| /* |
| * Copyright (C) 2017 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| #ifndef _XFRM_CONTROLLER_H |
| #define _XFRM_CONTROLLER_H |
| |
| #include <atomic> |
| #include <list> |
| #include <map> |
| #include <string> |
| #include <utility> // for pair |
| |
| #include <linux/if.h> |
| #include <linux/if_link.h> |
| #include <linux/if_tunnel.h> |
| #include <linux/netlink.h> |
| #include <linux/udp.h> |
| #include <linux/xfrm.h> |
| #include <unistd.h> |
| |
| #include "NetdConstants.h" |
| #include "android-base/unique_fd.h" |
| #include "netdutils/DumpWriter.h" |
| #include "netdutils/Slice.h" |
| #include "netdutils/Status.h" |
| #include "sysutils/SocketClient.h" |
| |
| namespace android { |
| namespace net { |
| |
| // Exposed for testing |
| extern const uint32_t ALGO_MASK_AUTH_ALL; |
| // Exposed for testing |
| extern const uint32_t ALGO_MASK_CRYPT_ALL; |
| // Exposed for testing |
| extern const uint32_t ALGO_MASK_AEAD_ALL; |
| // Exposed for testing |
| extern const uint8_t REPLAY_WINDOW_SIZE; |
| |
| // Suggest we avoid the smallest and largest ints |
| class XfrmMessage; |
| class TransportModeSecurityAssociation; |
| |
| class XfrmSocket { |
| public: |
| // called from destructor and thus cannot be virtual |
| void close() { |
| if (mSock >= 0) { |
| ::close(mSock); |
| } |
| mSock = -1; |
| } |
| |
| virtual netdutils::Status open() = 0; |
| |
| virtual ~XfrmSocket() { close(); } |
| |
| // Sends the netlink message contained in iovecs. This populates iovecs[0] with |
| // a valid netlink message header. |
| virtual netdutils::Status sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, |
| uint16_t nlMsgSeqNum, |
| std::vector<iovec>* iovecs) const = 0; |
| |
| protected: |
| int mSock; |
| }; |
| |
| enum struct XfrmDirection : uint8_t { |
| IN = XFRM_POLICY_IN, |
| OUT = XFRM_POLICY_OUT, |
| FORWARD = XFRM_POLICY_FWD, |
| MASK = XFRM_POLICY_MASK, |
| }; |
| |
| enum struct XfrmMode : uint8_t { |
| TRANSPORT = XFRM_MODE_TRANSPORT, |
| TUNNEL = XFRM_MODE_TUNNEL, |
| }; |
| |
| enum struct XfrmEncapType : uint16_t { |
| NONE = 0, |
| ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE, |
| ESPINUDP = UDP_ENCAP_ESPINUDP |
| }; |
| |
| struct XfrmAlgo { |
| std::string name; |
| std::vector<uint8_t> key; |
| uint16_t truncLenBits; |
| }; |
| |
| struct XfrmEncap { |
| XfrmEncapType type; |
| uint16_t srcPort; |
| uint16_t dstPort; |
| }; |
| |
| struct XfrmEndpointPair { |
| xfrm_address_t dstAddr; // network order |
| xfrm_address_t srcAddr; |
| int addrFamily; // AF_INET or AF_INET6 |
| }; |
| |
| // minimally sufficient structure to match either an SA or a Policy |
| struct XfrmCommonInfo : XfrmEndpointPair { |
| int transformId; // requestId |
| int spi; |
| xfrm_mark mark; |
| int xfrm_if_id; |
| XfrmMode mode; |
| }; |
| |
| struct XfrmSaInfo : XfrmCommonInfo { |
| XfrmAlgo auth; |
| XfrmAlgo crypt; |
| XfrmAlgo aead; |
| int netId; |
| XfrmEncap encap; |
| }; |
| |
| struct XfrmSpInfo : XfrmCommonInfo { |
| // Address family in XfrmCommonInfo used for template/SA matching, need separate addrFamily |
| // for selectors |
| int selAddrFamily; // AF_INET or AF_INET6 |
| XfrmDirection direction; |
| }; |
| |
| struct XfrmMigrateInfo : XfrmSpInfo { |
| XfrmEndpointPair newEndpointInfo; |
| }; |
| |
| /* |
| * This is a workaround for a kernel bug in the 32bit netlink compat layer |
| * that has been present on x86_64 kernels since 2010 with no fix on the |
| * horizon. |
| * |
| * Below is a redefinition of the xfrm_usersa_info struct that is part |
| * of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit |
| * boundary. |
| * |
| * Note that we turn this on for all x86 32bit targets, under the assumption |
| * that nowadays all x86 targets are running 64bit kernels. |
| */ |
| #if defined(__i386__) |
| // Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version |
| struct xfrm_usersa_info : ::xfrm_usersa_info { |
| } __attribute__((aligned(8))); |
