Source/charon/ike_sa.c

   1 /**
   2  * @file ike_sa.c
   3  *
   4  * @brief Class ike_sa_t. An object of this type is managed by an
   5  * ike_sa_manager_t object and represents an IKE_SA
   6  *
   7  */
   8
   9 /*
  10  * Copyright (C) 2005 Jan Hutter, Martin Willi
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include "ike_sa.h"
  25
  26 #include "types.h"
  27 #include "globals.h"
  28 #include "utils/allocator.h"
  29 #include "utils/linked_list.h"
  30 #include "utils/logger_manager.h"
  31 #include "utils/randomizer.h"
  32 #include "payloads/sa_payload.h"
  33 #include "payloads/nonce_payload.h"
  34 #include "payloads/ke_payload.h"
  35 #include "payloads/transform_substructure.h"
  36 #include "payloads/transform_attribute.h"
  37
  38
  39 /**
  40  * States in which a IKE_SA can actually be
  41  */
  42 typedef enum ike_sa_state_e ike_sa_state_t;
  43
  44 enum ike_sa_state_e {
  45
  46         /**
  47          * IKE_SA is is not in a state
  48          */
  49         NO_STATE = 1,
  50
  51         /**
  52          * A IKE_SA_INIT-message was sent: role initiator
  53          */
  54         IKE_SA_INIT_REQUESTED = 2,
  55
  56         /**
  57          * A IKE_SA_INIT-message was replied: role responder
  58          */
  59         IKE_SA_INIT_RESPONDED = 3,
  60
  61         /**
  62          * An IKE_AUTH-message was sent after a successful
  63          * IKE_SA_INIT-exchange: role initiator
  64          */
  65         IKE_AUTH_REQUESTED = 4,
  66
  67         /**
  68          * An IKE_AUTH-message was replied: role responder.
  69          * In this state, all the informations for an IKE_SA
  70          * and one CHILD_SA are known.
  71          */
  72         IKE_SA_INITIALIZED = 5
  73 };
  74
  75
  76 /**
  77  * Private data of an message_t object
  78  */
  79 typedef struct private_ike_sa_s private_ike_sa_t;
  80
  81 struct private_ike_sa_s {
  82
  83         /**
  84          * Public part of a ike_sa_t object
  85          */
  86         ike_sa_t public;
  87
  88         status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
  89         status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
  90         status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
  91
  92         /* Private values */
  93         /**
  94          * Identifier for the current IKE_SA
  95          */
  96         ike_sa_id_t *ike_sa_id;
  97
  98         /**
  99          * Linked List containing the child sa's of the current IKE_SA
 100          */
 101         linked_list_t *child_sas;
 102
 103         /**
 104          * Current state of the IKE_SA
 105          */
 106         ike_sa_state_t current_state;
 107
 108         /**
 109          * is this IKE_SA the original initiator of this IKE_SA
 110          */
 111         bool original_initiator;
 112
 113         /**
 114          * this SA's source for random data
 115          */
 116         randomizer_t *randomizer;
 117
 118         linked_list_t *sent_messages;
 119
 120         struct {
 121                 host_t *host;
 122         } me;
 123
 124         struct {
 125                 host_t *host;
 126         } other;
 127
 128         /**
 129          * a logger for this IKE_SA
 130          */
 131         logger_t *logger;
 132 };
 133
 134 /**
 135  * @brief implements function process_message of private_ike_sa_t
 136  */
 137 static status_t process_message (private_ike_sa_t *this, message_t *message)
 138 {
 139         status_t status;
 140         /* @TODO Add Message Processing here */
 141
 142         this->logger->log(this->logger, CONTROL_MORE, "Process message of exchange type %s",mapping_find(exchange_type_m,message->get_exchange_type(message)));
 143
 144         /* parse body */
 145         status = message->parse_body(message);
 146         switch (status)
 147         {
 148                 case SUCCESS:
 149                 {
 150                         break;
 151                 }
 152                 default:
 153                 {
 154                         this->logger->log(this->logger, ERROR, "Error of type %s while parsing message body",mapping_find(status_m,status));
 155                         switch (this->current_state)
 156                         {
 157                                 case NO_STATE:
 158                                 {
 159                                         job_t *delete_job;
 160                                         /* create delete job for this ike_sa */
 161                                         delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
 162                                         if (delete_job == NULL)
 163                                         {
 164                                                 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
