Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP2:Update
strongswan.27472
strongswan-marvell-auth-els.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File strongswan-marvell-auth-els.patch of Package strongswan.27472
From 31541a25dfc199439450fb03381fbb4b687386b7 Mon Sep 17 00:00:00 2001 From: Bhushan Narkhede <bnarkhede@marvell.com> Date: Fri, 20 Aug 2021 02:53:56 -0700 Subject: [PATCH] strongswan marvell auth els --- conf/Makefile.am | 1 + conf/options/charon.opt | 3 + conf/plugins/auth-els.opt | 26 + configure.ac | 8 + src/charon-cmd/cmd/cmd_connection.c | 3 +- src/charon-nm/nm/nm_service.c | 3 +- src/charon/Makefile.am | 4 + src/libcharon/Makefile.am | 8 + src/libcharon/config/ike_cfg.c | 2 +- src/libcharon/encoding/parser.c | 10 + .../payloads/traffic_selector_substructure.c | 139 +++- src/libcharon/kernel/kernel_fc_sp.c | 40 ++ src/libcharon/kernel/kernel_fc_sp.h | 341 ++++++++++ src/libcharon/kernel/kernel_interface.c | 169 ++++- src/libcharon/kernel/kernel_interface.h | 30 +- src/libcharon/kernel/kernel_ipsec.h | 2 + src/libcharon/network/sender.c | 35 +- src/libcharon/network/socket.h | 6 + src/libcharon/network/socket_manager.c | 135 ++-- src/libcharon/network/socket_manager.h | 3 +- src/libcharon/plugins/auth_els/Makefile.am | 25 + .../plugins/auth_els/auth_els_configs.c | 595 ++++++++++++++++++ .../plugins/auth_els/auth_els_configs.h | 44 ++ src/libcharon/plugins/auth_els/auth_els_ike.c | 265 ++++++++ src/libcharon/plugins/auth_els/auth_els_ike.h | 42 ++ .../plugins/auth_els/auth_els_kernel_fc_sp.c | 252 ++++++++ .../plugins/auth_els/auth_els_kernel_fc_sp.h | 35 ++ .../plugins/auth_els/auth_els_plugin.c | 208 ++++++ .../plugins/auth_els/auth_els_plugin.h | 43 ++ .../plugins/auth_els/auth_els_socket.c | 115 ++++ .../plugins/auth_els/auth_els_socket.h | 29 + .../plugins/auth_els/auth_els_utils.h | 40 ++ src/libcharon/plugins/ha/ha_tunnel.c | 2 +- .../plugins/load_tester/load_tester_config.c | 3 +- src/libcharon/plugins/medcli/medcli_config.c | 5 +- src/libcharon/plugins/medsrv/medsrv_config.c | 3 +- src/libcharon/plugins/sql/sql_config.c | 3 +- .../plugins/stroke/stroke_attribute.c | 2 + src/libcharon/plugins/stroke/stroke_config.c | 3 +- src/libcharon/plugins/stroke/stroke_list.c | 10 + src/libcharon/plugins/uci/uci_config.c | 5 +- src/libcharon/plugins/vici/vici_attribute.c | 4 +- src/libcharon/plugins/vici/vici_config.c | 5 +- src/libcharon/plugins/vici/vici_control.c | 3 +- src/libcharon/processing/jobs/migrate_job.c | 2 +- src/libcharon/sa/child_sa.c | 20 +- src/libcharon/sa/child_sa.h | 11 + src/libcharon/sa/ike_sa.c | 33 +- src/libcharon/sa/ike_sa.h | 4 + src/libcharon/sa/ike_sa_manager.c | 27 +- src/libcharon/sa/ike_sa_manager.h | 15 +- src/libcharon/sa/ikev1/tasks/informational.c | 3 +- src/libcharon/sa/ikev1/tasks/isakmp_natd.c | 3 +- src/libcharon/sa/ikev2/task_manager_v2.c | 3 +- src/libcharon/sa/ikev2/tasks/child_create.c | 8 +- src/libcharon/sa/ikev2/tasks/ike_mobike.c | 6 +- src/libcharon/sa/ikev2/tasks/ike_natd.c | 19 +- src/libstrongswan/networking/host.c | 19 +- src/libstrongswan/plugins/plugin_loader.c | 2 +- .../selectors/traffic_selector.c | 215 ++++++- .../selectors/traffic_selector.h | 80 ++- src/libstrongswan/utils/identification.c | 14 +- src/libstrongswan/utils/identification.h | 7 + 63 files changed, 3069 insertions(+), 131 deletions(-) create mode 100644 conf/plugins/auth-els.opt create mode 100644 src/libcharon/kernel/kernel_fc_sp.c create mode 100644 src/libcharon/kernel/kernel_fc_sp.h create mode 100644 src/libcharon/plugins/auth_els/Makefile.am create mode 100644 src/libcharon/plugins/auth_els/auth_els_configs.c create mode 100644 src/libcharon/plugins/auth_els/auth_els_configs.h create mode 100644 src/libcharon/plugins/auth_els/auth_els_ike.c create mode 100644 src/libcharon/plugins/auth_els/auth_els_ike.h create mode 100644 src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.c create mode 100644 src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.h create mode 100644 src/libcharon/plugins/auth_els/auth_els_plugin.c create mode 100644 src/libcharon/plugins/auth_els/auth_els_plugin.h create mode 100644 src/libcharon/plugins/auth_els/auth_els_socket.c create mode 100644 src/libcharon/plugins/auth_els/auth_els_socket.h create mode 100644 src/libcharon/plugins/auth_els/auth_els_utils.h diff --git a/conf/Makefile.am b/conf/Makefile.am index 1c2b41236..ce3129df0 100644 --- a/conf/Makefile.am +++ b/conf/Makefile.am @@ -32,6 +32,7 @@ plugins = \ plugins/android_log.opt \ plugins/attr.opt \ plugins/attr-sql.opt \ + plugins/auth-els.opt \ plugins/bliss.opt \ plugins/bypass-lan.opt \ plugins/certexpire.opt \ diff --git a/conf/options/charon.opt b/conf/options/charon.opt index cc58afda8..3f4ff1395 100644 --- a/conf/options/charon.opt +++ b/conf/options/charon.opt @@ -380,6 +380,9 @@ charon.send_delay_request = yes charon.send_delay_type = 0 Specific IKEv2 message type to delay, 0 for any. +charon.sender_thread_count = 1 + For applications that require connection scaling, this allows creation of multiples threads to do sends. + charon.send_vendor_id = no Send strongSwan vendor ID payload diff --git a/conf/plugins/auth-els.opt b/conf/plugins/auth-els.opt new file mode 100644 index 000000000..8e1d796f6 --- /dev/null +++ b/conf/plugins/auth-els.opt @@ -0,0 +1,26 @@ +charon.plugins.auth-els.rekey_config.rekey_1.rekey_time = 7200 + Time between each request for a new key, only applies to initiator. + +charon.plugins.auth-els.rekey_config.rekey_1.reauth_time = 606000 + Reauth time to replace old key with new one. + +charon.plugins.auth-els.rekey_config.rekey_1.reauth_rekey_jitter = 60 + Minimum separation between reauth and rekey. + +charon.plugins.auth-els.disabled_remotes.remote_1.wwpn = 21:00:00:24:ff:78:30:c5 + WWPN of remote port. + +charon.plugins.auth-els.disabled_remotes.remote_1.wwpn_separator = . : - + WWPN separated by : . -. + +charon.plugins.auth-els.shared_secret_config.shared_secret_1.shared_secret = strongswan + Shared secret between initiator and target + +charon.plugins.auth-els.algorithm_config.ike_proposal = aes256gcm16-prfsha256-curve25519 + Encryption algorithm for IKE - SA negotiation + +charon.plugins.auth-els.algorithm_config.esp_proposal = aes128gcm16 + Encryption algorithm for ESP - data on the wire + +charon.plugins.auth-els.rekey_config.rekey_1.ike_auth_direct_child = false + If it is desired to get the child SA during the IKE_AUTH phase, set this to true diff --git a/configure.ac b/configure.ac index d7e7a1134..d1513760f 100644 --- a/configure.ac +++ b/configure.ac @@ -3,6 +3,7 @@ # Copyright (C) 2006-2019 Andreas Steffen # Copyright (C) 2006-2014 Martin Willi # HSR Hochschule fuer Technik Rapperswil +# Copyright (C) 2019-2020 Marvell # # This program is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by the @@ -204,6 +205,7 @@ ARG_ENABL_SET([eap-tnc], [enable EAP TNC trusted network connect module.] ARG_ENABL_SET([eap-dynamic], [enable dynamic EAP proxy module.]) ARG_ENABL_SET([eap-radius], [enable RADIUS proxy authentication module.]) ARG_ENABL_SET([ext-auth], [enable plugin calling an external authorization script.]) +ARG_ENABL_SET([auth-els], [enable auth els plugin authorization module.]) ARG_ENABL_SET([ipseckey], [enable IPSECKEY authentication plugin.]) ARG_ENABL_SET([keychain], [enables OS X Keychain Services credential set.]) ARG_ENABL_SET([pkcs11], [enables the PKCS11 token support plugin.]) @@ -596,6 +598,8 @@ AC_CHECK_FUNCS(pthread_rwlock_init) AC_CHECK_FUNCS(pthread_spin_init) # check if we have POSIX semaphore functions, including timed-wait AC_CHECK_FUNCS(sem_timedwait) +# lookup major()/minor()/makedev() +AC_HEADER_MAJOR LIBS=$saved_LIBS AC_CHECK_FUNC( @@ -1462,6 +1466,7 @@ ADD_PLUGIN([kernel-wfp], [c charon]) ADD_PLUGIN([kernel-iph], [c charon]) ADD_PLUGIN([kernel-pfkey], [c charon starter nm cmd]) ADD_PLUGIN([kernel-pfroute], [c charon starter nm cmd]) +ADD_PLUGIN([auth-els], [c charon]) ADD_PLUGIN([kernel-netlink], [c charon starter nm cmd]) ADD_PLUGIN([resolve], [c charon cmd]) ADD_PLUGIN([save-keys], [c]) @@ -1644,6 +1649,8 @@ AM_CONDITIONAL(USE_KERNEL_WFP, test x$kernel_wfp = xtrue) AM_CONDITIONAL(USE_KERNEL_IPH, test x$kernel_iph = xtrue) AM_CONDITIONAL(USE_WHITELIST, test x$whitelist = xtrue) AM_CONDITIONAL(USE_EXT_AUTH, test x$ext_auth = xtrue) +AM_CONDITIONAL(USE_AUTH_ELS, test x$auth_els = xtrue) +AM_CONDITIONAL(USE_DISABLE_SIGNAL_HANDLER, test x$auth_els = xtrue) AM_CONDITIONAL(USE_LOOKIP, test x$lookip = xtrue) AM_CONDITIONAL(USE_ERROR_NOTIFY, test x$error_notify = xtrue) AM_CONDITIONAL(USE_CERTEXPIRE, test x$certexpire = xtrue) @@ -1988,6 +1995,7 @@ AC_CONFIG_FILES([ src/libcharon/plugins/kernel_iph/Makefile src/libcharon/plugins/whitelist/Makefile src/libcharon/plugins/ext_auth/Makefile + src/libcharon/plugins/auth_els/Makefile src/libcharon/plugins/lookip/Makefile src/libcharon/plugins/error_notify/Makefile src/libcharon/plugins/certexpire/Makefile diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c index b91c89830..1a7bc637f 100644 --- a/src/charon-cmd/cmd/cmd_connection.c +++ b/src/charon-cmd/cmd/cmd_connection.c @@ -4,6 +4,7 @@ * * Copyright (C) 2013 Martin Willi * Copyright (C) 2013 revosec AG + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -181,7 +182,7 @@ static peer_cfg_t* create_peer_cfg(private_cmd_connection_t *this) break; } - ike.local_port = charon->socket->get_port(charon->socket, FALSE); + ike.local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE); if (ike.local_port != IKEV2_UDP_PORT) { ike.remote_port = IKEV2_NATT_PORT; diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c index 1b07230fd..30ffed66c 100644 --- a/src/charon-nm/nm/nm_service.c +++ b/src/charon-nm/nm/nm_service.c @@ -3,6 +3,7 @@ * * Copyright (C) 2013-2019 Tobias Brunner * Copyright (C) 2008-2009 Martin Willi + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -397,7 +398,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, ike_cfg_create_t ike = { .version = IKEV2, .local = "%any", - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote_port = IKEV2_UDP_PORT, .fragmentation = FRAGMENTATION_YES, }; diff --git a/src/charon/Makefile.am b/src/charon/Makefile.am index b78bbd757..f490be6e6 100644 --- a/src/charon/Makefile.am +++ b/src/charon/Makefile.am @@ -17,4 +17,8 @@ charon_LDADD = \ $(top_builddir)/src/libcharon/libcharon.la \ -lm $(PTHREADLIB) $(ATOMICLIB) $(DLLIB) +if USE_DISABLE_SIGNAL_HANDLER + AM_CPPFLAGS += -DDISABLE_SIGNAL_HANDLER +endif + EXTRA_DIST = Android.mk diff --git a/src/libcharon/Makefile.am b/src/libcharon/Makefile.am index 15ac7a6d1..baec785bb 100644 --- a/src/libcharon/Makefile.am +++ b/src/libcharon/Makefile.am @@ -47,6 +47,7 @@ encoding/payloads/hash_payload.c encoding/payloads/hash_payload.h \ encoding/payloads/fragment_payload.c encoding/payloads/fragment_payload.h \ kernel/kernel_interface.c kernel/kernel_interface.h \ kernel/kernel_ipsec.c kernel/kernel_ipsec.h \ +kernel/kernel_fc_sp.c kernel/kernel_fc_sp.h \ kernel/kernel_net.c kernel/kernel_net.h \ kernel/kernel_listener.h kernel/kernel_handler.c kernel/kernel_handler.h \ network/receiver.c network/receiver.h network/sender.c network/sender.h \ @@ -327,6 +328,13 @@ if MONOLITHIC endif endif +if USE_AUTH_ELS + SUBDIRS += plugins/auth_els +if MONOLITHIC + libcharon_la_LIBADD += plugins/auth_els/libstrongswan-auth-els.la +endif +endif + if USE_EAP_IDENTITY SUBDIRS += plugins/eap_identity if MONOLITHIC diff --git a/src/libcharon/config/ike_cfg.c b/src/libcharon/config/ike_cfg.c index 79a344e45..a3a74a14c 100644 --- a/src/libcharon/config/ike_cfg.c +++ b/src/libcharon/config/ike_cfg.c @@ -450,7 +450,7 @@ static traffic_selector_t* make_range(char *str) { return NULL; } - if (to->get_family(to) == AF_INET) + if (to->get_family(to) == AF_INET || to->get_family(to) == AF_NETLINK) { type = TS_IPV4_ADDR_RANGE; } diff --git a/src/libcharon/encoding/parser.c b/src/libcharon/encoding/parser.c index 9169ba202..66fb72307 100644 --- a/src/libcharon/encoding/parser.c +++ b/src/libcharon/encoding/parser.c @@ -2,6 +2,7 @@ * Copyright (C) 2005-2009 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -596,11 +597,20 @@ METHOD(parser_t, parse_payload, status_t, return PARSE_ERROR; } ts_type = *(uint8_t*)(output + rule->offset); + + if(ts_type == TS_FC_ADDR_RANGE) + { + traffic_selector_substructure_t *tsstruct = (traffic_selector_substructure_t*)pld; + tsstruct->set_ts_type(tsstruct, TS_FC_ADDR_RANGE); + rule_count = pld->get_encoding_rules(pld, &this->rules); + } + break; } case ADDRESS: { int address_length = (ts_type == TS_IPV4_ADDR_RANGE) ? 4 : 16; + address_length = ((ts_type == TS_FC_ADDR_RANGE) ? 3 : address_length); if (!parse_chunk(this, rule_number, output + rule->offset, address_length)) diff --git a/src/libcharon/encoding/payloads/traffic_selector_substructure.c b/src/libcharon/encoding/payloads/traffic_selector_substructure.c index febf0c410..68e770fe5 100644 --- a/src/libcharon/encoding/payloads/traffic_selector_substructure.c +++ b/src/libcharon/encoding/payloads/traffic_selector_substructure.c @@ -3,6 +3,7 @@ * Copyright (C) 2010 revosec AG * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -66,6 +67,22 @@ struct private_traffic_selector_substructure_t { * Ending address. */ chunk_t ending_address; + + /** + * starting R_CTL. + */ + uint8_t starting_r_ctl; + + /** + * ending R_CTL. + */ + uint8_t ending_r_ctl; + + /** + * FC port is identified using port index + * as host_t structure is still not FC compliant. + */ + uint16_t id; }; /** @@ -109,9 +126,68 @@ static encoding_rule_t encodings[] = { +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ +/** + * Encoding rules to parse or generate a TS payload as per FC-SP-2 + * + * The defined offsets are the positions in a object of type + * private_traffic_selector_substructure_t. + */ +static encoding_rule_t fc_encodings[] = { + /* 1 Byte next ts type*/ + { TS_TYPE, offsetof(private_traffic_selector_substructure_t, ts_type) }, + /* 1 Byte reserved*/ + { U_INT_8, offsetof(private_traffic_selector_substructure_t, ip_protocol_id) }, + /* 2 Byte Length of the whole payload*/ + { PAYLOAD_LENGTH,offsetof(private_traffic_selector_substructure_t, payload_length) }, + /* 1 Byte starting R_CTL*/ + { U_INT_8, offsetof(private_traffic_selector_substructure_t, starting_r_ctl) }, + /* 3 Bytes starting address */ + { ADDRESS, offsetof(private_traffic_selector_substructure_t, starting_address) }, + /* 1 Byte ending R_CTL*/ + { U_INT_8, offsetof(private_traffic_selector_substructure_t, ending_r_ctl) }, + /* 3 Bytes ending address */ + { ADDRESS, offsetof(private_traffic_selector_substructure_t, ending_address) }, + /* 2 Byte start type*/ + { U_INT_16, offsetof(private_traffic_selector_substructure_t, start_port) }, + /* 2 Byte start type*/ + { U_INT_16, offsetof(private_traffic_selector_substructure_t, end_port) } +}; +/* + 0 1 2 3 4 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + ! TS Type ! Reserved* | Selector Length | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Starting R_CTL| Starting Address* | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Ending R_CTL | Ending Address* | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Start Type* | End Type* | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +*/ + METHOD(payload_t, verify, status_t, private_traffic_selector_substructure_t *this) { + if (this->ts_type == TS_FC_ADDR_RANGE) + { + if (this->start_port > this->end_port) + { + return FAILED; + } + if (this->starting_r_ctl > this->ending_r_ctl) + { + return FAILED; + } + if ((this->starting_address.len != 3) || + (this->ending_address.len != 3)) + { + /* ipv4 address must be 4 bytes long */ + return FAILED; + } + return SUCCESS; + } + if (this->start_port > this->end_port) { /* OPAQUE ports are the only exception */ @@ -142,6 +218,15 @@ METHOD(payload_t, verify, status_t, } break; } + case TS_FC_ADDR_RANGE: + { + if ((this->starting_address.len != 3) || + (this->ending_address.len != 3)) + { + return FAILED; + } + break; + } default: { /* not supported ts type */ @@ -155,8 +240,16 @@ METHOD(payload_t, verify, status_t, METHOD(payload_t, get_encoding_rules, int, private_traffic_selector_substructure_t *this, encoding_rule_t **rules) { - *rules = encodings; - return countof(encodings); + if (this->ts_type == TS_FC_ADDR_RANGE) + { + *rules = fc_encodings; + return countof(fc_encodings); + } + else + { + *rules = encodings; + return countof(encodings); + } } METHOD(payload_t, get_header_length, int, @@ -188,13 +281,42 @@ METHOD(payload_t, get_length, size_t, return this->payload_length; } +METHOD(traffic_selector_substructure_t, set_ts_type, void, + private_traffic_selector_substructure_t *this, ts_type_t ts_type) +{ + this->ts_type = ts_type; + if (this->ts_type == TS_FC_ADDR_RANGE) + { + this->payload_length = get_header_length(this) + + 8; //starting address(3), ending address(3), start R_CTL(1), end R_CTL(1) + } +} + +METHOD(traffic_selector_substructure_t, get_ts_type, ts_type_t, + private_traffic_selector_substructure_t *this) +{ + return this->ts_type; +} + + METHOD(traffic_selector_substructure_t, get_traffic_selector, traffic_selector_t*, private_traffic_selector_substructure_t *this) { - return traffic_selector_create_from_bytes( + traffic_selector_t* ts = NULL; + if (this->ts_type == TS_FC_ADDR_RANGE) + { + ts = traffic_selector_create_from_fcsp2_format(this->starting_address, this->start_port, + this->ending_address, this->end_port, + this->starting_r_ctl, this->ending_r_ctl); + } + else + { + ts = traffic_selector_create_from_bytes( this->ip_protocol_id, this->ts_type, this->starting_address, this->start_port, this->ending_address, this->end_port); + } + return ts; } METHOD2(payload_t, traffic_selector_substructure_t, destroy, void, @@ -224,6 +346,8 @@ traffic_selector_substructure_t *traffic_selector_substructure_create() .get_type = _get_type, .destroy = _destroy, }, + .get_ts_type = _get_ts_type, + .set_ts_type = _set_ts_type, .get_traffic_selector = _get_traffic_selector, .destroy = _destroy, }, @@ -251,6 +375,15 @@ traffic_selector_substructure_t *traffic_selector_substructure_create_from_traff this->ending_address = chunk_clone(ts->get_to_address(ts)); this->payload_length = get_header_length(this) + this->ending_address.len + this->starting_address.len; + if (this->ts_type == TS_FC_ADDR_RANGE) + { + this->payload_length = get_header_length(this) + + this->ending_address.len + this->starting_address.len + + 2; //start/end R_CTL + this->starting_r_ctl = ts->get_start_rctl(ts); + this->ending_r_ctl = ts->get_end_rctl(ts); + this->id = ts->get_id(ts); + } return &this->public; } diff --git a/src/libcharon/kernel/kernel_fc_sp.c b/src/libcharon/kernel/kernel_fc_sp.c new file mode 100644 index 000000000..9532cae4f --- /dev/null +++ b/src/libcharon/kernel/kernel_fc_sp.c @@ -0,0 +1,40 @@ +/* + * Copyright (C) 2008 Tobias Brunner + * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell + * + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "kernel_fc_sp.h" + +#include <daemon.h> + +/** + * See header + */ +bool kernel_fc_sp_register(plugin_t *plugin, plugin_feature_t *feature, + bool reg, void *data) +{ + if (reg) + { + return charon->kernel->add_fc_sp_interface(charon->kernel, + (kernel_fc_sp_constructor_t)data); + } + else + { + return charon->kernel->remove_fc_sp_interface(charon->kernel, + (kernel_fc_sp_constructor_t)data); + } +} + + diff --git a/src/libcharon/kernel/kernel_fc_sp.h b/src/libcharon/kernel/kernel_fc_sp.h new file mode 100644 index 000000000..2d2b12e59 --- /dev/null +++ b/src/libcharon/kernel/kernel_fc_sp.h @@ -0,0 +1,341 @@ +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ + +/* + * File: kernel_fc_sp.h + * Author: cwinkler + * + * Created on October 20, 2020, 2:19 PM + */ + +#ifndef KERNEL_FC_SP_H +#define KERNEL_FC_SP_H + +typedef struct kernel_fc_sp_t kernel_fc_sp_t; +typedef struct kernel_fc_sp_sa_id_t kernel_fc_sp_sa_id_t; +typedef struct kernel_fc_sp_add_sa_t kernel_fc_sp_add_sa_t; +typedef struct kernel_fc_sp_update_sa_t kernel_fc_sp_update_sa_t; +typedef struct kernel_fc_sp_query_sa_t kernel_fc_sp_query_sa_t; +typedef struct kernel_fc_sp_del_sa_t kernel_fc_sp_del_sa_t; +typedef struct kernel_fc_sp_policy_id_t kernel_fc_sp_policy_id_t; +typedef struct kernel_fc_sp_manage_policy_t kernel_fc_sp_manage_policy_t; +typedef struct kernel_fc_sp_query_policy_t kernel_fc_sp_query_policy_t; + +#include <networking/host.h> +#include <ipsec/ipsec_types.h> +#include <selectors/traffic_selector.h> +#include <plugins/plugin.h> +#include <kernel/kernel_interface.h> + +/** + * Data required to identify an SA in the kernel + */ +struct kernel_fc_sp_sa_id_t { + /** Source address */ + host_t *src; + /** Destination address */ + host_t *dst; + /** SPI */ + uint32_t spi; + /** Protocol (ESP/AH) */ + uint8_t proto; + /** Optional mark */ + mark_t mark; + /** Optional interface ID */ + uint32_t if_id; +}; + +/** + * Data required to add an SA to the kernel + */ +struct kernel_fc_sp_add_sa_t { + /** Reqid */ + uint32_t reqid; + /** Mode (tunnel, transport...) */ + ipsec_mode_t mode; + /** List of source traffic selectors */ + linked_list_t *src_ts; + /** List of destination traffic selectors */ + linked_list_t *dst_ts; + /** Network interface restricting policy */ + char *interface; + /** Lifetime configuration */ + lifetime_cfg_t *lifetime; + /** Encryption algorithm */ + uint16_t enc_alg; + /** Encryption key */ + chunk_t enc_key; + /** Integrity protection algorithm */ + uint16_t int_alg; + /** Integrity protection key */ + chunk_t int_key; + /** Anti-replay window size */ + uint32_t replay_window; + /** Traffic Flow Confidentiality padding */ + uint32_t tfc; + /** IPComp transform */ + uint16_t ipcomp; + /** CPI for IPComp */ + uint16_t cpi; + /** TRUE to enable UDP encapsulation for NAT traversal */ + bool encap; + /** no (disabled), yes (enabled), auto (enabled if supported) */ + hw_offload_t hw_offload; + /** Mark the SA should apply to packets after processing */ + mark_t mark; + /** TRUE to use Extended Sequence Numbers */ + bool esn; + /** TRUE to copy the DF bit to the outer IPv4 header in tunnel mode */ + bool copy_df; + /** TRUE to copy the ECN header field to/from the outer header */ + bool copy_ecn; + /** Whether to copy the DSCP header field to/from the outer header */ + dscp_copy_t copy_dscp; + /** TRUE if initiator of the exchange creating the SA */ + bool initiator; + /** TRUE if this is an inbound SA */ + bool inbound; + /** TRUE if an SPI has already been allocated for this SA */ + bool update; +}; + +/** + * Data required to update the hosts of an SA in the kernel + */ +struct kernel_fc_sp_update_sa_t { + /** CPI in case IPComp is used */ + uint16_t cpi; + /** New source address */ + host_t *new_src; + /** New destination address */ + host_t *new_dst; + /** TRUE if UDP encapsulation is currently enabled */ + bool encap; + /** TRUE to enable UDP encapsulation */ + bool new_encap; +}; + +/** + * Data required to query an SA in the kernel + */ +struct kernel_fc_sp_query_sa_t { + uint16_t cpi; +}; + +/** + * Data required to delete an SA in the kernel + */ +struct kernel_fc_sp_del_sa_t { + /** CPI in case IPComp is used */ + uint16_t cpi; +}; + +/** + * Data identifying a policy in the kernel + */ +struct kernel_fc_sp_policy_id_t { + /** Direction of traffic */ + policy_dir_t dir; + /** Source traffic selector */ + traffic_selector_t *src_ts; + /** Destination traffic selector */ + traffic_selector_t *dst_ts; + /** Optional mark */ + mark_t mark; + /** Optional interface ID */ + uint32_t if_id; + /** Network interface restricting policy */ + char *interface; +}; + +/** + * Data required to add/delete a policy to/from the kernel + */ +struct kernel_fc_sp_manage_policy_t { + /** Type of policy */ + policy_type_t type; + /** Priority class */ + policy_priority_t prio; + /** Manually-set priority (automatic if set to 0) */ + uint32_t manual_prio; + /** Source address of the SA(s) tied to this policy */ + host_t *src; + /** Destination address of the SA(s) tied to this policy */ + host_t *dst; + /** Details about the SA(s) tied to this policy */ + ipsec_sa_cfg_t *sa; +}; + +/** + * Data required to query a policy in the kernel + */ +struct kernel_fc_sp_query_policy_t { +}; + + +/** + * Interface to the fc-sp subsystem. + * + * The kernel fc-sp interface handles the communication with the FC-SP + * module that will communicate to the lower level that handles the SAs. + * FC-SP does not currently use policies so they are not provided in this + * implementation of the interface. + */ +struct kernel_fc_sp_t { + + /** + * Get the feature set supported by this kernel backend. + * + * @return ORed feature-set of backend + */ + kernel_feature_t (*get_features)(kernel_fc_sp_t *this); + + /** + * Get a SPI from the kernel. + * + * @param src source address of SA + * @param dst destination address of SA + * @param protocol protocol for SA (ESP/AH) + * @param spi allocated spi + * @return SUCCESS if operation completed + */ + status_t (*get_spi)(kernel_fc_sp_t *this, host_t *src, host_t *dst, + uint8_t protocol, uint32_t *spi); + + /** + * Get a Compression Parameter Index (CPI) from the kernel. + * + * @param src source address of SA + * @param dst destination address of SA + * @param cpi allocated cpi + * @return SUCCESS if operation completed + */ + status_t (*get_cpi)(kernel_fc_sp_t *this, host_t *src, host_t *dst, + uint16_t *cpi); + + /** + * Add an SA to the SAD. + * + * This function does install a single SA for a single protocol in one + * direction. + * + * @param id data identifying this SA + * @param data data for this SA + * @return SUCCESS if operation completed + */ + status_t (*add_sa)(kernel_fc_sp_t *this, kernel_fc_sp_sa_id_t *id, + kernel_fc_sp_add_sa_t *data); + + /** + * Update the hosts on an installed SA. + * + * We cannot directly update the destination address as the kernel + * requires the spi, the protocol AND the destination address (and family) + * to identify SAs. Therefore if the destination address changed we + * create a new SA and delete the old one. + * + * @param id data identifying this SA + * @param data updated data for this SA + * @return SUCCESS if operation completed, NOT_SUPPORTED if + * the kernel interface can't update the SA + */ + status_t (*update_sa)(kernel_fc_sp_t *this, kernel_fc_sp_sa_id_t *id, + kernel_fc_sp_update_sa_t *data); + + /** + * Query the number of bytes processed by an SA from the SAD. + * + * @param id data identifying this SA + * @param data data to query the SA + * @param[out] bytes the number of bytes processed by SA + * @param[out] packets number of packets processed by SA + * @param[out] time last (monotonic) time of SA use + * @return SUCCESS if operation completed + */ + status_t (*query_sa)(kernel_fc_sp_t *this, kernel_fc_sp_sa_id_t *id, + kernel_fc_sp_query_sa_t *data, uint64_t *bytes, + uint64_t *packets, time_t *time); + + /** + * Delete a previously installed SA from the SAD. + * + * @param id data identifying this SA + * @param data data to delete the SA + * @return SUCCESS if operation completed + */ + status_t (*del_sa)(kernel_fc_sp_t *this, kernel_fc_sp_sa_id_t *id, + kernel_fc_sp_del_sa_t *data); + + /** + * Add a policy to the SPD. + * + * @param id data identifying this policy + * @param data data for this policy + * @return SUCCESS if operation completed + */ + status_t (*add_policy)(kernel_fc_sp_t *this, + kernel_fc_sp_policy_id_t *id, + kernel_fc_sp_manage_policy_t *data); + + /** + * Query the use time of a policy. + * + * The use time of a policy is the time the policy was used for the last + * time. It is not the system time, but a monotonic timestamp as returned + * by time_monotonic. + * + * @param id data identifying this policy + * @param data data to query the policy + * @param[out] use_time the monotonic timestamp of this SA's last use + * @return SUCCESS if operation completed + */ + status_t (*query_policy)(kernel_fc_sp_t *this, + kernel_fc_sp_policy_id_t *id, + kernel_fc_sp_query_policy_t *data, + time_t *use_time); + + /** + * Remove a policy from the SPD. + * + * @param id data identifying this policy + * @param data data for this policy + * @return SUCCESS if operation completed + */ + status_t (*del_policy)(kernel_fc_sp_t *this, + kernel_fc_sp_policy_id_t *id, + kernel_fc_sp_manage_policy_t *data); + + /** + * Install a bypass policy for the given socket. + * + * @param fd socket file descriptor to setup policy for + * @param family protocol family of the socket + * @return TRUE of policy set up successfully + */ + bool (*bypass_socket)(kernel_fc_sp_t *this, int fd, int family); + + /** + * Enable decapsulation of ESP-in-UDP packets for the given port/socket. + * + * @param fd socket file descriptor + * @param family protocol family of the socket + * @param port the UDP port + * @return TRUE if UDP decapsulation was enabled successfully + */ + bool (*enable_udp_decap)(kernel_fc_sp_t *this, int fd, int family, + uint16_t port); + + /** + * Destroy the implementation. + */ + void (*destroy)(kernel_fc_sp_t *this); +}; + +bool kernel_fc_sp_register(plugin_t *plugin, plugin_feature_t *feature, + bool reg, void *data); + +#endif /* KERNEL_FC_SP_H */ + diff --git a/src/libcharon/kernel/kernel_interface.c b/src/libcharon/kernel/kernel_interface.c index e216c972c..9304723e1 100644 --- a/src/libcharon/kernel/kernel_interface.c +++ b/src/libcharon/kernel/kernel_interface.c @@ -4,6 +4,7 @@ * * Copyright (C) 2010 Martin Willi * Copyright (C) 2010 revosec AG + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -90,6 +91,11 @@ struct private_kernel_interface_t { * Registered IPsec constructor */ kernel_ipsec_constructor_t ipsec_constructor; + + /** + * Registered FC-SP constructor + */ + kernel_fc_sp_constructor_t fc_sp_constructor; /** * Registered net constructor @@ -100,6 +106,11 @@ struct private_kernel_interface_t { * ipsec interface */ kernel_ipsec_t *ipsec; + + /** + * fc-sp interface + */ + kernel_fc_sp_t *fc_sp; /** * network interface @@ -150,17 +161,27 @@ struct private_kernel_interface_t { }; METHOD(kernel_interface_t, get_features, kernel_feature_t, - private_kernel_interface_t *this) + private_kernel_interface_t *this, int family) { kernel_feature_t features = 0; - - if (this->ipsec && this->ipsec->get_features) + + if (family == AF_NETLINK) { - features |= this->ipsec->get_features(this->ipsec); + if (this->fc_sp && this->fc_sp->get_features) + { + features |= this->fc_sp->get_features(this->fc_sp); + } } - if (this->net && this->net->get_features) + else { - features |= this->net->get_features(this->net); + if (this->ipsec && this->ipsec->get_features) + { + features |= this->ipsec->get_features(this->ipsec); + } + if (this->net && this->net->get_features) + { + features |= this->net->get_features(this->net); + } } return features; } @@ -169,6 +190,19 @@ METHOD(kernel_interface_t, get_spi, status_t, private_kernel_interface_t *this, host_t *src, host_t *dst, uint8_t protocol, uint32_t *spi) { + + int family = src->get_family (src); + + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + + return this->fc_sp->get_spi (this->fc_sp, src, dst, protocol, spi); + } + if (!this->ipsec) { return NOT_SUPPORTED; @@ -180,6 +214,17 @@ METHOD(kernel_interface_t, get_cpi, status_t, private_kernel_interface_t *this, host_t *src, host_t *dst, uint16_t *cpi) { + int family = src->get_family (src); + + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + this->fc_sp->get_cpi (this->fc_sp, src, dst, cpi); + } + if (!this->ipsec) { return NOT_SUPPORTED; @@ -436,6 +481,18 @@ METHOD(kernel_interface_t, add_sa, status_t, private_kernel_interface_t *this, kernel_ipsec_sa_id_t *id, kernel_ipsec_add_sa_t *data) { + int family = id->src->get_family (id->src); + + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + + return this->fc_sp->add_sa (this->fc_sp, (kernel_fc_sp_sa_id_t*) id, (kernel_fc_sp_add_sa_t*) data); + } + if (!this->ipsec) { return NOT_SUPPORTED; @@ -459,6 +516,18 @@ METHOD(kernel_interface_t, query_sa, status_t, kernel_ipsec_query_sa_t *data, uint64_t *bytes, uint64_t *packets, time_t *time) { + int family = id->src->get_family (id->src); + + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + + return this->fc_sp->query_sa (this->fc_sp, (kernel_fc_sp_sa_id_t*) id, (kernel_fc_sp_query_sa_t*) data, bytes, packets, time); + } + if (!this->ipsec) { return NOT_SUPPORTED; @@ -470,6 +539,18 @@ METHOD(kernel_interface_t, del_sa, status_t, private_kernel_interface_t *this, kernel_ipsec_sa_id_t *id, kernel_ipsec_del_sa_t *data) { + int family = id->src->get_family (id->src); + + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + + return this->fc_sp->del_sa (this->fc_sp, (kernel_fc_sp_sa_id_t*) id, (kernel_fc_sp_del_sa_t*) data); + } + if (!this->ipsec) { return NOT_SUPPORTED; @@ -491,6 +572,17 @@ METHOD(kernel_interface_t, add_policy, status_t, private_kernel_interface_t *this, kernel_ipsec_policy_id_t *id, kernel_ipsec_manage_policy_t *data) { + int family = data->src->get_family (data->src); + + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + return this->fc_sp->add_policy(this->fc_sp, (kernel_fc_sp_policy_id_t*) id, (kernel_fc_sp_manage_policy_t*) data); + } + if (!this->ipsec) { return NOT_SUPPORTED; @@ -502,6 +594,14 @@ METHOD(kernel_interface_t, query_policy, status_t, private_kernel_interface_t *this, kernel_ipsec_policy_id_t *id, kernel_ipsec_query_policy_t *data, time_t *use_time) { + if (data->family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + return this->fc_sp->query_policy(this->fc_sp, (kernel_fc_sp_policy_id_t*) id, (kernel_fc_sp_query_policy_t*) data, use_time); + } if (!this->ipsec) { return NOT_SUPPORTED; @@ -513,6 +613,17 @@ METHOD(kernel_interface_t, del_policy, status_t, private_kernel_interface_t *this, kernel_ipsec_policy_id_t *id, kernel_ipsec_manage_policy_t *data) { + int family = data->src->get_family (data->src); + + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + return this->fc_sp->del_policy (this->fc_sp, (kernel_fc_sp_policy_id_t*) id, (kernel_fc_sp_manage_policy_t*) data); + } + if (!this->ipsec) { return NOT_SUPPORTED; @@ -629,6 +740,15 @@ METHOD(kernel_interface_t, del_route, status_t, METHOD(kernel_interface_t, bypass_socket, bool, private_kernel_interface_t *this, int fd, int family) { + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + return this->fc_sp->bypass_socket(this->fc_sp, fd, family); + } + if (!this->ipsec) { return FALSE; @@ -639,6 +759,15 @@ METHOD(kernel_interface_t, bypass_socket, bool, METHOD(kernel_interface_t, enable_udp_decap, bool, private_kernel_interface_t *this, int fd, int family, uint16_t port) { + if (family == AF_NETLINK) + { + if (!this->fc_sp) + { + return NOT_SUPPORTED; + } + return this->fc_sp->enable_udp_decap(this->fc_sp, fd, family, port); + } + if (!this->ipsec) { return FALSE; @@ -773,6 +902,31 @@ METHOD(kernel_interface_t, remove_ipsec_interface, bool, return FALSE; } + +METHOD(kernel_interface_t, add_fc_sp_interface, bool, + private_kernel_interface_t *this, kernel_fc_sp_constructor_t constructor) +{ + if (!this->fc_sp) + { + this->fc_sp_constructor = constructor; + this->fc_sp = constructor(); + return this->fc_sp != NULL; + } + return FALSE; +} + +METHOD(kernel_interface_t, remove_fc_sp_interface, bool, + private_kernel_interface_t *this, kernel_fc_sp_constructor_t constructor) +{ + if (constructor == this->fc_sp_constructor && this->fc_sp) + { + this->fc_sp->destroy(this->fc_sp); + this->fc_sp = NULL; + return TRUE; + } + return FALSE; +} + METHOD(kernel_interface_t, add_net_interface, bool, private_kernel_interface_t *this, kernel_net_constructor_t constructor) { @@ -992,6 +1146,7 @@ METHOD(kernel_interface_t, destroy, void, this->algorithms->destroy(this->algorithms); this->mutex_algs->destroy(this->mutex_algs); DESTROY_IF(this->ipsec); + DESTROY_IF(this->fc_sp); DESTROY_IF(this->net); DESTROY_FUNCTION_IF(this->ifaces_filter, (void*)free); this->reqids->destroy(this->reqids); @@ -1042,6 +1197,8 @@ kernel_interface_t *kernel_interface_create() .get_address_by_ts = _get_address_by_ts, .add_ipsec_interface = _add_ipsec_interface, .remove_ipsec_interface = _remove_ipsec_interface, + .add_fc_sp_interface = _add_fc_sp_interface, + .remove_fc_sp_interface = _remove_fc_sp_interface, .add_net_interface = _add_net_interface, .remove_net_interface = _remove_net_interface, diff --git a/src/libcharon/kernel/kernel_interface.h b/src/libcharon/kernel/kernel_interface.h index b7e3686d1..3fddfa91c 100644 --- a/src/libcharon/kernel/kernel_interface.h +++ b/src/libcharon/kernel/kernel_interface.h @@ -3,6 +3,7 @@ * Copyright (C) 2006 Daniel Roethlisberger * Copyright (C) 2005-2006 Martin Willi * Copyright (C) 2005 Jan Hutter + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -55,6 +56,7 @@ typedef enum kernel_feature_t kernel_feature_t; #include <kernel/kernel_listener.h> #include <kernel/kernel_ipsec.h> #include <kernel/kernel_net.h> +#include <kernel/kernel_fc_sp.h> /** * Default range for SPIs requested from kernels @@ -86,6 +88,11 @@ enum kernel_feature_t { */ typedef kernel_ipsec_t* (*kernel_ipsec_constructor_t)(void); +/** + * Constructor function for fc-sp kernel interface + */ +typedef kernel_fc_sp_t* (*kernel_fc_sp_constructor_t)(void); + /** * Constructor function for network kernel interface */ @@ -104,7 +111,7 @@ struct kernel_interface_t { * * @return ORed feature-set of backends */ - kernel_feature_t (*get_features)(kernel_interface_t *this); + kernel_feature_t (*get_features)(kernel_interface_t *this, int family); /** * Get a SPI from the kernel. @@ -459,6 +466,7 @@ struct kernel_interface_t { */ bool (*add_ipsec_interface)(kernel_interface_t *this, kernel_ipsec_constructor_t create); + /** * Unregister an ipsec kernel interface constructor. @@ -469,6 +477,26 @@ struct kernel_interface_t { */ bool (*remove_ipsec_interface)(kernel_interface_t *this, kernel_ipsec_constructor_t create); + + /** + * Register an fc-sp interface constructor on the manager. + * + * @param create constructor to register + * @return TRUE if the fc-sp kernel interface was registered + * successfully, FALSE if an interface was already + * registered or the registration failed + */ + bool (*add_fc_sp_interface) (kernel_interface_t *this, kernel_fc_sp_constructor_t constructor); + + /** + * Unregister an fc-sp interface constructor. + * + * @param create constructor to unregister + * @return TRUE if the ipsec kernel interface was unregistered + * successfully, FALSE otherwise + */ + bool (*remove_fc_sp_interface)(kernel_interface_t *this, + kernel_fc_sp_constructor_t create); /** * Register a network kernel interface constructor on the manager. diff --git a/src/libcharon/kernel/kernel_ipsec.h b/src/libcharon/kernel/kernel_ipsec.h index 70ff2eb12..917c5fde5 100644 --- a/src/libcharon/kernel/kernel_ipsec.h +++ b/src/libcharon/kernel/kernel_ipsec.h @@ -5,6 +5,7 @@ * Copyright (C) 2005-2006 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -184,6 +185,7 @@ struct kernel_ipsec_manage_policy_t { * Data required to query a policy in the kernel */ struct kernel_ipsec_query_policy_t { + int family; }; /** diff --git a/src/libcharon/network/sender.c b/src/libcharon/network/sender.c index 04cd4dc01..89c99dda6 100644 --- a/src/libcharon/network/sender.c +++ b/src/libcharon/network/sender.c @@ -48,6 +48,10 @@ struct private_sender_t { * mutex to synchronize access to list */ mutex_t *mutex; + + mutex_t *wakeup_mutex; + + int sender_thread_count; /** * condvar to signal for packets added to list @@ -97,8 +101,8 @@ METHOD(sender_t, send_, void, src = packet->get_source(packet); dst = packet->get_destination(packet); - DBG1(DBG_NET, "sending packet: from %#H to %#H (%zu bytes)", src, dst, - packet->get_data(packet).len); + DBG1(DBG_NET, "sending packet: from %#H to %#H (%zu bytes), src family: %d", src, dst, + packet->get_data(packet).len, src->get_family (src)); if (this->send_delay) { @@ -150,12 +154,24 @@ static job_requeue_t send_packets(private_sender_t *this) oldstate = thread_cancelability(TRUE); this->got->wait(this->got, this->mutex); + this->wakeup_mutex->lock (this->wakeup_mutex); thread_cancelability(oldstate); thread_cleanup_pop(FALSE); + + // If there is a spurious wakeup and we are the second ones to be awoken, + // there may be no send to service. So double check after we get the wakeup lock + // that there is still something to be serviced + if (this->list->get_count(this->list) == 0) + { + this->wakeup_mutex->unlock (this->wakeup_mutex); + this->mutex->unlock(this->mutex); + continue; + } } this->list->remove_first(this->list, (void**)&packet); this->sent->signal(this->sent); + this->wakeup_mutex->unlock (this->wakeup_mutex); this->mutex->unlock(this->mutex); charon->socket->send(charon->socket, packet); @@ -191,6 +207,7 @@ METHOD(sender_t, destroy, void, sender_t * sender_create() { private_sender_t *this; + int i; INIT(this, .public = { @@ -201,6 +218,9 @@ sender_t * sender_create() }, .list = linked_list_create(), .mutex = mutex_create(MUTEX_TYPE_DEFAULT), + .wakeup_mutex = mutex_create(MUTEX_TYPE_DEFAULT), + .sender_thread_count = lib->settings->get_int(lib->settings, + "%s.sender_thread_count", 1, lib->ns), .got = condvar_create(CONDVAR_TYPE_DEFAULT), .sent = condvar_create(CONDVAR_TYPE_DEFAULT), .send_delay = lib->settings->get_int(lib->settings, @@ -213,10 +233,13 @@ sender_t * sender_create() "%s.send_delay_response", TRUE, lib->ns), ); - lib->processor->queue_job(lib->processor, - (job_t*)callback_job_create_with_prio((callback_job_cb_t)send_packets, - this, NULL, (callback_job_cancel_t)return_false, JOB_PRIO_CRITICAL)); - + for (i = 0; i < this->sender_thread_count; i++) + { + lib->processor->queue_job(lib->processor, + (job_t*)callback_job_create_with_prio((callback_job_cb_t)send_packets, + this, NULL, (callback_job_cancel_t)return_false, JOB_PRIO_CRITICAL)); + } + return &this->public; } diff --git a/src/libcharon/network/socket.h b/src/libcharon/network/socket.h index e8ee5e347..b037dfcfa 100644 --- a/src/libcharon/network/socket.h +++ b/src/libcharon/network/socket.h @@ -4,6 +4,7 @@ * Copyright (C) 2006 Daniel Roethlisberger * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -60,6 +61,11 @@ enum socket_family_t { * Both address families supported */ SOCKET_FAMILY_BOTH = (1 << 2) - 1, + + /** + * FC BSG + */ + SOCKET_FAMILY_FC = (1 << 2), }; /** diff --git a/src/libcharon/network/socket_manager.c b/src/libcharon/network/socket_manager.c index 0a7ac9d11..6df56a0bb 100644 --- a/src/libcharon/network/socket_manager.c +++ b/src/libcharon/network/socket_manager.c @@ -3,6 +3,7 @@ * HSR Hochschule fuer Technik Rapperswil * Copyright (C) 2010 Martin Willi * Copyright (C) 2010 revosec AG + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -21,6 +22,7 @@ #include <threading/thread.h> #include <threading/rwlock.h> #include <collections/linked_list.h> +#include <collections/hashtable.h> typedef struct private_socket_manager_t private_socket_manager_t; @@ -33,16 +35,21 @@ struct private_socket_manager_t { * Public socket_manager_t interface. */ socket_manager_t public; - + /** - * List of registered socket constructors + * List of socket constructors used during shutdown. */ - linked_list_t *sockets; + hashtable_t *socket_constructors; /** - * Instantiated socket implementation + * Instantiated socket implementation for IP */ - socket_t *socket; + socket_t *ip_socket; + + /** + * Instantiated socket implementation for FC + */ + socket_t *fc_socket; /** * The constructor used to create the current socket @@ -60,7 +67,7 @@ METHOD(socket_manager_t, receiver, status_t, { status_t status; this->lock->read_lock(this->lock); - if (!this->socket) + if (!this->ip_socket) { DBG1(DBG_NET, "no socket implementation registered, receiving failed"); this->lock->unlock(this->lock); @@ -68,7 +75,7 @@ METHOD(socket_manager_t, receiver, status_t, } /* receive is blocking and the thread can be cancelled */ thread_cleanup_push((thread_cleanup_t)this->lock->unlock, this->lock); - status = this->socket->receive(this->socket, packet); + status = this->ip_socket->receive(this->ip_socket, packet); thread_cleanup_pop(TRUE); return status; } @@ -77,26 +84,51 @@ METHOD(socket_manager_t, sender, status_t, private_socket_manager_t *this, packet_t *packet) { status_t status; + socket_t *socket = NULL; + this->lock->read_lock(this->lock); - if (!this->socket) + host_t *src = packet->get_source (packet); + int family = src->get_family (src); + + if (family == AF_NETLINK) + { + socket = this->fc_socket; + } + else + { + socket = this->ip_socket; + } + + if (!socket) { - DBG1(DBG_NET, "no socket implementation registered, sending failed"); + DBG1(DBG_NET, "no socket implementation registered for family %d, sending failed", family); this->lock->unlock(this->lock); return NOT_SUPPORTED; } - status = this->socket->send(this->socket, packet); + status = socket->send(socket, packet); this->lock->unlock(this->lock); return status; } METHOD(socket_manager_t, get_port, uint16_t, - private_socket_manager_t *this, bool nat_t) + private_socket_manager_t *this, socket_family_t family, bool nat_t) { uint16_t port = 0; + socket_t *socket; + this->lock->read_lock(this->lock); - if (this->socket) + if (family == SOCKET_FAMILY_FC) + { + socket = this->fc_socket; + } + else { - port = this->socket->get_port(this->socket, nat_t); + socket = this->ip_socket; + } + + if (socket) + { + port = socket->get_port(socket, nat_t); } this->lock->unlock(this->lock); return port; @@ -106,40 +138,41 @@ METHOD(socket_manager_t, supported_families, socket_family_t, private_socket_manager_t *this) { socket_family_t families = SOCKET_FAMILY_NONE; - this->lock->read_lock(this->lock); - if (this->socket) - { - families = this->socket->supported_families(this->socket); + + // Supported families is not needed for fc_socket because there is only one + // family for FC, i.e. no IPv4 and IPv6. + + if (this->ip_socket != NULL) + { + this->lock->read_lock(this->lock); + families = this->ip_socket->supported_families (this->ip_socket); + this->lock->unlock(this->lock); } - this->lock->unlock(this->lock); return families; } -static void create_socket(private_socket_manager_t *this) -{ - socket_constructor_t create; - /* remove constructors in order to avoid trying to create broken ones - * multiple times */ - while (this->sockets->remove_first(this->sockets, - (void**)&create) == SUCCESS) - { - this->socket = create(); - if (this->socket) - { - this->create = create; - break; - } - } -} - METHOD(socket_manager_t, add_socket, void, private_socket_manager_t *this, socket_constructor_t create) { + socket_t *new_socket; + socket_family_t family; + this->lock->write_lock(this->lock); - this->sockets->insert_last(this->sockets, create); - if (!this->socket) + new_socket = create(); + family = new_socket->supported_families (new_socket); + + if (new_socket) + { + this->socket_constructors->put (this->socket_constructors, (void*) create, (void*) family); + } + + if (family == SOCKET_FAMILY_FC) { - create_socket(this); + this->fc_socket = new_socket; + } + else + { + this->ip_socket = new_socket; } this->lock->unlock(this->lock); } @@ -148,22 +181,28 @@ METHOD(socket_manager_t, remove_socket, void, private_socket_manager_t *this, socket_constructor_t create) { this->lock->write_lock(this->lock); - this->sockets->remove(this->sockets, create, NULL); - if (this->create == create) + + socket_family_t family = (socket_family_t) this->socket_constructors->get (this->socket_constructors, (void*) create); + + if (family == SOCKET_FAMILY_FC) + { + this->fc_socket->destroy (this->fc_socket); + this->fc_socket = NULL; + } + else { - this->socket->destroy(this->socket); - this->socket = NULL; - this->create = NULL; - create_socket(this); + this->ip_socket->destroy (this->ip_socket); + this->ip_socket = NULL; } + this->socket_constructors->remove (this->socket_constructors, (void*) create); this->lock->unlock(this->lock); } METHOD(socket_manager_t, destroy, void, private_socket_manager_t *this) { - DESTROY_IF(this->socket); - this->sockets->destroy(this->sockets); + DESTROY_IF(this->ip_socket); + DESTROY_IF(this->fc_socket); this->lock->destroy(this->lock); free(this); } @@ -185,8 +224,10 @@ socket_manager_t *socket_manager_create() .remove_socket = _remove_socket, .destroy = _destroy, }, - .sockets = linked_list_create(), + .socket_constructors = hashtable_create (hashtable_hash_ptr, hashtable_equals_ptr, 8), .lock = rwlock_create(RWLOCK_TYPE_DEFAULT), + .ip_socket = NULL, + .fc_socket = NULL, ); return &this->public; diff --git a/src/libcharon/network/socket_manager.h b/src/libcharon/network/socket_manager.h index 38baaea91..01781691e 100644 --- a/src/libcharon/network/socket_manager.h +++ b/src/libcharon/network/socket_manager.h @@ -1,5 +1,6 @@ /* * Copyright (C) 2010-2013 Tobias Brunner + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * Copyright (C) 2010 Martin Willi * Copyright (C) 2010 revosec AG @@ -58,7 +59,7 @@ struct socket_manager_t { * @param nat_t TRUE to get the port used to float in case of NAT-T * @return the port, or 0, if no socket is registered */ - uint16_t (*get_port)(socket_manager_t *this, bool nat_t); + uint16_t (*get_port)(socket_manager_t *this, socket_family_t family, bool nat_t); /** * Get the address families the registered socket is listening on. diff --git a/src/libcharon/plugins/auth_els/Makefile.am b/src/libcharon/plugins/auth_els/Makefile.am new file mode 100644 index 000000000..5bb04d3da --- /dev/null +++ b/src/libcharon/plugins/auth_els/Makefile.am @@ -0,0 +1,25 @@ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libhydra \ + -I$(top_srcdir)/src/libcharon + +AM_CFLAGS = \ + $(PLUGIN_CFLAGS) + +if MONOLITHIC +noinst_LTLIBRARIES = libstrongswan-auth-els.la +else +plugin_LTLIBRARIES = libstrongswan-auth-els.la +endif + +libstrongswan_auth_els_la_SOURCES = \ + auth_els_configs.h auth_els_configs.c \ + auth_els_kernel_fc_sp.h auth_els_kernel_fc_sp.c \ + auth_els_ike.h auth_els_ike.c \ + auth_els_socket.h auth_els_socket.c \ + auth_els_plugin.h auth_els_plugin.c \ + auth_els_utils.h + +libstrongswan_auth_els_la_LDFLAGS = -module -avoid-version + + diff --git a/src/libcharon/plugins/auth_els/auth_els_configs.c b/src/libcharon/plugins/auth_els/auth_els_configs.c new file mode 100644 index 000000000..1332a109b --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_configs.c @@ -0,0 +1,595 @@ +/* Copyright (C) 2019-2020 Marvell */ + +#include <sys/types.h> +#include <sys/stat.h> +#include <stdio.h> +#include <unistd.h> +#include <dirent.h> +#include <signal.h> +#include <errno.h> + +#ifdef AUTH_ELS_KMIP // If we are not compiling KMIP, then don't want these +#include <openssl/bio.h> +#endif + +#include <collections/linked_list.h> +#include <threading/thread.h> +#include <threading/condvar.h> +#include <threading/mutex.h> +#include <processing/jobs/callback_job.h> +#include <credentials/keys/shared_key.h> +#include <utils/identification.h> + +#include <config/child_cfg.h> + +#include "auth_els_utils.h" +#include "auth_els_configs.h" + +typedef struct auth_els_backend_t auth_els_backend_t; +struct auth_els_backend_t { + + backend_t public; + linked_list_t* configs; +}; + +typedef struct auth_els_psk_creds_t auth_els_psk_creds_t; +struct auth_els_psk_creds_t { + + credential_set_t credential_set; + linked_list_t* auth_els_psks; +}; + +typedef struct { + enumerator_t public; + enumerator_t *inner; + shared_key_t *current; + identification_t *me; + identification_t *other; +} shared_enumerator_t; + +enum shared_secret_type_t { + SHARED_SECRET_TYPE_WWPN, + SHARED_SECRET_TYPE_CONFIG_FILE, + SHARED_SECRET_TYPE_KMIP, +}; + +struct private_auth_els_configs_t { + + auth_els_configs_t public; + + auth_els_backend_t backend; + auth_els_psk_creds_t* creds; + + chunk_t shared_secret; + enum shared_secret_type_t secret_type; + + proposal_t *esp_proposal; + proposal_t *ike_proposal; +}; +typedef struct private_auth_els_configs_t private_auth_els_configs_t; + + +METHOD(enumerator_t, shared_enumerator_enumerate, bool, + shared_enumerator_t *this, va_list args) +{ + DBG4(DBG_CFG, "auth_els - entering shared_enumerator_enumerate"); + + shared_key_t **key; + shared_enumerator_t *rport_shared_key; + enumerator_t *e1; + id_match_t local_match = ID_MATCH_NONE, remote_match = ID_MATCH_NONE; + id_match_t *me_match; + id_match_t *other_match; + + VA_ARGS_VGET(args, key, me_match, other_match); + + if ((this != NULL) && (this->inner != NULL)) + { + e1 = this->inner;//->create_enumerator(this->inner); + while (e1->enumerate(e1, &rport_shared_key)) + { + if( (rport_shared_key == NULL) || + (rport_shared_key->me == NULL) || + (rport_shared_key->other == NULL) ) + { + DBG4(DBG_CFG, "auth_els - shared_enumerator_enumerate shared key is NULL"); + continue; + } + + if ( (this == NULL) || (this->me == NULL) || (this->other == NULL) ) { + DBG4(DBG_CFG, "auth_els - shared_enumerator_enumerate local or remote identification is NULL"); + continue; + } + + local_match = this->me->matches(this->me, rport_shared_key->me); + remote_match = this->other->matches(this->other, rport_shared_key->other); + if (me_match) + *me_match = local_match; + if (other_match) + *other_match = remote_match; + DBG_STD ("me_match=%N other_match=%N", + id_match_names, local_match, id_match_names, remote_match); + if ( (local_match >= ID_MATCH_PERFECT) && (remote_match >= ID_MATCH_PERFECT) ) + { + chunk_t key_s = rport_shared_key->current->get_key(rport_shared_key->current); + this->current = shared_key_create( SHARED_IKE, chunk_clone(key_s)); + *key = this->current; + DBG_STD ("matching shared key for %Y - %Y is %#B", + rport_shared_key->me, rport_shared_key->other, + &key_s); + + return TRUE; + } + } + } + + return FALSE; +} + +METHOD(enumerator_t, shared_enumerator_destroy, void, + shared_enumerator_t *this) +{ + DESTROY_IF(this->inner); + DESTROY_IF(this->me); + DESTROY_IF(this->other); + DESTROY_IF(this->current); + free(this); +} + +METHOD(credential_set_t, create_shared_enumerator, enumerator_t*, + auth_els_psk_creds_t *this, shared_key_type_t type, + identification_t *me, identification_t *other) +{ + DBG4(DBG_CFG, "auth_els - entering create_shared_enumerator"); + DBG_ENTER; + + shared_enumerator_t *data; + + if (type != SHARED_IKE) + { + return NULL; + } + + if ((me == NULL) || (other == NULL)) + { + DBG_STD ("local or remote identification is NULL"); + return NULL; + } + + if (this->auth_els_psks == NULL) + { + this->auth_els_psks = linked_list_create (); + } + + INIT(data, + .public = { + .enumerate = enumerator_enumerate_default, + .venumerate = _shared_enumerator_enumerate, + .destroy = _shared_enumerator_destroy, + }, + .inner = this->auth_els_psks->create_enumerator(this->auth_els_psks), + .current = NULL, + .me = identification_create_from_encoding(me->get_type(me), me->get_encoding(me)), + .other = identification_create_from_encoding(other->get_type(other), other->get_encoding(other)), + ); + + return &data->public; +} + +CALLBACK(ike_filter, bool, + void *data, enumerator_t *orig, va_list args) +{ + //DBG4(DBG_CFG, "auth_els - entering ike_filter me => %#H", me); + + peer_cfg_t *cfg; + ike_cfg_t **out; + ike_cfg_t *ikecfg; + + host_t *me = (host_t *)data; + + VA_ARGS_VGET(args, out); + + while (orig->enumerate(orig, &cfg)) + { + ikecfg = cfg->get_ike_cfg(cfg); + if (ikecfg && me) + { + if (ikecfg->get_my_port(ikecfg) == me->get_port(me)) + { + //DBG4(DBG_CFG, "auth_els - ike_filter ike_cfg found for me => %#H", me); + *out = ikecfg; + return TRUE; + } + } + } + return FALSE; +} + +METHOD(backend_t, create_ike_cfg_enumerator, enumerator_t*, + auth_els_backend_t *this, host_t *me, host_t *other) +{ + if (this->configs == NULL) + { + this->configs = linked_list_create (); + } + return enumerator_create_filter( + this->configs->create_enumerator(this->configs), + (void*)ike_filter, me, (void*)nop); +} + +typedef struct { + identification_t *me; + identification_t *other; +} peer_data_t; + +CALLBACK(peer_filter, bool, + void *data, enumerator_t *orig, va_list args) +{ + peer_cfg_t *cfg; + peer_cfg_t **out; + id_match_t match_me = ID_MATCH_NONE; + id_match_t match_other = ID_MATCH_NONE; + + peer_data_t *peer_data = (peer_data_t*)data; + identification_t *me = (identification_t *)peer_data->me; + identification_t *other = (identification_t *)peer_data->other; + + //DBG4(DBG_CFG, "auth_els - auth_els_configs - peer_filter looking for peer configs matching [%Y]...[%Y]", + // me, other); + + VA_ARGS_VGET(args, out); + + if ((me == NULL) || (me->get_encoding(me).ptr == NULL)) + return FALSE; + + if ((other == NULL) || (other->get_encoding(other).ptr == NULL)) + return FALSE; + + //DBG4(DBG_CFG, "auth_els - entering peer_filter me => name %s", me->get_encoding(me).ptr); + + while (orig->enumerate(orig, &cfg)) + { + enumerator_t *enumerator; + auth_cfg_t *auth; + identification_t *candidate; + enumerator = cfg->create_auth_cfg_enumerator(cfg, TRUE); + while (enumerator->enumerate(enumerator, &auth)) + { + candidate = auth->get(auth, AUTH_RULE_IDENTITY); + if (candidate) + { + if (me) + { + //DBG1(DBG_CFG, "auth_els - auth_els_configs - peer_filter enumerator me[%Y]...my[%Y]", + // me, candidate); + match_me = me->matches(me, candidate); + } + + if (match_me == ID_MATCH_PERFECT) + { + break; + } + + } + } + enumerator->destroy(enumerator); + + enumerator = cfg->create_auth_cfg_enumerator(cfg, FALSE); + while (enumerator->enumerate(enumerator, &auth)) + { + candidate = auth->get(auth, AUTH_RULE_IDENTITY); + if (candidate) + { + if (other) + { + //DBG4(DBG_CFG, "auth_els - auth_els_configs - peer_filter enumerator other[%Y]...remote[%Y]", + // other, candidate); + match_other = other->matches(other, candidate); + } + + if (match_other == ID_MATCH_PERFECT) + { + //DBG4(DBG_CFG, "auth_els - peer_filter id_match=%N", id_match_names, match); + break; + } + } + } + enumerator->destroy(enumerator); + + if ((match_me == ID_MATCH_PERFECT) && (match_other == ID_MATCH_PERFECT)) + { + //DBG4(DBG_CFG, "auth_els - peer_filter id_match=%N", id_match_names, match); + *out = cfg; + return TRUE; + } + } + return FALSE; +} + +void destroy_peer_cfg_enum (void *data) +{ + free (data); +} + +METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*, + auth_els_backend_t *this, identification_t *me, identification_t *other) +{ + if (this->configs == NULL) + { + this->configs = linked_list_create (); + } + + peer_data_t *data; + INIT(data, + .me = me, + .other = other, + ); + + return enumerator_create_filter( + this->configs->create_enumerator(this->configs), + (void*)peer_filter, data, destroy_peer_cfg_enum); +} + +METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*, + auth_els_backend_t *this, char *name) +{ + DBG2(DBG_CFG, "auth_els - entering get_peer_cfg_by_name name=%s", name); + enumerator_t *e1; + peer_cfg_t *current, *found = NULL; + + if (this->configs == NULL) + { + this->configs = linked_list_create (); + } + + e1 = this->configs->create_enumerator(this->configs); + while (e1->enumerate(e1, ¤t)) + { + if (strncaseeq(current->get_name(current), name, 32)) + { + found = current; + break; + } + } + e1->destroy(e1); + return found; +} + +static auth_els_psk_creds_t *auth_els_psk_creds_create() +{ + auth_els_psk_creds_t *this; + + INIT(this, + .credential_set = { + .create_shared_enumerator = _create_shared_enumerator, + .create_private_enumerator = (void*)return_null, + .create_cert_enumerator = (void*)return_null, + .create_cdp_enumerator = (void*)return_null, + .cache_cert = (void*)nop, + }, + .auth_els_psks = NULL, + ); + + return this; +} + +METHOD(auth_els_configs_t, reload_config, bool, + private_auth_els_configs_t *this) +{ + + char *shared_secret_section, *shared_secret_string = NULL; + enumerator_t* enumerator; + + enumerator = lib->settings->create_section_enumerator(lib->settings, + "%s.plugins.auth-els.shared_secret_config", lib->ns); + + while (enumerator->enumerate(enumerator, &shared_secret_section)) + { + shared_secret_string = lib->settings->get_str(lib->settings, + "%s.plugins.auth-els.shared_secret_config.%s.shared_secret", NULL, + lib->ns, shared_secret_section); + DBG1(DBG_CFG, "auth_els - add_rport_cfg - config file secret: %s", shared_secret_string); + } + enumerator->destroy(enumerator); + + if (shared_secret_string == NULL) + { + this->secret_type = SHARED_SECRET_TYPE_WWPN; + } + else + { + this->shared_secret = chunk_clone (chunk_create (shared_secret_string, strlen (shared_secret_string))); + this->secret_type = SHARED_SECRET_TYPE_CONFIG_FILE; + } + + char *proposal = lib->settings->get_str(lib->settings, + "%s.plugins.auth-els.algorithm_config.esp_proposal", NULL, + lib->ns); + + if (proposal) + { + // If the user gives us a proposal, then validate below. + DBG_STD ("User encryption algorithms proposal: %s", proposal); + } + else + { + proposal = ESP_ENCR_PROPOSAL_DEFAULT_128_BIT; + DBG_STD ("Default encryption algorithms proposal: %s", proposal); + } + + this->esp_proposal = proposal_create_from_string(PROTO_ESP, proposal); + if (this->esp_proposal == NULL) + { + DBG_FATAL ("Invalid ESP proposal"); + return FALSE; + } + + proposal = lib->settings->get_str(lib->settings, + "%s.plugins.auth-els.algorithm_config.ike_proposal", NULL, + lib->ns); + + if (proposal) + { + // If the user gives us a proposal, then validate below. + DBG_STD ("User ike algorithms proposal: %s", proposal); + } + else + { + proposal = IKE_PROPOSAL_DEFAULT_128_BIT; + + DBG_STD ("Default ike algorithms proposal: %s", proposal); + } + + this->ike_proposal = proposal_create_from_string(PROTO_IKE, proposal); + if (this->ike_proposal == NULL) + { + DBG_FATAL ("Invalid IKE proposal"); + return FALSE; + } + + uint16_t esp_enc_alg, ike_enc_alg, prf, dh_group; + uint16_t key_size_temp, esp_key_size; + this->esp_proposal->get_algorithm (this->esp_proposal, ENCRYPTION_ALGORITHM, (uint16_t*) &esp_enc_alg, &key_size_temp); + + if ((esp_enc_alg != ENCR_AES_GCM_ICV16) && (esp_enc_alg != ENCR_NULL_AUTH_AES_GMAC)) + { + DBG_STD ("Invalid encryption algorithm specified: %N, set to default", encryption_algorithm_names, esp_enc_alg); + this->esp_proposal->destroy (this->esp_proposal); + this->esp_proposal = proposal_create_from_string(PROTO_ESP, ESP_ENCR_PROPOSAL_DEFAULT_128_BIT); + } + + this->esp_proposal->get_algorithm (this->esp_proposal, ENCRYPTION_ALGORITHM, &esp_enc_alg, &esp_key_size); + this->ike_proposal->get_algorithm (this->ike_proposal, ENCRYPTION_ALGORITHM, &ike_enc_alg, &key_size_temp); + this->ike_proposal->get_algorithm (this->ike_proposal, DIFFIE_HELLMAN_GROUP, &dh_group, &key_size_temp); + this->ike_proposal->get_algorithm (this->ike_proposal, PSEUDO_RANDOM_FUNCTION, &prf, &key_size_temp); + + // We don't have a separate integrity algorithm because GCM and GMAC are AEAD which has integrity algorithm built in. + DBG_STD ("chosen algorithms: esp encryption: %N, %d, ike encryption: %N, %d, PRF: %N, %d, DH Group: %N, %d", + encryption_algorithm_names, esp_enc_alg, esp_enc_alg, + encryption_algorithm_names, ike_enc_alg, ike_enc_alg, + pseudo_random_function_names, prf, prf, + diffie_hellman_group_names, dh_group, dh_group); + + enumerator = this->esp_proposal->create_enumerator (this->esp_proposal, ENCRYPTION_ALGORITHM); + while (enumerator->enumerate (enumerator, &esp_enc_alg, &esp_key_size)) + { + DBG_STD ("Possible key size for ESP GCM: %d", esp_key_size); + } + enumerator->destroy (enumerator); + + return TRUE; +} + +METHOD(auth_els_configs_t, get_esp_proposal, proposal_t*, private_auth_els_configs_t *this) +{ + // We have to return a clone because the proposal is destroyed whenever the ike_sa is destroyed. + proposal_t *clone_prop = this->esp_proposal->clone (this->esp_proposal, 0); + return clone_prop; +} + +METHOD(auth_els_configs_t, get_ike_proposal, proposal_t*, private_auth_els_configs_t *this) +{ + // We have to return a clone because the proposal is destroyed whenever the ike_sa is destroyed. + proposal_t *clone_prop = this->ike_proposal->clone (this->ike_proposal, 0); + return clone_prop; +} + +METHOD(auth_els_configs_t, get_shared_secret, chunk_t, private_auth_els_configs_t *this, + bool initiator, char *host_name, char *rport_name) +{ + if (this->secret_type == SHARED_SECRET_TYPE_WWPN) + { + uint8_t default_shared_secret[(2 * HOST_NAME_SIZE) + 1] = { 0 }; + chunk_t shared_secret; + + if (initiator) + { + strncpy(default_shared_secret, host_name, HOST_NAME_SIZE); + strncpy(default_shared_secret+HOST_NAME_SIZE, rport_name, HOST_NAME_SIZE); + } + else + { + strncpy(default_shared_secret, rport_name, HOST_NAME_SIZE); + strncpy(default_shared_secret+HOST_NAME_SIZE, host_name, HOST_NAME_SIZE); + } + default_shared_secret[(2 * HOST_NAME_SIZE)] = '\0'; // Make sure default secret is only 32 bytes. + + shared_secret = chunk_clone (chunk_create (default_shared_secret, (2 * HOST_NAME_SIZE) + 1)); + + return shared_secret; + } + else + { + return chunk_clone (this->shared_secret); + } +} + +METHOD(auth_els_configs_t, get_backend, backend_t*, + private_auth_els_configs_t *this) +{ + return &this->backend.public; +} + +METHOD(auth_els_configs_t, get_creds, credential_set_t*, + private_auth_els_configs_t *this) +{ + return &this->creds->credential_set; +} + +METHOD(auth_els_configs_t, destroy, void, + private_auth_els_configs_t *this) +{ + peer_cfg_t *current; + enumerator_t *config_enum = this->backend.configs->create_enumerator(this->backend.configs); + + DBG_ENTER; + + while (config_enum->enumerate(config_enum, ¤t)) + { + this->backend.configs->remove (this->backend.configs, current, NULL); + current->destroy(current); + } + if (this->creds->auth_els_psks) + { + this->creds->auth_els_psks->destroy_function (this->creds->auth_els_psks, (void*)_shared_enumerator_destroy); + } + free (this->creds); + + if (this->secret_type != SHARED_SECRET_TYPE_WWPN) + { + chunk_free (&this->shared_secret); + } + DESTROY_IF (this->esp_proposal); + DESTROY_IF (this->ike_proposal); + free(this); +} + +auth_els_configs_t *auth_els_configs_create() +{ + private_auth_els_configs_t *this; + + INIT(this, + .public = { + .destroy = _destroy, + .get_backend = _get_backend, + .get_creds = _get_creds, + .reload_config = _reload_config, + .get_shared_secret = _get_shared_secret, + .get_esp_proposal = _get_esp_proposal, + .get_ike_proposal = _get_ike_proposal, + }, + .backend = { + .configs = NULL, + .public = { + .create_peer_cfg_enumerator = (void*)_create_peer_cfg_enumerator, + .create_ike_cfg_enumerator = (void*)_create_ike_cfg_enumerator, + .get_peer_cfg_by_name = (void*)_get_peer_cfg_by_name, + }, + }, + .creds = auth_els_psk_creds_create(), + .ike_proposal = NULL, + .esp_proposal = NULL, + ); + + return &this->public; +} diff --git a/src/libcharon/plugins/auth_els/auth_els_configs.h b/src/libcharon/plugins/auth_els/auth_els_configs.h new file mode 100644 index 000000000..76be6df88 --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_configs.h @@ -0,0 +1,44 @@ +/* Copyright (C) 2019-2020 Marvell */ + +/** + * @defgroup auth_els auth_els + * @ingroup cplugins + * + * @defgroup auth_els_configs auth_els_configs + * @{ @ingroup auth_els + */ + +#ifndef AUTH_ELS_CONFIGS_H_ +#define AUTH_ELS_CONFIGS_H_ + +#include <credentials/credential_set.h> +#include <daemon.h> + +// ESP proposal default +#define ESP_ENCR_PROPOSAL_DEFAULT_128_BIT "aes128gcm16" + +// IKE proposal default +#define IKE_PROPOSAL_DEFAULT_128_BIT "aes128gcm16-prfsha256-curve25519" + +#define HOST_NAME_SIZE 16 +#define HOST_ID_SIZE 4 +#define REMOTE_PORT_ID_SIZE 4 +#define PEER_NAME_SIZE 33 + +typedef struct auth_els_configs_t auth_els_configs_t; +struct auth_els_configs_t { + + backend_t* (*get_backend)(auth_els_configs_t *this); + credential_set_t* (*get_creds)(auth_els_configs_t *this); + bool (*reload_config)(auth_els_configs_t *this); + chunk_t (*get_shared_secret) (auth_els_configs_t *this, + bool initiator, char *host_name, char *rport_name); + proposal_t* (*get_esp_proposal) (auth_els_configs_t *this); + proposal_t* (*get_ike_proposal) (auth_els_configs_t *this); + + void (*destroy)(auth_els_configs_t *this); +}; + +auth_els_configs_t *auth_els_configs_create(); + +#endif /** AUTH_ELS_CONFIGS_H_ @}*/ diff --git a/src/libcharon/plugins/auth_els/auth_els_ike.c b/src/libcharon/plugins/auth_els/auth_els_ike.c new file mode 100644 index 000000000..8914f5d3c --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_ike.c @@ -0,0 +1,265 @@ +/* Copyright (C) 2019-2020 Marvell */ + +#include "auth_els_plugin.h" +#include "auth_els_ike.h" + +#include <scsi/scsi.h> +#include <scsi/scsi_bsg_fc.h> + +#include <sa/ikev2/keymat_v2.h> +#include <sa/ikev1/keymat_v1.h> +#include <sa/ikev2/tasks/child_create.h> +#include <encoding/payloads/nonce_payload.h> +#include <encoding/payloads/cert_payload.h> +#include <encoding/payloads/auth_payload.h> +#include <encoding/payloads/id_payload.h> +#include <encoding/payloads/sa_payload.h> +#include <encoding/payloads/ts_payload.h> +#include <encoding/payloads/ke_payload.h> +#include <encoding/payloads/notify_payload.h> +#include <threading/rwlock.h> +#include <threading/condvar.h> +#include <threading/mutex.h> +#include <processing/jobs/rekey_ike_sa_job.h> +#include <processing/jobs/rekey_child_sa_job.h> +#include <processing/jobs/delete_ike_sa_job.h> + +#include "auth_els_socket.h" +#include "auth_els_utils.h" + +/** + * Private data of an auth_els_ike_t object. + */ +typedef struct private_auth_els_ike_t private_auth_els_ike_t; +struct private_auth_els_ike_t { + + /** + * Public auth_els_ike_t interface. + */ + auth_els_ike_t public; + + hashtable_t *fchosts; + auth_els_plugin_t *plugin; + + unsigned int rekey_time; + unsigned int reauth_time; + unsigned int reauth_rekey_jitter; +}; + + + +METHOD(listener_t, ike_keys, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, diffie_hellman_t *dh, + chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r, ike_sa_t *rekey, + shared_key_t *shared, auth_method_t method) +{ + DBG_ENTER; + + return TRUE; +} + +METHOD(listener_t, ike_updown, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, bool