server/XfrmController.h - platform/system/netd - Git at Google

 /*
  * Copyright (C) 2017 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 #ifndef _XFRM_CONTROLLER_H
 #define _XFRM_CONTROLLER_H

 #include <atomic>
 #include <list>
 #include <map>
 #include <string>
 #include <utility> // for pair

 #include <linux/netlink.h>
 #include <linux/udp.h>
 #include <linux/xfrm.h>
 #include <sysutils/SocketClient.h>
 #include <utils/RWLock.h>

 #include "NetdConstants.h"

 namespace android {
 namespace net {

 // Suggest we avoid the smallest and largest ints
 class XfrmMessage;
 class TransportModeSecurityAssociation;

 class XfrmSocket {
 public:
     virtual void close() {
         if (mSock >= 0) {
             ::close(mSock);
         }
         mSock = -1;
     }

     virtual bool open() = 0;

     virtual ~XfrmSocket() { close(); }

     virtual int sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, uint16_t nlMsgSeqNum,
                             iovec* iov, int iovLen) const = 0;

 protected:
     int mSock;
 };

 enum struct XfrmDirection : uint8_t {
     IN = XFRM_POLICY_IN,
     OUT = XFRM_POLICY_OUT,
     FORWARD = XFRM_POLICY_FWD,
     MASK = XFRM_POLICY_MASK,
 };

 enum struct XfrmMode : uint8_t {
     TRANSPORT = XFRM_MODE_TRANSPORT,
     TUNNEL = XFRM_MODE_TUNNEL,
 };

 enum struct XfrmEncapType : uint16_t {
     NONE = 0,
     ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE,
     ESPINUDP = UDP_ENCAP_ESPINUDP
 };

 struct XfrmAlgo {
     std::string name;
     std::vector<uint8_t> key;
     uint16_t truncLenBits;
 };

 struct XfrmEncap {
     XfrmEncapType type;
     uint16_t srcPort;
     uint16_t dstPort;
 };

 struct XfrmSaId {
     XfrmDirection direction;
     xfrm_address_t dstAddr; // network order
     xfrm_address_t srcAddr;
     int addrFamily;  // AF_INET or AF_INET6
     int transformId; // requestId
     int spi;
 };

 struct XfrmSaInfo : XfrmSaId {
     XfrmAlgo auth;
     XfrmAlgo crypt;
     int netId;
     XfrmMode mode;
     XfrmEncap encap;
 };

 class XfrmController {
 public:
     XfrmController();

     int ipSecAllocateSpi(int32_t transformId, int32_t direction, const std::string& localAddress,
                          const std::string& remoteAddress, int32_t inSpi, int32_t* outSpi);

     int ipSecAddSecurityAssociation(
         int32_t transformId, int32_t mode, int32_t direction, const std::string& localAddress,
         const std::string& remoteAddress, int64_t underlyingNetworkHandle, int32_t spi,
         const std::string& authAlgo, const std::vector<uint8_t>& authKey, int32_t authTruncBits,
         const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, int32_t cryptTruncBits,
         int32_t encapType, int32_t encapLocalPort, int32_t encapRemotePort, int32_t* allocatedSpi);

     int ipSecDeleteSecurityAssociation(int32_t transformId, int32_t direction,
                                        const std::string& localAddress,
                                        const std::string& remoteAddress, int32_t spi);

     int ipSecApplyTransportModeTransform(const android::base::unique_fd& socket,
                                          int32_t transformId, int32_t direction,
                                          const std::string& localAddress,
                                          const std::string& remoteAddress, int32_t spi);

     int ipSecRemoveTransportModeTransform(const android::base::unique_fd& socket);

 private:
     // prevent concurrent modification of XFRM
     android::RWLock mLock;

     static constexpr size_t MAX_ALGO_LENGTH = 128;

 /*
  * Below is a redefinition of the xfrm_usersa_info struct that is part
  * of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit
  * boundary.
  */
 #ifdef NETLINK_COMPAT32
     // Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version
     struct xfrm_usersa_info : ::xfrm_usersa_info {
     } __attribute__((aligned(8)));
     // Shadow the kernel's version, using the aligned version of xfrm_usersa_info
     struct xfrm_userspi_info {
         struct xfrm_usersa_info info;
         __u32 min;
         __u32 max;
     };

