implemented clean spi allocation behavior when using multiple proposals
[strongswan.git] / src / charon / sa / child_sa.c
index 5c09b73..9c9b7e2 100644 (file)
@@ -68,6 +68,16 @@ struct private_child_sa_t {
        } me, other;
        
        /**
        } me, other;
        
        /**
+        * Allocated SPI for a ESP proposal candidates
+        */
+       u_int32_t alloc_esp_spi;
+       
+       /**
+        * Allocated SPI for a AH proposal candidates
+        */
+       u_int32_t alloc_ah_spi;
+       
+       /**
         * Protocol used to protect this SA, ESP|AH
         */
        protocol_id_t protocol;
         * Protocol used to protect this SA, ESP|AH
         */
        protocol_id_t protocol;
@@ -83,6 +93,11 @@ struct private_child_sa_t {
        u_int32_t reqid;
        
        /**
        u_int32_t reqid;
        
        /**
+        * time, on which SA was installed
+        */
+       time_t install_time;
+       
+       /**
         * Lifetime before rekeying
         */
        u_int32_t soft_lifetime;
         * Lifetime before rekeying
         */
        u_int32_t soft_lifetime;
@@ -93,6 +108,11 @@ struct private_child_sa_t {
        u_int32_t hard_lifetime;
        
        /**
        u_int32_t hard_lifetime;
        
        /**
+        * reqid of a CHILD_SA which rekeyed this one
+        */
+       u_int32_t rekeyed;
+       
+       /**
         * CHILD_SAs own logger
         */
        logger_t *logger;
         * CHILD_SAs own logger
         */
        logger_t *logger;
@@ -134,28 +154,47 @@ static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
        protocol_id_t protocol;
        iterator_t *iterator;
        proposal_t *proposal;
        protocol_id_t protocol;
        iterator_t *iterator;
        proposal_t *proposal;
-       status_t status;
        
        
-       /* iterator through proposals */
+       /* iterator through proposals to update spis */
        iterator = proposals->create_iterator(proposals, TRUE);
        while(iterator->has_next(iterator))
        {
                iterator->current(iterator, (void**)&proposal);
                protocol = proposal->get_protocol(proposal);
                
        iterator = proposals->create_iterator(proposals, TRUE);
        while(iterator->has_next(iterator))
        {
                iterator->current(iterator, (void**)&proposal);
                protocol = proposal->get_protocol(proposal);
                
-               status = charon->kernel_interface->get_spi(
-                                       charon->kernel_interface,
-                                       this->other.addr, this->me.addr,
-                                       protocol, this->reqid,
-                                       &this->me.spi);
-               
-               if (status != SUCCESS)
+               if (protocol == PROTO_AH)
                {
                {
-                       iterator->destroy(iterator);
-                       return FAILED;
+                       /* get a new spi for AH, if not already done */
+                       if (this->alloc_ah_spi == 0)
+                       {
+                               if (charon->kernel_interface->get_spi(
+                                                               charon->kernel_interface,
+                                                               this->other.addr, this->me.addr,
+                                                               PROTO_AH, this->reqid,
+                                                               &this->alloc_ah_spi) != SUCCESS)
+                               {
+                                       return FAILED;
+                               }
+                       }
+                       proposal->set_spi(proposal, this->alloc_ah_spi);
                }
                }
-               /* update proposal */
-               proposal->set_spi(proposal, (u_int64_t)this->me.spi);
+               if (protocol == PROTO_ESP)
+               {
+                       /* get a new spi for ESP, if not already done */
+                       if (this->alloc_esp_spi == 0)
+                       {
+                               if (charon->kernel_interface->get_spi(
+                                                               charon->kernel_interface,
+                                                               this->other.addr, this->me.addr,
+                                                               PROTO_ESP, this->reqid,
+                                                               &this->alloc_esp_spi) != SUCCESS)
+                               {
+                                       return FAILED;
+                               }
+                       }
+                       proposal->set_spi(proposal, this->alloc_esp_spi);
+               }
+               
        }
        iterator->destroy(iterator);
        return SUCCESS;
        }
        iterator->destroy(iterator);
        return SUCCESS;
@@ -171,30 +210,43 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
        host_t *dst;
        status_t status;
        
        host_t *dst;
        status_t status;
        
-       /* we must assign the roles to correctly set up the SAs */
-       if (mine)
-       {
-               dst = this->me.addr;
-               src = this->other.addr;
-       }
-       else
-       {
-               src = this->me.addr;
-               dst = this->other.addr;
-       }
-       
        this->protocol = proposal->get_protocol(proposal);
        
        /* now we have to decide which spi to use. Use self allocated, if "mine",
        this->protocol = proposal->get_protocol(proposal);
        
