blob: fdad82f94bd92693c2c7eba027fd800df4d706e6 [file] [log] [blame]
Nathan Harold1a371532017-01-30 12:30:48 -08001/*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef _XFRM_CONTROLLER_H
17#define _XFRM_CONTROLLER_H
18
19#include <atomic>
20#include <list>
21#include <map>
22#include <string>
23#include <utility> // for pair
24
25#include <linux/netlink.h>
Nathan Harold420ceac2017-04-05 19:36:59 -070026#include <linux/udp.h>
Nathan Harold1a371532017-01-30 12:30:48 -080027#include <linux/xfrm.h>
28#include <sysutils/SocketClient.h>
29#include <utils/RWLock.h>
30
31#include "NetdConstants.h"
32
33namespace android {
34namespace net {
35
Nathan Harold39b5df42017-08-02 18:45:25 -070036// Exposed for testing
37extern const uint32_t ALGO_MASK_AUTH_ALL;
38// Exposed for testing
39extern const uint32_t ALGO_MASK_CRYPT_ALL;
40// Exposed for testing
41extern const uint8_t REPLAY_WINDOW_SIZE;
42
Nathan Harold1a371532017-01-30 12:30:48 -080043// Suggest we avoid the smallest and largest ints
44class XfrmMessage;
45class TransportModeSecurityAssociation;
46
47class XfrmSocket {
48public:
49 virtual void close() {
Nathan Harold420ceac2017-04-05 19:36:59 -070050 if (mSock >= 0) {
Nathan Harold1a371532017-01-30 12:30:48 -080051 ::close(mSock);
52 }
53 mSock = -1;
54 }
55
56 virtual bool open() = 0;
57
58 virtual ~XfrmSocket() { close(); }
59
ludie51e3862017-08-15 19:28:12 -070060 // Sends the netlink message contained in iovecs. This populates iovecs[0] with
61 // a valid netlink message header.
Nathan Harold1a371532017-01-30 12:30:48 -080062 virtual int sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, uint16_t nlMsgSeqNum,
ludie51e3862017-08-15 19:28:12 -070063 std::vector<iovec>* iovecs) const = 0;
Nathan Harold1a371532017-01-30 12:30:48 -080064
65protected:
66 int mSock;
67};
68
69enum struct XfrmDirection : uint8_t {
70 IN = XFRM_POLICY_IN,
71 OUT = XFRM_POLICY_OUT,
72 FORWARD = XFRM_POLICY_FWD,
73 MASK = XFRM_POLICY_MASK,
74};
75
76enum struct XfrmMode : uint8_t {
77 TRANSPORT = XFRM_MODE_TRANSPORT,
78 TUNNEL = XFRM_MODE_TUNNEL,
79};
80
Nathan Harold420ceac2017-04-05 19:36:59 -070081enum struct XfrmEncapType : uint16_t {
82 NONE = 0,
83 ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE,
84 ESPINUDP = UDP_ENCAP_ESPINUDP
85};
86
Nathan Harold1a371532017-01-30 12:30:48 -080087struct XfrmAlgo {
88 std::string name;
89 std::vector<uint8_t> key;
90 uint16_t truncLenBits;
91};
92
Nathan Harold420ceac2017-04-05 19:36:59 -070093struct XfrmEncap {
94 XfrmEncapType type;
95 uint16_t srcPort;
96 uint16_t dstPort;
97};
98
Nathan Harold1a371532017-01-30 12:30:48 -080099struct XfrmSaId {
100 XfrmDirection direction;
101 xfrm_address_t dstAddr; // network order
102 xfrm_address_t srcAddr;
103 int addrFamily; // AF_INET or AF_INET6
104 int transformId; // requestId
105 int spi;
106};
107
108struct XfrmSaInfo : XfrmSaId {
109 XfrmAlgo auth;
110 XfrmAlgo crypt;
111 int netId;
112 XfrmMode mode;
Nathan Harold420ceac2017-04-05 19:36:59 -0700113 XfrmEncap encap;
Nathan Harold1a371532017-01-30 12:30:48 -0800114};
115
116class XfrmController {
117public:
118 XfrmController();
119
120 int ipSecAllocateSpi(int32_t transformId, int32_t direction, const std::string& localAddress,
121 const std::string& remoteAddress, int32_t inSpi, int32_t* outSpi);
122
123 int ipSecAddSecurityAssociation(
124 int32_t transformId, int32_t mode, int32_t direction, const std::string& localAddress,
125 const std::string& remoteAddress, int64_t underlyingNetworkHandle, int32_t spi,
126 const std::string& authAlgo, const std::vector<uint8_t>& authKey, int32_t authTruncBits,
127 const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, int32_t cryptTruncBits,
ludiec836052017-05-20 14:17:05 -0700128 int32_t encapType, int32_t encapLocalPort, int32_t encapRemotePort);
Nathan Harold1a371532017-01-30 12:30:48 -0800129
130 int ipSecDeleteSecurityAssociation(int32_t transformId, int32_t direction,
131 const std::string& localAddress,
132 const std::string& remoteAddress, int32_t spi);
133
134 int ipSecApplyTransportModeTransform(const android::base::unique_fd& socket,
135 int32_t transformId, int32_t direction,
136 const std::string& localAddress,
137 const std::string& remoteAddress, int32_t spi);
138
139 int ipSecRemoveTransportModeTransform(const android::base::unique_fd& socket);
140
Nathan Harold39b5df42017-08-02 18:45:25 -0700141 // Exposed for testing
