Source/charon/ike_sa.c

   1 /**
   2  * @file ike_sa.c
   3  *
   4  * @brief Class ike_sa_t. An object of this type is managed by an
   5  * ike_sa_manager_t object and represents an IKE_SA
   6  *
   7  */
   8
   9 /*
  10  * Copyright (C) 2005 Jan Hutter, Martin Willi
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include "ike_sa.h"
  25
  26 #include "types.h"
  27 #include "globals.h"
  28 #include "utils/allocator.h"
  29 #include "utils/linked_list.h"
  30 #include "utils/logger_manager.h"
  31 #include "utils/randomizer.h"
  32 #include "payloads/sa_payload.h"
  33 #include "payloads/nonce_payload.h"
  34 #include "payloads/ke_payload.h"
  35 #include "payloads/transform_substructure.h"
  36 #include "payloads/transform_attribute.h"
  37
  38
  39 /**
  40  * States in which a IKE_SA can actually be
  41  */
  42 typedef enum ike_sa_state_e ike_sa_state_t;
  43
  44 enum ike_sa_state_e {
  45
  46         /**
  47          * IKE_SA is is not in a state
  48          */
  49         NO_STATE = 1,
  50
  51         /**
  52          * A IKE_SA_INIT-message was sent: role initiator
  53          */
  54         IKE_SA_INIT_REQUESTED = 2,
  55
  56         /**
  57          * A IKE_SA_INIT-message was replied: role responder
  58          */
  59         IKE_SA_INIT_RESPONDED = 3,
  60
  61         /**
  62          * An IKE_AUTH-message was sent after a successful
  63          * IKE_SA_INIT-exchange: role initiator
  64          */
  65         IKE_AUTH_REQUESTED = 4,
  66
  67         /**
  68          * An IKE_AUTH-message was replied: role responder.
  69          * In this state, all the informations for an IKE_SA
  70          * and one CHILD_SA are known.
  71          */
  72         IKE_SA_INITIALIZED = 5
  73 };
  74
  75
  76 /**
  77  * Private data of an message_t object
  78  */
  79 typedef struct private_ike_sa_s private_ike_sa_t;
  80
  81 struct private_ike_sa_s {
  82
  83         /**
  84          * Public part of a ike_sa_t object
  85          */
  86         ike_sa_t public;
  87
  88         status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
  89         status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
  90         status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
  91
  92         /* Private values */
  93         /**
  94          * Identifier for the current IKE_SA
  95          */
  96         ike_sa_id_t *ike_sa_id;
  97
  98         /**
  99          * Linked List containing the child sa's of the current IKE_SA
 100          */
 101         linked_list_t *child_sas;
 102
 103         /**
 104          * Current state of the IKE_SA
 105          */
 106         ike_sa_state_t current_state;
 107
 108         /**
 109          * is this IKE_SA the original initiator of this IKE_SA
 110          */
 111         bool original_initiator;
 112
 113         /**
 114          * this SA's source for random data
 115          */
 116         randomizer_t *randomizer;
 117
 118         linked_list_t *sent_messages;
 119
 120         struct {
 121                 host_t *host;
 122         } me;
 123
 124         struct {
 125                 host_t *host;
 126         } other;
 127
 128         /**
 129          * a logger for this IKE_SA
 130          */
 131         logger_t *logger;
 132 };
 133
 134 /**
 135  * @brief implements function process_message of private_ike_sa_t
 136  */
 137 static status_t process_message (private_ike_sa_t *this, message_t *message)
 138 {
 139         status_t status;
 140         /* @TODO Add Message Processing here */
 141
 142         this->logger->log(this->logger, CONTROL_MORE, "Process message of exchange type %s",mapping_find(exchange_type_m,message->get_exchange_type(message)));
 143
 144         status = message->parse_body(message);
 145         switch (status)
 146         {
 147                 case SUCCESS:
 148                 {
 149                         break;
 150                 }
 151                 default:
 152                 {
 153                         this->logger->log(this->logger, CONTROL_MORE, "Error of type %s while parsing message body",mapping_find(status_m,status));
 154                         return FAILED;
 155                 }
 156         }
 157
 158         return status;
 159 }
 160
 161 /**
 162  * @brief implements function process_configuration of private_ike_sa_t
 163  */
 164 static status_t initialize_connection(private_ike_sa_t *this, char *name)
 165 {
 166         message_t *message;
 167         payload_t *payload;
 168         packet_t *packet;
 169         status_t status;
 170
 171         this->logger->log(this->logger, CONTROL, "initializing connection");
 172
 173         this->original_initiator = TRUE;
 174
 175         message = message_create();
 176
 177         if (message == NULL)
 178         {
 179                 return OUT_OF_RES;
 180         }
 181
 182
 183         message->set_exchange_type(message, IKE_SA_INIT);
 184         message->set_original_initiator(message, this->original_initiator);
 185         message->set_message_id(message, 0);
 186         message->set_ike_sa_id(message, this->ike_sa_id);
 187         message->set_request(message, TRUE);
 188
 189         status = this->build_sa_payload(this, (sa_payload_t**)&payload);
 190         if (status != SUCCESS)
 191         {
 192                 message->destroy(message);
 193                 return status;
 194         }
 195         payload->set_next_type(payload, KEY_EXCHANGE);
 196         message->add_payload(message, payload);
 197
 198         status = this->build_ke_payload(this, (ke_payload_t**)&payload);
