2f226c2271d7df70c5d1b2b32fdfb944af0220c3
[strongswan.git] / Source / charon / sa / ike_sa.c
1 /**
2 * @file ike_sa.c
3 *
4 * @brief Implementation of ike_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "ike_sa.h"
24
25 #include <types.h>
26 #include <daemon.h>
27 #include <definitions.h>
28 #include <utils/allocator.h>
29 #include <utils/linked_list.h>
30 #include <utils/logger_manager.h>
31 #include <utils/randomizer.h>
32 #include <transforms/diffie_hellman.h>
33 #include <transforms/prf_plus.h>
34 #include <transforms/crypters/crypter.h>
35 #include <encoding/payloads/sa_payload.h>
36 #include <encoding/payloads/nonce_payload.h>
37 #include <encoding/payloads/ke_payload.h>
38 #include <encoding/payloads/delete_payload.h>
39 #include <encoding/payloads/transform_substructure.h>
40 #include <encoding/payloads/transform_attribute.h>
41 #include <sa/states/initiator_init.h>
42 #include <sa/states/responder_init.h>
43 #include <queues/jobs/retransmit_request_job.h>
44 #include <queues/jobs/delete_established_ike_sa_job.h>
45
46
47
48
49 typedef struct private_ike_sa_t private_ike_sa_t;
50
51 /**
52 * Private data of an ike_sa_t object.
53 */
54 struct private_ike_sa_t {
55
56 /**
57 * Protected part of a ike_sa_t object.
58 */
59 protected_ike_sa_t protected;
60
61 /**
62 * Identifier for the current IKE_SA.
63 */
64 ike_sa_id_t *ike_sa_id;
65
66 /**
67 * Linked List containing the child sa's of the current IKE_SA.
68 */
69 linked_list_t *child_sas;
70
71 /**
72 * Current state of the IKE_SA represented as state_t object.
73 *
74 * A state object representates one of the following states and is processing
75 * messages in the specific state:
76 * - INITIATOR_INIT
77 * - RESPONDER_INIT
78 * - IKE_SA_INIT_REQUESTED
79 * - IKE_SA_INIT_RESPONDED
80 * - IKE_AUTH_REQUESTED
81 * -IKE_SA_ESTABLISHED
82 */
83 state_t *current_state;
84
85 /**
86 * INIT configuration, needed for the IKE_SA_INIT exchange.
87 *
88 * Gets set in states:
89 * - INITATOR_INIT
90 * - RESPONDER_INIT
91 *
92 * Available in states:
93 * - IKE_SA_INIT_REQUESTED
94 * - IKE_SA_INIT_RESPONDED
95 * - IKE_AUTH_REQUESTED
96 * -IKE_SA_ESTABLISHED
97 */
98 init_config_t *init_config;
99
100 /**
101 * SA configuration, needed for all other exchanges after IKE_SA_INIT exchange.
102 *
103 * Gets set in states:
104 * - IKE_SA_INIT_REQUESTED
105 * - IKE_SA_INIT_RESPONDED
106 *
107 * Available in states:
108 * - IKE_AUTH_REQUESTED
109 * -IKE_SA_ESTABLISHED
110 */
111 sa_config_t *sa_config;
112
113 /**
114 * This SA's source for random data.
115 *
116 * Is available in every state.
117 */
118 randomizer_t *randomizer;
119
120 /**
121 * The last responded message.
122 */
123 message_t *last_responded_message;
124
125 /**
126 * The ast requested message.
127 */
128 message_t *last_requested_message;
129
130 /**
131 * Informations of this host.
132 */
133 struct {
134 host_t *host;
135 } me;
136
137 /**
138 * Informations of the other host.
139 */
140 struct {
141 host_t *host;
142 } other;
143
144 /**
145 * Crypter object for initiator.
146 */
147 crypter_t *crypter_initiator;
148
149 /**
150 * Crypter object for responder.
151 */
152 crypter_t *crypter_responder;
153
154 /**
155 * Signer object for initiator.
156 */
157 signer_t *signer_initiator;
158
159 /**
160 * Signer object for responder.
161 */
162 signer_t *signer_responder;
163
164 /**
165 * Multi purpose prf, set key, use it, forget it
166 */
167 prf_t *prf;
168
169 /**
170 * Prf function for derivating keymat child SAs
171 */
172 prf_t *child_prf;
173
174 /**
175 * PRF, with key set to pi_key, used for authentication
176 */
177 prf_t *prf_auth_i;
178
179 /**
180 * PRF, with key set to pr_key, used for authentication
181 */
182 prf_t *prf_auth_r;
183
184 /**
185 * Next message id to receive.
186 */
187 u_int32_t message_id_in;
188
189 /**
190 * Next message id to send.
191 */
192 u_int32_t message_id_out;
193
194 /**
195 * Last reply id which was successfully received.
196 */
197 int32_t last_replied_message_id;
198
199 /**
200 * A logger for this IKE_SA.
201 */
202 logger_t *logger;
203
204 /**
205 * Resends the last sent reply.
206 *
207 * @param this calling object
208 */
209 status_t (*resend_last_reply) (private_ike_sa_t *this);
210 };
211
212 /**
213 * Implementation of ike_sa_t.process_message.
