238 lines
8.2 KiB
C++
238 lines
8.2 KiB
C++
/*
|
|
* Copyright (C) 2017 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
#ifndef _XFRM_CONTROLLER_H
|
|
#define _XFRM_CONTROLLER_H
|
|
|
|
#include <atomic>
|
|
#include <list>
|
|
#include <map>
|
|
#include <string>
|
|
#include <utility> // for pair
|
|
|
|
#include <linux/netlink.h>
|
|
#include <linux/udp.h>
|
|
#include <linux/xfrm.h>
|
|
#include <sysutils/SocketClient.h>
|
|
#include <utils/RWLock.h>
|
|
|
|
#include "NetdConstants.h"
|
|
|
|
namespace android {
|
|
namespace net {
|
|
|
|
// Suggest we avoid the smallest and largest ints
|
|
class XfrmMessage;
|
|
class TransportModeSecurityAssociation;
|
|
|
|
class XfrmSocket {
|
|
public:
|
|
virtual void close() {
|
|
if (mSock >= 0) {
|
|
::close(mSock);
|
|
}
|
|
mSock = -1;
|
|
}
|
|
|
|
virtual bool open() = 0;
|
|
|
|
virtual ~XfrmSocket() { close(); }
|
|
|
|
virtual int sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, uint16_t nlMsgSeqNum,
|
|
iovec* iov, int iovLen) const = 0;
|
|
|
|
protected:
|
|
int mSock;
|
|
};
|
|
|
|
enum struct XfrmDirection : uint8_t {
|
|
IN = XFRM_POLICY_IN,
|
|
OUT = XFRM_POLICY_OUT,
|
|
FORWARD = XFRM_POLICY_FWD,
|
|
MASK = XFRM_POLICY_MASK,
|
|
};
|
|
|
|
enum struct XfrmMode : uint8_t {
|
|
TRANSPORT = XFRM_MODE_TRANSPORT,
|
|
TUNNEL = XFRM_MODE_TUNNEL,
|
|
};
|
|
|
|
enum struct XfrmEncapType : uint16_t {
|
|
NONE = 0,
|
|
ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE,
|
|
ESPINUDP = UDP_ENCAP_ESPINUDP
|
|
};
|
|
|
|
struct XfrmAlgo {
|
|
std::string name;
|
|
std::vector<uint8_t> key;
|
|
uint16_t truncLenBits;
|
|
};
|
|
|
|
struct XfrmEncap {
|
|
XfrmEncapType type;
|
|
uint16_t srcPort;
|
|
uint16_t dstPort;
|
|
};
|
|
|
|
struct XfrmSaId {
|
|
XfrmDirection direction;
|
|
xfrm_address_t dstAddr; // network order
|
|
xfrm_address_t srcAddr;
|
|
int addrFamily; // AF_INET or AF_INET6
|
|
int transformId; // requestId
|
|
int spi;
|
|
};
|
|
|
|
struct XfrmSaInfo : XfrmSaId {
|
|
XfrmAlgo auth;
|
|
XfrmAlgo crypt;
|
|
int netId;
|
|
XfrmMode mode;
|
|
XfrmEncap encap;
|
|
};
|
|
|
|
class XfrmController {
|
|
public:
|
|
XfrmController();
|
|
|
|
int ipSecAllocateSpi(int32_t transformId, int32_t direction, const std::string& localAddress,
|
|
const std::string& remoteAddress, int32_t inSpi, int32_t* outSpi);
|
|
|
|
int ipSecAddSecurityAssociation(
|
|
int32_t transformId, int32_t mode, int32_t direction, const std::string& localAddress,
|
|
const std::string& remoteAddress, int64_t underlyingNetworkHandle, int32_t spi,
|
|
const std::string& authAlgo, const std::vector<uint8_t>& authKey, int32_t authTruncBits,
|
|
const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, int32_t cryptTruncBits,
|
|
int32_t encapType, int32_t encapLocalPort, int32_t encapRemotePort);
|
|
|
|
int ipSecDeleteSecurityAssociation(int32_t transformId, int32_t direction,
|
|
const std::string& localAddress,
|
|
const std::string& remoteAddress, int32_t spi);
|
|
|
|
int ipSecApplyTransportModeTransform(const android::base::unique_fd& socket,
|
|
int32_t transformId, int32_t direction,
|
|
const std::string& localAddress,
|
|
const std::string& remoteAddress, int32_t spi);
|
|
|
|
int ipSecRemoveTransportModeTransform(const android::base::unique_fd& socket);
|
|
|
|
private:
|
|
// prevent concurrent modification of XFRM
|
|
android::RWLock mLock;
|
|
|
|
static constexpr size_t MAX_ALGO_LENGTH = 128;
|
|
|
|
/*
|
|
* Below is a redefinition of the xfrm_usersa_info struct that is part
|
|
* of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit
|
|
* boundary.
