Source/charon/ike_sa.c

   1 /**
   2  * @file ike_sa.c
   3  *
   4  * @brief Class ike_sa_t. An object of this type is managed by an
   5  * ike_sa_manager_t object and represents an IKE_SA
   6  *
   7  */
   8
   9 /*
  10  * Copyright (C) 2005 Jan Hutter, Martin Willi
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include "ike_sa.h"
  25
  26 #include "types.h"
  27 #include "globals.h"
  28 #include "definitions.h"
  29 #include "utils/allocator.h"
  30 #include "utils/linked_list.h"
  31 #include "utils/logger_manager.h"
  32 #include "utils/randomizer.h"
  33 #include "transforms/diffie_hellman.h"
  34 #include "payloads/sa_payload.h"
  35 #include "payloads/nonce_payload.h"
  36 #include "payloads/ke_payload.h"
  37 #include "payloads/transform_substructure.h"
  38 #include "payloads/transform_attribute.h"
  39
  40
  41 /**
  42  * States in which a IKE_SA can actually be
  43  */
  44 typedef enum ike_sa_state_e ike_sa_state_t;
  45
  46 enum ike_sa_state_e {
  47
  48         /**
  49          * IKE_SA is is not in a state
  50          */
  51         NO_STATE = 1,
  52
  53         /**
  54          * A IKE_SA_INIT-message was sent: role initiator
  55          */
  56         IKE_SA_INIT_REQUESTED = 2,
  57
  58         /**
  59          * A IKE_SA_INIT-message was replied: role responder
  60          */
  61         IKE_SA_INIT_RESPONDED = 3,
  62
  63         /**
  64          * An IKE_AUTH-message was sent after a successful
  65          * IKE_SA_INIT-exchange: role initiator
  66          */
  67         IKE_AUTH_REQUESTED = 4,
  68
  69         /**
  70          * An IKE_AUTH-message was replied: role responder.
  71          * In this state, all the informations for an IKE_SA
  72          * and one CHILD_SA are known.
  73          */
  74         IKE_SA_INITIALIZED = 5
  75 };
  76
  77 /**
  78  * string mappings for ike_sa_state
  79  */
  80 mapping_t ike_sa_state_m[] = {
  81         {NO_STATE, "NO_STATE"},
  82         {IKE_SA_INIT_REQUESTED, "IKE_SA_INIT_REQUESTED"},
  83         {IKE_SA_INIT_RESPONDED, "IKE_SA_INIT_RESPONDED"},
  84         {IKE_AUTH_REQUESTED, "IKE_AUTH_REQUESTED"},
  85         {IKE_SA_INITIALIZED, "IKE_SA_INITIALIZED"},
  86         {MAPPING_END, NULL}
  87 };
  88
  89
  90 /**
  91  * Private data of an message_t object
  92  */
  93 typedef struct private_ike_sa_s private_ike_sa_t;
  94
  95 struct private_ike_sa_s {
  96
  97         /**
  98          * Public part of a ike_sa_t object
  99          */
 100         ike_sa_t public;
 101
 102         status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
 103         status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
 104         status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
 105
 106         status_t (*transto_ike_sa_init_responded) (private_ike_sa_t *this, message_t *message);
 107         status_t (*transto_ike_auth_requested) (private_ike_sa_t *this, message_t *message);
 108
 109         /* Private values */
 110         /**
 111          * Identifier for the current IKE_SA
 112          */
 113         ike_sa_id_t *ike_sa_id;
 114
 115         /**
 116          * Linked List containing the child sa's of the current IKE_SA
 117          */
 118         linked_list_t *child_sas;
 119
 120         /**
 121          * Current state of the IKE_SA
 122          */
 123         ike_sa_state_t state;
 124
 125         /**
 126          * is this IKE_SA the original initiator of this IKE_SA
 127          */
 128         bool original_initiator;
 129
 130         /**
 131          * this SA's source for random data
 132          */
 133         randomizer_t *randomizer;
 134
 135         linked_list_t *sent_messages;
 136
 137         struct {
 138                 host_t *host;
 139         } me;
 140
 141         struct {
 142                 host_t *host;
 143         } other;
 144
 145         diffie_hellman_t *diffie_hellman;
 146
 147         /**
 148          * a logger for this IKE_SA
 149          */
 150         logger_t *logger;
 151 };
 152
 153 /**
 154  * @brief implements function process_message of private_ike_sa_t
 155  */
 156 static status_t process_message (private_ike_sa_t *this, message_t *message)
 157 {
 158         this->logger->log(this->logger, CONTROL|MORE, "Process message of exchange type %s",
 159                                                 mapping_find(exchange_type_m,message->get_exchange_type(message)));
 160
 161         switch (message->get_exchange_type(message))
 162         {
 163                 case IKE_SA_INIT:
 164                 {
 165                         if (message->get_request(message)) {
 166                                 if (this->state ==      NO_STATE)
 167                                 {
 168                                         /* state transission NO_STATE => IKE_SA_INIT_RESPONDED */