214 */
215 static status_t process_message (private_ike_sa_t *this, message_t *message)
216 {
217 u_int32_t message_id;
218 exchange_type_t exchange_type;
219 bool is_request;
220
221 /* We must process each request or response from remote host */
222
223 /* Find out type of message (request or response) */
224 is_request = message->get_request(message);
225 exchange_type = message->get_exchange_type(message);
226
227 this->logger->log(this->logger, CONTROL, "Process %s message of exchange type %s",
228 (is_request) ? "REQUEST" : "RESPONSE",mapping_find(exchange_type_m,exchange_type));
229
230 message_id = message->get_message_id(message);
231
232 /*
233 * It has to be checked, if the message has to be resent cause of lost packets!
234 */
235 if (is_request && (message_id == (this->message_id_in - 1)))
236 {
237 /* Message can be resent ! */
238 this->logger->log(this->logger, CONTROL|LEVEL1, "Resent request detected. Send stored reply.");
239 return (this->resend_last_reply(this));
240 }
241
242 /* Now, the message id is checked for request AND reply */
243 if (is_request)
244 {
245 /* In a request, the message has to be this->message_id_in (other case is already handled) */
246 if (message_id != this->message_id_in)
247 {
248 this->logger->log(this->logger, ERROR | LEVEL1,
249 "Message request with message id %d received, but %d expected",
250 message_id,this->message_id_in);
251 return FAILED;
252 }
253 }
254 else
255 {
256 /* In a reply, the message has to be this->message_id_out -1 cause it is the reply to the last sent message*/
257 if (message_id != (this->message_id_out - 1))
258 {
259 this->logger->log(this->logger, ERROR | LEVEL1,
260 "Message reply with message id %d received, but %d expected",
261 message_id,this->message_id_in);
262 return FAILED;
263 }
264 }
265
266 /* now the message is processed by the current state object.
267 * The specific state object is responsible to check if a message can be received in
268 * the state it represents.
269 * The current state is also responsible to change the state object to the next state
270 * by calling protected_ike_sa_t.set_new_state*/
271 return this->current_state->process_message(this->current_state,message);
272 }
273
274 /**
275 * Implementation of protected_ike_sa_t.build_message.
276 */
277 static void build_message(private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
278 {
279 message_t *new_message;
280
281 this->logger->log(this->logger, CONTROL|LEVEL2, "Build empty message");
282 new_message = message_create();
283 new_message->set_source(new_message, this->me.host->clone(this->me.host));
284 new_message->set_destination(new_message, this->other.host->clone(this->other.host));
285 new_message->set_exchange_type(new_message, type);
286 new_message->set_request(new_message, request);
287 new_message->set_message_id(new_message, (request) ? this->message_id_out : this->message_id_in);
288 new_message->set_ike_sa_id(new_message, this->ike_sa_id);
289
290 *message = new_message;
291 }
292
293 /**
294 * Implementation of protected_ike_sa_t.process_configuration.
295 */
296 static status_t initialize_connection(private_ike_sa_t *this, char *name)
297 {
298 initiator_init_t *current_state;
299 status_t status;
300
301 /* Work is done in state object of type INITIATOR_INIT. All other states are not
302 * initial states and so don't have a initialize_connection function */
303
304 if (this->current_state->get_state(this->current_state) != INITIATOR_INIT)
305 {
306 return FAILED;
307 }
308
309 current_state = (initiator_init_t *) this->current_state;
310
311 status = current_state->initiate_connection(current_state,name);
312 return status;
313 }
314
315 /**
316 * Implementation of ike_sa_t.send_delete_ike_sa_request.
317 */
318 static void send_delete_ike_sa_request (private_ike_sa_t *this)
319 {
320 message_t *informational_request;
321 delete_payload_t *delete_payload;
322 crypter_t *crypter;
323 signer_t *signer;
324 packet_t *packet;
325 status_t status;
326
327 if (this->current_state->get_state(this->current_state) != IKE_SA_ESTABLISHED)
328 {
329 return;
330 }
331
332 /* build empty INFORMATIONAL message */
333 this->protected.build_message(&(this->protected), INFORMATIONAL, TRUE, &informational_request);
334
335 delete_payload = delete_payload_create();
336 delete_payload->set_protocol_id(delete_payload,IKE);
337
338 informational_request->add_payload(informational_request,(payload_t *)delete_payload);
339
340 if (this->ike_sa_id->is_initiator(this->ike_sa_id))
341 {
342 crypter = this->crypter_initiator;
343 signer = this->signer_initiator;
344 }
345 else
346 {
347 crypter = this->crypter_responder;
348 signer = this->signer_responder;
349 }
350
351 status = informational_request->generate(informational_request,
352 crypter,
353 signer, &packet);
354 informational_request->destroy(informational_request);
355 if (status != SUCCESS)
356 {
357 this->logger->log(this->logger, ERROR, "Could not generate packet from message");
358 return ;
359 }
360
361 charon->send_queue->add(charon->send_queue,packet);
362 }
363
364 /**
365 * Implementation of protected_ike_sa_t.get_id.
366 */
367 static ike_sa_id_t* get_id(private_ike_sa_t *this)
368 {
369 return this->ike_sa_id;
370 }
371
372 /**
373 * Implementation of private_ike_sa_t.resend_last_reply.
