Added IPsec processor which is responsible for handling in- and outbound packets
authorTobias Brunner <tobias@strongswan.org>
Fri, 13 Jul 2012 13:34:51 +0000 (15:34 +0200)
committerTobias Brunner <tobias@strongswan.org>
Wed, 8 Aug 2012 13:41:03 +0000 (15:41 +0200)
Two callbacks can be registered that get called when new inbound plaintext and
outbound ESP packets have been processed. Inbound ESP and outbound plaintext
packets can be queued for processing with two other methods.

src/libipsec/Android.mk
src/libipsec/Makefile.am
src/libipsec/ipsec.c
src/libipsec/ipsec.h
src/libipsec/ipsec_processor.c [new file with mode: 0644]
src/libipsec/ipsec_processor.h [new file with mode: 0644]

index 698e12f..81f4632 100644 (file)
@@ -11,6 +11,7 @@ ipsec_event_listener.h \
 ipsec_event_relay.c ipsec_event_relay.h \
 ipsec_policy.c ipsec_policy.h \
 ipsec_policy_mgr.c ipsec_policy_mgr.h \
+ipsec_processor.c ipsec_processor.h \
 ipsec_sa.c ipsec_sa.h \
 ipsec_sa_mgr.c ipsec_sa_mgr.h
 
index 3dfa41f..35b8d79 100644 (file)
@@ -9,6 +9,7 @@ ipsec_event_listener.h \
 ipsec_event_relay.c ipsec_event_relay.h \
 ipsec_policy.c ipsec_policy.h \
 ipsec_policy_mgr.c ipsec_policy_mgr.h \
+ipsec_processor.c ipsec_processor.h \
 ipsec_sa.c ipsec_sa.h \
 ipsec_sa_mgr.c ipsec_sa_mgr.h
 
index 5453430..50d9163 100644 (file)
@@ -43,6 +43,7 @@ ipsec_t *ipsec;
 void libipsec_deinit()
 {
        private_ipsec_t *this = (private_ipsec_t*)ipsec;
+       DESTROY_IF(this->public.processor);
        DESTROY_IF(this->public.events);
        DESTROY_IF(this->public.policies);
        DESTROY_IF(this->public.sas);
@@ -70,6 +71,7 @@ bool libipsec_init()
        this->public.sas = ipsec_sa_mgr_create();
        this->public.policies = ipsec_policy_mgr_create();
        this->public.events = ipsec_event_relay_create();
+       this->public.processor = ipsec_processor_create();
        return TRUE;
 }
 
index e8e828d..7ee4943 100644 (file)
@@ -28,6 +28,7 @@
 #include "ipsec_sa_mgr.h"
 #include "ipsec_policy_mgr.h"
 #include "ipsec_event_relay.h"
+#include "ipsec_processor.h"
 
 #include <library.h>
 
@@ -53,6 +54,11 @@ struct ipsec_t {
         */
        ipsec_event_relay_t *events;
 
+       /**
+        * IPsec processor instance
+        */
+       ipsec_processor_t *processor;
+
 };
 
