUE_FAIR;
167 }
168 raw.len = len;
169
170 packet = ip_packet_create(raw);
171 if (packet)
172 {
173 ipsec->processor->queue_outbound(ipsec->processor, packet);
174 }
175 else
176 {
177 DBG1(DBG_DMN, "invalid IP packet read from TUN device");
178 }
179 return JOB_REQUEUE_DIRECT;
180 }
181
182 /**
183 * Add a route to the TUN device builder
184 */
185 static bool add_route(vpnservice_builder_t *builder, host_t *net,
186 u_int8_t prefix)
187 {
188 /* if route is 0.0.0.0/0, split it into two routes 0.0.0.0/1 and
189 * 128.0.0.0/1 because otherwise it would conflict with the current default
190 * route */
191 if (net->is_anyaddr(net) && prefix == 0)
192 {
193 bool success;
194
195 success = add_route(builder, net, 1);
196 net = host_create_from_string("128.0.0.0", 0);
197 success = success && add_route(builder, net, 1);
198 net->destroy(net);
199 return success;
200 }
201 return builder->add_route(builder, net, prefix);
202 }
203
204 /**
205 * Generate and set routes from installed IPsec policies
206 */
207 static bool add_routes(vpnservice_builder_t *builder, child_sa_t *child_sa)
208 {
209 traffic_selector_t *src_ts, *dst_ts;
210 enumerator_t *enumerator;
211 bool success = TRUE;
212
213 enumerator = child_sa->create_policy_enumerator(child_sa);
214 while (success && enumerator->enumerate(enumerator, &src_ts, &dst_ts))
215 {
216 host_t *net;
217 u_int8_t prefix;
218
219 dst_ts->to_subnet(dst_ts, &net, &prefix);
220 success = add_route(builder, net, prefix);
221 net->destroy(net);
222 }
223 enumerator->destroy(enumerator);
224 return success;
225 }
226
227 /**
228 * Setup a new TUN device for the supplied SAs, also queues a job that
229 * reads packets from this device.
230 * Additional information such as DNS servers are gathered in appropriate
231 * listeners asynchronously. To be sure every required bit of information is
232 * available this should be called after the CHILD_SA has been established.
233 */
234 static bool setup_tun_device(private_android_service_t *this,
235 ike_sa_t *ike_sa, child_sa_t *child_sa)
236 {
237 vpnservice_builder_t *builder;
238 enumerator_t *enumerator;
239 bool vip_found = FALSE;
240 host_t *vip;
241 int tunfd;
242
243 DBG1(DBG_DMN, "setting up TUN device for CHILD_SA %s{%u}",
244 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
245
246 builder = charonservice->get_vpnservice_builder(charonservice);
247
248 enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, TRUE);
249 while (enumerator->enumerate(enumerator, &vip))
250 {
251 if (!vip->is_anyaddr(vip))
252 {
253 if (!builder->add_address(builder, vip))
254 {
255 break;
256 }
257 vip_found = TRUE;
258 }
259 }
260 enumerator->destroy(enumerator);
261
262 if (!vip_found)
263 {
264 DBG1(DBG_DMN, "setting up TUN device failed, no virtual IP found");
265 return FALSE;
266 }
267 if (!add_routes(builder, child_sa) ||
268 !builder->set_mtu(builder, TUN_DEFAULT_MTU))
269 {
270 return FALSE;
271 }
272
273 tunfd = builder->establish(builder);
274 if (tunfd == -1)
275 {
276 return FALSE;
277 }
278
279 this->lock->write_lock(this->lock);
280 this->tunfd = tunfd;
281 this->lock->unlock(this->lock);
282
283 DBG1(DBG_DMN, "successfully created TUN device");
284
285 charon->receiver->add_esp_cb(charon->receiver,
286 (receiver_esp_cb_t)receiver_esp_cb, NULL);
287 ipsec->processor->register_inbound(ipsec->processor,
288 (ipsec_inbound_cb_t)deliver_plain, this);
289 ipsec->processor->register_outbound(ipsec->processor,
290 (ipsec_outbound_cb_t)send_esp, NULL);
291
292 lib->processor->queue_job(lib->processor,
293 (job_t*)callback_job_create((callback_job_cb_t)handle_plain, this,
294 NULL, (callback_job_cancel_t)return_false));
295 return TRUE;
296 }
297