| // Shadow the kernel's version, using the aligned version of xfrm_usersa_info |
| struct xfrm_userspi_info { |
| struct xfrm_usersa_info info; |
| __u32 min; |
| __u32 max; |
| }; |
| struct xfrm_userpolicy_info : ::xfrm_userpolicy_info { |
| } __attribute__((aligned(8))); |
| |
| /* |
| * Anyone who encounters a failure when sending netlink messages should look here |
| * first. Hitting the static_assert() below should be a strong hint that Android |
| * IPsec will probably not work with your current settings. |
| * |
| * Again, experimentally determined, the "flags" field should be the first byte in |
| * the final word of the xfrm_usersa_info struct. The check validates the size of |
| * the padding to be 7. |
| * |
| * This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace. |
| */ |
| static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, |
| "struct xfrm_usersa_info has changed " |
| "alignment. Please consider whether this " |
| "patch is needed."); |
| static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8, |
| "struct xfrm_usersa_info probably misaligned with kernel struct."); |
| static_assert(sizeof(xfrm_usersa_info) % 8 == 0, |
| "struct xfrm_usersa_info_t is not 64-bit " |
| "aligned. Please consider whether this patch " |
| "is needed."); |
| static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) == |
| sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info), |
| "struct xfrm_userspi_info has changed and does not match the kernel struct."); |
| static_assert(sizeof(::xfrm_userpolicy_info) % 8 != 0, |
| "struct xfrm_userpolicy_info has changed " |
| "alignment. Please consider whether this " |
| "patch is needed."); |
| static_assert(sizeof(xfrm_userpolicy_info) - offsetof(xfrm_userpolicy_info, share) == 5, |
| "struct xfrm_userpolicy_info probably misaligned with kernel struct."); |
| static_assert(sizeof(xfrm_userpolicy_info) % 8 == 0, |
| "struct xfrm_userpolicy_info is not 64-bit " |
| "aligned. Please consider whether this patch " |
| "is needed."); |
| #endif |
| |
| class XfrmController { |
| public: |
| XfrmController(); |
| |
| // Initializer to override XFRM-I support for unit-testing purposes |
| explicit XfrmController(bool xfrmIntfSupport); |
| |
| static netdutils::Status Init(); |
| |
| static netdutils::Status ipSecSetEncapSocketOwner(int socketFd, int newUid, uid_t callerUid); |
| |
| static netdutils::Status ipSecAllocateSpi(int32_t transformId, const std::string& localAddress, |
| const std::string& remoteAddress, int32_t inSpi, |
| int32_t* outSpi); |
| |
| static netdutils::Status ipSecAddSecurityAssociation( |
| int32_t transformId, int32_t mode, const std::string& sourceAddress, |
| const std::string& destinationAddress, int32_t underlyingNetId, int32_t spi, |
| int32_t markValue, int32_t markMask, const std::string& authAlgo, |
| const std::vector<uint8_t>& authKey, int32_t authTruncBits, |
| const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, |
| int32_t cryptTruncBits, const std::string& aeadAlgo, |
| const std::vector<uint8_t>& aeadKey, int32_t aeadIcvBits, int32_t encapType, |
| int32_t encapLocalPort, int32_t encapRemotePort, int32_t xfrmInterfaceId); |
| |
| static netdutils::Status ipSecDeleteSecurityAssociation(int32_t transformId, |
| const std::string& sourceAddress, |
| const std::string& destinationAddress, |
| int32_t spi, int32_t markValue, |
| int32_t markMask, |
| int32_t xfrmInterfaceId); |
| |
| static netdutils::Status ipSecApplyTransportModeTransform(int socketFd, int32_t transformId, |
| int32_t direction, |
| const std::string& localAddress, |
| const std::string& remoteAddress, |
| int32_t spi); |
| |
| static netdutils::Status ipSecRemoveTransportModeTransform(int socketFd); |
| |
| static netdutils::Status ipSecAddSecurityPolicy(int32_t transformId, int32_t selAddrFamily, |
| int32_t direction, |
| const std::string& tmplSrcAddress, |
| const std::string& tmplDstAddress, int32_t spi, |