 /**
diff --git a/src/libipsec/ipsec_processor.c b/src/libipsec/ipsec_processor.c
new file mode 100644 (file)
index 0000000..a91d9e0
--- /dev/null
@@ -0,0 +1,324 @@
+/*
+ * Copyright (C) 2012 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ipsec.h"
+#include "ipsec_processor.h"
+
+#include <debug.h>
+#include <library.h>
+#include <threading/rwlock.h>
+#include <utils/blocking_queue.h>
+#include <processing/jobs/callback_job.h>
+
+typedef struct private_ipsec_processor_t private_ipsec_processor_t;
+
+/**
+ * Private additions to ipsec_processor_t.
+ */
+struct private_ipsec_processor_t {
+
+       /**
+        * Public members
+        */
+       ipsec_processor_t public;
+
+       /**
+        * Queue for inbound packets (esp_packet_t*)
+        */
+       blocking_queue_t *inbound_queue;
+
+       /**
+        * Queue for outbound packets (ip_packet_t*)
+        */
+       blocking_queue_t *outbound_queue;
+
+       /**
+        * Registered inbound callback
+        */
+       struct {
+               ipsec_inbound_cb_t cb;
+               void *data;
+       } inbound;
+
+       /**
+        * Registered outbound callback
+        */
+       struct {
+               ipsec_outbound_cb_t cb;
+               void *data;
+       } outbound;
+
+       /**
+        * Lock used to synchronize access to the callbacks
+        */
+       rwlock_t *lock;
+};
+
+/**
+ * Deliver an inbound IP packet to the registered listener
+ */
+static void deliver_inbound(private_ipsec_processor_t *this,
+                                                       esp_packet_t *packet)
+{
+       this->lock->read_lock(this->lock);
+       if (this->inbound.cb)
+       {
+               this->inbound.cb(this->inbound.data, packet->extract_payload(packet));
+       }
+       else
+       {
+               DBG2(DBG_ESP, "no inbound callback registered, dropping packet");
+       }
+       packet->destroy(packet);
+       this->lock->unlock(this->lock);
+}
+
+/**
+ * Processes inbound packets
+ */
+static job_requeue_t process_inbound(private_ipsec_processor_t *this)
+{
+       esp_packet_t *packet;
+       ipsec_sa_t *sa;
+       u_int8_t next_header;
+       u_int32_t spi;
+
+       packet = (esp_packet_t*)this->inbound_queue->dequeue(this->inbound_queue);
+
+       if (!packet->parse_header(packet, &spi))
+       {
+               packet->destroy(packet);
+               return JOB_REQUEUE_DIRECT;
+       }
+
+       sa = ipsec->sas->checkout_by_spi(ipsec->sas, spi,
+                                                                        packet->get_destination(packet));
+       if (!sa)
+       {
+               DBG2(DBG_ESP, "inbound ESP packet does not belong to an installed SA");
+               packet->destroy(packet);
+               return JOB_REQUEUE_DIRECT;
+       }
+
+       if (!sa->is_inbound(sa))
+       {
+               DBG1(DBG_ESP, "error: IPsec SA is not inbound");
+               packet->destroy(packet);
+               ipsec->sas->checkin(ipsec->sas, sa);
+               return JOB_REQUEUE_DIRECT;
+       }
+
+       if (packet->decrypt(packet, sa->get_esp_context(sa)) != SUCCESS)
+       {
+               ipsec->sas->checkin(ipsec->sas, sa);
+               packet->destroy(packet);
+               return JOB_REQUEUE_DIRECT;
+       }
+       ipsec->sas->checkin(ipsec->sas, sa);
+
+       next_header = packet->get_next_header(packet);
+       switch (next_header)
+       {
+               case IPPROTO_IPIP:
+               case IPPROTO_IPV6:
+               {
+                       ipsec_policy_t *policy;
+                       ip_packet_t *ip_packet;
+
+                       ip_packet = packet->get_payload(packet);
+                       policy = ipsec->policies->find_by_packet(ipsec->policies,
+                                                                                                        ip_packet, TRUE);
+                       if (policy)
+                       {       /* TODO-IPSEC: update policy/sa stats? */
+                               deliver_inbound(this, packet);
+                               policy->destroy(policy);
+                               break;
+                       }
+                       DBG1(DBG_ESP, "discarding inbound IP packet due to policy");
+                       /* no matching policy found, fall-through */
+               }
+               case IPPROTO_NONE:
+                       /* discard dummy packets */
+                       /* fall-through */
+               default:
+                       packet->destroy(packet);
+                       break;
+       }
+       return JOB_REQUEUE_DIRECT;
+}
+
+/**
+ * Send an ESP packet using the registered outbound callback
+ */
+static void send_outbound(private_ipsec_processor_t *this,
