1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 #ifndef _XFRM_CONTROLLER_H 17 #define _XFRM_CONTROLLER_H 18 19 #include <atomic> 20 #include <list> 21 #include <map> 22 #include <string> 23 #include <utility> // for pair 24 25 #include <linux/if.h> 26 #include <linux/if_link.h> 27 #include <linux/if_tunnel.h> 28 #include <linux/netlink.h> 29 #include <linux/udp.h> 30 #include <linux/xfrm.h> 31 #include <unistd.h> 32 33 #include "NetdConstants.h" 34 #include "android-base/unique_fd.h" 35 #include "netdutils/DumpWriter.h" 36 #include "netdutils/Slice.h" 37 #include "netdutils/Status.h" 38 #include "sysutils/SocketClient.h" 39 40 namespace android { 41 namespace net { 42 43 // Exposed for testing 44 extern const uint32_t ALGO_MASK_AUTH_ALL; 45 // Exposed for testing 46 extern const uint32_t ALGO_MASK_CRYPT_ALL; 47 // Exposed for testing 48 extern const uint32_t ALGO_MASK_AEAD_ALL; 49 // Exposed for testing 50 extern const uint8_t REPLAY_WINDOW_SIZE; 51 // Exposed for testing 52 extern const uint32_t REPLAY_WINDOW_SIZE_ESN; 53 54 // Suggest we avoid the smallest and largest ints 55 class XfrmMessage; 56 class TransportModeSecurityAssociation; 57 58 class XfrmSocket { 59 public: 60 // called from destructor and thus cannot be virtual close()61 void close() { 62 if (mSock >= 0) { 63 ::close(mSock); 64 } 65 mSock = -1; 66 } 67 68 virtual netdutils::Status open() = 0; 69 ~XfrmSocket()70 virtual ~XfrmSocket() { close(); } 71 72 // Sends the netlink message contained in iovecs. This populates iovecs[0] with 73 // a valid netlink message header. 74 virtual netdutils::Status sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, 75 uint16_t nlMsgSeqNum, 76 std::vector<iovec>* iovecs) const = 0; 77 78 protected: 79 int mSock; 80 }; 81 82 enum struct XfrmDirection : uint8_t { 83 IN = XFRM_POLICY_IN, 84 OUT = XFRM_POLICY_OUT, 85 FORWARD = XFRM_POLICY_FWD, 86 MASK = XFRM_POLICY_MASK, 87 }; 88 89 enum struct XfrmMode : uint8_t { 90 TRANSPORT = XFRM_MODE_TRANSPORT, 91 TUNNEL = XFRM_MODE_TUNNEL, 92 }; 93 94 enum struct XfrmEncapType : uint16_t { 95 NONE = 0, 96 ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE, 97 ESPINUDP = UDP_ENCAP_ESPINUDP 98 }; 99 100 struct XfrmAlgo { 101 std::string name; 102 std::vector<uint8_t> key; 103 uint16_t truncLenBits; 104 }; 105 106 struct XfrmEncap { 107 XfrmEncapType type; 108 uint16_t srcPort; 109 uint16_t dstPort; 110 }; 111 112 struct XfrmEndpointPair { 113 xfrm_address_t dstAddr; // network order 114 xfrm_address_t srcAddr; 115 int addrFamily; // AF_INET or AF_INET6 116 }; 117 118 // minimally sufficient structure to match either an SA or a Policy 119 struct XfrmCommonInfo : XfrmEndpointPair { 120 // TODO: b/259298885 rename "transformId" to "requestId" and update 121 // all the related methods/fields/logs 122 int transformId; // requestId 123 int spi; 124 xfrm_mark mark; 125 int xfrm_if_id; 126 XfrmMode mode; 127 }; 128 129 struct XfrmSaInfo : XfrmCommonInfo { 130 XfrmAlgo auth; 131 XfrmAlgo crypt; 132 XfrmAlgo aead; 133 int netId; 134 XfrmEncap encap; 135 }; 136 137 struct XfrmSpInfo : XfrmCommonInfo { 138 // Address family in XfrmCommonInfo used for template/SA matching, need separate addrFamily 139 // for selectors 140 int selAddrFamily; // AF_INET or AF_INET6 141 XfrmDirection direction; 142 }; 143 144 struct XfrmMigrateInfo : XfrmSpInfo { 145 XfrmEndpointPair newEndpointInfo; 146 }; 147 148 /* 149 * This is a workaround for a kernel bug in the 32bit netlink compat layer 150 * that has been present on x86_64 kernels since 2010 with no fix on the 151 * horizon. 152 * 153 * Below is a redefinition of the xfrm_usersa_info struct that is part 154 * of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit 155 * boundary. 156 * 157 * Note that we turn this on for all x86 32bit targets, under the assumption 158 * that nowadays all x86 targets are running 64bit kernels. 