Source/charon/ike_sa.c

   1 /**
   2  * @file ike_sa.c
   3  *
   4  * @brief Class ike_sa_t. An object of this type is managed by an
   5  * ike_sa_manager_t object and represents an IKE_SA
   6  *
   7  */
   8
   9 /*
  10  * Copyright (C) 2005 Jan Hutter, Martin Willi
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include "ike_sa.h"
  25
  26 #include "types.h"
  27 #include "globals.h"
  28 #include "definitions.h"
  29 #include "utils/allocator.h"
  30 #include "utils/linked_list.h"
  31 #include "utils/logger_manager.h"
  32 #include "utils/randomizer.h"
  33 #include "transforms/diffie_hellman.h"
  34 #include "payloads/sa_payload.h"
  35 #include "payloads/nonce_payload.h"
  36 #include "payloads/ke_payload.h"
  37 #include "payloads/transform_substructure.h"
  38 #include "payloads/transform_attribute.h"
  39
  40
  41 /**
  42  * States in which a IKE_SA can actually be
  43  */
  44 typedef enum ike_sa_state_e ike_sa_state_t;
  45
  46 enum ike_sa_state_e {
  47
  48         /**
  49          * IKE_SA is is not in a state
  50          */
  51         NO_STATE = 1,
  52
  53         /**
  54          * A IKE_SA_INIT-message was sent: role initiator
  55          */
  56         IKE_SA_INIT_REQUESTED = 2,
  57
  58         /**
  59          * A IKE_SA_INIT-message was replied: role responder
  60          */
  61         IKE_SA_INIT_RESPONDED = 3,
  62
  63         /**
  64          * An IKE_AUTH-message was sent after a successful
  65          * IKE_SA_INIT-exchange: role initiator
  66          */
  67         IKE_AUTH_REQUESTED = 4,
  68
  69         /**
  70          * An IKE_AUTH-message was replied: role responder.
  71          * In this state, all the informations for an IKE_SA
  72          * and one CHILD_SA are known.
  73          */
  74         IKE_SA_INITIALIZED = 5
  75 };
  76
  77 /**
  78  * string mappings for ike_sa_state
  79  */
  80 mapping_t ike_sa_state_m[] = {
  81         {NO_STATE, "NO_STATE"},
  82         {IKE_SA_INIT_REQUESTED, "IKE_SA_INIT_REQUESTED"},
  83         {IKE_SA_INIT_RESPONDED, "IKE_SA_INIT_RESPONDED"},
  84         {IKE_AUTH_REQUESTED, "IKE_AUTH_REQUESTED"},
  85         {IKE_SA_INITIALIZED, "IKE_SA_INITIALIZED"},
  86         {MAPPING_END, NULL}
  87 };
  88
  89
  90 /**
  91  * Private data of an message_t object
  92  */
  93 typedef struct private_ike_sa_s private_ike_sa_t;
  94
  95 struct private_ike_sa_s {
  96
  97         /**
  98          * Public part of a ike_sa_t object
  99          */
 100         ike_sa_t public;
 101
 102         status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
 103         status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
 104         status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
 105
 106         status_t (*build_message) (private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message);
 107
 108
 109         status_t (*transto_ike_sa_init_requested) (private_ike_sa_t *this, char *name);
 110         status_t (*transto_ike_sa_init_responded) (private_ike_sa_t *this, message_t *message);
 111         status_t (*transto_ike_auth_requested) (private_ike_sa_t *this, message_t *message);
 112
 113         /* Private values */
 114         /**
 115          * Identifier for the current IKE_SA
 116          */
 117         ike_sa_id_t *ike_sa_id;
 118
 119         /**
 120          * Linked List containing the child sa's of the current IKE_SA
 121          */
 122         linked_list_t *child_sas;
 123
 124         /**
 125          * Current state of the IKE_SA
 126          */
 127         ike_sa_state_t state;
 128
 129         /**
 130          * this SA's source for random data
 131          */
 132         randomizer_t *randomizer;
 133
 134         linked_list_t *sent_messages;
 135
 136         struct {
 137                 host_t *host;
 138         } me;
 139
 140         struct {
 141                 host_t *host;
 142         } other;
 143
 144
 145         struct {
 146                 /**
 147                  * Diffie Hellman object used to compute shared secret
 148                  */
 149                 diffie_hellman_t *diffie_hellman;
 150                 /**
 151                  * Diffie Hellman group number
 152                  */
 153                 u_int16_t dh_group_number;
 154
 155                 /**
 156                  * Priority used get matching dh_group number
 157                  */
 158                 u_int16_t dh_group_priority;
 159         } ike_sa_init_data;
 160
 161
 162         /**
 163          * next message id to receive
 164          */
 165         u_int32_t message_id_in;
 166
 167         /**
 168          * next message id to send
 169          */