 169                                         return this->transto_ike_sa_init_responded(this, message);
 170                                 }
 171                         }
 172                         else
 173                         {
 174                                 if (this->state == IKE_SA_INIT_REQUESTED)
 175                                 {
 176                                         /* state transission IKE_SA_INIT_REQUESTED => IKE_AUTH_REQUESTED*/
 177                                         return this->transto_ike_auth_requested(this, message);
 178                                 }
 179                         }
 180                         break;
 181                 }
 182                 case IKE_AUTH:
 183                 {
 184                         /* break; */
 185                 }
 186                 case CREATE_CHILD_SA:
 187                 {
 188                         /* break; */
 189                 }
 190                 case INFORMATIONAL:
 191                 {
 192                         /* break; */
 193                 }
 194                 default:
 195                 {
 196                         this->logger->log(this->logger, ERROR, "processing %s-message not supported.",
 197                                                                 mapping_find(exchange_type_m,message->get_exchange_type(message)));
 198                         return NOT_SUPPORTED;
 199                 }
 200         }
 201         this->logger->log(this->logger, ERROR, "received %s-message in state %s, rejected.",
 202                                                                 mapping_find(exchange_type_m, message->get_exchange_type(message)),
 203                                                                 mapping_find(ike_sa_state_m, this->state));
 204         return INVALID_STATE;
 205 }
 206
 207
 208 static status_t transto_ike_sa_init_responded(private_ike_sa_t *this, message_t *message)
 209 {
 210         status_t status;
 211         linked_list_iterator_t *payloads;
 212
 213         status = message->parse_body(message);
 214         if (status != SUCCESS)
 215         {
 216                 return status;
 217         }
 218
 219         status = message->get_payload_iterator(message, &payloads);
 220         if (status != SUCCESS)
 221         {
 222                 return status;
 223         }
 224         while (payloads->has_next(payloads))
 225         {
 226                 payload_t *payload;
 227                 payloads->current(payloads, (void**)payload);
 228                 switch (payload->get_type(payload))
 229                 {
 230                         case SECURITY_ASSOCIATION:
 231                         {
 232                                 sa_payload_t *sa_payload;
 233                                 linked_list_iterator_t *proposals;
 234
 235                                 sa_payload = (sa_payload_t*)payload;
 236                                 status = sa_payload->create_proposal_substructure_iterator(sa_payload, &proposals, TRUE);
 237                                 if (status != SUCCESS)
 238                                 {
 239                                         payloads->destroy(payloads);
 240                                         return status;
 241                                 }
 242                                 //global_configuration_manager->select_prop
 243
 244                                 break;
 245                         }
 246                         case KEY_EXCHANGE:
 247                         {
 248                                 break;
 249                         }
 250                         case NONCE:
 251                         {
 252                                 break;
 253                         }
 254                         default:
 255                         {
 256
 257                         }
 258
 259                 }
 260
 261         }
 262
 263
 264
 265
 266
 267         /*
 268         job_t *delete_job;
 269         delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
 270         if (delete_job == NULL)
 271         {
 272                 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
 273         }
 274
 275         status = global_job_queue->add(global_job_queue,delete_job);
 276         if (status != SUCCESS)
 277         {
 278                 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
 279                 delete_job->destroy_all(delete_job);
 280         }*/
 281         return SUCCESS;
 282 }
 283
 284 static status_t transto_ike_auth_requested(private_ike_sa_t *this, message_t *message)
 285 {
 286         return SUCCESS;
 287 }
 288
 289 /**
 290  * @brief implements function process_configuration of private_ike_sa_t
 291  */
 292 static status_t initialize_connection(private_ike_sa_t *this, char *name)
 293 {
 294         message_t *message;
 295         payload_t *payload;
 296         packet_t *packet;
