From 8fce649d9aa3e1b36079e3232213ac761e43ed49 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Thu, 18 Dec 2014 17:32:09 +0100 Subject: [PATCH 01/10] testing: Assert proper ESA deletion Extend the tkm/host2host-initiator testcase by asserting proper ESA deletion after connection shutdown. --- testing/tests/tkm/host2host-initiator/evaltest.dat | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/testing/tests/tkm/host2host-initiator/evaltest.dat b/testing/tests/tkm/host2host-initiator/evaltest.dat index d8d44dff6..de50ab32b 100644 --- a/testing/tests/tkm/host2host-initiator/evaltest.dat +++ b/testing/tests/tkm/host2host-initiator/evaltest.dat @@ -10,3 +10,7 @@ moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES moon::cat /tmp/tkm.log::Adding SA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES +moon::DAEMON_NAME=charon-tkm ipsec down conn1 && sleep 1::no output expected::NO +moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES +moon::cat /tmp/tkm.log::Resetting ESA context 1::YES +moon::cat /tmp/tkm.log::Deleting SA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES From e63cbb367c96e24a70b0012f4d3ea69e0ce52474 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Thu, 18 Dec 2014 16:16:49 +0100 Subject: [PATCH 02/10] charon-tkm: Fix logger entity name in tests.c Change 'test_runner' to 'test-runner'. --- src/charon-tkm/tests/tests.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/charon-tkm/tests/tests.c b/src/charon-tkm/tests/tests.c index 80894a133..669f4d500 100644 --- a/src/charon-tkm/tests/tests.c +++ b/src/charon-tkm/tests/tests.c @@ -1,6 +1,6 @@ /* * Copyright (C) 2013 Tobias Brunner - * Copyright (C) 2012 Reto Buerki + * Copyright (C) 2012-2014 Reto Buerki * Copyright (C) 2012 Adrian-Ken Rueegsegger * Hochschule fuer Technik Rapperswil * @@ -53,7 +53,7 @@ static bool test_runner_init(bool init) libhydra_init(); libcharon_init(); lib->settings->set_int(lib->settings, - "test_runner.filelog.stdout.default", 0); + "test-runner.filelog.stdout.default", 0); charon->load_loggers(charon, NULL, FALSE); /* Register TKM specific plugins */ From fa4f66cba3da0e1ddcff1f764e7147abe6dab22c Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Thu, 18 Dec 2014 16:24:07 +0100 Subject: [PATCH 03/10] charon-tkm: Make CHILD/ESP SA database public Make the CHILD/ESP SA database a public member of the global tkm_t struct. --- src/charon-tkm/src/tkm/tkm.c | 4 +++- src/charon-tkm/src/tkm/tkm.h | 8 +++++++- src/charon-tkm/src/tkm/tkm_kernel_ipsec.c | 25 +++++------------------ 3 files changed, 15 insertions(+), 22 deletions(-) diff --git a/src/charon-tkm/src/tkm/tkm.c b/src/charon-tkm/src/tkm/tkm.c index 61eb6056c..333b699a0 100644 --- a/src/charon-tkm/src/tkm/tkm.c +++ b/src/charon-tkm/src/tkm/tkm.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 Reto Buerki + * Copyright (C) 2012-2014 Reto Buerki * Copyright (C) 2012 Adrian-Ken Rueegsegger * Hochschule fuer Technik Rapperswil * @@ -95,6 +95,7 @@ bool tkm_init() .public = { .idmgr = tkm_id_manager_create(limits), .chunk_map = tkm_chunk_map_create(), + .sad = tkm_kernel_sad_create(), }, ); tkm = &this->public; @@ -114,6 +115,7 @@ void tkm_deinit() private_tkm_t *this = (private_tkm_t*)tkm; this->public.idmgr->destroy(this->public.idmgr); this->public.chunk_map->destroy(this->public.chunk_map); + this->public.sad->destroy(this->public.sad); ees_server_finalize(); diff --git a/src/charon-tkm/src/tkm/tkm.h b/src/charon-tkm/src/tkm/tkm.h index fb5acd117..4aed08602 100644 --- a/src/charon-tkm/src/tkm/tkm.h +++ b/src/charon-tkm/src/tkm/tkm.