374 */
375 static status_t resend_last_reply(private_ike_sa_t *this)
376 {
377 packet_t *packet;
378
379 this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit last reply");
380 packet = this->last_responded_message->get_packet(this->last_responded_message);
381 charon->send_queue->add(charon->send_queue, packet);
382
383 return SUCCESS;
384 }
385
386 /**
387 * Implementation of ike_sa_t.retransmit_request.
388 */
389 status_t retransmit_request (private_ike_sa_t *this, u_int32_t message_id)
390 {
391 packet_t *packet;
392
393 if (this->last_requested_message == NULL)
394 {
395 return NOT_FOUND;
396 }
397
398 if (message_id == this->last_replied_message_id)
399 {
400 return NOT_FOUND;
401 }
402
403 if ((this->last_requested_message->get_message_id(this->last_requested_message)) != message_id)
404 {
405 return NOT_FOUND;
406 }
407
408 this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit message with id %d",message_id);
409 packet = this->last_requested_message->get_packet(this->last_requested_message);
410 charon->send_queue->add(charon->send_queue, packet);
411
412 return SUCCESS;
413 }
414
415 /**
416 * Implementation of protected_ike_sa_t.set_new_state.
417 */
418 static void set_new_state (private_ike_sa_t *this, state_t *state)
419 {
420 this->logger->log(this->logger, CONTROL, "statechange: %s => %s",
421 mapping_find(ike_sa_state_m,this->current_state->get_state(this->current_state)),
422 mapping_find(ike_sa_state_m,state->get_state(state)));
423 this->current_state = state;
424 }
425
426 /**
427 * Implementation of protected_ike_sa_t.get_logger.
428 */
429 static logger_t *get_logger (private_ike_sa_t *this)
430 {
431 return this->logger;
432 }
433
434 /**
435 * Implementation of protected_ike_sa_t.get_my_host.
436 */
437 static host_t *get_my_host (private_ike_sa_t *this)
438 {
439 return this->me.host;
440 }
441
442 /**
443 * Implementation of protected_ike_sa_t.get_other_host.
444 */
445 static host_t *get_other_host (private_ike_sa_t *this)
446 {
447 return this->other.host;
448 }
449
450 /**
451 * Implementation of protected_ike_sa_t.get_init_config.
452 */
453 static init_config_t *get_init_config (private_ike_sa_t *this)
454 {
455 return this->init_config;
456 }
457
458 /**
459 * Implementation of protected_ike_sa_t.set_init_config.
460 */
461 static void set_init_config (private_ike_sa_t *this,init_config_t * init_config)
462 {
463 this->init_config = init_config;
464 }
465
466 /**
467 * Implementation of protected_ike_sa_t.get_sa_config.
468 */
469 static sa_config_t *get_sa_config (private_ike_sa_t *this)
470 {
471 return this->sa_config;
472 }
473
474 /**
475 * Implementation of protected_ike_sa_t.set_sa_config.
476 */
477 static void set_sa_config (private_ike_sa_t *this,sa_config_t * sa_config)
478 {
479 this->sa_config = sa_config;
480 }
481
482 /**
483 * Implementation of protected_ike_sa_t.set_my_host.
484 */
485 static void set_my_host (private_ike_sa_t *this, host_t *my_host)
486 {
487 if (this->me.host)
488 {
489 this->me.host->destroy(this->me.host);
490 }
491 this->me.host = my_host;
492 }
493
494 /**
495 * Implementation of protected_ike_sa_t.set_other_host.
496 */
497 static void set_other_host (private_ike_sa_t *this, host_t *other_host)
498 {
499 if (this->other.host)
500 {
501 this->other.host->destroy(this->other.host);
502 }
503 this->other.host = other_host;
504 }
505
506 /**
507 * Implementation of protected_ike_sa_t.get_prf.
508 */
509 static prf_t *get_prf (private_ike_sa_t *this)
510 {
511 return this->prf;
512 }
513
514 /**
515 * Implementation of protected_ike_sa_t.get_prf.
516 */
517 static prf_t *get_child_prf (private_ike_sa_t *this)
518 {
519 return this->child_prf;
520 }
521
522 /**
523 * Implementation of protected_ike_sa_t.get_prf_auth_i.
524 */
525 static prf_t *get_prf_auth_i (private_ike_sa_t *this)
526 {
527 return this->prf_auth_i;
528 }
529
530 /**
531 * Implementation of protected_ike_sa_t.get_prf_auth_r.
532 */
533 static prf_t *get_prf_auth_r (private_ike_sa_t *this)
534 {
535 return this->prf_auth_r;
536 }
537
538
539 /**
540 * Implementation of protected_ike_sa_t.build_transforms.
