1009c84e0e39c5b3c8e8cc437bd21a44613e1734
[strongswan.git] / Source / charon / config / sa_config.c
1 /**
2 * @file sa_config.c
3 *
4 * @brief Implementation of sa_config_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "sa_config.h"
24
25 #include <utils/linked_list.h>
26 #include <utils/allocator.h>
27 #include <utils/identification.h>
28 #include <utils/logger.h>
29
30 typedef struct private_sa_config_t private_sa_config_t;
31
32 /**
33 * Private data of an sa_config_t object
34 */
35 struct private_sa_config_t {
36
37 /**
38 * Public part
39 */
40 sa_config_t public;
41
42 /**
43 * id to use to identify us
44 */
45 identification_t *my_id;
46
47 /**
48 * allowed id for other
49 */
50 identification_t *other_id;
51
52 /**
53 * authentification method to use
54 */
55 auth_method_t auth_method;
56
57 /**
58 * Lifetime of IKE_SA in milliseconds.
59 */
60 u_int32_t ike_sa_lifetime;
61
62 /**
63 * list for all proposals
64 */
65 linked_list_t *proposals;
66
67 /**
68 * list for traffic selectors for initiator site
69 */
70 linked_list_t *ts_initiator;
71
72 /**
73 * list for traffic selectors for responder site
74 */
75 linked_list_t *ts_responder;
76
77 /**
78 * compare two proposals for equality
79 */
80 bool (*proposal_equals) (private_sa_config_t *this, child_proposal_t *first, child_proposal_t *second);
81
82 /**
83 * get_traffic_selectors for both
84 */
85 size_t (*get_traffic_selectors) (private_sa_config_t *,linked_list_t*,traffic_selector_t**[]);
86
87 /**
88 * select_traffic_selectors for both
89 */
90 size_t (*select_traffic_selectors) (private_sa_config_t *,linked_list_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]);
91 };
92
93 /**
94 * Implementation of sa_config_t.get_my_id
95 */
96 static identification_t *get_my_id(private_sa_config_t *this)
97 {
98 return this->my_id;
99 }
100
101 /**
102 * Implementation of sa_config_t.get_other_id
103 */
104 static identification_t *get_other_id(private_sa_config_t *this)
105 {
106 return this->other_id;
107 }
108
109 /**
110 * Implementation of sa_config_t.get_auth_method.
111 */
112 static auth_method_t get_auth_method(private_sa_config_t *this)
113 {
114 return this->auth_method;
115 }
116
117 /**
118 * Implementation of sa_config_t.get_ike_sa_lifetime.
119 */
120 static u_int32_t get_ike_sa_lifetime (private_sa_config_t *this)
121 {
122 return this->ike_sa_lifetime;
123 }
124
125 /**
126 * Implementation of sa_config_t.get_traffic_selectors_initiator
127 */
128 static size_t get_traffic_selectors_initiator(private_sa_config_t *this, traffic_selector_t **traffic_selectors[])
129 {
130 return this->get_traffic_selectors(this, this->ts_initiator, traffic_selectors);
131 }
132
133 /**
134 * Implementation of sa_config_t.get_traffic_selectors_responder
135 */
136 static size_t get_traffic_selectors_responder(private_sa_config_t *this, traffic_selector_t **traffic_selectors[])
137 {
138 return this->get_traffic_selectors(this, this->ts_responder, traffic_selectors);
139 }
140
141 /**
142 * Implementation of private_sa_config_t.get_traffic_selectors
143 */
144 static size_t get_traffic_selectors(private_sa_config_t *this, linked_list_t *ts_list, traffic_selector_t **traffic_selectors[])
145 {
146 iterator_t *iterator;
147 traffic_selector_t *current_ts;
148 int counter = 0;
149 *traffic_selectors = allocator_alloc(sizeof(traffic_selector_t*) * ts_list->get_count(ts_list));
150
151 /* copy all ts from the list in an array */
152 iterator = ts_list->create_iterator(ts_list, TRUE);
153 while (iterator->has_next(iterator))
154 {
155 iterator->current(iterator, (void**)&current_ts);
156 *((*traffic_selectors) + counter) = current_ts->clone(current_ts);
157 counter++;
158 }
159 iterator->destroy(iterator);
160 return counter;
161 }
162
163 /**
164 * Implementation of private_sa_config_t.select_traffic_selectors_initiator
165 */
166 static size_t select_traffic_selectors_initiator(private_sa_config_t *this,traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
167 {
168 return this->select_traffic_selectors(this, this->ts_initiator, supplied, count, selected);
169 }
170
171 /**
172 * Implementation of private_sa_config_t.select_traffic_selectors_responder
173 */
174 static size_t select_traffic_selectors_responder(private_sa_config_t *this,traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
175 {