     /*
      * Anyone who encounters a failure when sending netlink messages should look here
      * first. Hitting the static_assert() below should be a strong hint that Android
      * IPsec will probably not work with your current settings.
      *
      * Again, experimentally determined, the "flags" field should be the first byte in
      * the final word of the xfrm_usersa_info struct. The check validates the size of
      * the padding to be 7.
      *
      * This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace.
      */
     static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, "struct xfrm_usersa_info has changed "
                                                        "alignment. Please consider whether this "
                                                        "patch is needed.");
     static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8,
                   "struct xfrm_usersa_info probably misaligned with kernel struct.");
     static_assert(sizeof(xfrm_usersa_info) % 8 == 0, "struct xfrm_usersa_info_t is not 64-bit  "
                                                      "aligned. Please consider whether this patch "
                                                      "is needed.");
     static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) ==
                       sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info),
                   "struct xfrm_userspi_info has changed and does not match the kernel struct.");
 #endif

     struct nlattr_algo_crypt {
         nlattr hdr;
         xfrm_algo crypt;
         uint8_t key[MAX_ALGO_LENGTH];
     };

     struct nlattr_algo_auth {
         nlattr hdr;
         xfrm_algo_auth auth;
         uint8_t key[MAX_ALGO_LENGTH];
     };

     struct nlattr_user_tmpl {
         nlattr hdr;
         xfrm_user_tmpl tmpl;
     };

     struct nlattr_encap_tmpl {
         nlattr hdr;
         xfrm_encap_tmpl tmpl;
     };


     // helper function for filling in the XfrmSaInfo structure
     static int fillXfrmSaId(int32_t direction, const std::string& localAddress,
                             const std::string& remoteAddress, int32_t spi, XfrmSaId* xfrmId);

     // Top level functions for managing a Transport Mode Transform
     static int addTransportModeTransform(const XfrmSaInfo& record);
     static int removeTransportModeTransform(const XfrmSaInfo& record);

     // TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE
     // Shared between SA and SP
     static void fillTransportModeSelector(const XfrmSaInfo& record, xfrm_selector* selector);

     // Shared between Transport and Tunnel Mode
     static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo);
     static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo);
     static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl);

     // Functions for Creating a Transport Mode SA
     static int createTransportModeSecurityAssociation(const XfrmSaInfo& record,
                                                       const XfrmSocket& sock);
     static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa);

     // Functions for deleting a Transport Mode SA
     static int deleteSecurityAssociation(const XfrmSaId& record, const XfrmSocket& sock);
     static int fillUserSaId(const XfrmSaId& record, xfrm_usersa_id* said);
     static int fillUserTemplate(const XfrmSaInfo& record, xfrm_user_tmpl* tmpl);
     static int fillTransportModeUserSpInfo(const XfrmSaInfo& record, xfrm_userpolicy_info* usersp);

     static int allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi,
                            uint32_t* outSpi, const XfrmSocket& sock);

     // END TODO(messagerefactor)
 };

 } // namespace net
 } // namespace android

 #endif /* !defined(XFRM_CONTROLLER_H) */
	/*
	* Copyright (C) 2017 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/
	#ifndef _XFRM_CONTROLLER_H
	#define _XFRM_CONTROLLER_H

	#include <atomic>
	#include <list>
	#include <map>
	#include <string>
	#include <utility> // for pair

	#include <linux/netlink.h>
	#include <linux/udp.h>
	#include <linux/xfrm.h>
	#include <sysutils/SocketClient.h>
	#include <utils/RWLock.h>

	#include "NetdConstants.h"

	namespace android {
	namespace net {

	// Suggest we avoid the smallest and largest ints
	class XfrmMessage;
	class TransportModeSecurityAssociation;

	class XfrmSocket {
	public:
	virtual void close() {
	if (mSock >= 0) {
	::close(mSock);
	}
	mSock = -1;
	}

	virtual bool open() = 0;

	virtual ~XfrmSocket() { close(); }

	virtual int sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, uint16_t nlMsgSeqNum,
	iovec* iov, int iovLen) const = 0;

	protected:
	int mSock;
	};

	enum struct XfrmDirection : uint8_t {
	IN = XFRM_POLICY_IN,
	OUT = XFRM_POLICY_OUT,
	FORWARD = XFRM_POLICY_FWD,
	MASK = XFRM_POLICY_MASK,
	};

	enum struct XfrmMode : uint8_t {
	TRANSPORT = XFRM_MODE_TRANSPORT,
	TUNNEL = XFRM_MODE_TUNNEL,
	};

	enum struct XfrmEncapType : uint16_t {
	NONE = 0,
	ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE,
	ESPINUDP = UDP_ENCAP_ESPINUDP
	};

	struct XfrmAlgo {
	std::string name;
	std::vector<uint8_t> key;
	uint16_t truncLenBits;
	};

	struct XfrmEncap {
	XfrmEncapType type;
	uint16_t srcPort;
	uint16_t dstPort;
	};

	struct XfrmSaId {
	XfrmDirection direction;
	xfrm_address_t dstAddr; // network order
	xfrm_address_t srcAddr;
	int addrFamily; // AF_INET or AF_INET6
	int transformId; // requestId
	int spi;
	};

	struct XfrmSaInfo : XfrmSaId {
	XfrmAlgo auth;
	XfrmAlgo crypt;
	int netId;
	XfrmMode mode;
	XfrmEncap encap;
	};

