Source/charon/ike_sa.c

   1 /**
   2  * @file ike_sa.c
   3  *
   4  * @brief Class ike_sa_t. An object of this type is managed by an
   5  * ike_sa_manager_t object and represents an IKE_SA
   6  *
   7  */
   8
   9 /*
  10  * Copyright (C) 2005 Jan Hutter, Martin Willi
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include "ike_sa.h"
  25
  26 #include "types.h"
  27 #include "globals.h"
  28 #include "definitions.h"
  29 #include "utils/allocator.h"
  30 #include "utils/linked_list.h"
  31 #include "utils/logger_manager.h"
  32 #include "utils/randomizer.h"
  33 #include "transforms/diffie_hellman.h"
  34 #include "payloads/sa_payload.h"
  35 #include "payloads/nonce_payload.h"
  36 #include "payloads/ke_payload.h"
  37 #include "payloads/transform_substructure.h"
  38 #include "payloads/transform_attribute.h"
  39
  40
  41 /**
  42  * States in which a IKE_SA can actually be
  43  */
  44 typedef enum ike_sa_state_e ike_sa_state_t;
  45
  46 enum ike_sa_state_e {
  47
  48         /**
  49          * IKE_SA is is not in a state
  50          */
  51         NO_STATE = 1,
  52
  53         /**
  54          * A IKE_SA_INIT-message was sent: role initiator
  55          */
  56         IKE_SA_INIT_REQUESTED = 2,
  57
  58         /**
  59          * A IKE_SA_INIT-message was replied: role responder
  60          */
  61         IKE_SA_INIT_RESPONDED = 3,
  62
  63         /**
  64          * An IKE_AUTH-message was sent after a successful
  65          * IKE_SA_INIT-exchange: role initiator
  66          */
  67         IKE_AUTH_REQUESTED = 4,
  68
  69         /**
  70          * An IKE_AUTH-message was replied: role responder.
  71          * In this state, all the informations for an IKE_SA
  72          * and one CHILD_SA are known.
  73          */
  74         IKE_SA_INITIALIZED = 5
  75 };
  76
  77 /**
  78  * string mappings for ike_sa_state
  79  */
  80 mapping_t ike_sa_state_m[] = {
  81         {NO_STATE, "NO_STATE"},
  82         {IKE_SA_INIT_REQUESTED, "IKE_SA_INIT_REQUESTED"},
  83         {IKE_SA_INIT_RESPONDED, "IKE_SA_INIT_RESPONDED"},
  84         {IKE_AUTH_REQUESTED, "IKE_AUTH_REQUESTED"},
  85         {IKE_SA_INITIALIZED, "IKE_SA_INITIALIZED"},
  86         {MAPPING_END, NULL}
  87 };
  88
  89
  90 /**
  91  * Private data of an message_t object
  92  */
  93 typedef struct private_ike_sa_s private_ike_sa_t;
  94
  95 struct private_ike_sa_s {
  96
  97         /**
  98          * Public part of a ike_sa_t object
  99          */
 100         ike_sa_t public;
 101
 102         status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
 103         status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
 104         status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
 105
 106         status_t (*build_message) (private_ike_sa_t *this, exchange_type_t type, bool request);
 107
 108         status_t (*transto_ike_sa_init_responded) (private_ike_sa_t *this, message_t *message);
 109         status_t (*transto_ike_auth_requested) (private_ike_sa_t *this, message_t *message);
 110
 111         /* Private values */
 112         /**
 113          * Identifier for the current IKE_SA
 114          */
 115         ike_sa_id_t *ike_sa_id;
 116
 117         /**
 118          * Linked List containing the child sa's of the current IKE_SA
 119          */
 120         linked_list_t *child_sas;
 121
 122         /**
 123          * Current state of the IKE_SA
 124          */
 125         ike_sa_state_t state;
 126
 127         /**
 128          * is this IKE_SA the original initiator of this IKE_SA
 129          */
 130         bool original_initiator;
 131
 132         /**
 133          * this SA's source for random data
 134          */
 135         randomizer_t *randomizer;
 136
 137         linked_list_t *sent_messages;
 138
 139         struct {
 140                 host_t *host;
 141         } me;
 142
 143         struct {
 144                 host_t *host;
 145         } other;
 146
 147         diffie_hellman_t *diffie_hellman;
 148
 149         u_int32_t message_id_in;
 150         u_int32_t message_id_out;
 151
 152         /**
 153          * a logger for this IKE_SA
 154          */
 155         logger_t *logger;
 156 };
 157
 158 /**
 159  * @brief implements function process_message of private_ike_sa_t
 160  */
 161 static status_t process_message (private_ike_sa_t *this, message_t *message)
 162 {
 163         this->logger->log(this->logger, CONTROL|MORE, "Process message of exchange type %s",
 164                                                 mapping_find(exchange_type_m,message->get_exchange_type(message)));
 165
 166         switch (message->get_exchange_type(message))
 167         {
 168                 case IKE_SA_INIT:
 169                 {
 170                         if (message->get_request(message)) {
 171                                 if (this->state ==      NO_STATE)
 172                                 {
 173                                         /* state transission NO_STATE => IKE_SA_INIT_RESPONDED */
 174                                         return this->transto_ike_sa_init_responded(this, message);
 175                                 }
 176                         }
 177                         else