 165                                         }
 166
 167                                         status = global_job_queue->add(global_job_queue,delete_job);
 168                                         if (status != SUCCESS)
 169                                         {
 170                                                 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
 171                                                 delete_job->destroy_all(delete_job);
 172                                         }
 173
 174                                 }
 175                                 default:
 176                                 {
 177                                         break;
 178                                 }
 179                         }
 180
 181                         return FAILED;
 182                 }
 183         }
 184
 185         return status;
 186 }
 187
 188 /**
 189  * @brief implements function process_configuration of private_ike_sa_t
 190  */
 191 static status_t initialize_connection(private_ike_sa_t *this, char *name)
 192 {
 193         message_t *message;
 194         payload_t *payload;
 195         packet_t *packet;
 196         host_t *source, *destination;
 197         status_t status;
 198
 199         this->logger->log(this->logger, CONTROL, "initializing connection");
 200
 201         this->original_initiator = TRUE;
 202
 203         status = global_configuration_manager->get_local_host(global_configuration_manager, name, &source);
 204         if (status != SUCCESS)
 205         {
 206                 return INVALID_ARG;
 207         }
 208
 209         status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &destination);
 210         if (status != SUCCESS)
 211         {
 212                 return INVALID_ARG;
 213         }
 214
 215         message = message_create();
 216
 217         if (message == NULL)
 218         {
 219                 return OUT_OF_RES;
 220         }
 221
 222
 223         message->set_source(message, source);
 224         message->set_destination(message, destination);
 225
 226         message->set_exchange_type(message, IKE_SA_INIT);
 227         message->set_original_initiator(message, this->original_initiator);
 228         message->set_message_id(message, 0);
 229         message->set_ike_sa_id(message, this->ike_sa_id);
 230         message->set_request(message, TRUE);
 231
 232         status = this->build_sa_payload(this, (sa_payload_t**)&payload);
 233         if (status != SUCCESS)
 234         {
 235                 this->logger->log(this->logger, ERROR, "Could not build SA payload");
 236                 message->destroy(message);
 237                 return status;
 238         }
 239         payload->set_next_type(payload, KEY_EXCHANGE);
 240         message->add_payload(message, payload);
 241
 242         status = this->build_ke_payload(this, (ke_payload_t**)&payload);
 243         if (status != SUCCESS)
 244         {
 245                 this->logger->log(this->logger, ERROR, "Could not build KE payload");
 246                 message->destroy(message);
 247                 return status;
 248         }
 249         payload->set_next_type(payload, NONCE);
 250         message->add_payload(message, payload);
 251
 252         status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
 253         if (status != SUCCESS)
 254         {
 255                 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
 256                 message->destroy(message);
 257                 return status;
 258         }
 259         payload->set_next_type(payload, NO_PAYLOAD);
 260         message->add_payload(message, payload);
 261
 262         status = message->generate(message, &packet);
 263         if (status != SUCCESS)
 264         {
 265                 this->logger->log(this->logger, ERROR, "Could not generate message");
 266                 message->destroy(message);
 267                 return status;
 268         }
 269
 270
 271         global_send_queue->add(global_send_queue, packet);
 272
 273         message->destroy(message);
 274
 275
 276         return SUCCESS;
 277 }
 278
 279 /**
 280  * @brief implements function private_ike_sa_t.get_id
 281  */
 282 static ike_sa_id_t* get_id(private_ike_sa_t *this)
 283 {
 284         return this->ike_sa_id;
 285 }
 286
 287 /**
 288  * implements private_ike_sa_t.build_sa_payload
 289  */
 290 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
 291 {
 292         sa_payload_t *sa_payload;
 293         proposal_substructure_t *proposal;
 294         transform_substructure_t *transform;
 295         transform_attribute_t *attribute;
 296
 297
 298         this->logger->log(this->logger, CONTROL_MORE, "building sa payload");
 299
