src/libcharon/sa/trap_manager.c

   1 /*
   2  * Copyright (C) 2011 Tobias Brunner
   3  * Copyright (C) 2009 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "trap_manager.h"
  18
  19 #include <hydra.h>
  20 #include <daemon.h>
  21 #include <threading/rwlock.h>
  22 #include <utils/linked_list.h>
  23
  24
  25 typedef struct private_trap_manager_t private_trap_manager_t;
  26 typedef struct trap_listener_t trap_listener_t;
  27
  28 /**
  29  * listener to track acquires
  30  */
  31 struct trap_listener_t {
  32
  33         /**
  34          * Implements listener interface
  35          */
  36         listener_t listener;
  37
  38         /**
  39          * points to trap_manager
  40          */
  41         private_trap_manager_t *traps;
  42 };
  43
  44 /**
  45  * Private data of an trap_manager_t object.
  46  */
  47 struct private_trap_manager_t {
  48
  49         /**
  50          * Public trap_manager_t interface.
  51          */
  52         trap_manager_t public;
  53
  54         /**
  55          * Installed traps, as entry_t
  56          */
  57         linked_list_t *traps;
  58
  59         /**
  60          * read write lock for traps list
  61          */
  62         rwlock_t *lock;
  63
  64         /**
  65          * listener to track acquiring IKE_SAs
  66          */
  67         trap_listener_t listener;
  68 };
  69
  70 /**
  71  * A installed trap entry
  72  */
  73 typedef struct {
  74         /** ref to peer_cfg to initiate */
  75         peer_cfg_t *peer_cfg;
  76         /** ref to instanciated CHILD_SA */
  77         child_sa_t *child_sa;
  78         /** TRUE if an acquire is pending */
  79         bool pending;
  80         /** pending IKE_SA connecting upon acquire */
  81         ike_sa_t *ike_sa;
  82 } entry_t;
  83
  84 /**
  85  * actually uninstall and destroy an installed entry
  86  */
  87 static void destroy_entry(entry_t *entry)
  88 {
  89         entry->child_sa->destroy(entry->child_sa);
  90         entry->peer_cfg->destroy(entry->peer_cfg);
  91         free(entry);
  92 }
  93
  94 METHOD(trap_manager_t, install, u_int32_t,
  95         private_trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child)
  96 {
  97         entry_t *entry;
  98         ike_cfg_t *ike_cfg;
  99         child_sa_t *child_sa;
 100         host_t *me, *other;
 101         linked_list_t *my_ts, *other_ts;
 102         enumerator_t *enumerator;
 103         bool found = FALSE;
 104         status_t status;
 105         u_int32_t reqid;
 106
 107         /* check if not already done */
 108         this->lock->read_lock(this->lock);
 109         enumerator = this->traps->create_enumerator(this->traps);
 110         while (enumerator->enumerate(enumerator, &entry))
 111         {
 112                 if (streq(entry->child_sa->get_name(entry->child_sa),
 113                                   child->get_name(child)))
 114                 {
 115                         found = TRUE;
 116                         break;
 117                 }
 118         }
 119         enumerator->destroy(enumerator);
 120         this->lock->unlock(this->lock);
 121         if (found)
 122         {
 123                 DBG1(DBG_CFG, "CHILD_SA named '%s' already routed",
 124                          child->get_name(child));
 125                 return 0;
 126         }
 127
 128         /* try to resolve addresses */
 129         ike_cfg = peer->get_ike_cfg(peer);
 130         other = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg),
 131                                                                  0, ike_cfg->get_other_port(ike_cfg));
 132         if (!other || other->is_anyaddr(other))
 133         {
 134                 DBG1(DBG_CFG, "installing trap failed, remote address unknown");
 135                 return 0;
 136         }
 137         me = host_create_from_dns(ike_cfg->get_my_addr(ike_cfg),
 138                                         other->get_family(other), ike_cfg->get_my_port(ike_cfg));
 139         if (!me || me->is_anyaddr(me))
 140         {
 141                 DESTROY_IF(me);
 142                 me = hydra->kernel_interface->get_source_addr(
 143                                                                         hydra->kernel_interface, other, NULL);
 144                 if (!me)
 145                 {
 146                         DBG1(DBG_CFG, "installing trap failed, local address unknown");
 147                         other->destroy(other);
 148                         return 0;
 149                 }
 150                 me->set_port(me, ike_cfg->get_my_port(ike_cfg));
 151         }
 152
 153         /* create and route CHILD_SA */
 154         child_sa = child_sa_create(me, other, child, 0, FALSE);
 155         my_ts = child->get_traffic_selectors(child, TRUE, NULL, me);
 156         other_ts = child->get_traffic_selectors(child, FALSE, NULL, other);
 157         me->destroy(me);
 158         other->destroy(other);
 159
 160         /* while we don't know the finally negotiated protocol (ESP|AH), we