 178                         {
 179                                 if (this->state == IKE_SA_INIT_REQUESTED)
 180                                 {
 181                                         /* state transission IKE_SA_INIT_REQUESTED => IKE_AUTH_REQUESTED*/
 182                                         return this->transto_ike_auth_requested(this, message);
 183                                 }
 184                         }
 185                         break;
 186                 }
 187                 case IKE_AUTH:
 188                 {
 189                         /* break; */
 190                 }
 191                 case CREATE_CHILD_SA:
 192                 {
 193                         /* break; */
 194                 }
 195                 case INFORMATIONAL:
 196                 {
 197                         /* break; */
 198                 }
 199                 default:
 200                 {
 201                         this->logger->log(this->logger, ERROR, "processing %s-message not supported.",
 202                                                                 mapping_find(exchange_type_m,message->get_exchange_type(message)));
 203                         return NOT_SUPPORTED;
 204                 }
 205         }
 206         this->logger->log(this->logger, ERROR, "received %s-message in state %s, rejected.",
 207                                                                 mapping_find(exchange_type_m, message->get_exchange_type(message)),
 208                                                                 mapping_find(ike_sa_state_m, this->state));
 209         return INVALID_STATE;
 210 }
 211
 212
 213 static status_t build_message(private_ike_sa_t *this, exchange_type_t type, bool request)
 214 {
 215         status_t status;
 216         message_t *message;
 217         host_t *source, *destination;
 218
 219         message = message_create();
 220         if (message == NULL)
 221         {
 222                 return OUT_OF_RES;
 223         }
 224
 225         status  = this->me.host->clone(this->me.host, &source);
 226         status |= this->other.host->clone(this->other.host, &destination);
 227         if (status != SUCCESS)
 228         {
 229                 message->destroy(message);
 230                 return status;
 231         }
 232         message->set_source(message, source);
 233         message->set_destination(message, destination);
 234
 235         message->set_exchange_type(message, type);
 236         message->set_request(message, request);
 237
 238         message->set_ike_sa_id(message, this->ike_sa_id);
 239
 240         return SUCCESS;
 241 }
 242
 243 static status_t transto_ike_sa_init_responded(private_ike_sa_t *this, message_t *message)
 244 {
 245         status_t status;
 246         linked_list_iterator_t *payloads;
 247         message_t *respond;
 248
 249         status = message->parse_body(message);
 250         if (status != SUCCESS)
 251         {
 252                 return status;
 253         }
 254
 255
 256
 257
 258
 259         status = message->get_payload_iterator(message, &payloads);
 260         if (status != SUCCESS)
 261         {
 262                 respond->destroy(respond);
 263                 return status;
 264         }
 265         while (payloads->has_next(payloads))
 266         {
 267                 payload_t *payload;
 268                 payloads->current(payloads, (void**)payload);
 269                 switch (payload->get_type(payload))
 270                 {
 271                         case SECURITY_ASSOCIATION:
 272                         {
 273                                 sa_payload_t *sa_payload;
 274                                 linked_list_iterator_t *proposals;
 275
 276                                 sa_payload = (sa_payload_t*)payload;
 277                                 status = sa_payload->create_proposal_substructure_iterator(sa_payload, &proposals, TRUE);
 278                                 if (status != SUCCESS)
 279                                 {
 280                                         payloads->destroy(payloads);
 281                                         return status;
 282                                 }
 283                                 //global_configuration_manager->select_proposals_for_host
 284
 285                                 break;
 286                         }
 287                         case KEY_EXCHANGE:
 288                         {
 289                                 break;
 290                         }
 291                         case NONCE:
 292                         {
 293                                 break;
 294                         }
 295                         default:
 296                         {
 297
 298                         }
 299
 300                 }
 301
 302         }
 303
 304
 305
 306
 307
 308         /*
 309         job_t *delete_job;
 310         delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
 311         if (delete_job == NULL)
 312         {
 313                 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
 314         }
 315
 316         status = global_job_queue->add(global_job_queue,delete_job);
 317         if (status != SUCCESS)
 318         {
