Source/charon/ike_sa.c

   1 /**
   2  * @file ike_sa.c
   3  *
   4  * @brief Class ike_sa_t. An object of this type is managed by an
   5  * ike_sa_manager_t object and represents an IKE_SA
   6  *
   7  */
   8
   9 /*
  10  * Copyright (C) 2005 Jan Hutter, Martin Willi
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include "ike_sa.h"
  25
  26 #include "types.h"
  27 #include "globals.h"
  28 #include "utils/allocator.h"
  29 #include "utils/linked_list.h"
  30 #include "utils/logger_manager.h"
  31 #include "utils/randomizer.h"
  32 #include "payloads/sa_payload.h"
  33 #include "payloads/nonce_payload.h"
  34 #include "payloads/ke_payload.h"
  35 #include "payloads/transform_substructure.h"
  36 #include "payloads/transform_attribute.h"
  37
  38
  39 /**
  40  * States in which a IKE_SA can actually be
  41  */
  42 typedef enum ike_sa_state_e ike_sa_state_t;
  43
  44 enum ike_sa_state_e {
  45
  46         /**
  47          * IKE_SA is is not in a state
  48          */
  49         NO_STATE = 1,
  50
  51         /**
  52          * A IKE_SA_INIT-message was sent: role initiator
  53          */
  54         IKE_SA_INIT_REQUESTED = 2,
  55
  56         /**
  57          * A IKE_SA_INIT-message was replied: role responder
  58          */
  59         IKE_SA_INIT_RESPONDED = 3,
  60
  61         /**
  62          * An IKE_AUTH-message was sent after a successful
  63          * IKE_SA_INIT-exchange: role initiator
  64          */
  65         IKE_AUTH_REQUESTED = 4,
  66
  67         /**
  68          * An IKE_AUTH-message was replied: role responder.
  69          * In this state, all the informations for an IKE_SA
  70          * and one CHILD_SA are known.
  71          */
  72         IKE_SA_INITIALIZED = 5
  73 };
  74
  75
  76 /**
  77  * Private data of an message_t object
  78  */
  79 typedef struct private_ike_sa_s private_ike_sa_t;
  80
  81 struct private_ike_sa_s {
  82
  83         /**
  84          * Public part of a ike_sa_t object
  85          */
  86         ike_sa_t public;
  87
  88         status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
  89         status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
  90         status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
  91
  92         /* Private values */
  93         /**
  94          * Identifier for the current IKE_SA
  95          */
  96         ike_sa_id_t *ike_sa_id;
  97
  98         /**
  99          * Linked List containing the child sa's of the current IKE_SA
 100          */
 101         linked_list_t *child_sas;
 102
 103         /**
 104          * Current state of the IKE_SA
 105          */
 106         ike_sa_state_t current_state;
 107
 108         /**
 109          * is this IKE_SA the original initiator of this IKE_SA
 110          */
 111         bool original_initiator;
 112
 113         /**
 114          * this SA's source for random data
 115          */
 116         randomizer_t *randomizer;
 117
 118         linked_list_t *sent_messages;
 119
 120         struct {
 121                 host_t *host;
 122         } me;
 123
 124         struct {
 125                 host_t *host;
 126         } other;
 127
 128         /**
 129          * a logger for this IKE_SA
 130          */
 131         logger_t *logger;
 132 };
 133
 134 /**
 135  * @brief implements function process_message of private_ike_sa_t
 136  */
 137 static status_t process_message (private_ike_sa_t *this, message_t *message)
 138 {
 139         status_t status;
 140         /* @TODO Add Message Processing here */
 141
 142         this->logger->log(this->logger, CONTROL|MORE, "Process message of exchange type %s",mapping_find(exchange_type_m,message->get_exchange_type(message)));
 143
 144         /* parse body */
 145         status = message->parse_body(message);
 146         switch (status)
 147         {
 148                 case SUCCESS:
 149                 {
 150                         break;
 151                 }
 152                 default:
 153                 {
 154                         this->logger->log(this->logger, ERROR, "Error of type %s while parsing message body",mapping_find(status_m,status));
 155                         switch (this->current_state)
 156                         {
 157                                 case NO_STATE:
 158                                 {
 159                                         job_t *delete_job;
 160                                         /* create delete job for this ike_sa */
 161                                         delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
 162                                         if (delete_job == NULL)
 163                                         {
 164                                                 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
 165                                         }
 166
 167                                         status = global_job_queue->add(global_job_queue,delete_job);
 168                                         if (status != SUCCESS)
 169                                         {
 170                                                 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