| int32_t markValue, int32_t markMask, |
| int32_t xfrmInterfaceId); |
| |
| static netdutils::Status ipSecUpdateSecurityPolicy(int32_t transformId, int32_t selAddrFamily, |
| int32_t direction, |
| const std::string& tmplSrcAddress, |
| const std::string& tmplDstAddress, |
| int32_t spi, int32_t markValue, |
| int32_t markMask, int32_t xfrmInterfaceId); |
| |
| static netdutils::Status ipSecDeleteSecurityPolicy(int32_t transformId, int32_t selAddrFamily, |
| int32_t direction, int32_t markValue, |
| int32_t markMask, int32_t xfrmInterfaceId); |
| |
| static netdutils::Status ipSecAddTunnelInterface(const std::string& deviceName, |
| const std::string& localAddress, |
| const std::string& remoteAddress, int32_t ikey, |
| int32_t okey, int32_t interfaceId, |
| bool isUpdate); |
| |
| static netdutils::Status ipSecRemoveTunnelInterface(const std::string& deviceName); |
| |
| // Only available for Tunnel must already have a matching tunnel SA and policy |
| static netdutils::Status ipSecMigrate(int32_t transformId, int32_t selAddrFamily, |
| int32_t direction, const std::string& oldSourceAddress, |
| const std::string& oldDestinationAddress, |
| const std::string& newSourceAddress, |
| const std::string& newDestinationAddress, |
| int32_t xfrmInterfaceId); |
| void dump(netdutils::DumpWriter& dw); |
| |
| // Some XFRM netlink attributes comprise a header, a struct, and some data |
| // after the struct. We wrap all of those in one struct for easier |
| // marshalling. The structs below must be ABI compatible with the kernel and |
| // are composed from kernel structures; thus, they use the kernel naming |
| // convention. |
| |
| // Exposed for testing |
| static constexpr size_t MAX_KEY_LENGTH = 128; |
| |
| // Disable this warning since avoiding it makes the code unreadable. |
| #pragma clang diagnostic push |
| #pragma clang diagnostic ignored "-Wgnu-variable-sized-type-not-at-end" |
| |
| // Container for the content of an XFRMA_ALG_CRYPT netlink attribute. |
| // Exposed for testing |
| struct nlattr_algo_crypt { |
| nlattr hdr; |
| xfrm_algo crypt; |
| uint8_t key[MAX_KEY_LENGTH]; |
| }; |
| |
| // Container for the content of an XFRMA_ALG_AUTH_TRUNC netlink attribute. |
| // Exposed for testing |
| struct nlattr_algo_auth { |
| nlattr hdr; |
| xfrm_algo_auth auth; |
| uint8_t key[MAX_KEY_LENGTH]; |
| }; |
| |
| // Container for the content of an XFRMA_TMPL netlink attribute. |
| // Exposed for testing |
| struct nlattr_algo_aead { |
| nlattr hdr; |
| xfrm_algo_aead aead; |
| uint8_t key[MAX_KEY_LENGTH]; |
| }; |
| |
| #pragma clang diagnostic pop |
| |
| // Exposed for testing |
| struct nlattr_user_tmpl { |
| nlattr hdr; |
| xfrm_user_tmpl tmpl; |
| }; |
| |
| // Container for the content of an XFRMA_ENCAP netlink attribute. |
| // Exposed for testing |
| struct nlattr_encap_tmpl { |
| nlattr hdr; |
| xfrm_encap_tmpl tmpl; |
| }; |
| |
| // Container for the content of an XFRMA_MARK netlink attribute. |
| // Exposed for testing |
| struct nlattr_xfrm_mark { |
| nlattr hdr; |
| xfrm_mark mark; |
| }; |
| |
| // Container for the content of an XFRMA_OUTPUT_MARK netlink attribute. |
| // Exposed for testing |
| struct nlattr_xfrm_output_mark { |
| nlattr hdr; |
| __u32 outputMark; |
| }; |
| |
| // Container for the content of an XFRMA_IF_ID netlink attribute. |
| // Exposed for testing |
| struct nlattr_xfrm_interface_id { |
| nlattr hdr; |
| __u32 if_id; |
| }; |
| |
| // Container for the content of an XFRMA_MIGRATE netlink attribute. |
| // Exposed for testing |
| struct nlattr_xfrm_user_migrate { |
| nlattr hdr; |
| xfrm_user_migrate migrate; |
| }; |
| |
| // Exposed for testing |
| struct nlattr_payload_u32 { |
| nlattr hdr; |
| uint32_t value; |
| }; |
| |
| private: |
| static bool isXfrmIntfSupported(); |
| |
| static netdutils::Status fillXfrmEndpointPair(const std::string& sourceAddress, |
| const std::string& destinationAddress, |
| XfrmEndpointPair* info); |