 161          * could iterate all proposals for a best guess (TODO). But as we
 162          * support ESP only for now, we set it here. */
 163         child_sa->set_protocol(child_sa, PROTO_ESP);
 164         child_sa->set_mode(child_sa, child->get_mode(child));
 165         status = child_sa->add_policies(child_sa, my_ts, other_ts);
 166         my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
 167         other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
 168         if (status != SUCCESS)
 169         {
 170                 child_sa->destroy(child_sa);
 171                 DBG1(DBG_CFG, "installing trap failed");
 172                 return 0;
 173         }
 174
 175         reqid = child_sa->get_reqid(child_sa);
 176         INIT(entry,
 177                 .child_sa = child_sa,
 178                 .peer_cfg = peer->get_ref(peer),
 179         );
 180
 181         this->lock->write_lock(this->lock);
 182         this->traps->insert_last(this->traps, entry);
 183         this->lock->unlock(this->lock);
 184
 185         return reqid;
 186 }
 187
 188 METHOD(trap_manager_t, uninstall, bool,
 189         private_trap_manager_t *this, u_int32_t reqid)
 190 {
 191         enumerator_t *enumerator;
 192         entry_t *entry, *found = NULL;
 193
 194         this->lock->write_lock(this->lock);
 195         enumerator = this->traps->create_enumerator(this->traps);
 196         while (enumerator->enumerate(enumerator, &entry))
 197         {
 198                 if (entry->child_sa->get_reqid(entry->child_sa) == reqid)
 199                 {
 200                         this->traps->remove_at(this->traps, enumerator);
 201                         found = entry;
 202                         break;
 203                 }
 204         }
 205         enumerator->destroy(enumerator);
 206         this->lock->unlock(this->lock);
 207
 208         if (!found)
 209         {
 210                 DBG1(DBG_CFG, "trap %d not found to uninstall", reqid);
 211                 return FALSE;
 212         }
 213
 214         destroy_entry(found);
 215         return TRUE;
 216 }
 217
 218 /**
 219  * convert enumerated entries to peer_cfg, child_sa
 220  */
 221 static bool trap_filter(rwlock_t *lock, entry_t **entry, peer_cfg_t **peer_cfg,
 222                                                 void *none, child_sa_t **child_sa)
 223 {
 224         if (peer_cfg)
 225         {
 226                 *peer_cfg = (*entry)->peer_cfg;
 227         }
 228         if (child_sa)
 229         {
 230                 *child_sa = (*entry)->child_sa;
 231         }
 232         return TRUE;
 233 }
 234
 235 METHOD(trap_manager_t, create_enumerator, enumerator_t*,
 236         private_trap_manager_t *this)
 237 {
 238         this->lock->read_lock(this->lock);
 239         return enumerator_create_filter(this->traps->create_enumerator(this->traps),
 240                                                                         (void*)trap_filter, this->lock,
 241                                                                         (void*)this->lock->unlock);
 242 }
 243
 244 METHOD(trap_manager_t, acquire, void,
 245         private_trap_manager_t *this, u_int32_t reqid,
 246         traffic_selector_t *src, traffic_selector_t *dst)
 247 {
 248         enumerator_t *enumerator;
 249         entry_t *entry, *found = NULL;
 250         peer_cfg_t *peer;
 251         child_cfg_t *child;
 252         ike_sa_t *ike_sa;
 253
 254         this->lock->read_lock(this->lock);
 255         enumerator = this->traps->create_enumerator(this->traps);
 256         while (enumerator->enumerate(enumerator, &entry))
 257         {
 258                 if (entry->child_sa->get_reqid(entry->child_sa) == reqid)
 259                 {
 260                         found = entry;
 261                         break;
 262                 }
 263         }
 264         enumerator->destroy(enumerator);
 265
 266         if (!found)
 267         {
 268                 DBG1(DBG_CFG, "trap not found, unable to acquire reqid %d",reqid);
 269                 this->lock->unlock(this->lock);
 270                 return;
 271         }
 272         if (!cas_bool(&found->pending, FALSE, TRUE))
 273         {
 274                 DBG1(DBG_CFG, "ignoring acquire, connection attempt pending");
 275                 this->lock->unlock(this->lock);
 276                 return;
 277         }
 278         peer = found->peer_cfg->get_ref(found->peer_cfg);
 279         child = found->child_sa->get_config(found->child_sa);
 280         child = child->get_ref(child);
 281         reqid = found->child_sa->get_reqid(found->child_sa);
 282         /* don't hold the lock while checking out the IKE_SA */
 283         this->lock->unlock(this->lock);
 284
 285         ike_sa = charon->ike_sa_manager->checkout_by_config(
 286                                                                                         charon->ike_sa_manager, peer);
 287         if (ike_sa->get_peer_cfg(ike_sa) == NULL)
 288         {