 199         if (status != SUCCESS)
 200         {
 201                 message->destroy(message);
 202                 return status;
 203         }
 204         payload->set_next_type(payload, NONCE);
 205         message->add_payload(message, payload);
 206
 207         status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
 208         if (status != SUCCESS)
 209         {
 210                 message->destroy(message);
 211                 return status;
 212         }
 213         payload->set_next_type(payload, NO_PAYLOAD);
 214         message->add_payload(message, payload);
 215
 216         status = message->generate(message, &packet);
 217         if (status != SUCCESS)
 218         {
 219                 message->destroy(message);
 220                 return status;
 221         }
 222
 223         global_send_queue->add(global_send_queue, packet);
 224
 225
 226         message->destroy(message);
 227
 228
 229         return OUT_OF_RES;
 230 }
 231
 232 /**
 233  * @brief implements function private_ike_sa_t.get_id
 234  */
 235 static ike_sa_id_t* get_id(private_ike_sa_t *this)
 236 {
 237         return this->ike_sa_id;
 238 }
 239
 240 /**
 241  * implements private_ike_sa_t.build_sa_payload
 242  */
 243 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
 244 {
 245         sa_payload_t *sa_payload;
 246         proposal_substructure_t *proposal;
 247         transform_substructure_t *transform;
 248         transform_attribute_t *attribute;
 249
 250
 251         this->logger->log(this->logger, CONTROL_MORE, "building sa payload");
 252
 253         sa_payload = sa_payload_create();
 254         if (sa_payload == NULL)
 255         {
 256                 return OUT_OF_RES;
 257         }
 258
 259         do
 260         {       /* no loop, just to break */
 261                 proposal = proposal_substructure_create();
 262                 if (proposal == NULL)
 263                 {
 264                         break;
 265                 }
 266                 sa_payload->add_proposal_substructure(sa_payload, proposal);
 267
 268                 /*
 269                  * Encryption Algorithm
 270                  */
 271                 transform = transform_substructure_create();
 272                 if (transform == NULL)
 273                 {
 274                         break;
 275                 }
 276                 proposal->add_transform_substructure(proposal, transform);
 277                 transform->set_is_last_transform(transform, FALSE);
 278                 transform->set_transform_type(transform, ENCRYPTION_ALGORITHM);
 279                 transform->set_transform_id(transform, ENCR_AES_CBC);
 280
 281                 attribute = transform_attribute_create();
 282                 if (attribute == NULL)
 283                 {
 284                         break;
 285                 }
 286                 transform->add_transform_attribute(transform, attribute);
 287                 attribute->set_attribute_type(attribute, KEY_LENGTH);
 288                 attribute->set_value(attribute, 16);
 289
 290                 /*
 291                  * Pseudo-random Function
 292                  */
 293                 transform = transform_substructure_create();
 294                 if (transform == NULL)
 295                 {
 296                         break;
 297                 }
 298                 proposal->add_transform_substructure(proposal, transform);
 299                 transform->set_is_last_transform(transform, FALSE);
 300                 transform->set_transform_type(transform, PSEUDO_RANDOM_FUNCTION);
 301                 transform->set_transform_id(transform, PRF_HMAC_SHA1);
 302
 303                 attribute = transform_attribute_create();
 304                 if (attribute == NULL)
 305                 {
 306                         break;
 307                 }
 308                 transform->add_transform_attribute(transform, attribute);
 309                 attribute->set_attribute_type(attribute, KEY_LENGTH);
 310                 attribute->set_value(attribute, 16);
 311
 312
 313                 /*
 314                  * Integrity Algorithm
 315                  */
 316                 transform = transform_substructure_create();
 317                 if (transform == NULL)
 318                 {
 319                         break;
 320                 }
 321                 proposal->add_transform_substructure(proposal, transform);
 322                 transform->set_is_last_transform(transform, FALSE);
 323                 transform->set_transform_type(transform, INTEGRITIY_ALGORITHM);
 324                 transform->set_transform_id(transform, AUTH_HMAC_SHA1_96);
 325
 326                 attribute = transform_attribute_create();
 327                 if (attribute == NULL)
 328                 {
 329                         break;
 330                 }
 331                 transform->add_transform_attribute(transform, attribute);
 332                 attribute->set_attribute_type(attribute, KEY_LENGTH);
 333                 attribute->set_value(attribute, 16);
 334
 335
 336             /*
 337              * Diffie-Hellman Group
 338              */
 339                 transform = transform_substructure_create();
 340                 if (transform == NULL)
 341                 {
 342                         break;
 343                 }
 344                 proposal->add_transform_substructure(proposal, transform);
 345                 transform->set_is_last_transform(transform, FALSE);