 170         u_int32_t message_id_out;
 171
 172         /**
 173          * a logger for this IKE_SA
 174          */
 175         logger_t *logger;
 176 };
 177
 178 /**
 179  * @brief implements function process_message of private_ike_sa_t
 180  */
 181 static status_t process_message (private_ike_sa_t *this, message_t *message)
 182 {
 183         this->logger->log(this->logger, CONTROL|MORE, "Process message of exchange type %s",
 184                                                 mapping_find(exchange_type_m,message->get_exchange_type(message)));
 185
 186         switch (message->get_exchange_type(message))
 187         {
 188                 case IKE_SA_INIT:
 189                 {
 190                         if (message->get_request(message)) {
 191                                 if (this->state ==      NO_STATE)
 192                                 {
 193                                         /* state transission NO_STATE => IKE_SA_INIT_RESPONDED */
 194                                         return this->transto_ike_sa_init_responded(this, message);
 195                                 }
 196                         }
 197                         else
 198                         {
 199                                 if (this->state == IKE_SA_INIT_REQUESTED)
 200                                 {
 201                                         /* state transission IKE_SA_INIT_REQUESTED => IKE_AUTH_REQUESTED*/
 202                                         return this->transto_ike_auth_requested(this, message);
 203                                 }
 204                         }
 205                         break;
 206                 }
 207                 case IKE_AUTH:
 208                 {
 209                         /* break; */
 210                 }
 211                 case CREATE_CHILD_SA:
 212                 {
 213                         /* break; */
 214                 }
 215                 case INFORMATIONAL:
 216                 {
 217                         /* break; */
 218                 }
 219                 default:
 220                 {
 221                         this->logger->log(this->logger, ERROR, "processing %s-message not supported.",
 222                                                                 mapping_find(exchange_type_m,message->get_exchange_type(message)));
 223                         return NOT_SUPPORTED;
 224                 }
 225         }
 226         this->logger->log(this->logger, ERROR, "received %s-message in state %s, rejected.",
 227                                                                 mapping_find(exchange_type_m, message->get_exchange_type(message)),
 228                                                                 mapping_find(ike_sa_state_m, this->state));
 229         return INVALID_STATE;
 230 }
 231
 232
 233 static status_t build_message(private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
 234 {
 235         status_t status;
 236         message_t *new_message;
 237         host_t *source, *destination;
 238
 239         new_message = message_create();
 240         if (new_message == NULL)
 241         {
 242                 return OUT_OF_RES;
 243         }
 244
 245         status  = this->me.host->clone(this->me.host, &source);
 246         status |= this->other.host->clone(this->other.host, &destination);
 247         if (status != SUCCESS)
 248         {
 249                 new_message->destroy(new_message);
 250                 return status;
 251         }
 252         new_message->set_source(new_message, source);
 253         new_message->set_destination(new_message, destination);
 254
 255         new_message->set_exchange_type(new_message, type);
 256         new_message->set_request(new_message, request);
 257
 258         new_message->set_ike_sa_id(new_message, this->ike_sa_id);
 259
 260         *message = new_message;
 261
 262         return SUCCESS;
 263 }
 264
 265
 266 static status_t transto_ike_sa_init_requested(private_ike_sa_t *this, char *name)
 267 {
 268
 269 }
 270
 271 static status_t transto_ike_sa_init_responded(private_ike_sa_t *this, message_t *message)
 272 {
 273         status_t status;
 274         linked_list_iterator_t *payloads;
 275         message_t *respond;
 276
 277         status = message->parse_body(message);
 278         if (status != SUCCESS)
 279         {
 280                 return status;
 281         }
 282
 283
 284
 285
 286
 287         status = message->get_payload_iterator(message, &payloads);
 288         if (status != SUCCESS)
 289         {
 290                 respond->destroy(respond);
 291                 return status;
 292         }
 293         while (payloads->has_next(payloads))