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 Reto Buerki + * Copyright (C) 2012-2014 Reto Buerki * Copyright (C) 2012 Adrian-Ken Rueegsegger * Hochschule fuer Technik Rapperswil * @@ -72,6 +72,7 @@ #include "tkm_id_manager.h" #include "tkm_chunk_map.h" +#include "tkm_kernel_sad.h" typedef struct tkm_t tkm_t; @@ -90,6 +91,11 @@ struct tkm_t { */ tkm_chunk_map_t *chunk_map; + /** + * CHILD/ESP SA database. + */ + tkm_kernel_sad_t *sad; + }; /** diff --git a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c index da8e0ee64..1cc58e2b9 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c +++ b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 Reto Buerki + * Copyright (C) 2012-2014 Reto Buerki * Copyright (C) 2012 Adrian-Ken Rueegsegger * Hochschule fuer Technik Rapperswil * @@ -26,7 +26,6 @@ #include "tkm_utils.h" #include "tkm_types.h" #include "tkm_keymat.h" -#include "tkm_kernel_sad.h" #include "tkm_kernel_ipsec.h" /** From linux/in.h */ @@ -51,11 +50,6 @@ struct private_tkm_kernel_ipsec_t { */ rng_t *rng; - /** - * CHILD/ESP SA database. - */ - tkm_kernel_sad_t *sad; - }; METHOD(kernel_ipsec_t, get_spi, status_t, @@ -142,7 +136,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t, } esa_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_ESA); - if (!this->sad->insert(this->sad, esa_id, peer, local, spi_loc, protocol)) + if (!tkm->sad->insert(tkm->sad, esa_id, peer, local, spi_loc, protocol)) { DBG1(DBG_KNL, "unable to add entry (%llu) to SAD", esa_id); goto sad_failure; @@ -206,7 +200,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t, return SUCCESS; failure: - this->sad->remove(this->sad, esa_id); + tkm->sad->remove(tkm->sad, esa_id); sad_failure: tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_ESA, esa_id); chunk_free(&esa.nonce_i); @@ -228,7 +222,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t, { esa_id_type esa_id; - esa_id = this->sad->get_esa_id(this->sad, src, dst, spi, protocol); + esa_id = tkm->sad->get_esa_id(tkm->sad, src, dst, spi, protocol); if (esa_id) { DBG1(DBG_KNL, "deleting child SA (esa: %llu, spi: %x)", esa_id, @@ -238,7 +232,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t, DBG1(DBG_KNL, "child SA (%llu) deletion failed", esa_id); return FAILED; } - this->sad->remove(this->sad, esa_id); + tkm->sad->remove(tkm->sad, esa_id); tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_ESA, esa_id); } return SUCCESS; @@ -349,7 +343,6 @@ METHOD(kernel_ipsec_t, destroy, void, private_tkm_kernel_ipsec_t *this) { DESTROY_IF(this->rng); - DESTROY_IF(this->sad); free(this); } @@ -379,15 +372,7 @@ tkm_kernel_ipsec_t *tkm_kernel_ipsec_create() .destroy = _destroy, }, }, - .sad = tkm_kernel_sad_create(), ); - if (!this->sad) - { - DBG1(DBG_KNL, "unable to create SAD"); - destroy(this); - return NULL; - } - return &this->public; } From e1e854bd0c3c1bf2f2eb6c8935daadfb565c61fc Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Thu, 18 Dec 2014 16:49:16 +0100 Subject: [PATCH 04/10] charon-tkm: Store remote SPI in SAD Store the remote instead of the local SPI in the SAD when adding a new entry in the kernel plugin's add_sa() function. Since only one ESA context must be destroyed for an inbound/outbound CHILD SA pair, it does not matter which SPI is used to retrieve it in the del_sa function. --- src/charon-tkm/src/tkm/tkm_kernel_ipsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c index 1cc58e2b9..3f1b0bbf9 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c +++ b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c @@ -136,7 +136,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t, } esa_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_ESA); - if (!tkm->sad->insert(tkm->sad, esa_id, peer, local, spi_loc, protocol)) + if (!tkm->sad->insert(tkm->sad, esa_id, local, peer, spi_rem, protocol)) { DBG1(DBG_KNL, "unable to add entry (%llu) to SAD", esa_id); goto sad_failure; From f5fc592ae1405451dc37ad62a7170d9f7dafba12 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Thu, 18 Dec 2014 17:58:26 +0100 Subject: [PATCH 05/10] charon-tkm: Store reqid in SAD --- src/charon-tkm/src/tkm/tkm_kernel_ipsec.c | 3 ++- src/charon-tkm/src/tkm/tkm_kernel_sad.c | 18 +++++++++++++----- src/charon-tkm/src/tkm/tkm_kernel_sad.h | 8 +++++--- src/charon-tkm/tests/kernel_sad_tests.c | 12 ++++++------ 4 files changed, 26 insertions(+), 15 deletions(-) diff --git a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c index 3f1b0bbf9..a62e2b150 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c +++ b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c @@ -136,7 +136,8 @@ METHOD(kernel_ipsec_t, add_sa, status_t, } esa_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_ESA); - if (!tkm->sad->insert(tkm->sad, esa_id, local, peer, spi_rem, protocol)) + if (!tkm->sad->insert(tkm->sad, reqid, esa_id, local, peer, spi_rem, + protocol)) { DBG1(DBG_KNL, "unable to add entry (%llu) to SAD", esa_id); goto sad_failure; diff --git a/src/charon-tkm/src/tkm/tkm_kernel_sad.c b/src/charon-tkm/src/tkm/tkm_kernel_sad.c index 360a47bdc..3dcecb58c 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_sad.c +++ b/src/charon-tkm/src/tkm/tkm_kernel_sad.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 Reto Buerki + * Copyright (C) 2012-2014 Reto Buerki * Copyright (C) 2012 Adrian-Ken Rueegsegger * Hochschule fuer Technik Rapperswil * @@ -56,6 +56,11 @@ struct sad_entry_t { */ esa_id_type esa_id; + /** + * Reqid. + */ + u_int32_t reqid; + /** * Source address of CHILD SA. */ @@ -119,6 +124,7 @@ static bool sad_entry_equal(sad_entry_t * const left, sad_entry_t * const right) return FALSE; } return left->esa_id == right->esa_id && + left->reqid == right->reqid && left->src->ip_equals(left->src, right->src) && left->dst->ip_equals(left->dst, right->dst) && left->spi == right->spi && left->proto == right->proto; @@ -126,14 +132,15 @@ static bool sad_entry_equal(sad_entry_t * const left, sad_entry_t * const right) METHOD(tkm_kernel_sad_t, insert, bool, private_tkm_kernel_sad_t * const this, const esa_id_type esa_id, - const host_t * const src, const host_t * const dst, const u_int32_t spi, - const u_int8_t proto) + const u_int32_t reqid, const host_t * const src, const host_t * const dst, + const u_int32_t spi, const u_int8_t proto) { status_t result; sad_entry_t *new_entry; INIT(new_entry, .esa_id = esa_id, + .reqid = reqid, .src = (host_t *)src, .dst = (host_t *)dst, .spi = spi, @@ -146,8 +153,9 @@ METHOD(tkm_kernel_sad_t, insert, bool, new_entry); if (result == NOT_FOUND) { - DBG3(DBG_KNL, "inserting SAD entry (esa: %llu, src: %H, dst: %H, " - "spi: %x, proto: %u)", esa_id, src, dst, ntohl(spi), proto); + DBG3(DBG_KNL, "inserting SAD entry (esa: %llu, reqid: %u, src: %H, " + "dst: %H, spi: %x, proto: %u)", esa_id, reqid, src, dst, + ntohl(spi), proto); new_entry->src = src->clone((host_t *)src); new_entry->dst = dst->clone((host_t *)dst); this->data->insert_last(this->data, new_entry); diff --git a/src/charon-tkm/src/tkm/tkm_kernel_sad.h b/src/charon-tkm/src/tkm/tkm_kernel_sad.h index 0194cd3bc..39388f8a8 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_sad.h +++ b/src/charon-tkm/src/tkm/tkm_kernel_sad.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 Reto Buerki + * Copyright (C) 2012-2014 Reto Buerki * Copyright (C) 2012 Adrian-Ken Rueegsegger * Hochschule fuer Technik Rapperswil * @@ -37,6 +37,7 @@ struct tkm_kernel_sad_t { * Insert new SAD entry with specified parameters. * * @param esa_id ESP SA context identifier + * @param reqid reqid of the SA * @param src source address of CHILD SA * @param dst destination address of CHILD SA * @param spi SPI of CHILD SA @@ -44,8 +45,9 @@ struct tkm_kernel_sad_t { * @return TRUE if entry was inserted, FALSE otherwise */ bool (*insert)(tkm_kernel_sad_t * const this, const esa_id_type esa_id, - const host_t * const src, const host_t * const dst, - const u_int32_t spi, const u_int8_t proto); + const u_int32_t reqid, const host_t * const src, + const host_t * const dst, const u_int32_t spi, + const u_int8_t proto); /** * Get ESA id for entry with given parameters. diff --git a/src/charon-tkm/tests/kernel_sad_tests.c b/src/charon-tkm/tests/kernel_sad_tests.c index 6f0b396d3..7eb2ff8e6 100644 --- a/src/charon-tkm/tests/kernel_sad_tests.c +++ b/src/charon-tkm/tests/kernel_sad_tests.