| // helper functions for filling in the XfrmCommonInfo (and XfrmSaInfo) structure |
| static netdutils::Status fillXfrmCommonInfo(const std::string& sourceAddress, |
| const std::string& destinationAddress, int32_t spi, |
| int32_t markValue, int32_t markMask, |
| int32_t transformId, int32_t xfrmInterfaceId, |
| XfrmCommonInfo* info); |
| static netdutils::Status fillXfrmCommonInfo(int32_t spi, int32_t markValue, int32_t markMask, |
| int32_t transformId, int32_t xfrmInterfaceId, |
| XfrmCommonInfo* info); |
| |
| // Top level functions for managing a Transport Mode Transform |
| static netdutils::Status addTransportModeTransform(const XfrmSaInfo& record); |
| static int removeTransportModeTransform(const XfrmSaInfo& record); |
| |
| // TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE |
| // Shared between SA and SP |
| static void fillXfrmSelector(const int record, xfrm_selector* selector); |
| |
| // Shared between Transport and Tunnel Mode |
| static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo); |
| static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo); |
| static int fillNlAttrXfrmAlgoAead(const XfrmAlgo& in_algo, nlattr_algo_aead* algo); |
| static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl); |
| |
| // Functions for updating a Transport Mode SA |
| static netdutils::Status updateSecurityAssociation(const XfrmSaInfo& record, |
| const XfrmSocket& sock); |
| static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa); |
| |
| // Functions for deleting a Transport Mode SA |
| static netdutils::Status deleteSecurityAssociation(const XfrmCommonInfo& record, |
| const XfrmSocket& sock); |
| static int fillUserSaId(const XfrmCommonInfo& record, xfrm_usersa_id* said); |
| static void fillUserTemplate(const XfrmSpInfo& record, xfrm_user_tmpl* tmpl); |
| |
| static int fillUserSpInfo(const XfrmSpInfo& record, xfrm_userpolicy_info* usersp); |
| static int fillNlAttrUserTemplate(const XfrmSpInfo& record, nlattr_user_tmpl* tmpl); |
| static int fillUserPolicyId(const XfrmSpInfo& record, xfrm_userpolicy_id* policy_id); |
| static int fillNlAttrXfrmMark(const XfrmCommonInfo& record, nlattr_xfrm_mark* mark); |
| static int fillNlAttrXfrmOutputMark(const XfrmSaInfo& record, |
| nlattr_xfrm_output_mark* output_mark); |
| static int fillNlAttrXfrmIntfId(const __u32 intf_id_value, nlattr_xfrm_interface_id* intf_id); |
| static int fillNlAttrXfrmMigrate(const XfrmMigrateInfo& record, |
| nlattr_xfrm_user_migrate* migrate); |
| |
| static netdutils::Status allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi, |
| uint32_t* outSpi, const XfrmSocket& sock); |
| |
| static netdutils::Status processSecurityPolicy(int32_t transformId, int32_t selAddrFamily, |
| int32_t direction, |
| const std::string& tmplSrcAddress, |
| const std::string& tmplDstAddress, int32_t spi, |
| int32_t markValue, int32_t markMask, |
| int32_t xfrmInterfaceId, int32_t msgType); |
| static netdutils::Status updateTunnelModeSecurityPolicy(const XfrmSpInfo& record, |
| const XfrmSocket& sock, |
| uint16_t msgType); |
| static netdutils::Status deleteTunnelModeSecurityPolicy(const XfrmSpInfo& record, |
| const XfrmSocket& sock); |
| static netdutils::Status migrate(const XfrmMigrateInfo& record, const XfrmSocket& sock); |
| static netdutils::Status flushInterfaces(); |
| static netdutils::Status flushSaDb(const XfrmSocket& s); |
| static netdutils::Status flushPolicyDb(const XfrmSocket& s); |
| |
| static netdutils::Status ipSecAddXfrmInterface(const std::string& deviceName, |
| int32_t interfaceId, uint16_t flags); |
| static netdutils::Status ipSecAddVirtualTunnelInterface(const std::string& deviceName, |
| const std::string& localAddress, |
| const std::string& remoteAddress, |
| int32_t ikey, int32_t okey, |
| uint16_t flags); |
| // END TODO(messagerefactor) |
| }; |
| |
| } // namespace net |
| } // namespace android |
| |
| #endif /* !defined(XFRM_CONTROLLER_H) */ |
