projects / strongswan.git / blob
? search:


760d9064d77744c5ee6d2058dd3e0c9322e8d6a3
[strongswan.git] / Source / charon / ike_sa.c
1 /**
2 * @file ike_sa.c
3 *
4 * @brief Class ike_sa_t. An object of this type is managed by an
5 * ike_sa_manager_t object and represents an IKE_SA
6 *
7 */
8
9 /*
10 * Copyright (C) 2005 Jan Hutter, Martin Willi
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #include "ike_sa.h"
25
26 #include "types.h"
27 #include "globals.h"
28 #include "definitions.h"
29 #include "utils/allocator.h"
30 #include "utils/linked_list.h"
31 #include "utils/logger_manager.h"
32 #include "utils/randomizer.h"
33 #include "transforms/diffie_hellman.h"
34 #include "payloads/sa_payload.h"
35 #include "payloads/nonce_payload.h"
36 #include "payloads/ke_payload.h"
37 #include "payloads/transform_substructure.h"
38 #include "payloads/transform_attribute.h"
39
40
41 /**
42 * States in which a IKE_SA can actually be
43 */
44 typedef enum ike_sa_state_e ike_sa_state_t;
45
46 enum ike_sa_state_e {
47
48 /**
49 * IKE_SA is is not in a state
50 */
51 NO_STATE = 1,
52
53 /**
54 * A IKE_SA_INIT-message was sent: role initiator
55 */
56 IKE_SA_INIT_REQUESTED = 2,
57
58 /**
59 * A IKE_SA_INIT-message was replied: role responder
60 */
61 IKE_SA_INIT_RESPONDED = 3,
62
63 /**
64 * An IKE_AUTH-message was sent after a successful
65 * IKE_SA_INIT-exchange: role initiator
66 */
67 IKE_AUTH_REQUESTED = 4,
68
69 /**
70 * An IKE_AUTH-message was replied: role responder.
71 * In this state, all the informations for an IKE_SA
72 * and one CHILD_SA are known.
73 */
74 IKE_SA_INITIALIZED = 5
75 };
76
77 /**
78 * string mappings for ike_sa_state
79 */
80 mapping_t ike_sa_state_m[] = {
81 {NO_STATE, "NO_STATE"},
82 {IKE_SA_INIT_REQUESTED, "IKE_SA_INIT_REQUESTED"},
83 {IKE_SA_INIT_RESPONDED, "IKE_SA_INIT_RESPONDED"},
84 {IKE_AUTH_REQUESTED, "IKE_AUTH_REQUESTED"},
85 {IKE_SA_INITIALIZED, "IKE_SA_INITIALIZED"},
86 {MAPPING_END, NULL}
87 };
88
89
90 /**
91 * Private data of an message_t object
92 */
93 typedef struct private_ike_sa_s private_ike_sa_t;
94
95 struct private_ike_sa_s {
96
97 /**
98 * Public part of a ike_sa_t object
99 */
100 ike_sa_t public;
101
102 /**
103 * Builds an empty IKEv2-Message
104 *
105 * Depending on the type of message (request or response), the message id is
106 * either message_id_out or message_id_in.
107 *
108 *
109 * @param this calling object
110 * @param type exchange type of new message
111 * @param request TRUE, if message has to be a request
112 * @param message new message is stored at this location
113 * @return
114 * - SUCCESS
115 * - OUT_OF_RES
116 */
117 status_t (*build_message) (private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message);
118
119 status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
120 status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
121 status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
122
123 status_t (*create_delete_job) (private_ike_sa_t *this);
124 status_t (*resend_last_reply) (private_ike_sa_t *this);
125
126
127 status_t (*transto_ike_sa_init_requested) (private_ike_sa_t *this, char *name);
128 status_t (*transto_ike_sa_init_responded) (private_ike_sa_t *this, message_t *message);
129 status_t (*transto_ike_auth_requested) (private_ike_sa_t *this, message_t *message);
130
131 /* Private values */
132 /**
133 * Identifier for the current IKE_SA
134 */
135 ike_sa_id_t *ike_sa_id;
136
137 /**
138 * Linked List containing the child sa's of the current IKE_SA
139 */
140 linked_list_t *child_sas;
141
142 /**
143 * Current state of the IKE_SA
144 */
145 ike_sa_state_t state;
146
147 /**
148 * this SA's source for random data
149 */
150 randomizer_t *randomizer;
151
152 /**
153 * contains the last responded message
154 *
155 */
156 message_t *last_responded_message;
157
158 /**
159 * contains the last requested message
160 *
161 */
162 message_t *last_requested_message;
163
164 /**
165 * Informations of this host
166 */
167 struct {
168 host_t *host;
169 } me;
170
171 /**
172 * Informations of the other host
173 */
174 struct {
175 host_t *host;
176 } other;
177
178
179 struct {
180 /**
181 * Diffie Hellman object used to compute shared secret
182 */
183 diffie_hellman_t *diffie_hellman;
184
185 /**
186 * Diffie Hellman group number
187 */
