Annotation of embedaddon/strongswan/src/libcharon/sa/ikev2/tasks/child_delete.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (C) 2009-2016 Tobias Brunner
! 3: * Copyright (C) 2006-2007 Martin Willi
! 4: * HSR Hochschule fuer Technik Rapperswil
! 5: *
! 6: * This program is free software; you can redistribute it and/or modify it
! 7: * under the terms of the GNU General Public License as published by the
! 8: * Free Software Foundation; either version 2 of the License, or (at your
! 9: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
! 10: *
! 11: * This program is distributed in the hope that it will be useful, but
! 12: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
! 13: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
! 14: * for more details.
! 15: */
! 16:
! 17: #include "child_delete.h"
! 18:
! 19: #include <daemon.h>
! 20: #include <encoding/payloads/delete_payload.h>
! 21: #include <processing/jobs/delete_child_sa_job.h>
! 22: #include <sa/ikev2/tasks/child_create.h>
! 23: #include <sa/ikev2/tasks/child_rekey.h>
! 24:
! 25: #ifndef DELETE_REKEYED_DELAY
! 26: #define DELETE_REKEYED_DELAY 5
! 27: #endif
! 28:
! 29: typedef struct private_child_delete_t private_child_delete_t;
! 30:
! 31: /**
! 32: * Private members of a child_delete_t task.
! 33: */
! 34: struct private_child_delete_t {
! 35:
! 36: /**
! 37: * Public methods and task_t interface.
! 38: */
! 39: child_delete_t public;
! 40:
! 41: /**
! 42: * Assigned IKE_SA.
! 43: */
! 44: ike_sa_t *ike_sa;
! 45:
! 46: /**
! 47: * Whether we are the initiator of the exchange
! 48: */
! 49: bool initiator;
! 50:
! 51: /**
! 52: * Protocol of CHILD_SA to delete (as initiator)
! 53: */
! 54: protocol_id_t protocol;
! 55:
! 56: /**
! 57: * Inbound SPI of CHILD_SA to delete (as initiator)
! 58: */
! 59: uint32_t spi;
! 60:
! 61: /**
! 62: * CHILD_SA already expired (as initiator)
! 63: */
! 64: bool expired;
! 65:
! 66: /**
! 67: * CHILD_SAs which get deleted, entry_t*
! 68: */
! 69: linked_list_t *child_sas;
! 70: };
! 71:
! 72: /**
! 73: * Information about a deleted CHILD_SA
! 74: */
! 75: typedef struct {
! 76: /** Deleted CHILD_SA */
! 77: child_sa_t *child_sa;
! 78: /** Whether the CHILD_SA was rekeyed */
! 79: bool rekeyed;
! 80: /** Whether to enforce any delete action policy */
! 81: bool check_delete_action;
! 82: } entry_t;
! 83:
! 84: CALLBACK(match_child, bool,
! 85: entry_t *entry, va_list args)
! 86: {
! 87: child_sa_t *child_sa;
! 88:
! 89: VA_ARGS_VGET(args, child_sa);
! 90: return entry->child_sa == child_sa;
! 91: }
! 92:
! 93: /**
! 94: * build the delete payloads from the listed child_sas
! 95: */
! 96: static void build_payloads(private_child_delete_t *this, message_t *message)
! 97: {
! 98: delete_payload_t *ah = NULL, *esp = NULL;
! 99: enumerator_t *enumerator;
! 100: entry_t *entry;
! 101: protocol_id_t protocol;
! 102: uint32_t spi;
! 103:
! 104: enumerator = this->child_sas->create_enumerator(this->child_sas);
! 105: while (enumerator->enumerate(enumerator, (void**)&entry))
! 106: {
! 107: protocol = entry->child_sa->get_protocol(entry->child_sa);
! 108: spi = entry->child_sa->get_spi(entry->child_sa, TRUE);
! 109:
! 110: switch (protocol)
! 111: {
! 112: case PROTO_ESP:
! 113: if (!esp)
! 114: {
! 115: esp = delete_payload_create(PLV2_DELETE, PROTO_ESP);
! 116: message->add_payload(message, (payload_t*)esp);
! 117: }
! 118: esp->add_spi(esp, spi);
! 119: DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
! 120: protocol_id_names, protocol, ntohl(spi));
! 121: break;
! 122: case PROTO_AH:
! 123: if (ah == NULL)
! 124: {
! 125: ah = delete_payload_create(PLV2_DELETE, PROTO_AH);
! 126: message->add_payload(message, (payload_t*)ah);
! 127: }
! 128: ah->add_spi(ah, spi);
! 129: DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
! 130: protocol_id_names, protocol, ntohl(spi));
! 131: break;
! 132: default:
! 133: break;
! 134: }
! 135: entry->child_sa->set_state(entry->child_sa, CHILD_DELETING);
! 136: }
! 137: enumerator->destroy(enumerator);
! 138: }
! 139:
! 140: /**
! 141: * Check if the given CHILD_SA is the redundant SA created in a rekey collision.
