src/libcharon/sa/trap_manager.c

   1 /*
   2  * Copyright (C) 2011 Tobias Brunner
   3  * Copyright (C) 2009 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "trap_manager.h"
  18
  19 #include <hydra.h>
  20 #include <daemon.h>
  21 #include <threading/rwlock.h>
  22 #include <utils/linked_list.h>
  23
  24
  25 typedef struct private_trap_manager_t private_trap_manager_t;
  26 typedef struct trap_listener_t trap_listener_t;
  27
  28 /**
  29  * listener to track acquires
  30  */
  31 struct trap_listener_t {
  32
  33         /**
  34          * Implements listener interface
  35          */
  36         listener_t listener;
  37
  38         /**
  39          * points to trap_manager
  40          */
  41         private_trap_manager_t *traps;
  42 };
  43
  44 /**
  45  * Private data of an trap_manager_t object.
  46  */
  47 struct private_trap_manager_t {
  48
  49         /**
  50          * Public trap_manager_t interface.
  51          */
  52         trap_manager_t public;
  53
  54         /**
  55          * Installed traps, as entry_t
  56          */
  57         linked_list_t *traps;
  58
  59         /**
  60          * read write lock for traps list
  61          */
  62         rwlock_t *lock;
  63
  64         /**
  65          * listener to track acquiring IKE_SAs
  66          */
  67         trap_listener_t listener;
  68 };
  69
  70 /**
  71  * A installed trap entry
  72  */
  73 typedef struct {
  74         /** ref to peer_cfg to initiate */
  75         peer_cfg_t *peer_cfg;
  76         /** ref to instanciated CHILD_SA */
  77         child_sa_t *child_sa;
  78         /** TRUE if an acquire is pending */
  79         bool pending;
  80         /** pending IKE_SA connecting upon acquire */
  81         ike_sa_t *ike_sa;
  82 } entry_t;
  83
  84 /**
  85  * actually uninstall and destroy an installed entry
  86  */
  87 static void destroy_entry(entry_t *entry)
  88 {
  89         entry->child_sa->destroy(entry->child_sa);
  90         entry->peer_cfg->destroy(entry->peer_cfg);
  91         free(entry);
  92 }
  93
  94 METHOD(trap_manager_t, install, u_int32_t,
  95         private_trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child)
  96 {
  97         entry_t *entry;
  98         ike_cfg_t *ike_cfg;
  99         child_sa_t *child_sa;
 100         host_t *me, *other;
 101         linked_list_t *my_ts, *other_ts, *list;
 102         enumerator_t *enumerator;
 103         bool found = FALSE;
 104         status_t status;
 105         u_int32_t reqid;
 106
 107         /* check if not already done */
 108         this->lock->read_lock(this->lock);
 109         enumerator = this->traps->create_enumerator(this->traps);
 110         while (enumerator->enumerate(enumerator, &entry))
 111         {
 112                 if (streq(entry->child_sa->get_name(entry->child_sa),
 113                                   child->get_name(child)))
 114                 {
 115                         found = TRUE;
 116                         break;
 117                 }
 118         }
 119         enumerator->destroy(enumerator);
 120         this->lock->unlock(this->lock);
 121         if (found)
 122         {
 123                 DBG1(DBG_CFG, "CHILD_SA named '%s' already routed",
 124                          child->get_name(child));
 125                 return 0;
 126         }
 127
 128         /* try to resolve addresses */
 129         ike_cfg = peer->get_ike_cfg(peer);
 130         other = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg, NULL),
 131                                                                  0, ike_cfg->get_other_port(ike_cfg));
 132         if (!other || other->is_anyaddr(other))
 133         {
 134                 DBG1(DBG_CFG, "installing trap failed, remote address unknown");
 135                 return 0;
 136         }
 137         me = host_create_from_dns(ike_cfg->get_my_addr(ike_cfg, NULL),
 138                                         other->get_family(other), ike_cfg->get_my_port(ike_cfg));
 139         if (!me || me->is_anyaddr(me))
 140         {
 141                 DESTROY_IF(me);
 142                 me = hydra->kernel_interface->get_source_addr(
 143                                                                         hydra->kernel_interface, other, NULL);
 144                 if (!me)
 145                 {
 146                         DBG1(DBG_CFG, "installing trap failed, local address unknown");
 147                         other->destroy(other);
 148                         return 0;
 149                 }
 150                 me->set_port(me, ike_cfg->get_my_port(ike_cfg));
 151         }
 152
 153         /* create and route CHILD_SA */
 154         child_sa = child_sa_create(me, other, child, 0, FALSE);
 155
 156         list = linked_list_create_with_items(me, NULL);
 157         my_ts = child->get_traffic_selectors(child, TRUE, NULL, list);
 158         list->destroy_offset(list, offsetof(host_t, destroy));
 159
 160         list = linked_list_create_with_items(other, NULL);
 161         other_ts = child->get_traffic_selectors(child, FALSE, NULL, list);
 162         list->destroy_offset(list, offsetof(host_t, destroy));
 163
 164         /* while we don't know the finally negotiated protocol (ESP|AH), we