188 u_int16_t dh_group_number;
189
190 /**
191 * Priority used get matching dh_group number
192 */
193 u_int16_t dh_group_priority;
194
195 /**
196 * selected proposals
197 */
198 linked_list_t *proposals;
199
200 /**
201 * Sent nonce value
202 */
203 chunk_t sent_nonce;
204
205 /**
206 * received nonce value
207 */
208 chunk_t received_nonce;
209 } ike_sa_init_data;
210
211
212 /**
213 * next message id to receive
214 */
215 u_int32_t message_id_in;
216
217 /**
218 * next message id to send
219 */
220 u_int32_t message_id_out;
221
222 /**
223 * a logger for this IKE_SA
224 */
225 logger_t *logger;
226 };
227
228 /**
229 * @brief implements function process_message of private_ike_sa_t
230 */
231 static status_t process_message (private_ike_sa_t *this, message_t *message)
232 {
233 u_int32_t message_id;
234 bool is_request;
235 exchange_type_t exchange_type;
236 /* we must process each request or response from remote host
237 * the check if a given message is possible for a given state is done in here
238 */
239
240 /* find out type of message (request or response) */
241 is_request = message->get_request(message);
242 exchange_type = message->get_exchange_type(message);
243
244 this->logger->log(this->logger, CONTROL|MORE, "Process %s message of exchange type %s",(is_request) ? "REQUEST" : "RESPONSE",
245 mapping_find(exchange_type_m,exchange_type));
246
247 message_id = message->get_message_id(message);
248
249 /*
250 * It has to be checked, if the message has to be resent cause of lost packets!
251 */
252 if (is_request && ( message_id == (this->message_id_in - 1)))
253 {
254 /* message can be resent ! */
255 this->logger->log(this->logger, CONTROL|MORE, "Resent message detected. Send stored reply");
256 return (this->resend_last_reply(this));
257 }
258
259 /* Now, the message id is checked for request AND reply */
260 if (is_request)
261 {
262 /* In a request, the message has to be this->message_id_in (other case is already handled) */
263 if (message_id != this->message_id_in)
264 {
265 this->logger->log(this->logger, ERROR | MORE, "Message request with message id %d received, but %d expected",message_id,this->message_id_in);
266 return FAILED;
267 }
268 }
269 else
270 {
271 /* In a reply, the message has to be this->message_id_out -1 cause it is the reply to the last sent message*/
272 if (message_id != (this->message_id_out - 1))
273 {
274 this->logger->log(this->logger, ERROR | MORE, "Message reply with message id %d received, but %d expected",message_id,this->message_id_in);
275 return FAILED;
276 }
277 }
278
279 /* Now, the exchange type is checked and the appropriate transition handler is called*/
280 switch (message->get_exchange_type(message))
281 {
282 case IKE_SA_INIT:
283 {
284
285 if (message->get_request(message)) {
286 if (this->state == NO_STATE)
287 {
288 /* state transission NO_STATE => IKE_SA_INIT_RESPONDED */
289 return this->transto_ike_sa_init_responded(this, message);
290 }
291 }
292 else
293 {
294 if (this->state == IKE_SA_INIT_REQUESTED)
295 {
296 /* state transission IKE_SA_INIT_REQUESTED => IKE_AUTH_REQUESTED*/
297 return this->transto_ike_auth_requested(this, message);
298 }
299 }
300 break;
301 }
302 case IKE_AUTH:
303 {
304 if (this->state <= IKE_SA_INIT_REQUESTED)
305 {
306 this->logger->log(this->logger, ERROR | MORE, "Current state %s of IKE_SA does not allow IKE_AUTH message",mapping_find(ike_sa_state_m,this->state));
307 return FAILED;
308 }
309 break;
310 }
311 case CREATE_CHILD_SA:
312 {
313 if (this->state < IKE_SA_INITIALIZED)
314 {
315 this->logger->log(this->logger, ERROR | MORE, "Current state %s of IKE_SA does not allow CREATE_CHILD_SA message",mapping_find(ike_sa_state_m,this->state));
316 return FAILED;
317 }
318 break;
319 }
320 case INFORMATIONAL:
321 {
322 break;
323 }
324 default:
325 {
326 this->logger->log(this->logger, ERROR, "processing %s-message not supported.",
327 mapping_find(exchange_type_m,message->get_exchange_type(message)));
328 return NOT_SUPPORTED;
329 }
330 }
331 this->logger->log(this->logger, CONTROL, "received %s-message in state %s, not handled.",
332 mapping_find(exchange_type_m, message->get_exchange_type(message)),
333 mapping_find(ike_sa_state_m, this->state));
334 return INVALID_STATE;
335 }
336
337 /**
338 * @brief Implements function build_message of private_ike_sa_t.
