- changed config values
[strongswan.git] / Source / charon / config / sa_config.c
1 /**
2 * @file sa_config.c
3 *
4 * @brief Implementation of sa_config_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "sa_config.h"
24
25 #include <utils/linked_list.h>
26 #include <utils/allocator.h>
27 #include <utils/identification.h>
28
29 typedef struct private_sa_config_t private_sa_config_t;
30
31 /**
32 * Private data of an sa_config_t object
33 */
34 struct private_sa_config_t {
35
36 /**
37 * Public part
38 */
39 sa_config_t public;
40
41 /**
42 * id to use to identify us
43 */
44 identification_t *my_id;
45
46 /**
47 * allowed id for other
48 */
49 identification_t *other_id;
50
51 /**
52 * authentification method to use
53 */
54 auth_method_t auth_method;
55
56 /**
57 * Lifetime of IKE_SA in milliseconds.
58 */
59 u_int32_t ike_sa_lifetime;
60
61 /**
62 * list for all proposals
63 */
64 linked_list_t *proposals;
65
66 /**
67 * list for traffic selectors for initiator site
68 */
69 linked_list_t *ts_initiator;
70
71 /**
72 * list for traffic selectors for responder site
73 */
74 linked_list_t *ts_responder;
75
76 /**
77 * compare two proposals for equality
78 */
79 bool (*proposal_equals) (private_sa_config_t *this, child_proposal_t *first, child_proposal_t *second);
80
81 /**
82 * get_traffic_selectors for both
83 */
84 size_t (*get_traffic_selectors) (private_sa_config_t *,linked_list_t*,traffic_selector_t**[]);
85
86 /**
87 * select_traffic_selectors for both
88 */
89 size_t (*select_traffic_selectors) (private_sa_config_t *,linked_list_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]);
90 };
91
92 /**
93 * Implementation of sa_config_t.get_my_id
94 */
95 static identification_t *get_my_id(private_sa_config_t *this)
96 {
97 return this->my_id;
98 }
99
100 /**
101 * Implementation of sa_config_t.get_other_id
102 */
103 static identification_t *get_other_id(private_sa_config_t *this)
104 {
105 return this->other_id;
106 }
107
108 /**
109 * Implementation of sa_config_t.get_auth_method.
110 */
111 static auth_method_t get_auth_method(private_sa_config_t *this)
112 {
113 return this->auth_method;
114 }
115
116 /**
117 * Implementation of sa_config_t.get_ike_sa_lifetime.
118 */
119 static u_int32_t get_ike_sa_lifetime (private_sa_config_t *this)
120 {
121 return this->ike_sa_lifetime;
122 }
123
124 /**
125 * Implementation of sa_config_t.get_traffic_selectors_initiator
126 */
127 static size_t get_traffic_selectors_initiator(private_sa_config_t *this, traffic_selector_t **traffic_selectors[])
128 {
129 return this->get_traffic_selectors(this, this->ts_initiator, traffic_selectors);
130 }
131
132 /**
133 * Implementation of sa_config_t.get_traffic_selectors_responder
134 */
135 static size_t get_traffic_selectors_responder(private_sa_config_t *this, traffic_selector_t **traffic_selectors[])
136 {
137 return this->get_traffic_selectors(this, this->ts_responder, traffic_selectors);
138 }
139
140 /**
141 * Implementation of private_sa_config_t.get_traffic_selectors
142 */
143 static size_t get_traffic_selectors(private_sa_config_t *this, linked_list_t *ts_list, traffic_selector_t **traffic_selectors[])
144 {
145 iterator_t *iterator;
146 traffic_selector_t *current_ts;
147 int counter = 0;
148 *traffic_selectors = allocator_alloc(sizeof(traffic_selector_t*) * ts_list->get_count(ts_list));
149
150 /* copy all ts from the list in an array */
151 iterator = ts_list->create_iterator(ts_list, TRUE);
152 while (iterator->has_next(iterator))
153 {
154 iterator->current(iterator, (void**)&current_ts);
155 *((*traffic_selectors) + counter) = current_ts->clone(current_ts);