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 Reto Buerki + * Copyright (C) 2012-2014 Reto Buerki * Copyright (C) 2012 Adrian-Ken Rueegsegger * Hochschule fuer Technik Rapperswil * @@ -34,7 +34,7 @@ START_TEST(test_insert) host_t *addr = host_create_from_string("127.0.0.1", 1024); tkm_kernel_sad_t *sad = tkm_kernel_sad_create(); - fail_unless(sad->insert(sad, 1, addr, addr, 42, 50), + fail_unless(sad->insert(sad, 1, 2, addr, addr, 42, 50), "Error inserting SAD entry"); sad->destroy(sad); @@ -47,9 +47,9 @@ START_TEST(test_insert_duplicate) host_t *addr = host_create_from_string("127.0.0.1", 1024); tkm_kernel_sad_t *sad = tkm_kernel_sad_create(); - fail_unless(sad->insert(sad, 1, addr, addr, 42, 50), + fail_unless(sad->insert(sad, 1, 2, addr, addr, 42, 50), "Error inserting SAD entry"); - fail_if(sad->insert(sad, 1, addr, addr, 42, 50), + fail_if(sad->insert(sad, 1, 2, addr, addr, 42, 50), "Expected error inserting duplicate entry"); sad->destroy(sad); @@ -61,7 +61,7 @@ START_TEST(test_get_esa_id) { host_t *addr = host_create_from_string("127.0.0.1", 1024); tkm_kernel_sad_t *sad = tkm_kernel_sad_create(); - fail_unless(sad->insert(sad, 23, addr, addr, 42, 50), + fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50), "Error inserting SAD entry"); fail_unless(sad->get_esa_id(sad, addr, addr, 42, 50) == 23, "Error getting esa id"); @@ -85,7 +85,7 @@ START_TEST(test_remove) { host_t *addr = host_create_from_string("127.0.0.1", 1024); tkm_kernel_sad_t *sad = tkm_kernel_sad_create(); - fail_unless(sad->insert(sad, 23, addr, addr, 42, 50), + fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50), "Error inserting SAD entry"); fail_unless(sad->get_esa_id(sad, addr, addr, 42, 50) == 23, "Error getting esa id"); From ba8aefd5f2a79cb1bf491476c8ff861321f58137 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Fri, 19 Dec 2014 08:52:19 +0100 Subject: [PATCH 06/10] charon-tkm: Improve SAD get_esa_id log messages --- src/charon-tkm/src/tkm/tkm_kernel_sad.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/charon-tkm/src/tkm/tkm_kernel_sad.c b/src/charon-tkm/src/tkm/tkm_kernel_sad.c index 3dcecb58c..f8f23a8f8 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_sad.c +++ b/src/charon-tkm/src/tkm/tkm_kernel_sad.c @@ -184,13 +184,13 @@ METHOD(tkm_kernel_sad_t, get_esa_id, esa_id_type, if (res == SUCCESS && entry) { id = entry->esa_id; - DBG3(DBG_KNL, "getting ESA id of SAD entry (esa: %llu, src: %H, " - "dst: %H, spi: %x, proto: %u)", id, src, dst, ntohl(spi), - proto); + DBG3(DBG_KNL, "returning ESA id %llu of SAD entry (src: %H, dst: %H, " + "spi: %x, proto: %u)", id, src, dst, ntohl(spi), proto); } else { - DBG3(DBG_KNL, "no SAD entry found"); + DBG3(DBG_KNL, "no SAD entry found for src %H, dst %H, spi %x, proto %u", + src, dst, ntohl(spi), proto); } this->mutex->unlock(this->mutex); return id; From e12ff07c96a5cb75307c0e51e05cfd8f40e5b004 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Fri, 19 Dec 2014 08:54:22 +0100 Subject: [PATCH 07/10] charon-tkm: Add get_dst_host getter to SAD This function returns the destination host of an SAD entry for given reqid, spi and protocol arguments or NULL if not found. --- src/charon-tkm/src/tkm/tkm_kernel_sad.c | 40 +++++++++++++++++++++++++ src/charon-tkm/src/tkm/tkm_kernel_sad.h | 11 +++++++ src/charon-tkm/tests/kernel_sad_tests.c | 28 +++++++++++++++++ 3 files changed, 79 insertions(+) diff --git a/src/charon-tkm/src/tkm/tkm_kernel_sad.c b/src/charon-tkm/src/tkm/tkm_kernel_sad.c index f8f23a8f8..3394b58af 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_sad.c +++ b/src/charon-tkm/src/tkm/tkm_kernel_sad.c @@ -113,6 +113,19 @@ static bool sad_entry_match(sad_entry_t * const entry, const host_t * const src, entry->spi == *spi && entry->proto == *proto; } +/** + * Find a list entry with given reqid, spi and proto values. + */ +static bool sad_entry_match_dst(sad_entry_t * const entry, + const u_int32_t * const reqid, + const u_int32_t * const spi, + const u_int8_t * const proto) +{ + return entry->reqid == *reqid && + entry->spi == *spi && + entry->proto == *proto; +} + /** * Compare two SAD entries for equality. */ @@ -196,6 +209,32 @@ METHOD(tkm_kernel_sad_t, get_esa_id, esa_id_type, return id; } +METHOD(tkm_kernel_sad_t, get_dst_host, host_t *, + private_tkm_kernel_sad_t * const this, const u_int32_t reqid, + const u_int32_t spi, const u_int8_t proto) +{ + host_t *dst = NULL; + sad_entry_t *entry = NULL; + + this->mutex->lock(this->mutex); + const status_t res = this->data->find_first(this->data, + (linked_list_match_t)sad_entry_match_dst, + (void**)&entry, &reqid, &spi, &proto); + if (res == SUCCESS && entry) + { + dst = entry->dst; + DBG3(DBG_KNL, "returning destination host %H of SAD entry (reqid: %u," + " spi: %x, proto: %u)", dst, reqid, ntohl(spi), proto); + } + else + { + DBG3(DBG_KNL, "no SAD entry found for reqid %u, spi %x, proto: %u", + reqid, ntohl(spi), proto); + } + this->mutex->unlock(this->mutex); + return dst; +} + METHOD(tkm_kernel_sad_t, _remove, bool, private_tkm_kernel_sad_t * const this, const esa_id_type esa_id) { @@ -250,6 +289,7 @@ tkm_kernel_sad_t *tkm_kernel_sad_create() .public = { .insert = _insert, .get_esa_id = _get_esa_id, + .get_dst_host = _get_dst_host, .remove = __remove, .destroy = _destroy, }, diff --git a/src/charon-tkm/src/tkm/tkm_kernel_sad.h b/src/charon-tkm/src/tkm/tkm_kernel_sad.h index 39388f8a8..38b19dd01 100644 --- a/src/charon-tkm/src/tkm/tkm_kernel_sad.h +++ b/src/charon-tkm/src/tkm/tkm_kernel_sad.h @@ -62,6 +62,17 @@ struct tkm_kernel_sad_t { const host_t * const src, const host_t * const dst, const u_int32_t spi, const u_int8_t proto); + /** + * Get destination host for entry with given parameters. + * + * @param reqid reqid of CHILD SA + * @param spi SPI of CHILD SA + * @param proto protocol of CHILD SA (ESP/AH) + * @return destination host of entry if found, NULL otherwise + */ + host_t * (*get_dst_host)(tkm_kernel_sad_t * const this, + const u_int32_t reqid, const u_int32_t spi, const u_int8_t proto); + /** * Remove entry with given ESA id from SAD. * diff --git a/src/charon-tkm/tests/kernel_sad_tests.c b/src/charon-tkm/tests/kernel_sad_tests.c index 7eb2ff8e6..b9ab3cb5e 100644 --- a/src/charon-tkm/tests/kernel_sad_tests.c +++ b/src/charon-tkm/tests/kernel_sad_tests.c @@ -81,6 +81,29 @@ START_TEST(test_get_esa_id_nonexistent) } END_TEST +START_TEST(test_get_dst_host) +{ + host_t *addr = host_create_from_string("127.0.0.1", 1024); + tkm_kernel_sad_t *sad = tkm_kernel_sad_create(); + fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50), + "Error inserting SAD entry"); + + host_t *dst = sad->get_dst_host(sad, 54, 42, 50); + fail_unless(addr->equals(addr, dst), "Error getting dst host"); + sad->destroy(sad); + addr->destroy(addr); +} +END_TEST + +START_TEST(test_get_dst_host_nonexistent) +{ + tkm_kernel_sad_t *sad = tkm_kernel_sad_create(); + fail_unless(sad->get_dst_host(sad, 1, 12, 50) == NULL, + "Got dst for nonexistent SAD entry"); + sad->destroy(sad); +} +END_TEST + START_TEST(test_remove) { host_t *addr = host_create_from_string("127.0.0.1", 1024); @@ -128,6 +151,11 @@ Suite *make_kernel_sad_tests() tcase_add_test(tc, test_get_esa_id_nonexistent); suite_add_tcase(s, tc); + tc = tcase_create("get_dst_host"); + tcase_add_test(tc, test_get_dst_host); + tcase_add_test(tc, test_get_dst_host_nonexistent); + suite_add_tcase(s, tc); + tc = tcase_create("remove"); tcase_add_test(tc, test_remove); tcase_add_test(tc, test_remove_nonexistent); From 3fb42bc87f68970916f2d8d64026462446879f4b Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Fri, 19 Dec 2014 09:11:12 +0100 Subject: [PATCH 08/10] charon-tkm: Use get_dst_host getter in EES callback Use the new get_dst_host getter to retrieve the destination host from the SAD using the reqid, spi and protocol values received from the xfrm-proxy. --- src/charon-tkm/src/ees/ees_callbacks.