357c4a73b75f16668eb538def1e2be78d24033a9
[strongswan.git] / src / libcharon / config / ike_cfg.c
1 /*
2 * Copyright (C) 2012-2018 Tobias Brunner
3 * Copyright (C) 2005-2007 Martin Willi
4 * Copyright (C) 2005 Jan Hutter
5 * HSR Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #define _GNU_SOURCE /* for stdndup() */
19 #include <string.h>
20
21 #include "ike_cfg.h"
22
23 #include <daemon.h>
24
25 ENUM(ike_version_names, IKE_ANY, IKEV2,
26 "IKEv1/2",
27 "IKEv1",
28 "IKEv2",
29 );
30
31 typedef struct private_ike_cfg_t private_ike_cfg_t;
32
33 /**
34 * Private data of an ike_cfg_t object
35 */
36 struct private_ike_cfg_t {
37
38 /**
39 * Public part
40 */
41 ike_cfg_t public;
42
43 /**
44 * Number of references hold by others to this ike_cfg
45 */
46 refcount_t refcount;
47
48 /**
49 * IKE version to use
50 */
51 ike_version_t version;
52
53 /**
54 * Address list string for local host
55 */
56 char *me;
57
58 /**
59 * Address list string for remote host
60 */
61 char *other;
62
63 /**
64 * Local single host or DNS names, as allocated char*
65 */
66 linked_list_t *my_hosts;
67
68 /**
69 * Remote single host or DNS names, as allocated char*
70 */
71 linked_list_t *other_hosts;
72
73 /**
74 * Local ranges/subnets this config matches to, as traffic_selector_t*
75 */
76 linked_list_t *my_ranges;
77
78 /**
79 * Remote ranges/subnets this config matches to, as traffic_selector_t*
80 */
81 linked_list_t *other_ranges;
82
83 /**
84 * our source port
85 */
86 uint16_t my_port;
87
88 /**
89 * destination port
90 */
91 uint16_t other_port;
92
93 /**
94 * should we send a certificate request?
95 */
96 bool certreq;
97
98 /**
99 * enforce UDP encapsulation
100 */
101 bool force_encap;
102
103 /**
104 * use IKEv1 fragmentation
105 */
106 fragmentation_t fragmentation;
107
108 /**
109 * DSCP value to use on sent IKE packets
110 */
111 uint8_t dscp;
112
113 /**
114 * List of proposals to use
115 */
116 linked_list_t *proposals;
117 };
118
119 METHOD(ike_cfg_t, get_version, ike_version_t,
120 private_ike_cfg_t *this)
121 {
122 return this->version;
123 }
124
125 METHOD(ike_cfg_t, send_certreq, bool,
126 private_ike_cfg_t *this)
127 {
128 return this->certreq;
129 }
130
131 METHOD(ike_cfg_t, force_encap_, bool,
132 private_ike_cfg_t *this)
133 {
134 return this->force_encap;
135 }
136
137 METHOD(ike_cfg_t, fragmentation, fragmentation_t,
138 private_ike_cfg_t *this)
139 {
140 return this->fragmentation;
141 }
142
143 /**
144 * Common function for resolve_me/other
145 */
146 static host_t* resolve(linked_list_t *hosts, int family, uint16_t port)
147 {
148 enumerator_t *enumerator;
149 host_t *host = NULL;
150 bool tried = FALSE;
151 char *str;
152
153 enumerator = hosts->create_enumerator(hosts);
154 while (enumerator->enumerate(enumerator, &str))
155 {
156 host = host_create_from_dns(str, family, port);
157 if (host)
158 {
159 break;
160 }
161 tried = TRUE;
162 }
163 enumerator->destroy(enumerator);
164
165 if (!host && !tried)
166 {
167 /* we have no single host configured, return %any */
168 host = host_create_any(family ?: AF_INET);
169 host->set_port(host, port);
170 }
171 return host;
172 }
173
174 METHOD(ike_cfg_t, resolve_me, host_t*,
175 private_ike_cfg_t *this, int family)
176 {
177 return resolve(this->my_hosts, family, this->my_port);
178 }
179
180 METHOD(ike_cfg_t, resolve_other, host_t*,
181 private_ike_cfg_t *this, int family)
182 {
183 return resolve(this->other_hosts, family, this->other_port);
184 }
185
186 /**
187 * Common function for match_me/other
188 */
189 static u_int match(linked_list_t *hosts, linked_list_t *ranges, host_t *cand)
190 {
191 enumerator_t *enumerator;
192 traffic_selector_t *ts;
193 char *str;
194 host_t *host;
195 uint8_t mask;
196 u_int quality = 0;
197
198 /* try single hosts first */
199 enumerator = hosts->create_enumerator(hosts);
200 while (enumerator->enumerate(enumerator, &str))
201 {
202 host = host_create_from_dns(str, cand->get_family(cand), 0);
203 if (host)
