4 * @brief Class ike_sa_t. An object of this type is managed by an
5 * ike_sa_manager_t object and represents an IKE_SA
10 * Copyright (C) 2005 Jan Hutter, Martin Willi
11 * Hochschule fuer Technik Rapperswil
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
28 #include "definitions.h"
29 #include "utils/allocator.h"
30 #include "utils/linked_list.h"
31 #include "utils/logger_manager.h"
32 #include "utils/randomizer.h"
33 #include "transforms/diffie_hellman.h"
34 #include "payloads/sa_payload.h"
35 #include "payloads/nonce_payload.h"
36 #include "payloads/ke_payload.h"
37 #include "payloads/transform_substructure.h"
38 #include "payloads/transform_attribute.h"
42 * States in which a IKE_SA can actually be
44 typedef enum ike_sa_state_e ike_sa_state_t
;
49 * IKE_SA is is not in a state
54 * A IKE_SA_INIT-message was sent: role initiator
56 IKE_SA_INIT_REQUESTED
= 2,
59 * A IKE_SA_INIT-message was replied: role responder
61 IKE_SA_INIT_RESPONDED
= 3,
64 * An IKE_AUTH-message was sent after a successful
65 * IKE_SA_INIT-exchange: role initiator
67 IKE_AUTH_REQUESTED
= 4,
70 * An IKE_AUTH-message was replied: role responder.
71 * In this state, all the informations for an IKE_SA
72 * and one CHILD_SA are known.
74 IKE_SA_INITIALIZED
= 5
78 * string mappings for ike_sa_state
80 mapping_t ike_sa_state_m
[] = {
81 {NO_STATE
, "NO_STATE"},
82 {IKE_SA_INIT_REQUESTED
, "IKE_SA_INIT_REQUESTED"},
83 {IKE_SA_INIT_RESPONDED
, "IKE_SA_INIT_RESPONDED"},
84 {IKE_AUTH_REQUESTED
, "IKE_AUTH_REQUESTED"},
85 {IKE_SA_INITIALIZED
, "IKE_SA_INITIALIZED"},
91 * Private data of an message_t object
93 typedef struct private_ike_sa_s private_ike_sa_t
;
95 struct private_ike_sa_s
{
98 * Public part of a ike_sa_t object
102 status_t (*build_sa_payload
) (private_ike_sa_t
*this, sa_payload_t
**payload
);
103 status_t (*build_nonce_payload
) (private_ike_sa_t
*this, nonce_payload_t
**payload
);
104 status_t (*build_ke_payload
) (private_ike_sa_t
*this, ke_payload_t
**payload
);
106 status_t (*build_message
) (private_ike_sa_t
*this, exchange_type_t type
, bool request
);
108 status_t (*transto_ike_sa_init_responded
) (private_ike_sa_t
*this, message_t
*message
);
109 status_t (*transto_ike_auth_requested
) (private_ike_sa_t
*this, message_t
*message
);
113 * Identifier for the current IKE_SA
115 ike_sa_id_t
*ike_sa_id
;
118 * Linked List containing the child sa's of the current IKE_SA
120 linked_list_t
*child_sas
;
123 * Current state of the IKE_SA
125 ike_sa_state_t state
;
128 * is this IKE_SA the original initiator of this IKE_SA
130 bool original_initiator
;
133 * this SA's source for random data
135 randomizer_t
*randomizer
;
137 linked_list_t
*sent_messages
;
147 diffie_hellman_t
*diffie_hellman
;
149 u_int32_t message_id_in
;
150 u_int32_t message_id_out
;
153 * a logger for this IKE_SA
159 * @brief implements function process_message of private_ike_sa_t
161 static status_t
process_message (private_ike_sa_t
*this, message_t
*message
)
163 this->logger
->log(this->logger
, CONTROL
|MORE
, "Process message of exchange type %s",
164 mapping_find(exchange_type_m
,message
->get_exchange_type(message
)));
166 switch (message
->get_exchange_type(message
))
170 if (message
->get_request(message
)) {
171 if (this->state
== NO_STATE
)
173 /* state transission NO_STATE => IKE_SA_INIT_RESPONDED */
174 return this->transto_ike_sa_init_responded(this, message
);
179 if (this->state
== IKE_SA_INIT_REQUESTED
)
181 /* state transission IKE_SA_INIT_REQUESTED => IKE_AUTH_REQUESTED*/
182 return this->transto_ike_auth_requested(this, message
);
191 case CREATE_CHILD_SA
:
201 this->logger
->log(this->logger
, ERROR
, "processing %s-message not supported.",
202 mapping_find(exchange_type_m
,message
->get_exchange_type(message
)));
203 return NOT_SUPPORTED
;
206 this->logger
->log(this->logger
, ERROR
, "received %s-message in state %s, rejected.",
207 mapping_find(exchange_type_m
, message
->get_exchange_type(message
)),
208 mapping_find(ike_sa_state_m
, this->state
));
209 return INVALID_STATE
;
213 static status_t
build_message(private_ike_sa_t
*this, exchange_type_t type
, bool request
)
217 host_t
*source
, *destination
;
219 message
= message_create();
225 status
= this->me
.host
->clone(this->me
.host
, &source
);
226 status
|= this->other
.host
->clone(this->other
.host
, &destination
);
227 if (status
!= SUCCESS
)
229 message
