4 * @brief Class ike_sa_t. An object of this type is managed by an
5 * ike_sa_manager_t object and represents an IKE_SA
10 * Copyright (C) 2005 Jan Hutter, Martin Willi
11 * Hochschule fuer Technik Rapperswil
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
28 #include "definitions.h"
29 #include "utils/allocator.h"
30 #include "utils/linked_list.h"
31 #include "utils/logger_manager.h"
32 #include "utils/randomizer.h"
33 #include "transforms/diffie_hellman.h"
34 #include "payloads/sa_payload.h"
35 #include "payloads/nonce_payload.h"
36 #include "payloads/ke_payload.h"
37 #include "payloads/transform_substructure.h"
38 #include "payloads/transform_attribute.h"
42 * States in which a IKE_SA can actually be
44 typedef enum ike_sa_state_e ike_sa_state_t
;
49 * IKE_SA is is not in a state
54 * A IKE_SA_INIT-message was sent: role initiator
56 IKE_SA_INIT_REQUESTED
= 2,
59 * A IKE_SA_INIT-message was replied: role responder
61 IKE_SA_INIT_RESPONDED
= 3,
64 * An IKE_AUTH-message was sent after a successful
65 * IKE_SA_INIT-exchange: role initiator
67 IKE_AUTH_REQUESTED
= 4,
70 * An IKE_AUTH-message was replied: role responder.
71 * In this state, all the informations for an IKE_SA
72 * and one CHILD_SA are known.
74 IKE_SA_INITIALIZED
= 5
78 * string mappings for ike_sa_state
80 mapping_t ike_sa_state_m
[] = {
81 {NO_STATE
, "NO_STATE"},
82 {IKE_SA_INIT_REQUESTED
, "IKE_SA_INIT_REQUESTED"},
83 {IKE_SA_INIT_RESPONDED
, "IKE_SA_INIT_RESPONDED"},
84 {IKE_AUTH_REQUESTED
, "IKE_AUTH_REQUESTED"},
85 {IKE_SA_INITIALIZED
, "IKE_SA_INITIALIZED"},
91 * Private data of an message_t object
93 typedef struct private_ike_sa_s private_ike_sa_t
;
95 struct private_ike_sa_s
{
98 * Public part of a ike_sa_t object
102 status_t (*build_sa_payload
) (private_ike_sa_t
*this, sa_payload_t
**payload
);
103 status_t (*build_nonce_payload
) (private_ike_sa_t
*this, nonce_payload_t
**payload
);
104 status_t (*build_ke_payload
) (private_ike_sa_t
*this, ke_payload_t
**payload
);
106 status_t (*transto_ike_sa_init_responded
) (private_ike_sa_t
*this, message_t
*message
);
107 status_t (*transto_ike_auth_requested
) (private_ike_sa_t
*this, message_t
*message
);
111 * Identifier for the current IKE_SA
113 ike_sa_id_t
*ike_sa_id
;
116 * Linked List containing the child sa's of the current IKE_SA
118 linked_list_t
*child_sas
;
121 * Current state of the IKE_SA
123 ike_sa_state_t state
;
126 * is this IKE_SA the original initiator of this IKE_SA
128 bool original_initiator
;
131 * this SA's source for random data
133 randomizer_t
*randomizer
;
135 linked_list_t
*sent_messages
;
145 diffie_hellman_t
*diffie_hellman
;
148 * a logger for this IKE_SA
154 * @brief implements function process_message of private_ike_sa_t
156 static status_t
process_message (private_ike_sa_t
*this, message_t
*message
)
158 this->logger
->log(this->logger
, CONTROL
|MORE
, "Process message of exchange type %s",
159 mapping_find(exchange_type_m
,message
->get_exchange_type(message
)));
161 switch (message
->get_exchange_type(message
))
165 if (message
->get_request(message
)) {
166 if (this->state
== NO_STATE
)
168 /* state transission NO_STATE => IKE_SA_INIT_RESPONDED */
169 return this->transto_ike_sa_init_responded(this, message
);
174 if (this->state
== IKE_SA_INIT_REQUESTED
)
176 /* state transission IKE_SA_INIT_REQUESTED => IKE_AUTH_REQUESTED*/
177 return this->transto_ike_auth_requested(this, message
);
186 case CREATE_CHILD_SA
:
196 this->logger
->log(this->logger
, ERROR
, "processing %s-message not supported.",
197 mapping_find(exchange_type_m
,message
->get_exchange_type(message
)));
198 return NOT_SUPPORTED
;
201 this->logger
->log(this->logger
, ERROR
, "received %s-message in state %s, rejected.",
202 mapping_find(exchange_type_m
, message
->get_exchange_type(message
)),
203 mapping_find(ike_sa_state_m
, this->state
));
204 return INVALID_STATE
;
208 static status_t
transto_ike_sa_init_responded(private_ike_sa_t
*this, message_t
*message
)
211 linked_list_iterator_t
*payloads
;
213 status
= message
->parse_body(message
);
