path: root/tinySIP/src/transports/tsip_transport_ipsec.c

/*
* Copyright (C) 2010-2011 Mamadou Diop.
*
* Contact: Mamadou Diop <diopmamadou(at)doubango[dot]org>
*	
* This file is part of Open Source Doubango Framework.
*
* DOUBANGO is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*	
* DOUBANGO is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
* GNU General Public License for more details.
*	
* You should have received a copy of the GNU General Public License
* along with DOUBANGO.
*
*/

/**@file tsip_transport_ipsec.c
 * @brief SIP/IPSec transport.
 *
 * @author Mamadou Diop <diopmamadou(at)doubango[dot]org>
 *

 */
#include "tinysip/transports/tsip_transport_ipsec.h"

#include "tinysip/transports/tsip_transport.h"

#include "tinysip/headers/tsip_header_Proxy_Require.h"
#include "tinysip/headers/tsip_header_Require.h"
#include "tinysip/headers/tsip_header_Security_Client.h"
#include "tinysip/headers/tsip_header_Security_Server.h"

#include "tsip.h"

#include "tnet_socket.h"

#include "tsk_debug.h"

TINYSIP_GEXTERN const tsk_object_def_t *tsip_ipsec_association_def_t;

tsip_ipsec_association_t* tsip_ipsec_association_create(const tsip_transport_t* transport)
{
	return tsk_object_new(tsip_ipsec_association_def_t, transport);
}

tsip_transport_ipsec_t* tsip_transport_ipsec_create(struct tsip_stack_s* stack, const char* host, tnet_port_t port, tnet_socket_type_t type, const char* description)
{
	return tsk_object_new(tsip_transport_ipsec_def_t, stack, host, port, type, description);
}


int tsip_transport_ipsec_createTempSAs(tsip_transport_ipsec_t* self)
{
	int ret = -1;

	/* Check */
	if (!self) {
		TSK_DEBUG_ERROR("Invalid parameter");
		goto bail;
	}
	
	/* Already have temporary SAs ? */
	if (self->asso_temporary) {
		TSK_DEBUG_ERROR("IPSec transport layer already have temporary SAs");
		ret = -2;
		goto bail;
	}

	/* Create temporary association */
	if ((self->asso_temporary = tsip_ipsec_association_create(TSIP_TRANSPORT(self)))) {
		if (self->asso_temporary->ctx && self->asso_temporary->ctx->state == tipsec_state_inbound) {
			ret = 0;
		}
		else {
			TSK_DEBUG_INFO("Failed to create new temporary SAs.");
			ret = -3;
			goto bail;
		}
	}
	else {
		TSK_DEBUG_INFO("Failed to create new temporary SAs.");

		ret = -4;
		goto bail;
	}

bail:

	if (ret && ret != -1) {
		TSK_OBJECT_SAFE_FREE(self->asso_temporary);
	}
	return ret;
}

int tsip_transport_ipsec_ensureTempSAs(tsip_transport_ipsec_t* self, const tsip_response_t *r401_407, int64_t expires)
{
	int ret = -1;
	struct sockaddr_storage to;
	tsk_size_t index;
	const tsip_header_Security_Server_t *ssHdr;
	double maxQ = -2.0; /* The Q value in the SIP header will be equal to -1 by default. */
	int match = 0;


	tipsec_spi_t spi_pc, spi_ps;
	tipsec_port_t port_pc, port_ps;
	tipsec_lifetime_t lifetime;

	if(!self || expires < 0){
		goto bail;
	}

	lifetime = (tipsec_lifetime_t)expires;

	/* Already have temporary SAs ? */
	if(!self->asso_temporary){
		TSK_DEBUG_ERROR("Cannot ensure temporary SAs (No tempSAs)");
		ret = -2;
		goto bail;
	}

	/* Cleanup old Security-Verifies */
	TSK_OBJECT_SAFE_FREE(self->secVerifies);