 346                 transform->set_transform_type(transform, DIFFIE_HELLMAN_GROUP);
 347                 transform->set_transform_id(transform, MODP_1024_BIT);
 348
 349                 *payload = sa_payload;
 350
 351                 return SUCCESS;
 352
 353         } while(FALSE);
 354
 355         return OUT_OF_RES;
 356 }
 357
 358 /**
 359  * implements private_ike_sa_t.build_ke_payload
 360  */
 361 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
 362 {
 363         ke_payload_t *ke_payload;
 364         chunk_t key_data;
 365
 366
 367         this->logger->log(this->logger, CONTROL_MORE, "building ke payload");
 368
 369         key_data.ptr = "12345";
 370         key_data.len = strlen("12345");
 371
 372
 373         ke_payload = ke_payload_create();
 374         if (ke_payload == NULL)
 375         {
 376                 return OUT_OF_RES;
 377         }
 378         ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
 379         if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
 380         {
 381                 ke_payload->destroy(ke_payload);
 382                 return OUT_OF_RES;
 383         }
 384         *payload = ke_payload;
 385         return SUCCESS;
 386 }
 387
 388 /**
 389  * implements private_ike_sa_t.build_nonce_payload
 390  */
 391 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
 392 {
 393         nonce_payload_t *nonce_payload;
 394         chunk_t nonce;
 395
 396         this->logger->log(this->logger, CONTROL_MORE, "building nonce payload");
 397
 398         if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 16, &nonce) != SUCCESS)
 399         {
 400                 return OUT_OF_RES;
 401         }
 402
 403         nonce_payload = nonce_payload_create();
 404         if (nonce_payload == NULL)
 405         {
 406                 return OUT_OF_RES;
 407         }
 408
 409         nonce_payload->set_nonce(nonce_payload, nonce);
 410
 411         *payload = nonce_payload;
 412
 413         return SUCCESS;
 414 }
 415
 416 /**
 417  * @brief implements function destroy of private_ike_sa_t
 418  */
 419 static status_t destroy (private_ike_sa_t *this)
 420 {
 421         linked_list_iterator_t *iterator;
 422
 423         this->child_sas->create_iterator(this->child_sas, &iterator, TRUE);
 424         while (iterator->has_next(iterator))
 425         {
 426                 payload_t *payload;
 427                 iterator->current(iterator, (void**)&payload);
 428                 payload->destroy(payload);
 429         }
 430         iterator->destroy(iterator);
 431         this->child_sas->destroy(this->child_sas);
 432
 433         this->ike_sa_id->destroy(this->ike_sa_id);
 434         this->sent_messages->destroy(this->sent_messages);
 435         this->randomizer->destroy(this->randomizer);
 436
 437         global_logger_manager->destroy_logger(global_logger_manager, this->logger);
 438
 439         allocator_free(this);
 440
 441         return SUCCESS;
 442 }
 443
 444 /*
 445  * Described in Header
 446  */
 447 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 448 {
 449         private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
 450         if (this == NULL)
 451         {
 452                 return NULL;
 453         }
 454
 455
 456         /* Public functions */
 457         this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
 458         this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
 459         this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
 460         this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
 461
 462         this->build_sa_payload = build_sa_payload;
 463         this->build_ke_payload = build_ke_payload;
 464         this->build_nonce_payload = build_nonce_payload;
 465
 466
 467
 468         /* initialize private fields */
 469         if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
 470         {
 471                 allocator_free(this);
 472                 return NULL;
 473         }
 474         this->child_sas = linked_list_create();
 475         if (this->child_sas == NULL)
 476         {
 477                 this->ike_sa_id->destroy(this->ike_sa_id);
 478                 allocator_free(this);
 479                 return NULL;
 480         }
 481         this->randomizer = randomizer_create();
 482         if (this->randomizer == NULL)
 483         {
 484                 this->child_sas->destroy(this->child_sas);
 485                 this->ike_sa_id->destroy(this->ike_sa_id);
 486                 allocator_free(this);
 487         }
 488         this->sent_messages = linked_list_create();
 489         if (this->sent_messages == NULL)
 490         {
 491                 this->randomizer->destroy(this->randomizer);
 492                 this->child_sas->destroy(this->child_sas);
 493                 this->ike_sa_id->destroy(this->ike_sa_id);
 494                 allocator_free(this);
 495         }
 496         this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
 497         if (this->logger ==  NULL)
 498         {
 499                 this->randomizer->destroy(this->randomizer);
 500                 this->child_sas->destroy(this->child_sas);
 501                 this->ike_sa_id->destroy(this->ike_sa_id);
 502                 this->sent_messages->destroy(this->sent_messages);
 503                 allocator_free(this);
 504         }
 505
 506         this->me.host = NULL;
 507         this->other.host = NULL;
 508
 509
 510         /* at creation time, IKE_SA isn't in a specific state */
 511         this->current_state = NO_STATE;
 512
 513         return (&this->public);
 514 }