541 */
542 static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r)
543 {
544 chunk_t nonces, nonces_spis, skeyseed, key, secret;
545 u_int64_t spi_i, spi_r;
546 prf_plus_t *prf_plus;
547 algorithm_t *algo;
548 size_t key_size;
549
550 /*
551 * Build the PRF+ instance for deriving keys
552 */
553 if (this->prf != NULL)
554 {
555 this->prf->destroy(this->prf);
556 }
557 proposal->get_algorithm(proposal, IKE, PSEUDO_RANDOM_FUNCTION, &algo);
558 if (algo == NULL)
559 {
560 this->logger->log(this->logger, ERROR|LEVEL2, "No PRF algoithm selected!?");
561 return FAILED;
562 }
563 this->prf = prf_create(algo->algorithm);
564 if (this->prf == NULL)
565 {
566 this->logger->log(this->logger, ERROR|LEVEL1,
567 "PSEUDO_RANDOM_FUNCTION %s not supported!",
568 mapping_find(pseudo_random_function_m, algo->algorithm));
569 return FAILED;
570 }
571
572 /* concatenate nonces = nonce_i | nonce_r */
573 nonces = allocator_alloc_as_chunk(nonce_i.len + nonce_r.len);
574 memcpy(nonces.ptr, nonce_i.ptr, nonce_i.len);
575 memcpy(nonces.ptr + nonce_i.len, nonce_r.ptr, nonce_r.len);
576
577 /* concatenate prf_seed = nonce_i | nonce_r | spi_i | spi_r */
578 nonces_spis = allocator_alloc_as_chunk(nonces.len + 16);
579 memcpy(nonces_spis.ptr, nonces.ptr, nonces.len);
580 spi_i = this->ike_sa_id->get_initiator_spi(this->ike_sa_id);
581 spi_r = this->ike_sa_id->get_responder_spi(this->ike_sa_id);
582 memcpy(nonces_spis.ptr + nonces.len, &spi_i, 8);
583 memcpy(nonces_spis.ptr + nonces.len + 8, &spi_r, 8);
584
585 /* SKEYSEED = prf(Ni | Nr, g^ir) */
586 dh->get_shared_secret(dh, &secret);
587 this->logger->log_chunk(this->logger, PRIVATE, "Shared Diffie Hellman secret", &secret);
588 this->prf->set_key(this->prf, nonces);
589 this->prf->allocate_bytes(this->prf, secret, &skeyseed);
590 this->logger->log_chunk(this->logger, PRIVATE | LEVEL1, "SKEYSEED", &skeyseed);
591 allocator_free_chunk(&secret);
592
593 /* prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr )
594 * = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr
595 *
596 * we use the prf directly for prf+
597 */
598 this->prf->set_key(this->prf, skeyseed);
599 prf_plus = prf_plus_create(this->prf, nonces_spis);
600
601 /* clean up unused stuff */
602 allocator_free_chunk(&nonces);
603 allocator_free_chunk(&nonces_spis);
604 allocator_free_chunk(&skeyseed);
605
606
607 /*
608 * We now can derive all of our key. We build the transforms
609 * directly.
610 */
611
612
613 /* SK_d used for prf+ to derive keys for child SAs */
614 this->child_prf = prf_create(algo->algorithm);
615 key_size = this->child_prf->get_key_size(this->child_prf);
616 prf_plus->allocate_bytes(prf_plus, key_size, &key);
617 this->logger->log_chunk(this->logger, PRIVATE, "Sk_d secret", &key);
618 this->child_prf->set_key(this->child_prf, key);
619 allocator_free_chunk(&key);
620
621
622 /* SK_ai/SK_ar used for integrity protection */
623 proposal->get_algorithm(proposal, IKE, INTEGRITY_ALGORITHM, &algo);
624 if (algo == NULL)
625 {
626 this->logger->log(this->logger, ERROR|LEVEL2, "No integrity algoithm selected?!");
627 return FAILED;
628 }
629 if (this->signer_initiator != NULL)
630 {
631 this->signer_initiator->destroy(this->signer_initiator);
632 }
633 if (this->signer_responder != NULL)
634 {
635 this->signer_responder->destroy(this->signer_responder);
636 }
637
638 this->signer_initiator = signer_create(algo->algorithm);
639 this->signer_responder = signer_create(algo->algorithm);
640 if (this->signer_initiator == NULL || this->signer_responder == NULL)
641 {
642 this->logger->log(this->logger, ERROR|LEVEL1,
643 "INTEGRITY_ALGORITHM %s not supported!",
644 mapping_find(integrity_algorithm_m,algo->algorithm));
645 return FAILED;
646 }
647 key_size = this->signer_initiator->get_key_size(this->signer_initiator);
648
649 prf_plus->allocate_bytes(prf_plus, key_size, &key);
650 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ai secret", &key);
651 this->signer_initiator->set_key(this->signer_initiator, key);
652 allocator_free_chunk(&key);
653
654 prf_plus->allocate_bytes(prf_plus, key_size, &key);
655 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ar secret", &key);
656 this->signer_responder->set_key(this->signer_responder, key);
657 allocator_free_chunk(&key);
658
659
660 /* SK_ei/SK_er used for encryption */
661 proposal->get_algorithm(proposal, IKE, ENCRYPTION_ALGORITHM, &algo);
662 if (algo == NULL)
663 {
664 this->logger->log(this->logger, ERROR|LEVEL2, "No encryption algoithm selected!?");
665 return FAILED;
666 }
667 if (this->crypter_initiator != NULL)
668 {
669 this->crypter_initiator->destroy(this->crypter_initiator);
670 }
671 if (this->crypter_responder != NULL)
672 {
673 this->crypter_responder->destroy(this->crypter_responder);
674 }
675
676 this->crypter_initiator = crypter_create(algo->algorithm, algo->key_size);
677 this->crypter_responder = crypter_create(algo->algorithm, algo->key_size);
678 if (this->crypter_initiator == NULL || this->crypter_responder == NULL)
679 {
680 this->logger->log(this->logger, ERROR|LEVEL1,
681 "ENCRYPTION_ALGORITHM %s (key size %d) not supported!",
682 mapping_find(encryption_algorithm_m, algo->algorithm),
683 algo->key_size);
684 return FAILED;
685 }