	/*	RFC 3329 - 2.3.1 Client Initiated
		
		When the client receives a response with a Security-Server header field, it MUST choose the security mechanism in the server's list
		with the highest "q" value among all the mechanisms that are known to the client.
	*/
	for (index = 0; (ssHdr = (const tsip_header_Security_Server_t *)tsip_message_get_headerAt(r401_407, tsip_htype_Security_Server, index)); index++) {
		tsip_header_Security_Verify_t* svHdr;

		if (maxQ > ssHdr->q || !tsk_striequals(ssHdr->mech, "ipsec-3gpp")){
			goto copy;
		}
		
		if ((TIPSEC_ALG_FROM_STR(ssHdr->alg) == self->asso_temporary->ctx->alg) &&
			(TIPSEC_EALG_FROM_STR(ssHdr->ealg) == self->asso_temporary->ctx->ealg) &&
			(TIPSEC_PROTOCOL_FROM_STR(ssHdr->prot) == self->asso_temporary->ctx->protocol) &&
			(TIPSEC_MODE_FROM_STR(ssHdr->mod) == self->asso_temporary->ctx->mode)){
		
			match = 1;

			maxQ = (ssHdr->q >= maxQ) ? ssHdr->q : maxQ;
			spi_pc = ssHdr->spi_c;
			spi_ps = ssHdr->spi_s;
			port_pc = ssHdr->port_c;
			port_ps = ssHdr->port_s;
		}

copy:
		svHdr = tsip_header_Security_Verify_create_null();
		svHdr->mech = tsk_strdup(ssHdr->mech);
		svHdr->alg = tsk_strdup(ssHdr->alg);
		svHdr->prot = tsk_strdup(ssHdr->prot);
		svHdr->mod = tsk_strdup(ssHdr->mod);
		svHdr->ealg = tsk_strdup(ssHdr->ealg);
		svHdr->port_c = ssHdr->port_c;
		svHdr->port_s = ssHdr->port_s;
		svHdr->spi_c = ssHdr->spi_c;
		svHdr->spi_s = ssHdr->spi_s;
		svHdr->q = ssHdr->q;
		TSIP_HEADER_PARAMS(svHdr) = tsk_object_ref(TSIP_HEADER_PARAMS(ssHdr));
		if(!self->secVerifies){
			self->secVerifies = tsk_list_create();
		}
		tsk_list_push_back_data(self->secVerifies, (void**)&svHdr);
	}

	if(!match){
		TSK_DEBUG_ERROR("Failed to match security server<->security client.");
		ret = -3;
		goto bail;
	}

	/* Set remote parameters received from 401/407 response. */
	if((ret = tipsec_ctx_set_remote(self->asso_temporary->ctx, spi_pc, spi_ps, port_pc, port_ps, lifetime))){
		TSK_DEBUG_ERROR("Failed to set remote IPSec parameters [%d]", ret);
		goto bail;
	}

	/* Connect Sockets: port_uc to port_ps*/
	if((ret = tnet_sockaddr_init(self->asso_temporary->ip_remote, self->asso_temporary->ctx->port_ps, TSIP_TRANSPORT(self)->type, &to))){
		TSK_DEBUG_ERROR("Invalid HOST/PORT [%s/%u].", (const char*)self->asso_temporary->ctx->addr_remote, self->asso_temporary->ctx->port_ps);
		goto bail;
	}
	if((ret = tnet_sockfd_connectto(self->asso_temporary->socket_uc->fd, &to))){
		TSK_DEBUG_ERROR("Failed to connect port_uc to port_ps.");
		goto bail;
	}

bail:
	return ret;
}

int tsip_transport_ipsec_startSAs(tsip_transport_ipsec_t* self, const tipsec_key_t* ik, const tipsec_key_t* ck)
{
	int ret = -1;

	if (!self) {
		TSK_DEBUG_ERROR("Invalid parameter");
		goto bail;
	}
	
	if (!self->asso_temporary) {
		TSK_DEBUG_ERROR("Failed to find temporary SAs");
		ret = -2;
		goto bail;
	}

