Catcrafts/imsd
Watch
2
0
Fork
You've already forked imsd
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

ipsec: build the SAs from the Security-Server mechanism the UE selects

Browse source 
A P-CSCF may answer the challenge with every mechanism it supports and
attach the SPIs and ports to the one it applied. O2 UK's core lists six
ipsec-3gpp entries with q-values, md5 first, and marks the fourth (sha1,
no ealg). imsd took the first ealg= anywhere in the header - the 3DES of
an entry the P-CSCF had not selected - and installed SAs the far end
could not decrypt: every protected packet after the 401 was dropped at
its IPsec layer, over TCP and UDP alike, with nothing to answer.

The 401 handling now parses the Security-Server as a mechanism list
(commas outside quotes, parameters on semicolons, names and values
case-insensitive) and selects the highest-q ipsec-3gpp mechanism that
matches what Security-Client offered (RFC 3329 2.3.1, TS 24.229
5.1.1.5.1): alg equal to ours, ealg (absent = null) equal to the offer.
The SPIs and ports are per registration and come from the entry carrying
them. When no entry matches the offer, the entry carrying the SPIs is
installed as listed and the journal says so; hmac-md5-96 becomes
hmac(md5) with IK as the key. A single-mechanism header selects itself:
on KPN the SAs are the same as before (unit-pinned argv, verified on the
phone). An answer that cannot be used - no ipsec-3gpp entry, a missing
spi/port, an alg, ealg, prot or mod the kernel cannot be handed - defers
the bring-up on the throttle schedule with the reason, before the AKA is
spent, instead of a fatal that would restart imsd every RestartSec with
an initial REGISTER each time; spi-s=0 stays the throttle deferral.
Repeated Security-Server header lines are joined into the one list
Security-Verify echoes.

The journal shows the Security-Server line, the selected mechanism, the
SA parameters, and any ip xfrm command that fails (keys masked) at every
fresh registration - the silence this bug produced had no line to read.
This commit is contained in:
Jorijn van der Graaf 2026-09-19 21:36:57 +02:00
commit 52736295a1
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
4 changed files with 371 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

221
interfaces/Imsd-Ipsec.cppm
View file

@ -8,12 +8,14 @@ lines, plus a reader for an SA already installed in the kernel.
A registered IMS UE keeps two ESP SA pairs with the P-CSCF (TS 33.203):
reqid 1 carries the UE-initiated client flow (protected client port ⇄ P-CSCF
server port), reqid 2 the terminating server flow. Integrity is HMAC-SHA1-96
keyed with IK; confidentiality is the negotiated ealg keyed with CK. This
module turns the negotiated SPIs/ports/keys into the exact argv lists the
daemon shell hands to `ip`, and — for a warm resume — reconstructs the SPIs,
ports, and Security-Server value back out of `ip xfrm state`/`policy` text so
a refresh re-REGISTER can advertise the SPIs actually in use.
server port), reqid 2 the terminating server flow. Integrity is the negotiated
alg (HMAC-SHA-1-96 or HMAC-MD5-96) keyed with IK; confidentiality is the
negotiated ealg keyed with CK. Both come from the Security-Server mechanism
the P-CSCF selected in its 401 (parsed here), and this module turns the
negotiated SPIs/ports/keys into the exact argv lists the daemon shell hands to
`ip`; for a warm resume it reconstructs the SPIs, ports, and Security-Server
value back out of `ip xfrm state`/`policy` text so a refresh re-REGISTER can
advertise the SPIs actually in use.
Pure std C++ (the shell runs the commands and captures the text). Command
shapes and the parser are pinned by tests/Ipsec.
@ -40,9 +42,36 @@ export namespace imsd::ipsec {
int portUs = imsd::util::PortUs; // UE protected server port
int portPs = 0; // P-CSCF server port (UE connects its TCP here)
int portPc = 0; // P-CSCF client port
std::string alg = "hmac-sha-1-96"; // hmac-sha-1-96 | hmac-md5-96
std::string ealg = "aes-cbc"; // aes-cbc | des-ede3-cbc/3des | null
};
// Kernel name of a TS 33.203 ESP integrity algorithm; nullopt for one we
// cannot install. Both take IK itself as the key: HMAC zero-pads a key
// shorter than its block, so the IK||0x00000000 the spec writes for
// SHA-1 hashes identically to the 128-bit IK handed to the kernel.