686 key_size = this->crypter_initiator->get_key_size(this->crypter_initiator);
687
688 prf_plus->allocate_bytes(prf_plus, key_size, &key);
689 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ei secret", &key);
690 this->crypter_initiator->set_key(this->crypter_initiator, key);
691 allocator_free_chunk(&key);
692
693 prf_plus->allocate_bytes(prf_plus, key_size, &key);
694 this->logger->log_chunk(this->logger, PRIVATE, "Sk_er secret", &key);
695 this->crypter_responder->set_key(this->crypter_responder, key);
696 allocator_free_chunk(&key);
697
698 /* SK_pi/SK_pr used for authentication */
699 proposal->get_algorithm(proposal, IKE, PSEUDO_RANDOM_FUNCTION, &algo);
700 if (this->prf_auth_i != NULL)
701 {
702 this->prf_auth_i->destroy(this->prf_auth_i);
703 }
704 if (this->prf_auth_r != NULL)
705 {
706 this->prf_auth_r->destroy(this->prf_auth_r);
707 }
708
709 this->prf_auth_i = prf_create(algo->algorithm);
710 this->prf_auth_r = prf_create(algo->algorithm);
711
712 key_size = this->prf_auth_i->get_key_size(this->prf_auth_i);
713 prf_plus->allocate_bytes(prf_plus, key_size, &key);
714 this->logger->log_chunk(this->logger, PRIVATE, "Sk_pi secret", &key);
715 this->prf_auth_i->set_key(this->prf_auth_i, key);
716 allocator_free_chunk(&key);
717
718 prf_plus->allocate_bytes(prf_plus, key_size, &key);
719 this->logger->log_chunk(this->logger, PRIVATE, "Sk_pr secret", &key);
720 this->prf_auth_r->set_key(this->prf_auth_r, key);
721 allocator_free_chunk(&key);
722
723 /* all done, prf_plus not needed anymore */
724 prf_plus->destroy(prf_plus);
725
726 return SUCCESS;
727 }
728
729 /**
730 * Implementation of protected_ike_sa_t.get_randomizer.
731 */
732 static randomizer_t *get_randomizer (private_ike_sa_t *this)
733 {
734 return this->randomizer;
735 }
736
737 /**
738 * Implementation of protected_ike_sa_t.get_crypter_initiator.
739 */
740 static crypter_t *get_crypter_initiator (private_ike_sa_t *this)
741 {
742 return this->crypter_initiator;
743 }
744
745 /**
746 * Implementation of protected_ike_sa_t.get_signer_initiator.
747 */
748 static signer_t *get_signer_initiator (private_ike_sa_t *this)
749 {
750 return this->signer_initiator;
751 }
752
753 /**
754 * Implementation of protected_ike_sa_t.get_crypter_responder.
755 */
756 static crypter_t *get_crypter_responder(private_ike_sa_t *this)
757 {
758 return this->crypter_responder;
759 }
760
761 /**
762 * Implementation of protected_ike_sa_t.get_signer_responder.
763 */
764 static signer_t *get_signer_responder (private_ike_sa_t *this)
765 {
766 return this->signer_responder;
767 }
768
769 /**
770 * Implementation of protected_ike_sa_t.send_request.
771 */
772 static status_t send_request (private_ike_sa_t *this,message_t * message)
773 {
774 retransmit_request_job_t *retransmit_job;
775 u_int32_t timeout;
776 crypter_t *crypter;
777 signer_t *signer;
778 packet_t *packet;
779 status_t status;
780
781 if (message->get_message_id(message) != this->message_id_out)
782 {
783 this->logger->log(this->logger, ERROR, "Message could not be sent cause id (%d) was not as expected (%d)",
784 message->get_message_id(message),this->message_id_out);
785 return FAILED;
786 }
787
788 /* generate packet */
789 this->logger->log(this->logger, CONTROL|LEVEL2, "Generate packet from message");
790
791 if (this->ike_sa_id->is_initiator(this->ike_sa_id))
792 {
793 crypter = this->crypter_initiator;
794 signer = this->signer_initiator;
795 }
796 else
797 {
798 crypter = this->crypter_responder;
799 signer =this->signer_responder;
800 }
801
802 status = message->generate(message, crypter,signer, &packet);
803 if (status != SUCCESS)
804 {
805 this->logger->log(this->logger, ERROR, "Could not generate packet from message");
806 return FAILED;
807 }
808
809 this->logger->log(this->logger, CONTROL|LEVEL3,
810 "Add request packet with message id %d to global send queue",
811 this->message_id_out);
812 charon->send_queue->add(charon->send_queue, packet);
813
814 if (this->last_requested_message != NULL)
815 {
816 /* destroy message */
817 this->last_requested_message->destroy(this->last_requested_message);
818 }
819
820 this->logger->log(this->logger, CONTROL|LEVEL3, "Replace last requested message with new one");
821 this->last_requested_message = message;
822
823 retransmit_job = retransmit_request_job_create(this->message_id_out,this->ike_sa_id);
824
825 status = charon->configuration->get_retransmit_timeout (charon->configuration,
826 retransmit_job->get_retransmit_count(retransmit_job),&timeout);
827
828 if (status != SUCCESS)
829 {
830 this->logger->log(this->logger, CONTROL|LEVEL2, "No retransmit job for message created!");
831 retransmit_job->destroy(retransmit_job);
832 }
833 else
834 {
835 this->logger->log(this->logger, CONTROL|LEVEL2, "Request will be retransmitted in %d ms.",timeout);
836 charon->event_queue->add_relative(charon->event_queue,(job_t *) retransmit_job,timeout);
837 }
838
839 /* message counter can now be increased */
840 this->logger->log(this->logger, CONTROL|LEVEL3,
841 "Increase message counter for outgoing messages from %d",
842 this->message_id_out);
843 this->message_id_out++;
844 return SUCCESS;
845 }
846
847 /**
848 * Implementation of protected_ike_sa_t.send_response.
