1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 #ifndef _XFRM_CONTROLLER_H 17 #define _XFRM_CONTROLLER_H 18 19 #include <atomic> 20 #include <list> 21 #include <map> 22 #include <string> 23 #include <utility> // for pair 24 25 #include <linux/if.h> 26 #include <linux/if_link.h> 27 #include <linux/if_tunnel.h> 28 #include <linux/netlink.h> 29 #include <linux/udp.h> 30 #include <linux/xfrm.h> 31 #include <unistd.h> 32 33 #include "NetdConstants.h" 34 #include "android-base/unique_fd.h" 35 #include "netdutils/DumpWriter.h" 36 #include "netdutils/Slice.h" 37 #include "netdutils/Status.h" 38 #include "sysutils/SocketClient.h" 39 40 namespace android { 41 namespace net { 42 43 // Exposed for testing 44 extern const uint32_t ALGO_MASK_AUTH_ALL; 45 // Exposed for testing 46 extern const uint32_t ALGO_MASK_CRYPT_ALL; 47 // Exposed for testing 48 extern const uint32_t ALGO_MASK_AEAD_ALL; 49 // Exposed for testing 50 extern const uint8_t REPLAY_WINDOW_SIZE; 51 52 // Suggest we avoid the smallest and largest ints 53 class XfrmMessage; 54 class TransportModeSecurityAssociation; 55 56 class XfrmSocket { 57 public: close()58 virtual void close() { 59 if (mSock >= 0) { 60 ::close(mSock); 61 } 62 mSock = -1; 63 } 64 65 virtual netdutils::Status open() = 0; 66 ~XfrmSocket()67 virtual ~XfrmSocket() { close(); } 68 69 // Sends the netlink message contained in iovecs. This populates iovecs[0] with 70 // a valid netlink message header. 71 virtual netdutils::Status sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, 72 uint16_t nlMsgSeqNum, 73 std::vector<iovec>* iovecs) const = 0; 74 75 protected: 76 int mSock; 77 }; 78 79 enum struct XfrmDirection : uint8_t { 80 IN = XFRM_POLICY_IN, 81 OUT = XFRM_POLICY_OUT, 82 FORWARD = XFRM_POLICY_FWD, 83 MASK = XFRM_POLICY_MASK, 84 }; 85 86 enum struct XfrmMode : uint8_t { 87 TRANSPORT = XFRM_MODE_TRANSPORT, 88 TUNNEL = XFRM_MODE_TUNNEL, 89 }; 90 91 enum struct XfrmEncapType : uint16_t { 92 NONE = 0, 93 ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE, 94 ESPINUDP = UDP_ENCAP_ESPINUDP 95 }; 96 97 struct XfrmAlgo { 98 std::string name; 99 std::vector<uint8_t> key; 100 uint16_t truncLenBits; 101 }; 102 103 struct XfrmEncap { 104 XfrmEncapType type; 105 uint16_t srcPort; 106 uint16_t dstPort; 107 }; 108 109 // minimally sufficient structure to match either an SA or a Policy 110 struct XfrmCommonInfo { 111 xfrm_address_t dstAddr; // network order 112 xfrm_address_t srcAddr; 113 int addrFamily; // AF_INET or AF_INET6 114 int transformId; // requestId 115 int spi; 116 xfrm_mark mark; 117 int xfrm_if_id; 118 }; 119 120 struct XfrmSaInfo : XfrmCommonInfo { 121 XfrmAlgo auth; 122 XfrmAlgo crypt; 123 XfrmAlgo aead; 124 int netId; 125 XfrmMode mode; 126 XfrmEncap encap; 127 }; 128 129 struct XfrmSpInfo : XfrmSaInfo { 130 // Address family in XfrmCommonInfo used for template/SA matching, need separate addrFamily 131 // for selectors 132 int selAddrFamily; // AF_INET or AF_INET6 133 }; 134 135 /* 136 * This is a workaround for a kernel bug in the 32bit netlink compat layer 137 * that has been present on x86_64 kernels since 2010 with no fix on the 138 * horizon. 139 * 140 * Below is a redefinition of the xfrm_usersa_info struct that is part 141 * of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit 142 * boundary. 143 * 144 * Note that we turn this on for all x86 32bit targets, under the assumption 145 * that nowadays all x86 targets are running 64bit kernels. 