child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs
[strongswan.git] / src / libcharon / sa / ikev2 / tasks / child_delete.c
1 /*
2 * Copyright (C) 2009-2016 Tobias Brunner
3 * Copyright (C) 2006-2007 Martin Willi
4 * HSR Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "child_delete.h"
18
19 #include <daemon.h>
20 #include <encoding/payloads/delete_payload.h>
21 #include <processing/jobs/delete_child_sa_job.h>
22 #include <sa/ikev2/tasks/child_create.h>
23 #include <sa/ikev2/tasks/child_rekey.h>
24
25 #ifndef DELETE_REKEYED_DELAY
26 #define DELETE_REKEYED_DELAY 5
27 #endif
28
29 typedef struct private_child_delete_t private_child_delete_t;
30
31 /**
32 * Private members of a child_delete_t task.
33 */
34 struct private_child_delete_t {
35
36 /**
37 * Public methods and task_t interface.
38 */
39 child_delete_t public;
40
41 /**
42 * Assigned IKE_SA.
43 */
44 ike_sa_t *ike_sa;
45
46 /**
47 * Whether we are the initiator of the exchange
48 */
49 bool initiator;
50
51 /**
52 * Protocol of CHILD_SA to delete (as initiator)
53 */
54 protocol_id_t protocol;
55
56 /**
57 * Inbound SPI of CHILD_SA to delete (as initiator)
58 */
59 uint32_t spi;
60
61 /**
62 * CHILD_SA already expired (as initiator)
63 */
64 bool expired;
65
66 /**
67 * CHILD_SAs which get deleted, entry_t*
68 */
69 linked_list_t *child_sas;
70 };
71
72 /**
73 * Information about a deleted CHILD_SA
74 */
75 typedef struct {
76 /** Deleted CHILD_SA */
77 child_sa_t *child_sa;
78 /** Whether the CHILD_SA was rekeyed */
79 bool rekeyed;
80 /** Whether to enforce any delete action policy */
81 bool check_delete_action;
82 } entry_t;
83
84 /**
85 * Check if the given entry is for the same CHILD_SA
86 */
87 static bool match_child(entry_t *entry, child_sa_t *child_sa)
88 {
89 return entry->child_sa == child_sa;
90 }
91
92 /**
93 * build the delete payloads from the listed child_sas
94 */
95 static void build_payloads(private_child_delete_t *this, message_t *message)
96 {
97 delete_payload_t *ah = NULL, *esp = NULL;
98 enumerator_t *enumerator;
99 entry_t *entry;
100 protocol_id_t protocol;
101 uint32_t spi;
102
103 enumerator = this->child_sas->create_enumerator(this->child_sas);
104 while (enumerator->enumerate(enumerator, (void**)&entry))
105 {
106 protocol = entry->child_sa->get_protocol(entry->child_sa);
107 spi = entry->child_sa->get_spi(entry->child_sa, TRUE);
108
109 switch (protocol)
110 {
111 case PROTO_ESP:
112 if (!esp)
113 {
114 esp = delete_payload_create(PLV2_DELETE, PROTO_ESP);
115 message->add_payload(message, (payload_t*)esp);
116 }
117 esp->add_spi(esp, spi);
118 DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
119 protocol_id_names, protocol, ntohl(spi));
120 break;
121 case PROTO_AH:
122 if (ah == NULL)
123 {
124 ah = delete_payload_create(PLV2_DELETE, PROTO_AH);
125 message->add_payload(message, (payload_t*)ah);
126 }
127 ah->add_spi(ah, spi);
128 DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
129 protocol_id_names, protocol, ntohl(spi));
130 break;
131 default:
132 break;
133 }
134 entry->child_sa->set_state(entry->child_sa, CHILD_DELETING);
135 }
136 enumerator->destroy(enumerator);
137 }
138
139 /**
140 * Check if the given CHILD_SA is the redundant SA created in a rekey collision.