339 */
340 static status_t build_message(private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
341 {
342 status_t status;
343 message_t *new_message;
344 host_t *source, *destination;
345
346 this ->logger->log(this->logger, CONTROL|MORE, "build empty message");
347 new_message = message_create();
348 if (new_message == NULL)
349 {
350 this->logger->log(this->logger, ERROR, "Fatal error: could not create empty message object");
351 return OUT_OF_RES;
352 }
353
354 status = this->me.host->clone(this->me.host, &source);
355 if (status != SUCCESS)
356 {
357 this->logger->log(this->logger, ERROR, "Fatal error: could not clone my host information");
358 new_message->destroy(new_message);
359 return status;
360 }
361 status = this->other.host->clone(this->other.host, &destination);
362 if (status != SUCCESS)
363 {
364 this->logger->log(this->logger, ERROR, "Fatal error: could not clone other host information");
365 source->destroy(source);
366 new_message->destroy(new_message);
367 return status;
368 }
369
370 new_message->set_source(new_message, source);
371 new_message->set_destination(new_message, destination);
372
373 new_message->set_exchange_type(new_message, type);
374 new_message->set_request(new_message, request);
375
376 new_message->set_message_id(new_message, (request) ? this->message_id_out : this->message_id_in);
377
378 status = new_message->set_ike_sa_id(new_message, this->ike_sa_id);
379 if (status != SUCCESS)
380 {
381 this->logger->log(this->logger, ERROR, "Fatal error: could not set ike_sa_id of message");
382 new_message->destroy(new_message);
383 return status;
384 }
385
386 *message = new_message;
387
388 return SUCCESS;
389 }
390
391 /**
392 * @brief Implements function transto_ike_sa_init_requested of private_ike_sa_t.
393 */
394 static status_t transto_ike_sa_init_requested(private_ike_sa_t *this, char *name)
395 {
396 message_t *message;
397 payload_t *payload;
398 packet_t *packet;
399 status_t status;
400
401 this->logger->log(this->logger, CONTROL, "Initializing connection %s",name);
402
403 status = global_configuration_manager->get_local_host(global_configuration_manager, name, &(this->me.host));
404 if (status != SUCCESS)
405 {
406 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve local host configuration information for %s",name);
407 return INVALID_ARG;
408 }
409
410 status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &(this->other.host));
411 if (status != SUCCESS)
412 {
413 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve remote host configuration information for %s",name);
414 return INVALID_ARG;
415 }
416
417 status = global_configuration_manager->get_dh_group_number(global_configuration_manager, name, &(this->ike_sa_init_data.dh_group_number), this->ike_sa_init_data.dh_group_priority);
418 if (status != SUCCESS)
419 {
420 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve DH group number for %s",name);
421 return INVALID_ARG;
422 }
423
424 if (this->ike_sa_init_data.diffie_hellman != NULL)
425 {
426 this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t already existing!");
427 return FAILED;
428 }
429 this ->logger->log(this->logger, CONTROL|MOST, "create diffie hellman object");
430 this->ike_sa_init_data.diffie_hellman = diffie_hellman_create(this->ike_sa_init_data.dh_group_number);
431 if (this->ike_sa_init_data.diffie_hellman == NULL)
432 {
433 this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t could not be created!");
434 return FAILED;
435 }
436
437 if (this->ike_sa_init_data.sent_nonce.ptr != NULL)
438 {
439 this->logger->log(this->logger, ERROR, "Nonce for IKE_SA_INIT phase already existing!");
440 return FAILED;
441 }
442
443 if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 16, &(this->ike_sa_init_data.sent_nonce)) != SUCCESS)
444 {
445 this->logger->log(this->logger, ERROR, "Could not create nonce!");
446 return OUT_OF_RES;
447 }
448
449
450 /* going to build message */
451 status = this->build_message(this, IKE_SA_INIT, TRUE, &message);
452 if (status != SUCCESS)
453 {
454 this->logger->log(this->logger, ERROR, "Could not build message");
455 return status;
456 }
457
458 /* build SA payload */
459 status = this->build_sa_payload(this, (sa_payload_t**)&payload);
460 if (status != SUCCESS)
461 {
462 this->logger->log(this->logger, ERROR, "Could not build SA payload");
463 message->destroy(message);
464 return status;
465 }
466
467 this ->logger->log(this->logger, CONTROL|MOST, "add SA payload to message");
468 status = message->add_payload(message, payload);
469 if (status != SUCCESS)
470 {
471 this->logger->log(this->logger, ERROR, "Could not add SA payload to message");
472 message->destroy(message);
473 return status;
474 }
475
476
477 /* build KE payload */
478 status = this->build_ke_payload(this,(ke_payload_t **) &payload);
479 if (status != SUCCESS)
480 {
481 this->logger->log(this->logger, ERROR, "Could not build KE payload");