	/* Promote tempSAs (temp => active) */
	TSK_OBJECT_SAFE_FREE(self->asso_active); /* delete old active SAs */
	self->asso_active = tsk_object_ref((void*)self->asso_temporary); /* promote */
	TSK_OBJECT_SAFE_FREE(self->asso_temporary); /* delete old temp SAs */

	if ((ret = tipsec_ctx_set_keys(self->asso_active->ctx, ik, ck)) == 0){
		ret = tipsec_ctx_start(self->asso_active->ctx);
	}

bail:
	return ret;
}

int tsip_transport_ipsec_cleanupSAs(tsip_transport_ipsec_t* self)
{
	int ret = -1;

	if(!self){
		goto bail;
	}

	TSK_OBJECT_SAFE_FREE(self->asso_temporary);
	TSK_OBJECT_SAFE_FREE(self->asso_active);

bail:
	return ret;
}

int tsip_transport_ipsec_updateMSG(tsip_transport_ipsec_t* self, tsip_message_t *msg)
{
	int ret = -1;
	const tsip_ipsec_association_t* asso;

	if (!self) {
		TSK_DEBUG_ERROR("Invalid parameter");
		goto bail;
	}

	asso = (self->asso_temporary && TSIP_REQUEST_IS_REGISTER(msg)) ? self->asso_temporary : self->asso_active;
	if (!asso || !asso->ctx) {
		TSK_DEBUG_ERROR("No IPSec association found.");
		ret = -2;
		goto bail;
	}

	if (TSIP_MESSAGE_IS_RESPONSE(msg)) {
		return 0;
	}

	/* Security-Client, Require, Proxy-Require and Security Verify */
	switch(msg->line.request.request_type) {
		case tsip_BYE:
		case tsip_INVITE:
		case tsip_OPTIONS:
		case tsip_REGISTER:
		case tsip_SUBSCRIBE:
		case tsip_NOTIFY:
		case tsip_REFER:
		case tsip_INFO:
		case tsip_UPDATE:
		case tsip_MESSAGE:
		case tsip_PUBLISH:
		case tsip_PRACK:
			{
				const tsk_list_item_t *item;
				TSIP_MESSAGE_ADD_HEADER(msg, TSIP_HEADER_SECURITY_CLIENT_VA_ARGS("ipsec-3gpp",
						TIPSEC_ALG_TO_STR(asso->ctx->alg),
						TIPSEC_PROTOCOL_TO_STR(asso->ctx->protocol),
						TIPSEC_MODE_TO_STR(asso->ctx->mode),
						TIPSEC_EALG_TO_STR(asso->ctx->ealg),
						asso->ctx->port_uc,
						asso->ctx->port_us,
						asso->ctx->spi_uc,
						asso->ctx->spi_us
					));
				/*	RFC 3329 - 2.3.1 Client Initiated 
					All the subsequent SIP requests sent by the client to that server
					SHOULD make use of the security mechanism initiated in the previous
					step.  These requests MUST contain a Security-Verify header field
					that mirrors the server's list received previously in the Security-
					Server header field.  These requests MUST also have both a Require
					and Proxy-Require header fields with the value "sec-agree".
				*/
				tsk_list_foreach(item, self->secVerifies){
					tsip_message_add_header(msg, (const tsip_header_t*)item->data);
				}
				TSIP_MESSAGE_ADD_HEADER(msg, TSIP_HEADER_REQUIRE_VA_ARGS("sec-agree"));
				TSIP_MESSAGE_ADD_HEADER(msg, TSIP_HEADER_PROXY_REQUIRE_VA_ARGS("sec-agree"));
				break;
			}
            
        default: break;
	}

	ret = 0;