+                                                 esp_packet_t *packet)
+{
+       this->lock->read_lock(this->lock);
+       if (this->outbound.cb)
+       {
+               this->outbound.cb(this->outbound.data, packet);
+       }
+       else
+       {
+               DBG2(DBG_ESP, "no outbound callback registered, dropping packet");
+               packet->destroy(packet);
+       }
+       this->lock->unlock(this->lock);
+}
+
+/**
+ * Processes outbound packets
+ */
+static job_requeue_t process_outbound(private_ipsec_processor_t *this)
+{
+       ipsec_policy_t *policy;
+       esp_packet_t *esp_packet;
+       ip_packet_t *packet;
+       ipsec_sa_t *sa;
+       host_t *src, *dst;
+
+       packet = (ip_packet_t*)this->outbound_queue->dequeue(this->outbound_queue);
+
+       policy = ipsec->policies->find_by_packet(ipsec->policies, packet, FALSE);
+       if (!policy)
+       {
+               DBG1(DBG_ESP, "no matching outbound IPsec policy for %H == %H",
+                        packet->get_source(packet), packet->get_destination(packet));
+               packet->destroy(packet);
+               return JOB_REQUEUE_DIRECT;
+       }
+
+       sa = ipsec->sas->checkout_by_reqid(ipsec->sas, policy->get_reqid(policy),
+                                                                          FALSE);
+       if (!sa)
+       {       /* TODO-IPSEC: send an acquire to uppper layer */
+               DBG1(DBG_ESP, "could not find an outbound IPsec SA for reqid {%u}, "
+                        "dropping packet", policy->get_reqid(policy));
+               packet->destroy(packet);
+               policy->destroy(policy);
+               return JOB_REQUEUE_DIRECT;
+       }
+       src = sa->get_source(sa);
+       dst = sa->get_destination(sa);
+       esp_packet = esp_packet_create_from_payload(src->clone(src),
+                                                                                               dst->clone(dst), packet);
+       if (esp_packet->encrypt(esp_packet, sa->get_esp_context(sa),
+                                                       sa->get_spi(sa)) != SUCCESS)
+       {
+               ipsec->sas->checkin(ipsec->sas, sa);
+               esp_packet->destroy(esp_packet);
+               policy->destroy(policy);
+               return JOB_REQUEUE_DIRECT;
+       }
+       /* TODO-IPSEC: update policy/sa counters? */
+       ipsec->sas->checkin(ipsec->sas, sa);
+       policy->destroy(policy);
+       send_outbound(this, esp_packet);
+       return JOB_REQUEUE_DIRECT;
+}
+
+METHOD(ipsec_processor_t, queue_inbound, void,
+       private_ipsec_processor_t *this, esp_packet_t *packet)
+{
+       this->inbound_queue->enqueue(this->inbound_queue, packet);
+}
+
+METHOD(ipsec_processor_t, queue_outbound, void,
+       private_ipsec_processor_t *this, ip_packet_t *packet)
+{
+       this->outbound_queue->enqueue(this->outbound_queue, packet);
+}
+
+METHOD(ipsec_processor_t, register_inbound, void,
+       private_ipsec_processor_t *this, ipsec_inbound_cb_t cb, void *data)
+{
+       this->lock->write_lock(this->lock);
+       this->inbound.cb = cb;
+       this->inbound.data = data;
+       this->lock->unlock(this->lock);
+}
+
+METHOD(ipsec_processor_t, unregister_inbound, void,
+       private_ipsec_processor_t *this, ipsec_inbound_cb_t cb)
+{
+       this->lock->write_lock(this->lock);
+       if (this->inbound.cb == cb)
+       {
+               this->inbound.cb = NULL;
+       }
+       this->lock->unlock(this->lock);
+}
+
+METHOD(ipsec_processor_t, register_outbound, void,
+       private_ipsec_processor_t *this, ipsec_outbound_cb_t cb, void *data)
+{
+       this->lock->write_lock(this->lock);
+       this->outbound.cb = cb;
+       this->outbound.data = data;
+       this->lock->unlock(this->lock);
+}
+
+METHOD(ipsec_processor_t, unregister_outbound, void,
+       private_ipsec_processor_t *this, ipsec_outbound_cb_t cb)
+{
+       this->lock->write_lock(this->lock);
+       if (this->outbound.cb == cb)
+       {
+               this->outbound.cb = NULL;
+       }
+       this->lock->unlock(this->lock);
+}
+
+METHOD(ipsec_processor_t, destroy, void,
+       private_ipsec_processor_t *this)
+{
+       this->inbound_queue->destroy_offset(this->inbound_queue,
+                                                                               offsetof(esp_packet_t, destroy));
+       this->outbound_queue->destroy_offset(this->outbound_queue,
+                                                                                offsetof(ip_packet_t, destroy));
+       this->lock->destroy(this->lock);
+       free(this);
+}
+
+/**
+ * Described in header.
+ */
+ipsec_processor_t *ipsec_processor_create()
+{
+       private_ipsec_processor_t *this;