482 message->destroy(message);
483 return status;
484 }
485
486 this ->logger->log(this->logger, CONTROL|MOST, "add KE payload to message");
487 status = message->add_payload(message, payload);
488 if (status != SUCCESS)
489 {
490 this->logger->log(this->logger, ERROR, "Could not add KE payload to message");
491 message->destroy(message);
492 return status;
493 }
494
495 /* build Nonce payload */
496 status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
497 if (status != SUCCESS)
498 {
499 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
500 message->destroy(message);
501 return status;
502 }
503
504 this ->logger->log(this->logger, CONTROL|MOST, "add nonce payload to message");
505 status = message->add_payload(message, payload);
506 if (status != SUCCESS)
507 {
508 this->logger->log(this->logger, ERROR, "Could not add nonce payload to message");
509 message->destroy(message);
510 return status;
511 }
512
513 this ->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
514 status = message->generate(message, &packet);
515 if (status != SUCCESS)
516 {
517 this->logger->log(this->logger, ERROR, "Fatal error: could not generate packet from message");
518 message->destroy(message);
519 return status;
520 }
521
522 this ->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
523 status = global_send_queue->add(global_send_queue, packet);
524 if (status != SUCCESS)
525 {
526 this->logger->log(this->logger, ERROR, "Could not add packet to send queue");
527 message->destroy(message);
528 return status;
529 }
530
531 if ( this->last_requested_message != NULL)
532 {
533 /* destroy message */
534 this ->logger->log(this->logger, CONTROL|MOST, "Destroy stored last requested message");
535 this->last_requested_message->destroy(this->last_requested_message);
536 }
537
538 this->last_requested_message = message;
539
540 /* message counter can now be increased */
541 this->message_id_out++;
542
543 /* states has NOW changed :-) */
544 this ->logger->log(this->logger, CONTROL|MORE, "Change state of IKE_SA from %s to %s",mapping_find(ike_sa_state_m,this->state),mapping_find(ike_sa_state_m,IKE_SA_INIT_REQUESTED) );
545 this->state = IKE_SA_INIT_REQUESTED;
546
547 return SUCCESS;
548 }
549
550 static status_t transto_ike_sa_init_responded(private_ike_sa_t *this, message_t *request)
551 {
552 status_t status;
553 linked_list_iterator_t *payloads;
554 message_t *response;
555 host_t *source, *destination;
556
557 /* this is the first message we process, so copy host infos */
558 request->get_source(request, &source);
559 request->get_destination(request, &destination);
560 /* we need to clone them, since we destroy the message later */
561 destination->clone(destination, &(this->me.host));
562 source->clone(source, &(this->other.host));
563
564 /* parse incoming message */
565 status = request->parse_body(request);
566 if (status != SUCCESS)
567 {
568 this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message");
569 this->create_delete_job(this);
570 return status;
571 }
572
573 /* iterate over incoming payloads. We can be sure, the message contains only accepted payloads! */
574 status = request->get_payload_iterator(request, &payloads);
575 if (status != SUCCESS)
576 {
577 this->logger->log(this->logger, ERROR, "Fatal error: Could not get payload interator");
578 this->create_delete_job(this);
579 return status;
580 }
581
582 while (payloads->has_next(payloads))
583 {
584 payload_t *payload;
585
586 /* get current payload */
587 payloads->current(payloads, (void**)&payload);
588
589 this->logger->log(this->logger, CONTROL|MORE, "Processing payload of type %s", mapping_find(payload_type_m, payload->get_type(payload)));
590 switch (payload->get_type(payload))
591 {
592 case SECURITY_ASSOCIATION:
593 {
594 sa_payload_t *sa_payload = (sa_payload_t*)payload;
595 linked_list_iterator_t *suggested_proposals, *accepted_proposals;
596
597 /* create a list for accepted proposals */
598 if (this->ike_sa_init_data.proposals == NULL)
599 {
600 this->ike_sa_init_data.proposals = linked_list_create();
601 }
602 else
603 {
604 /* delete stored proposals */
605 while (this->ike_sa_init_data.proposals->get_count(this->ike_sa_init_data.proposals) > 0)
606 {
607 proposal_substructure_t *current_proposal;
608 this->ike_sa_init_data.proposals->remove_first(this->ike_sa_init_data.proposals,(void **)&current_proposal);
609 current_proposal->destroy(current_proposal);
610 }
611 }
612 if (this->ike_sa_init_data.proposals == NULL)
613 {
614 /* destroy iterator and leave */
615 this->logger->log(this->logger, ERROR, "Fatal error: Could not create list for proposals");
616 payloads->destroy(payloads);
617 this->create_delete_job(this);
618 return OUT_OF_RES;
619 }
620 status = this->ike_sa_init_data.proposals->create_iterator(this->ike_sa_init_data.proposals, &accepted_proposals, FALSE);
621 if (status != SUCCESS)
622 {