	/* Add Security-Server headers */
bail:
	return ret;
}

tnet_fd_t tsip_transport_ipsec_getFD(tsip_transport_ipsec_t* self, int isRequest)
{
	if (!self) {
		TSK_DEBUG_ERROR("Invalid parameter");
		return TNET_INVALID_FD;
	}

	/* If no active SAs ca be found then use default connection. */
	if (!self->asso_active) {
		return TNET_INVALID_FD;
		// return TSIP_TRANSPORT(self)->connectedFD;
	}

	/*	IPSec ports management
		For more information: http://betelco.blogspot.com/2008/09/ipsec-using-security-agreement-in-3gpp.html
	*/

	if (TNET_SOCKET_TYPE_IS_DGRAM(TSIP_TRANSPORT(self)->type)) {
		/*
			=== UDP ===
			port_uc -> REGISTER -> port_ps
			port_ps <- 200 OK <- port_pc
		*/
			return self->asso_active->socket_uc->fd;
	}
	else {
		/*
			=== TCP ===
			port_uc -> REGISTER -> port_ps
			port_uc <- 200 OK <- port_ps

			port_us <- NOTIFY <- port_pc
			port_us -> 200 OK -> port_pc
		*/
		if (isRequest) {
			return self->asso_active->socket_uc->fd;
		}
		else {
			return self->asso_active->socket_us->fd;
		}
	}

	return TNET_INVALID_FD;
}









//========================================================
//	SIP/IPSec transport object definition
//
static tsk_object_t* tsip_transport_ipsec_ctor(tsk_object_t * self, va_list * app)
{
	tsip_transport_ipsec_t *transport = self;
	if(transport){
		const struct tsip_stack_s *stack = va_arg(*app, const struct tsip_stack_s*);
		const char *host = va_arg(*app, const char*);
#if defined(__GNUC__)
		tnet_port_t port = (tnet_port_t)va_arg(*app, unsigned);
#else
		tnet_port_t port = va_arg(*app, tnet_port_t);
#endif
		tnet_socket_type_t type = va_arg(*app, tnet_socket_type_t);
		const char *description = va_arg(*app, const char*);
		
		/* init base */
		tsip_transport_init(TSIP_TRANSPORT(transport), type, stack, host, port, description);
	}
	return self;
}

static tsk_object_t* tsip_transport_ipsec_dtor(tsk_object_t * self)
{ 
	tsip_transport_ipsec_t *transport = self;
	if(transport){
		/* deinit base */
		tsip_transport_deinit(TSIP_TRANSPORT(transport));

		/* deinit self */
		tsip_transport_ipsec_cleanupSAs(transport);

		TSK_OBJECT_SAFE_FREE(transport->secVerifies);
	}
	return self;
}

static int tsip_transport_ipsec_cmp(const tsk_object_t *obj1, const tsk_object_t *obj2)
{
	const tsip_transport_ipsec_t *transport1 = obj1;
	const tsip_transport_ipsec_t *transport2 = obj2;
	if(transport1 && transport2){
		const char* desc1 = tsip_transport_get_description(TSIP_TRANSPORT(transport1));
		const char* desc2 = tsip_transport_get_description(TSIP_TRANSPORT(transport2));
		return tsk_stricmp(desc1, desc2);
	}
	return -1;
}

static const tsk_object_def_t tsip_transport_ipsec_def_s = 
{
	sizeof(tsip_transport_ipsec_t),
	tsip_transport_ipsec_ctor, 
	tsip_transport_ipsec_dtor,
	tsip_transport_ipsec_cmp, 
};
const tsk_object_def_t *tsip_transport_ipsec_def_t = &tsip_transport_ipsec_def_s;











//=================================================================================================
//	IPSec association object definition
//
static tsk_object_t* tsip_ipsec_association_ctor(tsk_object_t * self, va_list * app)
{
	tsip_ipsec_association_t *association = self;
	if(association){

		const tsip_transport_t* transport = va_arg(*app, const tsip_transport_t *);