141 */
142 static bool is_redundant(private_child_delete_t *this, child_sa_t *child)
143 {
144 enumerator_t *tasks;
145 task_t *task;
146
147 tasks = this->ike_sa->create_task_enumerator(this->ike_sa,
148 TASK_QUEUE_ACTIVE);
149 while (tasks->enumerate(tasks, &task))
150 {
151 if (task->get_type(task) == TASK_CHILD_REKEY)
152 {
153 child_rekey_t *rekey = (child_rekey_t*)task;
154
155 if (rekey->is_redundant(rekey, child))
156 {
157 tasks->destroy(tasks);
158 return TRUE;
159 }
160 }
161 }
162 tasks->destroy(tasks);
163 return FALSE;
164 }
165
166 /**
167 * Install the outbound CHILD_SA with the given SPI
168 */
169 static void install_outbound(private_child_delete_t *this,
170 protocol_id_t protocol, uint32_t spi)
171 {
172 child_sa_t *child_sa;
173 linked_list_t *my_ts, *other_ts;
174 status_t status;
175
176 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
177 spi, FALSE);
178 if (!child_sa)
179 {
180 DBG1(DBG_IKE, "CHILD_SA not found after rekeying");
181 return;
182 }
183 if (this->initiator && is_redundant(this, child_sa))
184 { /* if we won the rekey collision we don't want to install the
185 * redundant SA created by the peer */
186 return;
187 }
188
189 status = child_sa->install_outbound(child_sa);
190 if (status != SUCCESS)
191 {
192 DBG1(DBG_IKE, "unable to install outbound IPsec SA (SAD) in kernel");
193 charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED,
194 child_sa);
195 /* FIXME: delete the new child_sa? */
196 return;
197 }
198 child_sa->set_state(child_sa, CHILD_INSTALLED);
199
200 my_ts = linked_list_create_from_enumerator(
201 child_sa->create_ts_enumerator(child_sa, TRUE));
202 other_ts = linked_list_create_from_enumerator(
203 child_sa->create_ts_enumerator(child_sa, FALSE));
204
205 DBG0(DBG_IKE, "outbound CHILD_SA %s{%d} established "
206 "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
207 child_sa->get_name(child_sa),
208 child_sa->get_unique_id(child_sa),
209 ntohl(child_sa->get_spi(child_sa, TRUE)),
210 ntohl(child_sa->get_spi(child_sa, FALSE)),
211 my_ts, other_ts);
212
213 my_ts->destroy(my_ts);
214 other_ts->destroy(other_ts);
215 }
216
217 /**
218 * read in payloads and find the children to delete
219 */
220 static void process_payloads(private_child_delete_t *this, message_t *message)
221 {
222 enumerator_t *payloads, *spis;
223 payload_t *payload;
224 delete_payload_t *delete_payload;
225 uint32_t spi;
226 protocol_id_t protocol;
227 child_sa_t *child_sa;
228 entry_t *entry;
229
230 payloads = message->create_payload_enumerator(message);
231 while (payloads->enumerate(payloads, &payload))
232 {
233 if (payload->get_type(payload) == PLV2_DELETE)
234 {
235 delete_payload = (delete_payload_t*)payload;
236 protocol = delete_payload->get_protocol_id(delete_payload);
237 if (protocol != PROTO_ESP && protocol != PROTO_AH)
238 {
239 continue;
240 }
241 spis = delete_payload->create_spi_enumerator(delete_payload);
242 while (spis->enumerate(spis, &spi))
243 {
244 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
245 spi, FALSE);
246 if (!child_sa)
247 {
248 DBG1(DBG_IKE, "received DELETE for unknown %N CHILD_SA with"
249 " SPI %.8x", protocol_id_names, protocol, ntohl(spi));
250 continue;
251 }
252 DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x",
253 protocol_id_names, protocol, ntohl(spi));
254
255 if (this->child_sas->find_first(this->child_sas,
256 (void*)match_child, NULL, child_sa) == SUCCESS)
257 {
258 continue;
259 }
260 INIT(entry,
261 .child_sa = child_sa
262 );
263 switch (child_sa->get_state(child_sa))
264 {
265 case CHILD_REKEYED:
266 entry->rekeyed = TRUE;
267 break;
268 case CHILD_DELETING:
269 /* we don't send back a delete if we already initiated
270 * a delete ourself */
271 if (!this->initiator)
272 {
273 free(entry);
274 continue;
275 }
276 break;
277 case CHILD_REKEYING:
278 /* we reply as usual, rekeying will fail */
279 case CHILD_INSTALLED:
280 if (!this->initiator)
281 {
282 if (is_redundant(this, child_sa))
283 {
284 entry->rekeyed = TRUE;
285 }
286 else
287 {
288 entry->check_delete_action = TRUE;
289 }
290 }
291 break;
292 default:
293 break;