 294         {
 295                 payload_t *payload;
 296                 payloads->current(payloads, (void**)payload);
 297                 switch (payload->get_type(payload))
 298                 {
 299                         case SECURITY_ASSOCIATION:
 300                         {
 301                                 sa_payload_t *sa_payload;
 302                                 linked_list_iterator_t *proposals;
 303
 304                                 sa_payload = (sa_payload_t*)payload;
 305                                 status = sa_payload->create_proposal_substructure_iterator(sa_payload, &proposals, TRUE);
 306                                 if (status != SUCCESS)
 307                                 {
 308                                         payloads->destroy(payloads);
 309                                         return status;
 310                                 }
 311                                 //global_configuration_manager->select_proposals_for_host
 312
 313                                 break;
 314                         }
 315                         case KEY_EXCHANGE:
 316                         {
 317                                 break;
 318                         }
 319                         case NONCE:
 320                         {
 321                                 break;
 322                         }
 323                         default:
 324                         {
 325
 326                         }
 327
 328                 }
 329
 330         }
 331
 332
 333
 334
 335
 336         /*
 337         job_t *delete_job;
 338         delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
 339         if (delete_job == NULL)
 340         {
 341                 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
 342         }
 343
 344         status = global_job_queue->add(global_job_queue,delete_job);
 345         if (status != SUCCESS)
 346         {
 347                 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
 348                 delete_job->destroy_all(delete_job);
 349         }*/
 350         return SUCCESS;
 351 }
 352
 353 static status_t transto_ike_auth_requested(private_ike_sa_t *this, message_t *message)
 354 {
 355         return SUCCESS;
 356 }
 357
 358 /**
 359  * @brief implements function process_configuration of private_ike_sa_t
 360  */
 361 static status_t initialize_connection(private_ike_sa_t *this, char *name)
 362 {
 363         message_t *message;
 364         payload_t *payload;
 365         packet_t *packet;
 366         status_t status;
 367
 368         this->logger->log(this->logger, CONTROL, "initializing connection");
 369
 370         status = global_configuration_manager->get_local_host(global_configuration_manager, name, &(this->me.host));
 371         if (status != SUCCESS)
 372         {
 373                 return INVALID_ARG;
 374         }
 375
 376         status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &(this->other.host));
 377         if (status != SUCCESS)
 378         {
 379                 return INVALID_ARG;
 380         }
 381
 382         status = global_configuration_manager->get_dh_group_number(global_configuration_manager, name, &(this->ike_sa_init_data.dh_group_number), this->ike_sa_init_data.dh_group_priority);
 383         if (status != SUCCESS)
 384         {
 385                 return INVALID_ARG;
 386         }
 387
 388         status = this->build_message(this, IKE_SA_INIT, TRUE, &message);
 389         if (status != SUCCESS)
 390         {
 391                 return status;
 392         }
 393
 394
 395         status = this->build_sa_payload(this, (sa_payload_t**)&payload);
 396         if (status != SUCCESS)
 397         {
 398                 this->logger->log(this->logger, ERROR, "Could not build SA payload");
 399                 message->destroy(message);
 400                 return status;
 401         }
 402         message->add_payload(message, payload);
 403
 404         {
 405                 ke_payload_t *ke_payload;
 406                 chunk_t key_data;
 407                 this    ->logger->log(this->logger, CONTROL|MORE, "create diffie hellman object");
 408                 if (this->ike_sa_init_data.diffie_hellman != NULL)
 409                 {
 410                         this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t  already existing!");
 411                         message->destroy(message);
 412                         return FAILED;
 413                 }
 414                 this->ike_sa_init_data.diffie_hellman = diffie_hellman_create(this->ike_sa_init_data.dh_group_number);
 415
 416                 if (this->ike_sa_init_data.diffie_hellman == NULL)
 417                 {