up) +{ + DBG_STD ("enter: up=%s", (up? "yes" : "no")); + + return TRUE; +} + +METHOD(listener_t, ike_rekey, bool, + private_auth_els_ike_t *this, ike_sa_t *old, ike_sa_t *new) +{ + return TRUE; +} + + +METHOD(listener_t, child_keys, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, + bool initiator, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r) +{ + DBG_STD ("ike_sa: %p, child_sa: %p", ike_sa, child_sa); + + chunk_t secret; + + if (dh && dh->get_shared_secret(dh, &secret)) + { + DBG_STD ("DH secret:"); + chunk_clear(&secret); + } + + return TRUE; +} + +METHOD(listener_t, child_state_change, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, + child_sa_t *child_sa, child_sa_state_t state) +{ + + DBG_STD ("ike_sa: %p, child_sa: %p, new state: %N", ike_sa, child_sa, child_sa_state_names, state); + + return TRUE; +} + +METHOD(listener_t, child_updown, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, + child_sa_t *child_sa, bool up) +{ + DBG_ENTER; + + return TRUE; +} + +METHOD(listener_t, child_rekey, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, + child_sa_t *old, child_sa_t *new) +{ + DBG_STD ("ike_sa: %p, child_sa old: %p, new: %p", ike_sa, old, new); + + return TRUE; +} + +METHOD(listener_t, narrow, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, + child_sa_t *child_sa, narrow_hook_t type, + linked_list_t *local, linked_list_t *remote) +{ + DBG_ENTER; + + return TRUE; +} + +METHOD(listener_t, ike_reestablish_pre, bool, + private_auth_els_ike_t *this, ike_sa_t *old, ike_sa_t *new) +{ + DBG_ENTER; + return TRUE; +} + +METHOD(listener_t, ike_reestablish_post, bool, + private_auth_els_ike_t *this, ike_sa_t *old, ike_sa_t *new, + bool initiated) +{ + DBG_ENTER; + return TRUE; +} + +METHOD(listener_t, ike_state_change, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, ike_sa_state_t new) +{ + DBG_STD ("ike_sa: %p, new_state=%N", ike_sa, ike_sa_state_names, new); + + return TRUE; +} + +METHOD(listener_t, message_hook, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, message_t *message, + bool incoming, bool plain) +{ + DBG_STD ("plain=%s - incoming=%s - request=%s message=%N, message_id initiate: %x, respond: %x", + (plain?"true":"false"), + (incoming?"true":"false"), + (message->get_request(message)?"true":"false"), + exchange_type_names, message->get_exchange_type(message), + ike_sa->get_message_id(ike_sa, true), ike_sa->get_message_id(ike_sa, false)); + + return true; +} + +METHOD(listener_t, authorize, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, + bool final, bool *success) +{ + DBG2(DBG_CFG, "auth_els - entering authorize event"); + + if (final) + { + DBG_STD ("final event"); + } + + *success = TRUE; + + return TRUE; /* stay registered */ +} + + +METHOD(listener_t, alert_hook, bool, + private_auth_els_ike_t *this, ike_sa_t *ike_sa, alert_t alert, va_list args) +{ + DBG_STD ("enter: alert=%d, ike_sa: %p", alert, ike_sa); + + switch(alert) + { + case ALERT_SHUTDOWN_SIGNAL: + DBG_STD ("AUTH_ELS Plugin shutdown: send app_stop to all hosts now."); + break; + + case ALERT_KEEP_ON_CHILD_SA_FAILURE: + case ALERT_RETRANSMIT_SEND_TIMEOUT: + case ALERT_HALF_OPEN_TIMEOUT: + case ALERT_PEER_INIT_UNREACHABLE: + case ALERT_LOCAL_AUTH_FAILED: + case ALERT_PEER_AUTH_FAILED: + case ALERT_PEER_ADDR_FAILED: + case ALERT_PARSE_ERROR_HEADER: + case ALERT_PARSE_ERROR_BODY: + case ALERT_PROPOSAL_MISMATCH_IKE: + case ALERT_PROPOSAL_MISMATCH_CHILD: + case ALERT_TS_MISMATCH: + case ALERT_INSTALL_CHILD_SA_FAILED: + case ALERT_INSTALL_CHILD_POLICY_FAILED: + case ALERT_AUTHORIZATION_FAILED: + case ALERT_RETRANSMIT_RECEIVE: + + case ALERT_INVALID_IKE_SPI: + case ALERT_TS_NARROWED: + case ALERT_RETRANSMIT_SEND: + case ALERT_IKE_SA_EXPIRED: + default: + break; + }; + + return TRUE; +} + +METHOD(auth_els_ike_t, destroy, void, + private_auth_els_ike_t *this) +{ + DBG2(DBG_CFG, "auth_els_ike: destroy"); + + free(this); +} + +/** + * See header + */ +auth_els_ike_t *auth_els_ike_create(auth_els_plugin_t *plugin_ref) +{ + DBG2(DBG_CFG, "In auth_els_ike_create"); + + private_auth_els_ike_t *this; + + INIT(this, + .public = { + .listener = { + .ike_keys = _ike_keys, + .ike_updown = _ike_updown, + .ike_rekey = _ike_rekey, + .ike_state_change = _ike_state_change, + .message = _message_hook, + .authorize = _authorize, + .alert = _alert_hook, + .ike_reestablish_pre = _ike_reestablish_pre, + .ike_reestablish_post = _ike_reestablish_post, + .child_keys = _child_keys, + .child_state_change = _child_state_change, + .child_updown = _child_updown, + .child_rekey = _child_rekey, + .narrow = _narrow, + }, + .destroy = _destroy, + }, + .plugin = plugin_ref, + ); + + return &(this->public); +} diff --git a/src/libcharon/plugins/auth_els/auth_els_ike.h b/src/libcharon/plugins/auth_els/auth_els_ike.h new file mode 100644 index 000000000..5404454f4 --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_ike.h @@ -0,0 +1,42 @@ +/* Copyright (C) 2019-2020 Marvell */ + +/** + * @defgroup auth_els_ike auth_els_ike + * @{ @ingroup auth_els + */ + +#ifndef AUTH_ELS_IKE_H_ +#define AUTH_ELS_IKE_H_ + +#include <collections/hashtable.h> +#include <sa/ike_sa.h> +#include <daemon.h> + +typedef struct auth_els_ike_t auth_els_ike_t; +/** + * Listener to synchronize IKE_SAs. + */ +struct auth_els_ike_t { + + /** + * Implements bus listener interface. + */ + listener_t listener; + + /** + * Destroy a auth_els_ike_t. + */ + void (*destroy)(auth_els_ike_t *this); + +}; + +/** + * Create a auth_els_ike instance. + * + * @param cache message cache + * @param cache List of rport sockets + * @return IKE listener + */ +auth_els_ike_t *auth_els_ike_create(auth_els_plugin_t *plugin_ref); + +#endif /** AUTH_ELS_IKE_ @}*/ diff --git a/src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.c b/src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.c new file mode 100644 index 000000000..cba29def4 --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.c @@ -0,0 +1,252 @@ +/* Copyright (C) 2019-2020 Marvell */ + +#include "auth_els_kernel_fc_sp.h" + +#include <collections/hashtable.h> +#include <collections/linked_list.h> +#include <processing/jobs/delete_ike_sa_job.h> +#include <threading/rwlock.h> +#include <threading/mutex.h> +#include <daemon.h> + +#include "auth_els_utils.h" + +#include <errno.h> +#include <linux/xfrm.h> +#include <utils/debug.h> +#include <utils/chunk.h> + +typedef struct private_auth_els_kernel_fc_sp_t private_auth_els_kernel_fc_sp_t; + +/** + * Private variables and functions of auth_els kernel ipsec instance. + */ +struct private_auth_els_kernel_fc_sp_t { + + /** + * Public auth_els_kernel_ipsec interface. + */ + auth_els_kernel_fc_sp_t public; + + /** + * RNG used for SPI generation. + */ + rng_t *rng; + /** + * Lock to access the RNG instance and the callback for getting spi + */ + rwlock_t *spi_lock; +}; + + +METHOD(kernel_ipsec_t, get_features, kernel_feature_t, + private_auth_els_kernel_fc_sp_t *this) +{ + DBG2 (DBG_CFG, "auth_els - auth_els_kernel_ipsec - get_features callback, ignoring"); + return KERNEL_POLICY_SPI; +} + +METHOD(kernel_ipsec_t, get_spi, status_t, + private_auth_els_kernel_fc_sp_t *this, host_t *src, host_t *dst, + uint8_t protocol, uint32_t *spi) +{ + DBG_ENTER; + + bool result = FALSE; + + this->spi_lock->read_lock(this->spi_lock); + + if (!this->rng) + { + DBG_FATAL ("unable to create RNG"); + *spi = 0; + this->spi_lock->unlock(this->spi_lock); + return FAILED; + } + + result = this->rng->get_bytes(this->rng, sizeof(uint32_t), + (uint8_t *)spi); + if (!result) + { + DBG_FATAL ("get_spi failed, set to 0"); + *spi = 0; + } + this->spi_lock->unlock(this->spi_lock); + + DBG_STD ("src port_number %d dest port_number %d, spi provided: %x", src->get_port(src), dst->get_port(dst), *spi); + + return result ? SUCCESS : FAILED; +} + +METHOD(kernel_ipsec_t, get_cpi, status_t, + private_auth_els_kernel_fc_sp_t *this, host_t *src, host_t *dst, + uint16_t *cpi) +{ + DBG_ENTER; + (void) this; + (void) src; + (void) dst; + (void) cpi; + + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, add_sa, status_t, + private_auth_els_kernel_fc_sp_t *this, kernel_ipsec_sa_id_t *id, + kernel_ipsec_add_sa_t *data) +{ + DBG_ENTER; + + uint32_t key_size; + uint16_t remote_port_number; + status_t final_status = FAILED; + + key_size = data->enc_key.len - 4; + + if (data->inbound) + { + remote_port_number = id->src->get_port(id->src); + } + else + { + remote_port_number = id->dst->get_port(id->dst); + } + + DBG_STD ("remote_port_number: %d, enc_alg: %N, key_size: %d", + remote_port_number, encryption_algorithm_names, data->enc_alg, key_size); + + return final_status; +} + +METHOD(kernel_ipsec_t, query_sa, status_t, + private_auth_els_kernel_fc_sp_t *this, kernel_ipsec_sa_id_t *id, + kernel_ipsec_query_sa_t *data, uint64_t *bytes, uint64_t *packets, + time_t *time) +{ + DBG_ENTER; + + int ret_status = SUCCESS; + + *bytes = 0; + *packets = 0; // Driver only provides bytes for now. + + return ret_status; +} + +METHOD(kernel_ipsec_t, del_sa, status_t, + private_auth_els_kernel_fc_sp_t *this, + kernel_ipsec_sa_id_t *id, + kernel_ipsec_del_sa_t *data) +{ + status_t final_status = FAILED; + + DBG_STD ("start: spi: %x", id->spi); + + return final_status; +} + +METHOD(kernel_ipsec_t, update_sa, status_t, + private_auth_els_kernel_fc_sp_t *this, kernel_ipsec_sa_id_t *id, + kernel_ipsec_update_sa_t *data) +{ + DBG_ENTER; + DBG_STD ("child_sa: me: %d, other: %d", + id->src->get_port(id->src), id->dst->get_port(id->dst)); + + return SUCCESS; +} + +METHOD(kernel_ipsec_t, flush_sas, status_t, + private_auth_els_kernel_fc_sp_t *this) +{ + DBG_ENTER; + return SUCCESS; +} + +METHOD(kernel_ipsec_t, add_policy, status_t, + private_auth_els_kernel_fc_sp_t *this, kernel_ipsec_policy_id_t *id, + kernel_ipsec_manage_policy_t *data) +{ + DBG_ENTER; + return SUCCESS; +} + +METHOD(kernel_ipsec_t, query_policy, status_t, + private_auth_els_kernel_fc_sp_t *this, kernel_ipsec_policy_id_t *id, + kernel_ipsec_query_policy_t *data, time_t *use_time) +{ + DBG_ENTER; + return NOT_SUPPORTED; +} + +METHOD(kernel_ipsec_t, del_policy, status_t, + private_auth_els_kernel_fc_sp_t *this, kernel_ipsec_policy_id_t *id, + kernel_ipsec_manage_policy_t *data) +{ + DBG_ENTER; + return SUCCESS; +} + +METHOD(kernel_ipsec_t, flush_policies, status_t, + private_auth_els_kernel_fc_sp_t *this) +{ + DBG_ENTER; + return SUCCESS; +} + + +METHOD(kernel_ipsec_t, bypass_socket, bool, + private_auth_els_kernel_fc_sp_t *this, int fd, int family) +{ + DBG_ENTER; + return TRUE; +} + +METHOD(kernel_ipsec_t, enable_udp_decap, bool, + private_auth_els_kernel_fc_sp_t *this, int fd, int family, uint16_t port) +{ + DBG_ENTER; + return TRUE; +} + +METHOD(kernel_ipsec_t, destroy, void, + private_auth_els_kernel_fc_sp_t *this) +{ + DESTROY_IF(this->rng); + DESTROY_IF(this->spi_lock); + free(this); +} + +/* + * Described in header. + */ +auth_els_kernel_fc_sp_t *auth_els_kernel_fc_sp_create() +{ + private_auth_els_kernel_fc_sp_t *this; + + INIT(this, + .public = { + .interface = { + .get_features = _get_features, + .get_spi = _get_spi, + .get_cpi = _get_cpi, + .add_sa = _add_sa, + .update_sa = _update_sa, + .query_sa = _query_sa, + .del_sa = _del_sa, + .flush_sas = _flush_sas, + .add_policy = _add_policy, + .query_policy = _query_policy, + .del_policy = _del_policy, + .flush_policies = _flush_policies, + .bypass_socket = _bypass_socket, + .enable_udp_decap = _enable_udp_decap, + .destroy = _destroy, + }, + }, + .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK), + .spi_lock = rwlock_create(RWLOCK_TYPE_DEFAULT), + ); + + return &this->public; +} diff --git a/src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.h b/src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.h new file mode 100644 index 000000000..56d7418ac --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_kernel_fc_sp.h @@ -0,0 +1,35 @@ +/* Copyright (C) 2019-2020 Marvell */ + +/** + * @defgroup auth_els-kernel-ipsec kernel ipsec + * @{ @ingroup auth_els + */ + +#ifndef AUTH_ELS_KERNEL_IPSEC_H_ +#define AUTH_ELS_KERNEL_IPSEC_H_ + +#include <kernel/kernel_ipsec.h> +#include <sa/ike_sa.h> + +typedef struct auth_els_kernel_fc_sp_t auth_els_kernel_fc_sp_t; + +/** + * auth_els implementation of the kernel ipsec interface. + */ +struct auth_els_kernel_fc_sp_t { + + /** + * Implements kernel_ipsec_t interface + */ + kernel_ipsec_t interface; + +}; + +/** + * Create a auth_els kernel ipsec interface instance. + * + * @return auth_els_kernel_ipsec_t instance + */ +auth_els_kernel_fc_sp_t *auth_els_kernel_fc_sp_create(); + +#endif /** AUTH_ELS_KERNEL_IPSEC_H_ @}*/ diff --git a/src/libcharon/plugins/auth_els/auth_els_plugin.c b/src/libcharon/plugins/auth_els/auth_els_plugin.c new file mode 100644 index 000000000..35b683aaa --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_plugin.c @@ -0,0 +1,208 @@ +/* Copyright (C) 2019-2020 Marvell */ + +#include <stdint.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <stdio.h> +#include <unistd.h> +#include <dirent.h> +#include <signal.h> +#include <errno.h> +#include <linux/netlink.h> +#include <scsi/scsi_netlink_fc.h> +#include <scsi/scsi_netlink.h> +#include <pthread.h> + +#include <collections/linked_list.h> + +#include <processing/jobs/callback_job.h> +#include <credentials/credential_set.h> +#include <credentials/keys/shared_key.h> +#include <utils/identification.h> +#include <utils/backtrace.h> +#include <threading/thread.h> +#include <daemon.h> + +#include "auth_els_utils.h" +#include "auth_els_plugin.h" +#include "auth_els_ike.h" +#include "auth_els_socket.h" +#include "auth_els_kernel_fc_sp.h" +#include "auth_els_configs.h" + +/** + * private data of auth_els plugin + */ +struct private_auth_els_plugin_t { + + auth_els_plugin_t public; + + auth_els_ike_t *ike; + backend_t* backend; + credential_set_t *creds; + + int apidev_fd; + auth_els_configs_t *configs; +}; +typedef struct private_auth_els_plugin_t private_auth_els_plugin_t; + +// This plugin reference is being used for handling of signals because retreiving +// a context is too complicated. Use with caution otherwise. +private_auth_els_plugin_t *plugin_ref; + + +static void handle_system_fault(int sig_type, siginfo_t* si, void* arg) +{ + DBG_STD ("thread %u received %x", thread_current_id(), sig_type); + + backtrace_t *backtrace; + + backtrace = backtrace_create(2); + backtrace->log(backtrace, NULL, TRUE); + backtrace->log(backtrace, stderr, TRUE); + backtrace->destroy(backtrace); + + DBG_STD ("killing ourself, received critical signal"); + abort(); +} + +static void setup_signal_handlers (private_auth_els_plugin_t *plugin) +{ + struct sigaction sa; + + // fault handler + memset (&sa, 0, sizeof (struct sigaction)); // struct + sigemptyset(&sa.sa_mask); + sa.sa_sigaction = handle_system_fault; + sa.sa_flags = SA_SIGINFO; + sigaction(SIGSEGV, &sa, NULL); + sigaction(SIGFPE, &sa, NULL); + sigaction(SIGILL, &sa, NULL); + +} + +/** + * Initialize plugin + */ +static bool initialize_plugin(private_auth_els_plugin_t *this) +{ + if (this->configs->reload_config(this->configs) == FALSE) + { + return FALSE; + } + + this->ike = auth_els_ike_create(&this->public); + + setup_signal_handlers (this); + + return TRUE; +} + +/** + * Initialize plugin and register listener + */ +static bool plugin_cb(private_auth_els_plugin_t *this, + plugin_feature_t *feature, bool reg, void *cb_data) +{ + if (reg) + { + DBG_STD ("before socket_register"); + + lib->credmgr->add_set(lib->credmgr, this->creds); + } + + if (reg) + { + if (!initialize_plugin(this)) + { + return FALSE; + } + charon->bus->add_listener(charon->bus, &this->ike->listener); + charon->backends->add_backend(charon->backends, this->backend); + } + else + { + lib->credmgr->remove_set(lib->credmgr, this->creds); + } + return TRUE; +} + +METHOD(plugin_t, get_name, char*, + private_auth_els_plugin_t *this) +{ + return "auth-els"; +} + +METHOD(plugin_t, get_features, int, + private_auth_els_plugin_t *this, plugin_feature_t *features[]) +{ + static plugin_feature_t f[] = { + PLUGIN_CALLBACK(kernel_fc_sp_register, auth_els_kernel_fc_sp_create), + PLUGIN_PROVIDE(CUSTOM, "kernel-ipsec"), + PLUGIN_CALLBACK(socket_register, auth_els_socket_create), + PLUGIN_PROVIDE(CUSTOM, "socket"), + PLUGIN_DEPENDS(CUSTOM, "kernel-ipsec"), + PLUGIN_CALLBACK((plugin_feature_callback_t)plugin_cb, NULL), + PLUGIN_PROVIDE(CUSTOM, "auth_els"), + }; + *features = f; + + return countof(f); +} + +METHOD(plugin_t, reload, bool, + private_auth_els_plugin_t *this) +{ + return TRUE; +} + +METHOD(plugin_t, destroy, void, + private_auth_els_plugin_t *this) +{ + DESTROY_IF(this->ike); + + free(this); + + DBG_STD ("Plugin destroy complete"); +} + +/** + * Plugin constructor + */ +plugin_t *auth_els_plugin_create() +{ + private_auth_els_plugin_t *this; + + if (!lib->caps->keep(lib->caps, CAP_CHOWN)) + { + DBG_FATAL ("creation failed"); + return NULL; + } + + INIT(this, + .public = { + .plugin = { + .get_name = _get_name, + .get_features = _get_features, + .reload = _reload, + .destroy = _destroy, + }, + }, + .apidev_fd = -1, + .configs = NULL, + ); + + this->configs = auth_els_configs_create (); + + this->backend = this->configs->get_backend(this->configs); + this->creds = this->configs->get_creds(this->configs); + + char auth_els_plugin_version[AUTH_MAX_STRING_VERSION_LEN + 1]; + + sprintf(auth_els_plugin_version, "%d.%02d.