146 */ 147 #if defined(__i386__) 148 // Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version 149 struct xfrm_usersa_info : ::xfrm_usersa_info { 150 } __attribute__((aligned(8))); 151 // Shadow the kernel's version, using the aligned version of xfrm_usersa_info 152 struct xfrm_userspi_info { 153 struct xfrm_usersa_info info; 154 __u32 min; 155 __u32 max; 156 }; 157 struct xfrm_userpolicy_info : ::xfrm_userpolicy_info { 158 } __attribute__((aligned(8))); 159 160 /* 161 * Anyone who encounters a failure when sending netlink messages should look here 162 * first. Hitting the static_assert() below should be a strong hint that Android 163 * IPsec will probably not work with your current settings. 164 * 165 * Again, experimentally determined, the "flags" field should be the first byte in 166 * the final word of the xfrm_usersa_info struct. The check validates the size of 167 * the padding to be 7. 168 * 169 * This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace. 170 */ 171 static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, 172 "struct xfrm_usersa_info has changed " 173 "alignment. Please consider whether this " 174 "patch is needed."); 175 static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8, 176 "struct xfrm_usersa_info probably misaligned with kernel struct."); 177 static_assert(sizeof(xfrm_usersa_info) % 8 == 0, 178 "struct xfrm_usersa_info_t is not 64-bit " 179 "aligned. Please consider whether this patch " 180 "is needed."); 181 static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) == 182 sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info), 183 "struct xfrm_userspi_info has changed and does not match the kernel struct."); 184 static_assert(sizeof(::xfrm_userpolicy_info) % 8 != 0, 185 "struct xfrm_userpolicy_info has changed " 186 "alignment. Please consider whether this " 187 "patch is needed."); 188 static_assert(sizeof(xfrm_userpolicy_info) - offsetof(xfrm_userpolicy_info, share) == 5, 189 "struct xfrm_userpolicy_info probably misaligned with kernel struct."); 190 static_assert(sizeof(xfrm_userpolicy_info) % 8 == 0, 191 "struct xfrm_userpolicy_info is not 64-bit " 192 "aligned. Please consider whether this patch " 193 "is needed."); 194 #endif 195 196 class XfrmController { 197 public: 198 XfrmController(); 199 200 // Initializer to override XFRM-I support for unit-testing purposes 201 explicit XfrmController(bool xfrmIntfSupport); 202 203 static netdutils::Status Init(); 204 205 static netdutils::Status ipSecSetEncapSocketOwner(int socketFd, int newUid, uid_t callerUid); 206 207 static netdutils::Status ipSecAllocateSpi(int32_t transformId, const std::string& localAddress, 208 const std::string& remoteAddress, int32_t inSpi, 209 int32_t* outSpi); 210 211 static netdutils::Status ipSecAddSecurityAssociation( 212 int32_t transformId, int32_t mode, const std::string& sourceAddress, 213 const std::string& destinationAddress, int32_t underlyingNetId, int32_t spi, 214 int32_t markValue, int32_t markMask, const std::string& authAlgo, 215 const std::vector<uint8_t>& authKey, int32_t authTruncBits, 216 const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, 217 int32_t cryptTruncBits, const std::string& aeadAlgo, 218 const std::vector<uint8_t>& aeadKey, int32_t aeadIcvBits, int32_t encapType, 219 int32_t encapLocalPort, int32_t encapRemotePort, int32_t xfrmInterfaceId); 220 221 static netdutils::Status ipSecDeleteSecurityAssociation(int32_t transformId, 222 const std::string& sourceAddress, 223 const std::string& destinationAddress, 224 int32_t spi, int32_t markValue, 225 int32_t markMask, 226 int32_t xfrmInterfaceId); 227 228 static netdutils::Status ipSecApplyTransportModeTransform(int socketFd, int32_t transformId, 229 int32_t direction, 230 const