ae6356db1d989aa2d564a85ab367d0779c4c58eb
[strongswan.git] / src / pluto / connections.h
1 /* information about connections between hosts and clients
2 * Copyright (C) 1998-2001 D. Hugh Redelmeier
3 * Copyright (C) 2009 Andreas Steffen - Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #ifndef _CONNECTIONS_H
17 #define _CONNECTIONS_H
18
19 #include <sys/queue.h>
20
21 #include <utils/linked_list.h>
22 #include <utils/identification.h>
23 #include <credentials/ietf_attributes/ietf_attributes.h>
24
25 #include "certs.h"
26 #include "smartcard.h"
27 #include "whack.h"
28
29 /* There are two kinds of connections:
30 * - ISAKMP connections, between hosts (for IKE communication)
31 * - IPsec connections, between clients (for secure IP communication)
32 *
33 * An ISAKMP connection looks like:
34 * host<--->host
35 *
36 * An IPsec connection looks like:
37 * client-subnet<-->host<->nexthop<--->nexthop<->host<-->client-subnet
38 *
39 * For the connection to be relevant to this instance of Pluto,
40 * exactly one of the hosts must be a public interface of our machine
41 * known to this instance.
42 *
43 * The client subnet might simply be the host -- this is a
44 * representation of "host mode".
45 *
46 * Each nexthop defaults to the neighbouring host's IP address.
47 * The nexthop is a property of the pair of hosts, not each
48 * individually. It is only needed for IPsec because of the
49 * way IPsec is mixed into the kernel routing logic. Furthermore,
50 * only this end's nexthop is actually used. Eventually, nexthop
51 * will be unnecessary.
52 *
53 * Other information represented:
54 * - each connection has a name: a chunk of uninterpreted text
55 * that is unique for each connection.
56 * - security requirements (currently just the "policy" flags from
57 * the whack command to initiate the connection, but eventually
58 * much more. Different for ISAKMP and IPsec connections.
59 * - rekeying parameters:
60 * + time an SA may live
61 * + time before SA death that a rekeying should be attempted
62 * (only by the initiator)
63 * + number of times to attempt rekeying
64 * - With the current KLIPS, we must route packets for a client
65 * subnet through the ipsec interface (ipsec0). Only one
66 * gateway can get traffic for a specific (client) subnet.
67 * Furthermore, if the routing isn't in place, packets will
68 * be sent in the clear.
69 * "routing" indicates whether the routing has been done for
70 * this connection. Note that several connections may claim
71 * the same routing, as long as they agree about where the
72 * packets are to be sent.
73 * - With the current KLIPS, only one outbound IPsec SA bundle can be
74 * used for a particular client. This is due to a limitation
75 * of using only routing for selection. So only one IPsec state (SA)
76 * may "own" the eroute. "eroute_owner" is the serial number of
77 * this state, SOS_NOBODY if there is none. "routing" indicates
78 * what kind of erouting has been done for this connection, if any.
79 *
80 * Details on routing is in constants.h
81 *
82 * Operations on Connections:
83 *
84 * - add a new connection (with all details) [whack command]
85 * - delete a connection (by name) [whack command]
86 * - initiate a connection (by name) [whack command]
87 * - find a connection (by IP addresses of hosts)
88 * [response to peer request; finding ISAKMP connection for IPsec connection]
89 *
90 * Some connections are templates, missing the address of the peer
91 * (represented by INADDR_ANY). These are always arranged so that the
92 * missing end is "that" (there can only be one missing end). These can
93 * be instantiated (turned into real connections) by Pluto in one of two
94 * different ways: Road Warrior Instantiation or Opportunistic
95 * Instantiation. A template connection is marked for Opportunistic
96 * Instantiation by specifying the peer client as 0.0.0.0/32 (or the IPV6
97 * equivalent). Otherwise, it is suitable for Road Warrior Instantiation.
98 *
99 * Instantiation creates a new temporary connection, with the missing
100 * details filled in. The resulting template lasts only as long as there
101 * is a state that uses it.
102 */
103
104 /* connection policy priority: how important this policy is
105 * - used to implement eroute-like precedence (augmented by a small
106 * bonus for a routed connection).
107 * - a whole number
108 * - larger is more important
109 * - three subcomponents. In order of decreasing significance:
110 * + length of source subnet mask (8 bits)
111 * + length of destination subnet mask (8 bits)
112 * + bias (8 bit)
113 * - a bias of 1 is added to allow prio BOTTOM_PRIO to be less than all
114 * normal priorities
115 * - other bias values are created on the fly to give mild preference
116 * to certaion conditions (eg. routedness)
117 * - priority is inherited -- an instance of a policy has the same priority
118 * as the original policy, even though its subnets might be smaller.