849 */
850 static status_t send_response (private_ike_sa_t *this,message_t * message)
851 {
852 crypter_t *crypter;
853 signer_t *signer;
854 packet_t *packet;
855 status_t status;
856
857 if (message->get_message_id(message) != this->message_id_in)
858 {
859 this->logger->log(this->logger, ERROR, "Message could not be sent cause id was not as expected");
860 return FAILED;
861 }
862
863
864 if (this->ike_sa_id->is_initiator(this->ike_sa_id))
865 {
866 crypter = this->crypter_initiator;
867 signer = this->signer_initiator;
868 }
869 else
870 {
871 crypter = this->crypter_responder;
872 signer =this->signer_responder;
873 }
874
875 status = message->generate(message, crypter,signer, &packet);
876 if (status != SUCCESS)
877 {
878 this->logger->log(this->logger, ERROR, "Could not generate packet from message");
879 return FAILED;
880 }
881
882 this->logger->log(this->logger, CONTROL|LEVEL3,
883 "Add response packet with message id %d to global send queue",
884 this->message_id_in);
885 charon->send_queue->add(charon->send_queue, packet);
886
887 if (this->last_responded_message != NULL)
888 {
889 /* destroy message */
890 this->last_responded_message->destroy(this->last_responded_message);
891 }
892
893 this->logger->log(this->logger, CONTROL|LEVEL3, "Replace last responded message with new one");
894 this->last_responded_message = message;
895
896 /* message counter can now be increased */
897 this->logger->log(this->logger, CONTROL|LEVEL3, "Increase message counter for incoming messages");
898 this->message_id_in++;
899
900 return SUCCESS;
901 }
902
903 /**
904 * Implementation of of private_responder_init_t.send_notify_reply.
905 */
906 static void send_notify(private_ike_sa_t *this, exchange_type_t exchange_type, notify_message_type_t type, chunk_t data)
907 {
908 notify_payload_t *payload;
909 message_t *response;
910 packet_t *packet;
911 status_t status;
912
913 this->logger->log(this->logger, CONTROL|LEVEL2, "Going to build message with notify payload");
914 /* set up the reply */
915 this->protected.build_message(&(this->protected), exchange_type, FALSE, &response);
916 payload = notify_payload_create_from_protocol_and_type(IKE,type);
917 if ((data.ptr != NULL) && (data.len > 0))
918 {
919 this->logger->log(this->logger, CONTROL|LEVEL2, "Add Data to notify payload");
920 payload->set_notification_data(payload,data);
921 }
922
923 this->logger->log(this->logger, CONTROL|LEVEL2, "Add Notify payload to message");
924 response->add_payload(response,(payload_t *) payload);
925
926 /* generate packet */
927 this->logger->log(this->logger, CONTROL|LEVEL2, "Generate packet from message");
928 status = response->generate(response, this->crypter_responder, this->signer_responder, &packet);
929 if (status != SUCCESS)
930 {
931 this->logger->log(this->logger, ERROR|LEVEL1, "Could not generate notify message");
932 response->destroy(response);
933 return;
934 }
935
936 this->logger->log(this->logger, CONTROL|LEVEL2, "Add packet to global send queue");
937 charon->send_queue->add(charon->send_queue, packet);
938 this->logger->log(this->logger, CONTROL|LEVEL2, "Destroy message");
939 response->destroy(response);
940 }
941
942 /**
943 * Implementation of protected_ike_sa_t.set_last_replied_message_id.
944 */
945 static void set_last_replied_message_id (private_ike_sa_t *this,u_int32_t message_id)
946 {
947 this->last_replied_message_id = message_id;
948 }
949
950 /**
951 * Implementation of protected_ike_sa_t.get_last_responded_message.
952 */
953 static message_t * get_last_responded_message (private_ike_sa_t *this)
954 {
955 return this->last_responded_message;
956 }
957
958 /**
959 * Implementation of protected_ike_sa_t.get_last_requested_message.
960 */
961 static message_t * get_last_requested_message (private_ike_sa_t *this)
962 {
963 return this->last_requested_message;
964 }
965
966 /**
967 * Implementation of protected_ike_sa_t.get_state.