176 return this->select_traffic_selectors(this, this->ts_responder, supplied, count, selected);
177 }
178 /**
179 * Implementation of private_sa_config_t.select_traffic_selectors
180 */
181 static size_t select_traffic_selectors(private_sa_config_t *this, linked_list_t *ts_list, traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
182 {
183 iterator_t *iterator;
184 traffic_selector_t *current_ts;
185 int i, counter = 0;
186 *selected = allocator_alloc(sizeof(traffic_selector_t*) * ts_list->get_count(ts_list));
187
188 /* iterate over all stored proposals */
189 iterator = ts_list->create_iterator(ts_list, TRUE);
190 while (iterator->has_next(iterator))
191 {
192 iterator->current(iterator, (void**)&current_ts);
193 for (i = 0; i < count; i++)
194 {
195 traffic_selector_t *new_ts;
196 /* compare it */
197 new_ts = current_ts->get_subset(current_ts, supplied[i]);
198 /* match ? */
199 if (new_ts)
200 {
201 *((*selected) + counter) = new_ts;
202 counter++;
203 }
204 }
205 }
206 iterator->destroy(iterator);
207
208 /* free unused space */
209 *selected = allocator_realloc(*selected, sizeof(traffic_selector_t) * counter);
210 return counter;
211 }
212
213 /**
214 * Implementation of sa_config_t.get_proposals
215 */
216 static size_t get_proposals(private_sa_config_t *this, u_int8_t ah_spi[4], u_int8_t esp_spi[4], child_proposal_t **proposals)
217 {
218 iterator_t *iterator;
219 child_proposal_t *current_proposal;
220 int counter = 0;
221 *proposals = allocator_alloc(sizeof(child_proposal_t) * this->proposals->get_count(this->proposals));
222
223 /* copy all proposals from the list in an array */
224 iterator = this->proposals->create_iterator(this->proposals, TRUE);
225 while (iterator->has_next(iterator))
226 {
227 child_proposal_t *new_proposal = (*proposals) + counter;
228 iterator->current(iterator, (void**)&current_proposal);
229 *new_proposal = *current_proposal;
230 memcpy(new_proposal->ah.spi, ah_spi, 4);
231 memcpy(new_proposal->ah.spi, esp_spi, 4);
232 counter++;
233 }
234 iterator->destroy(iterator);
235 return counter;
236 }
237
238 /**
239 * Implementation of sa_config_t.select_proposal
240 */
241 static child_proposal_t *select_proposal(private_sa_config_t *this, u_int8_t ah_spi[4], u_int8_t esp_spi[4], child_proposal_t *supplied, size_t count)
242 {
243 iterator_t *iterator;
244 child_proposal_t *current_proposal, *selected_proposal;
245 int i;
246 /* logger_t *logger = logger_create("SA Config",FULL,FALSE,stdout); */
247
248
249 /* iterate over all stored proposals */
250 iterator = this->proposals->create_iterator(this->proposals, TRUE);
251 while (iterator->has_next(iterator))
252 {
253 iterator->current(iterator, (void**)&current_proposal);
254 /*
255 logger->log(logger,FULL,"ESP integrity algorithm: %s, keylength: %d", mapping_find(integrity_algorithm_m,current_proposal->esp.integrity_algorithm),current_proposal->esp.integrity_algorithm_key_size);
256 logger->log(logger,FULL,"ESP diffie_hellman_group: %s", mapping_find(diffie_hellman_group_m,current_proposal->esp.diffie_hellman_group));
257 logger->log(logger,FULL,"ESP extended_sequence_numbers: %s", mapping_find(extended_sequence_numbers_m,current_proposal->esp.extended_sequence_numbers));
258 logger->log(logger,FULL,"ESP encryption_algorithm: %s keylength: %d", mapping_find(encryption_algorithm_m,current_proposal->esp.encryption_algorithm),current_proposal->esp.encryption_algorithm_key_size);
259 */
260
261
262 /* copy and break if a proposal matches */
263 for (i = 0; i < count; i++)
264 {
265 /* if (supplied[i].esp.is_set)
266 {
267 logger->log(logger,FULL,"ESP integrity algorithm: %s, keylength: %d", mapping_find(integrity_algorithm_m,supplied[i].esp.integrity_algorithm),supplied[i].esp.integrity_algorithm_key_size);
268 logger->log(logger,FULL,"ESP diffie_hellman_group: %s", mapping_find(diffie_hellman_group_m,supplied[i].esp.diffie_hellman_group));
269 logger->log(logger,FULL,"ESP extended_sequence_numbers: %s", mapping_find(extended_sequence_numbers_m,supplied[i].esp.extended_sequence_numbers));
270 logger->log(logger,FULL,"ESP encryption_algorithm: %s keylength: %d", mapping_find(encryption_algorithm_m,supplied[i].esp.encryption_algorithm),supplied[i].esp.encryption_algorithm_key_size);
271 }
272
273 if (supplied[i].ah.is_set)
274 {
