Derive a dynamic TS to multiple virtual IPs
[strongswan.git] / src / libcharon / sa / trap_manager.c
1 /*
2 * Copyright (C) 2011 Tobias Brunner
3 * Copyright (C) 2009 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "trap_manager.h"
18
19 #include <hydra.h>
20 #include <daemon.h>
21 #include <threading/rwlock.h>
22 #include <utils/linked_list.h>
23
24
25 typedef struct private_trap_manager_t private_trap_manager_t;
26 typedef struct trap_listener_t trap_listener_t;
27
28 /**
29 * listener to track acquires
30 */
31 struct trap_listener_t {
32
33 /**
34 * Implements listener interface
35 */
36 listener_t listener;
37
38 /**
39 * points to trap_manager
40 */
41 private_trap_manager_t *traps;
42 };
43
44 /**
45 * Private data of an trap_manager_t object.
46 */
47 struct private_trap_manager_t {
48
49 /**
50 * Public trap_manager_t interface.
51 */
52 trap_manager_t public;
53
54 /**
55 * Installed traps, as entry_t
56 */
57 linked_list_t *traps;
58
59 /**
60 * read write lock for traps list
61 */
62 rwlock_t *lock;
63
64 /**
65 * listener to track acquiring IKE_SAs
66 */
67 trap_listener_t listener;
68 };
69
70 /**
71 * A installed trap entry
72 */
73 typedef struct {
74 /** ref to peer_cfg to initiate */
75 peer_cfg_t *peer_cfg;
76 /** ref to instanciated CHILD_SA */
77 child_sa_t *child_sa;
78 /** TRUE if an acquire is pending */
79 bool pending;
80 /** pending IKE_SA connecting upon acquire */
81 ike_sa_t *ike_sa;
82 } entry_t;
83
84 /**
85 * actually uninstall and destroy an installed entry
86 */
87 static void destroy_entry(entry_t *entry)
88 {
89 entry->child_sa->destroy(entry->child_sa);
90 entry->peer_cfg->destroy(entry->peer_cfg);
91 free(entry);
92 }
93
94 METHOD(trap_manager_t, install, u_int32_t,
95 private_trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child)
96 {
97 entry_t *entry;
98 ike_cfg_t *ike_cfg;
99 child_sa_t *child_sa;
100 host_t *me, *other;
101 linked_list_t *my_ts, *other_ts, *list;
102 enumerator_t *enumerator;
103 bool found = FALSE;
104 status_t status;
105 u_int32_t reqid;
106
107 /* check if not already done */
108 this->lock->read_lock(this->lock);
109 enumerator = this->traps->create_enumerator(this->traps);
110 while (enumerator->enumerate(enumerator, &entry))
111 {
112 if (streq(entry->child_sa->get_name(entry->child_sa),
113 child->get_name(child)))
114 {
115 found = TRUE;
116 break;
117 }
118 }
119 enumerator->destroy(enumerator);
120 this->lock->unlock(this->lock);
121 if (found)
122 {
123 DBG1(DBG_CFG, "CHILD_SA named '%s' already routed",
124 child->get_name(child));
125 return 0;
126 }
127
128 /* try to resolve addresses */
129 ike_cfg = peer->get_ike_cfg(peer);
130 other = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg, NULL),
131 0, ike_cfg->get_other_port(ike_cfg));
132 if (!other || other->is_anyaddr(other))
133 {
134 DBG1(DBG_CFG, "installing trap failed, remote address unknown");
135 return 0;
136 }
137 me = host_create_from_dns(ike_cfg->get_my_addr(ike_cfg, NULL),
138 other->get_family(other), ike_cfg->get_my_port(ike_cfg));
139 if (!me || me->is_anyaddr(me))
140 {
141 DESTROY_IF(me);
142 me = hydra->kernel_interface->get_source_addr(
143 hydra->kernel_interface, other, NULL);
144 if (!me)
145 {
146 DBG1(DBG_CFG, "installing trap failed, local address unknown");
147 other->destroy(other);
148 return 0;
149 }
150 me->set_port(me, ike_cfg->get_my_port(ike_cfg));
151 }
152
153 /* create and route CHILD_SA */
154 child_sa = child_sa_create(me, other, child, 0, FALSE);
155
156 list = linked_list_create_with_items(me, NULL);
157 my_ts = child->get_traffic_selectors(child, TRUE, NULL, list);
158 list->destroy_offset(list, offsetof(host_t, destroy));
159
160 list = linked_list_create_with_items(other, NULL);
