diff --git a/Source/charon/config/configuration_manager.c b/Source/charon/config/configuration_manager.c index 7179e5555..d7191b89f 100644 --- a/Source/charon/config/configuration_manager.c +++ b/Source/charon/config/configuration_manager.c @@ -312,23 +312,15 @@ static void load_default_config (private_configuration_manager_t *this) 30000); /* traffic selectors alice */ - ts = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "10.1.0.0", 0, "10.1.255.255", 65535); + ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE, "10.1.0.0", 0, "10.1.255.255", 65535); sa_config_a->add_my_traffic_selector(sa_config_a,ts); - ts = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "10.2.0.0", 0, "10.2.255.255", 65535); - sa_config_a->add_other_traffic_selector(sa_config_a,ts); - ts = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "10.1.0.0", 0, "10.1.255.255", 65535); - sa_config_a->add_my_traffic_selector(sa_config_a,ts); - ts = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "10.2.0.1", 22, "10.2.0.1", 22); + ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE, "10.2.0.0", 0, "10.2.255.255", 65535); sa_config_a->add_other_traffic_selector(sa_config_a,ts); /* traffic selectors bob */ - ts = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "10.2.0.0", 0, "10.2.255.255", 65535); + ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE, "10.2.0.0", 0, "10.2.255.255", 65535); sa_config_b->add_my_traffic_selector(sa_config_b,ts); - ts = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "10.1.0.0", 0, "10.1.255.255", 65535); - sa_config_b->add_other_traffic_selector(sa_config_b,ts); - ts = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "10.2.0.0", 0, "10.2.255.255", 65535); - sa_config_b->add_my_traffic_selector(sa_config_b,ts); - ts = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "10.1.0.0", 0, "10.1.255.255", 65535); + ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE, "10.1.0.0", 0, "10.1.255.255", 65535); sa_config_b->add_other_traffic_selector(sa_config_b,ts); /* child proposal for alice */ @@ -369,8 +361,8 @@ static void load_default_config (private_configuration_manager_t *this) - this->add_new_configuration(this,"bob",init_config_a,sa_config_a); - this->add_new_configuration(this,"alice",init_config_b,sa_config_b); + this->add_new_configuration(this,"sun",init_config_a,sa_config_a); + this->add_new_configuration(this,"moon",init_config_b,sa_config_b); //this->add_new_preshared_secret(this,ID_IPV4_ADDR, "192.168.1.2","verschluesselt"); diff --git a/Source/charon/sa/child_sa.c b/Source/charon/sa/child_sa.c index faadf27ce..adf4c62dd 100644 --- a/Source/charon/sa/child_sa.c +++ b/Source/charon/sa/child_sa.c @@ -550,7 +550,7 @@ static void destroy(private_child_sa_t *this) */ child_sa_t * child_sa_create(host_t *me, host_t* other) { - static u_int32_t reqid = 1; + static u_int32_t reqid = 0xc0000000; private_child_sa_t *this = allocator_alloc_thing(private_child_sa_t); /* public functions */ diff --git a/Source/charon/sa/child_sa.h b/Source/charon/sa/child_sa.h index bd48c603c..a43ed0674 100644 --- a/Source/charon/sa/child_sa.h +++ b/Source/charon/sa/child_sa.h @@ -47,6 +47,8 @@ typedef struct child_sa_t child_sa_t; * - B sends the updated proposal to A * - A calls child_sa_t.update to update the already allocated SPIs with the chosen proposal * + * Once SAs are set up, policies can be added using add_policies. + * * * @b Constructors: * - child_sa_create() diff --git a/Source/charon/testcases/sa_config_test.c b/Source/charon/testcases/sa_config_test.c index 162e39ec3..bb01618df 100644 --- a/Source/charon/testcases/sa_config_test.c +++ b/Source/charon/testcases/sa_config_test.c @@ -36,13 +36,12 @@ void test_sa_config(protected_tester_t *tester) { sa_config_t *sa_config; - traffic_selector_t *ts_policy[3], *ts_request[4], *ts_reference[3], **ts_result; +// traffic_selector_t *ts; +// linked_list_t *ts_stored, *ts_supplied, *ts_selected, *ts_expected; proposal_t *proposal1, *proposal2, *proposal3, *proposal_sel; linked_list_t *proposals_list; iterator_t *iterator; - size_t count; logger_t *logger; - ts_payload_t *ts_payload; logger = charon->logger_manager->create_logger(charon->logger_manager, TESTER, NULL); logger->disable_level(logger, FULL); @@ -128,119 +127,121 @@ void test_sa_config(protected_tester_t *tester) proposal1->destroy(proposal2); proposals_list->destroy(proposals_list); - /* - * test traffic selection getting and matching - * - */ - - /* define policies */ - - /* allow any tcp */ - ts_policy[0] = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535); - - /* allow udp on port 123 to ".122" */ - ts_policy[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123); - - /* allow udp on ports > 2000 in subnet ... */ - ts_policy[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 65535); - - - - /* define request and result */ - - /* udp on subnet:123, should be reduced to ".122" */ - ts_request[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 123, "152.96.193.255", 123); - ts_reference[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123); - - /* should be granted. */ - ts_request[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000); - ts_reference[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000); - - /* should be reduced to port 2000 - 3000. and range ".193.*" */ - ts_request[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.191.0", 1000, "152.96.194.255", 3000); - ts_reference[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 3000); - - /* icmp request, should be discarded */ - ts_request[3] = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535); - - sa_config->add_my_traffic_selector(sa_config, ts_policy[0]); - sa_config->add_my_traffic_selector(sa_config, ts_policy[1]); - sa_config->add_my_traffic_selector(sa_config, ts_policy[2]); - - count = sa_config->get_my_traffic_selectors(sa_config, &ts_result); - tester->assert_true(tester, (count == 3), "ts get count"); - ts_result[0]->destroy(ts_result[0]); - ts_result[0]->destroy(ts_result[1]); - ts_result[0]->destroy(ts_result[2]); - allocator_free(ts_result); - - count = sa_config->select_my_traffic_selectors(sa_config, &ts_request[0], 4, &ts_result); - tester->assert_true(tester, (count == 3), "ts select count"); - - - /* store and restore into ts payload, tricky tricky */ - ts_payload = ts_payload_create_from_traffic_selectors(TRUE, ts_result, count); - - /* destroy */ - ts_result[0]->destroy(ts_result[0]); - ts_result[0]->destroy(ts_result[1]); - ts_result[0]->destroy(ts_result[2]); - allocator_free(ts_result); - - /* get them again out of the payload */ - count = ts_payload->get_traffic_selectors(ts_payload, &ts_result); - ts_payload->destroy(ts_payload); - - - - int i; - for (i = 0; iget_from_address(ts_result[i]); - chunk_t fa_ref = ts_reference[i]->get_from_address(ts_reference[i]); - chunk_t ta_res = ts_result[i]->get_to_address(ts_result[i]); - chunk_t ta_ref = ts_reference[i]->get_to_address(ts_reference[i]); - u_int16_t fp_res = ts_result[i]->get_from_port(ts_result[i]); - u_int16_t fp_ref = ts_reference[i]->get_from_port(ts_reference[i]); - u_int16_t tp_res = ts_result[i]->get_to_port(ts_result[i]); - u_int16_t tp_ref = ts_reference[i]->get_to_port(ts_reference[i]); - - - logger->log_chunk(logger, RAW, "from address result", &fa_res); - logger->log_chunk(logger, RAW, "from address reference", &fa_ref); - logger->log_chunk(logger, RAW, "to address result", &ta_res); - logger->log_chunk(logger, RAW, "to address reference", &ta_ref); - tester->assert_true(tester, fa_res.len == fa_ref.len, "from address len"); - tester->assert_false(tester, memcmp(fa_res.ptr, fa_ref.ptr,fa_res.len), "from address value"); - tester->assert_true(tester, ta_res.len == ta_ref.len, "to address len"); - tester->assert_false(tester, memcmp(ta_res.ptr, ta_ref.ptr,ta_res.len), "to address value"); - - tester->assert_true(tester, fp_res == fp_ref, "from port"); - tester->assert_true(tester, tp_res == tp_ref, "to port"); - - allocator_free(fa_res.ptr); - allocator_free(fa_ref.ptr); - allocator_free(ta_res.ptr); - allocator_free(ta_ref.ptr); - } - - - /* destroy */ - ts_result[0]->destroy(ts_result[0]); - ts_result[0]->destroy(ts_result[1]); - ts_result[0]->destroy(ts_result[2]); - allocator_free(ts_result); - - ts_policy[0]->destroy(ts_policy[0]); - ts_policy[1]->destroy(ts_policy[1]); - ts_policy[2]->destroy(ts_policy[2]); - ts_request[0]->destroy(ts_request[0]); - ts_reference[0]->destroy(ts_reference[0]); - ts_request[1]->destroy(ts_request[1]); - ts_reference[1]->destroy(ts_reference[1]); - ts_request[2]->destroy(ts_request[2]); - ts_reference[2]->destroy(ts_reference[2]); - ts_request[3]->destroy(ts_request[3]); +// /* +// * test