214 if (status
!= SUCCESS
)
219 status
= message
->get_payload_iterator(message
, &payloads
);
220 if (status
!= SUCCESS
)
224 while (payloads
->has_next(payloads
))
227 payloads
->current(payloads
, (void**)payload
);
228 switch (payload
->get_type(payload
))
230 case SECURITY_ASSOCIATION
:
232 sa_payload_t
*sa_payload
;
233 linked_list_iterator_t
*proposals
;
235 sa_payload
= (sa_payload_t
*)payload
;
236 status
= sa_payload
->create_proposal_substructure_iterator(sa_payload
, &proposals
, TRUE
);
237 if (status
!= SUCCESS
)
239 payloads
->destroy(payloads
);
242 //global_configuration_manager->select_prop
269 delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
270 if (delete_job == NULL)
272 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
275 status = global_job_queue->add(global_job_queue,delete_job);
276 if (status != SUCCESS)
278 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
279 delete_job->destroy_all(delete_job);
284 static status_t
transto_ike_auth_requested(private_ike_sa_t
*this, message_t
*message
)
290 * @brief implements function process_configuration of private_ike_sa_t
292 static status_t
initialize_connection(private_ike_sa_t
*this, char *name
)
299 this->logger
->log(this->logger
, CONTROL
, "initializing connection");
301 this->original_initiator
= TRUE
;
303 status
= global_configuration_manager
->get_local_host(global_configuration_manager
, name
, &(this->me
.host
));
304 if (status
!= SUCCESS
)
309 status
= global_configuration_manager
->get_remote_host(global_configuration_manager
, name
, &(this->other
.host
));
310 if (status
!= SUCCESS
)
315 message
= message_create();
323 message
->set_source(message
, this->me
.host
);
324 message
->set_destination(message
, this->other
.host
);
326 message
->set_exchange_type(message
, IKE_SA_INIT
);
327 message
->set_original_initiator(message
, this->original_initiator
);
328 message
->set_message_id(message
, 0);
329 message
->set_ike_sa_id(message
, this->ike_sa_id
);
330 message
->set_request(message
, TRUE
);
332 status
= this->build_sa_payload(this, (sa_payload_t
**)&payload
);
333 if (status
!= SUCCESS
)
335 this->logger
->log(this->logger
, ERROR
, "Could not build SA payload");
336 message
->destroy(message
);
339 payload
->set_next_type(payload
, KEY_EXCHANGE
);
340 message
->add_payload(message
, payload
);
342 status
= this->build_ke_payload(this, (ke_payload_t
**)&payload
);
343 if (status
!= SUCCESS
)
345 this->logger
->log(this->logger
, ERROR
, "Could not build KE payload");
346 message
->destroy(message
);
349 payload
->set_next_type(payload
, NONCE
);
350 message
->add_payload(message
, payload
);
352 status
= this->build_nonce_payload(this, (nonce_payload_t
**)&payload
);
353 if (status
!= SUCCESS
)
355 this->logger
->log(this->logger
, ERROR
, "Could not build NONCE payload");
356 message
->destroy(message
);
359 payload
->set_next_type(payload
, NO_PAYLOAD
);
360 message
->add_payload(message
, payload
);
362 status
= message
->generate(message
, &packet
);
363 if (status
!= SUCCESS
)
365 this->logger
->log(this->logger
, ERROR
, "Could not generate message");
366 message
->destroy(message
);
371 global_send_queue
->add(global_send_queue
, packet
);
373 message
->destroy(message
);
375 this->state
= IKE_SA_INIT_REQUESTED
;
381 * @brief implements function private_ike_sa_t.get_id
383 static ike_sa_id_t
* get_id(private_ike_sa_t
*this)
385 return this->ike_sa_id
;
389 * implements private_ike_sa_t.build_sa_payload
391 static status_t
build_sa_payload(private_ike_sa_t
*this, sa_payload_t
**payload
)
393 sa_payload_t
* sa_payload
;
394 linked_list_iterator_t
*iterator
;
397 this->logger
->log(this->logger
, CONTROL
|MORE
, "building sa payload");
399 sa_payload
= sa_payload_create();
400 if (sa_payload
== NULL
)
404 status
= sa_payload
->create_proposal_substructure_iterator(sa_payload
, &iterator
, FALSE
);
405 if (status
!= SUCCESS
)
407 sa_payload
->destroy(sa_payload
);
410 status
= global_configuration_manager
->get_proposals_for_host(global_configuration_manager
, this->other
.host