 300         sa_payload = sa_payload_create();
 301         if (sa_payload == NULL)
 302         {
 303                 return OUT_OF_RES;
 304         }
 305
 306         do
 307         {       /* no loop, just to break */
 308                 proposal = proposal_substructure_create();
 309                 if (proposal == NULL)
 310                 {
 311                         break;
 312                 }
 313                 sa_payload->add_proposal_substructure(sa_payload, proposal);
 314
 315                 /*
 316                  * Encryption Algorithm
 317                  */
 318                 transform = transform_substructure_create();
 319                 if (transform == NULL)
 320                 {
 321                         break;
 322                 }
 323                 proposal->add_transform_substructure(proposal, transform);
 324                 transform->set_is_last_transform(transform, FALSE);
 325                 transform->set_transform_type(transform, ENCRYPTION_ALGORITHM);
 326                 transform->set_transform_id(transform, ENCR_AES_CBC);
 327
 328                 attribute = transform_attribute_create();
 329                 if (attribute == NULL)
 330                 {
 331                         break;
 332                 }
 333                 transform->add_transform_attribute(transform, attribute);
 334                 attribute->set_attribute_type(attribute, KEY_LENGTH);
 335                 attribute->set_value(attribute, 16);
 336
 337                 /*
 338                  * Pseudo-random Function
 339                  */
 340                 transform = transform_substructure_create();
 341                 if (transform == NULL)
 342                 {
 343                         break;
 344                 }
 345                 proposal->add_transform_substructure(proposal, transform);
 346                 transform->set_is_last_transform(transform, FALSE);
 347                 transform->set_transform_type(transform, PSEUDO_RANDOM_FUNCTION);
 348                 transform->set_transform_id(transform, PRF_HMAC_SHA1);
 349
 350                 attribute = transform_attribute_create();
 351                 if (attribute == NULL)
 352                 {
 353                         break;
 354                 }
 355                 transform->add_transform_attribute(transform, attribute);
 356                 attribute->set_attribute_type(attribute, KEY_LENGTH);
 357                 attribute->set_value(attribute, 16);
 358
 359
 360                 /*
 361                  * Integrity Algorithm
 362                  */
 363                 transform = transform_substructure_create();
 364                 if (transform == NULL)
 365                 {
 366                         break;
 367                 }
 368                 proposal->add_transform_substructure(proposal, transform);
 369                 transform->set_is_last_transform(transform, FALSE);
 370                 transform->set_transform_type(transform, INTEGRITIY_ALGORITHM);
 371                 transform->set_transform_id(transform, AUTH_HMAC_SHA1_96);
 372
 373                 attribute = transform_attribute_create();
 374                 if (attribute == NULL)
 375                 {
 376                         break;
 377                 }
 378                 transform->add_transform_attribute(transform, attribute);
 379                 attribute->set_attribute_type(attribute, KEY_LENGTH);
 380                 attribute->set_value(attribute, 16);
 381
 382
 383             /*
 384              * Diffie-Hellman Group
 385              */
 386                 transform = transform_substructure_create();
 387                 if (transform == NULL)
 388                 {
 389                         break;
 390                 }
 391                 proposal->add_transform_substructure(proposal, transform);
 392                 transform->set_is_last_transform(transform, FALSE);
 393                 transform->set_transform_type(transform, DIFFIE_HELLMAN_GROUP);
 394                 transform->set_transform_id(transform, MODP_1024_BIT);
 395
 396                 *payload = sa_payload;
 397
 398                 return SUCCESS;
 399
 400         } while(FALSE);
 401
 402         return OUT_OF_RES;
 403 }
 404
 405 /**
 406  * implements private_ike_sa_t.build_ke_payload
 407  */
 408 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
 409 {
 410         ke_payload_t *ke_payload;
 411         chunk_t key_data;
 412
 413
 414         this->logger->log(this->logger, CONTROL_MORE, "building ke payload");
 415
 416         key_data.ptr = "12345";
 417         key_data.len = strlen("12345");
 418
 419
 420         ke_payload = ke_payload_create();
 421         if (ke_payload == NULL)
 422         {