159 */ 160 #if defined(__i386__) 161 // Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version 162 struct xfrm_usersa_info : ::xfrm_usersa_info { 163 } __attribute__((aligned(8))); 164 // Shadow the kernel's version, using the aligned version of xfrm_usersa_info 165 struct xfrm_userspi_info { 166 struct xfrm_usersa_info info; 167 __u32 min; 168 __u32 max; 169 }; 170 struct xfrm_userpolicy_info : ::xfrm_userpolicy_info { 171 } __attribute__((aligned(8))); 172 173 /* 174 * Anyone who encounters a failure when sending netlink messages should look here 175 * first. Hitting the static_assert() below should be a strong hint that Android 176 * IPsec will probably not work with your current settings. 177 * 178 * Again, experimentally determined, the "flags" field should be the first byte in 179 * the final word of the xfrm_usersa_info struct. The check validates the size of 180 * the padding to be 7. 181 * 182 * This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace. 183 */ 184 static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, 185 "struct xfrm_usersa_info has changed " 186 "alignment. Please consider whether this " 187 "patch is needed."); 188 static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8, 189 "struct xfrm_usersa_info probably misaligned with kernel struct."); 190 static_assert(sizeof(xfrm_usersa_info) % 8 == 0, 191 "struct xfrm_usersa_info_t is not 64-bit " 192 "aligned. Please consider whether this patch " 193 "is needed."); 194 static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) == 195 sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info), 196 "struct xfrm_userspi_info has changed and does not match the kernel struct."); 197 static_assert(sizeof(::xfrm_userpolicy_info) % 8 != 0, 198 "struct xfrm_userpolicy_info has changed " 199 "alignment. Please consider whether this " 200 "patch is needed."); 201 static_assert(sizeof(xfrm_userpolicy_info) - offsetof(xfrm_userpolicy_info, share) == 5, 202 "struct xfrm_userpolicy_info probably misaligned with kernel struct."); 203 static_assert(sizeof(xfrm_userpolicy_info) % 8 == 0, 204 "struct xfrm_userpolicy_info is not 64-bit " 205 "aligned. Please consider whether this patch " 206 "is needed."); 207 #endif 208 209 class XfrmController { 210 public: 211 XfrmController(); 212 213 // Initializer to override XFRM-I support for unit-testing purposes 214 explicit XfrmController(bool xfrmIntfSupport); 215 216 static netdutils::Status Init(); 217 218 static netdutils::Status ipSecSetEncapSocketOwner(int socketFd, int newUid, uid_t callerUid); 219 220 static netdutils::Status ipSecAllocateSpi(int32_t transformId, const std::string& localAddress, 221 const std::string& remoteAddress, int32_t inSpi, 222 int32_t* outSpi); 223 224 static netdutils::Status ipSecAddSecurityAssociation( 225 int32_t transformId, int32_t mode, const std::string& sourceAddress, 226 const std::string& destinationAddress, int32_t underlyingNetId, int32_t spi, 227 int32_t markValue, int32_t markMask, const std::string& authAlgo, 228 const std::vector<uint8_t>& authKey, int32_t authTruncBits, 229 const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, 230 int32_t cryptTruncBits, const std::string& aeadAlgo, 231 const std::vector<uint8_t>& aeadKey, int32_t aeadIcvBits, int32_t encapType, 232 int32_t encapLocalPort, int32_t encapRemotePort, int32_t xfrmInterfaceId); 233 234 static netdutils::Status ipSecDeleteSecurityAssociation(int32_t transformId, 235 const std::string& sourceAddress, 236 const std::string& destinationAddress, 237 int32_t spi, int32_t markValue, 238 int32_t markMask, 239 int32_t xfrmInterfaceId); 240 241 static netdutils::Status ipSecApplyTransportModeTransform(int socketFd, int32_t transformId, 242 int32_t direction, 243 const std::string& localAddress, 244 const std::string& remoteAddress, 245 int32_t spi); 246 247 static netdutils::Status ipSecRemoveTransportModeTransform(int socketFd); 248 249 static netdutils::Status ipSecAddSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 250 int32_t direction, 251 const std::string& tmplSrcAddress, 252 const std::string& tmplDstAddress, int32_t spi, 253 int32_t markValue, int32_t markMask, 254 int32_t xfrmInterfaceId); 255 256 