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/src/charon-tkm/src/ees/ees_callbacks.c b/src/charon-tkm/src/ees/ees_callbacks.c index 8650947f8..74c0d3618 100644 --- a/src/charon-tkm/src/ees/ees_callbacks.c +++ b/src/charon-tkm/src/ees/ees_callbacks.c @@ -19,11 +19,12 @@ #include #include +#include "tkm.h" #include "ees_callbacks.h" void charon_esa_acquire(result_type *res, const sp_id_type sp_id) { - DBG1(DBG_KNL, "ees: acquire received for reqid {%d}", sp_id); + DBG1(DBG_KNL, "ees: acquire received for reqid %u", sp_id); hydra->kernel_interface->acquire(hydra->kernel_interface, sp_id, NULL, NULL); *res = TKM_OK; @@ -33,10 +34,19 @@ void charon_esa_expire(result_type *res, const sp_id_type sp_id, const esp_spi_type spi_rem, const protocol_type protocol, const expiry_flag_type hard) { - host_t *dst = NULL; + host_t *dst; - DBG1(DBG_KNL, "ees: expire received for reqid {%d}", sp_id); + dst = tkm->sad->get_dst_host(tkm->sad, sp_id, spi_rem, protocol); + *res = TKM_OK; + if (dst == NULL) + { + DBG3(DBG_KNL, "ees: destination host not found for reqid %u, spi %x, " + "proto %u", sp_id, ntohl(spi_rem), protocol); + return; + } + + DBG1(DBG_KNL, "ees: expire received for reqid %u, spi %x, dst %H", sp_id, + ntohl(spi_rem), dst); hydra->kernel_interface->expire(hydra->kernel_interface, protocol, spi_rem, dst, hard != 0); - *res = TKM_OK; } From 03409ac7a0b5033d555282b8101f2f91b0731239 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Thu, 18 Dec 2014 10:43:42 +0100 Subject: [PATCH 09/10] testing: Assert ees acquire messages in xfrmproxy tests --- testing/tests/tkm/host2host-xfrmproxy/evaltest.dat | 1 + testing/tests/tkm/net2net-xfrmproxy/evaltest.dat | 1 + 2 files changed, 2 insertions(+) diff --git a/testing/tests/tkm/host2host-xfrmproxy/evaltest.dat b/testing/tests/tkm/host2host-xfrmproxy/evaltest.dat index 7c8c6b24a..f5143f19a 100644 --- a/testing/tests/tkm/host2host-xfrmproxy/evaltest.dat +++ b/testing/tests/tkm/host2host-xfrmproxy/evaltest.dat @@ -5,6 +5,7 @@ sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES diff --git a/testing/tests/tkm/net2net-xfrmproxy/evaltest.dat b/testing/tests/tkm/net2net-xfrmproxy/evaltest.dat index a38dba0ee..98eff247f 100644 --- a/testing/tests/tkm/net2net-xfrmproxy/evaltest.dat +++ b/testing/tests/tkm/net2net-xfrmproxy/evaltest.dat @@ -5,6 +5,7 @@ sun::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES moon::cat /tmp/tkm.log::Adding policy \[ 1, 10.1.0.0/16 > 192.168.0.1 <=> 192.168.0.2 < 10.2.0.0/16 \]::YES moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES From 65566c37caec653bd91f488083f95387e9fbc1f3 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Thu, 18 Dec 2014 11:49:05 +0100 Subject: [PATCH 10/10] testing: Add tkm xfrmproxy-expire test This test asserts that the handling of XFRM expire messages from the kernel are handled correctly by the xfrm-proxy and the Esa Event Service (EES) in charon-tkm. --- .../tkm/xfrmproxy-expire/description.txt | 6 +++++ .../tests/tkm/xfrmproxy-expire/evaltest.dat | 22 ++++++++++++++++++ .../hosts/moon/etc/strongswan.conf | 8 +++++++ .../hosts/moon/etc/tkm/moonKey.der | Bin 0 -> 1191 bytes .../hosts/moon/etc/tkm/strongswanCert.der | Bin 0 -> 956 bytes .../hosts/moon/etc/tkm/tkm.conf | 21 +++++++++++++++++ .../xfrmproxy-expire/hosts/sun/etc/ipsec.conf | 21 +++++++++++++++++ .../hosts/sun/etc/strongswan.conf | 5 ++++ .../tests/tkm/xfrmproxy-expire/posttest.dat | 5 ++++ .../tests/tkm/xfrmproxy-expire/pretest.dat | 12 ++++++++++ testing/tests/tkm/xfrmproxy-expire/test.conf | 21 +++++++++++++++++ 11 files changed, 121 insertions(+) create mode 100644 testing/tests/tkm/xfrmproxy-expire/description.txt create mode 100644 testing/tests/tkm/xfrmproxy-expire/evaltest.dat create mode 100644 testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/moonKey.der create mode 100644 testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/strongswanCert.der create mode 100644 testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/tkm.conf create mode 100644 testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/ipsec.conf create mode 100644 testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/strongswan.conf create mode 100644 testing/tests/tkm/xfrmproxy-expire/posttest.dat create mode 100644 testing/tests/tkm/xfrmproxy-expire/pretest.dat create mode 100644 testing/tests/tkm/xfrmproxy-expire/test.conf diff --git a/testing/tests/tkm/xfrmproxy-expire/description.txt b/testing/tests/tkm/xfrmproxy-expire/description.txt new file mode 100644 index 000000000..9578cd8f3 --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/description.txt @@ -0,0 +1,6 @@ +A transport connection between the hosts moon and sun is set up. +The host moon starts the Trusted Key Manager (TKM) and the Ada XFRM +proxy, which relays XFRM kernel messages to charon. The authentication is based +on X.509 certificates. The connection is initiated by a ping from moon +to sun. The test asserts that XFRM expire messages from the kernel are +handled correctly. diff --git a/testing/tests/tkm/xfrmproxy-expire/evaltest.dat b/testing/tests/tkm/xfrmproxy-expire/evaltest.dat new file mode 100644 index 000000000..96b486a07 --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/evaltest.dat @@ -0,0 +1,22 @@ +moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES +sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES +moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES +sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES +moon::cat /var/log/daemon.log::ees: expire received for reqid 1, spi.*, dst 192.168.0.2::YES +moon::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES +moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES +moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES +moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES +moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES +moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES +moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES +moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Dh_Id 1, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES +moon::cat /tmp/tkm.log | grep 'Adding SA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 2, hard 60 \]' | wc -l::2::YES +moon::cat /tmp/tkm.log::Resetting ESA context 1::YES +moon::cat /tmp/tkm.log::Deleting SA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES +moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES +moon::cat /tmp/xfrm_proxy.log::Initiating ESA expire (reqid 1, proto 50, SPI.*, hard FALSE)::YES diff --git a/testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/strongswan.conf b/testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..cc9d6e072 --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/strongswan.conf @@ -0,0 +1,8 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon-tkm { + dh_mapping { + 15 = 1 + 16 = 2 + } +} diff --git a/testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/moonKey.der b/testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/moonKey.der new file mode 100644 index 0000000000000000000000000000000000000000..d3748930a7da99c460214bae2eedf2d58d011de0 GIT binary patch literal 1191 zcmV;Y1X%kpf&`-i0RRGm0RaG{dhq;DHNNyXk+g2SP10pz-}d5!ZX^}-fB~=0%k+>hYo3H0fFe-KhVf{#Rk8{q z6eVTP653)g0c{C$p(dV!Z}vWg{?