|
|
*/
|
|
#ifdef NETLINK_COMPAT32
|
|
// Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version
|
|
struct xfrm_usersa_info : ::xfrm_usersa_info {
|
|
} __attribute__((aligned(8)));
|
|
// Shadow the kernel's version, using the aligned version of xfrm_usersa_info
|
|
struct xfrm_userspi_info {
|
|
struct xfrm_usersa_info info;
|
|
__u32 min;
|
|
__u32 max;
|
|
};
|
|
|
|
/*
|
|
* Anyone who encounters a failure when sending netlink messages should look here
|
|
* first. Hitting the static_assert() below should be a strong hint that Android
|
|
* IPsec will probably not work with your current settings.
|
|
*
|
|
* Again, experimentally determined, the "flags" field should be the first byte in
|
|
* the final word of the xfrm_usersa_info struct. The check validates the size of
|
|
* the padding to be 7.
|
|
*
|
|
* This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace.
|
|
*/
|
|
static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, "struct xfrm_usersa_info has changed "
|
|
"alignment. Please consider whether this "
|
|
"patch is needed.");
|
|
static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8,
|
|
"struct xfrm_usersa_info probably misaligned with kernel struct.");
|
|
static_assert(sizeof(xfrm_usersa_info) % 8 == 0, "struct xfrm_usersa_info_t is not 64-bit "
|
|
"aligned. Please consider whether this patch "
|
|
"is needed.");
|
|
static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) ==
|
|
sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info),
|
|
"struct xfrm_userspi_info has changed and does not match the kernel struct.");
|
|
#endif
|
|
|
|
struct nlattr_algo_crypt {
|
|
nlattr hdr;
|
|
xfrm_algo crypt;
|
|
uint8_t key[MAX_ALGO_LENGTH];
|
|
};
|
|
|
|
struct nlattr_algo_auth {
|
|
nlattr hdr;
|
|
xfrm_algo_auth auth;
|
|
uint8_t key[MAX_ALGO_LENGTH];
|
|
};
|
|
|
|
struct nlattr_user_tmpl {
|
|
nlattr hdr;
|
|
xfrm_user_tmpl tmpl;
|
|
};
|
|
|
|
struct nlattr_encap_tmpl {
|
|
nlattr hdr;
|
|
xfrm_encap_tmpl tmpl;
|
|
};
|
|
|
|
|
|
// helper function for filling in the XfrmSaInfo structure
|
|
static int fillXfrmSaId(int32_t direction, const std::string& localAddress,
|
|
const std::string& remoteAddress, int32_t spi, XfrmSaId* xfrmId);
|
|
|
|
// Top level functions for managing a Transport Mode Transform
|
|
static int addTransportModeTransform(const XfrmSaInfo& record);
|
|
static int removeTransportModeTransform(const XfrmSaInfo& record);
|
|
|
|
// TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE
|
|
// Shared between SA and SP
|
|
static void fillTransportModeSelector(const XfrmSaInfo& record, xfrm_selector* selector);
|
|
|
|
// Shared between Transport and Tunnel Mode
|
|
static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo);
|
|
static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo);
|
|
static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl);
|
|
|
|
// Functions for Creating a Transport Mode SA
|
|
static int createTransportModeSecurityAssociation(const XfrmSaInfo& record,
|
|
const XfrmSocket& sock);
|
|
static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa);
|
|
|
|
// Functions for deleting a Transport Mode SA
|
|
static int deleteSecurityAssociation(const XfrmSaId& record, const XfrmSocket& sock);
|
|
static int fillUserSaId(const XfrmSaId& record, xfrm_usersa_id* said);
|
|
static int fillUserTemplate(const XfrmSaInfo& record, xfrm_user_tmpl* tmpl);
|
|
static int fillTransportModeUserSpInfo(const XfrmSaInfo& record, xfrm_userpolicy_info* usersp);
|
|
|
|
static int allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi,
|
|
uint32_t* outSpi, const XfrmSocket& sock);
|
|
|
|
// END TODO(messagerefactor)
|
|
};
|
|
|
|
} // namespace net
|
|
} // namespace android
|
|
|
|
#endif /* !defined(XFRM_CONTROLLER_H) */
|