std::optional<std::string> KernelAuth(std::string_view alg) {
if (alg == "hmac-sha-1-96") return "hmac(sha1)";
if (alg == "hmac-md5-96") return "hmac(md5)";
return std::nullopt;
}
// Canonical ealg name: absent is the null cipher (RFC 3329 §2.2), "3des"
// (imsd's EALG alias) is des-ede3-cbc. Used on both sides of the
// offer/answer comparison.
std::string NormalizeEalg(std::string_view ealg) {
if (ealg.empty()) return "null";
if (ealg == "3des") return "des-ede3-cbc";
return std::string(ealg);
}
// The ESP ciphers EncArgs can key from CK (canonical names). A P-CSCF
// selecting anything else must be refused by the caller, never
// installed as a silent null.
bool KnownEalg(std::string_view ealg) {
return ealg == "null" || ealg == "aes-cbc" || ealg == "des-ede3-cbc";
}
namespace detail {
// ESP cipher argv triple for `ip xfrm state add ... <enc>`, matching
// imscall.setup_sa: aes-cbc keyed with CK; 3DES uses CK||CK[:8] to
@ -57,13 +86,13 @@ export namespace imsd::ipsec {
return {"enc", "cipher_null", ""};
}
inline std::vector<std::string> StateAdd(std::string_view src, std::string_view dst, std::uint32_t spi, int reqid, std::string_view ikx, const std::vector<std::string>& enc) {
inline std::vector<std::string> StateAdd(std::string_view src, std::string_view dst, std::uint32_t spi, int reqid, std::string_view auth, std::string_view ikx, const std::vector<std::string>& enc) {
std::vector<std::string> a = {
"ip", "xfrm", "state", "add",
"src", std::string(src), "dst", std::string(dst),
"proto", "esp", "spi", std::to_string(spi),
"mode", "transport", "reqid", std::to_string(reqid),
"auth-trunc", "hmac(sha1)", std::string(ikx), "96"};
"auth-trunc", std::string(auth), std::string(ikx), "96"};
a.insert(a.end(), enc.begin(), enc.end());
return a;
}
@ -83,20 +112,23 @@ export namespace imsd::ipsec {
// The full `ip xfrm` argv sequence to install a fresh SA pair: flush
// state+policy, add the four ESP states, add the four transport policies.
// Order matches imscall.setup_sa exactly.
// Order matches imscall.setup_sa exactly. Callers validate p.alg with
// KernelAuth() first; an unknown alg goes to the kernel by its own name
// and is rejected there, never mapped to a default.
std::vector<std::vector<std::string>> BuildSetupCommands(const SaParams& p) {
const std::string& local = p.local;
const std::string& pcscf = p.pcscf;
std::string ikx = std::format("0x{}", imsd::util::ToHex(p.ik));
std::string auth = KernelAuth(p.alg).value_or(p.alg);
std::vector<std::string> enc = detail::EncArgs(p);
int plen = imsd::util::Is6(local) ? 128 : 32;
std::vector<std::vector<std::string>> cmds;
cmds.push_back({"ip", "xfrm", "state", "flush"});
cmds.push_back({"ip", "xfrm", "policy", "flush"});
cmds.push_back(detail::StateAdd(local, pcscf, p.spiPs, 1, ikx, enc));
cmds.push_back(detail::StateAdd(pcscf, local, p.spiUc, 1, ikx, enc));
cmds.push_back(detail::StateAdd(local, pcscf, p.spiPc, 2, ikx, enc));
cmds.push_back(detail::StateAdd(pcscf, local, p.spiUs, 2, ikx, enc));
cmds.push_back(detail::StateAdd(local, pcscf, p.spiPs, 1, auth, ikx, enc));
cmds.push_back(detail::StateAdd(pcscf, local, p.spiUc, 1, auth, ikx, enc));
cmds.push_back(detail::StateAdd(local, pcscf, p.spiPc, 2, auth, ikx, enc));
cmds.push_back(detail::StateAdd(pcscf, local, p.spiUs, 2, auth, ikx, enc));
cmds.push_back(detail::PolicyAdd(local, pcscf, plen, p.portUc, p.portPs, "out", local, pcscf, 1));
cmds.push_back(detail::PolicyAdd(pcscf, local, plen, p.portPs, p.portUc, "in", pcscf, local, 1));
cmds.push_back(detail::PolicyAdd(local, pcscf, plen, p.portUs, p.portPc, "out", local, pcscf, 2));
@ -108,6 +140,169 @@ export namespace imsd::ipsec {
return {{"ip", "xfrm", "state", "flush"}, {"ip", "xfrm", "policy", "flush"}};
}
// ---- Security-Server (RFC 3329 §2.2) -----------------------------------
//
// The P-CSCF answers the challenge with the mechanisms it supports, each
// with a preference, plus the SPIs and ports it assigned to this
// registration. The UE takes the highest-preference mechanism that is
// in that list AND that it offered (RFC 3329 §2.3.1, TS 24.229
// §5.1.1.5.1, TS 33.203 §7.2); imsd offers exactly one combination
// (hmac-sha-1-96 + EALG). The SPIs/ports are per registration, not per
// mechanism: they come from whichever entry carries them (O2 UK's
// Mavenir core lists six entries and puts them on the one it applied).