623 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on list for proposals");
624 payloads->destroy(payloads);
625 this->create_delete_job(this);
626 return status;
627 }
628
629 /* get the list of suggested proposals */
630 status = sa_payload->create_proposal_substructure_iterator(sa_payload, &suggested_proposals, TRUE);
631 if (status != SUCCESS)
632 {
633 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on suggested proposals");
634 accepted_proposals->destroy(accepted_proposals);
635 payloads->destroy(payloads);
636 this->create_delete_job(this);
637 return status;
638 }
639
640 /* now let the configuration-manager select a subset of the proposals */
641 status = global_configuration_manager->select_proposals_for_host(global_configuration_manager,
642 this->other.host, suggested_proposals, accepted_proposals);
643 if (status != SUCCESS)
644 {
645 this->logger->log(this->logger, CONTROL | MORE, "No proposal of suggested proposals selected");
646 suggested_proposals->destroy(suggested_proposals);
647 accepted_proposals->destroy(accepted_proposals);
648 payloads->destroy(payloads);
649 this->create_delete_job(this);
650 return status;
651 }
652
653 /* iterators are not needed anymore */
654 suggested_proposals->destroy(suggested_proposals);
655 accepted_proposals->destroy(accepted_proposals);
656
657 /* ok, we have what we need for sa_payload (proposals are stored in this->proposals)*/
658 break;
659 }
660 case KEY_EXCHANGE:
661 {
662 ke_payload_t *ke_payload = (ke_payload_t*)payload;
663 diffie_hellman_group_t group;
664 diffie_hellman_t *dh;
665 bool allowed_group;
666
667 group = ke_payload->get_dh_group_number(ke_payload);
668
669 status = global_configuration_manager->is_dh_group_allowed_for_host(global_configuration_manager,
670 this->other.host, group, &allowed_group);
671
672 if (status != SUCCESS)
673 {
674 this->logger->log(this->logger, ERROR | MORE, "Could not get informations about DH group");
675 payloads->destroy(payloads);
676 this->create_delete_job(this);
677 return status;
678 }
679 if (!allowed_group)
680 {
681 /** @todo Send info reply */
682 }
683
684 /* create diffie hellman object to handle DH exchange */
685 dh = diffie_hellman_create(group);
686 if (dh == NULL)
687 {
688 this->logger->log(this->logger, ERROR, "Could not generate DH object");
689 payloads->destroy(payloads);
690 this->create_delete_job(this);
691 return OUT_OF_RES;
692 }
693
694 this->logger->log(this->logger, CONTROL | MORE, "Set other DH public value");
695
696 status = dh->set_other_public_value(dh, ke_payload->get_key_exchange_data(ke_payload));
697 if (status != SUCCESS)
698 {
699 this->logger->log(this->logger, ERROR, "Could not set other DH public value");
700 dh->destroy(dh);
701 payloads->destroy(payloads);
702 this->create_delete_job(this);
703 return OUT_OF_RES;
704 }
705 /** @todo destroy if there is already one */
706 this->ike_sa_init_data.diffie_hellman = dh;
707 break;
708 }
709 case NONCE:
710 {
711 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
712 chunk_t nonce;
713
714 this->logger->log(this->logger, CONTROL | MORE, "Get nonce value and store it");
715 nonce_payload->get_nonce(nonce_payload, &nonce);
716 /** @todo free if there is already one */
717 this->ike_sa_init_data.received_nonce.ptr = allocator_clone_bytes(nonce.ptr, nonce.len);
718 this->ike_sa_init_data.received_nonce.len = nonce.len;
719 if (this->ike_sa_init_data.received_nonce.ptr == NULL)
720 {
721 payloads->destroy(payloads);
722 this->create_delete_job(this);
723 return OUT_OF_RES;
724 }
725 break;
726 }
727 default:
728 {
729 /** @todo handle */
730 }
731
732 }
733
734 }
735 /* iterator can be destroyed */
736 payloads->destroy(payloads);
737
738 this->logger->log(this->logger, CONTROL | MORE, "Request successfully handled. Going to create reply.");
739
740 /* set up the reply */
741 status = this->build_message(this, IKE_SA_INIT, FALSE, &response);
742 if (status != SUCCESS)
743 {
744 this->logger->log(this->logger, ERROR, "Could not create empty message");
745 this->create_delete_job(this);
746 return status;
747 }
748
749 /* leaks */
750 response->destroy(response);
751
752
753 return SUCCESS;
754 }
755
756 static status_t transto_ike_auth_requested(private_ike_sa_t *this, message_t *response)
757 {
758 status_t status;
759 linked_list_iterator_t *payloads;
760
761
762 /* parse incoming message */
763 status = response->parse_body(response);
764 if (status != SUCCESS)
765 {
766 this->logger->log(this->logger, ERROR, "Could not parse body");
767 return status;
768 }
769 /* iterate over incoming payloads */
770 status = response->get_payload_iterator(response, &payloads);
771 if (status != SUCCESS)
772 {
773 response->destroy(response);
774 return status;
775 }
776 while (payloads->has_next(payloads))
777 {
778 payload_t *payload;
779 payloads->current(payloads, (void**)&payload);
780