 165          * could iterate all proposals for a best guess (TODO). But as we
 166          * support ESP only for now, we set it here. */
 167         child_sa->set_protocol(child_sa, PROTO_ESP);
 168         child_sa->set_mode(child_sa, child->get_mode(child));
 169         status = child_sa->add_policies(child_sa, my_ts, other_ts);
 170         my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
 171         other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
 172         if (status != SUCCESS)
 173         {
 174                 child_sa->destroy(child_sa);
 175                 DBG1(DBG_CFG, "installing trap failed");
 176                 return 0;
 177         }
 178
 179         reqid = child_sa->get_reqid(child_sa);
 180         INIT(entry,
 181                 .child_sa = child_sa,
 182                 .peer_cfg = peer->get_ref(peer),
 183         );
 184
 185         this->lock->write_lock(this->lock);
 186         this->traps->insert_last(this->traps, entry);
 187         this->lock->unlock(this->lock);
 188
 189         return reqid;
 190 }
 191
 192 METHOD(trap_manager_t, uninstall, bool,
 193         private_trap_manager_t *this, u_int32_t reqid)
 194 {
 195         enumerator_t *enumerator;
 196         entry_t *entry, *found = NULL;
 197
 198         this->lock->write_lock(this->lock);
 199         enumerator = this->traps->create_enumerator(this->traps);
 200         while (enumerator->enumerate(enumerator, &entry))
 201         {
 202                 if (entry->child_sa->get_reqid(entry->child_sa) == reqid)
 203                 {
 204                         this->traps->remove_at(this->traps, enumerator);
 205                         found = entry;
 206                         break;
 207                 }
 208         }
 209         enumerator->destroy(enumerator);
 210         this->lock->unlock(this->lock);
 211
 212         if (!found)
 213         {
 214                 DBG1(DBG_CFG, "trap %d not found to uninstall", reqid);
 215                 return FALSE;
 216         }
 217
 218         destroy_entry(found);
 219         return TRUE;
 220 }
 221
 222 /**
 223  * convert enumerated entries to peer_cfg, child_sa
 224  */
 225 static bool trap_filter(rwlock_t *lock, entry_t **entry, peer_cfg_t **peer_cfg,
 226                                                 void *none, child_sa_t **child_sa)
 227 {
 228         if (peer_cfg)
 229         {
 230                 *peer_cfg = (*entry)->peer_cfg;
 231         }
 232         if (child_sa)
 233         {
 234                 *child_sa = (*entry)->child_sa;
 235         }
 236         return TRUE;
 237 }
 238
 239 METHOD(trap_manager_t, create_enumerator, enumerator_t*,
 240         private_trap_manager_t *this)
 241 {
 242         this->lock->read_lock(this->lock);
 243         return enumerator_create_filter(this->traps->create_enumerator(this->traps),
 244                                                                         (void*)trap_filter, this->lock,
 245                                                                         (void*)this->lock->unlock);
 246 }
 247
 248 METHOD(trap_manager_t, acquire, void,
 249         private_trap_manager_t *this, u_int32_t reqid,
 250         traffic_selector_t *src, traffic_selector_t *dst)
 251 {
 252         enumerator_t *enumerator;
 253         entry_t *entry, *found = NULL;
 254         peer_cfg_t *peer;
 255         child_cfg_t *child;
 256         ike_sa_t *ike_sa;
 257
 258         this->lock->read_lock(this->lock);
 259         enumerator = this->traps->create_enumerator(this->traps);
 260         while (enumerator->enumerate(enumerator, &entry))
 261         {
 262                 if (entry->child_sa->get_reqid(entry->child_sa) == reqid)
 263                 {
 264                         found = entry;
 265                         break;
 266                 }
 267         }
 268         enumerator->destroy(enumerator);
 269
 270         if (!found)
 271         {
 272                 DBG1(DBG_CFG, "trap not found, unable to acquire reqid %d",reqid);
 273                 this->lock->unlock(this->lock);
 274                 return;
 275         }
 276         if (!cas_bool(&found->pending, FALSE, TRUE))
 277         {
 278                 DBG1(DBG_CFG, "ignoring acquire, connection attempt pending");
 279                 this->lock->unlock(this->lock);
 280                 return;
 281         }
 282         peer = found->peer_cfg->get_ref(found->peer_cfg);
 283         child = found->child_sa->get_config(found->child_sa);
 284         child = child->get_ref(child);
 285         reqid = found->child_sa->get_reqid(found->child_sa);
 286         /* don't hold the lock while checking out the IKE_SA */
 287         this->lock->unlock(this->lock);
 288
 289         ike_sa = charon->ike_sa_manager->checkout_by_config(
 290                                                                                         charon->ike_sa_manager, peer);
 291         if (ike_sa)
 292         {
 293                 if (ike_sa->get_peer_cfg(ike_sa) == NULL)
 294                 {
 295                         ike_sa->set_peer_cfg(ike_sa, peer);
 296                 }
 297                 if (ike_sa->get_version(ike_sa) == IKEV1)
 298                 {       /* in IKEv1, don't prepend the acquiring packet TS, as we only