%04d%s", + AUTH_MAJOR_VERSION, AUTH_MINOR_VERSION, AUTH_BUILD_VERSION, AUTH_STRING_SUFFIX_VERSION); + DBG1(DBG_CFG, "auth_els version is %s.", + auth_els_plugin_version); + + return &this->public.plugin; +} diff --git a/src/libcharon/plugins/auth_els/auth_els_plugin.h b/src/libcharon/plugins/auth_els/auth_els_plugin.h new file mode 100644 index 000000000..8d74c1f52 --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_plugin.h @@ -0,0 +1,43 @@ +/* Copyright (C) 2019-2020 Marvell */ + +/** + * @defgroup auth_els auth_els + * @ingroup cplugins + * + * @defgroup auth_els_plugin auth_els_plugin + * @{ @ingroup auth_els + */ + +#ifndef AUTH_ELS_PLUGIN_H_ +#define AUTH_ELS_PLUGIN_H_ + +#include <plugins/plugin.h> + +#define AUTH_MAJOR_VERSION 1 +#define AUTH_MINOR_VERSION 5 +#define AUTH_BUILD_VERSION 3 +#define AUTH_STRING_SUFFIX_VERSION "-stub" +#define AUTH_MAX_STRING_VERSION_LEN 32 + +#define APIDEV_DEVICE "/dev/ql2xapidev" +#define MEMTRACE_MAX_BACKTRACE_DEPTH (64) +#define CHARON_EXECUTABLE "charon" +#define SHELL_BUF_SIZE 512 + +#define HOST_NO_UNASSIGNED 0xffff + +/** Test **/ + +/** + * Plugin to synchronize state in a high availability cluster. + */ +struct auth_els_plugin_t { + + /** + * implements plugin interface + */ + plugin_t plugin; +}; +typedef struct auth_els_plugin_t auth_els_plugin_t; + +#endif /** AUTH_ELS_PLUGIN_H_ @}*/ diff --git a/src/libcharon/plugins/auth_els/auth_els_socket.c b/src/libcharon/plugins/auth_els/auth_els_socket.c new file mode 100644 index 000000000..00faba208 --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_socket.c @@ -0,0 +1,115 @@ +/* Copyright (C) 2019-2020 Marvell */ + +#include <utils/chunk.h> +#include <config/child_cfg.h> + +#include <errno.h> +#include <fcntl.h> +#include <getopt.h> +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <sys/stat.h> +#include <sys/time.h> +#include <sys/ioctl.h> +#include <scsi/scsi.h> +#include <scsi/sg.h> +#include <linux/types.h> + +#include <linux/bsg.h> +#include <scsi/scsi_bsg_fc.h> + +#include <sys/types.h> +#include <sys/socket.h> +#include <errno.h> +#include <unistd.h> + +/* "readdir" etc. are defined here. */ +#include <dirent.h> +/* limits.h defines "PATH_MAX". */ +#include <limits.h> + +#include <daemon.h> +#include <networking/host.h> +#include <processing/jobs/callback_job.h> + +#include <pthread.h> + +#include "auth_els_plugin.h" +#include "auth_els_socket.h" +#include "auth_els_utils.h" + +/** + * Data to pass to the send_message() callback job + */ +typedef struct { + chunk_t chunk; + int fd; +} job_data_t; + +typedef struct private_auth_els_socket_t private_auth_els_socket_t; +/** + * Private data of an auth_els_socket_t object. + */ +struct private_auth_els_socket_t { + + auth_els_socket_t public; + +}; + +METHOD(socket_t, supported_families, socket_family_t, + private_auth_els_socket_t *this) +{ + return SOCKET_FAMILY_FC; +} + +METHOD(socket_t, destroy, void, + private_auth_els_socket_t *this) +{ + free(this); +} + +METHOD(socket_t, receiver, status_t, + private_auth_els_socket_t *this, packet_t **packet) +{ + DBG_ENTER; + + // We don't use the receiver function, so just tell the core to stop trying. + // Receives are done when the driver gives us an ELS_RECV AEN. + return NOT_SUPPORTED; +} + +METHOD(socket_t, sender, status_t, + private_auth_els_socket_t *this, packet_t *packet) +{ + DBG_ENTER; + + return NOT_SUPPORTED; +} + +METHOD(socket_t, get_port, uint16_t, + private_auth_els_socket_t *this, bool nat_t) +{ + return 77; // dummy host number +} + +auth_els_socket_t *auth_els_socket_create() +{ + private_auth_els_socket_t *this; + + INIT(this, + .public = { + .socket = { + .send = _sender, + .receive = _receiver, + .supported_families = _supported_families, + .get_port = _get_port, + .destroy = _destroy, + }, + }, + ); + + return &this->public; +} \ No newline at end of file diff --git a/src/libcharon/plugins/auth_els/auth_els_socket.h b/src/libcharon/plugins/auth_els/auth_els_socket.h new file mode 100644 index 000000000..efef65723 --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_socket.h @@ -0,0 +1,29 @@ +/* Copyright (C) 2019-2020 Marvell */ + +/** + * @defgroup auth_els_socket auth_els_socket + * @{ @ingroup auth_els + */ + +#ifndef AUTH_ELS_SOCKET_H_ +#define AUTH_ELS_SOCKET_H_ + +#include <sa/ike_sa.h> +#include <collections/hashtable.h> +#include <network/socket.h> + +/** + * Socket to send/received SA synchronization data + */ +typedef struct auth_els_socket_t auth_els_socket_t; +struct auth_els_socket_t { + + socket_t socket; +}; + +/** + * Create a default auth_els_socket instance. + */ +auth_els_socket_t *auth_els_socket_create(); + +#endif /** AUTH_ELS_SOCKET_ @}*/ diff --git a/src/libcharon/plugins/auth_els/auth_els_utils.h b/src/libcharon/plugins/auth_els/auth_els_utils.h new file mode 100644 index 000000000..6c864582d --- /dev/null +++ b/src/libcharon/plugins/auth_els/auth_els_utils.h @@ -0,0 +1,40 @@ +/* Copyright (C) 2019-2020 Marvell */ + +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ + +/* + * File: auth_els_utils.h + * Author: cwinkler + * + * Created on February 19, 2020, 8:02 AM + */ + +#include <pthread.h> + +#ifndef AUTH_ELS_UTILS_H +#define AUTH_ELS_UTILS_H + +#define DBG_ENTER { \ + char final_format[1024]; \ + sprintf (final_format, "%s: %s: %d: enter, thread_id: %lx", __FILE__, __func__, __LINE__, pthread_self()); \ + DBG1 (DBG_CFG, final_format); \ +} + +#define DBG_STD(format, ...) { \ + char final_format[1024]; \ + sprintf (final_format, "%s: %s: %d: %s, thread_id: %lx", __FILE__, __func__, __LINE__, format, pthread_self()); \ + DBG1 (DBG_CFG, final_format, ##__VA_ARGS__); \ +} + +#define DBG_FATAL(format, ...) { \ + char final_format[1024]; \ + sprintf (final_format, "%s: %s: %d: FATAL_ERROR: %s, thread_id: %lx", __FILE__, __func__, __LINE__, format, pthread_self()); \ + DBG0 (DBG_CFG, final_format, ##__VA_ARGS__); \ +} + +#endif /* AUTH_ELS_UTILS_H */ + diff --git a/src/libcharon/plugins/ha/ha_tunnel.c b/src/libcharon/plugins/ha/ha_tunnel.c index f94291505..27a0b4aca 100644 --- a/src/libcharon/plugins/ha/ha_tunnel.c +++ b/src/libcharon/plugins/ha/ha_tunnel.c @@ -193,7 +193,7 @@ static void setup_tunnel(private_ha_tunnel_t *this, ike_cfg_create_t ike = { .version = IKEV2, .local = local, - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote = remote, .remote_port = IKEV2_UDP_PORT, .no_certreq = TRUE, diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c index 77c9630ca..3bbd08f69 100644 --- a/src/libcharon/plugins/load_tester/load_tester_config.c +++ b/src/libcharon/plugins/load_tester/load_tester_config.c @@ -1,5 +1,6 @@ /* * Copyright (C) 2008 Martin Willi + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -746,7 +747,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num) } else { - ike.local_port = charon->socket->get_port(charon->socket, FALSE); + ike.local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE); } ike_cfg = ike_cfg_create(&ike); ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal, 0)); diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c index be42d7d7d..b31542afd 100644 --- a/src/libcharon/plugins/medcli/medcli_config.c +++ b/src/libcharon/plugins/medcli/medcli_config.c @@ -1,5 +1,6 @@ /* * Copyright (C) 2008 Martin Willi + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -90,7 +91,7 @@ static peer_cfg_t *build_mediation_config(private_medcli_config_t *this, ike_cfg_create_t ike = { .version = IKEV2, .local = "0.0.0.0", - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote_port = IKEV2_UDP_PORT, .no_certreq = TRUE, }; @@ -404,7 +405,7 @@ medcli_config_t *medcli_config_create(database_t *db) ike_cfg_create_t ike = { .version = IKEV2, .local = "0.0.0.0", - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote = "0.0.0.0", .remote_port = IKEV2_UDP_PORT, .no_certreq = TRUE, diff --git a/src/libcharon/plugins/medsrv/medsrv_config.c b/src/libcharon/plugins/medsrv/medsrv_config.c index b9dce8c0d..500be51b1 100644 --- a/src/libcharon/plugins/medsrv/medsrv_config.c +++ b/src/libcharon/plugins/medsrv/medsrv_config.c @@ -1,5 +1,6 @@ /* * Copyright (C) 2008 Martin Willi + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -133,7 +134,7 @@ medsrv_config_t *medsrv_config_create(database_t *db) ike_cfg_create_t ike = { .version = IKEV2, .local = "0.0.0.0", - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote = "0.0.0.0", .remote_port = IKEV2_UDP_PORT, .no_certreq = TRUE, diff --git a/src/libcharon/plugins/sql/sql_config.c b/src/libcharon/plugins/sql/sql_config.c index fb8ea8c5e..30560d9b0 100644 --- a/src/libcharon/plugins/sql/sql_config.c +++ b/src/libcharon/plugins/sql/sql_config.c @@ -1,6 +1,7 @@ /* * Copyright (C) 2006-2008 Martin Willi * Copyright (C) 2010 Andreas Steffen + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -275,7 +276,7 @@ static ike_cfg_t *build_ike_cfg(private_sql_config_t *this, enumerator_t *e, ike_cfg_create_t ike = { .version = IKEV2, .local = local, - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote = remote, .remote_port = IKEV2_UDP_PORT, .no_certreq = !certreq, diff --git a/src/libcharon/plugins/stroke/stroke_attribute.c b/src/libcharon/plugins/stroke/stroke_attribute.c index fff6a438f..1d2a69cca 100644 --- a/src/libcharon/plugins/stroke/stroke_attribute.c +++ b/src/libcharon/plugins/stroke/stroke_attribute.c @@ -1,6 +1,7 @@ /* * Copyright (C) 2010 Tobias Brunner * Copyright (C) 2008 Martin Willi + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -192,6 +193,7 @@ CALLBACK(attr_filter, bool, switch (host->get_family(host)) { case AF_INET: + case AF_NETLINK: *type = INTERNAL_IP4_DNS; break; case AF_INET6: diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c index fe5c1a542..cfd58a402 100644 --- a/src/libcharon/plugins/stroke/stroke_config.c +++ b/src/libcharon/plugins/stroke/stroke_config.c @@ -1,6 +1,7 @@ /* * Copyright (C) 2012-2014 Tobias Brunner * Copyright (C) 2008 Martin Willi + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -291,7 +292,7 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg } if (ike.local_port == IKEV2_UDP_PORT) { - ike.local_port = charon->socket->get_port(charon->socket, FALSE); + ike.local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE); } ike_cfg = ike_cfg_create(&ike); diff --git a/src/libcharon/plugins/stroke/stroke_list.c b/src/libcharon/plugins/stroke/stroke_list.c index 92b18a8a6..abf8d1bde 100644 --- a/src/libcharon/plugins/stroke/stroke_list.c +++ b/src/libcharon/plugins/stroke/stroke_list.c @@ -5,6 +5,8 @@ * Copyright (C) 2015 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * + * Copyright (C) 2019-2020 Marvell + * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the * Free Software Foundation; either version 2 of the License, or (at your @@ -653,10 +655,13 @@ METHOD(stroke_list_t, status, void, half_open); enumerator = charon->controller->create_ike_sa_enumerator( charon->controller, wait); + int ike_num = 0, child_num = 0; while (enumerator->enumerate(enumerator, &ike_sa) && ferror(out) == 0) { bool ike_printed = FALSE; enumerator_t *children = ike_sa->create_child_sa_enumerator(ike_sa); + + fprintf(out, "ike_sa %d\n--------\n", ike_num); if (name == NULL || streq(name, ike_sa->get_name(ike_sa))) { @@ -665,8 +670,10 @@ METHOD(stroke_list_t, status, void, ike_printed = TRUE; } + child_num = 0; while (children->enumerate(children, (void**)&child_sa)) { + fprintf(out, "\nchild_sa %d-%d\n------------\n", ike_num, child_num++); if (name == NULL || streq(name, child_sa->get_name(child_sa))) { if (!ike_printed) @@ -676,9 +683,12 @@ METHOD(stroke_list_t, status, void, ike_printed = TRUE; } log_child_sa(out, child_sa, all); + fprintf(out, "\n\n"); } } children->destroy(children); + + ike_num++; } enumerator->destroy(enumerator); diff --git a/src/libcharon/plugins/uci/uci_config.c b/src/libcharon/plugins/uci/uci_config.c index a66bb58cb..807da0344 100644 --- a/src/libcharon/plugins/uci/uci_config.c +++ b/src/libcharon/plugins/uci/uci_config.c @@ -2,6 +2,7 @@ * Copyright (C) 2008 Thomas Kallenberg * Copyright (C) 2008 Tobias Brunner * Copyright (C) 2008 Martin Willi + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -129,7 +130,7 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool, ike_cfg_create_t ike = { .version = IKEV2, .local = "0.0.0.0", - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote = "0.0.0.0", .remote_port = IKEV2_UDP_PORT, .no_certreq = TRUE, @@ -254,7 +255,7 @@ METHOD(enumerator_t, ike_enumerator_enumerate, bool, ike_cfg_create_t ike = { .version = IKEV2, .local = "0.0.0.0", - .local_port = charon->socket->get_port(charon->socket, FALSE), + .local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE), .remote = "0.0.0.0", .remote_port = IKEV2_UDP_PORT, .no_certreq = TRUE, diff --git a/src/libcharon/plugins/vici/vici_attribute.c b/src/libcharon/plugins/vici/vici_attribute.c index f7c7ce13a..de6c302e6 100644 --- a/src/libcharon/plugins/vici/vici_attribute.c +++ b/src/libcharon/plugins/vici/vici_attribute.c @@ -4,6 +4,7 @@ * * Copyright (C) 2014 Martin Willi * Copyright (C) 2014 revosec AG + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -467,6 +468,7 @@ CALLBACK(pool_li, bool, switch (host->get_family(host)) { case AF_INET: + case AF_NETLINK: type = keys[index].v4; break; case AF_INET6: @@ -481,7 +483,7 @@ CALLBACK(pool_li, bool, } else { - if (host->get_family(host) == AF_INET) + if (host->get_family(host) == AF_INET || host->get_family(host) == AF_NETLINK) { /* IPv4 attributes contain a subnet mask */ uint32_t netmask = 0; diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c index eb679290d..c3e8e7517 100644 --- a/src/libcharon/plugins/vici/vici_config.c +++ b/src/libcharon/plugins/vici/vici_config.c @@ -4,6 +4,7 @@ * * Copyright (C) 2015-2019 Tobias Brunner * Copyright (C) 2015-2018 Andreas Steffen + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -750,7 +751,7 @@ CALLBACK(parse_ts, bool, if (host_create_from_range(buf, &lower, &upper)) { - type = (lower->get_family(lower) == AF_INET) ? + type = (lower->get_family(lower) == AF_INET || lower->get_family(lower) == AF_NETLINK) ? TS_IPV4_ADDR_RANGE : TS_IPV6_ADDR_RANGE; ts = traffic_selector_create_from_bytes(proto, type, lower->get_address(lower), from, @@ -2473,7 +2474,7 @@ CALLBACK(config_sn, bool, } if (!peer.local_port) { - peer.local_port = charon->socket->get_port(charon->socket, FALSE); + peer.local_port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE); } if (peer.rekey_time == LFT_UNDEFINED && peer.reauth_time == LFT_UNDEFINED) diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c index 4c09b578d..2b2694e9a 100644 --- a/src/libcharon/plugins/vici/vici_control.c +++ b/src/libcharon/plugins/vici/vici_control.c @@ -4,6 +4,7 @@ * * Copyright (C) 2014 Martin Willi * Copyright (C) 2014 revosec AG + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -480,7 +481,7 @@ static traffic_selector_t *parse_peer_ip(char *ip) if (host_create_from_range(ip, &from, &to)) { - if (to->get_family(to) == AF_INET) + if (to->get_family(to) == AF_INET || to->get_family(to) == AF_NETLINK) { type = TS_IPV4_ADDR_RANGE; } diff --git a/src/libcharon/processing/jobs/migrate_job.c b/src/libcharon/processing/jobs/migrate_job.c index 574d715a7..c8cc72703 100644 --- a/src/libcharon/processing/jobs/migrate_job.c +++ b/src/libcharon/processing/jobs/migrate_job.c @@ -103,7 +103,7 @@ METHOD(job_t, execute, job_requeue_t, ike_sa->set_kmaddress(ike_sa, this->local, this->remote); host = this->local->clone(this->local); - host->set_port(host, charon->socket->get_port(charon->socket, FALSE)); + host->set_port(host, charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE)); ike_sa->set_my_host(ike_sa, host); host = this->remote->clone(this->remote); diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c index b11236b8f..e0d467ddc 100644 --- a/src/libcharon/sa/child_sa.c +++ b/src/libcharon/sa/child_sa.c @@ -5,6 +5,7 @@ * Copyright (C) 2006 Daniel Roethlisberger * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -633,7 +634,8 @@ static bool update_usetime(private_child_sa_t *this, bool inbound) .mark = this->mark_in, .if_id = this->if_id_in, }; - kernel_ipsec_query_policy_t query = {}; + kernel_ipsec_query_policy_t query; + query.family = this->my_addr->get_family (this->my_addr); if (charon->kernel->query_policy(charon->kernel, &id, &query, &in) == SUCCESS) @@ -660,7 +662,8 @@ static bool update_usetime(private_child_sa_t *this, bool inbound) .if_id = this->if_id_out, .interface = this->config->get_interface(this->config), }; - kernel_ipsec_query_policy_t query = {}; + kernel_ipsec_query_policy_t query; + query.family = this->my_addr->get_family (this->my_addr); if (charon->kernel->query_policy(charon->kernel, &id, &query, &out) == SUCCESS) @@ -736,6 +739,12 @@ METHOD(child_sa_t, get_lifetime, time_t, return hard ? this->expire_time : this->rekey_time; } +METHOD(child_sa_t, set_rekey_time, void, + private_child_sa_t *this, time_t rekey_time) +{ + this->rekey_time = rekey_time; +} + METHOD(child_sa_t, get_installtime, time_t, private_child_sa_t *this) { @@ -947,7 +956,7 @@ static bool require_policy_update() { kernel_feature_t f; - f = charon->kernel->get_features(charon->kernel); + f = charon->kernel->get_features(charon->kernel, AF_INET); return !