$YG?yB$B*P(tUHAFmNsr5=!aKU zg`u9IZmDf7DZD)e&O{2N17$cW|K+)DR~eg}ckLtl1_t#I7>1?ibCDD1;8$OgE21=@ z0v3oWRN97VV8AV>wXr&QEC7~75yrqLO1I0TV z^mG+CxWmlkKE8dnUOwPZAtS)K0)c@5*hXNw?8$c&NLUo7BP{6)H|m=~Aj!I3F5*>x zHKl7zidc?-c(_(_zq_N=1oCi@9arBXxFcFiBXjh*797I$HWD6_+VL~sd9=_gg>jt! zP?8_lMv`L+s0s2-jAB=ZV-~&uq%Z$&ayAm(qX`X1NR-w_;%S6QF#Q&a048(=0)c@5 z!m?gta=>c?q-s({FjVa=dn#m4bxd3gx75&|JggXf(ChC_`mCu-l7f29xzp;PuK-m> zWKDBevC35FKX7yera3r2!NAOQFZ|Lwe0w8?Lu$aT-+Z>ZL5p!zv9A=*OlMv3_(X|Q zwFoubGfzK}Cy;ASJtxfKV{<;>(A3{KCP)z7P| zFWi{5=Xc&KHp;JLZmi6myO05bk%yoj^aIhm0(Krd$a)yvr3)XN)UWvRWH1toJAEDZ4?<WeaP3qCjNe!i8&xoYjClnj9{Oy<~0Uu)pa zIqlTCe_|Y*k8t zNrNw+8fCkXXBpCzo&!&pII!KwF;kq^9!$Rifq;9R0iy4Uf+(aKSj_7R*y}`}qfqTE z2hbA4Qt3y^#)qk?`JhZ@Ggjtd=&vw0J%&9PEpRyQypSC{c)T7>zjVm_x)d9wYYO&n zp~Mbd@8|6}F2D%MkGG!_o<_^bR}B#j$deD&_@CU}q94bQ)C8aMPyT{%O_DUFVI+`H FH`OpGI1&H= literal 0 HcmV?d00001 diff --git a/testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/strongswanCert.der b/testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/strongswanCert.der new file mode 100644 index 0000000000000000000000000000000000000000..a5a631f4b5f8b29a990ab4b075e44e0d961c6286 GIT binary patch literal 956 zcmXqLV%}lU#I#@mGZP~d6C;BGFB_*;n@8JsUPeZ4Rt5uCLv903Hs(+kHen`b4?{@< zaS(?~SimPUue3s;xTGjQFFm+CG0#xiKoTUyEG&c&R0zt?FHvxIG>{YLH83%-G&C?Y zFfcTDv^20ZFo$xfWla;K60!#vSs9p{82K3tni#p5niv@w_J4{`dSx4y7qR(7 zmFKC?YZA||OfE0>ZPDHQ<8R&qVr3m&D^Z!e>5hr^J|7ip;*q&X7;J9nJMy%`F{u86ZU_r zKi%fNl%kd_PMW94}Puv*8AYCiO2emHylag=VxMO zWMEv}xXGY#y@3!gwq%7F8UM3z7_b2;CPqdBZjcy13kxtYuo=jLID9N(EF!VX?-sBH z8r41Dmb-cD(+3H!^nBkN;%VE(+*PTKbXwG3(qzs@zZJ zGO5X|urkr(i+z5@#=OMO{@h~8a)ncZEmz)8dA9F0uZpn zO<5(yvOZRAu^X3LC!@PVa?^LSM*f5(vbm~p5 zWc{Ll0keeWtb7-8Uz_hvj;%$Qzkq7qpBwv{HoZxiUT2jb_hH7X + + moon.strongswan.org + moonCert.pem + + + transport + + 1 + 192.168.0.1 + + + sun.strongswan.org + 192.168.0.2 + + + 2 + 60 + + + diff --git a/testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/ipsec.conf b/testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/ipsec.conf new file mode 100644 index 000000000..e52a04f42 --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=sun.strongswan.org + right=PH_IP_MOON + rightid=moon.strongswan.org + ike=aes256-sha512-modp4096! + esp=aes256-sha512-modp4096! + type=transport + auto=add diff --git a/testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/strongswan.conf b/testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/strongswan.conf new file mode 100644 index 000000000..f585edfca --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown +} diff --git a/testing/tests/tkm/xfrmproxy-expire/posttest.dat b/testing/tests/tkm/xfrmproxy-expire/posttest.dat new file mode 100644 index 000000000..99efe7b00 --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/posttest.dat @@ -0,0 +1,5 @@ +moon::DAEMON_NAME=charon-tkm ipsec stop +moon::killall xfrm_proxy +moon::killall tkm_keymanager +moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log +sun::ipsec stop diff --git a/testing/tests/tkm/xfrmproxy-expire/pretest.dat b/testing/tests/tkm/xfrmproxy-expire/pretest.dat new file mode 100644 index 000000000..d645ddbfe --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/pretest.dat @@ -0,0 +1,12 @@ +sun::ipsec start +moon::rm /etc/ipsec.secrets +moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd +moon::cat /etc/ipsec.conf +moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der >/tmp/tkm.log 2>&1 & +moon::expect-file /tmp/tkm.rpc.ike +moon::DAEMON_NAME=charon-tkm ipsec start +moon::expect-file /tmp/tkm.rpc.ees +moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 & +moon::DAEMON_NAME=charon-tkm expect-connection conn1 +sun::expect-connection host-host +moon::ping -c 3 192.168.0.2 diff --git a/testing/tests/tkm/xfrmproxy-expire/test.conf b/testing/tests/tkm/xfrmproxy-expire/test.conf new file mode 100644 index 000000000..9647dc6a2 --- /dev/null +++ b/testing/tests/tkm/xfrmproxy-expire/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun"