programs/charon/charon/sa/child_sa.c

   1 /**
   2  * @file child_sa.c
   3  *
   4  * @brief Implementation of child_sa_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include <netdb.h>
  24
  25 #include "child_sa.h"
  26
  27 #include <daemon.h>
  28
  29
  30 typedef struct sa_policy_t sa_policy_t;
  31
  32 /**
  33  * Struct used to store information for a policy. This
  34  * is needed since we must provide all this information
  35  * for deleting a policy...
  36  */
  37 struct sa_policy_t {
  38
  39         /**
  40          * Network on local side
  41          */
  42         host_t *my_net;
  43
  44         /**
  45          * Network on remote side
  46          */
  47         host_t *other_net;
  48
  49         /**
  50          * Number of bits for local network (subnet size)
  51          */
  52         u_int8_t my_net_mask;
  53
  54         /**
  55          * Number of bits for remote network (subnet size)
  56          */
  57         u_int8_t other_net_mask;
  58
  59         /**
  60          * Protocol for this policy, such as TCP/UDP/ICMP...
  61          */
  62         int upper_proto;
  63 };
  64
  65 typedef struct private_child_sa_t private_child_sa_t;
  66
  67 /**
  68  * Private data of a child_sa_t object.
  69  */
  70 struct private_child_sa_t {
  71         /**
  72          * Public interface of child_sa_t.
  73          */
  74         child_sa_t public;
  75
  76         /**
  77          * IP of this peer
  78          */
  79         host_t *me;
  80
  81         /**
  82          * IP of other peer
  83          */
  84         host_t *other;
  85
  86         /**
  87          * Local security parameter index for AH protocol, 0 if not used
  88          */
  89         u_int32_t my_ah_spi;
  90
  91         /**
  92          * Local security parameter index for ESP protocol, 0 if not used
  93          */
  94         u_int32_t my_esp_spi;
  95
  96         /**
  97          * Remote security parameter index for AH protocol, 0 if not used
  98          */
  99         u_int32_t other_ah_spi;
 100
 101         /**
 102          * Remote security parameter index for ESP protocol, 0 if not used
 103          */
 104         u_int32_t other_esp_spi;
 105
 106         /**
 107          * List containing policy_id_t objects
 108          */
 109         linked_list_t *policies;
 110
 111         /**
 112          * reqid used for this child_sa
 113          */
 114         u_int32_t reqid;
 115
 116         /**
 117          * CHILD_SAs own logger
 118          */
 119         logger_t *logger;
 120 };
 121
 122 /**
 123  * Implements child_sa_t.alloc
 124  */
 125 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
 126 {
 127         protocol_id_t protocols[2];
 128         iterator_t *iterator;
 129         proposal_t *proposal;
 130         status_t status;
 131         u_int i;
 132
 133         /* iterator through proposals */
 134         iterator = proposals->create_iterator(proposals, TRUE);
 135         while(iterator->has_next(iterator))
 136         {
 137                 iterator->current(iterator, (void**)&proposal);
 138                 proposal->get_protocols(proposal, protocols);
 139
 140                 /* check all protocols */
 141                 for (i = 0; i<2; i++)
 142                 {
 143                         switch (protocols[i])
 144                         {
 145                                 case PROTO_AH:
 146                                         /* do we already have an spi for AH?*/
 147                                         if (this->my_ah_spi == 0)
 148                                         {
 149                                                 /* nope, get one */
 150                                                 status = charon->kernel_interface->get_spi(
 151                                                                                         charon->kernel_interface,
 152                                                                                         this->me, this->other,
 153                                                                                         PROTO_AH, FALSE,
 154                                                                                         &(this->my_ah_spi));
 155                                         }
 156                                         /* update proposal */
 157                                         proposal->set_spi(proposal, PROTO_AH, (u_int64_t)this->my_ah_spi);
 158                                         break;
 159                                 case PROTO_ESP:
 160                                         /* do we already have an spi for ESP?*/
 161                                         if (this->my_esp_spi == 0)
 162                                         {
 163                                                 /* nope, get one */
 164                                                 status = charon->kernel_interface->get_spi(
 165                                                                                         charon->kernel_interface,
 166                                                                                         this->me, this->other,
 167                                                                                         PROTO_ESP, FALSE,
 168                                                                                         &(this->my_esp_spi));
 169                                         }
 170                                         /* update proposal */
 171                                         proposal->set_spi(proposal, PROTO_ESP, (u_int64_t)this->my_esp_spi);
 172                                         break;
 173                                 default:
 174                                         break;
 175                         }
 176                         if (status != SUCCESS)
 177                         {
 178                                 iterator->destroy(iterator);
 179                                 return FAILED;
 180                         }
 181                 }
 182         }
 183         iterator->destroy(iterator);
 184         return SUCCESS;
 185 }
 186
 187 static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
 188 {
 189         protocol_id_t protocols[2];
 190         u_int32_t spi;
 191         encryption_algorithm_t enc_algo;
 192         integrity_algorithm_t int_algo;
 193         chunk_t enc_key, int_key;
 194         algorithm_t *algo;
 195         crypter_t *crypter;
 196         signer_t *signer;
 197         size_t key_size;
 198         host_t *src;
 199         host_t *dst;
 200         status_t status;
 201         u_int i;
 202
 203         /* we must assign the roles to correctly set up the SAs */
 204         if (mine)
 205         {
 206                 src = this->me;
 207                 dst = this->other;
 208         }
 209         else
 210         {
 211                 dst = this->me;
 212                 src = this->other;
 213         }
 214
 215         proposal->get_protocols(proposal, protocols);
 216         /* derive keys in order as protocols appear */
 217         for (i = 0; i<2; i++)
 218         {
 219                 if (protocols[i] != PROTO_NONE)
 220                 {
 221
 222                         /* now we have to decide which spi to use. Use self allocated, if "mine",
 223                          * or the one in the proposal, if not "mine" (others). */
 224                         if (mine)
 225                         {
 226                                 if (protocols[i] == PROTO_AH)
 227                                 {
 228                                         spi = this->my_ah_spi;
 229                                 }
 230                                 else
 231                                 {
 232                                         spi = this->my_esp_spi;
 233                                 }
 234                         }
 235                         else /* use proposals spi */
 236                         {
 237                                 spi = proposal->get_spi(proposal, protocols[i]);
 238                                 if (protocols[i] == PROTO_AH)
 239                                 {
 240                                         this->other_ah_spi = spi;
 241                                 }
 242                                 else
 243                                 {
 244                                         this->other_esp_spi = spi;
 245                                 }
 246                         }
 247
 248                         /* derive encryption key first */
 249                         if (proposal->get_algorithm(proposal, protocols[i], ENCRYPTION_ALGORITHM, &algo))
 250                         {
 251                                 enc_algo = algo->algorithm;
 252                                 this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s, ",
 253                                                                   mapping_find(protocol_id_m, protocols[i]),
 254                                                                   mine ? "me" : "other",
 255                                                                   mapping_find(transform_type_m, ENCRYPTION_ALGORITHM),
 256                                                                   mapping_find(encryption_algorithm_m, enc_algo));
 257
 258                                 /* we must create a (unused) crypter, since its the only way to get the size
 259                                  * of the key. This is not so nice, since charon must support all algorithms
 260                                  * the kernel supports...