204 {
205 if (host->ip_equals(host, cand))
206 {
207 quality = max(quality, 128 + 1);
208 }
209 if (host->is_anyaddr(host))
210 {
211 quality = max(quality, 1);
212 }
213 host->destroy(host);
214 }
215 }
216 enumerator->destroy(enumerator);
217
218 /* then ranges/subnets */
219 enumerator = ranges->create_enumerator(ranges);
220 while (enumerator->enumerate(enumerator, &ts))
221 {
222 if (ts->includes(ts, cand))
223 {
224 if (ts->to_subnet(ts, &host, &mask))
225 {
226 quality = max(quality, mask + 1);
227 }
228 else
229 {
230 quality = max(quality, 1);
231 }
232 host->destroy(host);
233 }
234 }
235 enumerator->destroy(enumerator);
236
237 return quality;
238 }
239
240 METHOD(ike_cfg_t, match_me, u_int,
241 private_ike_cfg_t *this, host_t *host)
242 {
243 return match(this->my_hosts, this->my_ranges, host);
244 }
245
246 METHOD(ike_cfg_t, match_other, u_int,
247 private_ike_cfg_t *this, host_t *host)
248 {
249 return match(this->other_hosts, this->other_ranges, host);
250 }
251
252 METHOD(ike_cfg_t, get_my_addr, char*,
253 private_ike_cfg_t *this)
254 {
255 return this->me;
256 }
257
258 METHOD(ike_cfg_t, get_other_addr, char*,
259 private_ike_cfg_t *this)
260 {
261 return this->other;
262 }
263
264 METHOD(ike_cfg_t, get_my_port, uint16_t,
265 private_ike_cfg_t *this)
266 {
267 return this->my_port;
268 }
269
270 METHOD(ike_cfg_t, get_other_port, uint16_t,
271 private_ike_cfg_t *this)
272 {
273 return this->other_port;
274 }
275
276 METHOD(ike_cfg_t, get_dscp, uint8_t,
277 private_ike_cfg_t *this)
278 {
279 return this->dscp;
280 }
281
282 METHOD(ike_cfg_t, add_proposal, void,
283 private_ike_cfg_t *this, proposal_t *proposal)
284 {
285 if (proposal)
286 {
287 this->proposals->insert_last(this->proposals, proposal);
288 }
289 }
290
291 METHOD(ike_cfg_t, get_proposals, linked_list_t*,
292 private_ike_cfg_t *this)
293 {
294 enumerator_t *enumerator;
295 proposal_t *current;
296 linked_list_t *proposals;
297
298 proposals = linked_list_create();
299 enumerator = this->proposals->create_enumerator(this->proposals);
300 while (enumerator->enumerate(enumerator, &current))
301 {
302 current = current->clone(current);
303 proposals->insert_last(proposals, current);
304 }
305 enumerator->destroy(enumerator);
306
307 DBG2(DBG_CFG, "configured proposals: %#P", proposals);
308
309 return proposals;
310 }
311
312 METHOD(ike_cfg_t, has_proposal, bool,
313 private_ike_cfg_t *this, proposal_t *match, bool private)
314 {
315 enumerator_t *enumerator;
316 proposal_t *proposal;
317
318 enumerator = this->proposals->create_enumerator(this->proposals);
319 while (enumerator->enumerate(enumerator, &proposal))
320 {
321 if (proposal->matches(proposal, match, private))
322 {
323 enumerator->destroy(enumerator);
324 return TRUE;
325 }
326 }
327 enumerator->destroy(enumerator);
328 return FALSE;
329 }
330
331 METHOD(ike_cfg_t, select_proposal, proposal_t*,
332 private_ike_cfg_t *this, linked_list_t *proposals, bool private,
333 bool prefer_self)
334 {
335 enumerator_t *prefer_enum, *match_enum;
336 proposal_t *proposal, *match, *selected = NULL;
337
338 if (prefer_self)
339 {
340 prefer_enum = this->proposals->create_enumerator(this->proposals);
341 match_enum = proposals->create_enumerator(proposals);
342 }
343 else
344 {
345 prefer_enum = proposals->create_enumerator(proposals);
346 match_enum = this->proposals->create_enumerator(this->proposals);
347 }
348
349 while (prefer_enum->enumerate(prefer_enum, (void**)&proposal))
350 {
351 if (prefer_self)
352 {
353 proposals->reset_enumerator(proposals, match_enum);
354 }
355 else
356 {
357 this->proposals->reset_enumerator(this->proposals, match_enum);
358 }
359 while (match_enum->enumerate(match_enum, (void**)&match))
360 {
361 selected = proposal->select(proposal, match, prefer_self, private);
362 if (selected)
363 {
364 DBG2(DBG_CFG, "received proposals: %#P", proposals);
365 DBG2(DBG_CFG, "configured proposals: %#P", this->proposals);