968 */
969 static ike_sa_state_t get_state (private_ike_sa_t *this)
970 {
971 return this->current_state->get_state(this->current_state);
972 }
973
974 /**
975 * Implementation of protected_ike_sa_t.get_state.
976 */
977 static void add_child_sa (private_ike_sa_t *this, child_sa_t *child_sa)
978 {
979 this->child_sas->insert_last(this->child_sas, child_sa);
980 }
981
982 /**
983 * Implementation of protected_ike_sa_t.reset_message_buffers.
984 */
985 static void reset_message_buffers (private_ike_sa_t *this)
986 {
987 this->logger->log(this->logger, CONTROL|LEVEL2, "Reset message counters and destroy stored messages");
988 /* destroy stored requested message */
989 if (this->last_requested_message != NULL)
990 {
991 this->last_requested_message->destroy(this->last_requested_message);
992 this->last_requested_message = NULL;
993 }
994
995 /* destroy stored responded messages */
996 if (this->last_responded_message != NULL)
997 {
998 this->last_responded_message->destroy(this->last_responded_message);
999 this->last_responded_message = NULL;
1000 }
1001
1002 this->message_id_out = 0;
1003 this->message_id_in = 0;
1004 this->last_replied_message_id = -1;
1005 }
1006
1007 /**
1008 * Implementation of protected_ike_sa_t.create_delete_established_ike_sa_job.
1009 */
1010 static void create_delete_established_ike_sa_job (private_ike_sa_t *this,u_int32_t timeout)
1011 {
1012 job_t *delete_job;
1013
1014 this->logger->log(this->logger, CONTROL | LEVEL1,
1015 "Going to create job to delete established IKE_SA in %d ms",
1016 timeout);
1017
1018 delete_job = (job_t *) delete_established_ike_sa_job_create(this->ike_sa_id);
1019 charon->event_queue->add_relative(charon->event_queue,delete_job, timeout);
1020 }
1021
1022 /**
1023 * Implementation of protected_ike_sa_t.destroy.
1024 */
1025 static void destroy (private_ike_sa_t *this)
1026 {
1027 child_sa_t *child_sa;
1028
1029 this->logger->log(this->logger, CONTROL|LEVEL2, "Going to destroy IKE SA %llu:%llu, role %s",
1030 this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
1031 this->ike_sa_id->get_responder_spi(this->ike_sa_id),
1032 this->ike_sa_id->is_initiator(this->ike_sa_id) ? "initiator" : "responder");
1033
1034 /* inform other peer of delete */
1035 send_delete_ike_sa_request(this);
1036
1037 while (this->child_sas->remove_last(this->child_sas, (void**)&child_sa) == SUCCESS)
1038 {
1039 child_sa->destroy(child_sa);
1040 }
1041 this->child_sas->destroy(this->child_sas);
1042 if (this->crypter_initiator != NULL)
1043 {
1044 this->crypter_initiator->destroy(this->crypter_initiator);
1045 }
1046 if (this->crypter_responder != NULL)
1047 {
1048 this->crypter_responder->destroy(this->crypter_responder);
1049 }
1050 if (this->signer_initiator != NULL)
1051 {
1052 this->signer_initiator->destroy(this->signer_initiator);
1053 }
1054 if (this->signer_responder != NULL)
1055 {
1056 this->signer_responder->destroy(this->signer_responder);
1057 }
1058 if (this->prf != NULL)
1059 {
1060 this->prf->destroy(this->prf);
1061 }
1062 if (this->child_prf != NULL)
1063 {
1064 this->child_prf->destroy(this->child_prf);
1065 }
1066 if (this->prf_auth_i != NULL)
1067 {
1068 this->prf_auth_i->destroy(this->prf_auth_i);
1069 }
1070 if (this->prf_auth_r != NULL)
1071 {
1072 this->prf_auth_r->destroy(this->prf_auth_r);
1073 }
1074 this->ike_sa_id->destroy(this->ike_sa_id);
1075 if (this->last_requested_message != NULL)
1076 {
1077 this->last_requested_message->destroy(this->last_requested_message);
1078 }
1079 if (this->last_responded_message != NULL)
1080 {
1081 this->last_responded_message->destroy(this->last_responded_message);
1082 }
1083 if (this->me.host != NULL)
1084 {
1085 this->me.host->destroy(this->me.host);
1086 }
1087 if (this->other.host != NULL)
1088 {
1089 this->other.host->destroy(this->other.host);
1090 }
1091 this->randomizer->destroy(this->randomizer);
1092 this->current_state->destroy(this->current_state);
1093 charon->logger_manager->destroy_logger(charon->logger_manager, this->logger);
1094
1095 allocator_free(this);
1096 }
1097
1098 /*
1099 * Described in header.