		/* Set transport */
		association->transport = transport;

		/* Get local IP and port. */
		tsip_transport_get_ip_n_port(transport, &association->ip_local, &association->port_local);
		
		/* Create IPSec context */
		if (tipsec_ctx_create(
			TIPSEC_IPPROTO_FROM_STR(transport->protocol),
			TNET_SOCKET_TYPE_IS_IPV6(transport->type),
			TIPSEC_MODE_FROM_STR(transport->stack->security.ipsec.mode),
			TIPSEC_EALG_FROM_STR(transport->stack->security.ipsec.ealg),
			TIPSEC_ALG_FROM_STR(transport->stack->security.ipsec.alg),
			TIPSEC_PROTOCOL_FROM_STR(transport->stack->security.ipsec.protocol), &association->ctx))
		{
			TSK_DEBUG_ERROR("Failed to create IPSec context");
			return tsk_null;
		}
		
		/* Create Both client and Server legs */
		association->socket_us = tnet_socket_create(association->ip_local, TNET_SOCKET_PORT_ANY, transport->type);
		association->socket_uc = tnet_socket_create(association->ip_local, TNET_SOCKET_PORT_ANY, transport->type);

		/* Add Both sockets to the network transport */
		tsip_transport_add_socket(transport, association->socket_us->fd, transport->type, 0, 0);
		tsip_transport_add_socket(transport, association->socket_uc->fd, transport->type, 0, 1);
		
		/* Set local */
		if (tnet_get_peerip(transport->connectedFD, &association->ip_remote) == 0) { /* Get remote IP string */
			if (tipsec_ctx_set_local(association->ctx, association->ip_local, association->ip_remote, association->socket_uc->port, association->socket_us->port)) {
				TSK_DEBUG_ERROR("Failed to set IPSec local info:%s,%s,%u,%u", association->ip_local, association->ip_remote, association->socket_uc->port, association->socket_us->port);
				return tsk_null;
			}
		}
		else {
			// Resolve the HostName because "tipsec_ctx_set_local()" requires IP address instead of FQDN.
			if (tnet_resolve(transport->stack->network.proxy_cscf[transport->stack->network.transport_idx_default], 
				transport->stack->network.proxy_cscf_port[transport->stack->network.transport_idx_default], 
				transport->stack->network.proxy_cscf_type[transport->stack->network.transport_idx_default], 
				&association->ip_remote, tsk_null))
			{
				return tsk_null;
			}
			if (tipsec_ctx_set_local(association->ctx, 
				association->ip_local, 
				association->ip_remote, 
				association->socket_uc->port, 
				association->socket_us->port))
			{
				return tsk_null;
			}
		}
	}	 	
	return self;
}

static tsk_object_t* tsip_ipsec_association_dtor(tsk_object_t * self)
{ 
	tsip_ipsec_association_t *association = self;
	if(association){
		TSK_OBJECT_SAFE_FREE(association->ctx);

		/* Remove Both sockets from the network transport and delete them. */
		if(association->socket_uc){
			tsip_transport_remove_socket(association->transport, &association->socket_uc->fd);
			TSK_OBJECT_SAFE_FREE(association->socket_uc);
		}
		if(association->socket_us){
			tsip_transport_remove_socket(association->transport, &association->socket_us->fd);
			TSK_OBJECT_SAFE_FREE(association->socket_us);
		}		
	}
	return self;
}

static int tsip_ipsec_association_cmp(const tsk_object_t *obj1, const tsk_object_t *obj2)
{
	return -1;
}

static const tsk_object_def_t tsip_ipsec_association_def_s = 
{
	sizeof(tsip_ipsec_association_t),
	tsip_ipsec_association_ctor, 
	tsip_ipsec_association_dtor,
	tsip_ipsec_association_cmp, 
};
const tsk_object_def_t *tsip_ipsec_association_def_t = &tsip_ipsec_association_def_s;