(f & KERNEL_NO_POLICY_UPDATES); } @@ -1310,10 +1319,12 @@ METHOD(child_sa_t, register_outbound, status_t, uint16_t cpi, bool tfcv3) { status_t status; + + int family = this->my_addr->get_family (this->my_addr); /* if the kernel supports installing SPIs with policies we install the * SA immediately as it will only be used once we update the policies */ - if (charon->kernel->get_features(charon->kernel) & KERNEL_POLICY_SPI) + if (charon->kernel->get_features(charon->kernel, family) & KERNEL_POLICY_SPI) { status = install_internal(this, encr, integ, spi, cpi, FALSE, FALSE, tfcv3); @@ -1811,6 +1822,7 @@ child_sa_t *child_sa_create(host_t *me, host_t *other, child_cfg_t *config, .get_proposal = _get_proposal, .set_proposal = _set_proposal, .get_lifetime = _get_lifetime, + .set_rekey_time = _set_rekey_time, .get_installtime = _get_installtime, .get_usestats = _get_usestats, .get_mark = _get_mark, diff --git a/src/libcharon/sa/child_sa.h b/src/libcharon/sa/child_sa.h index c9b3f63e2..90cec0146 100644 --- a/src/libcharon/sa/child_sa.h +++ b/src/libcharon/sa/child_sa.h @@ -3,6 +3,7 @@ * Copyright (C) 2006-2008 Martin Willi * Copyright (C) 2006 Daniel Roethlisberger * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -334,6 +335,16 @@ struct child_sa_t { * @return absolute time */ time_t (*get_lifetime)(child_sa_t *this, bool hard); + + /** + * Set the absolute time when the CHILD_SA gets rekeyed. + * Note: since the rekeying is actually controlled in the kernel, + * this api is here to report what is expected, not to actually affect the rekey action. + * + * @param rekey_time absolute time when rekey should happen. + * @return void + */ + void (*set_rekey_time)(child_sa_t *this, time_t rekey_time); /** * Get the absolute time when this SA has been installed. diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index d6cc4e5a7..0d63bc763 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -4,6 +4,7 @@ * Copyright (C) 2005-2009 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -1076,10 +1077,10 @@ METHOD(ike_sa_t, float_ports, void, this->other_host->set_port(this->other_host, IKEV2_NATT_PORT); } if (this->my_host->get_port(this->my_host) == - charon->socket->get_port(charon->socket, FALSE)) + charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE)) { this->my_host->set_port(this->my_host, - charon->socket->get_port(charon->socket, TRUE)); + charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, TRUE)); } } @@ -1384,6 +1385,7 @@ static void resolve_hosts(private_ike_sa_t *this) switch (charon->socket->supported_families(charon->socket)) { case SOCKET_FAMILY_IPV4: + case SOCKET_FAMILY_FC: family = AF_INET; break; case SOCKET_FAMILY_IPV6: @@ -1435,7 +1437,7 @@ static void resolve_hosts(private_ike_sa_t *this) if (this->local_host) { host = this->local_host->clone(this->local_host); - host->set_port(host, charon->socket->get_port(charon->socket, FALSE)); + host->set_port(host, charon->socket->get_port(charon->socket, host->get_family (host), FALSE)); } else { @@ -2572,6 +2574,7 @@ static bool is_any_path_valid(private_ike_sa_t *this) switch (charon->socket->supported_families(charon->socket)) { case SOCKET_FAMILY_IPV4: + case SOCKET_FAMILY_FC: family = AF_INET; break; case SOCKET_FAMILY_IPV6: @@ -3015,11 +3018,9 @@ METHOD(ike_sa_t, destroy, void, free(this); } -/* - * Described in header. - */ -ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, - ike_version_t version) + +ike_sa_t * ike_sa_create_with_family(ike_sa_id_t *ike_sa_id, bool initiator, + ike_version_t version, int family) { private_ike_sa_t *this; static refcount_t unique_id = 0; @@ -3131,8 +3132,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, }, .ike_sa_id = ike_sa_id->clone(ike_sa_id), .version = version, - .my_host = host_create_any(AF_INET), - .other_host = host_create_any(AF_INET), + .my_host = host_create_any(family), + .other_host = host_create_any(family), .my_id = identification_create_from_encoding(ID_ANY, chunk_empty), .other_id = identification_create_from_encoding(ID_ANY, chunk_empty), .keymat = keymat_create(version, initiator), @@ -3163,8 +3164,9 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, } this->task_manager = task_manager_create(&this->public); + this->my_host->set_port(this->my_host, - charon->socket->get_port(charon->socket, FALSE)); + charon->socket->get_port(charon->socket, this->my_host->get_family (this->my_host), FALSE)); if (!this->task_manager || !this->keymat) { @@ -3174,3 +3176,12 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, } return &this->public; } + +/* + * Described in header. + */ +ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, + ike_version_t version) +{ + return ike_sa_create_with_family (ike_sa_id, initiator, version, AF_INET); +} \ No newline at end of file diff --git a/src/libcharon/sa/ike_sa.h b/src/libcharon/sa/ike_sa.h index d51108140..466f541fb 100644 --- a/src/libcharon/sa/ike_sa.h +++ b/src/libcharon/sa/ike_sa.h @@ -3,6 +3,7 @@ * Copyright (C) 2006 Daniel Roethlisberger * Copyright (C) 2005-2009 Martin Willi * Copyright (C) 2005 Jan Hutter + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -1221,4 +1222,7 @@ struct ike_sa_t { ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, ike_version_t version); +ike_sa_t * ike_sa_create_with_family(ike_sa_id_t *ike_sa_id, bool initiator, + ike_version_t version, int family); + #endif /** IKE_SA_H_ @}*/ diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c index 1de410d6c..c0f608758 100644 --- a/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c @@ -1,6 +1,7 @@ /* * Copyright (C) 2005-2011 Martin Willi * Copyright (C) 2011 revosec AG + * Copyright (C) 2019-2020 Marvell * * Copyright (C) 2008-2018 Tobias Brunner * Copyright (C) 2005 Jan Hutter @@ -1202,8 +1203,8 @@ METHOD(ike_sa_manager_t, checkout, ike_sa_t*, return ike_sa; } -METHOD(ike_sa_manager_t, checkout_new, ike_sa_t*, - private_ike_sa_manager_t* this, ike_version_t version, bool initiator) +METHOD(ike_sa_manager_t, checkout_new_with_family, ike_sa_t*, + private_ike_sa_manager_t* this, ike_version_t version, bool initiator, int family) { ike_sa_id_t *ike_sa_id; ike_sa_t *ike_sa; @@ -1227,7 +1228,7 @@ METHOD(ike_sa_manager_t, checkout_new, ike_sa_t*, { ike_sa_id = ike_sa_id_create(ike_version, 0, spi, FALSE); } - ike_sa = ike_sa_create(ike_sa_id, initiator, version); + ike_sa = ike_sa_create_with_family(ike_sa_id, initiator, version, family); ike_sa_id->destroy(ike_sa_id); if (ike_sa) @@ -1238,6 +1239,12 @@ METHOD(ike_sa_manager_t, checkout_new, ike_sa_t*, return ike_sa; } +METHOD(ike_sa_manager_t, checkout_new, ike_sa_t*, + private_ike_sa_manager_t* this, ike_version_t version, bool initiator) +{ + return checkout_new_with_family (this, version, initiator, AF_INET); +} + /** * Get the message ID or message hash to detect early retransmissions */ @@ -1256,8 +1263,8 @@ static uint32_t get_message_id_or_hash(message_t *message) return message->get_message_id(message); } -METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*, - private_ike_sa_manager_t* this, message_t *message) +METHOD(ike_sa_manager_t, checkout_by_message_with_family, ike_sa_t*, + private_ike_sa_manager_t* this, message_t *message, int family) { u_int segment; entry_t *entry; @@ -1328,7 +1335,7 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*, this->public.get_count(&this->public) < this->ikesa_limit) { id->set_responder_spi(id, our_spi); - ike_sa = ike_sa_create(id, FALSE, ike_version); + ike_sa = ike_sa_create_with_family(id, FALSE, ike_version, family); if (ike_sa) { entry = entry_create(); @@ -1422,6 +1429,12 @@ out: return ike_sa; } +METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*, + private_ike_sa_manager_t* this, message_t *message) +{ + return checkout_by_message_with_family (this, message, AF_INET); +} + METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg) { @@ -2361,7 +2374,9 @@ ike_sa_manager_t *ike_sa_manager_create() .public = { .checkout = _checkout, .checkout_new = _checkout_new, + .checkout_new_with_family = _checkout_new_with_family, .checkout_by_message = _checkout_by_message, + .checkout_by_message_with_family = _checkout_by_message_with_family, .checkout_by_config = _checkout_by_config, .checkout_by_id = _checkout_by_id, .checkout_by_name = _checkout_by_name, diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h index efad2e4d6..012059af0 100644 --- a/src/libcharon/sa/ike_sa_manager.h +++ b/src/libcharon/sa/ike_sa_manager.h @@ -2,6 +2,7 @@ * Copyright (C) 2008-2017 Tobias Brunner * Copyright (C) 2005-2008 Martin Willi * Copyright (C) 2005 Jan Hutter + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -58,9 +59,20 @@ struct ike_sa_manager_t { * - NULL, if specified IKE_SA is not found. */ ike_sa_t* (*checkout) (ike_sa_manager_t* this, ike_sa_id_t *sa_id); + + /** + * Create and check out a new IKE_SA. + * + * @param version IKE version of this SA + * @param initiator TRUE for initiator, FALSE otherwise + * @param family Address family (AF_xx) + * @returns created and checked out IKE_SA + */ + ike_sa_t* (*checkout_new_with_family) (ike_sa_manager_t* this, ike_version_t version, + bool initiator, int family); /** - * Create and check out a new IKE_SA. + * Create and check out a new IKE_SA with default address family of AF_INET. * * @param version IKE version of this SA * @param initiator TRUE for initiator, FALSE otherwise @@ -90,6 +102,7 @@ struct ike_sa_manager_t { * - checked out/created IKE_SA * - NULL to not process message further */ + ike_sa_t* (*checkout_by_message_with_family) (ike_sa_manager_t* this, message_t *message, int family); ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message); /** diff --git a/src/libcharon/sa/ikev1/tasks/informational.c b/src/libcharon/sa/ikev1/tasks/informational.c index 2798978b2..bf11991dd 100644 --- a/src/libcharon/sa/ikev1/tasks/informational.c +++ b/src/libcharon/sa/ikev1/tasks/informational.c @@ -1,6 +1,7 @@ /* * Copyright (C) 2011 Martin Willi * Copyright (C) 2011 revosec AG + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -117,7 +118,7 @@ METHOD(task_t, process_r, status_t, /* Cisco boxes reject the first message from 4500 */ me = this->ike_sa->get_my_host(this->ike_sa); me->set_port(me, charon->socket->get_port( - charon->socket, FALSE)); + charon->socket, SOCKET_FAMILY_BOTH, FALSE)); this->ike_sa->set_other_host(this->ike_sa, redirect); status = this->ike_sa->reauth(this->ike_sa); enumerator->destroy(enumerator); diff --git a/src/libcharon/sa/ikev1/tasks/isakmp_natd.c b/src/libcharon/sa/ikev1/tasks/isakmp_natd.c index 81e63740e..482c6803a 100644 --- a/src/libcharon/sa/ikev1/tasks/isakmp_natd.c +++ b/src/libcharon/sa/ikev1/tasks/isakmp_natd.c @@ -2,6 +2,7 @@ * Copyright (C) 2006-2011 Tobias Brunner, * Copyright (C) 2006-2007 Martin Willi * Copyright (C) 2006 Daniel Roethlisberger + * Copyright (C) 2019-2020 Marvell * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -103,7 +104,7 @@ static bool force_encap(ike_cfg_t *ike_cfg) { if (!ike_cfg->force_encap(ike_cfg)) { - return charon->kernel->get_features(charon->kernel) & + return charon->kernel->get_features(charon->kernel, AF_INET) & KERNEL_REQUIRE_UDP_ENCAPSULATION; } return TRUE; diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c index 6bafd42e0..757f1fb7c 100644 --- a/src/libcharon/sa/ikev2/task_manager_v2.c +++ b/src/libcharon/sa/ikev2/task_manager_v2.c @@ -2,6 +2,7 @@ * Copyright (C) 2007-2018 Tobias Brunner * Copyright (C) 2007-2010 Martin Willi * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -2083,7 +2084,7 @@ METHOD(task_manager_t, queue_child, void, { child_create_t *task; - task = child_create_create(this->ike_sa, cfg, FALSE, tsi, tsr); + task = child_create_create(this->ike_sa, cfg->get_ref(cfg), FALSE, tsi, tsr); if (reqid) { task->use_reqid(task, reqid); diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c index e98c1dbcc..95e338005 100644 --- a/src/libcharon/sa/ikev2/tasks/child_create.c +++ b/src/libcharon/sa/ikev2/tasks/child_create.c @@ -3,6 +3,7 @@ * Copyright (C) 2005-2008 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -901,8 +902,11 @@ static bool build_payloads(private_child_create_t *this, message_t *message) default: break; } + + host_t *my_host = this->ike_sa->get_my_host (this->ike_sa); + int family = my_host->get_family (my_host); - features = charon->kernel->get_features(charon->kernel); + features = charon->kernel->get_features(charon->kernel, family); if (!(features & KERNEL_ESP_V3_TFC)) { message->add_notify(message, FALSE, ESP_TFC_PADDING_NOT_SUPPORTED, @@ -1323,7 +1327,7 @@ static linked_list_t* get_ts_if_nat_transport(private_child_create_t *this, static child_cfg_t* select_child_cfg(private_child_create_t *this) { peer_cfg_t *peer_cfg; - child_cfg_t *child_cfg = NULL;; + child_cfg_t *child_cfg = NULL; peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); if (peer_cfg && this->tsi && this->tsr) diff --git a/src/libcharon/sa/ikev2/tasks/ike_mobike.c b/src/libcharon/sa/ikev2/tasks/ike_mobike.c index b2ad0a02a..5fc74721a 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_mobike.c +++ b/src/libcharon/sa/ikev2/tasks/ike_mobike.c @@ -2,6 +2,7 @@ * Copyright (C) 2010-2018 Tobias Brunner * Copyright (C) 2007 Martin Willi * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -327,9 +328,9 @@ static void apply_port(host_t *host, host_t *old, uint16_t port, bool local) { port = old->get_port(old); } - else if (local && port == charon->socket->get_port(charon->socket, FALSE)) + else if (local && port == charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, FALSE)) { - port = charon->socket->get_port(charon->socket, TRUE); + port = charon->socket->get_port(charon->socket, SOCKET_FAMILY_BOTH, TRUE); } else if (!local && port == IKEV2_UDP_PORT) { @@ -375,6 +376,7 @@ METHOD(ike_mobike_t, transmit, bool, switch (charon->socket->supported_families(charon->socket)) { case SOCKET_FAMILY_IPV4: + case SOCKET_FAMILY_FC: family = AF_INET; break; case SOCKET_FAMILY_IPV6: diff --git a/src/libcharon/sa/ikev2/tasks/ike_natd.c b/src/libcharon/sa/ikev2/tasks/ike_natd.c index 8ea903ec8..e04714e75 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_natd.c +++ b/src/libcharon/sa/ikev2/tasks/ike_natd.c @@ -2,6 +2,7 @@ * Copyright (C) 2006-2007 Martin Willi * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -85,7 +86,7 @@ static bool force_encap(ike_cfg_t *ike_cfg) { if (!ike_cfg->force_encap(ike_cfg)) { - return charon->kernel->get_features(charon->kernel) & + return charon->kernel->get_features(charon->kernel, AF_INET) & KERNEL_REQUIRE_UDP_ENCAPSULATION; } return TRUE; @@ -101,6 +102,18 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this, chunk_t natd_hash; uint64_t spi_i, spi_r; uint16_t port; + + // For FC, the port is not a valid comparison point because that port + // is not used to make the address tuple. It is only used as a local host identifier. + socket_family_t family = charon->socket->supported_families(charon->socket); + if (family != SOCKET_FAMILY_FC) + { + port = htons(host->get_port(host)); + } + else + { + port = 0; + } /* prepare all required chunks */ spi_i = ike_sa_id->get_initiator_spi(ike_sa_id); @@ -109,11 +122,10 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this, spi_i_chunk.len = sizeof(spi_i); spi_r_chunk.ptr = (void*)&spi_r; spi_r_chunk.len = sizeof(spi_r); - port = htons(host->get_port(host)); port_chunk.ptr = (void*)&port; port_chunk.len = sizeof(port); addr_chunk = host->get_address(host); - + /* natd_hash = SHA1( spi_i | spi_r | address | port ) */ natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk); if (!this->hasher->allocate_hash(this->hasher, natd_chunk, &natd_hash)) @@ -184,6 +196,7 @@ static void process_payloads(private_ike_natd_t *this, message_t *message) ike_sa_id = message->get_ike_sa_id(message); me = message->get_destination(message); other = message->get_source(message); + dst_hash = generate_natd_hash(this, ike_sa_id, me); src_hash = generate_natd_hash(this, ike_sa_id, other); diff --git a/src/libstrongswan/networking/host.c b/src/libstrongswan/networking/host.c index 110ece894..8d9fbb40e 100644 --- a/src/libstrongswan/networking/host.c +++ b/src/libstrongswan/networking/host.c @@ -84,6 +84,7 @@ METHOD(host_t, is_anyaddr, bool, switch (this->address.sa_family) { case AF_INET: + case AF_NETLINK: { return memeq(zeroes, &(this->address4.sin_addr.s_addr), IPV4_LEN); } @@ -121,19 +122,23 @@ int host_printf_hook(printf_hook_data_t *data, printf_hook_spec_t *spec, void *address; uint16_t port; int len; + int family; address = &this->address6.sin6_addr; port = this->address6.sin6_port; + family = this->address.sa_family; switch (this->address.sa_family) { case AF_INET: + case AF_NETLINK: address = &this->address4.sin_addr; port = this->address4.sin_port; + family = AF_INET; // inet_ntop does not recognize AF_NETLINK /* fall */ case AF_INET6: - if (inet_ntop(this->address.sa_family, address, + if (inet_ntop(family, address, buffer, sizeof(buffer)) == NULL) { snprintf(buffer, sizeof(buffer), @@ -166,6 +171,7 @@ METHOD(host_t, get_address, chunk_t, switch (this->address.sa_family) { case AF_INET: + case AF_NETLINK: { address.ptr = (char*)&(this->address4.sin_addr.s_addr); address.len = IPV4_LEN; @@ -197,6 +203,7 @@ METHOD(host_t, get_port, uint16_t, switch (this->address.sa_family) { case AF_INET: + case AF_NETLINK: { return ntohs(this->address4.sin_port); } @@ -217,6 +224,7 @@ METHOD(host_t, set_port, void, switch (this->address.sa_family) { case AF_INET: + case AF_NETLINK: { this->address4.sin_port = htons(port); break; @@ -258,6 +266,7 @@ static bool ip_equals(private_host_t *this, private_host_t *other) switch (this->address.sa_family) { case AF_INET: + case AF_NETLINK: { return memeq(&this->address4.sin_addr, &other->address4.sin_addr, sizeof(this->address4.sin_addr)); @@ -286,6 +295,7 @@ static