 261                                  * TODO: build something of a encryption algorithm lookup function
 262                                  */
 263                                 crypter = crypter_create(enc_algo, algo->key_size);
 264                                 key_size = crypter->get_key_size(crypter);
 265                                 crypter->destroy(crypter);
 266                                 prf_plus->allocate_bytes(prf_plus, key_size, &enc_key);
 267                                 this->logger->log_chunk(this->logger, PRIVATE, "key:", enc_key);
 268                         }
 269                         else
 270                         {
 271                                 enc_algo = ENCR_UNDEFINED;
 272                         }
 273
 274                         /* derive integrity key */
 275                         if (proposal->get_algorithm(proposal, protocols[i], INTEGRITY_ALGORITHM, &algo))
 276                         {
 277                                 int_algo = algo->algorithm;
 278                                 this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s,",
 279                                                                   mapping_find(protocol_id_m, protocols[i]),
 280                                                                   mine ? "me" : "other",
 281                                                                   mapping_find(transform_type_m, INTEGRITY_ALGORITHM),
 282                                                                   mapping_find(integrity_algorithm_m, algo->algorithm));
 283
 284                                 signer = signer_create(int_algo);
 285                                 key_size = signer->get_key_size(signer);
 286                                 signer->destroy(signer);
 287                                 prf_plus->allocate_bytes(prf_plus, key_size, &int_key);
 288                                 this->logger->log_chunk(this->logger, PRIVATE, "key:", int_key);
 289                         }
 290                         else
 291                         {
 292                                 int_algo = AUTH_UNDEFINED;
 293                         }
 294                         /* send keys down to kernel */
 295                         this->logger->log(this->logger, CONTROL|LEVEL1,
 296                                                           "installing 0x%.8x for %s, src %s dst %s",
 297                                                           ntohl(spi), mapping_find(protocol_id_m, protocols[i]),
 298                                                           src->get_address(src), dst->get_address(dst));
 299                         status = charon->kernel_interface->add_sa(charon->kernel_interface,
 300                                                                                                           src, dst,
 301                                                                                                           spi, protocols[i],
 302                                                                                                           this->reqid,
 303                                                                                                           enc_algo, enc_key,
 304                                                                                                           int_algo, int_key, mine);
 305                         /* clean up for next round */
 306                         if (enc_algo != ENCR_UNDEFINED)
 307                         {
 308                                 chunk_free(&enc_key);
 309                         }
 310                         if (int_algo != AUTH_UNDEFINED)
 311                         {
 312                                 chunk_free(&int_key);
 313                         }
 314
 315                         if (status != SUCCESS)
 316                         {
 317                                 return FAILED;
 318                         }
 319
 320
 321                 }
 322         }
 323         return SUCCESS;
 324 }
 325
 326 static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
 327 {
 328         linked_list_t *list;
 329
 330         /* install others (initiators) SAs*/
 331         if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
 332         {
 333                 return FAILED;
 334         }
 335
 336         /* get SPIs for our SAs */
 337         list = linked_list_create();
 338         list->insert_last(list, proposal);
 339         if (alloc(this, list) != SUCCESS)
 340         {
 341                 list->destroy(list);
 342                 return FAILED;
 343         }
 344         list->destroy(list);
 345
 346         /* install our (responders) SAs */
 347         if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
 348         {
 349                 return FAILED;
 350         }
 351
 352         return SUCCESS;
 353 }
 354
 355 static status_t update(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
 356 {
 357         /* install our (initator) SAs */
 358         if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
 359         {
 360                 return FAILED;
 361         }
 362         /* install his (responder) SAs */
 363         if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
 364         {
 365                 return FAILED;
 366         }
 367
 368         return SUCCESS;
 369 }
 370
 371 static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list, linked_list_t *other_ts_list)
 372 {