->destroy(message
);
232 message
->set_source(message
, source
);
233 message
->set_destination(message
, destination
);
235 message
->set_exchange_type(message
, type
);
236 message
->set_request(message
, request
);
238 message
->set_ike_sa_id(message
, this->ike_sa_id
);
243 static status_t
transto_ike_sa_init_responded(private_ike_sa_t
*this, message_t
*message
)
246 linked_list_iterator_t
*payloads
;
249 status
= message
->parse_body(message
);
250 if (status
!= SUCCESS
)
259 status
= message
->get_payload_iterator(message
, &payloads
);
260 if (status
!= SUCCESS
)
262 respond
->destroy(respond
);
265 while (payloads
->has_next(payloads
))
268 payloads
->current(payloads
, (void**)payload
);
269 switch (payload
->get_type(payload
))
271 case SECURITY_ASSOCIATION
:
273 sa_payload_t
*sa_payload
;
274 linked_list_iterator_t
*proposals
;
276 sa_payload
= (sa_payload_t
*)payload
;
277 status
= sa_payload
->create_proposal_substructure_iterator(sa_payload
, &proposals
, TRUE
);
278 if (status
!= SUCCESS
)
280 payloads
->destroy(payloads
);
283 //global_configuration_manager->select_proposals_for_host
310 delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
311 if (delete_job == NULL)
313 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
316 status = global_job_queue->add(global_job_queue,delete_job);
317 if (status != SUCCESS)
319 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
320 delete_job->destroy_all(delete_job);
325 static status_t
transto_ike_auth_requested(private_ike_sa_t
*this, message_t
*message
)
331 * @brief implements function process_configuration of private_ike_sa_t
333 static status_t
initialize_connection(private_ike_sa_t
*this, char *name
)
340 this->logger
->log(this->logger
, CONTROL
, "initializing connection");
342 this->original_initiator
= TRUE
;
344 status
= global_configuration_manager
->get_local_host(global_configuration_manager
, name
, &(this->me
.host
));
345 if (status
!= SUCCESS
)
350 status
= global_configuration_manager
->get_remote_host(global_configuration_manager
, name
, &(this->other
.host
));
351 if (status
!= SUCCESS
)
356 message
= message_create();
364 message
->set_source(message
, this->me
.host
);
365 message
->set_destination(message
, this->other
.host
);
367 message
->set_exchange_type(message
, IKE_SA_INIT
);
368 message
->set_original_initiator(message
, this->original_initiator
);
369 message
->set_message_id(message
, this->message_id_out
++);
370 message
->set_ike_sa_id(message
, this->ike_sa_id
);
371 message
->set_request(message
, TRUE
);
373 status
= this->build_sa_payload(this, (sa_payload_t
**)&payload
);
374 if (status
!= SUCCESS
)
376 this->logger
->log(this->logger
, ERROR
, "Could not build SA payload");
377 message
->destroy(message
);
380 payload
->set_next_type(payload
, KEY_EXCHANGE
);
381 message
->add_payload(message
, payload
);
383 status
= this->build_ke_payload(this, (ke_payload_t
**)&payload
);
384 if (status
!= SUCCESS
)
386 this->logger
->log(this->logger
, ERROR
, "Could not build KE payload");
387 message
->destroy(message
);
390 payload
->set_next_type(payload
, NONCE
);
391 message
->add_payload(message
, payload
);
393 status
= this->build_nonce_payload(this, (nonce_payload_t
**)&payload
);
394 if (status
!= SUCCESS
)
396 this->logger
->log(this->logger
, ERROR
, "Could not build NONCE payload");
397 message
->destroy(message
);
400 payload
->set_next_type(payload
, NO_PAYLOAD
);
401 message
->add_payload(message
, payload
);
403 status
= message
->generate(message
, &packet
);
404 if (status
!= SUCCESS
)
406 this->logger
->log(this->logger
, ERROR
, "Could not generate message");
407 message
->destroy(message
);
412 global_send_queue
->add(global_send_queue
, packet
);
414 message
->destroy(message
);
416 this->state
= IKE_SA_INIT_REQUESTED
;
422 * @brief implements function private_ike_sa_t.get_id
424 static ike_sa_id_t
* get_id(private_ike_sa_t
*this)
426 return this->ike_sa_id
;
430 * implements private_ike_sa_t.build_sa_payload
432 static status_t
build_sa_payload(private_ike_sa_t
*this, sa_payload_t
**payload
)
434 sa_payload_t
* sa_payload
;
435 linked_list_iterator_t
*iterator
;
438 this->logger
->log(this->logger
, CONTROL
|MORE
, "building sa payload");
440 sa_payload
= sa_payload_create();
441 if (sa_payload
== NULL
)
445 status
= sa_payload
->create_proposal_substructure_iterator(sa_payload