366 DBG1(DBG_CFG, "selected proposal: %P", selected);
367 break;
368 }
369 }
370 if (selected)
371 {
372 break;
373 }
374 }
375 prefer_enum->destroy(prefer_enum);
376 match_enum->destroy(match_enum);
377 if (!selected)
378 {
379 DBG1(DBG_CFG, "received proposals: %#P", proposals);
380 DBG1(DBG_CFG, "configured proposals: %#P", this->proposals);
381 }
382 return selected;
383 }
384
385 METHOD(ike_cfg_t, get_dh_group, diffie_hellman_group_t,
386 private_ike_cfg_t *this)
387 {
388 enumerator_t *enumerator;
389 proposal_t *proposal;
390 uint16_t dh_group = MODP_NONE;
391
392 enumerator = this->proposals->create_enumerator(this->proposals);
393 while (enumerator->enumerate(enumerator, &proposal))
394 {
395 if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP, &dh_group, NULL))
396 {
397 break;
398 }
399 }
400 enumerator->destroy(enumerator);
401 return dh_group;
402 }
403
404 METHOD(ike_cfg_t, equals, bool,
405 private_ike_cfg_t *this, ike_cfg_t *other_public)
406 {
407 private_ike_cfg_t *other = (private_ike_cfg_t*)other_public;
408
409 if (this == other)
410 {
411 return TRUE;
412 }
413 if (this->public.equals != other->public.equals)
414 {
415 return FALSE;
416 }
417 if (!this->proposals->equals_offset(this->proposals, other->proposals,
418 offsetof(proposal_t, equals)))
419 {
420 return FALSE;
421 }
422 return
423 this->version == other->version &&
424 this->certreq == other->certreq &&
425 this->force_encap == other->force_encap &&
426 this->fragmentation == other->fragmentation &&
427 streq(this->me, other->me) &&
428 streq(this->other, other->other) &&
429 this->my_port == other->my_port &&
430 this->other_port == other->other_port;
431 }
432
433 METHOD(ike_cfg_t, get_ref, ike_cfg_t*,
434 private_ike_cfg_t *this)
435 {
436 ref_get(&this->refcount);
437 return &this->public;
438 }
439
440 METHOD(ike_cfg_t, destroy, void,
441 private_ike_cfg_t *this)
442 {
443 if (ref_put(&this->refcount))
444 {
445 this->proposals->destroy_offset(this->proposals,
446 offsetof(proposal_t, destroy));
447 free(this->me);
448 free(this->other);
449 this->my_hosts->destroy_function(this->my_hosts, free);
450 this->other_hosts->destroy_function(this->other_hosts, free);
451 this->my_ranges->destroy_offset(this->my_ranges,
452 offsetof(traffic_selector_t, destroy));
453 this->other_ranges->destroy_offset(this->other_ranges,
454 offsetof(traffic_selector_t, destroy));
455 free(this);
456 }
457 }
458
459 /**
460 * Try to parse a string as subnet
461 */
462 static traffic_selector_t* make_subnet(char *str)
463 {
464 char *pos;
465
466 pos = strchr(str, '/');
467 if (!pos)
468 {
469 return NULL;
470 }
471 return traffic_selector_create_from_cidr(str, 0, 0, 0);
472 }
473
474 /**
475 * Try to parse a string as an IP range
476 */
477 static traffic_selector_t* make_range(char *str)
478 {
479 traffic_selector_t *ts;
480 ts_type_t type;
481 host_t *from, *to;
482
483 if (!host_create_from_range(str, &from, &to))
484 {
485 return NULL;
486 }
487 if (to->get_family(to) == AF_INET)
488 {
489 type = TS_IPV4_ADDR_RANGE;
490 }
491 else
492 {
493 type = TS_IPV6_ADDR_RANGE;
494 }
495 ts = traffic_selector_create_from_bytes(0, type,
496 from->get_address(from), 0,
497 to->get_address(to), 0);
498 from->destroy(from);
499 to->destroy(to);
500 return ts;
501 }
502
503 /**
504 * Parse address string into lists of single hosts and ranges/subnets
505 */
506 static void parse_addresses(char *str, linked_list_t *hosts,
507 linked_list_t *ranges)
508 {
509 enumerator_t *enumerator;
510 traffic_selector_t *ts;
511
512 enumerator = enumerator_create_token(str, ",", " ");
513 while (enumerator->enumerate(enumerator, &str))
514 {
515 ts = make_subnet(str);
516 if (ts)
517 {
518 ranges->insert_last(ranges, ts);
519 continue;
520 }
521 ts = make_range(str);
522 if (ts)
523 {
524 ranges->insert_last(ranges, ts);
525 continue;
526 }
527 hosts->insert_last(hosts, strdup(str));
528 }
529 enumerator->destroy(enumerator);
530 }
531
532 /**
533 * Described in header.