156 counter++;
157 }
158 iterator->destroy(iterator);
159 return counter;
160 }
161
162 /**
163 * Implementation of private_sa_config_t.select_traffic_selectors_initiator
164 */
165 static size_t select_traffic_selectors_initiator(private_sa_config_t *this,traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
166 {
167 return this->select_traffic_selectors(this, this->ts_initiator, supplied, count, selected);
168 }
169
170 /**
171 * Implementation of private_sa_config_t.select_traffic_selectors_responder
172 */
173 static size_t select_traffic_selectors_responder(private_sa_config_t *this,traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
174 {
175 return this->select_traffic_selectors(this, this->ts_responder, supplied, count, selected);
176 }
177 /**
178 * Implementation of private_sa_config_t.select_traffic_selectors
179 */
180 static size_t select_traffic_selectors(private_sa_config_t *this, linked_list_t *ts_list, traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
181 {
182 iterator_t *iterator;
183 traffic_selector_t *current_ts;
184 int i, counter = 0;
185 *selected = allocator_alloc(sizeof(traffic_selector_t*) * ts_list->get_count(ts_list));
186
187 /* iterate over all stored proposals */
188 iterator = ts_list->create_iterator(ts_list, TRUE);
189 while (iterator->has_next(iterator))
190 {
191 iterator->current(iterator, (void**)&current_ts);
192 for (i = 0; i < count; i++)
193 {
194 traffic_selector_t *new_ts;
195 /* compare it */
196 new_ts = current_ts->get_subset(current_ts, supplied[i]);
197 /* match ? */
198 if (new_ts)
199 {
200 *((*selected) + counter) = new_ts;
201 counter++;
202 }
203 }
204 }
205 iterator->destroy(iterator);
206
207 /* free unused space */
208 *selected = allocator_realloc(*selected, sizeof(traffic_selector_t) * counter);
209 return counter;
210 }
211
212 /**
213 * Implementation of sa_config_t.get_proposals
214 */
215 static size_t get_proposals(private_sa_config_t *this, u_int8_t ah_spi[4], u_int8_t esp_spi[4], child_proposal_t **proposals)
216 {
217 iterator_t *iterator;
218 child_proposal_t *current_proposal;
219 int counter = 0;
220 *proposals = allocator_alloc(sizeof(child_proposal_t) * this->proposals->get_count(this->proposals));
221
222 /* copy all proposals from the list in an array */
223 iterator = this->proposals->create_iterator(this->proposals, TRUE);
224 while (iterator->has_next(iterator))
225 {
226 child_proposal_t *new_proposal = (*proposals) + counter;
227 iterator->current(iterator, (void**)&current_proposal);
228 *new_proposal = *current_proposal;
229 memcpy(new_proposal->ah.spi, ah_spi, 4);
230 memcpy(new_proposal->ah.spi, esp_spi, 4);
231 counter++;
232 }
233 iterator->destroy(iterator);
234 return counter;
235 }
236
237 /**
238 * Implementation of sa_config_t.select_proposal
239 */
240 static child_proposal_t *select_proposal(private_sa_config_t *this, u_int8_t ah_spi[4], u_int8_t esp_spi[4], child_proposal_t *supplied, size_t count)
241 {
242 iterator_t *iterator;
243 child_proposal_t *current_proposal, *selected_proposal;
244 int i;
245
246 /* iterate over all stored proposals */
247 iterator = this->proposals->create_iterator(this->proposals, TRUE);
248 while (iterator->has_next(iterator))
249 {
250 iterator->current(iterator, (void**)&current_proposal);
251 /* copy and break if a proposal matches */
252 for (i = 0; i < count; i++)
253 {
254 if (this->proposal_equals(this, &(supplied[i]), current_proposal))
255 {
256 selected_proposal = allocator_alloc(sizeof(child_proposal_t));
257 *selected_proposal = *current_proposal;
258 memcpy(selected_proposal->ah.spi, ah_spi, 4);