std::string& localAddress, 231 const std::string& remoteAddress, 232 int32_t spi); 233 234 static netdutils::Status ipSecRemoveTransportModeTransform(int socketFd); 235 236 static netdutils::Status ipSecAddSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 237 int32_t direction, 238 const std::string& tmplSrcAddress, 239 const std::string& tmplDstAddress, int32_t spi, 240 int32_t markValue, int32_t markMask, 241 int32_t xfrmInterfaceId); 242 243 static netdutils::Status ipSecUpdateSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 244 int32_t direction, 245 const std::string& tmplSrcAddress, 246 const std::string& tmplDstAddress, 247 int32_t spi, int32_t markValue, 248 int32_t markMask, int32_t xfrmInterfaceId); 249 250 static netdutils::Status ipSecDeleteSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 251 int32_t direction, int32_t markValue, 252 int32_t markMask, int32_t xfrmInterfaceId); 253 254 static netdutils::Status ipSecAddTunnelInterface(const std::string& deviceName, 255 const std::string& localAddress, 256 const std::string& remoteAddress, int32_t ikey, 257 int32_t okey, int32_t interfaceId, 258 bool isUpdate); 259 260 static netdutils::Status ipSecRemoveTunnelInterface(const std::string& deviceName); 261 262 void dump(netdutils::DumpWriter& dw); 263 264 // Some XFRM netlink attributes comprise a header, a struct, and some data 265 // after the struct. We wrap all of those in one struct for easier 266 // marshalling. The structs below must be ABI compatible with the kernel and 267 // are composed from kernel structures; thus, they use the kernel naming 268 // convention. 269 270 // Exposed for testing 271 static constexpr size_t MAX_KEY_LENGTH = 128; 272 273 // Container for the content of an XFRMA_ALG_CRYPT netlink attribute. 274 // Exposed for testing 275 struct nlattr_algo_crypt { 276 nlattr hdr; 277 xfrm_algo crypt; 278 uint8_t key[MAX_KEY_LENGTH]; 279 }; 280 281 // Container for the content of an XFRMA_ALG_AUTH_TRUNC netlink attribute. 282 // Exposed for testing 283 struct nlattr_algo_auth { 284 nlattr hdr; 285 xfrm_algo_auth auth; 286 uint8_t key[MAX_KEY_LENGTH]; 287 }; 288 289 // Container for the content of an XFRMA_TMPL netlink attribute. 290 // Exposed for testing 291 struct nlattr_algo_aead { 292 nlattr hdr; 293 xfrm_algo_aead aead; 294 uint8_t key[MAX_KEY_LENGTH]; 295 }; 296 297 // Exposed for testing 298 struct nlattr_user_tmpl { 299 nlattr hdr; 300 xfrm_user_tmpl tmpl; 301 }; 302 303 // Container for the content of an XFRMA_ENCAP netlink attribute. 304 // Exposed for testing 305 struct nlattr_encap_tmpl { 306 nlattr hdr; 307 xfrm_encap_tmpl tmpl; 308 }; 309 310 // Container for the content of an XFRMA_MARK netlink attribute. 311 // Exposed for testing 312 struct nlattr_xfrm_mark { 313 nlattr hdr; 314 xfrm_mark mark; 315 }; 316 317 // Container for the content of an XFRMA_OUTPUT_MARK netlink attribute. 318 // Exposed for testing 319 struct nlattr_xfrm_output_mark { 320 nlattr hdr; 321 __u32 outputMark; 322 }; 323 324 // Container for the content of an XFRMA_IF_ID netlink attribute. 