294 }
295 this->child_sas->insert_last(this->child_sas, entry);
296 }
297 spis->destroy(spis);
298 }
299 }
300 payloads->destroy(payloads);
301 }
302
303 /**
304 * destroy the children listed in this->child_sas, reestablish by policy
305 */
306 static status_t destroy_and_reestablish(private_child_delete_t *this)
307 {
308 enumerator_t *enumerator;
309 entry_t *entry;
310 child_sa_t *child_sa;
311 child_cfg_t *child_cfg;
312 protocol_id_t protocol;
313 uint32_t spi, reqid, rekey_spi;
314 action_t action;
315 status_t status = SUCCESS;
316 time_t now, expire;
317 u_int delay;
318
319 now = time_monotonic(NULL);
320 delay = lib->settings->get_int(lib->settings, "%s.delete_rekeyed_delay",
321 DELETE_REKEYED_DELAY, lib->ns);
322
323 enumerator = this->child_sas->create_enumerator(this->child_sas);
324 while (enumerator->enumerate(enumerator, (void**)&entry))
325 {
326 child_sa = entry->child_sa;
327 /* signal child down event if we weren't rekeying */
328 protocol = child_sa->get_protocol(child_sa);
329 if (!entry->rekeyed)
330 {
331 charon->bus->child_updown(charon->bus, child_sa, FALSE);
332 }
333 else
334 {
335 rekey_spi = child_sa->get_rekey_spi(child_sa);
336 if (rekey_spi)
337 {
338 install_outbound(this, protocol, rekey_spi);
339 }
340 /* for rekeyed CHILD_SAs we uninstall the outbound SA but don't
341 * immediately destroy it, by default, so we can process delayed
342 * packets */
343 child_sa->remove_outbound(child_sa);
344 expire = child_sa->get_lifetime(child_sa, TRUE);
345 if (delay && (!expire || ((now + delay) < expire)))
346 {
347 lib->scheduler->schedule_job(lib->scheduler,
348 (job_t*)delete_child_sa_job_create_id(
349 child_sa->get_unique_id(child_sa)), delay);
350 continue;
351 }
352 else if (expire)
353 { /* let it expire naturally */
354 continue;
355 }
356 /* no delay and no lifetime, destroy it immediately */
357 }
358 spi = child_sa->get_spi(child_sa, TRUE);
359 reqid = child_sa->get_reqid(child_sa);
360 child_cfg = child_sa->get_config(child_sa);
361 child_cfg->get_ref(child_cfg);
362 action = child_sa->get_close_action(child_sa);
363
364 this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
365
366 if (entry->check_delete_action)
367 { /* enforce child_cfg policy if deleted passively */
368 switch (action)
369 {
370 case ACTION_RESTART:
371 child_cfg->get_ref(child_cfg);
372 status = this->ike_sa->initiate(this->ike_sa, child_cfg,
373 reqid, NULL, NULL);
374 break;
375 case ACTION_ROUTE:
376 charon->traps->install(charon->traps,
377 this->ike_sa->get_peer_cfg(this->ike_sa), child_cfg,
378 reqid);
379 break;
380 default:
381 break;
382 }
383 }
384 child_cfg->destroy(child_cfg);
385 if (status != SUCCESS)
386 {
387 break;
388 }
389 }
390 enumerator->destroy(enumerator);
391 return status;
392 }
393
394 /**
395 * send closing signals for all CHILD_SAs over the bus
396 */
397 static void log_children(private_child_delete_t *this)
398 {
399 linked_list_t *my_ts, *other_ts;
400 enumerator_t *enumerator;
401 entry_t *entry;
402 child_sa_t *child_sa;
403 uint64_t bytes_in, bytes_out;
404
405 enumerator = this->child_sas->create_enumerator(this->child_sas);
406 while (enumerator->enumerate(enumerator, (void**)&entry))
407 {
408 child_sa = entry->child_sa;
409 my_ts = linked_list_create_from_enumerator(
410 child_sa->create_ts_enumerator(child_sa, TRUE));
411 other_ts = linked_list_create_from_enumerator(
412 child_sa->create_ts_enumerator(child_sa, FALSE));
413 if (this->expired)
414 {
415 DBG0(DBG_IKE, "closing expired CHILD_SA %s{%d} "
416 "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
417 child_sa->get_name(child_sa), child_sa->get_unique_id(child_sa),
418 ntohl(child_sa->get_spi(child_sa, TRUE)),
419 ntohl(child_sa->get_spi(child_sa, FALSE)), my_ts, other_ts);
420 }
421 else
422 {
423 child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in, NULL);
424 child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out, NULL);
425
426 DBG0(DBG_IKE, "closing CHILD_SA %s{%d} with SPIs %.8x_i "
427 "(%llu bytes) %.8x_o (%llu bytes) and TS %#R === %#R",
428 child_sa->get_name(child_sa), child_sa->get_unique_id(child_sa),