259 memcpy(selected_proposal->ah.spi, esp_spi, 4);
260 iterator->destroy(iterator);
261 return selected_proposal;
262 }
263 }
264 }
265 iterator->destroy(iterator);
266 return NULL;
267 }
268
269
270 /**
271 * Implementation of private_sa_config_t.proposal_equals
272 */
273 static bool proposal_equals(private_sa_config_t *this, child_proposal_t *first, child_proposal_t *second)
274 {
275 /*
276 * Proto ? Mandatory ? Optional
277 * -----------------------------------
278 * ESP ? ENCR ? INTEG, D-H, ESN
279 * AH ? INTEG ? D-H, ESN
280 */
281
282 /* equality defaults to false, so return is FALSE if ah and esp not set */
283 bool equal = FALSE;
284
285 /* check ah, if set */
286 if (first->ah.is_set && second->ah.is_set)
287 {
288 /* integrity alg is mandatory, with key size */
289 if ((first->ah.integrity_algorithm == second->ah.integrity_algorithm) &&
290 (first->ah.integrity_algorithm_key_size == second->ah.integrity_algorithm_key_size))
291 {
292 /* dh group is optional, but must be NOT_SET when not set */
293 if (first->ah.diffie_hellman_group != second->ah.diffie_hellman_group)
294 {
295 return FALSE;
296 }
297 /* sequence numbers is optional, but must be NOT_SET when not set */
298 if (first->ah.extended_sequence_numbers != second->ah.extended_sequence_numbers)
299 {
300 return FALSE;
301 }
302 /* all checked, ah seems ok */
303 equal = TRUE;
304 }
305 else
306 {
307 return FALSE;
308 }
309 }
310 /* check esp, if set */
311 if (first->esp.is_set && second->esp.is_set)
312 {
313 /* encryption alg is mandatory, with key size */
314 if ((first->esp.encryption_algorithm == second->esp.encryption_algorithm) &&
315 (first->esp.encryption_algorithm_key_size == second->esp.encryption_algorithm_key_size))
316 {
317 /* int alg is optional, check key only when not NOT_SET */
318 if (first->esp.integrity_algorithm != second->esp.integrity_algorithm)
319 {
320 return FALSE;
321 }
322 if ((first->esp.integrity_algorithm != AUTH_UNDEFINED) &&
323 (first->esp.integrity_algorithm_key_size != second->esp.integrity_algorithm_key_size))
324 {
325 return FALSE;
326 }
327 /* dh group is optional, but must be NOT_SET when not set */
328 if (first->esp.diffie_hellman_group != second->esp.diffie_hellman_group)
329 {
330 return FALSE;
331 }
332 if (first->esp.extended_sequence_numbers != second->esp.extended_sequence_numbers)
333 {
334 return FALSE;
335 }
336 /* all checked, esp seems ok */
337 equal = TRUE;
338 }
339 else
340 {
341 return FALSE;
342 }
343 }
344 return equal;
345 }
346
347 /**
348 * Implementation of sa_config_t.add_traffic_selector_initiator
349 */
350 static void add_traffic_selector_initiator(private_sa_config_t *this, traffic_selector_t *traffic_selector)
351 {
352 /* clone ts, and add*/
353 this->ts_initiator->insert_last(this->ts_initiator, (void*)traffic_selector->clone(traffic_selector));
354 }
355
356 /**
357 * Implementation of sa_config_t.add_traffic_selector_responder
358 */
359 static void add_traffic_selector_responder(private_sa_config_t *this, traffic_selector_t *traffic_selector)
360 {
361 /* clone ts, and add*/
362 this->ts_responder->insert_last(this->ts_responder, (void*)traffic_selector->clone(traffic_selector));
363 }
364
365 /**
366 * Implementation of sa_config_t.add_proposal
367 */
368 static void add_proposal(private_sa_config_t *this, child_proposal_t *proposal)
369 {
370 /* clone proposal, and add*/
371 child_proposal_t *new_proposal = allocator_alloc_thing(child_proposal_t);
372 *new_proposal = *proposal;
373 this->proposals->insert_last(this->proposals, (void*)new_proposal);
374 }
375
376 /**
377 * Implements sa_config_t.destroy.