 171                                                 delete_job->destroy_all(delete_job);
 172                                         }
 173
 174                                 }
 175                                 default:
 176                                 {
 177                                         break;
 178                                 }
 179                         }
 180
 181                         return FAILED;
 182                 }
 183         }
 184
 185         return status;
 186 }
 187
 188 /**
 189  * @brief implements function process_configuration of private_ike_sa_t
 190  */
 191 static status_t initialize_connection(private_ike_sa_t *this, char *name)
 192 {
 193         message_t *message;
 194         payload_t *payload;
 195         packet_t *packet;
 196         status_t status;
 197
 198         this->logger->log(this->logger, CONTROL, "initializing connection");
 199
 200         this->original_initiator = TRUE;
 201
 202         status = global_configuration_manager->get_local_host(global_configuration_manager, name, &(this->me.host));
 203         if (status != SUCCESS)
 204         {
 205                 return INVALID_ARG;
 206         }
 207
 208         status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &(this->other.host));
 209         if (status != SUCCESS)
 210         {
 211                 return INVALID_ARG;
 212         }
 213
 214         message = message_create();
 215
 216         if (message == NULL)
 217         {
 218                 return OUT_OF_RES;
 219         }
 220
 221
 222         message->set_source(message, this->me.host);
 223         message->set_destination(message, this->other.host);
 224
 225         message->set_exchange_type(message, IKE_SA_INIT);
 226         message->set_original_initiator(message, this->original_initiator);
 227         message->set_message_id(message, 0);
 228         message->set_ike_sa_id(message, this->ike_sa_id);
 229         message->set_request(message, TRUE);
 230
 231         status = this->build_sa_payload(this, (sa_payload_t**)&payload);
 232         if (status != SUCCESS)
 233         {
 234                 this->logger->log(this->logger, ERROR, "Could not build SA payload");
 235                 message->destroy(message);
 236                 return status;
 237         }
 238         payload->set_next_type(payload, KEY_EXCHANGE);
 239         message->add_payload(message, payload);
 240
 241         status = this->build_ke_payload(this, (ke_payload_t**)&payload);
 242         if (status != SUCCESS)
 243         {
 244                 this->logger->log(this->logger, ERROR, "Could not build KE payload");
 245                 message->destroy(message);
 246                 return status;
 247         }
 248         payload->set_next_type(payload, NONCE);
 249         message->add_payload(message, payload);
 250
 251         status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
 252         if (status != SUCCESS)
 253         {
 254                 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
 255                 message->destroy(message);
 256                 return status;
 257         }
 258         payload->set_next_type(payload, NO_PAYLOAD);
 259         message->add_payload(message, payload);
 260
 261         status = message->generate(message, &packet);
 262         if (status != SUCCESS)
 263         {
 264                 this->logger->log(this->logger, ERROR, "Could not generate message");
 265                 message->destroy(message);
 266                 return status;
 267         }
 268
 269
 270         global_send_queue->add(global_send_queue, packet);
 271
 272         message->destroy(message);
 273
 274         this->current_state = IKE_SA_INIT_REQUESTED;
 275
 276         return SUCCESS;
 277 }
 278
 279 /**
 280  * @brief implements function private_ike_sa_t.get_id
 281  */
 282 static ike_sa_id_t* get_id(private_ike_sa_t *this)
 283 {
 284         return this->ike_sa_id;
 285 }
 286
 287 /**
 288  * implements private_ike_sa_t.build_sa_payload
 289  */
 290 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
 291 {
 292         sa_payload_t* sa_payload;
 293         linked_list_iterator_t *iterator;
 294         status_t status;
 295
 296         this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
 297
 298         sa_payload = sa_payload_create();
 299         if (sa_payload == NULL)
 300         {
 301                 return OUT_OF_RES;
 302         }
 303         status = sa_payload->create_proposal_substructure_iterator(sa_payload, &iterator, FALSE);
 304         if (status != SUCCESS)
 305         {
 306                 sa_payload->destroy(sa_payload);
 307                 return status;
 308         }
 309         status = global_configuration_manager->get_proposals_for_host(global_configuration_manager, this->other.host, iterator);
 310         if (status != SUCCESS)
 311         {
 312                 sa_payload->destroy(sa_payload);
 313                 return status;
 314         }
 315
 316         *payload = sa_payload;
 317
 318         return SUCCESS;
 319 }
 320
 321 /**
 322  * implements private_ike_sa_t.build_ke_payload
 323  */