! 142: */
! 143: static bool is_redundant(private_child_delete_t *this, child_sa_t *child)
! 144: {
! 145: enumerator_t *tasks;
! 146: task_t *task;
! 147:
! 148: tasks = this->ike_sa->create_task_enumerator(this->ike_sa,
! 149: TASK_QUEUE_ACTIVE);
! 150: while (tasks->enumerate(tasks, &task))
! 151: {
! 152: if (task->get_type(task) == TASK_CHILD_REKEY)
! 153: {
! 154: child_rekey_t *rekey = (child_rekey_t*)task;
! 155:
! 156: if (rekey->is_redundant(rekey, child))
! 157: {
! 158: tasks->destroy(tasks);
! 159: return TRUE;
! 160: }
! 161: }
! 162: }
! 163: tasks->destroy(tasks);
! 164: return FALSE;
! 165: }
! 166:
! 167: /**
! 168: * Install the outbound CHILD_SA with the given SPI
! 169: */
! 170: static void install_outbound(private_child_delete_t *this,
! 171: protocol_id_t protocol, uint32_t spi)
! 172: {
! 173: child_sa_t *child_sa;
! 174: linked_list_t *my_ts, *other_ts;
! 175: status_t status;
! 176:
! 177: if (!spi)
! 178: {
! 179: return;
! 180: }
! 181:
! 182: child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
! 183: spi, FALSE);
! 184: if (!child_sa)
! 185: {
! 186: DBG1(DBG_IKE, "CHILD_SA not found after rekeying");
! 187: return;
! 188: }
! 189: if (this->initiator && is_redundant(this, child_sa))
! 190: { /* if we won the rekey collision we don't want to install the
! 191: * redundant SA created by the peer */
! 192: return;
! 193: }
! 194:
! 195: status = child_sa->install_outbound(child_sa);
! 196: if (status != SUCCESS)
! 197: {
! 198: DBG1(DBG_IKE, "unable to install outbound IPsec SA (SAD) in kernel");
! 199: charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED,
! 200: child_sa);
! 201: /* FIXME: delete the new child_sa? */
! 202: return;
! 203: }
! 204:
! 205: my_ts = linked_list_create_from_enumerator(
! 206: child_sa->create_ts_enumerator(child_sa, TRUE));
! 207: other_ts = linked_list_create_from_enumerator(
! 208: child_sa->create_ts_enumerator(child_sa, FALSE));
! 209:
! 210: DBG0(DBG_IKE, "outbound CHILD_SA %s{%d} established "
! 211: "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
! 212: child_sa->get_name(child_sa),
! 213: child_sa->get_unique_id(child_sa),
! 214: ntohl(child_sa->get_spi(child_sa, TRUE)),
! 215: ntohl(child_sa->get_spi(child_sa, FALSE)),
! 216: my_ts, other_ts);
! 217:
! 218: my_ts->destroy(my_ts);
! 219: other_ts->destroy(other_ts);
! 220: }
! 221:
! 222: /**
! 223: * read in payloads and find the children to delete
! 224: */
! 225: static void process_payloads(private_child_delete_t *this, message_t *message)
! 226: {
! 227: enumerator_t *payloads, *spis;
! 228: payload_t *payload;
! 229: delete_payload_t *delete_payload;
! 230: uint32_t spi;
! 231: protocol_id_t protocol;
! 232: child_sa_t *child_sa;
! 233: entry_t *entry;
! 234:
! 235: payloads = message->create_payload_enumerator(message);
! 236: while (payloads->enumerate(payloads, &payload))
! 237: {
! 238: if (payload->get_type(payload) == PLV2_DELETE)
! 239: {
! 240: delete_payload = (delete_payload_t*)payload;
! 241: protocol = delete_payload->get_protocol_id(delete_payload);
! 242: if (protocol != PROTO_ESP && protocol != PROTO_AH)
! 243: {
! 244: continue;
! 245: }
! 246: spis = delete_payload->create_spi_enumerator(delete_payload);
! 247: while (spis->enumerate(spis, &spi))
! 248: {
! 249: child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
! 250: spi, FALSE);
! 251: if (!child_sa)
! 252: {
! 253: DBG1(DBG_IKE, "received DELETE for unknown %N CHILD_SA with"
! 254: " SPI %.8x", protocol_id_names, protocol, ntohl(spi));
! 255: continue;
! 256: }
! 257: DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x",
! 258: protocol_id_names, protocol, ntohl(spi));
! 259:
! 260: if (this->child_sas->find_first(this->child_sas, match_child,
! 261: NULL, child_sa))
! 262: {
! 263: continue;
! 264: }
! 265: INIT(entry,
! 266: .child_sa = child_sa
! 267: );
! 268: switch (child_sa->get_state(child_sa))
! 269: {
! 270: case CHILD_REKEYED:
! 271: entry->rekeyed = TRUE;
! 272: break;
! 273: case CHILD_DELETED:
! 274: /* already deleted but not yet destroyed, ignore */
! 275: case CHILD_DELETING:
! 276: /* we don't send back a delete if we already initiated
! 277: * a delete ourself */
! 278: if (!this->initiator)
! 279: {
! 280: free(entry);
! 281: continue;
! 282: }
! 283: break;
! 284: case CHILD_REKEYING:
! 285: /* we reply as usual, rekeying will fail */
! 286: case CHILD_INSTALLED:
! 287: if (!this->initiator)
! 288: {
! 289: if (is_redundant(this, child_sa))
! 290: {
! 291: entry->rekeyed = TRUE;
! 292: }
! 293: else
! 294: {
! 295: entry->check_delete_action = TRUE;
! 296: }
! 297: }
! 298: break;
! 299: default:
! 300: break;
! 301: }
! 302: this->child_sas->insert_last(this->child_sas, entry);
! 303: }
! 304: spis->destroy(spis);
! 305: }
! 306: }
! 307: payloads->destroy(payloads);
! 308: }
! 309:
! 310: /**
! 311: * destroy the children listed in this->child_sas, reestablish by policy
! 312: */
! 313: static status_t destroy_and_reestablish(private_child_delete_t *this)
! 314: {
! 315: enumerator_t *enumerator;
! 316: entry_t *entry;
! 317: child_sa_t *child_sa;
! 318: child_cfg_t *child_cfg;
! 319: protocol_id_t protocol;
! 320: uint32_t spi, reqid;
! 321: action_t action;
! 322: status_t status = SUCCESS;
! 323: time_t now, expire;
! 324: u_int delay;
! 325:
! 326: now = time_monotonic(NULL);
! 327: delay = lib->settings->get_int(lib->settings, "%s.delete_rekeyed_delay",
! 328: DELETE_REKEYED_DELAY, lib->ns);
! 329:
! 330: enumerator = this->child_sas->create_enumerator(this->child_sas);
! 331: while (enumerator->enumerate(enumerator, (void**)&entry))
! 332: {
! 333: child_sa = entry->child_sa;
! 334: child_sa->set_state(child_sa, CHILD_DELETED);
! 335: /* signal child down event if we weren't rekeying */
! 336: protocol = child_sa->get_protocol(child_sa);
! 337: if (!entry->rekeyed)
! 338: {
! 339: charon->bus->child_updown(charon->bus, child_sa, FALSE);
! 340: }
! 341: else
! 342: {
! 343: install_outbound(this, protocol, child_sa->get_rekey_spi(child_sa));
! 344: /* for rekeyed CHILD_SAs we uninstall the outbound SA but don't
! 345: * immediately destroy it, by default, so we can process delayed
! 346: * packets */
! 347: child_sa->remove_outbound(child_sa);
! 348: expire = child_sa->get_lifetime(child_sa, TRUE);
! 349: if (delay && (!expire || ((now + delay) < expire)))
! 350: {
! 351: lib->scheduler->schedule_job(lib->scheduler,
! 352: (job_t*)delete_child_sa_job_create_id(
! 353: child_sa->get_unique_id(child_sa)), delay);
! 354: continue;
! 355: }
! 356: else if (now < expire)
! 357: { /* let it expire naturally */
! 358: continue;
! 359: }
! 360: /* no delay and no lifetime, destroy it immediately */
! 361: }
! 362: spi = child_sa->get_spi(child_sa, TRUE);
! 363: reqid = child_sa->get_reqid(child_sa);
! 364: child_cfg = child_sa->get_config(child_sa);
! 365: child_cfg->get_ref(child_cfg);
! 366: action = child_sa->get_close_action(child_sa);
! 367:
! 368: this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
! 369:
! 370: if (entry->check_delete_action)
! 371: { /* enforce child_cfg policy if deleted passively */
! 372: switch (action)
! 373: {
! 374: case ACTION_RESTART:
! 375: child_cfg->get_ref(child_cfg);