        /* now we have to decide which spi to use. Use self allocated, if "mine",
-        * or the one in the proposal, if not "mine" (others). */
+        * or the one in the proposal, if not "mine" (others). Additionally,
+        * source and dest host switch depending on the role */
        if (mine)
        {
        if (mine)
        {
+               /* if we have allocated SPIs for AH and ESP, we must delete the unused
+                * one. */
+               if (this->protocol == PROTO_ESP)
+               {
+                       this->me.spi = this->alloc_esp_spi;
+                       if (this->alloc_ah_spi)
+                       {
+                               charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr, 
+                                               this->alloc_ah_spi, PROTO_AH);
+                       }
+               }
+               else
+               {
+                       this->me.spi = this->alloc_ah_spi;
+                       if (this->alloc_esp_spi)
+                       {
+                               charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr, 
+                                               this->alloc_esp_spi, PROTO_ESP);
+                       }
+               }
                spi = this->me.spi;
                spi = this->me.spi;
+               dst = this->me.addr;
+               src = this->other.addr;
        }
        else
        {
        }
        else
        {
-               spi = proposal->get_spi(proposal);
-               this->other.spi = spi;
+               this->other.spi = proposal->get_spi(proposal);
+               spi = this->other.spi;
+               src = this->me.addr;
+               dst = this->other.addr;
        }
        
        this->logger->log(this->logger, CONTROL|LEVEL1, "Adding %s %s SA",
        }
        
        this->logger->log(this->logger, CONTROL|LEVEL1, "Adding %s %s SA",
@@ -234,6 +286,8 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
                                                                                                mine ? 0 : this->soft_lifetime,
                                                                                                this->hard_lifetime,
                                                                                                enc_algo, int_algo, prf_plus, mine);
                                                                                                mine ? 0 : this->soft_lifetime,
                                                                                                this->hard_lifetime,
                                                                                                enc_algo, int_algo, prf_plus, mine);
+       
+       this->install_time = time(NULL);
 
        return status;
 }
 
        return status;
 }
@@ -379,6 +433,14 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
 }
 
 /**
 }
 
 /**
+ * Implementation of child_sa_t.set_rekeyed.
+ */
+static void set_rekeyed(private_child_sa_t *this, u_int32_t reqid)
+{
+       this->rekeyed = reqid;
+}
+
+/**
  * Implementation of child_sa_t.log_status.
  */
 static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
  * Implementation of child_sa_t.log_status.
  */
 static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
@@ -393,11 +455,24 @@ static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
        {
                logger = this->logger;
        }
        {
                logger = this->logger;
        }
-       logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   protected with %s (0x%x/0x%x), reqid %d:",
-                               name,
-                               this->protocol == PROTO_ESP ? "ESP" : "AH",
-                               htonl(this->me.spi), htonl(this->other.spi),
-                               this->reqid);
+       if (this->soft_lifetime)
+       {
+               logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   protected with %s (0x%x/0x%x), reqid %d, rekeying in %ds:",
+                                       name,
+                                       this->protocol == PROTO_ESP ? "ESP" : "AH",
+                                       htonl(this->me.spi), htonl(this->other.spi),
+                                       this->reqid, 
+                                       this->soft_lifetime - (time(NULL) - this->install_time));
+       }
+       else
+       {
+               
+               logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   protected with %s (0x%x/0x%x), reqid %d, no rekeying:",
+                                       name,
+                                       this->protocol == PROTO_ESP ? "ESP" : "AH",
+                                       htonl(this->me.spi), htonl(this->other.spi),
+                                       this->reqid);
+       }
        iterator = this->policies->create_iterator(this->policies, TRUE);
        while (iterator->has_next(iterator))
        {
        iterator = this->policies->create_iterator(this->policies, TRUE);
        while (iterator->has_next(iterator))
        {
@@ -428,49 +503,68 @@ static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
  */
 static void destroy(private_child_sa_t *this)
 {
  */
 static void destroy(private_child_sa_t *this)
 {
-       /* delete all policies in the kernel */
        sa_policy_t *policy;
        sa_policy_t *policy;
+       
+       /* delete SAs in the kernel, if they are set up */
+       if (this->me.spi)
+       {
+               charon->kernel_interface->del_sa(charon->kernel_interface,
+                                                                                this->me.addr, this->me.spi, this->protocol);
+       }
+       if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi)
+       {
+               charon->kernel_interface->del_sa(charon->kernel_interface,
+                                                                                this->me.addr, this->alloc_esp_spi, PROTO_ESP);
+       }
+       if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi)
+       {
+               charon->kernel_interface->del_sa(charon->kernel_interface,
+                                                                                this->me.addr, this->alloc_ah_spi, PROTO_AH);
+       }
+       if (this->other.spi)
+       {
+               charon->kernel_interface->del_sa(charon->kernel_interface,
+                                                                                this->other.addr, this->other.spi, this->protocol);
+       }
+       
+       /* delete all policies in the kernel */
        while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
        {
        while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
        {
-               charon->kernel_interface->del_policy(charon->kernel_interface,
-                                                                                        this->me.addr, this->other.addr,
-                                                                                        policy->me.net, policy->other.net,
-                                                                                        policy->me.net_mask, policy->other.net_mask,
-                                                                                        XFRM_POLICY_OUT, policy->upper_proto);
-               
-               charon->kernel_interface->del_policy(charon->kernel_interface,
-                                                                                        this->other.addr, this->me.addr,
-                                                                                        policy->other.net, policy->me.net,
-                                                                                        policy->other.net_mask, policy->me.net_mask,
-                                                                                        XFRM_POLICY_IN, policy->upper_proto);
-               
-               charon->kernel_interface->del_policy(charon->kernel_interface,
-                                                                                        this->other.addr, this->me.addr,
-                                                                                        policy->other.net, policy->me.net,
-                                                                                        policy->other.net_mask, policy->me.net_mask,
-                                                                                        XFRM_POLICY_FWD, policy->upper_proto);
-               
+               if (!this->rekeyed)
+               {       
+                       /* let rekeyed policies, as they are used by another child_sa */
+                       charon->kernel_interface->del_policy(charon->kernel_interface,
+                                                                                               this->me.addr, this->other.addr,
+                                                                                               policy->me.net, policy->other.net,
+                                                                                               policy->me.net_mask, policy->other.net_mask,
+                                                                                               XFRM_POLICY_OUT, policy->upper_proto);
+                       
+                       charon->kernel_interface->del_policy(charon->kernel_interface,
+                                                                                               this->other.addr, this->me.addr,
+                                                                                               policy->other.net, policy->me.net,
+                                                                                               policy->other.net_mask, policy->me.net_mask,
+                                                                                               XFRM_POLICY_IN, policy->upper_proto);
+                       
+                       charon->kernel_interface->del_policy(charon->kernel_interface,
+                                                                                               this->other.addr, this->me.addr,
+                                                                                               policy->other.net, policy->me.net,
+                                                                                               policy->other.net_mask, policy->me.net_mask,
+                                                                                               XFRM_POLICY_FWD, policy->upper_proto);
+               }
                policy->me.net->destroy(policy->me.net);
                policy->other.net->destroy(policy->other.net);
                free(policy);
        }
        this->policies->destroy(this->policies);
                policy->me.net->destroy(policy->me.net);
                policy->other.net->destroy(policy->other.net);
                free(policy);
        }
        this->policies->destroy(this->policies);
-       
-       /* delete SAs in the kernel, if they are set up */
-       if (this->protocol != PROTO_NONE)
-       {
-               charon->kernel_interface->del_sa(charon->kernel_interface,
-                                                                                this->other.addr, this->me.spi, this->protocol);
-               charon->kernel_interface->del_sa(charon->kernel_interface,
-                                                                                this->me.addr, this->other.spi, this->protocol);
-       }
+
        free(this);
 }
 