traffic selection getting and matching +// * +// */ +// +// ts_stored = linked_list_create(); +// +// /* allow any tcp */ +// ts = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535); +// ts_stored->insert_last(ts_stored, (void*)ts); +// /* allow udp on port 123 to ".122" */ +// ts = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123); +// ts_stored->insert_last(ts_stored, (void*)ts); +// /* allow udp on ports > 2000 in subnet ... */ +// ts = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 65535); +// ts_stored->insert_last(ts_stored, (void*)ts); +// +// +// +// /* define request and result */ +// +// /* udp on subnet:123, should be reduced to ".122" */ +// ts = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 123, "152.96.193.255", 123); +// ts_supplied->insert_last(ts_supplied, (void*)ts); +// ts_reference[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123); +// +// /* should be granted. */ +// ts_request[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000); +// ts_reference[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000); +// +// /* should be reduced to port 2000 - 3000. and range ".193.*" */ +// ts_request[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.191.0", 1000, "152.96.194.255", 3000); +// ts_reference[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 3000); +// +// /* icmp request, should be discarded */ +// ts_request[3] = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535); +// +// sa_config->add_my_traffic_selector(sa_config, ts_policy[0]); +// sa_config->add_my_traffic_selector(sa_config, ts_policy[1]); +// sa_config->add_my_traffic_selector(sa_config, ts_policy[2]); +// +// count = sa_config->get_my_traffic_selectors(sa_config, &ts_result); +// tester->assert_true(tester, (count == 3), "ts get count"); +// ts_result[0]->destroy(ts_result[0]); +// ts_result[0]->destroy(ts_result[1]); +// ts_result[0]->destroy(ts_result[2]); +// allocator_free(ts_result); +// +// count = sa_config->select_my_traffic_selectors(sa_config, &ts_request[0], 4, &ts_result); +// tester->assert_true(tester, (count == 3), "ts select count"); +// +// +// /* store and restore into ts payload, tricky tricky */ +// ts_payload = ts_payload_create_from_traffic_selectors(TRUE, ts_result, count); +// +// /* destroy */ +// ts_result[0]->destroy(ts_result[0]); +// ts_result[0]->destroy(ts_result[1]); +// ts_result[0]->destroy(ts_result[2]); +// allocator_free(ts_result); +// +// /* get them again out of the payload */ +// count = ts_payload->get_traffic_selectors(ts_payload, &ts_result); +// ts_payload->destroy(ts_payload); +// +// +// +// int i; +// for (i = 0; iget_from_address(ts_result[i]); +// chunk_t fa_ref = ts_reference[i]->get_from_address(ts_reference[i]); +// chunk_t ta_res = ts_result[i]->get_to_address(ts_result[i]); +// chunk_t ta_ref = ts_reference[i]->get_to_address(ts_reference[i]); +// u_int16_t fp_res = ts_result[i]->get_from_port(ts_result[i]); +// u_int16_t fp_ref = ts_reference[i]->get_from_port(ts_reference[i]); +// u_int16_t tp_res = ts_result[i]->get_to_port(ts_result[i]); +// u_int16_t tp_ref = ts_reference[i]->get_to_port(ts_reference[i]); +// +// +// logger->log_chunk(logger, RAW, "from address result", &fa_res); +// logger->log_chunk(logger, RAW, "from address reference", &fa_ref); +// logger->log_chunk(logger, RAW, "to address result", &ta_res); +// logger->log_chunk(logger, RAW, "to address reference", &ta_ref); +// tester->assert_true(tester, fa_res.len == fa_ref.len, "from address len"); +// tester->assert_false(tester, memcmp(fa_res.ptr, fa_ref.ptr,fa_res.len), "from address value"); +// tester->assert_true(tester, ta_res.len == ta_ref.len, "to address len"); +// tester->assert_false(tester, memcmp(ta_res.ptr, ta_ref.ptr,ta_res.len), "to address value"); +// +// tester->assert_true(tester, fp_res == fp_ref, "from port"); +// tester->assert_true(tester, tp_res == tp_ref, "to port"); +// +// allocator_free(fa_res.ptr); +// allocator_free(fa_ref.ptr); +// allocator_free(ta_res.ptr); +// allocator_free(ta_ref.ptr); +// } +// +// +// /* destroy */ +// ts_result[0]->destroy(ts_result[0]); +// ts_result[0]->destroy(ts_result[1]); +// ts_result[0]->destroy(ts_result[2]); +// allocator_free(ts_result); +// +// ts_policy[0]->destroy(ts_policy[0]); +// ts_policy[1]->destroy(ts_policy[1]); +// ts_policy[2]->destroy(ts_policy[2]); +// ts_request[0]->destroy(ts_request[0]); +// ts_reference[0]->destroy(ts_reference[0]); +// ts_request[1]->destroy(ts_request[1]); +// ts_reference[1]->destroy(ts_reference[1]); +// ts_request[2]->destroy(ts_request[2]); +// ts_reference[2]->destroy(ts_reference[2]); +// ts_request[3]->destroy(ts_request[3]); sa_config->destroy(sa_config); } diff --git a/Source/charon/threads/kernel_interface.c b/Source/charon/threads/kernel_interface.c index 8ff1affbd..7b0c163ce 100644 --- a/Source/charon/threads/kernel_interface.c +++ b/Source/charon/threads/kernel_interface.c @@ -44,28 +44,34 @@ #define SPD_PRIORITY 1024 +#define XFRM_DATA_LENGTH 512 + typedef struct xfrm_data_t xfrm_data_t; /** * Lenght/Type/data struct for userdata in xfrm + * We dont use the "I-don't-know-where-they-come-from"-structs + * used in the kernel. */ struct xfrm_data_t { /** * length of the data */ u_int16_t length; + /** * type of data */ u_int16_t type; + /** * and the data itself, for different purposes */ union { - /* algorithm */ + /** algorithm */ struct xfrm_algo algo; - /* policy tmpl */ + /** policy tmpl */ struct xfrm_user_tmpl tmpl[2]; }; }; @@ -84,20 +90,20 @@ struct netlink_message_t { struct nlmsghdr hdr; union { - /* error message */ + /** error message */ struct nlmsgerr e; - /* message for spi allocation */ + /** message for spi allocation */ struct xfrm_userspi_info spi; - /* message for SA manipulation */ + /** message for SA manipulation */ struct xfrm_usersa_id sa_id; - /* message for SA installation */ + /** message for SA installation */ struct xfrm_usersa_info sa; - /* message for policy manipulation */ + /** message for policy manipulation */ struct xfrm_userpolicy_id policy_id; - /* message for policy installation */ + /** message for policy installation */ struct xfrm_userpolicy_info policy; }; - u_int8_t data[512]; + u_int8_t data[XFRM_DATA_LENGTH]; }; @@ -155,6 +161,12 @@ struct private_kernel_interface_t { status_t (*send_message) (private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response); }; +/** + * In the kernel, algorithms are identified as strings, we use our + * mapping functions... + * Algorithms for encryption. + * TODO: Add missing algorithm strings + */ mapping_t kernel_encryption_algs_m[] = { {ENCR_DES_IV64, ""}, {ENCR_DES, "des"}, @@ -170,7 +182,12 @@ mapping_t kernel_encryption_algs_m[] = { {ENCR_AES_CTR, ""}, {MAPPING_END, NULL} }; - +/** + * In the kernel, algorithms are identified as strings, we use our + * mapping functions... + * Algorithms for integrity protection. + * TODO: Add missing algorithm strings + */ mapping_t kernel_integrity_algs_m[] = { {AUTH_HMAC_MD5_96, "md5"}, {AUTH_HMAC_SHA1_96, "sha1"}, @@ -180,7 +197,9 @@ mapping_t kernel_integrity_algs_m[] = { {MAPPING_END, NULL} }; - +/** + * Implementation of kernel_interface_t.get_spi. + */ static status_t get_spi(private_kernel_interface_t *this, host_t *src, host_t *dest, protocol_id_t protocol, u_int32_t reqid, @@ -199,8 +218,8 @@ static status_t get_spi(private_kernel_interface_t *this, request.spi.info.reqid = reqid; request.spi.info.id.proto = (protocol == ESP) ? KERNEL_ESP : KERNEL_AH; request.spi.info.family = PF_INET; - request.spi.min = 100; - request.spi.max = 200; + request.spi.min = 0xc0000000; + request.spi.max = 0xcFFFFFFF; if (this->send_message(this, &request, &response) != SUCCESS) { @@ -225,6 +244,9 @@ static status_t get_spi(private_kernel_interface_t *this, return status; } +/** + * Implementation of kernel_interface_t.add_sa. + */ static status_t add_sa( private_kernel_interface_t *this, host_t *me, host_t *other, @@ -267,11 +289,13 @@ static status_t add_sa( private_kernel_interface_t *this, data->type = XFRMA_ALG_CRYPT; data->length = 4 + sizeof(data->algo) + encryption_key.len; data->algo.alg_key_len = encryption_key.len * 8; - + request.hdr.nlmsg_len += data->length; + if (request.hdr.nlmsg_len > sizeof(request)) + { + return FAILED; + } strcpy(data->algo.alg_name, mapping_find(kernel_encryption_algs_m, enc_alg)); memcpy(data->algo.alg_key, encryption_key.ptr, encryption_key.len); - - request.hdr.nlmsg_len += data->length; } if (int_alg != AUTH_UNDEFINED) @@ -281,13 +305,16 @@ static status_t add_sa( private_kernel_interface_t *this, data->type = XFRMA_ALG_AUTH; data->length = 4 + sizeof(data->algo) + integrity_key.len; data->algo.alg_key_len = integrity_key.len * 8; + request.hdr.nlmsg_len += data->length; + if (request.hdr.nlmsg_len > sizeof(request)) + { + return FAILED; + } strcpy(data->algo.alg_name, mapping_find(kernel_integrity_algs_m, int_alg)); memcpy(data->algo.alg_key, integrity_key.ptr, integrity_key.len); - - request.hdr.nlmsg_len += data->length; } - /* add IPComp here*/ + /* TODO: add IPComp here*/ if (this->send_message(this, &request, &response) != SUCCESS) { @@ -343,6 +370,9 @@ static status_t del_sa( private_kernel_interface_t *this, return SUCCESS; } +/** + * Implementation of kernel_interface_t.add_policy. + */ static status_t add_policy(private_kernel_interface_t *this, host_t *me, host_t *other, host_t *src, host_t *dst, @@ -432,6 +462,9 @@ static status_t add_policy(private_kernel_interface_t *this, return status; } +/** + * Implementation of kernel_interface_t.del_policy. + */ static status_t del_policy(private_kernel_interface_t *this, host_t *me, host_t *other, host_t *src, host_t *dst, @@ -477,7 +510,9 @@ static status_t del_policy(private_kernel_interface_t *this, return status; } - +/** + * Implementation of private_kernel_interface_t.send_message. + */ static status_t send_message(private_kernel_interface_t *this, netlink_message_t *request, netlink_message_t **response) { size_t length; @@ -528,7 +563,7 @@ static status_t send_message(private_kernel_interface_t *this, netlink_message_t { break; } - /* we should time out, if something goes wrong */ + /* TODO: we should time out, if something goes wrong!??? */ pthread_cond_wait(&(this->condvar), &(this->mutex)); } @@ -537,7 +572,9 @@ static status_t send_message(private_kernel_interface_t *this, netlink_message_t return SUCCESS; } - +/** + * Implementation of private_kernel_interface_t.receive_messages. + */ static void receive_messages(private_kernel_interface_t *this) { while(TRUE) @@ -599,8 +636,6 @@ static void receive_messages(private_kernel_interface_t *this) } } - - /** * Implementation of kernel_interface_t.destroy. */ @@ -613,8 +648,6 @@ static void destroy(private_kernel_interface_t *this) allocator_free(this); } -#define ASSIGN(member, function) member = (void*)function - /* * Described in header. */ @@ -626,8 +659,8 @@ kernel_interface_t *kernel_interface_create() this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi; this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,encryption_algorithm_t,chunk_t,integrity_algorithm_t,chunk_t,bool))add_sa; this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*, host_t*,host_t*,host_t*,u_int8_t,u_int8_t,int,int,bool,bool,u_int32_t))add_policy; - ASSIGN(this->public.del_sa, del_sa); - ASSIGN(this->public.del_policy, del_policy); + this->public.del_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t))del_sa; + this->public.del_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,host_t*,host_t*,u_int8_t,u_int8_t,int,int))del_policy; this->public.destroy = (void(*)(kernel_interface_t*)) destroy; @@ -653,10 +686,6 @@ kernel_interface_t *kernel_interface_create() charon->kill(charon, "Unable to create netlink thread"); } - //host_t *all = host_create(AF_INET, "0.0.0.0", 500); - //add_policy(this, all, all, all, all, 0, 0, XFRM_POLICY_OUT, 17, FALSE, FALSE, 0); - - charon->logger_manager->enable_logger_level(charon->logger_manager, TESTER, FULL); return (&this->public); } diff --git a/Source/charon/threads/kernel_interface.h b/Source/charon/threads/kernel_interface.h index 7c2a27147..f7621afd9 100644 --- a/Source/charon/threads/kernel_interface.h +++ b/Source/charon/threads/kernel_interface.h @@ -33,6 +33,10 @@ typedef struct kernel_interface_t kernel_interface_t; /** * @brief Interface to the kernel. * + * The kernel interface handles the communication with the kernel + * for SA and policy management. It