 418                         this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t could not be created!");
 419                         message->destroy(message);
 420                         return FAILED;
 421                 }
 422
 423                 this    ->logger->log(this->logger, CONTROL|MORE, "get public dh value to send in ke payload");
 424
 425                 status = this->ike_sa_init_data.diffie_hellman->get_my_public_value(this->ike_sa_init_data.diffie_hellman,&key_data);
 426                 if (status != SUCCESS)
 427                 {
 428                         this->logger->log(this->logger, ERROR, "Could not get my DH public value");
 429                         message->destroy(message);
 430                         return status;
 431                 }
 432
 433                 ke_payload = ke_payload_create();
 434                 if (ke_payload == NULL)
 435                 {
 436                         this->logger->log(this->logger, ERROR, "Could not build KE payload");
 437                         message->destroy(message);
 438                         allocator_free_chunk(key_data);
 439                         return OUT_OF_RES;
 440                 }
 441                 ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
 442                 if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
 443                 {
 444                         this->logger->log(this->logger, ERROR, "Could not build KE payload");
 445                         ke_payload->destroy(ke_payload);
 446                         message->destroy(message);
 447                         allocator_free_chunk(key_data);
 448                         return OUT_OF_RES;
 449                 }
 450                 allocator_free_chunk(key_data);
 451
 452                 payload = (payload_t *) ke_payload;
 453         }
 454
 455         message->add_payload(message, payload);
 456
 457         status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
 458         if (status != SUCCESS)
 459         {
 460                 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
 461                 message->destroy(message);
 462                 return status;
 463         }
 464         payload->set_next_type(payload, NO_PAYLOAD);
 465         message->add_payload(message, payload);
 466
 467         status = message->generate(message, &packet);
 468         if (status != SUCCESS)
 469         {
 470                 this->logger->log(this->logger, ERROR, "Could not generate message");
 471                 message->destroy(message);
 472                 return status;
 473         }
 474
 475
 476         global_send_queue->add(global_send_queue, packet);
 477
 478         message->destroy(message);
 479
 480         this->state = IKE_SA_INIT_REQUESTED;
 481
 482         return SUCCESS;
 483 }
 484
 485 /**
 486  * @brief implements function private_ike_sa_t.get_id
 487  */
 488 static ike_sa_id_t* get_id(private_ike_sa_t *this)
 489 {
 490         return this->ike_sa_id;
 491 }
 492
 493 /**
 494  * implements private_ike_sa_t.build_sa_payload
 495  */
 496 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
 497 {
 498         sa_payload_t* sa_payload;
 499         linked_list_iterator_t *iterator;
 500         status_t status;
 501
 502         this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
 503
 504         sa_payload = sa_payload_create();
 505         if (sa_payload == NULL)
 506         {
 507                 return OUT_OF_RES;
 508         }
 509         status = sa_payload->create_proposal_substructure_iterator(sa_payload, &iterator, FALSE);
 510         if (status != SUCCESS)
 511         {
 512                 sa_payload->destroy(sa_payload);
 513                 return status;
 514         }
 515         status = global_configuration_manager->get_proposals_for_host(global_configuration_manager, this->other.host, iterator);
 516         if (status != SUCCESS)
 517         {
 518                 sa_payload->destroy(sa_payload);
 519                 return status;
 520         }
 521
 522         *payload = sa_payload;
 523
 524         return SUCCESS;
 525 }
 526
 527 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
 528 {
 529
 530 }
 531
 532 /**
 533  * implements private_ike_sa_t.build_nonce_payload
 534  */
 535 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
 536 {
 537         nonce_payload_t *nonce_payload;
 538         chunk_t nonce;
 539
 540         this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
 541
 542         if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 16, &nonce) != SUCCESS)
 543         {
 544                 return OUT_OF_RES;
 545         }
 546
 547         nonce_payload = nonce_payload_create();
 548         if (nonce_payload == NULL)
 549         {
 550                 return OUT_OF_RES;
 551         }
 552
 553         nonce_payload->set_nonce(nonce_payload, nonce);
 554
 555         *payload = nonce_payload;
 556
 557         return SUCCESS;
 558 }
 559
 560 /**
 561  * @brief implements function destroy of private_ike_sa_t
 562  */
 563 static status_t destroy (private_ike_sa_t *this)
 564 {
 565         linked_list_iterator_t *iterator;
 566
 567         this->child_sas->create_iterator(this->child_sas, &iterator, TRUE);
 568         while (iterator->has_next(iterator))
 569         {
 570                 payload_t *payload;
 571                 iterator->current(iterator, (void**)&payload);
 572                 payload->destroy(payload);
 573         }
 574         iterator->destroy(iterator);
 575         this->child_sas->destroy(this->child_sas);
 576
 577         this->ike_sa_id->destroy(this->ike_sa_id);
 578         this->sent_messages->destroy(this->sent_messages);
 579         this->randomizer->destroy(this->randomizer);
 580         if (this->ike_sa_init_data.diffie_hellman != NULL)
 581         {
 582                 this->ike_sa_init_data.diffie_hellman->destroy(this->ike_sa_init_data.diffie_hellman);
 583         }
 584
 585         global_logger_manager->destroy_logger(global_logger_manager, this->logger);
 586
 587         allocator_free(this);
 588
 589         return SUCCESS;
 590 }
 591
 592 /*
 593  * Described in Header
 594  */
 595 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 596 {
 597         private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
 598         if (this == NULL)
 599         {
 600                 return NULL;
 601         }
 602
 603
 604         /* Public functions */
 605         this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
 606         this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
 607         this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
 608         this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
 609
 610         this->build_sa_payload = build_sa_payload;
 611         this->build_nonce_payload = build_nonce_payload;
 612         this->build_ke_payload = build_ke_payload;
 613
 614         this->build_message = build_message;
 615         this->transto_ike_sa_init_requested = transto_ike_sa_init_requested;
 616         this->transto_ike_sa_init_responded = transto_ike_sa_init_responded;
 617         this->transto_ike_auth_requested = transto_ike_auth_requested;
 618
 619
 620
 621         /* initialize private fields */
 622         if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
 623         {
 624                 allocator_free(this);
 625                 return NULL;
 626         }
 627         this->child_sas = linked_list_create();
 628         if (this->child_sas == NULL)
 629         {
 630                 this->ike_sa_id->destroy(this->ike_sa_id);
 631                 allocator_free(this);
 632                 return NULL;
 633         }
 634         this->randomizer = randomizer_create();
 635         if (this->randomizer == NULL)
 636         {
 637                 this->child_sas->destroy(this->child_sas);
 638                 this->ike_sa_id->destroy(this->ike_sa_id);
 639                 allocator_free(this);
 640         }
 641         this->sent_messages = linked_list_create();
 642         if (this->sent_messages == NULL)
 643         {
 644                 this->randomizer->destroy(this->randomizer);
 645                 this->child_sas->destroy(this->child_sas);
 646                 this->ike_sa_id->destroy(this->ike_sa_id);
 647                 allocator_free(this);
 648         }
 649         this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
 650         if (this->logger ==  NULL)
 651         {
 652                 this->randomizer->destroy(this->randomizer);
 653                 this->child_sas->destroy(this->child_sas);
 654                 this->ike_sa_id->destroy(this->ike_sa_id);
 655                 this->sent_messages->destroy(this->sent_messages);
 656                 allocator_free(this);
 657         }
 658
 659         this->me.host = NULL;
 660         this->other.host = NULL;
 661         this->ike_sa_init_data.diffie_hellman = NULL;
 662         this->ike_sa_init_data.dh_group_number = 0;
 663         /* 1 means highest priority */
 664         this->ike_sa_init_data.dh_group_priority = 1;
 665         this->message_id_out = 0;
 666         this->message_id_in = 0;
 667
 668
 669         /* at creation time, IKE_SA isn't in a specific state */
 670         this->state = NO_STATE;
 671
 672         return (&this->public);
 673 }