 319                 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
 320                 delete_job->destroy_all(delete_job);
 321         }*/
 322         return SUCCESS;
 323 }
 324
 325 static status_t transto_ike_auth_requested(private_ike_sa_t *this, message_t *message)
 326 {
 327         return SUCCESS;
 328 }
 329
 330 /**
 331  * @brief implements function process_configuration of private_ike_sa_t
 332  */
 333 static status_t initialize_connection(private_ike_sa_t *this, char *name)
 334 {
 335         message_t *message;
 336         payload_t *payload;
 337         packet_t *packet;
 338         status_t status;
 339
 340         this->logger->log(this->logger, CONTROL, "initializing connection");
 341
 342         this->original_initiator = TRUE;
 343
 344         status = global_configuration_manager->get_local_host(global_configuration_manager, name, &(this->me.host));
 345         if (status != SUCCESS)
 346         {
 347                 return INVALID_ARG;
 348         }
 349
 350         status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &(this->other.host));
 351         if (status != SUCCESS)
 352         {
 353                 return INVALID_ARG;
 354         }
 355
 356         message = message_create();
 357
 358         if (message == NULL)
 359         {
 360                 return OUT_OF_RES;
 361         }
 362
 363
 364         message->set_source(message, this->me.host);
 365         message->set_destination(message, this->other.host);
 366
 367         message->set_exchange_type(message, IKE_SA_INIT);
 368         message->set_original_initiator(message, this->original_initiator);
 369         message->set_message_id(message, this->message_id_out++);
 370         message->set_ike_sa_id(message, this->ike_sa_id);
 371         message->set_request(message, TRUE);
 372
 373         status = this->build_sa_payload(this, (sa_payload_t**)&payload);
 374         if (status != SUCCESS)
 375         {
 376                 this->logger->log(this->logger, ERROR, "Could not build SA payload");
 377                 message->destroy(message);
 378                 return status;
 379         }
 380         payload->set_next_type(payload, KEY_EXCHANGE);
 381         message->add_payload(message, payload);
 382
 383         status = this->build_ke_payload(this, (ke_payload_t**)&payload);
 384         if (status != SUCCESS)
 385         {
 386                 this->logger->log(this->logger, ERROR, "Could not build KE payload");
 387                 message->destroy(message);
 388                 return status;
 389         }
 390         payload->set_next_type(payload, NONCE);
 391         message->add_payload(message, payload);
 392
 393         status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
 394         if (status != SUCCESS)
 395         {
 396                 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
 397                 message->destroy(message);
 398                 return status;
 399         }
 400         payload->set_next_type(payload, NO_PAYLOAD);
 401         message->add_payload(message, payload);
 402
 403         status = message->generate(message, &packet);
 404         if (status != SUCCESS)
 405         {
 406                 this->logger->log(this->logger, ERROR, "Could not generate message");
 407                 message->destroy(message);
 408                 return status;
 409         }
 410
 411
 412         global_send_queue->add(global_send_queue, packet);
 413
 414         message->destroy(message);
 415
 416         this->state = IKE_SA_INIT_REQUESTED;
 417
 418         return SUCCESS;
 419 }
 420
 421 /**
 422  * @brief implements function private_ike_sa_t.get_id
 423  */
 424 static ike_sa_id_t* get_id(private_ike_sa_t *this)
 425 {
 426         return this->ike_sa_id;
 427 }
 428
 429 /**
 430  * implements private_ike_sa_t.build_sa_payload
 431  */
 432 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
 433 {
 434         sa_payload_t* sa_payload;
 435         linked_list_iterator_t *iterator;
 436         status_t status;
 437
 438         this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
 439
 440         sa_payload = sa_payload_create();
 441         if (sa_payload == NULL)
 442         {
 443                 return OUT_OF_RES;
 444         }
 445         status = sa_payload->create_proposal_substructure_iterator(sa_payload, &iterator, FALSE);
 446         if (status != SUCCESS)
 447         {
 448                 sa_payload->destroy(sa_payload);
 449                 return status;
 450         }
 451         status = global_configuration_manager->get_proposals_for_host(global_configuration_manager, this->other.host, iterator);
 452         if (status != SUCCESS)
 453         {
 454                 sa_payload->destroy(sa_payload);
 455                 return status;
 456         }
 457
 458         *payload = sa_payload;
 459
 460         return SUCCESS;
 461 }
 462
 463 /**
 464  * implements private_ike_sa_t.build_ke_payload
 465  */
 466 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
 467 {
 468         ke_payload_t *ke_payload;
 469         chunk_t key_data;
 470
 471
 472         this->logger->log(this->logger, CONTROL|MORE, "building ke payload");
 473
 474         key_data.ptr = "12345";