275 logger->log(logger,FULL,"AH integrity algorithm: %s, keylength: %d", mapping_find(integrity_algorithm_m,supplied[i].ah.integrity_algorithm),supplied[i].ah.integrity_algorithm_key_size);
276 logger->log(logger,FULL,"AH diffie_hellman_group: %s", mapping_find(diffie_hellman_group_m,supplied[i].ah.diffie_hellman_group));
277 logger->log(logger,FULL,"AH extended_sequence_numbers: %s", mapping_find(extended_sequence_numbers_m,supplied[i].ah.extended_sequence_numbers));
278 }*/
279
280
281 if (this->proposal_equals(this, &(supplied[i]), current_proposal))
282 {
283 selected_proposal = allocator_alloc(sizeof(child_proposal_t));
284 *selected_proposal = *current_proposal;
285 memcpy(selected_proposal->ah.spi, ah_spi, 4);
286 memcpy(selected_proposal->ah.spi, esp_spi, 4);
287 /* logger->destroy(logger);*/
288 iterator->destroy(iterator);
289 return selected_proposal;
290 }
291 }
292 }
293 iterator->destroy(iterator);
294
295 /* logger->destroy(logger); */
296 return NULL;
297 }
298
299
300 /**
301 * Implementation of private_sa_config_t.proposal_equals
302 */
303 static bool proposal_equals(private_sa_config_t *this, child_proposal_t *first, child_proposal_t *second)
304 {
305 /*
306 * Proto ? Mandatory ? Optional
307 * -----------------------------------
308 * ESP ? ENCR ? INTEG, D-H, ESN
309 * AH ? INTEG ? D-H, ESN
310 */
311
312 /* equality defaults to false, so return is FALSE if ah and esp not set */
313 bool equal = FALSE;
314
315 /* check ah, if set */
316 if (first->ah.is_set && second->ah.is_set)
317 {
318 /* integrity alg is mandatory, with key size */
319 if ((first->ah.integrity_algorithm == second->ah.integrity_algorithm) &&
320 (first->ah.integrity_algorithm_key_size == second->ah.integrity_algorithm_key_size))
321 {
322 /* dh group is optional, but must be NOT_SET when not set */
323 if (first->ah.diffie_hellman_group != second->ah.diffie_hellman_group)
324 {
325 return FALSE;
326 }
327 /* sequence numbers is optional, but must be NOT_SET when not set */
328 if (first->ah.extended_sequence_numbers != second->ah.extended_sequence_numbers)
329 {
330 return FALSE;
331 }
332 /* all checked, ah seems ok */
333 equal = TRUE;
334 }
335 else
336 {
337 return FALSE;
338 }
339 }
340 /* check esp, if set */
341 if (first->esp.is_set && second->esp.is_set)
342 {
343 /* encryption alg is mandatory, with key size */
344 if ((first->esp.encryption_algorithm == second->esp.encryption_algorithm) &&
345 (first->esp.encryption_algorithm_key_size == second->esp.encryption_algorithm_key_size))
346 {
347 /* int alg is optional, check key only when not NOT_SET */
348 if (first->esp.integrity_algorithm != second->esp.integrity_algorithm)
349 {
350 return FALSE;
351 }
352 if ((first->esp.integrity_algorithm != AUTH_UNDEFINED) &&
353 (first->esp.integrity_algorithm_key_size != second->esp.integrity_algorithm_key_size))
354 {
355 return FALSE;
356 }
357 /* dh group is optional, but must be NOT_SET when not set */
358 if (first->esp.diffie_hellman_group != second->esp.diffie_hellman_group)
359 {
360 return FALSE;
361 }
362 if (first->esp.extended_sequence_numbers != second->esp.extended_sequence_numbers)
363 {
364 return FALSE;
365 }
366 /* all checked, esp seems ok */
367 equal = TRUE;
368 }
369 else
370 {
371 return FALSE;
372 }
373 }
374 return equal;
375 }
376
377 /**
378 * Implementation of sa_config_t.add_traffic_selector_initiator
379 */
380 static void add_traffic_selector_initiator(private_sa_config_t *this, traffic_selector_t *traffic_selector)
381 {
382 /* clone ts, and add*/
383 this->ts_initiator->insert_last(this->ts_initiator, (void*)traffic_selector->clone(traffic_selector));
384 }
385
386 /**
387 * Implementation of sa_config_t.add_traffic_selector_responder
388 */
389 static void add_traffic_selector_responder(private_sa_config_t *this, traffic_selector_t *traffic_selector)
390 {
391 /* clone ts, and add*/
392 this->ts_responder->insert_last(this->ts_responder, (void*)traffic_selector->clone(traffic_selector));
393 }
394
395 /**
396 * Implementation of sa_config_t.add_proposal
397 */
398 static void add_proposal(private_sa_config_t *this, child_proposal_t *proposal)
399 {
400 /* clone proposal, and add*/
401 child_proposal_t *new_proposal = allocator_alloc_thing(child_proposal_t);
402 *new_proposal = *proposal;
403 this->proposals->insert_last(this->proposals, (void*)new_proposal);
404 }
405
406 /**
407 * Implements sa_config_t.destroy.