119 * - display format: n,m
120 */
121 typedef unsigned long policy_prio_t;
122 #define BOTTOM_PRIO ((policy_prio_t)0) /* smaller than any real prio */
123 #define set_policy_prio(c) { (c)->prio = \
124 ((policy_prio_t)(c)->spd.this.client.maskbits << 16) \
125 | ((policy_prio_t)(c)->spd.that.client.maskbits << 8) \
126 | (policy_prio_t)1; }
127 #define POLICY_PRIO_BUF (3+1+3+1)
128 extern void fmt_policy_prio(policy_prio_t pp, char buf[POLICY_PRIO_BUF]);
129
130 struct virtual_t;
131
132 struct end {
133 identification_t *id;
134 ip_address
135 host_addr,
136 host_nexthop,
137 host_srcip;
138 ip_subnet client;
139
140 bool is_left;
141 bool key_from_DNS_on_demand;
142 bool has_client;
143 bool has_client_wildcard;
144 bool has_port_wildcard;
145 bool has_id_wildcards;
146 bool has_natip;
147 char *updown;
148 u_int16_t host_port; /* host order */
149 u_int16_t port; /* host order */
150 u_int8_t protocol;
151 cert_t *cert; /* end certificate */
152 identification_t *ca; /* CA distinguished name */
153 ietf_attributes_t *groups; /* access control groups */
154 smartcard_t *sc; /* smartcard reader and key info */
155 struct virtual_t *virt;
156 bool modecfg; /* this end: request local address from server */
157 /* that end: give local addresses to clients */
158 char *pool; /* name of an associated virtual IP address pool */
159 bool hostaccess; /* allow access to host via iptables INPUT/OUTPUT */
160 /* rules if client behind host is a subnet */
161 bool allow_any; /* IP address is subject to change */
162 certpolicy_t sendcert; /* whether or not to send the certificate */
163 };
164
165 struct spd_route {
166 struct spd_route *next;
167 struct end this;
168 struct end that;
169 so_serial_t eroute_owner;
170 enum routing_t routing; /* level of routing in place */
171 uint32_t reqid;
172 };
173
174 typedef struct connection connection_t;
175
176 struct connection {
177 char *name;
178 bool ikev1;
179
180 lset_t policy;
181 time_t sa_ike_life_seconds;
182 time_t sa_ipsec_life_seconds;
183 time_t sa_rekey_margin;
184 unsigned long sa_rekey_fuzz;
185 unsigned long sa_keying_tries;
186
187 /* RFC 3706 DPD */
188 time_t dpd_delay;
189 time_t dpd_timeout;
190 dpd_action_t dpd_action;
191
192 char *log_file_name; /* name of log file */
193 FILE *log_file; /* possibly open FILE */
194 TAILQ_ENTRY(connection) log_link; /* linked list of open conns */
195 bool log_file_err; /* only bitch once */
196
197 struct spd_route spd;
198
199 /* internal fields: */
200
201 unsigned long instance_serial;
202 policy_prio_t prio;
203 bool instance_initiation_ok; /* this is an instance of a policy that mandates initiate */
204 enum connection_kind kind;
205 const struct iface *interface; /* filled in iff oriented */
206
207 so_serial_t /* state object serial number */
208 newest_isakmp_sa,
209 newest_ipsec_sa;
210
211
212 #ifdef DEBUG
213 lset_t extra_debugging;
214 #endif
215
216 /* note: if the client is the gateway, the following must be equal */
217 sa_family_t addr_family; /* between gateways */
218 sa_family_t tunnel_addr_family; /* between clients */
219
220 connection_t *policy_next; /* if multiple policies,
221 next one to apply */
222 struct gw_info *gw_info;
223 struct alg_info_esp *alg_info_esp;
224 struct alg_info_ike *alg_info_ike;
225 struct host_pair *host_pair;
226 connection_t *hp_next; /* host pair list link */
227 connection_t *ac_next; /* all connections list link */
228 linked_list_t *requested_ca; /* collected certificate requests */
229 linked_list_t *requested; /* requested attributes with handlers */
230 linked_list_t *attributes; /* configuration attributes with handlers */
231 bool got_certrequest;
232 };
233
234 #define oriented(c) ((c).interface != NULL)
235 extern bool orient(connection_t *c);
236
237 extern bool same_peer_ids(const connection_t *c, const connection_t *d,
238 identification_t *his_id);
239
240 /* Format the topology of a connection end, leaving out defaults.