+
+       INIT(this,
+               .public = {
+                       .queue_inbound = _queue_inbound,
+                       .queue_outbound = _queue_outbound,
+                       .register_inbound = _register_inbound,
+                       .unregister_inbound = _unregister_inbound,
+                       .register_outbound = _register_outbound,
+                       .unregister_outbound = _unregister_outbound,
+                       .destroy = _destroy,
+               },
+               .inbound_queue = blocking_queue_create(),
+               .outbound_queue = blocking_queue_create(),
+               .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
+       );
+
+       lib->processor->queue_job(lib->processor,
+               (job_t*)callback_job_create((callback_job_cb_t)process_inbound, this,
+                                                                       NULL, (callback_job_cancel_t)return_false));
+       lib->processor->queue_job(lib->processor,
+               (job_t*)callback_job_create((callback_job_cb_t)process_outbound, this,
+                                                                       NULL, (callback_job_cancel_t)return_false));
+       return &this->public;
+}
diff --git a/src/libipsec/ipsec_processor.h b/src/libipsec/ipsec_processor.h
new file mode 100644 (file)
index 0000000..0a40982
--- /dev/null
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2012 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ipsec_processor ipsec_processor
+ * @{ @ingroup libipsec
+ */
+
+#ifndef IPSEC_PROCESSOR_H_
+#define IPSEC_PROCESSOR_H_
+
+#include "ip_packet.h"
+#include "esp_packet.h"
+
+typedef struct ipsec_processor_t ipsec_processor_t;
+
+/**
+ * Callback called to deliver an inbound plaintext packet.
+ *
+ * @param data                 data supplied during registration of the callback
+ * @param packet               plaintext IP packet to deliver
+ */
+typedef void (*ipsec_inbound_cb_t)(void *data, ip_packet_t *packet);
+
+/**
+ * Callback called to send an ESP packet.
+ *
+ * @note The ESP packet currently comes without IP header (and without UDP
+ * header in case of UDP encapsulation)
+ *
+ * @param data                 data supplied during registration of the callback
+ * @param packet               ESP packet to send
+ */
+typedef void (*ipsec_outbound_cb_t)(void *data, esp_packet_t *packet);
+
+/**
+ *  IPsec processor
+ */
+struct ipsec_processor_t {
+
+       /**
+        * Queue an inbound ESP packet for processing.
+        *
+        * @param packet                the ESP packet to process
+        */
+       void (*queue_inbound)(ipsec_processor_t *this, esp_packet_t *packet);
+
+       /**
+        * Queue an outbound plaintext IP packet for processing.
+        *
+        * @param packet                the plaintext IP packet
+        */
+       void (*queue_outbound)(ipsec_processor_t *this, ip_packet_t *packet);
+
+       /**
+        * Register the callback used to deliver inbound plaintext packets.
+        *
+        * @param cb                    the inbound callback function
+        * @param data                  optional data provided to callback
+        */
+       void (*register_inbound)(ipsec_processor_t *this, ipsec_inbound_cb_t cb,
+                                                        void *data);
+
+       /**
+        * Unregister a previously registered inbound callback.
+        *
+        * @param cb                    previously registered callback function
+        */
+       void (*unregister_inbound)(ipsec_processor_t *this,
+                                                          ipsec_inbound_cb_t cb);
+
+       /**
+        * Register the callback used to send outbound ESP packets.
+        *
+        * @param cb                    the outbound callback function
+        * @param data                  optional data provided to callback
+        */
+       void (*register_outbound)(ipsec_processor_t *this, ipsec_outbound_cb_t cb,
+                                                         void *data);
+
+       /**
+        * Unregister a previously registered outbound callback.
+        *
+        * @param cb                    previously registered callback function
+        */
+       void (*unregister_outbound)(ipsec_processor_t *this,
+                                                               ipsec_outbound_cb_t cb);
+
+       /**
+        * Destroy an ipsec_processor_t.
+        */
+       void (*destroy)(ipsec_processor_t *this);
+
+};
+
+/**
+ * Create an ipsec_processor_t instance
+ *
+ * @return                                     IPsec processor instance
+ */
+ipsec_processor_t *ipsec_processor_create();
+
+#endif /** IPSEC_PROCESSOR_H_ @}*/