298 /**
299 * Close the current tun device
300 */
301 static void close_tun_device(private_android_service_t *this)
302 {
303 int tunfd;
304
305 this->lock->write_lock(this->lock);
306 if (this->tunfd < 0)
307 { /* already closed (or never created) */
308 this->lock->unlock(this->lock);
309 return;
310 }
311 tunfd = this->tunfd;
312 this->tunfd = -1;
313 this->lock->unlock(this->lock);
314
315 ipsec->processor->unregister_outbound(ipsec->processor,
316 (ipsec_outbound_cb_t)send_esp);
317 ipsec->processor->unregister_inbound(ipsec->processor,
318 (ipsec_inbound_cb_t)deliver_plain);
319 charon->receiver->del_esp_cb(charon->receiver,
320 (receiver_esp_cb_t)receiver_esp_cb);
321 close(tunfd);
322 }
323
324 METHOD(listener_t, child_updown, bool,
325 private_android_service_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
326 bool up)
327 {
328 if (this->ike_sa == ike_sa)
329 {
330 if (up)
331 {
332 /* disable the hooks registered to catch initiation failures */
333 this->public.listener.ike_updown = NULL;
334 this->public.listener.ike_state_change = NULL;
335 if (!setup_tun_device(this, ike_sa, child_sa))
336 {
337 DBG1(DBG_DMN, "failed to setup TUN device");
338 charonservice->update_status(charonservice,
339 CHARONSERVICE_GENERIC_ERROR);
340 return FALSE;
341
342 }
343 charonservice->update_status(charonservice,
344 CHARONSERVICE_CHILD_STATE_UP);
345 }
346 else
347 {
348 close_tun_device(this);
349 charonservice->update_status(charonservice,
350 CHARONSERVICE_CHILD_STATE_DOWN);
351 return FALSE;
352 }
353 }
354 return TRUE;
355 }
356
357 METHOD(listener_t, ike_updown, bool,
358 private_android_service_t *this, ike_sa_t *ike_sa, bool up)
359 {
360 /* this callback is only registered during initiation, so if the IKE_SA
361 * goes down we assume an authentication error */
362 if (this->ike_sa == ike_sa && !up)
363 {
364 charonservice->update_status(charonservice,
365 CHARONSERVICE_AUTH_ERROR);
366 return FALSE;
367 }
368 return TRUE;
369 }
370
371 METHOD(listener_t, ike_state_change, bool,
372 private_android_service_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
373 {
374 /* this call back is only registered during initiation */
375 if (this->ike_sa == ike_sa && state == IKE_DESTROYING)
376 {
377 charonservice->update_status(charonservice,
378 CHARONSERVICE_UNREACHABLE_ERROR);
379 return FALSE;
380 }
381 return TRUE;
382 }
383
384 METHOD(listener_t, alert, bool,
385 private_android_service_t *this, ike_sa_t *ike_sa, alert_t alert,
386 va_list args)
387 {
388 if (this->ike_sa == ike_sa)
389 {
390 switch (alert)
391 {
392 case ALERT_PEER_ADDR_FAILED:
393 charonservice->update_status(charonservice,
394 CHARONSERVICE_LOOKUP_ERROR);
395 break;
396 case ALERT_PEER_AUTH_FAILED:
397 charonservice->update_status(charonservice,
398 CHARONSERVICE_PEER_AUTH_ERROR);
399 break;
400 default:
401 break;
402 }
403 }
404 return TRUE;
405 }
406
407 METHOD(listener_t, ike_rekey, bool,
408 private_android_service_t *this, ike_sa_t *old, ike_sa_t *new)
409 {
410 if (this->ike_sa == old)
411 {
412 this->ike_sa = new;
413 }
414 return TRUE;
415 }
416
417 static job_requeue_t initiate(private_android_service_t *this)
418 {
419 identification_t *gateway, *user;
420 ike_cfg_t *ike_cfg;
421 peer_cfg_t *peer_cfg;
422 child_cfg_t *child_cfg;
423 traffic_selector_t *ts;
424 ike_sa_t *ike_sa;
425 auth_cfg_t *auth;
426 lifetime_cfg_t lifetime = {
427 .time = {
428 .life = 10800, /* 3h */
429 .rekey = 10200, /* 2h50min */
430 .jitter = 300 /* 5min */
431 }
432 };
433
434 ike_cfg = ike_cfg_create(TRUE, TRUE, this->local_address, FALSE,
435 charon->socket->get_port(charon->socket, FALSE),
436 this->gateway, FALSE, IKEV2_UDP_PORT);