241 * Largest left end looks like: client === host : port [ host_id ] --- hop
242 * Note: if that==NULL, skip nexthop
243 */
244 #define END_BUF (SUBNETTOT_BUF + ADDRTOT_BUF + IDTOA_BUF + ADDRTOT_BUF + 10)
245 extern size_t format_end(char *buf, size_t buf_len, const struct end *this,
246 const struct end *that, bool is_left, lset_t policy);
247
248 extern void add_connection(const whack_message_t *wm);
249 extern void initiate_connection(const char *name, int whackfd);
250 extern void initiate_opportunistic(const ip_address *our_client,
251 const ip_address *peer_client,
252 int transport_proto, bool held, int whackfd);
253 extern void terminate_connection(const char *nm);
254 extern void release_connection(connection_t *c, bool relations);
255 extern void delete_connection(connection_t *c, bool relations);
256 extern void delete_connections_by_name(const char *name, bool strict);
257 extern void delete_every_connection(void);
258 extern char *add_group_instance(connection_t *group, const ip_subnet *target);
259 extern void remove_group_instance(const connection_t *group, const char *name);
260 extern void release_dead_interfaces(void);
261 extern void check_orientations(void);
262 extern connection_t *route_owner(connection_t *c, struct spd_route **srp,
263 connection_t **erop, struct spd_route **esrp);
264 extern connection_t *shunt_owner(const ip_subnet *ours, const ip_subnet *his);
265
266 extern bool uniqueIDs; /* --uniqueids? */
267 extern void ISAKMP_SA_established(connection_t *c, so_serial_t serial);
268
269 #define id_is_ipaddr(id) ((id)->get_type(id) == ID_IPV4_ADDR || \
270 (id)->get_type(id) == ID_IPV6_ADDR)
271 extern bool his_id_was_instantiated(const connection_t *c);
272
273 struct state; /* forward declaration of tag (defined in state.h) */
274
275 extern connection_t* con_by_name(const char *nm, bool strict);
276 extern connection_t* find_host_connection(const ip_address *me,
277 u_int16_t my_port,
278 const ip_address *him,
279 u_int16_t his_port, lset_t policy);
280 extern connection_t* refine_host_connection(const struct state *st,
281 identification_t *id,
282 identification_t *peer_ca);
283 extern connection_t* find_client_connection(connection_t *c,
284 const ip_subnet *our_net,
285 const ip_subnet *peer_net,
286 const u_int8_t our_protocol,
287 const u_int16_t out_port,
288 const u_int8_t peer_protocol,
289 const u_int16_t peer_port);
290 extern connection_t* find_connection_by_reqid(uint32_t reqid);
291 extern connection_t* find_connection_for_clients(struct spd_route **srp,
292 const ip_address *our_client,
293 const ip_address *peer_client,
294 int transport_proto);
295 extern void get_peer_ca_and_groups(connection_t *c,
296 identification_t **peer_ca,
297 ietf_attributes_t **peer_attributes);
298
299 /* instantiating routines
300 * Note: connection_discard() is in state.h because all its work
301 * is looking through state objects.
302 */
303 struct gw_info; /* forward declaration of tag (defined in dnskey.h) */
304 struct alg_info; /* forward declaration of tag (defined in alg_info.h) */
305 extern connection_t *rw_instantiate(connection_t *c,
306 const ip_address *him,
307 u_int16_t his_port,
308 const ip_subnet *his_net,
309 identification_t *his_id);
310
311 extern connection_t *oppo_instantiate(connection_t *c,
312 const ip_address *him,
313 identification_t *his_id,
314 struct gw_info *gw,
315 const ip_address *our_client,
316 const ip_address *peer_client);
317
318 extern connection_t
319 *build_outgoing_opportunistic_connection(struct gw_info *gw,
320 const ip_address *our_client,
321 const ip_address *peer_client);
322
323 #define CONN_INST_BUF BUF_LEN
324
325 extern void fmt_conn_instance(const connection_t *c, char buf[CONN_INST_BUF]);
326
327 /* operations on "pending", the structure representing Quick Mode
328 * negotiations delayed until a Keying Channel has been negotiated.
329 */
330
331 struct pending; /* forward declaration (opaque outside connections.c) */
332
333 extern void add_pending(int whack_sock, struct state *isakmp_sa,
334 connection_t *c, lset_t policy, unsigned long try,
335 so_serial_t replacing);
336
337 extern void release_pending_whacks(struct state *st, err_t story);
338 extern void unpend(struct state *st);
339 extern void update_pending(struct state *os, struct state *ns);
340 extern void flush_pending_by_state(struct state *st);
341 extern void show_pending_phase2(const struct host_pair *hp, const struct state *st);
342
343 extern void connection_discard(connection_t *c);
344
345 /* A template connection's eroute can be eclipsed by
346 * either a %hold or an eroute for an instance iff
347 * the template is a /32 -> /32. This requires some special casing.
348 */
349 #define eclipsable(sr) (subnetishost(&(sr)->this.client) && subnetishost(&(sr)->that.client))
350 extern long eclipse_count;
351 extern connection_t *eclipsed(connection_t *c, struct spd_route **);
352
353
354 /* print connection status */
355
356 extern void show_connections_status(bool all, const char *name);
357 extern int connection_compare(const connection_t *ca
358 , const connection_t *cb);
359 extern void update_host_pair(const char *why, connection_t *c
360 , const ip_address *myaddr, u_int16_t myport
361 , const ip_address *hisaddr, u_int16_t hisport);
362
363 #endif /* _CONNECTIONS_H */