 373         iterator_t *my_iter, *other_iter;
 374         traffic_selector_t *my_ts, *other_ts;
 375
 376         /* iterate over both lists */
 377         my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
 378         other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
 379         while (my_iter->has_next(my_iter))
 380         {
 381                 my_iter->current(my_iter, (void**)&my_ts);
 382                 other_iter->reset(other_iter);
 383                 while (other_iter->has_next(other_iter))
 384                 {
 385                         /* set up policies for every entry in my_ts_list to every entry in other_ts_list */
 386                         int family;
 387                         chunk_t from_addr;
 388                         u_int16_t from_port, to_port;
 389                         sa_policy_t *policy;
 390                         status_t status;
 391
 392                         other_iter->current(other_iter, (void**)&other_ts);
 393
 394                         /* only set up policies if protocol matches */
 395                         if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts))
 396                         {
 397                                 continue;
 398                         }
 399                         policy = malloc_thing(sa_policy_t);
 400                         policy->upper_proto = my_ts->get_protocol(my_ts);
 401
 402                         /* calculate net and ports for local side */
 403                         family = my_ts->get_type(my_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
 404                         from_addr = my_ts->get_from_address(my_ts);
 405                         from_port = my_ts->get_from_port(my_ts);
 406                         to_port = my_ts->get_to_port(my_ts);
 407                         from_port = (from_port != to_port) ? 0 : from_port;
 408                         policy->my_net = host_create_from_chunk(family, from_addr, from_port);
 409                         policy->my_net_mask = my_ts->get_netmask(my_ts);
 410                         chunk_free(&from_addr);
 411
 412                         /* calculate net and ports for remote side */
 413                         family = other_ts->get_type(other_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
 414                         from_addr = other_ts->get_from_address(other_ts);
 415                         from_port = other_ts->get_from_port(other_ts);
 416                         to_port = other_ts->get_to_port(other_ts);
 417                         from_port = (from_port != to_port) ? 0 : from_port;
 418                         policy->other_net = host_create_from_chunk(family, from_addr, from_port);
 419                         policy->other_net_mask = other_ts->get_netmask(other_ts);
 420                         chunk_free(&from_addr);
 421
 422                         /* install 3 policies: out, in and forward */
 423                         status = charon->kernel_interface->add_policy(charon->kernel_interface,
 424                                         this->me, this->other,
 425                                         policy->my_net, policy->other_net,
 426                                         policy->my_net_mask, policy->other_net_mask,
 427                                         XFRM_POLICY_OUT, policy->upper_proto,
 428                                         this->my_ah_spi, this->my_esp_spi,
 429                                         this->reqid);
 430
 431                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 432                                         this->other, this->me,
 433                                         policy->other_net, policy->my_net,
 434                                         policy->other_net_mask, policy->my_net_mask,
 435                                         XFRM_POLICY_IN, policy->upper_proto,
 436                                         this->my_ah_spi, this->my_esp_spi,
 437                                         this->reqid);
 438
 439                         status |= charon->kernel_interface->add_policy(charon->kernel_interface,
 440                                         this->other, this->me,
 441                                         policy->other_net, policy->my_net,
 442                                         policy->other_net_mask, policy->my_net_mask,
 443                                         XFRM_POLICY_FWD, policy->upper_proto,
 444                                         this->my_ah_spi, this->my_esp_spi,
 445                                         this->reqid);
 446
 447                         if (status != SUCCESS)
 448                         {
 449                                 my_iter->destroy(my_iter);
 450                                 other_iter->destroy(other_iter);
 451                                 policy->my_net->destroy(policy->my_net);
 452                                 policy->other_net->destroy(policy->other_net);
 453                                 free(policy);
 454                                 return status;
 455                         }
 456
 457                         /* add it to the policy list, since we want to know which policies we own */
 458                         this->policies->insert_last(this->policies, policy);
 459                 }
 460         }
 461
 462         my_iter->destroy(my_iter);
 463         other_iter->destroy(other_iter);
 464         return SUCCESS;
 465 }
 466
 467 /**
 468  * Implementation of child_sa_t.log_status.