, iterator
);
411 if (status
!= SUCCESS
)
413 sa_payload
->destroy(sa_payload
);
417 *payload
= sa_payload
;
423 * implements private_ike_sa_t.build_ke_payload
425 static status_t
build_ke_payload(private_ike_sa_t
*this, ke_payload_t
**payload
)
427 ke_payload_t
*ke_payload
;
431 this->logger
->log(this->logger
, CONTROL
|MORE
, "building ke payload");
433 key_data
.ptr
= "12345";
434 key_data
.len
= strlen("12345");
437 ke_payload
= ke_payload_create();
438 if (ke_payload
== NULL
)
442 ke_payload
->set_dh_group_number(ke_payload
, MODP_1024_BIT
);
443 if (ke_payload
->set_key_exchange_data(ke_payload
, key_data
) != SUCCESS
)
445 ke_payload
->destroy(ke_payload
);
448 *payload
= ke_payload
;
453 * implements private_ike_sa_t.build_nonce_payload
455 static status_t
build_nonce_payload(private_ike_sa_t
*this, nonce_payload_t
**payload
)
457 nonce_payload_t
*nonce_payload
;
460 this->logger
->log(this->logger
, CONTROL
|MORE
, "building nonce payload");
462 if (this->randomizer
->allocate_pseudo_random_bytes(this->randomizer
, 16, &nonce
) != SUCCESS
)
467 nonce_payload
= nonce_payload_create();
468 if (nonce_payload
== NULL
)
473 nonce_payload
->set_nonce(nonce_payload
, nonce
);
475 *payload
= nonce_payload
;
481 * @brief implements function destroy of private_ike_sa_t
483 static status_t
destroy (private_ike_sa_t
*this)
485 linked_list_iterator_t
*iterator
;
487 this->child_sas
->create_iterator(this->child_sas
, &iterator
, TRUE
);
488 while (iterator
->has_next(iterator
))
491 iterator
->current(iterator
, (void**)&payload
);
492 payload
->destroy(payload
);
494 iterator
->destroy(iterator
);
495 this->child_sas
->destroy(this->child_sas
);
497 this->ike_sa_id
->destroy(this->ike_sa_id
);
498 this->sent_messages
->destroy(this->sent_messages
);
499 this->randomizer
->destroy(this->randomizer
);
501 global_logger_manager
->destroy_logger(global_logger_manager
, this->logger
);
503 allocator_free(this);
509 * Described in Header
511 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
)
513 private_ike_sa_t
*this = allocator_alloc_thing(private_ike_sa_t
);
520 /* Public functions */
521 this->public.process_message
= (status_t(*)(ike_sa_t
*, message_t
*)) process_message
;
522 this->public.initialize_connection
= (status_t(*)(ike_sa_t
*, char*)) initialize_connection
;
523 this->public.get_id
= (ike_sa_id_t
*(*)(ike_sa_t
*)) get_id
;
524 this->public.destroy
= (status_t(*)(ike_sa_t
*))destroy
;
526 this->build_sa_payload
= build_sa_payload
;
527 this->build_ke_payload
= build_ke_payload
;
528 this->build_nonce_payload
= build_nonce_payload
;
531 this->transto_ike_sa_init_responded
= transto_ike_sa_init_responded
;
532 this->transto_ike_auth_requested
= transto_ike_auth_requested
;
536 /* initialize private fields */
537 if (ike_sa_id
->clone(ike_sa_id
,&(this->ike_sa_id
)) != SUCCESS
)
539 allocator_free(this);
542 this->child_sas
= linked_list_create();
543 if (this->child_sas
== NULL
)
545 this->ike_sa_id
->destroy(this->ike_sa_id
);
546 allocator_free(this);
549 this->randomizer
= randomizer_create();
550 if (this->randomizer
== NULL
)
552 this->child_sas
->destroy(this->child_sas
);
553 this->ike_sa_id
->destroy(this->ike_sa_id
);
554 allocator_free(this);
556 this->sent_messages
= linked_list_create();
557 if (this->sent_messages
== NULL
)
559 this->randomizer
->destroy(this->randomizer
);
560 this->child_sas
->destroy(this->child_sas
);
561 this->ike_sa_id
->destroy(this->ike_sa_id
);
562 allocator_free(this);
564 this->logger
= global_logger_manager
->create_logger(global_logger_manager
, IKE_SA
, NULL
);
565 if (this->logger
== NULL
)
567 this->randomizer
->destroy(this->randomizer
);
568 this->child_sas
->destroy(this->child_sas
);
569 this->ike_sa_id
->destroy(this->ike_sa_id
);
570 this->sent_messages
->destroy(this->sent_messages
);
571 allocator_free(this);
574 this->me
.host
= NULL
;
575 this->other
.host
= NULL
;
576 this->diffie_hellman
= NULL
;
579 /* at creation time, IKE_SA isn't in a specific state */
580 this->state
= NO_STATE
;
582 return (&this->public);