, &iterator
, FALSE
);
446 if (status
!= SUCCESS
)
448 sa_payload
->destroy(sa_payload
);
451 status
= global_configuration_manager
->get_proposals_for_host(global_configuration_manager
, this->other
.host
, iterator
);
452 if (status
!= SUCCESS
)
454 sa_payload
->destroy(sa_payload
);
458 *payload
= sa_payload
;
464 * implements private_ike_sa_t.build_ke_payload
466 static status_t
build_ke_payload(private_ike_sa_t
*this, ke_payload_t
**payload
)
468 ke_payload_t
*ke_payload
;
472 this->logger
->log(this->logger
, CONTROL
|MORE
, "building ke payload");
474 key_data
.ptr
= "12345";
475 key_data
.len
= strlen("12345");
478 ke_payload
= ke_payload_create();
479 if (ke_payload
== NULL
)
483 ke_payload
->set_dh_group_number(ke_payload
, MODP_1024_BIT
);
484 if (ke_payload
->set_key_exchange_data(ke_payload
, key_data
) != SUCCESS
)
486 ke_payload
->destroy(ke_payload
);
489 *payload
= ke_payload
;
494 * implements private_ike_sa_t.build_nonce_payload
496 static status_t
build_nonce_payload(private_ike_sa_t
*this, nonce_payload_t
**payload
)
498 nonce_payload_t
*nonce_payload
;
501 this->logger
->log(this->logger
, CONTROL
|MORE
, "building nonce payload");
503 if (this->randomizer
->allocate_pseudo_random_bytes(this->randomizer
, 16, &nonce
) != SUCCESS
)
508 nonce_payload
= nonce_payload_create();
509 if (nonce_payload
== NULL
)
514 nonce_payload
->set_nonce(nonce_payload
, nonce
);
516 *payload
= nonce_payload
;
522 * @brief implements function destroy of private_ike_sa_t
524 static status_t
destroy (private_ike_sa_t
*this)
526 linked_list_iterator_t
*iterator
;
528 this->child_sas
->create_iterator(this->child_sas
, &iterator
, TRUE
);
529 while (iterator
->has_next(iterator
))
532 iterator
->current(iterator
, (void**)&payload
);
533 payload
->destroy(payload
);
535 iterator
->destroy(iterator
);
536 this->child_sas
->destroy(this->child_sas
);
538 this->ike_sa_id
->destroy(this->ike_sa_id
);
539 this->sent_messages
->destroy(this->sent_messages
);
540 this->randomizer
->destroy(this->randomizer
);
542 global_logger_manager
->destroy_logger(global_logger_manager
, this->logger
);
544 allocator_free(this);
550 * Described in Header
552 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
)
554 private_ike_sa_t
*this = allocator_alloc_thing(private_ike_sa_t
);
561 /* Public functions */
562 this->public.process_message
= (status_t(*)(ike_sa_t
*, message_t
*)) process_message
;
563 this->public.initialize_connection
= (status_t(*)(ike_sa_t
*, char*)) initialize_connection
;
564 this->public.get_id
= (ike_sa_id_t
*(*)(ike_sa_t
*)) get_id
;
565 this->public.destroy
= (status_t(*)(ike_sa_t
*))destroy
;
567 this->build_sa_payload
= build_sa_payload
;
568 this->build_ke_payload
= build_ke_payload
;
569 this->build_nonce_payload
= build_nonce_payload
;
571 this->build_message
= build_message
;
572 this->transto_ike_sa_init_responded
= transto_ike_sa_init_responded
;
573 this->transto_ike_auth_requested
= transto_ike_auth_requested
;
577 /* initialize private fields */
578 if (ike_sa_id
->clone(ike_sa_id
,&(this->ike_sa_id
)) != SUCCESS
)
580 allocator_free(this);
583 this->child_sas
= linked_list_create();
584 if (this->child_sas
== NULL
)
586 this->ike_sa_id
->destroy(this->ike_sa_id
);
587 allocator_free(this);
590 this->randomizer
= randomizer_create();
591 if (this->randomizer
== NULL
)
593 this->child_sas
->destroy(this->child_sas
);
594 this->ike_sa_id
->destroy(this->ike_sa_id
);
595 allocator_free(this);
597 this->sent_messages
= linked_list_create();
598 if (this->sent_messages
== NULL
)
600 this->randomizer
->destroy(this->randomizer
);
601 this->child_sas
->destroy(this->child_sas
);
602 this->ike_sa_id
->destroy(this->ike_sa_id
);
603 allocator_free(this);
605 this->logger
= global_logger_manager
->create_logger(global_logger_manager
, IKE_SA
, NULL
);
606 if (this->logger
== NULL
)
608 this->randomizer
->destroy(this->randomizer
);
609 this->child_sas
->destroy(this->child_sas
);
610 this->ike_sa_id
->destroy(this->ike_sa_id
);
611 this->sent_messages
->destroy(this->sent_messages
);
612 allocator_free(this);
615 this->me
.host
= NULL
;
616 this->other
.host
= NULL
;
617 this->diffie_hellman
= NULL
;
618 this->message_id_out
= 0;
619 this->message_id_in
= 0;
622 /* at creation time, IKE_SA isn't in a specific state */
623 this->state
= NO_STATE
;
625 return (&this->public);