static netdutils::Status ipSecUpdateSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 257 int32_t direction, 258 const std::string& tmplSrcAddress, 259 const std::string& tmplDstAddress, 260 int32_t spi, int32_t markValue, 261 int32_t markMask, int32_t xfrmInterfaceId); 262 263 static netdutils::Status ipSecDeleteSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 264 int32_t direction, int32_t markValue, 265 int32_t markMask, int32_t xfrmInterfaceId); 266 267 static netdutils::Status ipSecAddTunnelInterface(const std::string& deviceName, 268 const std::string& localAddress, 269 const std::string& remoteAddress, int32_t ikey, 270 int32_t okey, int32_t interfaceId, 271 bool isUpdate); 272 273 static netdutils::Status ipSecRemoveTunnelInterface(const std::string& deviceName); 274 275 // Only available for Tunnel must already have a matching tunnel SA and policy 276 static netdutils::Status ipSecMigrate(int32_t transformId, int32_t selAddrFamily, 277 int32_t direction, const std::string& oldSourceAddress, 278 const std::string& oldDestinationAddress, 279 const std::string& newSourceAddress, 280 const std::string& newDestinationAddress, 281 int32_t xfrmInterfaceId); 282 void dump(netdutils::DumpWriter& dw); 283 284 // Some XFRM netlink attributes comprise a header, a struct, and some data 285 // after the struct. We wrap all of those in one struct for easier 286 // marshalling. The structs below must be ABI compatible with the kernel and 287 // are composed from kernel structures; thus, they use the kernel naming 288 // convention. 289 290 // Exposed for testing 291 static constexpr size_t MAX_KEY_LENGTH = 128; 292 293 // Disable this warning since avoiding it makes the code unreadable. 294 #pragma clang diagnostic push 295 #pragma clang diagnostic ignored "-Wgnu-variable-sized-type-not-at-end" 296 297 // Container for the content of an XFRMA_ALG_CRYPT netlink attribute. 298 // Exposed for testing 299 struct nlattr_algo_crypt { 300 nlattr hdr; 301 xfrm_algo crypt; 302 uint8_t key[MAX_KEY_LENGTH]; 303 }; 304 305 // Container for the content of an XFRMA_ALG_AUTH_TRUNC netlink attribute. 306 // Exposed for testing 307 struct nlattr_algo_auth { 308 nlattr hdr; 309 xfrm_algo_auth auth; 310 uint8_t key[MAX_KEY_LENGTH]; 311 }; 312 313 // Container for the content of an XFRMA_TMPL netlink attribute. 314 // Exposed for testing 315 struct nlattr_algo_aead { 316 nlattr hdr; 317 xfrm_algo_aead aead; 318 uint8_t key[MAX_KEY_LENGTH]; 319 }; 320 321 // Container for the content of an XFRMA_REPLAY_ESN_VAL netlink attribute. 322 // Exposed for testing 323 struct nlattr_xfrm_replay_esn { 324 nlattr hdr; 325 xfrm_replay_state_esn replay_state; 326 }; 327 328 #pragma clang diagnostic pop 329 330 // Exposed for testing 331 struct nlattr_user_tmpl { 332 nlattr hdr; 333 xfrm_user_tmpl tmpl; 334 }; 335 336 // Container for the content of an XFRMA_ENCAP netlink attribute. 337 // Exposed for testing 338 struct nlattr_encap_tmpl { 339 nlattr hdr; 340 xfrm_encap_tmpl tmpl; 341 }; 342 343 // Container for the content of an XFRMA_MARK netlink attribute. 344 // Exposed for testing 345 struct nlattr_xfrm_mark { 346 nlattr hdr; 347 xfrm_mark mark; 348 }; 349 350 // Container for the content of an XFRMA_OUTPUT_MARK netlink attribute. 351 // Exposed for testing 352 struct nlattr_xfrm_output_mark { 353 nlattr hdr; 354 __u32 outputMark; 355 }; 356 357 // Container for the content of an XFRMA_IF_ID netlink attribute. 358 // Exposed for testing 359 struct nlattr_xfrm_interface_id { 360 nlattr hdr; 361 __u32 if_id; 362 }; 363 364 // Container for the content of an XFRMA_MIGRATE netlink attribute. 