161 other_ts = child->get_traffic_selectors(child, FALSE, NULL, list);
162 list->destroy_offset(list, offsetof(host_t, destroy));
163
164 /* while we don't know the finally negotiated protocol (ESP|AH), we
165 * could iterate all proposals for a best guess (TODO). But as we
166 * support ESP only for now, we set it here. */
167 child_sa->set_protocol(child_sa, PROTO_ESP);
168 child_sa->set_mode(child_sa, child->get_mode(child));
169 status = child_sa->add_policies(child_sa, my_ts, other_ts);
170 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
171 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
172 if (status != SUCCESS)
173 {
174 child_sa->destroy(child_sa);
175 DBG1(DBG_CFG, "installing trap failed");
176 return 0;
177 }
178
179 reqid = child_sa->get_reqid(child_sa);
180 INIT(entry,
181 .child_sa = child_sa,
182 .peer_cfg = peer->get_ref(peer),
183 );
184
185 this->lock->write_lock(this->lock);
186 this->traps->insert_last(this->traps, entry);
187 this->lock->unlock(this->lock);
188
189 return reqid;
190 }
191
192 METHOD(trap_manager_t, uninstall, bool,
193 private_trap_manager_t *this, u_int32_t reqid)
194 {
195 enumerator_t *enumerator;
196 entry_t *entry, *found = NULL;
197
198 this->lock->write_lock(this->lock);
199 enumerator = this->traps->create_enumerator(this->traps);
200 while (enumerator->enumerate(enumerator, &entry))
201 {
202 if (entry->child_sa->get_reqid(entry->child_sa) == reqid)
203 {
204 this->traps->remove_at(this->traps, enumerator);
205 found = entry;
206 break;
207 }
208 }
209 enumerator->destroy(enumerator);
210 this->lock->unlock(this->lock);
211
212 if (!found)
213 {
214 DBG1(DBG_CFG, "trap %d not found to uninstall", reqid);
215 return FALSE;
216 }
217
218 destroy_entry(found);
219 return TRUE;
220 }
221
222 /**
223 * convert enumerated entries to peer_cfg, child_sa
224 */
225 static bool trap_filter(rwlock_t *lock, entry_t **entry, peer_cfg_t **peer_cfg,
226 void *none, child_sa_t **child_sa)
227 {
228 if (peer_cfg)
229 {
230 *peer_cfg = (*entry)->peer_cfg;
231 }
232 if (child_sa)
233 {
234 *child_sa = (*entry)->child_sa;
235 }
236 return TRUE;
237 }
238
239 METHOD(trap_manager_t, create_enumerator, enumerator_t*,
240 private_trap_manager_t *this)
241 {
242 this->lock->read_lock(this->lock);
243 return enumerator_create_filter(this->traps->create_enumerator(this->traps),
244 (void*)trap_filter, this->lock,
245 (void*)this->lock->unlock);
246 }
247
248 METHOD(trap_manager_t, acquire, void,
249 private_trap_manager_t *this, u_int32_t reqid,
250 traffic_selector_t *src, traffic_selector_t *dst)
251 {
252 enumerator_t *enumerator;
253 entry_t *entry, *found = NULL;
254 peer_cfg_t *peer;
255 child_cfg_t *child;
256 ike_sa_t *ike_sa;
257
258 this->lock->read_lock(this->lock);
259 enumerator = this->traps->create_enumerator(this->traps);
260 while (enumerator->enumerate(enumerator, &entry))
261 {
262 if (entry->child_sa->get_reqid(entry->child_sa) == reqid)
263 {
264 found = entry;
265 break;
266 }
267 }
268 enumerator->destroy(enumerator);
269
270 if (!found)
271 {
272 DBG1(DBG_CFG, "trap not found, unable to acquire reqid %d",reqid);
273 this->lock->unlock(this->lock);
274 return;
275 }
276 if (!cas_bool(&found->pending, FALSE, TRUE))
277 {
278 DBG1(DBG_CFG, "ignoring acquire, connection attempt pending");
279 this->lock->unlock(this->lock);
280 return;
281 }
282 peer = found->peer_cfg->get_ref(found->peer_cfg);
283 child = found->child_sa->get_config(found->child_sa);
284 child = child->get_ref(child);
285 reqid = found->child_sa->get_reqid(found->child_sa);
286 /* don't hold the lock while checking out the IKE_SA */
287 this->lock->unlock(this->lock);
288
289 ike_sa = charon->ike_sa_manager->checkout_by_config(