// imsd ≤ 0.3.5 took the first `ealg=` anywhere in the header and
// installed 3DES against a P-CSCF expecting the null cipher: every
// protected packet was undecryptable to it (alyx, 2026-09-17; journal/ims
// ledger F11).
struct SecurityMechanism {
std::string text; // the mechanism verbatim (trimmed)
std::string name; // mechanism-name, lower-case ("ipsec-3gpp")
std::optional<int> qMilli; // q in thousandths (q=0.94 -> 940)
std::string alg; // lower-case; empty when absent
std::string ealg; // lower-case; empty when absent (= null cipher)
std::string prot; // lower-case; empty when absent (= esp)
std::string mod; // lower-case; empty when absent (= trans)
std::optional<std::uint32_t> spiPc;
std::optional<std::uint32_t> spiPs;
std::optional<int> portPc;
std::optional<int> portPs;
};
struct SecurityServer {
std::vector<SecurityMechanism> mechanisms; // in header order
std::size_t selected = 0; // algorithms: the ipsec-3gpp entry the UE selects
std::size_t carrier = 0; // SPIs/ports: the entry carrying spi-s (== selected when it does)
bool offerMatched = false; // selected is what we offered; false = the fallback below
const SecurityMechanism& Selected() const { return mechanisms[selected]; }
const SecurityMechanism& Carrier() const { return mechanisms[carrier]; }
};
namespace detail {
inline std::string_view TrimWs(std::string_view s) {
auto ws = [](char c) { return c == ' ' || c == '\t' || c == '\r' || c == '\n'; };
while (!s.empty() && ws(s.front())) s.remove_prefix(1);
while (!s.empty() && ws(s.back())) s.remove_suffix(1);
return s;
}
inline std::string Lower(std::string_view s) {
std::string out(s);
for (char& c : out) if (c >= 'A' && c <= 'Z') c = static_cast<char>(c - 'A' + 'a');
return out;
}
// Split on `sep` outside double quotes: a d-qop="auth,auth-int"
// value must not split the mechanism list.
inline std::vector<std::string_view> SplitUnquoted(std::string_view s, char sep) {
std::vector<std::string_view> out;
bool quoted = false;
std::size_t start = 0;
for (std::size_t i = 0; i < s.size(); i++) {
if (s[i] == '"') quoted = !quoted;
else if (s[i] == sep && !quoted) { out.push_back(s.substr(start, i - start)); start = i + 1; }
}
out.push_back(s.substr(start));
return out;
}
// RFC 3261 qvalue ("0" ["." 0*3DIGIT] / "1" ["." 0*3("0")]) in thousandths.
inline std::optional<int> ParseQMilli(std::string_view v) {
std::size_t dot = v.find('.');
std::string_view whole = v.substr(0, dot);
std::string_view frac = dot == std::string_view::npos ? std::string_view{} : v.substr(dot + 1);
if ((whole.empty() && frac.empty()) || whole.size() > 1 || frac.size() > 3) return std::nullopt;
int q = 0;
for (char c : whole) { if (c < '0' || c > '9') return std::nullopt; q = (c - '0') * 1000; }
int scale = 100;
for (char c : frac) { if (c < '0' || c > '9') return std::nullopt; q += (c - '0') * scale; scale /= 10; }
return q;
}
template <class T>
inline std::optional<T> ParseWhole(std::string_view v) {
if (v.empty()) return std::nullopt;
T out{};
auto [p, ec] = std::from_chars(v.data(), v.data() + v.size(), out);
if (ec != std::errc{} || p != v.data() + v.size()) return std::nullopt;
return out;
}
inline std::optional<int> ParsePort(std::string_view v) {
auto p = ParseWhole<int>(v);
if (!p || *p < 1 || *p > 65535) return std::nullopt;
return p;
}
// Index of the highest-q mechanism satisfying `pred` (absent q loses
// to any q; ties keep the earlier entry); nullopt when none does.