781 this->logger->log(this->logger, CONTROL|MORE, "Processing payload %s", mapping_find(payload_type_m, payload->get_type(payload)));
782 switch (payload->get_type(payload))
783 {
784 // case SECURITY_ASSOCIATION:
785 // {
786 // sa_payload_t *sa_payload = (sa_payload_t*)payload;
787 // linked_list_iterator_t *suggested_proposals, *accepted_proposals;
788 // /* create a list for accepted proposals */
789 // if (this->ike_sa_init_data.proposals == NULL) {
790 // this->ike_sa_init_data.proposals = linked_list_create();
791 // }
792 // else
793 // {
794 // /** @todo destroy list contents */
795 // }
796 // if (this->ike_sa_init_data.proposals == NULL)
797 // {
798 // payloads->destroy(payloads);
799 // return OUT_OF_RES;
800 // }
801 // status = this->ike_sa_init_data.proposals->create_iterator(this->ike_sa_init_data.proposals, &accepted_proposals, FALSE);
802 // if (status != SUCCESS)
803 // {
804 // payloads->destroy(payloads);
805 // return status;
806 // }
807 //
808 // /* get the list of suggested proposals */
809 // status = sa_payload->create_proposal_substructure_iterator(sa_payload, &suggested_proposals, TRUE);
810 // if (status != SUCCESS)
811 // {
812 // accepted_proposals->destroy(accepted_proposals);
813 // payloads->destroy(payloads);
814 // return status;
815 // }
816 //
817 // /* now let the configuration-manager select a subset of the proposals */
818 // status = global_configuration_manager->select_proposals_for_host(global_configuration_manager,
819 // this->other.host, suggested_proposals, accepted_proposals);
820 // if (status != SUCCESS)
821 // {
822 // suggested_proposals->destroy(suggested_proposals);
823 // accepted_proposals->destroy(accepted_proposals);
824 // payloads->destroy(payloads);
825 // return status;
826 // }
827 //
828 // suggested_proposals->destroy(suggested_proposals);
829 // accepted_proposals->destroy(accepted_proposals);
830 //
831 // /* ok, we have what we need for sa_payload */
832 // break;
833 // }
834 case KEY_EXCHANGE:
835 {
836 ke_payload_t *ke_payload = (ke_payload_t*)payload;
837 diffie_hellman_t *dh;
838 chunk_t shared_secret;
839
840 dh = this->ike_sa_init_data.diffie_hellman;
841
842
843
844
845 status = dh->set_other_public_value(dh, ke_payload->get_key_exchange_data(ke_payload));
846 if (status != SUCCESS)
847 {
848 dh->destroy(dh);
849 payloads->destroy(payloads);
850 return OUT_OF_RES;
851 }
852
853 status = dh->get_shared_secret(dh, &shared_secret);
854
855 this->logger->log_chunk(this->logger, RAW, "Shared secret", &shared_secret);
856
857 break;
858 }
859 case NONCE:
860 {
861 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
862 chunk_t nonce;
863
864 nonce_payload->get_nonce(nonce_payload, &nonce);
865 /** @todo free if there is already one */
866 this->ike_sa_init_data.received_nonce.ptr = allocator_clone_bytes(nonce.ptr, nonce.len);
867 this->ike_sa_init_data.received_nonce.len = nonce.len;
868 if (this->ike_sa_init_data.received_nonce.ptr == NULL)
869 {
870 payloads->destroy(payloads);
871 return OUT_OF_RES;
872 }
873 break;
874 }
875 default:
876 {
877 /** @todo handle */
878 }
879
880 }
881
882 }
883 payloads->destroy(payloads);
884
885 printf("done.\n");
886
887 /* set up the reply */
888 status = this->build_message(this, IKE_SA_INIT, FALSE, &response);
889 if (status != SUCCESS)
890 {
891 this->create_delete_job(this);
892 return status;
893 }
894
895 response->destroy(response);
896
897 return SUCCESS;
898
899
900 }
901
902 /**
903 * @brief implements function process_configuration of private_ike_sa_t
904 */
905 static status_t initialize_connection(private_ike_sa_t *this, char *name)
906 {
907 /* work is done in transto_ike_sa_init_requested */
908 return (this->transto_ike_sa_init_requested(this,name));
909 }
910
911 /**
912 * @brief implements function private_ike_sa_t.get_id
913 */
914 static ike_sa_id_t* get_id(private_ike_sa_t *this)
915 {
916 return this->ike_sa_id;
917 }
918
919 /**
920 * implements private_ike_sa_t.build_sa_payload
921 */
922 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
923 {
924 sa_payload_t* sa_payload;
925 linked_list_iterator_t *iterator;
926 status_t status;
927
928 this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
929
930 sa_payload = sa_payload_create();
931 if (sa_payload == NULL)
932 {
933 return OUT_OF_RES;
934 }
935 status = sa_payload->create_proposal_substructure_iterator(sa_payload, &iterator, FALSE);
936 if (status != SUCCESS)
937 {
938 sa_payload->destroy(sa_payload);
939 return status;
940 }
941 status = global_configuration_manager->get_proposals_for_host(global_configuration_manager, this->other.host, iterator);
942 if (status != SUCCESS)
943 {
944 sa_payload->destroy(sa_payload);
945 return status;
946 }
947
948 *payload = sa_payload;
949
950 return SUCCESS;
951 }
952
953 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
954 {
955 ke_payload_t *ke_payload;
956 chunk_t key_data;
957 status_t status;
958