 324 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
 325 {
 326         ke_payload_t *ke_payload;
 327         chunk_t key_data;
 328
 329
 330         this->logger->log(this->logger, CONTROL|MORE, "building ke payload");
 331
 332         key_data.ptr = "12345";
 333         key_data.len = strlen("12345");
 334
 335
 336         ke_payload = ke_payload_create();
 337         if (ke_payload == NULL)
 338         {
 339                 return OUT_OF_RES;
 340         }
 341         ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
 342         if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
 343         {
 344                 ke_payload->destroy(ke_payload);
 345                 return OUT_OF_RES;
 346         }
 347         *payload = ke_payload;
 348         return SUCCESS;
 349 }
 350
 351 /**
 352  * implements private_ike_sa_t.build_nonce_payload
 353  */
 354 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
 355 {
 356         nonce_payload_t *nonce_payload;
 357         chunk_t nonce;
 358
 359         this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
 360
 361         if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 16, &nonce) != SUCCESS)
 362         {
 363                 return OUT_OF_RES;
 364         }
 365
 366         nonce_payload = nonce_payload_create();
 367         if (nonce_payload == NULL)
 368         {
 369                 return OUT_OF_RES;
 370         }
 371
 372         nonce_payload->set_nonce(nonce_payload, nonce);
 373
 374         *payload = nonce_payload;
 375
 376         return SUCCESS;
 377 }
 378
 379 /**
 380  * @brief implements function destroy of private_ike_sa_t
 381  */
 382 static status_t destroy (private_ike_sa_t *this)
 383 {
 384         linked_list_iterator_t *iterator;
 385
 386         this->child_sas->create_iterator(this->child_sas, &iterator, TRUE);
 387         while (iterator->has_next(iterator))
 388         {
 389                 payload_t *payload;
 390                 iterator->current(iterator, (void**)&payload);
 391                 payload->destroy(payload);
 392         }
 393         iterator->destroy(iterator);
 394         this->child_sas->destroy(this->child_sas);
 395
 396         this->ike_sa_id->destroy(this->ike_sa_id);
 397         this->sent_messages->destroy(this->sent_messages);
 398         this->randomizer->destroy(this->randomizer);
 399
 400         global_logger_manager->destroy_logger(global_logger_manager, this->logger);
 401
 402         allocator_free(this);
 403
 404         return SUCCESS;
 405 }
 406
 407 /*
 408  * Described in Header
 409  */
 410 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 411 {
 412         private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
 413         if (this == NULL)
 414         {
 415                 return NULL;
 416         }
 417
 418
 419         /* Public functions */
 420         this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
 421         this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
 422         this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
 423         this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
 424
 425         this->build_sa_payload = build_sa_payload;
 426         this->build_ke_payload = build_ke_payload;
 427         this->build_nonce_payload = build_nonce_payload;
 428
 429
 430
 431         /* initialize private fields */
 432         if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
 433         {
 434                 allocator_free(this);
 435                 return NULL;
 436         }
 437         this->child_sas = linked_list_create();
 438         if (this->child_sas == NULL)
 439         {
 440                 this->ike_sa_id->destroy(this->ike_sa_id);
 441                 allocator_free(this);
 442                 return NULL;
 443         }
 444         this->randomizer = randomizer_create();
 445         if (this->randomizer == NULL)
 446         {
 447                 this->child_sas->destroy(this->child_sas);
 448                 this->ike_sa_id->destroy(this->ike_sa_id);
 449                 allocator_free(this);
 450         }
 451         this->sent_messages = linked_list_create();
 452         if (this->sent_messages == NULL)
 453         {
 454                 this->randomizer->destroy(this->randomizer);
 455                 this->child_sas->destroy(this->child_sas);
 456                 this->ike_sa_id->destroy(this->ike_sa_id);
 457                 allocator_free(this);
 458         }
 459         this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
 460         if (this->logger ==  NULL)
 461         {
 462                 this->randomizer->destroy(this->randomizer);
 463                 this->child_sas->destroy(this->child_sas);
 464                 this->ike_sa_id->destroy(this->ike_sa_id);
 465                 this->sent_messages->destroy(this->sent_messages);
 466                 allocator_free(this);
 467         }
 468
 469         this->me.host = NULL;
 470         this->other.host = NULL;
 471
 472
 473         /* at creation time, IKE_SA isn't in a specific state */
 474         this->current_state = NO_STATE;
 475
 476         return (&this->public);
 477 }