	class XfrmController {
	public:
	XfrmController();

	int ipSecAllocateSpi(int32_t transformId, int32_t direction, const std::string& localAddress,
	const std::string& remoteAddress, int32_t inSpi, int32_t* outSpi);

	int ipSecAddSecurityAssociation(
	int32_t transformId, int32_t mode, int32_t direction, const std::string& localAddress,
	const std::string& remoteAddress, int64_t underlyingNetworkHandle, int32_t spi,
	const std::string& authAlgo, const std::vector<uint8_t>& authKey, int32_t authTruncBits,
	const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, int32_t cryptTruncBits,
	int32_t encapType, int32_t encapLocalPort, int32_t encapRemotePort, int32_t* allocatedSpi);

	int ipSecDeleteSecurityAssociation(int32_t transformId, int32_t direction,
	const std::string& localAddress,
	const std::string& remoteAddress, int32_t spi);

	int ipSecApplyTransportModeTransform(const android::base::unique_fd& socket,
	int32_t transformId, int32_t direction,
	const std::string& localAddress,
	const std::string& remoteAddress, int32_t spi);

	int ipSecRemoveTransportModeTransform(const android::base::unique_fd& socket);

	private:
	// prevent concurrent modification of XFRM
	android::RWLock mLock;

	static constexpr size_t MAX_ALGO_LENGTH = 128;

	/*
	* Below is a redefinition of the xfrm_usersa_info struct that is part
	* of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit
	* boundary.
	*/
	#ifdef NETLINK_COMPAT32
	// Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version
	struct xfrm_usersa_info : ::xfrm_usersa_info {
	} __attribute__((aligned(8)));
	// Shadow the kernel's version, using the aligned version of xfrm_usersa_info
	struct xfrm_userspi_info {
	struct xfrm_usersa_info info;
	__u32 min;
	__u32 max;
	};

	/*
	* Anyone who encounters a failure when sending netlink messages should look here
	* first. Hitting the static_assert() below should be a strong hint that Android
	* IPsec will probably not work with your current settings.
	*
	* Again, experimentally determined, the "flags" field should be the first byte in
	* the final word of the xfrm_usersa_info struct. The check validates the size of
	* the padding to be 7.
	*
	* This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace.
	*/
	static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, "struct xfrm_usersa_info has changed "
	"alignment. Please consider whether this "
	"patch is needed.");
	static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8,
	"struct xfrm_usersa_info probably misaligned with kernel struct.");
	static_assert(sizeof(xfrm_usersa_info) % 8 == 0, "struct xfrm_usersa_info_t is not 64-bit "
	"aligned. Please consider whether this patch "
	"is needed.");
	static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) ==
	sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info),
	"struct xfrm_userspi_info has changed and does not match the kernel struct.");
	#endif

	struct nlattr_algo_crypt {
	nlattr hdr;
	xfrm_algo crypt;
	uint8_t key[MAX_ALGO_LENGTH];
	};

	struct nlattr_algo_auth {
	nlattr hdr;
	xfrm_algo_auth auth;
	uint8_t key[MAX_ALGO_LENGTH];
	};

	struct nlattr_user_tmpl {
	nlattr hdr;
	xfrm_user_tmpl tmpl;
	};

	struct nlattr_encap_tmpl {
	nlattr hdr;
	xfrm_encap_tmpl tmpl;
	};


	// helper function for filling in the XfrmSaInfo structure
	static int fillXfrmSaId(int32_t direction, const std::string& localAddress,
	const std::string& remoteAddress, int32_t spi, XfrmSaId* xfrmId);

	// Top level functions for managing a Transport Mode Transform
	static int addTransportModeTransform(const XfrmSaInfo& record);
	static int removeTransportModeTransform(const XfrmSaInfo& record);

	// TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE
	// Shared between SA and SP
	static void fillTransportModeSelector(const XfrmSaInfo& record, xfrm_selector* selector);

	// Shared between Transport and Tunnel Mode
	static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo);
	static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo);
	static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl);

	// Functions for Creating a Transport Mode SA
	static int createTransportModeSecurityAssociation(const XfrmSaInfo& record,
	const XfrmSocket& sock);
	static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa);

	// Functions for deleting a Transport Mode SA
	static int deleteSecurityAssociation(const XfrmSaId& record, const XfrmSocket& sock);
	static int fillUserSaId(const XfrmSaId& record, xfrm_usersa_id* said);
	static int fillUserTemplate(const XfrmSaInfo& record, xfrm_user_tmpl* tmpl);
	static int fillTransportModeUserSpInfo(const XfrmSaInfo& record, xfrm_userpolicy_info* usersp);

	static int allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi,
	uint32_t* outSpi, const XfrmSocket& sock);

	// END TODO(messagerefactor)
	};

	} // namespace net
	} // namespace android

	#endif /* !defined(XFRM_CONTROLLER_H) */