142 static constexpr size_t MAX_ALGO_LENGTH = 128;
143
144 // Exposed for testing
145 struct nlattr_algo_crypt {
146 nlattr hdr;
147 xfrm_algo crypt;
148 uint8_t key[MAX_ALGO_LENGTH];
149 };
150
151 // Exposed for testing
152 struct nlattr_algo_auth {
153 nlattr hdr;
154 xfrm_algo_auth auth;
155 uint8_t key[MAX_ALGO_LENGTH];
156 };
157
158 // Exposed for testing
159 struct nlattr_user_tmpl {
160 nlattr hdr;
161 xfrm_user_tmpl tmpl;
162 };
163
164 // Exposed for testing
165 struct nlattr_encap_tmpl {
166 nlattr hdr;
167 xfrm_encap_tmpl tmpl;
168 };
169
Nathan Harold1a371532017-01-30 12:30:48 -0800170private:
171 // prevent concurrent modification of XFRM
172 android::RWLock mLock;
173
Nathan Harolde2dd4c72017-04-19 11:09:11 -0700174/*
175 * Below is a redefinition of the xfrm_usersa_info struct that is part
176 * of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit
177 * boundary.
178 */
179#ifdef NETLINK_COMPAT32
180 // Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version
181 struct xfrm_usersa_info : ::xfrm_usersa_info {
182 } __attribute__((aligned(8)));
183 // Shadow the kernel's version, using the aligned version of xfrm_usersa_info
184 struct xfrm_userspi_info {
185 struct xfrm_usersa_info info;
186 __u32 min;
187 __u32 max;
188 };
189
190 /*
191 * Anyone who encounters a failure when sending netlink messages should look here
192 * first. Hitting the static_assert() below should be a strong hint that Android
193 * IPsec will probably not work with your current settings.
194 *
195 * Again, experimentally determined, the "flags" field should be the first byte in
196 * the final word of the xfrm_usersa_info struct. The check validates the size of
197 * the padding to be 7.
198 *
199 * This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace.
200 */
201 static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, "struct xfrm_usersa_info has changed "
202 "alignment. Please consider whether this "
203 "patch is needed.");
204 static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8,
205 "struct xfrm_usersa_info probably misaligned with kernel struct.");
206 static_assert(sizeof(xfrm_usersa_info) % 8 == 0, "struct xfrm_usersa_info_t is not 64-bit "
207 "aligned. Please consider whether this patch "
208 "is needed.");
209 static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) ==
210 sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info),
211 "struct xfrm_userspi_info has changed and does not match the kernel struct.");
212#endif
213
Nathan Harold1a371532017-01-30 12:30:48 -0800214 // helper function for filling in the XfrmSaInfo structure
215 static int fillXfrmSaId(int32_t direction, const std::string& localAddress,
216 const std::string& remoteAddress, int32_t spi, XfrmSaId* xfrmId);
217
218 // Top level functions for managing a Transport Mode Transform
219 static int addTransportModeTransform(const XfrmSaInfo& record);
220 static int removeTransportModeTransform(const XfrmSaInfo& record);
221
222 // TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE
223 // Shared between SA and SP
224 static void fillTransportModeSelector(const XfrmSaInfo& record, xfrm_selector* selector);
225
226 // Shared between Transport and Tunnel Mode
227 static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo);
228 static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo);
Nathan Harold420ceac2017-04-05 19:36:59 -0700229 static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl);
Nathan Harold1a371532017-01-30 12:30:48 -0800230
231 // Functions for Creating a Transport Mode SA
232 static int createTransportModeSecurityAssociation(const XfrmSaInfo& record,
233 const XfrmSocket& sock);
234 static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa);
235
236 // Functions for deleting a Transport Mode SA
237 static int deleteSecurityAssociation(const XfrmSaId& record, const XfrmSocket& sock);
238 static int fillUserSaId(const XfrmSaId& record, xfrm_usersa_id* said);
239 static int fillUserTemplate(const XfrmSaInfo& record, xfrm_user_tmpl* tmpl);
240 static int fillTransportModeUserSpInfo(const XfrmSaInfo& record, xfrm_userpolicy_info* usersp);
241
242 static int allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi,
243 uint32_t* outSpi, const XfrmSocket& sock);
244
245 // END TODO(messagerefactor)
246};
247
248} // namespace net
249} // namespace android
250
251#endif /* !defined(XFRM_CONTROLLER_H) */