325 // Exposed for testing 326 struct nlattr_xfrm_interface_id { 327 nlattr hdr; 328 __u32 if_id; 329 }; 330 331 // Exposed for testing 332 struct nlattr_payload_u32 { 333 nlattr hdr; 334 uint32_t value; 335 }; 336 337 private: 338 static bool isXfrmIntfSupported(); 339 340 // helper functions for filling in the XfrmCommonInfo (and XfrmSaInfo) structure 341 static netdutils::Status fillXfrmCommonInfo(const std::string& sourceAddress, 342 const std::string& destinationAddress, int32_t spi, 343 int32_t markValue, int32_t markMask, 344 int32_t transformId, int32_t xfrmInterfaceId, 345 XfrmCommonInfo* info); 346 static netdutils::Status fillXfrmCommonInfo(int32_t spi, int32_t markValue, int32_t markMask, 347 int32_t transformId, int32_t xfrmInterfaceId, 348 XfrmCommonInfo* info); 349 350 // Top level functions for managing a Transport Mode Transform 351 static netdutils::Status addTransportModeTransform(const XfrmSaInfo& record); 352 static int removeTransportModeTransform(const XfrmSaInfo& record); 353 354 // TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE 355 // Shared between SA and SP 356 static void fillXfrmSelector(const int record, xfrm_selector* selector); 357 358 // Shared between Transport and Tunnel Mode 359 static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo); 360 static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo); 361 static int fillNlAttrXfrmAlgoAead(const XfrmAlgo& in_algo, nlattr_algo_aead* algo); 362 static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl); 363 364 // Functions for updating a Transport Mode SA 365 static netdutils::Status updateSecurityAssociation(const XfrmSaInfo& record, 366 const XfrmSocket& sock); 367 static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa); 368 369 // Functions for deleting a Transport Mode SA 370 static netdutils::Status deleteSecurityAssociation(const XfrmCommonInfo& record, 371 const XfrmSocket& sock); 372 static int fillUserSaId(const XfrmCommonInfo& record, xfrm_usersa_id* said); 373 static int fillUserTemplate(const XfrmSpInfo& record, xfrm_user_tmpl* tmpl); 374 375 static int fillUserSpInfo(const XfrmSpInfo& record, XfrmDirection direction, 376 xfrm_userpolicy_info* usersp); 377 static int fillNlAttrUserTemplate(const XfrmSpInfo& record, nlattr_user_tmpl* tmpl); 378 static int fillUserPolicyId(const XfrmSpInfo& record, XfrmDirection direction, 379 xfrm_userpolicy_id* policy_id); 380 static int fillNlAttrXfrmMark(const XfrmCommonInfo& record, nlattr_xfrm_mark* mark); 381 static int fillNlAttrXfrmOutputMark(const __u32 underlyingNetId, 382 nlattr_xfrm_output_mark* output_mark); 383 static int fillNlAttrXfrmIntfId(const __u32 intf_id_value, nlattr_xfrm_interface_id* intf_id); 384 385 static netdutils::Status allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi, 386 uint32_t* outSpi, const XfrmSocket& sock); 387 388 static netdutils::Status processSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 389 int32_t direction, 390 const std::string& tmplSrcAddress, 391 const std::string& tmplDstAddress, int32_t spi, 392 int32_t markValue, int32_t markMask, 393 int32_t xfrmInterfaceId, int32_t msgType); 394 static netdutils::Status updateTunnelModeSecurityPolicy(const XfrmSpInfo& record, 395 const XfrmSocket& sock, 396 XfrmDirection direction, 397 uint16_t msgType); 398 static netdutils::Status deleteTunnelModeSecurityPolicy(const XfrmSpInfo& record, 399 const XfrmSocket& sock, 400 XfrmDirection direction); 401 static netdutils::Status flushInterfaces(); 402 static netdutils::Status flushSaDb(const XfrmSocket& s); 403 static netdutils::Status flushPolicyDb(const XfrmSocket& s); 404 405 static netdutils::Status ipSecAddXfrmInterface(const std::string& deviceName, 406 int32_t interfaceId, uint16_t flags); 407 static netdutils::Status ipSecAddVirtualTunnelInterface(const std::string& deviceName, 408 const std::string& localAddress, 409 const std::string& remoteAddress, 410 int32_t ikey, int32_t okey, 411 uint16_t flags); 412 // END TODO(messagerefactor) 413 }; 414 415 } // namespace net 416 } // namespace android 417 418 #endif /* !defined(XFRM_CONTROLLER_H) */ 419