378 */
379 static status_t destroy(private_sa_config_t *this)
380 {
381 child_proposal_t *proposal;
382 traffic_selector_t *traffic_selector;
383
384
385 /* delete proposals */
386 while(this->proposals->get_count(this->proposals) > 0)
387 {
388 this->proposals->remove_last(this->proposals, (void**)&proposal);
389 allocator_free(proposal);
390 }
391 this->proposals->destroy(this->proposals);
392
393 /* delete traffic selectors */
394 while(this->ts_initiator->get_count(this->ts_initiator) > 0)
395 {
396 this->ts_initiator->remove_last(this->ts_initiator, (void**)&traffic_selector);
397 traffic_selector->destroy(traffic_selector);
398 }
399 this->ts_initiator->destroy(this->ts_initiator);
400
401 /* delete traffic selectors */
402 while(this->ts_responder->get_count(this->ts_responder) > 0)
403 {
404 this->ts_responder->remove_last(this->ts_responder, (void**)&traffic_selector);
405 traffic_selector->destroy(traffic_selector);
406 }
407 this->ts_responder->destroy(this->ts_responder);
408
409 /* delete ids */
410 this->my_id->destroy(this->my_id);
411 this->other_id->destroy(this->other_id);
412
413 allocator_free(this);
414 return SUCCESS;
415 }
416
417 /*
418 * Described in header-file
419 */
420 sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other_id_type, char *other_id, auth_method_t auth_method, u_int32_t ike_sa_lifetime)
421 {
422 private_sa_config_t *this = allocator_alloc_thing(private_sa_config_t);
423
424 /* public functions */
425 this->public.get_my_id = (identification_t*(*)(sa_config_t*))get_my_id;
426 this->public.get_other_id = (identification_t*(*)(sa_config_t*))get_other_id;
427 this->public.get_auth_method = (auth_method_t(*)(sa_config_t*))get_auth_method;
428 this->public.get_ike_sa_lifetime = (u_int32_t(*)(sa_config_t*))get_ike_sa_lifetime;
429 this->public.get_traffic_selectors_initiator = (size_t(*)(sa_config_t*,traffic_selector_t**[]))get_traffic_selectors_initiator;
430 this->public.select_traffic_selectors_initiator = (size_t(*)(sa_config_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]))select_traffic_selectors_initiator;
431 this->public.get_traffic_selectors_responder = (size_t(*)(sa_config_t*,traffic_selector_t**[]))get_traffic_selectors_responder;
432 this->public.select_traffic_selectors_responder = (size_t(*)(sa_config_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]))select_traffic_selectors_responder;
433 this->public.get_proposals = (size_t(*)(sa_config_t*,u_int8_t[4],u_int8_t[4],child_proposal_t**))get_proposals;
434 this->public.select_proposal = (child_proposal_t*(*)(sa_config_t*,u_int8_t[4],u_int8_t[4],child_proposal_t*,size_t))select_proposal;
435 this->public.add_traffic_selector_initiator = (void(*)(sa_config_t*,traffic_selector_t*))add_traffic_selector_initiator;
436 this->public.add_traffic_selector_responder = (void(*)(sa_config_t*,traffic_selector_t*))add_traffic_selector_responder;
437 this->public.add_proposal = (void(*)(sa_config_t*,child_proposal_t*))add_proposal;
438 this->public.destroy = (void(*)(sa_config_t*))destroy;
439
440
441 /* apply init values */
442 this->my_id = identification_create_from_string(my_id_type, my_id);
443 if (this->my_id == NULL)
444 {
445 allocator_free(this);
446 return NULL;
447 }
448 this->other_id = identification_create_from_string(other_id_type, other_id);
449 if (this->my_id == NULL)
450 {
451 this->other_id->destroy(this->other_id);
452 allocator_free(this);
453 return NULL;
454 }
455
456 /* init private members*/
457 this->proposal_equals = proposal_equals;
458 this->select_traffic_selectors = select_traffic_selectors;
459 this->get_traffic_selectors = get_traffic_selectors;
460 this->proposals = linked_list_create();
461 this->ts_initiator = linked_list_create();
462 this->ts_responder = linked_list_create();
463 this->auth_method = auth_method;
464 this->ike_sa_lifetime = ike_sa_lifetime;
465
466 return (&this->public);
467 }