 475         key_data.len = strlen("12345");
 476
 477
 478         ke_payload = ke_payload_create();
 479         if (ke_payload == NULL)
 480         {
 481                 return OUT_OF_RES;
 482         }
 483         ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
 484         if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
 485         {
 486                 ke_payload->destroy(ke_payload);
 487                 return OUT_OF_RES;
 488         }
 489         *payload = ke_payload;
 490         return SUCCESS;
 491 }
 492
 493 /**
 494  * implements private_ike_sa_t.build_nonce_payload
 495  */
 496 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
 497 {
 498         nonce_payload_t *nonce_payload;
 499         chunk_t nonce;
 500
 501         this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
 502
 503         if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 16, &nonce) != SUCCESS)
 504         {
 505                 return OUT_OF_RES;
 506         }
 507
 508         nonce_payload = nonce_payload_create();
 509         if (nonce_payload == NULL)
 510         {
 511                 return OUT_OF_RES;
 512         }
 513
 514         nonce_payload->set_nonce(nonce_payload, nonce);
 515
 516         *payload = nonce_payload;
 517
 518         return SUCCESS;
 519 }
 520
 521 /**
 522  * @brief implements function destroy of private_ike_sa_t
 523  */
 524 static status_t destroy (private_ike_sa_t *this)
 525 {
 526         linked_list_iterator_t *iterator;
 527
 528         this->child_sas->create_iterator(this->child_sas, &iterator, TRUE);
 529         while (iterator->has_next(iterator))
 530         {
 531                 payload_t *payload;
 532                 iterator->current(iterator, (void**)&payload);
 533                 payload->destroy(payload);
 534         }
 535         iterator->destroy(iterator);
 536         this->child_sas->destroy(this->child_sas);
 537
 538         this->ike_sa_id->destroy(this->ike_sa_id);
 539         this->sent_messages->destroy(this->sent_messages);
 540         this->randomizer->destroy(this->randomizer);
 541
 542         global_logger_manager->destroy_logger(global_logger_manager, this->logger);
 543
 544         allocator_free(this);
 545
 546         return SUCCESS;
 547 }
 548
 549 /*
 550  * Described in Header
 551  */
 552 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 553 {
 554         private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
 555         if (this == NULL)
 556         {
 557                 return NULL;
 558         }
 559
 560
 561         /* Public functions */
 562         this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
 563         this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
 564         this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
 565         this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
 566
 567         this->build_sa_payload = build_sa_payload;
 568         this->build_ke_payload = build_ke_payload;
 569         this->build_nonce_payload = build_nonce_payload;
 570
 571         this->build_message = build_message;
 572         this->transto_ike_sa_init_responded = transto_ike_sa_init_responded;
 573         this->transto_ike_auth_requested = transto_ike_auth_requested;
 574
 575
 576
 577         /* initialize private fields */
 578         if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
 579         {
 580                 allocator_free(this);
 581                 return NULL;
 582         }
 583         this->child_sas = linked_list_create();
 584         if (this->child_sas == NULL)
 585         {
 586                 this->ike_sa_id->destroy(this->ike_sa_id);
 587                 allocator_free(this);
 588                 return NULL;
 589         }
 590         this->randomizer = randomizer_create();
 591         if (this->randomizer == NULL)
 592         {
 593                 this->child_sas->destroy(this->child_sas);
 594                 this->ike_sa_id->destroy(this->ike_sa_id);
 595                 allocator_free(this);
 596         }
 597         this->sent_messages = linked_list_create();
 598         if (this->sent_messages == NULL)
 599         {
 600                 this->randomizer->destroy(this->randomizer);
 601                 this->child_sas->destroy(this->child_sas);
 602                 this->ike_sa_id->destroy(this->ike_sa_id);
 603                 allocator_free(this);
 604         }
 605         this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
 606         if (this->logger ==  NULL)
 607         {
 608                 this->randomizer->destroy(this->randomizer);
 609                 this->child_sas->destroy(this->child_sas);
 610                 this->ike_sa_id->destroy(this->ike_sa_id);
 611                 this->sent_messages->destroy(this->sent_messages);
 612                 allocator_free(this);
 613         }
 614
 615         this->me.host = NULL;
 616         this->other.host = NULL;
 617         this->diffie_hellman = NULL;
 618         this->message_id_out = 0;
 619         this->message_id_in = 0;
 620
 621
 622         /* at creation time, IKE_SA isn't in a specific state */
 623         this->state = NO_STATE;
 624
 625         return (&this->public);
 626 }