959 this->logger->log(this->logger, CONTROL|MORE, "building ke payload");
960
961 if (this->state != NO_STATE)
962 {
963 this->logger->log(this->logger, ERROR, "KE payload in state %s not supported",mapping_find(ike_sa_state_m,this->state));
964 return FALSE;
965 }
966
967 switch(this->ike_sa_id->is_initiator(this->ike_sa_id))
968 {
969 case TRUE:
970 {
971 this ->logger->log(this->logger, CONTROL|MORE, "get public dh value to send in ke payload");
972 status = this->ike_sa_init_data.diffie_hellman->get_my_public_value(this->ike_sa_init_data.diffie_hellman,&key_data);
973 if (status != SUCCESS)
974 {
975 this->logger->log(this->logger, ERROR, "Could not get my DH public value");
976 return status;
977 }
978
979 ke_payload = ke_payload_create();
980 if (ke_payload == NULL)
981 {
982 this->logger->log(this->logger, ERROR, "Could not create KE payload");
983 allocator_free_chunk(key_data);
984 return OUT_OF_RES;
985 }
986 ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
987 if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
988 {
989 this->logger->log(this->logger, ERROR, "Could not set key exchange data of KE payload");
990 ke_payload->destroy(ke_payload);
991 allocator_free_chunk(key_data);
992 return OUT_OF_RES;
993 }
994 allocator_free_chunk(key_data);
995
996 *payload = ke_payload;
997 return SUCCESS;
998 }
999 default: /* FALSE */
1000 {
1001 break;
1002 }
1003 }
1004
1005 return FAILED;
1006 }
1007
1008 /**
1009 * implements private_ike_sa_t.build_nonce_payload
1010 */
1011 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
1012 {
1013 nonce_payload_t *nonce_payload;
1014
1015 this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
1016 nonce_payload = nonce_payload_create();
1017 if (nonce_payload == NULL)
1018 {
1019 return OUT_OF_RES;
1020 }
1021
1022 nonce_payload->set_nonce(nonce_payload, this->ike_sa_init_data.sent_nonce);
1023
1024 *payload = nonce_payload;
1025
1026 return SUCCESS;
1027 }
1028
1029 /**
1030 * @brief implements function resend_last_reply of private_ike_sa_t
1031 */
1032 status_t resend_last_reply (private_ike_sa_t *this)
1033 {
1034 packet_t *packet;
1035 status_t status;
1036
1037 status = this->last_responded_message->generate(this->last_responded_message, &packet);
1038 if (status != SUCCESS)
1039 {
1040 this->logger->log(this->logger, ERROR, "Could not generate message to resent");
1041 return status;
1042 }
1043
1044 status = global_send_queue->add(global_send_queue, packet);
1045 if (status != SUCCESS)
1046 {
1047 this->logger->log(this->logger, ERROR, "Could not add packet to send queue");
1048 packet->destroy(packet);
1049 return status;
1050 }
1051 return SUCCESS;
1052 }
1053
1054 status_t create_delete_job (private_ike_sa_t *this)
1055 {
1056 job_t *delete_job;
1057 status_t status;
1058
1059 this->logger->log(this->logger, CONTROL | MORE, "Going to create job to delete this IKE_SA");
1060
1061 delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
1062 if (delete_job == NULL)
1063 {
1064 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
1065 return FAILED;
1066 }
1067
1068 status = global_job_queue->add(global_job_queue,delete_job);
1069 if (status != SUCCESS)
1070 {
1071 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
1072 delete_job->destroy_all(delete_job);
1073 return status;
1074 }
1075 return SUCCESS;
1076 }
1077
1078 /**
1079 * @brief implements function destroy of private_ike_sa_t
1080 */
1081 static status_t destroy (private_ike_sa_t *this)
1082 {
1083
1084 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy IKE_SA");
1085
1086 /* destroy child sa's */
1087 this->logger->log(this->logger, CONTROL | MOST, "Destroy all child_sa's");
1088 while (this->child_sas->get_count(this->child_sas) > 0)
1089 {
1090 void *child_sa;
1091 if (this->child_sas->remove_first(this->child_sas,&child_sa) != SUCCESS)
1092 {
1093 break;
1094 }
1095 /* destroy child sa */
1096 }
1097 this->child_sas->destroy(this->child_sas);
1098
1099 /* destroy ike_sa_id */
1100 this->logger->log(this->logger, CONTROL | MOST, "Destroy assigned ike_sa_id");
1101 this->ike_sa_id->destroy(this->ike_sa_id);
1102
1103 /* destroy stored requested message */
1104 if (this->last_requested_message != NULL)
1105 {
1106 this->logger->log(this->logger, CONTROL | MOST, "Destroy last requested message");
1107 this->last_requested_message->destroy(this->last_requested_message);
1108 }
1109
1110 /* destroy stored responded messages */
1111 if (this->last_responded_message != NULL)
1112 {
1113 this->logger->log(this->logger, CONTROL | MOST, "Destroy last responded message");
1114 this->last_responded_message->destroy(this->last_responded_message);
1115 }
1116
1117 /* destroy stored proposal */
1118 if (this->ike_sa_init_data.proposals != NULL)
1119 {
1120 this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
1121 while (this->ike_sa_init_data.proposals->get_count(this->ike_sa_init_data.proposals) > 0)