bool equals(private_host_t *this, private_host_t *other) switch (this->address.sa_family) { case AF_INET: + case AF_NETLINK: { return (this->address4.sin_port == other->address4.sin_port); } @@ -394,6 +404,7 @@ host_t *host_create_from_string_and_family(char *string, int family, addr.v6.sin6_family = AF_INET6; return host_create_from_sockaddr((sockaddr_t*)&addr); case AF_INET: + case AF_NETLINK: if (strchr(string, ':')) { /* do not try to convert v6 addresses for v4 family */ return NULL; @@ -405,7 +416,7 @@ host_t *host_create_from_string_and_family(char *string, int family, return NULL; } addr.v4.sin_port = htons(port); - addr.v4.sin_family = AF_INET; + addr.v4.sin_family = family == AF_NETLINK ? AF_NETLINK : AF_INET; return host_create_from_sockaddr((sockaddr_t*)&addr); default: return NULL; @@ -430,6 +441,7 @@ host_t *host_create_from_sockaddr(sockaddr_t *sockaddr) switch (sockaddr->sa_family) { case AF_INET: + case AF_NETLINK: { memcpy(&this->address4, (struct sockaddr_in*)sockaddr, sizeof(struct sockaddr_in)); @@ -481,6 +493,7 @@ host_t *host_create_from_chunk(int family, chunk_t address, uint16_t port) switch (family) { case AF_INET: + case AF_NETLINK: if (address.len < IPV4_LEN) { return NULL; @@ -515,6 +528,7 @@ host_t *host_create_from_chunk(int family, chunk_t address, uint16_t port) switch (family) { case AF_INET: + case AF_NETLINK: memcpy(&this->address4.sin_addr.s_addr, address.ptr, address.len); this->address4.sin_port = htons(port); this->socklen = sizeof(struct sockaddr_in); @@ -664,6 +678,7 @@ host_t *host_create_any(int family) switch (family) { case AF_INET: + case AF_NETLINK: { this->socklen = sizeof(struct sockaddr_in); update_sa_len(this); diff --git a/src/libstrongswan/plugins/plugin_loader.c b/src/libstrongswan/plugins/plugin_loader.c index b694e97cd..121248bbe 100644 --- a/src/libstrongswan/plugins/plugin_loader.c +++ b/src/libstrongswan/plugins/plugin_loader.c @@ -658,7 +658,7 @@ static bool loadable_feature_matches(registered_feature_t *a, } /** - * Returns a compatible plugin feature for the given dependency + * Returns a compatible plugin feature for the given depencency */ static bool find_compatible_feature(private_plugin_loader_t *this, plugin_feature_t *dependency) diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c index cfd2b029d..9377ca980 100644 --- a/src/libstrongswan/selectors/traffic_selector.c +++ b/src/libstrongswan/selectors/traffic_selector.c @@ -3,6 +3,7 @@ * Copyright (C) 2005-2007 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -27,13 +28,15 @@ #define IPV4_LEN 4 #define IPV6_LEN 16 -#define TS_IP_LEN(this) ({ ((this)->type == TS_IPV4_ADDR_RANGE) ? IPV4_LEN : IPV6_LEN; }) +#define PORTID_LEN 3 +#define TS_IP_LEN(this) ({ (((this)->type == TS_IPV4_ADDR_RANGE) ? IPV4_LEN : (((this)->type == TS_FC_ADDR_RANGE) ? PORTID_LEN: IPV6_LEN) ); }) #define NON_SUBNET_ADDRESS_RANGE 255 -ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_IPV6_ADDR_RANGE, +ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_FC_ADDR_RANGE, "TS_IPV4_ADDR_RANGE", "TS_IPV6_ADDR_RANGE", + "TS_FC_ADDR_RANGE", ); typedef struct private_traffic_selector_t private_traffic_selector_t; @@ -88,6 +91,23 @@ struct private_traffic_selector_t { * end of port range */ uint16_t to_port; + + /** + * starting R_CTL. + */ + uint8_t starting_r_ctl; + + /** + * ending R_CTL. + */ + uint8_t ending_r_ctl; + + /** + * FC port is identified using port index + * as host_t structure is still not FC compliant. + */ + uint16_t id; + }; /** @@ -234,7 +254,7 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, len = TS_IP_LEN(this); memset(from, 0, len); memset(to, 0xFF, len); - if (this->dynamic && + if (this->dynamic && (this->type != TS_FC_ADDR_RANGE) && memeq(this->from, from, len) && memeq(this->to, to, len)) { written += print_in_hook(data, "dynamic"); @@ -245,6 +265,11 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, { inet_ntop(AF_INET, &this->from, from_str, sizeof(from_str)); } + else if (this->type == TS_FC_ADDR_RANGE) + { + written += print_in_hook(data, "%x%x%x..%x%x%x", this->from[0], this->from[1], this->from[2], + this->to[0], this->to[1], this->to[2]); + } else { inet_ntop(AF_INET6, &this->from, from_str, sizeof(from_str)); @@ -312,6 +337,14 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, { written += print_icmp(data, this->from_port); } + else if (this->type == TS_FC_ADDR_RANGE) + { + written += print_in_hook(data, "%d-%d", + this->from_port, this->to_port); + written += print_in_hook(data, "%d-%d", + this->starting_r_ctl, this->ending_r_ctl); + + } else { serv = getservbyport(htons(this->from_port), serv_proto); @@ -340,6 +373,12 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, { written += print_in_hook(data, "%d-%d", this->from_port, this->to_port); + if (this->type == TS_FC_ADDR_RANGE) + { + written += print_in_hook(data, "%d-%d", + this->starting_r_ctl, this->ending_r_ctl); + + } } } @@ -421,6 +460,14 @@ METHOD(traffic_selector_t, get_subset, traffic_selector_t*, /* we have a match in protocol, port, and address: return it... */ subset = traffic_selector_create(protocol, this->type, from_port, to_port); + if(this->type == TS_FC_ADDR_RANGE) + { + subset->starting_r_ctl = this->starting_r_ctl; + subset->ending_r_ctl = this->ending_r_ctl; + subset->id = this->id; + from = this->from; + to = this->to; + } memcpy(subset->from, from, size); memcpy(subset->to, to, size); calc_netbits(subset); @@ -470,6 +517,56 @@ METHOD(traffic_selector_t, get_protocol, uint8_t, return this->protocol; } +METHOD(traffic_selector_t, get_start_rctl, uint8_t, + private_traffic_selector_t *this) +{ + return this->starting_r_ctl; +} + +METHOD(traffic_selector_t, set_start_rctl, void, + private_traffic_selector_t *this, uint8_t starting_r_ctl) +{ + this->starting_r_ctl = starting_r_ctl; +} + +METHOD(traffic_selector_t, get_end_rctl, uint8_t, + private_traffic_selector_t *this) +{ + return this->ending_r_ctl; +} + +METHOD(traffic_selector_t, set_end_rctl, void, + private_traffic_selector_t *this, uint8_t ending_r_ctl) +{ + this->ending_r_ctl = ending_r_ctl; +} + +METHOD(traffic_selector_t, set_id, void, + private_traffic_selector_t *this, uint16_t port_index) +{ + this->id = port_index; +} + +METHOD(traffic_selector_t, get_id, uint16_t, + private_traffic_selector_t *this) +{ + return this->id; +} + +METHOD(traffic_selector_t, set_port_id, void, + private_traffic_selector_t *this, chunk_t from, chunk_t to) +{ + if (this->type == TS_FC_ADDR_RANGE) + { + if ((from.len != 3) || (to.len != 3)) + { + return; + } + memcpy(this->from, from.ptr, from.len); + memcpy(this->to, to.ptr, to.len); + } +} + METHOD(traffic_selector_t, is_host, bool, private_traffic_selector_t *this, host_t *host) { @@ -488,6 +585,14 @@ METHOD(traffic_selector_t, is_host, bool, return TRUE; } } + else if (this->type == TS_FC_ADDR_RANGE) + { + uint16_t port_index = host->get_port(host); + if (this->id == port_index) + { + return TRUE; + } + } } else { @@ -515,21 +620,38 @@ METHOD(traffic_selector_t, is_dynamic, bool, METHOD(traffic_selector_t, set_address, void, private_traffic_selector_t *this, host_t *host) { - this->type = host->get_family(host) == AF_INET ? TS_IPV4_ADDR_RANGE - : TS_IPV6_ADDR_RANGE; + if (this->type != TS_FC_ADDR_RANGE) + { + this->type = host->get_family(host) == AF_INET ? TS_IPV4_ADDR_RANGE + : TS_IPV6_ADDR_RANGE; + } if (host->is_anyaddr(host)) { memset(this->from, 0x00, sizeof(this->from)); memset(this->to, 0xFF, sizeof(this->to)); this->netbits = 0; + + if (this->type == TS_FC_ADDR_RANGE) + { + uint16_t port_index = host->get_port(host); + this->id = port_index; + } } else { - chunk_t from = host->get_address(host); - memcpy(this->from, from.ptr, from.len); - memcpy(this->to, from.ptr, from.len); - this->netbits = from.len * 8; + if (this->type == TS_FC_ADDR_RANGE) + { + uint16_t port_index = host->get_port(host); + this->id = port_index; + } + else + { + chunk_t from = host->get_address(host); + memcpy(this->from, from.ptr, from.len); + memcpy(this->to, from.ptr, from.len); + this->netbits = from.len * 8; + } } this->dynamic = FALSE; } @@ -540,6 +662,15 @@ METHOD(traffic_selector_t, is_contained_in, bool, private_traffic_selector_t *subset; bool contained_in = FALSE; + if (this->type == TS_FC_ADDR_RANGE) + { + if (equals(this, other)) + { + contained_in = TRUE; + } + return contained_in; + } + subset = (private_traffic_selector_t*)get_subset(this, other); if (subset) @@ -558,6 +689,7 @@ METHOD(traffic_selector_t, includes, bool, { chunk_t addr; int family = host->get_family(host); + uint16_t port_index = 0; if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) || (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE)) @@ -568,6 +700,13 @@ METHOD(traffic_selector_t, includes, bool, memcmp(this->to, addr.ptr, addr.len) >= 0; } + if (this->type == TS_FC_ADDR_RANGE) + { + port_index = host->get_port(host); + + return ((this->from_port == port_index) || (this->to_port == port_index)); + } + return FALSE; } @@ -633,12 +772,24 @@ METHOD(traffic_selector_t, clone_, traffic_selector_t*, memcpy(clone->from, this->from, len); memcpy(clone->to, this->to, len); + if (clone->type == TS_FC_ADDR_RANGE) + { + clone->starting_r_ctl = this->starting_r_ctl; + clone->ending_r_ctl = this->ending_r_ctl; + clone->id = this->id; + } return &clone->public; } METHOD(traffic_selector_t, hash, u_int, private_traffic_selector_t *this, u_int hash) { + if (this->type == TS_FC_ADDR_RANGE) + { + hash = chunk_hash_inc(chunk_from_thing(this->starting_r_ctl), + chunk_hash_inc(chunk_from_thing(this->ending_r_ctl), + hash)); + } return chunk_hash_inc(get_from_address(this), chunk_hash_inc(get_to_address(this), chunk_hash_inc(chunk_from_thing(this->from_port), @@ -706,7 +857,23 @@ int traffic_selector_cmp(traffic_selector_t *a_pub, traffic_selector_t *b_pub, return res; } /* larger port ranges first */ - return compare_int(b->to_port, a->to_port); + res = compare_int(b->to_port, a->to_port); + if (res) + { + return res; + } + + if (a->type == TS_FC_ADDR_RANGE) + { + res = compare_int(b->starting_r_ctl, a->starting_r_ctl); + if (res) + { + return res; + } + res = compare_int(b->ending_r_ctl, a->ending_r_ctl); + } + return res; + } /* @@ -882,7 +1049,7 @@ static private_traffic_selector_t *traffic_selector_create(uint8_t protocol, private_traffic_selector_t *this; /* sanity check */ - if (type != TS_IPV4_ADDR_RANGE && type != TS_IPV6_ADDR_RANGE) + if (type != TS_IPV4_ADDR_RANGE && type != TS_IPV6_ADDR_RANGE && type != TS_FC_ADDR_RANGE) { return NULL; } @@ -906,6 +1073,13 @@ static private_traffic_selector_t *traffic_selector_create(uint8_t protocol, .clone = _clone_, .hash = _hash, .destroy = _destroy, + .get_start_rctl = _get_start_rctl, + .get_end_rctl = _get_end_rctl, + .set_start_rctl = _set_start_rctl, + .set_end_rctl = _set_end_rctl, + .set_port_id = _set_port_id, + .set_id = _set_id, + .get_id = _get_id, }, .from_port = from_port, .to_port = to_port, @@ -919,3 +1093,22 @@ static private_traffic_selector_t *traffic_selector_create(uint8_t protocol, } return this; } + +traffic_selector_t *traffic_selector_create_from_fcsp2_format(chunk_t start_address, uint16_t start_type, + chunk_t end_address, uint16_t end_type, + uint8_t start_rctl, uint8_t end_rctl) +{ + ts_type_t type = TS_FC_ADDR_RANGE; + private_traffic_selector_t *this = traffic_selector_create(IPPROTO_RAW, type, + start_type, end_type); + + memset(this->from, 0x0, start_address.len); + memcpy(this->from, start_address.ptr, start_address.len); + this->starting_r_ctl = start_rctl; + + memset(this->to, 0x0, end_address.len); + memcpy(this->to, end_address.ptr, end_address.len); + this->ending_r_ctl = end_rctl; + + return &this->public; +} diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h index 03f7a6d8c..9c7251705 100644 --- a/src/libstrongswan/selectors/traffic_selector.h +++ b/src/libstrongswan/selectors/traffic_selector.h @@ -3,6 +3,7 @@ * Copyright (C) 2005-2006 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -50,7 +51,16 @@ enum ts_type_t { * (inclusive). All addresses falling between the two specified * addresses are considered to be within the list. */ - TS_IPV6_ADDR_RANGE = 8 + TS_IPV6_ADDR_RANGE = 8, + + /** + * A range of FC addresses, represented by two three (3) + * octet values. The first value is the beginning FC address + * (inclusive) and the second value is the ending FC address + * (inclusive). All addresses falling between the two specified + * addresses are considered to be within the list. + */ + TS_FC_ADDR_RANGE = 9 }; /** @@ -152,6 +162,55 @@ struct traffic_selector_t { */ uint8_t (*get_protocol)(traffic_selector_t *this); + /** + * Get the starting R_CTL type allowed for FC frame + * + * @return starting R_CTL + */ + uint8_t (*get_start_rctl) (traffic_selector_t *this); + + /** + * Get the ending R_CTL type allowed for FC frame + * + * @return ending R_CTL + */ + uint8_t (*get_end_rctl) (traffic_selector_t *this); + + /** + * set the starting R_CTL type allowed for FC frame + * + * @return ending R_CTL + */ + void (*set_start_rctl) (traffic_selector_t *this, uint8_t starting_r_ctl); + + /** + * set the ending R_CTL type allowed for FC frame + * + * @return ending R_CTL + */ + void (*set_end_rctl) (traffic_selector_t *this, uint8_t ending_r_ctl); + + /** + * set the 3 bytes port identifiers allowed for FC port + * + * @return ending R_CTL + */ + void (*set_port_id) (traffic_selector_t *this, chunk_t from, chunk_t to); + + /** + * set id in ts for FC port as host_t is still not FC compilant + * + * @return ending R_CTL + */ + void (*set_id) (traffic_selector_t *this, uint16_t port_index); + + /** + * get id from ts for FC port to check corresponding host match to identity payload + * + * @return ending R_CTL + */ + uint16_t (*get_id) (traffic_selector_t *this); + /** * Check if the traffic selector is for a single host. * @@ -416,4 +475,23 @@ traffic_selector_t *traffic_selector_create_dynamic(uint8_t protocol, int traffic_selector_printf_hook(printf_hook_data_t *data, printf_hook_spec_t *spec, const void *const *args); +/** + * Create a new traffic selector using data read from the net. + * + * There exists a mix of network and host order in the params. + * But the parser gives us this data in fcsp format, so we + * don't have to convert twice. + * + * @param start_address start of address range, network order + * @param start_type starting type of following addresses + * @param end_address end of address range, network order + * @param end_rctl Ending R_CTL + * @param start_rctl Starting R_CTL + * @param end_type ending type of following address + * @return traffic_selector_t object + */ +traffic_selector_t *traffic_selector_create_from_fcsp2_format(chunk_t start_address, uint16_t start_type, + chunk_t end_address, uint16_t end_type, + uint8_t start_rctl, uint8_t end_rctl); + #endif /** TRAFFIC_SELECTOR_H_ @}*/ diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c index 3d803c04b..f60e2df40 100644 --- a/src/libstrongswan/utils/identification.c +++ b/src/libstrongswan/utils/identification.c @@ -4,6 +4,7 @@ * Copyright (C) 2005-2009 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -36,7 +37,7 @@ ENUM_NEXT(id_match_names, ID_MATCH_PERFECT, ID_MATCH_PERFECT, ID_MATCH_MAX_WILDC "MATCH_PERFECT"); ENUM_END(id_match_names, ID_MATCH_PERFECT); -ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_ID, +ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_Q_NAME, "ID_ANY", "ID_IPV4_ADDR", "ID_FQDN", @@ -48,8 +49,9 @@ ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_ID, "ID_IPV6_ADDR_RANGE", "ID_DER_ASN1_DN", "ID_DER_ASN1_GN", - "ID_KEY_ID"); -ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_DER_ASN1_GN_URI, ID_KEY_ID, + "ID_KEY_ID", + "ID_KEY_Q_NAME"); +ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_DER_ASN1_GN_URI, ID_KEY_Q_NAME, "ID_DER_ASN1_GN_URI"); ENUM_END(id_type_names, ID_DER_ASN1_GN_URI); @@ -1281,6 +1283,10 @@ int identification_printf_hook(printf_hook_data_t *data, case ID_DER_ASN1_GN: snprintf(buf, BUF_LEN, "(ASN.1 general name)"); break; + case ID_KEY_Q_NAME: + snprintf(buf, sizeof(buf), "%.*s", (int)this->encoded.len, + this->encoded.ptr); + break; case ID_KEY_ID: if (chunk_printable(this->encoded, NULL, '?') && this->encoded.len != HASH_SIZE_SHA1) @@ -1353,6 +1359,7 @@ static private_identification_t *identification_create(id_type_t type) break; case ID_FQDN: case ID_RFC822_ADDR: + case ID_KEY_Q_NAME: this->public.hash = _hash_binary; this->public.equals = _equals_strcasecmp; this->public.matches = _matches_string; @@ -1416,6 +1423,7 @@ static private_identification_t* create_from_string_with_prefix_type(char *str) { "asn1gn:", ID_DER_ASN1_GN }, { "xmppaddr:", ID_DER_ASN1_GN }, { "keyid:", ID_KEY_ID }, + { "0x", ID_KEY_Q_NAME }, }; private_identification_t *this; int i; diff --git a/src/libstrongswan/utils/identification.h b/src/libstrongswan/utils/identification.h index 704df7842..b2d57ccd7 100644 --- a/src/libstrongswan/utils/identification.h +++ b/src/libstrongswan/utils/identification.h @@ -3,6 +3,7 @@ * Copyright (C) 2005-2009 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2019-2020 Marvell * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -125,6 +126,12 @@ enum id_type_t { */ ID_KEY_ID = 11, + /** + * ID data is a qualifier name string. + * The string MUST NOT contain any terminators. + */ + ID_KEY_Q_NAME = 12, + /** * Private ID type which represents a GeneralName of type URI */ -- 2.29.2
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