365 // Exposed for testing 366 struct nlattr_xfrm_user_migrate { 367 nlattr hdr; 368 xfrm_user_migrate migrate; 369 }; 370 371 // Exposed for testing 372 struct nlattr_payload_u32 { 373 nlattr hdr; 374 uint32_t value; 375 }; 376 377 private: 378 static bool isXfrmIntfSupported(); 379 380 static netdutils::Status fillXfrmEndpointPair(const std::string& sourceAddress, 381 const std::string& destinationAddress, 382 XfrmEndpointPair* info); 383 // helper functions for filling in the XfrmCommonInfo (and XfrmSaInfo) structure 384 static netdutils::Status fillXfrmCommonInfo(const std::string& sourceAddress, 385 const std::string& destinationAddress, int32_t spi, 386 int32_t markValue, int32_t markMask, 387 int32_t transformId, int32_t xfrmInterfaceId, 388 XfrmCommonInfo* info); 389 static netdutils::Status fillXfrmCommonInfo(int32_t spi, int32_t markValue, int32_t markMask, 390 int32_t transformId, int32_t xfrmInterfaceId, 391 XfrmCommonInfo* info); 392 393 // Top level functions for managing a Transport Mode Transform 394 static netdutils::Status addTransportModeTransform(const XfrmSaInfo& record); 395 static int removeTransportModeTransform(const XfrmSaInfo& record); 396 397 // TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE 398 // Shared between SA and SP 399 static void fillXfrmSelector(const int record, xfrm_selector* selector); 400 401 // Shared between Transport and Tunnel Mode 402 static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo); 403 static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo); 404 static int fillNlAttrXfrmAlgoAead(const XfrmAlgo& in_algo, nlattr_algo_aead* algo); 405 static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl); 406 407 // Functions for updating a Transport Mode SA 408 static netdutils::Status updateSecurityAssociation(const XfrmSaInfo& record, 409 const XfrmSocket& sock); 410 static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa); 411 412 // Functions for deleting a Transport Mode SA 413 static netdutils::Status deleteSecurityAssociation(const XfrmCommonInfo& record, 414 const XfrmSocket& sock); 415 static int fillUserSaId(const XfrmCommonInfo& record, xfrm_usersa_id* said); 416 static void fillUserTemplate(const XfrmSpInfo& record, xfrm_user_tmpl* tmpl); 417 418 static int fillUserSpInfo(const XfrmSpInfo& record, xfrm_userpolicy_info* usersp); 419 static int fillNlAttrUserTemplate(const XfrmSpInfo& record, nlattr_user_tmpl* tmpl); 420 static int fillUserPolicyId(const XfrmSpInfo& record, xfrm_userpolicy_id* policy_id); 421 static int fillNlAttrXfrmMark(const XfrmCommonInfo& record, nlattr_xfrm_mark* mark); 422 static int fillNlAttrXfrmOutputMark(const XfrmSaInfo& record, 423 nlattr_xfrm_output_mark* output_mark); 424 static int fillNlAttrXfrmIntfId(const __u32 intf_id_value, nlattr_xfrm_interface_id* intf_id); 425 static int fillNlAttrXfrmReplayEsn(nlattr_xfrm_replay_esn* replay_esn); 426 static int fillNlAttrXfrmMigrate(const XfrmMigrateInfo& record, 427 nlattr_xfrm_user_migrate* migrate); 428 429 static netdutils::Status allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi, 430 uint32_t* outSpi, const XfrmSocket& sock); 431 432 static netdutils::Status processSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 433 int32_t direction, 434 const std::string& tmplSrcAddress, 435 const std::string& tmplDstAddress, int32_t spi, 436 int32_t markValue, int32_t markMask, 437 int32_t xfrmInterfaceId, int32_t msgType); 438 static netdutils::Status updateTunnelModeSecurityPolicy(const XfrmSpInfo& record, 439 const XfrmSocket& sock, 440 uint16_t msgType); 441 static netdutils::Status deleteTunnelModeSecurityPolicy(const XfrmSpInfo& record, 442 const XfrmSocket& sock); 443 static netdutils::Status migrate(const XfrmMigrateInfo& record, const XfrmSocket& sock); 444 static netdutils::Status flushInterfaces(); 445 static netdutils::Status flushSaDb(const XfrmSocket& s); 446 static netdutils::Status flushPolicyDb(const XfrmSocket& s); 447 448 static netdutils::Status ipSecAddXfrmInterface(const std::string& deviceName, 449 int32_t interfaceId, uint16_t flags); 450 static netdutils::Status ipSecAddVirtualTunnelInterface(const std::string& deviceName, 451 const std::string& localAddress, 452 const std::string& remoteAddress, 453 int32_t ikey, int32_t okey, 454 uint16_t flags); 455 // END TODO(messagerefactor) 456 }; 457 458 } // namespace net 459 } // namespace android 460 461 #endif /* !defined(XFRM_CONTROLLER_H) */ 462