! 376: status = this->ike_sa->initiate(this->ike_sa, child_cfg,
! 377: reqid, NULL, NULL);
! 378: break;
! 379: case ACTION_ROUTE:
! 380: charon->traps->install(charon->traps,
! 381: this->ike_sa->get_peer_cfg(this->ike_sa),
! 382: child_cfg);
! 383: break;
! 384: default:
! 385: break;
! 386: }
! 387: }
! 388: child_cfg->destroy(child_cfg);
! 389: if (status != SUCCESS)
! 390: {
! 391: break;
! 392: }
! 393: }
! 394: enumerator->destroy(enumerator);
! 395: return status;
! 396: }
! 397:
! 398: /**
! 399: * send closing signals for all CHILD_SAs over the bus
! 400: */
! 401: static void log_children(private_child_delete_t *this)
! 402: {
! 403: linked_list_t *my_ts, *other_ts;
! 404: enumerator_t *enumerator;
! 405: entry_t *entry;
! 406: child_sa_t *child_sa;
! 407: uint64_t bytes_in, bytes_out;
! 408:
! 409: enumerator = this->child_sas->create_enumerator(this->child_sas);
! 410: while (enumerator->enumerate(enumerator, (void**)&entry))
! 411: {
! 412: child_sa = entry->child_sa;
! 413: my_ts = linked_list_create_from_enumerator(
! 414: child_sa->create_ts_enumerator(child_sa, TRUE));
! 415: other_ts = linked_list_create_from_enumerator(
! 416: child_sa->create_ts_enumerator(child_sa, FALSE));
! 417: if (this->expired)
! 418: {
! 419: DBG0(DBG_IKE, "closing expired CHILD_SA %s{%d} "
! 420: "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
! 421: child_sa->get_name(child_sa), child_sa->get_unique_id(child_sa),
! 422: ntohl(child_sa->get_spi(child_sa, TRUE)),
! 423: ntohl(child_sa->get_spi(child_sa, FALSE)), my_ts, other_ts);
! 424: }
! 425: else
! 426: {
! 427: child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in, NULL);
! 428: child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out, NULL);
! 429:
! 430: DBG0(DBG_IKE, "closing CHILD_SA %s{%d} with SPIs %.8x_i "
! 431: "(%llu bytes) %.8x_o (%llu bytes) and TS %#R === %#R",
! 432: child_sa->get_name(child_sa), child_sa->get_unique_id(child_sa),
! 433: ntohl(child_sa->get_spi(child_sa, TRUE)), bytes_in,
! 434: ntohl(child_sa->get_spi(child_sa, FALSE)), bytes_out,
! 435: my_ts, other_ts);
! 436: }
! 437: my_ts->destroy(my_ts);
! 438: other_ts->destroy(other_ts);
! 439: }
! 440: enumerator->destroy(enumerator);
! 441: }
! 442:
! 443: METHOD(task_t, build_i, status_t,
! 444: private_child_delete_t *this, message_t *message)
! 445: {
! 446: child_sa_t *child_sa;
! 447: entry_t *entry;
! 448:
! 449: child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
! 450: this->spi, TRUE);
! 451: if (!child_sa)
! 452: { /* check if it is an outbound sa */
! 453: child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
! 454: this->spi, FALSE);
! 455: if (!child_sa)
! 456: { /* child does not exist anymore */
! 457: return SUCCESS;
! 458: }
! 459: /* we work only with the inbound SPI */
! 460: this->spi = child_sa->get_spi(child_sa, TRUE);
! 461: }
! 462:
! 463: if (this->expired && child_sa->get_state(child_sa) == CHILD_REKEYED)
! 464: { /* the peer was expected to delete this SA, but if we send a DELETE
! 465: * we might cause a collision there if the CREATE_CHILD_SA response
! 466: * is delayed (the peer wouldn't know if we deleted this SA due to an
! 467: * expire or because of a forced delete by the user and might then
! 468: * ignore the CREATE_CHILD_SA response once it arrives) */
! 469: child_sa->set_state(child_sa, CHILD_DELETED);
! 470: install_outbound(this, this->protocol,
! 471: child_sa->get_rekey_spi(child_sa));
! 472: }
! 473:
! 474: if (child_sa->get_state(child_sa) == CHILD_DELETED)
! 475: { /* DELETEs for this CHILD_SA were already exchanged, but it was not yet
