summaryrefslogtreecommitdiff
path: root/src/charon/sa/child_sa.h
blob: 216e56659e2bd89c2c6c4fabd37c44ff522714a0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
/**
 * @file child_sa.h
 *
 * @brief Interface of child_sa_t.
 *
 */

/*
 * Copyright (C) 2006-2007 Martin Willi
 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */


#ifndef CHILD_SA_H_
#define CHILD_SA_H_

typedef enum child_sa_state_t child_sa_state_t;
typedef struct child_sa_t child_sa_t;

#include <library.h>
#include <crypto/prf_plus.h>
#include <encoding/payloads/proposal_substructure.h>
#include <config/proposal.h>
#include <config/policies/policy.h>

/**
 * Where we should start with reqid enumeration
 */
#define REQID_START 2000000000

/**
 * @brief States of a CHILD_SA
 */
enum child_sa_state_t {
	
	/**
	 * Just created, uninstalled CHILD_SA
	 */
	CHILD_CREATED,
	
	/**
	 * Installed SPD, but no SAD entries
	 */
	CHILD_ROUTED,
	
	/**
	 * Installed an in-use CHILD_SA
	 */
	CHILD_INSTALLED,
	
	/**
	 * CHILD_SA which is rekeying
	 */
	CHILD_REKEYING,
	
	/**
	 * CHILD_SA in progress of delete
	 */
	CHILD_DELETING,
};

/**
 * enum strings for child_sa_state_t.
 */
extern enum_name_t *child_sa_state_names;

/**
 * @brief Represents an IPsec SAs between two hosts.
 * 
 * A child_sa_t contains two SAs. SAs for both
 * directions are managed in one child_sa_t object. Both
 * SAs and the policies have the same reqid.
 * 
 * The procedure for child sa setup is as follows:
 * - A gets SPIs for a proposal via child_sa_t.alloc
 * - A send the updated proposal to B
 * - B selects a suitable proposal
 * - B calls child_sa_t.add to add and update the selected proposal
 * - B sends the updated proposal to A
 * - A calls child_sa_t.update to update the already allocated SPIs with the chosen proposal
 * 
 * Once SAs are set up, policies can be added using add_policies.
 * 
 * 
 * @b Constructors:
 *  - child_sa_create()
 * 
 * @ingroup sa
 */
struct child_sa_t {
	
	/**
	 * @brief Get the name of the policy this CHILD_SA uses.
	 *
	 * @param this			calling object
	 * @return				name
	 */
	char* (*get_name) (child_sa_t *this);
	
	/**
	 * @brief Get the reqid of the CHILD SA.
	 * 
	 * Every CHILD_SA has a reqid. The kernel uses this ID to
	 * identify it.
	 *
	 * @param this 		calling object
	 * @return 			reqid of the CHILD SA
	 */
	u_int32_t (*get_reqid)(child_sa_t *this);
	
	/**
	 * @brief Get the SPI of this CHILD_SA.
	 * 
	 * Set the boolean parameter inbound to TRUE to
	 * get the SPI for which we receive packets, use
	 * FALSE to get those we use for sending packets.
	 *
	 * @param this 		calling object
	 * @param inbound	TRUE to get inbound SPI, FALSE for outbound.
	 * @return 			spi of the CHILD SA
	 */
	u_int32_t (*get_spi) (child_sa_t *this, bool inbound);
	
	/**
	 * @brief Get the protocol which this CHILD_SA uses to protect traffic.
	 *
	 * @param this 		calling object
	 * @return 			AH | ESP
	 */
	protocol_id_t (*get_protocol) (child_sa_t *this);
	
	/**
	 * @brief Allocate SPIs for given proposals.
	 * 
	 * Since the kernel manages SPIs for us, we need
	 * to allocate them. If a proposal contains more
	 * than one protocol, for each protocol an SPI is
	 * allocated. SPIs are stored internally and written
	 * back to the proposal.
	 *
	 * @param this 		calling object
	 * @param proposals	list of proposals for which SPIs are allocated
	 */
	status_t (*alloc)(child_sa_t *this, linked_list_t* proposals);
	
	/**
	 * @brief Install the kernel SAs for a proposal, without previous SPI allocation.
	 *
	 * @param this 		calling object
	 * @param proposal	proposal for which SPIs are allocated
	 * @param mode		mode for the CHILD_SA
	 * @param prf_plus	key material to use for key derivation
	 * @return			SUCCESS or FAILED
	 */
	status_t (*add)(child_sa_t *this, proposal_t *proposal, mode_t mode,
					prf_plus_t *prf_plus);
	