1100 */
1101 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
1102 {
1103 private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
1104
1105 /* Public functions */
1106 this->protected.public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
1107 this->protected.public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
1108 this->protected.public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
1109 this->protected.public.retransmit_request = (status_t (*) (ike_sa_t *, u_int32_t)) retransmit_request;
1110 this->protected.public.get_state = (ike_sa_state_t (*) (ike_sa_t *this)) get_state;
1111 this->protected.public.send_delete_ike_sa_request = (void (*)(ike_sa_t*)) send_delete_ike_sa_request;
1112 this->protected.public.destroy = (void(*)(ike_sa_t*))destroy;
1113
1114 /* protected functions */
1115 this->protected.build_message = (void (*) (protected_ike_sa_t *, exchange_type_t , bool , message_t **)) build_message;
1116 this->protected.get_prf = (prf_t *(*) (protected_ike_sa_t *)) get_prf;
1117 this->protected.get_child_prf = (prf_t *(*) (protected_ike_sa_t *)) get_child_prf;
1118 this->protected.get_prf_auth_i = (prf_t *(*) (protected_ike_sa_t *)) get_prf_auth_i;
1119 this->protected.get_prf_auth_r = (prf_t *(*) (protected_ike_sa_t *)) get_prf_auth_r;
1120 this->protected.add_child_sa = (void (*) (protected_ike_sa_t*,child_sa_t*)) add_child_sa;
1121 this->protected.get_logger = (logger_t *(*) (protected_ike_sa_t *)) get_logger;
1122 this->protected.set_init_config = (void (*) (protected_ike_sa_t *,init_config_t *)) set_init_config;
1123 this->protected.get_init_config = (init_config_t *(*) (protected_ike_sa_t *)) get_init_config;
1124 this->protected.set_sa_config = (void (*) (protected_ike_sa_t *,sa_config_t *)) set_sa_config;
1125 this->protected.get_sa_config = (sa_config_t *(*) (protected_ike_sa_t *)) get_sa_config;
1126 this->protected.get_my_host = (host_t *(*) (protected_ike_sa_t *)) get_my_host;
1127 this->protected.get_other_host = (host_t *(*) (protected_ike_sa_t *)) get_other_host;
1128 this->protected.set_my_host = (void(*) (protected_ike_sa_t *,host_t *)) set_my_host;
1129 this->protected.set_other_host = (void(*) (protected_ike_sa_t *, host_t *)) set_other_host;
1130 this->protected.get_randomizer = (randomizer_t *(*) (protected_ike_sa_t *)) get_randomizer;
1131 this->protected.send_request = (status_t (*) (protected_ike_sa_t *,message_t *)) send_request;
1132 this->protected.send_response = (status_t (*) (protected_ike_sa_t *,message_t *)) send_response;
1133 this->protected.send_notify = (void (*)(protected_ike_sa_t*,exchange_type_t,notify_message_type_t,chunk_t)) send_notify;
1134 this->protected.build_transforms = (status_t (*) (protected_ike_sa_t *,proposal_t*,diffie_hellman_t*,chunk_t,chunk_t)) build_transforms;
1135 this->protected.set_new_state = (void (*) (protected_ike_sa_t *,state_t *)) set_new_state;
1136 this->protected.get_crypter_initiator = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_initiator;
1137 this->protected.get_signer_initiator = (signer_t *(*) (protected_ike_sa_t *)) get_signer_initiator;
1138 this->protected.get_crypter_responder = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_responder;
1139 this->protected.get_signer_responder = (signer_t *(*) (protected_ike_sa_t *)) get_signer_responder;
1140 this->protected.reset_message_buffers = (void (*) (protected_ike_sa_t *)) reset_message_buffers;
1141 this->protected.get_last_responded_message = (message_t * (*) (protected_ike_sa_t *this)) get_last_responded_message;
1142 this->protected.get_last_requested_message = (message_t * (*) (protected_ike_sa_t *this)) get_last_requested_message;
1143 this->protected.create_delete_established_ike_sa_job = (void (*) (protected_ike_sa_t *this,u_int32_t)) create_delete_established_ike_sa_job;
1144
1145 this->protected.set_last_replied_message_id = (void (*) (protected_ike_sa_t *,u_int32_t)) set_last_replied_message_id;
1146
1147 /* private functions */
1148 this->resend_last_reply = resend_last_reply;
1149
1150 /* initialize private fields */
1151 this->logger = charon->logger_manager->create_logger(charon->logger_manager, IKE_SA, NULL);
1152
1153 this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
1154 this->child_sas = linked_list_create();
1155 this->randomizer = randomizer_create();
1156
1157 this->me.host = NULL;
1158 this->other.host = NULL;
1159 this->last_requested_message = NULL;
1160 this->last_responded_message = NULL;
1161 this->message_id_out = 0;
1162 this->message_id_in = 0;
1163 this->last_replied_message_id = -1;
1164 this->crypter_initiator = NULL;
1165 this->crypter_responder = NULL;
1166 this->signer_initiator = NULL;
1167 this->signer_responder = NULL;
1168 this->prf = NULL;
1169 this->prf_auth_i = NULL;
1170 this->prf_auth_r = NULL;
1171 this->child_prf = NULL;
1172 this->init_config = NULL;
1173 this->sa_config = NULL;
1174
1175 /* at creation time, IKE_SA is in a initiator state */
1176 if (ike_sa_id->is_initiator(ike_sa_id))
1177 {
1178 this->logger->log(this->logger, CONTROL | LEVEL2, "Create first state_t object of type INITIATOR_INIT");
1179 this->current_state = (state_t *) initiator_init_create(&(this->protected));
1180 }
1181 else
1182 {
1183 this->logger->log(this->logger, CONTROL | LEVEL2, "Create first state_t object of type RESPONDER_INIT");
1184 this->current_state = (state_t *) responder_init_create(&(this->protected));
1185 }
1186 return &(this->protected.public);
1187 }