! 476: * destroyed to allow delayed packets to get processed */
! 477: this->ike_sa->destroy_child_sa(this->ike_sa, this->protocol, this->spi);
! 478: message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
! 479: return SUCCESS;
! 480: }
! 481:
! 482: INIT(entry,
! 483: .child_sa = child_sa,
! 484: .rekeyed = child_sa->get_state(child_sa) == CHILD_REKEYED,
! 485: );
! 486: this->child_sas->insert_last(this->child_sas, entry);
! 487: log_children(this);
! 488: build_payloads(this, message);
! 489:
! 490: if (!entry->rekeyed && this->expired)
! 491: {
! 492: child_cfg_t *child_cfg;
! 493:
! 494: DBG1(DBG_IKE, "scheduling CHILD_SA recreate after hard expire");
! 495: child_cfg = child_sa->get_config(child_sa);
! 496: this->ike_sa->queue_task(this->ike_sa, (task_t*)
! 497: child_create_create(this->ike_sa, child_cfg->get_ref(child_cfg),
! 498: FALSE, NULL, NULL));
! 499: }
! 500: return NEED_MORE;
! 501: }
! 502:
! 503: METHOD(task_t, process_i, status_t,
! 504: private_child_delete_t *this, message_t *message)
! 505: {
! 506: process_payloads(this, message);
! 507: DBG1(DBG_IKE, "CHILD_SA closed");
! 508: return destroy_and_reestablish(this);
! 509: }
! 510:
! 511: METHOD(task_t, process_r, status_t,
! 512: private_child_delete_t *this, message_t *message)
! 513: {
! 514: process_payloads(this, message);
! 515: log_children(this);
! 516: return NEED_MORE;
! 517: }
! 518:
! 519: METHOD(task_t, build_r, status_t,
! 520: private_child_delete_t *this, message_t *message)
! 521: {
! 522: build_payloads(this, message);
! 523: DBG1(DBG_IKE, "CHILD_SA closed");
! 524: return destroy_and_reestablish(this);
! 525: }
! 526:
! 527: METHOD(task_t, get_type, task_type_t,
! 528: private_child_delete_t *this)
! 529: {
! 530: return TASK_CHILD_DELETE;
! 531: }
! 532:
! 533: METHOD(child_delete_t , get_child, child_sa_t*,
! 534: private_child_delete_t *this)
! 535: {
! 536: child_sa_t *child_sa = NULL;
! 537: entry_t *entry;
! 538:
! 539: if (this->child_sas->get_first(this->child_sas, (void**)&entry) == SUCCESS)
! 540: {
! 541: child_sa = entry->child_sa;
! 542: }
! 543: return child_sa;
! 544: }
! 545:
! 546: METHOD(task_t, migrate, void,
! 547: private_child_delete_t *this, ike_sa_t *ike_sa)
! 548: {
! 549: this->ike_sa = ike_sa;
! 550:
! 551: this->child_sas->destroy_function(this->child_sas, free);
! 552: this->child_sas = linked_list_create();
! 553: }
! 554:
! 555: METHOD(task_t, destroy, void,
! 556: private_child_delete_t *this)
! 557: {
! 558: this->child_sas->destroy_function(this->child_sas, free);
! 559: free(this);
! 560: }
! 561:
! 562: /*
! 563: * Described in header.
! 564: */
! 565: child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
! 566: uint32_t spi, bool expired)
! 567: {
! 568: private_child_delete_t *this;
! 569:
! 570: INIT(this,
! 571: .public = {
! 572: .task = {
! 573: .get_type = _get_type,
! 574: .migrate = _migrate,
! 575: .destroy = _destroy,
! 576: },
! 577: .get_child = _get_child,
! 578: },
! 579: .ike_sa = ike_sa,
! 580: .child_sas = linked_list_create(),
! 581: .protocol = protocol,
! 582: .spi = spi,
! 583: .expired = expired,
! 584: );
! 585:
! 586: if (protocol != PROTO_NONE)
! 587: {
! 588: this->public.task.build = _build_i;
! 589: this->public.task.process = _process_i;
! 590: this->initiator = TRUE;
! 591: }
! 592: else
! 593: {
! 594: this->public.task.build = _build_r;
! 595: this->public.task.process = _process_r;
! 596: this->initiator = FALSE;
! 597: }
! 598: return &this->public;
! 599: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to child_delete.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / sa / ikev2 / tasks