	/**
	 * @brief Install the kernel SAs for a proposal, after SPIs have been allocated.
	 *
	 * Updates an SA, for which SPIs are already allocated via alloc().
	 *
	 * @param this 		calling object
	 * @param proposal	proposal for which SPIs are allocated
	 * @param mode		mode for the CHILD_SA
	 * @param prf_plus	key material to use for key derivation
	 * @return			SUCCESS or FAILED
	 */
	status_t (*update)(child_sa_t *this, proposal_t *proposal, mode_t mode,
					   prf_plus_t *prf_plus);

	/**
	 * @brief Update the hosts in the kernel SAs and policies
	 *
	 * @warning only call this after update() has been called.
	 *
	 * @param this			calling object
	 * @param new_me		the new local host
	 * @param new_other		the new remote host
	 * @param my_diff		differences to apply for me
	 * @param other_diff	differences to apply for other
	 * @return				SUCCESS or FAILED
	 */
	status_t (*update_hosts)(child_sa_t *this, host_t *new_me, host_t *new_other,
							 host_diff_t my_diff, host_diff_t other_diff);
	
	/**
	 * @brief Install the policies using some traffic selectors.
	 *
	 * Supplied lists of traffic_selector_t's specify the policies
	 * to use for this child sa.
	 *
	 * @param this 		calling object
	 * @param my_ts		traffic selectors for local site
	 * @param other_ts	traffic selectors for remote site
	 * @param mode		mode for the SA: tunnel/transport
	 * @return			SUCCESS or FAILED
	 */	
	status_t (*add_policies)(child_sa_t *this, linked_list_t *my_ts_list,
							 linked_list_t *other_ts_list, mode_t mode);
	
	/**
	 * @brief Get the traffic selectors of added policies of local host.
	 *
	 * @param this 		calling object
	 * @return			list of traffic selectors
	 */	
	linked_list_t* (*get_my_traffic_selectors) (child_sa_t *this);
	
	/**
	 * @brief Get the traffic selectors of added policies of remote host.
	 *
	 * @param this 		calling object
	 * @return			list of traffic selectors
	 */	
	linked_list_t* (*get_other_traffic_selectors) (child_sa_t *this);
	
	/**
	 * @brief Get the time of this child_sa_t's last use (i.e. last use of any of its policies)
	 * 
	 * @param this 		calling object
	 * @param inbound	query for in- or outbound usage
	 * @param use_time	the time
	 * @return			SUCCESS or FAILED
	 */	
	status_t (*get_use_time) (child_sa_t *this, bool inbound, time_t *use_time);
	
	/**
	 * @brief Get the state of the CHILD_SA.
	 *
	 * @param this 		calling object
	 */	
	child_sa_state_t (*get_state) (child_sa_t *this);
	
	/**
	 * @brief Set the state of the CHILD_SA.
	 *
	 * @param this 		calling object
	 */	
	void (*set_state) (child_sa_t *this, child_sa_state_t state);
	
	/**
	 * @brief Get the policy used to set up this child sa.
	 *
	 * @param this 		calling object
	 * @return			policy
	 */
	policy_t* (*get_policy) (child_sa_t *this);
	
	/**
	 * @brief Set the virtual IP used received from IRAS.
	 *
	 * To allow proper setup of firewall rules, the virtual IP is required
	 * for filtering.
	 *
	 * @param this 		calling object
	 * @param ip		own virtual IP
	 */
	void (*set_virtual_ip) (child_sa_t *this, host_t *ip);
	
	/**
	 * @brief Destroys a child_sa.
	 *
	 * @param this 		calling object
	 */
	void (*destroy) (child_sa_t *this);
};

/**
 * @brief Constructor to create a new child_sa_t.
 *
 * @param me			own address
 * @param other			remote address
 * @param my_id			id of own peer
 * @param other_id		id of remote peer
 * @param policy		policy this CHILD_SA instantiates
 * @param reqid			reqid of old CHILD_SA when rekeying, 0 otherwise
 * @param use_natt		TRUE if NAT traversal is used
 * @return				child_sa_t object
 * 
 * @ingroup sa
 */
child_sa_t * child_sa_create(host_t *me, host_t *other,
							 identification_t *my_id, identification_t* other_id,
							 policy_t *policy, u_int32_t reqid, bool use_natt);

#endif /*CHILD_SA_H_*/