408 */
409 static status_t destroy(private_sa_config_t *this)
410 {
411 child_proposal_t *proposal;
412 traffic_selector_t *traffic_selector;
413
414
415 /* delete proposals */
416 while(this->proposals->get_count(this->proposals) > 0)
417 {
418 this->proposals->remove_last(this->proposals, (void**)&proposal);
419 allocator_free(proposal);
420 }
421 this->proposals->destroy(this->proposals);
422
423 /* delete traffic selectors */
424 while(this->ts_initiator->get_count(this->ts_initiator) > 0)
425 {
426 this->ts_initiator->remove_last(this->ts_initiator, (void**)&traffic_selector);
427 traffic_selector->destroy(traffic_selector);
428 }
429 this->ts_initiator->destroy(this->ts_initiator);
430
431 /* delete traffic selectors */
432 while(this->ts_responder->get_count(this->ts_responder) > 0)
433 {
434 this->ts_responder->remove_last(this->ts_responder, (void**)&traffic_selector);
435 traffic_selector->destroy(traffic_selector);
436 }
437 this->ts_responder->destroy(this->ts_responder);
438
439 /* delete ids */
440 this->my_id->destroy(this->my_id);
441 this->other_id->destroy(this->other_id);
442
443 allocator_free(this);
444 return SUCCESS;
445 }
446
447 /*
448 * Described in header-file
449 */
450 sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other_id_type, char *other_id, auth_method_t auth_method, u_int32_t ike_sa_lifetime)
451 {
452 private_sa_config_t *this = allocator_alloc_thing(private_sa_config_t);
453
454 /* public functions */
455 this->public.get_my_id = (identification_t*(*)(sa_config_t*))get_my_id;
456 this->public.get_other_id = (identification_t*(*)(sa_config_t*))get_other_id;
457 this->public.get_auth_method = (auth_method_t(*)(sa_config_t*))get_auth_method;
458 this->public.get_ike_sa_lifetime = (u_int32_t(*)(sa_config_t*))get_ike_sa_lifetime;
459 this->public.get_traffic_selectors_initiator = (size_t(*)(sa_config_t*,traffic_selector_t**[]))get_traffic_selectors_initiator;
460 this->public.select_traffic_selectors_initiator = (size_t(*)(sa_config_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]))select_traffic_selectors_initiator;
461 this->public.get_traffic_selectors_responder = (size_t(*)(sa_config_t*,traffic_selector_t**[]))get_traffic_selectors_responder;
462 this->public.select_traffic_selectors_responder = (size_t(*)(sa_config_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]))select_traffic_selectors_responder;
463 this->public.get_proposals = (size_t(*)(sa_config_t*,u_int8_t[4],u_int8_t[4],child_proposal_t**))get_proposals;
464 this->public.select_proposal = (child_proposal_t*(*)(sa_config_t*,u_int8_t[4],u_int8_t[4],child_proposal_t*,size_t))select_proposal;
465 this->public.add_traffic_selector_initiator = (void(*)(sa_config_t*,traffic_selector_t*))add_traffic_selector_initiator;
466 this->public.add_traffic_selector_responder = (void(*)(sa_config_t*,traffic_selector_t*))add_traffic_selector_responder;
467 this->public.add_proposal = (void(*)(sa_config_t*,child_proposal_t*))add_proposal;
468 this->public.destroy = (void(*)(sa_config_t*))destroy;
469
470
471 /* apply init values */
472 this->my_id = identification_create_from_string(my_id_type, my_id);
473 if (this->my_id == NULL)
474 {
475 allocator_free(this);
476 return NULL;
477 }
478 this->other_id = identification_create_from_string(other_id_type, other_id);
479 if (this->my_id == NULL)
480 {
481 this->other_id->destroy(this->other_id);
482 allocator_free(this);
483 return NULL;
484 }
485
486 /* init private members*/
487 this->proposal_equals = proposal_equals;
488 this->select_traffic_selectors = select_traffic_selectors;
489 this->get_traffic_selectors = get_traffic_selectors;
490 this->proposals = linked_list_create();
491 this->ts_initiator = linked_list_create();
492 this->ts_responder = linked_list_create();
493 this->auth_method = auth_method;
494 this->ike_sa_lifetime = ike_sa_lifetime;
495
496 return (&this->public);
497 }