 299                          * have a single TS that we can establish in a Quick Mode. */
 300                         src = dst = NULL;
 301                 }
 302                 if (ike_sa->initiate(ike_sa, child, reqid, src, dst) != DESTROY_ME)
 303                 {
 304                         /* make sure the entry is still there */
 305                         this->lock->read_lock(this->lock);
 306                         if (this->traps->find_first(this->traps, NULL,
 307                                                                                 (void**)&found) == SUCCESS)
 308                         {
 309                                 found->ike_sa = ike_sa;
 310                         }
 311                         this->lock->unlock(this->lock);
 312                         charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
 313                 }
 314                 else
 315                 {
 316                         charon->ike_sa_manager->checkin_and_destroy(
 317                                                                                                 charon->ike_sa_manager, ike_sa);
 318                 }
 319         }
 320         peer->destroy(peer);
 321 }
 322
 323 /**
 324  * Complete the acquire, if successful or failed
 325  */
 326 static void complete(private_trap_manager_t *this, ike_sa_t *ike_sa,
 327                                          child_sa_t *child_sa)
 328 {
 329         enumerator_t *enumerator;
 330         entry_t *entry;
 331
 332         this->lock->read_lock(this->lock);
 333         enumerator = this->traps->create_enumerator(this->traps);
 334         while (enumerator->enumerate(enumerator, &entry))
 335         {
 336                 if (entry->ike_sa != ike_sa)
 337                 {
 338                         continue;
 339                 }
 340                 if (child_sa && child_sa->get_reqid(child_sa) !=
 341                                                                         entry->child_sa->get_reqid(entry->child_sa))
 342                 {
 343                         continue;
 344                 }
 345                 entry->ike_sa = NULL;
 346                 entry->pending = FALSE;
 347         }
 348         enumerator->destroy(enumerator);
 349         this->lock->unlock(this->lock);
 350 }
 351
 352 METHOD(listener_t, ike_state_change, bool,
 353         trap_listener_t *listener, ike_sa_t *ike_sa, ike_sa_state_t state)
 354 {
 355         switch (state)
 356         {
 357                 case IKE_DESTROYING:
 358                         complete(listener->traps, ike_sa, NULL);
 359                         return TRUE;
 360                 default:
 361                         return TRUE;
 362         }
 363 }
 364
 365 METHOD(listener_t, child_state_change, bool,
 366         trap_listener_t *listener, ike_sa_t *ike_sa, child_sa_t *child_sa,
 367         child_sa_state_t state)
 368 {
 369         switch (state)
 370         {
 371                 case CHILD_INSTALLED:
 372                 case CHILD_DESTROYING:
 373                         complete(listener->traps, ike_sa, child_sa);
 374                         return TRUE;
 375                 default:
 376                         return TRUE;
 377         }
 378 }
 379
 380 METHOD(trap_manager_t, flush, void,
 381         private_trap_manager_t *this)
 382 {
 383         linked_list_t *traps;
 384         /* since destroying the CHILD_SA results in events which require a read
 385          * lock we cannot destroy the list while holding the write lock */
 386         this->lock->write_lock(this->lock);
 387         traps = this->traps;
 388         this->traps = linked_list_create();
 389         this->lock->unlock(this->lock);
 390         traps->destroy_function(traps, (void*)destroy_entry);
 391 }
 392
 393 METHOD(trap_manager_t, destroy, void,
 394         private_trap_manager_t *this)
 395 {
 396         charon->bus->remove_listener(charon->bus, &this->listener.listener);
 397         this->traps->destroy_function(this->traps, (void*)destroy_entry);
 398         this->lock->destroy(this->lock);
 399         free(this);
 400 }
 401
 402 /**
 403  * See header
 404  */
 405 trap_manager_t *trap_manager_create(void)
 406 {
 407         private_trap_manager_t *this;
 408
 409         INIT(this,
 410                 .public = {
 411                         .install = _install,
 412                         .uninstall = _uninstall,
 413                         .create_enumerator = _create_enumerator,
 414                         .acquire = _acquire,
 415                         .flush = _flush,
 416                         .destroy = _destroy,
 417                 },
 418                 .listener = {
 419                         .traps = this,
 420                         .listener = {
 421                                 .ike_state_change = _ike_state_change,
 422                                 .child_state_change = _child_state_change,
 423                         },
 424                 },
 425                 .traps = linked_list_create(),
 426                 .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
 427         );
 428         charon->bus->add_listener(charon->bus, &this->listener.listener);
 429
 430         return &this->public;
 431 }
 432