290 charon->ike_sa_manager, peer);
291 if (ike_sa)
292 {
293 if (ike_sa->get_peer_cfg(ike_sa) == NULL)
294 {
295 ike_sa->set_peer_cfg(ike_sa, peer);
296 }
297 if (ike_sa->get_version(ike_sa) == IKEV1)
298 { /* in IKEv1, don't prepend the acquiring packet TS, as we only
299 * have a single TS that we can establish in a Quick Mode. */
300 src = dst = NULL;
301 }
302 if (ike_sa->initiate(ike_sa, child, reqid, src, dst) != DESTROY_ME)
303 {
304 /* make sure the entry is still there */
305 this->lock->read_lock(this->lock);
306 if (this->traps->find_first(this->traps, NULL,
307 (void**)&found) == SUCCESS)
308 {
309 found->ike_sa = ike_sa;
310 }
311 this->lock->unlock(this->lock);
312 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
313 }
314 else
315 {
316 charon->ike_sa_manager->checkin_and_destroy(
317 charon->ike_sa_manager, ike_sa);
318 }
319 }
320 peer->destroy(peer);
321 }
322
323 /**
324 * Complete the acquire, if successful or failed
325 */
326 static void complete(private_trap_manager_t *this, ike_sa_t *ike_sa,
327 child_sa_t *child_sa)
328 {
329 enumerator_t *enumerator;
330 entry_t *entry;
331
332 this->lock->read_lock(this->lock);
333 enumerator = this->traps->create_enumerator(this->traps);
334 while (enumerator->enumerate(enumerator, &entry))
335 {
336 if (entry->ike_sa != ike_sa)
337 {
338 continue;
339 }
340 if (child_sa && child_sa->get_reqid(child_sa) !=
341 entry->child_sa->get_reqid(entry->child_sa))
342 {
343 continue;
344 }
345 entry->ike_sa = NULL;
346 entry->pending = FALSE;
347 }
348 enumerator->destroy(enumerator);
349 this->lock->unlock(this->lock);
350 }
351
352 METHOD(listener_t, ike_state_change, bool,
353 trap_listener_t *listener, ike_sa_t *ike_sa, ike_sa_state_t state)
354 {
355 switch (state)
356 {
357 case IKE_DESTROYING:
358 complete(listener->traps, ike_sa, NULL);
359 return TRUE;
360 default:
361 return TRUE;
362 }
363 }
364
365 METHOD(listener_t, child_state_change, bool,
366 trap_listener_t *listener, ike_sa_t *ike_sa, child_sa_t *child_sa,
367 child_sa_state_t state)
368 {
369 switch (state)
370 {
371 case CHILD_INSTALLED:
372 case CHILD_DESTROYING:
373 complete(listener->traps, ike_sa, child_sa);
374 return TRUE;
375 default:
376 return TRUE;
377 }
378 }
379
380 METHOD(trap_manager_t, flush, void,
381 private_trap_manager_t *this)
382 {
383 linked_list_t *traps;
384 /* since destroying the CHILD_SA results in events which require a read
385 * lock we cannot destroy the list while holding the write lock */
386 this->lock->write_lock(this->lock);
387 traps = this->traps;
388 this->traps = linked_list_create();
389 this->lock->unlock(this->lock);
390 traps->destroy_function(traps, (void*)destroy_entry);
391 }
392
393 METHOD(trap_manager_t, destroy, void,
394 private_trap_manager_t *this)
395 {
396 charon->bus->remove_listener(charon->bus, &this->listener.listener);
397 this->traps->destroy_function(this->traps, (void*)destroy_entry);
398 this->lock->destroy(this->lock);
399 free(this);
400 }
401
402 /**
403 * See header
404 */
405 trap_manager_t *trap_manager_create(void)
406 {
407 private_trap_manager_t *this;
408
409 INIT(this,
410 .public = {
411 .install = _install,
412 .uninstall = _uninstall,
413 .create_enumerator = _create_enumerator,
414 .acquire = _acquire,
415 .flush = _flush,
416 .destroy = _destroy,
417 },
418 .listener = {
419 .traps = this,
420 .listener = {
421 .ike_state_change = _ike_state_change,
422 .child_state_change = _child_state_change,
423 },
424 },
425 .traps = linked_list_create(),
426 .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
427 );
428 charon->bus->add_listener(charon->bus, &this->listener.listener);
429
430 return &this->public;
431 }
432