 297         status_t status;
 298
 299         this->logger->log(this->logger, CONTROL, "initializing connection");
 300
 301         this->original_initiator = TRUE;
 302
 303         status = global_configuration_manager->get_local_host(global_configuration_manager, name, &(this->me.host));
 304         if (status != SUCCESS)
 305         {
 306                 return INVALID_ARG;
 307         }
 308
 309         status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &(this->other.host));
 310         if (status != SUCCESS)
 311         {
 312                 return INVALID_ARG;
 313         }
 314
 315         message = message_create();
 316
 317         if (message == NULL)
 318         {
 319                 return OUT_OF_RES;
 320         }
 321
 322
 323         message->set_source(message, this->me.host);
 324         message->set_destination(message, this->other.host);
 325
 326         message->set_exchange_type(message, IKE_SA_INIT);
 327         message->set_original_initiator(message, this->original_initiator);
 328         message->set_message_id(message, 0);
 329         message->set_ike_sa_id(message, this->ike_sa_id);
 330         message->set_request(message, TRUE);
 331
 332         status = this->build_sa_payload(this, (sa_payload_t**)&payload);
 333         if (status != SUCCESS)
 334         {
 335                 this->logger->log(this->logger, ERROR, "Could not build SA payload");
 336                 message->destroy(message);
 337                 return status;
 338         }
 339         payload->set_next_type(payload, KEY_EXCHANGE);
 340         message->add_payload(message, payload);
 341
 342         status = this->build_ke_payload(this, (ke_payload_t**)&payload);
 343         if (status != SUCCESS)
 344         {
 345                 this->logger->log(this->logger, ERROR, "Could not build KE payload");
 346                 message->destroy(message);
 347                 return status;
 348         }
 349         payload->set_next_type(payload, NONCE);
 350         message->add_payload(message, payload);
 351
 352         status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
 353         if (status != SUCCESS)
 354         {
 355                 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
 356                 message->destroy(message);
 357                 return status;
 358         }
 359         payload->set_next_type(payload, NO_PAYLOAD);
 360         message->add_payload(message, payload);
 361
 362         status = message->generate(message, &packet);
 363         if (status != SUCCESS)
 364         {
 365                 this->logger->log(this->logger, ERROR, "Could not generate message");
 366                 message->destroy(message);
 367                 return status;
 368         }
 369
 370
 371         global_send_queue->add(global_send_queue, packet);
 372
 373         message->destroy(message);
 374
 375         this->state = IKE_SA_INIT_REQUESTED;
 376
 377         return SUCCESS;
 378 }
 379
 380 /**
 381  * @brief implements function private_ike_sa_t.get_id
 382  */
 383 static ike_sa_id_t* get_id(private_ike_sa_t *this)
 384 {
 385         return this->ike_sa_id;
 386 }
 387
 388 /**
 389  * implements private_ike_sa_t.build_sa_payload
 390  */
 391 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
 392 {
 393         sa_payload_t* sa_payload;
 394         linked_list_iterator_t *iterator;
 395         status_t status;
 396
 397         this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
 398
 399         sa_payload = sa_payload_create();
 400         if (sa_payload == NULL)
 401         {
 402                 return OUT_OF_RES;
 403         }
 404         status = sa_payload->create_proposal_substructure_iterator(sa_payload, &iterator, FALSE);
 405         if (status != SUCCESS)
 406         {
 407                 sa_payload->destroy(sa_payload);
 408                 return status;
 409         }
 410         status = global_configuration_manager->get_proposals_for_host(global_configuration_manager, this->other.host, iterator);
 411         if (status != SUCCESS)
 412         {
 413                 sa_payload->destroy(sa_payload);
 414                 return status;
 415         }
 416
 417         *payload = sa_payload;
 418
 419         return SUCCESS;
 420 }
 421
 422 /**
 423  * implements private_ike_sa_t.build_ke_payload
 424  */
 425 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
 426 {
 427         ke_payload_t *ke_payload;
 428         chunk_t key_data;
 429
 430
 431         this->logger->log(this->logger, CONTROL|MORE, "building ke payload");
 432
 433         key_data.ptr = "12345";
 434         key_data.len = strlen("12345");
 435
 436
 437         ke_payload = ke_payload_create();
 438         if (ke_payload == NULL)
 439         {
 440                 return OUT_OF_RES;
 441         }