429 ntohl(child_sa->get_spi(child_sa, TRUE)), bytes_in,
430 ntohl(child_sa->get_spi(child_sa, FALSE)), bytes_out,
431 my_ts, other_ts);
432 }
433 my_ts->destroy(my_ts);
434 other_ts->destroy(other_ts);
435 }
436 enumerator->destroy(enumerator);
437 }
438
439 METHOD(task_t, build_i, status_t,
440 private_child_delete_t *this, message_t *message)
441 {
442 child_sa_t *child_sa;
443 entry_t *entry;
444
445 child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
446 this->spi, TRUE);
447 if (!child_sa)
448 { /* check if it is an outbound sa */
449 child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
450 this->spi, FALSE);
451 if (!child_sa)
452 { /* child does not exist anymore */
453 return SUCCESS;
454 }
455 /* we work only with the inbound SPI */
456 this->spi = child_sa->get_spi(child_sa, TRUE);
457 }
458
459 if (child_sa->get_state(child_sa) == CHILD_DELETING)
460 { /* DELETEs for this CHILD_SA were already exchanged, but it was not yet
461 * destroyed to allow delayed packets to get processed */
462 this->ike_sa->destroy_child_sa(this->ike_sa, this->protocol, this->spi);
463 message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
464 return SUCCESS;
465 }
466
467 INIT(entry,
468 .child_sa = child_sa,
469 .rekeyed = child_sa->get_state(child_sa) == CHILD_REKEYED,
470 );
471 this->child_sas->insert_last(this->child_sas, entry);
472 log_children(this);
473 build_payloads(this, message);
474
475 if (!entry->rekeyed && this->expired)
476 {
477 child_cfg_t *child_cfg;
478
479 DBG1(DBG_IKE, "scheduling CHILD_SA recreate after hard expire");
480 child_cfg = child_sa->get_config(child_sa);
481 this->ike_sa->queue_task(this->ike_sa, (task_t*)
482 child_create_create(this->ike_sa, child_cfg->get_ref(child_cfg),
483 FALSE, NULL, NULL));
484 }
485 return NEED_MORE;
486 }
487
488 METHOD(task_t, process_i, status_t,
489 private_child_delete_t *this, message_t *message)
490 {
491 process_payloads(this, message);
492 DBG1(DBG_IKE, "CHILD_SA closed");
493 return destroy_and_reestablish(this);
494 }
495
496 METHOD(task_t, process_r, status_t,
497 private_child_delete_t *this, message_t *message)
498 {
499 process_payloads(this, message);
500 log_children(this);
501 return NEED_MORE;
502 }
503
504 METHOD(task_t, build_r, status_t,
505 private_child_delete_t *this, message_t *message)
506 {
507 build_payloads(this, message);
508 DBG1(DBG_IKE, "CHILD_SA closed");
509 return destroy_and_reestablish(this);
510 }
511
512 METHOD(task_t, get_type, task_type_t,
513 private_child_delete_t *this)
514 {
515 return TASK_CHILD_DELETE;
516 }
517
518 METHOD(child_delete_t , get_child, child_sa_t*,
519 private_child_delete_t *this)
520 {
521 child_sa_t *child_sa = NULL;
522 entry_t *entry;
523
524 if (this->child_sas->get_first(this->child_sas, (void**)&entry) == SUCCESS)
525 {
526 child_sa = entry->child_sa;
527 }
528 return child_sa;
529 }
530
531 METHOD(task_t, migrate, void,
532 private_child_delete_t *this, ike_sa_t *ike_sa)
533 {
534 this->ike_sa = ike_sa;
535
536 this->child_sas->destroy_function(this->child_sas, free);
537 this->child_sas = linked_list_create();
538 }
539
540 METHOD(task_t, destroy, void,
541 private_child_delete_t *this)
542 {
543 this->child_sas->destroy_function(this->child_sas, free);
544 free(this);
545 }
546
547 /*
548 * Described in header.
549 */
550 child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
551 uint32_t spi, bool expired)
552 {
553 private_child_delete_t *this;
554
555 INIT(this,
556 .public = {
557 .task = {
558 .get_type = _get_type,
559 .migrate = _migrate,
560 .destroy = _destroy,
561 },
562 .get_child = _get_child,
563 },
564 .ike_sa = ike_sa,
565 .child_sas = linked_list_create(),
566 .protocol = protocol,
567 .spi = spi,
568 .expired = expired,
569 );
570
571 if (protocol != PROTO_NONE)
572 {
573 this->public.task.build = _build_i;
574 this->public.task.process = _process_i;
575 this->initiator = TRUE;
576 }
577 else
578 {
579 this->public.task.build = _build_r;
580 this->public.task.process = _process_r;
581 this->initiator = FALSE;
582 }
583 return &this->public;
584 }