534 */
535 int ike_cfg_get_family(ike_cfg_t *cfg, bool local)
536 {
537 private_ike_cfg_t *this = (private_ike_cfg_t*)cfg;
538 enumerator_t *enumerator;
539 host_t *host;
540 char *str;
541 int family = AF_UNSPEC;
542
543 if (local)
544 {
545 enumerator = this->my_hosts->create_enumerator(this->my_hosts);
546 }
547 else
548 {
549 enumerator = this->other_hosts->create_enumerator(this->other_hosts);
550 }
551 while (enumerator->enumerate(enumerator, &str))
552 {
553 if (streq(str, "%any"))
554 { /* ignore %any as its family is undetermined */
555 continue;
556 }
557 host = host_create_from_string(str, 0);
558 if (host)
559 {
560 if (family == AF_UNSPEC)
561 {
562 family = host->get_family(host);
563 }
564 else if (family != host->get_family(host))
565 {
566 /* more than one address family defined */
567 family = AF_UNSPEC;
568 host->destroy(host);
569 break;
570 }
571 }
572 DESTROY_IF(host);
573 }
574 enumerator->destroy(enumerator);
575 return family;
576 }
577
578 /**
579 * Described in header.
580 */
581 bool ike_cfg_has_address(ike_cfg_t *cfg, host_t *addr, bool local)
582 {
583 private_ike_cfg_t *this = (private_ike_cfg_t*)cfg;
584 enumerator_t *enumerator;
585 host_t *host;
586 char *str;
587 bool found = FALSE;
588
589 if (local)
590 {
591 enumerator = this->my_hosts->create_enumerator(this->my_hosts);
592 }
593 else
594 {
595 enumerator = this->other_hosts->create_enumerator(this->other_hosts);
596 }
597 while (enumerator->enumerate(enumerator, &str))
598 {
599 host = host_create_from_string(str, 0);
600 if (host && addr->ip_equals(addr, host))
601 {
602 host->destroy(host);
603 found = TRUE;
604 break;
605 }
606 DESTROY_IF(host);
607 }
608 enumerator->destroy(enumerator);
609 return found;
610 }
611
612 /**
613 * Described in header.
614 */
615 ike_cfg_t *ike_cfg_create(ike_version_t version, bool certreq, bool force_encap,
616 char *me, uint16_t my_port,
617 char *other, uint16_t other_port,
618 fragmentation_t fragmentation, uint8_t dscp)
619 {
620 private_ike_cfg_t *this;
621
622 INIT(this,
623 .public = {
624 .get_version = _get_version,
625 .send_certreq = _send_certreq,
626 .force_encap = _force_encap_,
627 .fragmentation = _fragmentation,
628 .resolve_me = _resolve_me,
629 .resolve_other = _resolve_other,
630 .match_me = _match_me,
631 .match_other = _match_other,
632 .get_my_addr = _get_my_addr,
633 .get_other_addr = _get_other_addr,
634 .get_my_port = _get_my_port,
635 .get_other_port = _get_other_port,
636 .get_dscp = _get_dscp,
637 .add_proposal = _add_proposal,
638 .get_proposals = _get_proposals,
639 .select_proposal = _select_proposal,
640 .has_proposal = _has_proposal,
641 .get_dh_group = _get_dh_group,
642 .equals = _equals,
643 .get_ref = _get_ref,
644 .destroy = _destroy,
645 },
646 .refcount = 1,
647 .version = version,
648 .certreq = certreq,
649 .force_encap = force_encap,
650 .fragmentation = fragmentation,
651 .me = strdup(me),
652 .my_ranges = linked_list_create(),
653 .my_hosts = linked_list_create(),
654 .other = strdup(other),
655 .other_ranges = linked_list_create(),
656 .other_hosts = linked_list_create(),
657 .my_port = my_port,
658 .other_port = other_port,
659 .dscp = dscp,
660 .proposals = linked_list_create(),
661 );
662
663 parse_addresses(me, this->my_hosts, this->my_ranges);
664 parse_addresses(other, this->other_hosts, this->other_ranges);
665
666 return &this->public;
667 }