1122 {
1123 proposal_substructure_t *current_proposal;
1124 this->ike_sa_init_data.proposals->remove_first(this->ike_sa_init_data.proposals,(void **)&current_proposal);
1125 current_proposal->destroy(current_proposal);
1126 }
1127 this->ike_sa_init_data.proposals->destroy(this->ike_sa_init_data.proposals);
1128 }
1129
1130 this->logger->log(this->logger, CONTROL | MOST, "Destroy randomizer");
1131 this->randomizer->destroy(this->randomizer);
1132
1133
1134 /* destroy ike_sa_init data */
1135 this->logger->log(this->logger, CONTROL | MOST, "Going to destroy ike_sa_init data");
1136 if (this->ike_sa_init_data.diffie_hellman != NULL)
1137 {
1138 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
1139 this->ike_sa_init_data.diffie_hellman->destroy(this->ike_sa_init_data.diffie_hellman);
1140 }
1141 if (this->ike_sa_init_data.sent_nonce.ptr != NULL)
1142 {
1143 this->logger->log(this->logger, CONTROL | MOST, "Destroy sent nonce data");
1144 allocator_free_chunk(this->ike_sa_init_data.sent_nonce);
1145 }
1146 if (this->ike_sa_init_data.received_nonce.ptr != NULL)
1147 {
1148 this->logger->log(this->logger, CONTROL | MOST, "Destroy received nonce data");
1149 allocator_free_chunk(this->ike_sa_init_data.received_nonce);
1150 }
1151
1152 if (this->me.host != NULL)
1153 {
1154 this->logger->log(this->logger, CONTROL | MOST, "Destroy host informations of me");
1155 this->me.host->destroy(this->me.host);
1156 }
1157
1158 if (this->other.host != NULL)
1159 {
1160 this->logger->log(this->logger, CONTROL | MOST, "Destroy host informations of other");
1161 this->other.host->destroy(this->other.host);
1162 }
1163
1164
1165 this->logger->log(this->logger, CONTROL | MOST, "Destroy logger of IKE_SA");
1166 global_logger_manager->destroy_logger(global_logger_manager, this->logger);
1167
1168 allocator_free(this);
1169 return SUCCESS;
1170 }
1171
1172 /*
1173 * Described in Header
1174 */
1175 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
1176 {
1177 private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
1178 if (this == NULL)
1179 {
1180 return NULL;
1181 }
1182
1183 /* Public functions */
1184 this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
1185 this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
1186 this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
1187 this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
1188
1189 /* private functions */
1190 this->build_sa_payload = build_sa_payload;
1191 this->build_nonce_payload = build_nonce_payload;
1192 this->build_ke_payload = build_ke_payload;
1193 this->build_message = build_message;
1194 this->transto_ike_sa_init_requested = transto_ike_sa_init_requested;
1195 this->transto_ike_sa_init_responded = transto_ike_sa_init_responded;
1196 this->transto_ike_auth_requested = transto_ike_auth_requested;
1197 this->resend_last_reply = resend_last_reply;
1198 this->create_delete_job = create_delete_job;
1199
1200
1201 /* initialize private fields */
1202 this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
1203 if (this->logger == NULL)
1204 {
1205 allocator_free(this);
1206 }
1207
1208 if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
1209 {
1210 this->logger->log(this->logger, ERROR, "Fatal error: Could not clone ike_sa_id");
1211 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
1212 allocator_free(this);
1213 return NULL;
1214 }
1215 this->child_sas = linked_list_create();
1216 if (this->child_sas == NULL)
1217 {
1218 this->logger->log(this->logger, ERROR, "Fatal error: Could not create list for child_sa's");
1219 this->ike_sa_id->destroy(this->ike_sa_id);
1220 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
1221 allocator_free(this);
1222 return NULL;
1223 }
1224 this->randomizer = randomizer_create();
1225 if (this->randomizer == NULL)
1226 {
1227 this->logger->log(this->logger, ERROR, "Fatal error: Could not create list for child_sa's");
1228 this->child_sas->destroy(this->child_sas);
1229 this->ike_sa_id->destroy(this->ike_sa_id);
1230 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
1231 allocator_free(this);
1232 }
1233
1234 this->me.host = NULL;
1235 this->other.host = NULL;
1236 this->ike_sa_init_data.diffie_hellman = NULL;
1237 this->ike_sa_init_data.dh_group_number = 0;
1238 /* 1 means highest priority */
1239 this->ike_sa_init_data.dh_group_priority = 1;
1240 this->ike_sa_init_data.sent_nonce.len = 0;
1241 this->ike_sa_init_data.sent_nonce.ptr = NULL;
1242 this->ike_sa_init_data.received_nonce.len = 0;
1243 this->ike_sa_init_data.received_nonce.ptr = NULL;
1244 this->ike_sa_init_data.proposals = NULL;
1245 this->last_requested_message = NULL;
1246 this->last_responded_message = NULL;
1247 this->message_id_out = 0;
1248 this->message_id_in = 0;
1249
1250
1251 /* at creation time, IKE_SA isn't in a specific state */
1252 this->state = NO_STATE;
1253
1254 return (&this->public);
1255 }
strongSwan - IPsec VPN