 469  */
 470 static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
 471 {
 472         iterator_t *iterator;
 473         sa_policy_t *policy;
 474         struct protoent *proto;
 475         char proto_buf[8] = "";
 476         char *proto_name = proto_buf;
 477
 478         if (logger == NULL)
 479         {
 480                 logger = this->logger;
 481         }
 482         logger->log(logger, CONTROL|LEVEL1, "\"%s\":   protected with ESP (0x%x/0x%x), AH (0x%x,0x%x):",
 483                                 name,
 484                                 htonl(this->my_esp_spi), htonl(this->other_esp_spi),
 485                                 htonl(this->my_ah_spi), htonl(this->other_ah_spi));
 486         iterator = this->policies->create_iterator(this->policies, TRUE);
 487         while (iterator->has_next(iterator))
 488         {
 489                 iterator->current(iterator, (void**)&policy);
 490                 if (policy->upper_proto)
 491                 {
 492                         proto = getprotobynumber(policy->upper_proto);
 493                         if (proto)
 494                         {
 495                                 proto_name = proto->p_name;
 496                         }
 497                         else
 498                         {
 499                                 snprintf(proto_buf, sizeof(proto_buf), "<%d>", policy->upper_proto);
 500                         }
 501                 }
 502                 logger->log(logger, CONTROL, "\"%s\":     %s/%d==%s==%s/%d",
 503                                         name,
 504                                         policy->my_net->get_address(policy->my_net), policy->my_net_mask,
 505                                         proto_name,
 506                                         policy->other_net->get_address(policy->other_net), policy->other_net_mask);
 507         }
 508         iterator->destroy(iterator);
 509 }
 510
 511 /**
 512  * Implementation of child_sa_t.destroy.
 513  */
 514 static void destroy(private_child_sa_t *this)
 515 {
 516         /* delete all policys in the kernel */
 517         sa_policy_t *policy;
 518         while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
 519         {
 520                 charon->kernel_interface->del_policy(charon->kernel_interface,
 521                                                                                          this->me, this->other,
 522                                                                                          policy->my_net, policy->other_net,
 523                                                                                          policy->my_net_mask, policy->other_net_mask,
 524                                                                                          XFRM_POLICY_OUT, policy->upper_proto);
 525
 526                 charon->kernel_interface->del_policy(charon->kernel_interface,
 527                                                                                          this->other, this->me,
 528                                                                                          policy->other_net, policy->my_net,
 529                                                                                          policy->other_net_mask, policy->my_net_mask,
 530                                                                                          XFRM_POLICY_IN, policy->upper_proto);
 531
 532                 charon->kernel_interface->del_policy(charon->kernel_interface,
 533                                                                                          this->other, this->me,
 534                                                                                          policy->other_net, policy->my_net,
 535                                                                                          policy->other_net_mask, policy->my_net_mask,
 536                                                                                          XFRM_POLICY_FWD, policy->upper_proto);
 537
 538                 policy->my_net->destroy(policy->my_net);
 539                 policy->other_net->destroy(policy->other_net);
 540                 free(policy);
 541         }
 542         this->policies->destroy(this->policies);
 543
 544         /* delete SAs in the kernel, if they are set up */
 545         if (this->my_ah_spi)
 546         {
 547                 charon->kernel_interface->del_sa(charon->kernel_interface,
 548                                                                                  this->other, this->my_ah_spi, PROTO_AH);
 549                 charon->kernel_interface->del_sa(charon->kernel_interface,
 550                                                                                  this->me, this->other_ah_spi, PROTO_AH);
 551         }
 552         if (this->my_esp_spi)
 553         {
 554                 charon->kernel_interface->del_sa(charon->kernel_interface,
 555                                                                                  this->other, this->my_esp_spi, PROTO_ESP);
 556                 charon->kernel_interface->del_sa(charon->kernel_interface,
 557                                                                                  this->me, this->other_esp_spi, PROTO_ESP);
 558         }
 559         free(this);
 560 }
 561
 562 /*
 563  * Described in header.
 564  */
 565 child_sa_t * child_sa_create(host_t *me, host_t* other)
 566 {
 567         static u_int32_t reqid = 0xc0000000;
 568         private_child_sa_t *this = malloc_thing(private_child_sa_t);
 569
 570         /* public functions */
 571         this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
 572         this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
 573         this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
 574         this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
 575         this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
 576         this->public.destroy = (void(*)(child_sa_t*))destroy;
 577
 578         /* private data */
 579         this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
 580         this->me = me;
 581         this->other = other;
 582         this->my_ah_spi = 0;
 583         this->my_esp_spi = 0;
 584         this->other_ah_spi = 0;
 585         this->other_esp_spi = 0;
 586         this->reqid = reqid++;
 587         this->policies = linked_list_create();
 588
 589         return (&this->public);
 590 }