template <class Pred>
inline std::optional<std::size_t> Best(const std::vector<SecurityMechanism>& ms, Pred pred) {
std::optional<std::size_t> b;
for (std::size_t i = 0; i < ms.size(); i++) {
if (!pred(ms[i])) continue;
if (!b || ms[i].qMilli.value_or(-1) > ms[*b].qMilli.value_or(-1)) b = i;
}
return b;
}
}
// Parse a Security-Server value and select against our offer. Names,
// parameter names and alg/ealg/prot/mod values are tokens
// (case-insensitive) and come back lower-case. `selected` = the
// highest-q ipsec-3gpp mechanism whose alg (absent = the offered one)
// and ealg (absent = null) equal what we offered; when none matches,
// the highest-q ipsec-3gpp entry carrying spi-s, else port-s, else the
// first ipsec-3gpp entry, with offerMatched = false so the caller can
// say so. `carrier` = selected when it carries spi-s, else the highest-q
// ipsec-3gpp entry that does. nullopt when the value holds no ipsec-3gpp
// mechanism at all.
std::optional<SecurityServer> ParseSecurityServer(std::string_view value, std::string_view offeredAlg, std::string_view offeredEalg) {
SecurityServer ss;
for (std::string_view part : detail::SplitUnquoted(value, ',')) {
part = detail::TrimWs(part);
if (part.empty()) continue;
SecurityMechanism m;
m.text = std::string(part);
bool first = true;
for (std::string_view tok : detail::SplitUnquoted(part, ';')) {
tok = detail::TrimWs(tok);
if (first) { m.name = detail::Lower(tok); first = false; continue; }
if (tok.empty()) continue;
std::size_t eq = tok.find('=');
std::string key = detail::Lower(detail::TrimWs(tok.substr(0, eq)));
std::string_view val = eq == std::string_view::npos ? std::string_view{} : detail::TrimWs(tok.substr(eq + 1));
if (val.size() >= 2 && val.front() == '"' && val.back() == '"') val = val.substr(1, val.size() - 2);
if (key == "q") m.qMilli = detail::ParseQMilli(val);
else if (key == "alg") m.alg = detail::Lower(val);
else if (key == "ealg") m.ealg = detail::Lower(val);
else if (key == "prot") m.prot = detail::Lower(val);
else if (key == "mod") m.mod = detail::Lower(val);
else if (key == "spi-c") m.spiPc = detail::ParseWhole<std::uint32_t>(val);
else if (key == "spi-s") m.spiPs = detail::ParseWhole<std::uint32_t>(val);
else if (key == "port-c") m.portPc = detail::ParsePort(val);
else if (key == "port-s") m.portPs = detail::ParsePort(val);
}
ss.mechanisms.push_back(std::move(m));
}
auto ipsec = [](const SecurityMechanism& m) { return m.name == "ipsec-3gpp"; };
auto carries = [&](const SecurityMechanism& m) { return ipsec(m) && m.spiPs.has_value(); };
std::string wantAlg = detail::Lower(offeredAlg);
std::string wantEalg = NormalizeEalg(detail::Lower(offeredEalg));
auto offered = [&](const SecurityMechanism& m) {
return ipsec(m) && (m.alg.empty() || m.alg == wantAlg) && NormalizeEalg(m.ealg) == wantEalg;
};
auto firstIpsec = std::ranges::find_if(ss.mechanisms, ipsec);
if (firstIpsec == ss.mechanisms.end()) return std::nullopt;
if (auto i = detail::Best(ss.mechanisms, offered)) { ss.selected = *i; ss.offerMatched = true; }
else if (auto i = detail::Best(ss.mechanisms, carries)) ss.selected = *i;
else if (auto i = detail::Best(ss.mechanisms, [&](const SecurityMechanism& m) { return ipsec(m) && m.portPs.has_value(); })) ss.selected = *i;
else ss.selected = static_cast<std::size_t>(firstIpsec - ss.mechanisms.begin());
ss.carrier = ss.selected;
if (!ss.Selected().spiPs) if (auto i = detail::Best(ss.mechanisms, carries)) ss.carrier = *i;
return ss;
}
// What a warm SA in the kernel tells us — enough for a refresh re-REGISTER
// to re-bind without re-authenticating.
struct ExistingSa {