 289                 ike_sa->set_peer_cfg(ike_sa, peer);
 290         }
 291         if (ike_sa->initiate(ike_sa, child, reqid, src, dst) != DESTROY_ME)
 292         {
 293                 /* make sure the entry is still there */
 294                 this->lock->read_lock(this->lock);
 295                 if (this->traps->find_first(this->traps, NULL,
 296                                                                         (void**)&found) == SUCCESS)
 297                 {
 298                         found->ike_sa = ike_sa;
 299                 }
 300                 this->lock->unlock(this->lock);
 301                 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
 302         }
 303         else
 304         {
 305                 charon->ike_sa_manager->checkin_and_destroy(
 306                                                                                         charon->ike_sa_manager, ike_sa);
 307         }
 308         peer->destroy(peer);
 309 }
 310
 311 /**
 312  * Complete the acquire, if successful or failed
 313  */
 314 static void complete(private_trap_manager_t *this, ike_sa_t *ike_sa,
 315                                          child_sa_t *child_sa)
 316 {
 317         enumerator_t *enumerator;
 318         entry_t *entry;
 319
 320         this->lock->read_lock(this->lock);
 321         enumerator = this->traps->create_enumerator(this->traps);
 322         while (enumerator->enumerate(enumerator, &entry))
 323         {
 324                 if (entry->ike_sa != ike_sa)
 325                 {
 326                         continue;
 327                 }
 328                 if (child_sa && child_sa->get_reqid(child_sa) !=
 329                                                                         entry->child_sa->get_reqid(entry->child_sa))
 330                 {
 331                         continue;
 332                 }
 333                 entry->ike_sa = NULL;
 334                 entry->pending = FALSE;
 335         }
 336         enumerator->destroy(enumerator);
 337         this->lock->unlock(this->lock);
 338 }
 339
 340 METHOD(listener_t, ike_state_change, bool,
 341         trap_listener_t *listener, ike_sa_t *ike_sa, ike_sa_state_t state)
 342 {
 343         switch (state)
 344         {
 345                 case IKE_DESTROYING:
 346                         complete(listener->traps, ike_sa, NULL);
 347                         return TRUE;
 348                 default:
 349                         return TRUE;
 350         }
 351 }
 352
 353 METHOD(listener_t, child_state_change, bool,
 354         trap_listener_t *listener, ike_sa_t *ike_sa, child_sa_t *child_sa,
 355         child_sa_state_t state)
 356 {
 357         switch (state)
 358         {
 359                 case CHILD_INSTALLED:
 360                 case CHILD_DESTROYING:
 361                         complete(listener->traps, ike_sa, child_sa);
 362                         return TRUE;
 363                 default:
 364                         return TRUE;
 365         }
 366 }
 367
 368 METHOD(trap_manager_t, flush, void,
 369         private_trap_manager_t *this)
 370 {
 371         linked_list_t *traps;
 372         /* since destroying the CHILD_SA results in events which require a read
 373          * lock we cannot destroy the list while holding the write lock */
 374         this->lock->write_lock(this->lock);
 375         traps = this->traps;
 376         this->traps = linked_list_create();
 377         this->lock->unlock(this->lock);
 378         traps->destroy_function(traps, (void*)destroy_entry);
 379 }
 380
 381 METHOD(trap_manager_t, destroy, void,
 382         private_trap_manager_t *this)
 383 {
 384         charon->bus->remove_listener(charon->bus, &this->listener.listener);
 385         this->traps->destroy_function(this->traps, (void*)destroy_entry);
 386         this->lock->destroy(this->lock);
 387         free(this);
 388 }
 389
 390 /**
 391  * See header
 392  */
 393 trap_manager_t *trap_manager_create(void)
 394 {
 395         private_trap_manager_t *this;
 396
 397         INIT(this,
 398                 .public = {
 399                         .install = _install,
 400                         .uninstall = _uninstall,
 401                         .create_enumerator = _create_enumerator,
 402                         .acquire = _acquire,
 403                         .flush = _flush,
 404                         .destroy = _destroy,
 405                 },
 406                 .listener = {
 407                         .traps = this,
 408                         .listener = {
 409                                 .ike_state_change = _ike_state_change,
 410                                 .child_state_change = _child_state_change,
 411                         },
 412                 },
 413                 .traps = linked_list_create(),
 414                 .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
 415         );
 416         charon->bus->add_listener(charon->bus, &this->listener.listener);
 417
 418         return &this->public;
 419 }
 420