 442         ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
 443         if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
 444         {
 445                 ke_payload->destroy(ke_payload);
 446                 return OUT_OF_RES;
 447         }
 448         *payload = ke_payload;
 449         return SUCCESS;
 450 }
 451
 452 /**
 453  * implements private_ike_sa_t.build_nonce_payload
 454  */
 455 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
 456 {
 457         nonce_payload_t *nonce_payload;
 458         chunk_t nonce;
 459
 460         this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
 461
 462         if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 16, &nonce) != SUCCESS)
 463         {
 464                 return OUT_OF_RES;
 465         }
 466
 467         nonce_payload = nonce_payload_create();
 468         if (nonce_payload == NULL)
 469         {
 470                 return OUT_OF_RES;
 471         }
 472
 473         nonce_payload->set_nonce(nonce_payload, nonce);
 474
 475         *payload = nonce_payload;
 476
 477         return SUCCESS;
 478 }
 479
 480 /**
 481  * @brief implements function destroy of private_ike_sa_t
 482  */
 483 static status_t destroy (private_ike_sa_t *this)
 484 {
 485         linked_list_iterator_t *iterator;
 486
 487         this->child_sas->create_iterator(this->child_sas, &iterator, TRUE);
 488         while (iterator->has_next(iterator))
 489         {
 490                 payload_t *payload;
 491                 iterator->current(iterator, (void**)&payload);
 492                 payload->destroy(payload);
 493         }
 494         iterator->destroy(iterator);
 495         this->child_sas->destroy(this->child_sas);
 496
 497         this->ike_sa_id->destroy(this->ike_sa_id);
 498         this->sent_messages->destroy(this->sent_messages);
 499         this->randomizer->destroy(this->randomizer);
 500
 501         global_logger_manager->destroy_logger(global_logger_manager, this->logger);
 502
 503         allocator_free(this);
 504
 505         return SUCCESS;
 506 }
 507
 508 /*
 509  * Described in Header
 510  */
 511 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 512 {
 513         private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
 514         if (this == NULL)
 515         {
 516                 return NULL;
 517         }
 518
 519
 520         /* Public functions */
 521         this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
 522         this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
 523         this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
 524         this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
 525
 526         this->build_sa_payload = build_sa_payload;
 527         this->build_ke_payload = build_ke_payload;
 528         this->build_nonce_payload = build_nonce_payload;
 529
 530
 531         this->transto_ike_sa_init_responded = transto_ike_sa_init_responded;
 532         this->transto_ike_auth_requested = transto_ike_auth_requested;
 533
 534
 535
 536         /* initialize private fields */
 537         if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
 538         {
 539                 allocator_free(this);
 540                 return NULL;
 541         }
 542         this->child_sas = linked_list_create();
 543         if (this->child_sas == NULL)
 544         {
 545                 this->ike_sa_id->destroy(this->ike_sa_id);
 546                 allocator_free(this);
 547                 return NULL;
 548         }
 549         this->randomizer = randomizer_create();
 550         if (this->randomizer == NULL)
 551         {
 552                 this->child_sas->destroy(this->child_sas);
 553                 this->ike_sa_id->destroy(this->ike_sa_id);
 554                 allocator_free(this);
 555         }
 556         this->sent_messages = linked_list_create();
 557         if (this->sent_messages == NULL)
 558         {
 559                 this->randomizer->destroy(this->randomizer);
 560                 this->child_sas->destroy(this->child_sas);
 561                 this->ike_sa_id->destroy(this->ike_sa_id);
 562                 allocator_free(this);
 563         }
 564         this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
 565         if (this->logger ==  NULL)
 566         {
 567                 this->randomizer->destroy(this->randomizer);
 568                 this->child_sas->destroy(this->child_sas);
 569                 this->ike_sa_id->destroy(this->ike_sa_id);
 570                 this->sent_messages->destroy(this->sent_messages);
 571                 allocator_free(this);
 572         }
 573
 574         this->me.host = NULL;
 575         this->other.host = NULL;
 576         this->diffie_hellman = NULL;
 577
 578
 579         /* at creation time, IKE_SA isn't in a specific state */
 580         this->state = NO_STATE;
 581
 582         return (&this->public);
 583 }