 /*
  * Described in header.
  */
        free(this);
 }
 
 /*
  * Described in header.
  */
-child_sa_t * child_sa_create(host_t *me, host_t* other, u_int32_t soft_lifetime, u_int32_t hard_lifetime)
+child_sa_t * child_sa_create(u_int32_t rekey, host_t *me, host_t* other, 
+                                                        u_int32_t soft_lifetime, u_int32_t hard_lifetime)
 {
        static u_int32_t reqid = 2000000000;
        private_child_sa_t *this = malloc_thing(private_child_sa_t);
 {
        static u_int32_t reqid = 2000000000;
        private_child_sa_t *this = malloc_thing(private_child_sa_t);
@@ -483,6 +577,7 @@ child_sa_t * child_sa_create(host_t *me, host_t* other, u_int32_t soft_lifetime,
        this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
        this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
        this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
        this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
        this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
        this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
+       this->public.set_rekeyed = (void (*)(child_sa_t*,u_int32_t))set_rekeyed;
        this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
        this->public.destroy = (void(*)(child_sa_t*))destroy;
 
        this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
        this->public.destroy = (void(*)(child_sa_t*))destroy;
 
@@ -492,11 +587,15 @@ child_sa_t * child_sa_create(host_t *me, host_t* other, u_int32_t soft_lifetime,
        this->other.addr = other;
        this->me.spi = 0;
        this->other.spi = 0;
        this->other.addr = other;
        this->me.spi = 0;
        this->other.spi = 0;
+       this->alloc_ah_spi = 0;
+       this->alloc_esp_spi = 0;
        this->soft_lifetime = soft_lifetime;
        this->hard_lifetime = hard_lifetime;
        this->soft_lifetime = soft_lifetime;
        this->hard_lifetime = hard_lifetime;
-       this->reqid = ++reqid;
+       /* reuse old reqid if we are rekeying an existing CHILD_SA */
+       this->reqid = rekey ? rekey : ++reqid;
        this->policies = linked_list_create();
        this->protocol = PROTO_NONE;
        this->policies = linked_list_create();
        this->protocol = PROTO_NONE;
+       this->rekeyed = 0;
        
        return (&this->public);
 }
        
        return (&this->public);
 }