437 ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
438
439 peer_cfg = peer_cfg_create("android", IKEV2, ike_cfg, CERT_SEND_IF_ASKED,
440 UNIQUE_REPLACE, 1, /* keyingtries */
441 36000, 0, /* rekey 10h, reauth none */
442 600, 600, /* jitter, over 10min */
443 TRUE, FALSE, /* mobike, aggressive */
444 0, 0, /* DPD delay, timeout */
445 NULL, FALSE, NULL, NULL); /* pool, mediation */
446 peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("0.0.0.0", 0));
447
448 auth = auth_cfg_create();
449 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
450 user = identification_create_from_string(this->username);
451 auth->add(auth, AUTH_RULE_IDENTITY, user);
452 peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
453 auth = auth_cfg_create();
454 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
455 gateway = identification_create_from_string(this->gateway);
456 auth->add(auth, AUTH_RULE_IDENTITY, gateway);
457 peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
458
459 child_cfg = child_cfg_create("android", &lifetime, NULL, TRUE, MODE_TUNNEL,
460 ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
461 0, 0, NULL, NULL, 0);
462 child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
463 ts = traffic_selector_create_dynamic(0, 0, 65535);
464 child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
465 ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE, "0.0.0.0",
466 0, "255.255.255.255", 65535);
467 child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
468 peer_cfg->add_child_cfg(peer_cfg, child_cfg);
469
470 /* get us an IKE_SA */
471 ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
472 peer_cfg);
473 if (!ike_sa)
474 {
475 peer_cfg->destroy(peer_cfg);
476 charonservice->update_status(charonservice,
477 CHARONSERVICE_GENERIC_ERROR);
478 return JOB_REQUEUE_NONE;
479 }
480 if (!ike_sa->get_peer_cfg(ike_sa))
481 {
482 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
483 }
484 peer_cfg->destroy(peer_cfg);
485
486 /* store the IKE_SA so we can track its progress */
487 this->ike_sa = ike_sa;
488
489 /* get an additional reference because initiate consumes one */
490 child_cfg->get_ref(child_cfg);
491 if (ike_sa->initiate(ike_sa, child_cfg, 0, NULL, NULL) != SUCCESS)
492 {
493 DBG1(DBG_CFG, "failed to initiate tunnel");
494 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
495 ike_sa);
496 return JOB_REQUEUE_NONE;
497 }
498 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
499 return JOB_REQUEUE_NONE;
500 }
501
502 METHOD(android_service_t, destroy, void,
503 private_android_service_t *this)
504 {
505 charon->bus->remove_listener(charon->bus, &this->public.listener);
506 /* make sure the tun device is actually closed */
507 close_tun_device(this);
508 this->lock->destroy(this->lock);
509 free(this->local_address);
510 free(this->username);
511 free(this->gateway);
512 free(this);
513 }
514
515 /**
516 * See header
517 */
518 android_service_t *android_service_create(char *local_address, char *gateway,
519 char *username)
520 {
521 private_android_service_t *this;
522
523 INIT(this,
524 .public = {
525 .listener = {
526 .ike_rekey = _ike_rekey,
527 .ike_updown = _ike_updown,
528 .ike_state_change = _ike_state_change,
529 .child_updown = _child_updown,
530 .alert = _alert,
531 },
532 .destroy = _destroy,
533 },
534 .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
535 .local_address = local_address,
536 .username = username,
537 .gateway = gateway,
538 .tunfd = -1,
539 );
540
541 charon->bus->add_listener(charon->bus, &this->public.listener);
542
543 lib->processor->queue_job(lib->processor,
544 (job_t*)callback_job_create((callback_job_cb_t)initiate, this,
545 NULL, NULL));
546 return &this->public;
547 }