allows setup of these, and provides + * further the handling of kernel events. + * * @b Constructors: * - kernel_interface_create() * @@ -41,22 +45,47 @@ typedef struct kernel_interface_t kernel_interface_t; struct kernel_interface_t { /** - * @brief Get a SPI from the kernel + * @brief Get a SPI from the kernel. * - * @todo Fix spi range + * @param this calling object + * @param src source address of SA + * @param dst destination address of SA + * @param protocol protocol for SA (ESP/AH) + * @param reqid unique ID for this SA + * @param[out] spi allocated spi + * @return + * - SUCCESS + * - FAILED if kernel comm failed */ status_t (*get_spi) (kernel_interface_t *this, - host_t *src, host_t *dest, + host_t *src, host_t *dst, protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi); /** - * @brief Create an SA. + * @brief Add an SA to the SAD. * - * @todo Fix reqid and replay_window params + * add_sa() may update an already allocated + * SPI (via get_spi). In this case, the replace + * flag must be set. + * This function does install a single SA for a + * single protocol in one direction. * - * @todo Cleanup method params + * @param this calling object + * @param src source address for this SA + * @param dst destination address for this SA + * @param spi SPI allocated by us or remote peer + * @param protocol protocol for this SA (ESP/AH) + * @param reqid unique ID for this SA + * @param enc_alg Algorithm to use for encryption (ESP only) + * @param enc_key Key to use for encryption + * @param int_alg Algorithm to use for integrity protection + * @param int_key Key for integrity protection + * @param replace Should an already installed SA be updated? + * @return + * - SUCCESS + * - FAILED if kernel comm failed */ status_t (*add_sa)(kernel_interface_t *this, host_t *src, host_t *dst, @@ -64,16 +93,50 @@ struct kernel_interface_t { protocol_id_t protocol, u_int32_t reqid, encryption_algorithm_t enc_alg, - chunk_t encryption_key, + chunk_t enc_key, integrity_algorithm_t int_alg, - chunk_t integrity_key, + chunk_t int_key, bool replace); - + /** + * @brief Delete a previusly installed SA from the SAD. + * + * @param this calling object + * @param dst destination address for this SA + * @param spi SPI allocated by us or remote peer + * @param protocol protocol for this SA (ESP/AH) + * @return + * - SUCCESS + * - FAILED if kernel comm failed + */ status_t (*del_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi, protocol_id_t protocol); + /** + * @brief Add a policy to the SPD. + * + * A policy is always associated to an SA, so + * traffic applied to a policy. Traffic which + * matches a policy is handled by the SA with the same + * reqid. + * + * @param this calling object + * @param me address of local peer + * @param other address of remote peer + * @param src src address of traffic this policy applies + * @param dst dest address of traffic this policy applies + * @param src_hostbits subnetmask to use for src address + * @param dst_hostbits subnetmask to use for dst address + * @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD + * @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...) + * @param ah protect traffic with AH? + * @param esp protect traffic with ESP? + * @param reqid uniqe ID of an SA to use to enforce policy + * @return + * - SUCCESS + * - FAILED if kernel comm failed + */ status_t (*add_policy) (kernel_interface_t *this, host_t *me, host_t *other, host_t *src, host_t *dst, @@ -82,6 +145,22 @@ struct kernel_interface_t { bool ah, bool esp, u_int32_t reqid); + /** + * @brief Remove a policy from the SPD. + * + * @param this calling object + * @param me address of local peer + * @param other address of remote peer + * @param src src address of traffic this policy applies + * @param dst dest address of traffic this policy applies + * @param src_hostbits subnetmask to use for src address + * @param dst_hostbits subnetmask to use for dst address + * @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD + * @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...) + * @return + * - SUCCESS + * - FAILED if kernel comm failed + */ status_t (*del_policy) (kernel_interface_t *this, host_t *me, host_t *other, host_t *src, host_t *dst,