 423                 return OUT_OF_RES;
 424         }
 425         ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
 426         if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
 427         {
 428                 ke_payload->destroy(ke_payload);
 429                 return OUT_OF_RES;
 430         }
 431         *payload = ke_payload;
 432         return SUCCESS;
 433 }
 434
 435 /**
 436  * implements private_ike_sa_t.build_nonce_payload
 437  */
 438 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
 439 {
 440         nonce_payload_t *nonce_payload;
 441         chunk_t nonce;
 442
 443         this->logger->log(this->logger, CONTROL_MORE, "building nonce payload");
 444
 445         if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 16, &nonce) != SUCCESS)
 446         {
 447                 return OUT_OF_RES;
 448         }
 449
 450         nonce_payload = nonce_payload_create();
 451         if (nonce_payload == NULL)
 452         {
 453                 return OUT_OF_RES;
 454         }
 455
 456         nonce_payload->set_nonce(nonce_payload, nonce);
 457
 458         *payload = nonce_payload;
 459
 460         return SUCCESS;
 461 }
 462
 463 /**
 464  * @brief implements function destroy of private_ike_sa_t
 465  */
 466 static status_t destroy (private_ike_sa_t *this)
 467 {
 468         linked_list_iterator_t *iterator;
 469
 470         this->child_sas->create_iterator(this->child_sas, &iterator, TRUE);
 471         while (iterator->has_next(iterator))
 472         {
 473                 payload_t *payload;
 474                 iterator->current(iterator, (void**)&payload);
 475                 payload->destroy(payload);
 476         }
 477         iterator->destroy(iterator);
 478         this->child_sas->destroy(this->child_sas);
 479
 480         this->ike_sa_id->destroy(this->ike_sa_id);
 481         this->sent_messages->destroy(this->sent_messages);
 482         this->randomizer->destroy(this->randomizer);
 483
 484         global_logger_manager->destroy_logger(global_logger_manager, this->logger);
 485
 486         allocator_free(this);
 487
 488         return SUCCESS;
 489 }
 490
 491 /*
 492  * Described in Header
 493  */
 494 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 495 {
 496         private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
 497         if (this == NULL)
 498         {
 499                 return NULL;
 500         }
 501
 502
 503         /* Public functions */
 504         this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
 505         this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
 506         this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
 507         this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
 508
 509         this->build_sa_payload = build_sa_payload;
 510         this->build_ke_payload = build_ke_payload;
 511         this->build_nonce_payload = build_nonce_payload;
 512
 513
 514
 515         /* initialize private fields */
 516         if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
 517         {
 518                 allocator_free(this);
 519                 return NULL;
 520         }
 521         this->child_sas = linked_list_create();
 522         if (this->child_sas == NULL)
 523         {
 524                 this->ike_sa_id->destroy(this->ike_sa_id);
 525                 allocator_free(this);
 526                 return NULL;
 527         }
 528         this->randomizer = randomizer_create();
 529         if (this->randomizer == NULL)
 530         {
 531                 this->child_sas->destroy(this->child_sas);
 532                 this->ike_sa_id->destroy(this->ike_sa_id);
 533                 allocator_free(this);
 534         }
 535         this->sent_messages = linked_list_create();
 536         if (this->sent_messages == NULL)
 537         {
 538                 this->randomizer->destroy(this->randomizer);
 539                 this->child_sas->destroy(this->child_sas);
 540                 this->ike_sa_id->destroy(this->ike_sa_id);
 541                 allocator_free(this);
 542         }
 543         this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
 544         if (this->logger ==  NULL)
 545         {
 546                 this->randomizer->destroy(this->randomizer);
 547                 this->child_sas->destroy(this->child_sas);
 548                 this->ike_sa_id->destroy(this->ike_sa_id);
 549                 this->sent_messages->destroy(this->sent_messages);
 550                 allocator_free(this);
 551         }
 552
 553         this->me.host = NULL;
 554         this->other.host = NULL;
 555
 556
 557         /* at creation time, IKE_SA isn't in a specific state */
 558         this->current_state = NO_STATE;
 559
 560         return (&this->public);
 561 }